leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

crypto: jitter - don't limit ->health_failure check to FIPS mode

Browse Source 
The jitterentropy's Repetition Count Test (RCT) as well as the Adaptive
Proportion Test (APT) are run unconditionally on any collected samples.
However, their result, i.e. ->health_failure, will only get checked if
fips_enabled is set, c.f. the jent_health_failure() wrapper.

I would argue that a RCT or APT failure indicates that something's
seriously off and that this should always be reported as an error,
independently of whether FIPS mode is enabled or not: it should be up to
callers whether or not and how to handle jitterentropy failures.

Make jent_health_failure() to unconditionally return ->health_failure,
independent of whether fips_enabled is set.

Note that fips_enabled isn't accessed from the jitterentropy code anymore
now. Remove the linux/fips.h include as well as the jent_fips_enabled()
wrapper.

Signed-off-by: Nicolai Stange <nstange@suse.de>
Reviewed-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Nicolai Stange 2021-11-30 15:10:08 +01:00 committed by Herbert Xu
parent 8f79772843
commit b454fb7025
3 changed files with 0 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
crypto/jitterentropy-kcapi.c
View File

@ -40,7 +40,6 @@
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/fips.h>
#include <linux/time.h> #include <linux/time.h>
#include <crypto/internal/rng.h> #include <crypto/internal/rng.h>
@ -60,11 +59,6 @@ void jent_zfree(void *ptr)
kfree_sensitive(ptr); kfree_sensitive(ptr);
} }
int jent_fips_enabled(void)
{
return fips_enabled;
}
void jent_panic(char *s) void jent_panic(char *s)
{ {
panic("%s", s); panic("%s", s);

4
crypto/jitterentropy.c
View File

@ -298,10 +298,6 @@ static int jent_stuck(struct rand_data *ec, __u64 current_delta)
*/ */
static int jent_health_failure(struct rand_data *ec) static int jent_health_failure(struct rand_data *ec)
{ {
/* Test is only enabled in FIPS mode */
if (!jent_fips_enabled())
return 0;
return ec->health_failure; return ec->health_failure;
} }

1
crypto/jitterentropy.h
View File

@ -2,7 +2,6 @@
extern void *jent_zalloc(unsigned int len); extern void *jent_zalloc(unsigned int len);
extern void jent_zfree(void *ptr); extern void jent_zfree(void *ptr);
extern int jent_fips_enabled(void);
extern void jent_panic(char *s); extern void jent_panic(char *s);
extern void jent_memcpy(void *dest, const void *src, unsigned int n); extern void jent_memcpy(void *dest, const void *src, unsigned int n);
extern void jent_get_nstime(__u64 *out); extern void jent_get_nstime(__u64 *out);