mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-27 05:21:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

Document that the openssl fipsinstall self test callback may not be used.

Browse Source 
Fixes #16260

If the user autoloads a fips module from a config file, then it will run the self tests early (before the self test callback is set),
and they may not get triggered again during the fipsinstall process.
In order for this to happen there must already be a valid fips config file.
As the main purpose of the application is to generate the fips config file, this case has just been documented.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16475)
This commit is contained in:
slontis 2021-08-31 10:59:20 +10:00 committed by Tomas Mraz
parent e396c114eb
commit 8d257d0dc6
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
doc/man1/openssl-fipsinstall.pod.in
View File

@ -197,6 +197,18 @@ All other options are ignored if '-config' is used.
=back
=head1 NOTES
Self tests results are logged by default if the options B<-quiet> and B<-noout>
are not specified, or if either of the options B<-corrupt_desc> or
B<-corrupt_type> are used.
If the base configuration file is set up to autoload the fips module, then the
fips module will be loaded and self tested BEFORE the fipsinstall application
has a chance to set up its own self test callback. As a result of this the self
test output and the options B<-corrupt_desc> and B<-corrupt_type> will be ignored.
For normal usage the base configuration file should use the default provider
when generating the fips configuration file.
=head1 EXAMPLES
Calculate the mac of a FIPS module F<fips.so> and run a FIPS self test