Re: [PATCH] crypto: Force panic on continuous CPRNG test failure when in FIPS mode

2009-01-28 Thread Herbert Xu 
On Wed, Jan 28, 2009 at 07:15:11AM -0500, Neil Horman wrote:
 On Wed, Jan 28, 2009 at 03:18:28PM +1100, Herbert Xu wrote:
  
  I'm OK with this change but I'd like it to look like:
  
  if (fips_enabled) {
  panic(...)
  }
  
  blah blah blah
  
  This way the FIPS crap doesn't get in the way of everyday use.
  
  Thanks,
 
 
 Sure, new patch, extra commentary removed.  Also brought the panic/printk text
 into agreement.

Hmm no I wasn't referring to the comment, but rather that you
should just move the stuff in the else branch into the main code
path since the panic makes the else redundant.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmVHI~} herb...@gondor.apana.org.au
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line unsubscribe linux-crypto in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] crypto: Force panic on continuous CPRNG test failure when in FIPS mode

2009-01-23 Thread Neil Horman 

FIPS 140-2 specifies that all access to various cryptographic modules be
prevented in the event that any of the provided self tests fail on the various
implemented algorithms. The way this is currently done is by simply panicing the
box.  We do this already for the various alg tests in testmgr.c, we should do it
in the case of a failure for the continuous test in the CPRNG as well.  This
patch implements that change

Signed-off-by: Neil Horman nhor...@tuxdriver.com

diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
index 0fac8ff..7eef5be 100644
--- a/crypto/ansi_cprng.c
+++ b/crypto/ansi_cprng.c
@@ -132,10 +132,20 @@ static int _get_more_prng_bytes(struct prng_context *ctx)
 */
if (!memcmp(ctx-rand_data, ctx-last_rand_data,
DEFAULT_BLK_SZ)) {
-   printk(KERN_ERR
-   ctx %p Failed repetition check!\n,
-   ctx);
-   ctx-flags |= PRNG_NEED_RESET;
+   if (fips_enabled) {
+   /* FIPS 140-2 requires that we disable
+* further use of crypto code if we fail
+* this test,  easiest way to do that
+* is panic the box
+*/
+   panic(cprng %p failed continuity test,
+   ctx);  
+   } else {
+   printk(KERN_ERR
+   ctx %p Failed repetition 
check!\n,
+   ctx);
+   ctx-flags |= PRNG_NEED_RESET;
+   }
return -EINVAL;
}
memcpy(ctx-last_rand_data, ctx-rand_data,
--
To unsubscribe from this list: send the line unsubscribe linux-crypto in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html