Allow all curves when the client doesn't send an supported elliptic curves extension
At least in the case of SSLv3 we can't send an extention.
Reviewed-by: Matt Caswell <matt@openssl.org>
MR #811
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index a161dcc..0420fe3 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -555,6 +555,20 @@
(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE), &pref,
&num_pref))
return nmatch == -1 ? 0 : NID_undef;
+
+ /*
+ * If the client didn't send the elliptic_curves extension all of them
+ * are allowed.
+ */
+ if (num_supp == 0 && (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) != 0) {
+ supp = eccurves_all;
+ num_supp = sizeof(eccurves_all) / 2;
+ } else if (num_pref == 0 &&
+ (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) == 0) {
+ pref = eccurves_all;
+ num_pref = sizeof(eccurves_all) / 2;
+ }
+
k = 0;
for (i = 0; i < num_pref; i++, pref += 2) {
const unsigned char *tsupp = supp;
