diff options
| -rw-r--r-- | src/GNUmakefile | 1 | ||||
| -rw-r--r-- | src/openssl.c | 422 | ||||
| -rw-r--r-- | src/openssl.x509.verify_param.lua | 1 |
3 files changed, 422 insertions, 2 deletions
diff --git a/src/GNUmakefile b/src/GNUmakefile index e7cb54d..015a93c 100644 --- a/src/GNUmakefile +++ b/src/GNUmakefile @@ -102,6 +102,7 @@ MODS$(1)_$(d) = \ $$(DESTDIR)$(3)/openssl/x509/csr.lua \ $$(DESTDIR)$(3)/openssl/x509/extension.lua \ $$(DESTDIR)$(3)/openssl/x509/store.lua \ + $$(DESTDIR)$(3)/openssl/x509/verify_param.lua \ $$(DESTDIR)$(3)/openssl/pkcs12.lua \ $$(DESTDIR)$(3)/openssl/ssl/context.lua \ $$(DESTDIR)$(3)/openssl/ssl.lua \ diff --git a/src/openssl.c b/src/openssl.c index a92df1a..ef0c6a6 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -60,6 +60,7 @@ #include <openssl/bn.h> #include <openssl/asn1.h> #include <openssl/x509.h> +#include <openssl/x509_vfy.h> #include <openssl/x509v3.h> #include <openssl/pkcs12.h> #include <openssl/evp.h> @@ -249,6 +250,10 @@ #define HAVE_SSL_CLIENT_VERSION OPENSSL_PREREQ(1,1,0) #endif +#ifndef HAVE_SSL_CTX_GET0_PARAM +#define HAVE_SSL_CTX_GET0_PARAM OPENSSL_PREREQ(1,0,2) +#endif + #ifndef HAVE_SSL_CTX_SET_ALPN_PROTOS #define HAVE_SSL_CTX_SET_ALPN_PROTOS (OPENSSL_PREREQ(1,0,2) || LIBRESSL_PREREQ(2,1,3)) #endif @@ -261,16 +266,28 @@ #define HAVE_SSL_CTX_SET1_CERT_STORE (HAVE_SSL_CTX_set1_cert_store || 0) /* backwards compatible with old macro name */ #endif +#ifndef HAVE_SSL_CTX_SET1_PARAM +#define HAVE_SSL_CTX_SET1_PARAM (OPENSSL_PREREQ(1,0,2) || LIBRESSL_PREREQ(2,1,0)) +#endif + #ifndef HAVE_SSL_CTX_CERT_STORE #define HAVE_SSL_CTX_CERT_STORE (!OPENSSL_PREREQ(1,1,0)) #endif +#ifndef HAVE_SSL_GET0_ALPN_SELECTED +#define HAVE_SSL_GET0_ALPN_SELECTED HAVE_SSL_CTX_SET_ALPN_PROTOS +#endif + +#ifndef HAVE_SSL_GET0_PARAM +#define HAVE_SSL_GET0_PARAM OPENSSL_PREREQ(1,0,2) +#endif + #ifndef HAVE_SSL_SET_ALPN_PROTOS #define HAVE_SSL_SET_ALPN_PROTOS HAVE_SSL_CTX_SET_ALPN_PROTOS #endif -#ifndef HAVE_SSL_GET0_ALPN_SELECTED -#define HAVE_SSL_GET0_ALPN_SELECTED HAVE_SSL_CTX_SET_ALPN_PROTOS +#ifndef HAVE_SSL_SET1_PARAM +#define HAVE_SSL_SET1_PARAM OPENSSL_PREREQ(1,0,2) #endif #ifndef HAVE_SSL_UP_REF @@ -297,6 +314,26 @@ #define HAVE_X509_UP_REF OPENSSL_PREREQ(1,1,0) #endif +#ifndef HAVE_X509_VERIFY_PARAM_ADD1_HOST +#define HAVE_X509_VERIFY_PARAM_ADD1_HOST OPENSSL_PREREQ(1,0,2) +#endif + +#ifndef HAVE_X509_VERIFY_PARAM_SET_AUTH_LEVEL +#define HAVE_X509_VERIFY_PARAM_SET_AUTH_LEVEL OPENSSL_PREREQ(1,1,0) +#endif + +#ifndef HAVE_X509_VERIFY_PARAM_SET1_EMAIL +#define HAVE_X509_VERIFY_PARAM_SET1_EMAIL OPENSSL_PREREQ(1,0,2) +#endif + +#ifndef HAVE_X509_VERIFY_PARAM_SET1_HOST +#define HAVE_X509_VERIFY_PARAM_SET1_HOST OPENSSL_PREREQ(1,0,2) +#endif + +#ifndef HAVE_X509_VERIFY_PARAM_SET1_IP_ASC +#define HAVE_X509_VERIFY_PARAM_SET1_IP_ASC OPENSSL_PREREQ(1,0,2) +#endif + #ifndef HMAC_INIT_EX_INT #define HMAC_INIT_EX_INT OPENSSL_PREREQ(1,0,0) #endif @@ -335,6 +372,7 @@ #define X509_CSR_CLASS "X509_REQ*" #define X509_CRL_CLASS "X509_CRL*" #define X509_STORE_CLASS "X509_STORE*" +#define X509_VERIFY_PARAM_CLASS "X509_VERIFY_PARAM*" #define X509_STCTX_CLASS "X509_STORE_CTX*" #define PKCS12_CLASS "PKCS12*" #define SSL_CTX_CLASS "SSL_CTX*" @@ -1529,6 +1567,22 @@ static int compat_SSL_client_version(const SSL *ssl) { } /* compat_SSL_client_version() */ #endif +#if !HAVE_SSL_GET0_PARAM +#define SSL_get0_param(ssl) compat_SSL_get0_param((ssl)) + +static X509_VERIFY_PARAM *compat_SSL_get0_param(SSL *ssl) { + return ssl->param; +} /* compat_SSL_get0_param() */ +#endif + +#if !HAVE_SSL_SET1_PARAM +#define SSL_set1_param(ssl, vpm) compat_SSL_set1_param((ssl), (vpm)) + +static int compat_SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm) { + return X509_VERIFY_PARAM_set1(ssl->param, vpm); +} /* compat_SSL_set1_param() */ +#endif + #if !HAVE_SSL_UP_REF #define SSL_up_ref(...) compat_SSL_up_ref(__VA_ARGS__) @@ -1541,6 +1595,22 @@ static int compat_SSL_up_ref(SSL *ssl) { } /* compat_SSL_up_ref() */ #endif +#if !HAVE_SSL_CTX_GET0_PARAM +#define SSL_CTX_get0_param(ctx) compat_SSL_CTX_get0_param((ctx)) + +static X509_VERIFY_PARAM *compat_SSL_CTX_get0_param(SSL_CTX *ctx) { + return ctx->param; +} /* compat_SSL_CTX_get0_param() */ +#endif + +#if !HAVE_SSL_CTX_SET1_PARAM +#define SSL_CTX_set1_param(ctx, vpm) compat_SSL_CTX_set1_param((ctx), (vpm)) + +static int compat_SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm) { + return X509_VERIFY_PARAM_set1(ctx->param, vpm); +} /* compat_SSL_CTX_set1_param() */ +#endif + #if !HAVE_X509_GET0_EXT #define X509_get0_ext(crt, i) X509_get_ext((crt), (i)) #endif @@ -1661,6 +1731,19 @@ static int compat_X509_up_ref(X509 *crt) { } /* compat_X509_up_ref() */ #endif +#if !HAVE_X509_VERIFY_PARAM_SET1_EMAIL +/* + * NB: Cannot emulate. Requires dereferencing X509_VERIFY_PARAM_ID objects, + * which were always opaque. + */ +#endif + +#if !HAVE_X509_VERIFY_PARAM_SET1_HOST +/* + * NB: See HAVE_X509_VERIFY_PARAM_SET1_EMAIL. + */ +#endif + static int compat_init(void) { static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER; static int store_index = -1, ssl_ctx_index = -1, done; @@ -7530,6 +7613,38 @@ static int sx_getStore(lua_State *L) { } /* sx_getStore() */ +static int sx_setParam(lua_State *L) { + SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS); + X509_VERIFY_PARAM *xp = checksimple(L, 2, X509_VERIFY_PARAM_CLASS); + + if (!SSL_CTX_set1_param(ctx, xp)) + return auxL_error(L, auxL_EOPENSSL, "ssl.context:setParam"); + + lua_pushboolean(L, 1); + + return 1; +} /* sx_setParam() */ + + +static int sx_getParam(lua_State *L) { + SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS); + X509_VERIFY_PARAM **ud, *from; + + /* X509_VERIFY_PARAM is not refcounted; create a new object and copy into it. */ + ud = prepsimple(L, X509_VERIFY_PARAM_CLASS); + if (!(*ud = X509_VERIFY_PARAM_new())) + return auxL_error(L, auxL_EOPENSSL, "ssl.context:getParam"); + + from = SSL_CTX_get0_param(ctx); + + if (!(X509_VERIFY_PARAM_set1(*ud, from))) + /* Note: openssl doesn't set an error as it should for some cases */ + return auxL_error(L, auxL_EOPENSSL, "ssl.context:getParam"); + + return 1; +} /* sx_getParam() */ + + static int sx_setVerify(lua_State *L) { SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS); int mode = luaL_optint(L, 2, -1); @@ -7797,6 +7912,8 @@ static const auxL_Reg sx_methods[] = { { "clearOptions", &sx_clearOptions }, { "setStore", &sx_setStore }, { "getStore", &sx_getStore }, + { "setParam", &sx_setParam }, + { "getParam", &sx_getParam }, { "setVerify", &sx_setVerify }, { "getVerify", &sx_getVerify }, { "setCertificate", &sx_setCertificate }, @@ -7949,6 +8066,38 @@ static int ssl_clearOptions(lua_State *L) { } /* ssl_clearOptions() */ +static int ssl_setParam(lua_State *L) { + SSL *ssl = checksimple(L, 1, SSL_CLASS); + X509_VERIFY_PARAM *xp = checksimple(L, 2, X509_VERIFY_PARAM_CLASS); + + if (!SSL_set1_param(ssl, xp)) + return auxL_error(L, auxL_EOPENSSL, "ssl:setParam"); + + lua_pushboolean(L, 1); + + return 1; +} /* ssl_setParam() */ + + +static int ssl_getParam(lua_State *L) { + SSL *ssl = checksimple(L, 1, SSL_CLASS); + X509_VERIFY_PARAM **ud, *from; + + /* X509_VERIFY_PARAM is not refcounted; create a new object and copy into it. */ + ud = prepsimple(L, X509_VERIFY_PARAM_CLASS); + if (!(*ud = X509_VERIFY_PARAM_new())) + return auxL_error(L, auxL_EOPENSSL, "ssl:getParam"); + + from = SSL_get0_param(ssl); + + if (!(X509_VERIFY_PARAM_set1(*ud, from))) + /* Note: openssl doesn't set an error as it should for some cases */ + return auxL_error(L, auxL_EOPENSSL, "ssl:getParam"); + + return 1; +} /* ssl_getParam() */ + + static int ssl_getPeerCertificate(lua_State *L) { SSL *ssl = checksimple(L, 1, SSL_CLASS); X509 **x509 = prepsimple(L, X509_CERT_CLASS); @@ -8136,6 +8285,8 @@ static const auxL_Reg ssl_methods[] = { { "setOptions", &ssl_setOptions }, { "getOptions", &ssl_getOptions }, { "clearOptions", &ssl_clearOptions }, + { "setParam", &ssl_setParam }, + { "getParam", &ssl_getParam }, { "getPeerCertificate", &ssl_getPeerCertificate }, { "getPeerChain", &ssl_getPeerChain }, { "getCipherInfo", &ssl_getCipherInfo }, @@ -8190,6 +8341,272 @@ int luaopen__openssl_ssl(lua_State *L) { /* + * X509_VERIFY_PARAM + * + * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */ + +static int xp_new(lua_State *L) { + X509_VERIFY_PARAM **ud = prepsimple(L, X509_VERIFY_PARAM_CLASS); + + if (!(*ud = X509_VERIFY_PARAM_new())) + return auxL_error(L, auxL_EOPENSSL, "x509.verify_param.new"); + + return 1; +} /* xp_new() */ + + +static int xp_interpose(lua_State *L) { + return interpose(L, X509_VERIFY_PARAM_CLASS); +} /* xp_interpose() */ + + +/* + * NB: Per the OpenSSL source, "[t]he 'inh_flags' field determines how this + * function behaves". (Referring to X509_VERIFY_PARAM_inherit.) The way to + * set inh_flags prior to OpenSSL 1.1 was by OR'ing flags into the inh_flags + * member and restoring it after the call. The OpenSSL 1.1 API makes the + * X509_VERIFY_PARAM object opaque, X509_VERIFY_PARAM_inherit, and there's + * no other function to set the flags argument; therefore it's not possible + * to control the inherit behavior from OpenSSL 1.1. + * + * For more details see + * https://github.com/openssl/openssl/issues/2054 and the original + * https://github.com/wahern/luaossl/pull/76/commits/db6e414d68c0f94c2497d363f6131b4de1710ba9 + */ +static int xp_inherit(lua_State *L) { + X509_VERIFY_PARAM *dest = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + X509_VERIFY_PARAM *src = checksimple(L, 2, X509_VERIFY_PARAM_CLASS); + int ret; + + ret = X509_VERIFY_PARAM_inherit(dest, src); + if (!ret) + /* Note: openssl doesn't set an error as it should for some cases */ + return auxL_error(L, auxL_EOPENSSL, "x509.verify_param:inherit"); + + lua_pushboolean(L, 1); + return 1; +} /* xp_inherit() */ + + +static const X509_PURPOSE *purpose_checktype(lua_State *L, int index) { + const char *purpose_name; + int purpose_id; + int purpose_idx; + const X509_PURPOSE *purpose; + + if (lua_isnumber(L, index)) { + purpose_id = luaL_checkinteger(L, index); + purpose_idx = X509_PURPOSE_get_by_id(purpose_id); + if (purpose_idx < 0) + luaL_argerror(L, index, lua_pushfstring(L, "%d: invalid purpose", purpose_id)); + } else { + purpose_name = luaL_checkstring(L, index); + purpose_idx = X509_PURPOSE_get_by_sname((char*)purpose_name); + if (purpose_idx < 0) + luaL_argerror(L, index, lua_pushfstring(L, "%s: invalid purpose", purpose_name)); + } + + purpose = X509_PURPOSE_get0(purpose_idx); + return purpose; +} /* purpose_checktype() */ + + +static int xp_setPurpose(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + const X509_PURPOSE *purpose = purpose_checktype(L, 2); + + if (!X509_VERIFY_PARAM_set_purpose(xp, X509_PURPOSE_get_id((X509_PURPOSE*)purpose))) + return auxL_error(L, auxL_EOPENSSL, "x509.verify_param:setPurpose"); + + lua_pushboolean(L, 1); + return 1; +} /* xp_setPurpose() */ + + +static int xp_setTime(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + time_t t = luaL_checkinteger(L, 2); + + X509_VERIFY_PARAM_set_time(xp, t); + + lua_pushboolean(L, 1); + return 1; +} /* xp_setTime() */ + + +static int xp_setDepth(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + int depth = luaL_checkinteger(L, 2); + + X509_VERIFY_PARAM_set_depth(xp, depth); + + lua_pushboolean(L, 1); + return 1; +} /* xp_setDepth() */ + + +static int xp_getDepth(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + + int depth = X509_VERIFY_PARAM_get_depth(xp); + + lua_pushinteger(L, depth); + return 1; +} /* xp_getDepth() */ + + +#if HAVE_X509_VERIFY_PARAM_SET_AUTH_LEVEL +static int xp_setAuthLevel(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + int auth_level = luaL_checkinteger(L, 2); + + X509_VERIFY_PARAM_set_auth_level(xp, auth_level); + + lua_pushboolean(L, 1); + return 1; +} /* xp_setAuthLevel() */ + + +static int xp_getAuthLevel(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + + int auth_level = X509_VERIFY_PARAM_get_auth_level(xp); + + lua_pushinteger(L, auth_level); + return 1; +} /* xp_getAuthLevel() */ +#endif + + +#if HAVE_X509_VERIFY_PARAM_SET1_HOST +static int xp_setHost(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + size_t len; + const char *str = luaL_optlstring(L, 2, NULL, &len); /* NULL = clear hosts */ + + if (!X509_VERIFY_PARAM_set1_host(xp, str, len)) + /* Note: openssl doesn't set an error as it should for some cases */ + return auxL_error(L, auxL_EOPENSSL, "x509.verify_param:setHost"); + + lua_pushboolean(L, 1); + return 1; +} /* xp_setHost() */ +#endif + + +#if HAVE_X509_VERIFY_PARAM_ADD1_HOST +static int xp_addHost(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + size_t len; + const char *str = luaL_checklstring(L, 2, &len); + + if (!X509_VERIFY_PARAM_add1_host(xp, str, len)) + /* Note: openssl doesn't set an error as it should for some cases */ + return auxL_error(L, auxL_EOPENSSL, "x509.verify_param:addHost"); + + lua_pushboolean(L, 1); + return 1; +} /* xp_addHost() */ +#endif + + +#if HAVE_X509_VERIFY_PARAM_SET1_EMAIL +static int xp_setEmail(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + size_t len; + const char *str = luaL_checklstring(L, 2, &len); + + if (!X509_VERIFY_PARAM_set1_email(xp, str, len)) + /* Note: openssl doesn't set an error as it should for some cases */ + return auxL_error(L, auxL_EOPENSSL, "x509.verify_param:setEmail"); + + lua_pushboolean(L, 1); + return 1; +} /* xp_setEmail() */ +#endif + + +#if HAVE_X509_VERIFY_PARAM_SET1_IP_ASC +static int xp_setIP(lua_State *L) { + X509_VERIFY_PARAM *xp = checksimple(L, 1, X509_VERIFY_PARAM_CLASS); + const char *str = luaL_checkstring(L, 2); + + if (!X509_VERIFY_PARAM_set1_ip_asc(xp, str)) + /* Note: openssl doesn't set an error as it should for some cases */ + return auxL_error(L, auxL_EOPENSSL, "x509.verify_param:setIP"); + + lua_pushboolean(L, 1); + return 1; +} /* xp_setIP() */ +#endif + + +static int xp__gc(lua_State *L) { + X509_VERIFY_PARAM **ud = luaL_checkudata(L, 1, X509_VERIFY_PARAM_CLASS); + + X509_VERIFY_PARAM_free(*ud); + *ud = NULL; + + return 0; +} /* xp__gc() */ + + +static const auxL_Reg xp_methods[] = { + { "inherit", &xp_inherit }, + { "setPurpose", &xp_setPurpose }, + { "setTime", &xp_setTime }, + { "setDepth", &xp_setDepth }, + { "getDepth", &xp_getDepth }, +#if HAVE_X509_VERIFY_PARAM_SET_AUTH_LEVEL + { "setAuthLevel", &xp_setAuthLevel }, + { "getAuthLevel", &xp_getAuthLevel }, +#endif +#if HAVE_X509_VERIFY_PARAM_SET1_HOST + { "setHost", &xp_setHost }, +#endif +#if HAVE_X509_VERIFY_PARAM_ADD1_HOST + { "addHost", &xp_addHost }, +#endif +#if HAVE_X509_VERIFY_PARAM_SET1_EMAIL + { "setEmail", &xp_setEmail }, +#endif +#if HAVE_X509_VERIFY_PARAM_SET1_IP_ASC + { "setIP", &xp_setIP }, +#endif + { NULL, NULL }, +}; + +static const auxL_Reg xp_metatable[] = { + { "__gc", &xp__gc }, + { NULL, NULL }, +}; + +static const auxL_Reg xp_globals[] = { + { "new", &xp_new }, + { "interpose", &xp_interpose }, + { NULL, NULL }, +}; + +static const auxL_IntegerReg xp_inherit_flags[] = { + { "DEFAULT", X509_VP_FLAG_DEFAULT }, + { "OVERWRITE", X509_VP_FLAG_OVERWRITE }, + { "RESET_FLAGS", X509_VP_FLAG_RESET_FLAGS }, + { "LOCKED", X509_VP_FLAG_LOCKED }, + { "ONCE", X509_VP_FLAG_ONCE }, + { NULL, 0 } +}; + +int luaopen__openssl_x509_verify_param(lua_State *L) { + initall(L); + + auxL_newlib(L, xp_globals, 0); + auxL_setintegers(L, xp_inherit_flags); + + return 1; +} /* luaopen__openssl_x509_verify_param() */ + + +/* * Digest - openssl.digest * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */ @@ -9177,6 +9594,7 @@ static void initall(lua_State *L) { auxL_addclass(L, X509_CRL_CLASS, xx_methods, xx_metatable, 0); auxL_addclass(L, X509_CHAIN_CLASS, xl_methods, xl_metatable, 0); auxL_addclass(L, X509_STORE_CLASS, xs_methods, xs_metatable, 0); + auxL_addclass(L, X509_VERIFY_PARAM_CLASS, xp_methods, xp_metatable, 0); auxL_addclass(L, PKCS12_CLASS, p12_methods, p12_metatable, 0); auxL_addclass(L, SSL_CTX_CLASS, sx_methods, sx_metatable, 0); auxL_addclass(L, SSL_CLASS, ssl_methods, ssl_metatable, 0); diff --git a/src/openssl.x509.verify_param.lua b/src/openssl.x509.verify_param.lua new file mode 100644 index 0000000..a3148e6 --- /dev/null +++ b/src/openssl.x509.verify_param.lua @@ -0,0 +1 @@ +return require('_openssl.x509.verify_param') |