Coverage Report

Created: 2025-06-13 06:58

/src/openssl32/providers/common/capabilities.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#include <assert.h>
11
#include <string.h>
12
#include <openssl/core_dispatch.h>
13
#include <openssl/core_names.h>
14
/* For TLS1_VERSION etc */
15
#include <openssl/prov_ssl.h>
16
#include <openssl/params.h>
17
#include "internal/nelem.h"
18
#include "internal/tlsgroups.h"
19
#include "prov/providercommon.h"
20
#include "internal/e_os.h"
21
22
/* If neither ec or dh is available then we have no TLS-GROUP capabilities */
23
#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
24
typedef struct tls_group_constants_st {
25
    unsigned int group_id;   /* Group ID */
26
    unsigned int secbits;    /* Bits of security */
27
    int mintls;              /* Minimum TLS version, -1 unsupported */
28
    int maxtls;              /* Maximum TLS version (or 0 for undefined) */
29
    int mindtls;             /* Minimum DTLS version, -1 unsupported */
30
    int maxdtls;             /* Maximum DTLS version (or 0 for undefined) */
31
} TLS_GROUP_CONSTANTS;
32
33
static const TLS_GROUP_CONSTANTS group_list[] = {
34
    { OSSL_TLS_GROUP_ID_sect163k1, 80, TLS1_VERSION, TLS1_2_VERSION,
35
      DTLS1_VERSION, DTLS1_2_VERSION },
36
    { OSSL_TLS_GROUP_ID_sect163r1, 80, TLS1_VERSION, TLS1_2_VERSION,
37
      DTLS1_VERSION, DTLS1_2_VERSION },
38
    { OSSL_TLS_GROUP_ID_sect163r2, 80, TLS1_VERSION, TLS1_2_VERSION,
39
      DTLS1_VERSION, DTLS1_2_VERSION },
40
    { OSSL_TLS_GROUP_ID_sect193r1, 80, TLS1_VERSION, TLS1_2_VERSION,
41
      DTLS1_VERSION, DTLS1_2_VERSION },
42
    { OSSL_TLS_GROUP_ID_sect193r2, 80, TLS1_VERSION, TLS1_2_VERSION,
43
      DTLS1_VERSION, DTLS1_2_VERSION },
44
    { OSSL_TLS_GROUP_ID_sect233k1, 112, TLS1_VERSION, TLS1_2_VERSION,
45
      DTLS1_VERSION, DTLS1_2_VERSION },
46
    { OSSL_TLS_GROUP_ID_sect233r1, 112, TLS1_VERSION, TLS1_2_VERSION,
47
      DTLS1_VERSION, DTLS1_2_VERSION },
48
    { OSSL_TLS_GROUP_ID_sect239k1, 112, TLS1_VERSION, TLS1_2_VERSION,
49
      DTLS1_VERSION, DTLS1_2_VERSION },
50
    { OSSL_TLS_GROUP_ID_sect283k1, 128, TLS1_VERSION, TLS1_2_VERSION,
51
      DTLS1_VERSION, DTLS1_2_VERSION },
52
    { OSSL_TLS_GROUP_ID_sect283r1, 128, TLS1_VERSION, TLS1_2_VERSION,
53
      DTLS1_VERSION, DTLS1_2_VERSION },
54
    { OSSL_TLS_GROUP_ID_sect409k1, 192, TLS1_VERSION, TLS1_2_VERSION,
55
      DTLS1_VERSION, DTLS1_2_VERSION },
56
    { OSSL_TLS_GROUP_ID_sect409r1, 192, TLS1_VERSION, TLS1_2_VERSION,
57
      DTLS1_VERSION, DTLS1_2_VERSION },
58
    { OSSL_TLS_GROUP_ID_sect571k1, 256, TLS1_VERSION, TLS1_2_VERSION,
59
      DTLS1_VERSION, DTLS1_2_VERSION },
60
    { OSSL_TLS_GROUP_ID_sect571r1, 256, TLS1_VERSION, TLS1_2_VERSION,
61
      DTLS1_VERSION, DTLS1_2_VERSION },
62
    { OSSL_TLS_GROUP_ID_secp160k1, 80, TLS1_VERSION, TLS1_2_VERSION,
63
      DTLS1_VERSION, DTLS1_2_VERSION },
64
    { OSSL_TLS_GROUP_ID_secp160r1, 80, TLS1_VERSION, TLS1_2_VERSION,
65
      DTLS1_VERSION, DTLS1_2_VERSION },
66
    { OSSL_TLS_GROUP_ID_secp160r2, 80, TLS1_VERSION, TLS1_2_VERSION,
67
      DTLS1_VERSION, DTLS1_2_VERSION },
68
    { OSSL_TLS_GROUP_ID_secp192k1, 80, TLS1_VERSION, TLS1_2_VERSION,
69
      DTLS1_VERSION, DTLS1_2_VERSION },
70
    { OSSL_TLS_GROUP_ID_secp192r1, 80, TLS1_VERSION, TLS1_2_VERSION,
71
      DTLS1_VERSION, DTLS1_2_VERSION },
72
    { OSSL_TLS_GROUP_ID_secp224k1, 112, TLS1_VERSION, TLS1_2_VERSION,
73
      DTLS1_VERSION, DTLS1_2_VERSION },
74
    { OSSL_TLS_GROUP_ID_secp224r1, 112, TLS1_VERSION, TLS1_2_VERSION,
75
      DTLS1_VERSION, DTLS1_2_VERSION },
76
    { OSSL_TLS_GROUP_ID_secp256k1, 128, TLS1_VERSION, TLS1_2_VERSION,
77
      DTLS1_VERSION, DTLS1_2_VERSION },
78
    { OSSL_TLS_GROUP_ID_secp256r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
79
    { OSSL_TLS_GROUP_ID_secp384r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
80
    { OSSL_TLS_GROUP_ID_secp521r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
81
    { OSSL_TLS_GROUP_ID_brainpoolP256r1, 128, TLS1_VERSION, TLS1_2_VERSION,
82
      DTLS1_VERSION, DTLS1_2_VERSION },
83
    { OSSL_TLS_GROUP_ID_brainpoolP384r1, 192, TLS1_VERSION, TLS1_2_VERSION,
84
      DTLS1_VERSION, DTLS1_2_VERSION },
85
    { OSSL_TLS_GROUP_ID_brainpoolP512r1, 256, TLS1_VERSION, TLS1_2_VERSION,
86
      DTLS1_VERSION, DTLS1_2_VERSION },
87
    { OSSL_TLS_GROUP_ID_x25519, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
88
    { OSSL_TLS_GROUP_ID_x448, 224, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
89
    { OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13, 128, TLS1_3_VERSION, 0, -1, -1 },
90
    { OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13, 192, TLS1_3_VERSION, 0, -1, -1 },
91
    { OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13, 256, TLS1_3_VERSION, 0, -1, -1 },
92
    /* Security bit values as given by BN_security_bits() */
93
    { OSSL_TLS_GROUP_ID_ffdhe2048, 112, TLS1_3_VERSION, 0, -1, -1 },
94
    { OSSL_TLS_GROUP_ID_ffdhe3072, 128, TLS1_3_VERSION, 0, -1, -1 },
95
    { OSSL_TLS_GROUP_ID_ffdhe4096, 128, TLS1_3_VERSION, 0, -1, -1 },
96
    { OSSL_TLS_GROUP_ID_ffdhe6144, 128, TLS1_3_VERSION, 0, -1, -1 },
97
    { OSSL_TLS_GROUP_ID_ffdhe8192, 192, TLS1_3_VERSION, 0, -1, -1 },
98
};
99
100
#define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx) \
101
    { \
102
        OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME, \
103
                               tlsname, \
104
                               sizeof(tlsname)), \
105
        OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL, \
106
                               realname, \
107
                               sizeof(realname)), \
108
        OSSL_PARAM_utf8_string(OSSL_CAPABILITY_TLS_GROUP_ALG, \
109
                               algorithm, \
110
                               sizeof(algorithm)), \
111
        OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_ID, \
112
                        (unsigned int *)&group_list[idx].group_id), \
113
        OSSL_PARAM_uint(OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS, \
114
                        (unsigned int *)&group_list[idx].secbits), \
115
        OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_TLS, \
116
                        (unsigned int *)&group_list[idx].mintls), \
117
        OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_TLS, \
118
                        (unsigned int *)&group_list[idx].maxtls), \
119
        OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS, \
120
                        (unsigned int *)&group_list[idx].mindtls), \
121
        OSSL_PARAM_int(OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS, \
122
                        (unsigned int *)&group_list[idx].maxdtls), \
123
        OSSL_PARAM_END \
124
    }
125
126
static const OSSL_PARAM param_group_list[][10] = {
127
# ifndef OPENSSL_NO_EC
128
#  ifndef OPENSSL_NO_EC2M
129
    TLS_GROUP_ENTRY("sect163k1", "sect163k1", "EC", 0),
130
    TLS_GROUP_ENTRY("K-163", "sect163k1", "EC", 0), /* Alias of above */
131
#  endif
132
#  ifndef FIPS_MODULE
133
    TLS_GROUP_ENTRY("sect163r1", "sect163r1", "EC", 1),
134
#  endif
135
#  ifndef OPENSSL_NO_EC2M
136
    TLS_GROUP_ENTRY("sect163r2", "sect163r2", "EC", 2),
137
    TLS_GROUP_ENTRY("B-163", "sect163r2", "EC", 2), /* Alias of above */
138
#  endif
139
#  ifndef FIPS_MODULE
140
    TLS_GROUP_ENTRY("sect193r1", "sect193r1", "EC", 3),
141
    TLS_GROUP_ENTRY("sect193r2", "sect193r2", "EC", 4),
142
#  endif
143
#  ifndef OPENSSL_NO_EC2M
144
    TLS_GROUP_ENTRY("sect233k1", "sect233k1", "EC", 5),
145
    TLS_GROUP_ENTRY("K-233", "sect233k1", "EC", 5), /* Alias of above */
146
    TLS_GROUP_ENTRY("sect233r1", "sect233r1", "EC", 6),
147
    TLS_GROUP_ENTRY("B-233", "sect233r1", "EC", 6), /* Alias of above */
148
#  endif
149
#  ifndef FIPS_MODULE
150
    TLS_GROUP_ENTRY("sect239k1", "sect239k1", "EC", 7),
151
#  endif
152
#  ifndef OPENSSL_NO_EC2M
153
    TLS_GROUP_ENTRY("sect283k1", "sect283k1", "EC", 8),
154
    TLS_GROUP_ENTRY("K-283", "sect283k1", "EC", 8), /* Alias of above */
155
    TLS_GROUP_ENTRY("sect283r1", "sect283r1", "EC", 9),
156
    TLS_GROUP_ENTRY("B-283", "sect283r1", "EC", 9), /* Alias of above */
157
    TLS_GROUP_ENTRY("sect409k1", "sect409k1", "EC", 10),
158
    TLS_GROUP_ENTRY("K-409", "sect409k1", "EC", 10), /* Alias of above */
159
    TLS_GROUP_ENTRY("sect409r1", "sect409r1", "EC", 11),
160
    TLS_GROUP_ENTRY("B-409", "sect409r1", "EC", 11), /* Alias of above */
161
    TLS_GROUP_ENTRY("sect571k1", "sect571k1", "EC", 12),
162
    TLS_GROUP_ENTRY("K-571", "sect571k1", "EC", 12), /* Alias of above */
163
    TLS_GROUP_ENTRY("sect571r1", "sect571r1", "EC", 13),
164
    TLS_GROUP_ENTRY("B-571", "sect571r1", "EC", 13), /* Alias of above */
165
#  endif
166
#  ifndef FIPS_MODULE
167
    TLS_GROUP_ENTRY("secp160k1", "secp160k1", "EC", 14),
168
    TLS_GROUP_ENTRY("secp160r1", "secp160r1", "EC", 15),
169
    TLS_GROUP_ENTRY("secp160r2", "secp160r2", "EC", 16),
170
    TLS_GROUP_ENTRY("secp192k1", "secp192k1", "EC", 17),
171
#  endif
172
    TLS_GROUP_ENTRY("secp192r1", "prime192v1", "EC", 18),
173
    TLS_GROUP_ENTRY("P-192", "prime192v1", "EC", 18), /* Alias of above */
174
#  ifndef FIPS_MODULE
175
    TLS_GROUP_ENTRY("secp224k1", "secp224k1", "EC", 19),
176
#  endif
177
    TLS_GROUP_ENTRY("secp224r1", "secp224r1", "EC", 20),
178
    TLS_GROUP_ENTRY("P-224", "secp224r1", "EC", 20), /* Alias of above */
179
#  ifndef FIPS_MODULE
180
    TLS_GROUP_ENTRY("secp256k1", "secp256k1", "EC", 21),
181
#  endif
182
    TLS_GROUP_ENTRY("secp256r1", "prime256v1", "EC", 22),
183
    TLS_GROUP_ENTRY("P-256", "prime256v1", "EC", 22), /* Alias of above */
184
    TLS_GROUP_ENTRY("secp384r1", "secp384r1", "EC", 23),
185
    TLS_GROUP_ENTRY("P-384", "secp384r1", "EC", 23), /* Alias of above */
186
    TLS_GROUP_ENTRY("secp521r1", "secp521r1", "EC", 24),
187
    TLS_GROUP_ENTRY("P-521", "secp521r1", "EC", 24), /* Alias of above */
188
#  ifndef FIPS_MODULE
189
    TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25),
190
    TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26),
191
    TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27),
192
#  endif
193
    TLS_GROUP_ENTRY("x25519", "X25519", "X25519", 28),
194
    TLS_GROUP_ENTRY("x448", "X448", "X448", 29),
195
#  ifndef FIPS_MODULE
196
    TLS_GROUP_ENTRY("brainpoolP256r1tls13", "brainpoolP256r1", "EC", 30),
197
    TLS_GROUP_ENTRY("brainpoolP384r1tls13", "brainpoolP384r1", "EC", 31),
198
    TLS_GROUP_ENTRY("brainpoolP512r1tls13", "brainpoolP512r1", "EC", 32),
199
#  endif
200
# endif /* OPENSSL_NO_EC */
201
# ifndef OPENSSL_NO_DH
202
    /* Security bit values for FFDHE groups are as per RFC 7919 */
203
    TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 33),
204
    TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 34),
205
    TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 35),
206
    TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 36),
207
    TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 37),
208
# endif
209
};
210
#endif /* !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) */
211
212
static int tls_group_capability(OSSL_CALLBACK *cb, void *arg)
213
79.3k
{
214
79.3k
#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
215
79.3k
    size_t i;
216
217
4.39M
    for (i = 0; i < OSSL_NELEM(param_group_list); i++)
218
4.31M
        if (!cb(param_group_list[i], arg))
219
0
            return 0;
220
79.3k
#endif
221
222
79.3k
    return 1;
223
79.3k
}
224
225
int ossl_prov_get_capabilities(void *provctx, const char *capability,
226
                               OSSL_CALLBACK *cb, void *arg)
227
72.0k
{
228
72.0k
    if (OPENSSL_strcasecmp(capability, "TLS-GROUP") == 0)
229
48.2k
        return tls_group_capability(cb, arg);
230
231
    /* We don't support this capability */
232
23.8k
    return 0;
233
72.0k
}