Add more meaningful OPENSSL_NO_ECDH error message for suite b mode

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit db812f2d70f0695fd53b386fe5e870bef8ca3c22)

diff --git a/ssl/ssl.h b/ssl/ssl.h
index a5af6fca57f172c1597eb0bf62325a07c1a7b953..d51ae387f4e8c2d98f49d45f2e1d6a13c35ffee8 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -2778,6 +2778,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_ECC_CERT_NOT_FOR_SIGNING                  318
 #define SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE        322
 #define SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE       323
+#define SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE             374
 #define SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER              310
 #define SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST        354
 #define SSL_R_ENCRYPTED_LENGTH_TOO_LONG                         150

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index b26a57e439747613665fc9199f5caf1aa83b42c4..0ad11dd1b7d00e7f1a26cf0854a5b8df47dcf901 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -1440,7 +1440,7 @@ static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,
        c->ecdh_tmp_auto = 1;
        return 1;
 #else
-       SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST, SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
+       SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST, SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE);
        return 0;
 #endif
        }

diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index fd63d37257c5ffe6a6613114b1565cd7c5cc280e..8fca51ba56ecaf886a08447c65e2e5b9536f6595 100644 (file)
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -385,6 +385,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_SIGNING),"ecc cert not for signing"},
 {ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE),"ecc cert should have rsa signature"},
 {ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE),"ecc cert should have sha1 signature"},
+{ERR_REASON(SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE),"ecdh required for suiteb mode"},
 {ERR_REASON(SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER),"ecgroup too large for cipher"},
 {ERR_REASON(SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST),"empty srtp protection profile list"},
 {ERR_REASON(SSL_R_ENCRYPTED_LENGTH_TOO_LONG),"encrypted length too long"},