Bruno Silvestre
20443861eb
Update version number and rock file.
2016-03-03 16:11:46 -03:00
Bruno Silvestre
3b5f4b0dc1
Options from OpenSSL 1.0.2f
2016-02-16 10:48:19 -02:00
Bruno Silvestre
407ff6133c
Use "any" protocol, but SSL.
2016-02-16 09:35:47 -02:00
Bruno Silvestre
72e159149b
Merge pull request #20 from Zash/zash/checkissued
...
Method for checking if one certificate issued another
2016-02-16 09:34:31 -02:00
Gleydson
27fbd70424
tweak OPENSSL_NO_COMP
2015-11-20 13:22:00 -03:00
Bruno Silvestre
6a7a6f7f67
Keep 'sslv23' for compability, but deprected. (it will be removed in the next version)
2015-11-19 12:33:06 -02:00
Gleydson Soares
63f7d46d00
for consistency and readability, rename "sslv23" to "any" since that it is related to {TLS, SSLv23}methods that handles all supported protocols.
2015-11-17 20:05:06 -03:00
Gleydson Soares
ef28f7d20d
add TLS_method(). for now, keep SSLv23_method() for compatibility.
2015-11-17 19:36:58 -03:00
Bruno Silvestre
49ea6b8ba6
Merge pull request #55 from gleydsonsoares/ifndef-OPENSSL_NO_SSL3
...
guard SSLv3_method() with #ifndef OPENSSL_NO_SSL3
2015-11-12 18:47:56 -02:00
Bruno Silvestre
96401bdf67
Add lsec_testcontext().
2015-10-28 00:05:30 -02:00
Gleydson Soares
67f0867277
guard SSLv3_method() with #ifndef OPENSSL_NO_SSL3
2015-10-12 08:35:35 -03:00
Bruno Silvestre
d1fb889547
Version number -> 0.6 alpha
2015-08-21 11:21:16 -03:00
Bruno Silvestre
24e5ec13f3
Merge pull request #46 from olesalscheider/master
...
Do not hardcode ar
2015-08-03 20:37:00 -03:00
Bruno Silvestre
8e9910cb15
Format.
2015-08-01 01:14:16 -03:00
Bruno Silvestre
2c2c9cf16f
Alternative implementation to inet_ntop() for old versions of Windows.
2015-08-01 01:07:04 -03:00
Niels Ole Salscheider
580d9b7ed8
Do not hardcode ar
...
On Exherbo, ar is prefixed by the target triple.
2015-05-23 19:51:58 +02:00
Kim Alvefur
4e59c719df
Perform all validation before allocating structures
...
Check that all arguments are certificates before allocating OpenSSL
structures that require cleanup afterwards.
API of issued() changes (again) to root:issued(cert, [chain]*)
2015-03-31 17:48:44 +02:00
Kim Alvefur
aa0c7ea1e5
Validate signatures too.
...
API changes to root:issued([intermediate]*, cert)
2015-03-20 16:36:05 +01:00
Bruno Silvestre
3862e76df9
Fix inet_ntop() on Windows.
2015-03-12 17:05:53 -03:00
Bruno Silvestre
1ab6fac919
Don't set globals from C.
2015-02-12 16:32:54 -02:00
Bruno Silvestre
91d378a86e
Fix unpack().
2015-02-12 16:29:02 -02:00
Bruno Silvestre
356e03a64d
Stop using module().
2015-02-06 18:07:29 -02:00
Bruno Silvestre
97b1974039
Change to luaL_newlib().
2015-02-06 17:44:08 -02:00
Bruno Silvestre
9cb5220759
Remove luaL_optint() and luaL_checkint().
2015-02-06 16:53:34 -02:00
Bruno Silvestre
acbf575420
BSD headers.
2015-01-28 16:38:00 -02:00
Bruno Silvestre
a9b81b1c10
Merge pull request #21 from Zash/zash/iPAddress-fix
...
iPAddress encoding
2015-01-28 16:24:02 -02:00
Bruno Silvestre
ab42d4ec86
Stop if we don't have a string.
2015-01-28 16:19:19 -02:00
Lluixhi Scura
5240c02f3d
Changed for strict compiles.
2015-01-16 09:12:14 -08:00
Lluixhi Scura
4c7339cace
Fix for LibreSSL/OPENSSL_NO_COMP
2015-01-16 08:55:22 -08:00
Bruno Silvestre
f514e9fb1b
Problem on Win64, since double does not represent SOCKET_INVALID exactly.
2014-09-10 14:41:09 -03:00
Bruno Silvestre
84cb83b92f
- Add a parameter to server:sni(), so that we can accept an unknown name, using the initial context.
...
- Add the method :getsniname() to retrieve the SNI hostname used.
2014-09-09 21:48:26 -03:00
Kim Alvefur
f13aee5dac
Encode iPAddress fields in human readable form
2014-06-08 13:20:47 +02:00
Kim Alvefur
b83d2c6a91
Don't try to encode IP addresses as UTF-8
2014-06-08 12:47:58 +02:00
Kim Alvefur
c276e9ff60
Return early if ASN1 string is invalid
2014-06-08 12:41:20 +02:00
Kim Alvefur
1ade1542d7
Push nil if unable to encode ASN1 string as UTF-8
2014-06-08 12:38:52 +02:00
Kim Alvefur
97e836696b
Return human readable error message from cert:issued()
2014-04-22 01:17:34 +02:00
Bruno Silvestre
903efaf3b1
SNI support.
2014-04-21 13:20:17 -03:00
brunoos
77637e9d3c
Merge pull request #17 from Zash/zash/checkkey
...
Verify that certificate and key belong together
2014-04-21 13:07:38 -03:00
brunoos
a481015217
Merge pull request #19 from Zash/zash/pubkey
...
Zash/pubkey
2014-04-21 11:52:40 -03:00
Kim Alvefur
11eaec6520
Add cert:pubkey() to methods registry
2014-04-19 23:11:32 +02:00
Kim Alvefur
d2c87d71f7
Add cert:issued(leafcert) for checking chains
2014-04-19 22:58:28 +02:00
Bruno Silvestre
8fd31f3ad2
Wrong type.
2014-04-18 22:50:40 -03:00
Kim Alvefur
55d45f0542
Check if private key matches cert only if both key and cert are set
2014-02-05 16:51:30 +01:00
Kim Alvefur
8e5bcefbb6
Check that certificate matches private key
2014-02-05 01:48:58 +01:00
Kim Alvefur
eb8cb33160
Add method for extracting public key, type and size from x509 objects
2014-02-05 01:39:30 +01:00
Bruno Silvestre
21aefcf67d
Version number -> 0.5.
2014-01-29 18:43:33 -02:00
Bruno Silvestre
46d6078e82
Merge branch 'master' of https://github.com/brunoos/luasec
2013-10-23 13:53:43 -02:00
Bruno Silvestre
ce504d3554
Add x509:setencode() function to change the encode of ASN.1 string.
2013-10-23 13:42:34 -02:00
brunoos
4a95102cc8
Merge pull request #8 from xnyhps/protocol_version
...
Report the actual TLS version used, not the version the cipher belongs to.
2013-09-16 09:25:39 -07:00
Paul Aurich
1d920fc13c
context: Don't leak DH* in dhparam_cb
...
==1429== 336 (144 direct, 192 indirect) bytes in 1 blocks are definitely lost in loss record 567 of 611
...
==1429== by 0x5ECCBC7: PEM_ASN1_read_bio (in /lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==1429== by 0x4E39D8F: dhparam_cb (context.c:184)
==1429== by 0x5B679D3: ??? (in /lib/x86_64-linux-gnu/libssl.so.1.0.0)
==1429== by 0x5B6A6EE: ??? (in /lib/x86_64-linux-gnu/libssl.so.1.0.0)
==1429== by 0x4E3C00D: meth_handshake (ssl.c:103)
...
2013-09-11 21:55:25 -07:00
Paul Aurich
0dab860770
context: Link SSL_CTX to p_context (not lua_State)
...
This is needed because the p_context is going to cache DH (and eventually
EC_KEY) objects, to plug a leak in the dhparam callback.
2013-09-11 21:55:25 -07:00
Paul Aurich
8cf7eb2d78
context: for dhparam_cb, pass is_export as boolean
...
The integer value that's actually returned for this flag is 2, which is fine
for C (it is defined as true), but it's sufficiently surprising (because it's
not 1), that this is worth fixing -- even if export ciphers aren't common.
It should be a boolean anyway.
2013-09-11 21:55:25 -07:00
Paul Aurich
9c7c96f2a0
Add useful context to various error messages
2013-09-11 21:55:25 -07:00
Paul Aurich
9262f9e7de
ssl.lua: Comment subtle DH/ECDH ordering caveat
2013-09-11 21:55:25 -07:00
Paul Aurich
3fb33cdc4e
context: Don't leak EC_KEY in set_curve()
...
SSL_CTX_set_tmp_ecdh() takes a reference to the provided key.
==8323== 1,044 (56 direct, 988 indirect) bytes in 1 blocks are definitely lost in loss record 611 of 631
==8323== at 0x4C2935B: malloc (vg_replace_malloc.c:270)
==8323== by 0x5E05D9F: CRYPTO_malloc (mem.c:308)
==8323== by 0x5E59859: EC_KEY_new (ec_key.c:75)
==8323== by 0x5E59974: EC_KEY_new_by_curve_name (ec_key.c:96)
==8323== by 0x4E395A7: set_curve (context.c:261)
...
2013-09-11 21:55:25 -07:00
Paul Aurich
a344f58b20
context: Wrap find_ec_key in #ifndef OPENSSL_NO_ECDH
...
"#ifndef OPENSSL_NO_ECDH" is a ridiculous conditional, by the way.
2013-09-11 21:55:25 -07:00
Thijs Alkemade
1a75704ff0
Report the actual TLS version used, not the version the cipher belongs
...
to.
2013-09-08 15:00:07 +02:00
Bruno Silvestre
063e8a8a5c
- using buffer from luasocket 3.0.
...
- adding getstats() and setstats().
2013-06-20 13:03:58 -03:00
Paul Aurich
7532f3b729
context: Support explicit selection of TLS v1.1 and v1.2
2013-06-12 19:06:16 -07:00
Paul Aurich
2dae14877e
options: Remove dead code
...
The workaround for 'no_compression' on older OpenSSL is handled in context.c;
set_option_flag (which uses ssl_options) is never called, so this shouldn't
exist.
2013-06-12 18:38:44 -07:00
Paul Aurich
4c5ce1b177
context: Incidental cleanup
2013-06-12 18:36:35 -07:00
Paul Aurich
9bda3322fb
context: no_compression is options, not verify
...
The OpenSSL 0.9.8 compat needs to be handled as part of the options, not the
verification flags.
2013-06-12 18:33:19 -07:00
Vadim A. Misbakh-Soloviov
fceef56dce
DESTDIR compatibility + *FLAGs/utils configurability + ld -fpic error fix. Also fixes #1
...
Signed-off-by: Vadim A. Misbakh-Soloviov <mva@mva.name>
2013-05-14 08:13:57 +07:00
Matthew Wild
1b899afd38
Remove duplicate files (now in luasocket/)
2013-03-30 12:49:55 +00:00
Matthew Wild
77ac210283
LuaSec 20120616 (unofficial) + patches
2013-03-30 12:21:40 +00:00
Bruno Silvestre
908fc346d2
LuaSec 0.4.1
2012-09-02 11:40:59 -03:00
Bruno Silvestre
67e5176b6b
LuaSec 0.4
2012-09-02 11:32:26 -03:00
Bruno Silvestre
29c6bd65d2
LuaSec 0.3.3
2012-09-02 11:31:22 -03:00
Bruno Silvestre
d28c5e4f9e
LuaSec 0.3.2
2012-09-02 11:30:04 -03:00
Bruno Silvestre
affd08cf05
LuaSec 0.3.1
2012-09-02 11:27:04 -03:00
Bruno Silvestre
1c95a077ee
LuaSec 0.3
2012-09-02 11:22:22 -03:00
Bruno Silvestre
36e94ee40d
LuaSec 0.2
2012-09-02 11:15:49 -03:00