From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Fri, 22 Nov 2013 12:06:49 +0000 (+0100)
Subject: Added curve_exists() to pk-backend. That allows to determine which curves are available.
X-Git-Tag: gnutls_3_3_0pre0~520^2~54
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=56d4c98724a73ccbf53ee8699a89f078b4465e98;p=thirdparty%2Fgnutls.git

Added curve_exists() to pk-backend. That allows to determine which curves are available.
---

diff --git a/lib/algorithms/ecc.c b/lib/algorithms/ecc.c
index 3aa4000f9d..015c5d0e23 100644
--- a/lib/algorithms/ecc.c
+++ b/lib/algorithms/ecc.c
@@ -24,7 +24,7 @@
 #include <algorithms.h>
 #include <gnutls_errors.h>
 #include <x509/common.h>
-
+#include <gnutls_pk.h>
 
 /* Supported ECC curves
  */
@@ -36,35 +36,35 @@ static const gnutls_ecc_curve_entry_st ecc_curves[] = {
 	 .id = GNUTLS_ECC_CURVE_SECP192R1,
 	 .tls_id = 19,
 	 .size = 24,
-	 },
+	},
 	{
 	 .name = "SECP224R1",
 	 .oid = "1.3.132.0.33",
 	 .id = GNUTLS_ECC_CURVE_SECP224R1,
 	 .tls_id = 21,
 	 .size = 28,
-	 },
+	},
 	{
 	 .name = "SECP256R1",
 	 .oid = "1.2.840.10045.3.1.7",
 	 .id = GNUTLS_ECC_CURVE_SECP256R1,
 	 .tls_id = 23,
 	 .size = 32,
-	 },
+	},
 	{
 	 .name = "SECP384R1",
 	 .oid = "1.3.132.0.34",
 	 .id = GNUTLS_ECC_CURVE_SECP384R1,
 	 .tls_id = 24,
 	 .size = 48,
-	 },
+	},
 	{
 	 .name = "SECP521R1",
 	 .oid = "1.3.132.0.35",
 	 .id = GNUTLS_ECC_CURVE_SECP521R1,
 	 .tls_id = 25,
 	 .size = 66,
-	 },
+	},
 	{0, 0, 0}
 };
 
@@ -79,8 +79,11 @@ int _gnutls_tls_id_to_ecc_curve(int num)
 {
 	gnutls_ecc_curve_t ret = GNUTLS_ECC_CURVE_INVALID;
 
-	GNUTLS_ECC_CURVE_LOOP(if (p->tls_id == num) {
-			      ret = p->id; break;}
+	GNUTLS_ECC_CURVE_LOOP(
+		if (p->tls_id == num && _gnutls_pk_curve_exists(p->id)) {
+			ret = p->id; 
+			break;
+		}
 	);
 
 	return ret;
@@ -103,7 +106,10 @@ const gnutls_ecc_curve_t *gnutls_ecc_curve_list(void)
 	if (supported_curves[0] == 0) {
 		int i = 0;
 
-		GNUTLS_ECC_CURVE_LOOP(supported_curves[i++] = p->id;);
+		GNUTLS_ECC_CURVE_LOOP(
+			if (_gnutls_pk_curve_exists(p->id)) 
+				supported_curves[i++] = p->id;
+		);
 		supported_curves[i++] = 0;
 	}
 
@@ -139,7 +145,7 @@ gnutls_ecc_curve_t _gnutls_oid_to_ecc_curve(const char *oid)
 	gnutls_ecc_curve_t ret = GNUTLS_ECC_CURVE_INVALID;
 
 	GNUTLS_ECC_CURVE_LOOP(
-		if (strcasecmp(p->oid, oid) == 0) {
+		if (strcasecmp(p->oid, oid) == 0 && _gnutls_pk_curve_exists(p->id)) {
 			ret = p->id;
 			break;
 		}
@@ -162,7 +168,7 @@ gnutls_ecc_curve_t _gnutls_ecc_curve_get_id(const char *name)
 	gnutls_ecc_curve_t ret = GNUTLS_ECC_CURVE_INVALID;
 
 	GNUTLS_ECC_CURVE_LOOP(
-		if (strcasecmp(p->name, name) == 0) {
+		if (strcasecmp(p->name, name) == 0 && _gnutls_pk_curve_exists(p->id)) {
 			ret = p->id;
 			break;
 		}
@@ -183,7 +189,7 @@ gnutls_ecc_curve_t _gnutls_ecc_bits_to_curve(int bits)
 	gnutls_ecc_curve_t ret = GNUTLS_ECC_CURVE_SECP224R1;
 
 	GNUTLS_ECC_CURVE_LOOP(
-		if (8 * p->size >= bits) {
+		if (8 * p->size >= bits && _gnutls_pk_curve_exists(p->id)) {
 			ret = p->id;
 			break;
 		}
diff --git a/lib/crypto-backend.h b/lib/crypto-backend.h
index 89cb239f0b..e273c0da32 100644
--- a/lib/crypto-backend.h
+++ b/lib/crypto-backend.h
@@ -324,7 +324,7 @@ typedef struct gnutls_crypto_pk {
 		       const gnutls_pk_params_st * priv,
 		       const gnutls_pk_params_st * pub);
 
-
+	int (*curve_exists) (gnutls_ecc_curve_t);	/* true/false */
 } gnutls_crypto_pk_st;
 
 /* priority: infinity for backend algorithms, 90 for kernel
diff --git a/lib/gnutls_pk.h b/lib/gnutls_pk.h
index 46eb3d4f7a..6b5d5dbf6c 100644
--- a/lib/gnutls_pk.h
+++ b/lib/gnutls_pk.h
@@ -35,6 +35,7 @@ extern gnutls_crypto_pk_st _gnutls_pk_ops;
 #define _gnutls_pk_generate_keys( algo, bits, priv) _gnutls_pk_ops.generate_keys( algo, bits, priv)
 #define _gnutls_pk_generate_params( algo, bits, priv) _gnutls_pk_ops.generate_params( algo, bits, priv)
 #define _gnutls_pk_hash_algorithm( pk, sig, params, hash) _gnutls_pk_ops.hash_algorithm(pk, sig, params, hash)
+#define _gnutls_pk_curve_exists( curve) _gnutls_pk_ops.curve_exists(curve)
 
 inline static int
 _gnutls_pk_fixup(gnutls_pk_algorithm_t algo, gnutls_direction_t direction,
diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
index 2245af0db5..619d31c5db 100644
--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
@@ -667,6 +667,11 @@ static inline const struct ecc_curve *get_supported_curve(int curve)
 	}
 }
 
+static int _wrap_nettle_pk_curve_exists(gnutls_ecc_curve_t curve)
+{
+	return ((get_supported_curve(curve)!=NULL)?1:0);
+}
+
 /* Generates algorithm's parameters. That is:
  *  For DSA: p, q, and g are generated.
  *  For RSA: nothing
@@ -1355,4 +1360,5 @@ gnutls_crypto_pk_st _gnutls_pk_ops = {
 	.generate_keys = wrap_nettle_pk_generate_keys,
 	.pk_fixup_private_params = wrap_nettle_pk_fixup,
 	.derive = _wrap_nettle_pk_derive,
+	.curve_exists = _wrap_nettle_pk_curve_exists,
 };