From e07f41d4be8ab80c3f9dad6111fc1a6ab5b8b064 Mon Sep 17 00:00:00 2001 From: Paul Bakker Date: Fri, 19 Apr 2013 09:08:57 +0200 Subject: [PATCH] Introduced defines to control availability of specific SSL Key Exchange methods. Introduces POLARSSL_KEY_EXCHANGE_RSA_ENABLED, POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED, POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED, etc --- include/polarssl/config.h | 131 ++++++++++++++++++++++++++++++++++++- library/ssl_ciphersuites.c | 59 ++++++++--------- 2 files changed, 157 insertions(+), 33 deletions(-) diff --git a/include/polarssl/config.h b/include/polarssl/config.h index 0a412b602..1f3e0292a 100644 --- a/include/polarssl/config.h +++ b/include/polarssl/config.h @@ -165,10 +165,9 @@ * \def POLARSSL_KEY_EXCHANGE_PSK_ENABLED * * Enable the PSK based ciphersuite modes in SSL / TLS - * In combination with POLARSSL_RSA_C it also enables RSA_PSK ciphersuites - * and in combination with POLARSSL_DHM_C it enables the DHE_PSK ciphersuites * - * This enables the following ciphersuites: + * This enables the following ciphersuites (if other requisites are + * enabled as well): * TLS_PSK_WITH_RC4_128_SHA * TLS_PSK_WITH_3DES_EDE_CBC_SHA * TLS_PSK_WITH_AES_128_CBC_SHA @@ -176,6 +175,106 @@ */ #define POLARSSL_KEY_EXCHANGE_PSK_ENABLED +/** + * \def POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED + * + * Enable the DHE-PSK based ciphersuite modes in SSL / TLS + * + * Requires: POLARSSL_DHM_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * TLS_DHE_PSK_WITH_RC4_128_SHA + * TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * TLS_DHE_PSK_WITH_AES_256_CBC_SHA +#define POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED + */ + +/** + * \def POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED + * + * Enable the RSA-PSK based ciphersuite modes in SSL / TLS + * + * Requires: POLARSSL_RSA_C, POLARSSL_X509_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * TLS_RSA_PSK_WITH_RC4_128_SHA + * TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * TLS_RSA_PSK_WITH_AES_256_CBC_SHA +#define POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED + */ + +/** + * \def POLARSSL_KEY_EXCHANGE_RSA_ENABLED + * + * Enable the RSA-only based ciphersuite modes in SSL / TLS + * + * Requires: POLARSSL_RSA_C, POLARSSL_X509_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * TLS_RSA_WITH_AES_128_CBC_SHA + * TLS_RSA_WITH_AES_256_CBC_SHA + * TLS_RSA_WITH_AES_128_CBC_SHA256 + * TLS_RSA_WITH_AES_256_CBC_SHA256 + * TLS_RSA_WITH_AES_128_GCM_SHA256 + * TLS_RSA_WITH_AES_256_GCM_SHA384 + * TLS_RSA_WITH_RC4_128_MD5 + * TLS_RSA_WITH_RC4_128_SHA + * TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * TLS_RSA_WITH_3DES_EDE_CBC_SHA + */ +#define POLARSSL_KEY_EXCHANGE_RSA_ENABLED + +/** + * \def POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED + * + * Enable the DHE-RSA based ciphersuite modes in SSL / TLS + * + * Requires: POLARSSL_DHM_C, POLARSSL_RSA_C, POLARSSL_X509_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + */ +#define POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED + +/** + * \def POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED + * + * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS + * + * Requires: POLARSSL_ECDH_C, POLARSSL_RSA_C, POLARSSL_X509_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * TLS_ECDHE_RSA_WITH_RC4_128_SHA + * TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + */ +#define POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED + /** * \def POLARSSL_ERROR_STRERROR_DUMMY * @@ -1007,6 +1106,32 @@ #error "POLARSSL_GCM_C defined, but not all prerequisites" #endif +#if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) && !defined(POLARSSL_DHM_C) +#error "POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ + ( !defined(POLARSSL_DHM_C) || !defined(POLARSSL_RSA_C) || \ + !defined(POLARSSL_X509_PARSE_C) ) +#error "POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ + ( !defined(POLARSSL_ECDH_C) || !defined(POLARSSL_RSA_C) || \ + !defined(POLARSSL_X509_PARSE_C) ) +#error "POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED) && \ + ( !defined(POLARSSL_RSA_C) || !defined(POLARSSL_X509_PARSE_C) ) +#error "POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) && \ + ( !defined(POLARSSL_RSA_C) || !defined(POLARSSL_X509_PARSE_C) ) +#error "POLARSSL_KEY_EXCHANGE_RSA_ENABLED defined, but not all prerequisites" +#endif + #if defined(POLARSSL_PBKDF2_C) && !defined(POLARSSL_MD_C) #error "POLARSSL_PBKDF2_C defined, but not all prerequisites" #endif diff --git a/library/ssl_ciphersuites.c b/library/ssl_ciphersuites.c index 38d873f96..d4d96bfcf 100644 --- a/library/ssl_ciphersuites.c +++ b/library/ssl_ciphersuites.c @@ -128,8 +128,7 @@ static int supported_init = 0; static const ssl_ciphersuite_t ciphersuite_definitions[] = { -#if defined(POLARSSL_X509_PARSE_C) && defined(POLARSSL_RSA_C) -#if defined(POLARSSL_ECDH_C) +#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) #if defined(POLARSSL_AES_C) { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, "TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA", POLARSSL_CIPHER_AES_128_CBC, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_ECDHE_RSA, @@ -211,23 +210,9 @@ static const ssl_ciphersuite_t ciphersuite_definitions[] = SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, POLARSSL_CIPHERSUITE_EC | POLARSSL_CIPHERSUITE_WEAK }, #endif /* POLARSSL_CIPHER_NULL_CIPHER */ -#endif /* POLARSSL_ECDH_C */ +#endif /* POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED */ -#if defined(POLARSSL_ARC4_C) - { TLS_RSA_WITH_RC4_128_MD5, "TLS-RSA-WITH-RC4-128-MD5", - POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_MD5, POLARSSL_KEY_EXCHANGE_RSA, - SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0, - SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, - 0 }, - - { TLS_RSA_WITH_RC4_128_SHA, "TLS-RSA-WITH-RC4-128-SHA", - POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_RSA, - SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0, - SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, - 0 }, -#endif /* POLARSSL_ARC4_C */ - -#if defined(POLARSSL_DHM_C) +#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) #if defined(POLARSSL_AES_C) #if defined(POLARSSL_SHA4_C) && defined(POLARSSL_GCM_C) { TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, "TLS-DHE-RSA-WITH-AES-256-GCM-SHA384", @@ -307,8 +292,9 @@ static const ssl_ciphersuite_t ciphersuite_definitions[] = SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, 0 }, #endif /* POLARSSL_DES_C */ -#endif /* POLARSSL_DHM_C */ +#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED */ +#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) #if defined(POLARSSL_AES_C) #if defined(POLARSSL_SHA4_C) && defined(POLARSSL_GCM_C) { TLS_RSA_WITH_AES_256_GCM_SHA384, "TLS-RSA-WITH-AES-256-GCM-SHA384", @@ -388,7 +374,21 @@ static const ssl_ciphersuite_t ciphersuite_definitions[] = SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, 0 }, #endif /* POLARSSL_DES_C */ -#endif /* POLARSSL_X509_PARSE_C && POLARSSL_RSA_C */ + +#if defined(POLARSSL_ARC4_C) + { TLS_RSA_WITH_RC4_128_MD5, "TLS-RSA-WITH-RC4-128-MD5", + POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_MD5, POLARSSL_KEY_EXCHANGE_RSA, + SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0, + SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, + 0 }, + + { TLS_RSA_WITH_RC4_128_SHA, "TLS-RSA-WITH-RC4-128-SHA", + POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_RSA, + SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0, + SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, + 0 }, +#endif /* POLARSSL_ARC4_C */ +#endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED */ #if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED) #if defined(POLARSSL_AES_C) @@ -420,8 +420,9 @@ static const ssl_ciphersuite_t ciphersuite_definitions[] = SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, 0 }, #endif /* POLARSSL_ARC4_C */ +#endif /* POLARSSL_KEY_EXCHANGE_PSK_ENABLED */ -#if defined(POLARSSL_DHM_C) +#if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) #if defined(POLARSSL_AES_C) { TLS_DHE_PSK_WITH_AES_128_CBC_SHA, "TLS-DHE-PSK-WITH-AES-128-CBC-SHA", POLARSSL_CIPHER_AES_128_CBC, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_DHE_PSK, @@ -451,9 +452,9 @@ static const ssl_ciphersuite_t ciphersuite_definitions[] = SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, 0 }, #endif /* POLARSSL_ARC4_C */ -#endif /* POLARSSL_DHM_C */ +#endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */ -#if defined(POLARSSL_X509_PARSE_C) && defined(POLARSSL_RSA_C) +#if defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED) #if defined(POLARSSL_AES_C) { TLS_RSA_PSK_WITH_AES_128_CBC_SHA, "TLS-RSA-PSK-WITH-AES-128-CBC-SHA", POLARSSL_CIPHER_AES_128_CBC, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_RSA_PSK, @@ -483,11 +484,10 @@ static const ssl_ciphersuite_t ciphersuite_definitions[] = SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, 0 }, #endif /* POLARSSL_ARC4_C */ -#endif /* POLARSSL_X509_PARSE_C && POLARSSL_RSA_C */ -#endif /* POLARSSL_KEY_EXCHANGE_PSK_ENABLED */ +#endif /* POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */ #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) -#if defined(POLARSSL_X509_PARSE_C) && defined(POLARSSL_RSA_C) +#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) #if defined(POLARSSL_CIPHER_NULL_CIPHER) { TLS_RSA_WITH_NULL_MD5, "TLS-RSA-WITH-NULL-MD5", POLARSSL_CIPHER_NULL, POLARSSL_MD_MD5, POLARSSL_KEY_EXCHANGE_RSA, @@ -507,15 +507,16 @@ static const ssl_ciphersuite_t ciphersuite_definitions[] = SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, POLARSSL_CIPHERSUITE_WEAK }, #endif /* POLARSSL_CIPHER_NULL_CIPHER */ +#endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED */ #if defined(POLARSSL_DES_C) -#if defined(POLARSSL_DHM_C) +#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) { TLS_DHE_RSA_WITH_DES_CBC_SHA, "TLS-DHE-RSA-WITH-DES-CBC-SHA", POLARSSL_CIPHER_DES_CBC, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_DHE_RSA, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, POLARSSL_CIPHERSUITE_WEAK }, -#endif /* POLARSSL_DHM_C */ +#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED */ { TLS_RSA_WITH_DES_CBC_SHA, "TLS-RSA-WITH-DES-CBC-SHA", POLARSSL_CIPHER_DES_CBC, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_RSA, @@ -523,8 +524,6 @@ static const ssl_ciphersuite_t ciphersuite_definitions[] = SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3, POLARSSL_CIPHERSUITE_WEAK }, #endif /* POLARSSL_DES_C */ -#endif /* POLARSSL_X509_PARSE_C && POLARSSL_RSA_C */ - #endif /* POLARSSL_ENABLE_WEAK_CIPHERSUITES */ { 0, "", 0, 0, 0, 0, 0, 0, 0, 0 }