sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-12-23 00:00:35 -05:00
Code Issues Projects Releases Wiki Activity

Store a MODP group we use for each TLS suite

Browse Source
This commit is contained in:
Martin Willi 2010-09-02 19:24:56 +02:00
parent 08d8b9405b
commit 35d9c15d5e
2 changed files with 34 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
src/libtls/tls_crypto.c
View File

@ -365,6 +365,7 @@ typedef struct {
tls_cipher_suite_t suite; tls_cipher_suite_t suite;
hash_algorithm_t hash; hash_algorithm_t hash;
pseudo_random_function_t prf; pseudo_random_function_t prf;
diffie_hellman_group_t dh;
integrity_algorithm_t mac; integrity_algorithm_t mac;
encryption_algorithm_t encr; encryption_algorithm_t encr;
size_t encr_size; size_t encr_size;
@ -375,51 +376,51 @@ typedef struct {
*/ */
static suite_algs_t suite_algs[] = { static suite_algs_t suite_algs[] = {
{ TLS_RSA_WITH_AES_128_CBC_SHA, { TLS_RSA_WITH_AES_128_CBC_SHA,
HASH_SHA1, PRF_HMAC_SHA1, HASH_SHA1, PRF_HMAC_SHA1, MODP_NONE,
AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16
}, },
{ TLS_RSA_WITH_AES_128_CBC_SHA256, { TLS_RSA_WITH_AES_128_CBC_SHA256,
HASH_SHA256, PRF_HMAC_SHA2_256, HASH_SHA256, PRF_HMAC_SHA2_256, MODP_NONE,
AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16
}, },
{ TLS_RSA_WITH_AES_256_CBC_SHA, { TLS_RSA_WITH_AES_256_CBC_SHA,
HASH_SHA1, PRF_HMAC_SHA1, HASH_SHA1, PRF_HMAC_SHA1, MODP_NONE,
AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32
}, },
{ TLS_RSA_WITH_AES_256_CBC_SHA256, { TLS_RSA_WITH_AES_256_CBC_SHA256,
HASH_SHA256, PRF_HMAC_SHA2_256, HASH_SHA256, PRF_HMAC_SHA2_256, MODP_NONE,
AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 32 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 32
}, },
{ TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
HASH_SHA1, PRF_HMAC_SHA1, HASH_SHA1, PRF_HMAC_SHA1, MODP_NONE,
AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 16 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 16
}, },
{ TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256, { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
HASH_SHA256, PRF_HMAC_SHA2_256, HASH_SHA256, PRF_HMAC_SHA2_256, MODP_NONE,
AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 16 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 16
}, },
{ TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
HASH_SHA1, PRF_HMAC_SHA1, HASH_SHA1, PRF_HMAC_SHA1, MODP_NONE,
AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 32 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 32
}, },
{ TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256, { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
HASH_SHA256, PRF_HMAC_SHA2_256, HASH_SHA256, PRF_HMAC_SHA2_256, MODP_NONE,
AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 32 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 32
}, },
{ TLS_RSA_WITH_3DES_EDE_CBC_SHA, { TLS_RSA_WITH_3DES_EDE_CBC_SHA,
HASH_SHA1, PRF_HMAC_SHA1, HASH_SHA1, PRF_HMAC_SHA1, MODP_NONE,
AUTH_HMAC_SHA1_160, ENCR_3DES, 0 AUTH_HMAC_SHA1_160, ENCR_3DES, 0
}, },
{ TLS_RSA_WITH_NULL_SHA, { TLS_RSA_WITH_NULL_SHA,
HASH_SHA1, PRF_HMAC_SHA1, HASH_SHA1, PRF_HMAC_SHA1, MODP_NONE,
AUTH_HMAC_SHA1_160, ENCR_NULL, 0 AUTH_HMAC_SHA1_160, ENCR_NULL, 0
}, },
{ TLS_RSA_WITH_NULL_SHA256, { TLS_RSA_WITH_NULL_SHA256,
HASH_SHA256, PRF_HMAC_SHA2_256, HASH_SHA256, PRF_HMAC_SHA2_256, MODP_NONE,
AUTH_HMAC_SHA2_256_256, ENCR_NULL, 0 AUTH_HMAC_SHA2_256_256, ENCR_NULL, 0
}, },
{ TLS_RSA_WITH_NULL_MD5, { TLS_RSA_WITH_NULL_MD5,
HASH_MD5, PRF_HMAC_MD5, HASH_MD5, PRF_HMAC_MD5, MODP_NONE,
AUTH_HMAC_MD5_128, ENCR_NULL, 0 AUTH_HMAC_MD5_128, ENCR_NULL, 0
}, },
}; };
@ -624,6 +625,19 @@ METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
return 0; return 0;
} }
METHOD(tls_crypto_t, get_dh_group, diffie_hellman_group_t,
private_tls_crypto_t *this)
{
suite_algs_t *algs;
algs = find_suite(this->suite);
if (algs)
{
return algs->dh;
}
return MODP_NONE;
}
METHOD(tls_crypto_t, get_signature_algorithms, void, METHOD(tls_crypto_t, get_signature_algorithms, void,
private_tls_crypto_t *this, tls_writer_t *writer) private_tls_crypto_t *this, tls_writer_t *writer)
{ {
@ -1129,6 +1143,7 @@ tls_crypto_t *tls_crypto_create(tls_t *tls)
.public = { .public = {
.get_cipher_suites = _get_cipher_suites, .get_cipher_suites = _get_cipher_suites,
.select_cipher_suite = _select_cipher_suite, .select_cipher_suite = _select_cipher_suite,
.get_dh_group = _get_dh_group,
.get_signature_algorithms = _get_signature_algorithms, .get_signature_algorithms = _get_signature_algorithms,
.set_protection = _set_protection, .set_protection = _set_protection,
.append_handshake = _append_handshake, .append_handshake = _append_handshake,

7
src/libtls/tls_crypto.h
View File

@ -328,6 +328,13 @@ struct tls_crypto_t {
tls_cipher_suite_t (*select_cipher_suite)(tls_crypto_t *this, tls_cipher_suite_t (*select_cipher_suite)(tls_crypto_t *this,
tls_cipher_suite_t *suites, int count); tls_cipher_suite_t *suites, int count);
/**
* Get the Diffie-Hellman group to use, if any.
*
* @return Diffie Hellman group, ord MODP_NONE
*/
diffie_hellman_group_t (*get_dh_group)(tls_crypto_t *this);
/** /**
* Write the list of supported hash/sig algorithms to writer. * Write the list of supported hash/sig algorithms to writer.
* *