From facea2b7659e11efce7014bda8800574d35dd05d Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 12 Jun 2019 14:02:05 +0200
Subject: [PATCH] fips: run selftests over overridden AES-CBC algorithm

Previously, we only tested nettle's AES-CBC in
_gnutls_fips_perform_self_checks1(), which is called before the
implementation is overridden.  This adds an AES-CBC self-test in
_gnutls_fips_perform_self_checks2() so it can test the actual
implementation.

Signed-off-by: Daiki Ueno <dueno@redhat.com>
---
 lib/fips.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/fips.c b/lib/fips.c
index b92edbbd7..902af5674 100644
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -317,6 +317,12 @@ int _gnutls_fips_perform_self_checks2(void)
 		goto error;
 	}
 
+	ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_CBC);
+	if (ret < 0) {
+		gnutls_assert();
+		goto error;
+	}
+
 	ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_GCM);
 	if (ret < 0) {
 		gnutls_assert();
-- 
2.20.1