Send the supported elliptic curves extension. Instead of hardcoding

the values let policy specify them. Also choose an ECC curve for
server kex from the client hello. Choice is via policy, default
implementation is to choose the first curve the client supports out of
the server's preference list.

1 files changed, 4 insertions, 3 deletions

diff --git a/src/tls/s_hello.cpp b/src/tls/s_hello.cpp
index 10e3a96fa..7b7e4a753 100644
--- a/src/tls/s_hello.cpp
+++ b/src/tls/s_hello.cpp
@@ -51,9 +51,10 @@ Server_Hello::Server_Hello(Record_Writer& writer,
          have_dsa = true;
       }
 
-   suite = policy.choose_suite(c_hello.ciphersuites(),
-                               !c_hello.supported_ecc_curves().empty(),
-                               have_rsa, have_dsa, false);
+   suite = policy.choose_suite(
+      c_hello.ciphersuites(),
+      policy.choose_curve(c_hello.supported_ecc_curves()) != "",
+      have_rsa, have_dsa, false);
 
    if(suite == 0)
       throw TLS_Exception(HANDSHAKE_FAILURE,