From 20d2e99010f067cd45a7bcfa93fe10862882b3a8 Mon Sep 17 00:00:00 2001 From: Steven Barth Date: Thu, 28 May 2009 13:50:00 +0000 Subject: nixio: Rework TLS support, added support for CyaSSL --- libs/nixio/Makefile | 7 +++++++ libs/nixio/docsrc/nixio.lua | 1 + libs/nixio/src/cyassl-compat.c | 31 ++++++++++++++++++++++++++++++ libs/nixio/src/cyassl-compat.h | 32 +++++++++++++++++++++++++++++++ libs/nixio/src/tls-context.c | 43 ++++++++++++++---------------------------- libs/nixio/src/tls-crypto.c | 1 + 6 files changed, 86 insertions(+), 29 deletions(-) create mode 100644 libs/nixio/src/cyassl-compat.c create mode 100644 libs/nixio/src/cyassl-compat.h (limited to 'libs') diff --git a/libs/nixio/Makefile b/libs/nixio/Makefile index 8e87eaa10..500b6c4f1 100644 --- a/libs/nixio/Makefile +++ b/libs/nixio/Makefile @@ -28,6 +28,13 @@ ifeq ($(NIXIO_TLS),openssl) NIXIO_LDFLAGS += -lssl endif +ifeq ($(NIXIO_TLS),cyassl) + NIXIO_LDFLAGS += -lcyassl + TLS_DEPENDS = src/cyassl-compat.o + TLS_CFLAGS = -include src/cyassl-compat.h + NIXIO_OBJ += src/cyassl-compat.o +endif + ifeq ($(OS),SunOS) NIXIO_LDFLAGS += -lsocket -lnsl -lsendfile diff --git a/libs/nixio/docsrc/nixio.lua b/libs/nixio/docsrc/nixio.lua index 2d0056f17..90331cf23 100644 --- a/libs/nixio/docsrc/nixio.lua +++ b/libs/nixio/docsrc/nixio.lua @@ -430,4 +430,5 @@ module "nixio" --- Create a new TLS context. -- @class function -- @name nixio.tls +-- @param mode TLS-Mode ["client", "server"] -- @return TLSContext Object \ No newline at end of file diff --git a/libs/nixio/src/cyassl-compat.c b/libs/nixio/src/cyassl-compat.c new file mode 100644 index 000000000..a483119ac --- /dev/null +++ b/libs/nixio/src/cyassl-compat.c @@ -0,0 +1,31 @@ +#include "cyassl-compat.h" + +int MD5_Init(MD5_CTX *md5) { + InitMd5(md5); + return 1; +} + +int MD5_Update(MD5_CTX *md5, void *input, unsigned long sz) { + Md5Update(md5, input, (word32)sz); + return 1; +} + +int MD5_Final(void *input, MD5_CTX *md5) { + Md5Final(md5, input); + return 1; +} + +int SHA1_Init(SHA_CTX *sha) { + InitSha(sha); + return 1; +} + +int SHA1_Update(SHA_CTX *sha, void *input, unsigned long sz) { + ShaUpdate(sha, input, (word32)sz); + return 1; +} + +int SHA1_Final(void *input, SHA_CTX *sha) { + ShaFinal(sha, input); + return 1; +} diff --git a/libs/nixio/src/cyassl-compat.h b/libs/nixio/src/cyassl-compat.h new file mode 100644 index 000000000..b2cdc9233 --- /dev/null +++ b/libs/nixio/src/cyassl-compat.h @@ -0,0 +1,32 @@ +#define WITH_CYASSL +#define WITHOUT_OPENSSL +#include + +typedef unsigned int word32; + + +#define MD5_DIGEST_LENGTH 16 +typedef struct MD5_CTX { + int dummy[24]; +} MD5_CTX; + +void InitMd5(MD5_CTX*); +void Md5Update(MD5_CTX*, void*, word32); +void Md5Final(MD5_CTX*, void*); + + +#define SHA_DIGEST_LENGTH 20 +typedef struct SHA_CTX { + int dummy[24]; +} SHA_CTX; + +void InitSha(SHA_CTX*); +void ShaUpdate(SHA_CTX*, void*, word32); +void ShaFinal(SHA_CTX*, void*); + +int MD5_Init(MD5_CTX *md5); +int MD5_Update(MD5_CTX *md5, void *input, unsigned long sz); +int MD5_Final(void *input, MD5_CTX *md5); +int SHA1_Init(SHA_CTX *md5); +int SHA1_Update(SHA_CTX *sha, void *input, unsigned long sz); +int SHA1_Final(void *input, SHA_CTX *sha); diff --git a/libs/nixio/src/tls-context.c b/libs/nixio/src/tls-context.c index 59e06f449..fdbe22462 100644 --- a/libs/nixio/src/tls-context.c +++ b/libs/nixio/src/tls-context.c @@ -41,7 +41,7 @@ static int nixio__tls_pstatus(lua_State *L, int code) { } static int nixio_tls_ctx(lua_State * L) { - const char *method = luaL_optlstring(L, 1, "tlsv1", NULL); + const char *method = luaL_optlstring(L, 1, "client", NULL); luaL_getmetatable(L, NIXIO_TLS_CTX_META); SSL_CTX **ctx = lua_newuserdata(L, sizeof(SSL_CTX *)); @@ -52,27 +52,22 @@ static int nixio_tls_ctx(lua_State * L) { /* create userdata */ lua_pushvalue(L, -2); lua_setmetatable(L, -2); - lua_getfield(L, -1, "tls_defaultkey"); - if (!strcmp(method, "tlsv1")) { - *ctx = SSL_CTX_new(TLSv1_method()); - } else if (!strcmp(method, "sslv23")) { - *ctx = SSL_CTX_new(SSLv23_method()); + if (!strcmp(method, "client")) { + *ctx = SSL_CTX_new(TLSv1_client_method()); + } else if (!strcmp(method, "server")) { + *ctx = SSL_CTX_new(TLSv1_server_method()); } else { - return luaL_argerror(L, 1, "supported values: tlsv1, sslv23"); + return luaL_argerror(L, 1, "supported values: client, server"); } if (!(*ctx)) { return luaL_error(L, "unable to create TLS context"); } - const char *autoload = lua_tostring(L, -1); - if (autoload) { - SSL_CTX_use_PrivateKey_file(*ctx, autoload, SSL_FILETYPE_PEM); - } - lua_pop(L, 1); - - SSL_CTX_set_options(*ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); +#ifdef WITH_CYASSL + SSL_CTX_set_verify(*ctx, SSL_VERIFY_NONE, NULL); +#endif return 1; } @@ -136,13 +131,6 @@ static int nixio_tls_ctx_set_ciphers(lua_State *L) { return nixio__tls_pstatus(L, SSL_CTX_set_cipher_list(ctx, ciphers)); } -static int nixio_tls_ctx_set_verify_depth(lua_State *L) { - SSL_CTX *ctx = nixio__checktlsctx(L); - const int depth = luaL_checkinteger(L, 2); - SSL_CTX_set_verify_depth(ctx, depth); - return 0; -} - static int nixio_tls_ctx_set_verify(lua_State *L) { SSL_CTX *ctx = nixio__checktlsctx(L); const int j = lua_gettop(L); @@ -192,7 +180,6 @@ static const luaL_reg CTX_M[] = { {"set_cert", nixio_tls_ctx_set_cert}, {"set_key", nixio_tls_ctx_set_key}, {"set_ciphers", nixio_tls_ctx_set_ciphers}, - {"set_verify_depth", nixio_tls_ctx_set_verify_depth}, {"set_verify", nixio_tls_ctx_set_verify}, {"create", nixio_tls_ctx_create}, {"__gc", nixio_tls_ctx__gc}, @@ -209,10 +196,12 @@ void nixio_open_tls_context(lua_State *L) { /* register module functions */ luaL_register(L, NULL, R); -#ifndef WITH_AXTLS - lua_pushliteral(L, "openssl"); -#else +#if defined (WITH_AXTLS) lua_pushliteral(L, "axtls"); +#elif defined (WITH_CYASSL) + lua_pushliteral(L, "cyassl"); +#else + lua_pushliteral(L, "openssl"); #endif lua_setfield(L, -2, "tls_provider"); @@ -221,9 +210,5 @@ void nixio_open_tls_context(lua_State *L) { lua_pushvalue(L, -1); lua_setfield(L, -2, "__index"); luaL_register(L, NULL, CTX_M); -#ifdef WITH_AXTLS - lua_pushliteral(L, "/etc/axtls.key"); - lua_setfield(L, -2, "tls_defaultkey"); -#endif lua_setfield(L, -2, "meta_tls_context"); } diff --git a/libs/nixio/src/tls-crypto.c b/libs/nixio/src/tls-crypto.c index 62ade2265..714ec4e60 100644 --- a/libs/nixio/src/tls-crypto.c +++ b/libs/nixio/src/tls-crypto.c @@ -17,6 +17,7 @@ */ #include "nixio-tls.h" +#include #include #include #include -- cgit v1.2.3