Add OPENSSL_NO_ECDH guards

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index a15625b91182cb9d7313988f8eaaa01924294f4a..713de7295ece85a4c6e73d747bfdfa9dc3812a0f 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -3484,9 +3484,11 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
        case SSL_CTRL_GET_SHARED_CURVE:
                return tls1_shared_curve(s, larg);
 
+#ifndef OPENSSL_NO_ECDH
        case SSL_CTRL_SET_ECDH_AUTO:
                s->cert->ecdh_tmp_auto = larg;
                return 1;
+#endif
 #endif
        case SSL_CTRL_SET_SIGALGS:
                return tls1_set_sigalgs(s->cert, parg, larg, 0);
@@ -3558,7 +3560,7 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                        EVP_PKEY *ptmp;
                        int rv = 0;
                        sc = s->session->sess_cert;
-#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC)
+#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECDH)
                        if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp
                                                        && !sc->peer_ecdh_tmp)
                                return 0;
@@ -3598,6 +3600,33 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                return (int)sess->tlsext_ecpointformatlist_length;
                }
 #endif
+
+       case SSL_CTRL_CHECK_PROTO_VERSION:
+               /* For library-internal use; checks that the current protocol
+                * is the highest enabled version (according to s->ctx->method,
+                * as version negotiation may have changed s->method). */
+               if (s->version == s->ctx->method->version)
+                       return 1;
+               /* Apparently we're using a version-flexible SSL_METHOD
+                * (not at its highest protocol version). */
+               if (s->ctx->method->version == SSLv23_method()->version)
+                       {
+#if TLS_MAX_VERSION != TLS1_2_VERSION
+#  error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION.
+#endif
+                       if (!(s->options & SSL_OP_NO_TLSv1_2))
+                               return s->version == TLS1_2_VERSION;
+                       if (!(s->options & SSL_OP_NO_TLSv1_1))
+                               return s->version == TLS1_1_VERSION;
+                       if (!(s->options & SSL_OP_NO_TLSv1))
+                               return s->version == TLS1_VERSION;
+                       if (!(s->options & SSL_OP_NO_SSLv3))
+                               return s->version == SSL3_VERSION;
+                       if (!(s->options & SSL_OP_NO_SSLv2))
+                               return s->version == SSL2_VERSION;
+                       }
+               return 0; /* Unexpected state; fail closed. */
+
        default:
                break;
                }
@@ -3872,9 +3901,11 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                return tls1_set_curves_list(&ctx->tlsext_ellipticcurvelist,
                                        &ctx->tlsext_ellipticcurvelist_length,
                                                                parg);
+#ifndef OPENSSL_NO_ECDH
        case SSL_CTRL_SET_ECDH_AUTO:
                ctx->cert->ecdh_tmp_auto = larg;
                return 1;
+#endif
 #endif
        case SSL_CTRL_SET_SIGALGS:
                return tls1_set_sigalgs(ctx->cert, parg, larg, 0);
@@ -4173,10 +4204,12 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
 
 #ifndef OPENSSL_NO_TLSEXT
 #ifndef OPENSSL_NO_EC
+#ifndef OPENSSL_NO_ECDH
                /* if we are considering an ECC cipher suite that uses
                 * an ephemeral EC key check it */
                if (alg_k & SSL_kEECDH)
                        ok = ok && tls1_check_ec_tmp_key(s, c->id);
+#endif /* OPENSSL_NO_ECDH */
 #endif /* OPENSSL_NO_EC */
 #endif /* OPENSSL_NO_TLSEXT */
 
@@ -4519,4 +4552,3 @@ long ssl_get_algorithm2(SSL *s)
                return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
        return alg2;
        }
-