You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
72 lines
2.3 KiB
72 lines
2.3 KiB
diff -up libgcrypt-1.5.3/cipher/md.c.fips-ctor libgcrypt-1.5.3/cipher/md.c |
|
--- libgcrypt-1.5.3/cipher/md.c.fips-ctor 2013-07-25 11:10:03.000000000 +0200 |
|
+++ libgcrypt-1.5.3/cipher/md.c 2014-12-12 15:32:35.464515238 +0100 |
|
@@ -570,11 +570,8 @@ md_enable (gcry_md_hd_t hd, int algorith |
|
|
|
if (!err && algorithm == GCRY_MD_MD5 && fips_mode ()) |
|
{ |
|
- _gcry_inactivate_fips_mode ("MD5 used"); |
|
if (_gcry_enforced_fips_mode () ) |
|
{ |
|
- /* We should never get to here because we do not register |
|
- MD5 in enforced fips mode. But better throw an error. */ |
|
err = GPG_ERR_DIGEST_ALGO; |
|
} |
|
} |
|
diff -up libgcrypt-1.5.3/src/global.c.fips-ctor libgcrypt-1.5.3/src/global.c |
|
--- libgcrypt-1.5.3/src/global.c.fips-ctor 2014-12-12 15:32:35.463515215 +0100 |
|
+++ libgcrypt-1.5.3/src/global.c 2014-12-12 16:46:33.424883301 +0100 |
|
@@ -140,6 +140,34 @@ global_init (void) |
|
} |
|
|
|
|
|
+#ifndef FIPS_MODULE_PATH |
|
+#define FIPS_MODULE_PATH "/etc/system-fips" |
|
+#endif |
|
+ |
|
+void __attribute__ ((constructor)) _gcry_global_constructor (void) |
|
+{ |
|
+ int rv; |
|
+ |
|
+ rv = access (FIPS_MODULE_PATH, F_OK); |
|
+ if (rv < 0 && errno != ENOENT) |
|
+ rv = 0; |
|
+ |
|
+ if (!rv) |
|
+ { |
|
+ int no_secmem_save; |
|
+ |
|
+ /* it should be always 0 at this point but let's keep on the safe side */ |
|
+ no_secmem_save = no_secure_memory; |
|
+ no_secure_memory = 1; |
|
+ /* force selftests */ |
|
+ global_init (); |
|
+ if (fips_mode ()) |
|
+ _gcry_random_initialize (1); |
|
+ _gcry_fips_run_selftests (0); |
|
+ no_secure_memory = no_secmem_save; |
|
+ } |
|
+} |
|
+ |
|
/* This function is called by the macro fips_is_operational and makes |
|
sure that the minimal initialization has been done. This is far |
|
from a perfect solution and hides problems with an improper |
|
@@ -500,8 +528,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd, |
|
|
|
case GCRYCTL_FIPS_MODE_P: |
|
if (fips_mode () |
|
- && !_gcry_is_fips_mode_inactive () |
|
- && !no_secure_memory) |
|
+ && !_gcry_is_fips_mode_inactive ()) |
|
err = GPG_ERR_GENERAL; /* Used as TRUE value */ |
|
break; |
|
|
|
@@ -600,7 +627,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd, |
|
break; |
|
|
|
case GCRYCTL_SET_ENFORCED_FIPS_FLAG: |
|
- if (!any_init_done) |
|
+ if (fips_mode ()) |
|
{ |
|
/* Not yet intialized at all. Set the enforced fips mode flag */ |
|
_gcry_set_enforced_fips_mode ();
|
|
|