Use ECDH group check where appropriate

src/libtls/tls_peer.c

@@ -458,35 +458,18 @@ static status_t process_key_exchange(private_tls_peer_t *this,
 								TLS_SERVER_KEY_EXCHANGE, reader->peek(reader));
 
 	group = this->crypto->get_dh_group(this->crypto);
-	/* check if the suite used a MODP or a ECP group */
+	if (group == MODP_NONE)
-	switch (group)
 	{
-		case MODP_NONE:
+		DBG1(DBG_TLS, "received Server Key Exchange, but not required "
-			DBG1(DBG_TLS, "received Server Key Exchange, but not required "
+			 "for current suite");
-				 "for current suite");
+		this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
-			this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
+		return NEED_MORE;
-			return NEED_MORE;
-		case MODP_768_BIT:
-		case MODP_1024_BIT:
-		case MODP_1536_BIT:
-		case MODP_2048_BIT:
-		case MODP_3072_BIT:
-		case MODP_4096_BIT:
-		case MODP_6144_BIT:
-		case MODP_8192_BIT:
-		case MODP_1024_160:
-		case MODP_2048_224:
-		case MODP_2048_256:
-			return process_modp_key_exchange(this, reader);
-		case ECP_256_BIT:
-		case ECP_384_BIT:
-		case ECP_521_BIT:
-		case ECP_192_BIT:
-		case ECP_224_BIT:
-			return process_ec_key_exchange(this, reader);
-		default:
-			return FAILED;
 	}
+	if (diffie_hellman_group_is_ec(group))
+	{
+		return process_ec_key_exchange(this, reader);
+	}
+	return process_modp_key_exchange(this, reader);
 }
 
 /**

src/libtls/tls_server.c

@@ -409,23 +409,12 @@ static status_t process_key_exchange_dhe(private_tls_server_t *this,
 										 tls_reader_t *reader)
 {
 	chunk_t premaster, pub;
-	bool ec = FALSE;
+	bool ec;
 
 	this->crypto->append_handshake(this->crypto,
 								   TLS_CLIENT_KEY_EXCHANGE, reader->peek(reader));
 
-	switch (this->dh->get_dh_group(this->dh))
+	ec = diffie_hellman_group_is_ec(this->dh->get_dh_group(this->dh));
-	{
-		case ECP_256_BIT:
-		case ECP_384_BIT:
-		case ECP_521_BIT:
-		case ECP_192_BIT:
-		case ECP_224_BIT:
-			ec = TRUE;
-			break;
-		default:
-			break;
-	}
 	if ((ec && !reader->read_data8(reader, &pub)) ||
 		(!ec && !reader->read_data16(reader, &pub)))
 	{
@@ -823,36 +812,30 @@ static status_t send_server_key_exchange(private_tls_server_t *this,
 	diffie_hellman_params_t *params = NULL;
 	chunk_t chunk;
 
-	switch (group)
+	if (diffie_hellman_group_is_ec(group))
 	{
-		case ECP_256_BIT:
+		if (!peer_supports_ec_group(this, group) &&
-		case ECP_384_BIT:
+			!find_supported_group(this, &group))
-		case ECP_521_BIT:
+		{
-		case ECP_192_BIT:
+			DBG1(DBG_TLS, "no EC group supported by client and server");
-		case ECP_224_BIT:
+			this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
-			if (!peer_supports_ec_group(this, group) &&
+			return NEED_MORE;
-				!find_supported_group(this, &group))
+		}
-			{
+		writer->write_uint8(writer, TLS_ECC_NAMED_CURVE);
-				DBG1(DBG_TLS, "no EC group supported by client and server");
+		writer->write_uint16(writer, ec_group_to_curve(group));
-				this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
+	}
-				return NEED_MORE;
+	else
-			}
+	{
-			writer->write_uint8(writer, TLS_ECC_NAMED_CURVE);
+		params = diffie_hellman_get_params(group);
-			writer->write_uint16(writer, ec_group_to_curve(group));
+		if (!params)
-			break;
+		{
-		default:
+			DBG1(DBG_TLS, "no parameters found for DH group %N",
-			/* MODP groups */
+				 diffie_hellman_group_names, group);
-			params = diffie_hellman_get_params(group);
+			this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
-			if (!params)
+			return NEED_MORE;
-			{
+		}
-				DBG1(DBG_TLS, "no parameters found for DH group %N",
+		writer->write_data16(writer, params->prime);
-					 diffie_hellman_group_names, group);
+		writer->write_data16(writer, params->generator);
-				this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
-				return NEED_MORE;
-			}
-			writer->write_data16(writer, params->prime);
-			writer->write_data16(writer, params->generator);
-			break;
 	}
 	this->dh = lib->crypto->create_dh(lib->crypto, group);
 	if (!this->dh)