diff options
Diffstat (limited to 'providers/common/capabilities.c')
| -rw-r--r-- | providers/common/capabilities.c | 205 |
1 files changed, 102 insertions, 103 deletions
diff --git a/providers/common/capabilities.c b/providers/common/capabilities.c index 0c3a0daa4182..eb96627a67e2 100644 --- a/providers/common/capabilities.c +++ b/providers/common/capabilities.c @@ -24,16 +24,15 @@ * If none of EC, DH OR ML-KEM are available then we have no TLS-GROUP * capabilities. */ -#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) || \ - !defined(OPENSSL_NO_ML_KEM) +#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ML_KEM) typedef struct tls_group_constants_st { - unsigned int group_id; /* Group ID */ - unsigned int secbits; /* Bits of security */ - int mintls; /* Minimum TLS version, -1 unsupported */ - int maxtls; /* Maximum TLS version (or 0 for undefined) */ - int mindtls; /* Minimum DTLS version, -1 unsupported */ - int maxdtls; /* Maximum DTLS version (or 0 for undefined) */ - int is_kem; /* Indicates utility as KEM */ + unsigned int group_id; /* Group ID */ + unsigned int secbits; /* Bits of security */ + int mintls; /* Minimum TLS version, -1 unsupported */ + int maxtls; /* Maximum TLS version (or 0 for undefined) */ + int mindtls; /* Minimum DTLS version, -1 unsupported */ + int maxdtls; /* Maximum DTLS version (or 0 for undefined) */ + int is_kem; /* Indicates utility as KEM */ } TLS_GROUP_CONSTANTS; /* @@ -94,32 +93,32 @@ static const TLS_GROUP_CONSTANTS group_list[] = { /* 43 */ { OSSL_TLS_GROUP_ID_SecP384r1MLKEM1024, ML_KEM_1024_SECBITS, TLS1_3_VERSION, 0, -1, -1, 1 }, }; -#define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx) \ - { \ - OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME, \ - tlsname, \ - sizeof(tlsname)), \ +#define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx) \ + { \ + OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME, \ + tlsname, \ + sizeof(tlsname)), \ OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL, \ - realname, \ - sizeof(realname)), \ - OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_ALG, \ - algorithm, \ - sizeof(algorithm)), \ - OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_ID, \ - (unsigned int *)&group_list[idx].group_id), \ - OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS, \ - (unsigned int *)&group_list[idx].secbits), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_TLS, \ - (unsigned int *)&group_list[idx].mintls), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_TLS, \ - (unsigned int *)&group_list[idx].maxtls), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS, \ - (unsigned int *)&group_list[idx].mindtls), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS, \ - (unsigned int *)&group_list[idx].maxdtls), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_IS_KEM, \ - (unsigned int *)&group_list[idx].is_kem), \ - OSSL_PARAM_END \ + realname, \ + sizeof(realname)), \ + OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_ALG, \ + algorithm, \ + sizeof(algorithm)), \ + OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_ID, \ + (unsigned int *)&group_list[idx].group_id), \ + OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS, \ + (unsigned int *)&group_list[idx].secbits), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_TLS, \ + (unsigned int *)&group_list[idx].mintls), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_TLS, \ + (unsigned int *)&group_list[idx].maxtls), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS, \ + (unsigned int *)&group_list[idx].mindtls), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS, \ + (unsigned int *)&group_list[idx].maxdtls), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_IS_KEM, \ + (unsigned int *)&group_list[idx].is_kem), \ + OSSL_PARAM_END \ } /*- @@ -152,79 +151,79 @@ static const TLS_GROUP_CONSTANTS group_list[] = { * and those added later (FFDHE, brainpool, ML-KEM) */ static const OSSL_PARAM param_group_list[][11] = { -# ifndef OPENSSL_NO_EC -# if !defined(OPENSSL_NO_ML_KEM) -# if !defined(OPENSSL_NO_ECX) +#ifndef OPENSSL_NO_EC +#if !defined(OPENSSL_NO_ML_KEM) +#if !defined(OPENSSL_NO_ECX) TLS_GROUP_ENTRY("X25519MLKEM768", "", "X25519MLKEM768", 41), -# endif -# endif -# ifndef FIPS_MODULE +#endif +#endif +#ifndef FIPS_MODULE TLS_GROUP_ENTRY("x25519", "X25519", "X25519", 28), TLS_GROUP_ENTRY("x448", "X448", "X448", 29), -# endif +#endif TLS_GROUP_ENTRY("secp256r1", "prime256v1", "EC", 22), TLS_GROUP_ENTRY("P-256", "prime256v1", "EC", 22), /* Alias of above */ TLS_GROUP_ENTRY("secp384r1", "secp384r1", "EC", 23), TLS_GROUP_ENTRY("P-384", "secp384r1", "EC", 23), /* Alias of above */ TLS_GROUP_ENTRY("secp521r1", "secp521r1", "EC", 24), TLS_GROUP_ENTRY("P-521", "secp521r1", "EC", 24), /* Alias of above */ -# endif /* OPENSSL_NO_EC */ -# ifndef OPENSSL_NO_DH +#endif /* OPENSSL_NO_EC */ +#ifndef OPENSSL_NO_DH /* Security bit values for FFDHE groups are as per RFC 7919 */ TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 33), TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 34), -# endif -# if !defined(OPENSSL_NO_ML_KEM) +#endif +#if !defined(OPENSSL_NO_ML_KEM) /* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 */ TLS_GROUP_ENTRY("MLKEM512", "", "ML-KEM-512", 38), TLS_GROUP_ENTRY("MLKEM768", "", "ML-KEM-768", 39), TLS_GROUP_ENTRY("MLKEM1024", "", "ML-KEM-1024", 40), -# endif -# ifndef OPENSSL_NO_EC -# ifndef FIPS_MODULE +#endif +#ifndef OPENSSL_NO_EC +#ifndef FIPS_MODULE TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25), TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26), TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27), TLS_GROUP_ENTRY("brainpoolP256r1tls13", "brainpoolP256r1", "EC", 30), TLS_GROUP_ENTRY("brainpoolP384r1tls13", "brainpoolP384r1", "EC", 31), TLS_GROUP_ENTRY("brainpoolP512r1tls13", "brainpoolP512r1", "EC", 32), -# endif -# ifndef OPENSSL_NO_ML_KEM +#endif +#ifndef OPENSSL_NO_ML_KEM TLS_GROUP_ENTRY("SecP256r1MLKEM768", "", "SecP256r1MLKEM768", 42), TLS_GROUP_ENTRY("SecP384r1MLKEM1024", "", "SecP384r1MLKEM1024", 43), -# endif -# endif -# ifndef OPENSSL_NO_DH +#endif +#endif +#ifndef OPENSSL_NO_DH TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 35), TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 36), TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 37), -# endif -# ifndef OPENSSL_NO_TLS_DEPRECATED_EC -# ifndef OPENSSL_NO_EC2M +#endif +#ifndef OPENSSL_NO_TLS_DEPRECATED_EC +#ifndef OPENSSL_NO_EC2M TLS_GROUP_ENTRY("sect163k1", "sect163k1", "EC", 0), TLS_GROUP_ENTRY("K-163", "sect163k1", "EC", 0), /* Alias of above */ -# endif -# ifndef FIPS_MODULE +#endif +#ifndef FIPS_MODULE TLS_GROUP_ENTRY("sect163r1", "sect163r1", "EC", 1), -# endif -# ifndef OPENSSL_NO_EC2M +#endif +#ifndef OPENSSL_NO_EC2M TLS_GROUP_ENTRY("sect163r2", "sect163r2", "EC", 2), TLS_GROUP_ENTRY("B-163", "sect163r2", "EC", 2), /* Alias of above */ -# endif -# ifndef FIPS_MODULE +#endif +#ifndef FIPS_MODULE TLS_GROUP_ENTRY("sect193r1", "sect193r1", "EC", 3), TLS_GROUP_ENTRY("sect193r2", "sect193r2", "EC", 4), -# endif -# ifndef OPENSSL_NO_EC2M +#endif +#ifndef OPENSSL_NO_EC2M TLS_GROUP_ENTRY("sect233k1", "sect233k1", "EC", 5), TLS_GROUP_ENTRY("K-233", "sect233k1", "EC", 5), /* Alias of above */ TLS_GROUP_ENTRY("sect233r1", "sect233r1", "EC", 6), TLS_GROUP_ENTRY("B-233", "sect233r1", "EC", 6), /* Alias of above */ -# endif -# ifndef FIPS_MODULE +#endif +#ifndef FIPS_MODULE TLS_GROUP_ENTRY("sect239k1", "sect239k1", "EC", 7), -# endif -# ifndef OPENSSL_NO_EC2M +#endif +#ifndef OPENSSL_NO_EC2M TLS_GROUP_ENTRY("sect283k1", "sect283k1", "EC", 8), TLS_GROUP_ENTRY("K-283", "sect283k1", "EC", 8), /* Alias of above */ TLS_GROUP_ENTRY("sect283r1", "sect283r1", "EC", 9), @@ -237,24 +236,24 @@ static const OSSL_PARAM param_group_list[][11] = { TLS_GROUP_ENTRY("K-571", "sect571k1", "EC", 12), /* Alias of above */ TLS_GROUP_ENTRY("sect571r1", "sect571r1", "EC", 13), TLS_GROUP_ENTRY("B-571", "sect571r1", "EC", 13), /* Alias of above */ -# endif -# ifndef FIPS_MODULE +#endif +#ifndef FIPS_MODULE TLS_GROUP_ENTRY("secp160k1", "secp160k1", "EC", 14), TLS_GROUP_ENTRY("secp160r1", "secp160r1", "EC", 15), TLS_GROUP_ENTRY("secp160r2", "secp160r2", "EC", 16), TLS_GROUP_ENTRY("secp192k1", "secp192k1", "EC", 17), -# endif +#endif TLS_GROUP_ENTRY("secp192r1", "prime192v1", "EC", 18), TLS_GROUP_ENTRY("P-192", "prime192v1", "EC", 18), /* Alias of above */ -# ifndef FIPS_MODULE +#ifndef FIPS_MODULE TLS_GROUP_ENTRY("secp224k1", "secp224k1", "EC", 19), -# endif +#endif TLS_GROUP_ENTRY("secp224r1", "secp224r1", "EC", 20), TLS_GROUP_ENTRY("P-224", "secp224r1", "EC", 20), /* Alias of above */ -# ifndef FIPS_MODULE +#ifndef FIPS_MODULE TLS_GROUP_ENTRY("secp256k1", "secp256k1", "EC", 21), -# endif -# endif /* !defined(OPENSSL_NO_TLS_DEPRECATED_EC) */ +#endif +#endif /* !defined(OPENSSL_NO_TLS_DEPRECATED_EC) */ }; #endif /* !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ML_KEM) */ @@ -277,11 +276,11 @@ static int tls_group_capability(OSSL_CALLBACK *cb, void *arg) typedef struct tls_sigalg_constants_st { unsigned int code_point; - unsigned int sec_bits; /* Bits of security */ - int min_tls; /* Minimum TLS version, -1 unsupported */ - int max_tls; /* Maximum TLS version (or 0 for undefined) */ - int min_dtls; /* Minimum DTLS version, -1 unsupported */ - int max_dtls; /* Maximum DTLS version (or 0 for undefined) */ + unsigned int sec_bits; /* Bits of security */ + int min_tls; /* Minimum TLS version, -1 unsupported */ + int max_tls; /* Maximum TLS version (or 0 for undefined) */ + int min_dtls; /* Minimum DTLS version, -1 unsupported */ + int max_dtls; /* Maximum DTLS version (or 0 for undefined) */ } TLS_SIGALG_CONSTANTS; static const TLS_SIGALG_CONSTANTS sigalg_constants_list[3] = { @@ -290,27 +289,27 @@ static const TLS_SIGALG_CONSTANTS sigalg_constants_list[3] = { { 0x0906, 256, TLS1_3_VERSION, 0, -1, -1 }, }; -# define TLS_SIGALG_ENTRY(tlsname, algorithm, oid, idx) \ - { \ - OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_SIGALG_IANA_NAME, \ - tlsname, sizeof(tlsname)), \ - OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_SIGALG_NAME, \ - algorithm, sizeof(algorithm)), \ - OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_SIGALG_OID, \ - oid, sizeof(oid)), \ - OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_SIGALG_CODE_POINT, \ - (unsigned int *)&sigalg_constants_list[idx].code_point),\ - OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_SIGALG_SECURITY_BITS, \ - (unsigned int *)&sigalg_constants_list[idx].sec_bits), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_SIGALG_MIN_TLS, \ - (unsigned int *)&sigalg_constants_list[idx].min_tls), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_SIGALG_MAX_TLS, \ - (unsigned int *)&sigalg_constants_list[idx].max_tls), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS, \ - (unsigned int *)&sigalg_constants_list[idx].min_dtls), \ - OSSL_PARAM_int(OSSL_CAPABILITY_TLS_SIGALG_MAX_DTLS, \ - (unsigned int *)&sigalg_constants_list[idx].max_dtls), \ - OSSL_PARAM_END \ +#define TLS_SIGALG_ENTRY(tlsname, algorithm, oid, idx) \ + { \ + OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_SIGALG_IANA_NAME, \ + tlsname, sizeof(tlsname)), \ + OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_SIGALG_NAME, \ + algorithm, sizeof(algorithm)), \ + OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_SIGALG_OID, \ + oid, sizeof(oid)), \ + OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_SIGALG_CODE_POINT, \ + (unsigned int *)&sigalg_constants_list[idx].code_point), \ + OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_SIGALG_SECURITY_BITS, \ + (unsigned int *)&sigalg_constants_list[idx].sec_bits), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_SIGALG_MIN_TLS, \ + (unsigned int *)&sigalg_constants_list[idx].min_tls), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_SIGALG_MAX_TLS, \ + (unsigned int *)&sigalg_constants_list[idx].max_tls), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS, \ + (unsigned int *)&sigalg_constants_list[idx].min_dtls), \ + OSSL_PARAM_int(OSSL_CAPABILITY_TLS_SIGALG_MAX_DTLS, \ + (unsigned int *)&sigalg_constants_list[idx].max_dtls), \ + OSSL_PARAM_END \ } static const OSSL_PARAM param_sigalg_list[][10] = { @@ -333,7 +332,7 @@ static int tls_sigalg_capability(OSSL_CALLBACK *cb, void *arg) } int ossl_prov_get_capabilities(void *provctx, const char *capability, - OSSL_CALLBACK *cb, void *arg) + OSSL_CALLBACK *cb, void *arg) { if (OPENSSL_strcasecmp(capability, "TLS-GROUP") == 0) return tls_group_capability(cb, arg); |