denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename diffie_hellman_t to key_exchange_t and change the interface etc.

Browse Source 
This makes it more generic so we can use it for QSKE methods.
This commit is contained in:
Tobias Brunner
2022-06-29 10:28:50 +02:00
parent ec95fd9b93
commit 3af7c6db87
130 changed files with 1379 additions and 1384 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tests/suites/test_socket.c
+2 -2
View File
@@ -581,7 +581,7 @@ static void test_tls(tls_version_t version, uint16_t port, bool cauth, u_int i)
static void test_tls_ke_groups(tls_version_t version, uint16_t port, bool cauth,
u_int i)
{
diffie_hellman_group_t *groups;
key_exchange_method_t *groups;
char curve[128];
int count;
@@ -591,7 +591,7 @@ static void test_tls_ke_groups(tls_version_t version, uint16_t port, bool cauth,
count = tls_crypto_get_supported_groups(&groups);
ck_assert(i < count);
snprintf(curve, sizeof(curve), "%N", diffie_hellman_group_names_short,
snprintf(curve, sizeof(curve), "%N", key_exchange_method_names_short,
groups[i]);
lib->settings->set_str(lib->settings, "%s.tls.ke_group", curve, lib->ns);
src/libtls/tls_crypto.c
+23 -23
View File
@@ -481,7 +481,7 @@ struct private_tls_crypto_t {
typedef struct {
tls_cipher_suite_t suite;
key_type_t key;
diffie_hellman_group_t dh;
key_exchange_method_t dh;
hash_algorithm_t hash;
pseudo_random_function_t prf;
integrity_algorithm_t mac;
@@ -837,8 +837,8 @@ static void filter_suite(suite_algs_t suites[], int *count, int offset,
if (current.dh && current.dh != suites[i].dh)
{
if (suites[i].dh != MODP_NONE &&
!(diffie_hellman_group_is_ec(current.dh) &&
diffie_hellman_group_is_ec(suites[i].dh)))
!(key_exchange_is_ecdh(current.dh) &&
key_exchange_is_ecdh(suites[i].dh)))
{ /* skip DH group, does not match nor NONE nor both ECDH */
continue;
}
@@ -911,21 +911,21 @@ static void filter_key_exchange_config_suites(private_tls_crypto_t *this,
while (enumerator->enumerate(enumerator, &token))
{
if (strcaseeq(token, "ecdhe-ecdsa") &&
diffie_hellman_group_is_ec(suites[i].dh) &&
key_exchange_is_ecdh(suites[i].dh) &&
suites[i].key == KEY_ECDSA)
{
suites[remaining++] = suites[i];
break;
}
if (strcaseeq(token, "ecdhe-rsa") &&
diffie_hellman_group_is_ec(suites[i].dh) &&
key_exchange_is_ecdh(suites[i].dh) &&
suites[i].key == KEY_RSA)
{
suites[remaining++] = suites[i];
break;
}
if (strcaseeq(token, "dhe-rsa") &&
!diffie_hellman_group_is_ec(suites[i].dh) &&
!key_exchange_is_ecdh(suites[i].dh) &&
suites[i].dh != MODP_NONE &&
suites[i].key == KEY_RSA)
{
@@ -1076,7 +1076,7 @@ static bool filter_curve_config(tls_named_group_t curve)
const proposal_token_t *tok;
tok = lib->proposal->get_token(lib->proposal, token);
if (tok != NULL && tok->type == DIFFIE_HELLMAN_GROUP &&
if (tok != NULL && tok->type == KEY_EXCHANGE_METHOD &&
curve == tls_ec_group_to_curve(tok->algorithm))
{
enumerator->destroy(enumerator);
@@ -1105,7 +1105,7 @@ static void filter_unsupported_suites(suite_algs_t suites[], int *count)
filter_suite(suites, count, offsetof(suite_algs_t, hash),
lib->crypto->create_hasher_enumerator);
filter_suite(suites, count, offsetof(suite_algs_t, dh),
lib->crypto->create_dh_enumerator);
lib->crypto->create_ke_enumerator);
}
/**
@@ -1526,7 +1526,7 @@ static signature_params_t *params_for_scheme(tls_signature_scheme_t sig,
* Mapping groups to TLS named curves
*/
static struct {
diffie_hellman_group_t group;
key_exchange_method_t group;
tls_named_group_t curve;
} curves[] = {
{ ECP_256_BIT, TLS_SECP256R1},
@@ -1541,7 +1541,7 @@ static struct {
CALLBACK(group_filter, bool,
void *null, enumerator_t *orig, va_list args)
{
diffie_hellman_group_t group, *group_out;
key_exchange_method_t group, *group_out;
tls_named_group_t curve, *curve_out;
char *plugin;
@@ -1569,7 +1569,7 @@ CALLBACK(group_filter, bool,
CALLBACK(config_filter, bool,
void *null, enumerator_t *orig, va_list args)
{
diffie_hellman_group_t group, *group_out;
key_exchange_method_t group, *group_out;
tls_named_group_t curve, *curve_out;
VA_ARGS_VGET(args, group_out, curve_out);
@@ -1598,7 +1598,7 @@ METHOD(tls_crypto_t, create_ec_enumerator, enumerator_t*,
{
return enumerator_create_filter(
enumerator_create_filter(
lib->crypto->create_dh_enumerator(lib->crypto),
lib->crypto->create_ke_enumerator(lib->crypto),
group_filter, NULL, NULL),
config_filter, NULL, NULL);
}
@@ -1607,10 +1607,10 @@ METHOD(tls_crypto_t, create_ec_enumerator, enumerator_t*,
* Check if the given ECDH group is supported or return the first one we
* actually do support.
*/
static diffie_hellman_group_t supported_ec_group(private_tls_crypto_t *this,
diffie_hellman_group_t orig)
static key_exchange_method_t supported_ec_group(private_tls_crypto_t *this,
key_exchange_method_t orig)
{
diffie_hellman_group_t current, first = MODP_NONE;
key_exchange_method_t current, first = MODP_NONE;
enumerator_t *enumerator;
enumerator = create_ec_enumerator(this);
@@ -1630,7 +1630,7 @@ static diffie_hellman_group_t supported_ec_group(private_tls_crypto_t *this,
return first;
}
METHOD(tls_crypto_t, get_dh_group, diffie_hellman_group_t,
METHOD(tls_crypto_t, get_dh_group, key_exchange_method_t,
private_tls_crypto_t *this)
{
suite_algs_t *algs;
@@ -1638,7 +1638,7 @@ METHOD(tls_crypto_t, get_dh_group, diffie_hellman_group_t,
algs = find_suite(this->suite);
if (algs)
{
if (diffie_hellman_group_is_ec(algs->dh))
if (key_exchange_is_ecdh(algs->dh))
{
return supported_ec_group(this, algs->dh);
}
@@ -2494,16 +2494,16 @@ int tls_crypto_get_supported_suites(bool null, tls_version_t version,
/**
* See header.
*/
int tls_crypto_get_supported_groups(diffie_hellman_group_t **out)
int tls_crypto_get_supported_groups(key_exchange_method_t **out)
{
enumerator_t *enumerator;
diffie_hellman_group_t groups[countof(curves)];
diffie_hellman_group_t group;
key_exchange_method_t groups[countof(curves)];
key_exchange_method_t group;
tls_named_group_t curve;
int count = 0, i;
enumerator = enumerator_create_filter(
lib->crypto->create_dh_enumerator(lib->crypto),
lib->crypto->create_ke_enumerator(lib->crypto),
group_filter, NULL, NULL);
while (enumerator->enumerate(enumerator, &group, &curve))
@@ -2514,7 +2514,7 @@ int tls_crypto_get_supported_groups(diffie_hellman_group_t **out)
if (out)
{
*out = calloc(count, sizeof(diffie_hellman_group_t));
*out = calloc(count, sizeof(key_exchange_method_t));
for (i = 0; i < count; i++)
{
(*out)[i] = groups[i];
@@ -2565,7 +2565,7 @@ int tls_crypto_get_supported_signatures(tls_version_t version,
/**
* See header.
*/
tls_named_group_t tls_ec_group_to_curve(diffie_hellman_group_t group)
tls_named_group_t tls_ec_group_to_curve(key_exchange_method_t group)
{
int i;
src/libtls/tls_crypto.h
+5 -5
View File
@@ -464,9 +464,9 @@ struct tls_crypto_t {
/**
* Get the Diffie-Hellman group to use, if any.
*
* @return Diffie Hellman group, ord MODP_NONE
* @return Diffie-Hellman group, or MODP_NONE
*/
diffie_hellman_group_t (*get_dh_group)(tls_crypto_t *this);
key_exchange_method_t (*get_dh_group)(tls_crypto_t *this);
/**
* Write the list of supported signature schemes, either for certificates
@@ -481,7 +481,7 @@ struct tls_crypto_t {
/**
* Create an enumerator over supported ECDH groups.
*
* Enumerates over (diffie_hellman_group_t, tls_named_group_t)
* Enumerates over (key_exchange_method_t, tls_named_group_t)
*
* @return enumerator
*/
@@ -680,7 +680,7 @@ int tls_crypto_get_supported_suites(bool null, tls_version_t version,
* @param groups pointer to allocated DH group array, to free(), or NULL
* @return number of curves supported
*/
int tls_crypto_get_supported_groups(diffie_hellman_group_t **groups);
int tls_crypto_get_supported_groups(key_exchange_method_t **groups);
/**
* Get a list of all supported TLS signature schemes.
@@ -698,7 +698,7 @@ int tls_crypto_get_supported_signatures(tls_version_t version,
* @param group diffie hellman group indicator
* @return TLS group indicator
*/
tls_named_group_t tls_ec_group_to_curve(diffie_hellman_group_t group);
tls_named_group_t tls_ec_group_to_curve(key_exchange_method_t group);
/**
* Get the key type from a TLS signature scheme
src/libtls/tls_peer.c
+20 -20
View File
@@ -123,7 +123,7 @@ struct private_tls_peer_t {
/**
* DHE exchange
*/
diffie_hellman_t *dh;
key_exchange_t *dh;
/**
* Requested DH group
@@ -162,7 +162,7 @@ struct private_tls_peer_t {
};
/* Implemented in tls_server.c */
bool tls_write_key_share(bio_writer_t **key_share, diffie_hellman_t *dh);
bool tls_write_key_share(bio_writer_t **key_share, key_exchange_t *dh);
public_key_t *tls_find_public_key(auth_cfg_t *peer_auth, identification_t *id);
/**
@@ -172,7 +172,7 @@ static bool verify_requested_key_type(private_tls_peer_t *this,
uint16_t key_type)
{
enumerator_t *enumerator;
diffie_hellman_group_t group, found = MODP_NONE;
key_exchange_method_t group, found = MODP_NONE;
tls_named_group_t curve;
enumerator = this->crypto->create_ec_enumerator(this->crypto);
@@ -191,7 +191,7 @@ static bool verify_requested_key_type(private_tls_peer_t *this,
DBG1(DBG_TLS, "server requested key exchange we didn't propose");
return FALSE;
}
if (this->dh->get_dh_group(this->dh) == found)
if (this->dh->get_method(this->dh) == found)
{
DBG1(DBG_TLS, "server requested key exchange we already use");
return FALSE;
@@ -426,7 +426,7 @@ static status_t process_server_hello(private_tls_peer_t *this,
key_share = chunk_skip(key_share, 1);
}
if (!key_share.len ||
!this->dh->set_other_public_value(this->dh, key_share) ||
!this->dh->set_public_key(this->dh, key_share) ||
!this->dh->get_shared_secret(this->dh, &shared_secret) ||
!this->crypto->derive_handshake_keys(this->crypto, shared_secret))
{
@@ -676,7 +676,7 @@ static status_t process_modp_key_exchange(private_tls_peer_t *this,
public->destroy(public);
free(chunk.ptr);
this->dh = lib->crypto->create_dh(lib->crypto, MODP_CUSTOM,
this->dh = lib->crypto->create_ke(lib->crypto, MODP_CUSTOM,
generator, prime);
if (!this->dh)
{
@@ -684,7 +684,7 @@ static status_t process_modp_key_exchange(private_tls_peer_t *this,
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
}
if (!this->dh->set_other_public_value(this->dh, pub))
if (!this->dh->set_public_key(this->dh, pub))
{
DBG1(DBG_TLS, "applying DH public value failed");
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
@@ -698,10 +698,10 @@ static status_t process_modp_key_exchange(private_tls_peer_t *this,
/**
* Get the EC group for a TLS named curve
*/
static diffie_hellman_group_t curve_to_ec_group(private_tls_peer_t *this,
tls_named_group_t curve)
static key_exchange_method_t curve_to_ec_group(private_tls_peer_t *this,
tls_named_group_t curve)
{
diffie_hellman_group_t group;
key_exchange_method_t group;
tls_named_group_t current;
enumerator_t *enumerator;
@@ -724,7 +724,7 @@ static diffie_hellman_group_t curve_to_ec_group(private_tls_peer_t *this,
static status_t process_ec_key_exchange(private_tls_peer_t *this,
bio_reader_t *reader)
{
diffie_hellman_group_t group;
key_exchange_method_t group;
public_key_t *public;
uint8_t type;
uint16_t curve;
@@ -783,11 +783,11 @@ static status_t process_ec_key_exchange(private_tls_peer_t *this,
public->destroy(public);
free(chunk.ptr);
this->dh = lib->crypto->create_dh(lib->crypto, group);
this->dh = lib->crypto->create_ke(lib->crypto, group);
if (!this->dh)
{
DBG1(DBG_TLS, "DH group %N not supported",
diffie_hellman_group_names, group);
key_exchange_method_names, group);
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
}
@@ -805,7 +805,7 @@ static status_t process_ec_key_exchange(private_tls_peer_t *this,
pub = chunk_skip(pub, 1);
}
if (!this->dh->set_other_public_value(this->dh, pub))
if (!this->dh->set_public_key(this->dh, pub))
{
DBG1(DBG_TLS, "applying DH public value failed");
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
@@ -822,7 +822,7 @@ static status_t process_ec_key_exchange(private_tls_peer_t *this,
static status_t process_key_exchange(private_tls_peer_t *this,
bio_reader_t *reader)
{
diffie_hellman_group_t group;
key_exchange_method_t group;
this->crypto->append_handshake(this->crypto,
TLS_SERVER_KEY_EXCHANGE, reader->peek(reader));
@@ -835,7 +835,7 @@ static status_t process_key_exchange(private_tls_peer_t *this,
this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
return NEED_MORE;
}
if (diffie_hellman_group_is_ec(group))
if (key_exchange_is_ecdh(group))
{
return process_ec_key_exchange(this, reader);
}
@@ -1248,7 +1248,7 @@ static status_t send_client_hello(private_tls_peer_t *this,
tls_cipher_suite_t *suites;
bio_writer_t *extensions, *curves = NULL, *versions, *key_share, *signatures;
tls_version_t version_max, version_min;
diffie_hellman_group_t group;
key_exchange_method_t group;
tls_named_group_t curve;
enumerator_t *enumerator;
int count, i, v;
@@ -1336,7 +1336,7 @@ static status_t send_client_hello(private_tls_peer_t *this,
}
if (!this->dh)
{
this->dh = lib->crypto->create_dh(lib->crypto, group);
this->dh = lib->crypto->create_ke(lib->crypto, group);
if (!this->dh)
{
continue;
@@ -1636,12 +1636,12 @@ static status_t send_key_exchange_dhe(private_tls_peer_t *this,
}
chunk_clear(&premaster);
if (!this->dh->get_my_public_value(this->dh, &pub))
if (!this->dh->get_public_key(this->dh, &pub))
{
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
}
switch (this->dh->get_dh_group(this->dh))
switch (this->dh->get_method(this->dh))
{
case MODP_CUSTOM:
writer->write_data16(writer, pub);
src/libtls/tls_server.c
+19 -19
View File
@@ -121,7 +121,7 @@ struct private_tls_server_t {
/**
* DHE exchange
*/
diffie_hellman_t *dh;
key_exchange_t *dh;
/**
* Requested DH group
@@ -571,7 +571,7 @@ static status_t process_client_hello(private_tls_server_t *this,
if (this->tls->get_version_max(this->tls) >= TLS_1_3)
{
diffie_hellman_group_t group;
key_exchange_method_t group;
tls_named_group_t curve, requesting_curve = 0;
enumerator_t *enumerator;
array_t *peer_key_shares;
@@ -609,7 +609,7 @@ static status_t process_client_hello(private_tls_server_t *this,
{
DBG1(DBG_TLS, "using key exchange %N",
tls_named_group_names, curve);
this->dh = lib->crypto->create_dh(lib->crypto, group);
this->dh = lib->crypto->create_ke(lib->crypto, group);
break;
}
}
@@ -656,7 +656,7 @@ static status_t process_client_hello(private_tls_server_t *this,
peer.key_share = chunk_skip(peer.key_share, 1);
}
if (!peer.key_share.len ||
!this->dh->set_other_public_value(this->dh, peer.key_share))
!this->dh->set_public_key(this->dh, peer.key_share))
{
DBG1(DBG_TLS, "DH key derivation failed");
this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
@@ -844,14 +844,14 @@ static status_t process_key_exchange_dhe(private_tls_server_t *this,
bio_reader_t *reader)
{
chunk_t premaster, pub;
diffie_hellman_group_t group;
key_exchange_method_t group;
bool ec;
this->crypto->append_handshake(this->crypto,
TLS_CLIENT_KEY_EXCHANGE, reader->peek(reader));
group = this->dh->get_dh_group(this->dh);
ec = diffie_hellman_group_is_ec(group);
group = this->dh->get_method(this->dh);
ec = key_exchange_is_ecdh(group);
if ((ec && !reader->read_data8(reader, &pub)) ||
(!ec && (!reader->read_data16(reader, &pub) || pub.len == 0)))
{
@@ -873,7 +873,7 @@ static status_t process_key_exchange_dhe(private_tls_server_t *this,
}
pub = chunk_skip(pub, 1);
}
if (!this->dh->set_other_public_value(this->dh, pub))
if (!this->dh->set_public_key(this->dh, pub))
{
DBG1(DBG_TLS, "applying DH public value failed");
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
@@ -1154,7 +1154,7 @@ METHOD(tls_handshake_t, process, status_t,
/**
* Write public key into key share extension
*/
bool tls_write_key_share(bio_writer_t **key_share, diffie_hellman_t *dh)
bool tls_write_key_share(bio_writer_t **key_share, key_exchange_t *dh)
{
bio_writer_t *writer;
tls_named_group_t curve;
@@ -1164,8 +1164,8 @@ bool tls_write_key_share(bio_writer_t **key_share, diffie_hellman_t *dh)
{
return FALSE;
}
curve = tls_ec_group_to_curve(dh->get_dh_group(dh));
if (!curve || !dh->get_my_public_value(dh, &pub))
curve = tls_ec_group_to_curve(dh->get_method(dh));
if (!curve || !dh->get_public_key(dh, &pub))
{
return FALSE;
}
@@ -1496,13 +1496,13 @@ static bool find_supported_curve(private_tls_server_t *this,
*/
static status_t send_server_key_exchange(private_tls_server_t *this,
tls_handshake_type_t *type, bio_writer_t *writer,
diffie_hellman_group_t group)
key_exchange_method_t group)
{
diffie_hellman_params_t *params = NULL;
tls_named_group_t curve;
chunk_t chunk;
if (diffie_hellman_group_is_ec(group))
if (key_exchange_is_ecdh(group))
{
curve = tls_ec_group_to_curve(group);
if (!curve || (!peer_supports_curve(this, curve) &&
@@ -1522,23 +1522,23 @@ static status_t send_server_key_exchange(private_tls_server_t *this,
if (!params)
{
DBG1(DBG_TLS, "no parameters found for DH group %N",
diffie_hellman_group_names, group);
key_exchange_method_names, group);
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
}
DBG2(DBG_TLS, "selected DH group %N", diffie_hellman_group_names, group);
DBG2(DBG_TLS, "selected DH group %N", key_exchange_method_names, group);
writer->write_data16(writer, params->prime);
writer->write_data16(writer, params->generator);
}
this->dh = lib->crypto->create_dh(lib->crypto, group);
this->dh = lib->crypto->create_ke(lib->crypto, group);
if (!this->dh)
{
DBG1(DBG_TLS, "DH group %N not supported",
diffie_hellman_group_names, group);
key_exchange_method_names, group);
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
}
if (!this->dh->get_my_public_value(this->dh, &chunk))
if (!this->dh->get_public_key(this->dh, &chunk))
{
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
@@ -1649,7 +1649,7 @@ static status_t send_key_update(private_tls_server_t *this,
METHOD(tls_handshake_t, build, status_t,
private_tls_server_t *this, tls_handshake_type_t *type, bio_writer_t *writer)
{
diffie_hellman_group_t group;
key_exchange_method_t group;
if (this->tls->get_version_max(this->tls) < TLS_1_3)
{