diff --git a/CHANGELOG.md b/CHANGELOG.md index 90c517c56..1be9ccbb2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,9 @@ All notable changes to the ZSS package will be documented in this file. +## `3.4.0` +- Enhancement: Curve customization support from array 'zowe.network.server.tls.curves' in zowe.yaml, only curves mentioned in https://www.ibm.com/docs/en/zos/3.1.0?topic=programming-cipher-suite-definitions#csdcwh__tttcsd are supported currently (#721). + ## `3.3.0` - Enhancement: Utility "zis-test" is now used to ensure that ZIS is running and accessible by Zowe before starting ZSS. (zowe/zss#764) - Enhancement: Utility "bind-test" is now available in Zowe and used to validate if each Zowe server can succeed in binding to the user requested TCPIP port at each Zowe startup. (zowe/zss#764) diff --git a/c/zss.c b/c/zss.c index f42ebb517..7c456a5c8 100644 --- a/c/zss.c +++ b/c/zss.c @@ -1167,6 +1167,7 @@ static char* generateCookieNameV2(ConfigManager *configmgr, int port) { #define ENV_AGENT_HTTPS_KEY(key) AGENT_HTTPS_PREFIX key TLS_IANA_CIPHER_MAP(ianaCipherMap) +TLS_IANA_CURVE_MAP(ianaCurveMap) static bool readAgentHttpsSettingsV2(ShortLivedHeap *slh, ConfigManager *configmgr, @@ -1222,6 +1223,50 @@ static bool readAgentHttpsSettingsV2(ShortLivedHeap *slh, } + Json *tlsConfig = NULL; + int tlsGetStatus = cfgGetAnyC(configmgr, ZSS_CFGNAME, &tlsConfig, 4, "zowe", "network", "server", "tls"); + if (tlsGetStatus) { + zowelog(NULL, LOG_COMP_ID_MVD_SERVER, ZOWE_LOG_INFO, "TLS is NOT configured for this ZSS\n"); + } else { + JsonObject *tlsConfigObject = jsonAsObject(tlsConfig); + Json *curveJson = jsonObjectGetPropertyValue(tlsConfigObject, "curves"); + char *curves = NULL; + if (curveJson && jsonIsArray(curveJson)) { + JsonArray *curveArray = jsonObjectGetArray(tlsConfigObject, "curves"); + if (curveArray) { + int count = jsonArrayGetCount(curveArray); + const int curveCharLength = 4; + curves = safeMalloc((sizeof(char) * curveCharLength * count)+1, "curve list"); + if (curves == NULL) { + zowelog(NULL, LOG_COMP_ID_MVD_SERVER, ZOWE_LOG_WARNING, "Failure to allocate memory for Curves\n"); + return false; + } + for (int i = 0; i < count; i++) { + char *ianaName = jsonArrayGetString(curveArray, i); + if (ianaName) { + zowelog(NULL, LOG_COMP_ID_MVD_SERVER, ZOWE_LOG_DEBUG, "curve request=%s\n", ianaName); + CurveMap *curve = (CurveMap *)ianaCurveMap; + bool found = false; + while (curve->groupId != NULL) { + if (!strcmp(ianaName, curve->name)) { + strcat(curves, curve->groupId); + zowelog(NULL, LOG_COMP_ID_MVD_SERVER, ZOWE_LOG_DEBUG, "Curve match=%s\n", curve->groupId); + found = true; + break; + } + ++curve; + } + if (!found) { + zowelog(NULL, LOG_COMP_ID_MVD_SERVER, ZOWE_LOG_WARNING, ZSS_LOG_CURVE_INVALID_MSG, ianaName); + } + } + } + zowelog(NULL, LOG_COMP_ID_MVD_SERVER, ZOWE_LOG_DEBUG, "Curve array is %s\n", curves); + settings->curves = curves; + } + } + } + ECVT *ecvt = getECVT(); /* 2.3 (1020300) no tls 1.3 diff --git a/deps/zowe-common-c b/deps/zowe-common-c index dc9755ff7..ca424c35a 160000 --- a/deps/zowe-common-c +++ b/deps/zowe-common-c @@ -1 +1 @@ -Subproject commit dc9755ff79b38bfe387a80a9c8a6d606ada34dac +Subproject commit ca424c35a651fb0eebfdbf95599a148c81817d57 diff --git a/h/zssLogging.h b/h/zssLogging.h index 0f954b56f..3dc5b55a0 100644 --- a/h/zssLogging.h +++ b/h/zssLogging.h @@ -303,6 +303,12 @@ bool isLogLevelValid(int level); #define ZSS_LOG_CIPHER_INVALID_MSG_TEXT "Requested cipher '%s' not available.\n" #define ZSS_LOG_CIPHER_INVALID_MSG ZSS_LOG_CIPHER_INVALID_MSG_ID" "ZSS_LOG_CIPHER_INVALID_MSG_TEXT +#ifndef ZSS_LOG_CURVE_INVALID_MSG_ID +#define ZSS_LOG_CURVE_INVALID_MSG_ID ZSS_LOG_MSG_PRFX"1067W" +#endif +#define ZSS_LOG_CURVE_INVALID_MSG_TEXT "Requested curve '%s' not supported.\n" +#define ZSS_LOG_CURVE_INVALID_MSG ZSS_LOG_CURVE_INVALID_MSG_ID" "ZSS_LOG_CURVE_INVALID_MSG_TEXT + /* registerProduct */