From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Wed, 4 Dec 2013 14:48:49 +0000 (+0100)
Subject: removed zombie mode, and no longer use fips140.h
X-Git-Tag: gnutls_3_3_0pre0~499
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4123494385f4c0916923a870c8a69cf664e99df4;p=thirdparty%2Fgnutls.git

removed zombie mode, and no longer use fips140.h
---

diff --git a/lib/crypto-api.c b/lib/crypto-api.c
index 8618e1a139..850e206898 100644
--- a/lib/crypto-api.c
+++ b/lib/crypto-api.c
@@ -317,8 +317,9 @@ gnutls_hmac_init(gnutls_hmac_hd_t * dig,
 {
 #ifdef ENABLE_FIPS140
 	/* MD5 is only allowed internally for TLS */
-	if (_gnutls_get_lib_state() != LIB_STATE_SELFTEST && 
-		_gnutls_get_lib_state() != LIB_STATE_ZOMBIE) {
+	if (gnutls_fips140_mode_enabled() != 0 &&
+		_gnutls_get_lib_state() != LIB_STATE_SELFTEST) {
+
 		if (algorithm == GNUTLS_MAC_MD5)
 			return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
 	}
@@ -463,8 +464,9 @@ gnutls_hash_init(gnutls_hash_hd_t * dig,
 {
 #ifdef ENABLE_FIPS140
 	/* MD5 is only allowed internally for TLS */
-	if (_gnutls_get_lib_state() != LIB_STATE_SELFTEST && 
-		_gnutls_get_lib_state() != LIB_STATE_ZOMBIE) {
+	if (gnutls_fips140_mode_enabled() != 0 &&
+		_gnutls_get_lib_state() != LIB_STATE_SELFTEST) {
+
 		if (algorithm == GNUTLS_DIG_MD5)
 			return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
 	}
diff --git a/lib/fips.c b/lib/fips.c
index 0cb5838139..3444e4d577 100644
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -27,7 +27,6 @@
 #include <fips.h>
 #include <stdio.h>
 #include <random.h>
-#include <gnutls/fips140.h>
 #include <dlfcn.h>
 
 unsigned int _gnutls_lib_mode = LIB_STATE_POWERON;
@@ -60,7 +59,6 @@ FILE* fd;
 	if (f2p != 0) {
 		/* a funny state where self tests are performed
 		 * and ignored */
-		_gnutls_switch_lib_state(LIB_STATE_ZOMBIE);
 		_gnutls_debug_log("FIPS140-2 ZOMBIE mode enabled\n");
 		return 2;
 	}
diff --git a/lib/fips.h b/lib/fips.h
index 95f28ad251..6b48be4a5a 100644
--- a/lib/fips.h
+++ b/lib/fips.h
@@ -30,7 +30,6 @@
 
 typedef enum {
   LIB_STATE_POWERON,
-  LIB_STATE_ZOMBIE,
   LIB_STATE_INIT,
   LIB_STATE_SELFTEST,
   LIB_STATE_OPERATIONAL,
@@ -45,8 +44,7 @@ inline static
 void _gnutls_switch_lib_state(gnutls_lib_state_t state)
 {
 	/* Once into zombie state no errors can change us */
-	if (_gnutls_lib_mode != LIB_STATE_ZOMBIE)
-		_gnutls_lib_mode = state;
+	_gnutls_lib_mode = state;
 }
 
 inline static gnutls_lib_state_t _gnutls_get_lib_state(void)
@@ -59,8 +57,8 @@ unsigned _gnutls_fips_mode_enabled(void);
 
 # define FAIL_IF_LIB_ERROR \
 	if (_gnutls_get_lib_state() != LIB_STATE_OPERATIONAL && \
-	  _gnutls_get_lib_state() != LIB_STATE_SELFTEST && \
-	  _gnutls_get_lib_state() != LIB_STATE_ZOMBIE) return GNUTLS_E_LIB_IN_ERROR_STATE
+	  _gnutls_get_lib_state() != LIB_STATE_SELFTEST) \
+	return GNUTLS_E_LIB_IN_ERROR_STATE
 
 void _gnutls_switch_lib_state(gnutls_lib_state_t state);
 
diff --git a/lib/gnutls_global.c b/lib/gnutls_global.c
index e499990cf9..5a4b2eea83 100644
--- a/lib/gnutls_global.c
+++ b/lib/gnutls_global.c
@@ -321,9 +321,13 @@ int gnutls_global_init2(unsigned int flags)
 	 * have been loaded */
 	if (flags & GNUTLS_GLOBAL_INIT_MINIMAL) {
 		res = _gnutls_fips_mode_enabled();
+		/* res == 1 -> fips140-2 mode enabled
+		 * res == 2 -> only self checks performed - but no failure
+		 * res == not in fips140 mode
+		 */
 		if (res != 0) {
 			ret = _gnutls_fips_perform_self_checks();
-			if (_gnutls_get_lib_state() != LIB_STATE_ZOMBIE) {
+			if (res != 2) {
 				if (ret < 0) {
 					gnutls_assert();
 					goto out;
diff --git a/tests/fips-test.c b/tests/fips-test.c
index 9566e0d1a7..9096a6c053 100644
--- a/tests/fips-test.c
+++ b/tests/fips-test.c
@@ -8,7 +8,6 @@
 #include <gnutls/crypto.h>
 #include <gnutls/abstract.h>
 #include <gnutls/x509.h>
-#include <gnutls/fips140.h>
 
 void _gnutls_lib_simulate_error(void);