From 8d91ac802732222ba1b775712543601137d2bf20 Mon Sep 17 00:00:00 2001 From: daurnimator Date: Mon, 3 Apr 2017 11:01:54 +1000 Subject: openssl.ssl.context: Add ctx:setCurvesList --- src/openssl.c | 22 ++++++++++++++++++++++ src/openssl.ssl.context.lua | 14 ++++++++++++++ 2 files changed, 36 insertions(+) (limited to 'src') diff --git a/src/openssl.c b/src/openssl.c index fa7dd79..d679d92 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -254,6 +254,10 @@ #define HAVE_SSL_CTX_GET0_PARAM OPENSSL_PREREQ(1,0,2) #endif +#ifndef HAVE_SSL_CTX_SET_CURVES_LIST +#define HAVE_SSL_CTX_SET_CURVES_LIST (OPENSSL_PREREQ(1,0,2) || LIBRESSL_PREREQ(2,5,1)) +#endif + #ifndef HAVE_SSL_CTX_SET_ALPN_PROTOS #define HAVE_SSL_CTX_SET_ALPN_PROTOS (OPENSSL_PREREQ(1,0,2) || LIBRESSL_PREREQ(2,1,3)) #endif @@ -7746,6 +7750,21 @@ static int sx_setCipherList(lua_State *L) { } /* sx_setCipherList() */ +#if HAVE_SSL_CTX_SET_CURVES_LIST +static int sx_setCurvesList(lua_State *L) { + SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS); + const char *curves = luaL_checkstring(L, 2); + + if (!SSL_CTX_set1_curves_list(ctx, curves)) + return auxL_error(L, auxL_EOPENSSL, "ssl.context:setCurvesList"); + + lua_pushboolean(L, 1); + + return 1; +} /* sx_setCurvesList() */ +#endif + + static int sx_setEphemeralKey(lua_State *L) { SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS); EVP_PKEY *key = checksimple(L, 2, PKEY_CLASS); @@ -7941,6 +7960,9 @@ static const auxL_Reg sx_methods[] = { { "setCertificate", &sx_setCertificate }, { "setPrivateKey", &sx_setPrivateKey }, { "setCipherList", &sx_setCipherList }, +#if HAVE_SSL_CTX_SET_CURVES_LIST + { "setCurvesList", &sx_setCurvesList }, +#endif { "setEphemeralKey", &sx_setEphemeralKey }, #if HAVE_SSL_CTX_SET_ALPN_PROTOS { "setAlpnProtos", &sx_setAlpnProtos }, diff --git a/src/openssl.ssl.context.lua b/src/openssl.ssl.context.lua index 2098b54..3263fb1 100644 --- a/src/openssl.ssl.context.lua +++ b/src/openssl.ssl.context.lua @@ -13,4 +13,18 @@ local setCipherList; setCipherList = ctx.interpose("setCipherList", function (se return setCipherList(self, ciphers) end) +-- Allow passing a vararg of curves, or an array +local setCurvesList = ctx.interpose("setCurvesList", nil) +if setCurvesList then + ctx.interpose("setCurvesList", function (self, curves, ...) + if (...) then + local curves_t = pack(curves, ...) + curves = table.concat(curves_t, ":", 1, curves_t.n) + elseif type(curves) == "table" then + curves = table.concat(curves, ":") + end + return setCurvesList(self, curves) + end) +end + return ctx -- cgit v1.2.3-55-g6feb From a0346d8054d3b19a7e30b5de70048c001d8c2c26 Mon Sep 17 00:00:00 2001 From: daurnimator Date: Mon, 3 Apr 2017 12:54:23 +1000 Subject: openssl.ssl.context.new: Turn on ecdh_auto in OpenSSL 1.0.2 It's on by default in 1.1.0, and supported in < 1.0.2. Suggestion taken from ruby openssl implementation: https://github.com/ruby/openssl/blob/a7bbd590c66d40bd662502df9c65474e85b5f03f/ext/openssl/ossl_ssl.c#L135 --- src/openssl.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'src') diff --git a/src/openssl.c b/src/openssl.c index d679d92..652e38a 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -258,6 +258,10 @@ #define HAVE_SSL_CTX_SET_CURVES_LIST (OPENSSL_PREREQ(1,0,2) || LIBRESSL_PREREQ(2,5,1)) #endif +#ifndef HAVE_SSL_CTX_SET_ECDH_AUTO +#define HAVE_SSL_CTX_SET_ECDH_AUTO ((OPENSSL_PREREQ(1,0,2) && !OPENSSL_PREREQ(1,1,0)) || LIBRESSL_PREREQ(2,1,2)) +#endif + #ifndef HAVE_SSL_CTX_SET_ALPN_PROTOS #define HAVE_SSL_CTX_SET_ALPN_PROTOS (OPENSSL_PREREQ(1,0,2) || LIBRESSL_PREREQ(2,1,3)) #endif @@ -7575,6 +7579,15 @@ static int sx_new(lua_State *L) { SSL_CTX_set_options(*ud, options); +#if HAVE_SSL_CTX_SET_ECDH_AUTO + /* OpenSSL 1.0.2 introduced SSL_CTX_set_ecdh_auto to automatically select + * from the curves set via SSL_CTX_set1_curves_list. However as of OpenSSL + * 1.1.0, the functionality was turned on permanently and the option + * removed. */ + if (!SSL_CTX_set_ecdh_auto(*ud, 1)) + return auxL_error(L, auxL_EOPENSSL, "ssl.context.new"); +#endif + return 1; } /* sx_new() */ -- cgit v1.2.3-55-g6feb From f92ced1a1448c07ae19c3832a278867859371f76 Mon Sep 17 00:00:00 2001 From: daurnimator Date: Thu, 6 Apr 2017 14:51:22 +1000 Subject: openssl.ssl: Bind SSL_set1_curves_list as ssl:setCurvesList() --- doc/luaossl.tex | 6 ++++++ src/openssl.c | 22 ++++++++++++++++++++++ src/openssl.ssl.lua | 20 ++++++++++++++++++-- 3 files changed, 46 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/doc/luaossl.tex b/doc/luaossl.tex index 32a4dba..76821a1 100644 --- a/doc/luaossl.tex +++ b/doc/luaossl.tex @@ -978,6 +978,12 @@ TLS1\_2\_VERSION & 16-bit TLSv1.2 identifier (0x0303). \\ Returns the SSL/TLS version supported by the client, which should be greater than or equal to the negotiated version. See \fn{ssl:getVersion}. +\subsubsection[\fn{ssl:setCurvesList}]{\fn{ssl:setCurvesList($string$ [, ...])}} + +Sets the supported curves for this SSL connection instance. See \fn{openssl.ssl.context:setCurvesList}. + +\emph{Only supported since OpenSSL 1.0.2.} + \subsubsection[\fn{ssl:getAlpnSelected}]{\fn{ssl:getAlpnSelected()}} Returns the negotiated ALPN protocol as a string. diff --git a/src/openssl.c b/src/openssl.c index 652e38a..8217deb 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -294,6 +294,10 @@ #define HAVE_SSL_SET_ALPN_PROTOS HAVE_SSL_CTX_SET_ALPN_PROTOS #endif +#ifndef HAVE_SSL_SET_CURVES_LIST +#define HAVE_SSL_SET_CURVES_LIST (OPENSSL_PREREQ(1,0,2) || LIBRESSL_PREREQ(2,5,1)) +#endif + #ifndef HAVE_SSL_SET1_PARAM #define HAVE_SSL_SET1_PARAM OPENSSL_PREREQ(1,0,2) #endif @@ -8214,6 +8218,21 @@ static int ssl_getCipherInfo(lua_State *L) { } /* ssl_getCipherInfo() */ +#if HAVE_SSL_SET_CURVES_LIST +static int ssl_setCurvesList(lua_State *L) { + SSL *ssl = checksimple(L, 1, SSL_CLASS); + const char *curves = luaL_checkstring(L, 2); + + if (!SSL_set1_curves_list(ssl, curves)) + return auxL_error(L, auxL_EOPENSSL, "ssl:setCurvesList"); + + lua_pushboolean(L, 1); + + return 1; +} /* ssl_setCurvesList() */ +#endif + + static int ssl_getHostName(lua_State *L) { SSL *ssl = checksimple(L, 1, SSL_CLASS); const char *host; @@ -8357,6 +8376,9 @@ static const auxL_Reg ssl_methods[] = { { "getPeerCertificate", &ssl_getPeerCertificate }, { "getPeerChain", &ssl_getPeerChain }, { "getCipherInfo", &ssl_getCipherInfo }, +#if HAVE_SSL_SET_CURVES_LIST + { "setCurvesList", &ssl_setCurvesList }, +#endif { "getHostName", &ssl_getHostName }, { "setHostName", &ssl_setHostName }, { "getVersion", &ssl_getVersion }, diff --git a/src/openssl.ssl.lua b/src/openssl.ssl.lua index 3c348f6..bf90f29 100644 --- a/src/openssl.ssl.lua +++ b/src/openssl.ssl.lua @@ -1,3 +1,19 @@ -local ctx = require"_openssl.ssl" +local ssl = require"_openssl.ssl" -return ctx +local pack = table.pack or function(...) return { n = select("#", ...); ... } end + +-- Allow passing a vararg of curves, or an array +local setCurvesList = ssl.interpose("setCurvesList", nil) +if setCurvesList then + ssl.interpose("setCurvesList", function (self, curves, ...) + if (...) then + local curves_t = pack(curves, ...) + curves = table.concat(curves_t, ":", 1, curves_t.n) + elseif type(curves) == "table" then + curves = table.concat(curves, ":") + end + return setCurvesList(self, curves) + end) +end + +return ssl -- cgit v1.2.3-55-g6feb