dlls/secur32/schannel_gnutls.c

   1 /*
   2  * GnuTLS-based implementation of the schannel (SSL/TLS) provider.
   3  *
   4  * Copyright 2005 Juan Lang
   5  * Copyright 2008 Henri Verbeet
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include "config.h"
  23 #include "wine/port.h"
  24
  25 #include <stdarg.h>
  26 #ifdef SONAME_LIBGNUTLS
  27 #include <gnutls/gnutls.h>
  28 #endif
  29
  30 #include "windef.h"
  31 #include "winbase.h"
  32 #include "sspi.h"
  33 #include "schannel.h"
  34 #include "secur32_priv.h"
  35 #include "wine/debug.h"
  36 #include "wine/library.h"
  37
  38 WINE_DEFAULT_DEBUG_CHANNEL(secur32);
  39
  40 #if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H)
  41
  42 static void *libgnutls_handle;
  43 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
  44 MAKE_FUNCPTR(gnutls_alert_get);
  45 MAKE_FUNCPTR(gnutls_alert_get_name);
  46 MAKE_FUNCPTR(gnutls_certificate_allocate_credentials);
  47 MAKE_FUNCPTR(gnutls_certificate_free_credentials);
  48 MAKE_FUNCPTR(gnutls_certificate_get_peers);
  49 MAKE_FUNCPTR(gnutls_cipher_get);
  50 MAKE_FUNCPTR(gnutls_cipher_get_key_size);
  51 MAKE_FUNCPTR(gnutls_credentials_set);
  52 MAKE_FUNCPTR(gnutls_deinit);
  53 MAKE_FUNCPTR(gnutls_global_deinit);
  54 MAKE_FUNCPTR(gnutls_global_init);
  55 MAKE_FUNCPTR(gnutls_global_set_log_function);
  56 MAKE_FUNCPTR(gnutls_global_set_log_level);
  57 MAKE_FUNCPTR(gnutls_handshake);
  58 MAKE_FUNCPTR(gnutls_init);
  59 MAKE_FUNCPTR(gnutls_kx_get);
  60 MAKE_FUNCPTR(gnutls_mac_get);
  61 MAKE_FUNCPTR(gnutls_mac_get_key_size);
  62 MAKE_FUNCPTR(gnutls_perror);
  63 MAKE_FUNCPTR(gnutls_protocol_get_version);
  64 MAKE_FUNCPTR(gnutls_set_default_priority);
  65 MAKE_FUNCPTR(gnutls_record_recv);
  66 MAKE_FUNCPTR(gnutls_record_send);
  67 MAKE_FUNCPTR(gnutls_transport_set_errno);
  68 MAKE_FUNCPTR(gnutls_transport_set_ptr);
  69 MAKE_FUNCPTR(gnutls_transport_set_pull_function);
  70 MAKE_FUNCPTR(gnutls_transport_set_push_function);
  71 #undef MAKE_FUNCPTR
  72
  73
  74
  75 static ssize_t schan_pull_adapter(gnutls_transport_ptr_t transport,
  76                                       void *buff, size_t buff_len)
  77 {
  78     struct schan_transport *t = (struct schan_transport*)transport;
  79     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
  80
  81     int ret = schan_pull(transport, buff, &buff_len);
  82     if (ret)
  83     {
  84         pgnutls_transport_set_errno(s, ret);
  85         return -1;
  86     }
  87
  88     return buff_len;
  89 }
  90
  91 static ssize_t schan_push_adapter(gnutls_transport_ptr_t transport,
  92                                       const void *buff, size_t buff_len)
  93 {
  94     struct schan_transport *t = (struct schan_transport*)transport;
  95     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
  96
  97     int ret = schan_push(transport, buff, &buff_len);
  98     if (ret)
  99     {
 100         pgnutls_transport_set_errno(s, ret);
 101         return -1;
 102     }
 103
 104     return buff_len;
 105 }
 106
 107 BOOL schan_imp_create_session(schan_imp_session *session, BOOL is_server,
 108                               schan_imp_certificate_credentials cred)
 109 {
 110     gnutls_session_t *s = (gnutls_session_t*)session;
 111
 112     int err = pgnutls_init(s, is_server ? GNUTLS_SERVER : GNUTLS_CLIENT);
 113     if (err != GNUTLS_E_SUCCESS)
 114     {
 115         pgnutls_perror(err);
 116         return FALSE;
 117     }
 118
 119     /* FIXME: We should be using the information from the credentials here. */
 120     FIXME("Using hardcoded \"NORMAL\" priority\n");
 121     err = pgnutls_set_default_priority(*s);
 122     if (err != GNUTLS_E_SUCCESS)
 123     {
 124         pgnutls_perror(err);
 125         pgnutls_deinit(*s);
 126         return FALSE;
 127     }
 128
 129     err = pgnutls_credentials_set(*s, GNUTLS_CRD_CERTIFICATE,
 130                                   (gnutls_certificate_credentials)cred);
 131     if (err != GNUTLS_E_SUCCESS)
 132     {
 133         pgnutls_perror(err);
 134         pgnutls_deinit(*s);
 135         return FALSE;
 136     }
 137
 138     pgnutls_transport_set_pull_function(*s, schan_pull_adapter);
 139     pgnutls_transport_set_push_function(*s, schan_push_adapter);
 140
 141     return TRUE;
 142 }
 143
 144 void schan_imp_dispose_session(schan_imp_session session)
 145 {
 146     gnutls_session_t s = (gnutls_session_t)session;
 147     pgnutls_deinit(s);
 148 }
 149
 150 void schan_imp_set_session_transport(schan_imp_session session,
 151                                      struct schan_transport *t)
 152 {
 153     gnutls_session_t s = (gnutls_session_t)session;
 154     pgnutls_transport_set_ptr(s, (gnutls_transport_ptr_t)t);
 155 }
 156
 157 SECURITY_STATUS schan_imp_handshake(schan_imp_session session)
 158 {
 159     gnutls_session_t s = (gnutls_session_t)session;
 160     int err = pgnutls_handshake(s);
 161     switch(err)
 162     {
 163         case GNUTLS_E_SUCCESS:
 164             TRACE("Handshake completed\n");
 165             return SEC_E_OK;
 166
 167         case GNUTLS_E_AGAIN:
 168             TRACE("Continue...\n");
 169             return SEC_I_CONTINUE_NEEDED;
 170
 171         case GNUTLS_E_WARNING_ALERT_RECEIVED:
 172         case GNUTLS_E_FATAL_ALERT_RECEIVED:
 173         {
 174             gnutls_alert_description_t alert = pgnutls_alert_get(s);
 175             const char *alert_name = pgnutls_alert_get_name(alert);
 176             WARN("ALERT: %d %s\n", alert, alert_name);
 177             return SEC_E_INTERNAL_ERROR;
 178         }
 179
 180         default:
 181             pgnutls_perror(err);
 182             return SEC_E_INTERNAL_ERROR;
 183     }
 184
 185     /* Never reached */
 186     return SEC_E_OK;
 187 }
 188
 189 static unsigned int schannel_get_cipher_block_size(gnutls_cipher_algorithm_t cipher)
 190 {
 191     const struct
 192     {
 193         gnutls_cipher_algorithm_t cipher;
 194         unsigned int block_size;
 195     }
 196     algorithms[] =
 197     {
 198         {GNUTLS_CIPHER_3DES_CBC, 8},
 199         {GNUTLS_CIPHER_AES_128_CBC, 16},
 200         {GNUTLS_CIPHER_AES_256_CBC, 16},
 201         {GNUTLS_CIPHER_ARCFOUR_128, 1},
 202         {GNUTLS_CIPHER_ARCFOUR_40, 1},
 203         {GNUTLS_CIPHER_DES_CBC, 8},
 204         {GNUTLS_CIPHER_NULL, 1},
 205         {GNUTLS_CIPHER_RC2_40_CBC, 8},
 206     };
 207     unsigned int i;
 208
 209     for (i = 0; i < sizeof(algorithms) / sizeof(*algorithms); ++i)
 210     {
 211         if (algorithms[i].cipher == cipher)
 212             return algorithms[i].block_size;
 213     }
 214
 215     FIXME("Unknown cipher %#x, returning 1\n", cipher);
 216
 217     return 1;
 218 }
 219
 220 static DWORD schannel_get_protocol(gnutls_protocol_t proto)
 221 {
 222     /* FIXME: currently schannel only implements client connections, but
 223      * there's no reason it couldn't be used for servers as well.  The
 224      * context doesn't tell us which it is, so assume client for now.
 225      */
 226     switch (proto)
 227     {
 228     case GNUTLS_SSL3: return SP_PROT_SSL3_CLIENT;
 229     case GNUTLS_TLS1_0: return SP_PROT_TLS1_CLIENT;
 230     default:
 231         FIXME("unknown protocol %d\n", proto);
 232         return 0;
 233     }
 234 }
 235
 236 static ALG_ID schannel_get_cipher_algid(gnutls_cipher_algorithm_t cipher)
 237 {
 238     switch (cipher)
 239     {
 240     case GNUTLS_CIPHER_UNKNOWN:
 241     case GNUTLS_CIPHER_NULL: return 0;
 242     case GNUTLS_CIPHER_ARCFOUR_40:
 243     case GNUTLS_CIPHER_ARCFOUR_128: return CALG_RC4;
 244     case GNUTLS_CIPHER_DES_CBC:
 245     case GNUTLS_CIPHER_3DES_CBC: return CALG_DES;
 246     case GNUTLS_CIPHER_AES_128_CBC:
 247     case GNUTLS_CIPHER_AES_256_CBC: return CALG_AES;
 248     case GNUTLS_CIPHER_RC2_40_CBC: return CALG_RC2;
 249     default:
 250         FIXME("unknown algorithm %d\n", cipher);
 251         return 0;
 252     }
 253 }
 254
 255 static ALG_ID schannel_get_mac_algid(gnutls_mac_algorithm_t mac)
 256 {
 257     switch (mac)
 258     {
 259     case GNUTLS_MAC_UNKNOWN:
 260     case GNUTLS_MAC_NULL: return 0;
 261     case GNUTLS_MAC_MD5: return CALG_MD5;
 262     case GNUTLS_MAC_SHA1:
 263     case GNUTLS_MAC_SHA256:
 264     case GNUTLS_MAC_SHA384:
 265     case GNUTLS_MAC_SHA512: return CALG_SHA;
 266     default:
 267         FIXME("unknown algorithm %d\n", mac);
 268         return 0;
 269     }
 270 }
 271
 272 static ALG_ID schannel_get_kx_algid(gnutls_kx_algorithm_t kx)
 273 {
 274     switch (kx)
 275     {
 276         case GNUTLS_KX_RSA: return CALG_RSA_KEYX;
 277         case GNUTLS_KX_DHE_DSS:
 278         case GNUTLS_KX_DHE_RSA: return CALG_DH_EPHEM;
 279     default:
 280         FIXME("unknown algorithm %d\n", kx);
 281         return 0;
 282     }
 283 }
 284
 285 unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session)
 286 {
 287     gnutls_session_t s = (gnutls_session_t)session;
 288     gnutls_cipher_algorithm_t cipher = pgnutls_cipher_get(s);
 289     return schannel_get_cipher_block_size(cipher);
 290 }
 291
 292 SECURITY_STATUS schan_imp_get_connection_info(schan_imp_session session,
 293                                               SecPkgContext_ConnectionInfo *info)
 294 {
 295     gnutls_session_t s = (gnutls_session_t)session;
 296     gnutls_protocol_t proto = pgnutls_protocol_get_version(s);
 297     gnutls_cipher_algorithm_t alg = pgnutls_cipher_get(s);
 298     gnutls_mac_algorithm_t mac = pgnutls_mac_get(s);
 299     gnutls_kx_algorithm_t kx = pgnutls_kx_get(s);
 300
 301     info->dwProtocol = schannel_get_protocol(proto);
 302     info->aiCipher = schannel_get_cipher_algid(alg);
 303     info->dwCipherStrength = pgnutls_cipher_get_key_size(alg);
 304     info->aiHash = schannel_get_mac_algid(mac);
 305     info->dwHashStrength = pgnutls_mac_get_key_size(mac);
 306     info->aiExch = schannel_get_kx_algid(kx);
 307     /* FIXME: info->dwExchStrength? */
 308     info->dwExchStrength = 0;
 309     return SEC_E_OK;
 310 }
 311
 312 SECURITY_STATUS schan_imp_get_session_peer_certificate(schan_imp_session session,
 313                                                        PCCERT_CONTEXT *cert)
 314 {
 315     gnutls_session_t s = (gnutls_session_t)session;
 316     unsigned int list_size;
 317     const gnutls_datum_t *datum;
 318
 319     datum = pgnutls_certificate_get_peers(s, &list_size);
 320     if (datum)
 321     {
 322         *cert = CertCreateCertificateContext(X509_ASN_ENCODING, datum->data,
 323                                              datum->size);
 324         if (!*cert)
 325             return GetLastError();
 326         else
 327             return SEC_E_OK;
 328     }
 329     else
 330         return SEC_E_INTERNAL_ERROR;
 331 }
 332
 333 SECURITY_STATUS schan_imp_send(schan_imp_session session, const void *buffer,
 334                                size_t *length)
 335 {
 336     gnutls_session_t s = (gnutls_session_t)session;
 337     ssize_t ret = pgnutls_record_send(s, buffer, *length);
 338     if (ret >= 0)
 339         *length = ret;
 340     else if (ret == GNUTLS_E_AGAIN)
 341         return SEC_I_CONTINUE_NEEDED;
 342     else
 343     {
 344         pgnutls_perror(ret);
 345         return SEC_E_INTERNAL_ERROR;
 346     }
 347
 348     return SEC_E_OK;
 349 }
 350
 351 SECURITY_STATUS schan_imp_recv(schan_imp_session session, void *buffer,
 352                                size_t *length)
 353 {
 354     gnutls_session_t s = (gnutls_session_t)session;
 355     ssize_t ret = pgnutls_record_recv(s, buffer, *length);
 356     if (ret >= 0)
 357         *length = ret;
 358     else if (ret == GNUTLS_E_AGAIN)
 359         return SEC_I_CONTINUE_NEEDED;
 360     else
 361     {
 362         pgnutls_perror(ret);
 363         return SEC_E_INTERNAL_ERROR;
 364     }
 365
 366     return SEC_E_OK;
 367 }
 368
 369 BOOL schan_imp_allocate_certificate_credentials(schan_imp_certificate_credentials *c)
 370 {
 371     int ret = pgnutls_certificate_allocate_credentials((gnutls_certificate_credentials*)c);
 372     if (ret != GNUTLS_E_SUCCESS)
 373         pgnutls_perror(ret);
 374     return (ret == GNUTLS_E_SUCCESS);
 375 }
 376
 377 void schan_imp_free_certificate_credentials(schan_imp_certificate_credentials c)
 378 {
 379     pgnutls_certificate_free_credentials((gnutls_certificate_credentials)c);
 380 }
 381
 382 static void schan_gnutls_log(int level, const char *msg)
 383 {
 384     TRACE("<%d> %s", level, msg);
 385 }
 386
 387 BOOL schan_imp_init(void)
 388 {
 389     int ret;
 390
 391     libgnutls_handle = wine_dlopen(SONAME_LIBGNUTLS, RTLD_NOW, NULL, 0);
 392     if (!libgnutls_handle)
 393     {
 394         WARN("Failed to load libgnutls.\n");
 395         return FALSE;
 396     }
 397
 398 #define LOAD_FUNCPTR(f) \
 399     if (!(p##f = wine_dlsym(libgnutls_handle, #f, NULL, 0))) \
 400     { \
 401         ERR("Failed to load %s\n", #f); \
 402         goto fail; \
 403     }
 404
 405     LOAD_FUNCPTR(gnutls_alert_get)
 406     LOAD_FUNCPTR(gnutls_alert_get_name)
 407     LOAD_FUNCPTR(gnutls_certificate_allocate_credentials)
 408     LOAD_FUNCPTR(gnutls_certificate_free_credentials)
 409     LOAD_FUNCPTR(gnutls_certificate_get_peers)
 410     LOAD_FUNCPTR(gnutls_cipher_get)
 411     LOAD_FUNCPTR(gnutls_cipher_get_key_size)
 412     LOAD_FUNCPTR(gnutls_credentials_set)
 413     LOAD_FUNCPTR(gnutls_deinit)
 414     LOAD_FUNCPTR(gnutls_global_deinit)
 415     LOAD_FUNCPTR(gnutls_global_init)
 416     LOAD_FUNCPTR(gnutls_global_set_log_function)
 417     LOAD_FUNCPTR(gnutls_global_set_log_level)
 418     LOAD_FUNCPTR(gnutls_handshake)
 419     LOAD_FUNCPTR(gnutls_init)
 420     LOAD_FUNCPTR(gnutls_kx_get)
 421     LOAD_FUNCPTR(gnutls_mac_get)
 422     LOAD_FUNCPTR(gnutls_mac_get_key_size)
 423     LOAD_FUNCPTR(gnutls_perror)
 424     LOAD_FUNCPTR(gnutls_protocol_get_version)
 425     LOAD_FUNCPTR(gnutls_set_default_priority)
 426     LOAD_FUNCPTR(gnutls_record_recv);
 427     LOAD_FUNCPTR(gnutls_record_send);
 428     LOAD_FUNCPTR(gnutls_transport_set_errno)
 429     LOAD_FUNCPTR(gnutls_transport_set_ptr)
 430     LOAD_FUNCPTR(gnutls_transport_set_pull_function)
 431     LOAD_FUNCPTR(gnutls_transport_set_push_function)
 432 #undef LOAD_FUNCPTR
 433
 434     ret = pgnutls_global_init();
 435     if (ret != GNUTLS_E_SUCCESS)
 436     {
 437         pgnutls_perror(ret);
 438         goto fail;
 439     }
 440
 441     if (TRACE_ON(secur32))
 442     {
 443         pgnutls_global_set_log_level(4);
 444         pgnutls_global_set_log_function(schan_gnutls_log);
 445     }
 446
 447     return TRUE;
 448
 449 fail:
 450     wine_dlclose(libgnutls_handle, NULL, 0);
 451     libgnutls_handle = NULL;
 452     return FALSE;
 453 }
 454
 455 void schan_imp_deinit(void)
 456 {
 457     pgnutls_global_deinit();
 458     wine_dlclose(libgnutls_handle, NULL, 0);
 459     libgnutls_handle = NULL;
 460 }
 461
 462 #endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H */