Skip to content

Commit fc2f4fc

Browse files
SparkiDevSparkiDev
authored
Merge pull request #10435 from Frauschi/pqc_default_curve
Improved handling for ClientHello default key share group
2 parents 8574fa9 + 5915e39 commit fc2f4fc

1 file changed

Lines changed: 189 additions & 69 deletions

File tree

‎src/tls.c‎

Lines changed: 189 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -11169,10 +11169,14 @@ int TLSX_KeyShare_Empty(WOLFSSL* ssl)
1116911169
return ret;
1117011170
}
1117111171

11172+
/* Compile-time gating must stay aligned with TLSX_PopulateSupportedGroups().
11173+
* Runtime-only conditions in that function (TLS 1.3 version check, FFDHE
11174+
* key-size bounds, session-resumption short-circuit, downgrade-aware
11175+
* Brainpool TLS 1.2 selection) are intentionally not represented here. */
1117211176
static const word16 preferredGroup[] = {
1117311177
/* Sort by strength, but prefer non-experimental PQ/T hybrid groups */
11174-
#if defined(WOLFSSL_HAVE_MLKEM) && !defined(WOLFSSL_NO_ML_KEM) && \
11175-
defined(WOLFSSL_PQC_HYBRIDS)
11178+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11179+
!defined(WOLFSSL_NO_ML_KEM) && defined(WOLFSSL_PQC_HYBRIDS)
1117611180
#if !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_CURVE25519) && \
1117711181
ECC_MIN_KEY_SZ <= 256
1117811182
WOLFSSL_X25519MLKEM768,
@@ -11187,50 +11191,96 @@ static const word16 preferredGroup[] = {
1118711191
ECC_MIN_KEY_SZ <= 256
1118811192
WOLFSSL_SECP256R1MLKEM768,
1118911193
#endif
11190-
#endif /* WOLFSSL_HAVE_MLKEM && !WOLFSSL_NO_ML_KEM && WOLFSSL_PQC_HYBRIDS */
11191-
#if defined(WOLFSSL_HAVE_MLKEM) && !defined(WOLFSSL_NO_ML_KEM) && \
11192-
!defined(WOLFSSL_NO_ML_KEM_1024) && !defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
11194+
#endif /* WOLFSSL_TLS13 && WOLFSSL_HAVE_MLKEM && !WOLFSSL_NO_ML_KEM &&
11195+
* WOLFSSL_PQC_HYBRIDS */
11196+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11197+
!defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_1024) && \
11198+
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
1119311199
WOLFSSL_ML_KEM_1024,
1119411200
#endif
11195-
#if defined(HAVE_ECC) && (!defined(NO_ECC521) || \
11196-
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 521
11201+
#if defined(HAVE_ECC) && (defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)) && \
11202+
!defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 521
1119711203
WOLFSSL_ECC_SECP521R1,
1119811204
#endif
11199-
#if defined(HAVE_ECC) && defined(HAVE_ECC512) && \
11205+
#if defined(HAVE_ECC) && (defined(HAVE_ECC512) || defined(HAVE_ALL_CURVES)) && \
1120011206
defined(HAVE_ECC_BRAINPOOL) && ECC_MIN_KEY_SZ <= 512
1120111207
WOLFSSL_ECC_BRAINPOOLP512R1TLS13,
11208+
WOLFSSL_ECC_BRAINPOOLP512R1,
1120211209
#endif
11203-
#if defined(WOLFSSL_HAVE_MLKEM) && !defined(WOLFSSL_NO_ML_KEM) && \
11204-
!defined(WOLFSSL_NO_ML_KEM_768) && !defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
11210+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11211+
!defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_768) && \
11212+
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
1120511213
WOLFSSL_ML_KEM_768,
1120611214
#endif
11207-
#if defined(HAVE_ECC) && (!defined(NO_ECC384) || \
11208-
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 384
11215+
#if defined(HAVE_ECC) && (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && \
11216+
ECC_MIN_KEY_SZ <= 384
11217+
#ifndef NO_ECC_SECP
1120911218
WOLFSSL_ECC_SECP384R1,
11210-
#if defined(HAVE_ECC_BRAINPOOL)
11219+
#endif
11220+
#ifdef HAVE_ECC_BRAINPOOL
1121111221
WOLFSSL_ECC_BRAINPOOLP384R1TLS13,
11222+
WOLFSSL_ECC_BRAINPOOLP384R1,
11223+
#endif
1121211224
#endif
11213-
#endif
11214-
#if defined(HAVE_CURVE448) && ECC_MIN_KEY_SZ <= 448
11225+
#if !defined(HAVE_FIPS) && defined(HAVE_CURVE448) && ECC_MIN_KEY_SZ <= 448
1121511226
WOLFSSL_ECC_X448,
1121611227
#endif
11217-
#if defined(WOLFSSL_HAVE_MLKEM) && !defined(WOLFSSL_NO_ML_KEM) && \
11218-
!defined(WOLFSSL_NO_ML_KEM_512) && !defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
11228+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11229+
!defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_512) && \
11230+
!defined(WOLFSSL_TLS_NO_MLKEM_STANDALONE)
1121911231
WOLFSSL_ML_KEM_512,
1122011232
#endif
11221-
#if defined(HAVE_ECC) && (!defined(NO_ECC256) || \
11222-
defined(HAVE_ALL_CURVES)) && !defined(NO_ECC_SECP) && ECC_MIN_KEY_SZ <= 256
11233+
#if defined(HAVE_ECC) && (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && \
11234+
ECC_MIN_KEY_SZ <= 256
11235+
#ifndef NO_ECC_SECP
1122311236
WOLFSSL_ECC_SECP256R1,
11224-
#if !defined(HAVE_FIPS) && defined(WOLFSSL_SM2)
11225-
WOLFSSL_ECC_SM2P256V1,
11226-
#endif
11227-
#if defined(HAVE_ECC_BRAINPOOL)
11237+
#endif
11238+
#ifdef HAVE_ECC_KOBLITZ
11239+
WOLFSSL_ECC_SECP256K1,
11240+
#endif
11241+
#ifdef HAVE_ECC_BRAINPOOL
1122811242
WOLFSSL_ECC_BRAINPOOLP256R1TLS13,
11243+
WOLFSSL_ECC_BRAINPOOLP256R1,
11244+
#endif
11245+
#if !defined(HAVE_FIPS) && defined(WOLFSSL_SM2)
11246+
WOLFSSL_ECC_SM2P256V1,
11247+
#endif
1122911248
#endif
11230-
#endif
11231-
#if defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
11249+
#if !defined(HAVE_FIPS) && defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
1123211250
WOLFSSL_ECC_X25519,
1123311251
#endif
11252+
#if defined(HAVE_ECC) && (defined(HAVE_ECC224) || defined(HAVE_ALL_CURVES)) && \
11253+
ECC_MIN_KEY_SZ <= 224
11254+
#ifndef NO_ECC_SECP
11255+
WOLFSSL_ECC_SECP224R1,
11256+
#endif
11257+
#ifdef HAVE_ECC_KOBLITZ
11258+
WOLFSSL_ECC_SECP224K1,
11259+
#endif
11260+
#endif
11261+
#if !defined(HAVE_FIPS) && defined(HAVE_ECC)
11262+
#if (defined(HAVE_ECC192) || defined(HAVE_ALL_CURVES)) && \
11263+
ECC_MIN_KEY_SZ <= 192
11264+
#ifndef NO_ECC_SECP
11265+
WOLFSSL_ECC_SECP192R1,
11266+
#endif
11267+
#ifdef HAVE_ECC_KOBLITZ
11268+
WOLFSSL_ECC_SECP192K1,
11269+
#endif
11270+
#endif
11271+
#if (defined(HAVE_ECC160) || defined(HAVE_ALL_CURVES)) && \
11272+
ECC_MIN_KEY_SZ <= 160
11273+
#ifndef NO_ECC_SECP
11274+
WOLFSSL_ECC_SECP160R1,
11275+
#endif
11276+
#ifdef HAVE_ECC_SECPR2
11277+
WOLFSSL_ECC_SECP160R2,
11278+
#endif
11279+
#ifdef HAVE_ECC_KOBLITZ
11280+
WOLFSSL_ECC_SECP160K1,
11281+
#endif
11282+
#endif
11283+
#endif /* !HAVE_FIPS && HAVE_ECC */
1123411284
#if defined(HAVE_FFDHE_8192)
1123511285
WOLFSSL_FFDHE_8192,
1123611286
#endif
@@ -11246,35 +11296,52 @@ static const word16 preferredGroup[] = {
1124611296
#if defined(HAVE_FFDHE_2048)
1124711297
WOLFSSL_FFDHE_2048,
1124811298
#endif
11249-
#ifndef WOLFSSL_NO_ML_KEM
11250-
#if !defined(WOLFSSL_NO_ML_KEM_1024) && \
11251-
defined(WOLFSSL_EXTRA_PQC_HYBRIDS)
11299+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11300+
!defined(WOLFSSL_NO_ML_KEM) && defined(WOLFSSL_EXTRA_PQC_HYBRIDS)
11301+
#if !defined(WOLFSSL_NO_ML_KEM_1024) && defined(HAVE_ECC) && \
11302+
(defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)) && \
11303+
ECC_MIN_KEY_SZ <= 521
1125211304
WOLFSSL_SECP521R1MLKEM1024,
1125311305
#endif
11254-
#if !defined(WOLFSSL_NO_ML_KEM_768) && \
11255-
defined(WOLFSSL_EXTRA_PQC_HYBRIDS)
11306+
#if !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_ECC) && \
11307+
(defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && \
11308+
ECC_MIN_KEY_SZ <= 384
1125611309
WOLFSSL_SECP384R1MLKEM768,
11257-
#if defined(HAVE_CURVE448) && ECC_MIN_KEY_SZ <= 448
11310+
#endif
11311+
#if !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_CURVE448) && \
11312+
ECC_MIN_KEY_SZ <= 448
1125811313
WOLFSSL_X448MLKEM768,
11259-
#endif /* HAVE_CURVE448 */
1126011314
#endif
11261-
#if !defined(WOLFSSL_NO_ML_KEM_512) && \
11262-
defined(WOLFSSL_EXTRA_PQC_HYBRIDS)
11315+
#if !defined(WOLFSSL_NO_ML_KEM_512) && defined(HAVE_ECC) && \
11316+
(!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && \
11317+
ECC_MIN_KEY_SZ <= 256
1126311318
WOLFSSL_SECP256R1MLKEM512,
11264-
#if defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
11319+
#endif
11320+
#if !defined(WOLFSSL_NO_ML_KEM_512) && defined(HAVE_CURVE25519) && \
11321+
ECC_MIN_KEY_SZ <= 256
1126511322
WOLFSSL_X25519MLKEM512,
11266-
#endif /* HAVE_CURVE25519 */
1126711323
#endif
11268-
#endif /* !WOLFSSL_NO_ML_KEM */
11269-
#ifdef WOLFSSL_MLKEM_KYBER
11324+
#endif /* WOLFSSL_TLS13 && WOLFSSL_HAVE_MLKEM && !WOLFSSL_NO_ML_KEM &&
11325+
* WOLFSSL_EXTRA_PQC_HYBRIDS */
11326+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11327+
defined(WOLFSSL_MLKEM_KYBER)
1127011328
#ifdef WOLFSSL_KYBER1024
1127111329
WOLFSSL_KYBER_LEVEL5,
11330+
#if defined(HAVE_ECC) && (defined(HAVE_ECC521) || \
11331+
defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 521
1127211332
WOLFSSL_P521_KYBER_LEVEL5,
1127311333
#endif
11334+
#endif
1127411335
#ifdef WOLFSSL_KYBER768
1127511336
WOLFSSL_KYBER_LEVEL3,
11337+
#if defined(HAVE_ECC) && (defined(HAVE_ECC384) || \
11338+
defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 384
1127611339
WOLFSSL_P384_KYBER_LEVEL3,
11340+
#endif
11341+
#if defined(HAVE_ECC) && (!defined(NO_ECC256) || \
11342+
defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256
1127711343
WOLFSSL_P256_KYBER_LEVEL3,
11344+
#endif
1127811345
#if defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
1127911346
WOLFSSL_X25519_KYBER_LEVEL3,
1128011347
#endif
@@ -11284,19 +11351,80 @@ static const word16 preferredGroup[] = {
1128411351
#endif
1128511352
#ifdef WOLFSSL_KYBER512
1128611353
WOLFSSL_KYBER_LEVEL1,
11354+
#if defined(HAVE_ECC) && (!defined(NO_ECC256) || \
11355+
defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256
1128711356
WOLFSSL_P256_KYBER_LEVEL1,
11357+
#endif
1128811358
#if defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
1128911359
WOLFSSL_X25519_KYBER_LEVEL1,
1129011360
#endif
1129111361
#endif
11292-
#endif /* WOLFSSL_MLKEM_KYBER */
11362+
#endif /* WOLFSSL_TLS13 && WOLFSSL_HAVE_MLKEM && WOLFSSL_MLKEM_KYBER */
1129311363
WOLFSSL_NAMED_GROUP_INVALID
1129411364
};
1129511365

1129611366
#define PREFERRED_GROUP_SZ \
1129711367
((sizeof(preferredGroup)/sizeof(*preferredGroup)) - 1)
1129811368
/* -1 for the invalid group */
1129911369

11370+
/* WOLFSSL_KEY_SHARE_DEFAULT_GROUP - group used for the speculative key share
11371+
* in ClientHello messages when the application has not selected one via
11372+
* wolfSSL_CTX_set_groups() / wolfSSL_set_groups() or wolfSSL_UseKeyShare().
11373+
*
11374+
* The default is optimized for the likelihood that the server will accept the
11375+
* speculative key share without forcing a HelloRetryRequest. It therefore
11376+
* differs from preferredGroup[] (which is sorted by strength): we pick the
11377+
* most widely deployed group at each tier rather than the strongest.
11378+
*
11379+
* Selection order when not user-defined:
11380+
* 1. A standardized PQ/T hybrid using X25519 or SECP256R1, if available.
11381+
* 2. SECP256R1, then X25519, then SECP384R1.
11382+
* 3. FFDHE 2048 or 3072, for DH-only TLS 1.3 builds.
11383+
* 4. preferredGroup[0] as a final fallback for any other configuration.
11384+
*
11385+
* Users can override the default by defining WOLFSSL_KEY_SHARE_DEFAULT_GROUP
11386+
* in user_settings.h to any of the WOLFSSL_* group identifiers from
11387+
* wolfssl/ssl.h (or the numeric IANA code point). The macro is substituted
11388+
* directly into an assignment, so wrap non-trivial expressions in parentheses.
11389+
*/
11390+
#ifndef WOLFSSL_KEY_SHARE_DEFAULT_GROUP
11391+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11392+
!defined(WOLFSSL_NO_ML_KEM) && defined(WOLFSSL_PQC_HYBRIDS) && \
11393+
!defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_CURVE25519) && \
11394+
ECC_MIN_KEY_SZ <= 256
11395+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP WOLFSSL_X25519MLKEM768
11396+
#elif defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11397+
!defined(WOLFSSL_NO_ML_KEM) && defined(WOLFSSL_PQC_HYBRIDS) && \
11398+
!defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_ECC) && \
11399+
(!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && \
11400+
ECC_MIN_KEY_SZ <= 256
11401+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP WOLFSSL_SECP256R1MLKEM768
11402+
#elif defined(WOLFSSL_TLS13) && defined(WOLFSSL_HAVE_MLKEM) && \
11403+
!defined(WOLFSSL_NO_ML_KEM) && defined(WOLFSSL_PQC_HYBRIDS) && \
11404+
!defined(WOLFSSL_NO_ML_KEM_1024) && defined(HAVE_ECC) && \
11405+
(defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && \
11406+
ECC_MIN_KEY_SZ <= 384
11407+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP WOLFSSL_SECP384R1MLKEM1024
11408+
#elif defined(HAVE_ECC) && (!defined(NO_ECC256) || \
11409+
defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256 && \
11410+
!defined(NO_ECC_SECP)
11411+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP WOLFSSL_ECC_SECP256R1
11412+
#elif !defined(HAVE_FIPS) && defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
11413+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP WOLFSSL_ECC_X25519
11414+
#elif defined(HAVE_ECC) && (defined(HAVE_ECC384) || \
11415+
defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 384 && \
11416+
!defined(NO_ECC_SECP)
11417+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP WOLFSSL_ECC_SECP384R1
11418+
#elif defined(HAVE_FFDHE_2048)
11419+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP WOLFSSL_FFDHE_2048
11420+
#elif defined(HAVE_FFDHE_3072)
11421+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP WOLFSSL_FFDHE_3072
11422+
#else
11423+
/* Fall back to whatever preferredGroup[] starts with. */
11424+
#define WOLFSSL_KEY_SHARE_DEFAULT_GROUP (preferredGroup[0])
11425+
#endif
11426+
#endif /* !WOLFSSL_KEY_SHARE_DEFAULT_GROUP */
11427+
1130011428
/* Examines the application specified group ranking and returns the rank of the
1130111429
* group.
1130211430
* If no group ranking set then all groups are rank 0 (highest).
@@ -15654,7 +15782,7 @@ static int TLSX_PopulateSupportedGroups(WOLFSSL* ssl, TLSX** extensions)
1565415782
if (ret != WOLFSSL_SUCCESS) return ret;
1565515783
}
1565615784
#endif
15657-
#ifdef WOLFSSL_SM2
15785+
#if !defined(HAVE_FIPS) && defined(WOLFSSL_SM2)
1565815786
ret = TLSX_UseSupportedCurve(extensions,
1565915787
WOLFSSL_ECC_SM2P256V1, ssl->heap);
1566015788
if (ret != WOLFSSL_SUCCESS) return ret;
@@ -15904,8 +16032,7 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
1590416032
}
1590516033
#endif
1590616034

15907-
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
15908-
defined(HAVE_CURVE448)) && defined(HAVE_SUPPORTED_CURVES)
16035+
#if defined(HAVE_SUPPORTED_CURVES)
1590916036
if (!ssl->options.userCurves && !ssl->ctx->userCurves) {
1591016037
if (TLSX_Find(ssl->ctx->extensions,
1591116038
TLSX_SUPPORTED_GROUPS) == NULL) {
@@ -15914,15 +16041,17 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
1591416041
return ret;
1591516042
}
1591616043
}
16044+
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
1591716045
if ((!IsAtLeastTLSv1_3(ssl->version) || ssl->options.downgrade) &&
1591816046
TLSX_Find(ssl->ctx->extensions, TLSX_EC_POINT_FORMATS) == NULL &&
1591916047
TLSX_Find(ssl->extensions, TLSX_EC_POINT_FORMATS) == NULL) {
15920-
ret = TLSX_UsePointFormat(&ssl->extensions,
16048+
ret = TLSX_UsePointFormat(&ssl->extensions,
1592116049
WOLFSSL_EC_PF_UNCOMPRESSED, ssl->heap);
15922-
if (ret != WOLFSSL_SUCCESS)
15923-
return ret;
16050+
if (ret != WOLFSSL_SUCCESS)
16051+
return ret;
1592416052
}
15925-
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && HAVE_SUPPORTED_CURVES */
16053+
#endif
16054+
#endif /* HAVE_SUPPORTED_CURVES */
1592616055

1592716056
#ifdef WOLFSSL_SRTP
1592816057
if (ssl->options.dtls && ssl->dtlsSrtpProfiles != 0) {
@@ -15971,20 +16100,6 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
1597116100
return ret;
1597216101
}
1597316102

15974-
#if !defined(HAVE_ECC) && !defined(HAVE_CURVE25519) && \
15975-
!defined(HAVE_CURVE448) && defined(HAVE_SUPPORTED_CURVES)
15976-
if (TLSX_Find(ssl->ctx->extensions, TLSX_SUPPORTED_GROUPS) == NULL) {
15977-
/* Put in DH groups for TLS 1.3 only. */
15978-
ret = TLSX_PopulateSupportedGroups(ssl, &ssl->extensions);
15979-
if (ret != WOLFSSL_SUCCESS)
15980-
return ret;
15981-
/* ret value will be overwritten in !NO_PSK case */
15982-
#ifdef NO_PSK
15983-
ret = 0;
15984-
#endif
15985-
}
15986-
#endif /* !(HAVE_ECC || CURVE25519 || CURVE448) && HAVE_SUPPORTED_CURVES */
15987-
1598816103
#if !defined(NO_CERTS) && !defined(WOLFSSL_NO_SIGALG)
1598916104
if (ssl->certHashSigAlgoSz > 0) {
1599016105
WOLFSSL_MSG("Adding signature algorithms cert extension");
@@ -16007,10 +16122,11 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
1600716122
int set = 0;
1600816123
int i, j;
1600916124

16010-
/* try to find the highest element in ssl->group[]
16011-
* that is contained in preferredGroup[].
16012-
*/
16013-
namedGroup = preferredGroup[0];
16125+
/* Find the first element of ssl->group[] that is also
16126+
* present in preferredGroup[]. The user's ranking wins;
16127+
* if nothing intersects, send no key share and let the
16128+
* server drive group selection via HRR. */
16129+
namedGroup = WOLFSSL_NAMED_GROUP_INVALID;
1601416130
for (i = 0; i < ssl->numGroups && !set; i++) {
1601516131
for (j = 0; preferredGroup[j] != WOLFSSL_NAMED_GROUP_INVALID; j++) {
1601616132
if (preferredGroup[j] == ssl->group[i]) {
@@ -16020,12 +16136,10 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
1602016136
}
1602116137
}
1602216138
}
16023-
if (!set)
16024-
namedGroup = WOLFSSL_NAMED_GROUP_INVALID;
1602516139
}
1602616140
else {
1602716141
/* Choose the most preferred group. */
16028-
namedGroup = preferredGroup[0];
16142+
namedGroup = WOLFSSL_KEY_SHARE_DEFAULT_GROUP;
1602916143
}
1603016144
}
1603116145
else {
@@ -16036,9 +16150,15 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
1603616150
if (namedGroup != WOLFSSL_NAMED_GROUP_INVALID) {
1603716151
ret = TLSX_KeyShare_Use(ssl, namedGroup, 0, NULL, NULL,
1603816152
&ssl->extensions);
16039-
if (ret != 0)
16040-
return ret;
1604116153
}
16154+
else {
16155+
/* No suitable key share group found, send no key share to
16156+
* trigger a HRR with the server's preferred group. */
16157+
WOLFSSL_MSG("Sending no key share to trigger HRR");
16158+
ret = TLSX_KeyShare_Empty(ssl);
16159+
}
16160+
if (ret != 0)
16161+
return ret;
1604216162
#endif /* HAVE_SUPPORTED_CURVES */
1604316163

1604416164
#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)

0 commit comments

Comments
 (0)