Skip to content

Commit 717ea6a

Browse files
ejohnstownejohnstown
committed
Separate the ECC disable into ECDSA and ECDHE disables.
1 parent 92fcd08 commit 717ea6a

4 files changed

Lines changed: 41 additions & 33 deletions

File tree

‎src/internal.c‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,10 @@
119119
Set when all DH algorithms are disabled. Set to disable use of all DH
120120
algorithms for key agreement. Setting this will force all DH key agreement
121121
algorithms off.
122+
WOLFSSH_NO_ECDH
123+
Set when all ECDH algorithms are disabled. Set to disable use of all ECDH
124+
algorithms for key agreement. Setting this will force all ECDH key agreement
125+
algorithms off.
122126
*/
123127

124128

@@ -2234,29 +2238,19 @@ static INLINE int wcPrimeForId(byte id)
22342238
return ECC_CURVE_INVALID;
22352239
}
22362240
}
2241+
2242+
#ifndef WOLFSSH_NO_ECDSA
22372243
static INLINE const char *PrimeNameForId(byte id)
22382244
{
22392245
switch (id) {
2240-
#ifndef WOLFSSH_NO_ECDH_SHA2_NISTP256
2241-
case ID_ECDH_SHA2_NISTP256:
2242-
return "nistp256";
2243-
#endif
22442246
#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP256
22452247
case ID_ECDSA_SHA2_NISTP256:
22462248
return "nistp256";
22472249
#endif
2248-
#ifndef WOLFSSH_NO_ECDH_SHA2_NISTP384
2249-
case ID_ECDH_SHA2_NISTP384:
2250-
return "nistp384";
2251-
#endif
22522250
#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP384
22532251
case ID_ECDSA_SHA2_NISTP384:
22542252
return "nistp384";
22552253
#endif
2256-
#ifndef WOLFSSH_NO_ECDH_SHA2_NISTP521
2257-
case ID_ECDH_SHA2_NISTP521:
2258-
return "nistp521";
2259-
#endif
22602254
#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP521
22612255
case ID_ECDSA_SHA2_NISTP521:
22622256
return "nistp521";
@@ -2265,6 +2259,7 @@ static INLINE const char *PrimeNameForId(byte id)
22652259
return "unknown";
22662260
}
22672261
}
2262+
#endif
22682263

22692264

22702265
static INLINE byte AeadModeForId(byte id)
@@ -2785,7 +2780,7 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
27852780
RsaKey key;
27862781
} rsa;
27872782
#endif
2788-
#ifndef WOLFSSH_NO_ECC
2783+
#ifndef WOLFSSH_NO_ECDSA
27892784
struct {
27902785
ecc_key key;
27912786
} ecc;
@@ -3098,7 +3093,7 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
30983093
#endif
30993094
}
31003095
else {
3101-
#ifndef WOLFSSH_NO_ECDHE
3096+
#ifndef WOLFSSH_NO_ECDH
31023097
ecc_key key;
31033098
ret = wc_ecc_init(&key);
31043099
#ifdef HAVE_WC_ECC_SET_RNG
@@ -3254,7 +3249,7 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
32543249
#endif
32553250
}
32563251
else {
3257-
#ifdef WOLFSSH_NO_ECDSA
3252+
#ifndef WOLFSSH_NO_ECDSA
32583253
wc_ecc_free(&sigKeyBlock.sk.ecc.key);
32593254
#endif
32603255
}
@@ -4120,7 +4115,7 @@ static int DoUserAuthRequestEcc(WOLFSSH* ssh, WS_UserAuthData_PublicKey* pk,
41204115
#endif
41214116

41224117

4123-
#if !defined(WOLFSSH_NO_RSA) && !defined(WOLFSSH_NO_ECDSA)
4118+
#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA)
41244119
/* Utility for DoUserAuthRequest() */
41254120
static int DoUserAuthRequestPublicKey(WOLFSSH* ssh, WS_UserAuthData* authData,
41264121
byte* buf, word32 len, word32* idx)
@@ -4282,11 +4277,12 @@ static int DoUserAuthRequestPublicKey(WOLFSSH* ssh, WS_UserAuthData* authData,
42824277
}
42834278
else if (pkTypeId == ID_ECDSA_SHA2_NISTP256 ||
42844279
pkTypeId == ID_ECDSA_SHA2_NISTP384 ||
4285-
pkTypeId == ID_ECDSA_SHA2_NISTP521)
4280+
pkTypeId == ID_ECDSA_SHA2_NISTP521) {
42864281
#ifndef WOLFSSH_NO_ECDSA
42874282
ret = DoUserAuthRequestEcc(ssh, pk,
42884283
hashId, digest, digestSz);
42894284
#endif
4285+
}
42904286
}
42914287

42924288
if (ret != WS_SUCCESS) {
@@ -4364,7 +4360,7 @@ static int DoUserAuthRequest(WOLFSSH* ssh,
43644360

43654361
if (authNameId == ID_USERAUTH_PASSWORD)
43664362
ret = DoUserAuthRequestPassword(ssh, &authData, buf, len, &begin);
4367-
#if !defined(WOLFSSH_NO_RSA) && !defined(WOLFSSH_NO_ECDSA)
4363+
#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA)
43684364
else if (authNameId == ID_USERAUTH_PUBLICKEY) {
43694365
authData.sf.publicKey.dataToSign = buf + *idx;
43704366
ret = DoUserAuthRequestPublicKey(ssh, &authData, buf, len, &begin);
@@ -6449,7 +6445,7 @@ int SendKexDhReply(WOLFSSH* ssh)
64496445
byte nPad;
64506446
} rsa;
64516447
#endif
6452-
#ifndef WOLFSSH_NO_ECDH_SHA2_NISTP256
6448+
#ifndef WOLFSSH_NO_ECDSA
64536449
struct {
64546450
ecc_key key;
64556451
word32 keyBlobSz;
@@ -6638,6 +6634,7 @@ int SendKexDhReply(WOLFSSH* ssh)
66386634
#endif /* WOLFSSH_NO_SSH_RSA_SHA1 */
66396635
}
66406636
else {
6637+
#ifndef WOLFSSH_NO_ECDSA
66416638
sigKeyBlock.sk.ecc.primeName =
66426639
PrimeNameForId(ssh->handshake->pubKeyId);
66436640
sigKeyBlock.sk.ecc.primeNameSz =
@@ -6707,6 +6704,7 @@ int SendKexDhReply(WOLFSSH* ssh)
67076704
enmhashId,
67086705
sigKeyBlock.sk.ecc.q,
67096706
sigKeyBlock.sk.ecc.qSz);
6707+
#endif
67106708
}
67116709
#ifndef WOLFSSH_NO_DH_GEX_SHA256
67126710
/* If using DH-GEX include the GEX specific values. */
@@ -6950,6 +6948,7 @@ int SendKexDhReply(WOLFSSH* ssh)
69506948
#endif
69516949
}
69526950
else {
6951+
#ifndef WOLFSSH_NO_ECDSA
69536952
WLOG(WS_LOG_INFO, "Signing hash with ECDSA.");
69546953
sigSz = sizeof(sig);
69556954
ret = wc_ecc_sign_hash(digest, wc_HashGetDigestSize(sigHashId),
@@ -6987,6 +6986,7 @@ int SendKexDhReply(WOLFSSH* ssh)
69876986
WMEMCPY(sig + idx, s, sSz);
69886987
}
69896988
}
6989+
#endif
69906990
}
69916991
}
69926992
}
@@ -6997,7 +6997,9 @@ int SendKexDhReply(WOLFSSH* ssh)
69976997
#endif
69986998
}
69996999
else {
7000+
#ifndef WOLFSSH_NO_ECDSA
70007001
wc_ecc_free(&sigKeyBlock.sk.ecc.key);
7002+
#endif
70017003
}
70027004

70037005
sigBlockSz = (LENGTH_SZ * 2) + sigKeyBlock.nameSz + sigSz;
@@ -7043,6 +7045,7 @@ int SendKexDhReply(WOLFSSH* ssh)
70437045
#endif
70447046
}
70457047
else {
7048+
#ifndef WOLFSSH_NO_ECDSA
70467049
c32toa(sigKeyBlock.sk.ecc.primeNameSz, output + idx);
70477050
idx += LENGTH_SZ;
70487051
WMEMCPY(output + idx, sigKeyBlock.sk.ecc.primeName,
@@ -7053,6 +7056,7 @@ int SendKexDhReply(WOLFSSH* ssh)
70537056
WMEMCPY(output + idx, sigKeyBlock.sk.ecc.q,
70547057
sigKeyBlock.sk.ecc.qSz);
70557058
idx += sigKeyBlock.sk.ecc.qSz;
7059+
#endif
70567060
}
70577061

70587062
/* Copy the server's public key. F for DE, or Q_S for ECDH. */
@@ -8168,7 +8172,7 @@ static int BuildUserAuthRequestEcc(WOLFSSH* ssh,
81688172
#endif
81698173

81708174

8171-
#if !defined(WOLFSSH_NO_RSA) && !defined(WOLFSSH_NO_ECDSA)
8175+
#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA)
81728176
static int PrepareUserAuthRequestPublicKey(WOLFSSH* ssh, word32* payloadSz,
81738177
const WS_UserAuthData* authData, WS_KeySignature* keySig)
81748178
{

‎src/ssh.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1439,7 +1439,7 @@ int wolfSSH_ReadKey_buffer(const byte* in, word32 inSz, int format,
14391439
#ifndef WOLFSSH_NO_RSA
14401440
RsaKey rsa;
14411441
#endif
1442-
#ifndef WOLFSSH_NO_ECC
1442+
#ifndef WOLFSSH_NO_ECDSA
14431443
ecc_key ecc;
14441444
#endif
14451445
} testKey;
@@ -1474,7 +1474,7 @@ int wolfSSH_ReadKey_buffer(const byte* in, word32 inSz, int format,
14741474
}
14751475
else {
14761476
#endif
1477-
#ifndef WOLFSSH_NO_ECC
1477+
#ifndef WOLFSSH_NO_ECDSA
14781478
byte curveId = ID_UNKNOWN;
14791479

14801480
/* Couldn't decode as RSA testKey. Try decoding as ECC testKey. */

‎tests/api.c‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -462,14 +462,14 @@ enum WS_TestFormatTypes {
462462
};
463463

464464

465-
#ifndef NO_ECC256
465+
#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP256
466466
static const char serverKeyEccDer[] =
467467
"307702010104206109990b79d25f285a0f5d15cca15654f92b3987212da77d85"
468468
"7bb87f38c66dd5a00a06082a8648ce3d030107a144034200048113ffa42bb79c"
469469
"45747a834c61f33fad26cf22cda9a3bca561b47ce662d4c2f755439a31fb8011"
470470
"20b5124b24f578d7fd22ef4635f005586b5f63c8da1bc4f569";
471471
static const int serverKeyEccCurveId = ECC_SECP256R1;
472-
#elif defined(HAVE_ECC384)
472+
#elif defined(WOLFSSH_NO_ECDSA_SHA2_NISTP384)
473473
static const char serverKeyEccDer[] =
474474
"3081a402010104303eadd2bbbf05a7be3a3f7c28151289de5bb3644d7011761d"
475475
"b56f2a0362fba64f98e64ff986dc4fb8efdb2d6b8da57142a00706052b810400"
@@ -478,7 +478,7 @@ static const char serverKeyEccDer[] =
478478
"b4c6a4cf5e97bd7e51e975e3e9217261506eb9cf3c493d3eb88d467b5f27ebab"
479479
"2161c00066febd";
480480
static const int serverKeyEccCurveId = ECC_SECP384R1;
481-
#elif defined(HAVE_ECC521)
481+
#elif defined(WOLFSSH_NO_ECDSA_SHA2_NISTP521)
482482
static const char serverKeyEccDer[] =
483483
"3081dc0201010442004ca4d86428d9400e7b2df3912eb996c195895043af92e8"
484484
"6de70ae4df46f22a291a6bb2748aae82580df6c39f49b3ed82f1789ece1b657d"
@@ -490,6 +490,7 @@ static const char serverKeyEccDer[] =
490490
static const int serverKeyEccCurveId = ECC_SECP521R1;
491491
#endif
492492

493+
#ifndef WOLFSSH_NO_SSH_RSA_SHA1
493494
static const char serverKeyRsaDer[] =
494495
"308204a30201000282010100da5dad2514761559f340fd3cb86230b36dc0f9ec"
495496
"ec8b831e9e429cca416ad38ae15234e00d13627ed40fae5c4d04f18dfac5ad77"
@@ -529,6 +530,7 @@ static const char serverKeyRsaDer[] =
529530
"731fba275c82f8ad311edef33772cb47d2cdf7f87f0039db8d2aca4ec1cee215"
530531
"89d63a61ae9da230a585ae38ea4674dc023aace95fa3c6734f73819056c3ce77"
531532
"5f5bba6c42f121";
533+
#endif
532534

533535

534536
static void test_wolfSSH_CTX_UsePrivateKey_buffer(void)
@@ -591,9 +593,11 @@ static void test_wolfSSH_CTX_UsePrivateKey_buffer(void)
591593
TEST_GOOD_FORMAT_ASN1));
592594
AssertNotNull(ctx->privateKey);
593595
AssertIntNE(0, ctx->privateKeySz);
596+
#ifndef WOLFSSH_NO_ECDSA
594597
AssertIntEQ(serverKeyEccCurveId, ctx->useEcc);
598+
#endif
595599

596-
#ifndef NO_RSA
600+
#ifndef WOLFSSH_NO_RSA
597601
lastKey = ctx->privateKey;
598602
lastKeySz = ctx->privateKeySz;
599603
AssertIntEQ(WS_SUCCESS,

‎wolfssh/internal.h‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,8 @@ extern "C" {
7474
#ifndef HAVE_ECC
7575
#undef WOLFSSH_NO_ECDSA
7676
#define WOLFSSH_NO_ECDSA
77-
#undef WOLFSSH_NO_ECDHE
78-
#define WOLFSSH_NO_ECDHE
77+
#undef WOLFSSH_NO_ECDH
78+
#define WOLFSSH_NO_ECDH
7979
#endif
8080

8181
#ifdef NO_DH
@@ -115,15 +115,15 @@ extern "C" {
115115
#undef WOLFSSH_NO_DH_GEX_SHA256
116116
#define WOLFSSH_NO_DH_GEX_SHA256
117117
#endif
118-
#if defined(WOLFSSH_NO_ECDHE) || defined(NO_SHA256) || defined(NO_ECC256)
118+
#if defined(WOLFSSH_NO_ECDH) || defined(NO_SHA256) || defined(NO_ECC256)
119119
#undef WOLFSSH_NO_ECDH_SHA2_NISTP256
120120
#define WOLFSSH_NO_ECDH_SHA2_NISTP256
121121
#endif
122-
#if defined(WOLFSSH_NO_ECDHE) || !defined(WOLFSSL_SHA384) || !defined(HAVE_ECC384)
122+
#if defined(WOLFSSH_NO_ECDH) || !defined(WOLFSSL_SHA384) || !defined(HAVE_ECC384)
123123
#undef WOLFSSH_NO_ECDH_SHA2_NISTP384
124124
#define WOLFSSH_NO_ECDH_SHA2_NISTP384
125125
#endif
126-
#if defined(WOLFSSH_NO_ECDHE) || !defined(WOLFSSL_SHA512) || !defined(HAVE_ECC521)
126+
#if defined(WOLFSSH_NO_ECDH) || !defined(WOLFSSL_SHA512) || !defined(HAVE_ECC521)
127127
#undef WOLFSSH_NO_ECDH_SHA2_NISTP521
128128
#define WOLFSSH_NO_ECDH_SHA2_NISTP521
129129
#endif
@@ -152,8 +152,8 @@ extern "C" {
152152
#if defined(WOLFSSH_NO_ECDH_SHA2_NISTP256) && \
153153
defined(WOLFSSH_NO_ECDH_SHA2_NISTP384) && \
154154
defined(WOLFSSH_NO_ECDH_SHA2_NISTP521)
155-
#undef WOLFSSH_NO_ECDHE
156-
#define WOLFSSH_NO_ECDHE
155+
#undef WOLFSSH_NO_ECDH
156+
#define WOLFSSH_NO_ECDH
157157
#endif
158158

159159
#if defined(WOLFSSH_NO_RSA) || defined(NO_SHA)

0 commit comments

Comments
 (0)