SSL and HTTPS now supported for scripts.
This commit is contained in:
Scott Duensing
parent
ea544996f1
commit
de6d5f1fe5
37195 changed files with 6233435 additions and 0 deletions
3
thirdparty/luasec/.gitignore
vendored
Normal file
3
thirdparty/luasec/.gitignore
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
/src/*.o
|
||||
/src/luasocket/*.o
|
||||
/*.dll
|
||||
257
thirdparty/luasec/CHANGELOG
vendored
Normal file
257
thirdparty/luasec/CHANGELOG
vendored
Normal file
|
|
@ -0,0 +1,257 @@
|
|||
--------------------------------------------------------------------------------
|
||||
LuaSec 1.3.2
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Fix: place EAI_OVERFLOW inside macro, unbreak build on <10.7 (Sergey Fedorov)
|
||||
* Fix: Expand workaround for zero errno to OpenSSL 3.0.x (Kim Alvefur)
|
||||
* Fix: reset block timeout at send or receive (MartinDahlberg)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 1.3.1
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Fix: check if PSK is available
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 1.3.0
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Add :getlocalchain() + :getlocalcertificate() to mirror the peer methods (@mwild1)
|
||||
* Add Pre-Shared Key (PSK) support (@jclab-joseph)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 1.2.0
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Add key material export method
|
||||
* Backguard compat for openssl on providers, like LTS linuxes
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 1.1.0
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Fix missing DANE flag
|
||||
* Remove unused parameter in https.lua
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 1.0.2
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Fix handle SSL_send SYSCALL error without errno
|
||||
* Fix off by one in cert:validat(notafter)
|
||||
* Fix meth_get_{sinagure => signature}_name function name
|
||||
* Fix update the Lua state reference on the selected SSL context after SNI
|
||||
* Fix ignore SSL_OP_BIT(n) macro and update option.c
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 1.0.1
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
|
||||
* Fix luaL_buffinit() can use the stack and broke buffer_meth_receive()
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 1.0
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
|
||||
* Add cert:getsignaturename()
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.9
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
|
||||
* Add DNS-based Authentication of Named Entities (DANE) support
|
||||
* Add __close() metamethod
|
||||
* Fix deprecation warnings with OpenSSL 1.1
|
||||
* Fix special case listing of TLS 1.3 EC curves
|
||||
* Fix general_name leak in cert:extensions()
|
||||
* Fix unexported 'ssl.config' table
|
||||
* Replace $(LD) with $(CCLD) variable
|
||||
* Remove multiple definitions of 'ssl_options' variable
|
||||
* Use tag in git format: v0.9
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.8.2
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Fix unexported 'ssl.config' table (backported)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.8.1
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Fix general_name leak in cert:extensions() (backported)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.8
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Add support to ALPN
|
||||
* Add support to TLS 1.3
|
||||
* Add support to multiple certificates
|
||||
* Add timeout to https module (https.TIMEOUT)
|
||||
* Drop support to SSL 3.0
|
||||
* Drop support to TLS 1.0 from https module
|
||||
* Fix invalid reference to Lua state
|
||||
* Fix memory leak when get certficate extensions
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.7.2
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Fix unexported 'ssl.config' table (backported)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.7.1
|
||||
---------------
|
||||
This version includes:
|
||||
|
||||
* Fix general_name leak in cert:extensions() (backported)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.7
|
||||
---------------
|
||||
LuaSec depends on OpenSSL, and integrates with LuaSocket to make it
|
||||
easy to add secure connections to any Lua applications or scripts.
|
||||
|
||||
Documentation: https://github.com/brunoos/luasec/wiki
|
||||
|
||||
This version includes:
|
||||
|
||||
* Add support to OpenSSL 1.1.0
|
||||
* Add support to elliptic curves list
|
||||
* Add ssl.config that exports some OpenSSL information
|
||||
* Add integration with luaossl
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.6
|
||||
------------
|
||||
LuaSec depends on OpenSSL, and integrates with LuaSocket to make it
|
||||
easy to add secure connections to any Lua applications or scripts.
|
||||
|
||||
Documentation: https://github.com/brunoos/luasec/wiki
|
||||
|
||||
This version includes:
|
||||
|
||||
* Lua 5.2 and 5.3 compatibility
|
||||
|
||||
* Context module:
|
||||
- Add ctx:checkkey()
|
||||
|
||||
* SSL module:
|
||||
- Add conn:sni() and conn:getsniname()
|
||||
|
||||
* Context options:
|
||||
- Add "any" protocol ("sslv23" is deprecated)
|
||||
|
||||
* HTTPS module:
|
||||
- Using "any" protocol without SSLv2/SSLv3, by default
|
||||
|
||||
* X509 module:
|
||||
- Human readable IP address
|
||||
- Add cert:issued()
|
||||
- Add cert:pubkey()
|
||||
|
||||
* Some bug fixes
|
||||
|
||||
|
||||
=> Thanks to everyone who collaborate with LuaSec <=
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.5
|
||||
------------
|
||||
LuaSec depends on OpenSSL, and integrates with LuaSocket to make it
|
||||
easy to add secure connections to any Lua applications or scripts.
|
||||
|
||||
This version includes:
|
||||
|
||||
* A new certificate (X509) API, which supports:
|
||||
- Reading the subject (identity) and issuer of the certificate.
|
||||
- Reading various X509 extensions, including email and dnsName.
|
||||
- Converting certificates to and from the standard ASCII PEM
|
||||
format.
|
||||
- Generating the fingerprint/digest of a certificate (using SHA1,
|
||||
SHA256 or SHA512).
|
||||
- Reading the certificate's expiration, serial number, and other
|
||||
info.
|
||||
|
||||
* The ability to get more detailed information from OpenSSL about
|
||||
why a certificate failed verification, for each certificate in the
|
||||
chain.
|
||||
|
||||
* Flags to force acceptance of invalid certificates, e.g. to allow
|
||||
the use of self-signed certificates in a Trust On First Use model.
|
||||
|
||||
* Flags to control checking CRLs for certificate revocation status.
|
||||
|
||||
* Support for ECDH cipher suites.
|
||||
|
||||
* An API to get the TLS 'finished' messages used for SASL channel
|
||||
binding (e.g. the SCRAM PLUS mechanisms).
|
||||
|
||||
The work in this release was undertaken by Kim Alvefur, Paul Aurich,
|
||||
Tobias Markmann, Bruno Silvestre and Matthew Wild.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.4.1
|
||||
------------
|
||||
- SSL options updated --- based on OpenSSL 1.0.0d.
|
||||
- Activate SSL_MODE_RELEASE_BUFFERS by default if it is available.
|
||||
(thanks Prosody project)
|
||||
|
||||
---------------------------------------------------------------------------------
|
||||
LuaSec 0.4
|
||||
------------
|
||||
- Add option 'no_ticket' (included in OpenSSL 0.9.8f).
|
||||
- Add HTTPS module. (thanks Tomas Guisasola and Pablo Musa)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.3.3
|
||||
------------
|
||||
- BUG: Clear the error queue before call I/O functions (see SSL_get_error
|
||||
manual).
|
||||
(thanks Matthew Wild)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.3.2
|
||||
------------
|
||||
- BUG: Windows uses a different way to report socket error.
|
||||
(thanks Sebastien Perin)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.3.1
|
||||
------------
|
||||
- BUG: receive("a") returns 'closed' error instead of the content when the
|
||||
SSL/TLS connection is shut down cleanly. (thanks Matthias Diener)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.3
|
||||
----------
|
||||
- Add functions ssl.rawcontext() and ssl.rawconnection()
|
||||
- Add support to encrypted key password. (thanks Norbert Kiesel)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.2.1
|
||||
------------
|
||||
- 'key' and 'certificate' configurations become optional. (thanks René Rebe)
|
||||
- Add '_VERSION' variable to module.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
LuaSec 0.2
|
||||
----------
|
||||
Initial version
|
||||
39
thirdparty/luasec/INSTALL
vendored
Normal file
39
thirdparty/luasec/INSTALL
vendored
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
LuaSec 1.3.2
|
||||
------------
|
||||
|
||||
* OpenSSL options:
|
||||
|
||||
By default, this version includes options for OpenSSL 3.0.8
|
||||
|
||||
If you need to generate the options for a different version of OpenSSL:
|
||||
|
||||
$ cd src
|
||||
$ lua options.lua -g /usr/include/openssl/ssl.h > options.c
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
* On Linux, BSD, and Mac OS X:
|
||||
|
||||
- Edit 'Makefile'
|
||||
* Inform the path to where install the Lua modules (LUAPATH) and binaries
|
||||
modules (LUACPATH)
|
||||
* If Lua or OpenSSL are not in the default path, set the
|
||||
variables INCDIR and LIBDIR.
|
||||
* For Mac OS X, set the variable MACOSX_VERSION.
|
||||
|
||||
- Use 'make <platform>' to compile
|
||||
* Platforms: linux, bsd, or macosx
|
||||
|
||||
- Use 'make install' to install the modules.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
* On Windows:
|
||||
|
||||
- Use the Visual C++ project to compile the library.
|
||||
|
||||
- Copy the 'ssl.lua' file to some place in your LUA_PATH.
|
||||
|
||||
- Copy the 'ssl.dll' file to some place in your LUA_CPATH.
|
||||
|
||||
- Create a directory 'ssl' in your LUA_PATH and copy 'https.lua' to it.
|
||||
21
thirdparty/luasec/LICENSE
vendored
Normal file
21
thirdparty/luasec/LICENSE
vendored
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
LuaSec 1.3.2 license
|
||||
Copyright (C) 2006-2023 Bruno Silvestre, UFG
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of this software and associated documentation files (the
|
||||
"Software"), to deal in the Software without restriction, including
|
||||
without limitation the rights to use, copy, modify, merge, publish,
|
||||
distribute, sublicense, and/or sell copies of the Software, and to
|
||||
permit persons to whom the Software is furnished to do so, subject to
|
||||
the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be
|
||||
included in all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
||||
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
||||
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
||||
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
56
thirdparty/luasec/Makefile
vendored
Normal file
56
thirdparty/luasec/Makefile
vendored
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
# Inform the location to install the modules
|
||||
LUAPATH ?= /usr/share/lua/5.1
|
||||
LUACPATH ?= /usr/lib/lua/5.1
|
||||
|
||||
# Compile with build-in LuaSocket's help files.
|
||||
# Comment this lines if you will link with non-internal LuaSocket's help files
|
||||
# and edit INCDIR and LIBDIR properly.
|
||||
EXTRA = luasocket
|
||||
DEFS = -DWITH_LUASOCKET
|
||||
|
||||
# Edit the lines below to inform new path, if necessary.
|
||||
# Path below points to internal LuaSocket's help files.
|
||||
INC_PATH ?= -I/usr/include
|
||||
LIB_PATH ?= -L/usr/lib
|
||||
INCDIR = -I. $(INC_PATH)
|
||||
LIBDIR = -L./luasocket $(LIB_PATH)
|
||||
|
||||
# For Mac OS X: set the system version
|
||||
MACOSX_VERSION=10.11
|
||||
|
||||
#----------------------
|
||||
# Do not edit this part
|
||||
|
||||
.PHONY: all clean install none linux bsd macosx
|
||||
|
||||
all: none
|
||||
|
||||
none:
|
||||
@echo "Usage: $(MAKE) <platform>"
|
||||
@echo " * linux"
|
||||
@echo " * bsd"
|
||||
@echo " * macosx"
|
||||
|
||||
install:
|
||||
@cd src && $(MAKE) LUACPATH="$(LUACPATH)" LUAPATH="$(LUAPATH)" install
|
||||
|
||||
linux:
|
||||
@echo "---------------------"
|
||||
@echo "** Build for Linux **"
|
||||
@echo "---------------------"
|
||||
@cd src && $(MAKE) INCDIR="$(INCDIR)" LIBDIR="$(LIBDIR)" DEFS="$(DEFS)" EXTRA="$(EXTRA)" $@
|
||||
|
||||
bsd:
|
||||
@echo "-------------------"
|
||||
@echo "** Build for BSD **"
|
||||
@echo "-------------------"
|
||||
@cd src && $(MAKE) INCDIR="$(INCDIR)" LIBDIR="$(LIBDIR)" DEFS="$(DEFS)" EXTRA="$(EXTRA)" $@
|
||||
|
||||
macosx:
|
||||
@echo "------------------------------"
|
||||
@echo "** Build for Mac OS X $(MACOSX_VERSION) **"
|
||||
@echo "------------------------------"
|
||||
@cd src && $(MAKE) INCDIR="$(INCDIR)" LIBDIR="$(LIBDIR)" MACVER="$(MACOSX_VERSION)" DEFS="$(DEFS)" EXTRA="$(EXTRA)" $@
|
||||
|
||||
clean:
|
||||
@cd src && $(MAKE) clean
|
||||
6
thirdparty/luasec/README.md
vendored
Normal file
6
thirdparty/luasec/README.md
vendored
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
LuaSec 1.3.2
|
||||
===============
|
||||
LuaSec depends on OpenSSL, and integrates with LuaSocket to make it
|
||||
easy to add secure connections to any Lua applications or scripts.
|
||||
|
||||
Documentation: https://github.com/brunoos/luasec/wiki
|
||||
105
thirdparty/luasec/luasec-1.3.2-1.rockspec
vendored
Normal file
105
thirdparty/luasec/luasec-1.3.2-1.rockspec
vendored
Normal file
|
|
@ -0,0 +1,105 @@
|
|||
package = "LuaSec"
|
||||
version = "1.3.2-1"
|
||||
source = {
|
||||
url = "git+https://github.com/brunoos/luasec",
|
||||
tag = "v1.3.2",
|
||||
}
|
||||
description = {
|
||||
summary = "A binding for OpenSSL library to provide TLS/SSL communication over LuaSocket.",
|
||||
detailed = "This version delegates to LuaSocket the TCP connection establishment between the client and server. Then LuaSec uses this connection to start a secure TLS/SSL session.",
|
||||
homepage = "https://github.com/brunoos/luasec/wiki",
|
||||
license = "MIT"
|
||||
}
|
||||
dependencies = {
|
||||
"lua >= 5.1", "luasocket"
|
||||
}
|
||||
external_dependencies = {
|
||||
platforms = {
|
||||
unix = {
|
||||
OPENSSL = {
|
||||
header = "openssl/ssl.h",
|
||||
library = "ssl"
|
||||
}
|
||||
},
|
||||
windows = {
|
||||
OPENSSL = {
|
||||
header = "openssl/ssl.h",
|
||||
}
|
||||
},
|
||||
}
|
||||
}
|
||||
build = {
|
||||
type = "builtin",
|
||||
copy_directories = {
|
||||
"samples"
|
||||
},
|
||||
platforms = {
|
||||
unix = {
|
||||
install = {
|
||||
lib = {
|
||||
"ssl.so"
|
||||
},
|
||||
lua = {
|
||||
"src/ssl.lua", ['ssl.https'] = "src/https.lua"
|
||||
}
|
||||
},
|
||||
modules = {
|
||||
ssl = {
|
||||
defines = {
|
||||
"WITH_LUASOCKET", "LUASOCKET_DEBUG",
|
||||
},
|
||||
incdirs = {
|
||||
"$(OPENSSL_INCDIR)", "src/", "src/luasocket",
|
||||
},
|
||||
libdirs = {
|
||||
"$(OPENSSL_LIBDIR)"
|
||||
},
|
||||
libraries = {
|
||||
"ssl", "crypto"
|
||||
},
|
||||
sources = {
|
||||
"src/options.c", "src/config.c", "src/ec.c",
|
||||
"src/x509.c", "src/context.c", "src/ssl.c",
|
||||
"src/luasocket/buffer.c", "src/luasocket/io.c",
|
||||
"src/luasocket/timeout.c", "src/luasocket/usocket.c"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
windows = {
|
||||
install = {
|
||||
lib = {
|
||||
"ssl.dll"
|
||||
},
|
||||
lua = {
|
||||
"src/ssl.lua", ['ssl.https'] = "src/https.lua"
|
||||
}
|
||||
},
|
||||
modules = {
|
||||
ssl = {
|
||||
defines = {
|
||||
"WIN32", "NDEBUG", "_WINDOWS", "_USRDLL", "LSEC_EXPORTS", "BUFFER_DEBUG", "LSEC_API=__declspec(dllexport)",
|
||||
"WITH_LUASOCKET", "LUASOCKET_DEBUG",
|
||||
"LUASEC_INET_NTOP", "WINVER=0x0501", "_WIN32_WINNT=0x0501", "NTDDI_VERSION=0x05010300"
|
||||
},
|
||||
libdirs = {
|
||||
"$(OPENSSL_LIBDIR)",
|
||||
"$(OPENSSL_BINDIR)",
|
||||
},
|
||||
libraries = {
|
||||
"libssl", "libcrypto", "ws2_32"
|
||||
},
|
||||
incdirs = {
|
||||
"$(OPENSSL_INCDIR)", "src/", "src/luasocket"
|
||||
},
|
||||
sources = {
|
||||
"src/options.c", "src/config.c", "src/ec.c",
|
||||
"src/x509.c", "src/context.c", "src/ssl.c",
|
||||
"src/luasocket/buffer.c", "src/luasocket/io.c",
|
||||
"src/luasocket/timeout.c", "src/luasocket/wsocket.c"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
19
thirdparty/luasec/luasec.sln
vendored
Normal file
19
thirdparty/luasec/luasec.sln
vendored
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
Microsoft Visual Studio Solution File, Format Version 11.00
|
||||
# Visual C++ Express 2010
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "luasec", "luasec.vcxproj", "{A629932F-8819-4C0B-8835-CBF1FEED6376}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Win32 = Debug|Win32
|
||||
Release|Win32 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{A629932F-8819-4C0B-8835-CBF1FEED6376}.Debug|Win32.ActiveCfg = Debug|Win32
|
||||
{A629932F-8819-4C0B-8835-CBF1FEED6376}.Debug|Win32.Build.0 = Debug|Win32
|
||||
{A629932F-8819-4C0B-8835-CBF1FEED6376}.Release|Win32.ActiveCfg = Release|Win32
|
||||
{A629932F-8819-4C0B-8835-CBF1FEED6376}.Release|Win32.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
131
thirdparty/luasec/luasec.vcxproj
vendored
Normal file
131
thirdparty/luasec/luasec.vcxproj
vendored
Normal file
|
|
@ -0,0 +1,131 @@
|
|||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{A629932F-8819-4C0B-8835-CBF1FEED6376}</ProjectGuid>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
<PlatformToolset>v140</PlatformToolset>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
<PlatformToolset>v140</PlatformToolset>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
<Import Project="$(VCTargetsPath)Microsoft.CPP.UpgradeFromVC71.props" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
<Import Project="$(VCTargetsPath)Microsoft.CPP.UpgradeFromVC71.props" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup>
|
||||
<_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
|
||||
<OutDir Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Debug\</OutDir>
|
||||
<IntDir Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Debug\</IntDir>
|
||||
<LinkIncremental Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">true</LinkIncremental>
|
||||
<OutDir Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Release\</OutDir>
|
||||
<IntDir Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Release\</IntDir>
|
||||
<LinkIncremental Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">false</LinkIncremental>
|
||||
<TargetName Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">ssl</TargetName>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<AdditionalIncludeDirectories>C:\devel\openssl\include;C:\devel\lua-dll9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;LUASEC_EXPORTS;LUASEC_INET_NTOP;WINVER=0x0501;_WIN32_WINNT=0x0501;NTDDI_VERSION=0x05010300;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<MinimalRebuild>true</MinimalRebuild>
|
||||
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
||||
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
|
||||
<PrecompiledHeader>
|
||||
</PrecompiledHeader>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<DebugInformationFormat>EditAndContinue</DebugInformationFormat>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<AdditionalDependencies>ws2_32.lib;libssl.lib;libcrypto.lib;lua5.1.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<OutputFile>$(OutDir)ssl.dll</OutputFile>
|
||||
<AdditionalLibraryDirectories>C:\devel\openssl\lib\VC;C:\devel\lua-dll9;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<ProgramDatabaseFile>$(OutDir)luasec.pdb</ProgramDatabaseFile>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<RandomizedBaseAddress>false</RandomizedBaseAddress>
|
||||
<DataExecutionPrevention>
|
||||
</DataExecutionPrevention>
|
||||
<ImportLibrary>$(OutDir)ssl.lib</ImportLibrary>
|
||||
<TargetMachine>MachineX86</TargetMachine>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<AdditionalIncludeDirectories>C:\devel\openssl-1.1.0\include;C:\devel\lua-5.1\include;.\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||
<PreprocessorDefinitions>WIN32;_WIN32;NDEBUG;_WINDOWS;_USRDLL;LUASOCKET_DEBUG;WITH_LUASOCKET;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
<PrecompiledHeader>
|
||||
</PrecompiledHeader>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<AdditionalDependencies>ws2_32.lib;libssl.lib;libcrypto.lib;lua5.1.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>C:\devel\openssl-1.1.0\lib\VC;C:\devel\lua-5.1\lib;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<RandomizedBaseAddress>false</RandomizedBaseAddress>
|
||||
<DataExecutionPrevention>
|
||||
</DataExecutionPrevention>
|
||||
<ImportLibrary>$(OutDir)ssl.lib</ImportLibrary>
|
||||
<TargetMachine>MachineX86</TargetMachine>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="src\config.c" />
|
||||
<ClCompile Include="src\context.c" />
|
||||
<ClCompile Include="src\ec.c" />
|
||||
<ClCompile Include="src\luasocket\buffer.c" />
|
||||
<ClCompile Include="src\luasocket\io.c" />
|
||||
<ClCompile Include="src\luasocket\timeout.c" />
|
||||
<ClCompile Include="src\luasocket\wsocket.c" />
|
||||
<ClCompile Include="src\options.c" />
|
||||
<ClCompile Include="src\ssl.c" />
|
||||
<ClCompile Include="src\x509.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="src\compat.h" />
|
||||
<ClInclude Include="src\config.h" />
|
||||
<ClInclude Include="src\context.h" />
|
||||
<ClInclude Include="src\ec.h" />
|
||||
<ClInclude Include="src\luasocket\buffer.h" />
|
||||
<ClInclude Include="src\luasocket\io.h" />
|
||||
<ClInclude Include="src\luasocket\socket.h" />
|
||||
<ClInclude Include="src\luasocket\timeout.h" />
|
||||
<ClInclude Include="src\luasocket\wsocket.h" />
|
||||
<ClInclude Include="src\options.h" />
|
||||
<ClInclude Include="src\ssl.h" />
|
||||
<ClInclude Include="src\x509.h" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
67
thirdparty/luasec/samples/README
vendored
Normal file
67
thirdparty/luasec/samples/README
vendored
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
Directories:
|
||||
------------
|
||||
* alpn
|
||||
Test ALPN (Application-Layer Protocol Negotiation) support.
|
||||
|
||||
* certs
|
||||
Contains scripts to generate the certificates used by the examples.
|
||||
Generate Root CA 'A' and 'B' first, then the servers and clients.
|
||||
|
||||
* chain
|
||||
Example of certificate chain in handshake.
|
||||
|
||||
* curve-negotiation
|
||||
Elliptic curve negotiation.
|
||||
|
||||
* dhparam
|
||||
DH parameters for handshake.
|
||||
|
||||
* digest
|
||||
Certificate digest.
|
||||
|
||||
* ecdh
|
||||
Elliptic curve cipher.
|
||||
|
||||
* info
|
||||
Information about the connection.
|
||||
|
||||
* key
|
||||
Test encrypted private key.
|
||||
|
||||
* loop
|
||||
Test successive connections between the server and the client
|
||||
(to check memory leak).
|
||||
|
||||
* loop-gc
|
||||
Same of above, but the connection is not explicit closed, the gabage
|
||||
collector is encharge of that.
|
||||
|
||||
* luaossl
|
||||
Integration with luaossl.
|
||||
|
||||
* multicert
|
||||
Support to multiple certificate for dual RSA/ECDSA.
|
||||
|
||||
* oneshot
|
||||
A simple connection example.
|
||||
|
||||
* psk
|
||||
PSK(Pre Shared Key) support.
|
||||
|
||||
* sni
|
||||
Support to SNI (Server Name Indication).
|
||||
|
||||
* verification
|
||||
Retrieve the certificate verification errors from the handshake.
|
||||
|
||||
* verify
|
||||
Ignore handshake errors and proceed.
|
||||
|
||||
* want
|
||||
Test want() method.
|
||||
|
||||
* wantread
|
||||
Test timeout in handshake() and receive().
|
||||
|
||||
* wantwrite
|
||||
Test timeout in send().
|
||||
27
thirdparty/luasec/samples/alpn/client.lua
vendored
Normal file
27
thirdparty/luasec/samples/alpn/client.lua
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
--alpn = {"foo","bar","baz"}
|
||||
alpn = "foo"
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
|
||||
print("ALPN", peer:getalpn())
|
||||
|
||||
peer:close()
|
||||
77
thirdparty/luasec/samples/alpn/server.lua
vendored
Normal file
77
thirdparty/luasec/samples/alpn/server.lua
vendored
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
--
|
||||
-- Callback that selects one protocol from client's list.
|
||||
--
|
||||
local function alpncb01(protocols)
|
||||
print("--- ALPN protocols from client")
|
||||
for k, v in ipairs(protocols) do
|
||||
print(k, v)
|
||||
end
|
||||
print("--- Selecting:", protocols[1])
|
||||
return protocols[1]
|
||||
end
|
||||
|
||||
--
|
||||
-- Callback that returns a fixed list, ignoring the client's list.
|
||||
--
|
||||
local function alpncb02(protocols)
|
||||
print("--- ALPN protocols from client")
|
||||
for k, v in ipairs(protocols) do
|
||||
print(k, v)
|
||||
end
|
||||
print("--- Returning a fixed list")
|
||||
return {"bar", "foo"}
|
||||
end
|
||||
|
||||
--
|
||||
-- Callback that generates a list as it whishes.
|
||||
--
|
||||
local function alpncb03(protocols)
|
||||
local resp = {}
|
||||
print("--- ALPN protocols from client")
|
||||
for k, v in ipairs(protocols) do
|
||||
print(k, v)
|
||||
if k%2 ~= 0 then resp[#resp+1] = v end
|
||||
end
|
||||
print("--- Returning an odd list")
|
||||
return resp
|
||||
end
|
||||
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
--alpn = alpncb01,
|
||||
--alpn = alpncb02,
|
||||
--alpn = alpncb03,
|
||||
alpn = {"bar", "baz", "foo"},
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
|
||||
print("ALPN", peer:getalpn())
|
||||
|
||||
peer:close()
|
||||
server:close()
|
||||
14
thirdparty/luasec/samples/certs/all.bat
vendored
Normal file
14
thirdparty/luasec/samples/certs/all.bat
vendored
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
REM make sure the 'openssl.exe' commandline tool is in your path before starting!
|
||||
REM set the path below;
|
||||
set opensslpath=c:\program files (x86)\openssl-win32\bin
|
||||
|
||||
|
||||
|
||||
setlocal
|
||||
set path=%opensslpath%;%path%
|
||||
call roota.bat
|
||||
call rootb.bat
|
||||
call servera.bat
|
||||
call serverb.bat
|
||||
call clienta.bat
|
||||
call clientb.bat
|
||||
7
thirdparty/luasec/samples/certs/all.sh
vendored
Executable file
7
thirdparty/luasec/samples/certs/all.sh
vendored
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
#!/bin/sh
|
||||
./rootA.sh
|
||||
./rootB.sh
|
||||
./clientA.sh
|
||||
./clientB.sh
|
||||
./serverA.sh
|
||||
./serverB.sh
|
||||
9
thirdparty/luasec/samples/certs/clientA.bat
vendored
Normal file
9
thirdparty/luasec/samples/certs/clientA.bat
vendored
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
rem #!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:1024 -sha1 -keyout clientAkey.pem -out clientAreq.pem -nodes -config ./clientA.cnf -days 365 -batch
|
||||
|
||||
openssl x509 -req -in clientAreq.pem -sha1 -extfile ./clientA.cnf -extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial -out clientAcert.pem -days 365
|
||||
|
||||
copy clientAcert.pem + rootA.pem clientA.pem
|
||||
|
||||
openssl x509 -subject -issuer -noout -in clientA.pem
|
||||
316
thirdparty/luasec/samples/certs/clientA.cnf
vendored
Normal file
316
thirdparty/luasec/samples/certs/clientA.cnf
vendored
Normal file
|
|
@ -0,0 +1,316 @@
|
|||
#
|
||||
# OpenSSL example configuration file.
|
||||
# This is mostly being used for generation of certificate requests.
|
||||
#
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
#oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
|
||||
# We can add new OIDs in here for use by 'ca' and 'req'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several ctificates with same subject.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
|
||||
certificate = $dir/cacert.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crlnumber = $dir/crlnumber # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/cakey.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = sha1 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString.
|
||||
# utf8only: only UTF8Strings.
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
|
||||
# so use this option with caution!
|
||||
string_mask = nombstr
|
||||
|
||||
# req_extensions = v3_req # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = BR
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Some-State
|
||||
stateOrProvinceName_default = Espirito Santo
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = Santo Antonio do Canaa
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Sao Tonico Ltda
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
organizationalUnitName_default = Department of Computer Science
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_default = Client A
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
# This is what PKIX recommends but some broken software chokes on critical
|
||||
# extensions.
|
||||
#basicConstraints = critical,CA:true
|
||||
# So we do this instead.
|
||||
basicConstraints = CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer:always
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
12
thirdparty/luasec/samples/certs/clientA.sh
vendored
Executable file
12
thirdparty/luasec/samples/certs/clientA.sh
vendored
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
#!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:2048 -sha256 -keyout clientAkey.pem -out clientAreq.pem \
|
||||
-nodes -config ./clientA.cnf -days 365 -batch
|
||||
|
||||
openssl x509 -req -in clientAreq.pem -sha256 -extfile ./clientA.cnf \
|
||||
-extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial \
|
||||
-out clientAcert.pem -days 365
|
||||
|
||||
cat clientAcert.pem rootA.pem > clientA.pem
|
||||
|
||||
openssl x509 -subject -issuer -noout -in clientA.pem
|
||||
9
thirdparty/luasec/samples/certs/clientB.bat
vendored
Normal file
9
thirdparty/luasec/samples/certs/clientB.bat
vendored
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
rem #!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:1024 -sha1 -keyout clientBkey.pem -out clientBreq.pem -nodes -config ./clientB.cnf -days 365 -batch
|
||||
|
||||
openssl x509 -req -in clientBreq.pem -sha1 -extfile ./clientB.cnf -extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial -out clientBcert.pem -days 365
|
||||
|
||||
copy clientBcert.pem + rootB.pem clientB.pem
|
||||
|
||||
openssl x509 -subject -issuer -noout -in clientB.pem
|
||||
316
thirdparty/luasec/samples/certs/clientB.cnf
vendored
Normal file
316
thirdparty/luasec/samples/certs/clientB.cnf
vendored
Normal file
|
|
@ -0,0 +1,316 @@
|
|||
#
|
||||
# OpenSSL example configuration file.
|
||||
# This is mostly being used for generation of certificate requests.
|
||||
#
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
#oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
|
||||
# We can add new OIDs in here for use by 'ca' and 'req'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several ctificates with same subject.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
|
||||
certificate = $dir/cacert.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crlnumber = $dir/crlnumber # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/cakey.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = sha1 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString.
|
||||
# utf8only: only UTF8Strings.
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
|
||||
# so use this option with caution!
|
||||
string_mask = nombstr
|
||||
|
||||
# req_extensions = v3_req # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = BR
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Some-State
|
||||
stateOrProvinceName_default = Espirito Santo
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = Santo Antonio do Canaa
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Sao Tonico Ltda
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
organizationalUnitName_default = Department of Computer Science
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_default = Client B
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
# This is what PKIX recommends but some broken software chokes on critical
|
||||
# extensions.
|
||||
#basicConstraints = critical,CA:true
|
||||
# So we do this instead.
|
||||
basicConstraints = CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer:always
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
12
thirdparty/luasec/samples/certs/clientB.sh
vendored
Executable file
12
thirdparty/luasec/samples/certs/clientB.sh
vendored
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
#!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:2048 -sha256 -keyout clientBkey.pem -out clientBreq.pem \
|
||||
-nodes -config ./clientB.cnf -days 365 -batch
|
||||
|
||||
openssl x509 -req -in clientBreq.pem -sha256 -extfile ./clientB.cnf \
|
||||
-extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial \
|
||||
-out clientBcert.pem -days 365
|
||||
|
||||
cat clientBcert.pem rootB.pem > clientB.pem
|
||||
|
||||
openssl x509 -subject -issuer -noout -in clientB.pem
|
||||
7
thirdparty/luasec/samples/certs/rootA.bat
vendored
Normal file
7
thirdparty/luasec/samples/certs/rootA.bat
vendored
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
REM #!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:1024 -sha1 -keyout rootAkey.pem -out rootAreq.pem -nodes -config ./rootA.cnf -days 365 -batch
|
||||
|
||||
openssl x509 -req -in rootAreq.pem -sha1 -extfile ./rootA.cnf -extensions v3_ca -signkey rootAkey.pem -out rootA.pem -days 365
|
||||
|
||||
openssl x509 -subject -issuer -noout -in rootA.pem
|
||||
315
thirdparty/luasec/samples/certs/rootA.cnf
vendored
Normal file
315
thirdparty/luasec/samples/certs/rootA.cnf
vendored
Normal file
|
|
@ -0,0 +1,315 @@
|
|||
#
|
||||
# OpenSSL example configuration file.
|
||||
# This is mostly being used for generation of certificate requests.
|
||||
#
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
#oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
|
||||
# We can add new OIDs in here for use by 'ca' and 'req'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several ctificates with same subject.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
|
||||
certificate = $dir/cacert.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crlnumber = $dir/crlnumber # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/cakey.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = sha1 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString.
|
||||
# utf8only: only UTF8Strings.
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
|
||||
# so use this option with caution!
|
||||
string_mask = nombstr
|
||||
|
||||
# req_extensions = v3_req # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = BR
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Espirito Santo
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = Santo Antonio do Canaa
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Santo Tonico Ltda
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
organizationalUnitName_default = Department of Computer Science
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_max = 64
|
||||
commonName_default = Root A
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
# This is what PKIX recommends but some broken software chokes on critical
|
||||
# extensions.
|
||||
#basicConstraints = critical,CA:true
|
||||
# So we do this instead.
|
||||
basicConstraints = CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer:always
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
7
thirdparty/luasec/samples/certs/rootA.sh
vendored
Executable file
7
thirdparty/luasec/samples/certs/rootA.sh
vendored
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
#!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:2048 -sha256 -keyout rootAkey.pem -out rootAreq.pem -nodes -config ./rootA.cnf -days 365 -batch
|
||||
|
||||
openssl x509 -req -in rootAreq.pem -sha256 -extfile ./rootA.cnf -extensions v3_ca -signkey rootAkey.pem -out rootA.pem -days 365
|
||||
|
||||
openssl x509 -subject -issuer -noout -in rootA.pem
|
||||
7
thirdparty/luasec/samples/certs/rootB.bat
vendored
Normal file
7
thirdparty/luasec/samples/certs/rootB.bat
vendored
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
rem #!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:1024 -sha1 -keyout rootBkey.pem -out rootBreq.pem -nodes -config ./rootB.cnf -days 365 -batch
|
||||
|
||||
openssl x509 -req -in rootBreq.pem -sha1 -extfile ./rootB.cnf -extensions v3_ca -signkey rootBkey.pem -out rootB.pem -days 365
|
||||
|
||||
openssl x509 -subject -issuer -noout -in rootB.pem
|
||||
315
thirdparty/luasec/samples/certs/rootB.cnf
vendored
Normal file
315
thirdparty/luasec/samples/certs/rootB.cnf
vendored
Normal file
|
|
@ -0,0 +1,315 @@
|
|||
#
|
||||
# OpenSSL example configuration file.
|
||||
# This is mostly being used for generation of certificate requests.
|
||||
#
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
#oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
|
||||
# We can add new OIDs in here for use by 'ca' and 'req'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several ctificates with same subject.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
|
||||
certificate = $dir/cacert.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crlnumber = $dir/crlnumber # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/cakey.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = sha1 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString.
|
||||
# utf8only: only UTF8Strings.
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
|
||||
# so use this option with caution!
|
||||
string_mask = nombstr
|
||||
|
||||
# req_extensions = v3_req # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = BR
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Espirito Santo
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = Santo Antonio do Canaa
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Sao Tonico Ltda
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
organizationalUnitName_default = Department of Computer Science
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_default = Root B
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
# This is what PKIX recommends but some broken software chokes on critical
|
||||
# extensions.
|
||||
#basicConstraints = critical,CA:true
|
||||
# So we do this instead.
|
||||
basicConstraints = CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer:always
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
7
thirdparty/luasec/samples/certs/rootB.sh
vendored
Executable file
7
thirdparty/luasec/samples/certs/rootB.sh
vendored
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
#!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:2048 -sha256 -keyout rootBkey.pem -out rootBreq.pem -nodes -config ./rootB.cnf -days 365 -batch
|
||||
|
||||
openssl x509 -req -in rootBreq.pem -sha256 -extfile ./rootB.cnf -extensions v3_ca -signkey rootBkey.pem -out rootB.pem -days 365
|
||||
|
||||
openssl x509 -subject -issuer -noout -in rootB.pem
|
||||
9
thirdparty/luasec/samples/certs/serverA.bat
vendored
Normal file
9
thirdparty/luasec/samples/certs/serverA.bat
vendored
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
rem #!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout serverAkey.pem -out serverAreq.pem -config ./serverA.cnf -nodes -days 365 -batch
|
||||
|
||||
openssl x509 -req -in serverAreq.pem -sha1 -extfile ./serverA.cnf -extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial -out serverAcert.pem -days 365
|
||||
|
||||
copy serverAcert.pem + rootA.pem serverA.pem
|
||||
|
||||
openssl x509 -subject -issuer -noout -in serverA.pem
|
||||
316
thirdparty/luasec/samples/certs/serverA.cnf
vendored
Normal file
316
thirdparty/luasec/samples/certs/serverA.cnf
vendored
Normal file
|
|
@ -0,0 +1,316 @@
|
|||
#
|
||||
# OpenSSL example configuration file.
|
||||
# This is mostly being used for generation of certificate requests.
|
||||
#
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
#oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
|
||||
# We can add new OIDs in here for use by 'ca' and 'req'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several ctificates with same subject.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
|
||||
certificate = $dir/cacert.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crlnumber = $dir/crlnumber # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/cakey.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = sha1 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString.
|
||||
# utf8only: only UTF8Strings.
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
|
||||
# so use this option with caution!
|
||||
string_mask = nombstr
|
||||
|
||||
# req_extensions = v3_ext # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = BR
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Some-State
|
||||
stateOrProvinceName_default = Espirito Santo
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = Santo Antonio do Canaa
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Sao Tonico Ltda
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
organizationalUnitName_default = Department of Computer Science
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_default = Server A
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
subjectAltName=DNS:foo.bar.example
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
# This is what PKIX recommends but some broken software chokes on critical
|
||||
# extensions.
|
||||
#basicConstraints = critical,CA:true
|
||||
# So we do this instead.
|
||||
basicConstraints = CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer:always
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
12
thirdparty/luasec/samples/certs/serverA.sh
vendored
Executable file
12
thirdparty/luasec/samples/certs/serverA.sh
vendored
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
#!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:2048 -sha256 -keyout serverAkey.pem -out serverAreq.pem \
|
||||
-config ./serverA.cnf -nodes -days 365 -batch
|
||||
|
||||
openssl x509 -req -in serverAreq.pem -sha256 -extfile ./serverA.cnf \
|
||||
-extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial \
|
||||
-out serverAcert.pem -days 365
|
||||
|
||||
cat serverAcert.pem rootA.pem > serverA.pem
|
||||
|
||||
openssl x509 -subject -issuer -noout -in serverA.pem
|
||||
9
thirdparty/luasec/samples/certs/serverB.bat
vendored
Normal file
9
thirdparty/luasec/samples/certs/serverB.bat
vendored
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
rem #!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:1024 -keyout serverBkey.pem -out serverBreq.pem -config ./serverB.cnf -nodes -days 365 -batch
|
||||
|
||||
openssl x509 -req -in serverBreq.pem -sha1 -extfile ./serverB.cnf -extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial -out serverBcert.pem -days 365
|
||||
|
||||
copy serverBcert.pem + rootB.pem serverB.pem
|
||||
|
||||
openssl x509 -subject -issuer -noout -in serverB.pem
|
||||
316
thirdparty/luasec/samples/certs/serverB.cnf
vendored
Normal file
316
thirdparty/luasec/samples/certs/serverB.cnf
vendored
Normal file
|
|
@ -0,0 +1,316 @@
|
|||
#
|
||||
# OpenSSL example configuration file.
|
||||
# This is mostly being used for generation of certificate requests.
|
||||
#
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
RANDFILE = $ENV::HOME/.rnd
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
#oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
|
||||
# We can add new OIDs in here for use by 'ca' and 'req'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several ctificates with same subject.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
|
||||
certificate = $dir/cacert.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crlnumber = $dir/crlnumber # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/cakey.pem # The private key
|
||||
RANDFILE = $dir/private/.rand # private random number file
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = sha1 # which md to use.
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString.
|
||||
# utf8only: only UTF8Strings.
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
|
||||
# so use this option with caution!
|
||||
string_mask = nombstr
|
||||
|
||||
# req_extensions = v3_req # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = BR
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Some-State
|
||||
stateOrProvinceName_default = Espirito Santo
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = Santo Antonio do Canaa
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Sao Tonico Ltda
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
organizationalUnitName_default = Department of Computer Science
|
||||
|
||||
commonName = Common Name (eg, YOUR name)
|
||||
commonName_default = Server B
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
subjectAltName=DNS:fnord.bar.example
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
# This is what PKIX recommends but some broken software chokes on critical
|
||||
# extensions.
|
||||
#basicConstraints = critical,CA:true
|
||||
# So we do this instead.
|
||||
basicConstraints = CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Some might want this also
|
||||
# nsCertType = sslCA, emailCA
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# Here are some examples of the usage of nsCertType. If it is omitted
|
||||
# the certificate can be used for anything *except* object signing.
|
||||
|
||||
# This is OK for an SSL server.
|
||||
# nsCertType = server
|
||||
|
||||
# For an object signing certificate this would be used.
|
||||
# nsCertType = objsign
|
||||
|
||||
# For normal client use this is typical
|
||||
# nsCertType = client, email
|
||||
|
||||
# and for everything including object signing:
|
||||
# nsCertType = client, email, objsign
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# This will be displayed in Netscape's comment listbox.
|
||||
nsComment = "OpenSSL Generated Certificate"
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer:always
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
|
||||
#nsBaseUrl
|
||||
#nsRevocationUrl
|
||||
#nsRenewalUrl
|
||||
#nsCaPolicyUrl
|
||||
#nsSslServerName
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
12
thirdparty/luasec/samples/certs/serverB.sh
vendored
Executable file
12
thirdparty/luasec/samples/certs/serverB.sh
vendored
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
#!/bin/sh
|
||||
|
||||
openssl req -newkey rsa:2048 -sha256 -keyout serverBkey.pem -out serverBreq.pem \
|
||||
-config ./serverB.cnf -nodes -days 365 -batch
|
||||
|
||||
openssl x509 -req -in serverBreq.pem -sha256 -extfile ./serverB.cnf \
|
||||
-extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial \
|
||||
-out serverBcert.pem -days 365
|
||||
|
||||
cat serverBcert.pem rootB.pem > serverB.pem
|
||||
|
||||
openssl x509 -subject -issuer -noout -in serverB.pem
|
||||
36
thirdparty/luasec/samples/chain/client.lua
vendored
Normal file
36
thirdparty/luasec/samples/chain/client.lua
vendored
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
local util = require("util")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local conn = socket.tcp()
|
||||
conn:connect("127.0.0.1", 8888)
|
||||
|
||||
conn = assert( ssl.wrap(conn, params) )
|
||||
assert(conn:dohandshake())
|
||||
|
||||
util.show( conn:getpeercertificate() )
|
||||
|
||||
print("----------------------------------------------------------------------")
|
||||
|
||||
for k, cert in ipairs( conn:getpeerchain() ) do
|
||||
util.show(cert)
|
||||
end
|
||||
|
||||
local cert = conn:getpeercertificate()
|
||||
print( cert )
|
||||
print( cert:pem() )
|
||||
|
||||
conn:close()
|
||||
72
thirdparty/luasec/samples/chain/server.lua
vendored
Normal file
72
thirdparty/luasec/samples/chain/server.lua
vendored
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
local util = require("util")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local conn = server:accept()
|
||||
|
||||
conn = assert( ssl.wrap(conn, ctx) )
|
||||
assert( conn:dohandshake() )
|
||||
|
||||
util.show( conn:getpeercertificate() )
|
||||
|
||||
print("----------------------------------------------------------------------")
|
||||
|
||||
local expectedpeerchain = { "../certs/clientAcert.pem", "../certs/rootA.pem" }
|
||||
|
||||
local peerchain = conn:getpeerchain()
|
||||
assert(#peerchain == #expectedpeerchain)
|
||||
for k, cert in ipairs( peerchain ) do
|
||||
util.show(cert)
|
||||
local expectedpem = assert(io.open(expectedpeerchain[k])):read("*a")
|
||||
assert(cert:pem() == expectedpem, "peer chain mismatch @ "..tostring(k))
|
||||
end
|
||||
|
||||
local expectedlocalchain = { "../certs/serverAcert.pem" }
|
||||
|
||||
local localchain = assert(conn:getlocalchain())
|
||||
assert(#localchain == #expectedlocalchain)
|
||||
for k, cert in ipairs( localchain ) do
|
||||
util.show(cert)
|
||||
local expectedpem = assert(io.open(expectedlocalchain[k])):read("*a")
|
||||
assert(cert:pem() == expectedpem, "local chain mismatch @ "..tostring(k))
|
||||
if k == 1 then
|
||||
assert(cert:pem() == conn:getlocalcertificate():pem())
|
||||
end
|
||||
end
|
||||
|
||||
local f = io.open(params.certificate)
|
||||
local str = f:read("*a")
|
||||
f:close()
|
||||
|
||||
util.show( ssl.loadcertificate(str) )
|
||||
|
||||
print("----------------------------------------------------------------------")
|
||||
local cert = conn:getpeercertificate()
|
||||
print( cert )
|
||||
print( cert:digest() )
|
||||
print( cert:digest("sha1") )
|
||||
print( cert:digest("sha256") )
|
||||
print( cert:digest("sha512") )
|
||||
|
||||
conn:close()
|
||||
server:close()
|
||||
22
thirdparty/luasec/samples/chain/util.lua
vendored
Normal file
22
thirdparty/luasec/samples/chain/util.lua
vendored
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
local print = print
|
||||
local ipairs = ipairs
|
||||
|
||||
local _ENV = {}
|
||||
|
||||
function _ENV.show(cert)
|
||||
print("Serial:", cert:serial())
|
||||
print("NotBefore:", cert:notbefore())
|
||||
print("NotAfter:", cert:notafter())
|
||||
print("--- Issuer ---")
|
||||
for k, v in ipairs(cert:issuer()) do
|
||||
print(v.name .. " = " .. v.value)
|
||||
end
|
||||
|
||||
print("--- Subject ---")
|
||||
for k, v in ipairs(cert:subject()) do
|
||||
print(v.name .. " = " .. v.value)
|
||||
end
|
||||
print("----------------------------------------------------------------------")
|
||||
end
|
||||
|
||||
return _ENV
|
||||
28
thirdparty/luasec/samples/curve-negotiation/client.lua
vendored
Normal file
28
thirdparty/luasec/samples/curve-negotiation/client.lua
vendored
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "any",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = {"all"},
|
||||
--
|
||||
curve = "P-256:P-384",
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
37
thirdparty/luasec/samples/curve-negotiation/server.lua
vendored
Normal file
37
thirdparty/luasec/samples/curve-negotiation/server.lua
vendored
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = {"all"},
|
||||
--
|
||||
curve = "P-384:P-256:P-521",
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
peer:send("oneshot with curve negotiation test\n")
|
||||
peer:close()
|
||||
40
thirdparty/luasec/samples/dane/client.lua
vendored
Normal file
40
thirdparty/luasec/samples/dane/client.lua
vendored
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
|
||||
local socket = require "socket";
|
||||
local ssl = require "ssl";
|
||||
|
||||
local dns = require "lunbound".new();
|
||||
|
||||
|
||||
local cfg = {
|
||||
protocol = "tlsv1_2",
|
||||
mode = "client",
|
||||
ciphers = "DEFAULT",
|
||||
capath = "/etc/ssl/certs",
|
||||
verify = "peer",
|
||||
dane = true,
|
||||
};
|
||||
|
||||
local function daneconnect(host, port)
|
||||
port = port or "443";
|
||||
local conn = ssl.wrap(socket.connect(host, port), cfg);
|
||||
|
||||
local tlsa = dns:resolve("_" .. port .. "._tcp." .. host, 52);
|
||||
assert(tlsa.secure, "Insecure DNS");
|
||||
|
||||
assert(conn:setdane(host));
|
||||
for i = 1, tlsa.n do
|
||||
local usage, selector, mtype = tlsa[i] :byte(1, 3);
|
||||
assert(conn:settlsa(usage, selector, mtype, tlsa[i] :sub(4, - 1)));
|
||||
end
|
||||
|
||||
assert(conn:dohandshake());
|
||||
return conn;
|
||||
end
|
||||
|
||||
if not ... then
|
||||
print("Usage: client.lua example.com [port]");
|
||||
return os.exit(1);
|
||||
end
|
||||
local conn = daneconnect(...);
|
||||
|
||||
print(conn:getpeerverification());
|
||||
27
thirdparty/luasec/samples/dhparam/client.lua
vendored
Normal file
27
thirdparty/luasec/samples/dhparam/client.lua
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "any",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
ciphers = "EDH+AESGCM"
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
4
thirdparty/luasec/samples/dhparam/params.sh
vendored
Executable file
4
thirdparty/luasec/samples/dhparam/params.sh
vendored
Executable file
|
|
@ -0,0 +1,4 @@
|
|||
#!/usr/bin/env sh
|
||||
|
||||
openssl dhparam -2 -out dh-512.pem -outform PEM 512
|
||||
openssl dhparam -2 -out dh-1024.pem -outform PEM 1024
|
||||
62
thirdparty/luasec/samples/dhparam/server.lua
vendored
Normal file
62
thirdparty/luasec/samples/dhparam/server.lua
vendored
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local function readfile(filename)
|
||||
local fd = assert(io.open(filename))
|
||||
local dh = fd:read("*a")
|
||||
fd:close()
|
||||
return dh
|
||||
end
|
||||
|
||||
local function dhparam_cb(export, keylength)
|
||||
print("---")
|
||||
print("DH Callback")
|
||||
print("Export", export)
|
||||
print("Key length", keylength)
|
||||
print("---")
|
||||
local filename
|
||||
if keylength == 512 then
|
||||
filename = "dh-512.pem"
|
||||
elseif keylength == 1024 then
|
||||
filename = "dh-1024.pem"
|
||||
else
|
||||
-- No key
|
||||
return nil
|
||||
end
|
||||
return readfile(filename)
|
||||
end
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
dhparam = dhparam_cb,
|
||||
ciphers = "EDH+AESGCM"
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
26
thirdparty/luasec/samples/digest/client.lua
vendored
Normal file
26
thirdparty/luasec/samples/digest/client.lua
vendored
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
44
thirdparty/luasec/samples/digest/server.lua
vendored
Normal file
44
thirdparty/luasec/samples/digest/server.lua
vendored
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
local cert = peer:getpeercertificate()
|
||||
local sha1 = cert:digest("sha1")
|
||||
local sha256 = cert:digest("sha256")
|
||||
local sha512 = cert:digest("sha512")
|
||||
|
||||
print("SHA1", sha1)
|
||||
print("SHA256", sha256)
|
||||
print("SHA512", sha512)
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
33
thirdparty/luasec/samples/ecdh/client.lua
vendored
Normal file
33
thirdparty/luasec/samples/ecdh/client.lua
vendored
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
--
|
||||
curve = "secp384r1",
|
||||
}
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
|
||||
print("--- INFO ---")
|
||||
local info = peer:info()
|
||||
for k, v in pairs(info) do
|
||||
print(k, v)
|
||||
end
|
||||
print("---")
|
||||
|
||||
peer:close()
|
||||
40
thirdparty/luasec/samples/ecdh/server.lua
vendored
Normal file
40
thirdparty/luasec/samples/ecdh/server.lua
vendored
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
--
|
||||
curve = "secp384r1",
|
||||
}
|
||||
|
||||
------------------------------------------------------------------------------
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
|
||||
print("--- INFO ---")
|
||||
local info = peer:info()
|
||||
for k, v in pairs(info) do
|
||||
print(k, v)
|
||||
end
|
||||
print("---")
|
||||
|
||||
peer:close()
|
||||
server:close()
|
||||
26
thirdparty/luasec/samples/info/client.lua
vendored
Normal file
26
thirdparty/luasec/samples/info/client.lua
vendored
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
48
thirdparty/luasec/samples/info/server.lua
vendored
Normal file
48
thirdparty/luasec/samples/info/server.lua
vendored
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
|
||||
-- Before handshake: nil
|
||||
print( peer:info() )
|
||||
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
print("---")
|
||||
local info = peer:info()
|
||||
for k, v in pairs(info) do
|
||||
print(k, v)
|
||||
end
|
||||
|
||||
print("---")
|
||||
print("-> Compression", peer:info("compression"))
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
3
thirdparty/luasec/samples/key/genkey.sh
vendored
Executable file
3
thirdparty/luasec/samples/key/genkey.sh
vendored
Executable file
|
|
@ -0,0 +1,3 @@
|
|||
#!/usr/bin/env sh
|
||||
|
||||
openssl genrsa -des3 -out key.pem -passout pass:foobar 2048
|
||||
29
thirdparty/luasec/samples/key/loadkey.lua
vendored
Normal file
29
thirdparty/luasec/samples/key/loadkey.lua
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local ssl = require("ssl")
|
||||
|
||||
local pass = "foobar"
|
||||
local cfg = {
|
||||
protocol = "tlsv1",
|
||||
mode = "client",
|
||||
key = "key.pem",
|
||||
}
|
||||
|
||||
-- Shell
|
||||
print(string.format("*** Hint: password is '%s' ***", pass))
|
||||
ctx, err = ssl.newcontext(cfg)
|
||||
assert(ctx, err)
|
||||
print("Shell: ok")
|
||||
|
||||
-- Text password
|
||||
cfg.password = pass
|
||||
ctx, err = ssl.newcontext(cfg)
|
||||
assert(ctx, err)
|
||||
print("Text: ok")
|
||||
|
||||
-- Callback
|
||||
cfg.password = function() return pass end
|
||||
ctx, err = ssl.newcontext(cfg)
|
||||
assert(ctx, err)
|
||||
print("Callback: ok")
|
||||
27
thirdparty/luasec/samples/loop-gc/client.lua
vendored
Normal file
27
thirdparty/luasec/samples/loop-gc/client.lua
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
while true do
|
||||
local peer = socket.tcp()
|
||||
assert( peer:connect("127.0.0.1", 8888) )
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
print(peer:receive("*l"))
|
||||
end
|
||||
35
thirdparty/luasec/samples/loop-gc/server.lua
vendored
Normal file
35
thirdparty/luasec/samples/loop-gc/server.lua
vendored
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert( ssl.newcontext(params) )
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
while true do
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
peer:send("loop test\n")
|
||||
end
|
||||
30
thirdparty/luasec/samples/loop/client.lua
vendored
Normal file
30
thirdparty/luasec/samples/loop/client.lua
vendored
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
while true do
|
||||
local peer = socket.tcp()
|
||||
assert( peer:connect("127.0.0.1", 8888) )
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
peer:getpeercertificate():extensions()
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
end
|
||||
36
thirdparty/luasec/samples/loop/server.lua
vendored
Normal file
36
thirdparty/luasec/samples/loop/server.lua
vendored
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert( ssl.newcontext(params) )
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
while true do
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
peer:send("loop test\n")
|
||||
peer:close()
|
||||
end
|
||||
40
thirdparty/luasec/samples/luaossl/client.lua
vendored
Normal file
40
thirdparty/luasec/samples/luaossl/client.lua
vendored
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local pkey = require "openssl.pkey"
|
||||
local ssl_context = require "openssl.ssl.context"
|
||||
local x509 = require "openssl.x509"
|
||||
local x509_store = require "openssl.x509.store"
|
||||
|
||||
local function read_file(path)
|
||||
local file, err, errno = io.open(path, "rb")
|
||||
if not file then
|
||||
return nil, err, errno
|
||||
end
|
||||
local contents
|
||||
contents, err, errno = file:read "*a"
|
||||
file:close()
|
||||
return contents, err, errno
|
||||
end
|
||||
|
||||
local ctx = ssl_context.new("TLSv1_2", false)
|
||||
ctx:setPrivateKey(pkey.new(assert(read_file("../certs/clientAkey.pem"))))
|
||||
ctx:setCertificate(x509.new(assert(read_file("../certs/clientA.pem"))))
|
||||
local store = x509_store.new()
|
||||
store:add("../certs/rootA.pem")
|
||||
ctx:setStore(store)
|
||||
ctx:setVerify(ssl_context.VERIFY_FAIL_IF_NO_PEER_CERT)
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
58
thirdparty/luasec/samples/luaossl/server.lua
vendored
Normal file
58
thirdparty/luasec/samples/luaossl/server.lua
vendored
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local pkey = require "openssl.pkey"
|
||||
local ssl_context = require "openssl.ssl.context"
|
||||
local x509 = require "openssl.x509"
|
||||
local x509_store = require "openssl.x509.store"
|
||||
|
||||
local function read_file(path)
|
||||
local file, err, errno = io.open(path, "rb")
|
||||
if not file then
|
||||
return nil, err, errno
|
||||
end
|
||||
local contents
|
||||
contents, err, errno = file:read "*a"
|
||||
file:close()
|
||||
return contents, err, errno
|
||||
end
|
||||
|
||||
local ctx = ssl_context.new("TLSv1_2", true)
|
||||
ctx:setPrivateKey(pkey.new(assert(read_file("../certs/serverAkey.pem"))))
|
||||
ctx:setCertificate(x509.new(assert(read_file("../certs/serverA.pem"))))
|
||||
local store = x509_store.new()
|
||||
store:add("../certs/rootA.pem")
|
||||
ctx:setStore(store)
|
||||
ctx:setVerify(ssl_context.VERIFY_FAIL_IF_NO_PEER_CERT)
|
||||
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
|
||||
-- Before handshake: nil
|
||||
print( peer:info() )
|
||||
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
print("---")
|
||||
local info = peer:info()
|
||||
for k, v in pairs(info) do
|
||||
print(k, v)
|
||||
end
|
||||
|
||||
print("---")
|
||||
print("-> Compression", peer:info("compression"))
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
29
thirdparty/luasec/samples/multicert/client-ecdsa.lua
vendored
Normal file
29
thirdparty/luasec/samples/multicert/client-ecdsa.lua
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "certs/clientECDSAkey.pem",
|
||||
certificate = "certs/clientECDSA.pem",
|
||||
verify = "none",
|
||||
options = "all",
|
||||
ciphers = "ALL:!aRSA"
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
local i = peer:info()
|
||||
for k, v in pairs(i) do print(k, v) end
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
29
thirdparty/luasec/samples/multicert/client-rsa.lua
vendored
Normal file
29
thirdparty/luasec/samples/multicert/client-rsa.lua
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "certs/clientRSAkey.pem",
|
||||
certificate = "certs/clientRSA.pem",
|
||||
verify = "none",
|
||||
options = "all",
|
||||
ciphers = "ALL:!ECDSA"
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
local i = peer:info()
|
||||
for k, v in pairs(i) do print(k, v) end
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
13
thirdparty/luasec/samples/multicert/gencerts.sh
vendored
Executable file
13
thirdparty/luasec/samples/multicert/gencerts.sh
vendored
Executable file
|
|
@ -0,0 +1,13 @@
|
|||
#!/usr/bin/env sh
|
||||
|
||||
mkdir -p certs
|
||||
|
||||
openssl ecparam -name secp256r1 -genkey -out certs/serverECDSAkey.pem
|
||||
openssl req -new -config ../certs/serverA.cnf -extensions usr_cert -x509 -key certs/serverECDSAkey.pem -out certs/serverECDSA.pem -days 360 -batch
|
||||
|
||||
openssl ecparam -name secp256r1 -genkey -out certs/clientECDSAkey.pem
|
||||
openssl req -config ../certs/clientA.cnf -extensions usr_cert -x509 -new -key certs/clientECDSAkey.pem -out certs/clientECDSA.pem -days 360 -batch
|
||||
|
||||
openssl req -config ../certs/serverB.cnf -extensions usr_cert -x509 -new -newkey rsa:2048 -keyout certs/serverRSAkey.pem -out certs/serverRSA.pem -nodes -days 365 -batch
|
||||
|
||||
openssl req -config ../certs/clientB.cnf -extensions usr_cert -x509 -new -newkey rsa:2048 -keyout certs/clientRSAkey.pem -out certs/clientRSA.pem -nodes -days 365 -batch
|
||||
38
thirdparty/luasec/samples/multicert/server.lua
vendored
Normal file
38
thirdparty/luasec/samples/multicert/server.lua
vendored
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
certificates = {
|
||||
-- Comment line below and 'client-rsa' stop working
|
||||
{ certificate = "certs/serverRSA.pem", key = "certs/serverRSAkey.pem" },
|
||||
-- Comment line below and 'client-ecdsa' stop working
|
||||
{ certificate = "certs/serverECDSA.pem", key = "certs/serverECDSAkey.pem" }
|
||||
},
|
||||
verify = "none",
|
||||
options = "all"
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
26
thirdparty/luasec/samples/oneshot/client.lua
vendored
Normal file
26
thirdparty/luasec/samples/oneshot/client.lua
vendored
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
35
thirdparty/luasec/samples/oneshot/server.lua
vendored
Normal file
35
thirdparty/luasec/samples/oneshot/server.lua
vendored
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
41
thirdparty/luasec/samples/psk/client.lua
vendored
Normal file
41
thirdparty/luasec/samples/psk/client.lua
vendored
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
if not ssl.config.capabilities.psk then
|
||||
print("[ERRO] PSK not available")
|
||||
os.exit(1)
|
||||
end
|
||||
|
||||
-- @param hint (nil | string)
|
||||
-- @param max_identity_len (number)
|
||||
-- @param max_psk_len (number)
|
||||
-- @return identity (string)
|
||||
-- @return PSK (string)
|
||||
local function pskcb(hint, max_identity_len, max_psk_len)
|
||||
print(string.format("PSK Callback: hint=%q, max_identity_len=%d, max_psk_len=%d", hint, max_identity_len, max_psk_len))
|
||||
return "abcd", "1234"
|
||||
end
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
psk = pskcb,
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
|
||||
print("--- INFO ---")
|
||||
local info = peer:info()
|
||||
for k, v in pairs(info) do
|
||||
print(k, v)
|
||||
end
|
||||
print("---")
|
||||
|
||||
peer:close()
|
||||
60
thirdparty/luasec/samples/psk/server.lua
vendored
Normal file
60
thirdparty/luasec/samples/psk/server.lua
vendored
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
if not ssl.config.capabilities.psk then
|
||||
print("[ERRO] PSK not available")
|
||||
os.exit(1)
|
||||
end
|
||||
|
||||
-- @param identity (string)
|
||||
-- @param max_psk_len (number)
|
||||
-- @return psk (string)
|
||||
local function pskcb(identity, max_psk_len)
|
||||
print(string.format("PSK Callback: identity=%q, max_psk_len=%d", identity, max_psk_len))
|
||||
if identity == "abcd" then
|
||||
return "1234"
|
||||
end
|
||||
return nil
|
||||
end
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
options = "all",
|
||||
|
||||
-- PSK with just a callback
|
||||
psk = pskcb,
|
||||
|
||||
-- PSK with identity hint
|
||||
-- psk = {
|
||||
-- hint = "hintpsksample",
|
||||
-- callback = pskcb,
|
||||
-- },
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
|
||||
print("--- INFO ---")
|
||||
local info = peer:info()
|
||||
for k, v in pairs(info) do
|
||||
print(k, v)
|
||||
end
|
||||
print("---")
|
||||
|
||||
peer:close()
|
||||
server:close()
|
||||
35
thirdparty/luasec/samples/sni/client.lua
vendored
Normal file
35
thirdparty/luasec/samples/sni/client.lua
vendored
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = "peer",
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local conn = socket.tcp()
|
||||
conn:connect("127.0.0.1", 8888)
|
||||
|
||||
-- TLS/SSL initialization
|
||||
conn = ssl.wrap(conn, params)
|
||||
|
||||
-- Comment the lines to not send a name
|
||||
--conn:sni("servera.br")
|
||||
--conn:sni("serveraa.br")
|
||||
conn:sni("serverb.br")
|
||||
|
||||
assert(conn:dohandshake())
|
||||
--
|
||||
local cert = conn:getpeercertificate()
|
||||
for k, v in pairs(cert:subject()) do
|
||||
for i, j in pairs(v) do
|
||||
print(i, j)
|
||||
end
|
||||
end
|
||||
--
|
||||
print(conn:receive("*l"))
|
||||
conn:close()
|
||||
52
thirdparty/luasec/samples/sni/server.lua
vendored
Normal file
52
thirdparty/luasec/samples/sni/server.lua
vendored
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params01 = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = "none",
|
||||
options = "all",
|
||||
ciphers = "ALL:!ADH:@STRENGTH",
|
||||
}
|
||||
|
||||
local params02 = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAAkey.pem",
|
||||
certificate = "../certs/serverAA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = "none",
|
||||
options = "all",
|
||||
ciphers = "ALL:!ADH:@STRENGTH",
|
||||
}
|
||||
|
||||
--
|
||||
local ctx01 = ssl.newcontext(params01)
|
||||
local ctx02 = ssl.newcontext(params02)
|
||||
|
||||
--
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
server:bind("127.0.0.1", 8888)
|
||||
server:listen()
|
||||
local conn = server:accept()
|
||||
--
|
||||
|
||||
-- Default context (when client does not send a name) is ctx01
|
||||
conn = ssl.wrap(conn, ctx01)
|
||||
|
||||
-- Configure the name map
|
||||
local sni_map = {
|
||||
["servera.br"] = ctx01,
|
||||
["serveraa.br"] = ctx02,
|
||||
}
|
||||
|
||||
conn:sni(sni_map, true)
|
||||
|
||||
assert(conn:dohandshake())
|
||||
--
|
||||
conn:send("one line\n")
|
||||
conn:close()
|
||||
29
thirdparty/luasec/samples/verification/fail-string/client.lua
vendored
Normal file
29
thirdparty/luasec/samples/verification/fail-string/client.lua
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1",
|
||||
key = "../../certs/clientBkey.pem",
|
||||
certificate = "../../certs/clientB.pem",
|
||||
cafile = "../../certs/rootB.pem",
|
||||
verify = "none",
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
local err, msg = peer:getpeerverification()
|
||||
print(err, msg)
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
37
thirdparty/luasec/samples/verification/fail-string/server.lua
vendored
Normal file
37
thirdparty/luasec/samples/verification/fail-string/server.lua
vendored
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "tlsv1",
|
||||
key = "../../certs/serverAkey.pem",
|
||||
certificate = "../../certs/serverA.pem",
|
||||
cafile = "../../certs/rootA.pem",
|
||||
verify = "none",
|
||||
options = "all",
|
||||
}
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
local err, msg = peer:getpeerverification()
|
||||
print(err, msg)
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
39
thirdparty/luasec/samples/verification/fail-table/client.lua
vendored
Normal file
39
thirdparty/luasec/samples/verification/fail-table/client.lua
vendored
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1",
|
||||
key = "../../certs/clientBkey.pem",
|
||||
certificate = "../../certs/clientB.pem",
|
||||
cafile = "../../certs/rootB.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
verifyext = "lsec_continue",
|
||||
}
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
local succ, errs = peer:getpeerverification()
|
||||
print(succ, errs)
|
||||
for i, err in pairs(errs) do
|
||||
for j, msg in ipairs(err) do
|
||||
print("depth = " .. i, "error = " .. msg)
|
||||
end
|
||||
end
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
43
thirdparty/luasec/samples/verification/fail-table/server.lua
vendored
Normal file
43
thirdparty/luasec/samples/verification/fail-table/server.lua
vendored
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "tlsv1",
|
||||
key = "../../certs/serverAkey.pem",
|
||||
certificate = "../../certs/serverA.pem",
|
||||
cafile = "../../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
verifyext = {"lsec_continue", "crl_check", "crl_check_chain"},
|
||||
}
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
local succ, errs = peer:getpeerverification()
|
||||
print(succ, errs)
|
||||
for i, err in pairs(errs) do
|
||||
for j, msg in ipairs(err) do
|
||||
print("depth = " .. i, "error = " .. msg)
|
||||
end
|
||||
end
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
29
thirdparty/luasec/samples/verification/success/client.lua
vendored
Normal file
29
thirdparty/luasec/samples/verification/success/client.lua
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1",
|
||||
key = "../../certs/clientAkey.pem",
|
||||
certificate = "../../certs/clientA.pem",
|
||||
cafile = "../../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert(peer:dohandshake())
|
||||
--]]
|
||||
|
||||
local err, msg = peer:getpeerverification()
|
||||
print(err, msg)
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
38
thirdparty/luasec/samples/verification/success/server.lua
vendored
Normal file
38
thirdparty/luasec/samples/verification/success/server.lua
vendored
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "tlsv1",
|
||||
key = "../../certs/serverAkey.pem",
|
||||
certificate = "../../certs/serverA.pem",
|
||||
cafile = "../../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
local err, msg = peer:getpeerverification()
|
||||
print(err, msg)
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
35
thirdparty/luasec/samples/verify/client.lua
vendored
Normal file
35
thirdparty/luasec/samples/verify/client.lua
vendored
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/serverBkey.pem",
|
||||
certificate = "../certs/serverB.pem",
|
||||
cafile = "../certs/rootB.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
verifyext = {"lsec_continue", "lsec_ignore_purpose"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
|
||||
local peer = socket.tcp()
|
||||
peer:connect("127.0.0.1", 8888)
|
||||
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert(peer:dohandshake())
|
||||
|
||||
local succ, errs = peer:getpeerverification()
|
||||
print(succ, errs)
|
||||
for i, err in pairs(errs) do
|
||||
for j, msg in ipairs(err) do
|
||||
print("depth = " .. i, "error = " .. msg)
|
||||
end
|
||||
end
|
||||
|
||||
print(peer:receive("*l"))
|
||||
peer:close()
|
||||
40
thirdparty/luasec/samples/verify/server.lua
vendored
Normal file
40
thirdparty/luasec/samples/verify/server.lua
vendored
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
verifyext = {"lsec_continue", "lsec_ignore_purpose"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
|
||||
local succ, errs = peer:getpeerverification()
|
||||
print(succ, errs)
|
||||
for i, err in pairs(errs) do
|
||||
for j, msg in ipairs(err) do
|
||||
print("depth = " .. i, "error = " .. msg)
|
||||
end
|
||||
end
|
||||
|
||||
peer:send("oneshot test\n")
|
||||
peer:close()
|
||||
66
thirdparty/luasec/samples/want/client.lua
vendored
Normal file
66
thirdparty/luasec/samples/want/client.lua
vendored
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
--
|
||||
-- Test the conn:want() function
|
||||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
-- Wait until socket is ready (for reading or writing)
|
||||
local function wait(peer)
|
||||
-- What event blocked us?
|
||||
local err
|
||||
if peer.want then -- Is it an SSL connection?
|
||||
err = peer:want()
|
||||
print("Want? ", err)
|
||||
else
|
||||
-- No, it's a normal TCP connection...
|
||||
err = "timeout"
|
||||
end
|
||||
|
||||
if err == "read" or err == "timeout" then
|
||||
socket.select({peer}, nil)
|
||||
elseif err == "write" then
|
||||
socket.select(nil, {peer})
|
||||
else
|
||||
peer:close()
|
||||
os.exit(1)
|
||||
end
|
||||
end
|
||||
|
||||
-- Start the TCP connection
|
||||
local peer = socket.tcp()
|
||||
assert( peer:connect("127.0.0.1", 8888) )
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
peer:settimeout(0.3)
|
||||
local succ = peer:dohandshake()
|
||||
while not succ do
|
||||
wait(peer)
|
||||
succ = peer:dohandshake()
|
||||
end
|
||||
print("** Handshake done")
|
||||
--]]
|
||||
|
||||
-- If the section above is commented, the timeout is not set.
|
||||
-- We set it again for safetiness.
|
||||
peer:settimeout(0.3)
|
||||
|
||||
-- Try to receive a line
|
||||
local str = peer:receive("*l")
|
||||
while not str do
|
||||
wait(peer)
|
||||
str = peer:receive("*l")
|
||||
end
|
||||
peer:close()
|
||||
43
thirdparty/luasec/samples/want/server.lua
vendored
Normal file
43
thirdparty/luasec/samples/want/server.lua
vendored
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
socket.sleep(2) -- force the timeout in the client dohandshake()
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
for i = 1, 10 do
|
||||
local v = tostring(i)
|
||||
io.write(v)
|
||||
io.flush()
|
||||
peer:send(v)
|
||||
socket.sleep(1) -- force the timeout in the client receive()
|
||||
end
|
||||
io.write("\n")
|
||||
peer:send("\n")
|
||||
peer:close()
|
||||
55
thirdparty/luasec/samples/wantread/client.lua
vendored
Normal file
55
thirdparty/luasec/samples/wantread/client.lua
vendored
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
|
||||
local function wait(peer, err)
|
||||
if err == "timeout" or err == "wantread" then
|
||||
socket.select({peer}, nil)
|
||||
elseif err == "wantwrite" then
|
||||
socket.select(nil, {peer})
|
||||
else
|
||||
peer:close()
|
||||
os.exit(1)
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
local peer = socket.tcp()
|
||||
assert( peer:connect("127.0.0.1", 8888) )
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
peer:settimeout(0.3)
|
||||
local succ, err = peer:dohandshake()
|
||||
while not succ do
|
||||
print("handshake", err)
|
||||
wait(peer, err)
|
||||
succ, err = peer:dohandshake()
|
||||
end
|
||||
print("** Handshake done")
|
||||
--]]
|
||||
|
||||
-- If the section above is commented, the timeout is not set.
|
||||
-- We set it again for safetiness.
|
||||
peer:settimeout(0.3)
|
||||
|
||||
local str, err, part = peer:receive("*l")
|
||||
while not str do
|
||||
print(part, err)
|
||||
wait(peer, err)
|
||||
str, err, part = peer:receive("*l")
|
||||
end
|
||||
peer:close()
|
||||
45
thirdparty/luasec/samples/wantread/server.lua
vendored
Normal file
45
thirdparty/luasec/samples/wantread/server.lua
vendored
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
--
|
||||
-- Test the conn:want() function.
|
||||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
socket.sleep(2) -- force the timeout in the client dohandshake()
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
for i = 1, 10 do
|
||||
local v = tostring(i)
|
||||
io.write(v)
|
||||
io.flush()
|
||||
peer:send(v)
|
||||
socket.sleep(1) -- force the timeout in the client receive()
|
||||
end
|
||||
io.write("\n")
|
||||
peer:send("\n")
|
||||
peer:close()
|
||||
49
thirdparty/luasec/samples/wantwrite/client.lua
vendored
Normal file
49
thirdparty/luasec/samples/wantwrite/client.lua
vendored
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
local params = {
|
||||
mode = "client",
|
||||
protocol = "tlsv1_2",
|
||||
key = "../certs/clientAkey.pem",
|
||||
certificate = "../certs/clientA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
local function wait(peer, err)
|
||||
if err == "wantread" then
|
||||
socket.select({peer}, nil)
|
||||
elseif err == "timeout" or err == "wantwrite" then
|
||||
socket.select(nil, {peer})
|
||||
else
|
||||
peer:close()
|
||||
os.exit(1)
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
local peer = socket.tcp()
|
||||
assert( peer:connect("127.0.0.1", 8888) )
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, params) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
peer:settimeout(0.3)
|
||||
|
||||
local str = "a rose is a rose is a rose is a...\n"
|
||||
while true do
|
||||
print("Sending...")
|
||||
local succ, err = peer:send(str)
|
||||
while succ do
|
||||
succ, err = peer:send(str)
|
||||
end
|
||||
print("Waiting...", err)
|
||||
wait(peer, err)
|
||||
end
|
||||
peer:close()
|
||||
40
thirdparty/luasec/samples/wantwrite/server.lua
vendored
Normal file
40
thirdparty/luasec/samples/wantwrite/server.lua
vendored
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
--
|
||||
-- Public domain
|
||||
--
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
|
||||
print("Use Ctrl+S and Ctrl+Q to suspend and resume the server.")
|
||||
|
||||
local params = {
|
||||
mode = "server",
|
||||
protocol = "any",
|
||||
key = "../certs/serverAkey.pem",
|
||||
certificate = "../certs/serverA.pem",
|
||||
cafile = "../certs/rootA.pem",
|
||||
verify = {"peer", "fail_if_no_peer_cert"},
|
||||
options = "all",
|
||||
}
|
||||
|
||||
|
||||
-- [[ SSL context
|
||||
local ctx = assert(ssl.newcontext(params))
|
||||
--]]
|
||||
|
||||
local server = socket.tcp()
|
||||
server:setoption('reuseaddr', true)
|
||||
assert( server:bind("127.0.0.1", 8888) )
|
||||
server:listen()
|
||||
|
||||
local peer = server:accept()
|
||||
|
||||
-- [[ SSL wrapper
|
||||
peer = assert( ssl.wrap(peer, ctx) )
|
||||
assert( peer:dohandshake() )
|
||||
--]]
|
||||
|
||||
while true do
|
||||
local str = peer:receive("*l")
|
||||
print(str)
|
||||
end
|
||||
peer:close()
|
||||
66
thirdparty/luasec/src/Makefile
vendored
Normal file
66
thirdparty/luasec/src/Makefile
vendored
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
CMOD=ssl.so
|
||||
LMOD=ssl.lua
|
||||
|
||||
OBJS= \
|
||||
options.o \
|
||||
x509.o \
|
||||
context.o \
|
||||
ssl.o \
|
||||
config.o \
|
||||
ec.o
|
||||
|
||||
LIBS=-lssl -lcrypto -lluasocket
|
||||
|
||||
WARN=-Wall -pedantic
|
||||
|
||||
BSD_CFLAGS=-O2 -fPIC $(WARN) $(INCDIR) $(DEFS)
|
||||
BSD_LDFLAGS=-O -fPIC -shared $(LIBDIR)
|
||||
|
||||
LNX_CFLAGS=-O2 -fPIC $(WARN) $(INCDIR) $(DEFS)
|
||||
LNX_LDFLAGS=-O -fPIC -shared $(LIBDIR)
|
||||
|
||||
MAC_ENV=env MACOSX_DEPLOYMENT_TARGET='$(MACVER)'
|
||||
MAC_CFLAGS=-O2 -fno-common $(WARN) $(INCDIR) $(DEFS)
|
||||
MAC_LDFLAGS=-bundle -undefined dynamic_lookup $(LIBDIR)
|
||||
|
||||
INSTALL = install
|
||||
CC ?= cc
|
||||
CCLD ?= $(MYENV) $(CC)
|
||||
CFLAGS += $(MYCFLAGS)
|
||||
LDFLAGS += $(MYLDFLAGS)
|
||||
|
||||
.PHONY: all clean install none linux bsd macosx luasocket
|
||||
|
||||
all:
|
||||
|
||||
install: $(CMOD) $(LMOD)
|
||||
$(INSTALL) -d $(DESTDIR)$(LUAPATH)/ssl $(DESTDIR)$(LUACPATH)
|
||||
$(INSTALL) $(CMOD) $(DESTDIR)$(LUACPATH)
|
||||
$(INSTALL) -m644 $(LMOD) $(DESTDIR)$(LUAPATH)
|
||||
$(INSTALL) -m644 https.lua $(DESTDIR)$(LUAPATH)/ssl
|
||||
|
||||
linux:
|
||||
@$(MAKE) $(CMOD) MYCFLAGS="$(LNX_CFLAGS)" MYLDFLAGS="$(LNX_LDFLAGS)" EXTRA="$(EXTRA)"
|
||||
|
||||
bsd:
|
||||
@$(MAKE) $(CMOD) MYCFLAGS="$(BSD_CFLAGS)" MYLDFLAGS="$(BSD_LDFLAGS)" EXTRA="$(EXTRA)"
|
||||
|
||||
macosx:
|
||||
@$(MAKE) $(CMOD) MYCFLAGS="$(MAC_CFLAGS)" MYLDFLAGS="$(MAC_LDFLAGS)" MYENV="$(MAC_ENV)" EXTRA="$(EXTRA)"
|
||||
|
||||
luasocket:
|
||||
@cd luasocket && $(MAKE)
|
||||
|
||||
$(CMOD): $(EXTRA) $(OBJS)
|
||||
$(CCLD) $(LDFLAGS) -o $@ $(OBJS) $(LIBS)
|
||||
|
||||
clean:
|
||||
cd luasocket && $(MAKE) clean
|
||||
rm -f $(OBJS) $(CMOD)
|
||||
|
||||
options.o: options.h options.c
|
||||
ec.o: ec.c ec.h
|
||||
x509.o: x509.c x509.h compat.h
|
||||
context.o: context.c context.h ec.h compat.h options.h
|
||||
ssl.o: ssl.c ssl.h context.h x509.h compat.h
|
||||
config.o: config.c ec.h options.h compat.h
|
||||
77
thirdparty/luasec/src/compat.h
vendored
Normal file
77
thirdparty/luasec/src/compat.h
vendored
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#ifndef LSEC_COMPAT_H
|
||||
#define LSEC_COMPAT_H
|
||||
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
#if defined(_WIN32)
|
||||
#define LSEC_API __declspec(dllexport)
|
||||
#else
|
||||
#define LSEC_API extern
|
||||
#endif
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
#if (LUA_VERSION_NUM == 501)
|
||||
|
||||
#define luaL_testudata(L, ud, tname) lsec_testudata(L, ud, tname)
|
||||
#define setfuncs(L, R) luaL_register(L, NULL, R)
|
||||
#define lua_rawlen(L, i) lua_objlen(L, i)
|
||||
|
||||
#ifndef luaL_newlib
|
||||
#define luaL_newlib(L, R) do { lua_newtable(L); luaL_register(L, NULL, R); } while(0)
|
||||
#endif
|
||||
|
||||
#else
|
||||
#define setfuncs(L, R) luaL_setfuncs(L, R, 0)
|
||||
#endif
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
#if (!defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x1010000fL))
|
||||
#define LSEC_ENABLE_DANE
|
||||
#endif
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
#if !((defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x2070000fL)) || (OPENSSL_VERSION_NUMBER < 0x1010000fL))
|
||||
#define LSEC_API_OPENSSL_1_1_0
|
||||
#endif
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
#if !defined(LIBRESSL_VERSION_NUMBER) && ((OPENSSL_VERSION_NUMBER & 0xFFFFF000L) == 0x10101000L || (OPENSSL_VERSION_NUMBER & 0xFFFFF000L) == 0x30000000L)
|
||||
#define LSEC_OPENSSL_ERRNO_BUG
|
||||
#endif
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
#if !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_PSK)
|
||||
#define LSEC_ENABLE_PSK
|
||||
#endif
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
// Added by Scott Duensing to work with existing luasocket for Singe.
|
||||
#ifndef SOCKET_SELECT
|
||||
#include <sys/poll.h>
|
||||
#define WAITFD_R POLLIN
|
||||
#define WAITFD_W POLLOUT
|
||||
#define WAITFD_C (POLLIN|POLLOUT)
|
||||
#else
|
||||
#define WAITFD_R 1
|
||||
#define WAITFD_W 2
|
||||
#define WAITFD_C (WAITFD_R|WAITFD_W)
|
||||
#endif
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
#endif
|
||||
108
thirdparty/luasec/src/config.c
vendored
Normal file
108
thirdparty/luasec/src/config.c
vendored
Normal file
|
|
@ -0,0 +1,108 @@
|
|||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#include "compat.h"
|
||||
#include "options.h"
|
||||
#include "ec.h"
|
||||
|
||||
/**
|
||||
* Registre the module.
|
||||
*/
|
||||
LSEC_API int luaopen_ssl_config(lua_State *L)
|
||||
{
|
||||
lsec_ssl_option_t *opt;
|
||||
|
||||
lua_newtable(L);
|
||||
|
||||
// Options
|
||||
lua_pushstring(L, "options");
|
||||
lua_newtable(L);
|
||||
for (opt = lsec_get_ssl_options(); opt->name; opt++) {
|
||||
lua_pushstring(L, opt->name);
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
}
|
||||
lua_rawset(L, -3);
|
||||
|
||||
// Protocols
|
||||
lua_pushstring(L, "protocols");
|
||||
lua_newtable(L);
|
||||
|
||||
lua_pushstring(L, "tlsv1");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
lua_pushstring(L, "tlsv1_1");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
lua_pushstring(L, "tlsv1_2");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
#ifdef TLS1_3_VERSION
|
||||
lua_pushstring(L, "tlsv1_3");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
#endif
|
||||
|
||||
lua_rawset(L, -3);
|
||||
|
||||
// Algorithms
|
||||
lua_pushstring(L, "algorithms");
|
||||
lua_newtable(L);
|
||||
|
||||
#ifndef OPENSSL_NO_EC
|
||||
lua_pushstring(L, "ec");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
#endif
|
||||
lua_rawset(L, -3);
|
||||
|
||||
// Curves
|
||||
lua_pushstring(L, "curves");
|
||||
lsec_get_curves(L);
|
||||
lua_rawset(L, -3);
|
||||
|
||||
// Capabilities
|
||||
lua_pushstring(L, "capabilities");
|
||||
lua_newtable(L);
|
||||
|
||||
// ALPN
|
||||
lua_pushstring(L, "alpn");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
|
||||
#ifdef LSEC_ENABLE_PSK
|
||||
lua_pushstring(L, "psk");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
#endif
|
||||
|
||||
#ifdef LSEC_ENABLE_DANE
|
||||
// DANE
|
||||
lua_pushstring(L, "dane");
|
||||
#ifdef DANE_FLAG_NO_DANE_EE_NAMECHECKS
|
||||
lua_createtable(L, 0, 1);
|
||||
lua_pushstring(L, "no_ee_namechecks");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
#else
|
||||
lua_pushboolean(L, 1);
|
||||
#endif
|
||||
lua_rawset(L, -3);
|
||||
#endif
|
||||
|
||||
#ifndef OPENSSL_NO_EC
|
||||
lua_pushstring(L, "curves_list");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
lua_pushstring(L, "ecdh_auto");
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -3);
|
||||
#endif
|
||||
lua_rawset(L, -3);
|
||||
|
||||
return 1;
|
||||
}
|
||||
1099
thirdparty/luasec/src/context.c
vendored
Normal file
1099
thirdparty/luasec/src/context.c
vendored
Normal file
File diff suppressed because it is too large
Load diff
47
thirdparty/luasec/src/context.h
vendored
Normal file
47
thirdparty/luasec/src/context.h
vendored
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
#ifndef LSEC_CONTEXT_H
|
||||
#define LSEC_CONTEXT_H
|
||||
|
||||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#include <lua.h>
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
#include "compat.h"
|
||||
|
||||
#define LSEC_MODE_INVALID 0
|
||||
#define LSEC_MODE_SERVER 1
|
||||
#define LSEC_MODE_CLIENT 2
|
||||
|
||||
#define LSEC_VERIFY_CONTINUE 1
|
||||
#define LSEC_VERIFY_IGNORE_PURPOSE 2
|
||||
|
||||
typedef struct t_context_ {
|
||||
SSL_CTX *context;
|
||||
lua_State *L;
|
||||
DH *dh_param;
|
||||
void *alpn;
|
||||
int mode;
|
||||
} t_context;
|
||||
typedef t_context* p_context;
|
||||
|
||||
/* Retrieve the SSL context from the Lua stack */
|
||||
SSL_CTX *lsec_checkcontext(lua_State *L, int idx);
|
||||
SSL_CTX *lsec_testcontext(lua_State *L, int idx);
|
||||
|
||||
/* Retrieve the mode from the context in the Lua stack */
|
||||
int lsec_getmode(lua_State *L, int idx);
|
||||
|
||||
/* Registre the module. */
|
||||
LSEC_API int luaopen_ssl_context(lua_State *L);
|
||||
|
||||
/* Compat - Lua 5.1 */
|
||||
#if (LUA_VERSION_NUM == 501)
|
||||
void *lsec_testudata (lua_State *L, int ud, const char *tname);
|
||||
#endif
|
||||
|
||||
#endif
|
||||
116
thirdparty/luasec/src/ec.c
vendored
Normal file
116
thirdparty/luasec/src/ec.c
vendored
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#include <openssl/objects.h>
|
||||
|
||||
#include "ec.h"
|
||||
|
||||
#ifndef OPENSSL_NO_EC
|
||||
|
||||
EC_KEY *lsec_find_ec_key(lua_State *L, const char *str)
|
||||
{
|
||||
int nid;
|
||||
lua_pushstring(L, "SSL:EC:CURVES");
|
||||
lua_rawget(L, LUA_REGISTRYINDEX);
|
||||
lua_pushstring(L, str);
|
||||
lua_rawget(L, -2);
|
||||
|
||||
if (!lua_isnumber(L, -1))
|
||||
return NULL;
|
||||
|
||||
nid = (int)lua_tonumber(L, -1);
|
||||
return EC_KEY_new_by_curve_name(nid);
|
||||
}
|
||||
|
||||
void lsec_load_curves(lua_State *L)
|
||||
{
|
||||
size_t i;
|
||||
size_t size;
|
||||
const char *name;
|
||||
EC_builtin_curve *curves = NULL;
|
||||
|
||||
lua_pushstring(L, "SSL:EC:CURVES");
|
||||
lua_newtable(L);
|
||||
|
||||
size = EC_get_builtin_curves(NULL, 0);
|
||||
if (size > 0) {
|
||||
curves = (EC_builtin_curve*)malloc(sizeof(EC_builtin_curve) * size);
|
||||
EC_get_builtin_curves(curves, size);
|
||||
for (i = 0; i < size; i++) {
|
||||
name = OBJ_nid2sn(curves[i].nid);
|
||||
if (name != NULL) {
|
||||
lua_pushstring(L, name);
|
||||
lua_pushnumber(L, curves[i].nid);
|
||||
lua_rawset(L, -3);
|
||||
}
|
||||
switch (curves[i].nid) {
|
||||
case NID_X9_62_prime256v1:
|
||||
lua_pushstring(L, "P-256");
|
||||
lua_pushnumber(L, curves[i].nid);
|
||||
lua_rawset(L, -3);
|
||||
break;
|
||||
case NID_secp384r1:
|
||||
lua_pushstring(L, "P-384");
|
||||
lua_pushnumber(L, curves[i].nid);
|
||||
lua_rawset(L, -3);
|
||||
break;
|
||||
case NID_secp521r1:
|
||||
lua_pushstring(L, "P-521");
|
||||
lua_pushnumber(L, curves[i].nid);
|
||||
lua_rawset(L, -3);
|
||||
break;
|
||||
}
|
||||
}
|
||||
free(curves);
|
||||
}
|
||||
|
||||
/* These are special so are manually added here */
|
||||
#ifdef NID_X25519
|
||||
lua_pushstring(L, "X25519");
|
||||
lua_pushnumber(L, NID_X25519);
|
||||
lua_rawset(L, -3);
|
||||
#endif
|
||||
|
||||
#ifdef NID_X448
|
||||
lua_pushstring(L, "X448");
|
||||
lua_pushnumber(L, NID_X448);
|
||||
lua_rawset(L, -3);
|
||||
#endif
|
||||
|
||||
lua_rawset(L, LUA_REGISTRYINDEX);
|
||||
}
|
||||
|
||||
void lsec_get_curves(lua_State *L)
|
||||
{
|
||||
lua_newtable(L);
|
||||
|
||||
lua_pushstring(L, "SSL:EC:CURVES");
|
||||
lua_rawget(L, LUA_REGISTRYINDEX);
|
||||
|
||||
lua_pushnil(L);
|
||||
while (lua_next(L, -2) != 0) {
|
||||
lua_pop(L, 1);
|
||||
lua_pushvalue(L, -1);
|
||||
lua_pushboolean(L, 1);
|
||||
lua_rawset(L, -5);
|
||||
}
|
||||
lua_pop(L, 1);
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
void lsec_load_curves(lua_State *L)
|
||||
{
|
||||
// do nothing
|
||||
}
|
||||
|
||||
void lsec_get_curves(lua_State *L)
|
||||
{
|
||||
lua_newtable(L);
|
||||
}
|
||||
|
||||
#endif
|
||||
22
thirdparty/luasec/src/ec.h
vendored
Normal file
22
thirdparty/luasec/src/ec.h
vendored
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#ifndef LSEC_EC_H
|
||||
#define LSEC_EC_H
|
||||
|
||||
#include <lua.h>
|
||||
|
||||
#ifndef OPENSSL_NO_EC
|
||||
#include <openssl/ec.h>
|
||||
|
||||
EC_KEY *lsec_find_ec_key(lua_State *L, const char *str);
|
||||
#endif
|
||||
|
||||
void lsec_get_curves(lua_State *L);
|
||||
void lsec_load_curves(lua_State *L);
|
||||
|
||||
#endif
|
||||
147
thirdparty/luasec/src/https.lua
vendored
Normal file
147
thirdparty/luasec/src/https.lua
vendored
Normal file
|
|
@ -0,0 +1,147 @@
|
|||
----------------------------------------------------------------------------
|
||||
-- LuaSec 1.3.2
|
||||
--
|
||||
-- Copyright (C) 2009-2023 PUC-Rio
|
||||
--
|
||||
-- Author: Pablo Musa
|
||||
-- Author: Tomas Guisasola
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
local socket = require("socket")
|
||||
local ssl = require("ssl")
|
||||
local ltn12 = require("ltn12")
|
||||
local http = require("socket.http")
|
||||
local url = require("socket.url")
|
||||
|
||||
local try = socket.try
|
||||
|
||||
--
|
||||
-- Module
|
||||
--
|
||||
local _M = {
|
||||
_VERSION = "1.3.2",
|
||||
_COPYRIGHT = "LuaSec 1.3.2 - Copyright (C) 2009-2023 PUC-Rio",
|
||||
PORT = 443,
|
||||
TIMEOUT = 60
|
||||
}
|
||||
|
||||
-- TLS configuration
|
||||
local cfg = {
|
||||
protocol = "any",
|
||||
options = {"all", "no_sslv2", "no_sslv3", "no_tlsv1"},
|
||||
verify = "none",
|
||||
}
|
||||
|
||||
--------------------------------------------------------------------
|
||||
-- Auxiliar Functions
|
||||
--------------------------------------------------------------------
|
||||
|
||||
-- Insert default HTTPS port.
|
||||
local function default_https_port(u)
|
||||
return url.build(url.parse(u, {port = _M.PORT}))
|
||||
end
|
||||
|
||||
-- Convert an URL to a table according to Luasocket needs.
|
||||
local function urlstring_totable(url, body, result_table)
|
||||
url = {
|
||||
url = default_https_port(url),
|
||||
method = body and "POST" or "GET",
|
||||
sink = ltn12.sink.table(result_table)
|
||||
}
|
||||
if body then
|
||||
url.source = ltn12.source.string(body)
|
||||
url.headers = {
|
||||
["content-length"] = #body,
|
||||
["content-type"] = "application/x-www-form-urlencoded",
|
||||
}
|
||||
end
|
||||
return url
|
||||
end
|
||||
|
||||
-- Forward calls to the real connection object.
|
||||
local function reg(conn)
|
||||
local mt = getmetatable(conn.sock).__index
|
||||
for name, method in pairs(mt) do
|
||||
if type(method) == "function" then
|
||||
conn[name] = function (self, ...)
|
||||
return method(self.sock, ...)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
-- Return a function which performs the SSL/TLS connection.
|
||||
local function tcp(params)
|
||||
params = params or {}
|
||||
-- Default settings
|
||||
for k, v in pairs(cfg) do
|
||||
params[k] = params[k] or v
|
||||
end
|
||||
-- Force client mode
|
||||
params.mode = "client"
|
||||
-- 'create' function for LuaSocket
|
||||
return function ()
|
||||
local conn = {}
|
||||
conn.sock = try(socket.tcp())
|
||||
local st = getmetatable(conn.sock).__index.settimeout
|
||||
function conn:settimeout(...)
|
||||
return st(self.sock, _M.TIMEOUT)
|
||||
end
|
||||
-- Replace TCP's connection function
|
||||
function conn:connect(host, port)
|
||||
try(self.sock:connect(host, port))
|
||||
self.sock = try(ssl.wrap(self.sock, params))
|
||||
self.sock:sni(host)
|
||||
self.sock:settimeout(_M.TIMEOUT)
|
||||
try(self.sock:dohandshake())
|
||||
reg(self)
|
||||
return 1
|
||||
end
|
||||
return conn
|
||||
end
|
||||
end
|
||||
|
||||
--------------------------------------------------------------------
|
||||
-- Main Function
|
||||
--------------------------------------------------------------------
|
||||
|
||||
-- Make a HTTP request over secure connection. This function receives
|
||||
-- the same parameters of LuaSocket's HTTP module (except 'proxy' and
|
||||
-- 'redirect') plus LuaSec parameters.
|
||||
--
|
||||
-- @param url mandatory (string or table)
|
||||
-- @param body optional (string)
|
||||
-- @return (string if url == string or 1), code, headers, status
|
||||
--
|
||||
local function request(url, body)
|
||||
local result_table = {}
|
||||
local stringrequest = type(url) == "string"
|
||||
if stringrequest then
|
||||
url = urlstring_totable(url, body, result_table)
|
||||
else
|
||||
url.url = default_https_port(url.url)
|
||||
end
|
||||
if http.PROXY or url.proxy then
|
||||
return nil, "proxy not supported"
|
||||
elseif url.redirect then
|
||||
return nil, "redirect not supported"
|
||||
elseif url.create then
|
||||
return nil, "create function not permitted"
|
||||
end
|
||||
-- New 'create' function to establish a secure connection
|
||||
url.create = tcp(url)
|
||||
local res, code, headers, status = http.request(url)
|
||||
if res and stringrequest then
|
||||
return table.concat(result_table), code, headers, status
|
||||
end
|
||||
return res, code, headers, status
|
||||
end
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
-- Export module
|
||||
--
|
||||
|
||||
_M.request = request
|
||||
_M.tcp = tcp
|
||||
|
||||
return _M
|
||||
185
thirdparty/luasec/src/options.c
vendored
Normal file
185
thirdparty/luasec/src/options.c
vendored
Normal file
|
|
@ -0,0 +1,185 @@
|
|||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
#include "options.h"
|
||||
|
||||
/* If you need to generate these options again, see options.lua */
|
||||
|
||||
|
||||
/*
|
||||
OpenSSL version: OpenSSL 3.0.8
|
||||
*/
|
||||
|
||||
static lsec_ssl_option_t ssl_options[] = {
|
||||
#if defined(SSL_OP_ALL)
|
||||
{"all", SSL_OP_ALL},
|
||||
#endif
|
||||
#if defined(SSL_OP_ALLOW_CLIENT_RENEGOTIATION)
|
||||
{"allow_client_renegotiation", SSL_OP_ALLOW_CLIENT_RENEGOTIATION},
|
||||
#endif
|
||||
#if defined(SSL_OP_ALLOW_NO_DHE_KEX)
|
||||
{"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX},
|
||||
#endif
|
||||
#if defined(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)
|
||||
{"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION},
|
||||
#endif
|
||||
#if defined(SSL_OP_CIPHER_SERVER_PREFERENCE)
|
||||
{"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE},
|
||||
#endif
|
||||
#if defined(SSL_OP_CISCO_ANYCONNECT)
|
||||
{"cisco_anyconnect", SSL_OP_CISCO_ANYCONNECT},
|
||||
#endif
|
||||
#if defined(SSL_OP_CLEANSE_PLAINTEXT)
|
||||
{"cleanse_plaintext", SSL_OP_CLEANSE_PLAINTEXT},
|
||||
#endif
|
||||
#if defined(SSL_OP_COOKIE_EXCHANGE)
|
||||
{"cookie_exchange", SSL_OP_COOKIE_EXCHANGE},
|
||||
#endif
|
||||
#if defined(SSL_OP_CRYPTOPRO_TLSEXT_BUG)
|
||||
{"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_DISABLE_TLSEXT_CA_NAMES)
|
||||
{"disable_tlsext_ca_names", SSL_OP_DISABLE_TLSEXT_CA_NAMES},
|
||||
#endif
|
||||
#if defined(SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)
|
||||
{"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS},
|
||||
#endif
|
||||
#if defined(SSL_OP_ENABLE_KTLS)
|
||||
{"enable_ktls", SSL_OP_ENABLE_KTLS},
|
||||
#endif
|
||||
#if defined(SSL_OP_ENABLE_MIDDLEBOX_COMPAT)
|
||||
{"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT},
|
||||
#endif
|
||||
#if defined(SSL_OP_EPHEMERAL_RSA)
|
||||
{"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA},
|
||||
#endif
|
||||
#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
|
||||
{"ignore_unexpected_eof", SSL_OP_IGNORE_UNEXPECTED_EOF},
|
||||
#endif
|
||||
#if defined(SSL_OP_LEGACY_SERVER_CONNECT)
|
||||
{"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT},
|
||||
#endif
|
||||
#if defined(SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
|
||||
{"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER},
|
||||
#endif
|
||||
#if defined(SSL_OP_MICROSOFT_SESS_ID_BUG)
|
||||
{"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_MSIE_SSLV2_RSA_PADDING)
|
||||
{"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING},
|
||||
#endif
|
||||
#if defined(SSL_OP_NETSCAPE_CA_DN_BUG)
|
||||
{"netscape_ca_dn_bug", SSL_OP_NETSCAPE_CA_DN_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_NETSCAPE_CHALLENGE_BUG)
|
||||
{"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG)
|
||||
{"netscape_demo_cipher_change_bug", SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)
|
||||
{"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_ANTI_REPLAY)
|
||||
{"no_anti_replay", SSL_OP_NO_ANTI_REPLAY},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_COMPRESSION)
|
||||
{"no_compression", SSL_OP_NO_COMPRESSION},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_DTLS_MASK)
|
||||
{"no_dtls_mask", SSL_OP_NO_DTLS_MASK},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_DTLSv1)
|
||||
{"no_dtlsv1", SSL_OP_NO_DTLSv1},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_DTLSv1_2)
|
||||
{"no_dtlsv1_2", SSL_OP_NO_DTLSv1_2},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_ENCRYPT_THEN_MAC)
|
||||
{"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_EXTENDED_MASTER_SECRET)
|
||||
{"no_extended_master_secret", SSL_OP_NO_EXTENDED_MASTER_SECRET},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_QUERY_MTU)
|
||||
{"no_query_mtu", SSL_OP_NO_QUERY_MTU},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_RENEGOTIATION)
|
||||
{"no_renegotiation", SSL_OP_NO_RENEGOTIATION},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)
|
||||
{"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_SSL_MASK)
|
||||
{"no_ssl_mask", SSL_OP_NO_SSL_MASK},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_SSLv2)
|
||||
{"no_sslv2", SSL_OP_NO_SSLv2},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_SSLv3)
|
||||
{"no_sslv3", SSL_OP_NO_SSLv3},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_TICKET)
|
||||
{"no_ticket", SSL_OP_NO_TICKET},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_TLSv1)
|
||||
{"no_tlsv1", SSL_OP_NO_TLSv1},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_TLSv1_1)
|
||||
{"no_tlsv1_1", SSL_OP_NO_TLSv1_1},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_TLSv1_2)
|
||||
{"no_tlsv1_2", SSL_OP_NO_TLSv1_2},
|
||||
#endif
|
||||
#if defined(SSL_OP_NO_TLSv1_3)
|
||||
{"no_tlsv1_3", SSL_OP_NO_TLSv1_3},
|
||||
#endif
|
||||
#if defined(SSL_OP_PKCS1_CHECK_1)
|
||||
{"pkcs1_check_1", SSL_OP_PKCS1_CHECK_1},
|
||||
#endif
|
||||
#if defined(SSL_OP_PKCS1_CHECK_2)
|
||||
{"pkcs1_check_2", SSL_OP_PKCS1_CHECK_2},
|
||||
#endif
|
||||
#if defined(SSL_OP_PRIORITIZE_CHACHA)
|
||||
{"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA},
|
||||
#endif
|
||||
#if defined(SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
|
||||
{"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_SINGLE_DH_USE)
|
||||
{"single_dh_use", SSL_OP_SINGLE_DH_USE},
|
||||
#endif
|
||||
#if defined(SSL_OP_SINGLE_ECDH_USE)
|
||||
{"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE},
|
||||
#endif
|
||||
#if defined(SSL_OP_SSLEAY_080_CLIENT_DH_BUG)
|
||||
{"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG)
|
||||
{"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_TLSEXT_PADDING)
|
||||
{"tlsext_padding", SSL_OP_TLSEXT_PADDING},
|
||||
#endif
|
||||
#if defined(SSL_OP_TLS_BLOCK_PADDING_BUG)
|
||||
{"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_TLS_D5_BUG)
|
||||
{"tls_d5_bug", SSL_OP_TLS_D5_BUG},
|
||||
#endif
|
||||
#if defined(SSL_OP_TLS_ROLLBACK_BUG)
|
||||
{"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG},
|
||||
#endif
|
||||
{NULL, 0L}
|
||||
};
|
||||
|
||||
LSEC_API lsec_ssl_option_t* lsec_get_ssl_options() {
|
||||
return ssl_options;
|
||||
}
|
||||
|
||||
22
thirdparty/luasec/src/options.h
vendored
Normal file
22
thirdparty/luasec/src/options.h
vendored
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
#ifndef LSEC_OPTIONS_H
|
||||
#define LSEC_OPTIONS_H
|
||||
|
||||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#include "compat.h"
|
||||
|
||||
struct lsec_ssl_option_s {
|
||||
const char *name;
|
||||
unsigned long code;
|
||||
};
|
||||
|
||||
typedef struct lsec_ssl_option_s lsec_ssl_option_t;
|
||||
|
||||
LSEC_API lsec_ssl_option_t* lsec_get_ssl_options();
|
||||
|
||||
#endif
|
||||
93
thirdparty/luasec/src/options.lua
vendored
Normal file
93
thirdparty/luasec/src/options.lua
vendored
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
local function usage()
|
||||
print("Usage:")
|
||||
print("* Generate options of your system:")
|
||||
print(" lua options.lua -g /path/to/ssl.h [version] > options.c")
|
||||
print("* Examples:")
|
||||
print(" lua options.lua -g /usr/include/openssl/ssl.h > options.c\n")
|
||||
print(" lua options.lua -g /usr/include/openssl/ssl.h \"OpenSSL 1.1.1f\" > options.c\n")
|
||||
|
||||
print("* List options of your system:")
|
||||
print(" lua options.lua -l /path/to/ssl.h\n")
|
||||
end
|
||||
|
||||
--
|
||||
local function printf(str, ...)
|
||||
print(string.format(str, ...))
|
||||
end
|
||||
|
||||
local function generate(options, version)
|
||||
print([[
|
||||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
#include "options.h"
|
||||
|
||||
/* If you need to generate these options again, see options.lua */
|
||||
|
||||
]])
|
||||
|
||||
printf([[
|
||||
/*
|
||||
OpenSSL version: %s
|
||||
*/
|
||||
]], version)
|
||||
|
||||
print([[static lsec_ssl_option_t ssl_options[] = {]])
|
||||
|
||||
for k, option in ipairs(options) do
|
||||
local name = string.lower(string.sub(option, 8))
|
||||
print(string.format([[#if defined(%s)]], option))
|
||||
print(string.format([[ {"%s", %s},]], name, option))
|
||||
print([[#endif]])
|
||||
end
|
||||
print([[ {NULL, 0L}]])
|
||||
print([[
|
||||
};
|
||||
|
||||
LSEC_API lsec_ssl_option_t* lsec_get_ssl_options() {
|
||||
return ssl_options;
|
||||
}
|
||||
]])
|
||||
end
|
||||
|
||||
local function loadoptions(file)
|
||||
local options = {}
|
||||
local f = assert(io.open(file, "r"))
|
||||
for line in f:lines() do
|
||||
local op = string.match(line, "define%s+(SSL_OP_BIT%()")
|
||||
if not op then
|
||||
op = string.match(line, "define%s+(SSL_OP_%S+)")
|
||||
if op then
|
||||
table.insert(options, op)
|
||||
end
|
||||
end
|
||||
end
|
||||
table.sort(options, function(a,b) return a<b end)
|
||||
return options
|
||||
end
|
||||
--
|
||||
|
||||
local options
|
||||
local flag, file, version = ...
|
||||
|
||||
version = version or "Unknown"
|
||||
|
||||
if not file then
|
||||
usage()
|
||||
elseif flag == "-g" then
|
||||
options = loadoptions(file)
|
||||
generate(options, version)
|
||||
elseif flag == "-l" then
|
||||
options = loadoptions(file)
|
||||
for k, option in ipairs(options) do
|
||||
print(option)
|
||||
end
|
||||
else
|
||||
usage()
|
||||
end
|
||||
1092
thirdparty/luasec/src/ssl.c
vendored
Normal file
1092
thirdparty/luasec/src/ssl.c
vendored
Normal file
File diff suppressed because it is too large
Load diff
41
thirdparty/luasec/src/ssl.h
vendored
Normal file
41
thirdparty/luasec/src/ssl.h
vendored
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
#ifndef LSEC_SSL_H
|
||||
#define LSEC_SSL_H
|
||||
|
||||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2006-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#include <openssl/ssl.h>
|
||||
#include <lua.h>
|
||||
|
||||
#include <luasocket/io.h>
|
||||
#include <luasocket/buffer.h>
|
||||
#include <luasocket/timeout.h>
|
||||
#include <luasocket/socket.h>
|
||||
|
||||
#include "compat.h"
|
||||
#include "context.h"
|
||||
|
||||
#define LSEC_STATE_NEW 1
|
||||
#define LSEC_STATE_CONNECTED 2
|
||||
#define LSEC_STATE_CLOSED 3
|
||||
|
||||
#define LSEC_IO_SSL -100
|
||||
|
||||
typedef struct t_ssl_ {
|
||||
t_socket sock;
|
||||
t_io io;
|
||||
t_buffer buf;
|
||||
t_timeout tm;
|
||||
SSL *ssl;
|
||||
int state;
|
||||
int error;
|
||||
} t_ssl;
|
||||
typedef t_ssl* p_ssl;
|
||||
|
||||
LSEC_API int luaopen_ssl_core(lua_State *L);
|
||||
|
||||
#endif
|
||||
313
thirdparty/luasec/src/ssl.lua
vendored
Normal file
313
thirdparty/luasec/src/ssl.lua
vendored
Normal file
|
|
@ -0,0 +1,313 @@
|
|||
------------------------------------------------------------------------------
|
||||
-- LuaSec 1.3.2
|
||||
--
|
||||
-- Copyright (C) 2006-2023 Bruno Silvestre
|
||||
--
|
||||
------------------------------------------------------------------------------
|
||||
|
||||
local core = require("ssl.core")
|
||||
local context = require("ssl.context")
|
||||
local x509 = require("ssl.x509")
|
||||
local config = require("ssl.config")
|
||||
|
||||
local unpack = table.unpack or unpack
|
||||
|
||||
-- We must prevent the contexts to be collected before the connections,
|
||||
-- otherwise the C registry will be cleared.
|
||||
local registry = setmetatable({}, {__mode="k"})
|
||||
|
||||
--
|
||||
--
|
||||
--
|
||||
local function optexec(func, param, ctx)
|
||||
if param then
|
||||
if type(param) == "table" then
|
||||
return func(ctx, unpack(param))
|
||||
else
|
||||
return func(ctx, param)
|
||||
end
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
--
|
||||
-- Convert an array of strings to wire-format
|
||||
--
|
||||
local function array2wireformat(array)
|
||||
local str = ""
|
||||
for k, v in ipairs(array) do
|
||||
if type(v) ~= "string" then return nil end
|
||||
local len = #v
|
||||
if len == 0 then
|
||||
return nil, "invalid ALPN name (empty string)"
|
||||
elseif len > 255 then
|
||||
return nil, "invalid ALPN name (length > 255)"
|
||||
end
|
||||
str = str .. string.char(len) .. v
|
||||
end
|
||||
if str == "" then return nil, "invalid ALPN list (empty)" end
|
||||
return str
|
||||
end
|
||||
|
||||
--
|
||||
-- Convert wire-string format to array
|
||||
--
|
||||
local function wireformat2array(str)
|
||||
local i = 1
|
||||
local array = {}
|
||||
while i < #str do
|
||||
local len = str:byte(i)
|
||||
array[#array + 1] = str:sub(i + 1, i + len)
|
||||
i = i + len + 1
|
||||
end
|
||||
return array
|
||||
end
|
||||
|
||||
--
|
||||
--
|
||||
--
|
||||
local function newcontext(cfg)
|
||||
local succ, msg, ctx
|
||||
-- Create the context
|
||||
ctx, msg = context.create(cfg.protocol)
|
||||
if not ctx then return nil, msg end
|
||||
-- Mode
|
||||
succ, msg = context.setmode(ctx, cfg.mode)
|
||||
if not succ then return nil, msg end
|
||||
local certificates = cfg.certificates
|
||||
if not certificates then
|
||||
certificates = {
|
||||
{ certificate = cfg.certificate, key = cfg.key, password = cfg.password }
|
||||
}
|
||||
end
|
||||
for _, certificate in ipairs(certificates) do
|
||||
-- Load the key
|
||||
if certificate.key then
|
||||
if certificate.password and
|
||||
type(certificate.password) ~= "function" and
|
||||
type(certificate.password) ~= "string"
|
||||
then
|
||||
return nil, "invalid password type"
|
||||
end
|
||||
succ, msg = context.loadkey(ctx, certificate.key, certificate.password)
|
||||
if not succ then return nil, msg end
|
||||
end
|
||||
-- Load the certificate(s)
|
||||
if certificate.certificate then
|
||||
succ, msg = context.loadcert(ctx, certificate.certificate)
|
||||
if not succ then return nil, msg end
|
||||
if certificate.key and context.checkkey then
|
||||
succ = context.checkkey(ctx)
|
||||
if not succ then return nil, "private key does not match public key" end
|
||||
end
|
||||
end
|
||||
end
|
||||
-- Load the CA certificates
|
||||
if cfg.cafile or cfg.capath then
|
||||
succ, msg = context.locations(ctx, cfg.cafile, cfg.capath)
|
||||
if not succ then return nil, msg end
|
||||
end
|
||||
-- Set SSL ciphers
|
||||
if cfg.ciphers then
|
||||
succ, msg = context.setcipher(ctx, cfg.ciphers)
|
||||
if not succ then return nil, msg end
|
||||
end
|
||||
-- Set SSL cipher suites
|
||||
if cfg.ciphersuites then
|
||||
succ, msg = context.setciphersuites(ctx, cfg.ciphersuites)
|
||||
if not succ then return nil, msg end
|
||||
end
|
||||
-- Set the verification options
|
||||
succ, msg = optexec(context.setverify, cfg.verify, ctx)
|
||||
if not succ then return nil, msg end
|
||||
-- Set SSL options
|
||||
succ, msg = optexec(context.setoptions, cfg.options, ctx)
|
||||
if not succ then return nil, msg end
|
||||
-- Set the depth for certificate verification
|
||||
if cfg.depth then
|
||||
succ, msg = context.setdepth(ctx, cfg.depth)
|
||||
if not succ then return nil, msg end
|
||||
end
|
||||
|
||||
-- NOTE: Setting DH parameters and elliptic curves needs to come after
|
||||
-- setoptions(), in case the user has specified the single_{dh,ecdh}_use
|
||||
-- options.
|
||||
|
||||
-- Set DH parameters
|
||||
if cfg.dhparam then
|
||||
if type(cfg.dhparam) ~= "function" then
|
||||
return nil, "invalid DH parameter type"
|
||||
end
|
||||
context.setdhparam(ctx, cfg.dhparam)
|
||||
end
|
||||
|
||||
-- Set elliptic curves
|
||||
if (not config.algorithms.ec) and (cfg.curve or cfg.curveslist) then
|
||||
return false, "elliptic curves not supported"
|
||||
end
|
||||
if config.capabilities.curves_list and cfg.curveslist then
|
||||
succ, msg = context.setcurveslist(ctx, cfg.curveslist)
|
||||
if not succ then return nil, msg end
|
||||
elseif cfg.curve then
|
||||
succ, msg = context.setcurve(ctx, cfg.curve)
|
||||
if not succ then return nil, msg end
|
||||
end
|
||||
|
||||
-- Set extra verification options
|
||||
if cfg.verifyext and ctx.setverifyext then
|
||||
succ, msg = optexec(ctx.setverifyext, cfg.verifyext, ctx)
|
||||
if not succ then return nil, msg end
|
||||
end
|
||||
|
||||
-- ALPN
|
||||
if cfg.mode == "server" and cfg.alpn then
|
||||
if type(cfg.alpn) == "function" then
|
||||
local alpncb = cfg.alpn
|
||||
-- This callback function has to return one value only
|
||||
succ, msg = context.setalpncb(ctx, function(str)
|
||||
local protocols = alpncb(wireformat2array(str))
|
||||
if type(protocols) == "string" then
|
||||
protocols = { protocols }
|
||||
elseif type(protocols) ~= "table" then
|
||||
return nil
|
||||
end
|
||||
return (array2wireformat(protocols)) -- use "()" to drop error message
|
||||
end)
|
||||
if not succ then return nil, msg end
|
||||
elseif type(cfg.alpn) == "table" then
|
||||
local protocols = cfg.alpn
|
||||
-- check if array is valid before use it
|
||||
succ, msg = array2wireformat(protocols)
|
||||
if not succ then return nil, msg end
|
||||
-- This callback function has to return one value only
|
||||
succ, msg = context.setalpncb(ctx, function()
|
||||
return (array2wireformat(protocols)) -- use "()" to drop error message
|
||||
end)
|
||||
if not succ then return nil, msg end
|
||||
else
|
||||
return nil, "invalid ALPN parameter"
|
||||
end
|
||||
elseif cfg.mode == "client" and cfg.alpn then
|
||||
local alpn
|
||||
if type(cfg.alpn) == "string" then
|
||||
alpn, msg = array2wireformat({ cfg.alpn })
|
||||
elseif type(cfg.alpn) == "table" then
|
||||
alpn, msg = array2wireformat(cfg.alpn)
|
||||
else
|
||||
return nil, "invalid ALPN parameter"
|
||||
end
|
||||
if not alpn then return nil, msg end
|
||||
succ, msg = context.setalpn(ctx, alpn)
|
||||
if not succ then return nil, msg end
|
||||
end
|
||||
|
||||
-- PSK
|
||||
if config.capabilities.psk and cfg.psk then
|
||||
if cfg.mode == "client" then
|
||||
if type(cfg.psk) ~= "function" then
|
||||
return nil, "invalid PSK configuration"
|
||||
end
|
||||
succ = context.setclientpskcb(ctx, cfg.psk)
|
||||
if not succ then return nil, msg end
|
||||
elseif cfg.mode == "server" then
|
||||
if type(cfg.psk) == "function" then
|
||||
succ, msg = context.setserverpskcb(ctx, cfg.psk)
|
||||
if not succ then return nil, msg end
|
||||
elseif type(cfg.psk) == "table" then
|
||||
if type(cfg.psk.hint) == "string" and type(cfg.psk.callback) == "function" then
|
||||
succ, msg = context.setpskhint(ctx, cfg.psk.hint)
|
||||
if not succ then return succ, msg end
|
||||
succ = context.setserverpskcb(ctx, cfg.psk.callback)
|
||||
if not succ then return succ, msg end
|
||||
else
|
||||
return nil, "invalid PSK configuration"
|
||||
end
|
||||
else
|
||||
return nil, "invalid PSK configuration"
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if config.capabilities.dane and cfg.dane then
|
||||
if type(cfg.dane) == "table" then
|
||||
context.setdane(ctx, unpack(cfg.dane))
|
||||
else
|
||||
context.setdane(ctx)
|
||||
end
|
||||
end
|
||||
|
||||
return ctx
|
||||
end
|
||||
|
||||
--
|
||||
--
|
||||
--
|
||||
local function wrap(sock, cfg)
|
||||
local ctx, msg
|
||||
if type(cfg) == "table" then
|
||||
ctx, msg = newcontext(cfg)
|
||||
if not ctx then return nil, msg end
|
||||
else
|
||||
ctx = cfg
|
||||
end
|
||||
local s, msg = core.create(ctx)
|
||||
if s then
|
||||
core.setfd(s, sock:getfd())
|
||||
sock:setfd(core.SOCKET_INVALID)
|
||||
registry[s] = ctx
|
||||
return s
|
||||
end
|
||||
return nil, msg
|
||||
end
|
||||
|
||||
--
|
||||
-- Extract connection information.
|
||||
--
|
||||
local function info(ssl, field)
|
||||
local str, comp, err, protocol
|
||||
comp, err = core.compression(ssl)
|
||||
if err then
|
||||
return comp, err
|
||||
end
|
||||
-- Avoid parser
|
||||
if field == "compression" then
|
||||
return comp
|
||||
end
|
||||
local info = {compression = comp}
|
||||
str, info.bits, info.algbits, protocol = core.info(ssl)
|
||||
if str then
|
||||
info.cipher, info.protocol, info.key,
|
||||
info.authentication, info.encryption, info.mac =
|
||||
string.match(str,
|
||||
"^(%S+)%s+(%S+)%s+Kx=(%S+)%s+Au=(%S+)%s+Enc=(%S+)%s+Mac=(%S+)")
|
||||
info.export = (string.match(str, "%sexport%s*$") ~= nil)
|
||||
end
|
||||
if protocol then
|
||||
info.protocol = protocol
|
||||
end
|
||||
if field then
|
||||
return info[field]
|
||||
end
|
||||
-- Empty?
|
||||
return ( (next(info)) and info )
|
||||
end
|
||||
|
||||
--
|
||||
-- Set method for SSL connections.
|
||||
--
|
||||
core.setmethod("info", info)
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
-- Export module
|
||||
--
|
||||
|
||||
local _M = {
|
||||
_VERSION = "1.3.2",
|
||||
_COPYRIGHT = core.copyright(),
|
||||
config = config,
|
||||
loadcertificate = x509.load,
|
||||
newcontext = newcontext,
|
||||
wrap = wrap,
|
||||
}
|
||||
|
||||
return _M
|
||||
750
thirdparty/luasec/src/x509.c
vendored
Normal file
750
thirdparty/luasec/src/x509.c
vendored
Normal file
|
|
@ -0,0 +1,750 @@
|
|||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2014-2023 Kim Alvefur, Paul Aurich, Tobias Markmann, Matthew Wild
|
||||
* Copyright (C) 2014-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
#if defined(WIN32)
|
||||
#include <ws2tcpip.h>
|
||||
#include <windows.h>
|
||||
#else
|
||||
#include <sys/types.h>
|
||||
#include <sys/socket.h>
|
||||
#include <netinet/in.h>
|
||||
#include <arpa/inet.h>
|
||||
#endif
|
||||
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/x509v3.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/asn1.h>
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/bn.h>
|
||||
|
||||
#include <lua.h>
|
||||
#include <lauxlib.h>
|
||||
|
||||
#include "x509.h"
|
||||
|
||||
|
||||
#ifndef LSEC_API_OPENSSL_1_1_0
|
||||
#define X509_get0_notBefore X509_get_notBefore
|
||||
#define X509_get0_notAfter X509_get_notAfter
|
||||
#define ASN1_STRING_get0_data ASN1_STRING_data
|
||||
#endif
|
||||
|
||||
static const char* hex_tab = "0123456789abcdef";
|
||||
|
||||
/**
|
||||
* Push the certificate on the stack.
|
||||
*/
|
||||
void lsec_pushx509(lua_State* L, X509 *cert)
|
||||
{
|
||||
p_x509 cert_obj = (p_x509)lua_newuserdata(L, sizeof(t_x509));
|
||||
cert_obj->cert = cert;
|
||||
cert_obj->encode = LSEC_AI5_STRING;
|
||||
luaL_getmetatable(L, "SSL:Certificate");
|
||||
lua_setmetatable(L, -2);
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the OpenSSL certificate X509.
|
||||
*/
|
||||
X509* lsec_checkx509(lua_State* L, int idx)
|
||||
{
|
||||
return ((p_x509)luaL_checkudata(L, idx, "SSL:Certificate"))->cert;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return LuaSec certificate X509 representation.
|
||||
*/
|
||||
p_x509 lsec_checkp_x509(lua_State* L, int idx)
|
||||
{
|
||||
return (p_x509)luaL_checkudata(L, idx, "SSL:Certificate");
|
||||
}
|
||||
|
||||
/*---------------------------------------------------------------------------*/
|
||||
|
||||
#if defined(LUASEC_INET_NTOP)
|
||||
/*
|
||||
* For WinXP (SP3), set the following preprocessor macros:
|
||||
* LUASEC_INET_NTOP
|
||||
* WINVER=0x0501
|
||||
* _WIN32_WINNT=0x0501
|
||||
* NTDDI_VERSION=0x05010300
|
||||
*
|
||||
* For IPv6 addresses, you need to add IPv6 Protocol to your interface.
|
||||
*
|
||||
*/
|
||||
static const char *inet_ntop(int af, const char *src, char *dst, socklen_t size)
|
||||
{
|
||||
int addrsize;
|
||||
struct sockaddr *addr;
|
||||
struct sockaddr_in addr4;
|
||||
struct sockaddr_in6 addr6;
|
||||
|
||||
switch (af) {
|
||||
case AF_INET:
|
||||
memset((void*)&addr4, 0, sizeof(addr4));
|
||||
addr4.sin_family = AF_INET;
|
||||
memcpy((void*)&addr4.sin_addr, src, sizeof(struct in_addr));
|
||||
addr = (struct sockaddr*)&addr4;
|
||||
addrsize = sizeof(struct sockaddr_in);
|
||||
break;
|
||||
case AF_INET6:
|
||||
memset((void*)&addr6, 0, sizeof(addr6));
|
||||
addr6.sin6_family = AF_INET6;
|
||||
memcpy((void*)&addr6.sin6_addr, src, sizeof(struct in6_addr));
|
||||
addr = (struct sockaddr*)&addr6;
|
||||
addrsize = sizeof(struct sockaddr_in6);
|
||||
break;
|
||||
default:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if(getnameinfo(addr, addrsize, dst, size, NULL, 0, NI_NUMERICHOST) != 0)
|
||||
return NULL;
|
||||
return dst;
|
||||
}
|
||||
#endif
|
||||
|
||||
/*---------------------------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* Convert the buffer 'in' to hexadecimal.
|
||||
*/
|
||||
static void to_hex(const char* in, int length, char* out)
|
||||
{
|
||||
int i;
|
||||
for (i = 0; i < length; i++) {
|
||||
out[i*2] = hex_tab[(in[i] >> 4) & 0xF];
|
||||
out[i*2+1] = hex_tab[(in[i]) & 0xF];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts the ASN1_OBJECT into a textual representation and put it
|
||||
* on the Lua stack.
|
||||
*/
|
||||
static void push_asn1_objname(lua_State* L, ASN1_OBJECT *object, int no_name)
|
||||
{
|
||||
char buffer[256];
|
||||
int len = OBJ_obj2txt(buffer, sizeof(buffer), object, no_name);
|
||||
len = (len < sizeof(buffer)) ? len : sizeof(buffer);
|
||||
lua_pushlstring(L, buffer, len);
|
||||
}
|
||||
|
||||
/**
|
||||
* Push the ASN1 string on the stack.
|
||||
*/
|
||||
static void push_asn1_string(lua_State* L, ASN1_STRING *string, int encode)
|
||||
{
|
||||
int len;
|
||||
unsigned char *data;
|
||||
if (!string) {
|
||||
lua_pushnil(L);
|
||||
return;
|
||||
}
|
||||
switch (encode) {
|
||||
case LSEC_AI5_STRING:
|
||||
lua_pushlstring(L, (char*)ASN1_STRING_get0_data(string), ASN1_STRING_length(string));
|
||||
break;
|
||||
case LSEC_UTF8_STRING:
|
||||
len = ASN1_STRING_to_UTF8(&data, string);
|
||||
if (len >= 0) {
|
||||
lua_pushlstring(L, (char*)data, len);
|
||||
OPENSSL_free(data);
|
||||
}
|
||||
else
|
||||
lua_pushnil(L);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a human readable time.
|
||||
*/
|
||||
static int push_asn1_time(lua_State *L, const ASN1_UTCTIME *tm)
|
||||
{
|
||||
char *tmp;
|
||||
long size;
|
||||
BIO *out = BIO_new(BIO_s_mem());
|
||||
ASN1_TIME_print(out, tm);
|
||||
size = BIO_get_mem_data(out, &tmp);
|
||||
lua_pushlstring(L, tmp, size);
|
||||
BIO_free(out);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a human readable IP address.
|
||||
*/
|
||||
static void push_asn1_ip(lua_State *L, ASN1_STRING *string)
|
||||
{
|
||||
int af;
|
||||
char dst[INET6_ADDRSTRLEN];
|
||||
unsigned char *ip = (unsigned char*)ASN1_STRING_get0_data(string);
|
||||
switch(ASN1_STRING_length(string)) {
|
||||
case 4:
|
||||
af = AF_INET;
|
||||
break;
|
||||
case 16:
|
||||
af = AF_INET6;
|
||||
break;
|
||||
default:
|
||||
lua_pushnil(L);
|
||||
return;
|
||||
}
|
||||
if(inet_ntop(af, ip, dst, INET6_ADDRSTRLEN))
|
||||
lua_pushstring(L, dst);
|
||||
else
|
||||
lua_pushnil(L);
|
||||
}
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
static int push_subtable(lua_State* L, int idx)
|
||||
{
|
||||
lua_pushvalue(L, -1);
|
||||
lua_gettable(L, idx-1);
|
||||
if (lua_isnil(L, -1)) {
|
||||
lua_pop(L, 1);
|
||||
lua_newtable(L);
|
||||
lua_pushvalue(L, -2);
|
||||
lua_pushvalue(L, -2);
|
||||
lua_settable(L, idx-3);
|
||||
lua_replace(L, -2); /* Replace key with table */
|
||||
return 1;
|
||||
}
|
||||
lua_replace(L, -2); /* Replace key with table */
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve the general names from the object.
|
||||
*/
|
||||
static int push_x509_name(lua_State* L, X509_NAME *name, int encode)
|
||||
{
|
||||
int i;
|
||||
int n_entries;
|
||||
ASN1_OBJECT *object;
|
||||
X509_NAME_ENTRY *entry;
|
||||
lua_newtable(L);
|
||||
n_entries = X509_NAME_entry_count(name);
|
||||
for (i = 0; i < n_entries; i++) {
|
||||
entry = X509_NAME_get_entry(name, i);
|
||||
object = X509_NAME_ENTRY_get_object(entry);
|
||||
lua_newtable(L);
|
||||
push_asn1_objname(L, object, 1);
|
||||
lua_setfield(L, -2, "oid");
|
||||
push_asn1_objname(L, object, 0);
|
||||
lua_setfield(L, -2, "name");
|
||||
push_asn1_string(L, X509_NAME_ENTRY_get_data(entry), encode);
|
||||
lua_setfield(L, -2, "value");
|
||||
lua_rawseti(L, -2, i+1);
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*---------------------------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* Retrieve the Subject from the certificate.
|
||||
*/
|
||||
static int meth_subject(lua_State* L)
|
||||
{
|
||||
p_x509 px = lsec_checkp_x509(L, 1);
|
||||
return push_x509_name(L, X509_get_subject_name(px->cert), px->encode);
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve the Issuer from the certificate.
|
||||
*/
|
||||
static int meth_issuer(lua_State* L)
|
||||
{
|
||||
p_x509 px = lsec_checkp_x509(L, 1);
|
||||
return push_x509_name(L, X509_get_issuer_name(px->cert), px->encode);
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve the extensions from the certificate.
|
||||
*/
|
||||
int meth_extensions(lua_State* L)
|
||||
{
|
||||
int j;
|
||||
int i = -1;
|
||||
int n_general_names;
|
||||
OTHERNAME *otherName;
|
||||
X509_EXTENSION *extension;
|
||||
GENERAL_NAME *general_name;
|
||||
STACK_OF(GENERAL_NAME) *values;
|
||||
p_x509 px = lsec_checkp_x509(L, 1);
|
||||
X509 *peer = px->cert;
|
||||
|
||||
/* Return (ret) */
|
||||
lua_newtable(L);
|
||||
|
||||
while ((i = X509_get_ext_by_NID(peer, NID_subject_alt_name, i)) != -1) {
|
||||
extension = X509_get_ext(peer, i);
|
||||
if (extension == NULL)
|
||||
break;
|
||||
values = X509V3_EXT_d2i(extension);
|
||||
if (values == NULL)
|
||||
break;
|
||||
|
||||
/* Push ret[oid] */
|
||||
push_asn1_objname(L, X509_EXTENSION_get_object(extension), 1);
|
||||
push_subtable(L, -2);
|
||||
|
||||
/* Set ret[oid].name = name */
|
||||
push_asn1_objname(L, X509_EXTENSION_get_object(extension), 0);
|
||||
lua_setfield(L, -2, "name");
|
||||
|
||||
n_general_names = sk_GENERAL_NAME_num(values);
|
||||
for (j = 0; j < n_general_names; j++) {
|
||||
general_name = sk_GENERAL_NAME_value(values, j);
|
||||
switch (general_name->type) {
|
||||
case GEN_OTHERNAME:
|
||||
otherName = general_name->d.otherName;
|
||||
push_asn1_objname(L, otherName->type_id, 1);
|
||||
if (push_subtable(L, -2)) {
|
||||
push_asn1_objname(L, otherName->type_id, 0);
|
||||
lua_setfield(L, -2, "name");
|
||||
}
|
||||
push_asn1_string(L, otherName->value->value.asn1_string, px->encode);
|
||||
lua_rawseti(L, -2, lua_rawlen(L, -2) + 1);
|
||||
lua_pop(L, 1);
|
||||
break;
|
||||
case GEN_DNS:
|
||||
lua_pushstring(L, "dNSName");
|
||||
push_subtable(L, -2);
|
||||
push_asn1_string(L, general_name->d.dNSName, px->encode);
|
||||
lua_rawseti(L, -2, lua_rawlen(L, -2) + 1);
|
||||
lua_pop(L, 1);
|
||||
break;
|
||||
case GEN_EMAIL:
|
||||
lua_pushstring(L, "rfc822Name");
|
||||
push_subtable(L, -2);
|
||||
push_asn1_string(L, general_name->d.rfc822Name, px->encode);
|
||||
lua_rawseti(L, -2, lua_rawlen(L, -2) + 1);
|
||||
lua_pop(L, 1);
|
||||
break;
|
||||
case GEN_URI:
|
||||
lua_pushstring(L, "uniformResourceIdentifier");
|
||||
push_subtable(L, -2);
|
||||
push_asn1_string(L, general_name->d.uniformResourceIdentifier, px->encode);
|
||||
lua_rawseti(L, -2, lua_rawlen(L, -2)+1);
|
||||
lua_pop(L, 1);
|
||||
break;
|
||||
case GEN_IPADD:
|
||||
lua_pushstring(L, "iPAddress");
|
||||
push_subtable(L, -2);
|
||||
push_asn1_ip(L, general_name->d.iPAddress);
|
||||
lua_rawseti(L, -2, lua_rawlen(L, -2)+1);
|
||||
lua_pop(L, 1);
|
||||
break;
|
||||
case GEN_X400:
|
||||
/* x400Address */
|
||||
/* not supported */
|
||||
break;
|
||||
case GEN_DIRNAME:
|
||||
/* directoryName */
|
||||
/* not supported */
|
||||
break;
|
||||
case GEN_EDIPARTY:
|
||||
/* ediPartyName */
|
||||
/* not supported */
|
||||
break;
|
||||
case GEN_RID:
|
||||
/* registeredID */
|
||||
/* not supported */
|
||||
break;
|
||||
}
|
||||
GENERAL_NAME_free(general_name);
|
||||
}
|
||||
sk_GENERAL_NAME_free(values);
|
||||
lua_pop(L, 1); /* ret[oid] */
|
||||
i++; /* Next extension */
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert the certificate to PEM format.
|
||||
*/
|
||||
static int meth_pem(lua_State* L)
|
||||
{
|
||||
char* data;
|
||||
long bytes;
|
||||
X509* cert = lsec_checkx509(L, 1);
|
||||
BIO *bio = BIO_new(BIO_s_mem());
|
||||
if (!PEM_write_bio_X509(bio, cert)) {
|
||||
lua_pushnil(L);
|
||||
return 1;
|
||||
}
|
||||
bytes = BIO_get_mem_data(bio, &data);
|
||||
if (bytes > 0)
|
||||
lua_pushlstring(L, data, bytes);
|
||||
else
|
||||
lua_pushnil(L);
|
||||
BIO_free(bio);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract public key in PEM format.
|
||||
*/
|
||||
static int meth_pubkey(lua_State* L)
|
||||
{
|
||||
char* data;
|
||||
long bytes;
|
||||
int ret = 1;
|
||||
X509* cert = lsec_checkx509(L, 1);
|
||||
BIO *bio = BIO_new(BIO_s_mem());
|
||||
EVP_PKEY *pkey = X509_get_pubkey(cert);
|
||||
if(PEM_write_bio_PUBKEY(bio, pkey)) {
|
||||
bytes = BIO_get_mem_data(bio, &data);
|
||||
if (bytes > 0) {
|
||||
lua_pushlstring(L, data, bytes);
|
||||
switch(EVP_PKEY_base_id(pkey)) {
|
||||
case EVP_PKEY_RSA:
|
||||
lua_pushstring(L, "RSA");
|
||||
break;
|
||||
case EVP_PKEY_DSA:
|
||||
lua_pushstring(L, "DSA");
|
||||
break;
|
||||
case EVP_PKEY_DH:
|
||||
lua_pushstring(L, "DH");
|
||||
break;
|
||||
case EVP_PKEY_EC:
|
||||
lua_pushstring(L, "EC");
|
||||
break;
|
||||
default:
|
||||
lua_pushstring(L, "Unknown");
|
||||
break;
|
||||
}
|
||||
lua_pushinteger(L, EVP_PKEY_bits(pkey));
|
||||
ret = 3;
|
||||
}
|
||||
else
|
||||
lua_pushnil(L);
|
||||
}
|
||||
else
|
||||
lua_pushnil(L);
|
||||
/* Cleanup */
|
||||
BIO_free(bio);
|
||||
EVP_PKEY_free(pkey);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/**
|
||||
* Compute the fingerprint.
|
||||
*/
|
||||
static int meth_digest(lua_State* L)
|
||||
{
|
||||
unsigned int bytes;
|
||||
const EVP_MD *digest = NULL;
|
||||
unsigned char buffer[EVP_MAX_MD_SIZE];
|
||||
char hex_buffer[EVP_MAX_MD_SIZE*2];
|
||||
X509 *cert = lsec_checkx509(L, 1);
|
||||
const char *str = luaL_optstring(L, 2, NULL);
|
||||
if (!str)
|
||||
digest = EVP_sha1();
|
||||
else {
|
||||
if (!strcmp(str, "sha1"))
|
||||
digest = EVP_sha1();
|
||||
else if (!strcmp(str, "sha256"))
|
||||
digest = EVP_sha256();
|
||||
else if (!strcmp(str, "sha512"))
|
||||
digest = EVP_sha512();
|
||||
}
|
||||
if (!digest) {
|
||||
lua_pushnil(L);
|
||||
lua_pushfstring(L, "digest algorithm not supported (%s)", str);
|
||||
return 2;
|
||||
}
|
||||
if (!X509_digest(cert, digest, buffer, &bytes)) {
|
||||
lua_pushnil(L);
|
||||
lua_pushfstring(L, "error processing the certificate (%s)",
|
||||
ERR_reason_error_string(ERR_get_error()));
|
||||
return 2;
|
||||
}
|
||||
to_hex((char*)buffer, bytes, hex_buffer);
|
||||
lua_pushlstring(L, hex_buffer, bytes*2);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the certificate is valid in a given time.
|
||||
*/
|
||||
static int meth_valid_at(lua_State* L)
|
||||
{
|
||||
int nb, na;
|
||||
X509* cert = lsec_checkx509(L, 1);
|
||||
time_t time = luaL_checkinteger(L, 2);
|
||||
nb = X509_cmp_time(X509_get0_notBefore(cert), &time);
|
||||
time -= 1;
|
||||
na = X509_cmp_time(X509_get0_notAfter(cert), &time);
|
||||
lua_pushboolean(L, nb == -1 && na == 1);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the serial number.
|
||||
*/
|
||||
static int meth_serial(lua_State *L)
|
||||
{
|
||||
char *tmp;
|
||||
BIGNUM *bn;
|
||||
ASN1_INTEGER *serial;
|
||||
X509* cert = lsec_checkx509(L, 1);
|
||||
serial = X509_get_serialNumber(cert);
|
||||
bn = ASN1_INTEGER_to_BN(serial, NULL);
|
||||
tmp = BN_bn2hex(bn);
|
||||
lua_pushstring(L, tmp);
|
||||
BN_free(bn);
|
||||
OPENSSL_free(tmp);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return not before date.
|
||||
*/
|
||||
static int meth_notbefore(lua_State *L)
|
||||
{
|
||||
X509* cert = lsec_checkx509(L, 1);
|
||||
return push_asn1_time(L, X509_get0_notBefore(cert));
|
||||
}
|
||||
|
||||
/**
|
||||
* Return not after date.
|
||||
*/
|
||||
static int meth_notafter(lua_State *L)
|
||||
{
|
||||
X509* cert = lsec_checkx509(L, 1);
|
||||
return push_asn1_time(L, X509_get0_notAfter(cert));
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if this certificate issued some other certificate
|
||||
*/
|
||||
static int meth_issued(lua_State* L)
|
||||
{
|
||||
int ret, i, len;
|
||||
|
||||
X509_STORE_CTX* ctx = NULL;
|
||||
X509_STORE* root = NULL;
|
||||
STACK_OF(X509)* chain = NULL;
|
||||
|
||||
X509* issuer = lsec_checkx509(L, 1);
|
||||
X509* subject = lsec_checkx509(L, 2);
|
||||
X509* cert = NULL;
|
||||
|
||||
len = lua_gettop(L);
|
||||
|
||||
/* Check that all arguments are certificates */
|
||||
|
||||
for (i = 3; i <= len; i++) {
|
||||
lsec_checkx509(L, i);
|
||||
}
|
||||
|
||||
/* Before allocating things that require freeing afterwards */
|
||||
|
||||
chain = sk_X509_new_null();
|
||||
ctx = X509_STORE_CTX_new();
|
||||
root = X509_STORE_new();
|
||||
|
||||
if (ctx == NULL || root == NULL) {
|
||||
lua_pushnil(L);
|
||||
lua_pushstring(L, "X509_STORE_new() or X509_STORE_CTX_new() error");
|
||||
ret = 2;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
ret = X509_STORE_add_cert(root, issuer);
|
||||
|
||||
if(!ret) {
|
||||
lua_pushnil(L);
|
||||
lua_pushstring(L, "X509_STORE_add_cert() error");
|
||||
ret = 2;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
for (i = 3; i <= len && lua_isuserdata(L, i); i++) {
|
||||
cert = lsec_checkx509(L, i);
|
||||
sk_X509_push(chain, cert);
|
||||
}
|
||||
|
||||
ret = X509_STORE_CTX_init(ctx, root, subject, chain);
|
||||
|
||||
if(!ret) {
|
||||
lua_pushnil(L);
|
||||
lua_pushstring(L, "X509_STORE_CTX_init() error");
|
||||
ret = 2;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
/* Actual verification */
|
||||
if (X509_verify_cert(ctx) <= 0) {
|
||||
ret = X509_STORE_CTX_get_error(ctx);
|
||||
lua_pushnil(L);
|
||||
lua_pushstring(L, X509_verify_cert_error_string(ret));
|
||||
ret = 2;
|
||||
} else {
|
||||
lua_pushboolean(L, 1);
|
||||
ret = 1;
|
||||
}
|
||||
|
||||
cleanup:
|
||||
|
||||
if (ctx != NULL) {
|
||||
X509_STORE_CTX_free(ctx);
|
||||
}
|
||||
|
||||
if (chain != NULL) {
|
||||
X509_STORE_free(root);
|
||||
}
|
||||
|
||||
sk_X509_free(chain);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/**
|
||||
* Collect X509 objects.
|
||||
*/
|
||||
static int meth_destroy(lua_State* L)
|
||||
{
|
||||
p_x509 px = lsec_checkp_x509(L, 1);
|
||||
if (px->cert) {
|
||||
X509_free(px->cert);
|
||||
px->cert = NULL;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int meth_tostring(lua_State *L)
|
||||
{
|
||||
X509* cert = lsec_checkx509(L, 1);
|
||||
lua_pushfstring(L, "X509 certificate: %p", cert);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the encode for ASN.1 string.
|
||||
*/
|
||||
static int meth_set_encode(lua_State* L)
|
||||
{
|
||||
int succ = 0;
|
||||
p_x509 px = lsec_checkp_x509(L, 1);
|
||||
const char *enc = luaL_checkstring(L, 2);
|
||||
if (strncmp(enc, "ai5", 3) == 0) {
|
||||
succ = 1;
|
||||
px->encode = LSEC_AI5_STRING;
|
||||
} else if (strncmp(enc, "utf8", 4) == 0) {
|
||||
succ = 1;
|
||||
px->encode = LSEC_UTF8_STRING;
|
||||
}
|
||||
lua_pushboolean(L, succ);
|
||||
return 1;
|
||||
}
|
||||
|
||||
#if (OPENSSL_VERSION_NUMBER >= 0x1010000fL)
|
||||
/**
|
||||
* Get signature name.
|
||||
*/
|
||||
static int meth_get_signature_name(lua_State* L)
|
||||
{
|
||||
p_x509 px = lsec_checkp_x509(L, 1);
|
||||
int nid = X509_get_signature_nid(px->cert);
|
||||
const char *name = OBJ_nid2sn(nid);
|
||||
if (!name)
|
||||
lua_pushnil(L);
|
||||
else
|
||||
lua_pushstring(L, name);
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
|
||||
/*---------------------------------------------------------------------------*/
|
||||
|
||||
static int load_cert(lua_State* L)
|
||||
{
|
||||
X509 *cert;
|
||||
size_t bytes;
|
||||
const char* data;
|
||||
BIO *bio = BIO_new(BIO_s_mem());
|
||||
data = luaL_checklstring(L, 1, &bytes);
|
||||
BIO_write(bio, data, bytes);
|
||||
cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
|
||||
if (cert)
|
||||
lsec_pushx509(L, cert);
|
||||
else
|
||||
lua_pushnil(L);
|
||||
BIO_free(bio);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*---------------------------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* Certificate methods.
|
||||
*/
|
||||
static luaL_Reg methods[] = {
|
||||
{"digest", meth_digest},
|
||||
{"setencode", meth_set_encode},
|
||||
{"extensions", meth_extensions},
|
||||
#if (OPENSSL_VERSION_NUMBER >= 0x1010000fL)
|
||||
{"getsignaturename", meth_get_signature_name},
|
||||
#endif
|
||||
{"issuer", meth_issuer},
|
||||
{"notbefore", meth_notbefore},
|
||||
{"notafter", meth_notafter},
|
||||
{"issued", meth_issued},
|
||||
{"pem", meth_pem},
|
||||
{"pubkey", meth_pubkey},
|
||||
{"serial", meth_serial},
|
||||
{"subject", meth_subject},
|
||||
{"validat", meth_valid_at},
|
||||
{NULL, NULL}
|
||||
};
|
||||
|
||||
/**
|
||||
* X509 metamethods.
|
||||
*/
|
||||
static luaL_Reg meta[] = {
|
||||
{"__close", meth_destroy},
|
||||
{"__gc", meth_destroy},
|
||||
{"__tostring", meth_tostring},
|
||||
{NULL, NULL}
|
||||
};
|
||||
|
||||
/**
|
||||
* X509 functions.
|
||||
*/
|
||||
static luaL_Reg funcs[] = {
|
||||
{"load", load_cert},
|
||||
{NULL, NULL}
|
||||
};
|
||||
|
||||
/*--------------------------------------------------------------------------*/
|
||||
|
||||
LSEC_API int luaopen_ssl_x509(lua_State *L)
|
||||
{
|
||||
/* Register the functions and tables */
|
||||
luaL_newmetatable(L, "SSL:Certificate");
|
||||
setfuncs(L, meta);
|
||||
|
||||
luaL_newlib(L, methods);
|
||||
lua_setfield(L, -2, "__index");
|
||||
|
||||
luaL_newlib(L, funcs);
|
||||
|
||||
return 1;
|
||||
}
|
||||
31
thirdparty/luasec/src/x509.h
vendored
Normal file
31
thirdparty/luasec/src/x509.h
vendored
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
/*--------------------------------------------------------------------------
|
||||
* LuaSec 1.3.2
|
||||
*
|
||||
* Copyright (C) 2014-2023 Kim Alvefur, Paul Aurich, Tobias Markmann, Matthew Wild
|
||||
* Copyright (C) 2013-2023 Bruno Silvestre
|
||||
*
|
||||
*--------------------------------------------------------------------------*/
|
||||
|
||||
#ifndef LSEC_X509_H
|
||||
#define LSEC_X509_H
|
||||
|
||||
#include <openssl/x509v3.h>
|
||||
#include <lua.h>
|
||||
|
||||
#include "compat.h"
|
||||
|
||||
/* We do not support UniversalString nor BMPString as ASN.1 String types */
|
||||
enum { LSEC_AI5_STRING, LSEC_UTF8_STRING };
|
||||
|
||||
typedef struct t_x509_ {
|
||||
X509 *cert;
|
||||
int encode;
|
||||
} t_x509;
|
||||
typedef t_x509* p_x509;
|
||||
|
||||
void lsec_pushx509(lua_State* L, X509* cert);
|
||||
X509* lsec_checkx509(lua_State* L, int idx);
|
||||
|
||||
LSEC_API int luaopen_ssl_x509(lua_State *L);
|
||||
|
||||
#endif
|
||||
11
thirdparty/openssl/.ctags.d/add-dir.ctags
vendored
Normal file
11
thirdparty/openssl/.ctags.d/add-dir.ctags
vendored
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
#
|
||||
# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
#
|
||||
|
||||
# Allow ctags to load configuration file under the sub directories.
|
||||
--optlib-dir=+./.ctags.d
|
||||
13
thirdparty/openssl/.ctags.d/exclude.ctags
vendored
Normal file
13
thirdparty/openssl/.ctags.d/exclude.ctags
vendored
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
#
|
||||
# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
#
|
||||
|
||||
# List file names or patterns you want ctags to ignore.
|
||||
--exclude=.ctags.d
|
||||
--exclude=test
|
||||
--exclude=check-format-test-positives.c
|
||||
18
thirdparty/openssl/.ctags.d/openssl-stage1/10extrac-macrodefs.ctags
vendored
Normal file
18
thirdparty/openssl/.ctags.d/openssl-stage1/10extrac-macrodefs.ctags
vendored
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
#
|
||||
# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
#
|
||||
|
||||
# This file is only for extracting macro definitions.
|
||||
--langmap=C:+.h
|
||||
-o -
|
||||
--sort=no
|
||||
--languages=C
|
||||
-R
|
||||
|
||||
--fields-C=+{macrodef}
|
||||
--fields=+{signature}
|
||||
1
thirdparty/openssl/.ctags.d/openssl-stage2/.gitignore
vendored
Normal file
1
thirdparty/openssl/.ctags.d/openssl-stage2/.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
*macro-definitons.ctags
|
||||
9
thirdparty/openssl/.ctags.d/openssl-stage2/10expand-macros.ctags
vendored
Normal file
9
thirdparty/openssl/.ctags.d/openssl-stage2/10expand-macros.ctags
vendored
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
#
|
||||
# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
#
|
||||
--param-CPreProcessor._expand=1
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Reference in a new issue