p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

crypto: jitter - don't limit ->health_failure check to FIPS mode 

The jitterentropy's Repetition Count Test (RCT) as well as the Adaptive
Proportion Test (APT) are run unconditionally on any collected samples.
However, their result, i.e. ->health_failure, will only get checked if
fips_enabled is set, c.f. the jent_health_failure() wrapper.

I would argue that a RCT or APT failure indicates that something's
seriously off and that this should always be reported as an error,
independently of whether FIPS mode is enabled or not: it should be up to
callers whether or not and how to handle jitterentropy failures.

Make jent_health_failure() to unconditionally return ->health_failure,
independent of whether fips_enabled is set.

Note that fips_enabled isn't accessed from the jitterentropy code anymore
now. Remove the linux/fips.h include as well as the jent_fips_enabled()
wrapper.

Signed-off-by: Nicolai Stange <nstange@suse.de>
Reviewed-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Nicolai Stange 2021-11-30 15:10:08 +01:00 committed by Herbert Xu
parent 8f79772843
commit b454fb7025
3 changed files with 0 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
crypto/jitterentropy-kcapi.c
View File

@ -40,7 +40,6 @@
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/fips.h>
#include <linux/time.h> #include <linux/time.h>
#include <crypto/internal/rng.h> #include <crypto/internal/rng.h>
@ -60,11 +59,6 @@ void jent_zfree(void *ptr)
kfree_sensitive(ptr); kfree_sensitive(ptr);
} }
int jent_fips_enabled(void)
{
return fips_enabled;
}
void jent_panic(char *s) void jent_panic(char *s)
{ {
panic("%s", s); panic("%s", s);

4
crypto/jitterentropy.c
View File

@ -298,10 +298,6 @@ static int jent_stuck(struct rand_data *ec, __u64 current_delta)
*/ */
static int jent_health_failure(struct rand_data *ec) static int jent_health_failure(struct rand_data *ec)
{ {
/* Test is only enabled in FIPS mode */
if (!jent_fips_enabled())
return 0;
return ec->health_failure; return ec->health_failure;
} }

1
crypto/jitterentropy.h
View File

@ -2,7 +2,6 @@
extern void *jent_zalloc(unsigned int len); extern void *jent_zalloc(unsigned int len);
extern void jent_zfree(void *ptr); extern void jent_zfree(void *ptr);
extern int jent_fips_enabled(void);
extern void jent_panic(char *s); extern void jent_panic(char *s);
extern void jent_memcpy(void *dest, const void *src, unsigned int n); extern void jent_memcpy(void *dest, const void *src, unsigned int n);
extern void jent_get_nstime(__u64 *out); extern void jent_get_nstime(__u64 *out);