Add OPENSSL_NO_ECDH guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

diff --git a/crypto/ec/ec_pmeth.c b/crypto/ec/ec_pmeth.c
index 29752998c27a59fc615054b6e1f122192be22779..ad68139ef6e44061211023543c6940e8eb5a1e5d 100644 (file)
--- a/crypto/ec/ec_pmeth.c
+++ b/crypto/ec/ec_pmeth.c
@@ -213,6 +213,7 @@ static int pkey_ec_verify(EVP_PKEY_CTX *ctx,
        return ret;
        }
 
+#ifndef OPENSSL_NO_ECDH
 static int pkey_ec_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
        {
        int ret;
@@ -288,6 +289,7 @@ static int pkey_ec_kdf_derive(EVP_PKEY_CTX *ctx,
                }
        return rv;
        }
+#endif
 
 static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
        {
@@ -316,6 +318,7 @@ static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
                EC_GROUP_set_asn1_flag(dctx->gen_group, p1);
                return 1;
 
+#ifndef OPENSSL_NO_ECDH
                case EVP_PKEY_CTRL_EC_ECDH_COFACTOR:
                if (p1 == -2)
                        {
@@ -357,6 +360,7 @@ static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
                        dctx->co_key = NULL;
                        }
                return 1;
+#endif
 
                case EVP_PKEY_CTRL_EC_KDF_TYPE:
                if (p1 == -2)
@@ -556,7 +560,11 @@ const EVP_PKEY_METHOD ec_pkey_meth =
        0,0,
 
        0,
+#ifndef OPENSSL_NO_ECDH
        pkey_ec_kdf_derive,
+#else
+       0,
+#endif
 
        pkey_ec_ctrl,
        pkey_ec_ctrl_str

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 51a4ec3e89bce6f3d8e86e924c4a8b3773fc9818..0cd08bd4f0ad320afed89a9fa96af2d24bb9c548 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -3810,9 +3810,11 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
        case SSL_CTRL_GET_SHARED_CURVE:
                return tls1_shared_curve(s, larg);
 
+#ifndef OPENSSL_NO_ECDH
        case SSL_CTRL_SET_ECDH_AUTO:
                s->cert->ecdh_tmp_auto = larg;
                return 1;
+#endif
 #endif
        case SSL_CTRL_SET_SIGALGS:
                return tls1_set_sigalgs(s->cert, parg, larg, 0);
@@ -3884,7 +3886,7 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                        EVP_PKEY *ptmp;
                        int rv = 0;
                        sc = s->session->sess_cert;
-#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC)
+#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECDH)
                        if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp
                                                        && !sc->peer_ecdh_tmp)
                                return 0;
@@ -4237,9 +4239,11 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                return tls1_set_curves_list(&ctx->tlsext_ellipticcurvelist,
                                        &ctx->tlsext_ellipticcurvelist_length,
                                                                parg);
+#ifndef OPENSSL_NO_ECDH
        case SSL_CTRL_SET_ECDH_AUTO:
                ctx->cert->ecdh_tmp_auto = larg;
                return 1;
+#endif
 #endif
        case SSL_CTRL_SET_SIGALGS:
                return tls1_set_sigalgs(ctx->cert, parg, larg, 0);
@@ -4543,10 +4547,12 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
 
 #ifndef OPENSSL_NO_TLSEXT
 #ifndef OPENSSL_NO_EC
+#ifndef OPENSSL_NO_ECDH
                /* if we are considering an ECC cipher suite that uses
                 * an ephemeral EC key check it */
                if (alg_k & SSL_kECDHE)
                        ok = ok && tls1_check_ec_tmp_key(s, c->id);
+#endif /* OPENSSL_NO_ECDH */
 #endif /* OPENSSL_NO_EC */
 #endif /* OPENSSL_NO_TLSEXT */
 

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index 133d9d9b2fdefba7da3b5d3d17f3fedf8fe1fa93..60e57726390e5b2a849c6e717feaaeecc86383a0 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -1436,6 +1436,7 @@ static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,
                return 0;
                }
 
+#ifndef OPENSSL_NO_ECDH
        switch(suiteb_flags)
                {
        case SSL_CERT_FLAG_SUITEB_128_LOS:
@@ -1454,6 +1455,10 @@ static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,
        /* Set auto ECDH parameter determination */
        c->ecdh_tmp_auto = 1;
        return 1;
+#else
+       SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST, SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
+       return 0;
+#endif
        }
 #endif
 

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index a4d565fb4ab41054741e79bf5bce671c5c6d7413..ea271fb4f52b5723ea9a5b175d28262bc10d0351 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -2361,8 +2361,10 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
                x = cpk->x509;
                /* This call populates extension flags (ex_flags) */
                X509_check_purpose(x, -1, 0);
+#ifndef OPENSSL_NO_ECDH
                ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
                    (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1;
+#endif
                ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
                    (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1;
                if (!(cpk->valid_flags & CERT_PKEY_SIGN))

diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 4e307e44c126466ff15ddd74b192e51146d48e73..2e598e3ac55c6d3297b1744cd363c63d2352abb4 100644 (file)
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -1250,7 +1250,9 @@ int tls1_set_curves(unsigned char **pext, size_t *pextlen,
                        int *curves, size_t ncurves);
 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen, 
                                const char *str);
+#ifndef OPENSSL_NO_ECDH
 int tls1_check_ec_tmp_key(SSL *s, unsigned long id);
+#endif /* OPENSSL_NO_ECDH */
 #endif /* OPENSSL_NO_EC */
 
 #ifndef OPENSSL_NO_TLSEXT

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 8d5fd12903c2b83c151c88f2ad88e105742bcf41..f0291b115f4a8dcc9042b8e77a5334a4a83e29c7 100644 (file)
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -828,6 +828,7 @@ static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
                }
        return rv;
        }
+#ifndef OPENSSL_NO_ECDH
 /* Check EC temporary key is compatible with client extensions */
 int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
        {
@@ -894,6 +895,7 @@ int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
        return tls1_check_ec_key(s, curve_id, NULL);
 #endif
        }
+#endif /* OPENSSL_NO_ECDH */
 
 #else
 

diff --git a/test/cms-test.pl b/test/cms-test.pl
index 595ab48fa9715607d941482f660b7ddec80d5e7b..7d4ca2990a0f1f3331dda6ccefa2b2b2a80b000c 100644 (file)
--- a/test/cms-test.pl
+++ b/test/cms-test.pl
@@ -84,6 +84,7 @@ my $halt_err = 1;
 my $badcmd = 0;
 my $no_ec;
 my $no_ec2m;
+my $no_ecdh;
 my $ossl8 = `$ossl_path version -v` =~ /0\.9\.8/;
 
 system ("$ossl_path no-ec >/dev/null");
@@ -113,6 +114,20 @@ else
        {
        die "Error checking for EC2M support\n";
        }
+
+system ("$ossl_path no-ecdh >/dev/null");
+if ($? == 0)
+       {
+       $no_ecdh = 1;
+       }
+elsif ($? == 256)
+       {
+       $no_ecdh = 0;
+       }
+else
+       {
+       die "Error checking for ECDH support\n";
+       }
     
 my @smime_pkcs7_tests = (
 
@@ -507,6 +522,11 @@ sub run_smime_tests {
                print "$tnam: skipped, EC disabled\n";
                next;
                }
+       if ($no_ecdh && $tnam =~ /ECDH/)
+               {
+               print "$tnam: skipped, ECDH disabled\n";
+               next;
+               }
        if ($no_ec2m && $tnam =~ /K-283/)
                {
                print "$tnam: skipped, EC2M disabled\n";