From 1bc9545b387216d41afda4a9080b39c1bbb8a207 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Tue, 19 May 2020 18:33:30 -0700
Subject: [PATCH] Revert "FIPS module installed state definition is modified"

This reverts commit 89a24d69fca3f59d40038cc30e9bbf74cd38a6e1.
---
 openssl-1.1.1-fips.patch | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/openssl-1.1.1-fips.patch b/openssl-1.1.1-fips.patch
index 4fd1117..7a0580f 100644
--- a/openssl-1.1.1-fips.patch
+++ b/openssl-1.1.1-fips.patch
@@ -2303,7 +2303,7 @@ diff -up openssl-1.1.1e/crypto/fips/fips.c.fips openssl-1.1.1e/crypto/fips/fips.
 +        rv = 0;
 +
 +    /* Installed == true */
-+    return !rv || FIPS_module_mode();
++    return !rv;
 +}
 +
 +int FIPS_module_mode_set(int onoff)
@@ -9865,7 +9865,7 @@ diff -up openssl-1.1.1e/crypto/o_fips.c.fips openssl-1.1.1e/crypto/o_fips.c
 diff -up openssl-1.1.1e/crypto/o_init.c.fips openssl-1.1.1e/crypto/o_init.c
 --- openssl-1.1.1e/crypto/o_init.c.fips	2020-03-17 15:31:17.000000000 +0100
 +++ openssl-1.1.1e/crypto/o_init.c	2020-03-17 17:30:52.052566939 +0100
-@@ -7,8 +7,69 @@
+@@ -7,8 +7,68 @@
   * https://www.openssl.org/source/license.html
   */
  
@@ -9891,20 +9891,16 @@ diff -up openssl-1.1.1e/crypto/o_init.c.fips openssl-1.1.1e/crypto/o_init.c
 +    char buf[2] = "0";
 +    int fd;
 +
++    /* Ensure the selftests always run */
++    /* XXX: TO SOLVE - premature initialization due to selftests */
++    FIPS_mode_set(1);
++
 +    if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) {
 +        buf[0] = '1';
 +    } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) {
 +        while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ;
 +        close(fd);
 +    }
-+
-+    if (buf[0] != '1' && !FIPS_module_installed())
-+        return;
-+
-+    /* Ensure the selftests always run */
-+    /* XXX: TO SOLVE - premature initialization due to selftests */
-+    FIPS_mode_set(1);
-+
 +    /* Failure reading the fips mode switch file means just not
 +     * switching into FIPS mode. We would break too many things
 +     * otherwise..
@@ -9929,6 +9925,9 @@ diff -up openssl-1.1.1e/crypto/o_init.c.fips openssl-1.1.1e/crypto/o_init.c
 +    if (done)
 +        return;
 +    done = 1;
++    if (!FIPS_module_installed()) {
++        return;
++    }
 +    init_fips_mode();
 +}
 +#endif