[git] GCRYPT - branch, LIBGCRYPT-1-5-BRANCH, updated. libgcrypt-1.5.0-8-g5a4a9a1
by Tomas Mraz
cvs at cvs.gnupg.org
Wed Apr 4 17:10:24 CEST 2012
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".
The branch, LIBGCRYPT-1-5-BRANCH has been updated
via 5a4a9a1c7b817e49163537286e50572afe408685 (commit)
from 5898c577034cbc2883f6f788c7deb5903f172bc8 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 5a4a9a1c7b817e49163537286e50572afe408685
Author: Tomas Mraz <tmraz at fedoraproject.org>
Date: Wed Apr 4 14:17:09 2012 +0200
Add GCRYCTL_SET_ENFORCED_FIPS_FLAG command.
* doc/gcrypt.texi: Add documentation of the new command.
* src/fips.c (_gcry_enforced_fips_mode): Report the enforced fips mode
only when fips mode is enabled.
(_gcry_set_enforced_fips_mode): New function.
* src/g10lib.h: Add the _gcry_set_enforced_fips_mode prototype.
* src/gcrypt.h.in: Add the GCRYCTL_SET_ENFORCED_FIPS_FLAG.
* src/global.c (_gcry_vcontrol): Handle the new command.
diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi
index 561a826..5d73578 100644
--- a/doc/gcrypt.texi
+++ b/doc/gcrypt.texi
@@ -577,8 +577,10 @@ initialization (i.e. before @code{gcry_check_version}).
In addition to the standard FIPS mode, Libgcrypt may also be put into
an Enforced FIPS mode by writing a non-zero value into the file
- at file{/etc/gcrypt/fips_enabled}. The Enforced FIPS mode helps to
-detect applications which don't fulfill all requirements for using
+ at file{/etc/gcrypt/fips_enabled} or by using the control command
+ at code{GCRYCTL_SET_ENFORCED_FIPS_FLAG} before any other calls to
+libgcrypt. The Enforced FIPS mode helps to detect applications
+which don't fulfill all requirements for using
Libgcrypt in FIPS mode (@pxref{FIPS Mode}).
Once Libgcrypt has been put into FIPS mode, it is not possible to
@@ -787,20 +789,20 @@ proper random device.
This command dumps information pertaining to the configuration of the
library to the given stream. If NULL is given for @var{stream}, the log
system is used. This command may be used before the intialization has
-been finished but not before a gcry_version_check.
+been finished but not before a @code{gcry_check_version}.
@item GCRYCTL_OPERATIONAL_P; Arguments: none
This command returns true if the library is in an operational state.
This information makes only sense in FIPS mode. In contrast to other
functions, this is a pure test function and won't put the library into
FIPS mode or change the internal state. This command may be used before
-the intialization has been finished but not before a gcry_version_check.
+the intialization has been finished but not before a @code{gcry_check_version}.
@item GCRYCTL_FIPS_MODE_P; Arguments: none
This command returns true if the library is in FIPS mode. Note, that
this is no indication about the current state of the library. This
command may be used before the intialization has been finished but not
-before a gcry_version_check. An application may use this command or
+before a @code{gcry_check_version}. An application may use this command or
the convenience macro below to check whether FIPS mode is actually
active.
@@ -816,10 +818,19 @@ implemented as a macro.
Running this command puts the library into FIPS mode. If the library is
already in FIPS mode, a self-test is triggered and thus the library will
be put into operational state. This command may be used before a call
-to gcry_check_version and that is actually the recommended way to let an
+to @code{gcry_check_version} and that is actually the recommended way to let an
application switch the library into FIPS mode. Note that Libgcrypt will
reject an attempt to switch to fips mode during or after the intialization.
+ at item GCRYCTL_SET_ENFORCED_FIPS_FLAG; Arguments: none
+Running this command sets the internal flag that puts the library into
+the enforced FIPS mode during the FIPS mode initialization. This command
+does not affect the library if the library is not put into the FIPS mode and
+it must be used before any other libgcrypt library calls that initialize
+the library such as @code{gcry_check_version}. Note that Libgcrypt will
+reject an attempt to switch to the enforced fips mode during or after
+the intialization.
+
@item GCRYCTL_SELFTEST; Arguments: none
This may be used at anytime to have the library run all implemented
self-tests. It works in standard and in FIPS mode. Returns 0 on
diff --git a/src/fips.c b/src/fips.c
index 8bc45e7..c5737a7 100644
--- a/src/fips.c
+++ b/src/fips.c
@@ -274,9 +274,17 @@ _gcry_fips_mode (void)
int
_gcry_enforced_fips_mode (void)
{
+ if (!_gcry_fips_mode ())
+ return 0;
return enforced_fips_mode;
}
+/* Set a flag telling whether we are in the enforced fips mode. */
+void
+_gcry_set_enforced_fips_mode (void)
+{
+ enforced_fips_mode = 1;
+}
/* If we do not want to enforce the fips mode, we can set a flag so
that the application may check whether it is still in fips mode.
diff --git a/src/g10lib.h b/src/g10lib.h
index 8d98ae3..30706a2 100644
--- a/src/g10lib.h
+++ b/src/g10lib.h
@@ -326,6 +326,8 @@ int _gcry_fips_mode (void);
int _gcry_enforced_fips_mode (void);
+void _gcry_set_enforced_fips_mode (void);
+
void _gcry_inactivate_fips_mode (const char *text);
int _gcry_is_fips_mode_inactive (void);
diff --git a/src/gcrypt.h.in b/src/gcrypt.h.in
index 44070bc..dab7033 100644
--- a/src/gcrypt.h.in
+++ b/src/gcrypt.h.in
@@ -415,7 +415,8 @@ enum gcry_ctl_cmds
GCRYCTL_FORCE_FIPS_MODE = 56,
GCRYCTL_SELFTEST = 57,
/* Note: 58 .. 62 are used internally. */
- GCRYCTL_DISABLE_HWF = 63
+ GCRYCTL_DISABLE_HWF = 63,
+ GCRYCTL_SET_ENFORCED_FIPS_FLAG = 64
};
/* Perform various operations defined by CMD. */
diff --git a/src/global.c b/src/global.c
index d65b068..24cfca5 100644
--- a/src/global.c
+++ b/src/global.c
@@ -596,6 +596,16 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd, va_list arg_ptr)
}
break;
+ case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
+ if (!any_init_done)
+ {
+ /* Not yet intialized at all. Set the enforced fips mode flag */
+ _gcry_set_enforced_fips_mode ();
+ }
+ else
+ err = GPG_ERR_GENERAL;
+ break;
+
default:
/* A call to make sure that the dummy code is linked in. */
_gcry_compat_identification ();
-----------------------------------------------------------------------
Summary of changes:
doc/gcrypt.texi | 23 +++++++++++++++++------
src/fips.c | 8 ++++++++
src/g10lib.h | 2 ++
src/gcrypt.h.in | 3 ++-
src/global.c | 10 ++++++++++
5 files changed, 39 insertions(+), 7 deletions(-)
hooks/post-receive
--
The GNU crypto library
http://git.gnupg.org
More information about the Gnupg-commits
mailing list