|
 |
e09bf5 |
diff -up libgcrypt-1.8.3/src/global.c.fips-ctor libgcrypt-1.8.3/src/global.c
|
|
|
e09bf5 |
--- libgcrypt-1.8.3/src/global.c.fips-ctor 2017-11-23 19:25:58.000000000 +0100
|
|
|
e09bf5 |
+++ libgcrypt-1.8.3/src/global.c 2020-04-17 16:29:59.258218015 +0200
|
|
|
e09bf5 |
@@ -141,6 +141,34 @@ global_init (void)
|
|
|
e09bf5 |
}
|
|
|
e09bf5 |
|
|
|
e09bf5 |
|
|
|
e09bf5 |
+#ifndef FIPS_MODULE_PATH
|
|
|
e09bf5 |
+#define FIPS_MODULE_PATH "/etc/system-fips"
|
|
|
e09bf5 |
+#endif
|
|
|
e09bf5 |
+
|
|
|
e09bf5 |
+void __attribute__ ((constructor)) _gcry_global_constructor (void)
|
|
|
e09bf5 |
+{
|
|
|
e09bf5 |
+ int rv;
|
|
|
e09bf5 |
+
|
|
|
e09bf5 |
+ rv = access (FIPS_MODULE_PATH, F_OK);
|
|
|
e09bf5 |
+ if (rv < 0 && errno != ENOENT)
|
|
|
e09bf5 |
+ rv = 0;
|
|
|
e09bf5 |
+
|
|
|
e09bf5 |
+ if (!rv)
|
|
|
e09bf5 |
+ {
|
|
|
e09bf5 |
+ int no_secmem_save;
|
|
|
e09bf5 |
+
|
|
|
e09bf5 |
+ /* it should be always 0 at this point but let's keep on the safe side */
|
|
|
e09bf5 |
+ no_secmem_save = no_secure_memory;
|
|
|
e09bf5 |
+ no_secure_memory = 1;
|
|
|
e09bf5 |
+ /* force selftests */
|
|
|
e09bf5 |
+ global_init();
|
|
|
e09bf5 |
+ _gcry_fips_run_selftests (0);
|
|
|
e09bf5 |
+ if (!fips_mode())
|
|
|
e09bf5 |
+ _gcry_random_close_fds ();
|
|
|
e09bf5 |
+ no_secure_memory = no_secmem_save;
|
|
|
e09bf5 |
+ }
|
|
|
e09bf5 |
+}
|
|
|
e09bf5 |
+
|
|
|
e09bf5 |
/* This function is called by the macro fips_is_operational and makes
|
|
|
e09bf5 |
sure that the minimal initialization has been done. This is far
|
|
|
e09bf5 |
from a perfect solution and hides problems with an improper
|
|
|
e09bf5 |
@@ -671,8 +699,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
|
|
|
e09bf5 |
|
|
|
e09bf5 |
case GCRYCTL_FIPS_MODE_P:
|
|
|
e09bf5 |
if (fips_mode ()
|
|
|
e09bf5 |
- && !_gcry_is_fips_mode_inactive ()
|
|
|
e09bf5 |
- && !no_secure_memory)
|
|
|
e09bf5 |
+ && !_gcry_is_fips_mode_inactive ())
|
|
|
e09bf5 |
rc = GPG_ERR_GENERAL; /* Used as TRUE value */
|
|
|
e09bf5 |
break;
|
|
|
e09bf5 |
|
|
|
e09bf5 |
@@ -749,9 +776,9 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
|
|
|
e09bf5 |
break;
|
|
|
e09bf5 |
|
|
|
e09bf5 |
case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
|
|
|
e09bf5 |
- if (!_gcry_global_any_init_done)
|
|
|
e09bf5 |
+ if (fips_mode ())
|
|
|
e09bf5 |
{
|
|
|
e09bf5 |
- /* Not yet initialized at all. Set the enforced fips mode flag */
|
|
|
e09bf5 |
+ /* We are in FIPS mode, we can set the enforced fips mode flag. */
|
|
|
e09bf5 |
_gcry_set_preferred_rng_type (0);
|
|
|
e09bf5 |
_gcry_set_enforced_fips_mode ();
|
|
|
e09bf5 |
}
|