|
| 1 | +local ffi = require "ffi" |
| 2 | +local C = ffi.C |
| 3 | +local ffi_gc = ffi.gc |
| 4 | + |
| 5 | +require "resty.openssl.include.dh" |
| 6 | +local bn_lib = require "resty.openssl.bn" |
| 7 | +local objects_lib = require "resty.openssl.objects" |
| 8 | + |
| 9 | +local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10 |
| 10 | +local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER |
| 11 | +local format_error = require("resty.openssl.err").format_error |
| 12 | + |
| 13 | +local _M = {} |
| 14 | + |
| 15 | +_M.params = {"public", "private", "p", "q", "g"} |
| 16 | + |
| 17 | +local empty_table = {} |
| 18 | +local bn_ptrptr_ct = ffi.typeof("const BIGNUM *[1]") |
| 19 | +function _M.get_parameters(dh_st) |
| 20 | + return setmetatable(empty_table, { |
| 21 | + __index = function(_, k) |
| 22 | + local ptr, ret |
| 23 | + if OPENSSL_11_OR_LATER then |
| 24 | + ptr = bn_ptrptr_ct() |
| 25 | + end |
| 26 | + |
| 27 | + if OPENSSL_11_OR_LATER then |
| 28 | + ptr = bn_ptrptr_ct() |
| 29 | + end |
| 30 | + |
| 31 | + if k == 'p' then |
| 32 | + if OPENSSL_11_OR_LATER then |
| 33 | + C.DH_get0_pqg(dh_st, ptr, nil, nil) |
| 34 | + end |
| 35 | + elseif k == 'q' then |
| 36 | + if OPENSSL_11_OR_LATER then |
| 37 | + C.DH_get0_pqg(dh_st, nil, ptr, nil) |
| 38 | + end |
| 39 | + elseif k == 'g' then |
| 40 | + if OPENSSL_11_OR_LATER then |
| 41 | + C.DH_get0_pqg(dh_st, nil, nil, ptr) |
| 42 | + end |
| 43 | + elseif k == 'public' then |
| 44 | + if OPENSSL_11_OR_LATER then |
| 45 | + C.DH_get0_key(dh_st, ptr, nil) |
| 46 | + end |
| 47 | + k = "pub_key" |
| 48 | + elseif k == 'private' then |
| 49 | + if OPENSSL_11_OR_LATER then |
| 50 | + C.DH_get0_key(dh_st, nil, ptr) |
| 51 | + end |
| 52 | + k = "priv_key" |
| 53 | + else |
| 54 | + return nil, "rsa.get_parameters: unknown parameter \"" .. k .. "\" for RSA key" |
| 55 | + end |
| 56 | + |
| 57 | + if OPENSSL_11_OR_LATER then |
| 58 | + ret = ptr[0] |
| 59 | + elseif OPENSSL_10 then |
| 60 | + ret = dh_st[k] |
| 61 | + end |
| 62 | + |
| 63 | + if ret == nil then |
| 64 | + return nil |
| 65 | + end |
| 66 | + return bn_lib.dup(ret) |
| 67 | + end |
| 68 | + }), nil |
| 69 | +end |
| 70 | + |
| 71 | +local function dup_bn_value(v) |
| 72 | + if not bn_lib.istype(v) then |
| 73 | + return nil, "expect value to be a bn instance" |
| 74 | + end |
| 75 | + local bn = C.BN_dup(v.ctx) |
| 76 | + if bn == nil then |
| 77 | + return nil, "BN_dup() failed" |
| 78 | + end |
| 79 | + return bn |
| 80 | +end |
| 81 | + |
| 82 | +function _M.set_parameters(dh_st, opts) |
| 83 | + local err |
| 84 | + local opts_bn = {} |
| 85 | + -- remember which parts of BNs has been added to dh_st, they should be freed |
| 86 | + -- by DH_free and we don't cleanup them on failure |
| 87 | + local cleanup_from_idx = 1 |
| 88 | + -- dup input |
| 89 | + local do_set_key, do_set_pqg |
| 90 | + for k, v in pairs(opts) do |
| 91 | + opts_bn[k], err = dup_bn_value(v) |
| 92 | + if err then |
| 93 | + err = "dh.set_parameters: cannot process parameter \"" .. k .. "\":" .. err |
| 94 | + goto cleanup_with_error |
| 95 | + end |
| 96 | + if k == "private" or k == "public" then |
| 97 | + do_set_key = true |
| 98 | + elseif k == "p" or k == "q" or k == "g" then |
| 99 | + do_set_pqg = true |
| 100 | + end |
| 101 | + end |
| 102 | + if OPENSSL_11_OR_LATER then |
| 103 | + local code |
| 104 | + if do_set_key then |
| 105 | + code = C.DH_set0_key(dh_st, opts_bn["public"], opts_bn["private"]) |
| 106 | + if code == 0 then |
| 107 | + err = format_error("dh.set_parameters: DH_set0_key") |
| 108 | + goto cleanup_with_error |
| 109 | + end |
| 110 | + end |
| 111 | + cleanup_from_idx = cleanup_from_idx + 2 |
| 112 | + if do_set_pqg then |
| 113 | + code = C.DH_set0_pqg(dh_st, opts_bn["p"], opts_bn["q"], opts_bn["g"]) |
| 114 | + if code == 0 then |
| 115 | + err = format_error("dh.set_parameters: DH_set0_pqg") |
| 116 | + goto cleanup_with_error |
| 117 | + end |
| 118 | + end |
| 119 | + return true |
| 120 | + elseif OPENSSL_10 then |
| 121 | + for k, v in pairs(opts_bn) do |
| 122 | + if k == "public" then |
| 123 | + k = "pub_key" |
| 124 | + elseif k == "private" then |
| 125 | + k = "priv_key" |
| 126 | + end |
| 127 | + dh_st[k]= v |
| 128 | + end |
| 129 | + return true |
| 130 | + end |
| 131 | + |
| 132 | +::cleanup_with_error:: |
| 133 | + for i, k in pairs(_M.params) do |
| 134 | + if i >= cleanup_from_idx then |
| 135 | + C.BN_free(opts_bn[k]) |
| 136 | + end |
| 137 | + end |
| 138 | + return false, err |
| 139 | +end |
| 140 | + |
| 141 | +return _M |
0 commit comments