if (!ss->enableSSL3 && !ss->enableTLS) {
if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
ssl3_config_match_init(sslSocket *ss){    ssl3CipherSuiteCfg *      suite;    const ssl3CipherSuiteDef *cipher_def;    SSLCipherAlgorithm        cipher_alg;    CK_MECHANISM_TYPE         cipher_mech;    SSL3KEAType               exchKeyType;    int                       i;    int                       numPresent		= 0;    int                       numEnabled		= 0;    PRBool                    isServer;    sslServerCerts           *svrAuth;    if (!ss->enableSSL3 && !ss->enableTLS) {    	return 0;    }    isServer = (PRBool)( ss && ss->sec.isServer );    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {	suite = &ss->cipherSuites[i];	if (suite->enabled) {	    ++numEnabled;	    /* We need the cipher defs to see if we have a token that can handle	     * this cipher.  It isn't part of the static definition.	     */	    cipher_def = ssl_LookupCipherSuiteDef(suite->cipher_suite);	    if (!cipher_def) {	    	suite->isPresent = PR_FALSE;		continue;	    }	    cipher_alg=bulk_cipher_defs[cipher_def->bulk_cipher_alg ].calg;	    PORT_Assert(  alg2Mech[cipher_alg].calg == cipher_alg);	    cipher_mech = alg2Mech[cipher_alg].cmech;	    exchKeyType =	    	    kea_defs[cipher_def->key_exchange_alg].exchKeyType;#ifndef NSS_ENABLE_ECC	    svrAuth = ss->serverCerts + exchKeyType;#else	    /* XXX SSLKEAType isn't really a good choice for 	     * indexing certificates. It doesn't work for	     * (EC)DHE-* ciphers. Here we use a hack to ensure	     * that the server uses an RSA cert for (EC)DHE-RSA.	     */	    switch (cipher_def->key_exchange_alg) {	    case kea_ecdhe_rsa:	    case kea_dhe_rsa:		svrAuth = ss->serverCerts + kt_rsa;		break;	    case kea_ecdh_ecdsa:	    case kea_ecdh_rsa:	        /* 		 * XXX We ought to have different indices for 		 * ECDSA- and RSA-signed EC certificates so		 * we could support both key exchange mechanisms		 * simultaneously. For now, both of them use		 * whatever is in the certificate slot for kt_ecdh		 */	    default:		svrAuth = ss->serverCerts + exchKeyType;		break;	    }#endif /* NSS_ENABLE_ECC */	    /* Mark the suites that are backed by real tokens, certs and keys */	    suite->isPresent = (PRBool)		(((exchKeyType == kt_null) ||		    ((!isServer || (svrAuth->serverKey &&				   svrAuth->serverCertChain)) &&		    PK11_TokenExists(kea_alg_defs[exchKeyType]))) &&		((cipher_alg == calg_null) || PK11_TokenExists(cipher_mech)));	    if (suite->isPresent)	    	++numPresent;	}    }    PORT_Assert(numPresent > 0 || numEnabled == 0);    if (numPresent <= 0) {	PORT_SetError(SSL_ERROR_NO_CIPHERS_SUPPORTED);    }    return numPresent;}