2 * GnuTLS-based implementation of the schannel (SSL/TLS) provider.
4 * Copyright 2005 Juan Lang
5 * Copyright 2008 Henri Verbeet
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
24 #include <wine/config.h>
25 #include <wine/port.h>
28 #ifdef SONAME_LIBGNUTLS
29 #include <gnutls/gnutls.h>
30 #include <gnutls/crypto.h>
33 #define __wine_dbch_secur32 __wine_dbch_schannel
35 #if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H)
37 static void *libgnutls_handle
;
38 #if (_MSC_VER >= 1600)
39 #define MAKE_FUNCPTR(f) static decltype(f) p##f
41 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
43 MAKE_FUNCPTR(gnutls_alert_get
);
44 MAKE_FUNCPTR(gnutls_alert_get_name
);
45 MAKE_FUNCPTR(gnutls_certificate_allocate_credentials
);
46 MAKE_FUNCPTR(gnutls_certificate_free_credentials
);
47 MAKE_FUNCPTR(gnutls_certificate_get_peers
);
48 MAKE_FUNCPTR(gnutls_cipher_get
);
49 MAKE_FUNCPTR(gnutls_cipher_get_key_size
);
50 MAKE_FUNCPTR(gnutls_credentials_set
);
51 MAKE_FUNCPTR(gnutls_deinit
);
52 MAKE_FUNCPTR(gnutls_global_deinit
);
53 MAKE_FUNCPTR(gnutls_global_init
);
54 MAKE_FUNCPTR(gnutls_global_set_log_function
);
55 MAKE_FUNCPTR(gnutls_global_set_log_level
);
56 MAKE_FUNCPTR(gnutls_handshake
);
57 MAKE_FUNCPTR(gnutls_init
);
58 MAKE_FUNCPTR(gnutls_kx_get
);
59 MAKE_FUNCPTR(gnutls_mac_get
);
60 MAKE_FUNCPTR(gnutls_mac_get_key_size
);
61 MAKE_FUNCPTR(gnutls_perror
);
62 MAKE_FUNCPTR(gnutls_protocol_get_version
);
63 MAKE_FUNCPTR(gnutls_priority_set_direct
);
64 MAKE_FUNCPTR(gnutls_record_get_max_size
);
65 MAKE_FUNCPTR(gnutls_record_recv
);
66 MAKE_FUNCPTR(gnutls_record_send
);
67 MAKE_FUNCPTR(gnutls_server_name_set
);
68 MAKE_FUNCPTR(gnutls_transport_get_ptr
);
69 MAKE_FUNCPTR(gnutls_transport_set_errno
);
70 MAKE_FUNCPTR(gnutls_transport_set_ptr
);
71 MAKE_FUNCPTR(gnutls_transport_set_pull_function
);
72 MAKE_FUNCPTR(gnutls_transport_set_push_function
);
77 static ssize_t
schan_pull_adapter(gnutls_transport_ptr_t transport
,
78 void *buff
, size_t buff_len
)
80 struct schan_transport
*t
= (struct schan_transport
*)transport
;
81 gnutls_session_t s
= (gnutls_session_t
)schan_session_for_transport(t
);
83 int ret
= schan_pull(transport
, buff
, &buff_len
);
86 pgnutls_transport_set_errno(s
, ret
);
93 static ssize_t
schan_push_adapter(gnutls_transport_ptr_t transport
,
94 const void *buff
, size_t buff_len
)
96 struct schan_transport
*t
= (struct schan_transport
*)transport
;
97 gnutls_session_t s
= (gnutls_session_t
)schan_session_for_transport(t
);
99 int ret
= schan_push(transport
, buff
, &buff_len
);
102 pgnutls_transport_set_errno(s
, ret
);
109 static const struct {
111 const char *gnutls_flag
;
112 } protocol_priority_flags
[] = {
113 {SP_PROT_TLS1_2_CLIENT
, "VERS-TLS1.2"},
114 {SP_PROT_TLS1_1_CLIENT
, "VERS-TLS1.1"},
115 {SP_PROT_TLS1_0_CLIENT
, "VERS-TLS1.0"},
116 {SP_PROT_SSL3_CLIENT
, "VERS-SSL3.0"}
117 /* {SP_PROT_SSL2_CLIENT} is not supported by GnuTLS */
120 DWORD
schan_imp_enabled_protocols(void)
122 /* NOTE: No support for SSL 2.0 */
123 return SP_PROT_SSL3_CLIENT
| SP_PROT_TLS1_0_CLIENT
| SP_PROT_TLS1_1_CLIENT
| SP_PROT_TLS1_2_CLIENT
;
126 BOOL
schan_imp_create_session(schan_imp_session
*session
, schan_credentials
*cred
)
128 gnutls_session_t
*s
= (gnutls_session_t
*)session
;
129 char priority
[64] = "NORMAL", *p
;
132 int err
= pgnutls_init(s
, cred
->credential_use
== SECPKG_CRED_INBOUND
? GNUTLS_SERVER
: GNUTLS_CLIENT
);
133 if (err
!= GNUTLS_E_SUCCESS
)
139 p
= priority
+ strlen(priority
);
140 for(i
=0; i
< sizeof(protocol_priority_flags
)/sizeof(*protocol_priority_flags
); i
++) {
142 *p
++ = (cred
->enabled_protocols
& protocol_priority_flags
[i
].enable_flag
) ? '+' : '-';
143 strcpy(p
, protocol_priority_flags
[i
].gnutls_flag
);
147 TRACE("Using %s priority\n", debugstr_a(priority
));
148 err
= pgnutls_priority_set_direct(*s
, priority
, NULL
);
149 if (err
!= GNUTLS_E_SUCCESS
)
156 err
= pgnutls_credentials_set(*s
, GNUTLS_CRD_CERTIFICATE
,
157 (gnutls_certificate_credentials_t
)cred
->credentials
);
158 if (err
!= GNUTLS_E_SUCCESS
)
165 pgnutls_transport_set_pull_function(*s
, schan_pull_adapter
);
166 pgnutls_transport_set_push_function(*s
, schan_push_adapter
);
171 void schan_imp_dispose_session(schan_imp_session session
)
173 gnutls_session_t s
= (gnutls_session_t
)session
;
177 void schan_imp_set_session_transport(schan_imp_session session
,
178 struct schan_transport
*t
)
180 gnutls_session_t s
= (gnutls_session_t
)session
;
181 pgnutls_transport_set_ptr(s
, (gnutls_transport_ptr_t
)t
);
184 void schan_imp_set_session_target(schan_imp_session session
, const char *target
)
186 gnutls_session_t s
= (gnutls_session_t
)session
;
188 pgnutls_server_name_set( s
, GNUTLS_NAME_DNS
, target
, strlen(target
) );
191 SECURITY_STATUS
schan_imp_handshake(schan_imp_session session
)
193 gnutls_session_t s
= (gnutls_session_t
)session
;
197 err
= pgnutls_handshake(s
);
199 case GNUTLS_E_SUCCESS
:
200 TRACE("Handshake completed\n");
204 TRACE("Continue...\n");
205 return SEC_I_CONTINUE_NEEDED
;
207 case GNUTLS_E_WARNING_ALERT_RECEIVED
:
209 gnutls_alert_description_t alert
= pgnutls_alert_get(s
);
211 WARN("WARNING ALERT: %d %s\n", alert
, pgnutls_alert_get_name(alert
));
214 case GNUTLS_A_UNRECOGNIZED_NAME
:
218 return SEC_E_INTERNAL_ERROR
;
222 case GNUTLS_E_FATAL_ALERT_RECEIVED
:
224 gnutls_alert_description_t alert
= pgnutls_alert_get(s
);
225 WARN("FATAL ALERT: %d %s\n", alert
, pgnutls_alert_get_name(alert
));
226 return SEC_E_INTERNAL_ERROR
;
231 return SEC_E_INTERNAL_ERROR
;
239 static unsigned int schannel_get_cipher_block_size(gnutls_cipher_algorithm_t cipher
)
243 gnutls_cipher_algorithm_t cipher
;
244 unsigned int block_size
;
248 {GNUTLS_CIPHER_3DES_CBC
, 8},
249 {GNUTLS_CIPHER_AES_128_CBC
, 16},
250 {GNUTLS_CIPHER_AES_256_CBC
, 16},
251 {GNUTLS_CIPHER_ARCFOUR_128
, 1},
252 {GNUTLS_CIPHER_ARCFOUR_40
, 1},
253 {GNUTLS_CIPHER_DES_CBC
, 8},
254 {GNUTLS_CIPHER_NULL
, 1},
255 {GNUTLS_CIPHER_RC2_40_CBC
, 8},
259 for (i
= 0; i
< sizeof(algorithms
) / sizeof(*algorithms
); ++i
)
261 if (algorithms
[i
].cipher
== cipher
)
262 return algorithms
[i
].block_size
;
265 FIXME("Unknown cipher %#x, returning 1\n", cipher
);
270 static DWORD
schannel_get_protocol(gnutls_protocol_t proto
)
272 /* FIXME: currently schannel only implements client connections, but
273 * there's no reason it couldn't be used for servers as well. The
274 * context doesn't tell us which it is, so assume client for now.
278 case GNUTLS_SSL3
: return SP_PROT_SSL3_CLIENT
;
279 case GNUTLS_TLS1_0
: return SP_PROT_TLS1_0_CLIENT
;
280 case GNUTLS_TLS1_1
: return SP_PROT_TLS1_1_CLIENT
;
281 case GNUTLS_TLS1_2
: return SP_PROT_TLS1_2_CLIENT
;
283 FIXME("unknown protocol %d\n", proto
);
288 static ALG_ID
schannel_get_cipher_algid(gnutls_cipher_algorithm_t cipher
)
292 case GNUTLS_CIPHER_UNKNOWN
:
293 case GNUTLS_CIPHER_NULL
: return 0;
294 case GNUTLS_CIPHER_ARCFOUR_40
:
295 case GNUTLS_CIPHER_ARCFOUR_128
: return CALG_RC4
;
296 case GNUTLS_CIPHER_DES_CBC
:
297 case GNUTLS_CIPHER_3DES_CBC
: return CALG_DES
;
298 case GNUTLS_CIPHER_AES_128_CBC
:
299 case GNUTLS_CIPHER_AES_256_CBC
: return CALG_AES
;
300 case GNUTLS_CIPHER_RC2_40_CBC
: return CALG_RC2
;
302 FIXME("unknown algorithm %d\n", cipher
);
307 static ALG_ID
schannel_get_mac_algid(gnutls_mac_algorithm_t mac
)
311 case GNUTLS_MAC_UNKNOWN
:
312 case GNUTLS_MAC_NULL
: return 0;
313 case GNUTLS_MAC_MD5
: return CALG_MD5
;
314 case GNUTLS_MAC_SHA1
:
315 case GNUTLS_MAC_SHA256
:
316 case GNUTLS_MAC_SHA384
:
317 case GNUTLS_MAC_SHA512
: return CALG_SHA
;
319 FIXME("unknown algorithm %d\n", mac
);
324 static ALG_ID
schannel_get_kx_algid(gnutls_kx_algorithm_t kx
)
328 case GNUTLS_KX_RSA
: return CALG_RSA_KEYX
;
329 case GNUTLS_KX_DHE_DSS
:
330 case GNUTLS_KX_DHE_RSA
: return CALG_DH_EPHEM
;
332 FIXME("unknown algorithm %d\n", kx
);
337 unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session
)
339 gnutls_session_t s
= (gnutls_session_t
)session
;
340 gnutls_cipher_algorithm_t cipher
= pgnutls_cipher_get(s
);
341 return schannel_get_cipher_block_size(cipher
);
344 unsigned int schan_imp_get_max_message_size(schan_imp_session session
)
346 return pgnutls_record_get_max_size((gnutls_session_t
)session
);
349 SECURITY_STATUS
schan_imp_get_connection_info(schan_imp_session session
,
350 SecPkgContext_ConnectionInfo
*info
)
352 gnutls_session_t s
= (gnutls_session_t
)session
;
353 gnutls_protocol_t proto
= pgnutls_protocol_get_version(s
);
354 gnutls_cipher_algorithm_t alg
= pgnutls_cipher_get(s
);
355 gnutls_mac_algorithm_t mac
= pgnutls_mac_get(s
);
356 gnutls_kx_algorithm_t kx
= pgnutls_kx_get(s
);
358 info
->dwProtocol
= schannel_get_protocol(proto
);
359 info
->aiCipher
= schannel_get_cipher_algid(alg
);
360 info
->dwCipherStrength
= pgnutls_cipher_get_key_size(alg
) * 8;
361 info
->aiHash
= schannel_get_mac_algid(mac
);
362 info
->dwHashStrength
= pgnutls_mac_get_key_size(mac
) * 8;
363 info
->aiExch
= schannel_get_kx_algid(kx
);
364 /* FIXME: info->dwExchStrength? */
365 info
->dwExchStrength
= 0;
369 SECURITY_STATUS
schan_imp_get_session_peer_certificate(schan_imp_session session
, HCERTSTORE store
,
372 gnutls_session_t s
= (gnutls_session_t
)session
;
373 PCCERT_CONTEXT cert
= NULL
;
374 const gnutls_datum_t
*datum
;
375 unsigned list_size
, i
;
378 datum
= pgnutls_certificate_get_peers(s
, &list_size
);
380 return SEC_E_INTERNAL_ERROR
;
382 for(i
= 0; i
< list_size
; i
++) {
383 res
= CertAddEncodedCertificateToStore(store
, X509_ASN_ENCODING
, datum
[i
].data
, datum
[i
].size
,
384 CERT_STORE_ADD_REPLACE_EXISTING
, i
? NULL
: &cert
);
387 CertFreeCertificateContext(cert
);
388 return GetLastError();
396 SECURITY_STATUS
schan_imp_send(schan_imp_session session
, const void *buffer
,
399 gnutls_session_t s
= (gnutls_session_t
)session
;
403 ret
= pgnutls_record_send(s
, buffer
, *length
);
407 else if (ret
== GNUTLS_E_AGAIN
)
409 struct schan_transport
*t
= (struct schan_transport
*)pgnutls_transport_get_ptr(s
);
412 if (schan_get_buffer(t
, &t
->out
, &count
))
415 return SEC_I_CONTINUE_NEEDED
;
420 return SEC_E_INTERNAL_ERROR
;
426 SECURITY_STATUS
schan_imp_recv(schan_imp_session session
, void *buffer
,
429 gnutls_session_t s
= (gnutls_session_t
)session
;
433 ret
= pgnutls_record_recv(s
, buffer
, *length
);
437 else if (ret
== GNUTLS_E_AGAIN
)
439 struct schan_transport
*t
= (struct schan_transport
*)pgnutls_transport_get_ptr(s
);
442 if (schan_get_buffer(t
, &t
->in
, &count
))
445 return SEC_I_CONTINUE_NEEDED
;
450 return SEC_E_INTERNAL_ERROR
;
456 BOOL
schan_imp_allocate_certificate_credentials(schan_credentials
*c
)
458 int ret
= pgnutls_certificate_allocate_credentials((gnutls_certificate_credentials_t
*)&c
->credentials
);
459 if (ret
!= GNUTLS_E_SUCCESS
)
461 return (ret
== GNUTLS_E_SUCCESS
);
464 void schan_imp_free_certificate_credentials(schan_credentials
*c
)
466 pgnutls_certificate_free_credentials(c
->credentials
);
469 static void schan_gnutls_log(int level
, const char *msg
)
471 TRACE("<%d> %s", level
, msg
);
474 BOOL
schan_imp_init(void)
479 libgnutls_handle
= wine_dlopen(SONAME_LIBGNUTLS
, RTLD_NOW
, NULL
, 0);
480 if (!libgnutls_handle
)
482 WARN("Failed to load libgnutls.\n");
486 #define LOAD_FUNCPTR(f) \
487 if (!(p##f = wine_dlsym(libgnutls_handle, #f, NULL, 0))) \
489 ERR("Failed to load %s\n", #f); \
494 static const WCHAR RosSchannelKey[] = L"Software\\ReactOS\\Schannel";
495 static const WCHAR PathValue[] = L"GnuTLSPath";
496 WCHAR Path[MAX_PATH];
497 DWORD PathSize = sizeof(Path), ValueType;
501 Error = RegOpenKeyW(HKEY_LOCAL_MACHINE, RosSchannelKey, &Key);
502 if(Error != ERROR_SUCCESS)
505 Error = RegQueryValueExW(Key, PathValue, NULL, &ValueType, (LPBYTE)Path, &PathSize);
507 if ((Error != ERROR_SUCCESS) || (ValueType != REG_SZ))
510 wcscat(Path, SONAME_LIBGNUTLS);
512 static const WCHAR Path
[] = L
"C:\\Reactos\\system32\\gnutls\\libgnutls-28.dll";
514 libgnutls_handle
= LoadLibraryExW(Path
, NULL
, LOAD_WITH_ALTERED_SEARCH_PATH
);
515 if (!libgnutls_handle
)
517 ERR("Could not load %S.\n", Path
);
521 #define LOAD_FUNCPTR(f) \
522 if (!(p##f = (void*)GetProcAddress(libgnutls_handle, #f))) \
524 ERR("Failed to load %s\n", #f); \
527 #endif // __REACTOS__
529 LOAD_FUNCPTR(gnutls_alert_get
)
530 LOAD_FUNCPTR(gnutls_alert_get_name
)
531 LOAD_FUNCPTR(gnutls_certificate_allocate_credentials
)
532 LOAD_FUNCPTR(gnutls_certificate_free_credentials
)
533 LOAD_FUNCPTR(gnutls_certificate_get_peers
)
534 LOAD_FUNCPTR(gnutls_cipher_get
)
535 LOAD_FUNCPTR(gnutls_cipher_get_key_size
)
536 LOAD_FUNCPTR(gnutls_credentials_set
)
537 LOAD_FUNCPTR(gnutls_deinit
)
538 LOAD_FUNCPTR(gnutls_global_deinit
)
539 LOAD_FUNCPTR(gnutls_global_init
)
540 LOAD_FUNCPTR(gnutls_global_set_log_function
)
541 LOAD_FUNCPTR(gnutls_global_set_log_level
)
542 LOAD_FUNCPTR(gnutls_handshake
)
543 LOAD_FUNCPTR(gnutls_init
)
544 LOAD_FUNCPTR(gnutls_kx_get
)
545 LOAD_FUNCPTR(gnutls_mac_get
)
546 LOAD_FUNCPTR(gnutls_mac_get_key_size
)
547 LOAD_FUNCPTR(gnutls_perror
)
548 LOAD_FUNCPTR(gnutls_protocol_get_version
)
549 LOAD_FUNCPTR(gnutls_priority_set_direct
)
550 LOAD_FUNCPTR(gnutls_record_get_max_size
);
551 LOAD_FUNCPTR(gnutls_record_recv
);
552 LOAD_FUNCPTR(gnutls_record_send
);
553 LOAD_FUNCPTR(gnutls_server_name_set
)
554 LOAD_FUNCPTR(gnutls_transport_get_ptr
)
555 LOAD_FUNCPTR(gnutls_transport_set_errno
)
556 LOAD_FUNCPTR(gnutls_transport_set_ptr
)
557 LOAD_FUNCPTR(gnutls_transport_set_pull_function
)
558 LOAD_FUNCPTR(gnutls_transport_set_push_function
)
561 ret
= pgnutls_global_init();
562 if (ret
!= GNUTLS_E_SUCCESS
)
568 if (TRACE_ON(secur32
))
570 pgnutls_global_set_log_level(4);
571 pgnutls_global_set_log_function(schan_gnutls_log
);
578 wine_dlclose(libgnutls_handle
, NULL
, 0);
580 FreeLibrary(libgnutls_handle
);
582 libgnutls_handle
= NULL
;
586 void schan_imp_deinit(void)
588 pgnutls_global_deinit();
590 wine_dlclose(libgnutls_handle
, NULL
, 0);
592 FreeLibrary(libgnutls_handle
);
594 libgnutls_handle
= NULL
;
597 #endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H */