1 /* Copyright (C) 2005 Juan Lang
2 * Copyright 2008 Henri Verbeet
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
18 * This file implements the schannel provider, or, the SSL/TLS implementations.
21 #include "wine/port.h"
26 #define NONAMELESSUNION
33 #include "secur32_priv.h"
35 #include "wine/unicode.h"
36 #include "wine/debug.h"
38 WINE_DEFAULT_DEBUG_CHANNEL(secur32
);
40 #if defined(SONAME_LIBGNUTLS) || defined (HAVE_SECURITY_SECURITY_H)
42 #define SCHAN_INVALID_HANDLE ~0UL
44 enum schan_handle_type
54 enum schan_handle_type type
;
59 schan_imp_session session
;
60 struct schan_transport transport
;
62 const CERT_CONTEXT
*cert
;
65 static struct schan_handle
*schan_handle_table
;
66 static struct schan_handle
*schan_free_handles
;
67 static SIZE_T schan_handle_table_size
;
68 static SIZE_T schan_handle_count
;
70 /* Protocols enabled, only those may be used for the connection. */
71 static DWORD config_enabled_protocols
;
73 /* Protocols disabled by default. They are enabled for using, but disabled when caller asks for default settings. */
74 static DWORD config_default_disabled_protocols
;
76 static ULONG_PTR
schan_alloc_handle(void *object
, enum schan_handle_type type
)
78 struct schan_handle
*handle
;
80 if (schan_free_handles
)
82 DWORD index
= schan_free_handles
- schan_handle_table
;
83 /* Use a free handle */
84 handle
= schan_free_handles
;
85 if (handle
->type
!= SCHAN_HANDLE_FREE
)
87 ERR("Handle %d(%p) is in the free list, but has type %#x.\n", index
, handle
, handle
->type
);
88 return SCHAN_INVALID_HANDLE
;
90 schan_free_handles
= handle
->object
;
91 handle
->object
= object
;
96 if (!(schan_handle_count
< schan_handle_table_size
))
99 SIZE_T new_size
= schan_handle_table_size
+ (schan_handle_table_size
>> 1);
100 struct schan_handle
*new_table
= heap_realloc(schan_handle_table
, new_size
* sizeof(*schan_handle_table
));
103 ERR("Failed to grow the handle table\n");
104 return SCHAN_INVALID_HANDLE
;
106 schan_handle_table
= new_table
;
107 schan_handle_table_size
= new_size
;
110 handle
= &schan_handle_table
[schan_handle_count
++];
111 handle
->object
= object
;
114 return handle
- schan_handle_table
;
117 static void *schan_free_handle(ULONG_PTR handle_idx
, enum schan_handle_type type
)
119 struct schan_handle
*handle
;
122 if (handle_idx
== SCHAN_INVALID_HANDLE
) return NULL
;
123 if (handle_idx
>= schan_handle_count
) return NULL
;
124 handle
= &schan_handle_table
[handle_idx
];
125 if (handle
->type
!= type
)
127 ERR("Handle %ld(%p) is not of type %#x\n", handle_idx
, handle
, type
);
131 object
= handle
->object
;
132 handle
->object
= schan_free_handles
;
133 handle
->type
= SCHAN_HANDLE_FREE
;
134 schan_free_handles
= handle
;
139 static void *schan_get_object(ULONG_PTR handle_idx
, enum schan_handle_type type
)
141 struct schan_handle
*handle
;
143 if (handle_idx
== SCHAN_INVALID_HANDLE
) return NULL
;
144 if (handle_idx
>= schan_handle_count
) return NULL
;
145 handle
= &schan_handle_table
[handle_idx
];
146 if (handle
->type
!= type
)
148 ERR("Handle %ld(%p) is not of type %#x\n", handle_idx
, handle
, type
);
152 return handle
->object
;
155 static void read_config(void)
157 DWORD enabled
= 0, default_disabled
= 0;
158 HKEY protocols_key
, key
;
159 WCHAR subkey_name
[64];
163 static BOOL config_read
= FALSE
;
165 static const WCHAR protocol_config_key_name
[] = {
166 'S','Y','S','T','E','M','\\',
167 'C','u','r','r','e','n','t','C','o','n','t','r','o','l','S','e','t','\\',
168 'C','o','n','t','r','o','l','\\',
169 'S','e','c','u','r','i','t','y','P','r','o','v','i','d','e','r','s','\\',
170 'S','C','H','A','N','N','E','L','\\',
171 'P','r','o','t','o','c','o','l','s',0 };
173 static const WCHAR clientW
[] = {'\\','C','l','i','e','n','t',0};
174 static const WCHAR enabledW
[] = {'e','n','a','b','l','e','d',0};
175 static const WCHAR disabledbydefaultW
[] = {'D','i','s','a','b','l','e','d','B','y','D','e','f','a','u','l','t',0};
177 static const struct {
179 DWORD prot_client_flag
;
180 BOOL enabled
; /* If no config is present, enable the protocol */
181 BOOL disabled_by_default
; /* Disable if caller asks for default protocol set */
182 } protocol_config_keys
[] = {
183 {{'S','S','L',' ','2','.','0',0}, SP_PROT_SSL2_CLIENT
, FALSE
, TRUE
}, /* NOTE: TRUE, TRUE on Windows */
184 {{'S','S','L',' ','3','.','0',0}, SP_PROT_SSL3_CLIENT
, TRUE
, FALSE
},
185 {{'T','L','S',' ','1','.','0',0}, SP_PROT_TLS1_0_CLIENT
, TRUE
, FALSE
},
186 {{'T','L','S',' ','1','.','1',0}, SP_PROT_TLS1_1_CLIENT
, TRUE
, FALSE
/* NOTE: not enabled by default on Windows */ },
187 {{'T','L','S',' ','1','.','2',0}, SP_PROT_TLS1_2_CLIENT
, TRUE
, FALSE
/* NOTE: not enabled by default on Windows */ }
190 /* No need for thread safety */
194 res
= RegOpenKeyExW(HKEY_LOCAL_MACHINE
, protocol_config_key_name
, 0, KEY_READ
, &protocols_key
);
195 if(res
== ERROR_SUCCESS
) {
196 DWORD type
, size
, value
;
198 for(i
=0; i
< sizeof(protocol_config_keys
)/sizeof(*protocol_config_keys
); i
++) {
199 strcpyW(subkey_name
, protocol_config_keys
[i
].key_name
);
200 strcatW(subkey_name
, clientW
);
201 res
= RegOpenKeyExW(protocols_key
, subkey_name
, 0, KEY_READ
, &key
);
202 if(res
!= ERROR_SUCCESS
) {
203 if(protocol_config_keys
[i
].enabled
)
204 enabled
|= protocol_config_keys
[i
].prot_client_flag
;
205 if(protocol_config_keys
[i
].disabled_by_default
)
206 default_disabled
|= protocol_config_keys
[i
].prot_client_flag
;
210 size
= sizeof(value
);
211 res
= RegQueryValueExW(key
, enabledW
, NULL
, &type
, (BYTE
*)&value
, &size
);
212 if(res
== ERROR_SUCCESS
) {
213 if(type
== REG_DWORD
&& value
)
214 enabled
|= protocol_config_keys
[i
].prot_client_flag
;
215 }else if(protocol_config_keys
[i
].enabled
) {
216 enabled
|= protocol_config_keys
[i
].prot_client_flag
;
219 size
= sizeof(value
);
220 res
= RegQueryValueExW(key
, disabledbydefaultW
, NULL
, &type
, (BYTE
*)&value
, &size
);
221 if(res
== ERROR_SUCCESS
) {
222 if(type
!= REG_DWORD
|| value
)
223 default_disabled
|= protocol_config_keys
[i
].prot_client_flag
;
224 }else if(protocol_config_keys
[i
].disabled_by_default
) {
225 default_disabled
|= protocol_config_keys
[i
].prot_client_flag
;
231 /* No config, enable all known protocols. */
232 for(i
=0; i
< sizeof(protocol_config_keys
)/sizeof(*protocol_config_keys
); i
++) {
233 if(protocol_config_keys
[i
].enabled
)
234 enabled
|= protocol_config_keys
[i
].prot_client_flag
;
235 if(protocol_config_keys
[i
].disabled_by_default
)
236 default_disabled
|= protocol_config_keys
[i
].prot_client_flag
;
240 RegCloseKey(protocols_key
);
242 config_enabled_protocols
= enabled
& schan_imp_enabled_protocols();
243 config_default_disabled_protocols
= default_disabled
;
246 TRACE("enabled %x, disabled by default %x\n", config_enabled_protocols
, config_default_disabled_protocols
);
249 static SECURITY_STATUS
schan_QueryCredentialsAttributes(
250 PCredHandle phCredential
, ULONG ulAttribute
, VOID
*pBuffer
)
252 struct schan_credentials
*cred
;
255 cred
= schan_get_object(phCredential
->dwLower
, SCHAN_HANDLE_CRED
);
257 return SEC_E_INVALID_HANDLE
;
261 case SECPKG_ATTR_SUPPORTED_ALGS
:
264 /* FIXME: get from CryptoAPI */
265 FIXME("SECPKG_ATTR_SUPPORTED_ALGS: stub\n");
266 ret
= SEC_E_UNSUPPORTED_FUNCTION
;
269 ret
= SEC_E_INTERNAL_ERROR
;
271 case SECPKG_ATTR_CIPHER_STRENGTHS
:
274 SecPkgCred_CipherStrengths
*r
= pBuffer
;
276 /* FIXME: get from CryptoAPI */
277 FIXME("SECPKG_ATTR_CIPHER_STRENGTHS: semi-stub\n");
278 r
->dwMinimumCipherStrength
= 40;
279 r
->dwMaximumCipherStrength
= 168;
283 ret
= SEC_E_INTERNAL_ERROR
;
285 case SECPKG_ATTR_SUPPORTED_PROTOCOLS
:
287 /* Regardless of MSDN documentation, tests show that this attribute takes into account
288 * what protocols are enabled for given credential. */
289 ((SecPkgCred_SupportedProtocols
*)pBuffer
)->grbitProtocol
= cred
->enabled_protocols
;
292 ret
= SEC_E_INTERNAL_ERROR
;
296 ret
= SEC_E_UNSUPPORTED_FUNCTION
;
301 static SECURITY_STATUS SEC_ENTRY
schan_QueryCredentialsAttributesA(
302 PCredHandle phCredential
, ULONG ulAttribute
, PVOID pBuffer
)
306 TRACE("(%p, %d, %p)\n", phCredential
, ulAttribute
, pBuffer
);
310 case SECPKG_CRED_ATTR_NAMES
:
311 FIXME("SECPKG_CRED_ATTR_NAMES: stub\n");
312 ret
= SEC_E_UNSUPPORTED_FUNCTION
;
315 ret
= schan_QueryCredentialsAttributes(phCredential
, ulAttribute
,
321 static SECURITY_STATUS SEC_ENTRY
schan_QueryCredentialsAttributesW(
322 PCredHandle phCredential
, ULONG ulAttribute
, PVOID pBuffer
)
326 TRACE("(%p, %d, %p)\n", phCredential
, ulAttribute
, pBuffer
);
330 case SECPKG_CRED_ATTR_NAMES
:
331 FIXME("SECPKG_CRED_ATTR_NAMES: stub\n");
332 ret
= SEC_E_UNSUPPORTED_FUNCTION
;
335 ret
= schan_QueryCredentialsAttributes(phCredential
, ulAttribute
,
341 static SECURITY_STATUS
schan_CheckCreds(const SCHANNEL_CRED
*schanCred
)
346 TRACE("dwVersion = %d\n", schanCred
->dwVersion
);
347 TRACE("cCreds = %d\n", schanCred
->cCreds
);
348 TRACE("hRootStore = %p\n", schanCred
->hRootStore
);
349 TRACE("cMappers = %d\n", schanCred
->cMappers
);
350 TRACE("cSupportedAlgs = %d:\n", schanCred
->cSupportedAlgs
);
351 for (i
= 0; i
< schanCred
->cSupportedAlgs
; i
++)
352 TRACE("%08x\n", schanCred
->palgSupportedAlgs
[i
]);
353 TRACE("grbitEnabledProtocols = %08x\n", schanCred
->grbitEnabledProtocols
);
354 TRACE("dwMinimumCipherStrength = %d\n", schanCred
->dwMinimumCipherStrength
);
355 TRACE("dwMaximumCipherStrength = %d\n", schanCred
->dwMaximumCipherStrength
);
356 TRACE("dwSessionLifespan = %d\n", schanCred
->dwSessionLifespan
);
357 TRACE("dwFlags = %08x\n", schanCred
->dwFlags
);
358 TRACE("dwCredFormat = %d\n", schanCred
->dwCredFormat
);
360 switch (schanCred
->dwVersion
)
363 case SCHANNEL_CRED_VERSION
:
366 return SEC_E_INTERNAL_ERROR
;
369 if (schanCred
->cCreds
== 0)
370 st
= SEC_E_NO_CREDENTIALS
;
371 else if (schanCred
->cCreds
> 1)
372 st
= SEC_E_UNKNOWN_CREDENTIALS
;
379 ret
= CryptAcquireCertificatePrivateKey(schanCred
->paCred
[0],
380 0, /* FIXME: what flags to use? */ NULL
,
381 &csp
, &keySpec
, &freeCSP
);
386 CryptReleaseContext(csp
, 0);
389 st
= SEC_E_UNKNOWN_CREDENTIALS
;
394 static SECURITY_STATUS
schan_AcquireClientCredentials(const SCHANNEL_CRED
*schanCred
,
395 PCredHandle phCredential
, PTimeStamp ptsExpiry
)
397 struct schan_credentials
*creds
;
398 unsigned enabled_protocols
;
400 SECURITY_STATUS st
= SEC_E_OK
;
402 TRACE("schanCred %p, phCredential %p, ptsExpiry %p\n", schanCred
, phCredential
, ptsExpiry
);
406 st
= schan_CheckCreds(schanCred
);
407 if (st
!= SEC_E_OK
&& st
!= SEC_E_NO_CREDENTIALS
)
414 if(schanCred
&& schanCred
->grbitEnabledProtocols
)
415 enabled_protocols
= schanCred
->grbitEnabledProtocols
& config_enabled_protocols
;
417 enabled_protocols
= config_enabled_protocols
& ~config_default_disabled_protocols
;
418 if(!enabled_protocols
) {
419 ERR("Could not find matching protocol\n");
420 return SEC_E_NO_AUTHENTICATING_AUTHORITY
;
423 /* For now, the only thing I'm interested in is the direction of the
424 * connection, so just store it.
426 creds
= heap_alloc(sizeof(*creds
));
427 if (!creds
) return SEC_E_INSUFFICIENT_MEMORY
;
429 handle
= schan_alloc_handle(creds
, SCHAN_HANDLE_CRED
);
430 if (handle
== SCHAN_INVALID_HANDLE
) goto fail
;
432 creds
->credential_use
= SECPKG_CRED_OUTBOUND
;
433 if (!schan_imp_allocate_certificate_credentials(creds
))
435 schan_free_handle(handle
, SCHAN_HANDLE_CRED
);
439 creds
->enabled_protocols
= enabled_protocols
;
440 phCredential
->dwLower
= handle
;
441 phCredential
->dwUpper
= 0;
443 /* Outbound credentials have no expiry */
446 ptsExpiry
->LowPart
= 0;
447 ptsExpiry
->HighPart
= 0;
454 return SEC_E_INTERNAL_ERROR
;
457 static SECURITY_STATUS
schan_AcquireServerCredentials(const SCHANNEL_CRED
*schanCred
,
458 PCredHandle phCredential
, PTimeStamp ptsExpiry
)
462 TRACE("schanCred %p, phCredential %p, ptsExpiry %p\n", schanCred
, phCredential
, ptsExpiry
);
464 if (!schanCred
) return SEC_E_NO_CREDENTIALS
;
466 st
= schan_CheckCreds(schanCred
);
470 struct schan_credentials
*creds
;
472 creds
= heap_alloc_zero(sizeof(*creds
));
473 if (!creds
) return SEC_E_INSUFFICIENT_MEMORY
;
474 creds
->credential_use
= SECPKG_CRED_INBOUND
;
476 handle
= schan_alloc_handle(creds
, SCHAN_HANDLE_CRED
);
477 if (handle
== SCHAN_INVALID_HANDLE
)
480 return SEC_E_INTERNAL_ERROR
;
483 phCredential
->dwLower
= handle
;
484 phCredential
->dwUpper
= 0;
486 /* FIXME: get expiry from cert */
491 static SECURITY_STATUS
schan_AcquireCredentialsHandle(ULONG fCredentialUse
,
492 const SCHANNEL_CRED
*schanCred
, PCredHandle phCredential
, PTimeStamp ptsExpiry
)
496 if (fCredentialUse
== SECPKG_CRED_OUTBOUND
)
497 ret
= schan_AcquireClientCredentials(schanCred
, phCredential
,
500 ret
= schan_AcquireServerCredentials(schanCred
, phCredential
,
505 static SECURITY_STATUS SEC_ENTRY
schan_AcquireCredentialsHandleA(
506 SEC_CHAR
*pszPrincipal
, SEC_CHAR
*pszPackage
, ULONG fCredentialUse
,
507 PLUID pLogonID
, PVOID pAuthData
, SEC_GET_KEY_FN pGetKeyFn
,
508 PVOID pGetKeyArgument
, PCredHandle phCredential
, PTimeStamp ptsExpiry
)
510 TRACE("(%s, %s, 0x%08x, %p, %p, %p, %p, %p, %p)\n",
511 debugstr_a(pszPrincipal
), debugstr_a(pszPackage
), fCredentialUse
,
512 pLogonID
, pAuthData
, pGetKeyFn
, pGetKeyArgument
, phCredential
, ptsExpiry
);
513 return schan_AcquireCredentialsHandle(fCredentialUse
,
514 pAuthData
, phCredential
, ptsExpiry
);
517 static SECURITY_STATUS SEC_ENTRY
schan_AcquireCredentialsHandleW(
518 SEC_WCHAR
*pszPrincipal
, SEC_WCHAR
*pszPackage
, ULONG fCredentialUse
,
519 PLUID pLogonID
, PVOID pAuthData
, SEC_GET_KEY_FN pGetKeyFn
,
520 PVOID pGetKeyArgument
, PCredHandle phCredential
, PTimeStamp ptsExpiry
)
522 TRACE("(%s, %s, 0x%08x, %p, %p, %p, %p, %p, %p)\n",
523 debugstr_w(pszPrincipal
), debugstr_w(pszPackage
), fCredentialUse
,
524 pLogonID
, pAuthData
, pGetKeyFn
, pGetKeyArgument
, phCredential
, ptsExpiry
);
525 return schan_AcquireCredentialsHandle(fCredentialUse
,
526 pAuthData
, phCredential
, ptsExpiry
);
529 static SECURITY_STATUS SEC_ENTRY
schan_FreeCredentialsHandle(
530 PCredHandle phCredential
)
532 struct schan_credentials
*creds
;
534 TRACE("phCredential %p\n", phCredential
);
536 if (!phCredential
) return SEC_E_INVALID_HANDLE
;
538 creds
= schan_free_handle(phCredential
->dwLower
, SCHAN_HANDLE_CRED
);
539 if (!creds
) return SEC_E_INVALID_HANDLE
;
541 if (creds
->credential_use
== SECPKG_CRED_OUTBOUND
)
542 schan_imp_free_certificate_credentials(creds
);
548 static void init_schan_buffers(struct schan_buffers
*s
, const PSecBufferDesc desc
,
549 int (*get_next_buffer
)(const struct schan_transport
*, struct schan_buffers
*))
554 s
->current_buffer_idx
= -1;
555 s
->allow_buffer_resize
= FALSE
;
556 s
->get_next_buffer
= get_next_buffer
;
559 static int schan_find_sec_buffer_idx(const SecBufferDesc
*desc
, unsigned int start_idx
, ULONG buffer_type
)
564 for (i
= start_idx
; i
< desc
->cBuffers
; ++i
)
566 buffer
= &desc
->pBuffers
[i
];
567 if (buffer
->BufferType
== buffer_type
) return i
;
573 static void schan_resize_current_buffer(const struct schan_buffers
*s
, SIZE_T min_size
)
575 SecBuffer
*b
= &s
->desc
->pBuffers
[s
->current_buffer_idx
];
576 SIZE_T new_size
= b
->cbBuffer
? b
->cbBuffer
* 2 : 128;
579 if (b
->cbBuffer
>= min_size
|| !s
->allow_buffer_resize
|| min_size
> UINT_MAX
/ 2) return;
581 while (new_size
< min_size
) new_size
*= 2;
584 new_data
= heap_realloc(b
->pvBuffer
, new_size
);
586 new_data
= heap_alloc(new_size
);
590 TRACE("Failed to resize %p from %d to %ld\n", b
->pvBuffer
, b
->cbBuffer
, new_size
);
594 b
->cbBuffer
= new_size
;
595 b
->pvBuffer
= new_data
;
598 char *schan_get_buffer(const struct schan_transport
*t
, struct schan_buffers
*s
, SIZE_T
*count
)
609 if (s
->current_buffer_idx
== -1)
612 int buffer_idx
= s
->get_next_buffer(t
, s
);
613 if (buffer_idx
== -1)
615 TRACE("No next buffer\n");
618 s
->current_buffer_idx
= buffer_idx
;
621 buffer
= &s
->desc
->pBuffers
[s
->current_buffer_idx
];
622 TRACE("Using buffer %d: cbBuffer %d, BufferType %#x, pvBuffer %p\n", s
->current_buffer_idx
, buffer
->cbBuffer
, buffer
->BufferType
, buffer
->pvBuffer
);
624 schan_resize_current_buffer(s
, s
->offset
+ *count
);
625 max_count
= buffer
->cbBuffer
- s
->offset
;
626 if (s
->limit
!= ~0UL && s
->limit
< max_count
)
627 max_count
= s
->limit
;
632 s
->allow_buffer_resize
= FALSE
;
633 buffer_idx
= s
->get_next_buffer(t
, s
);
634 if (buffer_idx
== -1)
636 TRACE("No next buffer\n");
639 s
->current_buffer_idx
= buffer_idx
;
641 return schan_get_buffer(t
, s
, count
);
644 if (*count
> max_count
)
646 if (s
->limit
!= ~0UL)
649 return (char *)buffer
->pvBuffer
+ s
->offset
;
653 * Read data from the transport input buffer.
655 * t - The session transport object.
656 * buff - The buffer into which to store the read data. Must be at least
657 * *buff_len bytes in length.
658 * buff_len - On input, *buff_len is the desired length to read. On successful
659 * return, *buff_len is the number of bytes actually read.
662 * 0 on success, in which case:
663 * *buff_len == 0 indicates end of file.
664 * *buff_len > 0 indicates that some data was read. May be less than
665 * what was requested, in which case the caller should call again if/
666 * when they want more.
667 * EAGAIN when no data could be read without blocking
668 * another errno-style error value on failure
671 int schan_pull(struct schan_transport
*t
, void *buff
, size_t *buff_len
)
674 SIZE_T local_len
= *buff_len
;
676 TRACE("Pull %lu bytes\n", local_len
);
680 b
= schan_get_buffer(t
, &t
->in
, &local_len
);
684 memcpy(buff
, b
, local_len
);
685 t
->in
.offset
+= local_len
;
687 TRACE("Read %lu bytes\n", local_len
);
689 *buff_len
= local_len
;
694 * Write data to the transport output buffer.
696 * t - The session transport object.
697 * buff - The buffer of data to write. Must be at least *buff_len bytes in length.
698 * buff_len - On input, *buff_len is the desired length to write. On successful
699 * return, *buff_len is the number of bytes actually written.
703 * *buff_len will be > 0 indicating how much data was written. May be less
704 * than what was requested, in which case the caller should call again
705 if/when they want to write more.
706 * EAGAIN when no data could be written without blocking
707 * another errno-style error value on failure
710 int schan_push(struct schan_transport
*t
, const void *buff
, size_t *buff_len
)
713 SIZE_T local_len
= *buff_len
;
715 TRACE("Push %lu bytes\n", local_len
);
719 b
= schan_get_buffer(t
, &t
->out
, &local_len
);
723 memcpy(b
, buff
, local_len
);
724 t
->out
.offset
+= local_len
;
726 TRACE("Wrote %lu bytes\n", local_len
);
728 *buff_len
= local_len
;
732 schan_imp_session
schan_session_for_transport(struct schan_transport
* t
)
734 return t
->ctx
->session
;
737 static int schan_init_sec_ctx_get_next_input_buffer(const struct schan_transport
*t
, struct schan_buffers
*s
)
739 if (s
->current_buffer_idx
!= -1)
741 return schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_TOKEN
);
744 static int schan_init_sec_ctx_get_next_output_buffer(const struct schan_transport
*t
, struct schan_buffers
*s
)
746 if (s
->current_buffer_idx
== -1)
748 int idx
= schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_TOKEN
);
749 if (t
->ctx
->req_ctx_attr
& ISC_REQ_ALLOCATE_MEMORY
)
753 idx
= schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_EMPTY
);
754 if (idx
!= -1) s
->desc
->pBuffers
[idx
].BufferType
= SECBUFFER_TOKEN
;
756 if (idx
!= -1 && !s
->desc
->pBuffers
[idx
].pvBuffer
)
758 s
->desc
->pBuffers
[idx
].cbBuffer
= 0;
759 s
->allow_buffer_resize
= TRUE
;
768 static void dump_buffer_desc(SecBufferDesc
*desc
)
773 TRACE("Buffer desc %p:\n", desc
);
774 for (i
= 0; i
< desc
->cBuffers
; ++i
)
776 SecBuffer
*b
= &desc
->pBuffers
[i
];
777 TRACE("\tbuffer %u: cbBuffer %d, BufferType %#x pvBuffer %p\n", i
, b
->cbBuffer
, b
->BufferType
, b
->pvBuffer
);
781 /***********************************************************************
782 * InitializeSecurityContextW
784 static SECURITY_STATUS SEC_ENTRY
schan_InitializeSecurityContextW(
785 PCredHandle phCredential
, PCtxtHandle phContext
, SEC_WCHAR
*pszTargetName
,
786 ULONG fContextReq
, ULONG Reserved1
, ULONG TargetDataRep
,
787 PSecBufferDesc pInput
, ULONG Reserved2
, PCtxtHandle phNewContext
,
788 PSecBufferDesc pOutput
, ULONG
*pfContextAttr
, PTimeStamp ptsExpiry
)
790 struct schan_context
*ctx
;
791 struct schan_buffers
*out_buffers
;
792 struct schan_credentials
*cred
;
793 SIZE_T expected_size
= ~0UL;
796 TRACE("%p %p %s 0x%08x %d %d %p %d %p %p %p %p\n", phCredential
, phContext
,
797 debugstr_w(pszTargetName
), fContextReq
, Reserved1
, TargetDataRep
, pInput
,
798 Reserved1
, phNewContext
, pOutput
, pfContextAttr
, ptsExpiry
);
800 dump_buffer_desc(pInput
);
801 dump_buffer_desc(pOutput
);
807 if (!phCredential
) return SEC_E_INVALID_HANDLE
;
809 cred
= schan_get_object(phCredential
->dwLower
, SCHAN_HANDLE_CRED
);
810 if (!cred
) return SEC_E_INVALID_HANDLE
;
812 if (!(cred
->credential_use
& SECPKG_CRED_OUTBOUND
))
814 WARN("Invalid credential use %#x\n", cred
->credential_use
);
815 return SEC_E_INVALID_HANDLE
;
818 ctx
= heap_alloc(sizeof(*ctx
));
819 if (!ctx
) return SEC_E_INSUFFICIENT_MEMORY
;
822 handle
= schan_alloc_handle(ctx
, SCHAN_HANDLE_CTX
);
823 if (handle
== SCHAN_INVALID_HANDLE
)
826 return SEC_E_INTERNAL_ERROR
;
829 if (!schan_imp_create_session(&ctx
->session
, cred
))
831 schan_free_handle(handle
, SCHAN_HANDLE_CTX
);
833 return SEC_E_INTERNAL_ERROR
;
836 ctx
->transport
.ctx
= ctx
;
837 schan_imp_set_session_transport(ctx
->session
, &ctx
->transport
);
839 if (pszTargetName
&& *pszTargetName
)
841 UINT len
= WideCharToMultiByte( CP_UNIXCP
, 0, pszTargetName
, -1, NULL
, 0, NULL
, NULL
);
842 char *target
= heap_alloc( len
);
846 WideCharToMultiByte( CP_UNIXCP
, 0, pszTargetName
, -1, target
, len
, NULL
, NULL
);
847 schan_imp_set_session_target( ctx
->session
, target
);
851 phNewContext
->dwLower
= handle
;
852 phNewContext
->dwUpper
= 0;
856 SIZE_T record_size
= 0;
862 return SEC_E_INCOMPLETE_MESSAGE
;
864 idx
= schan_find_sec_buffer_idx(pInput
, 0, SECBUFFER_TOKEN
);
866 return SEC_E_INCOMPLETE_MESSAGE
;
868 buffer
= &pInput
->pBuffers
[idx
];
869 ptr
= buffer
->pvBuffer
;
872 while (buffer
->cbBuffer
> expected_size
+ 5)
874 record_size
= 5 + ((ptr
[3] << 8) | ptr
[4]);
876 if (buffer
->cbBuffer
< expected_size
+ record_size
)
879 expected_size
+= record_size
;
885 TRACE("Expected at least %lu bytes, but buffer only contains %u bytes.\n",
886 max(6, record_size
), buffer
->cbBuffer
);
887 return SEC_E_INCOMPLETE_MESSAGE
;
890 TRACE("Using expected_size %lu.\n", expected_size
);
892 ctx
= schan_get_object(phContext
->dwLower
, SCHAN_HANDLE_CTX
);
895 ctx
->req_ctx_attr
= fContextReq
;
897 init_schan_buffers(&ctx
->transport
.in
, pInput
, schan_init_sec_ctx_get_next_input_buffer
);
898 ctx
->transport
.in
.limit
= expected_size
;
899 init_schan_buffers(&ctx
->transport
.out
, pOutput
, schan_init_sec_ctx_get_next_output_buffer
);
901 /* Perform the TLS handshake */
902 ret
= schan_imp_handshake(ctx
->session
);
904 if(ctx
->transport
.in
.offset
&& ctx
->transport
.in
.offset
!= pInput
->pBuffers
[0].cbBuffer
) {
905 if(pInput
->cBuffers
<2 || pInput
->pBuffers
[1].BufferType
!=SECBUFFER_EMPTY
)
906 return SEC_E_INVALID_TOKEN
;
908 pInput
->pBuffers
[1].BufferType
= SECBUFFER_EXTRA
;
909 pInput
->pBuffers
[1].cbBuffer
= pInput
->pBuffers
[0].cbBuffer
-ctx
->transport
.in
.offset
;
912 out_buffers
= &ctx
->transport
.out
;
913 if (out_buffers
->current_buffer_idx
!= -1)
915 SecBuffer
*buffer
= &out_buffers
->desc
->pBuffers
[out_buffers
->current_buffer_idx
];
916 buffer
->cbBuffer
= out_buffers
->offset
;
920 if (ctx
->req_ctx_attr
& ISC_REQ_REPLAY_DETECT
)
921 *pfContextAttr
|= ISC_RET_REPLAY_DETECT
;
922 if (ctx
->req_ctx_attr
& ISC_REQ_SEQUENCE_DETECT
)
923 *pfContextAttr
|= ISC_RET_SEQUENCE_DETECT
;
924 if (ctx
->req_ctx_attr
& ISC_REQ_CONFIDENTIALITY
)
925 *pfContextAttr
|= ISC_RET_CONFIDENTIALITY
;
926 if (ctx
->req_ctx_attr
& ISC_REQ_ALLOCATE_MEMORY
)
927 *pfContextAttr
|= ISC_RET_ALLOCATED_MEMORY
;
928 if (ctx
->req_ctx_attr
& ISC_REQ_STREAM
)
929 *pfContextAttr
|= ISC_RET_STREAM
;
934 /***********************************************************************
935 * InitializeSecurityContextA
937 static SECURITY_STATUS SEC_ENTRY
schan_InitializeSecurityContextA(
938 PCredHandle phCredential
, PCtxtHandle phContext
, SEC_CHAR
*pszTargetName
,
939 ULONG fContextReq
, ULONG Reserved1
, ULONG TargetDataRep
,
940 PSecBufferDesc pInput
, ULONG Reserved2
, PCtxtHandle phNewContext
,
941 PSecBufferDesc pOutput
, ULONG
*pfContextAttr
, PTimeStamp ptsExpiry
)
944 SEC_WCHAR
*target_name
= NULL
;
946 TRACE("%p %p %s %d %d %d %p %d %p %p %p %p\n", phCredential
, phContext
,
947 debugstr_a(pszTargetName
), fContextReq
, Reserved1
, TargetDataRep
, pInput
,
948 Reserved1
, phNewContext
, pOutput
, pfContextAttr
, ptsExpiry
);
952 INT len
= MultiByteToWideChar(CP_ACP
, 0, pszTargetName
, -1, NULL
, 0);
953 if (!(target_name
= heap_alloc(len
* sizeof(*target_name
)))) return SEC_E_INSUFFICIENT_MEMORY
;
954 MultiByteToWideChar(CP_ACP
, 0, pszTargetName
, -1, target_name
, len
);
957 ret
= schan_InitializeSecurityContextW(phCredential
, phContext
, target_name
,
958 fContextReq
, Reserved1
, TargetDataRep
, pInput
, Reserved2
,
959 phNewContext
, pOutput
, pfContextAttr
, ptsExpiry
);
961 heap_free(target_name
);
965 static void *get_alg_name(ALG_ID id
, BOOL wide
)
967 static const struct {
970 const WCHAR nameW
[8];
972 { CALG_ECDSA
, "ECDSA", {'E','C','D','S','A',0} },
973 { CALG_RSA_SIGN
, "RSA", {'R','S','A',0} },
974 { CALG_DES
, "DES", {'D','E','S',0} },
975 { CALG_RC2
, "RC2", {'R','C','2',0} },
976 { CALG_3DES
, "3DES", {'3','D','E','S',0} },
977 { CALG_AES_128
, "AES", {'A','E','S',0} },
978 { CALG_AES_192
, "AES", {'A','E','S',0} },
979 { CALG_AES_256
, "AES", {'A','E','S',0} },
980 { CALG_RC4
, "RC4", {'R','C','4',0} },
984 for (i
= 0; i
< sizeof(alg_name_map
)/sizeof(alg_name_map
[0]); i
++)
985 if (alg_name_map
[i
].alg_id
== id
)
986 return wide
? (void*)alg_name_map
[i
].nameW
: (void*)alg_name_map
[i
].name
;
988 FIXME("Unknown ALG_ID %04x\n", id
);
992 static SECURITY_STATUS
ensure_remote_cert(struct schan_context
*ctx
)
994 HCERTSTORE cert_store
;
995 SECURITY_STATUS status
;
1000 cert_store
= CertOpenStore(CERT_STORE_PROV_MEMORY
, 0, 0, CERT_STORE_CREATE_NEW_FLAG
, NULL
);
1002 return GetLastError();
1004 status
= schan_imp_get_session_peer_certificate(ctx
->session
, cert_store
, &ctx
->cert
);
1005 CertCloseStore(cert_store
, 0);
1009 static SECURITY_STATUS SEC_ENTRY
schan_QueryContextAttributesW(
1010 PCtxtHandle context_handle
, ULONG attribute
, PVOID buffer
)
1012 struct schan_context
*ctx
;
1014 TRACE("context_handle %p, attribute %#x, buffer %p\n",
1015 context_handle
, attribute
, buffer
);
1017 if (!context_handle
) return SEC_E_INVALID_HANDLE
;
1018 ctx
= schan_get_object(context_handle
->dwLower
, SCHAN_HANDLE_CTX
);
1022 case SECPKG_ATTR_STREAM_SIZES
:
1024 SecPkgContext_ConnectionInfo info
;
1025 SECURITY_STATUS status
= schan_imp_get_connection_info(ctx
->session
, &info
);
1026 if (status
== SEC_E_OK
)
1028 SecPkgContext_StreamSizes
*stream_sizes
= buffer
;
1029 SIZE_T mac_size
= info
.dwHashStrength
;
1030 unsigned int block_size
= schan_imp_get_session_cipher_block_size(ctx
->session
);
1031 unsigned int message_size
= schan_imp_get_max_message_size(ctx
->session
);
1033 TRACE("Using %lu mac bytes, message size %u, block size %u\n",
1034 mac_size
, message_size
, block_size
);
1036 /* These are defined by the TLS RFC */
1037 stream_sizes
->cbHeader
= 5;
1038 stream_sizes
->cbTrailer
= mac_size
+ 256; /* Max 255 bytes padding + 1 for padding size */
1039 stream_sizes
->cbMaximumMessage
= message_size
;
1040 stream_sizes
->cbBuffers
= 4;
1041 stream_sizes
->cbBlockSize
= block_size
;
1046 case SECPKG_ATTR_KEY_INFO
:
1048 SecPkgContext_ConnectionInfo conn_info
;
1049 SECURITY_STATUS status
= schan_imp_get_connection_info(ctx
->session
, &conn_info
);
1050 if (status
== SEC_E_OK
)
1052 SecPkgContext_KeyInfoW
*info
= buffer
;
1053 info
->KeySize
= conn_info
.dwCipherStrength
;
1054 info
->SignatureAlgorithm
= schan_imp_get_key_signature_algorithm(ctx
->session
);
1055 info
->EncryptAlgorithm
= conn_info
.aiCipher
;
1056 info
->sSignatureAlgorithmName
= get_alg_name(info
->SignatureAlgorithm
, TRUE
);
1057 info
->sEncryptAlgorithmName
= get_alg_name(info
->EncryptAlgorithm
, TRUE
);
1061 case SECPKG_ATTR_REMOTE_CERT_CONTEXT
:
1063 PCCERT_CONTEXT
*cert
= buffer
;
1064 SECURITY_STATUS status
;
1066 status
= ensure_remote_cert(ctx
);
1067 if(status
!= SEC_E_OK
)
1070 *cert
= CertDuplicateCertificateContext(ctx
->cert
);
1073 case SECPKG_ATTR_CONNECTION_INFO
:
1075 SecPkgContext_ConnectionInfo
*info
= buffer
;
1076 return schan_imp_get_connection_info(ctx
->session
, info
);
1078 case SECPKG_ATTR_ENDPOINT_BINDINGS
:
1080 SecPkgContext_Bindings
*bindings
= buffer
;
1081 CCRYPT_OID_INFO
*info
;
1082 ALG_ID hash_alg
= CALG_SHA_256
;
1085 SECURITY_STATUS status
;
1089 static const char prefix
[] = "tls-server-end-point:";
1091 status
= ensure_remote_cert(ctx
);
1092 if(status
!= SEC_E_OK
)
1096 info
= CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY
, ctx
->cert
->pCertInfo
->SignatureAlgorithm
.pszObjId
, 0);
1097 if(info
&& info
->u
.Algid
!= CALG_SHA1
&& info
->u
.Algid
!= CALG_MD5
)
1098 hash_alg
= info
->u
.Algid
;
1100 hash_size
= sizeof(hash
);
1101 r
= CryptHashCertificate(0, hash_alg
, 0, ctx
->cert
->pbCertEncoded
, ctx
->cert
->cbCertEncoded
, hash
, &hash_size
);
1103 return GetLastError();
1105 bindings
->BindingsLength
= sizeof(*bindings
->Bindings
) + sizeof(prefix
)-1 + hash_size
;
1106 bindings
->Bindings
= heap_alloc_zero(bindings
->BindingsLength
);
1107 if(!bindings
->Bindings
)
1108 return SEC_E_INSUFFICIENT_MEMORY
;
1110 bindings
->Bindings
->cbApplicationDataLength
= sizeof(prefix
)-1 + hash_size
;
1111 bindings
->Bindings
->dwApplicationDataOffset
= sizeof(*bindings
->Bindings
);
1113 p
= (char*)(bindings
->Bindings
+1);
1114 memcpy(p
, prefix
, sizeof(prefix
)-1);
1115 p
+= sizeof(prefix
)-1;
1116 memcpy(p
, hash
, hash_size
);
1121 FIXME("Unhandled attribute %#x\n", attribute
);
1122 return SEC_E_UNSUPPORTED_FUNCTION
;
1126 static SECURITY_STATUS SEC_ENTRY
schan_QueryContextAttributesA(
1127 PCtxtHandle context_handle
, ULONG attribute
, PVOID buffer
)
1129 TRACE("context_handle %p, attribute %#x, buffer %p\n",
1130 context_handle
, attribute
, buffer
);
1134 case SECPKG_ATTR_STREAM_SIZES
:
1135 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1136 case SECPKG_ATTR_KEY_INFO
:
1138 SECURITY_STATUS status
= schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1139 if (status
== SEC_E_OK
)
1141 SecPkgContext_KeyInfoA
*info
= buffer
;
1142 info
->sSignatureAlgorithmName
= get_alg_name(info
->SignatureAlgorithm
, FALSE
);
1143 info
->sEncryptAlgorithmName
= get_alg_name(info
->EncryptAlgorithm
, FALSE
);
1147 case SECPKG_ATTR_REMOTE_CERT_CONTEXT
:
1148 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1149 case SECPKG_ATTR_CONNECTION_INFO
:
1150 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1151 case SECPKG_ATTR_ENDPOINT_BINDINGS
:
1152 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1155 FIXME("Unhandled attribute %#x\n", attribute
);
1156 return SEC_E_UNSUPPORTED_FUNCTION
;
1160 static int schan_encrypt_message_get_next_buffer(const struct schan_transport
*t
, struct schan_buffers
*s
)
1164 if (s
->current_buffer_idx
== -1)
1165 return schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_STREAM_HEADER
);
1167 b
= &s
->desc
->pBuffers
[s
->current_buffer_idx
];
1169 if (b
->BufferType
== SECBUFFER_STREAM_HEADER
)
1170 return schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_DATA
);
1172 if (b
->BufferType
== SECBUFFER_DATA
)
1173 return schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_STREAM_TRAILER
);
1178 static int schan_encrypt_message_get_next_buffer_token(const struct schan_transport
*t
, struct schan_buffers
*s
)
1182 if (s
->current_buffer_idx
== -1)
1183 return schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_TOKEN
);
1185 b
= &s
->desc
->pBuffers
[s
->current_buffer_idx
];
1187 if (b
->BufferType
== SECBUFFER_TOKEN
)
1189 int idx
= schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_TOKEN
);
1190 if (idx
!= s
->current_buffer_idx
) return -1;
1191 return schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_DATA
);
1194 if (b
->BufferType
== SECBUFFER_DATA
)
1196 int idx
= schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_TOKEN
);
1198 idx
= schan_find_sec_buffer_idx(s
->desc
, idx
+ 1, SECBUFFER_TOKEN
);
1205 static SECURITY_STATUS SEC_ENTRY
schan_EncryptMessage(PCtxtHandle context_handle
,
1206 ULONG quality
, PSecBufferDesc message
, ULONG message_seq_no
)
1208 struct schan_context
*ctx
;
1209 struct schan_buffers
*b
;
1210 SECURITY_STATUS status
;
1217 TRACE("context_handle %p, quality %d, message %p, message_seq_no %d\n",
1218 context_handle
, quality
, message
, message_seq_no
);
1220 if (!context_handle
) return SEC_E_INVALID_HANDLE
;
1221 ctx
= schan_get_object(context_handle
->dwLower
, SCHAN_HANDLE_CTX
);
1223 dump_buffer_desc(message
);
1225 idx
= schan_find_sec_buffer_idx(message
, 0, SECBUFFER_DATA
);
1228 WARN("No data buffer passed\n");
1229 return SEC_E_INTERNAL_ERROR
;
1231 buffer
= &message
->pBuffers
[idx
];
1233 data_size
= buffer
->cbBuffer
;
1234 data
= heap_alloc(data_size
);
1235 memcpy(data
, buffer
->pvBuffer
, data_size
);
1237 if (schan_find_sec_buffer_idx(message
, 0, SECBUFFER_STREAM_HEADER
) != -1)
1238 init_schan_buffers(&ctx
->transport
.out
, message
, schan_encrypt_message_get_next_buffer
);
1240 init_schan_buffers(&ctx
->transport
.out
, message
, schan_encrypt_message_get_next_buffer_token
);
1243 status
= schan_imp_send(ctx
->session
, data
, &length
);
1245 TRACE("Sent %ld bytes.\n", length
);
1247 if (length
!= data_size
)
1248 status
= SEC_E_INTERNAL_ERROR
;
1250 b
= &ctx
->transport
.out
;
1251 b
->desc
->pBuffers
[b
->current_buffer_idx
].cbBuffer
= b
->offset
;
1254 TRACE("Returning %#x.\n", status
);
1259 static int schan_decrypt_message_get_next_buffer(const struct schan_transport
*t
, struct schan_buffers
*s
)
1261 if (s
->current_buffer_idx
== -1)
1262 return schan_find_sec_buffer_idx(s
->desc
, 0, SECBUFFER_DATA
);
1267 static int schan_validate_decrypt_buffer_desc(PSecBufferDesc message
)
1270 unsigned int empty_count
= 0;
1273 if (message
->cBuffers
< 4)
1275 WARN("Less than four buffers passed\n");
1279 for (i
= 0; i
< message
->cBuffers
; ++i
)
1281 SecBuffer
*b
= &message
->pBuffers
[i
];
1282 if (b
->BufferType
== SECBUFFER_DATA
)
1286 WARN("More than one data buffer passed\n");
1291 else if (b
->BufferType
== SECBUFFER_EMPTY
)
1297 WARN("No data buffer passed\n");
1301 if (empty_count
< 3)
1303 WARN("Less than three empty buffers passed\n");
1310 static void schan_decrypt_fill_buffer(PSecBufferDesc message
, ULONG buffer_type
, void *data
, ULONG size
)
1315 idx
= schan_find_sec_buffer_idx(message
, 0, SECBUFFER_EMPTY
);
1316 buffer
= &message
->pBuffers
[idx
];
1318 buffer
->BufferType
= buffer_type
;
1319 buffer
->pvBuffer
= data
;
1320 buffer
->cbBuffer
= size
;
1323 static SECURITY_STATUS SEC_ENTRY
schan_DecryptMessage(PCtxtHandle context_handle
,
1324 PSecBufferDesc message
, ULONG message_seq_no
, PULONG quality
)
1326 struct schan_context
*ctx
;
1330 unsigned expected_size
;
1331 SSIZE_T received
= 0;
1333 unsigned char *buf_ptr
;
1335 TRACE("context_handle %p, message %p, message_seq_no %d, quality %p\n",
1336 context_handle
, message
, message_seq_no
, quality
);
1338 if (!context_handle
) return SEC_E_INVALID_HANDLE
;
1339 ctx
= schan_get_object(context_handle
->dwLower
, SCHAN_HANDLE_CTX
);
1341 dump_buffer_desc(message
);
1343 idx
= schan_validate_decrypt_buffer_desc(message
);
1345 return SEC_E_INVALID_TOKEN
;
1346 buffer
= &message
->pBuffers
[idx
];
1347 buf_ptr
= buffer
->pvBuffer
;
1349 expected_size
= 5 + ((buf_ptr
[3] << 8) | buf_ptr
[4]);
1350 if(buffer
->cbBuffer
< expected_size
)
1352 TRACE("Expected %u bytes, but buffer only contains %u bytes\n", expected_size
, buffer
->cbBuffer
);
1353 buffer
->BufferType
= SECBUFFER_MISSING
;
1354 buffer
->cbBuffer
= expected_size
- buffer
->cbBuffer
;
1356 /* This is a bit weird, but windows does it too */
1357 idx
= schan_find_sec_buffer_idx(message
, 0, SECBUFFER_EMPTY
);
1358 buffer
= &message
->pBuffers
[idx
];
1359 buffer
->BufferType
= SECBUFFER_MISSING
;
1360 buffer
->cbBuffer
= expected_size
- buffer
->cbBuffer
;
1362 TRACE("Returning SEC_E_INCOMPLETE_MESSAGE\n");
1363 return SEC_E_INCOMPLETE_MESSAGE
;
1366 data_size
= expected_size
- 5;
1367 data
= heap_alloc(data_size
);
1369 init_schan_buffers(&ctx
->transport
.in
, message
, schan_decrypt_message_get_next_buffer
);
1370 ctx
->transport
.in
.limit
= expected_size
;
1372 while (received
< data_size
)
1374 SIZE_T length
= data_size
- received
;
1375 SECURITY_STATUS status
= schan_imp_recv(ctx
->session
, data
+ received
, &length
);
1377 if (status
== SEC_I_CONTINUE_NEEDED
)
1380 if (status
!= SEC_E_OK
)
1383 ERR("Returning %x\n", status
);
1393 TRACE("Received %ld bytes\n", received
);
1395 memcpy(buf_ptr
+ 5, data
, received
);
1398 schan_decrypt_fill_buffer(message
, SECBUFFER_DATA
,
1399 buf_ptr
+ 5, received
);
1401 schan_decrypt_fill_buffer(message
, SECBUFFER_STREAM_TRAILER
,
1402 buf_ptr
+ 5 + received
, buffer
->cbBuffer
- 5 - received
);
1404 if(buffer
->cbBuffer
> expected_size
)
1405 schan_decrypt_fill_buffer(message
, SECBUFFER_EXTRA
,
1406 buf_ptr
+ expected_size
, buffer
->cbBuffer
- expected_size
);
1408 buffer
->BufferType
= SECBUFFER_STREAM_HEADER
;
1409 buffer
->cbBuffer
= 5;
1414 static SECURITY_STATUS SEC_ENTRY
schan_DeleteSecurityContext(PCtxtHandle context_handle
)
1416 struct schan_context
*ctx
;
1418 TRACE("context_handle %p\n", context_handle
);
1420 if (!context_handle
) return SEC_E_INVALID_HANDLE
;
1422 ctx
= schan_free_handle(context_handle
->dwLower
, SCHAN_HANDLE_CTX
);
1423 if (!ctx
) return SEC_E_INVALID_HANDLE
;
1426 CertFreeCertificateContext(ctx
->cert
);
1427 schan_imp_dispose_session(ctx
->session
);
1433 static const SecurityFunctionTableA schanTableA
= {
1435 NULL
, /* EnumerateSecurityPackagesA */
1436 schan_QueryCredentialsAttributesA
,
1437 schan_AcquireCredentialsHandleA
,
1438 schan_FreeCredentialsHandle
,
1439 NULL
, /* Reserved2 */
1440 schan_InitializeSecurityContextA
,
1441 NULL
, /* AcceptSecurityContext */
1442 NULL
, /* CompleteAuthToken */
1443 schan_DeleteSecurityContext
,
1444 NULL
, /* ApplyControlToken */
1445 schan_QueryContextAttributesA
,
1446 NULL
, /* ImpersonateSecurityContext */
1447 NULL
, /* RevertSecurityContext */
1448 NULL
, /* MakeSignature */
1449 NULL
, /* VerifySignature */
1451 NULL
, /* QuerySecurityPackageInfoA */
1452 NULL
, /* Reserved3 */
1453 NULL
, /* Reserved4 */
1454 NULL
, /* ExportSecurityContext */
1455 NULL
, /* ImportSecurityContextA */
1456 NULL
, /* AddCredentialsA */
1457 NULL
, /* Reserved8 */
1458 NULL
, /* QuerySecurityContextToken */
1459 schan_EncryptMessage
,
1460 schan_DecryptMessage
,
1461 NULL
, /* SetContextAttributesA */
1464 static const SecurityFunctionTableW schanTableW
= {
1466 NULL
, /* EnumerateSecurityPackagesW */
1467 schan_QueryCredentialsAttributesW
,
1468 schan_AcquireCredentialsHandleW
,
1469 schan_FreeCredentialsHandle
,
1470 NULL
, /* Reserved2 */
1471 schan_InitializeSecurityContextW
,
1472 NULL
, /* AcceptSecurityContext */
1473 NULL
, /* CompleteAuthToken */
1474 schan_DeleteSecurityContext
,
1475 NULL
, /* ApplyControlToken */
1476 schan_QueryContextAttributesW
,
1477 NULL
, /* ImpersonateSecurityContext */
1478 NULL
, /* RevertSecurityContext */
1479 NULL
, /* MakeSignature */
1480 NULL
, /* VerifySignature */
1482 NULL
, /* QuerySecurityPackageInfoW */
1483 NULL
, /* Reserved3 */
1484 NULL
, /* Reserved4 */
1485 NULL
, /* ExportSecurityContext */
1486 NULL
, /* ImportSecurityContextW */
1487 NULL
, /* AddCredentialsW */
1488 NULL
, /* Reserved8 */
1489 NULL
, /* QuerySecurityContextToken */
1490 schan_EncryptMessage
,
1491 schan_DecryptMessage
,
1492 NULL
, /* SetContextAttributesW */
1495 static const WCHAR schannelComment
[] = { 'S','c','h','a','n','n','e','l',' ',
1496 'S','e','c','u','r','i','t','y',' ','P','a','c','k','a','g','e',0 };
1497 static const WCHAR schannelDllName
[] = { 's','c','h','a','n','n','e','l','.','d','l','l',0 };
1499 void SECUR32_initSchannelSP(void)
1501 /* This is what Windows reports. This shouldn't break any applications
1502 * even though the functions are missing, because the wrapper will
1503 * return SEC_E_UNSUPPORTED_FUNCTION if our function is NULL.
1505 static const LONG caps
=
1506 SECPKG_FLAG_INTEGRITY
|
1507 SECPKG_FLAG_PRIVACY
|
1508 SECPKG_FLAG_CONNECTION
|
1509 SECPKG_FLAG_MULTI_REQUIRED
|
1510 SECPKG_FLAG_EXTENDED_ERROR
|
1511 SECPKG_FLAG_IMPERSONATION
|
1512 SECPKG_FLAG_ACCEPT_WIN32_NAME
|
1514 static const short version
= 1;
1515 static const LONG maxToken
= 16384;
1516 SEC_WCHAR
*uniSPName
= (SEC_WCHAR
*)UNISP_NAME_W
,
1517 *schannel
= (SEC_WCHAR
*)SCHANNEL_NAME_W
;
1518 const SecPkgInfoW info
[] = {
1519 { caps
, version
, UNISP_RPC_ID
, maxToken
, uniSPName
, uniSPName
},
1520 { caps
, version
, UNISP_RPC_ID
, maxToken
, schannel
,
1521 (SEC_WCHAR
*)schannelComment
},
1523 SecureProvider
*provider
;
1525 if (!schan_imp_init())
1528 schan_handle_table
= heap_alloc(64 * sizeof(*schan_handle_table
));
1529 if (!schan_handle_table
)
1531 ERR("Failed to allocate schannel handle table.\n");
1534 schan_handle_table_size
= 64;
1536 provider
= SECUR32_addProvider(&schanTableA
, &schanTableW
, schannelDllName
);
1539 ERR("Failed to add schannel provider.\n");
1543 SECUR32_addPackages(provider
, sizeof(info
) / sizeof(info
[0]), NULL
, info
);
1548 heap_free(schan_handle_table
);
1549 schan_handle_table
= NULL
;
1554 void SECUR32_deinitSchannelSP(void)
1556 SIZE_T i
= schan_handle_count
;
1558 if (!schan_handle_table
) return;
1560 /* deinitialized sessions first because a pointer to the credentials
1561 * may be stored for the session. */
1564 if (schan_handle_table
[i
].type
== SCHAN_HANDLE_CTX
)
1566 struct schan_context
*ctx
= schan_free_handle(i
, SCHAN_HANDLE_CTX
);
1567 schan_imp_dispose_session(ctx
->session
);
1571 i
= schan_handle_count
;
1574 if (schan_handle_table
[i
].type
!= SCHAN_HANDLE_FREE
)
1576 struct schan_credentials
*cred
;
1577 cred
= schan_free_handle(i
, SCHAN_HANDLE_CRED
);
1578 schan_imp_free_certificate_credentials(cred
);
1582 heap_free(schan_handle_table
);
1586 #else /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H */
1588 void SECUR32_initSchannelSP(void)
1590 ERR("TLS library not found, SSL connections will fail\n");
1593 void SECUR32_deinitSchannelSP(void) {}
1595 #endif /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H */