From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Fri, 22 Nov 2013 15:42:55 +0000 (+0100)
Subject: separate zombie mode from operational fips mode
X-Git-Tag: gnutls_3_3_0pre0~520^2~40
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=20afbbbfbdc41f491450949fd2568a66dbf21077;p=thirdparty%2Fgnutls.git

separate zombie mode from operational fips mode
---

diff --git a/lib/fips.c b/lib/fips.c
index fcb9da2f32..f2c7c1da26 100644
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -63,7 +63,7 @@ FILE* fd;
 		 * and ignored */
 		_gnutls_switch_fips_state(FIPS_STATE_ZOMBIE);
 		_gnutls_debug_log("FIPS140-2 ZOMBIE mode enabled\n");
-		return 1;
+		return 2;
 	}
 
 	return 0;
@@ -276,8 +276,11 @@ error:
 int gnutls_fips140_mode_enabled(void)
 {
 #ifdef ENABLE_FIPS140
+int ret = _gnutls_fips_mode_enabled();
 
-	return _gnutls_fips_mode_enabled();
+	if (ret == 1)
+		return ret;
+	return 0;
 #else
 	return 0;
 #endif
diff --git a/tests/fips-test.c b/tests/fips-test.c
index b8d227680b..f46a3beae2 100644
--- a/tests/fips-test.c
+++ b/tests/fips-test.c
@@ -46,7 +46,8 @@ void doit(void)
 
 	mode = gnutls_fips140_mode_enabled();
 	if (mode == 0) {
-		fail("We are not in FIPS140 mode\n");
+		success("We are not in FIPS140 mode\n");
+		exit(77);
 	}
 
 	ret = global_init();
@@ -98,50 +99,44 @@ void doit(void)
 	gnutls_deinit(session);
 
 	/* Test when FIPS140 is set to error state */
-	if (mode == 1) {	/* this works in full fips140 mode */
-		_gnutls_fips140_simulate_error();
-
-
-		/* Try crypto.h functionality */
-		ret =
-		    gnutls_cipher_init(&ch, GNUTLS_CIPHER_AES_128_CBC,
-				       &key, &iv);
-		if (ret >= 0) {
-			fail("gnutls_cipher_init succeeded when in FIPS140 error state\n");
-		}
-
-		ret =
-		    gnutls_hmac_init(&mh, GNUTLS_MAC_SHA1, key.data,
-				     key.size);
-		if (ret >= 0) {
-			fail("gnutls_hmac_init succeeded when in FIPS140 error state\n");
-		}
-
-		ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
-		if (ret >= 0) {
-			fail("gnutls_rnd succeeded when in FIPS140 error state\n");
-		}
-
-		ret = gnutls_pubkey_init(&pubkey);
-		if (ret >= 0) {
-			fail("gnutls_pubkey_init succeeded when in FIPS140 error state\n");
-		}
-
-		ret = gnutls_privkey_init(&privkey);
-		if (ret >= 0) {
-			fail("gnutls_privkey_init succeeded when in FIPS140 error state\n");
-		}
-
-		ret = gnutls_x509_privkey_init(&xprivkey);
-		if (ret >= 0) {
-			fail("gnutls_x509_privkey_init succeeded when in FIPS140 error state\n");
-		}
-
-		ret = gnutls_init(&session, 0);
-		if (ret >= 0) {
-			fail("gnutls_init succeeded when in FIPS140 error state\n");
-		}
+	_gnutls_fips140_simulate_error();
 
+
+	/* Try crypto.h functionality */
+	ret =
+	    gnutls_cipher_init(&ch, GNUTLS_CIPHER_AES_128_CBC, &key, &iv);
+	if (ret >= 0) {
+		fail("gnutls_cipher_init succeeded when in FIPS140 error state\n");
+	}
+
+	ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA1, key.data, key.size);
+	if (ret >= 0) {
+		fail("gnutls_hmac_init succeeded when in FIPS140 error state\n");
+	}
+
+	ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
+	if (ret >= 0) {
+		fail("gnutls_rnd succeeded when in FIPS140 error state\n");
+	}
+
+	ret = gnutls_pubkey_init(&pubkey);
+	if (ret >= 0) {
+		fail("gnutls_pubkey_init succeeded when in FIPS140 error state\n");
+	}
+
+	ret = gnutls_privkey_init(&privkey);
+	if (ret >= 0) {
+		fail("gnutls_privkey_init succeeded when in FIPS140 error state\n");
+	}
+
+	ret = gnutls_x509_privkey_init(&xprivkey);
+	if (ret >= 0) {
+		fail("gnutls_x509_privkey_init succeeded when in FIPS140 error state\n");
+	}
+
+	ret = gnutls_init(&session, 0);
+	if (ret >= 0) {
+		fail("gnutls_init succeeded when in FIPS140 error state\n");
 	}
 
 	gnutls_global_deinit();