1

     2

#include "sock_gnutls.h"

     3

     4

// XXX: remove

     5

#include "log.h"

     6

     7

#include <gnutls/x509.h>

     8

     9

#include <stdlib.h>

    10

#include <string.h>

    11

#include <time.h>

    12

    13

#include <assert.h>

    14

    15

/**

    16

 * Register for events based on the session's gnutls_record_get_direction().

    17

 */

    18

static err_t sock_gnutls_ev_enable (struct sock_gnutls *sock, struct error_info *err)

    19

{

    20

    int ret;

    21

    22

    // gnutls_record_get_direction tells us what I/O operation gnutls would have required for the last

    23

    // operation, so we can use that to determine what events to register

    24

    switch ((ret = gnutls_record_get_direction(sock->session))) {

    25

        case 0: 

    26

            // read more data

    27

            sock_fd_enable_events(SOCK_GNUTLS_FD(sock), EV_READ); 

    28

            break;

    29

    30

        case 1:

    31

            // write buffer full

    32

            sock_fd_enable_events(SOCK_GNUTLS_FD(sock), EV_WRITE);

    33

            break;

    34

    35

        default:

    36

            // random error

    37

            RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_GET_DIRECTION, ret);

    38

    }

    39

    40

    // ok... wait

    41

    return SUCCESS;

    42

}

    43

    44

/**

    45

 * Translate a set of gnutls_certificate_status_t values to a constant error message

    46

 */

    47

static const char* sock_gnutls_verify_error (unsigned int status)

    48

{

    49

    if (status & GNUTLS_CERT_REVOKED)

    50

        return "certificate was revoked";

    51

    52

    else if (status & GNUTLS_CERT_INVALID) {

    53

        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)

    54

            return "certificate signer was not found";

    55

    56

        else if (status & GNUTLS_CERT_SIGNER_NOT_CA)

    57

            return "certificate signer is not a Certificate Authority";

    58

    59

        else if (status & GNUTLS_CERT_INSECURE_ALGORITHM)

    60

            return "certificate signed using an insecure algorithm";

    61

    62

        else

    63

            return "certificate could not be verified";

    64

    65

    } else

    66

        return "unknown error";

    67

    68

}

    69

    70

/**

    71

 * Perform the certificate validation procedure on the socket.

    72

 *

    73

 * Based on the GnuTLS examples/ex-rfc2818.c

    74

 */

    75

static err_t sock_gnutls_verify (struct sock_gnutls *sock, struct error_info *err)

    76

{

    77

    unsigned int status;

    78

    const gnutls_datum_t *cert_list;

    79

    unsigned int cert_list_size;

    80

    gnutls_x509_crt_t cert = NULL;

    81

    time_t t, now;

    82

    83

    // init

    84

    RESET_ERROR(err);

    85

    now = time(NULL);

    86

    87

    // inspect the peer's cert chain using the installed trusted CAs

    88

    if ((ERROR_EXTRA(err) = gnutls_certificate_verify_peers2(sock->session, &status)))

    89

        JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_VERIFY_PEERS2);

    90

    91

    // verify errors?

    92

    if (status)

    93

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, sock_gnutls_verify_error(status));

    94

    95

    // import the main cert

    96

    assert(gnutls_certificate_type_get(sock->session) == GNUTLS_CRT_X509);

    97

    98

    if ((ERROR_EXTRA(err) = gnutls_x509_crt_init(&cert)))

    99

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_init");

   100

   101

    if ((cert_list = gnutls_certificate_get_peers(sock->session, &cert_list_size)) == NULL)

   102

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_certificate_get_peers");

   103

   104

    if (!cert_list_size)

   105

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "cert_list_size");

   106

   107

    if ((ERROR_EXTRA(err) = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER)))

   108

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_import");

   109

   110

    // check expire/activate... not sure if we need to do this

   111

    if ((t = gnutls_x509_crt_get_expiration_time(cert)) == ((time_t) -1) || t < now)

   112

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_get_expiration_time");

   113

   114

    if ((t = gnutls_x509_crt_get_activation_time(cert)) == ((time_t) -1) || t > now)

   115

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_get_activation_time");

   116

   117

    // check hostname

   118

    if (!gnutls_x509_crt_check_hostname(cert, sock->hostname))

   119

        JUMP_SET_ERROR_STR(err, ERR_GNUTLS_CERT_VERIFY, "gnutls_x509_crt_check_hostname");

   120

   121

error:

   122

    // cleanup

   123

    if (cert)

   124

        gnutls_x509_crt_deinit(cert);

   125

   126

    // should be SUCCESS

   127

    return ERROR_CODE(err);    

   128

}

   129

   130

   131

/**

   132

 * Our handshake driver. This will execute the next gnutls_handshake step, handling E_AGAIN.

   133

 *

   134

 * This updates the sock_gnutls::handshake state internally, as used by sock_gnutls_event_handler.

   135

 *

   136

 * If the sock is marked as verify, this will perform the verification, returning on any errors, and then unset the

   137

 * verify flag - this ensures that the peer cert is only verified once per connection...

   138

 *

   139

 * @return >0 for finished handshake, 0 for handshake-in-progress, -err_t for errors.

   140

 */

   141

static int sock_gnutls_handshake (struct sock_gnutls *sock, struct error_info *err)

   142

{

   143

    int ret;

   144

   145

    // perform the handshake

   146

    if ((ret = gnutls_handshake(sock->session)) < 0 && ret != GNUTLS_E_AGAIN)

   147

        JUMP_SET_ERROR_EXTRA(err, ERR_GNUTLS_HANDSHAKE, ret);

   148

   149

    // complete?

   150

    if (ret == 0) {

   151

        // update state

   152

        sock->handshake = false;

   153

   154

        // verify?

   155

        if (sock->verify) {

   156

            // perform the validation

   157

            if (sock_gnutls_verify(sock, err))

   158

                goto error;

   159

   160

            // unmark

   161

            sock->verify = false;

   162

        }

   163

   164

        // handshake done

   165

        return 1;

   166

   167

    } else {

   168

        // set state, isn't really needed every time, but easier this way

   169

        sock->handshake = true;

   170

   171

        // re-enable the event for the next iteration

   172

        return sock_gnutls_ev_enable(sock, err);

   173

    }

   174

   175

error:

   176

    return -ERROR_CODE(err);    

   177

}

   178

   179

/**

   180

 * Our SOCK_STREAM event handler. Drive the handshake if that's current, otherwise, invoke user callbacks.

   181

 *

   182

 * XXX: this is ugly. This sock_stream-level separation doesn't really work that well.

   183

 */

   184

static void sock_gnutls_event_handler (int fd, short what, void *arg)

   185

{

   186

    struct sock_gnutls *sock = arg;

   187

    struct error_info err;

   188

   189

    (void) fd;

   190

    (void) what;

   191

   192

    // are we in the handshake cycle?

   193

    if (sock->handshake) {

   194

        RESET_ERROR(&err);

   195

   196

        if (sock_gnutls_handshake(sock, &err) == 0) {

   197

            // wait for the next handshake step

   198

   199

        } else if (SOCK_GNUTLS_BASE(sock)->conn_cb_func) {

   200

            // the async connect process has now completed, either succesfully or with an error

   201

            // invoke the user connect callback directly with appropriate error

   202

            sock_stream_invoke_conn_cb(SOCK_GNUTLS_BASE(sock), ERROR_CODE(&err) ? &err : NULL, true);

   203

   204

        } else {

   205

            // re-handshake completed, so continue with the sock_stream_callbacks, so the user can call sock_gnutls_read/write

   206

   207

            if (ERROR_CODE(&err))

   208

                // XXX: bad, since we can't report this directly... we need to let the user call _read/write, and get

   209

                // the error from there

   210

                log_warn_err(&err, "sock_gnutls_handshake failed");

   211

   212

            // continue where we left off

   213

            sock_stream_invoke_callbacks(SOCK_GNUTLS_BASE(sock), sock->ev_mask);

   214

        }

   215

   216

    } else {

   217

        // normal sock_stream operation

   218

        // gnutls might be able to proceed now, so ask user to try what didn't work before now, using the mask given to

   219

        // event_enable().

   220

        sock_stream_invoke_callbacks(SOCK_GNUTLS_BASE(sock), sock->ev_mask);

   221

    }

   222

}

   223

   224

static err_t sock_gnutls_read (struct sock_stream *base_sock, void *buf, size_t *len, struct error_info *err)

   225

{

   226

    struct sock_gnutls *sock = SOCK_FROM_BASE(base_sock, struct sock_gnutls);

   227

    int ret;

   228

   229

    // read gnutls record

   230

    ret = gnutls_record_recv(sock->session, buf, *len);

   231

   232

    // errors

   233

    // XXX: E_INTERRUPTED, E_REHANDSHAKE?

   234

    if (ret < 0 && ret != GNUTLS_E_AGAIN)

   235

        RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_RECV, ret);

   236

   237

    else if (ret == 0)

   238

        return SET_ERROR(err, ERR_READ_EOF);

   239

   240

   241

    // eagain?

   242

    if (ret < 0) {

   243

        *len = 0;

   244

   245

    } else {

   246

        // updated length

   247

        *len = ret;

   248

   249

    }

   250

   251

    return SUCCESS;

   252

}

   253

   254

static err_t sock_gnutls_write (struct sock_stream *base_sock, const void *buf, size_t *len, struct error_info *err)

   255

{

   256

    struct sock_gnutls *sock = SOCK_FROM_BASE(base_sock, struct sock_gnutls);

   257

    int ret;

   258

   259

    // read gnutls record

   260

    ret = gnutls_record_send(sock->session, buf, *len);

   261

   262

    // errors

   263

    if (ret < 0 && ret != GNUTLS_E_AGAIN)

   264

        RETURN_SET_ERROR_EXTRA(err, ERR_GNUTLS_RECORD_RECV, ret);

   265

   266

    else if (ret == 0)

   267

        return SET_ERROR(err, ERR_READ_EOF);

   268

   269

   270

    // eagain?

   271

    if (ret < 0) {

   272

        *len = 0;

   273

   274

    } else {

   275

        // updated length

   276

        *len = ret;

   277

    }

   278

   279

    return SUCCESS;

   280

}

   281

   282

static err_t sock_gnutls_event_init (struct sock_stream *base_sock)

   283

{

   284

    struct sock_gnutls *sock = SOCK_FROM_BASE(base_sock, struct sock_gnutls);

   285

   286

    (void) sock;

   287

   288

    // already setup, ok

   289

    return SUCCESS;

   290

}

   291

   292

static err_t sock_gnutls_event_enable (struct sock_stream *base_sock, short mask)

   293

{

   294

    struct sock_gnutls *sock = SOCK_FROM_BASE(base_sock, struct sock_gnutls);

   295

   296

    // store the ev_mask. We don't care about it here, because we assume that event_enable is only called once read or

   297

    // write, respectively, return zero. This is really the only case we can handle with gnutls.

   298

    sock->ev_mask = mask;

   299

   300

    // then wait for the event

   301

    return sock_gnutls_ev_enable(sock, SOCK_GNUTLS_ERR(sock));

   302

}

   303

   304

static void sock_gnutls_release (struct sock_stream *base_sock)

   305

{

   306

    struct sock_gnutls *sock = SOCK_FROM_BASE(base_sock, struct sock_gnutls);

   307

   308

    // DIEEEE

   309

    sock_gnutls_destroy(sock);

   310

}

   311

   312

/**

   313

 * Our sock_tcp-invoked connect handler

   314

 */

   315

static void sock_gnutls_on_connect (struct sock_stream *base_sock, struct error_info *tcp_err)

   316

{

   317

    struct sock_gnutls *sock = SOCK_FROM_BASE(base_sock, struct sock_gnutls);

   318

    struct error_info err;

   319

   320

    // trap errors to let the user handle them directly

   321

    if (tcp_err)

   322

        JUMP_SET_ERROR_INFO(&err, tcp_err);

   323

   324

    // bind default transport functions (recv/send) to use the TCP fd

   325

    gnutls_transport_set_ptr(sock->session, (gnutls_transport_ptr_t) (long int) SOCK_GNUTLS_FD(sock)->fd);

   326

   327

    // add ourselves as the event handler

   328

    if ((ERROR_CODE(&err) = sock_fd_init_ev(SOCK_GNUTLS_FD(sock), &sock_gnutls_event_handler, sock)))

   329

        goto error;

   330

   331

    // start handshake

   332

    if (sock_gnutls_handshake(sock, &err))

   333

        // this should complete with SUCCESS if it returns >0

   334

        goto error;

   335

   336

    // ok, so we wait...

   337

    return;

   338

   339

error:

   340

    // tell the user

   341

    SOCK_GNUTLS_BASE(sock)->conn_cb_func(SOCK_GNUTLS_BASE(sock), &err, SOCK_GNUTLS_BASE(sock)->conn_cb_arg);

   342

}

   343

   344

/*

   345

 * Our sock_stream_Type

   346

 */

   347

struct sock_stream_type sock_gnutls_type = {

   348

    .methods                = {

   349

        .read               = &sock_gnutls_read,

   350

        .write              = &sock_gnutls_write,

   351

        .event_init         = &sock_gnutls_event_init,

   352

        .event_enable       = &sock_gnutls_event_enable,

   353

        .release            = &sock_gnutls_release,

   354

        ._conn_cb           = &sock_gnutls_on_connect,

   355

    },

   356

};

   357

   358

/*

   359

 * Global shared anonymous client credentials

   360

 */

   361

static struct sock_ssl_client_cred sock_gnutls_client_cred_anon = { .x509 = NULL, .verify = false, .refcount = 0 };

   362

   363

// XXX: GnuTLS log func

   364

void _log (int level, const char *msg)

   365

{

   366

    printf("gnutls: %d: %s", level, msg);

   367

}

   368

   369

err_t sock_gnutls_global_init (struct error_info *err)

   370

{

   371

    // global init

   372

    if ((ERROR_EXTRA(err) = gnutls_global_init()) < 0)

   373

        return SET_ERROR(err, ERR_GNUTLS_GLOBAL_INIT);

   374

   375

    // initialize the anon client credentials

   376

    if ((ERROR_EXTRA(err) = gnutls_certificate_allocate_credentials(&sock_gnutls_client_cred_anon.x509)) < 0)

   377

        return SET_ERROR(err, ERR_GNUTLS_CERT_ALLOC_CRED);

   378

   379

    // XXX: debug

   380

//    gnutls_global_set_log_function(&_log);

   381

//    gnutls_global_set_log_level(11);

   382

   383

    // done

   384

    return SUCCESS;

   385

}

   386

   387

static void sock_ssl_client_cred_destroy (struct sock_ssl_client_cred *cred)

   388

{

   389

    // simple

   390

    gnutls_certificate_free_credentials(cred->x509);

   391

   392

    free(cred);

   393

}

   394

   395

err_t sock_ssl_client_cred_create (struct sock_ssl_client_cred **ctx_cred,

   396

        const char *cafile_path, bool verify,

   397

        const char *cert_path, const char *pkey_path,

   398

        struct error_info *err

   399

) {

   400

    struct sock_ssl_client_cred *cred;

   401

   402

    // alloc it

   403

    if ((cred = calloc(1, sizeof(*cred))) == NULL)

   404

        return SET_ERROR(err, ERR_CALLOC);

   405

   406

    // create the cert

   407

    if ((ERROR_EXTRA(err) = gnutls_certificate_allocate_credentials(&cred->x509)) < 0)

   408

        JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_ALLOC_CRED);

   409

   410

    // load the trusted ca certs?

   411

    if (cafile_path) {

   412

        // load them

   413

        if ((ERROR_EXTRA(err) = gnutls_certificate_set_x509_trust_file(cred->x509, cafile_path, GNUTLS_X509_FMT_PEM)) < 0)

   414

            JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_SET_X509_TRUST_FILE);

   415

   416

    }

   417

   418

    // set the verify flags?

   419

    cred->verify = verify;

   420

    gnutls_certificate_set_verify_flags(cred->x509, 0);

   421

   422

    // load the client cert?

   423

    if (cert_path || pkey_path) {

   424

        // need both...

   425

        assert(cert_path && pkey_path);

   426

   427

        // load

   428

        if ((ERROR_EXTRA(err) = gnutls_certificate_set_x509_key_file(cred->x509, cert_path, pkey_path, GNUTLS_X509_FMT_PEM)))

   429

            JUMP_SET_ERROR(err, ERR_GNUTLS_CERT_SET_X509_KEY_FILE);

   430

    }

   431

   432

    // ok

   433

    cred->refcount = 1;

   434

    *ctx_cred = cred;

   435

   436

    return SUCCESS;

   437

   438

error:

   439

    // release

   440

    sock_ssl_client_cred_destroy(cred);

   441

   442

    return ERROR_CODE(err);

   443

}

   444

   445

void sock_ssl_client_cred_get (struct sock_ssl_client_cred *cred)

   446

{

   447

    cred->refcount++;

   448

}

   449

   450

void sock_ssl_client_cred_put (struct sock_ssl_client_cred *cred)

   451

{

   452

    if (--cred->refcount == 0)

   453

        sock_ssl_client_cred_destroy(cred);

   454

}

   455

   456

err_t sock_ssl_connect_async (struct sock_stream **sock_ptr, 

   457

        const char *hostname, const char *service,

   458

        struct sock_ssl_client_cred *cred,

   459

        sock_stream_connect_cb cb_func, void *cb_arg, 

   460

        struct error_info *err

   461

    )

   462

{

   463

    struct sock_gnutls *sock = NULL;

   464

   465

    // alloc

   466

    if ((sock = calloc(1, sizeof(*sock))) == NULL)

   467

        return SET_ERROR(err, ERR_CALLOC);

   468

   469

    // initialize base

   470

    sock_stream_init(SOCK_GNUTLS_BASE(sock), &sock_gnutls_type, cb_func, cb_arg);

   471

   472

    if (!cred) {

   473

        // default credentials

   474

        cred = &sock_gnutls_client_cred_anon;

   475

   476

    } else {

   477

        // take a ref

   478

        sock->cred = cred;

   479

        cred->refcount++;

   480

    };

   481

   482

    // do verify?

   483

    if (cred->verify)

   484

        sock->verify = true;

   485

   486

    // init

   487

    if ((sock->hostname = strdup(hostname)) == NULL)

   488

        JUMP_SET_ERROR(err, ERR_STRDUP);

   489

   490

    // initialize client session

   491

    if ((ERROR_EXTRA(err) = gnutls_init(&sock->session, GNUTLS_CLIENT)) < 0)

   492

        JUMP_SET_ERROR(err, ERR_GNUTLS_INIT);

   493