generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Make ssl code consistent with FIPS branch. The new code has no effect

Browse Source 
at present because it asserts either noop flags or is inside
OPENSSL_FIPS #ifdef's.
This commit is contained in:
Dr. Stephen Henson
2008-06-16 16:56:43 +00:00
parent ff2ab9e6bb
commit 14748adb09
17 changed files with 122 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
ssl/s23_clnt.c
View File

@@ -257,6 +257,14 @@ static int ssl23_client_hello(SSL *s)
version_major = TLS1_VERSION_MAJOR;
version_minor = TLS1_VERSION_MINOR;
}
#ifdef OPENSSL_FIPS
else if(FIPS_mode())
{
SSLerr(SSL_F_SSL23_CLIENT_HELLO,
SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
return -1;
}
#endif
else if (version == SSL3_VERSION)
{
version_major = SSL3_VERSION_MAJOR;
@@ -536,6 +544,14 @@ static int ssl23_get_server_hello(SSL *s)
if ((p[2] == SSL3_VERSION_MINOR) &&
!(s->options & SSL_OP_NO_SSLv3))
{
#ifdef OPENSSL_FIPS
if(FIPS_mode())
{
SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
goto err;
}
#endif
s->version=SSL3_VERSION;
s->method=SSLv3_client_method();
}