[gnutls-devel] GnuTLS | _gnutls_fips_mode_enabled: treat selftest failure as FIPS disabled (!1306)

[Read-only notification of GNU's TLS library development activities]

Daiki Ueno commented on a discussion on lib/fips.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1306#note_396070323

>  #ifdef ENABLE_FIPS140
>  	unsigned ret = _gnutls_fips_mode_enabled();
>  
> -	if (ret > GNUTLS_FIPS140_DISABLED)
> +	if (ret > GNUTLS_FIPS140_DISABLED) {
> +		/* If the previous run of selftests has failed, return as if
> +		 * the FIPS mode is disabled. We could use HAVE_LIB_ERROR, if

Well the library state is maintained internally, and the only way for the application to know the state is that it aborts the function call if the library is in an error state.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1306#note_396070323
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20200814/fab92c46/attachment.html>