]> git.ipfire.org Git - thirdparty/openssl.git/blame - providers/common/capabilities.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Move e_os.h to include/internal
[thirdparty/openssl.git] / providers / common / capabilities.c
CommitLineData
72bfc958 1/*
a28d06f3 2 * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
72bfc958
MC		 3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10#include <assert.h>
11#include <string.h>
23c48d94 12#include <openssl/core_dispatch.h>
72bfc958
MC		 13#include <openssl/core_names.h>
14/* For TLS1_VERSION etc */
085e3cec 15#include <openssl/prov_ssl.h>
72bfc958
MC		 16#include <openssl/params.h>
17#include "internal/nelem.h"
48e971dd 18#include "internal/tlsgroups.h"
72bfc958 19#include "prov/providercommon.h"
d5f9166b 20#include "internal/e_os.h"
72bfc958 21
cbb85bda
MC		 22/* If neither ec or dh is available then we have no TLS-GROUP capabilities */
23#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
72bfc958
MC		 24typedef struct tls_group_constants_st {
25 unsigned int group_id; /* Group ID */
26 unsigned int secbits; /* Bits of security */
27 int mintls; /* Minimum TLS version, -1 unsupported */
28 int maxtls; /* Maximum TLS version (or 0 for undefined) */
29 int mindtls; /* Minimum DTLS version, -1 unsupported */
30 int maxdtls; /* Maximum DTLS version (or 0 for undefined) */
31} TLS_GROUP_CONSTANTS;
32
33static const TLS_GROUP_CONSTANTS group_list[35] = {
9ff5bd61
TM		 34 { OSSL_TLS_GROUP_ID_sect163k1, 80, TLS1_VERSION, TLS1_2_VERSION,
35 DTLS1_VERSION, DTLS1_2_VERSION },
36 { OSSL_TLS_GROUP_ID_sect163r1, 80, TLS1_VERSION, TLS1_2_VERSION,
37 DTLS1_VERSION, DTLS1_2_VERSION },
38 { OSSL_TLS_GROUP_ID_sect163r2, 80, TLS1_VERSION, TLS1_2_VERSION,
39 DTLS1_VERSION, DTLS1_2_VERSION },
40 { OSSL_TLS_GROUP_ID_sect193r1, 80, TLS1_VERSION, TLS1_2_VERSION,
41 DTLS1_VERSION, DTLS1_2_VERSION },
42 { OSSL_TLS_GROUP_ID_sect193r2, 80, TLS1_VERSION, TLS1_2_VERSION,
43 DTLS1_VERSION, DTLS1_2_VERSION },
44 { OSSL_TLS_GROUP_ID_sect233k1, 112, TLS1_VERSION, TLS1_2_VERSION,
45 DTLS1_VERSION, DTLS1_2_VERSION },
46 { OSSL_TLS_GROUP_ID_sect233r1, 112, TLS1_VERSION, TLS1_2_VERSION,
47 DTLS1_VERSION, DTLS1_2_VERSION },
48 { OSSL_TLS_GROUP_ID_sect239k1, 112, TLS1_VERSION, TLS1_2_VERSION,
49 DTLS1_VERSION, DTLS1_2_VERSION },
50 { OSSL_TLS_GROUP_ID_sect283k1, 128, TLS1_VERSION, TLS1_2_VERSION,
51 DTLS1_VERSION, DTLS1_2_VERSION },
52 { OSSL_TLS_GROUP_ID_sect283r1, 128, TLS1_VERSION, TLS1_2_VERSION,
53 DTLS1_VERSION, DTLS1_2_VERSION },
54 { OSSL_TLS_GROUP_ID_sect409k1, 192, TLS1_VERSION, TLS1_2_VERSION,
55 DTLS1_VERSION, DTLS1_2_VERSION },
56 { OSSL_TLS_GROUP_ID_sect409r1, 192, TLS1_VERSION, TLS1_2_VERSION,
57 DTLS1_VERSION, DTLS1_2_VERSION },
58 { OSSL_TLS_GROUP_ID_sect571k1, 256, TLS1_VERSION, TLS1_2_VERSION,
59 DTLS1_VERSION, DTLS1_2_VERSION },
60 { OSSL_TLS_GROUP_ID_sect571r1, 256, TLS1_VERSION, TLS1_2_VERSION,
61 DTLS1_VERSION, DTLS1_2_VERSION },
62 { OSSL_TLS_GROUP_ID_secp160k1, 80, TLS1_VERSION, TLS1_2_VERSION,
63 DTLS1_VERSION, DTLS1_2_VERSION },
64 { OSSL_TLS_GROUP_ID_secp160r1, 80, TLS1_VERSION, TLS1_2_VERSION,
65 DTLS1_VERSION, DTLS1_2_VERSION },
66 { OSSL_TLS_GROUP_ID_secp160r2, 80, TLS1_VERSION, TLS1_2_VERSION,
67 DTLS1_VERSION, DTLS1_2_VERSION },
68 { OSSL_TLS_GROUP_ID_secp192k1, 80, TLS1_VERSION, TLS1_2_VERSION,
69 DTLS1_VERSION, DTLS1_2_VERSION },
70 { OSSL_TLS_GROUP_ID_secp192r1, 80, TLS1_VERSION, TLS1_2_VERSION,
71 DTLS1_VERSION, DTLS1_2_VERSION },
72 { OSSL_TLS_GROUP_ID_secp224k1, 112, TLS1_VERSION, TLS1_2_VERSION,
73 DTLS1_VERSION, DTLS1_2_VERSION },
74 { OSSL_TLS_GROUP_ID_secp224r1, 112, TLS1_VERSION, TLS1_2_VERSION,
75 DTLS1_VERSION, DTLS1_2_VERSION },
76 { OSSL_TLS_GROUP_ID_secp256k1, 128, TLS1_VERSION, TLS1_2_VERSION,
77 DTLS1_VERSION, DTLS1_2_VERSION },
48e971dd
MC		 78 { OSSL_TLS_GROUP_ID_secp256r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
79 { OSSL_TLS_GROUP_ID_secp384r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
80 { OSSL_TLS_GROUP_ID_secp521r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
81 { OSSL_TLS_GROUP_ID_brainpoolP256r1, 128, TLS1_VERSION, TLS1_2_VERSION,
82 DTLS1_VERSION, DTLS1_2_VERSION },
83 { OSSL_TLS_GROUP_ID_brainpoolP384r1, 192, TLS1_VERSION, TLS1_2_VERSION,
84 DTLS1_VERSION, DTLS1_2_VERSION },
85 { OSSL_TLS_GROUP_ID_brainpoolP512r1, 256, TLS1_VERSION, TLS1_2_VERSION,
86 DTLS1_VERSION, DTLS1_2_VERSION },
87 { OSSL_TLS_GROUP_ID_x25519, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
88 { OSSL_TLS_GROUP_ID_x448, 224, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
72bfc958 89 /* Security bit values as given by BN_security_bits() */
48e971dd
MC		 90 { OSSL_TLS_GROUP_ID_ffdhe2048, 112, TLS1_3_VERSION, 0, -1, -1 },
91 { OSSL_TLS_GROUP_ID_ffdhe3072, 128, TLS1_3_VERSION, 0, -1, -1 },
92 { OSSL_TLS_GROUP_ID_ffdhe4096, 128, TLS1_3_VERSION, 0, -1, -1 },
93 { OSSL_TLS_GROUP_ID_ffdhe6144, 128, TLS1_3_VERSION, 0, -1, -1 },
94 { OSSL_TLS_GROUP_ID_ffdhe8192, 192, TLS1_3_VERSION, 0, -1, -1 },
72bfc958
MC		 95};
96
97#define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx) \
98 { \
99 OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME, \
100 tlsname, \
101 sizeof(tlsname)), \
102 OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL, \
103 realname, \
104 sizeof(realname)), \
105 OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_ALG, \
106 algorithm, \
107 sizeof(algorithm)), \
108 OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_ID, \
109 (unsigned int *)&group_list[idx].group_id), \
110 OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS, \
111 (unsigned int *)&group_list[idx].secbits), \
112 OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_TLS, \
113 (unsigned int *)&group_list[idx].mintls), \
114 OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_TLS, \
115 (unsigned int *)&group_list[idx].maxtls), \
116 OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS, \
117 (unsigned int *)&group_list[idx].mindtls), \
118 OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS, \
119 (unsigned int *)&group_list[idx].maxdtls), \
120 OSSL_PARAM_END \
121 }
122
123static const OSSL_PARAM param_group_list[][10] = {
cbb85bda
MC		 124# ifndef OPENSSL_NO_EC
125# ifndef OPENSSL_NO_EC2M
72bfc958 126 TLS_GROUP_ENTRY("sect163k1", "sect163k1", "EC", 0),
306b8e7e 127 TLS_GROUP_ENTRY("K-163", "sect163k1", "EC", 0), /* Alias of above */
cbb85bda
MC		 128# endif
129# ifndef FIPS_MODULE
72bfc958 130 TLS_GROUP_ENTRY("sect163r1", "sect163r1", "EC", 1),
cbb85bda
MC		 131# endif
132# ifndef OPENSSL_NO_EC2M
72bfc958 133 TLS_GROUP_ENTRY("sect163r2", "sect163r2", "EC", 2),
306b8e7e 134 TLS_GROUP_ENTRY("B-163", "sect163r2", "EC", 2), /* Alias of above */
cbb85bda
MC		 135# endif
136# ifndef FIPS_MODULE
72bfc958
MC		 137 TLS_GROUP_ENTRY("sect193r1", "sect193r1", "EC", 3),
138 TLS_GROUP_ENTRY("sect193r2", "sect193r2", "EC", 4),
cbb85bda
MC		 139# endif
140# ifndef OPENSSL_NO_EC2M
72bfc958 141 TLS_GROUP_ENTRY("sect233k1", "sect233k1", "EC", 5),
306b8e7e 142 TLS_GROUP_ENTRY("K-233", "sect233k1", "EC", 5), /* Alias of above */
72bfc958 143 TLS_GROUP_ENTRY("sect233r1", "sect233r1", "EC", 6),
306b8e7e 144 TLS_GROUP_ENTRY("B-233", "sect233r1", "EC", 6), /* Alias of above */
cbb85bda
MC		 145# endif
146# ifndef FIPS_MODULE
72bfc958 147 TLS_GROUP_ENTRY("sect239k1", "sect239k1", "EC", 7),
cbb85bda
MC		 148# endif
149# ifndef OPENSSL_NO_EC2M
72bfc958 150 TLS_GROUP_ENTRY("sect283k1", "sect283k1", "EC", 8),
306b8e7e 151 TLS_GROUP_ENTRY("K-283", "sect283k1", "EC", 8), /* Alias of above */
72bfc958 152 TLS_GROUP_ENTRY("sect283r1", "sect283r1", "EC", 9),
306b8e7e 153 TLS_GROUP_ENTRY("B-283", "sect283r1", "EC", 9), /* Alias of above */
72bfc958 154 TLS_GROUP_ENTRY("sect409k1", "sect409k1", "EC", 10),
306b8e7e 155 TLS_GROUP_ENTRY("K-409", "sect409k1", "EC", 10), /* Alias of above */
72bfc958 156 TLS_GROUP_ENTRY("sect409r1", "sect409r1", "EC", 11),
306b8e7e 157 TLS_GROUP_ENTRY("B-409", "sect409r1", "EC", 11), /* Alias of above */
72bfc958 158 TLS_GROUP_ENTRY("sect571k1", "sect571k1", "EC", 12),
306b8e7e 159 TLS_GROUP_ENTRY("K-571", "sect571k1", "EC", 12), /* Alias of above */
72bfc958 160 TLS_GROUP_ENTRY("sect571r1", "sect571r1", "EC", 13),
306b8e7e 161 TLS_GROUP_ENTRY("B-571", "sect571r1", "EC", 13), /* Alias of above */
cbb85bda
MC		 162# endif
163# ifndef FIPS_MODULE
72bfc958
MC		 164 TLS_GROUP_ENTRY("secp160k1", "secp160k1", "EC", 14),
165 TLS_GROUP_ENTRY("secp160r1", "secp160r1", "EC", 15),
166 TLS_GROUP_ENTRY("secp160r2", "secp160r2", "EC", 16),
167 TLS_GROUP_ENTRY("secp192k1", "secp192k1", "EC", 17),
cbb85bda 168# endif
72bfc958 169 TLS_GROUP_ENTRY("secp192r1", "prime192v1", "EC", 18),
306b8e7e 170 TLS_GROUP_ENTRY("P-192", "prime192v1", "EC", 18), /* Alias of above */
cbb85bda 171# ifndef FIPS_MODULE
72bfc958 172 TLS_GROUP_ENTRY("secp224k1", "secp224k1", "EC", 19),
cbb85bda 173# endif
72bfc958 174 TLS_GROUP_ENTRY("secp224r1", "secp224r1", "EC", 20),
306b8e7e 175 TLS_GROUP_ENTRY("P-224", "secp224r1", "EC", 20), /* Alias of above */
cbb85bda 176# ifndef FIPS_MODULE
72bfc958 177 TLS_GROUP_ENTRY("secp256k1", "secp256k1", "EC", 21),
cbb85bda 178# endif
72bfc958 179 TLS_GROUP_ENTRY("secp256r1", "prime256v1", "EC", 22),
306b8e7e 180 TLS_GROUP_ENTRY("P-256", "prime256v1", "EC", 22), /* Alias of above */
72bfc958 181 TLS_GROUP_ENTRY("secp384r1", "secp384r1", "EC", 23),
306b8e7e 182 TLS_GROUP_ENTRY("P-384", "secp384r1", "EC", 23), /* Alias of above */
72bfc958 183 TLS_GROUP_ENTRY("secp521r1", "secp521r1", "EC", 24),
306b8e7e 184 TLS_GROUP_ENTRY("P-521", "secp521r1", "EC", 24), /* Alias of above */
cbb85bda 185# ifndef FIPS_MODULE
72bfc958
MC		 186 TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25),
187 TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26),
188 TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27),
cbb85bda 189# endif
306b8e7e
MC		 190 TLS_GROUP_ENTRY("x25519", "X25519", "X25519", 28),
191 TLS_GROUP_ENTRY("x448", "X448", "X448", 29),
cbb85bda
MC		 192# endif /* OPENSSL_NO_EC */
193# ifndef OPENSSL_NO_DH
72bfc958
MC		 194 /* Security bit values for FFDHE groups are as per RFC 7919 */
195 TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 30),
196 TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 31),
197 TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 32),
198 TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 33),
199 TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 34),
cbb85bda 200# endif
72bfc958 201};
cbb85bda 202#endif /* !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) */
72bfc958
MC		 203
204static int tls_group_capability(OSSL_CALLBACK *cb, void *arg)
205{
cbb85bda 206#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
72bfc958
MC		 207 size_t i;
208
72bfc958
MC		 209 for (i = 0; i < OSSL_NELEM(param_group_list); i++)
210 if (!cb(param_group_list[i], arg))
211 return 0;
cbb85bda 212#endif
72bfc958
MC		 213
214 return 1;
215}
216
c8830891
SL		 217int ossl_prov_get_capabilities(void *provctx, const char *capability,
218 OSSL_CALLBACK *cb, void *arg)
72bfc958 219{
ecca5b6e 220 if (strcasecmp(capability, "TLS-GROUP") == 0)
72bfc958
MC		 221 return tls_group_capability(cb, arg);
222
223 /* We don't support this capability */
224 return 0;
225}
A mirror of the official openssl repository