properly reset the zombie mode in FIPS mode

This amends 9158f590f4a18c84fc9eb41877b29d73b30af879

diff --git a/lib/fips.c b/lib/fips.c
index 8688aec1fbedcd9a671fdf539e28d5ef1d696aa9..b99da2d44b7015038e5fdd1beee6fbbdb8685ac8 100644 (file)
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -93,6 +93,15 @@ const char *p;
        return _fips_mode;
 }
 
+/* This _fips_mode == 2 is a strange mode where checks are being
+ * performed, but its output is ignored. */
+void _gnutls_fips_mode_reset_zombie(void)
+{
+       if (_fips_mode == 2) {
+               _fips_mode = 0;
+       }
+}
+
 #define GNUTLS_LIBRARY_NAME "libgnutls.so.28"
 #define NETTLE_LIBRARY_NAME "libnettle.so.4"
 #define HOGWEED_LIBRARY_NAME "libhogweed.so.2"
@@ -368,9 +377,6 @@ int _gnutls_fips_perform_self_checks2(void)
                goto error;
        }
        
-       if (_fips_mode == 2)
-               _fips_mode = 0;
-
        return 0;
 
 error:

diff --git a/lib/fips.h b/lib/fips.h
index dcd855c916e985bd6fef8dfbbddc274e10f430bf..f7fc7f62530c1ba6f020cd9e471f435a7087932e 100644 (file)
--- a/lib/fips.h
+++ b/lib/fips.h
@@ -55,6 +55,7 @@ inline static gnutls_lib_state_t _gnutls_get_lib_state(void)
 
 int _gnutls_fips_perform_self_checks1(void);
 int _gnutls_fips_perform_self_checks2(void);
+void _gnutls_fips_mode_reset_zombie(void);
 
 #ifdef ENABLE_FIPS140
 unsigned _gnutls_fips_mode_enabled(void);

diff --git a/lib/gnutls_global.c b/lib/gnutls_global.c
index 8d44ef35b1b12d395dd6da8b245e7a95ffd25370..243f5332989ca15b817978359386e675ed67d215 100644 (file)
--- a/lib/gnutls_global.c
+++ b/lib/gnutls_global.c
@@ -346,6 +346,7 @@ int gnutls_global_init(void)
                                goto out;
                        }
                }
+               _gnutls_fips_mode_reset_zombie();
        }
 #endif
        _gnutls_switch_lib_state(LIB_STATE_OPERATIONAL);