From 482b77da5eaf44e628b003ae63e6cabcb5bc2d3d Mon Sep 17 00:00:00 2001
From: Nicolai Stange <nstange@suse.de>
Date: Tue, 30 Nov 2021 11:58:52 +0100
Subject: [PATCH 1/3] crypto: drbg - ignore jitterentropy errors if not in FIPS
mode
References: jsc#SLE-21132,bsc#1191259
Patch-mainline: v5.17-rc1
Git-commit: 8f7977284331d0b0f210efa98a5d3fdcb2a65dd3
A subsequent patch will make the jitterentropy RNG to unconditionally
report health test errors back to callers, independent of whether
fips_enabled is set or not. The DRBG needs access to a functional
jitterentropy instance only in FIPS mode (because it's the only SP800-90B
compliant entropy source as it currently stands). Thus, it is perfectly
fine for the DRBGs to obtain entropy from the jitterentropy source only
on a best effort basis if fips_enabled is off.
Make the DRBGs to ignore jitterentropy failues if fips_enabled is not set.
Signed-off-by: Nicolai Stange <nstange@suse.de>
---
crypto/drbg.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1193,11 +1193,14 @@ static int drbg_seed(struct drbg_state *
pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
entropylen);
} else {
- /* Get seed from Jitter RNG */
+ /*
+ * Get seed from Jitter RNG, failures are
+ * fatal only in FIPS mode.
+ */
ret = crypto_rng_get_bytes(drbg->jent,
entropy + entropylen,
entropylen);
- if (ret) {
+ if (fips_enabled && ret) {
pr_devel("DRBG: jent failed with %d\n", ret);
/*