2 * nixio - Linux I/O library for lua
4 * Copyright (C) 2009 Steven Barth <steven@midlink.org>
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at
10 * http://www.apache.org/licenses/LICENSE-2.0
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
19 #include "nixio-tls.h"
22 static SSL_CTX
* nixio__checktlsctx(lua_State
*L
) {
23 SSL_CTX
**ctx
= (SSL_CTX
**)luaL_checkudata(L
, 1, NIXIO_TLS_CTX_META
);
24 luaL_argcheck(L
, *ctx
, 1, "invalid context");
28 static int nixio__tls_perror(lua_State
*L
, int code
) {
30 lua_pushinteger(L
, code
);
34 static int nixio__tls_pstatus(lua_State
*L
, int code
) {
36 lua_pushboolean(L
, 1);
39 return nixio__tls_perror(L
, code
);
43 static int nixio_tls_ctx(lua_State
* L
) {
44 const char *method
= luaL_optlstring(L
, 1, "client", NULL
);
46 luaL_getmetatable(L
, NIXIO_TLS_CTX_META
);
47 SSL_CTX
**ctx
= lua_newuserdata(L
, sizeof(SSL_CTX
*));
49 return luaL_error(L
, "out of memory");
54 lua_setmetatable(L
, -2);
56 if (!strcmp(method
, "client")) {
57 *ctx
= SSL_CTX_new(TLSv1_client_method());
58 } else if (!strcmp(method
, "server")) {
59 *ctx
= SSL_CTX_new(TLSv1_server_method());
61 return luaL_argerror(L
, 1, "supported values: client, server");
65 return luaL_error(L
, "unable to create TLS context");
69 SSL_CTX_set_verify(*ctx
, SSL_VERIFY_NONE
, NULL
);
75 static int nixio_tls_ctx_create(lua_State
*L
) {
76 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
77 int fd
= nixio__checkfd(L
, 2);
79 lua_createtable(L
, 0, 3);
80 nixio_tls_sock
*sock
= lua_newuserdata(L
, sizeof(nixio_tls_sock
));
82 return luaL_error(L
, "out of memory");
84 memset(sock
, 0, sizeof(nixio_tls_sock
));
87 luaL_getmetatable(L
, NIXIO_TLS_SOCK_META
);
89 lua_setmetatable(L
, -3);
91 sock
->socket
= SSL_new(ctx
);
93 return nixio__tls_perror(L
, 0);
96 if (SSL_set_fd(sock
->socket
, fd
) != 1) {
97 return nixio__tls_perror(L
, 0);
100 /* save context and socket to prevent GC from collecting them */
101 lua_setmetatable(L
, -3);
102 lua_setfield(L
, -2, "connection");
105 lua_setfield(L
, -2, "context");
108 lua_setfield(L
, -2, "socket");
113 static int nixio_tls_ctx_set_cert(lua_State
*L
) {
114 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
115 const char *cert
= luaL_checkstring(L
, 2);
116 const char *type
= luaL_optstring(L
, 3, "chain");
119 if (!strcmp(type
, "chain")) {
120 return nixio__tls_pstatus(L
,
121 SSL_CTX_use_certificate_chain_file(ctx
, cert
));
122 } else if (!strcmp(type
, "pem")) {
123 ktype
= SSL_FILETYPE_PEM
;
124 } else if (!strcmp(type
, "asn1")) {
125 ktype
= SSL_FILETYPE_ASN1
;
127 return luaL_argerror(L
, 3, "supported values: chain, pem, asn1");
130 return nixio__tls_pstatus(L
,
131 SSL_CTX_use_certificate_file(ctx
, cert
, ktype
));
134 static int nixio_tls_ctx_set_verify_locations(lua_State
*L
) {
135 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
136 const char *CAfile
= luaL_optstring(L
, 2, NULL
);
137 const char *CApath
= luaL_optstring(L
, 3, NULL
);
138 return nixio__tls_pstatus(L
, SSL_CTX_load_verify_locations(ctx
,
142 static int nixio_tls_ctx_set_key(lua_State
*L
) {
143 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
144 const char *cert
= luaL_checkstring(L
, 2);
145 const char *type
= luaL_optstring(L
, 3, "pem");
148 if (!strcmp(type
, "pem")) {
149 ktype
= SSL_FILETYPE_PEM
;
150 } else if (!strcmp(type
, "asn1")) {
151 ktype
= SSL_FILETYPE_ASN1
;
153 return luaL_argerror(L
, 3, "supported values: pem, asn1");
156 return nixio__tls_pstatus(L
, SSL_CTX_use_PrivateKey_file(ctx
, cert
, ktype
));
159 static int nixio_tls_ctx_set_ciphers(lua_State
*L
) {
160 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
162 const char *ciphers
= luaL_checklstring(L
, 2, &len
);
163 luaL_argcheck(L
, len
< 255, 2, "cipher string too long");
164 return nixio__tls_pstatus(L
, SSL_CTX_set_cipher_list(ctx
, ciphers
));
167 static int nixio_tls_ctx_set_verify(lua_State
*L
) {
168 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
169 const int j
= lua_gettop(L
);
171 for (int i
=2; i
<=j
; i
++) {
172 const char *flag
= luaL_checkstring(L
, i
);
173 if (!strcmp(flag
, "none")) {
174 flags
|= SSL_VERIFY_NONE
;
175 } else if (!strcmp(flag
, "peer")) {
176 flags
|= SSL_VERIFY_PEER
;
177 } else if (!strcmp(flag
, "verify_fail_if_no_peer_cert")) {
178 flags
|= SSL_VERIFY_FAIL_IF_NO_PEER_CERT
;
179 } else if (!strcmp(flag
, "client_once")) {
180 flags
|= SSL_VERIFY_CLIENT_ONCE
;
182 return luaL_argerror(L
, i
, "supported values: none, peer, "
183 "verify_fail_if_no_peer_cert, client_once");
186 SSL_CTX_set_verify(ctx
, flags
, NULL
);
190 static int nixio_tls_ctx__gc(lua_State
*L
) {
191 SSL_CTX
**ctx
= (SSL_CTX
**)luaL_checkudata(L
, 1, NIXIO_TLS_CTX_META
);
199 static int nixio_tls_ctx__tostring(lua_State
*L
) {
200 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
201 lua_pushfstring(L
, "nixio TLS context: %p", ctx
);
206 static const luaL_reg R
[] = {
207 {"tls", nixio_tls_ctx
},
211 /* ctx function table */
212 static const luaL_reg CTX_M
[] = {
213 {"set_cert", nixio_tls_ctx_set_cert
},
214 {"set_verify_locations", nixio_tls_ctx_set_verify_locations
},
215 {"set_key", nixio_tls_ctx_set_key
},
216 {"set_ciphers", nixio_tls_ctx_set_ciphers
},
217 {"set_verify", nixio_tls_ctx_set_verify
},
218 {"create", nixio_tls_ctx_create
},
219 {"__gc", nixio_tls_ctx__gc
},
220 {"__tostring", nixio_tls_ctx__tostring
},
225 void nixio_open_tls_context(lua_State
*L
) {
226 /* initialize tls library */
227 SSL_load_error_strings();
230 /* register module functions */
231 luaL_register(L
, NULL
, R
);
233 #if defined (WITH_AXTLS)
234 lua_pushliteral(L
, "axtls");
235 #elif defined (WITH_CYASSL)
236 lua_pushliteral(L
, "cyassl");
238 lua_pushliteral(L
, "openssl");
240 lua_setfield(L
, -2, "tls_provider");
242 /* create context metatable */
243 luaL_newmetatable(L
, NIXIO_TLS_CTX_META
);
244 lua_pushvalue(L
, -1);
245 lua_setfield(L
, -2, "__index");
246 luaL_register(L
, NULL
, CTX_M
);
247 lua_setfield(L
, -2, "meta_tls_context");