darkenModule
Encrypted Lua script execution using AES-256-GCM.
This module provides functionality to decrypt and load or execute Lua scripts encrypted with AES-256 in GCM mode. Scripts are decrypted in-kernel and loaded immediately, with the decrypted plaintext never written to persistent storage.Functions
| load (ciphertext, iv, key) | Decrypts an encrypted Lua script and loads it without running it. |
| run (ciphertext, iv, key) | Decrypts and executes an encrypted Lua script: darken.load followed by a call of what it loads. |
Functions in detail
- load (ciphertext, iv, key)
-
Decrypts an encrypted Lua script and loads it without running it.
The ciphertext carries its 16-byte tag at the end and no associated data, and nothing is loaded
unless the tag matches. The decrypted script is Lua source or a chunk
lunaticcompiled, and the function it loads into has the runtime’s global environment. A script that calls the function as it returns it,return darken.load(...)(...), runs it as a tail call, at the depth of the script itself, where one that darken.run runs nests below a C call. It allocates a crypto transform, which may sleep: call it from a process runtime or from a script body, never from a softirq or hardirq callback.Parameters
- ciphertext string encrypted Lua script followed by its 16-byte tag (binary).
- iv string 12-byte initialization vector (binary).
- key string 32-byte AES-256 key (binary).
Returns
-
function
the loaded script.
Raises
“IV must be 12 bytes”, “key must be 32 bytes”, “not allowed once the runtime is armed” from an interrupt-context runtime past its body, “EBADMSG” when the tag does not match (a wrong key or IV, or a ciphertext altered or shorter than the tag), the errno name of a failed transform allocation, key setting or decryption, “not enough memory”, or the load error of the decrypted script. - run (ciphertext, iv, key)
-
Decrypts and executes an encrypted Lua script: darken.load followed by a call of what it loads.
Parameters
- ciphertext string encrypted Lua script followed by its 16-byte tag (binary).
- iv string 12-byte initialization vector (binary).
- key string 32-byte AES-256 key (binary).
Returns
-
The return values from the executed script.
Raises
what darken.load raises, or the error the script raises.