From cf82f353b7737e5fc59eae086424d8ef63951934 Mon Sep 17 00:00:00 2001 From: Matthew Wild Date: Tue, 3 Sep 2013 12:11:11 +0100 Subject: certmanager: Fix for working around a bug with LuaSec 0.4.1 that causes it to not honour the 'ciphers' option. This change will apply 0.9's default cipher string for LuaSec 0.4.1 users. --- core/certmanager.lua | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/core/certmanager.lua b/core/certmanager.lua index 5dee5876..5aec22b3 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -74,11 +74,11 @@ function create_context(host, mode, user_ssl_config) local ctx, err = ssl_newcontext(ssl_config); - -- LuaSec ignores the cipher list from the config, so we have to take care - -- of it ourselves (W/A for #x) - if ctx and user_ssl_config.ciphers then + -- COMPAT: LuaSec 0.4.1 ignores the cipher list from the config, so we have to take + -- care of it ourselves... + if ctx and ssl_config.ciphers then local success; - success, err = ssl.context.setcipher(ctx, user_ssl_config.ciphers); + success, err = ssl.context.setcipher(ctx, ssl_config.ciphers); if not success then ctx = nil; end end -- cgit v1.2.3 From 7f9fe6d4cd5ddd4d260b68e57a8dc378175ef627 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Tue, 3 Sep 2013 13:13:31 +0200 Subject: certmanager: Allow for specifying the dhparam option as a path to a file instead of a callback --- core/certmanager.lua | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/core/certmanager.lua b/core/certmanager.lua index 5aec22b3..c1ce468d 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -72,6 +72,17 @@ function create_context(host, mode, user_ssl_config) dhparam = user_ssl_config.dhparam; }; + -- LuaSec expects dhparam to be a callback that takes two arguments. + -- We ignore those because it is mostly used for having a separate + -- set of params for EXPORT ciphers, which we don't have by default. + if type(user_ssl_config.dhparam) == "string" then + local f, err = io_open(resolve_path(user_ssl_config.dhparam)); + if not f then return nil, "Could not open DH parameters: "..err end + local dhparam = f:read("*a"); + f:close(); + user_ssl_config.dhparam = function() return dhparam; end + end + local ctx, err = ssl_newcontext(ssl_config); -- COMPAT: LuaSec 0.4.1 ignores the cipher list from the config, so we have to take -- cgit v1.2.3