1

     2

#include "sock_gnutls.h"

     3

     4

// XXX: remove

     5

#include "log.h"

     6

     7

#include <gnutls/x509.h>

     8

     9

#include <stdlib.h>

    10

#include <string.h>

    11

#include <time.h>

    12

    13

#include <assert.h>

    14

    15

/**

    16

 * Enable the TCP events based on the session's gnutls_record_get_direction().

    17

 */

    18

static err_t sock_gnutls_ev_enable (struct sock_gnutls *sock, error_t *err)

    19

{

    20

    int ret;

    21

    short mask;

    22

    23

    // gnutls_record_get_direction tells us what I/O operation gnutls would have required for the last

    24

    // operation, so we can use that to determine what events to register

    25

    switch ((ret = gnutls_record_get_direction(sock->session))) {

    26

        case 0: 

    27

            // read more data

    28

            mask = TRANSPORT_READ;

    29

            break;

    30

    31

        case 1:

    32

            // write buffer full

    33

            mask = TRANSPORT_WRITE;

    34

            break;

    35

    36

        default:

    37

            // random error

    38

            RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_GET_DIRECTION, ret);

    39

    }

    40

    41

    // do the enabling

    42

    if ((ERROR_CODE(err) = transport_fd_enable(SOCK_GNUTLS_FD(sock), mask)))

    43

        return ERROR_CODE(err);

    44

    45

    46

    return SUCCESS;

    47

}

    48

    49

/**

    50

 * Translate a set of gnutls_certificate_status_t values to a constant error message

    51

 */

    52

static const char* sock_gnutls_verify_error (unsigned int status)

    53

{

    54

    if (status & GNUTLS_CERT_REVOKED)

    55

        return "certificate was revoked";

    56

    57

    else if (status & GNUTLS_CERT_INVALID) {

    58

        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)

    59

            return "certificate signer was not found";

    60

    61

        else if (status & GNUTLS_CERT_SIGNER_NOT_CA)

    62

            return "certificate signer is not a Certificate Authority";

    63

    64

        else if (status & GNUTLS_CERT_INSECURE_ALGORITHM)

    65

            return "certificate signed using an insecure algorithm";

    66

    67

        else

    68

            return "certificate could not be verified";

    69

    70

    } else

    71

        return "unknown error";

    72

    73

}

    74

    75

/**

    76

 * Perform the certificate validation procedure on the socket.

    77

 *

    78

 * Based on the GnuTLS examples/ex-rfc2818.c

    79

 */

    80

static err_t sock_gnutls_verify (struct sock_gnutls *sock, error_t *err)

    81

{

    82

    unsigned int status;

    83

    const gnutls_datum_t *cert_list;

    84

    unsigned int cert_list_size;

    85

    gnutls_x509_crt_t cert = NULL;

    86

    time_t t, now;

    87

    88

    // init

    89

    RESET_ERROR(err);

    90

    now = time(NULL);

    91

    92

    // inspect the peer's cert chain using the installed trusted CAs

    93

    if ((ERROR_EXTRA(err) = gnutls_certificate_verify_peers2(sock->session, &status)))

    94

        JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_VERIFY_PEERS2);

    95

    96

    // verify errors?

    97

    if (status)

    98

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, sock_gnutls_verify_error(status));

    99

   100

    // import the main cert

   101

    assert(gnutls_certificate_type_get(sock->session) == GNUTLS_CRT_X509);

   102

   103

    if ((ERROR_EXTRA(err) = gnutls_x509_crt_init(&cert)))

   104

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_init");

   105

   106

    if ((cert_list = gnutls_certificate_get_peers(sock->session, &cert_list_size)) == NULL)

   107

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_certificate_get_peers");

   108

   109

    if (!cert_list_size)

   110

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "cert_list_size");

   111

   112

    if ((ERROR_EXTRA(err) = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER)))

   113

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_import");

   114

   115

    // check expire/activate... not sure if we need to do this

   116

    if ((t = gnutls_x509_crt_get_expiration_time(cert)) == ((time_t) -1) || t < now)

   117

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_get_expiration_time");

   118

   119

    if ((t = gnutls_x509_crt_get_activation_time(cert)) == ((time_t) -1) || t > now)

   120

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_get_activation_time");

   121

   122

    // check hostname

   123

    if (!gnutls_x509_crt_check_hostname(cert, sock->hostname))

   124

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_check_hostname");

   125

   126

error:

   127

    // cleanup

   128

    if (cert)

   129

        gnutls_x509_crt_deinit(cert);

   130

   131

    // should be SUCCESS

   132

    return ERROR_CODE(err);    

   133

}

   134

   135

   136

/**

   137

 * Our handshake driver. This will execute the next gnutls_handshake step, handling E_AGAIN.

   138

 *

   139

 * This updates the sock_gnutls::handshake state internally, as used by sock_gnutls_event_handler.

   140

 *

   141

 * If the sock is marked as verify, this will perform the verification, returning on any errors, and then unset the

   142

 * verify flag - this ensures that the peer cert is only verified once per connection...

   143

 *

   144

 * @return >0 for finished handshake, 0 for handshake-in-progress, -err_t for errors.

   145

 */

   146

static int sock_gnutls_handshake (struct sock_gnutls *sock, error_t *err)

   147

{

   148

    int ret;

   149

   150

    // perform the handshake

   151

    if ((ret = gnutls_handshake(sock->session)) < 0 && ret != GNUTLS_E_AGAIN)

   152

        JUMP_SET_ERROR_EXTRA(err, ERR_GNUTLS_HANDSHAKE, ret);

   153

   154

    // complete?

   155

    if (ret == 0) {

   156

        // update state

   157

        sock->handshake = false;

   158

   159

        // verify?

   160

        if (sock->verify) {

   161

            // perform the validation

   162

            if (sock_gnutls_verify(sock, err))

   163

                goto error;

   164

   165

            // unmark

   166

            sock->verify = false;

   167

        }

   168

   169

        // handshake done

   170

        return 1;

   171

   172

    } else {

   173

        // set state, isn't really needed every time, but easier this way

   174

        sock->handshake = true;

   175

   176

        // re-enable the event for the next iteration

   177

        return sock_gnutls_ev_enable(sock, err);

   178

    }

   179

   180

error:

   181

    return -ERROR_CODE(err);    

   182

}

   183

   184

/**

   185

 * Our transport_fd event handler. Drive the handshake if that's current, otherwise, invoke user callbacks.

   186

 */

   187

static void sock_gnutls_on_event (struct transport_fd *fd, short what, void *arg)

   188

{

   189

    struct sock_gnutls *sock = arg;

   190

    error_t err;

   191

   192

    (void) fd;

   193

   194

    // XXX: timeouts

   195

    (void) what;

   196

   197

    // are we in the handshake cycle?

   198

    if (sock->handshake) {

   199

        RESET_ERROR(&err);

   200

   201

        // perform the next handshake step

   202

        if (sock_gnutls_handshake(sock, &err) == 0) {

   203

            // handshake continues

   204

   205

            // XXX: this state flag is completely wrong

   206

        } else if (SOCK_GNUTLS_TRANSPORT(sock)->connected) {

   207

            // the async connect process has now completed, either succesfully or with an error

   208

            // invoke the user connect callback directly with appropriate error

   209

            transport_connected(SOCK_GNUTLS_TRANSPORT(sock), ERROR_CODE(&err) ? &err : NULL, true);

   210

   211

        } else {

   212

            if (ERROR_CODE(&err))

   213

                // the re-handshake failed, so this transport is dead

   214

                transport_error(SOCK_GNUTLS_TRANSPORT(sock), &err);

   215

   216

            else

   217

                // re-handshake completed, so continue with the transport_callbacks

   218

                transport_invoke(SOCK_GNUTLS_TRANSPORT(sock), what);

   219

        }

   220

   221

    } else {

   222

        // normal sock_stream operation

   223

        // gnutls might be able to proceed now, so invoke user callbacks

   224

        transport_invoke(SOCK_GNUTLS_TRANSPORT(sock), what);

   225

    }

   226

}

   227

   228

static err_t sock_gnutls_read (transport_t *transport, void *buf, size_t *len, error_t *err)

   229

{

   230

    struct sock_gnutls *sock = transport_check(transport, &sock_gnutls_type);

   231

    int ret;

   232

   233

    // read gnutls record

   234

    do {

   235

        ret = gnutls_record_recv(sock->session, buf, *len);

   236

   237

    } while (ret == GNUTLS_E_INTERRUPTED);

   238

   239

    // errors

   240

    // XXX: E_REHANDSHAKE?

   241

    if (ret < 0 && ret != GNUTLS_E_AGAIN)

   242

        RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_RECV, ret);

   243

   244

    else if (ret == 0)

   245

        return SET_ERROR(err, ERR_EOF);

   246

   247

   248

    // EAGAIN?

   249

    if (ret < 0) {

   250

        *len = 0;

   251

   252

    } else {

   253

        // updated length

   254

        *len = ret;

   255

   256

    }

   257

   258

    return SUCCESS;

   259

}

   260

   261

static err_t sock_gnutls_write (transport_t *transport, const void *buf, size_t *len, error_t *err)

   262

{

   263

    struct sock_gnutls *sock = transport_check(transport, &sock_gnutls_type);

   264

    int ret;

   265

   266

    // read gnutls record

   267

    do {

   268

        ret = gnutls_record_send(sock->session, buf, *len);

   269

   270

    } while (ret == GNUTLS_E_INTERRUPTED);

   271

   272

    // errors

   273

    if (ret < 0 && ret != GNUTLS_E_AGAIN)

   274

        RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_SEND, ret);

   275

   276

    else if (ret == 0)

   277

        return SET_ERROR(err, ERR_WRITE_EOF);

   278

   279

   280

    // eagain?

   281

    if (ret < 0) {

   282

        *len = 0;

   283

   284

    } else {

   285

        // updated length

   286

        *len = ret;

   287

    }

   288

   289

    return SUCCESS;

   290

}

   291

   292

static void _sock_gnutls_destroy (transport_t *transport)

   293

{

   294

    struct sock_gnutls *sock = transport_check(transport, &sock_gnutls_type);

   295

   296

    // die

   297

    sock_gnutls_destroy(sock);

   298

}

   299

   300

/**

   301

 * Our sock_tcp-invoked connect handler

   302

 */

   303

static void sock_gnutls__connected (transport_t *transport, const error_t *tcp_err)

   304

{

   305

    struct sock_gnutls *sock = transport_check(transport, &sock_gnutls_type);

   306

    error_t err;

   307

   308

    // trap errors to let the user handle them directly

   309

    if (tcp_err)

   310

        JUMP_SET_ERROR_INFO(&err, tcp_err);

   311

   312

    // bind default transport functions (recv/send) to use the TCP fd

   313

    gnutls_transport_set_ptr(sock->session, (gnutls_transport_ptr_t) (long int) SOCK_GNUTLS_FD(sock)->fd);

   314

   315

    // add ourselves as the event handler

   316

    if ((ERROR_CODE(&err) = transport_fd_setup(SOCK_GNUTLS_FD(sock), sock_gnutls_on_event, sock)))

   317

        goto error;

   318

   319

    // start handshake

   320

    if (sock_gnutls_handshake(sock, &err))

   321

        // this should complete with SUCCESS if it returns >0

   322

        goto error;

   323

   324

    // ok, so we wait...

   325

    return;

   326

   327

error:

   328

    // tell the user

   329

    transport_connected(transport, &err, true);

   330

}

   331

   332

struct transport_type sock_gnutls_type = {

   333

    .parent                 = &sock_tcp_type,

   334

    .methods                = {

   335

        .read               = sock_gnutls_read,

   336

        .write              = sock_gnutls_write,

   337

        .destroy            = _sock_gnutls_destroy,

   338

        ._connected         = sock_gnutls__connected,

   339

    },

   340

};

   341

   342

/*

   343

 * Global shared anonymous client credentials

   344

 */

   345

static struct sock_ssl_client_cred sock_gnutls_client_cred_anon = { .x509 = NULL, .verify = false, .refcount = 0 };

   346

   347

// XXX: GnuTLS log func

   348

void _log (int level, const char *msg)

   349

{

   350

    printf("gnutls: %d: %s", level, msg);

   351

}

   352

   353

err_t sock_gnutls_global_init (error_t *err)

   354

{

   355

    // global init

   356

    if ((ERROR_EXTRA(err) = gnutls_global_init()) < 0)

   357

        return SET_ERROR(err, ERR_GNUTLS_GLOBAL_INIT);

   358

   359

    // initialize the anon client credentials

   360

    if ((ERROR_EXTRA(err) = gnutls_certificate_allocate_credentials(&sock_gnutls_client_cred_anon.x509)) < 0)

   361

        return SET_ERROR(err, ERR_GNUTLS_CERT_ALLOC_CRED);

   362

   363

    // XXX: debug

   364

//    gnutls_global_set_log_function(&_log);

   365

//    gnutls_global_set_log_level(11);

   366

   367

    // done

   368

    return SUCCESS;

   369

}

   370

   371

static void sock_ssl_client_cred_destroy (struct sock_ssl_client_cred *cred)

   372

{

   373

    // simple

   374

    gnutls_certificate_free_credentials(cred->x509);

   375

   376

    free(cred);

   377

}

   378

   379

err_t sock_ssl_client_cred_create (struct sock_ssl_client_cred **ctx_cred,

   380

        const char *cafile_path, bool verify,

   381

        const char *cert_path, const char *pkey_path,

   382

        error_t *err

   383

) {

   384

    struct sock_ssl_client_cred *cred;

   385

   386

    // alloc it

   387

    if ((cred = calloc(1, sizeof(*cred))) == NULL)

   388

        return SET_ERROR(err, ERR_CALLOC);

   389

   390

    // create the cert

   391

    if ((ERROR_EXTRA(err) = gnutls_certificate_allocate_credentials(&cred->x509)) < 0)

   392

        JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_ALLOC_CRED);

   393

   394

    // load the trusted ca certs?

   395

    if (cafile_path) {

   396

        // load them

   397

        if ((ERROR_EXTRA(err) = gnutls_certificate_set_x509_trust_file(cred->x509, cafile_path, GNUTLS_X509_FMT_PEM)) < 0)

   398

            JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_SET_X509_TRUST_FILE);

   399

   400

    }

   401

   402

    // set the verify flags?

   403

    cred->verify = verify;

   404

    gnutls_certificate_set_verify_flags(cred->x509, 0);

   405

   406

    // load the client cert?

   407

    if (cert_path || pkey_path) {

   408

        // need both...

   409

        assert(cert_path && pkey_path);

   410

   411

        // load

   412

        if ((ERROR_EXTRA(err) = gnutls_certificate_set_x509_key_file(cred->x509, cert_path, pkey_path, GNUTLS_X509_FMT_PEM)))

   413

            JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_SET_X509_KEY_FILE);

   414

    }

   415

   416

    // ok

   417

    cred->refcount = 1;

   418

    *ctx_cred = cred;

   419

   420

    return SUCCESS;

   421

   422

error:

   423

    // release

   424

    sock_ssl_client_cred_destroy(cred);

   425

   426

    return ERROR_CODE(err);

   427

}

   428

   429

void sock_ssl_client_cred_get (struct sock_ssl_client_cred *cred)

   430

{

   431

    cred->refcount++;

   432

}

   433

   434

void sock_ssl_client_cred_put (struct sock_ssl_client_cred *cred)

   435

{

   436

    if (--cred->refcount == 0)

   437

        sock_ssl_client_cred_destroy(cred);

   438

}

   439

   440

err_t sock_ssl_connect (const struct transport_info *info, transport_t **transport_ptr, 

   441

        const char *hostname, const char *service,

   442

        struct sock_ssl_client_cred *cred,

   443

        error_t *err

   444

    )

   445

{

   446

    struct sock_gnutls *sock = NULL;

   447

   448

    // alloc

   449

    if ((sock = calloc(1, sizeof(*sock))) == NULL)

   450

        return SET_ERROR(err, ERR_CALLOC);

   451

   452

    // initialize base

   453

    transport_init(SOCK_GNUTLS_TRANSPORT(sock), &sock_gnutls_type, info);

   454

   455

    if (!cred) {

   456

        // default credentials

   457

        cred = &sock_gnutls_client_cred_anon;

   458

   459

    } else {

   460

        // take a ref

   461

        sock->cred = cred;

   462

        cred->refcount++;

   463

    };

   464

   465

    // do verify?

   466

    if (cred->verify)

   467

        sock->verify = true;

   468

   469

    // init

   470

    if ((sock->hostname = strdup(hostname)) == NULL)

   471

        JUMP_SET_ERROR(err, ERR_STRDUP);

   472

   473

    // initialize TCP

   474

    sock_tcp_init(SOCK_GNUTLS_TCP(sock));

   475

   476

    // initialize client session

   477

    if ((ERROR_EXTRA(err) = gnutls_init(&sock->session, GNUTLS_CLIENT)) < 0)

   478

        JUMP_SET_ERROR(err, ERR_GNUTLS_INIT);

   479

   480

    // ...default priority stuff

   481

    if ((ERROR_EXTRA(err) = gnutls_set_default_priority(sock->session)))

   482

        JUMP_SET_ERROR(err, ERR_GNUTLS_SET_DEFAULT_PRIORITY);

   483

   484

    // XXX: silly hack for OpenSSL interop

   485

    gnutls_dh_set_prime_bits(sock->session, 512);

   486

   487

    // bind credentials

   488

    if ((ERROR_EXTRA(err) = gnutls_credentials_set(sock->session, GNUTLS_CRD_CERTIFICATE, cred->x509)))

   489

        JUMP_SET_ERROR(err, ERR_GNUTLS_CRED_SET);