crypto: ansi_cprng - Panic on CPRNG test failure when in FIPS mode

FIPS 140-2 specifies that all access to various cryptographic modules be prevented in the event that any of the provided self tests fail on the various implemented algorithms. We already panic when any of the test in testmgr.c fail when we are operating in fips mode. The continuous test in the cprng here was missed when that was implmented. This code simply checks for the fips_enabled flag if the test fails, and warns us via syslog or panics the box accordingly. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

crypto: ansi_cprng - Panic on CPRNG test failure when in FIPS mode
FIPS 140-2 specifies that all access to various cryptographic modules be prevented in the event that any of the provided self tests fail on the various implemented algorithms. We already panic when any of the test in testmgr.c fail when we are operating in fips mode. The continuous test in the cprng here was missed when that was implmented. This code simply checks for the fips_enabled flag if the test fails, and warns us via syslog or panics the box accordingly. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Neil Horman · Herbert Xu
1 parent 563f346d04
Showing 1 changed file with 6 additions and 0 deletions Side-by-side Diff
crypto/ansi_cprng.c
@@ -132,9 +132,15 @@
 			 */
 			if (!memcmp(ctx->rand_data, ctx->last_rand_data,
 					DEFAULT_BLK_SZ)) {
+				if (fips_enabled) {
+					panic("cprng %p Failed repetition check!\n",
+						ctx);
+				}
+
 				printk(KERN_ERR
 					"ctx %p Failed repetition check!\n",
 					ctx);
+
 				ctx->flags |= PRNG_NEED_RESET;
 				return -EINVAL;
 			}
...	...	@@ -132,9 +132,15 @@
132	132	*/
133	133	if (!memcmp(ctx->rand_data, ctx->last_rand_data,
134	134	DEFAULT_BLK_SZ)) {
	135	+ if (fips_enabled) {
	136	+ panic("cprng %p Failed repetition check!\n",
	137	+ ctx);
	138	+ }
	139	+
135	140	printk(KERN_ERR
136	141	"ctx %p Failed repetition check!\n",
137	142	ctx);
	143	+
138	144	ctx->flags \|= PRNG_NEED_RESET;
139	145	return -EINVAL;
140	146	}