removed zombie mode, and no longer use fips140.h

diff --git a/lib/crypto-api.c b/lib/crypto-api.c
index 8618e1a139e48dc74df00dc6c33ea0e0524fb68c..850e20689830475146bcec5147cda6f667a83843 100644 (file)
--- a/lib/crypto-api.c
+++ b/lib/crypto-api.c
@@ -317,8 +317,9 @@ gnutls_hmac_init(gnutls_hmac_hd_t * dig,
 {
 #ifdef ENABLE_FIPS140
        /* MD5 is only allowed internally for TLS */
-       if (_gnutls_get_lib_state() != LIB_STATE_SELFTEST && 
-               _gnutls_get_lib_state() != LIB_STATE_ZOMBIE) {
+       if (gnutls_fips140_mode_enabled() != 0 &&
+               _gnutls_get_lib_state() != LIB_STATE_SELFTEST) {
+
                if (algorithm == GNUTLS_MAC_MD5)
                        return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
        }
@@ -463,8 +464,9 @@ gnutls_hash_init(gnutls_hash_hd_t * dig,
 {
 #ifdef ENABLE_FIPS140
        /* MD5 is only allowed internally for TLS */
-       if (_gnutls_get_lib_state() != LIB_STATE_SELFTEST && 
-               _gnutls_get_lib_state() != LIB_STATE_ZOMBIE) {
+       if (gnutls_fips140_mode_enabled() != 0 &&
+               _gnutls_get_lib_state() != LIB_STATE_SELFTEST) {
+
                if (algorithm == GNUTLS_DIG_MD5)
                        return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
        }

diff --git a/lib/fips.c b/lib/fips.c
index 0cb58381390cf5e0cc259920caae26914d4752dc..3444e4d57769e2d7149a068b772c9ab84321a06f 100644 (file)
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -27,7 +27,6 @@
 #include <fips.h>
 #include <stdio.h>
 #include <random.h>
-#include <gnutls/fips140.h>
 #include <dlfcn.h>
 
 unsigned int _gnutls_lib_mode = LIB_STATE_POWERON;
@@ -60,7 +59,6 @@ FILE* fd;
        if (f2p != 0) {
                /* a funny state where self tests are performed
                 * and ignored */
-               _gnutls_switch_lib_state(LIB_STATE_ZOMBIE);
                _gnutls_debug_log("FIPS140-2 ZOMBIE mode enabled\n");
                return 2;
        }

diff --git a/lib/fips.h b/lib/fips.h
index 95f28ad2512affea6535b7f96e2cfd795c86095b..6b48be4a5a995a44bb7e2815301a69874a8dd147 100644 (file)
--- a/lib/fips.h
+++ b/lib/fips.h
@@ -30,7 +30,6 @@
 
 typedef enum {
   LIB_STATE_POWERON,
-  LIB_STATE_ZOMBIE,
   LIB_STATE_INIT,
   LIB_STATE_SELFTEST,
   LIB_STATE_OPERATIONAL,
@@ -45,8 +44,7 @@ inline static
 void _gnutls_switch_lib_state(gnutls_lib_state_t state)
 {
        /* Once into zombie state no errors can change us */
-       if (_gnutls_lib_mode != LIB_STATE_ZOMBIE)
-               _gnutls_lib_mode = state;
+       _gnutls_lib_mode = state;
 }
 
 inline static gnutls_lib_state_t _gnutls_get_lib_state(void)
@@ -59,8 +57,8 @@ unsigned _gnutls_fips_mode_enabled(void);
 
 # define FAIL_IF_LIB_ERROR \
        if (_gnutls_get_lib_state() != LIB_STATE_OPERATIONAL && \
-         _gnutls_get_lib_state() != LIB_STATE_SELFTEST && \
-         _gnutls_get_lib_state() != LIB_STATE_ZOMBIE) return GNUTLS_E_LIB_IN_ERROR_STATE
+         _gnutls_get_lib_state() != LIB_STATE_SELFTEST) \
+       return GNUTLS_E_LIB_IN_ERROR_STATE
 
 void _gnutls_switch_lib_state(gnutls_lib_state_t state);
 

diff --git a/lib/gnutls_global.c b/lib/gnutls_global.c
index e499990cf9756faf8e4d523d89ff8990be3a0b08..5a4b2eea83a087da355f70da90e428e19980d8cc 100644 (file)
--- a/lib/gnutls_global.c
+++ b/lib/gnutls_global.c
@@ -321,9 +321,13 @@ int gnutls_global_init2(unsigned int flags)
         * have been loaded */
        if (flags & GNUTLS_GLOBAL_INIT_MINIMAL) {
                res = _gnutls_fips_mode_enabled();
+               /* res == 1 -> fips140-2 mode enabled
+                * res == 2 -> only self checks performed - but no failure
+                * res == not in fips140 mode
+                */
                if (res != 0) {
                        ret = _gnutls_fips_perform_self_checks();
-                       if (_gnutls_get_lib_state() != LIB_STATE_ZOMBIE) {
+                       if (res != 2) {
                                if (ret < 0) {
                                        gnutls_assert();
                                        goto out;

diff --git a/tests/fips-test.c b/tests/fips-test.c
index 9566e0d1a76f3d4331ab09199a8c347d702dad87..9096a6c05351a6e741231b44a3427576630c851d 100644 (file)
--- a/tests/fips-test.c
+++ b/tests/fips-test.c
@@ -8,7 +8,6 @@
 #include <gnutls/crypto.h>
 #include <gnutls/abstract.h>
 #include <gnutls/x509.h>
-#include <gnutls/fips140.h>
 
 void _gnutls_lib_simulate_error(void);