separate zombie mode from operational fips mode

diff --git a/lib/fips.c b/lib/fips.c
index fcb9da2f3224dae6115a220a63b6b325139ce0d2..f2c7c1da268af61a872c391ffc823f0a388b242a 100644 (file)
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -63,7 +63,7 @@ FILE* fd;
                 * and ignored */
                _gnutls_switch_fips_state(FIPS_STATE_ZOMBIE);
                _gnutls_debug_log("FIPS140-2 ZOMBIE mode enabled\n");
-               return 1;
+               return 2;
        }
 
        return 0;
@@ -276,8 +276,11 @@ error:
 int gnutls_fips140_mode_enabled(void)
 {
 #ifdef ENABLE_FIPS140
+int ret = _gnutls_fips_mode_enabled();
 
-       return _gnutls_fips_mode_enabled();
+       if (ret == 1)
+               return ret;
+       return 0;
 #else
        return 0;
 #endif

diff --git a/tests/fips-test.c b/tests/fips-test.c
index b8d227680b6c46db72b928da1149278df3434d3e..f46a3beae2c46692c5d60852a9d44f68a64b892d 100644 (file)
--- a/tests/fips-test.c
+++ b/tests/fips-test.c
@@ -46,7 +46,8 @@ void doit(void)
 
        mode = gnutls_fips140_mode_enabled();
        if (mode == 0) {
-               fail("We are not in FIPS140 mode\n");
+               success("We are not in FIPS140 mode\n");
+               exit(77);
        }
 
        ret = global_init();
@@ -98,50 +99,44 @@ void doit(void)
        gnutls_deinit(session);
 
        /* Test when FIPS140 is set to error state */
-       if (mode == 1) {        /* this works in full fips140 mode */
-               _gnutls_fips140_simulate_error();
-
-
-               /* Try crypto.h functionality */
-               ret =
-                   gnutls_cipher_init(&ch, GNUTLS_CIPHER_AES_128_CBC,
-                                      &key, &iv);
-               if (ret >= 0) {
-                       fail("gnutls_cipher_init succeeded when in FIPS140 error state\n");
-               }
-
-               ret =
-                   gnutls_hmac_init(&mh, GNUTLS_MAC_SHA1, key.data,
-                                    key.size);
-               if (ret >= 0) {
-                       fail("gnutls_hmac_init succeeded when in FIPS140 error state\n");
-               }
-
-               ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
-               if (ret >= 0) {
-                       fail("gnutls_rnd succeeded when in FIPS140 error state\n");
-               }
-
-               ret = gnutls_pubkey_init(&pubkey);
-               if (ret >= 0) {
-                       fail("gnutls_pubkey_init succeeded when in FIPS140 error state\n");
-               }
-
-               ret = gnutls_privkey_init(&privkey);
-               if (ret >= 0) {
-                       fail("gnutls_privkey_init succeeded when in FIPS140 error state\n");
-               }
-
-               ret = gnutls_x509_privkey_init(&xprivkey);
-               if (ret >= 0) {
-                       fail("gnutls_x509_privkey_init succeeded when in FIPS140 error state\n");
-               }
-
-               ret = gnutls_init(&session, 0);
-               if (ret >= 0) {
-                       fail("gnutls_init succeeded when in FIPS140 error state\n");
-               }
+       _gnutls_fips140_simulate_error();
 
+
+       /* Try crypto.h functionality */
+       ret =
+           gnutls_cipher_init(&ch, GNUTLS_CIPHER_AES_128_CBC, &key, &iv);
+       if (ret >= 0) {
+               fail("gnutls_cipher_init succeeded when in FIPS140 error state\n");
+       }
+
+       ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA1, key.data, key.size);
+       if (ret >= 0) {
+               fail("gnutls_hmac_init succeeded when in FIPS140 error state\n");
+       }
+
+       ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
+       if (ret >= 0) {
+               fail("gnutls_rnd succeeded when in FIPS140 error state\n");
+       }
+
+       ret = gnutls_pubkey_init(&pubkey);
+       if (ret >= 0) {
+               fail("gnutls_pubkey_init succeeded when in FIPS140 error state\n");
+       }
+
+       ret = gnutls_privkey_init(&privkey);
+       if (ret >= 0) {
+               fail("gnutls_privkey_init succeeded when in FIPS140 error state\n");
+       }
+
+       ret = gnutls_x509_privkey_init(&xprivkey);
+       if (ret >= 0) {
+               fail("gnutls_x509_privkey_init succeeded when in FIPS140 error state\n");
+       }
+
+       ret = gnutls_init(&session, 0);
+       if (ret >= 0) {
+               fail("gnutls_init succeeded when in FIPS140 error state\n");
        }
 
        gnutls_global_deinit();