Remove OPENSSL_FIPS blocks.
Done with unifdef with some manual edits to remove empty lines.
Change-Id: I40d163539cab8ef0e01e45b7dc6a1a0a37733c3e
Reviewed-on: https://boringssl-review.googlesource.com/1097
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index 3336d77..2047a21 100644
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -377,13 +377,6 @@
version_major = TLS1_VERSION_MAJOR;
version_minor = TLS1_VERSION_MINOR;
}
-#ifdef OPENSSL_FIPS
- else if(FIPS_mode())
- {
- OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
- return -1;
- }
-#endif
else if (version == SSL3_VERSION)
{
version_major = SSL3_VERSION_MAJOR;
@@ -610,13 +603,6 @@
if ((p[2] == SSL3_VERSION_MINOR) &&
!(s->options & SSL_OP_NO_SSLv3))
{
-#ifdef OPENSSL_FIPS
- if(FIPS_mode())
- {
- OPENSSL_PUT_ERROR(SSL, ssl23_get_server_hello, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
- goto err;
- }
-#endif
s->version=SSL3_VERSION;
s->method=SSLv3_client_method();
}
diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c
index 55e503c..3a40819 100644
--- a/ssl/s23_srvr.c
+++ b/ssl/s23_srvr.c
@@ -423,14 +423,6 @@
goto err;
}
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && (s->version < TLS1_VERSION))
- {
- OPENSSL_PUT_ERROR(SSL, ssl23_get_client_hello, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
- goto err;
- }
-#endif
-
if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
{
/* we have SSLv3/TLSv1 in an SSLv2 header
diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index e37c4e7..e39d488 100644
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -388,10 +388,6 @@
* which ssl3_cbc_digest_record supports. */
char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
{
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return 0;
-#endif
switch (EVP_MD_CTX_type(ctx))
{
case NID_md5:
@@ -737,50 +733,3 @@
*md_out_size = md_out_size_u;
EVP_MD_CTX_cleanup(&md_ctx);
}
-
-#ifdef OPENSSL_FIPS
-
-/* Due to the need to use EVP in FIPS mode we can't reimplement digests but
- * we can ensure the number of blocks processed is equal for all cases
- * by digesting additional data.
- */
-
-void tls_fips_digest_extra(
- const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx,
- const unsigned char *data, size_t data_len, size_t orig_len)
- {
- size_t block_size, digest_pad, blocks_data, blocks_orig;
- if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
- return;
- block_size = EVP_MD_CTX_block_size(mac_ctx);
- /* We are in FIPS mode if we get this far so we know we have only SHA*
- * digests and TLS to deal with.
- * Minimum digest padding length is 17 for SHA384/SHA512 and 9
- * otherwise.
- * Additional header is 13 bytes. To get the number of digest blocks
- * processed round up the amount of data plus padding to the nearest
- * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
- * So we have:
- * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
- * equivalently:
- * blocks = (payload_len + digest_pad + 12)/block_size + 1
- * HMAC adds a constant overhead.
- * We're ultimately only interested in differences so this becomes
- * blocks = (payload_len + 29)/128
- * for SHA384/SHA512 and
- * blocks = (payload_len + 21)/64
- * otherwise.
- */
- digest_pad = block_size == 64 ? 21 : 29;
- blocks_orig = (orig_len + digest_pad)/block_size;
- blocks_data = (data_len + digest_pad)/block_size;
- /* MAC enough blocks to make up the difference between the original
- * and actual lengths plus one extra block to ensure this is never a
- * no op. The "data" pointer should always have enough space to
- * perform this operation as it is large enough for a maximum
- * length TLS buffer.
- */
- EVP_DigestSignUpdate(mac_ctx, data,
- (blocks_orig - blocks_data + 1) * block_size);
- }
-#endif
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index 0becd82..766cc85 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -473,11 +473,6 @@
s->ssl_version < TLS1_VERSION)
return 1;
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return 1;
-#endif
-
/* TODO(fork): enable the stitched cipher modes. */
#if 0
if (c->algorithm_enc == SSL_RC4 &&
@@ -677,9 +672,6 @@
c = ssl_method->get_cipher(i);
/* drop those that use any of that is not available */
if ((c != NULL) && c->valid &&
-#ifdef OPENSSL_FIPS
- (!FIPS_mode() || (c->algo_strength & SSL_FIPS)) &&
-#endif
!(c->algorithm_mkey & disabled_mkey) &&
!(c->algorithm_auth & disabled_auth) &&
!(c->algorithm_enc & disabled_enc) &&
@@ -1504,11 +1496,7 @@
*/
for (curr = head; curr != NULL; curr = curr->next)
{
-#ifdef OPENSSL_FIPS
- if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
-#else
if (curr->active)
-#endif
{
sk_SSL_CIPHER_push(cipherstack, curr->cipher);
in_group_flags[num_in_group_flags++] = curr->in_group;
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index f0f8100..1e512ca 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -1951,14 +1951,6 @@
return(NULL);
}
-#ifdef OPENSSL_FIPS
- if (FIPS_mode() && (meth->version < TLS1_VERSION))
- {
- OPENSSL_PUT_ERROR(SSL, SSL_CTX_new, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
- return NULL;
- }
-#endif
-
if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0)
{
OPENSSL_PUT_ERROR(SSL, SSL_CTX_new, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index a995a49..dac71b4 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -1255,13 +1255,6 @@
EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
t=EVP_DigestSignFinal(mac_ctx,md,&md_size);
assert(t > 0);
-#ifdef OPENSSL_FIPS
- if (!send && FIPS_mode())
- tls_fips_digest_extra(
- ssl->enc_read_ctx,
- mac_ctx, rec->input,
- rec->length, orig_len);
-#endif
}
if (!stream_mac)
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 0f37072..b1f56a0 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -3169,10 +3169,6 @@
{
#ifndef OPENSSL_NO_MD5
case TLSEXT_hash_md5:
-#ifdef OPENSSL_FIPS
- if (FIPS_mode())
- return NULL;
-#endif
return EVP_md5();
#endif
#ifndef OPENSSL_NO_SHA
