Proposed changes
'zowe.network.server.tls.curves' is an array a user can set in zowe.yaml to customize crypto curves.
GSK handles curves as a string of 4 digit numbers(IANA numbers) back to back without any spaces or symbols in between.
Its very unfriendly to a human, so a mapping from names to numbers is needed, this is done in tls.h, for now only supported curves are in the array. Unsupported curves are commented and can be moved into this array as and when the supported curves are updated.
Testing:
The curves that are not supported show an error in gsktrace as below, this was tested by adding some unsupported curves into the curve map array.
ERROR set_binary_ecurves(): Elliptical curve 0001 not supported
ERROR set_binary_ecurves(): Elliptical curve 0009 not supported
ERROR set_binary_ecurves(): Elliptical curve 0026 not supported
To show the error in normal logs, only valid curves are in the mapping array. So if any invalid curve is mentioned in zowe.yaml an invalid curve message is logged.
zowe.network.server.tls.curves: ["x25519", "x448", "secp192r1", "secp224r1","prime256v1","secp384r1", "secp521r1"]
,
is converted to number string 0029003000190021002300240025
Proposed changes 'zowe.network.server.tls.curves' is an array a user can set in zowe.yaml to customize crypto curves. GSK handles curves as a string of 4 digit numbers(IANA numbers) back to back without any spaces or symbols in between. Its very unfriendly to a human, so a mapping from names to numbers is needed, this is done in tls.h, for now only supported curves are in the array. Unsupported curves are commented and can be moved into this array as and when the supported curves are updated.
Curves are set during TLS settings initialization using gsk_attribute_set_buffer(), using 'GSK_CLIENT_ECURVE_LIST', see here https://www.ibm.com/docs/en/zos/3.1.0?topic=reference-gsk-attribute-set-buffer for reference,
Currently, the supported curves are here, https://www.ibm.com/docs/en/zos/3.1.0?topic=programming-cipher-suite-definitions#csdcwh__tttcsd
Testing: The curves that are not supported show an error in gsktrace as below, this was tested by adding some unsupported curves into the curve map array. ERROR set_binary_ecurves(): Elliptical curve 0001 not supported ERROR set_binary_ecurves(): Elliptical curve 0009 not supported ERROR set_binary_ecurves(): Elliptical curve 0026 not supported
To show the error in normal logs, only valid curves are in the mapping array. So if any invalid curve is mentioned in zowe.yaml an invalid curve message is logged.
zowe.network.server.tls.curves: ["x25519", "x448", "secp192r1", "secp224r1","prime256v1","secp384r1", "secp521r1"] , is converted to number string 0029003000190021002300240025
This PR addresses Issue: https://github.com/zowe/zss/issues/713
This PR depends on: https://github.com/zowe/zowe-common-c/pull/466
Type of change
Please delete options that are not relevant.
PR Checklist
Please delete options that are not relevant.