Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

wolfssl: Allow setting of groups/curves. #7728

Closed
wants to merge 7 commits into from
Closed

wolfssl: Allow setting of groups/curves. #7728

Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ea7c628
wolfssl: Allow setting of groups/curves.
anhu Sep 15, 2021
61a7ff1
whitespace, XSTR*() ---> str*(), array of group mappings.
anhu Sep 16, 2021
e36fdcc
Whitespace fixups.
anhu Sep 20, 2021
be6fd19
Whitespace and comp to zero
anhu Sep 20, 2021
140cf63
Align with WolfSSL PR4412 to use levels instead of parameter set names
anhu Sep 20, 2021
1ab0bc3
Make C89 happy!
anhu Sep 20, 2021
f9080d8
Remove SSLSUPP_TLS13_CIPHERSUITES as it was wrongly added.
anhu Sep 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
72 changes: 71 additions & 1 deletion lib/vtls/wolfssl.c
View file
Open in desktop
Expand Up @@ -202,6 +202,43 @@ static int do_file_type(const char *type)
return -1;
}

#ifdef HAVE_LIBOQS
struct group_name_map {
const word16 group;
const char *name;
};

static const struct group_name_map gnm[] = {
{ WOLFSSL_KYBER_LEVEL1, "KYBER_LEVEL1" },
{ WOLFSSL_KYBER_LEVEL3, "KYBER_LEVEL3" },
{ WOLFSSL_KYBER_LEVEL5, "KYBER_LEVEL5" },
{ WOLFSSL_NTRU_HPS_LEVEL1, "NTRU_HPS_LEVEL1" },
{ WOLFSSL_NTRU_HPS_LEVEL3, "NTRU_HPS_LEVEL3" },
{ WOLFSSL_NTRU_HPS_LEVEL5, "NTRU_HPS_LEVEL5" },
{ WOLFSSL_NTRU_HRSS_LEVEL3, "NTRU_HRSS_LEVEL3" },
{ WOLFSSL_SABER_LEVEL1, "SABER_LEVEL1" },
{ WOLFSSL_SABER_LEVEL3, "SABER_LEVEL3" },
{ WOLFSSL_SABER_LEVEL5, "SABER_LEVEL5" },
{ WOLFSSL_KYBER_90S_LEVEL1, "KYBER_90S_LEVEL1" },
{ WOLFSSL_KYBER_90S_LEVEL3, "KYBER_90S_LEVEL3" },
{ WOLFSSL_KYBER_90S_LEVEL5, "KYBER_90S_LEVEL5" },
{ WOLFSSL_P256_NTRU_HPS_LEVEL1, "P256_NTRU_HPS_LEVEL1" },
{ WOLFSSL_P384_NTRU_HPS_LEVEL3, "P384_NTRU_HPS_LEVEL3" },
{ WOLFSSL_P521_NTRU_HPS_LEVEL5, "P521_NTRU_HPS_LEVEL5" },
{ WOLFSSL_P384_NTRU_HRSS_LEVEL3, "P384_NTRU_HRSS_LEVEL3" },
{ WOLFSSL_P256_SABER_LEVEL1, "P256_SABER_LEVEL1" },
{ WOLFSSL_P384_SABER_LEVEL3, "P384_SABER_LEVEL3" },
{ WOLFSSL_P521_SABER_LEVEL5, "P521_SABER_LEVEL5" },
{ WOLFSSL_P256_KYBER_LEVEL1, "P256_KYBER_LEVEL1" },
{ WOLFSSL_P384_KYBER_LEVEL3, "P384_KYBER_LEVEL3" },
{ WOLFSSL_P521_KYBER_LEVEL5, "P521_KYBER_LEVEL5" },
{ WOLFSSL_P256_KYBER_90S_LEVEL1, "P256_KYBER_90S_LEVEL1" },
{ WOLFSSL_P384_KYBER_90S_LEVEL3, "P384_KYBER_90S_LEVEL3" },
{ WOLFSSL_P521_KYBER_90S_LEVEL5, "P521_KYBER_90S_LEVEL5" },
{ 0, NULL }
};
#endif

/*
* This function loads all the client/CA certificates and CRLs. Setup the TLS
* layer and do all necessary magic.
Expand All @@ -210,11 +247,15 @@ static CURLcode
wolfssl_connect_step1(struct Curl_easy *data, struct connectdata *conn,
int sockindex)
{
char *ciphers;
char *ciphers, *curves;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
struct ssl_backend_data *backend = connssl->backend;
SSL_METHOD* req_method = NULL;
curl_socket_t sockfd = conn->sock[sockindex];
#ifdef HAVE_LIBOQS
word16 oqsAlg = 0;
size_t idx = 0;
#endif
#ifdef HAVE_SNI
bool sni = FALSE;
#define use_sni(x) sni = (x)
Expand Down Expand Up @@ -327,6 +368,26 @@ wolfssl_connect_step1(struct Curl_easy *data, struct connectdata *conn,
infof(data, "Cipher selection: %s", ciphers);
}

curves = SSL_CONN_CONFIG(curves);
bagder marked this conversation as resolved.
Show resolved Hide resolved
if(curves) {

#ifdef HAVE_LIBOQS
for(idx = 0; gnm[idx].name != NULL; idx++) {
if(strncmp(curves, gnm[idx].name, strlen(gnm[idx].name)) == 0) {
oqsAlg = gnm[idx].group;
break;
}
}

if(oqsAlg == 0)
#endif
{
if(!SSL_CTX_set1_curves_list(backend->ctx, curves)) {
failf(data, "failed setting curves list: '%s'", curves);
return CURLE_SSL_CIPHER;
}
}
}
#ifndef NO_FILESYSTEM
/* load trusted cacert */
if(SSL_CONN_CONFIG(CAfile)) {
Expand Down Expand Up @@ -439,6 +500,14 @@ wolfssl_connect_step1(struct Curl_easy *data, struct connectdata *conn,
return CURLE_OUT_OF_MEMORY;
}

#ifdef HAVE_LIBOQS
if(oqsAlg) {
if(wolfSSL_UseKeyShare(backend->handle, oqsAlg) != WOLFSSL_SUCCESS) {
failf(data, "unable to use oqs KEM");
}
}
#endif

#ifdef HAVE_ALPN
if(conn->bits.tls_enable_alpn) {
char protocols[128];
Expand Down Expand Up @@ -1113,6 +1182,7 @@ const struct Curl_ssl Curl_ssl_wolfssl = {
#ifdef KEEP_PEER_CERT
SSLSUPP_PINNEDPUBKEY |
#endif
SSLSUPP_TLS13_CIPHERSUITES |
bagder marked this conversation as resolved.
Show resolved Hide resolved
SSLSUPP_SSL_CTX,

sizeof(struct ssl_backend_data),
Expand Down