diff options
| author | Daiki Ueno <ueno@gnu.org> | 2020-06-04 16:42:07 +0200 |
|---|---|---|
| committer | Daiki Ueno <ueno@gnu.org> | 2020-09-03 09:57:13 +0200 |
| commit | fd35e0528a64d41f4b94b74e9133d6742349dda3 (patch) | |
| tree | 4cc201f8f5fd9d5627a58370fad56b223c575e75 | |
| parent | 8266600c0730dba7dd6d4b2a4083748fa5396e4e (diff) | |
| download | gnutls-fd35e0528a64d41f4b94b74e9133d6742349dda3.tar.gz | |
_gnutls_fips_mode_enabled: treat selftest failure as FIPS disabled
Previously gnutls_fips140_mode_enabled() returned true, even after
selftests have failed and the library state has switched to error.
While later calls to crypto operations fails, it would be more
convenient to have a function to detect that state.
Signed-off-by: Daiki Ueno <ueno@gnu.org>
| -rw-r--r-- | lib/fips.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/lib/fips.c b/lib/fips.c index acdd2ec23e..f8b10f7502 100644 --- a/lib/fips.c +++ b/lib/fips.c @@ -491,8 +491,17 @@ unsigned gnutls_fips140_mode_enabled(void) #ifdef ENABLE_FIPS140 unsigned ret = _gnutls_fips_mode_enabled(); - if (ret > GNUTLS_FIPS140_DISABLED) + if (ret > GNUTLS_FIPS140_DISABLED) { + /* If the previous run of selftests has failed, return as if + * the FIPS mode is disabled. We could use HAVE_LIB_ERROR, if + * we can assume that all the selftests run atomically from + * the ELF constructor. + */ + if (_gnutls_get_lib_state() == LIB_STATE_ERROR) + return 0; + return ret; + } #endif return 0; } |