Summary

Extends the Fedora system crypto-policy support (added in #8205) to parse config files in the same key=value format as OpenSSL's opensslcnf.config backend, and to actually call wolfSSL API to enforce every policy parameter read from the file.

What was missing (fedora-crypto-policies work item #60)

The original implementation only parsed a single-line @SECLEVEL=N:cipher_string format and applied the cipher list. It did not:

• Parse an explicit MinProtocol = TLSv1.2 key
• Parse a Ciphersuites = ... key for TLS 1.3 suites
• Use the same config format as opensslcnf.config so that fedora-crypto-policies can generate a wolfssl.config with the same tooling

Changes

wolfssl/internal.h

• Add explicitMinDowngrade and explicitMinDtlsDowngrade fields to SystemCryptoPolicy to store values from MinProtocol / DTLS.MinProtocol keys.
• Add cipherSuites[] field for TLS 1.3 Ciphersuites key.
• Add MAX_WOLFSSL_CRYPTO_POLICY_FILE_SIZE = 4096 for multi-line configs.

src/ssl.c

• crypto_policy_parse(): detects legacy @SECLEVEL= format (fully backward-compatible) or new key=value format.
• New key=value parser handles: MinProtocol, DTLS.MinProtocol, CipherString, Ciphersuites. Unknown keys silently ignored.
• wolfSSL_crypto_policy_enable(): allocates a temporary buffer with XMALLOC so multi-line files up to 4 KiB are accepted.
• wolfSSL_CTX_new_ex(): also applies Ciphersuites (TLS 1.3) when set.
• New internal accessors: wolfSSL_crypto_policy_get_min_downgrade(), wolfSSL_crypto_policy_get_min_dtls_downgrade(), wolfSSL_crypto_policy_get_ciphersuites().

src/internal.c

• wolfSSL_crypto_policy_init_ctx(): after deriving minDowngrade from @SECLEVEL, overrides it with the explicit MinProtocol value if one was provided.

Example files — updated to new format:

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = @SECLEVEL=2:EECDH:kRSA:EDH:PSK:DHEPSK:ECDHEPSK:RSAPSK:!RC4:!eNULL:!aNULL
Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

Backward compatibility

The old single-line @SECLEVEL=N:cipher_string format still works — wolfSSL_crypto_policy_enable_buffer() with the legacy format passes all existing tests unchanged.

Test plan

• Existing test_wolfSSL_crypto_policy (buffer path with @SECLEVEL= strings) continues to pass
• wolfSSL_crypto_policy_enable() with new-format files sets correct secLevel, minDowngrade, cipher list
• DTLS.MinProtocol sets minDowngrade for DTLS contexts
• Unknown keys in config are silently ignored

🤖 Generated with Claude Code