From 20d2e99010f067cd45a7bcfa93fe10862882b3a8 Mon Sep 17 00:00:00 2001 From: Steven Barth Date: Thu, 28 May 2009 13:50:00 +0000 Subject: [PATCH] nixio: Rework TLS support, added support for CyaSSL --- contrib/package/cyassl/Makefile | 58 +++++++++++++++++++++++++++++++++++++++++ contrib/package/luci/Makefile | 7 +++++ libs/nixio/Makefile | 7 +++++ libs/nixio/docsrc/nixio.lua | 1 + libs/nixio/src/cyassl-compat.c | 31 ++++++++++++++++++++++ libs/nixio/src/cyassl-compat.h | 32 +++++++++++++++++++++++ libs/nixio/src/tls-context.c | 43 ++++++++++-------------------- libs/nixio/src/tls-crypto.c | 1 + 8 files changed, 151 insertions(+), 29 deletions(-) create mode 100644 contrib/package/cyassl/Makefile create mode 100644 libs/nixio/src/cyassl-compat.c create mode 100644 libs/nixio/src/cyassl-compat.h diff --git a/contrib/package/cyassl/Makefile b/contrib/package/cyassl/Makefile new file mode 100644 index 000000000..416e93366 --- /dev/null +++ b/contrib/package/cyassl/Makefile @@ -0,0 +1,58 @@ +# +# Copyright (C) 2008 OpenWrt.org +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_BASENAME:=cyassl +PKG_NAME:=$(PKG_BASENAME)-luci +PKG_VERSION:=1.0.3 +PKG_RELEASE:=1 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).zip +PKG_SOURCE_URL:=http://www.yassl.com/ +PKG_MD5SUM:=e9e85a2d78cd535a049e4acce786e42d +PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)/$(PKG_BASENAME)-$(PKG_VERSION) +PKG_UNPACK=unzip -d $(BUILD_DIR)/$(PKG_NAME) $(DL_DIR)/$(PKG_SOURCE) + +include $(INCLUDE_DIR)/package.mk + +define Package/cyassl-luci/Default + TITLE:=CyaSSL (LuCI embedded flavor) + URL:=http://www.yassl.com/ +endef + +define Package/libcyassl-luci + $(call Package/cyassl-luci/Default) + SECTION:=libs + SUBMENU:=SSL + CATEGORY:=Libraries + TITLE+= (library) +endef + +define Package/libcyassl-luci/description + CyaSSL is an SSL library optimized for small footprint, both on disk and for memory use. +endef + +TARGET_CFLAGS += $(FPIC) + +CONFIGURE_ARGS += --without-zlib --enable-fastmath + +define Build/InstallDev + $(INSTALL_DIR) $(1)/usr/include/ctaocrypt + $(CP) $(PKG_BUILD_DIR)/ctaocrypt/include/*.h $(1)/usr/include/ctaocrypt + + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_BUILD_DIR)/src/.libs/libcyassl.{a,so*} $(1)/usr/lib/ + $(CP) $(PKG_BUILD_DIR)/src/libcyassl.la $(1)/usr/lib/ +endef + +define Package/libcyassl-luci/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_BUILD_DIR)/src/.libs/libcyassl.so* $(1)/usr/lib/ +endef + +$(eval $(call BuildPackage,libcyassl-luci)) diff --git a/contrib/package/luci/Makefile b/contrib/package/luci/Makefile index 2e7e7a567..4fced4637 100644 --- a/contrib/package/luci/Makefile +++ b/contrib/package/luci/Makefile @@ -266,6 +266,10 @@ define Package/luci-nixio/config select PACKAGE_dropbear select PACKAGE_dropbearconvert + config PACKAGE_luci-nixio_cyassl + bool "CyaSSL" + select PACKAGE_libcyassl-luci + config PACKAGE_luci-nixio_openssl bool "OpenSSL" select PACKAGE_libopenssl @@ -276,6 +280,9 @@ ifneq ($(CONFIG_PACKAGE_luci-nixio_openssl),) NIXIO_TLS:=openssl endif +ifneq ($(CONFIG_PACKAGE_luci-nixio_cyassl),) + NIXIO_TLS:=cyassl +endif define Package/luci-sys $(call Package/luci/libtemplate) diff --git a/libs/nixio/Makefile b/libs/nixio/Makefile index 8e87eaa10..500b6c4f1 100644 --- a/libs/nixio/Makefile +++ b/libs/nixio/Makefile @@ -28,6 +28,13 @@ ifeq ($(NIXIO_TLS),openssl) NIXIO_LDFLAGS += -lssl endif +ifeq ($(NIXIO_TLS),cyassl) + NIXIO_LDFLAGS += -lcyassl + TLS_DEPENDS = src/cyassl-compat.o + TLS_CFLAGS = -include src/cyassl-compat.h + NIXIO_OBJ += src/cyassl-compat.o +endif + ifeq ($(OS),SunOS) NIXIO_LDFLAGS += -lsocket -lnsl -lsendfile diff --git a/libs/nixio/docsrc/nixio.lua b/libs/nixio/docsrc/nixio.lua index 2d0056f17..90331cf23 100644 --- a/libs/nixio/docsrc/nixio.lua +++ b/libs/nixio/docsrc/nixio.lua @@ -430,4 +430,5 @@ module "nixio" --- Create a new TLS context. -- @class function -- @name nixio.tls +-- @param mode TLS-Mode ["client", "server"] -- @return TLSContext Object \ No newline at end of file diff --git a/libs/nixio/src/cyassl-compat.c b/libs/nixio/src/cyassl-compat.c new file mode 100644 index 000000000..a483119ac --- /dev/null +++ b/libs/nixio/src/cyassl-compat.c @@ -0,0 +1,31 @@ +#include "cyassl-compat.h" + +int MD5_Init(MD5_CTX *md5) { + InitMd5(md5); + return 1; +} + +int MD5_Update(MD5_CTX *md5, void *input, unsigned long sz) { + Md5Update(md5, input, (word32)sz); + return 1; +} + +int MD5_Final(void *input, MD5_CTX *md5) { + Md5Final(md5, input); + return 1; +} + +int SHA1_Init(SHA_CTX *sha) { + InitSha(sha); + return 1; +} + +int SHA1_Update(SHA_CTX *sha, void *input, unsigned long sz) { + ShaUpdate(sha, input, (word32)sz); + return 1; +} + +int SHA1_Final(void *input, SHA_CTX *sha) { + ShaFinal(sha, input); + return 1; +} diff --git a/libs/nixio/src/cyassl-compat.h b/libs/nixio/src/cyassl-compat.h new file mode 100644 index 000000000..b2cdc9233 --- /dev/null +++ b/libs/nixio/src/cyassl-compat.h @@ -0,0 +1,32 @@ +#define WITH_CYASSL +#define WITHOUT_OPENSSL +#include + +typedef unsigned int word32; + + +#define MD5_DIGEST_LENGTH 16 +typedef struct MD5_CTX { + int dummy[24]; +} MD5_CTX; + +void InitMd5(MD5_CTX*); +void Md5Update(MD5_CTX*, void*, word32); +void Md5Final(MD5_CTX*, void*); + + +#define SHA_DIGEST_LENGTH 20 +typedef struct SHA_CTX { + int dummy[24]; +} SHA_CTX; + +void InitSha(SHA_CTX*); +void ShaUpdate(SHA_CTX*, void*, word32); +void ShaFinal(SHA_CTX*, void*); + +int MD5_Init(MD5_CTX *md5); +int MD5_Update(MD5_CTX *md5, void *input, unsigned long sz); +int MD5_Final(void *input, MD5_CTX *md5); +int SHA1_Init(SHA_CTX *md5); +int SHA1_Update(SHA_CTX *sha, void *input, unsigned long sz); +int SHA1_Final(void *input, SHA_CTX *sha); diff --git a/libs/nixio/src/tls-context.c b/libs/nixio/src/tls-context.c index 59e06f449..fdbe22462 100644 --- a/libs/nixio/src/tls-context.c +++ b/libs/nixio/src/tls-context.c @@ -41,7 +41,7 @@ static int nixio__tls_pstatus(lua_State *L, int code) { } static int nixio_tls_ctx(lua_State * L) { - const char *method = luaL_optlstring(L, 1, "tlsv1", NULL); + const char *method = luaL_optlstring(L, 1, "client", NULL); luaL_getmetatable(L, NIXIO_TLS_CTX_META); SSL_CTX **ctx = lua_newuserdata(L, sizeof(SSL_CTX *)); @@ -52,27 +52,22 @@ static int nixio_tls_ctx(lua_State * L) { /* create userdata */ lua_pushvalue(L, -2); lua_setmetatable(L, -2); - lua_getfield(L, -1, "tls_defaultkey"); - if (!strcmp(method, "tlsv1")) { - *ctx = SSL_CTX_new(TLSv1_method()); - } else if (!strcmp(method, "sslv23")) { - *ctx = SSL_CTX_new(SSLv23_method()); + if (!strcmp(method, "client")) { + *ctx = SSL_CTX_new(TLSv1_client_method()); + } else if (!strcmp(method, "server")) { + *ctx = SSL_CTX_new(TLSv1_server_method()); } else { - return luaL_argerror(L, 1, "supported values: tlsv1, sslv23"); + return luaL_argerror(L, 1, "supported values: client, server"); } if (!(*ctx)) { return luaL_error(L, "unable to create TLS context"); } - const char *autoload = lua_tostring(L, -1); - if (autoload) { - SSL_CTX_use_PrivateKey_file(*ctx, autoload, SSL_FILETYPE_PEM); - } - lua_pop(L, 1); - - SSL_CTX_set_options(*ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); +#ifdef WITH_CYASSL + SSL_CTX_set_verify(*ctx, SSL_VERIFY_NONE, NULL); +#endif return 1; } @@ -136,13 +131,6 @@ static int nixio_tls_ctx_set_ciphers(lua_State *L) { return nixio__tls_pstatus(L, SSL_CTX_set_cipher_list(ctx, ciphers)); } -static int nixio_tls_ctx_set_verify_depth(lua_State *L) { - SSL_CTX *ctx = nixio__checktlsctx(L); - const int depth = luaL_checkinteger(L, 2); - SSL_CTX_set_verify_depth(ctx, depth); - return 0; -} - static int nixio_tls_ctx_set_verify(lua_State *L) { SSL_CTX *ctx = nixio__checktlsctx(L); const int j = lua_gettop(L); @@ -192,7 +180,6 @@ static const luaL_reg CTX_M[] = { {"set_cert", nixio_tls_ctx_set_cert}, {"set_key", nixio_tls_ctx_set_key}, {"set_ciphers", nixio_tls_ctx_set_ciphers}, - {"set_verify_depth", nixio_tls_ctx_set_verify_depth}, {"set_verify", nixio_tls_ctx_set_verify}, {"create", nixio_tls_ctx_create}, {"__gc", nixio_tls_ctx__gc}, @@ -209,10 +196,12 @@ void nixio_open_tls_context(lua_State *L) { /* register module functions */ luaL_register(L, NULL, R); -#ifndef WITH_AXTLS - lua_pushliteral(L, "openssl"); -#else +#if defined (WITH_AXTLS) lua_pushliteral(L, "axtls"); +#elif defined (WITH_CYASSL) + lua_pushliteral(L, "cyassl"); +#else + lua_pushliteral(L, "openssl"); #endif lua_setfield(L, -2, "tls_provider"); @@ -221,9 +210,5 @@ void nixio_open_tls_context(lua_State *L) { lua_pushvalue(L, -1); lua_setfield(L, -2, "__index"); luaL_register(L, NULL, CTX_M); -#ifdef WITH_AXTLS - lua_pushliteral(L, "/etc/axtls.key"); - lua_setfield(L, -2, "tls_defaultkey"); -#endif lua_setfield(L, -2, "meta_tls_context"); } diff --git a/libs/nixio/src/tls-crypto.c b/libs/nixio/src/tls-crypto.c index 62ade2265..714ec4e60 100644 --- a/libs/nixio/src/tls-crypto.c +++ b/libs/nixio/src/tls-crypto.c @@ -17,6 +17,7 @@ */ #include "nixio-tls.h" +#include #include #include #include -- 2.11.0