OpenSSL: Allow server/client random to be fetched in FIPS mode

tls_connection_get_keys() used to return TLS master secret, but that
part was removed in commit 94f1fe6f6384a2ef379ef5b8cdc32a2fa01f8d13
('Remove master key extraction from tls_connection_get_keys()'). Since
then, there is no real need for preventing this function from being used
in FIPS mode.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 1dce157d0f234714aed40e4a4434144469c23033..7dc41a5326383d770869c840e767d9a3d2a9d708 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -2642,11 +2642,6 @@ static int tls_global_dh(SSL_CTX *ssl_ctx, const char *dh_file)
 int tls_connection_get_keys(void *ssl_ctx, struct tls_connection *conn,
                            struct tls_keys *keys)
 {
-#ifdef CONFIG_FIPS
-       wpa_printf(MSG_ERROR, "OpenSSL: TLS keys cannot be exported in FIPS "
-                  "mode");
-       return -1;
-#else /* CONFIG_FIPS */
        SSL *ssl;
 
        if (conn == NULL || keys == NULL)
@@ -2675,7 +2670,6 @@ int tls_connection_get_keys(void *ssl_ctx, struct tls_connection *conn,
 #endif
 
        return 0;
-#endif /* CONFIG_FIPS */
 }