lkml.org 
[lkml]   [2009]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH] crypto: Force panic on continuous CPRNG test failure when in FIPS mode
On Wed, Jan 28, 2009 at 03:18:28PM +1100, Herbert Xu wrote:
>
> I'm OK with this change but I'd like it to look like:
>
> if (fips_enabled) {
> panic(...)
> }
>
> blah blah blah
>
> This way the FIPS crap doesn't get in the way of everyday use.
>
> Thanks,


Sure, new patch, extra commentary removed. Also brought the panic/printk text
into agreement.


FIPS 140-2 specifies that all access to various cryptographic modules be
prevented in the event that any of the provided self tests fail on the various
implemented algorithms. We already panic when any of the test in testmgr.c
fail when we are operating in fips mode. The continuous test in the cprng here
was missed when that was implmented. This code simply checks for the
fips_enabled flag if the test fails, and warns us via syslog or panics the box
accordingly.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>


ansi_cprng.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)


diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
index 7447806..3003f21 100644
--- a/crypto/ansi_cprng.c
+++ b/crypto/ansi_cprng.c
@@ -132,10 +132,15 @@ static int _get_more_prng_bytes(struct prng_context *ctx)
*/
if (!memcmp(ctx->rand_data, ctx->last_rand_data,
DEFAULT_BLK_SZ)) {
- printk(KERN_ERR
- "ctx %p Failed repetition check!\n",
- ctx);
- ctx->flags |= PRNG_NEED_RESET;
+ if (fips_enabled) {
+ panic("cprng %p Failed repetition check!\n",
+ ctx);
+ } else {
+ printk(KERN_ERR
+ "ctx %p Failed repetition check!\n",
+ ctx);
+ ctx->flags |= PRNG_NEED_RESET;
+ }
return -EINVAL;
}
memcpy(ctx->last_rand_data, ctx->rand_data,

\
 
 \ /
  Last update: 2009-01-28 13:17    [W:0.586 / U:0.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site