Add the nist group names as aliases for the normal TLS group names

By recognising the nist group names directly we can avoid having to call
EC_curve_nist2nid in libssl, which is not available in a no-ec build.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13916)

diff --git a/providers/common/capabilities.c b/providers/common/capabilities.c
index f935268ab29af06ef774735aa0e53d955607b707..f708beb16de17a93ce624d90088dbb6a1d9b5f47 100644 (file)
--- a/providers/common/capabilities.c
+++ b/providers/common/capabilities.c
@@ -102,12 +102,14 @@ static const OSSL_PARAM param_group_list[][10] = {
 # ifndef OPENSSL_NO_EC
 #  ifndef OPENSSL_NO_EC2M
     TLS_GROUP_ENTRY("sect163k1", "sect163k1", "EC", 0),
+    TLS_GROUP_ENTRY("K-163", "sect163k1", "EC", 0), /* Alias of above */
 #  endif
 #  ifndef FIPS_MODULE
     TLS_GROUP_ENTRY("sect163r1", "sect163r1", "EC", 1),
 #  endif
 #  ifndef OPENSSL_NO_EC2M
     TLS_GROUP_ENTRY("sect163r2", "sect163r2", "EC", 2),
+    TLS_GROUP_ENTRY("B-163", "sect163r2", "EC", 2), /* Alias of above */
 #  endif
 #  ifndef FIPS_MODULE
     TLS_GROUP_ENTRY("sect193r1", "sect193r1", "EC", 3),
@@ -115,18 +117,26 @@ static const OSSL_PARAM param_group_list[][10] = {
 #  endif
 #  ifndef OPENSSL_NO_EC2M
     TLS_GROUP_ENTRY("sect233k1", "sect233k1", "EC", 5),
+    TLS_GROUP_ENTRY("K-233", "sect233k1", "EC", 5), /* Alias of above */
     TLS_GROUP_ENTRY("sect233r1", "sect233r1", "EC", 6),
+    TLS_GROUP_ENTRY("B-233", "sect233r1", "EC", 6), /* Alias of above */
 #  endif
 #  ifndef FIPS_MODULE
     TLS_GROUP_ENTRY("sect239k1", "sect239k1", "EC", 7),
 #  endif
 #  ifndef OPENSSL_NO_EC2M
     TLS_GROUP_ENTRY("sect283k1", "sect283k1", "EC", 8),
+    TLS_GROUP_ENTRY("K-283", "sect283k1", "EC", 8), /* Alias of above */
     TLS_GROUP_ENTRY("sect283r1", "sect283r1", "EC", 9),
+    TLS_GROUP_ENTRY("B-283", "sect283r1", "EC", 9), /* Alias of above */
     TLS_GROUP_ENTRY("sect409k1", "sect409k1", "EC", 10),
+    TLS_GROUP_ENTRY("K-409", "sect409k1", "EC", 10), /* Alias of above */
     TLS_GROUP_ENTRY("sect409r1", "sect409r1", "EC", 11),
+    TLS_GROUP_ENTRY("B-409", "sect409r1", "EC", 11), /* Alias of above */
     TLS_GROUP_ENTRY("sect571k1", "sect571k1", "EC", 12),
+    TLS_GROUP_ENTRY("K-571", "sect571k1", "EC", 12), /* Alias of above */
     TLS_GROUP_ENTRY("sect571r1", "sect571r1", "EC", 13),
+    TLS_GROUP_ENTRY("B-571", "sect571r1", "EC", 13), /* Alias of above */
 #  endif
 #  ifndef FIPS_MODULE
     TLS_GROUP_ENTRY("secp160k1", "secp160k1", "EC", 14),
@@ -135,23 +145,28 @@ static const OSSL_PARAM param_group_list[][10] = {
     TLS_GROUP_ENTRY("secp192k1", "secp192k1", "EC", 17),
 #  endif
     TLS_GROUP_ENTRY("secp192r1", "prime192v1", "EC", 18),
+    TLS_GROUP_ENTRY("P-192", "prime192v1", "EC", 18), /* Alias of above */
 #  ifndef FIPS_MODULE
     TLS_GROUP_ENTRY("secp224k1", "secp224k1", "EC", 19),
 #  endif
     TLS_GROUP_ENTRY("secp224r1", "secp224r1", "EC", 20),
+    TLS_GROUP_ENTRY("P-224", "secp224r1", "EC", 20), /* Alias of above */
 #  ifndef FIPS_MODULE
     TLS_GROUP_ENTRY("secp256k1", "secp256k1", "EC", 21),
 #  endif
     TLS_GROUP_ENTRY("secp256r1", "prime256v1", "EC", 22),
+    TLS_GROUP_ENTRY("P-256", "prime256v1", "EC", 22), /* Alias of above */
     TLS_GROUP_ENTRY("secp384r1", "secp384r1", "EC", 23),
+    TLS_GROUP_ENTRY("P-384", "secp384r1", "EC", 23), /* Alias of above */
     TLS_GROUP_ENTRY("secp521r1", "secp521r1", "EC", 24),
+    TLS_GROUP_ENTRY("P-521", "secp521r1", "EC", 24), /* Alias of above */
 #  ifndef FIPS_MODULE
     TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25),
     TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26),
     TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27),
 #  endif
-    TLS_GROUP_ENTRY("x25519", "x25519", "X25519", 28),
-    TLS_GROUP_ENTRY("x448", "x448", "X448", 29),
+    TLS_GROUP_ENTRY("x25519", "X25519", "X25519", 28),
+    TLS_GROUP_ENTRY("x448", "X448", "X448", 29),
 # endif /* OPENSSL_NO_EC */
 # ifndef OPENSSL_NO_DH
     /* Security bit values for FFDHE groups are as per RFC 7919 */
@@ -169,13 +184,6 @@ static int tls_group_capability(OSSL_CALLBACK *cb, void *arg)
 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
     size_t i;
 
-# if !defined(OPENSSL_NO_EC) \
-    && !defined(OPENSSL_NO_EC2M) \
-    && !defined(OPENSSL_NO_DH) \
-    && !defined(FIPS_MODULE)
-    assert(OSSL_NELEM(param_group_list) == OSSL_NELEM(group_list));
-# endif
-
     for (i = 0; i < OSSL_NELEM(param_group_list); i++)
         if (!cb(param_group_list[i], arg))
             return 0;

diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c
index 2e8240c73b820ce6e2b7c1574976219bfa1d7383..09e2ee2e3ef696d0db8784469357e42b1707e72f 100644 (file)
--- a/ssl/ssl_conf.c
+++ b/ssl/ssl_conf.c
@@ -226,7 +226,6 @@ static int cmd_Curves(SSL_CONF_CTX *cctx, const char *value)
 static int cmd_ECDHParameters(SSL_CONF_CTX *cctx, const char *value)
 {
     int rv = 1;
-    int nid;
 
     /* Ignore values supported by 1.0.2 for the automatic selection */
     if ((cctx->flags & SSL_CONF_FLAG_FILE)

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 6bc33215c1260c45b0206df1a7b71373c1d83235..571a1ec2c46207c1ee513e84fc33b80e27bcb377 100644 (file)
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -440,10 +440,7 @@ static uint16_t tls1_group_name2id(SSL_CTX *ctx, const char *name)
 
     for (i = 0; i < ctx->group_list_len; i++) {
         if (strcmp(ctx->group_list[i].tlsname, name) == 0
-                || (nid != NID_undef
-                    && nid == tls1_group_id2nid(ctx->group_list[i].group_id,
-                                                0))
-           )
+                || strcmp(ctx->group_list[i].realname, name) == 0)
             return ctx->group_list[i].group_id;
     }