diff options
| author | Daiki Ueno <ueno@gnu.org> | 2020-08-14 17:22:37 +0000 |
|---|---|---|
| committer | Daiki Ueno <ueno@gnu.org> | 2020-08-14 17:22:37 +0000 |
| commit | 5995580f003b0c00b7bcb1df98bdbb4434008eab (patch) | |
| tree | 4f180dad671c97f2fc7c7643198bcb238b4f0c69 | |
| parent | 7b4f6d1f48ea2b65e9a57260dae50bf5d8448b31 (diff) | |
| parent | eb2bf4a2db2b3caf36fda830ea08e932c00eca86 (diff) | |
| download | gnutls-5995580f003b0c00b7bcb1df98bdbb4434008eab.tar.gz | |
Merge branch 'tmp-fips-enabled' into 'master'
_gnutls_fips_mode_enabled: treat selftest failure as FIPS disabled
See merge request gnutls/gnutls!1306
| -rw-r--r-- | lib/fips.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/lib/fips.c b/lib/fips.c index acdd2ec23e..f8b10f7502 100644 --- a/lib/fips.c +++ b/lib/fips.c @@ -491,8 +491,17 @@ unsigned gnutls_fips140_mode_enabled(void) #ifdef ENABLE_FIPS140 unsigned ret = _gnutls_fips_mode_enabled(); - if (ret > GNUTLS_FIPS140_DISABLED) + if (ret > GNUTLS_FIPS140_DISABLED) { + /* If the previous run of selftests has failed, return as if + * the FIPS mode is disabled. We could use HAVE_LIB_ERROR, if + * we can assume that all the selftests run atomically from + * the ELF constructor. + */ + if (_gnutls_get_lib_state() == LIB_STATE_ERROR) + return 0; + return ret; + } #endif return 0; } |