Software /
code /
prosody
Annotate
util/sslconfig.lua @ 11339:25260c20c5a4
doap: Move comment into <implements> it comments on
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Fri, 29 Jan 2021 23:14:48 +0100 |
parent | 10920:c171b4c59bd1 |
child | 12480:7e9ebdc75ce4 |
rev | line source |
---|---|
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
1 -- util to easily merge multiple sets of LuaSec context options |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
2 |
6777
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
6671
diff
changeset
|
3 local type = type; |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
6671
diff
changeset
|
4 local pairs = pairs; |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
6671
diff
changeset
|
5 local rawset = rawset; |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
6671
diff
changeset
|
6 local t_concat = table.concat; |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
6671
diff
changeset
|
7 local t_insert = table.insert; |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
6671
diff
changeset
|
8 local setmetatable = setmetatable; |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
6671
diff
changeset
|
9 |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
6671
diff
changeset
|
10 local _ENV = nil; |
8555
4f0f5b49bb03
vairious: Add annotation when an empty environment is set [luacheck]
Kim Alvefur <zash@zash.se>
parents:
8278
diff
changeset
|
11 -- luacheck: std none |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 local handlers = { }; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
14 local finalisers = { }; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 local id = function (v) return v end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
17 -- All "handlers" behave like extended rawset(table, key, value) with extra |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
18 -- processing usually merging the new value with the old in some reasonable |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
19 -- way |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
20 -- If a field does not have a defined handler then a new value simply |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
21 -- replaces the old. |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
22 |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
23 |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
24 -- Convert either a list or a set into a special type of set where each |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
25 -- item is either positive or negative in order for a later set of options |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
26 -- to be able to remove options from this set by filtering out the negative ones |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
27 function handlers.options(config, field, new) |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
28 local options = config[field] or { }; |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
29 if type(new) ~= "table" then new = { new } end |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
30 for key, value in pairs(new) do |
6671
2d5e2ed44c22
util.sslconfig: Rename variable to avoid name clash [luacheck]
Matthew Wild <mwild1@gmail.com>
parents:
6292
diff
changeset
|
31 if value == true or value == false then |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
32 options[key] = value; |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
33 else -- list item |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
34 options[value] = true; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
35 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 end |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
37 config[field] = options; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
38 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
39 |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
40 handlers.verifyext = handlers.options; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
41 |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
42 -- finalisers take something produced by handlers and return what luasec |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
43 -- expects it to be |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
44 |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
45 -- Produce a list of "positive" options from the set |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
46 function finalisers.options(options) |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
47 local output = {}; |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
48 for opt, enable in pairs(options) do |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
49 if enable then |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
50 output[#output+1] = opt; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
51 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
52 end |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
53 return output; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
54 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
55 |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
56 finalisers.verifyext = finalisers.options; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
57 |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
58 -- We allow ciphers to be a list |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
59 |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
60 function finalisers.ciphers(cipherlist) |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
61 if type(cipherlist) == "table" then |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
62 return t_concat(cipherlist, ":"); |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
63 end |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
64 return cipherlist; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
65 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
66 |
8278
a349299038ff
util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951)
Kim Alvefur <zash@zash.se>
parents:
7867
diff
changeset
|
67 -- Curve list too |
a349299038ff
util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951)
Kim Alvefur <zash@zash.se>
parents:
7867
diff
changeset
|
68 finalisers.curveslist = finalisers.ciphers; |
a349299038ff
util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951)
Kim Alvefur <zash@zash.se>
parents:
7867
diff
changeset
|
69 |
10920
c171b4c59bd1
util.sslconfig: Process TLS 1.3-specific cipher list
Kim Alvefur <zash@zash.se>
parents:
9584
diff
changeset
|
70 -- TLS 1.3 ciphers |
c171b4c59bd1
util.sslconfig: Process TLS 1.3-specific cipher list
Kim Alvefur <zash@zash.se>
parents:
9584
diff
changeset
|
71 finalisers.ciphersuites = finalisers.ciphers; |
c171b4c59bd1
util.sslconfig: Process TLS 1.3-specific cipher list
Kim Alvefur <zash@zash.se>
parents:
9584
diff
changeset
|
72 |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
73 -- protocol = "x" should enable only that protocol |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
74 -- protocol = "x+" should enable x and later versions |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
75 |
9584
2860f8dabf35
util.sslconfig: Recognise TLS 1.3 as a protocol version
Kim Alvefur <zash@zash.se>
parents:
8555
diff
changeset
|
76 local protocols = { "sslv2", "sslv3", "tlsv1", "tlsv1_1", "tlsv1_2", "tlsv1_3" }; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
77 for i = 1, #protocols do protocols[protocols[i] .. "+"] = i - 1; end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
78 |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
79 -- this interacts with ssl.options as well to add no_x |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
80 local function protocol(config) |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
81 local min_protocol = protocols[config.protocol]; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
82 if min_protocol then |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
83 config.protocol = "sslv23"; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
84 for i = 1, min_protocol do |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
85 t_insert(config.options, "no_"..protocols[i]); |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
86 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
87 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
88 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
89 |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
90 -- Merge options from 'new' config into 'config' |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
91 local function apply(config, new) |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
92 if type(new) == "table" then |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
93 for field, value in pairs(new) do |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
94 (handlers[field] or rawset)(config, field, value); |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
95 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
96 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
97 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
98 |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
99 -- Finalize the config into the form LuaSec expects |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
100 local function final(config) |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
101 local output = { }; |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
102 for field, value in pairs(config) do |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
103 output[field] = (finalisers[field] or id)(value); |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
104 end |
7004
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
105 -- Need to handle protocols last because it adds to the options list |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
106 protocol(output); |
ddb03cc4ce04
util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
107 return output; |
6292
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
108 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
109 |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
110 local sslopts_mt = { |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
111 __index = { |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
112 apply = apply; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
113 final = final; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
114 }; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
115 }; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
116 |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
117 local function new() |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
118 return setmetatable({options={}}, sslopts_mt); |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
119 end |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
120 |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
121 return { |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
122 apply = apply; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
123 final = final; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
124 new = new; |
751618071e89
util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
125 }; |