From 3c06513f3833d4692f620e2c03d7a840871c08a7 Mon Sep 17 00:00:00 2001 From: Kurt Roeckx Date: Sat, 30 May 2015 19:20:12 +0200 Subject: [PATCH] Allow all curves when the client doesn't send an supported elliptic curves extension At least in the case of SSLv3 we can't send an extention. Reviewed-by: Matt Caswell MR #811 --- ssl/t1_lib.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index a161dcc5f4..0420fe31b2 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -555,6 +555,20 @@ int tls1_shared_curve(SSL *s, int nmatch) (s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE), &pref, &num_pref)) return nmatch == -1 ? 0 : NID_undef; + + /* + * If the client didn't send the elliptic_curves extension all of them + * are allowed. + */ + if (num_supp == 0 && (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) != 0) { + supp = eccurves_all; + num_supp = sizeof(eccurves_all) / 2; + } else if (num_pref == 0 && + (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) == 0) { + pref = eccurves_all; + num_pref = sizeof(eccurves_all) / 2; + } + k = 0; for (i = 0; i < num_pref; i++, pref += 2) { const unsigned char *tsupp = supp; -- 2.34.1