The environment variable GNUTLS_FORCE_FIPS_MODE can be used to force the FIPS-140...

diff --git a/lib/fips.c b/lib/fips.c
index 908e5299f316e7d9ff0f3c20e221051949bacb0d..33cf4a6207b84c3fa2e9abf3eb2094b290173ebc 100644 (file)
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -47,10 +47,22 @@ unsigned _gnutls_fips_mode_enabled(void)
 unsigned f1p = 0, f2p;
 FILE* fd;
 static int fips_mode = -1;
+const char *p;
 
        if (fips_mode != -1)
                return fips_mode;
-               
+
+       p = getenv("GNUTLS_FORCE_FIPS_MODE");
+       if (p) {
+               if (p[0] == '1')
+                       fips_mode = 1;
+               else if (p[0] == '2')
+                       fips_mode = 2;
+               else
+                       fips_mode = 0;
+               return fips_mode;
+       }
+
        fd = fopen(FIPS_KERNEL_FILE, "r");
        if (fd != NULL) {
                f1p = fgetc(fd);