msi: Break out of the loop as soon as the assembly is detected in msi_load_assembly.
[wine] / dlls / secur32 / schannel_gnutls.c
1 /*
2  * GnuTLS-based implementation of the schannel (SSL/TLS) provider.
3  *
4  * Copyright 2005 Juan Lang
5  * Copyright 2008 Henri Verbeet
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2.1 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
20  */
21
22 #include "config.h"
23 #include "wine/port.h"
24
25 #include <stdarg.h>
26 #ifdef SONAME_LIBGNUTLS
27 #include <gnutls/gnutls.h>
28 #endif
29
30 #include "windef.h"
31 #include "winbase.h"
32 #include "sspi.h"
33 #include "schannel.h"
34 #include "secur32_priv.h"
35 #include "wine/debug.h"
36 #include "wine/library.h"
37
38 WINE_DEFAULT_DEBUG_CHANNEL(secur32);
39
40 #if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H)
41
42 static void *libgnutls_handle;
43 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
44 MAKE_FUNCPTR(gnutls_alert_get);
45 MAKE_FUNCPTR(gnutls_alert_get_name);
46 MAKE_FUNCPTR(gnutls_certificate_allocate_credentials);
47 MAKE_FUNCPTR(gnutls_certificate_free_credentials);
48 MAKE_FUNCPTR(gnutls_certificate_get_peers);
49 MAKE_FUNCPTR(gnutls_cipher_get);
50 MAKE_FUNCPTR(gnutls_cipher_get_key_size);
51 MAKE_FUNCPTR(gnutls_credentials_set);
52 MAKE_FUNCPTR(gnutls_deinit);
53 MAKE_FUNCPTR(gnutls_global_deinit);
54 MAKE_FUNCPTR(gnutls_global_init);
55 MAKE_FUNCPTR(gnutls_global_set_log_function);
56 MAKE_FUNCPTR(gnutls_global_set_log_level);
57 MAKE_FUNCPTR(gnutls_handshake);
58 MAKE_FUNCPTR(gnutls_init);
59 MAKE_FUNCPTR(gnutls_kx_get);
60 MAKE_FUNCPTR(gnutls_mac_get);
61 MAKE_FUNCPTR(gnutls_mac_get_key_size);
62 MAKE_FUNCPTR(gnutls_perror);
63 MAKE_FUNCPTR(gnutls_protocol_get_version);
64 MAKE_FUNCPTR(gnutls_set_default_priority);
65 MAKE_FUNCPTR(gnutls_record_get_max_size);
66 MAKE_FUNCPTR(gnutls_record_recv);
67 MAKE_FUNCPTR(gnutls_record_send);
68 MAKE_FUNCPTR(gnutls_transport_get_ptr);
69 MAKE_FUNCPTR(gnutls_transport_set_errno);
70 MAKE_FUNCPTR(gnutls_transport_set_ptr);
71 MAKE_FUNCPTR(gnutls_transport_set_pull_function);
72 MAKE_FUNCPTR(gnutls_transport_set_push_function);
73 #undef MAKE_FUNCPTR
74
75
76
77 static ssize_t schan_pull_adapter(gnutls_transport_ptr_t transport,
78                                       void *buff, size_t buff_len)
79 {
80     struct schan_transport *t = (struct schan_transport*)transport;
81     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
82
83     int ret = schan_pull(transport, buff, &buff_len);
84     if (ret)
85     {
86         pgnutls_transport_set_errno(s, ret);
87         return -1;
88     }
89
90     return buff_len;
91 }
92
93 static ssize_t schan_push_adapter(gnutls_transport_ptr_t transport,
94                                       const void *buff, size_t buff_len)
95 {
96     struct schan_transport *t = (struct schan_transport*)transport;
97     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
98
99     int ret = schan_push(transport, buff, &buff_len);
100     if (ret)
101     {
102         pgnutls_transport_set_errno(s, ret);
103         return -1;
104     }
105
106     return buff_len;
107 }
108
109 BOOL schan_imp_create_session(schan_imp_session *session, BOOL is_server,
110                               schan_imp_certificate_credentials cred)
111 {
112     gnutls_session_t *s = (gnutls_session_t*)session;
113
114     int err = pgnutls_init(s, is_server ? GNUTLS_SERVER : GNUTLS_CLIENT);
115     if (err != GNUTLS_E_SUCCESS)
116     {
117         pgnutls_perror(err);
118         return FALSE;
119     }
120
121     /* FIXME: We should be using the information from the credentials here. */
122     FIXME("Using hardcoded \"NORMAL\" priority\n");
123     err = pgnutls_set_default_priority(*s);
124     if (err != GNUTLS_E_SUCCESS)
125     {
126         pgnutls_perror(err);
127         pgnutls_deinit(*s);
128         return FALSE;
129     }
130
131     err = pgnutls_credentials_set(*s, GNUTLS_CRD_CERTIFICATE,
132                                   (gnutls_certificate_credentials)cred);
133     if (err != GNUTLS_E_SUCCESS)
134     {
135         pgnutls_perror(err);
136         pgnutls_deinit(*s);
137         return FALSE;
138     }
139
140     pgnutls_transport_set_pull_function(*s, schan_pull_adapter);
141     pgnutls_transport_set_push_function(*s, schan_push_adapter);
142
143     return TRUE;
144 }
145
146 void schan_imp_dispose_session(schan_imp_session session)
147 {
148     gnutls_session_t s = (gnutls_session_t)session;
149     pgnutls_deinit(s);
150 }
151
152 void schan_imp_set_session_transport(schan_imp_session session,
153                                      struct schan_transport *t)
154 {
155     gnutls_session_t s = (gnutls_session_t)session;
156     pgnutls_transport_set_ptr(s, (gnutls_transport_ptr_t)t);
157 }
158
159 SECURITY_STATUS schan_imp_handshake(schan_imp_session session)
160 {
161     gnutls_session_t s = (gnutls_session_t)session;
162     int err = pgnutls_handshake(s);
163     switch(err)
164     {
165         case GNUTLS_E_SUCCESS:
166             TRACE("Handshake completed\n");
167             return SEC_E_OK;
168
169         case GNUTLS_E_AGAIN:
170             TRACE("Continue...\n");
171             return SEC_I_CONTINUE_NEEDED;
172
173         case GNUTLS_E_WARNING_ALERT_RECEIVED:
174         case GNUTLS_E_FATAL_ALERT_RECEIVED:
175         {
176             gnutls_alert_description_t alert = pgnutls_alert_get(s);
177             const char *alert_name = pgnutls_alert_get_name(alert);
178             WARN("ALERT: %d %s\n", alert, alert_name);
179             return SEC_E_INTERNAL_ERROR;
180         }
181
182         default:
183             pgnutls_perror(err);
184             return SEC_E_INTERNAL_ERROR;
185     }
186
187     /* Never reached */
188     return SEC_E_OK;
189 }
190
191 static unsigned int schannel_get_cipher_block_size(gnutls_cipher_algorithm_t cipher)
192 {
193     const struct
194     {
195         gnutls_cipher_algorithm_t cipher;
196         unsigned int block_size;
197     }
198     algorithms[] =
199     {
200         {GNUTLS_CIPHER_3DES_CBC, 8},
201         {GNUTLS_CIPHER_AES_128_CBC, 16},
202         {GNUTLS_CIPHER_AES_256_CBC, 16},
203         {GNUTLS_CIPHER_ARCFOUR_128, 1},
204         {GNUTLS_CIPHER_ARCFOUR_40, 1},
205         {GNUTLS_CIPHER_DES_CBC, 8},
206         {GNUTLS_CIPHER_NULL, 1},
207         {GNUTLS_CIPHER_RC2_40_CBC, 8},
208     };
209     unsigned int i;
210
211     for (i = 0; i < sizeof(algorithms) / sizeof(*algorithms); ++i)
212     {
213         if (algorithms[i].cipher == cipher)
214             return algorithms[i].block_size;
215     }
216
217     FIXME("Unknown cipher %#x, returning 1\n", cipher);
218
219     return 1;
220 }
221
222 static DWORD schannel_get_protocol(gnutls_protocol_t proto)
223 {
224     /* FIXME: currently schannel only implements client connections, but
225      * there's no reason it couldn't be used for servers as well.  The
226      * context doesn't tell us which it is, so assume client for now.
227      */
228     switch (proto)
229     {
230     case GNUTLS_SSL3: return SP_PROT_SSL3_CLIENT;
231     case GNUTLS_TLS1_0: return SP_PROT_TLS1_CLIENT;
232     default:
233         FIXME("unknown protocol %d\n", proto);
234         return 0;
235     }
236 }
237
238 static ALG_ID schannel_get_cipher_algid(gnutls_cipher_algorithm_t cipher)
239 {
240     switch (cipher)
241     {
242     case GNUTLS_CIPHER_UNKNOWN:
243     case GNUTLS_CIPHER_NULL: return 0;
244     case GNUTLS_CIPHER_ARCFOUR_40:
245     case GNUTLS_CIPHER_ARCFOUR_128: return CALG_RC4;
246     case GNUTLS_CIPHER_DES_CBC:
247     case GNUTLS_CIPHER_3DES_CBC: return CALG_DES;
248     case GNUTLS_CIPHER_AES_128_CBC:
249     case GNUTLS_CIPHER_AES_256_CBC: return CALG_AES;
250     case GNUTLS_CIPHER_RC2_40_CBC: return CALG_RC2;
251     default:
252         FIXME("unknown algorithm %d\n", cipher);
253         return 0;
254     }
255 }
256
257 static ALG_ID schannel_get_mac_algid(gnutls_mac_algorithm_t mac)
258 {
259     switch (mac)
260     {
261     case GNUTLS_MAC_UNKNOWN:
262     case GNUTLS_MAC_NULL: return 0;
263     case GNUTLS_MAC_MD5: return CALG_MD5;
264     case GNUTLS_MAC_SHA1:
265     case GNUTLS_MAC_SHA256:
266     case GNUTLS_MAC_SHA384:
267     case GNUTLS_MAC_SHA512: return CALG_SHA;
268     default:
269         FIXME("unknown algorithm %d\n", mac);
270         return 0;
271     }
272 }
273
274 static ALG_ID schannel_get_kx_algid(gnutls_kx_algorithm_t kx)
275 {
276     switch (kx)
277     {
278         case GNUTLS_KX_RSA: return CALG_RSA_KEYX;
279         case GNUTLS_KX_DHE_DSS:
280         case GNUTLS_KX_DHE_RSA: return CALG_DH_EPHEM;
281     default:
282         FIXME("unknown algorithm %d\n", kx);
283         return 0;
284     }
285 }
286
287 unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session)
288 {
289     gnutls_session_t s = (gnutls_session_t)session;
290     gnutls_cipher_algorithm_t cipher = pgnutls_cipher_get(s);
291     return schannel_get_cipher_block_size(cipher);
292 }
293
294 unsigned int schan_imp_get_max_message_size(schan_imp_session session)
295 {
296     return pgnutls_record_get_max_size((gnutls_session_t)session);
297 }
298
299 SECURITY_STATUS schan_imp_get_connection_info(schan_imp_session session,
300                                               SecPkgContext_ConnectionInfo *info)
301 {
302     gnutls_session_t s = (gnutls_session_t)session;
303     gnutls_protocol_t proto = pgnutls_protocol_get_version(s);
304     gnutls_cipher_algorithm_t alg = pgnutls_cipher_get(s);
305     gnutls_mac_algorithm_t mac = pgnutls_mac_get(s);
306     gnutls_kx_algorithm_t kx = pgnutls_kx_get(s);
307
308     info->dwProtocol = schannel_get_protocol(proto);
309     info->aiCipher = schannel_get_cipher_algid(alg);
310     info->dwCipherStrength = pgnutls_cipher_get_key_size(alg);
311     info->aiHash = schannel_get_mac_algid(mac);
312     info->dwHashStrength = pgnutls_mac_get_key_size(mac);
313     info->aiExch = schannel_get_kx_algid(kx);
314     /* FIXME: info->dwExchStrength? */
315     info->dwExchStrength = 0;
316     return SEC_E_OK;
317 }
318
319 SECURITY_STATUS schan_imp_get_session_peer_certificate(schan_imp_session session,
320                                                        PCCERT_CONTEXT *cert)
321 {
322     gnutls_session_t s = (gnutls_session_t)session;
323     unsigned int list_size;
324     const gnutls_datum_t *datum;
325
326     datum = pgnutls_certificate_get_peers(s, &list_size);
327     if (datum)
328     {
329         *cert = CertCreateCertificateContext(X509_ASN_ENCODING, datum->data,
330                                              datum->size);
331         if (!*cert)
332             return GetLastError();
333         else
334             return SEC_E_OK;
335     }
336     else
337         return SEC_E_INTERNAL_ERROR;
338 }
339
340 SECURITY_STATUS schan_imp_send(schan_imp_session session, const void *buffer,
341                                SIZE_T *length)
342 {
343     gnutls_session_t s = (gnutls_session_t)session;
344     ssize_t ret;
345
346 again:
347     ret = pgnutls_record_send(s, buffer, *length);
348
349     if (ret >= 0)
350         *length = ret;
351     else if (ret == GNUTLS_E_AGAIN)
352     {
353         struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s);
354         SIZE_T count = 0;
355
356         if (schan_get_buffer(t, &t->out, &count))
357             goto again;
358
359         return SEC_I_CONTINUE_NEEDED;
360     }
361     else
362     {
363         pgnutls_perror(ret);
364         return SEC_E_INTERNAL_ERROR;
365     }
366
367     return SEC_E_OK;
368 }
369
370 SECURITY_STATUS schan_imp_recv(schan_imp_session session, void *buffer,
371                                SIZE_T *length)
372 {
373     gnutls_session_t s = (gnutls_session_t)session;
374     ssize_t ret;
375
376 again:
377     ret = pgnutls_record_recv(s, buffer, *length);
378
379     if (ret >= 0)
380         *length = ret;
381     else if (ret == GNUTLS_E_AGAIN)
382     {
383         struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s);
384         SIZE_T count = 0;
385
386         if (schan_get_buffer(t, &t->in, &count))
387             goto again;
388
389         return SEC_I_CONTINUE_NEEDED;
390     }
391     else
392     {
393         pgnutls_perror(ret);
394         return SEC_E_INTERNAL_ERROR;
395     }
396
397     return SEC_E_OK;
398 }
399
400 BOOL schan_imp_allocate_certificate_credentials(schan_imp_certificate_credentials *c)
401 {
402     int ret = pgnutls_certificate_allocate_credentials((gnutls_certificate_credentials*)c);
403     if (ret != GNUTLS_E_SUCCESS)
404         pgnutls_perror(ret);
405     return (ret == GNUTLS_E_SUCCESS);
406 }
407
408 void schan_imp_free_certificate_credentials(schan_imp_certificate_credentials c)
409 {
410     pgnutls_certificate_free_credentials((gnutls_certificate_credentials)c);
411 }
412
413 static void schan_gnutls_log(int level, const char *msg)
414 {
415     TRACE("<%d> %s", level, msg);
416 }
417
418 BOOL schan_imp_init(void)
419 {
420     int ret;
421
422     libgnutls_handle = wine_dlopen(SONAME_LIBGNUTLS, RTLD_NOW, NULL, 0);
423     if (!libgnutls_handle)
424     {
425         WARN("Failed to load libgnutls.\n");
426         return FALSE;
427     }
428
429 #define LOAD_FUNCPTR(f) \
430     if (!(p##f = wine_dlsym(libgnutls_handle, #f, NULL, 0))) \
431     { \
432         ERR("Failed to load %s\n", #f); \
433         goto fail; \
434     }
435
436     LOAD_FUNCPTR(gnutls_alert_get)
437     LOAD_FUNCPTR(gnutls_alert_get_name)
438     LOAD_FUNCPTR(gnutls_certificate_allocate_credentials)
439     LOAD_FUNCPTR(gnutls_certificate_free_credentials)
440     LOAD_FUNCPTR(gnutls_certificate_get_peers)
441     LOAD_FUNCPTR(gnutls_cipher_get)
442     LOAD_FUNCPTR(gnutls_cipher_get_key_size)
443     LOAD_FUNCPTR(gnutls_credentials_set)
444     LOAD_FUNCPTR(gnutls_deinit)
445     LOAD_FUNCPTR(gnutls_global_deinit)
446     LOAD_FUNCPTR(gnutls_global_init)
447     LOAD_FUNCPTR(gnutls_global_set_log_function)
448     LOAD_FUNCPTR(gnutls_global_set_log_level)
449     LOAD_FUNCPTR(gnutls_handshake)
450     LOAD_FUNCPTR(gnutls_init)
451     LOAD_FUNCPTR(gnutls_kx_get)
452     LOAD_FUNCPTR(gnutls_mac_get)
453     LOAD_FUNCPTR(gnutls_mac_get_key_size)
454     LOAD_FUNCPTR(gnutls_perror)
455     LOAD_FUNCPTR(gnutls_protocol_get_version)
456     LOAD_FUNCPTR(gnutls_set_default_priority)
457     LOAD_FUNCPTR(gnutls_record_get_max_size);
458     LOAD_FUNCPTR(gnutls_record_recv);
459     LOAD_FUNCPTR(gnutls_record_send);
460     LOAD_FUNCPTR(gnutls_transport_get_ptr)
461     LOAD_FUNCPTR(gnutls_transport_set_errno)
462     LOAD_FUNCPTR(gnutls_transport_set_ptr)
463     LOAD_FUNCPTR(gnutls_transport_set_pull_function)
464     LOAD_FUNCPTR(gnutls_transport_set_push_function)
465 #undef LOAD_FUNCPTR
466
467     ret = pgnutls_global_init();
468     if (ret != GNUTLS_E_SUCCESS)
469     {
470         pgnutls_perror(ret);
471         goto fail;
472     }
473
474     if (TRACE_ON(secur32))
475     {
476         pgnutls_global_set_log_level(4);
477         pgnutls_global_set_log_function(schan_gnutls_log);
478     }
479
480     return TRUE;
481
482 fail:
483     wine_dlclose(libgnutls_handle, NULL, 0);
484     libgnutls_handle = NULL;
485     return FALSE;
486 }
487
488 void schan_imp_deinit(void)
489 {
490     pgnutls_global_deinit();
491     wine_dlclose(libgnutls_handle, NULL, 0);
492     libgnutls_handle = NULL;
493 }
494
495 #endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H */