]>
Commit | Line | Data |
---|---|---|
72bfc958 | 1 | /* |
fecb3aae | 2 | * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. |
72bfc958 MC |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | #include <assert.h> | |
11 | #include <string.h> | |
23c48d94 | 12 | #include <openssl/core_dispatch.h> |
72bfc958 MC |
13 | #include <openssl/core_names.h> |
14 | /* For TLS1_VERSION etc */ | |
085e3cec | 15 | #include <openssl/prov_ssl.h> |
72bfc958 MC |
16 | #include <openssl/params.h> |
17 | #include "internal/nelem.h" | |
48e971dd | 18 | #include "internal/tlsgroups.h" |
72bfc958 | 19 | #include "prov/providercommon.h" |
d5f9166b | 20 | #include "internal/e_os.h" |
72bfc958 | 21 | |
cbb85bda MC |
22 | /* If neither ec or dh is available then we have no TLS-GROUP capabilities */ |
23 | #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) | |
72bfc958 MC |
24 | typedef struct tls_group_constants_st { |
25 | unsigned int group_id; /* Group ID */ | |
26 | unsigned int secbits; /* Bits of security */ | |
27 | int mintls; /* Minimum TLS version, -1 unsupported */ | |
28 | int maxtls; /* Maximum TLS version (or 0 for undefined) */ | |
29 | int mindtls; /* Minimum DTLS version, -1 unsupported */ | |
30 | int maxdtls; /* Maximum DTLS version (or 0 for undefined) */ | |
31 | } TLS_GROUP_CONSTANTS; | |
32 | ||
33 | static const TLS_GROUP_CONSTANTS group_list[35] = { | |
9ff5bd61 TM |
34 | { OSSL_TLS_GROUP_ID_sect163k1, 80, TLS1_VERSION, TLS1_2_VERSION, |
35 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
36 | { OSSL_TLS_GROUP_ID_sect163r1, 80, TLS1_VERSION, TLS1_2_VERSION, | |
37 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
38 | { OSSL_TLS_GROUP_ID_sect163r2, 80, TLS1_VERSION, TLS1_2_VERSION, | |
39 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
40 | { OSSL_TLS_GROUP_ID_sect193r1, 80, TLS1_VERSION, TLS1_2_VERSION, | |
41 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
42 | { OSSL_TLS_GROUP_ID_sect193r2, 80, TLS1_VERSION, TLS1_2_VERSION, | |
43 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
44 | { OSSL_TLS_GROUP_ID_sect233k1, 112, TLS1_VERSION, TLS1_2_VERSION, | |
45 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
46 | { OSSL_TLS_GROUP_ID_sect233r1, 112, TLS1_VERSION, TLS1_2_VERSION, | |
47 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
48 | { OSSL_TLS_GROUP_ID_sect239k1, 112, TLS1_VERSION, TLS1_2_VERSION, | |
49 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
50 | { OSSL_TLS_GROUP_ID_sect283k1, 128, TLS1_VERSION, TLS1_2_VERSION, | |
51 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
52 | { OSSL_TLS_GROUP_ID_sect283r1, 128, TLS1_VERSION, TLS1_2_VERSION, | |
53 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
54 | { OSSL_TLS_GROUP_ID_sect409k1, 192, TLS1_VERSION, TLS1_2_VERSION, | |
55 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
56 | { OSSL_TLS_GROUP_ID_sect409r1, 192, TLS1_VERSION, TLS1_2_VERSION, | |
57 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
58 | { OSSL_TLS_GROUP_ID_sect571k1, 256, TLS1_VERSION, TLS1_2_VERSION, | |
59 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
60 | { OSSL_TLS_GROUP_ID_sect571r1, 256, TLS1_VERSION, TLS1_2_VERSION, | |
61 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
62 | { OSSL_TLS_GROUP_ID_secp160k1, 80, TLS1_VERSION, TLS1_2_VERSION, | |
63 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
64 | { OSSL_TLS_GROUP_ID_secp160r1, 80, TLS1_VERSION, TLS1_2_VERSION, | |
65 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
66 | { OSSL_TLS_GROUP_ID_secp160r2, 80, TLS1_VERSION, TLS1_2_VERSION, | |
67 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
68 | { OSSL_TLS_GROUP_ID_secp192k1, 80, TLS1_VERSION, TLS1_2_VERSION, | |
69 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
70 | { OSSL_TLS_GROUP_ID_secp192r1, 80, TLS1_VERSION, TLS1_2_VERSION, | |
71 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
72 | { OSSL_TLS_GROUP_ID_secp224k1, 112, TLS1_VERSION, TLS1_2_VERSION, | |
73 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
74 | { OSSL_TLS_GROUP_ID_secp224r1, 112, TLS1_VERSION, TLS1_2_VERSION, | |
75 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
76 | { OSSL_TLS_GROUP_ID_secp256k1, 128, TLS1_VERSION, TLS1_2_VERSION, | |
77 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
48e971dd MC |
78 | { OSSL_TLS_GROUP_ID_secp256r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, |
79 | { OSSL_TLS_GROUP_ID_secp384r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, | |
80 | { OSSL_TLS_GROUP_ID_secp521r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, | |
81 | { OSSL_TLS_GROUP_ID_brainpoolP256r1, 128, TLS1_VERSION, TLS1_2_VERSION, | |
82 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
83 | { OSSL_TLS_GROUP_ID_brainpoolP384r1, 192, TLS1_VERSION, TLS1_2_VERSION, | |
84 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
85 | { OSSL_TLS_GROUP_ID_brainpoolP512r1, 256, TLS1_VERSION, TLS1_2_VERSION, | |
86 | DTLS1_VERSION, DTLS1_2_VERSION }, | |
87 | { OSSL_TLS_GROUP_ID_x25519, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, | |
88 | { OSSL_TLS_GROUP_ID_x448, 224, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, | |
72bfc958 | 89 | /* Security bit values as given by BN_security_bits() */ |
48e971dd MC |
90 | { OSSL_TLS_GROUP_ID_ffdhe2048, 112, TLS1_3_VERSION, 0, -1, -1 }, |
91 | { OSSL_TLS_GROUP_ID_ffdhe3072, 128, TLS1_3_VERSION, 0, -1, -1 }, | |
92 | { OSSL_TLS_GROUP_ID_ffdhe4096, 128, TLS1_3_VERSION, 0, -1, -1 }, | |
93 | { OSSL_TLS_GROUP_ID_ffdhe6144, 128, TLS1_3_VERSION, 0, -1, -1 }, | |
94 | { OSSL_TLS_GROUP_ID_ffdhe8192, 192, TLS1_3_VERSION, 0, -1, -1 }, | |
72bfc958 MC |
95 | }; |
96 | ||
97 | #define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx) \ | |
98 | { \ | |
99 | OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME, \ | |
100 | tlsname, \ | |
101 | sizeof(tlsname)), \ | |
102 | OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL, \ | |
103 | realname, \ | |
104 | sizeof(realname)), \ | |
105 | OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_ALG, \ | |
106 | algorithm, \ | |
107 | sizeof(algorithm)), \ | |
108 | OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_ID, \ | |
109 | (unsigned int *)&group_list[idx].group_id), \ | |
110 | OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS, \ | |
111 | (unsigned int *)&group_list[idx].secbits), \ | |
112 | OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_TLS, \ | |
113 | (unsigned int *)&group_list[idx].mintls), \ | |
114 | OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_TLS, \ | |
115 | (unsigned int *)&group_list[idx].maxtls), \ | |
116 | OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS, \ | |
117 | (unsigned int *)&group_list[idx].mindtls), \ | |
118 | OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS, \ | |
119 | (unsigned int *)&group_list[idx].maxdtls), \ | |
120 | OSSL_PARAM_END \ | |
121 | } | |
122 | ||
123 | static const OSSL_PARAM param_group_list[][10] = { | |
cbb85bda MC |
124 | # ifndef OPENSSL_NO_EC |
125 | # ifndef OPENSSL_NO_EC2M | |
72bfc958 | 126 | TLS_GROUP_ENTRY("sect163k1", "sect163k1", "EC", 0), |
306b8e7e | 127 | TLS_GROUP_ENTRY("K-163", "sect163k1", "EC", 0), /* Alias of above */ |
cbb85bda MC |
128 | # endif |
129 | # ifndef FIPS_MODULE | |
72bfc958 | 130 | TLS_GROUP_ENTRY("sect163r1", "sect163r1", "EC", 1), |
cbb85bda MC |
131 | # endif |
132 | # ifndef OPENSSL_NO_EC2M | |
72bfc958 | 133 | TLS_GROUP_ENTRY("sect163r2", "sect163r2", "EC", 2), |
306b8e7e | 134 | TLS_GROUP_ENTRY("B-163", "sect163r2", "EC", 2), /* Alias of above */ |
cbb85bda MC |
135 | # endif |
136 | # ifndef FIPS_MODULE | |
72bfc958 MC |
137 | TLS_GROUP_ENTRY("sect193r1", "sect193r1", "EC", 3), |
138 | TLS_GROUP_ENTRY("sect193r2", "sect193r2", "EC", 4), | |
cbb85bda MC |
139 | # endif |
140 | # ifndef OPENSSL_NO_EC2M | |
72bfc958 | 141 | TLS_GROUP_ENTRY("sect233k1", "sect233k1", "EC", 5), |
306b8e7e | 142 | TLS_GROUP_ENTRY("K-233", "sect233k1", "EC", 5), /* Alias of above */ |
72bfc958 | 143 | TLS_GROUP_ENTRY("sect233r1", "sect233r1", "EC", 6), |
306b8e7e | 144 | TLS_GROUP_ENTRY("B-233", "sect233r1", "EC", 6), /* Alias of above */ |
cbb85bda MC |
145 | # endif |
146 | # ifndef FIPS_MODULE | |
72bfc958 | 147 | TLS_GROUP_ENTRY("sect239k1", "sect239k1", "EC", 7), |
cbb85bda MC |
148 | # endif |
149 | # ifndef OPENSSL_NO_EC2M | |
72bfc958 | 150 | TLS_GROUP_ENTRY("sect283k1", "sect283k1", "EC", 8), |
306b8e7e | 151 | TLS_GROUP_ENTRY("K-283", "sect283k1", "EC", 8), /* Alias of above */ |
72bfc958 | 152 | TLS_GROUP_ENTRY("sect283r1", "sect283r1", "EC", 9), |
306b8e7e | 153 | TLS_GROUP_ENTRY("B-283", "sect283r1", "EC", 9), /* Alias of above */ |
72bfc958 | 154 | TLS_GROUP_ENTRY("sect409k1", "sect409k1", "EC", 10), |
306b8e7e | 155 | TLS_GROUP_ENTRY("K-409", "sect409k1", "EC", 10), /* Alias of above */ |
72bfc958 | 156 | TLS_GROUP_ENTRY("sect409r1", "sect409r1", "EC", 11), |
306b8e7e | 157 | TLS_GROUP_ENTRY("B-409", "sect409r1", "EC", 11), /* Alias of above */ |
72bfc958 | 158 | TLS_GROUP_ENTRY("sect571k1", "sect571k1", "EC", 12), |
306b8e7e | 159 | TLS_GROUP_ENTRY("K-571", "sect571k1", "EC", 12), /* Alias of above */ |
72bfc958 | 160 | TLS_GROUP_ENTRY("sect571r1", "sect571r1", "EC", 13), |
306b8e7e | 161 | TLS_GROUP_ENTRY("B-571", "sect571r1", "EC", 13), /* Alias of above */ |
cbb85bda MC |
162 | # endif |
163 | # ifndef FIPS_MODULE | |
72bfc958 MC |
164 | TLS_GROUP_ENTRY("secp160k1", "secp160k1", "EC", 14), |
165 | TLS_GROUP_ENTRY("secp160r1", "secp160r1", "EC", 15), | |
166 | TLS_GROUP_ENTRY("secp160r2", "secp160r2", "EC", 16), | |
167 | TLS_GROUP_ENTRY("secp192k1", "secp192k1", "EC", 17), | |
cbb85bda | 168 | # endif |
72bfc958 | 169 | TLS_GROUP_ENTRY("secp192r1", "prime192v1", "EC", 18), |
306b8e7e | 170 | TLS_GROUP_ENTRY("P-192", "prime192v1", "EC", 18), /* Alias of above */ |
cbb85bda | 171 | # ifndef FIPS_MODULE |
72bfc958 | 172 | TLS_GROUP_ENTRY("secp224k1", "secp224k1", "EC", 19), |
cbb85bda | 173 | # endif |
72bfc958 | 174 | TLS_GROUP_ENTRY("secp224r1", "secp224r1", "EC", 20), |
306b8e7e | 175 | TLS_GROUP_ENTRY("P-224", "secp224r1", "EC", 20), /* Alias of above */ |
cbb85bda | 176 | # ifndef FIPS_MODULE |
72bfc958 | 177 | TLS_GROUP_ENTRY("secp256k1", "secp256k1", "EC", 21), |
cbb85bda | 178 | # endif |
72bfc958 | 179 | TLS_GROUP_ENTRY("secp256r1", "prime256v1", "EC", 22), |
306b8e7e | 180 | TLS_GROUP_ENTRY("P-256", "prime256v1", "EC", 22), /* Alias of above */ |
72bfc958 | 181 | TLS_GROUP_ENTRY("secp384r1", "secp384r1", "EC", 23), |
306b8e7e | 182 | TLS_GROUP_ENTRY("P-384", "secp384r1", "EC", 23), /* Alias of above */ |
72bfc958 | 183 | TLS_GROUP_ENTRY("secp521r1", "secp521r1", "EC", 24), |
306b8e7e | 184 | TLS_GROUP_ENTRY("P-521", "secp521r1", "EC", 24), /* Alias of above */ |
cbb85bda | 185 | # ifndef FIPS_MODULE |
72bfc958 MC |
186 | TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25), |
187 | TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26), | |
188 | TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27), | |
cbb85bda | 189 | # endif |
306b8e7e MC |
190 | TLS_GROUP_ENTRY("x25519", "X25519", "X25519", 28), |
191 | TLS_GROUP_ENTRY("x448", "X448", "X448", 29), | |
cbb85bda MC |
192 | # endif /* OPENSSL_NO_EC */ |
193 | # ifndef OPENSSL_NO_DH | |
72bfc958 MC |
194 | /* Security bit values for FFDHE groups are as per RFC 7919 */ |
195 | TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 30), | |
196 | TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 31), | |
197 | TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 32), | |
198 | TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 33), | |
199 | TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 34), | |
cbb85bda | 200 | # endif |
72bfc958 | 201 | }; |
cbb85bda | 202 | #endif /* !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) */ |
72bfc958 MC |
203 | |
204 | static int tls_group_capability(OSSL_CALLBACK *cb, void *arg) | |
205 | { | |
cbb85bda | 206 | #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) |
72bfc958 MC |
207 | size_t i; |
208 | ||
72bfc958 MC |
209 | for (i = 0; i < OSSL_NELEM(param_group_list); i++) |
210 | if (!cb(param_group_list[i], arg)) | |
211 | return 0; | |
cbb85bda | 212 | #endif |
72bfc958 MC |
213 | |
214 | return 1; | |
215 | } | |
216 | ||
c8830891 SL |
217 | int ossl_prov_get_capabilities(void *provctx, const char *capability, |
218 | OSSL_CALLBACK *cb, void *arg) | |
72bfc958 | 219 | { |
fba140c7 | 220 | if (OPENSSL_strcasecmp(capability, "TLS-GROUP") == 0) |
72bfc958 MC |
221 | return tls_group_capability(cb, arg); |
222 | ||
223 | /* We don't support this capability */ | |
224 | return 0; | |
225 | } |