dlls/secur32/schannel_gnutls.c

   1 /*
   2  * GnuTLS-based implementation of the schannel (SSL/TLS) provider.
   3  *
   4  * Copyright 2005 Juan Lang
   5  * Copyright 2008 Henri Verbeet
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include "config.h"
  23 #include "wine/port.h"
  24
  25 #include <stdarg.h>
  26 #ifdef SONAME_LIBGNUTLS
  27 #include <gnutls/gnutls.h>
  28 #include <gnutls/crypto.h>
  29 #endif
  30
  31 #include "windef.h"
  32 #include "winbase.h"
  33 #include "sspi.h"
  34 #include "schannel.h"
  35 #include "secur32_priv.h"
  36 #include "wine/debug.h"
  37 #include "wine/library.h"
  38
  39 #if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H)
  40
  41 WINE_DEFAULT_DEBUG_CHANNEL(secur32);
  42 WINE_DECLARE_DEBUG_CHANNEL(winediag);
  43
  44 /* Not present in gnutls version < 2.9.10. */
  45 static int (*pgnutls_cipher_get_block_size)(gnutls_cipher_algorithm_t algorithm);
  46
  47 static void *libgnutls_handle;
  48 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
  49 MAKE_FUNCPTR(gnutls_alert_get);
  50 MAKE_FUNCPTR(gnutls_alert_get_name);
  51 MAKE_FUNCPTR(gnutls_certificate_allocate_credentials);
  52 MAKE_FUNCPTR(gnutls_certificate_free_credentials);
  53 MAKE_FUNCPTR(gnutls_certificate_get_peers);
  54 MAKE_FUNCPTR(gnutls_cipher_get);
  55 MAKE_FUNCPTR(gnutls_cipher_get_key_size);
  56 MAKE_FUNCPTR(gnutls_credentials_set);
  57 MAKE_FUNCPTR(gnutls_deinit);
  58 MAKE_FUNCPTR(gnutls_global_deinit);
  59 MAKE_FUNCPTR(gnutls_global_init);
  60 MAKE_FUNCPTR(gnutls_global_set_log_function);
  61 MAKE_FUNCPTR(gnutls_global_set_log_level);
  62 MAKE_FUNCPTR(gnutls_handshake);
  63 MAKE_FUNCPTR(gnutls_init);
  64 MAKE_FUNCPTR(gnutls_kx_get);
  65 MAKE_FUNCPTR(gnutls_mac_get);
  66 MAKE_FUNCPTR(gnutls_mac_get_key_size);
  67 MAKE_FUNCPTR(gnutls_perror);
  68 MAKE_FUNCPTR(gnutls_protocol_get_version);
  69 MAKE_FUNCPTR(gnutls_priority_set_direct);
  70 MAKE_FUNCPTR(gnutls_record_get_max_size);
  71 MAKE_FUNCPTR(gnutls_record_recv);
  72 MAKE_FUNCPTR(gnutls_record_send);
  73 MAKE_FUNCPTR(gnutls_server_name_set);
  74 MAKE_FUNCPTR(gnutls_transport_get_ptr);
  75 MAKE_FUNCPTR(gnutls_transport_set_errno);
  76 MAKE_FUNCPTR(gnutls_transport_set_ptr);
  77 MAKE_FUNCPTR(gnutls_transport_set_pull_function);
  78 MAKE_FUNCPTR(gnutls_transport_set_push_function);
  79 #undef MAKE_FUNCPTR
  80
  81 #if GNUTLS_VERSION_MAJOR < 3
  82 #define GNUTLS_CIPHER_AES_192_CBC 92
  83 #define GNUTLS_CIPHER_AES_128_GCM 93
  84 #define GNUTLS_CIPHER_AES_256_GCM 94
  85
  86 #define GNUTLS_MAC_AEAD 200
  87
  88 #define GNUTLS_KX_ANON_ECDH     11
  89 #define GNUTLS_KX_ECDHE_RSA     12
  90 #define GNUTLS_KX_ECDHE_ECDSA   13
  91 #define GNUTLS_KX_ECDHE_PSK     14
  92 #endif
  93
  94 static int compat_cipher_get_block_size(gnutls_cipher_algorithm_t cipher)
  95 {
  96     switch(cipher) {
  97     case GNUTLS_CIPHER_3DES_CBC:
  98         return 8;
  99     case GNUTLS_CIPHER_AES_128_CBC:
 100     case GNUTLS_CIPHER_AES_256_CBC:
 101         return 16;
 102     case GNUTLS_CIPHER_ARCFOUR_128:
 103     case GNUTLS_CIPHER_ARCFOUR_40:
 104         return 1;
 105     case GNUTLS_CIPHER_DES_CBC:
 106         return 8;
 107     case GNUTLS_CIPHER_NULL:
 108         return 1;
 109     case GNUTLS_CIPHER_RC2_40_CBC:
 110         return 8;
 111     default:
 112         FIXME("Unknown cipher %#x, returning 1\n", cipher);
 113         return 1;
 114     }
 115 }
 116
 117 static ssize_t schan_pull_adapter(gnutls_transport_ptr_t transport,
 118                                       void *buff, size_t buff_len)
 119 {
 120     struct schan_transport *t = (struct schan_transport*)transport;
 121     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
 122
 123     int ret = schan_pull(transport, buff, &buff_len);
 124     if (ret)
 125     {
 126         pgnutls_transport_set_errno(s, ret);
 127         return -1;
 128     }
 129
 130     return buff_len;
 131 }
 132
 133 static ssize_t schan_push_adapter(gnutls_transport_ptr_t transport,
 134                                       const void *buff, size_t buff_len)
 135 {
 136     struct schan_transport *t = (struct schan_transport*)transport;
 137     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
 138
 139     int ret = schan_push(transport, buff, &buff_len);
 140     if (ret)
 141     {
 142         pgnutls_transport_set_errno(s, ret);
 143         return -1;
 144     }
 145
 146     return buff_len;
 147 }
 148
 149 static const struct {
 150     DWORD enable_flag;
 151     const char *gnutls_flag;
 152 } protocol_priority_flags[] = {
 153     {SP_PROT_TLS1_2_CLIENT, "VERS-TLS1.2"},
 154     {SP_PROT_TLS1_1_CLIENT, "VERS-TLS1.1"},
 155     {SP_PROT_TLS1_0_CLIENT, "VERS-TLS1.0"},
 156     {SP_PROT_SSL3_CLIENT,   "VERS-SSL3.0"}
 157     /* {SP_PROT_SSL2_CLIENT} is not supported by GnuTLS */
 158 };
 159
 160 DWORD schan_imp_enabled_protocols(void)
 161 {
 162     /* NOTE: No support for SSL 2.0 */
 163     return SP_PROT_SSL3_CLIENT | SP_PROT_TLS1_0_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_2_CLIENT;
 164 }
 165
 166 BOOL schan_imp_create_session(schan_imp_session *session, schan_credentials *cred)
 167 {
 168     gnutls_session_t *s = (gnutls_session_t*)session;
 169     char priority[128] = "NORMAL:%LATEST_RECORD_VERSION", *p;
 170     unsigned i;
 171
 172     int err = pgnutls_init(s, cred->credential_use == SECPKG_CRED_INBOUND ? GNUTLS_SERVER : GNUTLS_CLIENT);
 173     if (err != GNUTLS_E_SUCCESS)
 174     {
 175         pgnutls_perror(err);
 176         return FALSE;
 177     }
 178
 179     p = priority + strlen(priority);
 180     for(i=0; i < sizeof(protocol_priority_flags)/sizeof(*protocol_priority_flags); i++) {
 181         *p++ = ':';
 182         *p++ = (cred->enabled_protocols & protocol_priority_flags[i].enable_flag) ? '+' : '-';
 183         strcpy(p, protocol_priority_flags[i].gnutls_flag);
 184         p += strlen(p);
 185     }
 186
 187     TRACE("Using %s priority\n", debugstr_a(priority));
 188     err = pgnutls_priority_set_direct(*s, priority, NULL);
 189     if (err != GNUTLS_E_SUCCESS)
 190     {
 191         pgnutls_perror(err);
 192         pgnutls_deinit(*s);
 193         return FALSE;
 194     }
 195
 196     err = pgnutls_credentials_set(*s, GNUTLS_CRD_CERTIFICATE,
 197                                   (gnutls_certificate_credentials_t)cred->credentials);
 198     if (err != GNUTLS_E_SUCCESS)
 199     {
 200         pgnutls_perror(err);
 201         pgnutls_deinit(*s);
 202         return FALSE;
 203     }
 204
 205     pgnutls_transport_set_pull_function(*s, schan_pull_adapter);
 206     pgnutls_transport_set_push_function(*s, schan_push_adapter);
 207
 208     return TRUE;
 209 }
 210
 211 void schan_imp_dispose_session(schan_imp_session session)
 212 {
 213     gnutls_session_t s = (gnutls_session_t)session;
 214     pgnutls_deinit(s);
 215 }
 216
 217 void schan_imp_set_session_transport(schan_imp_session session,
 218                                      struct schan_transport *t)
 219 {
 220     gnutls_session_t s = (gnutls_session_t)session;
 221     pgnutls_transport_set_ptr(s, (gnutls_transport_ptr_t)t);
 222 }
 223
 224 void schan_imp_set_session_target(schan_imp_session session, const char *target)
 225 {
 226     gnutls_session_t s = (gnutls_session_t)session;
 227
 228     pgnutls_server_name_set( s, GNUTLS_NAME_DNS, target, strlen(target) );
 229 }
 230
 231 SECURITY_STATUS schan_imp_handshake(schan_imp_session session)
 232 {
 233     gnutls_session_t s = (gnutls_session_t)session;
 234     int err;
 235
 236     while(1) {
 237         err = pgnutls_handshake(s);
 238         switch(err) {
 239         case GNUTLS_E_SUCCESS:
 240             TRACE("Handshake completed\n");
 241             return SEC_E_OK;
 242
 243         case GNUTLS_E_AGAIN:
 244             TRACE("Continue...\n");
 245             return SEC_I_CONTINUE_NEEDED;
 246
 247         case GNUTLS_E_WARNING_ALERT_RECEIVED:
 248         {
 249             gnutls_alert_description_t alert = pgnutls_alert_get(s);
 250
 251             WARN("WARNING ALERT: %d %s\n", alert, pgnutls_alert_get_name(alert));
 252
 253             switch(alert) {
 254             case GNUTLS_A_UNRECOGNIZED_NAME:
 255                 TRACE("Ignoring\n");
 256                 continue;
 257             default:
 258                 return SEC_E_INTERNAL_ERROR;
 259             }
 260         }
 261
 262         case GNUTLS_E_FATAL_ALERT_RECEIVED:
 263         {
 264             gnutls_alert_description_t alert = pgnutls_alert_get(s);
 265             WARN("FATAL ALERT: %d %s\n", alert, pgnutls_alert_get_name(alert));
 266             return SEC_E_INTERNAL_ERROR;
 267         }
 268
 269         default:
 270             pgnutls_perror(err);
 271             return SEC_E_INTERNAL_ERROR;
 272         }
 273     }
 274
 275     /* Never reached */
 276     return SEC_E_OK;
 277 }
 278
 279 static DWORD schannel_get_protocol(gnutls_protocol_t proto)
 280 {
 281     /* FIXME: currently schannel only implements client connections, but
 282      * there's no reason it couldn't be used for servers as well.  The
 283      * context doesn't tell us which it is, so assume client for now.
 284      */
 285     switch (proto)
 286     {
 287     case GNUTLS_SSL3: return SP_PROT_SSL3_CLIENT;
 288     case GNUTLS_TLS1_0: return SP_PROT_TLS1_0_CLIENT;
 289     case GNUTLS_TLS1_1: return SP_PROT_TLS1_1_CLIENT;
 290     case GNUTLS_TLS1_2: return SP_PROT_TLS1_2_CLIENT;
 291     default:
 292         FIXME("unknown protocol %d\n", proto);
 293         return 0;
 294     }
 295 }
 296
 297 static ALG_ID schannel_get_cipher_algid(gnutls_cipher_algorithm_t cipher)
 298 {
 299     switch (cipher)
 300     {
 301     case GNUTLS_CIPHER_UNKNOWN:
 302     case GNUTLS_CIPHER_NULL: return 0;
 303     case GNUTLS_CIPHER_ARCFOUR_40:
 304     case GNUTLS_CIPHER_ARCFOUR_128: return CALG_RC4;
 305     case GNUTLS_CIPHER_DES_CBC: return CALG_DES;
 306     case GNUTLS_CIPHER_3DES_CBC: return CALG_3DES;
 307     case GNUTLS_CIPHER_AES_128_CBC:
 308     case GNUTLS_CIPHER_AES_128_GCM: return CALG_AES_128;
 309     case GNUTLS_CIPHER_AES_192_CBC: return CALG_AES_192;
 310     case GNUTLS_CIPHER_AES_256_GCM:
 311     case GNUTLS_CIPHER_AES_256_CBC: return CALG_AES_256;
 312     case GNUTLS_CIPHER_RC2_40_CBC: return CALG_RC2;
 313     default:
 314         FIXME("unknown algorithm %d\n", cipher);
 315         return 0;
 316     }
 317 }
 318
 319 static ALG_ID schannel_get_mac_algid(gnutls_mac_algorithm_t mac, gnutls_cipher_algorithm_t cipher)
 320 {
 321     switch (mac)
 322     {
 323     case GNUTLS_MAC_UNKNOWN:
 324     case GNUTLS_MAC_NULL: return 0;
 325     case GNUTLS_MAC_MD2: return CALG_MD2;
 326     case GNUTLS_MAC_MD5: return CALG_MD5;
 327     case GNUTLS_MAC_SHA1: return CALG_SHA1;
 328     case GNUTLS_MAC_SHA256: return CALG_SHA_256;
 329     case GNUTLS_MAC_SHA384: return CALG_SHA_384;
 330     case GNUTLS_MAC_SHA512: return CALG_SHA_512;
 331     case GNUTLS_MAC_AEAD:
 332         /* When using AEAD (such as GCM), we return PRF algorithm instead
 333            which is defined in RFC 5289. */
 334         switch (cipher)
 335         {
 336         case GNUTLS_CIPHER_AES_128_GCM: return CALG_SHA_256;
 337         case GNUTLS_CIPHER_AES_256_GCM: return CALG_SHA_384;
 338         default:
 339             break;
 340         }
 341         /* fall through */
 342     default:
 343         FIXME("unknown algorithm %d, cipher %d\n", mac, cipher);
 344         return 0;
 345     }
 346 }
 347
 348 static ALG_ID schannel_get_kx_algid(int kx)
 349 {
 350     switch (kx)
 351     {
 352     case GNUTLS_KX_UNKNOWN: return 0;
 353     case GNUTLS_KX_RSA:
 354     case GNUTLS_KX_RSA_EXPORT: return CALG_RSA_KEYX;
 355     case GNUTLS_KX_DHE_PSK:
 356     case GNUTLS_KX_DHE_DSS:
 357     case GNUTLS_KX_DHE_RSA: return CALG_DH_EPHEM;
 358     case GNUTLS_KX_ANON_ECDH: return CALG_ECDH;
 359     case GNUTLS_KX_ECDHE_RSA:
 360     case GNUTLS_KX_ECDHE_PSK:
 361     case GNUTLS_KX_ECDHE_ECDSA: return CALG_ECDH_EPHEM;
 362     default:
 363         FIXME("unknown algorithm %d\n", kx);
 364         return 0;
 365     }
 366 }
 367
 368 unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session)
 369 {
 370     gnutls_session_t s = (gnutls_session_t)session;
 371     return pgnutls_cipher_get_block_size(pgnutls_cipher_get(s));
 372 }
 373
 374 unsigned int schan_imp_get_max_message_size(schan_imp_session session)
 375 {
 376     return pgnutls_record_get_max_size((gnutls_session_t)session);
 377 }
 378
 379 SECURITY_STATUS schan_imp_get_connection_info(schan_imp_session session,
 380                                               SecPkgContext_ConnectionInfo *info)
 381 {
 382     gnutls_session_t s = (gnutls_session_t)session;
 383     gnutls_protocol_t proto = pgnutls_protocol_get_version(s);
 384     gnutls_cipher_algorithm_t alg = pgnutls_cipher_get(s);
 385     gnutls_mac_algorithm_t mac = pgnutls_mac_get(s);
 386     gnutls_kx_algorithm_t kx = pgnutls_kx_get(s);
 387
 388     info->dwProtocol = schannel_get_protocol(proto);
 389     info->aiCipher = schannel_get_cipher_algid(alg);
 390     info->dwCipherStrength = pgnutls_cipher_get_key_size(alg) * 8;
 391     info->aiHash = schannel_get_mac_algid(mac, alg);
 392     info->dwHashStrength = pgnutls_mac_get_key_size(mac) * 8;
 393     info->aiExch = schannel_get_kx_algid(kx);
 394     /* FIXME: info->dwExchStrength? */
 395     info->dwExchStrength = 0;
 396     return SEC_E_OK;
 397 }
 398
 399 ALG_ID schan_imp_get_key_signature_algorithm(schan_imp_session session)
 400 {
 401     gnutls_session_t s = (gnutls_session_t)session;
 402     gnutls_kx_algorithm_t kx = pgnutls_kx_get(s);
 403
 404     TRACE("(%p)\n", session);
 405
 406     switch (kx)
 407     {
 408     case GNUTLS_KX_UNKNOWN: return 0;
 409     case GNUTLS_KX_RSA:
 410     case GNUTLS_KX_RSA_EXPORT:
 411     case GNUTLS_KX_DHE_RSA:
 412     case GNUTLS_KX_ECDHE_RSA: return CALG_RSA_SIGN;
 413     case GNUTLS_KX_ECDHE_ECDSA: return CALG_ECDSA;
 414     default:
 415         FIXME("unknown algorithm %d\n", kx);
 416         return 0;
 417     }
 418 }
 419
 420 SECURITY_STATUS schan_imp_get_session_peer_certificate(schan_imp_session session, HCERTSTORE store,
 421                                                        PCCERT_CONTEXT *ret)
 422 {
 423     gnutls_session_t s = (gnutls_session_t)session;
 424     PCCERT_CONTEXT cert = NULL;
 425     const gnutls_datum_t *datum;
 426     unsigned list_size, i;
 427     BOOL res;
 428
 429     datum = pgnutls_certificate_get_peers(s, &list_size);
 430     if(!datum)
 431         return SEC_E_INTERNAL_ERROR;
 432
 433     for(i = 0; i < list_size; i++) {
 434         res = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, datum[i].data, datum[i].size,
 435                 CERT_STORE_ADD_REPLACE_EXISTING, i ? NULL : &cert);
 436         if(!res) {
 437             if(i)
 438                 CertFreeCertificateContext(cert);
 439             return GetLastError();
 440         }
 441     }
 442
 443     *ret = cert;
 444     return SEC_E_OK;
 445 }
 446
 447 SECURITY_STATUS schan_imp_send(schan_imp_session session, const void *buffer,
 448                                SIZE_T *length)
 449 {
 450     gnutls_session_t s = (gnutls_session_t)session;
 451     SSIZE_T ret, total = 0;
 452
 453     for (;;)
 454     {
 455         ret = pgnutls_record_send(s, (const char *)buffer + total, *length - total);
 456         if (ret >= 0)
 457         {
 458             total += ret;
 459             TRACE( "sent %ld now %ld/%ld\n", ret, total, *length );
 460             if (total == *length) return SEC_E_OK;
 461         }
 462         else if (ret == GNUTLS_E_AGAIN)
 463         {
 464             struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s);
 465             SIZE_T count = 0;
 466
 467             if (schan_get_buffer(t, &t->out, &count)) continue;
 468             return SEC_I_CONTINUE_NEEDED;
 469         }
 470         else
 471         {
 472             pgnutls_perror(ret);
 473             return SEC_E_INTERNAL_ERROR;
 474         }
 475     }
 476 }
 477
 478 SECURITY_STATUS schan_imp_recv(schan_imp_session session, void *buffer,
 479                                SIZE_T *length)
 480 {
 481     gnutls_session_t s = (gnutls_session_t)session;
 482     ssize_t ret;
 483
 484 again:
 485     ret = pgnutls_record_recv(s, buffer, *length);
 486
 487     if (ret >= 0)
 488         *length = ret;
 489     else if (ret == GNUTLS_E_AGAIN)
 490     {
 491         struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s);
 492         SIZE_T count = 0;
 493
 494         if (schan_get_buffer(t, &t->in, &count))
 495             goto again;
 496
 497         return SEC_I_CONTINUE_NEEDED;
 498     }
 499     else
 500     {
 501         pgnutls_perror(ret);
 502         return SEC_E_INTERNAL_ERROR;
 503     }
 504
 505     return SEC_E_OK;
 506 }
 507
 508 BOOL schan_imp_allocate_certificate_credentials(schan_credentials *c)
 509 {
 510     int ret = pgnutls_certificate_allocate_credentials((gnutls_certificate_credentials_t*)&c->credentials);
 511     if (ret != GNUTLS_E_SUCCESS)
 512         pgnutls_perror(ret);
 513     return (ret == GNUTLS_E_SUCCESS);
 514 }
 515
 516 void schan_imp_free_certificate_credentials(schan_credentials *c)
 517 {
 518     pgnutls_certificate_free_credentials(c->credentials);
 519 }
 520
 521 static void schan_gnutls_log(int level, const char *msg)
 522 {
 523     TRACE("<%d> %s", level, msg);
 524 }
 525
 526 BOOL schan_imp_init(void)
 527 {
 528     int ret;
 529
 530     libgnutls_handle = wine_dlopen(SONAME_LIBGNUTLS, RTLD_NOW, NULL, 0);
 531     if (!libgnutls_handle)
 532     {
 533         ERR_(winediag)("Failed to load libgnutls, secure connections will not be available.\n");
 534         return FALSE;
 535     }
 536
 537 #define LOAD_FUNCPTR(f) \
 538     if (!(p##f = wine_dlsym(libgnutls_handle, #f, NULL, 0))) \
 539     { \
 540         ERR("Failed to load %s\n", #f); \
 541         goto fail; \
 542     }
 543
 544     LOAD_FUNCPTR(gnutls_alert_get)
 545     LOAD_FUNCPTR(gnutls_alert_get_name)
 546     LOAD_FUNCPTR(gnutls_certificate_allocate_credentials)
 547     LOAD_FUNCPTR(gnutls_certificate_free_credentials)
 548     LOAD_FUNCPTR(gnutls_certificate_get_peers)
 549     LOAD_FUNCPTR(gnutls_cipher_get)
 550     LOAD_FUNCPTR(gnutls_cipher_get_key_size)
 551     LOAD_FUNCPTR(gnutls_credentials_set)
 552     LOAD_FUNCPTR(gnutls_deinit)
 553     LOAD_FUNCPTR(gnutls_global_deinit)
 554     LOAD_FUNCPTR(gnutls_global_init)
 555     LOAD_FUNCPTR(gnutls_global_set_log_function)
 556     LOAD_FUNCPTR(gnutls_global_set_log_level)
 557     LOAD_FUNCPTR(gnutls_handshake)
 558     LOAD_FUNCPTR(gnutls_init)
 559     LOAD_FUNCPTR(gnutls_kx_get)
 560     LOAD_FUNCPTR(gnutls_mac_get)
 561     LOAD_FUNCPTR(gnutls_mac_get_key_size)
 562     LOAD_FUNCPTR(gnutls_perror)
 563     LOAD_FUNCPTR(gnutls_protocol_get_version)
 564     LOAD_FUNCPTR(gnutls_priority_set_direct)
 565     LOAD_FUNCPTR(gnutls_record_get_max_size);
 566     LOAD_FUNCPTR(gnutls_record_recv);
 567     LOAD_FUNCPTR(gnutls_record_send);
 568     LOAD_FUNCPTR(gnutls_server_name_set)
 569     LOAD_FUNCPTR(gnutls_transport_get_ptr)
 570     LOAD_FUNCPTR(gnutls_transport_set_errno)
 571     LOAD_FUNCPTR(gnutls_transport_set_ptr)
 572     LOAD_FUNCPTR(gnutls_transport_set_pull_function)
 573     LOAD_FUNCPTR(gnutls_transport_set_push_function)
 574 #undef LOAD_FUNCPTR
 575
 576     if (!(pgnutls_cipher_get_block_size = wine_dlsym(libgnutls_handle, "gnutls_cipher_get_block_size", NULL, 0)))
 577     {
 578         WARN("gnutls_cipher_get_block_size not found\n");
 579         pgnutls_cipher_get_block_size = compat_cipher_get_block_size;
 580     }
 581
 582     ret = pgnutls_global_init();
 583     if (ret != GNUTLS_E_SUCCESS)
 584     {
 585         pgnutls_perror(ret);
 586         goto fail;
 587     }
 588
 589     if (TRACE_ON(secur32))
 590     {
 591         pgnutls_global_set_log_level(4);
 592         pgnutls_global_set_log_function(schan_gnutls_log);
 593     }
 594
 595     return TRUE;
 596
 597 fail:
 598     wine_dlclose(libgnutls_handle, NULL, 0);
 599     libgnutls_handle = NULL;
 600     return FALSE;
 601 }
 602
 603 void schan_imp_deinit(void)
 604 {
 605     pgnutls_global_deinit();
 606     wine_dlclose(libgnutls_handle, NULL, 0);
 607     libgnutls_handle = NULL;
 608 }
 609
 610 #endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H */