if (ss->ssl3->hs.kea_def->is_limited) {
if (ss->ssl3.hs.kea_def->is_limited) {
ssl3_SendClientKeyExchange(sslSocket *ss){    SECKEYPublicKey *	serverKey 	= NULL;    SECStatus 		rv 		= SECFailure;    PRBool              isTLS;    SSL_TRC(3, ("%d: SSL3[%d]: send client_key_exchange handshake",		SSL_GETPID(), ss->fd));    PORT_Assert( ssl_HaveXmitBufLock(ss));    PORT_Assert( ssl_HaveSSL3HandshakeLock(ss));    if (ss->sec.peerKey == NULL) {	serverKey = CERT_ExtractPublicKey(ss->sec.peerCert);	if (serverKey == NULL) {	    PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE);	    return SECFailure;	}    } else {	serverKey = ss->sec.peerKey;	ss->sec.peerKey = NULL; /* we're done with it now */    }    isTLS = (PRBool)(ss->ssl3->pwSpec->version > SSL_LIBRARY_VERSION_3_0);    /* enforce limits on kea key sizes. */    if (ss->ssl3->hs.kea_def->is_limited) {	int keyLen = SECKEY_PublicKeyStrength(serverKey);	/* bytes */	if (keyLen * BPB > ss->ssl3->hs.kea_def->key_size_limit) {	    if (isTLS)		(void)SSL3_SendAlert(ss, alert_fatal, export_restriction);	    else		(void)ssl3_HandshakeFailure(ss);	    PORT_SetError(SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED);	    goto loser;	}    }    ss->sec.keaType    = ss->ssl3->hs.kea_def->exchKeyType;    ss->sec.keaKeyBits = SECKEY_PublicKeyStrengthInBits(serverKey);    switch (ss->ssl3->hs.kea_def->exchKeyType) {    case kt_rsa:	rv = sendRSAClientKeyExchange(ss, serverKey);	break;    case kt_dh:	rv = sendDHClientKeyExchange(ss, serverKey);	break;#ifdef NSS_ENABLE_ECC    case kt_ecdh:	rv = sendECDHClientKeyExchange(ss, serverKey);	break;#endif /* NSS_ENABLE_ECC */    default:	/* got an unknown or unsupported Key Exchange Algorithm.  */	SEND_ALERT	PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);	break;    }    SSL_TRC(3, ("%d: SSL3[%d]: DONE sending client_key_exchange",		SSL_GETPID(), ss->fd));loser:    if (serverKey)     	SECKEY_DestroyPublicKey(serverKey);    return rv;	/* err code already set. */}