140 lines
4.6 KiB
Diff
140 lines
4.6 KiB
Diff
diff -up libgcrypt-1.8.5/src/fips.c.fips-module libgcrypt-1.8.5/src/fips.c
|
|
--- libgcrypt-1.8.5/src/fips.c.fips-module 2020-04-20 19:07:45.924919645 +0200
|
|
+++ libgcrypt-1.8.5/src/fips.c 2020-04-20 19:10:33.690722470 +0200
|
|
@@ -35,10 +35,6 @@
|
|
#include "hmac256.h"
|
|
|
|
|
|
-/* The name of the file used to force libgcrypt into fips mode. */
|
|
-#define FIPS_FORCE_FILE "/etc/gcrypt/fips_enabled"
|
|
-
|
|
-
|
|
/* The states of the finite state machine used in fips mode. */
|
|
enum module_states
|
|
{
|
|
@@ -122,54 +118,6 @@ _gcry_initialize_fips_mode (int force)
|
|
goto leave;
|
|
}
|
|
|
|
- /* For testing the system it is useful to override the system
|
|
- provided detection of the FIPS mode and force FIPS mode using a
|
|
- file. The filename is hardwired so that there won't be any
|
|
- confusion on whether /etc/gcrypt/ or /usr/local/etc/gcrypt/ is
|
|
- actually used. The file itself may be empty. */
|
|
- if ( !access (FIPS_FORCE_FILE, F_OK) )
|
|
- {
|
|
- gcry_assert (!no_fips_mode_required);
|
|
- goto leave;
|
|
- }
|
|
-
|
|
- /* Checking based on /proc file properties. */
|
|
- {
|
|
- static const char procfname[] = "/proc/sys/crypto/fips_enabled";
|
|
- FILE *fp;
|
|
- int saved_errno;
|
|
-
|
|
- fp = fopen (procfname, "r");
|
|
- if (fp)
|
|
- {
|
|
- char line[256];
|
|
-
|
|
- if (fgets (line, sizeof line, fp) && atoi (line))
|
|
- {
|
|
- /* System is in fips mode. */
|
|
- fclose (fp);
|
|
- gcry_assert (!no_fips_mode_required);
|
|
- goto leave;
|
|
- }
|
|
- fclose (fp);
|
|
- }
|
|
- else if ((saved_errno = errno) != ENOENT
|
|
- && saved_errno != EACCES
|
|
- && !access ("/proc/version", F_OK) )
|
|
- {
|
|
- /* Problem reading the fips file despite that we have the proc
|
|
- file system. We better stop right away. */
|
|
- log_info ("FATAL: error reading `%s' in libgcrypt: %s\n",
|
|
- procfname, strerror (saved_errno));
|
|
-#ifdef HAVE_SYSLOG
|
|
- syslog (LOG_USER|LOG_ERR, "Libgcrypt error: "
|
|
- "reading `%s' failed: %s - abort",
|
|
- procfname, strerror (saved_errno));
|
|
-#endif /*HAVE_SYSLOG*/
|
|
- abort ();
|
|
- }
|
|
- }
|
|
-
|
|
/* Fips not not requested, set flag. */
|
|
no_fips_mode_required = 1;
|
|
|
|
diff -up libgcrypt-1.8.5/src/g10lib.h.fips-module libgcrypt-1.8.5/src/g10lib.h
|
|
--- libgcrypt-1.8.5/src/g10lib.h.fips-module 2020-04-20 19:07:45.918919759 +0200
|
|
+++ libgcrypt-1.8.5/src/g10lib.h 2020-04-20 19:11:05.003125740 +0200
|
|
@@ -422,6 +422,9 @@ gpg_err_code_t _gcry_sexp_vextract_param
|
|
|
|
/*-- fips.c --*/
|
|
|
|
+/* The name of the file used to force libgcrypt into fips mode. */
|
|
+#define FIPS_FORCE_FILE "/etc/gcrypt/fips_enabled"
|
|
+
|
|
void _gcry_initialize_fips_mode (int force);
|
|
|
|
int _gcry_fips_mode (void);
|
|
diff -up libgcrypt-1.8.5/src/global.c.fips-module libgcrypt-1.8.5/src/global.c
|
|
--- libgcrypt-1.8.5/src/global.c.fips-module 2020-04-20 19:07:45.919919741 +0200
|
|
+++ libgcrypt-1.8.5/src/global.c 2020-04-20 19:07:45.950919149 +0200
|
|
@@ -160,6 +160,53 @@ void __attribute__ ((constructor)) _gcry
|
|
rv = access (FIPS_MODULE_PATH, F_OK);
|
|
if (rv < 0 && errno != ENOENT)
|
|
rv = 0;
|
|
+
|
|
+ /* For testing the system it is useful to override the system
|
|
+ provided detection of the FIPS mode and force FIPS mode using a
|
|
+ file. The filename is hardwired so that there won't be any
|
|
+ confusion on whether /etc/gcrypt/ or /usr/local/etc/gcrypt/ is
|
|
+ actually used. The file itself may be empty. */
|
|
+ if ( !access (FIPS_FORCE_FILE, F_OK) )
|
|
+ {
|
|
+ rv = 0;
|
|
+ force_fips_mode = 1;
|
|
+ }
|
|
+
|
|
+ /* Checking based on /proc file properties. */
|
|
+ {
|
|
+ static const char procfname[] = "/proc/sys/crypto/fips_enabled";
|
|
+ FILE *fp;
|
|
+ int saved_errno;
|
|
+
|
|
+ fp = fopen (procfname, "r");
|
|
+ if (fp)
|
|
+ {
|
|
+ char line[256];
|
|
+
|
|
+ if (fgets (line, sizeof line, fp) && atoi (line))
|
|
+ {
|
|
+ /* System is in fips mode. */
|
|
+ rv = 0;
|
|
+ force_fips_mode = 1;
|
|
+ }
|
|
+ fclose (fp);
|
|
+ }
|
|
+ else if ((saved_errno = errno) != ENOENT
|
|
+ && saved_errno != EACCES
|
|
+ && !access ("/proc/version", F_OK) )
|
|
+ {
|
|
+ /* Problem reading the fips file despite that we have the proc
|
|
+ file system. We better stop right away. */
|
|
+ log_info ("FATAL: error reading `%s' in libgcrypt: %s\n",
|
|
+ procfname, strerror (saved_errno));
|
|
+#ifdef HAVE_SYSLOG
|
|
+ syslog (LOG_USER|LOG_ERR, "Libgcrypt error: "
|
|
+ "reading `%s' failed: %s - abort",
|
|
+ procfname, strerror (saved_errno));
|
|
+#endif /*HAVE_SYSLOG*/
|
|
+ abort ();
|
|
+ }
|
|
+ }
|
|
|
|
if (!rv)
|
|
{
|