remove FIPS mode support. people who require FIPS can buy something that

meets their needs, but dumping it in here only penalizes the rest of us.
ok miod

1 files changed, 1 insertions, 16 deletions

diff --git a/src/lib/libssl/s23_clnt.c b/src/lib/libssl/s23_clnt.c
index 8ed79c3d55..3d2e7510cf 100644
--- a/src/lib/libssl/s23_clnt.c
+++ b/src/lib/libssl/s23_clnt.c
@@ -387,15 +387,7 @@ ssl23_client_hello(SSL *s)
                 } else if (version == TLS1_VERSION) {
                         version_major = TLS1_VERSION_MAJOR;
                         version_minor = TLS1_VERSION_MINOR;
-                }
-#ifdef OPENSSL_FIPS
-                else if (FIPS_mode()) {
-                        SSLerr(SSL_F_SSL23_CLIENT_HELLO,
-                        SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                        return -1;
-                }
-#endif
-                else if (version == SSL3_VERSION) {
+                } else if (version == SSL3_VERSION) {
                         version_major = SSL3_VERSION_MAJOR;
                         version_minor = SSL3_VERSION_MINOR;
                 } else if (version == SSL2_VERSION) {
@@ -671,13 +663,6 @@ ssl23_get_server_hello(SSL *s)
 
                 if ((p[2] == SSL3_VERSION_MINOR) &&
                     !(s->options & SSL_OP_NO_SSLv3)) {
-#ifdef OPENSSL_FIPS
-                        if (FIPS_mode()) {
-                                SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
-                                SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                                goto err;
-                        }
-#endif
                         s->version = SSL3_VERSION;
                         s->method = SSLv3_client_method();
                 } else if ((p[2] == TLS1_VERSION_MINOR) &&