aboutsummaryrefslogtreecommitdiffstats
path: root/crypto
diff options
context:
space:
mode:
authorNeil Horman <nhorman@tuxdriver.com>2009-02-05 00:01:38 -0500
committerHerbert Xu <herbert@gondor.apana.org.au>2009-02-18 03:48:07 -0500
commitc5b1e545a567c52081239bd5d187669640d0146f (patch)
tree8e55b9fc925e420b3bda30d0a70e611badc562bb /crypto
parent563f346d04e8373739240604a51ce8529dd9f07e (diff)
crypto: ansi_cprng - Panic on CPRNG test failure when in FIPS mode
FIPS 140-2 specifies that all access to various cryptographic modules be prevented in the event that any of the provided self tests fail on the various implemented algorithms. We already panic when any of the test in testmgr.c fail when we are operating in fips mode. The continuous test in the cprng here was missed when that was implmented. This code simply checks for the fips_enabled flag if the test fails, and warns us via syslog or panics the box accordingly. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto')
-rw-r--r--crypto/ansi_cprng.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
index 74478061ac0c..d80ed4c1e009 100644
--- a/crypto/ansi_cprng.c
+++ b/crypto/ansi_cprng.c
@@ -132,9 +132,15 @@ static int _get_more_prng_bytes(struct prng_context *ctx)
132 */ 132 */
133 if (!memcmp(ctx->rand_data, ctx->last_rand_data, 133 if (!memcmp(ctx->rand_data, ctx->last_rand_data,
134 DEFAULT_BLK_SZ)) { 134 DEFAULT_BLK_SZ)) {
135 if (fips_enabled) {
136 panic("cprng %p Failed repetition check!\n",
137 ctx);
138 }
139
135 printk(KERN_ERR 140 printk(KERN_ERR
136 "ctx %p Failed repetition check!\n", 141 "ctx %p Failed repetition check!\n",
137 ctx); 142 ctx);
143
138 ctx->flags |= PRNG_NEED_RESET; 144 ctx->flags |= PRNG_NEED_RESET;
139 return -EINVAL; 145 return -EINVAL;
140 } 146 }