From 4fc53159b94bb78586dc082df16745af009cbb8a Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 1 Aug 2015 22:39:21 +0300 Subject: [PATCH] OpenSSL: Fix FIPS mode enabling in dynamic interface case FIPS_mode_set(1) cannot be called multiple times which could happen in some dynamic interface cases. Avoid this by enabling FIPS mode only once. There is no code in wpa_supplicant to disable FIPS mode, so once it is enabled, it will remain enabled. Signed-off-by: Jouni Malinen --- src/crypto/tls_openssl.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index de163965e..fcc5c7fed 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -757,7 +757,9 @@ void * tls_init(const struct tls_config *conf) #ifdef CONFIG_FIPS #ifdef OPENSSL_FIPS if (conf && conf->fips_mode) { - if (!FIPS_mode_set(1)) { + static int fips_enabled = 0; + + if (!fips_enabled && !FIPS_mode_set(1)) { wpa_printf(MSG_ERROR, "Failed to enable FIPS " "mode"); ERR_load_crypto_strings(); @@ -765,8 +767,10 @@ void * tls_init(const struct tls_config *conf) os_free(tls_global); tls_global = NULL; return NULL; - } else + } else { wpa_printf(MSG_INFO, "Running in FIPS mode"); + fips_enabled = 1; + } } #else /* OPENSSL_FIPS */ if (conf && conf->fips_mode) { -- 2.47.2