From: Sebastian Hahn <sebastian@torproject.org>
Date: Sat, 19 Sep 2015 14:36:55 +0000 (+0200)
Subject: Check that openssl has ECC support during configure
X-Git-Tag: tor-0.2.7.3-rc~27^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ae98dd255b3db5585c0eab17dab702f72046ee57;p=thirdparty%2Ftor.git

Check that openssl has ECC support during configure

This allows builds on machines with a crippled openssl to fail early
during configure. Bugfix on 0.2.7.1-alpha, which introduced the
requirement for ECC support. Fixes bug 17109.
---

diff --git a/changes/bug17109 b/changes/bug17109
new file mode 100644
index 0000000000..9f80f6ef16
--- /dev/null
+++ b/changes/bug17109
@@ -0,0 +1,4 @@
+  o Minor bugfixes:
+    - Fail during configure if we're trying to build against an OpenSSL
+      built without ECC support. Fixes bug 17109, bugfix on
+      0.2.7.1-alpha which started requiring ECC.
diff --git a/configure.ac b/configure.ac
index bf818ac4eb..2220c18fdb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -642,6 +642,19 @@ AC_TRY_COMPILE([
    [ : ],
    [ AC_ERROR([OpenSSL is too old. We require 1.0.0 or later. You can specify a path to a newer one with --with-openssl-dir.]) ])
 
+AC_TRY_COMPILE([
+#include <openssl/opensslv.h>
+#include <openssl/evp.h>
+#if defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_ECDH) || defined(OPENSSL_NO_ECDSA)
+#error "no ECC"
+#endif
+#if !defined(NID_X9_62_prime256v1) || !defined(NID_secp224r1)
+#error "curves unavailable"
+#endif
+   ], [],
+   [ : ],
+   [ AC_ERROR([OpenSSL is built without full ECC support, including curves P256 and P224. You can specify a path to one with ECC support with --with-openssl-dir.]) ])
+
 AC_CHECK_MEMBERS([struct ssl_method_st.get_cipher_by_char], , ,
 [#include <openssl/ssl.h>
 ])