1 files changed, 72 insertions, 12 deletions

diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c
index 40374ea220..581c493a55 100644
--- a/src/lib/libtls/tls_config.c
+++ b/src/lib/libtls/tls_config.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_config.c,v 1.42 2017/08/09 21:27:24 claudio Exp $ */
+/* $OpenBSD: tls_config.c,v 1.43 2017/08/10 18:18:30 jsing Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -214,7 +214,7 @@ tls_config_new(void)
          */
         if (tls_config_set_dheparams(config, "none") != 0)
                 goto err;
-        if (tls_config_set_ecdhecurve(config, "auto") != 0)
+        if (tls_config_set_ecdhecurves(config, "default") != 0)
                 goto err;
         if (tls_config_set_ciphers(config, "secure") != 0)
                 goto err;
@@ -269,6 +269,7 @@ tls_config_free(struct tls_config *config)
         free((char *)config->ca_path);
         free((char *)config->ciphers);
         free((char *)config->crl_mem);
+        free(config->ecdhecurves);
 
         free(config);
 }
@@ -616,22 +617,81 @@ tls_config_set_dheparams(struct tls_config *config, const char *params)
 }
 
 int
-tls_config_set_ecdhecurve(struct tls_config *config, const char *name)
+tls_config_set_ecdhecurve(struct tls_config *config, const char *curve)
 {
+        if (strchr(curve, ',') != NULL || strchr(curve, ':') != NULL) {
+                tls_config_set_errorx(config, "invalid ecdhe curve '%s'",
+                    curve);
+                return (-1);
+        }
+
+        if (curve == NULL ||
+            strcasecmp(curve, "none") == 0 ||
+            strcasecmp(curve, "auto") == 0)
+                curve = TLS_ECDHE_CURVES;
+                
+        return tls_config_set_ecdhecurves(config, curve);
+}
+
+int
+tls_config_set_ecdhecurves(struct tls_config *config, const char *curves)
+{
+        int *curves_list = NULL, *curves_new;
+        size_t curves_num = 0;
+        char *cs = NULL;
+        char *p, *q;
+        int rv = -1;
         int nid;
 
-        if (name == NULL || strcasecmp(name, "none") == 0)
-                nid = NID_undef;
-        else if (strcasecmp(name, "auto") == 0)
-                nid = -1;
-        else if ((nid = OBJ_txt2nid(name)) == NID_undef) {
-                tls_config_set_errorx(config, "invalid ecdhe curve '%s'", name);
-                return (-1);
+        free(config->ecdhecurves);
+        config->ecdhecurves = NULL;
+        config->ecdhecurves_len = 0;
+
+        if (curves == NULL || strcasecmp(curves, "default") == 0)
+                curves = TLS_ECDHE_CURVES;
+
+        if ((cs = strdup(curves)) == NULL) {
+                tls_config_set_errorx(config, "out of memory");
+                goto err;
+        }
+
+        q = cs;
+        while ((p = strsep(&q, ",:")) != NULL) {
+                while (*p == ' ' || *p == '\t')
+                        p++;
+
+                nid = OBJ_sn2nid(p);
+                if (nid == NID_undef)
+                        nid = OBJ_ln2nid(p);
+                if (nid == NID_undef)
+                        nid = EC_curve_nist2nid(p);
+                if (nid == NID_undef) {
+                        tls_config_set_errorx(config,
+                            "invalid ecdhe curve '%s'", p);
+                        goto err;
+                }
+
+                if ((curves_new = reallocarray(curves_list, curves_num + 1,
+                    sizeof(int))) == NULL) {
+                        tls_config_set_errorx(config, "out of memory");
+                        goto err;
+                }
+                curves_list = curves_new;
+                curves_list[curves_num] = nid;
+                curves_num++;
         }
 
-        config->ecdhecurve = nid;
+        config->ecdhecurves = curves_list;
+        config->ecdhecurves_len = curves_num;
+        curves_list = NULL;
 
-        return (0);
+        rv = 0;
+
+ err:
+        free(cs);
+        free(curves_list);
+
+        return (rv);
 }
 
 int