openssl: Add support for ECC Brainpool curves for DH, if defined by OpenSSL

OpenSSL does not include them in releases before 1.0.2.

diff --git a/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c b/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
index d846278c821a5eaf33e4bb1979387be8a48b74ee..93aeaf2d4950d07caf934b98e735bfe9709dc160 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
+++ b/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Tobias Brunner
+ * Copyright (C) 2008-2013 Tobias Brunner
  * Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -255,12 +255,48 @@ METHOD(diffie_hellman_t, get_dh_group, diffie_hellman_group_t,
 METHOD(diffie_hellman_t, destroy, void,
        private_openssl_ec_diffie_hellman_t *this)
 {
-       EC_POINT_clear_free(this->pub_key);
-       EC_KEY_free(this->key);
+       if (this->pub_key)
+       {
+               EC_POINT_clear_free(this->pub_key);
+       }
+       if (this->key)
+       {
+               EC_KEY_free(this->key);
+       }
        chunk_clear(&this->shared_secret);
        free(this);
 }
 
+/**
+ * Create an EC_KEY for ECC Brainpool curves as defined by OpenSSL, they are not
+ * defined in releases < 1.0.2, but we don't check the version in case somebody
+ * backorted them.
+ */
+static EC_KEY *ec_key_new_brainpool(diffie_hellman_group_t group)
+{
+       switch (group)
+       {
+#ifdef NID_brainpoolP224r1
+               case ECP_224_BP:
+                       return EC_KEY_new_by_curve_name(NID_brainpoolP224r1);
+#endif
+#ifdef NID_brainpoolP256r1
+               case ECP_256_BP:
+                       return EC_KEY_new_by_curve_name(NID_brainpoolP256r1);
+#endif
+#ifdef NID_brainpoolP384r1
+               case ECP_384_BP:
+                       return EC_KEY_new_by_curve_name(NID_brainpoolP384r1);
+#endif
+#ifdef NID_brainpoolP512r1
+               case ECP_512_BP:
+                       return EC_KEY_new_by_curve_name(NID_brainpoolP512r1);
+#endif
+               default:
+                       return NULL;
+       }
+}
+
 /*
  * Described in header.
  */
@@ -298,6 +334,12 @@ openssl_ec_diffie_hellman_t *openssl_ec_diffie_hellman_create(diffie_hellman_gro
                case ECP_521_BIT:
                        this->key = EC_KEY_new_by_curve_name(NID_secp521r1);
                        break;
+               case ECP_224_BP:
+               case ECP_256_BP:
+               case ECP_384_BP:
+               case ECP_512_BP:
+                       this->key = ec_key_new_brainpool(group);
+                       break;
                default:
                        this->key = NULL;
                        break;
@@ -315,18 +357,17 @@ openssl_ec_diffie_hellman_t *openssl_ec_diffie_hellman_create(diffie_hellman_gro
        this->pub_key = EC_POINT_new(this->ec_group);
        if (!this->pub_key)
        {
-               free(this);
+               destroy(this);
                return NULL;
        }
 
        /* generate an EC private (public) key */
        if (!EC_KEY_generate_key(this->key))
        {
-               free(this);
+               destroy(this);
                return NULL;
        }
 
        return &this->public;
 }
 #endif /* OPENSSL_NO_EC */
-

diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c
index ba4ebcd4cc526d339e0eb0887733f7bb179fdb21..ff2508609d67e256bf45abe175ffe80cea9b77ca 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_plugin.c
+++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c
@@ -452,6 +452,10 @@ METHOD(plugin_t, get_features, int,
                        PLUGIN_PROVIDE(DH, ECP_521_BIT),
                        PLUGIN_PROVIDE(DH, ECP_224_BIT),
                        PLUGIN_PROVIDE(DH, ECP_192_BIT),
+                       PLUGIN_PROVIDE(DH, ECP_224_BP),
+                       PLUGIN_PROVIDE(DH, ECP_256_BP),
+                       PLUGIN_PROVIDE(DH, ECP_384_BP),
+                       PLUGIN_PROVIDE(DH, ECP_512_BP),
 #endif
 #ifndef OPENSSL_NO_ECDSA
                /* EC private/public key loading */