src/wolfSSL/src/internal.c
static int VerifyServerSuite(WOLFSSL* ssl, word16 idx)
    {
        int  haveRSA = !ssl->options.haveStaticECC;
        int  havePSK = 0;
        byte first;
        byte second;

        WOLFSSL_ENTER("VerifyServerSuite");

        if (ssl->suites == NULL) {
            WOLFSSL_MSG("Suites pointer error");
            return 0;
        }

        first   = ssl->suites->suites[idx];
        second  = ssl->suites->suites[idx+1];

        #ifndef NO_PSK
            havePSK = ssl->options.havePSK;
        #endif

        if (ssl->options.haveNTRU)
            haveRSA = 0;

        if (CipherRequires(first, second, REQUIRES_RSA)) {
            WOLFSSL_MSG("Requires RSA");
            if (haveRSA == 0) {
                WOLFSSL_MSG("Don't have RSA");
                return 0;
            }
        }

        if (CipherRequires(first, second, REQUIRES_DHE)) {
            WOLFSSL_MSG("Requires DHE");
            if (ssl->options.haveDH == 0) {
                WOLFSSL_MSG("Don't have DHE");
                return 0;
            }
        }

        if (CipherRequires(first, second, REQUIRES_ECC)) {
            WOLFSSL_MSG("Requires ECC");
            if (ssl->options.haveECC == 0) {
                WOLFSSL_MSG("Don't have ECC");
                return 0;
            }
        }

        if (CipherRequires(first, second, REQUIRES_ECC_STATIC)) {
            WOLFSSL_MSG("Requires static ECC");
            if (ssl->options.haveStaticECC == 0) {
                WOLFSSL_MSG("Don't have static ECC");
                return 0;
            }
        }

        if (CipherRequires(first, second, REQUIRES_PSK)) {
            WOLFSSL_MSG("Requires PSK");
            if (havePSK == 0) {
                WOLFSSL_MSG("Don't have PSK");
                return 0;
            }
        }

        if (CipherRequires(first, second, REQUIRES_NTRU)) {
            WOLFSSL_MSG("Requires NTRU");
            if (ssl->options.haveNTRU == 0) {
                WOLFSSL_MSG("Don't have NTRU");
                return 0;
            }
        }

        if (CipherRequires(first, second, REQUIRES_RSA_SIG)) {
            WOLFSSL_MSG("Requires RSA Signature");
            if (ssl->options.side == WOLFSSL_SERVER_END &&
                                           ssl->options.haveECDSAsig == 1) {
                WOLFSSL_MSG("Don't have RSA Signature");
                return 0;
            }
        }

#ifdef HAVE_SUPPORTED_CURVES
        if (!TLSX_ValidateEllipticCurves(ssl, first, second)) {
            WOLFSSL_MSG("Don't have matching curves");
                return 0;
        }
#endif

        /* ECCDHE is always supported if ECC on */

#ifdef HAVE_QSH
        /* need to negotiate a classic suite in addition to TLS_QSH */
        if (first == QSH_BYTE && second == TLS_QSH) {
            if (TLSX_SupportExtensions(ssl)) {
                ssl->options.haveQSH = 1; /* matched TLS_QSH */
            }
            else {
                WOLFSSL_MSG("Version of SSL connection does not support TLS_QSH");
            }
            return 0;
        }
#endif

        return 1;
    }
/* Make sure server cert/key are valid for this suite, true on success */
Make sure server cert/key are valid for this suite, true on success
Make sure server cert / key are valid for this suite true on success
static int VerifyServerSuite(WOLFSSL* ssl, word16 idx)
    {
        int  haveRSA = !ssl->options.haveStaticECC;
        int  havePSK = 0;
        byte first;
        byte second;
        WOLFSSL_ENTER("VerifyServerSuite");
        if (ssl->suites == NULL) {
            WOLFSSL_MSG("Suites pointer error");
            return 0;
        }
        first   = ssl->suites->suites[idx];
        second  = ssl->suites->suites[idx+1];
        #ifndef NO_PSK
            havePSK = ssl->options.havePSK;
        #endif
        if (ssl->options.haveNTRU)
            haveRSA = 0;
        if (CipherRequires(first, second, REQUIRES_RSA)) {
            WOLFSSL_MSG("Requires RSA");
            if (haveRSA == 0) {
                WOLFSSL_MSG("Don't have RSA");
                return 0;
            }
        }
        if (CipherRequires(first, second, REQUIRES_DHE)) {
            WOLFSSL_MSG("Requires DHE");
            if (ssl->options.haveDH == 0) {
                WOLFSSL_MSG("Don't have DHE");
                return 0;
            }
        }
        if (CipherRequires(first, second, REQUIRES_ECC)) {
            WOLFSSL_MSG("Requires ECC");
            if (ssl->options.haveECC == 0) {
                WOLFSSL_MSG("Don't have ECC");
                return 0;
            }
        }
        if (CipherRequires(first, second, REQUIRES_ECC_STATIC)) {
            WOLFSSL_MSG("Requires static ECC");
            if (ssl->options.haveStaticECC == 0) {
                WOLFSSL_MSG("Don't have static ECC");
                return 0;
            }
        }
        if (CipherRequires(first, second, REQUIRES_PSK)) {
            WOLFSSL_MSG("Requires PSK");
            if (havePSK == 0) {
                WOLFSSL_MSG("Don't have PSK");
                return 0;
            }
        }
        if (CipherRequires(first, second, REQUIRES_NTRU)) {
            WOLFSSL_MSG("Requires NTRU");
            if (ssl->options.haveNTRU == 0) {
                WOLFSSL_MSG("Don't have NTRU");
                return 0;
            }
        }
        if (CipherRequires(first, second, REQUIRES_RSA_SIG)) {
            WOLFSSL_MSG("Requires RSA Signature");
            if (ssl->options.side == WOLFSSL_SERVER_END &&
                                           ssl->options.haveECDSAsig == 1) {
                WOLFSSL_MSG("Don't have RSA Signature");
                return 0;
            }
        }
#ifdef HAVE_SUPPORTED_CURVES
        if (!TLSX_ValidateEllipticCurves(ssl, first, second)) {
            WOLFSSL_MSG("Don't have matching curves");
                return 0;
        }
#endif
#ifdef HAVE_QSH
        if (first == QSH_BYTE && second == TLS_QSH) {
            if (TLSX_SupportExtensions(ssl)) {
                ssl->options.haveQSH = 1; 
            }
            else {
                WOLFSSL_MSG("Version of SSL connection does not support TLS_QSH");
            }
            return 0;
        }
#endif
        return 1;
    }
static int VerifyServerSuite ( WOLFSSL * ssl , word16 idx ) { int haveRSA = ! ssl -> options . haveStaticECC ; int havePSK = 0 ; byte first ; byte second ; WOLFSSL_ENTER ( " " ) ; if ( ssl -> suites == NULL ) { WOLFSSL_MSG ( " " ) ; return 0 ; } first = ssl -> suites -> suites [ idx ] ; second = ssl -> suites -> suites [ idx + 1 ] ; #ifndef NO_PSK havePSK = ssl -> options . havePSK ; #endif if ( ssl -> options . haveNTRU ) haveRSA = 0 ; if ( CipherRequires ( first , second , REQUIRES_RSA ) ) { WOLFSSL_MSG ( " " ) ; if ( haveRSA == 0 ) { WOLFSSL_MSG ( " " ) ; return 0 ; } } if ( CipherRequires ( first , second , REQUIRES_DHE ) ) { WOLFSSL_MSG ( " " ) ; if ( ssl -> options . haveDH == 0 ) { WOLFSSL_MSG ( " " ) ; return 0 ; } } if ( CipherRequires ( first , second , REQUIRES_ECC ) ) { WOLFSSL_MSG ( " " ) ; if ( ssl -> options . haveECC == 0 ) { WOLFSSL_MSG ( " " ) ; return 0 ; } } if ( CipherRequires ( first , second , REQUIRES_ECC_STATIC ) ) { WOLFSSL_MSG ( " " ) ; if ( ssl -> options . haveStaticECC == 0 ) { WOLFSSL_MSG ( " " ) ; return 0 ; } } if ( CipherRequires ( first , second , REQUIRES_PSK ) ) { WOLFSSL_MSG ( " " ) ; if ( havePSK == 0 ) { WOLFSSL_MSG ( " " ) ; return 0 ; } } if ( CipherRequires ( first , second , REQUIRES_NTRU ) ) { WOLFSSL_MSG ( " " ) ; if ( ssl -> options . haveNTRU == 0 ) { WOLFSSL_MSG ( " " ) ; return 0 ; } } if ( CipherRequires ( first , second , REQUIRES_RSA_SIG ) ) { WOLFSSL_MSG ( " " ) ; if ( ssl -> options . side == WOLFSSL_SERVER_END && ssl -> options . haveECDSAsig == 1 ) { WOLFSSL_MSG ( " " ) ; return 0 ; } } #ifdef HAVE_SUPPORTED_CURVES if ( ! TLSX_ValidateEllipticCurves ( ssl , first , second ) ) { WOLFSSL_MSG ( " " ) ; return 0 ; } #endif #ifdef HAVE_QSH if ( first == QSH_BYTE && second == TLS_QSH ) { if ( TLSX_SupportExtensions ( ssl ) ) { ssl -> options . haveQSH = 1 ; } else { WOLFSSL_MSG ( " " ) ; } return 0 ; } #endif return 1 ; }
Make sure server cert/key are valid for this suite, true on success
Make sure server cert / key are valid for this suite true on success
/* ECCDHE is always supported if ECC on */ /* need to negotiate a classic suite in addition to TLS_QSH */ /* matched TLS_QSH */