|
 |
95b286 |
diff --git a/src/config.h.in b/src/config.h.in
|
|
|
95b286 |
index 7d61220..ca0b1a8 100644
|
|
|
95b286 |
--- a/src/config.h.in
|
|
|
95b286 |
+++ b/src/config.h.in
|
|
|
95b286 |
@@ -478,3 +478,12 @@
|
|
|
95b286 |
|
|
|
95b286 |
/* Define to inline symbol or empty */
|
|
|
95b286 |
#undef inline
|
|
|
95b286 |
+
|
|
|
95b286 |
+/* Do we need FIPS warning? */
|
|
|
95b286 |
+#undef HAVE_FIPS_WARNING
|
|
|
95b286 |
+
|
|
|
95b286 |
+/* Link to system-fips file */
|
|
|
95b286 |
+#undef SYSTEM_FIPS_FILE_LINK
|
|
|
95b286 |
+
|
|
|
95b286 |
+/* Link to fips_enabled file */
|
|
|
95b286 |
+#undef FIPS_ENABLED_FILE_LINK
|
|
|
95b286 |
diff --git a/src/configure.ac b/src/configure.ac
|
|
|
95b286 |
index 1e7d444..5e45762 100644
|
|
|
95b286 |
--- a/src/configure.ac
|
|
|
95b286 |
+++ b/src/configure.ac
|
|
|
95b286 |
@@ -525,6 +525,38 @@ else
|
|
|
95b286 |
AC_MSG_RESULT(yes)
|
|
|
95b286 |
fi
|
|
|
95b286 |
|
|
|
95b286 |
+dnl Checking if we want FIPS warning
|
|
|
95b286 |
+
|
|
|
95b286 |
+AC_MSG_CHECKING(--enable-fips-warning)
|
|
|
95b286 |
+AC_ARG_ENABLE([fips-warning],
|
|
|
95b286 |
+ AS_HELP_STRING([--enable-fips-warning], [Enable FIPS warning]),
|
|
|
95b286 |
+ ,[enable_fips_warning="no"])
|
|
|
95b286 |
+
|
|
|
95b286 |
+if test "$enable_fips_warning" = "yes"; then
|
|
|
95b286 |
+ AC_MSG_RESULT(yes)
|
|
|
95b286 |
+ AC_DEFINE([HAVE_FIPS_WARNING])
|
|
|
95b286 |
+
|
|
|
95b286 |
+ dnl Setting path for system-fips file
|
|
|
95b286 |
+
|
|
|
95b286 |
+ AC_MSG_CHECKING(--with-system-fips-file argument)
|
|
|
95b286 |
+ AC_ARG_WITH([system-fips-file], [ --with-system-fips-file=PATH Link to system-fips file (default: /etc/system-fips)],
|
|
|
95b286 |
+ with_system_fips_file=$withval,
|
|
|
95b286 |
+ with_system_fips_file="/etc/system-fips")
|
|
|
95b286 |
+ AC_MSG_RESULT([$with_system_fips_file])
|
|
|
95b286 |
+ AC_DEFINE_UNQUOTED([SYSTEM_FIPS_FILE_LINK], ["$with_system_fips_file"])
|
|
|
95b286 |
+
|
|
|
95b286 |
+ dnl Setting link to fips_enabled file
|
|
|
95b286 |
+
|
|
|
95b286 |
+ AC_MSG_CHECKING(--with-fips-enabled-file argument)
|
|
|
95b286 |
+ AC_ARG_WITH([fips-enabled-file], [ --with-fips-enabled-file=PATH Link to fibs_enabled file (default: /proc/sys/crypto/fips_enabled)],
|
|
|
95b286 |
+ with_fips_enabled_file=$withval,
|
|
|
95b286 |
+ with_fips_enabled_file="/proc/sys/crypto/fips_enabled")
|
|
|
95b286 |
+ AC_MSG_RESULT([$with_fips_enabled_file])
|
|
|
95b286 |
+ AC_DEFINE_UNQUOTED([FIPS_ENABLED_FILE_LINK], ["$with_fips_enabled_file"])
|
|
|
95b286 |
+else
|
|
|
95b286 |
+ AC_MSG_RESULT(no)
|
|
|
95b286 |
+fi
|
|
|
95b286 |
+
|
|
|
95b286 |
dnl Check for Lua feature.
|
|
|
95b286 |
AC_MSG_CHECKING(--enable-luainterp argument)
|
|
|
95b286 |
AC_ARG_ENABLE(luainterp,
|
|
|
95b286 |
diff --git a/src/crypt.c b/src/crypt.c
|
|
|
95b286 |
index dfbf02c..c935bc0 100644
|
|
|
95b286 |
--- a/src/crypt.c
|
|
|
95b286 |
+++ b/src/crypt.c
|
|
|
95b286 |
@@ -501,6 +501,21 @@ crypt_check_method(int method)
|
|
|
95b286 |
msg_scroll = TRUE;
|
|
|
95b286 |
MSG(_("Warning: Using a weak encryption method; see :help 'cm'"));
|
|
|
95b286 |
}
|
|
|
95b286 |
+#ifdef HAVE_FIPS_WARNING
|
|
|
95b286 |
+ FILE *fips_enable_fd = fopen(FIPS_ENABLED_FILE_LINK, "r");
|
|
|
95b286 |
+ if (fips_enable_fd == NULL)
|
|
|
95b286 |
+ return;
|
|
|
95b286 |
+
|
|
|
95b286 |
+ int enabled = fgetc(fips_enable_fd);
|
|
|
95b286 |
+
|
|
|
95b286 |
+ if ( access(SYSTEM_FIPS_FILE_LINK, F_OK) != -1 && enabled == '1')
|
|
|
95b286 |
+ {
|
|
|
95b286 |
+ msg_scroll = TRUE;
|
|
|
95b286 |
+ MSG(_("Warning: This cryptography is not FIPS 140-2 compliant."));
|
|
|
95b286 |
+ }
|
|
|
95b286 |
+
|
|
|
95b286 |
+ fclose(fips_enable_fd);
|
|
|
95b286 |
+#endif
|
|
|
95b286 |
}
|
|
|
95b286 |
|
|
|
95b286 |
void
|