preliminary support for pkey:setParameters

1 files changed, 470 insertions, 31 deletions

diff --git a/src/openssl.c b/src/openssl.c
index 71aaed4..ed1fecb 100644
--- a/src/openssl.c
+++ b/src/openssl.c
@@ -148,6 +148,7 @@
 
 #define BIGNUM_CLASS     "BIGNUM*"
 #define PKEY_CLASS       "EVP_PKEY*"
+#define EC_GROUP_CLASS   "EVP_GROUP*"
 #define X509_NAME_CLASS  "X509_NAME*"
 #define X509_GENS_CLASS  "GENERAL_NAMES*"
 #define X509_EXT_CLASS   "X509_EXTENSION*"
@@ -336,10 +337,11 @@ static int checkoption(lua_State *L, int index, const char *def, const char *con
 #define X509_ANY 0x01
 #define X509_PEM 0x02
 #define X509_DER 0x04
+#define X509_TXT 0x08 /* "pretty" */
 #define X509_ALL (X509_PEM|X509_DER)
 
 static int optencoding(lua_State *L, int index, const char *def, int allow) {
-        static const char *const opts[] = { "*", "pem", "der", NULL };
+        static const char *const opts[] = { "*", "pem", "der", "pretty", NULL };
         int type = 0;
 
         switch (checkoption(L, index, def, opts)) {
@@ -352,6 +354,9 @@ static int optencoding(lua_State *L, int index, const char *def, int allow) {
         case 2:
                 type = X509_DER;
                 break;
+        case 3:
+                type = X509_TXT;
+                break;
         }
 
         if (!(type & allow))
@@ -608,6 +613,21 @@ static _Bool auxS_txt2obj(ASN1_OBJECT **obj, const char *txt) {
         }
 } /* auxS_txt2obj() */
 
+static _Bool auxS_txt2nid(int *nid, const char *txt) {
+        /* try builtins first */
+        if ((*nid = OBJ_sn2nid(txt)) != NID_undef
+        ||  (*nid = OBJ_ln2nid(txt)) != NID_undef) {
+                return 1;
+        }
+
+        /* OBJ_txt2nid creates a temporary ASN1_OBJECT; call sparingly */
+        if (auxS_isoid(txt) && (*nid = OBJ_txt2nid(txt)) != NID_undef) {
+                return 1;
+        }
+
+        return 0;
+} /* auxS_txt2nid() */
+
 
 /*
  * Auxiliary Lua API routines
@@ -1577,6 +1597,11 @@ static BIGNUM *bn_dup(lua_State *L, const BIGNUM *src) {
 } /* bn_dup() */
 
 
+static BIGNUM *bn_dup_nil(lua_State *L, const BIGNUM *src) {
+        return (src)? bn_dup(L, src) : (lua_pushnil(L), (BIGNUM *)0);
+} /* bn_dup_nil() */
+
+
 #define checkbig_(a, b, c, ...) checkbig((a), (b), (c))
 #define checkbig(...) checkbig_(__VA_ARGS__, &(_Bool){ 0 }, 0)
 
@@ -1976,7 +2001,7 @@ static int bn__gc(lua_State *L) {
         BIGNUM **ud = luaL_checkudata(L, 1, BIGNUM_CLASS);
 
         if (*ud) {
-                BN_free(*ud);
+                BN_clear_free(*ud);
                 *ud = NULL;
         }
 
@@ -2222,8 +2247,8 @@ static int pk_new(lua_State *L) {
                 }
 
                 if (loadfield(L, 1, "curve", LUA_TSTRING, &id)) {
-                        curve = OBJ_sn2nid(id);
-                        luaL_argcheck(L, curve != NID_undef, 1, lua_pushfstring(L, "%s: invalid curve", id));
+                        if (!auxS_txt2nid(&curve, id))
+                                luaL_argerror(L, 1, lua_pushfstring(L, "%s: invalid curve", id));
                 }
 
 creat:
@@ -2686,8 +2711,14 @@ enum pk_param  {
         PK_DH_PUB_KEY,
         PK_DH_PRIV_KEY,
 
-#define PK_EC_OPTLIST { "pub_key", "priv_key", NULL }
-#define PK_EC_OPTOFFSET PK_EC_PUB_KEY
+/*
+ * NB: group MUST come before pub_key as setting pub_key requires the group
+ * to be defined. :setParameters will do the requested assignments in the
+ * order defined by by this array.
+ */
+#define PK_EC_OPTLIST { "group", "pub_key", "priv_key", NULL }
+#define PK_EC_OPTOFFSET PK_EC_GROUP
+        PK_EC_GROUP,
         PK_EC_PUB_KEY,
         PK_EC_PRIV_KEY,
 }; /* enum pk_param */
@@ -2712,6 +2743,10 @@ static int pk_checkparam(lua_State *L, int type, int index) {
         }
 } /* pk_checkparam() */
 
+#ifndef OPENSSL_NO_EC
+static EC_GROUP *ecg_dup_nil(lua_State *, const EC_GROUP *);
+#endif
+
 static void pk_pushparam(lua_State *L, void *_key, enum pk_param which) {
         union {
                 RSA *rsa;
@@ -2725,95 +2760,246 @@ static void pk_pushparam(lua_State *L, void *_key, enum pk_param which) {
         switch (which) {
         case PK_RSA_N:
                 /* RSA public modulus n */
-                bn_dup(L, key.rsa->n);
+                bn_dup_nil(L, key.rsa->n);
 
                 break;
         case PK_RSA_E:
                 /* RSA public exponent e */
-                bn_dup(L, key.rsa->e);
+                bn_dup_nil(L, key.rsa->e);
 
                 break;
         case PK_RSA_D:
                 /* RSA secret exponent d */
-                bn_dup(L, key.rsa->d);
+                bn_dup_nil(L, key.rsa->d);
 
                 break;
         case PK_RSA_P:
                 /* RSA secret prime p */
-                bn_dup(L, key.rsa->p);
+                bn_dup_nil(L, key.rsa->p);
 
                 break;
         case PK_RSA_Q:
                 /* RSA secret prime q with p < q */
-                bn_dup(L, key.rsa->q);
+                bn_dup_nil(L, key.rsa->q);
 
                 break;
         case PK_RSA_DMP1:
                 /* exponent1 */
-                bn_dup(L, key.rsa->dmp1);
+                bn_dup_nil(L, key.rsa->dmp1);
 
                 break;
         case PK_RSA_DMQ1:
                 /* exponent2 */
-                bn_dup(L, key.rsa->dmq1);
+                bn_dup_nil(L, key.rsa->dmq1);
 
                 break;
         case PK_RSA_IQMP:
                 /* coefficient */
-                bn_dup(L, key.rsa->iqmp);
+                bn_dup_nil(L, key.rsa->iqmp);
 
                 break;
         case PK_DSA_P:
-                bn_dup(L, key.dsa->p);
+                bn_dup_nil(L, key.dsa->p);
 
                 break;
         case PK_DSA_Q:
-                bn_dup(L, key.dsa->q);
+                bn_dup_nil(L, key.dsa->q);
 
                 break;
         case PK_DSA_G:
-                bn_dup(L, key.dsa->g);
+                bn_dup_nil(L, key.dsa->g);
 
                 break;
         case PK_DSA_PUB_KEY:
-                bn_dup(L, key.dsa->pub_key);
+                bn_dup_nil(L, key.dsa->pub_key);
 
                 break;
         case PK_DSA_PRIV_KEY:
-                bn_dup(L, key.dsa->priv_key);
+                bn_dup_nil(L, key.dsa->priv_key);
 
                 break;
         case PK_DH_P:
-                bn_dup(L, key.dh->p);
+                bn_dup_nil(L, key.dh->p);
 
                 break;
         case PK_DH_G:
-                bn_dup(L, key.dh->g);
+                bn_dup_nil(L, key.dh->g);
 
                 break;
         case PK_DH_PUB_KEY:
-                bn_dup(L, key.dh->pub_key);
+                bn_dup_nil(L, key.dh->pub_key);
 
                 break;
         case PK_DH_PRIV_KEY:
-                bn_dup(L, key.dh->priv_key);
+                bn_dup_nil(L, key.dh->priv_key);
 
                 break;
 #ifndef OPENSSL_NO_EC
+        case PK_EC_GROUP:
+                ecg_dup_nil(L, EC_KEY_get0_group(key.ec));
+
+                break;
         case PK_EC_PUB_KEY: {
                 const EC_GROUP *group;
-                const EC_POINT *public_key;
+                const EC_POINT *pub_key;
 
-                if (!(group = EC_KEY_get0_group(key.ec)) || !(public_key = EC_KEY_get0_public_key(key.ec)))
-                        goto sslerr;
-                bn_dup(L, EC_POINT_point2bn(group, public_key, EC_KEY_get_conv_form(key.ec), NULL, getctx(L)));
+                if ((group = EC_KEY_get0_group(key.ec)) && (pub_key = EC_KEY_get0_public_key(key.ec))) {
+                        bn_dup_nil(L, EC_POINT_point2bn(group, pub_key, EC_KEY_get_conv_form(key.ec), NULL, getctx(L)));
+                } else {
+                        lua_pushnil(L);
+                }
 
                 break;
         }
         case PK_EC_PRIV_KEY:
-                bn_dup(L, EC_KEY_get0_private_key(key.ec));
+                bn_dup_nil(L, EC_KEY_get0_private_key(key.ec));
+
+                break;
+#endif
+        default:
+                luaL_error(L, "%d: invalid EVP_PKEY parameter", which);
+        }
+
+        return;
+} /* pk_pushparam() */
+
+
+static _Bool pk_bn_set_nothrow(BIGNUM **dst, BIGNUM *src) {
+        BIGNUM *tmp;
+
+        if (!(tmp = BN_dup(src)))
+                return 0;
+
+        if (*dst)
+                BN_clear_free(*dst);
+        *dst = tmp;
+
+        return 1;
+} /* pk_bn_set_nothrow() */
+
+#define pk_bn_set(L, dst, index) do { \
+        BIGNUM *n = checkbig((L), (index)); \
+        if (!pk_bn_set_nothrow((dst), n)) \
+                goto sslerr; \
+} while (0)
+
+static void pk_setparam(lua_State *L, void *_key, enum pk_param which, int index) {
+        union {
+                RSA *rsa;
+                DH *dh;
+                DSA *dsa;
+#ifndef OPENSSL_NO_EC
+                EC_KEY *ec;
+#endif
+        } key = { _key };
+
+        switch (which) {
+        case PK_RSA_N:
+                pk_bn_set(L, &key.rsa->n, index);
+
+                break;
+        case PK_RSA_E:
+                pk_bn_set(L, &key.rsa->e, index);
+
+                break;
+        case PK_RSA_D:
+                pk_bn_set(L, &key.rsa->d, index);
+
+                break;
+        case PK_RSA_P:
+                pk_bn_set(L, &key.rsa->p, index);
+
+                break;
+        case PK_RSA_Q:
+                pk_bn_set(L, &key.rsa->q, index);
 
                 break;
+        case PK_RSA_DMP1:
+                pk_bn_set(L, &key.rsa->dmp1, index);
+
+                break;
+        case PK_RSA_DMQ1:
+                pk_bn_set(L, &key.rsa->dmq1, index);
+
+                break;
+        case PK_RSA_IQMP:
+                pk_bn_set(L, &key.rsa->iqmp, index);
+
+                break;
+        case PK_DSA_P:
+                pk_bn_set(L, &key.dsa->p, index);
+
+                break;
+        case PK_DSA_Q:
+                pk_bn_set(L, &key.dsa->q, index);
+
+                break;
+        case PK_DSA_G:
+                pk_bn_set(L, &key.dsa->g, index);
+
+                break;
+        case PK_DSA_PUB_KEY:
+                pk_bn_set(L, &key.dsa->pub_key, index);
+
+                break;
+        case PK_DSA_PRIV_KEY:
+                pk_bn_set(L, &key.dsa->priv_key, index);
+
+                break;
+        case PK_DH_P:
+                pk_bn_set(L, &key.dh->p, index);
+
+                break;
+        case PK_DH_G:
+                pk_bn_set(L, &key.dh->g, index);
+
+                break;
+        case PK_DH_PUB_KEY:
+                pk_bn_set(L, &key.dh->pub_key, index);
+
+                break;
+        case PK_DH_PRIV_KEY:
+                pk_bn_set(L, &key.dh->priv_key, index);
+
+                break;
+#ifndef OPENSSL_NO_EC
+        case PK_EC_GROUP: {
+                const EC_GROUP *group = checksimple(L, index, EC_GROUP_CLASS);
+
+                if (!EC_KEY_set_group(key.ec, group))
+                        goto sslerr;
+
+                break;
+        }
+        case PK_EC_PUB_KEY: {
+                const BIGNUM *n = checkbig(L, index);
+                const EC_GROUP *group;
+                EC_POINT *pub_key;
+                _Bool okay;
+
+                if (!(group = EC_KEY_get0_group(key.ec)))
+                        luaL_error(L, "unable to set EC pub_key (no group defined)");
+
+                if (!(pub_key = EC_POINT_bn2point(group, n, NULL, getctx(L))))
+                        goto sslerr;
+
+                /* NB: copies key, doesn't share or take ownership */
+                okay = EC_KEY_set_public_key(key.ec, pub_key);
+                EC_POINT_free(pub_key);
+                if (!okay)
+                        goto sslerr;
+
+                break;
+        }
+        case PK_EC_PRIV_KEY: {
+                const BIGNUM *n = checkbig(L, index);
+
+                /* NB: copies key, doesn't share or take ownership */
+                if (!EC_KEY_set_private_key(key.ec, n))
+                        goto sslerr;
+
+                break;
+        }
 #endif
         default:
                 luaL_error(L, "%d: invalid EVP_PKEY parameter", which);
@@ -2821,10 +3007,10 @@ static void pk_pushparam(lua_State *L, void *_key, enum pk_param which) {
 
         return;
 sslerr:
-        auxL_error(L, auxL_EOPENSSL, "pkey:getParameters");
+        auxL_error(L, auxL_EOPENSSL, "pkey:setParameters");
 
         return;
-} /* pk_pushparam() */
+} /* pk_setparam() */
 
 
 static int pk_getParameters(lua_State *L) {
@@ -2862,7 +3048,7 @@ static int pk_getParameters(lua_State *L) {
 
                         break;
                 default:
-                        return luaL_error(L, "%d: unsupported EVP_PKEY base type", EVP_PKEY_base_id(key));
+                        return luaL_error(L, "%d: unsupported EVP_PKEY base type", type);
                 }
 
                 /*
@@ -2908,6 +3094,56 @@ sslerr:
 } /* pk_getParameters() */
 
 
+static int pk_setParameters(lua_State *L) {
+        EVP_PKEY *_key = checksimple(L, 1, PKEY_CLASS);
+        int type = EVP_PKEY_base_id(_key);
+        void *key;
+        const char *const *optlist;
+        int optindex, optoffset;
+
+        luaL_checktype(L, 2, LUA_TTABLE);
+
+        if (!(key = EVP_PKEY_get0(_key)))
+                goto sslerr;
+
+        switch (type) {
+        case EVP_PKEY_RSA:
+                optlist = pk_rsa_optlist;
+                optoffset = PK_RSA_OPTOFFSET;
+
+                break;
+        case EVP_PKEY_DSA:
+                optlist = pk_dsa_optlist;
+                optoffset = PK_DSA_OPTOFFSET;
+
+                break;
+        case EVP_PKEY_DH:
+                optlist = pk_dh_optlist;
+                optoffset = PK_DH_OPTOFFSET;
+
+                break;
+        case EVP_PKEY_EC:
+                optlist = pk_ec_optlist;
+                optoffset = PK_EC_OPTOFFSET;
+
+                break;
+        default:
+                return luaL_error(L, "%d: unsupported EVP_PKEY base type", type);
+        }
+
+        for (optindex = 0; optlist[optindex]; optindex++) {
+                if (getfield(L, 2, optlist[optindex])) {
+                        pk_setparam(L, key, optindex + optoffset, -1);
+                        lua_pop(L, 1);
+                }
+        }
+
+        return 0;
+sslerr:
+        return auxL_error(L, auxL_EOPENSSL, "pkey:setParameters");
+} /* pk_setParameters() */
+
+
 static int pk__tostring(lua_State *L) {
         EVP_PKEY *key = checksimple(L, 1, PKEY_CLASS);
         int type = optencoding(L, 2, "pem", X509_PEM|X509_DER);
@@ -2954,6 +3190,7 @@ static const luaL_Reg pk_methods[] = {
         { "verify",        &pk_verify },
         { "toPEM",         &pk_toPEM },
         { "getParameters", &pk_getParameters },
+        { "setParameters", &pk_setParameters },
         { NULL,            NULL },
 };
 
@@ -2988,6 +3225,205 @@ int luaopen__openssl_pubkey(lua_State *L) {
 
 
 /*
+ * EC_GROUP - openssl.ec.group
+ *
+ * NOTE: Ensure copy-by-value semantics when passing EC_GROUP objects as it
+ * doesn't support reference counting. The only persistent reference should
+ * be the Lua userdata value.
+ *
+ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
+
+#ifndef OPENSSL_NO_EC
+
+static EC_GROUP *ecg_dup(lua_State *L, const EC_GROUP *src) {
+        EC_GROUP **ud = prepsimple(L, EC_GROUP_CLASS);
+
+        if (!(*ud = EC_GROUP_dup(src)))
+                auxL_error(L, auxL_EOPENSSL, "group");
+
+        return *ud;
+} /* ecg_dup() */
+
+static EC_GROUP *ecg_dup_nil(lua_State *L, const EC_GROUP *src) {
+        return (src)? ecg_dup(L, src) : (lua_pushnil(L), (EC_GROUP *)0);
+} /* ecg_dup_nil() */
+
+static EC_GROUP *ecg_new_by_nid(int nid) {
+        EC_GROUP *group;
+
+        if (!(group = EC_GROUP_new_by_curve_name(nid)))
+                return NULL;
+
+        /* flag as named for benefit of __tostring */
+        EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
+
+        /* compressed points may be patented */
+        EC_GROUP_set_point_conversion_form(group, POINT_CONVERSION_UNCOMPRESSED);
+
+        return group;
+} /* ecg_new_by_nid() */
+
+static EC_GROUP *ecg_push_by_nid(lua_State *L, int nid) {
+        EC_GROUP **group = prepsimple(L, EC_GROUP_CLASS);
+
+        if (!(*group = EC_GROUP_new_by_curve_name(nid)))
+                goto oops;
+
+        EC_GROUP_set_asn1_flag(*group, OPENSSL_EC_NAMED_CURVE);
+
+        /* compressed points may be patented */
+        EC_GROUP_set_point_conversion_form(*group, POINT_CONVERSION_UNCOMPRESSED);
+
+        return *group;
+oops:
+        lua_pop(L, 1);
+
+        return NULL;
+} /* ecg_push_by_nid() */
+
+static int ecg_new(lua_State *L) {
+        switch (lua_type(L, 1)) {
+        case LUA_TSTRING: {
+                const char *data;
+                size_t datalen;
+                int nid, type, goterr;
+                BIO *bio;
+                EC_GROUP **group;
+
+                data = luaL_checklstring(L, 1, &datalen);
+
+                if (auxS_txt2nid(&nid, data)) {
+                        if (!ecg_push_by_nid(L, nid))
+                                goto sslerr;
+                } else {
+                        type = optencoding(L, 2, "*", X509_ANY|X509_PEM|X509_DER);
+                        group = prepsimple(L, EC_GROUP_CLASS);
+
+                        luaL_argcheck(L, datalen < INT_MAX, 1, "string too long");
+                        if (!(bio = BIO_new_mem_buf((void *)data, datalen)))
+                                return auxL_error(L, auxL_EOPENSSL, "group.new");
+
+                        goterr = 0;
+
+                        if (type == X509_PEM || type == X509_ANY) {
+                                goterr |= !(*group = PEM_read_bio_ECPKParameters(bio, NULL, 0, ""));
+                        }
+
+                        if (!*group && (type == X509_DER || type == X509_ANY)) {
+                                BIO_reset(bio);
+                                goterr |= !(*group = d2i_ECPKParameters_bio(bio, NULL));
+                        }
+
+                        BIO_free(bio);
+
+                        if (!*group)
+                                return auxL_error(L, auxL_EOPENSSL, "group.new");
+                        if (goterr)
+                                ERR_clear_error();
+                }
+
+                return 1;
+        }
+        case LUA_TNUMBER: {
+                int nid = luaL_checkint(L, 2);
+
+                if (!ecg_push_by_nid(L, nid))
+                        goto sslerr;
+
+                return 1;
+        }
+        default:
+                return luaL_error(L, "%s: unknown group initializer", lua_typename(L, lua_type(L, 1)));
+        } /* switch() */
+
+        return 0;
+sslerr:
+        return auxL_error(L, auxL_EOPENSSL, "group.new");
+} /* ecg_new() */
+
+static int ecg_interpose(lua_State *L) {
+        return interpose(L, EC_GROUP_CLASS);
+} /* ecg_interpose() */
+
+static int ecg_tostring(lua_State *L) {
+        EC_GROUP *group = checksimple(L, 1, EC_GROUP_CLASS);
+        int how = optencoding(L, 2, "pem", X509_PEM|X509_DER|X509_TXT);
+        BIO *bio = getbio(L);
+        char *bytes;
+        int len, indent;
+
+        switch (how) {
+        case X509_PEM:
+                if (!PEM_write_bio_ECPKParameters(bio, group))
+                        goto sslerr;
+                break;
+        case X509_DER:
+                if (!i2d_ECPKParameters_bio(bio, group))
+                        goto sslerr;
+                break;
+        case X509_TXT:
+                indent = auxL_optinteger(L, 3, 0, 0, INT_MAX);
+                if (!ECPKParameters_print(bio, group, indent))
+                        goto sslerr;
+                break;
+        }
+
+        len = BIO_get_mem_data(bio, &bytes);
+        lua_pushlstring(L, bytes, len);
+
+        return 1;
+sslerr:
+        return auxL_error(L, auxL_EOPENSSL, "group:__tostring");
+} /* ecg_tostring() */
+
+static int ecg__tostring(lua_State *L) {
+        return ecg_tostring(L);
+} /* ecg__tostring() */
+
+static int ecg__gc(lua_State *L) {
+        EC_GROUP **ud = luaL_checkudata(L, 1, EC_GROUP_CLASS);
+
+        if (*ud) {
+                EC_GROUP_clear_free(*ud);
+                *ud = NULL;
+        }
+
+        return 0;
+} /* ecg__gc() */
+
+static const luaL_Reg ecg_methods[] = {
+        { "tostring", &ecg_tostring },
+        { NULL,       NULL },
+};
+
+static const luaL_Reg ecg_metatable[] = {
+        { "__tostring", &ecg__tostring },
+        { "__gc",       &ecg__gc },
+        { NULL,         NULL },
+};
+
+static const luaL_Reg ecg_globals[] = {
+        { "new",       &ecg_new },
+        { "interpose", &ecg_interpose },
+        { NULL,        NULL },
+};
+
+#endif /* OPENSSL_NO_EC */
+
+int luaopen__openssl_ec_group(lua_State *L) {
+#ifndef OPENSSL_NO_EC
+        initall(L);
+
+        luaL_newlib(L, ecg_globals);
+
+        return 1;
+#else
+        return 0;
+#endif
+} /* luaopen__openssl_ec_group() */
+
+
+/*
  * X509_NAME - openssl.x509.name
  *
  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
@@ -7575,6 +8011,9 @@ static void initall(lua_State *L) {
 
         addclass(L, BIGNUM_CLASS, bn_methods, bn_metatable);
         addclass(L, PKEY_CLASS, pk_methods, pk_metatable);
+#ifndef OPENSSL_NO_EC
+        addclass(L, EC_GROUP_CLASS, ecg_methods, ecg_metatable);
+#endif
         addclass(L, X509_NAME_CLASS, xn_methods, xn_metatable);
         addclass(L, X509_GENS_CLASS, gn_methods, gn_metatable);
         addclass(L, X509_EXT_CLASS, xe_methods, xe_metatable);