import of openssl-0.9.7g; tested on platforms from alpha to zaurus, ok deraadt@

1 files changed, 9 insertions, 0 deletions

diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c
index c5404ca0bc..92f3391f60 100644
--- a/src/lib/libssl/s23_srvr.c
+++ b/src/lib/libssl/s23_srvr.c
@@ -407,6 +407,15 @@ int ssl23_get_client_hello(SSL *s)
                         }
                 }
 
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && (s->version < TLS1_VERSION))
+                {
+                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
+                                        SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
+                goto err;
+                }
+#endif
+
         if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
                 {
                 /* we have SSLv3/TLSv1 in an SSLv2 header