diff options
| author |   tedu <tedu@openbsd.org> | 2014-04-15 19:42:56 +0000 |
|---|---|---|
| committer | tedu <tedu@openbsd.org> | 2014-04-15 19:42:56 +0000 |
| commit | 9aa350fda47654255da340793da9ac9b2422db9c (patch) | |
| tree | 35c7560d24ab5b1ee73cc180f2bb87940d0584f5 /lib/libssl/src/ssl/s23_clnt.c | |
| parent | In EC_POINT_invert(), actually check the correct function pointer for NULL (diff) | |
| download | wireguard-openbsd-9aa350fda47654255da340793da9ac9b2422db9c.tar.xz wireguard-openbsd-9aa350fda47654255da340793da9ac9b2422db9c.zip | |
remove FIPS mode support. people who require FIPS can buy something that
meets their needs, but dumping it in here only penalizes the rest of us.
ok miod
Diffstat (limited to 'lib/libssl/src/ssl/s23_clnt.c')
| -rw-r--r-- | lib/libssl/src/ssl/s23_clnt.c | 17 |
1 files changed, 1 insertions, 16 deletions
diff --git a/lib/libssl/src/ssl/s23_clnt.c b/lib/libssl/src/ssl/s23_clnt.c index 8ed79c3d557..3d2e7510cf5 100644 --- a/lib/libssl/src/ssl/s23_clnt.c +++ b/lib/libssl/src/ssl/s23_clnt.c @@ -387,15 +387,7 @@ ssl23_client_hello(SSL *s) } else if (version == TLS1_VERSION) { version_major = TLS1_VERSION_MAJOR; version_minor = TLS1_VERSION_MINOR; - } -#ifdef OPENSSL_FIPS - else if (FIPS_mode()) { - SSLerr(SSL_F_SSL23_CLIENT_HELLO, - SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE); - return -1; - } -#endif - else if (version == SSL3_VERSION) { + } else if (version == SSL3_VERSION) { version_major = SSL3_VERSION_MAJOR; version_minor = SSL3_VERSION_MINOR; } else if (version == SSL2_VERSION) { @@ -671,13 +663,6 @@ ssl23_get_server_hello(SSL *s) if ((p[2] == SSL3_VERSION_MINOR) && !(s->options & SSL_OP_NO_SSLv3)) { -#ifdef OPENSSL_FIPS - if (FIPS_mode()) { - SSLerr(SSL_F_SSL23_GET_SERVER_HELLO, - SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE); - goto err; - } -#endif s->version = SSL3_VERSION; s->method = SSLv3_client_method(); } else if ((p[2] == TLS1_VERSION_MINOR) && |