Skip to content

Commit 6141b6f

Browse files
fffonionfffonion
committed
feat(x509) add get_ocsp_url and get_crl_url
1 parent 46bb723 commit 6141b6f

File tree

9 files changed

+204
-6
lines changed

9 files changed

+204
-6
lines changed

‎lib/resty/openssl.lua

+2
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ local _M = {
1212
digest = require("resty.openssl.digest"),
1313
hmac = require("resty.openssl.hmac"),
1414
pkey = require("resty.openssl.pkey"),
15+
objects = require("resty.openssl.objects"),
1516
rand = require("resty.openssl.rand"),
1617
version = require("resty.openssl.version"),
1718
x509 = require("resty.openssl.x509"),
@@ -73,6 +74,7 @@ function _M.luaossl_compat()
7374
_M.x509.getSubject = _M.x509.get_subject_name
7475
_M.x509.setIssuer = _M.x509.set_issuer_name
7576
_M.x509.getIssuer = _M.x509.get_issuer_name
77+
_M.x509.getOCSP = _M.x509.get_ocsp_url
7678

7779
_M.cipher.encrypt = function(self, key, iv, padding)
7880
return self, _M.cipher.init(self, key, iv, true, not padding)

‎lib/resty/openssl/include/stack.lua

+4
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ local OPENSSL_11 = require("resty.openssl.version").OPENSSL_11
1414

1515
local _M = {}
1616

17+
ffi.cdef [[
18+
typedef char *OPENSSL_STRING;
19+
]]
20+
1721
if OPENSSL_11 then
1822
ffi.cdef [[
1923
typedef struct stack_st OPENSSL_STACK;

‎lib/resty/openssl/include/x509/init.lua

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ ffi.cdef [[
2828
int X509_EXTENSION_get_critical(const X509_EXTENSION *ex);
2929
ASN1_OBJECT *X509_EXTENSION_get_object(X509_EXTENSION *ex);
3030
ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ne);
31+
X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc);
3132

3233
// needed by pkey
3334
EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a);

‎lib/resty/openssl/include/x509v3.lua

+4
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ local BASIC_CONSTRAINTS = {
1010
}
1111

1212
ffi.cdef [[
13+
// STACK_OF(OPENSSL_STRING)
14+
OPENSSL_STACK *X509_get1_ocsp(X509 *x);
15+
void X509_email_free(OPENSSL_STACK *sk);
16+
1317
typedef struct EDIPartyName_st EDIPARTYNAME;
1418

1519
typedef struct otherName_st OTHERNAME;

‎lib/resty/openssl/x509/extension.lua

+20
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,26 @@ function _M.dup(ctx)
7979
return self, nil
8080
end
8181

82+
function _M.from_data(any, nid, crit)
83+
if type(any) ~= "table" or type(any.ctx) ~= "cdata" then
84+
return nil, "expect a table with ctx at #1"
85+
elseif type(nid) ~= "number" then
86+
return nil, "expect a table at #2"
87+
end
88+
89+
local ctx = C.X509V3_EXT_i2d(nid, crit and 1 or 0, any.ctx)
90+
if ctx == nil then
91+
return nil, format_error("extension:from_data: X509V3_EXT_i2d")
92+
end
93+
ffi_gc(ctx, C.X509_EXTENSION_free)
94+
95+
local self = setmetatable({
96+
ctx = ctx,
97+
}, mt)
98+
99+
return self, nil
100+
end
101+
82102
function _M:get_object()
83103
-- retruns the internal pointer
84104
local asn1 = C.X509_EXTENSION_get_object(self.ctx)

‎lib/resty/openssl/x509/init.lua

+80-4
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ require "resty.openssl.include.x509"
99
require "resty.openssl.include.x509v3"
1010
require "resty.openssl.include.evp"
1111
require "resty.openssl.include.objects"
12+
local stack_macro = require("resty.openssl.include.stack")
1213
local stack_lib = require("resty.openssl.stack")
1314
local asn1_lib = require("resty.openssl.asn1")
1415
local digest_lib = require("resty.openssl.digest")
@@ -166,15 +167,89 @@ function _M:get_lifetime()
166167
return not_before, not_after, nil
167168
end
168169

170+
-- note: index is 0 based
171+
local OPENSSL_STRING_value_at = function(ctx, i)
172+
local ct = ffi_cast("OPENSSL_STRING", stack_macro.OPENSSL_sk_value(ctx, i))
173+
if ct == nil then
174+
return nil
175+
end
176+
return ffi_str(ct)
177+
end
178+
179+
function _M:get_ocsp_url(return_all)
180+
local st = C.X509_get1_ocsp(self.ctx)
181+
local ret
182+
if return_all then
183+
ret = {}
184+
local count = stack_macro.OPENSSL_sk_num(st)
185+
for i=0,count do
186+
ret[i+1] = OPENSSL_STRING_value_at(st, i)
187+
end
188+
else
189+
ret = OPENSSL_STRING_value_at(st, 0)
190+
end
191+
192+
C.X509_email_free(st)
193+
return ret
194+
end
195+
196+
function _M:get_ocsp_request()
197+
198+
end
199+
200+
function _M:get_crl_url(return_all)
201+
local cdp, err = self:get_crl_distribution_points()
202+
if err then
203+
return nil, err
204+
end
205+
206+
if cdp:count() == 0 then
207+
return
208+
end
209+
210+
if return_all then
211+
local ret = {}
212+
local cdp_iter = cdp:each()
213+
while true do
214+
local _, gn = cdp_iter()
215+
if not gn then
216+
break
217+
end
218+
local gn_iter = gn:each()
219+
while true do
220+
local k, v = gn_iter()
221+
if not k then
222+
break
223+
elseif k == "URI" then
224+
table.insert(ret, v)
225+
end
226+
end
227+
end
228+
return ret
229+
else
230+
local gn, err = cdp:index(1)
231+
if err then
232+
return nil, err
233+
end
234+
local iter = gn:each()
235+
while true do
236+
local k, v = iter()
237+
if not k then
238+
break
239+
elseif k == "URI" then
240+
return v
241+
end
242+
end
243+
end
244+
end
245+
169246
function _M:sign(pkey, digest)
170247
local pkey_lib = require("resty.openssl.pkey")
171248
if not pkey_lib.istype(pkey) then
172249
return false, "expect a pkey instance at #1"
173250
end
174-
if digest then
175-
if not digest_lib.istype(digest) then
176-
return false, "expect a digest instance at #2"
177-
end
251+
if digest and not digest_lib.istype(digest) then
252+
return false, "expect a digest instance at #2"
178253
end
179254

180255
-- returns size of signature if success
@@ -301,6 +376,7 @@ else
301376
error("X509_delete_ext undefined")
302377
end
303378
end
379+
304380
function _M:set_extension(extension, last_pos)
305381
if not extension_lib.istype(extension) then
306382
return false, "expect a x509.extension instance at #1"

‎t/openssl/x509.t

+66-1
Original file line numberDiff line numberDiff line change
@@ -452,9 +452,74 @@ OCSP - URI:http://somedomain.com
452452
}
453453
--- request
454454
GET /t
455-
--- response_body_like eval
455+
--- response_body eval
456456
"URI http://crl3.digicert.com/sha2-ev-server-g2.crl
457457
URI http://crl4.digicert.com/sha2-ev-server-g2.crl
458458
"
459459
--- no_error_log
460+
[error]
461+
462+
=== TEST 18: Set CRL distribution points
463+
--- http_config eval: $::HttpConfig
464+
--- config
465+
location =/t {
466+
content_by_lua_block {
467+
-- NYI
468+
}
469+
}
470+
--- request
471+
GET /t
472+
--- no_error_log
473+
[error]
474+
475+
=== TEST 19: Get OCSP url
476+
--- http_config eval: $::HttpConfig
477+
--- config
478+
location =/t {
479+
content_by_lua_block {
480+
local f = io.open("t/fixtures/Github.pem"):read("*a")
481+
local c, err = require("resty.openssl.x509").new(f)
482+
483+
local ocsp, err = c:get_ocsp_url()
484+
if err then ngx.log(ngx.ERR, err) end
485+
ngx.say(ocsp)
486+
487+
local ocsp, err = c:get_ocsp_url(true)
488+
if err then ngx.log(ngx.ERR, err) end
489+
ngx.say(require("cjson").encode(ocsp))
490+
}
491+
}
492+
--- request
493+
GET /t
494+
--- response_body eval
495+
'http://ocsp.digicert.com
496+
["http:\/\/ocsp.digicert.com"]
497+
'
498+
--- no_error_log
499+
[error]
500+
501+
=== TEST 20: Get CRL url
502+
--- http_config eval: $::HttpConfig
503+
--- config
504+
location =/t {
505+
content_by_lua_block {
506+
local f = io.open("t/fixtures/Github.pem"):read("*a")
507+
local c, err = require("resty.openssl.x509").new(f)
508+
509+
local crl, err = c:get_crl_url()
510+
if err then ngx.log(ngx.ERR, err) end
511+
ngx.say(crl)
512+
513+
local crl, err = c:get_crl_url(true)
514+
if err then ngx.log(ngx.ERR, err) end
515+
ngx.say(require("cjson").encode(crl))
516+
}
517+
}
518+
--- request
519+
GET /t
520+
--- response_body eval
521+
'http://crl3.digicert.com/sha2-ev-server-g2.crl
522+
["http:\/\/crl3.digicert.com\/sha2-ev-server-g2.crl","http:\/\/crl4.digicert.com\/sha2-ev-server-g2.crl"]
523+
'
524+
--- no_error_log
460525
[error]

‎t/openssl/x509/altname.t

+1-1
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ __DATA__
5555
end
5656
end
5757
ngx.say(#c)
58-
ngx.say(#c:all())
58+
ngx.say(c:count())
5959
}
6060
}
6161
--- request

‎t/openssl/x509/extension.t

+26
Original file line numberDiff line numberDiff line change
@@ -191,3 +191,29 @@ CA Issuers - URI:http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServe
191191
--- no_error_log
192192
[error]
193193

194+
=== TEST 7: Creates extension by data
195+
--- http_config eval: $::HttpConfig
196+
--- config
197+
location =/t {
198+
content_by_lua_block {
199+
local altname = require("resty.openssl.x509.altname").new()
200+
altname:add("DNS", "test.com")
201+
altname:add("DNS", "test2.com")
202+
local extension = require("resty.openssl.x509.extension")
203+
local c, err = extension.from_data(altname, 85, false)
204+
if err then
205+
ngx.log(ngx.ERR, err)
206+
return
207+
end
208+
ngx.say(require("cjson").encode(c:get_object()))
209+
ngx.say(tostring(c))
210+
}
211+
}
212+
--- request
213+
GET /t
214+
--- response_body_like eval
215+
'{"ln":"X509v3 Subject Alternative Name","nid":85,"sn":"subjectAltName","id":"2.5.29.17"}
216+
DNS:test.com, DNS:test2.com
217+
'
218+
--- no_error_log
219+
[error]

0 commit comments

Comments
 (0)