??? JFIF    ?? C    !"$"$?? C  ?? p " ??     ??   ?   ???? (% aA*?XYD?(J??ERE,PXYae?)(E2BR BQ X?)X? @ .............................................................................................................................................................................. ............................................................................. PK7N]7ł} tablepool.luanu[local newtab = require "table.new" local cleartab = require "table.clear" local setmetatable = setmetatable local _M = newtab(0, 2) local max_pool_size = 200 local pools = newtab(0, 4) function _M.fetch(tag, narr, nrec) local pool = pools[tag] if not pool then pool = newtab(4, 1) pools[tag] = pool pool.c = 0 pool[0] = 0 else local len = pool[0] if len > 0 then local obj = pool[len] pool[len] = nil pool[0] = len - 1 -- ngx.log(ngx.ERR, "HIT") return obj end end return newtab(narr, nrec) end function _M.release(tag, obj, noclear) if not obj then error("object empty", 2) end local pool = pools[tag] if not pool then pool = newtab(4, 1) pools[tag] = pool pool.c = 0 pool[0] = 0 end do local cnt = pool.c + 1 if cnt >= 20000 then pool = newtab(4, 1) pools[tag] = pool pool.c = 0 pool[0] = 0 return end pool.c = cnt end local len = pool[0] + 1 if len > max_pool_size then -- discard it simply return end if not noclear then setmetatable(obj, nil) cleartab(obj) end pool[len] = obj pool[0] = len end return _M -- vi: ft=lua ts=4 sw=4 et PK:N]Ѓresty/core/ndk.luanu[-- Copyright (C) by OpenResty Inc. local ffi = require 'ffi' local base = require "resty.core.base" base.allows_subsystem('http') local C = ffi.C local ffi_cast = ffi.cast local ffi_new = ffi.new local ffi_str = ffi.string local FFI_OK = base.FFI_OK local new_tab = base.new_tab local get_string_buf = base.get_string_buf local get_request = base.get_request local setmetatable = setmetatable local type = type local tostring = tostring local error = error local _M = { version = base.version } ffi.cdef[[ typedef void * ndk_set_var_value_pt; int ngx_http_lua_ffi_ndk_lookup_directive(const unsigned char *var_data, size_t var_len, ndk_set_var_value_pt *func); int ngx_http_lua_ffi_ndk_set_var_get(ngx_http_request_t *r, ndk_set_var_value_pt func, const unsigned char *arg_data, size_t arg_len, ngx_http_lua_ffi_str_t *value); ]] local func_p = ffi_new("void*[1]") local ffi_str_size = ffi.sizeof("ngx_http_lua_ffi_str_t") local ffi_str_type = ffi.typeof("ngx_http_lua_ffi_str_t*") local function ndk_set_var_get(self, var) if type(var) ~= "string" then var = tostring(var) end if C.ngx_http_lua_ffi_ndk_lookup_directive(var, #var, func_p) ~= FFI_OK then error('ndk.set_var: directive "' .. var .. '" not found or does not use ndk_set_var_value', 2) end local func = func_p[0] return function (arg) local r = get_request() if not r then error("no request found") end if type(arg) ~= "string" then arg = tostring(arg) end local buf = get_string_buf(ffi_str_size) local value = ffi_cast(ffi_str_type, buf) local rc = C.ngx_http_lua_ffi_ndk_set_var_get(r, func, arg, #arg, value) if rc ~= FFI_OK then error("calling directive " .. var .. " failed with code " .. rc, 2) end return ffi_str(value.data, value.len) end end local function ndk_set_var_set() error("not allowed", 2) end if ndk then local mt = new_tab(0, 2) mt.__newindex = ndk_set_var_set mt.__index = ndk_set_var_get ndk.set_var = setmetatable(new_tab(0, 0), mt) end return _M PK;N]f~nu<u<resty/core/socket.luanu[local base = require "resty.core.base" -- base.allows_subsystem("http") local debug = require "debug" local ffi = require "ffi" local subsystem = ngx.config.subsystem local error = error local assert = assert local tonumber = tonumber local tostring = tostring local type = type local select = select local registry = debug.getregistry() local C = ffi.C local ffi_new = ffi.new local ffi_str = ffi.string local ffi_gc = ffi.gc local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local get_request = base.get_request local errmsg = base.get_errmsg_ptr() local co_yield = coroutine._yield local option_index = { ["keepalive"] = 1, ["reuseaddr"] = 2, ["tcp-nodelay"] = 3, ["sndbuf"] = 4, ["rcvbuf"] = 5, ["keepintvl"] = 6, ["keepcnt"] = 7, } local ngx_lua_ffi_socket_tcp_getoption local ngx_lua_ffi_socket_tcp_setoption local ngx_lua_ffi_socket_getfd local ngx_lua_ffi_socket_getsslpointer local ngx_lua_ffi_socket_getsslctx local ngx_lua_ffi_socket_tcp_settrustedstore if subsystem == 'http' then ffi.cdef[[ typedef struct ngx_http_lua_socket_tcp_upstream_s ngx_http_lua_socket_tcp_upstream_t; int ngx_http_lua_ffi_socket_tcp_getoption(ngx_http_lua_socket_tcp_upstream_t *u, int opt, int *val, unsigned char *err, size_t *errlen); int ngx_http_lua_ffi_socket_tcp_setoption(ngx_http_lua_socket_tcp_upstream_t *u, int opt, int val, unsigned char *err, size_t *errlen); int ngx_http_lua_ffi_socket_tcp_sslhandshake(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, void *sess, int enable_session_reuse, ngx_str_t *server_name, int verify, int ocsp_status_req, void *chain, void *pkey, char **errmsg); int ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, void **sess, char **errmsg, int *openssl_error_code); void ngx_http_lua_ffi_ssl_free_session(void *sess); int ngx_http_lua_ffi_socket_tcp_getfd(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, char **errmsg); int ngx_http_lua_socket_tcp_get_ssl_session(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, void **sess, char **errmsg); int ngx_http_lua_ffi_socket_tcp_get_ssl_pointer(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, void **pssl, char **errmsg); int ngx_http_lua_ffi_socket_tcp_get_ssl_ctx(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, void **pctx, char **errmsg); int ngx_http_lua_ffi_socket_tcp_settrustedstore(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, void *store, char **errmsg); ]] ngx_lua_ffi_socket_tcp_getoption = C.ngx_http_lua_ffi_socket_tcp_getoption ngx_lua_ffi_socket_tcp_setoption = C.ngx_http_lua_ffi_socket_tcp_setoption ngx_lua_ffi_socket_getfd = C.ngx_http_lua_ffi_socket_tcp_getfd if pcall(function() return C.ngx_http_lua_ffi_socket_tcp_get_ssl_pointer end) then ngx_lua_ffi_socket_getsslpointer = C.ngx_http_lua_ffi_socket_tcp_get_ssl_pointer end if pcall(function() return C.ngx_http_lua_ffi_socket_tcp_get_ssl_ctx end) then ngx_lua_ffi_socket_getsslctx = C.ngx_http_lua_ffi_socket_tcp_get_ssl_ctx end if pcall(function() return C.ngx_http_lua_ffi_socket_tcp_settrustedstore end) then ngx_lua_ffi_socket_tcp_settrustedstore = C.ngx_http_lua_ffi_socket_tcp_settrustedstore end elseif subsystem == 'stream' then ffi.cdef[[ typedef struct ngx_stream_lua_socket_tcp_upstream_s ngx_stream_lua_socket_tcp_upstream_t; int ngx_stream_lua_ffi_socket_tcp_getoption(ngx_stream_lua_socket_tcp_upstream_t *u, int option, int *val, unsigned char *err, size_t *errlen); int ngx_stream_lua_ffi_socket_tcp_setoption(ngx_stream_lua_socket_tcp_upstream_t *u, int opt, int val, unsigned char *err, size_t *errlen); int ngx_stream_lua_ffi_socket_tcp_getfd(ngx_stream_lua_request_t *r, ngx_stream_lua_socket_tcp_upstream_t *u, char **errmsg); int ngx_stream_lua_ffi_socket_tcp_get_ssl_pointer(ngx_stream_lua_request_t *r, ngx_stream_lua_socket_tcp_upstream_t *u, void **pssl, char **errmsg); int ngx_stream_lua_ffi_socket_tcp_get_ssl_ctx(ngx_stream_lua_request_t *r, ngx_stream_lua_socket_tcp_upstream_t *u, void **pctx, char **errmsg); int ngx_stream_lua_ffi_socket_tcp_settrustedstore(ngx_stream_lua_request_t *r, ngx_stream_lua_socket_tcp_upstream_t *u, void *store, char **errmsg); ]] ngx_lua_ffi_socket_tcp_getoption = C.ngx_stream_lua_ffi_socket_tcp_getoption ngx_lua_ffi_socket_tcp_setoption = C.ngx_stream_lua_ffi_socket_tcp_setoption ngx_lua_ffi_socket_getfd = C.ngx_stream_lua_ffi_socket_tcp_getfd if pcall(function() return C.ngx_stream_lua_ffi_socket_tcp_get_ssl_pointer end) then ngx_lua_ffi_socket_getsslpointer = C.ngx_stream_lua_ffi_socket_tcp_get_ssl_pointer end if pcall(function() return C.ngx_stream_lua_ffi_socket_tcp_get_ssl_pointer end) then ngx_lua_ffi_socket_getsslctx = C.ngx_stream_lua_ffi_socket_tcp_get_ssl_pointer end if pcall(function() return C.ngx_stream_lua_ffi_socket_tcp_settrustedstore end) then ngx_lua_ffi_socket_tcp_settrustedstore = C.ngx_stream_lua_ffi_socket_tcp_settrustedstore end end local output_value_buf = ffi_new("int[1]") local session_ptr = ffi_new("void *[1]") local ERR_BUF_SIZE = 4096 local FFI_OK = base.FFI_OK local FFI_ERROR = base.FFI_ERROR local FFI_DONE = base.FFI_DONE local FFI_AGAIN = base.FFI_AGAIN local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX local SOCKET_CTX_INDEX = 1 local SOCKET_CLIENT_CERT_INDEX = 6 local SOCKET_CLIENT_PKEY_INDEX = 7 local SOCKET_IP_TRANSPARENT_INDEX = 9 local SOCKET_TRUSTED_STORE_INDEX = 10 local function get_tcp_socket(cosocket) local tcp_socket = cosocket[SOCKET_CTX_INDEX] if not tcp_socket then error("socket is never created nor connected") end return tcp_socket end local function getoption(cosocket, option) local tcp_socket = get_tcp_socket(cosocket) if option == nil then return nil, 'missing the "option" argument' end if option_index[option] == nil then return nil, "unsupported option " .. tostring(option) end local err = get_string_buf(ERR_BUF_SIZE) local errlen = get_size_ptr() errlen[0] = ERR_BUF_SIZE local rc = ngx_lua_ffi_socket_tcp_getoption(tcp_socket, option_index[option], output_value_buf, err, errlen) if rc ~= FFI_OK then return nil, ffi_str(err, errlen[0]) end return tonumber(output_value_buf[0]) end local function setoption(cosocket, option, value) if option == nil then return nil, 'missing the "option" argument' end if value == nil then return nil, 'missing the "value" argument' end if option == "ip-transparent" then cosocket[SOCKET_IP_TRANSPARENT_INDEX] = value return true end local tcp_socket = get_tcp_socket(cosocket) if option_index[option] == nil then return nil, "unsupported option " .. tostring(option) end local err = get_string_buf(ERR_BUF_SIZE) local errlen = get_size_ptr() errlen[0] = ERR_BUF_SIZE local rc = ngx_lua_ffi_socket_tcp_setoption(tcp_socket, option_index[option], value, err, errlen) if rc ~= FFI_OK then return nil, ffi_str(err, errlen[0]) end return true end local function getfd(cosocket) if not cosocket then error("ngx.socket getfd: expecting the cosocket object, but seen none") end local r = get_request() if not r then error("no request found") end local u = get_tcp_socket(cosocket) local fd = ngx_lua_ffi_socket_getfd(r, u, errmsg) if (fd < 0) then return nil, ffi_str(errmsg[0]) end return fd; end local function getsslpointer(cosocket) if not cosocket then error("ngx.socket getfd: expecting the cosocket object, but seen none") end local r = get_request() if not r then error("no request found") end local u = get_tcp_socket(cosocket) local rc = ngx_lua_ffi_socket_getsslpointer(r, u, session_ptr, errmsg) if rc == FFI_ERROR then return nil, ffi_str(errmsg[0]) end return session_ptr[0] end local function getsslctx(cosocket) if not cosocket then error("ngx.socket getfd: expecting the cosocket object, but seen none") end local r = get_request() if not r then error("no request found") end local u = get_tcp_socket(cosocket) local rc = ngx_lua_ffi_socket_getsslctx(r, u, session_ptr, errmsg) if rc == FFI_ERROR then return nil, ffi_str(errmsg[0]) end return session_ptr[0] end local NULL_STORE = ffi_new("void *", nil) local function settrustedstore(cosocket, store) if not ngx_lua_ffi_socket_tcp_settrustedstore then return nil, "tcpsock:settrustedstore is not supported by " .. "the current nginx module" end if store ~= nil and type(store) ~= "cdata" then return nil, "bad store arg: cdata expected, got " .. type(store) end local r = get_request() if not r then error("no request found", 2) end local u = get_tcp_socket(cosocket) local rc = ngx_lua_ffi_socket_tcp_settrustedstore(r, u, store or NULL_STORE, errmsg) if rc ~= FFI_OK then return nil, ffi_str(errmsg[0]) end cosocket[SOCKET_TRUSTED_STORE_INDEX] = store return true end if subsystem == 'http' then local server_name_str = ffi_new("ngx_str_t[1]") local openssl_error_code = ffi_new("int[1]") local function setclientcert(cosocket, cert, pkey) if not cert and not pkey then cosocket[SOCKET_CLIENT_CERT_INDEX] = nil cosocket[SOCKET_CLIENT_PKEY_INDEX] = nil return true end if not cert or not pkey then return nil, "client certificate must be supplied with corresponding " .. "private key" end if type(cert) ~= "cdata" then return nil, "bad cert arg: cdata expected, got " .. type(cert) end if type(pkey) ~= "cdata" then return nil, "bad pkey arg: cdata expected, got " .. type(pkey) end cosocket[SOCKET_CLIENT_CERT_INDEX] = cert cosocket[SOCKET_CLIENT_PKEY_INDEX] = pkey return true end local function sslhandshake(cosocket, reused_session, server_name, ssl_verify, send_status_req, ...) local n = select("#", ...) if not cosocket or n > 0 then error("ngx.socket sslhandshake: expecting 1 ~ 5 arguments " .. "(including the object), but seen " .. (cosocket and 5 + n or 0)) end local r = get_request() if not r then error("no request found", 2) end session_ptr[0] = type(reused_session) == "cdata" and reused_session or nil if server_name then server_name_str[0].data = server_name server_name_str[0].len = #server_name else server_name_str[0].data = nil server_name_str[0].len = 0 end local u = get_tcp_socket(cosocket) local rc = C.ngx_http_lua_ffi_socket_tcp_sslhandshake(r, u, session_ptr[0], reused_session ~= false, server_name_str, ssl_verify and 1 or 0, send_status_req and 1 or 0, cosocket[SOCKET_CLIENT_CERT_INDEX], cosocket[SOCKET_CLIENT_PKEY_INDEX], errmsg) if rc == FFI_NO_REQ_CTX then error("no request ctx found", 2) end if rc == FFI_OK then if reused_session == false then return true end rc = C.ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result(r, u, session_ptr, errmsg, openssl_error_code) end while true do if rc == FFI_ERROR then if openssl_error_code[0] ~= 0 then return nil, openssl_error_code[0] .. ": " .. ffi_str(errmsg[0]) end return nil, ffi_str(errmsg[0]) end if rc == FFI_DONE then return reused_session end if rc == FFI_OK then if reused_session == false then return true end rc = C.ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result(r, u, session_ptr, errmsg, openssl_error_code) assert(rc == FFI_OK) if session_ptr[0] == nil then return session_ptr[0] end return ffi_gc(session_ptr[0], C.ngx_http_lua_ffi_ssl_free_session) end assert(rc == FFI_AGAIN) co_yield() rc = C.ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result(r, u, session_ptr, errmsg, openssl_error_code) end end local function getsslsession(cosocket) if not cosocket then error("ngx.socket getfd: expecting the cosocket object, but seen none") end local r = get_request() if not r then error("no request found") end local u = get_tcp_socket(cosocket) local rc = C.ngx_http_lua_socket_tcp_get_ssl_session(r, u, session_ptr, errmsg) if rc == FFI_ERROR then return nil, ffi_str(errmsg[0]) end return ffi_gc(session_ptr[0], C.ngx_http_lua_ffi_ssl_free_session) end do local method_table = registry.__tcp_cosocket_mt method_table.getoption = getoption method_table.setoption = setoption method_table.setclientcert = setclientcert if ngx_lua_ffi_socket_tcp_settrustedstore then method_table.settrustedstore = settrustedstore end method_table.sslhandshake = sslhandshake method_table.getfd = getfd method_table.getoption = getoption method_table.setoption = setoption method_table.getsslsession = getsslsession method_table.getsslpointer = getsslpointer method_table.getsslctx = getsslctx method_table = registry.__tcp_req_cosocket_mt method_table.getfd = getfd method_table.getoption = getoption method_table.setoption = setoption method_table = registry.__tcp_raw_req_cosocket_mt method_table.getfd = getfd method_table.getoption = getoption method_table.setoption = setoption end elseif subsystem == 'stream' then do local method_table = registry.__tcp_cosocket_mt method_table.getoption = getoption method_table.setoption = setoption method_table.getfd = getfd method_table.getsslpointer = getsslpointer method_table.getsslctx = getsslctx if ngx_lua_ffi_socket_tcp_settrustedstore then method_table.settrustedstore = settrustedstore end method_table = registry.__tcp_raw_req_cosocket_mt method_table.getfd = getfd method_table.getoption = getoption method_table.setoption = setoption end end return { version = base.version } PK;N]j resty/core/worker.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require "ffi" local jit = require "jit" local base = require "resty.core.base" local ffi_cast = ffi.cast local C = ffi.C local new_tab = base.new_tab local subsystem = ngx.config.subsystem local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local ngx_lua_ffi_worker_id local ngx_lua_ffi_worker_pid local ngx_lua_ffi_worker_pids local ngx_lua_ffi_worker_count local ngx_lua_ffi_worker_exiting local ffi_intp_type = ffi.typeof("int *") local ffi_int_size = ffi.sizeof("int") local is_not_windows = jit.os ~= "Windows" if is_not_windows then ngx.worker = new_tab(0, 5) else ngx.worker = new_tab(0, 4) end if subsystem == "http" then ffi.cdef[[ int ngx_http_lua_ffi_worker_id(void); int ngx_http_lua_ffi_worker_pid(void); int ngx_http_lua_ffi_worker_count(void); int ngx_http_lua_ffi_worker_exiting(void); ]] ngx_lua_ffi_worker_id = C.ngx_http_lua_ffi_worker_id ngx_lua_ffi_worker_pid = C.ngx_http_lua_ffi_worker_pid ngx_lua_ffi_worker_count = C.ngx_http_lua_ffi_worker_count ngx_lua_ffi_worker_exiting = C.ngx_http_lua_ffi_worker_exiting elseif subsystem == "stream" then ffi.cdef[[ int ngx_stream_lua_ffi_worker_id(void); int ngx_stream_lua_ffi_worker_pid(void); int ngx_stream_lua_ffi_worker_count(void); int ngx_stream_lua_ffi_worker_exiting(void); ]] ngx_lua_ffi_worker_id = C.ngx_stream_lua_ffi_worker_id ngx_lua_ffi_worker_pid = C.ngx_stream_lua_ffi_worker_pid ngx_lua_ffi_worker_count = C.ngx_stream_lua_ffi_worker_count ngx_lua_ffi_worker_exiting = C.ngx_stream_lua_ffi_worker_exiting end function ngx.worker.exiting() return ngx_lua_ffi_worker_exiting() ~= 0 end function ngx.worker.pid() return ngx_lua_ffi_worker_pid() end if is_not_windows then if subsystem == "http" then require "resty.core.phase" -- for ngx.get_phase ffi.cdef[[ int ngx_http_lua_ffi_worker_pids(int *pids, size_t *pids_len); ]] ngx_lua_ffi_worker_pids = C.ngx_http_lua_ffi_worker_pids elseif subsystem == "stream" then ffi.cdef[[ int ngx_stream_lua_ffi_worker_pids(int *pids, size_t *pids_len); ]] ngx_lua_ffi_worker_pids = C.ngx_stream_lua_ffi_worker_pids end local tonumber = tonumber local ngx_phase = ngx.get_phase function ngx.worker.pids() local phase = ngx_phase() if phase == "init" or phase == "init_worker" then return nil, "API disabled in the current context" end local pids = {} local size_ptr = get_size_ptr() -- the old and the new workers coexist during reloading local worker_cnt = ngx_lua_ffi_worker_count() * 4 if worker_cnt == 0 then return pids end size_ptr[0] = worker_cnt local pids_ptr = get_string_buf(worker_cnt * ffi_int_size) local intp_buf = ffi_cast(ffi_intp_type, pids_ptr) local res = ngx_lua_ffi_worker_pids(intp_buf, size_ptr) if res == 0 then for i = 1, tonumber(size_ptr[0]) do pids[i] = intp_buf[i - 1] end end return pids end end function ngx.worker.id() local id = ngx_lua_ffi_worker_id() if id < 0 then return nil end return id end function ngx.worker.count() return ngx_lua_ffi_worker_count() end return { _VERSION = base.version } PK;N]@zttresty/core/regex.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require 'ffi' local base = require "resty.core.base" local bit = require "bit" local subsystem = ngx.config.subsystem require "resty.core.time" -- for ngx.now used by resty.lrucache if subsystem == 'http' then require "resty.core.phase" -- for ngx.get_phase end local lrucache = require "resty.lrucache" local lrucache_get = lrucache.get local lrucache_set = lrucache.set local ffi_string = ffi.string local ffi_gc = ffi.gc local ffi_copy = ffi.copy local ffi_cast = ffi.cast local C = ffi.C local bor = bit.bor local band = bit.band local lshift = bit.lshift local sub = string.sub local fmt = string.format local byte = string.byte local ngx = ngx local type = type local tostring = tostring local error = error local setmetatable = setmetatable local tonumber = tonumber local get_string_buf = base.get_string_buf local get_string_buf_size = base.get_string_buf_size local new_tab = base.new_tab local ngx_phase = ngx.get_phase local ngx_log = ngx.log local ngx_NOTICE = ngx.NOTICE local _M = { version = base.version } ngx.re = new_tab(0, 5) local pcre_ver_fn if subsystem == 'http' then ffi.cdef[[ const char *ngx_http_lua_ffi_pcre_version(void); ]] pcre_ver_fn = C.ngx_http_lua_ffi_pcre_version elseif subsystem == 'stream' then ffi.cdef[[ const char *ngx_stream_lua_ffi_pcre_version(void); ]] pcre_ver_fn = C.ngx_stream_lua_ffi_pcre_version else error("unsupported subsystem: " .. tostring(subsystem)) end local pcre_ver if not pcall(function() pcre_ver = ffi_string(pcre_ver_fn()) end) then setmetatable(ngx.re, { __index = function(_, key) error("no support for 'ngx.re." .. key .. "': OpenResty was " .. "compiled without PCRE support", 2) end }) _M.no_pcre = true return _M end local MAX_ERR_MSG_LEN = 256 local FLAG_COMPILE_ONCE = 0x01 local FLAG_DFA = 0x02 local FLAG_JIT = 0x04 local FLAG_DUPNAMES = 0x08 local FLAG_NO_UTF8_CHECK = 0x10 local PCRE_CASELESS = 0x0000001 local PCRE_MULTILINE = 0x0000002 local PCRE_DOTALL = 0x0000004 local PCRE_EXTENDED = 0x0000008 local PCRE_ANCHORED = 0x0000010 local PCRE_UTF8 = 0x0000800 local PCRE_DUPNAMES = 0x0080000 local PCRE_JAVASCRIPT_COMPAT = 0x2000000 -- PCRE2_ERROR_NOMATCH uses the same value local PCRE_ERROR_NOMATCH = -1 local regex_match_cache local regex_sub_func_cache = new_tab(0, 4) local regex_sub_str_cache = new_tab(0, 4) local max_regex_cache_size local regex_cache_size = 0 local script_engine local ngx_lua_ffi_max_regex_cache_size local ngx_lua_ffi_destroy_regex local ngx_lua_ffi_compile_regex local ngx_lua_ffi_exec_regex local ngx_lua_ffi_create_script_engine local ngx_lua_ffi_destroy_script_engine local ngx_lua_ffi_init_script_engine local ngx_lua_ffi_compile_replace_template local ngx_lua_ffi_script_eval_len local ngx_lua_ffi_script_eval_data -- PCRE 8.43 on macOS introduced the MAP_JIT option when creating the memory -- region used to store JIT compiled code, which does not survive across -- `fork()`, causing further usage of PCRE JIT compiler to segfault in worker -- processes. -- -- This flag prevents any regex used in the init phase to be JIT compiled or -- cached when running under macOS, even if the user requests so. Caching is -- thus disabled to prevent further calls of same regex in worker to have poor -- performance. -- -- TODO: improve this workaround when PCRE allows for unspecifying the MAP_JIT -- option. local no_jit_in_init local pcre_ver_num local maj, min = string.match(pcre_ver, "^(%d+)%.(%d+)") if maj and min then pcre_ver_num = tonumber(maj .. min) end if jit.os == "OSX" then if pcre_ver_num == nil then -- assume this version is faulty as well no_jit_in_init = true -- PCRE2 is also subject to this issue on macOS elseif pcre_ver_num >= 843 then no_jit_in_init = true end end -- pcre2 if pcre_ver_num > 845 then -- option PCRE_CASELESS = 0x00000008 PCRE_MULTILINE = 0x00000400 PCRE_DOTALL = 0x00000020 PCRE_EXTENDED = 0x00000080 PCRE_ANCHORED = 0x80000000 PCRE_UTF8 = 0x00080000 PCRE_DUPNAMES = 0x00000040 -- In the pcre2, The PCRE_JAVASCRIPT_COMPAT option has been split into -- independent functional options PCRE2_ALT_BSUX, PCRE2_ALLOW_EMPTY_CLASS, -- and PCRE2_MATCH_UNSET_BACKREF. local PCRE2_ALT_BSUX = 0x00000002 local PCRE2_ALLOW_EMPTY_CLASS = 0x00000001 local PCRE2_MATCH_UNSET_BACKREF = 0x00000200 PCRE_JAVASCRIPT_COMPAT = bor(PCRE2_ALT_BSUX, PCRE2_ALLOW_EMPTY_CLASS) PCRE_JAVASCRIPT_COMPAT = bor(PCRE2_MATCH_UNSET_BACKREF, PCRE_JAVASCRIPT_COMPAT) end if subsystem == 'http' then ffi.cdef[[ typedef struct { ngx_str_t value; void *lengths; void *values; } ngx_http_lua_complex_value_t; typedef struct { void *pool; unsigned char *name_table; int name_count; int name_entry_size; int ncaptures; int *captures; void *regex; void *regex_sd; ngx_http_lua_complex_value_t *replace; const char *pattern; } ngx_http_lua_regex_t; ngx_http_lua_regex_t * ngx_http_lua_ffi_compile_regex(const unsigned char *pat, size_t pat_len, int flags, int pcre_opts, unsigned char *errstr, size_t errstr_size); int ngx_http_lua_ffi_exec_regex(ngx_http_lua_regex_t *re, int flags, const unsigned char *s, size_t len, int pos); void ngx_http_lua_ffi_destroy_regex(ngx_http_lua_regex_t *re); int ngx_http_lua_ffi_compile_replace_template(ngx_http_lua_regex_t *re, const unsigned char *replace_data, size_t replace_len); struct ngx_http_lua_script_engine_s; typedef struct ngx_http_lua_script_engine_s *ngx_http_lua_script_engine_t; ngx_http_lua_script_engine_t *ngx_http_lua_ffi_create_script_engine(void); void ngx_http_lua_ffi_init_script_engine(ngx_http_lua_script_engine_t *e, const unsigned char *subj, ngx_http_lua_regex_t *compiled, int count); void ngx_http_lua_ffi_destroy_script_engine( ngx_http_lua_script_engine_t *e); size_t ngx_http_lua_ffi_script_eval_len(ngx_http_lua_script_engine_t *e, ngx_http_lua_complex_value_t *cv); size_t ngx_http_lua_ffi_script_eval_data(ngx_http_lua_script_engine_t *e, ngx_http_lua_complex_value_t *cv, unsigned char *dst); uint32_t ngx_http_lua_ffi_max_regex_cache_size(void); ]] ngx_lua_ffi_max_regex_cache_size = C.ngx_http_lua_ffi_max_regex_cache_size ngx_lua_ffi_destroy_regex = C.ngx_http_lua_ffi_destroy_regex ngx_lua_ffi_compile_regex = C.ngx_http_lua_ffi_compile_regex ngx_lua_ffi_exec_regex = C.ngx_http_lua_ffi_exec_regex ngx_lua_ffi_create_script_engine = C.ngx_http_lua_ffi_create_script_engine ngx_lua_ffi_init_script_engine = C.ngx_http_lua_ffi_init_script_engine ngx_lua_ffi_destroy_script_engine = C.ngx_http_lua_ffi_destroy_script_engine ngx_lua_ffi_compile_replace_template = C.ngx_http_lua_ffi_compile_replace_template ngx_lua_ffi_script_eval_len = C.ngx_http_lua_ffi_script_eval_len ngx_lua_ffi_script_eval_data = C.ngx_http_lua_ffi_script_eval_data elseif subsystem == 'stream' then ffi.cdef[[ typedef struct { ngx_str_t value; void *lengths; void *values; } ngx_stream_lua_complex_value_t; typedef struct { void *pool; unsigned char *name_table; int name_count; int name_entry_size; int ncaptures; int *captures; void *regex; void *regex_sd; ngx_stream_lua_complex_value_t *replace; const char *pattern; } ngx_stream_lua_regex_t; ngx_stream_lua_regex_t * ngx_stream_lua_ffi_compile_regex(const unsigned char *pat, size_t pat_len, int flags, int pcre_opts, unsigned char *errstr, size_t errstr_size); int ngx_stream_lua_ffi_exec_regex(ngx_stream_lua_regex_t *re, int flags, const unsigned char *s, size_t len, int pos); void ngx_stream_lua_ffi_destroy_regex(ngx_stream_lua_regex_t *re); int ngx_stream_lua_ffi_compile_replace_template(ngx_stream_lua_regex_t *re, const unsigned char *replace_data, size_t replace_len); struct ngx_stream_lua_script_engine_s; typedef struct ngx_stream_lua_script_engine_s *ngx_stream_lua_script_engine_t; ngx_stream_lua_script_engine_t * ngx_stream_lua_ffi_create_script_engine(void); void ngx_stream_lua_ffi_init_script_engine( ngx_stream_lua_script_engine_t *e, const unsigned char *subj, ngx_stream_lua_regex_t *compiled, int count); void ngx_stream_lua_ffi_destroy_script_engine( ngx_stream_lua_script_engine_t *e); size_t ngx_stream_lua_ffi_script_eval_len( ngx_stream_lua_script_engine_t *e, ngx_stream_lua_complex_value_t *cv); size_t ngx_stream_lua_ffi_script_eval_data( ngx_stream_lua_script_engine_t *e, ngx_stream_lua_complex_value_t *cv, unsigned char *dst); uint32_t ngx_stream_lua_ffi_max_regex_cache_size(void); ]] ngx_lua_ffi_max_regex_cache_size = C.ngx_stream_lua_ffi_max_regex_cache_size ngx_lua_ffi_destroy_regex = C.ngx_stream_lua_ffi_destroy_regex ngx_lua_ffi_compile_regex = C.ngx_stream_lua_ffi_compile_regex ngx_lua_ffi_exec_regex = C.ngx_stream_lua_ffi_exec_regex ngx_lua_ffi_create_script_engine = C.ngx_stream_lua_ffi_create_script_engine ngx_lua_ffi_init_script_engine = C.ngx_stream_lua_ffi_init_script_engine ngx_lua_ffi_destroy_script_engine = C.ngx_stream_lua_ffi_destroy_script_engine ngx_lua_ffi_compile_replace_template = C.ngx_stream_lua_ffi_compile_replace_template ngx_lua_ffi_script_eval_len = C.ngx_stream_lua_ffi_script_eval_len ngx_lua_ffi_script_eval_data = C.ngx_stream_lua_ffi_script_eval_data end local c_str_type = ffi.typeof("const char *") local cached_re_opts = new_tab(0, 4) local buf_grow_ratio = 2 function _M.set_buf_grow_ratio(ratio) buf_grow_ratio = ratio end local function get_max_regex_cache_size() if max_regex_cache_size then return max_regex_cache_size end max_regex_cache_size = ngx_lua_ffi_max_regex_cache_size() return max_regex_cache_size end local regex_cache_is_empty = true function _M.is_regex_cache_empty() return regex_cache_is_empty end local function lrucache_set_wrapper(...) regex_cache_is_empty = false lrucache_set(...) end local parse_regex_opts = function (opts) local t = cached_re_opts[opts] if t then return t[1], t[2] end local flags = 0 local pcre_opts = 0 local len = #opts for i = 1, len do local opt = byte(opts, i) if opt == byte("o") then flags = bor(flags, FLAG_COMPILE_ONCE) elseif opt == byte("j") then flags = bor(flags, FLAG_JIT) elseif opt == byte("i") then pcre_opts = bor(pcre_opts, PCRE_CASELESS) elseif opt == byte("s") then pcre_opts = bor(pcre_opts, PCRE_DOTALL) elseif opt == byte("m") then pcre_opts = bor(pcre_opts, PCRE_MULTILINE) elseif opt == byte("u") then pcre_opts = bor(pcre_opts, PCRE_UTF8) elseif opt == byte("U") then pcre_opts = bor(pcre_opts, PCRE_UTF8) flags = bor(flags, FLAG_NO_UTF8_CHECK) elseif opt == byte("x") then pcre_opts = bor(pcre_opts, PCRE_EXTENDED) elseif opt == byte("d") then flags = bor(flags, FLAG_DFA) elseif opt == byte("a") then pcre_opts = bor(pcre_opts, PCRE_ANCHORED) elseif opt == byte("D") then pcre_opts = bor(pcre_opts, PCRE_DUPNAMES) flags = bor(flags, FLAG_DUPNAMES) elseif opt == byte("J") then pcre_opts = bor(pcre_opts, PCRE_JAVASCRIPT_COMPAT) else error(fmt('unknown flag "%s" (flags "%s")', sub(opts, i, i), opts), 3) end end cached_re_opts[opts] = {flags, pcre_opts} return flags, pcre_opts end if no_jit_in_init then local parse_regex_opts_ = parse_regex_opts parse_regex_opts = function (opts) if ngx_phase() ~= "init" then -- past init_by_lua* phase now parse_regex_opts = parse_regex_opts_ return parse_regex_opts(opts) end local t = cached_re_opts[opts] if t then return t[1], t[2] end local flags = 0 local pcre_opts = 0 local len = #opts for i = 1, len do local opt = byte(opts, i) if opt == byte("o") then ngx_log(ngx_NOTICE, "regex compilation cache disabled in init ", "phase under macOS") elseif opt == byte("j") then ngx_log(ngx_NOTICE, "regex compilation disabled in init ", "phase under macOS") elseif opt == byte("i") then pcre_opts = bor(pcre_opts, PCRE_CASELESS) elseif opt == byte("s") then pcre_opts = bor(pcre_opts, PCRE_DOTALL) elseif opt == byte("m") then pcre_opts = bor(pcre_opts, PCRE_MULTILINE) elseif opt == byte("u") then pcre_opts = bor(pcre_opts, PCRE_UTF8) elseif opt == byte("U") then pcre_opts = bor(pcre_opts, PCRE_UTF8) flags = bor(flags, FLAG_NO_UTF8_CHECK) elseif opt == byte("x") then pcre_opts = bor(pcre_opts, PCRE_EXTENDED) elseif opt == byte("d") then flags = bor(flags, FLAG_DFA) elseif opt == byte("a") then pcre_opts = bor(pcre_opts, PCRE_ANCHORED) elseif opt == byte("D") then pcre_opts = bor(pcre_opts, PCRE_DUPNAMES) flags = bor(flags, FLAG_DUPNAMES) elseif opt == byte("J") then pcre_opts = bor(pcre_opts, PCRE_JAVASCRIPT_COMPAT) else error(fmt('unknown flag "%s" (flags "%s")', sub(opts, i, i), opts), 3) end end cached_re_opts[opts] = {flags, pcre_opts} return flags, pcre_opts end end local function collect_named_captures(compiled, flags, res) local name_count = compiled.name_count local name_table = compiled.name_table local entry_size = compiled.name_entry_size local ind = 0 local dup_names = (band(flags, FLAG_DUPNAMES) ~= 0) for i = 1, name_count do local n = bor(lshift(name_table[ind], 8), name_table[ind + 1]) -- ngx.say("n = ", n) local name = ffi_string(name_table + ind + 2) local cap = res[n] if dup_names then -- unmatched captures (false) are not collected if cap then local old = res[name] if old then old[#old + 1] = cap else res[name] = {cap} end end else res[name] = cap end ind = ind + entry_size end end local function collect_captures(compiled, rc, subj, flags, res) local cap = compiled.captures local ncap = compiled.ncaptures local name_count = compiled.name_count if not res then res = new_tab(ncap, name_count) end local i = 0 local n = 0 while i <= ncap do if i > rc then res[i] = false else local from = cap[n] if from >= 0 then local to = cap[n + 1] res[i] = sub(subj, from + 1, to) else res[i] = false end end i = i + 1 n = n + 2 end if name_count > 0 then collect_named_captures(compiled, flags, res) end return res end _M.collect_captures = collect_captures local function destroy_compiled_regex(compiled) ngx_lua_ffi_destroy_regex(ffi_gc(compiled, nil)) end _M.destroy_compiled_regex = destroy_compiled_regex local function re_match_compile(regex, opts) local flags = 0 local pcre_opts = 0 if opts then flags, pcre_opts = parse_regex_opts(opts) else opts = "" end local compiled, key local compile_once = (band(flags, FLAG_COMPILE_ONCE) == 1) -- FIXME: better put this in the outer scope when fixing the ngx.re API's -- compatibility in the init_by_lua* context. if not regex_match_cache then local sz = get_max_regex_cache_size() if sz <= 0 then compile_once = false else regex_match_cache = lrucache.new(sz) end end if compile_once then key = regex .. '\0' .. opts compiled = lrucache_get(regex_match_cache, key) end -- compile the regex if compiled == nil then -- print("compiled regex not found, compiling regex...") local errbuf = get_string_buf(MAX_ERR_MSG_LEN) compiled = ngx_lua_ffi_compile_regex(regex, #regex, flags, pcre_opts, errbuf, MAX_ERR_MSG_LEN) if compiled == nil then return nil, ffi_string(errbuf) end ffi_gc(compiled, ngx_lua_ffi_destroy_regex) -- print("ncaptures: ", compiled.ncaptures) if compile_once then -- print("inserting compiled regex into cache") lrucache_set_wrapper(regex_match_cache, key, compiled) end end return compiled, compile_once, flags end _M.re_match_compile = re_match_compile local function re_match_helper(subj, regex, opts, ctx, want_caps, res, nth) -- we need to cast this to strings to avoid exceptions when they are -- something else. subj = tostring(subj) local compiled, compile_once, flags = re_match_compile(regex, opts) if compiled == nil then -- compiled_once holds the error string if not want_caps then return nil, nil, compile_once end return nil, compile_once end -- exec the compiled regex local rc do local pos if ctx then pos = ctx.pos if not pos or pos <= 0 then pos = 0 else pos = pos - 1 end else pos = 0 end rc = ngx_lua_ffi_exec_regex(compiled, flags, subj, #subj, pos) end if rc == PCRE_ERROR_NOMATCH then if not compile_once then destroy_compiled_regex(compiled) end return nil end if rc < 0 then if not compile_once then destroy_compiled_regex(compiled) end if not want_caps then return nil, nil, "pcre_exec() failed: " .. rc end return nil, "pcre_exec() failed: " .. rc end if rc == 0 then if band(flags, FLAG_DFA) == 0 then if not want_caps then return nil, nil, "capture size too small" end return nil, "capture size too small" end rc = 1 end -- print("cap 0: ", compiled.captures[0]) -- print("cap 1: ", compiled.captures[1]) if ctx then ctx.pos = compiled.captures[1] + 1 end if not want_caps then if not nth or nth < 0 then nth = 0 end if nth > compiled.ncaptures then return nil, nil, "nth out of bound" end if nth >= rc then return nil, nil end local from = compiled.captures[nth * 2] + 1 local to = compiled.captures[nth * 2 + 1] if from < 0 or to < 0 then return nil, nil end return from, to end res = collect_captures(compiled, rc, subj, flags, res) if not compile_once then destroy_compiled_regex(compiled) end return res end function ngx.re.match(subj, regex, opts, ctx, res) return re_match_helper(subj, regex, opts, ctx, true, res) end function ngx.re.find(subj, regex, opts, ctx, nth) return re_match_helper(subj, regex, opts, ctx, false, nil, nth) end do local function destroy_re_gmatch_iterator(iterator) if not iterator._compile_once then destroy_compiled_regex(iterator._compiled) end iterator._compiled = nil iterator._pos = nil iterator._subj = nil end local function iterate_re_gmatch(self) local compiled = self._compiled local subj = self._subj local subj_len = self._subj_len local flags = self._flags local pos = self._pos if not pos then -- The iterator is exhausted. return nil end local rc = ngx_lua_ffi_exec_regex(compiled, flags, subj, subj_len, pos) if rc == PCRE_ERROR_NOMATCH then destroy_re_gmatch_iterator(self) return nil end if rc < 0 then destroy_re_gmatch_iterator(self) return nil, "pcre_exec() failed: " .. rc end if rc == 0 then if band(flags, FLAG_DFA) == 0 then destroy_re_gmatch_iterator(self) return nil, "capture size too small" end rc = 1 end local cp_pos = tonumber(compiled.captures[1]) if cp_pos == compiled.captures[0] then cp_pos = cp_pos + 1 if cp_pos > subj_len then local res = collect_captures(compiled, rc, subj, flags) destroy_re_gmatch_iterator(self) return res end end self._pos = cp_pos return collect_captures(compiled, rc, subj, flags) end local re_gmatch_iterator_mt = { __call = iterate_re_gmatch } function ngx.re.gmatch(subj, regex, opts) subj = tostring(subj) local compiled, compile_once, flags = re_match_compile(regex, opts) if compiled == nil then -- compiled_once holds the error string return nil, compile_once end local re_gmatch_iterator = { _compiled = compiled, _compile_once = compile_once, _subj = subj, _subj_len = #subj, _flags = flags, _pos = 0, } return setmetatable(re_gmatch_iterator, re_gmatch_iterator_mt) end end -- do local function new_script_engine(subj, compiled, count) if not script_engine then script_engine = ngx_lua_ffi_create_script_engine() if script_engine == nil then return nil end ffi_gc(script_engine, ngx_lua_ffi_destroy_script_engine) end ngx_lua_ffi_init_script_engine(script_engine, subj, compiled, count) return script_engine end local function check_buf_size(buf, buf_size, pos, len, new_len, must_alloc) if new_len > buf_size then buf_size = buf_size * buf_grow_ratio if buf_size < new_len then buf_size = new_len end local new_buf = get_string_buf(buf_size, must_alloc) ffi_copy(new_buf, buf, len) buf = new_buf pos = buf + len end return buf, buf_size, pos, new_len end _M.check_buf_size = check_buf_size local function re_sub_compile(regex, opts, replace, func) local flags = 0 local pcre_opts = 0 if opts then flags, pcre_opts = parse_regex_opts(opts) else opts = "" end local compiled local compile_once = (band(flags, FLAG_COMPILE_ONCE) == 1) if compile_once then if func then local subcache = regex_sub_func_cache[opts] if subcache then -- print("cache hit!") compiled = subcache[regex] end else local subcache = regex_sub_str_cache[opts] if subcache then local subsubcache = subcache[regex] if subsubcache then -- print("cache hit!") compiled = subsubcache[replace] end end end end -- compile the regex if compiled == nil then -- print("compiled regex not found, compiling regex...") local errbuf = get_string_buf(MAX_ERR_MSG_LEN) compiled = ngx_lua_ffi_compile_regex(regex, #regex, flags, pcre_opts, errbuf, MAX_ERR_MSG_LEN) if compiled == nil then return nil, ffi_string(errbuf) end ffi_gc(compiled, ngx_lua_ffi_destroy_regex) if func == nil then local rc = ngx_lua_ffi_compile_replace_template(compiled, replace, #replace) if rc ~= 0 then if not compile_once then destroy_compiled_regex(compiled) end return nil, "failed to compile the replacement template" end end -- print("ncaptures: ", compiled.ncaptures) if compile_once then if regex_cache_size < get_max_regex_cache_size() then -- print("inserting compiled regex into cache") if func then local subcache = regex_sub_func_cache[opts] if not subcache then regex_sub_func_cache[opts] = {[regex] = compiled} else subcache[regex] = compiled end else local subcache = regex_sub_str_cache[opts] if not subcache then regex_sub_str_cache[opts] = {[regex] = {[replace] = compiled}} else local subsubcache = subcache[regex] if not subsubcache then subcache[regex] = {[replace] = compiled} else subsubcache[replace] = compiled end end end regex_cache_size = regex_cache_size + 1 else compile_once = false end end end return compiled, compile_once, flags end _M.re_sub_compile = re_sub_compile local function re_sub_func_helper(subj, regex, replace, opts, global) local compiled, compile_once, flags = re_sub_compile(regex, opts, nil, replace) if not compiled then -- error string is in compile_once return nil, nil, compile_once end -- exec the compiled regex subj = tostring(subj) local subj_len = #subj local count = 0 local pos = 0 local cp_pos = 0 local dst_buf_size = get_string_buf_size() -- Note: we have to always allocate the string buffer because -- the user might call whatever resty.core's API functions recursively -- in the user callback function. local dst_buf = get_string_buf(dst_buf_size, true) local dst_pos = dst_buf local dst_len = 0 while true do local rc = ngx_lua_ffi_exec_regex(compiled, flags, subj, subj_len, pos) if rc == PCRE_ERROR_NOMATCH then break end if rc < 0 then if not compile_once then destroy_compiled_regex(compiled) end return nil, nil, "pcre_exec() failed: " .. rc end if rc == 0 then if band(flags, FLAG_DFA) == 0 then if not compile_once then destroy_compiled_regex(compiled) end return nil, nil, "capture size too small" end rc = 1 end count = count + 1 local prefix_len = compiled.captures[0] - cp_pos local res = collect_captures(compiled, rc, subj, flags) local piece = tostring(replace(res)) local piece_len = #piece local new_dst_len = dst_len + prefix_len + piece_len dst_buf, dst_buf_size, dst_pos, dst_len = check_buf_size(dst_buf, dst_buf_size, dst_pos, dst_len, new_dst_len, true) if prefix_len > 0 then ffi_copy(dst_pos, ffi_cast(c_str_type, subj) + cp_pos, prefix_len) dst_pos = dst_pos + prefix_len end if piece_len > 0 then ffi_copy(dst_pos, piece, piece_len) dst_pos = dst_pos + piece_len end cp_pos = compiled.captures[1] pos = cp_pos if pos == compiled.captures[0] then pos = pos + 1 if pos > subj_len then break end end if not global then break end end if not compile_once then destroy_compiled_regex(compiled) end if count > 0 then if cp_pos < subj_len then local suffix_len = subj_len - cp_pos local new_dst_len = dst_len + suffix_len local _ dst_buf, _, dst_pos, dst_len = check_buf_size(dst_buf, dst_buf_size, dst_pos, dst_len, new_dst_len, true) ffi_copy(dst_pos, ffi_cast(c_str_type, subj) + cp_pos, suffix_len) end return ffi_string(dst_buf, dst_len), count end return subj, 0 end local function re_sub_str_helper(subj, regex, replace, opts, global) local compiled, compile_once, flags = re_sub_compile(regex, opts, replace, nil) if not compiled then -- error string is in compile_once return nil, nil, compile_once end -- exec the compiled regex subj = tostring(subj) local subj_len = #subj local count = 0 local pos = 0 local cp_pos = 0 local dst_buf_size = get_string_buf_size() local dst_buf = get_string_buf(dst_buf_size) local dst_pos = dst_buf local dst_len = 0 while true do local rc = ngx_lua_ffi_exec_regex(compiled, flags, subj, subj_len, pos) if rc == PCRE_ERROR_NOMATCH then break end if rc < 0 then if not compile_once then destroy_compiled_regex(compiled) end return nil, nil, "pcre_exec() failed: " .. rc end if rc == 0 then if band(flags, FLAG_DFA) == 0 then if not compile_once then destroy_compiled_regex(compiled) end return nil, nil, "capture size too small" end rc = 1 end count = count + 1 local prefix_len = compiled.captures[0] - cp_pos local cv = compiled.replace if cv.lengths ~= nil then local e = new_script_engine(subj, compiled, rc) if e == nil then return nil, nil, "failed to create script engine" end local bit_len = ngx_lua_ffi_script_eval_len(e, cv) local new_dst_len = dst_len + prefix_len + bit_len dst_buf, dst_buf_size, dst_pos, dst_len = check_buf_size(dst_buf, dst_buf_size, dst_pos, dst_len, new_dst_len) if prefix_len > 0 then ffi_copy(dst_pos, ffi_cast(c_str_type, subj) + cp_pos, prefix_len) dst_pos = dst_pos + prefix_len end if bit_len > 0 then ngx_lua_ffi_script_eval_data(e, cv, dst_pos) dst_pos = dst_pos + bit_len end else local bit_len = cv.value.len dst_buf, dst_buf_size, dst_pos, dst_len = check_buf_size(dst_buf, dst_buf_size, dst_pos, dst_len, dst_len + prefix_len + bit_len) if prefix_len > 0 then ffi_copy(dst_pos, ffi_cast(c_str_type, subj) + cp_pos, prefix_len) dst_pos = dst_pos + prefix_len end if bit_len > 0 then ffi_copy(dst_pos, cv.value.data, bit_len) dst_pos = dst_pos + bit_len end end cp_pos = compiled.captures[1] pos = cp_pos if pos == compiled.captures[0] then pos = pos + 1 if pos > subj_len then break end end if not global then break end end if not compile_once then destroy_compiled_regex(compiled) end if count > 0 then if cp_pos < subj_len then local suffix_len = subj_len - cp_pos local new_dst_len = dst_len + suffix_len local _ dst_buf, _, dst_pos, dst_len = check_buf_size(dst_buf, dst_buf_size, dst_pos, dst_len, new_dst_len) ffi_copy(dst_pos, ffi_cast(c_str_type, subj) + cp_pos, suffix_len) end return ffi_string(dst_buf, dst_len), count end return subj, 0 end local function re_sub_helper(subj, regex, replace, opts, global) local repl_type = type(replace) if repl_type == "function" then return re_sub_func_helper(subj, regex, replace, opts, global) end if repl_type ~= "string" then replace = tostring(replace) end return re_sub_str_helper(subj, regex, replace, opts, global) end function ngx.re.sub(subj, regex, replace, opts) return re_sub_helper(subj, regex, replace, opts, false) end function ngx.re.gsub(subj, regex, replace, opts) return re_sub_helper(subj, regex, replace, opts, true) end return _M PK;N]resty/core/response.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require 'ffi' local base = require "resty.core.base" local C = ffi.C local ffi_cast = ffi.cast local ffi_str = ffi.string local new_tab = base.new_tab local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX local FFI_DECLINED = base.FFI_DECLINED local get_string_buf = base.get_string_buf local setmetatable = setmetatable local type = type local tostring = tostring local get_request = base.get_request local error = error local ngx = ngx local _M = { version = base.version } local MAX_HEADER_VALUES = 100 local errmsg = base.get_errmsg_ptr() local ffi_str_type = ffi.typeof("ngx_http_lua_ffi_str_t*") local ffi_str_size = ffi.sizeof("ngx_http_lua_ffi_str_t") ffi.cdef[[ int ngx_http_lua_ffi_set_resp_header(ngx_http_request_t *r, const char *key_data, size_t key_len, int is_nil, const char *sval, size_t sval_len, ngx_http_lua_ffi_str_t *mvals, size_t mvals_len, int override, char **errmsg); int ngx_http_lua_ffi_get_resp_header(ngx_http_request_t *r, const unsigned char *key, size_t key_len, unsigned char *key_buf, ngx_http_lua_ffi_str_t *values, int max_nvalues, char **errmsg); int ngx_http_lua_ffi_bypass_if_checks(ngx_http_request_t *r); ]] local ngx_lua_ffi_set_resp_header local MACOS = jit and jit.os == "OSX" if MACOS then ffi.cdef[[ typedef struct { ngx_http_request_t *r; const char *key_data; size_t key_len; int is_nil; const char *sval; size_t sval_len; void *mvals; size_t mvals_len; int override; char **errmsg; } ngx_http_lua_set_resp_header_params_t; int ngx_http_lua_ffi_set_resp_header_macos( ngx_http_lua_set_resp_header_params_t *p); ]] local set_params = ffi.new("ngx_http_lua_set_resp_header_params_t") ngx_lua_ffi_set_resp_header = function(r, key, key_len, is_nil, sval, sval_len, mvals, mvals_len, override, err) set_params.r = r set_params.key_data = key set_params.key_len = key_len set_params.is_nil = is_nil set_params.sval = sval set_params.sval_len = sval_len set_params.mvals = mvals set_params.mvals_len = mvals_len set_params.override = override set_params.errmsg = err return C.ngx_http_lua_ffi_set_resp_header_macos(set_params) end else ngx_lua_ffi_set_resp_header = function(r, key, key_len, is_nil, sval, sval_len, mvals, mvals_len, override, err) return C.ngx_http_lua_ffi_set_resp_header(r, key, key_len, is_nil, sval, sval_len, mvals, mvals_len, override, err) end end local function set_resp_header(tb, key, value, no_override) local r = get_request() if not r then error("no request found") end if type(key) ~= "string" then key = tostring(key) end local rc if value == nil then if no_override then error("invalid header value", 3) end rc = ngx_lua_ffi_set_resp_header(r, key, #key, true, nil, 0, nil, 0, 1, errmsg) else local sval, sval_len, mvals, mvals_len, buf if type(value) == "table" then mvals_len = #value if mvals_len == 0 and no_override then return end buf = get_string_buf(ffi_str_size * mvals_len) mvals = ffi_cast(ffi_str_type, buf) for i = 1, mvals_len do local s = value[i] if type(s) ~= "string" then s = tostring(s) value[i] = s end local str = mvals[i - 1] str.data = s str.len = #s end sval_len = 0 else if type(value) ~= "string" then sval = tostring(value) else sval = value end sval_len = #sval mvals_len = 0 end local override_int = no_override and 0 or 1 rc = ngx_lua_ffi_set_resp_header(r, key, #key, false, sval, sval_len, mvals, mvals_len, override_int, errmsg) end if rc == 0 or rc == FFI_DECLINED then return end if rc == FFI_NO_REQ_CTX then error("no request ctx found") end if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end -- rc == FFI_ERROR error(ffi_str(errmsg[0]), 2) end _M.set_resp_header = set_resp_header local function get_resp_header(tb, key) local r = get_request() if not r then error("no request found") end if type(key) ~= "string" then key = tostring(key) end local key_len = #key local key_buf = get_string_buf(key_len + ffi_str_size * MAX_HEADER_VALUES) local values = ffi_cast(ffi_str_type, key_buf + key_len) local n = C.ngx_http_lua_ffi_get_resp_header(r, key, key_len, key_buf, values, MAX_HEADER_VALUES, errmsg) -- print("retval: ", n) if n == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end if n == 0 then return nil end if n == 1 then local v = values[0] return ffi_str(v.data, v.len) end if n > 0 then local ret = new_tab(n, 0) for i = 1, n do local v = values[i - 1] ret[i] = ffi_str(v.data, v.len) end return ret end -- n == FFI_ERROR error(ffi_str(errmsg[0]), 2) end local function bypass_if_checks() local r = get_request() if not r then error("no request found") end C.ngx_http_lua_ffi_bypass_if_checks(r) end _M.bypass_if_checks = bypass_if_checks do local mt = new_tab(0, 2) mt.__newindex = set_resp_header mt.__index = get_resp_header ngx.header = setmetatable(new_tab(0, 0), mt) end return _M PK;N]`tresty/core/misc.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" local ffi = require "ffi" local os = require "os" local C = ffi.C local ffi_new = ffi.new local ffi_str = ffi.string local ngx = ngx local type = type local error = error local rawget = rawget local rawset = rawset local tonumber = tonumber local setmetatable = setmetatable local FFI_OK = base.FFI_OK local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT local new_tab = base.new_tab local get_request = base.get_request local get_size_ptr = base.get_size_ptr local get_string_buf = base.get_string_buf local get_string_buf_size = base.get_string_buf_size local subsystem = ngx.config.subsystem local ngx_lua_ffi_get_resp_status local ngx_lua_ffi_get_conf_env local ngx_magic_key_getters local ngx_magic_key_setters local _M = new_tab(0, 3) local ngx_mt = new_tab(0, 2) if subsystem == "http" then ngx_magic_key_getters = new_tab(0, 4) ngx_magic_key_setters = new_tab(0, 2) elseif subsystem == "stream" then ngx_magic_key_getters = new_tab(0, 2) ngx_magic_key_setters = new_tab(0, 1) end local function register_getter(key, func) ngx_magic_key_getters[key] = func end _M.register_ngx_magic_key_getter = register_getter local function register_setter(key, func) ngx_magic_key_setters[key] = func end _M.register_ngx_magic_key_setter = register_setter ngx_mt.__index = function (tb, key) local f = ngx_magic_key_getters[key] if f then return f() end return rawget(tb, key) end ngx_mt.__newindex = function (tb, key, ctx) local f = ngx_magic_key_setters[key] if f then return f(ctx) end return rawset(tb, key, ctx) end setmetatable(ngx, ngx_mt) if subsystem == "http" then ffi.cdef[[ int ngx_http_lua_ffi_get_resp_status(ngx_http_request_t *r); int ngx_http_lua_ffi_set_resp_status(ngx_http_request_t *r, int r); int ngx_http_lua_ffi_is_subrequest(ngx_http_request_t *r); int ngx_http_lua_ffi_headers_sent(ngx_http_request_t *r); int ngx_http_lua_ffi_get_conf_env(const unsigned char *name, unsigned char **env_buf, size_t *name_len); int ngx_http_lua_ffi_req_is_internal(ngx_http_request_t *r); ]] ngx_lua_ffi_get_resp_status = C.ngx_http_lua_ffi_get_resp_status ngx_lua_ffi_get_conf_env = C.ngx_http_lua_ffi_get_conf_env -- ngx.status local function set_status(status) local r = get_request() if not r then error("no request found") end if type(status) ~= 'number' then status = tonumber(status) end local rc = C.ngx_http_lua_ffi_set_resp_status(r, status) if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end end register_setter("status", set_status) -- ngx.is_subrequest local function is_subreq() local r = get_request() if not r then error("no request found") end local rc = C.ngx_http_lua_ffi_is_subrequest(r) if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end return rc == 1 end register_getter("is_subrequest", is_subreq) -- ngx.headers_sent local function headers_sent() local r = get_request() if not r then error("no request found") end local rc = C.ngx_http_lua_ffi_headers_sent(r) if rc == FFI_NO_REQ_CTX then error("no request ctx found") end if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end return rc == 1 end register_getter("headers_sent", headers_sent) -- ngx.req.is_internal function ngx.req.is_internal() local r = get_request() if not r then error("no request found") end local rc = C.ngx_http_lua_ffi_req_is_internal(r) if rc == FFI_BAD_CONTEXT then error("API disabled in the current context") end return rc == 1 end elseif subsystem == "stream" then ffi.cdef[[ int ngx_stream_lua_ffi_get_resp_status(ngx_stream_lua_request_t *r); int ngx_stream_lua_ffi_get_conf_env(const unsigned char *name, unsigned char **env_buf, size_t *name_len); ]] ngx_lua_ffi_get_resp_status = C.ngx_stream_lua_ffi_get_resp_status ngx_lua_ffi_get_conf_env = C.ngx_stream_lua_ffi_get_conf_env end -- ngx.status local function get_status() local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_get_resp_status(r) if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end return rc end register_getter("status", get_status) do local _getenv = os.getenv local env_ptr = ffi_new("unsigned char *[1]") os.getenv = function (name) local r = get_request() if r then -- past init_by_lua* phase now os.getenv = _getenv env_ptr = nil return os.getenv(name) end local size = get_string_buf_size() env_ptr[0] = get_string_buf(size) local name_len_ptr = get_size_ptr() local rc = ngx_lua_ffi_get_conf_env(name, env_ptr, name_len_ptr) if rc == FFI_OK then return ffi_str(env_ptr[0] + name_len_ptr[0] + 1) end -- FFI_DECLINED local value = _getenv(name) if value ~= nil then return value end return nil end end _M._VERSION = base.version return _M PK;N]0uUresty/core/ctx.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require "ffi" local debug = require "debug" local base = require "resty.core.base" local misc = require "resty.core.misc" local C = ffi.C local register_getter = misc.register_ngx_magic_key_getter local register_setter = misc.register_ngx_magic_key_setter local registry = debug.getregistry() local new_tab = base.new_tab local ref_in_table = base.ref_in_table local unref_in_table = base.unref_in_table local get_request = base.get_request local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX local FFI_OK = base.FFI_OK local error = error local setmetatable = setmetatable local type = type local subsystem = ngx.config.subsystem local ngx_lua_ffi_get_ctx_ref local ngx_lua_ffi_set_ctx_ref if subsystem == "http" then ffi.cdef[[ int ngx_http_lua_ffi_get_ctx_ref(ngx_http_request_t *r, int *in_ssl_phase, int *ssl_ctx_ref); int ngx_http_lua_ffi_set_ctx_ref(ngx_http_request_t *r, int ref); ]] ngx_lua_ffi_get_ctx_ref = C.ngx_http_lua_ffi_get_ctx_ref ngx_lua_ffi_set_ctx_ref = C.ngx_http_lua_ffi_set_ctx_ref elseif subsystem == "stream" then ffi.cdef[[ int ngx_stream_lua_ffi_get_ctx_ref(ngx_stream_lua_request_t *r, int *in_ssl_phase, int *ssl_ctx_ref); int ngx_stream_lua_ffi_set_ctx_ref(ngx_stream_lua_request_t *r, int ref); ]] ngx_lua_ffi_get_ctx_ref = C.ngx_stream_lua_ffi_get_ctx_ref ngx_lua_ffi_set_ctx_ref = C.ngx_stream_lua_ffi_set_ctx_ref end local _M = { _VERSION = base.version } -- use a new ctxs table to make LuaJIT JIT compiler happy to generate more -- efficient machine code. local ctxs = {} registry.ngx_lua_ctx_tables = ctxs local get_ctx_table do local in_ssl_phase = ffi.new("int[1]") local ssl_ctx_ref = ffi.new("int[1]") function get_ctx_table(ctx) local r = get_request() if not r then error("no request found") end local ctx_ref = ngx_lua_ffi_get_ctx_ref(r, in_ssl_phase, ssl_ctx_ref) if ctx_ref == FFI_NO_REQ_CTX then error("no request ctx found") end if ctx_ref < 0 then ctx_ref = ssl_ctx_ref[0] if ctx_ref > 0 and ctxs[ctx_ref] then if in_ssl_phase[0] ~= 0 then return ctxs[ctx_ref] end if not ctx then ctx = new_tab(0, 4) end ctx = setmetatable(ctx, ctxs[ctx_ref]) else if in_ssl_phase[0] ~= 0 then if not ctx then ctx = new_tab(1, 4) end -- to avoid creating another table, we assume the users -- won't overwrite the `__index` key ctx.__index = ctx elseif not ctx then ctx = new_tab(0, 4) end end ctx_ref = ref_in_table(ctxs, ctx) if ngx_lua_ffi_set_ctx_ref(r, ctx_ref) ~= FFI_OK then unref_in_table(ctxs, ctx_ref) return nil end return ctx end return ctxs[ctx_ref] end end register_getter("ctx", get_ctx_table) _M.get_ctx_table = get_ctx_table local function set_ctx_table(ctx) local ctx_type = type(ctx) if ctx_type ~= "table" then error("ctx should be a table while getting a " .. ctx_type) end local r = get_request() if not r then error("no request found") end local ctx_ref = ngx_lua_ffi_get_ctx_ref(r, nil, nil) if ctx_ref == FFI_NO_REQ_CTX then error("no request ctx found") end if ctx_ref < 0 then ctx_ref = ref_in_table(ctxs, ctx) if ngx_lua_ffi_set_ctx_ref(r, ctx_ref) ~= FFI_OK then unref_in_table(ctxs, ctx_ref) error("no memory") end return end ctxs[ctx_ref] = ctx end register_setter("ctx", set_ctx_table) return _M PK;N]7resty/core/time.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require 'ffi' local base = require "resty.core.base" local error = error local tonumber = tonumber local type = type local C = ffi.C local ffi_new = ffi.new local ffi_str = ffi.string local time_val = ffi_new("long[1]") local get_string_buf = base.get_string_buf local ngx = ngx local FFI_ERROR = base.FFI_ERROR local subsystem = ngx.config.subsystem local ngx_lua_ffi_now local ngx_lua_ffi_time local ngx_lua_ffi_monotonic_msec local ngx_lua_ffi_today local ngx_lua_ffi_localtime local ngx_lua_ffi_utctime local ngx_lua_ffi_update_time if subsystem == 'http' then ffi.cdef[[ double ngx_http_lua_ffi_now(void); long ngx_http_lua_ffi_time(void); long ngx_http_lua_ffi_monotonic_msec(void); void ngx_http_lua_ffi_today(unsigned char *buf); void ngx_http_lua_ffi_localtime(unsigned char *buf); void ngx_http_lua_ffi_utctime(unsigned char *buf); void ngx_http_lua_ffi_update_time(void); int ngx_http_lua_ffi_cookie_time(unsigned char *buf, long t); void ngx_http_lua_ffi_http_time(unsigned char *buf, long t); void ngx_http_lua_ffi_parse_http_time(const unsigned char *str, size_t len, long *time); ]] ngx_lua_ffi_now = C.ngx_http_lua_ffi_now ngx_lua_ffi_time = C.ngx_http_lua_ffi_time ngx_lua_ffi_monotonic_msec = C.ngx_http_lua_ffi_monotonic_msec ngx_lua_ffi_today = C.ngx_http_lua_ffi_today ngx_lua_ffi_localtime = C.ngx_http_lua_ffi_localtime ngx_lua_ffi_utctime = C.ngx_http_lua_ffi_utctime ngx_lua_ffi_update_time = C.ngx_http_lua_ffi_update_time elseif subsystem == 'stream' then ffi.cdef[[ double ngx_stream_lua_ffi_now(void); long ngx_stream_lua_ffi_time(void); long ngx_stream_lua_ffi_monotonic_msec(void); void ngx_stream_lua_ffi_today(unsigned char *buf); void ngx_stream_lua_ffi_localtime(unsigned char *buf); void ngx_stream_lua_ffi_utctime(unsigned char *buf); void ngx_stream_lua_ffi_update_time(void); ]] ngx_lua_ffi_now = C.ngx_stream_lua_ffi_now ngx_lua_ffi_time = C.ngx_stream_lua_ffi_time ngx_lua_ffi_monotonic_msec = C.ngx_stream_lua_ffi_monotonic_msec ngx_lua_ffi_today = C.ngx_stream_lua_ffi_today ngx_lua_ffi_localtime = C.ngx_stream_lua_ffi_localtime ngx_lua_ffi_utctime = C.ngx_stream_lua_ffi_utctime ngx_lua_ffi_update_time = C.ngx_stream_lua_ffi_update_time end function ngx.now() local now = tonumber(ngx_lua_ffi_now()) return now end function ngx.time() local time = tonumber(ngx_lua_ffi_time()) return time end local function monotonic_msec() local msec = tonumber(ngx_lua_ffi_monotonic_msec()) return msec end local function monotonic_time() local msec = tonumber(ngx_lua_ffi_monotonic_msec()) local time = msec / 1000 return time end function ngx.update_time() ngx_lua_ffi_update_time() end function ngx.today() -- the format of today is 2010-11-19 local today_buf_size = 10 local buf = get_string_buf(today_buf_size) ngx_lua_ffi_today(buf) return ffi_str(buf, today_buf_size) end function ngx.localtime() -- the format of localtime is 2010-11-19 20:56:31 local localtime_buf_size = 19 local buf = get_string_buf(localtime_buf_size) ngx_lua_ffi_localtime(buf) return ffi_str(buf, localtime_buf_size) end function ngx.utctime() -- the format of utctime is 2010-11-19 20:56:31 local utctime_buf_size = 19 local buf = get_string_buf(utctime_buf_size) ngx_lua_ffi_utctime(buf) return ffi_str(buf, utctime_buf_size) end if subsystem == 'http' then function ngx.cookie_time(sec) if type(sec) ~= "number" then error("number argument only", 2) end -- the format of cookie time is Mon, 28-Sep-2038 06:00:00 GMT -- or Mon, 28-Sep-18 06:00:00 GMT local cookie_time_buf_size = 29 local buf = get_string_buf(cookie_time_buf_size) local used_size = C.ngx_http_lua_ffi_cookie_time(buf, sec) return ffi_str(buf, used_size) end function ngx.http_time(sec) if type(sec) ~= "number" then error("number argument only", 2) end -- the format of http time is Mon, 28 Sep 1970 06:00:00 GMT local http_time_buf_size = 29 local buf = get_string_buf(http_time_buf_size) C.ngx_http_lua_ffi_http_time(buf, sec) return ffi_str(buf, http_time_buf_size) end function ngx.parse_http_time(time_str) if type(time_str) ~= "string" then error("string argument only", 2) end C.ngx_http_lua_ffi_parse_http_time(time_str, #time_str, time_val) local res = time_val[0] if res == FFI_ERROR then return nil end local time = tonumber(res) return time end end return { version = base.version, monotonic_msec = monotonic_msec, monotonic_time = monotonic_time } PK;N] resty/core/utils.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require "ffi" local base = require "resty.core.base" local C = ffi.C local ffi_str = ffi.string local ffi_copy = ffi.copy local byte = string.byte local str_find = string.find local get_string_buf = base.get_string_buf local subsystem = ngx.config.subsystem local _M = { version = base.version } if subsystem == "http" then ffi.cdef[[ void ngx_http_lua_ffi_str_replace_char(unsigned char *buf, size_t len, const unsigned char find, const unsigned char replace); ]] function _M.str_replace_char(str, find, replace) if not str_find(str, find, nil, true) then return str end local len = #str local buf = get_string_buf(len) ffi_copy(buf, str, len) C.ngx_http_lua_ffi_str_replace_char(buf, len, byte(find), byte(replace)) return ffi_str(buf, len) end end return _M PK;N]Aresty/core/coroutine.luanu[local base = require "resty.core.base" local get_request = base.get_request do local keys = {'create', 'yield', 'resume', 'status', 'wrap'} local get_raw_phase = ngx.get_raw_phase for _, key in ipairs(keys) do local std = coroutine['_' .. key] local ours = coroutine['__' .. key] coroutine[key] = function (...) local r = get_request() if r ~= nil then local ctx = get_raw_phase(r) if ctx ~= 0x020 and ctx ~= 0x040 then return ours(...) end end return std(...) end end package.loaded.coroutine = coroutine end return { version = base.version } PK;N]S)EEresty/core/var.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require "ffi" local base = require "resty.core.base" local C = ffi.C local ffi_new = ffi.new local ffi_str = ffi.string local type = type local error = error local tostring = tostring local setmetatable = setmetatable local get_request = base.get_request local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local new_tab = base.new_tab local subsystem = ngx.config.subsystem local ngx_lua_ffi_var_get local ngx_lua_ffi_var_set local ERR_BUF_SIZE = 256 ngx.var = new_tab(0, 0) if subsystem == "http" then ffi.cdef[[ int ngx_http_lua_ffi_var_get(ngx_http_request_t *r, const char *name_data, size_t name_len, char *lowcase_buf, int capture_id, char **value, size_t *value_len, char **err); int ngx_http_lua_ffi_var_set(ngx_http_request_t *r, const unsigned char *name_data, size_t name_len, unsigned char *lowcase_buf, const unsigned char *value, size_t value_len, unsigned char *errbuf, size_t *errlen); ]] ngx_lua_ffi_var_get = C.ngx_http_lua_ffi_var_get ngx_lua_ffi_var_set = C.ngx_http_lua_ffi_var_set elseif subsystem == "stream" then ffi.cdef[[ int ngx_stream_lua_ffi_var_get(ngx_stream_lua_request_t *r, const char *name_data, size_t name_len, char *lowcase_buf, int capture_id, char **value, size_t *value_len, char **err); int ngx_stream_lua_ffi_var_set(ngx_stream_lua_request_t *r, const unsigned char *name_data, size_t name_len, unsigned char *lowcase_buf, const unsigned char *value, size_t value_len, unsigned char *errbuf, size_t *errlen); ]] ngx_lua_ffi_var_get = C.ngx_stream_lua_ffi_var_get ngx_lua_ffi_var_set = C.ngx_stream_lua_ffi_var_set end local value_ptr = ffi_new("unsigned char *[1]") local errmsg = base.get_errmsg_ptr() local function var_get(self, name) local r = get_request() if not r then error("no request found") end local value_len = get_size_ptr() local rc if type(name) == "number" then rc = ngx_lua_ffi_var_get(r, nil, 0, nil, name, value_ptr, value_len, errmsg) else if type(name) ~= "string" then error("bad variable name", 2) end local name_len = #name local lowcase_buf = get_string_buf(name_len) rc = ngx_lua_ffi_var_get(r, name, name_len, lowcase_buf, 0, value_ptr, value_len, errmsg) end -- ngx.log(ngx.WARN, "rc = ", rc) if rc == 0 then -- NGX_OK return ffi_str(value_ptr[0], value_len[0]) end if rc == -5 then -- NGX_DECLINED return nil end if rc == -1 then -- NGX_ERROR error(ffi_str(errmsg[0]), 2) end end local function var_set(self, name, value) local r = get_request() if not r then error("no request found") end if type(name) ~= "string" then error("bad variable name", 2) end local name_len = #name local errlen = get_size_ptr() errlen[0] = ERR_BUF_SIZE local lowcase_buf = get_string_buf(name_len + ERR_BUF_SIZE) local value_len if value == nil then value_len = 0 else if type(value) ~= 'string' then value = tostring(value) end value_len = #value end local errbuf = lowcase_buf + name_len local rc = ngx_lua_ffi_var_set(r, name, name_len, lowcase_buf, value, value_len, errbuf, errlen) -- ngx.log(ngx.WARN, "rc = ", rc) if rc == 0 then -- NGX_OK return end if rc == -1 then -- NGX_ERROR error(ffi_str(errbuf, errlen[0]), 2) end end do local mt = new_tab(0, 2) mt.__index = var_get mt.__newindex = var_set setmetatable(ngx.var, mt) end return { version = base.version } PK;N]O> _/_/resty/core/request.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require 'ffi' local base = require "resty.core.base" local utils = require "resty.core.utils" local subsystem = ngx.config.subsystem local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT local FFI_DECLINED = base.FFI_DECLINED local FFI_OK = base.FFI_OK local clear_tab = base.clear_tab local new_tab = base.new_tab local C = ffi.C local ffi_cast = ffi.cast local ffi_new = ffi.new local ffi_str = ffi.string local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local setmetatable = setmetatable local lower = string.lower local find = string.find local rawget = rawget local ngx = ngx local get_request = base.get_request local type = type local error = error local tostring = tostring local tonumber = tonumber local str_replace_char = utils.str_replace_char local _M = { version = base.version } local ngx_lua_ffi_req_start_time if subsystem == "stream" then ffi.cdef[[ double ngx_stream_lua_ffi_req_start_time(ngx_stream_lua_request_t *r); int ngx_stream_lua_ffi_req_dst_addr(ngx_stream_lua_request_t *r, char *buf, size_t *buf_size, char *errbuf, size_t *errbuf_size); ]] ngx_lua_ffi_req_start_time = C.ngx_stream_lua_ffi_req_start_time elseif subsystem == "http" then ffi.cdef[[ double ngx_http_lua_ffi_req_start_time(ngx_http_request_t *r); ]] ngx_lua_ffi_req_start_time = C.ngx_http_lua_ffi_req_start_time end function ngx.req.start_time() local r = get_request() if not r then error("no request found") end return tonumber(ngx_lua_ffi_req_start_time(r)) end if subsystem == "stream" then local ERR_BUF_SIZE = 256 local buf = get_string_buf(128, 1) local buf_sizep = ffi_new("size_t[1]") function ngx.req.get_original_addr() local rc local r = get_request() local err = get_string_buf(ERR_BUF_SIZE) local errlenp = get_size_ptr() buf_sizep[0] = 128 errlenp[0] = ERR_BUF_SIZE rc = C.ngx_stream_lua_ffi_req_dst_addr(r, buf, buf_sizep, err, errlenp) if tonumber(rc) ~= 0 then return nil, ffi_str(err, errlenp[0]) end return ffi_str(buf, buf_sizep[0]) end return _M end local errmsg = base.get_errmsg_ptr() local ffi_str_type = ffi.typeof("ngx_http_lua_ffi_str_t*") local ffi_str_size = ffi.sizeof("ngx_http_lua_ffi_str_t") ffi.cdef[[ typedef struct { ngx_http_lua_ffi_str_t key; ngx_http_lua_ffi_str_t value; } ngx_http_lua_ffi_table_elt_t; int ngx_http_lua_ffi_req_get_headers_count(ngx_http_request_t *r, int max, int *truncated); int ngx_http_lua_ffi_req_get_headers(ngx_http_request_t *r, ngx_http_lua_ffi_table_elt_t *out, int count, int raw); int ngx_http_lua_ffi_req_get_uri_args_count(ngx_http_request_t *r, int max, int *truncated); size_t ngx_http_lua_ffi_req_get_querystring_len(ngx_http_request_t *r); int ngx_http_lua_ffi_req_get_uri_args(ngx_http_request_t *r, unsigned char *buf, ngx_http_lua_ffi_table_elt_t *out, int count); int ngx_http_lua_ffi_req_get_method(ngx_http_request_t *r); int ngx_http_lua_ffi_req_get_method_name(ngx_http_request_t *r, unsigned char **name, size_t *len); int ngx_http_lua_ffi_req_set_method(ngx_http_request_t *r, int method); int ngx_http_lua_ffi_req_set_header(ngx_http_request_t *r, const unsigned char *key, size_t key_len, const unsigned char *value, size_t value_len, ngx_http_lua_ffi_str_t *mvals, size_t mvals_len, int override, char **errmsg); ]] local table_elt_type = ffi.typeof("ngx_http_lua_ffi_table_elt_t*") local table_elt_size = ffi.sizeof("ngx_http_lua_ffi_table_elt_t") local truncated = ffi.new("int[1]") local req_headers_mt = { __index = function (tb, key) key = lower(key) local value = rawget(tb, key) if value == nil and find(key, '_', 1, true) then value = rawget(tb, (str_replace_char(key, '_', '-'))) end return value end } function ngx.req.get_headers(max_headers, raw) local r = get_request() if not r then error("no request found") end if not max_headers then max_headers = -1 end if not raw then raw = 0 else raw = 1 end local n = C.ngx_http_lua_ffi_req_get_headers_count(r, max_headers, truncated) if n == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end if n == 0 then local headers = {} if raw == 0 then headers = setmetatable(headers, req_headers_mt) end return headers end local raw_buf = get_string_buf(n * table_elt_size) local buf = ffi_cast(table_elt_type, raw_buf) local rc = C.ngx_http_lua_ffi_req_get_headers(r, buf, n, raw) if rc == 0 then local headers = new_tab(0, n) for i = 0, n - 1 do local h = buf[i] local key = h.key key = ffi_str(key.data, key.len) local value = h.value value = ffi_str(value.data, value.len) local existing = headers[key] if existing then if type(existing) == "table" then existing[#existing + 1] = value else headers[key] = {existing, value} end else headers[key] = value end end if raw == 0 then headers = setmetatable(headers, req_headers_mt) end if truncated[0] ~= 0 then return headers, "truncated" end return headers end return nil end function ngx.req.get_uri_args(max_args, tab) local r = get_request() if not r then error("no request found") end if not max_args then max_args = -1 end if tab then clear_tab(tab) end local n = C.ngx_http_lua_ffi_req_get_uri_args_count(r, max_args, truncated) if n == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end if n == 0 then return tab or {} end local args_len = C.ngx_http_lua_ffi_req_get_querystring_len(r) local strbuf = get_string_buf(args_len + n * table_elt_size) local kvbuf = ffi_cast(table_elt_type, strbuf + args_len) local nargs = C.ngx_http_lua_ffi_req_get_uri_args(r, strbuf, kvbuf, n) local args = tab or new_tab(0, nargs) for i = 0, nargs - 1 do local arg = kvbuf[i] local key = arg.key key = ffi_str(key.data, key.len) local value = arg.value local len = value.len if len == -1 then value = true else value = ffi_str(value.data, len) end local existing = args[key] if existing then if type(existing) == "table" then existing[#existing + 1] = value else args[key] = {existing, value} end else args[key] = value end end if truncated[0] ~= 0 then return args, "truncated" end return args end do local methods = { [0x0002] = "GET", [0x0004] = "HEAD", [0x0008] = "POST", [0x0010] = "PUT", [0x0020] = "DELETE", [0x0040] = "MKCOL", [0x0080] = "COPY", [0x0100] = "MOVE", [0x0200] = "OPTIONS", [0x0400] = "PROPFIND", [0x0800] = "PROPPATCH", [0x1000] = "LOCK", [0x2000] = "UNLOCK", [0x4000] = "PATCH", [0x8000] = "TRACE", } local namep = ffi_new("unsigned char *[1]") function ngx.req.get_method() local r = get_request() if not r then error("no request found") end do local id = C.ngx_http_lua_ffi_req_get_method(r) if id == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end local method = methods[id] if method then return method end end local sizep = get_size_ptr() local rc = C.ngx_http_lua_ffi_req_get_method_name(r, namep, sizep) if rc ~= 0 then return nil end return ffi_str(namep[0], sizep[0]) end end -- do function ngx.req.set_method(method) local r = get_request() if not r then error("no request found") end if type(method) ~= "number" then error("bad method number", 2) end local rc = C.ngx_http_lua_ffi_req_set_method(r, method) if rc == FFI_OK then return end if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end if rc == FFI_DECLINED then error("unsupported HTTP method: " .. method, 2) end error("unknown error: " .. rc) end do local function set_req_header(name, value, override) local r = get_request() if not r then error("no request found", 3) end if name == nil then error("bad 'name' argument: string expected, got nil", 3) end if type(name) ~= "string" then name = tostring(name) end local rc if value == nil then if not override then error("bad 'value' argument: string or table expected, got nil", 3) end rc = C.ngx_http_lua_ffi_req_set_header(r, name, #name, nil, 0, nil, 0, 1, errmsg) else local sval, sval_len, mvals, mvals_len, buf local value_type = type(value) if value_type == "table" then mvals_len = #value if mvals_len == 0 and not override then error("bad 'value' argument: non-empty table expected", 3) end buf = get_string_buf(ffi_str_size * mvals_len) mvals = ffi_cast(ffi_str_type, buf) for i = 1, mvals_len do local s = value[i] if type(s) ~= "string" then s = tostring(s) value[i] = s end local str = mvals[i - 1] str.data = s str.len = #s end sval_len = 0 else if value_type ~= "string" then sval = tostring(value) else sval = value end sval_len = #sval mvals_len = 0 end rc = C.ngx_http_lua_ffi_req_set_header(r, name, #name, sval, sval_len, mvals, mvals_len, override and 1 or 0, errmsg) end if rc == FFI_OK or rc == FFI_DECLINED then return end if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 3) end -- rc == FFI_ERROR error(ffi_str(errmsg[0])) end _M.set_req_header = set_req_header function ngx.req.set_header(name, value) set_req_header(name, value, true) -- override end end -- do function ngx.req.clear_header(name) local r = get_request() if not r then error("no request found") end if type(name) ~= "string" then name = tostring(name) end local rc = C.ngx_http_lua_ffi_req_set_header(r, name, #name, nil, 0, nil, 0, 1, errmsg) if rc == FFI_OK or rc == FFI_DECLINED then return end if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end -- rc == FFI_ERROR error(ffi_str(errmsg[0])) end return _M PK;N]eresty/core/base.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require 'ffi' local ffi_new = ffi.new local pcall = pcall local error = error local select = select local ceil = math.ceil local subsystem = ngx.config.subsystem local str_buf_size = 4096 local str_buf local size_ptr local FREE_LIST_REF = 0 if subsystem == 'http' then if not ngx.config or not ngx.config.ngx_lua_version or ngx.config.ngx_lua_version ~= 10031 then local ver = ngx.config and tostring(ngx.config.ngx_lua_version) or 'nil' error("ngx_http_lua_module 0.10.31 required but got " .. ver) end elseif subsystem == 'stream' then if not ngx.config or not ngx.config.ngx_lua_version or ngx.config.ngx_lua_version ~= 19 then local ver = ngx.config and tostring(ngx.config.ngx_lua_version) or 'nil' error("ngx_stream_lua_module 0.0.19 required but got " .. ver) end else error("ngx_http_lua_module 0.10.31 or " .. "ngx_stream_lua_module 0.0.19 required") end if string.find(jit.version, " 2.0", 1, true) then ngx.log(ngx.ALERT, "use of lua-resty-core with LuaJIT 2.0 is ", "not recommended; use LuaJIT 2.1+ instead") end local ok, new_tab = pcall(require, "table.new") if not ok then new_tab = function (narr, nrec) return {} end end local clear_tab ok, clear_tab = pcall(require, "table.clear") if not ok then local pairs = pairs clear_tab = function (tab) for k, _ in pairs(tab) do tab[k] = nil end end end -- XXX for now LuaJIT 2.1 cannot compile require() -- so we make the fast code path Lua only in our own -- wrapper so that most of the require() calls in hot -- Lua code paths can be JIT compiled. do local orig_require = require local pkg_loaded = package.loaded -- the key_sentinel is inserted into package.loaded before -- the chunk is executed and replaced if the chunk completes normally. local key_sentinel = pkg_loaded[...] local function my_require(name) local mod = pkg_loaded[name] if mod then if mod == key_sentinel then error("loop or previous error loading module '" .. name .. "'") end return mod end return orig_require(name) end getfenv(0).require = my_require end if not pcall(ffi.typeof, "ngx_str_t") then ffi.cdef[[ typedef struct { size_t len; const unsigned char *data; } ngx_str_t; ]] end if subsystem == 'http' then if not pcall(ffi.typeof, "ngx_http_request_t") then ffi.cdef[[ typedef struct ngx_http_request_s ngx_http_request_t; ]] end if not pcall(ffi.typeof, "ngx_http_lua_ffi_str_t") then ffi.cdef[[ typedef struct { int len; const unsigned char *data; } ngx_http_lua_ffi_str_t; ]] end elseif subsystem == 'stream' then if not pcall(ffi.typeof, "ngx_stream_lua_request_t") then ffi.cdef[[ typedef struct ngx_stream_lua_request_s ngx_stream_lua_request_t; ]] end if not pcall(ffi.typeof, "ngx_stream_lua_ffi_str_t") then ffi.cdef[[ typedef struct { int len; const unsigned char *data; } ngx_stream_lua_ffi_str_t; ]] end else error("unknown subsystem: " .. subsystem) end local c_buf_type = ffi.typeof("char[?]") local _M = new_tab(0, 18) _M.version = "0.1.34" _M.new_tab = new_tab _M.clear_tab = clear_tab local errmsg function _M.get_errmsg_ptr() if not errmsg then errmsg = ffi_new("char *[1]") end return errmsg end if not ngx then error("no existing ngx. table found") end function _M.set_string_buf_size(size) if size <= 0 then return end if str_buf then str_buf = nil end str_buf_size = ceil(size) end function _M.get_string_buf_size() return str_buf_size end function _M.get_size_ptr() if not size_ptr then size_ptr = ffi_new("size_t[1]") end return size_ptr end function _M.get_string_buf(size, must_alloc) -- ngx.log(ngx.ERR, "str buf size: ", str_buf_size) if size > str_buf_size or must_alloc then local buf = ffi_new(c_buf_type, size) return buf end if not str_buf then str_buf = ffi_new(c_buf_type, str_buf_size) end return str_buf end function _M.ref_in_table(tb, key) if key == nil then return -1 end local ref = tb[FREE_LIST_REF] if ref and ref ~= 0 then tb[FREE_LIST_REF] = tb[ref] else ref = #tb + 1 end tb[ref] = key -- print("ref key_id returned ", ref) return ref end -- Release a slot acquired via ref_in_table() back to the free list. -- Mirrors the layout used by luaL_ref / luaL_unref on the C side (both -- use the slot at FREE_LIST_REF as the free-list head), so tables shared -- with luaL_ref/unref (e.g. ngx_lua_ctx_tables) stay consistent. function _M.unref_in_table(tb, ref) tb[ref] = tb[FREE_LIST_REF] tb[FREE_LIST_REF] = ref end function _M.allows_subsystem(...) local total = select("#", ...) for i = 1, total do if select(i, ...) == subsystem then return end end error("unsupported subsystem: " .. subsystem, 2) end _M.FFI_OK = 0 _M.FFI_NO_REQ_CTX = -100 _M.FFI_BAD_CONTEXT = -101 _M.FFI_ERROR = -1 _M.FFI_AGAIN = -2 _M.FFI_BUSY = -3 _M.FFI_DONE = -4 _M.FFI_DECLINED = -5 _M.FFI_ABORT = -6 do local exdata ok, exdata = pcall(require, "thread.exdata") if ok and exdata then function _M.get_request() local r = exdata() if r ~= nil then return r end end else local getfenv = getfenv function _M.get_request() return getfenv(0).__ngx_req end end end return _M PK;N]զresty/core/base64.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require "ffi" local base = require "resty.core.base" local C = ffi.C local ffi_string = ffi.string local ngx = ngx local type = type local error = error local floor = math.floor local tostring = tostring local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local subsystem = ngx.config.subsystem local ngx_lua_ffi_encode_base64 local ngx_lua_ffi_decode_base64 if subsystem == "http" then ffi.cdef[[ size_t ngx_http_lua_ffi_encode_base64(const unsigned char *src, size_t len, unsigned char *dst, int no_padding); int ngx_http_lua_ffi_decode_base64(const unsigned char *src, size_t len, unsigned char *dst, size_t *dlen); int ngx_http_lua_ffi_decode_base64mime(const unsigned char *src, size_t len, unsigned char *dst, size_t *dlen); ]] ngx_lua_ffi_encode_base64 = C.ngx_http_lua_ffi_encode_base64 ngx_lua_ffi_decode_base64 = C.ngx_http_lua_ffi_decode_base64 elseif subsystem == "stream" then ffi.cdef[[ size_t ngx_stream_lua_ffi_encode_base64(const unsigned char *src, size_t len, unsigned char *dst, int no_padding); int ngx_stream_lua_ffi_decode_base64(const unsigned char *src, size_t len, unsigned char *dst, size_t *dlen); ]] ngx_lua_ffi_encode_base64 = C.ngx_stream_lua_ffi_encode_base64 ngx_lua_ffi_decode_base64 = C.ngx_stream_lua_ffi_decode_base64 end local function base64_encoded_length(len, no_padding) return no_padding and floor((len * 8 + 5) / 6) or floor((len + 2) / 3) * 4 end ngx.encode_base64 = function (s, no_padding) if type(s) ~= 'string' then if not s then s = '' else s = tostring(s) end end local slen = #s local no_padding_bool = false; local no_padding_int = 0; if no_padding then if no_padding ~= true then local typ = type(no_padding) error("bad no_padding: boolean expected, got " .. typ, 2) end no_padding_bool = true no_padding_int = 1; end local dlen = base64_encoded_length(slen, no_padding_bool) local dst = get_string_buf(dlen) local r_dlen = ngx_lua_ffi_encode_base64(s, slen, dst, no_padding_int) -- if dlen ~= r_dlen then error("discrepancy in len") end return ffi_string(dst, r_dlen) end local function base64_decoded_length(len) return floor((len + 3) / 4) * 3 end ngx.decode_base64 = function (s) if type(s) ~= 'string' then error("string argument only", 2) end local slen = #s local dlen = base64_decoded_length(slen) -- print("dlen: ", tonumber(dlen)) local dst = get_string_buf(dlen) local pdlen = get_size_ptr() local ok = ngx_lua_ffi_decode_base64(s, slen, dst, pdlen) if ok == 0 then return nil end return ffi_string(dst, pdlen[0]) end ngx.decode_base64mime = function (s) if type(s) ~= 'string' then error("string argument only", 2) end local slen = #s local dlen = base64_decoded_length(slen) local dst = get_string_buf(dlen) local pdlen = get_size_ptr() local ok = C.ngx_http_lua_ffi_decode_base64mime(s, slen, dst, pdlen) if ok == 0 then return nil end return ffi_string(dst, pdlen[0]) end return { version = base.version } PK;N]=m  resty/core/uri.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require "ffi" local base = require "resty.core.base" local C = ffi.C local ffi_string = ffi.string local ngx = ngx local type = type local error = error local tostring = tostring local get_string_buf = base.get_string_buf local subsystem = ngx.config.subsystem local ngx_lua_ffi_escape_uri local ngx_lua_ffi_unescape_uri local ngx_lua_ffi_uri_escaped_length local NGX_ESCAPE_URI = 0 local NGX_ESCAPE_URI_COMPONENT = 2 local NGX_ESCAPE_MAIL_AUTH = 6 if subsystem == "http" then ffi.cdef[[ size_t ngx_http_lua_ffi_uri_escaped_length(const unsigned char *src, size_t len, int type); void ngx_http_lua_ffi_escape_uri(const unsigned char *src, size_t len, unsigned char *dst, int type); size_t ngx_http_lua_ffi_unescape_uri(const unsigned char *src, size_t len, unsigned char *dst); ]] ngx_lua_ffi_escape_uri = C.ngx_http_lua_ffi_escape_uri ngx_lua_ffi_unescape_uri = C.ngx_http_lua_ffi_unescape_uri ngx_lua_ffi_uri_escaped_length = C.ngx_http_lua_ffi_uri_escaped_length elseif subsystem == "stream" then ffi.cdef[[ size_t ngx_stream_lua_ffi_uri_escaped_length(const unsigned char *src, size_t len, int type); void ngx_stream_lua_ffi_escape_uri(const unsigned char *src, size_t len, unsigned char *dst, int type); size_t ngx_stream_lua_ffi_unescape_uri(const unsigned char *src, size_t len, unsigned char *dst); ]] ngx_lua_ffi_escape_uri = C.ngx_stream_lua_ffi_escape_uri ngx_lua_ffi_unescape_uri = C.ngx_stream_lua_ffi_unescape_uri ngx_lua_ffi_uri_escaped_length = C.ngx_stream_lua_ffi_uri_escaped_length end ngx.escape_uri = function (s, esc_type) if type(s) ~= 'string' then if not s then s = '' else s = tostring(s) end end if esc_type == nil then esc_type = NGX_ESCAPE_URI_COMPONENT else if type(esc_type) ~= 'number' then error("\"type\" is not a number", 3) end if esc_type < NGX_ESCAPE_URI or esc_type > NGX_ESCAPE_MAIL_AUTH then error("\"type\" " .. esc_type .. " out of range", 3) end end local slen = #s local dlen = ngx_lua_ffi_uri_escaped_length(s, slen, esc_type) -- print("dlen: ", tonumber(dlen)) if dlen == slen then return s end local dst = get_string_buf(dlen) ngx_lua_ffi_escape_uri(s, slen, dst, esc_type) return ffi_string(dst, dlen) end ngx.unescape_uri = function (s) if type(s) ~= 'string' then if not s then s = '' else s = tostring(s) end end local slen = #s local dlen = slen local dst = get_string_buf(dlen) dlen = ngx_lua_ffi_unescape_uri(s, slen, dst) return ffi_string(dst, dlen) end return { version = base.version, } PK;N]f@j@jresty/core/shdict.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require 'ffi' local base = require "resty.core.base" local _M = { version = base.version } local ngx_shared = ngx.shared if not ngx_shared then return _M end local ffi_new = ffi.new local ffi_str = ffi.string local C = ffi.C local get_string_buf = base.get_string_buf local get_string_buf_size = base.get_string_buf_size local get_size_ptr = base.get_size_ptr local tonumber = tonumber local tostring = tostring local next = next local type = type local error = error local getmetatable = getmetatable local FFI_DECLINED = base.FFI_DECLINED local subsystem = ngx.config.subsystem local ngx_lua_ffi_shdict_get local ngx_lua_ffi_shdict_incr local ngx_lua_ffi_shdict_store local ngx_lua_ffi_shdict_flush_all local ngx_lua_ffi_shdict_get_ttl local ngx_lua_ffi_shdict_set_expire local ngx_lua_ffi_shdict_capacity local ngx_lua_ffi_shdict_free_space local ngx_lua_ffi_shdict_udata_to_zone if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_shdict_get(void *zone, const unsigned char *key, size_t key_len, int *value_type, unsigned char **str_value_buf, size_t *str_value_len, double *num_value, int *user_flags, int get_stale, int *is_stale, char **errmsg); int ngx_http_lua_ffi_shdict_incr(void *zone, const unsigned char *key, size_t key_len, double *value, char **err, int has_init, double init, long init_ttl, int *forcible); int ngx_http_lua_ffi_shdict_store(void *zone, int op, const unsigned char *key, size_t key_len, int value_type, const unsigned char *str_value_buf, size_t str_value_len, double num_value, long exptime, int user_flags, char **errmsg, int *forcible); int ngx_http_lua_ffi_shdict_flush_all(void *zone); long ngx_http_lua_ffi_shdict_get_ttl(void *zone, const unsigned char *key, size_t key_len); int ngx_http_lua_ffi_shdict_set_expire(void *zone, const unsigned char *key, size_t key_len, long exptime); size_t ngx_http_lua_ffi_shdict_capacity(void *zone); void *ngx_http_lua_ffi_shdict_udata_to_zone(void *zone_udata); ]] ngx_lua_ffi_shdict_get = function(zone, key, key_len, value_type, str_value_buf, value_len, num_value, user_flags, get_stale, is_stale, errmsg) return C.ngx_http_lua_ffi_shdict_get(zone, key, key_len, value_type, str_value_buf, value_len, num_value, user_flags, get_stale, is_stale, errmsg) end ngx_lua_ffi_shdict_incr = function(zone, key, key_len, value, err, has_init, init, init_ttl, forcible) return C.ngx_http_lua_ffi_shdict_incr(zone, key, key_len, value, err, has_init, init, init_ttl, forcible) end ngx_lua_ffi_shdict_store = function(zone, op, key, key_len, value_type, str_value_buf, str_value_len, num_value, exptime, user_flags, errmsg, forcible) return C.ngx_http_lua_ffi_shdict_store(zone, op, key, key_len, value_type, str_value_buf, str_value_len, num_value, exptime, user_flags, errmsg, forcible) end ngx_lua_ffi_shdict_flush_all = C.ngx_http_lua_ffi_shdict_flush_all ngx_lua_ffi_shdict_get_ttl = C.ngx_http_lua_ffi_shdict_get_ttl ngx_lua_ffi_shdict_set_expire = C.ngx_http_lua_ffi_shdict_set_expire ngx_lua_ffi_shdict_capacity = C.ngx_http_lua_ffi_shdict_capacity ngx_lua_ffi_shdict_udata_to_zone = C.ngx_http_lua_ffi_shdict_udata_to_zone if not pcall(function () return C.ngx_http_lua_ffi_shdict_free_space end) then ffi.cdef[[ size_t ngx_http_lua_ffi_shdict_free_space(void *zone); ]] end pcall(function () ngx_lua_ffi_shdict_free_space = C.ngx_http_lua_ffi_shdict_free_space end) elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_shdict_get(void *zone, const unsigned char *key, size_t key_len, int *value_type, unsigned char **str_value_buf, size_t *str_value_len, double *num_value, int *user_flags, int get_stale, int *is_stale, char **errmsg); int ngx_stream_lua_ffi_shdict_incr(void *zone, const unsigned char *key, size_t key_len, double *value, char **err, int has_init, double init, long init_ttl, int *forcible); int ngx_stream_lua_ffi_shdict_store(void *zone, int op, const unsigned char *key, size_t key_len, int value_type, const unsigned char *str_value_buf, size_t str_value_len, double num_value, long exptime, int user_flags, char **errmsg, int *forcible); int ngx_stream_lua_ffi_shdict_flush_all(void *zone); long ngx_stream_lua_ffi_shdict_get_ttl(void *zone, const unsigned char *key, size_t key_len); int ngx_stream_lua_ffi_shdict_set_expire(void *zone, const unsigned char *key, size_t key_len, long exptime); size_t ngx_stream_lua_ffi_shdict_capacity(void *zone); void *ngx_stream_lua_ffi_shdict_udata_to_zone(void *zone_udata); ]] ngx_lua_ffi_shdict_get = function(zone, key, key_len, value_type, str_value_buf, value_len, num_value, user_flags, get_stale, is_stale, errmsg) return C.ngx_stream_lua_ffi_shdict_get(zone, key, key_len, value_type, str_value_buf, value_len, num_value, user_flags, get_stale, is_stale, errmsg) end ngx_lua_ffi_shdict_incr = function(zone, key, key_len, value, err, has_init, init, init_ttl, forcible) return C.ngx_stream_lua_ffi_shdict_incr(zone, key, key_len, value, err, has_init, init, init_ttl, forcible) end ngx_lua_ffi_shdict_store = function(zone, op, key, key_len, value_type, str_value_buf, str_value_len, num_value, exptime, user_flags, errmsg, forcible) return C.ngx_stream_lua_ffi_shdict_store(zone, op, key, key_len, value_type, str_value_buf, str_value_len, num_value, exptime, user_flags, errmsg, forcible) end ngx_lua_ffi_shdict_flush_all = C.ngx_stream_lua_ffi_shdict_flush_all ngx_lua_ffi_shdict_get_ttl = C.ngx_stream_lua_ffi_shdict_get_ttl ngx_lua_ffi_shdict_set_expire = C.ngx_stream_lua_ffi_shdict_set_expire ngx_lua_ffi_shdict_capacity = C.ngx_stream_lua_ffi_shdict_capacity ngx_lua_ffi_shdict_udata_to_zone = C.ngx_stream_lua_ffi_shdict_udata_to_zone if not pcall(function () return C.ngx_stream_lua_ffi_shdict_free_space end) then ffi.cdef[[ size_t ngx_stream_lua_ffi_shdict_free_space(void *zone); ]] end -- ngx_stream_lua is only compatible with NGINX >= 1.13.6, meaning it -- cannot lack support for ngx_stream_lua_ffi_shdict_free_space. ngx_lua_ffi_shdict_free_space = C.ngx_stream_lua_ffi_shdict_free_space else error("unknown subsystem: " .. subsystem) end local MACOS = jit and jit.os == "OSX" if MACOS and subsystem == 'http' then ffi.cdef[[ typedef struct { void *zone; const unsigned char *key; size_t key_len; int *value_type; unsigned char **str_value_buf; size_t *str_value_len; double *num_value; int *user_flags; int get_stale; int *is_stale; char **errmsg; } ngx_http_lua_shdict_get_params_t; typedef struct { void *zone; int op; const unsigned char *key; size_t key_len; int value_type; const unsigned char *str_value_buf; size_t str_value_len; double num_value; long exptime; int user_flags; char **errmsg; int *forcible; } ngx_http_lua_shdict_store_params_t; typedef struct { void *zone; const unsigned char *key; size_t key_len; double *num_value; char **errmsg; int has_init; double init; long init_ttl; int *forcible; } ngx_http_lua_shdict_incr_params_t; int ngx_http_lua_ffi_shdict_get_macos( ngx_http_lua_shdict_get_params_t *p); int ngx_http_lua_ffi_shdict_store_macos( ngx_http_lua_shdict_store_params_t *p); int ngx_http_lua_ffi_shdict_incr_macos( ngx_http_lua_shdict_incr_params_t *p); ]] local get_params = ffi_new("ngx_http_lua_shdict_get_params_t") local incr_params = ffi_new("ngx_http_lua_shdict_incr_params_t") local store_params = ffi_new("ngx_http_lua_shdict_store_params_t") ngx_lua_ffi_shdict_get = function(zone, key, key_len, value_type, str_value_buf, value_len, num_value, user_flags, get_stale, is_stale, errmsg) get_params.zone = zone get_params.key = key get_params.key_len = key_len get_params.value_type = value_type get_params.str_value_buf = str_value_buf get_params.str_value_len = value_len get_params.num_value = num_value get_params.user_flags = user_flags get_params.get_stale = get_stale get_params.is_stale = is_stale get_params.errmsg = errmsg return C.ngx_http_lua_ffi_shdict_get_macos(get_params) end ngx_lua_ffi_shdict_incr = function(zone, key, key_len, value, err, has_init, init, init_ttl, forcible) incr_params.zone = zone incr_params.key = key incr_params.key_len = key_len incr_params.num_value = value incr_params.errmsg = err incr_params.has_init = has_init incr_params.init = init incr_params.init_ttl = init_ttl incr_params.forcible = forcible return C.ngx_http_lua_ffi_shdict_incr_macos(incr_params) end ngx_lua_ffi_shdict_store = function(zone, op, key, key_len, value_type, str_value_buf, str_value_len, num_value, exptime, user_flags, errmsg, forcible) store_params.zone = zone store_params.op = op store_params.key = key store_params.key_len = key_len store_params.value_type = value_type store_params.str_value_buf = str_value_buf store_params.str_value_len = str_value_len store_params.num_value = num_value store_params.exptime = exptime store_params.user_flags = user_flags store_params.errmsg = errmsg store_params.forcible = forcible return C.ngx_http_lua_ffi_shdict_store_macos(store_params) end end if MACOS and subsystem == 'stream' then ffi.cdef[[ typedef struct { void *zone; const unsigned char *key; size_t key_len; int *value_type; unsigned char **str_value_buf; size_t *str_value_len; double *num_value; int *user_flags; int get_stale; int *is_stale; char **errmsg; } ngx_stream_lua_shdict_get_params_t; typedef struct { void *zone; int op; const unsigned char *key; size_t key_len; int value_type; const unsigned char *str_value_buf; size_t str_value_len; double num_value; long exptime; int user_flags; char **errmsg; int *forcible; } ngx_stream_lua_shdict_store_params_t; typedef struct { void *zone; const unsigned char *key; size_t key_len; double *num_value; char **errmsg; int has_init; double init; long init_ttl; int *forcible; } ngx_stream_lua_shdict_incr_params_t; int ngx_stream_lua_ffi_shdict_get_macos( ngx_stream_lua_shdict_get_params_t *p); int ngx_stream_lua_ffi_shdict_store_macos( ngx_stream_lua_shdict_store_params_t *p); int ngx_stream_lua_ffi_shdict_incr_macos( ngx_stream_lua_shdict_incr_params_t *p); ]] local get_params = ffi_new("ngx_stream_lua_shdict_get_params_t") local store_params = ffi_new("ngx_stream_lua_shdict_store_params_t") local incr_params = ffi_new("ngx_stream_lua_shdict_incr_params_t") ngx_lua_ffi_shdict_get = function(zone, key, key_len, value_type, str_value_buf, value_len, num_value, user_flags, get_stale, is_stale, errmsg) get_params.zone = zone get_params.key = key get_params.key_len = key_len get_params.value_type = value_type get_params.str_value_buf = str_value_buf get_params.str_value_len = value_len get_params.num_value = num_value get_params.user_flags = user_flags get_params.get_stale = get_stale get_params.is_stale = is_stale get_params.errmsg = errmsg return C.ngx_stream_lua_ffi_shdict_get_macos(get_params) end ngx_lua_ffi_shdict_incr = function(zone, key, key_len, value, err, has_init, init, init_ttl, forcible) incr_params.zone = zone incr_params.key = key incr_params.key_len = key_len incr_params.num_value = value incr_params.errmsg = err incr_params.has_init = has_init incr_params.init = init incr_params.init_ttl = init_ttl incr_params.forcible = forcible return C.ngx_stream_lua_ffi_shdict_incr_macos(incr_params) end ngx_lua_ffi_shdict_store = function(zone, op, key, key_len, value_type, str_value_buf, str_value_len, num_value, exptime, user_flags, errmsg, forcible) store_params.zone = zone store_params.op = op store_params.key = key store_params.key_len = key_len store_params.value_type = value_type store_params.str_value_buf = str_value_buf store_params.str_value_len = str_value_len store_params.num_value = num_value store_params.exptime = exptime store_params.user_flags = user_flags store_params.errmsg = errmsg store_params.forcible = forcible return C.ngx_stream_lua_ffi_shdict_store_macos(store_params) end end if not pcall(function () return C.free end) then ffi.cdef[[ void free(void *ptr); ]] end local value_type = ffi_new("int[1]") local user_flags = ffi_new("int[1]") local num_value = ffi_new("double[1]") local is_stale = ffi_new("int[1]") local forcible = ffi_new("int[1]") local str_value_buf = ffi_new("unsigned char *[1]") local errmsg = base.get_errmsg_ptr() local function check_zone(zone) if not zone or type(zone) ~= "table" then error("bad \"zone\" argument", 3) end zone = zone[1] if type(zone) ~= "userdata" then error("bad \"zone\" argument", 3) end zone = ngx_lua_ffi_shdict_udata_to_zone(zone) if zone == nil then error("bad \"zone\" argument", 3) end return zone end local function shdict_store(zone, op, key, value, exptime, flags) zone = check_zone(zone) if not exptime then exptime = 0 elseif exptime < 0 then error('bad "exptime" argument', 2) end if not flags then flags = 0 end if key == nil then return nil, "nil key" end if type(key) ~= "string" then key = tostring(key) end local key_len = #key if key_len == 0 then return nil, "empty key" end if key_len > 65535 then return nil, "key too long" end local str_val_buf local str_val_len = 0 local num_val = 0 local valtyp = type(value) -- print("value type: ", valtyp) -- print("exptime: ", exptime) if valtyp == "string" then valtyp = 4 -- LUA_TSTRING str_val_buf = value str_val_len = #value elseif valtyp == "number" then valtyp = 3 -- LUA_TNUMBER num_val = value elseif value == nil then valtyp = 0 -- LUA_TNIL elseif valtyp == "boolean" then valtyp = 1 -- LUA_TBOOLEAN num_val = value and 1 or 0 else return nil, "bad value type" end local rc = ngx_lua_ffi_shdict_store(zone, op, key, key_len, valtyp, str_val_buf, str_val_len, num_val, exptime * 1000, flags, errmsg, forcible) -- print("rc == ", rc) if rc == 0 then -- NGX_OK return true, nil, forcible[0] == 1 end -- NGX_DECLINED or NGX_ERROR return false, ffi_str(errmsg[0]), forcible[0] == 1 end local function shdict_set(zone, key, value, exptime, flags) return shdict_store(zone, 0, key, value, exptime, flags) end local function shdict_safe_set(zone, key, value, exptime, flags) return shdict_store(zone, 0x0004, key, value, exptime, flags) end local function shdict_add(zone, key, value, exptime, flags) return shdict_store(zone, 0x0001, key, value, exptime, flags) end local function shdict_safe_add(zone, key, value, exptime, flags) return shdict_store(zone, 0x0005, key, value, exptime, flags) end local function shdict_replace(zone, key, value, exptime, flags) return shdict_store(zone, 0x0002, key, value, exptime, flags) end local function shdict_delete(zone, key) return shdict_set(zone, key, nil) end local function shdict_get(zone, key) zone = check_zone(zone) if key == nil then return nil, "nil key" end if type(key) ~= "string" then key = tostring(key) end local key_len = #key if key_len == 0 then return nil, "empty key" end if key_len > 65535 then return nil, "key too long" end local size = get_string_buf_size() local buf = get_string_buf(size) str_value_buf[0] = buf local value_len = get_size_ptr() value_len[0] = size local rc = ngx_lua_ffi_shdict_get(zone, key, key_len, value_type, str_value_buf, value_len, num_value, user_flags, 0, is_stale, errmsg) if rc ~= 0 then if errmsg[0] ~= nil then return nil, ffi_str(errmsg[0]) end error("failed to get the key") end local typ = value_type[0] if typ == 0 then -- LUA_TNIL return nil end local flags = tonumber(user_flags[0]) local val if typ == 4 then -- LUA_TSTRING if str_value_buf[0] ~= buf then -- ngx.say("len: ", tonumber(value_len[0])) buf = str_value_buf[0] val = ffi_str(buf, value_len[0]) C.free(buf) else val = ffi_str(buf, value_len[0]) end elseif typ == 3 then -- LUA_TNUMBER val = tonumber(num_value[0]) elseif typ == 1 then -- LUA_TBOOLEAN val = (tonumber(buf[0]) ~= 0) else error("unknown value type: " .. typ) end if flags ~= 0 then return val, flags end return val end local function shdict_get_stale(zone, key) zone = check_zone(zone) if key == nil then return nil, "nil key" end if type(key) ~= "string" then key = tostring(key) end local key_len = #key if key_len == 0 then return nil, "empty key" end if key_len > 65535 then return nil, "key too long" end local size = get_string_buf_size() local buf = get_string_buf(size) str_value_buf[0] = buf local value_len = get_size_ptr() value_len[0] = size local rc = ngx_lua_ffi_shdict_get(zone, key, key_len, value_type, str_value_buf, value_len, num_value, user_flags, 1, is_stale, errmsg) if rc ~= 0 then if errmsg[0] ~= nil then return nil, ffi_str(errmsg[0]) end error("failed to get the key") end local typ = value_type[0] if typ == 0 then -- LUA_TNIL return nil end local flags = tonumber(user_flags[0]) local val if typ == 4 then -- LUA_TSTRING if str_value_buf[0] ~= buf then -- ngx.say("len: ", tonumber(value_len[0])) buf = str_value_buf[0] val = ffi_str(buf, value_len[0]) C.free(buf) else val = ffi_str(buf, value_len[0]) end elseif typ == 3 then -- LUA_TNUMBER val = tonumber(num_value[0]) elseif typ == 1 then -- LUA_TBOOLEAN val = (tonumber(buf[0]) ~= 0) else error("unknown value type: " .. typ) end if flags ~= 0 then return val, flags, is_stale[0] == 1 end return val, nil, is_stale[0] == 1 end local function shdict_incr(zone, key, value, init, init_ttl) zone = check_zone(zone) if key == nil then return nil, "nil key" end if type(key) ~= "string" then key = tostring(key) end local key_len = #key if key_len == 0 then return nil, "empty key" end if key_len > 65535 then return nil, "key too long" end if type(value) ~= "number" then value = tonumber(value) end num_value[0] = value if init then local typ = type(init) if typ ~= "number" then init = tonumber(init) if not init then error("bad init arg: number expected, got " .. typ, 2) end end end if init_ttl ~= nil then local typ = type(init_ttl) if typ ~= "number" then init_ttl = tonumber(init_ttl) if not init_ttl then error("bad init_ttl arg: number expected, got " .. typ, 2) end end if init_ttl < 0 then error('bad "init_ttl" argument', 2) end if not init then error('must provide "init" when providing "init_ttl"', 2) end else init_ttl = 0 end local rc = ngx_lua_ffi_shdict_incr(zone, key, key_len, num_value, errmsg, init and 1 or 0, init or 0, init_ttl * 1000, forcible) if rc ~= 0 then -- ~= NGX_OK return nil, ffi_str(errmsg[0]) end if not init then return tonumber(num_value[0]) end return tonumber(num_value[0]), nil, forcible[0] == 1 end local function shdict_flush_all(zone) zone = check_zone(zone) ngx_lua_ffi_shdict_flush_all(zone) end local function shdict_ttl(zone, key) zone = check_zone(zone) if key == nil then return nil, "nil key" end if type(key) ~= "string" then key = tostring(key) end local key_len = #key if key_len == 0 then return nil, "empty key" end if key_len > 65535 then return nil, "key too long" end local rc = ngx_lua_ffi_shdict_get_ttl(zone, key, key_len) if rc == FFI_DECLINED then return nil, "not found" end return tonumber(rc) / 1000 end local function shdict_expire(zone, key, exptime) zone = check_zone(zone) if not exptime then error('bad "exptime" argument', 2) end if key == nil then return nil, "nil key" end if type(key) ~= "string" then key = tostring(key) end local key_len = #key if key_len == 0 then return nil, "empty key" end if key_len > 65535 then return nil, "key too long" end local rc = ngx_lua_ffi_shdict_set_expire(zone, key, key_len, exptime * 1000) if rc == FFI_DECLINED then return nil, "not found" end -- NGINX_OK/FFI_OK return true end local function shdict_capacity(zone) zone = check_zone(zone) return tonumber(ngx_lua_ffi_shdict_capacity(zone)) end local shdict_free_space if ngx_lua_ffi_shdict_free_space then shdict_free_space = function (zone) zone = check_zone(zone) return tonumber(ngx_lua_ffi_shdict_free_space(zone)) end else shdict_free_space = function () error("'shm:free_space()' not supported in NGINX < 1.11.7", 2) end end local _, dict = next(ngx_shared, nil) if dict then local mt = getmetatable(dict) if mt then mt = mt.__index if mt then mt.get = shdict_get mt.get_stale = shdict_get_stale mt.incr = shdict_incr mt.set = shdict_set mt.safe_set = shdict_safe_set mt.add = shdict_add mt.safe_add = shdict_safe_add mt.replace = shdict_replace mt.delete = shdict_delete mt.flush_all = shdict_flush_all mt.ttl = shdict_ttl mt.expire = shdict_expire mt.capacity = shdict_capacity mt.free_space = shdict_free_space end end end return _M PK;N]o9resty/core/exit.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require "ffi" local base = require "resty.core.base" local C = ffi.C local ffi_string = ffi.string local ngx = ngx local error = error local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local get_request = base.get_request local co_yield = coroutine._yield local subsystem = ngx.config.subsystem local ngx_lua_ffi_exit if subsystem == "http" then ffi.cdef[[ int ngx_http_lua_ffi_exit(ngx_http_request_t *r, int status, unsigned char *err, size_t *errlen); ]] ngx_lua_ffi_exit = C.ngx_http_lua_ffi_exit elseif subsystem == "stream" then ffi.cdef[[ int ngx_stream_lua_ffi_exit(ngx_stream_lua_request_t *r, int status, unsigned char *err, size_t *errlen); ]] ngx_lua_ffi_exit = C.ngx_stream_lua_ffi_exit end local ERR_BUF_SIZE = 128 local FFI_DONE = base.FFI_DONE ngx.exit = function (rc) local err = get_string_buf(ERR_BUF_SIZE) local errlen = get_size_ptr() local r = get_request() if r == nil then error("no request found") end errlen[0] = ERR_BUF_SIZE rc = ngx_lua_ffi_exit(r, rc, err, errlen) if rc == 0 then -- print("yielding...") return co_yield() end if rc == FFI_DONE then return end error(ffi_string(err, errlen[0]), 2) end return { version = base.version } PK 0x7fff then return nil, "bad status code" end payload = char(band(rshift(code, 8), 0xff), band(code, 0xff)) .. (msg or "") end return send_frame(self, true, 0x8, payload) end function _M.send_ping(self, data) return send_frame(self, true, 0x9, data) end function _M.send_pong(self, data) return send_frame(self, true, 0xa, data) end return _M PK 0 then -- being a reused connection (must have done handshake) return 1, nil, "connection reused" end if ssl then if client_cert then ok, err = sock:setclientcert(client_cert, client_priv_key) if not ok then return nil, "failed to set TLS client certificate: " .. err end end server_name = server_name or header_host or addr ok, err = sock:sslhandshake(false, server_name, ssl_verify) if not ok then return nil, "ssl handshake failed: " .. err end end local custom_headers if headers then custom_headers = concat(headers, "\r\n") custom_headers = "\r\n" .. custom_headers end -- do the websocket handshake: if not key then local bytes = char(rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1, rand(256) - 1) key = encode_base64(bytes) end local host_header = header_host or (is_unix and "unix_sock" or addr .. ":" .. port) local req = "GET " .. path .. " HTTP/1.1\r\nUpgrade: websocket\r\nHost: " .. host_header .. "\r\nSec-WebSocket-Key: " .. key .. (proto_header or "") .. "\r\nSec-WebSocket-Version: 13" .. (origin_header or "") .. "\r\nConnection: Upgrade" .. (custom_headers or "") .. "\r\n\r\n" local bytes, err = sock:send(req) if not bytes then return nil, "failed to send the handshake request: " .. err end local header_reader = sock:receiveuntil("\r\n\r\n") -- FIXME: check for too big response headers local header, err, partial = header_reader() if not header then return nil, "failed to receive response header: " .. err end -- error("header: " .. header) -- FIXME: verify the response headers m, err = re_match(header, [[^\s*HTTP/1\.1\s+]], "jo") if not m then return nil, "bad HTTP response status line: " .. header end return 1, nil, header end function _M.set_timeout(self, time) local sock = self.sock if not sock then return nil, nil, "not initialized yet" end return sock:settimeout(time) end function _M.recv_frame(self) if self.fatal then return nil, nil, "fatal error already happened" end local sock = self.sock if not sock then return nil, nil, "not initialized yet" end local data, typ, err = _recv_frame(sock, self.max_recv_len, false) if not data and not str_find(err, ": timeout", 1, true) then self.fatal = true end return data, typ, err end local function send_frame(self, fin, opcode, payload) if self.fatal then return nil, "fatal error already happened" end if self.closed then return nil, "already closed" end local sock = self.sock if not sock then return nil, "not initialized yet" end local bytes, err = _send_frame(sock, fin, opcode, payload, self.max_send_len, not self.send_unmasked) if not bytes then self.fatal = true end return bytes, err end _M.send_frame = send_frame function _M.send_text(self, data) return send_frame(self, true, 0x1, data) end function _M.send_binary(self, data) return send_frame(self, true, 0x2, data) end local function send_close(self, code, msg) local payload if code then if type(code) ~= "number" or code > 0x7fff then return nil, "bad status code" end payload = char(band(rshift(code, 8), 0xff), band(code, 0xff)) .. (msg or "") end if debug then ngx_log(ngx_DEBUG, "sending the close frame") end local bytes, err = send_frame(self, true, 0x8, payload) if not bytes then self.fatal = true end self.closed = true return bytes, err end _M.send_close = send_close function _M.send_ping(self, data) return send_frame(self, true, 0x9, data) end function _M.send_pong(self, data) return send_frame(self, true, 0xa, data) end function _M.close(self) if self.fatal then return nil, "fatal error already happened" end local sock = self.sock if not sock then return nil, "not initialized" end if not self.closed then local bytes, err = send_close(self) if not bytes then return nil, "failed to send close frame: " .. err end end return sock:close() end function _M.set_keepalive(self, ...) local sock = self.sock if not sock then return nil, "not initialized" end return sock:setkeepalive(...) end return _M PK str_buf_size then return ffi_new(c_buf_type, size) end if not str_buf then str_buf = ffi_new(c_buf_type, str_buf_size) end return str_buf end function _M.recv_frame(sock, max_payload_len, force_masking) local data, err = sock:receive(2) if not data then return nil, nil, "failed to receive the first 2 bytes: " .. err end local fst, snd = byte(data, 1, 2) local fin = band(fst, 0x80) ~= 0 -- print("fin: ", fin) if band(fst, 0x70) ~= 0 then return nil, nil, "bad RSV1, RSV2, or RSV3 bits" end local opcode = band(fst, 0x0f) -- print("opcode: ", tohex(opcode)) if opcode >= 0x3 and opcode <= 0x7 then return nil, nil, "reserved non-control frames" end if opcode >= 0xb and opcode <= 0xf then return nil, nil, "reserved control frames" end local mask = band(snd, 0x80) ~= 0 if debug then ngx_log(ngx_DEBUG, "recv_frame: mask bit: ", mask and 1 or 0) end if force_masking and not mask then return nil, nil, "frame unmasked" end local payload_len = band(snd, 0x7f) -- print("payload len: ", payload_len) if payload_len == 126 then local data, err = sock:receive(2) if not data then return nil, nil, "failed to receive the 2 byte payload length: " .. (err or "unknown") end payload_len = bor(lshift(byte(data, 1), 8), byte(data, 2)) elseif payload_len == 127 then local data, err = sock:receive(8) if not data then return nil, nil, "failed to receive the 8 byte payload length: " .. (err or "unknown") end if byte(data, 1) ~= 0 or byte(data, 2) ~= 0 or byte(data, 3) ~= 0 or byte(data, 4) ~= 0 then return nil, nil, "payload len too large" end local fifth = byte(data, 5) if band(fifth, 0x80) ~= 0 then return nil, nil, "payload len too large" end payload_len = bor(lshift(fifth, 24), lshift(byte(data, 6), 16), lshift(byte(data, 7), 8), byte(data, 8)) end if band(opcode, 0x8) ~= 0 then -- being a control frame if payload_len > 125 then return nil, nil, "too long payload for control frame" end if not fin then return nil, nil, "fragmented control frame" end end -- print("payload len: ", payload_len, ", max payload len: ", -- max_payload_len) if payload_len > max_payload_len then return nil, nil, "exceeding max payload len" end local rest if mask then rest = payload_len + 4 else rest = payload_len end -- print("rest: ", rest) local data if rest > 0 then data, err = sock:receive(rest) if not data then return nil, nil, "failed to read masking-len and payload: " .. (err or "unknown") end else data = "" end -- print("received rest") if opcode == 0x8 then -- being a close frame if payload_len > 0 then if payload_len < 2 then return nil, nil, "close frame with a body must carry a 2-byte" .. " status code" end local msg, code if mask then local fst = bxor(byte(data, 4 + 1), byte(data, 1)) local snd = bxor(byte(data, 4 + 2), byte(data, 2)) code = bor(lshift(fst, 8), snd) if payload_len > 2 then -- TODO string.buffer optimizations local bytes = get_string_buf(payload_len - 2) for i = 3, payload_len do bytes[i - 3] = bxor(byte(data, 4 + i), byte(data, (i - 1) % 4 + 1)) end msg = ffi_string(bytes, payload_len - 2) else msg = "" end else local fst = byte(data, 1) local snd = byte(data, 2) code = bor(lshift(fst, 8), snd) -- print("parsing unmasked close frame payload: ", payload_len) if payload_len > 2 then msg = sub(data, 3) else msg = "" end end return msg, "close", code end return "", "close", nil end local msg if mask then -- TODO string.buffer optimizations local bytes = get_string_buf(payload_len) for i = 1, payload_len do bytes[i - 1] = bxor(byte(data, 4 + i), byte(data, (i - 1) % 4 + 1)) end msg = ffi_string(bytes, payload_len) else msg = data end return msg, types[opcode], not fin and "again" or nil end local function build_frame(fin, opcode, payload_len, payload, masking) -- XXX optimize this when we have string.buffer in LuaJIT 2.1 local fst if fin then fst = bor(0x80, opcode) else fst = opcode end local snd, extra_len_bytes if payload_len <= 125 then snd = payload_len extra_len_bytes = "" elseif payload_len <= 65535 then snd = 126 extra_len_bytes = char(band(rshift(payload_len, 8), 0xff), band(payload_len, 0xff)) else if band(payload_len, 0x7fffffff) < payload_len then return nil, "payload too big" end snd = 127 -- XXX we only support 31-bit length here extra_len_bytes = char(0, 0, 0, 0, band(rshift(payload_len, 24), 0xff), band(rshift(payload_len, 16), 0xff), band(rshift(payload_len, 8), 0xff), band(payload_len, 0xff)) end local masking_key if masking then -- set the mask bit snd = bor(snd, 0x80) local key = rand(0xffffffff) masking_key = char(band(rshift(key, 24), 0xff), band(rshift(key, 16), 0xff), band(rshift(key, 8), 0xff), band(key, 0xff)) -- TODO string.buffer optimizations local bytes = get_string_buf(payload_len) for i = 1, payload_len do bytes[i - 1] = bxor(byte(payload, i), byte(masking_key, (i - 1) % 4 + 1)) end payload = ffi_string(bytes, payload_len) else masking_key = "" end return char(fst, snd) .. extra_len_bytes .. masking_key .. payload end _M.build_frame = build_frame function _M.send_frame(sock, fin, opcode, payload, max_payload_len, masking) -- ngx.log(ngx.WARN, ngx.var.uri, ": masking: ", masking) if not payload then payload = "" elseif type(payload) ~= "string" then payload = tostring(payload) end local payload_len = #payload if payload_len > max_payload_len then return nil, "payload too big" end if band(opcode, 0x8) ~= 0 then -- being a control frame if payload_len > 125 then return nil, "too much payload for control frame" end if not fin then return nil, "fragmented control frame" end end local frame, err = build_frame(fin, opcode, payload_len, payload, masking) if not frame then return nil, "failed to build frame: " .. err end local bytes, err = sock:send(frame) if not bytes then return nil, "failed to send frame: " .. err end return bytes end return _M PK max_size then return pos - 1, "too much data" end return pos - 1 end function _M.run(cmd, stdin, timeout, max_size) if not max_size then max_size = 128 * 1024 -- 128KB end local proc, err = pipe_spawn(cmd, spawn_opts) if not proc then return nil, nil, nil, "failed to spawn: " .. tostring(err) end proc:set_timeouts(timeout, timeout, timeout, timeout) if stdin and stdin ~= "" then local bytes, err = proc:write(stdin) if not bytes then local ok2, err2 = cleanup_proc(proc) if not ok2 then err = concat_err(err, err2) end return nil, nil, nil, "failed to write to stdin: " .. tostring(err) end end local ok ok, err = proc:shutdown("stdin") if not ok then local ok2, err2 = cleanup_proc(proc) if not ok2 then err = concat_err(err, err2) end return nil, nil, nil, "failed to shutdown stdin: " .. tostring(err) end local stdout_tab = fetch_tab(tab_pool_tag, 4, 0) local stderr_tab = fetch_tab(tab_pool_tag, 4, 0) local thr_out = spawn_thread(read_stream, proc, stdout_tab, max_size, "stdout_read_any") local thr_err = spawn_thread(read_stream, proc, stderr_tab, max_size, "stderr_read_any") local reason, status ok, reason, status = proc:wait() if ok == nil and reason ~= "exited" then err = reason local ok2, err2 = cleanup_proc(proc) if not ok2 then err = concat_err(err, err2) end local stdout = concat(stdout_tab) release_tab(tab_pool_tag, stdout_tab) local stderr = concat(stderr_tab) release_tab(tab_pool_tag, stderr_tab) return nil, stdout, stderr, "failed to wait for process: " .. tostring(err) end local ok2, stdout_pos, err2 = wait_thread(thr_out) if not ok2 then local stdout = concat(stdout_tab) release_tab(tab_pool_tag, stdout_tab) local stderr = concat(stderr_tab) release_tab(tab_pool_tag, stderr_tab) return nil, stdout, stderr, "failed to wait stdout thread: " .. tostring(stdout_pos) end if err2 then local stdout = concat(stdout_tab, "", 1, stdout_pos) release_tab(tab_pool_tag, stdout_tab) local stderr = concat(stderr_tab) release_tab(tab_pool_tag, stderr_tab) return nil, stdout, stderr, "failed to read stdout: " .. tostring(err2) end local stderr_pos ok2, stderr_pos, err2 = wait_thread(thr_err) if not ok2 then local stdout = concat(stdout_tab, "", 1, stdout_pos) release_tab(tab_pool_tag, stdout_tab) local stderr = concat(stderr_tab) release_tab(tab_pool_tag, stderr_tab) return nil, stdout, stderr, "failed to wait stderr thread: " .. tostring(stderr_pos) end local stdout = concat(stdout_tab, "", 1, stdout_pos) release_tab(tab_pool_tag, stdout_tab) local stderr = concat(stderr_tab, "", 1, stderr_pos) release_tab(tab_pool_tag, stderr_tab) if err2 then return nil, stdout, stderr, "failed to read stderr: " .. tostring(err2) end return ok, stdout, stderr, reason, status end return _M PK=N]]V[V[resty/upstream/healthcheck.luanu[local stream_sock = ngx.socket.tcp local log = ngx.log local ERR = ngx.ERR local WARN = ngx.WARN local DEBUG = ngx.DEBUG local ngx = ngx local error = error local string = string local sub = string.sub local re_find = ngx.re.find local new_timer = ngx.timer.at local shared = ngx.shared local debug_mode = ngx.config.debug local concat = table.concat local tonumber = tonumber local tostring = tostring local ipairs = ipairs local ceil = math.ceil local spawn = ngx.thread.spawn local wait = ngx.thread.wait local pcall = pcall local setmetatable = setmetatable -- LuaFormatter off local _M = { _VERSION = '0.08' } if not ngx.config or not ngx.config.ngx_lua_version or ngx.config.ngx_lua_version < 9005 then error("ngx_lua 0.9.5+ required") end -- LuaFormatter on local ok, upstream = pcall(require, "ngx.upstream") if not ok then error("ngx_upstream_lua module required") end local ok, new_tab = pcall(require, "table.new") if not ok or type(new_tab) ~= "function" then new_tab = function(narr, nrec) return {} end end local set_peer_down = upstream.set_peer_down local get_primary_peers = upstream.get_primary_peers local get_backup_peers = upstream.get_backup_peers local get_upstreams = upstream.get_upstreams local upstream_checker_statuses = {} local function warn(...) log(WARN, "healthcheck: ", ...) end local function errlog(...) log(ERR, "healthcheck: ", ...) end local function debug(...) -- print("debug mode: ", debug_mode) if debug_mode then log(DEBUG, "healthcheck: ", ...) end end local function gen_peer_key(prefix, u, is_backup, id) if is_backup then return prefix .. u .. ":b" .. id end return prefix .. u .. ":p" .. id end local function set_peer_down_globally(ctx, is_backup, id, value) local u = ctx.upstream local dict = ctx.dict local ok, err = set_peer_down(u, is_backup, id, value) if not ok then errlog("failed to set peer down: ", err) end if not ctx.new_version then ctx.new_version = true end local key = gen_peer_key("d:", u, is_backup, id) local ok, err = dict:set(key, value) if not ok then errlog("failed to set peer down state: ", err) end end local function peer_fail(ctx, is_backup, id, peer) debug("peer ", peer.name, " was checked to be not ok") local u = ctx.upstream local dict = ctx.dict local key = gen_peer_key("nok:", u, is_backup, id) local fails, err = dict:get(key) if not fails then if err then errlog("failed to get peer nok key: ", err) return end fails = 1 -- below may have a race condition, but it is fine for our -- purpose here. local ok, err = dict:set(key, 1) if not ok then errlog("failed to set peer nok key: ", err) end else fails = fails + 1 local ok, err = dict:incr(key, 1) if not ok then errlog("failed to incr peer nok key: ", err) end end if fails == 1 then key = gen_peer_key("ok:", u, is_backup, id) local succ, err = dict:get(key) if not succ or succ == 0 then if err then errlog("failed to get peer ok key: ", err) return end else local ok, err = dict:set(key, 0) if not ok then errlog("failed to set peer ok key: ", err) end end end -- print("ctx fall: ", ctx.fall, ", peer down: ", peer.down, -- ", fails: ", fails) if not peer.down and fails >= ctx.fall then warn("peer ", peer.name, " is turned down after ", fails, " failure(s)") peer.down = true set_peer_down_globally(ctx, is_backup, id, true) end end local function peer_ok(ctx, is_backup, id, peer) debug("peer ", peer.name, " was checked to be ok") local u = ctx.upstream local dict = ctx.dict local key = gen_peer_key("ok:", u, is_backup, id) local succ, err = dict:get(key) if not succ then if err then errlog("failed to get peer ok key: ", err) return end succ = 1 -- below may have a race condition, but it is fine for our -- purpose here. local ok, err = dict:set(key, 1) if not ok then errlog("failed to set peer ok key: ", err) end else succ = succ + 1 local ok, err = dict:incr(key, 1) if not ok then errlog("failed to incr peer ok key: ", err) end end if succ == 1 then key = gen_peer_key("nok:", u, is_backup, id) local fails, err = dict:get(key) if not fails or fails == 0 then if err then errlog("failed to get peer nok key: ", err) return end else local ok, err = dict:set(key, 0) if not ok then errlog("failed to set peer nok key: ", err) end end end if peer.down and succ >= ctx.rise then warn("peer ", peer.name, " is turned up after ", succ, " success(es)") peer.down = nil set_peer_down_globally(ctx, is_backup, id, nil) end end -- shortcut error function for check_peer() local function peer_error(ctx, is_backup, id, peer, ...) if not peer.down then errlog(...) end peer_fail(ctx, is_backup, id, peer) end local function check_peer(ctx, id, peer, is_backup) local ok local name = peer.name local statuses = ctx.statuses local req = ctx.http_req local sock, err = stream_sock() if not sock then errlog("failed to create stream socket: ", err) return end sock:settimeout(ctx.timeout) if peer.host then -- print("peer port: ", peer.port) ok, err = sock:connect(peer.host, peer.port) else ok, err = sock:connect(name) end if not ok then if not peer.down then errlog("failed to connect to ", name, ": ", err) end return peer_fail(ctx, is_backup, id, peer) end if ctx.type == "https" then ok, err = sock:sslhandshake(nil, ctx.host, ctx.ssl_verify) if not ok then sock:close() return peer_error(ctx, is_backup, id, peer, "failed to ssl handshake to ", name, ": ", err) end end local bytes, err = sock:send(req) if not bytes then return peer_error(ctx, is_backup, id, peer, "failed to send request to ", name, ": ", err) end local status_line, err = sock:receive() if not status_line then peer_error(ctx, is_backup, id, peer, "failed to receive status line from ", name, ": ", err) if err == "timeout" then sock:close() -- timeout errors do not close the socket. end return end if statuses then local from, to, err = re_find(status_line, [[^HTTP/\d+\.\d+\s+(\d+)]], "joi", nil, 1) if err then errlog("failed to parse status line: ", err) end if not from then peer_error(ctx, is_backup, id, peer, "bad status line from ", name, ": ", status_line) sock:close() return end local status = tonumber(sub(status_line, from, to)) if not statuses[status] then peer_error(ctx, is_backup, id, peer, "bad status code from ", name, ": ", status) sock:close() return end end peer_ok(ctx, is_backup, id, peer) sock:close() end local function check_peer_range(ctx, from, to, peers, is_backup) for i = from, to do check_peer(ctx, i - 1, peers[i], is_backup) end end local function check_peers(ctx, peers, is_backup) local n = #peers if n == 0 then return end local concur = ctx.concurrency if concur <= 1 then for i = 1, n do check_peer(ctx, i - 1, peers[i], is_backup) end else local threads local nthr if n <= concur then nthr = n - 1 threads = new_tab(nthr, 0) for i = 1, nthr do if debug_mode then debug("spawn a thread checking ", is_backup and "backup" or "primary", " peer ", i - 1) end threads[i] = spawn(check_peer, ctx, i - 1, peers[i], is_backup) end -- use the current "light thread" to run the last task if debug_mode then debug("check ", is_backup and "backup" or "primary", " peer ", n - 1) end check_peer(ctx, n - 1, peers[n], is_backup) else local group_size = ceil(n / concur) nthr = ceil(n / group_size) - 1 threads = new_tab(nthr, 0) local from = 1 local rest = n for i = 1, nthr do local to if rest >= group_size then rest = rest - group_size to = from + group_size - 1 else rest = 0 to = from + rest - 1 end if debug_mode then debug("spawn a thread checking ", is_backup and "backup" or "primary", " peers ", from - 1, " to ", to - 1) end threads[i] = spawn(check_peer_range, ctx, from, to, peers, is_backup) from = from + group_size if rest == 0 then break end end if rest > 0 then local to = from + rest - 1 if debug_mode then debug("check ", is_backup and "backup" or "primary", " peers ", from - 1, " to ", to - 1) end check_peer_range(ctx, from, to, peers, is_backup) end end if nthr and nthr > 0 then for i = 1, nthr do local t = threads[i] if t then wait(t) end end end end end local function upgrade_peers_version(ctx, peers, is_backup) local dict = ctx.dict local u = ctx.upstream local n = #peers for i = 1, n do local peer = peers[i] local id = i - 1 local key = gen_peer_key("d:", u, is_backup, id) local down = false local res, err = dict:get(key) if not res then if err then errlog("failed to get peer down state: ", err) end else down = true end if (peer.down and not down) or (not peer.down and down) then local ok, err = set_peer_down(u, is_backup, id, down) if not ok then errlog("failed to set peer down: ", err) else -- update our cache too peer.down = down end end end end local function preprocess_peers(peers, port) local n = #peers for i = 1, n do local p = peers[i] local name = p.name if name then local from, to, err = re_find(name, [[^(.*):\d+$]], "jo", nil, 1) if from then p.host = sub(name, 1, to) p.port = port or tonumber(sub(name, to + 2)) end end end return peers end local function check_peers_updates(ctx) local dict = ctx.dict local u = ctx.upstream local ppeers, err = get_primary_peers(u) if ppeers then ctx.primary_peers = preprocess_peers(ppeers, ctx.port) end local bpeers, err = get_backup_peers(u) if bpeers then ctx.backup_peers = preprocess_peers(bpeers, ctx.port) end local key = "v:" .. u local ver, err = dict:get(key) if not ver then if err then errlog("failed to get peers version: ", err) return end if ctx.version > 0 then ctx.new_version = true end elseif ctx.version < ver then debug("upgrading peers version to ", ver) upgrade_peers_version(ctx, ctx.primary_peers, false); upgrade_peers_version(ctx, ctx.backup_peers, true); ctx.version = ver end end local function get_lock(ctx) local dict = ctx.dict local key = "l:" .. ctx.upstream -- the lock is held for the whole interval to prevent multiple -- worker processes from sending the test request simultaneously. -- here we substract the lock expiration time by 1ms to prevent -- a race condition with the next timer event. local ok, err = dict:add(key, true, ctx.interval - 0.001) if not ok then if err == "exists" then return nil end errlog("failed to add key \"", key, "\": ", err) return nil end return true end local function do_check(ctx) debug("healthcheck: run a check cycle") check_peers_updates(ctx) if get_lock(ctx) then check_peers(ctx, ctx.primary_peers, false) check_peers(ctx, ctx.backup_peers, true) end if ctx.new_version then local key = "v:" .. ctx.upstream local dict = ctx.dict if debug_mode then debug("publishing peers version ", ctx.version + 1) end dict:add(key, 0) local new_ver, err = dict:incr(key, 1) if not new_ver then errlog("failed to publish new peers version: ", err) end ctx.version = new_ver ctx.new_version = nil end end local function update_upstream_checker_status(upstream, success) local cnt = upstream_checker_statuses[upstream] if not cnt then cnt = 0 end if success then cnt = cnt + 1 else cnt = cnt - 1 end upstream_checker_statuses[upstream] = cnt end local check check = function(premature, ctx) if premature then return end local ok, err = pcall(do_check, ctx) if not ok then errlog("failed to run healthcheck cycle: ", err) end local ok, err = new_timer(ctx.interval, check, ctx) if not ok then if err ~= "process exiting" then errlog("failed to create timer: ", err) end update_upstream_checker_status(ctx.upstream, false) return end end function _M.spawn_checker(opts) local typ = opts.type if not typ then return nil, "\"type\" option required" end if typ ~= "http" and typ ~= "https" then return nil, "only \"http\" and \"https\" type are supported right now" end local ssl_verify = opts.ssl_verify if ssl_verify == nil then ssl_verify = true end local http_req = opts.http_req if not http_req then return nil, "\"http_req\" option required" end local timeout = opts.timeout if not timeout then timeout = 1000 end local interval = opts.interval if not interval then interval = 1 else interval = interval / 1000 if interval < 0.002 then -- minimum 2ms interval = 0.002 end end local valid_statuses = opts.valid_statuses local statuses if valid_statuses then statuses = new_tab(0, #valid_statuses) for _, status in ipairs(valid_statuses) do -- print("found good status ", status) statuses[status] = true end end -- debug("interval: ", interval) local concur = opts.concurrency if not concur then concur = 1 end local fall = opts.fall if not fall then fall = 5 end local rise = opts.rise if not rise then rise = 2 end local shm = opts.shm if not shm then return nil, "\"shm\" option required" end local dict = shared[shm] if not dict then return nil, "shm \"" .. tostring(shm) .. "\" not found" end local u = opts.upstream if not u then return nil, "no upstream specified" end local ppeers, err = get_primary_peers(u) if not ppeers then return nil, "failed to get primary peers: " .. err end local bpeers, err = get_backup_peers(u) if not bpeers then return nil, "failed to get backup peers: " .. err end local ctx = { upstream = u, primary_peers = preprocess_peers(ppeers, opts.port), backup_peers = preprocess_peers(bpeers, opts.port), port = opts.port, http_req = http_req, timeout = timeout, interval = interval, dict = dict, fall = fall, rise = rise, statuses = statuses, version = 0, concurrency = concur, type = typ, host = opts.host, ssl_verify = ssl_verify } if debug_mode and opts.no_timer then check(nil, ctx) else local ok, err = new_timer(0, check, ctx) if not ok then return nil, "failed to create timer: " .. err end end update_upstream_checker_status(u, true) return true end local new_status_meta = { __add = function(self, rhs) -- debug("new_status_meta:__add: rhs: ", rhs) self.statuses[self.idx] = rhs self.idx = self.idx + 1 end } new_status_meta.__index = new_status_meta function new_status_meta:add(rhs) self:__add(rhs) end local function new_status_table(n) local tab = {statuses = new_tab(n * 90, 0), idx = 1} return setmetatable(tab, new_status_meta) end -- combined upstream status adding functions local function add_upstream_prometheus_status_line(tab, u, st) tab:add('nginx_upstream_status_info{name="') tab:add(u) tab:add('",status="') tab:add(st) tab:add('\n') end local function add_upstream_up_prometheus_status(tab, u) add_upstream_prometheus_status_line(tab, u, 'UP"} 1'); add_upstream_prometheus_status_line(tab, u, 'DOWN"} 0'); add_upstream_prometheus_status_line(tab, u, 'UNKNOWN"} 0'); end local function add_upstream_down_prometheus_status(tab, u) add_upstream_prometheus_status_line(tab, u, 'UP"} 0'); add_upstream_prometheus_status_line(tab, u, 'DOWN"} 1'); add_upstream_prometheus_status_line(tab, u, 'UNKNOWN"} 0'); end local function add_upstream_unknown_prometheus_status(tab, u) add_upstream_prometheus_status_line(tab, u, 'UP"} 0'); add_upstream_prometheus_status_line(tab, u, 'DOWN"} 0'); add_upstream_prometheus_status_line(tab, u, 'UNKNOWN"} 1'); end -- peer status generator functions local function gen_peer_prometheus_status(tab, u, p, r, s, n) tab:add("nginx_upstream_status_info{name=\"") tab:add(u) tab:add("\",endpoint=\"") tab:add(p) tab:add("\",status=\"") tab:add(s) tab:add("\",role=\"") tab:add(r) tab:add("\"} ") tab:add(n) tab:add("\n") end -- combined peer status adding function local function add_peer_status(tab, u, p, r) gen_peer_prometheus_status(tab, u, p.name, r, "UP", not p.down and 1 or 0) gen_peer_prometheus_status(tab, u, p.name, r, "DOWN", p.down and 1 or 0) end local function add_peer_prometheus_status(tab, u, p, r) gen_peer_prometheus_status(tab, u, p.name, r, "UP", not p.down and 1 or 0) gen_peer_prometheus_status(tab, u, p.name, r, "DOWN", p.down and 1 or 0) end local function add_peers_info(tab, u, peers, role) local npeers = #peers for i = 1, npeers do local peer = peers[i] tab:add(" ") tab:add(peer.name) if peer.down then tab:add(" DOWN\n") else tab:add(" UP\n") end end end local function add_peers_prometheus_info(tab, u, peers, role) local npeers = #peers local found_up_peer = false for i = 1, npeers do add_peer_prometheus_status(tab, u, peers[i], role) if not peers[i].down then found_up_peer = true end end return found_up_peer end function _M.prometheus_status_page() -- generate an prometheus metrics -- # HELP nginx_upstream_status_info The running staus of nginx upstream -- # TYPE nginx_upstream_status_info gauge -- nginx_upstream_status_info{name="",endpoint="",status="",role=""} num local us, err = get_upstreams() if not us then return nil, "failed to get upstream names: " .. err end local n = #us local stats_tab = new_status_table(n) stats_tab:add( "# HELP nginx_upstream_status_info The running status of nginx upstream\n") stats_tab:add("# TYPE nginx_upstream_status_info gauge\n") for i = 1, n do local u = us[i] local ncheckers = upstream_checker_statuses[u] if not ncheckers or ncheckers == 0 then add_upstream_unknown_prometheus_status(stats_tab, u) goto continue end local peers, err = get_primary_peers(u) if not peers then add_upstream_down_prometheus_status(stats_tab, u) else local peers, err = get_primary_peers(u) local found_up_peer = false if peers then if add_peers_prometheus_info(stats_tab, u, peers, "PRIMARY") then found_up_peer = true end end peers, err = get_backup_peers(u) if peers then if add_peers_prometheus_info(stats_tab, u, peers, "BACKUP") then found_up_peer = true end end if found_up_peer then add_upstream_up_prometheus_status(stats_tab, u) else add_upstream_down_prometheus_status(stats_tab, u) end end ::continue:: end return concat(stats_tab.statuses) end function _M.status_page() -- generate an HTML page local us, err = get_upstreams() if not us then return "failed to get upstream names: " .. err end local n = #us local stats_tab = new_status_table(n) for i = 1, n do if i > 1 then stats_tab:add("\n") end local u = us[i] stats_tab:add("Upstream ") stats_tab:add(u) local ncheckers = upstream_checker_statuses[u] if not ncheckers or ncheckers == 0 then stats_tab:add(" (NO checkers)") end stats_tab:add("\n Primary Peers\n") local peers, err = get_primary_peers(u) if not peers then return "failed to get primary peers in upstream " .. u .. ": " .. err end add_peers_info(stats_tab, u, peers, "PRIMARY") stats_tab:add(" Backup Peers\n") peers, err = get_backup_peers(u) if not peers then return "failed to get backup peers in upstream " .. u .. ": " .. err end add_peers_info(stats_tab, u, peers, "BACKUP") end return concat(stats_tab.statuses) end return _M PK=N]۵ resty/sha.luanu[-- Copyright (C) by Yichun Zhang (agentzh) local ffi = require "ffi" local _M = { _VERSION = '0.17' } ffi.cdef[[ typedef unsigned long SHA_LONG; typedef unsigned long long SHA_LONG64; enum { SHA_LBLOCK = 16 }; ]]; return _M PK=N]"9resty/sha224.luanu[-- Copyright (C) by Yichun Zhang (agentzh) require "resty.sha256" local ffi = require "ffi" local ffi_new = ffi.new local ffi_str = ffi.string local C = ffi.C local setmetatable = setmetatable --local error = error local _M = { _VERSION = '0.17' } local mt = { __index = _M } ffi.cdef[[ int SHA224_Init(SHA256_CTX *c); int SHA224_Update(SHA256_CTX *c, const void *data, size_t len); int SHA224_Final(unsigned char *md, SHA256_CTX *c); ]] local digest_len = 28 local buf = ffi_new("char[?]", digest_len) local ctx_ptr_type = ffi.typeof("SHA256_CTX[1]") function _M.new(self) local ctx = ffi_new(ctx_ptr_type) if C.SHA224_Init(ctx) == 0 then return nil end return setmetatable({ _ctx = ctx }, mt) end function _M.update(self, s) return C.SHA224_Update(self._ctx, s, #s) == 1 end function _M.final(self) if C.SHA224_Final(buf, self._ctx) == 1 then return ffi_str(buf, digest_len) end return nil end function _M.reset(self) return C.SHA224_Init(self._ctx) == 1 end return _M PK=N]0/Yresty/sha384.luanu[-- Copyright (C) by Yichun Zhang (agentzh) require "resty.sha512" local ffi = require "ffi" local ffi_new = ffi.new local ffi_str = ffi.string local C = ffi.C local setmetatable = setmetatable --local error = error local _M = { _VERSION = '0.17' } local mt = { __index = _M } ffi.cdef[[ int SHA384_Init(SHA512_CTX *c); int SHA384_Update(SHA512_CTX *c, const void *data, size_t len); int SHA384_Final(unsigned char *md, SHA512_CTX *c); ]] local digest_len = 48 local buf = ffi_new("char[?]", digest_len) local ctx_ptr_type = ffi.typeof("SHA512_CTX[1]") function _M.new(self) local ctx = ffi_new(ctx_ptr_type) if C.SHA384_Init(ctx) == 0 then return nil end return setmetatable({ _ctx = ctx }, mt) end function _M.update(self, s) return C.SHA384_Update(self._ctx, s, #s) == 1 end function _M.final(self) if C.SHA384_Final(buf, self._ctx) == 1 then return ffi_str(buf, digest_len) end return nil end function _M.reset(self) return C.SHA384_Init(self._ctx) == 1 end return _M PK=N]v5 resty/md5.luanu[-- Copyright (C) by Yichun Zhang (agentzh) local ffi = require "ffi" local ffi_new = ffi.new local ffi_str = ffi.string local C = ffi.C local setmetatable = setmetatable --local error = error local _M = { _VERSION = '0.17' } local mt = { __index = _M } ffi.cdef[[ typedef unsigned long MD5_LONG ; enum { MD5_CBLOCK = 64, MD5_LBLOCK = MD5_CBLOCK/4 }; typedef struct MD5state_st { MD5_LONG A,B,C,D; MD5_LONG Nl,Nh; MD5_LONG data[MD5_LBLOCK]; unsigned int num; } MD5_CTX; int MD5_Init(MD5_CTX *c); int MD5_Update(MD5_CTX *c, const void *data, size_t len); int MD5_Final(unsigned char *md, MD5_CTX *c); ]] local buf = ffi_new("char[16]") local ctx_ptr_type = ffi.typeof("MD5_CTX[1]") function _M.new(self) local ctx = ffi_new(ctx_ptr_type) if C.MD5_Init(ctx) == 0 then return nil end return setmetatable({ _ctx = ctx }, mt) end function _M.update(self, s, len) return C.MD5_Update(self._ctx, s, len or #s) == 1 end function _M.final(self) if C.MD5_Final(buf, self._ctx) == 1 then return ffi_str(buf, 16) end return nil end function _M.reset(self) return C.MD5_Init(self._ctx) == 1 end return _M PK=N];11resty/cookie.luanu[-- Copyright (C) 2013-2016 Jiale Zhi (calio), CloudFlare Inc. -- See RFC6265 http://tools.ietf.org/search/rfc6265 -- require "luacov" local type = type local byte = string.byte local sub = string.sub local format = string.format local log = ngx.log local ERR = ngx.ERR local WARN = ngx.WARN local ngx_header = ngx.header local EQUAL = byte("=") local SEMICOLON = byte(";") local SPACE = byte(" ") local HTAB = byte("\t") -- table.new(narr, nrec) local ok, new_tab = pcall(require, "table.new") if not ok then new_tab = function () return {} end end local ok, clear_tab = pcall(require, "table.clear") if not ok then clear_tab = function(tab) for k, _ in pairs(tab) do tab[k] = nil end end end local _M = new_tab(0, 2) _M._VERSION = '0.01' local function get_cookie_table(text_cookie) if type(text_cookie) ~= "string" then log(ERR, format("expect text_cookie to be \"string\" but found %s", type(text_cookie))) return {} end local EXPECT_KEY = 1 local EXPECT_VALUE = 2 local EXPECT_SP = 3 local n = 0 local len = #text_cookie for i=1, len do if byte(text_cookie, i) == SEMICOLON then n = n + 1 end end local cookie_table = new_tab(0, n + 1) local state = EXPECT_SP local i = 1 local j = 1 local key, value while j <= len do if state == EXPECT_KEY then if byte(text_cookie, j) == EQUAL then key = sub(text_cookie, i, j - 1) state = EXPECT_VALUE i = j + 1 end elseif state == EXPECT_VALUE then if byte(text_cookie, j) == SEMICOLON or byte(text_cookie, j) == SPACE or byte(text_cookie, j) == HTAB then value = sub(text_cookie, i, j - 1) cookie_table[key] = value key, value = nil, nil state = EXPECT_SP i = j + 1 end elseif state == EXPECT_SP then if byte(text_cookie, j) ~= SPACE and byte(text_cookie, j) ~= HTAB then state = EXPECT_KEY i = j j = j - 1 end end j = j + 1 end if key ~= nil and value == nil then cookie_table[key] = sub(text_cookie, i) end return cookie_table end function _M.new(self) local _cookie = ngx.var.http_cookie --if not _cookie then --return nil, "no cookie found in current request" --end return setmetatable({ _cookie = _cookie, set_cookie_table = new_tab(4, 0) }, { __index = self }) end function _M.get(self, key) if not self._cookie then return nil, "no cookie found in the current request" end if self.cookie_table == nil then self.cookie_table = get_cookie_table(self._cookie) end return self.cookie_table[key] end function _M.get_all(self) if not self._cookie then return nil, "no cookie found in the current request" end if self.cookie_table == nil then self.cookie_table = get_cookie_table(self._cookie) end return self.cookie_table end local function bake(cookie) if not cookie.key or not cookie.value then return nil, 'missing cookie field "key" or "value"' end if cookie["max-age"] then cookie.max_age = cookie["max-age"] end if (cookie.samesite) then local samesite = cookie.samesite -- if we dont have a valid-looking attribute, ignore the attribute if (samesite ~= "Strict" and samesite ~= "Lax" and samesite ~= "None") then log(WARN, "SameSite value must be 'Strict', 'Lax' or 'None'") cookie.samesite = nil end end local str = cookie.key .. "=" .. cookie.value .. (cookie.expires and "; Expires=" .. cookie.expires or "") .. (cookie.max_age and "; Max-Age=" .. cookie.max_age or "") .. (cookie.domain and "; Domain=" .. cookie.domain or "") .. (cookie.path and "; Path=" .. cookie.path or "") .. (cookie.secure and "; Secure" or "") .. (cookie.httponly and "; HttpOnly" or "") .. (cookie.samesite and "; SameSite=" .. cookie.samesite or "") .. (cookie.extension and "; " .. cookie.extension or "") return str end function _M.set(self, cookie) local cookie_str, err = bake(cookie) if not cookie_str then return nil, err end local set_cookie = ngx_header['Set-Cookie'] local set_cookie_type = type(set_cookie) local t = self.set_cookie_table clear_tab(t) if set_cookie_type == "string" then -- only one cookie has been setted if set_cookie ~= cookie_str then t[1] = set_cookie t[2] = cookie_str ngx_header['Set-Cookie'] = t end elseif set_cookie_type == "table" then -- more than one cookies has been setted local size = #set_cookie -- we can not set cookie like ngx.header['Set-Cookie'][3] = val -- so create a new table, copy all the values, and then set it back for i=1, size do t[i] = ngx_header['Set-Cookie'][i] if t[i] == cookie_str then -- new cookie is duplicated return true end end t[size + 1] = cookie_str ngx_header['Set-Cookie'] = t else -- no cookie has been setted ngx_header['Set-Cookie'] = cookie_str end return true end return _M PK=N]zHHresty/lrucache/pureffi.luanu[-- Copyright (C) Yichun Zhang (agentzh) -- Copyright (C) Shuxin Yang --[[ This module implements a key/value cache store. We adopt LRU as our replace/evict policy. Each key/value pair is tagged with a Time-to-Live (TTL); from user's perspective, stale pairs are automatically removed from the cache. Why FFI ------- In Lua, expression "table[key] = nil" does not *PHYSICALLY* remove the value associated with the key; it just set the value to be nil! So the table will keep growing with large number of the key/nil pairs which will be purged until resize() operator is called. This "feature" is terribly ill-suited to what we need. Therefore we have to rely on FFI to build a hash-table where any entry can be physically deleted immediately. Under the hood: -------------- In concept, we introduce three data structures to implement the cache store: 1. key/value vector for storing keys and values. 2. a queue to mimic the LRU. 3. hash-table for looking up the value for a given key. Unfortunately, efficiency and clarity usually come at each other cost. The data strucutres we are using are slightly more complicated than what we described above. o. Lua does not have efficient way to store a vector of pair. So, we use two vectors for key/value pair: one for keys and the other for values (_M.key_v and _M.val_v, respectively), and i-th key corresponds to i-th value. A key/value pair is identified by the "id" field in a "node" (we shall discuss node later) o. The queue is nothing more than a doubly-linked list of "node" linked via lrucache_pureffi_queue_s::{next|prev} fields. o. The hash-table has two parts: - the _M.bucket_v[] a vector of bucket, indiced by hash-value, and - a bucket is a singly-linked list of "node" via the lrucache_pureffi_queue_s::conflict field. A key must be a string, and the hash value of a key is evaluated by: crc32(key-cast-to-pointer) % size(_M.bucket_v). We mandate size(_M.bucket_v) being a power-of-two in order to avoid expensive modulo operation. At the heart of the module is an array of "node" (of type lrucache_pureffi_queue_s). A node: - keeps the meta-data of its corresponding key/value pair (embodied by the "id", and "expire" field); - is a part of LRU queue (embodied by "prev" and "next" fields); - is a part of hash-table (embodied by the "conflict" field). ]] local ffi = require "ffi" local bit = require "bit" local ffi_new = ffi.new local ffi_sizeof = ffi.sizeof local ffi_cast = ffi.cast local ffi_fill = ffi.fill local ngx_now = ngx.now local uintptr_t = ffi.typeof("uintptr_t") local c_str_t = ffi.typeof("const char*") local int_t = ffi.typeof("int") local int_array_t = ffi.typeof("int[?]") local crc_tab = ffi.new("const unsigned int[256]", { 0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA, 0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3, 0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988, 0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91, 0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE, 0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7, 0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC, 0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5, 0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172, 0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B, 0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940, 0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59, 0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116, 0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F, 0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924, 0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D, 0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A, 0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433, 0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818, 0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01, 0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E, 0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457, 0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C, 0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65, 0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2, 0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB, 0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0, 0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9, 0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086, 0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F, 0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4, 0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD, 0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A, 0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683, 0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8, 0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1, 0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE, 0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7, 0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC, 0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5, 0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252, 0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B, 0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60, 0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79, 0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236, 0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F, 0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04, 0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D, 0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A, 0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713, 0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38, 0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21, 0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E, 0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777, 0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C, 0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45, 0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2, 0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB, 0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0, 0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9, 0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6, 0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF, 0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94, 0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D }); local setmetatable = setmetatable local tonumber = tonumber local tostring = tostring local type = type local brshift = bit.rshift local bxor = bit.bxor local band = bit.band local new_tab do local ok ok, new_tab = pcall(require, "table.new") if not ok then new_tab = function(narr, nrec) return {} end end end -- queue data types -- -- this queue is a double-ended queue and the first node -- is reserved for the queue itself. -- the implementation is mostly borrowed from nginx's ngx_queue_t data -- structure. ffi.cdef[[ /* A lrucache_pureffi_queue_s node hook together three data structures: * o. the key/value store as embodied by the "id" (which is in essence the * indentifier of key/pair pair) and the "expire" (which is a metadata * of the corresponding key/pair pair). * o. The LRU queue via the prev/next fields. * o. The hash-tabble as embodied by the "conflict" field. */ typedef struct lrucache_pureffi_queue_s lrucache_pureffi_queue_t; struct lrucache_pureffi_queue_s { /* Each node is assigned a unique ID at construction time, and the * ID remain immutatble, regardless the node is in active-list or * free-list. The queue header is assigned ID 0. Since queue-header * is a sentinel node, 0 denodes "invalid ID". * * Intuitively, we can view the "id" as the identifier of key/value * pair. */ int id; /* The bucket of the hash-table is implemented as a singly-linked list. * The "conflict" refers to the ID of the next node in the bucket. */ int conflict; uint32_t user_flags; double expire; /* in seconds */ lrucache_pureffi_queue_t *prev; lrucache_pureffi_queue_t *next; }; ]] local queue_arr_type = ffi.typeof("lrucache_pureffi_queue_t[?]") --local queue_ptr_type = ffi.typeof("lrucache_pureffi_queue_t*") local queue_type = ffi.typeof("lrucache_pureffi_queue_t") local NULL = ffi.null --======================================================================== -- -- Queue utility functions -- --======================================================================== -- Append the element "x" to the given queue "h". local function queue_insert_tail(h, x) local last = h[0].prev x.prev = last last.next = x x.next = h h[0].prev = x end --[[ Allocate a queue with size + 1 elements. Elements are linked together in a circular way, i.e. the last element's "next" points to the first element, while the first element's "prev" element points to the last element. ]] local function queue_init(size) if not size then size = 0 end local q = ffi_new(queue_arr_type, size + 1) ffi_fill(q, ffi_sizeof(queue_type, size + 1), 0) if size == 0 then q[0].prev = q q[0].next = q else local prev = q[0] for i = 1, size do local e = q[i] e.id = i e.user_flags = 0 prev.next = e e.prev = prev prev = e end local last = q[size] last.next = q q[0].prev = last end return q end local function queue_is_empty(q) -- print("q: ", tostring(q), "q.prev: ", tostring(q), ": ", q == q.prev) return q == q[0].prev end local function queue_remove(x) local prev = x.prev local next = x.next next.prev = prev prev.next = next -- for debugging purpose only: x.prev = NULL x.next = NULL end -- Insert the element "x" the to the given queue "h" local function queue_insert_head(h, x) x.next = h[0].next x.next.prev = x x.prev = h h[0].next = x end local function queue_last(h) return h[0].prev end local function queue_head(h) return h[0].next end --======================================================================== -- -- Miscellaneous Utility Functions -- --======================================================================== local function ptr2num(ptr) return tonumber(ffi_cast(uintptr_t, ptr)) end local function crc32_ptr(ptr) local p = brshift(ptr2num(ptr), 3) local b = band(p, 255) local crc32 = crc_tab[b] b = band(brshift(p, 8), 255) crc32 = bxor(brshift(crc32, 8), crc_tab[band(bxor(crc32, b), 255)]) b = band(brshift(p, 16), 255) crc32 = bxor(brshift(crc32, 8), crc_tab[band(bxor(crc32, b), 255)]) --b = band(brshift(p, 24), 255) --crc32 = bxor(brshift(crc32, 8), crc_tab[band(bxor(crc32, b), 255)]) return crc32 end --======================================================================== -- -- Implementation of "export" functions -- --======================================================================== local _M = { _VERSION = '0.13' } local mt = { __index = _M } -- "size" specifies the maximum number of entries in the LRU queue, and the -- "load_factor" designates the 'load factor' of the hash-table we are using -- internally. The default value of load-factor is 0.5 (i.e. 50%); if the -- load-factor is specified, it will be clamped to the range of [0.1, 1](i.e. -- if load-factor is greater than 1, it will be saturated to 1, likewise, -- if load-factor is smaller than 0.1, it will be clamped to 0.1). function _M.new(size, load_factor) if size < 1 then return nil, "size too small" end -- Determine bucket size, which must be power of two. local load_f = load_factor if not load_factor then load_f = 0.5 elseif load_factor > 1 then load_f = 1 elseif load_factor < 0.1 then load_f = 0.1 end local bs_min = size / load_f -- The bucket_sz *MUST* be a power-of-two. See the hash_string(). local bucket_sz = 1 repeat bucket_sz = bucket_sz * 2 until bucket_sz >= bs_min local self = { size = size, bucket_sz = bucket_sz, free_queue = queue_init(size), cache_queue = queue_init(0), node_v = nil, key_v = new_tab(size, 0), val_v = new_tab(size, 0), bucket_v = ffi_new(int_array_t, bucket_sz), num_items = 0, } -- "node_v" is an array of all the nodes used in the LRU queue. Exprpession -- node_v[i] evaluates to the element of ID "i". self.node_v = self.free_queue -- Allocate the array-part of the key_v, val_v, bucket_v. --local key_v = self.key_v --local val_v = self.val_v --local bucket_v = self.bucket_v ffi_fill(self.bucket_v, ffi_sizeof(int_t, bucket_sz), 0) return setmetatable(self, mt) end function _M.count(self) return self.num_items end function _M.capacity(self) return self.size end local function hash_string(self, str) local c_str = ffi_cast(c_str_t, str) local hv = crc32_ptr(c_str) hv = band(hv, self.bucket_sz - 1) -- Hint: bucket is 0-based return hv end -- Search the node associated with the key in the bucket, if found returns -- the the id of the node, and the id of its previous node in the conflict list. -- The "bucket_hdr_id" is the ID of the first node in the bucket local function _find_node_in_bucket(key, key_v, node_v, bucket_hdr_id) if bucket_hdr_id ~= 0 then local prev = 0 local cur = bucket_hdr_id while cur ~= 0 and key_v[cur] ~= key do prev = cur cur = node_v[cur].conflict end if cur ~= 0 then return cur, prev end end end -- Return the node corresponding to the key/val. local function find_key(self, key) local key_hash = hash_string(self, key) return _find_node_in_bucket(key, self.key_v, self.node_v, self.bucket_v[key_hash]) end --[[ This function tries to 1. Remove the given key and the associated value from the key/value store, 2. Remove the entry associated with the key from the hash-table. NOTE: all queues remain intact. If there was a node bound to the key/val, return that node; otherwise, nil is returned. ]] local function remove_key(self, key) local key_v = self.key_v local val_v = self.val_v local node_v = self.node_v local bucket_v = self.bucket_v local key_hash = hash_string(self, key) local cur, prev = _find_node_in_bucket(key, key_v, node_v, bucket_v[key_hash]) if cur then -- In an attempt to make key and val dead. key_v[cur] = nil val_v[cur] = nil self.num_items = self.num_items - 1 -- Remove the node from the hash table local next_node = node_v[cur].conflict if prev ~= 0 then node_v[prev].conflict = next_node else bucket_v[key_hash] = next_node end node_v[cur].conflict = 0 return cur end end --[[ Bind the key/val with the given node, and insert the node into the Hashtab. NOTE: this function does not touch any queue ]] local function insert_key(self, key, val, node) -- Bind the key/val with the node local node_id = node.id self.key_v[node_id] = key self.val_v[node_id] = val -- Insert the node into the hash-table local key_hash = hash_string(self, key) local bucket_v = self.bucket_v node.conflict = bucket_v[key_hash] bucket_v[key_hash] = node_id self.num_items = self.num_items + 1 end function _M.get(self, key) if type(key) ~= "string" then key = tostring(key) end local node_id = find_key(self, key) if not node_id then return nil end -- print(key, ": moving node ", tostring(node), " to cache queue head") local cache_queue = self.cache_queue local node = self.node_v + node_id queue_remove(node) queue_insert_head(cache_queue, node) local expire = node.expire if expire >= 0 and expire < ngx_now() then -- print("expired: ", node.expire, " > ", ngx_now()) return nil, self.val_v[node_id], node.user_flags end return self.val_v[node_id], nil, node.user_flags end function _M.delete(self, key) if type(key) ~= "string" then key = tostring(key) end local node_id = remove_key(self, key); if not node_id then return false end local node = self.node_v + node_id queue_remove(node) queue_insert_tail(self.free_queue, node) return true end function _M.set(self, key, value, ttl, flags) if type(key) ~= "string" then key = tostring(key) end local node_id = find_key(self, key) local node if not node_id then local free_queue = self.free_queue if queue_is_empty(free_queue) then -- evict the least recently used key -- assert(not queue_is_empty(self.cache_queue)) node = queue_last(self.cache_queue) remove_key(self, self.key_v[node.id]) else -- take a free queue node node = queue_head(free_queue) -- print(key, ": get a new free node: ", tostring(node)) end -- insert the key insert_key(self, key, value, node) else node = self.node_v + node_id self.val_v[node_id] = value end queue_remove(node) queue_insert_head(self.cache_queue, node) if ttl then node.expire = ngx_now() + ttl else node.expire = -1 end if type(flags) == "number" and flags >= 0 then node.user_flags = flags else node.user_flags = 0 end end function _M.get_keys(self, max_count, res) if not max_count or max_count == 0 then max_count = self.num_items end if not res then res = new_tab(max_count + 1, 0) -- + 1 for trailing hole end local cache_queue = self.cache_queue local key_v = self.key_v local i = 0 local node = queue_head(cache_queue) while node ~= cache_queue do if i >= max_count then break end i = i + 1 res[i] = key_v[node.id] node = node.next end res[i + 1] = nil return res end function _M.flush_all(self) local cache_queue = self.cache_queue local key_v = self.key_v local node = queue_head(cache_queue) while node ~= cache_queue do local key = key_v[node.id] node = node.next _M.delete(self, key) end end return _M PK=N]Nssresty/http.luanu[local http_headers = require "resty.http_headers" local ngx = ngx local ngx_socket_tcp = ngx.socket.tcp local ngx_req = ngx.req local ngx_req_socket = ngx_req.socket local ngx_req_get_headers = ngx_req.get_headers local ngx_req_get_method = ngx_req.get_method local str_gmatch = string.gmatch local str_lower = string.lower local str_upper = string.upper local str_find = string.find local str_sub = string.sub local tbl_concat = table.concat local tbl_insert = table.insert local ngx_encode_args = ngx.encode_args local ngx_re_match = ngx.re.match local ngx_re_gmatch = ngx.re.gmatch local ngx_re_sub = ngx.re.sub local ngx_re_gsub = ngx.re.gsub local ngx_re_find = ngx.re.find local ngx_log = ngx.log local ngx_DEBUG = ngx.DEBUG local ngx_ERR = ngx.ERR local ngx_var = ngx.var local ngx_print = ngx.print local ngx_header = ngx.header local co_yield = coroutine.yield local co_create = coroutine.create local co_status = coroutine.status local co_resume = coroutine.resume local setmetatable = setmetatable local tonumber = tonumber local tostring = tostring local unpack = unpack local rawget = rawget local select = select local ipairs = ipairs local pairs = pairs local pcall = pcall local type = type -- http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.5.1 local HOP_BY_HOP_HEADERS = { ["connection"] = true, ["keep-alive"] = true, ["proxy-authenticate"] = true, ["proxy-authorization"] = true, ["te"] = true, ["trailers"] = true, ["transfer-encoding"] = true, ["upgrade"] = true, ["content-length"] = true, -- Not strictly hop-by-hop, but Nginx will deal -- with this (may send chunked for example). } -- Reimplemented coroutine.wrap, returning "nil, err" if the coroutine cannot -- be resumed. This protects user code from inifite loops when doing things like -- repeat -- local chunk, err = res.body_reader() -- if chunk then -- <-- This could be a string msg in the core wrap function. -- ... -- end -- until not chunk local co_wrap = function(func) local co = co_create(func) if not co then return nil, "could not create coroutine" else return function(...) if co_status(co) == "suspended" then return select(2, co_resume(co, ...)) else return nil, "can't resume a " .. co_status(co) .. " coroutine" end end end end -- Returns a new table, recursively copied from the one given. -- -- @param table table to be copied -- @return table local function tbl_copy(orig) local orig_type = type(orig) local copy if orig_type == "table" then copy = {} for orig_key, orig_value in next, orig, nil do copy[tbl_copy(orig_key)] = tbl_copy(orig_value) end else -- number, string, boolean, etc copy = orig end return copy end local _M = { _VERSION = '0.12', } _M._USER_AGENT = "lua-resty-http/" .. _M._VERSION .. " (Lua) ngx_lua/" .. ngx.config.ngx_lua_version local mt = { __index = _M } local HTTP = { [1.0] = " HTTP/1.0\r\n", [1.1] = " HTTP/1.1\r\n", } local DEFAULT_PARAMS = { method = "GET", path = "/", version = 1.1, } function _M.new(self) local sock, err = ngx_socket_tcp() if not sock then return nil, err end return setmetatable({ sock = sock, keepalive = true }, mt) end function _M.set_timeout(self, timeout) local sock = self.sock if not sock then return nil, "not initialized" end return sock:settimeout(timeout) end function _M.set_timeouts(self, connect_timeout, send_timeout, read_timeout) local sock = self.sock if not sock then return nil, "not initialized" end return sock:settimeouts(connect_timeout, send_timeout, read_timeout) end function _M.ssl_handshake(self, ...) local sock = self.sock if not sock then return nil, "not initialized" end self.ssl = true return sock:sslhandshake(...) end function _M.connect(self, ...) local sock = self.sock if not sock then return nil, "not initialized" end self.host = select(1, ...) self.port = select(2, ...) -- If port is not a number, this is likely a unix domain socket connection. if type(self.port) ~= "number" then self.port = nil end self.keepalive = true return sock:connect(...) end function _M.set_keepalive(self, ...) local sock = self.sock if not sock then return nil, "not initialized" end if self.keepalive == true then return sock:setkeepalive(...) else -- The server said we must close the connection, so we cannot setkeepalive. -- If close() succeeds we return 2 instead of 1, to differentiate between -- a normal setkeepalive() failure and an intentional close(). local res, err = sock:close() if res then return 2, "connection must be closed" else return res, err end end end function _M.get_reused_times(self) local sock = self.sock if not sock then return nil, "not initialized" end return sock:getreusedtimes() end function _M.close(self) local sock = self.sock if not sock then return nil, "not initialized" end return sock:close() end local function _should_receive_body(method, code) if method == "HEAD" then return nil end if code == 204 or code == 304 then return nil end if code >= 100 and code < 200 then return nil end return true end function _M.parse_uri(self, uri, query_in_path) if query_in_path == nil then query_in_path = true end local m, err = ngx_re_match(uri, [[^(?:(http[s]?):)?//([^:/\?]+)(?::(\d+))?([^\?]*)\??(.*)]], "jo") if not m then if err then return nil, "failed to match the uri: " .. uri .. ", " .. err end return nil, "bad uri: " .. uri else -- If the URI is schemaless (i.e. //example.com) try to use our current -- request scheme. if not m[1] then local scheme = ngx_var.scheme if scheme == "http" or scheme == "https" then m[1] = scheme else return nil, "schemaless URIs require a request context: " .. uri end end if m[3] then m[3] = tonumber(m[3]) else if m[1] == "https" then m[3] = 443 else m[3] = 80 end end if not m[4] or "" == m[4] then m[4] = "/" end if query_in_path and m[5] and m[5] ~= "" then m[4] = m[4] .. "?" .. m[5] m[5] = nil end return m, nil end end local function _format_request(params) local version = params.version local headers = params.headers or {} local query = params.query or "" if type(query) == "table" then query = "?" .. ngx_encode_args(query) elseif query ~= "" and str_sub(query, 1, 1) ~= "?" then query = "?" .. query end -- Initialize request local req = { str_upper(params.method), " ", params.path, query, HTTP[version], -- Pre-allocate slots for minimum headers and carriage return. true, true, true, } local c = 6 -- req table index it's faster to do this inline vs table.insert -- Append headers for key, values in pairs(headers) do if type(values) ~= "table" then values = {values} end key = tostring(key) for _, value in pairs(values) do req[c] = key .. ": " .. tostring(value) .. "\r\n" c = c + 1 end end -- Close headers req[c] = "\r\n" return tbl_concat(req) end local function _receive_status(sock) local line, err = sock:receive("*l") if not line then return nil, nil, nil, err end return tonumber(str_sub(line, 10, 12)), tonumber(str_sub(line, 6, 8)), str_sub(line, 14) end local function _receive_headers(sock) local headers = http_headers.new() repeat local line, err = sock:receive("*l") if not line then return nil, err end local m, err = ngx_re_match(line, "([^:\\s]+):\\s*(.+)", "jo") if not m then break end local key = m[1] local val = m[2] if headers[key] then if type(headers[key]) ~= "table" then headers[key] = { headers[key] } end tbl_insert(headers[key], tostring(val)) else headers[key] = tostring(val) end until ngx_re_find(line, "^\\s*$", "jo") return headers, nil end local function _chunked_body_reader(sock, default_chunk_size) return co_wrap(function(max_chunk_size) local remaining = 0 local length max_chunk_size = max_chunk_size or default_chunk_size repeat -- If we still have data on this chunk if max_chunk_size and remaining > 0 then if remaining > max_chunk_size then -- Consume up to max_chunk_size length = max_chunk_size remaining = remaining - max_chunk_size else -- Consume all remaining length = remaining remaining = 0 end else -- This is a fresh chunk -- Receive the chunk size local str, err = sock:receive("*l") if not str then co_yield(nil, err) end length = tonumber(str, 16) if not length then co_yield(nil, "unable to read chunksize") end if max_chunk_size and length > max_chunk_size then -- Consume up to max_chunk_size remaining = length - max_chunk_size length = max_chunk_size end end if length > 0 then local str, err = sock:receive(length) if not str then co_yield(nil, err) end max_chunk_size = co_yield(str) or default_chunk_size -- If we're finished with this chunk, read the carriage return. if remaining == 0 then sock:receive(2) -- read \r\n end else -- Read the last (zero length) chunk's carriage return sock:receive(2) -- read \r\n end until length == 0 end) end local function _body_reader(sock, content_length, default_chunk_size) return co_wrap(function(max_chunk_size) max_chunk_size = max_chunk_size or default_chunk_size if not content_length and max_chunk_size then -- We have no length, but wish to stream. -- HTTP 1.0 with no length will close connection, so read chunks to the end. repeat local str, err, partial = sock:receive(max_chunk_size) if not str and err == "closed" then co_yield(partial, err) end max_chunk_size = tonumber(co_yield(str) or default_chunk_size) if max_chunk_size and max_chunk_size < 0 then max_chunk_size = nil end if not max_chunk_size then ngx_log(ngx_ERR, "Buffer size not specified, bailing") break end until not str elseif not content_length then -- We have no length but don't wish to stream. -- HTTP 1.0 with no length will close connection, so read to the end. co_yield(sock:receive("*a")) elseif not max_chunk_size then -- We have a length and potentially keep-alive, but want everything. co_yield(sock:receive(content_length)) else -- We have a length and potentially a keep-alive, and wish to stream -- the response. local received = 0 repeat local length = max_chunk_size if received + length > content_length then length = content_length - received end if length > 0 then local str, err = sock:receive(length) if not str then co_yield(nil, err) end received = received + length max_chunk_size = tonumber(co_yield(str) or default_chunk_size) if max_chunk_size and max_chunk_size < 0 then max_chunk_size = nil end if not max_chunk_size then ngx_log(ngx_ERR, "Buffer size not specified, bailing") break end end until length == 0 end end) end local function _no_body_reader() return nil end local function _read_body(res) local reader = res.body_reader if not reader then -- Most likely HEAD or 304 etc. return nil, "no body to be read" end local chunks = {} local c = 1 local chunk, err repeat chunk, err = reader() if err then return nil, err, tbl_concat(chunks) -- Return any data so far. end if chunk then chunks[c] = chunk c = c + 1 end until not chunk return tbl_concat(chunks) end local function _trailer_reader(sock) return co_wrap(function() co_yield(_receive_headers(sock)) end) end local function _read_trailers(res) local reader = res.trailer_reader if not reader then return nil, "no trailers" end local trailers = reader() setmetatable(res.headers, { __index = trailers }) end local function _send_body(sock, body) if type(body) == 'function' then repeat local chunk, err, partial = body() if chunk then local ok, err = sock:send(chunk) if not ok then return nil, err end elseif err ~= nil then return nil, err, partial end until chunk == nil elseif body ~= nil then local bytes, err = sock:send(body) if not bytes then return nil, err end end return true, nil end local function _handle_continue(sock, body) local status, version, reason, err = _receive_status(sock) if not status then return nil, nil, err end -- Only send body if we receive a 100 Continue if status == 100 then local ok, err = sock:receive("*l") -- Read carriage return if not ok then return nil, nil, err end _send_body(sock, body) end return status, version, err end function _M.send_request(self, params) -- Apply defaults setmetatable(params, { __index = DEFAULT_PARAMS }) local sock = self.sock local body = params.body local headers = http_headers.new() local params_headers = params.headers if params_headers then -- We assign one by one so that the metatable can handle case insensitivity -- for us. You can blame the spec for this inefficiency. for k,v in pairs(params_headers) do headers[k] = v end end -- Ensure minimal headers are set if type(body) == 'string' and not headers["Content-Length"] then headers["Content-Length"] = #body end if not headers["Host"] then if (str_sub(self.host, 1, 5) == "unix:") then return nil, "Unable to generate a useful Host header for a unix domain socket. Please provide one." end -- If we have a port (i.e. not connected to a unix domain socket), and this -- port is non-standard, append it to the Host heaer. if self.port then if self.ssl and self.port ~= 443 then headers["Host"] = self.host .. ":" .. self.port elseif not self.ssl and self.port ~= 80 then headers["Host"] = self.host .. ":" .. self.port else headers["Host"] = self.host end else headers["Host"] = self.host end end if not headers["User-Agent"] then headers["User-Agent"] = _M._USER_AGENT end if params.version == 1.0 and not headers["Connection"] then headers["Connection"] = "Keep-Alive" end params.headers = headers -- Format and send request local req = _format_request(params) ngx_log(ngx_DEBUG, "\n", req) local bytes, err = sock:send(req) if not bytes then return nil, err end -- Send the request body, unless we expect: continue, in which case -- we handle this as part of reading the response. if headers["Expect"] ~= "100-continue" then local ok, err, partial = _send_body(sock, body) if not ok then return nil, err, partial end end return true end function _M.read_response(self, params) local sock = self.sock local status, version, reason, err -- If we expect: continue, we need to handle this, sending the body if allowed. -- If we don't get 100 back, then status is the actual status. if params.headers["Expect"] == "100-continue" then local _status, _version, _err = _handle_continue(sock, params.body) if not _status then return nil, _err elseif _status ~= 100 then status, version, err = _status, _version, _err end end -- Just read the status as normal. if not status then status, version, reason, err = _receive_status(sock) if not status then return nil, err end end local res_headers, err = _receive_headers(sock) if not res_headers then return nil, err end -- keepalive is true by default. Determine if this is correct or not. local ok, connection = pcall(str_lower, res_headers["Connection"]) if ok then if (version == 1.1 and connection == "close") or (version == 1.0 and connection ~= "keep-alive") then self.keepalive = false end else -- no connection header if version == 1.0 then self.keepalive = false end end local body_reader = _no_body_reader local trailer_reader, err local has_body = false -- Receive the body_reader if _should_receive_body(params.method, status) then local ok, encoding = pcall(str_lower, res_headers["Transfer-Encoding"]) if ok and version == 1.1 and encoding == "chunked" then body_reader, err = _chunked_body_reader(sock) has_body = true else local ok, length = pcall(tonumber, res_headers["Content-Length"]) if ok then body_reader, err = _body_reader(sock, length) has_body = true end end end if res_headers["Trailer"] then trailer_reader, err = _trailer_reader(sock) end if err then return nil, err else return { status = status, reason = reason, headers = res_headers, has_body = has_body, body_reader = body_reader, read_body = _read_body, trailer_reader = trailer_reader, read_trailers = _read_trailers, } end end function _M.request(self, params) params = tbl_copy(params) -- Take by value local res, err = self:send_request(params) if not res then return res, err else return self:read_response(params) end end function _M.request_pipeline(self, requests) requests = tbl_copy(requests) -- Take by value for _, params in ipairs(requests) do if params.headers and params.headers["Expect"] == "100-continue" then return nil, "Cannot pipeline request specifying Expect: 100-continue" end local res, err = self:send_request(params) if not res then return res, err end end local responses = {} for i, params in ipairs(requests) do responses[i] = setmetatable({ params = params, response_read = false, }, { -- Read each actual response lazily, at the point the user tries -- to access any of the fields. __index = function(t, k) local res, err if t.response_read == false then res, err = _M.read_response(self, t.params) t.response_read = true if not res then ngx_log(ngx_ERR, err) else for rk, rv in pairs(res) do t[rk] = rv end end end return rawget(t, k) end, }) end return responses end function _M.request_uri(self, uri, params) params = tbl_copy(params or {}) -- Take by value local parsed_uri, err = self:parse_uri(uri, false) if not parsed_uri then return nil, err end local scheme, host, port, path, query = unpack(parsed_uri) if not params.path then params.path = path end if not params.query then params.query = query end -- See if we should use a proxy to make this request local proxy_uri = self:get_proxy_uri(scheme, host) -- Make the connection either through the proxy or directly -- to the remote host local c, err if proxy_uri then c, err = self:connect_proxy(proxy_uri, scheme, host, port) else c, err = self:connect(host, port) end if not c then return nil, err end if proxy_uri then if scheme == "http" then -- When a proxy is used, the target URI must be in absolute-form -- (RFC 7230, Section 5.3.2.). That is, it must be an absolute URI -- to the remote resource with the scheme, host and an optional port -- in place. -- -- Since _format_request() constructs the request line by concatenating -- params.path and params.query together, we need to modify the path -- to also include the scheme, host and port so that the final form -- in conformant to RFC 7230. if port == 80 then params.path = scheme .. "://" .. host .. path else params.path = scheme .. "://" .. host .. ":" .. port .. path end end if scheme == "https" then -- don't keep this connection alive as the next request could target -- any host and re-using the proxy tunnel for that is not possible self.keepalive = false end -- self:connect_uri() set the host and port to point to the proxy server. As -- the connection to the proxy has been established, set the host and port -- to point to the actual remote endpoint at the other end of the tunnel to -- ensure the correct Host header added to the requests. self.host = host self.port = port end if scheme == "https" then local verify = true if params.ssl_verify == false then verify = false end local ok, err = self:ssl_handshake(nil, host, verify) if not ok then return nil, err end end local res, err = self:request(params) if not res then return nil, err end local body, err = res:read_body() if not body then return nil, err end res.body = body local ok, err = self:set_keepalive() if not ok then ngx_log(ngx_ERR, err) end return res, nil end function _M.get_client_body_reader(self, chunksize, sock) chunksize = chunksize or 65536 if not sock then local ok, err ok, sock, err = pcall(ngx_req_socket) if not ok then return nil, sock -- pcall err end if not sock then if err == "no body" then return nil else return nil, err end end end local headers = ngx_req_get_headers() local length = headers.content_length local encoding = headers.transfer_encoding if length then return _body_reader(sock, tonumber(length), chunksize) elseif encoding and str_lower(encoding) == 'chunked' then -- Not yet supported by ngx_lua but should just work... return _chunked_body_reader(sock, chunksize) else return nil end end function _M.proxy_request(self, chunksize) return self:request{ method = ngx_req_get_method(), path = ngx_re_gsub(ngx_var.uri, "\\s", "%20", "jo") .. ngx_var.is_args .. (ngx_var.query_string or ""), body = self:get_client_body_reader(chunksize), headers = ngx_req_get_headers(), } end function _M.proxy_response(self, response, chunksize) if not response then ngx_log(ngx_ERR, "no response provided") return end ngx.status = response.status -- Filter out hop-by-hop headeres for k,v in pairs(response.headers) do if not HOP_BY_HOP_HEADERS[str_lower(k)] then ngx_header[k] = v end end local reader = response.body_reader repeat local chunk, err = reader(chunksize) if err then ngx_log(ngx_ERR, err) break end if chunk then local res, err = ngx_print(chunk) if not res then ngx_log(ngx_ERR, err) break end end until not chunk end function _M.set_proxy_options(self, opts) self.proxy_opts = tbl_copy(opts) -- Take by value end function _M.get_proxy_uri(self, scheme, host) if not self.proxy_opts then return nil end -- Check if the no_proxy option matches this host. Implementation adapted -- from lua-http library (https://github.com/daurnimator/lua-http) if self.proxy_opts.no_proxy then if self.proxy_opts.no_proxy == "*" then -- all hosts are excluded return nil end local no_proxy_set = {} -- wget allows domains in no_proxy list to be prefixed by "." -- e.g. no_proxy=.mit.edu for host_suffix in ngx_re_gmatch(self.proxy_opts.no_proxy, "\\.?([^,]+)") do no_proxy_set[host_suffix[1]] = true end -- From curl docs: -- matched as either a domain which contains the hostname, or the -- hostname itself. For example local.com would match local.com, -- local.com:80, and www.local.com, but not www.notlocal.com. -- -- Therefore, we keep stripping subdomains from the host, compare -- them to the ones in the no_proxy list and continue until we find -- a match or until there's only the TLD left repeat if no_proxy_set[host] then return nil end -- Strip the next level from the domain and check if that one -- is on the list host = ngx_re_sub(host, "^[^.]+\\.", "") until not ngx_re_find(host, "\\.") end if scheme == "http" and self.proxy_opts.http_proxy then return self.proxy_opts.http_proxy end if scheme == "https" and self.proxy_opts.https_proxy then return self.proxy_opts.https_proxy end return nil end function _M.connect_proxy(self, proxy_uri, scheme, host, port) -- Parse the provided proxy URI local parsed_proxy_uri, err = self:parse_uri(proxy_uri, false) if not parsed_proxy_uri then return nil, err end -- Check that the scheme is http (https is not supported for -- connections between the client and the proxy) local proxy_scheme = parsed_proxy_uri[1] if proxy_scheme ~= "http" then return nil, "protocol " .. proxy_scheme .. " not supported for proxy connections" end -- Make the connection to the given proxy local proxy_host, proxy_port = parsed_proxy_uri[2], parsed_proxy_uri[3] local c, err = self:connect(proxy_host, proxy_port) if not c then return nil, err end if scheme == "https" then -- Make a CONNECT request to create a tunnel to the destination through -- the proxy. The request-target and the Host header must be in the -- authority-form of RFC 7230 Section 5.3.3. See also RFC 7231 Section -- 4.3.6 for more details about the CONNECT request local destination = host .. ":" .. port local res, err = self:request({ method = "CONNECT", path = destination, headers = { ["Host"] = destination } }) if not res then return nil, err end if res.status < 200 or res.status > 299 then return nil, "failed to establish a tunnel through a proxy: " .. res.status end end return c, nil end return _M PK=N]resty/lrucache.luanu[-- Copyright (C) Yichun Zhang (agentzh) local ffi = require "ffi" local ffi_new = ffi.new local ffi_sizeof = ffi.sizeof local ffi_cast = ffi.cast local ffi_fill = ffi.fill local ngx_now = ngx.now local uintptr_t = ffi.typeof("uintptr_t") local setmetatable = setmetatable local tonumber = tonumber local type = type local new_tab do local ok ok, new_tab = pcall(require, "table.new") if not ok then new_tab = function(narr, nrec) return {} end end end if string.find(jit.version, " 2.0", 1, true) then ngx.log(ngx.ALERT, "use of lua-resty-lrucache with LuaJIT 2.0 is ", "not recommended; use LuaJIT 2.1+ instead") end local ok, tb_clear = pcall(require, "table.clear") if not ok then local pairs = pairs tb_clear = function (tab) for k, _ in pairs(tab) do tab[k] = nil end end end -- queue data types -- -- this queue is a double-ended queue and the first node -- is reserved for the queue itself. -- the implementation is mostly borrowed from nginx's ngx_queue_t data -- structure. ffi.cdef[[ typedef struct lrucache_queue_s lrucache_queue_t; struct lrucache_queue_s { double expire; /* in seconds */ lrucache_queue_t *prev; lrucache_queue_t *next; uint32_t user_flags; }; ]] local queue_arr_type = ffi.typeof("lrucache_queue_t[?]") local queue_type = ffi.typeof("lrucache_queue_t") local NULL = ffi.null -- queue utility functions local function queue_insert_tail(h, x) local last = h[0].prev x.prev = last last.next = x x.next = h h[0].prev = x end local function queue_init(size) if not size then size = 0 end local q = ffi_new(queue_arr_type, size + 1) ffi_fill(q, ffi_sizeof(queue_type, size + 1), 0) if size == 0 then q[0].prev = q q[0].next = q else local prev = q[0] for i = 1, size do local e = q + i e.user_flags = 0 prev.next = e e.prev = prev prev = e end local last = q[size] last.next = q q[0].prev = last end return q end local function queue_is_empty(q) -- print("q: ", tostring(q), "q.prev: ", tostring(q), ": ", q == q.prev) return q == q[0].prev end local function queue_remove(x) local prev = x.prev local next = x.next next.prev = prev prev.next = next -- for debugging purpose only: x.prev = NULL x.next = NULL end local function queue_insert_head(h, x) x.next = h[0].next x.next.prev = x x.prev = h h[0].next = x end local function queue_last(h) return h[0].prev end local function queue_head(h) return h[0].next end -- true module stuffs local _M = { _VERSION = '0.14' } local mt = { __index = _M } local function ptr2num(ptr) local v = tonumber(ffi_cast(uintptr_t, ptr)) return v end function _M.new(size) if size < 1 then return nil, "size too small" end local self = { hasht = {}, free_queue = queue_init(size), cache_queue = queue_init(), key2node = {}, node2key = {}, num_items = 0, max_items = size, } setmetatable(self, mt) return self end function _M.count(self) return self.num_items end function _M.capacity(self) return self.max_items end function _M.get(self, key) local hasht = self.hasht local val = hasht[key] if val == nil then return nil end local node = self.key2node[key] -- print(key, ": moving node ", tostring(node), " to cache queue head") local cache_queue = self.cache_queue queue_remove(node) queue_insert_head(cache_queue, node) if node.expire >= 0 and node.expire < ngx_now() then -- print("expired: ", node.expire, " > ", ngx_now()) return nil, val, node.user_flags end return val, nil, node.user_flags end function _M.delete(self, key) self.hasht[key] = nil local key2node = self.key2node local node = key2node[key] if not node then return false end key2node[key] = nil self.node2key[ptr2num(node)] = nil queue_remove(node) queue_insert_tail(self.free_queue, node) self.num_items = self.num_items - 1 return true end function _M.set(self, key, value, ttl, flags) local hasht = self.hasht hasht[key] = value local key2node = self.key2node local node = key2node[key] if not node then local free_queue = self.free_queue local node2key = self.node2key if queue_is_empty(free_queue) then -- evict the least recently used key -- assert(not queue_is_empty(self.cache_queue)) node = queue_last(self.cache_queue) local oldkey = node2key[ptr2num(node)] -- print(key, ": evicting oldkey: ", oldkey, ", oldnode: ", -- tostring(node)) if oldkey then hasht[oldkey] = nil key2node[oldkey] = nil end else -- take a free queue node node = queue_head(free_queue) -- only add count if we are not evicting self.num_items = self.num_items + 1 -- print(key, ": get a new free node: ", tostring(node)) end node2key[ptr2num(node)] = key key2node[key] = node end queue_remove(node) queue_insert_head(self.cache_queue, node) if ttl then node.expire = ngx_now() + ttl else node.expire = -1 end if type(flags) == "number" and flags >= 0 then node.user_flags = flags else node.user_flags = 0 end end function _M.get_keys(self, max_count, res) if not max_count or max_count == 0 then max_count = self.num_items end if not res then res = new_tab(max_count + 1, 0) -- + 1 for trailing hole end local cache_queue = self.cache_queue local node2key = self.node2key local i = 0 local node = queue_head(cache_queue) while node ~= cache_queue do if i >= max_count then break end i = i + 1 res[i] = node2key[ptr2num(node)] node = node.next end res[i + 1] = nil return res end function _M.flush_all(self) tb_clear(self.hasht) tb_clear(self.node2key) tb_clear(self.key2node) self.num_items = 0 local cache_queue = self.cache_queue local free_queue = self.free_queue -- splice the cache_queue into free_queue if not queue_is_empty(cache_queue) then local free_head = free_queue[0] local free_last = free_head.prev local cache_head = cache_queue[0] local cache_first = cache_head.next local cache_last = cache_head.prev free_last.next = cache_first cache_first.prev = free_last cache_last.next = free_head free_head.prev = cache_last cache_head.next = cache_queue cache_head.prev = cache_queue end end return _M PK=N]lqresty/core.luanu[-- Copyright (C) Yichun Zhang (agentzh) local subsystem = ngx.config.subsystem require "resty.core.var" require "resty.core.worker" require "resty.core.regex" require "resty.core.shdict" require "resty.core.time" require "resty.core.hash" require "resty.core.uri" require "resty.core.exit" require "resty.core.base64" require "resty.core.request" if subsystem == 'http' then require "resty.core.response" require "resty.core.phase" require "resty.core.ndk" require "resty.core.coroutine" require "resty.core.param" end require "resty.core.socket" require "resty.core.misc" require "resty.core.ctx" local base = require "resty.core.base" return { version = base.version } PK=N]66 resty/rsa.luanu[-- Copyright (C) by Zhu Dejiang (doujiang24) -- Copyright (C) by Zexuan Luo (spacewander) local bit = require "bit" local band = bit.band local ffi = require "ffi" local ffi_new = ffi.new local ffi_gc = ffi.gc local ffi_copy = ffi.copy local ffi_str = ffi.string local C = ffi.C local tab_concat = table.concat local setmetatable = setmetatable local _M = { _VERSION = '1.1.0' } local mt = { __index = _M } local PADDING = { RSA_PKCS1_PADDING = 1, RSA_NO_PADDING = 3, RSA_PKCS1_OAEP_PADDING = 4, } _M.PADDING = PADDING local KEY_TYPE = { PKCS1 = "PKCS#1", PKCS8 = "PKCS#8", PKIX = "PKIX", } local PKCS1_PREFIX = "-----BEGIN RSA " _M.KEY_TYPE = KEY_TYPE ffi.cdef[[ int memcmp(const void *s1, const void *s2, size_t n); typedef struct bio_st BIO; typedef struct bio_method_st BIO_METHOD; BIO_METHOD *BIO_s_mem(void); BIO * BIO_new(BIO_METHOD *type); int BIO_puts(BIO *bp, const char *buf); void BIO_vfree(BIO *a); typedef struct rsa_st RSA; RSA *RSA_new(void); void RSA_free(RSA *rsa); typedef int pem_password_cb(char *buf, int size, int rwflag, void *userdata); RSA * PEM_read_bio_RSAPrivateKey(BIO *bp, RSA **rsa, pem_password_cb *cb, void *u); RSA * PEM_read_bio_RSAPublicKey(BIO *bp, RSA **rsa, pem_password_cb *cb, void *u); RSA * PEM_read_bio_RSA_PUBKEY(BIO *bp, RSA **rsa, pem_password_cb *cb, void *u); unsigned long ERR_get_error_line_data(const char **file, int *line, const char **data, int *flags); const char * ERR_reason_error_string(unsigned long e); typedef struct bignum_st BIGNUM; BIGNUM *BN_new(void); void BN_free(BIGNUM *a); typedef unsigned long BN_ULONG; int BN_set_word(BIGNUM *a, BN_ULONG w); typedef struct bn_gencb_st BN_GENCB; int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb); typedef struct evp_cipher_st EVP_CIPHER; int PEM_write_bio_RSAPrivateKey(BIO *bp, RSA *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen, pem_password_cb *cb, void *u); int PEM_write_bio_RSAPublicKey(BIO *bp, RSA *x); int PEM_write_bio_RSA_PUBKEY(BIO *bp, RSA *x); long BIO_ctrl(BIO *bp, int cmd, long larg, void *parg); int BIO_read(BIO *b, void *data, int len); typedef struct evp_pkey_st EVP_PKEY; typedef struct engine_st ENGINE; typedef struct evp_pkey_ctx_st EVP_PKEY_CTX; EVP_PKEY *EVP_PKEY_new(void); void EVP_PKEY_free(EVP_PKEY *key); EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e); void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx); int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype, int cmd, int p1, void *p2); int EVP_PKEY_size(EVP_PKEY *pkey); int EVP_PKEY_get_size(EVP_PKEY *pkey); int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx, unsigned char *out, size_t *outlen, const unsigned char *in, size_t inlen); int EVP_PKEY_decrypt_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_decrypt(EVP_PKEY_CTX *ctx, unsigned char *out, size_t *outlen, const unsigned char *in, size_t inlen); int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key); int PEM_write_bio_PKCS8PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc, char *kstr, int klen, pem_password_cb *cb, void *u); void OpenSSL_add_all_digests(void); typedef struct env_md_st EVP_MD; typedef struct env_md_ctx_st EVP_MD_CTX; const EVP_MD *EVP_get_digestbyname(const char *name); /* EVP_MD_CTX methods for OpenSSL < 1.1.0 */ EVP_MD_CTX *EVP_MD_CTX_create(void); void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx); /* EVP_MD_CTX methods for OpenSSL >= 1.1.0 */ EVP_MD_CTX *EVP_MD_CTX_new(void); void EVP_MD_CTX_free(EVP_MD_CTX *ctx); int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type); int EVP_DigestUpdate(EVP_MD_CTX *ctx, const unsigned char *in, int inl); int EVP_SignFinal(EVP_MD_CTX *ctx,unsigned char *sig,unsigned int *s, EVP_PKEY *pkey); int EVP_VerifyFinal(EVP_MD_CTX *ctx,unsigned char *sigbuf, unsigned int siglen, EVP_PKEY *pkey); int EVP_PKEY_set1_RSA(EVP_PKEY *e, RSA *r); void ERR_set_error_data(char *data, int flags); ]] --[[ # define EVP_PKEY_CTX_set_rsa_padding(ctx, pad) \ EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING, \ pad, NULL) # define EVP_SignInit(a,b) EVP_DigestInit(a,b) # define EVP_SignUpdate(a,b,c) EVP_DigestUpdate(a,b,c) --]] local EVP_PKEY_ALG_CTRL = 0x1000 local EVP_PKEY_CTRL_RSA_PADDING = EVP_PKEY_ALG_CTRL + 1 local NID_rsaEncryption = 6 local EVP_PKEY_RSA = NID_rsaEncryption local ERR_TXT_STRING = 0x02 local evp_md_ctx_new local evp_md_ctx_free if not pcall(function () return C.EVP_MD_CTX_create end) then evp_md_ctx_new = C.EVP_MD_CTX_new evp_md_ctx_free = C.EVP_MD_CTX_free else evp_md_ctx_new = C.EVP_MD_CTX_create evp_md_ctx_free = C.EVP_MD_CTX_destroy end local evp_pkey_size if not pcall(function () return C.EVP_PKEY_size end) then evp_pkey_size = C.EVP_PKEY_get_size else evp_pkey_size = C.EVP_PKEY_size end local function ssl_err() local err_queue = {} local i = 1 local data = ffi_new("const char*[1]") local flags = ffi_new("int[1]") while true do local code = C.ERR_get_error_line_data(nil, nil, data, flags) if code == 0 then break end local err = C.ERR_reason_error_string(code) if err == nil then err_queue[i] = "unknown openssl error code: " .. code i = i + 1 else err_queue[i] = ffi_str(err) i = i + 1 if data[0] ~= nil and band(flags[0], ERR_TXT_STRING) > 0 then err_queue[i] = ffi_str(data[0]) i = i + 1 end end end if #err_queue == 0 then return nil, "internal error" end return nil, tab_concat(err_queue, ": ", 1, i - 1) end local function has_prefix(s, prefix) if type(s) ~= "string" or type(prefix) ~= "string" then return false end if #s < #prefix then return false end local rc = C.memcmp(s, prefix, #prefix) return rc == 0 end local function read_bio(bio) local BIO_CTRL_PENDING = 10 local keylen = C.BIO_ctrl(bio, BIO_CTRL_PENDING, 0, nil); local key = ffi.new("char[?]", keylen) if C.BIO_read(bio, key, keylen) < 0 then return ssl_err() end return ffi_str(key, keylen) end -- Follow the calling style to avoid careless mistake. function _M.generate_rsa_keys(_, bits, pkcs8) local rsa = C.RSA_new() if rsa == nil then return nil, ssl_err() end ffi_gc(rsa, C.RSA_free) local bn = C.BN_new() if bn == nil then return nil, ssl_err() end ffi_gc(bn, C.BN_free) -- Set public exponent to 65537 if C.BN_set_word(bn, 65537) ~= 1 then return nil, ssl_err() end -- Generate key if C.RSA_generate_key_ex(rsa, bits, bn, nil) ~= 1 then return nil, ssl_err() end local pub_key_bio = C.BIO_new(C.BIO_s_mem()) if pub_key_bio == nil then return nil, ssl_err() end ffi_gc(pub_key_bio, C.BIO_vfree) if pkcs8 == true then if C.PEM_write_bio_RSA_PUBKEY(pub_key_bio, rsa) ~= 1 then return nil, ssl_err() end else if C.PEM_write_bio_RSAPublicKey(pub_key_bio, rsa) ~= 1 then return nil, ssl_err() end end local public_key, err = read_bio(pub_key_bio) if not public_key then return nil, nil, err end local priv_key_bio = C.BIO_new(C.BIO_s_mem()) if priv_key_bio == nil then return nil, ssl_err() end ffi_gc(priv_key_bio, C.BIO_vfree) if pkcs8 == true then local pk = C.EVP_PKEY_new() if pk == nil then return nil, ssl_err() end ffi_gc(pk, C.EVP_PKEY_free) if C.EVP_PKEY_set1_RSA(pk,rsa) ~= 1 then return nil, ssl_err() end if C.PEM_write_bio_PKCS8PrivateKey(priv_key_bio, pk, nil, nil, 0, nil, nil) ~= 1 then return nil, ssl_err() end else if C.PEM_write_bio_RSAPrivateKey(priv_key_bio, rsa, nil, nil, 0, nil, nil) ~= 1 then return nil, ssl_err() end end local private_key private_key, err = read_bio(priv_key_bio) if not private_key then return nil, nil, err end return public_key, private_key end function _M.new(_, opts) local key, read_func, is_pub, md if opts.public_key then key = opts.public_key if opts.key_type == KEY_TYPE.PKIX or opts.key_type == KEY_TYPE.PKCS8 -- for compatible then read_func = C.PEM_read_bio_RSA_PUBKEY elseif opts.key_type == KEY_TYPE.PKCS1 then read_func = C.PEM_read_bio_RSAPublicKey else local is_pkcs1 = has_prefix(key, PKCS1_PREFIX) if is_pkcs1 then read_func = C.PEM_read_bio_RSAPublicKey else read_func = C.PEM_read_bio_RSA_PUBKEY end end is_pub = true elseif opts.private_key then key = opts.private_key read_func = C.PEM_read_bio_RSAPrivateKey else return nil, "public_key or private_key not found" end local bio_method = C.BIO_s_mem() local bio = C.BIO_new(bio_method) if bio == nil then return ssl_err() end ffi_gc(bio, C.BIO_vfree) local len = C.BIO_puts(bio, key) if len < 0 then return ssl_err() end local pass if opts.password then local plen = #opts.password pass = ffi_new("unsigned char[?]", plen + 1) ffi_copy(pass, opts.password, plen) end local rsa = read_func(bio, nil, nil, pass) if rsa == nil then return ssl_err() end ffi_gc(rsa, C.RSA_free) -- EVP_PKEY local pkey = C.EVP_PKEY_new() if pkey == nil then return ssl_err() end ffi_gc(pkey, C.EVP_PKEY_free) if C.EVP_PKEY_set1_RSA(pkey, rsa) == 0 then return ssl_err() end --EVP_PKEY_CTX local ctx = C.EVP_PKEY_CTX_new(pkey, nil) if ctx == nil then return ssl_err() end ffi_gc(ctx, C.EVP_PKEY_CTX_free) -- md_ctx init for sign or verify; if signature algorithm is seted if opts.algorithm then md = C.EVP_get_digestbyname(opts.algorithm) if md == nil then return nil, "Unknown message digest" end end -- ctx init for encrypt or decrypt -- default for encrypt/decrypt if nothing is set if opts.padding or not opts.digest then local init_func = is_pub and C.EVP_PKEY_encrypt_init or C.EVP_PKEY_decrypt_init if init_func(ctx) <= 0 then return ssl_err() end if C.EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING, opts.padding or PADDING.RSA_PKCS1_PADDING, nil) <= 0 then return ssl_err() end end local size = evp_pkey_size(pkey) return setmetatable({ pkey = pkey, size = size, buf = ffi_new("unsigned char[?]", size), _encrypt_ctx = is_pub and ctx or nil, _decrypt_ctx = not is_pub and ctx or nil, is_pub = is_pub, md = md, }, mt) end function _M.decrypt(self, str) local ctx = self._decrypt_ctx if not ctx then return nil, "not inited for decrypt" end local len = ffi_new("size_t [1]") if C.EVP_PKEY_decrypt(ctx, nil, len, str, #str) <= 0 then return ssl_err() end local buf = self.buf if C.EVP_PKEY_decrypt(ctx, buf, len, str, #str) <= 0 then return ssl_err() end return ffi_str(buf, len[0]) end function _M.encrypt(self, str) local ctx = self._encrypt_ctx if not ctx then return nil, "not inited for encrypt" end local len = ffi_new("size_t [1]") if C.EVP_PKEY_encrypt(ctx, nil, len, str, #str) <= 0 then return ssl_err() end local buf = self.buf if C.EVP_PKEY_encrypt(ctx, buf, len, str, #str) <= 0 then return ssl_err() end return ffi_str(buf, len[0]) end function _M.sign(self, str) if self.is_pub then return nil, "not inited for sign" end local md_ctx = evp_md_ctx_new() if md_ctx == nil then return ssl_err() end ffi_gc(md_ctx, evp_md_ctx_free) if C.EVP_DigestInit(md_ctx, self.md) <= 0 then return ssl_err() end if C.EVP_DigestUpdate(md_ctx, str, #str) <= 0 then return ssl_err() end local buf = self.buf local len = ffi_new("unsigned int[1]") if C.EVP_SignFinal(md_ctx, self.buf, len, self.pkey) <= 0 then return ssl_err() end return ffi_str(buf, len[0]) end function _M.verify(self, str, sig) if not self.is_pub then return nil, "not inited for verify" end local md_ctx = evp_md_ctx_new() if md_ctx == nil then return ssl_err() end ffi_gc(md_ctx, evp_md_ctx_free) if C.EVP_DigestInit(md_ctx, self.md) <= 0 then return ssl_err() end if C.EVP_DigestUpdate(md_ctx, str, #str) <= 0 then return ssl_err() end local siglen = #sig local buf = siglen <= self.size and self.buf or ffi_new("unsigned char[?]", siglen) ffi_copy(buf, sig, siglen) if C.EVP_VerifyFinal(md_ctx, buf, siglen, self.pkey) <= 0 then return ssl_err() end return true end return _M PK@N]9=e~~resty/http_headers.luanu[local rawget, rawset, setmetatable = rawget, rawset, setmetatable local str_lower = string.lower local _M = { _VERSION = '0.12', } -- Returns an empty headers table with internalised case normalisation. function _M.new() local mt = { normalised = {}, } mt.__index = function(t, k) return rawget(t, mt.normalised[str_lower(k)]) end mt.__newindex = function(t, k, v) local k_normalised = str_lower(k) -- First time seeing this header field? if not mt.normalised[k_normalised] then -- Create a lowercased entry in the metatable proxy, with the value -- of the given field case mt.normalised[k_normalised] = k -- Set the header using the given field case rawset(t, k, v) else -- We're being updated just with a different field case. Use the -- normalised metatable proxy to give us the original key case, and -- perorm a rawset() to update the value. rawset(t, mt.normalised[k_normalised], v) end end return setmetatable({}, mt) end return _M PK@N]SSresty/lock.luanu[-- Copyright (C) Yichun Zhang (agentzh) require "resty.core.shdict" -- enforce this to avoid dead locks local ffi = require "ffi" local ffi_new = ffi.new local shared = ngx.shared local sleep = ngx.sleep local log = ngx.log local max = math.max local min = math.min local debug = ngx.config.debug local setmetatable = setmetatable local tonumber = tonumber local _M = { _VERSION = '0.08' } local mt = { __index = _M } local ERR = ngx.ERR local FREE_LIST_REF = 0 -- FIXME: we don't need this when we have __gc metamethod support on Lua -- tables. local memo = {} if debug then _M.memo = memo end local function ref_obj(key) if key == nil then return -1 end local ref = memo[FREE_LIST_REF] if ref and ref ~= 0 then memo[FREE_LIST_REF] = memo[ref] else ref = #memo + 1 end memo[ref] = key -- print("ref key_id returned ", ref) return ref end if debug then _M.ref_obj = ref_obj end local function unref_obj(ref) if ref >= 0 then memo[ref] = memo[FREE_LIST_REF] memo[FREE_LIST_REF] = ref end end if debug then _M.unref_obj = unref_obj end local function gc_lock(cdata) local dict_id = tonumber(cdata.dict_id) local key_id = tonumber(cdata.key_id) -- print("key_id: ", key_id, ", key: ", memo[key_id], "dict: ", -- type(memo[cdata.dict_id])) if key_id > 0 then local key = memo[key_id] unref_obj(key_id) local dict = memo[dict_id] -- print("dict.delete type: ", type(dict.delete)) local ok, err = dict:delete(key) if not ok then log(ERR, 'failed to delete key "', key, '": ', err) end cdata.key_id = 0 end unref_obj(dict_id) end local ctype = ffi.metatype("struct { int key_id; int dict_id; }", { __gc = gc_lock }) function _M.new(_, dict_name, opts) local dict = shared[dict_name] if not dict then return nil, "dictionary not found" end local cdata = ffi_new(ctype) cdata.key_id = 0 cdata.dict_id = ref_obj(dict) local timeout, exptime, step, ratio, max_step if opts then timeout = opts.timeout exptime = opts.exptime step = opts.step ratio = opts.ratio max_step = opts.max_step end if not exptime then exptime = 30 end if timeout then timeout = min(timeout, exptime) if step then step = min(step, timeout) end end local self = { cdata = cdata, dict = dict, timeout = timeout or 5, exptime = exptime, step = step or 0.001, ratio = ratio or 2, max_step = max_step or 0.5, } setmetatable(self, mt) return self end function _M.lock(self, key) if not key then return nil, "nil key" end local dict = self.dict local cdata = self.cdata if cdata.key_id > 0 then return nil, "locked" end local exptime = self.exptime local ok, err = dict:add(key, true, exptime) if ok then cdata.key_id = ref_obj(key) self.key = key return 0 end if err ~= "exists" then return nil, err end -- lock held by others local step = self.step local ratio = self.ratio local timeout = self.timeout local max_step = self.max_step local elapsed = 0 while timeout > 0 do sleep(step) elapsed = elapsed + step timeout = timeout - step local ok, err = dict:add(key, true, exptime) if ok then cdata.key_id = ref_obj(key) self.key = key return elapsed end if err ~= "exists" then return nil, err end if timeout <= 0 then break end step = min(max(0.001, step * ratio), timeout, max_step) end return nil, "timeout" end function _M.unlock(self) local dict = self.dict local cdata = self.cdata local key_id = tonumber(cdata.key_id) if key_id <= 0 then return nil, "unlocked" end local key = memo[key_id] unref_obj(key_id) local ok, err = dict:delete(key) if not ok then return nil, err end cdata.key_id = 0 return 1 end function _M.expire(self, time) local dict = self.dict local cdata = self.cdata local key_id = tonumber(cdata.key_id) if key_id <= 0 then return nil, "unlocked" end if not time then time = self.exptime end local ok, err = dict:replace(self.key, true, time) if not ok then return nil, err end return true end return _M PK@N]׌T7++resty/template/safe.luanu[return require "resty.template".new(true) PK@N] !resty/template/microbenchmark.luanu[local template = require "resty.template" local ok, new_tab = pcall(require, "table.new") if not ok then new_tab = function() return {} end end local function run(iterations) local gc, total, print, parse, compile, clock, format = collectgarbage, 0, ngx and ngx.say or print, template.parse, template.compile, os.clock, string.format iterations = iterations or 1000 local view = [[
    {% for _, v in ipairs(context) do %}
  • {{v}}
    • {% end %}
]] print(format("Running %d iterations in each test", iterations)) gc() gc() local x = clock() for _ = 1, iterations do parse(view, true) end local z = clock() - x print(format(" Parsing Time: %.6f", z)) total = total + z gc() gc() x = clock() for _ = 1, iterations do compile(view, nil, true) template.cache = {} end z = clock() - x print(format("Compilation Time: %.6f (template)", z)) total = total + z compile(view, nil, true) gc() gc() x = clock() for _ = 1, iterations do compile(view, 1, true) end z = clock() - x print(format("Compilation Time: %.6f (template, cached)", z)) total = total + z local context = { "Emma", "James", "Nicholas", "Mary" } template.cache = {} gc() gc() x = clock() for _ = 1, iterations do compile(view, 1, true)(context) template.cache = {} end z = clock() - x print(format(" Execution Time: %.6f (same template)", z)) total = total + z template.cache = {} compile(view, 1, true) gc() gc() x = clock() for _ = 1, iterations do compile(view, 1, true)(context) end z = clock() - x print(format(" Execution Time: %.6f (same template, cached)", z)) total = total + z template.cache = {} local views = new_tab(iterations, 0) for i = 1, iterations do views[i] = "

Iteration " .. i .. "

\n" .. view end gc() gc() x = clock() for i = 1, iterations do compile(views[i], i, true)(context) end z = clock() - x print(format(" Execution Time: %.6f (different template)", z)) total = total + z gc() gc() x = clock() for i = 1, iterations do compile(views[i], i, true)(context) end z = clock() - x print(format(" Execution Time: %.6f (different template, cached)", z)) total = total + z local contexts = new_tab(iterations, 0) for i = 1, iterations do contexts[i] = { "Emma", "James", "Nicholas", "Mary" } end template.cache = {} gc() gc() x = clock() for i = 1, iterations do compile(views[i], i, true)(contexts[i]) end z = clock() - x print(format(" Execution Time: %.6f (different template, different context)", z)) total = total + z gc() gc() x = clock() for i = 1, iterations do compile(views[i], i, true)(contexts[i]) end z = clock() - x print(format(" Execution Time: %.6f (different template, different context, cached)", z)) total = total + z print(format(" Total Time: %.6f", total)) end return { run = run } PK@N]Eresty/template/html.luanu[local template = require "resty.template" local setmetatable = setmetatable local escape = template.escape local concat = table.concat local pairs = pairs local type = type local function tag(name, content, attr) local r, a = {}, {} content = content or attr r[#r + 1] = "<" r[#r + 1] = name if attr then for k, v in pairs(attr) do if type(k) == "number" then a[#a + 1] = escape(v) else a[#a + 1] = k .. '="' .. escape(v) .. '"' end end if #a > 0 then r[#r + 1] = " " r[#r + 1] = concat(a, " ") end end if type(content) == "string" then r[#r + 1] = ">" r[#r + 1] = escape(content) r[#r + 1] = "" else r[#r + 1] = " />" end return concat(r) end local html = { __index = function(_, name) return function(attr) if type(attr) == "table" then return function(content) return tag(name, content, attr) end else return tag(name, attr) end end end } template.html = setmetatable(html, html) return template.html PK@N]Eb3ZZresty/template.luanu[local setmetatable = setmetatable local loadstring = loadstring local tostring = tostring local setfenv = setfenv local require = require local concat = table.concat local assert = assert local write = io.write local pcall = pcall local phase local open = io.open local load = load local type = type local dump = string.dump local find = string.find local gsub = string.gsub local byte = string.byte local null local sub = string.sub local ngx = ngx local jit = jit local var local _VERSION = _VERSION local _ENV = _ENV -- luacheck: globals _ENV local _G = _G local HTML_ENTITIES = { ["&"] = "&", ["<"] = "<", [">"] = ">", ['"'] = """, ["'"] = "'", ["/"] = "/" } local CODE_ENTITIES = { ["{"] = "{", ["}"] = "}", ["&"] = "&", ["<"] = "<", [">"] = ">", ['"'] = """, ["'"] = "'", ["/"] = "/" } local VAR_PHASES local ESC = byte("\27") local NUL = byte("\0") local HT = byte("\t") local VT = byte("\v") local LF = byte("\n") local SOL = byte("/") local BSOL = byte("\\") local SP = byte(" ") local AST = byte("*") local NUM = byte("#") local LPAR = byte("(") local LSQB = byte("[") local LCUB = byte("{") local MINUS = byte("-") local PERCNT = byte("%") local EMPTY = "" local VIEW_ENV if _VERSION == "Lua 5.1" then VIEW_ENV = { __index = function(t, k) return t.context[k] or t.template[k] or _G[k] end } else VIEW_ENV = { __index = function(t, k) return t.context[k] or t.template[k] or _ENV[k] end } end local newtab do local ok ok, newtab = pcall(require, "table.new") if not ok then newtab = function() return {} end end end local function enabled(val) if val == nil then return true end return val == true or (val == "1" or val == "true" or val == "on") end local function trim(s) return gsub(gsub(s, "^%s+", EMPTY), "%s+$", EMPTY) end local function rpos(view, s) while s > 0 do local c = byte(view, s, s) if c == SP or c == HT or c == VT or c == NUL then s = s - 1 else break end end return s end local function escaped(view, s) if s > 1 and byte(view, s - 1, s - 1) == BSOL then if s > 2 and byte(view, s - 2, s - 2) == BSOL then return false, 1 else return true, 1 end end return false, 0 end local function read_file(path) local file, err = open(path, "rb") if not file then return nil, err end local content content, err = file:read "*a" file:close() return content, err end local print_view local load_view if ngx then print_view = ngx.print or write var = ngx.var null = ngx.null phase = ngx.get_phase VAR_PHASES = { set = true, rewrite = true, access = true, content = true, header_filter = true, body_filter = true, log = true, preread = true } local capture = ngx.location.capture local prefix = ngx.config.prefix() load_view = function(template) return function(view, plain) if plain == true then return view end local vars = VAR_PHASES[phase()] local path = view local root = template.location if (not root or root == EMPTY) and vars then root = var.template_location end if root and root ~= EMPTY then if byte(root, -1) == SOL then root = sub(root, 1, -2) end if byte(path, 1) == SOL then path = sub(path, 2) end path = root .. "/" .. path local res = capture(path) if res.status == 200 then return res.body end end path = view root = template.root if (not root or root == EMPTY) and vars then root = var.template_root if not root or root == EMPTY then root = var.document_root or prefix end end if root and root ~= EMPTY then if byte(root, -1) == SOL then root = sub(root, 1, -2) end if byte(path, 1) == SOL then path = sub(path, 2) end path = root .. "/" .. path end return plain == false and assert(read_file(path)) or read_file(path) or view end end else print_view = write load_view = function(template) return function(view, plain) if plain == true then return view end local path, root = view, template.root if root and root ~= EMPTY then if byte(root, -1) == SOL then root = sub(root, 1, -2) end if byte(view, 1) == SOL then path = sub(view, 2) end path = root .. "/" .. path end return plain == false and assert(read_file(path)) or read_file(path) or view end end end local function load_file(func) return function(view) return func(view, false) end end local function load_string(func) return function(view) return func(view, true) end end local loader if jit or _VERSION ~= "Lua 5.1" then loader = function(template) return function(view) return assert(load(view, nil, nil, setmetatable({ template = template }, VIEW_ENV))) end end else loader = function(template) return function(view) local func = assert(loadstring(view)) setfenv(func, setmetatable({ template = template }, VIEW_ENV)) return func end end end local function visit(visitors, content, tag, name) if not visitors then return content end for i = 1, visitors.n do content = visitors[i](content, tag, name) end return content end local function new(template, safe) template = template or newtab(0, 26) template._VERSION = "2.0" template.cache = {} template.load = load_view(template) template.load_file = load_file(template.load) template.load_string = load_string(template.load) template.print = print_view local load_chunk = loader(template) local caching if VAR_PHASES and VAR_PHASES[phase()] then caching = enabled(var.template_cache) else caching = true end local visitors function template.visit(func) if not visitors then visitors = { func, n = 1 } return end visitors.n = visitors.n + 1 visitors[visitors.n] = func end function template.caching(enable) if enable ~= nil then caching = enable == true end return caching end function template.output(s) if s == nil or s == null then return EMPTY end if type(s) == "function" then return template.output(s()) end return tostring(s) end function template.escape(s, c) if type(s) == "string" then if c then return gsub(s, "[}{\">/<'&]", CODE_ENTITIES) end return gsub(s, "[\">/<'&]", HTML_ENTITIES) end return template.output(s) end function template.new(view, layout) local vt = type(view) if vt == "boolean" then return new(nil, view) end if vt == "table" then return new(view, safe) end if vt == "nil" then return new(nil, safe) end local render local process if layout then if type(layout) == "table" then render = function(self, context) context = context or self context.blocks = context.blocks or {} context.view = template.process(view, context) layout.blocks = context.blocks or {} layout.view = context.view or EMPTY layout:render() end process = function(self, context) context = context or self context.blocks = context.blocks or {} context.view = template.process(view, context) layout.blocks = context.blocks or {} layout.view = context.view return tostring(layout) end else render = function(self, context) context = context or self context.blocks = context.blocks or {} context.view = template.process(view, context) template.render(layout, context) end process = function(self, context) context = context or self context.blocks = context.blocks or {} context.view = template.process(view, context) return template.process(layout, context) end end else render = function(self, context) return template.render(view, context or self) end process = function(self, context) return template.process(view, context or self) end end if safe then return setmetatable({ render = function(...) local ok, err = pcall(render, ...) if not ok then return nil, err end end, process = function(...) local ok, output = pcall(process, ...) if not ok then return nil, output end return output end, }, { __tostring = function(...) local ok, output = pcall(process, ...) if not ok then return "" end return output end }) end return setmetatable({ render = render, process = process }, { __tostring = process }) end function template.precompile(view, path, strip, plain) local chunk = dump(template.compile(view, nil, plain), strip ~= false) if path then local file = open(path, "wb") file:write(chunk) file:close() end return chunk end function template.precompile_string(view, path, strip) return template.precompile(view, path, strip, true) end function template.precompile_file(view, path, strip) return template.precompile(view, path, strip, false) end function template.compile(view, cache_key, plain) assert(view, "view was not provided for template.compile(view, cache_key, plain)") if cache_key == "no-cache" then return load_chunk(template.parse(view, plain)), false end cache_key = cache_key or view local cache = template.cache if cache[cache_key] then return cache[cache_key], true end local func = load_chunk(template.parse(view, plain)) if caching then cache[cache_key] = func end return func, false end function template.compile_file(view, cache_key) return template.compile(view, cache_key, false) end function template.compile_string(view, cache_key) return template.compile(view, cache_key, true) end function template.parse(view, plain) assert(view, "view was not provided for template.parse(view, plain)") if plain ~= true then view = template.load(view, plain) if byte(view, 1, 1) == ESC then return view end end local j = 2 local c = {[[ context=... or {} local ___,blocks,layout={},blocks or {} local function include(v, c) return template.process(v, c or context) end local function echo(...) for i=1,select("#", ...) do ___[#___+1] = tostring(select(i, ...)) end end ]] } local i, s = 1, find(view, "{", 1, true) while s do local t, p = byte(view, s + 1, s + 1), s + 2 if t == LCUB then local e = find(view, "}}", p, true) if e then local z, w = escaped(view, s) if i < s - w then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, s - 1 - w)) c[j+2] = "]=]\n" j=j+3 end if z then i = s else c[j] = "___[#___+1]=template.escape(" c[j+1] = visit(visitors, trim(sub(view, p, e - 1)), "{") c[j+2] = ")\n" j=j+3 s, i = e + 1, e + 2 end end elseif t == AST then local e = find(view, "*}", p, true) if e then local z, w = escaped(view, s) if i < s - w then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, s - 1 - w)) c[j+2] = "]=]\n" j=j+3 end if z then i = s else c[j] = "___[#___+1]=template.output(" c[j+1] = visit(visitors, trim(sub(view, p, e - 1)), "*") c[j+2] = ")\n" j=j+3 s, i = e + 1, e + 2 end end elseif t == PERCNT then local e = find(view, "%}", p, true) if e then local z, w = escaped(view, s) if z then if i < s - w then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, s - 1 - w)) c[j+2] = "]=]\n" j=j+3 end i = s else local n = e + 2 if byte(view, n, n) == LF then n = n + 1 end local r = rpos(view, s - 1) if i <= r then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, r)) c[j+2] = "]=]\n" j=j+3 end c[j] = visit(visitors, trim(sub(view, p, e - 1)), "%") c[j+1] = "\n" j=j+2 s, i = n - 1, n end end elseif t == LPAR then local e = find(view, ")}", p, true) if e then local z, w = escaped(view, s) if i < s - w then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, s - 1 - w)) c[j+2] = "]=]\n" j=j+3 end if z then i = s else local f = visit(visitors, sub(view, p, e - 1), "(") local x = find(f, ",", 2, true) if x then c[j] = "___[#___+1]=include([=[" c[j+1] = trim(sub(f, 1, x - 1)) c[j+2] = "]=]," c[j+3] = trim(sub(f, x + 1)) c[j+4] = ")\n" j=j+5 else c[j] = "___[#___+1]=include([=[" c[j+1] = trim(f) c[j+2] = "]=])\n" j=j+3 end s, i = e + 1, e + 2 end end elseif t == LSQB then local e = find(view, "]}", p, true) if e then local z, w = escaped(view, s) if i < s - w then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, s - 1 - w)) c[j+2] = "]=]\n" j=j+3 end if z then i = s else c[j] = "___[#___+1]=include(" c[j+1] = visit(visitors, trim(sub(view, p, e - 1)), "[") c[j+2] = ")\n" j=j+3 s, i = e + 1, e + 2 end end elseif t == MINUS then local e = find(view, "-}", p, true) if e then local x, y = find(view, sub(view, s, e + 1), e + 2, true) if x then local z, w = escaped(view, s) if z then if i < s - w then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, s - 1 - w)) c[j+2] = "]=]\n" j=j+3 end i = s else y = y + 1 x = x - 1 if byte(view, y, y) == LF then y = y + 1 end local b = trim(sub(view, p, e - 1)) if b == "verbatim" or b == "raw" then if i < s - w then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, s - 1 - w)) c[j+2] = "]=]\n" j=j+3 end c[j] = "___[#___+1]=[=[" c[j+1] = visit(visitors, sub(view, e + 2, x)) c[j+2] = "]=]\n" j=j+3 else if byte(view, x, x) == LF then x = x - 1 end local r = rpos(view, s - 1) if i <= r then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, r)) c[j+2] = "]=]\n" j=j+3 end c[j] = 'blocks["' c[j+1] = b c[j+2] = '"]=include[=[' c[j+3] = visit(visitors, sub(view, e + 2, x), "-", b) c[j+4] = "]=]\n" j=j+5 end s, i = y - 1, y end end end elseif t == NUM then local e = find(view, "#}", p, true) if e then local z, w = escaped(view, s) if i < s - w then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, sub(view, i, s - 1 - w)) c[j+2] = "]=]\n" j=j+3 end if z then i = s else e = e + 2 if byte(view, e, e) == LF then e = e + 1 end s, i = e - 1, e end end end s = find(view, "{", s + 1, true) end s = sub(view, i) if s and s ~= EMPTY then c[j] = "___[#___+1]=[=[\n" c[j+1] = visit(visitors, s) c[j+2] = "]=]\n" j=j+3 end c[j] = "return layout and include(layout,setmetatable({view=table.concat(___),blocks=blocks},{__index=context})) or table.concat(___)" -- luacheck: ignore return concat(c) end function template.parse_file(view) return template.parse(view, false) end function template.parse_string(view) return template.parse(view, true) end function template.process(view, context, cache_key, plain) assert(view, "view was not provided for template.process(view, context, cache_key, plain)") return template.compile(view, cache_key, plain)(context) end function template.process_file(view, context, cache_key) assert(view, "view was not provided for template.process_file(view, context, cache_key)") return template.compile(view, cache_key, false)(context) end function template.process_string(view, context, cache_key) assert(view, "view was not provided for template.process_string(view, context, cache_key)") return template.compile(view, cache_key, true)(context) end function template.render(view, context, cache_key, plain) assert(view, "view was not provided for template.render(view, context, cache_key, plain)") template.print(template.process(view, context, cache_key, plain)) end function template.render_file(view, context, cache_key) assert(view, "view was not provided for template.render_file(view, context, cache_key)") template.render(view, context, cache_key, false) end function template.render_string(view, context, cache_key) assert(view, "view was not provided for template.render_string(view, context, cache_key)") template.render(view, context, cache_key, true) end if safe then return setmetatable({}, { __index = function(_, k) if type(template[k]) == "function" then return function(...) local ok, a, b = pcall(template[k], ...) if not ok then return nil, a end return a, b end end return template[k] end, __new_index = function(_, k, v) template[k] = v end, }) end return template end return new() PK@N]n]q/q/resty/openssl.luanu[local ffi = require("ffi") local C = ffi.C local ffi_cast = ffi.cast local ffi_str = ffi.string local format_error = require("resty.openssl.err").format_error local OPENSSL_3X local function try_require_modules() package.loaded["resty.openssl.version"] = nil local pok, lib = pcall(require, "resty.openssl.version") if pok then OPENSSL_3X = lib.OPENSSL_3X require "resty.openssl.include.crypto" require "resty.openssl.include.objects" else package.loaded["resty.openssl.version"] = nil end end try_require_modules() local _M = { _VERSION = '1.7.1', } function _M.load_modules() _M.bn = require("resty.openssl.bn") _M.cipher = require("resty.openssl.cipher") _M.digest = require("resty.openssl.digest") _M.hmac = require("resty.openssl.hmac") _M.kdf = require("resty.openssl.kdf") _M.pkey = require("resty.openssl.pkey") _M.objects = require("resty.openssl.objects") _M.rand = require("resty.openssl.rand") _M.version = require("resty.openssl.version") _M.x509 = require("resty.openssl.x509") _M.altname = require("resty.openssl.x509.altname") _M.chain = require("resty.openssl.x509.chain") _M.csr = require("resty.openssl.x509.csr") _M.crl = require("resty.openssl.x509.crl") _M.extension = require("resty.openssl.x509.extension") _M.extensions = require("resty.openssl.x509.extensions") _M.name = require("resty.openssl.x509.name") _M.revoked = require("resty.openssl.x509.revoked") _M.store = require("resty.openssl.x509.store") _M.pkcs12 = require("resty.openssl.pkcs12") _M.ssl = require("resty.openssl.ssl") _M.ssl_ctx = require("resty.openssl.ssl_ctx") if OPENSSL_3X then _M.provider = require("resty.openssl.provider") _M.mac = require("resty.openssl.mac") _M.ctx = require("resty.openssl.ctx") end _M.bignum = _M.bn end function _M.luaossl_compat() _M.load_modules() _M.csr.setSubject = _M.csr.set_subject_name _M.csr.setPublicKey = _M.csr.set_pubkey _M.x509.setPublicKey = _M.x509.set_pubkey _M.x509.getPublicKey = _M.x509.get_pubkey _M.x509.setSerial = _M.x509.set_serial_number _M.x509.getSerial = _M.x509.get_serial_number _M.x509.setSubject = _M.x509.set_subject_name _M.x509.getSubject = _M.x509.get_subject_name _M.x509.setIssuer = _M.x509.set_issuer_name _M.x509.getIssuer = _M.x509.get_issuer_name _M.x509.getOCSP = _M.x509.get_ocsp_url local pkey_new = _M.pkey.new _M.pkey.new = function(a, b) if type(a) == "string" then return pkey_new(a, b and unpack(b)) else return pkey_new(a, b) end end _M.cipher.encrypt = function(self, key, iv, padding) return self, _M.cipher.init(self, key, iv, true, not padding) end _M.cipher.decrypt = function(self, key, iv, padding) return self, _M.cipher.init(self, key, iv, false, not padding) end local digest_update = _M.digest.update _M.digest.update = function(self, ...) local ok, err = digest_update(self, ...) if ok then return self else return nil, err end end local store_verify = _M.store.verify _M.store.verify = function(...) local ok, err = store_verify(...) if err then return false, err else return true, ok end end local kdf_derive = _M.kdf.derive local kdf_keys_mappings = { iter = "pbkdf2_iter", key = "hkdf_key", info = "hkdf_info", secret = "tls1_prf_secret", seed = "tls1_prf_seed", maxmem_bytes = "scrypt_maxmem", N = "scrypt_N", r = "scrypt_r", p = "scrypt_p", } _M.kdf.derive = function(o) for k1, k2 in pairs(kdf_keys_mappings) do o[k1] = o[k2] o[k2] = nil end local hkdf_mode = o.hkdf_mode if hkdf_mode == "extract_and_expand" then o.hkdf_mode = _M.kdf.HKDEF_MODE_EXTRACT_AND_EXPAND elseif hkdf_mode == "extract_only" then o.hkdf_mode = _M.kdf.HKDEF_MODE_EXTRACT_ONLY elseif hkdf_mode == "expand_only" then o.hkdf_mode = _M.kdf.HKDEF_MODE_EXPAND_ONLY end return kdf_derive(o) end _M.pkcs12.new = function(tbl) local certs = {} local passphrase = tbl.passphrase if not tbl.key then return nil, "key must be set" end for _, cert in ipairs(tbl.certs) do if not _M.x509.istype(cert) then return nil, "certs must contains only x509 instance" end if cert:check_private_key(tbl.key) then tbl.cert = cert else certs[#certs+1] = cert end end tbl.cacerts = certs return _M.pkcs12.encode(tbl, passphrase) end _M.crl.add = _M.crl.add_revoked _M.crl.lookupSerial = _M.crl.get_by_serial for mod, tbl in pairs(_M) do if type(tbl) == 'table' then -- avoid using a same table as the iterrator will change local new_tbl = {} -- luaossl always error() out for k, f in pairs(tbl) do if type(f) == 'function' then local of = f new_tbl[k] = function(...) local ret = { of(...) } if ret and #ret > 1 and ret[#ret] then error(mod .. "." .. k .. "(): " .. ret[#ret]) end return unpack(ret) end end end for k, f in pairs(new_tbl) do tbl[k] = f end setmetatable(tbl, { __index = function(t, k) local tok -- handle special case if k == 'toPEM' then tok = 'to_PEM' else tok = k:gsub("(%l)(%u)", function(a, b) return a .. "_" .. b:lower() end) if tok == k then return end end if type(tbl[tok]) == 'function' then return tbl[tok] end end }) end end -- skip error() conversion _M.pkcs12.parse = function(p12, passphrase) local r, err = _M.pkcs12.decode(p12, passphrase) if err then error(err) end return r.key, r.cert, r.cacerts end end if OPENSSL_3X then require "resty.openssl.include.evp" local provider = require "resty.openssl.provider" local ctx_lib = require "resty.openssl.ctx" local fips_provider_ctx function _M.set_fips_mode(enable, self_test) if (not not enable) == _M.get_fips_mode() then return true end if enable then local p, err = provider.load("fips") if not p then return false, err end fips_provider_ctx = p if self_test then local ok, err = p:self_test() if not ok then return false, err end end elseif fips_provider_ctx then -- disable local p = fips_provider_ctx fips_provider_ctx = nil return p:unload() end -- set algorithm in fips mode in default ctx -- this deny/allow non-FIPS compliant algorithms to be used from EVP interface -- and redirect/remove redirect implementation to fips provider if C.EVP_default_properties_enable_fips(ctx_lib.get_libctx(), enable and 1 or 0) == 0 then return false, format_error("openssl.set_fips_mode: EVP_default_properties_enable_fips") end return true end function _M.get_fips_mode() local pok = provider.is_available("fips") if not pok then return false end return C.EVP_default_properties_is_fips_enabled(ctx_lib.get_libctx()) == 1 end function _M.get_fips_version_text() if not fips_provider_ctx then return false, "FIPS mode is not enabled" end return fips_provider_ctx:get_params("version") end else function _M.set_fips_mode(enable) if (not not enable) == _M.get_fips_mode() then return true end if C.FIPS_mode_set(enable and 1 or 0) == 0 then return false, format_error("openssl.set_fips_mode") end return true end function _M.get_fips_mode() return C.FIPS_mode() == 1 end function _M.get_fips_version_text() return nil, "openssl.get_fips_version_text not supported on OpenSSL 1.1.1" end end function _M.set_default_properties(props) if not OPENSSL_3X then return nil, "openssl.set_default_properties is only not supported from OpenSSL 3.0" end local ctx_lib = require "resty.openssl.ctx" if C.EVP_set_default_properties(ctx_lib.get_libctx(), props) == 0 then return false, format_error("openssl.EVP_set_default_properties") end return true end local function list_legacy(typ, get_nid_cf) local typ_lower = string.lower(typ:sub(5)) -- cut off EVP_ require ("resty.openssl.include.evp." .. typ_lower) local ret = {} local fn = ffi_cast("fake_openssl_" .. typ_lower .. "_list_fn*", function(elem, from, to, arg) if elem ~= nil then local nid = get_nid_cf(elem) table.insert(ret, ffi_str(C.OBJ_nid2sn(nid))) end -- from/to (renamings) are ignored end) C[typ .. "_do_all_sorted"](fn, nil) fn:free() return ret end local function list_provided(typ, hide_provider) local typ_lower = string.lower(typ:sub(5)) -- cut off EVP_ local typ_ptr = typ .. "*" require ("resty.openssl.include.evp." .. typ_lower) local ctx_lib = require "resty.openssl.ctx" local ret = {} local fn = ffi_cast("fake_openssl_" .. typ_lower .. "_provided_list_fn*", function(elem, _) elem = ffi_cast(typ_ptr, elem) local name = ffi_str(C[typ .. "_get0_name"](elem)) if hide_provider then table.insert(ret, name) else -- alternate names are ignored, retrieve use TYPE_names_do_all local prov = ffi_str(C.OSSL_PROVIDER_get0_name(C[typ .. "_get0_provider"](elem))) table.insert(ret, name .. " @ " .. prov) end end) C[typ .. "_do_all_provided"](ctx_lib.get_libctx(), fn, nil) fn:free() table.sort(ret) return ret end function _M.list_cipher_algorithms(hide_provider) require "resty.openssl.include.evp.cipher" if OPENSSL_3X then return list_provided("EVP_CIPHER", hide_provider) else return list_legacy("EVP_CIPHER", C.EVP_CIPHER_nid) end end function _M.list_digest_algorithms(hide_provider) require "resty.openssl.include.evp.md" if OPENSSL_3X then return list_provided("EVP_MD", hide_provider) else return list_legacy("EVP_MD", C.EVP_MD_type) end end function _M.list_mac_algorithms(hide_provider) if not OPENSSL_3X then return nil, "openssl.list_mac_algorithms is only supported from OpenSSL 3.0" end return list_provided("EVP_MAC", hide_provider) end function _M.list_kdf_algorithms(hide_provider) if not OPENSSL_3X then return nil, "openssl.list_kdf_algorithms is only supported from OpenSSL 3.0" end return list_provided("EVP_KDF", hide_provider) end local valid_ssl_protocols = { ["SSLv3"] = 0x0300, ["TLSv1"] = 0x0301, ["TLSv1.1"] = 0x0302, ["TLSv1.2"] = 0x0303, ["TLSv1.3"] = 0x0304, } function _M.list_ssl_ciphers(cipher_list, ciphersuites, protocol) local ssl_lib = require("resty.openssl.ssl") local ssl_macro = require("resty.openssl.include.ssl") if protocol then if not valid_ssl_protocols[protocol] then return nil, "unknown protocol \"" .. protocol .. "\"" end protocol = valid_ssl_protocols[protocol] end local ssl_ctx = C.SSL_CTX_new(C.TLS_server_method()) if ssl_ctx == nil then return nil, format_error("SSL_CTX_new") end ffi.gc(ssl_ctx, C.SSL_CTX_free) local ssl = C.SSL_new(ssl_ctx) if ssl == nil then return nil, format_error("SSL_new") end ffi.gc(ssl, C.SSL_free) if protocol then if ssl_macro.SSL_set_min_proto_version(ssl, protocol) == 0 or ssl_macro.SSL_set_max_proto_version(ssl, protocol) == 0 then return nil, format_error("SSL_set_min/max_proto_version") end end ssl = { ctx = ssl } local ok, err if cipher_list then ok, err = ssl_lib.set_cipher_list(ssl, cipher_list) if not ok then return nil, err end end if ciphersuites then ok, err = ssl_lib.set_ciphersuites(ssl, ciphersuites) if not ok then return nil, err end end return ssl_lib.get_ciphers(ssl) end return _M PK@N]p\resty/limit/conn.luanu[-- Copyright (C) Yichun Zhang (agentzh) -- -- This library is an enhanced Lua port of the standard ngx_limit_conn -- module. local math = require "math" local setmetatable = setmetatable local floor = math.floor local ngx_shared = ngx.shared local assert = assert local _M = { _VERSION = '0.08' } local mt = { __index = _M } function _M.new(dict_name, max, burst, default_conn_delay) local dict = ngx_shared[dict_name] if not dict then return nil, "shared dict not found" end assert(max > 0 and burst >= 0 and default_conn_delay > 0) local self = { dict = dict, max = max + 0, -- just to ensure the param is good burst = burst, unit_delay = default_conn_delay, } return setmetatable(self, mt) end function _M.incoming(self, key, commit) local dict = self.dict local max = self.max self.committed = false local conn, err if commit then conn, err = dict:incr(key, 1, 0) if not conn then return nil, err end if conn > max + self.burst then conn, err = dict:incr(key, -1) if not conn then return nil, err end return nil, "rejected" end self.committed = true else conn = (dict:get(key) or 0) + 1 if conn > max + self.burst then return nil, "rejected" end end if conn > max then -- make the excessive connections wait return self.unit_delay * floor((conn - 1) / max), conn end -- we return a 0 delay by default return 0, conn end function _M.is_committed(self) return self.committed end function _M.leaving(self, key, req_latency) assert(key) local dict = self.dict local conn, err = dict:incr(key, -1) if not conn then return nil, err end if req_latency then local unit_delay = self.unit_delay self.unit_delay = (req_latency + unit_delay) / 2 end return conn end function _M.uncommit(self, key) assert(key) local dict = self.dict return dict:incr(key, -1) end function _M.set_conn(self, conn) self.max = conn end function _M.set_burst(self, burst) self.burst = burst end return _M PK@N]V[0 resty/limit/count.luanu[-- implement GitHub request rate limiting: -- https://developer.github.com/v3/#rate-limiting local ngx_shared = ngx.shared local setmetatable = setmetatable local assert = assert local _M = { _VERSION = '0.08' } local mt = { __index = _M } local incr_support_init_ttl local ngx_config = ngx.config local ngx_lua_v = ngx.config.ngx_lua_version if not ngx_config or not ngx_lua_v or (ngx_lua_v < 10012) then incr_support_init_ttl = false else incr_support_init_ttl = true end -- the "limit" argument controls number of request allowed in a time window. -- time "window" argument controls the time window in seconds. function _M.new(dict_name, limit, window) local dict = ngx_shared[dict_name] if not dict then return nil, "shared dict not found" end assert(limit > 0 and window > 0) local self = { dict = dict, limit = limit, window = window, } return setmetatable(self, mt) end -- incoming function using incr with init_ttl -- need OpenResty version > v0.10.12rc2 local function incoming_new(self, key, commit) local dict = self.dict local limit = self.limit local window = self.window local remaining, err if commit then remaining, err = dict:incr(key, -1, limit, window) if not remaining then return nil, err end else remaining = (dict:get(key) or limit) - 1 end if remaining < 0 then return nil, "rejected" end return 0, remaining end -- incoming function using incr and expire local function incoming_old(self, key, commit) local dict = self.dict local limit = self.limit local window = self.window local remaining, ok, err if commit then remaining, err = dict:incr(key, -1, limit) if not remaining then return nil, err end if remaining == limit - 1 then ok, err = dict:expire(key, window) if not ok then if err == "not found" then remaining, err = dict:incr(key, -1, limit) if not remaining then return nil, err end ok, err = dict:expire(key, window) if not ok then return nil, err end else return nil, err end end end else remaining = (dict:get(key) or limit) - 1 end if remaining < 0 then return nil, "rejected" end return 0, remaining end _M.incoming = incr_support_init_ttl and incoming_new or incoming_old -- uncommit remaining and return remaining value function _M.uncommit(self, key) assert(key) local dict = self.dict local limit = self.limit local remaining, err = dict:incr(key, 1) if not remaining then if err == "not found" then remaining = limit else return nil, err end end return remaining end return _M PK@N]A?llresty/limit/req.luanu[-- Copyright (C) Yichun Zhang (agentzh) -- -- This library is an approximate Lua port of the standard ngx_limit_req -- module. local ffi = require "ffi" local math = require "math" local ngx_shared = ngx.shared local ngx_now = ngx.now local setmetatable = setmetatable local ffi_cast = ffi.cast local ffi_str = ffi.string local abs = math.abs local tonumber = tonumber local type = type local assert = assert local max = math.max -- TODO: we could avoid the tricky FFI cdata when lua_shared_dict supports -- hash-typed values as in redis. ffi.cdef[[ struct lua_resty_limit_req_rec { unsigned long excess; uint64_t last; /* time in milliseconds */ /* integer value, 1 corresponds to 0.001 r/s */ }; ]] local const_rec_ptr_type = ffi.typeof("const struct lua_resty_limit_req_rec*") local rec_size = ffi.sizeof("struct lua_resty_limit_req_rec") -- we can share the cdata here since we only need it temporarily for -- serialization inside the shared dict: local rec_cdata = ffi.new("struct lua_resty_limit_req_rec") local _M = { _VERSION = '0.08' } local mt = { __index = _M } function _M.new(dict_name, rate, burst) local dict = ngx_shared[dict_name] if not dict then return nil, "shared dict not found" end assert(rate > 0 and burst >= 0) local self = { dict = dict, rate = rate * 1000, burst = burst * 1000, } return setmetatable(self, mt) end -- sees an new incoming event -- the "commit" argument controls whether should we record the event in shm. -- FIXME we have a (small) race-condition window between dict:get() and -- dict:set() across multiple nginx worker processes. The size of the -- window is proportional to the number of workers. function _M.incoming(self, key, commit) local dict = self.dict local rate = self.rate local now = ngx_now() * 1000 local excess -- it's important to anchor the string value for the read-only pointer -- cdata: local v = dict:get(key) if v then if type(v) ~= "string" or #v ~= rec_size then return nil, "shdict abused by other users" end local rec = ffi_cast(const_rec_ptr_type, v) local elapsed = now - tonumber(rec.last) -- print("elapsed: ", elapsed, "ms") -- we do not handle changing rate values specifically. the excess value -- can get automatically adjusted by the following formula with new rate -- values rather quickly anyway. excess = max(tonumber(rec.excess) - rate * abs(elapsed) / 1000 + 1000, 0) -- print("excess: ", excess) if excess > self.burst then return nil, "rejected" end else excess = 0 end if commit then rec_cdata.excess = excess rec_cdata.last = now dict:set(key, ffi_str(rec_cdata, rec_size)) end -- return the delay in seconds, as well as excess return excess / rate, excess / 1000 end function _M.uncommit(self, key) assert(key) local dict = self.dict local v = dict:get(key) if not v then return nil, "not found" end if type(v) ~= "string" or #v ~= rec_size then return nil, "shdict abused by other users" end local rec = ffi_cast(const_rec_ptr_type, v) local excess = max(tonumber(rec.excess) - 1000, 0) rec_cdata.excess = excess rec_cdata.last = rec.last dict:set(key, ffi_str(rec_cdata, rec_size)) return true end function _M.set_rate(self, rate) self.rate = rate * 1000 end function _M.set_burst(self, burst) self.burst = burst * 1000 end return _M PK@N]l> ))resty/limit/traffic.luanu[-- Copyright (C) Yichun Zhang (agentzh) -- -- This is an aggregator for various concrete traffic limiter instances -- (like instances of the resty.limit.req, resty.limit.count and -- resty.limit.conn classes). local max = math.max local _M = { _VERSION = '0.08' } -- the states table is user supplied. each element stores the 2nd return value -- of each limiter if there is no error returned. for resty.limit.req, the state -- is the "excess" value (i.e., the number of excessive requests each second), -- and for resty.limit.conn, the state is the current concurrency level -- (including the current new connection). function _M.combine(limiters, keys, states) local n = #limiters local max_delay = 0 for i = 1, n do local lim = limiters[i] local delay, err = lim:incoming(keys[i], i == n) if not delay then return nil, err end if i == n then if states then states[i] = err end max_delay = delay end end for i = 1, n - 1 do local lim = limiters[i] local delay, err = lim:incoming(keys[i], true) if not delay then for j = 1, i - 1 do -- we intentionally ignore any errors returned below. limiters[j]:uncommit(keys[j]) end limiters[n]:uncommit(keys[n]) return nil, err end if states then states[i] = err end max_delay = max(max_delay, delay) end return max_delay end return _M PKAN]N\\resty/dns/resolver.luanu[-- Copyright (C) Yichun Zhang (agentzh) -- local socket = require "socket" local bit = require "bit" local udp = ngx.socket.udp local rand = math.random local char = string.char local byte = string.byte local find = string.find local gsub = string.gsub local sub = string.sub local rep = string.rep local format = string.format local band = bit.band local rshift = bit.rshift local lshift = bit.lshift local insert = table.insert local concat = table.concat local re_sub = ngx.re.sub local tcp = ngx.socket.tcp local log = ngx.log local DEBUG = ngx.DEBUG local unpack = unpack local setmetatable = setmetatable local type = type local ipairs = ipairs local ok, new_tab = pcall(require, "table.new") if not ok then new_tab = function (narr, nrec) return {} end end local DOT_CHAR = byte(".") local ZERO_CHAR = byte("0") local COLON_CHAR = byte(":") local IP6_ARPA = "ip6.arpa" local TYPE_A = 1 local TYPE_NS = 2 local TYPE_CNAME = 5 local TYPE_SOA = 6 local TYPE_PTR = 12 local TYPE_MX = 15 local TYPE_TXT = 16 local TYPE_AAAA = 28 local TYPE_SRV = 33 local TYPE_SPF = 99 local CLASS_IN = 1 local SECTION_AN = 1 local SECTION_NS = 2 local SECTION_AR = 3 local _M = { _VERSION = '0.22', TYPE_A = TYPE_A, TYPE_NS = TYPE_NS, TYPE_CNAME = TYPE_CNAME, TYPE_SOA = TYPE_SOA, TYPE_PTR = TYPE_PTR, TYPE_MX = TYPE_MX, TYPE_TXT = TYPE_TXT, TYPE_AAAA = TYPE_AAAA, TYPE_SRV = TYPE_SRV, TYPE_SPF = TYPE_SPF, CLASS_IN = CLASS_IN, SECTION_AN = SECTION_AN, SECTION_NS = SECTION_NS, SECTION_AR = SECTION_AR } local resolver_errstrs = { "format error", -- 1 "server failure", -- 2 "name error", -- 3 "not implemented", -- 4 "refused", -- 5 } local soa_int32_fields = { "serial", "refresh", "retry", "expire", "minimum" } local mt = { __index = _M } local arpa_tmpl = new_tab(72, 0) for i = 1, #IP6_ARPA do arpa_tmpl[64 + i] = byte(IP6_ARPA, i) end for i = 2, 64, 2 do arpa_tmpl[i] = DOT_CHAR end local function udp_socks_close(self) if self.socks == nil then return end for _, sock in ipairs(self.socks) do sock:close() end self.socks = nil end local function tcp_socks_close(self) if self.tcp_sock == nil then return end self.tcp_sock:close() self.tcp_sock = nil end function _M.new(class, opts) if not opts then return nil, "no options table specified" end local servers = opts.nameservers if not servers or #servers == 0 then return nil, "no nameservers specified" end local timeout = opts.timeout or 2000 -- default 2 sec local n = #servers local socks = {} for i = 1, n do local server = servers[i] local sock, err = udp() if not sock then return nil, "failed to create udp socket: " .. err end local host, port if type(server) == 'table' then host = server[1] port = server[2] or 53 else host = server port = 53 servers[i] = {host, port} end local ok, err = sock:setpeername(host, port) if not ok then return nil, "failed to set peer name: " .. err end sock:settimeout(timeout) insert(socks, sock) end local tcp_sock, err = tcp() if not tcp_sock then return nil, "failed to create tcp socket: " .. err end tcp_sock:settimeout(timeout) return setmetatable( { cur = opts.no_random and 1 or rand(1, n), socks = socks, tcp_sock = tcp_sock, servers = servers, retrans = opts.retrans or 5, no_recurse = opts.no_recurse, }, mt) end function _M:destroy() udp_socks_close(self) tcp_socks_close(self) self.cur = nil self.servers = nil self.retrans = nil self.no_recurse = nil end local function pick_sock(self, socks) local cur = self.cur if cur == #socks then self.cur = 1 else self.cur = cur + 1 end return socks[cur] end local function _get_cur_server(self) local cur = self.cur local servers = self.servers if cur == 1 then return servers[#servers] end return servers[cur - 1] end function _M.set_timeout(self, timeout) local socks = self.socks if not socks then return nil, "not initialized" end for i = 1, #socks do local sock = socks[i] sock:settimeout(timeout) end local tcp_sock = self.tcp_sock if not tcp_sock then return nil, "not initialized" end tcp_sock:settimeout(timeout) end local function _encode_name(s) return char(#s) .. s end local function _decode_name(buf, pos) local labels = {} local nptrs = 0 local p = pos while nptrs < 128 do local fst = byte(buf, p) if not fst then return nil, 'truncated'; end -- print("fst at ", p, ": ", fst) if fst == 0 then if nptrs == 0 then pos = pos + 1 end break end if band(fst, 0xc0) ~= 0 then -- being a pointer if nptrs == 0 then pos = pos + 2 end nptrs = nptrs + 1 local snd = byte(buf, p + 1) if not snd then return nil, 'truncated' end p = lshift(band(fst, 0x3f), 8) + snd + 1 -- print("resolving ptr ", p, ": ", byte(buf, p)) else -- being a label local label = sub(buf, p + 1, p + fst) insert(labels, label) -- print("resolved label ", label) p = p + fst + 1 if nptrs == 0 then pos = p end end end return concat(labels, "."), pos end local function _build_request(qname, id, no_recurse, opts) local qtype if opts then qtype = opts.qtype end if not qtype then qtype = 1 -- A record end local ident_hi = char(rshift(id, 8)) local ident_lo = char(band(id, 0xff)) local flags if no_recurse then -- print("found no recurse") flags = "\0\0" else flags = "\1\0" end local nqs = "\0\1" local nan = "\0\0" local nns = "\0\0" local nar = "\0\0" local typ = char(rshift(qtype, 8), band(qtype, 0xff)) local class = "\0\1" -- the Internet class if byte(qname, 1) == DOT_CHAR then return nil, "bad name" end local name = gsub(qname, "([^.]+)%.?", _encode_name) .. '\0' return { ident_hi, ident_lo, flags, nqs, nan, nns, nar, name, typ, class } end local function parse_section(answers, section, buf, start_pos, size, should_skip) local pos = start_pos for _ = 1, size do -- print(format("ans %d: qtype:%d qclass:%d", i, qtype, qclass)) local ans = {} if not should_skip then insert(answers, ans) end ans.section = section local name name, pos = _decode_name(buf, pos) if not name then return nil, pos end ans.name = name -- print("name: ", name) local type_hi = byte(buf, pos) local type_lo = byte(buf, pos + 1) local typ = lshift(type_hi, 8) + type_lo ans.type = typ -- print("type: ", typ) local class_hi = byte(buf, pos + 2) local class_lo = byte(buf, pos + 3) local class = lshift(class_hi, 8) + class_lo ans.class = class -- print("class: ", class) local byte_1, byte_2, byte_3, byte_4 = byte(buf, pos + 4, pos + 7) local ttl = lshift(byte_1, 24) + lshift(byte_2, 16) + lshift(byte_3, 8) + byte_4 -- print("ttl: ", ttl) ans.ttl = ttl local len_hi = byte(buf, pos + 8) local len_lo = byte(buf, pos + 9) local len = lshift(len_hi, 8) + len_lo -- print("record len: ", len) pos = pos + 10 if typ == TYPE_A then if len ~= 4 then return nil, "bad A record value length: " .. len end local addr_bytes = { byte(buf, pos, pos + 3) } local addr = concat(addr_bytes, ".") -- print("ipv4 address: ", addr) ans.address = addr pos = pos + 4 elseif typ == TYPE_CNAME then local cname, p = _decode_name(buf, pos) if not cname then return nil, pos end if p - pos ~= len then return nil, format("bad cname record length: %d ~= %d", p - pos, len) end pos = p -- print("cname: ", cname) ans.cname = cname elseif typ == TYPE_AAAA then if len ~= 16 then return nil, "bad AAAA record value length: " .. len end local addr_bytes = { byte(buf, pos, pos + 15) } local flds = {} for i = 1, 16, 2 do local a = addr_bytes[i] local b = addr_bytes[i + 1] if a == 0 then insert(flds, format("%x", b)) else insert(flds, format("%x%02x", a, b)) end end -- we do not compress the IPv6 addresses by default -- due to performance considerations ans.address = concat(flds, ":") pos = pos + 16 elseif typ == TYPE_MX then -- print("len = ", len) if len < 3 then return nil, "bad MX record value length: " .. len end local pref_hi = byte(buf, pos) local pref_lo = byte(buf, pos + 1) ans.preference = lshift(pref_hi, 8) + pref_lo local host, p = _decode_name(buf, pos + 2) if not host then return nil, pos end if p - pos ~= len then return nil, format("bad cname record length: %d ~= %d", p - pos, len) end ans.exchange = host pos = p elseif typ == TYPE_SRV then if len < 7 then return nil, "bad SRV record value length: " .. len end local prio_hi = byte(buf, pos) local prio_lo = byte(buf, pos + 1) ans.priority = lshift(prio_hi, 8) + prio_lo local weight_hi = byte(buf, pos + 2) local weight_lo = byte(buf, pos + 3) ans.weight = lshift(weight_hi, 8) + weight_lo local port_hi = byte(buf, pos + 4) local port_lo = byte(buf, pos + 5) ans.port = lshift(port_hi, 8) + port_lo local name, p = _decode_name(buf, pos + 6) if not name then return nil, pos end if p - pos ~= len then return nil, format("bad srv record length: %d ~= %d", p - pos, len) end ans.target = name pos = p elseif typ == TYPE_NS then local name, p = _decode_name(buf, pos) if not name then return nil, pos end if p - pos ~= len then return nil, format("bad cname record length: %d ~= %d", p - pos, len) end pos = p -- print("name: ", name) ans.nsdname = name elseif typ == TYPE_TXT or typ == TYPE_SPF then local key = (typ == TYPE_TXT) and "txt" or "spf" local slen = byte(buf, pos) if slen + 1 > len then -- truncate the over-run TXT record data slen = len end -- print("slen: ", len) local val = sub(buf, pos + 1, pos + slen) local last = pos + len pos = pos + slen + 1 if pos < last then -- more strings to be processed -- this code path is usually cold, so we do not -- merge the following loop on this code path -- with the processing logic above. val = {val} local idx = 2 repeat local slen = byte(buf, pos) if pos + slen + 1 > last then -- truncate the over-run TXT record data slen = last - pos - 1 end val[idx] = sub(buf, pos + 1, pos + slen) idx = idx + 1 pos = pos + slen + 1 until pos >= last end ans[key] = val elseif typ == TYPE_PTR then local name, p = _decode_name(buf, pos) if not name then return nil, pos end if p - pos ~= len then return nil, format("bad cname record length: %d ~= %d", p - pos, len) end pos = p -- print("name: ", name) ans.ptrdname = name elseif typ == TYPE_SOA then local name, p = _decode_name(buf, pos) if not name then return nil, pos end ans.mname = name pos = p name, p = _decode_name(buf, pos) if not name then return nil, pos end ans.rname = name for _, field in ipairs(soa_int32_fields) do local byte_1, byte_2, byte_3, byte_4 = byte(buf, p, p + 3) ans[field] = lshift(byte_1, 24) + lshift(byte_2, 16) + lshift(byte_3, 8) + byte_4 p = p + 4 end pos = p else -- for unknown types, just forward the raw value ans.rdata = sub(buf, pos, pos + len - 1) pos = pos + len end end return pos end local function parse_response(buf, id, opts) local n = #buf if n < 12 then return nil, 'truncated'; end -- header layout: ident flags nqs nan nns nar local ident_hi = byte(buf, 1) local ident_lo = byte(buf, 2) local ans_id = lshift(ident_hi, 8) + ident_lo -- print("id: ", id, ", ans id: ", ans_id) if ans_id ~= id then -- identifier mismatch and throw it away log(DEBUG, "id mismatch in the DNS reply: ", ans_id, " ~= ", id) return nil, "id mismatch" end local flags_hi = byte(buf, 3) local flags_lo = byte(buf, 4) local flags = lshift(flags_hi, 8) + flags_lo -- print(format("flags: 0x%x", flags)) if band(flags, 0x8000) == 0 then return nil, format("bad QR flag in the DNS response") end if band(flags, 0x200) ~= 0 then return nil, "truncated" end local code = band(flags, 0xf) -- print(format("code: %d", code)) local nqs_hi = byte(buf, 5) local nqs_lo = byte(buf, 6) local nqs = lshift(nqs_hi, 8) + nqs_lo -- print("nqs: ", nqs) if nqs ~= 1 then return nil, format("bad number of questions in DNS response: %d", nqs) end local nan_hi = byte(buf, 7) local nan_lo = byte(buf, 8) local nan = lshift(nan_hi, 8) + nan_lo -- print("nan: ", nan) local nns_hi = byte(buf, 9) local nns_lo = byte(buf, 10) local nns = lshift(nns_hi, 8) + nns_lo local nar_hi = byte(buf, 11) local nar_lo = byte(buf, 12) local nar = lshift(nar_hi, 8) + nar_lo -- skip the question part local ans_qname, pos = _decode_name(buf, 13) if not ans_qname then return nil, pos end -- print("qname in reply: ", ans_qname) -- print("question: ", sub(buf, 13, pos)) if pos + 3 + nan * 12 > n then -- print(format("%d > %d", pos + 3 + nan * 12, n)) return nil, 'truncated'; end -- question section layout: qname qtype(2) qclass(2) --[[ local type_hi = byte(buf, pos) local type_lo = byte(buf, pos + 1) local ans_type = lshift(type_hi, 8) + type_lo ]] -- print("ans qtype: ", ans_type) local class_hi = byte(buf, pos + 2) local class_lo = byte(buf, pos + 3) local qclass = lshift(class_hi, 8) + class_lo -- print("ans qclass: ", qclass) if qclass ~= 1 then return nil, format("unknown query class %d in DNS response", qclass) end pos = pos + 4 local answers = {} if code ~= 0 then answers.errcode = code answers.errstr = resolver_errstrs[code] or "unknown" end local authority_section, additional_section if opts then authority_section = opts.authority_section additional_section = opts.additional_section if opts.qtype == TYPE_SOA then authority_section = true end end local err pos, err = parse_section(answers, SECTION_AN, buf, pos, nan) if not pos then return nil, err end if not authority_section and not additional_section then return answers end pos, err = parse_section(answers, SECTION_NS, buf, pos, nns, not authority_section) if not pos then return nil, err end if not additional_section then return answers end pos, err = parse_section(answers, SECTION_AR, buf, pos, nar) if not pos then return nil, err end return answers end local function _gen_id(self) local id = self._id -- for regression testing if id then return id end return rand(0, 65535) -- two bytes end local function _tcp_query(self, query, id, opts) local sock = self.tcp_sock if not sock then return nil, "not initialized" end log(DEBUG, "query the TCP server due to reply truncation") local server = _get_cur_server(self) local ok, err = sock:connect(server[1], server[2]) if not ok then return nil, "failed to connect to TCP server " .. concat(server, ":") .. ": " .. err end query = concat(query, "") local len = #query local len_hi = char(rshift(len, 8)) local len_lo = char(band(len, 0xff)) local bytes, err = sock:send({len_hi, len_lo, query}) if not bytes then return nil, "failed to send query to TCP server " .. concat(server, ":") .. ": " .. err end local buf, err = sock:receive(2) if not buf then return nil, "failed to receive the reply length field from TCP server " .. concat(server, ":") .. ": " .. err end len_hi = byte(buf, 1) len_lo = byte(buf, 2) len = lshift(len_hi, 8) + len_lo -- print("tcp message len: ", len) buf, err = sock:receive(len) if not buf then return nil, "failed to receive the reply message body from TCP server " .. concat(server, ":") .. ": " .. err end local answers, err = parse_response(buf, id, opts) if not answers then return nil, "failed to parse the reply from the TCP server " .. concat(server, ":") .. ": " .. err end sock:close() return answers end function _M.tcp_query(self, qname, opts) local socks = self.socks if not socks then return nil, "not initialized" end pick_sock(self, socks) local id = _gen_id(self) local query, err = _build_request(qname, id, self.no_recurse, opts) if not query then return nil, err end return _tcp_query(self, query, id, opts) end function _M.query(self, qname, opts, tries) local socks = self.socks if not socks then return nil, "not initialized" end local id = _gen_id(self) local query, err = _build_request(qname, id, self.no_recurse, opts) if not query then return nil, err end -- local cjson = require "cjson" -- print("query: ", cjson.encode(concat(query, ""))) local retrans = self.retrans if tries then tries[1] = nil end -- print("retrans: ", retrans) for i = 1, retrans do local sock = pick_sock(self, socks) local ok ok, err = sock:send(query) if not ok then local server = _get_cur_server(self) err = "failed to send request to UDP server " .. concat(server, ":") .. ": " .. err else local buf for _ = 1, 128 do buf, err = sock:receive(4096) if err then local server = _get_cur_server(self) err = "failed to receive reply from UDP server " .. concat(server, ":") .. ": " .. err break end if buf then local answers answers, err = parse_response(buf, id, opts) if err == "truncated" then answers, err = _tcp_query(self, query, id, opts) end if err and err ~= "id mismatch" then break end if answers then return answers, nil, tries end end -- only here in case of an "id mismatch" end end if tries then tries[i] = err tries[i + 1] = nil -- ensure termination for user supplied table end end return nil, err, tries end function _M.compress_ipv6_addr(addr) local addr = re_sub(addr, "^(0:)+|(:0)+$|:(0:)+", "::", "jo") if addr == "::0" then addr = "::" end return addr end local function _expand_ipv6_addr(addr) if find(addr, "::", 1, true) then local ncol, addrlen = 8, #addr for i = 1, addrlen do if byte(addr, i) == COLON_CHAR then ncol = ncol - 1 end end if byte(addr, 1) == COLON_CHAR then addr = "0" .. addr end if byte(addr, -1) == COLON_CHAR then addr = addr .. "0" end addr = re_sub(addr, "::", ":" .. rep("0:", ncol), "jo") end return addr end _M.expand_ipv6_addr = _expand_ipv6_addr function _M.arpa_str(addr) if find(addr, ":", 1, true) then addr = _expand_ipv6_addr(addr) local idx, hidx, addrlen = 1, 1, #addr for i = addrlen, 0, -1 do local s = byte(addr, i) if s == COLON_CHAR or not s then for _ = hidx, 4 do arpa_tmpl[idx] = ZERO_CHAR idx = idx + 2 end hidx = 1 else arpa_tmpl[idx] = s idx = idx + 2 hidx = hidx + 1 end end addr = char(unpack(arpa_tmpl)) else addr = re_sub(addr, [[(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})]], "$4.$3.$2.$1.in-addr.arpa", "ajo") end return addr end function _M.reverse_query(self, addr) return self.query(self, self.arpa_str(addr), {qtype = self.TYPE_PTR}) end return _M PKAN]C6J(J( resty/aes.luanu[-- Copyright (C) by Yichun Zhang (agentzh) --local asn1 = require "resty.asn1" local ffi = require "ffi" local ffi_new = ffi.new local ffi_gc = ffi.gc local ffi_str = ffi.string local ffi_copy = ffi.copy local C = ffi.C local setmetatable = setmetatable --local error = error local type = type local _M = { _VERSION = '0.17' } local mt = { __index = _M } local EVP_CTRL_AEAD_SET_IVLEN = 0x09 local EVP_CTRL_AEAD_GET_TAG = 0x10 local EVP_CTRL_AEAD_SET_TAG = 0x11 ffi.cdef[[ typedef struct engine_st ENGINE; typedef struct evp_cipher_st EVP_CIPHER; typedef struct evp_cipher_ctx_st EVP_CIPHER_CTX; typedef struct env_md_ctx_st EVP_MD_CTX; typedef struct env_md_st EVP_MD; const EVP_MD *EVP_md5(void); const EVP_MD *EVP_sha(void); const EVP_MD *EVP_sha1(void); const EVP_MD *EVP_sha224(void); const EVP_MD *EVP_sha256(void); const EVP_MD *EVP_sha384(void); const EVP_MD *EVP_sha512(void); const EVP_CIPHER *EVP_aes_128_ecb(void); const EVP_CIPHER *EVP_aes_128_cbc(void); const EVP_CIPHER *EVP_aes_128_cfb1(void); const EVP_CIPHER *EVP_aes_128_cfb8(void); const EVP_CIPHER *EVP_aes_128_cfb128(void); const EVP_CIPHER *EVP_aes_128_ofb(void); const EVP_CIPHER *EVP_aes_128_ctr(void); const EVP_CIPHER *EVP_aes_192_ecb(void); const EVP_CIPHER *EVP_aes_192_cbc(void); const EVP_CIPHER *EVP_aes_192_cfb1(void); const EVP_CIPHER *EVP_aes_192_cfb8(void); const EVP_CIPHER *EVP_aes_192_cfb128(void); const EVP_CIPHER *EVP_aes_192_ofb(void); const EVP_CIPHER *EVP_aes_192_ctr(void); const EVP_CIPHER *EVP_aes_256_ecb(void); const EVP_CIPHER *EVP_aes_256_cbc(void); const EVP_CIPHER *EVP_aes_256_cfb1(void); const EVP_CIPHER *EVP_aes_256_cfb8(void); const EVP_CIPHER *EVP_aes_256_cfb128(void); const EVP_CIPHER *EVP_aes_256_ofb(void); const EVP_CIPHER *EVP_aes_256_ctr(void); const EVP_CIPHER *EVP_aes_128_gcm(void); const EVP_CIPHER *EVP_aes_192_gcm(void); const EVP_CIPHER *EVP_aes_256_gcm(void); EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(); void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *a); int EVP_CIPHER_CTX_block_size(const EVP_CIPHER_CTX *ctx); int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *ctx, int padding); int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx,const EVP_CIPHER *cipher, ENGINE *impl, unsigned char *key, const unsigned char *iv); int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, const unsigned char *in, int inl); int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl); int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx,const EVP_CIPHER *cipher, ENGINE *impl, unsigned char *key, const unsigned char *iv); int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, const unsigned char *in, int inl); int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); int EVP_BytesToKey(const EVP_CIPHER *type,const EVP_MD *md, const unsigned char *salt, const unsigned char *data, int datal, int count, unsigned char *key,unsigned char *iv); int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr); ]] local hash hash = { md5 = C.EVP_md5(), sha1 = C.EVP_sha1(), sha224 = C.EVP_sha224(), sha256 = C.EVP_sha256(), sha384 = C.EVP_sha384(), sha512 = C.EVP_sha512() } _M.hash = hash local EVP_MAX_BLOCK_LENGTH = 32 local shared_out_len_ptr = ffi_new("int[1]") local shared_tmp_len_ptr = ffi_new("int[1]") local shared_tag_buf_ptr = ffi_new("unsigned char[?]", 16) local cipher cipher = function (size, _cipher) local _size = size or 128 _cipher = _cipher or "cbc" local func = "EVP_aes_" .. _size .. "_" .. _cipher if C[func] then return { size=_size, cipher=_cipher, method=C[func]()} else return nil end end _M.cipher = cipher function _M.new(self, key, salt, _cipher, _hash, hash_rounds, iv_len, enable_padding) local encrypt_ctx = C.EVP_CIPHER_CTX_new() if encrypt_ctx == nil then return nil, "no memory" end ffi_gc(encrypt_ctx, C.EVP_CIPHER_CTX_free) local decrypt_ctx = C.EVP_CIPHER_CTX_new() if decrypt_ctx == nil then return nil, "no memory" end ffi_gc(decrypt_ctx, C.EVP_CIPHER_CTX_free) _cipher = _cipher or cipher() _hash = _hash or hash.md5 hash_rounds = hash_rounds or 1 local _cipherLength = _cipher.size/8 local gen_key = ffi_new("unsigned char[?]", _cipherLength) local gen_iv = ffi_new("unsigned char[?]", _cipherLength) iv_len = iv_len or _cipherLength -- enable padding by default local padding = (enable_padding == nil or enable_padding) and 1 or 0 if type(_hash) == "table" then if not _hash.iv then return nil, "iv is needed" end --[[ Depending on the encryption algorithm, the length of iv will be different. For detailed, please refer to https://www.openssl.org/docs/man1.1.0/man3/EVP_CIPHER_CTX_ctrl.html ]] iv_len = #_hash.iv if iv_len > _cipherLength then return nil, "bad iv length" end if _hash.method then local tmp_key = _hash.method(key) if #tmp_key ~= _cipherLength then return nil, "bad key length" end ffi_copy(gen_key, tmp_key, _cipherLength) elseif #key ~= _cipherLength then return nil, "bad key length" else ffi_copy(gen_key, key, _cipherLength) end ffi_copy(gen_iv, _hash.iv, iv_len) else if salt and #salt ~= 8 then return nil, "salt must be 8 characters or nil" end if C.EVP_BytesToKey(_cipher.method, _hash, salt, key, #key, hash_rounds, gen_key, gen_iv) ~= _cipherLength then return nil, "failed to generate key and iv" end end if C.EVP_EncryptInit_ex(encrypt_ctx, _cipher.method, nil, nil, nil) == 0 or C.EVP_DecryptInit_ex(decrypt_ctx, _cipher.method, nil, nil, nil) == 0 then return nil, "failed to init ctx" end local cipher_name = _cipher.cipher if cipher_name == "gcm" or cipher_name == "ccm" or cipher_name == "ocb" then if C.EVP_CIPHER_CTX_ctrl(encrypt_ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, nil) == 0 or C.EVP_CIPHER_CTX_ctrl(decrypt_ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, nil) == 0 then return nil, "failed to set IV length" end end if C.EVP_CIPHER_CTX_set_padding(encrypt_ctx, padding) == 0 then return nil, "failed to set padding for encrypt context" end if C.EVP_CIPHER_CTX_set_padding(decrypt_ctx, padding) == 0 then return nil, "failed to set padding for decrypt context" end return setmetatable({ _encrypt_ctx = encrypt_ctx, _decrypt_ctx = decrypt_ctx, _cipher = _cipher.cipher, _key = gen_key, _iv = gen_iv }, mt) end local function alloc_buf(max_len) local buf = ffi_new("unsigned char[?]", max_len) return buf, max_len end do local ok, str_buf_mod = pcall(require, "string.buffer") if ok then local str_buf = str_buf_mod.new(4096) function alloc_buf(max_len) local buf, sz = str_buf:reset():reserve(max_len) return buf, sz end end end function _M.encrypt(self, s, aad) local typ = type(self) if typ ~= "table" then error("bad argument #1 self: table expected, got " .. typ, 2) end local s_len = #s local buf = alloc_buf(s_len + 2 * EVP_MAX_BLOCK_LENGTH) local out_len = shared_out_len_ptr local tmp_len = shared_tmp_len_ptr local ctx = self._encrypt_ctx if C.EVP_EncryptInit_ex(ctx, nil, nil, self._key, self._iv) == 0 then return nil, "EVP_EncryptInit_ex failed" end if self._cipher == "gcm" and aad ~= nil then if C.EVP_EncryptUpdate(ctx, nil, tmp_len, aad, #aad) == 0 then return nil, "C.EVP_EncryptUpdate failed" end end if C.EVP_EncryptUpdate(ctx, buf, out_len, s, s_len) == 0 then return nil, "EVP_EncryptUpdate failed" end if self._cipher == "gcm" then local encrypt_data = ffi_str(buf, out_len[0]) if C.EVP_EncryptFinal_ex(ctx, buf, out_len) == 0 then return nil, "EVP_EncryptFinal_ex failed" end -- FIXME: For OCB mode the taglen must either be 16 -- or the value previously set via EVP_CTRL_OCB_SET_TAGLEN. -- so we should extend this api in the future C.EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16, buf); local tag = ffi_str(buf, 16) return {encrypt_data, tag} end if C.EVP_EncryptFinal_ex(ctx, buf + out_len[0], tmp_len) == 0 then return nil, "EVP_EncryptFinal_ex failed" end return ffi_str(buf, out_len[0] + tmp_len[0]) end function _M.decrypt(self, s, tag, aad) local typ = type(self) if typ ~= "table" then error("bad argument #1 self: table expected, got " .. typ, 2) end local s_len = #s local buf = alloc_buf(s_len + 2 * EVP_MAX_BLOCK_LENGTH) local out_len = shared_out_len_ptr local tmp_len = shared_tmp_len_ptr local ctx = self._decrypt_ctx if C.EVP_DecryptInit_ex(ctx, nil, nil, self._key, self._iv) == 0 then return nil, "EVP_DecryptInit_ex failed" end if self._cipher == "gcm" and aad ~= nil then if C.EVP_DecryptUpdate(ctx, nil, tmp_len, aad, #aad) == 0 then return nil, "C.EVP_DecryptUpdate failed" end end if C.EVP_DecryptUpdate(ctx, buf, out_len, s, s_len) == 0 then return nil, "EVP_DecryptUpdate failed" end if self._cipher == "gcm" then local plain_txt = ffi_str(buf, out_len[0]) if tag ~= nil then local tag_buf = shared_tag_buf_ptr ffi_copy(tag_buf, tag, 16) C.EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, tag_buf); end if C.EVP_DecryptFinal_ex(ctx, buf + out_len[0], tmp_len) == 0 then return nil, "EVP_DecryptFinal_ex failed" end return plain_txt end if C.EVP_DecryptFinal_ex(ctx, buf + out_len[0], tmp_len) == 0 then return nil, "EVP_DecryptFinal_ex failed" end return ffi_str(buf, out_len[0] + tmp_len[0]) end return _M PKAN]w&;";"resty/openssl/ssl.luanu[local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local ffi_cast = ffi.cast require "resty.openssl.include.ssl" local nginx_aux = require("resty.openssl.auxiliary.nginx") local x509_lib = require("resty.openssl.x509") local chain_lib = require("resty.openssl.x509.chain") local stack_lib = require("resty.openssl.stack") local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local format_error = require("resty.openssl.err").format_error local _M = { SSL_VERIFY_NONE = 0x00, SSL_VERIFY_PEER = 0x01, SSL_VERIFY_FAIL_IF_NO_PEER_CERT = 0x02, SSL_VERIFY_CLIENT_ONCE = 0x04, SSL_VERIFY_POST_HANDSHAKE = 0x08, } local ops = { SSL_OP_NO_EXTENDED_MASTER_SECRET = 0x00000001, SSL_OP_CLEANSE_PLAINTEXT = 0x00000002, SSL_OP_LEGACY_SERVER_CONNECT = 0x00000004, SSL_OP_TLSEXT_PADDING = 0x00000010, SSL_OP_SAFARI_ECDHE_ECDSA_BUG = 0x00000040, SSL_OP_IGNORE_UNEXPECTED_EOF = 0x00000080, SSL_OP_DISABLE_TLSEXT_CA_NAMES = 0x00000200, SSL_OP_ALLOW_NO_DHE_KEX = 0x00000400, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS = 0x00000800, SSL_OP_NO_QUERY_MTU = 0x00001000, SSL_OP_COOKIE_EXCHANGE = 0x00002000, SSL_OP_NO_TICKET = 0x00004000, SSL_OP_CISCO_ANYCONNECT = 0x00008000, SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION = 0x00010000, SSL_OP_NO_COMPRESSION = 0x00020000, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION = 0x00040000, SSL_OP_NO_ENCRYPT_THEN_MAC = 0x00080000, SSL_OP_ENABLE_MIDDLEBOX_COMPAT = 0x00100000, SSL_OP_PRIORITIZE_CHACHA = 0x00200000, SSL_OP_CIPHER_SERVER_PREFERENCE = 0x00400000, SSL_OP_TLS_ROLLBACK_BUG = 0x00800000, SSL_OP_NO_ANTI_REPLAY = 0x01000000, SSL_OP_NO_SSLv3 = 0x02000000, SSL_OP_NO_TLSv1 = 0x04000000, SSL_OP_NO_TLSv1_2 = 0x08000000, SSL_OP_NO_TLSv1_1 = 0x10000000, SSL_OP_NO_TLSv1_3 = 0x20000000, SSL_OP_NO_DTLSv1 = 0x04000000, SSL_OP_NO_DTLSv1_2 = 0x08000000, SSL_OP_NO_RENEGOTIATION = 0x40000000, SSL_OP_CRYPTOPRO_TLSEXT_BUG = 0x80000000, } ops.SSL_OP_NO_SSL_MASK = ops.SSL_OP_NO_SSLv3 + ops.SSL_OP_NO_TLSv1 + ops.SSL_OP_NO_TLSv1_1 + ops.SSL_OP_NO_TLSv1_2 + ops.SSL_OP_NO_TLSv1_3 ops.SSL_OP_NO_DTLS_MASK = ops.SSL_OP_NO_DTLSv1 + ops.SSL_OP_NO_DTLSv1_2 for k, v in pairs(ops) do _M[k] = v end local mt = {__index = _M} local ssl_ptr_ct = ffi.typeof('SSL*') local stack_of_ssl_cipher_iter = function(ctx) return stack_lib.mt_of("SSL_CIPHER", function(x) return x end, {}, true).__ipairs({ctx = ctx}) end function _M.from_request() -- don't GC this local ctx, err = nginx_aux.get_req_ssl() if err ~= nil then return nil, err end return setmetatable({ ctx = ctx, -- the cdata is not manage by Lua, don't GC on Lua side _managed = false, -- this is the client SSL session _server = true, }, mt) end function _M.from_socket(socket) if not socket then return nil, "expect a ngx.socket.tcp instance at #1" end -- don't GC this local ctx, err = nginx_aux.get_socket_ssl(socket) if err ~= nil then return nil, err end return setmetatable({ ctx = ctx, -- the cdata is not manage by Lua, don't GC on Lua side _managed = false, -- this is the client SSL session _server = false, }, mt) end function _M.istype(l) return l and l.ctx and ffi.istype(ssl_ptr_ct, l.ctx) end function _M:get_peer_certificate() local x509 if OPENSSL_3X then x509 = C.SSL_get1_peer_certificate(self.ctx) else x509 = C.SSL_get_peer_certificate(self.ctx) end if x509 == nil then return nil end ffi.gc(x509, C.X509_free) local err -- always copy, although the ref counter of returned x509 is -- already increased by one. x509, err = x509_lib.dup(x509) if err then return nil, err end return x509 end function _M:get_peer_cert_chain() local stack = C.SSL_get_peer_cert_chain(self.ctx) if stack == nil then return nil end return chain_lib.dup(stack) end -- TLSv1.3 function _M:set_ciphersuites(ciphers) if C.SSL_set_ciphersuites(self.ctx, ciphers) ~= 1 then return false, format_error("ssl:set_ciphers: SSL_set_ciphersuites") end return true end -- TLSv1.2 and lower function _M:set_cipher_list(ciphers) if C.SSL_set_cipher_list(self.ctx, ciphers) ~= 1 then return false, format_error("ssl:set_ciphers: SSL_set_cipher_list") end return true end function _M:get_ciphers() local ciphers = C.SSL_get_ciphers(self.ctx) if ciphers == nil then return nil end local ret = {} for i, cipher in stack_of_ssl_cipher_iter(ciphers) do cipher = C.SSL_CIPHER_get_name(cipher) if cipher == nil then return nil, format_error("ssl:get_ciphers: SSL_CIPHER_get_name") end ret[i] = ffi_str(cipher) end return table.concat(ret, ":") end function _M:get_cipher_name() local cipher = C.SSL_get_current_cipher(self.ctx) if cipher == nil then return nil end cipher = C.SSL_CIPHER_get_name(cipher) if cipher == nil then return nil, format_error("ssl:get_cipher_name: SSL_CIPHER_get_name") end return ffi_str(cipher) end function _M:set_timeout(tm) local session = C.SSL_get_session(self.ctx) if session == nil then return false, format_error("ssl:set_timeout: SSL_get_session") end if C.SSL_SESSION_set_timeout(session, tm) ~= 1 then return false, format_error("ssl:set_timeout: SSL_SESSION_set_timeout") end return true end function _M:get_timeout() local session = C.SSL_get_session(self.ctx) if session == nil then return false, format_error("ssl:get_timeout: SSL_get_session") end return tonumber(C.SSL_SESSION_get_timeout(session)) end local ssl_verify_default_cb = ffi_cast("verify_callback", function() return 1 end) function _M:set_verify(mode, cb) if self._verify_cb then self._verify_cb:free() end if cb then cb = ffi_cast("verify_callback", cb) self._verify_cb = cb end C.SSL_set_verify(self.ctx, mode, cb or ssl_verify_default_cb) return true end function _M:free_verify_cb() if self._verify_cb then self._verify_cb:free() self._verify_cb = nil end end function _M:add_client_ca(x509) if not self._server then return false, "ssl:add_client_ca is only supported on server side" end if not x509_lib.istype(x509) then return false, "expect a x509 instance at #1" end if C.SSL_add_client_CA(self.ctx, x509.ctx) ~= 1 then return false, format_error("ssl:add_client_ca: SSL_add_client_CA") end return true end function _M:set_options(...) local bitmask = 0 for _, opt in ipairs({...}) do bitmask = bit.bor(bitmask, opt) end bitmask = C.SSL_set_options(self.ctx, bitmask) return tonumber(bitmask) end function _M:get_options(readable) local bitmask = C.SSL_get_options(self.ctx) if not readable then return tonumber(bitmask) end local ret = {} for k, v in pairs(ops) do if bit.band(v, bitmask) > 0 then table.insert(ret, k) end end table.sort(ret) return ret end function _M:clear_options(...) local bitmask = 0 for _, opt in ipairs({...}) do bitmask = bit.bor(bitmask, opt) end bitmask = C.SSL_clear_options(self.ctx, bitmask) return tonumber(bitmask) end local valid_protocols = { ["SSLv3"] = ops.SSL_OP_NO_SSLv3, ["TLSv1"] = ops.SSL_OP_NO_TLSv1, ["TLSv1.1"] = ops.SSL_OP_NO_TLSv1_1, ["TLSv1.2"] = ops.SSL_OP_NO_TLSv1_2, ["TLSv1.3"] = ops.SSL_OP_NO_TLSv1_3, } local any_tlsv1 = ops.SSL_OP_NO_TLSv1_1 + ops.SSL_OP_NO_TLSv1_2 + ops.SSL_OP_NO_TLSv1_3 function _M:set_protocols(...) local bitmask = 0 for _, prot in ipairs({...}) do local b = valid_protocols[prot] if not b then return nil, "\"" .. prot .. "\" is not a valid protocol" end bitmask = bit.bor(bitmask, b) end if bit.band(bitmask, any_tlsv1) > 0 then bitmask = bit.bor(bitmask, ops.SSL_OP_NO_TLSv1) end -- first disable all protocols C.SSL_set_options(self.ctx, ops.SSL_OP_NO_SSL_MASK) -- then enable selected protocols return tonumber(C.SSL_clear_options(self.ctx, bitmask)) end return _MPKAN]ΏX<resty/openssl/hmac.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string require "resty.openssl.include.hmac" require "resty.openssl.include.evp.md" local ctypes = require "resty.openssl.auxiliary.ctypes" local format_error = require("resty.openssl.err").format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local _M = {} local mt = {__index = _M} local hmac_ctx_ptr_ct = ffi.typeof('HMAC_CTX*') -- Note: https://www.openssl.org/docs/manmaster/man3/HMAC_Init.html -- Replace with EVP_MAC_* functions for OpenSSL 3.0 function _M.new(key, typ) local ctx = C.HMAC_CTX_new() if ctx == nil then return nil, "hmac.new: failed to create HMAC_CTX" end ffi_gc(ctx, C.HMAC_CTX_free) local algo = C.EVP_get_digestbyname(typ or 'sha1') if algo == nil then return nil, string.format("hmac.new: invalid digest type \"%s\"", typ) end local code = C.HMAC_Init_ex(ctx, key, #key, algo, nil) if code ~= 1 then return nil, format_error("hmac.new") end return setmetatable({ ctx = ctx, algo = algo, buf = ctypes.uchar_array(OPENSSL_3X and C.EVP_MD_get_size(algo) or C.EVP_MD_size(algo)), }, mt), nil end function _M.istype(l) return l and l.ctx and ffi.istype(hmac_ctx_ptr_ct, l.ctx) end function _M:update(...) for _, s in ipairs({...}) do if C.HMAC_Update(self.ctx, s, #s) ~= 1 then return false, format_error("hmac:update") end end return true, nil end local result_length = ctypes.ptr_of_uint() function _M:final(s) if s then if C.HMAC_Update(self.ctx, s, #s) ~= 1 then return false, format_error("hmac:final") end end if C.HMAC_Final(self.ctx, self.buf, result_length) ~= 1 then return nil, format_error("hmac:final: HMAC_Final") end return ffi_str(self.buf, result_length[0]) end function _M:reset() local code = C.HMAC_Init_ex(self.ctx, nil, 0, nil, nil) if code ~= 1 then return false, format_error("hmac:reset") end return true end return _M PKAN]R3b``resty/openssl/ctx.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc require "resty.openssl.include.ossl_typ" local format_error = require("resty.openssl.err").format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ OSSL_LIB_CTX *OSSL_LIB_CTX_new(void); int OSSL_LIB_CTX_load_config(OSSL_LIB_CTX *ctx, const char *config_file); void OSSL_LIB_CTX_free(OSSL_LIB_CTX *ctx); ]] local ossl_lib_ctx local function new(request_context_only, conf_file) if not OPENSSL_3X then return false, "ctx is only supported from OpenSSL 3.0" end local ctx = C.OSSL_LIB_CTX_new() ffi_gc(ctx, C.OSSL_LIB_CTX_free) if conf_file and C.OSSL_LIB_CTX_load_config(ctx, conf_file) ~= 1 then return false, format_error("ctx.new") end if request_context_only and ngx then ngx.ctx.ossl_lib_ctx = ctx else ossl_lib_ctx = ctx end return true end local function free(request_context_only) if not OPENSSL_3X then return false, "ctx is only supported from OpenSSL 3.0" end if request_context_only and ngx then ngx.ctx.ossl_lib_ctx = nil else ossl_lib_ctx = nil end return true end local test_request do local ok, exdata = pcall(require, "thread.exdata") if ok and exdata then test_request = function() local r = exdata() if r ~= nil then return not not r end end else local getfenv = getfenv function test_request() return not not getfenv(0).__ngx_req end end end return { new = new, free = free, get_libctx = function() return test_request() and ngx.ctx.ossl_lib_ctx or ossl_lib_ctx end, }PKAN]eB||resty/openssl/pkey.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_new = ffi.new local ffi_str = ffi.string local ffi_cast = ffi.cast local ffi_copy = ffi.copy local rsa_macro = require "resty.openssl.include.rsa" local dh_macro = require "resty.openssl.include.dh" require "resty.openssl.include.bio" require "resty.openssl.include.pem" require "resty.openssl.include.x509" require "resty.openssl.include.evp.pkey" local evp_macro = require "resty.openssl.include.evp" local pkey_macro = require "resty.openssl.include.evp.pkey" local bio_util = require "resty.openssl.auxiliary.bio" local digest_lib = require "resty.openssl.digest" local rsa_lib = require "resty.openssl.rsa" local dh_lib = require "resty.openssl.dh" local ec_lib = require "resty.openssl.ec" local ecx_lib = require "resty.openssl.ecx" local objects_lib = require "resty.openssl.objects" local jwk_lib = require "resty.openssl.auxiliary.jwk" local ctx_lib = require "resty.openssl.ctx" local ctypes = require "resty.openssl.auxiliary.ctypes" local ecdsa_util = require "resty.openssl.auxiliary.ecdsa" local format_error = require("resty.openssl.err").format_error local log_warn = require "resty.openssl.auxiliary.compat".log_warn local log_debug = require "resty.openssl.auxiliary.compat".log_debug local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local ptr_of_uint = ctypes.ptr_of_uint local ptr_of_size_t = ctypes.ptr_of_size_t local ptr_of_int = ctypes.ptr_of_int local null = ctypes.null local load_pem_args = { null, null, null } local load_der_args = { null } local get_pkey_key = { [evp_macro.EVP_PKEY_RSA] = function(ctx) return C.EVP_PKEY_get0_RSA(ctx) end, [evp_macro.EVP_PKEY_EC] = function(ctx) return C.EVP_PKEY_get0_EC_KEY(ctx) end, [evp_macro.EVP_PKEY_DH] = function(ctx) return C.EVP_PKEY_get0_DH(ctx) end } local load_rsa_key_funcs if not OPENSSL_3X then load_rsa_key_funcs= { ['PEM_read_bio_RSAPrivateKey'] = true, ['PEM_read_bio_RSAPublicKey'] = true, } -- those functions return RSA* instead of EVP_PKEY* end local function load_pem_der(txt, opts, funcs) local fmt = opts.format or '*' if fmt ~= 'PEM' and fmt ~= 'DER' and fmt ~= "JWK" and fmt ~= '*' then return nil, "expecting 'DER', 'PEM', 'JWK' or '*' as \"format\"" end local typ = opts.type or '*' if typ ~= 'pu' and typ ~= 'pr' and typ ~= '*' then return nil, "expecting 'pr', 'pu' or '*' as \"type\"" end if fmt == "JWK" and (typ == "pu" or type == "pr") and not OPENSSL_3X then return nil, "explictly load private or public key from JWK format is not supported on OpenSSL 1.1.1" end log_debug("load key using fmt: ", fmt, ", type: ", typ) local bio = C.BIO_new_mem_buf(txt, #txt) if bio == nil then return nil, "BIO_new_mem_buf() failed" end ffi_gc(bio, C.BIO_free) local ctx local fs = funcs[fmt][typ] local passphrase_cb for f, arg in pairs(fs) do -- don't need BIO when loading JWK key: we parse it in Lua land if f == "load_jwk" then local err ctx, err = jwk_lib[f](txt, typ, opts and opts.properties) if ctx == nil then -- if fmt is explictly set to JWK, we should return an error now if fmt == "JWK" then return nil, err end log_debug("jwk decode failed: ", err, ", continuing") end else -- #define BIO_CTRL_RESET 1 local code = C.BIO_ctrl(bio, 1, 0, nil) if code ~= 1 then return nil, "BIO_ctrl() failed" end -- only pass in passphrase/passphrase_cb to PEM_* functions if fmt == "PEM" or (fmt == "*" and arg == load_pem_args) then if opts.passphrase then local passphrase = opts.passphrase if type(passphrase) ~= "string" then -- clear errors occur when trying C.ERR_clear_error() return nil, "passphrase must be a string" end arg = { null, null, passphrase } elseif opts.passphrase_cb then passphrase_cb = passphrase_cb or ffi_cast("pem_password_cb", function(buf, size) local p = opts.passphrase_cb() local len = #p -- 1 byte for \0 if len > size then log_warn("pkey:load_pem_der: passphrase truncated from ", len, " to ", size) len = size end ffi_copy(buf, p, len) return len end) arg = { null, passphrase_cb, null } end end ctx = C[f](bio, unpack(arg)) end if ctx ~= nil then log_debug("pkey:load_pem_der: loaded pkey using function ", f) -- pkcs1 functions create a rsa rather than evp_pkey -- disable the checking in openssl 3.0 for sail safe if not OPENSSL_3X and load_rsa_key_funcs[f] then local rsa = ctx ctx = C.EVP_PKEY_new() if ctx == null then return nil, format_error("pkey:load_pem_der: EVP_PKEY_new") end if C.EVP_PKEY_assign(ctx, evp_macro.EVP_PKEY_RSA, rsa) ~= 1 then C.RSA_free(rsa) C.EVP_PKEY_free(ctx) return nil, "pkey:load_pem_der: EVP_PKEY_assign() failed" end end break end end if passphrase_cb ~= nil then passphrase_cb:free() end if ctx == nil then return nil, format_error() end -- clear errors occur when trying C.ERR_clear_error() return ctx, nil end local function _pctx_ctrl_str(pctx, opts) if not opts then return true end if opts.mgf1_md and pkey_macro.EVP_PKEY_CTX_set_rsa_mgf1_md_name(pctx, opts.mgf1_md, nil) ~= 1 then return nil, format_error("EVP_PKEY_CTX_set_rsa_mgf1_md_name") end if opts.oaep_md and pkey_macro.EVP_PKEY_CTX_set_rsa_oaep_md_name(pctx, opts.oaep_md, nil) ~= 1 then return nil, format_error("EVP_PKEY_CTX_set_rsa_oaep_md_name") end if opts.pss_saltlen and pkey_macro.EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, opts.pss_saltlen) ~= 1 then return nil, format_error("EVP_PKEY_CTX_set_rsa_pss_saltlen") end for _, c in ipairs(opts) do if type(c) == "string" then local k, v = string.match(c, "([_%w]+):([_%w]+)") if not k or not v then return nil, "unknown ctrl str: ".. c end if C.EVP_PKEY_CTX_ctrl_str(pctx, k, v) ~= 1 then return nil, format_error(string.format('EVP_PKEY_CTX_ctrl_str(%s, "%s", "%s")', pctx, k, v)) end end end return true end local function generate_param(key_type, config) if key_type == evp_macro.EVP_PKEY_DH then local dh_group = config.group if dh_group then local get_group_func = dh_macro.dh_groups[dh_group] if not get_group_func then return nil, "unknown pre-defined group " .. dh_group end local ctx = get_group_func() if ctx == nil then return nil, format_error("DH_get_x") end local params = C.EVP_PKEY_new() if not params then return nil, format_error("EVP_PKEY_new") end ffi_gc(params, C.EVP_PKEY_free) if C.EVP_PKEY_assign(params, key_type, ctx) ~= 1 then return nil, format_error("EVP_PKEY_assign") end return params end end local pctx = C.EVP_PKEY_CTX_new_id(key_type, nil) if pctx == nil then return nil, format_error("EVP_PKEY_CTX_new_id") end ffi_gc(pctx, C.EVP_PKEY_CTX_free) if C.EVP_PKEY_paramgen_init(pctx) ~= 1 then return nil, format_error("EVP_PKEY_paramgen_init") end if key_type == evp_macro.EVP_PKEY_EC then local curve = config.curve or 'prime192v1' local nid = C.OBJ_ln2nid(curve) if nid == 0 then return nil, "unknown curve " .. curve end if pkey_macro.EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, nid) <= 0 then return nil, format_error("EVP_PKEY_CTX_ctrl: EC: curve_nid") end -- use the named-curve encoding for best backward-compatibilty -- and for playing well with go:crypto/x509 -- # define OPENSSL_EC_NAMED_CURVE 0x001 if pkey_macro.EVP_PKEY_CTX_set_ec_param_enc(pctx, 1) <= 0 then return nil, format_error("EVP_PKEY_CTX_ctrl: EC: param_enc") end elseif key_type == evp_macro.EVP_PKEY_DH then local bits = config.bits if not config.param and not bits then bits = 2048 end if bits and pkey_macro.EVP_PKEY_CTX_set_dh_paramgen_prime_len(pctx, bits) <= 0 then return nil, format_error("EVP_PKEY_CTX_ctrl: DH: bits") end end local ok, err = _pctx_ctrl_str(pctx, config) if not ok then return nil, "pkey:generate_param: " .. err end local ctx_ptr = ffi_new("EVP_PKEY*[1]") if C.EVP_PKEY_paramgen(pctx, ctx_ptr) ~= 1 then return nil, format_error("EVP_PKEY_paramgen") end local params = ctx_ptr[0] ffi_gc(params, C.EVP_PKEY_free) return params end local load_param_funcs = { [evp_macro.EVP_PKEY_EC] = { ["*"] = { ["*"] = { ['PEM_read_bio_ECPKParameters'] = load_pem_args, -- ['d2i_ECPKParameters_bio'] = load_der_args, } }, }, [evp_macro.EVP_PKEY_DH] = { ["*"] = { ["*"] = { ['PEM_read_bio_DHparams'] = load_pem_args, -- ['d2i_DHparams_bio'] = load_der_args, } }, }, } local function generate_key(config) local typ = config.type or 'RSA' local key_type if typ == "RSA" then key_type = evp_macro.EVP_PKEY_RSA elseif typ == "EC" then key_type = evp_macro.EVP_PKEY_EC elseif typ == "DH" then key_type = evp_macro.EVP_PKEY_DH elseif evp_macro.ecx_curves[typ] then key_type = evp_macro.ecx_curves[typ] else return nil, "unsupported type " .. typ end if key_type == 0 then return nil, "the linked OpenSSL library doesn't support " .. typ .. " key" end local pctx if key_type == evp_macro.EVP_PKEY_EC or key_type == evp_macro.EVP_PKEY_DH then local params, err if config.param then -- HACK config.type = nil local ctx, err = load_pem_der(config.param, config, load_param_funcs[key_type]) if err then return nil, "load_pem_der: " .. err end if key_type == evp_macro.EVP_PKEY_EC then local ec_group = ctx ffi_gc(ec_group, C.EC_GROUP_free) ctx = C.EC_KEY_new() if ctx == nil then return nil, "EC_KEY_new() failed" end if C.EC_KEY_set_group(ctx, ec_group) ~= 1 then return nil, format_error("EC_KEY_set_group") end end params = C.EVP_PKEY_new() if not params then return nil, format_error("EVP_PKEY_new") end ffi_gc(params, C.EVP_PKEY_free) if C.EVP_PKEY_assign(params, key_type, ctx) ~= 1 then return nil, format_error("EVP_PKEY_assign") end else params, err = generate_param(key_type, config) if err then return nil, "generate_param: " .. err end end pctx = C.EVP_PKEY_CTX_new(params, nil) if pctx == nil then return nil, format_error("EVP_PKEY_CTX_new") end else pctx = C.EVP_PKEY_CTX_new_id(key_type, nil) if pctx == nil then return nil, format_error("EVP_PKEY_CTX_new_id") end end ffi_gc(pctx, C.EVP_PKEY_CTX_free) if C.EVP_PKEY_keygen_init(pctx) ~= 1 then return nil, format_error("EVP_PKEY_keygen_init") end -- RSA key parameters are set for keygen ctx not paramgen if key_type == evp_macro.EVP_PKEY_RSA then local bits = config.bits or 2048 if bits > 4294967295 then return nil, "bits out of range" end if pkey_macro.EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, bits) <= 0 then return nil, format_error("EVP_PKEY_CTX_ctrl: RSA: bits") end if config.exp then -- don't free exp as it's used internally in key local exp = C.BN_new() if exp == nil then return nil, "BN_new() failed" end C.BN_set_word(exp, config.exp) if pkey_macro.EVP_PKEY_CTX_set_rsa_keygen_pubexp(pctx, exp) <= 0 then return nil, format_error("EVP_PKEY_CTX_ctrl: RSA: exp") end end end local ok, err = _pctx_ctrl_str(pctx, config) if not ok then return nil, "pkey:generate_key: " .. err end local ctx_ptr = ffi_new("EVP_PKEY*[1]") -- TODO: move to use EVP_PKEY_gen after drop support for <1.1.1 if C.EVP_PKEY_keygen(pctx, ctx_ptr) ~= 1 then return nil, format_error("EVP_PKEY_gen") end return ctx_ptr[0] end local function compose_key(config) local typ = config.type or 'RSA' local key_type if typ == "RSA" then key_type = evp_macro.EVP_PKEY_RSA elseif typ == "EC" then key_type = evp_macro.EVP_PKEY_EC elseif evp_macro.ecx_curves[typ] then key_type = evp_macro.ecx_curves[typ] else return nil, "unsupported type " .. typ end if key_type == 0 then return nil, "the linked OpenSSL library doesn't support " .. typ .. " key" end local key, err, key_free, _ if key_type == evp_macro.EVP_PKEY_EC then key = C.EC_KEY_new() if key == nil then return nil, "EC_KEY_new failed" end key_free = C.EC_KEY_free _, err = ec_lib.set_parameters(key, config.params) elseif key_type == evp_macro.EVP_PKEY_RSA then key = C.RSA_new() if key == nil then return nil, "RSA_new failed" end key_free = C.RSA_free _, err = rsa_lib.set_parameters(key, config.params) elseif key_type == evp_macro.EVP_PKEY_ED25519 or key_type == evp_macro.EVP_PKEY_X25519 or key_type == evp_macro.EVP_PKEY_ED448 or key_type == evp_macro.EVP_PKEY_X448 then return ecx_lib.set_parameters(key_type, nil, config.params) end if err then return nil, "failed to construct " .. typ.. " key from parameters: " .. err end local ctx = C.EVP_PKEY_new() if ctx == nil then key_free(key) return nil, "EVP_PKEY_new() failed" end local code = C.EVP_PKEY_assign(ctx, key_type, key) if code ~= 1 then key_free(key) C.EVP_PKEY_free(ctx) return nil, "EVP_PKEY_assign() failed" end return ctx end local load_key_try_funcs = {} do -- TODO: pkcs1 load functions are not required in openssl 3.0 local _load_key_try_funcs = { PEM = { -- Note: make sure we always try load priv key first pr = { ['PEM_read_bio_PrivateKey'] = load_pem_args, -- disable in openssl3.0, PEM_read_bio_PrivateKey can read pkcs1 in 3.0 ['PEM_read_bio_RSAPrivateKey'] = not OPENSSL_3X and load_pem_args or nil, }, pu = { ['PEM_read_bio_PUBKEY'] = load_pem_args, -- disable in openssl3.0, PEM_read_bio_PrivateKey can read pkcs1 in 3.0 ['PEM_read_bio_RSAPublicKey'] = not OPENSSL_3X and load_pem_args or nil, }, }, DER = { pr = { ['d2i_PrivateKey_bio'] = load_der_args, }, pu = { ['d2i_PUBKEY_bio'] = load_der_args, }, }, JWK = { pr = { ['load_jwk'] = {}, }, pu = { ['load_jwk'] = {}, }, } } -- populate * funcs local all_funcs = {} local typ_funcs = {} for fmt, ffs in pairs(_load_key_try_funcs) do load_key_try_funcs[fmt] = ffs local funcs = {} for typ, fs in pairs(ffs) do for f, arg in pairs(fs) do funcs[f] = arg all_funcs[f] = arg if not typ_funcs[typ] then typ_funcs[typ] = {} end typ_funcs[typ] = arg end end load_key_try_funcs[fmt]["*"] = funcs end load_key_try_funcs["*"] = {} load_key_try_funcs["*"]["*"] = all_funcs for typ, fs in pairs(typ_funcs) do load_key_try_funcs[typ] = fs end end local function __tostring(self, is_priv, fmt, is_pkcs1) if fmt == "JWK" then return jwk_lib.dump_jwk(self, is_priv) elseif is_pkcs1 then if fmt ~= "PEM" or self.key_type ~= evp_macro.EVP_PKEY_RSA then return nil, "PKCS#1 format is only supported to encode RSA key in \"PEM\" format" elseif OPENSSL_3X then -- maybe possible with OSSL_ENCODER_CTX_new_for_pkey though return nil, "writing out RSA key in PKCS#1 format is not supported in OpenSSL 3.0" end end if is_priv then if fmt == "DER" then return bio_util.read_wrap(C.i2d_PrivateKey_bio, self.ctx) end -- PEM if is_pkcs1 then local rsa = get_pkey_key[evp_macro.EVP_PKEY_RSA](self.ctx) if rsa == nil then return nil, "unable to read RSA key for writing" end return bio_util.read_wrap(C.PEM_write_bio_RSAPrivateKey, rsa, nil, nil, 0, nil, nil) end return bio_util.read_wrap(C.PEM_write_bio_PrivateKey, self.ctx, nil, nil, 0, nil, nil) else if fmt == "DER" then return bio_util.read_wrap(C.i2d_PUBKEY_bio, self.ctx) end -- PEM if is_pkcs1 then local rsa = get_pkey_key[evp_macro.EVP_PKEY_RSA](self.ctx) if rsa == nil then return nil, "unable to read RSA key for writing" end return bio_util.read_wrap(C.PEM_write_bio_RSAPublicKey, rsa) end return bio_util.read_wrap(C.PEM_write_bio_PUBKEY, self.ctx) end end local _M = {} local mt = { __index = _M, __tostring = __tostring } local empty_table = {} local evp_pkey_ptr_ct = ffi.typeof('EVP_PKEY*') function _M.new(s, opts) local ctx, err s = s or {} if type(s) == 'table' then if s.params then ctx, err = compose_key(s) else ctx, err = generate_key(s) end if err then err = "pkey.new:new_key: " .. err end elseif type(s) == 'string' then ctx, err = load_pem_der(s, opts or empty_table, load_key_try_funcs) if err then err = "pkey.new:load_key: " .. err end elseif type(s) == 'cdata' then if ffi.istype(evp_pkey_ptr_ct, s) then ctx = s else return nil, "pkey.new: expect a EVP_PKEY* cdata at #1" end else return nil, "pkey.new: unexpected type " .. type(s) .. " at #1" end if err then return nil, err end ffi_gc(ctx, C.EVP_PKEY_free) local key_type = OPENSSL_3X and C.EVP_PKEY_get_base_id(ctx) or C.EVP_PKEY_base_id(ctx) if key_type == 0 then return nil, "pkey.new: cannot get key_type" end local key_type_is_ecx = (key_type == evp_macro.EVP_PKEY_ED25519) or (key_type == evp_macro.EVP_PKEY_X25519) or (key_type == evp_macro.EVP_PKEY_ED448) or (key_type == evp_macro.EVP_PKEY_X448) -- although OpenSSL discourages to use this size for digest/verify -- but this is good enough for now local buf_size = OPENSSL_3X and C.EVP_PKEY_get_size(ctx) or C.EVP_PKEY_size(ctx) local self = setmetatable({ ctx = ctx, pkey_ctx = nil, key_type = key_type, key_type_is_ecx = key_type_is_ecx, buf = ctypes.uchar_array(buf_size), buf_size = buf_size, }, mt) return self, nil end function _M.istype(l) return l and l.ctx and ffi.istype(evp_pkey_ptr_ct, l.ctx) end function _M:get_key_type(nid_only) return nid_only and self.key_type or objects_lib.nid2table(self.key_type) end function _M:get_size() return OPENSSL_3X and C.EVP_PKEY_get_size(self.ctx) or C.EVP_PKEY_size(self.ctx) end function _M:get_default_digest_type() local nid = ptr_of_int() local code = C.EVP_PKEY_get_default_digest_nid(self.ctx, nid) if code == -2 then return nil, "operation is not supported by the public key algorithm" elseif code <= 0 then return nil, format_error("get_default_digest", code) end local ret = objects_lib.nid2table(nid[0]) ret.mandatory = code == 2 return ret end function _M:get_provider_name() if not OPENSSL_3X then return false, "pkey:get_provider_name is not supported" end local p = C.EVP_PKEY_get0_provider(self.ctx) if p == nil then return nil end return ffi_str(C.OSSL_PROVIDER_get0_name(p)) end if OPENSSL_3X then local param_lib = require "resty.openssl.param" _M.settable_params, _M.set_params, _M.gettable_params, _M.get_param = param_lib.get_params_func("EVP_PKEY", "key_type") end function _M:get_parameters() if not self.key_type_is_ecx then local getter = get_pkey_key[self.key_type] if not getter then return nil, "key getter not defined" end local key = getter(self.ctx) if key == nil then return nil, format_error("EVP_PKEY_get0_{key}") end if self.key_type == evp_macro.EVP_PKEY_RSA then return rsa_lib.get_parameters(key) elseif self.key_type == evp_macro.EVP_PKEY_EC then return ec_lib.get_parameters(key) elseif self.key_type == evp_macro.EVP_PKEY_DH then return dh_lib.get_parameters(key) end else return ecx_lib.get_parameters(self.ctx) end end function _M:set_parameters(opts) if not self.key_type_is_ecx then local getter = get_pkey_key[self.key_type] if not getter then return nil, "key getter not defined" end local key = getter(self.ctx) if key == nil then return nil, format_error("EVP_PKEY_get0_{key}") end if self.key_type == evp_macro.EVP_PKEY_RSA then return rsa_lib.set_parameters(key, opts) elseif self.key_type == evp_macro.EVP_PKEY_EC then return ec_lib.set_parameters(key, opts) elseif self.key_type == evp_macro.EVP_PKEY_DH then return dh_lib.set_parameters(key, opts) end else -- for ecx keys we always create a new EVP_PKEY and release the old one local ctx, err = ecx_lib.set_parameters(self.key_type, self.ctx, opts) if err then return false, err end self.ctx = ctx end end function _M:is_private() local params = self:get_parameters() if self.key_type == evp_macro.EVP_PKEY_RSA then return params.d ~= nil else return params.private ~= nil end end local ASYMMETRIC_OP_ENCRYPT = 0x1 local ASYMMETRIC_OP_DECRYPT = 0x2 local ASYMMETRIC_OP_SIGN_RAW = 0x3 local ASYMMETRIC_OP_VERIFY_RAW = 0x4 local ASYMMETRIC_OP_VERIFY_RECOVER = 0x5 local function asymmetric_routine(self, s, op, padding, opts) if type(s) ~= "string" then return nil, "pkey:asymmetric_routine: expect a string at #1" end local pkey_ctx if self.key_type == evp_macro.EVP_PKEY_RSA then if padding then padding = tonumber(padding) if not padding then return nil, "invalid padding: " .. __tostring(padding) end else padding = rsa_macro.paddings.RSA_PKCS1_PADDING end end if self.pkey_ctx ~= nil and self.key_type ~= evp_macro.EVP_PKEY_RSA then pkey_ctx = self.pkey_ctx else pkey_ctx = C.EVP_PKEY_CTX_new(self.ctx, nil) if pkey_ctx == nil then return nil, format_error("pkey:asymmetric_routine EVP_PKEY_CTX_new()") end ffi_gc(pkey_ctx, C.EVP_PKEY_CTX_free) self.pkey_ctx = pkey_ctx end local f, fint, op_name if op == ASYMMETRIC_OP_ENCRYPT then fint = C.EVP_PKEY_encrypt_init f = C.EVP_PKEY_encrypt op_name = "encrypt" elseif op == ASYMMETRIC_OP_DECRYPT then fint = C.EVP_PKEY_decrypt_init f = C.EVP_PKEY_decrypt op_name = "decrypt" elseif op == ASYMMETRIC_OP_SIGN_RAW then fint = C.EVP_PKEY_sign_init f = C.EVP_PKEY_sign op_name = "sign" elseif op == ASYMMETRIC_OP_VERIFY_RAW then fint = C.EVP_PKEY_verify_init f = C.EVP_PKEY_verify op_name = "verify" elseif op == ASYMMETRIC_OP_VERIFY_RECOVER then fint = C.EVP_PKEY_verify_recover_init f = C.EVP_PKEY_verify_recover op_name = "verify_recover" else error("bad \"op\", got " .. op, 2) end local code = fint(pkey_ctx) if code < 1 then return nil, format_error("pkey:asymmetric_routine EVP_PKEY_" .. op_name .. "_init", code) end -- EVP_PKEY_CTX_ctrl must be called after *_init if self.key_type == evp_macro.EVP_PKEY_RSA and padding and pkey_macro.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding) ~= 1 then return nil, format_error("pkey:asymmetric_routine EVP_PKEY_CTX_set_rsa_padding") end local ok, err = _pctx_ctrl_str(pkey_ctx, opts) if not ok then return nil, "pkey:asymmetric_routine: " .. err end local buf, buf_len if opts and opts.buf_in then buf = opts.buf_in buf_len = #buf else buf = self.buf buf_len = ptr_of_size_t(self.buf_size) end code = f(pkey_ctx, buf, buf_len, s, #s) if code <= 0 then return nil, format_error("pkey:asymmetric_routine EVP_PKEY_" .. op_name, code) end if not opts or not opts.buf_in then return ffi_str(self.buf, buf_len[0]), nil end return true end _M.PADDINGS = rsa_macro.paddings function _M:encrypt(s, padding, opts) return asymmetric_routine(self, s, ASYMMETRIC_OP_ENCRYPT, padding, opts) end function _M:decrypt(s, padding, opts) return asymmetric_routine(self, s, ASYMMETRIC_OP_DECRYPT, padding, opts) end function _M:sign_raw(s, padding, opts) -- TODO: temporary hack before OpenSSL has proper check for existence of private key if self.key_type_is_ecx and not self:is_private() then return nil, "pkey:sign_raw: missing private key" end return asymmetric_routine(self, s, ASYMMETRIC_OP_SIGN_RAW, padding, opts) end function _M:verify_raw(signature, hashed_message, md_alg, padding, opts) opts = opts or {} opts.buf_in = signature if md_alg then table.insert(opts, "digest:" .. md_alg) end return asymmetric_routine(self, hashed_message, ASYMMETRIC_OP_VERIFY_RAW, padding, opts) end function _M:verify_recover(s, padding, opts) return asymmetric_routine(self, s, ASYMMETRIC_OP_VERIFY_RECOVER, padding, opts) end local evp_pkey_ctx_ptr_ptr_ct = ffi.typeof('EVP_PKEY_CTX*[1]') local function sign_verify_prepare(self, fint, md_alg, padding, opts) local md_ctx = C.EVP_MD_CTX_new() if md_ctx == nil then return nil, "pkey:sign_verify_prepare: EVP_MD_CTX_new() failed" end ffi_gc(md_ctx, C.EVP_MD_CTX_free) local algo if md_alg then if OPENSSL_3X then algo = C.EVP_MD_fetch(ctx_lib.get_libctx(), md_alg, nil) else algo = C.EVP_get_digestbyname(md_alg) end if algo == nil then return nil, string.format("pkey:sign_verify_prepare: invalid digest type \"%s\"", md_alg) end end local ppkey_ctx = evp_pkey_ctx_ptr_ptr_ct() if fint(md_ctx, ppkey_ctx, algo, nil, self.ctx) ~= 1 then return nil, format_error("pkey:sign_verify_prepare: Init failed") end -- EVP_PKEY_CTX_ctrl must be called after *_init if self.key_type == evp_macro.EVP_PKEY_RSA and padding and pkey_macro.EVP_PKEY_CTX_set_rsa_padding(ppkey_ctx[0], padding) ~= 1 then return nil, format_error("pkey:sign_verify_prepare EVP_PKEY_CTX_set_rsa_padding") end local ok, err = _pctx_ctrl_str(ppkey_ctx[0], opts) if not ok then return nil, "pkey:sign_verify_prepare: " .. err end return md_ctx end function _M:sign(digest, md_alg, padding, opts) -- TODO: temporary hack before OpenSSL has proper check for existence of private key if self.key_type_is_ecx and not self:is_private() then return nil, "pkey:sign: missing private key" end local ret, err if digest_lib.istype(digest) then local length = ptr_of_uint() if C.EVP_SignFinal(digest.ctx, self.buf, length, self.ctx) ~= 1 then return nil, format_error("pkey:sign: EVP_SignFinal") end ret = ffi_str(self.buf, length[0]) elseif type(digest) == "string" then local md_ctx, err = sign_verify_prepare(self, C.EVP_DigestSignInit, md_alg, padding, opts) if err then return nil, err end local length = ptr_of_size_t(self.buf_size) if C.EVP_DigestSign(md_ctx, self.buf, length, digest, #digest) ~= 1 then return nil, format_error("pkey:sign: EVP_DigestSign") end ret = ffi_str(self.buf, length[0]) else return nil, "pkey:sign: expect a digest instance or a string at #1" end if self.key_type == evp_macro.EVP_PKEY_EC and opts and opts.ecdsa_use_raw then local ec_key = get_pkey_key[evp_macro.EVP_PKEY_EC](self.ctx) ret, err = ecdsa_util.sig_der2raw(ret, ec_key) if err then return nil, "pkey:sign: ecdsa.sig_der2raw: " .. err end end return ret end function _M:verify(signature, digest, md_alg, padding, opts) if type(signature) ~= "string" then return nil, "pkey:verify: expect a string at #1" end local err if self.key_type == evp_macro.EVP_PKEY_EC and opts and opts.ecdsa_use_raw then local ec_key = get_pkey_key[evp_macro.EVP_PKEY_EC](self.ctx) signature, err = ecdsa_util.sig_raw2der(signature, ec_key) if err then return nil, "pkey:sign: ecdsa.sig_raw2der: " .. err end end local code if digest_lib.istype(digest) then code = C.EVP_VerifyFinal(digest.ctx, signature, #signature, self.ctx) elseif type(digest) == "string" then local md_ctx, err = sign_verify_prepare(self, C.EVP_DigestVerifyInit, md_alg, padding, opts) if err then return nil, err end code = C.EVP_DigestVerify(md_ctx, signature, #signature, digest, #digest) else return nil, "pkey:verify: expect a digest instance or a string at #2" end if code == 0 then return false, format_error("pkey:verify") elseif code == 1 then return true, nil end return false, format_error("pkey:verify") end function _M:derive(peerkey) if not self.istype(peerkey) then return nil, "pkey:derive: expect a pkey instance at #1" end local pctx = C.EVP_PKEY_CTX_new(self.ctx, nil) if pctx == nil then return nil, "pkey:derive: EVP_PKEY_CTX_new() failed" end ffi_gc(pctx, C.EVP_PKEY_CTX_free) local code = C.EVP_PKEY_derive_init(pctx) if code <= 0 then return nil, format_error("pkey:derive: EVP_PKEY_derive_init", code) end code = C.EVP_PKEY_derive_set_peer(pctx, peerkey.ctx) if code <= 0 then return nil, format_error("pkey:derive: EVP_PKEY_derive_set_peer", code) end local buflen = ptr_of_size_t() code = C.EVP_PKEY_derive(pctx, nil, buflen) if code <= 0 then return nil, format_error("pkey:derive: EVP_PKEY_derive check buffer size", code) end local buf = ctypes.uchar_array(buflen[0]) code = C.EVP_PKEY_derive(pctx, buf, buflen) if code <= 0 then return nil, format_error("pkey:derive: EVP_PKEY_derive", code) end return ffi_str(buf, buflen[0]) end local function pub_or_priv_is_pri(pub_or_priv) if pub_or_priv == 'private' or pub_or_priv == 'PrivateKey' then return true elseif not pub_or_priv or pub_or_priv == 'public' or pub_or_priv == 'PublicKey' then return false else return nil, string.format("can only export private or public key, not %s", pub_or_priv) end end function _M:tostring(pub_or_priv, fmt, pkcs1) local is_priv, err = pub_or_priv_is_pri(pub_or_priv) if err then return nil, "pkey:tostring: " .. err end return __tostring(self, is_priv, fmt, pkcs1) end function _M:to_PEM(pub_or_priv, pkcs1) return self:tostring(pub_or_priv, "PEM", pkcs1) end function _M.paramgen(config) local typ = config.type local key_type, write_func, get_ctx_func if typ == "EC" then key_type = evp_macro.EVP_PKEY_EC if key_type == 0 then return nil, "pkey.paramgen: the linked OpenSSL library doesn't support EC key" end write_func = C.PEM_write_bio_ECPKParameters get_ctx_func = function(ctx) local ctx = get_pkey_key[key_type](ctx) if ctx == nil then error(format_error("pkey.paramgen: EVP_PKEY_get0_{key}")) end return C.EC_KEY_get0_group(ctx) end elseif typ == "DH" then key_type = evp_macro.EVP_PKEY_DH if key_type == 0 then return nil, "pkey.paramgen: the linked OpenSSL library doesn't support DH key" end write_func = C.PEM_write_bio_DHparams get_ctx_func = get_pkey_key[key_type] else return nil, "pkey.paramgen: unsupported type " .. type end local params, err = generate_param(key_type, config) if err then return nil, "pkey.paramgen: generate_param: " .. err end local ctx = get_ctx_func(params) if ctx == nil then return nil, format_error("pkey.paramgen: EVP_PKEY_get0_{key}") end -- since ctx is always a internal pointer inside of params (a EVP_PKEY*), thus avoid use tail call -- here to avoid using `ctx` after `params` is GC collected. local res, err = bio_util.read_wrap(write_func, ctx) return res, err end return _M PKAN]PP!resty/openssl/auxiliary/ecdsa.luanu[local ffi = require "ffi" local ffi_new = ffi.new local ffi_gc = ffi.gc local ffi_str = ffi.string local C = ffi.C require "resty.openssl.include.ecdsa" local bn_lib = require "resty.openssl.bn" local format_error = require("resty.openssl.err").format_error local ceil = math.ceil local _M = {} --[[ A DER formatted ECDSA signature looks like SEQUENCE { INTEGER 4B 5F CF E8 A7 BD 6A C2 1D 25 0D F8 DE 9C EF DC C4 DF 33 F3 AF 2F 3D 5B 83 2C 1F BD 98 C8 61 34 INTEGER 7E F9 E9 60 B1 E6 7F 59 9E 2C 38 22 39 B2 C4 B1 71 3E FA AE 24 A4 B7 D2 03 5A 60 8D F3 34 3D E8 } It has ASN.1 headers on both the SEQUENCE and INTEGERs, so the total length is typically 70 bytes (3 headers, 2 bytes each). The binary form is typically 64 bytes. ]] local function group_size(ec_key) local group = C.EC_KEY_get0_group(ec_key) if group == nil then assert("failed to get EC group", 2) end local sz = C.EC_GROUP_order_bits(group) if sz <= 0 then assert("failed to get EC group order bits", 2) end return ceil(sz / 8) end _M.sig_der2raw = function(der, ec_key) if ec_key == nil then error("ec_key is required", 2) end local psize = group_size(ec_key) local buf = ffi.new("const unsigned char*", der) local buf_ptr = ffi.new("const unsigned char*[1]", buf) local sig = C.d2i_ECDSA_SIG(nil, buf_ptr, #der) if sig == nil then return nil, format_error("failed to parse ECDSA signature: d2i_ECDSA_SIG") end ffi_gc(sig, C.ECDSA_SIG_free) local bn_r_ptr = ffi_new("const BIGNUM*[1]") local bn_s_ptr = ffi_new("const BIGNUM*[1]") C.ECDSA_SIG_get0(sig, bn_r_ptr, bn_s_ptr) if bn_r_ptr[0] == nil or bn_s_ptr[0] == nil then return nil, format_error("failed to get r or s from sig") end local bn_r = bn_lib.dup(bn_r_ptr[0]) local bn_s = bn_lib.dup(bn_s_ptr[0]) if bn_r == nil or bn_s == nil then return nil, format_error("failed to dup r or s") end local rbin, err = bn_r:to_binary(psize) if err then return nil, "failed to parse r to binary: " .. err end local sbin, err = bn_s:to_binary(psize) if err then return nil, "failed to parse s to binary: " .. err end return rbin .. sbin end _M.sig_raw2der = function(bin, ec_key) if ec_key == nil then error("ec_key is required", 2) end local psize = group_size(ec_key) if #bin ~= psize * 2 then return nil, "invalid signature length, expect " .. (psize * 2) .. " but got " .. #bin end local rbin = string.sub(bin, 1, psize) local sbin = string.sub(bin, psize + 1) local bn_r, err = bn_lib.from_binary(rbin) if err then return nil, "failed to parse r from binary: " .. err end local bn_s, err = bn_lib.from_binary(sbin) if err then return nil, "failed to parse s from binary: " .. err end local sig = C.ECDSA_SIG_new() if sig == nil then return nil, format_error("ECDSA_SIG_new") end ffi_gc(sig, C.ECDSA_SIG_free) local bn_r0 = C.BN_dup(bn_r.ctx) local bn_s0 = C.BN_dup(bn_s.ctx) if not bn_r0 or not bn_s0 then return nil, format_error("failed to BN_dup r or s") end local ok = C.ECDSA_SIG_set0(sig, bn_r0, bn_s0) if ok ~= 1 then return nil, format_error("failed to set r and s to sig") end local der_len = C.i2d_ECDSA_SIG(sig, nil) if der_len <= 0 then return nil, format_error("failed to get ECDSA signature size") end local buf = ffi_new("unsigned char[?]", der_len) local buf_ptr = ffi.new("unsigned char*[1]", buf) der_len = C.i2d_ECDSA_SIG(sig, buf_ptr) if der_len <= 0 then return nil, format_error("failed to encode ECDSA signature to DER") end return ffi_str(buf, der_len) end return _M PKAN]=  "resty/openssl/auxiliary/compat.luanu[local nkeys do local pok, perr = pcall(require, "table.nkeys") if pok then nkeys = perr else nkeys = function(tbl) local cnt = 0 for _ in pairs(tbl) do cnt = cnt + 1 end return cnt end end end local noop = function() end local log_warn, log_debug local encode_base64url, decode_base64url if ngx then log_warn = function(...) ngx.log(ngx.WARN, ...) end log_debug = function(...) ngx.log(ngx.DEBUG, ...) end local b64 = require("ngx.base64") encode_base64url = b64.encode_base64url decode_base64url = b64.decode_base64url else log_warn = noop log_debug = noop local pok, basexx = pcall(require, "basexx") if pok then encode_base64url = basexx.to_url64 decode_base64url = basexx.from_url64 else encode_base64url = function() error("no base64 library is found, needs either ngx.base64 or basexx") end decode_base64url = encode_base64url end end local json do local pok, perr = pcall(require, "cjson.safe") if pok then json = perr else local pok, perr = pcall(require, "dkjson") if pok then json = perr end end if not json then json = setmetatable({}, { __index = function() return function() error("no JSON library is found, needs either cjson or dkjson") end end, }) end end return { nkeys = nkeys, log_warn = log_warn, log_debug = log_debug, encode_base64url = encode_base64url, decode_base64url = decode_base64url, json = json, }PKAN]^66resty/openssl/auxiliary/jwk.luanu[ local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local evp_macro = require "resty.openssl.include.evp" local rsa_lib = require "resty.openssl.rsa" local ec_lib = require "resty.openssl.ec" local ecx_lib = require "resty.openssl.ecx" local bn_lib = require "resty.openssl.bn" local digest_lib = require "resty.openssl.digest" local encode_base64url = require "resty.openssl.auxiliary.compat".encode_base64url local decode_base64url = require "resty.openssl.auxiliary.compat".decode_base64url local param_lib = require "resty.openssl.param" local json = require "resty.openssl.auxiliary.compat".json local ctypes = require "resty.openssl.auxiliary.ctypes" local format_error = require "resty.openssl.err".format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local _M = {} local rsa_jwk_params = {"n", "e", "d", "p", "q", "dp", "dq", "qi"} local rsa_openssl_params = rsa_lib.params local function load_jwk_rsa(tbl) if not tbl["n"] or not tbl["e"] then return nil, "at least \"n\" and \"e\" parameter is required" end local params = {} local err for i, k in ipairs(rsa_jwk_params) do local v = tbl[k] if v then v = decode_base64url(v) if not v then return nil, "cannot decode parameter \"" .. k .. "\" from base64 " .. tbl[k] end params[rsa_openssl_params[i]], err = bn_lib.from_binary(v) if err then return nil, "cannot use parameter \"" .. k .. "\": " .. err end end end local key = C.RSA_new() if key == nil then return nil, "RSA_new() failed" end local _, err = rsa_lib.set_parameters(key, params) if err ~= nil then C.RSA_free(key) return nil, err end return key end local ec_curves = { ["P-256"] = C.OBJ_ln2nid("prime256v1"), ["P-384"] = C.OBJ_ln2nid("secp384r1"), ["P-521"] = C.OBJ_ln2nid("secp521r1"), } local ec_curves_reverse = {} for k, v in pairs(ec_curves) do ec_curves_reverse[v] = k end local ec_jwk_params = {"x", "y", "d"} local function load_jwk_ec(tbl) local curve = tbl['crv'] if not curve then return nil, "\"crv\" not defined for EC key" end if not tbl["x"] or not tbl["y"] then return nil, "at least \"x\" and \"y\" parameter is required" end local curve_nid = ec_curves[curve] if not curve_nid then return nil, "curve \"" .. curve .. "\" is not supported by this library" elseif curve_nid == 0 then return nil, "curve \"" .. curve .. "\" is not supported by linked OpenSSL" end local params = {} local err for _, k in ipairs(ec_jwk_params) do local v = tbl[k] if v then v = decode_base64url(v) if not v then return nil, "cannot decode parameter \"" .. k .. "\" from base64 " .. tbl[k] end params[k], err = bn_lib.from_binary(v) if err then return nil, "cannot use parameter \"" .. k .. "\": " .. err end end end -- map to the name we expect if params["d"] then params["private"] = params["d"] params["d"] = nil end params["group"] = curve_nid local key = C.EC_KEY_new() if key == nil then return nil, "EC_KEY_new() failed" end local _, err = ec_lib.set_parameters(key, params) if err ~= nil then C.EC_KEY_free(key) return nil, err end return key end local function load_jwk_okp(key_type, tbl) local params = {} if tbl["d"] then params.private = decode_base64url(tbl["d"]) elseif tbl["x"] then params.public = decode_base64url(tbl["x"]) else return nil, "at least \"x\" or \"d\" parameter is required" end local key, err = ecx_lib.set_parameters(key_type, nil, params) if err ~= nil then return nil, err end return key end local ecx_curves_reverse = {} for k, v in pairs(evp_macro.ecx_curves) do ecx_curves_reverse[v] = k end function _M.load_jwk(txt) local tbl, err = json.decode(txt) if err then return nil, "error decoding JSON from JWK: " .. err elseif type(tbl) ~= "table" then return nil, "except input to be decoded as a table, got " .. type(tbl) end local key, key_free, key_type, err if tbl["kty"] == "RSA" then key_type = evp_macro.EVP_PKEY_RSA if key_type == 0 then return nil, "the linked OpenSSL library doesn't support RSA key" end key, err = load_jwk_rsa(tbl) key_free = C.RSA_free elseif tbl["kty"] == "EC" then key_type = evp_macro.EVP_PKEY_EC if key_type == 0 then return nil, "the linked OpenSSL library doesn't support EC key" end key, err = load_jwk_ec(tbl) key_free = C.EC_KEY_free elseif tbl["kty"] == "OKP" then local curve = tbl["crv"] key_type = evp_macro.ecx_curves[curve] if not key_type then return nil, "unknown curve \"" .. tostring(curve) elseif key_type == 0 then return nil, "the linked OpenSSL library doesn't support \"" .. curve .. "\" key" end key, err = load_jwk_okp(key_type, tbl) if key ~= nil then return key end key_free = function() end else return nil, "not yet supported jwk type \"" .. (tbl["kty"] or "nil") .. "\"" end if err then return nil, "failed to construct " .. tbl["kty"] .. " key from JWK: " .. err end local ctx = C.EVP_PKEY_new() if ctx == nil then key_free(key) return nil, "EVP_PKEY_new() failed" end local code = C.EVP_PKEY_assign(ctx, key_type, key) if code ~= 1 then key_free(key) C.EVP_PKEY_free(ctx) return nil, "EVP_PKEY_assign() failed" end return ctx end function _M.dump_jwk(pkey, is_priv) local jwk if is_priv and not pkey:is_private() then return nil, "jwk.dump_jwk: could not dump public key as private key" end if pkey.key_type == evp_macro.EVP_PKEY_RSA then local param_keys = { "n" , "e" } if is_priv then param_keys = rsa_jwk_params end local params, err = pkey:get_parameters() if err then return nil, "jwk.dump_jwk: " .. err end jwk = { kty = "RSA", } for i, p in ipairs(param_keys) do local v = params[rsa_openssl_params[i]]:to_binary() jwk[p] = encode_base64url(v) end elseif pkey.key_type == evp_macro.EVP_PKEY_EC then local params, err = pkey:get_parameters() if err then return nil, "jwk.dump_jwk: " .. err end jwk = { kty = "EC", crv = ec_curves_reverse[params.group], x = encode_base64url(params.x:to_binary()), y = encode_base64url(params.y:to_binary()), } if is_priv then jwk.d = encode_base64url(params.private:to_binary()) end elseif ecx_curves_reverse[pkey.key_type] then local params, err = pkey:get_parameters() if err then return nil, "jwk.dump_jwk: " .. err end jwk = { kty = "OKP", crv = ecx_curves_reverse[pkey.key_type], x = encode_base64url(params.public), } if is_priv then jwk.d = encode_base64url(params.private) end else return nil, "jwk.dump_jwk: not implemented for this key type" end local der = pkey:tostring(is_priv and "private" or "public", "DER") local dgst = digest_lib.new("sha256") local d, err = dgst:final(der) if err then return nil, "jwk.dump_jwk: failed to calculate digest for key" end jwk.kid = encode_base64url(d) return json.encode(jwk) end -- 3.x load_jwk local settable_schema = {} local function get_settable_schema(type, selection, properties) -- the pctx can't be reused after EVP_PKEY_fromdata_settable, so we create a new here local pctx = C.EVP_PKEY_CTX_new_from_name(nil, type, properties) if pctx == nil then return nil, "EVP_PKEY_CTX_new_from_name() failed" end ffi.gc(pctx, C.EVP_PKEY_CTX_free) if C.EVP_PKEY_fromdata_init(pctx) ~= 1 then return nil, "EVP_PKEY_fromdata_init() failed" end if settable_schema[type] then return settable_schema[type] end local settable = C.EVP_PKEY_fromdata_settable(pctx, selection) if settable == nil then return nil, "EVP_PKEY_fromdata_settable() failed" end local schema = {} param_lib.parse_params_schema(settable, schema, nil) settable_schema[type] = schema return schema end local ossl_params_jwk_mapping = { RSA = { n = "n", e = "e", d = "d", p = "rsa-factor1", q = "rsa-factor2", dp = "rsa-exponent1", dq = "rsa-exponent2", qi = "rsa-coefficient1", }, EC = { x = "x", y = "y", d = "priv", crv = "group", }, OKP = { x = "pub", d = "priv", }, } local jwk_params_required_mapping = { RSA = { n = true, e = true, }, EC = { crv = true, x = true, y = true, }, -- OKP required parameters are checked elsewhere OKP = {}, } local ec_coord_size_map = { -- JWK RFC7518 ["P-256"] = 32, ["P-384"] = 48, ["P-521"] = 66, -- rounded up to the next byte -- JOSE RFC8812 and others prime256v1 = 32, secp384r1 = 48, secp521r1 = 66, -- rounded up to the next byte brainpoolP256r1 = 32, brainpoolP320r1 = 40, brainpoolP384r1 = 48, brainpoolP512r1 = 64, -- note this is 512 not 521 secp256k1 = 32, } -- Pad coordinates to field size with leading zeros local function pad_ec_coordinate(coord, crv) local size = ec_coord_size_map[crv] if not size then return nil, "unsupported curve " .. tostring(crv) end if #coord < size then return string.rep("\x00", size - #coord) .. coord elseif #coord > size then return nil, "coordinate length " .. #coord .. " is longer than expected " .. size else return coord end end function _M.load_jwk_ex(txt, ptyp, properties) local tbl, err = json.decode(txt) if err then return nil, "jwk:load_jwk: error decoding JSON from JWK: " .. err elseif type(tbl) ~= "table" then return nil, "jwk:load_jwk: except input to be decoded as a table, got " .. type(tbl) elseif not tbl["kty"] then return nil, "jwk:load_jwk: missing \"kty\" parameter from JWK" end local kty = tbl["kty"] tbl["kty"] = nil local selection = ptyp == "pu" and evp_macro.EVP_PKEY_PUBLIC_KEY or evp_macro.EVP_PKEY_KEYPAIR local pkey_name = kty if kty == "OKP" then pkey_name = tbl["crv"] if not pkey_name then return nil, "jwk:load_jwk: missing \"crv\" parameter from OKP JWK" end tbl["crv"] = nil if not tbl["x"] and not tbl["d"] then return nil, "jwk:load_jwk: missing at least one of \"x\" or \"d\" parameter from OKP JWK" end if tbl["d"] and selection == evp_macro.EVP_PKEY_PUBLIC_KEY then -- if only 'd' is provided and we want to import a public key, first create a private key selection = evp_macro.EVP_PKEY_KEYPAIR end end local ctx = ffi.new("EVP_PKEY*[1]") local pctx = C.EVP_PKEY_CTX_new_from_name(nil, pkey_name, nil) if pctx == nil then return nil, "jwk:load_jwk: EVP_PKEY_CTX_new_from_name() failed" end ffi.gc(pctx, C.EVP_PKEY_CTX_free) if C.EVP_PKEY_fromdata_init(pctx) ~= 1 then return nil, "jwk:load_jwk: EVP_PKEY_fromdata_init() failed" end local schema, err = get_settable_schema(pkey_name, selection, properties) if not schema then return nil, "jwk:load_jwk: failed to get key schema for " .. pkey_name .. " key: " .. err end local mapping = ossl_params_jwk_mapping[kty] if not mapping then return nil, "jwk:load_jwk: not yet supported jwk type \"" .. (tbl["kty"] or "nil") .. "\"" end local required = jwk_params_required_mapping[kty] local params_t = {} for kfrom, kto in pairs(mapping) do local v = tbl[kfrom] if type(v) == "string" and (selection == evp_macro.EVP_PKEY_KEYPAIR or required[kfrom]) then if kfrom ~= "crv" then v = decode_base64url(v) if not v then return nil, "jwk:load_jwk: cannot decode parameter \"" .. kfrom .. "\" from base64 " .. tbl[kfrom] end -- reverse endian expect for OKP keys if kty ~= "OKP" or (kfrom ~= "x" and kfrom ~= "d") then v = v:reverse() end end params_t[kto] = v elseif required[kfrom] then return nil, "jwk:load_jwk: missing required parameter \"" .. kfrom .. "\"" end end if kty == "EC" then if params_t["x"] and params_t["y"] then local x = params_t["x"]:reverse() local y = params_t["y"]:reverse() x, err = pad_ec_coordinate(x, tbl["crv"]) if err then return nil, "jwk:load_jwk: pad_ec_coordinate: " .. err end y, err = pad_ec_coordinate(y, tbl["crv"]) if err then return nil, "jwk:load_jwk: pad_ec_coordinate: " .. err end params_t["pub"] = "\x04" .. x .. y params_t["x"], params_t["y"] = nil, nil end end local params, err = param_lib.construct(params_t, nil, schema) if params == nil then return nil, "jwk:load_jwk: failed to construct parameters for " .. kty .. " key: " .. err end if C.EVP_PKEY_fromdata(pctx, ctx, selection, params) ~= 1 then return nil, format_error("jwk:load_jwk: EVP_PKEY_fromdata()") end if kty == "OKP" and ptyp == "pu" and params_t["priv"] then -- re-export the pubkey local MAX_ECX_KEY_SIZE = 114 -- ed448 uses 114 bytes local buf = ctypes.uchar_array(MAX_ECX_KEY_SIZE) local length = ctypes.ptr_of_size_t(MAX_ECX_KEY_SIZE) if C.EVP_PKEY_get_raw_public_key(ctx[0], buf, length) ~= 1 then C.EVP_PKEY_free(ctx[0]) return nil, format_error("jwk:load_jwk: unable to derive public key from private key OKP JWK") end params_t["pub"] = ffi_str(buf, length[0]) C.EVP_PKEY_free(ctx[0]) ctx[0] = nil local params, err = param_lib.construct(params_t, nil, schema) if params == nil then return nil, "jwk:load_jwk: failed to construct parameters for " .. kty .. " key: " .. err end if C.EVP_PKEY_fromdata(pctx, ctx, evp_macro.EVP_PKEY_PUBLIC_KEY, params) ~= 1 then return nil, format_error("jwk:load_jwk: EVP_PKEY_fromdata()") end return ctx[0] end return ctx[0] end if OPENSSL_3X then _M.load_jwk = _M.load_jwk_ex end return _M PKAN]%connection->ssl->connection" end return ffi.cast(ssl_type, void_pp[0]) end get_req_ssl_ctx = function() local c = get_request() local ret if stream_subsystem then ret = C.ngx_stream_lua_resty_openssl_aux_get_request_ssl_ctx(c, void_pp) else ret = C.ngx_http_lua_resty_openssl_aux_get_request_ssl_ctx(c, void_pp) end if ret ~= NGX_OK then return nil, "cannot read r->connection->ssl->session_ctx" end return ffi.cast(ssl_ctx_type, void_pp[0]) end get_socket_ssl = function(sock) local u = sock[SOCKET_CTX_INDEX] local ret = get_sock_ssl(u, void_pp) if ret ~= NGX_OK then return nil, "cannot read u->peer.connection->ssl->connection" end return ffi.cast(ssl_type, void_pp[0]) end get_socket_ssl_ctx = function(sock) local u = sock[SOCKET_CTX_INDEX] local ret if stream_subsystem then ret = C.ngx_stream_lua_resty_openssl_aux_get_socket_ssl_ctx(u, void_pp) else ret = C.ngx_http_lua_resty_openssl_aux_get_socket_ssl_ctx(u, void_pp) end if ret ~= NGX_OK then return nil, "cannot read u->peer.connection->ssl->session_ctx" end return ffi.cast(ssl_ctx_type, void_pp[0]) end return { get_req_ssl = get_req_ssl, get_req_ssl_ctx = get_req_ssl_ctx, get_socket_ssl = get_socket_ssl, get_socket_ssl_ctx = get_socket_ssl_ctx, } PKAN]8resty/openssl/auxiliary/bio.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_new = ffi.new local ffi_str = ffi.string require "resty.openssl.include.bio" local format_error = require("resty.openssl.err").format_error local function read_wrap(f, ...) if type(f) ~= "cdata" then -- should be explictly a function return nil, "bio_util.read_wrap: expect a function at #1" end local bio_method = C.BIO_s_mem() if bio_method == nil then return nil, "bio_util.read_wrap: BIO_s_mem() failed" end local bio = C.BIO_new(bio_method) ffi_gc(bio, C.BIO_free) -- BIO_reset; #define BIO_CTRL_RESET 1 local code = C.BIO_ctrl(bio, 1, 0, nil) if code ~= 1 then return nil, "bio_util.read_wrap: BIO_ctrl() failed: " .. code end local code = f(bio, ...) if code ~= 1 then return nil, format_error(f, code) end local buf = ffi_new("char *[1]") -- BIO_get_mem_data; #define BIO_CTRL_INFO 3 local length = C.BIO_ctrl(bio, 3, 0, buf) return ffi_str(buf[0], length) end return { read_wrap = read_wrap, }PKAN];vz"resty/openssl/auxiliary/ctypes.luanu[-- Put common type definition at the same place for convenience -- and standarlization local ffi = require "ffi" --[[ TYPE_ptr: usually used to define a pointer (to cast or something) char* var_name; // <- we use char_ptr ptr_of_TYPE: usually used to pass the pointer of an object that is already allocated. so that we can also set value of it as well int p = 2; // ptr_of_int(); ptr_of_int[0] = 2; plus_one(&p); // <- we use ptr_of_int ]] return { void_ptr = ffi.typeof("void *"), ptr_of_uint64 = ffi.typeof("uint64_t[1]"), ptr_of_uint = ffi.typeof("unsigned int[1]"), ptr_of_size_t = ffi.typeof("size_t[1]"), ptr_of_int = ffi.typeof("int[1]"), null = ffi.new("void *"), -- hack wher ngx.null is not available uchar_array = ffi.typeof("unsigned char[?]"), uchar_ptr = ffi.typeof("unsigned char*"), SIZE_MAX = math.pow(2, 64), -- nginx set _FILE_OFFSET_BITS to 64 }PKAN]Ń))!resty/openssl/auxiliary/nginx.luanu[local get_req_ssl, get_req_ssl_ctx local get_socket_ssl, get_socket_ssl_ctx local pok, nginx_c = pcall(require, "resty.openssl.auxiliary.nginx_c") if pok and not os.getenv("CI_SKIP_NGINX_C") then get_req_ssl = nginx_c.get_req_ssl get_req_ssl_ctx = nginx_c.get_req_ssl_ctx get_socket_ssl = nginx_c.get_socket_ssl get_socket_ssl_ctx = nginx_c.get_socket_ssl else local ffi = require "ffi" ffi.cdef [[ // Nginx seems to always config _FILE_OFFSET_BITS=64, this should always be 8 byte typedef long long off_t; typedef unsigned int socklen_t; // windows uses int, same size typedef unsigned short in_port_t; typedef struct ssl_st SSL; typedef struct ssl_ctx_st SSL_CTX; typedef long (*ngx_recv_pt)(void *c, void *buf, size_t size); typedef long (*ngx_recv_chain_pt)(void *c, void *in, off_t limit); typedef long (*ngx_send_pt)(void *c, void *buf, size_t size); typedef void *(*ngx_send_chain_pt)(void *c, void *in, off_t limit); typedef struct { size_t len; void *data; } ngx_str_t; typedef struct { SSL *connection; SSL_CTX *session_ctx; // trimmed } ngx_ssl_connection_s; ]] local ngx_version = ngx.config.nginx_version local ngx_configure = ngx.config.nginx_configure() local ngx_has_http_v3 = ngx_configure and ngx_configure:find("--with-http_v3_module", 1, true) -- https://github.com/nginx/nginx/blob/master/src/core/ngx_connection.h if ngx_version == 1017008 or ngx_version == 1019003 or ngx_version == 1019009 or ngx_version == 1021004 or (not ngx_has_http_v3 and (ngx_version == 1025003 or ngx_version == 1027001)) then -- 1.17.8, 1.19.3, 1.19.9, 1.21.4, 1.25.3 ffi.cdef [[ typedef struct ngx_proxy_protocol_s ngx_proxy_protocol_t; typedef struct { void *data; void *read; void *write; int fd; ngx_recv_pt recv; ngx_send_pt send; ngx_recv_chain_pt recv_chain; ngx_send_chain_pt send_chain; void *listening; off_t sent; void *log; void *pool; int type; void *sockaddr; socklen_t socklen; ngx_str_t addr_text; // https://github.com/nginx/nginx/commit/be932e81a1531a3ba032febad968fc2006c4fa48 ngx_proxy_protocol_t *proxy_protocol; ngx_ssl_connection_s *ssl; // trimmed } ngx_connection_s; ]] elseif ngx_has_http_v3 and (ngx_version == 1025003 or ngx_version == 1027001) then -- 1.25.3 ffi.cdef [[ typedef struct ngx_proxy_protocol_s ngx_proxy_protocol_t; typedef struct ngx_quic_stream_s ngx_quic_stream_t; typedef struct { void *data; void *read; void *write; int fd; ngx_recv_pt recv; ngx_send_pt send; ngx_recv_chain_pt recv_chain; ngx_send_chain_pt send_chain; void *listening; off_t sent; void *log; void *pool; int type; void *sockaddr; socklen_t socklen; ngx_str_t addr_text; // https://github.com/nginx/nginx/commit/be932e81a1531a3ba032febad968fc2006c4fa48 ngx_proxy_protocol_t *proxy_protocol; // https://github.com/nginx/nginx/commit/b813b9ec358862a2a94868bc057420d6eca5c05d ngx_quic_stream_t *quic; ngx_ssl_connection_s *ssl; // trimmed } ngx_connection_s; ]] else error("resty.openssl.auxiliary.nginx development mode doesn't support Nginx version " .. ngx_version .. ", please compile nginx with lua-resty-openssl-aux-module or lua-kong-nginx-module.", 2) end ffi.cdef [[ typedef struct { ngx_connection_s *connection; // trimmed } ngx_stream_lua_request_s; typedef struct { unsigned int signature; /* "HTTP" */ ngx_connection_s *connection; // trimmed } ngx_http_request_s; ]] local get_request do local ok, exdata = pcall(require, "thread.exdata") if ok and exdata then function get_request() local r = exdata() if r ~= nil then return r end end else local getfenv = getfenv function get_request() return getfenv(0).__ngx_req end end end local SOCKET_CTX_INDEX = 1 local NO_C_MODULE_WARNING_MSG_SHOWN = false local NO_C_MODULE_WARNING_MSG = "note resty.openssl.auxiliary.nginx is using plain FFI " .. "and it's only intended to be used in development, " .. "consider using lua-resty-openssl-aux-module or " .. "lua-kong-nginx-module in production." local function get_ngx_ssl_from_req() if not NO_C_MODULE_WARNING_MSG_SHOWN then ngx.log(ngx.WARN, NO_C_MODULE_WARNING_MSG) NO_C_MODULE_WARNING_MSG_SHOWN = true end local c = get_request() if ngx.config.subsystem == "stream" then c = ffi.cast("ngx_stream_lua_request_s*", c) else -- http c = ffi.cast("ngx_http_request_s*", c) end local ngx_ssl = c.connection.ssl if ngx_ssl == nil then return nil, "c.connection.ssl is nil" end return ngx_ssl end get_req_ssl = function() local ssl, err = get_ngx_ssl_from_req() if err then return nil, err end return ssl.connection end get_req_ssl_ctx = function() local ssl, err = get_ngx_ssl_from_req() if err then return nil, err end return ssl.session_ctx end -- https://github.com/openresty/stream-lua-nginx-module/blob/master/src/ngx_stream_lua_socket_tcp.h ffi.cdef[[ typedef struct ngx_http_lua_socket_tcp_upstream_s ngx_http_lua_socket_tcp_upstream_t; typedef struct { ngx_connection_s *connection; // trimmed } ngx_peer_connection_s; typedef int (*ngx_http_lua_socket_tcp_retval_handler_masked)(void *r, void *u, void *L); typedef void (*ngx_http_lua_socket_tcp_upstream_handler_pt_masked) (void *r, void *u); typedef int (*ngx_stream_lua_socket_tcp_retval_handler)(void *r, void *u, void *L); typedef void (*ngx_stream_lua_socket_tcp_upstream_handler_pt) (void *r, void *u); typedef struct { ngx_stream_lua_socket_tcp_retval_handler read_prepare_retvals; ngx_stream_lua_socket_tcp_retval_handler write_prepare_retvals; ngx_stream_lua_socket_tcp_upstream_handler_pt read_event_handler; ngx_stream_lua_socket_tcp_upstream_handler_pt write_event_handler; void *socket_pool; void *conf; void *cleanup; void *request; ngx_peer_connection_s peer; // trimmed } ngx_stream_lua_socket_tcp_upstream_s; ]] local ngx_lua_version = ngx.config and ngx.config.ngx_lua_version and ngx.config.ngx_lua_version if ngx_lua_version >= 10019 and ngx_lua_version <= 10028 then -- https://github.com/openresty/lua-nginx-module/blob/master/src/ngx_http_lua_socket_tcp.h ffi.cdef[[ typedef struct { ngx_http_lua_socket_tcp_retval_handler_masked read_prepare_retvals; ngx_http_lua_socket_tcp_retval_handler_masked write_prepare_retvals; ngx_http_lua_socket_tcp_upstream_handler_pt_masked read_event_handler; ngx_http_lua_socket_tcp_upstream_handler_pt_masked write_event_handler; void *udata_queue; // 0.10.19 void *socket_pool; void *conf; void *cleanup; void *request; ngx_peer_connection_s peer; // trimmed } ngx_http_lua_socket_tcp_upstream_s; ]] elseif ngx_lua_version < 10019 then -- the struct doesn't seem to get changed a long time since birth ffi.cdef[[ typedef struct { ngx_http_lua_socket_tcp_retval_handler_masked read_prepare_retvals; ngx_http_lua_socket_tcp_retval_handler_masked write_prepare_retvals; ngx_http_lua_socket_tcp_upstream_handler_pt_masked read_event_handler; ngx_http_lua_socket_tcp_upstream_handler_pt_masked write_event_handler; void *socket_pool; void *conf; void *cleanup; void *request; ngx_peer_connection_s peer; // trimmed } ngx_http_lua_socket_tcp_upstream_s; ]] else error("resty.openssl.auxiliary.nginx doesn't support lua-nginx-module version " .. (ngx_lua_version or "nil"), 2) end local function get_ngx_ssl_from_socket_ctx(sock) if not NO_C_MODULE_WARNING_MSG_SHOWN then ngx.log(ngx.WARN, NO_C_MODULE_WARNING_MSG) NO_C_MODULE_WARNING_MSG_SHOWN = true end local u = sock[SOCKET_CTX_INDEX] if u == nil then return nil, "lua_socket_tcp_upstream_t not found" end if ngx.config.subsystem == "stream" then u = ffi.cast("ngx_stream_lua_socket_tcp_upstream_s*", u) else -- http u = ffi.cast("ngx_http_lua_socket_tcp_upstream_s*", u) end local p = u.peer if p == nil then return nil, "u.peer is nil" end local uc = p.connection if uc == nil then return nil, "u.peer.connection is nil" end local ngx_ssl = uc.ssl if ngx_ssl == nil then return nil, "u.peer.connection.ssl is nil" end return ngx_ssl end get_socket_ssl = function(sock) local ssl, err = get_ngx_ssl_from_socket_ctx(sock) if err then return nil, err end return ssl.connection end get_socket_ssl_ctx = function(sock) local ssl, err = get_ngx_ssl_from_socket_ctx(sock) if err then return nil, err end return ssl.session_ctx end end return { get_req_ssl = get_req_ssl, get_req_ssl_ctx = get_req_ssl_ctx, get_socket_ssl = get_socket_ssl, get_socket_ssl_ctx = get_socket_ssl_ctx, } PKAN]XѼl l resty/openssl/version.luanu[-- https://github.com/GUI/lua-openssl-ffi/blob/master/lib/openssl-ffi/version.lua local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local log_debug = require "resty.openssl.auxiliary.compat".log_debug local libcrypto_name local lib_patterns = { "%s", "%s.so.3", "%s.so.1.1", "%s.so.1.0" } local function load_library() for _, pattern in ipairs(lib_patterns) do -- true: load to global namespae local pok, _ = pcall(ffi.load, string.format(pattern, "crypto"), true) if pok then libcrypto_name = string.format(pattern, "crypto") ffi.load(string.format(pattern, "ssl"), true) log_debug("loaded crypto library: ", libcrypto_name) return libcrypto_name end end return false, "unable to load crypto library" end ffi.cdef[[ // >= 1.1 unsigned long OpenSSL_version_num(); const char *OpenSSL_version(int t); // >= 3.0 const char *OPENSSL_info(int t); ]] local version_func, info_func local types_table = { VERSION = 0, CFLAGS = 1, BUILT_ON = 2, PLATFORM = 3, DIR = 4, ENGINES_DIR = 5, VERSION_STRING = 6, FULL_VERSION_STRING = 7, MODULES_DIR = 8, CPU_INFO = 9, } local get_version = function() local num = C.OpenSSL_version_num() version_func = C.OpenSSL_version return num end local ok, version_num = pcall(get_version) if not ok then ok, version_num = pcall(load_library) if ok then -- try again ok, version_num = pcall(get_version) end end if not ok then error(string.format("OpenSSL has encountered an error: %s; is OpenSSL library loaded?", tostring(version_num))) elseif type(version_num) == 'number' and version_num < 0x10101000 then error(string.format("OpenSSL version %s is not supported", tostring(version_num or 0))) elseif not version_num then error("Can not get OpenSSL version") end if version_num >= 0x30000000 then local info_table = { INFO_CONFIG_DIR = 1001, INFO_ENGINES_DIR = 1002, INFO_MODULES_DIR = 1003, INFO_DSO_EXTENSION = 1004, INFO_DIR_FILENAME_SEPARATOR = 1005, INFO_LIST_SEPARATOR = 1006, INFO_SEED_SOURCE = 1007, INFO_CPU_SETTINGS = 1008, } for k, v in pairs(info_table) do types_table[k] = v end info_func = C.OPENSSL_info else info_func = function(_) error(string.format("OPENSSL_info is not supported on %s", ffi_str(version_func(0)))) end end return setmetatable({ version_num = tonumber(version_num), version_text = ffi_str(version_func(0)), version = function(t) return ffi_str(version_func(t)) end, info = function(t) return ffi_str(info_func(t)) end, -- the following has implict upper bound of 4.x OPENSSL_30 = version_num >= 0x30000000 and version_num < 0x30100000, OPENSSL_3X = version_num >= 0x30000000 and version_num < 0x40000000, OPENSSL_111 = version_num >= 0x10101000 and version_num < 0x10200000, }, { __index = types_table, }) PKAN]u%u%resty/openssl/bn.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_new = ffi.new local ffi_str = ffi.string local floor = math.floor require "resty.openssl.include.bn" local crypto_macro = require("resty.openssl.include.crypto") local ctypes = require "resty.openssl.auxiliary.ctypes" local format_error = require("resty.openssl.err").format_error local _M = {} local mt = {__index = _M} local bn_ptr_ct = ffi.typeof('BIGNUM*') local bn_ptrptr_ct = ffi.typeof('BIGNUM*[1]') local function set_binary(ctx, s) local ctx = C.BN_bin2bn(s, #s, ctx) if ctx == nil then return nil, format_error("set_binary") end return ctx end local function set_mpi(ctx, s) local ctx = C.BN_mpi2bn(s, #s, ctx) if ctx == nil then return nil, format_error("set_mpi") end return ctx end local function set_hex(ctx, s) local p = ffi_new(bn_ptrptr_ct) p[0] = ctx if C.BN_hex2bn(p, s) == 0 then return nil, format_error("set_hex") end return p[0] end local function set_dec(ctx, s) local p = ffi_new(bn_ptrptr_ct) p[0] = ctx if C.BN_dec2bn(p, s) == 0 then return nil, format_error("set_dec") end return p[0] end local function set_bn(ctx, s, base) if type(s) == 'number' then if C.BN_set_word(ctx, s) ~= 1 then return nil, format_error("set_bn") end return ctx elseif type(s) == 'string' then if not base or base == 10 then return set_dec(ctx, s) elseif base == 16 then return set_hex(ctx, s) elseif base == 2 then return set_binary(ctx, s) elseif base == 0 then return set_mpi(ctx, s) else return nil, "set_bn: unsupported base: " .. base end elseif s then return nil, "set_bn: expect nil, a number or a string at #1" end -- fall through return ctx end function _M.new(some, base) local ctx = C.BN_new() ffi_gc(ctx, C.BN_free) -- local ctx, err = set_bn(ctx, some, base) -- The above expression set ctx to a new cdata return by -- set_bn, the origin cdata would be GC at any time. local _, err = set_bn(ctx, some, base) if err then return nil, "bn.new: " .. err end return setmetatable( { ctx = ctx }, mt), nil end function _M.istype(l) return l and l.ctx and ffi.istype(bn_ptr_ct, l.ctx) end function _M.dup(ctx) if not ffi.istype(bn_ptr_ct, ctx) then return nil, "bn.dup: expect a bn ctx at #1" end local ctx = C.BN_dup(ctx) ffi_gc(ctx, C.BN_free) local self = setmetatable({ ctx = ctx, }, mt) return self end function _M:set(some, base) if not some then return nil, "expect a number or a string at #1" end local _, err = set_bn(self.ctx, some, base) if err then return nil, "bn:set: " .. err end return self end function _M:to_binary(pad) if pad then if type(pad) ~= "number" then return nil, "bn:to_binary: expect a number at #1" end end local length if not pad then length = (C.BN_num_bits(self.ctx)+7)/8 -- align to bytes length = floor(length) else length = pad end local buf = ctypes.uchar_array(length) local sz if not pad then sz = C.BN_bn2bin(self.ctx, buf) else sz = C.BN_bn2binpad(self.ctx, buf, pad) end if sz <= 0 then return nil, format_error("bn:to_binary") end return ffi_str(buf, sz) end function _M:to_mpi(no_header) local length = C.BN_bn2mpi(self.ctx, nil) if length <= 0 then return nil, format_error("bn:to_mpi") end local buf = ctypes.uchar_array(length) local sz = C.BN_bn2mpi(self.ctx, buf) if sz <= 0 then return nil, format_error("bn:to_mpi") end local ret = ffi_str(buf, sz) return no_header and ret:sub(4) or ret end function _M:to_hex() local buf = C.BN_bn2hex(self.ctx) if buf == nil then return nil, format_error("bn:to_hex") end ffi_gc(buf, crypto_macro.OPENSSL_free) local s = ffi_str(buf) return s end function _M:to_dec() local buf = C.BN_bn2dec(self.ctx) if buf == nil then return nil, format_error("bn:to_dec") end ffi_gc(buf, crypto_macro.OPENSSL_free) local s = ffi_str(buf) return s end mt.__tostring = _M.to_dec function _M:to_number() return tonumber(C.BN_get_word(self.ctx)) end _M.tonumber = _M.to_number local from_funcs = { binary = set_binary, mpi = set_mpi, hex = set_hex, dec = set_dec, } for typ, func in pairs(from_funcs) do local sig = "from_" .. typ _M[sig] = function(s) if type(s) ~= "string" then return nil, "bn." .. sig .. ": expect a string at #1" end local ctx, err = func(nil, s) if not ctx then return nil, "bn." .. sig .. ": " .. err end ffi_gc(ctx, C.BN_free) return setmetatable( { ctx = ctx }, mt), nil end end function _M.generate_prime(bits, safe) local ctx = C.BN_new() ffi_gc(ctx, C.BN_free) if C.BN_generate_prime_ex(ctx, bits, safe and 1 or 0, nil, nil, nil) == 0 then return nil, format_error("bn.BN_generate_prime_ex") end return setmetatable( { ctx = ctx }, mt), nil end -- BN_CTX is used to store temporary variable -- we only need one per worker local bn_ctx_tmp = C.BN_CTX_new() assert(bn_ctx_tmp ~= nil) ffi_gc(bn_ctx_tmp, C.BN_CTX_free) _M.bn_ctx_tmp = bn_ctx_tmp -- mathematics function mt.__unm(a) local b = _M.dup(a.ctx) if b == nil then error("BN_dup() failed") end local sign = C.BN_is_negative(b.ctx) C.BN_set_negative(b.ctx, 1-sign) return b end local function check_args(op, ...) local args = {...} for i, arg in ipairs(args) do if type(arg) == 'number' then local b = C.BN_new() if b == nil then error("BN_new() failed") end ffi_gc(b, C.BN_free) if C.BN_set_word(b, arg) ~= 1 then error("BN_set_word() failed") end args[i] = b elseif _M.istype(arg) then args[i] = arg.ctx else error("cannot " .. op .. " a " .. type(arg) .. " to bignum") end end local ctx = C.BN_new() if ctx == nil then error("BN_new() failed") end ffi_gc(ctx, C.BN_free) local r = setmetatable( { ctx = ctx }, mt) return r, unpack(args) end function mt.__add(...) local r, a, b = check_args("add", ...) if C.BN_add(r.ctx, a, b) == 0 then error("BN_add() failed") end return r end _M.add = mt.__add function mt.__sub(...) local r, a, b = check_args("substract", ...) if C.BN_sub(r.ctx, a, b) == 0 then error("BN_sub() failed") end return r end _M.sub = mt.__sub function mt.__mul(...) local r, a, b = check_args("multiply", ...) if C.BN_mul(r.ctx, a, b, bn_ctx_tmp) == 0 then error("BN_mul() failed") end return r end _M.mul = mt.__mul -- lua 5.3 only function mt.__idiv(...) local r, a, b = check_args("divide", ...) if C.BN_div(r.ctx, nil, a, b, bn_ctx_tmp) == 0 then error("BN_div() failed") end return r end mt.__div = mt.__idiv _M.idiv = mt.__idiv _M.div = mt.__div function mt.__mod(...) local r, a, b = check_args("mod", ...) if C.BN_div(nil, r.ctx, a, b, bn_ctx_tmp) == 0 then error("BN_div() failed") end return r end _M.mod = mt.__mod -- __concat doesn't make sense at all? function _M.sqr(...) local r, a = check_args("square", ...) if C.BN_sqr(r.ctx, a, bn_ctx_tmp) == 0 then error("BN_sqr() failed") end return r end function _M.gcd(...) local r, a, b = check_args("extract greatest common divisor", ...) if C.BN_gcd(r.ctx, a, b, bn_ctx_tmp) == 0 then error("BN_gcd() failed") end return r end function _M.exp(...) local r, a, b = check_args("power", ...) if C.BN_exp(r.ctx, a, b, bn_ctx_tmp) == 0 then error("BN_exp() failed") end return r end _M.pow = _M.exp for _, op in ipairs({ "add", "sub" , "mul", "exp" }) do local f = "BN_mod_" .. op local cf = C[f] _M["mod_" .. op] = function(...) local r, a, b, m = check_args(op, ...) if cf(r.ctx, a, b, m, bn_ctx_tmp) == 0 then error(f .. " failed") end return r end end function _M.mod_sqr(...) local r, a, m = check_args("mod_sub", ...) if C.BN_mod_sqr(r.ctx, a, m, bn_ctx_tmp) == 0 then error("BN_mod_sqr() failed") end return r end local function nyi() error("NYI") end -- bit operations, lua 5.3 mt.__band = nyi mt.__bor = nyi mt.__bxor = nyi mt.__bnot = nyi function mt.__shl(a, b) local r, a = check_args("lshift", a) if C.BN_lshift(r.ctx, a, b) == 0 then error("BN_lshift() failed") end return r end _M.lshift = mt.__shl function mt.__shr(a, b) local r, a = check_args("rshift", a) if C.BN_rshift(r.ctx, a, b) == 0 then error("BN_lshift() failed") end return r end _M.rshift = mt.__shr -- comparaions -- those functions are only called when the table -- has exact same metamethods, i.e. they are all BN -- so we don't need to check args function mt.__eq(a, b) return C.BN_cmp(a.ctx, b.ctx) == 0 end function mt.__lt(a, b) return C.BN_cmp(a.ctx, b.ctx) < 0 end function mt.__le(a, b) return C.BN_cmp(a.ctx, b.ctx) <= 0 end function _M:is_zero() return C.BN_is_zero(self.ctx) == 1 end function _M:is_one() return C.BN_is_one(self.ctx) == 1 end function _M:is_word(n) return C.BN_is_word(self.ctx, n) == 1 end function _M:is_odd() return C.BN_is_odd(self.ctx) == 1 end function _M:is_prime(nchecks) if nchecks and type(nchecks) ~= "number" then return nil, "bn:is_prime: expect a number at #1" end -- if nchecks is not defined, set to BN_prime_checks: -- select number of iterations based on the size of the number local code = C.BN_is_prime_ex(self.ctx, nchecks or 0, bn_ctx_tmp, nil) if code == -1 then return nil, format_error("bn.is_prime") end return code == 1 end return _M PKAN]+BB!resty/openssl/x509/extensions.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local stack_lib = require "resty.openssl.stack" local extension_lib = require "resty.openssl.x509.extension" local format_error = require("resty.openssl.err").format_error local _M = {} local stack_ptr_ct = ffi.typeof("OPENSSL_STACK*") local STACK = "X509_EXTENSION" local new = stack_lib.new_of(STACK) local add = stack_lib.add_of(STACK) local dup = stack_lib.dup_of(STACK) local mt = stack_lib.mt_of(STACK, extension_lib.dup, _M) function _M.new() local raw, err = new() if raw == nil then return nil, err end local self = setmetatable({ stack_of = STACK, ctx = raw, }, mt) return self, nil end function _M.istype(l) return l and l.ctx and ffi.istype(stack_ptr_ct, l.ctx) and l.stack_of and l.stack_of == STACK end function _M.dup(ctx) if ctx == nil or not ffi.istype(stack_ptr_ct, ctx) then return nil, "x509.extensions.dup: expect a stack ctx at #1, got " .. type(ctx) end local dup_ctx, err = dup(ctx) if dup_ctx == nil then return nil, err end return setmetatable({ stack_of = STACK, ctx = dup_ctx, -- don't let lua gc the original stack to keep its elements _dupped_from = ctx, _is_shallow_copy = true, _elem_refs = {}, _elem_refs_idx = 1, }, mt), nil end function _M:add(extension) if not extension_lib.istype(extension) then return nil, "expect a x509.extension instance at #1" end local dup = C.X509_EXTENSION_dup(extension.ctx) if dup == nil then return nil, format_error("extensions:add: X509_EXTENSION_dup") end local _, err = add(self.ctx, dup) if err then C.X509_EXTENSION_free(dup) return nil, err end -- if the stack is duplicated, the gc handler is not pop_free -- handle the gc by ourselves if self._is_shallow_copy then ffi_gc(dup, C.X509_EXTENSION_free) self._elem_refs[self._elem_refs_idx] = dup self._elem_refs_idx = self._elem_refs_idx + 1 end return true end _M.all = stack_lib.all_func(mt) _M.each = mt.__ipairs _M.index = mt.__index _M.count = mt.__len return _M PKAN]&< ,resty/openssl/x509/extension/info_access.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_cast = ffi.cast require "resty.openssl.include.x509" require "resty.openssl.include.x509v3" require "resty.openssl.include.err" local altname_lib = require "resty.openssl.x509.altname" local stack_lib = require "resty.openssl.stack" local _M = {} local authority_info_access_ptr_ct = ffi.typeof("AUTHORITY_INFO_ACCESS*") local STACK = "ACCESS_DESCRIPTION" local new = stack_lib.new_of(STACK) local add = stack_lib.add_of(STACK) local dup = stack_lib.dup_of(STACK) local aia_decode = function(ctx) local nid = C.OBJ_obj2nid(ctx.method) local gn = altname_lib.gn_decode(ctx.location) return { nid, unpack(gn) } end local mt = stack_lib.mt_of(STACK, aia_decode, _M) local mt__pairs = mt.__pairs mt.__pairs = function(tbl) local f = mt__pairs(tbl) return function() local _, e = f() if not e then return end return unpack(e) end end function _M.new() local ctx = new() if ctx == nil then return nil, "OPENSSL_sk_new_null() failed" end local cast = ffi_cast("AUTHORITY_INFO_ACCESS*", ctx) local self = setmetatable({ ctx = ctx, cast = cast, _is_shallow_copy = false, }, mt) return self, nil end function _M.istype(l) return l and l.cast and ffi.istype(authority_info_access_ptr_ct, l.cast) end function _M.dup(ctx) if ctx == nil or not ffi.istype(authority_info_access_ptr_ct, ctx) then return nil, "expect a AUTHORITY_INFO_ACCESS* ctx at #1" end local dup_ctx, err = dup(ctx) if dup_ctx == nil then return nil, err end return setmetatable({ ctx = dup_ctx, cast = ffi_cast(authority_info_access_ptr_ct, dup_ctx), -- don't let lua gc the original stack to keep its elements _dupped_from = ctx, _is_shallow_copy = true, _elem_refs = {}, _elem_refs_idx = 1, }, mt), nil end function _M:add(nid, typ, value) -- the stack element stays with stack -- we shouldn't add gc handler if it's already been -- pushed to stack. instead, rely on the gc handler -- of the stack to release all memories local ad = C.ACCESS_DESCRIPTION_new() if ad == nil then return nil, "ACCESS_DESCRIPTION_new() failed" end -- C.ASN1_OBJECT_free(ad.method) local asn1 = C.OBJ_txt2obj(nid, 0) if asn1 == nil then C.ACCESS_DESCRIPTION_free(ad) -- clean up error occurs during OBJ_txt2* C.ERR_clear_error() return nil, "invalid NID text " .. (nid or "nil") end ad.method = asn1 local err = altname_lib.gn_set(ad.location, typ, value) if err then C.ACCESS_DESCRIPTION_free(ad) return nil, err end local _, err = add(self.ctx, ad) if err then C.ACCESS_DESCRIPTION_free(ad) return nil, err end -- if the stack is duplicated, the gc handler is not pop_free -- handle the gc by ourselves if self._is_shallow_copy then ffi_gc(ad, C.ACCESS_DESCRIPTION_free) self._elem_refs[self._elem_refs_idx] = ad self._elem_refs_idx = self._elem_refs_idx + 1 end return self end _M.all = function(stack) local ret = {} local _next = mt.__ipairs(stack) while true do local i, e = _next() if i then ret[i] = e else break end end return ret end _M.each = mt.__ipairs _M.index = mt.__index _M.count = mt.__len return _M PKAN]5,resty/openssl/x509/extension/dist_points.luanu[local ffi = require "ffi" require "resty.openssl.include.x509" require "resty.openssl.include.x509v3" local altname_lib = require "resty.openssl.x509.altname" local stack_lib = require "resty.openssl.stack" local _M = {} local stack_ptr_ct = ffi.typeof("OPENSSL_STACK*") local STACK = "DIST_POINT" local new = stack_lib.new_of(STACK) local dup = stack_lib.dup_of(STACK) -- TODO: return other attributes? local cdp_decode_fullname = function(ctx) return altname_lib.dup(ctx.distpoint.name.fullname) end local mt = stack_lib.mt_of(STACK, cdp_decode_fullname, _M) function _M.new() local ctx = new() if ctx == nil then return nil, "OPENSSL_sk_new_null() failed" end local self = setmetatable({ stack_of = STACK, ctx = ctx, _is_shallow_copy = false, }, mt) return self, nil end function _M.istype(l) return l and l.ctx and ffi.istype(stack_ptr_ct, l.ctx) and l.stack_of and l.stack_of == STACK end function _M.dup(ctx) if ctx == nil or not ffi.istype(stack_ptr_ct, ctx) then return nil, "expect a stack ctx at #1" end local dup_ctx, err = dup(ctx) if dup_ctx == nil then return nil, err end return setmetatable({ stack_of = STACK, ctx = dup_ctx, -- don't let lua gc the original stack to keep its elements _dupped_from = ctx, _is_shallow_copy = true, _elem_refs = {}, _elem_refs_idx = 1, }, mt), nil end _M.all = function(stack) local ret = {} local _next = mt.__ipairs(stack) while true do local i, e = _next() if i then ret[i] = e else break end end return ret end _M.each = mt.__ipairs _M.index = mt.__index _M.count = mt.__len return _M PKAN]ª;;resty/openssl/x509/csr.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_cast = ffi.cast require "resty.openssl.include.pem" require "resty.openssl.include.x509v3" require "resty.openssl.include.x509.csr" require "resty.openssl.include.asn1" require "resty.openssl.include.stack" local stack_lib = require "resty.openssl.stack" local pkey_lib = require "resty.openssl.pkey" local digest_lib = require("resty.openssl.digest") local extension_lib = require("resty.openssl.x509.extension") local extensions_lib = require("resty.openssl.x509.extensions") local bio_util = require "resty.openssl.auxiliary.bio" local ctypes = require "resty.openssl.auxiliary.ctypes" local ctx_lib = require "resty.openssl.ctx" local txtnid2nid = require("resty.openssl.objects").txtnid2nid local find_sigid_algs = require("resty.openssl.objects").find_sigid_algs local format_error = require("resty.openssl.err").format_error local version = require("resty.openssl.version") local OPENSSL_3X = version.OPENSSL_3X local accessors = {} accessors.set_subject_name = C.X509_REQ_set_subject_name accessors.get_pubkey = C.X509_REQ_get_pubkey accessors.set_pubkey = C.X509_REQ_set_pubkey accessors.set_version = C.X509_REQ_set_version accessors.get_signature_nid = C.X509_REQ_get_signature_nid accessors.get_subject_name = C.X509_REQ_get_subject_name -- returns internal ptr accessors.get_version = C.X509_REQ_get_version local function __tostring(self, fmt) if not fmt or fmt == 'PEM' then return bio_util.read_wrap(C.PEM_write_bio_X509_REQ, self.ctx) elseif fmt == 'DER' then return bio_util.read_wrap(C.i2d_X509_REQ_bio, self.ctx) else return nil, "x509.csr:tostring: can only write PEM or DER format, not " .. fmt end end local _M = {} local mt = { __index = _M, __tostring = __tostring } local x509_req_ptr_ct = ffi.typeof("X509_REQ*") local stack_ptr_type = ffi.typeof("struct stack_st *[1]") local x509_extensions_gc = stack_lib.gc_of("X509_EXTENSION") function _M.new(csr, fmt, properties) local ctx if not csr then if OPENSSL_3X then ctx = C.X509_REQ_new_ex(ctx_lib.get_libctx(), properties) else ctx = C.X509_REQ_new() end if ctx == nil then return nil, "x509.csr.new: X509_REQ_new() failed" end elseif type(csr) == "string" then -- routine for load an existing csr local bio = C.BIO_new_mem_buf(csr, #csr) if bio == nil then return nil, format_error("x509.csr.new: BIO_new_mem_buf") end fmt = fmt or "*" while true do -- luacheck: ignore 512 -- loop is executed at most once if fmt == "PEM" or fmt == "*" then ctx = C.PEM_read_bio_X509_REQ(bio, nil, nil, nil) if ctx ~= nil then break elseif fmt == "*" then -- BIO_reset; #define BIO_CTRL_RESET 1 local code = C.BIO_ctrl(bio, 1, 0, nil) if code ~= 1 then return nil, "x509.csr.new: BIO_ctrl() failed: " .. code end end end if fmt == "DER" or fmt == "*" then ctx = C.d2i_X509_REQ_bio(bio, nil) end break end C.BIO_free(bio) if ctx == nil then return nil, format_error("x509.csr.new") end -- clear errors occur when trying C.ERR_clear_error() else return nil, "x509.csr.new: expect nil or a string at #1" end ffi_gc(ctx, C.X509_REQ_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M.istype(l) return l and l and l.ctx and ffi.istype(x509_req_ptr_ct, l.ctx) end function _M:tostring(fmt) return __tostring(self, fmt) end function _M:to_PEM() return __tostring(self, "PEM") end function _M:check_private_key(key) if not pkey_lib.istype(key) then return false, "x509.csr:check_private_key: except a pkey instance at #1" end if not key:is_private() then return false, "x509.csr:check_private_key: not a private key" end if C.X509_REQ_check_private_key(self.ctx, key.ctx) == 1 then return true end return false, format_error("x509.csr:check_private_key") end --- Get all csr extensions -- @tparam table self Instance of csr -- @treturn Extensions object function _M:get_extensions() local extensions = C.X509_REQ_get_extensions(self.ctx) -- GC handler is sk_X509_EXTENSION_pop_free ffi_gc(extensions, x509_extensions_gc) return extensions_lib.dup(extensions) end local function get_extension(ctx, nid_txt, last_pos) local nid, err = txtnid2nid(nid_txt) if err then return nil, nil, err end local extensions = C.X509_REQ_get_extensions(ctx) if extensions == nil then return nil, nil, format_error("csr.get_extension: X509_REQ_get_extensions") end ffi_gc(extensions, x509_extensions_gc) -- make 1-index array to 0-index last_pos = (last_pos or 0) -1 local ext_idx = C.X509v3_get_ext_by_NID(extensions, nid, last_pos) if ext_idx == -1 then err = ("X509v3_get_ext_by_NID extension for %d not found"):format(nid) return nil, -1, format_error(err) end local ctx = C.X509v3_get_ext(extensions, ext_idx) if ctx == nil then return nil, nil, format_error("X509v3_get_ext") end -- the extension is not duplicated when returned by X509v3_get_ext -- so we need to copy it ctx = C.X509_EXTENSION_dup(ctx) if ctx == nil then return nil, nil, "X509_EXTENSION_dup() failed" end ffi_gc(ctx, C.X509_EXTENSION_free) return ctx, ext_idx, nil end --- Get a csr extension -- @tparam table self Instance of csr -- @tparam string|number Nid number or name of the extension -- @tparam number Position to start looking for the extension; default to look from start if omitted -- @treturn Parsed extension object or nil if not found function _M:get_extension(nid_txt, last_pos) local ctx, pos, err = get_extension(self.ctx, nid_txt, last_pos) if err then return nil, nil, "x509.csr:get_extension: " .. err end local ext, err = extension_lib.dup(ctx) if err then return nil, nil, "x509.csr:get_extension: " .. err end return ext, pos+1 end local function modify_extension(replace, ctx, nid, toset, crit) local extensions_ptr = stack_ptr_type() local extension = C.X509_REQ_get_extensions(ctx) extensions_ptr[0] = extension local need_cleanup = extension ~= nil and -- extensions_ptr being nil is fine: it may just because there's no extension yet -- https://github.com/openssl/openssl/commit/2039ac07b401932fa30a05ade80b3626e189d78a -- introduces a change that a empty stack instead of NULL will be returned in no extension -- is found. so we need to double check the number if it's not NULL. C.OPENSSL_sk_num(extension) > 0 local flag if replace then -- x509v3.h: # define X509V3_ADD_REPLACE 2L flag = 0x2 else -- x509v3.h: # define X509V3_ADD_APPEND 1L flag = 0x1 end local code = C.X509V3_add1_i2d(extensions_ptr, nid, toset, crit and 1 or 0, flag) if code ~= 1 then return false, format_error("X509V3_add1_i2d", code) end -- when the stack is newly allocated, we want to cleanup the newly created stack as well -- setting the gc handler here as it's mutated in X509V3_add1_i2d if it's pointing to NULL ffi_gc(extension, x509_extensions_gc) if need_cleanup then -- cleanup old attributes -- delete the first only, why? local attr = C.X509_REQ_delete_attr(ctx, 0) if attr ~= nil then C.X509_ATTRIBUTE_free(attr) end end code = C.X509_REQ_add_extensions(ctx, extension) if code ~= 1 then return false, format_error("X509_REQ_add_extensions", code) end -- mark encoded form as invalid so next time it will be re-encoded C.i2d_re_X509_REQ_tbs(ctx, nil) return true end local function add_extension(...) return modify_extension(false, ...) end local function replace_extension(...) return modify_extension(true, ...) end function _M:add_extension(extension) if not extension_lib.istype(extension) then return false, "x509:set_extension: expect a x509.extension instance at #1" end local nid = extension:get_object().nid local toset = extension_lib.to_data(extension, nid) -- avoid tail call return as `toset.ctx` may got GC'ed early local ok, err = add_extension(self.ctx, nid, toset.ctx, extension:get_critical()) return ok, err end function _M:set_extension(extension) if not extension_lib.istype(extension) then return false, "x509:set_extension: expect a x509.extension instance at #1" end local nid = extension:get_object().nid local toset = extension_lib.to_data(extension, nid) -- avoid tail call return as `toset.ctx` may got GC'ed early local ok, err = replace_extension(self.ctx, nid, toset.ctx, extension:get_critical()) return ok, err end function _M:set_extension_critical(nid_txt, crit, last_pos) local nid, err = txtnid2nid(nid_txt) if err then return nil, "x509.csr:set_extension_critical: " .. err end local extension, _, err = get_extension(self.ctx, nid, last_pos) if err then return nil, "x509.csr:set_extension_critical: " .. err end local toset = extension_lib.to_data({ ctx = extension }, nid) -- avoid tail call return as `toset.ctx` may got GC'ed early local ok, err = replace_extension(self.ctx, nid, toset.ctx, crit and 1 or 0) return ok, err end function _M:get_extension_critical(nid_txt, last_pos) local ctx, _, err = get_extension(self.ctx, nid_txt, last_pos) if err then return nil, "x509.csr:get_extension_critical: " .. err end return C.X509_EXTENSION_get_critical(ctx) == 1 end -- START AUTO GENERATED CODE -- AUTO GENERATED function _M:sign(pkey, digest) if not pkey_lib.istype(pkey) then return false, "x509.csr:sign: expect a pkey instance at #1" end local digest_algo if digest then if not digest_lib.istype(digest) then return false, "x509.csr:sign: expect a digest instance at #2" elseif not digest.algo then return false, "x509.csr:sign: expect a digest instance to have algo member" end digest_algo = digest.algo end -- returns size of signature if success if C.X509_REQ_sign(self.ctx, pkey.ctx, digest_algo) == 0 then return false, format_error("x509.csr:sign") end return true end -- AUTO GENERATED function _M:verify(pkey) if not pkey_lib.istype(pkey) then return false, "x509.csr:verify: expect a pkey instance at #1" end local code = C.X509_REQ_verify(self.ctx, pkey.ctx) if code == 1 then return true elseif code == 0 then return false else -- typically -1 return false, format_error("x509.csr:verify", code) end end -- AUTO GENERATED function _M:get_subject_name() local got = accessors.get_subject_name(self.ctx) if got == nil then return nil end local lib = require("resty.openssl.x509.name") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED function _M:set_subject_name(toset) local lib = require("resty.openssl.x509.name") if lib.istype and not lib.istype(toset) then return false, "x509.csr:set_subject_name: expect a x509.name instance at #1" end toset = toset.ctx if accessors.set_subject_name(self.ctx, toset) == 0 then return false, format_error("x509.csr:set_subject_name") end return true end -- AUTO GENERATED function _M:get_pubkey() local got = accessors.get_pubkey(self.ctx) if got == nil then return nil end local lib = require("resty.openssl.pkey") -- returned a copied instance directly return lib.new(got) end -- AUTO GENERATED function _M:set_pubkey(toset) local lib = require("resty.openssl.pkey") if lib.istype and not lib.istype(toset) then return false, "x509.csr:set_pubkey: expect a pkey instance at #1" end toset = toset.ctx if accessors.set_pubkey(self.ctx, toset) == 0 then return false, format_error("x509.csr:set_pubkey") end return true end -- AUTO GENERATED function _M:get_version() local got = accessors.get_version(self.ctx) if got == nil then return nil end got = tonumber(got) + 1 return got end -- AUTO GENERATED function _M:set_version(toset) if type(toset) ~= "number" then return false, "x509.csr:set_version: expect a number at #1" end -- Note: this is defined by standards (X.509 et al) to be one less than the certificate version. -- So a version 3 certificate will return 2 and a version 1 certificate will return 0. toset = toset - 1 if accessors.set_version(self.ctx, toset) == 0 then return false, format_error("x509.csr:set_version") end return true end local NID_subject_alt_name = C.OBJ_sn2nid("subjectAltName") assert(NID_subject_alt_name ~= 0) -- AUTO GENERATED: EXTENSIONS function _M:get_subject_alt_name() local crit = ctypes.ptr_of_int() local extensions = C.X509_REQ_get_extensions(self.ctx) -- GC handler is sk_X509_EXTENSION_pop_free ffi_gc(extensions, x509_extensions_gc) local got = C.X509V3_get_d2i(extensions, NID_subject_alt_name, crit, nil) crit = tonumber(crit[0]) if crit == -1 then -- not found return nil elseif crit == -2 then return nil, "x509.csr:get_subject_alt_name: extension of subject_alt_name occurs more than one times, " .. "this is not yet implemented. Please use get_extension instead." elseif got == nil then return nil, format_error("x509.csr:get_subject_alt_name") end -- Note: here we only free the stack itself not elements -- since there seems no way to increase ref count for a GENERAL_NAME -- we left the elements referenced by the new-dup'ed stack local got_ref = got got = ffi_cast("GENERAL_NAMES*", got_ref) ffi_gc(got, stack_lib.gc_of("GENERAL_NAME")) local lib = require("resty.openssl.x509.altname") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED: EXTENSIONS function _M:set_subject_alt_name(toset) local lib = require("resty.openssl.x509.altname") if lib.istype and not lib.istype(toset) then return false, "x509.csr:set_subject_alt_name: expect a x509.altname instance at #1" end toset = toset.ctx -- avoid tail call return as `toset.ctx` may got GC'ed early local ok, err = replace_extension(self.ctx, NID_subject_alt_name, toset) return ok, err end -- AUTO GENERATED: EXTENSIONS function _M:set_subject_alt_name_critical(crit) return _M.set_extension_critical(self, NID_subject_alt_name, crit) end -- AUTO GENERATED: EXTENSIONS function _M:get_subject_alt_name_critical() return _M.get_extension_critical(self, NID_subject_alt_name) end -- AUTO GENERATED function _M:get_signature_nid() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509.csr:get_signature_nid") end return nid end -- AUTO GENERATED function _M:get_signature_name() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509.csr:get_signature_name") end return ffi.string(C.OBJ_nid2sn(nid)) end -- AUTO GENERATED function _M:get_signature_digest_name() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509.csr:get_signature_digest_name") end local nid = find_sigid_algs(nid) return ffi.string(C.OBJ_nid2sn(nid)) end -- END AUTO GENERATED CODE return _M PKAN]wW xresty/openssl/x509/store.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string local bor = bit.bor local x509_vfy_macro = require "resty.openssl.include.x509_vfy" local x509_lib = require "resty.openssl.x509" local chain_lib = require "resty.openssl.x509.chain" local crl_lib = require "resty.openssl.x509.crl" local ctx_lib = require "resty.openssl.ctx" local format_all_error = require("resty.openssl.err").format_all_error local format_error = require("resty.openssl.err").format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local _M = {} local mt = { __index = _M } _M.verify_flags = x509_vfy_macro.verify_flags local flag_crl_check = _M.verify_flags.X509_V_FLAG_CRL_CHECK local x509_store_ptr_ct = ffi.typeof('X509_STORE*') function _M.new() local ctx = C.X509_STORE_new() if ctx == nil then return nil, "x509.store.new: X509_STORE_new() failed" end ffi_gc(ctx, C.X509_STORE_free) local self = setmetatable({ ctx = ctx, _elem_refs = {}, _elem_refs_idx = 1, }, mt) return self, nil end function _M.istype(l) return l and l.ctx and ffi.istype(x509_store_ptr_ct, l.ctx) end function _M:use_default(properties) if x509_vfy_macro.X509_STORE_set_default_paths(self.ctx, ctx_lib.get_libctx(), properties) ~= 1 then return false, format_all_error("x509.store:use_default") end return true end function _M:add(item, skip_set_flags) local dup local err if x509_lib.istype(item) then dup = C.X509_dup(item.ctx) if dup == nil then return false, "x509.store:add: X509_dup() failed" end -- ref counter of dup is increased by 1 if C.X509_STORE_add_cert(self.ctx, dup) ~= 1 then err = format_all_error("x509.store:add: X509_STORE_add_cert") end -- decrease the dup ctx ref count immediately to make leak test happy C.X509_free(dup) elseif crl_lib.istype(item) then dup = C.X509_CRL_dup(item.ctx) if dup == nil then return false, "x509.store:add: X509_CRL_dup() failed" end -- ref counter of dup is increased by 1 if C.X509_STORE_add_crl(self.ctx, dup) ~= 1 then err = format_all_error("x509.store:add: X509_STORE_add_crl") end -- define X509_V_FLAG_CRL_CHECK 0x4 -- enables CRL checking for the certificate chain leaf certificate. -- An error occurs if a suitable CRL cannot be found. -- Note: this does not check for certificates in the chain. if not skip_set_flags and C.X509_STORE_set_flags(self.ctx, 0x4) ~= 1 then return false, format_error("x509.store:add: X509_STORE_set_flags") end -- decrease the dup ctx ref count immediately to make leak test happy C.X509_CRL_free(dup) else return false, "x509.store:add: expect an x509 or crl instance at #1" end if err then return false, err end -- X509_STORE doesn't have stack gc handler, we need to gc by ourselves self._elem_refs[self._elem_refs_idx] = dup self._elem_refs_idx = self._elem_refs_idx + 1 return true end function _M:load_file(path, properties) if type(path) ~= "string" then return false, "x509.store:load_file: expect a string at #1" else if x509_vfy_macro.X509_STORE_load_locations(self.ctx, path, nil, ctx_lib.get_libctx(), properties) ~= 1 then return false, format_all_error("x509.store:load_file") end end return true end function _M:load_directory(path, properties) if type(path) ~= "string" then return false, "x509.store:load_directory expect a string at #1" else if x509_vfy_macro.X509_STORE_load_locations(self.ctx, nil, path, ctx_lib.get_libctx(), properties) ~= 1 then return false, format_all_error("x509.store:load_directory") end end return true end function _M:set_depth(depth) depth = depth and tonumber(depth) if not depth then return nil, "x509.store:set_depth: expect a number at #1" end if C.X509_STORE_set_depth(self.ctx, depth) ~= 1 then return false, format_error("x509.store:set_depth") end return true end function _M:set_purpose(purpose) if type(purpose) ~= "string" then return nil, "x509.store:set_purpose: expect a string at #1" end local pchar = ffi.new("char[?]", #purpose + 1, purpose) local idx = C.X509_PURPOSE_get_by_sname(pchar) idx = tonumber(idx) if idx == -1 then return false, "invalid purpose \"" .. purpose .. "\"" end local purp = C.X509_PURPOSE_get0(idx) local i = C.X509_PURPOSE_get_id(purp) if C.X509_STORE_set_purpose(self.ctx, i) ~= 1 then return false, format_error("x509.store:set_purpose: X509_STORE_set_purpose") end return true end function _M:set_flags(...) local flag = 0 for _, f in ipairs({...}) do flag = bor(flag, f) end if C.X509_STORE_set_flags(self.ctx, flag) ~= 1 then return false, format_error("x509.store:set_flags: X509_STORE_set_flags") end return true end function _M:verify(x509, chain, return_chain, properties, verify_method, flags) if not x509_lib.istype(x509) then return nil, "x509.store:verify: expect a x509 instance at #1" elseif chain and not chain_lib.istype(chain) then return nil, "x509.store:verify: expect a x509.chain instance at #1" end local ctx if OPENSSL_3X then ctx = C.X509_STORE_CTX_new_ex(ctx_lib.get_libctx(), properties) else ctx = C.X509_STORE_CTX_new() end if ctx == nil then return nil, "x509.store:verify: X509_STORE_CTX_new() failed" end ffi_gc(ctx, C.X509_STORE_CTX_free) local chain_dup_ctx if chain then local chain_dup, err = chain_lib.dup(chain.ctx) if err then return nil, err end chain_dup_ctx = chain_dup.ctx end if C.X509_STORE_CTX_init(ctx, self.ctx, x509.ctx, chain_dup_ctx) ~= 1 then return nil, format_error("x509.store:verify: X509_STORE_CTX_init") end if verify_method and C.X509_STORE_CTX_set_default(ctx, verify_method) ~= 1 then return nil, "x509.store:verify: invalid verify_method \"" .. verify_method .. "\"" end if flags then C.X509_STORE_CTX_set_flags(ctx, flags) end local code = C.X509_verify_cert(ctx) if code == 1 then -- verified if not return_chain then return true, nil end local ret_chain_ctx = C.X509_STORE_CTX_get0_chain(ctx) -- returns the internal pointer, dup it and avoid tail call return -- to avoid ctx being GC'ed early local res, err = chain_lib.dup(ret_chain_ctx) return res, err elseif code == 0 then -- unverified local vfy_code = C.X509_STORE_CTX_get_error(ctx) return nil, ffi_str(C.X509_verify_cert_error_string(vfy_code)) end -- error return nil, format_error("x509.store:verify: X509_verify_cert", code) end function _M:check_revocation(verified_chain, properties) if not verified_chain or not chain_lib.istype(verified_chain) then return nil, "x509.store:check_revocation: expect a x509.chain instance at #1" end local ctx if OPENSSL_3X then ctx = C.X509_STORE_CTX_new_ex(ctx_lib.get_libctx(), properties) else ctx = C.X509_STORE_CTX_new() end if ctx == nil then return nil, "x509.store:check_revocation: X509_STORE_CTX_new() failed" end ffi_gc(ctx, C.X509_STORE_CTX_free) if C.X509_STORE_CTX_init(ctx, self.ctx, nil, nil) ~= 1 then return nil, format_error("x509.store:check_revocation: X509_STORE_CTX_init") end local verified_dup = C.X509_chain_up_ref(verified_chain.ctx) if verified_dup == nil then return nil, "x509.store:check_revocation: X509_chain_up_ref() failed" end C.X509_STORE_CTX_set0_verified_chain(ctx, verified_dup) -- enables CRL checking for the certificate chain leaf certificate. -- An error occurs if a suitable CRL cannot be found. C.X509_STORE_CTX_set_flags(ctx, flag_crl_check) local check_revocation = C.X509_STORE_CTX_get_check_revocation(ctx) local code = check_revocation(ctx) if code == 1 then -- succeess return true, nil else local vfy_code = C.X509_STORE_CTX_get_error(ctx) return nil, ffi_str(C.X509_verify_cert_error_string(vfy_code)) end end return _M PKAN] 6Ծ resty/openssl/x509/revoked.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc require "resty.openssl.include.x509.crl" require "resty.openssl.include.x509.revoked" local bn_lib = require("resty.openssl.bn") local format_error = require("resty.openssl.err").format_error local _M = {} local mt = { __index = _M } local x509_revoked_ptr_ct = ffi.typeof('X509_REVOKED*') local NID_crl_reason = C.OBJ_txt2nid("CRLReason") assert(NID_crl_reason > 0) --- Creates new instance of X509_REVOKED data -- @tparam bn|number sn Serial number as number or bn instance -- @tparam number time Revocation time -- @tparam number reason Revocation reason -- @treturn table instance of the module or nil -- @treturn[opt] string Returns optional error message in case of error function _M.new(sn, time, reason) --- only convert to bn if it is number if type(sn) == "number"then sn = bn_lib.new(sn) end if not bn_lib.istype(sn) then return nil, "x509.revoked.new: sn should be number or a bn instance" end if type(time) ~= "number" then return nil, "x509.revoked.new: expect a number at #2" end if type(reason) ~= "number" then return nil, "x509.revoked.new: expect a number at #3" end local ctx = C.X509_REVOKED_new() ffi_gc(ctx, C.X509_REVOKED_free) -- serial number local sn_asn1 = C.BN_to_ASN1_INTEGER(sn.ctx, nil) if sn_asn1 == nil then return nil, "x509.revoked.new: BN_to_ASN1_INTEGER() failed" end ffi_gc(sn_asn1, C.ASN1_INTEGER_free) if C.X509_REVOKED_set_serialNumber(ctx, sn_asn1) == 0 then return nil, format_error("x509.revoked.new: X509_REVOKED_set_serialNumber()") end -- time time = C.ASN1_TIME_set(nil, time) if time == nil then return nil, format_error("x509.revoked.new: ASN1_TIME_set()") end ffi_gc(time, C.ASN1_STRING_free) if C.X509_REVOKED_set_revocationDate(ctx, time) == 0 then return nil, format_error("x509.revoked.new: X509_REVOKED_set_revocationDate()") end -- reason local reason_asn1 = C.ASN1_ENUMERATED_new() if reason_asn1 == nil then return nil, "x509.revoked.new: ASN1_ENUMERATED_new() failed" end ffi_gc(reason_asn1, C.ASN1_ENUMERATED_free) local reason_ext = C.X509_EXTENSION_new() if reason_ext == nil then return nil, "x509.revoked.new: X509_EXTENSION_new() failed" end ffi_gc(reason_ext, C.X509_EXTENSION_free) if C.ASN1_ENUMERATED_set(reason_asn1, reason) == 0 then return nil, format_error("x509.revoked.new: ASN1_ENUMERATED_set()") end if C.X509_EXTENSION_set_data(reason_ext, reason_asn1) == 0 then return nil, format_error("x509.revoked.new: X509_EXTENSION_set_data()") end if C.X509_EXTENSION_set_object(reason_ext, C.OBJ_nid2obj(NID_crl_reason)) == 0 then return nil, format_error("x509.revoked.new: X509_EXTENSION_set_object()") end if C.X509_REVOKED_add_ext(ctx, reason_ext, 0) == 0 then return nil, format_error("x509.revoked.new: X509_EXTENSION_set_object()") end local self = setmetatable({ ctx = ctx, }, mt) return self, nil end --- Type check -- @tparam table Instance of revoked module -- @treturn boolean true if instance is instance of revoked module false otherwise function _M.istype(l) return l and l.ctx and ffi.istype(x509_revoked_ptr_ct, l.ctx) end return _M PKAN]Ӹ66resty/openssl/x509/crl.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc require "resty.openssl.include.x509.crl" require "resty.openssl.include.pem" require "resty.openssl.include.x509v3" local asn1_lib = require("resty.openssl.asn1") local bn_lib = require("resty.openssl.bn") local revoked_lib = require("resty.openssl.x509.revoked") local digest_lib = require("resty.openssl.digest") local extension_lib = require("resty.openssl.x509.extension") local pkey_lib = require("resty.openssl.pkey") local bio_util = require "resty.openssl.auxiliary.bio" local ctx_lib = require "resty.openssl.ctx" local stack_lib = require "resty.openssl.stack" local txtnid2nid = require("resty.openssl.objects").txtnid2nid local find_sigid_algs = require("resty.openssl.objects").find_sigid_algs local format_error = require("resty.openssl.err").format_error local version = require("resty.openssl.version") local OPENSSL_3X = version.OPENSSL_3X local accessors = {} accessors.set_issuer_name = C.X509_CRL_set_issuer_name accessors.set_version = C.X509_CRL_set_version accessors.get_last_update = C.X509_CRL_get0_lastUpdate accessors.set_last_update = C.X509_CRL_set1_lastUpdate accessors.get_next_update = C.X509_CRL_get0_nextUpdate accessors.set_next_update = C.X509_CRL_set1_nextUpdate accessors.get_version = C.X509_CRL_get_version accessors.get_issuer_name = C.X509_CRL_get_issuer -- returns internal ptr accessors.get_signature_nid = C.X509_CRL_get_signature_nid accessors.get_revoked = C.X509_CRL_get_REVOKED local function __tostring(self, fmt) if not fmt or fmt == 'PEM' then return bio_util.read_wrap(C.PEM_write_bio_X509_CRL, self.ctx) elseif fmt == 'DER' then return bio_util.read_wrap(C.i2d_X509_CRL_bio, self.ctx) else return nil, "x509.crl:tostring: can only write PEM or DER format, not " .. fmt end end local _M = {} local mt = { __index = _M, __tostring = __tostring } local x509_crl_ptr_ct = ffi.typeof("X509_CRL*") function _M.new(crl, fmt, properties) local ctx if not crl then if OPENSSL_3X then ctx = C.X509_CRL_new_ex(ctx_lib.get_libctx(), properties) else ctx = C.X509_CRL_new() end if ctx == nil then return nil, "x509.crl.new: X509_CRL_new() failed" end elseif type(crl) == "string" then -- routine for load an existing csr local bio = C.BIO_new_mem_buf(crl, #crl) if bio == nil then return nil, format_error("x509.crl.new: BIO_new_mem_buf") end fmt = fmt or "*" while true do -- luacheck: ignore 512 -- loop is executed at most once if fmt == "PEM" or fmt == "*" then ctx = C.PEM_read_bio_X509_CRL(bio, nil, nil, nil) if ctx ~= nil then break elseif fmt == "*" then -- BIO_reset; #define BIO_CTRL_RESET 1 local code = C.BIO_ctrl(bio, 1, 0, nil) if code ~= 1 then return nil, "x509.crl.new: BIO_ctrl() failed: " .. code end end end if fmt == "DER" or fmt == "*" then ctx = C.d2i_X509_CRL_bio(bio, nil) end break end C.BIO_free(bio) if ctx == nil then return nil, format_error("x509.crl.new") end -- clear errors occur when trying C.ERR_clear_error() else return nil, "x509.crl.new: expect nil or a string at #1" end ffi_gc(ctx, C.X509_CRL_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M.istype(l) return l and l and l.ctx and ffi.istype(x509_crl_ptr_ct, l.ctx) end function _M.dup(ctx) if not ffi.istype(x509_crl_ptr_ct, ctx) then return nil, "x509.crl.dup: expect a x509.crl ctx at #1" end local ctx = C.X509_CRL_dup(ctx) if ctx == nil then return nil, "x509.crl.dup: X509_CRL_dup() failed" end ffi_gc(ctx, C.X509_CRL_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M:tostring(fmt) return __tostring(self, fmt) end function _M:to_PEM() return __tostring(self, "PEM") end function _M:text() return bio_util.read_wrap(C.X509_CRL_print, self.ctx) end local function revoked_decode(ctx) local ret = {} local serial = C.X509_REVOKED_get0_serialNumber(ctx) if serial ~= nil then serial = C.ASN1_INTEGER_to_BN(serial, nil) if serial == nil then error("x509.crl:revoked_decode: ASN1_INTEGER_to_BN() failed") end ffi_gc(serial, C.BN_free) ret["serial_number"] = bn_lib.to_hex({ctx = serial}) end local date = C.X509_REVOKED_get0_revocationDate(ctx) if date ~= nil then date = asn1_lib.asn1_to_unix(date) ret["revocation_date"] = date end return ret end local revoked_mt = stack_lib.mt_of("X509_REVOKED", revoked_decode, _M) local function nil_iter() return nil end local function revoked_iter(self) local stack = accessors.get_revoked(self.ctx) if stack == nil then return nil_iter end return revoked_mt.__ipairs({ctx = stack}) end mt.__pairs = revoked_iter mt.__ipairs = revoked_iter mt.__index = function(self, k) local i = tonumber(k) if not i then return _M[k] end local stack = accessors.get_revoked(self.ctx) if stack == nil then return nil end return revoked_mt.__index({ctx = stack}, i) end mt.__len = function(self) local stack = accessors.get_revoked(self.ctx) if stack == nil then return 0 end return revoked_mt.__len({ctx = stack}) end _M.all = function(self) local ret = {} local _next = mt.__pairs(self) while true do local k, v = _next() if k then ret[k] = v else break end end return ret end _M.each = mt.__pairs _M.index = mt.__index _M.count = mt.__len --- Adds revoked item to stack of revoked certificates of crl -- @tparam table Instance of crl module -- @tparam table Instance of revoked module -- @treturn boolean true if revoked item was successfully added or false otherwise -- @treturn[opt] string Returns optional error message in case of error function _M:add_revoked(revoked) if not revoked_lib.istype(revoked) then return false, "x509.crl:add_revoked: expect a revoked instance at #1" end local ctx = C.X509_REVOKED_dup(revoked.ctx) if ctx == nil then return nil, "x509.crl:add_revoked: X509_REVOKED_dup() failed" end if C.X509_CRL_add0_revoked(self.ctx, ctx) == 0 then return false, format_error("x509.crl:add_revoked") end return true end local ptr_ptr_of_x509_revoked = ffi.typeof("X509_REVOKED*[1]") function _M:get_by_serial(sn) local bn, err if bn_lib.istype(sn) then bn = sn elseif type(sn) == "string" then bn, err = bn_lib.from_hex(sn) if err then return nil, "x509.crl:find: can't decode bn: " .. err end else return nil, "x509.crl:find: expect a bn instance at #1" end local sn_asn1 = C.BN_to_ASN1_INTEGER(bn.ctx, nil) if sn_asn1 == nil then return nil, "x509.crl:find: BN_to_ASN1_INTEGER() failed" end ffi_gc(sn_asn1, C.ASN1_INTEGER_free) local pp = ptr_ptr_of_x509_revoked() local code = C.X509_CRL_get0_by_serial(self.ctx, pp, sn_asn1) if code == 1 then return revoked_decode(pp[0]) elseif code == 2 then return nil, "not revoked (removeFromCRL)" end -- 0 or other return nil end -- START AUTO GENERATED CODE -- AUTO GENERATED function _M:sign(pkey, digest) if not pkey_lib.istype(pkey) then return false, "x509.crl:sign: expect a pkey instance at #1" end local digest_algo if digest then if not digest_lib.istype(digest) then return false, "x509.crl:sign: expect a digest instance at #2" elseif not digest.algo then return false, "x509.crl:sign: expect a digest instance to have algo member" end digest_algo = digest.algo end -- returns size of signature if success if C.X509_CRL_sign(self.ctx, pkey.ctx, digest_algo) == 0 then return false, format_error("x509.crl:sign") end return true end -- AUTO GENERATED function _M:verify(pkey) if not pkey_lib.istype(pkey) then return false, "x509.crl:verify: expect a pkey instance at #1" end local code = C.X509_CRL_verify(self.ctx, pkey.ctx) if code == 1 then return true elseif code == 0 then return false else -- typically -1 return false, format_error("x509.crl:verify", code) end end -- AUTO GENERATED local function get_extension(ctx, nid_txt, last_pos) last_pos = (last_pos or 0) - 1 local nid, err = txtnid2nid(nid_txt) if err then return nil, nil, err end local pos = C.X509_CRL_get_ext_by_NID(ctx, nid, last_pos) if pos == -1 then return nil end local ctx = C.X509_CRL_get_ext(ctx, pos) if ctx == nil then return nil, nil, format_error() end return ctx, pos end -- AUTO GENERATED function _M:add_extension(extension) if not extension_lib.istype(extension) then return false, "x509.crl:add_extension: expect a x509.extension instance at #1" end -- X509_CRL_add_ext returnes the stack on success, and NULL on error -- the X509_EXTENSION ctx is dupped internally if C.X509_CRL_add_ext(self.ctx, extension.ctx, -1) == nil then return false, format_error("x509.crl:add_extension") end return true end -- AUTO GENERATED function _M:get_extension(nid_txt, last_pos) local ctx, pos, err = get_extension(self.ctx, nid_txt, last_pos) if err then return nil, nil, "x509.crl:get_extension: " .. err end local ext, err = extension_lib.dup(ctx) if err then return nil, nil, "x509.crl:get_extension: " .. err end return ext, pos+1 end -- AUTO GENERATED function _M:set_extension(extension, last_pos) if not extension_lib.istype(extension) then return false, "x509.crl:set_extension: expect a x509.extension instance at #1" end last_pos = (last_pos or 0) - 1 local nid = extension:get_object().nid local pos = C.X509_CRL_get_ext_by_NID(self.ctx, nid, last_pos) -- pos may be -1, which means not found, it's fine, we will add new one instead of replace local removed = C.X509_CRL_delete_ext(self.ctx, pos) C.X509_EXTENSION_free(removed) if C.X509_CRL_add_ext(self.ctx, extension.ctx, pos) == nil then return false, format_error("x509.crl:set_extension") end return true end -- AUTO GENERATED function _M:set_extension_critical(nid_txt, crit, last_pos) local ctx, _, err = get_extension(self.ctx, nid_txt, last_pos) if err then return nil, "x509.crl:set_extension_critical: " .. err end if C.X509_EXTENSION_set_critical(ctx, crit and 1 or 0) ~= 1 then return false, format_error("x509.crl:set_extension_critical") end return true end -- AUTO GENERATED function _M:get_extension_critical(nid_txt, last_pos) local ctx, _, err = get_extension(self.ctx, nid_txt, last_pos) if err then return nil, "x509.crl:get_extension_critical: " .. err end return C.X509_EXTENSION_get_critical(ctx) == 1 end -- AUTO GENERATED function _M:get_issuer_name() local got = accessors.get_issuer_name(self.ctx) if got == nil then return nil end local lib = require("resty.openssl.x509.name") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED function _M:set_issuer_name(toset) local lib = require("resty.openssl.x509.name") if lib.istype and not lib.istype(toset) then return false, "x509.crl:set_issuer_name: expect a x509.name instance at #1" end toset = toset.ctx if accessors.set_issuer_name(self.ctx, toset) == 0 then return false, format_error("x509.crl:set_issuer_name") end return true end -- AUTO GENERATED function _M:get_last_update() local got = accessors.get_last_update(self.ctx) if got == nil then return nil end got = asn1_lib.asn1_to_unix(got) return got end -- AUTO GENERATED function _M:set_last_update(toset) if type(toset) ~= "number" then return false, "x509.crl:set_last_update: expect a number at #1" end toset = C.ASN1_TIME_set(nil, toset) ffi_gc(toset, C.ASN1_STRING_free) if accessors.set_last_update(self.ctx, toset) == 0 then return false, format_error("x509.crl:set_last_update") end return true end -- AUTO GENERATED function _M:get_next_update() local got = accessors.get_next_update(self.ctx) if got == nil then return nil end got = asn1_lib.asn1_to_unix(got) return got end -- AUTO GENERATED function _M:set_next_update(toset) if type(toset) ~= "number" then return false, "x509.crl:set_next_update: expect a number at #1" end toset = C.ASN1_TIME_set(nil, toset) ffi_gc(toset, C.ASN1_STRING_free) if accessors.set_next_update(self.ctx, toset) == 0 then return false, format_error("x509.crl:set_next_update") end return true end -- AUTO GENERATED function _M:get_version() local got = accessors.get_version(self.ctx) if got == nil then return nil end got = tonumber(got) + 1 return got end -- AUTO GENERATED function _M:set_version(toset) if type(toset) ~= "number" then return false, "x509.crl:set_version: expect a number at #1" end -- Note: this is defined by standards (X.509 et al) to be one less than the certificate version. -- So a version 3 certificate will return 2 and a version 1 certificate will return 0. toset = toset - 1 if accessors.set_version(self.ctx, toset) == 0 then return false, format_error("x509.crl:set_version") end return true end -- AUTO GENERATED function _M:get_signature_nid() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509.crl:get_signature_nid") end return nid end -- AUTO GENERATED function _M:get_signature_name() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509.crl:get_signature_name") end return ffi.string(C.OBJ_nid2sn(nid)) end -- AUTO GENERATED function _M:get_signature_digest_name() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509.crl:get_signature_digest_name") end local nid = find_sigid_algs(nid) return ffi.string(C.OBJ_nid2sn(nid)) end -- END AUTO GENERATED CODE return _M PKAN]^G9 resty/openssl/x509/extension.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_new = ffi.new local ffi_cast = ffi.cast local ffi_str = ffi.string require "resty.openssl.include.x509" require "resty.openssl.include.x509.extension" require "resty.openssl.include.x509v3" require "resty.openssl.include.bio" require "resty.openssl.include.conf" local asn1_macro = require("resty.openssl.include.asn1") local objects_lib = require "resty.openssl.objects" local stack_lib = require("resty.openssl.stack") local bio_util = require "resty.openssl.auxiliary.bio" local format_error = require("resty.openssl.err").format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local _M = {} local mt = { __index = _M } local x509_extension_ptr_ct = ffi.typeof("X509_EXTENSION*") local extension_types = { issuer = "resty.openssl.x509", subject = "resty.openssl.x509", request = "resty.openssl.x509.csr", crl = "resty.openssl.x509.crl", } if OPENSSL_3X then extension_types["issuer_pkey"] = "resty.openssl.pkey" end local nconf_load = function(conf, str) local bio = C.BIO_new_mem_buf(str, #str) if bio == nil then return format_error("BIO_new_mem_buf") end ffi_gc(bio, C.BIO_free) if C.NCONF_load_bio(conf, bio, nil) ~= 1 then return format_error("NCONF_load_bio") end end function _M.new(txtnid, value, data) local nid, err = objects_lib.txtnid2nid(txtnid) if err then return nil, "x509.extension.new: " .. err end if type(value) ~= 'string' then return nil, "x509.extension.new: expect string at #2" end -- get a ptr and also zerofill the struct local x509_ctx_ptr = ffi_new('X509V3_CTX[1]') local conf = C.NCONF_new(nil) if conf == nil then return nil, format_error("NCONF_new") end ffi_gc(conf, C.NCONF_free) if type(data) == 'table' then local args = {} if data.db then if type(data.db) ~= 'string' then return nil, "x509.extension.new: expect data.db must be a string" end err = nconf_load(conf, data) if err then return nil, "x509.extension.new: " .. err end end for k, t in pairs(extension_types) do if data[k] then local lib = require(t) if not lib.istype(data[k]) then return nil, "x509.extension.new: expect data." .. k .. " to be a " .. t .. " instance" end args[k] = data[k].ctx end end C.X509V3_set_ctx(x509_ctx_ptr[0], args.issuer, args.subject, args.request, args.crl, 0) if OPENSSL_3X and args.issuer_pkey then if C.X509V3_set_issuer_pkey(x509_ctx_ptr[0], args.issuer_pkey) ~= 1 then return nil, format_error("x509.extension.new: X509V3_set_issuer_pkey") end end elseif type(data) == 'string' then err = nconf_load(conf, data) if err then return nil, "x509.extension.new: " .. err end elseif data then return nil, "x509.extension.new: expect nil, string a table at #3" end -- setting conf is required for some extensions to load -- crypto/x509/v3_conf.c:do_ext_conf "else if (method->r2i) {" branch C.X509V3_set_nconf(x509_ctx_ptr[0], conf) local ctx = C.X509V3_EXT_nconf_nid(conf, x509_ctx_ptr[0], nid, value) if ctx == nil then return nil, format_error("x509.extension.new") end ffi_gc(ctx, C.X509_EXTENSION_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M.istype(l) return l and l.ctx and ffi.istype(x509_extension_ptr_ct, l.ctx) end function _M.dup(ctx) if not ffi.istype(x509_extension_ptr_ct, ctx) then return nil, "x509.extension.dup: expect a x509.extension ctx at #1" end local ctx = C.X509_EXTENSION_dup(ctx) if ctx == nil then return nil, "x509.extension.dup: X509_EXTENSION_dup() failed" end ffi_gc(ctx, C.X509_EXTENSION_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M.from_der(value, txtnid, crit) local nid, err = objects_lib.txtnid2nid(txtnid) if err then return nil, "x509.extension.from_der: " .. err end if type(value) ~= 'string' then return nil, "x509.extension.from_der: expect string at #1" end local asn1 = C.ASN1_STRING_new() if asn1 == nil then return nil, format_error("x509.extension.from_der: ASN1_STRING_new") end ffi_gc(asn1, C.ASN1_STRING_free) if C.ASN1_STRING_set(asn1, value, #value) ~= 1 then return nil, format_error("x509.extension.from_der: ASN1_STRING_set") end local ctx = C.X509_EXTENSION_create_by_NID(nil, nid, crit and 1 or 0, asn1) if ctx == nil then return nil, format_error("x509.extension.from_der: X509_EXTENSION_create_by_NID") end ffi_gc(ctx, C.X509_EXTENSION_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M:to_der() local asn1 = C.X509_EXTENSION_get_data(self.ctx) return ffi_str(asn1_macro.ASN1_STRING_get0_data(asn1)) end function _M.from_data(any, txtnid, crit) local nid, err = objects_lib.txtnid2nid(txtnid) if err then return nil, "x509.extension.from_der: " .. err end if type(any) ~= "table" or type(any.ctx) ~= "cdata" then return nil, "x509.extension.from_data: expect a table with ctx at #1" elseif type(nid) ~= "number" then return nil, "x509.extension.from_data: expect a table at #2" end local ctx = C.X509V3_EXT_i2d(nid, crit and 1 or 0, any.ctx) if ctx == nil then return nil, format_error("x509.extension.from_data: X509V3_EXT_i2d") end ffi_gc(ctx, C.X509_EXTENSION_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end local NID_subject_alt_name = C.OBJ_sn2nid("subjectAltName") assert(NID_subject_alt_name ~= 0) local sk_GENERAL_NAME_free = stack_lib.gc_of("GENERAL_NAME") function _M.to_data(extension, nid) if not _M.istype(extension) then return nil, "x509.extension.dup: expect a x509.extension ctx at #1" elseif type(nid) ~= "number" then return nil, "x509.extension.to_data: expect a table at #2" end local void_ptr = C.X509V3_EXT_d2i(extension.ctx) if void_ptr == nil then return nil, format_error("x509.extension:to_data: X509V3_EXT_d2i") end if nid == NID_subject_alt_name then -- Note: here we only free the stack itself not elements -- since there seems no way to increase ref count for a GENERAL_NAME -- we left the elements referenced by the new-dup'ed stack local got = ffi_cast("GENERAL_NAMES*", void_ptr) ffi_gc(got, sk_GENERAL_NAME_free) local lib = require("resty.openssl.x509.altname") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end return nil, string.format("x509.extension:to_data: don't know how to convert to NID %d", nid) end function _M:get_object() -- retruns the internal pointer local asn1 = C.X509_EXTENSION_get_object(self.ctx) return objects_lib.obj2table(asn1) end function _M:get_critical() return C.X509_EXTENSION_get_critical(self.ctx) == 1 end function _M:set_critical(crit) if C.X509_EXTENSION_set_critical(self.ctx, crit and 1 or 0) ~= 1 then return false, format_error("x509.extension:set_critical") end return true end function _M:tostring() local ret, err = bio_util.read_wrap(C.X509V3_EXT_print, self.ctx, 0, 0) if not err then return ret end -- fallback to ASN.1 print local asn1 = C.X509_EXTENSION_get_data(self.ctx) return bio_util.read_wrap(C.ASN1_STRING_print, asn1) end _M.text = _M.tostring mt.__tostring = function(tbl) local txt, err = _M.text(tbl) if err then error(err) end return txt end return _M PKAN](. . resty/openssl/x509/name.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string require "resty.openssl.include.x509.name" require "resty.openssl.include.err" local objects_lib = require "resty.openssl.objects" local asn1_macro = require "resty.openssl.include.asn1" -- local MBSTRING_FLAG = 0x1000 local MBSTRING_ASC = 0x1001 -- (MBSTRING_FLAG|1) local _M = {} local x509_name_ptr_ct = ffi.typeof("X509_NAME*") -- starts from 0 local function value_at(ctx, i) local entry = C.X509_NAME_get_entry(ctx, i) local obj = C.X509_NAME_ENTRY_get_object(entry) local ret = objects_lib.obj2table(obj) local str = C.X509_NAME_ENTRY_get_data(entry) if str ~= nil then ret.blob = ffi_str(asn1_macro.ASN1_STRING_get0_data(str)) end return ret end local function iter(tbl) local i = 0 local n = tonumber(C.X509_NAME_entry_count(tbl.ctx)) return function() i = i + 1 if i <= n then local obj = value_at(tbl.ctx, i-1) return obj.sn or obj.ln or obj.id, obj end end end local mt = { __index = _M, __pairs = iter, __len = function(tbl) return tonumber(C.X509_NAME_entry_count(tbl.ctx)) end, } function _M.new() local ctx = C.X509_NAME_new() if ctx == nil then return nil, "x509.name.new: X509_NAME_new() failed" end ffi_gc(ctx, C.X509_NAME_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M.istype(l) return l and l.ctx and ffi.istype(x509_name_ptr_ct, l.ctx) end function _M.dup(ctx) if not ffi.istype(x509_name_ptr_ct, ctx) then return nil, "x509.name.dup: expect a x509.name ctx at #1, got " .. type(ctx) end local ctx = C.X509_NAME_dup(ctx) ffi_gc(ctx, C.X509_NAME_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M:add(nid, txt) local asn1 = C.OBJ_txt2obj(nid, 0) if asn1 == nil then -- clean up error occurs during OBJ_txt2* C.ERR_clear_error() return nil, "x509.name:add: invalid NID text " .. (nid or "nil") end local code = C.X509_NAME_add_entry_by_OBJ(self.ctx, asn1, MBSTRING_ASC, txt, #txt, -1, 0) C.ASN1_OBJECT_free(asn1) if code ~= 1 then return nil, "x509.name:add: X509_NAME_add_entry_by_OBJ() failed" end return self end function _M:find(nid, last_pos) local asn1 = C.OBJ_txt2obj(nid, 0) if asn1 == nil then -- clean up error occurs during OBJ_txt2* C.ERR_clear_error() return nil, nil, "x509.name:find: invalid NID text " .. (nid or "nil") end -- make 1-index array to 0-index last_pos = (last_pos or 0) - 1 local pos = C.X509_NAME_get_index_by_OBJ(self.ctx, asn1, last_pos) if pos == -1 then return nil end C.ASN1_OBJECT_free(asn1) return value_at(self.ctx, pos), pos+1 end -- fallback function to iterate if LUAJIT_ENABLE_LUA52COMPAT not enabled function _M:all() local ret = {} local _next = iter(self) while true do local k, obj = _next() if obj then ret[k] = obj else break end end return ret end function _M:each() return iter(self) end mt.__tostring = function(self) local values = {} local _next = iter(self) while true do local k, v = _next() if k then table.insert(values, k .. "=" .. v.blob) else break end end table.sort(values) return table.concat(values, "/") end _M.tostring = mt.__tostring return _M PKAN]h qqresty/openssl/x509/init.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string local ffi_cast = ffi.cast require "resty.openssl.include.x509" require "resty.openssl.include.x509v3" require "resty.openssl.include.evp" require "resty.openssl.include.objects" require "resty.openssl.include.stack" local stack_lib = require("resty.openssl.stack") local asn1_lib = require("resty.openssl.asn1") local digest_lib = require("resty.openssl.digest") local extension_lib = require("resty.openssl.x509.extension") local pkey_lib = require("resty.openssl.pkey") local bio_util = require "resty.openssl.auxiliary.bio" local txtnid2nid = require("resty.openssl.objects").txtnid2nid local find_sigid_algs = require("resty.openssl.objects").find_sigid_algs local ctypes = require "resty.openssl.auxiliary.ctypes" local ctx_lib = require "resty.openssl.ctx" local format_error = require("resty.openssl.err").format_error local version = require("resty.openssl.version") local OPENSSL_3X = version.OPENSSL_3X -- accessors provides an openssl version neutral interface to lua layer -- it doesn't handle any error, expect that to be implemented in -- _M.set_X or _M.get_X local accessors = {} accessors.get_pubkey = C.X509_get_pubkey -- returns new evp_pkey instance, don't need to dup accessors.set_pubkey = C.X509_set_pubkey accessors.set_version = C.X509_set_version accessors.set_serial_number = C.X509_set_serialNumber accessors.get_subject_name = C.X509_get_subject_name -- returns internal ptr, we dup it accessors.set_subject_name = C.X509_set_subject_name accessors.get_issuer_name = C.X509_get_issuer_name -- returns internal ptr, we dup it accessors.set_issuer_name = C.X509_set_issuer_name accessors.get_signature_nid = C.X509_get_signature_nid -- generally, use get1 if we return a lua table wrapped ctx which doesn't support dup. -- in that case, a new struct is returned from C api, and we will handle gc. -- openssl will increment the reference count for returned ptr, and won't free it when -- parent struct is freed. -- otherwise, use get0, which returns an internal pointer, we don't need to free it up. -- it will be gone together with the parent struct. accessors.get_not_before = C.X509_get0_notBefore -- returns internal ptr, we convert to number accessors.set_not_before = C.X509_set1_notBefore accessors.get_not_after = C.X509_get0_notAfter -- returns internal ptr, we convert to number accessors.set_not_after = C.X509_set1_notAfter accessors.get_version = C.X509_get_version -- returns int accessors.get_serial_number = C.X509_get0_serialNumber -- returns internal ptr, we convert to bn local function __tostring(self, fmt) if not fmt or fmt == 'PEM' then return bio_util.read_wrap(C.PEM_write_bio_X509, self.ctx) elseif fmt == 'DER' then return bio_util.read_wrap(C.i2d_X509_bio, self.ctx) else return nil, "x509:tostring: can only write PEM or DER format, not " .. fmt end end local _M = {} local mt = { __index = _M, __tostring = __tostring } local x509_ptr_ct = ffi.typeof("X509*") -- only PEM format is supported for now function _M.new(cert, fmt, properties) local ctx if not cert then -- routine for create a new cert if OPENSSL_3X then ctx = C.X509_new_ex(ctx_lib.get_libctx(), properties) else ctx = C.X509_new() end if ctx == nil then return nil, format_error("x509.new") end ffi_gc(ctx, C.X509_free) C.X509_gmtime_adj(accessors.get_not_before(ctx), 0) C.X509_gmtime_adj(accessors.get_not_after(ctx), 0) elseif type(cert) == "string" then -- routine for load an existing cert local bio = C.BIO_new_mem_buf(cert, #cert) if bio == nil then return nil, format_error("x509.new: BIO_new_mem_buf") end fmt = fmt or "*" while true do -- luacheck: ignore 512 -- loop is executed at most once if fmt == "PEM" or fmt == "*" then ctx = C.PEM_read_bio_X509(bio, nil, nil, nil) if ctx ~= nil then break elseif fmt == "*" then -- BIO_reset; #define BIO_CTRL_RESET 1 local code = C.BIO_ctrl(bio, 1, 0, nil) if code ~= 1 then C.BIO_free(bio) return nil, "x509.new: BIO_ctrl() failed: " .. code end end end if fmt == "DER" or fmt == "*" then ctx = C.d2i_X509_bio(bio, nil) end break end C.BIO_free(bio) if ctx == nil then return nil, format_error("x509.new") end -- clear errors occur when trying C.ERR_clear_error() ffi_gc(ctx, C.X509_free) elseif type(cert) == 'cdata' then if ffi.istype(x509_ptr_ct, cert) then ctx = cert ffi_gc(ctx, C.X509_free) else return nil, "x509.new: expect a X509* cdata at #1" end else return nil, "x509.new: expect nil or a string at #1" end local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M.istype(l) return l and l.ctx and ffi.istype(x509_ptr_ct, l.ctx) end function _M.dup(ctx) if not ffi.istype(x509_ptr_ct, ctx) then return nil, "x509.dup: expect a x509 ctx at #1" end local ctx = C.X509_dup(ctx) if ctx == nil then return nil, "x509.dup: X509_dup() failed" end ffi_gc(ctx, C.X509_free) local self = setmetatable({ ctx = ctx, }, mt) return self, nil end function _M:tostring(fmt) return __tostring(self, fmt) end function _M:to_PEM() return __tostring(self, "PEM") end function _M:set_lifetime(not_before, not_after) local ok, err if not_before then ok, err = self:set_not_before(not_before) if err then return ok, err end end if not_after then ok, err = self:set_not_after(not_after) if err then return ok, err end end return true end function _M:get_lifetime() local not_before, err = self:get_not_before() if not_before == nil then return nil, nil, err end local not_after, err = self:get_not_after() if not_after == nil then return nil, nil, err end return not_before, not_after, nil end -- note: index is 0 based local OPENSSL_STRING_value_at = function(ctx, i) local ct = ffi_cast("OPENSSL_STRING", C.OPENSSL_sk_value(ctx, i)) if ct == nil then return nil end return ffi_str(ct) end function _M:get_ocsp_url(return_all) local st = C.X509_get1_ocsp(self.ctx) local count = C.OPENSSL_sk_num(st) if count == 0 then return end local ret if return_all then ret = {} for i=0,count-1 do ret[i+1] = OPENSSL_STRING_value_at(st, i) end else ret = OPENSSL_STRING_value_at(st, 0) end C.X509_email_free(st) return ret end function _M:get_ocsp_request() end function _M:get_crl_url(return_all) local cdp, err = self:get_crl_distribution_points() if err then return nil, err end if not cdp or cdp:count() == 0 then return end if return_all then local ret = {} local cdp_iter = cdp:each() while true do local _, gn = cdp_iter() if not gn then break end local gn_iter = gn:each() while true do local k, v = gn_iter() if not k then break elseif k == "URI" then table.insert(ret, v) end end end return ret else local gn, err = cdp:index(1) if err then return nil, err end local iter = gn:each() while true do local k, v = iter() if not k then break elseif k == "URI" then return v end end end end local digest_length = ctypes.ptr_of_uint() local digest_buf, digest_buf_size local function digest(self, cfunc, typ, properties) -- TODO: dedup the following with resty.openssl.digest local ctx = C.EVP_MD_CTX_new() if ctx == nil then return nil, "x509:digest: failed to create EVP_MD_CTX" end ffi_gc(ctx, C.EVP_MD_CTX_free) local algo if OPENSSL_3X then algo = C.EVP_MD_fetch(ctx_lib.get_libctx(), typ or 'sha1', properties) else algo = C.EVP_get_digestbyname(typ or 'sha1') end if algo == nil then return nil, string.format("x509:digest: invalid digest type \"%s\"", typ) end local md_size = OPENSSL_3X and C.EVP_MD_get_size(algo) or C.EVP_MD_size(algo) if not digest_buf or digest_buf_size < md_size then digest_buf = ctypes.uchar_array(md_size) digest_buf_size = md_size end if cfunc(self.ctx, algo, digest_buf, digest_length) ~= 1 then return nil, format_error("x509:digest") end return ffi_str(digest_buf, digest_length[0]) end function _M:digest(typ, properties) return digest(self, C.X509_digest, typ, properties) end function _M:pubkey_digest(typ, properties) return digest(self, C.X509_pubkey_digest, typ, properties) end function _M:check_private_key(key) if not pkey_lib.istype(key) then return false, "x509:check_private_key: except a pkey instance at #1" end if not key:is_private() then return false, "x509:check_private_key: not a private key" end if C.X509_check_private_key(self.ctx, key.ctx) == 1 then return true end return false, format_error("x509:check_private_key") end -- START AUTO GENERATED CODE -- AUTO GENERATED function _M:sign(pkey, digest) if not pkey_lib.istype(pkey) then return false, "x509:sign: expect a pkey instance at #1" end local digest_algo if digest then if not digest_lib.istype(digest) then return false, "x509:sign: expect a digest instance at #2" elseif not digest.algo then return false, "x509:sign: expect a digest instance to have algo member" end digest_algo = digest.algo end -- returns size of signature if success if C.X509_sign(self.ctx, pkey.ctx, digest_algo) == 0 then return false, format_error("x509:sign") end return true end -- AUTO GENERATED function _M:verify(pkey) if not pkey_lib.istype(pkey) then return false, "x509:verify: expect a pkey instance at #1" end local code = C.X509_verify(self.ctx, pkey.ctx) if code == 1 then return true elseif code == 0 then return false else -- typically -1 return false, format_error("x509:verify", code) end end -- AUTO GENERATED local function get_extension(ctx, nid_txt, last_pos) last_pos = (last_pos or 0) - 1 local nid, err = txtnid2nid(nid_txt) if err then return nil, nil, err end local pos = C.X509_get_ext_by_NID(ctx, nid, last_pos) if pos == -1 then return nil end local ctx = C.X509_get_ext(ctx, pos) if ctx == nil then return nil, nil, format_error() end return ctx, pos end -- AUTO GENERATED function _M:add_extension(extension) if not extension_lib.istype(extension) then return false, "x509:add_extension: expect a x509.extension instance at #1" end -- X509_add_ext returnes the stack on success, and NULL on error -- the X509_EXTENSION ctx is dupped internally if C.X509_add_ext(self.ctx, extension.ctx, -1) == nil then return false, format_error("x509:add_extension") end return true end -- AUTO GENERATED function _M:get_extension(nid_txt, last_pos) local ctx, pos, err = get_extension(self.ctx, nid_txt, last_pos) if err then return nil, nil, "x509:get_extension: " .. err end local ext, err = extension_lib.dup(ctx) if err then return nil, nil, "x509:get_extension: " .. err end return ext, pos+1 end -- AUTO GENERATED function _M:set_extension(extension, last_pos) if not extension_lib.istype(extension) then return false, "x509:set_extension: expect a x509.extension instance at #1" end last_pos = (last_pos or 0) - 1 local nid = extension:get_object().nid local pos = C.X509_get_ext_by_NID(self.ctx, nid, last_pos) -- pos may be -1, which means not found, it's fine, we will add new one instead of replace local removed = C.X509_delete_ext(self.ctx, pos) C.X509_EXTENSION_free(removed) if C.X509_add_ext(self.ctx, extension.ctx, pos) == nil then return false, format_error("x509:set_extension") end return true end -- AUTO GENERATED function _M:set_extension_critical(nid_txt, crit, last_pos) local ctx, _, err = get_extension(self.ctx, nid_txt, last_pos) if err then return nil, "x509:set_extension_critical: " .. err end if C.X509_EXTENSION_set_critical(ctx, crit and 1 or 0) ~= 1 then return false, format_error("x509:set_extension_critical") end return true end -- AUTO GENERATED function _M:get_extension_critical(nid_txt, last_pos) local ctx, _, err = get_extension(self.ctx, nid_txt, last_pos) if err then return nil, "x509:get_extension_critical: " .. err end return C.X509_EXTENSION_get_critical(ctx) == 1 end -- AUTO GENERATED function _M:get_serial_number() local got = accessors.get_serial_number(self.ctx) if got == nil then return nil end -- returns a new BIGNUM instance got = C.ASN1_INTEGER_to_BN(got, nil) if got == nil then return false, format_error("x509:set: BN_to_ASN1_INTEGER") end -- bn will be duplicated thus this ctx should be freed up ffi_gc(got, C.BN_free) local lib = require("resty.openssl.bn") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED function _M:set_serial_number(toset) local lib = require("resty.openssl.bn") if lib.istype and not lib.istype(toset) then return false, "x509:set_serial_number: expect a bn instance at #1" end toset = toset.ctx toset = C.BN_to_ASN1_INTEGER(toset, nil) if toset == nil then return false, format_error("x509:set: BN_to_ASN1_INTEGER") end -- "A copy of the serial number is used internally -- so serial should be freed up after use."" ffi_gc(toset, C.ASN1_INTEGER_free) if accessors.set_serial_number(self.ctx, toset) == 0 then return false, format_error("x509:set_serial_number") end return true end -- AUTO GENERATED function _M:get_not_before() local got = accessors.get_not_before(self.ctx) if got == nil then return nil end got = asn1_lib.asn1_to_unix(got) return got end -- AUTO GENERATED function _M:set_not_before(toset) if type(toset) ~= "number" then return false, "x509:set_not_before: expect a number at #1" end toset = C.ASN1_TIME_set(nil, toset) ffi_gc(toset, C.ASN1_STRING_free) if accessors.set_not_before(self.ctx, toset) == 0 then return false, format_error("x509:set_not_before") end return true end -- AUTO GENERATED function _M:get_not_after() local got = accessors.get_not_after(self.ctx) if got == nil then return nil end got = asn1_lib.asn1_to_unix(got) return got end -- AUTO GENERATED function _M:set_not_after(toset) if type(toset) ~= "number" then return false, "x509:set_not_after: expect a number at #1" end toset = C.ASN1_TIME_set(nil, toset) ffi_gc(toset, C.ASN1_STRING_free) if accessors.set_not_after(self.ctx, toset) == 0 then return false, format_error("x509:set_not_after") end return true end -- AUTO GENERATED function _M:get_pubkey() local got = accessors.get_pubkey(self.ctx) if got == nil then return nil end local lib = require("resty.openssl.pkey") -- returned a copied instance directly return lib.new(got) end -- AUTO GENERATED function _M:set_pubkey(toset) local lib = require("resty.openssl.pkey") if lib.istype and not lib.istype(toset) then return false, "x509:set_pubkey: expect a pkey instance at #1" end toset = toset.ctx if accessors.set_pubkey(self.ctx, toset) == 0 then return false, format_error("x509:set_pubkey") end return true end -- AUTO GENERATED function _M:get_subject_name() local got = accessors.get_subject_name(self.ctx) if got == nil then return nil end local lib = require("resty.openssl.x509.name") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED function _M:set_subject_name(toset) local lib = require("resty.openssl.x509.name") if lib.istype and not lib.istype(toset) then return false, "x509:set_subject_name: expect a x509.name instance at #1" end toset = toset.ctx if accessors.set_subject_name(self.ctx, toset) == 0 then return false, format_error("x509:set_subject_name") end return true end -- AUTO GENERATED function _M:get_issuer_name() local got = accessors.get_issuer_name(self.ctx) if got == nil then return nil end local lib = require("resty.openssl.x509.name") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED function _M:set_issuer_name(toset) local lib = require("resty.openssl.x509.name") if lib.istype and not lib.istype(toset) then return false, "x509:set_issuer_name: expect a x509.name instance at #1" end toset = toset.ctx if accessors.set_issuer_name(self.ctx, toset) == 0 then return false, format_error("x509:set_issuer_name") end return true end -- AUTO GENERATED function _M:get_version() local got = accessors.get_version(self.ctx) if got == nil then return nil end got = tonumber(got) + 1 return got end -- AUTO GENERATED function _M:set_version(toset) if type(toset) ~= "number" then return false, "x509:set_version: expect a number at #1" end -- Note: this is defined by standards (X.509 et al) to be one less than the certificate version. -- So a version 3 certificate will return 2 and a version 1 certificate will return 0. toset = toset - 1 if accessors.set_version(self.ctx, toset) == 0 then return false, format_error("x509:set_version") end return true end local NID_subject_alt_name = C.OBJ_sn2nid("subjectAltName") assert(NID_subject_alt_name ~= 0) -- AUTO GENERATED: EXTENSIONS function _M:get_subject_alt_name() local crit = ctypes.ptr_of_int() -- X509_get_ext_d2i returns internal pointer, always dup -- for now this function always returns the first found extension local got = C.X509_get_ext_d2i(self.ctx, NID_subject_alt_name, crit, nil) crit = tonumber(crit[0]) if crit == -1 then -- not found return nil elseif crit == -2 then return nil, "x509:get_subject_alt_name: extension of subject_alt_name occurs more than one times, " .. "this is not yet implemented. Please use get_extension instead." elseif got == nil then return nil, format_error("x509:get_subject_alt_name") end -- Note: here we only free the stack itself not elements -- since there seems no way to increase ref count for a GENERAL_NAME -- we left the elements referenced by the new-dup'ed stack local got_ref = got got = ffi_cast("GENERAL_NAMES*", got_ref) ffi_gc(got, stack_lib.gc_of("GENERAL_NAME")) local lib = require("resty.openssl.x509.altname") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED: EXTENSIONS function _M:set_subject_alt_name(toset) local lib = require("resty.openssl.x509.altname") if lib.istype and not lib.istype(toset) then return false, "x509:set_subject_alt_name: expect a x509.altname instance at #1" end toset = toset.ctx -- x509v3.h: # define X509V3_ADD_REPLACE 2L if C.X509_add1_ext_i2d(self.ctx, NID_subject_alt_name, toset, 0, 0x2) ~= 1 then return false, format_error("x509:set_subject_alt_name") end return true end -- AUTO GENERATED: EXTENSIONS function _M:set_subject_alt_name_critical(crit) return _M.set_extension_critical(self, NID_subject_alt_name, crit) end -- AUTO GENERATED: EXTENSIONS function _M:get_subject_alt_name_critical() return _M.get_extension_critical(self, NID_subject_alt_name) end local NID_issuer_alt_name = C.OBJ_sn2nid("issuerAltName") assert(NID_issuer_alt_name ~= 0) -- AUTO GENERATED: EXTENSIONS function _M:get_issuer_alt_name() local crit = ctypes.ptr_of_int() -- X509_get_ext_d2i returns internal pointer, always dup -- for now this function always returns the first found extension local got = C.X509_get_ext_d2i(self.ctx, NID_issuer_alt_name, crit, nil) crit = tonumber(crit[0]) if crit == -1 then -- not found return nil elseif crit == -2 then return nil, "x509:get_issuer_alt_name: extension of issuer_alt_name occurs more than one times, " .. "this is not yet implemented. Please use get_extension instead." elseif got == nil then return nil, format_error("x509:get_issuer_alt_name") end -- Note: here we only free the stack itself not elements -- since there seems no way to increase ref count for a GENERAL_NAME -- we left the elements referenced by the new-dup'ed stack local got_ref = got got = ffi_cast("GENERAL_NAMES*", got_ref) ffi_gc(got, stack_lib.gc_of("GENERAL_NAME")) local lib = require("resty.openssl.x509.altname") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED: EXTENSIONS function _M:set_issuer_alt_name(toset) local lib = require("resty.openssl.x509.altname") if lib.istype and not lib.istype(toset) then return false, "x509:set_issuer_alt_name: expect a x509.altname instance at #1" end toset = toset.ctx -- x509v3.h: # define X509V3_ADD_REPLACE 2L if C.X509_add1_ext_i2d(self.ctx, NID_issuer_alt_name, toset, 0, 0x2) ~= 1 then return false, format_error("x509:set_issuer_alt_name") end return true end -- AUTO GENERATED: EXTENSIONS function _M:set_issuer_alt_name_critical(crit) return _M.set_extension_critical(self, NID_issuer_alt_name, crit) end -- AUTO GENERATED: EXTENSIONS function _M:get_issuer_alt_name_critical() return _M.get_extension_critical(self, NID_issuer_alt_name) end local NID_basic_constraints = C.OBJ_sn2nid("basicConstraints") assert(NID_basic_constraints ~= 0) -- AUTO GENERATED: EXTENSIONS function _M:get_basic_constraints(name) local crit = ctypes.ptr_of_int() -- X509_get_ext_d2i returns internal pointer, always dup -- for now this function always returns the first found extension local got = C.X509_get_ext_d2i(self.ctx, NID_basic_constraints, crit, nil) crit = tonumber(crit[0]) if crit == -1 then -- not found return nil elseif crit == -2 then return nil, "x509:get_basic_constraints: extension of basic_constraints occurs more than one times, " .. "this is not yet implemented. Please use get_extension instead." elseif got == nil then return nil, format_error("x509:get_basic_constraints") end local ctx = ffi_cast("BASIC_CONSTRAINTS*", got) local ca = ctx.ca == 0xFF local pathlen = tonumber(C.ASN1_INTEGER_get(ctx.pathlen)) C.BASIC_CONSTRAINTS_free(ctx) if not name or type(name) ~= "string" then got = { ca = ca, pathlen = pathlen, } elseif string.lower(name) == "ca" then got = ca elseif string.lower(name) == "pathlen" then got = pathlen end return got end -- AUTO GENERATED: EXTENSIONS function _M:set_basic_constraints(toset) if type(toset) ~= "table" then return false, "x509:set_basic_constraints: expect a table at #1" end local cfg_lower = {} for k, v in pairs(toset) do cfg_lower[string.lower(k)] = v end toset = C.BASIC_CONSTRAINTS_new() if toset == nil then return false, format_error("x509:set_BASIC_CONSTRAINTS") end ffi_gc(toset, C.BASIC_CONSTRAINTS_free) toset.ca = cfg_lower.ca and 0xFF or 0 local pathlen = cfg_lower.pathlen and tonumber(cfg_lower.pathlen) if pathlen then C.ASN1_INTEGER_free(toset.pathlen) local asn1 = C.ASN1_STRING_type_new(pathlen) if asn1 == nil then return false, format_error("x509:set_BASIC_CONSTRAINTS: ASN1_STRING_type_new") end toset.pathlen = asn1 local code = C.ASN1_INTEGER_set(asn1, pathlen) if code ~= 1 then return false, format_error("x509:set_BASIC_CONSTRAINTS: ASN1_INTEGER_set", code) end end -- x509v3.h: # define X509V3_ADD_REPLACE 2L if C.X509_add1_ext_i2d(self.ctx, NID_basic_constraints, toset, 0, 0x2) ~= 1 then return false, format_error("x509:set_basic_constraints") end return true end -- AUTO GENERATED: EXTENSIONS function _M:set_basic_constraints_critical(crit) return _M.set_extension_critical(self, NID_basic_constraints, crit) end -- AUTO GENERATED: EXTENSIONS function _M:get_basic_constraints_critical() return _M.get_extension_critical(self, NID_basic_constraints) end local NID_info_access = C.OBJ_sn2nid("authorityInfoAccess") assert(NID_info_access ~= 0) -- AUTO GENERATED: EXTENSIONS function _M:get_info_access() local crit = ctypes.ptr_of_int() -- X509_get_ext_d2i returns internal pointer, always dup -- for now this function always returns the first found extension local got = C.X509_get_ext_d2i(self.ctx, NID_info_access, crit, nil) crit = tonumber(crit[0]) if crit == -1 then -- not found return nil elseif crit == -2 then return nil, "x509:get_info_access: extension of info_access occurs more than one times, " .. "this is not yet implemented. Please use get_extension instead." elseif got == nil then return nil, format_error("x509:get_info_access") end -- Note: here we only free the stack itself not elements -- since there seems no way to increase ref count for a ACCESS_DESCRIPTION -- we left the elements referenced by the new-dup'ed stack local got_ref = got got = ffi_cast("AUTHORITY_INFO_ACCESS*", got_ref) ffi_gc(got, stack_lib.gc_of("ACCESS_DESCRIPTION")) local lib = require("resty.openssl.x509.extension.info_access") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED: EXTENSIONS function _M:set_info_access(toset) local lib = require("resty.openssl.x509.extension.info_access") if lib.istype and not lib.istype(toset) then return false, "x509:set_info_access: expect a x509.extension.info_access instance at #1" end toset = toset.ctx -- x509v3.h: # define X509V3_ADD_REPLACE 2L if C.X509_add1_ext_i2d(self.ctx, NID_info_access, toset, 0, 0x2) ~= 1 then return false, format_error("x509:set_info_access") end return true end -- AUTO GENERATED: EXTENSIONS function _M:set_info_access_critical(crit) return _M.set_extension_critical(self, NID_info_access, crit) end -- AUTO GENERATED: EXTENSIONS function _M:get_info_access_critical() return _M.get_extension_critical(self, NID_info_access) end local NID_crl_distribution_points = C.OBJ_sn2nid("crlDistributionPoints") assert(NID_crl_distribution_points ~= 0) -- AUTO GENERATED: EXTENSIONS function _M:get_crl_distribution_points() local crit = ctypes.ptr_of_int() -- X509_get_ext_d2i returns internal pointer, always dup -- for now this function always returns the first found extension local got = C.X509_get_ext_d2i(self.ctx, NID_crl_distribution_points, crit, nil) crit = tonumber(crit[0]) if crit == -1 then -- not found return nil elseif crit == -2 then return nil, "x509:get_crl_distribution_points: extension of crl_distribution_points occurs more than one times, " .. "this is not yet implemented. Please use get_extension instead." elseif got == nil then return nil, format_error("x509:get_crl_distribution_points") end -- Note: here we only free the stack itself not elements -- since there seems no way to increase ref count for a DIST_POINT -- we left the elements referenced by the new-dup'ed stack local got_ref = got got = ffi_cast("OPENSSL_STACK*", got_ref) ffi_gc(got, stack_lib.gc_of("DIST_POINT")) local lib = require("resty.openssl.x509.extension.dist_points") -- the internal ptr is returned, ie we need to copy it return lib.dup(got) end -- AUTO GENERATED: EXTENSIONS function _M:set_crl_distribution_points(toset) local lib = require("resty.openssl.x509.extension.dist_points") if lib.istype and not lib.istype(toset) then return false, "x509:set_crl_distribution_points: expect a x509.extension.dist_points instance at #1" end toset = toset.ctx -- x509v3.h: # define X509V3_ADD_REPLACE 2L if C.X509_add1_ext_i2d(self.ctx, NID_crl_distribution_points, toset, 0, 0x2) ~= 1 then return false, format_error("x509:set_crl_distribution_points") end return true end -- AUTO GENERATED: EXTENSIONS function _M:set_crl_distribution_points_critical(crit) return _M.set_extension_critical(self, NID_crl_distribution_points, crit) end -- AUTO GENERATED: EXTENSIONS function _M:get_crl_distribution_points_critical() return _M.get_extension_critical(self, NID_crl_distribution_points) end -- AUTO GENERATED function _M:get_signature_nid() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509:get_signature_nid") end return nid end -- AUTO GENERATED function _M:get_signature_name() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509:get_signature_name") end return ffi.string(C.OBJ_nid2sn(nid)) end -- AUTO GENERATED function _M:get_signature_digest_name() local nid = accessors.get_signature_nid(self.ctx) if nid <= 0 then return nil, format_error("x509:get_signature_digest_name") end local nid = find_sigid_algs(nid) return ffi.string(C.OBJ_nid2sn(nid)) end -- END AUTO GENERATED CODE return _M PKBN]0Aresty/openssl/x509/altname.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_cast = ffi.cast local ffi_str = ffi.string require "resty.openssl.include.x509" require "resty.openssl.include.x509v3" local asn1_macro = require "resty.openssl.include.asn1" local stack_lib = require "resty.openssl.stack" local name_lib = require "resty.openssl.x509.name" local altname_macro = require "resty.openssl.include.x509.altname" local _M = {} local general_names_ptr_ct = ffi.typeof("GENERAL_NAMES*") local STACK = "GENERAL_NAME" local new = stack_lib.new_of(STACK) local add = stack_lib.add_of(STACK) local dup = stack_lib.dup_of(STACK) local types = altname_macro.types local AF_INET = 2 local AF_INET6 = 10 if ffi.os == "OSX" then AF_INET6 = 30 elseif ffi.os == "BSD" then AF_INET6 = 28 elseif ffi.os == "Windows" then AF_INET6 = 23 end ffi.cdef [[ typedef int socklen_t; int inet_pton(int af, const char *restrict src, void *restrict dst); const char *inet_ntop(int af, const void *restrict src, char *restrict dst, socklen_t size); ]] local ip_buffer = ffi.new("unsigned char [46]") -- 46 bytes enough for both string ipv6 and binary ipv6 -- similar to GENERAL_NAME_print, but returns value instead of print local gn_decode = function(ctx) local typ = ctx.type local k = altname_macro.literals[typ] local v if typ == types.OtherName then v = "OtherName:" elseif typ == types.RFC822Name then v = ffi_str(asn1_macro.ASN1_STRING_get0_data(ctx.d.rfc822Name)) elseif typ == types.DNS then v = ffi_str(asn1_macro.ASN1_STRING_get0_data(ctx.d.dNSName)) elseif typ == types.X400 then v = "X400:" elseif typ == types.DirName then v = name_lib.dup(ctx.d.directoryName) elseif typ == types.EdiParty then v = "EdiParty:" elseif typ == types.URI then v = ffi_str(asn1_macro.ASN1_STRING_get0_data(ctx.d.uniformResourceIdentifier)) elseif typ == types.IP then v = asn1_macro.ASN1_STRING_get0_data(ctx.d.iPAddress) local l = tonumber(C.ASN1_STRING_length(ctx.d.iPAddress)) if l ~= 4 and l ~= 16 then error("Unknown IP address type") end v = C.inet_ntop(l == 4 and AF_INET or AF_INET6, v, ip_buffer, 46) v = ffi_str(v) elseif typ == types.RID then v = "RID:" else error("unknown type" .. typ .. "-> " .. types.OtherName) end return { k, v } end -- shared with info_access _M.gn_decode = gn_decode local mt = stack_lib.mt_of(STACK, gn_decode, _M) local mt__pairs = mt.__pairs mt.__pairs = function(tbl) local f = mt__pairs(tbl) return function() local _, e = f() if not e then return end return unpack(e) end end function _M.new() local ctx = new() if ctx == nil then return nil, "x509.altname.new: OPENSSL_sk_new_null() failed" end local cast = ffi_cast("GENERAL_NAMES*", ctx) local self = setmetatable({ ctx = ctx, cast = cast, _is_shallow_copy = false, }, mt) return self, nil end function _M.istype(l) return l and l.cast and ffi.istype(general_names_ptr_ct, l.cast) end function _M.dup(ctx) if ctx == nil or not ffi.istype(general_names_ptr_ct, ctx) then return nil, "x509.altname.dup: expect a GENERAL_NAMES* ctx at #1" end local dup_ctx, err = dup(ctx) if dup_ctx == nil then return nil, err end return setmetatable({ cast = ffi_cast(general_names_ptr_ct, dup_ctx), ctx = dup_ctx, -- don't let lua gc the original stack to keep its elements _dupped_from = ctx, _is_shallow_copy = true, _elem_refs = {}, _elem_refs_idx = 1, }, mt), nil end local function gn_set(gn, typ, value) if type(typ) ~= 'string' then return "x509.altname:gn_set: expect a string at #1" end local typ_lower = typ:lower() if type(value) ~= 'string' then return "x509.altname:gn_set: except a string at #2" end local txt = value local gn_type = types[typ_lower] if not gn_type then return "x509.altname:gn_set: unknown type " .. typ end if gn_type == types.IP then if C.inet_pton(AF_INET, txt, ip_buffer) == 1 then txt = ffi_str(ip_buffer, 4) elseif C.inet_pton(AF_INET6, txt, ip_buffer) == 1 then txt = ffi_str(ip_buffer, 16) else return "x509.altname:gn_set: invalid IP address " .. txt end elseif gn_type ~= types.Email and gn_type ~= types.URI and gn_type ~= types.DNS then return "x509.altname:gn_set: setting type " .. typ .. " is currently not supported" end gn.type = gn_type local asn1_string = C.ASN1_IA5STRING_new() if asn1_string == nil then return "x509.altname:gn_set: ASN1_STRING_type_new() failed" end local code = C.ASN1_STRING_set(asn1_string, txt, #txt) if code ~= 1 then C.ASN1_STRING_free(asn1_string) return "x509.altname:gn_set: ASN1_STRING_set() failed: " .. code end gn.d.ia5 = asn1_string end -- shared with info_access _M.gn_set = gn_set function _M:add(typ, value) -- the stack element stays with stack -- we shouldn't add gc handler if it's already been -- pushed to stack. instead, rely on the gc handler -- of the stack to release all memories local gn = C.GENERAL_NAME_new() if gn == nil then return nil, "x509.altname:add: GENERAL_NAME_new() failed" end local err = gn_set(gn, typ, value) if err then C.GENERAL_NAME_free(gn) return nil, err end local _, err = add(self.ctx, gn) if err then C.GENERAL_NAME_free(gn) return nil, err end -- if the stack is duplicated, the gc handler is not pop_free -- handle the gc by ourselves if self._is_shallow_copy then ffi_gc(gn, C.GENERAL_NAME_free) self._elem_refs[self._elem_refs_idx] = gn self._elem_refs_idx = self._elem_refs_idx + 1 end return self end _M.all = function(self) local ret = {} local _next = mt.__pairs(self) while true do local k, v = _next() if k then ret[k] = v else break end end return ret end _M.each = mt.__pairs _M.index = mt.__index _M.count = mt.__len mt.__tostring = function(self) local values = {} local _next = mt.__pairs(self) while true do local k, v = _next() if k then table.insert(values, k .. "=" .. v) else break end end table.sort(values) return table.concat(values, "/") end _M.tostring = mt.__tostring return _M PKBN]—vڧresty/openssl/x509/chain.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local stack_lib = require "resty.openssl.stack" local x509_lib = require "resty.openssl.x509" local format_error = require("resty.openssl.err").format_error local _M = {} local stack_ptr_ct = ffi.typeof("OPENSSL_STACK*") local STACK = "X509" local gc = stack_lib.gc_of(STACK) local new = stack_lib.new_of(STACK) local add = stack_lib.add_of(STACK) local mt = stack_lib.mt_of(STACK, x509_lib.dup, _M) function _M.new() local raw, err = new() if raw == nil then return nil, err end local self = setmetatable({ stack_of = STACK, ctx = raw, }, mt) return self, nil end function _M.istype(l) return l and l.ctx and ffi.istype(stack_ptr_ct, l.ctx) and l.stack_of and l.stack_of == STACK end function _M.dup(ctx) if ctx == nil or not ffi.istype(stack_ptr_ct, ctx) then return nil, "x509.chain.dup: expect a stack ctx at #1, got " .. type(ctx) end -- sk_X509_dup plus up ref for each X509 element local ctx = C.X509_chain_up_ref(ctx) if ctx == nil then return nil, "x509.chain.dup: X509_chain_up_ref() failed" end ffi_gc(ctx, gc) return setmetatable({ stack_of = STACK, ctx = ctx, }, mt) end function _M:add(x509) if not x509_lib.istype(x509) then return nil, "x509.chain:add: expect a x509 instance at #1" end local dup = C.X509_dup(x509.ctx) if dup == nil then return nil, format_error("x509.chain:add: X509_dup") end local _, err = add(self.ctx, dup) if err then C.X509_free(dup) return nil, err end return true end _M.all = stack_lib.all_func(mt) _M.each = mt.__ipairs _M.index = mt.__index _M.count = mt.__len return _M PKBN]&resty/openssl/pkcs12.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string require "resty.openssl.include.pkcs12" require "resty.openssl.include.bio" require "resty.openssl.include.stack" local bio_util = require "resty.openssl.auxiliary.bio" local format_error = require("resty.openssl.err").format_error local pkey_lib = require "resty.openssl.pkey" local x509_lib = require "resty.openssl.x509" local stack_lib = require "resty.openssl.stack" local objects_lib = require "resty.openssl.objects" local ctx_lib = require "resty.openssl.ctx" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local stack_of_x509_new = stack_lib.new_of("X509") local stack_of_x509_add = stack_lib.add_of("X509") local stack_of_x509_iter = stack_lib.mt_of("X509", x509_lib.dup, {}).__ipairs local ptr_ptr_of_pkey = ffi.typeof("EVP_PKEY*[1]") local ptr_ptr_of_x509 = ffi.typeof("X509*[1]") local ptr_ptr_of_stack = ffi.typeof("OPENSSL_STACK*[1]") local function decode(p12, passphrase) local bio = C.BIO_new_mem_buf(p12, #p12) if bio == nil then return nil, "pkcs12.decode: BIO_new_mem_buf() failed" end ffi_gc(bio, C.BIO_free) local p12 = C.d2i_PKCS12_bio(bio, nil) if p12 == nil then return nil, format_error("pkcs12.decode: d2i_PKCS12_bio") end ffi_gc(p12, C.PKCS12_free) local ppkey = ptr_ptr_of_pkey() local px509 = ptr_ptr_of_x509() local pstack = ptr_ptr_of_stack() local stack = stack_of_x509_new() if stack == nil then return nil, "pkcs12.decode: OPENSSL_sk_new_null() failed" end -- assign a valid OPENSSL_STACK so gc is taken care of pstack[0] = stack local code = C.PKCS12_parse(p12, passphrase or "", ppkey, px509, pstack) if code ~= 1 then return nil, format_error("pkcs12.decode: PKCS12_parse") end local cacerts local n = C.OPENSSL_sk_num(stack) if n > 0 then cacerts = {} local iter = stack_of_x509_iter({ ctx = stack }) for i=1, n do local _, c = iter() cacerts[i] = c end end local friendly_name = C.X509_alias_get0(px509[0], nil) if friendly_name ~= nil then friendly_name = ffi_str(friendly_name) end return { key = pkey_lib.new(ppkey[0]), cert = x509_lib.new(px509[0]), friendly_name = friendly_name, cacerts = cacerts, -- store reference to the stack, so it's not GC'ed unexpectedly _stack = stack, } end local function encode(opts, passphrase, properties) if passphrase and type(passphrase) ~= "string" then return nil, "pkcs12.encode: expect passphrase to be a string" end local pkey = opts.key if not pkey_lib.istype(pkey) then return nil, "pkcs12.encode: expect key to be a pkey instance" end local cert = opts.cert if not x509_lib.istype(cert) then return nil, "pkcs12.encode: expect cert to be a x509 instance" end local ok, err = cert:check_private_key(pkey) if not ok then return nil, "pkcs12.encode: key doesn't match cert: " .. err end local nid_key = opts.nid_key if nid_key then nid_key, err = objects_lib.txtnid2nid(nid_key) if err then return nil, "pkcs12.encode: invalid nid_key" end end local nid_cert = opts.nid_cert if nid_cert then nid_cert, err = objects_lib.txtnid2nid(nid_cert) if err then return nil, "pkcs12.encode: invalid nid_cert" end end local x509stack local cacerts = opts.cacerts if cacerts then if type(cacerts) ~= "table" then return nil, "pkcs12.encode: expect cacerts to be a table" end if #cacerts > 0 then -- stack lib handles gc x509stack = stack_of_x509_new() for _, c in ipairs(cacerts) do if C.X509_up_ref(c.ctx) ~= 1 then return nil, "pkcs12.encode: failed to add cacerts: X509_up_ref failed" end local ok, err = stack_of_x509_add(x509stack, c.ctx) if not ok then return nil, "pkcs12.encode: failed to add cacerts: " .. err end end end end local p12 if OPENSSL_3X then p12 = C.PKCS12_create_ex(passphrase or "", opts.friendly_name, pkey.ctx, cert.ctx, x509stack, nid_key or 0, nid_cert or 0, opts.iter or 0, opts.mac_iter or 0, 0, ctx_lib.get_libctx(), properties) else p12 = C.PKCS12_create(passphrase or "", opts.friendly_name, pkey.ctx, cert.ctx, x509stack, nid_key or 0, nid_cert or 0, opts.iter or 0, opts.mac_iter or 0, 0) end if p12 == nil then return nil, format_error("pkcs12.encode: PKCS12_create") end ffi_gc(p12, C.PKCS12_free) return bio_util.read_wrap(C.i2d_PKCS12_bio, p12) end return { decode = decode, loads = decode, encode = encode, dumps = encode, } PKBN]&+#+#resty/openssl/cipher.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string local ffi_cast = ffi.cast require "resty.openssl.include.evp.cipher" local evp_macro = require "resty.openssl.include.evp" local ctypes = require "resty.openssl.auxiliary.ctypes" local ctx_lib = require "resty.openssl.ctx" local format_error = require("resty.openssl.err").format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local log_warn = require "resty.openssl.auxiliary.compat".log_warn local uchar_array = ctypes.uchar_array local void_ptr = ctypes.void_ptr local ptr_of_int = ctypes.ptr_of_int local _M = {} local mt = {__index = _M} local cipher_ctx_ptr_ct = ffi.typeof('EVP_CIPHER_CTX*') local out_length = ptr_of_int() -- EVP_MAX_BLOCK_LENGTH is 32, we give it a 64 to be future proof local out_buffer_size = 1024 local out_buffer = ctypes.uchar_array(out_buffer_size + 64) function _M.new(typ, properties) if not typ then return nil, "cipher.new: expect type to be defined" end local ctx = C.EVP_CIPHER_CTX_new() if ctx == nil then return nil, "cipher.new: failed to create EVP_CIPHER_CTX" end ffi_gc(ctx, C.EVP_CIPHER_CTX_free) local ctyp if OPENSSL_3X then ctyp = C.EVP_CIPHER_fetch(ctx_lib.get_libctx(), typ, properties) else ctyp = C.EVP_get_cipherbyname(typ) end local err_new = string.format("cipher.new: invalid cipher type \"%s\"", typ) if ctyp == nil then return nil, format_error(err_new) end local code = C.EVP_CipherInit_ex(ctx, ctyp, nil, "", nil, -1) if code ~= 1 then return nil, format_error(err_new) end return setmetatable({ ctx = ctx, algo = ctyp, initialized = false, block_size = tonumber(OPENSSL_3X and C.EVP_CIPHER_CTX_get_block_size(ctx) or C.EVP_CIPHER_CTX_block_size(ctx)), key_size = tonumber(OPENSSL_3X and C.EVP_CIPHER_CTX_get_key_length(ctx) or C.EVP_CIPHER_CTX_key_length(ctx)), iv_size = tonumber(OPENSSL_3X and C.EVP_CIPHER_CTX_get_iv_length(ctx) or C.EVP_CIPHER_CTX_iv_length(ctx)), }, mt), nil end function _M.istype(l) return l and l.ctx and ffi.istype(cipher_ctx_ptr_ct, l.ctx) end function _M.set_buffer_size(sz) if out_buffer_size ~= sz then out_buffer_size = sz out_buffer = ctypes.uchar_array(sz + 64) end return true end function _M:get_provider_name() if not OPENSSL_3X then return false, "cipher:get_provider_name is not supported" end local p = C.EVP_CIPHER_get0_provider(self.algo) if p == nil then return nil end return ffi_str(C.OSSL_PROVIDER_get0_name(p)) end if OPENSSL_3X then local param_lib = require "resty.openssl.param" _M.settable_params, _M.set_params, _M.gettable_params, _M.get_param = param_lib.get_params_func("EVP_CIPHER_CTX") end function _M:init(key, iv, opts) opts = opts or {} if not key or #key ~= self.key_size then return false, string.format("cipher:init: incorrect key size, expect %d", self.key_size) end if self.iv_size > 0 and (not iv or #iv ~= self.iv_size) then return false, string.format("cipher:init: incorrect iv size, expect %d", self.iv_size) end -- always passed in the `EVP_CIPHER` parameter to reinitialized the cipher -- it will have a same effect as EVP_CIPHER_CTX_cleanup/EVP_CIPHER_CTX_reset then Init_ex with -- empty algo if C.EVP_CipherInit_ex(self.ctx, self.algo, nil, key, iv, opts.is_encrypt and 1 or 0) == 0 then return false, format_error("cipher:init EVP_CipherInit_ex") end if opts.no_padding then -- EVP_CIPHER_CTX_set_padding() always returns 1. C.EVP_CIPHER_CTX_set_padding(self.ctx, 0) end self.initialized = true return true end function _M:encrypt(key, iv, s, no_padding, aead_aad) local _, err = self:init(key, iv, { is_encrypt = true, no_padding = no_padding, }) if err then return nil, err end if aead_aad then local _, err = self:update_aead_aad(aead_aad) if err then return nil, err end end return self:final(s) end function _M:decrypt(key, iv, s, no_padding, aead_aad, aead_tag) local _, err = self:init(key, iv, { is_encrypt = false, no_padding = no_padding, }) if err then return nil, err end if aead_aad then local _, err = self:update_aead_aad(aead_aad) if err then return nil, err end end if aead_tag then local _, err = self:set_aead_tag(aead_tag) if err then return nil, err end end return self:final(s) end -- https://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption function _M:update_aead_aad(aad) if not self.initialized then return nil, "cipher:update_aead_aad: cipher not initalized, call cipher:init first" end if C.EVP_CipherUpdate(self.ctx, nil, out_length, aad, #aad) ~= 1 then return false, format_error("cipher:update_aead_aad") end return true end function _M:get_aead_tag(size) if not self.initialized then return nil, "cipher:get_aead_tag: cipher not initalized, call cipher:init first" end size = size or self.key_size / 2 if size > self.key_size then return nil, string.format("tag size %d is too large", size) end if C.EVP_CIPHER_CTX_ctrl(self.ctx, evp_macro.EVP_CTRL_AEAD_GET_TAG, size, out_buffer) ~= 1 then return nil, format_error("cipher:get_aead_tag") end return ffi_str(out_buffer, size) end function _M:set_aead_tag(tag) if not self.initialized then return nil, "cipher:set_aead_tag: cipher not initalized, call cipher:init first" end if type(tag) ~= "string" then return false, "cipher:set_aead_tag expect a string at #1" end local tag_void_ptr = ffi_cast(void_ptr, tag) if C.EVP_CIPHER_CTX_ctrl(self.ctx, evp_macro.EVP_CTRL_AEAD_SET_TAG, #tag, tag_void_ptr) ~= 1 then return false, format_error("cipher:set_aead_tag") end return true end local update_buffer = {} function _M:update(...) if not self.initialized then return nil, "cipher:update: cipher not initalized, call cipher:init first" end table.clear(update_buffer) local _out_buffer = out_buffer for i, s in ipairs({...}) do local inl = #s if inl > out_buffer_size and _out_buffer == out_buffer then -- create a larger buffer than the default one _out_buffer = ctypes.uchar_array(inl + 64) end if C.EVP_CipherUpdate(self.ctx, _out_buffer, out_length, s, inl) ~= 1 then return nil, format_error("cipher:update") end table.insert(update_buffer, ffi_str(_out_buffer, out_length[0])) end return table.concat(update_buffer, "") end function _M:final(s) if not self.initialized then return nil, "cipher:update: cipher not initalized, call cipher:init first" end out_length[0] = 0 local offset = 0 -- advance the offset if we have update buffer local _out_buffer = out_buffer if s then local inl = #s if inl > out_buffer_size then -- create a larger buffer than the default one _out_buffer = ctypes.uchar_array(inl + 64) end if C.EVP_CipherUpdate(self.ctx, _out_buffer, out_length, s, inl) ~= 1 then return nil, format_error("cipher:final") end offset = out_length[0] end if C.EVP_CipherFinal_ex(self.ctx, _out_buffer + offset, out_length) ~= 1 then return nil, format_error("cipher:final: EVP_CipherFinal_ex") end return ffi_str(_out_buffer, out_length[0] + offset) end function _M:derive(key, salt, count, md, md_properties) if type(key) ~= "string" then return nil, nil, "cipher:derive: expect a string at #1" elseif salt and type(salt) ~= "string" then return nil, nil, "cipher:derive: expect a string at #2" elseif count then count = tonumber(count) if not count then return nil, nil, "cipher:derive: expect a number at #3" end elseif md and type(md) ~= "string" then return nil, nil, "cipher:derive: expect a string or nil at #4" end if salt then if #salt > 8 then log_warn("cipher:derive: salt is too long, truncate salt to 8 bytes") salt = salt:sub(0, 8) elseif #salt < 8 then log_warn("cipher:derive: salt is too short, padding with zero bytes to length") salt = salt .. string.rep('\000', 8 - #salt) end end local mdt if OPENSSL_3X then mdt = C.EVP_MD_fetch(ctx_lib.get_libctx(), md or 'sha1', md_properties) else mdt = C.EVP_get_digestbyname(md or 'sha1') end if mdt == nil then return nil, nil, string.format("cipher:derive: invalid digest type \"%s\"", md) end local cipt = C.EVP_CIPHER_CTX_cipher(self.ctx) local keyb = uchar_array(self.key_size) local ivb = uchar_array(self.iv_size) local size = C.EVP_BytesToKey(cipt, mdt, salt, key, #key, count or 1, keyb, ivb) if size == 0 then return nil, nil, format_error("cipher:derive: EVP_BytesToKey") end return ffi_str(keyb, size), ffi_str(ivb, self.iv_size) end return _M PKBN][ia a resty/openssl/dh.luanu[local ffi = require "ffi" local C = ffi.C require "resty.openssl.include.dh" local bn_lib = require "resty.openssl.bn" local format_error = require("resty.openssl.err").format_error local _M = {} _M.params = {"public", "private", "p", "q", "g"} local empty_table = {} local bn_ptrptr_ct = ffi.typeof("const BIGNUM *[1]") function _M.get_parameters(dh_st) return setmetatable(empty_table, { __index = function(_, k) local ptr, ret ptr = bn_ptrptr_ct() if k == 'p' then C.DH_get0_pqg(dh_st, ptr, nil, nil) elseif k == 'q' then C.DH_get0_pqg(dh_st, nil, ptr, nil) elseif k == 'g' then C.DH_get0_pqg(dh_st, nil, nil, ptr) elseif k == 'public' then C.DH_get0_key(dh_st, ptr, nil) elseif k == 'private' then C.DH_get0_key(dh_st, nil, ptr) else return nil, "rsa.get_parameters: unknown parameter \"" .. k .. "\" for RSA key" end ret = ptr[0] if ret == nil then return nil end return bn_lib.dup(ret) end }), nil end local function dup_bn_value(v) if not bn_lib.istype(v) then return nil, "expect value to be a bn instance" end local bn = C.BN_dup(v.ctx) if bn == nil then return nil, "BN_dup() failed" end return bn end function _M.set_parameters(dh_st, opts) local err local opts_bn = {} -- remember which parts of BNs has been added to dh_st, they should be freed -- by DH_free and we don't cleanup them on failure local cleanup_from_idx = 1 -- dup input local do_set_key, do_set_pqg while true do -- luacheck: ignore for k, v in pairs(opts) do opts_bn[k], err = dup_bn_value(v) if err then -- luacheck: ignore err = "dh.set_parameters: cannot process parameter \"" .. k .. "\":" .. err break end if k == "private" or k == "public" then do_set_key = true elseif k == "p" or k == "q" or k == "g" then do_set_pqg = true end end local code if do_set_key then code = C.DH_set0_key(dh_st, opts_bn["public"], opts_bn["private"]) if code == 0 then err = format_error("dh.set_parameters: DH_set0_key") break end end cleanup_from_idx = cleanup_from_idx + 2 if do_set_pqg then code = C.DH_set0_pqg(dh_st, opts_bn["p"], opts_bn["q"], opts_bn["g"]) if code == 0 then err = format_error("dh.set_parameters: DH_set0_pqg") break end end return true end for i, k in pairs(_M.params) do if i >= cleanup_from_idx then C.BN_free(opts_bn[k]) end end return false, err end return _M PKBN]y1>@ resty/openssl/mac.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string require "resty.openssl.include.evp.mac" local param_lib = require "resty.openssl.param" local ctx_lib = require "resty.openssl.ctx" local ctypes = require "resty.openssl.auxiliary.ctypes" local format_error = require("resty.openssl.err").format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local _M = {} local mt = {__index = _M} local mac_ctx_ptr_ct = ffi.typeof('EVP_MAC_CTX*') local param_types = { cipher = param_lib.OSSL_PARAM_UTF8_STRING, digest = param_lib.OSSL_PARAM_UTF8_STRING, } local params = {} function _M.new(key, typ, cipher, digest, properties) if not OPENSSL_3X then return false, "EVP_MAC is only supported from OpenSSL 3.0" end local algo = C.EVP_MAC_fetch(ctx_lib.get_libctx(), typ, properties) if algo == nil then return nil, format_error(string.format("mac.new: invalid mac type \"%s\"", typ)) end ffi_gc(algo, C.EVP_MAC_free) local ctx = C.EVP_MAC_CTX_new(algo) if ctx == nil then return nil, "mac.new: failed to create EVP_MAC_CTX" end ffi_gc(ctx, C.EVP_MAC_CTX_free) params.digest = digest params.cipher = cipher local p = param_lib.construct(params, 2, param_types) local keyl = #key local code = C.EVP_MAC_init(ctx, key, keyl, p) if code ~= 1 then return nil, format_error(string.format("mac.new: invalid cipher or digest type")) end local md_size = C.EVP_MAC_CTX_get_mac_size(ctx) return setmetatable({ ctx = ctx, algo = algo, buf = ctypes.uchar_array(md_size), buf_size = md_size, _reset = function() return C.EVP_MAC_init(ctx, key, keyl, p) end, }, mt), nil end function _M.istype(l) return l and l.ctx and ffi.istype(mac_ctx_ptr_ct, l.ctx) end function _M:get_provider_name() local p = C.EVP_MAC_get0_provider(self.algo) if p == nil then return nil end return ffi_str(C.OSSL_PROVIDER_get0_name(p)) end _M.settable_params, _M.set_params, _M.gettable_params, _M.get_param = param_lib.get_params_func("EVP_MAC_CTX") function _M:update(...) for _, s in ipairs({...}) do if C.EVP_MAC_update(self.ctx, s, #s) ~= 1 then return false, format_error("mac:update") end end return true, nil end function _M:final(s) if s then if C.EVP_MAC_update(self.ctx, s, #s) ~= 1 then return false, format_error("mac:final") end end local length = ctypes.ptr_of_size_t() if C.EVP_MAC_final(self.ctx, self.buf, length, self.buf_size) ~= 1 then return nil, format_error("mac:final: EVP_MAC_final") end return ffi_str(self.buf, length[0]) end function _M:reset() local code = self._reset() if code ~= 1 then return false, format_error("mac:reset") end return true end return _M PKBN]ZUAresty/openssl/stack.luanu[ --[[ The OpenSSL stack library. Note `safestack` is not usable here in ffi because those symbols are eaten after preprocessing. Instead, we should do a Lua land type checking by having a nested field indicating which type of cdata its ctx holds. ]] local ffi = require "ffi" local C = ffi.C local ffi_cast = ffi.cast local ffi_gc = ffi.gc require "resty.openssl.include.stack" local format_error = require("resty.openssl.err").format_error local _M = {} local function gc_of(typ) local f = C[typ .. "_free"] return function (st) C.OPENSSL_sk_pop_free(st, f) end end _M.gc_of = gc_of _M.mt_of = function(typ, convert, index_tbl, no_gc) if type(typ) ~= "string" then error("expect a string at #1") elseif type(convert) ~= "function" then error("expect a function at #2") end local typ_ptr = typ .. "*" -- starts from 0 local function value_at(ctx, i) local elem = C.OPENSSL_sk_value(ctx, i) if elem == nil then error(format_error("OPENSSL_sk_value")) end local dup, err = convert(ffi_cast(typ_ptr, elem)) if err then error(err) end return dup end local function iter(tbl) if not tbl then error("instance is nil") end local i = 0 local n = tonumber(C.OPENSSL_sk_num(tbl.ctx)) return function() i = i + 1 if i <= n then return i, value_at(tbl.ctx, i-1) end end end local ret = { __pairs = iter, __ipairs = iter, __len = function(tbl) if not tbl then error("instance is nil") end return tonumber(C.OPENSSL_sk_num(tbl.ctx)) end, __index = function(tbl, k) if not tbl then error("instance is nil") end local i = tonumber(k) if not i then return index_tbl[k] end local n = C.OPENSSL_sk_num(tbl.ctx) if i <= 0 or i > n then return nil end return value_at(tbl.ctx, i-1) end, } if not no_gc then ret.__gc = gc_of(typ) end return ret end _M.new_of = function(typ) local gc = gc_of(typ) return function() local raw = C.OPENSSL_sk_new_null() if raw == nil then return nil, "stack.new_of: OPENSSL_sk_new_null() failed" end ffi_gc(raw, gc) return raw end end _M.add_of = function(typ) local ptr = ffi.typeof(typ .. "*") return function(stack, ctx) if not stack then error("instance is nil") end if ctx == nil or not ffi.istype(ptr, ctx) then return false, "stack.add_of: expect a " .. typ .. "* at #1" end local code = C.OPENSSL_sk_push(stack, ctx) if code == 0 then return false, "stack.add_of: OPENSSL_sk_push() failed" end return true end end local stack_ptr_ct = ffi.typeof("OPENSSL_STACK*") _M.dup_of = function(_) return function(ctx) if ctx == nil or not ffi.istype(stack_ptr_ct, ctx) then return nil, "stack.dup_of: expect a stack ctx at #1" end local ctx = C.OPENSSL_sk_dup(ctx) if ctx == nil then return nil, "stack.dup_of: OPENSSL_sk_dup() failed" end -- if the stack is duplicated: since we don't copy the elements -- then we only control gc of the stack itself here ffi_gc(ctx, C.OPENSSL_sk_free) return ctx end end -- fallback function to iterate if LUAJIT_ENABLE_LUA52COMPAT not enabled _M.all_func = function(mt) return function(stack) if not stack then error("stack is nil") end local ret = {} local _next = mt.__pairs(stack) while true do local i, elem = _next() if elem then ret[i] = elem else break end end return ret end end _M.deep_copy_of = function(typ) local dup = C[typ .. "_dup"] local free = C[typ .. "_free"] return function(ctx) return C.OPENSSL_sk_deep_copy(ctx, dup, free) end end return _MPKBN]'resty/openssl/objects.luanu[local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local ffi_sizeof = ffi.sizeof require "resty.openssl.include.objects" require "resty.openssl.include.err" local buf = ffi.new('char[?]', 100) local function obj2table(obj) local nid = C.OBJ_obj2nid(obj) local len = C.OBJ_obj2txt(buf, ffi_sizeof(buf), obj, 1) local oid = ffi_str(buf, len) return { id = oid, nid = nid, sn = ffi_str(C.OBJ_nid2sn(nid)), ln = ffi_str(C.OBJ_nid2ln(nid)), } end local function nid2table(nid) return obj2table(C.OBJ_nid2obj(nid)) end local function txt2nid(txt) if type(txt) ~= "string" then return nil, "objects.txt2nid: expect a string at #1" end local nid = C.OBJ_txt2nid(txt) if nid == 0 then -- clean up error occurs during OBJ_txt2nid C.ERR_clear_error() return nil, "objects.txt2nid: invalid NID text " .. txt end return nid end local function txtnid2nid(txt_nid) local nid if type(txt_nid) == "string" then nid = C.OBJ_txt2nid(txt_nid) if nid == 0 then -- clean up error occurs during OBJ_txt2nid C.ERR_clear_error() return nil, "objects.txtnid2nid: invalid NID text " .. txt_nid end elseif type(txt_nid) == "number" then nid = txt_nid else return nil, "objects.txtnid2nid: expect string or number at #1" end return nid end local function find_sigid_algs(nid) local out = ffi.new("int[1]") if C.OBJ_find_sigid_algs(nid, out, nil) == 0 then return 0, "objects.find_sigid_algs: invalid sigid " .. nid end return tonumber(out[0]) end return { obj2table = obj2table, nid2table = nid2table, txt2nid = txt2nid, txtnid2nid = txtnid2nid, find_sigid_algs = find_sigid_algs, create = C.OBJ_create, } PKBN]U resty/openssl/err.luanu[local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local ffi_sizeof = ffi.sizeof local ctypes = require "resty.openssl.auxiliary.ctypes" require "resty.openssl.include.err" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local constchar_ptrptr = ffi.typeof("const char*[1]") local last_err_code = 0 local function get_last_error_code() local code = C.ERR_peek_last_error() last_err_code = code == 0 and last_err_code or code return last_err_code end local function get_lib_error_string(code) code = code or get_last_error_code() local msg = C.ERR_lib_error_string(code) if msg == nil then return "unknown library" end return ffi_str(msg) end local function get_reason_error_string(code) code = code or get_last_error_code() local msg = C.ERR_reason_error_string(code) if msg == nil then return "" end return ffi_str(msg) end local function format_error(ctx, code, all_errors) local errors = {} if code then table.insert(errors, string.format("code: %d", code or 0)) end local line = ctypes.ptr_of_int() local path = constchar_ptrptr() local func = constchar_ptrptr() -- get the OpenSSL errors while C.ERR_peek_error() ~= 0 do local code if all_errors then if OPENSSL_3X then code = C.ERR_get_error_all(path, line, func, nil, nil) else code = C.ERR_get_error_line(path, line) end else if OPENSSL_3X then code = C.ERR_peek_last_error_all(path, line, func, nil, nil) else code = C.ERR_peek_last_error_line(path, line) end end last_err_code = code local abs_path = ffi_str(path[0]) -- ../crypto/asn1/a_d2i_fp.c => crypto/asn1/a_d2i_fp.c local start = abs_path:find("/") if start then abs_path = abs_path:sub(start+1) end local err_line if OPENSSL_3X then local reason_msg = get_reason_error_string(code) local lib_msg = get_lib_error_string(code) -- error:04800065:PEM routines:PEM_do_header:bad decrypt:crypto/pem/pem_lib.c:467: err_line = string.format("error:%X:%s:%s:%s:%s:%d:", code, lib_msg, ffi_str(func[0]), reason_msg, abs_path, line[0]) else local buf = ffi.new('char[256]') C.ERR_error_string_n(code, buf, ffi_sizeof(buf)) err_line = string.format("%s:%d:%s", abs_path, line[0], ffi_str(buf)) end table.insert(errors, err_line) if not all_errors then break end end C.ERR_clear_error() if #errors > 0 then return string.format("%s%s%s", (ctx or ""), (ctx and ": " or ""), table.concat(errors, " ")) else return string.format("%s failed", ctx) end end local function format_all_error(ctx, code) return format_error(ctx, code, true) end return { format_error = format_error, format_all_error = format_all_error, get_last_error_code = get_last_error_code, get_lib_error_string = get_lib_error_string, get_reason_error_string = get_reason_error_string, } PKBN]V resty/openssl/rsa.luanu[local ffi = require "ffi" local C = ffi.C local bn_lib = require "resty.openssl.bn" local format_error = require("resty.openssl.err").format_error local _M = {} _M.params = {"n", "e", "d", "p", "q", "dmp1", "dmq1", "iqmp"} local empty_table = {} local bn_ptrptr_ct = ffi.typeof("const BIGNUM *[1]") function _M.get_parameters(rsa_st) -- {"n", "e", "d", "p", "q", "dmp1", "dmq1", "iqmp"} return setmetatable(empty_table, { __index = function(_, k) local ptr, ret ptr = bn_ptrptr_ct() if k == 'n' then C.RSA_get0_key(rsa_st, ptr, nil, nil) elseif k == 'e' then C.RSA_get0_key(rsa_st, nil, ptr, nil) elseif k == 'd' then C.RSA_get0_key(rsa_st, nil, nil, ptr) elseif k == 'p' then C.RSA_get0_factors(rsa_st, ptr, nil) elseif k == 'q' then C.RSA_get0_factors(rsa_st, nil, ptr) elseif k == 'dmp1' then C.RSA_get0_crt_params(rsa_st, ptr, nil, nil) elseif k == 'dmq1' then C.RSA_get0_crt_params(rsa_st, nil, ptr, nil) elseif k == 'iqmp' then C.RSA_get0_crt_params(rsa_st, nil, nil, ptr) else return nil, "rsa.get_parameters: unknown parameter \"" .. k .. "\" for RSA key" end ret = ptr[0] if ret == nil then return nil end return bn_lib.dup(ret) end }), nil end local function dup_bn_value(v) if not bn_lib.istype(v) then return nil, "expect value to be a bn instance" end local bn = C.BN_dup(v.ctx) if bn == nil then return nil, "BN_dup() failed" end return bn end function _M.set_parameters(rsa_st, opts) local err local opts_bn = {} -- remember which parts of BNs has been added to rsa_st, they should be freed -- by RSA_free and we don't cleanup them on failure local cleanup_from_idx = 1 -- dup input local do_set_key, do_set_factors, do_set_crt_params while true do -- luacheck: ignore for k, v in pairs(opts) do opts_bn[k], err = dup_bn_value(v) if err then -- luacheck: ignore err = "rsa.set_parameters: cannot process parameter \"" .. k .. "\":" .. err break end if k == "n" or k == "e" or k == "d" then do_set_key = true elseif k == "p" or k == "q" then do_set_factors = true elseif k == "dmp1" or k == "dmq1" or k == "iqmp" then do_set_crt_params = true end end -- "The values n and e must be non-NULL the first time this function is called on a given RSA object." -- thus we force to set them together local code if do_set_key then code = C.RSA_set0_key(rsa_st, opts_bn["n"], opts_bn["e"], opts_bn["d"]) if code == 0 then err = format_error("rsa.set_parameters: RSA_set0_key") break end end cleanup_from_idx = cleanup_from_idx + 3 if do_set_factors then code = C.RSA_set0_factors(rsa_st, opts_bn["p"], opts_bn["q"]) if code == 0 then err = format_error("rsa.set_parameters: RSA_set0_factors") break end end cleanup_from_idx = cleanup_from_idx + 2 if do_set_crt_params then code = C.RSA_set0_crt_params(rsa_st, opts_bn["dmp1"], opts_bn["dmq1"], opts_bn["iqmp"]) if code == 0 then err = format_error("rsa.set_parameters: RSA_set0_crt_params") break end end return true end for i, k in pairs(_M.params) do if i >= cleanup_from_idx then C.BN_free(opts_bn[k]) end end return false, err end return _M PKBN]gW--resty/openssl/kdf.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string require("resty.openssl.objects") require("resty.openssl.include.evp.md") -- used by legacy EVP_PKEY_derive interface require("resty.openssl.include.evp.pkey") local kdf_macro = require "resty.openssl.include.evp.kdf" local ctx_lib = require "resty.openssl.ctx" local format_error = require("resty.openssl.err").format_error local version_text = require("resty.openssl.version").version_text local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local ctypes = require "resty.openssl.auxiliary.ctypes" local nkeys = require "resty.openssl.auxiliary.compat".nkeys local log_warn = require "resty.openssl.auxiliary.compat".log_warn --[[ https://wiki.openssl.org/index.php/EVP_Key_Derivation OpenSSL 1.0.2 and above provides PBKDF2 by way of PKCS5_PBKDF2_HMAC and PKCS5_PBKDF2_HMAC_SHA1. OpenSSL 1.1.0 and above additionally provides HKDF and TLS1 PRF KDF by way of EVP_PKEY_derive and Scrypt by way of EVP_PBE_scrypt OpenSSL 1.1.1 and above additionally provides Scrypt by way of EVP_PKEY_derive. OpenSSL 3.0 additionally provides Single Step KDF, SSH KDF, PBKDF2, Scrypt, HKDF, ANSI X9.42 KDF, ANSI X9.63 KDF and TLS1 PRF KDF by way of EVP_KDF. From OpenSSL 3.0 the recommended way of performing key derivation is to use the EVP_KDF functions. If compatibility with OpenSSL 1.1.1 is required then a limited set of KDFs can be used via EVP_PKEY_derive. ]] local NID_id_pbkdf2 = C.OBJ_txt2nid("PBKDF2") assert(NID_id_pbkdf2 > 0) local NID_hkdf = C.OBJ_txt2nid("HKDF") assert(NID_hkdf > 0) local NID_tls1_prf = C.OBJ_txt2nid("TLS1-PRF") assert(NID_tls1_prf > 0) -- we use EVP_PBE_scrypt to do scrypt, so this is supported >= 1.1.0 local NID_id_scrypt = C.OBJ_txt2nid("id-scrypt") assert(NID_id_scrypt > 0) local _M = { HKDEF_MODE_EXTRACT_AND_EXPAND = kdf_macro.EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND, HKDEF_MODE_EXTRACT_ONLY = kdf_macro.EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY, HKDEF_MODE_EXPAND_ONLY = kdf_macro.EVP_PKEY_HKDEF_MODE_EXPAND_ONLY, PBKDF2 = NID_id_pbkdf2, SCRYPT = NID_id_scrypt, TLS1_PRF = NID_tls1_prf, HKDF = NID_hkdf, } local type_literals = { [NID_id_pbkdf2] = "PBKDF2", [NID_id_scrypt] = "scrypt", [NID_tls1_prf] = "TLS-1PRF", [NID_hkdf] = "HKDF", } local TYPE_NUMBER = 0x1 local TYPE_STRING = 0x2 local function check_options(opt, nid, field, typ, is_optional, required_only_if_nid) local v = opt[field] if not v then if is_optional or (required_only_if_nid and required_only_if_nid ~= nid) then return typ == TYPE_NUMBER and 0 or nil else return nil, "\"" .. field .. "\" must be set" end end if typ == TYPE_NUMBER then v = tonumber(v) if not typ then return nil, "except a number as \"" .. field .. "\"" end elseif typ == TYPE_STRING then if type(v) ~= "string" then return nil, "except a string as \"" .. field .. "\"" end else error("don't known how to check " .. typ, 2) end return v end local function check_hkdf_options(opt) local mode = opt.hkdf_mode if not mode then mode = _M.HKDEF_MODE_EXTRACT_AND_EXPAND end if mode == _M.HKDEF_MODE_EXTRACT_AND_EXPAND and ( not opt.salt or not opt.hkdf_info) then return '""salt" and "hkdf_info" are required for EXTRACT_AND_EXPAND mode' elseif mode == _M.HKDEF_MODE_EXTRACT_ONLY and not opt.salt then return '"salt" is required for EXTRACT_ONLY mode' elseif mode == _M.EVP_PKEY_HKDEF_MODE_EXPAND_ONLY and not opt.hkdf_info then return '"hkdf_info" is required for EXPAND_ONLY mode' end return nil end local options_schema = { outlen = { TYPE_NUMBER }, pass = { TYPE_STRING, true }, salt = { TYPE_STRING, true }, md = { TYPE_STRING, true }, -- pbkdf2 only pbkdf2_iter = { TYPE_NUMBER, true }, -- hkdf only hkdf_key = { TYPE_STRING, nil, NID_hkdf }, hkdf_mode = { TYPE_NUMBER, true }, hkdf_info = { TYPE_STRING, true }, -- tls1-prf tls1_prf_secret = { TYPE_STRING, nil, NID_tls1_prf }, tls1_prf_seed = { TYPE_STRING, nil, NID_tls1_prf }, -- scrypt only scrypt_maxmem = { TYPE_NUMBER, true }, scrypt_N = { TYPE_NUMBER, nil, NID_id_scrypt }, scrypt_r = { TYPE_NUMBER, nil, NID_id_scrypt }, scrypt_p = { TYPE_NUMBER, nil, NID_id_scrypt }, } local outlen = ctypes.ptr_of_size_t() function _M.derive(options) local typ = options.type if not typ then return nil, "kdf.derive: \"type\" must be set" elseif type(typ) ~= "number" then return nil, "kdf.derive: expect a number as \"type\"" end if typ <= 0 then return nil, "kdf.derive: kdf type " .. (type_literals[typ] or tostring(typ)) .. " not supported in " .. version_text end for k, v in pairs(options_schema) do -- don't use unpack here to avoid nil truncation local v, err = check_options(options, typ, k, v[1],v[2],v[3]) if err then return nil, "kdf.derive: " .. err end options[k] = v end if typ == NID_hkdf then local err = check_hkdf_options(options) if err then return nil, "kdf.derive: " .. err end end local salt_len = 0 if options.salt then salt_len = #options.salt end local pass_len = 0 if options.pass then pass_len = #options.pass end local md if OPENSSL_3X then md = C.EVP_MD_fetch(ctx_lib.get_libctx(), options.md or 'sha1', options.properties) else md = C.EVP_get_digestbyname(options.md or 'sha1') end if md == nil then return nil, string.format("kdf.derive: invalid digest type \"%s\"", md) end local buf = ctypes.uchar_array(options.outlen) -- begin legacay low level routines local code if typ == NID_id_pbkdf2 then -- https://www.openssl.org/docs/man1.1.0/man3/PKCS5_PBKDF2_HMAC.html local iter = options.pbkdf2_iter if iter < 1 then iter = 1 end code = C.PKCS5_PBKDF2_HMAC( options.pass, pass_len, options.salt, salt_len, iter, md, options.outlen, buf ) elseif typ == NID_id_scrypt then code = C.EVP_PBE_scrypt( options.pass, pass_len, options.salt, salt_len, options.scrypt_N, options.scrypt_r, options.scrypt_p, options.scrypt_maxmem, buf, options.outlen ) elseif typ ~= NID_tls1_prf and typ ~= NID_hkdf then return nil, string.format("kdf.derive: unknown type %d", typ) end if code then if code ~= 1 then return nil, format_error("kdf.derive") else return ffi_str(buf, options.outlen) end end -- end legacay low level routines -- begin EVP_PKEY_derive routines outlen[0] = options.outlen local ctx = C.EVP_PKEY_CTX_new_id(typ, nil) if ctx == nil then return nil, format_error("kdf.derive: EVP_PKEY_CTX_new_id") end ffi_gc(ctx, C.EVP_PKEY_CTX_free) if C.EVP_PKEY_derive_init(ctx) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_derive_init") end if typ == NID_tls1_prf then if kdf_macro.EVP_PKEY_CTX_set_tls1_prf_md(ctx, md) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_CTX_set_tls1_prf_md") end if kdf_macro.EVP_PKEY_CTX_set1_tls1_prf_secret(ctx, options.tls1_prf_secret) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_CTX_set1_tls1_prf_secret") end if kdf_macro.EVP_PKEY_CTX_add1_tls1_prf_seed(ctx, options.tls1_prf_seed) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_CTX_add1_tls1_prf_seed") end elseif typ == NID_hkdf then if kdf_macro.EVP_PKEY_CTX_set_hkdf_md(ctx, md) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_CTX_set_hkdf_md") end if options.salt and kdf_macro.EVP_PKEY_CTX_set1_hkdf_salt(ctx, options.salt) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_CTX_set1_hkdf_salt") end if options.hkdf_key and kdf_macro.EVP_PKEY_CTX_set1_hkdf_key(ctx, options.hkdf_key) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_CTX_set1_hkdf_key") end if options.hkdf_info and kdf_macro.EVP_PKEY_CTX_add1_hkdf_info(ctx, options.hkdf_info) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_CTX_add1_hkdf_info") end if options.hkdf_mode then if kdf_macro.EVP_PKEY_CTX_set_hkdf_mode(ctx, options.hkdf_mode) ~= 1 then return nil, format_error("kdf.derive: EVP_PKEY_CTX_set_hkdf_mode") end if options.hkdf_mode == _M.HKDEF_MODE_EXTRACT_ONLY then local md_size = OPENSSL_3X and C.EVP_MD_get_size(md) or C.EVP_MD_size(md) if options.outlen ~= md_size then options.outlen = md_size log_warn("hkdf_mode EXTRACT_ONLY outputs fixed length of ", md_size, " key, ignoring options.outlen") end outlen[0] = md_size buf = ctypes.uchar_array(md_size) end end else return nil, string.format("kdf.derive: unknown type %d", typ) end code = C.EVP_PKEY_derive(ctx, buf, outlen) if code == -2 then return nil, "kdf.derive: operation is not supported by the public key algorithm" end -- end EVP_PKEY_derive routines return ffi_str(buf, options.outlen) end if not OPENSSL_3X then return _M end _M.derive_legacy = _M.derive _M.derive = nil -- OPENSSL 3.0 style API local param_lib = require "resty.openssl.param" local SIZE_MAX = ctypes.SIZE_MAX local mt = {__index = _M} local kdf_ctx_ptr_ct = ffi.typeof('EVP_KDF_CTX*') function _M.new(typ, properties) local algo = C.EVP_KDF_fetch(ctx_lib.get_libctx(), typ, properties) if algo == nil then return nil, format_error(string.format("mac.new: invalid mac type \"%s\"", typ)) end ffi_gc(algo, C.EVP_KDF_free) local ctx = C.EVP_KDF_CTX_new(algo) if ctx == nil then return nil, "mac.new: failed to create EVP_MAC_CTX" end ffi_gc(ctx, C.EVP_KDF_CTX_free) local buf local buf_size = tonumber(C.EVP_KDF_CTX_get_kdf_size(ctx)) if buf_size == SIZE_MAX then -- no fixed size buf_size = nil else buf = ctypes.uchar_array(buf_size) end return setmetatable({ ctx = ctx, algo = algo, buf = buf, buf_size = buf_size, schema = nil, }, mt), nil end function _M.istype(l) return l and l.ctx and ffi.istype(kdf_ctx_ptr_ct, l.ctx) end function _M:get_provider_name() local p = C.EVP_KDF_get0_provider(self.algo) if p == nil then return nil end return ffi_str(C.OSSL_PROVIDER_get0_name(p)) end _M.settable_params, _M.set_params, _M.gettable_params, _M.get_param = param_lib.get_params_func("EVP_KDF_CTX") function _M:derive(outlen, options, options_count) if not _M.istype(self) then return _M.derive_legacy(self) end if self.buf_size and outlen then return nil, string.format("kdf:derive: this KDF has fixed output size %d, ".. "it can't be set manually", self.buf_size) end outlen = self.buf_size or outlen local buf = self.buf or ctypes.uchar_array(outlen) if options_count then options_count = options_count else options_count = nkeys(options) end local param, err if options_count > 0 then if not self.schema then self.schema = self:settable_params(true) -- raw schema end param, err = param_lib.construct(options, nil, self.schema) if err then return nil, "kdf:derive: " .. err end end if C.EVP_KDF_derive(self.ctx, buf, outlen, param) ~= 1 then return nil, format_error("kdf:derive") end return ffi_str(buf, outlen) end function _M:reset() C.EVP_KDF_CTX_reset(self.ctx) return true end return _M PKCN]+resty/openssl/crypto.luanu[local ffi = require "ffi" local ffi_cast = ffi.cast local C = ffi.C require "resty.openssl.include.crypto" local _M = {} function _M.memcmp(a, b, len) if type(len) ~= "number" or len < 1 then return nil, "crypto:memcmp arg 'len' must be a number > 0" end if type(a) ~= "string" and type(a) ~= "cdata" then return nil, "crypto:memcmp only strings and cdata types are supported" end return C.CRYPTO_memcmp(ffi_cast("void*", a), ffi_cast("void*", b), len) end return _M PKCN]@f resty/openssl/provider.luanu[local ffi = require "ffi" local C = ffi.C require "resty.openssl.include.provider" local param_lib = require "resty.openssl.param" local ctx_lib = require "resty.openssl.ctx" local null = require("resty.openssl.auxiliary.ctypes").null local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local format_error = require("resty.openssl.err").format_error if not OPENSSL_3X then error("provider is only supported since OpenSSL 3.0") end local _M = {} local mt = {__index = _M} local ossl_provider_ctx_ct = ffi.typeof('OSSL_PROVIDER*') function _M.load(name, try) local ctx local libctx = ctx_lib.get_libctx() if try then ctx = C.OSSL_PROVIDER_try_load(libctx, name) if ctx == nil then return nil, format_error("provider.try_load") end else ctx = C.OSSL_PROVIDER_load(libctx, name) if ctx == nil then return nil, format_error("provider.load") end end return setmetatable({ ctx = ctx, param_types = nil, }, mt), nil end function _M.set_default_search_path(path) C.OSSL_PROVIDER_set_default_search_path(ctx_lib.get_libctx(), path) end function _M.is_available(name) return C.OSSL_PROVIDER_available(ctx_lib.get_libctx(), name) == 1 end function _M.istype(l) return l and l.ctx and ffi.istype(ossl_provider_ctx_ct, l.ctx) end function _M:unload() if C.OSSL_PROVIDER_unload(self.ctx) == nil then return false, format_error("provider:unload") end return true end function _M:self_test() if C.OSSL_PROVIDER_self_test(self.ctx) == nil then return false, format_error("provider:self_test") end return true end local params_well_known = { -- Well known parameter names that core passes to providers ["openssl-version"] = param_lib.OSSL_PARAM_UTF8_PTR, ["provider-name"] = param_lib.OSSL_PARAM_UTF8_PTR, ["module-filename"] = param_lib.OSSL_PARAM_UTF8_PTR, -- Well known parameter names that Providers can define ["name"] = param_lib.OSSL_PARAM_UTF8_PTR, ["version"] = param_lib.OSSL_PARAM_UTF8_PTR, ["buildinfo"] = param_lib.OSSL_PARAM_UTF8_PTR, ["status"] = param_lib.OSSL_PARAM_INTEGER, ["security-checks"] = param_lib.OSSL_PARAM_INTEGER, } local function load_gettable_names(ctx) local schema = {} for k, v in pairs(params_well_known) do schema[k] = v end local err schema, err = param_lib.parse_params_schema( C.OSSL_PROVIDER_gettable_params(ctx), schema) if err then return nil, err end return schema end function _M:get_params(...) local keys = {...} local key_length = #keys if key_length == 0 then return nil, "provider:get_params: at least one key is required" end if not self.param_types then local param_types, err = load_gettable_names(self.ctx) if err then return nil, "provider:get_params: " .. err end self.param_types = param_types end local buffers = {} for _, key in ipairs(keys) do buffers[key] = null end local req, err = param_lib.construct(buffers, key_length, self.param_types) if not req then return nil, "provider:get_params: failed to construct params: " .. err end if C.OSSL_PROVIDER_get_params(self.ctx, req) ~= 1 then return nil, format_error("provider:get_params") end buffers, err = param_lib.parse(buffers, key_length, self.param_types) if err then return nil, "provider:get_params: failed to parse params: " .. err end if key_length == 1 then return buffers[keys[1]] end return buffers end return _M PKCN]ȵIIresty/openssl/include/pem.luanu[ local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ // all pem_password_cb* has been modified to pem_password_cb to avoid a table overflow issue typedef int (*pem_password_cb)(char *buf, int size, int rwflag, void *userdata); EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, // the following signature has been modified to avoid ffi.cast pem_password_cb cb, const char *u); // pem_password_cb *cb, void *u); EVP_PKEY *PEM_read_bio_PUBKEY(BIO *bp, EVP_PKEY **x, // the following signature has been modified to avoid ffi.cast pem_password_cb cb, const char *u); // pem_password_cb *cb, void *u); int PEM_write_bio_PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen, pem_password_cb *cb, void *u); int PEM_write_bio_PUBKEY(BIO *bp, EVP_PKEY *x); RSA *PEM_read_bio_RSAPrivateKey(BIO *bp, RSA **x, // the following signature has been modified to avoid ffi.cast pem_password_cb cb, const char *u); // pem_password_cb *cb, void *u); RSA *PEM_read_bio_RSAPublicKey(BIO *bp, RSA **x, // the following signature has been modified to avoid ffi.cast pem_password_cb cb, const char *u); // pem_password_cb *cb, void *u); int PEM_write_bio_RSAPrivateKey(BIO *bp, RSA *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen, pem_password_cb *cb, void *u); int PEM_write_bio_RSAPublicKey(BIO *bp, RSA *x); X509_REQ *PEM_read_bio_X509_REQ(BIO *bp, X509_REQ **x, pem_password_cb cb, void *u); int PEM_write_bio_X509_REQ(BIO *bp, X509_REQ *x); X509_CRL *PEM_read_bio_X509_CRL(BIO *bp, X509_CRL **x, pem_password_cb cb, void *u); int PEM_write_bio_X509_CRL(BIO *bp, X509_CRL *x); X509 *PEM_read_bio_X509(BIO *bp, X509 **x, pem_password_cb cb, void *u); int PEM_write_bio_X509(BIO *bp, X509 *x); DH *PEM_read_bio_DHparams(BIO *bp, DH **x, pem_password_cb cb, void *u); int PEM_write_bio_DHparams(BIO *bp, DH *x); EC_GROUP *PEM_read_bio_ECPKParameters(BIO *bp, EC_GROUP **x, pem_password_cb cb, void *u); int PEM_write_bio_ECPKParameters(BIO *bp, const EC_GROUP *x); ]] PKCN]^dW resty/openssl/include/ssl.luanu[local ffi = require "ffi" local C = ffi.C require "resty.openssl.include.ossl_typ" require "resty.openssl.include.stack" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ // SSL_METHOD typedef struct ssl_method_st SSL_METHOD; // const SSL_METHOD *TLS_method(void); const SSL_METHOD *TLS_server_method(void); // SSL_CIPHER typedef struct ssl_cipher_st SSL_CIPHER; const char *SSL_CIPHER_get_name(const SSL_CIPHER *cipher); SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl); SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth); void SSL_CTX_free(SSL_CTX *a); // SSL_SESSION typedef struct ssl_session_st SSL_SESSION; SSL_SESSION *SSL_get_session(const SSL *ssl); long SSL_SESSION_set_timeout(SSL_SESSION *s, long t); long SSL_SESSION_get_timeout(const SSL_SESSION *s); typedef int (*SSL_CTX_alpn_select_cb_func)(SSL *ssl, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg); void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, SSL_CTX_alpn_select_cb_func cb, void *arg); int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsigned char *server, unsigned int server_len, const unsigned char *client, unsigned int client_len); SSL *SSL_new(SSL_CTX *ctx); void SSL_free(SSL *ssl); int SSL_set_cipher_list(SSL *ssl, const char *str); int SSL_set_ciphersuites(SSL *s, const char *str); long SSL_set_options(SSL *ssl, long options); long SSL_clear_options(SSL *ssl, long options); long SSL_get_options(SSL *ssl); /*STACK_OF(SSL_CIPHER)*/ OPENSSL_STACK *SSL_get_ciphers(const SSL *ssl); // /*STACK_OF(SSL_CIPHER)*/ OPENSSL_STACK *SSL_CTX_get_ciphers(const SSL_CTX *ctx); OPENSSL_STACK *SSL_get_peer_cert_chain(const SSL *ssl); typedef int (*verify_callback)(int preverify_ok, X509_STORE_CTX *x509_ctx); void SSL_set_verify(SSL *s, int mode, int (*verify_callback)(int, X509_STORE_CTX *)); int SSL_add_client_CA(SSL *ssl, X509 *cacert); long SSL_ctrl(SSL *ssl, int cmd, long larg, void *parg); ]] if OPENSSL_3X then ffi.cdef [[ X509 *SSL_get1_peer_certificate(const SSL *ssl); ]] else ffi.cdef [[ X509 *SSL_get_peer_certificate(const SSL *ssl); ]] end local SSL_CTRL_SET_MIN_PROTO_VERSION = 123 local SSL_CTRL_SET_MAX_PROTO_VERSION = 124 local SSL_set_min_proto_version = function(ctx, version) return C.SSL_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, nil) end local SSL_set_max_proto_version = function(ctx, version) return C.SSL_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, nil) end return { SSL_set_min_proto_version = SSL_set_min_proto_version, SSL_set_max_proto_version = SSL_set_max_proto_version, } PKCN]yresty/openssl/include/hmac.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.evp" ffi.cdef [[ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, const EVP_MD *md, ENGINE *impl); int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len); int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len); HMAC_CTX *HMAC_CTX_new(void); void HMAC_CTX_free(HMAC_CTX *ctx); ]] PKCN]^~resty/openssl/include/evp.luanu[local ffi = require "ffi" local C = ffi.C local bit = require("bit") require "resty.openssl.include.ossl_typ" require "resty.openssl.include.err" require "resty.openssl.include.objects" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ /* KDF */ int PKCS5_PBKDF2_HMAC(const char *pass, int passlen, const unsigned char *salt, int saltlen, int iter, const EVP_MD *digest, int keylen, unsigned char *out); int EVP_PBE_scrypt(const char *pass, size_t passlen, const unsigned char *salt, size_t saltlen, uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem, unsigned char *key, size_t keylen); ]] if OPENSSL_3X then require "resty.openssl.include.provider" ffi.cdef [[ int EVP_set_default_properties(OSSL_LIB_CTX *libctx, const char *propq); int EVP_default_properties_enable_fips(OSSL_LIB_CTX *libctx, int enable); int EVP_default_properties_is_fips_enabled(OSSL_LIB_CTX *libctx); // const OSSL_PROVIDER *EVP_RAND_get0_provider(const EVP_RAND *rand); // EVP_RAND *EVP_RAND_fetch(OSSL_LIB_CTX *libctx, const char *algorithm, // const char *properties); ]] end local EVP_PKEY_ALG_CTRL = 0x1000 local _M = { EVP_PKEY_RSA = C.OBJ_txt2nid("rsaEncryption"), EVP_PKEY_DH = C.OBJ_txt2nid("dhKeyAgreement"), EVP_PKEY_EC = C.OBJ_txt2nid("id-ecPublicKey"), EVP_PKEY_X25519 = C.OBJ_txt2nid("X25519"), EVP_PKEY_ED25519 = C.OBJ_txt2nid("ED25519"), EVP_PKEY_X448 = C.OBJ_txt2nid("X448"), EVP_PKEY_ED448 = C.OBJ_txt2nid("ED448"), EVP_CTRL_AEAD_SET_IVLEN = 0x9, EVP_CTRL_AEAD_GET_TAG = 0x10, EVP_CTRL_AEAD_SET_TAG = 0x11, -- remove EVP_PKEY_OP_* and EVP_PKEY_CTRL_* after openssl 1.1.1 support is dropped EVP_PKEY_OP_PARAMGEN = not OPENSSL_3X and bit.lshift(1, 1) or nil, EVP_PKEY_OP_KEYGEN = not OPENSSL_3X and bit.lshift(1, 2) or nil, EVP_PKEY_OP_SIGN = not OPENSSL_3X and bit.lshift(1, 3) or nil, EVP_PKEY_OP_VERIFY = not OPENSSL_3X and bit.lshift(1, 4) or nil, EVP_PKEY_OP_VERIFYRECOVER = not OPENSSL_3X and bit.lshift(1, 5) or nil, EVP_PKEY_OP_SIGNCTX = not OPENSSL_3X and bit.lshift(1, 6) or nil, EVP_PKEY_OP_VERIFYCTX = not OPENSSL_3X and bit.lshift(1, 7) or nil, EVP_PKEY_OP_ENCRYPT = not OPENSSL_3X and bit.lshift(1, 8) or nil, EVP_PKEY_OP_DECRYPT = not OPENSSL_3X and bit.lshift(1, 9) or nil, EVP_PKEY_OP_DERIVE = not OPENSSL_3X and bit.lshift(1, 10) or nil, EVP_PKEY_ALG_CTRL = EVP_PKEY_ALG_CTRL, EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN = EVP_PKEY_ALG_CTRL + 1, EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID = EVP_PKEY_ALG_CTRL + 1, EVP_PKEY_CTRL_EC_PARAM_ENC = EVP_PKEY_ALG_CTRL + 2, EVP_PKEY_CTRL_RSA_KEYGEN_BITS = EVP_PKEY_ALG_CTRL + 3, EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP = EVP_PKEY_ALG_CTRL + 4, EVP_PKEY_CTRL_RSA_PADDING = EVP_PKEY_ALG_CTRL + 1, EVP_PKEY_CTRL_RSA_PSS_SALTLEN = EVP_PKEY_ALG_CTRL + 2, EVP_PKEY_CTRL_RSA_MGF1_MD = EVP_PKEY_ALG_CTRL + 5, EVP_PKEY_CTRL_RSA_OAEP_MD = EVP_PKEY_ALG_CTRL + 9, EVP_PKEY_CTRL_TLS_MD = EVP_PKEY_ALG_CTRL, EVP_PKEY_CTRL_TLS_SECRET = EVP_PKEY_ALG_CTRL + 1, EVP_PKEY_CTRL_TLS_SEED = EVP_PKEY_ALG_CTRL + 2, EVP_PKEY_CTRL_HKDF_MD = EVP_PKEY_ALG_CTRL + 3, EVP_PKEY_CTRL_HKDF_SALT = EVP_PKEY_ALG_CTRL + 4, EVP_PKEY_CTRL_HKDF_KEY = EVP_PKEY_ALG_CTRL + 5, EVP_PKEY_CTRL_HKDF_INFO = EVP_PKEY_ALG_CTRL + 6, EVP_PKEY_CTRL_HKDF_MODE = EVP_PKEY_ALG_CTRL + 7, EVP_PKEY_CTRL_PASS = EVP_PKEY_ALG_CTRL + 8, EVP_PKEY_CTRL_SCRYPT_SALT = EVP_PKEY_ALG_CTRL + 9, EVP_PKEY_CTRL_SCRYPT_N = EVP_PKEY_ALG_CTRL + 10, EVP_PKEY_CTRL_SCRYPT_R = EVP_PKEY_ALG_CTRL + 11, EVP_PKEY_CTRL_SCRYPT_P = EVP_PKEY_ALG_CTRL + 12, EVP_PKEY_CTRL_SCRYPT_MAXMEM_BYTES = EVP_PKEY_ALG_CTRL + 13, } local OSSL_KEYMGMT_SELECT_PRIVATE_KEY = 0x01 local OSSL_KEYMGMT_SELECT_PUBLIC_KEY = 0x02 local OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS = 0x04 local OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS = 0x80 local OSSL_KEYMGMT_SELECT_ALL_PARAMETERS = OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS + OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS -- local OSSL_KEYMGMT_SELECT_KEYPAIR = OSSL_KEYMGMT_SELECT_PRIVATE_KEY + -- OSSL_KEYMGMT_SELECT_PUBLIC_KEY -- local OSSL_KEYMGMT_SELECT_ALL = OSSL_KEYMGMT_SELECT_KEYPAIR + -- OSSL_KEYMGMT_SELECT_ALL_PARAMETERS if not OPENSSL_3X then _M.EVP_PKEY_OP_CRYPT = _M.EVP_PKEY_OP_ENCRYPT + _M.EVP_PKEY_OP_DECRYPT _M.EVP_PKEY_OP_SIG = _M.EVP_PKEY_OP_SIGN + _M.EVP_PKEY_OP_VERIFY + _M.EVP_PKEY_OP_VERIFYRECOVER + _M.EVP_PKEY_OP_SIGNCTX + _M.EVP_PKEY_OP_VERIFYCTX else _M.EVP_PKEY_KEY_PARAMETERS = OSSL_KEYMGMT_SELECT_ALL_PARAMETERS _M.EVP_PKEY_PUBLIC_KEY = _M.EVP_PKEY_KEY_PARAMETERS + OSSL_KEYMGMT_SELECT_PUBLIC_KEY _M.EVP_PKEY_KEYPAIR = _M.EVP_PKEY_PUBLIC_KEY + OSSL_KEYMGMT_SELECT_PRIVATE_KEY end -- clean up error occurs during OBJ_txt2* C.ERR_clear_error() _M.ecx_curves = { Ed25519 = _M.EVP_PKEY_ED25519, X25519 = _M.EVP_PKEY_X25519, Ed448 = _M.EVP_PKEY_ED448, X448 = _M.EVP_PKEY_X448, } return _M PKCN]hresty/openssl/include/ecdsa.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ ECDSA_SIG *ECDSA_SIG_new(void); void ECDSA_SIG_free(ECDSA_SIG *sig); void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps); int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s); int i2d_ECDSA_SIG(const ECDSA_SIG *sig, unsigned char **pp); ECDSA_SIG *d2i_ECDSA_SIG(ECDSA_SIG **sig, const unsigned char **pp, long len); int EC_GROUP_order_bits(const EC_GROUP *group); ]] PKCN]Presty/openssl/include/conf.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ CONF *NCONF_new(CONF_METHOD *meth); void NCONF_free(CONF *conf); int NCONF_load_bio(CONF *conf, BIO *bp, long *eline); ]]PKCN]* resty/openssl/include/bn.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" local BN_ULONG if ffi.abi('64bit') then BN_ULONG = 'unsigned long long' else -- 32bit BN_ULONG = 'unsigned int' end ffi.cdef( [[ BIGNUM *BN_new(void); void BN_free(BIGNUM *a); BN_CTX *BN_CTX_new(void); // void BN_CTX_init(BN_CTX *c); void BN_CTX_free(BN_CTX *c); BIGNUM *BN_dup(const BIGNUM *a); int BN_add_word(BIGNUM *a, ]] .. BN_ULONG ..[[ w); int BN_set_word(BIGNUM *a, ]] .. BN_ULONG ..[[ w); ]] .. BN_ULONG ..[[ BN_get_word(BIGNUM *a); int BN_num_bits(const BIGNUM *a); BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret); int BN_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen); int BN_hex2bn(BIGNUM **a, const char *str); int BN_dec2bn(BIGNUM **a, const char *str); int BN_bn2bin(const BIGNUM *a, unsigned char *to); char *BN_bn2hex(const BIGNUM *a); char *BN_bn2dec(const BIGNUM *a); int BN_bn2mpi(const BIGNUM *a, unsigned char *to); BIGNUM *BN_mpi2bn(const unsigned char *s, int len, BIGNUM *ret); void BN_set_negative(BIGNUM *a, int n); int BN_is_negative(const BIGNUM *a); int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b); int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b); int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx); int BN_sqr(BIGNUM *r, BIGNUM *a, BN_CTX *ctx); int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *a, const BIGNUM *d, BN_CTX *ctx); int BN_mod_add(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx); int BN_mod_sub(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx); int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx); int BN_mod_sqr(BIGNUM *ret, BIGNUM *a, const BIGNUM *m, BN_CTX *ctx); int BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BN_CTX *ctx); int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx); int BN_gcd(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx); int BN_lshift(BIGNUM *r, const BIGNUM *a, int n); int BN_rshift(BIGNUM *r, BIGNUM *a, int n); int BN_cmp(BIGNUM *a, BIGNUM *b); int BN_ucmp(BIGNUM *a, BIGNUM *b); int BN_is_zero(BIGNUM *a); int BN_is_one(BIGNUM *a); int BN_is_word(BIGNUM *a, ]] .. BN_ULONG ..[[ w); int BN_is_odd(BIGNUM *a); int BN_is_prime_ex(const BIGNUM *p,int nchecks, BN_CTX *ctx, BN_GENCB *cb); int BN_generate_prime_ex(BIGNUM *ret,int bits,int safe, const BIGNUM *add, const BIGNUM *rem, BN_GENCB *cb); ]] )PKDN]U$"resty/openssl/include/x509/csr.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.evp" require "resty.openssl.include.objects" require "resty.openssl.include.x509" require "resty.openssl.include.stack" local asn1_macro = require "resty.openssl.include.asn1" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X asn1_macro.declare_asn1_functions("X509_REQ", asn1_macro.has_new_ex) ffi.cdef [[ int X509_REQ_set_subject_name(X509_REQ *req, X509_NAME *name); EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req); int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey); int X509_REQ_set_version(X509_REQ *x, long version); int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc); X509_EXTENSION *X509_CRL_get_ext(const X509_CRL *x, int loc); int X509_CRL_get_ext_by_NID(const X509_CRL *x, int nid, int lastpos); int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp); void X509_ATTRIBUTE_free(X509_ATTRIBUTE *a); // int X509_REQ_get_attr_count(const X509_REQ *req); // int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos); X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc); // int *X509_REQ_get_extension_nids(void); int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md); int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r); int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req); X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **req); // STACK_OF(X509_EXTENSION) OPENSSL_STACK *X509_REQ_get_extensions(X509_REQ *req); // STACK_OF(X509_EXTENSION) int X509_REQ_add_extensions(X509_REQ *req, OPENSSL_STACK *exts); int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k); X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req); long X509_REQ_get_version(const X509_REQ *req); int X509_REQ_get_signature_nid(const X509_REQ *crl); ]] if OPENSSL_3X then ffi.cdef [[ // int X509_REQ_verify_ex(X509_REQ *a, EVP_PKEY *pkey, OSSL_LIB_CTX *libctx, // const char *propq); ]] end PKDN]<ւ&resty/openssl/include/x509/revoked.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.asn1" require "resty.openssl.include.objects" local asn1_macro = require "resty.openssl.include.asn1" asn1_macro.declare_asn1_functions("X509_REVOKED") ffi.cdef [[ int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial); int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm); int X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc); const ASN1_INTEGER *X509_REVOKED_get0_serialNumber(const X509_REVOKED *r); const ASN1_TIME *X509_REVOKED_get0_revocationDate(const X509_REVOKED *r); ]]PKDN]"resty/openssl/include/x509/crl.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.evp" require "resty.openssl.include.objects" require "resty.openssl.include.x509" require "resty.openssl.include.stack" local asn1_macro = require "resty.openssl.include.asn1" asn1_macro.declare_asn1_functions("X509_CRL", asn1_macro.has_new_ex) ffi.cdef [[ X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl); int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name); int X509_CRL_set_version(X509_CRL *x, long version); int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc); X509_EXTENSION *X509_CRL_get_ext(const X509_CRL *x, int loc); int X509_CRL_get_ext_by_NID(const X509_CRL *x, int nid, int lastpos); // void *X509_CRL_get_ext_d2i(const X509_CRL *x, int nid, int *crit, int *idx); int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md); int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r); int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl); X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl); int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev); int X509_CRL_print(BIO *bio, X509_CRL *crl); int X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial); // int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x); //STACK_OF(X509_REVOKED) OPENSSL_STACK *X509_CRL_get_REVOKED(X509_CRL *crl); int X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial); int X509_CRL_set1_lastUpdate(X509_CRL *x, const ASN1_TIME *tm); int X509_CRL_set1_nextUpdate(X509_CRL *x, const ASN1_TIME *tm); /*const*/ ASN1_TIME *X509_CRL_get0_lastUpdate(const X509_CRL *crl); /*const*/ ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl); long X509_CRL_get_version(const X509_CRL *crl); X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc); int X509_CRL_get_signature_nid(const X509_CRL *crl); ]] PKDN]P))(resty/openssl/include/x509/extension.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.x509v3" require "resty.openssl.include.x509" local asn1_macro = require "resty.openssl.include.asn1" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X asn1_macro.declare_asn1_functions("X509_EXTENSION") if OPENSSL_3X then ffi.cdef [[ struct v3_ext_ctx { int flags; X509 *issuer_cert; X509 *subject_cert; X509_REQ *subject_req; X509_CRL *crl; /*X509V3_CONF_METHOD*/ void *db_meth; void *db; EVP_PKEY *issuer_pkey; }; int X509V3_set_issuer_pkey(X509V3_CTX *ctx, EVP_PKEY *pkey); ]] else ffi.cdef [[ struct v3_ext_ctx { int flags; X509 *issuer_cert; X509 *subject_cert; X509_REQ *subject_req; X509_CRL *crl; /*X509V3_CONF_METHOD*/ void *db_meth; void *db; }; ]] end ffi.cdef [[ int X509_EXTENSION_set_data(X509_EXTENSION *ex, ASN1_OCTET_STRING *data); int X509_EXTENSION_set_object(X509_EXTENSION *ex, const ASN1_OBJECT *obj); ]]PKDN]U`kKK#resty/openssl/include/x509/name.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.asn1" require "resty.openssl.include.objects" local asn1_macro = require "resty.openssl.include.asn1" asn1_macro.declare_asn1_functions("X509_NAME") ffi.cdef [[ int X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, int type, const unsigned char *bytes, int len, int loc, int set); int X509_NAME_entry_count(const X509_NAME *name); X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc); ASN1_OBJECT *X509_NAME_ENTRY_get_object(const X509_NAME_ENTRY *ne); ASN1_STRING * X509_NAME_ENTRY_get_data(const X509_NAME_ENTRY *ne); int X509_NAME_get_index_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, int lastpos); ]]PKDN]Jx #resty/openssl/include/x509/init.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.bio" require "resty.openssl.include.pem" require "resty.openssl.include.stack" local asn1_macro = require "resty.openssl.include.asn1" asn1_macro.declare_asn1_functions("X509", asn1_macro.has_new_ex) ffi.cdef [[ int i2d_X509_bio(BIO *bp, X509 *x509); X509 *d2i_X509_bio(BIO *bp, X509 **x509); // STACK_OF(X509) OPENSSL_STACK *X509_chain_up_ref(OPENSSL_STACK *chain); int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md); int X509_verify(X509 *a, EVP_PKEY *r); ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj); int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc); X509_EXTENSION *X509_get_ext(const X509 *x, int loc); int X509_get_ext_by_NID(const X509 *x, int nid, int lastpos); void *X509_get_ext_d2i(const X509 *x, int nid, int *crit, int *idx); int X509_EXTENSION_set_critical(X509_EXTENSION *ex, int crit); int X509_EXTENSION_get_critical(const X509_EXTENSION *ex); ASN1_OBJECT *X509_EXTENSION_get_object(X509_EXTENSION *ex); ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ne); X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc); X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex, int nid, int crit, ASN1_OCTET_STRING *data); // needed by pkey EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a); EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a); int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey); int i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey); EVP_PKEY *X509_get_pubkey(X509 *x); int X509_set_pubkey(X509 *x, EVP_PKEY *pkey); int X509_set_version(X509 *x, long version); int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial); X509_NAME *X509_get_subject_name(const X509 *a); int X509_set_subject_name(X509 *x, X509_NAME *name); X509_NAME *X509_get_issuer_name(const X509 *a); int X509_set_issuer_name(X509 *x, X509_NAME *name); int X509_pubkey_digest(const X509 *data, const EVP_MD *type, unsigned char *md, unsigned int *len); int X509_digest(const X509 *data, const EVP_MD *type, unsigned char *md, unsigned int *len); const char *X509_verify_cert_error_string(long n); int X509_verify_cert(X509_STORE_CTX *ctx); int X509_get_signature_nid(const X509 *x); unsigned char *X509_alias_get0(X509 *x, int *len); // unsigned char *X509_keyid_get0(X509 *x, int *len); int X509_check_private_key(X509 *x, EVP_PKEY *k); int X509_up_ref(X509 *a); int X509_set1_notBefore(X509 *x, const ASN1_TIME *tm); int X509_set1_notAfter(X509 *x, const ASN1_TIME *tm); /*const*/ ASN1_TIME *X509_get0_notBefore(const X509 *x); /*const*/ ASN1_TIME *X509_get0_notAfter(const X509 *x); long X509_get_version(const X509 *x); const ASN1_INTEGER *X509_get0_serialNumber(X509 *x); X509_EXTENSION *X509_delete_ext(X509 *x, int loc); ]] PKDN]g&resty/openssl/include/x509/altname.luanu[local GEN_OTHERNAME = 0 local GEN_EMAIL = 1 local GEN_DNS = 2 local GEN_X400 = 3 local GEN_DIRNAME = 4 local GEN_EDIPARTY = 5 local GEN_URI = 6 local GEN_IPADD = 7 local GEN_RID = 8 local default_types = { OtherName = GEN_OTHERNAME, -- otherName RFC822Name = GEN_EMAIL, -- email RFC822 = GEN_EMAIL, Email = GEN_EMAIL, DNSName = GEN_DNS, -- dns DNS = GEN_DNS, X400 = GEN_X400, -- x400 DirName = GEN_DIRNAME, -- dirName EdiParty = GEN_EDIPARTY, -- EdiParty UniformResourceIdentifier = GEN_URI, -- uri URI = GEN_URI, IPAddress = GEN_IPADD, -- ipaddr IP = GEN_IPADD, RID = GEN_RID, -- rid } local literals = { [GEN_OTHERNAME] = "OtherName", [GEN_EMAIL] = "email", [GEN_DNS] = "DNS", [GEN_X400] = "X400", [GEN_DIRNAME] = "DirName", [GEN_EDIPARTY] = "EdiParty", [GEN_URI] = "URI", [GEN_IPADD] = "IP", [GEN_RID] = "RID", } local types = {} for t, gid in pairs(default_types) do types[t:lower()] = gid types[t] = gid end return { types = types, literals = literals, }PKDN]ύĐ resty/openssl/include/pkcs12.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.stack" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ // hack by changing char* to const char* here PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 *cert, OPENSSL_STACK *ca, // STACK_OF(X509) int nid_key, int nid_cert, int iter, int mac_iter, int keytype); int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, OPENSSL_STACK **ca); // STACK_OF(X509) **ca); void PKCS12_free(PKCS12 *p12); int i2d_PKCS12_bio(BIO *bp, PKCS12 *a); PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **a); ]] if OPENSSL_3X then ffi.cdef [[ PKCS12 *PKCS12_create_ex(const char *pass, const char *name, EVP_PKEY *pkey, X509 *cert, OPENSSL_STACK *ca, // STACK_OF(X509) int nid_key, int nid_cert, int iter, int mac_iter, int keytype, OSSL_LIB_CTX *ctx, const char *propq); ]] end PKDN]X\]] resty/openssl/include/x509v3.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.stack" local asn1_macro = require "resty.openssl.include.asn1" ffi.cdef [[ // STACK_OF(OPENSSL_STRING) OPENSSL_STACK *X509_get1_ocsp(X509 *x); void X509_email_free(OPENSSL_STACK *sk); void X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf); typedef struct EDIPartyName_st EDIPARTYNAME; typedef struct otherName_st OTHERNAME; typedef struct GENERAL_NAME_st { int type; union { char *ptr; OTHERNAME *otherName; /* otherName */ ASN1_IA5STRING *rfc822Name; ASN1_IA5STRING *dNSName; ASN1_TYPE *x400Address; X509_NAME *directoryName; EDIPARTYNAME *ediPartyName; ASN1_IA5STRING *uniformResourceIdentifier; ASN1_OCTET_STRING *iPAddress; ASN1_OBJECT *registeredID; /* Old names */ ASN1_OCTET_STRING *ip; /* iPAddress */ X509_NAME *dirn; /* dirn */ ASN1_IA5STRING *ia5; /* rfc822Name, dNSName, * uniformResourceIdentifier */ ASN1_OBJECT *rid; /* registeredID */ ASN1_TYPE *other; /* x400Address */ } d; } GENERAL_NAME; // STACK_OF(GENERAL_NAME) typedef struct stack_st GENERAL_NAMES; // STACK_OF(X509_EXTENSION) int X509V3_add1_i2d(OPENSSL_STACK **x, int nid, void *value, int crit, unsigned long flags); void *X509V3_EXT_d2i(X509_EXTENSION *ext); X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc); int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, unsigned long flag, int indent); int X509_add1_ext_i2d(X509 *x, int nid, void *value, int crit, unsigned long flags); // although the struct has plural form, it's not a stack typedef struct BASIC_CONSTRAINTS_st { int ca; ASN1_INTEGER *pathlen; } BASIC_CONSTRAINTS; void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject, X509_REQ *req, X509_CRL *crl, int flags); X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid, const char *value); // X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, const char *name, // const char *value); int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, unsigned long flag, int indent); void *X509V3_get_d2i(const OPENSSL_STACK *x, int nid, int *crit, int *idx); int X509v3_get_ext_by_NID(const OPENSSL_STACK *x, int nid, int lastpos); X509_EXTENSION *X509v3_get_ext(const OPENSSL_STACK *x, int loc); // STACK_OF(ACCESS_DESCRIPTION) typedef struct stack_st AUTHORITY_INFO_ACCESS; typedef struct ACCESS_DESCRIPTION_st { ASN1_OBJECT *method; GENERAL_NAME *location; } ACCESS_DESCRIPTION; typedef struct DIST_POINT_NAME_st { int type; union { GENERAL_NAMES *fullname; // STACK_OF(X509_NAME_ENTRY) OPENSSL_STACK *relativename; } name; /* If relativename then this contains the full distribution point name */ X509_NAME *dpname; } DIST_POINT_NAME; typedef struct DIST_POINT_st { DIST_POINT_NAME *distpoint; ASN1_BIT_STRING *reasons; GENERAL_NAMES *CRLissuer; int dp_reasons; } DIST_POINT; ]] asn1_macro.declare_asn1_functions("GENERAL_NAME") asn1_macro.declare_asn1_functions("BASIC_CONSTRAINTS") asn1_macro.declare_asn1_functions("AUTHORITY_INFO_ACCESS") -- OCSP responder and CA asn1_macro.declare_asn1_functions("ACCESS_DESCRIPTION") asn1_macro.declare_asn1_functions("DIST_POINT") -- CRL distribution points PKDN] jresty/openssl/include/dh.luanu[local ffi = require "ffi" local C = ffi.C require "resty.openssl.include.ossl_typ" require "resty.openssl.include.objects" ffi.cdef [[ void DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g); int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g); void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key); int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key); DH *DH_get_1024_160(void); DH *DH_get_2048_224(void); DH *DH_get_2048_256(void); DH *DH_new_by_nid(int nid); ]]; local dh_groups = { -- per https://tools.ietf.org/html/rfc5114 dh_1024_160 = function() return C.DH_get_1024_160() end, dh_2048_224 = function() return C.DH_get_2048_224() end, dh_2048_256 = function() return C.DH_get_2048_256() end, } local groups = { "ffdhe2048", "ffdhe3072", "ffdhe4096", "ffdhe6144", "ffdhe8192", "modp_2048", "modp_3072", "modp_4096", "modp_6144", "modp_8192", -- following cannot be used with FIPS provider "modp_1536", -- and the RFC5114 ones } for _, group in ipairs(groups) do local nid = C.OBJ_sn2nid(group) if nid ~= 0 then dh_groups[group] = function() return C.DH_new_by_nid(nid) end end end return { dh_groups = dh_groups, } PKDN]s(s("resty/openssl/include/evp/pkey.luanu[local ffi = require "ffi" local C = ffi.C require "resty.openssl.include.ossl_typ" require "resty.openssl.include.evp.md" local evp = require("resty.openssl.include.evp") local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ EVP_PKEY *EVP_PKEY_new(void); void EVP_PKEY_free(EVP_PKEY *pkey); RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey); EC_KEY *EVP_PKEY_get0_EC_KEY(EVP_PKEY *pkey); DH *EVP_PKEY_get0_DH(EVP_PKEY *pkey); int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key); // openssl < 3.0 int EVP_PKEY_base_id(const EVP_PKEY *pkey); int EVP_PKEY_size(const EVP_PKEY *pkey); EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e); EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e); void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx); int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype, int cmd, int p1, void *p2); // TODO replace EVP_PKEY_CTX_ctrl with EVP_PKEY_CTX_ctrl_str to reduce // some hardcoded macros // int EVP_PKEY_CTX_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, // const char *value); int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx, unsigned char *out, size_t *outlen, const unsigned char *in, size_t inlen); int EVP_PKEY_decrypt_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_decrypt(EVP_PKEY_CTX *ctx, unsigned char *out, size_t *outlen, const unsigned char *in, size_t inlen); int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_sign(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen, const unsigned char *tbs, size_t tbslen); int EVP_PKEY_verify_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_verify(EVP_PKEY_CTX *ctx, const unsigned char *sig, size_t siglen, const unsigned char *tbs, size_t tbslen); int EVP_PKEY_verify_recover_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_verify_recover(EVP_PKEY_CTX *ctx, unsigned char *rout, size_t *routlen, const unsigned char *sig, size_t siglen); EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e, const unsigned char *key, size_t keylen); EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e, const unsigned char *key, size_t keylen); int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv, size_t *len); int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub, size_t *len); int EVP_SignFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s, EVP_PKEY *pkey); int EVP_VerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sigbuf, unsigned int siglen, EVP_PKEY *pkey); int EVP_DigestSignInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey); int EVP_DigestSign(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen, const unsigned char *tbs, size_t tbslen); int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey); int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, size_t siglen, const unsigned char *tbs, size_t tbslen); int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid); int EVP_PKEY_derive_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer); int EVP_PKEY_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen); int EVP_PKEY_keygen_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey); int EVP_PKEY_paramgen_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey); int EVP_PKEY_CTX_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, const char *value); ]] local _M = {} if OPENSSL_3X then require "resty.openssl.include.provider" ffi.cdef [[ int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int pad_mode); int EVP_PKEY_get_base_id(const EVP_PKEY *pkey); int EVP_PKEY_get_size(const EVP_PKEY *pkey); int EVP_PKEY_CTX_set_ec_paramgen_curve_nid(EVP_PKEY_CTX *ctx, int nid); int EVP_PKEY_CTX_set_ec_param_enc(EVP_PKEY_CTX *ctx, int param_enc); int EVP_PKEY_CTX_set_rsa_keygen_bits(EVP_PKEY_CTX *ctx, int mbits); int EVP_PKEY_CTX_set_rsa_keygen_pubexp(EVP_PKEY_CTX *ctx, BIGNUM *pubexp); int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int pad); int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int len); int EVP_PKEY_CTX_set_rsa_mgf1_md_name(EVP_PKEY_CTX *ctx, const char *mdname, const char *mdprops); int EVP_PKEY_CTX_set_rsa_oaep_md_name(EVP_PKEY_CTX *ctx, const char *mdname, const char *mdprops); int EVP_PKEY_CTX_set_dh_paramgen_prime_len(EVP_PKEY_CTX *ctx, int pbits); const OSSL_PROVIDER *EVP_PKEY_get0_provider(const EVP_PKEY *key); // const OSSL_PROVIDER *EVP_PKEY_CTX_get0_provider(const EVP_PKEY_CTX *ctx); const OSSL_PARAM *EVP_PKEY_settable_params(const EVP_PKEY *pkey); int EVP_PKEY_set_params(EVP_PKEY *pkey, OSSL_PARAM params[]); int EVP_PKEY_get_params(EVP_PKEY *ctx, OSSL_PARAM params[]); const OSSL_PARAM *EVP_PKEY_gettable_params(EVP_PKEY *ctx); EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_name(OSSL_LIB_CTX *libctx, const char *name, const char *propquery); int EVP_PKEY_fromdata_init(EVP_PKEY_CTX *ctx); int EVP_PKEY_fromdata(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey, int selection, OSSL_PARAM params[]); const OSSL_PARAM *EVP_PKEY_fromdata_settable(EVP_PKEY_CTX *ctx, int selection); ]] _M.EVP_PKEY_CTX_set_ec_paramgen_curve_nid = function(pctx, nid) return C.EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, nid) end _M.EVP_PKEY_CTX_set_ec_param_enc = function(pctx, param_enc) return C.EVP_PKEY_CTX_set_ec_param_enc(pctx, param_enc) end _M.EVP_PKEY_CTX_set_dh_paramgen_prime_len = function(pctx, pbits) return C.EVP_PKEY_CTX_set_dh_paramgen_prime_len(pctx, pbits) end _M.EVP_PKEY_CTX_set_rsa_keygen_bits = function(pctx, mbits) return C.EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, mbits) end _M.EVP_PKEY_CTX_set_rsa_keygen_pubexp = function(pctx, pubexp) return C.EVP_PKEY_CTX_set_rsa_keygen_pubexp(pctx, pubexp) end _M.EVP_PKEY_CTX_set_rsa_padding = function(pctx, pad) return C.EVP_PKEY_CTX_set_rsa_padding(pctx, pad) end _M.EVP_PKEY_CTX_set_rsa_pss_saltlen = function(pctx, len) return C.EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, len) end _M.EVP_PKEY_CTX_set_rsa_mgf1_md_name = function(pctx, name ,props) return C.EVP_PKEY_CTX_set_rsa_mgf1_md_name(pctx, name, props) end _M.EVP_PKEY_CTX_set_rsa_oaep_md_name = function(pctx, name, props) return C.EVP_PKEY_CTX_set_rsa_oaep_md_name(pctx, name, props) end else _M.EVP_PKEY_CTX_set_ec_paramgen_curve_nid = function(pctx, nid) return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_EC, evp.EVP_PKEY_OP_PARAMGEN + evp.EVP_PKEY_OP_KEYGEN, evp.EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID, nid, nil) end _M.EVP_PKEY_CTX_set_ec_param_enc = function(pctx, param_enc) return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_EC, evp.EVP_PKEY_OP_PARAMGEN + evp.EVP_PKEY_OP_KEYGEN, evp.EVP_PKEY_CTRL_EC_PARAM_ENC, param_enc, nil) end _M.EVP_PKEY_CTX_set_dh_paramgen_prime_len = function(pctx, pbits) return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_DH, evp.EVP_PKEY_OP_PARAMGEN, evp.EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN, pbits, nil) end _M.EVP_PKEY_CTX_set_rsa_keygen_bits = function(pctx, mbits) return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_RSA, evp.EVP_PKEY_OP_KEYGEN, evp.EVP_PKEY_CTRL_RSA_KEYGEN_BITS, mbits, nil) end _M.EVP_PKEY_CTX_set_rsa_keygen_pubexp = function(pctx, pubexp) return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_RSA, evp.EVP_PKEY_OP_KEYGEN, evp.EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP, 0, pubexp) end _M.EVP_PKEY_CTX_set_rsa_padding = function(pctx, pad) return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_RSA, -1, evp.EVP_PKEY_CTRL_RSA_PADDING, pad, nil) end _M.EVP_PKEY_CTX_set_rsa_pss_saltlen = function(pctx, len) return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_RSA, evp.EVP_PKEY_OP_SIGN + evp.EVP_PKEY_OP_VERIFY, evp.EVP_PKEY_CTRL_RSA_PSS_SALTLEN, len, nil) end _M.EVP_PKEY_CTX_set_rsa_mgf1_md_name = function(pctx, name, _) local md = C.EVP_get_digestbyname(name) if not md then return -1, "unknown digest: " .. name end return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_RSA, evp.EVP_PKEY_OP_SIG + evp.EVP_PKEY_OP_TYPE_CRYPT, evp.EVP_PKEY_CTRL_RSA_MGF1_MD, 0, ffi.cast("void *", md)) end _M.EVP_PKEY_CTX_set_rsa_oaep_md_name = function(pctx, name, _) local md = C.EVP_get_digestbyname(name) if not md then return -1, "unknown digest: " .. name end return C.EVP_PKEY_CTX_ctrl(pctx, evp.EVP_PKEY_RSA, evp.EVP_PKEY_OP_CRYPT, evp.EVP_PKEY_CTRL_RSA_OAEP_MD, 0, ffi.cast("void *", md)) end end return _MPKDN]?| | $resty/openssl/include/evp/cipher.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void); // int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c); void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *c); int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *c, int pad); const EVP_CIPHER *EVP_CIPHER_CTX_cipher(const EVP_CIPHER_CTX *ctx); const EVP_CIPHER *EVP_get_cipherbyname(const char *name); int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr); // int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, // int *outl, const unsigned char *in, int inl); // int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, // int *outl, const unsigned char *in, int inl); int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *impl, const unsigned char *key, const unsigned char *iv, int enc); int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, const unsigned char *in, int inl); int EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); // list functions typedef void* fake_openssl_cipher_list_fn(const EVP_CIPHER *ciph, const char *from, const char *to, void *x); //void EVP_CIPHER_do_all_sorted(fake_openssl_cipher_list_fn*, void *arg); void EVP_CIPHER_do_all_sorted(void (*fn) (const EVP_CIPHER *ciph, const char *from, const char *to, void *x), void *arg); int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md, const unsigned char *salt, const unsigned char *data, int datal, int count, unsigned char *key, unsigned char *iv); ]] if OPENSSL_3X then require "resty.openssl.include.provider" ffi.cdef [[ int EVP_CIPHER_CTX_get_block_size(const EVP_CIPHER_CTX *ctx); int EVP_CIPHER_CTX_get_key_length(const EVP_CIPHER_CTX *ctx); int EVP_CIPHER_CTX_get_iv_length(const EVP_CIPHER_CTX *ctx); int EVP_CIPHER_get_nid(const EVP_CIPHER *cipher); const OSSL_PROVIDER *EVP_CIPHER_get0_provider(const EVP_CIPHER *cipher); EVP_CIPHER *EVP_CIPHER_fetch(OSSL_LIB_CTX *ctx, const char *algorithm, const char *properties); typedef void* fake_openssl_cipher_provided_list_fn(EVP_CIPHER *cipher, void *arg); void EVP_CIPHER_do_all_provided(OSSL_LIB_CTX *libctx, fake_openssl_cipher_provided_list_fn*, void *arg); // int EVP_CIPHER_up_ref(EVP_CIPHER *cipher); // void EVP_CIPHER_free(EVP_CIPHER *cipher); const char *EVP_CIPHER_get0_name(const EVP_CIPHER *cipher); int EVP_CIPHER_CTX_set_params(EVP_CIPHER_CTX *ctx, const OSSL_PARAM params[]); const OSSL_PARAM *EVP_CIPHER_CTX_settable_params(EVP_CIPHER_CTX *ctx); int EVP_CIPHER_CTX_get_params(EVP_CIPHER_CTX *ctx, OSSL_PARAM params[]); const OSSL_PARAM *EVP_CIPHER_CTX_gettable_params(EVP_CIPHER_CTX *ctx); ]] else ffi.cdef [[ int EVP_CIPHER_CTX_block_size(const EVP_CIPHER_CTX *ctx); int EVP_CIPHER_CTX_key_length(const EVP_CIPHER_CTX *ctx); int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx); int EVP_CIPHER_nid(const EVP_CIPHER *cipher); ]] end PKDN]!resty/openssl/include/evp/mac.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.provider" ffi.cdef [[ typedef struct evp_mac_st EVP_MAC; typedef struct evp_mac_ctx_st EVP_MAC_CTX; EVP_MAC_CTX *EVP_MAC_CTX_new(EVP_MAC *mac); void EVP_MAC_CTX_free(EVP_MAC_CTX *ctx); const OSSL_PROVIDER *EVP_MAC_get0_provider(const EVP_MAC *mac); EVP_MAC *EVP_MAC_fetch(OSSL_LIB_CTX *libctx, const char *algorithm, const char *properties); int EVP_MAC_init(EVP_MAC_CTX *ctx, const unsigned char *key, size_t keylen, const OSSL_PARAM params[]); int EVP_MAC_update(EVP_MAC_CTX *ctx, const unsigned char *data, size_t datalen); int EVP_MAC_final(EVP_MAC_CTX *ctx, unsigned char *out, size_t *outl, size_t outsize); size_t EVP_MAC_CTX_get_mac_size(EVP_MAC_CTX *ctx); typedef void* fake_openssl_mac_provided_list_fn(EVP_MAC *mac, void *arg); void EVP_MAC_do_all_provided(OSSL_LIB_CTX *libctx, fake_openssl_mac_provided_list_fn*, void *arg); // int EVP_MAC_up_ref(EVP_MAC *mac); void EVP_MAC_free(EVP_MAC *mac); const char *EVP_MAC_get0_name(const EVP_MAC *mac); int EVP_MAC_CTX_set_params(EVP_MAC_CTX *ctx, const OSSL_PARAM params[]); const OSSL_PARAM *EVP_MAC_CTX_settable_params(EVP_MAC_CTX *ctx); int EVP_MAC_CTX_get_params(EVP_MAC_CTX *ctx, OSSL_PARAM params[]); const OSSL_PARAM *EVP_MAC_CTX_gettable_params(EVP_MAC_CTX *ctx); ]]PKDN]K2 resty/openssl/include/evp/md.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl); int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, size_t cnt); int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s); const EVP_MD *EVP_get_digestbyname(const char *name); int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, size_t cnt); int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s); const EVP_MD *EVP_md_null(void); EVP_MD_CTX *EVP_MD_CTX_new(void); void EVP_MD_CTX_free(EVP_MD_CTX *ctx); typedef void* fake_openssl_md_list_fn(const EVP_MD *ciph, const char *from, const char *to, void *x); void EVP_MD_do_all_sorted(fake_openssl_md_list_fn*, void *arg); const EVP_MD *EVP_get_digestbyname(const char *name); ]] if OPENSSL_3X then require "resty.openssl.include.provider" ffi.cdef [[ int EVP_MD_get_size(const EVP_MD *md); int EVP_MD_get_type(const EVP_MD *md); const OSSL_PROVIDER *EVP_MD_get0_provider(const EVP_MD *md); EVP_MD *EVP_MD_fetch(OSSL_LIB_CTX *ctx, const char *algorithm, const char *properties); typedef void* fake_openssl_md_provided_list_fn(EVP_MD *md, void *arg); void EVP_MD_do_all_provided(OSSL_LIB_CTX *libctx, fake_openssl_md_provided_list_fn*, void *arg); // int EVP_MD_up_ref(EVP_MD *md); void EVP_MD_free(EVP_MD *md); const char *EVP_MD_get0_name(const EVP_MD *md); int EVP_MD_CTX_set_params(EVP_MD_CTX *ctx, const OSSL_PARAM params[]); const OSSL_PARAM *EVP_MD_CTX_settable_params(EVP_MD_CTX *ctx); int EVP_MD_CTX_get_params(EVP_MD_CTX *ctx, OSSL_PARAM params[]); const OSSL_PARAM *EVP_MD_CTX_gettable_params(EVP_MD_CTX *ctx); ]] else ffi.cdef [[ int EVP_MD_size(const EVP_MD *md); int EVP_MD_type(const EVP_MD *md); ]] end PKDN],!resty/openssl/include/evp/kdf.luanu[local ffi = require "ffi" local ffi_cast = ffi.cast local C = ffi.C require "resty.openssl.include.ossl_typ" require "resty.openssl.include.evp.md" local evp = require("resty.openssl.include.evp") local ctypes = require "resty.openssl.auxiliary.ctypes" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local void_ptr = ctypes.void_ptr local _M = { EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND = 0, EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY = 1, EVP_PKEY_HKDEF_MODE_EXPAND_ONLY = 2, } if OPENSSL_3X then require "resty.openssl.include.provider" ffi.cdef [[ const OSSL_PROVIDER *EVP_KDF_get0_provider(const EVP_KDF *kdf); typedef void* fake_openssl_kdf_provided_list_fn(EVP_KDF *kdf, void *arg); void EVP_KDF_do_all_provided(OSSL_LIB_CTX *libctx, fake_openssl_kdf_provided_list_fn*, void *arg); // int EVP_KDF_up_ref(EVP_KDF *kdf); void EVP_KDF_free(EVP_KDF *kdf); const char *EVP_KDF_get0_name(const EVP_KDF *kdf); EVP_KDF *EVP_KDF_fetch(OSSL_LIB_CTX *libctx, const char *algorithm, const char *properties); EVP_KDF_CTX *EVP_KDF_CTX_new(const EVP_KDF *kdf); void EVP_KDF_CTX_free(EVP_KDF_CTX *ctx); void EVP_KDF_CTX_reset(EVP_KDF_CTX *ctx); size_t EVP_KDF_CTX_get_kdf_size(EVP_KDF_CTX *ctx); int EVP_KDF_derive(EVP_KDF_CTX *ctx, unsigned char *key, size_t keylen, const OSSL_PARAM params[]); int EVP_KDF_CTX_get_params(EVP_KDF_CTX *ctx, OSSL_PARAM params[]); int EVP_KDF_CTX_set_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[]); const OSSL_PARAM *EVP_KDF_CTX_gettable_params(const EVP_KDF_CTX *ctx); const OSSL_PARAM *EVP_KDF_CTX_settable_params(const EVP_KDF_CTX *ctx); int EVP_PKEY_CTX_set_tls1_prf_md(EVP_PKEY_CTX *ctx, const EVP_MD *md); int EVP_PKEY_CTX_set1_tls1_prf_secret(EVP_PKEY_CTX *pctx, const unsigned char *sec, int seclen); int EVP_PKEY_CTX_add1_tls1_prf_seed(EVP_PKEY_CTX *pctx, const unsigned char *seed, int seedlen); int EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX *ctx, const EVP_MD *md); int EVP_PKEY_CTX_set1_hkdf_salt(EVP_PKEY_CTX *ctx, const unsigned char *salt, int saltlen); int EVP_PKEY_CTX_set1_hkdf_key(EVP_PKEY_CTX *ctx, const unsigned char *key, int keylen); int EVP_PKEY_CTX_set_hkdf_mode(EVP_PKEY_CTX *ctx, int mode); int EVP_PKEY_CTX_add1_hkdf_info(EVP_PKEY_CTX *ctx, const unsigned char *info, int infolen); ]] _M.EVP_PKEY_CTX_set_tls1_prf_md = function(pctx, md) return C.EVP_PKEY_CTX_set_tls1_prf_md(pctx, md) end _M.EVP_PKEY_CTX_set1_tls1_prf_secret = function(pctx, sec) return C.EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, sec, #sec) end _M.EVP_PKEY_CTX_add1_tls1_prf_seed = function(pctx, seed) return C.EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed, #seed) end _M.EVP_PKEY_CTX_set_hkdf_md = function(pctx, md) return C.EVP_PKEY_CTX_set_hkdf_md(pctx, md) end _M.EVP_PKEY_CTX_set1_hkdf_salt = function(pctx, salt) return C.EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, #salt) end _M.EVP_PKEY_CTX_set1_hkdf_key = function(pctx, key) return C.EVP_PKEY_CTX_set1_hkdf_key(pctx, key, #key) end _M.EVP_PKEY_CTX_set_hkdf_mode = function(pctx, mode) return C.EVP_PKEY_CTX_set_hkdf_mode(pctx, mode) end _M.EVP_PKEY_CTX_add1_hkdf_info = function(pctx, info) return C.EVP_PKEY_CTX_add1_hkdf_info(pctx, info, #info) end else _M.EVP_PKEY_CTX_set_tls1_prf_md = function(pctx, md) return C.EVP_PKEY_CTX_ctrl(pctx, -1, evp.EVP_PKEY_OP_DERIVE, evp.EVP_PKEY_CTRL_TLS_MD, 0, ffi_cast(void_ptr, md)) end _M.EVP_PKEY_CTX_set1_tls1_prf_secret = function(pctx, sec) return C.EVP_PKEY_CTX_ctrl(pctx, -1, evp.EVP_PKEY_OP_DERIVE, evp.EVP_PKEY_CTRL_TLS_SECRET, #sec, ffi_cast(void_ptr, sec)) end _M.EVP_PKEY_CTX_add1_tls1_prf_seed = function(pctx, seed) return C.EVP_PKEY_CTX_ctrl(pctx, -1, evp.EVP_PKEY_OP_DERIVE, evp.EVP_PKEY_CTRL_TLS_SEED, #seed, ffi_cast(void_ptr, seed)) end _M.EVP_PKEY_CTX_set_hkdf_md = function(pctx, md) return C.EVP_PKEY_CTX_ctrl(pctx, -1, evp.EVP_PKEY_OP_DERIVE, evp.EVP_PKEY_CTRL_HKDF_MD, 0, ffi_cast(void_ptr, md)) end _M.EVP_PKEY_CTX_set1_hkdf_salt = function(pctx, salt) return C.EVP_PKEY_CTX_ctrl(pctx, -1, evp.EVP_PKEY_OP_DERIVE, evp.EVP_PKEY_CTRL_HKDF_SALT, #salt, ffi_cast(void_ptr, salt)) end _M.EVP_PKEY_CTX_set1_hkdf_key = function(pctx, key) return C.EVP_PKEY_CTX_ctrl(pctx, -1, evp.EVP_PKEY_OP_DERIVE, evp.EVP_PKEY_CTRL_HKDF_KEY, #key, ffi_cast(void_ptr, key)) end _M.EVP_PKEY_CTX_set_hkdf_mode = function(pctx, mode) return C.EVP_PKEY_CTX_ctrl(pctx, -1, evp.EVP_PKEY_OP_DERIVE, evp.EVP_PKEY_CTRL_HKDF_MODE, mode, nil) end _M.EVP_PKEY_CTX_add1_hkdf_info = function(pctx, info) return C.EVP_PKEY_CTX_ctrl(pctx, -1, evp.EVP_PKEY_OP_DERIVE, evp.EVP_PKEY_CTRL_HKDF_INFO, #info, ffi_cast(void_ptr, info)) end end return _MPKDN]-*"  "resty/openssl/include/ossl_typ.luanu[local ffi = require "ffi" ffi.cdef( [[ typedef struct rsa_st RSA; typedef struct evp_pkey_st EVP_PKEY; typedef struct bignum_st BIGNUM; typedef struct bn_gencb_st BN_GENCB; typedef struct bignum_ctx BN_CTX; typedef struct bio_st BIO; typedef struct evp_cipher_st EVP_CIPHER; typedef struct evp_md_ctx_st EVP_MD_CTX; typedef struct evp_pkey_ctx_st EVP_PKEY_CTX; typedef struct evp_md_st EVP_MD; typedef struct evp_pkey_asn1_method_st EVP_PKEY_ASN1_METHOD; typedef struct evp_cipher_ctx_st EVP_CIPHER_CTX; typedef struct engine_st ENGINE; typedef struct x509_st X509; typedef struct x509_attributes_st X509_ATTRIBUTE; typedef struct X509_extension_st X509_EXTENSION; typedef struct X509_name_st X509_NAME; typedef struct X509_name_entry_st X509_NAME_ENTRY; typedef struct X509_req_st X509_REQ; typedef struct X509_crl_st X509_CRL; typedef struct x509_store_st X509_STORE; typedef struct x509_store_ctx_st X509_STORE_CTX; typedef struct x509_purpose_st X509_PURPOSE; typedef struct v3_ext_ctx X509V3_CTX; typedef struct asn1_string_st ASN1_INTEGER; typedef struct asn1_string_st ASN1_ENUMERATED; typedef struct asn1_string_st ASN1_BIT_STRING; typedef struct asn1_string_st ASN1_OCTET_STRING; typedef struct asn1_string_st ASN1_PRINTABLESTRING; typedef struct asn1_string_st ASN1_T61STRING; typedef struct asn1_string_st ASN1_IA5STRING; typedef struct asn1_string_st ASN1_GENERALSTRING; typedef struct asn1_string_st ASN1_UNIVERSALSTRING; typedef struct asn1_string_st ASN1_BMPSTRING; typedef struct asn1_string_st ASN1_UTCTIME; typedef struct asn1_string_st ASN1_TIME; typedef struct asn1_string_st ASN1_GENERALIZEDTIME; typedef struct asn1_string_st ASN1_VISIBLESTRING; typedef struct asn1_string_st ASN1_UTF8STRING; typedef struct asn1_string_st ASN1_STRING; typedef struct asn1_object_st ASN1_OBJECT; typedef struct conf_st CONF; typedef struct conf_method_st CONF_METHOD; typedef int ASN1_BOOLEAN; typedef int ASN1_NULL; typedef struct ec_key_st EC_KEY; typedef struct ec_method_st EC_METHOD; typedef struct ec_point_st EC_POINT; typedef struct ec_group_st EC_GROUP; typedef struct rsa_meth_st RSA_METHOD; // typedef struct evp_keymgmt_st EVP_KEYMGMT; // typedef struct crypto_ex_data_st CRYPTO_EX_DATA; // typedef struct bn_mont_ctx_st BN_MONT_CTX; // typedef struct bn_blinding_st BN_BLINDING; // crypto.h // typedef void CRYPTO_RWLOCK; typedef struct hmac_ctx_st HMAC_CTX; typedef struct x509_revoked_st X509_REVOKED; typedef struct dh_st DH; typedef struct PKCS12_st PKCS12; typedef struct ssl_st SSL; typedef struct ssl_ctx_st SSL_CTX; typedef struct evp_kdf_st EVP_KDF; typedef struct evp_kdf_ctx_st EVP_KDF_CTX; typedef struct ossl_lib_ctx_st OSSL_LIB_CTX; typedef struct ECDSA_SIG_st ECDSA_SIG; ]]) PKDN]|ddresty/openssl/include/stack.luanu[--[[ The OpenSSL stack library. Note `safestack` is not usable here in ffi because those symbols are eaten after preprocessing. Instead, we should do a Lua land type checking by having a nested field indicating which type of cdata its ctx holds. ]] local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ typedef char *OPENSSL_STRING; typedef struct stack_st OPENSSL_STACK; OPENSSL_STACK *OPENSSL_sk_new_null(void); int OPENSSL_sk_push(OPENSSL_STACK *st, const void *data); void OPENSSL_sk_pop_free(OPENSSL_STACK *st, void (*func) (void *)); int OPENSSL_sk_num(const OPENSSL_STACK *); void *OPENSSL_sk_value(const OPENSSL_STACK *, int); OPENSSL_STACK *OPENSSL_sk_dup(const OPENSSL_STACK *st); void OPENSSL_sk_free(OPENSSL_STACK *); // void *OPENSSL_sk_delete(OPENSSL_STACK *st, int loc); typedef void (*OPENSSL_sk_freefunc)(void *); typedef void *(*OPENSSL_sk_copyfunc)(const void *); OPENSSL_STACK *OPENSSL_sk_deep_copy(const OPENSSL_STACK *, OPENSSL_sk_copyfunc c, OPENSSL_sk_freefunc f); ]] PKDN]JL}}!resty/openssl/include/objects.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name); ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name); int OBJ_txt2nid(const char *s); const char *OBJ_nid2sn(int n); int OBJ_ln2nid(const char *s); int OBJ_sn2nid(const char *s); const char *OBJ_nid2ln(int n); const char *OBJ_nid2sn(int n); int OBJ_obj2nid(const ASN1_OBJECT *o); const ASN1_OBJECT *OBJ_nid2obj(int n); int OBJ_create(const char *oid, const char *sn, const char *ln); int OBJ_find_sigid_algs(int signid, int *pdig_nid, int *ppkey_nid); ]] PKEN]Cresty/openssl/include/err.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ unsigned long ERR_peek_error(void); unsigned long ERR_peek_last_error(void); void ERR_clear_error(void); void ERR_error_string_n(unsigned long e, char *buf, size_t len); const char *ERR_lib_error_string(unsigned long e); const char *ERR_reason_error_string(unsigned long e); ]] if OPENSSL_3X then ffi.cdef [[ unsigned long ERR_get_error_all(const char **file, int *line, const char **func, const char **data, int *flags); unsigned long ERR_peek_last_error_all(const char **file, int *line, const char **func, const char **data, int *flags); ]] else ffi.cdef [[ unsigned long ERR_get_error_line(const char **file, int *line); unsigned long ERR_peek_last_error_line(const char **file, int *line); ]] endPKEN]tUllresty/openssl/include/rsa.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ RSA *RSA_new(void); void RSA_free(RSA *r); void RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, const BIGNUM **d); void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q); void RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, const BIGNUM **iqmp); int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d); int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q); int RSA_set0_crt_params(RSA *r,BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp); struct rsa_st; ]] return { paddings = { RSA_PKCS1_PADDING = 1, RSA_SSLV23_PADDING = 2, RSA_NO_PADDING = 3, RSA_PKCS1_OAEP_PADDING = 4, RSA_X931_PADDING = 5, RSA_PKCS1_PSS_PADDING = 6, }, } PKEN]%7_ resty/openssl/include/crypto.luanu[local ffi = require "ffi" local C = ffi.C ffi.cdef [[ int FIPS_mode(void); int FIPS_mode_set(int ONOFF); void CRYPTO_free(void *ptr, const char *file, int line); int CRYPTO_memcmp(const void *a, const void *b, size_t len); ]] local OPENSSL_free = function(ptr) -- file and line is for debuggin only, since we can't know the c file info -- the macro is expanded, just ignore this C.CRYPTO_free(ptr, "", 0) end return { OPENSSL_free = OPENSSL_free, } PKFN]6p"resty/openssl/include/provider.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" require "resty.openssl.include.param" ffi.cdef [[ typedef struct ossl_provider_st OSSL_PROVIDER; typedef struct ossl_lib_ctx_st OSSL_LIB_CTX; void OSSL_PROVIDER_set_default_search_path(OSSL_LIB_CTX *libctx, const char *path); OSSL_PROVIDER *OSSL_PROVIDER_load(OSSL_LIB_CTX *libctx, const char *name); OSSL_PROVIDER *OSSL_PROVIDER_try_load(OSSL_LIB_CTX *libctx, const char *name); int OSSL_PROVIDER_unload(OSSL_PROVIDER *prov); int OSSL_PROVIDER_available(OSSL_LIB_CTX *libctx, const char *name); const OSSL_PARAM *OSSL_PROVIDER_gettable_params(OSSL_PROVIDER *prov); int OSSL_PROVIDER_get_params(OSSL_PROVIDER *prov, OSSL_PARAM params[]); // int OSSL_PROVIDER_add_builtin(OSSL_LIB_CTX *libctx, const char *name, // ossl_provider_init_fn *init_fn); const char *OSSL_PROVIDER_get0_name(const OSSL_PROVIDER *prov); int OSSL_PROVIDER_self_test(const OSSL_PROVIDER *prov); ]] PKFN]*(EJJ"resty/openssl/include/x509_vfy.luanu[local ffi = require "ffi" local C = ffi.C require "resty.openssl.include.ossl_typ" require "resty.openssl.include.stack" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ X509_STORE *X509_STORE_new(void); void X509_STORE_free(X509_STORE *v); // int X509_STORE_lock(X509_STORE *ctx); // int X509_STORE_unlock(X509_STORE *ctx); // int X509_STORE_up_ref(X509_STORE *v); // STACK_OF(X509_OBJECT) // OPENSSL_STACK *X509_STORE_get0_objects(X509_STORE *v); int X509_STORE_add_cert(X509_STORE *ctx, X509 *x); int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x); int X509_STORE_load_locations(X509_STORE *ctx, const char *file, const char *dir); int X509_STORE_set_default_paths(X509_STORE *ctx); int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags); int X509_STORE_set_depth(X509_STORE *store, int depth); int X509_STORE_set_purpose(X509_STORE *ctx, int purpose); X509_STORE_CTX *X509_STORE_CTX_new(void); void X509_STORE_CTX_free(X509_STORE_CTX *ctx); // STACK_OF(X509) int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, OPENSSL_STACK *chain); int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx); int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name); void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags); // int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose); // STACK_OF(X509_CRL) // void X509_STORE_CTX_set0_crls(X509_STORE_CTX *c, OPENSSL_STACK *sk); int X509_PURPOSE_get_by_sname(char *sname); X509_PURPOSE *X509_PURPOSE_get0(int idx); int X509_PURPOSE_get_id(const X509_PURPOSE *xp); // STACK_OF(X509) OPENSSL_STACK *X509_STORE_CTX_get0_chain(X509_STORE_CTX *ctx); typedef int (*X509_STORE_CTX_check_revocation_fn)(X509_STORE_CTX *ctx); // STACK_OF(X509) void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *ctx, OPENSSL_STACK *sk); typedef int (*X509_STORE_CTX_check_revocation_fn)(X509_STORE_CTX *ctx); X509_STORE_CTX_check_revocation_fn X509_STORE_CTX_get_check_revocation(const X509_STORE_CTX *ctx); // STACK_OF(X509) void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *ctx, OPENSSL_STACK *sk); ]] local _M = { verify_flags = { X509_V_FLAG_CB_ISSUER_CHECK = 0x0, -- Deprecated X509_V_FLAG_USE_CHECK_TIME = 0x2, X509_V_FLAG_CRL_CHECK = 0x4, X509_V_FLAG_CRL_CHECK_ALL = 0x8, X509_V_FLAG_IGNORE_CRITICAL = 0x10, X509_V_FLAG_X509_STRICT = 0x20, X509_V_FLAG_ALLOW_PROXY_CERTS = 0x40, X509_V_FLAG_POLICY_CHECK = 0x80, X509_V_FLAG_EXPLICIT_POLICY = 0x100, X509_V_FLAG_INHIBIT_ANY = 0x200, X509_V_FLAG_INHIBIT_MAP = 0x400, X509_V_FLAG_NOTIFY_POLICY = 0x800, X509_V_FLAG_EXTENDED_CRL_SUPPORT = 0x1000, X509_V_FLAG_USE_DELTAS = 0x2000, X509_V_FLAG_CHECK_SS_SIGNATURE = 0x4000, X509_V_FLAG_TRUSTED_FIRST = 0x8000, X509_V_FLAG_SUITEB_128_LOS_ONLY = 0x10000, X509_V_FLAG_SUITEB_192_LOS = 0x20000, X509_V_FLAG_SUITEB_128_LOS = 0x30000, X509_V_FLAG_PARTIAL_CHAIN = 0x80000, X509_V_FLAG_NO_ALT_CHAINS = 0x100000, X509_V_FLAG_NO_CHECK_TIME = 0x200000, }, } if OPENSSL_3X then ffi.cdef [[ X509_STORE_CTX *X509_STORE_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq); int X509_STORE_set_default_paths_ex(X509_STORE *ctx, OSSL_LIB_CTX *libctx, const char *propq); // int X509_STORE_load_file_ex(X509_STORE *ctx, const char *file, // OSSL_LIB_CTX *libctx, const char *propq); // int X509_STORE_load_store_ex(X509_STORE *ctx, const char *uri, // OSSL_LIB_CTX *libctx, const char *propq); int X509_STORE_load_locations_ex(X509_STORE *ctx, const char *file, const char *dir, OSSL_LIB_CTX *libctx, const char *propq); ]] _M.X509_STORE_set_default_paths = function(...) return C.X509_STORE_set_default_paths_ex(...) end _M.X509_STORE_load_locations = function(...) return C.X509_STORE_load_locations_ex(...) end else _M.X509_STORE_set_default_paths = function(s) return C.X509_STORE_set_default_paths(s) end _M.X509_STORE_load_locations = function(s, file, dir) return C.X509_STORE_load_locations(s, file, dir) end end return _M PKFN]a=  resty/openssl/include/rand.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X if OPENSSL_3X then ffi.cdef [[ int RAND_bytes_ex(OSSL_LIB_CTX *ctx, unsigned char *buf, size_t num, unsigned int strength); int RAND_priv_bytes_ex(OSSL_LIB_CTX *ctx, unsigned char *buf, size_t num, unsigned int strength); ]] else ffi.cdef [[ int RAND_bytes(unsigned char *buf, int num); int RAND_priv_bytes(unsigned char *buf, int num); ]] end PKFN]ҁresty/openssl/include/bio.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ typedef struct bio_method_st BIO_METHOD; long BIO_ctrl(BIO *bp, int cmd, long larg, void *parg); BIO *BIO_new_mem_buf(const void *buf, int len); BIO *BIO_new(const BIO_METHOD *type); int BIO_free(BIO *a); const BIO_METHOD *BIO_s_mem(void); // int BIO_read(BIO *b, void *data, int dlen); ]] PKFN]?resty/openssl/include/ec.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ /** Enum for the point conversion form as defined in X9.62 (ECDSA) * for the encoding of a elliptic curve point (x,y) */ typedef enum { /** the point is encoded as z||x, where the octet z specifies * which solution of the quadratic equation y is */ POINT_CONVERSION_COMPRESSED = 2, /** the point is encoded as z||x||y, where z is the octet 0x04 */ POINT_CONVERSION_UNCOMPRESSED = 4, /** the point is encoded as z||x||y, where the octet z specifies * which solution of the quadratic equation y is */ POINT_CONVERSION_HYBRID = 6 } point_conversion_form_t; EC_KEY *EC_KEY_new(void); void EC_KEY_free(EC_KEY *key); EC_GROUP *EC_GROUP_new_by_curve_name(int nid); void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag); void EC_GROUP_set_point_conversion_form(EC_GROUP *group, point_conversion_form_t form); // void EC_GROUP_set_curve_name(EC_GROUP *group, int nid); int EC_GROUP_get_curve_name(const EC_GROUP *group); void EC_GROUP_free(EC_GROUP *group); BIGNUM *EC_POINT_point2bn(const EC_GROUP *, const EC_POINT *, point_conversion_form_t form, BIGNUM *, BN_CTX *); int EC_POINT_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *p, BIGNUM *x, BIGNUM *y, BN_CTX *ctx); EC_POINT *EC_POINT_bn2point(const EC_GROUP *group, const BIGNUM *bn, EC_POINT *p, BN_CTX *ctx); void EC_POINT_free(EC_POINT *point); point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key); const BIGNUM *EC_KEY_get0_private_key(const EC_KEY *key); int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *prv); const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *key); int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub); int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y); const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key); int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group); ]] PKFN]\resty/openssl/include/asn1.luanu[local ffi = require "ffi" local C = ffi.C require "resty.openssl.include.ossl_typ" local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X ffi.cdef [[ typedef struct ASN1_VALUE_st ASN1_VALUE; typedef struct asn1_type_st ASN1_TYPE; ASN1_IA5STRING *ASN1_IA5STRING_new(); int ASN1_STRING_type(const ASN1_STRING *x); ASN1_STRING *ASN1_STRING_type_new(int type); int ASN1_STRING_set(ASN1_STRING *str, const void *data, int len); ASN1_INTEGER *BN_to_ASN1_INTEGER(const BIGNUM *bn, ASN1_INTEGER *ai); BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn); typedef long time_t; ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t); int ASN1_INTEGER_set(ASN1_INTEGER *a, long v); long ASN1_INTEGER_get(const ASN1_INTEGER *a); int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v); int ASN1_STRING_print(BIO *bp, const ASN1_STRING *v); int ASN1_STRING_length(const ASN1_STRING *x); ]] local function declare_asn1_functions(typ, has_ex) local t = {} for i=1, 7 do t[i] = typ end ffi.cdef(string.format([[ %s *%s_new(void); void %s_free(%s *a); %s *%s_dup(%s *a); ]], unpack(t))) if OPENSSL_3X and has_ex then ffi.cdef(string.format([[ %s *%s_new_ex(OSSL_LIB_CTX *libctx, const char *propq); ]], typ, typ)) end end declare_asn1_functions("ASN1_INTEGER") declare_asn1_functions("ASN1_OBJECT") declare_asn1_functions("ASN1_STRING") declare_asn1_functions("ASN1_ENUMERATED") ffi.cdef[[ const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x); ]] local ASN1_STRING_get0_data = C.ASN1_STRING_get0_data return { ASN1_STRING_get0_data = ASN1_STRING_get0_data, declare_asn1_functions = declare_asn1_functions, has_new_ex = true, } PKFN]Sl$b resty/openssl/include/param.luanu[local ffi = require "ffi" require "resty.openssl.include.ossl_typ" ffi.cdef [[ typedef struct ossl_param_st { const char *key; /* the name of the parameter */ unsigned int data_type; /* declare what kind of content is in buffer */ void *data; /* value being passed in or out */ size_t data_size; /* data size */ size_t return_size; /* returned content size */ } OSSL_PARAM; OSSL_PARAM OSSL_PARAM_construct_int(const char *key, int *buf); OSSL_PARAM OSSL_PARAM_construct_uint(const char *key, unsigned int *buf); OSSL_PARAM OSSL_PARAM_construct_BN(const char *key, unsigned char *buf, size_t bsize); // OSSL_PARAM OSSL_PARAM_construct_double(const char *key, double *buf); OSSL_PARAM OSSL_PARAM_construct_utf8_string(const char *key, char *buf, size_t bsize); OSSL_PARAM OSSL_PARAM_construct_octet_string(const char *key, void *buf, size_t bsize); OSSL_PARAM OSSL_PARAM_construct_utf8_ptr(const char *key, char **buf, size_t bsize); OSSL_PARAM OSSL_PARAM_construct_octet_ptr(const char *key, void **buf, size_t bsize); OSSL_PARAM OSSL_PARAM_construct_end(void); int OSSL_PARAM_get_int32(const OSSL_PARAM *p, int32_t *val); int OSSL_PARAM_get_uint32(const OSSL_PARAM *p, uint32_t *val); int OSSL_PARAM_get_int64(const OSSL_PARAM *p, int64_t *val); int OSSL_PARAM_get_uint64(const OSSL_PARAM *p, uint64_t *val); // int OSSL_PARAM_get_size_t(const OSSL_PARAM *p, size_t *val); // int OSSL_PARAM_get_time_t(const OSSL_PARAM *p, time_t *val); int OSSL_PARAM_set_int(OSSL_PARAM *p, int val); int OSSL_PARAM_set_uint(OSSL_PARAM *p, unsigned int val); int OSSL_PARAM_set_long(OSSL_PARAM *p, long int val); int OSSL_PARAM_set_ulong(OSSL_PARAM *p, unsigned long int val); int OSSL_PARAM_set_int32(OSSL_PARAM *p, int32_t val); int OSSL_PARAM_set_uint32(OSSL_PARAM *p, uint32_t val); int OSSL_PARAM_set_int64(OSSL_PARAM *p, int64_t val); int OSSL_PARAM_set_uint64(OSSL_PARAM *p, uint64_t val); // int OSSL_PARAM_set_size_t(OSSL_PARAM *p, size_t val); // int OSSL_PARAM_set_time_t(OSSL_PARAM *p, time_t val); int OSSL_PARAM_get_double(const OSSL_PARAM *p, double *val); int OSSL_PARAM_set_double(OSSL_PARAM *p, double val); int OSSL_PARAM_get_BN(const OSSL_PARAM *p, BIGNUM **val); int OSSL_PARAM_set_BN(OSSL_PARAM *p, const BIGNUM *val); int OSSL_PARAM_get_utf8_string(const OSSL_PARAM *p, char **val, size_t max_len); int OSSL_PARAM_set_utf8_string(OSSL_PARAM *p, const char *val); int OSSL_PARAM_get_octet_string(const OSSL_PARAM *p, void **val, size_t max_len, size_t *used_len); int OSSL_PARAM_set_octet_string(OSSL_PARAM *p, const void *val, size_t len); int OSSL_PARAM_get_utf8_ptr(const OSSL_PARAM *p, const char **val); int OSSL_PARAM_set_utf8_ptr(OSSL_PARAM *p, const char *val); int OSSL_PARAM_get_octet_ptr(const OSSL_PARAM *p, const void **val, size_t *used_len); int OSSL_PARAM_set_octet_ptr(OSSL_PARAM *p, const void *val, size_t used_len); int OSSL_PARAM_get_utf8_string_ptr(const OSSL_PARAM *p, const char **val); int OSSL_PARAM_get_octet_string_ptr(const OSSL_PARAM *p, const void **val, size_t *used_len); ]] PKFN]]zWWresty/openssl/rand.luanu[local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string require "resty.openssl.include.rand" local ctx_lib = require "resty.openssl.ctx" local ctypes = require "resty.openssl.auxiliary.ctypes" local format_error = require("resty.openssl.err").format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local buf local buf_size = 0 local function bytes(length, private, strength) if type(length) ~= "number" then return nil, "rand.bytes: expect a number at #1" elseif strength and type(strength) ~= "number" then return nil, "rand.bytes: expect a number at #3" end -- generally we don't need manually reseed rng -- https://www.openssl.org/docs/man1.1.1/man3/RAND_seed.html -- initialize or resize buffer if not buf or buf_size < length then buf = ctypes.uchar_array(length) buf_size = length end local code if OPENSSL_3X then if private then code = C.RAND_priv_bytes_ex(ctx_lib.get_libctx(), buf, length, strength or 0) else code = C.RAND_bytes_ex(ctx_lib.get_libctx(), buf, length, strength or 0) end else if private then code = C.RAND_priv_bytes(buf, length) else code = C.RAND_bytes(buf, length) end end if code ~= 1 then return nil, format_error("rand.bytes", code) end return ffi_str(buf, length) end return { bytes = bytes, } PKGN]gdPqqresty/openssl/ssl_ctx.luanu[local ffi = require "ffi" local C = ffi.C local new_tab = table.new local char = string.char local concat = table.concat require "resty.openssl.include.ssl" local nginx_aux = require("resty.openssl.auxiliary.nginx") local _M = {} local mt = {__index = _M} local ssl_ctx_ptr_ct = ffi.typeof('SSL_CTX*') function _M.from_request() -- don't GC this local ctx, err = nginx_aux.get_req_ssl_ctx() if err ~= nil then return nil, err end return setmetatable({ ctx = ctx, -- the cdata is not manage by Lua, don't GC on Lua side _managed = false, -- this is the Server SSL session _server = true, }, mt) end function _M.from_socket(socket) if not socket then return nil, "expect a ngx.socket.tcp instance at #1" end -- don't GC this local ctx, err = nginx_aux.get_socket_ssl_ctx(socket) if err ~= nil then return nil, err end return setmetatable({ ctx = ctx, -- the cdata is not manage by Lua, don't GC on Lua side _managed = false, -- this is the client SSL session _server = false, }, mt) end function _M.istype(l) return l and l.ctx and ffi.istype(ssl_ctx_ptr_ct, l.ctx) end local function encode_alpn_wire(alpns) local ret = new_tab(#alpns*2, 0) for i, alpn in ipairs(alpns) do ret[i*2-1] = char(#alpn) ret[i*2] = alpn end return concat(ret, "") end function _M:set_alpns(alpns) if not self._server then return nil, "ssl_ctx:set_alpns is only supported on server side" end alpns = encode_alpn_wire(alpns) if self._alpn_select_cb then self._alpn_select_cb:free() end local alpn_select_cb = ffi.cast("SSL_CTX_alpn_select_cb_func", function(_, out, outlen, client, client_len) local code = ffi.C.SSL_select_next_proto( ffi.cast("unsigned char **", out), outlen, alpns, #alpns, client, client_len) if code ~= 1 then -- OPENSSL_NPN_NEGOTIATED return 3 -- SSL_TLSEXT_ERR_NOACK end return 0 -- SSL_TLSEXT_ERR_OK end) C.SSL_CTX_set_alpn_select_cb(self.ctx, alpn_select_cb, nil) -- store the reference to avoid it being GC'ed self._alpn_select_cb = alpn_select_cb return true end return _MPKGN]M**resty/openssl/ec.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc require "resty.openssl.include.ec" local bn_lib = require "resty.openssl.bn" local objects_lib = require "resty.openssl.objects" local format_error = require("resty.openssl.err").format_error local _M = {} _M.params = {"group", "public", "private", "x", "y"} local empty_table = {} function _M.get_parameters(ec_key_st) return setmetatable(empty_table, { __index = function(_, k) local group = C.EC_KEY_get0_group(ec_key_st) local bn if k == 'group' then local nid = C.EC_GROUP_get_curve_name(group) if nid == 0 then return nil, "ec.get_parameters: EC_GROUP_get_curve_name() failed" end return nid elseif k == 'public' or k == "pub_key" then local pub_point = C.EC_KEY_get0_public_key(ec_key_st) if pub_point == nil then return nil, format_error("ec.get_parameters: EC_KEY_get0_public_key") end local point_form = C.EC_KEY_get_conv_form(ec_key_st) if point_form == nil then return nil, format_error("ec.get_parameters: EC_KEY_get_conv_form") end bn = C.EC_POINT_point2bn(group, pub_point, point_form, nil, bn_lib.bn_ctx_tmp) if bn == nil then return nil, format_error("ec.get_parameters: EC_POINT_point2bn") end ffi_gc(bn, C.BN_free) elseif k == 'private' or k == "priv_key" then -- get0, don't GC bn = C.EC_KEY_get0_private_key(ec_key_st) elseif k == 'x' or k == 'y' then local pub_point = C.EC_KEY_get0_public_key(ec_key_st) if pub_point == nil then return nil, format_error("ec.get_parameters: EC_KEY_get0_public_key") end bn = C.BN_new() if bn == nil then return nil, "ec.get_parameters: BN_new() failed" end ffi_gc(bn, C.BN_free) local code if k == 'x' then code = C.EC_POINT_get_affine_coordinates(group, pub_point, bn, nil, bn_lib.bn_ctx_tmp) else code = C.EC_POINT_get_affine_coordinates(group, pub_point, nil, bn, bn_lib.bn_ctx_tmp) end if code ~= 1 then return nil, format_error("ec.get_parameters: EC_POINT_get_affine_coordinates") end else return nil, "ec.get_parameters: unknown parameter \"" .. k .. "\" for EC key" end if bn == nil then return nil end return bn_lib.dup(bn) end }), nil end function _M.set_parameters(ec_key_st, opts) for _, k in ipairs(_M.params) do if k ~= "group" then if opts[k] and not bn_lib.istype(opts[k]) then return nil, "expect parameter \"" .. k .. "\" to be a bn instance" end end end local group_nid = opts["group"] local group if group_nid then local nid, err = objects_lib.txtnid2nid(group_nid) if err then return nil, "ec.set_parameters: cannot use parameter \"group\":" .. err end group = C.EC_GROUP_new_by_curve_name(nid) if group == nil then return nil, "ec.set_parameters: EC_GROUP_new_by_curve_name() failed" end ffi_gc(group, C.EC_GROUP_free) -- # define OPENSSL_EC_NAMED_CURVE 0x001 C.EC_GROUP_set_asn1_flag(group, 1) C.EC_GROUP_set_point_conversion_form(group, C.POINT_CONVERSION_UNCOMPRESSED) if C.EC_KEY_set_group(ec_key_st, group) ~= 1 then return nil, format_error("ec.set_parameters: EC_KEY_set_group") end end local x = opts["x"] local y = opts["y"] local pub = opts["public"] if (x and not y) or (y and not x) then return nil, "ec.set_parameters: \"x\" and \"y\" parameter must be defined at same time or both undefined" end if x and y then if pub then return nil, "ec.set_parameters: cannot set \"x\" and \"y\" with \"public\" at same time to set public key" end -- double check if we have set group already if group == nil then group = C.EC_KEY_get0_group(ec_key_st) if group == nil then return nil, "ec.set_parameters: cannot set public key without setting \"group\"" end end if C.EC_KEY_set_public_key_affine_coordinates(ec_key_st, x.ctx, y.ctx) ~= 1 then return nil, format_error("ec.set_parameters: EC_KEY_set_public_key_affine_coordinates") end end if pub then if group == nil then group = C.EC_KEY_get0_group(ec_key_st) if group == nil then return nil, "ec.set_parameters: cannot set public key without setting \"group\"" end end local point = C.EC_POINT_bn2point(group, pub.ctx, nil, bn_lib.bn_ctx_tmp) if point == nil then return nil, format_error("ec.set_parameters: EC_POINT_bn2point") end ffi_gc(point, C.EC_POINT_free) if C.EC_KEY_set_public_key(ec_key_st, point) ~= 1 then return nil, format_error("ec.set_parameters: EC_KEY_set_public_key") end end local priv = opts["private"] if priv then -- openssl duplicates it inside if C.EC_KEY_set_private_key(ec_key_st, priv.ctx) ~= 1 then return nil, format_error("ec.set_parameters: EC_KEY_set_private_key") end end return true end return _M PKGN]~  resty/openssl/asn1.luanu[local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local floor = math.floor local asn1_macro = require("resty.openssl.include.asn1") -- https://github.com/wahern/luaossl/blob/master/src/openssl.c local function isleap(year) return (year % 4) == 0 and ((year % 100) > 0 or (year % 400) == 0) end local past = { 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334 } local function yday(year, mon, mday) local d = past[mon] + mday - 1 if mon > 2 and isleap(year) then d = d + 1 end return d end local function leaps(year) return floor(year / 400) + floor(year / 4) - floor(year / 100) end local function asn1_to_unix(asn1) if asn1 == nil then return nil, "except an ASN1 instance at #1, got nil" end local s = asn1_macro.ASN1_STRING_get0_data(asn1) s = ffi_str(s) -- V_ASN1_UTCTIME 190303223958Z -- V_ASN1_GENERALIZEDTIME 21190822162753Z local yyoffset = 2 local year -- # define V_ASN1_GENERALIZEDTIME 24 if C.ASN1_STRING_type(asn1) == 24 then yyoffset = 4 year = tonumber(s:sub(1, yyoffset)) else year = tonumber(s:sub(1, yyoffset)) year = year + (year < 50 and 2000 or 1900) end local month = tonumber(s:sub(yyoffset+1, yyoffset+2)) if month > 12 or month < 1 then return nil, "asn1.asn1_to_unix: bad format " .. s end local day = tonumber(s:sub(yyoffset+3, yyoffset+4)) if day > 31 or day < 1 then return nil, "asn1.asn1_to_unix: bad format " .. s end local hour = tonumber(s:sub(yyoffset+5, yyoffset+6)) if hour > 23 or hour < 0 then return nil, "asn1.asn1_to_unix: bad format " .. s end local minute = tonumber(s:sub(yyoffset+7, yyoffset+8)) if minute > 59 or hour < 0 then return nil, "asn1.asn1_to_unix: bad format " .. s end local second = tonumber(s:sub(yyoffset+9, yyoffset+10)) if second > 59 or second < 0 then return nil, "asn1.asn1_to_unix: bad format " .. s end local tm tm = (year - 1970) * 365 tm = tm + leaps(year - 1) - leaps(1969) tm = (tm + yday(year, month, day)) * 24 tm = (tm + hour) * 60 tm = (tm + minute) * 60 tm = tm + second -- offset? local sign = s:sub(yyoffset+11, yyoffset+11) if sign == "+" or sign == "-" then local sgn = sign == "+" and 1 or -1 local hh = tonumber(s:sub(yyoffset+12, yyoffset+13) or 'no') local mm = tonumber(s:sub(yyoffset+14, yyoffset+15) or 'no') if not hh or not mm then return nil, "asn1.asn1_to_unix: bad format " .. s end tm = tm + sgn * (hh * 3600 + mm * 60) end return tm end return { asn1_to_unix = asn1_to_unix, } PKGN]yresty/openssl/ecx.luanu[local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string require "resty.openssl.include.ec" require "resty.openssl.include.evp" local ctypes = require "resty.openssl.auxiliary.ctypes" local format_error = require("resty.openssl.err").format_error local _M = {} _M.params = {"public", "private"} local empty_table = {} local MAX_ECX_KEY_SIZE = 114 -- ed448 uses 114 bytes function _M.get_parameters(evp_pkey_st) return setmetatable(empty_table, { __index = function(_, k) local buf = ctypes.uchar_array(MAX_ECX_KEY_SIZE) local length = ctypes.ptr_of_size_t(MAX_ECX_KEY_SIZE) if k == 'public' or k == "pub_key" then if C.EVP_PKEY_get_raw_public_key(evp_pkey_st, buf, length) ~= 1 then error(format_error("ecx.get_parameters: EVP_PKEY_get_raw_private_key")) end elseif k == 'private' or k == "priv ~=_key" then if C.EVP_PKEY_get_raw_private_key(evp_pkey_st, buf, length) ~= 1 then return nil, format_error("ecx.get_parameters: EVP_PKEY_get_raw_private_key") end else return nil, "ecx.get_parameters: unknown parameter \"" .. k .. "\" for EC key" end return ffi_str(buf, length[0]) end }), nil end function _M.set_parameters(key_type, evp_pkey_st, opts) -- for ecx keys we always create a new EVP_PKEY and release the old one -- Note: we allow to pass a nil as evp_pkey_st to create a new EVP_PKEY local key if opts.private then local priv = opts.private key = C.EVP_PKEY_new_raw_private_key(key_type, nil, priv, #priv) if key == nil then return nil, format_error("ecx.set_parameters: EVP_PKEY_new_raw_private_key") end elseif opts.public then local pub = opts.public key = C.EVP_PKEY_new_raw_public_key(key_type, nil, pub, #pub) if key == nil then return nil, format_error("ecx.set_parameters: EVP_PKEY_new_raw_public_key") end else return nil, "no parameter is specified" end if evp_pkey_st ~= nil then C.EVP_PKEY_free(evp_pkey_st) end return key end return _M PKHN]l3W resty/openssl/digest.luanu[local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string require "resty.openssl.include.evp.md" local ctypes = require "resty.openssl.auxiliary.ctypes" local ctx_lib = require "resty.openssl.ctx" local format_error = require("resty.openssl.err").format_error local OPENSSL_3X = require("resty.openssl.version").OPENSSL_3X local _M = {} local mt = {__index = _M} local md_ctx_ptr_ct = ffi.typeof('EVP_MD_CTX*') function _M.new(typ, properties) local ctx = C.EVP_MD_CTX_new() if ctx == nil then return nil, "digest.new: failed to create EVP_MD_CTX" end ffi_gc(ctx, C.EVP_MD_CTX_free) local err_new = string.format("digest.new: invalid digest type \"%s\"", typ) local algo if typ == "null" then algo = C.EVP_md_null() else if OPENSSL_3X then algo = C.EVP_MD_fetch(ctx_lib.get_libctx(), typ or 'sha1', properties) ffi_gc(algo, C.EVP_MD_free) else algo = C.EVP_get_digestbyname(typ or 'sha1') end if algo == nil then return nil, format_error(err_new) end end local code = C.EVP_DigestInit_ex(ctx, algo, nil) if code ~= 1 then return nil, format_error(err_new) end return setmetatable({ ctx = ctx, algo = algo, buf = ctypes.uchar_array(OPENSSL_3X and C.EVP_MD_get_size(algo) or C.EVP_MD_size(algo)), }, mt), nil end function _M.istype(l) return l and l.ctx and ffi.istype(md_ctx_ptr_ct, l.ctx) end function _M:get_provider_name() if not OPENSSL_3X then return false, "digest:get_provider_name is not supported" end local p = C.EVP_MD_get0_provider(self.algo) if p == nil then return nil end return ffi_str(C.OSSL_PROVIDER_get0_name(p)) end if OPENSSL_3X then local param_lib = require "resty.openssl.param" _M.settable_params, _M.set_params, _M.gettable_params, _M.get_param = param_lib.get_params_func("EVP_MD_CTX") end function _M:update(...) for _, s in ipairs({...}) do if C.EVP_DigestUpdate(self.ctx, s, #s) ~= 1 then return false, format_error("digest:update") end end return true, nil end local result_length = ctypes.ptr_of_uint() function _M:final(s) if s then if C.EVP_DigestUpdate(self.ctx, s, #s) ~= 1 then return false, format_error("digest:final") end end -- no return value of EVP_DigestFinal_ex C.EVP_DigestFinal_ex(self.ctx, self.buf, result_length) if result_length[0] == nil or result_length[0] <= 0 then return nil, format_error("digest:final: EVP_DigestFinal_ex") end return ffi_str(self.buf, result_length[0]) end function _M:reset() local code = C.EVP_DigestInit_ex(self.ctx, self.algo, nil) if code ~= 1 then return false, format_error("digest:reset") end return true end return _M PKHN]f++resty/openssl/param.luanu[local ffi = require "ffi" local C = ffi.C local ffi_new = ffi.new local ffi_str = ffi.string local ffi_cast = ffi.cast require "resty.openssl.include.param" local format_error = require("resty.openssl.err").format_error local bn_lib = require("resty.openssl.bn") local null = require("resty.openssl.auxiliary.ctypes").null local nkeys = require "resty.openssl.auxiliary.compat".nkeys local OSSL_PARAM_INTEGER = 1 local OSSL_PARAM_UNSIGNED_INTEGER = 2 local OSSL_PARAM_REAL = 3 local OSSL_PARAM_UTF8_STRING = 4 local OSSL_PARAM_OCTET_STRING = 5 local OSSL_PARAM_UTF8_PTR = 6 local OSSL_PARAM_OCTET_PTR = 7 local alter_type_key = {} local buf_param_key = {} local buf_anchor_key = {} local function construct(buf_t, length, types_map, types_size) if not length then length = nkeys(buf_t) end local params = ffi_new("OSSL_PARAM[?]", length + 1) local i = 0 local buf_param, buf_anchored for key, value in pairs(buf_t) do if key == buf_anchor_key then goto continue end local typ = types_map[key] if not typ then return nil, "param:construct: unknown key \"" .. key .. "\"" end local param, buf, size if value == null then -- out value = nil size = types_size and types_size[key] or 100 if typ == OSSL_PARAM_UTF8_STRING or typ == OSSL_PARAM_OCTET_STRING then buf = ffi_new("char[?]", size) end else local string_input = type(value) == "string" -- binary input is also accepted as string local integer_input = type(value) == "number" or string_input if (not string_input and typ >= OSSL_PARAM_UTF8_STRING) or (not integer_input and typ <= OSSL_PARAM_UNSIGNED_INTEGER) then local alter_typ = types_map[alter_type_key] and types_map[alter_type_key][key] if alter_typ and ((not string_input and alter_typ <= OSSL_PARAM_UNSIGNED_INTEGER) or (not integer_input and alter_typ >= OSSL_PARAM_UTF8_STRING)) then typ = alter_typ else return nil, "param:construct: key \"" .. key .. "\" can't be a " .. type(value) end end end if typ == "bn" then -- out only buf = ffi_new("char[?]", size) param = C.OSSL_PARAM_construct_BN(key, buf, size) buf_param = buf_param or {} buf_param[key] = param elseif typ == OSSL_PARAM_INTEGER then if value and type(value) == "string" then -- in only local bin = ffi_cast("char *", value) param = C.OSSL_PARAM_construct_BN(key, bin, #value) else buf = value and ffi_new("int[1]", value) or ffi_new("int[1]") param = C.OSSL_PARAM_construct_int(key, buf) end elseif typ == OSSL_PARAM_UNSIGNED_INTEGER then if value and type(value) == "string" then -- in only local bin = ffi_cast("char *", value) param = C.OSSL_PARAM_construct_BN(key, bin, #value) else buf = value and ffi_new("unsigned int[1]", value) or ffi_new("unsigned int[1]") param = C.OSSL_PARAM_construct_uint(key, buf) end elseif typ == OSSL_PARAM_UTF8_STRING then buf = value ~= nil and ffi_cast("char *", value) or buf param = C.OSSL_PARAM_construct_utf8_string(key, buf, value and #value or size) elseif typ == OSSL_PARAM_OCTET_STRING then buf = value ~= nil and ffi_cast("char *", value) or buf param = C.OSSL_PARAM_construct_octet_string(key, ffi_cast("void*", buf), value and #value or size) elseif typ == OSSL_PARAM_UTF8_PTR then -- out only buf = ffi_new("char*[1]") param = C.OSSL_PARAM_construct_utf8_ptr(key, buf, 0) elseif typ == OSSL_PARAM_OCTET_PTR then -- out only buf = ffi_new("char*[1]") param = C.OSSL_PARAM_construct_octet_ptr(key, ffi_cast("void**", buf), 0) else error("type " .. typ .. " is not yet implemented") end if value == nil then -- out buf_t[key] = buf else -- in -- save value as OSSL_PARAM_construct_* doesn't copy the value buf_anchored = buf_anchored or {} buf_anchored[key] = buf end params[i] = param i = i + 1 ::continue:: end buf_t[buf_anchor_key] = buf_anchored buf_t[buf_param_key] = buf_param params[length] = C.OSSL_PARAM_construct_end() return params end local function parse(buf_t, length, types_map, types_size) for key, buf in pairs(buf_t) do local typ = types_map[key] local sz = types_size and types_size[key] if key == buf_param_key then -- luacheck: ignore -- ignore elseif buf == nil or buf[0] == nil then buf_t[key] = nil elseif typ == "bn" then local bn_t = ffi_new("BIGNUM*[1]") local param = buf_t[buf_param_key][key] if C.OSSL_PARAM_get_BN(param, bn_t) ~= 1 then return nil, format_error("param:parse: OSSL_PARAM_get_BN") end buf_t[key] = assert(bn_lib.dup(bn_t[0])) C.BN_free(bn_t[0]) elseif typ == OSSL_PARAM_INTEGER or typ == OSSL_PARAM_UNSIGNED_INTEGER then buf_t[key] = tonumber(buf[0]) elseif typ == OSSL_PARAM_UTF8_STRING or typ == OSSL_PARAM_OCTET_STRING then buf_t[key] = sz and ffi_str(buf, sz) or ffi_str(buf) elseif typ == OSSL_PARAM_UTF8_PTR or typ == OSSL_PARAM_OCTET_PTR then buf_t[key] = sz and ffi_str(buf[0], sz) or ffi_str(buf[0]) elseif not typ then return nil, "param:parse: unknown key type \"" .. key .. "\"" else error("type " .. typ .. " is not yet implemented") end end -- for GC buf_t[buf_param_key] = nil return buf_t end local param_type_readable = { [OSSL_PARAM_UNSIGNED_INTEGER] = "unsigned integer", [OSSL_PARAM_INTEGER] = "integer", [OSSL_PARAM_REAL] = "real number", [OSSL_PARAM_UTF8_PTR] = "pointer to a UTF8 encoded string", [OSSL_PARAM_UTF8_STRING] = "UTF8 encoded string", [OSSL_PARAM_OCTET_PTR] = "pointer to an octet string", [OSSL_PARAM_OCTET_STRING] = "octet string", } local function readable_data_type(p) local typ = p.data_type local literal = param_type_readable[typ] if not literal then literal = string.format("unknown type [%d]", typ) end local sz = tonumber(p.data_size) if sz == 0 then literal = literal .. " (arbitrary size)" else literal = literal .. string.format(" (max %d bytes large)", sz) end return literal end local function parse_params_schema(params, schema, schema_readable) if params == nil then return nil, format_error("parse_params_schema") end local i = 0 while true do local p = params[i] if p.key == nil then break end local key = ffi_str(p.key) if schema then -- TODO: don't support same key with different types for now -- prefer string type over integer types local typ = tonumber(p.data_type) if schema[key] then schema[alter_type_key] = schema[alter_type_key] or {} schema[alter_type_key][key] = typ else schema[key] = typ end end -- if schema_return_size then -- only non-ptr string types are needed actually -- schema_return_size[key] = tonumber(p.return_size) -- end if schema_readable then table.insert(schema_readable, { key, readable_data_type(p) }) end i = i + 1 end return schema end local param_maps_set, param_maps_get = {}, {} local function get_params_func(typ, field) local typ_lower = typ:sub(5):lower() if typ_lower:sub(-4) == "_ctx" then typ_lower = typ_lower:sub(0, -5) end -- field name for indexing schema, usually the (const) one created by -- EVP_TYP_fetch or EVP_get_typebynam,e field = field or "algo" local cf_settable = C[typ .. "_settable_params"] local settable = function(self, raw) local k = self[field] if raw and param_maps_set[k] then return param_maps_set[k] end local param = cf_settable(self.ctx) -- no params, this is fine, shouldn't be regarded as an error if param == nil then param_maps_set[k] = {} return {} end local schema, schema_reabale = {}, raw and nil or {} parse_params_schema(param, schema, schema_reabale) param_maps_set[k] = schema return raw and schema or schema_reabale end local cf_set = C[typ .. "_set_params"] local set = function(self, params) if not param_maps_set[self[field]] then local ok, err = self:settable_params(true) -- only query raw schema to save memory if not ok then return false, typ_lower .. ":set_params: " .. err end end local oparams, err = construct(params, nil, param_maps_set[self[field]]) if err then return false, typ_lower .. ":set_params: " .. err end if cf_set(self.ctx, oparams) ~= 1 then return false, format_error(typ_lower .. ":set_params: " .. typ .. "_set_params") end return true end local cf_gettable = C[typ .. "_gettable_params"] local gettable = function(self, raw) local k = self[field] if raw and param_maps_get[k] then return param_maps_get[k] end local param = cf_gettable(self.ctx) -- no params, this is fine, shouldn't be regarded as an error if param == nil then param_maps_get[k] = {} return {} end local schema, schema_reabale = {}, raw and nil or {} parse_params_schema(param, schema, schema_reabale) param_maps_get[k] = schema return raw and schema or schema_reabale end local cf_get = C[typ .. "_get_params"] local get_buffer, get_size_map = {}, {} local get = function(self, key, want_size, want_type) if not param_maps_get[self[field]] then local ok, err = self:gettable_params(true) -- only query raw schema to save memory if not ok then return false, typ_lower .. ":set_params: " .. err end end local schema = param_maps_get[self[field]] if schema == nil or not schema[key] then -- nil or null return nil, typ_lower .. ":get_param: unknown key \"" .. key .. "\"" end table.clear(get_buffer) table.clear(get_size_map) get_buffer[key] = null get_size_map[key] = want_size schema = want_type and { [key] = want_type } or schema local req, err = construct(get_buffer, 1, schema, get_size_map) if not req then return nil, typ_lower .. ":get_param: failed to construct params: " .. err end if cf_get(self.ctx, req) ~= 1 then return nil, format_error(typ_lower .. ":get_param:get") end get_buffer, err = parse(get_buffer, 1, schema, get_size_map) if err then return nil, typ_lower .. ":get_param: failed to parse params: " .. err end return get_buffer[key] end return settable, set, gettable, get end return { OSSL_PARAM_INTEGER = OSSL_PARAM_INTEGER, OSSL_PARAM_UNSIGNED_INTEGER = OSSL_PARAM_INTEGER, OSSL_PARAM_REAL = OSSL_PARAM_REAL, OSSL_PARAM_UTF8_STRING = OSSL_PARAM_UTF8_STRING, OSSL_PARAM_OCTET_STRING = OSSL_PARAM_OCTET_STRING, OSSL_PARAM_UTF8_PTR = OSSL_PARAM_UTF8_PTR, OSSL_PARAM_OCTET_PTR = OSSL_PARAM_OCTET_PTR, construct = construct, parse = parse, parse_params_schema = parse_params_schema, get_params_func = get_params_func, }PKHN]v v resty/signal.luanu[local _M = { version = 0.04 } local ffi = require "ffi" local base = require "resty.core.base" local C = ffi.C local ffi_str = ffi.string local tonumber = tonumber local assert = assert local errno = ffi.errno local type = type local new_tab = base.new_tab local error = error local string_format = string.format local load_shared_lib do local string_gmatch = string.gmatch local string_match = string.match local io_open = io.open local io_close = io.close local cpath = package.cpath function load_shared_lib(so_name) local tried_paths = new_tab(32, 0) local i = 1 for k, _ in string_gmatch(cpath, "[^;]+") do if k == "?.so" then k = "./" end local fpath = string_match(k, "(.*/)") fpath = fpath .. so_name -- Don't get me wrong, the only way to know if a file exist is -- trying to open it. local f = io_open(fpath) if f ~= nil then io_close(f) return ffi.load(fpath) end tried_paths[i] = fpath i = i + 1 end return nil, tried_paths end -- function end -- do local resty_signal, tried_paths = load_shared_lib("librestysignal.so") if not resty_signal then error("could not load librestysignal.so from the following paths:\n" .. table.concat(tried_paths, "\n"), 2) end ffi.cdef[[ int resty_signal_signum(int num); ]] if not pcall(function () return C.kill end) then ffi.cdef("int kill(int32_t pid, int sig);") end if not pcall(function () return C.strerror end) then ffi.cdef("char *strerror(int errnum);") end -- Below is just the ID numbers for each POSIX signal. We map these signal IDs -- to system-specific signal numbers on the C land (via librestysignal.so). local signals = { NONE = 0, HUP = 1, INT = 2, QUIT = 3, ILL = 4, TRAP = 5, ABRT = 6, BUS = 7, FPE = 8, KILL = 9, USR1 = 10, SEGV = 11, USR2 = 12, PIPE = 13, ALRM = 14, TERM = 15, CHLD = 17, CONT = 18, STOP = 19, TSTP = 20, TTIN = 21, TTOU = 22, URG = 23, XCPU = 24, XFSZ = 25, VTALRM = 26, PROF = 27, WINCH = 28, IO = 29, PWR = 30, EMT = 31, SYS = 32, INFO = 33 } local function signum(name) local sig_num if type(name) == "number" then sig_num = name else local id = signals[name] if not id then return nil, "unknown signal name" end sig_num = tonumber(resty_signal.resty_signal_signum(id)) if sig_num < 0 then error( string_format("missing C def for signal %s = %d", name, id), 2 ) end end return sig_num end function _M.kill(pid, sig) assert(sig) local sig_num, err = signum(sig) if err then return nil, err end local rc = tonumber(C.kill(assert(pid), sig_num)) if rc == 0 then return true end local err = ffi_str(C.strerror(errno())) return nil, err end _M.signum = signum return _M PKHN]/tresty/sha256.luanu[-- Copyright (C) by Yichun Zhang (agentzh) require "resty.sha" local ffi = require "ffi" local ffi_new = ffi.new local ffi_str = ffi.string local C = ffi.C local setmetatable = setmetatable --local error = error local _M = { _VERSION = '0.17' } local mt = { __index = _M } ffi.cdef[[ typedef struct SHA256state_st { SHA_LONG h[8]; SHA_LONG Nl,Nh; SHA_LONG data[SHA_LBLOCK]; unsigned int num,md_len; } SHA256_CTX; int SHA256_Init(SHA256_CTX *c); int SHA256_Update(SHA256_CTX *c, const void *data, size_t len); int SHA256_Final(unsigned char *md, SHA256_CTX *c); ]] local digest_len = 32 local buf = ffi_new("char[?]", digest_len) local ctx_ptr_type = ffi.typeof("SHA256_CTX[1]") function _M.new(self) local ctx = ffi_new(ctx_ptr_type) if C.SHA256_Init(ctx) == 0 then return nil end return setmetatable({ _ctx = ctx }, mt) end function _M.update(self, s) return C.SHA256_Update(self._ctx, s, #s) == 1 end function _M.final(self) if C.SHA256_Final(buf, self._ctx) == 1 then return ffi_str(buf, digest_len) end return nil end function _M.reset(self) return C.SHA256_Init(self._ctx) == 1 end return _M PKHN]Xwwresty/string.luanu[-- Copyright (C) by Yichun Zhang (agentzh) local ffi = require "ffi" local ffi_new = ffi.new local ffi_str = ffi.string local C = ffi.C --local setmetatable = setmetatable --local error = error local tonumber = tonumber local _M = { _VERSION = '0.17' } ffi.cdef[[ typedef unsigned char u_char; u_char * ngx_hex_dump(u_char *dst, const u_char *src, size_t len); intptr_t ngx_atoi(const unsigned char *line, size_t n); ]] local str_type = ffi.typeof("uint8_t[?]") local BUF_MAX_LEN = 1024 local hex_buf = ffi_new(str_type, BUF_MAX_LEN) function _M.to_hex(s) local len = #s local buf_len = len * 2 local buf if buf_len <= BUF_MAX_LEN then buf = hex_buf else buf = ffi_new(str_type, buf_len) end C.ngx_hex_dump(buf, s, len) return ffi_str(buf, buf_len) end function _M.atoi(s) return tonumber(C.ngx_atoi(s, #s)) end return _M PKHN]@L7webshield/sslutils.luanu[local ngx_ssl = require('ngx.ssl') local openssl = require('openssl') local lfs = require('lfs') local domains_ips = ngx.shared.domains_ips local ssl_cache_file = '/var/cache/imunify360-webshield/ssl.cache' local notfound_ssl = ngx.shared.notfound_ssl_domains local function split(line, sep, num) local fields = {} local pos = 0 local count = 0 local strlen = line:len() while strlen > pos do local start, stop = line:find(sep, pos) if start == nil then table.insert(fields, line:sub(pos)) break end table.insert(fields, line:sub(pos, start - 1)) pos = stop + 1 count = count + 1 if count == num then table.insert(fields, line:sub(pos)) break end end return fields end local function read_certs(_cache) local f = io.open(ssl_cache_file) if not f then return end local _names = setmetatable({}, {_mode="kv"}) for key, _ in pairs(_cache) do _names[key] = true end for line in f:lines() do local _pair = split(line, ';;', 1) if #_pair ~= 2 then goto continue end _pair[2] = _pair[2]:gsub('\\r\\n', '\\n') -- unifying EOL markers local data = _pair[2]:gsub('\\n', '\n') -- cert itself local bundle = table.concat({data}, "\n") local xcrt = openssl.x509.read(bundle) if not xcrt then ngx.log(ngx.WARN, "Failed to get SSL XCRT (host: ", _pair[1], ")") goto continue end local crt = ngx_ssl.parse_pem_cert(bundle) if not crt then ngx.log(ngx.WARN, "Failed to get SSL CRT (host: ", _pair[1], ")") goto continue end local key = ngx_ssl.parse_pem_priv_key(bundle) if not key then ngx.log(ngx.WARN, "Failed to get SSL KEY (host: ", _pair[1], ")") goto continue end local val = {["xcrt"] = xcrt, ["crt"] = crt, ["key"] = key} _cache[_pair[1]] = val _names[_pair[1]] = nil ::continue:: end for key, _ in pairs(_names) do _cache[key] = nil end f:close() end local function cache_getter() local _cache = {} local _cached_mtime = 0 return function (name, addr) local mtime = lfs.attributes(ssl_cache_file, 'modification') if _cached_mtime ~= mtime then _cached_mtime = mtime read_certs(_cache) notfound_ssl:flush_all() -- clear not_found dict end local dedicated_domain = domains_ips:get(addr) if not name then -- No SNI found ngx.log(ngx.WARN, "Could not get SNI for request (IP: ", addr, ")") if dedicated_domain then name = dedicated_domain end end if name then local cert = _cache[name] if cert then return cert end local notfound_name = notfound_ssl:get(name) -- we didn't find cert for the name earlier if notfound_name then -- so there's no need to look for it again return end for key, cert in pairs(_cache) do if cert["xcrt"]:check_host(name) then return cert end end ngx.log(ngx.WARN, "Certificate not found (host: ", name, ")") ok, err, forced = notfound_ssl:set(name, true, 3600) -- cache name for missing cert for an hour if not ok then ngx.log(ngx.ERR, "Could not cache name (", name, ") of missing cert: ", err) end end end end local get_cert_by_host = cache_getter() return { get_cert_by_host = get_cert_by_host } PKHN]B xSxSlfs.sonuȯELF>p@xL@8@P5P5 << <  >> > $$Ptd(.(.(.DDQtdRtd<< < 00GNUb9g%^60/l:@ (:=kнBE|HDHE(ATIUSHLHŋ8Mt2 LH5eHH1HcuHj[]A\HHff.AW1AVAUATUHSHHMIILHՅH߉HH&t 11HUH! H0Ht7HhA@HLHUDHH(HuHu׸HĘ[]A\A]A^A_H1ҾL5b! II>HM~DIIHtpLxuHcLHHAT.H 8HaLH57HH1HcuH:@LH5/ H1H5 D@AV1ҾIAUATUS1I DLHLjHcЅx+9?LcHLHHu[1]A\A]A^@H[1]A\A]A^DHLHy[]A\A]A^ff.USHHmt)1ҾHH=Y Ht H5 HAŃt*H[]ÐHtLH[]fDHuHtH H@HHH5 []SAT1ҾUSH1H5HIH1[@SH H8HtHH;vH1[ff.AUATUSHHHT$H߾IIHD$HxSHLHHsHH/lockfilHH=@e.lffP t;ImH߾H2H߾H[]A\A]fDHH08tHHYH[]A\A]fSHr8;HH5H1[U1SHHHH1t/Hf(HH,H$HHD$HtH߾H[]@H1fH[]ff.@S1ҾH HtH߾q[f.H1[DAT1ҾUSH1ҾHHHIKu/H LH1H߃t&Y[]A\Ha []A\ff.@ATIUS1HHHu88"uVHHHHHu[LH5]A\DHL(H@[]A\fLH5H߉[]A\ATHIUHS5HHt H[]A\DLH5H1\f.AUH5ATUSHH(1ҾHI51ҾHH1ҾHIUuwrtVH1H5H1t"H߾=H([]A\A]DHH([]A\A]D1f4$1LLl$fT$HD$H1@Df<$Df $DSH5iH1H߾H ? ZH߾}HH5<>[S1ҾHH(tH߾6[H1[ff.fATH5USHH 1ҾHH1ҾHIHLd$$HD$H1 tH߾H []A\HH []A\SH5H 11HD1HH5XH߾H 1HH5CH߾HZH߾HF1HH5 UHH߾!HH5!11H1HH5H߾HH߾Hd1HH5H߾HG11H &6FVfv&6FVfv&6FVfv&6FVf--------- ,,,,,,,,,p,`-P,,@-0GA$3a1+ GA$3p1113**GA*GA$annobin gcc 8.5.0 20210514GA$plugin name: gcc-annobinGA$running gcc 8.5.0 20210514GA*GA*GA! GA*FORTIFYGA+GLIBCXX_ASSERTIONS GA*GOW*GA*cf_protectionGA+omit_frame_pointerGA+stack_clashGA!stack_realign GA$3p1113**GA*GA$annobin gcc 8.5.0 20210514GA$plugin name: gcc-annobinGA$running gcc 8.5.0 20210514GA*GA*GA! GA*FORTIFYGA+GLIBCXX_ASSERTIONS GA*GOW*GA*cf_protectionGA+omit_frame_pointerGA+stack_clashGA!stack_realignlfs.so-1.49.0-1.el8.x86_64.debugi/W7zXZִF!t/GZ]?Eh=ڊ2N$SzדPhw9M<aꆛ3 [GH 7R@_G^\s!*>7Qύ}PAlj;6b&xvLLM ^f)j,ovmоg?*iz?p~ g:a7qwOsݍ ^|-Cˑ`"4l&7C~ե^Pس[m˿#z$ |dQY6-qrZH'5&:Cqm'g&9P7cO8Gkp]0fZ^bdEl6Zԯ+e*RU[RCdzh V+C1{TZ R7:fwE2dKQƽ*s<{"e[T)ǔ'țG0HOٞ}(־=x reお0mwDnZg}wdz/.Hivrkcgh R' (;<@s\SInyB](MitRqItq#nQc|a4;ҖEF9q 3`<@!Sqr5JXgb2M4>pVngӠ~%YpW A5AH0da wE*•0)&IEDG1HGdU{GWߏl\ڇw~u!_jݗ$bn64jsZQ2,z rVȱ:Ħ3fiY$MSgYZ.shstrtab.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.data.rel.ro.dynamic.got.got.plt.data.bss.gnu.build.attributes.gnu_debuglink.gnu_debugdata $o8( ((08o  ~Eo 0T 0^Bhc`nppt** z2++ (.(.Dp/p/< << << <  > >? ?8@ @A A B BB`BF(F`KPKHN]%|#((cjson.sonuȯELF>p!@(@8@oo P}P} P} 1P ~~ ~ $$Ptdeee\\QtdRtdP}P} P} GNUaDGJk)P%>A$X >CIrx~qBELӎ3C|IqX |(ܴ -P#dȵ]}k UfpFD w"M^ V2V _d2yU=, F"N; U  X WE  0We k `Xl [d Wi~ Y @Z- U \q__gmon_start___ITM_deregisterTMCloneTable_ITM_registerTMCloneTable__cxa_finalizelua_touserdatastrbuf_freelua_tolstringstrbuf_append_stringstrbuf_resizeabortstrtollfpconv_strtodlua_gettopluaL_argerrorlua_pushvaluelua_insertlua_pcallluaL_errorlua_pushnilfpconv_initlua_pushlightuserdatalua_rawgetlua_typelua_createtablelua_newuserdatalua_pushcclosurelua_setfieldlua_setmetatablestrbuf_initluaL_checkstacklua_settoplua_pushlstringlua_rawsetlua_getfieldluaL_checkoptionlua_pushstringlua_pushbooleanlua_tobooleanlua_pushintegerluaL_checkintegersnprintfluaL_checklstringlua_tonumberfpconv_g_fmtlua_typenamestrncasecmplua_checkstacklua_rawsetilua_pushnumberstrbuf_newlua_getmetatablelua_nextlua_rawequallua_objlenluaL_getmetafieldlua_calllua_rawgetilua_gettableluaopen_cjsonluaopen_cjson_safestderrvfprintffputcmallocstrbuf_free_to_stringreallocmemcpystrchrfwritelibc.so.6_edata__bss_start_endGLIBC_2.14GLIBC_2.2.5ui P} 0"X} !`} `} } "a} .a} 8a} Da} Na} Wa} `a} ja} ta} {a} a} a} a} a} a ]( R0 ]8 PE@ ]H 4P ^X 0` ^h -p 3^x + G^ 3 X^ P1 i^ 2 ^ + ^Ȃ @.Ђ ^؂ p/ ^ 6 a 0 ^ 5 ^ $@ E`H ~^P ]` E`h ~^ I` P` W` ^` e` l` s` z` `ȃ `Ѓ `؃ ` ` ` ` ` ` ` ` ` `( `0 `8 `@ `H `P `X `` `h ap ax a a  _` ax a  # 8 ; =  ( 0 8 I@ H P CX `  h  p  x          Ȁ Ѐ ؀     @  A   (  0 !8 "@ $H %P &X '` (h )p *x + , - . K / 0 1 2 3ȁ 4Ё F؁ 5 G 6 7 9 : ; < HHHb HtH5b %b @%b h%b h%b h%b h%b h%b h%b h%zb hp%rb h`%jb h P%bb h @%Zb h 0%Rb h %Jb h %Bb h%:b h%2b h%*b h%"b h%b h%b h% b h%b h%a hp%a h`%a hP%a h@%a h0%a h %a h%a h%a h%a h %a h!%a h"%a h#%a h$%a h%%a h&%za h'p%ra h(`%ja h)P%ba h*@%Za h+0%Ra h, %Ja h-%Ba h.%:a h/%2a h0%*a h1%"a h2%a h3%a h4% a h5%a h6%` h7p%` h8`%` h9P%` h:@%` h;0%` h< %` h=%` h>%` h?%` h@;6fDH=j Hi H9tH&^ Ht H=i H5i H)HHH?HHtH] HtfD=i u+UH=] Ht H=N[ )dei ]wHHt H1Hf.AUATUHSHHT$H*IHD$H9HuH@HTHHHEH9HEHV1L-` HU0"H|$t(A ItHHt6HHZH9\$wHEHUHHHM"H[]A\A]@HMHEHHqHuH9\$wHHHu`ff.AT UHSHHHLd$LH{HT$H9t xA.@Au߀Eu0ELHT$EH9St!HSH[]A\@EHEHE H)HL9HUHEH[]A\ff.SHH3tH&9HHH1ɺH߾t t+HHH5=1[ DH[DH߉D$ HD$ fAVH57] "AUL-f ATUHSHI!HILH@LHHH11HpHHHHxHH1H1Hǀh1H)pHH1H5HCH7HHfo=H1ǃH(fo=ǃh8fo=HǃPXfo=HHfDHH9uH H foe=HHC$H H6H)HHH1ǃǃǃlǃtǃ C4 ǃǃǃ$ǃǃ8ǃǃǃǃ HǃHǃH uHƃ""ƃ\\ƃ//ƃbƃn ƃf ƃr ft8H$HtIAfDHI1It$HHھHI$HuHHwc rH1Hk5HLHHHD5HXHHH!HHH5HHHtHH4HH54lHH4HH54DHH4H[]A\A]A^H[LH11HHH50b HH!1H1HAUH?4L-ATUHSH14H8H\$~D$Ld$HD$HD$ D$)D$1H5HH4HHھHI8LHHھHI$HuH8[]A\A]ff.@UHSHHtVHytdH X 1ҾHEv.HHX HH4aH[]DEw҉HH[]fHEff.ATUHST~}DHH8~HHHtoH@HD@@D9tHt1L[]A\f[[]A\ÐHI3HD9rHkHBHkƒ?ɀ=L$ T$ ?}\5}u+UJЀ 0 J ҃WM q@  q@ɍyM q@  q@ɍqM DIA  DIAɃW ʉсup  % T$ ?ʀT$ ƒ?Ȁ?D$ʀT$d0*JrHHCA$ H)ID$HID$0yHA$ H)HBIl$ID$THCHHkHH@HCA$HH@IT$ID$Eƒ x0 F L$D$ Ѓ?ȀD$ sHA$ H)HIl$ID$0lq;y 0AVAUATUHSHH0:H 4"HcH1H0[]A\A]A^@F HVF ;\u$H{|S HKHH+ H5 1!11Ld$HLHL-; D$uV2 t=H{"D$HL$ tILLD$HH1H5 ILHD$t=H{D$HL$ tILLD$HH1H5V I]HT$(Ht$ HLH@|$ t=H{pD$HL$ tILLD$H9H1H5ILHLHH3HLHD$k H0[]A\A]A^DF HVF ;\9u$H{S HKHH+ H51a11HHC`Ld$HALL59 &|$u_\f. tH 8 H LBHH*1H5IH0[]A\A]A^fDHJf.HH5oF HH!HH:"DATUSHHptHHwHZHHHHT$Hl$XGH|$D$`HD$~D$fl)D$@Hv8tkxteD[Ld$ Hl$@LHHD$PLHHLH|$ uAH|$PHp[]A\fHH51_H|$H|$PD$ HL$0 t H7 H LD$(H|H1H5I vH5QH1f.AWAAVAUATIUHSHH H xAHcHfDHHHE1HD[]A\A]A^A_EoE;$4E$@EmDH5H19H$D$ HE1D$-@f*L$f/v,D$HAHJA…_HHff.ztkf(-f(fTf.v3H,f5fUH*f(fT\f(fVf.zuf/%Ht$ HEHUH)HpHHUHuHE1{1f.H߉T$?T$AHEE3JH$L$I$PtFHEHUH)HpHHUHu E~E1I$PHAE9uHA$@xH[H߉H zH5kHH1I$Pt%HEHUH)HpH HUHu HDLHtHc$HED$EȉL$HAST$f.HuHHHEHHunullHE@HSH H=H@ E1HH!H9hHEHUH)HpHHUHu[HEHUH)HZHUHHE1HM]HLHE1DH{HuAHHHEEHHuE1trueHEE$hEuSA$@HDT$QH߉H rH5aHH1DT$MfA@DHvHufalsFeHEfHHDT$HuDT$@HHHu$HDT$DT$>HH5$? HHH!HHߺHAEHAAfHDLHE12HHpHEH)HHEHu,HH0HuHEH)HHEHVHU0:`fDHH5> HH!HHߺHAƅHA AEHHDT$'HuDT$afHC-MfDHEHUH)HpHHUHuLH"HHEHHHUHHHE":fHE4f.HEHHHUHHEE1nullHE\HH8HEHpGH HEHpH{HHUHrHUHpH)EtYI$PtNH$HUHu1 E~"I$PHDT$A9DT$uHEHUHpH)HxHUHu}o@HGH$HHHHD,DD$iDD$HHHuA$,DD$D9A;$0!D $DD$HDLHDT$ RDT$ HpHdHEHpHLHEH8HEHpT|${A$DD$z\HDT$HEDT$HpiHHEHpfHpHHEHHEHp[HDT$HEDT$HpA$(A$@t5H;H߉H CH5K HH1HATUHSH0HHHGtH: H@tTHǃLL1HHbIT$I4$H@t'H0[]A\fI1L#믐L8H0[]A\f.H51H1;f.AWIAVAUAATIUHSH(HAHQDL$H)HpHIIw[EAGD$D$ A@HHD$fI$P\$tJIGIWH)HpHIIw E~!E1DI$PLAE9uD$T$HLHLDHtHcD$ |$IGt}H9\$IGIWD$H)‰D$ HpHtoIIw,HHH}HqLIGHp  H9\$t,AGD$ f.LxIGHp|IGIWH)HpI$PtLHIIwAm1 A~DI$PLU9uIGIWHpH)Ht %zd %gError: wide characters found or printf() bug.?;\*8xX](XX(hȿxHL(0Xh8h0thh(<x8Hxh L Hl ( zRx $ FJ w?;*3$"D&Da8\BBA F(D@ (A ABBE zRx @$<<(BFD G0d  AABE p AAB( AG Y MJ I AF D8,BNI A(D0T 0F(A BBBD zRx (U4\BPA D(K`(F ABB4AIG R FAF V FAC 8(lBAD n FBC F FBB @dBBB A(A0Gp 0F(A BBBH (|AAG K FAE 4+AAG m FAC M FAD ( AAG K FAE (8\AAG K FAE (dAAG K FAE @D"BBB A(A0Gpf 0F(A BBBF @0"BBB A(A0Gpf 0F(A BBBF @"BBB A(A0Gpf 0F(A BBBF (\AAG | KAO (|AAG  FAC (PAAG j AAK 8hBED F(G@_ (A ABBC @PBAA D0  AABE   GABE `$KBBB A(D0G`i 0A(A BBBE  0A(A BBBF < 0A(A BBBD N 0A(A BBBJ M 0A(A BBBK L 0A(A BBBD I 0A(A BBBG 0(vBAA G  FABJ H\) BEB B(I0D8GP@ 8D0A(B BBBD @BFD DP}  FABJ \  FABK HBEB E(D0D8D`) 8A0A(B BBBC 8DN8PBPA D(K`(F ABBxAG eA} B (`EAID c DAA iAf I t4BAD q ABE |AB,HBAA w ABB (xADG xAA LEB D(D0Dp 0A(A BBBE v 0A(A BBBB H 0E(A BBBD I 0A(A BBBA <( ,HHJP AAD P AAF nAAh qD G A 0"!`} "a.a8aDaNaWa`ajata{aaaaaa 0 D]P} X} ox X    o ooP o[~ fv&6FVfv&6FVfv  & 6 F V f v !!&!6!F!V!f!]R]PE]4^0^-3^+G^3X^P1i^2^+^@.^p/^6a0^5^$E`~^]E`~^I`P`W`^`e`l`s`z``````````````````````aaaa _aa.GA$3a10Q]cjson.so-1.49.0-1.el8.x86_64.debuga77zXZִF!t/]?Eh=ڊ2N$iҰPhw9MWAh/lgWɁok0]nH֛[l'Rs6T2c€73&uБ Ȫg*RDI18W;@ps?["!h\ -q F짵n(Z$،3+wV_)!:ď/g*?%t.}4x) ׸L{*IF޹׆*7";(T~Ny"괊k~UlsFAkr4%#OЀ"t9t-a'dAUn}Sd- $ $oJ*}Sg/h:TR?TP p.K/UmDf?ج )E#'W7ԌbŻç I!챪I,~S au)W &~Oj YYG"D~g4e_×)6:$żcR=^~w?Pg:GqdR ;QFxUb&0P8j0Cd2f2ރzBbѴ%dRM`m9_*l²gn8iՓD*# ͮЎ~;5 vZ-~SӄG83o67kdGXu8p@x@8@ - - 0000.00. 0=0=.0=.$$Ptdh h h RRQtdRtd0000.00.GNUB~w_ rqa "aHP @` 8 >$+"0 @ Q @b@@$ dB# %!@ B`0!@ ' ``j     "#$&'()*+/01345679:=>@CDFHLORSTUXYZ\]%(M=4*ef*簩:<|oLW5|a xqEh-7/ KtHu ] 0[?[ A0 }'F496V"2'q[Z!#!nQ <FJ2G1 G#%wD7/K 7 &$!6%3nLiFOC<z#X^$c Wg93]Y6H/Hf3,* a@"@CR+ N"kK$H~= i2G&_T B5'`!Z_A$4&^5!]1s e#M[N8^f`S^=IB/ @ & 3BYUQ2@Jlc\ +W8q=TZH`w..0q!W}\EYf Ss R*"l]D[#F_j1}`^hCL[B@6S,S0FD Ea `+;!f5CJ:X 4`,1X+5.qL&%^.B]a-( `eED"B8KF"@a%RV +X`0YG*M8 *8/A@%UgXa]Y"Z4 BQ@O[+"I?o,  !?EIG$T@!$J.,GIHAX5 &/nQPp?:SC8I2O,aILP!=J::|XK:=!~CiIn_Y8VK)(,T"A GAAI(1nVH68;`[=( 4T- HCaMx^1-O7>Z B>80%2!MMm3I}^'JW=!7X0A}Ur5*a3d8,,? H XWQsZ?j=~#[R\lXS%MYAu6F(5I.SX4GI _Kh:#"Uq V"2JH\!jS50@`[Q:SP.>5R?OK0Z-R %A: t1*CU3/<Ah/> [ j;2@_/Dr8%aMpOZ9#v/Rj7pJ0;< B @89xQ 5E>d^]?NJ]L8Y>VT4M 2)q\N3#UZZY'>U7('7Q NV$C=6,D-=5;UU AadTGM"YL> '5P\< K%EO"lN\O?GX% K7)Z;b 6'C="q:IQ<Z8LCcRaO^/Jf&p'QP6<$D3 #uO89-#N@*TX7^' %-4"/IQ3 /1*?BT_]:* Py@!K )Yh3yY-E4"M<p9 6&(:$1_2UL/M # : l<wU9+D4)"EPW`X 6>V>#;N]'k]UOy5'G'kl#Z cKW[_5\Q6D[#IA&`$?7 ?]!9')?299[ x&S[a`Zt\BIK;E2 DZ#RMEUV`Jd;( 0@xS|A&i'RSF& !P>H,:CR 0K]_  #]_oJ#R,G*20TJxoL 07O*m@=DS&@.<.r )Y58@)z7:u;L+TR/K? .=V?NS#K #yGocWUja(^.- 2H:^"vB!_SN;b< =-:VWI$!,9 %p 2Z1S P#d$ %l0]*C+8_;M ??TD> VL41^SE([{H-< F" C[ _!yG,C4f) QB} +&dJ>)#W jU1R3-Q~K1*3B  Zr(!, @#+-X4X^ KJ.<LB?<U5 NDQ1f }+L<  Of89aH>?X@;*7'FRR MBZ/0JT;x r 95 a  9> w.(U n - n #E e [O h -r$ >$ 5 9 Q [ O] ! ^-2 P8 #; 1V + / C c; )P) oP b u  zD & {!o\ N7 \ P t [a. :  v8sW ,3 m`f [6 K  V- QT k -^ _L Q . -E 6Q wJ # Y s \  lPsP < [F; yya.D ɤ 8% P j [  `M) %KW0.- i  ! p1\ 7 DV - 1 H O R*4 /  AH țuZP [ gC   .Rn  Os[ N P ,  Ӡ} s q-$ 0 6E`s u K #\  MP e [H  gU `%  ). %_s3 ` )qP 0 [ PWn- n" $[% 21  ݶ{% 6 Q 1__gmon_start___ITM_deregisterTMCloneTable_ITM_registerTMCloneTable__cxa_finalize__xpg_strerror_rstrerrorlua_gettoplua_typelua_settopluaL_loadbufferlua_errorlua_pushvaluelua_insertlua_callluaL_errorlua_pushnumberlua_equallua_lessthanlua_tobooleanlua_replacelua_objlenluaL_callmetalua_typenamelua_pushlightuserdatalua_rawgetlua_rawsetlua_tonumberlua_isnumberlua_checkstacklua_pushstringlua_tolstringlua_gettablelua_createtablelua_settablelua_pushcclosurelua_getfieldlua_setmetatablelua_touserdatalua_getmetatablelua_rawequallua_getstacklua_pushnillua_removelua_concatlua_nextlua_getinfolua_pushfstring__errno_locationlua_pushbooleanstrchrlua_loadfeoffreadgetcstdinfopenfreopenferrorfcloselua_pushintegerlua_newuserdatamemcpylua_pushlstringlua_setfieldlua_pushthreadmemsetstrtod__ctype_b_locluaL_getmetafieldlua_topointerlua_isstringauxiliar_checkbooleanluaL_checklstringCRYPTO_mallocbin2hexhex2binCRYPTO_freeload_bio_objectBIO_f_base64BIO_newBIO_s_memBIO_set_flagsBIO_pushBIO_ctrlBIO_writeBIO_readBIO_free_allBIO_freelua_rawsetiauxiliar_checkoptionOBJ_NAME_do_all_sortedERR_get_errorluaL_optintegerERR_reason_error_stringERR_lib_error_stringERR_clear_errorERR_print_errorsRAND_addluaL_optlstringRAND_file_nameRAND_load_fileRAND_write_fileopenssl_pushresultRAND_statusluaL_checkintegerluaL_argerrorRAND_bytesopenssl_engineOPENSSL_thread_stopOPENSSL_cleanupOPENSSL_init_cryptoOPENSSL_init_sslOSSL_PROVIDER_loadluaopen_opensslopenssl_register_lhashopenssl_register_engineluaopen_bioluaopen_asn1luaopen_digestluaopen_cipherluaopen_hmacluaopen_macluaopen_paramluaopen_kdfluaopen_pkeyluaopen_ecluaopen_x509luaopen_pkcs7luaopen_pkcs12luaopen_ocspluaopen_tsluaopen_cmsluaopen_sslluaopen_bnluaopen_rsaluaopen_dsaluaopen_dhluaopen_srpauxiliar_getgroupudataASN1_TYPE_newASN1_TYPE_setASN1_INTEGER_newASN1_INTEGER_setASN1_TYPE_set_octetstringASN1_STRING_typeASN1_TYPE_set1auxiliar_setclassASN1_TYPE_freeposrelatASN1_get_objectASN1_put_objectstrcmpASN1_STRING_type_newASN1_STRING_setBN_getBN_to_ASN1_INTEGERBN_freeASN1_GENERALIZEDTIME_newASN1_GENERALIZEDTIME_setASN1_GENERALIZEDTIME_set_stringASN1_GENERALIZEDTIME_freeASN1_UTCTIME_newASN1_TIME_setASN1_TIME_set_stringASN1_UTCTIME_freeOBJ_txt2nidOBJ_nid2objOBJ_txt2objOBJ_sn2nidOBJ_ln2nidOBJ_createASN1_OBJECT_newd2i_ASN1_TYPEauxiliar_checkclassASN1_TYPE_get_octetstringASN1_TYPE_cmpASN1_STRING_dupi2d_ASN1_TYPEopenssl_push_asn1typeOBJ_dupauxiliar_tostringOBJ_obj2nidOBJ_nid2snOBJ_nid2lnOBJ_obj2txtOBJ_cmpi2a_ASN1_OBJECTASN1_OBJECT_freed2i_ASN1_OBJECTi2d_ASN1_OBJECTASN1_INTEGER_to_BNauxiliar_checkgroupASN1_UTCTIME_setmktimei2d_ASN1_INTEGERi2d_ASN1_BIT_STRINGi2d_ASN1_OCTET_STRINGi2d_ASN1_NULLi2d_ASN1_ENUMERATEDi2d_ASN1_UTF8STRINGi2d_ASN1_PRINTABLESTRINGi2d_ASN1_T61STRINGi2d_ASN1_IA5STRINGi2d_ASN1_UTCTIMEi2d_ASN1_GENERALIZEDTIMEi2d_ASN1_VISIBLESTRINGi2d_ASN1_GENERALSTRINGi2d_ASN1_UNIVERSALSTRINGi2d_ASN1_BMPSTRINGd2i_ASN1_INTEGERd2i_ASN1_BIT_STRINGd2i_ASN1_OCTET_STRINGd2i_ASN1_NULLd2i_ASN1_ENUMERATEDd2i_ASN1_UTF8STRINGd2i_ASN1_PRINTABLESTRINGd2i_ASN1_T61STRINGd2i_ASN1_IA5STRINGd2i_ASN1_UTCTIMEd2i_ASN1_GENERALIZEDTIMEd2i_ASN1_VISIBLESTRINGd2i_ASN1_GENERALSTRINGd2i_ASN1_UNIVERSALSTRINGd2i_ASN1_BMPSTRINGASN1_STRING_lengthASN1_STRING_get0_dataASN1_STRING_cmpASN1_STRING_freeBN_bin2bnBN_bn2hexASN1_TIME_printASN1_GENERALIZEDTIME_printASN1_STRING_print_exASN1_STRING_to_UTF8openssl_push_asn1ASN1_TIME_checkASN1_UTCTIME_adjASN1_GENERALIZEDTIME_adjASN1_TIME_diffauxiliar_newclassauxiliar_add2groupauxiliar_enumerateopenssl_get_asn1objectauxiliar_getclassudataopenssl_push_asn1objectASN1_INTEGER_dupopenssl_push_asn1integer_as_bnauxiliar_openluaL_newmetatablesnprintfauxiliar_typeerrorBIO_new_bio_pairBIO_s_nullBIO_new_socketBIO_new_dgramBIO_new_fdBIO_new_fileBIO_new_acceptBIO_new_connectBIO_s_connectluaL_checkoptionBIO_f_bufferget_cipherBIO_f_cipherBIO_set_cipherget_digestBIO_f_mdBIO_f_sslBIO_test_flagsBIO_getsBIO_putsBIO_method_nameBIO_popBIO_up_refBIO_find_typeBIO_nextBIO_method_typeBIO_ssl_shutdownSSL_up_refopenssl_newvalueBIO_int_ctrlopenssl_add_method_or_aliasopenssl_add_methodEVP_CIPHER_CTX_newEVP_EncryptInit_exEVP_CIPHER_CTX_set_paddingEVP_CIPHER_CTX_get_block_sizeEVP_EncryptUpdateEVP_EncryptFinal_exEVP_CIPHER_CTX_freeEVP_DecryptInit_exEVP_DecryptUpdateEVP_DecryptFinal_exEVP_CipherInit_exEVP_CipherUpdateEVP_CipherFinal_exEVP_CIPHER_get0_nameEVP_CIPHER_get_block_sizeEVP_CIPHER_get_key_lengthEVP_CIPHER_get_iv_lengthEVP_CIPHER_get_flagsEVP_CIPHER_get_modeEVP_BytesToKeyEVP_CIPHER_CTX_get0_cipherEVP_CIPHER_CTX_get_key_lengthEVP_CIPHER_CTX_get_iv_lengthEVP_CIPHER_CTX_get_nidEVP_CIPHER_get_typeluaL_checkanyEVP_CIPHER_CTX_ctrlformatbio_is_derd2i_CMS_bioPEM_read_bio_CMSSMIME_read_CMSSMIME_write_CMSPEM_write_bio_CMS_streami2d_CMS_bio_streamCMS_ContentInfo_newCMS_data_createCMS_compressCMS_uncompressopenssl_sk_x509_fromtableCMS_signX509_freeOPENSSL_sk_pop_freeCMS_verifyCMS_EncryptedData_encryptCMS_EncryptedData_decryptCMS_digest_createCMS_digest_verifyCMS_encryptCMS_add0_recipient_keyCRYPTO_strdupCMS_add0_recipient_passwordCMS_finalCMS_decrypt_set1_passwordCMS_decrypt_set1_keyCMS_decrypt_set1_pkeyCMS_decryptCMS_get0_typeCMS_is_detachedCMS_set_detachedCMS_get0_contentCMS_add1_signerCMS_get0_signersopenssl_sk_x509_totableOPENSSL_sk_freeCMS_dataOPENSSL_sk_new_nullOPENSSL_sk_valuea2i_GENERAL_NAMEGENERAL_NAMES_newOPENSSL_sk_pushOPENSSL_sk_numGENERAL_NAMES_freeGENERAL_NAME_freeCMS_ReceiptRequest_create0CMS_get0_SignerInfosluaL_checktypelua_rawgetiCMS_add1_ReceiptRequestCMS_ReceiptRequest_freeCMS_sign_receiptCMS_verify_receiptCMS_ContentInfo_freeDH_freeDH_sizeDH_bitsDH_get0_pqgDH_get0_keyBN_duplua_isuserdataDH_check_pub_keyDH_checkDH_new_methodDH_newDH_generate_parameters_exDHparams_dupDH_generate_keyEVP_MD_CTX_newEVP_MD_CTX_resetEVP_DigestInit_exEVP_MD_CTX_freeEVP_Digestto_hexEVP_DigestSignInitEVP_DigestVerifyInitEVP_MD_get_typeEVP_MD_get0_nameEVP_MD_get_sizeEVP_MD_get_block_sizeEVP_MD_get_pkey_typeEVP_MD_CTX_get0_mdEVP_MD_CTX_get_size_exEVP_DigestUpdateEVP_DigestFinal_exEVP_MD_meth_get_app_datasizeEVP_MD_CTX_get0_md_dataEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestVerifyFinalEVP_DigestSignEVP_DigestVerifyDSA_freeDSA_bitsDSA_get0_pqgDSA_get0_keyENGINE_get_DSADSA_set_methodDSA_new_methodDSA_newDSA_generate_parameters_exDSA_generate_keyBN_newEC_POINT_get_affine_coordinatesEC_POINT_set_affine_coordinatesopenssl_get_ec_groupEC_GROUP_get0_generatorEC_POINT_dupBN_CTX_newEC_GROUP_get_orderEC_GROUP_get_cofactorEC_GROUP_get_asn1_flagEC_GROUP_get_degreeEC_GROUP_get_curve_nameEC_GROUP_get_point_conversion_formEC_GROUP_get_seed_lenEC_GROUP_get0_seedEC_GROUP_get_curveBN_CTX_freeEC_GROUP_freeEC_GROUP_set_asn1_flagEC_GROUP_set_point_conversion_formEVP_PKEY_get1_EC_KEYEC_KEY_get0_groupEC_KEY_freeEC_GROUP_dupEC_GROUP_new_by_curve_nameEC_POINT_newEC_POINT_cmpEC_POINT_oct2pointEC_POINT_point2octEC_POINT_bn2pointEC_POINT_point2bnEC_POINT_hex2pointEC_POINT_point2hexEC_KEY_newEC_KEY_set_groupEC_KEY_generate_keyEC_GROUP_cmpECDSA_do_signi2d_ECDSA_SIGECDSA_SIG_get0ECDSA_SIG_freed2i_ECDSA_SIGECDSA_do_verifyECDSA_SIG_newECDSA_SIG_set0ECDSA_sizeECDSA_signECDSA_verifyEC_POINT_copyEC_POINT_freeEC_KEY_get0_public_keyEC_KEY_get0_private_keyEC_KEY_get_enc_flagsEC_KEY_get_conv_formSHA1ECDH_compute_keyENGINE_get_ECEC_KEY_set_methodEC_KEY_check_keyi2d_ECPrivateKeyd2i_ECPrivateKeyEC_KEY_set_conv_formEC_KEY_set_enc_flagsEC_get_builtin_curvesENGINE_by_idENGINE_get_firstENGINE_get_lastENGINE_up_refENGINE_get_nextENGINE_get_prevENGINE_addENGINE_removeENGINE_unregister_RSAENGINE_register_RSAENGINE_unregister_DSAENGINE_register_DSAENGINE_unregister_ECENGINE_register_ECENGINE_unregister_DHENGINE_register_DHENGINE_unregister_RANDENGINE_register_RANDENGINE_unregister_pkey_methsENGINE_register_pkey_methsENGINE_unregister_pkey_asn1_methsENGINE_register_pkey_asn1_methsENGINE_unregister_ciphersENGINE_register_ciphersENGINE_unregister_digestsENGINE_register_digestsENGINE_register_completeENGINE_cmd_is_executableluaL_checknumberENGINE_ctrlENGINE_ctrl_cmdENGINE_ctrl_cmd_stringENGINE_freeENGINE_set_idENGINE_get_idENGINE_set_nameENGINE_get_nameENGINE_set_flagsENGINE_get_flagsENGINE_initENGINE_finishENGINE_set_default_RSAENGINE_set_default_DSAENGINE_set_default_ECENGINE_set_default_DHENGINE_set_default_RANDENGINE_set_default_ciphersENGINE_set_default_digestsRAND_set_rand_engineENGINE_load_private_keyENGINE_load_public_keySSL_get_client_CA_listENGINE_load_ssl_client_certHMAC_CTX_newHMAC_Init_exHMAC_CTX_freeHMACHMAC_UpdateHMAC_FinalHMAC_sizeBN_hex2bnBN_dec2bnluaL_checkudataBN_num_bitsBN_bn2decBN_bn2binpadBN_is_zeroBN_is_oneBN_is_oddBN_is_negativeBN_cmpBN_sqrBN_set_wordBN_subBN_addBN_mulBN_divBN_nnmodBN_gcdBN_expBN_mod_addBN_mod_subBN_mod_mulBN_mod_expBN_mod_sqrBN_mod_inverseBN_mod_sqrtBN_randBN_generate_prime_exBN_GENCB_newBN_check_primeBN_GENCB_freeCONF_load_bioopenssl_lhash_gcCONF_freeopenssl_lhash_get_numberCONF_get_numberopenssl_lhash_get_stringCONF_get_stringOPENSSL_LH_doall_arg_thunkCONF_dump_bioBIO_new_mem_bufopt_digestEVP_get_digestbynameopt_cipherEVP_get_cipherbynameBN_copyopenssl_push_bit_string_bitnameopenssl_get_paddingstrlenX509_get_subject_nameX509_get0_pubkey_bitstrOCSP_cert_id_newASN1_INTEGER_freeOCSP_cert_to_idOCSP_CERTID_freeOCSP_REQUEST_newOCSP_request_add1_nonced2i_OCSP_REQUESTPEM_ASN1_read_bioASN1_d2i_biod2i_OCSP_RESPONSEOCSP_RESPONSE_newOCSP_BASICRESP_newOCSP_id_get0_infoOCSP_CERTID_dupOCSP_request_add0_idOCSP_REQUEST_get_ext_countOCSP_REQUEST_add_exti2d_OCSP_REQUESTPEM_ASN1_write_bioASN1_i2d_bioOCSP_REQUEST_freeOCSP_request_is_signedOCSP_request_signOCSP_request_onereq_countOCSP_request_onereq_get0OCSP_onereq_get0_idOCSP_REQUEST_get_extX509_EXTENSION_dupOCSP_SINGLERESP_get_ext_countOCSP_SINGLERESP_add_extOCSP_SINGLERESP_get0_idOCSP_single_get0_statusOCSP_response_status_strOCSP_crl_reason_strOCSP_SINGLERESP_get_extASN1_TIME_newOCSP_basic_add1_statusASN1_TIME_freeOCSP_BASICRESP_get_ext_countOCSP_BASICRESP_add_extOCSP_basic_signOCSP_resp_get0_produced_atOCSP_resp_get0_certsX509_up_refOCSP_resp_get0_idopenssl_push_xname_asobjectOCSP_BASICRESP_get_extOCSP_resp_get0_signerOCSP_resp_countOCSP_resp_get0OCSP_resp_get0_signatureOCSP_resp_get0_tbs_sigalgopenssl_push_x509_signatureOCSP_copy_nonceOCSP_response_createOCSP_BASICRESP_freei2d_OCSP_RESPONSEOCSP_response_get1_basicOCSP_response_statusOCSP_RESPONSE_freeTS_MSG_IMPRINT_newTS_MSG_IMPRINT_set_msgX509_ALGOR_newX509_ALGOR_set_mdTS_MSG_IMPRINT_set_algoX509_ALGOR_freed2i_TS_MSG_IMPRINTi2d_TS_MSG_IMPRINTTS_MSG_IMPRINT_get_msgTS_MSG_IMPRINT_get_algoX509_ALGOR_dupTS_MSG_IMPRINT_dupTS_MSG_IMPRINT_freeTS_ACCURACY_newTS_ACCURACY_set_secondsTS_ACCURACY_set_millisTS_ACCURACY_set_microsTS_ACCURACY_freeTS_ACCURACY_get_secondsASN1_INTEGER_getTS_ACCURACY_get_millisTS_ACCURACY_get_microsTS_ACCURACY_dupi2d_TS_ACCURACYd2i_TS_ACCURACYTS_TST_INFO_get_versionTS_TST_INFO_get_policy_idTS_TST_INFO_get_msg_imprintTS_TST_INFO_get_serialTS_TST_INFO_get_timeTS_TST_INFO_get_accuracyTS_TST_INFO_set_accuracyTS_TST_INFO_get_orderingTS_TST_INFO_get_nonceTS_TST_INFO_get_tsaopenssl_push_general_nameTS_TST_INFO_get_extsopenssl_sk_x509_extension_totableTS_TST_INFO_freeTS_REQ_newTS_REQ_set_versionTS_REQ_freed2i_TS_REQ_biod2i_TS_RESP_bioX509_check_private_keyTS_RESP_CTX_newTS_RESP_CTX_set_def_policyTS_RESP_CTX_set_signer_certTS_RESP_CTX_set_signer_keyTS_RESP_CTX_freeTS_VERIFY_CTX_newTS_REQ_to_TS_VERIFY_CTXTS_REQ_dupTS_REQ_get_cert_reqTS_REQ_set_cert_reqTS_REQ_get_nonceTS_REQ_set_nonceTS_REQ_get_policy_idTS_REQ_set_policy_idTS_REQ_get_versionTS_REQ_get_msg_imprintTS_REQ_set_msg_imprinti2d_TS_REQTS_REQ_get_ext_countTS_REQ_add_extTS_REQ_get_extsTS_RESP_freeTS_RESP_dupi2d_TS_RESP_bioTS_RESP_get_tst_infoTS_TST_INFO_dupTS_RESP_get_status_infoTS_STATUS_INFO_get0_textTS_STATUS_INFO_get0_failure_infoTS_STATUS_INFO_get0_statusTS_RESP_get_tokenPKCS7_dupTS_RESP_create_responseTS_RESP_CTX_set_certsTS_RESP_CTX_add_policyTS_RESP_CTX_set_accuracyTS_RESP_CTX_set_clock_precision_digitsTS_RESP_CTX_add_flagsTS_RESP_CTX_add_mdTS_RESP_CTX_get_tst_infoTS_RESP_CTX_get_requestopenssl_valuegetTS_RESP_CTX_set_status_infoTS_RESP_CTX_add_failure_infolua_pcallluaL_refopenssl_valuesetTS_RESP_CTX_set_serial_cbTS_RESP_CTX_set_time_cbluaL_unrefopenssl_freevalueX509_STORE_up_refTS_VERIFY_CTX_set_storeTS_VERIFY_CTX_add_flagsTS_VERIFY_CTX_set_flagsTS_VERIFY_CTX_set_dataTS_VERIFY_CTX_set_imprintTS_VERIFY_CTX_cleanupTS_VERIFY_CTX_freeTS_RESP_verify_responseTS_RESP_verify_tokend2i_TS_RESPopenssl_pkey_is_privatePKCS12_createi2d_PKCS12_bioPKCS12_freed2i_PKCS12_bioPKCS12_parsed2i_PKCS7_bioPEM_read_bio_PKCS7SMIME_read_PKCS7PKCS7_newPKCS7_set_typePKCS7_content_newPKCS7_freeopenssl_sk_x509_crl_fromtablePKCS7_SIGNED_newPKCS7_SIGNED_freePKCS7_set_contentPKCS7_add_certificatePKCS7_add_crlPKCS7_signPKCS7_verifyPKCS7_encryptPKCS7_decryptPEM_write_bio_PKCS7i2d_PKCS7_bioSMIME_write_PKCS7X509_NAME_dupEVP_PKEY_up_refopenssl_sk_x509_attribute_totablePKCS7_ctrlopenssl_sk_x509_algor_totableopenssl_sk_x509_crl_totablePKCS7_set_digestPKCS7_final__assert_failEVP_PKEY_get_idEVP_PKEY_typeEVP_PKEY_get0_RSARSA_get0_keyEVP_PKEY_get0_DSAEVP_PKEY_get0_DHEVP_PKEY_get0_EC_KEYEVP_PKEY_CTX_new_from_pkeyEVP_PKEY_private_checkEVP_PKEY_CTX_freeEVP_PKEY_get_base_idPEM_read_bio_RSAPublicKeyEVP_PKEY_newEVP_PKEY_assignPEM_read_bio_DSA_PUBKEYPEM_read_bio_EC_PUBKEYPEM_read_bio_PUBKEYd2i_RSAPublicKey_biod2i_DSA_PUBKEY_biod2i_EC_PUBKEY_biod2i_PUBKEY_bioPEM_read_bio_PrivateKeyd2i_RSAPrivateKey_biod2i_DSAPrivateKey_biod2i_ECPrivateKey_biod2i_PKCS8PrivateKey_biod2i_PrivateKey_bioEC_KEY_set_public_keyEC_POINT_mulEC_POINT_make_affinestrcasecmpRSA_new_methodRSA_newRSA_generate_key_exRSA_freeRSA_set0_keyRSA_set0_factorsRSA_set0_crt_paramsEVP_PKEY_freeDSA_set0_keyDSA_set0_pqgDH_set0_keyDH_set0_pqgEC_KEY_set_private_keyEVP_PKEY_set1_RSAEVP_PKEY_set1_EC_KEYEVP_PKEY_set1_DHEVP_PKEY_set1_DSAEVP_aes_128_cbcPEM_write_bio_PrivateKeyPEM_write_bio_PUBKEYPEM_write_bio_RSAPrivateKeyPEM_write_bio_RSAPublicKeyPEM_write_bio_DSAPrivateKeyPEM_write_bio_DSA_PUBKEYPEM_write_bio_ECPrivateKeyPEM_write_bio_EC_PUBKEYi2d_PrivateKey_bioi2d_PKCS8PrivateKey_bioi2d_PUBKEY_bioi2d_RSAPrivateKey_bioi2d_RSAPublicKey_bioi2d_DSAPrivateKey_bioi2d_DSA_PUBKEY_bioi2d_ECPrivateKey_bioi2d_EC_PUBKEY_bioEVP_PKEY_get_bitsEVP_PKEY_get_sizeEVP_PKEY_get1_RSAEVP_PKEY_get1_DSAEVP_PKEY_get1_DHEVP_PKEY_CTX_newEVP_PKEY_encrypt_initEVP_PKEY_CTX_set_rsa_paddingEVP_PKEY_encryptEVP_PKEY_decrypt_initEVP_PKEY_decryptopenssl_pkey_is_private1EC_KEY_dupi2d_PUBKEYEVP_PKEY_copy_parametersd2i_PUBKEYEVP_PKEY_CTX_new_idEVP_PKEY_keygen_initEVP_PKEY_keygenEVP_PKEY_CTX_ctrl_strEVP_PKEY_verify_initEVP_PKEY_sign_initEVP_PKEY_verifyEVP_PKEY_signEVP_PKEY_derive_initEVP_PKEY_derive_set_peerEVP_PKEY_deriveEVP_PKEY_CTX_set1_idEVP_MD_CTX_set_pkey_ctxEVP_CIPHER_CTX_resetEVP_SealInitEVP_SealFinalEVP_OpenInitEVP_OpenFinalENGINE_get_RSARSA_set_methodENGINE_get_DHDH_set_methodEVP_PKEY_missing_parametersRSA_sizeRSA_private_encryptRSA_public_encryptRSA_private_decryptRSA_public_decryptRSA_signRSA_verifyRSA_get0_factorsRSA_get0_crt_paramsRSA_bitsd2i_RSAPrivateKeyd2i_RSA_PUBKEYi2d_RSA_PUBKEY_bioRSA_padding_add_PKCS1_type_1RSA_padding_add_PKCS1_type_2RSA_padding_add_noneRSA_padding_add_PKCS1_OAEPRSA_padding_add_PKCS1_OAEP_mgf1RSA_padding_add_X931RSA_padding_add_PKCS1_PSS_mgf1RSA_padding_check_PKCS1_type_1RSA_padding_check_PKCS1_type_2RSA_padding_check_PKCS1_OAEPRSA_padding_check_PKCS1_OAEP_mgf1RSA_padding_check_noneRSA_padding_check_X931RSA_verify_PKCS1_PSS_mgf1DTLS_methodDTLS_server_methodDTLS_client_methodDTLSv1_2_methodDTLSv1_2_server_methodDTLSv1_2_client_methodDTLSv1_methodDTLSv1_server_methodDTLSv1_client_methodTLSv1_1_methodTLSv1_1_server_methodTLSv1_1_client_methodSSL_CTX_newSSL_CTX_set_ciphersuitesSSL_CTX_set_cipher_listSSL_CTX_set_ex_dataSSL_alert_type_string_longSSL_alert_type_stringSSL_alert_desc_string_longSSL_alert_desc_stringSSL_SESSION_newPEM_read_bio_SSL_SESSIONd2i_SSL_SESSIONSSL_CTX_use_certificate_chain_fileSSL_CTX_use_certificateSSL_CTX_use_PrivateKeySSL_CTX_check_private_keySSL_CTX_add_client_CASSL_CTX_ctrlSSL_CTX_freeSSL_CTX_set_timeoutSSL_CTX_get_timeoutSSL_CTX_clear_optionsSSL_CTX_set_optionsSSL_CTX_get_optionsSSL_CTX_get_quiet_shutdownSSL_CTX_set_quiet_shutdownSSL_CTX_load_verify_fileSSL_CTX_load_verify_dirSSL_CTX_get_cert_storeSSL_CTX_set_cert_storeX509_STORE_set_trustSSL_CTX_set_client_cert_engineSSL_newSSL_set0_rbioSSL_set0_wbioSSL_set_fdSSL_set_accept_stateSSL_set_connect_stateSSL_freeBIO_new_sslBIO_new_ssl_connectSSL_ctrlSSL_CTX_set_verify_depthSSL_CTX_get_verify_depthopenssl_verify_cbSSL_CTX_set_verifySSL_CTX_get_verify_modeopenssl_cert_verify_cbSSL_CTX_set_cert_verify_callbackreallocSSL_CTX_set_alpn_protosSSL_get_SSL_CTXstderrfprintfSSL_CTX_set_alpn_select_cbSSL_CTX_get_ex_dataSSL_get_servernameSSL_set_SSL_CTXSSL_CTX_callback_ctrlopenssl_valuegetiSSL_SESSION_get_idopenssl_valuesetiSSL_CTX_sess_set_new_cbSSL_CTX_sess_set_get_cbSSL_CTX_sess_set_remove_cbSSL_CTX_flush_sessionsSSL_CTX_set_session_id_contextSSL_CTX_add_sessionSSL_CTX_remove_sessionSSL_CTX_set_num_ticketsSSL_CTX_get_num_ticketsSSL_get_verify_resultSSL_SESSION_set_timeSSL_SESSION_get_timeSSL_SESSION_set_timeoutSSL_SESSION_get_timeoutSSL_SESSION_freeSSL_SESSION_get0_peerSSL_SESSION_set1_idSSL_SESSION_get_compress_idPEM_write_bio_SSL_SESSIONi2d_SSL_SESSIONSSL_SESSION_is_resumableSSL_SESSION_has_ticketSSL_clearSSL_use_PrivateKeySSL_use_certificateSSL_check_private_keySSL_get1_peer_certificateSSL_get_peer_cert_chainSSL_wantSSL_get_current_compressionSSL_COMP_get_nameSSL_get_current_cipherSSL_CIPHER_get_nameSSL_CIPHER_get_versionSSL_CIPHER_get_idSSL_CIPHER_get_bitsSSL_CIPHER_descriptionSSL_pendingSSL_get_errorSSL_get_fdSSL_is_serverSSL_get_rfdSSL_get_wfdopenssl_sk_x509_name_totableSSL_get_read_aheadSSL_get_shared_ciphersSSL_get_cipher_listSSL_get_verify_modeSSL_get_verify_depthSSL_state_stringSSL_state_string_longSSL_rstate_stringSSL_rstate_string_longSSL_get_versionSSL_versionSSL_get_default_timeoutSSL_get_certificateSSL_get_stateSSL_set_wfdSSL_add_client_CASSL_set_read_aheadSSL_set_cipher_listSSL_set_verify_depthSSL_set_purposeSSL_set_trustSSL_set_verify_resultSSL_acceptSSL_connectSSL_readSSL_peekSSL_writeSSL_do_handshakeSSL_renegotiateSSL_renegotiate_abbreviatedSSL_renegotiate_pendingSSL_shutdownSSL_set_shutdownSSL_set_quiet_shutdownSSL_get_quiet_shutdownSSL_get_shutdownSSL_get_rbioSSL_get_wbioSSL_dupSSL_session_reusedSSL_get1_sessionSSL_set_session_id_contextSSL_set_sessionSSL_get0_alpn_selectedX509_PURPOSE_get_countX509_PURPOSE_get0X509_PURPOSE_get_by_idX509_PURPOSE_get_by_snameX509_verify_cert_error_stringd2i_X509_bioPEM_read_bio_X509X509_newX509_set_versionX509_set_serialNumberX509_REQ_get_subject_nameX509_set_subject_nameX509_REQ_get_extensionsX509_add_extX509_EXTENSION_freeX509_REQ_get_pubkeyX509_set_pubkeyX509_STORE_CTX_newX509_STORE_set_flagsX509_STORE_CTX_initX509_STORE_CTX_set_purposeX509_verify_certX509_STORE_CTX_get_errorX509_STORE_CTX_cleanupX509_STORE_CTX_freePEM_write_bio_X509i2d_X509_bioX509_check_caX509_get_versionX509_get_issuer_nameX509_subject_name_hashX509_get0_serialNumberX509_get0_notBeforeX509_get0_notAfterX509_get0_signatureX509_alias_get0X509_PURPOSE_get_idX509_PURPOSE_get0_snameX509_check_purposeX509_get_ext_countX509_get_extX509_get_pubkeyX509_check_hostX509_check_emailX509_check_ip_ascX509_set_issuer_nameX509_digestX509_set1_notBeforeX509_set1_notAfterX509_cmp_timeX509_get_serialNumberX509_get0_extensionsopenssl_sk_x509_extension_fromtableOPENSSL_sk_deleteOPENSSL_sk_zeroi2d_re_X509_tbsX509_signASN1_BIT_STRING_setX509_ALGOR_set0X509_verifyX509_cmpopenssl_register_xnameopenssl_register_xattributeopenssl_register_xextensionopenssl_register_xstoreopenssl_register_xalgorluaopen_x509_reqluaopen_x509_crlopenssl_new_xattributeX509_ATTRIBUTE_get0_objectX509_ATTRIBUTE_countX509_ATTRIBUTE_get0_typeX509_ATTRIBUTE_dupX509_ATTRIBUTE_freeX509_ATTRIBUTE_set1_dataX509_ATTRIBUTE_get0_dataX509_ATTRIBUTE_set1_objectX509_ATTRIBUTE_create_by_OBJopenssl_sk_x509_attribute_fromtableX509V3_EXT_get_nidX509V3_parse_listX509V3_conf_freeASN1_item_i2dASN1_item_freeX509_EXTENSION_create_by_NIDd2i_X509_EXTENSIONX509_supported_extensionX509_EXTENSION_get_objectX509_EXTENSION_get_dataX509_EXTENSION_get_criticalX509V3_EXT_d2ii2d_X509_EXTENSIONX509_EXTENSION_set_objectX509_EXTENSION_set_criticalX509_EXTENSION_set_dataX509_NAME_newX509_NAME_add_entry_by_OBJX509_NAME_freed2i_X509_NAMEX509_NAME_onelineX509_NAME_hash_exX509_NAME_digestX509_NAME_print_exX509_NAME_ENTRY_get_objectX509_NAME_ENTRY_get_dataX509_NAME_entry_countX509_NAME_get_entryX509_NAME_cmpi2d_X509_NAMEX509_NAME_get_index_by_OBJX509_NAME_delete_entryX509_NAME_ENTRY_freeopenssl_sk_x509_name_fromtableX509_STORE_newX509_STORE_add_certX509_STORE_add_crlopenssl_xstore_freeX509_STORE_freeX509_LOOKUP_fileX509_STORE_add_lookupX509_LOOKUP_ctrlX509_LOOKUP_hash_dirX509_STORE_set_depthX509_STORE_set_purposeX509_STORE_load_fileX509_STORE_load_pathX509_STORE_set_default_pathsopenssl_sk_x509_algor_fromtableX509_ALGOR_cmpX509_ALGOR_get0openssl_pushparamsopenssl_toparamsOSSL_PARAM_construct_intOSSL_PARAM_construct_uintOSSL_PARAM_construct_longOSSL_PARAM_construct_ulongOSSL_PARAM_construct_int32OSSL_PARAM_construct_uint32OSSL_PARAM_construct_int64OSSL_PARAM_construct_uint64OSSL_PARAM_construct_time_tOSSL_PARAM_construct_size_tOSSL_PARAM_construct_doubleOSSL_PARAM_construct_utf8_stringOSSL_PARAM_construct_octet_stringOSSL_PARAM_construct_endEVP_KDF_fetchEVP_KDF_do_all_providedEVP_KDF_CTX_newEVP_KDF_deriveEVP_KDF_CTX_freeEVP_KDF_CTX_dupEVP_KDF_CTX_resetEVP_KDF_CTX_get_kdf_sizeEVP_KDF_CTX_kdfEVP_KDF_CTX_gettable_paramsEVP_KDF_CTX_settable_paramsEVP_KDF_CTX_get_paramsEVP_KDF_CTX_set_paramsEVP_KDF_get0_descriptionEVP_KDF_get0_nameEVP_KDF_get0_providerEVP_KDF_is_aEVP_KDF_names_do_allEVP_KDF_gettable_paramsEVP_KDF_gettable_ctx_paramsEVP_KDF_settable_ctx_paramsEVP_KDF_get_paramsX509_STORE_CTX_get_error_depthX509_STORE_CTX_get_current_certX509_STORE_CTX_set_errorSSL_get_ex_data_X509_STORE_CTX_idxX509_STORE_CTX_get_ex_dataSRP_create_verifier_BNSRP_Calc_BSRP_Verify_B_mod_NSRP_Calc_server_keySRP_Calc_ASRP_Verify_A_mod_NSRP_Calc_xSRP_Calc_client_keySRP_get_default_gNSRP_Calc_uEVP_MAC_fetchEVP_MAC_freeEVP_MAC_is_aEVP_MAC_names_do_allEVP_MAC_get0_providerOSSL_PROVIDER_get0_nameEVP_MAC_get_paramsEVP_MAC_CTX_freeEVP_MAC_CTX_dupEVP_MAC_CTX_get0_macEVP_MAC_do_all_providedEVP_MAC_CTX_newEVP_MAC_initEVP_MAC_updateEVP_MAC_finalEVP_MAC_CTX_get_mac_sizeopenssl_i2s_revoke_reasonopenssl_s2i_revoke_reasonX509_REVOKED_get_ext_d2iASN1_ENUMERATED_freeX509_REVOKED_newX509_REVOKED_set_revocationDateX509_REVOKED_set_serialNumberASN1_ENUMERATED_newX509_EXTENSION_newASN1_ENUMERATED_setX509_REVOKED_add_extX509_REVOKED_get0_serialNumberX509_REVOKED_get0_revocationDateX509_REVOKED_get0_extensionsX509_CRL_newX509_CRL_set_versionX509_CRL_add0_revokedX509_CRL_set_issuer_nameX509_CRL_set1_lastUpdateX509_CRL_set1_nextUpdateX509_CRL_signX509_CRL_freePEM_read_bio_X509_CRLd2i_X509_CRL_bioX509_CRL_get_versionX509_CRL_get0_extensionsX509_CRL_add_extX509_CRL_get_issuerX509_CRL_get0_lastUpdateX509_CRL_get0_nextUpdateX509_CRL_sortX509_CRL_verifyopenssl_crl_signX509_CRL_digestX509_CRL_cmpX509_CRL_diffX509_CRL_get0_signatureX509_CRL_get_ext_d2iX509_CRL_get_REVOKEDPEM_write_bio_X509_CRLi2d_X509_CRL_bioX509_REVOKED_dupX509_REVOKED_freeX509_CRL_up_refPEM_read_bio_X509_REQd2i_X509_REQ_bioX509_REQ_newX509_REQ_set_versionX509_REQ_set_subject_nameX509_REQ_set_pubkeyX509_REQ_signX509_REQ_freeX509_get_ext_by_OBJX509_delete_extASN1_TIME_adjPEM_write_bio_X509_REQi2d_X509_REQ_bioX509_REQ_digestX509_REQ_check_private_keyX509_REQ_dupX509_REQ_verifyX509_REQ_get0_signaturei2d_re_X509_REQ_tbsX509_REQ_get_versionX509_REQ_get_X509_PUBKEYX509_PUBKEY_getX509_REQ_get_attr_countX509_REQ_get_attrX509_PUBKEY_get0_paramX509_REQ_add_extensionsX509_REQ_add1_attrX509_REQ_delete_attrlibcrypto.so.3libssl.so.3libc.so.6_edata__bss_startGLIBC_2.3GLIBC_2.14GLIBC_2.3.4GLIBC_2.2.5OPENSSL_3.0.0OPENSSL_3.4.0OPENSSL_3.3.0/opt/imunify360-webshield/openssl/lib aPii abti bui ba +p&ba /p 4b .pBb +p&b00. 80.@0.@0.`0. h0.ܾp0. x0.f0.h 0.ۿ0.p 0.P0. 0.0.A 0.X0.E 0.N0.Q 0.1. 1. 1. 1.D  1. (1. 01. 81.X@1. H1.P1. X1.H`1. h1.ap1. x1.1. 1.1. 1.1. 1.1. 1.d1. 1.F1. 1.E2. 2.2. 2. 2.i (2.02.J 82.Z@2.r H2.P2.{ X2.02. 2. 2. 2. 2. 2. 2. 2. 2. 2. 2. 2.2~2. 2. 3. (3.03. 83.$@3. H3.P3. X3.F`3. h3. p3. x3.3. 3.3. 3.3. 3.F3.@ 3.3. 3.ղ3. 3.J3. 3.3. 3.54. 4.P4. 4.n 4. (4.E04. 84.$@4. H4.P4.' X4.A`4.+ h4.p4.2 x4.x4.8 4.44.> 4.4.D 4.ͼ4.L 4.4.S 4.4.W 4.4.[ 4.a4.b 4.ղ5.f 5.5.m 5. 5.q (5.05.x 85.@5. H5.6P5. X5.q`5. h5.p5. x5.5. 5.F5. 5.˸5. 5.5. 5.-5. 5.5. 5.p5. 5.6.N 6. 6.R 6.i" 6. (6. 06.Y 86.%@6.! H6.'P6.^ X6.)`6. h6.*6.! 6.! 6.! 6.! 6.! 6.! 6.! 6.! 7.! 7.! (7.! 87.! H7.M P7.M `7.M h7.M x7.M 7.M 7.M 7.M 7.N 7.N 7.*N 7.;N 7.GN 7.PN 7.XN 7.fN 8.sN 8.N H8.N P8.N `8.N h8.N x8.N 8.N 8.N 8.N 8.N 8.N 8.N 8.N 8.N 8.N 8.O 8.O 9.q (9.}g 09.q 89.f @9.Fq H9. h `9. h9.M p9. x9.0 9. 9. 9. 9. 9. 9. 9.ǃ 9.Ճ 9. 9. :. :. :. (:.6 8:.K @:.\ P:.l X:.| h:. p:. :. :. :.۪ :.:. :.ʱ:. :.:. :. ;. ;.L;. ;. ;. (;.0;. 8;.Ǵ@;. H;.tP;.$ X;.`;.0 h;./p;.6 x;. ;.= ;.D ;.<;. ;.b;.# ;.i;.# ;. ;.V# ;.<.# <.<.# <.5 <.# (<.0<. 8<.Ԫ@<.# H<.P<.# X<. `<.# h<.p<.# x<.<.# <.<.# <.)# <. <.0# <.w<.! <.<.:# <.<.B# <.̐<.J# <.Q=.O# =.=.[# =.@j.ë Hj.˫ Pj.ӫ Xj.٫ j. j. j. j. j. j.ͯ j.ۯ j. k. k. k. 0k. @k. Pk. `k. pk. k.( k.3 k.@ k.E k.L k.^ k.g k.l l.w l. l. 0l. @l. Pl. `l. pl.ư l.԰ l. l. l. l. l. l. l.- m.; m.K @m. Hm.Pm. Xm.`m. hm.pm. xm.m. m.m.ɳ m. m.ҳ m.Nm.߳ m.jm. m.m. m.5m. m.9n. n.n. n.; n. (n.g0n. 8n.+@n. Hn.Pn. Xn.$`n.@ pn. xn.gn. n.n.Ĵ n.kn.ȴ n.n.+ n.`n. n.n.ʹ n.jn.Ѵ n.o.մ o.o.ڴ o.> o. (o.0o. 8o.@o. Ho.>Po. Xo.U`o.@ o.' o.o. o.o.մ o.o.Ѵ o.6o.. o.o.5 o.o. o.xo.f o.p.@ p. p. p. (p.:0p.= 8p.O@p.A Hp. Pp. Xp. `p. hp.pp.E xp.cp.H p.p.L p.p.Q p.p.W p.'p.̾ p.gp.Ѿ p.p.׾ p.q.ܾ q.q. q. q. (q.0q. 8q.@q. Hq.9Pq. Xq.a`q. hq.pq. xq.q. q.q. q.gq. q.Nq. q. q.) q.q.. q.q.6 q.gq.= q.r.E r.ar.O r._ r.X (r.0r.[ 8r.%@r._ Hr.Pr.d Xr._`r.i hr.Z|pr. r.v r.r.{ r.|r. r. zr. r.){r. r."}r. r.}r.X r.X~s. s.~s. s. s.6 (s.0s.= 8s.F`s. hs. ps. xs.Ŀ s.[ s.< s.vs.A s.Xs.E s.Ns.Q s.s.] s.Bs.h s.ۿt.p t.Pt. t. t.@ @t.x Ht.Pt.} Xt.`t. ht.pt.< xt.t. t.lt. t.t. t.<t. t.lt.@ t. t. u. u. u. 0u. @u.5 Pu.G `u.\ pu.j u. u. u. u. u. u. u. u. v.- v.E v.\ 0v.v @v. Pv. `v. pv. v. v. v. v. v. v." w.+ w.A w.J 0w. @w.S Pw.Z `w.e pw.s w.{ w. w. w. w. w. w. x. x.> x. x.f! x.J (x. 0x. 8x.D @x. Hx.j#Px. Xx.d`x. hx."px. xx."x. x.&x. x.{*x. x.-,x. x.@$x. x. x.3-y. y.[y.% y.0V y.+ (y.Y0y.1 8y.U@y. `y.6 py.K y.e y. y. y. y. y. y. y. z. (z.dZ0z. 8z.N\`z.i hz.Npz.m xz.z.J z.z.r z.z.{ z.0z. z. z.z. z.f{.m {.j{. {.̕ {. ({.m0{. 8{.@{. H{.P{. X{.`{. h{.$p{. x{.}{. {.{. {.{. {. {.m{. {.{. {.1|. |.|.` @|. H|.`|. p|. x|./|. |. |. |. |. |.|. |.|.> |.~|. |.|. |.|. |.}. }.H}. }. }. (}.0}." 8}.@}.+ H}.%P}.4 X}.`}.> h}.p}.H x}.}. }.5}. }.}. }.}. }.!}. }.$ }. }. ~. ~.{ ~. ~. ~. (~.0~. 8~.@~.m H~.P~. X~.`~. h~.p~. ~. ~. ~.l~. ~.~. ~.~. ~.. .. .$  . (. 0. 8.{ @. H.`.K h.Fp.P x.AG.U .G.Y .>H.` .H.i .0K.n .N.q .O.v .ZP.| .S. .cS. ./T . (.T0. 8.P@. H.MQP. X.Q`. h.Np. . .z. .. Ȁ.GЀ. ؀..@ . .G . 0. @. H.P. X.E`. p. . ȁ. Ё. ؁. .i . . . . . @.# H.2MP.  `.( h.I.- .LP.4 .S.: .R.? .O.G Ȃ.QЂ.Q ؂.N.  .( .Q .  @.# H.EVP.? X.U`.  p.( x. Z.# .9^.Q .]Z.? ȃ.\Ѓ.: ؃.+].U .c.^ .Sc.  .( .d@.- H.dP.4 X.e`.  p.( x.Mg.i .G.t .J. Ȅ.IЄ. ؄.K. .L. . . 0. @. P. `. p.  . .* ./ .7 .? Ѕ.` . . . . . 0. `.: h.Ɣp.1 x.ʒ.5 .$.> .(.E ..M .P. .: .M.f .X.m .c.t .o .> (.0.E 8.d@.M H.ךP. . .f. .. .. .. ȇ.Ї. ؇.Z. .a. .. .. .O .M (.0. `.: h.p. x.. .m. .. .. .ɪ. Ȉ.4Ј.> ؈. . .. .~. .M .@.: H.\P.> X.`.< h.Jp.H x.˴.N .. .M .. ȉ.AЉ. ؉.). .. .;. .׹. .i .6 (.@0.9 8.@.C H.P.Q X.`.] h.p.N x..e .z.j .z. .M .. .W. .. .. . . (.0. @.M H.u`. h.p. x..$ .C.. ..? .{.S ..` ȋ.Ћ.o ؋.. ... . . 0. @. P.! `.0 p.P .o .| . . . Ќ. . . . .% .1 0.< @.H P.Q `.[ p.f .s . .w ȍ.Ѝ.& ؍.. .1.  .b2 . (. ,0. 8.*@.! H.'P.( X.H$`., h.#p.8 x.m7.C .7.I .+. .f Ў.k .s .z . . . 0. @. P. `. p. . . . . .# .# ..# ..)# .  .0# (.w0.! 8.@.6# H.P.:# X.`.B# h.̐p.J# x.Q.O# ..V# .. .Ԫ.[# ..b# Ȑ.А.u# ؐ.o.` .z# ..# .C .# (.0.# 8.u@.# H.P.# X.`.B# h.ۚp.:# x..O# ..J# .0.u# .A.` .4) ..:) .'.D) ..K) . .S) (.(0.[) 8.@.`) H.P.( X.u`.g) h.p.r) x..' .4) ..:) .'.D) Ȓ.В.K) ؒ..S) .(.[) ..`) ..( .u .g) (.0.' 8.@.w) H.P.) X.`.) h..R- .X- .z- .- .- Г.- .- .- .- . . .$. 0.:. @.Q. P.d. `.. p.. .. .. .. ./ ./ Д./ .#/ .,/ .7/ .B/ .P/ 0.^/ @.l/ P.|/ `./ p./ ./ ./ .1 ȕ.!Е.1 ؕ.&.2 .p'.2 .(.2 .y( .h2 (.}2 0.2 8.2 @.2 `.D3 h.I3 p.N3 x.S3 .9 .Jh.9 .a.5 Ȗ.'XЖ.I3 ؖ.X.9 .x`.9 .`.9 .R[.9 .Z .9 (.}R0.6 8.~u@.9 H.rP."3 X.t`.9 h.Wp.9 x.Y.9 .].9 .l.9 .cl.w, .l.9 ȗ.mЗ.8 ؗ.on.9 .[o.: . o.: .Qp.: .t .': (.bt0.1: 8.o@.I: H.oP.]: X.r`.o: h.rp.: x.-w.6 .Y.- .v.x5 Ș.5 И.5 ؘ.5 .|5 .5 .5 .5 .w, (.8 0.: 8.: `.5 h.q5p.5 x.8.5 .y).5 .~*.5 .,.5 .3,.5 ș..Й.5 ؙ. 1.5 .Q.6 .2.6 . 3.'6 .3 .26 (.40.=6 8.:@.I6 H.1=P.Y6 X.>`.i6 h.$Cp.|6 x.":.6 .L.6 .M.6 .'N.6 .3K.6 Ț.FEК.6 ؚ.+.- .6 ..U.6 .R .5 (.S0.6 8.U@.I3 H.TP.7 X.EV`. 7 h.5Wp.7 x.W.6 .ZT.- .B ț.B Л.B .3C .:.A ..rB ..7C . .AC (.@.E P.E `.E p.E .F .*F .BF М.EF .QF .kF .F .F .F 0.F @.G P.G `.+G p.P?.+X?.B`?.h?.p?.x?.?.3?.?.?.?.?.?.(?.=?.U?.`?.X?.?.hn..ho..p..xr..(t..t..x..Hy..z..{..|..h|..x~..~..x....(..X....(..h....h..Ȇ..X..8........8..............h..ȣ........ا......8..Ȭ..x........8.h.x.F. @. @.(@.0@.8@.@@.H@.P@.X@. `@. h@. p@. x@. @.@.@.@.@.@.@.@.@.U@.@.@.@.@.@.@.A.A.A.A. A.!(A."0A.#8A.$@A.%HA.&PA.'XA.(`A.)hA.*pA.+xA.,A.-A..A./A.0A.1A.2A.3A.4A.5A.6A.8A.9A.:A.;A.<A.=B.>B.?B.@B.A B.B(B.0B.C8B.D@B.EHB.FPB.GXB.H`B.IhB.JpB.KxB.LB.MB.@B.NB.OB.PB.QB.RB.SB.LB.TB.UB.VB.WB.XB.YB.ZC.[C.\C.]C.^ C._(C.`0C.a8C.b@C.cHC.dPC.eXC.f`C.ghC.hpC.ixC.jC.kC.lC.mC.nC.oC.pC.qC.rC.sC.tC.uC.vC.wC.xC.yC.zD.{D.|D.}D.~ D.(D.0D.8D.@D.HD.PD.XD.`D.hD.pD.xD.D.1D.D.D.4D.D.D.D.D.D.D.D.VD.D.D.D.$E.E.E.E. E.(E.0E.8E.@E.HE.PE.XE.`E.hE.pE.xE.E.E.E.E.E.E.E.E.E.E.E.E.E.E.E.E.F.F.F.F. F.(F.0F.D8F.@F.HF.PF.XF.`F.hF.pF.xF.F.F.F.F.9F.F.F.F.F.F.F.F.F.F.F.F.G.G.G.G. G.(G.(0G.8G.@G.HG.PG.XG.M`G.hG.pG.SxG.G.G.G.G.G.G.G.G.G.G.G.G.G.G.G.G.H.H.H.H. H.(H.0H.8H.@H.HH.PH.XH.`H.hH.pH.xH.H.H.H.H.H.H.H.H.H.H.H.H.H. H. H. H. I. I. I.I. I.(I.0I.8I.@I.HI.PI.HXI.O`I.hI.pI.xI.I.I.I.I.I.I.I. I.!I."I.#I.$I.%I.&I.'I.(I.)J.*J.+J.,J.W J.-(J..0J./8J.0@J.1HJ.2PJ.3XJ.4`J.5hJ.6pJ.7xJ.8J.9J.:J.;J.<J.=J.>J.?J.@J.AJ.BJ.CJ.DJ.J.EJ.FJ.GK.HK.IK.JK.K K.L(K.]0K.M8K.N@K.OHK.PPK.QXK.R`K.ShK.TpK.UxK.VK.WK.XK.YK.YK.ZK.[K.\K.]K.^K._K.`K.aK.bK.cK.dK.eL.fL.gL.hL. L.i(L.j0L.k8L.l@L.mHL.nPL.oXL.p`L.qhL.rpL.sxL.tL.uL.vL.wL.xL.yL.zL.{L.|L.}L.~L.L.L.L.&L.L.M.M.M."M. M.(M.0M.8M.@M.HM.PM.XM.`M.hM.pM.xM.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.N.N.N.N./ N.(N.0N.8N.@N.HN.XPN.XN.`N.hN.pN.xN.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.O.O.O.O. O.(O.0O.8O.@O.HO.PO.XO.`O.hO.pO.xO.O.O.O.O.:O.O.O.O.O.O.AO.O.O.O.O.O.P.P.P.P. P.(P.0P.8P.@P.HP.PP.XP.`P.hP.pP.xP.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.Q.Q.Q.Q. Q.(Q.0Q.8Q.@Q.HQ.PQ.XQ.`Q.hQ. pQ. xQ. Q. Q. Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.Q.R.R.R.R. R.(R. 0R.!8R."@R.#HR.$PR.%XR.`R.&hR.'pR.(xR.)R.*R.+R.,R.-R..R./R.7R.0R.1R.2R.3R.4R.5R.6R.7R.8S.9S.:S.;S.< S.=(S.>0S.?8S.@@S.AHS.BPS.CXS.D`S.EhS.FpS.xS.GS.6S.HS.S.IS.JS.KS.S.LS.MS.NS.OS.PS.JS.QS.RS.ST.TT.UT.VT.W T.X(T.Y0T.Z8T.[@T.\HT.]PT.^XT._`T.`hT.apT.bxT. T.cT.dT.eT.fT.gT.hT.iT.jT.kT.lT.mT.nT.oT.pT.qT.rU.sU.tU.uU.v U.w(U.x0U.y8U.z@U.{HU.|PU.}XU.`U.~hU.pU.xU.U.U.;U.U.U.U.U.U.U.U.U.U.U.U.U.U.V.V.V.V. V.(V.0V.8V.@V.HV.PV.XV.`V.hV.pV.xV.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.W.W.W.W. W.(W.0W.8W.@W.HW.PW.XW.`W.hW.pW.xW.W.W.W.W.W.W.=W.W.W.W.W.W.#W.W.W.W.X.X.X.\X. X.(X.0X.8X.@X.HX.PX.XX.`X.hX.pX.xX.X.X.X.X.X.X.X.X.X.X.X.'X.X.X.X.X.Y.Y.Y.Y. Y.(Y.0Y.8Y.@Y.HY.PY.XY.`Y.hY.pY.xY.Y.Y.Y.Y.Y.Y.Y.Y.Y.Y.Y. Y. Y. Y. Y. Y.Z.Z.Z.Z.% Z.(Z.0Z.8Z.@Z.HZ.PZ.XZ.`Z.hZ.pZ.xZ.Z.Z.Z. Z.!Z.Z."Z.#Z.$Z.%Z.&Z. Z.'Z.)Z. Z.*Z.+[.,[.-[..[., [./([.00[.18[.2@[.3H[.4P[.5X[.6`[.7h[.8p[.x[.9[.:[.;[.<[.=[.>[.?[.@[.A[.B[.C[.D[.E[.F[.G[.H[.I\.T\.J\.K\.L \.M(\.N0\.O8\.P@\.QH\.RP\.SX\.T`\.Vh\.Wp\.x\.X\.Y\.Z\.[\.\\.]\.^\._\.a\.b\.c\.d\.e\.f\.g\.h\.i].j].k].].l ].m(].n0].o8].p@].qH].rP].sX].t`].uh].vp].wx].x].y].z].{].|].}].~].-].].].].].].].].].^.^.^.^. ^.(^.0^.8^.@^.H^.P^.X^.`^.h^.p^.x^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^.^._._._.5_. _.(_.0_.8_.@_.H_.P_.X_.`_.h_.p_.x_._._._.R_._._._._._._._._._._._._.`.`.`.`. `.(`.0`.8`.@`.H`.P`.X`.``.h`.p`.x`.`.`.`.`.`.`.`.`.P`.`.`.`.`.`.`.`.a.a.<a.a. a.(a.0a.8a.@a.Ha.Pa.Xa.`a.ha.pa.xa.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.b.b.b.b. b.(b.0b.8b.@b.Hb. Pb. Xb. `b. hb. pb.xb.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.c. c.!c."c.# c.$(c.N0c.%8c.&@c.Hc.'Pc.(Xc.)`c.*hc.+pc.,xc.-c..c./c.0c.1c.2c.3c.4c.5c.6c.7c.8c.9c.:c.;c.c.<d.=d.>d.?d.@ d.A(d.B0d.C8d.D@d.EHd.FPd.GXd.H`d.Ihd.Jpd.Kxd.Ld.Md.Nd.Od.Pd.Qd.Rd.Sd.Td.Ud.Vd.Wd.Yd.Zd.[d.\d.]e.^e._e.`e.a e.b(e.c0e.d8e.e@e.fHe.gPe.hXe.i`e.jhe.kpe.lxe.me.ne.oe.pe.qe.re.se.te.ue.ve.we.xe.ye.ze.{e.Qe.|f.}f.~f.f. f.(f.0f.8f.@f.Hf.Pf.CXf.`f.hf.pf.xf.f.f.f. f.f.f.f.f.f.f.f.f.f.f.f.f.Bg.g.g.g. g.(g.0g.28g.@g.Hg.Pg.Xg.`g.hg.pg.xg.g.g.g.8g.g.g.g.Kg.g.g.g.g.g.?g.g.g.h.h.h.h. h.(h.0h.8h.@h.Hh.Ph.Xh.E`h.hh.ph.xh.h.h.h.h.h.h.h.h.h.h.[h.h.h.h.h.h.i.i.i.i. i.(i.0i.8i.@i.Hi.Pi.Xi.`i.hi.pi.xi.i.i.i.i.i.i.i.i.i.i.i.i.i.i.i.i.j.HHq,HtH5,%,@%,h%z,h%r,h%j,h%b,h%Z,h%R,h%J,hp%B,h`%:,h P%2,h @%*,h 0%",h %,h %,h% ,h%,h%,h%,h%,h%,h%,h%,h%,hp%,h`%,hP%,h@%,h0%,h %,h%,h%,h%,h %z,h!%r,h"%j,h#%b,h$%Z,h%%R,h&%J,h'p%B,h(`%:,h)P%2,h*@%*,h+0%",h, %,h-%,h.% ,h/%,h0% ,h1% ,h2% ,h3% ,h4% ,h5% ,h6% ,h7p% ,h8`% ,h9P% ,h:@% ,h;0% ,h< % ,h=% ,h>% ,h?% ,h@%z ,hA%r ,hB%j ,hC%b ,hD%Z ,hE%R ,hF%J ,hGp%B ,hH`%: ,hIP%2 ,hJ@%* ,hK0%" ,hL % ,hM% ,hN% ,hO% ,hP% ,hQ% ,hR% ,hS% ,hT% ,hU% ,hV% ,hWp% ,hX`% ,hYP% ,hZ@% ,h[0% ,h\ % ,h]% ,h^% ,h_% ,h`%z ,ha%r ,hb%j ,hc%b ,hd%Z ,he%R ,hf%J ,hgp%B ,hh`%: ,hiP%2 ,hj@%* ,hk0%" ,hl % ,hm% ,hn% ,ho% ,hp% ,hq% ,hr% ,hs% ,ht% ,hu% ,hv% ,hwp% ,hx`% ,hyP% ,hz@% ,h{0% ,h| % ,h}% ,h~% ,h% ,h%z ,h%r ,h%j ,h%b ,h%Z ,h%R ,h%J ,hp%B ,h`%: ,hP%2 ,h@%* ,h0%" ,h % ,h% ,h% ,h% ,h% ,h% ,h% ,h% ,h% ,h% ,h% ,hp% ,h`% ,hP% ,h@% ,h0% ,h % ,h% ,h% ,h% ,h%z ,h%r ,h%j ,h%b ,h%Z ,h%R ,h%J ,hp%B ,h`%: ,hP%2 ,h@%* ,h0%" ,h % ,h% ,h% ,h% ,h% ,h% ,h% ,h% ,h% ,h% ,h% ,hp% ,h`% ,hP% ,h@% ,h0% ,h % ,h% ,h% ,h% ,h%z ,h%r ,h%j ,h%b ,h%Z ,h%R ,h%J ,hp%B ,h`%: ,hP%2 ,h@%* ,h0%" ,h % ,h% ,h% ,h% ,h%,h%,h%,h%,h%,h%,h%,hp%,h`%,hP%,h@%,h0%,h %,h%,h%,h%,h%z,h%r,h%j,h%b,h%Z,h%R,h%J,hp%B,h`%:,hP%2,h@%*,h0%",h %,h%,h% ,h%,h%,h%,h%,h%,h%,h%,h%,hp%,h`%,hP%,h@%,h0%,h %,h%,h%,h%,h%z,h%r,h%j,h%b,h%Z,h%R,h%J,hp%B,h`%:,h P%2,h @%*,h 0%",h  %,h %,h% ,h%,h%,h%,h%,h%,h%,h%,h%,hp%,h`%,hP%,h@%,h0%,h %,h%,h%,h%,h %z,h!%r,h"%j,h#%b,h$%Z,h%%R,h&%J,h'p%B,h(`%:,h)P%2,h*@%*,h+0%",h, %,h-%,h.% ,h/%,h0%,h1%,h2%,h3%,h4%,h5%,h6%,h7p%,h8`%,h9P%,h:@%,h;0%,h< %,h=%,h>%,h?%,h@%z,hA%r,hB%j,hC%b,hD%Z,hE%R,hF%J,hGp%B,hH`%:,hIP%2,hJ@%*,hK0%",hL %,hM%,hN% ,hO%,hP%,hQ%,hR%,hS%,hT%,hU%,hV%,hWp%,hX`%,hYP%,hZ@%,h[0%,h\ %,h]%,h^%,h_%,h`%z,ha%r,hb%j,hc%b,hd%Z,he%R,hf%J,hgp%B,hh`%:,hiP%2,hj@%*,hk0%",hl %,hm%,hn% ,ho%,hp%,hq%,hr%,hs%,ht%,hu%,hv%,hwp%,hx`%,hyP%,hz@%,h{0%,h| %,h}%,h~%,h%,h%z,h%r,h%j,h%b,h%Z,h%R,h%J,hp%B,h`%:,hP%2,h@%*,h0%",h %,h%,h% ,h%,h%,h%,h%,h%,h%,h%,h%,hp%,h`%,hP%,h@%,h0%,h %,h%,h%,h%,h%z,h%r,h%j,h%b,h%Z,h%R,h%J,hp%B,h`%:,hP%2,h@%*,h0%",h %,h%,h% ,h%,h%,h%,h%,h%,h%,h%,h%,hp%,h`%,hP%,h@%,h0%,h %,h%,h%,h%,h%z,h%r,h%j,h%b,h%Z,h%R,h%J,hp%B,h`%:,hP%2,h@%*,h0%",h %,h%,h% ,h%,h%,h%,h%,h%,h%,h%,h%,hp%,h`%,hP%,h@%,h0%,h %,h%,h%,h%,h%z,h%r,h%j,h%b,h%Z,h%R,h%J,hp%B,h`%:,hP%2,h@%*,h0%",h %,h%,h% ,h%,h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+h P%2+h @%*+h 0%"+h  %+h %+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h %z+h!%r+h"%j+h#%b+h$%Z+h%%R+h&%J+h'p%B+h(`%:+h)P%2+h*@%*+h+0%"+h, %+h-%+h.% +h/%+h0%+h1%+h2%+h3%+h4%+h5%+h6%+h7p%+h8`%+h9P%+h:@%+h;0%+h< %+h=%+h>%+h?%+h@%z+hA%r+hB%j+hC%b+hD%Z+hE%R+hF%J+hGp%B+hH`%:+hIP%2+hJ@%*+hK0%"+hL %+hM%+hN% +hO%+hP%+hQ%+hR%+hS%+hT%+hU%+hV%+hWp%+hX`%+hYP%+hZ@%+h[0%+h\ %+h]%+h^%+h_%+h`%z+ha%r+hb%j+hc%b+hd%Z+he%R+hf%J+hgp%B+hh`%:+hiP%2+hj@%*+hk0%"+hl %+hm%+hn% +ho%+hp%+hq%+hr%+hs%+ht%+hu%+hv%+hwp%+hx`%+hyP%+hz@%+h{0%+h| %+h}%+h~%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+h P%2+h @%*+h 0%"+h  %+h %+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h %z+h!%r+h"%j+h#%b+h$%Z+h%%R+h&%J+h'p%B+h(`%:+h)P%2+h*@%*+h+0%"+h, %+h-%+h.% +h/%+h0%+h1%+h2%+h3%+h4%+h5%+h6%+h7p%+h8`%+h9P%+h:@%+h;0%+h< %+h=%+h>%+h?%+h@%z+hA%r+hB%j+hC%b+hD%Z+hE%R+hF%J+hGp%B+hH`%:+hIP%2+hJ@%*+hK0%"+hL %+hM%+hN% +hO%+hP%+hQ%+hR%+hS%+hT%+hU%+hV%+hWp%+hX`%+hYP%+hZ@%+h[0%+h\ %+h]%+h^%+h_%+h`%z+ha%r+hb%j+hc%b+hd%Z+he%R+hf%J+hgp%B+hh`%:+hiP%2+hj@%*+hk0%"+hl %+hm%+hn% +ho%+hp%+hq%+hr%+hs%+ht%+hu%+hv%+hwp%+hx`%+hyP%+hz@%+h{0%+h| %+h}%+h~%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+h%r+h%j+h%b+h%Z+h%R+h%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+h%+h%+h%+h%+h%+h%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+hп%r+h%j+h鰿%b+h頿%Z+h鐿%R+h逿%J+hp%B+h`%:+h P%2+h @%*+h 0%"+h  %+h %+h% +h%+h%+hо%+h%+h鰾%+h頾%+h鐾%+h逾%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h %z+h!н%r+h"%j+h#鰽%b+h$頽%Z+h%鐽%R+h&逽%J+h'p%B+h(`%:+h)P%2+h*@%*+h+0%"+h, %+h-%+h.% +h/%+h0%+h1м%+h2%+h3鰼%+h4頼%+h5鐼%+h6逼%+h7p%+h8`%+h9P%+h:@%+h;0%+h< %+h=%+h>%+h?%+h@%z+hAл%r+hB%j+hC鰻%b+hD頻%Z+hE鐻%R+hF逻%J+hGp%B+hH`%:+hIP%2+hJ@%*+hK0%"+hL %+hM%+hN% +hO%+hP%+hQк%+hR%+hS鰺%+hT頺%+hU鐺%+hV逺%+hWp%+hX`%+hYP%+hZ@%+h[0%+h\ %+h]%+h^%+h_%+h`%z+haй%r+hb%j+hc鰹%b+hd頹%Z+he鐹%R+hf逹%J+hgp%B+hh`%:+hiP%2+hj@%*+hk0%"+hl %+hm%+hn% +ho%+hp%+hqи%+hr%+hs鰸%+ht頸%+hu鐸%+hv逸%+hwp%+hx`%+hyP%+hz@%+h{0%+h| %+h}%+h~%+h%+h%z+hз%r+h%j+h鰷%b+h頷%Z+h鐷%R+h逷%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+hж%+h%+h鰶%+h頶%+h鐶%+h逶%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+hе%r+h%j+h鰵%b+h頵%Z+h鐵%R+h逵%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+hд%+h%+h鰴%+h頴%+h鐴%+h逴%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+hг%r+h%j+h鰳%b+h頳%Z+h鐳%R+h逳%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+hв%+h%+h鰲%+h頲%+h鐲%+h進%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+hб%r+h%j+h鰱%b+h頱%Z+h鐱%R+h週%J+hp%B+h`%:+hP%2+h@%*+h0%"+h %+h%+h% +h%+h%+hа%+h%+h鰰%+h頰%+h鐰%+h逰%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h%z+hЯ%r+h%j+h鰯%b+h頯%Z+h鐯%R+h逯%J+hp%B+h`%:+h P%2+h @%*+h 0%"+h  %+h %+h% +h%+h%+hЮ%+h%+h鰮%+h頮%+h鐮%+h逮%+hp%+h`%+hP%+h@%+h0%+h %+h%+h%+h%+h %z+h!Э%r+h"%j+h#鰭%b+h$頭%Z+h%鐭%R+h&逭%J+h'p%B+h(`%:+h)P%2+h*@%*+h+0%"+h, %+h-%+h.% +h/%+h0%+h1Ь%+h2%+h3鰬%+h4頬%+h5鐬%+h6逬%+h7p%+h8`%+h9P%+h:@%+h;0%+h< %+h=H=,,H,,H9tHF+Ht H=i,,H5b,,H)HHH?HHtH+HtfD=%,,u+UH=J+Ht H=>+Id+,]wUHH }HuHUH}t3HEHUHMEHΉaHEu E<HEUHHH}u}y}|HEHZEEUHH H}HuHUMDEHUHEHHEHtbHEHHUHuHEH H]t HEHHEHHUHEHEЉHEHUMHEHUHHH}u}x}~HEH55! HǸHEHA! H}uHEH)*EHEHxHEH'HEAH5 HUHH0H}uUME}t)}t<}UMHEHKUMHEHHEHf HUHEHEUHEHEUHEH,UHEHHEAH5 HHEHgEHEHSEHEH5 HǸ6UHH H}uUUHEHEHEHr HUHEH`UHEHUHHH}uUHEHtUUHEHHxH*HHH H*XHEH7MHEH HzUHEH!HxH*HHH H*XHEHԭZMHEH HuAUHEH5HEHHHEH5 HǸUHH0H}uHU؋UHEHYEHUHEHHgUHEHHEH襫HEH蔫UHH0H}uHU؋UHEHEHEHd HHUHEHHHEH_UHEHUHH0H}uHU؋UHEH臫fH~HEH}t=ff.Ez ff.EuUHEH0tHE؉EUHH}]UHH H}uHUEPHEHuIH}tHUHEH5 HǸ$HEH5 HEHEHtUHH0H}uHU؋UHEHyEHEH HJHUHEHHHEH試UHEHHEH藩HEH膩uwHEHHEHHUHEHH`HEHHEH)UHEHUHH H}uHEEHEH H3UHEH~HUHEHHEHEH EuHEH56 HǸHEUHH0H}HuU܋E܍HHEH HHEHHEHHBHEHEEЉHEHEE;E|HEHHUHEHHx+E܉HEH@HEHEHHcEЉHEHUHHH}HuHEHl HHUHEHƥHEH5HEHdUHH0H}uHU؋UHEHHEHEH HIH}tUHEH艽uiEHUHEH"HEH葦HEH EHEH}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhHt EEEEE;E|EUHHH}uU}tHEH芥t HEH蟾HEHYMHEHʴtHEHEPMHEHQtRHEHHEH5 HHEHHEH/HEH-HEH<UHH H}HuHEHaEHUHEH5; HHEHFEHHEHjt/EPHEHcHEHUHEHiUHHH}HuHEH@t%HEHPHEH5 HǸHEH@HEH@H6E}t} uHEH@HHEUHHPHHHHH2EHu.HH5 HHp+HHiHHH5 HǸHH5j HHHHuUHH5@ HVHHHHtPHƄ Ћ9uqHtgHHH5 HHHHuUHH5 HHHHHt PHHH~HHHHIHH5HEHHEHtHHc}t/UHHUHH5 HUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEH HEHuHEH HE}tEHMHUHuHEHUHH H}uH HE}uHEH[EuE%EE~eH HEHEUHEHHEHfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHUHEHѨUHEHUHEHoEmE;E|UHH H}uUEUHEHEHEHS+EE}yEE}E;E}zHEH! H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEH HUHEHEHUHEHH=HEH|UHEHUHH H}HuHUHEHHfH~HEHEH9Etj HEHHEHEt'ԴHHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEH H6UHEHMEEHE}tU} }tEHEH5N HIUHEH3UHEH_tHEH5 HHEH5HMHEHH tHEHdE}uHEH.UHEH˧HEUHEHfHHUHEH5eHǸ'}tCHEH/HEH uHEH5%HǸ@HUHEH與UHH H}HuHUMHEHtHHEHH.HUHEH躈HEH)HEHHMHEHHHUHEHHHEH迆HEHIHEH踣HUHEH}t&HEH茣HUHEHHEH&UHH H}HEH6tHEH0E}t5HEHߟHEHΟHE`P0H轟{HEH5bHHEH袅HEH5?H迨HEHyHEH5H薨HEHPUHH0H}HEHUHEؾHHEHEؾHtHEؾH蕑EHEHEHu3HEH5HHEغH豄}tDHEHHDH5SHHEHEHMHEHH%HHEBHEHHIH5HHEHEHMHEHHHHEHUHMHEHH)HEMH5HܜUHHPHHHHEHH跆tHH.EHH耆t&HHt EXHHEgHHEHEEUHEH}tmHUHEHH蒬HUHEHѺsHEHEHHEHHHEHH5HE H mHUHEHH%UHHEHHHHEHHEԃ}HEع H蛇HUHEHѺsH~HEHHt(HEHHEHHHHHEHEH螎}tHEH HEHEUHH H}HuHEHEHEHEHEHPHEHH膤HEH@EPHEH詢UHH H}HEL?+H X+HEHEH=HUEH56蘉UHH H}HEH}u HUHEHfHEHEHvHHEHH蔣HEHNHEHHHEHH`HEHHUHEHHHEH;HEH/UHHH}UHH0H}EH HEH}t_HEH詉HUHEHѺsHHEHHEHHHEHHHEH¨]EEUHH0H}HEHUHEؾHHEHEHHEؾH܇H*EHEEHEH UHH0HHH—HEEHH^EH}uHHHEEHcHEHHgEUHHUHH HHHHEEH}uHHSHE}tHEH譻EUHH薮UHHH}3HEHSUHH0H}HEؾHoHHEHEEH}HEHH蛅HEHHHEHEHEH`E}uHUHMHEHHHEH蔬}tUHE؉H譭UHH}EE]UH+u U耘]UH+P7@v8H5WHX+H5?HH+]UHHH}HEHGHEH5+HtHEH賜HEHHEH;HEH H#HEH׊HEHHHEHHEHHۇHEHHEHH跇HEH;HEHH蓇HEHHEHuHoHEH#HEHUHKHEHHEH7H'HEH[HEHHHEHHEHH߆HEHSHEHH軆HEHHEHH藆HEH蛖HEHHsHEH藦HEH}HOHEHSHEH^H+HEHHEH=HHEH苦HEHHHEHװHEHH迅HEHHEHH蛅HEH蟊HEHHwHEHkHEHHSHEHgHEH{H/UHH0H}HuU܋UHMHEHHHEH}t HEHUHH }HuHUH}t3HEHUHMEHΉHEu EɁHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHztbHEHHUHuHEH RHt HEH誉HEHYHUHEHEЉHEHOUMHEH蛬UHHH}u}x}~HEH5HǸeHEHH}uHEH趓*EHEH{HEH贋HEAH5iHUHH0H}uUME}t)}t<}UMHEHؼUMHEHHEHHUHEHEUHEHEUHEH蹒UHEH訒HEAH5HHEHEHEHEHEH5HǸÝUHH H}uUUHEHEHEHHUHEHUHEH蜺UHHH}uUHEHwtUUHEHHxH*HHH H*XHEHxMHEHHUHEH讗HxH*HHH H*XHEHaxZMHEHGHuAUHEHvHEHRHHEH5HǸ'UHH0H}uHU؋UHEHYEHUHEHHUHEH#HEH2vHEH!vUHH0H}uHU؋UHEHEHEHHHUHEHHmHEHUHEH蛑UHH0H}uHU؋UHEHvfH~HEH}t=ff.Ez ff.EuUHEH轔tHE؉EUHH}]UHH H}uHUEPHEH>uIH}tHUHEH5xHǸg$HEH5mHEHEHUHH0H}uHU؋UHEHyEHEHHJHUHEHH|HEH6qUHEH腻HEH$tHEHtuwHEH膳HEH0HUHEHHHEHpHEH趍UHEH%UHH H}uHEEHEHiH3UHEH~HUHEHHEHEH譲EuHEH5HǸ莘HEUHH0H}HuU܋E܍HHEHHHEHHEHHϒHEHoEEЉHEH苌EE;E|HEHHUHEHH+E܉HEHͨHEHEHHcEЉHEH裱UHHH}HuHEHHHUHEHSpHEHqHEHUHH0H}uHU؋UHEH:HEHEHHIH}tUHEHuiEHUHEHoHEHqHEH蘀EHEH脰}uHEHEUHHHhEE EEeHpMHhHquDUEЉEHpMHhHuqt EEEEE;E|EUHHH}uU}tHEHpt HEH,HEHoMHEHWtHEHBEPMHEHQtRHEHLHEH5VHHEH胁HEHB/HEH躮HEHɱUHH H}HuHEHEHUHEH5HdHEHӈEHHEHjt/EPHEHcHEHUHEHUHHH}HuHEH@t%HEHPHEH5HǸPHEH@HEH@HhE}t} uHEH@HhHEUHHPHHHHH|EHu.HH57HHn+HHiHHH5HǸ菓HH5H艑HHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5^HyHHHuUHH55HHHHHt PHHH aHHHHIHH5HEHH EHtHH}t/UHH6UHH5LHUHHGEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEHUUHH H}uHyHE}uHEH[EuE%EE~eH%HEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHosUHEH^sUHEH UHEHEmE;E|UHH H}uUEUHEHEHEHo+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHHnHEH jUHEHXUHH H}HuHUHEHHrrfH~HEHEH9Etj HEHHEHEt'aHHEHH% uHEuEHEHXHEH+EHUHH0H}uHU؋MHEH=H_UHEHVEEHE}tU} }tEHEH5HIUHEHp3UHEH_tHEH5HHEH5HMHEHjH|tHEHUE}uHEHRUHEHXrHEUHEHHHUHEH5HǸ贃}tCHEH=/HEH虖uHEH5HǸzHUHEHRUHH H}HuHUMHEHHHEHsH.HUHEHGSHEHTHEH-HMHEHH5HUHEHHtHEHLQHEHֆHEHEnHUHEH]}t&HEHnHUHEHt]HEH賖UHH`H}ϓHEHEEHEHSE}tI}tC}t=}uHEH5HHuHEHHXHEHGSuFHEH\EċEątHEHMH¾HXEHEHRu]HEHHE'HEHUHEHHgE}HUHEHޑHEH踓t7HUHEH?`HEHEHMHEHHZEFHEH5H}HEH}t#HEHLHUHEH芒E}uJH}t5HEHpHHEHHEH5ZHMHEHj HEHEUHSHXH}HEHUHEHL_HEH]HEHWHH#HEH]HEHHEHVHHHEHEHPHEHHEHEEEH}t HEH9ErHEHH"VHEH;EwHEHHUHEH9EvHEH}HUHEHPHEHHEHEH+EHHHMHUHuHEIHPEԋE%tTHEHMiHEH5,H*pHEHLEHcHEHHfEHcHEHHfEHcHEHHfHEH+EHPHEHHpfHEHUHH+EHHEHHOfEԃ HEHHX[]UHH HHH'EHHEEHEHHNtNHHNt5HHuHHHSHHNt6HHiNtHHHSHH2NuEEHHNuHHEAHHt)HHHJHEHEHHMtHHWEHHHHgH HHEHEHE؋}MUuHEAH[HUHEH+EHHEH}tEHcHMHHHHHUHH0H}HEؾH讚EHEعHbHEEH}uxEbEHHHH+9EuCEHHHHǀ+HHEHHTlHEغHIEEE)vHEHH=tcu|EhE HHHHX+9EuFE HHHH2+HHEHHkHEغHyHEE}~HEHH=ЁuqEbEHHHH+9EuCEHHHH+HHEHH2kHEغHGEE}~EUHH0H}HEHUHEؾHXHEHEغ HsPEEuHEHEHMHEHHhH}t5HEؾHhHHEHHEغH5HF HEHacUHH0H}yHEHEؾHtt*HEؾHHEHUHEHH_UHEؾHIt?HEؾHMHEH}t#HUHEHHeHEHEH}H}t5HEؾHgHHEHHEغH5H'E HEHibUHH H}HEEryHEHEHmht,HEHHHEHH6wEIHEHt-HEHEHHEHH萋EE}uJH}t5HEHfHHEHHEH5H$DHEHfa HEHZ}UHH0H}HEE\tHEHEؾHWgt4HEؾHҕHEHUHEHH EHEؾHވt-HEغHtDHHEHHPE>HEؾH\Gu(hHEHUHEHH膂E}uJH}t5HEؾHQeHHEHHEغH5HBHEH` HEHH}UHH0H}HEغHTHEHEH%EE}tEHcHEHHP]HEؾH=tEEUHHpH}EHEH1FHEHEE*rHEH}DH}t5HEH#dHHEHHEH5HA HEH^EHEHֆHEHXSHEHEHcEtHEHNEUHEHHEH}lH}t5HEHKcHHEHHEH5H@ HEH ^EHEHDHEHHCHEHDHEH軅uHEHLHIHEH&RHEHEHHEH*HBHEHDHEH7uHEHH;IHEHQHEHEH=HEHHBHEHCHEH賄uHEHHHHEHQHEHEH蹂HEH譇tHEHaHaHHEHetHEHHH6HHEHftHEH.H HHUHMHEHHqE}EnHEH}t5HEH`HHEHHEH5H> HEH^[EnHEHBuXZBHEH}t5HEH.`HHEHHEH5H= HEHZEEUHH0H}HUHEؾHqOHEHEHHEHƿUHHEEH}tOH}t5HEؾH_HHEHHEغH5̼H = HEHKZEEUHH H}HEH5H[@HHEHEHcHEHHWUHHPH}HEH5DH@HHEHEH@HEHvEEEH@H5RH褈HEEPHMHEHHwvE}x EHcHMHEHHEHEGH5HUEFHUHEHMHEHEȉHMHEHHGEԋUHEH{mUHH0H}HEغH5H>HHEHEغH5H>HHEHUHEHH,IE}HE؉HUHH H}HEH5Hf>HHEHEHc{UHH0H}HEغH5[H(>HHEEHEtnHEtcHEH@HtaHEH}t5HEؾH\HHEHHEغH5ԺH&: HEHhWEEUHH0H}HEغH5Hx=HHEHEHUHEHHBEE}~8EHcHMHEHHEHEyH5HSEEUHH HHHHrHDHHdHHXHEHPHHсMHHHvFDHH@HgHEHH5غHGH}t;HHZHHEHHH5HH_8HHUHHJXHH@HEEHEHcHEHHHHHMHHHEOHH@HEEHE؋HcHEHHHHHKMHHùH(EHH@HEEHEȋHcHEHHHHHMHHjHDHH@HEEHEHcHEHHHHHMHHHvDDHH@HEEHEHcHEHHHHH@MHHHDHH@HEEHEHcHEHHHHHMHH_HCHH@HEEHEHcHEHHHHHMHHHkC9HH@HxDžtHxHcHxHHHHH)tHHHCHH@HhDždHhHcHhHHHHHdHH6HBiHH@HXDžTHXHcHXHHHHHYTHHζH3BHH@HHDžDHHHcHHHHHHHDHHfHAHH@H8Dž4H8HcH8HHHHH4HHHcA1HH@H(Dž$H(HcH(HHHHH!$HHH@HH@HDžHHcHHHHHHHH.H@dHH@HDžHHcHHHHHHTHHɴH.@HDžHHHHI;~eDžHcHHHHHHQH?HH5#HKHHcHHHLHHH\?UHH H}HEH5TH!5HHEHUHEHHGvUHH H}HEH5:H4HHEHEHiHcHEHH,LUHH H}HEH5H4HHEHEHiEE\HHEHHUHEH1E|HHEHHTHEH1UHH0H}HEغH5EH3HHEHEHh"|HEEH}t0HUHEHH]THEغH1EEUHH0H}HEغH5Hg3HHEHEHth[HEEH}t0HUHEHHSHEغH0EEUHH` HHH52H2HHEHHN3tHH<EHHHH'H HHNjUHEH¾ EFHUHHHEHHUHH H}HEH5gH2HHEHEH5HH1HHEHUHEHHuHEHwUHH0H}HEغH5H1HHEHQHpsHEHUHEHH DHUHEHѺsHL4HEHHEHHHEHHFHEHXUHH H}HEH5PH0HHEHEHVUHH H}HEH5H0HHEHEH\HEH}t5HEHZOHHEHHEH5H, HEHJUHH0H}HEغH5H/0HHEHUHEؾH>HEHEHHMHEHHXHHE؉H.uUHH0H}HEغH5 H/HHEHEHhE}~yEHH5HixHEHEHEHUHEHHhE}~ EHcHMHEHHPEHE躌H5HE}UHH0H}HEغH5H.HHEHEؾHa/u_HEH_HEH}t5HEؾHoMHHEHHEغH5H*SHEH/HEHEؾH<3HEHUHEHHEJHEH cHEؾHHUHHPH}HEH5HZHHEEHE@tr8HEH5H-HHEHEH1|HEHUHEHHJCEUHEH[HEH5HY-HHEHEH-u*HEH{HEHUHEHHZZHEHnt-HEHg*HHEHH6EHEH5EHǸRUHEH[HEH5ѩH,HHEHEH-u*HEHzHEHUHEHH5[ZHEHnt-HEH)HHEHHoEHEH5vHǸ RUHEHHZUHH`H}HuHEH@HEHEHE8HHEHEHEHHMHEHHWYHEHEHuHXHQHXH=pHEHEHEHHMHEHHPHEHEHuHXHUQ-HXHl=HEHEHEHHMHEHHHEHEHuHXHPHXH =HEHEHEHHMHEHH4KHEHEHuHXHPkHXHHEH@HLE}t} uHEH@H-HEUHHPHHHHHHEHu.HH5@HH+HHiHHH5HǸ*HH5H(HHHuUHH5~HVHHHHtPHƄ Ћ9uqHtgHHH5g~H"HHHuUHH5>~HHHHHt PHHHHHHHIHH5HEHHCEHtHHy}t/UHH9UHH5U}HUHHEEUHH@H}HuHUHMLEEH}t1HE8u!HuHEH|HEHuHEH|HE}tEHMHUHuHEH:UHH H}uH|HE}uHEH[EuE%EE~eH.|HEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH UHEH UHEH2UHEH2EmE;E|UHH H}uUEUHEHEHEHi+EE}yEE}E;E}zHEHrH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEH'rHUHEHEHUHEHHSHEHUHEH$UHH H}HuHUHEHHfH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEH,HEH+EHUHH0H}uHU؋MHEHFqHLUHEHcEEHE}tU} }tEHEH5pHIUHEH 3UHEHutHEH5pHHEH5pHMHEHspHtHEHzE}uHEHDUHEHHEUHEH|HHUHEH5oHǸ=}tCHEH./HEH"-uHEH5oHǸVHUHEHUHH H}HuHUMHEH oHHEH|oH.HUHEHHEH?HEH*HMHEHH7HUHEHH HEHHEH_HEHHUHEH)}t&HEHHUHEHHEH<-UHH}]UHH H}HuHUHUHEHHtAHUHEHH< HEHHEHmHnHEH5mH HEHHEHHEH5mH HEHvHUHEHH HEHMHEH<uHEHHEHHT HEHHEHHHEHH5HEH<_uHEHHEHEHH{HEHHEH3(UHH0H}HEؾHC;HEH5lHHEغHBHEؾH/HEؾH0HEؾHHEH5%lH#HEغHHEؾH,/HEؾHHEؾH(t|HEؾHU HHEHHk HǸ%HEغH\HHUHEHHH5jHǸwAHEH5VkHFHEغHHEHTUHH H}HuHUHUHEHTHEHHUHEHHHEHHEHI+HEHhHEH%UHHH}uUHEHDt%HEHH‹MHEH:0UHEHUHH`H}HuUUHMHEHH^/HEH}u9HUHEHHj-HǸ#HUMHEHHEUHH`H}HuUUHMHEHHHEH}u9HUHEHHi-HǸL#HUMHEHHEUHH H}HuUHUHEHyHEH}ymUHEH .UHH H}HuUUHEHfu HUHEHHHEH_HEH>HEHMHEHHHUHEH5gHǸHEHUMHEHUHH }HuHUH}t3HEHUHMEHΉHEu EHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHtbHEH"HUHuHEH fH#t HEHHEHYHUHEHEЉHEHOUMHEHUHHH}u}x}~HEH5bgHǸeHEHngH}uHEH*EHEHHEHHEAH5 fHUHH0H}uUME}t)}t<}UMHEH$UMHEHHEHfHUHEHEUHEHEUHEHUHEHHEAH5=fHHEHEHEHEHEH5 fHǸUHH H}uUUHEHEHEHeHUHEHUHEH"UHHH}uUHEHtUUHEHHxH*HHH H*XHEHMHEHGeHUHEHHxH*HHH H*XHEHaZMHEHdHuAUHEHHEHRHHEH5dHǸ'UHH0H}uHU؋UHEHYEHUHEHHUHEH#HEH2HEH!UHH0H}uHU؋UHEHEHEHcHHUHEHHmHEHUHEHUHH0H}uHU؋UHEHfH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEH>uIH}tHUHEH5cHǸg$HEH5 cHEHEHUHH0H}uHU؋UHEHyEHEH bHJHUHEHH|HEH6UHEH#HEH$HEHuwHEHHEH0HUHEHHHEHHEHUHEH%UHH H}uHEEHEH aH3UHEH~HUHEHHEHEHEuHEH5caHǸHEUHH0H}HuU܋E܍HHEHLaHHEHHEHHHEHEEЉHEHEE;E|HEHHUHEHH'+E܉HEHHEHEHHcEЉHEHUHHH}HuHEH_HHUHEHSHEHHEH"UHH0H}uHU؋UHEH:HEHEH_HIH}tUHEHuiEHUHEHHEHHEHEHEH}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhHut EEEEE;E|EUHHH}uU}tHEHt HEH,HEHMHEHWtHEHBEPMHEHQtRHEHL#HEH5]HHEHHEHB/HEHHEHUHH H}HuHEHEHUHEH5h]HdHEHEHHEHjt/EPHEHcHEHUHEHUHHH}HuHEH@t%HEHPHEH5\HǸPHEH@HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH5THH*HHiHHH5THǸHH5THHHHuUHH5mTHVHHHHtPHƄ Ћ9uqHtgHHH5SHyHHHuUHH5SHHHHHt PHHH HHHHIHH5HEHH EHtHH}t/UHH6 UHH5RHUHHGEUHH@H}HuHUHMLEEH}t1HE8u!HuHEH>RHEHuHEH$RHE}tEHMHUHuHEHU UHH H}uHRHE}uHEH[EuE%EE~eHQHEHEPHǸYHEH0 HUHHHEHEH HEH HEHHvHEH HUHH9tHEH0 H& HEHUH HEHUH( HEH HEH HUHH H}HuHUHUHEHH|HHUHEHHHEH HEHHEH UHH H}HEHEH0 HUHHEH}uHEH0 H5NHǸHEH HUHH9tHEH0 HfHUHMHEHHHEH HUHH9tHEH0 HUHHH}HEH HEH HEH0 HH3HEH HUHH9tHEH0 HK UHH H}HuHUH}tHEHMHUHMHHHEHUHH H}uHUUHEHEHUHEHHUHEH* HEHHEHUHH0H}EHEHEH0MH^HEغH54MHHEؾHjHEؾH)HEؾH8HEؾH'HEؾHHEغHGHEغH1HEغH5LHQHEHLH1HEؾH HEؾHHEؾHHEؾH]HEؾH,HEH EHEؾHHEؾH+HEؾHHEH}dHEؾHHEؾH)HE}t|HEHHEHHEؾHHEؾHHEؾHJHEؾHHEؾHXHEHEؾH HEؾHHEؾH(HEؾHHEH}tHEHHEHHEHHEؾHeHEHHEؾHHEؾHHEؾH&HEUHH H}uUHEHpuOUHEHfH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHoUHEH^UHEH UHEHEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEHNHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHGHUHEHEHUHEHHHEH UHEHXUHH H}HuHUHEHHrfH~HEHEH9Etj HEHHEHEt'aHHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHFHUHEHھEEHE}tU} }tEHEH5{FHIUHEH3UHEHtHEH57FHHEH5FHMHEH FHtHEHE}uHEH軺UHEHXHEUHEHHHUHEH5EHǸ}tCHEH=/HEHuHEH5REHǸHUHEHUHH H}HuHUMHEHDHHEHEH.HUHEHGHEH趼HEH-HMHEHH5 HUHEHHHEHLHEHHEHEHUHEH}t&HEHHUHEHtHEHUHH0H}HEHHEHEؾHt9HEغH{HEHEHHEuH߽GHEؾHt2HUHEؾH#HEHEHMHEHHH}t5HEؾHNHHEHHEغH5&CH̶ HEHUHH@H}HEȺHHHEHUHEȾHjHHEHEHEHMHUHuHEHE}HEHt5HEȾHHHEHHEȺH5]BH HEHEHEHt5HEȾH;HHEHHEȺH5BH蹵 HEHE}UHEȉHEUHH H}HEH5AHHHEHEHлEUHEH,UHH H}HHEH}t5HEHUHHEHHEH5-AHӴ HEHUHH H}HEHEHEHxEUE։HEH}t5HEHHHEHHEH5@H8 HEHzUHH H}HEH&EHEHݽEUE։{HEH}t5HEHHHEHHEH5?H蝳 HEHUHH H}HEHEHEHBEUE։HEH}t5HEHHHEHHEH5\?H HEHDUHH0H}HEغHHEHEعH>HHEHUHEHHHEH}tHH}t5HEؾHHHEHHEغH5>HN HEHH}uHEؾH(UHH H}HEH HEHEH-HEH}t5HEH1HHEHHEH5 >H诱 HEHUHH0H}HEEEHEؾHt/HEغHMHEHEHMHEGHEؾHCHHEHEH\=H葳HEؾHHEؾHt2HEغHűHHEHѺdH)HEؾH8HEH<HHEؾHHEؾHnt2HEغHDHHEHѺdH訶HEؾHHxHEEHEؾHtHEؾHvEE}tHEeH-E}uJH}t5HEؾHHHEHHEغH5;HZHEH HEH}tUHE؉H'EUHHpH}HEH *HEHEE}EHHA;HH5;HH+HEg HHEQHEHHEHUHEH]HEHUHEHDHEHEH_EHHE}HMHUHuHEAHHEHHEYHQHEHUHEHѺoH@EpHEH5:H#HHEHEHfE.HHEEHcHMHEmH׳EE}uVH}tOH}t5HEHvHHEHHEH5N9H HEH6$H}t HEH輺UHEHUHH0H}HEغH58H%HHEHE HHcHEؾHOEHEE}~EEEHH HEUHMHEHHE}~"EHcHMHEHHE^HEHt!HMHEغHHcE(HEHEHcHEHHEHEHNEUHH0H}HEغH57HHHEHE HñHcHEؾHEE}~EEEHHHEUHMHEHHE}~"EHcHMHEHHaEoHEHt2HEH5O6HHEغH肫E(HEHEHcHEHHHEHEHEUHH@H}HEȺH5f6H蜭HHEHEHUHEȾHHEEHEHHEȾH赳EUHMHEHHLE}~EHcHEHHEWHEHtHEȾH_E(HEHEHcHEHH5EEUHH0H}HEغH5_5H蕬HHEHEغHHEEHUHEHHjE}~EHcHEHHEWHEHtHEؾH}E(HEHEHcHEHHSEEUHH H}HEH5}4H賫HHEHE H葮EEHcHEHHUHH H}HEH54HNHHEH}uQHEHHE}tHEHs HEHHEH4HUHH H}HEH53HªHHEHEH?HHEHHMHEHUHH H}HEH5&3H\HHEHEHdEEHcHEfH%EUHEHUHH H}HEH52HHHEHEHE}t{HEH HEHXHEHHEH7HEHHEHHEHHEHUHH H}HEH51HHHEHEHUHH H}HEH51HƨHHEHEH5q1H觨HHEHUHEHHHEH}tHEH HEH#UHH H}HEH51H8HHEHEH5HEH}uHEHTHEHH}t5HEHHHEHHEH50H6 HEHxUHH0H}HEغH5W0H荧HHEHUHEHѺsHiE}uHEHHEHHHEHHZ}tUHE؉HUHH0H}HEغH5/HHHEHEHƵHEEH}HUHEHѺpH賩H}t5HEؾHkHHEHHEغH5C/H HEH+HEHHEHt5HEؾHHHEHHEغH5'/H蓢 HEHտEEUHH H}HEH5.HHHEHEHHEH}tTH}t5HEHHHEHHEH5W.H HEH?HEHH}UHH H}HEH5 .HBHHEHEqH HEH`UHH0H}HEغH5-HHHEHEؾH]tHEؾH׮EHEeH蒧E}ue}u_HEHHEH}t5HEؾH+HHEHHEغH5-H詠 HEHUHE؉HUHH H}HEH5,HHHEHEH %uHEH,H詩HEHڽ%tHEH0HEH跽%tHEHcHEHUHH0H}HEغH5+H'HHEHEHUHEHѺnHE}uiHEHt5HEؾHHHEHHEغH5+H& HEHhHEHHUHEHH}tUHE؉HEUHH H}HEH5+HGHHEHEeH%EUHEHUHH H}HEH5*HHHEHEeHɤEUHEH%UHH H}HEH5Y*H菡HHEHEH謻EE%uHEH*HEHEHѡt/HEHEUHEѺhHHEiHH*HEHUHH0H}HEغH5)H趠HHEHEHӺEE%uHEH)HlHEؾHEEHcHEHIE}yUHE؉HEHcHEHH舷UHH H}HEH5(HHHEHEH EE%uHEH)H裥HEH蕢E}yUHEHEHcHEHHԶUHH H}HEH5(H9HHEHE HEHE HEEHcHEHHQEHcHEHH<UHHH}HEH*H5i'H迴HEHiHEH5*H HEHеHEH(HXHEH觵HEHe(H/UHH }HuHUH}t3HEHUHMEHΉ2HEu E HEUHHH}u}y}|HEH+EEUHH H}HuHUMDEHUHEHHEHߝtbHEHYHUHuHEH 'H.t HEHHEH蝷HUHEHEЉHEH蓯UMHEHUHHH}u}x}~HEH5(HǸHEH(H}uHEH*EHEHIHEHHEAH5&HUHH0H}uUME}t)}t<}UMHEHUMHEHäHEH7'HUHEHEUHEHEUHEHUHEHHEAH5&HHEH8EHEH$EHEH5&HǸUHH H}uUUHEHEHEHC&HUHEH1UHEHUHHH}uUHEHtUUHEHUHxH*HHH H*XHEHMHEH%HKUHEHHxH*HHH H*XHEH襛ZMHEH%HuAUHEHHEH薶HHEH5X%HǸkUHH0H}uHU؋UHEHYEHUHEHH8UHEHgHEHvHEHeUHH0H}uHU؋UHEHEHEH5$HHUHEHHHEH0UHEHߴUHH0H}uHU؋UHEHXfH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEHuIH}tHUHEH5#HǸ諽$HEH5#HEHEHEUHH0H}uHU؋UHEHyEHEH"HJHUHEHHHEHzUHEHHEHhHEHWuwHEHHEHtHUHEHH1HEHHEHUHEHiUHH H}uHEEHEH!H3UHEH~HUHEHHEHEHEuHEH5"HǸһHEUHH0H}HuU܋E܍HHEH!HHEHHEHHHEH͒EEЉHEHϯEE;E|HEHHUHEHHI+E܉HEHHEHEHHcEЉHEHUHHH}HuHEH= HHUHEH藓HEHHEH5UHH0H}uHU؋UHEH~HEHEHHIH}tUHEHZuiEHUHEHHEHbHEHܣEHEH}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhH蹔t EEEEE;E|EUHHH}uU}tHEH[t HEHpHEH*MHEH蛢tHEHEPMHEHQtRHEHHEH5HHEHǤHEH/HEHHEH UHH H}HuHEH2EHUHEH5 HHEHEHHEHjt/EPHEHcHEHRUHEH:UHHH}HuHEH@t%HEHPHEH5_HǸ蔿HEH@HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH5{HHA*HHiHHH5RHǸӶHH5;HʹHHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5H轮HHHuUHH5yHHHHHt PHHHOHHHHIHH5HEHHPEHtHH4}t/UHHzUHH5HUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEHUHH H}uHHE}uHEH[EuE%EE~eHiHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH賖UHEH袖UHEHQUHEH@EmE;E|UHH H}uUEUHEHEHEH$+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHbHUHEHEHUHEHHHEHMUHEH蜱UHH H}HuHUHEHH趕fH~HEHEH9Etj HEHHEHEt'襢HHEHH% uHEuEHEH{HEH+EHUHH0H}uHU؋MHEHHUHEHzEEHE}tU} }tEHEH5HIUHEHƓ3UHEH0tHEH5HHEH5HMHEHHڟtHEH5yE}uHEHuUHEH蜕HEUHEH7HHUHEH56HǸ}tCHEH聻/HEHݹuHEH5HǸHUHEHYuUHH H}HuHUMHEHEHHEHH.HUHEHvHEHwHEHqHMHEHHyHUHEHH֗HEHtHEHHEH艑HUHEH}t&HEH]HUHEH踀HEHUHH H}HEHwtHEH聀EHEH!}t H*H H8*HHEHHοa|UHH H}HEHHEH}t5HEH蜔HHEHHEH5Hr HEH\UHHH8H8HzHEHEHUH8H趃HEHEHUH8HѺH躋HEHEHUH8HѺH莋HEH8HfutH8H~EH8H/u~ H8H5HtHHE草HEEEHEHDžPHDžXHDž`HDžhHDžpHDžxHEHEHDž@HDžHEH}t/HE@H@HGHEHUHMHPHH.HEHt6H}t/HEHHGHEHUHMH@HHHEHt H@HPHUHuHEIHE}UHEH|E}HEH蓿HcHEHк_H51HջHEHEHMHUHuHEAHPpE}uREEEHcHEH HUHEHHpE}u"EEEHcHMH8HH9HEkH5H轈HEH}tUH8H藠EUHHH8H8HHEHEHUH8HAHEHEHUH8HѺHEHEHEHUH8HѺHHEH8HqtH8Hh{EH8Hq~ H8H5HH qHHEHEEEHEHDžPHDžXHDž`HDžhHDžpHDžxHEHEHDž@HDžHH}t/HE@H@HGHEHUHMHPHHHEHt6H}t/HEHHGHEHUHMH@HH聍HEHt H@H}t HPHUHuH}IHoE}UHEHE}HEH5HkHEHEHMHUHuHEAHE}ubEEHE‹E)‰ЉEEHcHEH HUHEHHwE}u"EEEHcHMH8HHHEH5HCHEH藗}tUH8HEUHHH(H(H苙HEH(HxEHEHUH(H|HEHEHUH(H|HEHEHUH(HѺH萄HEH(HhntH(HwEH(H1n~ H(H5HmHHE菂HEEEHDž@HDžHHDžPHDžXHDž`HDžhHDžpHDžxHDž0HDž8H}t/HE@H@HGHEHUHMH@HH9HEHt6H}t/HEHHGHEHUHMH0HHHEHt H0DEH@HUHuHEEIHΑE}UHEH耚E}HE EEHH5<HHEHEHMHUHuHEAHiE}ueEEHE‹E)‰Ѓ EEHcHEH HUHEHHXE}u"EEEHcHMH(HH1HEH5H赁HEH }tUH(H菙EUHHHXHXHHEHXHtEHEHUHXHѺHJHEHEHUHXHѺHHEHXHjtHXHmtEHXHj~ HXH5MHjHHEHEHDžpHDžxHEHEHEHEHEHEHDž`HDžhH}t/HE@H@HGHEHUHMHpHHHEHt6H}t/HEHHGHEHUHMH`HH詆D~HEHEHt H`H}t HpDEHUHuH}EIHfuHXH5HǸ׎UHEȉHH}t;HXH[HHEHHXH5HdHXHHXHHUHXHVUHHHhHhHHEHEHUHhHѺHk~HEHEHUHhHѺH?~HEHhHh~ HhH5HhgHHEHEHEHEHEHEHEHEHEHEHDžpHDžxH}t,HEȺ@H@HGHEHUHMHEHHIHEHt6H}t/HEHHGHEHUHMHpHH {HEHEHt HpH}tHEHUHuH}IHxEԃ}H}t;HhHHHEHHhH5HdbHhHHhH?}HUHhH HEHtUHhHUHHHhHhHsHEHEHUHhHѺH{HEHEHUHhHѺH{HEHhHe~ HhH5HdHHEHEHEHEHEHEHEHEHEHEHDžpHDžxH}t,HEȺ@H@HGHEHUHMHEHH赁HEHt6H}t/HEHHGHEHUHMHpHHvyHEHEHt HpH}tHEHUHuH}IHcEԃ}H}t;HhHUHHEHHhH5H_HhH}HhHzHUHhHP HEHUHhHlUHH0H}HEغH5HbHHEHEغH虘EHEH֛HHEHHDHEغH_MHEHHvlEHEH胠HcHEHHyMHEHH9lEHEH趐HcHEHHtyMHEHHkEHEHiHcHEHH7yMHEHxHkEHEH\}HHEHHxMHEHEHkEHEHoHcHEHHxMHEHHEkUHHHhHhH5+HaHHEHUHhHRoHEHUHhHѺH^wHEHhHHߚHEH}tZHEHwPHhH5RHǸ*HhH]HHhH*fHEAHMHUHuHEHpWH}WAH}HE܃}~THEH菎HcHMHhHHHEHZHcHpHhHHUHhHUHHHhHhH5Hd_HHEEHEHUHhHmHEHEHUHhHѺHuHEHhHiEHUHhHHhHEHhHǞHEHEHEHEHEHEHEHEHDžpHDžxH}t,HEȺ@H@HGHEHUHMHEHH{HEHt6H}t/HEHHGHEHUHMHpHH_{E}uPHEHt HpH}tHEMH}AIHE}uGHEHt HpH}tHEH}IHnEh}uGHEHt HpH}tHEH}IH\EHhH5HǸUHhH)UHHPH}HEH5(H\HHEHEH ]E}t }tHEHhHDbHUHEHjHEHEȃ EċEHH5aHHEHUHEHHEHEHEHE}u&HEȉHMHUHuHEAHtYEp}u&HEȉHMHUHuHEAHYED}u&HEȉHMHUHuHEAHoEHEH55HǸO}uEHcHMHEHHUHEHmEHEغH5.HRqEUHH`H}HEH5NHZHHEE EHUHEHMHEHE}uHUHMHEHH)E\}uHUHMHEHHE:}uHUHMHEHHbEHEH5HǸHEH}u EHcHMHEHHUHEH UHH@H}HEȺH5HYHHEHEHWVHEHEȺH=EHEHڥHcHEHHpMHEHH0cEHEH=yHcHEHHkpMHEHHbEHEH eHcHEHH.pMHEHoHbEHEHStHHEHHoMHEH<HybEHEHHcHEHHoMHEHVH*EHH4CUHH H}HuHUMH}tBHEHEHIHu%HMHUHEH5HǸoEUHH0H}HuHUHEHEHE@t$HE@HEHP HEHHEH@HEHHUHrHUHMHUHH`H}HuHUHMLEEHEHEEHEHEHEHEHEHEHEHP HuHMHEHHEHEHt:HEHt1HE8u!HuHEȹHH{EHuHEȹHHZE}tEHMHUHEH5HN^UHH0H}HuHUHEHEHE~HEHcHEHHEGHEH@Hzt4HEH@HUHzH-yHHEHHEHUHH0HHH@HH.:HHΉHEHH;HHEHuHMHHIH5HǸlHHjUHH H}HwHEHEHEH@HAE}tHEHPHU9EtECHEHHU UHUHLHEuHEHEH@H@UHH H}HuHEHIHEHEE}#u>HEH@HU@E}t} uHEH@H6@HEUHHPHHHHHQTEHu.HH5)HHF*HHiHHH5HǸ!kHH5HiHHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5PH cHHHuUHH5'HHHHHt PHHH8HHHHIHH5HEHH螄EHtHH_}t/UHHzUHH5>HUHHنEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHvHE}tEHMHUHuHEH{UHH H}uHkHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHKUHEHJUHEHsUHEHsEmE;E|UHH H}uUEUHEHEHEHrG+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHH\FHEHAUHEHeUHH H}HuHUHEHHJfH~HEHEH9Etj HEHHEHEt'VHHEHH% uHEuEHEH50HEH+EHUHH0H}uHU؋MHEH/HU7UHEHl.EEHE}tU} }tEHEH5HIUHEHH3UHEH~7tHEH5HHEH5qHMHEH\H(TtHEH-E}uHEHM*UHEHIHEUHEH]HHUHEH5HǸF[}tCHEHo/HEH+nuHEH5HǸ_RHUHEH)UHH H}HuHUMHEHHHEHeH.HUHEH*HEHH,HEHkHMHEHHxHUHEHH$LHEH(HEHh^HEHEHUHEH25}t&HEHEHUHEH5HEHEnUHH}HE]UHH0H}HEؾHmHEHEH4*HHH!KEHEEHE}uHEHEbtE}uHEH4HED}u!HEH6HE}uHUHEHHESHEHEHPH}H}t5HEؾHHHHEHHEغH5H& HEHRCEHEHtQHEHt5HEؾH8HHHEHHEغH5H% HEHBEEUHH@H}HEȺH5dH)HHEHEȾH)~HEȾHkHEHEȺH/EHEH2*HHH%IEEFHHnjHE؃}uMHUHuHEH )EB}uMHUHuHEH IE }uMHUHuHEH9(E}u;HUHEHѺsH*HEHHEHHHEHH[H}t HEHNH}t HEHN}tUHEȉHVUHH H}^@HEEH}tOH}t5HEH$FHHEHHEH5H# HEH@EEUHH0H}HEؾHiHEHEغHA-EEUHEH&HEHEHMH}tOH}t5HEؾHgEHHEHHEغH5ѽH" HEH'@EEUHH@H}HEȾHiHEEEEHHEHEHUHEHHrHFEHEȺH:,EEHHHf*EUMHEH YHEHEHLH}tQH}t5HEȾHJDHHEHHEȺH5H! HEH ?EHEȾHSEEUHH@H}HEȺH5`H%HHEHEȾH|%~HEȾHgHEHEȺH+EnDHfHEMHUHuHEH6E܃}u;HUHEHѺsHe'HEHHEHHHEHHHEH+KHEHK}tUHEȉHRUHSHXH}HEH5iH#HHEHEH5WH#HHEHEHfHEHEHnjHEHEH)EE}HMHUHuHEAHHR HEHHHHEHEȺH%E}1HSHEUHMHEHHKE}u=HUHEHѺsHuHEHHEHHHEHHUHEȉH?EHEH%8EUHH0H}HEغH5hH HHEHEؾHSHEHEغH:EUHuHEѺH= EHEH7UHE؉H ?UHSHHH}HEHEy[HEH}EHEHnH‹EHAHEHEAIHEH}T/HEH}HEH=HHEHEuHEH51HǸ$HEUHH0H}HuU܋E܍HHEHHHEHHEHHHEHEEЉHEHEE;E|HEHHUHEHH3K+E܉HEH4HEHEHHcEЉHEH=UHHH}HuHEHgHHUHEHHEHHEHGUHH0H}uHU؋UHEHh6HEHEHHIH}tUHEHDuiEHUHEHHEHLHEH EHEH<}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhHt EEEEE;E|EUHHH}uU}tHEHEt HEHZHEHMHEH tHEHp;EPMHEHQtRHEHzGHEH5ĖHHEH HEHp:/HEH:HEH=UHH H}HuHEHEHUHEH56H*HEHEHHEHjt/EPHEHcHEH<:UHEH$:UHHH}HuHEH@t%HEHPHEH5HǸ~(HEH@HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH5HH+)HHiHHH5|HǸHH5eHHHHuUHH5;HVHHHHtPHƄ Ћ9uqHtgHHH5̌HHHHuUHH5HHHHHt PHHH9HHHHIHH5HEHH:9EHtHH}t/UHHd/UHH5HUHHu;EUHH@H}HuHUHMLEEH}t1HE8u!HuHEH HEHuHEHHE}tEHMHUHuHEH0UHH H}uHHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHUHEHUHEH;(UHEH*(EmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHHHEH7UHEHUHH H}HuHUHEHHfH~HEHEH9Etj HEHHEHEt' HHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHHUHEHEEHE}tU} }tEHEH5IHIUHEH3UHEHtHEH5HHEH5~HMHEH~HtHEHE}uHEHUHEHHEUHEH!HHUHEH5`~HǸ}tCHEHk$/HEH"uHEH5 ~HǸHUHEHCUHH H}HuHUMHEHo}HHEH}H.HUHEHuHEHHEH[ HMHEHHc-HUHEHHHEHzHEHHEHsHUHEH}t&HEHGHUHEHHEH"UHH H}HEH5|HZHHEHEH*UHHpH}HEHEHEHEHEHEH5^|HHHEHEHHEHHcHEHH)HEH|HHEHHcHEHHHEH{H{HMHUHuHEHsHUHMHEHHHEHtpHEH7HEH}t5HEHHHEHHEH5h{HY HEHHEHR{HHEHtpHEHHEH}t5HEHbHHEHHEH5zH HEH"HEHzHZHEHtpHEHEHEH}t5HEHHHEHHEH5vzHg HEHHEHdzHHEHtpHEHHEH}t5HEHpHHEHHEH5yH HEH0HEHyHhHEHtpHEHSHEH}t5HEHHHEHHEH5yHu HEHHEH|yHUHH0H}HEغH5yHHHEEEHEؾH.t;HEغH5xHrHHEHUHMHEHH$EHUHEHHEUHE؉Hx EHcHEHHUHH0H}HEغHJEHEغH1EHEؾHM~HEغH5BxHHHEEH}tHEHHEUuHEHE}uOH}t5HEؾHHHEHHEغH5~wH HEHHEHC%UHE؉HRUHH0H}HEغH5&wHHHEHEH HEHEHYE}uOH}t5HEؾHHHHEHHEغH5vH HEHHEH$UHE؉HUHH H}HEH'EHEHEEHEH}Et4HEH5lwHEPUHM¾HEt4HEH5EwHQEPUHM¾HKEHEH5wHEPUHM¾H Et4HEH5vHEPUHM¾HEt4HEH5kvHEPUHM¾HEt4HEH5vHPEPUHM¾HJEt4HEH5^vHEPUHM¾H Et4HEH57vHEPUHM¾HE t4HEH5 vHEPUHM¾HE@t4HEH5uHXEPUHM¾HRUHHH}HEH*H5sHEHEH HEH5*HaHEH*H_UHH }HuHUH}t3HEHUHMEHΉHEu EHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHtbHEHHUHuHEH tHt HEHHEH]HUHEHEЉHEHSUMHEHUHHH}u}x}~HEH5uHǸiHEHuH}uHEH*EHEH HEHHEAH5sHUHH0H}uUME}t)}t<}UMHEHUMHEHHEH7tHUHEHEUHEHEUHEHUHEHHEAH5sHHEHEHEHEHEH5sHǸUHH H}uUUHEHEHEHCsHUHEHUHEHUHHH}uUHEHtUUHEHHxH*HHH H*XHEHMHEHrH UHEHHxH*HHH H*XHEHeZMHEHrHuAUHEHHEHVHHEH5XrHǸ+UHH0H}uHU؋UHEHYEHUHEHHUHEH'HEH6HEH%UHH0H}uHU؋UHEHEHEH5qHHUHEHHqHEHUHEHUHH0H}uHU؋UHEHfH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEHBuIH}tHUHEH5pHǸk$HEH5pHEHEHUHH0H}uHU؋UHEHyEHEHoHJHUHEHHHEH:UHEHHEH(HEHuwHEHHEH4HUHEHHHEHHEHUHEH)UHH H}uHEEHEHnH3UHEH~HUHEHHEHEH EuHEH5oHǸHEUHH0H}HuU܋E܍HHEHnHHEHHEHHHEHEEЉHEHEE;E|HEHHUHEHH +E܉HEHHEHEHHcEЉHEH UHHH}HuHEH=mHHUHEHWHEHHEHUHH0H}uHU؋UHEH>HEHEHlHIH}tUHEHuiEHUHEHHEH"HEHEHEH }uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhHyt EEEEE;E|EUHHH}uU}tHEHt HEH0HEHMHEH[tHEHF EPMHEHQtRHEHPHEH5kHHEHHEHF /HEH HEH UHH H}HuHEHEHUHEH5 kHhHEHEHHEHjt/EPHEHcHEH UHEHUHHH}HuHEH@t%HEHPHEH5_jHǸTHEH@HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH5{bHH)HHiHHH5RbHǸHH5;bHHHHuUHH5bHVHHHHtPHƄ Ћ9uqHtgHHH5aH}HHHuUHH5yaHHHHHt PHHHHHHHIHH5HEHHEHtHH}t/UHH:UHH5`HUHHK EUHH@H}HuHUHMLEEH}t1HE8u!HuHEH_HEHuHEH_HE}tEHMHUHuHEHYUHH H}uH_HE}uHEH[EuE%EE~eHi_HEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHsUHEHbUHEHUHEHEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEHUH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHbUHUHEHEHUHEHHHEH UHEH\UHH H}HuHUHEHHvfH~HEHEH9Etj HEHHEHEt'eHHEHH% uHEuEHEH觳HEH+EHUHH0H}uHU؋MHEHTHǺUHEHޱEEHE}tU} }tEHEH5THIUHEH3UHEHtHEH5SHHEH5SHMHEHSHtHEHE}uHEH迭UHEH\HEUHEHHHUHEH56SHǸ}tCHEHA/HEHuHEH5RHǸHUHEHUHH H}HuHUMHEHERHHEHRH.HUHEHKHEH躯HEH1HMHEHH9HUHEHHHEHPHEHHEHIHUHEH褸}t&HEHHUHEHxHEHUHH H}HEHǮtHEHAEHEH}t H)H H)HHEHHο!UHH H}HEHHEH}t5HEH\HHEHHEH5PHک HEHUHH0H}HEغHsHEEHEؾH觭~HEغH5xPHHHExHEH}HEHHUHEHHHUHEؾHHUHMHEHHE}uJH}t5HEؾH=HHEHHEغH5OH軨.HEH HEHUHE؉HEEUHHHE@HH$HEHUHH8HEHH@tHH践EHH ~ HH5NHZHHEHuLEH}HMHUHEMIH覿E܃}uo}tEHMHHHLEHHEHHHHHwHH.}tUHHUHH@H}HEȾHtHEȺHHEHEȺH5MH1HHEHEH~HEȺH5~MHHHE~HEEH}HEHHuHMHUHEIHHRHHEHUHEȾH覩HEHEHuHMHUHEIHږE}uHEк_H5>HHEH}HMHUHuHEIH薖E}uHUHMHEHHHEeH5>HHEH}tUHEȉHUHH@H}HEȺH5=H>HHEHUHEȾH蒨HEHUHEȾHyHEH}HUHMHuHEIH覚EHEH}yUHEȉH0UHEȉHEUHHH}HEH)H5<H袯HEH)H5<H舯HEH2HEH5ҕ)HUHH }HuHUH}t3HEHUHMEHΉMHEu E(HEUHHH}u}y}|HEHFEEUHH H}HuHUMDEHUHEHHEHtbHEHtHUHuHEH <HIt HEH HEH踲HUHEHEЉHEH讪UMHEHUHHH}u}x}~HEH5A=HǸĽHEHM=H}uHEH*EHEHdHEHHEAH5;HUHH0H}uUME}t)}t<}UMHEH7UMHEHޟHEHr<HUHEHEUHEHEUHEHUHEHHEAH5<HHEHSEHEH?EHEH5;HǸ"UHH H}uUUHEHEHEH~;HUHEHLUHEHUHHH}uUHEHtUUHEHpHxH*HHH H*XHEH#MHEH&;HfUHEH HxH*HHH H*XHEHZMHEH:HuAUHEH!HEH豱HHEH5:HǸ膺UHH0H}uHU؋UHEHYEHUHEHHSUHEH肷HEH葔HEH耔UHH0H}uHU؋UHEHEHEHp9HHUHEHHHEHKUHEHUHH0H}uHU؋UHEHsfH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEHuIH}tHUHEH58HǸƸ$HEH58HEHEH`UHH0H}uHU؋UHEHyEHEH7HJHUHEHH۲HEH蕏UHEHHEH胒HEHruwHEHHEHHUHEHHLHEHHEHUHEHUHH H}uHEEHEH6H3UHEH~HUHEHHEHEH EuHEH5B7HǸHEUHH0H}HuU܋E܍HHEH+7HHEHHEHH.HEHEEЉHEHEE;E|HEHHUHEHHd+E܉HEH,HEHEHHcEЉHEHUHHH}HuHEHx5HHUHEH貎HEH!HEHPUHH0H}uHU؋UHEHHEHEH4HIH}tUHEHuuiEHUHEHHEH}HEHEHEH}uHEHEUHHHhEE EEeHpMHhH uDUEЉEHpMHhHԏt EEEEE;E|EUHHH}uU}tHEHvt HEH苧HEHEMHEH趝tHEHEPMHEHQtRHEHHEH53HHEHHEH/HEHHEH(UHH H}HuHEHMEHUHEH5G3HüHEH2EHHEHjt/EPHEHcHEHmUHEHUUHHH}HuHEH@t%HEHPHEH52HǸ诺HEH@HEH@H"E}t} uHEH@HHEUHHPHHHHHEHu.HH5*HH\)HHiHHH5*HǸHH5v*HHHHuUHH5L*HVHHHHtPHƄ Ћ9uqHtgHHH5)HةHHHuUHH5)HHHHHt PHHHjHHHHIHH5HEHHkEHtHHO}t/UHHUHH5(HUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEH(HEHuHEH(HE}tEHMHUHuHEHUHH H}uH'HE}uHEH[EuE%EE~eH'HEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHΑUHEH轑UHEHlUHEH[EmE;E|UHH H}uUEUHEHEHEH?+EE}yEE}E;E}zHEH-H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHH)HEHhUHEH跬UHH H}HuHUHEHHѐfH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEHwHEH+EHUHH0H}uHU؋MHEHH"~UHEH9uEEHE}tU} }tEHEH5ZHIUHEH3UHEHK~tHEH5HHEH5HMHEHHtHEHPtE}uHEHqUHEH跐HEUHEHRHHUHEH5qHǸ}tCHEH蜶/HEHuHEH51HǸ,HUHEHtpUHH H}HuHUMHEHHHEHH.HUHEHqHEHsHEH茲HMHEHH蔿HUHEHHHEHoHEH5HEH褌HUHEH{}t&HEHxHUHEH{HEHUHH H}HEH5HqHHEHEHxUHHpH}HEHEHEHEHEHEH5oH%qHHEHEHHEH\HcHEHHZHEH-HzHMHUHuHEH*HUHMHEHHSHEHtpHEH螗HEH}t5HEHBHHEHHEH5Hl HEHHEHH:zHEHtpHEH%HEH}t5HEHɎHHEHHEH52HGl HEH艉HEHHyHEHtpHEH謖HEH}t5HEHPHHEHHEH5Hk HEHHEHHHyHEHtpHEH3HEH}t5HEH׍HHEHHEH5@HUk HEH藈HEH0HxHEHtpHEH躕HEH}t5HEH^HHEHHEH5Hj HEHHEHHVxUHH0H}HEغH5eHnHHEHEغH5yHmHHEHEHHEH}t)HUHEHHmEUHE؉H'UHH@H}HEȺHsEHEHUHEHѺHHEHEȾHm~HEȺH5H3mHHEH}tHEHRo;HEHE؉HUuHEHjAAH,uHE}uHEHlE}uOH}t5HEȾHrHHEHHEȺH5Hh HEH2HEH_UHEȉH辚UHHH}HEH)H5pHFHEHHEH5в)H1UHH }HuHUH}t3HEHUHMEHΉ yHEu ErHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHktbHEH2HUHuHEH Ht HEHzHEHvHUHEHEЉHEHl}UMHEH踝UHHH}u}x}~HEH5HǸ肐HEH+H}uHEHӄ*EHEH"lHEH|HEAH5HUHH0H}uUME}t)}t<}UMHEHUMHEHrHEHPHUHEHEUHEHEUHEHփUHEHŃHEAH5HHEHsEHEHEHEH5HǸUHH H}uUUHEHEHEH\HUHEH UHEH蹫UHHH}uUHEHhtUUHEH.HxH*HHH H*XHEHiMHEHH$qUHEHˈHxH*HHH H*XHEH~iZMHEHHpuAUHEHgHEHoHHEH5qHǸDUHH0H}uHU؋UHEHYEHUHEHHUHEH@HEHOgHEH>gUHH0H}uHU؋UHEHEHEHNHHUHEHH芚HEH yUHEH踂UHH0H}uHU؋UHEH1gfH~HEH}t=ff.Ez ff.EuUHEHڅtHE؉EUHH}]UHH H}uHUEPHEH[uIH}tHUHEH5HǸ脋$HEH5HEHEHuUHH0H}uHU؋UHEHyEHEHHJHUHEHH虅HEHSbUHEH袬HEHAeHEH0euwHEH裤HEHMHUHEHH HEHaHEH~UHEHBUHH H}uHEEHEH H3UHEH~HUHEHHEHEHʣEuHEH5 HǸ諉HEUHH0H}HuU܋E܍HHEH HHEHHEHHHEH`EEЉHEH}EE;E|HEHHUHEHH"+E܉HEHHEHEHHcEЉHEHUHHH}HuHEHV HHUHEHpaHEHbHEHUHH0H}uHU؋UHEHWHEHEH HIH}tUHEH3yuiEHUHEH`HEH;bHEHqEHEH衡}uHEHEUHHHhEE EEeHpMHhHbuDUEЉEHpMHhHbt EEEEE;E|EUHHH}uU}tHEH4at HEHIzHEHaMHEHtptHEH_EPMHEHQtRHEHiHEH5 HHEHrHEH_/HEHןHEHUHH H}HuHEH wEHUHEH5% H聏HEHyEHHEHjt/EPHEHcHEH+UHEHUHHH}HuHEH@t%HEHPHEH5x HǸmHEH@HEH@HYE}t} uHEH@HYHEUHHPHHHHHmEHu.HH5HH`)HHiHHH5kHǸ謄HH5TH覂HHHuUHH5*HVHHHHtPHƄ Ћ9uqHtgHHH5H|HHHuUHH5HHHHHt PHHH(RHHHHIHH5HEHH)EHtHH y}t/UHHSUHH5HUHHdEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEHrUHH H}uHHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHdUHEH{dUHEH*UHEHEmE;E|UHH H}uUEUHEHEHEH`+EE}yEE}E;E}zHEH H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEH{HUHEHEHUHEHH_HEH&[UHEHuUHH H}HuHUHEHHcfH~HEHEH9Etj HEHHEHEt'~pHHEHH% uHEuEHEHIHEH+EHUHH0H}uHU؋MHEHHPUHEHGEEHE}tU} }tEHEH58HIUHEHa3UHEH QtHEH5HHEH5HMHEHHmtHEHGE}uHEHCUHEHucHEUHEHwHHUHEH5OHǸt}tCHEHZ/HEH趇uHEH5HǸkHUHEH2CUHH H}HuHUMHEH^HHEHH.HUHEHdDHEHEHEHJHMHEHHRHUHEHHeHEHiBHEHwHEHb_HUHEHN}t&HEH6_HUHEHNHEHЇUHHPH}HEH5HIDHHEHEH5H*DHHEEHEH[tHEytHEHMHUHuHEAH:HEHbHHEHHEH,HBHEHDHEHIHEH8bHHEHHEHHVBHEHCHEHEHEH5HCHHEHEH5mHBHHEHMHUHuHEAH`E}uHEH58HǸhEEUHH H}HEHrHEH}HEHHEHUHEHHdHEH}t5HEH`HHEHHEH5bHh> HEH[H}t5HEH`HHEHHEH5+H > HEHb[UHSHHxHxH5HfAHHEHEH#HEVHEHxH wH}HUHEHHcHEEH}t;HxH_HHEHHxH5?H4=HxHsZMHxHWHJqHEHUHMHEHHAEH}t;HxH&_HHEHHxH5H<HxHYMHxHHJpHEHUHMHEHHFEH}t;HxH^HHEHHxH5*H<HxHMYMHxHAHIHEHF=HxHHxHHHIEHEHUpHcHxHHVMHxHHIEHEH"JHcHxHH=VMHxHHHHEHHxH2HxHoHHEHEHʼnHHEHvHHxHHH9MHxH'H3HnHEnHEnHEH}HMHUHuHEIH?HxHsEH}t;HxH~\HHEHHxH5H9HxH8WMHxHfHmGEH}t;HxH \HHEHHxH5H9HxHVMHxHHFEH}t;HxH[HHEHHxH5/H9HxHRVMHxHHFHxHnHlFHEHuHĈ[]UHH H}HEH5H4HHEHEHyHEH}t5HEHRHHEHHEH5hH]0 HEHMUHH0H}HEغH5H3HHEHEغH5H3HHEHUHEHH VHEH}t5HEؾH/RHHEHHEغH5H/ HEHLUHH0H}HEغH5nH3HHEHEغH5`H2HHEHEغH5AH2HHEHUHuHEH^EUHE؉HwUHH@H}HEȺH5H_2HHEHEHUHEȾH@HEHEHwHEHMHUHuHEAHYrE}uJH}t5HEȾHPHHEHHEȺH5AH6."HEHxKUHEȉH`EEUHH@H}HEȺH5Hy1HHEHEȺH5HZ1HHEHEȾH1uHEHqsHEHHEUHuHEAAH>HEH}HE^H5HyHEH}HM؋UHuHEAIH=HEH}tHUHMHEHHz HEH1JHEغdH5HFUHH0H}HEغH5H'0HHEHEغH5H0HHEHuHEH;HEH}tJH}t5HEؾHNHHEHHEغH5H,HEHTI HEHFIUHH0H}HEغH5H[/HHEHEغH5HHEHUHMHEHH-HEHMHUHEHebEHEHfP}uUHEHVUHEHLmUHSHXH}HEH5H'HHEHEHUHEH6HEHEHaHEHEH2uEE.H5HVpHEHEHF1HcHEH9tHEH$H"-HEHEHMcHuHMHUHEIIHщHDE}uEHMHEHHUHEH4UEHEȺ8H5H=EHX[]UHHPH}HEH5]H{&HHEHEHUHEH4HEHEHUHEH4HEHEH\`HEHEHHǸ9UHH0H}uHU؋UHEHYEHUHEHHFUHEH 6HEHHEH UHH0H}uHU؋UHEHEHEHHHUHEHHWFHEH$UHEH.UHH0H}uHU؋UHEHfH~HEH}t=ff.Ez ff.EuUHEH1tHE؉EUHH}]UHH H}uHUEPHEH(DuIH}tHUHEH5HǸQ7$HEH5HEHEH UHH0H}uHU؋UHEHyEHEHHJHUHEHHf1HEH UHEHoXHEHHEHuwHEHpPHEHFHUHEHH0HEH HEH*UHEHGUHH H}uHEEHEHH3UHEH~HUHEHHEHEHOEuHEH5HǸx5HEUHH0H}HuU܋E܍HHEHHHEHHEHH/HEHs EEЉHEHu)EE;E|HEHHUHEHH[+E܉HEHEHEHEHHcEЉHEHNUHHH}HuHEH#HHUHEH= HEHHEHWUHH0H}uHU؋UHEH$GHEHEHHIH}tUHEH%uiEHUHEH HEHHEHEHEHnM}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhH_t EEEEE;E|EUHHH}uU}tHEH t HEH&HEH MHEHAtHEH,LEPMHEHQtRHEH6XHEH5HHEHmHEH,K/HEHKHEHNUHH H}HuHEH"EHUHEH5HN;HEH%EHHEHjt/EPHEHcHEHJUHEHJUHHH}HuHEH@t%HEHPHEH5EHǸ:9HEH@HHEHHEHUHH0HHH@HHHHΉHEHH.HHEHuHMHHIH5ܵHǸ92HHOUHH H}HHEHEHEH@HZE}tHEHPHU9EtECHEHHU UHUHLHEuHEHEH@HUHH H}HuHEHIHEHEE}#u>HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH5aHH )HHiHHH58HǸy0HH5!Hs.HHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5Hc(HHHuUHH5_HHHHHt PHHHHHHHIHH5HEHHIEHtHH$}t/UHH @UHH5vHUHH1LEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHȱHEHuHEHHE}tEHMHUHuHEH?AUHH H}uHHE}uHEH[EuE%EE~eHOHEHEUHH H}HuHUH}tHEHyHUHMHHHEHUHH H}uHUUHEHEHUHEHHUHEHBHEHHEHUHH0H}EHEHEHH^HEغH5HHEؾHTHEؾHHEؾH"HEؾHHEؾH9HEغH1/HEغH/HEغH52HQHEH!HHEؾHBHEؾHHEؾHxHEؾHGHEؾHfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHYUHEHHUHEH8UHEH8EmE;E|UHH H}uUEUHEHEHEH +EE}yEE}E;E}zHEHاH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHHUHEHEHUHEHH HEHUHEHB+UHH H}HuHUHEHH\fH~HEHEH9Etj HEHHEHEt'KHHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHgHUHEHEEHE}tU} }tEHEH5HIUHEHl 3UHEHtHEH5HHEH5HMHEHHtHEHE}uHEHUHEHBHEUHEH"HHUHEH5HǸ }tCHEH'5/HEH3uHEH5ܤHǸHUHEHUHH H}HuHUMHEH+HHEHH.HUHEH1HEHHEH1HMHEHH>HUHEHH|HEH6HEH#HEH/ HUHEH}t&HEH HUHEH^HEH3UHSH8H}HEHEȾH1t/HEȺHjHEHEHHEHEȾH`u0HEȾHE܃}t \HEc&HEXHEȺHHHEȾHHEȉH HHEHH5HǸcH}tJH}t5HEȾH HHEHHEȺH5HrHEH HEHH8[]UHH H}HEH5ҢHHHEHEHHEHHEH}tJH}t5HEHD HHEHHEH5nHHEH HEHUHH H}HEH5'H HHEHEH(HEHHEH}tJH}t5HEH HHEHHEH5áHHEHY HEHKUHH H}HEH5|H`HHEHEH-EUHEH2UHH H}HEH5*HHHEHEH;#EUHEH72UHH0H}HEغH5ؠHHHEEEHEH+EHEؾH+HEؾHEE uHEH `(HH E} EHH^HHRH}tHEHHEH.}tHEH{HEHVj}tHEHSHEH2B}tHEHW+HEH}tHEH&HEH.}tHEH'(HEHf1}tHEHHEH}tHEH2HEH}}tHEH.iHEH[HEH5EUHE؉H/IEHHH(H UHEH5HǸxEE;EUHHHxHxH5/HHHEEHxH HxHe8EHxHNu2UHEH EUHxH.HxHs3H,HEHxH"HEHxH~HxHf"HEH}HMHUuHEIHEHxHLHEHxHTmHxH2H,HEHxHZ*HxHHEHxH~HxHy!HEHxHuEH}DEHMHUHuHEEIH|EHxH!HEHxHH~HxH HEHxHEH}DEHMHUHuHEEIHEXHxHHEHxHsEMHUHuHEHEUHxHRUHH H}HEH5ؚHHHEHEH2UHH0H}HEغH5H~HHEHEHEؾH.(tCHEغHHEHUHEHHEUHE؉Hi+4HEH HHEHHHEغHcUHH0H}HEغH5ԙHHHEHEHEؾHh'tCHEغHHEHUHEHHEUHE؉H*4HEHuHHEHHHEغHUHH H}HEH5HHHEHEHjt;HEHT3EUHEH EUHEH)HEH~HcHEHHUHH H}HEH5mHQHHEHEHnEUHEHz)UHH H}HEH5HHHEHEH&EUHEH()UHH0H}HEغH5ɗHHHEEEHEHEuHEH (HіHE}EHHЗHHėHHEHkEHEHEHEHExHEH+EgHEH1EVHEH`EEHEHE4EHHH(H UHEH5HǸE}uE;EUHE؉HUHH H}HEH5RH6HHEHEHEUHEHUHH0H}HEغH5HHHEHEغHHEHtNHEHt5HEH+HHEHHEH5H HEHEHEHtHUHEHHEEHEHa UHHH}HEH()H5HUHH }HuHUH}t3HEHUHMEHΉHEu EHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHtbHEHHUHuHEH @Ht HEHHEHGHUHEHEЉHEH=UMHEHUHHH}u}x}~HEH5HǸSHEHH}uHEH*EHEHHEHHEAH5WHUHH0H}uUME}t)}t<}UMHEH UMHEHmHEHHUHEHEUHEHEUHEHUHEHHEAH5HHEHEHEHEHEH5nHǸUHH H}uUUHEHEHEHHUHEHUHEHUHHH}uUHEHtUUHEHHxH*HHH H*XHEHMHEHHUHEHHxH*HHH H*XHEHOZMHEH5HuAUHEHHEH@HHEH5HǸUHH0H}uHU؋UHEHYEHUHEHH UHEHHEH HEHUHH0H}uHU؋UHEHEHEHߏHHUHEHH[ HEHUHEHUHH0H}uHU؋UHEHfH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEH, uIH}tHUHEH5fHǸU$HEH5[HEHEHUHH0H}uHU؋UHEHyEHEHnHJHUHEHHjHEH$UHEHsHEHHEHuwHEHtHEH HUHEHHHEHHEHUHEHUHH H}uHEEHEHWH3UHEH~HUHEHHEHEHEuHEH5HǸ|HEUHH0H}HuU܋E܍HHEHHHEHHEHHHEHwEEЉHEHyEE;E|HEHHUHEHH"+E܉HEH HEHEHHcEЉHEHUHHH}HuHEHHHUHEHAHEHHEHUHH0H}uHU؋UHEH(HEHEHmHIH}tUHEHuiEHUHEHHEH HEHEHEHr}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhHct EEEEE;E|EUHHH}uU}tHEHt HEHHEHMHEHEtHEH0EPMHEHQtRHEH:HEH5DHHEHqHEH0/HEHHEHUHH H}HuHEHEHUHEH5HRHEHEHHEHjt/EPHEHcHEHUHEHUHHH}HuHEH@t%HEHPHEH5 HǸ>HEH@HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH5%HH(HHiHHH5HǸ}HH5HwHHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5LHgHHHuUHH5#HHHHHt PHHHHHHHIHH5HEHHEHtHH}t/UHH$UHH5:HUHH5EUHH@H}HuHUHMLEEH}t1HE8u!HuHEH~HEHuHEHr~HE}tEHMHUHuHEHCUHH H}uHg~HE}uHEH[EuE%EE~eH~HEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH]UHEHLUHEHUHEHEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEHtH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEH tHUHEHEHUHEHHHEHUHEHFUHH H}HuHUHEHH`fH~HEHEH9Etj HEHHEHEt'OHHEHH% uHEuEHEH葼HEH+EHUHH0H}uHU؋MHEH+sHUHEHȺEEHE}tU} }tEHEH5rHIUHEHp3UHEHtHEH5rHHEH5mrHMHEHXrHtHEH߹E}uHEH詶UHEHFHEUHEHHHUHEH5qHǸ}tCHEH+/HEHuHEH5qHǸHUHEHUHH H}HuHUMHEHpHHEHaqH.HUHEH5HEH褸HEHHMHEHH#HUHEHHHEH:HEHHEH3HUHEH}t&HEHHUHEHbHEHUHH@H}HEȺH\HEHUHEȾHsHEHEȾH~~HEȺH5oHҶHHE_HEHEЉHMHUHuHEIHщHE}uJH}t5HEȾHDHHEHHEȺH5oH²"HEHUHEȉHEEUHH H}HEH5>oHHHEH}u)HEHHEHHUHH HHHHEHUHHHEHUHHHEHHڵtHHQEHH裵~ HH5nHHHEDž|@HEHcHEALEHUHuHEHH|QMIHDH~HHEԃ}uUHHz}t |HMHHHxO|HHEH_HHHHHH}UHH0H}HEغH5 mHҳHHEHUHEؾH&HEHUHMHEHHEUHE؉HUHHHHH5lHXHHEHE@EEHHtoHUHH{HEHUHMHEHH EHHitHHE7HH0tHH觼E}uHUHMHEHHPE}uUHHt}tHUHMHHHKMHEHHEH4HHHHHHRUHH H}HEH5jH觱HHEHEHHEHUHEHHUHHH}HEH(H5jHpHEHHEH5(HUHH }HuHUH}t3HEHUHMEHΉ5HEu EHEUHHH}u}y}|HEH.EEUHH H}HuHUMDEHUHEHHEHtbHEH\HUHuHEH iH1t HEHHEHHUHEHEЉHEHUMHEHUHHH}u}x}~HEH5 jHǸHEHjH}uHEH*EHEHLHEHHEAH5hHUHH0H}uUME}t)}t<}UMHEHUMHEHƷHEH:iHUHEHEUHEHEUHEHUHEHHEAH5hHHEH;EHEH'EHEH5hHǸ UHH H}uUUHEHEHEHFhHUHEH4UHEHUHHH}uUHEHtUUHEHXHxH*HHH H*XHEH MHEHgHNUHEHHxH*HHH H*XHEH訮ZMHEHgHuAUHEH HEHHHEH5[gHǸnUHH0H}uHU؋UHEHYEHUHEHH;UHEHjHEHyHEHhUHH0H}uHU؋UHEHEHEH8fHHUHEHHHEH3UHEHUHH0H}uHU؋UHEH[fH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEHuIH}tHUHEH5eHǸ$HEH5eHEHEHHUHH0H}uHU؋UHEHyEHEHdHJHUHEHHHEH}UHEHHEHkHEHZuwHEHHEHwHUHEHH4HEHHEHUHEHlUHH H}uHEEHEHcH3UHEH~HUHEHHEHEHEuHEH5 dHǸHEUHH0H}HuU܋E܍HHEHcHHEHHEHHHEHХEEЉHEHEE;E|HEHHUHEHHL+E܉HEHHEHEHHcEЉHEHUHHH}HuHEH@bHHUHEH蚦HEH HEH8UHH0H}uHU؋UHEHHEHEHaHIH}tUHEH]uiEHUHEHHEHeHEH߶EHEH}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhH輧t EEEEE;E|EUHHH}uU}tHEH^t HEHsHEH-MHEH螵tHEHEPMHEHQtRHEHHEH5`HHEHʷHEH/HEHHEHUHH H}HuHEH5EHUHEH5`HHEHEHHEHjt/EPHEHcHEHUUHEH=UHHH}HuHEH@t%HEHPHEH5b_HǸHEH@HEH@H E}t} uHEH@HHEUHHPHHHHHEHu.HH5~WHHD(HHiHHH5UWHǸHH5>WHHHHuUHH5WHVHHHHtPHƄ Ћ9uqHtgHHH5VHHHHuUHH5|VHHHHHt PHHHRHHHHIHH5HEHHSEHtHH7}t/UHH}UHH5UHUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHTHEHuHEHTHE}tEHMHUHuHEHUHH H}uHTHE}uHEH[EuE%EE~eHlTHEHEEHcHEHHUHH}HuHEHHEH@HE@HEHPHEH HEHǀ( HEHǀ HEHUH0 ]UHH H}HuHEH( HEH H)HH9E HEHEH( HHEHEH HUH)HH9EvHEH HEHHEHEH( H9EsHEH0 H5RHǸ蠼HEH0 HUHH6HEHEH HEH HEHH轳HEH HUHH9tHEH0 HmHEHUH HEHUH( HEH HEH HUHH H}HuHUHUHEHH|HHUHEHHHEH HEHHEH UHH H}HEHEH0 HUHǒHEH}uHEH0 H5QHǸ=HEH HUHH9tHEH0 H譧HUHMHEHHHEH HUHH9tHEH0 HUHHH}HEH HEH HEH0 HH3HEH HUHH9tHEH0 HUHH H}HuHUH}tHEHPHUHMHHdHEH^UHH H}uHUUHEHEHUHEHHUHEHqHEHHEHUHH0H}EHEHEHOH^HEغH5OHHEؾH豭HEؾHpHEؾHHEؾHnHEؾHHEغHHEغHxHEغH5OOHQHEH>OHxHEؾH'HEؾHHEؾHլHEؾH褮HEؾHsHEHgEHEؾHcHEؾHrHEؾHHEH}dHEؾHHEؾHpHE}t|HEHТHEHHEؾHHEؾHҭHEؾHHEؾHЫHEؾH蟭HEHEؾHQHEؾH`HEؾHoHEؾHHEH}tHEHHEHHEHHEؾHHEHHEؾHHEؾHެHEؾHmHEUHH H}uUHEH跐uOUHEH1fH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH趩UHEH襩UHEHTUHEHCEmE;E|UHH H}uUEUHEHEHEH'+EE}yEE}E;E}zHEHJH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHeJHUHEHEHUHEHHHEHPUHEHUHH H}HuHUHEHH蹨fH~HEHEH9Etj HEHHEHEt'訵HHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHIH UHEH!EEHE}tU} }tEHEH5"IHIUHEHɦ3UHEH3tHEH5HHHEH5HHMHEHHHݲtHEH8E}uHEHUHEH蟨HEUHEH:HHUHEH59HHǸ}tCHEH/HEHuHEH5GHǸHUHEH\UHH H}HuHUMHEHHGHHEHGH.HUHEH莉HEHHEHtHMHEHH|HUHEHH٪HEH蓇HEHHEH茤HUHEH}t&HEH`HUHEH軓HEHUHHH}Hu2HHHUHEH5FHǸ{UHH H}ǹHEH}uHEH5^FHHEHHHEHHEH>FHHEHuHEHHEUHH H}uUHEH>HEH>HEMHEHHEHEHEH@HdE}t} uHEH@HdHEUHHPHHHHHxEHu.HH5"HH!k(HHiHHH5r"HǸ賏HH5["H譍HHHuUHH51"HVHHHHtPHƄ Ћ9uqHtgHHH5!H蝇HHHuUHH5!HHHHHt PHHH/]HHHHIHH5HEHH0EHtHH}t/UHHZUHH5 HUHHkEUHH@H}HuHUHMLEEH}t1HE8u!HuHEH HEHuHEHHE}tEHMHUHuHEHyUHH H}uHHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHoUHEHoUHEH1UHEH EmE;E|UHH H}uUEUHEHEHEHl+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHHjHEH-fUHEH|UHH H}HuHUHEHHnfH~HEHEH9Etj HEHHEHEt'{HHEHH% uHEuEHEHTHEH+EHUHH0H}uHU؋MHEHH[UHEHREEHE}tU} }tEHEH5?HIUHEHl3UHEH\tHEH5HHEH5HMHEHHxtHEHRE}uHEHNUHEH|nHEUHEHHHUHEH5VHǸ}tCHEHa/HEH轒uHEH5HǸvHUHEH9NUHH H}HuHUMHEHeHHEHH.HUHEHkOHEHPHEHQHMHEHHYHUHEHHpHEHpMHEHHEHijHUHEHY}t&HEH=jHUHEHYHEHגUHH0H}HEHEؾHHEHUHEHƿVHEHEHvH}tOH}t5HEؾHmHHEHHEغH5OHUK HEHhFHUHEH51HǸt}HEغHLHHEؾHzTUHH0H}HEHEغH\HEHEH5HdHEHUHEHƿNHEHEHuH}tJH}t5HEؾHlHHEHHEغH5GHMJVHEHgHHUHEH5.HǸq|HEغHKHHEؾHwSUHH H}HEH5HZMHHEHEH\UHH0H}HEغH5HMHHEHEغHo[HEHEغHU[HEHUHMHEHH*wHHEHH(dUHH0H}HEغH5HLHHEHEغHZHEHEغHZHEHUHMHEHHKdHHEHHlHEغHIUHH H}HuHEH@H HEHHEHJHEHRLHEHALthHEH軋HEHeHEHHEH}UHEHHEHeJHEHKEHEHPHEHHkHEHHHEHPMHEHUHEHHEHHHEHHEHIHEH8KHEH'KuAHEH袊HEHLHEHHEHdT`HEHaMEHEHPHEHHjHEHGHEHPMHEHTUHH0H}HuHUHEHEHMHUHEHHАUHH H}HuHUHMHUHEH5H]JUHH H}HEH5 HfIHHEHEH)HUHEH5.HvUHH0H}HEغH5q HIHHEhHHEHEHUHEHH贌HUHEHѺsHKHEHHEHHHEHHHEH}oUHH H}HEH(H5 H^EHEH5H聕MHEH H9REHEH5HJMHEH HRUHH }HuHUH}t3HEHUHMEHΉUHEu ENHEUHHH}u}y}|HEH^EEUHH H}HuHUMDEHUHEHHEHGtbHEH,HUHuHEH Ht HEHVHEHpaHUHEHEЉHEHfYUMHEHyUHHH}u}x}~HEH59 HǸ|lHEHE H}uHEH`*EHEHHHEHXHEAH5HUHH0H}uUME}t)}t<}UMHEHUMHEHNHEHj HUHEHEUHEHEUHEH_UHEH_HEAH5 HHEH OEHEHEHEH5HǸjUHH H}uUUHEHEHEHvHUHEH_UHEH資UHHH}uUHEHDtUUHEH(eHxH*HHH H*XHEHEMHEHHMUHEHdHxH*HHH H*XHEHxEZMHEHHLuAUHEHCHEHi`HHEH5HǸ>iUHH0H}uHU؋UHEHYEHUHEHH wUHEH:fHEHICHEH8CUHH0H}uHU؋UHEHEHEHhHHUHEHHvHEHUUHEH^UHH0H}uHU؋UHEH+CfH~HEH}t=ff.Ez ff.EuUHEHatHE؉EUHH}]UHH H}uHUEPHEHUtuIH}tHUHEH5HǸ~g$HEH5HEHEHQUHH0H}uHU؋UHEHyEHEHHJHUHEHHaHEHM>UHEH蜈HEH;AHEH*AuwHEH蝀HEHGvHUHEHHaHEH=HEHZUHEHHEHUHH0H}uHU؋UHEHQwHEHEHHIH}tUHEH-UuiEHUHEHHEHMEHEH}}uHEHEUHHHhEE EEeHpMHhH>uDUEЉEHpMHhH>t EEEEE;E|EUHHH}uU}tHEH.=t HEHCVHEH<MHEHnLtHEHY|EPMHEHQtRHEHcHEH5HHEHNHEHY{/HEH{HEH~UHH H}HuHEHSEHUHEH5?H{kHEHUEHHEHjt/EPHEHcHEH%{UHEH {UHHH}HuHEH@t%HEHPHEH5HǸgiHEH@HEH@H5E}t} uHEH@H5HEUHHPHHHHHIEHu.HH5HH<(HHiHHH5HǸ`HH5nH^HHHuUHH5DHVHHHHtPHƄ Ћ9uqHtgHHH5HXHHHuUHH5HHHHHt PHHH".HHHHIHH5HEHH#zEHtHHU}t/UHHMpUHH5HUHH^|EUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEHlqUHH H}uHHE}uHEH[EuE%EE~eHHEHEHUHMHEHHHEH HUHH9tHEH0 HwUHHH}HEH HEH HEH0 HH3HEH HUHH9tHEH0 HbnUHH H}HuHUH}tHEHHUHMHH43HEH.(UHH H}uHUUHEHEHUHEHHAUHEHArHEH*HEH*UHH0H}EHEHEHH^HEغH5 HHEؾHDHEؾH@MHEؾHO*HEؾH>*HEؾHiHEغH^_HEغHH_HEغH5HQHEHnHH3HEؾHrHEؾHCHEؾHCHEؾHtEHEؾHClHEH7iEHEؾH3LHEؾHB)HEؾHaHEH}dHEؾHhHEؾH@GHE}t|HEH9HEHhHEؾHBHEؾHDHEؾHamHEؾHBHEؾHoDHEHEؾH!mHEؾH0KHEؾH?(HEؾH`HEH}tHEHHEHHEH8HEؾH|gHEHgHEؾHAHEؾHCHEؾH=gHEUHH H}uUHEH'uOUHEH(fH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH@UHEHu@UHEH$iUHEHiEmE;E|UHH H}uUEUHEHEHEH<+EE}yEE}E;E}zHEH%H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHH;HEH 7UHEHo[UHH H}HuHUHEHH?fH~HEHEH9Etj HEHHEHEt'xLHHEHH% uHEuEHEH%HEH+EHUHH0H}uHU؋MHEHH,UHEH#EEHE}tU} }tEHEH5RHIUHEH=3UHEH-tHEH5HHEH5HMHEHHItHEH#E}uHEHUHEHo?HEUHEH SHHUHEH5iHǸP}tCHEHTe/HEHcuHEH5)HǸGHUHEH,UHH H}HuHUMHEHxHHEHH.HUHEH^ HEH!HEHDaHMHEHHLnHUHEHHAHEHcHEHSHEH\;HUHEH*}t&HEH0;HUHEH*HEHcUHH0H}؉uHEUHE؉Hbt;HEHUMHE؉HHEHEHEHHE^UHEH5HiHt+UHEH5lHHHEHEH<^MHEHTH%HEUHH H}HMHEHHKEHEHZ"}uE<0uUHH0H}uHUHEUHEHHH1HH%HMHEHNHHEMHEH GHHEUHEH5LHhHt6UHEH51H^HHsSFH4HESUHEH5H8hHt8UHEH5H HHEH}tHEHHEH}tH}uMHEHH#HEUHH0H}uHUHU؋MHEH5HEH}uMHEHrH`#HEUHH0H}uHUHEUHEHHHHHHMHEHzHBHEMHEH7HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH5qHHW (HHiHHH5HHǸ-HH51H+HHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5H%HHHuUHH5oHHHHHt PHHHeHHHHIHH5HEHHfGEHtHHJ"}t/UHH=UHH5HUHHIEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEH>UHH H}uHHE}uHEH[EuE%EE~eH_HEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH UHEH UHEHg6UHEHV6EmE;E|UHH H}uUEUHEHEHEH: +EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHXHUHEHEHUHEHH$ HEHcUHEH(UHH H}HuHUHEHH fH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHwHUHEH4EEHE}tU} }tEHEH5HIUHEH 3UHEHFtHEH5ѼHHEH5HMHEHHtHEHKE}uHEHUHEH HEUHEHM HHUHEH5,HǸ}tCHEH2/HEH0uHEH5HǸ'HUHEHoUHH H}HuHUMHEH;HHEHH.HUHEHHEHHEH.HMHEHH;HUHEHHHEHHEH0!HEHHUHEH}t&HEHsHUHEHHEH 1UHH`H}HEH5HHEH}u/HEHtHEH5 HEHEH55H+HHEHEH(HL'HEEH}u!H}uHEHHH}tkHEHuHEHEHeHEHEHHEHMHUHuHEH0HEHEHdHEH8!HUHMHEHH HEH}tOH}t5HEH HHEHHEH5QHz HEHEEUHH H}HEH5HHHEHEHUHH0H}EHEHUHEHѺHHEHEH}txHEHtHEHMHEHH !H}t5HEؾH HHEHHEغH5^Hs HEHEEUHH0H}EHEؾH-HEHEHE~HEؾH? E}t0HEAAHH5طH'HQ%HEHH'HH'H(HEHEHH}tOH}t5HEؾHHHEHHEغH5DHY HEHEEUHH0H}HEؾH,HEHEH2~HEؾH, EE}t0HEAAHH5˶Hw'H7%HEHHZ'HHx'H'HEH}tOH}t5HEؾHHHEHHEغH5fHK HEHEHEHEUHH H}EHEH}tOH}t5HEHJHHEHHEH5H HEH EEUHH@H}HEHEHEHEHEȺH5AHHHEH}HMHUHuHEIH4E}HEȺHHEȺ H5QHWHUHEHH!HEȾHHEȺH5#HHMHEȺHH0HEȾHHEȺ H5HHMHEȺHHT0HEȾHsHEȺ H5HHMHEȺHH0HEȾH2}UHH0H}HEغH5ݳHHHEHEغH5HcHHEEHEHEHAHEHUHEHHHEH}tQH}t5HEؾHHHEHHEغH5ճHU HEHE HEHEUHH0H}HEغH5HHHEHEغH5~HzHHEHEH&HcHEؾHEUHMHEHH:EUHE؉HUHH@H}HEȺH5[HHHEHEH}~HEȾHwEEH&HE}tCHUHEHjjjAAHHH5H'HH EHUHEHH'H E}u;HUHEHѺsH,HEHHEHHHEHHHEH }tUHEȉH[EUHH H}HEH5HHHEHEH UHH H}HEH5ݰHHHEHEH?EUHEH(UHSHXH}HEH5H/HHEHEH5HHHEHEH5 HHHEHEHEEHEHR EHEHt)HEEHcHEHEHEH~HEHuHHEELcH}HMHUHuHEMIH EUHEHb'H}t)H'H|HHEH_HH"'HX[]UHH@H}HEȺH5 HHHEHEȺHuHEH EHEȺHPEUHEHcHEHEHs/HEHEH3HEH}t5HEȾHHHEHHEȺH5<He HEHEPHEȾHEE;E\HEHٮHHEHL!EHEȺHcEUHEHHEHEHHEH}t5HEȾH HHEHHEȺH5H HEHEPHEȾHEE;ElHEHHUHH0H}HEغH5HHHEHEغH5HHHEHEHHcHEؾHEUHMHEHHAEUHE؉H UHHpH}HEH5JHHHEEEHEHEHEHHEH`HEHEH5HbHEHHEH}t5HEHLHHEHHEH5H HEH HEHHMHUHuHEAH}EEEHcHEHHnMHEHFHEEHH%HHEHHpHEH*MHEHHEEHcHEHHMHEHЫHnEEHHZHHEHHHEHMHEHHHEHtAHE H5kHHMHEHH!&HEH@HEHtAHE H5,H]HMHEHH%HEHHEHẼ}HEH5HHEHHEHEUHEHA'HEHEHHEH}t5HEHHHEHHEH5H# HEHeEPHEHEE;ElHEHUHH H}HEH5HBHHEHEHHUHEH1UHH`H}EHEH5HHHEHEH5HHHEHEHA)EHEH-)EؿHEHEHEHEHEHEHt,BHEHEH(HcHEHH HUHEHvHHEHEHUHEHHHEHQHEH8HHEHEHUHEHHLEH}M؋UHuHEHuMIHHHEH}tuH}t5HEH4HHEHHEH5H HEHEHEHHUHEHHEH HEHHEHEUHH0H}HEغH5[HHHEHEغH5HHHEHEHHcHEؾHEUHMHEHHEUHE؉HUHHPH}HEH5¥H!HHEHEH5 HHHEHEH5HHHEHEHHHEHEH?~HEHjHEHEHHHELEH}HMHUHuHEMIHM E̋UHEHUHSHxH}HEH5HHHEHEHEHEH HEHHEH}tAHE H5NHtHMHEHHHEH HEHAHEH}HEHHẼ}HEH5ܤHHEH EHEHoH‹EHkHEHEH{H}t5HEHHHEHHEH5H! HEHcEPHEHEE;EeHEHHUHMHEHHHEHtAHEH5HHMHEHHbHEHHEHt HEH5HHEHuHEH4/HEHHEHUHH H}HuHEHEHUHEH5HVHEHEHHEHjt/EPHEHcHEHUHEHUHHH}HuHEH@t%HEHPHEH5MHǸBHEH@HEH@H赺E}t} uHEH@H薺HEUHHPHHHHHEHu.HH5iHH'HHiHHH5@HǸHH5)H{HHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5HkHHHuUHH5gHHHHHt PHHHHHHHIHH5HEHHEHtHH}t/UHH(UHH5~HUHH9EUHH@H}HuHUHMLEEH}t1HE8u!HuHEHЇHEHuHEHHE}tEHMHUHuHEHGUHH H}uHHE}uHEH[EuE%EE~eHWHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHaUHEHPUHEHUHEHEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEH}H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHP}HUHEHEHUHEHHHEHUHEHJUHH H}HuHUHEHHdfH~HEHEH9Etj HEHHEHEt'SHHEHH% uHEuEHEH蕪HEH+EHUHH0H}uHU؋MHEHo|H赱UHEH̨EEHE}tU} }tEHEH5 |HIUHEHt3UHEHޱtHEH5{HHEH5{HMHEH{HtHEHE}uHEH譤UHEHJHEUHEHHHUHEH5${HǸ}tCHEH//HEHuHEH5zHǸHUHEHUHH H}HuHUMHEH3zHHEHzH.HUHEH9HEH訦HEHHMHEHH'HUHEHHHEH>HEHHEH7HUHEH蒯}t&HEH HUHEHfHEHUHH@H}HEHUHEȾH艳HEHEȺH?HE覱HEHEЉHMHEHHEHEH躮HcHEH9tHEH5yHǸ}HEHUHEHH}uHUHEHH7EHEHH}t5HEȾHHHEHHEȺH5xH莠"HEHнUHEȉHmEEUHH0H}HEHUHEؾHHEHEH~NHEHdH4HEغH5scHHHEHEHHEH}tJH}t5HEؾH菬HHEHHEغH52dH HEHO HEHAUHH H}HEH5bHVHHEHEHSHEH}t5HEHHHEHHEH5~bHu HEH跦UHH H}HEH5EbȞHHEHEHDu#HEH×HEH9HEHEUHEHEUHEHúUHH0H}HEغH5aH-HHEHEؾH襌u#HEHHHEHH袮HEؾH輐HEH}tVHEHHEHUHEHH虵EHEH芠HEH^UHE؉HHEHbHSUHH0H}HEغH5`H=HHEHEؾH赋u*HEHԶHEHUHEHHMHEغH HEHUHEHHEHEHjUHE؉HUHH0H}HEغH5_H胊HHEHEؾHu%HEH蚸HHEHH踡Ht6HEH-HHEHHHEHx[HSHEHHHEHHըHEHv[HHEȺH׻HEHHEHEHHEHEH[HEEHEHcHEHHHEHHMHEH ]H蘏HEH蜓HEH}t5HEȾH0HHEHHEȺH5YH讁 HEHHEH\H(HEH?ZHHEH4HtXHEH5JZH茥HEȺHFHEHHHEHH蘈HEȾHUHH H}HEH5YHlHHEHEH詘UHH H}HEH5YH.HHEHEH苅UHH H}HEH5xYHHHEHEH譝HEH}t5HEH葢HHEHHEH5'YH HEHQUHH0H}EHEغH5XH_HHEH;HEHUHEHH贤tJHEHUHEHѺsH HEHHEHHHEHHEHEHʩEUHH H}HEH59XH豂HHEHEH莣HEH}tZHEHHEH}t5HEH;HHEHHEH5]WH~HEH HEHUHHPH}HEH5WHHHEHEHψHEHEHHEHEH?HEHEH蕷HEH HHEHHGHEH6YH菋H}t0HMHEHHHEHYHXH}EEHEH3H軏EE[HEHH‹EHcHEHEȋHcHEHHHEHHEPHEH踟EE;E|UHH H}HEH5 VH聀HHEHEHNHEH}tZHEH臵HEH}t5HEH HHEHHEH5WH|HEH˙ HEH轙UHH0H}HEغH5(VHHHEHEؾHHEHUHEHHsHEH}tJH}t5HEؾHPHHEHHEغH5TH{HEH HEHHEH&UHH0H}HEغH5aUH HHEHEغH5TH~HHEHEغH5TH~HHEHUHEHHSE}tHEH5THǸ貤}uHUHEHHE}uHUHEHHEUHE؉H蹬UHSH8H}HEȺH5xTH"~HHEHEȾHHEHUHEHHEHч'H HHEHHHUHEȉH&H8[]UHH0H}HEغH5SH}HHEHEغH|HEHUHEHH'EHEHUHE؉H觫UHH@H}HEȺH5gSH}HHEHEEHEHE܃}HEHTH辂EUHEȉH>}UHEȉH贝EEvUMHEȉH脃HEȾH|HEȺH{HEHEȾHXHUHEHHUEHEHơEE;EH}xAHEȺHHEHUHEHHOEԋUHEȉHUHH H}HEH5NHexHHEHEHRHEH}tZHEHˮHEH}t5HEHHHEHHEH5MHmtHEH译 HEH衑UHH H}HEH5 NHwHHEHEHHEH}tJH}t5HEHPHHEHHEH5LHsHEH HEHUHH@H}HuHEHEH'HMHEHHHEH蘷uDHEH1OHHEȾHuHEHڶTHEH߯HEHEH誶HEHEH}HEHvHEPHEHZ}HEHvHEHnzE}HEHEHzHEHEHH}t!HEؾHˑHEHEH苪H}uAHEHMH謕HEȾHKtHEH5MHǸ蓛HEHEHAUHH0H}HEغH5KH6uHHEHEHEH諌EHEغHRHEؾHHEHEؾH|HEؾHHE}~HEؾHL HEH^HEؾH轾HEPH'HMHEHHZHUHEH5 HӻUHH@H}HuHUHMHEHEH'HMHEHH"HEH衴u3HEHaLHHEHHHEHHEHEHijHEHEHzHEH tHEPHEHtzHEHsHEHwE}HEHtSHEHHHEHHEHEyHHEHHEHAHEHҲHEHKH誒HEHgUHH0H}HEغH5HH\rHHEHEHEHщEHEغHxHEؾHHEHEؾH袌HEؾH!HE}~HEؾHr HEH脋HEؾHHEPH3'HMHEHH耓HUHEH55HUHH0H}HEغH5GHNqHHEH'HMHEHH=HEؾH輱tDHEؾHGHEHEHEؾHHEPHEؾHHEؾHHT'HMHEHH蹂HEؾH8tDHEؾHéHEHEHEؾHxHEPHEؾH`HEؾH_HUHEHH܀HEH@UHH H}HEH5FHoHHEHEH5HHoHHEHEHHUHEHH`uUHH0H}HEغH5FHoHHEHEؾHEHEؾHotHEؾHcyE}tUHEHrEUHEH EEHcHEHHdUHH H}HEH5^EHnHHEHEH聱HEHUHEHHJUHH0H}HEغH5EHonHHEHUHEؾH|HEHE຿H5BH'HEHUHMHEHH蜋HEHHMHEHH2UHH H}HEH5lDHmHHEHEHHEHkUHHPH}HEH5"DHmHHEEHEH5BHwHt:HEH5BHJmHHEHUHEHH ~EHEH5DH Ht:HEH5DHlHHEHUHEHHIrEHEH萮tzHUHEH'jHEHEHHEHƿkHEH}t$HUHEHH]}EHEHm2HEHnEH4rHEHoEHrUHEH艚UHHH}HEH'H5jAHHEH'H5_AHHEH'H5BH݁HEH"'H58BHÁHEH'H5@H詁HEH'H5Y@H菁HEHT'H5?HuHEHHEH5'HͦHEH'H菅UHH}HE]UHH}HE]UHH }HuHUH}t3HEHUHMEHΉxHEu EqHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHjtbHEH-HUHuHEH *EHt HEHyHEHqHUHEHEЉHEHg|UMHEH賜UHHH}u}x}~HEH5EHǸ}HEHEH}uHEH΃*EHEHkHEH{HEAH5ADHUHH0H}uUME}t)}t<}UMHEHUMHEHqHEHDHUHEHEUHEHEUHEHтUHEHHEAH5uDHHEH rEHEHEHEH5XDHǸۍUHH H}uUUHEHEHEHCHUHEHUHEH贪UHHH}uUHEHgtUUHEH)HxH*HHH H*XHEHhMHEHCHpUHEHƇHxH*HHH H*XHEHyhZMHEHCHouAUHEHfHEHjHHEH5BHǸ?UHH0H}uHU؋UHEHYEHUHEHH UHEH;HEHJfHEH9fUHH0H}uHU؋UHEHEHEHAHHUHEHH腙HEHxUHEH賁UHH0H}uHU؋UHEH,ffH~HEH}t=ff.Ez ff.EuUHEHՄtHE؉EUHH}]UHH H}uHUEPHEHVuIH}tHUHEH5PAHǸ$HEH5EAHEHEHtUHH0H}uHU؋UHEHyEHEHX@HJHUHEHH蔄HEHNaUHEH蝫HEHVEH@HHtHH赟HH tHEHΉGHEHt(HMHHH57HǸ迈/HUHHHzHHNW*EHH[UHH H}HuHUMH}tBHEHEH=bHu%HMHUHEH57HǸEUHH0H}HuHUHEHEHE@t$HE@HEHP HEHHEH@HEHHUHrHUHMHUHH`H}HuHUHMLEEHEHEEHEHEHEHEHEHEHEHP HuHMHEHHEHEHt:HEHt1HE8u!HuHEȹH6H{EHuHEȹH5HZE}tEHMHUHEH5HvUHH0H}HuHUHEHEHE~HEHcHEHHEGHEH@H`t4HEH@HUHzH賑HHEHHEHUHH0HHH@HHRHHΉHEHH\THHEHuHMHHIH54HǸgHHUHH H}H]4HEHEHEH@HYE}tHEHPHU9EtECHEHHU UHUHLHEuHEHEH@H YUHH H}HuHEHIHEHEE}#u>HEH@HXE}t} uHEH@HXHEUHHPHHHHHlEHu.HH53HH_'HHiHHH52HǸ觃HH52H衁HHHuUHH52HVHHHHtPHƄ Ћ9uqHtgHHH562H{HHHuUHH5 2HHHHHt PHHH#QHHHHIHH5HEHH$EHtHHx}t/UHHNUHH5$1HUHH_EUHH@H}HuHUHMLEEH}t1HE8u!HuHEHv0HEHuHEH\0HE}tEHMHUHuHEHmUHH H}uHQ0HE}uHEH[EuE%EE~eH/HEHEHEHUH HEHUH( HEH HEH HUHH H}HuHUHUHEHH|HHUHEHHlHEH HEHHEH UHH H}HEHEH0 HUHLHEH}uHEH0 H5+-HǸuHEH HUHH9tHEH0 H~aHUHMHEHHHEH HUHH9tHEH0 HΚUHHH}HEH HEH HEH0 HH3HEH HUHH9tHEH0 HcUHH H}HuHUH}tHEH',HUHMHH5VHEH/KUHH H}uHUUHEHEHUHEHHdUHEHBHEHMHEHMUHH0H}EHEHEHh+H^HEغH5l+HHEؾHgHEؾHApHEؾHPMHEؾH?MHEؾH赌HEغH_HEغHIHEغH5*HQHEH*HIVHEؾHHEؾHfHEؾHfHEؾHuhHEؾHDHEH8EHEؾH4oHEؾHCLHEؾHHEH}dHEؾH袋HEؾHAjHE}t|HEH\HEH襋HEؾHeHEؾHgHEؾHbHEؾHeHEؾHpgHEHEؾH"HEؾH1nHEؾH@KHEؾH߃HEH}tHEHHEHHEH[HEؾH}HEH豊HEؾHdHEؾHfHEؾH>HEUHH H}uUHEHJuOUHEHKfH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHcUHEHvcUHEH%UHEHEmE;E|UHH H}uUEUHEHEHEH_+EE}yEE}E;E}zHEH&H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEH%HUHEHEHUHEHH^HEH!ZUHEHp~UHH H}HuHUHEHHbfH~HEHEH9Etj HEHHEHEt'yoHHEHH% uHEuEHEHHHEH+EHUHH0H}uHU؋MHEH%HOUHEHFEEHE}tU} }tEHEH5$HIUHEH`3UHEHPtHEH5o$HHEH5W$HMHEHB$HltHEH FE}uHEHBUHEHpbHEUHEH vHHUHEH5#HǸs}tCHEHU/HEH豆uHEH5#HǸjHUHEH-BUHH H}HuHUMHEH"HHEHK#H.HUHEH_CHEHDHEHEHMHEHHMHUHEHHdHEHdAHEHvHEH]^HUHEHM}t&HEH1^HUHEHMHEHˆUHSHxH}HEH5-"HCCHHEHEH5"H$CHHEHEHwQHEEHEHZEHEHEHEHEEHEHJNuHEH!HH}EUHEHItMHEH?HEEUHEHBu8UHEHHEH}uMHEH/!HGEUHEHBu$UHEHLtEH}t/HUHEHHUYuHEH5 HǸgLEHMHUHuHE}WjjjAHkH HEH}uHEH5 HǸfgaH)HEHUHEHHbtBHUHEHѺsHDHEHHEHHHEHHEH}t)HJ'HHHEHHHHEHgHEHWEH]UHSHXH}HEHEHEHEEHEHHEHEHNHEHUHEHHUUHHEH}HMHUHuIH=~nHEHuEHEHt5HEH~^HHEHHEH5vH; HEH>YMHEHHvIEHEHt5HEH^HHEHHEH5H; HEHXMHEHH IHEHtvHEH5H_HEHKHEHNHEAH5HUHH0H}uUME}t)}t<}UMHEHUMHEHDHEHiHUHEHEUHEHEUHEHUUHEHUHEAH5HHEH EEHEHzEHEH5HǸ`UHH H}uUUHEHEHEHuHUHEHUUHEH}UHHH}uUHEH:tUUHEH'[HxH*HHH H*XHEH;MHEHHCUHEHZHxH*HHH H*XHEHw;ZMHEHHBuAUHEH9HEHhVHHEH5HǸ=_UHH0H}uHU؋UHEHYEHUHEHH mUHEH9\HEHH9HEH79UHH0H}uHU؋UHEHEHEHgHHUHEHHlHEHKUHEHTUHH0H}uHU؋UHEH*9fH~HEH}t=ff.Ez ff.EuUHEHWtHE؉EUHH}]UHH H}uHUEPHEHTjuIH}tHUHEH5HǸ}]$HEH5HEHEHGUHH0H}uHU؋UHEHyEHEHHJHUHEHHWHEHL4UHEH~HEH:7HEH)7uwHEHvHEHFlHUHEHHWHEH3HEHPUHEH;mUHH H}uHEEHEHH3UHEH~HUHEHHEHEHuEuHEH59HǸ[HEUHH0H}HuU܋E܍HHEH"HHEHHEHHUHEH2EEЉHEHOEE;E|HEHHUHEHH+E܉HEHkHEHEHHcEЉHEHtUHHH}HuHEHoHHUHEHi3HEH4HEH~UHH0H}uHU؋UHEHPmHEHEHHIH}tUHEH,KuiEHUHEH2HEH44HEHCEHEHs}uHEHEUHHHhEE EEeHpMHhH4uDUEЉEHpMHhH4t EEEEE;E|EUHHH}uU}tHEH-3t HEHBLHEH2MHEHmBtHEHXrEPMHEHQtRHEHb~HEH5HHEHDHEHXq/HEHqHEHtUHH H}HuHEHIEHUHEH5>HzaHEHKEHHEHjt/EPHEHcHEH$qUHEH qUHHH}HuHEH@t%HEHPHEH5HǸf_HEH@HEH@H+E}t} uHEH@H+HEUHHPHHHHH?EHu.HH5 HH2'HHiHHH5 HǸVHH5m HTHHHuUHH5C HVHHHHtPHƄ Ћ9uqHtgHHH5 HNHHHuUHH5 HHHHHt PHHH!$HHHHIHH5HEHH"pEHtHHK}t/UHHLfUHH5HUHH]rEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEHkgUHH H}uHHE}uHEH[EuE%EE~eHHEHEHUHEHHSEHEH "EHcHEHH;UHH}HuHEHHEH@HE@HEHPHEH HEHǀ( HEHǀ HEHUH0 ]UHH H}HuHEH( HEH H)HH9E HEHEH( HHEHEH HUH)HH9EvHEH HEHHEHEH( H9EsHEH0 H5HǸoIHEH0 HUHHBHEHEH HEH HEHH@HEH HUHH9tHEH0 HHEؾHVHEH}tHEHHEHHEH.HEؾH{]HEH]HEؾH7HEؾH9HEؾH<]HEUHH H}uUHEHuOUHEHfH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH6UHEHt6UHEH#_UHEH_EmE;E|UHH H}uUEUHEHEHEH2+EE}yEE}E;E}zHEH$H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHH1HEH-UHEHnQUHH H}HuHUHEHH5fH~HEHEH9Etj HEHHEHEt'wBHHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHH"UHEHEEHE}tU} }tEHEH5QHIUHEH33UHEH#tHEH5 HHEH5HMHEHH?tHEHE}uHEHUHEHn5HEUHEH IHHUHEH5hHǸF}tCHEHS[/HEHYuHEH5(HǸ=HUHEH+UHH H}HuHUMHEHwHHEHH.HUHEH]HEHHEHCWHMHEHHKdHUHEHH7HEHbHEHIHEH[1HUHEH }t&HEH/1HUHEH HEHYUHH@H}HEȾHYHEHEHR 'HHH6EHEHEE}uHEHMtE}u2HEHAHEHEH_}uHCHEHH'HEHUHPHEHUHPH}t5HEȾH0HHEHHEȺH5nHO HEH+HEHHEHr%H8[]UHH0H}HEغH5HHHEHEغH5HcHHEHEHFHHEHHNEUHE؉H?UHH@H}HEȺH5HHHEHEH(EEHEȾHvQuHEHHEUHEH5HZHu5UHEH5HZHuMHEH7HMUHEH5BHTZHt5UHEH5'H)HHEHUHEHH??E3UHEH5HHHEHUHEHHE}uMHEHHEE;EUHEȉH>UHSHXH}EHEH>RHEHEH5PHRHHEHEH5aH3HHEHEH~HEHUHEHEHEHHEHEHUHEHHd&uHEHHHEHMHUHuHEAH%HEHEHd5H}t)HN'HXHHEH;HHSH}tOH}t5HEH,HHEHHEH5Hs HEH'EEHX[]UHSHXH}EHEH5GH HHEHEH0~HEH[THEHEH ~HEH5HS HHEHEH ~HEHOHEHEH^HHEHEHE@Hu,HNHEHEAH}HMHUHuHEEIHGu\H}t=HUHEHѺsHHEHHEHHHEHHeHEHQEH}t)H#'H-HHEHHHYQH}t HEH2H}t HEH2EHX[]UHSHHH}EHEHEHNHEHEHwRHEHEHH6HEHEHHHEHEHUHuHEH/HEHEH12H"'H,HHEHHHXPH}tOH}t5HEH)HHEHHEH5fHG HEH$EEHH[]UHHPH}EHEH5H HHEHEH5lHn HHEHEH5}HO HHEHEHHHE)HLHEHE؉HMHUHuHEAH5tBHUHEHѺsH HEHHEHHHEHHEHEH0EUHH H}HEH5H HHEHEH UHH@H}EHEȺH5H: HHEHEH@'HHH)EHE}t&}t }tHEHiH(HJHE}uHUHEHHPEA}uHUHEHH%E#}uHuHEHlE}uBHUHEHѺsHF HEHHEHHHEHH*EHEH/}tUHEȉHn6UHH`H}HuHEH=EHEHHHHEHHMHEHGHHEH@HHEH@HHK HEHEH@H@HQHEHEH@HHtgEH}t5HEH%HHEHHEH5Hn HEH MHEHHHEH@H@HtgEH}t5HEHx%HHEHHEH5]H HEH8 MHEHNHpHEH@Ht{HEH@HcHEEH}t5HEH$HHEHHEH5Hn HEHMHEHHHEH@ Ht{HEH@HHEEH}t5HEHh$HHEHHEH5iH HEH(MHEHcH`HEH@(Ht{HEH@(H(HEEH}t5HEH#HHEHHEH5H^ HEHMHEHHHEH@8HHEH@8HMEHEH@8Ht9HEHR#HHEH@8HHEH5H HEHMHEHwHFHEH@Ht/HEHPHEHH2 HEHCH HEH@0Ht/HEHP0HEHH HEHH UHH H}HEH5"HHHEHEH@H8EE+HHEHH $HEHEKHHEHH#HEHUHHpH}HEH5yHHHEHEHEHEH@H7EHEH8EE܉JHHEHH7#HEHMHEHHi E܃HHHHHHEH@ HEHEH@HEHEH@HEEHEHHHHEHHLMHEH|H EHEH@H6u'HEHHtHEHFMHEHHf HEH5H!HEHHEHPHEHH4HEHHEH@ HHEH@ HH|EHEH56Hv!HEH0HEHz6EdHEH@ HH‹EH1HEEHcHEHHHUHEHHMHEHEE;E|HEHHEH@H$5u$HEHH(HEH@(HEHEH4HEEH}t5HEHpHHEHHEH5 H HEH0MHEHHh HEH@ H@HEHEH@ H@HEHEH@ HEHEHHHEHHYHHEHH =HEHH HEHH#HHEH]HH}tMHEH5HHHEHHUHEHH?0HEHH}tMHEH5HHEHHUHEHHHEHUHH0H}HEغH5nHHHEHEغH8HEHUHEHH[JEUHE؉H,UHH0H}HEغH5HlHHEHEؾH$@HEHEغHEUHMHEHHQEUHE؉H}+HEH#UHHH}HEHsU'H5cHHEH2HEH5>&H(HEHU'HUHH }HuHUH}t3HEHUHMEHΉ HEu E|HEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHNtbHEH;HUHuHEH %H=t HEH] HEH HUHEHEЉHEHUMHEHN.UHHH}u}x}~HEH5HǸ!HEHH}uHEHi*EHEHHEHg HEAH5<HUHH0H}uUME}t)}t<}UMHEH>UMHEH2HEHHUHEHEUHEHEUHEHlUHEH[HEAH5pHHEHEHEH9EHEH5SHǸvUHH H}uUUHEHEHEHHUHEHUHEHOEE;E|HEHHUHEHH@+E܉HEH*HEHEHHcEЉHEHV3UHHH}HuHEHHHUHEHHEHuHEHHEH@HvE}t} uHEH@HWHEUHHPHHHHHrEHu.HH5 HH&HHiHHH5HǸBHH5H<HHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH51H, HHHuUHH5HHHHHt PHHHHHHHIHH5HEHH.EHtHH }t/UHH$UHH5HUHH0EUHH@H}HuHUHMLEEH}t1HE8u!HuHEHqHEHuHEHWHE}tEHMHUHuHEH&UHH H}uHLHE}uHEH[EuE%EE~eHHEHEHEؾH!HEؾHfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH"UHEHUHEHUHEHEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHH}HEHUHEH UHH H}HuHUHEHH%fH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEHVHEH+EHUHH0H}uHU؋MHEHHvUHEHEEHE}tU} }tEHEH5HIUHEH53UHEHtHEH5jHHEH5RHMHEH=HItHEHE}uHEHnUHEH HEUHEHHHUHEH5HǸg}tCHEH/HEHLuHEH5HǸHUHEHUHH H}HuHUMHEHԿHHEHFH.HUHEHHEHiHEHHMHEHH"HUHEHHEHEHHEHHEHHUHEHS}t&HEHHUHEH'HEHfUHH`H}EH}uH H5H= HEHwE}t}t}t.}}}HEH4HEHEHUHEHѺH HEHEHEHHEHEHUHEHHEHEHEHvHEHEHUHEHHEHEnHEHHEHEH&HEH}E>HEHƿHEHEHtEHEHEUHH0H}HEHwE}u[HEHE}u>HEHHEHEH0HEHEHE}UHHHxHEHxHIHEHxHtHxHEHxHH&HHHEHxHHEH}tHEH'Eԃ}uHEH tE}l}B}ttd}Ԙ}HEH HEH}HEHUHEH HEHIHEH}uHEHUHEtHjHEHHEH}tG/HEHUHEHv'HEH HEHEHa}}ttZ}Ԙ}HEHHEH}HEHUHEHHEHHEH}tvAHEHUHEtHVHEHHEH}t=HEHUHEHLHEHHEHEHA}uAHUHEHѺHHEHEHL}B}ttZ}Ԙ}HEH HEH}HEHUHEH`HEHHEH}HEHUHEtHHEHHEH}tgHEHUHEHGH}t#HUHEHѺHhHEHEHHEHEHHEHH}tQH}t;HxHKHHEHHxH5HHxHH}uHxHUHH@H}EHEHEHEHEHEHBHEYHEH}%HEH}HEHJHEH}HUHMHEHHHEHpHEHlHEH}uJHEHHEH}HUHEHHHEHHEHHEHMHUHuHEIAHQt>HEH1HHEHH E H}t HEH[H}t HEH(EUHHHHEHµHEHH~HH lHUHHHEHEH5^Hv;HH%HHHH~ HH5HmHHHHcHHHHtHHHHHH]t#THEHHEHHHGHHxHEH5H KHHHDž@H@HHѺHHHH~ HH5}HHHxHxtHxHHpH@HHpHjAAHHt9HpHt& HEHpHEtH&HpHB kHEH5H.HHilHHJhHH`~ HH5-HHH`H`tH`HHXhlHXHtMHXHt& HEHXHEHJHXH]6HXHI"HEH5sHqHHKHPHPuHH5)HǸHDžHHHHHHPHHHHHPHHHHt5HHH HEHHHEH(HHH HPHGHUHH5kHǸHH*#HHAHHHHUHHHEHHMHEH5H} HEH},HEH}HEHEHEHEHEHEHEHEHH^HHH HHGHEHHoHHHDHHHHHEHHHHHHHUHHHEHHHHSHHHHH6HEHH^HHH3HHHHHEHHHHHHHDHHHEHHHHKH}HHHH%HEHHMHHH"HHHHHEHHHMHUHuHEHڼH}tHUHMHEHH3unH}tHMHUHuHEHuJHUHEH%{HEHHEHEHHENHEHHEHEHHE!HEH5kHpCHEH}HEH}HDžxHDžpHDžhHDž`HDžXHH3HnHHHHHxHH;HHתHHH|HHHpHHHHH貾HHHHZHhHHHH.HTHHHHH`HH!HH٩HHHbHHHXHHH`HXHEHHugHhHpHxHEH`tBHUHEtHm HEH3HEHHEH HEHHEHEHHE HEH5iHj=HEH} HPHP HDžHHDž@HDž8HDž0HDž(HH'HbHHνHH HHHH/HH˧HHHpHHH@HHHH~H覻HHHHNH8HHsHH"HHHH贼HHH0HHHHͦHHHVHHH(HHH0H(HPHHu{H8H@HHHPHtSHPHEHX HPHkHDžPHEHHE% HPH8HDžPHEHHE HEH5CHA HEHEHEHEHDž HH^HsHHߺHH7HDHH谺HHHHH聺HHcH HHH uHH5HǸHHKH舸HHHH t`HDž8H8HHHH}u HEH8HUHHQHH5HHtMHH5ݣH豸HHH}u HEHHEHH:HHt"HHH5HǸeHHQHHH&HH蒸HHt`HDž0H0HH4HH}u 1HEH0HUHHHH5HHtMHH5{HOHHH}u HEHHEHH:HH虷t"HH\H5 HǸHHHH(HĵHH0HH\t`HDž(H(HHHH}u HEH(HUHH荺HH59HHtMHH5HHHH}u WHEHHEHH:HH7t"HHH5HǸHHHHȠHbHHεHHt`HDž H HHpHH}u mHEH HUHH+HH5ןHHtMHH5H苴HHH}u HEHHEHH:HHմt"HHH5\HǸ?HH+H}tHH5fHǸ THEH}S0HH9H HHHRH}tHUHHH襯H}tkH}tdH HHHMHUHH AH HHHHHHHHHHtHHEHu#HHHEHHEHEHvHEHjHEH^HEHRH HHH5HcHtIHH5˝H3HHHEHHEHHJ3HH5HHtIHH5nHʱHH+HEHHEHHAHH54HHtFHH5HaHHHEHHEHHdHH5ٜH+HtDHH5HHH\HEHHEHHH}thHEHtXH}t;HHpHHEHHH5HHH*HEH'UHSHhH}EEEHEHEEHEHEH5^HHHEHEHtEHEH`E؃}t }tHEH~H虵HEH&HHyHE؃}t }tHEHZHMHEHٯtHEHSEHUHEHѺHHEH}t ӿHEHEHHEЃ}}uT}t3HEHMHUHuHEHjAAHHHUHEHHEHEH-tt~=}t>HEHEH HHMHUHEHjAAHHHEHԸHHEHH2E}t>HEHEHbHHMHUHEHjAAHHHEH*HHEHHXE}t>HEHEHxHHMHUHEHjAAHHHEH@HHEHHE}up}tOH}uHUHEHH`FHEHMHUHuHEHjAAHHHUHEHHXE>HEHMtt`=}t HEH2HHEHH耭HEHHHEHHE}t HEHHHEHHHEHHHEHHE}}t HEHHHEHHHEHHHEHH;E4}tHUHEHHHUHEHHE}t?HUHEHѺH?HEHUHMHEHHEH}t HEHEH]UHH H}HEH5DHݪHHEHEH蚿UHH H}HEEHEHHH&HHEHHuHEHHH&HEH} vUH}HEHE;HEHHH?&9EuHEHHH-&HHE HEH} vHE]UHHPH}HEH5<HթHHEHEH"EHEHEHEHHcHEHHMHEHΕH|EHEH HcHEHHMHEHH?EEHHEHHHEHvMHEHJH}t}t}t.}a}}dBHEHHEH}t5HEHBHHEHHEH5H HEHHEHH:HEHHEH}t5HEHHHEHHEH5HK HEHHEHEHűXHEHdHEH}t5HEHXHHEHHEH5H֣ HEHHEHԑHPHEHHEH}t5HEHHHEHHEH5Ha HEHHEH?H۰qHEHHEH}t5HEHqHHEHHEH5#H HEH1HEHHiUHH`H}HEHEH5H%HHEHUHEHyHEHEHeHmEHEHi~HEH59H轥HHEHEHSHHEHEEHEH;Ẽ}t }tHEHّHDHUHEHH޵HEHEH螶utUHEЉHu^HEHWHEH}HMHUHuHEIHuHUHMHEHH-EHEHHEHEUHH`H}HEHEH5ߎHxHHEHUHEH̲HEHEHHEHEH輤~HEH5HHHEHEHHHEHEEHEH5莟Ẽ}t }tHEH,H藩HUHEHH1HEHEHutUHEЉH u^HEHHEH}HMHUHuHEIHuHUHMHEHHEHEHHHEHlEUHH H}HEH5:HӢHHEHEHPE}t }tHEHCH艨UHEHUHHPH}HEH5HZHHEEHEH=HEH9HEHEHHEHEH$oHEHUHEH趾H}t5HEHHHEHHEH5H HEH^HEHHHEH}HEH5HJHEH}HEHEHEHEHUHH'HUHEHHTHHEHEHEHUHMHEHHHEHEHtQHEHt5HEH蘿HHEHHEH5 H HEHXEHEغ H5ÊHEUHH0H}HEغH5HPHHEHEؾHȠ~HEغH5HHHEHEHEHZ賛E}t }tHEHQH輥HUHEHHVHEH}t5HEؾHjHHEHHEغH5)H HEH*UHH0H}HEؾHFtHEغHHEغH脭H,EHEؾH舟~HEغH5XHܞHHE}HEH{H蠤HUEH։HEH}tOH}t5HEؾHIHHEHHEغH5Hǚ HEH HEؾHUHH H}HEH5H HHEHEHhUHH0H}HEغH5~H͝HHEHEغHEHEHEHyE}uHUHEHHME}uLHEHt5HEؾH*HHEHHEغH5H訙fHEHX}u>HEHֶHEH5H賽HEغHmEUHE؉HCEEUHH@H}HEȺH5XH觜HHEHEHUHEȾHHEHUHEȾHڪHEHUHMHEHHE}HEȉHUHH H}HEH5H HHEHEH6HEHQHEHnUHH H}HEH5TH裛HHEHEHHEHHEHUHH H}HEH5H=HHEHEH HEHHEH袵UHH H}HEH5HךHHEHEHHEHHEH<UHH@H}HEȺH5"HqHHEHEHUHEȾH轨HEEHEHEHEH~HEH}HMHUHuHEIHuHUHMHEHHTEHEHEUHH@H}HEȺH5dH賙HHEHEHUHEȾHHEEHEHEHuHMHUHEIH4~]HEHHEH}HMHUHuHEIH~HUHMHEHHkEHEH3EUHH@H}HEȺH5{HʘHHEHEHUHEȾHHEHEHUHEȾHHEH}HUHMHuHEIHbE}HEȉHUHH@H}HEȺH5̈́HHHEHEHUHEȾHhHEHEHEEHuHMHUHEIH-~]HEHHEH}HMHUHuHEIH~HUHMHEHHԷEHEHEUHHPH}EHEH5H,HHEHEH5tH HHEHEH腗~HEH5UHٖHHEHEHxE܃}uHEHCHu4}ܘuHEH虳HuHEHaH\HEH轴9EtHEHPH)HUHEHHæHEH}HEHXE}HUHEHHhE}HUHEоHVE}urHEH5HHEH}tOHUHMHEHHE}u/HUHMHEHHȵHEȺ!H5H軫HEH}tUHEHUHHĀH}EEHEHEH5LHHHEHUHEH9HEHځHEHEHE}t HHEHUHEHHEȃ}tHEH=wEHE}tlHEHUHEHH_H˪HEHEؾH趤HEHEHMHEHHHUHEHHHMHUHEIȹHUE}HUHMHEHHQE}HEHEHUHEHE}uwHEHHEHEmH5}H2HEHUHMHEHHwE}uHUHMHEHHlHEsH59}H_HEHH}t HEH@}tUHEH)UHHĀH}EEHEHEH5|HvHHEHUHEHʠHEHUHEH豠HEHRHEHEHE}t H9HEHUHEH=HE脼HE}tlHEHUHEHH~HcHEHEؾHNHEHEHMHEHHAHUHEHH~HMHUHEIȹH E}uXHUHMHEHH E}u8HUHMHEHHE}u}HEHLHEHH}t HEHM}tUHEH6UHSHHHEEHE该HEHDžPHDžXHDž`HDžhHDžpHDžxHEHEHEHHH譐t=HHH5dzH HuHHH"}H͕HHHVuE}uEHcHMHEHHHEH}tUHEȉHٰEUHH0H}HEغH5oH>HHEHEHEEHHkHEHUHMHEHHpE}uEHcHMHEHHCHEH}tUHE؉H+EUHHPH}HEH5kH萁HHEHUHEHHEHUHEHˏHEHEHnHOHEEH}DHEHEHDHEAH}HMHUHuHEIIDH舡E}~QH}t5HEH藟HHEHHEH5.nH} HEHWE HEHR}tUHEHۮEUHH@H}HEȺH5mH@HHEHUHEȾH蔎HEHEHHEЉEԋEHHLHEHE؉HMHUHuHEAH臔E}uEHcHMHEHHHEH}tUHEȉHEUHH0H}HEغH5lHgHHEHEHEEHH蔲HEHUHMHEHHyE}uEHcHMHEHHlHEH;}tUHE؉HTEUHH H}HEH5 iH~HHEHEHHHEHUHEHHUHHpH}HEH5hHb~HHEHEH5hHC~HHEEHEH艜yE}} }t,}ttX}HEH谈HEHEH HEH}HUHEHHEHEH*HEHEH身HEH}HUHEHH|EHEHHEHEHHEH}t]HUHEHHEEHEH%HEHEHHEH}t!HUHEHH|E }HEHUHH H}HEH5fH|HHEHEH蒽E}HEHUHH H}HEH&H5fHZHEH&H5hH@HEHHEH5J&HׇHEwHEHHH|&HHEHHsHEH-yHEHHH|&HEHHHEHHEH} vUHH }HuHUH}t3HEHUHMEHΉ}HEu EXHEUHHH}u}y}|HEHvEEUHH H}HuHUMDEHUHEHHEH*{tbHEH褺HUHuHEH AiHyt HEH9HEHHUHEHEЉHEHތUMHEH*UHHH}u}x}~HEH5iHǸHEHiH}uHEHE*EHEH{HEHCHEAH5XhHUHH0H}uUME}t)}t<}UMHEHgUMHEHHEHhHUHEHEUHEHEUHEHHUHEH7HEAH5hHHEH胂EHEHoEHEH5ohHǸRUHH H}uUUHEHEHEHgHUHEH|UHEH+UHHH}uUHEH8xtUUHEH蠘HxH*HHH H*XHEHSyMHEHgH薀UHEH=HxH*HHH H*XHEHxZMHEH6gH6uAUHEHQwHEHHHEH5gHǸ趜UHH0H}uHU؋UHEHYEHUHEHH胪UHEH貙HEHvHEHvUHH0H}uHU؋UHEHEHEHeHHUHEHHHEH{UHEH*UHH0H}uHU؋UHEHvfH~HEH}t=ff.Ez ff.EuUHEHLtHE؉EUHH}]UHH H}uHUEPHEHͧuIH}tHUHEH5geHǸ$HEH5\eHEHEH萄UHH0H}uHU؋UHEHyEHEHodHJHUHEHH HEHqUHEHHEHtHEHtuwHEHHEH迩HUHEHH|HEH6qHEHEUHEH贪UHH H}uHEEHEHXcH3UHEH~HUHEHHEHEHpHEHqHEH'EHEH}uHEHEUHHHhEE EEeHpMHhH9ruDUEЉEHpMHhHrt EEEEE;E|EUHHH}uU}tHEHpt HEH軉HEHupMHEHtHEHѯEPMHEHQtRHEHۻHEH5E`HHEHHEHѮ/HEHIHEHXUHH H}HuHEH}EHUHEH5_HHEHbEHHEHjt/EPHEHcHEH蝮UHEH腮UHHH}HuHEH@t%HEHPHEH5 _HǸߜHEH@+EHhH(TPTHpH`HmHhH+EHhHԪUHH0HHHEfEH@HHtHH,HH胄HEHΉGHEHt(HMHHH5[HǸ6/HUHHHHHg*EHH1lUHH H}HuHUMH}tBHEHEHrHu%HMHUHEH5[HǸ菘EUHH0H}HuHUHEHEHE@t$HE@HEHP HEHHEH@HEHHUHrHUHMHUHH`H}HuHUHMLEEHEHEEHEHEHEHEHEHEHEHP HuHMHEHHEHEHt:HEHt1HE8u!HuHEȹHZH{EHuHEȹHYHZE}tEHMHUHEH5HKUHH0H}HuHUHEHEHE~HEHcHEHHEGHEH@Hףt4HEH@HUHzH*HHEHHEHUHH0HHH@HH+cHHΉHEHHdHHEHuHMHHIH5XHǸޕHHgUHH H}HtXHEHEHEH@HiE}tHEHPHU9EtECHEHHU UHUHLHEuHEHEH@HiUHH H}HuHEHIHEHEE}#u>HEH@HRiE}t} uHEH@H3iHEUHHPHHHHHN}EHu.HH5&WHHo&HHiHHH5VHǸHH5VHHHHuUHH5VHVHHHHtPHƄ Ћ9uqHtgHHH5MVHHHHuUHH5$VHHHHHt PHHHaHHHHIHH5HEHH蛭EHtHH}t/UHHţUHH5;UHUHH֯EUHH@H}HuHUHMLEEH}t1HE8u!HuHEHTHEHuHEHsTHE}tEHMHUHuHEHUHH H}uHhTHE}uHEH[EuE%EE~eHTHEHEPHUHMHHfHEH[UHH H}uHUUHEHEHUHEHHZuUHEH蹥HEHX^HEHG^UHH0H}EHEHEHOH^HEغH5OHHEؾHwHEؾH踀HEؾH]HEؾH]HEؾH,HEغH֒HEغHHEغH5NHQHEHNHfHEؾHoHEؾH.wHEؾHwHEؾHxHEؾH軟HEH诜EHEؾHHEؾH\HEؾHYHEH}dHEؾHHEؾHzHE}t|HEHmHEHHEؾHKvHEؾHxHEؾH٠HEؾHvHEؾHwHEHEؾH虠HEؾH~HEؾH[HEؾHVHEH}tHEHHEHHEH5lHEؾHHEH(HEؾHWuHEؾH&wHEؾH赚HEUHH H}uUHEHZuOUHEHy[fH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHsUHEHsUHEH蜜UHEH苜EmE;E|UHH H}uUEUHEHEHEHop+EE}yEE}E;E}zHEHJH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEH JHUHEHEHUHEHHYoHEHjUHEHUHH H}HuHUHEHHsfH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEH2YHEH+EHUHH0H}uHU؋MHEH,IHR`UHEHiWEEHE}tU} }tEHEH5HHIUHEHq3UHEH{`tHEH5HHHEH5nHHMHEHYHH%}tHEHVE}uHEHJSUHEHrHEUHEH肆HHUHEH5GHǸC}tCHEH̘/HEH(uHEH5GHǸ\{HUHEHRUHH H}HuHUMHEHFHHEHbGH.HUHEHSHEHEUHEH輔HMHEHHġHUHEHH!uHEHQHEHeHEHnHUHEH/^}t&HEHnHUHEH^HEHBUHH H}HEH5EFHSHHEHEH8}UHH H}HEHUHEHѺHHEHtHEH[uUHH H}HEH5EH%SHHEHEHqHEHRUHH H}HEH5aEHRHHEHEHddHcHEHH"jUHH@H}HEȺH5EHRHHEHUHEȾH`HEHEHDHϞEHEȾHRuHEHHEȾH7\EHEHcH0H5DHHEHEЉE}t}HMHUHuEAz}HMHUHuEAWgE}~ EHcHMHEHHEHEغ;H5DHg}tUHEȉHEUHH@H}HEȺH5CH$QHHEHUHEȾHx_HEHEHCHlEHEȾHhQuHEH&HEȾHZEHEHEbHFH5+CHHEHEЉE}t}HMHUHuEAl}HMHUHuEASE}~ EHcHMHEHHEHEغQH5BHsf}tUHEȉH\~EUHSHXH}HEH5JBHOHHEHUHEH^HEHEH3BHȉHEHEHaH[H5AHRHEHEEHEH`E]HEHiHuHMHUHEIIHщH脒Eȃ}uEHMHEHH|HEкdH5wAHKe}tUHEH4}EHX[]UHATSHPH}HEH5AHNHHEHUHEH\HEHUHEH\HEHEH@H耈HEHEEHEEDeȋ]HEHKHMHUHEIEHщH芆EċUHEH6HP[A\]UHHHhHEHEHEHEHEHEHEHDžxHhH5?HhMHHEHMHUHuHEHɆHUHMHEHH2HxHUHuHEHsHhHނHEH^HcHhHHMdHhHt?HVHEHQHcHhHHdHhH=?HVHEHt|HEHsHEH}t;HhH"kHHEHHhH5>HHHhHeHhH>HVHEHt|HEHrHEH}t;HhHjHHEHHhH5_>HHHhHWeHhHE>HUHEHt|HEHwrHEH}t;HhHjHHEHHhH5=HGHhHdHhH=HUHEHt|HEHqHEH}t;HhHiHHEHHhH5U=HGHhHMdHhH?=HTHEHt|HEHmqHEH}t;HhHiHHEHHhH5<HFHhHcHhH<HSHEHt|HEHpHEH}t;HhHhHHEHHhH5K<HFHhHCcHhH9<HxSHEHt|HEHcpHEH}t;HhHhHHEHHhH5;HEHhHbHhH;HRHxHtHxHoHEH}t;HhHygHHEHHhH5;;HDHhH3bHhH3;HhRUHH@H}HUHEȾHVHEHEȾHHtHEȾH%REHEHEЃ}tHEHHEHƿENHEHHEHƿ+[HEEH}tOH}t5HEȾHafHHEHHEȺH59HC HEH!aEEUHHPH}HEH59H1GHHEHEHGuHEHgHEHQEfHՈHEE}tHUHEHHGHUHEHHlE܃}~?HUHEHѺHIHEHUHMHEHHEHEHHmEUHH0H}EHEغH58H(FHHEHEغH58H FHHEHEHFHEH}t*HUHEHH(EUHE؉H4tEEUHH@H}HEȺHKEHEȺHKEHEȾHE~HEȺH5,8HQEHHEEuHEH}tHEHj]HE؋EHcHEHHtHUuHEعHXYE}uJH}t5HEȾHcHHEHHEȺH5/7HA!HEHW^HEHnEHEHFyEUHH H}HuEHEH^H}tKHEH軎HHEHHdHEHAHUHEHHp[EEUHH H}uUHEHct6UHEHRE}HMHEH6HI,UHEH56HCHHEHEHUEEUHHĀH}HUHEHQHEHEH豏EHEH&EEH H55HHEE}EHH6HH5HHEHSHEHLE܃}t!HEHUuHEH rEFHEHUuHEHo?E%HEHUuHEH.EHUHEHѺHXHEHEHBu4HEAHEHMHUuHEEIȉHqEHEH{HEHEH0BtHEH{HEHEAHEHMHUuHEuuEIȉH\HE HEHUuHEH"bEHEH53HAHHEHEH%{HEHEH`AtHEHzHEHEHHFEHEHsJHcHEH9tHEHd3HOFDEH}HMHUHuHEEIHcE}uEHcHMHEHHHEvHEHEVH52HUVEUHHĀH}HUHEH/NHEHEH%EHEHEEH`H52HeHEE}XEHH2HH2HHEHwOHEH6IE܃}t)HENjMHUuHEAȉHtEHENjMHUuHEAȉH]EHUHEHѺH>UHEHEH?uCHEAHEAH}ЋMHUuHEHAPIADHHE:HEHkxHEHEH>tHEH;xHEHEAHEAH}ЋMHUuHEHuuAPIADH蓄H EHENjMHUuHEAȉHEvHENjMHUuHEAȉHHEH@H(E}t} uHEH@H(HEUHHPHHHHH<EHu.HH5HH/&HHiHHH5HǸSHH5HQHHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5?HKHHHuUHH5HHHHHt PHHH,!HHHHIHH5HEHH-mEHtHHH}t/UHHWcUHH5-HUHHhoEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHeHE}tEHMHUHuHEHvdUHH H}uHZHE}uHEH[EuE%EE~eHHEHE&HEH8UHH H}uHUUHEHEHUHEHH4UHEHKeHEHHEHUHH0H}EHEHEHqH^HEغH5uHHEؾH7HEؾHJ@HEؾHYHEؾHHHEؾH\HEغHhRHEغHRRHEغH5HQHEHHR&HEؾHfHEؾH6HEؾH6HEؾH~8HEؾHM_HEHA\EHEؾH=?HEؾHLHEؾHTHEH}dHEؾH[HEؾHJ:HE}t|HEH,HEH[HEؾH5HEؾH7HEؾHk`HEؾH5HEؾHy7HEHEؾH+`HEؾH:>HEؾHIHEؾHSHEH}tHEHHEHHEH+HEؾHZHEHZHEؾH4HEؾH6HEؾHGZHEUHH H}uUHEHuOUHEH fH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH3UHEH3UHEH.\UHEH\EmE;E|UHH H}uUEUHEHEHEH0+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHH.HEH**UHEHyNUHH H}HuHUHEHH2fH~HEHEH9Etj HEHHEHEt'?HHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHHUHEHEEHE}tU} }tEHEH5 HIUHEH03UHEH tHEH5x HHEH5` HMHEHK HMHE؉HEE}uFUHEȉH t0UHEȉHtUHEȉHE}}tHEH HEH^H}t5HEȾHHHEHHEȺH5HT HEHHUHEHHSEHEȾHRHMHEHUHH0HEHUHUHEHH"UHEȉH+UHHPH}HEH5H;HHEHEH HEHEHtHEHEHEHhtHEHbE؃}tHEHA HEHC&HEH}E}tIHEHUHEHѺnHRE}uHEȹ!Hn}t7HEH HEHUHEHѺvHHEHE HUHEHѺdHE}uOH}t5HEHHHEHHEH53H HEHC,UHEH)HEHM"HEUHH H}HEH5H*HHEHEHt%HEHIEUHEHHEHEEHcHEHH4UHH0H}HEغH5HHHEHEH)HEؾHHE}t$EtHEH6H1HEؾHt0HEؾHtHEH%HHEؾHvuEHEؾHpHMHEHHHMHEH&H>HEHPHMHEHHHfMHEH@&H~EHEHa@EEHcHEHHE}u2HEH5HHEغHvEEHEH5H|HEغH6EEt-HEH5{HEHEغHEEt-HEH5IHHEغHEEUHH H}HEH5HHHEHEHtFHEH}t0HEHgtHEHHHEH6uGHEH0HMHEHHHfHUHEH G&HH<)sHEHuGHEHHMHEHHH HUHEH &HH(HEH(UHH`H}HEH5%HHHEHEH4HEHEHEH)HEHEHEHEEUHEHOHEHHUHEHHEHEH$6H}uHHEHEH=vH~HEHUHEHH9Ew,HeHUHEHH9EvHUHEHHX5HEH}u HFHEQHMHEHPHUHUHЉʈHUHMHEHHEHHHEHEEE;EH}u(HEHMHEHH:t HHEHEH4"H}t4HUHEHHǸHEH5HǸUHH}uHU؉MERE-UEHcHEHEHcHEH8uEE;E|E;EuEEE+E9E~]UHHpH}HuHUHMDELMHEHEEHEHHEH}HMHEHHHHEHNdEEHEHq)`EPUHcHEHE܋EHcЋEHcHEHHEHHHEPUHM¾H5EEE9EwHEH\uoHUHEHsHEH}HEȉuHUHEHE}t`EHcHEHHEHHEȉHEE7HEHHH%HH5HǸ+HEHq2EUHH H}HEH5H(HHEHEHuDHEH HMHEHHHHUHEH5H>HEH>UHH@H}HuHUHEHEHEHEHHEHEؾH HEH}u HMHEHtHHAHEHuUHUHEHHEHHEH5FH褵HEHEH0tHUHEHHcHEHHEHuHEH5H-HEHEH4&H}tHUHEHHUHH H}HEH5oHHHEHEH~t0HEHhtHEHHHEHG HMHEHHH}HEH5He*HUHEHѺ6HUHH0H}HuHEH5HEHEHpHEHMHEHHHEHXH}t5HEH HHEHHEH5lH. HEHpHUHEHH-6H}t5HEHU HHEHHEH5H HEHHEHE}t@HEHHHi%HH5oHǸ&EBHEHpuHEHHEH EHEH-EUHSHXH}HuUHMHEHuHEHEHHEHEHMHEغHHHEHH}t5HEؾH HHEHHEغH5Hf HEHHUHEHHe4EHcHMHEHHHEعHEԃ}tRHEغHHH%HH5HǸ%HEؾHp,HEؾH.tLHEHUHEؾHHEHEHEHcHEHƿHEHEغH5FH蔰HEH}t HEsHEؾH5t^HEغH HHEؾHHE؉HHH%HHH5HǸ#HEؾHR+HEHX[]UHH0H}HuEHEHEؾHGHEHMHEHH{HUHEHHHEEHMHEHHHEHE}tHHEHHH%HH5FHǸ"HEH`*UHH H}HEH5HHHEHEH~RHEH7HEHvHMHEHH>HEH5bHK HEH*~RHEHHEHHMHEHHHEH5HHEH~RHEHiHEHHMHEHHpHEH5H}HEHlUHH H}HEH5 HHHEHEH7HEHUHEHHUHH@H}HEȺH5HGHHEHEȾH)tKHUHEȾHHEHEЉHMHEHHY'EUHEȉHUHEȺH5AHHHEHEȾH@tHEȾH:E}tHUHEHHEHUHEHHEUHEȉHUHH0H}HEغH5H%HHEHEHEHE}HEؾHt8HEؾHg5HEHUHE,HyHEE2uHELH I&H0EEHH EEE;E~HUHE,HHEHE-HHEHEغHEH}uFHEH5HHEغHaEUHEؾH5HE%HtAHEH5HSHEغH EUHEؾHuHEHuFHEH5wHHEغHEUHEؾH'HEHtCHEH5*HHEغHmEUHEؾHMHEHtAHEH5HdHEغHEUHEؾHHE%H=uFHEH5HHEغHEUHEؾH4HE%HtCHEH5OHHEغHxEUHEؾHOHE%HtAHEH5HmHEغH'EUHEؾHUHH H}HEH5HdHHEHEHt*HEH1HEHUHEHHOHEH'HEHUHEHHjUHH H}HEH5}HHHEHEHHEH}HEH'HMHEHHHUHH H}HEH5HZHHEHEHtHHEH0EEHcHEHHEEHcHEHHl)HEHI&EEHcHEHHAUHH H}HEH5HHHEHEHtHHEH0EEHcHEHH`EEHcHEHH)HEHEEHcHEHHUHH H}HEH5kHHHEHEH)UHH H}HEH5-HHHEHEH!!HEHEH!H}t5HEHIHHEHHEH5,H HEH UHH@H}HEȺH5HHHEHEȾHu6HUHEHHHEEHMHEHHKHUHEȾH&HEHE؉HMHEHHYEUHEȉH$UHH H}HEH5HZHHEHEH'EUHEHHUHH0H}HEغH5HHHEHEؾHtHEؾHyEH HE}tHUHEHHHUHEHHA%HHUHEHѺsHlHEHHEHHHEHHEHEH2UHH H}HEH5HHHEHEHEUHEH@#UHH H}HEH5>HHHEHEHbEUHEH"UHH H}HEH5!HsHHEHEHHEH"UHH0H}HEغH5H%HHEHEغH5HHHEHEغH5HHHEHUHEHH}E}u+HUHEHH!E}uHEHEUHE؉H UHH0H}HEغH5HbHHEHEH%HEHEHHEH}t5HEؾHHHEHHEغH5Hq HEHH}tHUHEHH UHH H}HEH5UHHHEHEHdHUHEHH1UHH0H}HEغH5HVHHEHEHEHE}u HHE7}u HHE$}u HHE}u HHEHUHEHHHEغHEEHcHEHH UHH H}HEH53HHHEHEHHEH}t6HEH;HHEHHHEH HEHUHH@ HHH5HHHEHEHHEH}&HHHHHEHEHHHHH'HHMHH%HSEHEHHHHHHHMHHtHEHEHHHH0MHH0HHUHEHHEEEHcHHHMHH<HeEEHcHHHMHHH+EHHE HHHHHHHHKMHHHUHH H}HEH5,H~HHEHEH %HcHEHHUHH0H}HuU܋UHEHnE}EHHOHHCHHEH=EHcHEHHHHEHHEH!HEH`HEH5H=HEHsHEHHEH5LHHEH4HEHrHEH5HHEHyHEH3HEH5HHEH:HEHiHEH5HFHEHHEHHEH5H HEHCHEHHEH5WHHEHUHH H}HEH5HHHEHEHHcHEHHUHH H}HEH52HHHEHEHHEHUHHP HHH5H-HHEHHEEMHH_HEHEH5DH u&HEHHcHHH#pHEH5 H u&HEH;HcHHH3HEH5H^ u&HEHHcHHHHEH5H! u+HEHHEHUHHHHEH5eH u$HEHHH yHEH55H ueHHHHHE HHHHHH HHHEH5H( uDHEHHHHHHHeHEH5Hu&HEH=HcHHHeHEH5Hu&HEH@HcHHH(HEH5HSu?HEH3HHHHHHHEH5Hu?HEHHHHHHH?|HEH5rHu?HEHgHHHH2HH&HEH5*HQu?HEH!HHHHHHHEH5Hu?HEH[HHHHHH=zHEH5Hu&HEHHcHHH=HEH5]Hhu&HEHHHHHHEH50H+HEHHEH}teHEHH}t>HHHHEHHH5H0}HHliHHXUHEH5Hu+HEHHEHUHHHHEH5]H>u%HEH>HHHHEH5'HuAHEHHHHHHH?HEH5HuMHEH* t HHHHH$HHMHHsH.EE;E&EUHH`H}HEH5HHHEHEHEEEgMHEH3HEHEH5Hu,EPHEH$HEHEHEH5Hiu,EPHEHHEH!EHEH5H&u,EPHEHHEHEgHEH5'Hu;EPHEH5HHHEHUHEHHEHEH5Hu-EPHEHEԋUHEHe HEH5HMu8EHHEHHEHUHEHHEHEH5Hu-EPHEHvEċUHEH>HEH5Hu0EPHEH2EUHEH>EHEH5Hsu0EPHEHEUHEHEHEH5=H,u.EPHEHEEHcHEHHkHEH5 HuUHH0H}uHU؋UHEHHEHEHHIH}tUHEHcuiEHUHEHHEHkHEHEHEH}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhH²t EEEEE;E|EUHHH}uU}tHEHdt HEHyHEH3MHEHtHEHEPMHEHQtRHEHHEH5÷HHEHHEH/HEHHEHUHH H}HuHEH;EHUHEH55HHEH EHHEHjt/EPHEHcHEH[UHEHCUHHH}HuHEH@t%HEHPHEH5HǸHEH@HEH@HE}t} uHEH@HHEUHHPHHHHH EHu.HH5HHJ%HHiHHH5{HǸHH5dHHHHuUHH5:HVHHHHtPHƄ Ћ9uqHtgHHH5˭HHHHuUHH5HHHHHt PHHHXHHHHIHH5HEHHYEHtHH=}t/UHHUHH5HUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEH HEHuHEHHE}tEHMHUHuHEHUHH H}uHHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH輴UHEH諴UHEHZUHEHIEmE;E|UHH H}uUEUHEHEHEH-+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHHHEHVUHEHUHH H}HuHUHEHH迳fH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHHUHEH'EEHE}tU} }tEHEH5HHIUHEHϱ3UHEH9tHEH5HHEH5HMHEHןHtHEH>E}uHEHUHEH襳HEUHEH@HHUHEH5_HǸ}tCHEH/HEHuHEH5HǸHUHEHbUHH H}HuHUMHEHnHHEHH.HUHEH蔔HEHHEHzHMHEHHHUHEHHߵHEH虒HEH#HEH蒯HUHEH}t&HEHfHUHEHHEHUHHH}HuHUHEH-HEHu+HEH-HUHEH\HEHGUHHH}HuHEHĭHUHEHUHH H}HuHUHUHEHtHUHEHH\HEHHEH%HEHHEHUHH H}HuHUHUHEHHEH貓t\HUHEHH軳HEHuHEHTHEHcHEH"HEHAUHH H}HuUHUHEHHEH@HQE}t} uHEH@H2HEUHHPHHHHHMEHu.HH5HH%HHiHHH5|HǸHH5eHHHHuUHH5;HVHHHHtPHƄ Ћ9uqHtgHHH5̆HHHHuUHH5HHHHHt PHHHwHHHHIHH5HEHHEHtHH~}t/UHHĹUHH5HUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEH HEHuHEHHE}tEHMHUHuHEHUHH H}uHHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHUHEHUHEH蛲UHEH芲EmE;E|UHH H}uUEUHEHEHEHn+EE}yEE}E;E}zHEH{H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHzHUHEHEHUHEHHXHEH藀UHEHUHH H}HuHUHEHHfH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEH1oHEH+EHUHH0H}uHU؋MHEHyHQvUHEHhmEEHE}tU} }tEHEH5IyHIUHEH3UHEHzvtHEH5yHHEH5xHMHEHxH$tHEHlE}uHEHIiUHEHHEUHEH聜HHUHEH5`xHǸB}tCHEHˮ/HEH'uHEH5 xHǸ[HUHEHhUHH H}HuHUMHEHowHHEHwH.HUHEHiHEHDkHEH軪HMHEHH÷HUHEHH HEHgHEHdHEHӄHUHEH.t}t&HEH规HUHEHtHEHAUHH0H}HuHEغH蘟EHEЋHcHEHH MHEHvHsEHEЋ@HcHEHHрMHEH]vHYsEHEЋ@HcHEHH虀MHEH+vH!sEHEHPHEHH裉HEغH]fMHEHuHrEHEHP HEHHWHEغHfMHEHuHrUHHPH}HEHhE}t&}t }tHEH]uHnEHEHhuwcEHEHʝEeHEH5ciH{HEHXHEHhHdHEH貐HEH@HHEHHHEHhHdHEH@HHHEHHˣHEHhHsdHEHhH[dHEH5hHzHEHWHEH hHdHEHPHEHH~HEHQhHcHEH59hHszHEH-WHEHgHcAHEH5hH0zHEHVHEHSgHbcUHH H}HuHUM}uHEHUHEHEH}HEH gHEHEH5gHYH}t5HEHwHHEHHEH5QgHU HEHGr}tEHUHtH}tVHEH5gHHEHcHEHHHEHH}tEHUHt}UHH0H}HuHU؉MEtHEH}HE@H rHMHUHuHEHluD}~UHEHIyHEH rE}u EHEHpEHEH谥HEH脓EUHH@H}HEȺH5dHWHHEHEHa%HHeH{wEHEEvH輘HE}uHUHEHHHUHEHHZE}tBHUHEHѺsHtYHEHHEHHHEHHEHEH3}EUHHHXHXH5cHVHHEHXHVuHEH|HXH_EHXH蓋EHEHPHHXHHlMHXHIdH_HEH}HHXHH/yHXHdHD_HEHzHHXHHxHXHcH_HEHEEHcHMHXHHMHXH$bH]EHEHyHXH3MHXHaH\HXH菈EE9HEHEHIxEHEHTHEUMHEHBE}t3EHXH莗HUMHXH6\E}9EqHXH aH \HEH}VE}HXH5`HzrHXH1OHXHxEUHEHˍHEHEHfHEEHcHXHHhH}t;HXHpHHEHHXH5B`H|MHXHjHXHgmEE;EKHXHCmUHH H}HEH5(^HPHHEHEHaUHH0H}HEغH5]HZPHHEHEؾHPu_HEH豑HEH}t5HEؾHnHHEHHEغH5@_HcL HEHiFHEغH5_HOHHEHUHEHHcEUHE؉H~UHSHXH}HEH5]HqOHHEHEH5^HbHtLHEH5^H5OHHEHUHEHHfHEH[<HEH5G^HNHHEHEHaO~HEH茕HEEEHEH"OtLHEH]HeHxE}xEHEH}t HEEMHUHuHEH*EH}t)HX%HwHHEHZHH7}HEH/EHcHEHH:eHX[]UHH H}uHU}}y}}t[}HEH軒H}HUHEHHmHEHJEHEHjEHEHfHEH5_\HtEHEHfHE H5=\HIEHEHlfEHcHEHHdEEUHH@H}HEȺH5YHdLHHEHUHEȾHZHEHEȺHREHEMHUH}HuHEIHuEHU؋MHEȉH/EHEغH5Z[HBbEUHH0H}HEغH59YHKHHEHUHEؾHYHEHEغHQEMHUHuHEH_EMHEغHUHH0H}HEغH5XHKHHEHEغHmYHEHEغHCQEUHMHEHHfEMHEغHUHSH8H}ȉuċUHEȉHKtMHEH ZHaPiHEUHEȉHJUHEȉHZkEEEPMHEȉH$QHEȾHJHEȺH5{WHIHHEHEHhnHEHHHEHHHbeHEȾHEE;EfHEH8[]UHH H}HuEEHEH2HEH萷HWEEHEHmH‹EHzHEHEHmH}t5HEHgHHEHHEH5YVH9E HEH{bEPHEHgEE;EeUHH0H}HEغH5UHiHHHEHEؾHHu%HEHoHEHUHEHH lFHEغH5UHHHHEHUHEHHEUHE؉HQvUHH0H}HEغH5KUHGHHEHEؾH3Hu%HEHrlHEHUHEHH[kFHEغH5UHaGHHEHUHEHHWUEUHE؉HuUHHpH}HEH5TH GHHEHEHVH.HEHMHUHuHEH2wE}uEHMHEHH;}tUHEH uEUHH@H}HEȺH5SHoFHHEHEȾHFu(HEHfHHEȺHHHEEHEȾH ft8HEȺHHEsHEHUHEHH谁dHEȾH荇tOHEȺH#CHEsHEHUHEHHOtHEH肃HEH}t$HUHEHH oEHEHQEUHEȉHsUHH@H}HEȺH5RHEHHEHEȾHyEu(HEHȄHHEȺHHHEEHEȾHdt8HEȺHoHEirHEHUHEHHBdHEȾHtOHEȺHAHErHEHUHEHHNtHEHHEH}t$HUHEHHnEHEHEUHEȉH)rUHHPH}HEH5#QHCHHEEHEHDHEHEHweHEH;HHEHHCx)HEHIHHEHHwCHEHIHEH HHEHH&HEH躂HHEHHEHEH+ZHEHHEHEHaHHEHHBx)HEHoHHEHHBHEHoHEH3HHEHHLHEHHHEHH)EHEHQYHEHHEHEHuHEooHEfoHEHUHEHH?}HUHEHH,}HUHEHH kE}uHUHEHHkEHEHHEHUHEHaoEEUHHPH}HEH5UNH@HHEHEHyHEHEH-AHEHJE}tHMHEHH貉HEH\qHEH}t8HEH_HHEHHEH5MH~HHEHEH>u+HEHkEEHcHEHHU=HEH謌EEHcHEHHHEUHEH`lUHSHHH}HEH5YKH=HHEHEHeHEEHEH*>u*H}hHUHEHHgAEIHEH:HEH}HEH賫HKE̋ẼELHEH葫H‹EH}nHEHEH==HEHsH‹EH9m}yHEHMHdEHEH$HHKEUHH0H}uHU؋UHEHyEHEH'IHJHUHEHHNHEH]+UHEHuHEHK.HEH:.uwHEHmHEHWcHUHEHHNHEH*HEHGUHEHLdUHH H}uHEEHEHHH3UHEH~HUHEHHEHEHlEuHEH5jHHǸRHEUHH0H}HuU܋E܍HHEHSHHHEHHEHHLHEH)EEЉHEHFEE;E|HEHHUHEHH,y+E܉HEHbHEHEHHcEЉHEHkUHHH}HuHEHFHHUHEHz*HEH+HEHuUHH0H}uHU؋UHEHadHEHEH&FHIH}tUHEH=BuiEHUHEH)HEHE+HEH:EHEHj}uHEHEUHHHhEE EEeHpMHhH+uDUEЉEHpMHhH+t EEEEE;E|EUHHH}uU}tHEH>*t HEHSCHEH *MHEH~9tHEHiiEPMHEHQtRHEHsuHEH5DHHEH;HEHih/HEHhHEHkUHH H}HuHEH@EHUHEH5oDHXHEHBEHHEHjt/EPHEHcHEH5hUHEHhUHHH}HuHEH@t%HEHPHEH5CHǸwVHEH@EH`HE}~ EHXt"HXHhH5BHǸUHhH5cBHT;Eu,HhH5IBH E THpH`H5!BHUHpHP8HhH5BHǸnTE~UHhH5AHǸITHhH5AH_ HpHhHH_HhH<+EHhHdTPTHpH`H&HhH<+EHhHldUHH0HHHEM EH@HHtHHiHH>HEHΉGHEHt(HMHHH5t@HǸR/HUHHHDHH]!*EHH%UHH H}HuHUMH}tBHEHEHL,Hu%HMHUHEH5?HǸ'REUHH0H}HuHUHEHEHE@t$HE@HEHP HEHHEH@HEHHUHrHUHMHUHH`H}HuHUHMLEEHEHEEHEHEHEHEHEHEHEHP HuHMHEHHEHEHt:HEHt1HE8u!HuHEȹH>H{EHuHEȹH>HZE}tEHMHUHEH5H@UHH0H}HuHUHEHEHE~HEHcHEHHEGHEH@Ho]t4HEH@HUHzH[HHEHHEHUHH0HHH@HHHHΉHEHHkHHEHuHMHHIH5Y=HǸvOHHlUHH H}H,=HEHEHEH@H#E}tHEHPHU9EtECHEHHU UHUHLHEuHEHEH@H/#UHH H}HuHEHIHEHEE}#u>HEH@H"E}t} uHEH@H"HEUHHPHHHHH6EHu.HH5;HH$)%HHiHHH5;HǸMHH5;HKHHHuUHH5t;HVHHHHtPHƄ Ћ9uqHtgHHH5;HEHHHuUHH5:HHHHHt PHHH2HHHHIHH5HEHH3gEHtHHB}t/UHH]]UHH59HUHHniEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHE9HEHuHEH+9HE}tEHMHUHuHEH|^UHH H}uH 9HE}uHEH[EuE%EE~eH8HEHEUHH H}uHUUHEHEHUHEHH.UHEHQ_HEHHEHUHH0H}EHEHEH74H^HEغH5;4HHEؾH1HEؾHP:HEؾH_HEؾHNHEؾHVHEغHnLHEغHXLHEغH53HQHEH3HX HEؾH`HEؾH0HEؾH0HEؾH2HEؾHSYHEHGVEHEؾHC9HEؾHRHEؾHNHEH}dHEؾHUHEؾHP4HE}t|HEH&HEHUHEؾH/HEؾH1HEؾHqZHEؾH/HEؾH1HEHEؾH1ZHEؾH@8HEؾHOHEؾHMHEH}tHEHHEHHEH%HEؾHTHEHTHEؾH.HEؾH0HEؾHMTHEUHH H}uUHEHuOUHEHfH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH-UHEH-UHEH4VUHEH#VEmE;E|UHH H}uUEUHEHEHEH*+EE}yEE}E;E}zHEHU/H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEH.HUHEHEHUHEHH(HEH0$UHEHHUHH H}HuHUHEHH,fH~HEHEH9Etj HEHHEHEt'9HHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEH-HUHEHEEHE}tU} }tEHEH5-HIUHEH*3UHEHtHEH5>-HHEH5&-HMHEH-H6tHEHE}uHEH UHEH,HEUHEH@HHUHEH5,HǸ=}tCHEHdR/HEHPuHEH5Y,HǸ4HUHEH< UHH H}HuHUMHEH+HHEH,H.HUHEHn HEHHEHTNHMHEHH\[HUHEHH.HEHs HEH@HEHl(HUHEH}t&HEH@(HUHEHHEHPUHH H}HEHEHHEHVHEH}t5HEH+HHEHHEH5*Hi HEH&UHH H}HuHEHBHEHHHEHH0FHEH\*HHEHVE}HEH9BECUHEH?HEHUHEHHhMEPHEH+EE;E|HEH)HUHH H}HEH5l)H HHEHUHEHHUHH H}HEH5,)H HHEHEH*HEH}t5HEH#*HHEHHEH5(H HEH$UHH H}HEH5(H HHEHEHE UHHPH}HEH5d(H HHEHEH2 u\HEHYEHUHEHHEHEȉHUuHEHSEUHEH8`HEHXEHEHXE܋U܋uHEH;HEHMHEHH6SUHH0H}HEغH5e'H HHEHEغHEUHEHHEH}tHUHEHHJUHH0H}HEغH5&H: HHEHEؾH u*HEHqHEHUHEHHBMHEغHHEHUHEHH&2EHEHg.UHE؉H7UHHPH}HuUHEHEHEHEMHEH*&HiHEȾHHEȺHrHEHEȾH=HMHEH%HHEȾHHEȾHsVEHEȾHGMHEH%HHEȾH6HEȾHeItHUHEȾHHEEHEȺH5R%HHEH}t"HEHwOHEHEHgPHHEHEȾH@GH}t"HE؉HMUHuHEAH2HEH,UHSH8H}ȉuċUHEȉHStMHEH$H QHEUHEȉHUHEȉH'EEEPMHEȉHY HEȾHHEȺH5#H HHEHEH$HEHEHHHEHHH!HEȾHEEE;EbHEH8[]UHH H}HuEEHEHc;HEHHEEHEHH‹EH6HEHEH#HEH}t5HEH#HHEHHEH5"Hf HEHEPHEH#EE;EaUHHH}HEHr%H5>"HHEH^:HEH5>r%HUHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH0H}HuU܋UHMHEHHHEH}t HEHUHH }HuHUH}t3HEHUHMEHΉHEu E HEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHdtbHEHBHUHuHEH HDt HEHsHEH"HUHEHEЉHEHUMHEHd5UHHH}u}x}~HEH5K!HǸ.(HEHW!H}uHEH*EHEHHEH}HEAH5HUHH0H}uUME}t)}t<}UMHEHEUMHEHH HEH| HUHEHEUHEHEUHEHUHEHqHEAH5& HHEH EHEH@EHEH5 HǸ&UHH H}uUUHEHEHEHHUHEHUHEHeCUHHH}uUHEHrtUUHEH HxH*HHH H*XHEHMHEH0HUHEHw HxH*HHH H*XHEH*ZMHEHHpuAUHEHHEHHHEH5HǸ$UHH0H}uHU؋UHEHYEHUHEHH2UHEH!HEHHEHUHH0H}uHU؋UHEHEHEHzHHUHEHH62HEHUHEHdUHH0H}uHU؋UHEHfH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEH0uIH}tHUHEH5HǸ0#$HEH5HEHEH UHH0H}uHU؋UHEHyEHEH HJHUHEHHEHEHUHEHNDHEHHEHuwHEHOt EEEEE;E|EUHHH}uU}tHEHt HEHHEHMHEH tHEH 8EPMHEHQtRHEHDHEH5HHEHL HEH 7/HEH7HEH:UHH H}HuHEHEHUHEH5QH-'HEHEHHEHjt/EPHEHcHEH6UHEH6UHHH}HuHEH@t%HEHPHEH5HǸ%HEH@HEH@HE}t} uHEH@HmHEUHHPHHHHHEHu.HH5HH$HHiHHH5HǸXHH5HRHHHuUHH5VHVHHHHtPHƄ Ћ9uqHtgHHH5 HBHHHuUHH5 HHHHHt PHHHHHHHIHH5HEHH5EHtHH}t/UHH+UHH5 HUHH8EUHH@H}HuHUHMLEEH}t1HE8u!HuHEH' HEHuHEH HE}tEHMHUHuHEH-UHH H}uH HE}uHEH[EuE%EE~eH HEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH8UHEH'UHEH$UHEH$EmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEH7H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHHHEHUHEH!UHH H}HuHUHEHH;fH~HEHEH9Etj HEHHEHEt'*HHEHH% uHEuEHEHlHEH+EHUHH0H}uHU؋MHEHHUHEHEEHE}tU} }tEHEH5dHIUHEHK3UHEHtHEH5 HHEH5HMHEHH_tHEHE}uHEHUHEH!HEUHEHHHUHEH5{HǸ} }tCHEH!/HEHbuHEH5;HǸHUHEHUHH H}HuHUMHEHHHEHH.HUHEHHEHHEHHMHEHH)HUHEHH[HEHHEHHEHHUHEHi}t&HEHHUHEH=HEH|UHSHxH}uUEHEHEHEEMHEHHHEHGHEHHEHEHEHEH2HEHMHEHLHiHEHHEHtHEHBEHEH'MHEHHHEHnHEHHUHEH0HEHEH}HEĉHEH}HEHEHHEHEH@HHt?H}t8HEH H~KHEH@HHUHMHHE+HEH@8HtHEH@8HUHMHHEH}t)H$HHHEHHHH}HEHEH@Ht;HEHEH@HHMHEHH'E܃}yiHE_HEH@(HUHЉE܋EHZH5,H"HEHEHt HEHEHEH@(HMHUHHHEHt>lHEHMUHEHHHEeH5H*HEHEH@HtHEH@HHEHHcHEH@HUHPHEHEHMHEHH 'HEHEHMHEHHH}t/HMU؋EĉƿHEHEHHEEĉ2 HHUHEHHH5HǸqHEH5HHEH}t1HMU؋Eĉƿ=HEHEHHEHEHH:Hx[]UHH H}HEEEHEHVHEHtHEHEUHEHHEH}tOH}t5HEHuHHEHHEH5 H HEH5EEUHH0H}EHUHEؾHHEHEHHEHƿHEH}tOH}t5HEؾHHHEHHEغH5gHP HEHEEUHH@H}EHEȾH2ME HEȺH] E EHHHEHEȺH! EHHEHHHEȺHHEHHE]HHEHHHEȺHEHEHVHEHcHEHHHEH/HEPHEȾHiEE;EEHEȺH5HEHtKHEȺH5HHHEHEHUEUHEȉHAEEHEȺHHEH}tpHEHEHEHRE EHHH9EtEE vE HEȉHEUHSHHH}HuHEH;HEHEH;EHEHHUHEHH HEHHHEH[HHEHHHEHHEHEH HEHMHEHTHq}UHEHHEH}HUHEHH HEHHEHHEENHEHH‹EHGHEHUHEHH`EPHEHEE;E|HEHH}$HHHEHqHHHH[]UHH H}HEH5H/HHEHUHEHHUHH H}HEH5vHHHEHEHlHEH}t5HEHHHEHHEH5%H HEHPUHH0H}HEغH5HeHHEHEHUHEHHE}~1EHcHMHEHHpHE|H5 Hy}UHH H}HEH5`HHHEHEHUHH0H}HEغH5"HHHEHEؾHu*HEHHEHUHEHHMHEغH~HEHUHEHHEHEHUHE؉HwUHH H}HEH5hHHHEHEHYu#HEH8HEH5HEHHEH`EUHEHUHHPH}EHEH5H?HHEHEHu4HEH HEHMHEHHJE<HEHHUHEH@HEHEH;tHEH%E܋E܉HEHEHMHEHH$uHUHEHHEHEHUHEHEuHEH5HHHHEHEH\tHEHHHUHEHHyEUHEH%EEUHSH8H}ȉuċUHEȉHtMHEHH_gHEUHEȉHUHEȉHXEEEPMHEȉH"HEȾHHEȺH5pHHHEHEHfHEHEHgHHEHtHH\HEȾH EE;EbHEH8[]UHH H}HuEEHEH,HEHHEEHEHH‹EH}HEHEHHEH}t5HEHHHEHHEH5FH/ HEHqEPHEHEE;EaUHHH}HEH9%H5H}HEH'HEH58%HUHH}HE]UHH}HE]UHH}HE]UHH }HuHUH}t3HEHUHMEHΉHEu EHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHtbHEH? HUHuHEH H t HEHHEHHUHEHEЉHEHyUMHEHUHHH}u}x}~HEH5 HǸHEHH}uHEH*EHEH/HEHHEAH5HUHH0H}uUME}t)}t<}UMHEH UMHEHHEH=HUHEHEUHEHEUHEHUHEHHEAH5HHEHEHEH EHEH5HǸUHH H}uUUHEHEHEHIHUHEHUHEH UHHH}uUHEHtUUHEH;HxH*HHH H*XHEHMHEHH1UHEHHxH*HHH H*XHEHZMHEHHuAUHEHHEH|HHEH5^HǸQUHH0H}uHU؋UHEHYEHUHEHHUHEHMHEH\HEHKUHH0H}uHU؋UHEHEHEH;HHUHEHHHEHUHEHUHH0H}uHU؋UHEH>fH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEHhuIH}tHUHEH5HǸ$HEH5HEHEH+UHH0H}uHU؋UHEHyEHEHHJHUHEHHHEH`UHEH HEHNHEH=uwHEHHEHZHUHEHHHEHѿHEHUHEHOUHH H}uHEEHEHH3UHEH~HUHEHHEHEHEuHEH5 HǸHEUHH0H}HuU܋E܍HHEHHHEHHEHHHEH賾EEЉHEHEE;E|HEHHUHEHH/+E܉HEHHEHEHHcEЉHEHUHHH}HuHEHCHHUHEH}HEHHEH UHH0H}uHU؋UHEHdHEHEHHIH}tUHEH@uiEHUHEHپHEHHHEHEHEH}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhHt EEEEE;E|EUHHH}uU}tHEHAt HEHVHEHMHEHtHEHlEPMHEHQtRHEHv HEH5HHEHHEHl/HEHHEHUHH H}HuHEHEHUHEH5HHEHEHHEHjt/EPHEHcHEH8UHEH UHHH}HuHEH@t%HEHPHEH5eHǸzHEH@HEH@HE}t} uHEH@HηHEUHHPHHHHHEHu.HH5HH'$HHiHHH5XHǸHH5AHHHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5HHHHuUHH5HHHHHt PHHH5HHHHIHH5HEHH6EHtHH}t/UHH`UHH5HUHHqEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEHUHH H}uHHE}uHEH[EuE%EE~eHoHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHUHEHUHEH7UHEH&EmE;E|UHH H}uUEUHEHEHEH +EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHhHUHEHEHUHEHHHEH3UHEHUHH H}HuHUHEHHfH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEHͧHEH+EHUHH0H}uHU؋MHEHHUHEHEEHE}tU} }tEHEH5%HIUHEH謿3UHEHtHEH5HHEH5HMHEHHtHEHE}uHEHUHEHHEUHEHHHUHEH5<HǸ}tCHEHg/HEHuHEH5HǸHUHEH?UHH H}HuHUMHEHKHHEHH.HUHEHqHEHHEHWHMHEHH_HUHEHHHEHvHEHHEHoHUHEHʬ}t&HEHCHUHEH螬HEHUHH H}HuHEH>HEH}t5HEHHHEHHEH5jH萞 HEHһUHATSH@H}uUAHEEUHEHEE EPMHEH迨HEH.HEHRHEH跠HEHUHEHίHEH}u EHE}tHUHuHEHjAAHщHWHEHEH}u,HEHHEH 7EE;E} }}tsHEHYHEEXHEHIHEHܝHƋUHEAALHH5HǸHEHe[A\]UHH H}EHEHLHEH HuHEHH辥HEHJtHEHĩEUHEH{HEH}tJH}t5HEH3HHEHHEH5H豛>HEH0HEHHEH詶PHEHȱEEUHH0H}EHUHEؾHDHEHEHHEHƿHHEH}tOH}t5HEؾHeHHEHHEغH5H HEH%E}uHEؾHEUHH H}HEH5fHHHEHEHUHH H}HEH5(HޝHHEHEHHEHUHEHHZHEHHEH5UHUHH H}HEH5HQHHEHEHHEHEHxH*HHH H*XHEHUHHĀH}HEH5HϜHHEHEHHEE@HMHUHuHEH菥E}uEHMHEHH\}tUHEHEUHH@H}HEȺH5vH,HHEHEȺHoEHEȺHVHE譻HHEHMUHuHEHzE܃}u;HUHEHѺsH褞HEHHEHHHEHHtHEHj}tUHEȉHEUHSH8H}HuЉUHEHܷHEHEHHEHEغH}t-HUHEHHHMHEغHH1kHEHHEH@HoE}t} uHEH@HPHEUHHPHHHHHkEHu.HH5HH$HHiHHH5ڦHǸ;HH5æH5HHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5*H%HHHuUHH5HHHHHt PHHHwHHHHIHH5HEHHEHtHH蜞}t/UHHUHH5HUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHjHEHuHEHPHE}tEHMHUHuHEHUHH H}uHEHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHUHEH UHEH蹲UHEH訲EmE;E|UHH H}uUEUHEHEHEH茆+EE}yEE}E;E}zHEHzH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHHvHEH赀UHEHUHH H}HuHUHEHHfH~HEHEH9Etj HEHHEHEt' HHEHH% uHEuEHEHOoHEH+EHUHH0H}uHU؋MHEH HovUHEHmEEHE}tU} }tEHEH5HIUHEH.3UHEHvtHEH5cHHEH5KHMHEH6HBtHEHlE}uHEHgiUHEHHEUHEH蟜HHUHEH5HǸ`}tCHEH/HEHEuHEH5~HǸyHUHEHhUHH H}HuHUMHEH͖HHEH?H.HUHEHiHEHbkHEH٪HMHEHHHUHEHH>HEHgHEH肝HEHHUHEHLt}t&HEHńHUHEH tHEH_UHH@H}HEHEȾHfjHEȺHzHEȾHNJEEEPHEȾHpHEȾHjHEȺH5HhHuHEHH+oHEȺH5jH iHHEHEȾH(HUHEHH|EE;EMHEȾHdiHEȺHyHEȾHʼnEEoEPHEȾHoHEȾHiHEȺH5ʔHYhHHEHEȾHaHUHEHHEE;E|H}t5HEȾHچHHEHHEȺH5jHXd HEH蚁UHHH}HEH蛅UHH H}HEH5HgHHEHEH!uUHHPH}HEH5ؓHVgHHEHEHuHEHEH $HH覇EEEEEHUHEIH $HtH!EEHE}uHԔHHEHHHEH}tlEHcHUHEAHlEF茰HHEHH蚆HEH}t$EHcHUHEAHkEUHEH芔UHH H}HEH5vHeHHEHEHlEUHEHXEUHEH$UHH H}HEH5HeHHEHEHEEHcHEHHEUHEH躓UHH H}HEH5H$eHHEHEH蜳EUHEH蘋EUHEHTUHH H}HEH5@HdHHEHEHFEUHEH袘EUHEHUHH0H}HEغH5ڐHXdHHEHEعHzHEHEعHzHEH}uH}t_H}uH}tEH}tHUHEHHE}u0H}t)HUHEHHyEHEHjEUHE؉HUHHPH}HEH5ߏH]cHHEHEHzEEEUHEHc+UHEH)EEUMHEHiHEHecHEH5HͬHt7HEH5HbHHEHUHEHHfvElHEH5ڎHyHt7HEH5HLbHHEHUHEHHEMHEHHhHEH$EE;EUHEH5#HHt5UHEH5HaHHEHUHEHHuEhUHEH5H虫Ht5UHEH5ߍHnaHHEHUHEHHEMHEHH'g}tEE;EUHEH}UHHH}HEH$$H5gHwHEH诖HEH5$HUHH}HE]UHH}HE]UHH}HE]UHH }HuHUH}t3HEHUHMEHΉmHEu E{gHEUHHH}u}y}|HEHwEEUHH H}HuHUMDEHUHEHHEHM`tbHEHǟHUHuHEH H蜡t HEH\oHEH zHUHEHEЉHEHrUMHEHMUHHH}u}x}~HEH5tHǸHEHH}uHEHhy*EHEH`HEHfqHEAH5HUHH0H}uUME}t)}t<}UMHEH芢UMHEH1gHEHHUHEHEUHEHEUHEHkxUHEHZxHEAH5OHHEHgEHEH蒝EHEH52HǸuUHH H}uUUHEHEHEHHUHEHwUHEHNUHHH}uUHEH[]tUUHEH}HxH*HHH H*XHEHv^MHEHYHeUHEH`}HxH*HHH H*XHEH^ZMHEHHYeuAUHEHt\HEHyHHEH5ƊHǸفUHH0H}uHU؋UHEHYEHUHEHH規UHEH~HEH[HEH[UHH0H}uHU؋UHEHEHEHHHUHEHHHEHmUHEHMwUHH0H}uHU؋UHEH[fH~HEH}t=ff.Ez ff.EuUHEHoztHE؉EUHH}]UHH H}uHUEPHEHuIH}tHUHEH5*HǸ$HEH5HEHEHiUHH0H}uHU؋UHEHyEHEH2HJHUHEHH.zHEHVUHEH7HEHYHEHYuwHEH8HEHHUHEHHyHEHYVHEHhsUHEH׏UHH H}uHEEHEHH3UHEH~HUHEHHEHEH_EuHEH5uHǸ@~HEUHH0H}HuU܋E܍HHEH^HHEHHEHHxHEH;UEEЉHEH=rEE;E|HEHHUHEHH跤+E܉HEHHEHEHHcEЉHEHUUHHH}HuHEHHHUHEHVHEHtWHEH裠UHH0H}uHU؋UHEHHEHEH1HIH}tUHEHmuiEHUHEHaUHEHVHEHJfEHEH6}uHEHEUHHHhEE EEeHpMHhH\WuDUEЉEHpMHhH'Wt EEEEE;E|EUHHH}uU}tHEHUt HEHnHEHUMHEH etHEHEPMHEHQtRHEHHEH5HHEH5gHEH/HEHlHEH{UHH H}HuHEHkEHUHEH5zHHEHnEHHEHjt/EPHEHcHEHUHEH訓UHHH}HuHEH@t%HEHPHEH5͂HǸHEH@HEH@HuNE}t} uHEH@HVNHEUHHPHHHHHqbEHu.HH5zHHT$HHiHHH5zHǸAyHH5zH;wHHHuUHH5zHVHHHHtPHƄ Ћ9uqHtgHHH5zH+qHHHuUHH5yHHHHHt PHHHFHHHHIHH5HEHH辒EHtHHm}t/UHHUHH5xHUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHPxHEHuHEH6xHE}tEHMHUHuHEHUHH H}uH+xHE}uHEH[EuE%EE~eHwHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH!YUHEHYUHEH迁UHEH讁EmE;E|UHH H}uUEUHEHEHEHU+EE}yEE}E;E}zHEH`nH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHmHUHEHEHUHEHH|THEHOUHEH tUHH H}HuHUHEHH$XfH~HEHEH9Etj HEHHEHEt'eHHEHH% uHEuEHEHU>HEH+EHUHH0H}uHU؋MHEHlHuEUHEH較HEUHEȉH79UHEȉHYEEEPMHEȉHw?HEȾH8HEȺH5iH>8HHEHEHKFHEHEHkHHEHxHHSHEȾHxEE;EbHEH8[]UHH H}HuEEHEHmHEHH-FEEHEHH‹EHhHEHEHrEHEH}t5HEHVHHEHHEH5dhH3 HEHPEPHEHUEE;EaUHH H}VHEH}t5HEH{UHHEHHEH5gH2 HEH;PUHH H}HEH5gHP6HHEHEHbUHH H}HEH5bgH6HHEHEHDHEH}t5HEHTHHEHHEH5gH12 HEHsOUHH H}HEH5fH5HHEHEH5fHi5HHEHEHHt7HEHHt+HUHEHH2HEHqzHEH^zUHH H}HEH53fH4HHEHEHoHEHUHEHHmUHH0H}HEغH5eH4HHEHMHUHuHEHUOHEHtHUHEHHm HEHMEuHEHMHMHEغHH]}UHH0H}EHEغH5+eH3HHEHEغH5#eH3HHEHEؾH44tHEغH5eH3HHEHEH^HEH}t0HEHVHEHEPHMHuHEHZEHuHEHZEUHE؉HtaUHSHx HHH5$dH2HHEHMHUHuHEHMHEHtiHHHHH]H HHھ HVFHUHHHEHHEHx []UHHH}HEH $H5^cH.HHEHgHEH5$HUHH }HuHUH}t3HEHUHMEHΉ>HEu E8HEUHHH}u}y}|HEHHEEUHH H}HuHUMDEHUHEHHEH1tbHEHqHUHuHEH bHrt HEH@HEH^KHUHEHEЉHEHTCUMHEHcUHHH}u}x}~HEH5cHǸjVHEHcH}uHEHJ*EHEH 2HEHBHEAH5aHUHH0H}uUME}t)}t<}UMHEHsUMHEH8HEH8bHUHEHEUHEHEUHEHIUHEHIHEAH5aHHEH8EHEHnEHEH5aHǸTUHH H}uUUHEHEHEHDaHUHEHHUHEHqUHHH}uUHEH.tUUHEHOHxH*HHH H*XHEH/MHEH`H 7UHEHNHxH*HHH H*XHEHf/ZMHEH`H6uAUHEH-HEHWJHHEH5Y`HǸ,SUHH0H}uHU؋UHEHYEHUHEHH`UHEH(PHEH7-HEH&-UHH0H}uHU؋UHEHEHEH6_HHUHEHHr`HEH>UHEHHUHH0H}uHU؋UHEH-fH~HEH}t=ff.Ez ff.EuUHEHKtHE؉EUHH}]UHH H}uHUEPHEHC^uIH}tHUHEH5^HǸlQ$HEH5^HEHEH;UHH0H}uHU؋UHEHyEHEH]HJHUHEHHKHEH;(UHEHrHEH)+HEH+uwHEHjHEH5`HUHEHHJHEH'HEHDUHEH*aUHH H}uHEEHEH\H3UHEH~HUHEHHEHEHiEuHEH5]HǸOHEUHH0H}HuU܋E܍HHEH\HHEHHEHHIHEH&EEЉHEHCEE;E|HEHHUHEHH v+E܉HEH_HEHEHHcEЉHEHhUHHH}HuHEH>[HHUHEHX'HEH(HEHqUHH0H}uHU؋UHEH?aHEHEHZHIH}tUHEH?uiEHUHEH&HEH#(HEH7EHEHg}uHEHEUHHHhEE EEeHpMHhH(uDUEЉEHpMHhHz(t EEEEE;E|EUHHH}uU}tHEH't HEH1@HEH&MHEH\6tHEHGfEPMHEHQtRHEHQrHEH5YHHEH8HEHGe/HEHeHEHhUHH H}HuHEHHEH@HE}t} uHEH@HHEUHHPHHHHH3EHu.HH5|PHH&$HHiHHH5SPHǸJHH5}t/UHH;ZUHH5NHUHHLfEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHMHEHuHEHMHE}tEHMHUHuHEHZ[UHH H}uHMHE}uHEH[EuE%EE~eHjMHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHt*UHEHc*UHEHSUHEHSEmE;E|UHH H}uUEUHEHEHEH&+EE}yEE}E;E}zHEHCH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHcCHUHEHEHUHEHH%HEH!UHEH]EUHH H}HuHUHEHHw)fH~HEHEH9Etj HEHHEHEt'f6HHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEHBHUHEH EEHE}tU} }tEHEH5 BHIUHEH'3UHEHtHEH5AHHEH5AHMHEHAH3tHEH E}uHEH UHEH])HEUHEHHHE@HH>HH>HHEH@HHEHH~HE@HxH*HHH H*XHEH@ FHEHP HEHHHEHH2%HEHPHEHH6< HEH!HEHg$EUHEH&HE(HEHH!UHSHH}uUHEH(HEMHEHH}uMHEH=HF HEHPHHHHH5=HPHEHEHHHEؾHUHEHPHHHHHHEHHEHE HEEEHE‹MHEH HEH#HEH5<HHEH)HEHHEHHEHEHNFHUHEHHEHEH5;HHEH_)HEHnHEH]X }}Ẽ }b HEHHEHHEHpOfH~HE OHH;HH;HHEHHEHHEHHEH,HEHHEH4HUHHHHHHEHH`HMHHH`9H`HhHHSHpHxHCHSHEHC HEHHEHHEHHEHH,ЉHEHHEH4HUHHHHHHEHH`HMHHH H`HhHHSHpHxHCHSHEHC HEHHEHHEHHEHH,HHEHHEH4HUHHHHHHEHH`HMHHHDH`HhHHSHpHxHCHSHEHC [HEHHEHHEHHEHf/w:sH, f:\H,HH1HHEHHEH4HUHHHHHHEHH`HMHHHH`HhHHSHpHxHCHSHEHC }HEHHEHHEHHEH,HEHHEH4HUHHHHHHEHH`HMHHH'H`HhHHSHpHxHCHSHEHC HEHHEHHEHHEHH,ЉHEHHEH4HUHHHHHHEHH`HMHHHDH`HhHHSHpHxHCHSHEHC HEHHEHHEHHEHH,HHEHHEH4HUHHHHHHEHH`HMHHHbH`HhHHSHpHxHCHSHEHC dHEHHEHHEHHEHf/7sH, o7\H,HH1HHEHHEH4HUHHHHHHEHH`HMHHHtIH`HhHHSHpHxHCHSHEHC HEHHEHHEHHEHH,HHEHHEH4HUHHHHHHEHH`HMHHHH`HhHHSHpHxHCHSHEHC HEHHEHHEHHEHf/5sH, 5\H,HH1HHEHHEH4HUHHHHHHEHH`HMHHHb;H`HhHHSHpHxHCHSHEHC HEHHEHHEH HEHHEHHEH4HUHHHHHHEHH`HMHHHb?H`HhHHSHpHxHCHSHEHC GH^$HLl4HW3H5\3HǸ|5HEH<UHUHEH HEHMHUHHHHHHEHH`HUHuH`H`HhHHSHpHxHCHSHEHC HUHEH HEHMHUHHHHHHEHH`HUHuHG+H`HhHHSHpHxHCHSHEHC FH$HL3H1H52HǸ!4HEH;7HEH{;HEHj;HEHEH;EcHUHHHHHHEHH`H H`HhHHSHpHxHCHSHEHC HEHĘ[]UHH H}HEH0HEH5W1HHEHY0EEHHHHl$HHEHEHHgHEHHEHHHEHHEH/HEH5/HHE@HcHEHH@HEH?HE@ HE H5d0HHE@ rHH0HH0HHEH5&0HaKHE H5 0HD.HEH5/H'HE H5/H HEH5/HHEH5/HHEH5/HHEH5/HHEH5|/HyfHEH5i/H_LHEH5V/HE2HEH5C/H+HEH50/HHEHmHEH\EE _HEH;UHH }HuHUH}t3HEHUHMEHΉHEu EHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEH{tbHEH6HUHuHEH R.H8t HEHHEH9HUHEHEЉHEH/ UMHEH{)UHHH}u}x}~HEH5.HǸEHEH.H}uHEH*EHEHHEHHEAH5i-HUHH0H}uUME}t)}t<}UMHEH9UMHEH_HEH-HUHEHEUHEHEUHEHUHEHHEAH5-HHEHEHEH4EHEH5-HǸUHH H}uUUHEHEHEH,HUHEHUHEH|7UHHH}uUHEHtUUHEHHxH*HHH H*XHEHMHEH,HUHEHHxH*HHH H*XHEHAZMHEHG,HuAUHEHHEH2HHEH5,HǸUHH0H}uHU؋UHEHYEHUHEHH&UHEHHEHHEHUHH0H}uHU؋UHEHEHEH*HHUHEHHM&HEHUHEH{UHH0H}uHU؋UHEHfH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEH$uIH}tHUHEH5x*HǸG$HEH5m*HEHEHUHH0H}uHU؋UHEHyEHEH)HJHUHEHH\HEHUHEHe8HEHHEHuwHEHf0HEH&HUHEHHHEHHEH UHEH'UHH H}uHEEHEHi(H3UHEH~HUHEHHEHEH/EuHEH5(HǸnHEUHH0H}HuU܋E܍HHEH(HHEHHEHHHEHiEEЉHEHk EE;E|HEHHUHEHH;+E܉HEH%HEHEHHcEЉHEH.UHHH}HuHEH&HHUHEH3HEHHEH7UHH0H}uHU؋UHEH'HEHEH&HIH}tUHEHuiEHUHEHHEHHEHxEHEHd-}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhHUt EEEEE;E|EUHHH}uU}tHEHt HEH HEHMHEH7tHEH",EPMHEHQtRHEH,8HEH5V%HHEHcHEH"+/HEH+HEH.UHH H}HuHEHEHUHEH5$HDHEHEHHEHjt/EPHEHcHEH*UHEH*UHHH}HuHEH@t%HEHPHEH5$HǸ0HEH@HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH57HH#HHiHHH5HǸoHH5HiHHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5^HYHHHuUHH55HHHHHt PHHHHHHHIHH5HEHH)EHtHH}t/UHH UHH5LHUHH',EUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEH5!UHH H}uHyHE}uHEH[EuE%EE~eH%HEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHOUHEH>UHEHUHEHEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHHHEHUHEH8 UHH H}HuHUHEHHRfH~HEHEH9Etj HEHHEHEt'AHHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEH=HUHEHEEHE}tU} }tEHEH5 HIUHEHb3UHEHtHEH5 HHEH5 HMHEHj HvtHEHE}uHEHUHEH8HEUHEHHHUHEH5 HǸ}tCHEH/HEHyuHEH5 HǸHUHEHUHH H}HuHUMHEH HHEHs H.HUHEH'HEHHEH HMHEHHHUHEHHrHEH,HEHHEH%HUHEH}t&HEHHUHEHTHEHUHH H}uHEUHEHtt0gMHEHfHƿHE9UHEH5 HHtUHEH5 HHHEH}uMHEH HfHEUHH H}HuHEHEHEHHbE}tH >H5 H= XH}t5HEHHHEHHEH5( HN HEHHEHt-HEHHHEHHǸUHHH}HEHHEHHEHHHEHH5nHEHHEHHUHH H}HEHAHEHEHƿHEH}t5HEHkHHEHHEH5H HEH+UHHĀH}HEHHEHEHBHEHEHEHEHEHEHEHEHEHEH8HEH}@vHEHZHHEHHEHMHUHuHEHzE}~ HUHMHEHHEUHEHEHEH!HE躋H5HEUHH H}HEH5HHHEHEHHEH}tJH}t5HEHHHEHHEH5lHHEHZ HEHLUHH H}HEH5%HaHHEHEH>HEHUHHpH}HEH5HHHEHEH HEHEHEHEHEHEHEHEHEHEHHEH}@vHEH"HmHMHUHuHEHRE}~ HUHMHEHHzEUHEHEHEH5H}EUHH H}HEH5HHHEHEHHHEHH/UHH H}HEH5XHHHEHEHHEH}t5HEH5HHEHHEH5H HEHUHH H}HEH5H HHEHEHwHEHUHEHHUHH H}HEH5~HHHEHEHHEHUHEHHPUHH0H}HEغH5.HjHHEHEؾHbHEHUHEHH;E}uHUHEHHE*HUHEHHEUHE؉HcEHE3H5UHHEUHH0H}HEغH5sHHHEHEؾHHEHUHEHHEHECH5HUHE؉HUHH0H}HEؾHHEHEHHEEH}tJH}t5HEؾHHHEHHEغH5HI"HEHHEؾH(EEUHH H}HEH5PHHHEH}u)HEHKHEHHUHH H}HEH5rH(HHEHEHHHEHHHEHmUHH H}HEH5 HHHEHEHHHEHHMHEHUHH H}HEH5H\HHEHEHyHHEHHgUHH H}HEH5VH HHEHEH_HEHUHEHH(HEH UHH H}HuHEHEHEHHE}tH H5H=HUHEHHHEHHEHut-HEHHHEHHǸUHH H}HEH5HHHEHEHHEH?HEHHHUHEH5HEUHEHHEHHEHHUHH H}HEH5WH HHEHEH*HEHUHEHHUHH H}HEH5HHHEHEHHEHUHEHHSUHH H}HEH5HmHHEHEHHEHUHEHHUHH0H}HEغH5gHHHEHEؾHHEHUHEHHE}uHUHEHHE*HUHEHHzEUHE؉HEHEH5HEUHHPH}HEH6$H5HHEH6$H5 HfHEHHEH5#HHEH5H8HEHEHEH5YHHEH:MHEH-HEHEH5H8HEHMHEHHjEHEH5HHEH誽MHEHH"EHEH5HHEHbMHEHkHEHEH5VH`HEHMHEH*HEHEH5HHEHҼMHEHHJEHEH5HHEH芼MHEHHEHEH5HHEHBMHEHfHEHEH5SH@HEHMHEH'HrEHEH5HHEH費MHEHH*EHEH5HHEHjMHEHHEHEH5HhHEH"MHEHsHEHEH5]H HEHںMHEH1HRHEHUHH }HuHUH}t3HEHUHMEHΉDHEu EHEUHHH}u}y}|HEH=EEUHH H}HuHUMDEHUHEHHEHtbHEHkHUHuHEH HH@t HEHHEHHUHEHEЉHEHUMHEHUHHH}u}x}~HEH5HǸHEHH}uHEH *EHEH[HEH HEAH5_HUHH0H}uUME}t)}t<}UMHEH.UMHEHHEHHUHEHEUHEHEUHEHUHEHHEAH5HHEHJEHEH6EHEH5vHǸUHH H}uUUHEHEHEHHUHEHCUHEHUHHH}uUHEHtUUHEHgHxH*HHH H*XHEHMHEHH]UHEHHxH*HHH H*XHEH跺ZMHEH=HuAUHEHHEHHHEH5 HǸ}UHH0H}uHU؋UHEHYEHUHEHHJUHEHyHEH舸HEHwUHH0H}uHU؋UHEHEHEHHHUHEHHHEHBUHEHUHH0H}uHU؋UHEHjfH~HEH}t=ff.Ez ff.EuUHEHtHE؉EUHH}]UHH H}uHUEPHEHuIH}tHUHEH5nHǸ$HEH5cHEHEHWUHH0H}uHU؋UHEHyEHEHvHJHUHEHHHEH茳UHEHHEHzHEHiuwHEHHEHHUHEHHCHEHHEH UHEH{UHH H}uHEEHEH_H3UHEH~HUHEHHEHEHEuHEH5HǸHEUHH0H}HuU܋E܍HHEHHHEHHEHH%HEH߱EEЉHEHEE;E|HEHHUHEHH[+E܉HEH#HEHEHHcEЉHEHUHHH}HuHEHHHUHEH該HEHHEHGUHH0H}uHU؋UHEHHEHEHuHIH}tUHEHluiEHUHEHHEHtHEHEHEH}uHEHEUHHHhEE EEeHpMHhHuDUEЉEHpMHhH˳t EEEEE;E|EUHHH}uU}tHEHmt HEHHEH<MHEHtHEHEPMHEHQtRHEHHEH5LHHEHHEH/HEHHEHUHH H}HuHEHDEHUHEH5HHEH)EHHEHjt/EPHEHcHEHdUHEHLUHHH}HuHEH@t%HEHPHEH5HǸHEH@HEH@HE}t} uHEH@HHEUHHPHHHHHEHu.HH5-HHS#HHiHHH5HǸHH5HHHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5THHHHuUHH5+HHHHHt PHHHaHHHHIHH5HEHHbEHtHHF}t/UHHUHH5BHUHHEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHzHE}tEHMHUHuHEHUHH H}uHoHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHŵUHEH贵UHEHcUHEHREmE;E|UHH H}uUEUHEHEHEH6+EE}yEE}E;E}zHEHH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHHUHEHEHUHEHH HEH_UHEHUHH H}HuHUHEHHȴfH~HEHEH9Etj HEHHEHEt'HHEHH% uHEuEHEHHEH+EHUHH0H}uHU؋MHEH3HUHEH0EEHE}tU} }tEHEH5HIUHEHز3UHEHBtHEH5HHEH5uHMHEH`HtHEHGE}uHEHUHEH讴HEUHEHIHHUHEH5HǸ }tCHEH/HEHuHEH5HǸ#HUHEHkUHH H}HuHUMHEHHHEHiH.HUHEH蝕HEH HEHHMHEHHHUHEHHHEH袓HEH,HEH蛰HUHEH}t&HEHoHUHEHʟHEH UHHP}HuHUHMLEHEHEHEHЬEHEHAHEH}HMHEHHHHHEȾH跕uJHEȺHHMHEHHHHMHEHHHHEȺH}t)UHEȉHHEHoH褞EHcHEHHHEHOHwEHHzHHEHHHEȺH貑HEHH*HEHnHcHEHHlHEHHH}tlH}t5HEȾH蕲HHEHHEȺH5H HEHUHEHHEHH聝}u HxH~HuHMHHXHEȾHǓHEȾH轭HEȹHRu*HEȾH EHEȾH@HEȺH>HHEHHǸǸHMHEHHH蘤HEȾHHEHHfHEȾHՒHEȾHTEHEȾH@HEHbHHEȾH臒HEȾHEHEȾHE;E~EHEоH"}tEHEȾHHEȾH裲HEȾHmHEȾH|EUHH0}HuúHEЉH3HEH}tHEHHEH}tHEHIHEH}tHUHEHHdH}tH}HMHUHuЋEI UHH0H}HuEHEHEHE؉HsHEH}tHEH\HEH}tHUHEHHH}t"HuHMHUHEIHƿjE}tEUHH }HuHUH}t3HEHUHMEHΉHEu EHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEH軏tbHEH5HUHuHEH rH t HEHʞHEHyHUHEHEЉHEHoUMHEHUHHH}u}x}~HEH5HǸ腴HEHH}uHEH֨*EHEH%HEHԠHEAH5HUHH0H}uUME}t)}t<}UMHEHUMHEH蟖HEHHUHEHEUHEHEUHEH٧UHEHȧHEAH5HHEHEHEHEHEH5HǸUHH H}uUUHEHEHEHHUHEH UHEHUHHH}uUHEHɌtUUHEH1HxH*HHH H*XHEHMHEHH'UHEHάHxH*HHH H*XHEH聍ZMHEHgHǔuAUHEHHEHrHHEH54HǸGUHH0H}uHU؋UHEHYEHUHEHHUHEHCHEHRHEHAUHH0H}uHU؋UHEHEHEHHHUHEHH荾HEH UHEH軦UHH0H}uHU؋UHEH4fH~HEH}t=ff.Ez ff.EuUHEHݩtHE؉EUHH}]UHH H}uHUEPHEH^uIH}tHUHEH5HǸ臯$HEH5HEHEH!UHH0H}uHU؋UHEHyEHEHHJHUHEHH蜩HEHVUHEHHEHDHEH3uwHEHHEHPHUHEHH HEHDžHEH֢UHEHEUHH H}uHEEHEHH3UHEH~HUHEHHEHEHEuHEH5HǸ训HEUHH0H}HuU܋E܍HHEHHHEHHEHHHEH詄EEЉHEH諡EE;E|HEHHUHEHH%+E܉HEHHEHEHHcEЉHEHUHHH}HuHEHHHUHEHsHEHHEHUHH0H}uHU؋UHEHZHEHEHHIH}tUHEH6uiEHUHEHτHEH>HEH踕EHEH}uHEHEUHHHhEE EEeHpMHhHʆuDUEЉEHpMHhH蕆t EEEEE;E|EUHHH}uU}tHEH7t HEHLHEHMHEHwtHEHbEPMHEHQtRHEHlHEH5vHHEH裖HEHb/HEHHEHUHH H}HuHEHEHUHEH5H脳HEHEHHEHjt/EPHEHcHEH.UHEHUHHH}HuHEH@t%HEHPHEH5;HǸpHEH@HEH@H}E}t} uHEH@H}HEUHHPHHHHHߑEHu.HH5WHH#HHiHHH5.HǸ诨HH5H試HHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5~H虠HHHuUHH5UHHHHHt PHHH+vHHHHIHH5HEHH,EHtHH}t/UHHVUHH5lHUHHgEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEHuUHH H}uHHE}uHEH[EuE%EE~eHEHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH菈UHEH~UHEH-UHEHEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEHαH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEH>HUHEHEHUHEHHHEH)UHEHxUHH H}HuHUHEHH蒇fH~HEHEH9Etj HEHHEHEt'联HHEHH% uHEuEHEHmHEH+EHUHH0H}uHU؋MHEH]HtUHEHkEEHE}tU} }tEHEH5HIUHEH袅3UHEH utHEH5HHEH5HMHEHH趑tHEHkE}uHEHgUHEHxHEUHEHHHUHEH5HǸԘ}tCHEH]/HEH蹫uHEH5ҮHǸHUHEH5gUHH H}HuHUMHEH!HHEHH.HUHEHghHEHiHEHMHMHEHHUHUHEHH貉HEHlfHEHHEHeHUHEHr}t&HEH9HUHEHrHEHӫUHH@H}HEȺH5vHLhHHEHEȺHvHEHEȺHvHEHEHEHEL@HEHxHMHUHuHEMIHc|E}HEHt5HEȾH|HHEHHEȺH5ìHc HEHHZE}tEHMHUHEH5HjUHH0H}HuHUHEHEHE~HEHcHEHHEGHEH@H8t4HEH@HUHzH苅HHEHHEHUHH0HHH@HHFHHΉHEHH4HHHEHuHMHHIH5HǸ?yHHȖUHH H}HHEHEHEH@H`ME}tHEHPHU9EtECHEHHU UHUHLHEuHEHEH@HLUHH H}HuHEHIHEHEE}#u>HEH@HLE}t} uHEH@HLHEUHHPHHHHH`EHu.HH5gHHR#HHiHHH5>HǸwHH5'HyuHHHuUHH5HVHHHHtPHƄ Ћ9uqHtgHHH5HioHHHuUHH5eHHHHHt PHHHDHHHHIHH5HEHHEHtHHk}t/UHH&UHH5|HUHH7EUHH@H}HuHUHMLEEH}t1HE8u!HuHEHΎHEHuHEHHE}tEHMHUHuHEHEUHH H}uHHE}uHEH[EuE%EE~eHUHEHEuOUHEH>fH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEH_WUHEHNWUHEHUHEHEmE;E|UHH H}uUEUHEHEHEHS+EE}yEE}E;E}zHEHބH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHNHUHEHEHUHEHHRHEHMUHEHHrUHH H}HuHUHEHHbVfH~HEHEH9Etj HEHHEHEt'QcHHEHH% uHEuEHEHVHEH2EPHEHaTUHH H}HEH5~H:5HHEHEHjHUHEH5AHVUHH0H}HEغH5E~H4HHEHEH1HEHEHhOHEHUHEHHQUHEغH 2UHH0H}HEغH5}H`4HHEHEؾHXmHEHUHEHH8E}uHUHEHHdE*HUHEHHdEUHE؉HYbEHEQH5D}H>JEUHH H}HEH5%}H3HHEHEHFUHH H}HEH5|Hg3HHEHEHd1HEH}t5HEHRHHEHHEH5|H/ HEHLUHH H}HEH5]|H2HHEHEHfHEH}t5HEH~QHHEHHEH5{H. HEH>LUHH H}HEH5{HS2HHEHEHLHEH5{HRHEH/UHH H}HuHEHEHEHSEH}t5HEHPHHEHHEH5{H. HEH\KEPHEHPUHH H}HEH5zH^1HHEHEH!gHUHEH5"HdUHSHHHEHEHHHbHEH}t HEHHH:HHEH}u"H}uHHH2zH}6HXHHH>HEH}H59z6HEHEHvHHUHBHEHHHHHMHHpHHH5yHKHHHHSH H(HCHSH0HC H5yC6HEHEHhHHUHBHEHHHHHMHHpHHH5EyH:KHHHHSH H(HCHSH0HC HUHHHHHMHHpHH5HHHHSH H(HCHSH0HC H}HEH`HEH}HXH`HuHEHvE}uSH}t;HHHMHHEHHHH5wH*4HHHG#UHHHk\EHEHLAHEHp1EH[]UHH H}HEH5/wH-HHEH}u)HEH@HEHfHUHSHHXEHXH|gHEHUHXH;HEHUHXHt;HEHXH|-tHXH6EHXHE-~ HXH5vH,HHEHDžH@HEHEH5Cv2HEH}HEHrHHUHBHEHHHHH]HHH HH5uHGH H(HHSH0H8HCHSH@HC HUHHHHH]HHH H2H H(HHSH0H8HCHSH@HC HEH<]HEH}ttHUHHuHEHsE}uDHUHMHEHHf\E}u$HHHHHPHEH,GEHEH->HEHQ.}uUHXHY}t"HHHPHXHHSHHH`HPHZH`HXHHJHXH'H[]UHH0H}HEغH5tsH)HHEHUHEؾHH8HEHUHMHEHH[EUHE؉HXUHHHHH5rHz)HHEHE@EEHHktoHUHH7HEHUHMHEHHrZEHH)tHH3E7HHR)tHH2E}uHMHUHuHEHDE}uUHHVt}tHUHMHHHjMHEHHEHUXHHHHHHHs%UHH H}HEH5HqH'HHEHEHoHEHUHEHH?UHHH}HEH#H5pH=HEH#H5pHw=HEH!]HEH5!+#HUHH0H}uHU؃}yEEEHEHEEHEHHEHHGHE@HcHEHH2>UHEH1CHEHEHHuUHH@H}uHUHMLEHMHU؋uHEHFEEHHHEHЋUHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH}HE]UHH0H}HuU܋UHMHEHHoHEH}t HEHUHH }HuHUH}t3HEHUHMEHΉ2HEu E,HEUHHH}u}y}|HEH<EEUHH H}HuHUMDEHUHEHHEHm%tbHEHdHUHuHEH $oHft HEH|4HEH+?HUHEHEЉHEH!7UMHEHmWUHHH}u}x}~HEH5oHǸ7JHEHoH}uHEH>*EHEH%HEH6HEAH5;nHUHH0H}uUME}t)}t<}UMHEHgUMHEHQ,HEHnHUHEHEUHEHEUHEH=UHEHz=HEAH5onHHEH,EHEHbEHEH5RnHǸHUHH H}uUUHEHEHEHmHUHEHHHEH5lHǸFUHH0H}uHU؋UHEHYEHUHEHHTUHEHCHEH!HEH UHH0H}uHU؋UHEHEHEHkHHUHEHH?THEH2UHEHmHEHyHEH8UHEHTUHH H}uHEEHEH;iH3UHEH~HUHEHHEHEH]EuHEH5iHǸ`CHEUHH0H}HuU܋E܍HHEH~iHHEHHEHH=HEH[EEЉHEH]7EE;E|HEHHUHEHHi+E܉HEHSHEHEHHcEЉHEHu\UHHH}HuHEHgHHUHEH%HEHHEHeUHH0H}uHU؋UHEH UHEHEHQgHIH}tUHEH2uiEHUHEHHEHHEHj+EHEHV[}uHEHEUHHHhEE EEeHpMHhH|uDUEЉEHpMHhHGt EEEEE;E|EUHHH}uU}tHEHt HEH3HEHMHEH)*tHEHZEPMHEHQtRHEHfHEH5(fHHEHU,HEHY/HEHYHEH\UHH H}HuHEH0EHUHEH5eH6IHEH3EHHEHjt/EPHEHcHEHXUHEHXUHHH}HuHEH@t%HEHPHEH5dHǸ"GHEH@HEH@HE}t} uHEH@HvHEUHHPHHHHH'EHu.HH5 ]HH#HHiHHH5\HǸa>HH5\H[HEH}tHEHHEHHEHxHEؾH7EHEHkEHEؾHHEؾHi!HEؾHDHEUHH H}uUHEHBuOUHEHfH~HEMHEH&HEH*Ef.Ezf.EuUHH0H}uHUEHUMHEH>fH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHAUHEH0UHEHFUHEHFEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEHPH|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHOHUHEHEHUHEHHHEHUHEH*9UHH H}HuHUHEHHDfH~HEHEH9Etj HEHHEHEt'3*HHEHH% uHEuEHEHuHEH+EHUHH0H}uHU؋MHEHOH UHEHEEHE}tU} }tEHEH5NHIUHEHT3UHEH tHEH5iNHHEH5QNHMHEHHMHEHHLHUHEHHdHEHHEH1HEHHUHEHr}t&HEHHUHEHFHEHAUH}EE 9E}E;Eu 9Eu HKM!EHcHHHHHH #H]UHH H}EEEHcHHHHHH#HHEHH&t4EHcHHHHHH#HHEHH%u%EHcHHHHHHR#EE 9EaEUHH H}uEUHEHtMHEHkEvUHEH|>t+MHEHHEHEHE6UHEH EMHEHKH7}x 9E|MHEHKHEUHH0H}EEHUHEعH9HEHEH#EUHHPH}HuUHE)HEHEȾHHEHUHEHHa7HUHEHHn/HUHEHH+ vHE}HE؋EHcHEHH,HUHEHH0'HHEHH.HMHEHH}HEH!HEH"HEH8HEHHEUHH H}HuHEHEHEHb0E*EHEHjMHEHIHbEEDHHEHHHEHMHEHIHHEH7HHEHH.CHEHyIHHEHHHEHHBHEHKIHHEH5BIH(HEHHEHHHEHH4HEHUHSHHxHxHE%HEHEȾHEHEHEHEE}HxH8tHxHeHHxUHxHHUHxHtEEUԋMHxH>HxHHxHQHxHGHHxHbHxHGHHxH3HxHGHHxHHxH@HEHxHEHxHHHEHHKHEH}tHUHEHH{)EHEH+HxH6HxH6E}u E;Ei}uCHxH5FHHHEHEHZHHEHH-E}HxH5gFH@HHEHEHuHxHKFHHUHEHH tHxH-FHE}u E;EHxHFH/HEHxHtHxHD: E}HEHsEHcHEHHE-#HE$#HEHUHEHH0HUHEHH0HUHEHH7%E}uHUHEHHEHEH2HEH2H}t>H}t7H}t0HUHMHEHHdHEH689E}uSH}t;HxH*HHEHHxH5DH3HxH "HEHUHxHr"HĈ[]UHH0H}EHEؾH6HEHEH"HH7DH7EHE}uHEHj+tE}uHHEH}u!H}uHEH?HQH}tHUHEHHt%E(H}t!HEH HHEHHJ%EUHE؉HvEEUHH@H}HEȺH5T>HHHEHEȾHRu/HEHHEHMHEȺHH6fHEȾH 3HHEHEHUHMHEHH#HEHtHEHHtlH}t;HHHHHEHHHH52HHHHHHH2H HEHt@HE~6HMHHHH*HHHl2HHEXH7)HEH}t6HMHHHH)HHH2HfHEH #HEH}t1HUHHHHHHH/HHEHHEH}HEH蛹HEHHHETHEHbH‹EHHEHUHHHHEPHHHjEE;E|HHH1HSUHH H}HEH5/HHHEHEHUHH@H}HEȺH5T/HHHEHEH"HH0HAEHEE}t }tHEHV0Hk3H[ HE}u_HUHEHH.HUHEHѺsH)HEHHEHHHEHHQEYHUHEHHtBHUHEHѺsHHEHHEHHHEHHEHEHEUHH0H}HEغH5-HtHHEHEHq HEH}tHEHHEEHcHEHHUHHPH}HEH5r-HHHEHEH HEHEEHEHtxHEHPE}xHEHFH*9E|HEH_.H]HEHH‹EH HEHEH5'.H-HHEHEHεHEEPHEH讵H‹EHZ HEHEHHHEHH*u HEHE EE;E|H}HEH"tHEHEă}tHUHEHHXHEH;HEH}t5HEHHHEHHEH5-H} HEHEEUHH H}HEH5,HHHEHUHEHHUHH0H}HEغH5,HHHEHEؾHu`HEHOEEHcHEHHE$HHEHHHEغHHEؾHEHE HEEHcHEHH HUHEHHtjHHEHHX HMHEHH HEHHEHxUHH`H}HEH@HEHEHE8HHE@ufHEHPHUHUHPЉEHEHPHUHUHPЋEЉEċEăEEădEHE@HEHPHUHUH0iEHEHPHUHUH0kdEЉEHEHPHUHUHPЉ‹EЉEHEHPHUHUHPЋEЉEċE-lEHEHPHUHUHPЉEHEHPHUHUHPϋEЉEHEHPHUHUHPЉEHEHPHUHUHPЋEЉEHEHPHUHUHPЉEHEHPHUHUHPЋEЉEHEHPHUHUHPЉEHEHPHUHUHPЋEЉEHEHPHUHUHPЉEHEHPHUHUHPЋEЉEHEHWUHH H}HEH5p(HaHHEHEHHEHEHHHEHHHMHEHHdUHH0H}HEغH5'HHHEHEHHEHEHHEH}t5HEؾHuHHEHHEغH5'H HEH5HMHEغHHUHH0H}HEغH5A'H2HHEHEHOHEEH}tHUHEHHEEUHH H}HEH5&HHHEHEHUHSH8H}ȉuċUHEȉHtMHEH&HbjHEUHEȉHUHEȉH[EEEPMHEȉH%HEȾHHEȺH5f$HHHEHEHiHEH菭HHEH蜭HHcHEȾHEE;EfHEH8[]UHH H}HuEEHEH3 HEHHEEHEHH‹EHHEHEHH}t5HEHHHEHHEH5D#H: HEH|EPHEHEE;EeUHHH}HEHJ#H5"HHEH-L#H5]$HnHEHHEH5XJ#HUHH}HE]UHH}HE]UHH}HE]UHH }HuHUH}t3HEHUHMEHΉ HEu EHEUHHH}u}y}|HEHEEUHH H}HuHUMDEHUHEHHEHtbHEH0HUHuHEH #Ht HEHHEHtHUHEHEЉHEHjUMHEHUHHH}u}x}~HEH5$HǸHEH)$H}uHEH*EHEH HEHHEAH5"HUHH0H}uUME}t)}t<}UMHEHUMHEHHEHN#HUHEHEUHEHEUHEHUHEHHEAH5"HHEHEHEHEHEH5"HǸUHH H}uUUHEHEHEHZ"HUHEHUHEHUHHH}uUHEHtUUHEH,HxH*HHH H*XHEHMHEH"H"UHEHHxH*HHH H*XHEH|ZMHEH!HuAUHEHHEHmHHEH5o!HǸBUHH0H}uHU؋UHEHYEHUHEHHUHEH>HEHMHEHHEH@H޿E}t} uHEH@H迿HEUHHPHHHHHEHu.HH5HH"HHiHHH5iHǸHH5RHHHHuUHH5(HVHHHHtPHƄ Ћ9uqHtgHHH5HHHHuUHH5HHHHHt PHHH&HHHHIHH5HEHH'EHtHH }t/UHHQUHH5HUHHbEUHH@H}HuHUHMLEEH}t1HE8u!HuHEHHEHuHEHHE}tEHMHUHuHEHpUHH H}uHHE}uHEH[EuE%EE~eHHEHEfH~HEEt:EH,H*f.Ez$f.EuH}t HEEH,H}t HEUHHH}uULUHEHUHEHyUHEH(UHEHEmE;E|UHH H}uUEUHEHEHEH+EE}yEE}E;E}zHEH H|E+EEUEЍPMHEHUEЍPMEHEHUEЍPMHEHUHH H}uHUHEHyHUHEHEHUHEHHHEH$UHEHsUHH H}HuHUHEHHfH~HEHEH9Etj HEHHEHEt'|HHEHH% uHEuEHEH辯HEH+EHUHH0H}uHU؋MHEHH޶UHEHEEHE}tU} }tEHEH56HIUHEH3UHEHtHEH5HHEH5HMHEHHtHEH E}uHEH֩UHEHsHEUHEHHHUHEH5MHǸ}tCHEHX/HEHuHEH5 HǸHUHEH0UHH H}HuHUMHEH\HHEHH.HUHEHbHEHѫHEHHHMHEHHPHUHEHHHEHgHEHHEH`HUHEH軴}t&HEH4HUHEH菴HEHUHH0H}HEؾHHEHEHW"HHHEHE}uHEHtE}uHHEHUHEHHdEUHEH5HHE;Et%E9EtMHEHHǭUHEH5PH辧HHEЋE9EuMHEȺHHEH=ZtHEHUHEHHE}uAHUHMHEHHE}~!EE}uE;Ee}uJH}t5HEȾHHHEHHEȺH5QHR"HEHHEHHEH}uUHEȉHUHSHXH}HuUHEEH}tH}u <HEHHEEHEH!H‹EHHEHEH*HEHMHEHH莰E}tY}tqUHEH.HEUHEHyHEHHMHEHH5E}uHMHEHHt-EHEHTH9EEH "HFHHEH)HHiEHX[]UHHpH}uHUHMLEHEHEHEHEHEHE诠HEH}u  ZHEH虯HEH}u  /HEȾH>E}HUHEHHE}HEH5HEHEHqHEHUHEHHE}HUHEHH E}nHEHEHƿ4HEH}u E >HUHEHHjE}HEHHEUHEHƿЯHEH}u E HUHEHHE}HEH-HEHMHEHH`E}u~HEH訯HEHUHEHHEHEH蒷}uIHUHMHEHHE}t,EHEHUHE% HEHEUHH@H}HEȺH5H:HHEHEȺH5HHHEHEȺmH^EHEHH#HEHEH}HMHUuHEIHE}uUHEHtLHEHt5HEȾH]HHEHHEȺH5OH۝"HEHUHEȉHEEUHH@H}HEȺH5HHHEHEH$"HHHEHE}t }tHEHH趦~HHE}uHUHEHHiHUHEHH蔨E}u;HUHEHѺsH^HEHHEHHHEHH=HEH$}tUHEȉHUHHĀH}HEH5_HHHEE@HEHH HEHMHUHuHEHnE}uEHMHEHH}tUHEHUHH0H}HEغH5HIHHEHEغH5H*HHEHUHEHH谽EUHE؉HlUHH H}HEH5EH֞HHEHEHsHEH}t5HEHwHHEHHEH5H HEH7UHH H}HEH5HLHHEHEHHEH}t8HUHEHH;HEHTHEHȲHEH5UHHĀH}HEH5)H躝HHEHEHgHEHEH5HHHEH5HjHHEHEH)HHEEH}HHEHUHEHHE}uEEHEоH0HEH}t"HUHEHHREHEH蓱HEH HEHy}uHUHMHEHHEUHEHHEH2HUHEH赪HEHEHHiHEHEHEH}uHEHHHUHMHEHH|HEHyHHEH0HEHEHMHHHEHPHEHHPHEHPHEHHPHEHHEH}uHEH>HHUHEHHE}~AHEHt8EHcHMHEHHHEH5HDHEH,UHSHHxHxH5H茚HHEHEHHEHEHHEHxH,HEHEHUHMHEHHųHEHH6t~HEH&HEHEHt;HxH赸HHEHHxH5H0HxHoHxHH褣HEt6HMHxHHHxHHdHxHEHEH8HHxHH胰MHxHOHHUHxHH¼HxH)HעH}HxH5 HVHxH HUHxHHgHxHH"HWHHEH:HHzHEH>HEHEHޮHEHEHxHHEHݣE}HxHEUHEH*HEHEHJHEH}t;HxHKHHEHHxH5HƓHxHEPHxH+EE;E`HxHHH}HxHHUHEIйH t1HUHxHH0HxHH蕠EH}t;HxH3HHEHHxH5H讒HxHMHxHH"HxHHHxHHHĈ[]UHH H}HEH5H評HHEHEHUHH0H}HEغH5HkHHEHEؾHu_HEHHEH}t5HEؾHHHEHHEغH5Ht HEH趮FHEغH5iHהHHEHUHEHH=EUHE؉HUHH0H}HEغH5H胔HHEHEؾHu%HEHjHHEHH踫>HEؾHHHEHUHEHH'EUHE؉HsUHH0H}HEغH5LHݓHHEEHEؾHNu3HEHHEH}teHUHEHHoEIHEغH5HnHHEHUHEHHEUHE؉HEEUHSH8H}HEȺH5HHHEEHEȾH脓u`HEHHEH}HUHEHH豖Hz"HHHEHHHEhHEȾH^HEHUHEHH'EH"HXHHEH;HH{UHEȉHEEH8[]UHHPH}HEH5hHHHEEHEH5CHHtNHEH5&H趑HHEHUHEHHlEUHEHE/HEHoHEHEHEHEHʑu'UHEH褞HEHEHįHE*HEH荑uUHEH8HEH}H}t5HEH葯HHEHHEH5H HEHQE4HEHEEHEHlEUHEH@HEH诐HEHEH薐u@HMHEHHHEHUHEHH袑EHEH#5HEH5H詏HHEHUHEHH_EHEHE}u E;E!UHEHĽEEUHH H}HEH5H(HHEHEHHcHEHHsUHHH}HEHu #H5EHHEHHEH5 #H%HH=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADED0.9.1Lua 5.1OpenSSL 3.5.6 7 Apr 2026src/openssl.cmust greater than 0versionlisthexbase64rand_statusrand_addrand_loadrand_writerandomclear_errorerrorerrorsengineFIPS_modelegacydefaultbioasn1digestcipherhmacmacparamkdfpkeyecx509pkcs7pkcs12ocsptscmssslbnrsadsadhsrpdigestscipherspkeyscomps=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDUNIVERSALAPPLICATIONCONTEXT_SPECIFICPRIVATECONSTRUCTEDPRIMITIVE_TAGPRIMATIVE_TAGAPP_CHOOSEOTHERANYNEGUNDEFEOCBOOLEANINTEGERNEG_INTEGERBIT_STRINGOCTET_STRINGNULLOBJECTOBJECT_DESCRIPTOREXTERNALREALENUMERATEDNEG_ENUMERATEDUTF8STRINGSEQUENCESETNUMERICSTRINGPRINTABLESTRINGT61STRINGTELETEXSTRINGVIDEOTEXSTRINGIA5STRINGUTCTIMEGENERALIZEDTIMEGRAPHICSTRINGISO64STRINGVISIBLESTRINGGENERALSTRINGUNIVERSALSTRINGBMPSTRINGopenssl.asn1grouponly accept boolean, number, string or asn1_stringopenssl.asn1_typestart out of length of asn1 stringstop must be greater than startstop out of length of asn1 stringarg #1 with error encodingif exist only accept string or numberif exist must be boolean typetagclassopenssl.asn1_stringopenssl.asn1_integeropenssl.asn1_timeopenssl.asn1_objectoidnot have oid field or is not stringsnnot have sn field or is not stringlnnot have ln field or is not stringoid already existsn already existln already existnew_objectnew_integernew_stringnew_utctimenew_generalizedtimenew_typed2i_asn1typeget_objectput_objecttostringtxt2nidsrc/asn1.cvaluedertypeJDE=FFJDJJJEJjJJJJJJJFHGJG2IIJJGHJbHoctetcmpinfoi2dasn1string__eq__gcnidnametxtdupdataequalsd2iopenssl.bnonly accpet number or string[[6Y\YYYY[[[Y[Z[[[[[[@ZfZ[ZZZ[Z![D[[m[%b%b[[\\]~]%b%b%b]%b@^%b%b%b%b%b%b^_%bc__%`%b``Ta%baasn1_time with mismatched typelengthtoutf8toprintsetgetbnadjdiffcheck=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADED__indexclass%pinvalid object passed to 'auxiliar.c:__tostring'%.35s expected%s expected, got %s=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.biohostnameportopenssl.sslopenssl.evp_digestdon't know howto shutdownnot a supported BIO typenot a fd or file BIO typegetswriteputsflushclosetypenbioresetretrypendingpushpopnextget_mdcipher_statusfreeget_memacceptconnecthandshakeshutdownfdsslseektelldestroy_pair__gcnullmempairsocketdgramfilefilterNCLOSECLOSEbase64bufferciphermd=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.evp_cipheropenssl.enginesrc/cipher.cEVP_CipherInit_ex failed, please check openssl erroropenssl.evp_cipher_ctxnameblock_sizekey_lengthiv_lengthflagsmodesha256salt must not shorter than %dnever go hereexpect integer or stringnidtypecipherneed integer or stringinvalid integer, must be 4, 6, 10, 12, 14 or 16not support2gOgOg[[[g[[[[[[infonewencrypt_newdecrypt_newBytesToKeyencryptdecryptinitupdatefinalclosectrlpadding__gclistgetEVP_CTRL_INITEVP_CTRL_SET_KEY_LENGTHEVP_CTRL_GET_RC2_KEY_BITSEVP_CTRL_SET_RC2_KEY_BITSEVP_CTRL_GET_RC5_ROUNDSEVP_CTRL_SET_RC5_ROUNDSEVP_CTRL_RAND_KEYEVP_CTRL_PBE_PRF_NIDEVP_CTRL_COPYEVP_CTRL_GCM_SET_IVLENEVP_CTRL_GCM_GET_TAGEVP_CTRL_GCM_SET_TAGEVP_CTRL_GCM_SET_IV_FIXEDEVP_CTRL_GCM_IV_GENEVP_CTRL_CCM_SET_IVLENEVP_CTRL_CCM_GET_TAGEVP_CTRL_CCM_SET_TAGEVP_CTRL_CCM_SET_LEVP_CTRL_CCM_SET_MSGLENEVP_CTRL_AEAD_TLS1_AADEVP_CTRL_AEAD_SET_MAC_KEYEVP_CTRL_GCM_SET_IV_INVEVP_CTRL_TLS1_1_MULTIBLOCK_AADEVP_CTRL_TLS1_1_MULTIBLOCK_ENCRYPTEVP_CTRL_TLS1_1_MULTIBLOCK_DECRYPTEVP_CTRL_TLS1_1_MULTIBLOCK_MAX_BUFSIZE=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDnocertsno_content_verifyno_attr_verifynosigsnointernno_signer_cert_verifynoverifydetachednoattrnosmimecapnooldmimetypecrlfeolstreamnocrlpartialreuse_digestuse_keyiddebug_decryptkey_paramautoopenssl.cmsopenssl.biosmimezlibopenssl.x509openssl.evp_pkeyopenssl.x509_storeaes-128-cbcsha256keykeyidkey and keyid field must be stringpasswordpassword field must be stringsrc/cms.cexportnewdatacompressuncompresssignverifyencryptdecryptdigest_createdigest_verifyEncryptedData_encryptEncryptedData_decryptopenssl.asn1_objectmust have at least one signer infomust have at least one recipientmust have at least one signererror in make_receipt_requesttypecontentadd_signersget_signersadd_receiptsign_receiptverify_receiptfinal__gccompressionflags=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.dhsizebitsopenssl.bnpqgpub_keypriv_keyopenssl.enginegenerate_keyparsecheck__gcDH_CHECK_P_NOT_PRIMEDH_CHECK_P_NOT_SAFE_PRIMEDH_UNABLE_TO_CHECK_GENERATORDH_NOT_SUITABLE_GENERATORDH_CHECK_Q_NOT_PRIMEDH_CHECK_INVALID_Q_VALUEDH_CHECK_INVALID_J_VALUEDH_CHECK_PUBKEY_TOO_SMALLDH_CHECK_PUBKEY_TOO_LARGEDH_CHECK_PUBKEY_INVALIDCHECK_PUBKEY_TOO_SMALLCHECK_PUBKEY_TOO_LARGECHECK_PUBKEY_INVALIDCHECK_P_NOT_PRIMEUNABLE_TO_CHECK_GENERATORNOT_SUITABLE_GENERATORCHECK_Q_NOT_PRIMECHECK_INVALID_Q_VALUECHECK_INVALID_J_VALUEgenerate_parametersproblems=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.evp_digestopenssl.engineopenssl.evp_digest_ctxopenssl.evp_pkeynidnamesizeblock_sizepkey_typeflagstypedigestwrong datasrc/digest.cnewinfosignInitverifyInitupdatefinalresetclosedatasignUpdatesignFinalverifyUpdateverifyFinalsignverify__gclistget=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.dsabitsopenssl.bnpqgpriv_keypub_keyopenssl.engineparseset_engine__gcgenerate_key=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.ec_groupopenssl.ec_pointopenssl.bnEC_POINT_set_affine_coordinates failgeneratorordercofactorasn1_flagdegreecurve_nameconversion_formseedpabcurveexplicitnamed_curveinvalid paramater, only accept 'explicit' or 'named_curve'compresseduncompressedhybridinvalid paramater, only support 'compressed', 'uncompressed' or 'hybrid'openssl.evp_pkeyopenssl.ec_keynot accept type of point_conversion_formnot accept type of asn1 flagsrc/ec.c__gc__eqequalaffine_coordinatesparsepoint_conversion_formpoint_newpoint_duppoint_equalpoint2octoct2pointpoint2bnbn2pointpoint2hexhex2pointgenerate_keyinvalid digestenc_flagconv_formdxypub_keygrouppriv_keyopenssl.enginecheckexportdo_signdo_verifysignverifycompute_keyset_methodenc_flagscopyCURVE DESCRIPTION NOT AVAILABLElist=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDRSADSAECDHRANDciphersdigestsPKEYASN1complete#1 may be string or boolean string for an engine id to load true for first engine, false or last engine but we get %s:%sopenssl.enginenot support %d for %s__`+`S```{``anot support '%s' to set defaultAhUhihzhhhhopenssl.evp_pkeyopenssl.sslopenssl.x509openssl.pkeynextprevaddremoveregisterctrlidnameflagsset_rand_engineload_private_keyload_public_keyload_ssl_client_certinitfinishset_default__gc=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.engineopenssl.hmac_ctxupdatefinalclosesize__gcnewhmac=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADED(bn) %s %sBN_new failedopenssl.bnsrc/lbn.c__add__div__eq__gc__lt__mod__mul__pow__sub__unmabsaddaddmodaprimebitscomparedivdivmodgcdinvmodisnegisoddisoneisprimeiszeromodmulmulmodnegnumberpowpowmodrandomrmodsqrsqrmodsqrtmodsubsubmodtohextotexttonumbertostringversionbn library for Lua 5.1 / Nov 2010 / based on OpenSSL 3.5.6__index=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.lhashERROR at LINE %d__gcparseexportget_stringget_numberlhash_readlhash_load=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDautoderpemsmimeopenssl.bioonly support string or openssl.bioopenssl.asn1_objectopenssl.evp_digestmust be a string, NID number or asn1_object identity digest method5openssl.evp_ciphermust be a string, NID number or asn1_object identity cipher method11[411openssl.bnUNKNOWN ERROR0123456789abcdefbitnumlnamesnamepkcs1nooaepx931pss0123456789abcdef  =nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.x509sha256need openssl.x509 or openssl.bn objectopenssl.ocsp_certidopenssl.ocsp_requestOCSP REQUESTOCSP RESPONSEopenssl.ocsp_responseopenssl.ocsp_basicresphashAlgorithmissuerNameHashissuerKeyHashserialNumberopenssl.ocsp_onereqopenssl.x509_extensionopenssl.evp_pkeyrequestListextensionsopenssl.ocsp_singlerespidstatusstatus_strreasonreason_strrevokeTimethisUpdateproducedAtcertsnamesignerbasicinfo__gcexportparsesignadd_extis_signedaddresponsecopy_noncecertid_newrequest_readrequest_newresponse_readbasicresp_newNOSTATUSUNSPECIFIEDKEYCOMPROMISECACOMPROMISEAFFILIATIONCHANGEDSUPERSEDEDCESSATIONOFOPERATIONCERTIFICATEHOLDREMOVEFROMCRLGOODREVOKEDUNKNOWNRESPONSE_STATUS_SUCCESSFULRESPONSE_STATUS_MALFORMEDREQUESTRESPONSE_STATUS_INTERNALERRORRESPONSE_STATUS_TRYLATERRESPONSE_STATUS_SIGREQUIREDRESPONSE_STATUS_UNAUTHORIZEDinvalidity_datehold_instruction_code=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDdata size not match with digest sizeopenssl.ts_msg_imprintsrc/ots.copenssl.x509_algormsgalgodupexporttotable__gcopenssl.ts_accuracymicrosmillissecondsopenssl.ts_tst_infoversionpolicy_idmsg_imprintserialtimeaccuracyorderingnoncetsaextensionsopenssl.ts_reqopenssl.ts_respopenssl.x509need openssl.x509 objectopenssl.evp_pkeyneed openssl.pkey objectopenssl.asn1_objectneed openssl.asn1_object, nid string or numbersigner cert and private key not matchopenssl.ts_resp_ctxmust be ts_req data or object or nilopenssl.ts_verify_ctxreq_newreq_readresp_readts_accuracy_readts_msg_imprint_readresp_ctx_newverify_ctx_newts_accuracy_newts_msg_imprint_newinvalid openssl.bn or can't convert to openssl.bnopenssl.x509_extensioncert_reqhashed_msghash_algoinfoadd_extto_verify_ctxstatusfailure_infoopenssl.pkcs7status_infotokentst_infoneed one or more asn1_object#%d not valid evp_digest object or idtime_cb_keyserial_cb_keyError during serial number generation.could not get current timesignercertsdefault_policypoliciesclock_precision_digitsmdadd_flagsset_serial_cbset_time_cbrequestsigncreate_responseopenssl.x509_storedata is not ts_resp objectmust be ts_resp or pkcs7 objectstoreflagsverifydataimprintSTATUS_GRANTEDSTATUS_GRANTED_WITH_MODSSTATUS_REJECTIONSTATUS_WAITINGSTATUS_REVOCATION_WARNINSTATUS_REVOCATION_NOTIFICATIONINFO_BAD_ALGINFO_BAD_REQUESTINFO_BAD_DATA_FORMAINFO_TIME_NOT_AVAILABLINFO_UNACCEPTED_POLICYINFO_UNACCEPTED_EXTENSIONINFO_ADD_INFO_NOT_AVAILABLINFO_SYSTEM_FAILURVFY_SIGNATUREVFY_VERSIONVFY_POLICYVFY_IMPRINTVFY_DATAVFY_NONCEVFY_SIGNERVFY_TSA_NAMEVFY_ALL_IMPRINTVFY_ALL_DATA=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.x509openssl.evp_pkeymust be private keymust be table contians x509 object as cacetsprivate key does not correspond to certPKCS12_create failed,pleases get more error infocertpkeyextracertsexport=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDautoopenssl.pkcs7datasignedenvelopedsignedAndEnvelopeddigestencryptedmust supply certificate or crl objectopenssl.x509openssl.x509_crladd to pkcs7 failopenssl.evp_pkeysigcert and private key not matchopenssl.x509_storeaes-128-cbcpemonly accept pem, der or smime, default is pemversionopenssl.x509_nameissueropenssl.asn1_integerserialopenssl.x509_algordigest_algdigest_enc_algopenssl.asn1_stringenc_digestpkeyauth_attrunauth_attrtypedetachedmd_algssigner_infocontentscertscrlsP%Gparseexportdecryptverifyaddset_contentset_digestfinal__gcnewcreatesignencryptTEXTNOCERTSNOSIGSNOCHAINNOINTERNNOVERIFYDETACHEDBINARYNOATTRNOSMIMECAPNOOLDMIMETYPECRLFEOLSTREAMNOCRLPARTIALREUSE_DIGEST=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDsrc/pkey.cpkey != NULLautoopenssl.evp_pkeyrsaopenssl.enginedsadhecfailed to get ec_group objectnot support %s!!!!algnedpqdmp1dmq1iqmpgpriv_keypub_keyec_nameparam_encconv_formget openssl.ec_group failopenssl.bnparameters must have "%s" field string or openssl.bnxyzonly accpet affine co-ordinatesopenssl.rsaopenssl.ec_keyopenssl.dhopenssl.dsaonly accept 'pem','der' or nonepemonly accept pem or der, default is pemRSARSA-PSSECED25519ED448X25519X448SM2DHX9.42 DHDHXDSAbitssizetypesm2pkcs1EVP_PKEY must be of type RSA or RSA2not supportopenssl.evp_pkey_ctxinvalid public key algorithmNOT_SUPPORTonly support DH or EC private keymismatch key typesha256sm31234567812345678must be openssl.evp_pkey or arrayempty arrayaes-128-cbctable with gapopenssl.evp_cipher_ctxis_privateget_publicset_engineexportparsectxencryptdecryptsignverifysealderivemissing_paramaters__gcencrypt_initdecrypt_initverify_initsign_initctrlkeygennewctx_newseal_initseal_updateseal_finalopen_initopen_updateopen_finalopenssl_pkey_is_private=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.rsapkcs1src/rsa.csha256sizebitsopenssl.bnnedpqdmp1dmq1iqmpopenssl.enginen must be positivedata length to pad mismatch with digest sizepadded data length mismatch with RSA sizeunpadded data length mismatch with digest sizePPparseisprivateexportencryptdecryptsignverifyset_engine__gcgenerate_keypadding_addpadding_check=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDallallow_unsafe_legacy_renegotiationcipher_server_preferencecisco_anyconnectcookie_exchangecryptopro_tlsext_bugdont_insert_empty_fragmentsephemeral_rsalegacy_server_connectmicrosoft_big_sslv3_buffermicrosoft_sess_id_bugmsie_sslv2_rsa_paddingnetscape_ca_dn_bugnetscape_challenge_bugnetscape_demo_cipher_change_bugnetscape_reuse_cipher_change_bugno_compressionno_query_mtuno_session_resumption_on_renegotiationno_sslv2no_sslv3no_ticketno_tlsv1no_tlsv1_1no_tlsv1_2pkcs1_check_1pkcs1_check_2single_dh_usesingle_ecdh_usessleay_080_client_dh_bugsslref2_reuse_cert_type_bugtls_block_padding_bugtls_d5_bugtls_rollback_bugTLSSSLv23SSLv23_serverSSLv23_clientTLS_serverTLS_clientDTLSDTLS_serverDTLS_clientDTLSv1_2DTLSv1_2_serverDTLSv1_2_clientDTLSv1DTLSv1_serverDTLSv1_clientTLSv1_2TLSv1_2_serverTLSv1_2_clientTLSv1_1TLSv1_1_serverTLSv1_1_clientTLSv1TLSv1_serverTLSv1_clientonly support TLS, DTLS to negotiate highest available SSL/TLS or DTLS version above openssl v1.1.0 optional followed by _client or _server default is TLS ALL:!COMPLEMENTOFDEFAULT:!eNULLError to set cipher listopenssl.ssl_ctxopenssl.ssl_sessionctx_newalert_typealert_descsession_newsession_readopenssl.evp_pkeyopenssl.x509enable_partial_writeaccept_moving_write_bufferauto_retryno_auto_chainrelease_buffersmax version can't less than minopenssl.x509_storeopenssl.engineopenssl.bioopenssl.sslctxnonepeerfailoncemust be none or peer(combined with fail, once or nonemust be callback functionverify_cbneed function or table contains flagsverify_cb_flagscert_verify_cbinvalid protocol valuetoo long protocol valuefail to allocate protocol listfail to set ALPN protocolstable expectedalpn_select_cbalpn select callback error: %s tlsext_servernamemust be table or functionadd session callback error: %s get session callback error: %s get session callback return unaccpet value: (type=%s)%s del session callback error: %s offno_auto_clearbothserverclientno_internalno_internal_lookupno_internal_storesslbiouseaddmodetimeoutoptionsversionnum_ticketsquiet_shutdownverify_locationscert_storeset_engineverify_modeset_cert_verifyset_alpn_protosset_alpn_select_cbverify_depthflush_sessionssessionsession_cache_modeset_session_callbackset_servername_callback__gcverify_certidtimecompress_idexportis_resumablehas_ticketnothingreadingwritingx509_lookupnamebitsalgbitsdescriptionwant_readwant_writewant_x509_lookupsyscallwant_connectwant_accept&'N''' (&B(~(fdrfdwfdclient_CA_listread_aheadshared_cipherscipher_liststate_stringstate_string_longrstate_stringrstate_string_longiversiondefault_timeoutcertificateverify_resultstatehostnamesidecan't understantclient_CApurposetrustdon't understandwriteCan't understand SSL_get_shutdown resultshould be boolean or string[read|write|quiet|noquite]invalid state: rbio or wbio already setopenssl.ssl %psetgetgetfdis_servercurrent_ciphercurrent_compressiongetpeerverificationdupclearwantpendingacceptconnectpeekrenegotiatehandshakeshutdownsession_reusedcache_hitrenegotiate_abbreviatedrenegotiate_pendingset_connect_stateset_accept_stateget_alpn_selecteddefaultDEFAULT_CIPHER_LISTquietnoquiet=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADED=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDpurposetrustflagsnamesnameonly accpet NONE, string or number as nid or short namestandardnetscapeextendlnamenidautoopenssl.x509openssl.bnopenssl.x509_reqopenssl.x509_namenewcerttypesverify_cert_error_stringotherNametyperfc822NamedNSNamex400AddressdirectoryNameuniformResourceIdentifieriPAddressnameAssignerpartyNameediPartyNameregisteredIDunsupport+ssig_algopenssl.x509_algorsigpemversionsubjectissuer%08lxhashserialNumbernotBeforenotAfteraliascapurposesextensionsopenssl.x509_extensionopenssl.evp_pkeyopenssl.x509_storeanyinternalmalformedsrc/x509.cmust be a table as array or nilsha256openssl.asn1_stringnot acceptparseexportcheckcheck_hostcheck_emailcheck_ip_ascpubkey__gc__eqequaldigestnotbeforenotafterserialvalidatsignverifyALWAYS_CHECK_SUBJECTNEVER_CHECK_SUBJECTNO_WILDCARDSNO_PARTIAL_WILDCARDSMULTI_LABEL_WILDCARDSSINGLE_LABEL_SUBDOMAINSOKUNSPECIFIEDUNABLE_TO_GET_ISSUER_CERTUNABLE_TO_GET_CRLUNABLE_TO_DECRYPT_CERT_SIGNATUREUNABLE_TO_DECRYPT_CRL_SIGNATUREUNABLE_TO_DECODE_ISSUER_PUBLIC_KEYCERT_SIGNATURE_FAILURECRL_SIGNATURE_FAILURECERT_NOT_YET_VALIDCERT_HAS_EXPIREDCRL_NOT_YET_VALIDCRL_HAS_EXPIREDERROR_IN_CERT_NOT_BEFORE_FIELDERROR_IN_CERT_NOT_AFTER_FIELDERROR_IN_CRL_LAST_UPDATE_FIELDERROR_IN_CRL_NEXT_UPDATE_FIELDOUT_OF_MEMDEPTH_ZERO_SELF_SIGNED_CERTSELF_SIGNED_CERT_IN_CHAINUNABLE_TO_GET_ISSUER_CERT_LOCALLYUNABLE_TO_VERIFY_LEAF_SIGNATURECERT_CHAIN_TOO_LONGCERT_REVOKEDINVALID_CAPATH_LENGTH_EXCEEDEDINVALID_PURPOSECERT_UNTRUSTEDCERT_REJECTEDSUBJECT_ISSUER_MISMATCHAKID_SKID_MISMATCHAKID_ISSUER_SERIAL_MISMATCHKEYUSAGE_NO_CERTSIGNUNABLE_TO_GET_CRL_ISSUERUNHANDLED_CRITICAL_EXTENSIONKEYUSAGE_NO_CRL_SIGNUNHANDLED_CRITICAL_CRL_EXTENSIONINVALID_NON_CAPROXY_PATH_LENGTH_EXCEEDEDKEYUSAGE_NO_DIGITAL_SIGNATUREPROXY_CERTIFICATES_NOT_ALLOWEDINVALID_EXTENSIONINVALID_POLICY_EXTENSIONNO_EXPLICIT_POLICYDIFFERENT_CRL_SCOPEUNSUPPORTED_EXTENSION_FEATUREUNNESTED_RESOURCEPERMITTED_VIOLATIONEXCLUDED_VIOLATIONSUBTREE_MINMAXAPPLICATION_VERIFICATIONUNSUPPORTED_CONSTRAINT_TYPEUNSUPPORTED_CONSTRAINT_SYNTAXUNSUPPORTED_NAME_SYNTAXCRL_PATH_VALIDATION_ERRORPATH_LOOPSUITE_B_INVALID_VERSIONSUITE_B_INVALID_ALGORITHMSUITE_B_INVALID_CURVESUITE_B_INVALID_SIGNATURE_ALGORITHMSUITE_B_LOS_NOT_ALLOWEDSUITE_B_CANNOT_SIGN_P_384_WITH_P_256HOSTNAME_MISMATCHEMAIL_MISMATCHIP_ADDRESS_MISMATCHDANE_NO_MATCHEE_KEY_TOO_SMALLCA_KEY_TOO_SMALLCA_MD_TOO_WEAKINVALID_CALLSTORE_LOOKUPNO_VALID_SCTSPROXY_SUBJECT_NAME_VIOLATIONOCSP_VERIFY_NEEDEDOCSP_VERIFY_FAILEDOCSP_CERT_UNKNOWNSIGNATURE_ALGORITHM_MISMATCHNO_ISSUER_PUBLIC_KEYUNSUPPORTED_SIGNATURE_ALGORITHMattributeextensionstorealgorreqcrlcheck_flagverify_resultDigital SignaturedigitalSignatureNon RepudiationnonRepudiationKey EnciphermentkeyEnciphermentData EnciphermentdataEnciphermentKey AgreementkeyAgreementCertificate SignkeyCertSignCRL SigncRLSignEncipher OnlyencipherOnlyDecipher OnlydecipherOnlySSL ClientclientSSL ServerserverS/MIMEemailObject SigningobjsignUnusedreservedSSL CAsslCAS/MIME CAemailCAObject Signing CAobjCA)=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.x509_attributenew_attributeobjectvalueinfodupdatatype__gcopenssl.asn1groupmust be a table as array or nil=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDobjectcriticalvaluesrc/xexts.cdon't support object(%s) with value (%s)openssl.asn1groupfield value must be string or openssl.asn1group objectopenssl.x509_extensionlnamesnamenidsupportnew_extensionread_extensiononly accpet asn1 octet string if is a asn1 stringinfodupexportdata__gcmust be a table as array or nilGSUWY~"#=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.x509_namecan't add to openssl.x509_name with value (%s=%s) at %d of #%d table argmust be not empty table as arraynewd2isrc/xname.conelinehashdigesttoprintinfodupi2dentry_countget_textget_entryadd_entrydelete_entrycmptostring__eq__gcmust be a table as array or nil=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.x509only contains x509 objectopenssl.x509_crlopenssl.x509_storenewfiledefaultonly accept table with x509 or x509_crl objectonly accept x509 or x509_crl object or table with x509 or x509_crl objectflagspurposedepthtrustloadaddadd_lookup__gcdirpemasn1=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDmust be a table as array or nilopenssl.x509_algornewopenssl.asn1_objectopenssl.asn1_stringdupsetgetmdtostringequals__eq__gc=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDsecretkeysaltpassprefixlabeldataukminfoseedxcghashsession_idconstantdigestciphermacpropertiesmodecekalgmacleniternpmaxmem_bytespkcs5typeiduse-luse-separatorsizenamedata_type>>Zempty paramaters tablesrc/param.c%s:%d in %s: Error NYI g:S1J(gkdfnumber_typeintunsinged intlongunsinged longint32uint32int64uint64size_ttime_tBIGNUMdoubleunknownf1Nhopenssl_toparamsC=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.kdfmust be a string for KDF method namesrc/kdf.ctyp == LUA_TFUNCTIONout of support range, limited to 64openssl.kdf_ctxdupresetderivesizekdfgettable_paramssettable_paramsget_paramsset_params__gcdescriptionnameprovideris_aiteratornewsettable_ctx_paramsgettable_ctx_paramsfetchnamesHKDFTLS13-KDFPBKDF1PBKDF2SCRYPTSSHKDFSSKDFTLS1-PRFX942KDF-ASN1X942KDF-CONCATX963KDFKBKDFKRB5KDFkdf_iterator_cbiterator_cb=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDverify_certpreverify_okerrorerror_stringerror_depthopenssl.x509current_certcert_verify_cbverify_cbverify_cb_flagsalways_continueverify_depth=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.srp_gnopenssl.bncalc_ucalc_acalc_xcalc_client_keycalc_bcreate_verifiercalc_server_keyget_default_gN=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDopenssl.macsrc/mac.copenssl.mac_ctxNYIopenssl.ctxmust be a string, NID number or asn1_object identity digest/cipher methodhmacdigestcmaccipheropenssl.engineis_anamesproviderget_params__gcupdatefinalclosesizedupmacparamsctxnew=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDUnspecifiedunspecifiedKey CompromisekeyCompromiseCA CompromiseCACompromiseAffiliation ChangedaffiliationChangedSupersededsupersededCessation Of OperationcessationOfOperationCertificate HoldcertificateHoldRemove From CRLremoveFromCRLPrivilege WithdrawnprivilegeWithdrawnAA CompromiseAACompromise unsetinvalid revoke reasonfail convert to revoke reasoncodereasonserialNumberrevocationDateextensionsmust be table contains rovked entry table{reason,time,sn}timesnopenssl.x509openssl.evp_pkeymust be private keyevp_pkey not match with x509 in #2sha256openssl.x509_crlautonewopenssl.x509_nameonly accept openssl.x509 or openssl.x509_name objectmust be x509 or evp_pkey objectmust be openssl.x509 or openssl.x509_name objectprivate key not match with cacertversion%08lxhashalgfingerprintissuerlastUpdatenextUpdateopenssl.x509_algorsig_algsignaturecrl_numberrevokedpemonly accept der or pemOut of rangeopenssl.asn1_integeropenssl.x509_revokedsortverifysigndigestdiffupdateTimeaddparseexportcmpcountget__eq__gcopenssl.bninfomust be a table as array or nil=nonelocal op,a,b=... if op==0 then return a+b elseif op==1 then return a-b elseif op==2 then return a*b elseif op==3 then return a/b elseif op==4 then return a%b elseif op==5 then return a^b elseif op==6 then return -a end invalid 'op' argument for lua_arithnot enough stack slotslocal a,b=... return a<=b invalid 'op' argument for lua_compare__lenattempt to get length of a %s valuestack overflow (%s)stack overflowobject length is not an integertoo many upvalues.ffunction '%s'main chunk?function <%s:%d>%s stack traceback: ...Slnt %s:%d: in %s: %sattempt to load a %s chunk (mode is '%s')binarytextcannot %s %s: %s=stdin@%sropenrbreopenreadexitsignalbuffer too largecannot convert value to stringnot enough stack slots available__compat53_extraspacek__mode__tostringniltruefalse__name%s: %p'__tostring' must return a string_LOADEDautoopenssl.x509_reqopenssl.x509_nameopenssl.evp_pkeymust be x509_name or evp_pkeymust is evp_pkey objectsha256newopenssl.x509pemonly accept der or pemhas not set public key!!!src/csr.copenssl.x509_algorsig_algsignatureversionsubjectextensionsopenssl.x509_attributeattributesalgorithmpubkeyreq_infoto_x509exportparsedigestverifycheckdupsignpublicattributeattr_count__gc;R] S8SXSIxSSSS\ST8T}XTxTTwTT-TUw8UEXUxUUUUUVa 8V XV xV^ V$ V V7 VWR8W:XWxWWeWBWWXo8XXXxXX XX`XY8YEXY? xY!Y#Yb$Y$Y%Z%8ZG&XZ&xZ_'Z'Z (Z(Z([ )8[u)X[,x[4-[-[-[.[:/\l08\0X\ 2x\y2\2\h3\s3\3] 58]5X]6x]6]7]X8]9]9:^\;8^V=X^m>x^>^=?^>@^@^A_2B8_BX_&Ex_E_F_G_{H_H`I8` JX`sJx`J`N`N`O`Oa\P8aPXazQxauSaTaWaKYa[b]fҌff:gD$gΏDgdgggFgDgmgh$h"Dhhhh3hhhiF(iHihigiߜiiaij(jHjahj/jϡjjjӤkͦ(kHkKhkkkHkkl!(lHlnnn4o(oHowhoooo4op(pHp:hplpp pypqh(qsHqhq qqqqrX(rHr9hr\rVrmrr=s>(sHshs2ss&sst(t{Hthtt tsttu(uHuhu\uuzuuuv(vHvNhvvUvvvYw(wXHwhwwHwOw1wx"(xHxhxxxxWxy(yHyhyyyyyUz.(zHzhzC z zC zx zL { ({( H{ h{{5{{${/|(|H|\h|D||t||J}(}H}h})}}}}~S(~H~fh~!~"~i#~#~7%%(q&H&h/''*?++;,(-H-h6.10t1Ȁ1s25(b9Hܥ(KH¦h:EȏܨrZ(Hh*` Ȑ.(?(Hhiȑ|(HhMȒE(HhUQȓ.L(GHh0Ȕ((0Hh6ȕh(uHhdoȖ(HhT5ȗXRi(H9h:Ș."(Hhwșo(Hh{ȚXv(qHh>ț}(HhȜd (K L l-  ̝ ` 0(P]p1 Оp0P pПA)0YPp/Р u 0 P!pr"8##СK$&f'0N(P(p*y*V+Т+,,0/P$0p0 11Уt2350Y6P6p9Z:;Ф<j<<0s=P>pO??@Х\AAKB0VBPBpCDkEЦEF;G0qHPIp?J9LPMЧM N!O0OPzPpQQ TШTUV0^WPWpXYVYЩY\f]0]Pb^p?__]`ЪXbcye0tfPktllmԫnn\o4CpTst0ttuԬkvwx4yT_zta{=||ԭ~i8XxBخ8<͉8Xx^Jد1J8XҐxPذ 8X~x ر8ΚXnxOrزl8SXTxHس<ۨ8éX4xˬش68Xx*rص8ηX.|ٹֺܶ(Ƚ(<f\,|ܷ7<\|F L@~`z @`j K@n`hOP @D`80 @`2& @n`C @`=@uI @%`2!, @`YAqG @`& P @ `c ~f4 @n`,< 8@`3.q:  @L ` >!"D""" #@T#`##?$$ %m% %@z&`&B''E((H) )@S*`*c++,%-- .@.`.e//01c1 1@l2`3H445U66 D7@O7`78|9d::; 4<@j=`>8?2AIBBC D@D`sEFFIIJ J@WL`LMMONNQ _R@R`[S8TTVUQWX Y@Z`ZW[[^L^~^ ^@_``p``ya#bUc c@d`beeQf\ffg h@qi`ijAkwl"mEn ?p@Vq`q&r'sstu u@x`xyzd{{| }@\}`}lhE @c`^lʈM !@r`9 ѐ@`ɑlzڒ -@b`6u @`F. ^@`4ߟz @`w=اP̪k S@Ĭ`!~[Ư @)`%y  ^@`V9Sʿb K@`$b2D$Dd*^(WH~h#&4B(HhHz(Hvh(HfhGjd{(KHLh@4(H,h.(Hh"j(HhbV^(&H h o O(HhNM(GHhQ<(/Hha(H3 h x###~$3%(%Hc'h(()Y** o,,-L-l-/.002 3,5L6l7_89u9 : W:,;L=p==o==x>"?0T@P@pAaBBPC[CC0DPEppFFG@HvI!J0DKP>MpUNN%O&PPQ0RPRpUUVWcXX0YPZp[ZZ]k^^g_0D`P`pba]cd}gii8jXjxjqjjzk$lVm8mXnxcooRp]ppq8rXrsxstBuxv#wFx8@zXW{x{'|(}}~8Xxe…8 X]ẋmiF8Xdx_}b<u\$Pe(QHhxԫ (ݬHhWư=(H7hWմ7(۷Hh!(Hhsk(H%hm/U ( aH h      ( aH h    E  , L dl       , = L  l A   s 1 , L l  X K l G$4%TT&t'}(+))O++4,X,x--../@0{181Xa2x22[3{4558[6X)7x789:<=8E>X>x?B@AABD86EXFxFGIH&III8SJXyMxMNNODPP8RX)TxgTT U]UV#X8PY\0Z_`aLbc d@d`(htllmfmm on@o`KppqXrrGs Rs@s`tugvvw7x my@z`;{5}L~~ @v` Z@`Rb @^`;YT] @`z˞w &@`   @ K` ɯ ( V ճ !^ !޷@!`!o!!˽!C!"$"D"d"">""0"#$#D#d##q###=$$$_D$d$f$$$`$%$%D%d%M%*%%%&E$&D&d&&W&&&'S$'D'wd''B'':'o(C((H(h(((,(()&()H)h)S);))k) *A(*H*h* * ***+(+JH+h+]++x+`+,.(,H,hh,,& , , ,6 - (-2H-h----(-k-. (.H.Yh..D.R.`.n/|(/H/h///.//0(0AH0|h00b000\1|(1H1h1\ 1*!1!1#1#2$(2&H2'h2F(2(2)2C*2 +3+(3,H3.h37/3030313J24'3(43H43h4T44z747484859(5E:H5:h5<5*>5?5QA53D6D(6EH6Il6N6P6P6Q6LW 7W,7rXL7JZp7[7;\7\7Y]7^8{_48)`T8`t8ua8b8Qd8g8oi9j49kX9nx9 p9p9r9r9r:r8: sX:`sx:s:it:u:Ev:v;w8;RxX;xx;Ay;Ly;y;z;y{<a|8<|X<}x<1~<g<<5</=F8=X=x===p= =>8>X>x>>T>>>?L8?X?x?\??X?5?@S8@NX@x@$@"@b@@*A)8AXAdxA$AQANAB Bţ@Bӣ`BBBB BC' Ck@C`CCǥCqCCDA D@D'`DDD!DAD׬E E!@E`EEŰEpEEF F @Ft`FuFFθFiFG] G@G`GUGGGGWH H@H?`HHKHHH I I@I`IIIBIIJ(JHJ hJIJJJ[J K,KPKpKK K]KKfL0LBPLpLLOLL>LIM0MPMvpM^MMM.MdN0N2PN,pNCNNNNOm0OPOpOOOOOQP0PPPpPIPPPYPQU0Q2PQpQPQKQQQR 4R TR tR R R R R S8SXSxS>SSSSSHT V^@V`VV> V !V!V"W# W$@W&`W'W((W(W)W%*X* X+@X+`Xz.X/X0Xr0X1Y,2 Y 3@Yt3`Y3Y64Y\7Y7Yh8Z8 Z9@Z':`Z:ZZ5@ZP@[@ [A@[VB`[B[&C[C[D[F\XG \fG@\tG`\G\G\ H\H\I]J ]K@]XL`]L]>M]M]M]8N^XO ^O@^P`^8Q^R^R^S^T_U _W@_X`_"Y_Y_Z_[_[`\ `\@`t_``````la`b`&cad and@ad`a0eaVhahabiaibj b!k@bk`bmbob3pb0qbqcq$c\rDcsdc`sctcucuc/vdv(dvHdwhd5xdgydyd{dt{e{(ec|Hen|he|e~e~eef(fSHfhf4fWfQfhfχg8(g9Hg̉hgg-gg!gh(hHhvhhӑhhhnhݓi(i~HihiziWiΙiuipj(j5HjUhj?jTjjܰjkZ0kPkpk*kkkkl 0l*Plpll lغlxlmY0m|Pmvpmmm]m^mn0nRPnpnFnnn>no0oPo@pooo(oo4p0p|Ppppppppq0qPqpqqqqPqr*0rzPr5prrXrr"rs0sGPspss'swsst0t1Ptfpt:tttytu#0uPupuuuuJu2v0vbPvpv8vvvvw~0wPwpw{wAwwTwxo0xWPxpx%xx_xxy0y Py- py y) yy}y$z0zbPzpzazzgzzp{0{LP{p{{Y{{H{S|0|P| p|h!|!|"|8#|n$}%0}<&P}6(p}M)})}*}+}+~w,0~-P~-p~0~0~1~1~[3304P5pS558c99_:0<;P;pZ<U>?Ѐ@BC0EPPFpxGHHЁDIII0JPJKp|LLNЂNOxO0OPOpQQRЃRShT0UPIVplWfY}ZЄZM[N\0\P]pB^^6aЅab.c0dPdpe0ffІfjj0$kPkplllmЇopq0qP;rpr ssЈ?t}tu0uPupvv5zԉz}a~8Xqxo؊ʁ؁8Xxb؋8hXx8،8X8xΊ؍8gXx؎kl8ŖX`xؗT؏ۛL8XxNؐ6B8XxؑB8X:xQܮܒpƶ<\˸ j @`=a p @`U X@dzȖ l(HuhQȗ^(MHXhȘm(=HshA;șR"(#Hh|Ț (H`hțX(hHhdAȜ_Z(Hkh̝  , L* lN ;yОa0Tt zRx $PSFJ w?;*3$"DSAC N d5AC p ɤAC  }AC  2AC - cAC ^ \;AC 6 $woAC j DƨwAC r dxAC s u AC F `wAC r  AC  AC  -AC  $bAC ] D7AC  dAC  e6AC 1 {AC  #AC   AC  AC  $ڲgAC b D!iAC d djAC  KAC  AC  dAC  ߵxAC s 7|AC w $AC  DAC  dڹqAC l +]AC X h]AC X AC  bkAC f SAC N $oAC j D/&AC ! d5{AC v AC  kAC f LAC   wAC r `AC  $AC  DCAC > dAC  dAC _ LAC G /sAC n eAC ` AC  $AC S DxAC  doAC j 6AC  AC  $(AC c ,AC  AC O $%AC ` DhAC c d{AC v pDAC  SAC N 5AC p AC   AC  $ 2AC - D ,cAC ^ d o;AC 6  oAC j  wAC r  0xAC s  AC F  swAC r $ AC  D AC  d @AC   bAC ]  JAC   AC   x6AC 1  AC  $ #AC  D AC  d AC   gAC b  4iAC d  }AC   ^AC   AC  $ wAC  D xAC s d J|AC w  AC   %AC   qAC l  >]AC X  {]AC X $ AC  D ukAC f d SAC N  oAC j  B&AC !  H{AC v  AC  kAC f $_AC  DwAC r dsAC  AC  CAC > JAC E  "IAC E? GAC } (AC  HnAC  h AC  AC  UAC P  rAC m _AC  AC  (eJAC E H,AC ' hAC z >AC y AC  AC  AC  @AC { (PAC K HAC  hAC  AC  ^AC  zAC u lAC  >AC y (AC  Hq|AC w hAC  wAC  CSAC N vAC  P2AC - b6AC 1 (xAC  H$AC  h$PAC K  $AC E %AC   &>AC y  (&*AC E  .' AC  0(AC  P(LAC G p(MAC H (AC  )AC  x*)AC $ +AC  ,oAC j 0V,AC   P-AC  t;.SAC N n.5AC p .AC  7/AC  /2AC - 0cAC ^ 41;AC 6 T12oAC j t2wAC r 2xAC s /3 AC F 3wAC r q3 AC  q4AC  44AC  T5bAC ] t5AC  6AC  76AC 1 58AC  8#AC  9AC  4;AC  TAC  x>AC  ?AC  ?xAC s 4?|AC w TMBAC  tBAC  CqAC l C]AC X "E]AC X _EAC  FkAC f 4gFSAC N TFoAC j tF&AC ! I{AC v JJAC  JkAC f KAC  KwAC r 4LAC  TLAC  t|NCAC > OAC J OAC  (QAC  RAC  $S]AC X 4aSsAC n TSsAC n tTWAC R >TAC  T*AC e TnAC i DUSAC N wU5AC p 4UAC  T@VAC  tV2AC - WcAC ^ X;AC 6 :YoAC j YwAC r YxAC s 48Z AC F T#ZwAC r tzZ AC  z[AC  [AC  \bAC ] \AC  ]AC  4(^6AC 1 T>_AC  t_#AC  `AC  bAC  cgAC b ciAC d  -dAC  4 eAC  T eAC  t 'fAC   fxAC s  f|AC w  ViAC   iAC  !jqAC l 4!j]AC X T!+l]AC X t!hlAC  !%mkAC f !pmSAC N !moAC j !m&AC ! "p{AC v 4"SqAC  T"qkAC f t"rAC  "rwAC r "#sAC  "sAC  "uCAC > #v AC  4#w1AC , T#x\AC W t#xlAC g #*yAC  #yAC  # zAC  #zAC  $I{AC  4${zAC u T$~gAC b t$O@AC ; $oIAC D $AC  $AC  $AeAC ` %AC  4%fAC a T%8qAC l t%AC  %AMAC H %nAC  %܆AC  %gAC  &ևAC  4&ψAC  T&R]AC X t&AC  &gAC  & AC  &͋\AC W & \AC W 'EAC  4'AC  T'AC  t';AC  'AC  '@SAC N 's5AC p 'AC  (<AC  4(Ɛ2AC - T(ؑcAC ^ t(;AC 6 (6oAC j (wAC r (ܓxAC s (4 AC F )wAC r 4)v AC  T)vAC  t)AC  )bAC ] )AC  )AC  )$6AC 1 *:AC  4*ř#AC  T*ȚAC  t*AC  *gAC b *iAC d *)AC  * AC  +}AC  4+#AC  T+xAC s t+|AC w +RAC  +ѣAC  +qAC l +]AC X ,']AC X 4,dAC  T,!kAC f t,lSAC N ,oAC j ,&AC ! ,{AC v ,OAC  -kAC f 4- AC  T-ȬwAC r t-AC  -AC  -CAC > -AC  -uAC p .cuAC p 4.zAC u T.AC  t.AC  .VAC  .AC  .>AC  .AC  /gAC  4/!AC  T//AC * t/zAC u /DhAC c /AC  /4AC  /AC  0AC I 40AC I T0AC I t0AC I 0AC I 0AC I 0AC I 0AC I 1vAC I 41dAC I T1RSAC N t15AC p 1AC  1NAC  12AC - 1cAC ^ 2-;AC 6 42HoAC j T2wAC r t2xAC s 2F AC F 21wAC r 2 AC  2AC  3AC  43bAC ] T3AC  t3AC  366AC 1 3LAC  3#AC  3AC  4AC  44gAC b T4iAC d t4;AC  4AC  4AC  45AC  4xAC s 5|AC w 45dAC  T5AC  t5qAC l 5]AC X 59]AC X 5vAC  53kAC f 6~SAC N 46oAC j T6&AC ! t6{AC v 6aAC  6kAC f 6AC  6wAC r 71AC  47AC  T7CAC > t7AC I 7AC  7,AC  7wAC r 7AC  83AC . 48AC   T8LAC EB  x8AC E 8FAC  8%AAC < 8FAC  8AC  9AC   <9qAC E `9cAC ^ 9ZAC  9AC   9BAC E 9AC  :|AC w $:AC  D: AC   d: AC E : AC   : AC Ev  :KAC E  :AC E ;>AC y 4;AC  T;SAC N t;5AC p ;AC  ;AC  ;<2AC - ;NcAC ^ <;AC 6 4<oAC j T<wAC r t<RxAC s < AC F <wAC r < AC  <AC  =bAC  4=*bAC ] T=lAC  t=AC  =6AC 1 =AC  =;#AC  =>AC  > AC  4>!gAC b T>V!iAC d t>!AC  >"AC  >"AC  >#AC  >$xAC s ?l$|AC w 4?&AC  T?G'AC  t?(qAC l ?`(]AC X ?)]AC X ?)AC  ?*kAC f @*SAC N 4@+oAC j T@d+&AC ! t@j.{AC v @.AC  @6/kAC f @/AC  @>0wAC r A0AC  4A1AC  TA2CAC > tA4>AC y A84hAC c A7AC  A,8,AC ' A89AC  B9AC  4B2AC - Bx?cAC ^ C?;AC 6 4C@oAC j TC%AwAC r tC|AxAC s CA AC F CAwAC r CB AC  CCAC  DCAC  4DTDbAC ] TDDAC  tDDEAC  DE6AC 1 DFAC  DeG#AC  DhHAC  EBJAC  4E9KgAC b TEKiAC d tEKAC  ELAC  EMAC  EMAC  E>NxAC s FN|AC w 4FPAC  TFqQAC  tF9RqAC l FR]AC X FS]AC X FTAC  FTkAC f G USAC N 4G?UoAC j TGU&AC ! tGX{AC v GXAC  G`YkAC f GYAC  GhZwAC r HZAC  4HF[AC  TH!]CAC > tHD^AC  H^uAC p H_?AC : H"`AC  HaKAC F IbRAC M 4IcAC  TIdAC  tIvfAC  IrgAC  IhvAC q I.iAC  Ik_AC Z JTkAC   4Jk/AC E% XJlqAC l xJHmqAC l JmAC  Jan}AC x JnAC  JoAC   KLpuAC p  \Q>AC y |Q2AC - Q1AC  QbAC ] Q[AC V QSAC N RR5AC p  XAC  AC y XiAC  XAC  X:AC  YAC   YAC  @Y AC  `YcAC ^ Y*AC  YAC  Y$AC  YAC  ZoRAC M  ZAC  @ZMAC   `Z<AC  ZAC  ZAC  ZAC z ZAC  []AC X  [VAC EL D[)(AC # d[1sAC n [>AC y [>AC y [hAC c [PAC K \8AC  $\AC  D\NAC I d\AC  \9AC  \AC  \AC  \jAC  ]1AC  $]AC  D] SAC N d]=5AC p ]RAC  ]AC  ]2AC - ]cAC ^ ^;AC 6 $^oAC j D^OwAC r d^xAC s ^ AC F ^wAC r ^@ AC  ^@AC  _AC  $_~bAC ] D_AC  d_nAC  _6AC 1 _AC  _#AC  _AC  `lAC  $`cgAC b D`iAC d d`AC  `AC  `GAC  `AC  `hxAC s a|AC w $aAC  DaAC  dacqAC l a]AC X a]AC X a.AC  akAC f b6SAC N $bioAC j Db&AC ! db{AC v bAC  bkAC f bAC  bwAC r cAC  $cpAC  DcKCAC >  dcn`AC EV cAC  c5AC  cRAC M cRAC M d$AC  (d`AC [ Hd >AC y hd AC  d AC  dN AC  d RAC M d RAC M e3 wAC r (e MAC H He AC  hecAC  eAC   eu-AC h e~SAC N e5AC p  fAC  ,fzAC  Lf2AC - lfcAC ^ fY;AC 6 ftoAC j fwAC r fxAC s  gr AC F ,g]wAC r Lg AC  lgAC  g*AC  gbAC ] g4AC  gAC   hb6AC 1 ,hxAC  Lh#AC  lhAC  hAC  hgAC b hiAC d hgAC   iH AC  ,i AC  Lia!AC  li!xAC s i4"|AC w i$AC  i%AC  i%qAC l  j(&]AC X ,je']AC X Lj'AC  lj_(kAC f j(SAC N j(oAC j j,)&AC ! j2,{AC v  k,AC  ,k,kAC f LkI-AC  lk.wAC r k].AC  k.AC  k0CAC > k1AC   l2dAC _ ,l3AC  Ll4qAC l ll5AC  l6UAC P l6[AC V l%7SAC N lX75AC p  mm7AC  ,m!8AC  Lm82AC - lm9cAC ^ m:;AC 6 m;oAC j mj;wAC r m;xAC s  n< AC F ,nbAC ] n>AC  n?AC   o @6AC 1 ,oAAC  LoA#AC  loBAC  oDAC  o~EgAC b oEiAC d oFAC   pFAC  ,pbGAC  LpHAC  lpHxAC s pH|AC w p7KAC  pKAC  p~LqAC l  qL]AC X ,q N]AC X LqINAC  lqOkAC f qQOSAC N qOoAC j qO&AC ! qR{AC v  r4SAC  ,rSkAC f LrSAC  lrTwAC r rUAC  rUAC  rfWCAC > rX?AC z  sXAC  ,sYAC  LsYFAC A lsYyAC t s=ZyAC t sZAC  s@[<AC w s\[DAC   t[DAC  ,t[DAC  Lt[DAC  lt[5AC p t\TAC O t5\bAC ] tw\fAC a t\dAC _  u]dAC _ ,uE]uAC p Lu]AC  lu^dAC _ uV^dAC _ u^zAC u u^AC  u]_AC   v_zAC u ,v `AC  Lv`zAC u lv`zAC u vEaAC  vaAC  v1bAC  vbAC   wczAC u ,wwczAC u LwczAC u lw+dUAC P w`d}AC x wdyAC t we4AC o w*eAC   xfSAC N ,x;f5AC p LxPfAC  lxgAC  xg2AC - xhcAC ^ xh;AC 6 xioAC j  yMjwAC r ,yjxAC s Lyj AC F lyjwAC r y>k AC  y>lAC  ylAC  y|mbAC ]  zmAC  ,zlnAC  Lzn6AC 1 lzpAC  zp#AC  zqAC  zjsAC  zatgAC b  {tiAC d ,{tAC  L{uAC  l{EvAC  {vAC  {fwxAC s {w|AC w {zAC   |zAC  ,|a{qAC l L|{]AC X l||]AC X |,}AC  |}kAC f |4~SAC N |g~oAC j  }~&AC ! ,}{AC v L}AC  l}kAC f }ӂAC  }wAC r }AC  }nAC   ~ICAC > ,~lAC  L~8 AC  l~">AC y ~@AC  ~AC  ~4AC  ~13AC n  D2AC m ,V_AC Z LAC  lAC  SAC N ȍ5AC p ݍAC  AC   2AC - ,-cAC ^ Lp;AC 6 loAC j ڑwAC r 1xAC s ̀ AC F twAC r  ˒ AC  ,˓AC  LAAC  l bAC ] KAC  AC  ́y6AC 1 AC   #AC  ,AC  LAC  lgAC b 5iAC d ~AC  ̂_AC  ҝAC   xAC  ,xAC s LK|AC w lAC  &AC  qAC l ̃?]AC X |]AC X  AC  ,vkAC f LSAC N loAC j C&AC ! I{AC v ̄AC  kAC f  `AC  ,wAC r LtAC  lAC  ֭CAC > AC  ̅^AC Y AC ~  EQAC L ,vAC ~ LٲQAC L l #AC   sAC n `1AC l ̆qAC  "AC   AC  ,s6AC q L>AC y lAC  AAC  ķAC I ̇AC I AC I  DAC  ,SAC N L5AC p lAC  AC  82AC - ̈JcAC ^ ;AC 6  oAC j ,wAC r LNxAC s l AC F wAC r  AC  ̉AC  ^AC   &bAC ] ,hAC  LAC  l6AC 1 AC  7#AC  ̊:AC  AC   gAC b ,RiAC d LAC  l|AC  AC  AC  ̋xAC s h|AC w  AC  ,CAC  L qAC l l\]AC X ]AC X AC  ̌kAC f SAC N  oAC j ,`&AC ! Lf{AC v lAC  2kAC f }AC  ̍:wAC r AC   AC  ,CAC > LAC  l>AC y AC  wAC  ̎qAC  kwAC r  AC  ,:AC  LAC  l|@AC ; >AC y RAC M  ̏~AC Et FAC   8AC  0AC  PVSAC N p5AC 0 AC  AC    АAC E sAC n NAC  4>AC y T'AC " tgAC b U>AC y sAC  ԑHAC I 6AC I $AC I 4SAC N TE5AC p tZAC  AC  2AC - ԒcAC ^ ;AC 6 oAC j 4WwAC r TxAC s t AC F wAC r H AC  ԓHAC  AC  bAC ] 4AC  TvAC  t6AC 1  AC  #AC  ԔAC  tAC  kgAC b 4iAC d TAC  tAC  OAC  AC  ԕpxAC s |AC w $ AC  4 AC  Tk qAC l t ]AC X  ]AC X 6 AC  Ԗ kAC f >SAC N qoAC j 4&AC ! T{AC v t!AC  kAC f AC  ԗwAC r AC  xAC  4SCAC > TvMAC H tAC  0AC  ZAC U ԘAC  fAC  NAC  4>AC y TAC  tAC  kAC  @AC  ԙ AC   >AC y  AC  4!AC  T!AC  t"PAC K "PAC K "AC  Ԛ}#PAC K #UAC P #AC  4$NAC I T$PAC K t'%PAC K W%jAC e %>AC y ԛ%AC  L&AC  &AC  4Q'AC  T)_AC Z t+AC  +AC  ,AC  Ԝ,AC  q-AC  -AC   4.AC  TU/AC  t/AC  <0AC  2>AC y ԝ2>AC y 3AC  n3AC  44AC  T4AC | t5AC  6AC  )7AC   Ԟ7AC E e8zAC u 8AC  8;:AC  X:AC { x ;WAC R D;AC  <AC  ؟Z=AC  =AC  ?AC   8@AC  X4BAC   x"CYAC T [DpAC k DAC  ؠGEZAC U EAC  EJAC E 8#FAC   XGAC   |HAC I vHAC I dHSAC N ܡH5AC p HAC  `IAC  <I2AC - \JcAC ^ |?K;AC 6 ZLoAC j LwAC r ܢMxAC s XM AC F CMwAC r <M AC  \NAC  |OAC  ObAC ] PAC  ܣPAC  HQ6AC 1 ^RAC  <R#AC  \SAC  |UAC  VgAC b WiAC d ܤMWAC  .XAC  XAC  <GYAC  \YxAC s |Z|AC w v\AC  \AC  ܥ]qAC l ^]AC X K_]AC X <_AC  \E`kAC f |`SAC N `oAC j a&AC ! ܦd{AC v sdAC  dkAC f </eAC  \ewAC r |CfAC  fAC  hCAC >  ܧiAC E  l6AC E, $nAAC | DnAC I dnAC I nAC I ~nSAC N Ĩn5AC p nAC  zoAC  $p2AC - DqcAC ^ dYq;AC 6 troAC j rwAC r ĩsxAC s rs AC F ]swAC r $s AC  DtAC  d*uAC  ubAC ] 4vAC  ĪvAC  bw6AC 1 xxAC  $y#AC  DzAC  d{AC  |gAC b }iAC d īg}AC  H~AC  ~AC  $aAC  DxAC s d4|AC w AC  AC  Ĭ׃qAC l (]AC X e]AC X $AC  D_kAC f dSAC N ݆oAC j ,&AC ! ĭ2{AC v AC  kAC f $IAC  DwAC r d]AC  AC  CAC > ĮAC  AC   aAC EW (>~AC y HAC   hAC E  AC E  s1AC E' ԯAC  u>AC y pAC k 4>AC 9 TAC  t AC  usAC n ȦAC  ԰>sAC n SAC N ħ5AC p 4٧AC  TAC  t2AC - )cAC ^ l;AC 6 ԱoAC j ֫wAC r -xAC s 4 AC F TpwAC r tǬ AC  ǭAC  =AC  ԲbAC ] GAC  AC  4u6AC 1 TAC  t#AC  AC  AC  ԳgAC b 1iAC d zAC  4[AC  TηAC  ttAC  xAC s G|AC w ԴAC  "AC  qAC l 4;]AC X Tx]AC X tAC  rkAC f SAC N ԵoAC j ?&AC ! E{AC v 4AC  TkAC f t\AC  wAC r pAC  ԶAC  CAC > AC  4AC  TAC  twAC  #AC   OAC EE ط3>AC y QiAC d aAC \ 8AC  XcAC  xAC  }yAC t  AC  ظAC   4AC / >AC y 8&AC ! XAC  xgfAC a fAC a fAC a ع9fAC a AC  AC  8AC  XtAC  x=8AC 3 UoAC j AC   غw !AC H tAC   /AC Hy @AC  `JAC  PAC K AC  AC  OWAC R AC   3YAC T  @lAC  dESAC N x5AC p AC  ļAAC  2AC - cAC ^ $ ;AC 6 D;!oAC j d!wAC r !xAC s 9" AC F Ľ$"wAC r {" AC  {#AC  $#AC  D$bAC ] d$AC  %AC  )&6AC 1 ľ?'AC  '#AC  (AC  $*AC  D+gAC b d+iAC d .,AC  -AC  Ŀ-AC  (.AC  .xAC s $.|AC w DW1AC  d1AC  2qAC l 2]AC X ,4]AC X i4AC  &5kAC f $q5SAC N D5oAC j d5&AC ! 8{AC v T9AC  9kAC f :AC  :wAC r $$;AC  D;AC  d=CAC > >>AC y >XAC S >NAC I -?PAC K ]?cAC ^ $@cAC ^  DA-AC E#  hBAC G CAC  IAC  IAC  JAC   DKKAC F ,oLzAC u LLAC  l4MAC  PLAC G T[AC V UDAC  +USAC N  ^U5AC p ,sUAC  L'VAC  lV2AC - WcAC ^ X;AC 6 !YoAC j pYwAC r  YxAC s ,Z AC F L ZwAC r laZ AC  a[AC  [AC  \bAC ] \AC   ]AC  ,^6AC 1 L%_AC  l_#AC  `AC  bAC  cgAC b ciAC d  dAC  ,dAC  LheAC  lfAC  fxAC s f|AC w =iAC  iAC   jqAC l ,j]AC X Ll]AC X lOlAC   mkAC f WmSAC N moAC j m&AC !  p{AC v ,:qAC  LqkAC f lqAC  rwAC r  sAC  sAC  luCAC >  vAC  ,5{AC  L{AC  lE|dAC _ |AC  i}AC  N~dAC _ QAC L  AC  ,OAC  Lށ}AC x l;}AC x AC  AC  Ć AC  sAC n  AC  ,AC   LrAC  l~AC y A_AC Z .AC ) AC z AC   AC  ,6AC { LAC  lOAC   rAC Eh 5AC  xAC s WZAC U "AC  0AC  P4AC  puAC p AC  AC  &>AC y DAC  AC  0^SAC N PAC  paRAC M RAC M ŦNAC I AC  AC  1QAC L 0bAC  PAC  p~|AC w ګPAC K  ZAC U DPAC K tNAC I 4AC / 0AC  P]RAC M pRAC M AC  ~AC  ;AC  RAC M RAC M 0RAC M PKRAC M p}0AC + >AC y >AC y ɾAC  RAC M YAC T 0'AC  PaAC \ p NAC I 9}AC x  AC  SAC N J5AC p _AC  4AC  T2AC - tcAC ^ ;AC 6  oAC j \wAC r xAC s  AC F 4wAC r TM AC  tMAC  AC  bAC ] AC  {AC  6AC 1 4AC  T#AC  tAC  yAC  pgAC b iAC d AC  AC  4TAC  TAC  tuxAC s |AC w )AC  AC  pqAC l ]AC X 4]AC X T;AC  tkAC f CSAC N voAC j &AC ! {AC v &AC  4kAC f TAC  twAC r AC  }AC  XCAC > {}AC x 8AC s 4AC  T\AC  teAC ` .AC  AC I AC I pAC I ^AC I 4LAC I T:AC I t(AC I SAC N I5AC p ^AC  AC  2AC - 4cAC ^ T;AC 6 t oAC j [wAC r xAC s  AC F wAC r L AC  4LAC  TAC  tbAC ] AC  zAC  6AC 1 AC  #AC  4AC  TxAC  togAC b iAC d AC  AC  SAC  AC  4txAC s T|AC w t(AC  AC  oqAC l ]AC X ]AC X :AC  4kAC f TBSAC N tuoAC j &AC ! {AC v %AC  kAC f AC  4wAC r TAC  t|AC  WCAC > zlAC g  AC  a AC  #aAC \ 4d>AC 9  T4AC E* xAC  )KAC F TAC  AC  AC } 8 >AC y 8V AC   X!AC E |"6AC 1 #AC  $AC  $AC   a%)AC E  f&AC  @?'AC  `'AC  [(AC  (nAC i '*nAC i u+AC  #.PAC K  S0AC   @0AC E d2AC  R5NAC I 6zAC u 6AC  8AC I 8AC I $8AC I D8DAC  d8SAC N 85AC p 8AC  9AC  3:2AC - E;cAC ^ $;;AC 6 DAC  $Y?AC  D!@bAC ] dc@AC  AAC  A6AC 1 BAC  2C#AC  5DAC  $FAC  DGgAC b dMGiAC d GAC  wHAC  HAC  IAC   JxAC s $cJ|AC w DLAC  d>MAC  NqAC l WN]AC X O]AC X OAC  PkAC f $PSAC N D QoAC j d[Q&AC ! aT{AC v TAC  -UkAC f xUAC  5VwAC r $VAC  DWAC  dXCAC > ZAC  ZAC  b[@AC { [AC  [>AC y $ \AC  D\AC | dJ]AC  ]AC   _-AC E# `AC   ja[AC V  aAC I ,aAC I L}aAC I lkaAC I YaAC I GaAC I 5aAC I #aAC I  aAC I ,`DAC  L#aSAC N lVa5AC p kaAC  bAC  b2AC - ccAC ^  c;AC 6 ,eoAC j LhewAC r lexAC s f AC F fwAC r Yf AC  YgAC   gAC  ,hbAC ] LhAC  liAC  j6AC 1 kAC  k#AC  lAC   nAC  ,|ogAC b LoiAC d l pAC  pAC  `qAC  rAC  rxAC s  r|AC w ,5uAC  LuAC  l|vqAC l v]AC X  x]AC X GxAC  ykAC f  OySAC N ,yoAC j Ly&AC ! l|{AC v 2}AC  }kAC f }AC  ~wAC r  AC  ,AC  LdCAC >  lAC E >AC  AC  v~AC y  ԊAC E @AC { 4ŌAC  T/AC  t>AC y AC  SAC  ΎAC   k-AC E# tAC   8Q[AC V \AC I |vAC I dAC I RSAC N 5AC p AC  NAC  <ؓ2AC - \cAC ^ |-;AC 6 HoAC j wAC r xAC s F AC F 1wAC r < AC  \AC  |AC  ƙbAC ] AC  AC  66AC 1 LAC  <ל#AC  \ڝAC  |AC  gAC b iAC d ;AC  AC  AC  <5AC  \xAC s ||AC w dAC  AC  qAC l ]AC X 9]AC X <vAC  \3kAC f |~SAC N oAC j &AC ! {AC v aAC  ҮkAC f <AC  \گwAC r |1AC  AC  CAC > oAC j  AC G  ǵ)AC $ @жAC  `l>AC y AC  AC } YAC  ܸAC   AC E $AC  DPAC z dAC  AC  VAC Q  ԼAC E AC  OAC  ($AC   H-AC E# lAC  [AC V SAC N 5AC p (AC   AC  ,f2AC - LxcAC ^ l;AC 6 oAC j %wAC r |xAC s  AC F  wAC r , AC  LAC  lAC  TbAC ] AC  DAC  6AC 1  AC  ,e#AC  LhAC  lBAC  9gAC b iAC d AC  AC   AC  ,AC  L>xAC s l|AC w AC  qAC  9qAC l ]AC X  ]AC X ,AC  LkAC f l SAC N ?oAC j &AC ! {AC v AC   `kAC f ,AC  LhwAC r lAC  FAC  !CAC > D)AC $ MAC V  H>AC y ,fbAC ] LfAC a ljAC e 8fAC a ~fAC a AC  vAC q  [AC V , 0AC I L AC I l  AC I  SAC N  -5AC p  BAC   AC   2AC - , cAC ^ L ;AC 6 l oAC j  ?wAC r  xAC s   AC F  wAC r  0 AC  , 0AC  L AC  l nbAC ]  AC   ^AC   6AC 1  AC   #AC  , AC  L \AC  l SgAC b  iAC d  AC   AC   7AC   AC  , XxAC s L |AC w l  AC   AC   SqAC l  ]AC X  ]AC X  AC  ,kAC f L&SAC N lYoAC j &AC ! {AC v  AC  zkAC f  AC  ,wAC r LAC  l` AC  ; CAC >  ^ -AC E# g AC  DdAC _ >AC y 0AC  PAC  p_AC Z AC  VAC   :AC H [AC V SAC N 4R5AC p TgAC  tAC  2AC - cAC ^ ;AC 6 oAC j dwAC r 4xAC s T AC F twAC r U AC  UAC  AC  bAC ] AC  4AC  T6AC 1 tAC  #AC  AC  AC  x gAC b  iAC d 4!AC  T!AC  t\"AC  #AC  }#xAC s #|AC w 1&AC  &AC  4x'qAC l T']AC X t)]AC X C)AC  *kAC f K*SAC N ~*oAC j *&AC ! 4-{AC v T..AC  t.kAC f .AC  /wAC r /AC  0AC  `2CAC > 43AC } T3 AC   t5 AC H  BAC  ESAC N E5AC p EAC  FAC  <"G2AC - \4HcAC ^ |wH;AC 6 IoAC j IwAC r 8JxAC s J AC F {JwAC r <J AC  \KAC  |HLAC  MbAC ] RMAC  NAC  N6AC 1 OAC  <!P#AC  \$QAC  |RAC  SgAC b  gAC  gAC  ohAC  <hAC  \Li@AC ; |ljAC  jOAC J k.AC ) (lPAC K XlAC  lPAC K <lPAC K \"mAC  |mAC | nAC  ndAC _ nfAC a *ofAC a  poPAC K < ooAC j \ oAC  | pAC   ?qPAC K  oqPAC K  qPAC K  qAC  !jr\AC W ycAC ^ !y;AC 6 "zoAC j <"zwAC r \"B{xAC s |"{ AC F "{wAC r "{ AC  "|AC  "R}AC  #~bAC ] <#\~AC  \# AC  |#6AC 1 #AC  #+#AC  #.AC  #AC  $gAC b <$FiAC d \$AC  |$pAC  $AC  $AC  $xAC s $\|AC w %AC  <%7AC  \%qAC l |%P]AC X %]AC X %ʍAC  %kAC f %ҎSAC N &oAC j <&T&AC ! \&Z{AC v |&AC  &&kAC f &qAC  &.wAC r &AC  ' AC  <'CAC > \' OAC J |'9AC  'ɜAC  '\SAC N '5AC p 'AC  (XAC  <(2AC - \(cAC ^ |(7;AC 6 (RoAC j (wAC r (xAC s (P AC F );wAC r <) AC  \)AC  |)AC  )ФbAC ] )AC  )AC  )@6AC 1 *VAC  <*#AC  \*AC  |*AC  *gAC b *iAC d *EAC  *&AC  +AC  <+?AC  \+xAC s |+|AC w +nAC  +AC  +qAC l +]AC X ,C]AC X <,AC  \,=kAC f |,SAC N ,oAC j , &AC ! ,{AC v ,kAC  -ܹkAC f <-'AC  \-wAC r |-;AC  -»AC  -CAC > -XAC S -AC  .AC  <.AC  \./AC  |.(AC # .AC  .ZAC  .[AC V .LSAC N /5AC p  5AC  <5W>AC y \5unAC i |5oAC j 5_AC Z 5Q{AC v 5AC  5G>AC y 6eAC  <6AC  \69gAC b |6AC  6_AC Z  6-PAC HC 6YdAC _  7WAC HJ $7qAC l D7!AC  d7UAC P 7uAC p 7FAC  7MAC H 7AC I 8AC I $8AC I D8AC I d8AC I 8AC I 8pAC I 8^DAC  8SAC N 95AC p $9AC  D9~AC  d92AC - 9cAC ^ 9];AC 6 9xoAC j 9wAC r :xAC s $:v AC F D:awAC r d: AC  :AC  :.AC  :bAC ] :8AC  ;AC  $;f6AC 1 D;|AC  d;#AC  ; AC  ;AC  ;gAC b ;"iAC d <kAC  $<LAC  D<AC  d<eAC  <xAC s <8|AC w < AC  < AC  = qAC l $=, ]AC X D=i ]AC X d= AC  =ckAC f =SAC N =oAC j =0&AC ! >6{AC v $>AC  D>kAC f d>MAC  > wAC r >aAC  >AC  >CAC > ?\AC W $?"AC  D?AC  d?IAC D ?AC  ?AC   ?;AC H. ?3!YAC T @l"AC  (@"AC  H@#AC   h@+$<AC E2 @C%?AC : @b&AC  @'AC  @'AC   Ab)MAC H ,A)@AC ; LA* AC  lA,AC  A6-AC z A-$AC  A.kAC f A3>AC y  B4fAC a ,BH5|AC w LB5)AC $ lB7@AC { B7BAC = B8AC  B;xAC s B<AC   CAC y  LC=)AC E pC>AC   C>uAC p C??AC I C-?AC I C?AC I D ?SAC N 4D 4Jm`gAC b TJagAC b  tJc~AC Et JUeAC  JgAC  Jh.AC ) JjAC  KjsAC n 8KjAC  XKDkAC  xKk$AC   KnAC H Ks>AC y KsAC  KitAC  LtAC   D ͼL S W [ ab ղf m q x  6 q   F ˸  -  p N R i" Y %! '^ ) *! ! ! ?! @! ! ! ! ! ! ! t! M M M M M M M M N N *N ;N GN PN XN fN sN N N N N N N N N N N N N N N N O O q }g q f Fq h  M  0    ǃ Ճ     6 K \ l | ۪  ʱ   L   Ǵ t$ 0 /6 = D < b# i# V# # # 5#  Ԫ# # # # # # )# 0# w! :# B# ̐J# QO# [# aaaPb X0 Ц 00.80.o vb @.}h oooo0=.000000011&161F1V1f1v11111111122&262F2V2f2v22222222233&363F3V3f3v33333333344&464F4V4f4v44444444455&565F5V5f5v55555555566&666F6V6f6v66666666677&767F7V7f7v77777777788&868F8V8f8v88888888899&969F9V9f9v999999999::&:6:F:V:f:v:::::::::;;&;6;F;V;f;v;;;;;;;;;<<&<6<F<V<f<v<<<<<<<<<==&=6=F=V=f=v=========>>&>6>F>V>f>v>>>>>>>>>??&?6?F?V?f?v?????????@@&@6@F@V@f@v@@@@@@@@@AA&A6AFAVAfAvAAAAAAAAABB&B6BFBVBfBvBBBBBBBBBCC&C6CFCVCfCvCCCCCCCCCDD&D6DFDVDfDvDDDDDDDDDEE&E6EFEVEfEvEEEEEEEEEFF&F6FFFVFfFvFFFFFFFFFGG&G6GFGVGfGvGGGGGGGGGHH&H6HFHVHfHvHHHHHHHHHII&I6IFIVIfIvIIIIIIIIIJJ&J6JFJVJfJvJJJJJJJJJKK&K6KFKVKfKvKKKKKKKKKLL&L6LFLVLfLvLLLLLLLLLMM&M6MFMVMfMvMMMMMMMMMNN&N6NFNVNfNvNNNNNNNNNOO&O6OFOVOfOvOOOOOOOOOPP&P6PFPVPfPvPPPPPPPPPQQ&Q6QFQVQfQvQQQQQQQQQRR&R6RFRVRfRvRRRRRRRRRSS&S6SFSVSfSvSSSSSSSSSTT&T6TFTVTfTvTTTTTTTTTUU&U6UFUVUfUvUUUUUUUUUVV&V6VFVVVfVvVVVVVVVVVWW&W6WFWVWfWvWWWWWWWWWXX&X6XFXVXfXvXXXXXXXXXYY&Y6YFYVYfYvYYYYYYYYYZZ&Z6ZFZVZfZvZZZZZZZZZ[[&[6[F[V[f[v[[[[[[[[[\\&\6\F\V\f\v\\\\\\\\\]]&]6]F]V]f]v]]]]]]]]]^^&^6^F^V^f^v^^^^^^^^^__&_6_F_V_f_v_________``&`6`F`V`f`v`````````aa&a6aFaVafavaaaaaaaaabb&b6bFbVbfbvbbbbbbbbbcc&c6cFcVcfcvcccccccccdd&d6dFdVdfdvdddddddddee&e6eFeVefeveeeeeeeeeff&f6fFfVfffvfffffffffgg&g6gFgVgfgvggggggggghh&h6hFhVhfhvhhhhhhhhhii&i6iFiVifiviiiiiiiiijj&j6jFjVjfjvjjjjjjjjjkk&k6kFkVkfkvkkkkkkkkkll&l6lFlVlflvlllllllllmm&m6mFmVmfmvmmmmmmmmmnn&n6nFnVnfnvnnnnnnnnnoo&o6oFoVofovooooooooopp&p6pFpVpfpvpppppppppqq&q6qFqVqfqvqqqqqqqqqrr&r6rFrVrfrvrrrrrrrrrss&s6sFsVsfsvssssssssstt&t6tFtVtftvtttttttttuu&u6uFuVufuvuuuuuuuuuvv&v6vFvVvfvvvvvvvvvvvww&w6wFwVwfwvwwwwwwwwwxx&x6xFxVxfxvxxxxxxxxxyy&y6yFyVyfyvyyyyyyyyyzz&z6zFzVzfzvzzzzzzzzz{{&{6{F{V{f{v{{{{{{{{{||&|6|F|V|f|v|||||||||}}&}6}F}V}f}v}}}}}}}}}~~&~6~F~V~f~v~~~~~~~~~&6FVfv&6FVfvƀր&6FVfvƁց&6FVfvƂւ&6FVfvƃփ&6FVfë ˫ ӫ ٫ @ ͯ ۯ      ( 3 @ E L ^ g l w      ư ԰       - ; K      ɳ ҳ N߳ j  5 9  ; g +  $@ g Ĵ kȴ + ` ʹ jѴ մ ڴ >   > U@ '  մ Ѵ 6. 5  xf @  := OA   E cH L Q W '̾ gѾ ׾ ܾ     9 a    g N ) . 6 g= E aO _X [ %_ d _i Z| v { | z ){ "} }X X~ ~ 6 = F Ŀ [ < vA XE NQ ] Bh ۿp P @ x }  <  l  < l@     5 G \ j       - E \ v     }     " + A J @ S Z e s {  @    >  f!J  D  j# d " " & {* -, @$ 3- [% 0V+ Y1 U 6 K e    @    dZ N\i Nm J r { 0  fm j ̕ m    $ }   m  1 `  /    > ~    H  " + %4 > H  5   ! $    {    m    l     $    {  K FP AGU GY >H` Hi 0Kn Nq Ov ZP| S cS /T T P MQ Q N z  G @ G  E   i # 2M  ( I- LP4 S: R? OG QQ N  ( Q  # EV? U  ( Z# 9^Q ]Z? \: +]U c^ Sc  ( d- d4 e  ( Mgi Gt J I K L          * / 7 ? `       : Ɣ1 ʒ5 $> (E M P : Mf Xm ct o> E dM ך f     Z a   OM  :   m   ɪ 4>   ~ M : \> < JH ˴N  M  A )  ; ׹ i6 @9 C Q ] N e zj z M  W     M u  $ C. ? {S ` o  .    ! 0 P o |        % 1 < H Q [ @f s  w &  1  b2 , *! '( H$, #8 m7C 7I + f k s z    @        @ # # # )# 0# w! 6# :# B# ̐J# QO# V#  Ԫ[# b# u# o` z# # C# # u# # B# ۚ:# O# J# 0u# A` 4) :) 'D) K) S) ([) `) ( ug) r) ' 4) :) 'D) K) S) ([) `) ( ug) ' w) ) ) R- PX- z- @- - - - - -  . $. :. Q. d. . . . . . / / / @#/ ,/ 7/ B/ P/ ^/ l/ |/ / / / / 1 !1 &2 p'2 (2 y(h2 }2 2 2 2 D3 I3 N3 S3 9 Jh9 a5 'XI3 X9 x`9 `9 R[9 Z9 }R6 ~u9 r"3 t9 W9 Y9 ]9 l9 clw, l9 m8 on9 [o: o: Qp: t': bt1: oI: o]: ro: r: -w6 Y- vx5 5 5 5 |5 5 5 5 w, 8 : : 5 q55 85 y)5 ~*5 ,5 3,5 .5 15 Q6 26 3'6 326 4=6 :I6 1=Y6 >i6 $C|6 ":6 L6 M6 'N6 3K6 FE6 +- 6 .U6 R5 S6 UI3 T7 EV 7 5W7 W6 ZT- B B B 3C :A rB 7C AC E E E E F *F BF EF QF kF F F F F G G +G L ?&L @:L AHL BYL CjL DyL EL FL GL HL IL JL KL MM (M LFE 2LE 8SE YE dE pE 2}E ?D E E  B E E ?D OD E E KE GD E E XE :)S ' DS ) IS ) MS * RS + 7S , WS T* R X _ X 2^ ,X _ rX d wX ]d {X d RW e YW kf X g X se W 9] K =] t M] n U] Z] } a] i]  n] w r]  v] ] ] ] ] ] ] n ] Z `\ ] 0 a t b b b b b b b ( b X b b b b `a b f f : f j f g i g n g g @f g j j j j j j j j j k k k k #k *k 1k 5k @k Ek Lk  Sk Xk i Zk \k ik ok tk wk }k i k  '$qB۳|kVNRȁ4^^u~hS kLFߥ_~g3ƩWu43$g,Bo[VG3u׮Ec nUecP)Zj^ ͮzmRlL;ȬrTXC͎6mL%f6`c&ь0=ERn<}~*[<QJ=BM l{Oq#l ٟb~WNQxV_aE!/Ҍ/\#kERK0b4ou}jSl4Ȑ]/F;ppͤpFv:`ʸGC19I d`koN>pt"|1CXD X&.;rJ_yCƾih鳙v-'(6\N_!mf1 p_*]%.aI!FH^chy_N)TE(5(($Aԧfw.~(=Ri Kb{W.4T|{<6y4!ʺ\yL;s\0Hv!nromW5WϟmӔg?+օ+9ȡ9uyd *ޚA*i Բa)b>>|H B#e^]轶#^ jD_'-n9H~xPjOq^z2%5EU;*MExTr&&=J犇Udz]륭QqTY?mQ.0AGHY,cuqV3GS^w^h gTpb5~L9SLzIqp-9`l9Xi%a{:nҫ8k09Mʹ]kwCQcl]Ґ;!_9SK4,"; 0e TXvP@GmxcALRڃeIJ^%̒ /bG`lQ8;02F,)͈ -d^VX4xÕFk=#kY\(w[կK 0rDw ?mmZsg@KL3VnV_7^00(>WU~l|k[6I`UC - bTjDa@y' CNwȫ -bQeؐUMξh^vWepZCqaov>SO}Cp HSGwٖ!8Mji/ۅӈj:g2qi|+Q 29Y,Y6Ӹ.rT-ҏ H2 ugγ,rwcү*hdAgq j]$|n#T(Fɚi~5D222T:GgBq4uL;KL#"gr4J( Jeɓ} mެ]@K4% `$S4]xwd]#辆5qJ.ZpQU] }2Am&{՚+ ^Iϣ; G{tRZ9Y_j~+ V8 yg~ RY2ċLGTϧ h-B1oAz!pYg4~ v4yCcz ݶ% }`@7DA> ÉR(+fcّ͛ pxF՞. *8@0j:`Z5~Z_DAO hXgJ؝32!$%)Ud§jF ]riۗ 7_Hr:_!}fS,S:aD؋Vr5TC@v}k'ߚ)* u4 Y^ w%(̖-Efkȓ+ҸRv<0R . "66aVP f XfNMZ]P}=L$U`uɻ$g;9I1l:]0S^~n/"fz3 i -lQj JGl4=qׅh)>-x>}F@)b1͙J~8Ihrɏ\ͤi_kǯ(Rr4JCWlLm_@9wK<92xHm~@p&2rShT2Dez0bD^ֺ&^_@RB?wsQE:1s+uR%j.|}ym=ZwP <~v44^Rgm ba3|My;"ӵNE/6'Sy6kQf!wcW{Yu}֥6iy|;K !/>'3;>n7~b Ąn.5ÉDX4taCܿVf6ω?*|\%@(};L[,8 s*yJ' Nh󉋴6,,>gvJ4MIBA'12~f! 5lDwI$TnXq. 2:^VJCj vEdzFW l^yi<7V^JbONTj>|F徛>'dg 屺&և%C zAq#;|HN0VxtXZoQ6NalɸG#+vL& %H,XDi1Tr 'Жş cUÌ6+y>R7RW>(0aĸI.rc␥{x݌CO1&T'YR \ۮzUà/xMz Jo*2 %@r"J;+.Sytgz-nD*ZǾ9?f+75q) AqU5h/2p&-b*?=sBu4qA^¤aTQON幉ёt?Irv($Ux.'-nuny6[}rm+r8+z #݆D-u8^x*?m&ι5<%o pcj- &ɳ_w:#^p%".탚(pm;g`ڼGkM\, ?{ǽpk"Xj~,R vQFx'nj!]Vu 5޻SFr9 JŠJK[e,NA퇄,HyAѻrXspG3 SWt*Ao@)n^J4fݵ|}~B'8}W=؍Eה5i@]{5dM+VΥR\7L,C:TUNW}x|.óUQE|.<{ 1! @EfE{CDTMS{1mU`ܢ@+upOkho2 p|Bojd9(i'݉fMC`ea(!hGt@є@ 161#9 Hh |ٽt|蘲ڋ >>ڝT^8zSV&:N#|k9̪2Ns + @<M7n X Q)'/W~~lÎ%k j2_f7WNW$voҤ :qh!pk5gmlQ ` u#dp>MYtӹwڔ';t]mP}?z-.ܴX>軺Z ?BӜel*H o~ wjr^/?UW̠.#9Hʤ!(Wx<,ު<ݔhz&xg;uY,KjK-Ԏ+DA9tl6A @Q!m7;~QӈpRl;LliFʳ:Q&~6WK8)o)^Y`IJɆ Lg8vAX q/ΐ3 ] b&QSēqTnb?WL/??a z@C~TB'MYݷz^M@r!jOMGC8ʅMۚ  qHyo_LgV9^j%c!^4e˖yK~|N=/+olQ ƻBpp;XMJnpEt|eyf!~ys6Tj.2ڐHt][m aS% ujF9}R6j"Ic{7D%΋-L6%ZFΔ٣?+J>S @b07 Bq֝UȜ bɾJp= /½Dw4IþPPP1ݥڦ]͚ 7.`Gt໷7=KtEWv(|UIaWSK`$A1/3n#݄ iߪ\(&q f.5Dk/f/mUlVu19E-9>1涁@ 4L%[ʂ9 ^F"cpa@vC>3-<\$ ΠblrI,5Aj̸14Q毂 >gw 0uV P\zJ׿Xi$?L4^^~7-0r ձF}7 hU)ah~#W@T{)\$*97&8KBR0 [P@zŒ!#!|5erUA$ѻ-Q4t>/O=rʗm a߿֠n#BQovnx5 QS.tp7Ƚz-DА3$"mB[֛/XrS |'_D1\+v[uaڢ|k(ʶ(](kGdS (,l;A\{Ov#0@=5O`A]D>}O(THԀnGGÈP=ۼU6::H:2j䆰b(` kJJв">_KAu;Ge*`=gHmm~'t$9 X%rhΥ&k4: J] L>{q6L*C}dO  $QsSѓW PB64?.-A4rb>AI/qv#&5ϐrcS$}!Aq%\w]f"Fn3=OVj_*9 prLEꍻEiUp@bcvkQnvPf$Bz"k 0 W9jL23,}<,XL푕6YVm1t|00W-L %Ŷ[H~{.#R-VrP:>ZfaR{zPH p:Ld# $*zQ4ű+Z$  jUcd-6exv?H/r0^$ʮr חLbOw@Z3lfpd-ǰ;s*ڽ(aCUΝ>g>:QG[9Lk  RIw=7|;h.({<ƺ-h$>y( K+Kȥ-gv؛<{8դN4eNs*G-f-K/ lrOꫥ}dz+noWB9M|R\)ޅ}[ɺFcV^jT!m5 PWvo H4mn3#7jSny6V|fl*\f&_pT4%5g!0CrU <`k I(j嘉BBV$z%M"l\'#251:_pc tYbˍ&P4=pIGH@0^5>tX8V>7zk+C^briCeNRӶ"ҏ4"r+3c {C^bGb&_m'/Uu̡hp\Pi&Z!m™BvcKuc'UE|f'|#ֹss:K)7$Id#QL&T)/P*L6lb׿//vQBڟAR}b -s\a}}tܢ(afy,5E]N{U '>Y4ڃs0rZd1S ,1㨽fpS>p8[vuRs 5%BW!jp{$5 }#ⲇȡNQM,hGӫ8e gD'2 '~{svkq0/˟`):=.r'1Z4;.>g0-QTBsJTeHl.ѸxRy((g ;qf݅:pA7@3ԡCӣH.HY IX_8IhfkJʒ'Zp5髢 !HR]KL Tb4~!epSlW-sF f-X"J[-??LXrDd{ :tO2 mјp # b;T^!']70߽amYFE _XtQӼXrfCc42#yܸ 1Jp.qvq(#h'RS.kR'[C,#6Ʋ])K9@K|BJ.Z@BdX\7'<3q[c foi$m㈫l._.Lk5#0n\2*Iy?{`i&A=[qNEiB:2݇TY+=TYWѼDG5Ċ3<]POk;F*h rQeN(*j~МzsQ|/T3 B@d6& V]e18%5 %c|7өOm"Gvyx1]\d15ˉp>p,+HA1޳l+ |܇@sTl0o049%Y >w_\^| 3} AJ n c9CMc a;hZ\ڡ)˰N=h+nVUo׬m @ʄC6e-7toX~iכ$\ vOpҙWDQЪiq 鶮A]Qb' tfd3)[+dW EiP$>ȵڑ:C\և-k9Z?FV |rU􎎻j,p yO,4A,)w3 3 p3Άu |/Ry)i@u6v9Af "FepQSܾ1(O+}X?/V!ZiJJ4aRLg\!Iտ["+*Rml@d8)1pyV':dҬvEU3>o供IN\%ފM={zD7r 9t|Ej|_PlL`ޚrr4+PmQ, F[if\D` Q?qj7oP!EK?jSLguwo{4>!> ];S{SG4@Z(񊌠o8Ord| |CܬpL-<}F{,xp?s*4>hߖqBvDv[]l;5pޢ#Mm{w@;{v_Rg~ \^h9n*˃'.+/Mܐ!KK"I.ιk&6AsC=To}-)i#~#y3&Ńދ6W,9Y%]}›<OKk|CC"췉]MT(4w!懮<u5AᢍW'^v 7 Og5vPWW;^hM%W8]Ă؅WkxV\MKx@ n}L&$@~'dFbnҦuAUq"4)Si.jY Z䪢y#RKFd;coH g~BJZb6NߢBDE#bAU:L{ePe`y\[]>8N׎fgFieC@"M)ngݙ~ē/pc% )\ ¾:6CZt"T: *\؛\_I9ZeYt%i=^٢&jypcbpftNO8_jt\˹08\L}%\ lo B3̢=ƺ|݃!7bksWzVTjk.NƳbGbn% >YJ#ubᩅ JD>LRVrD}U?[ f,Zss)qVY|,``%QV27oGMNX6V'Dr?GA}̑W3 Ҭ ɽ4B TҵA>(PsP9b)_Z.-H| bxɕBjFUK 0ܸA a+X]0V_!ofX>pU=b>K4/.+NreHV"l*p2ڃ n Hj*[CyT%ṀɊ;RUƔV{ҍ@|nv:#M7 bX?S&z`dCvy|7X[T '"F [߀T U02>0$ae,~z 㙶?MJF!JlӅ1ڬ|ZP΋CW쟹BΊw1mMBmt9(cZ(׵r6.# mيS[: B{mLx ):r`:VAMp9}dgxK_E mnTaMH~Ƽpo 9acE/c6/p~4=Z_ٷu3F46Hv/'ڿӄS"-?FCJQ4= ߲paKr6ITH7V%Lyeyʫ5>Ff"مd:HztU!:^=V7!Qz&8Ǵ.[Oa-&4)ԫ{'D%!v5#. |#!vŨ$BUhANUy, 9p5~htu3[/ܔk N7{G\J+Hȯ&ԕky8>TM_If[uU QZϊ+Xqȋ8 aقXA'IEt_N= ޷z2IƍՉΝHhh!1Y}ƽ LM"j?3Zvrb2ޓ5o1s>a~MAb:Kn^g3z]3К$#ju娙b.Y.%u;PKJAղ t}+a"y?qKdo}?pڥR9B_l4z*xה="xD8Ex\uWduPؖ]-'ne9o t@ A‚S~ScPZu"hPw2@Р'+ MN8jJ|*u dffCB4:rP@ViTyTPqNcI>A5 d\YFXeɝFr/;.'bI=s`툡MJ-HEuuM@zÛHvϜokL w+ZcI%tA,M6ngY8Ao" @Ffk0`p! 8P-|<_}uHAR ̆pUb豜%E'r( d3uRG -L?k{=vDU2q,We پ,#v܆XT74qATj X q'覞?v3A!M6(KP& ROgTD#=H6M& v豛,Iy"5maCe{F+T|%kb[^qkRA:MD;BO78%!Qp>rc>KEQߎ }q݈ YW2-YZ!#&o-&naMZ9mB!.k=P 7kpoӣULB17w\nݰ= lFBWΓx]{.'ho{lB4MB8!mؼsԨ%e%|Ѧ0[JNb0S% -sp2\J( qV]\ڔjzj~3o6,g@}egHĦ2z[!n o`Z(ɪL}%;n hQ~]HJHqG|I!j:WrU c#Jm@a`Ǵߌ84|O=m*$NBJR~uRr]a-`1"E6#lk}dC6bEQ`II/~-Vր ~R|/[2c<vSdb&d%䱓0zA/_wR 5`4A[UUQbE֮L_kYv|ђ2}M03?QUVZO9"j8H4? >"(}R͓cێizU:RqB" >efn&$PF$bhOǼHeny`|`L>ٶ.+$ &>lUA劜)ܥ%cѰ׃oc . qd.-[`mlzC)8=d"Bq7Z^+ևxX4 Eʦsq޻:H b gwi蘶dmgaΉn?xXIX%[.tS8=}imM9jE%k /7VZ㍙w$ali(t <-De=i &XhTW͓0q Aݮ*_3#]Ty% `Cܽ(k/H/7Mqu@^#ڡ(>aaGc820وVe_+!Q] ;k'HzMKw'8Fahp,'UoO=IC,Y5=DI8?7iYY,[]ET0#cL"e菏+R !՝#ˑ' kJ|PR7=\`5 I]107 whjc>7#sXs*n˨inUH u9Y4C;7e`gEe4AɡֵCZy Br\?c,CV!J')$`Y. m[B鸥'5 JRj{˪Tu ȵ6XELKu(^f D%+q, {pf4ẋM[VPk18}fMR@߳\Zڨ]4KsN9bJX7dX,r,y{&tK:H9Ȉӥ(Lه{dVf >Jo,^'=[_X;6|d` ų $ <cGp uRgYZ.shstrtab.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.data.rel.ro.dynamic.got.got.plt.data.bss.gnu.build.attributes.gnu_debuglink.gnu_debugdata $o( Ѐ0vb8o EoThh ^B}hX0X0c00Snpp_" tЦ Ц z h h R` ` L00.0080.80@0.@0 0=.0= ?. ?@.@* j. jF . 0n$4,`:\PKJN]Tki i tests/test_builtins.luanu[local math = require('math') local luaunit = require('luaunit') local cache = require('webshield.builtins.cache') local class = require('webshield.builtins.class') local etable = require('webshield.builtins.etable') TestCache = {} function TestCache.test_cached_return_value() local test_cache = cache.Cache() math.randomseed(os.time()) local function rnd() return math.random() end local r1 = rnd() local r2 = rnd() luaunit.assertNotEquals(r1, r2) rnd = test_cache(rnd) local r3 = rnd() local r4 = rnd() luaunit.assertEquals(r3, r4) test_cache:invalidate() local r5 = rnd() local r6 = rnd() luaunit.assertNotEquals(r4, r5) luaunit.assertEquals(r5, r6) end function TestCache.test_cached_return_multiple_values() local test_cache = cache.Cache() local function f() return 1, 2 end f = test_cache(f) local res = {f()} luaunit.assertEquals(res, {1, 2}) end local Class1 = class() Class1.x = 'x1' local Class2 = class() function Class2.__init(self) self.y = 'y2' end local Class3 = class(Class2) function Class3.__init(self) Class3.__super().__init(self) self.z = 'z3' end local Class4 = class(Class1, Class2) Class4.x = 'x4' Class4.z = 'z4' TestClass = {} function TestClass.test_class_attribute() local obj = Class1() luaunit.assertEquals(obj.x, Class1.x) end function TestClass.test_instance_attribute() local obj = Class2() luaunit.assertIsNil(Class2.y) luaunit.assertNotNil(obj.y) end function TestClass.test_inheritance() local obj = Class3() luaunit.assertEquals(obj.x, Class3.x) luaunit.assertIsNil(Class3.y) luaunit.assertIsNil(Class3.z) -- Class2.__init called explicitly via Class3.__super().__init luaunit.assertNotNil(obj.y) luaunit.assertNotNil(obj.z) end function TestClass.test_multiple_inheritance() local obj = Class4() luaunit.assertIsNil(Class4.y) luaunit.assertNotNil(Class4.z) luaunit.assertEquals(obj.x, Class4.x) -- Class2.__init called implicitly luaunit.assertNotNil(obj.y) luaunit.assertEquals(obj.z, Class4.z) end TestEtable = {} function TestEtable.test_equal_keys() local t = {} local et = etable() local k1 = {1} local k2 = {1} t[k1] = {123} et[k1] = {456} luaunit.assertNotIs(k1, k2) luaunit.assertIsNil(t[k2]) luaunit.assertIs(et[k1], et[k2]) end function TestEtable.test_init_value() local et = etable({hello = 'world'}) luaunit.assertEquals(et.hello, 'world') end os.exit(luaunit.LuaUnit.run()) PKJN]3]n n ngx/ssl/session.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http') local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local get_request = base.get_request local error = error local errmsg = base.get_errmsg_ptr() local get_string_buf = base.get_string_buf local FFI_ERROR = base.FFI_ERROR ffi.cdef[[ int ngx_http_lua_ffi_ssl_set_serialized_session(ngx_http_request_t *r, const unsigned char *buf, int len, char **err); int ngx_http_lua_ffi_ssl_get_serialized_session(ngx_http_request_t *r, char *buf, char **err); int ngx_http_lua_ffi_ssl_get_session_id(ngx_http_request_t *r, char *buf, char **err); int ngx_http_lua_ffi_ssl_get_serialized_session_size(ngx_http_request_t *r, char **err); int ngx_http_lua_ffi_ssl_get_session_id_size(ngx_http_request_t *r, char **err); ]] local _M = { version = base.version } -- return session, err function _M.get_serialized_session() local r = get_request() if not r then error("no request found") end local len = C.ngx_http_lua_ffi_ssl_get_serialized_session_size(r, errmsg) if len < 0 then return nil, ffi_str(errmsg[0]) end if len > 4096 then return nil, "session too big to serialize" end local buf = get_string_buf(len) local rc = C.ngx_http_lua_ffi_ssl_get_serialized_session(r, buf, errmsg) if rc == FFI_ERROR then return nil, ffi_str(errmsg[0]) end return ffi_str(buf, len) end -- return session_id, err function _M.get_session_id() local r = get_request() if not r then error("no request found") end local len = C.ngx_http_lua_ffi_ssl_get_session_id_size(r, errmsg) if len < 0 then return nil, ffi_str(errmsg[0]) end local buf = get_string_buf(len) local rc = C.ngx_http_lua_ffi_ssl_get_session_id(r, buf, errmsg) if rc == FFI_ERROR then return nil, ffi_str(errmsg[0]) end return ffi_str(buf, len) end -- return ok, err function _M.set_serialized_session(sess) local r = get_request() if not r then error("no request found") end local rc = C.ngx_http_lua_ffi_ssl_set_serialized_session(r, sess, #sess, errmsg) if rc == FFI_ERROR then return nil, ffi_str(errmsg[0]) end return true end return _M PKJN]Bj̟oongx/ssl/proxysslverify.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require "ffi" local C = ffi.C local ffi_gc = ffi.gc local ffi_str = ffi.string local get_request = base.get_request local error = error local errmsg = base.get_errmsg_ptr() local FFI_OK = base.FFI_OK local FFI_ERROR = base.FFI_ERROR local subsystem = ngx.config.subsystem local ngx_phase = ngx.get_phase local ngx_lua_ffi_proxy_ssl_set_verify_result local ngx_lua_ffi_proxy_ssl_get_verify_result local ngx_lua_ffi_proxy_ssl_get_verify_cert local ngx_lua_ffi_proxy_ssl_free_verify_cert if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_proxy_ssl_set_verify_result(ngx_http_request_t *r, int verify_result, char **err); int ngx_http_lua_ffi_proxy_ssl_get_verify_result(ngx_http_request_t *r, char **err); void *ngx_http_lua_ffi_proxy_ssl_get_verify_cert(ngx_http_request_t *r, char **err); void ngx_http_lua_ffi_proxy_ssl_free_verify_cert(void *cdata); ]] ngx_lua_ffi_proxy_ssl_set_verify_result = C.ngx_http_lua_ffi_proxy_ssl_set_verify_result ngx_lua_ffi_proxy_ssl_get_verify_result = C.ngx_http_lua_ffi_proxy_ssl_get_verify_result ngx_lua_ffi_proxy_ssl_get_verify_cert = C.ngx_http_lua_ffi_proxy_ssl_get_verify_cert ngx_lua_ffi_proxy_ssl_free_verify_cert = C.ngx_http_lua_ffi_proxy_ssl_free_verify_cert elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_proxy_ssl_set_verify_result( ngx_stream_lua_request_t *r, int verify_result, char **err); int ngx_stream_lua_ffi_proxy_ssl_get_verify_result( ngx_stream_lua_request_t *r, char **err); void *ngx_stream_lua_ffi_proxy_ssl_get_verify_cert( ngx_stream_lua_request_t *r, char **err); void ngx_stream_lua_ffi_proxy_ssl_free_verify_cert(void *cdata); ]] ngx_lua_ffi_proxy_ssl_set_verify_result = C.ngx_stream_lua_ffi_proxy_ssl_set_verify_result ngx_lua_ffi_proxy_ssl_get_verify_result = C.ngx_stream_lua_ffi_proxy_ssl_get_verify_result ngx_lua_ffi_proxy_ssl_get_verify_cert = C.ngx_stream_lua_ffi_proxy_ssl_get_verify_cert ngx_lua_ffi_proxy_ssl_free_verify_cert = C.ngx_stream_lua_ffi_proxy_ssl_free_verify_cert end local _M = { version = base.version } -- return ok, err function _M.set_verify_result(verify_result) local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "proxy_ssl_verify" then error("API disabled in the current context") end local rc = ngx_lua_ffi_proxy_ssl_set_verify_result(r, verify_result, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end -- return verify_result, err function _M.get_verify_result() local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "proxy_ssl_verify" then error("API disabled in the current context") end local rc = ngx_lua_ffi_proxy_ssl_get_verify_result(r, errmsg) if rc == FFI_ERROR then return nil, ffi_str(errmsg[0]) end return rc end -- return cert, err function _M.get_verify_cert() local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "proxy_ssl_verify" then error("API disabled in the current context") end local cert = ngx_lua_ffi_proxy_ssl_get_verify_cert(r, errmsg) if cert ~= nil then return ffi_gc(cert, ngx_lua_ffi_proxy_ssl_free_verify_cert) end return nil, ffi_str(errmsg[0]) end return _M PKJN]?IU$U$ngx/ssl/clienthello.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require "ffi" local bit = require "bit" local bor = bit.bor local C = ffi.C local ffi_str = ffi.string local get_request = base.get_request local error = error local errmsg = base.get_errmsg_ptr() local get_size_ptr = base.get_size_ptr local FFI_OK = base.FFI_OK local subsystem = ngx.config.subsystem local ngx_phase = ngx.get_phase local byte = string.byte local lshift = bit.lshift local table_insert = table.insert local table_new = require "table.new" local intp = ffi.new("int*[1]") local get_string_buf = base.get_string_buf local ffi_ushort_pointer_type = ffi.typeof("unsigned short *") local ffi_cast = ffi.cast local ngx_lua_ffi_ssl_get_client_hello_server_name local ngx_lua_ffi_ssl_get_client_hello_ext local ngx_lua_ffi_ssl_set_protocols local ngx_lua_ffi_ssl_get_client_hello_ext_present local ngx_lua_ffi_ssl_get_client_hello_ciphers if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_ssl_get_client_hello_server_name(ngx_http_request_t *r, const char **name, size_t *namelen, char **err); int ngx_http_lua_ffi_ssl_get_client_hello_ext(ngx_http_request_t *r, unsigned int type, const unsigned char **out, size_t *outlen, char **err); int ngx_http_lua_ffi_ssl_set_protocols(ngx_http_request_t *r, int protocols, char **err); int ngx_http_lua_ffi_ssl_get_client_hello_ext_present(ngx_http_request_t *r, int **extensions, size_t *extensions_len, char **err); /* Undefined for the stream subsystem */ int ngx_http_lua_ffi_ssl_get_client_hello_ciphers(ngx_http_request_t *r, unsigned short *ciphers, size_t ciphers_len, char **err); /* Undefined for the stream subsystem */ ]] ngx_lua_ffi_ssl_get_client_hello_server_name = C.ngx_http_lua_ffi_ssl_get_client_hello_server_name ngx_lua_ffi_ssl_get_client_hello_ext = C.ngx_http_lua_ffi_ssl_get_client_hello_ext ngx_lua_ffi_ssl_set_protocols = C.ngx_http_lua_ffi_ssl_set_protocols ngx_lua_ffi_ssl_get_client_hello_ext_present = C.ngx_http_lua_ffi_ssl_get_client_hello_ext_present ngx_lua_ffi_ssl_get_client_hello_ciphers = C.ngx_http_lua_ffi_ssl_get_client_hello_ciphers elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_ssl_get_client_hello_server_name( ngx_stream_lua_request_t *r, const char **name, size_t *namelen, char **err); int ngx_stream_lua_ffi_ssl_get_client_hello_ext( ngx_stream_lua_request_t *r, unsigned int type, const unsigned char **out, size_t *outlen, char **err); int ngx_stream_lua_ffi_ssl_set_protocols(ngx_stream_lua_request_t *r, int protocols, char **err); ]] ngx_lua_ffi_ssl_get_client_hello_server_name = C.ngx_stream_lua_ffi_ssl_get_client_hello_server_name ngx_lua_ffi_ssl_get_client_hello_ext = C.ngx_stream_lua_ffi_ssl_get_client_hello_ext ngx_lua_ffi_ssl_set_protocols = C.ngx_stream_lua_ffi_ssl_set_protocols end local _M = { version = base.version } local ccharpp = ffi.new("const char*[1]") local cucharpp = ffi.new("const unsigned char*[1]") --https://datatracker.ietf.org/doc/html/rfc8701 local TLS_GREASE = { [2570] = true, [6682] = true, [10794] = true, [14906] = true, [19018] = true, [23130] = true, [27242] = true, [31354] = true, [35466] = true, [39578] = true, [43690] = true, [47802] = true, [51914] = true, [56026] = true, [60138] = true, [64250] = true } -- return server_name, err function _M.get_client_hello_server_name() local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "ssl_client_hello" then error("API disabled in the current context") end local sizep = get_size_ptr() local rc = ngx_lua_ffi_ssl_get_client_hello_server_name(r, ccharpp, sizep, errmsg) if rc == FFI_OK then return ffi_str(ccharpp[0], sizep[0]) end -- NGX_DECLINED: no sni extension if rc == -5 then return nil end return nil, ffi_str(errmsg[0]) end -- return extensions_table, err function _M.get_client_hello_ext_present() local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "ssl_client_hello" then error("API disabled in the current context") end local sizep = get_size_ptr() local rc = ngx_lua_ffi_ssl_get_client_hello_ext_present(r, intp, sizep, errmsg) -- the function used under the hood, SSL_client_hello_get1_extensions_present, -- already excludes GREASE, thank G*d if rc == FFI_OK then -- Convert C array to Lua table local array = intp[0] local size = tonumber(sizep[0]) local extensions_table = table_new(size, 0) for i=0, size-1, 1 do extensions_table[i + 1] = array[i] end return extensions_table end -- NGX_DECLINED: no extensions; very unlikely if rc == -5 then return nil end return nil, ffi_str(errmsg[0]) end -- return ciphers_table, err -- excluding GREASE ciphers function _M.get_client_hello_ciphers() local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "ssl_client_hello" then error("API disabled in the current context") end local buf = get_string_buf(256) -- 256 bytes is short[128] local ciphers = ffi_cast(ffi_ushort_pointer_type, buf) local cipher_cnt = ngx_lua_ffi_ssl_get_client_hello_ciphers(r, ciphers, 128, errmsg) if cipher_cnt > 0 then local ciphers_table = table_new(16, 0) local y = 1 for i = 0, cipher_cnt - 1 do local cipher = tonumber(ciphers[i]) if not TLS_GREASE[cipher] then ciphers_table[y] = cipher y = y + 1 end end return ciphers_table end return nil, ffi_str(errmsg[0]) end -- return ext, err function _M.get_client_hello_ext(ext_type) local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "ssl_client_hello" then error("API disabled in the current context") end local sizep = get_size_ptr() local rc = ngx_lua_ffi_ssl_get_client_hello_ext(r, ext_type, cucharpp, sizep, errmsg) if rc == FFI_OK then return ffi_str(cucharpp[0], sizep[0]) end -- NGX_DECLINED: no extension if rc == -5 then return nil end return nil, ffi_str(errmsg[0]) end -- tls.handshake.extension.type supported_version local supported_versions_type = 43 local versions_map = { [0x002] = "SSLv2", [0x300] = "SSLv3", [0x301] = "TLSv1", [0x302] = "TLSv1.1", [0x303] = "TLSv1.2", [0x304] = "TLSv1.3", } -- return types, err function _M.get_supported_versions() local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "ssl_client_hello" then error("API disabled in the current context") end local sizep = get_size_ptr() local rc = ngx_lua_ffi_ssl_get_client_hello_ext(r, supported_versions_type, cucharpp, sizep, errmsg) if rc ~= FFI_OK then -- NGX_DECLINED: no extension if rc == -5 then return nil end return nil, ffi_str(errmsg[0]) end local supported_versions_str = ffi_str(cucharpp[0], sizep[0]) local remain_len = #supported_versions_str if remain_len == 0 then return nil end local supported_versions_len = byte(supported_versions_str, 1) remain_len = remain_len - 1 if remain_len ~= supported_versions_len then return nil end local types = {} while remain_len >= 2 do local type_hi = byte(supported_versions_str, remain_len) local type_lo = byte(supported_versions_str, remain_len + 1) local type_id = lshift(type_hi, 8) + type_lo if versions_map[type_id] ~= nil then table_insert(types, versions_map[type_id]) end remain_len = remain_len - 2 end return types end local prot_map = { ["SSLv2"] = 0x0002, ["SSLv3"] = 0x0004, ["TLSv1"] = 0x0008, ["TLSv1.1"] = 0x0010, ["TLSv1.2"] = 0x0020, ["TLSv1.3"] = 0x0040 } -- return ok, err function _M.set_protocols(protocols) local r = get_request() if not r then error("no request found") end if ngx_phase() ~= "ssl_client_hello" then error("API disabled in the current context") end local prots = 0 for _, v in ipairs(protocols) do if not prot_map[v] then return nil, "invalid protocols failed" end prots = bor(prots, prot_map[v]) end local rc = ngx_lua_ffi_ssl_set_protocols(r, prots, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end return _M PKJN]}}}ngx/ssl/proxysslcert.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local get_request = base.get_request local error = error local errmsg = base.get_errmsg_ptr() local FFI_OK = base.FFI_OK local subsystem = ngx.config.subsystem local ngx_lua_ffi_proxy_ssl_clear_certs local ngx_lua_ffi_proxy_ssl_set_der_certificate local ngx_lua_ffi_proxy_ssl_set_der_private_key local ngx_lua_ffi_proxy_ssl_set_cert local ngx_lua_ffi_proxy_ssl_set_priv_key if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_proxy_ssl_clear_certs(ngx_http_request_t *r, char **err); int ngx_http_lua_ffi_proxy_ssl_set_der_certificate(ngx_http_request_t *r, const char *data, size_t len, char **err); int ngx_http_lua_ffi_proxy_ssl_set_der_private_key(ngx_http_request_t *r, const char *data, size_t len, char **err); int ngx_http_lua_ffi_proxy_ssl_set_cert(void *r, void *cdata, char **err); int ngx_http_lua_ffi_proxy_ssl_set_priv_key(void *r, void *cdata, char **err); ]] ngx_lua_ffi_proxy_ssl_clear_certs = C.ngx_http_lua_ffi_proxy_ssl_clear_certs ngx_lua_ffi_proxy_ssl_set_der_certificate = C.ngx_http_lua_ffi_proxy_ssl_set_der_certificate ngx_lua_ffi_proxy_ssl_set_der_private_key = C.ngx_http_lua_ffi_proxy_ssl_set_der_private_key ngx_lua_ffi_proxy_ssl_set_cert = C.ngx_http_lua_ffi_proxy_ssl_set_cert ngx_lua_ffi_proxy_ssl_set_priv_key = C.ngx_http_lua_ffi_proxy_ssl_set_priv_key elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_proxy_ssl_clear_certs(ngx_stream_lua_request_t *r, char **err); int ngx_stream_lua_ffi_proxy_ssl_set_der_certificate( ngx_stream_lua_request_t *r, const char *data, size_t len, char **err); int ngx_stream_lua_ffi_proxy_ssl_set_der_private_key( ngx_stream_lua_request_t *r, const char *data, size_t len, char **err); int ngx_stream_lua_ffi_proxy_ssl_set_cert(ngx_stream_lua_request_t *r, void *cdata, char **err); int ngx_stream_lua_ffi_proxy_ssl_set_priv_key(ngx_stream_lua_request_t *r, void *cdata, char **err); ]] ngx_lua_ffi_proxy_ssl_clear_certs = C.ngx_stream_lua_ffi_proxy_ssl_clear_certs ngx_lua_ffi_proxy_ssl_set_der_certificate = C.ngx_stream_lua_ffi_proxy_ssl_set_der_certificate ngx_lua_ffi_proxy_ssl_set_der_private_key = C.ngx_stream_lua_ffi_proxy_ssl_set_der_private_key ngx_lua_ffi_proxy_ssl_set_cert = C.ngx_stream_lua_ffi_proxy_ssl_set_cert ngx_lua_ffi_proxy_ssl_set_priv_key = C.ngx_stream_lua_ffi_proxy_ssl_set_priv_key end local _M = { version = base.version } function _M.clear_certs() local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_proxy_ssl_clear_certs(r, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.set_der_cert(data) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_proxy_ssl_set_der_certificate(r, data, #data, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.set_der_priv_key(data) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_proxy_ssl_set_der_private_key(r, data, #data, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.set_cert(cert) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_proxy_ssl_set_cert(r, cert, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.set_priv_key(priv_key) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_proxy_ssl_set_priv_key(r, priv_key, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end return _M PKJN]}ߋ ngx/process.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require 'ffi' local errmsg = base.get_errmsg_ptr() local FFI_ERROR = base.FFI_ERROR local ffi_str = ffi.string local tonumber = tonumber local subsystem = ngx.config.subsystem if subsystem == 'http' then require "resty.core.phase" -- for ngx.get_phase end local ngx_phase = ngx.get_phase local process_type_names = { [0 ] = "single", [1 ] = "master", [2 ] = "signaller", [3 ] = "worker", [4 ] = "helper", [99] = "privileged agent", } local C = ffi.C local _M = { version = base.version } local ngx_lua_ffi_enable_privileged_agent local ngx_lua_ffi_get_process_type local ngx_lua_ffi_process_signal_graceful_exit local ngx_lua_ffi_master_pid if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_enable_privileged_agent(char **err, unsigned int connections); int ngx_http_lua_ffi_get_process_type(void); void ngx_http_lua_ffi_process_signal_graceful_exit(void); int ngx_http_lua_ffi_master_pid(void); ]] ngx_lua_ffi_enable_privileged_agent = C.ngx_http_lua_ffi_enable_privileged_agent ngx_lua_ffi_get_process_type = C.ngx_http_lua_ffi_get_process_type ngx_lua_ffi_process_signal_graceful_exit = C.ngx_http_lua_ffi_process_signal_graceful_exit ngx_lua_ffi_master_pid = C.ngx_http_lua_ffi_master_pid else ffi.cdef[[ int ngx_stream_lua_ffi_enable_privileged_agent(char **err, unsigned int connections); int ngx_stream_lua_ffi_get_process_type(void); void ngx_stream_lua_ffi_process_signal_graceful_exit(void); int ngx_stream_lua_ffi_master_pid(void); ]] ngx_lua_ffi_enable_privileged_agent = C.ngx_stream_lua_ffi_enable_privileged_agent ngx_lua_ffi_get_process_type = C.ngx_stream_lua_ffi_get_process_type ngx_lua_ffi_process_signal_graceful_exit = C.ngx_stream_lua_ffi_process_signal_graceful_exit ngx_lua_ffi_master_pid = C.ngx_stream_lua_ffi_master_pid end function _M.type() local typ = ngx_lua_ffi_get_process_type() return process_type_names[tonumber(typ)] end function _M.enable_privileged_agent(connections) if ngx_phase() ~= "init" then return nil, "API disabled in the current context" end connections = connections or 512 if type(connections) ~= "number" or connections < 0 then return nil, "bad 'connections' argument: " .. "number expected and greater than 0" end local rc = ngx_lua_ffi_enable_privileged_agent(errmsg, connections) if rc == FFI_ERROR then return nil, ffi_str(errmsg[0]) end return true end function _M.signal_graceful_exit() ngx_lua_ffi_process_signal_graceful_exit() end function _M.get_master_pid() local pid = ngx_lua_ffi_master_pid() if pid == FFI_ERROR then return nil end return tonumber(pid) end return _M PKJN]HiڎVV ngx/ssl.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local ffi_gc = ffi.gc local ffi_new = ffi.new local get_request = base.get_request local error = error local tonumber = tonumber local errmsg = base.get_errmsg_ptr() local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local FFI_DECLINED = base.FFI_DECLINED local FFI_OK = base.FFI_OK local subsystem = ngx.config.subsystem local ngx_lua_ffi_ssl_set_der_certificate local ngx_lua_ffi_ssl_clear_certs local ngx_lua_ffi_ssl_set_der_private_key local ngx_lua_ffi_ssl_raw_server_addr local ngx_lua_ffi_ssl_server_port local ngx_lua_ffi_ssl_server_name local ngx_lua_ffi_ssl_raw_client_addr local ngx_lua_ffi_cert_pem_to_der local ngx_lua_ffi_priv_key_pem_to_der local ngx_lua_ffi_ssl_get_tls1_version local ngx_lua_ffi_parse_pem_cert local ngx_lua_ffi_parse_pem_priv_key local ngx_lua_ffi_parse_der_cert local ngx_lua_ffi_parse_der_priv_key local ngx_lua_ffi_set_cert local ngx_lua_ffi_set_priv_key local ngx_lua_ffi_free_cert local ngx_lua_ffi_free_priv_key local ngx_lua_ffi_ssl_verify_client local ngx_lua_ffi_ssl_client_random local ngx_lua_ffi_ssl_server_random local ngx_lua_ffi_ssl_session_master_key local ngx_lua_ffi_ssl_export_keying_material local ngx_lua_ffi_ssl_export_keying_material_early local ngx_lua_ffi_get_req_ssl_pointer local ngx_lua_ffi_get_upstream_ssl_pointer local ngx_lua_ffi_req_shared_ssl_ciphers ffi.cdef[[ typedef struct SSL SSL; int SSL_session_reused(const SSL *ssl); ]] if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_ssl_set_der_certificate(ngx_http_request_t *r, const char *data, size_t len, char **err); int ngx_http_lua_ffi_ssl_clear_certs(ngx_http_request_t *r, char **err); int ngx_http_lua_ffi_ssl_set_der_private_key(ngx_http_request_t *r, const char *data, size_t len, char **err); int ngx_http_lua_ffi_ssl_raw_server_addr(ngx_http_request_t *r, char **addr, size_t *addrlen, int *addrtype, char **err); int ngx_http_lua_ffi_ssl_server_port(ngx_http_request_t *r, unsigned short *server_port, char **err); int ngx_http_lua_ffi_ssl_server_name(ngx_http_request_t *r, char **name, size_t *namelen, char **err); int ngx_http_lua_ffi_ssl_raw_client_addr(ngx_http_request_t *r, char **addr, size_t *addrlen, int *addrtype, char **err); int ngx_http_lua_ffi_cert_pem_to_der(const unsigned char *pem, size_t pem_len, unsigned char *der, char **err); int ngx_http_lua_ffi_priv_key_pem_to_der(const unsigned char *pem, size_t pem_len, const unsigned char *passphrase, unsigned char *der, char **err); int ngx_http_lua_ffi_ssl_get_tls1_version(ngx_http_request_t *r, char **err); void *ngx_http_lua_ffi_parse_pem_cert(const unsigned char *pem, size_t pem_len, char **err); void *ngx_http_lua_ffi_parse_pem_priv_key(const unsigned char *pem, size_t pem_len, char **err); void *ngx_http_lua_ffi_parse_der_cert(const char *data, size_t len, char **err); void *ngx_http_lua_ffi_parse_der_priv_key(const char *data, size_t len, char **err) ; void *ngx_http_lua_ffi_get_req_ssl_pointer(ngx_http_request_t *r, char **err); void *ngx_http_lua_ffi_get_upstream_ssl_pointer( ngx_http_request_t *r, char **err); int ngx_http_lua_ffi_set_cert(void *r, void *cdata, char **err); int ngx_http_lua_ffi_set_priv_key(void *r, void *cdata, char **err); void ngx_http_lua_ffi_free_cert(void *cdata); void ngx_http_lua_ffi_free_priv_key(void *cdata); int ngx_http_lua_ffi_ssl_verify_client(void *r, void *client_certs, void *trusted_certs, int depth, char **err); int ngx_http_lua_ffi_ssl_client_random(ngx_http_request_t *r, const unsigned char *out, size_t *outlen, char **err); int ngx_http_lua_ffi_ssl_server_random(ngx_http_request_t *r, const unsigned char *out, size_t *outlen, char **err); int ngx_http_lua_ffi_ssl_session_master_key(ngx_http_request_t *r, const unsigned char *out, size_t *outlen, char **err); int ngx_http_lua_ffi_ssl_export_keying_material(void *r, unsigned char *out, size_t out_size, const char *label, size_t llen, const unsigned char *ctx, size_t ctxlen, int use_ctx, char **err); int ngx_http_lua_ffi_ssl_export_keying_material_early(void *r, unsigned char *out, size_t out_size, const char *label, size_t llen, const unsigned char *ctx, size_t ctxlen, char **err); int ngx_http_lua_ffi_req_shared_ssl_ciphers(ngx_http_request_t *r, unsigned short *ciphers, unsigned short *nciphers, int filter_grease, char **err); ]] ngx_lua_ffi_ssl_set_der_certificate = C.ngx_http_lua_ffi_ssl_set_der_certificate ngx_lua_ffi_ssl_clear_certs = C.ngx_http_lua_ffi_ssl_clear_certs ngx_lua_ffi_ssl_set_der_private_key = C.ngx_http_lua_ffi_ssl_set_der_private_key ngx_lua_ffi_ssl_raw_server_addr = C.ngx_http_lua_ffi_ssl_raw_server_addr ngx_lua_ffi_ssl_server_port = C.ngx_http_lua_ffi_ssl_server_port ngx_lua_ffi_ssl_server_name = C.ngx_http_lua_ffi_ssl_server_name ngx_lua_ffi_ssl_raw_client_addr = C.ngx_http_lua_ffi_ssl_raw_client_addr ngx_lua_ffi_cert_pem_to_der = C.ngx_http_lua_ffi_cert_pem_to_der ngx_lua_ffi_priv_key_pem_to_der = C.ngx_http_lua_ffi_priv_key_pem_to_der ngx_lua_ffi_ssl_get_tls1_version = C.ngx_http_lua_ffi_ssl_get_tls1_version ngx_lua_ffi_parse_pem_cert = C.ngx_http_lua_ffi_parse_pem_cert ngx_lua_ffi_parse_pem_priv_key = C.ngx_http_lua_ffi_parse_pem_priv_key ngx_lua_ffi_parse_der_cert = C.ngx_http_lua_ffi_parse_der_cert ngx_lua_ffi_parse_der_priv_key = C.ngx_http_lua_ffi_parse_der_priv_key ngx_lua_ffi_set_cert = C.ngx_http_lua_ffi_set_cert ngx_lua_ffi_set_priv_key = C.ngx_http_lua_ffi_set_priv_key ngx_lua_ffi_free_cert = C.ngx_http_lua_ffi_free_cert ngx_lua_ffi_free_priv_key = C.ngx_http_lua_ffi_free_priv_key ngx_lua_ffi_ssl_verify_client = C.ngx_http_lua_ffi_ssl_verify_client ngx_lua_ffi_ssl_client_random = C.ngx_http_lua_ffi_ssl_client_random ngx_lua_ffi_ssl_server_random = C.ngx_http_lua_ffi_ssl_server_random ngx_lua_ffi_ssl_session_master_key = C.ngx_http_lua_ffi_ssl_session_master_key ngx_lua_ffi_ssl_export_keying_material = C.ngx_http_lua_ffi_ssl_export_keying_material ngx_lua_ffi_ssl_export_keying_material_early = C.ngx_http_lua_ffi_ssl_export_keying_material_early ngx_lua_ffi_get_req_ssl_pointer = C.ngx_http_lua_ffi_get_req_ssl_pointer ngx_lua_ffi_get_upstream_ssl_pointer = C.ngx_http_lua_ffi_get_upstream_ssl_pointer ngx_lua_ffi_req_shared_ssl_ciphers = C.ngx_http_lua_ffi_req_shared_ssl_ciphers elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_ssl_set_der_certificate(ngx_stream_lua_request_t *r, const char *data, size_t len, char **err); int ngx_stream_lua_ffi_ssl_clear_certs(ngx_stream_lua_request_t *r, char **err); int ngx_stream_lua_ffi_ssl_set_der_private_key(ngx_stream_lua_request_t *r, const char *data, size_t len, char **err); int ngx_stream_lua_ffi_ssl_raw_server_addr(ngx_stream_lua_request_t *r, char **addr, size_t *addrlen, int *addrtype, char **err); int ngx_stream_lua_ffi_ssl_server_port(ngx_stream_lua_request_t *r, unsigned short *server_port, char **err); int ngx_stream_lua_ffi_ssl_server_name(ngx_stream_lua_request_t *r, char **name, size_t *namelen, char **err); int ngx_stream_lua_ffi_ssl_raw_client_addr(ngx_stream_lua_request_t *r, char **addr, size_t *addrlen, int *addrtype, char **err); int ngx_stream_lua_ffi_cert_pem_to_der(const unsigned char *pem, size_t pem_len, unsigned char *der, char **err); int ngx_stream_lua_ffi_priv_key_pem_to_der(const unsigned char *pem, size_t pem_len, const unsigned char *passphrase, unsigned char *der, char **err); int ngx_stream_lua_ffi_ssl_get_tls1_version(ngx_stream_lua_request_t *r, char **err); void *ngx_stream_lua_ffi_parse_pem_cert(const unsigned char *pem, size_t pem_len, char **err); void *ngx_stream_lua_ffi_parse_der_cert(const unsigned char *der, size_t der_len, char **err); void *ngx_stream_lua_ffi_parse_pem_priv_key(const unsigned char *pem, size_t pem_len, char **err); void *ngx_stream_lua_ffi_parse_der_priv_key(const unsigned char *der, size_t der_len, char **err); void *ngx_stream_lua_ffi_get_req_ssl_pointer(ngx_stream_lua_request_t *r, char **err); void *ngx_stream_lua_ffi_get_upstream_ssl_pointer( ngx_stream_lua_request_t *r, char **err); int ngx_stream_lua_ffi_set_cert(void *r, void *cdata, char **err); int ngx_stream_lua_ffi_set_priv_key(void *r, void *cdata, char **err); void ngx_stream_lua_ffi_free_cert(void *cdata); void ngx_stream_lua_ffi_free_priv_key(void *cdata); int ngx_stream_lua_ffi_ssl_verify_client(void *r, void *client_certs, void *trusted_certs, int depth, char **err); int ngx_stream_lua_ffi_ssl_client_random(ngx_stream_lua_request_t *r, unsigned char *out, size_t *outlen, char **err); int ngx_stream_lua_ffi_req_shared_ssl_ciphers(ngx_stream_lua_request_t *r, unsigned short *ciphers, unsigned short *nciphers, int filter_grease, char **err); ]] ngx_lua_ffi_ssl_set_der_certificate = C.ngx_stream_lua_ffi_ssl_set_der_certificate ngx_lua_ffi_ssl_clear_certs = C.ngx_stream_lua_ffi_ssl_clear_certs ngx_lua_ffi_ssl_set_der_private_key = C.ngx_stream_lua_ffi_ssl_set_der_private_key ngx_lua_ffi_ssl_raw_server_addr = C.ngx_stream_lua_ffi_ssl_raw_server_addr ngx_lua_ffi_ssl_server_port = C.ngx_stream_lua_ffi_ssl_server_port ngx_lua_ffi_ssl_server_name = C.ngx_stream_lua_ffi_ssl_server_name ngx_lua_ffi_ssl_raw_client_addr = C.ngx_stream_lua_ffi_ssl_raw_client_addr ngx_lua_ffi_cert_pem_to_der = C.ngx_stream_lua_ffi_cert_pem_to_der ngx_lua_ffi_priv_key_pem_to_der = C.ngx_stream_lua_ffi_priv_key_pem_to_der ngx_lua_ffi_ssl_get_tls1_version = C.ngx_stream_lua_ffi_ssl_get_tls1_version ngx_lua_ffi_parse_pem_cert = C.ngx_stream_lua_ffi_parse_pem_cert ngx_lua_ffi_parse_der_cert = C.ngx_stream_lua_ffi_parse_der_cert ngx_lua_ffi_parse_pem_priv_key = C.ngx_stream_lua_ffi_parse_pem_priv_key ngx_lua_ffi_parse_der_priv_key = C.ngx_stream_lua_ffi_parse_der_priv_key ngx_lua_ffi_set_cert = C.ngx_stream_lua_ffi_set_cert ngx_lua_ffi_set_priv_key = C.ngx_stream_lua_ffi_set_priv_key ngx_lua_ffi_free_cert = C.ngx_stream_lua_ffi_free_cert ngx_lua_ffi_free_priv_key = C.ngx_stream_lua_ffi_free_priv_key ngx_lua_ffi_ssl_verify_client = C.ngx_stream_lua_ffi_ssl_verify_client ngx_lua_ffi_ssl_client_random = C.ngx_stream_lua_ffi_ssl_client_random ngx_lua_ffi_get_req_ssl_pointer = C.ngx_stream_lua_ffi_get_req_ssl_pointer ngx_lua_ffi_get_upstream_ssl_pointer = C.ngx_stream_lua_ffi_get_upstream_ssl_pointer ngx_lua_ffi_req_shared_ssl_ciphers = C.ngx_stream_lua_ffi_req_shared_ssl_ciphers end local _M = { version = base.version } local charpp = ffi.new("char*[1]") local intp = ffi.new("int[1]") local ushortp = ffi.new("unsigned short[1]") do local ciphers_buf = ffi_new("uint16_t [?]", 256) function _M.get_req_shared_ssl_ciphers(filter_grease) local r = get_request() if not r then error("no request found") end if filter_grease == nil then filter_grease = true -- Default to filter GREASE end ciphers_buf[0] = 255 -- Set max number of ciphers we can hold local filter_flag = filter_grease and 1 or 0 local rc = ngx_lua_ffi_req_shared_ssl_ciphers(r, ciphers_buf + 1, ciphers_buf, filter_flag, errmsg) if rc ~= FFI_OK then return nil, ffi_str(errmsg[0]) end -- Build result table local result = {} for i = 1, ciphers_buf[0] do result[i] = tonumber(ciphers_buf[i]) end return result end end function _M.clear_certs() local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_ssl_clear_certs(r, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.set_der_cert(data) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_ssl_set_der_certificate(r, data, #data, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.set_der_priv_key(data) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_ssl_set_der_private_key(r, data, #data, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end local addr_types = { [0] = "unix", [1] = "inet", [2] = "inet6", } function _M.raw_server_addr() local r = get_request() if not r then error("no request found") end local sizep = get_size_ptr() local rc = ngx_lua_ffi_ssl_raw_server_addr(r, charpp, sizep, intp, errmsg) if rc == FFI_OK then local typ = addr_types[intp[0]] if not typ then return nil, nil, "unknown address type: " .. intp[0] end return ffi_str(charpp[0], sizep[0]), typ end return nil, nil, ffi_str(errmsg[0]) end function _M.server_port() local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_ssl_server_port(r, ushortp, errmsg) if rc == FFI_OK then return ushortp[0] end return nil, ffi_str(errmsg[0]) end function _M.server_name() local r = get_request() if not r then error("no request found") end local sizep = get_size_ptr() local rc = ngx_lua_ffi_ssl_server_name(r, charpp, sizep, errmsg) if rc == FFI_OK then return ffi_str(charpp[0], sizep[0]) end if rc == FFI_DECLINED then return nil end return nil, ffi_str(errmsg[0]) end function _M.raw_client_addr() local r = get_request() if not r then error("no request found") end local sizep = get_size_ptr() local rc = ngx_lua_ffi_ssl_raw_client_addr(r, charpp, sizep, intp, errmsg) if rc == FFI_OK then local typ = addr_types[intp[0]] if not typ then return nil, nil, "unknown address type: " .. intp[0] end return ffi_str(charpp[0], sizep[0]), typ end return nil, nil, ffi_str(errmsg[0]) end function _M.cert_pem_to_der(pem) local outbuf = get_string_buf(#pem) local sz = ngx_lua_ffi_cert_pem_to_der(pem, #pem, outbuf, errmsg) if sz > 0 then return ffi_str(outbuf, sz) end return nil, ffi_str(errmsg[0]) end function _M.priv_key_pem_to_der(pem, passphrase) local outbuf = get_string_buf(#pem) local sz = ngx_lua_ffi_priv_key_pem_to_der(pem, #pem, passphrase, outbuf, errmsg) if sz > 0 then return ffi_str(outbuf, sz) end return nil, ffi_str(errmsg[0]) end local function get_tls1_version() local r = get_request() if not r then error("no request found") end local ver = ngx_lua_ffi_ssl_get_tls1_version(r, errmsg) ver = tonumber(ver) if ver >= 0 then return ver end -- rc == FFI_ERROR return nil, ffi_str(errmsg[0]) end _M.get_tls1_version = get_tls1_version function _M.parse_pem_cert(pem) local cert = ngx_lua_ffi_parse_pem_cert(pem, #pem, errmsg) if cert ~= nil then return ffi_gc(cert, ngx_lua_ffi_free_cert) end return nil, ffi_str(errmsg[0]) end function _M.parse_pem_priv_key(pem) local pkey = ngx_lua_ffi_parse_pem_priv_key(pem, #pem, errmsg) if pkey ~= nil then return ffi_gc(pkey, ngx_lua_ffi_free_priv_key) end return nil, ffi_str(errmsg[0]) end function _M.parse_der_cert(der) local cert = ngx_lua_ffi_parse_der_cert(der, #der, errmsg) if cert ~= nil then return ffi_gc(cert, ngx_lua_ffi_free_cert) end return nil, ffi_str(errmsg[0]) end function _M.parse_der_priv_key(der) local pkey = ngx_lua_ffi_parse_der_priv_key(der, #der, errmsg) if pkey ~= nil then return ffi_gc(pkey, ngx_lua_ffi_free_priv_key) end return nil, ffi_str(errmsg[0]) end function _M.set_cert(cert) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_set_cert(r, cert, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.set_priv_key(priv_key) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_set_priv_key(r, priv_key, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.verify_client(client_certs, depth, trusted_certs) local r = get_request() if not r then error("no request found") end if not depth then depth = -1 end local rc = ngx_lua_ffi_ssl_verify_client(r, client_certs, trusted_certs, depth, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end function _M.export_keying_material(length, label, context) local r = get_request() if not r then error("no request found") end local outbuf = get_string_buf(length) local use_context = context and 1 or 0 local context_len = context and #context or 0 local rc = ngx_lua_ffi_ssl_export_keying_material(r, outbuf, length, label, #label, context, context_len, use_context, errmsg) if rc == FFI_OK then return ffi_str(outbuf, length) end if rc == FFI_DECLINED then return nil end return nil, ffi_str(errmsg[0]) end function _M.export_keying_material_early(length, label, context) local r = get_request() if not r then error("no request found") end local outbuf = get_string_buf(length) local context_len = context and #context or 0 local rc = ngx_lua_ffi_ssl_export_keying_material_early(r, outbuf, length, label, #label, context, context_len, errmsg) if rc == FFI_OK then return ffi_str(outbuf, length) end if rc == FFI_DECLINED then return nil end return nil, ffi_str(errmsg[0]) end function _M.get_req_ssl_pointer() local r = get_request() if not r then error("no request found") end local ssl = ngx_lua_ffi_get_req_ssl_pointer(r, errmsg) if ssl == nil then return nil, ffi_str(errmsg[0]) end return ssl end function _M.get_upstream_ssl_pointer() local r = get_request() if not r then error("no request found") end local ssl = ngx_lua_ffi_get_upstream_ssl_pointer(r, errmsg) if not ssl then return nil, ffi_str(errmsg[0]) end return ssl end function _M.ssl_session_reused(ssl) if not ssl or type(ssl) ~= "cdata" then return nil, "bad ssl" end local reused = C.SSL_session_reused(ssl) return tonumber(reused) == 1 and true or false end do _M.SSL3_VERSION = 0x0300 _M.TLS1_VERSION = 0x0301 _M.TLS1_1_VERSION = 0x0302 _M.TLS1_2_VERSION = 0x0303 _M.TLS1_3_VERSION = 0x0304 local map = { [_M.SSL3_VERSION] = "SSLv3", [_M.TLS1_VERSION] = "TLSv1", [_M.TLS1_1_VERSION] = "TLSv1.1", [_M.TLS1_2_VERSION] = "TLSv1.2", [_M.TLS1_3_VERSION] = "TLSv1.3", } function _M.get_tls1_version_str() local ver, err = get_tls1_version() if not ver then return nil, err end local ver_str = map[ver] if not ver_str then return nil, "unknown version" end return ver_str end end function _M.get_client_random(outlen) local r = get_request() if not r then error("no request found") end if outlen == nil then outlen = 32 end local out = get_string_buf(outlen) local sizep = get_size_ptr() sizep[0] = outlen local rc = ngx_lua_ffi_ssl_client_random(r, out, sizep, errmsg) if rc == FFI_OK then if outlen == 0 then return tonumber(sizep[0]) end return ffi_str(out, sizep[0]) end return nil, ffi_str(errmsg[0]) end function _M.get_server_random(outlen) local r = get_request() if not r then error("no request found") end if outlen == nil then outlen = 32 end local out = get_string_buf(outlen) local sizep = get_size_ptr() sizep[0] = outlen local rc = ngx_lua_ffi_ssl_server_random(r, out, sizep, errmsg) if rc == FFI_OK then if outlen == 0 then return tonumber(sizep[0]) end return ffi_str(out, sizep[0]) end return nil, ffi_str(errmsg[0]) end function _M.get_session_master_key(outlen) local r = get_request() if not r then error("no request found") end if outlen == nil then outlen = 48 end local out = get_string_buf(outlen) local sizep = get_size_ptr() sizep[0] = outlen local rc = ngx_lua_ffi_ssl_session_master_key(r, out, sizep, errmsg) if rc == FFI_OK then if outlen == 0 then return tonumber(sizep[0]) end return ffi_str(out, sizep[0]) end return nil, ffi_str(errmsg[0]) end return _M PKJN]T)Qngx/proxyssl.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local get_request = base.get_request local error = error local tonumber = tonumber local errmsg = base.get_errmsg_ptr() local subsystem = ngx.config.subsystem local ngx_lua_ffi_proxy_ssl_get_tls1_version if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_proxy_ssl_get_tls1_version(ngx_http_request_t *r, char **err); ]] ngx_lua_ffi_proxy_ssl_get_tls1_version = C.ngx_http_lua_ffi_proxy_ssl_get_tls1_version elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_proxy_ssl_get_tls1_version( ngx_stream_lua_request_t *r, char **err); ]] ngx_lua_ffi_proxy_ssl_get_tls1_version = C.ngx_stream_lua_ffi_proxy_ssl_get_tls1_version end local _M = { version = base.version } local function get_tls1_version() local r = get_request() if not r then error("no request found") end local ver = ngx_lua_ffi_proxy_ssl_get_tls1_version(r, errmsg) ver = tonumber(ver) if ver >= 0 then return ver end -- rc == FFI_ERROR return nil, ffi_str(errmsg[0]) end _M.get_tls1_version = get_tls1_version do _M.SSL3_VERSION = 0x0300 _M.TLS1_VERSION = 0x0301 _M.TLS1_1_VERSION = 0x0302 _M.TLS1_2_VERSION = 0x0303 _M.TLS1_3_VERSION = 0x0304 local map = { [_M.SSL3_VERSION] = "SSLv3", [_M.TLS1_VERSION] = "TLSv1", [_M.TLS1_1_VERSION] = "TLSv1.1", [_M.TLS1_2_VERSION] = "TLSv1.2", [_M.TLS1_3_VERSION] = "TLSv1.3", } function _M.get_tls1_version_str() local ver, err = get_tls1_version() if not ver then return nil, err end local ver_str = map[ver] if not ver_str then return nil, "unknown version" end return ver_str end end return _M PKJN]qLL ngx/pipe.luanu[-- Copyright (C) by OpenResty Inc. local base = require "resty.core.base" base.allows_subsystem("http") require "resty.core.phase" -- for ngx.get_phase local assert = assert local error = error local ipairs = ipairs local tonumber = tonumber local tostring = tostring local type = type local str_find = string.find local table_concat = table.concat local ffi = require "ffi" local C = ffi.C local ffi_new = ffi.new local ffi_str = ffi.string local ngx_phase = ngx.get_phase local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local get_request = base.get_request local FFI_AGAIN = base.FFI_AGAIN local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT local FFI_DECLINED = base.FFI_DECLINED local FFI_ERROR = base.FFI_ERROR local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX local FFI_OK = base.FFI_OK local co_yield = coroutine._yield ffi.cdef[[ typedef int ngx_pid_t; typedef uintptr_t ngx_msec_t; typedef unsigned char u_char; typedef struct ngx_http_lua_pipe_s ngx_http_lua_pipe_t; typedef struct { ngx_pid_t _pid; ngx_msec_t write_timeout; ngx_msec_t stdout_read_timeout; ngx_msec_t stderr_read_timeout; ngx_msec_t wait_timeout; ngx_http_lua_pipe_t *pipe; } ngx_http_lua_ffi_pipe_proc_t; int ngx_http_lua_ffi_pipe_spawn(ngx_http_request_t *r, ngx_http_lua_ffi_pipe_proc_t *proc, const char *file, const char **argv, int merge_stderr, size_t buffer_size, const char **environ, u_char *errbuf, size_t *errbuf_size); int ngx_http_lua_ffi_pipe_proc_read(ngx_http_request_t *r, ngx_http_lua_ffi_pipe_proc_t *proc, int from_stderr, int reader_type, size_t length, u_char **buf, size_t *buf_size, u_char *errbuf, size_t *errbuf_size); int ngx_http_lua_ffi_pipe_get_read_result(ngx_http_request_t *r, ngx_http_lua_ffi_pipe_proc_t *proc, int from_stderr, u_char **buf, size_t *buf_size, u_char *errbuf, size_t *errbuf_size); ssize_t ngx_http_lua_ffi_pipe_proc_write(ngx_http_request_t *r, ngx_http_lua_ffi_pipe_proc_t *proc, const u_char *data, size_t len, u_char *errbuf, size_t *errbuf_size); ssize_t ngx_http_lua_ffi_pipe_get_write_result(ngx_http_request_t *r, ngx_http_lua_ffi_pipe_proc_t *proc, u_char *errbuf, size_t *errbuf_size); int ngx_http_lua_ffi_pipe_proc_shutdown_stdin( ngx_http_lua_ffi_pipe_proc_t *proc, u_char *errbuf, size_t *errbuf_size); int ngx_http_lua_ffi_pipe_proc_shutdown_stdout( ngx_http_lua_ffi_pipe_proc_t *proc, u_char *errbuf, size_t *errbuf_size); int ngx_http_lua_ffi_pipe_proc_shutdown_stderr( ngx_http_lua_ffi_pipe_proc_t *proc, u_char *errbuf, size_t *errbuf_size); int ngx_http_lua_ffi_pipe_proc_wait(ngx_http_request_t *r, ngx_http_lua_ffi_pipe_proc_t *proc, char **reason, int *status, u_char *errbuf, size_t *errbuf_size); int ngx_http_lua_ffi_pipe_proc_kill(ngx_http_lua_ffi_pipe_proc_t *proc, int signal, u_char *errbuf, size_t *errbuf_size); void ngx_http_lua_ffi_pipe_proc_destroy(ngx_http_lua_ffi_pipe_proc_t *proc); ]] if not pcall(function() return C.ngx_http_lua_ffi_pipe_spawn end) then error("pipe API is not supported due to either a platform issue " .. "or lack of the HAVE_SOCKET_CLOEXEC_PATCH patch", 2) end local _M = { version = base.version } local ERR_BUF_SIZE = 256 local VALUE_BUF_SIZE = 512 local PIPE_READ_ALL = 0 local PIPE_READ_BYTES = 1 local PIPE_READ_LINE = 2 local PIPE_READ_ANY = 3 local proc_set_timeouts do local MAX_TIMEOUT = 0xffffffff function proc_set_timeouts(proc, write_timeout, stdout_read_timeout, stderr_read_timeout, wait_timeout) -- the implementation below is straightforward but could not be JIT -- compiled by the latest LuaJIT. When called in loops, LuaJIT will try -- to unroll it, and fall back to interpreter after it reaches the -- unroll limit. --[[ local function set_timeout(proc, attr, timeout) if timeout then if timeout > MAX_TIMEOUT then error("bad timeout value", 3) end proc[attr] = timeout end end set_timeout(...) ]] if write_timeout then if write_timeout < 0 or MAX_TIMEOUT < write_timeout then error("bad write_timeout option", 3) end proc.write_timeout = write_timeout end if stdout_read_timeout then if stdout_read_timeout < 0 or MAX_TIMEOUT < stdout_read_timeout then error("bad stdout_read_timeout option", 3) end proc.stdout_read_timeout = stdout_read_timeout end if stderr_read_timeout then if stderr_read_timeout < 0 or MAX_TIMEOUT < stderr_read_timeout then error("bad stderr_read_timeout option", 3) end proc.stderr_read_timeout = stderr_read_timeout end if wait_timeout then if wait_timeout < 0 or MAX_TIMEOUT < wait_timeout then error("bad wait_timeout option", 3) end proc.wait_timeout = wait_timeout end end end local function check_proc_instance(proc) if type(proc) ~= "cdata" then error("not a process instance", 3) end end local proc_read do local value_buf = ffi_new("char[?]", VALUE_BUF_SIZE) local buf = ffi_new("char *[1]") local buf_size = ffi_new("size_t[1]") function proc_read(proc, stderr, reader_type, len) check_proc_instance(proc) local r = get_request() if not r then error("no request found") end buf[0] = value_buf buf_size[0] = VALUE_BUF_SIZE local errbuf = get_string_buf(ERR_BUF_SIZE) local errbuf_size = get_size_ptr() errbuf_size[0] = ERR_BUF_SIZE local rc = C.ngx_http_lua_ffi_pipe_proc_read(r, proc, stderr, reader_type, len, buf, buf_size, errbuf, errbuf_size) if rc == FFI_NO_REQ_CTX then error("no request ctx found") end if rc == FFI_BAD_CONTEXT then error(ffi_str(errbuf, errbuf_size[0]), 2) end while true do if rc == FFI_ERROR then return nil, ffi_str(errbuf, errbuf_size[0]) end if rc == FFI_OK then local p = buf[0] if p ~= value_buf then p = ffi_new("char[?]", buf_size[0]) buf[0] = p C.ngx_http_lua_ffi_pipe_get_read_result(r, proc, stderr, buf, buf_size, errbuf, errbuf_size) assert(p == buf[0]) end return ffi_str(p, buf_size[0]) end if rc == FFI_DECLINED then local err = ffi_str(errbuf, errbuf_size[0]) local p = buf[0] if p ~= value_buf then p = ffi_new("char[?]", buf_size[0]) buf[0] = p C.ngx_http_lua_ffi_pipe_get_read_result(r, proc, stderr, buf, buf_size, errbuf, errbuf_size) assert(p == buf[0]) end local partial = ffi_str(p, buf_size[0]) return nil, err, partial end assert(rc == FFI_AGAIN) co_yield() buf[0] = value_buf buf_size[0] = VALUE_BUF_SIZE errbuf = get_string_buf(ERR_BUF_SIZE) errbuf_size = get_size_ptr() errbuf_size[0] = ERR_BUF_SIZE rc = C.ngx_http_lua_ffi_pipe_get_read_result(r, proc, stderr, buf, buf_size, errbuf, errbuf_size) end end end local function proc_write(proc, data) check_proc_instance(proc) local r = get_request() if not r then error("no request found", 2) end local data_type = type(data) if data_type ~= "string" then if data_type == "table" then data = table_concat(data, "") elseif data_type == "number" then data = tostring(data) else error("bad data arg: string, number, or table expected, got " .. data_type, 2) end end local errbuf = get_string_buf(ERR_BUF_SIZE) local errbuf_size = get_size_ptr() errbuf_size[0] = ERR_BUF_SIZE local rc = C.ngx_http_lua_ffi_pipe_proc_write(r, proc, data, #data, errbuf, errbuf_size) if rc == FFI_NO_REQ_CTX then error("no request ctx found", 2) end if rc == FFI_BAD_CONTEXT then error(ffi_str(errbuf, errbuf_size[0]), 2) end while true do if rc == FFI_ERROR then return nil, ffi_str(errbuf, errbuf_size[0]) end if rc >= 0 then -- rc holds the bytes sent return tonumber(rc) end assert(rc == FFI_AGAIN) co_yield() errbuf = get_string_buf(ERR_BUF_SIZE) errbuf_size = get_size_ptr() errbuf_size[0] = ERR_BUF_SIZE rc = C.ngx_http_lua_ffi_pipe_get_write_result(r, proc, errbuf, errbuf_size) end end local function proc_shutdown(proc, direction) check_proc_instance(proc) local rc local errbuf = get_string_buf(ERR_BUF_SIZE) local errbuf_size = get_size_ptr() errbuf_size[0] = ERR_BUF_SIZE if direction == "stdin" then rc = C.ngx_http_lua_ffi_pipe_proc_shutdown_stdin(proc, errbuf, errbuf_size) elseif direction == "stdout" then rc = C.ngx_http_lua_ffi_pipe_proc_shutdown_stdout(proc, errbuf, errbuf_size) elseif direction == "stderr" then rc = C.ngx_http_lua_ffi_pipe_proc_shutdown_stderr(proc, errbuf, errbuf_size) else error("bad shutdown arg: " .. direction, 2) end if rc == FFI_ERROR then return nil, ffi_str(errbuf, errbuf_size[0]) end return true end local proc_wait do local reason = ffi_new("char *[1]") local status = ffi_new("int[1]") function proc_wait(proc) check_proc_instance(proc) local r = get_request() if not r then error("no request found", 2) end local errbuf = get_string_buf(ERR_BUF_SIZE) local errbuf_size = get_size_ptr() errbuf_size[0] = ERR_BUF_SIZE local rc = C.ngx_http_lua_ffi_pipe_proc_wait(r, proc, reason, status, errbuf, errbuf_size) if rc == FFI_NO_REQ_CTX then error("no request ctx found", 2) end if rc == FFI_BAD_CONTEXT then error(ffi_str(errbuf, errbuf_size[0]), 2) end if rc == FFI_ERROR then return nil, ffi_str(errbuf, errbuf_size[0]) end if rc == FFI_OK then return true, ffi_str(reason[0]), tonumber(status[0]) end if rc == FFI_DECLINED then return false, ffi_str(reason[0]), tonumber(status[0]) end local ok, exit_reason, exit_status ok, exit_reason, exit_status = co_yield() return ok, exit_reason, exit_status end end local function proc_kill(proc, signal) check_proc_instance(proc) if type(signal) ~= "number" then error("bad signal arg: number expected, got " .. tostring(signal), 2) end local errbuf = get_string_buf(ERR_BUF_SIZE) local errbuf_size = get_size_ptr() errbuf_size[0] = ERR_BUF_SIZE local rc = C.ngx_http_lua_ffi_pipe_proc_kill(proc, signal, errbuf, errbuf_size) if rc == FFI_ERROR then return nil, ffi_str(errbuf, errbuf_size[0]) end return true end local mt = { __gc = C.ngx_http_lua_ffi_pipe_proc_destroy, __index = { pid = function (proc) return proc._pid end, set_timeouts = function (proc, write_timeout, stdout_read_timeout, stderr_read_timeout, wait_timeout) proc_set_timeouts(proc, write_timeout, stdout_read_timeout, stderr_read_timeout, wait_timeout) end, stdout_read_all = function (proc) local data, err, partial = proc_read(proc, 0, PIPE_READ_ALL, 0) return data, err, partial end, stdout_read_bytes = function (proc, len) if len <= 0 then if len < 0 then error("bad len argument", 2) end return "" end local data, err, partial = proc_read(proc, 0, PIPE_READ_BYTES, len) return data, err, partial end, stdout_read_line = function (proc) local data, err, partial = proc_read(proc, 0, PIPE_READ_LINE, 0) return data, err, partial end, stdout_read_any = function (proc, max) if type(max) ~= "number" then max = tonumber(max) end if not max or max <= 0 then error("bad max argument", 2) end local data, err, partial = proc_read(proc, 0, PIPE_READ_ANY, max) return data, err, partial end, stderr_read_all = function (proc) local data, err, partial = proc_read(proc, 1, PIPE_READ_ALL, 0) return data, err, partial end, stderr_read_bytes = function (proc, len) if len <= 0 then if len < 0 then error("bad len argument", 2) end return "" end local data, err, partial = proc_read(proc, 1, PIPE_READ_BYTES, len) return data, err, partial end, stderr_read_line = function (proc) local data, err, partial = proc_read(proc, 1, PIPE_READ_LINE, 0) return data, err, partial end, stderr_read_any = function (proc, max) if type(max) ~= "number" then max = tonumber(max) end if not max or max <= 0 then error("bad max argument", 2) end local data, err, partial = proc_read(proc, 1, PIPE_READ_ANY, max) return data, err, partial end, write = proc_write, shutdown = proc_shutdown, wait = proc_wait, kill = proc_kill, } } local Proc = ffi.metatype("ngx_http_lua_ffi_pipe_proc_t", mt) local pipe_spawn do local sh_exe = "/bin/sh" local opt_c = "-c" local shell_args = ffi_new("const char* [?]", 4) shell_args[0] = sh_exe shell_args[1] = opt_c shell_args[3] = nil local write_timeout = 10000 local stdout_read_timeout = 10000 local stderr_read_timeout = 10000 local wait_timeout = 10000 -- reference shell cmd's constant strings here to prevent them from getting -- collected by the Lua GC. _M._gc_ref_c_opt = opt_c function pipe_spawn(args, opts) if ngx_phase() == "init" then error("API disabled in the current context", 2) end local exe local proc_args local proc_envs local args_type = type(args) if args_type == "table" then local nargs = 0 for i, arg in ipairs(args) do nargs = nargs + 1 if type(arg) ~= "string" then args[i] = tostring(arg) end end if nargs == 0 then error("bad args arg: non-empty table expected", 2) end exe = args[1] proc_args = ffi_new("const char* [?]", nargs + 1, args) proc_args[nargs] = nil elseif args_type == "string" then exe = sh_exe shell_args[2] = args proc_args = shell_args else error("bad args arg: table expected, got " .. args_type, 2) end local merge_stderr = 0 local buffer_size = 4096 local proc = Proc() if opts then merge_stderr = opts.merge_stderr and 1 or 0 if opts.buffer_size then buffer_size = tonumber(opts.buffer_size) if not buffer_size or buffer_size < 1 then error("bad buffer_size option", 2) end end if opts.environ then local environ = opts.environ local environ_type = type(environ) if environ_type ~= "table" then error("bad environ option: table expected, got " .. environ_type, 2) end local nenv = 0 for i, env in ipairs(environ) do nenv = nenv + 1 local env_type = type(env) if env_type ~= "string" then error("bad value at index " .. i .. " of environ " .. "option: string expected, got " .. env_type, 2) end if not str_find(env, "=", 2, true) then error("bad value at index " .. i .. " of environ " .. "option: 'name=[value]' format expected, got '" .. env .. "'", 2) end end if nenv > 0 then proc_envs = ffi_new("const char* [?]", nenv + 1, environ) proc_envs[nenv] = nil end end proc_set_timeouts(proc, opts.write_timeout or write_timeout, opts.stdout_read_timeout or stdout_read_timeout, opts.stderr_read_timeout or stderr_read_timeout, opts.wait_timeout or wait_timeout) else proc_set_timeouts(proc, write_timeout, stdout_read_timeout, stderr_read_timeout, wait_timeout) end local errbuf = get_string_buf(ERR_BUF_SIZE) local errbuf_size = get_size_ptr() local r = get_request() errbuf_size[0] = ERR_BUF_SIZE local rc = C.ngx_http_lua_ffi_pipe_spawn(r, proc, exe, proc_args, merge_stderr, buffer_size, proc_envs, errbuf, errbuf_size) if rc == FFI_ERROR then return nil, ffi_str(errbuf, errbuf_size[0]) end return proc end end -- do _M.spawn = pipe_spawn return _M PKJN]D) ngx/resp.luanu[-- Copyright (C) Yichun Zhang. All rights reserved. local ffi = require "ffi" local C = ffi.C local base = require "resty.core.base" base.allows_subsystem('http') local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT local core_response = require "resty.core.response" local set_resp_header = core_response.set_resp_header local get_request = base.get_request local bypass_if_checks = core_response.bypass_if_checks ffi.cdef[[ int ngx_http_lua_ffi_set_resp_status_and_reason(ngx_http_request_t *r, int status, const char *reason, size_t reason_len); ]] local _M = { version = base.version } function _M.add_header(key, value) set_resp_header(nil, key, value, true) end function _M.set_status(status, reason) local r = get_request() if not r then error("no request found") end if type(status) ~= 'number' then status = tonumber(status) end local rc = C.ngx_http_lua_ffi_set_resp_status_and_reason(r, status, reason, #reason) if rc == FFI_BAD_CONTEXT then error("API disabled in the current context", 2) end end function _M.bypass_if_checks() return bypass_if_checks() end return _M PKJN]~:: ngx/ocsp.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http') local ffi = require "ffi" local C = ffi.C local ffi_new = ffi.new local ffi_str = ffi.string local get_request = base.get_request local error = error local tonumber = tonumber local errmsg = base.get_errmsg_ptr() local get_string_buf = base.get_string_buf local get_string_buf_size = base.get_string_buf_size local get_size_ptr = base.get_size_ptr local FFI_DECLINED = base.FFI_DECLINED local FFI_OK = base.FFI_OK local FFI_BUSY = base.FFI_BUSY ffi.cdef[[ int ngx_http_lua_ffi_ssl_get_ocsp_responder_from_der_chain( const char *chain_data, size_t chain_len, char *out, size_t *out_size, char **err); int ngx_http_lua_ffi_ssl_create_ocsp_request(const char *chain_data, size_t chain_len, unsigned char *out, size_t *out_size, char **err); int ngx_http_lua_ffi_ssl_validate_ocsp_response(const unsigned char *resp, size_t resp_len, const char *chain_data, size_t chain_len, unsigned char *errbuf, size_t *errbuf_size, long *valid); int ngx_http_lua_ffi_ssl_set_ocsp_status_resp(ngx_http_request_t *r, const unsigned char *resp, size_t resp_len, char **err); ]] local _M = { version = base.version } function _M.get_ocsp_responder_from_der_chain(certs, maxlen) local buf_size = maxlen if not buf_size then buf_size = get_string_buf_size() end local buf = get_string_buf(buf_size) local sizep = get_size_ptr() sizep[0] = buf_size local rc = C.ngx_http_lua_ffi_ssl_get_ocsp_responder_from_der_chain(certs, #certs, buf, sizep, errmsg) if rc == FFI_DECLINED then return nil end if rc == FFI_OK then return ffi_str(buf, sizep[0]) end if rc == FFI_BUSY then return ffi_str(buf, sizep[0]), "truncated" end return nil, ffi_str(errmsg[0]) end function _M.create_ocsp_request(certs, maxlen) local buf_size = maxlen if not buf_size then buf_size = get_string_buf_size() end local buf = get_string_buf(buf_size) local sizep = get_size_ptr() sizep[0] = buf_size local rc = C.ngx_http_lua_ffi_ssl_create_ocsp_request(certs, #certs, buf, sizep, errmsg) if rc == FFI_OK then return ffi_str(buf, sizep[0]) end if rc == FFI_BUSY then return nil, ffi_str(errmsg[0]) .. ": " .. tonumber(sizep[0]) .. " > " .. buf_size end return nil, ffi_str(errmsg[0]) end local next_update_p = ffi_new("long[1]") function _M.validate_ocsp_response(resp, chain, max_errmsg_len) local errbuf_size = max_errmsg_len if not errbuf_size then errbuf_size = get_string_buf_size() end local errbuf = get_string_buf(errbuf_size) local sizep = get_size_ptr() sizep[0] = errbuf_size next_update_p[0] = 0 local rc = C.ngx_http_lua_ffi_ssl_validate_ocsp_response(resp, #resp, chain, #chain, errbuf, sizep, next_update_p) if rc == FFI_OK then local next_update = tonumber(next_update_p[0]) if next_update == 0 then next_update = nil end return true, next_update end -- rc == FFI_ERROR return nil, ffi_str(errbuf, sizep[0]) end function _M.set_ocsp_status_resp(ocsp_resp) local r = get_request() if not r then error("no request found") end local rc = C.ngx_http_lua_ffi_ssl_set_ocsp_status_resp(r, ocsp_resp, #ocsp_resp, errmsg) if rc == FFI_DECLINED then -- no client status req return true, "no status req" end if rc == FFI_OK then return true end -- rc == FFI_ERROR return nil, ffi_str(errmsg[0]) end return _M PKMN]܅,,ngx/balancer.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require "ffi" local C = ffi.C local ffi_str = ffi.string local errmsg = base.get_errmsg_ptr() local FFI_OK = base.FFI_OK local FFI_ERROR = base.FFI_ERROR local int_out = ffi.new("int[1]") local get_request = base.get_request local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local error = error local type = type local tonumber = tonumber local max = math.max local subsystem = ngx.config.subsystem local ngx_lua_ffi_balancer_set_current_peer local ngx_lua_ffi_balancer_enable_keepalive local ngx_lua_ffi_balancer_set_more_tries local ngx_lua_ffi_balancer_get_last_failure local ngx_lua_ffi_balancer_set_timeouts -- used by both stream and http local ngx_lua_ffi_balancer_set_upstream_tls local ngx_lua_ffi_balancer_bind_to_local_addr if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_balancer_set_current_peer(ngx_http_request_t *r, const unsigned char *addr, size_t addr_len, int port, const unsigned char *host, ssize_t host_len, char **err); int ngx_http_lua_ffi_balancer_enable_keepalive(ngx_http_request_t *r, unsigned long timeout, unsigned int max_requests, char **err); int ngx_http_lua_ffi_balancer_set_more_tries(ngx_http_request_t *r, int count, char **err); int ngx_http_lua_ffi_balancer_get_last_failure(ngx_http_request_t *r, int *status, char **err); int ngx_http_lua_ffi_balancer_set_timeouts(ngx_http_request_t *r, long connect_timeout, long send_timeout, long read_timeout, char **err); int ngx_http_lua_ffi_balancer_recreate_request(ngx_http_request_t *r, char **err); int ngx_http_lua_ffi_balancer_set_upstream_tls(ngx_http_request_t *r, int on, char **err); int ngx_http_lua_ffi_balancer_bind_to_local_addr(ngx_http_request_t *r, const u_char *addr, size_t addr_len, u_char *errbuf, size_t *errbuf_size); ]] ngx_lua_ffi_balancer_set_current_peer = C.ngx_http_lua_ffi_balancer_set_current_peer ngx_lua_ffi_balancer_enable_keepalive = C.ngx_http_lua_ffi_balancer_enable_keepalive ngx_lua_ffi_balancer_set_more_tries = C.ngx_http_lua_ffi_balancer_set_more_tries ngx_lua_ffi_balancer_get_last_failure = C.ngx_http_lua_ffi_balancer_get_last_failure ngx_lua_ffi_balancer_set_timeouts = C.ngx_http_lua_ffi_balancer_set_timeouts ngx_lua_ffi_balancer_set_upstream_tls = C.ngx_http_lua_ffi_balancer_set_upstream_tls ngx_lua_ffi_balancer_bind_to_local_addr = C.ngx_http_lua_ffi_balancer_bind_to_local_addr elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_balancer_set_current_peer( ngx_stream_lua_request_t *r, const unsigned char *addr, size_t addr_len, int port, char **err); int ngx_stream_lua_ffi_balancer_set_more_tries(ngx_stream_lua_request_t *r, int count, char **err); int ngx_stream_lua_ffi_balancer_get_last_failure( ngx_stream_lua_request_t *r, int *status, char **err); int ngx_stream_lua_ffi_balancer_set_timeouts(ngx_stream_lua_request_t *r, long connect_timeout, long timeout, char **err); int ngx_stream_lua_ffi_balancer_bind_to_local_addr( ngx_stream_lua_request_t *r, const char *addr, size_t addr_len, char *errbuf, size_t *errbuf_size); ]] ngx_lua_ffi_balancer_set_current_peer = C.ngx_stream_lua_ffi_balancer_set_current_peer ngx_lua_ffi_balancer_set_more_tries = C.ngx_stream_lua_ffi_balancer_set_more_tries ngx_lua_ffi_balancer_get_last_failure = C.ngx_stream_lua_ffi_balancer_get_last_failure local ngx_stream_lua_ffi_balancer_set_timeouts = C.ngx_stream_lua_ffi_balancer_set_timeouts ngx_lua_ffi_balancer_set_timeouts = function(r, connect_timeout, send_timeout, read_timeout, err) local timeout = max(send_timeout, read_timeout) return ngx_stream_lua_ffi_balancer_set_timeouts(r, connect_timeout, timeout, err) end ngx_lua_ffi_balancer_bind_to_local_addr = C.ngx_stream_lua_ffi_balancer_bind_to_local_addr else error("unknown subsystem: " .. subsystem) end local DEFAULT_KEEPALIVE_IDLE_TIMEOUT = 60000 local DEFAULT_KEEPALIVE_MAX_REQUESTS = 100 local peer_state_names = { [1] = "keepalive", [2] = "next", [4] = "failed", } local _M = { version = base.version } if subsystem == "http" then function _M.set_current_peer(addr, port, host) local r = get_request() if not r then error("no request found") end if not port then port = 0 elseif type(port) ~= "number" then port = tonumber(port) end if host ~= nil and type(host) ~= "string" then error("bad argument #3 to 'set_current_peer' " .. "(string expected, got " .. type(host) .. ")") end local rc = ngx_lua_ffi_balancer_set_current_peer(r, addr, #addr, port, host, host and #host or 0, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end else function _M.set_current_peer(addr, port, host) local r = get_request() if not r then error("no request found") end if not port then port = 0 elseif type(port) ~= "number" then port = tonumber(port) end if host ~= nil then error("bad argument #3 to 'set_current_peer' ('host' not yet " .. "implemented in " .. subsystem .. " subsystem)", 2) end local rc = ngx_lua_ffi_balancer_set_current_peer(r, addr, #addr, port, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end end if subsystem == "http" then function _M.enable_keepalive(idle_timeout, max_requests) local r = get_request() if not r then error("no request found") end if not idle_timeout then idle_timeout = DEFAULT_KEEPALIVE_IDLE_TIMEOUT elseif type(idle_timeout) ~= "number" then error("bad argument #1 to 'enable_keepalive' " .. "(number expected, got " .. type(idle_timeout) .. ")", 2) elseif idle_timeout < 0 then error("bad argument #1 to 'enable_keepalive' (expected >= 0)", 2) else idle_timeout = idle_timeout * 1000 end if not max_requests then max_requests = DEFAULT_KEEPALIVE_MAX_REQUESTS elseif type(max_requests) ~= "number" then error("bad argument #2 to 'enable_keepalive' " .. "(number expected, got " .. type(max_requests) .. ")", 2) elseif max_requests < 0 then error("bad argument #2 to 'enable_keepalive' (expected >= 0)", 2) end local rc = ngx_lua_ffi_balancer_enable_keepalive(r, idle_timeout, max_requests, errmsg) if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end else function _M.enable_keepalive() error("'enable_keepalive' not yet implemented in " .. subsystem .. " subsystem", 2) end end function _M.set_more_tries(count) local r = get_request() if not r then error("no request found") end local rc = ngx_lua_ffi_balancer_set_more_tries(r, count, errmsg) if rc == FFI_OK then if errmsg[0] == nil then return true end return true, ffi_str(errmsg[0]) -- return the warning end return nil, ffi_str(errmsg[0]) end function _M.get_last_failure() local r = get_request() if not r then error("no request found") end local state = ngx_lua_ffi_balancer_get_last_failure(r, int_out, errmsg) if state == 0 then return nil end if state == FFI_ERROR then return nil, nil, ffi_str(errmsg[0]) end return peer_state_names[state] or "unknown", int_out[0] end function _M.set_timeouts(connect_timeout, send_timeout, read_timeout) local r = get_request() if not r then error("no request found") end if not connect_timeout then connect_timeout = 0 elseif type(connect_timeout) ~= "number" or connect_timeout <= 0 then error("bad connect timeout", 2) else connect_timeout = connect_timeout * 1000 end if not send_timeout then send_timeout = 0 elseif type(send_timeout) ~= "number" or send_timeout <= 0 then error("bad send timeout", 2) else send_timeout = send_timeout * 1000 end if not read_timeout then read_timeout = 0 elseif type(read_timeout) ~= "number" or read_timeout <= 0 then error("bad read timeout", 2) else read_timeout = read_timeout * 1000 end local rc rc = ngx_lua_ffi_balancer_set_timeouts(r, connect_timeout, send_timeout, read_timeout, errmsg) if rc == FFI_OK then return true end return false, ffi_str(errmsg[0]) end if subsystem == 'http' then function _M.recreate_request() local r = get_request() if not r then error("no request found") end local rc = C.ngx_http_lua_ffi_balancer_recreate_request(r, errmsg) if rc == FFI_OK then return true end if errmsg[0] ~= nil then return nil, ffi_str(errmsg[0]) end return nil, "failed to recreate the upstream request" end function _M.set_upstream_tls(on) local r = get_request() if not r then return error("no request found") end local rc if on == 0 or on == false then on = 0 else on = 1 end rc = ngx_lua_ffi_balancer_set_upstream_tls(r, on, errmsg); if rc == FFI_OK then return true end return nil, ffi_str(errmsg[0]) end end function _M.bind_to_local_addr(addr) local r = get_request() if not r then error("no request found") end if type(addr) ~= "string" then error("bad argument #1 to 'bind_to_local_addr' " .. "(string expected, got " .. type(addr) .. ")") end local errbuf_size = 1024 local errbuf = get_string_buf(errbuf_size) local sizep = get_size_ptr() sizep[0] = errbuf_size local rc = ngx_lua_ffi_balancer_bind_to_local_addr(r, addr, #addr, errbuf, sizep) if rc == FFI_OK then return true end return nil, ffi_str(errbuf, sizep[0]) end return _M PKMN]`M*ngx/base64.luanu[-- Copyright (C) by Yichun Zhang (agentzh) -- Copyright (C) by OpenResty Inc. local ffi = require("ffi") local base = require("resty.core.base") local ffi_str = ffi.string local type = type local C = ffi.C local NGX_ERROR = ngx.ERROR local _M = { version = base.version } ffi.cdef[[ typedef intptr_t ngx_int_t; void ngx_encode_base64url(ngx_str_t *dst, ngx_str_t *src); ngx_int_t ngx_decode_base64url(ngx_str_t *dst, ngx_str_t *src); ]] local get_string_buf = base.get_string_buf local dst_str_t = ffi.new("ngx_str_t[1]") local src_str_t = ffi.new("ngx_str_t[1]") local function base64_encoded_length(len) return ((len + 2) / 3) * 4 end local function base64_decoded_length(len) return ((len + 3) / 4) * 3 end function _M.encode_base64url(s) if type(s) ~= "string" then return nil, "must provide a string" end local len = #s local trans_len = base64_encoded_length(len) local src = src_str_t[0] local dst = dst_str_t[0] src.data = s src.len = len dst.data = get_string_buf(trans_len) dst.len = trans_len C.ngx_encode_base64url(dst_str_t, src_str_t) return ffi_str(dst.data, dst.len) end function _M.decode_base64url(s) if type(s) ~= "string" then return nil, "must provide a string" end local len = #s local trans_len = base64_decoded_length(len) local src = src_str_t[0] local dst = dst_str_t[0] src.data = s src.len = len dst.data = get_string_buf(trans_len) dst.len = trans_len local ret = C.ngx_decode_base64url(dst_str_t, src_str_t) if ret == NGX_ERROR then return nil, "invalid input" end return ffi_str(dst.data, dst.len) end return _M PKMN]F_::ngx/errlog.luanu[-- Copyright (C) Yichun Zhang (agentzh) local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require 'ffi' local ffi_string = ffi.string local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local C = ffi.C local new_tab = base.new_tab local ffi_new = ffi.new local charpp = ffi_new("char *[1]") local intp = ffi.new("int[1]") local num_value = ffi_new("double[1]") local get_request = base.get_request local tonumber = tonumber local type = type local error = error local subsystem = ngx.config.subsystem local ngx_lua_ffi_errlog_set_filter_level local ngx_lua_ffi_errlog_get_msg local ngx_lua_ffi_errlog_get_sys_filter_level local ngx_lua_ffi_raw_log local _M = { version = base.version } if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_errlog_set_filter_level(int level, unsigned char *err, size_t *errlen); int ngx_http_lua_ffi_errlog_get_msg(char **log, int *loglevel, unsigned char *err, size_t *errlen, double *log_time); int ngx_http_lua_ffi_errlog_get_sys_filter_level(ngx_http_request_t *r); int ngx_http_lua_ffi_raw_log(ngx_http_request_t *r, int level, const unsigned char *s, size_t s_len); ]] ngx_lua_ffi_errlog_set_filter_level = C.ngx_http_lua_ffi_errlog_set_filter_level ngx_lua_ffi_errlog_get_msg = C.ngx_http_lua_ffi_errlog_get_msg ngx_lua_ffi_errlog_get_sys_filter_level = C.ngx_http_lua_ffi_errlog_get_sys_filter_level ngx_lua_ffi_raw_log = C.ngx_http_lua_ffi_raw_log elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_errlog_set_filter_level(int level, unsigned char *err, size_t *errlen); int ngx_stream_lua_ffi_errlog_get_msg(char **log, int *loglevel, unsigned char *err, size_t *errlen, double *log_time); int ngx_stream_lua_ffi_errlog_get_sys_filter_level(ngx_stream_lua_request_t *r); int ngx_stream_lua_ffi_raw_log(ngx_stream_lua_request_t *r, int level, const unsigned char *s, size_t s_len); ]] ngx_lua_ffi_errlog_set_filter_level = C.ngx_stream_lua_ffi_errlog_set_filter_level ngx_lua_ffi_errlog_get_msg = C.ngx_stream_lua_ffi_errlog_get_msg ngx_lua_ffi_errlog_get_sys_filter_level = C.ngx_stream_lua_ffi_errlog_get_sys_filter_level ngx_lua_ffi_raw_log = C.ngx_stream_lua_ffi_raw_log end local ERR_BUF_SIZE = 128 local FFI_ERROR = base.FFI_ERROR function _M.set_filter_level(level) if not level then return nil, [[missing "level" argument]] end local err = get_string_buf(ERR_BUF_SIZE) local errlen = get_size_ptr() errlen[0] = ERR_BUF_SIZE local rc = ngx_lua_ffi_errlog_set_filter_level(level, err, errlen) if rc == FFI_ERROR then return nil, ffi_string(err, errlen[0]) end return true end function _M.get_logs(max, logs) local err = get_string_buf(ERR_BUF_SIZE) local errlen = get_size_ptr() errlen[0] = ERR_BUF_SIZE local log = charpp local loglevel = intp local log_time = num_value max = max or 10 if not logs then logs = new_tab(max * 3 + 1, 0) end local count = 0 for i = 1, max do local loglen = ngx_lua_ffi_errlog_get_msg(log, loglevel, err, errlen, log_time) if loglen == FFI_ERROR then return nil, ffi_string(err, errlen[0]) end if loglen > 0 then logs[count + 1] = loglevel[0] logs[count + 2] = log_time[0] logs[count + 3] = ffi_string(log[0], loglen) count = count + 3 end if loglen < 0 then -- no error log logs[count + 1] = nil break end if i == max then -- last one logs[count + 1] = nil break end end return logs end function _M.get_sys_filter_level() local r = get_request() return tonumber(ngx_lua_ffi_errlog_get_sys_filter_level(r)) end function _M.raw_log(level, msg) if type(level) ~= "number" then error("bad argument #1 to 'raw_log' (must be a number)", 2) end if type(msg) ~= "string" then error("bad argument #2 to 'raw_log' (must be a string)", 2) end local r = get_request() local rc = ngx_lua_ffi_raw_log(r, level, msg, #msg) if rc == FFI_ERROR then error("bad log level", 2) end end return _M PKNN] TT ngx/req.luanu[-- Copyright (C) by OpenResty Inc. local base = require "resty.core.base" base.allows_subsystem("http") local core_request = require "resty.core.request" local set_req_header = core_request.set_req_header local _M = { version = base.version } function _M.add_header(key, value) set_req_header(key, value, false) end return _M PKNN]11 ngx/re.luanu[-- I hereby assign copyright in this code to the lua-resty-core project, -- to be licensed under the same terms as the rest of the code. local base = require "resty.core.base" local ffi = require 'ffi' local bit = require "bit" local core_regex = require "resty.core.regex" if core_regex.no_pcre then error("no support for 'ngx.re' module: OpenResty was " .. "compiled without PCRE support", 3) end local C = ffi.C local ffi_str = ffi.string local sub = string.sub local error = error local type = type local band = bit.band local new_tab = base.new_tab local tostring = tostring local math_max = math.max local math_min = math.min local is_regex_cache_empty = core_regex.is_regex_cache_empty local re_match_compile = core_regex.re_match_compile local destroy_compiled_regex = core_regex.destroy_compiled_regex local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local FFI_OK = base.FFI_OK local subsystem = ngx.config.subsystem local MAX_ERR_MSG_LEN = 128 local FLAG_DFA = 0x02 local PCRE_ERROR_NOMATCH = -1 local DEFAULT_SPLIT_RES_SIZE = 4 local split_ctx = new_tab(0, 1) local ngx_lua_ffi_set_jit_stack_size local ngx_lua_ffi_exec_regex if subsystem == 'http' then ffi.cdef[[ int ngx_http_lua_ffi_set_jit_stack_size(int size, unsigned char *errstr, size_t *errstr_size); ]] ngx_lua_ffi_exec_regex = C.ngx_http_lua_ffi_exec_regex ngx_lua_ffi_set_jit_stack_size = C.ngx_http_lua_ffi_set_jit_stack_size elseif subsystem == 'stream' then ffi.cdef[[ int ngx_stream_lua_ffi_set_jit_stack_size(int size, unsigned char *errstr, size_t *errstr_size); ]] ngx_lua_ffi_exec_regex = C.ngx_stream_lua_ffi_exec_regex ngx_lua_ffi_set_jit_stack_size = C.ngx_stream_lua_ffi_set_jit_stack_size end local _M = { version = base.version } local function re_split_helper(subj, compiled, compile_once, flags, ctx) local rc do local pos = math_max(ctx.pos, 0) rc = ngx_lua_ffi_exec_regex(compiled, flags, subj, #subj, pos) end if rc == PCRE_ERROR_NOMATCH then return nil, nil, nil end if rc < 0 then if not compile_once then destroy_compiled_regex(compiled) end return nil, nil, nil, "pcre_exec() failed: " .. rc end if rc == 0 then if band(flags, FLAG_DFA) == 0 then if not compile_once then destroy_compiled_regex(compiled) end return nil, nil, nil, "capture size too small" end rc = 1 end local caps = compiled.captures local ncaps = compiled.ncaptures local from = caps[0] local to = caps[1] if from < 0 or to < 0 then return nil, nil, nil end if from == to then -- empty match, skip to next char ctx.pos = to + 1 else ctx.pos = to end -- convert to Lua string indexes from = from + 1 to = to + 1 -- retrieve the first sub-match capture if any if ncaps > 0 and rc > 1 then return from, to, sub(subj, caps[2] + 1, caps[3]) end return from, to end function _M.split(subj, regex, opts, ctx, max, res) -- we need to cast this to strings to avoid exceptions when they are -- something else. -- needed because of further calls to string.sub in this function. subj = tostring(subj) if not ctx then ctx = split_ctx ctx.pos = 1 -- set or reset upvalue field elseif not ctx.pos then -- ctx provided by user but missing pos field ctx.pos = 1 end max = max or 0 if not res then -- limit the initial arr_n size of res to a reasonable value -- 0 < narr <= DEFAULT_SPLIT_RES_SIZE local narr = DEFAULT_SPLIT_RES_SIZE if max > 0 then -- the user specified a valid max limiter if max > 0 narr = math_min(narr, max) end res = new_tab(narr, 0) elseif type(res) ~= "table" then error("res is not a table", 2) end local len = #subj if ctx.pos > len then res[1] = nil return res end -- compile regex local compiled, compile_once, flags = re_match_compile(regex, opts) if compiled == nil then -- compiled_once holds the error string return nil, compile_once end local sub_idx = ctx.pos local res_idx = 0 local last_empty_match -- update to split_helper PCRE indexes ctx.pos = sub_idx - 1 -- splitting: with and without a max limiter if max > 0 then local count = 1 while count < max do local from, to, capture, err = re_split_helper(subj, compiled, compile_once, flags, ctx) if err then return nil, err end if not from then break end if last_empty_match then sub_idx = last_empty_match end if from == to then last_empty_match = from end if from > sub_idx or not last_empty_match then count = count + 1 res_idx = res_idx + 1 res[res_idx] = sub(subj, sub_idx, from - 1) if capture then res_idx = res_idx + 1 res[res_idx] = capture end sub_idx = to if sub_idx > len then break end end end else while true do local from, to, capture, err = re_split_helper(subj, compiled, compile_once, flags, ctx) if err then return nil, err end if not from then break end if last_empty_match then sub_idx = last_empty_match end if from == to then last_empty_match = from end if from > sub_idx or not last_empty_match then res_idx = res_idx + 1 res[res_idx] = sub(subj, sub_idx, from - 1) if capture then res_idx = res_idx + 1 res[res_idx] = capture end sub_idx = to if sub_idx > len then break end end end end if not compile_once then destroy_compiled_regex(compiled) end -- trailing nil for non-cleared res tables -- delete empty trailing ones (without max) if max <= 0 and sub_idx > len then for ety_idx = res_idx, 1, -1 do if res[ety_idx] ~= "" then res_idx = ety_idx break end res[ety_idx] = nil end else res_idx = res_idx + 1 res[res_idx] = sub(subj, sub_idx) end res[res_idx + 1] = nil return res end function _M.opt(option, value) if option == "jit_stack_size" then if not is_regex_cache_empty() then error("changing jit stack size is not allowed when some " .. "regexs have already been compiled and cached", 2) end local errbuf = get_string_buf(MAX_ERR_MSG_LEN) local sizep = get_size_ptr() sizep[0] = MAX_ERR_MSG_LEN local rc = ngx_lua_ffi_set_jit_stack_size(value, errbuf, sizep) if rc == FFI_OK then return end error(ffi_str(errbuf, sizep[0]), 2) end error("unrecognized option name", 2) end return _M PKON]ebngx/semaphore.luanu[-- Copyright (C) Yichun Zhang (agentzh) -- Copyright (C) cuiweixie -- I hereby assign copyright in this code to the lua-resty-core project, -- to be licensed under the same terms as the rest of the code. local base = require "resty.core.base" base.allows_subsystem('http', 'stream') local ffi = require 'ffi' local FFI_OK = base.FFI_OK local FFI_ERROR = base.FFI_ERROR local FFI_DECLINED = base.FFI_DECLINED local ffi_new = ffi.new local ffi_str = ffi.string local ffi_gc = ffi.gc local C = ffi.C local type = type local error = error local tonumber = tonumber local get_request = base.get_request local get_string_buf = base.get_string_buf local get_size_ptr = base.get_size_ptr local setmetatable = setmetatable local co_yield = coroutine._yield local ERR_BUF_SIZE = 128 local subsystem = ngx.config.subsystem local errmsg = base.get_errmsg_ptr() local psem local ngx_lua_ffi_sema_new local ngx_lua_ffi_sema_post local ngx_lua_ffi_sema_count local ngx_lua_ffi_sema_wait local ngx_lua_ffi_sema_gc if subsystem == 'http' then ffi.cdef[[ struct ngx_http_lua_sema_s; typedef struct ngx_http_lua_sema_s ngx_http_lua_sema_t; int ngx_http_lua_ffi_sema_new(ngx_http_lua_sema_t **psem, int n, char **errmsg); int ngx_http_lua_ffi_sema_post(ngx_http_lua_sema_t *sem, int n); int ngx_http_lua_ffi_sema_count(ngx_http_lua_sema_t *sem); int ngx_http_lua_ffi_sema_wait(ngx_http_request_t *r, ngx_http_lua_sema_t *sem, int wait_ms, unsigned char *errstr, size_t *errlen); void ngx_http_lua_ffi_sema_gc(ngx_http_lua_sema_t *sem); ]] psem = ffi_new("ngx_http_lua_sema_t *[1]") ngx_lua_ffi_sema_new = C.ngx_http_lua_ffi_sema_new ngx_lua_ffi_sema_post = C.ngx_http_lua_ffi_sema_post ngx_lua_ffi_sema_count = C.ngx_http_lua_ffi_sema_count ngx_lua_ffi_sema_wait = C.ngx_http_lua_ffi_sema_wait ngx_lua_ffi_sema_gc = C.ngx_http_lua_ffi_sema_gc elseif subsystem == 'stream' then ffi.cdef[[ struct ngx_stream_lua_sema_s; typedef struct ngx_stream_lua_sema_s ngx_stream_lua_sema_t; int ngx_stream_lua_ffi_sema_new(ngx_stream_lua_sema_t **psem, int n, char **errmsg); int ngx_stream_lua_ffi_sema_post(ngx_stream_lua_sema_t *sem, int n); int ngx_stream_lua_ffi_sema_count(ngx_stream_lua_sema_t *sem); int ngx_stream_lua_ffi_sema_wait(ngx_stream_lua_request_t *r, ngx_stream_lua_sema_t *sem, int wait_ms, unsigned char *errstr, size_t *errlen); void ngx_stream_lua_ffi_sema_gc(ngx_stream_lua_sema_t *sem); ]] psem = ffi_new("ngx_stream_lua_sema_t *[1]") ngx_lua_ffi_sema_new = C.ngx_stream_lua_ffi_sema_new ngx_lua_ffi_sema_post = C.ngx_stream_lua_ffi_sema_post ngx_lua_ffi_sema_count = C.ngx_stream_lua_ffi_sema_count ngx_lua_ffi_sema_wait = C.ngx_stream_lua_ffi_sema_wait ngx_lua_ffi_sema_gc = C.ngx_stream_lua_ffi_sema_gc end local _M = { version = base.version } local mt = { __index = _M } function _M.new(n) n = tonumber(n) or 0 if n < 0 then error("no negative number", 2) end local ret = ngx_lua_ffi_sema_new(psem, n, errmsg) if ret == FFI_ERROR then return nil, ffi_str(errmsg[0]) end local sem = psem[0] ffi_gc(sem, ngx_lua_ffi_sema_gc) return setmetatable({ sem = sem }, mt) end function _M.wait(self, seconds) if type(self) ~= "table" or type(self.sem) ~= "cdata" then error("not a semaphore instance", 2) end local r = get_request() if not r then error("no request found") end local milliseconds = tonumber(seconds) * 1000 if milliseconds < 0 then error("no negative number", 2) end local cdata_sem = self.sem local err = get_string_buf(ERR_BUF_SIZE) local errlen = get_size_ptr() errlen[0] = ERR_BUF_SIZE local ret = ngx_lua_ffi_sema_wait(r, cdata_sem, milliseconds, err, errlen) if ret == FFI_ERROR then return nil, ffi_str(err, errlen[0]) end if ret == FFI_OK then return true end if ret == FFI_DECLINED then return nil, "timeout" end -- Note: we cannot use the tail-call form here since we -- might need the current function call's activation -- record to hold the reference to our semaphore object -- to prevent it from getting GC'd prematurely. local ok ok, err = co_yield() return ok, err end function _M.post(self, n) if type(self) ~= "table" or type(self.sem) ~= "cdata" then error("not a semaphore instance", 2) end local cdata_sem = self.sem local num = n and tonumber(n) or 1 if num < 1 then error("positive number required", 2) end -- always return NGX_OK ngx_lua_ffi_sema_post(cdata_sem, num) return true end function _M.count(self) if type(self) ~= "table" or type(self.sem) ~= "cdata" then error("not a semaphore instance", 2) end return ngx_lua_ffi_sema_count(self.sem) end return _M PKON]f@@librestysignal.sonuȯELF>@@8@         $$Ptd<<<QtdRtd  GNU1YXKQ*H BE|qX'!  , F"s  ( z  U __gmon_start___ITM_deregisterTMCloneTable_ITM_registerTMCloneTable__cxa_finalizeresty_signal_signumlibc.so.6_edata__bss_start_endGLIBC_2.2.5iui   @       HHI HtH5R %T @%R hH=I HB H9tH Ht H= H5 H)HHH?HHtH HtfD= u+UH= Ht H= Yd ]ww HHH ;t4T\zRx $8 FJ w?;*3$"D@ i    o(  x oooo  GA$3a1librestysignal.so-1.49.0-1.el8.x86_64.debug97zXZִF!t/ ]?Eh=ڊ2N`L Z(3W BDрԲ׭Z"N+COaNT;( (HOz_k[x$ (C&cp]*SL 7= A"!ז+w6-;k[h,#x)jUiֶQWCTW5y0JxVOPjK/9 Ev1GMGv>;SM毗t3!;Z+fAy$I(;adҗ_/ @/|ڰsCOs`I]:^,>»?Mb/nc",1MeYMszr\ʲpbc8!. Qg)'q|Z@Cw Q< ß6esݝ'ndĮ7?9t%W]^;@ۿT7r5 UN?HrAM8zlc>߻գ}+)gx%p+s*r6presty/core/var.luanu[PK;N]O> _/_/Nresty/core/request.luanu[PK;N]e&~resty/core/base.luanu[PK;N]զ@resty/core/base64.luanu[PK;N]=m  +resty/core/uri.luanu[PK;N]f@j@jresty/core/shdict.luanu[PK;N]o9 resty/core/exit.luanu[PK ))1resty/limit/traffic.luanu[PKAN]N\\/8resty/dns/resolver.luanu[PKAN]C6J(J(  resty/aes.luanu[PKAN]w&;";"resty/openssl/ssl.luanu[PKAN]ΏX<resty/openssl/hmac.luanu[PKAN]R3b``(resty/openssl/ctx.luanu[PKAN]eB||resty/openssl/pkey.luanu[PKAN]PP!kresty/openssl/auxiliary/ecdsa.luanu[PKAN]=  "bzresty/openssl/auxiliary/compat.luanu[PKAN]^66resty/openssl/auxiliary/jwk.luanu[PKAN]%@ |resty/openssl/mac.luanu[PKBN]ZUAresty/openssl/stack.luanu[PKBN]' resty/openssl/objects.luanu[PKBN]U  resty/openssl/err.luanu[PKBN]V  resty/openssl/rsa.luanu[PKBN]gW--# resty/openssl/kdf.luanu[PKCN]+P resty/openssl/crypto.luanu[PKCN]@f 0S resty/openssl/provider.luanu[PKCN]ȵIIAa resty/openssl/include/pem.luanu[PKCN]^dW i resty/openssl/include/ssl.luanu[PKCN]yu resty/openssl/include/hmac.luanu[PKCN]^~x resty/openssl/include/evp.luanu[PKCN]h5 resty/openssl/include/ecdsa.luanu[PKCN]Pu resty/openssl/include/conf.luanu[PKCN]*  resty/openssl/include/bn.luanu[PKDN]U$"ɚ resty/openssl/include/x509/csr.luanu[PKDN]<ւ& resty/openssl/include/x509/revoked.luanu[PKDN]"ԥ resty/openssl/include/x509/crl.luanu[PKDN]P))( resty/openssl/include/x509/extension.luanu[PKDN]U`kKK#i resty/openssl/include/x509/name.luanu[PKDN]Jx # resty/openssl/include/x509/init.luanu[PKDN]g& resty/openssl/include/x509/altname.luanu[PKDN]ύĐ c resty/openssl/include/pkcs12.luanu[PKDN]X\]] C resty/openssl/include/x509v3.luanu[PKDN] j resty/openssl/include/dh.luanu[PKDN]s(s("7 resty/openssl/include/evp/pkey.luanu[PKDN]?| | $ resty/openssl/include/evp/cipher.luanu[PKDN]! resty/openssl/include/evp/mac.luanu[PKDN]K2  resty/openssl/include/evp/md.luanu[PKDN],!$ resty/openssl/include/evp/kdf.luanu[PKDN]-*"  "< resty/openssl/include/ossl_typ.luanu[PKDN]|ddG resty/openssl/include/stack.luanu[PKDN]JL}}!6L resty/openssl/include/objects.luanu[PKEN]CO resty/openssl/include/err.luanu[PKEN]tUllbS resty/openssl/include/rsa.luanu[PKEN]%7_ W resty/openssl/include/crypto.luanu[PKFN]6p"@Y resty/openssl/include/provider.luanu[PKFN]*(EJJ"] resty/openssl/include/x509_vfy.luanu[PKFN]a=  Cp resty/openssl/include/rand.luanu[PKFN]ҁr resty/openssl/include/bio.luanu[PKFN]?t resty/openssl/include/ec.luanu[PKFN]\| resty/openssl/include/asn1.luanu[PKFN]Sl$b  resty/openssl/include/param.luanu[PKFN]]zWWđ resty/openssl/rand.luanu[PKGN]gdPqqa resty/openssl/ssl_ctx.luanu[PKGN]M** resty/openssl/ec.luanu[PKGN]~   resty/openssl/asn1.luanu[PKGN]y resty/openssl/ecx.luanu[PKHN]l3W G resty/openssl/digest.luanu[PKHN]f++B resty/openssl/param.luanu[PKHN]v v : resty/signal.luanu[PKHN]/t resty/sha256.luanu[PKHN]Xww resty/string.luanu[PKHN]@L7 webshield/sslutils.luanu[PKHN]B xSxS# lfs.sonuȯPKHN]%|#((v cjson.sonuȯPKHN] kDxx  openssl.sonuȯPKJN]Tki i tests/test_builtins.luanu[PKJN]3]n n ngx/ssl/session.luanu[PKJN]Bj̟oo2ngx/ssl/proxysslverify.luanu[PKJN]?IU$U$(ngx/ssl/clienthello.luanu[PKJN]}}}Mngx/ssl/proxysslcert.luanu[PKJN]}ߋ L^ngx/process.luanu[PKJN]HiڎVV Sjngx/ssl.luanu[PKJN]T)Qngx/proxyssl.luanu[PKJN]qLL 9ngx/pipe.luanu[PKJN]D) ngx/resp.luanu[PKJN]~::  ngx/ocsp.luanu[PKMN]܅,,+ngx/balancer.luanu[PKMN]`M*Xngx/base64.luanu[PKMN]F_::_ngx/errlog.luanu[PKNN] TT qngx/req.luanu[PKNN]11 rngx/re.luanu[PKON]ebngx/semaphore.luanu[PKON]f@@1librestysignal.sonuȯPK5