From 7043fa702fa102a45b102e11990b650360c35503 Mon Sep 17 00:00:00 2001
From: "Dr. Stephen Henson" <steve@openssl.org>
Date: Thu, 19 May 2011 18:22:16 +0000
Subject: add FIPS support to ssl: doesn't do anything on this branch yet as
 there is no FIPS compilation support

---
 ssl/s23_clnt.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'ssl/s23_clnt.c')

diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index f49a95ba99..b3c48232d7 100644
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -356,6 +356,14 @@ static int ssl23_client_hello(SSL *s)
 			version_major = TLS1_VERSION_MAJOR;
 			version_minor = TLS1_VERSION_MINOR;
 			}
+#ifdef OPENSSL_FIPS
+		else if(FIPS_mode())
+			{
+			SSLerr(SSL_F_SSL23_CLIENT_HELLO,
+					SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
+			return -1;
+			}
+#endif
 		else if (version == SSL3_VERSION)
 			{
 			version_major = SSL3_VERSION_MAJOR;
@@ -639,6 +647,14 @@ static int ssl23_get_server_hello(SSL *s)
 		if ((p[2] == SSL3_VERSION_MINOR) &&
 			!(s->options & SSL_OP_NO_SSLv3))
 			{
+#ifdef OPENSSL_FIPS
+			if(FIPS_mode())
+				{
+				SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
+					SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
+				goto err;
+				}
+#endif
 			s->version=SSL3_VERSION;
 			s->method=SSLv3_client_method();
 			}
-- 
cgit v1.2.3