File gnutls-fips_mode_enabled.patch of Package gnutls

Overview Repositories Revisions Requests Users Attributes Meta

File gnutls-fips_mode_enabled.patch of Package gnutls (Revision 607df91a5c13c83e1894305a39e7e3ff)

Currently displaying revision 607df91a5c13c83e1894305a39e7e3ff , Show latest

Index: gnutls-3.7.2/lib/fips.c
===================================================================
--- gnutls-3.7.2.orig/lib/fips.c
+++ gnutls-3.7.2/lib/fips.c
@@ -38,7 +38,6 @@ unsigned int _gnutls_lib_state = LIB_STA
 #include <dlfcn.h>
 
 #define FIPS_KERNEL_FILE "/proc/sys/crypto/fips_enabled"
-#define FIPS_SYSTEM_FILE "/etc/system-fips"
 
 /* We provide a per-thread FIPS-mode so that an application
  * can use gnutls_fips140_set_mode() to override a specific
@@ -53,7 +52,7 @@ static int _skip_integrity_checks = 0;
  */
 unsigned _gnutls_fips_mode_enabled(void)
 {
-	unsigned f1p = 0, f2p;
+	unsigned f1p = 0;
 	FILE* fd;
 	const char *p;
 	unsigned ret;
@@ -80,7 +79,7 @@ unsigned _gnutls_fips_mode_enabled(void)
 	p = secure_getenv("GNUTLS_FORCE_FIPS_MODE");
 	if (p) {
 		if (p[0] == '1')
-			ret = 1;
+			ret = GNUTLS_FIPS140_STRICT;
 		else if (p[0] == '2')
 			ret = GNUTLS_FIPS140_SELFTESTS;
 		else if (p[0] == '3')
@@ -108,15 +107,6 @@ unsigned _gnutls_fips_mode_enabled(void)
 		goto exit;
 	}
 
-	f2p = !access(FIPS_SYSTEM_FILE, F_OK);
-	if (f2p != 0) {
-		/* a funny state where self tests are performed
-		 * and ignored */
-		_gnutls_debug_log("FIPS140-2 ZOMBIE mode enabled\n");
-		ret = GNUTLS_FIPS140_SELFTESTS;
-		goto exit;
-	}
-
 	ret = GNUTLS_FIPS140_DISABLED;
 	goto exit;

Places

File gnutls-fips_mode_enabled.patch of Package gnutls (Revision 607df91a5c13c83e1894305a39e7e3ff)

Places