|
 |
040c39b |
diff -up libgcrypt-1.6.2/cipher/md.c.fips-ctor libgcrypt-1.6.2/cipher/md.c
|
|
|
040c39b |
--- libgcrypt-1.6.2/cipher/md.c.fips-ctor 2014-08-21 14:50:39.000000000 +0200
|
|
|
040c39b |
+++ libgcrypt-1.6.2/cipher/md.c 2014-12-08 16:45:01.095256244 +0100
|
|
|
040c39b |
@@ -413,11 +413,8 @@ md_enable (gcry_md_hd_t hd, int algorith
|
|
|
040c39b |
|
|
|
040c39b |
if (!err && algorithm == GCRY_MD_MD5 && fips_mode ())
|
|
|
040c39b |
{
|
|
|
040c39b |
- _gcry_inactivate_fips_mode ("MD5 used");
|
|
|
040c39b |
if (_gcry_enforced_fips_mode () )
|
|
|
040c39b |
{
|
|
|
040c39b |
- /* We should never get to here because we do not register
|
|
|
040c39b |
- MD5 in enforced fips mode. But better throw an error. */
|
|
|
040c39b |
err = GPG_ERR_DIGEST_ALGO;
|
|
|
040c39b |
}
|
|
|
040c39b |
}
|
|
|
040c39b |
diff -up libgcrypt-1.6.2/src/global.c.fips-ctor libgcrypt-1.6.2/src/global.c
|
|
|
040c39b |
--- libgcrypt-1.6.2/src/global.c.fips-ctor 2014-12-08 16:45:01.094256222 +0100
|
|
|
040c39b |
+++ libgcrypt-1.6.2/src/global.c 2014-12-08 16:46:29.182248403 +0100
|
|
|
040c39b |
@@ -132,6 +132,28 @@ global_init (void)
|
|
|
040c39b |
}
|
|
|
040c39b |
|
|
|
040c39b |
|
|
|
040c39b |
+#ifndef FIPS_MODULE_PATH
|
|
|
040c39b |
+#define FIPS_MODULE_PATH "/etc/system-fips"
|
|
|
040c39b |
+#endif
|
|
|
040c39b |
+
|
|
|
040c39b |
+void __attribute__ ((constructor)) _gcry_global_constructor (void)
|
|
|
040c39b |
+{
|
|
|
040c39b |
+ int rv;
|
|
|
040c39b |
+
|
|
|
040c39b |
+ rv = access (FIPS_MODULE_PATH, F_OK);
|
|
|
040c39b |
+ if (rv < 0 && errno != ENOENT)
|
|
|
040c39b |
+ rv = 0;
|
|
|
040c39b |
+
|
|
|
040c39b |
+ if (!rv)
|
|
|
040c39b |
+ {
|
|
|
040c39b |
+ /* force selftests */
|
|
|
040c39b |
+ global_init ();
|
|
|
040c39b |
+ if (fips_mode ())
|
|
|
040c39b |
+ _gcry_random_initialize (1);
|
|
|
040c39b |
+ _gcry_fips_run_selftests (0);
|
|
|
040c39b |
+ }
|
|
|
040c39b |
+}
|
|
|
040c39b |
+
|
|
|
040c39b |
/* This function is called by the macro fips_is_operational and makes
|
|
|
040c39b |
sure that the minimal initialization has been done. This is far
|
|
|
040c39b |
from a perfect solution and hides problems with an improper
|
|
|
040c39b |
@@ -635,7 +657,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
|
|
|
040c39b |
break;
|
|
|
040c39b |
|
|
|
040c39b |
case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
|
|
|
040c39b |
- if (!any_init_done)
|
|
|
040c39b |
+ if (fips_mode ())
|
|
|
040c39b |
{
|
|
|
040c39b |
/* Not yet initialized at all. Set the enforced fips mode flag */
|
|
|
040c39b |
_gcry_set_preferred_rng_type (0);
|