dlls/secur32/schannel_gnutls.c

   1 /*
   2  * GnuTLS-based implementation of the schannel (SSL/TLS) provider.
   3  *
   4  * Copyright 2005 Juan Lang
   5  * Copyright 2008 Henri Verbeet
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include "config.h"
  23 #include "wine/port.h"
  24
  25 #include <stdarg.h>
  26 #ifdef SONAME_LIBGNUTLS
  27 #include <gnutls/gnutls.h>
  28 #include <gnutls/crypto.h>
  29 #endif
  30
  31 #include "windef.h"
  32 #include "winbase.h"
  33 #include "sspi.h"
  34 #include "schannel.h"
  35 #include "secur32_priv.h"
  36 #include "wine/debug.h"
  37 #include "wine/library.h"
  38
  39 WINE_DEFAULT_DEBUG_CHANNEL(secur32);
  40
  41 #if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H)
  42
  43 static void *libgnutls_handle;
  44 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
  45 MAKE_FUNCPTR(gnutls_alert_get);
  46 MAKE_FUNCPTR(gnutls_alert_get_name);
  47 MAKE_FUNCPTR(gnutls_certificate_allocate_credentials);
  48 MAKE_FUNCPTR(gnutls_certificate_free_credentials);
  49 MAKE_FUNCPTR(gnutls_certificate_get_peers);
  50 MAKE_FUNCPTR(gnutls_cipher_get);
  51 MAKE_FUNCPTR(gnutls_cipher_get_key_size);
  52 MAKE_FUNCPTR(gnutls_credentials_set);
  53 MAKE_FUNCPTR(gnutls_deinit);
  54 MAKE_FUNCPTR(gnutls_global_deinit);
  55 MAKE_FUNCPTR(gnutls_global_init);
  56 MAKE_FUNCPTR(gnutls_global_set_log_function);
  57 MAKE_FUNCPTR(gnutls_global_set_log_level);
  58 MAKE_FUNCPTR(gnutls_handshake);
  59 MAKE_FUNCPTR(gnutls_init);
  60 MAKE_FUNCPTR(gnutls_kx_get);
  61 MAKE_FUNCPTR(gnutls_mac_get);
  62 MAKE_FUNCPTR(gnutls_mac_get_key_size);
  63 MAKE_FUNCPTR(gnutls_perror);
  64 MAKE_FUNCPTR(gnutls_protocol_get_version);
  65 MAKE_FUNCPTR(gnutls_priority_set_direct);
  66 MAKE_FUNCPTR(gnutls_record_get_max_size);
  67 MAKE_FUNCPTR(gnutls_record_recv);
  68 MAKE_FUNCPTR(gnutls_record_send);
  69 MAKE_FUNCPTR(gnutls_server_name_set);
  70 MAKE_FUNCPTR(gnutls_transport_get_ptr);
  71 MAKE_FUNCPTR(gnutls_transport_set_errno);
  72 MAKE_FUNCPTR(gnutls_transport_set_ptr);
  73 MAKE_FUNCPTR(gnutls_transport_set_pull_function);
  74 MAKE_FUNCPTR(gnutls_transport_set_push_function);
  75 #undef MAKE_FUNCPTR
  76
  77
  78
  79 static ssize_t schan_pull_adapter(gnutls_transport_ptr_t transport,
  80                                       void *buff, size_t buff_len)
  81 {
  82     struct schan_transport *t = (struct schan_transport*)transport;
  83     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
  84
  85     int ret = schan_pull(transport, buff, &buff_len);
  86     if (ret)
  87     {
  88         pgnutls_transport_set_errno(s, ret);
  89         return -1;
  90     }
  91
  92     return buff_len;
  93 }
  94
  95 static ssize_t schan_push_adapter(gnutls_transport_ptr_t transport,
  96                                       const void *buff, size_t buff_len)
  97 {
  98     struct schan_transport *t = (struct schan_transport*)transport;
  99     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
 100
 101     int ret = schan_push(transport, buff, &buff_len);
 102     if (ret)
 103     {
 104         pgnutls_transport_set_errno(s, ret);
 105         return -1;
 106     }
 107
 108     return buff_len;
 109 }
 110
 111 static const struct {
 112     DWORD enable_flag;
 113     const char *gnutls_flag;
 114 } protocol_priority_flags[] = {
 115     {SP_PROT_TLS1_2_CLIENT, "VERS-TLS1.2"},
 116     {SP_PROT_TLS1_1_CLIENT, "VERS-TLS1.1"},
 117     {SP_PROT_TLS1_0_CLIENT, "VERS-TLS1.0"},
 118     {SP_PROT_SSL3_CLIENT,   "VERS-SSL3.0"}
 119     /* {SP_PROT_SSL2_CLIENT} is not supported by GnuTLS */
 120 };
 121
 122 DWORD schan_imp_enabled_protocols(void)
 123 {
 124     /* NOTE: No support for SSL 2.0 */
 125     return SP_PROT_SSL3_CLIENT | SP_PROT_TLS1_0_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_2_CLIENT;
 126 }
 127
 128 BOOL schan_imp_create_session(schan_imp_session *session, schan_credentials *cred)
 129 {
 130     gnutls_session_t *s = (gnutls_session_t*)session;
 131     char priority[64] = "NORMAL", *p;
 132     unsigned i;
 133
 134     int err = pgnutls_init(s, cred->credential_use == SECPKG_CRED_INBOUND ? GNUTLS_SERVER : GNUTLS_CLIENT);
 135     if (err != GNUTLS_E_SUCCESS)
 136     {
 137         pgnutls_perror(err);
 138         return FALSE;
 139     }
 140
 141     p = priority + strlen(priority);
 142     for(i=0; i < sizeof(protocol_priority_flags)/sizeof(*protocol_priority_flags); i++) {
 143         *p++ = ':';
 144         *p++ = (cred->enabled_protocols & protocol_priority_flags[i].enable_flag) ? '+' : '-';
 145         strcpy(p, protocol_priority_flags[i].gnutls_flag);
 146         p += strlen(p);
 147     }
 148
 149     TRACE("Using %s priority\n", debugstr_a(priority));
 150     err = pgnutls_priority_set_direct(*s, priority, NULL);
 151     if (err != GNUTLS_E_SUCCESS)
 152     {
 153         pgnutls_perror(err);
 154         pgnutls_deinit(*s);
 155         return FALSE;
 156     }
 157
 158     err = pgnutls_credentials_set(*s, GNUTLS_CRD_CERTIFICATE,
 159                                   (gnutls_certificate_credentials_t)cred->credentials);
 160     if (err != GNUTLS_E_SUCCESS)
 161     {
 162         pgnutls_perror(err);
 163         pgnutls_deinit(*s);
 164         return FALSE;
 165     }
 166
 167     pgnutls_transport_set_pull_function(*s, schan_pull_adapter);
 168     pgnutls_transport_set_push_function(*s, schan_push_adapter);
 169
 170     return TRUE;
 171 }
 172
 173 void schan_imp_dispose_session(schan_imp_session session)
 174 {
 175     gnutls_session_t s = (gnutls_session_t)session;
 176     pgnutls_deinit(s);
 177 }
 178
 179 void schan_imp_set_session_transport(schan_imp_session session,
 180                                      struct schan_transport *t)
 181 {
 182     gnutls_session_t s = (gnutls_session_t)session;
 183     pgnutls_transport_set_ptr(s, (gnutls_transport_ptr_t)t);
 184 }
 185
 186 void schan_imp_set_session_target(schan_imp_session session, const char *target)
 187 {
 188     gnutls_session_t s = (gnutls_session_t)session;
 189
 190     pgnutls_server_name_set( s, GNUTLS_NAME_DNS, target, strlen(target) );
 191 }
 192
 193 SECURITY_STATUS schan_imp_handshake(schan_imp_session session)
 194 {
 195     gnutls_session_t s = (gnutls_session_t)session;
 196     int err = pgnutls_handshake(s);
 197     switch(err)
 198     {
 199         case GNUTLS_E_SUCCESS:
 200             TRACE("Handshake completed\n");
 201             return SEC_E_OK;
 202
 203         case GNUTLS_E_AGAIN:
 204             TRACE("Continue...\n");
 205             return SEC_I_CONTINUE_NEEDED;
 206
 207         case GNUTLS_E_WARNING_ALERT_RECEIVED:
 208         case GNUTLS_E_FATAL_ALERT_RECEIVED:
 209         {
 210             gnutls_alert_description_t alert = pgnutls_alert_get(s);
 211             const char *alert_name = pgnutls_alert_get_name(alert);
 212             WARN("ALERT: %d %s\n", alert, alert_name);
 213             return SEC_E_INTERNAL_ERROR;
 214         }
 215
 216         default:
 217             pgnutls_perror(err);
 218             return SEC_E_INTERNAL_ERROR;
 219     }
 220
 221     /* Never reached */
 222     return SEC_E_OK;
 223 }
 224
 225 static unsigned int schannel_get_cipher_block_size(gnutls_cipher_algorithm_t cipher)
 226 {
 227     const struct
 228     {
 229         gnutls_cipher_algorithm_t cipher;
 230         unsigned int block_size;
 231     }
 232     algorithms[] =
 233     {
 234         {GNUTLS_CIPHER_3DES_CBC, 8},
 235         {GNUTLS_CIPHER_AES_128_CBC, 16},
 236         {GNUTLS_CIPHER_AES_256_CBC, 16},
 237         {GNUTLS_CIPHER_ARCFOUR_128, 1},
 238         {GNUTLS_CIPHER_ARCFOUR_40, 1},
 239         {GNUTLS_CIPHER_DES_CBC, 8},
 240         {GNUTLS_CIPHER_NULL, 1},
 241         {GNUTLS_CIPHER_RC2_40_CBC, 8},
 242     };
 243     unsigned int i;
 244
 245     for (i = 0; i < sizeof(algorithms) / sizeof(*algorithms); ++i)
 246     {
 247         if (algorithms[i].cipher == cipher)
 248             return algorithms[i].block_size;
 249     }
 250
 251     FIXME("Unknown cipher %#x, returning 1\n", cipher);
 252
 253     return 1;
 254 }
 255
 256 static DWORD schannel_get_protocol(gnutls_protocol_t proto)
 257 {
 258     /* FIXME: currently schannel only implements client connections, but
 259      * there's no reason it couldn't be used for servers as well.  The
 260      * context doesn't tell us which it is, so assume client for now.
 261      */
 262     switch (proto)
 263     {
 264     case GNUTLS_SSL3: return SP_PROT_SSL3_CLIENT;
 265     case GNUTLS_TLS1_0: return SP_PROT_TLS1_0_CLIENT;
 266     case GNUTLS_TLS1_1: return SP_PROT_TLS1_1_CLIENT;
 267     case GNUTLS_TLS1_2: return SP_PROT_TLS1_2_CLIENT;
 268     default:
 269         FIXME("unknown protocol %d\n", proto);
 270         return 0;
 271     }
 272 }
 273
 274 static ALG_ID schannel_get_cipher_algid(gnutls_cipher_algorithm_t cipher)
 275 {
 276     switch (cipher)
 277     {
 278     case GNUTLS_CIPHER_UNKNOWN:
 279     case GNUTLS_CIPHER_NULL: return 0;
 280     case GNUTLS_CIPHER_ARCFOUR_40:
 281     case GNUTLS_CIPHER_ARCFOUR_128: return CALG_RC4;
 282     case GNUTLS_CIPHER_DES_CBC:
 283     case GNUTLS_CIPHER_3DES_CBC: return CALG_DES;
 284     case GNUTLS_CIPHER_AES_128_CBC:
 285     case GNUTLS_CIPHER_AES_256_CBC: return CALG_AES;
 286     case GNUTLS_CIPHER_RC2_40_CBC: return CALG_RC2;
 287     default:
 288         FIXME("unknown algorithm %d\n", cipher);
 289         return 0;
 290     }
 291 }
 292
 293 static ALG_ID schannel_get_mac_algid(gnutls_mac_algorithm_t mac)
 294 {
 295     switch (mac)
 296     {
 297     case GNUTLS_MAC_UNKNOWN:
 298     case GNUTLS_MAC_NULL: return 0;
 299     case GNUTLS_MAC_MD5: return CALG_MD5;
 300     case GNUTLS_MAC_SHA1:
 301     case GNUTLS_MAC_SHA256:
 302     case GNUTLS_MAC_SHA384:
 303     case GNUTLS_MAC_SHA512: return CALG_SHA;
 304     default:
 305         FIXME("unknown algorithm %d\n", mac);
 306         return 0;
 307     }
 308 }
 309
 310 static ALG_ID schannel_get_kx_algid(gnutls_kx_algorithm_t kx)
 311 {
 312     switch (kx)
 313     {
 314         case GNUTLS_KX_RSA: return CALG_RSA_KEYX;
 315         case GNUTLS_KX_DHE_DSS:
 316         case GNUTLS_KX_DHE_RSA: return CALG_DH_EPHEM;
 317     default:
 318         FIXME("unknown algorithm %d\n", kx);
 319         return 0;
 320     }
 321 }
 322
 323 unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session)
 324 {
 325     gnutls_session_t s = (gnutls_session_t)session;
 326     gnutls_cipher_algorithm_t cipher = pgnutls_cipher_get(s);
 327     return schannel_get_cipher_block_size(cipher);
 328 }
 329
 330 unsigned int schan_imp_get_max_message_size(schan_imp_session session)
 331 {
 332     return pgnutls_record_get_max_size((gnutls_session_t)session);
 333 }
 334
 335 SECURITY_STATUS schan_imp_get_connection_info(schan_imp_session session,
 336                                               SecPkgContext_ConnectionInfo *info)
 337 {
 338     gnutls_session_t s = (gnutls_session_t)session;
 339     gnutls_protocol_t proto = pgnutls_protocol_get_version(s);
 340     gnutls_cipher_algorithm_t alg = pgnutls_cipher_get(s);
 341     gnutls_mac_algorithm_t mac = pgnutls_mac_get(s);
 342     gnutls_kx_algorithm_t kx = pgnutls_kx_get(s);
 343
 344     info->dwProtocol = schannel_get_protocol(proto);
 345     info->aiCipher = schannel_get_cipher_algid(alg);
 346     info->dwCipherStrength = pgnutls_cipher_get_key_size(alg) * 8;
 347     info->aiHash = schannel_get_mac_algid(mac);
 348     info->dwHashStrength = pgnutls_mac_get_key_size(mac) * 8;
 349     info->aiExch = schannel_get_kx_algid(kx);
 350     /* FIXME: info->dwExchStrength? */
 351     info->dwExchStrength = 0;
 352     return SEC_E_OK;
 353 }
 354
 355 SECURITY_STATUS schan_imp_get_session_peer_certificate(schan_imp_session session, HCERTSTORE store,
 356                                                        PCCERT_CONTEXT *ret)
 357 {
 358     gnutls_session_t s = (gnutls_session_t)session;
 359     PCCERT_CONTEXT cert = NULL;
 360     const gnutls_datum_t *datum;
 361     unsigned list_size, i;
 362     BOOL res;
 363
 364     datum = pgnutls_certificate_get_peers(s, &list_size);
 365     if(!datum)
 366         return SEC_E_INTERNAL_ERROR;
 367
 368     for(i = 0; i < list_size; i++) {
 369         res = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, datum[i].data, datum[i].size,
 370                 CERT_STORE_ADD_REPLACE_EXISTING, i ? NULL : &cert);
 371         if(!res) {
 372             if(i)
 373                 CertFreeCertificateContext(cert);
 374             return GetLastError();
 375         }
 376     }
 377
 378     *ret = cert;
 379     return SEC_E_OK;
 380 }
 381
 382 SECURITY_STATUS schan_imp_send(schan_imp_session session, const void *buffer,
 383                                SIZE_T *length)
 384 {
 385     gnutls_session_t s = (gnutls_session_t)session;
 386     ssize_t ret;
 387
 388 again:
 389     ret = pgnutls_record_send(s, buffer, *length);
 390
 391     if (ret >= 0)
 392         *length = ret;
 393     else if (ret == GNUTLS_E_AGAIN)
 394     {
 395         struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s);
 396         SIZE_T count = 0;
 397
 398         if (schan_get_buffer(t, &t->out, &count))
 399             goto again;
 400
 401         return SEC_I_CONTINUE_NEEDED;
 402     }
 403     else
 404     {
 405         pgnutls_perror(ret);
 406         return SEC_E_INTERNAL_ERROR;
 407     }
 408
 409     return SEC_E_OK;
 410 }
 411
 412 SECURITY_STATUS schan_imp_recv(schan_imp_session session, void *buffer,
 413                                SIZE_T *length)
 414 {
 415     gnutls_session_t s = (gnutls_session_t)session;
 416     ssize_t ret;
 417
 418 again:
 419     ret = pgnutls_record_recv(s, buffer, *length);
 420
 421     if (ret >= 0)
 422         *length = ret;
 423     else if (ret == GNUTLS_E_AGAIN)
 424     {
 425         struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s);
 426         SIZE_T count = 0;
 427
 428         if (schan_get_buffer(t, &t->in, &count))
 429             goto again;
 430
 431         return SEC_I_CONTINUE_NEEDED;
 432     }
 433     else
 434     {
 435         pgnutls_perror(ret);
 436         return SEC_E_INTERNAL_ERROR;
 437     }
 438
 439     return SEC_E_OK;
 440 }
 441
 442 BOOL schan_imp_allocate_certificate_credentials(schan_credentials *c)
 443 {
 444     int ret = pgnutls_certificate_allocate_credentials((gnutls_certificate_credentials_t*)&c->credentials);
 445     if (ret != GNUTLS_E_SUCCESS)
 446         pgnutls_perror(ret);
 447     return (ret == GNUTLS_E_SUCCESS);
 448 }
 449
 450 void schan_imp_free_certificate_credentials(schan_credentials *c)
 451 {
 452     pgnutls_certificate_free_credentials(c->credentials);
 453 }
 454
 455 static void schan_gnutls_log(int level, const char *msg)
 456 {
 457     TRACE("<%d> %s", level, msg);
 458 }
 459
 460 BOOL schan_imp_init(void)
 461 {
 462     int ret;
 463
 464     libgnutls_handle = wine_dlopen(SONAME_LIBGNUTLS, RTLD_NOW, NULL, 0);
 465     if (!libgnutls_handle)
 466     {
 467         WARN("Failed to load libgnutls.\n");
 468         return FALSE;
 469     }
 470
 471 #define LOAD_FUNCPTR(f) \
 472     if (!(p##f = wine_dlsym(libgnutls_handle, #f, NULL, 0))) \
 473     { \
 474         ERR("Failed to load %s\n", #f); \
 475         goto fail; \
 476     }
 477
 478     LOAD_FUNCPTR(gnutls_alert_get)
 479     LOAD_FUNCPTR(gnutls_alert_get_name)
 480     LOAD_FUNCPTR(gnutls_certificate_allocate_credentials)
 481     LOAD_FUNCPTR(gnutls_certificate_free_credentials)
 482     LOAD_FUNCPTR(gnutls_certificate_get_peers)
 483     LOAD_FUNCPTR(gnutls_cipher_get)
 484     LOAD_FUNCPTR(gnutls_cipher_get_key_size)
 485     LOAD_FUNCPTR(gnutls_credentials_set)
 486     LOAD_FUNCPTR(gnutls_deinit)
 487     LOAD_FUNCPTR(gnutls_global_deinit)
 488     LOAD_FUNCPTR(gnutls_global_init)
 489     LOAD_FUNCPTR(gnutls_global_set_log_function)
 490     LOAD_FUNCPTR(gnutls_global_set_log_level)
 491     LOAD_FUNCPTR(gnutls_handshake)
 492     LOAD_FUNCPTR(gnutls_init)
 493     LOAD_FUNCPTR(gnutls_kx_get)
 494     LOAD_FUNCPTR(gnutls_mac_get)
 495     LOAD_FUNCPTR(gnutls_mac_get_key_size)
 496     LOAD_FUNCPTR(gnutls_perror)
 497     LOAD_FUNCPTR(gnutls_protocol_get_version)
 498     LOAD_FUNCPTR(gnutls_priority_set_direct)
 499     LOAD_FUNCPTR(gnutls_record_get_max_size);
 500     LOAD_FUNCPTR(gnutls_record_recv);
 501     LOAD_FUNCPTR(gnutls_record_send);
 502     LOAD_FUNCPTR(gnutls_server_name_set)
 503     LOAD_FUNCPTR(gnutls_transport_get_ptr)
 504     LOAD_FUNCPTR(gnutls_transport_set_errno)
 505     LOAD_FUNCPTR(gnutls_transport_set_ptr)
 506     LOAD_FUNCPTR(gnutls_transport_set_pull_function)
 507     LOAD_FUNCPTR(gnutls_transport_set_push_function)
 508 #undef LOAD_FUNCPTR
 509
 510     ret = pgnutls_global_init();
 511     if (ret != GNUTLS_E_SUCCESS)
 512     {
 513         pgnutls_perror(ret);
 514         goto fail;
 515     }
 516
 517     if (TRACE_ON(secur32))
 518     {
 519         pgnutls_global_set_log_level(4);
 520         pgnutls_global_set_log_function(schan_gnutls_log);
 521     }
 522
 523     return TRUE;
 524
 525 fail:
 526     wine_dlclose(libgnutls_handle, NULL, 0);
 527     libgnutls_handle = NULL;
 528     return FALSE;
 529 }
 530
 531 void schan_imp_deinit(void)
 532 {
 533     pgnutls_global_deinit();
 534     wine_dlclose(libgnutls_handle, NULL, 0);
 535     libgnutls_handle = NULL;
 536 }
 537
 538 #endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H */