1

     2

#include "sock_gnutls.h"

     3

     4

// XXX: remove

     5

#include "log.h"

     6

     7

#include <gnutls/x509.h>

     8

     9

#include <stdlib.h>

    10

#include <string.h>

    11

#include <time.h>

    12

    13

#include <assert.h>

    14

    15

/**

    16

 * Enable the TCP events based on the session's gnutls_record_get_direction().

    17

 */

    18

static err_t sock_gnutls_ev_enable (struct sock_gnutls *sock, error_t *err)

    19

{

    20

    int ret;

    21

    short mask;

    22

    23

    // gnutls_record_get_direction tells us what I/O operation gnutls would have required for the last

    24

    // operation, so we can use that to determine what events to register

    25

    switch ((ret = gnutls_record_get_direction(sock->session))) {

    26

        case 0: 

    27

            // read more data

    28

            mask = TRANSPORT_READ;

    29

            break;

    30

    31

        case 1:

    32

            // write buffer full

    33

            mask = TRANSPORT_WRITE;

    34

            break;

    35

    36

        default:

    37

            // random error

    38

            RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_GET_DIRECTION, ret);

    39

    }

    40

    41

    // do the enabling

    42

    if ((ERROR_CODE(err) = transport_fd_enable(SOCK_GNUTLS_FD(sock), mask)))

    43

        return ERROR_CODE(err);

    44

    45

    46

    return SUCCESS;

    47

}

    48

    49

/**

    50

 * Translate a set of gnutls_certificate_status_t values to a constant error message

    51

 */

    52

static const char* sock_gnutls_verify_error (unsigned int status)

    53

{

    54

    if (status & GNUTLS_CERT_REVOKED)

    55

        return "certificate was revoked";

    56

    57

    else if (status & GNUTLS_CERT_INVALID) {

    58

        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)

    59

            return "certificate signer was not found";

    60

    61

        else if (status & GNUTLS_CERT_SIGNER_NOT_CA)

    62

            return "certificate signer is not a Certificate Authority";

    63

    64

        else if (status & GNUTLS_CERT_INSECURE_ALGORITHM)

    65

            return "certificate signed using an insecure algorithm";

    66

    67

        else

    68

            return "certificate could not be verified";

    69

    70

    } else

    71

        return "unknown error";

    72

    73

}

    74

    75

/**

    76

 * Perform the certificate validation procedure on the socket.

    77

 *

    78

 * Based on the GnuTLS examples/ex-rfc2818.c

    79

 */

    80

static err_t sock_gnutls_verify (struct sock_gnutls *sock, error_t *err)

    81

{

    82

    unsigned int status;

    83

    const gnutls_datum_t *cert_list;

    84

    unsigned int cert_list_size;

    85

    gnutls_x509_crt_t cert = NULL;

    86

    time_t t, now;

    87

    88

    // init

    89

    RESET_ERROR(err);

    90

    now = time(NULL);

    91

    92

    // inspect the peer's cert chain using the installed trusted CAs

    93

    if ((ERROR_EXTRA(err) = gnutls_certificate_verify_peers2(sock->session, &status)))

    94

        JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_VERIFY_PEERS2);

    95

    96

    // verify errors?

    97

    if (status)

    98

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, sock_gnutls_verify_error(status));

    99

   100

    // import the main cert

   101

    assert(gnutls_certificate_type_get(sock->session) == GNUTLS_CRT_X509);

   102

   103

    if ((ERROR_EXTRA(err) = gnutls_x509_crt_init(&cert)))

   104

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_init");

   105

   106

    if ((cert_list = gnutls_certificate_get_peers(sock->session, &cert_list_size)) == NULL)

   107

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_certificate_get_peers");

   108

   109

    if (!cert_list_size)

   110

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "cert_list_size");

   111

   112

    if ((ERROR_EXTRA(err) = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER)))

   113

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_import");

   114

   115

    // check expire/activate... not sure if we need to do this

   116

    if ((t = gnutls_x509_crt_get_expiration_time(cert)) == ((time_t) -1) || t < now)

   117

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_get_expiration_time");

   118

   119

    if ((t = gnutls_x509_crt_get_activation_time(cert)) == ((time_t) -1) || t > now)

   120

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_get_activation_time");

   121

   122

    // check hostname

   123

    if (!gnutls_x509_crt_check_hostname(cert, sock->hostname))

   124

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_check_hostname");

   125

   126

error:

   127

    // cleanup

   128

    if (cert)

   129

        gnutls_x509_crt_deinit(cert);

   130

   131

    // should be SUCCESS

   132

    return ERROR_CODE(err);    

   133

}

   134

   135

   136

/**

   137

 * Our handshake driver. This will execute the next gnutls_handshake step, handling E_AGAIN.

   138

 *

   139

 * This updates the sock_gnutls::handshake state internally, as used by sock_gnutls_event_handler.

   140

 *

   141

 * If the sock is marked as verify, this will perform the verification, returning on any errors, and then unset the

   142

 * verify flag - this ensures that the peer cert is only verified once per connection...

   143

 *

   144

 * @return >0 for finished handshake, 0 for handshake-in-progress, -err_t for errors.

   145

 */

   146

static int sock_gnutls_handshake (struct sock_gnutls *sock, error_t *err)

   147

{

   148

    int ret;

   149

   150

    // perform the handshake

   151

    if ((ret = gnutls_handshake(sock->session)) < 0 && ret != GNUTLS_E_AGAIN)

   152

        JUMP_SET_ERROR_EXTRA(err, ERR_GNUTLS_HANDSHAKE, ret);

   153

   154

    // complete?

   155

    if (ret == 0) {

   156

        // update state

   157

        sock->handshake = false;

   158

   159

        // verify?

   160

        if (sock->verify) {

   161

            // perform the validation

   162

            if (sock_gnutls_verify(sock, err))

   163

                goto error;

   164

   165

            // unmark

   166

            sock->verify = false;

   167

        }

   168

   169

        // handshake done

   170

        return 1;

   171

   172

    } else {

   173

        // set state, isn't really needed every time, but easier this way

   174

        sock->handshake = true;

   175

   176

        // re-enable the event for the next iteration

   177

        return sock_gnutls_ev_enable(sock, err);

   178

    }

   179

   180

error:

   181

    return -ERROR_CODE(err);    

   182

}

   183

   184

/**

   185

 * Our transport_fd event handler. Drive the handshake if that's current, otherwise, invoke user callbacks.

   186

 */

   187

static void sock_gnutls_on_event (struct transport_fd *fd, short what, void *arg)

   188

{

   189

    struct sock_gnutls *sock = arg;

   190

    error_t err;

   191

   192

    (void) fd;

   193

   194

    // XXX: timeouts

   195

    (void) what;

   196

   197

    // are we in the handshake cycle?

   198

    if (sock->handshake) {

   199

        RESET_ERROR(&err);

   200

   201

        // perform the next handshake step

   202

        if (sock_gnutls_handshake(sock, &err) == 0) {

   203

            // handshake continues

   204

   205

        } else if (SOCK_GNUTLS_TRANSPORT(sock)->connected) {

   206

            // the async connect process has now completed, either succesfully or with an error

   207

            // invoke the user connect callback directly with appropriate error

   208

            transport_connected(SOCK_GNUTLS_TRANSPORT(sock), ERROR_CODE(&err) ? &err : NULL, true);

   209

   210

        } else {

   211

            if (ERROR_CODE(&err))

   212

                // the re-handshake failed, so this transport is dead

   213

                transport_error(SOCK_GNUTLS_TRANSPORT(sock), &err);

   214

   215

            else

   216

                // re-handshake completed, so continue with the transport_callbacks

   217

                transport_fd_invoke(SOCK_GNUTLS_FD(sock), what);

   218

        }

   219

   220

    } else {

   221

        // normal sock_stream operation

   222

        // gnutls might be able to proceed now, so invoke user callbacks

   223

        transport_fd_invoke(SOCK_GNUTLS_FD(sock), what);

   224

    }

   225

}

   226

   227

static err_t sock_gnutls_read (transport_t *transport, void *buf, size_t *len, error_t *err)

   228

{

   229

    struct sock_gnutls *sock = transport_check(transport, &sock_gnutls_type);

   230

    int ret;

   231

   232

    // read gnutls record

   233

    do {

   234

        ret = gnutls_record_recv(sock->session, buf, *len);

   235

   236

    } while (ret == GNUTLS_E_INTERRUPTED);

   237

   238

    // errors

   239

    // XXX: E_REHANDSHAKE?

   240

    if (ret < 0 && ret != GNUTLS_E_AGAIN)

   241

        RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_RECV, ret);

   242

   243

    else if (ret == 0)

   244

        return SET_ERROR(err, ERR_READ_EOF);

   245

   246

   247

    // EAGAIN?

   248

    if (ret < 0) {

   249

        *len = 0;

   250

   251

    } else {

   252

        // updated length

   253

        *len = ret;

   254

   255

    }

   256

   257

    return SUCCESS;

   258

}

   259

   260

static err_t sock_gnutls_write (transport_t *transport, const void *buf, size_t *len, error_t *err)

   261

{

   262

    struct sock_gnutls *sock = transport_check(transport, &sock_gnutls_type);

   263

    int ret;

   264

   265

    // read gnutls record

   266

    do {

   267

        ret = gnutls_record_send(sock->session, buf, *len);

   268

   269

    } while (ret == GNUTLS_E_INTERRUPTED);

   270

   271

    // errors

   272

    if (ret < 0 && ret != GNUTLS_E_AGAIN)

   273

        RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_RECV, ret);

   274

   275

    else if (ret == 0)

   276

        return SET_ERROR(err, ERR_READ_EOF);

   277

   278

   279

    // eagain?

   280

    if (ret < 0) {

   281

        *len = 0;

   282

   283

    } else {

   284

        // updated length

   285

        *len = ret;

   286

    }

   287

   288

    return SUCCESS;

   289

}

   290

   291

static void _sock_gnutls_destroy (transport_t *transport)

   292

{

   293

    struct sock_gnutls *sock = transport_check(transport, &sock_gnutls_type);

   294

   295

    // die

   296

    sock_gnutls_destroy(sock);

   297

}

   298

   299

/**

   300

 * Our sock_tcp-invoked connect handler

   301

 */

   302

static void sock_gnutls__connected (transport_t *transport, const error_t *tcp_err)

   303

{

   304

    struct sock_gnutls *sock = transport_check(transport, &sock_gnutls_type);

   305

    error_t err;

   306

   307

    // trap errors to let the user handle them directly

   308

    if (tcp_err)

   309

        JUMP_SET_ERROR_INFO(&err, tcp_err);

   310

   311

    // bind default transport functions (recv/send) to use the TCP fd

   312

    gnutls_transport_set_ptr(sock->session, (gnutls_transport_ptr_t) (long int) SOCK_GNUTLS_FD(sock)->fd);

   313

   314

    // add ourselves as the event handler

   315

    if ((ERROR_CODE(&err) = transport_fd_setup(SOCK_GNUTLS_FD(sock), sock_gnutls_on_event, sock)))

   316

        goto error;

   317

   318

    // start handshake

   319

    if (sock_gnutls_handshake(sock, &err))

   320

        // this should complete with SUCCESS if it returns >0

   321

        goto error;

   322

   323

    // ok, so we wait...

   324

    return;

   325

   326

error:

   327

    // tell the user

   328

    transport_connected(transport, &err, true);

   329

}

   330

   331

struct transport_type sock_gnutls_type = {

   333

    .methods                = {

   334

        .read               = sock_gnutls_read,

   335

        .write              = sock_gnutls_write,

   336

        .destroy            = _sock_gnutls_destroy,

   337

        ._connected         = sock_gnutls__connected,

   338

    },

   339

};

   340

   341

/*

   342

 * Global shared anonymous client credentials

   343

 */

   344

static struct sock_ssl_client_cred sock_gnutls_client_cred_anon = { .x509 = NULL, .verify = false, .refcount = 0 };

   345

   346

// XXX: GnuTLS log func

   347

void _log (int level, const char *msg)

   348

{

   349

    printf("gnutls: %d: %s", level, msg);

   350

}

   351

   352

err_t sock_gnutls_global_init (error_t *err)

   353

{

   354

    // global init

   355

    if ((ERROR_EXTRA(err) = gnutls_global_init()) < 0)

   356

        return SET_ERROR(err, ERR_GNUTLS_GLOBAL_INIT);

   357

   358

    // initialize the anon client credentials

   359

    if ((ERROR_EXTRA(err) = gnutls_certificate_allocate_credentials(&sock_gnutls_client_cred_anon.x509)) < 0)

   360

        return SET_ERROR(err, ERR_GNUTLS_CERT_ALLOC_CRED);

   361

   362

    // XXX: debug

   363

//    gnutls_global_set_log_function(&_log);

   364

//    gnutls_global_set_log_level(11);

   365

   366

    // done

   367

    return SUCCESS;

   368

}

   369

   370

static void sock_ssl_client_cred_destroy (struct sock_ssl_client_cred *cred)

   371

{

   372

    // simple

   373

    gnutls_certificate_free_credentials(cred->x509);

   374

   375

    free(cred);

   376

}

   377

   378

err_t sock_ssl_client_cred_create (struct sock_ssl_client_cred **ctx_cred,

   379

        const char *cafile_path, bool verify,

   380

        const char *cert_path, const char *pkey_path,

   381

        error_t *err

   382

) {

   383

    struct sock_ssl_client_cred *cred;

   384

   385

    // alloc it

   386

    if ((cred = calloc(1, sizeof(*cred))) == NULL)

   387

        return SET_ERROR(err, ERR_CALLOC);

   388

   389

    // create the cert

   390

    if ((ERROR_EXTRA(err) = gnutls_certificate_allocate_credentials(&cred->x509)) < 0)

   391

        JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_ALLOC_CRED);

   392

   393

    // load the trusted ca certs?

   394

    if (cafile_path) {

   395

        // load them

   396

        if ((ERROR_EXTRA(err) = gnutls_certificate_set_x509_trust_file(cred->x509, cafile_path, GNUTLS_X509_FMT_PEM)) < 0)

   397

            JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_SET_X509_TRUST_FILE);

   398

   399

    }

   400

   401

    // set the verify flags?

   402

    cred->verify = verify;

   403

    gnutls_certificate_set_verify_flags(cred->x509, 0);

   404

   405

    // load the client cert?

   406

    if (cert_path || pkey_path) {

   407

        // need both...

   408

        assert(cert_path && pkey_path);

   409

   410

        // load

   411

        if ((ERROR_EXTRA(err) = gnutls_certificate_set_x509_key_file(cred->x509, cert_path, pkey_path, GNUTLS_X509_FMT_PEM)))

   412

            JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_SET_X509_KEY_FILE);

   413

    }

   414

   415

    // ok

   416

    cred->refcount = 1;

   417

    *ctx_cred = cred;

   418

   419

    return SUCCESS;

   420

   421

error:

   422

    // release

   423

    sock_ssl_client_cred_destroy(cred);

   424

   425

    return ERROR_CODE(err);

   426

}

   427

   428

void sock_ssl_client_cred_get (struct sock_ssl_client_cred *cred)

   429

{

   430

    cred->refcount++;

   431

}

   432

   433

void sock_ssl_client_cred_put (struct sock_ssl_client_cred *cred)

   434

{

   435

    if (--cred->refcount == 0)

   436

        sock_ssl_client_cred_destroy(cred);

   437

}

   438

   439

err_t sock_ssl_connect (const struct transport_info *info, transport_t **transport_ptr, 

   440

        const char *hostname, const char *service,

   441

        struct sock_ssl_client_cred *cred,

   442

        error_t *err

   443

    )

   444

{

   445

    struct sock_gnutls *sock = NULL;

   446

   447

    // alloc

   448

    if ((sock = calloc(1, sizeof(*sock))) == NULL)

   449

        return SET_ERROR(err, ERR_CALLOC);

   450

   451

    // initialize base

   452

    transport_init(SOCK_GNUTLS_TRANSPORT(sock), &sock_gnutls_type, info);

   453

   454

    if (!cred) {

   455

        // default credentials

   456

        cred = &sock_gnutls_client_cred_anon;

   457

   458

    } else {

   459

        // take a ref

   460

        sock->cred = cred;

   461

        cred->refcount++;

   462

    };

   463

   464

    // do verify?

   465

    if (cred->verify)

   466

        sock->verify = true;

   467

   468

    // init

   469

    if ((sock->hostname = strdup(hostname)) == NULL)

   470

        JUMP_SET_ERROR(err, ERR_STRDUP);

   471

   472

    // initialize TCP

   473

    sock_tcp_init(SOCK_GNUTLS_TCP(sock));

   474

   475

    // initialize client session

   476

    if ((ERROR_EXTRA(err) = gnutls_init(&sock->session, GNUTLS_CLIENT)) < 0)

   477

        JUMP_SET_ERROR(err, ERR_GNUTLS_INIT);

   478

   479

    // ...default priority stuff

   480

    if ((ERROR_EXTRA(err) = gnutls_set_default_priority(sock->session)))

   481

        JUMP_SET_ERROR(err, ERR_GNUTLS_SET_DEFAULT_PRIORITY);

   482

   483

    // XXX: silly hack for OpenSSL interop

   484

    gnutls_dh_set_prime_bits(sock->session, 512);

   485

   486

    // bind credentials

   487

    if ((ERROR_EXTRA(err) = gnutls_credentials_set(sock->session, GNUTLS_CRD_CERTIFICATE, cred->x509)))

   488

        JUMP_SET_ERROR(err, ERR_GNUTLS_CRED_SET);

   489