git.oblomov.eu Git - wine/blob - dlls/secur32/schannel_gnutls.c

   1 /*
   2  * GnuTLS-based implementation of the schannel (SSL/TLS) provider.
   3  *
   4  * Copyright 2005 Juan Lang
   5  * Copyright 2008 Henri Verbeet
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include "config.h"
  23 #include "wine/port.h"
  24
  25 #include <stdarg.h>
  26 #ifdef SONAME_LIBGNUTLS
  27 #include <gnutls/gnutls.h>
  28 #endif
  29
  30 #include "windef.h"
  31 #include "winbase.h"
  32 #include "sspi.h"
  33 #include "schannel.h"
  34 #include "secur32_priv.h"
  35 #include "wine/debug.h"
  36 #include "wine/library.h"
  37
  38 WINE_DEFAULT_DEBUG_CHANNEL(secur32);
  39
  40 #if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H)
  41
  42 static void *libgnutls_handle;
  43 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
  44 MAKE_FUNCPTR(gnutls_alert_get);
  45 MAKE_FUNCPTR(gnutls_alert_get_name);
  46 MAKE_FUNCPTR(gnutls_certificate_allocate_credentials);
  47 MAKE_FUNCPTR(gnutls_certificate_free_credentials);
  48 MAKE_FUNCPTR(gnutls_certificate_get_peers);
  49 MAKE_FUNCPTR(gnutls_cipher_get);
  50 MAKE_FUNCPTR(gnutls_cipher_get_key_size);
  51 MAKE_FUNCPTR(gnutls_credentials_set);
  52 MAKE_FUNCPTR(gnutls_deinit);
  53 MAKE_FUNCPTR(gnutls_global_deinit);
  54 MAKE_FUNCPTR(gnutls_global_init);
  55 MAKE_FUNCPTR(gnutls_global_set_log_function);
  56 MAKE_FUNCPTR(gnutls_global_set_log_level);
  57 MAKE_FUNCPTR(gnutls_handshake);
  58 MAKE_FUNCPTR(gnutls_init);
  59 MAKE_FUNCPTR(gnutls_kx_get);
  60 MAKE_FUNCPTR(gnutls_mac_get);
  61 MAKE_FUNCPTR(gnutls_mac_get_key_size);
  62 MAKE_FUNCPTR(gnutls_perror);
  63 MAKE_FUNCPTR(gnutls_protocol_get_version);
  64 MAKE_FUNCPTR(gnutls_set_default_priority);
  65 MAKE_FUNCPTR(gnutls_record_get_max_size);
  66 MAKE_FUNCPTR(gnutls_record_recv);
  67 MAKE_FUNCPTR(gnutls_record_send);
  68 MAKE_FUNCPTR(gnutls_transport_get_ptr);
  69 MAKE_FUNCPTR(gnutls_transport_set_errno);
  70 MAKE_FUNCPTR(gnutls_transport_set_ptr);
  71 MAKE_FUNCPTR(gnutls_transport_set_pull_function);
  72 MAKE_FUNCPTR(gnutls_transport_set_push_function);
  73 #undef MAKE_FUNCPTR
  74
  75
  76
  77 static ssize_t schan_pull_adapter(gnutls_transport_ptr_t transport,
  78                                       void *buff, size_t buff_len)
  79 {
  80     struct schan_transport *t = (struct schan_transport*)transport;
  81     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
  82
  83     int ret = schan_pull(transport, buff, &buff_len);
  84     if (ret)
  85     {
  86         pgnutls_transport_set_errno(s, ret);
  87         return -1;
  88     }
  89
  90     return buff_len;
  91 }
  92
  93 static ssize_t schan_push_adapter(gnutls_transport_ptr_t transport,
  94                                       const void *buff, size_t buff_len)
  95 {
  96     struct schan_transport *t = (struct schan_transport*)transport;
  97     gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t);
  98
  99     int ret = schan_push(transport, buff, &buff_len);
 100     if (ret)
 101     {
 102         pgnutls_transport_set_errno(s, ret);
 103         return -1;
 104     }
 105
 106     return buff_len;
 107 }
 108
 109 BOOL schan_imp_create_session(schan_imp_session *session, BOOL is_server,
 110                               schan_imp_certificate_credentials cred)
 111 {
 112     gnutls_session_t *s = (gnutls_session_t*)session;
 113
 114     int err = pgnutls_init(s, is_server ? GNUTLS_SERVER : GNUTLS_CLIENT);
 115     if (err != GNUTLS_E_SUCCESS)
 116     {
 117         pgnutls_perror(err);
 118         return FALSE;
 119     }
 120
 121     /* FIXME: We should be using the information from the credentials here. */
 122     FIXME("Using hardcoded \"NORMAL\" priority\n");
 123     err = pgnutls_set_default_priority(*s);
 124     if (err != GNUTLS_E_SUCCESS)
 125     {
 126         pgnutls_perror(err);
 127         pgnutls_deinit(*s);
 128         return FALSE;
 129     }
 130
 131     err = pgnutls_credentials_set(*s, GNUTLS_CRD_CERTIFICATE,
 132                                   (gnutls_certificate_credentials_t)cred);
 133     if (err != GNUTLS_E_SUCCESS)
 134     {
 135         pgnutls_perror(err);
 136         pgnutls_deinit(*s);
 137         return FALSE;
 138     }
 139
 140     pgnutls_transport_set_pull_function(*s, schan_pull_adapter);
 141     pgnutls_transport_set_push_function(*s, schan_push_adapter);
 142
 143     return TRUE;
 144 }
 145
 146 void schan_imp_dispose_session(schan_imp_session session)
 147 {
 148     gnutls_session_t s = (gnutls_session_t)session;
 149     pgnutls_deinit(s);
 150 }
 151
 152 void schan_imp_set_session_transport(schan_imp_session session,
 153                                      struct schan_transport *t)
 154 {
 155     gnutls_session_t s = (gnutls_session_t)session;
 156     pgnutls_transport_set_ptr(s, (gnutls_transport_ptr_t)t);
 157 }
 158
 159 SECURITY_STATUS schan_imp_handshake(schan_imp_session session)
 160 {
 161     gnutls_session_t s = (gnutls_session_t)session;
 162     int err = pgnutls_handshake(s);
 163     switch(err)
 164     {
 165         case GNUTLS_E_SUCCESS:
 166             TRACE("Handshake completed\n");
 167             return SEC_E_OK;
 168
 169         case GNUTLS_E_AGAIN:
 170             TRACE("Continue...\n");
 171             return SEC_I_CONTINUE_NEEDED;
 172
 173         case GNUTLS_E_WARNING_ALERT_RECEIVED:
 174         case GNUTLS_E_FATAL_ALERT_RECEIVED:
 175         {
 176             gnutls_alert_description_t alert = pgnutls_alert_get(s);
 177             const char *alert_name = pgnutls_alert_get_name(alert);
 178             WARN("ALERT: %d %s\n", alert, alert_name);
 179             return SEC_E_INTERNAL_ERROR;
 180         }
 181
 182         default:
 183             pgnutls_perror(err);
 184             return SEC_E_INTERNAL_ERROR;
 185     }
 186
 187     /* Never reached */
 188     return SEC_E_OK;
 189 }
 190
 191 static unsigned int schannel_get_cipher_block_size(gnutls_cipher_algorithm_t cipher)
 192 {
 193     const struct
 194     {
 195         gnutls_cipher_algorithm_t cipher;
 196         unsigned int block_size;
 197     }
 198     algorithms[] =
 199     {
 200         {GNUTLS_CIPHER_3DES_CBC, 8},
 201         {GNUTLS_CIPHER_AES_128_CBC, 16},
 202         {GNUTLS_CIPHER_AES_256_CBC, 16},
 203         {GNUTLS_CIPHER_ARCFOUR_128, 1},
 204         {GNUTLS_CIPHER_ARCFOUR_40, 1},
 205         {GNUTLS_CIPHER_DES_CBC, 8},
 206         {GNUTLS_CIPHER_NULL, 1},
 207         {GNUTLS_CIPHER_RC2_40_CBC, 8},
 208     };
 209     unsigned int i;
 210
 211     for (i = 0; i < sizeof(algorithms) / sizeof(*algorithms); ++i)
 212     {
 213         if (algorithms[i].cipher == cipher)
 214             return algorithms[i].block_size;
 215     }
 216
 217     FIXME("Unknown cipher %#x, returning 1\n", cipher);
 218
 219     return 1;
 220 }
 221
 222 static DWORD schannel_get_protocol(gnutls_protocol_t proto)
 223 {
 224     /* FIXME: currently schannel only implements client connections, but
 225      * there's no reason it couldn't be used for servers as well.  The
 226      * context doesn't tell us which it is, so assume client for now.
 227      */
 228     switch (proto)
 229     {
 230     case GNUTLS_SSL3: return SP_PROT_SSL3_CLIENT;
 231     case GNUTLS_TLS1_0: return SP_PROT_TLS1_0_CLIENT;
 232     case GNUTLS_TLS1_1: return SP_PROT_TLS1_1_CLIENT;
 233     case GNUTLS_TLS1_2: return SP_PROT_TLS1_2_CLIENT;
 234     default:
 235         FIXME("unknown protocol %d\n", proto);
 236         return 0;
 237     }
 238 }
 239
 240 static ALG_ID schannel_get_cipher_algid(gnutls_cipher_algorithm_t cipher)
 241 {
 242     switch (cipher)
 243     {
 244     case GNUTLS_CIPHER_UNKNOWN:
 245     case GNUTLS_CIPHER_NULL: return 0;
 246     case GNUTLS_CIPHER_ARCFOUR_40:
 247     case GNUTLS_CIPHER_ARCFOUR_128: return CALG_RC4;
 248     case GNUTLS_CIPHER_DES_CBC:
 249     case GNUTLS_CIPHER_3DES_CBC: return CALG_DES;
 250     case GNUTLS_CIPHER_AES_128_CBC:
 251     case GNUTLS_CIPHER_AES_256_CBC: return CALG_AES;
 252     case GNUTLS_CIPHER_RC2_40_CBC: return CALG_RC2;
 253     default:
 254         FIXME("unknown algorithm %d\n", cipher);
 255         return 0;
 256     }
 257 }
 258
 259 static ALG_ID schannel_get_mac_algid(gnutls_mac_algorithm_t mac)
 260 {
 261     switch (mac)
 262     {
 263     case GNUTLS_MAC_UNKNOWN:
 264     case GNUTLS_MAC_NULL: return 0;
 265     case GNUTLS_MAC_MD5: return CALG_MD5;
 266     case GNUTLS_MAC_SHA1:
 267     case GNUTLS_MAC_SHA256:
 268     case GNUTLS_MAC_SHA384:
 269     case GNUTLS_MAC_SHA512: return CALG_SHA;
 270     default:
 271         FIXME("unknown algorithm %d\n", mac);
 272         return 0;
 273     }
 274 }
 275
 276 static ALG_ID schannel_get_kx_algid(gnutls_kx_algorithm_t kx)
 277 {
 278     switch (kx)
 279     {
 280         case GNUTLS_KX_RSA: return CALG_RSA_KEYX;
 281         case GNUTLS_KX_DHE_DSS:
 282         case GNUTLS_KX_DHE_RSA: return CALG_DH_EPHEM;
 283     default:
 284         FIXME("unknown algorithm %d\n", kx);
 285         return 0;
 286     }
 287 }
 288
 289 unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session)
 290 {
 291     gnutls_session_t s = (gnutls_session_t)session;
 292     gnutls_cipher_algorithm_t cipher = pgnutls_cipher_get(s);
 293     return schannel_get_cipher_block_size(cipher);
 294 }
 295
 296 unsigned int schan_imp_get_max_message_size(schan_imp_session session)
 297 {
 298     return pgnutls_record_get_max_size((gnutls_session_t)session);
 299 }
 300
 301 SECURITY_STATUS schan_imp_get_connection_info(schan_imp_session session,
 302                                               SecPkgContext_ConnectionInfo *info)
 303 {
 304     gnutls_session_t s = (gnutls_session_t)session;
 305     gnutls_protocol_t proto = pgnutls_protocol_get_version(s);
 306     gnutls_cipher_algorithm_t alg = pgnutls_cipher_get(s);
 307     gnutls_mac_algorithm_t mac = pgnutls_mac_get(s);
 308     gnutls_kx_algorithm_t kx = pgnutls_kx_get(s);
 309
 310     info->dwProtocol = schannel_get_protocol(proto);
 311     info->aiCipher = schannel_get_cipher_algid(alg);
 312     info->dwCipherStrength = pgnutls_cipher_get_key_size(alg) * 8;
 313     info->aiHash = schannel_get_mac_algid(mac);
 314     info->dwHashStrength = pgnutls_mac_get_key_size(mac) * 8;
 315     info->aiExch = schannel_get_kx_algid(kx);
 316     /* FIXME: info->dwExchStrength? */
 317     info->dwExchStrength = 0;
 318     return SEC_E_OK;
 319 }
 320
 321 SECURITY_STATUS schan_imp_get_session_peer_certificate(schan_imp_session session, HCERTSTORE store,
 322                                                        PCCERT_CONTEXT *ret)
 323 {
 324     gnutls_session_t s = (gnutls_session_t)session;
 325     PCCERT_CONTEXT cert = NULL;
 326     const gnutls_datum_t *datum;
 327     unsigned list_size, i;
 328     BOOL res;
 329
 330     datum = pgnutls_certificate_get_peers(s, &list_size);
 331     if(!datum)
 332         return SEC_E_INTERNAL_ERROR;
 333
 334     for(i = 0; i < list_size; i++) {
 335         res = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, datum[i].data, datum[i].size,
 336                 CERT_STORE_ADD_REPLACE_EXISTING, i ? NULL : &cert);
 337         if(!res) {
 338             if(i)
 339                 CertFreeCertificateContext(cert);
 340             return GetLastError();
 341         }
 342     }
 343
 344     *ret = cert;
 345     return SEC_E_OK;
 346 }
 347
 348 SECURITY_STATUS schan_imp_send(schan_imp_session session, const void *buffer,
 349                                SIZE_T *length)
 350 {
 351     gnutls_session_t s = (gnutls_session_t)session;
 352     ssize_t ret;
 353
 354 again:
 355     ret = pgnutls_record_send(s, buffer, *length);
 356
 357     if (ret >= 0)
 358         *length = ret;
 359     else if (ret == GNUTLS_E_AGAIN)
 360     {
 361         struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s);
 362         SIZE_T count = 0;
 363
 364         if (schan_get_buffer(t, &t->out, &count))
 365             goto again;
 366
 367         return SEC_I_CONTINUE_NEEDED;
 368     }
 369     else
 370     {
 371         pgnutls_perror(ret);
 372         return SEC_E_INTERNAL_ERROR;
 373     }
 374
 375     return SEC_E_OK;
 376 }
 377
 378 SECURITY_STATUS schan_imp_recv(schan_imp_session session, void *buffer,
 379                                SIZE_T *length)
 380 {
 381     gnutls_session_t s = (gnutls_session_t)session;
 382     ssize_t ret;
 383
 384 again:
 385     ret = pgnutls_record_recv(s, buffer, *length);
 386
 387     if (ret >= 0)
 388         *length = ret;
 389     else if (ret == GNUTLS_E_AGAIN)
 390     {
 391         struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s);
 392         SIZE_T count = 0;
 393
 394         if (schan_get_buffer(t, &t->in, &count))
 395             goto again;
 396
 397         return SEC_I_CONTINUE_NEEDED;
 398     }
 399     else
 400     {
 401         pgnutls_perror(ret);
 402         return SEC_E_INTERNAL_ERROR;
 403     }
 404
 405     return SEC_E_OK;
 406 }
 407
 408 BOOL schan_imp_allocate_certificate_credentials(schan_imp_certificate_credentials *c)
 409 {
 410     int ret = pgnutls_certificate_allocate_credentials((gnutls_certificate_credentials*)c);
 411     if (ret != GNUTLS_E_SUCCESS)
 412         pgnutls_perror(ret);
 413     return (ret == GNUTLS_E_SUCCESS);
 414 }
 415
 416 void schan_imp_free_certificate_credentials(schan_imp_certificate_credentials c)
 417 {
 418     pgnutls_certificate_free_credentials((gnutls_certificate_credentials_t)c);
 419 }
 420
 421 static void schan_gnutls_log(int level, const char *msg)
 422 {
 423     TRACE("<%d> %s", level, msg);
 424 }
 425
 426 BOOL schan_imp_init(void)
 427 {
 428     int ret;
 429
 430     libgnutls_handle = wine_dlopen(SONAME_LIBGNUTLS, RTLD_NOW, NULL, 0);
 431     if (!libgnutls_handle)
 432     {
 433         WARN("Failed to load libgnutls.\n");
 434         return FALSE;
 435     }
 436
 437 #define LOAD_FUNCPTR(f) \
 438     if (!(p##f = wine_dlsym(libgnutls_handle, #f, NULL, 0))) \
 439     { \
 440         ERR("Failed to load %s\n", #f); \
 441         goto fail; \
 442     }
 443
 444     LOAD_FUNCPTR(gnutls_alert_get)
 445     LOAD_FUNCPTR(gnutls_alert_get_name)
 446     LOAD_FUNCPTR(gnutls_certificate_allocate_credentials)
 447     LOAD_FUNCPTR(gnutls_certificate_free_credentials)
 448     LOAD_FUNCPTR(gnutls_certificate_get_peers)
 449     LOAD_FUNCPTR(gnutls_cipher_get)
 450     LOAD_FUNCPTR(gnutls_cipher_get_key_size)
 451     LOAD_FUNCPTR(gnutls_credentials_set)
 452     LOAD_FUNCPTR(gnutls_deinit)
 453     LOAD_FUNCPTR(gnutls_global_deinit)
 454     LOAD_FUNCPTR(gnutls_global_init)
 455     LOAD_FUNCPTR(gnutls_global_set_log_function)
 456     LOAD_FUNCPTR(gnutls_global_set_log_level)
 457     LOAD_FUNCPTR(gnutls_handshake)
 458     LOAD_FUNCPTR(gnutls_init)
 459     LOAD_FUNCPTR(gnutls_kx_get)
 460     LOAD_FUNCPTR(gnutls_mac_get)
 461     LOAD_FUNCPTR(gnutls_mac_get_key_size)
 462     LOAD_FUNCPTR(gnutls_perror)
 463     LOAD_FUNCPTR(gnutls_protocol_get_version)
 464     LOAD_FUNCPTR(gnutls_set_default_priority)
 465     LOAD_FUNCPTR(gnutls_record_get_max_size);
 466     LOAD_FUNCPTR(gnutls_record_recv);
 467     LOAD_FUNCPTR(gnutls_record_send);
 468     LOAD_FUNCPTR(gnutls_transport_get_ptr)
 469     LOAD_FUNCPTR(gnutls_transport_set_errno)
 470     LOAD_FUNCPTR(gnutls_transport_set_ptr)
 471     LOAD_FUNCPTR(gnutls_transport_set_pull_function)
 472     LOAD_FUNCPTR(gnutls_transport_set_push_function)
 473 #undef LOAD_FUNCPTR
 474
 475     ret = pgnutls_global_init();
 476     if (ret != GNUTLS_E_SUCCESS)
 477     {
 478         pgnutls_perror(ret);
 479         goto fail;
 480     }
 481
 482     if (TRACE_ON(secur32))
 483     {
 484         pgnutls_global_set_log_level(4);
 485         pgnutls_global_set_log_function(schan_gnutls_log);
 486     }
 487
 488     return TRUE;
 489
 490 fail:
 491     wine_dlclose(libgnutls_handle, NULL, 0);
 492     libgnutls_handle = NULL;
 493     return FALSE;
 494 }
 495
 496 void schan_imp_deinit(void)
 497 {
 498     pgnutls_global_deinit();
 499     wine_dlclose(libgnutls_handle, NULL, 0);
 500     libgnutls_handle = NULL;
 501 }
 502
 503 #endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H */