diff options
| -rw-r--r-- | lib/fips.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/lib/fips.c b/lib/fips.c index acdd2ec23e..f8b10f7502 100644 --- a/lib/fips.c +++ b/lib/fips.c @@ -491,8 +491,17 @@ unsigned gnutls_fips140_mode_enabled(void) #ifdef ENABLE_FIPS140 unsigned ret = _gnutls_fips_mode_enabled(); - if (ret > GNUTLS_FIPS140_DISABLED) + if (ret > GNUTLS_FIPS140_DISABLED) { + /* If the previous run of selftests has failed, return as if + * the FIPS mode is disabled. We could use HAVE_LIB_ERROR, if + * we can assume that all the selftests run atomically from + * the ELF constructor. + */ + if (_gnutls_get_lib_state() == LIB_STATE_ERROR) + return 0; + return ret; + } #endif return 0; } |