util/sslconfig.lua

   1 -- util to easily merge multiple sets of LuaSec context options
   2
   3 local type = type;
   4 local pairs = pairs;
   5 local rawset = rawset;
   6 local t_concat = table.concat;
   7 local t_insert = table.insert;
   8 local setmetatable = setmetatable;
   9
  10 local _ENV = nil;
  11 -- luacheck: std none
  12
  13 local handlers = { };
  14 local finalisers = { };
  15 local id = function (v) return v end
  16
  17 -- All "handlers" behave like extended rawset(table, key, value) with extra
  18 -- processing usually merging the new value with the old in some reasonable
  19 -- way
  20 -- If a field does not have a defined handler then a new value simply
  21 -- replaces the old.
  22
  23
  24 -- Convert either a list or a set into a special type of set where each
  25 -- item is either positive or negative in order for a later set of options
  26 -- to be able to remove options from this set by filtering out the negative ones
  27 function handlers.options(config, field, new)
  28         local options = config[field] or { };
  29         if type(new) ~= "table" then new = { new } end
  30         for key, value in pairs(new) do
  31                 if value == true or value == false then
  32                         options[key] = value;
  33                 else -- list item
  34                         options[value] = true;
  35                 end
  36         end
  37         config[field] = options;
  38 end
  39
  40 handlers.verifyext = handlers.options;
  41
  42 -- finalisers take something produced by handlers and return what luasec
  43 -- expects it to be
  44
  45 -- Produce a list of "positive" options from the set
  46 function finalisers.options(options)
  47         local output = {};
  48         for opt, enable in pairs(options) do
  49                 if enable then
  50                         output[#output+1] = opt;
  51                 end
  52         end
  53         return output;
  54 end
  55
  56 finalisers.verifyext = finalisers.options;
  57
  58 -- We allow ciphers to be a list
  59
  60 function finalisers.ciphers(cipherlist)
  61         if type(cipherlist) == "table" then
  62                 return t_concat(cipherlist, ":");
  63         end
  64         return cipherlist;
  65 end
  66
  67 -- Curve list too
  68 finalisers.curveslist = finalisers.ciphers;
  69
  70 -- protocol = "x" should enable only that protocol
  71 -- protocol = "x+" should enable x and later versions
  72
  73 local protocols = { "sslv2", "sslv3", "tlsv1", "tlsv1_1", "tlsv1_2", "tlsv1_3" };
  74 for i = 1, #protocols do protocols[protocols[i] .. "+"] = i - 1; end
  75
  76 -- this interacts with ssl.options as well to add no_x
  77 local function protocol(config)
  78         local min_protocol = protocols[config.protocol];
  79         if min_protocol then
  80                 config.protocol = "sslv23";
  81                 for i = 1, min_protocol do
  82                         t_insert(config.options, "no_"..protocols[i]);
  83                 end
  84         end
  85 end
  86
  87 -- Merge options from 'new' config into 'config'
  88 local function apply(config, new)
  89         if type(new) == "table" then
  90                 for field, value in pairs(new) do
  91                         (handlers[field] or rawset)(config, field, value);
  92                 end
  93         end
  94 end
  95
  96 -- Finalize the config into the form LuaSec expects
  97 local function final(config)
  98         local output = { };
  99         for field, value in pairs(config) do
 100                 output[field] = (finalisers[field] or id)(value);
 101         end
 102         -- Need to handle protocols last because it adds to the options list
 103         protocol(output);
 104         return output;
 105 end
 106
 107 local sslopts_mt = {
 108         __index = {
 109                 apply = apply;
 110                 final = final;
 111         };
 112 };
 113
 114 local function new()
 115         return setmetatable({options={}}, sslopts_mt);
 116 end
 117
 118 return {
 119         apply = apply;
 120         final = final;
 121         new = new;
 122 };