From facea2b7659e11efce7014bda8800574d35dd05d Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 12 Jun 2019 14:02:05 +0200 Subject: [PATCH] fips: run selftests over overridden AES-CBC algorithm Previously, we only tested nettle's AES-CBC in _gnutls_fips_perform_self_checks1(), which is called before the implementation is overridden. This adds an AES-CBC self-test in _gnutls_fips_perform_self_checks2() so it can test the actual implementation. Signed-off-by: Daiki Ueno --- lib/fips.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/fips.c b/lib/fips.c index b92edbbd7..902af5674 100644 --- a/lib/fips.c +++ b/lib/fips.c @@ -317,6 +317,12 @@ int _gnutls_fips_perform_self_checks2(void) goto error; } + ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_CBC); + if (ret < 0) { + gnutls_assert(); + goto error; + } + ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_GCM); if (ret < 0) { gnutls_assert(); -- 2.20.1