nixio: Rework TLS support, added support for CyaSSL

diff --git a/contrib/package/cyassl/Makefile b/contrib/package/cyassl/Makefile
new file mode 100644 (file)
index 0000000..416e933
--- /dev/null
+++ b/contrib/package/cyassl/Makefile
@@ -0,0 +1,58 @@
+# 
+# Copyright (C) 2008 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_BASENAME:=cyassl
+PKG_NAME:=$(PKG_BASENAME)-luci
+PKG_VERSION:=1.0.3
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).zip
+PKG_SOURCE_URL:=http://www.yassl.com/
+PKG_MD5SUM:=e9e85a2d78cd535a049e4acce786e42d
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)/$(PKG_BASENAME)-$(PKG_VERSION)
+PKG_UNPACK=unzip -d $(BUILD_DIR)/$(PKG_NAME) $(DL_DIR)/$(PKG_SOURCE)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/cyassl-luci/Default
+  TITLE:=CyaSSL (LuCI embedded flavor)
+  URL:=http://www.yassl.com/
+endef
+
+define Package/libcyassl-luci
+  $(call Package/cyassl-luci/Default)
+  SECTION:=libs
+  SUBMENU:=SSL
+  CATEGORY:=Libraries
+  TITLE+= (library)
+endef
+
+define Package/libcyassl-luci/description
+       CyaSSL is an SSL library optimized for small footprint, both on disk and for memory use.
+endef
+
+TARGET_CFLAGS += $(FPIC)
+
+CONFIGURE_ARGS += --without-zlib --enable-fastmath
+
+define Build/InstallDev
+       $(INSTALL_DIR) $(1)/usr/include/ctaocrypt
+       $(CP) $(PKG_BUILD_DIR)/ctaocrypt/include/*.h $(1)/usr/include/ctaocrypt
+       
+       $(INSTALL_DIR) $(1)/usr/lib
+       $(CP) $(PKG_BUILD_DIR)/src/.libs/libcyassl.{a,so*} $(1)/usr/lib/
+       $(CP) $(PKG_BUILD_DIR)/src/libcyassl.la $(1)/usr/lib/
+endef
+
+define Package/libcyassl-luci/install
+       $(INSTALL_DIR) $(1)/usr/lib
+       $(CP) $(PKG_BUILD_DIR)/src/.libs/libcyassl.so* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libcyassl-luci))

diff --git a/contrib/package/luci/Makefile b/contrib/package/luci/Makefile
index 2e7e7a567b32da8e5587d49bdb75cb4d2c03ffe2..4fced4637eb17420807e1b9921c2c441b370190d 100644 (file)
--- a/contrib/package/luci/Makefile
+++ b/contrib/package/luci/Makefile
@@ -266,6 +266,10 @@ define Package/luci-nixio/config
                        select PACKAGE_dropbear
                        select PACKAGE_dropbearconvert
 
+               config PACKAGE_luci-nixio_cyassl
+                       bool "CyaSSL"
+                       select PACKAGE_libcyassl-luci
+
                config PACKAGE_luci-nixio_openssl
                        bool "OpenSSL"
                        select PACKAGE_libopenssl
@@ -276,6 +280,9 @@ ifneq ($(CONFIG_PACKAGE_luci-nixio_openssl),)
   NIXIO_TLS:=openssl
 endif
 
+ifneq ($(CONFIG_PACKAGE_luci-nixio_cyassl),)
+  NIXIO_TLS:=cyassl
+endif
 
 define Package/luci-sys
   $(call Package/luci/libtemplate)

diff --git a/libs/nixio/Makefile b/libs/nixio/Makefile
index 8e87eaa1093e54fe374e54e15179176398b52169..500b6c4f13c1bca64ca25e167934fab34bf75887 100644 (file)
--- a/libs/nixio/Makefile
+++ b/libs/nixio/Makefile
@@ -28,6 +28,13 @@ ifeq ($(NIXIO_TLS),openssl)
        NIXIO_LDFLAGS += -lssl
 endif
 
+ifeq ($(NIXIO_TLS),cyassl)
+       NIXIO_LDFLAGS += -lcyassl
+       TLS_DEPENDS = src/cyassl-compat.o
+       TLS_CFLAGS = -include src/cyassl-compat.h
+       NIXIO_OBJ += src/cyassl-compat.o
+endif
+
 
 ifeq ($(OS),SunOS)
        NIXIO_LDFLAGS += -lsocket -lnsl -lsendfile

diff --git a/libs/nixio/docsrc/nixio.lua b/libs/nixio/docsrc/nixio.lua
index 2d0056f1798427b56a135349d9ba6713374c7b6b..90331cf23d67da79b533e12e946d7f9b1673850d 100644 (file)
--- a/libs/nixio/docsrc/nixio.lua
+++ b/libs/nixio/docsrc/nixio.lua
@@ -430,4 +430,5 @@ module "nixio"
 --- Create a new TLS context.
 -- @class function
 -- @name nixio.tls
+-- @param mode TLS-Mode ["client", "server"]
 -- @return TLSContext Object
\ No newline at end of file

diff --git a/libs/nixio/src/cyassl-compat.c b/libs/nixio/src/cyassl-compat.c
new file mode 100644 (file)
index 0000000..a483119
--- /dev/null
+++ b/libs/nixio/src/cyassl-compat.c
@@ -0,0 +1,31 @@
+#include "cyassl-compat.h"
+
+int MD5_Init(MD5_CTX *md5) {
+       InitMd5(md5);
+       return 1;
+}
+
+int MD5_Update(MD5_CTX *md5, void *input, unsigned long sz) {
+       Md5Update(md5, input, (word32)sz);
+       return 1;
+}
+
+int MD5_Final(void *input, MD5_CTX *md5) {
+       Md5Final(md5, input);
+       return 1;
+}
+
+int SHA1_Init(SHA_CTX *sha) {
+       InitSha(sha);
+       return 1;
+}
+
+int SHA1_Update(SHA_CTX *sha, void *input, unsigned long sz) {
+       ShaUpdate(sha, input, (word32)sz);
+       return 1;
+}
+
+int SHA1_Final(void *input, SHA_CTX *sha) {
+       ShaFinal(sha, input);
+       return 1;
+}

diff --git a/libs/nixio/src/cyassl-compat.h b/libs/nixio/src/cyassl-compat.h
new file mode 100644 (file)
index 0000000..b2cdc92
--- /dev/null
+++ b/libs/nixio/src/cyassl-compat.h
@@ -0,0 +1,32 @@
+#define WITH_CYASSL
+#define WITHOUT_OPENSSL
+#include <openssl/ssl.h>
+
+typedef unsigned int word32;
+
+
+#define MD5_DIGEST_LENGTH 16
+typedef struct MD5_CTX {
+    int dummy[24];
+} MD5_CTX;
+
+void InitMd5(MD5_CTX*);
+void Md5Update(MD5_CTX*, void*, word32);
+void Md5Final(MD5_CTX*, void*);
+
+
+#define SHA_DIGEST_LENGTH 20
+typedef struct SHA_CTX {
+    int dummy[24];
+} SHA_CTX;
+
+void InitSha(SHA_CTX*);
+void ShaUpdate(SHA_CTX*, void*, word32);
+void ShaFinal(SHA_CTX*, void*);
+
+int MD5_Init(MD5_CTX *md5);
+int MD5_Update(MD5_CTX *md5, void *input, unsigned long sz);
+int MD5_Final(void *input, MD5_CTX *md5);
+int SHA1_Init(SHA_CTX *md5);
+int SHA1_Update(SHA_CTX *sha, void *input, unsigned long sz);
+int SHA1_Final(void *input, SHA_CTX *sha);

diff --git a/libs/nixio/src/tls-context.c b/libs/nixio/src/tls-context.c
index 59e06f4499c24fe1329d9ffb09cd97696ced9fcf..fdbe2246223216beaf84603e235072aa7d385b4b 100644 (file)
--- a/libs/nixio/src/tls-context.c
+++ b/libs/nixio/src/tls-context.c
@@ -41,7 +41,7 @@ static int nixio__tls_pstatus(lua_State *L, int code) {
 }
 
 static int nixio_tls_ctx(lua_State * L) {
-       const char *method = luaL_optlstring(L, 1, "tlsv1", NULL);
+       const char *method = luaL_optlstring(L, 1, "client", NULL);
 
        luaL_getmetatable(L, NIXIO_TLS_CTX_META);
        SSL_CTX **ctx = lua_newuserdata(L, sizeof(SSL_CTX *));
@@ -52,27 +52,22 @@ static int nixio_tls_ctx(lua_State * L) {
        /* create userdata */
        lua_pushvalue(L, -2);
        lua_setmetatable(L, -2);
-       lua_getfield(L, -1, "tls_defaultkey");
 
-       if (!strcmp(method, "tlsv1")) {
-               *ctx = SSL_CTX_new(TLSv1_method());
-       } else if (!strcmp(method, "sslv23")) {
-               *ctx = SSL_CTX_new(SSLv23_method());
+       if (!strcmp(method, "client")) {
+               *ctx = SSL_CTX_new(TLSv1_client_method());
+       } else if (!strcmp(method, "server")) {
+               *ctx = SSL_CTX_new(TLSv1_server_method());
        } else {
-               return luaL_argerror(L, 1, "supported values: tlsv1, sslv23");
+               return luaL_argerror(L, 1, "supported values: client, server");
        }
 
        if (!(*ctx)) {
                return luaL_error(L, "unable to create TLS context");
        }
 
-       const char *autoload = lua_tostring(L, -1);
-       if (autoload) {
-               SSL_CTX_use_PrivateKey_file(*ctx, autoload, SSL_FILETYPE_PEM);
-       }
-       lua_pop(L, 1);
-
-       SSL_CTX_set_options(*ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+#ifdef WITH_CYASSL
+       SSL_CTX_set_verify(*ctx, SSL_VERIFY_NONE, NULL);
+#endif
 
        return 1;
 }
@@ -136,13 +131,6 @@ static int nixio_tls_ctx_set_ciphers(lua_State *L) {
        return nixio__tls_pstatus(L, SSL_CTX_set_cipher_list(ctx, ciphers));
 }
 
-static int nixio_tls_ctx_set_verify_depth(lua_State *L) {
-       SSL_CTX *ctx = nixio__checktlsctx(L);
-       const int depth = luaL_checkinteger(L, 2);
-       SSL_CTX_set_verify_depth(ctx, depth);
-       return 0;
-}
-
 static int nixio_tls_ctx_set_verify(lua_State *L) {
        SSL_CTX *ctx = nixio__checktlsctx(L);
        const int j = lua_gettop(L);
@@ -192,7 +180,6 @@ static const luaL_reg CTX_M[] = {
        {"set_cert",                    nixio_tls_ctx_set_cert},
        {"set_key",                             nixio_tls_ctx_set_key},
        {"set_ciphers",                 nixio_tls_ctx_set_ciphers},
-       {"set_verify_depth",    nixio_tls_ctx_set_verify_depth},
        {"set_verify",                  nixio_tls_ctx_set_verify},
        {"create",                              nixio_tls_ctx_create},
        {"__gc",                                nixio_tls_ctx__gc},
@@ -209,10 +196,12 @@ void nixio_open_tls_context(lua_State *L) {
     /* register module functions */
     luaL_register(L, NULL, R);
 
-#ifndef WITH_AXTLS
-    lua_pushliteral(L, "openssl");
-#else
+#if defined (WITH_AXTLS)
     lua_pushliteral(L, "axtls");
+#elif defined (WITH_CYASSL)
+    lua_pushliteral(L, "cyassl");
+#else
+    lua_pushliteral(L, "openssl");
 #endif
     lua_setfield(L, -2, "tls_provider");
 
@@ -221,9 +210,5 @@ void nixio_open_tls_context(lua_State *L) {
        lua_pushvalue(L, -1);
        lua_setfield(L, -2, "__index");
        luaL_register(L, NULL, CTX_M);
-#ifdef WITH_AXTLS
-    lua_pushliteral(L, "/etc/axtls.key");
-    lua_setfield(L, -2, "tls_defaultkey");
-#endif
        lua_setfield(L, -2, "meta_tls_context");
 }

diff --git a/libs/nixio/src/tls-crypto.c b/libs/nixio/src/tls-crypto.c
index 62ade226577dae6105898ea58d744685101f6f26..714ec4e60c3fb4a0ae0f022d98e30fb13ce2b00e 100644 (file)
--- a/libs/nixio/src/tls-crypto.c
+++ b/libs/nixio/src/tls-crypto.c
@@ -17,6 +17,7 @@
  */
 
 #include "nixio-tls.h"
+#include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <fcntl.h>