wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 18:57:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3624 from SparkiDev/tls13_set_groups

Browse Source 
TLS 1.3 key share: add a key share from supported list
This commit is contained in:
toddouska
2021-01-18 15:18:14 -08:00
committed by GitHub
parent 8ae609d078 f196c60c66
commit 4b5d7d0595
1 changed files with 67 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
src/tls.c
View File

@ -10056,6 +10056,47 @@ static int TLSX_PopulateSupportedGroups(WOLFSSL* ssl, TLSX** extensions)
#endif /* HAVE_SUPPORTED_CURVES */ #endif /* HAVE_SUPPORTED_CURVES */
#if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
static const word16 preferredGroup[] = {
#if defined(HAVE_ECC) && (!defined(NO_ECC256) || \
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 256
WOLFSSL_ECC_SECP256R1,
#endif
#if defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
WOLFSSL_ECC_X25519,
#endif
#if defined(HAVE_CURVE448) && ECC_MIN_KEY_SZ <= 448
WOLFSSL_ECC_X448,
#endif
#if defined(HAVE_ECC) && (!defined(NO_ECC384) || \
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 384
WOLFSSL_ECC_SECP384R1,
#endif
#if defined(HAVE_ECC) && (!defined(NO_ECC521) || \
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 521
WOLFSSL_ECC_SECP521R1,
#endif
#if defined(HAVE_FFDHE_2048)
WOLFSSL_FFDHE_2048,
#endif
#if defined(HAVE_FFDHE_3072)
WOLFSSL_FFDHE_3072,
#endif
#if defined(HAVE_FFDHE_4096)
WOLFSSL_FFDHE_4096,
#endif
#if defined(HAVE_FFDHE_6144)
WOLFSSL_FFDHE_6144,
#endif
#if defined(HAVE_FFDHE_8192)
WOLFSSL_FFDHE_8192,
#endif
};
#define PREFERRED_GROUP_SZ (sizeof(preferredGroup) / sizeof(*preferredGroup))
#endif /* WOLFSSL_TLS13 && HAVE_SUPPORTED_CURVES */
int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer) int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
{ {
int ret = 0; int ret = 0;
@ -10185,7 +10226,7 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
#else #else
ret = 0; ret = 0;
#endif #endif
#ifdef WOLFSSL_TLS13 #ifdef WOLFSSL_TLS13
if (!isServer && IsAtLeastTLSv1_3(ssl->version)) { if (!isServer && IsAtLeastTLSv1_3(ssl->version)) {
/* Add mandatory TLS v1.3 extension: supported version */ /* Add mandatory TLS v1.3 extension: supported version */
WOLFSSL_MSG("Adding supported versions extension"); WOLFSSL_MSG("Adding supported versions extension");
@ -10224,33 +10265,31 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
namedGroup = ssl->session.namedGroup; namedGroup = ssl->session.namedGroup;
else else
#endif #endif
{ if (PREFERRED_GROUP_SZ == 0) {
#if defined(HAVE_ECC) && (!defined(NO_ECC256) || \ WOLFSSL_MSG("No groups in preference list");
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 256
namedGroup = WOLFSSL_ECC_SECP256R1;
#elif defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
namedGroup = WOLFSSL_ECC_X25519;
#elif defined(HAVE_CURVE448) && ECC_MIN_KEY_SZ <= 448
namedGroup = WOLFSSL_ECC_X448;
#elif defined(HAVE_ECC) && (!defined(NO_ECC384) || \
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 384
namedGroup = WOLFSSL_ECC_SECP384R1;
#elif defined(HAVE_ECC) && (!defined(NO_ECC521) || \
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 521
namedGroup = WOLFSSL_ECC_SECP521R1;
#elif defined(HAVE_FFDHE_2048)
namedGroup = WOLFSSL_FFDHE_2048;
#elif defined(HAVE_FFDHE_3072)
namedGroup = WOLFSSL_FFDHE_3072;
#elif defined(HAVE_FFDHE_4096)
namedGroup = WOLFSSL_FFDHE_4096;
#elif defined(HAVE_FFDHE_6144)
namedGroup = WOLFSSL_FFDHE_6144;
#elif defined(HAVE_FFDHE_8192)
namedGroup = WOLFSSL_FFDHE_8192;
#else
return KEY_SHARE_ERROR; return KEY_SHARE_ERROR;
#endif }
else if (ssl->numGroups > 0) {
int set = 0;
int i, j;
/* Default to first group in supported list. */
namedGroup = ssl->group[0];
/* Try to find preferred in supported list. */
for (i = 0; i < (int)PREFERRED_GROUP_SZ && !set; i++) {
for (j = 0; j < ssl->numGroups; j++) {
if (preferredGroup[i] == ssl->group[j]) {
/* Most preferred that is supported. */
namedGroup = ssl->group[j];
set = 1;
break;
}
}
}
}
else {
/* Choose the most preferred group. */
namedGroup = preferredGroup[0];
} }
ret = TLSX_KeyShare_Use(ssl, namedGroup, 0, NULL, NULL); ret = TLSX_KeyShare_Use(ssl, namedGroup, 0, NULL, NULL);
if (ret != 0) if (ret != 0)
@ -10364,7 +10403,7 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
#endif #endif
} }
#endif #endif
(void)isServer; (void)isServer;
(void)public_key; (void)public_key;