Skip to content

Commit 9c4e5dc

Browse files
fffonionfffonion
committed
feat(*) support BoringSSL
1 parent f6de183 commit 9c4e5dc

20 files changed

+317
-129
lines changed

‎lib/resty/openssl/ec.lua

+22-4
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@ local ffi_gc = ffi.gc
55
require "resty.openssl.include.ec"
66
local bn_lib = require "resty.openssl.bn"
77
local objects_lib = require "resty.openssl.objects"
8+
local ctypes = require "resty.openssl.aux.ctypes"
89

910
local version_num = require("resty.openssl.version").version_num
1011
local format_error = require("resty.openssl.err").format_error
12+
local BORINGSSL = require("resty.openssl.version").BORINGSSL
1113

1214
local _M = {}
1315

@@ -36,11 +38,27 @@ function _M.get_parameters(ec_key_st)
3638
if point_form == nil then
3739
return nil, format_error("ec.get_parameters: EC_KEY_get_conv_form")
3840
end
39-
bn = C.EC_POINT_point2bn(group, pub_point, point_form, nil, bn_lib.bn_ctx_tmp)
40-
if bn == nil then
41-
return nil, format_error("ec.get_parameters: EC_POINT_point2bn")
41+
if BORINGSSL then
42+
local sz = tonumber(C.EC_POINT_point2oct(group, pub_point, point_form, nil, 0, bn_lib.bn_ctx_tmp))
43+
if sz <= 0 then
44+
return nil, format_error("ec.get_parameters: EC_POINT_point2oct")
45+
end
46+
local buf = ctypes.uchar_array(sz)
47+
C.EC_POINT_point2oct(group, pub_point, point_form, buf, sz, bn_lib.bn_ctx_tmp)
48+
buf = ffi.string(buf, sz)
49+
local err
50+
bn, err = bn_lib.from_binary(buf)
51+
if bn == nil then
52+
return nil, "ec.get_parameters: bn_lib.from_binary: " .. err
53+
end
54+
return bn
55+
else
56+
bn = C.EC_POINT_point2bn(group, pub_point, point_form, nil, bn_lib.bn_ctx_tmp)
57+
if bn == nil then
58+
return nil, format_error("ec.get_parameters: EC_POINT_point2bn")
59+
end
60+
ffi_gc(bn, C.BN_free)
4261
end
43-
ffi_gc(bn, C.BN_free)
4462
elseif k == 'private' or k == "priv_key" then
4563
-- get0, don't GC
4664
bn = C.EC_KEY_get0_private_key(ec_key_st)

‎lib/resty/openssl/include/ec.lua

+4
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ ffi.cdef [[
3131

3232
BIGNUM *EC_POINT_point2bn(const EC_GROUP *, const EC_POINT *,
3333
point_conversion_form_t form, BIGNUM *, BN_CTX *);
34+
// for BoringSSL
35+
size_t EC_POINT_point2oct(const EC_GROUP *group, const EC_POINT *p,
36+
point_conversion_form_t form,
37+
unsigned char *buf, size_t len, BN_CTX *ctx);
3438
// OpenSSL < 1.1.1
3539
int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
3640
const EC_POINT *p,

‎lib/resty/openssl/include/evp.lua

+65
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
local ffi = require "ffi"
2+
local C = ffi.C
23
local bit = require("bit")
34

45
require "resty.openssl.include.ossl_typ"
56
require "resty.openssl.include.objects"
67
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
78
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
89
local OPENSSL_30 = require("resty.openssl.version").OPENSSL_30
10+
local BORINGSSL = require("resty.openssl.version").BORINGSSL
911

1012
ffi.cdef [[
1113
EVP_PKEY *EVP_PKEY_new(void);
@@ -270,4 +272,67 @@ _M.ecx_curves = {
270272
X448 = _M.EVP_PKEY_X448,
271273
}
272274

275+
if OPENSSL_30 or BORINGSSL then
276+
ffi.cdef [[
277+
int EVP_PKEY_CTX_set_ec_paramgen_curve_nid(EVP_PKEY_CTX *ctx, int nid);
278+
int EVP_PKEY_CTX_set_ec_param_enc(EVP_PKEY_CTX *ctx, int param_enc);
279+
280+
int EVP_PKEY_CTX_set_rsa_keygen_bits(EVP_PKEY_CTX *ctx, int mbits);
281+
int EVP_PKEY_CTX_set_rsa_keygen_pubexp(EVP_PKEY_CTX *ctx, BIGNUM *pubexp);
282+
int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int pad);
283+
]]
284+
_M.EVP_PKEY_CTX_set_ec_paramgen_curve_nid = function(pctx, nid)
285+
return C.EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, nid)
286+
end
287+
_M.EVP_PKEY_CTX_set_ec_param_enc = function(pctx, param_enc)
288+
return C.EVP_PKEY_CTX_set_ec_param_enc(pctx, param_enc)
289+
end
290+
291+
_M.EVP_PKEY_CTX_set_rsa_keygen_bits = function(pctx, mbits)
292+
return C.EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, mbits)
293+
end
294+
_M.EVP_PKEY_CTX_set_rsa_keygen_pubexp = function(pctx, pubexp)
295+
return C.EVP_PKEY_CTX_set_rsa_keygen_pubexp(pctx, pubexp)
296+
end
297+
_M.EVP_PKEY_CTX_set_rsa_padding = function(pctx, pad)
298+
return C.EVP_PKEY_CTX_set_rsa_padding(pctx, pad)
299+
end
300+
else
301+
_M.EVP_PKEY_CTX_set_ec_paramgen_curve_nid = function(pctx, nid)
302+
return C.EVP_PKEY_CTX_ctrl(pctx,
303+
_M.EVP_PKEY_EC,
304+
_M.EVP_PKEY_OP_PARAMGEN + _M.EVP_PKEY_OP_KEYGEN,
305+
_M.EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID,
306+
nid, nil)
307+
end
308+
_M.EVP_PKEY_CTX_set_ec_param_enc = function(pctx, param_enc)
309+
return C.EVP_PKEY_CTX_ctrl(pctx,
310+
_M.EVP_PKEY_EC,
311+
_M.EVP_PKEY_OP_PARAMGEN + _M.EVP_PKEY_OP_KEYGEN,
312+
_M.EVP_PKEY_CTRL_EC_PARAM_ENC,
313+
param_enc, nil)
314+
end
315+
316+
_M.EVP_PKEY_CTX_set_rsa_keygen_bits = function(pctx, mbits)
317+
return C.EVP_PKEY_CTX_ctrl(pctx,
318+
_M.EVP_PKEY_RSA,
319+
_M.EVP_PKEY_OP_KEYGEN,
320+
_M.EVP_PKEY_CTRL_RSA_KEYGEN_BITS,
321+
mbits, nil)
322+
end
323+
_M.EVP_PKEY_CTX_set_rsa_keygen_pubexp = function(pctx, pubexp)
324+
return C.EVP_PKEY_CTX_ctrl(pctx,
325+
_M.EVP_PKEY_RSA, _M.EVP_PKEY_OP_KEYGEN,
326+
_M.EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP,
327+
0, pubexp)
328+
end
329+
_M.EVP_PKEY_CTX_set_rsa_padding = function(pctx, pad)
330+
return C.EVP_PKEY_CTX_ctrl(pctx,
331+
_M.EVP_PKEY_RSA,
332+
-1,
333+
_M.EVP_PKEY_CTRL_RSA_PADDING,
334+
pad, nil)
335+
end
336+
end
337+
273338
return _M

‎lib/resty/openssl/include/stack.lua

+3-2
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,15 @@ local C = ffi.C
1111
require "resty.openssl.include.ossl_typ"
1212
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
1313
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
14+
local BORINGSSL = require("resty.openssl.version").BORINGSSL
1415

1516
local _M = {}
1617

1718
ffi.cdef [[
1819
typedef char *OPENSSL_STRING;
1920
]]
2021

21-
if OPENSSL_11_OR_LATER then
22+
if OPENSSL_11_OR_LATER and not BORINGSSL then
2223
ffi.cdef [[
2324
typedef struct stack_st OPENSSL_STACK;
2425

@@ -48,7 +49,7 @@ if OPENSSL_11_OR_LATER then
4849
_M.OPENSSL_sk_delete = C.OPENSSL_sk_delete
4950
_M.OPENSSL_sk_free = C.OPENSSL_sk_free
5051
_M.OPENSSL_sk_deep_copy = C.OPENSSL_sk_deep_copy
51-
elseif OPENSSL_10 then
52+
elseif OPENSSL_10 or BORINGSSL then
5253
ffi.cdef [[
5354
typedef struct stack_st _STACK;
5455
// i made this up

‎lib/resty/openssl/kdf.lua

+2-1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ local kdf_macro = require "resty.openssl.include.kdf"
99
local format_error = require("resty.openssl.err").format_error
1010
local version_num = require("resty.openssl.version").version_num
1111
local version_text = require("resty.openssl.version").version_text
12+
local BORINGSSL = require("resty.openssl.version").BORINGSSL
1213
local ctypes = require "resty.openssl.aux.ctypes"
1314
local EVP_PKEY_OP_DERIVE = require("resty.openssl.include.evp").EVP_PKEY_OP_DERIVE
1415

@@ -30,7 +31,7 @@ if version_num >= 0x10002000 then
3031
NID_id_pbkdf2 = C.OBJ_txt2nid("PBKDF2")
3132
assert(NID_id_pbkdf2 > 0)
3233
end
33-
if version_num >= 0x10100000 then
34+
if version_num >= 0x10100000 and not BORINGSSL then
3435
NID_hkdf = C.OBJ_txt2nid("HKDF")
3536
assert(NID_hkdf > 0)
3637
NID_tls1_prf = C.OBJ_txt2nid("TLS1-PRF")

‎lib/resty/openssl/pkey.lua

+13-34
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ local format_error = require("resty.openssl.err").format_error
2727
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
2828
local OPENSSL_111_OR_LATER = require("resty.openssl.version").OPENSSL_111_OR_LATER
2929
local OPENSSL_30 = require("resty.openssl.version").OPENSSL_30
30+
local BORINGSSL = require("resty.openssl.version").BORINGSSL
3031

3132
local ptr_of_uint = ctypes.ptr_of_uint
3233
local ptr_of_size_t = ctypes.ptr_of_size_t
@@ -162,23 +163,16 @@ local function generate_param(key_type, config)
162163
if nid == 0 then
163164
return nil, "unknown curve " .. curve
164165
end
165-
-- EVP_PKEY_CTX_set_ec_paramgen_curve_nid
166-
if C.EVP_PKEY_CTX_ctrl(pctx,
167-
evp_macro.EVP_PKEY_EC,
168-
evp_macro.EVP_PKEY_OP_PARAMGEN + evp_macro.EVP_PKEY_OP_KEYGEN,
169-
evp_macro.EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID,
170-
nid, nil) <= 0 then
166+
if evp_macro.EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, nid) <= 0 then
171167
return nil, format_error("EVP_PKEY_CTX_ctrl: EC: curve_nid")
172168
end
173-
-- use the named-curve encoding for best backward-compatibilty
174-
-- and for playing well with go:crypto/x509
175-
-- # define OPENSSL_EC_NAMED_CURVE 0x001
176-
if C.EVP_PKEY_CTX_ctrl(pctx,
177-
evp_macro.EVP_PKEY_EC,
178-
evp_macro.EVP_PKEY_OP_PARAMGEN + evp_macro.EVP_PKEY_OP_KEYGEN,
179-
evp_macro.EVP_PKEY_CTRL_EC_PARAM_ENC,
180-
1, nil) <= 0 then
181-
return nil, format_error("EVP_PKEY_CTX_ctrl: EC: param_enc")
169+
if not BORINGSSL then
170+
-- use the named-curve encoding for best backward-compatibilty
171+
-- and for playing well with go:crypto/x509
172+
-- # define OPENSSL_EC_NAMED_CURVE 0x001
173+
if evp_macro.EVP_PKEY_CTX_set_ec_param_enc(pctx, 1) <= 0 then
174+
return nil, format_error("EVP_PKEY_CTX_ctrl: EC: param_enc")
175+
end
182176
end
183177
elseif key_type == evp_macro.EVP_PKEY_DH then
184178
local bits = config.bits
@@ -302,11 +296,7 @@ local function generate_key(config)
302296
return nil, "bits out of range"
303297
end
304298

305-
-- EVP_PKEY_CTX_set_rsa_keygen_bits
306-
if C.EVP_PKEY_CTX_ctrl(pctx,
307-
evp_macro.EVP_PKEY_RSA, evp_macro.EVP_PKEY_OP_KEYGEN,
308-
evp_macro.EVP_PKEY_CTRL_RSA_KEYGEN_BITS,
309-
bits, nil) <= 0 then
299+
if evp_macro.EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, bits) <= 0 then
310300
return nil, format_error("EVP_PKEY_CTX_ctrl: RSA: bits")
311301
end
312302

@@ -317,11 +307,8 @@ local function generate_key(config)
317307
return nil, "BN_new() failed"
318308
end
319309
C.BN_set_word(exp, config.exp)
320-
-- EVP_PKEY_CTX_set_rsa_keygen_pubexp
321-
if C.EVP_PKEY_CTX_ctrl(pctx,
322-
evp_macro.EVP_PKEY_RSA, evp_macro.EVP_PKEY_OP_KEYGEN,
323-
evp_macro.EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP,
324-
0, exp) <= 0 then
310+
311+
if evp_macro.EVP_PKEY_CTX_set_rsa_keygen_pubexp(pctx, exp) <= 0 then
325312
return nil, format_error("EVP_PKEY_CTX_ctrl: RSA: exp")
326313
end
327314
end
@@ -608,15 +595,7 @@ local function asymmetric_routine(self, s, op, padding)
608595

609596
-- EVP_PKEY_CTX_ctrl must be called after *_init
610597
if self.key_type == evp_macro.EVP_PKEY_RSA and padding then
611-
local code
612-
if OPENSSL_30 then
613-
code = C.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding)
614-
else
615-
code = C.EVP_PKEY_CTX_ctrl(pkey_ctx, evp_macro.EVP_PKEY_RSA, -1,
616-
evp_macro.EVP_PKEY_CTRL_RSA_PADDING,
617-
padding, nil)
618-
end
619-
if code ~= 1 then
598+
if evp_macro.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding) ~= 1 then
620599
return nil, format_error("pkey:asymmetric_routine EVP_PKEY_CTX_ctrl")
621600
end
622601
self.rsa_padding = padding

‎lib/resty/openssl/version.lua

+9
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ ffi.cdef[[
1212
const char *OpenSSL_version(int t);
1313
// >= 3.0
1414
const char *OPENSSL_info(int t);
15+
// BoringSSL
16+
int BORINGSSL_self_test(void);
1517
]]
1618

1719
local version_func, info_func
@@ -85,6 +87,12 @@ else
8587
end
8688
end
8789

90+
local BORINGSSL = false
91+
pcall(function()
92+
local _ = C.BORINGSSL_self_test
93+
BORINGSSL = true
94+
end)
95+
8896
return setmetatable({
8997
version_num = tonumber(version_num),
9098
version_text = ffi_str(version_func(0)),
@@ -100,6 +108,7 @@ return setmetatable({
100108
OPENSSL_11_OR_LATER = version_num >= 0x10100000 and version_num < 0x30100000,
101109
OPENSSL_111_OR_LATER = version_num >= 0x10101000 and version_num < 0x30100000,
102110
OPENSSL_10 = version_num < 0x10100000 and version_num > 0x10000000,
111+
BORINGSSL = BORINGSSL,
103112
}, {
104113
__index = types_table,
105114
})

‎lib/resty/openssl/x509/extension.lua

+15-7
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ local objects_lib = require "resty.openssl.objects"
1515
local stack_lib = require("resty.openssl.stack")
1616
local util = require "resty.openssl.util"
1717
local format_error = require("resty.openssl.err").format_error
18+
local BORINGSSL = require("resty.openssl.version").BORINGSSL
1819

1920
local _M = {}
2021
local mt = { __index = _M }
@@ -28,15 +29,22 @@ local extension_types = {
2829
crl = "resty.openssl.x509.crl",
2930
}
3031

31-
local function nconf_load(conf, str)
32-
local bio = C.BIO_new_mem_buf(str, #str)
33-
if bio == nil then
34-
return format_error("BIO_new_mem_buf")
32+
local nconf_load
33+
if BORINGSSL then
34+
nconf_load = function()
35+
return nil, "NCONF_load_bio not exported in BoringSSL"
3536
end
36-
ffi_gc(bio, C.BIO_free)
37+
else
38+
nconf_load = function(conf, str)
39+
local bio = C.BIO_new_mem_buf(str, #str)
40+
if bio == nil then
41+
return format_error("BIO_new_mem_buf")
42+
end
43+
ffi_gc(bio, C.BIO_free)
3744

38-
if C.NCONF_load_bio(conf, bio, nil) ~= 1 then
39-
return format_error("NCONF_load_bio")
45+
if C.NCONF_load_bio(conf, bio, nil) ~= 1 then
46+
return format_error("NCONF_load_bio")
47+
end
4048
end
4149
end
4250

‎scripts/types_test.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
{
44
"bn": {
55
"new_from": "new(math.random(1, 2333333))",
6-
"print": "to_hex",
6+
"print": "to_hex():upper",
77
},
88
"number": {
99
"new_from": "ngx.time()",

‎t/openssl/bn.t

+2-2
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,8 @@ bn:to_binary failed
150150
}
151151
--- request
152152
GET /t
153-
--- response_body eval
154-
"5B25"
153+
--- response_body_like eval
154+
"5[Bb]25"
155155
--- no_error_log
156156
[error]
157157

0 commit comments

Comments
 (0)