diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2011-05-19 18:22:16 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2011-05-19 18:22:16 +0000 |
| commit | 7043fa702fa102a45b102e11990b650360c35503 (patch) | |
| tree | 77edd16724ed7b7312764e44b1f509d975470b76 /ssl/s23_srvr.c | |
| parent | f98d2e5cc13a42c39b2adb6771878ab8157e1fe4 (diff) | |
add FIPS support to ssl: doesn't do anything on this branch yet as there is no FIPS compilation support
Diffstat (limited to 'ssl/s23_srvr.c')
| -rw-r--r-- | ssl/s23_srvr.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c index b21c57a117..4877849013 100644 --- a/ssl/s23_srvr.c +++ b/ssl/s23_srvr.c @@ -115,6 +115,9 @@ #include <openssl/rand.h> #include <openssl/objects.h> #include <openssl/evp.h> +#ifdef OPENSSL_FIPS +#include <openssl/fips.h> +#endif static const SSL_METHOD *ssl23_get_server_method(int ver); int ssl23_get_client_hello(SSL *s); @@ -422,6 +425,15 @@ int ssl23_get_client_hello(SSL *s) } } +#ifdef OPENSSL_FIPS + if (FIPS_mode() && (s->version < TLS1_VERSION)) + { + SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, + SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE); + goto err; + } +#endif + if (s->state == SSL23_ST_SR_CLNT_HELLO_B) { /* we have SSLv3/TLSv1 in an SSLv2 header |