summaryrefslogtreecommitdiff
path: root/crypto/ansi_cprng.c
diff options
context:
space:
mode:
authorNeil Horman <nhorman@tuxdriver.com>2009-02-05 05:01:38 (GMT)
committerHerbert Xu <herbert@gondor.apana.org.au>2009-02-18 08:48:07 (GMT)
commitc5b1e545a567c52081239bd5d187669640d0146f (patch)
tree8e55b9fc925e420b3bda30d0a70e611badc562bb /crypto/ansi_cprng.c
parent563f346d04e8373739240604a51ce8529dd9f07e (diff)
downloadlinux-c5b1e545a567c52081239bd5d187669640d0146f.tar.xz
crypto: ansi_cprng - Panic on CPRNG test failure when in FIPS mode
FIPS 140-2 specifies that all access to various cryptographic modules be prevented in the event that any of the provided self tests fail on the various implemented algorithms. We already panic when any of the test in testmgr.c fail when we are operating in fips mode. The continuous test in the cprng here was missed when that was implmented. This code simply checks for the fips_enabled flag if the test fails, and warns us via syslog or panics the box accordingly. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/ansi_cprng.c')
-rw-r--r--crypto/ansi_cprng.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
index 7447806..d80ed4c 100644
--- a/crypto/ansi_cprng.c
+++ b/crypto/ansi_cprng.c
@@ -132,9 +132,15 @@ static int _get_more_prng_bytes(struct prng_context *ctx)
*/
if (!memcmp(ctx->rand_data, ctx->last_rand_data,
DEFAULT_BLK_SZ)) {
+ if (fips_enabled) {
+ panic("cprng %p Failed repetition check!\n",
+ ctx);
+ }
+
printk(KERN_ERR
"ctx %p Failed repetition check!\n",
ctx);
+
ctx->flags |= PRNG_NEED_RESET;
return -EINVAL;
}