ssl_test_lib.c (20226B)
1 /* 2 * Common code library for SSL test programs. 3 * 4 * In addition to the functions in this file, there is shared source code 5 * that cannot be compiled separately in "ssl_test_common_source.c". 6 * 7 * Copyright The Mbed TLS Contributors 8 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 9 */ 10 11 12 #include "ssl_test_lib.h" 13 14 #if defined(MBEDTLS_TEST_HOOKS) 15 #include "test/threading_helpers.h" 16 #endif 17 18 #if !defined(MBEDTLS_SSL_TEST_IMPOSSIBLE) 19 20 #define ARRAY_LENGTH(x) (sizeof(x)/sizeof(x[0])) 21 22 void my_debug(void *ctx, int level, 23 const char *file, int line, 24 const char *str) 25 { 26 const char *p, *basename; 27 28 /* Extract basename from file */ 29 for (p = basename = file; *p != '\0'; p++) { 30 if (*p == '/' || *p == '\\') { 31 basename = p + 1; 32 } 33 } 34 35 mbedtls_fprintf((FILE *) ctx, "%s:%04d: |%d| %s", 36 basename, line, level, str); 37 fflush((FILE *) ctx); 38 } 39 40 #if defined(MBEDTLS_HAVE_TIME) 41 mbedtls_time_t dummy_constant_time(mbedtls_time_t *time) 42 { 43 (void) time; 44 return 0x5af2a056; 45 } 46 #endif 47 48 #if !defined(MBEDTLS_TEST_USE_PSA_CRYPTO_RNG) 49 static int dummy_entropy(void *data, unsigned char *output, size_t len) 50 { 51 size_t i; 52 int ret; 53 (void) data; 54 55 ret = mbedtls_entropy_func(data, output, len); 56 for (i = 0; i < len; i++) { 57 //replace result with pseudo random 58 output[i] = (unsigned char) rand(); 59 } 60 return ret; 61 } 62 #endif 63 64 void rng_init(rng_context_t *rng) 65 { 66 #if defined(MBEDTLS_TEST_USE_PSA_CRYPTO_RNG) 67 (void) rng; 68 psa_crypto_init(); 69 #else /* !MBEDTLS_TEST_USE_PSA_CRYPTO_RNG */ 70 71 #if defined(MBEDTLS_CTR_DRBG_C) 72 mbedtls_ctr_drbg_init(&rng->drbg); 73 #elif defined(MBEDTLS_HMAC_DRBG_C) 74 mbedtls_hmac_drbg_init(&rng->drbg); 75 #else 76 #error "No DRBG available" 77 #endif 78 79 mbedtls_entropy_init(&rng->entropy); 80 #endif /* !MBEDTLS_TEST_USE_PSA_CRYPTO_RNG */ 81 } 82 83 int rng_seed(rng_context_t *rng, int reproducible, const char *pers) 84 { 85 #if defined(MBEDTLS_USE_PSA_CRYPTO) 86 if (reproducible) { 87 mbedtls_fprintf(stderr, 88 "MBEDTLS_USE_PSA_CRYPTO does not support reproducible mode.\n"); 89 return -1; 90 } 91 #endif 92 #if defined(MBEDTLS_TEST_USE_PSA_CRYPTO_RNG) 93 /* The PSA crypto RNG does its own seeding. */ 94 (void) rng; 95 (void) pers; 96 if (reproducible) { 97 mbedtls_fprintf(stderr, 98 "The PSA RNG does not support reproducible mode.\n"); 99 return -1; 100 } 101 return 0; 102 #else /* !MBEDTLS_TEST_USE_PSA_CRYPTO_RNG */ 103 int (*f_entropy)(void *, unsigned char *, size_t) = 104 (reproducible ? dummy_entropy : mbedtls_entropy_func); 105 106 if (reproducible) { 107 srand(1); 108 } 109 110 #if defined(MBEDTLS_CTR_DRBG_C) 111 int ret = mbedtls_ctr_drbg_seed(&rng->drbg, 112 f_entropy, &rng->entropy, 113 (const unsigned char *) pers, 114 strlen(pers)); 115 #elif defined(MBEDTLS_HMAC_DRBG_C) 116 #if defined(MBEDTLS_MD_CAN_SHA256) 117 const mbedtls_md_type_t md_type = MBEDTLS_MD_SHA256; 118 #elif defined(MBEDTLS_MD_CAN_SHA512) 119 const mbedtls_md_type_t md_type = MBEDTLS_MD_SHA512; 120 #else 121 #error "No message digest available for HMAC_DRBG" 122 #endif 123 int ret = mbedtls_hmac_drbg_seed(&rng->drbg, 124 mbedtls_md_info_from_type(md_type), 125 f_entropy, &rng->entropy, 126 (const unsigned char *) pers, 127 strlen(pers)); 128 #else /* !defined(MBEDTLS_CTR_DRBG_C) && !defined(MBEDTLS_HMAC_DRBG_C) */ 129 #error "No DRBG available" 130 #endif /* !defined(MBEDTLS_CTR_DRBG_C) && !defined(MBEDTLS_HMAC_DRBG_C) */ 131 132 if (ret != 0) { 133 mbedtls_printf(" failed\n ! mbedtls_ctr_drbg_seed returned -0x%x\n", 134 (unsigned int) -ret); 135 return ret; 136 } 137 #endif /* !MBEDTLS_TEST_USE_PSA_CRYPTO_RNG */ 138 139 return 0; 140 } 141 142 void rng_free(rng_context_t *rng) 143 { 144 #if defined(MBEDTLS_TEST_USE_PSA_CRYPTO_RNG) 145 (void) rng; 146 /* Deinitialize the PSA crypto subsystem. This deactivates all PSA APIs. 147 * This is ok because none of our applications try to do any crypto after 148 * deinitializing the RNG. */ 149 mbedtls_psa_crypto_free(); 150 #else /* !MBEDTLS_TEST_USE_PSA_CRYPTO_RNG */ 151 152 #if defined(MBEDTLS_CTR_DRBG_C) 153 mbedtls_ctr_drbg_free(&rng->drbg); 154 #elif defined(MBEDTLS_HMAC_DRBG_C) 155 mbedtls_hmac_drbg_free(&rng->drbg); 156 #else 157 #error "No DRBG available" 158 #endif 159 160 mbedtls_entropy_free(&rng->entropy); 161 #endif /* !MBEDTLS_TEST_USE_PSA_CRYPTO_RNG */ 162 } 163 164 int rng_get(void *p_rng, unsigned char *output, size_t output_len) 165 { 166 #if defined(MBEDTLS_TEST_USE_PSA_CRYPTO_RNG) 167 (void) p_rng; 168 return mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, 169 output, output_len); 170 #else /* !MBEDTLS_TEST_USE_PSA_CRYPTO_RNG */ 171 rng_context_t *rng = p_rng; 172 173 #if defined(MBEDTLS_CTR_DRBG_C) 174 return mbedtls_ctr_drbg_random(&rng->drbg, output, output_len); 175 #elif defined(MBEDTLS_HMAC_DRBG_C) 176 return mbedtls_hmac_drbg_random(&rng->drbg, output, output_len); 177 #else 178 #error "No DRBG available" 179 #endif 180 181 #endif /* !MBEDTLS_TEST_USE_PSA_CRYPTO_RNG */ 182 } 183 184 int key_opaque_alg_parse(const char *arg, const char **alg1, const char **alg2) 185 { 186 char *separator; 187 if ((separator = strchr(arg, ',')) == NULL) { 188 return 1; 189 } 190 *separator = '\0'; 191 192 *alg1 = arg; 193 *alg2 = separator + 1; 194 195 if (strcmp(*alg1, "rsa-sign-pkcs1") != 0 && 196 strcmp(*alg1, "rsa-sign-pss") != 0 && 197 strcmp(*alg1, "rsa-sign-pss-sha256") != 0 && 198 strcmp(*alg1, "rsa-sign-pss-sha384") != 0 && 199 strcmp(*alg1, "rsa-sign-pss-sha512") != 0 && 200 strcmp(*alg1, "rsa-decrypt") != 0 && 201 strcmp(*alg1, "ecdsa-sign") != 0 && 202 strcmp(*alg1, "ecdh") != 0) { 203 return 1; 204 } 205 206 if (strcmp(*alg2, "rsa-sign-pkcs1") != 0 && 207 strcmp(*alg2, "rsa-sign-pss") != 0 && 208 strcmp(*alg1, "rsa-sign-pss-sha256") != 0 && 209 strcmp(*alg1, "rsa-sign-pss-sha384") != 0 && 210 strcmp(*alg1, "rsa-sign-pss-sha512") != 0 && 211 strcmp(*alg2, "rsa-decrypt") != 0 && 212 strcmp(*alg2, "ecdsa-sign") != 0 && 213 strcmp(*alg2, "ecdh") != 0 && 214 strcmp(*alg2, "none") != 0) { 215 return 1; 216 } 217 218 return 0; 219 } 220 221 #if defined(MBEDTLS_USE_PSA_CRYPTO) 222 int key_opaque_set_alg_usage(const char *alg1, const char *alg2, 223 psa_algorithm_t *psa_alg1, 224 psa_algorithm_t *psa_alg2, 225 psa_key_usage_t *usage, 226 mbedtls_pk_type_t key_type) 227 { 228 if (strcmp(alg1, "none") != 0) { 229 const char *algs[] = { alg1, alg2 }; 230 psa_algorithm_t *psa_algs[] = { psa_alg1, psa_alg2 }; 231 232 for (int i = 0; i < 2; i++) { 233 if (strcmp(algs[i], "rsa-sign-pkcs1") == 0) { 234 *psa_algs[i] = PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH); 235 *usage |= PSA_KEY_USAGE_SIGN_HASH; 236 } else if (strcmp(algs[i], "rsa-sign-pss") == 0) { 237 *psa_algs[i] = PSA_ALG_RSA_PSS(PSA_ALG_ANY_HASH); 238 *usage |= PSA_KEY_USAGE_SIGN_HASH; 239 } else if (strcmp(algs[i], "rsa-sign-pss-sha256") == 0) { 240 *psa_algs[i] = PSA_ALG_RSA_PSS(PSA_ALG_SHA_256); 241 *usage |= PSA_KEY_USAGE_SIGN_HASH; 242 } else if (strcmp(algs[i], "rsa-sign-pss-sha384") == 0) { 243 *psa_algs[i] = PSA_ALG_RSA_PSS(PSA_ALG_SHA_384); 244 *usage |= PSA_KEY_USAGE_SIGN_HASH; 245 } else if (strcmp(algs[i], "rsa-sign-pss-sha512") == 0) { 246 *psa_algs[i] = PSA_ALG_RSA_PSS(PSA_ALG_SHA_512); 247 *usage |= PSA_KEY_USAGE_SIGN_HASH; 248 } else if (strcmp(algs[i], "rsa-decrypt") == 0) { 249 *psa_algs[i] = PSA_ALG_RSA_PKCS1V15_CRYPT; 250 *usage |= PSA_KEY_USAGE_DECRYPT; 251 } else if (strcmp(algs[i], "ecdsa-sign") == 0) { 252 *psa_algs[i] = PSA_ALG_ECDSA(PSA_ALG_ANY_HASH); 253 *usage |= PSA_KEY_USAGE_SIGN_HASH; 254 } else if (strcmp(algs[i], "ecdh") == 0) { 255 *psa_algs[i] = PSA_ALG_ECDH; 256 *usage |= PSA_KEY_USAGE_DERIVE; 257 } else if (strcmp(algs[i], "none") == 0) { 258 *psa_algs[i] = PSA_ALG_NONE; 259 } 260 } 261 } else { 262 if (key_type == MBEDTLS_PK_ECKEY) { 263 *psa_alg1 = PSA_ALG_ECDSA(PSA_ALG_ANY_HASH); 264 *psa_alg2 = PSA_ALG_ECDH; 265 *usage = PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_DERIVE; 266 } else if (key_type == MBEDTLS_PK_RSA) { 267 *psa_alg1 = PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH); 268 *psa_alg2 = PSA_ALG_RSA_PSS(PSA_ALG_ANY_HASH); 269 *usage = PSA_KEY_USAGE_SIGN_HASH; 270 } else { 271 return 1; 272 } 273 } 274 275 return 0; 276 } 277 278 #if defined(MBEDTLS_PK_C) 279 int pk_wrap_as_opaque(mbedtls_pk_context *pk, psa_algorithm_t psa_alg, psa_algorithm_t psa_alg2, 280 psa_key_usage_t psa_usage, mbedtls_svc_key_id_t *key_id) 281 { 282 int ret; 283 psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT; 284 285 ret = mbedtls_pk_get_psa_attributes(pk, PSA_KEY_USAGE_SIGN_HASH, &key_attr); 286 if (ret != 0) { 287 return ret; 288 } 289 psa_set_key_usage_flags(&key_attr, psa_usage); 290 psa_set_key_algorithm(&key_attr, psa_alg); 291 if (psa_alg2 != PSA_ALG_NONE) { 292 psa_set_key_enrollment_algorithm(&key_attr, psa_alg2); 293 } 294 ret = mbedtls_pk_import_into_psa(pk, &key_attr, key_id); 295 if (ret != 0) { 296 return ret; 297 } 298 mbedtls_pk_free(pk); 299 mbedtls_pk_init(pk); 300 ret = mbedtls_pk_setup_opaque(pk, *key_id); 301 if (ret != 0) { 302 return ret; 303 } 304 305 return 0; 306 } 307 #endif /* MBEDTLS_PK_C */ 308 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 309 310 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) 311 int ca_callback(void *data, mbedtls_x509_crt const *child, 312 mbedtls_x509_crt **candidates) 313 { 314 int ret = 0; 315 mbedtls_x509_crt *ca = (mbedtls_x509_crt *) data; 316 mbedtls_x509_crt *first; 317 318 /* This is a test-only implementation of the CA callback 319 * which always returns the entire list of trusted certificates. 320 * Production implementations managing a large number of CAs 321 * should use an efficient presentation and lookup for the 322 * set of trusted certificates (such as a hashtable) and only 323 * return those trusted certificates which satisfy basic 324 * parental checks, such as the matching of child `Issuer` 325 * and parent `Subject` field or matching key identifiers. */ 326 ((void) child); 327 328 first = mbedtls_calloc(1, sizeof(mbedtls_x509_crt)); 329 if (first == NULL) { 330 ret = -1; 331 goto exit; 332 } 333 mbedtls_x509_crt_init(first); 334 335 if (mbedtls_x509_crt_parse_der(first, ca->raw.p, ca->raw.len) != 0) { 336 ret = -1; 337 goto exit; 338 } 339 340 while (ca->next != NULL) { 341 ca = ca->next; 342 if (mbedtls_x509_crt_parse_der(first, ca->raw.p, ca->raw.len) != 0) { 343 ret = -1; 344 goto exit; 345 } 346 } 347 348 exit: 349 350 if (ret != 0) { 351 mbedtls_x509_crt_free(first); 352 mbedtls_free(first); 353 first = NULL; 354 } 355 356 *candidates = first; 357 return ret; 358 } 359 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ 360 361 int delayed_recv(void *ctx, unsigned char *buf, size_t len) 362 { 363 static int first_try = 1; 364 int ret; 365 366 if (first_try) { 367 first_try = 0; 368 return MBEDTLS_ERR_SSL_WANT_READ; 369 } 370 371 ret = mbedtls_net_recv(ctx, buf, len); 372 if (ret != MBEDTLS_ERR_SSL_WANT_READ) { 373 first_try = 1; /* Next call will be a new operation */ 374 } 375 return ret; 376 } 377 378 int delayed_send(void *ctx, const unsigned char *buf, size_t len) 379 { 380 static int first_try = 1; 381 int ret; 382 383 if (first_try) { 384 first_try = 0; 385 return MBEDTLS_ERR_SSL_WANT_WRITE; 386 } 387 388 ret = mbedtls_net_send(ctx, buf, len); 389 if (ret != MBEDTLS_ERR_SSL_WANT_WRITE) { 390 first_try = 1; /* Next call will be a new operation */ 391 } 392 return ret; 393 } 394 395 #if !defined(MBEDTLS_TIMING_C) 396 int idle(mbedtls_net_context *fd, 397 int idle_reason) 398 #else 399 int idle(mbedtls_net_context *fd, 400 mbedtls_timing_delay_context *timer, 401 int idle_reason) 402 #endif 403 { 404 int ret; 405 int poll_type = 0; 406 407 if (idle_reason == MBEDTLS_ERR_SSL_WANT_WRITE) { 408 poll_type = MBEDTLS_NET_POLL_WRITE; 409 } else if (idle_reason == MBEDTLS_ERR_SSL_WANT_READ) { 410 poll_type = MBEDTLS_NET_POLL_READ; 411 } 412 #if !defined(MBEDTLS_TIMING_C) 413 else { 414 return 0; 415 } 416 #endif 417 418 while (1) { 419 /* Check if timer has expired */ 420 #if defined(MBEDTLS_TIMING_C) 421 if (timer != NULL && 422 mbedtls_timing_get_delay(timer) == 2) { 423 break; 424 } 425 #endif /* MBEDTLS_TIMING_C */ 426 427 /* Check if underlying transport became available */ 428 if (poll_type != 0) { 429 ret = mbedtls_net_poll(fd, poll_type, 0); 430 if (ret < 0) { 431 return ret; 432 } 433 if (ret == poll_type) { 434 break; 435 } 436 } 437 } 438 439 return 0; 440 } 441 442 #if defined(MBEDTLS_TEST_HOOKS) 443 444 void test_hooks_init(void) 445 { 446 mbedtls_test_info_reset(); 447 448 #if defined(MBEDTLS_TEST_MUTEX_USAGE) 449 mbedtls_test_mutex_usage_init(); 450 #endif 451 } 452 453 int test_hooks_failure_detected(void) 454 { 455 #if defined(MBEDTLS_TEST_MUTEX_USAGE) 456 /* Errors are reported via mbedtls_test_info. */ 457 mbedtls_test_mutex_usage_check(); 458 #endif 459 460 if (mbedtls_test_get_result() != MBEDTLS_TEST_RESULT_SUCCESS) { 461 return 1; 462 } 463 return 0; 464 } 465 466 void test_hooks_free(void) 467 { 468 #if defined(MBEDTLS_TEST_MUTEX_USAGE) 469 mbedtls_test_mutex_usage_end(); 470 #endif 471 } 472 473 #endif /* MBEDTLS_TEST_HOOKS */ 474 475 static const struct { 476 uint16_t tls_id; 477 const char *name; 478 uint8_t is_supported; 479 } tls_id_group_name_table[] = 480 { 481 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_521) 482 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1, "secp521r1", 1 }, 483 #else 484 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1, "secp521r1", 0 }, 485 #endif 486 #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) 487 { MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1, "brainpoolP512r1", 1 }, 488 #else 489 { MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1, "brainpoolP512r1", 0 }, 490 #endif 491 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_384) 492 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1, "secp384r1", 1 }, 493 #else 494 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1, "secp384r1", 0 }, 495 #endif 496 #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) 497 { MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1, "brainpoolP384r1", 1 }, 498 #else 499 { MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1, "brainpoolP384r1", 0 }, 500 #endif 501 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_256) 502 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, "secp256r1", 1 }, 503 #else 504 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, "secp256r1", 0 }, 505 #endif 506 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_256) 507 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1, "secp256k1", 1 }, 508 #else 509 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1, "secp256k1", 0 }, 510 #endif 511 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) 512 { MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1, "brainpoolP256r1", 1 }, 513 #else 514 { MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1, "brainpoolP256r1", 0 }, 515 #endif 516 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_224) 517 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1, "secp224r1", 1 }, 518 #else 519 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1, "secp224r1", 0 }, 520 #endif 521 #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_224) 522 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1, "secp224k1", 1 }, 523 #else 524 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1, "secp224k1", 0 }, 525 #endif 526 #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_192) 527 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1, "secp192r1", 1 }, 528 #else 529 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1, "secp192r1", 0 }, 530 #endif 531 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_192) 532 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1, "secp192k1", 1 }, 533 #else 534 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1, "secp192k1", 0 }, 535 #endif 536 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || defined(PSA_WANT_ECC_MONTGOMERY_255) 537 { MBEDTLS_SSL_IANA_TLS_GROUP_X25519, "x25519", 1 }, 538 #else 539 { MBEDTLS_SSL_IANA_TLS_GROUP_X25519, "x25519", 0 }, 540 #endif 541 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) || defined(PSA_WANT_ECC_MONTGOMERY_448) 542 { MBEDTLS_SSL_IANA_TLS_GROUP_X448, "x448", 1 }, 543 #else 544 { MBEDTLS_SSL_IANA_TLS_GROUP_X448, "x448", 0 }, 545 #endif 546 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED) && \ 547 defined(PSA_WANT_ALG_FFDH) 548 #if defined(PSA_WANT_DH_RFC7919_2048) 549 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048, "ffdhe2048", 1 }, 550 #else /* PSA_WANT_DH_RFC7919_2048 */ 551 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048, "ffdhe2048", 0 }, 552 #endif /* PSA_WANT_DH_RFC7919_2048 */ 553 #if defined(PSA_WANT_DH_RFC7919_3072) 554 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072, "ffdhe3072", 1 }, 555 #else /* PSA_WANT_DH_RFC7919_3072 */ 556 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072, "ffdhe3072", 0 }, 557 #endif /* PSA_WANT_DH_RFC7919_3072 */ 558 #if defined(PSA_WANT_DH_RFC7919_4096) 559 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096, "ffdhe4096", 1 }, 560 #else /* PSA_WANT_DH_RFC7919_4096 */ 561 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096, "ffdhe4096", 0 }, 562 #endif /* PSA_WANT_DH_RFC7919_4096 */ 563 #if defined(PSA_WANT_DH_RFC7919_6144) 564 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144, "ffdhe6144", 1 }, 565 #else /* PSA_WANT_DH_RFC7919_6144 */ 566 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144, "ffdhe6144", 0 }, 567 #endif /* PSA_WANT_DH_RFC7919_6144 */ 568 #if defined(PSA_WANT_DH_RFC7919_8192) 569 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192, "ffdhe8192", 1 }, 570 #else /* PSA_WANT_DH_RFC7919_8192 */ 571 { MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192, "ffdhe8192", 0 }, 572 #endif /* PSA_WANT_DH_RFC7919_8192 */ 573 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED && PSA_WANT_ALG_FFDH */ 574 { 0, NULL, 0 }, 575 }; 576 577 static uint16_t mbedtls_ssl_get_curve_tls_id_from_name(const char *name) 578 { 579 if (name == NULL) { 580 return 0; 581 } 582 583 for (int i = 0; tls_id_group_name_table[i].tls_id != 0; i++) { 584 if (strcmp(tls_id_group_name_table[i].name, name) == 0) { 585 return tls_id_group_name_table[i].tls_id; 586 } 587 } 588 589 return 0; 590 } 591 592 static void mbedtls_ssl_print_supported_groups_list(void) 593 { 594 for (int i = 0; tls_id_group_name_table[i].tls_id != 0; i++) { 595 if (tls_id_group_name_table[i].is_supported == 1) { 596 mbedtls_printf("%s ", tls_id_group_name_table[i].name); 597 } 598 } 599 } 600 601 int parse_groups(const char *groups, uint16_t *group_list, size_t group_list_len) 602 { 603 char *p = (char *) groups; 604 char *q = NULL; 605 size_t i = 0; 606 607 if (strcmp(p, "none") == 0) { 608 group_list[0] = 0; 609 } else if (strcmp(p, "default") != 0) { 610 /* Leave room for a final NULL in group list */ 611 while (i < group_list_len - 1 && *p != '\0') { 612 uint16_t curve_tls_id; 613 q = p; 614 615 /* Terminate the current string */ 616 while (*p != ',' && *p != '\0') { 617 p++; 618 } 619 if (*p == ',') { 620 *p++ = '\0'; 621 } 622 623 if ((curve_tls_id = mbedtls_ssl_get_curve_tls_id_from_name(q)) != 0) { 624 group_list[i++] = curve_tls_id; 625 } else { 626 mbedtls_printf("unknown group %s\n", q); 627 mbedtls_printf("supported groups: "); 628 mbedtls_ssl_print_supported_groups_list(); 629 mbedtls_printf("\n"); 630 return -1; 631 } 632 } 633 634 mbedtls_printf("Number of groups: %u\n", (unsigned int) i); 635 636 if (i == group_list_len - 1 && *p != '\0') { 637 mbedtls_printf("groups list too long, maximum %u", 638 (unsigned int) (group_list_len - 1)); 639 return -1; 640 } 641 642 group_list[i] = 0; 643 } 644 645 return 0; 646 } 647 648 #endif /* !defined(MBEDTLS_SSL_TEST_IMPOSSIBLE) */