2 LuCI - Lua Development Framework
4 Copyright 2009 Steven Barth <steven@midlink.org>
6 Licensed under the Apache License, Version 2.0 (the "License");
7 you may not use this file except in compliance with the License.
8 You may obtain a copy of the License at
10 http://www.apache.org/licenses/LICENSE-2.0
15 local os = require "os"
16 local fs = require "nixio.fs"
17 local nixio = require "nixio"
18 local lucid = require "luci.lucid"
20 local ipairs, type, require, setmetatable = ipairs, type, require, setmetatable
21 local pairs, print, tostring, unpack = pairs, print, tostring, unpack
24 module "luci.lucid.tcpserver"
26 local cursor = lucid.cursor
27 local UCINAME = lucid.UCINAME
31 --- Prepare a daemon and allocate its resources. (superserver callback)
32 -- @param config configuration table
33 -- @param server LuCId basemodule
34 -- @return binary data
35 function prepare_daemon(config, server)
36 nixio.syslog("info", "Preparing TCP-Daemon " .. config[".name"])
37 if type(config.address) ~= "table" then
38 config.address = {config.address}
41 local sockets, socket, code, err = {}
42 local sopts = {reuseaddr = 1}
43 for _, addr in ipairs(config.address) do
44 local host, port = addr:match("(.-):?([^:]*)")
46 nixio.syslog("err", "Invalid address: " .. addr)
47 return nil, -5, "invalid address format"
48 elseif #host == 0 then
51 socket, code, err = prepare_socket(config.family, host, port, sopts)
53 sockets[#sockets+1] = socket
57 nixio.syslog("info", "Sockets bound for " .. config[".name"])
60 return nil, -6, "no sockets bound"
63 nixio.syslog("info", "Preparing publishers for " .. config[".name"])
66 for k, pname in ipairs(config.publisher) do
67 local pdata = cursor:get_all(UCINAME, pname)
69 publisher[#publisher+1] = pdata
71 nixio.syslog("err", "Publisher " .. pname .. " not found")
75 nixio.syslog("info", "Preparing TLS for " .. config[".name"])
77 local tls = prepare_tls(config.tls)
78 if not tls and config.encryption == "enable" then
79 for _, s in ipairs(sockets) do
82 return nil, -4, "Encryption requested, but no TLS context given"
85 nixio.syslog("info", "Invoking daemon factory for " .. config[".name"])
86 local handler, err = config.slave.module.factory(publisher, config)
88 for _, s in ipairs(sockets) do
93 local pollin = nixio.poll_flags("in")
94 for _, s in ipairs(sockets) do
95 server.register_pollfd({
102 publisher = publisher,
110 --- Accept a new TCP connection. (server callback)
111 -- @param polle Poll descriptor
112 -- @return handler process id or nil, error code, error message
113 function accept(polle)
114 if not lucid.try_process() then
117 local socket, host, port = polle.fd:accept()
119 return nixio.syslog("warn", "accept() failed: " .. port)
122 socket:setblocking(true)
124 local function thread()
125 lucid.close_pollfds()
126 local inst = setmetatable({
127 host = host, port = port, interfaces = lucid.get_interfaces()
128 }, {__index = polle})
129 if polle.config.encryption then
130 socket = polle.tls:create(socket)
131 if not socket:accept() then
133 return nixio.syslog("warning", "TLS handshake failed: " .. host)
137 return polle.accept(socket, inst)
140 local stat = {lucid.create_process(thread)}
145 --- Prepare a TCP server socket.
146 -- @param family protocol family ["inetany", "inet6", "inet"]
149 -- @param opts table of socket options
150 -- @param backlog socket backlog
151 -- @return socket, final socket family
152 function prepare_socket(family, host, port, opts, backlog)
153 nixio.syslog("info", "Preparing socket for port " .. port)
154 backlog = backlog or 1024
155 family = family or "inetany"
158 local inetany = family == "inetany"
159 family = inetany and "inet6" or family
161 local socket, code, err = nixio.socket(family, "stream")
162 if not socket and inetany then
164 socket, code, err = nixio.socket(family, "stream")
168 return nil, code, err
171 for k, v in pairs(opts) do
172 socket:setsockopt("socket", k, v)
175 local stat, code, err = socket:bind(host, port)
177 return nil, code, err
180 stat, code, err = socket:listen(backlog)
182 return nil, code, err
185 socket:setblocking(false)
187 return socket, family
190 --- Prepare a TLS server context and load keys and certificates.
191 -- May invoke px5g to create keys and certificate on demand if available.
192 -- @param tlskey TLS configuration identifier
193 -- @return TLS server conext or nil
194 function prepare_tls(tlskey)
196 if tlskey and cursor:get(UCINAME, tlskey) then
197 tls = nixio.tls("server")
199 local make = cursor:get(UCINAME, tlskey, "generate") == "1"
200 local key = cursor:get(UCINAME, tlskey, "key")
201 local xtype = make and "asn1" or cursor:get(UCINAME, tlskey, "type")
202 local cert = cursor:get(UCINAME, tlskey, "cert")
203 local ciphers = cursor:get(UCINAME, tlskey, "ciphers")
205 if make and (not fs.access(key) or not fs.access(cert)) then
206 local CN = cursor:get(UCINAME, tlskey, "CN")
207 local O = cursor:get(UCINAME, tlskey, "O")
211 CN = CN or nixio.uname().nodename,
212 O = not O and "LuCId Keymaster" or #O > 0 and O
215 local stat, px5g = pcall(require, "px5g")
217 return nixio.syslog("err", "Unable to load PX5G Keymaster")
220 nixio.syslog("warning", "PX5G: Generating private key")
221 local rk = px5g.genkey(bits)
222 local keyfile = nixio.open(key, "w", 600)
223 if not rk or not keyfile or not keyfile:writeall(rk:asn1()) then
224 return nixio.syslog("err", "Unable to generate private key")
228 nixio.syslog("warning", "PX5G: Generating self-signed certificate")
229 if not fs.writefile(cert, rk:create_selfsigned(data,
230 os.time(), os.time() + 3600 * 24 * 366 * 15)) then
231 return nixio.syslog("err", "Unable to generate certificate")
236 if not tls:set_cert(cert, xtype) then
237 nixio.syslog("err", "Unable to load certificate: " .. cert)
241 if not tls:set_key(key, xtype) then
242 nixio.syslog("err", "Unable to load private key: " .. key)
247 if type(ciphers) == "table" then
248 ciphers = table.concat(ciphers, ":")
250 tls:set_ciphers(ciphers)