-n

wrapp SSL_CTX

1 files changed, 183 insertions, 21 deletions

diff --git a/openssl.c b/openssl.c
index e6f6cc9..fd96d15 100644
--- a/openssl.c
+++ b/openssl.c
@@ -32,6 +32,9 @@
 #include <math.h>       /* INFINITY fabs(3) floor(3) frexp(3) fmod(3) round(3) isfinite(3) */
 #include <time.h>       /* struct tm time_t strptime(3) */
 
+#include <sys/types.h>
+#include <sys/stat.h>   /* struct stat stat(2) */
+
 #include <netinet/in.h> /* struct in_addr struct in6_addr */
 #include <arpa/inet.h>  /* AF_INET6 AF_INET inet_pton(3) */
 
@@ -42,6 +45,7 @@
 #include <openssl/x509v3.h>
 #include <openssl/evp.h>
 #include <openssl/pem.h>
+#include <openssl/ssl.h>
 
 #include <lua.h>
 #include <lualib.h>
@@ -58,6 +62,7 @@
 #define X509_CHAIN_CLASS "OpenSSL X.509 Chain"
 #define X509_STORE_CLASS "OpenSSL X.509 Store"
 #define X509_STCTX_CLASS "OpenSSL X.509 Store Context"
+#define SSL_CTX_CLASS    "OpenSSL SSL Context"
 
 
 #define countof(a) (sizeof (a) / sizeof *(a))
@@ -2708,15 +2713,36 @@ static int xs_interpose(lua_State *L) {
 
 static int xs_add(lua_State *L) {
         X509_STORE *store = checksimple(L, 1, X509_STORE_CLASS);
-        X509 *crt = checksimple(L, 2, X509_CERT_CLASS);
-        X509 *dup;
+        int i, top = lua_gettop(L);
 
-        if (!(dup = X509_dup(crt)))
-                return throwssl(L, "x509.store:add");
+        for (i = 2; i <= top; i++) {
+                if (lua_isuserdata(L, i)) {
+                        X509 *crt = checksimple(L, i, X509_CERT_CLASS);
+                        X509 *dup;
 
-        if (!X509_STORE_add_cert(store, dup)) {
-                X509_free(dup);
-                return throwssl(L, "x509.store:add");
+                        if (!(dup = X509_dup(crt)))
+                                return throwssl(L, "x509.store:add");
+
+                        if (!X509_STORE_add_cert(store, dup)) {
+                                X509_free(dup);
+                                return throwssl(L, "x509.store:add");
+                        }
+                } else {
+                        const char *path = luaL_checkstring(L, i);
+                        struct stat st;
+                        int ok;
+
+                        if (0 != stat(path, &st))
+                                return luaL_error(L, "%s: %s", path, strerror(errno));
+
+                        if (S_ISDIR(st.st_mode))
+                                ok = X509_STORE_load_locations(store, NULL, path);
+                        else
+                                ok = X509_STORE_load_locations(store, path, NULL);
+
+                        if (!ok)
+                                return throwssl(L, "x509.store:add");
+                }
         }
 
         lua_pushboolean(L, 1);
@@ -2835,8 +2861,8 @@ int luaopen__openssl_x509_store(lua_State *L) {
  * held externally for the life of the X509_STORE_CTX object.
  *
  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
-
-static int sx_new(lua_State *L) {
+#if 0
+static int stx_new(lua_State *L) {
         X509_STORE_CTX **ud = prepsimple(L, X509_STCTX_CLASS);
         STACK_OF(X509) *chain;
 
@@ -2844,36 +2870,159 @@ static int sx_new(lua_State *L) {
                 return throwssl(L, "x509.store.context");
 
         return 1;
-} /* sx_new() */
+} /* stx_new() */
 
 
-static int sx_interpose(lua_State *L) {
+static int stx_interpose(lua_State *L) {
         return interpose(L, X509_STCTX_CLASS);
-} /* sx_interpose() */
+} /* stx_interpose() */
 
 
-static int sx_add(lua_State *L) {
+static int stx_add(lua_State *L) {
         X509_STORE_CTX *ctx = checksimple(L, 1, X509_STCTX_CLASS);
 
-        
-
         return 0;
-} /* sx_add() */
+} /* stx_add() */
 
 
-static int sx__gc(lua_State *L) {
+static int stx__gc(lua_State *L) {
         X509_STORE **ud = luaL_checkudata(L, 1, X509_STORE_CLASS);
 
         X509_STORE_free(*ud);
         *ud = NULL;
 
         return 0;
+} /* stx__gc() */
+
+
+static const luaL_Reg stx_methods[] = {
+        { "add", &stx_add },
+        { NULL,  NULL },
+};
+
+static const luaL_Reg stx_metatable[] = {
+        { "__gc", &stx__gc },
+        { NULL,   NULL },
+};
+
+static const luaL_Reg stx_globals[] = {
+        { "new",       &stx_new },
+        { "interpose", &stx_interpose },
+        { NULL,        NULL },
+};
+
+int luaopen__openssl_x509_store_context(lua_State *L) {
+        initall(L);
+
+        luaL_newlib(L, stx_globals);
+
+        return 1;
+} /* luaopen__openssl_x509_store_context() */
+#endif
+
+
+/*
+ * SSL_CTX - openssl.ssl.context
+ *
+ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
+
+static int sx_new(lua_State *L) {
+        static const char *opts[] = {
+                "SSLv2", "SSLv3", "SSLv23", "SSL", "TLSv1", "TLS", NULL
+        };
+        SSL_CTX **ud = prepsimple(L, SSL_CTX_CLASS);
+        SSL_METHOD *(*method)() = &TLSv1_client_method;
+        _Bool srv;
+
+        lua_settop(L, 2);
+        srv = lua_toboolean(L, 2);
+
+        switch (checkoption(L, 1, "TLS", opts)) {
+        case 0: /* SSLv2 */
+                method = (srv)? &SSLv2_server_method : &SSLv2_client_method;
+                break;
+        case 1: /* SSLv3 */
+                method = (srv)? &SSLv3_server_method : &SSLv3_client_method;
+                break;
+        case 2: /* SSLv23 */
+                /* FALL THROUGH */
+        case 3: /* SSL */
+                method = (srv)? &SSLv23_server_method : &SSLv23_client_method;
+                break;
+        case 4: /* TLSv1 */
+                /* FALL THROUGH */
+        case 5: /* TLS */
+                method = (srv)? &TLSv1_server_method : &TLSv1_client_method;
+                break;
+        }
+
+        if (!(*ud = SSL_CTX_new(method())))
+                return throwssl(L, "ssl.context.new");
+
+        return 1;
+} /* sx_new() */
+
+
+static int sx_interpose(lua_State *L) {
+        return interpose(L, SSL_CTX_CLASS);
+} /* sx_interpose() */
+
+
+static int sx_setStore(lua_State *L) {
+        SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS);
+        X509_STORE *store = checksimple(L, 2, X509_STORE_CLASS);
+
+        SSL_CTX_set_cert_store(ctx, store);
+        CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE);
+
+        lua_pushboolean(L, 1);
+
+        return 1;
+} /* sx_setStore() */
+
+
+static int sx_setVerify(lua_State *L) {
+        SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS);
+        int mode = luaL_optint(L, 2, -1);
+        int depth = luaL_optint(L, 3, -1);
+
+        if (mode != -1)
+                SSL_CTX_set_verify(ctx, mode, 0);
+
+        if (depth != -1)
+                SSL_CTX_set_verify_depth(ctx, depth);
+
+        lua_pushboolean(L, 1);
+
+        return 1;
+} /* sx_setVerify() */
+
+
+static int sx_getVerify(lua_State *L) {
+        SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS);
+
+        lua_pushinteger(L, SSL_CTX_get_verify_mode(ctx));
+        lua_pushinteger(L, SSL_CTX_get_verify_depth(ctx));
+
+        return 2;
+} /* sx_getVerify() */
+
+
+static int sx__gc(lua_State *L) {
+        SSL_CTX **ud = luaL_checkudata(L, 1, SSL_CTX_CLASS);
+
+        SSL_CTX_free(*ud);
+        *ud = NULL;
+
+        return 0;
 } /* sx__gc() */
 
 
 static const luaL_Reg sx_methods[] = {
-        { "add", &sx_add },
-        { NULL,  NULL },
+        { "setStore",  &sx_setStore },
+        { "setVerify", &sx_setVerify },
+        { "getVerify", &sx_getVerify },
+        { NULL,        NULL },
 };
 
 static const luaL_Reg sx_metatable[] = {
@@ -2887,13 +3036,25 @@ static const luaL_Reg sx_globals[] = {
         { NULL,        NULL },
 };
 
-int luaopen__openssl_x509_store_context(lua_State *L) {
+int luaopen__openssl_ssl_context(lua_State *L) {
         initall(L);
 
         luaL_newlib(L, sx_globals);
 
+        lua_pushinteger(L, SSL_VERIFY_NONE);
+        lua_setfield(L, -2, "VERIFY_NONE");
+
+        lua_pushinteger(L, SSL_VERIFY_PEER);
+        lua_setfield(L, -2, "VERIFY_PEER");
+
+        lua_pushinteger(L, SSL_VERIFY_FAIL_IF_NO_PEER_CERT);
+        lua_setfield(L, -2, "VERIFY_FAIL_IF_NO_PEER_CERT");
+
+        lua_pushinteger(L, SSL_VERIFY_CLIENT_ONCE);
+        lua_setfield(L, -2, "VERIFY_CLIENT_ONCE");
+
         return 1;
-} /* luaopen__openssl_x509_store_context() */
+} /* luaopen__openssl_ssl_context() */
 
 
 
@@ -2909,6 +3070,7 @@ static void initall(lua_State *L) {
         addclass(L, X509_CSR_CLASS, xr_methods, xr_metatable);
         addclass(L, X509_CHAIN_CLASS, xl_methods, xl_metatable);
         addclass(L, X509_STORE_CLASS, xs_methods, xs_metatable);
+        addclass(L, SSL_CTX_CLASS, sx_methods, sx_metatable);
 } /* initall() */