diff --git a/nse_ssl_cert.cc b/nse_ssl_cert.cc index a8d4e0d77..fd5d422d5 100644 --- a/nse_ssl_cert.cc +++ b/nse_ssl_cert.cc @@ -443,24 +443,27 @@ static const char *pkey_type_to_string(int type) } int lua_push_ecdhparams(lua_State *L, EVP_PKEY *pubkey) { -#if OPENSSL_VERSION_NUMBER >= 0x30000000L - char tmp[64] = {0}; - size_t len = 0; +#ifdef OPENSSL_NO_EC + return 0; +#else /* This structure (ecdhparams.curve_params) comes from tls.lua */ lua_createtable(L, 0, 1); /* ecdhparams */ lua_createtable(L, 0, 2); /* curve_params */ + + /* According to RFC 5480 section 2.1.1, explicit curves must not be used with + X.509. This may change in the future, but for now it doesn't seem worth it + to add in code to extract the extra parameters. */ +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + char tmp[64] = {0}; + size_t len = 0; if (EVP_PKEY_get_utf8_string_param(pubkey, OSSL_PKEY_PARAM_GROUP_NAME, tmp, sizeof(tmp), &len)) { lua_pushlstring(L, tmp, len); lua_setfield(L, -2, "curve"); lua_pushliteral(L, "namedcurve"); - lua_setfield(L, -2, "ec_curve_type"); } else if (EVP_PKEY_get_utf8_string_param(pubkey, OSSL_PKEY_PARAM_EC_FIELD_TYPE, tmp, sizeof(tmp), &len)) { - /* According to RFC 5480 section 2.1.1, explicit curves must not be used with - X.509. This may change in the future, but for now it doesn't seem worth it - to add in code to extract the extra parameters. */ if (0 == strncmp(tmp, "prime-field", len)) { lua_pushliteral(L, "explicit_prime"); } @@ -471,42 +474,21 @@ int lua_push_ecdhparams(lua_State *L, EVP_PKEY *pubkey) { /* Something weird happened. */ lua_pushlstring(L, tmp, len); } - lua_setfield(L, -2, "ec_curve_type"); } - lua_setfield(L, -2, "curve_params"); - return 1; -#elif !defined(OPENSSL_NO_EC) +#else // OPENSSL_VERSION_NUMBER < 0x30000000L EC_KEY *ec_key = EVP_PKEY_get1_EC_KEY(pubkey); const EC_GROUP *group = EC_KEY_get0_group(ec_key); int nid; - /* This structure (ecdhparams.curve_params) comes from tls.lua */ - lua_createtable(L, 0, 1); /* ecdhparams */ - lua_createtable(L, 0, 2); /* curve_params */ if ((nid = EC_GROUP_get_curve_name(group)) != 0) { lua_pushstring(L, OBJ_nid2sn(nid)); lua_setfield(L, -2, "curve"); lua_pushstring(L, "namedcurve"); - lua_setfield(L, -2, "ec_curve_type"); } else { - /* According to RFC 5480 section 2.1.1, explicit curves must not be used with - X.509. This may change in the future, but for now it doesn't seem worth it - to add in code to extract the extra parameters. */ #if defined(LIBRESSL_VERSION_NUMBER) /* LibreSSL doesn't have EC_GROUP_get_field_type, and explicit curves are rare. * Just mark as UNKNOWN. */ lua_pushstring(L, "UNKNOWN"); -#elif HAVE_OPAQUE_STRUCTS - nid = EC_GROUP_get_field_type(group); - if (nid == NID_X9_62_prime_field) { - lua_pushstring(L, "explicit_prime"); - } - else if (nid == NID_X9_62_characteristic_two_field) { - lua_pushstring(L, "explicit_char2"); - } - else { - lua_pushstring(L, "UNKNOWN"); - } #else nid = EC_METHOD_get_field_type(EC_GROUP_method_of(group)); if (nid == NID_X9_62_prime_field) { @@ -519,14 +501,13 @@ int lua_push_ecdhparams(lua_State *L, EVP_PKEY *pubkey) { lua_pushstring(L, "UNKNOWN"); } #endif - lua_setfield(L, -2, "ec_curve_type"); } - lua_setfield(L, -2, "curve_params"); EC_KEY_free(ec_key); - return 1; -#else - return 0; #endif + lua_setfield(L, -2, "ec_curve_type"); + lua_setfield(L, -2, "curve_params"); + return 1; +#endif // OPENSSL_NO_EC } static int parse_ssl_cert(lua_State *L, X509 *cert);