|
 |
873a72 |
diff -ur gnutls-3.3.8.orig/lib/fips.c gnutls-3.3.8/lib/fips.c
|
|
|
873a72 |
--- gnutls-3.3.8.orig/lib/fips.c 2014-09-04 21:05:54.000000000 +0200
|
|
|
873a72 |
+++ gnutls-3.3.8/lib/fips.c 2014-11-18 09:46:47.376148426 +0100
|
|
|
873a72 |
@@ -37,6 +37,8 @@
|
|
|
873a72 |
#define FIPS_KERNEL_FILE "/proc/sys/crypto/fips_enabled"
|
|
|
873a72 |
#define FIPS_SYSTEM_FILE "/etc/system-fips"
|
|
|
873a72 |
|
|
|
873a72 |
+static int _fips_mode = -1;
|
|
|
873a72 |
+
|
|
|
873a72 |
/* Returns:
|
|
|
873a72 |
* 0 - FIPS mode disabled
|
|
|
873a72 |
* 1 - FIPS mode enabled and enforced
|
|
|
873a72 |
@@ -46,21 +48,20 @@
|
|
|
873a72 |
{
|
|
|
873a72 |
unsigned f1p = 0, f2p;
|
|
|
873a72 |
FILE* fd;
|
|
|
873a72 |
-static int fips_mode = -1;
|
|
|
873a72 |
const char *p;
|
|
|
873a72 |
|
|
|
873a72 |
- if (fips_mode != -1)
|
|
|
873a72 |
- return fips_mode;
|
|
|
873a72 |
+ if (_fips_mode != -1)
|
|
|
873a72 |
+ return _fips_mode;
|
|
|
873a72 |
|
|
|
873a72 |
p = getenv("GNUTLS_FORCE_FIPS_MODE");
|
|
|
873a72 |
if (p) {
|
|
|
873a72 |
if (p[0] == '1')
|
|
|
873a72 |
- fips_mode = 1;
|
|
|
873a72 |
+ _fips_mode = 1;
|
|
|
873a72 |
else if (p[0] == '2')
|
|
|
873a72 |
- fips_mode = 2;
|
|
|
873a72 |
+ _fips_mode = 2;
|
|
|
873a72 |
else
|
|
|
873a72 |
- fips_mode = 0;
|
|
|
873a72 |
- return fips_mode;
|
|
|
873a72 |
+ _fips_mode = 0;
|
|
|
873a72 |
+ return _fips_mode;
|
|
|
873a72 |
}
|
|
|
873a72 |
|
|
|
873a72 |
fd = fopen(FIPS_KERNEL_FILE, "r");
|
|
|
873a72 |
@@ -76,20 +77,29 @@
|
|
|
873a72 |
|
|
|
873a72 |
if (f1p != 0 && f2p != 0) {
|
|
|
873a72 |
_gnutls_debug_log("FIPS140-2 mode enabled\n");
|
|
|
873a72 |
- fips_mode = 1;
|
|
|
873a72 |
- return fips_mode;
|
|
|
873a72 |
+ _fips_mode = 1;
|
|
|
873a72 |
+ return _fips_mode;
|
|
|
873a72 |
}
|
|
|
873a72 |
|
|
|
873a72 |
if (f2p != 0) {
|
|
|
873a72 |
/* a funny state where self tests are performed
|
|
|
873a72 |
* and ignored */
|
|
|
873a72 |
_gnutls_debug_log("FIPS140-2 ZOMBIE mode enabled\n");
|
|
|
873a72 |
- fips_mode = 2;
|
|
|
873a72 |
- return fips_mode;
|
|
|
873a72 |
+ _fips_mode = 2;
|
|
|
873a72 |
+ return _fips_mode;
|
|
|
873a72 |
}
|
|
|
873a72 |
|
|
|
873a72 |
- fips_mode = 0;
|
|
|
873a72 |
- return fips_mode;
|
|
|
873a72 |
+ _fips_mode = 0;
|
|
|
873a72 |
+ return _fips_mode;
|
|
|
873a72 |
+}
|
|
|
873a72 |
+
|
|
|
873a72 |
+/* This _fips_mode == 2 is a strange mode where checks are being
|
|
|
873a72 |
+ * performed, but its output is ignored. */
|
|
|
873a72 |
+void _gnutls_fips_mode_reset_zombie(void)
|
|
|
873a72 |
+{
|
|
|
873a72 |
+ if (_fips_mode == 2) {
|
|
|
873a72 |
+ _fips_mode = 0;
|
|
|
873a72 |
+ }
|
|
|
873a72 |
}
|
|
|
873a72 |
|
|
|
873a72 |
#define GNUTLS_LIBRARY_NAME "libgnutls.so.28"
|
|
|
873a72 |
@@ -367,6 +377,9 @@
|
|
|
873a72 |
goto error;
|
|
|
873a72 |
}
|
|
|
873a72 |
|
|
|
873a72 |
+ if (_fips_mode == 2)
|
|
|
873a72 |
+ _fips_mode = 0;
|
|
|
873a72 |
+
|
|
|
873a72 |
return 0;
|
|
|
873a72 |
|
|
|
873a72 |
error:
|
|
|
873a72 |
Only in gnutls-3.3.8/lib: fips.c.orig
|
|
|
873a72 |
diff -ur gnutls-3.3.8.orig/lib/fips.h gnutls-3.3.8/lib/fips.h
|
|
|
873a72 |
--- gnutls-3.3.8.orig/lib/fips.h 2014-09-04 21:05:54.000000000 +0200
|
|
|
873a72 |
+++ gnutls-3.3.8/lib/fips.h 2014-11-18 09:46:47.377148445 +0100
|
|
|
873a72 |
@@ -55,6 +55,7 @@
|
|
|
873a72 |
|
|
|
873a72 |
int _gnutls_fips_perform_self_checks1(void);
|
|
|
873a72 |
int _gnutls_fips_perform_self_checks2(void);
|
|
|
873a72 |
+void _gnutls_fips_mode_reset_zombie(void);
|
|
|
873a72 |
|
|
|
873a72 |
#ifdef ENABLE_FIPS140
|
|
|
873a72 |
unsigned _gnutls_fips_mode_enabled(void);
|
|
|
873a72 |
diff -ur gnutls-3.3.8.orig/lib/gnutls_global.c gnutls-3.3.8/lib/gnutls_global.c
|
|
|
873a72 |
--- gnutls-3.3.8.orig/lib/gnutls_global.c 2014-09-04 21:05:54.000000000 +0200
|
|
|
873a72 |
+++ gnutls-3.3.8/lib/gnutls_global.c 2014-11-18 09:46:47.377148445 +0100
|
|
|
873a72 |
@@ -326,6 +326,7 @@
|
|
|
873a72 |
goto out;
|
|
|
873a72 |
}
|
|
|
873a72 |
}
|
|
|
873a72 |
+ _gnutls_fips_mode_reset_zombie();
|
|
|
873a72 |
}
|
|
|
873a72 |
#endif
|
|
|
873a72 |
_gnutls_switch_lib_state(LIB_STATE_OPERATIONAL);
|
|
|
873a72 |
Only in gnutls-3.3.8/lib: gnutls_global.c.orig
|