This commit was manufactured by cvs2svn to create branch

[oweals/openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 0f006fad005fdb042290dba59e283f6fc90160dd..9bf1dbec066acca9abbd4226ee6e524f7cc42d55 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -142,7 +142,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_RSA_NULL_SHA,
        SSL3_CK_RSA_NULL_SHA,
        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_STRONG_NONE,
+       SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
        0,
        0,
        0,
@@ -183,7 +183,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_ADH_DES_40_CBC_SHA,
        SSL3_CK_ADH_DES_40_CBC_SHA,
        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        128,
@@ -196,7 +196,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_ADH_DES_64_CBC_SHA,
        SSL3_CK_ADH_DES_64_CBC_SHA,
        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -209,7 +209,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_ADH_DES_192_CBC_SHA,
        SSL3_CK_ADH_DES_192_CBC_SHA,
        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -271,6 +271,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_STRENGTHS,
        },
 /* Cipher 07 */
+#ifndef OPENSSL_NO_IDEA
        {
        1,
        SSL3_TXT_RSA_IDEA_128_SHA,
@@ -283,13 +284,14 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
+#endif
 /* Cipher 08 */
        {
        1,
        SSL3_TXT_RSA_DES_40_CBC_SHA,
        SSL3_CK_RSA_DES_40_CBC_SHA,
        SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -302,7 +304,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_RSA_DES_64_CBC_SHA,
        SSL3_CK_RSA_DES_64_CBC_SHA,
        SSL_kRSA|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -315,7 +317,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_RSA_DES_192_CBC3_SHA,
        SSL3_CK_RSA_DES_192_CBC3_SHA,
        SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -330,7 +332,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
        SSL3_CK_DH_DSS_DES_40_CBC_SHA,
        SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -343,7 +345,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
        SSL3_CK_DH_DSS_DES_64_CBC_SHA,
        SSL_kDHd |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -356,7 +358,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
        SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
        SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -369,7 +371,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
        SSL3_CK_DH_RSA_DES_40_CBC_SHA,
        SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -382,7 +384,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
        SSL3_CK_DH_RSA_DES_64_CBC_SHA,
        SSL_kDHr |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -395,7 +397,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
        SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
        SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -410,7 +412,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
        SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
        SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -423,7 +425,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
        SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
        SSL_kEDH|SSL_aDSS|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -436,7 +438,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
        SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
        SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -449,7 +451,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
        SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
        SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -462,7 +464,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
        SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
        SSL_kEDH|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -475,7 +477,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
        SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
        SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -512,6 +514,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_STRENGTHS,
        },
 
+#if 0
 /* Cipher 1E */
        {
        0,
@@ -525,55 +528,70 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
+#endif
 
 #ifndef OPENSSL_NO_KRB5
 /* The Kerberos ciphers
 ** 20000107 VRS: And the first shall be last,
 ** in hopes of avoiding the lynx ssl renegotiation problem.
 */
-/* Cipher 21 VRS */
+/* Cipher 1E VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_40_CBC_SHA,
-       SSL3_CK_KRB5_DES_40_CBC_SHA,
+       SSL3_TXT_KRB5_DES_64_CBC_SHA,
+       SSL3_CK_KRB5_DES_64_CBC_SHA,
        SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
-       40,
+       56,
        56,
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
 
-/* Cipher 22 VRS */
+/* Cipher 1F VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_40_CBC_MD5,
-       SSL3_CK_KRB5_DES_40_CBC_MD5,
-       SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_MD5    |SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL3_TXT_KRB5_DES_192_CBC3_SHA,
+       SSL3_CK_KRB5_DES_192_CBC3_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_SHA1  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
-       40,
-       56,
+       112,
+       168,
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
 
-/* Cipher 23 VRS */
+/* Cipher 20 VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_64_CBC_SHA,
-       SSL3_CK_KRB5_DES_64_CBC_SHA,
-       SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL3_TXT_KRB5_RC4_128_SHA,
+       SSL3_CK_KRB5_RC4_128_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_SHA1  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_MEDIUM,
        0,
-       56,
-       56,
+       128,
+       128,
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
 
-/* Cipher 24 VRS */
+/* Cipher 21 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
+       SSL3_CK_KRB5_IDEA_128_CBC_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_IDEA|SSL_SHA1  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       0,
+       128,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 22 VRS */
        {
        1,
        SSL3_TXT_KRB5_DES_64_CBC_MD5,
@@ -587,12 +605,12 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_STRENGTHS,
        },
 
-/* Cipher 25 VRS */
+/* Cipher 23 VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_192_CBC3_SHA,
-       SSL3_CK_KRB5_DES_192_CBC3_SHA,
-       SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_SHA1  |SSL_SSLV3,
+       SSL3_TXT_KRB5_DES_192_CBC3_MD5,
+       SSL3_CK_KRB5_DES_192_CBC3_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_MD5   |SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
        0,
        112,
@@ -601,16 +619,114 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_STRENGTHS,
        },
 
+/* Cipher 24 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC4_128_MD5,
+       SSL3_CK_KRB5_RC4_128_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_MD5  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       0,
+       128,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 25 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
+       SSL3_CK_KRB5_IDEA_128_CBC_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_IDEA|SSL_MD5  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       0,
+       128,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
 /* Cipher 26 VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_192_CBC3_MD5,
-       SSL3_CK_KRB5_DES_192_CBC3_MD5,
-       SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_MD5   |SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL3_TXT_KRB5_DES_40_CBC_SHA,
+       SSL3_CK_KRB5_DES_40_CBC_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
-       112,
-       168,
+       40,
+       56,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 27 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC2_40_CBC_SHA,
+       SSL3_CK_KRB5_RC2_40_CBC_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC2|SSL_SHA1   |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       40,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 28 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC4_40_SHA,
+       SSL3_CK_KRB5_RC4_40_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_SHA1   |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       128,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 29 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_DES_40_CBC_MD5,
+       SSL3_CK_KRB5_DES_40_CBC_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_MD5    |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       40,
+       56,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 2A VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC2_40_CBC_MD5,
+       SSL3_CK_KRB5_RC2_40_CBC_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC2|SSL_MD5    |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       40,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 2B VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC4_40_MD5,
+       SSL3_CK_KRB5_RC4_40_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_MD5    |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       128,
+       128,
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
@@ -651,7 +767,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
            TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
            SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
-           SSL_EXPORT|SSL_EXP56,
+           SSL_EXPORT|SSL_EXP56|SSL_FIPS,
            0,
            56,
            56,
@@ -664,7 +780,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
            TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
            SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
-           SSL_EXPORT|SSL_EXP56,
+           SSL_EXPORT|SSL_EXP56|SSL_FIPS,
            0,
            56,
            56,
@@ -719,7 +835,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_RSA_WITH_AES_128_SHA,
            TLS1_CK_RSA_WITH_AES_128_SHA,
            SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -732,7 +848,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
            TLS1_CK_DH_DSS_WITH_AES_128_SHA,
            SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -745,7 +861,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
            TLS1_CK_DH_RSA_WITH_AES_128_SHA,
            SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -758,7 +874,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
            TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
            SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -771,7 +887,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
            TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
            SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -784,7 +900,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_ADH_WITH_AES_128_SHA,
            TLS1_CK_ADH_WITH_AES_128_SHA,
            SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -798,7 +914,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_RSA_WITH_AES_256_SHA,
            TLS1_CK_RSA_WITH_AES_256_SHA,
            SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -811,7 +927,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
            TLS1_CK_DH_DSS_WITH_AES_256_SHA,
            SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -824,7 +940,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
            TLS1_CK_DH_RSA_WITH_AES_256_SHA,
            SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -837,7 +953,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
            TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
            SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -850,7 +966,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
            TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
            SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -863,7 +979,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_ADH_WITH_AES_256_SHA,
            TLS1_CK_ADH_WITH_AES_256_SHA,
            SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -941,7 +1057,7 @@ SSL_CIPHER *ssl3_get_cipher(unsigned int u)
                return(NULL);
        }
 
-int ssl3_pending(SSL *s)
+int ssl3_pending(const SSL *s)
        {
        if (s->rstate == SSL_ST_READ_BODY)
                return 0;
@@ -986,7 +1102,7 @@ void ssl3_free(SSL *s)
                sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
        EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
        EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
-       memset(s->s3,0,sizeof *s->s3);
+       OPENSSL_cleanse(s->s3,sizeof *s->s3);
        OPENSSL_free(s->s3);
        s->s3=NULL;
        }