--- Python-3.4.4/Modules/_ssl.c.orig 2015-12-21 07:01:03.000000000 +0200 +++ Python-3.4.4/Modules/_ssl.c 2016-07-22 18:17:46.421990000 +0300 @@ -3737,6 +3737,43 @@ #endif /* _MSC_VER */ +/* Comment the below macro definition + * to exclude FIPS_mode functions from build. */ +#define EXPORT_FIPSMODE_FUNCS + +#ifdef EXPORT_FIPSMODE_FUNCS + +static PyObject * +PySSL_FIPS_mode(PyObject *self) { + return PyLong_FromLong(FIPS_mode()); +} + +PyDoc_STRVAR(PySSL_FIPS_mode_doc, +"FIPS_mode() -> int\n\ +\n\ +Returns != 0 (1) if FIPS mode is enabled, 0 otherwise."); + +static PyObject * +PySSL_FIPS_mode_set(PyObject *self, PyObject *arg) { + if (!PyLong_Check(arg)) + return PyErr_Format(PyExc_TypeError, + "FIPS_mode_set() expected int, found %s", + Py_TYPE(arg)->tp_name); + if (FIPS_mode_set(PyLong_AsUnsignedLong(arg)) == 0) { + _setSSLError(ERR_error_string(ERR_get_error(), NULL) , 0, __FILE__, __LINE__); + return NULL; + } + Py_RETURN_NONE; +} + +PyDoc_STRVAR(PySSL_FIPS_mode_set_doc, +"FIPS_mode_set(mode) -> None\n\ +\n\ +Tries to set the FIPS mode to 'mode' (int).\n\ +Returns nothing. Raises TypeError when 'mode' is invalid,\n\ +SSLError when enabling FIPS mode fails."); +#endif //EXPORT_FIPSMODE_FUNCS + /* List of functions exported by this module. */ static PyMethodDef PySSL_methods[] = { @@ -3768,6 +3805,12 @@ METH_VARARGS | METH_KEYWORDS, PySSL_txt2obj_doc}, {"nid2obj", (PyCFunction)PySSL_nid2obj, METH_VARARGS, PySSL_nid2obj_doc}, +#ifdef EXPORT_FIPSMODE_FUNCS + {"FIPS_mode", (PyCFunction)PySSL_FIPS_mode, METH_NOARGS, + PySSL_FIPS_mode_doc}, + {"FIPS_mode_set", (PyCFunction)PySSL_FIPS_mode_set, METH_O, + PySSL_FIPS_mode_set_doc}, +#endif {NULL, NULL} /* Sentinel */ }; --- Python-3.4.4/Lib/ssl.py.orig 2015-12-21 07:00:59.000000000 +0200 +++ Python-3.4.4/Lib/ssl.py 2016-07-22 12:23:25.635415500 +0300 @@ -111,6 +111,12 @@ # LibreSSL does not provide RAND_egd pass +# Try exposing the FIPS functions if available. +try: + from _ssl import FIPS_mode, FIPS_mode_set +except ImportError: + pass + def _import_symbols(prefix): for n in dir(_ssl): if n.startswith(prefix):