summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authortedu <>2014-04-15 19:42:56 +0000
committertedu <>2014-04-15 19:42:56 +0000
commitea717df2f3c9582198e1e40e6d5a566a33974039 (patch)
treec3cddef2cd4f28b6e01b7aaafadb1976f9e45d89 /src
parent5fbff974ec318bfb1a7cdda2d94ac86eaca1937a (diff)
downloadopenbsd-ea717df2f3c9582198e1e40e6d5a566a33974039.tar.gz
openbsd-ea717df2f3c9582198e1e40e6d5a566a33974039.tar.bz2
openbsd-ea717df2f3c9582198e1e40e6d5a566a33974039.zip
remove FIPS mode support. people who require FIPS can buy something that
meets their needs, but dumping it in here only penalizes the rest of us. ok miod
Diffstat (limited to 'src')
-rw-r--r--src/lib/libssl/s23_clnt.c17
-rw-r--r--src/lib/libssl/s23_srvr.c11
-rw-r--r--src/lib/libssl/s3_cbc.c51
-rw-r--r--src/lib/libssl/s3_clnt.c3
-rw-r--r--src/lib/libssl/src/ssl/s23_clnt.c17
-rw-r--r--src/lib/libssl/src/ssl/s23_srvr.c11
-rw-r--r--src/lib/libssl/src/ssl/s3_cbc.c51
-rw-r--r--src/lib/libssl/src/ssl/s3_clnt.c3
-rw-r--r--src/lib/libssl/src/ssl/s3_enc.c6
-rw-r--r--src/lib/libssl/src/ssl/ssl_ciph.c15
-rw-r--r--src/lib/libssl/src/ssl/ssl_lib.c7
-rw-r--r--src/lib/libssl/src/ssl/ssltest.c21
-rw-r--r--src/lib/libssl/src/ssl/t1_enc.c7
-rw-r--r--src/lib/libssl/ssl_ciph.c15
-rw-r--r--src/lib/libssl/ssl_lib.c7
-rw-r--r--src/lib/libssl/t1_enc.c7
16 files changed, 4 insertions, 245 deletions
diff --git a/src/lib/libssl/s23_clnt.c b/src/lib/libssl/s23_clnt.c
index 8ed79c3d55..3d2e7510cf 100644
--- a/src/lib/libssl/s23_clnt.c
+++ b/src/lib/libssl/s23_clnt.c
@@ -387,15 +387,7 @@ ssl23_client_hello(SSL *s)
387 } else if (version == TLS1_VERSION) { 387 } else if (version == TLS1_VERSION) {
388 version_major = TLS1_VERSION_MAJOR; 388 version_major = TLS1_VERSION_MAJOR;
389 version_minor = TLS1_VERSION_MINOR; 389 version_minor = TLS1_VERSION_MINOR;
390 } 390 } else if (version == SSL3_VERSION) {
391#ifdef OPENSSL_FIPS
392 else if (FIPS_mode()) {
393 SSLerr(SSL_F_SSL23_CLIENT_HELLO,
394 SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
395 return -1;
396 }
397#endif
398 else if (version == SSL3_VERSION) {
399 version_major = SSL3_VERSION_MAJOR; 391 version_major = SSL3_VERSION_MAJOR;
400 version_minor = SSL3_VERSION_MINOR; 392 version_minor = SSL3_VERSION_MINOR;
401 } else if (version == SSL2_VERSION) { 393 } else if (version == SSL2_VERSION) {
@@ -671,13 +663,6 @@ ssl23_get_server_hello(SSL *s)
671 663
672 if ((p[2] == SSL3_VERSION_MINOR) && 664 if ((p[2] == SSL3_VERSION_MINOR) &&
673 !(s->options & SSL_OP_NO_SSLv3)) { 665 !(s->options & SSL_OP_NO_SSLv3)) {
674#ifdef OPENSSL_FIPS
675 if (FIPS_mode()) {
676 SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
677 SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
678 goto err;
679 }
680#endif
681 s->version = SSL3_VERSION; 666 s->version = SSL3_VERSION;
682 s->method = SSLv3_client_method(); 667 s->method = SSLv3_client_method();
683 } else if ((p[2] == TLS1_VERSION_MINOR) && 668 } else if ((p[2] == TLS1_VERSION_MINOR) &&
diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c
index 2aad21e93c..ca95d4e636 100644
--- a/src/lib/libssl/s23_srvr.c
+++ b/src/lib/libssl/s23_srvr.c
@@ -115,9 +115,6 @@
115#include <openssl/rand.h> 115#include <openssl/rand.h>
116#include <openssl/objects.h> 116#include <openssl/objects.h>
117#include <openssl/evp.h> 117#include <openssl/evp.h>
118#ifdef OPENSSL_FIPS
119#include <openssl/fips.h>
120#endif
121 118
122static const SSL_METHOD *ssl23_get_server_method(int ver); 119static const SSL_METHOD *ssl23_get_server_method(int ver);
123int ssl23_get_client_hello(SSL *s); 120int ssl23_get_client_hello(SSL *s);
@@ -388,14 +385,6 @@ ssl23_get_client_hello(SSL *s)
388 } 385 }
389 } 386 }
390 387
391#ifdef OPENSSL_FIPS
392 if (FIPS_mode() && (s->version < TLS1_VERSION)) {
393 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
394 SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
395 goto err;
396 }
397#endif
398
399 if (s->state == SSL23_ST_SR_CLNT_HELLO_B) { 388 if (s->state == SSL23_ST_SR_CLNT_HELLO_B) {
400 /* we have SSLv3/TLSv1 in an SSLv2 header 389 /* we have SSLv3/TLSv1 in an SSLv2 header
401 * (other cases skip this state) */ 390 * (other cases skip this state) */
diff --git a/src/lib/libssl/s3_cbc.c b/src/lib/libssl/s3_cbc.c
index d6cc9b4771..964266e5b2 100644
--- a/src/lib/libssl/s3_cbc.c
+++ b/src/lib/libssl/s3_cbc.c
@@ -386,10 +386,6 @@ tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
386char 386char
387ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx) 387ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
388{ 388{
389#ifdef OPENSSL_FIPS
390 if (FIPS_mode())
391 return 0;
392#endif
393 switch (EVP_MD_CTX_type(ctx)) { 389 switch (EVP_MD_CTX_type(ctx)) {
394 case NID_md5: 390 case NID_md5:
395 case NID_sha1: 391 case NID_sha1:
@@ -710,50 +706,3 @@ void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char* md_out,
710 *md_out_size = md_out_size_u; 706 *md_out_size = md_out_size_u;
711 EVP_MD_CTX_cleanup(&md_ctx); 707 EVP_MD_CTX_cleanup(&md_ctx);
712} 708}
713
714#ifdef OPENSSL_FIPS
715
716/* Due to the need to use EVP in FIPS mode we can't reimplement digests but
717 * we can ensure the number of blocks processed is equal for all cases
718 * by digesting additional data.
719 */
720
721void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
722 EVP_MD_CTX *mac_ctx, const unsigned char *data, size_t data_len,
723 size_t orig_len)
724{
725 size_t block_size, digest_pad, blocks_data, blocks_orig;
726 if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
727 return;
728 block_size = EVP_MD_CTX_block_size(mac_ctx);
729 /* We are in FIPS mode if we get this far so we know we have only SHA*
730 * digests and TLS to deal with.
731 * Minimum digest padding length is 17 for SHA384/SHA512 and 9
732 * otherwise.
733 * Additional header is 13 bytes. To get the number of digest blocks
734 * processed round up the amount of data plus padding to the nearest
735 * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
736 * So we have:
737 * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
738 * equivalently:
739 * blocks = (payload_len + digest_pad + 12)/block_size + 1
740 * HMAC adds a constant overhead.
741 * We're ultimately only interested in differences so this becomes
742 * blocks = (payload_len + 29)/128
743 * for SHA384/SHA512 and
744 * blocks = (payload_len + 21)/64
745 * otherwise.
746 */
747 digest_pad = block_size == 64 ? 21 : 29;
748 blocks_orig = (orig_len + digest_pad)/block_size;
749 blocks_data = (data_len + digest_pad)/block_size;
750 /* MAC enough blocks to make up the difference between the original
751 * and actual lengths plus one extra block to ensure this is never a
752 * no op. The "data" pointer should always have enough space to
753 * perform this operation as it is large enough for a maximum
754 * length TLS buffer.
755 */
756 EVP_DigestSignUpdate(mac_ctx, data,
757 (blocks_orig - blocks_data + 1) * block_size);
758}
759#endif
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index c1460266fe..88be294ab7 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -156,9 +156,6 @@
156#include <openssl/objects.h> 156#include <openssl/objects.h>
157#include <openssl/evp.h> 157#include <openssl/evp.h>
158#include <openssl/md5.h> 158#include <openssl/md5.h>
159#ifdef OPENSSL_FIPS
160#include <openssl/fips.h>
161#endif
162#ifndef OPENSSL_NO_DH 159#ifndef OPENSSL_NO_DH
163#include <openssl/dh.h> 160#include <openssl/dh.h>
164#endif 161#endif
diff --git a/src/lib/libssl/src/ssl/s23_clnt.c b/src/lib/libssl/src/ssl/s23_clnt.c
index 8ed79c3d55..3d2e7510cf 100644
--- a/src/lib/libssl/src/ssl/s23_clnt.c
+++ b/src/lib/libssl/src/ssl/s23_clnt.c
@@ -387,15 +387,7 @@ ssl23_client_hello(SSL *s)
387 } else if (version == TLS1_VERSION) { 387 } else if (version == TLS1_VERSION) {
388 version_major = TLS1_VERSION_MAJOR; 388 version_major = TLS1_VERSION_MAJOR;
389 version_minor = TLS1_VERSION_MINOR; 389 version_minor = TLS1_VERSION_MINOR;
390 } 390 } else if (version == SSL3_VERSION) {
391#ifdef OPENSSL_FIPS
392 else if (FIPS_mode()) {
393 SSLerr(SSL_F_SSL23_CLIENT_HELLO,
394 SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
395 return -1;
396 }
397#endif
398 else if (version == SSL3_VERSION) {
399 version_major = SSL3_VERSION_MAJOR; 391 version_major = SSL3_VERSION_MAJOR;
400 version_minor = SSL3_VERSION_MINOR; 392 version_minor = SSL3_VERSION_MINOR;
401 } else if (version == SSL2_VERSION) { 393 } else if (version == SSL2_VERSION) {
@@ -671,13 +663,6 @@ ssl23_get_server_hello(SSL *s)
671 663
672 if ((p[2] == SSL3_VERSION_MINOR) && 664 if ((p[2] == SSL3_VERSION_MINOR) &&
673 !(s->options & SSL_OP_NO_SSLv3)) { 665 !(s->options & SSL_OP_NO_SSLv3)) {
674#ifdef OPENSSL_FIPS
675 if (FIPS_mode()) {
676 SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
677 SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
678 goto err;
679 }
680#endif
681 s->version = SSL3_VERSION; 666 s->version = SSL3_VERSION;
682 s->method = SSLv3_client_method(); 667 s->method = SSLv3_client_method();
683 } else if ((p[2] == TLS1_VERSION_MINOR) && 668 } else if ((p[2] == TLS1_VERSION_MINOR) &&
diff --git a/src/lib/libssl/src/ssl/s23_srvr.c b/src/lib/libssl/src/ssl/s23_srvr.c
index 2aad21e93c..ca95d4e636 100644
--- a/src/lib/libssl/src/ssl/s23_srvr.c
+++ b/src/lib/libssl/src/ssl/s23_srvr.c
@@ -115,9 +115,6 @@
115#include <openssl/rand.h> 115#include <openssl/rand.h>
116#include <openssl/objects.h> 116#include <openssl/objects.h>
117#include <openssl/evp.h> 117#include <openssl/evp.h>
118#ifdef OPENSSL_FIPS
119#include <openssl/fips.h>
120#endif
121 118
122static const SSL_METHOD *ssl23_get_server_method(int ver); 119static const SSL_METHOD *ssl23_get_server_method(int ver);
123int ssl23_get_client_hello(SSL *s); 120int ssl23_get_client_hello(SSL *s);
@@ -388,14 +385,6 @@ ssl23_get_client_hello(SSL *s)
388 } 385 }
389 } 386 }
390 387
391#ifdef OPENSSL_FIPS
392 if (FIPS_mode() && (s->version < TLS1_VERSION)) {
393 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
394 SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
395 goto err;
396 }
397#endif
398
399 if (s->state == SSL23_ST_SR_CLNT_HELLO_B) { 388 if (s->state == SSL23_ST_SR_CLNT_HELLO_B) {
400 /* we have SSLv3/TLSv1 in an SSLv2 header 389 /* we have SSLv3/TLSv1 in an SSLv2 header
401 * (other cases skip this state) */ 390 * (other cases skip this state) */
diff --git a/src/lib/libssl/src/ssl/s3_cbc.c b/src/lib/libssl/src/ssl/s3_cbc.c
index d6cc9b4771..964266e5b2 100644
--- a/src/lib/libssl/src/ssl/s3_cbc.c
+++ b/src/lib/libssl/src/ssl/s3_cbc.c
@@ -386,10 +386,6 @@ tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
386char 386char
387ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx) 387ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
388{ 388{
389#ifdef OPENSSL_FIPS
390 if (FIPS_mode())
391 return 0;
392#endif
393 switch (EVP_MD_CTX_type(ctx)) { 389 switch (EVP_MD_CTX_type(ctx)) {
394 case NID_md5: 390 case NID_md5:
395 case NID_sha1: 391 case NID_sha1:
@@ -710,50 +706,3 @@ void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char* md_out,
710 *md_out_size = md_out_size_u; 706 *md_out_size = md_out_size_u;
711 EVP_MD_CTX_cleanup(&md_ctx); 707 EVP_MD_CTX_cleanup(&md_ctx);
712} 708}
713
714#ifdef OPENSSL_FIPS
715
716/* Due to the need to use EVP in FIPS mode we can't reimplement digests but
717 * we can ensure the number of blocks processed is equal for all cases
718 * by digesting additional data.
719 */
720
721void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
722 EVP_MD_CTX *mac_ctx, const unsigned char *data, size_t data_len,
723 size_t orig_len)
724{
725 size_t block_size, digest_pad, blocks_data, blocks_orig;
726 if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
727 return;
728 block_size = EVP_MD_CTX_block_size(mac_ctx);
729 /* We are in FIPS mode if we get this far so we know we have only SHA*
730 * digests and TLS to deal with.
731 * Minimum digest padding length is 17 for SHA384/SHA512 and 9
732 * otherwise.
733 * Additional header is 13 bytes. To get the number of digest blocks
734 * processed round up the amount of data plus padding to the nearest
735 * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
736 * So we have:
737 * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
738 * equivalently:
739 * blocks = (payload_len + digest_pad + 12)/block_size + 1
740 * HMAC adds a constant overhead.
741 * We're ultimately only interested in differences so this becomes
742 * blocks = (payload_len + 29)/128
743 * for SHA384/SHA512 and
744 * blocks = (payload_len + 21)/64
745 * otherwise.
746 */
747 digest_pad = block_size == 64 ? 21 : 29;
748 blocks_orig = (orig_len + digest_pad)/block_size;
749 blocks_data = (data_len + digest_pad)/block_size;
750 /* MAC enough blocks to make up the difference between the original
751 * and actual lengths plus one extra block to ensure this is never a
752 * no op. The "data" pointer should always have enough space to
753 * perform this operation as it is large enough for a maximum
754 * length TLS buffer.
755 */
756 EVP_DigestSignUpdate(mac_ctx, data,
757 (blocks_orig - blocks_data + 1) * block_size);
758}
759#endif
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index c1460266fe..88be294ab7 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -156,9 +156,6 @@
156#include <openssl/objects.h> 156#include <openssl/objects.h>
157#include <openssl/evp.h> 157#include <openssl/evp.h>
158#include <openssl/md5.h> 158#include <openssl/md5.h>
159#ifdef OPENSSL_FIPS
160#include <openssl/fips.h>
161#endif
162#ifndef OPENSSL_NO_DH 159#ifndef OPENSSL_NO_DH
163#include <openssl/dh.h> 160#include <openssl/dh.h>
164#endif 161#endif
diff --git a/src/lib/libssl/src/ssl/s3_enc.c b/src/lib/libssl/src/ssl/s3_enc.c
index 9ed5850e73..bfd40b3d11 100644
--- a/src/lib/libssl/src/ssl/s3_enc.c
+++ b/src/lib/libssl/src/ssl/s3_enc.c
@@ -591,12 +591,6 @@ ssl3_digest_cached_records(SSL *s)
591 for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++) { 591 for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++) {
592 if ((mask & ssl_get_algorithm2(s)) && md) { 592 if ((mask & ssl_get_algorithm2(s)) && md) {
593 s->s3->handshake_dgst[i] = EVP_MD_CTX_create(); 593 s->s3->handshake_dgst[i] = EVP_MD_CTX_create();
594#ifdef OPENSSL_FIPS
595 if (EVP_MD_nid(md) == NID_md5) {
596 EVP_MD_CTX_set_flags(s->s3->handshake_dgst[i],
597 EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
598 }
599#endif
600 EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL); 594 EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL);
601 EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata, hdatalen); 595 EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata, hdatalen);
602 } else { 596 } else {
diff --git a/src/lib/libssl/src/ssl/ssl_ciph.c b/src/lib/libssl/src/ssl/ssl_ciph.c
index ed2e78bdcc..ed5ac725a2 100644
--- a/src/lib/libssl/src/ssl/ssl_ciph.c
+++ b/src/lib/libssl/src/ssl/ssl_ciph.c
@@ -617,11 +617,6 @@ ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
617 s->ssl_version < TLS1_VERSION) 617 s->ssl_version < TLS1_VERSION)
618 return 1; 618 return 1;
619 619
620#ifdef OPENSSL_FIPS
621 if (FIPS_mode())
622 return 1;
623#endif
624
625 if (c->algorithm_enc == SSL_RC4 && 620 if (c->algorithm_enc == SSL_RC4 &&
626 c->algorithm_mac == SSL_MD5 && 621 c->algorithm_mac == SSL_MD5 &&
627 (evp = EVP_get_cipherbyname("RC4-HMAC-MD5"))) 622 (evp = EVP_get_cipherbyname("RC4-HMAC-MD5")))
@@ -798,9 +793,6 @@ CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
798 c = ssl_method->get_cipher(i); 793 c = ssl_method->get_cipher(i);
799 /* drop those that use any of that is not available */ 794 /* drop those that use any of that is not available */
800 if ((c != NULL) && c->valid && 795 if ((c != NULL) && c->valid &&
801#ifdef OPENSSL_FIPS
802 (!FIPS_mode() || (c->algo_strength & SSL_FIPS)) &&
803#endif
804 !(c->algorithm_mkey & disabled_mkey) && 796 !(c->algorithm_mkey & disabled_mkey) &&
805 !(c->algorithm_auth & disabled_auth) && 797 !(c->algorithm_auth & disabled_auth) &&
806 !(c->algorithm_enc & disabled_enc) && 798 !(c->algorithm_enc & disabled_enc) &&
@@ -1461,12 +1453,7 @@ const char *rule_str)
1461 * to the resulting precedence to the STACK_OF(SSL_CIPHER). 1453 * to the resulting precedence to the STACK_OF(SSL_CIPHER).
1462 */ 1454 */
1463 for (curr = head; curr != NULL; curr = curr->next) { 1455 for (curr = head; curr != NULL; curr = curr->next) {
1464#ifdef OPENSSL_FIPS 1456 if (curr->active) {
1465 if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
1466#else
1467 if (curr->active)
1468#endif
1469 {
1470 sk_SSL_CIPHER_push(cipherstack, curr->cipher); 1457 sk_SSL_CIPHER_push(cipherstack, curr->cipher);
1471#ifdef CIPHER_DEBUG 1458#ifdef CIPHER_DEBUG
1472 printf("<%s>\n", curr->cipher->name); 1459 printf("<%s>\n", curr->cipher->name);
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index 98764b82aa..b5ba0f4aac 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -1708,13 +1708,6 @@ SSL_CTX
1708 return (NULL); 1708 return (NULL);
1709 } 1709 }
1710 1710
1711#ifdef OPENSSL_FIPS
1712 if (FIPS_mode() && (meth->version < TLS1_VERSION)) {
1713 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
1714 return NULL;
1715 }
1716#endif
1717
1718 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) { 1711 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
1719 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS); 1712 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
1720 goto err; 1713 goto err;
diff --git a/src/lib/libssl/src/ssl/ssltest.c b/src/lib/libssl/src/ssl/ssltest.c
index 664147cb6a..ea236df44d 100644
--- a/src/lib/libssl/src/ssl/ssltest.c
+++ b/src/lib/libssl/src/ssl/ssltest.c
@@ -299,9 +299,6 @@ sv_usage(void)
299{ 299{
300 fprintf(stderr, "usage: ssltest [args ...]\n"); 300 fprintf(stderr, "usage: ssltest [args ...]\n");
301 fprintf(stderr, "\n"); 301 fprintf(stderr, "\n");
302#ifdef OPENSSL_FIPS
303 fprintf(stderr, "-F - run test in FIPS mode\n");
304#endif
305 fprintf(stderr, " -server_auth - check server certificate\n"); 302 fprintf(stderr, " -server_auth - check server certificate\n");
306 fprintf(stderr, " -client_auth - do client authentication\n"); 303 fprintf(stderr, " -client_auth - do client authentication\n");
307 fprintf(stderr, " -proxy - allow proxy certificates\n"); 304 fprintf(stderr, " -proxy - allow proxy certificates\n");
@@ -526,9 +523,6 @@ main(int argc, char *argv[])
526 STACK_OF(SSL_COMP) *ssl_comp_methods = NULL; 523 STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
527#endif 524#endif
528 int test_cipherlist = 0; 525 int test_cipherlist = 0;
529#ifdef OPENSSL_FIPS
530 int fips_mode = 0;
531#endif
532 526
533 verbose = 0; 527 verbose = 0;
534 debug = 0; 528 debug = 0;
@@ -558,12 +552,8 @@ main(int argc, char *argv[])
558 552
559 while (argc >= 1) { 553 while (argc >= 1) {
560 if (!strcmp(*argv, "-F")) { 554 if (!strcmp(*argv, "-F")) {
561#ifdef OPENSSL_FIPS
562 fips_mode = 1;
563#else
564 fprintf(stderr, "not compiled with FIPS support, so exitting without running.\n"); 555 fprintf(stderr, "not compiled with FIPS support, so exitting without running.\n");
565 exit(0); 556 exit(0);
566#endif
567 } else if (strcmp(*argv, "-server_auth") == 0) 557 } else if (strcmp(*argv, "-server_auth") == 0)
568 server_auth = 1; 558 server_auth = 1;
569 else if (strcmp(*argv, "-client_auth") == 0) 559 else if (strcmp(*argv, "-client_auth") == 0)
@@ -739,17 +729,6 @@ bad:
739 exit(1); 729 exit(1);
740 } 730 }
741 731
742#ifdef OPENSSL_FIPS
743 if (fips_mode) {
744 if (!FIPS_mode_set(1)) {
745 ERR_load_crypto_strings();
746 ERR_print_errors(BIO_new_fp(stderr, BIO_NOCLOSE));
747 exit(1);
748 } else
749 fprintf(stderr, "*** IN FIPS MODE ***\n");
750 }
751#endif
752
753 if (print_time) { 732 if (print_time) {
754 if (!bio_pair) { 733 if (!bio_pair) {
755 fprintf(stderr, "Using BIO pair (-bio_pair)\n"); 734 fprintf(stderr, "Using BIO pair (-bio_pair)\n");
diff --git a/src/lib/libssl/src/ssl/t1_enc.c b/src/lib/libssl/src/ssl/t1_enc.c
index e59e883424..71d9f164b4 100644
--- a/src/lib/libssl/src/ssl/t1_enc.c
+++ b/src/lib/libssl/src/ssl/t1_enc.c
@@ -981,13 +981,6 @@ tls1_mac(SSL *ssl, unsigned char *md, int send)
981 EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length); 981 EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length);
982 t = EVP_DigestSignFinal(mac_ctx, md, &md_size); 982 t = EVP_DigestSignFinal(mac_ctx, md, &md_size);
983 OPENSSL_assert(t > 0); 983 OPENSSL_assert(t > 0);
984#ifdef OPENSSL_FIPS
985 if (!send && FIPS_mode())
986 tls_fips_digest_extra(
987 ssl->enc_read_ctx,
988 mac_ctx, rec->input,
989 rec->length, orig_len);
990#endif
991 } 984 }
992 985
993 if (!stream_mac) 986 if (!stream_mac)
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index ed2e78bdcc..ed5ac725a2 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -617,11 +617,6 @@ ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
617 s->ssl_version < TLS1_VERSION) 617 s->ssl_version < TLS1_VERSION)
618 return 1; 618 return 1;
619 619
620#ifdef OPENSSL_FIPS
621 if (FIPS_mode())
622 return 1;
623#endif
624
625 if (c->algorithm_enc == SSL_RC4 && 620 if (c->algorithm_enc == SSL_RC4 &&
626 c->algorithm_mac == SSL_MD5 && 621 c->algorithm_mac == SSL_MD5 &&
627 (evp = EVP_get_cipherbyname("RC4-HMAC-MD5"))) 622 (evp = EVP_get_cipherbyname("RC4-HMAC-MD5")))
@@ -798,9 +793,6 @@ CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
798 c = ssl_method->get_cipher(i); 793 c = ssl_method->get_cipher(i);
799 /* drop those that use any of that is not available */ 794 /* drop those that use any of that is not available */
800 if ((c != NULL) && c->valid && 795 if ((c != NULL) && c->valid &&
801#ifdef OPENSSL_FIPS
802 (!FIPS_mode() || (c->algo_strength & SSL_FIPS)) &&
803#endif
804 !(c->algorithm_mkey & disabled_mkey) && 796 !(c->algorithm_mkey & disabled_mkey) &&
805 !(c->algorithm_auth & disabled_auth) && 797 !(c->algorithm_auth & disabled_auth) &&
806 !(c->algorithm_enc & disabled_enc) && 798 !(c->algorithm_enc & disabled_enc) &&
@@ -1461,12 +1453,7 @@ const char *rule_str)
1461 * to the resulting precedence to the STACK_OF(SSL_CIPHER). 1453 * to the resulting precedence to the STACK_OF(SSL_CIPHER).
1462 */ 1454 */
1463 for (curr = head; curr != NULL; curr = curr->next) { 1455 for (curr = head; curr != NULL; curr = curr->next) {
1464#ifdef OPENSSL_FIPS 1456 if (curr->active) {
1465 if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
1466#else
1467 if (curr->active)
1468#endif
1469 {
1470 sk_SSL_CIPHER_push(cipherstack, curr->cipher); 1457 sk_SSL_CIPHER_push(cipherstack, curr->cipher);
1471#ifdef CIPHER_DEBUG 1458#ifdef CIPHER_DEBUG
1472 printf("<%s>\n", curr->cipher->name); 1459 printf("<%s>\n", curr->cipher->name);
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 98764b82aa..b5ba0f4aac 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1708,13 +1708,6 @@ SSL_CTX
1708 return (NULL); 1708 return (NULL);
1709 } 1709 }
1710 1710
1711#ifdef OPENSSL_FIPS
1712 if (FIPS_mode() && (meth->version < TLS1_VERSION)) {
1713 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
1714 return NULL;
1715 }
1716#endif
1717
1718 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) { 1711 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
1719 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS); 1712 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
1720 goto err; 1713 goto err;
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index e59e883424..71d9f164b4 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -981,13 +981,6 @@ tls1_mac(SSL *ssl, unsigned char *md, int send)
981 EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length); 981 EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length);
982 t = EVP_DigestSignFinal(mac_ctx, md, &md_size); 982 t = EVP_DigestSignFinal(mac_ctx, md, &md_size);
983 OPENSSL_assert(t > 0); 983 OPENSSL_assert(t > 0);
984#ifdef OPENSSL_FIPS
985 if (!send && FIPS_mode())
986 tls_fips_digest_extra(
987 ssl->enc_read_ctx,
988 mac_ctx, rec->input,
989 rec->length, orig_len);
990#endif
991 } 984 }
992 985
993 if (!stream_mac) 986 if (!stream_mac)
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 14:23:39 +0000