init_ecdh(SSL_CTX * sctx, host_item * host)
{
EC_KEY * ecdh;
uschar * exp_curve;
int nid;
BOOL rv;

#ifdef OPENSSL_NO_ECDH
return TRUE;
#else

if (host)	/* No ECDH setup for clients, only for servers */
  return TRUE;

# ifndef EXIM_HAVE_ECDH
DEBUG(D_tls)
  debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
return TRUE;
# else

if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve))
  return FALSE;
if (!exp_curve || !*exp_curve)
  return TRUE;

#  ifdef EXIM_HAVE_OPENSSL_ECDH_AUTO
/* check if new enough library to support auto ECDH temp key parameter selection */
if (Ustrcmp(exp_curve, "auto") == 0)
  {
  DEBUG(D_tls) debug_printf(
    "ECDH temp key parameter settings: OpenSSL 1.2+ autoselection\n");
  SSL_CTX_set_ecdh_auto(sctx, 1);
  return TRUE;
  }
#  endif

DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
if (  (nid = OBJ_sn2nid       (CCS exp_curve)) == NID_undef
#   ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
   && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
#   endif
   )
  {
  tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'",
      exp_curve),
    host, NULL);
  return FALSE;
  }

if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
  {
  tls_error("Unable to create ec curve", host, NULL);
  return FALSE;
  }

/* The "tmp" in the name here refers to setting a temporary key
not to the stability of the interface. */

if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
  tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL);
else
  DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);

EC_KEY_free(ecdh);
return !rv;

# endif	/*EXIM_HAVE_ECDH*/
#endif /*OPENSSL_NO_ECDH*/
}
init_ecdh(SSL_CTX * sctx, host_item * host)
{
EC_KEY * ecdh;
uschar * exp_curve;
int nid;
BOOL rv;

#ifdef OPENSSL_NO_ECDH
return TRUE;
#else

if (host)	 
  return TRUE;

# ifndef EXIM_HAVE_ECDH
DEBUG(D_tls)
  debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
return TRUE;
# else

if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve))
  return FALSE;
if (!exp_curve || !*exp_curve)
  return TRUE;

#  ifdef EXIM_HAVE_OPENSSL_ECDH_AUTO
 
if (Ustrcmp(exp_curve, "auto") == 0)
  {
  DEBUG(D_tls) debug_printf(
    "ECDH temp key parameter settings: OpenSSL 1.2+ autoselection\n");
  SSL_CTX_set_ecdh_auto(sctx, 1);
  return TRUE;
  }
#  endif

DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
if (  (nid = OBJ_sn2nid       (CCS exp_curve)) == NID_undef
#   ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
   && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
#   endif
   )
  {
  tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'",
      exp_curve),
    host, NULL);
  return FALSE;
  }

if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
  {
  tls_error("Unable to create ec curve", host, NULL);
  return FALSE;
  }

 

if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
  tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL);
else
  DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);

EC_KEY_free(ecdh);
return !rv;

# endif	 
#endif  
}