libgcrypt/libgcrypt-1.6.2-fips-ctor.patch

diff -up libgcrypt-1.6.2/cipher/md.c.fips-ctor libgcrypt-1.6.2/cipher/md.c
--- libgcrypt-1.6.2/cipher/md.c.fips-ctor	2014-08-21 14:50:39.000000000 +0200
+++ libgcrypt-1.6.2/cipher/md.c	2015-02-25 13:57:21.175704866 +0100
@@ -413,11 +413,8 @@ md_enable (gcry_md_hd_t hd, int algorith
 
   if (!err && algorithm == GCRY_MD_MD5 && fips_mode ())
     {
-      _gcry_inactivate_fips_mode ("MD5 used");
       if (_gcry_enforced_fips_mode () )
         {
-          /* We should never get to here because we do not register
-             MD5 in enforced fips mode. But better throw an error.  */
           err = GPG_ERR_DIGEST_ALGO;
         }
     }
diff -up libgcrypt-1.6.2/src/global.c.fips-ctor libgcrypt-1.6.2/src/global.c
--- libgcrypt-1.6.2/src/global.c.fips-ctor	2015-02-25 13:57:21.174704842 +0100
+++ libgcrypt-1.6.2/src/global.c	2015-02-25 14:03:07.066864208 +0100
@@ -132,6 +132,34 @@ global_init (void)
 }
 
 
+#ifndef FIPS_MODULE_PATH
+#define FIPS_MODULE_PATH "/etc/system-fips"
+#endif
+
+void __attribute__ ((constructor)) _gcry_global_constructor (void)
+{
+  int rv;
+
+  rv = access (FIPS_MODULE_PATH, F_OK);
+  if (rv < 0 && errno != ENOENT)
+    rv = 0;
+
+  if (!rv)
+    {
+      int no_secmem_save;
+
+      /* it should be always 0 at this point but let's keep on the safe side */
+      no_secmem_save = no_secure_memory;
+      no_secure_memory = 1;
+      /* force selftests */
+      global_init ();
+      if (fips_mode ())
+         _gcry_random_initialize (1);
+      _gcry_fips_run_selftests (0);
+      no_secure_memory = no_secmem_save;
+    }
+}
+
 /* This function is called by the macro fips_is_operational and makes
    sure that the minimal initialization has been done.  This is far
    from a perfect solution and hides problems with an improper
@@ -542,9 +570,8 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
 
     case GCRYCTL_FIPS_MODE_P:
       if (fips_mode ()
-          && !_gcry_is_fips_mode_inactive ()
-          && !no_secure_memory)
-	rc = GPG_ERR_GENERAL; /* Used as TRUE value */
+          && !_gcry_is_fips_mode_inactive ())
+	err = GPG_ERR_GENERAL; /* Used as TRUE value */
       break;
 
     case GCRYCTL_FORCE_FIPS_MODE:
@@ -635,7 +662,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
       break;
 
     case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
-      if (!any_init_done)
+      if (fips_mode ())
         {
           /* Not yet initialized at all.  Set the enforced fips mode flag */
           _gcry_set_preferred_rng_type (0);