fix FIDO key support for !OPENSSL_HAS_ECC case

ok dtucker

1 files changed, 11 insertions, 2 deletions

diff --git a/ssh-sk.c b/ssh-sk.c
index d254e77f..393b4ccd 100644
--- a/ssh-sk.c
+++ b/ssh-sk.c
@@ -29,10 +29,10 @@
 #include <string.h>
 #include <stdio.h>
 
-#ifdef WITH_OPENSSL
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
 #include <openssl/objects.h>
 #include <openssl/ec.h>
-#endif /* WITH_OPENSSL */
+#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
 
 #include "log.h"
 #include "misc.h"
@@ -45,6 +45,15 @@
 #include "sk-api.h"
 #include "crypto_api.h"
 
+/*
+ * Almost every use of OpenSSL in this file is for ECDSA-NISTP256.
+ * This is strictly a larger hammer than necessary, but it reduces changes
+ * with upstream.
+ */
+#ifndef OPENSSL_HAS_ECC
+# undef WITH_OPENSSL
+#endif
+
 struct sshsk_provider {
 	char *path;
 	void *dlhandle;