generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Implement FIPS_mode and FIPS_mode_set

Browse Source
This commit is contained in:
Dr. Stephen Henson
2011-05-19 18:09:02 +00:00
parent 05b4fc6c22
commit 086e32a6c7
15 changed files with 189 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
ssl/s23_clnt.c
View File

@@ -356,6 +356,14 @@ static int ssl23_client_hello(SSL *s)
version_major = TLS1_VERSION_MAJOR;
version_minor = TLS1_VERSION_MINOR;
}
#ifdef OPENSSL_FIPS
else if(FIPS_mode())
{
SSLerr(SSL_F_SSL23_CLIENT_HELLO,
SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
return -1;
}
#endif
else if (version == SSL3_VERSION)
{
version_major = SSL3_VERSION_MAJOR;
@@ -639,6 +647,14 @@ static int ssl23_get_server_hello(SSL *s)
if ((p[2] == SSL3_VERSION_MINOR) &&
!(s->options & SSL_OP_NO_SSLv3))
{
#ifdef OPENSSL_FIPS
if(FIPS_mode())
{
SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
goto err;
}
#endif
s->version=SSL3_VERSION;
s->method=SSLv3_client_method();
}