zowe / zss

Zowe System Services Server for enabling low-level microservices
Eclipse Public License 2.0
13 stars 45 forks source link

Curve customization support: extract curve array from yaml and make a list of mapped number strings #721

Open Gautham-coder opened 1 month ago

Gautham-coder commented 1 month ago

Proposed changes 'zowe.network.server.tls.curves' is an array a user can set in zowe.yaml to customize crypto curves. GSK handles curves as a string of 4 digit numbers(IANA numbers) back to back without any spaces or symbols in between. Its very unfriendly to a human, so a mapping from names to numbers is needed, this is done in tls.h, for now only supported curves are in the array. Unsupported curves are commented and can be moved into this array as and when the supported curves are updated.

Curves are set during TLS settings initialization using gsk_attribute_set_buffer(), using 'GSK_CLIENT_ECURVE_LIST', see here https://www.ibm.com/docs/en/zos/3.1.0?topic=reference-gsk-attribute-set-buffer for reference,

Currently, the supported curves are here, https://www.ibm.com/docs/en/zos/3.1.0?topic=programming-cipher-suite-definitions#csdcwh__tttcsd

Testing: The curves that are not supported show an error in gsktrace as below, this was tested by adding some unsupported curves into the curve map array. ERROR set_binary_ecurves(): Elliptical curve 0001 not supported ERROR set_binary_ecurves(): Elliptical curve 0009 not supported ERROR set_binary_ecurves(): Elliptical curve 0026 not supported

To show the error in normal logs, only valid curves are in the mapping array. So if any invalid curve is mentioned in zowe.yaml an invalid curve message is logged.

zowe.network.server.tls.curves: ["x25519", "x448", "secp192r1", "secp224r1","prime256v1","secp384r1", "secp521r1"] , is converted to number string 0029003000190021002300240025

This PR addresses Issue: https://github.com/zowe/zss/issues/713

This PR depends on: https://github.com/zowe/zowe-common-c/pull/466

Type of change

Please delete options that are not relevant.

PR Checklist

Please delete options that are not relevant.