• Nicolai Stange's avatar
    crypto: jitter - don't limit ->health_failure check to FIPS mode · b454fb70
    Nicolai Stange authored
    The jitterentropy's Repetition Count Test (RCT) as well as the Adaptive
    Proportion Test (APT) are run unconditionally on any collected samples.
    However, their result, i.e. ->health_failure, will only get checked if
    fips_enabled is set, c.f. the jent_health_failure() wrapper.
    
    I would argue that a RCT or APT failure indicates that something's
    seriously off and that this should always be reported as an error,
    independently of whether FIPS mode is enabled or not: it should be up to
    callers whether or not and how to handle jitterentropy failures.
    
    Make jent_health_failure() to unconditionally return ->health_failure,
    independent of whether fips_enabled is set.
    
    Note that fips_enabled isn't accessed from the jitterentropy code anymore
    now. Remove the linux/fips.h include as well as the jent_fips_enabled()
    wrapper.
    Signed-off-by: default avatarNicolai Stange <nstange@suse.de>
    Reviewed-by: default avatarStephan Mueller <smueller@chronox.de>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    b454fb70
jitterentropy.h 607 Bytes