diff options
| author | Daiki Ueno <ueno@gnu.org> | 2020-06-04 16:42:07 +0200 |
|---|---|---|
| committer | Daiki Ueno <ueno@gnu.org> | 2020-08-12 09:31:34 +0200 |
| commit | eb2bf4a2db2b3caf36fda830ea08e932c00eca86 (patch) | |
| tree | b4c76ce3fc132f97f3f58454b34cf88a51224457 | |
| parent | 606b77a2422c7e4124d80904bd191184323205fc (diff) | |
| download | gnutls-tmp-fips-enabled.tar.gz | |
_gnutls_fips_mode_enabled: treat selftest failure as FIPS disabledtmp-fips-enabled
Previously gnutls_fips140_mode_enabled() returned true, even after
selftests have failed and the library state has switched to error.
While later calls to crypto operations fails, it would be more
convenient to have a function to detect that state.
Signed-off-by: Daiki Ueno <ueno@gnu.org>
| -rw-r--r-- | lib/fips.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/lib/fips.c b/lib/fips.c index acdd2ec23e..f8b10f7502 100644 --- a/lib/fips.c +++ b/lib/fips.c @@ -491,8 +491,17 @@ unsigned gnutls_fips140_mode_enabled(void) #ifdef ENABLE_FIPS140 unsigned ret = _gnutls_fips_mode_enabled(); - if (ret > GNUTLS_FIPS140_DISABLED) + if (ret > GNUTLS_FIPS140_DISABLED) { + /* If the previous run of selftests has failed, return as if + * the FIPS mode is disabled. We could use HAVE_LIB_ERROR, if + * we can assume that all the selftests run atomically from + * the ELF constructor. + */ + if (_gnutls_get_lib_state() == LIB_STATE_ERROR) + return 0; + return ret; + } #endif return 0; } |