make-secnet-sites: Add XDH groups

(This was originally only part of a larger commit by Mark Wooding;
I (Ian Jackson) have split it out.)

Signed-off-by: Mark Wooding <mdw@distorted.org.uk>
Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

diff --git a/README.make-secnet-sites b/README.make-secnet-sites
index ad1242bb4e82a0acb8d9755ff4c51d7fb39511c3..a1949065ed2430dfe99d86d3fc0777972bd32b62 100644 (file)
--- a/README.make-secnet-sites
+++ b/README.make-secnet-sites
@@ -188,9 +188,14 @@ INPUT SYNTAX
                location levels.
 
        dh P G
-               Assigns a Diffie--Hellman closure to the `dh' key,
-               constructed as `diffie-hellman(P, G)'. Acceptable at all
-               levels; required at site level.
+       dh GROUP-NAME
+               Assigns a Diffie--Hellman closure to the `dh' key.  If
+               MODULUS and GENERATOR are given, the closure is
+               constructed as `diffie-hellman(P, G)'.  If a GROUP-NAME
+               is given, it must be one of `x25519' or `x448', and the
+               like-named pre-existing DH closure is used.
+
+               Acceptable at all levels; required at site level.
 
        hash HASH-NAME
                Assigns the HASH-NAME to the `hash' key.  The HASH-NAME

diff --git a/make-secnet-sites b/make-secnet-sites
index 4fa29b0c75dab21a4e41d9ec77733fcabbf5b09e..e10f7fcd5270191300ddc53f6c349a3d029d31a4 100755 (executable)
--- a/make-secnet-sites
+++ b/make-secnet-sites
@@ -499,13 +499,16 @@ class networks (basetype):
        def __str__(self):
                return ",".join(map((lambda n: '"%s"'%n), self.set.networks()))
 
-class dhgroup (basetype):
+class trad_dhgroup (basetype):
        "A Diffie-Hellman group"
        def __init__(self,w):
                self.mod=w[1].bignum_16('dh','dh mod')
                self.gen=w[2].bignum_16('dh','dh gen')
        def __str__(self):
                return 'diffie-hellman("%s","%s")'%(self.mod,self.gen)
+def dhgroup(w):
+       if w[1] in ('x25519', 'x448'): return w[1]
+       else: return trad_dhgroup(w)
 
 class hash (basetype):
        "A choice of hash function"