2 files changed, 191 insertions, 131 deletions

diff --git a/lib/crypto/c_src/crypto.c b/lib/crypto/c_src/crypto.c
index 5f10e93728..6e113ef39e 100644
--- a/lib/crypto/c_src/crypto.c
+++ b/lib/crypto/c_src/crypto.c
@@ -60,7 +60,6 @@
 #include <openssl/rand.h>
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
-#include <openssl/engine.h>
 #include <openssl/err.h>
 
 /* Helper macro to construct a OPENSSL_VERSION_NUMBER.
@@ -102,8 +101,10 @@
 #  undef FIPS_SUPPORT
 # endif
 
+# if LIBRESSL_VERSION_NUMBER < PACKED_OPENSSL_VERSION_PLAIN(2,7,0)
 /* LibreSSL wants the 1.0.1 API */
 # define NEED_EVP_COMPATIBILITY_FUNCTIONS
+# endif
 #endif
 
 
@@ -112,8 +113,10 @@
 #endif
 
 
-#if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(1,0,0)
-# define HAS_EVP_PKEY_CTX
+#ifndef HAS_LIBRESSL
+# if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(1,0,0)
+#  define HAS_EVP_PKEY_CTX
+# endif
 #endif
 
 
@@ -121,10 +124,6 @@
 #include <openssl/modes.h>
 #endif
 
-#if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION(0,9,8,'h')
-#define HAS_ENGINE_SUPPORT
-#endif
-
 #include "crypto_callback.h"
 
 #if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(0,9,8)	\
@@ -179,6 +178,25 @@
 # define HAVE_ECB_IVEC_BUG
 #endif
 
+#define HAVE_RSA_SSLV23_PADDING
+#if defined(HAS_LIBRESSL)                                             \
+    && LIBRESSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(2,6,1)
+# undef HAVE_RSA_SSLV23_PADDING
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION(0,9,8,'h') \
+    && defined(HAVE_EC)
+/* If OPENSSL_NO_EC is set, there will be an error in ec.h included from engine.h
+   So if EC is disabled, you can't use Engine either....
+*/
+# define HAS_ENGINE_SUPPORT
+#endif
+
+
+#if defined(HAS_ENGINE_SUPPORT)
+# include <openssl/engine.h>
+#endif
+
 #if defined(HAVE_CMAC)
 #include <openssl/cmac.h>
 #endif
@@ -473,8 +491,6 @@ static ERL_NIF_TERM pkey_sign_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
 static ERL_NIF_TERM pkey_verify_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM pkey_crypt_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM rsa_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
-static ERL_NIF_TERM dh_generate_parameters_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
-static ERL_NIF_TERM dh_check(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM dh_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM dh_compute_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM privkey_to_pubkey_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
@@ -496,7 +512,6 @@ static ERL_NIF_TERM aes_gcm_decrypt_NO_EVP(ErlNifEnv* env, int argc, const ERL_N
 static ERL_NIF_TERM chacha20_poly1305_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM chacha20_poly1305_decrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 
-static int get_engine_load_cmd_list(ErlNifEnv* env, const ERL_NIF_TERM term, char **cmds, int i);
 static ERL_NIF_TERM engine_by_id_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM engine_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM engine_finish_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
@@ -524,6 +539,7 @@ static int term2point(ErlNifEnv* env, ERL_NIF_TERM term,
 static ERL_NIF_TERM bin_from_bn(ErlNifEnv* env, const BIGNUM *bn);
 
 #ifdef HAS_ENGINE_SUPPORT
+static int get_engine_load_cmd_list(ErlNifEnv* env, const ERL_NIF_TERM term, char **cmds, int i);
 static int zero_terminate(ErlNifBinary bin, char **buf);
 #endif
 
@@ -563,8 +579,6 @@ static ErlNifFunc nif_funcs[] = {
     {"pkey_verify_nif", 6, pkey_verify_nif},
     {"pkey_crypt_nif", 6, pkey_crypt_nif},
     {"rsa_generate_key_nif", 2, rsa_generate_key_nif},
-    {"dh_generate_parameters_nif", 2, dh_generate_parameters_nif},
-    {"dh_check", 1, dh_check},
     {"dh_generate_key_nif", 4, dh_generate_key_nif},
     {"dh_compute_key_nif", 3, dh_compute_key_nif},
     {"privkey_to_pubkey_nif", 2, privkey_to_pubkey_nif},
@@ -660,7 +674,9 @@ static ERL_NIF_TERM atom_rsa_oaep_md;
 static ERL_NIF_TERM atom_rsa_pad; /* backwards compatibility */
 static ERL_NIF_TERM atom_rsa_padding;
 static ERL_NIF_TERM atom_rsa_pkcs1_pss_padding;
+#ifdef HAVE_RSA_SSLV23_PADDING
 static ERL_NIF_TERM atom_rsa_sslv23_padding;
+#endif
 static ERL_NIF_TERM atom_rsa_x931_padding;
 static ERL_NIF_TERM atom_rsa_pss_saltlen;
 static ERL_NIF_TERM atom_sha224;
@@ -1065,7 +1081,9 @@ static int initialize(ErlNifEnv* env, ERL_NIF_TERM load_info)
     atom_rsa_pad = enif_make_atom(env,"rsa_pad"); /* backwards compatibility */
     atom_rsa_padding = enif_make_atom(env,"rsa_padding");
     atom_rsa_pkcs1_pss_padding = enif_make_atom(env,"rsa_pkcs1_pss_padding");
+#ifdef HAVE_RSA_SSLV23_PADDING
     atom_rsa_sslv23_padding = enif_make_atom(env,"rsa_sslv23_padding");
+#endif
     atom_rsa_x931_padding = enif_make_atom(env,"rsa_x931_padding");
     atom_rsa_pss_saltlen = enif_make_atom(env,"rsa_pss_saltlen");
     atom_sha224 = enif_make_atom(env,"sha224");
@@ -2998,82 +3016,23 @@ static ERL_NIF_TERM rsa_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF
 			     rsa_generate_key, argc, argv);
 }
 
-static ERL_NIF_TERM dh_generate_parameters_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
-{/* (PrimeLen, Generator) */
-    int prime_len, generator;
-    DH* dh_params = NULL;
-    int p_len, g_len;
-    unsigned char *p_ptr, *g_ptr;
-    ERL_NIF_TERM ret_p, ret_g;
-    const BIGNUM *dh_p, *dh_q, *dh_g;
-
-    if (!enif_get_int(env, argv[0], &prime_len)
-	|| !enif_get_int(env, argv[1], &generator)) {
-
-	return enif_make_badarg(env);
-    }
-
-    if (DH_generate_parameters_ex(dh_params, prime_len, generator, NULL)) {
-	return atom_error;
-    }
-    DH_get0_pqg(dh_params, &dh_p, &dh_q, &dh_g);
-    DH_free(dh_params);
-    p_len = BN_num_bytes(dh_p);
-    g_len = BN_num_bytes(dh_g);
-    p_ptr = enif_make_new_binary(env, p_len, &ret_p);
-    g_ptr = enif_make_new_binary(env, g_len, &ret_g);
-    BN_bn2bin(dh_p, p_ptr);
-    BN_bn2bin(dh_g, g_ptr);
-    ERL_VALGRIND_MAKE_MEM_DEFINED(p_ptr, p_len);
-    ERL_VALGRIND_MAKE_MEM_DEFINED(g_ptr, g_len);
-    return enif_make_list2(env, ret_p, ret_g);
-}
-
-static ERL_NIF_TERM dh_check(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
-{/* ([PrimeLen, Generator]) */
-    DH* dh_params;
-    int i;
-    ERL_NIF_TERM ret, head, tail;
-    BIGNUM *dh_p, *dh_g;
-
-    if (!enif_get_list_cell(env, argv[0], &head, &tail)
-	|| !get_bn_from_bin(env, head, &dh_p)
-	|| !enif_get_list_cell(env, tail, &head, &tail)
-	|| !get_bn_from_bin(env, head, &dh_g)
-	|| !enif_is_empty_list(env,tail)) {
-
-	return enif_make_badarg(env);
-    }
-
-    dh_params = DH_new();
-    DH_set0_pqg(dh_params, dh_p, NULL, dh_g);
-    if (DH_check(dh_params, &i)) {
-	if (i == 0) ret = atom_ok;
-	else if (i & DH_CHECK_P_NOT_PRIME) ret = atom_not_prime;
-	else if (i & DH_CHECK_P_NOT_SAFE_PRIME)	ret = atom_not_strong_prime;
-	else if (i & DH_UNABLE_TO_CHECK_GENERATOR) ret = atom_unable_to_check_generator;
-	else if (i & DH_NOT_SUITABLE_GENERATOR)	ret = atom_not_suitable_generator;
-	else ret = enif_make_tuple2(env, atom_unknown, enif_make_uint(env, i));
-    }
-    else { /* Check Failed */
-	ret = enif_make_tuple2(env, atom_error, atom_check_failed);
-    }
-    DH_free(dh_params);
-    return ret;
-}
-
 static ERL_NIF_TERM dh_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (PrivKey|undefined, DHParams=[P,G], Mpint, Len|0) */
-    DH* dh_params;
+    DH* dh_params = NULL;
     int pub_len, prv_len;
     unsigned char *pub_ptr, *prv_ptr;
     ERL_NIF_TERM ret, ret_pub, ret_prv, head, tail;
     int mpint; /* 0 or 4 */
-    BIGNUM *priv_key = NULL;
+    BIGNUM *priv_key_in = NULL;
     BIGNUM *dh_p = NULL, *dh_g = NULL;
     unsigned long len = 0;
+#ifdef HAS_EVP_PKEY_CTX
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY *dhkey = NULL,
+             *params = NULL;
+#endif
 
-    if (!(get_bn_from_bin(env, argv[0], &priv_key)
+    if (!(get_bn_from_bin(env, argv[0], &priv_key_in)
 	  || argv[0] == atom_undefined)
 	|| !enif_get_list_cell(env, argv[1], &head, &tail)
 	|| !get_bn_from_bin(env, head, &dh_p)
@@ -3081,40 +3040,63 @@ static ERL_NIF_TERM dh_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_
 	|| !get_bn_from_bin(env, head, &dh_g)
 	|| !enif_is_empty_list(env, tail)
 	|| !enif_get_int(env, argv[2], &mpint) || (mpint & ~4)
-	|| !enif_get_ulong(env, argv[3], &len)  ) {
-
-        if (priv_key) BN_free(priv_key);
+	|| !enif_get_ulong(env, argv[3], &len) 
+
+        /* Load dh_params with values to use by the generator.
+           Mem mgmnt transfered from dh_p etc to dh_params */
+        || !(dh_params = DH_new())
+        || (priv_key_in && !DH_set0_key(dh_params, NULL, priv_key_in))
+        || !DH_set0_pqg(dh_params, dh_p, NULL, dh_g)
+        ) {
+        if (priv_key_in) BN_free(priv_key_in);
 	if (dh_p) BN_free(dh_p);
 	if (dh_g) BN_free(dh_g);
+        if (dh_params) DH_free(dh_params);
 	return enif_make_badarg(env);
     }
 
-    dh_params = DH_new();
-    DH_set0_key(dh_params, NULL, priv_key);
-    DH_set0_pqg(dh_params, dh_p, NULL, dh_g);
-
     if (len) {
         if (len < BN_num_bits(dh_p))
             DH_set_length(dh_params, len);
         else {
-            DH_free(dh_params);
+            if (priv_key_in) BN_free(priv_key_in);
+            if (dh_p) BN_free(dh_p);
+            if (dh_g) BN_free(dh_g);
+            if (dh_params) DH_free(dh_params);
             return enif_make_badarg(env);
         }
     }
 
+#ifdef HAS_EVP_PKEY_CTX
+    if ((dhkey  = EVP_PKEY_new())
+        && (params = EVP_PKEY_new())
+        && EVP_PKEY_set1_DH(params, dh_params)   /* set the key referenced by params to dh_params.
+                                                    dh_params (and params) must be freed by us*/
+        && (ctx = EVP_PKEY_CTX_new(params, NULL))
+        && EVP_PKEY_keygen_init(ctx)
+        && EVP_PKEY_keygen(ctx, &dhkey)
+        && (dh_params = EVP_PKEY_get1_DH(dhkey)) /* return the referenced key. dh_params and dhkey must be freed */
+        ) {
+#else
     if (DH_generate_key(dh_params)) {
-	const BIGNUM *pub_key, *priv_key;
-	DH_get0_key(dh_params, &pub_key, &priv_key);
-	pub_len = BN_num_bytes(pub_key);
-	prv_len = BN_num_bytes(priv_key);
+#endif   
+        const BIGNUM *pub_key_gen, *priv_key_gen;
+        
+	DH_get0_key(dh_params,
+                    &pub_key_gen, &priv_key_gen); /* Get pub_key_gen and priv_key_gen. 
+                                                     "The values point to the internal representation of 
+                                                     the public key and private key values. This memory 
+                                                     should not be freed directly." says man */
+	pub_len = BN_num_bytes(pub_key_gen);
+	prv_len = BN_num_bytes(priv_key_gen);
 	pub_ptr = enif_make_new_binary(env, pub_len+mpint, &ret_pub);
 	prv_ptr = enif_make_new_binary(env, prv_len+mpint, &ret_prv);
 	if (mpint) {
 	    put_int32(pub_ptr, pub_len); pub_ptr += 4;
 	    put_int32(prv_ptr, prv_len); prv_ptr += 4;
 	}
-	BN_bn2bin(pub_key, pub_ptr);
-	BN_bn2bin(priv_key, prv_ptr);
+	BN_bn2bin(pub_key_gen, pub_ptr);
+	BN_bn2bin(priv_key_gen, prv_ptr);
 	ERL_VALGRIND_MAKE_MEM_DEFINED(pub_ptr, pub_len);
 	ERL_VALGRIND_MAKE_MEM_DEFINED(prv_ptr, prv_len);
 	ret = enif_make_tuple2(env, ret_pub, ret_prv);
@@ -3122,21 +3104,33 @@ static ERL_NIF_TERM dh_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_
     else {
 	ret = atom_error;
     }
+
     DH_free(dh_params);
+#ifdef HAS_EVP_PKEY_CTX
+    if (ctx)    EVP_PKEY_CTX_free(ctx);
+    /* if (dhkey)  EVP_PKEY_free(dhkey); */
+    /* if (params) EVP_PKEY_free(params); */
+#endif
     return ret;
 }
 
 static ERL_NIF_TERM dh_compute_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (OthersPublicKey, MyPrivateKey, DHParams=[P,G]) */
-    DH* dh_params;
-    BIGNUM *dummy_pub_key = NULL, *priv_key = NULL;
-    BIGNUM *other_pub_key;
-    BIGNUM *dh_p = NULL, *dh_g = NULL;
-    int i;
+    BIGNUM *dummy_pub_key = NULL,
+        *priv_key = NULL,
+        *other_pub_key = NULL,
+        *dh_p = NULL,
+        *dh_g = NULL;
     ErlNifBinary ret_bin;
     ERL_NIF_TERM ret, head, tail;
-
-    dh_params = DH_new();
+    DH *dh_priv = DH_new(), *dh_pub = DH_new();
+#ifdef HAS_EVP_PKEY_CTX
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY *my_priv_key = NULL,  *peer_pub_key = NULL;
+    size_t skeylen;
+#else
+    int i;
+#endif
 
     if (!get_bn_from_bin(env, argv[0], &other_pub_key)
 	|| !get_bn_from_bin(env, argv[1], &priv_key)
@@ -3144,35 +3138,78 @@ static ERL_NIF_TERM dh_compute_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_T
 	|| !get_bn_from_bin(env, head, &dh_p)
 	|| !enif_get_list_cell(env, tail, &head, &tail)
 	|| !get_bn_from_bin(env, head, &dh_g)
-	|| !enif_is_empty_list(env, tail)) {
+	|| !enif_is_empty_list(env, tail)
+
+        /* Note: DH_set0_key() does not allow setting only the
+         * private key, although DH_compute_key() does not use the
+         * public key. Work around this limitation by setting
+         * the public key to a copy of the private key.
+         */
+        || !(dummy_pub_key = BN_dup(priv_key))
+        || !DH_set0_key(dh_priv, dummy_pub_key, priv_key)
+        || !DH_set0_pqg(dh_priv, dh_p, NULL, dh_g)
+        ) {
 	if (dh_p) BN_free(dh_p);
 	if (dh_g) BN_free(dh_g);
-	ret = enif_make_badarg(env);
+        if (other_pub_key) BN_free(other_pub_key);
+        if (dummy_pub_key) BN_free(dummy_pub_key);
+        if (priv_key) BN_free(priv_key);
+	return enif_make_badarg(env);
+    }
+
+#ifdef HAS_EVP_PKEY_CTX 
+    if (!(my_priv_key = EVP_PKEY_new())
+        || !EVP_PKEY_set1_DH(my_priv_key,  dh_priv) /* set the key referenced by my_priv_key to dh_priv.
+                                                       dh_priv (and my_priv_key) must be freed by us*/
+        
+        || !(peer_pub_key = EVP_PKEY_new())
+        || !DH_set0_key(dh_pub, other_pub_key, NULL)
+        || !DH_set0_pqg(dh_pub, dh_p, NULL, dh_g)
+        || !EVP_PKEY_set1_DH(peer_pub_key, dh_pub)
+        
+        || !(ctx = EVP_PKEY_CTX_new(my_priv_key, NULL))
+        || (EVP_PKEY_derive_init(ctx) <= 0)
+        || (EVP_PKEY_derive_set_peer(ctx, peer_pub_key) <= 0)
+        || (EVP_PKEY_derive(ctx, NULL, &skeylen) <= 0)) {
+
+        ret = atom_error;
     }
     else {
-	/* Note: DH_set0_key() does not allow setting only the
-	 * private key, although DH_compute_key() does not use the
-	 * public key. Work around this limitation by setting
-	 * the public key to a copy of the private key.
-	 */
-        dummy_pub_key = BN_dup(priv_key);
-	DH_set0_key(dh_params, dummy_pub_key, priv_key);
-	DH_set0_pqg(dh_params, dh_p, NULL, dh_g);
-	enif_alloc_binary(DH_size(dh_params), &ret_bin);
-	i = DH_compute_key(ret_bin.data, other_pub_key, dh_params);
-	if (i > 0) {
-	    if (i != ret_bin.size) {
-		enif_realloc_binary(&ret_bin, i);
-	    }
-	    ret = enif_make_binary(env, &ret_bin);
-	}
-	else {
+        enif_alloc_binary(skeylen, &ret_bin);
+    
+        if ((EVP_PKEY_derive(ctx, ret_bin.data,  &skeylen) > 0)
+            && (ret_bin.size >= skeylen)) {
+            /* Derivation succeded */
+            if (ret_bin.size > skeylen)  enif_realloc_binary(&ret_bin, skeylen);
+            ret = enif_make_binary(env, &ret_bin);
+        }
+        else {
             enif_release_binary(&ret_bin);
-	    ret = atom_error;
-	}
+            ret = atom_error;
+        }
+    }
+
+#else
+    enif_alloc_binary(DH_size(dh_priv), &ret_bin);
+    i = DH_compute_key(ret_bin.data, other_pub_key, dh_priv);
+    if (i > 0) {
+        if (i != ret_bin.size) enif_realloc_binary(&ret_bin, i);
+        ret = enif_make_binary(env, &ret_bin);
+    }
+    else {
+        enif_release_binary(&ret_bin);
+        ret = atom_error;
     }
+#endif
+
     if (other_pub_key) BN_free(other_pub_key);
-    DH_free(dh_params);
+    if (dh_priv)       DH_free(dh_priv);
+    if (dh_pub)        DH_free(dh_pub);
+#ifdef HAS_EVP_PKEY_CTX
+    if (ctx)           EVP_PKEY_CTX_free(ctx);
+    /* if (my_priv_key)   EVP_PKEY_free(my_priv_key); */
+    /* if (peer_pub_key)  EVP_PKEY_free(peer_pub_key); */
+#endif
     return ret;
 }
 
@@ -4451,8 +4488,10 @@ static int get_pkey_crypt_options(ErlNifEnv *env, ERL_NIF_TERM algorithm, ERL_NI
 			opt->rsa_padding = RSA_PKCS1_PADDING;
 		    } else if (tpl_terms[1] == atom_rsa_pkcs1_oaep_padding) {
 			opt->rsa_padding = RSA_PKCS1_OAEP_PADDING;
+#ifdef HAVE_RSA_SSLV23_PADDING
 		    } else if (tpl_terms[1] == atom_rsa_sslv23_padding) {
 			opt->rsa_padding = RSA_SSLV23_PADDING;
+#endif
 		    } else if (tpl_terms[1] == atom_rsa_x931_padding) {
 			opt->rsa_padding = RSA_X931_PADDING;
 		    } else if (tpl_terms[1] == atom_rsa_no_padding) {
@@ -4518,7 +4557,10 @@ static ERL_NIF_TERM pkey_crypt_nif(ErlNifEnv *env, int argc, const ERL_NIF_TERM
 #endif
     PKeyCryptOptions crypt_opt;
     ErlNifBinary in_bin, out_bin, tmp_bin;
-    size_t outlen, tmplen;
+    size_t outlen;
+#ifdef HAVE_RSA_SSLV23_PADDING
+    size_t tmplen;
+#endif
     int is_private = (argv[4] == atom_true),
         is_encrypt = (argv[5] == atom_true);
     int algo_init = 0;
@@ -4598,6 +4640,7 @@ static ERL_NIF_TERM pkey_crypt_nif(ErlNifEnv *env, int argc, const ERL_NIF_TERM
 	if (crypt_opt.signature_md != NULL
 	    && EVP_PKEY_CTX_set_signature_md(ctx, crypt_opt.signature_md) <= 0)
 		goto badarg;
+#ifdef HAVE_RSA_SSLV23_PADDING
 	if (crypt_opt.rsa_padding == RSA_SSLV23_PADDING) {
 	    if (is_encrypt) {
 		RSA *rsa = EVP_PKEY_get1_RSA(pkey);
@@ -4609,9 +4652,11 @@ static ERL_NIF_TERM pkey_crypt_nif(ErlNifEnv *env, int argc, const ERL_NIF_TERM
 		in_bin = tmp_bin;
 	    }
 	    if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_NO_PADDING) <= 0) goto badarg;
-	} else {
+	} else
+#endif
+                {
 	    if (EVP_PKEY_CTX_set_rsa_padding(ctx, crypt_opt.rsa_padding) <= 0) goto badarg;
-	}
+        }
 #ifdef HAVE_RSA_OAEP_MD
 	if (crypt_opt.rsa_padding == RSA_PKCS1_OAEP_PADDING) {
 	    if (crypt_opt.rsa_oaep_md != NULL
@@ -4730,6 +4775,7 @@ static ERL_NIF_TERM pkey_crypt_nif(ErlNifEnv *env, int argc, const ERL_NIF_TERM
 #endif
 
     if ((i > 0) && argv[0] == atom_rsa && !is_encrypt) {
+#ifdef HAVE_RSA_SSLV23_PADDING
 	if (crypt_opt.rsa_padding == RSA_SSLV23_PADDING) {
 	    RSA *rsa = EVP_PKEY_get1_RSA(pkey);
 	    unsigned char *p;
@@ -4747,6 +4793,7 @@ static ERL_NIF_TERM pkey_crypt_nif(ErlNifEnv *env, int argc, const ERL_NIF_TERM
 		i = 1;
 	    }
 	}
+#endif
     }
 
     if (tmp_bin.data != NULL) {
@@ -5374,9 +5421,9 @@ static ERL_NIF_TERM engine_get_id_nif(ErlNifEnv* env, int argc, const ERL_NIF_TE
 #endif
 }
 
+#ifdef HAS_ENGINE_SUPPORT
 static int get_engine_load_cmd_list(ErlNifEnv* env, const ERL_NIF_TERM term, char **cmds, int i)
 {
-#ifdef HAS_ENGINE_SUPPORT
     ERL_NIF_TERM head, tail;
     const ERL_NIF_TERM *tmp_tuple;
     ErlNifBinary tmpbin;
@@ -5421,10 +5468,8 @@ static int get_engine_load_cmd_list(ErlNifEnv* env, const ERL_NIF_TERM term, cha
         cmds[i] = NULL;
         return 0;
     }
-#else
-    return atom_notsup;
-#endif
 }
+#endif
 
 static ERL_NIF_TERM engine_get_all_methods_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* () */
diff --git a/lib/crypto/c_src/otp_test_engine.c b/lib/crypto/c_src/otp_test_engine.c
index 5c6122c06a..d0e23a2a3e 100644
--- a/lib/crypto/c_src/otp_test_engine.c
+++ b/lib/crypto/c_src/otp_test_engine.c
@@ -24,10 +24,8 @@
 #include <stdio.h>
 #include <string.h>
 
-#include <openssl/engine.h>
 #include <openssl/md5.h>
 #include <openssl/rsa.h>
-#include <openssl/pem.h>
 
 #define PACKED_OPENSSL_VERSION(MAJ, MIN, FIX, P)	\
     ((((((((MAJ << 8) | MIN) << 8 ) | FIX) << 8) | (P-'a'+1)) << 4) | 0xf)
@@ -40,6 +38,21 @@
 #define OLD
 #endif
 
+#if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION(0,9,8,'o') \
+	&& !defined(OPENSSL_NO_EC) \
+	&& !defined(OPENSSL_NO_ECDH) \
+	&& !defined(OPENSSL_NO_ECDSA)
+# define HAVE_EC
+#endif
+
+#if defined(HAVE_EC)
+/* If OPENSSL_NO_EC is set, there will be an error in ec.h included from engine.h
+   So if EC is disabled, you can't use Engine either....
+*/
+#include <openssl/engine.h>
+#include <openssl/pem.h>
+
+
 static const char *test_engine_id = "MD5";
 static const char *test_engine_name = "MD5 test engine";
 
@@ -262,3 +275,5 @@ int pem_passwd_cb_fun(char *buf, int size, int rwflag, void *password)
         return 0;
     }
 }
+
+#endif