2 * nixio - Linux I/O library for lua
4 * Copyright (C) 2009 Steven Barth <steven@midlink.org>
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at
10 * http://www.apache.org/licenses/LICENSE-2.0
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
22 #ifndef WITHOUT_OPENSSL
23 #include <openssl/ssl.h>
26 static SSL_CTX
* nixio__checktlsctx(lua_State
*L
) {
27 SSL_CTX
**ctx
= (SSL_CTX
**)luaL_checkudata(L
, 1, NIXIO_TLS_CTX_META
);
28 luaL_argcheck(L
, *ctx
, 1, "invalid context");
32 static int nixio__tls_perror(lua_State
*L
, int code
) {
34 lua_pushinteger(L
, code
);
38 static int nixio__tls_pstatus(lua_State
*L
, int code
) {
40 lua_pushboolean(L
, 1);
43 return nixio__tls_perror(L
, code
);
47 static int nixio_tls_ctx(lua_State
* L
) {
48 const char *method
= luaL_optlstring(L
, 1, "tlsv1", NULL
);
50 SSL_CTX
**ctx
= lua_newuserdata(L
, sizeof(SSL_CTX
*));
52 return luaL_error(L
, "out of memory");
56 luaL_getmetatable(L
, NIXIO_TLS_CTX_META
);
57 lua_setmetatable(L
, -2);
59 if (!strcmp(method
, "tlsv1")) {
60 *ctx
= SSL_CTX_new(TLSv1_method());
61 } else if (!strcmp(method
, "sslv23")) {
62 *ctx
= SSL_CTX_new(SSLv23_method());
64 return luaL_argerror(L
, 1, "supported values: tlsv1, sslv23");
68 SSL_CTX_set_options(*ctx
, SSL_OP_NO_SSLv2
| SSL_OP_NO_SSLv3
);
71 return luaL_error(L
, "unable to create TLS context");
77 static int nixio_tls_ctx_create(lua_State
*L
) {
78 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
79 int fd
= nixio__checkfd(L
, 2);
81 SSL
**sock
= lua_newuserdata(L
, sizeof(SSL
*));
83 return luaL_error(L
, "out of memory");
87 luaL_getmetatable(L
, NIXIO_TLS_SOCK_META
);
88 lua_setmetatable(L
, -2);
92 return nixio__tls_perror(L
, 0);
95 if (SSL_set_fd(*sock
, fd
) != 1) {
96 return nixio__tls_perror(L
, 0);
102 static int nixio_tls_ctx_set_cert(lua_State
*L
) {
103 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
104 const char *cert
= luaL_checkstring(L
, 2);
105 return nixio__tls_pstatus(L
, SSL_CTX_use_certificate_chain_file(ctx
, cert
));
108 static int nixio_tls_ctx_set_key(lua_State
*L
) {
109 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
110 const char *cert
= luaL_checkstring(L
, 2);
111 const int ktype
= SSL_FILETYPE_PEM
;
112 return nixio__tls_pstatus(L
, SSL_CTX_use_PrivateKey_file(ctx
, cert
, ktype
));
115 static int nixio_tls_ctx_set_ciphers(lua_State
*L
) {
116 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
118 const char *ciphers
= luaL_checklstring(L
, 2, &len
);
119 luaL_argcheck(L
, len
< 255, 2, "cipher string too long");
120 return nixio__tls_pstatus(L
, SSL_CTX_set_cipher_list(ctx
, ciphers
));
123 static int nixio_tls_ctx_set_verify_depth(lua_State
*L
) {
124 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
125 const int depth
= luaL_checkinteger(L
, 2);
126 SSL_CTX_set_verify_depth(ctx
, depth
);
130 static int nixio_tls_ctx_set_verify(lua_State
*L
) {
131 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
132 const int j
= lua_gettop(L
);
134 for (int i
=2; i
<=j
; i
++) {
135 const char *flag
= luaL_checkstring(L
, i
);
136 if (!strcmp(flag
, "none")) {
137 flags
|= SSL_VERIFY_NONE
;
138 } else if (!strcmp(flag
, "peer")) {
139 flags
|= SSL_VERIFY_PEER
;
140 } else if (!strcmp(flag
, "verify_fail_if_no_peer_cert")) {
141 flags
|= SSL_VERIFY_FAIL_IF_NO_PEER_CERT
;
142 } else if (!strcmp(flag
, "client_once")) {
143 flags
|= SSL_VERIFY_CLIENT_ONCE
;
145 return luaL_argerror(L
, i
, "supported values: none, peer, "
146 "verify_fail_if_no_peer_cert, client_once");
149 SSL_CTX_set_verify(ctx
, flags
, NULL
);
153 static int nixio_tls_ctx__gc(lua_State
*L
) {
154 SSL_CTX
**ctx
= (SSL_CTX
**)luaL_checkudata(L
, 1, NIXIO_TLS_CTX_META
);
162 static int nixio_tls_ctx__tostring(lua_State
*L
) {
163 SSL_CTX
*ctx
= nixio__checktlsctx(L
);
164 lua_pushfstring(L
, "nixio TLS context: %p", ctx
);
169 static const luaL_reg R
[] = {
170 {"tls", nixio_tls_ctx
},
174 /* ctx function table */
175 static const luaL_reg CTX_M
[] = {
176 {"set_cert", nixio_tls_ctx_set_cert
},
177 {"set_key", nixio_tls_ctx_set_key
},
178 {"set_ciphers", nixio_tls_ctx_set_ciphers
},
179 {"set_verify_depth", nixio_tls_ctx_set_verify_depth
},
180 {"set_verify", nixio_tls_ctx_set_verify
},
181 {"create", nixio_tls_ctx_create
},
182 {"__gc", nixio_tls_ctx__gc
},
183 {"__tostring", nixio_tls_ctx__tostring
},
188 void nixio_open_tls_context(lua_State
*L
) {
189 /* initialize tls library */
190 SSL_load_error_strings();
193 /* register module functions */
194 luaL_register(L
, NULL
, R
);
196 /* create context metatable */
197 luaL_newmetatable(L
, NIXIO_TLS_CTX_META
);
198 lua_pushvalue(L
, -1);
199 lua_setfield(L
, -2, "__index");
200 luaL_register(L
, NULL
, CTX_M
);