Skip to content

Commit 65750bf

Browse files
fffonionfffonion
committed
feat(ctx) add ctx module to provide OSSL_LIB_CTX context
1 parent 273f847 commit 65750bf

File tree

11 files changed

+99
-19
lines changed

11 files changed

+99
-19
lines changed

‎lib/resty/openssl.lua

+8-4
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,7 @@ end
200200
if OPENSSL_30 then
201201
require "resty.openssl.include.evp"
202202
local provider = require "resty.openssl.provider"
203+
local ctx_lib = require "resty.openssl.ctx"
203204
local fips_provider_ctx
204205

205206
function _M.set_fips_mode(enable, self_test)
@@ -229,7 +230,7 @@ if OPENSSL_30 then
229230
-- set algorithm in fips mode in default ctx
230231
-- this deny/allow non-FIPS compliant algorithms to be used from EVP interface
231232
-- and redirect/remove redirect implementation to fips provider
232-
if C.EVP_default_properties_enable_fips(nil, enable and 1 or 0) == 0 then
233+
if C.EVP_default_properties_enable_fips(ctx_lib.get_libctx(), enable and 1 or 0) == 0 then
233234
return false, format_error("openssl.set_fips_mode: EVP_default_properties_enable_fips")
234235
end
235236

@@ -242,7 +243,7 @@ if OPENSSL_30 then
242243
return false
243244
end
244245

245-
return C.EVP_default_properties_is_fips_enabled(nil) == 1
246+
return C.EVP_default_properties_is_fips_enabled(ctx_lib.get_libctx()) == 1
246247
end
247248

248249
else
@@ -268,7 +269,9 @@ function _M.set_default_properties(props)
268269
return nil, "openssl.set_default_properties is only not supported from OpenSSL 3.0"
269270
end
270271

271-
if C.EVP_set_default_properties(props) == 0 then
272+
local ctx_lib = require "resty.openssl.ctx"
273+
274+
if C.EVP_set_default_properties(ctx_lib.get_libctx(), props) == 0 then
272275
return false, format_error("openssl.EVP_set_default_properties")
273276
end
274277

@@ -298,6 +301,7 @@ local function list_provided(typ)
298301
local typ_lower = string.lower(typ:sub(5)) -- cut off EVP_
299302
local typ_ptr = typ .. "*"
300303
require ("resty.openssl.include.evp." .. typ_lower)
304+
local ctx_lib = require "resty.openssl.ctx"
301305

302306
local ret = {}
303307

@@ -310,7 +314,7 @@ local function list_provided(typ)
310314
table.insert(ret, name .. " @ " .. prov)
311315
end)
312316

313-
C[typ .. "_do_all_provided"](nil, fn, nil)
317+
C[typ .. "_do_all_provided"](ctx_lib.get_libctx(), fn, nil)
314318
fn:free()
315319

316320
table.sort(ret)

‎lib/resty/openssl/auxiliary/ctypes.lua

+1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ return {
1919
ptr_of_uint = ffi.typeof("unsigned int[1]"),
2020
ptr_of_size_t = ffi.typeof("size_t[1]"),
2121
ptr_of_int = ffi.typeof("int[1]"),
22+
null = ffi.new("void *"), -- hack wher ngx.null is not available
2223

2324
uchar_array = ffi.typeof("unsigned char[?]"),
2425

‎lib/resty/openssl/cipher.lua

+3-2
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ local ffi_cast = ffi.cast
77
require "resty.openssl.include.evp.cipher"
88
local evp_macro = require "resty.openssl.include.evp"
99
local ctypes = require "resty.openssl.auxiliary.ctypes"
10+
local ctx_lib = require "resty.openssl.ctx"
1011
local format_error = require("resty.openssl.err").format_error
1112
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
1213
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
@@ -41,7 +42,7 @@ function _M.new(typ, properties)
4142

4243
local ctyp
4344
if OPENSSL_30 then
44-
ctyp = C.EVP_CIPHER_fetch(nil, typ, properties)
45+
ctyp = C.EVP_CIPHER_fetch(ctx_lib.get_libctx(), typ, properties)
4546
else
4647
ctyp = C.EVP_get_cipherbyname(typ)
4748
end
@@ -269,7 +270,7 @@ function _M:derive(key, salt, count, md, md_properties)
269270

270271
local mdt
271272
if OPENSSL_30 then
272-
mdt = C.EVP_MD_fetch(nil, md or 'sha1', md_properties)
273+
mdt = C.EVP_MD_fetch(ctx_lib.get_libctx(), md or 'sha1', md_properties)
273274
else
274275
mdt = C.EVP_get_digestbyname(md or 'sha1')
275276
end

‎lib/resty/openssl/ctx.lua

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
local ffi = require "ffi"
2+
local C = ffi.C
3+
local ffi_gc = ffi.gc
4+
5+
local format_error = require("resty.openssl.err").format_error
6+
7+
ffi.cdef [[
8+
typedef struct ossl_lib_ctx_st OSSL_LIB_CTX;
9+
10+
OSSL_LIB_CTX *OSSL_LIB_CTX_new(void);
11+
int OSSL_LIB_CTX_load_config(OSSL_LIB_CTX *ctx, const char *config_file);
12+
void OSSL_LIB_CTX_free(OSSL_LIB_CTX *ctx);
13+
]]
14+
15+
local libcrypto_name
16+
local ossl_lib_ctx
17+
18+
local lib_patterns = {
19+
"%s", "%s.so.3", "%s.so.1.1", "%s.so.1.0"
20+
}
21+
22+
local function load_library()
23+
for _, pattern in ipairs(lib_patterns) do
24+
-- true: load to global namespae
25+
local pok, _ = pcall(ffi.load, string.format(pattern, "crypto"), true)
26+
if pok then
27+
libcrypto_name = string.format(pattern, "crypto")
28+
ffi.load(string.format(pattern, "ssl"), true)
29+
30+
return true
31+
end
32+
end
33+
34+
return false, "unable to load crypto library"
35+
end
36+
37+
local function new(context_only, conf_file)
38+
local ctx = C.OSSL_LIB_CTX_new()
39+
ffi_gc(ctx, C.OSSL_LIB_CTX_free)
40+
41+
if conf_file and C.OSSL_LIB_CTX_load_config(ctx, conf_file) ~= 1 then
42+
return false, format_error("ctx.new")
43+
end
44+
45+
if context_only then
46+
ngx.ctx.ossl_lib_ctx = ctx
47+
else
48+
ossl_lib_ctx = ctx
49+
end
50+
end
51+
52+
local function free(context_only)
53+
if context_only then
54+
ngx.ctx.ossl_lib_ctx = nil
55+
else
56+
ossl_lib_ctx = nil
57+
end
58+
end
59+
60+
return {
61+
new = new,
62+
free = free,
63+
load_library = load_library,
64+
get_library_name = function() return libcrypto_name end,
65+
get_libctx = function() return ngx.ctx.ossl_lib_ctx or ossl_lib_ctx end,
66+
}

‎lib/resty/openssl/digest.lua

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ local ffi_str = ffi.string
55

66
require "resty.openssl.include.evp.md"
77
local ctypes = require "resty.openssl.auxiliary.ctypes"
8+
local ctx_lib = require "resty.openssl.ctx"
89
local format_error = require("resty.openssl.err").format_error
910
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
1011
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
@@ -35,7 +36,7 @@ function _M.new(typ, properties)
3536
algo = C.EVP_md_null()
3637
else
3738
if OPENSSL_30 then
38-
algo = C.EVP_MD_fetch(nil, typ or 'sha1', properties)
39+
algo = C.EVP_MD_fetch(ctx_lib.get_libctx(), typ or 'sha1', properties)
3940
else
4041
algo = C.EVP_get_digestbyname(typ or 'sha1')
4142
end

‎lib/resty/openssl/kdf.lua

+3-2
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ require("resty.openssl.include.evp.md")
88
-- used by legacy EVP_PKEY_derive interface
99
require("resty.openssl.include.evp.pkey")
1010
local kdf_macro = require "resty.openssl.include.evp.kdf"
11+
local ctx_lib = require "resty.openssl.ctx"
1112
local format_error = require("resty.openssl.err").format_error
1213
local version_num = require("resty.openssl.version").version_num
1314
local version_text = require("resty.openssl.version").version_text
@@ -168,7 +169,7 @@ function _M.derive(options)
168169

169170
local md
170171
if OPENSSL_30 then
171-
md = C.EVP_MD_fetch(nil, options.md or 'sha1', options.properties)
172+
md = C.EVP_MD_fetch(ctx_lib.get_libctx(), options.md or 'sha1', options.properties)
172173
else
173174
md = C.EVP_get_digestbyname(options.md or 'sha1')
174175
end
@@ -300,7 +301,7 @@ local mt = {__index = _M}
300301
local kdf_ctx_ptr_ct = ffi.typeof('EVP_KDF_CTX*')
301302

302303
function _M.new(typ, properties)
303-
local algo = C.EVP_KDF_fetch(nil, typ, properties)
304+
local algo = C.EVP_KDF_fetch(ctx_lib.get_libctx(), typ, properties)
304305
if algo == nil then
305306
return nil, format_error(string.format("mac.new: invalid mac type \"%s\"", typ))
306307
end

‎lib/resty/openssl/mac.lua

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ local ffi_str = ffi.string
55

66
require "resty.openssl.include.evp.mac"
77
local param_lib = require "resty.openssl.param"
8+
local ctx_lib = require "resty.openssl.ctx"
89
local ctypes = require "resty.openssl.auxiliary.ctypes"
910
local format_error = require("resty.openssl.err").format_error
1011
local OPENSSL_30 = require("resty.openssl.version").OPENSSL_30
@@ -24,7 +25,7 @@ function _M.new(key, typ, cipher, digest, properties)
2425
return false, "EVP_MAC is only supported from OpenSSL 3.0"
2526
end
2627

27-
local algo = C.EVP_MAC_fetch(nil, typ, properties)
28+
local algo = C.EVP_MAC_fetch(ctx_lib.get_libctx(), typ, properties)
2829
if algo == nil then
2930
return nil, format_error(string.format("mac.new: invalid mac type \"%s\"", typ))
3031
end

‎lib/resty/openssl/param.lua

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ local C = ffi.C
33
local ffi_new = ffi.new
44
local ffi_str = ffi.string
55
local ffi_cast = ffi.cast
6-
local null = ngx.null
76

87
require "resty.openssl.include.param"
98
local format_error = require("resty.openssl.err").format_error
109
local bn_lib = require("resty.openssl.bn")
10+
local null = require("resty.openssl.auxiliary.ctypes").null
1111

1212
local OSSL_PARAM_INTEGER = 1
1313
local OSSL_PARAM_UNSIGNED_INTEGER = 2

‎lib/resty/openssl/pkey.lua

+3-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ local ffi_new = ffi.new
55
local ffi_str = ffi.string
66
local ffi_cast = ffi.cast
77
local ffi_copy = ffi.copy
8-
local null = ngx.null
98

109
local rsa_macro = require "resty.openssl.include.rsa"
1110
local dh_macro = require "resty.openssl.include.dh"
@@ -23,6 +22,7 @@ local ec_lib = require "resty.openssl.ec"
2322
local ecx_lib = require "resty.openssl.ecx"
2423
local objects_lib = require "resty.openssl.objects"
2524
local jwk_lib = require "resty.openssl.auxiliary.jwk"
25+
local ctx_lib = require "resty.openssl.ctx"
2626
local ctypes = require "resty.openssl.auxiliary.ctypes"
2727
local format_error = require("resty.openssl.err").format_error
2828

@@ -34,6 +34,7 @@ local BORINGSSL = require("resty.openssl.version").BORINGSSL
3434
local ptr_of_uint = ctypes.ptr_of_uint
3535
local ptr_of_size_t = ctypes.ptr_of_size_t
3636

37+
local null = ctypes.null
3738
local load_pem_args = { null, null, null }
3839
local load_der_args = { null }
3940

@@ -665,7 +666,7 @@ local function sign_verify_prepare(self, fint, md_alg, padding, opts)
665666
local algo
666667
if md_alg then
667668
if OPENSSL_30 then
668-
algo = C.EVP_MD_fetch(nil, md_alg, nil)
669+
algo = C.EVP_MD_fetch(ctx_lib.get_libctx(), md_alg, nil)
669670
else
670671
algo = C.EVP_get_digestbyname(md_alg)
671672
end

‎lib/resty/openssl/provider.lua

+8-5
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ local C = ffi.C
33

44
require "resty.openssl.include.provider"
55
local param_lib = require "resty.openssl.param"
6+
local ctx_lib = require "resty.openssl.ctx"
7+
local null = require("resty.openssl.auxiliary.ctypes").null
68
local OPENSSL_30 = require("resty.openssl.version").OPENSSL_30
79
local format_error = require("resty.openssl.err").format_error
810

@@ -17,13 +19,14 @@ local ossl_provider_ctx_ct = ffi.typeof('OSSL_PROVIDER*')
1719

1820
function _M.load(name, try)
1921
local ctx
22+
local libctx = ctx_lib.get_libctx()
2023
if try then
21-
ctx = C.OSSL_PROVIDER_try_load(nil, name)
24+
ctx = C.OSSL_PROVIDER_try_load(libctx, name)
2225
if ctx == nil then
2326
return nil, format_error("provider.try_load")
2427
end
2528
else
26-
ctx = C.OSSL_PROVIDER_load(nil, name)
29+
ctx = C.OSSL_PROVIDER_load(libctx, name)
2730
if ctx == nil then
2831
return nil, format_error("provider.load")
2932
end
@@ -36,11 +39,11 @@ function _M.load(name, try)
3639
end
3740

3841
function _M.set_default_search_path(path)
39-
C.OSSL_PROVIDER_set_default_search_path(nil, path)
42+
C.OSSL_PROVIDER_set_default_search_path(ctx_lib.get_libctx(), path)
4043
end
4144

4245
function _M.is_available(name)
43-
return C.OSSL_PROVIDER_available(nil, name) == 1
46+
return C.OSSL_PROVIDER_available(ctx_lib.get_libctx(), name) == 1
4447
end
4548

4649
function _M.istype(l)
@@ -108,7 +111,7 @@ function _M:get_params(...)
108111

109112
local buffers = {}
110113
for _, key in ipairs(keys) do
111-
buffers[key] = ngx.null
114+
buffers[key] = null
112115
end
113116
local req, err = param_lib.construct(buffers, key_length, self.param_types)
114117
if not req then

‎lib/resty/openssl/x509/init.lua

+2-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ local pkey_lib = require("resty.openssl.pkey")
1717
local util = require "resty.openssl.util"
1818
local txtnid2nid = require("resty.openssl.objects").txtnid2nid
1919
local ctypes = require "resty.openssl.auxiliary.ctypes"
20+
local ctx_lib = require "resty.openssl.ctx"
2021
local format_error = require("resty.openssl.err").format_error
2122
local version = require("resty.openssl.version")
2223
local OPENSSL_10 = version.OPENSSL_10
@@ -329,7 +330,7 @@ local function digest(self, cfunc, typ, properties)
329330

330331
local algo
331332
if OPENSSL_30 then
332-
algo = C.EVP_MD_fetch(nil, typ or 'sha1', properties)
333+
algo = C.EVP_MD_fetch(ctx_lib.get_libctx(), typ or 'sha1', properties)
333334
else
334335
algo = C.EVP_get_digestbyname(typ or 'sha1')
335336
end

0 commit comments

Comments
 (0)