diff options
| author | Ingela Anderton Andin <[email protected]> | 2013-10-07 15:06:51 +0200 |
|---|---|---|
| committer | Ingela Anderton Andin <[email protected]> | 2013-10-14 09:59:02 +0200 |
| commit | 475a34dc371503e601989125b9e4124cfcb26a5f (patch) | |
| tree | e4ef20110696e268a33e70eb6aab1f8cc0f5fb58 /lib/ssl/src/tls_handshake.erl | |
| parent | 240c5e4785fee63457e87c443eff5da82976c785 (diff) | |
| download | otp-475a34dc371503e601989125b9e4124cfcb26a5f.tar.gz otp-475a34dc371503e601989125b9e4124cfcb26a5f.tar.bz2 otp-475a34dc371503e601989125b9e4124cfcb26a5f.zip | |
ssl: Honor TLS client ECC extension
Also the server should only send ECC point formats extension not ECC curve
extension.
Diffstat (limited to 'lib/ssl/src/tls_handshake.erl')
| -rw-r--r-- | lib/ssl/src/tls_handshake.erl | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/lib/ssl/src/tls_handshake.erl b/lib/ssl/src/tls_handshake.erl index 02bfa69fc5..6f97da3ccf 100644 --- a/lib/ssl/src/tls_handshake.erl +++ b/lib/ssl/src/tls_handshake.erl @@ -120,17 +120,16 @@ hello(#client_hello{client_version = ClientVersion, cipher_suites = CipherSuites, compression_methods = Compressions, random = Random, - extensions = HelloExt}, + extensions = #hello_extensions{elliptic_curves = Curves} = HelloExt}, #ssl_options{versions = Versions} = SslOpts, {Port, Session0, Cache, CacheCb, ConnectionStates0, Cert}, Renegotiation) -> Version = ssl_handshake:select_version(tls_record, ClientVersion, Versions), case tls_record:is_acceptable_version(Version, Versions) of true -> - %% TODO: need to take supported Curves into Account when selecting the CipherSuite.... - %% if whe have an ECDSA cert with an unsupported curve, we need to drop ECDSA ciphers + ECCCurve = ssl_handshake:select_curve(Curves, ssl_handshake:supported_ecc(Version)), {Type, #session{cipher_suite = CipherSuite} = Session1} = ssl_handshake:select_session(SugesstedId, CipherSuites, Compressions, - Port, Session0, Version, + Port, Session0#session{ecc = ECCCurve}, Version, SslOpts, Cache, CacheCb, Cert), case CipherSuite of no_suite -> |