Don't advertise ECC ciphersuits in SSLv2 compatible client hello.
authorTomas Mraz <tmraz@redhat.com>
Fri, 27 Jun 2014 15:49:22 +0000 (16:49 +0100)
committerDr. Stephen Henson <steve@openssl.org>
Fri, 27 Jun 2014 15:51:26 +0000 (16:51 +0100)
PR#3374

ssl/s23_lib.c

index 3bf7283..f3c29d1 100644 (file)
@@ -107,6 +107,13 @@ int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
        long l;
 
        /* We can write SSLv2 and SSLv3 ciphers */
+       /* but no ECC ciphers */
+       if (c->algorithm_mkey == SSL_kECDHr ||
+               c->algorithm_mkey == SSL_kECDHe ||
+               c->algorithm_mkey == SSL_kEECDH ||
+               c->algorithm_auth == SSL_aECDH ||
+               c->algorithm_auth == SSL_aECDSA)
+               return 0;
        if (p != NULL)
                {
                l=c->id;