Add support for getting/setting GCM authentication tag (fixes #115)

doc/luaossl.tex

@@ -1485,6 +1485,14 @@ \section{Modules}
 
 Update the cipher with the specified string(s). Returns the final output string on success, or nil and an error message on failure. The returned string may be empty if all blocks have already been flushed in prior \fn{:update} calls.
 
+\subsubsection[\fn{cipher:get\_tag}]{\fn{cipher:get\_tag($len$)}}
+
+Returns the authentication tag for the ciphertext (GCM ciphers only) as a binary string. This method can only be called when encrypting data, and must be called after all data has been processed (i.e. after calling \fn{:final()}).
+
+\subsubsection[\fn{cipher:set\_tag}]{\fn{cipher:set\_tag($tag$)}}
+
+Sets the provided binary string as the expected authentication tag for the forthcoming ciphertext (GCM ciphers only). This method can only be called when decrypting data, and must be called before \fn{:final()} to ensure the ciphertext integrity can be verified successfully.
+
 \end{Module}
 
 

src/openssl.c

@@ -11975,6 +11975,47 @@ static int cipher_final(lua_State *L) {
 } /* cipher_final() */
 
 
+static int cipher_get_tag(lua_State *L) {
+	EVP_CIPHER_CTX *ctx = checksimple(L, 1, CIPHER_CLASS);
+	luaL_Buffer tag;
+	size_t tag_size = luaL_checkinteger(L, 2);
+
+	luaL_buffinit(L, &tag);
+
+	if(1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, tag_size, (void*)luaL_prepbuffsize(&tag, tag_size))) {
+		goto sslerr;
+	}
+
+	luaL_pushresultsize(&tag, tag_size);
+
+	return 1;
+
+sslerr:
+	lua_pushnil(L);
+	auxL_pusherror(L, auxL_EOPENSSL, NULL);
+
+	return 2;
+} /* cipher_get_tag() */
+
+static int cipher_set_tag(lua_State *L) {
+	EVP_CIPHER_CTX *ctx = checksimple(L, 1, CIPHER_CLASS);
+	size_t tag_size;
+	const char* tag = luaL_checklstring(L, 2, &tag_size);
+	if(1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, tag_size, (void*)tag)) {
+		goto sslerr;
+	}
+
+	lua_pushlstring(L, tag, tag_size);
+
+	return 1;
+
+sslerr:
+	lua_pushnil(L);
+	auxL_pusherror(L, auxL_EOPENSSL, NULL);
+
+	return 2;
+} /* cipher_get_tag() */
+
 static int cipher__gc(lua_State *L) {
 	EVP_CIPHER_CTX **ctx = luaL_checkudata(L, 1, CIPHER_CLASS);
 
@@ -11990,6 +12031,8 @@ static const auxL_Reg cipher_methods[] = {
 	{ "decrypt", &cipher_decrypt },
 	{ "update",  &cipher_update },
 	{ "final",   &cipher_final },
+	{ "get_tag", &cipher_get_tag },
+	{ "set_tag", &cipher_set_tag },
 	{ NULL,      NULL },
 };