rpms
/
openssl
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Revert "FIPS module installed state definition is modified" 

This reverts commit 89a24d69fc.
This commit is contained in:
Adam Williamson 2020-05-19 18:33:30 -07:00
parent 1e6a98d9e9
commit 1bc9545b38
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
openssl-1.1.1-fips.patch
View File

@ -2303,7 +2303,7 @@ diff -up openssl-1.1.1e/crypto/fips/fips.c.fips openssl-1.1.1e/crypto/fips/fips.
+ rv = 0; + rv = 0;
+ +
+ /* Installed == true */ + /* Installed == true */
+ return !rv || FIPS_module_mode(); + return !rv;
+} +}
+ +
+int FIPS_module_mode_set(int onoff) +int FIPS_module_mode_set(int onoff)
@ -9865,7 +9865,7 @@ diff -up openssl-1.1.1e/crypto/o_fips.c.fips openssl-1.1.1e/crypto/o_fips.c
diff -up openssl-1.1.1e/crypto/o_init.c.fips openssl-1.1.1e/crypto/o_init.c diff -up openssl-1.1.1e/crypto/o_init.c.fips openssl-1.1.1e/crypto/o_init.c
--- openssl-1.1.1e/crypto/o_init.c.fips 2020-03-17 15:31:17.000000000 +0100 --- openssl-1.1.1e/crypto/o_init.c.fips 2020-03-17 15:31:17.000000000 +0100
+++ openssl-1.1.1e/crypto/o_init.c 2020-03-17 17:30:52.052566939 +0100 +++ openssl-1.1.1e/crypto/o_init.c 2020-03-17 17:30:52.052566939 +0100
@@ -7,8 +7,69 @@ @@ -7,8 +7,68 @@
* https://www.openssl.org/source/license.html * https://www.openssl.org/source/license.html
*/ */
@ -9891,20 +9891,16 @@ diff -up openssl-1.1.1e/crypto/o_init.c.fips openssl-1.1.1e/crypto/o_init.c
+ char buf[2] = "0"; + char buf[2] = "0";
+ int fd; + int fd;
+ +
+ /* Ensure the selftests always run */
+ /* XXX: TO SOLVE - premature initialization due to selftests */
+ FIPS_mode_set(1);
+
+ if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { + if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) {
+ buf[0] = '1'; + buf[0] = '1';
+ } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) { + } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) {
+ while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ; + while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ;
+ close(fd); + close(fd);
+ } + }
+
+ if (buf[0] != '1' && !FIPS_module_installed())
+ return;
+
+ /* Ensure the selftests always run */
+ /* XXX: TO SOLVE - premature initialization due to selftests */
+ FIPS_mode_set(1);
+
+ /* Failure reading the fips mode switch file means just not + /* Failure reading the fips mode switch file means just not
+ * switching into FIPS mode. We would break too many things + * switching into FIPS mode. We would break too many things
+ * otherwise.. + * otherwise..
@ -9929,6 +9925,9 @@ diff -up openssl-1.1.1e/crypto/o_init.c.fips openssl-1.1.1e/crypto/o_init.c
+ if (done) + if (done)
+ return; + return;
+ done = 1; + done = 1;
+ if (!FIPS_module_installed()) {
+ return;
+ }
+ init_fips_mode(); + init_fips_mode();
+} +}
+#endif +#endif