[thirdparty/openssl.git] / providers / common / capabilities.c

/*
 * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <assert.h>
#include <string.h>
#include <openssl/core_numbers.h>
#include <openssl/core_names.h>
/* For TLS1_VERSION etc */
#include <openssl/ssl.h>
#include <openssl/params.h>
#include "internal/nelem.h"
#include "internal/tlsgroups.h"
#include "prov/providercommon.h"

typedef struct tls_group_constants_st {
    unsigned int group_id;   /* Group ID */
    unsigned int secbits;    /* Bits of security */
    int mintls;              /* Minimum TLS version, -1 unsupported */
    int maxtls;              /* Maximum TLS version (or 0 for undefined) */
    int mindtls;             /* Minimum DTLS version, -1 unsupported */
    int maxdtls;             /* Maximum DTLS version (or 0 for undefined) */
} TLS_GROUP_CONSTANTS;

static const TLS_GROUP_CONSTANTS group_list[35] = {
    { OSSL_TLS_GROUP_ID_sect163k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect163r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect163r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect193r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect193r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect233k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect233r1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect239k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect283k1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect283r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect409k1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect409r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect571k1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_sect571r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp160k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp160r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp160r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp192k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp192r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp224k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp224r1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp256k1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp256r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp384r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_secp521r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_brainpoolP256r1, 128, TLS1_VERSION, TLS1_2_VERSION,
      DTLS1_VERSION, DTLS1_2_VERSION },
    { OSSL_TLS_GROUP_ID_brainpoolP384r1, 192, TLS1_VERSION, TLS1_2_VERSION,
      DTLS1_VERSION, DTLS1_2_VERSION },
    { OSSL_TLS_GROUP_ID_brainpoolP512r1, 256, TLS1_VERSION, TLS1_2_VERSION,
      DTLS1_VERSION, DTLS1_2_VERSION },
    { OSSL_TLS_GROUP_ID_x25519, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    { OSSL_TLS_GROUP_ID_x448, 224, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
    /* Security bit values as given by BN_security_bits() */
    { OSSL_TLS_GROUP_ID_ffdhe2048, 112, TLS1_3_VERSION, 0, -1, -1 },
    { OSSL_TLS_GROUP_ID_ffdhe3072, 128, TLS1_3_VERSION, 0, -1, -1 },
    { OSSL_TLS_GROUP_ID_ffdhe4096, 128, TLS1_3_VERSION, 0, -1, -1 },
    { OSSL_TLS_GROUP_ID_ffdhe6144, 128, TLS1_3_VERSION, 0, -1, -1 },
    { OSSL_TLS_GROUP_ID_ffdhe8192, 192, TLS1_3_VERSION, 0, -1, -1 },
};

#define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx) \
    { \
        OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME, \
                               tlsname, \
                               sizeof(tlsname)), \
        OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL, \
                               realname, \
                               sizeof(realname)), \
        OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_ALG, \
                               algorithm, \
                               sizeof(algorithm)), \
        OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_ID, \
                        (unsigned int *)&group_list[idx].group_id), \
        OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS, \
                        (unsigned int *)&group_list[idx].secbits), \
        OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_TLS, \
                        (unsigned int *)&group_list[idx].mintls), \
        OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_TLS, \
                        (unsigned int *)&group_list[idx].maxtls), \
        OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS, \
                        (unsigned int *)&group_list[idx].mindtls), \
        OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS, \
                        (unsigned int *)&group_list[idx].maxdtls), \
        OSSL_PARAM_END \
    }

static const OSSL_PARAM param_group_list[][10] = {
#ifndef OPENSSL_NO_EC
    TLS_GROUP_ENTRY("sect163k1", "sect163k1", "EC", 0),
# ifndef FIPS_MODULE
    TLS_GROUP_ENTRY("sect163r1", "sect163r1", "EC", 1),
# endif
    TLS_GROUP_ENTRY("sect163r2", "sect163r2", "EC", 2),
# ifndef FIPS_MODULE
    TLS_GROUP_ENTRY("sect193r1", "sect193r1", "EC", 3),
    TLS_GROUP_ENTRY("sect193r2", "sect193r2", "EC", 4),
# endif
    TLS_GROUP_ENTRY("sect233k1", "sect233k1", "EC", 5),
    TLS_GROUP_ENTRY("sect233r1", "sect233r1", "EC", 6),
# ifndef FIPS_MODULE
    TLS_GROUP_ENTRY("sect239k1", "sect239k1", "EC", 7),
# endif
    TLS_GROUP_ENTRY("sect283k1", "sect283k1", "EC", 8),
    TLS_GROUP_ENTRY("sect283r1", "sect283r1", "EC", 9),
    TLS_GROUP_ENTRY("sect409k1", "sect409k1", "EC", 10),
    TLS_GROUP_ENTRY("sect409r1", "sect409r1", "EC", 11),
    TLS_GROUP_ENTRY("sect571k1", "sect571k1", "EC", 12),
    TLS_GROUP_ENTRY("sect571r1", "sect571r1", "EC", 13),
# ifndef FIPS_MODULE
    TLS_GROUP_ENTRY("secp160k1", "secp160k1", "EC", 14),
    TLS_GROUP_ENTRY("secp160r1", "secp160r1", "EC", 15),
    TLS_GROUP_ENTRY("secp160r2", "secp160r2", "EC", 16),
    TLS_GROUP_ENTRY("secp192k1", "secp192k1", "EC", 17),
# endif
    TLS_GROUP_ENTRY("secp192r1", "prime192v1", "EC", 18),
# ifndef FIPS_MODULE
    TLS_GROUP_ENTRY("secp224k1", "secp224k1", "EC", 19),
# endif
    TLS_GROUP_ENTRY("secp224r1", "secp224r1", "EC", 20),
# ifndef FIPS_MODULE
    TLS_GROUP_ENTRY("secp256k1", "secp256k1", "EC", 21),
# endif
    TLS_GROUP_ENTRY("secp256r1", "prime256v1", "EC", 22),
    TLS_GROUP_ENTRY("secp384r1", "secp384r1", "EC", 23),
    TLS_GROUP_ENTRY("secp521r1", "secp521r1", "EC", 24),
# ifndef FIPS_MODULE
    TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25),
    TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26),
    TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27),
# endif
    TLS_GROUP_ENTRY("x25519", "x25519", "X25519", 28),
    TLS_GROUP_ENTRY("x448", "x448", "X448", 29),
#endif /* OPENSSL_NO_EC */
#ifndef OPENSSL_NO_DH
    /* Security bit values for FFDHE groups are as per RFC 7919 */
    TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 30),
    TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 31),
    TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 32),
    TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 33),
    TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 34),
#endif
};

static int tls_group_capability(OSSL_CALLBACK *cb, void *arg)
{
    size_t i;

#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_DH) && !defined(FIPS_MODULE)
    assert(OSSL_NELEM(param_group_list) == OSSL_NELEM(group_list));
#endif
    for (i = 0; i < OSSL_NELEM(param_group_list); i++)
        if (!cb(param_group_list[i], arg))
            return 0;

    return 1;
}

int provider_get_capabilities(void *provctx, const char *capability,
                              OSSL_CALLBACK *cb, void *arg)
{
    if (strcmp(capability, "TLS-GROUP") == 0)
        return tls_group_capability(cb, arg);

    /* We don't support this capability */
    return 0;
}
Commit	Line	Data
72bfc958 MC	1	/*
	2	* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
	3	*
	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
	10	#include <assert.h>
	11	#include <string.h>
	12	#include <openssl/core_numbers.h>
	13	#include <openssl/core_names.h>
	14	/* For TLS1_VERSION etc */
	15	#include <openssl/ssl.h>
	16	#include <openssl/params.h>
	17	#include "internal/nelem.h"
48e971dd	18	#include "internal/tlsgroups.h"
72bfc958 MC	19	#include "prov/providercommon.h"
	20
	21	typedef struct tls_group_constants_st {
	22	unsigned int group_id; /* Group ID */
	23	unsigned int secbits; /* Bits of security */
	24	int mintls; /* Minimum TLS version, -1 unsupported */
	25	int maxtls; /* Maximum TLS version (or 0 for undefined) */
	26	int mindtls; /* Minimum DTLS version, -1 unsupported */
	27	int maxdtls; /* Maximum DTLS version (or 0 for undefined) */
	28	} TLS_GROUP_CONSTANTS;
	29
	30	static const TLS_GROUP_CONSTANTS group_list[35] = {
48e971dd MC	31	{ OSSL_TLS_GROUP_ID_sect163k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	32	{ OSSL_TLS_GROUP_ID_sect163r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	33	{ OSSL_TLS_GROUP_ID_sect163r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	34	{ OSSL_TLS_GROUP_ID_sect193r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	35	{ OSSL_TLS_GROUP_ID_sect193r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	36	{ OSSL_TLS_GROUP_ID_sect233k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	37	{ OSSL_TLS_GROUP_ID_sect233r1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	38	{ OSSL_TLS_GROUP_ID_sect239k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	39	{ OSSL_TLS_GROUP_ID_sect283k1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	40	{ OSSL_TLS_GROUP_ID_sect283r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	41	{ OSSL_TLS_GROUP_ID_sect409k1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	42	{ OSSL_TLS_GROUP_ID_sect409r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	43	{ OSSL_TLS_GROUP_ID_sect571k1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	44	{ OSSL_TLS_GROUP_ID_sect571r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	45	{ OSSL_TLS_GROUP_ID_secp160k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	46	{ OSSL_TLS_GROUP_ID_secp160r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	47	{ OSSL_TLS_GROUP_ID_secp160r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	48	{ OSSL_TLS_GROUP_ID_secp192k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	49	{ OSSL_TLS_GROUP_ID_secp192r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	50	{ OSSL_TLS_GROUP_ID_secp224k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	51	{ OSSL_TLS_GROUP_ID_secp224r1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	52	{ OSSL_TLS_GROUP_ID_secp256k1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	53	{ OSSL_TLS_GROUP_ID_secp256r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	54	{ OSSL_TLS_GROUP_ID_secp384r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	55	{ OSSL_TLS_GROUP_ID_secp521r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	56	{ OSSL_TLS_GROUP_ID_brainpoolP256r1, 128, TLS1_VERSION, TLS1_2_VERSION,
	57	DTLS1_VERSION, DTLS1_2_VERSION },
	58	{ OSSL_TLS_GROUP_ID_brainpoolP384r1, 192, TLS1_VERSION, TLS1_2_VERSION,
	59	DTLS1_VERSION, DTLS1_2_VERSION },
	60	{ OSSL_TLS_GROUP_ID_brainpoolP512r1, 256, TLS1_VERSION, TLS1_2_VERSION,
	61	DTLS1_VERSION, DTLS1_2_VERSION },
	62	{ OSSL_TLS_GROUP_ID_x25519, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
	63	{ OSSL_TLS_GROUP_ID_x448, 224, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
72bfc958	64	/* Security bit values as given by BN_security_bits() */
48e971dd MC	65	{ OSSL_TLS_GROUP_ID_ffdhe2048, 112, TLS1_3_VERSION, 0, -1, -1 },
	66	{ OSSL_TLS_GROUP_ID_ffdhe3072, 128, TLS1_3_VERSION, 0, -1, -1 },
	67	{ OSSL_TLS_GROUP_ID_ffdhe4096, 128, TLS1_3_VERSION, 0, -1, -1 },
	68	{ OSSL_TLS_GROUP_ID_ffdhe6144, 128, TLS1_3_VERSION, 0, -1, -1 },
	69	{ OSSL_TLS_GROUP_ID_ffdhe8192, 192, TLS1_3_VERSION, 0, -1, -1 },
72bfc958 MC	70	};
	71
	72	#define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx) \
	73	{ \
	74	OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME, \
	75	tlsname, \
	76	sizeof(tlsname)), \
	77	OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL, \
	78	realname, \
	79	sizeof(realname)), \
	80	OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_ALG, \
	81	algorithm, \
	82	sizeof(algorithm)), \
	83	OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_ID, \
	84	(unsigned int *)&group_list[idx].group_id), \
	85	OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS, \
	86	(unsigned int *)&group_list[idx].secbits), \
	87	OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_TLS, \
	88	(unsigned int *)&group_list[idx].mintls), \
	89	OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_TLS, \
	90	(unsigned int *)&group_list[idx].maxtls), \
	91	OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS, \
	92	(unsigned int *)&group_list[idx].mindtls), \
	93	OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS, \
	94	(unsigned int *)&group_list[idx].maxdtls), \
	95	OSSL_PARAM_END \
	96	}
	97
	98	static const OSSL_PARAM param_group_list[][10] = {
	99	#ifndef OPENSSL_NO_EC
	100	TLS_GROUP_ENTRY("sect163k1", "sect163k1", "EC", 0),
	101	# ifndef FIPS_MODULE
	102	TLS_GROUP_ENTRY("sect163r1", "sect163r1", "EC", 1),
	103	# endif
	104	TLS_GROUP_ENTRY("sect163r2", "sect163r2", "EC", 2),
	105	# ifndef FIPS_MODULE
	106	TLS_GROUP_ENTRY("sect193r1", "sect193r1", "EC", 3),
	107	TLS_GROUP_ENTRY("sect193r2", "sect193r2", "EC", 4),
	108	# endif
	109	TLS_GROUP_ENTRY("sect233k1", "sect233k1", "EC", 5),
	110	TLS_GROUP_ENTRY("sect233r1", "sect233r1", "EC", 6),
	111	# ifndef FIPS_MODULE
	112	TLS_GROUP_ENTRY("sect239k1", "sect239k1", "EC", 7),
	113	# endif
	114	TLS_GROUP_ENTRY("sect283k1", "sect283k1", "EC", 8),
	115	TLS_GROUP_ENTRY("sect283r1", "sect283r1", "EC", 9),
	116	TLS_GROUP_ENTRY("sect409k1", "sect409k1", "EC", 10),
	117	TLS_GROUP_ENTRY("sect409r1", "sect409r1", "EC", 11),
	118	TLS_GROUP_ENTRY("sect571k1", "sect571k1", "EC", 12),
	119	TLS_GROUP_ENTRY("sect571r1", "sect571r1", "EC", 13),
	120	# ifndef FIPS_MODULE
	121	TLS_GROUP_ENTRY("secp160k1", "secp160k1", "EC", 14),
	122	TLS_GROUP_ENTRY("secp160r1", "secp160r1", "EC", 15),
	123	TLS_GROUP_ENTRY("secp160r2", "secp160r2", "EC", 16),
	124	TLS_GROUP_ENTRY("secp192k1", "secp192k1", "EC", 17),
	125	# endif
	126	TLS_GROUP_ENTRY("secp192r1", "prime192v1", "EC", 18),
	127	# ifndef FIPS_MODULE
	128	TLS_GROUP_ENTRY("secp224k1", "secp224k1", "EC", 19),
	129	# endif
	130	TLS_GROUP_ENTRY("secp224r1", "secp224r1", "EC", 20),
	131	# ifndef FIPS_MODULE
	132	TLS_GROUP_ENTRY("secp256k1", "secp256k1", "EC", 21),
	133	# endif
134	TLS_GROUP_ENTRY("secp256r1", "prime256v1", "EC", 22),
135	TLS_GROUP_ENTRY("secp384r1", "secp384r1", "EC", 23),
136	TLS_GROUP_ENTRY("secp521r1", "secp521r1", "EC", 24),
137	# ifndef FIPS_MODULE
138	TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25),
139	TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26),
140	TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27),
141	# endif
142	TLS_GROUP_ENTRY("x25519", "x25519", "X25519", 28),
143	TLS_GROUP_ENTRY("x448", "x448", "X448", 29),
144	#endif /* OPENSSL_NO_EC */
145	#ifndef OPENSSL_NO_DH
146	/* Security bit values for FFDHE groups are as per RFC 7919 */
147	TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 30),
148	TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 31),
149	TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 32),
150	TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 33),
151	TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 34),
152	#endif
153	};
154
155	static int tls_group_capability(OSSL_CALLBACK cb, void arg)
156	{
157	size_t i;
158
159	#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_DH) && !defined(FIPS_MODULE)
160	assert(OSSL_NELEM(param_group_list) == OSSL_NELEM(group_list));
161	#endif
162	for (i = 0; i < OSSL_NELEM(param_group_list); i++)
163	if (!cb(param_group_list[i], arg))
164	return 0;
165
166	return 1;
167	}
168
169	int provider_get_capabilities(void provctx, const char capability,
170	OSSL_CALLBACK cb, void arg)
171	{
172	if (strcmp(capability, "TLS-GROUP") == 0)
173	return tls_group_capability(cb, arg);
174
175	/* We don't support this capability */
176	return 0;
177	}