1 /* Copyright (C) 2005 Juan Lang
2 * Copyright 2008 Henri Verbeet
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
18 * This file implements the schannel provider, or, the SSL/TLS implementations.
26 #define NONAMELESSUNION
36 #include "wine/unixlib.h"
37 #include "wine/debug.h"
38 #include "secur32_priv.h"
40 WINE_DEFAULT_DEBUG_CHANNEL(secur32
);
42 static unixlib_handle_t gnutls_handle
;
44 #define GNUTLS_CALL( func, params ) __wine_unix_call( gnutls_handle, unix_ ## func, params )
46 #define SCHAN_INVALID_HANDLE ~0UL
48 enum schan_handle_type
58 enum schan_handle_type type
;
63 struct schan_transport transport
;
65 const CERT_CONTEXT
*cert
;
69 static struct schan_handle
*schan_handle_table
;
70 static struct schan_handle
*schan_free_handles
;
71 static SIZE_T schan_handle_table_size
;
72 static SIZE_T schan_handle_count
;
74 /* Protocols enabled, only those may be used for the connection. */
75 static DWORD config_enabled_protocols
;
77 /* Protocols disabled by default. They are enabled for using, but disabled when caller asks for default settings. */
78 static DWORD config_default_disabled_protocols
;
80 static ULONG_PTR
schan_alloc_handle(void *object
, enum schan_handle_type type
)
82 struct schan_handle
*handle
;
84 if (schan_free_handles
)
86 DWORD index
= schan_free_handles
- schan_handle_table
;
87 /* Use a free handle */
88 handle
= schan_free_handles
;
89 if (handle
->type
!= SCHAN_HANDLE_FREE
)
91 ERR("Handle %d(%p) is in the free list, but has type %#x.\n", index
, handle
, handle
->type
);
92 return SCHAN_INVALID_HANDLE
;
94 schan_free_handles
= handle
->object
;
95 handle
->object
= object
;
100 if (!(schan_handle_count
< schan_handle_table_size
))
103 SIZE_T new_size
= schan_handle_table_size
+ (schan_handle_table_size
>> 1);
104 struct schan_handle
*new_table
= realloc(schan_handle_table
, new_size
* sizeof(*schan_handle_table
));
107 ERR("Failed to grow the handle table\n");
108 return SCHAN_INVALID_HANDLE
;
110 schan_handle_table
= new_table
;
111 schan_handle_table_size
= new_size
;
114 handle
= &schan_handle_table
[schan_handle_count
++];
115 handle
->object
= object
;
118 return handle
- schan_handle_table
;
121 static void *schan_free_handle(ULONG_PTR handle_idx
, enum schan_handle_type type
)
123 struct schan_handle
*handle
;
126 if (handle_idx
== SCHAN_INVALID_HANDLE
) return NULL
;
127 if (handle_idx
>= schan_handle_count
) return NULL
;
128 handle
= &schan_handle_table
[handle_idx
];
129 if (handle
->type
!= type
)
131 ERR("Handle %ld(%p) is not of type %#x\n", handle_idx
, handle
, type
);
135 object
= handle
->object
;
136 handle
->object
= schan_free_handles
;
137 handle
->type
= SCHAN_HANDLE_FREE
;
138 schan_free_handles
= handle
;
143 static void *schan_get_object(ULONG_PTR handle_idx
, enum schan_handle_type type
)
145 struct schan_handle
*handle
;
147 if (handle_idx
== SCHAN_INVALID_HANDLE
) return NULL
;
148 if (handle_idx
>= schan_handle_count
) return NULL
;
149 handle
= &schan_handle_table
[handle_idx
];
150 if (handle
->type
!= type
)
152 ERR("Handle %ld(%p) is not of type %#x\n", handle_idx
, handle
, type
);
156 return handle
->object
;
159 static void read_config(void)
161 DWORD enabled
= 0, default_disabled
= 0;
162 HKEY protocols_key
, key
;
163 WCHAR subkey_name
[64];
167 static BOOL config_read
= FALSE
;
168 static const struct {
170 DWORD prot_client_flag
;
171 BOOL enabled
; /* If no config is present, enable the protocol */
172 BOOL disabled_by_default
; /* Disable if caller asks for default protocol set */
173 } protocol_config_keys
[] = {
174 { L
"SSL 2.0", SP_PROT_SSL2_CLIENT
, FALSE
, TRUE
}, /* NOTE: TRUE, TRUE on Windows */
175 { L
"SSL 3.0", SP_PROT_SSL3_CLIENT
, TRUE
, FALSE
},
176 { L
"TLS 1.0", SP_PROT_TLS1_0_CLIENT
, TRUE
, FALSE
},
177 { L
"TLS 1.1", SP_PROT_TLS1_1_CLIENT
, TRUE
, FALSE
/* NOTE: not enabled by default on Windows */ },
178 { L
"TLS 1.2", SP_PROT_TLS1_2_CLIENT
, TRUE
, FALSE
/* NOTE: not enabled by default on Windows */ },
179 { L
"DTLS 1.0", SP_PROT_DTLS1_0_CLIENT
, TRUE
, TRUE
},
180 { L
"DTLS 1.2", SP_PROT_DTLS1_2_CLIENT
, TRUE
, TRUE
},
183 /* No need for thread safety */
187 res
= RegOpenKeyExW(HKEY_LOCAL_MACHINE
,
188 L
"SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols", 0, KEY_READ
,
190 if(res
== ERROR_SUCCESS
) {
191 DWORD type
, size
, value
;
193 for(i
= 0; i
< ARRAY_SIZE(protocol_config_keys
); i
++) {
194 wcscpy(subkey_name
, protocol_config_keys
[i
].key_name
);
195 wcscat(subkey_name
, L
"\\Client");
196 res
= RegOpenKeyExW(protocols_key
, subkey_name
, 0, KEY_READ
, &key
);
197 if(res
!= ERROR_SUCCESS
) {
198 if(protocol_config_keys
[i
].enabled
)
199 enabled
|= protocol_config_keys
[i
].prot_client_flag
;
200 if(protocol_config_keys
[i
].disabled_by_default
)
201 default_disabled
|= protocol_config_keys
[i
].prot_client_flag
;
205 size
= sizeof(value
);
206 res
= RegQueryValueExW(key
, L
"enabled", NULL
, &type
, (BYTE
*)&value
, &size
);
207 if(res
== ERROR_SUCCESS
) {
208 if(type
== REG_DWORD
&& value
)
209 enabled
|= protocol_config_keys
[i
].prot_client_flag
;
210 }else if(protocol_config_keys
[i
].enabled
) {
211 enabled
|= protocol_config_keys
[i
].prot_client_flag
;
214 size
= sizeof(value
);
215 res
= RegQueryValueExW(key
, L
"DisabledByDefault", NULL
, &type
, (BYTE
*)&value
, &size
);
216 if(res
== ERROR_SUCCESS
) {
217 if(type
!= REG_DWORD
|| value
)
218 default_disabled
|= protocol_config_keys
[i
].prot_client_flag
;
219 }else if(protocol_config_keys
[i
].disabled_by_default
) {
220 default_disabled
|= protocol_config_keys
[i
].prot_client_flag
;
226 /* No config, enable all known protocols. */
227 for(i
= 0; i
< ARRAY_SIZE(protocol_config_keys
); i
++) {
228 if(protocol_config_keys
[i
].enabled
)
229 enabled
|= protocol_config_keys
[i
].prot_client_flag
;
230 if(protocol_config_keys
[i
].disabled_by_default
)
231 default_disabled
|= protocol_config_keys
[i
].prot_client_flag
;
235 RegCloseKey(protocols_key
);
237 config_enabled_protocols
= enabled
& GNUTLS_CALL( get_enabled_protocols
, NULL
);
238 config_default_disabled_protocols
= default_disabled
;
241 TRACE("enabled %x, disabled by default %x\n", config_enabled_protocols
, config_default_disabled_protocols
);
244 static SECURITY_STATUS
schan_QueryCredentialsAttributes(
245 PCredHandle phCredential
, ULONG ulAttribute
, VOID
*pBuffer
)
247 struct schan_credentials
*cred
;
250 cred
= schan_get_object(phCredential
->dwLower
, SCHAN_HANDLE_CRED
);
252 return SEC_E_INVALID_HANDLE
;
256 case SECPKG_ATTR_SUPPORTED_ALGS
:
259 /* FIXME: get from CryptoAPI */
260 FIXME("SECPKG_ATTR_SUPPORTED_ALGS: stub\n");
261 ret
= SEC_E_UNSUPPORTED_FUNCTION
;
264 ret
= SEC_E_INTERNAL_ERROR
;
266 case SECPKG_ATTR_CIPHER_STRENGTHS
:
269 SecPkgCred_CipherStrengths
*r
= pBuffer
;
271 /* FIXME: get from CryptoAPI */
272 FIXME("SECPKG_ATTR_CIPHER_STRENGTHS: semi-stub\n");
273 r
->dwMinimumCipherStrength
= 40;
274 r
->dwMaximumCipherStrength
= 168;
278 ret
= SEC_E_INTERNAL_ERROR
;
280 case SECPKG_ATTR_SUPPORTED_PROTOCOLS
:
282 /* Regardless of MSDN documentation, tests show that this attribute takes into account
283 * what protocols are enabled for given credential. */
284 ((SecPkgCred_SupportedProtocols
*)pBuffer
)->grbitProtocol
= cred
->enabled_protocols
;
287 ret
= SEC_E_INTERNAL_ERROR
;
291 ret
= SEC_E_UNSUPPORTED_FUNCTION
;
296 static SECURITY_STATUS SEC_ENTRY
schan_QueryCredentialsAttributesA(
297 PCredHandle phCredential
, ULONG ulAttribute
, PVOID pBuffer
)
301 TRACE("(%p, %d, %p)\n", phCredential
, ulAttribute
, pBuffer
);
305 case SECPKG_CRED_ATTR_NAMES
:
306 FIXME("SECPKG_CRED_ATTR_NAMES: stub\n");
307 ret
= SEC_E_UNSUPPORTED_FUNCTION
;
310 ret
= schan_QueryCredentialsAttributes(phCredential
, ulAttribute
,
316 static SECURITY_STATUS SEC_ENTRY
schan_QueryCredentialsAttributesW(
317 PCredHandle phCredential
, ULONG ulAttribute
, PVOID pBuffer
)
321 TRACE("(%p, %d, %p)\n", phCredential
, ulAttribute
, pBuffer
);
325 case SECPKG_CRED_ATTR_NAMES
:
326 FIXME("SECPKG_CRED_ATTR_NAMES: stub\n");
327 ret
= SEC_E_UNSUPPORTED_FUNCTION
;
330 ret
= schan_QueryCredentialsAttributes(phCredential
, ulAttribute
,
336 static SECURITY_STATUS
get_cert(const SCHANNEL_CRED
*cred
, CERT_CONTEXT
const **cert
)
338 SECURITY_STATUS status
;
341 TRACE("dwVersion = %u\n", cred
->dwVersion
);
342 TRACE("cCreds = %u\n", cred
->cCreds
);
343 TRACE("paCred = %p\n", cred
->paCred
);
344 TRACE("hRootStore = %p\n", cred
->hRootStore
);
345 TRACE("cMappers = %u\n", cred
->cMappers
);
346 TRACE("cSupportedAlgs = %u:\n", cred
->cSupportedAlgs
);
347 for (i
= 0; i
< cred
->cSupportedAlgs
; i
++) TRACE("%08x\n", cred
->palgSupportedAlgs
[i
]);
348 TRACE("grbitEnabledProtocols = %08x\n", cred
->grbitEnabledProtocols
);
349 TRACE("dwMinimumCipherStrength = %u\n", cred
->dwMinimumCipherStrength
);
350 TRACE("dwMaximumCipherStrength = %u\n", cred
->dwMaximumCipherStrength
);
351 TRACE("dwSessionLifespan = %u\n", cred
->dwSessionLifespan
);
352 TRACE("dwFlags = %08x\n", cred
->dwFlags
);
353 TRACE("dwCredFormat = %u\n", cred
->dwCredFormat
);
355 switch (cred
->dwVersion
)
358 case SCHANNEL_CRED_VERSION
:
361 return SEC_E_INTERNAL_ERROR
;
364 if (!cred
->cCreds
) status
= SEC_E_NO_CREDENTIALS
;
365 else if (cred
->cCreds
> 1) status
= SEC_E_UNKNOWN_CREDENTIALS
;
372 if (CryptAcquireCertificatePrivateKey(cred
->paCred
[0], CRYPT_ACQUIRE_CACHE_FLAG
, NULL
, &prov
, &spec
, &free
))
374 if (free
) CryptReleaseContext(prov
, 0);
375 *cert
= cred
->paCred
[0];
378 else status
= SEC_E_UNKNOWN_CREDENTIALS
;
384 static WCHAR
*get_key_container_path(const CERT_CONTEXT
*ctx
)
386 CERT_KEY_CONTEXT keyctx
;
387 DWORD size
= sizeof(keyctx
), prov_size
= 0;
388 CRYPT_KEY_PROV_INFO
*prov
;
389 WCHAR username
[UNLEN
+ 1], *ret
= NULL
;
390 DWORD len
= ARRAY_SIZE(username
);
392 if (CertGetCertificateContextProperty(ctx
, CERT_KEY_CONTEXT_PROP_ID
, &keyctx
, &size
))
395 if (!CryptGetProvParam(keyctx
.hCryptProv
, PP_CONTAINER
, NULL
, &size
, 0)) return NULL
;
396 if (!(str
= RtlAllocateHeap(GetProcessHeap(), 0, size
))) return NULL
;
397 if (!CryptGetProvParam(keyctx
.hCryptProv
, PP_CONTAINER
, (BYTE
*)str
, &size
, 0)) return NULL
;
399 len
= MultiByteToWideChar(CP_ACP
, 0, str
, -1, NULL
, 0);
400 if (!(ret
= RtlAllocateHeap(GetProcessHeap(), 0, sizeof(L
"Software\\Wine\\Crypto\\RSA\\") + len
* sizeof(WCHAR
))))
402 RtlFreeHeap(GetProcessHeap(), 0, str
);
405 wcscpy(ret
, L
"Software\\Wine\\Crypto\\RSA\\");
406 MultiByteToWideChar(CP_ACP
, 0, str
, -1, ret
+ wcslen(ret
), len
);
407 RtlFreeHeap(GetProcessHeap(), 0, str
);
409 else if (CertGetCertificateContextProperty(ctx
, CERT_KEY_PROV_INFO_PROP_ID
, NULL
, &prov_size
))
411 if (!(prov
= RtlAllocateHeap(GetProcessHeap(), 0, prov_size
))) return NULL
;
412 if (!CertGetCertificateContextProperty(ctx
, CERT_KEY_PROV_INFO_PROP_ID
, prov
, &prov_size
))
414 RtlFreeHeap(GetProcessHeap(), 0, prov
);
417 if (!(ret
= RtlAllocateHeap(GetProcessHeap(), 0,
418 sizeof(L
"Software\\Wine\\Crypto\\RSA\\") + wcslen(prov
->pwszContainerName
) * sizeof(WCHAR
))))
420 RtlFreeHeap(GetProcessHeap(), 0, prov
);
423 wcscpy(ret
, L
"Software\\Wine\\Crypto\\RSA\\");
424 wcscat(ret
, prov
->pwszContainerName
);
425 RtlFreeHeap(GetProcessHeap(), 0, prov
);
428 if (!ret
&& GetUserNameW(username
, &len
) &&
429 (ret
= RtlAllocateHeap(GetProcessHeap(), 0, sizeof(L
"Software\\Wine\\Crypto\\RSA\\") + len
* sizeof(WCHAR
))))
431 wcscpy(ret
, L
"Software\\Wine\\Crypto\\RSA\\");
432 wcscat(ret
, username
);
438 #define MAX_LEAD_BYTES 8
439 static BYTE
*get_key_blob(const CERT_CONTEXT
*ctx
, DWORD
*size
)
441 BYTE
*buf
, *ret
= NULL
;
442 DATA_BLOB blob_in
, blob_out
;
443 DWORD spec
= 0, type
, len
;
447 if (!(path
= get_key_container_path(ctx
))) return NULL
;
448 if (RegOpenKeyExW(HKEY_CURRENT_USER
, path
, 0, KEY_READ
, &hkey
))
450 RtlFreeHeap(GetProcessHeap(), 0, path
);
453 RtlFreeHeap(GetProcessHeap(), 0, path
);
455 if (!RegQueryValueExW(hkey
, L
"KeyExchangeKeyPair", 0, &type
, NULL
, &len
)) spec
= AT_KEYEXCHANGE
;
456 else if (!RegQueryValueExW(hkey
, L
"SignatureKeyPair", 0, &type
, NULL
, &len
)) spec
= AT_SIGNATURE
;
463 if (!(buf
= RtlAllocateHeap(GetProcessHeap(), 0, len
+ MAX_LEAD_BYTES
)))
469 if (!RegQueryValueExW(hkey
, (spec
== AT_KEYEXCHANGE
) ? L
"KeyExchangeKeyPair" : L
"SignatureKeyPair", 0,
472 blob_in
.pbData
= buf
;
473 blob_in
.cbData
= len
;
474 if (CryptUnprotectData(&blob_in
, NULL
, NULL
, NULL
, NULL
, 0, &blob_out
))
476 assert(blob_in
.cbData
>= blob_out
.cbData
);
477 memcpy(buf
, blob_out
.pbData
, blob_out
.cbData
);
478 LocalFree(blob_out
.pbData
);
479 *size
= blob_out
.cbData
+ MAX_LEAD_BYTES
;
483 else RtlFreeHeap(GetProcessHeap(), 0, buf
);
489 static SECURITY_STATUS
schan_AcquireClientCredentials(const SCHANNEL_CRED
*schanCred
,
490 PCredHandle phCredential
, PTimeStamp ptsExpiry
)
492 struct schan_credentials
*creds
;
493 unsigned enabled_protocols
;
495 SECURITY_STATUS status
= SEC_E_OK
;
496 const CERT_CONTEXT
*cert
= NULL
;
497 DATA_BLOB key_blob
= {0};
498 struct allocate_certificate_credentials_params params
;
500 TRACE("schanCred %p, phCredential %p, ptsExpiry %p\n", schanCred
, phCredential
, ptsExpiry
);
504 const unsigned dtls_protocols
= SP_PROT_DTLS_CLIENT
| SP_PROT_DTLS1_2_CLIENT
;
505 const unsigned tls_protocols
= SP_PROT_TLS1_CLIENT
| SP_PROT_TLS1_0_CLIENT
| SP_PROT_TLS1_1_CLIENT
|
506 SP_PROT_TLS1_2_CLIENT
| SP_PROT_TLS1_3_CLIENT
;
508 status
= get_cert(schanCred
, &cert
);
509 if (status
!= SEC_E_OK
&& status
!= SEC_E_NO_CREDENTIALS
)
512 if ((schanCred
->grbitEnabledProtocols
& tls_protocols
) &&
513 (schanCred
->grbitEnabledProtocols
& dtls_protocols
)) return SEC_E_ALGORITHM_MISMATCH
;
519 if(schanCred
&& schanCred
->grbitEnabledProtocols
)
520 enabled_protocols
= schanCred
->grbitEnabledProtocols
& config_enabled_protocols
;
522 enabled_protocols
= config_enabled_protocols
& ~config_default_disabled_protocols
;
523 if(!enabled_protocols
) {
524 ERR("Could not find matching protocol\n");
525 return SEC_E_NO_AUTHENTICATING_AUTHORITY
;
528 if (!(creds
= malloc(sizeof(*creds
)))) return SEC_E_INSUFFICIENT_MEMORY
;
529 creds
->credential_use
= SECPKG_CRED_OUTBOUND
;
530 creds
->enabled_protocols
= enabled_protocols
;
532 if (cert
&& !(key_blob
.pbData
= get_key_blob(cert
, &key_blob
.cbData
))) goto fail
;
535 params
.key_blob
= &key_blob
;
536 if (GNUTLS_CALL( allocate_certificate_credentials
, ¶ms
)) goto fail
;
537 RtlFreeHeap(GetProcessHeap(), 0, key_blob
.pbData
);
539 handle
= schan_alloc_handle(creds
, SCHAN_HANDLE_CRED
);
540 if (handle
== SCHAN_INVALID_HANDLE
) goto fail
;
542 phCredential
->dwLower
= handle
;
543 phCredential
->dwUpper
= 0;
545 /* Outbound credentials have no expiry */
548 ptsExpiry
->LowPart
= 0;
549 ptsExpiry
->HighPart
= 0;
556 RtlFreeHeap(GetProcessHeap(), 0, key_blob
.pbData
);
557 return SEC_E_INTERNAL_ERROR
;
560 static SECURITY_STATUS
schan_AcquireServerCredentials(const SCHANNEL_CRED
*schanCred
,
561 PCredHandle phCredential
, PTimeStamp ptsExpiry
)
563 SECURITY_STATUS status
;
564 const CERT_CONTEXT
*cert
= NULL
;
566 TRACE("schanCred %p, phCredential %p, ptsExpiry %p\n", schanCred
, phCredential
, ptsExpiry
);
568 if (!schanCred
) return SEC_E_NO_CREDENTIALS
;
570 status
= get_cert(schanCred
, &cert
);
571 if (status
== SEC_E_OK
)
574 struct schan_credentials
*creds
;
576 if (!(creds
= calloc(1, sizeof(*creds
)))) return SEC_E_INSUFFICIENT_MEMORY
;
577 creds
->credential_use
= SECPKG_CRED_INBOUND
;
579 handle
= schan_alloc_handle(creds
, SCHAN_HANDLE_CRED
);
580 if (handle
== SCHAN_INVALID_HANDLE
)
583 return SEC_E_INTERNAL_ERROR
;
586 phCredential
->dwLower
= handle
;
587 phCredential
->dwUpper
= 0;
589 /* FIXME: get expiry from cert */
594 static SECURITY_STATUS
schan_AcquireCredentialsHandle(ULONG fCredentialUse
,
595 const SCHANNEL_CRED
*schanCred
, PCredHandle phCredential
, PTimeStamp ptsExpiry
)
599 if (fCredentialUse
== SECPKG_CRED_OUTBOUND
)
600 ret
= schan_AcquireClientCredentials(schanCred
, phCredential
,
603 ret
= schan_AcquireServerCredentials(schanCred
, phCredential
,
608 static SECURITY_STATUS SEC_ENTRY
schan_AcquireCredentialsHandleA(
609 SEC_CHAR
*pszPrincipal
, SEC_CHAR
*pszPackage
, ULONG fCredentialUse
,
610 PLUID pLogonID
, PVOID pAuthData
, SEC_GET_KEY_FN pGetKeyFn
,
611 PVOID pGetKeyArgument
, PCredHandle phCredential
, PTimeStamp ptsExpiry
)
613 TRACE("(%s, %s, 0x%08x, %p, %p, %p, %p, %p, %p)\n",
614 debugstr_a(pszPrincipal
), debugstr_a(pszPackage
), fCredentialUse
,
615 pLogonID
, pAuthData
, pGetKeyFn
, pGetKeyArgument
, phCredential
, ptsExpiry
);
616 return schan_AcquireCredentialsHandle(fCredentialUse
,
617 pAuthData
, phCredential
, ptsExpiry
);
620 static SECURITY_STATUS SEC_ENTRY
schan_AcquireCredentialsHandleW(
621 SEC_WCHAR
*pszPrincipal
, SEC_WCHAR
*pszPackage
, ULONG fCredentialUse
,
622 PLUID pLogonID
, PVOID pAuthData
, SEC_GET_KEY_FN pGetKeyFn
,
623 PVOID pGetKeyArgument
, PCredHandle phCredential
, PTimeStamp ptsExpiry
)
625 TRACE("(%s, %s, 0x%08x, %p, %p, %p, %p, %p, %p)\n",
626 debugstr_w(pszPrincipal
), debugstr_w(pszPackage
), fCredentialUse
,
627 pLogonID
, pAuthData
, pGetKeyFn
, pGetKeyArgument
, phCredential
, ptsExpiry
);
628 return schan_AcquireCredentialsHandle(fCredentialUse
,
629 pAuthData
, phCredential
, ptsExpiry
);
632 static SECURITY_STATUS SEC_ENTRY
schan_FreeCredentialsHandle(
633 PCredHandle phCredential
)
635 struct schan_credentials
*creds
;
637 TRACE("phCredential %p\n", phCredential
);
639 if (!phCredential
) return SEC_E_INVALID_HANDLE
;
641 creds
= schan_free_handle(phCredential
->dwLower
, SCHAN_HANDLE_CRED
);
642 if (!creds
) return SEC_E_INVALID_HANDLE
;
644 if (creds
->credential_use
== SECPKG_CRED_OUTBOUND
)
646 struct free_certificate_credentials_params params
= { creds
};
647 GNUTLS_CALL( free_certificate_credentials
, ¶ms
);
653 static int schan_find_sec_buffer_idx(const SecBufferDesc
*desc
, unsigned int start_idx
, ULONG buffer_type
)
658 for (i
= start_idx
; i
< desc
->cBuffers
; ++i
)
660 buffer
= &desc
->pBuffers
[i
];
661 if ((buffer
->BufferType
| SECBUFFER_ATTRMASK
) == (buffer_type
| SECBUFFER_ATTRMASK
))
668 static void dump_buffer_desc(SecBufferDesc
*desc
)
673 TRACE("Buffer desc %p:\n", desc
);
674 for (i
= 0; i
< desc
->cBuffers
; ++i
)
676 SecBuffer
*b
= &desc
->pBuffers
[i
];
677 TRACE("\tbuffer %u: cbBuffer %d, BufferType %#x pvBuffer %p\n", i
, b
->cbBuffer
, b
->BufferType
, b
->pvBuffer
);
681 #define HEADER_SIZE_TLS 5
682 #define HEADER_SIZE_DTLS 13
684 static inline SIZE_T
read_record_size(const BYTE
*buf
, SIZE_T header_size
)
686 return (buf
[header_size
- 2] << 8) | buf
[header_size
- 1];
689 static inline BOOL
is_dtls_context(const struct schan_context
*ctx
)
691 return ctx
->header_size
== HEADER_SIZE_DTLS
;
694 /***********************************************************************
695 * InitializeSecurityContextW
697 static SECURITY_STATUS SEC_ENTRY
schan_InitializeSecurityContextW(
698 PCredHandle phCredential
, PCtxtHandle phContext
, SEC_WCHAR
*pszTargetName
,
699 ULONG fContextReq
, ULONG Reserved1
, ULONG TargetDataRep
,
700 PSecBufferDesc pInput
, ULONG Reserved2
, PCtxtHandle phNewContext
,
701 PSecBufferDesc pOutput
, ULONG
*pfContextAttr
, PTimeStamp ptsExpiry
)
703 const ULONG extra_size
= 0x10000;
704 struct schan_context
*ctx
;
705 struct schan_buffers
*out_buffers
;
706 struct schan_credentials
*cred
;
707 SIZE_T expected_size
= ~0UL;
710 SecBuffer alloc_buffer
= { 0 };
711 struct handshake_params params
;
714 TRACE("%p %p %s 0x%08x %d %d %p %d %p %p %p %p\n", phCredential
, phContext
,
715 debugstr_w(pszTargetName
), fContextReq
, Reserved1
, TargetDataRep
, pInput
,
716 Reserved1
, phNewContext
, pOutput
, pfContextAttr
, ptsExpiry
);
718 dump_buffer_desc(pInput
);
719 dump_buffer_desc(pOutput
);
723 ptsExpiry
->LowPart
= 0;
724 ptsExpiry
->HighPart
= 0;
727 if (!pOutput
|| !pOutput
->cBuffers
) return SEC_E_INVALID_TOKEN
;
728 for (i
= 0; i
< pOutput
->cBuffers
; i
++)
730 ULONG type
= pOutput
->pBuffers
[i
].BufferType
;
732 if (type
!= SECBUFFER_TOKEN
&& type
!= SECBUFFER_ALERT
) continue;
733 if (!pOutput
->pBuffers
[i
].cbBuffer
&& !(fContextReq
& ISC_REQ_ALLOCATE_MEMORY
))
734 return SEC_E_INSUFFICIENT_MEMORY
;
740 struct create_session_params create_params
;
742 if (!phCredential
) return SEC_E_INVALID_HANDLE
;
744 cred
= schan_get_object(phCredential
->dwLower
, SCHAN_HANDLE_CRED
);
745 if (!cred
) return SEC_E_INVALID_HANDLE
;
747 if (!(cred
->credential_use
& SECPKG_CRED_OUTBOUND
))
749 WARN("Invalid credential use %#x\n", cred
->credential_use
);
750 return SEC_E_INVALID_HANDLE
;
753 if (!(ctx
= malloc(sizeof(*ctx
)))) return SEC_E_INSUFFICIENT_MEMORY
;
756 handle
= schan_alloc_handle(ctx
, SCHAN_HANDLE_CTX
);
757 if (handle
== SCHAN_INVALID_HANDLE
)
760 return SEC_E_INTERNAL_ERROR
;
763 create_params
.transport
= &ctx
->transport
;
764 create_params
.cred
= cred
;
765 if (GNUTLS_CALL( create_session
, &create_params
))
767 schan_free_handle(handle
, SCHAN_HANDLE_CTX
);
769 return SEC_E_INTERNAL_ERROR
;
772 if (cred
->enabled_protocols
& (SP_PROT_DTLS1_0_CLIENT
| SP_PROT_DTLS1_2_CLIENT
))
773 ctx
->header_size
= HEADER_SIZE_DTLS
;
775 ctx
->header_size
= HEADER_SIZE_TLS
;
777 ctx
->transport
.ctx
= ctx
;
779 if (pszTargetName
&& *pszTargetName
)
781 UINT len
= WideCharToMultiByte( CP_UNIXCP
, 0, pszTargetName
, -1, NULL
, 0, NULL
, NULL
);
782 char *target
= malloc( len
);
786 struct set_session_target_params params
= { ctx
->transport
.session
, target
};
787 WideCharToMultiByte( CP_UNIXCP
, 0, pszTargetName
, -1, target
, len
, NULL
, NULL
);
788 GNUTLS_CALL( set_session_target
, ¶ms
);
793 if (pInput
&& (idx
= schan_find_sec_buffer_idx(pInput
, 0, SECBUFFER_APPLICATION_PROTOCOLS
)) != -1)
795 struct set_application_protocols_params params
= { ctx
->transport
.session
,
796 pInput
->pBuffers
[idx
].pvBuffer
, pInput
->pBuffers
[idx
].cbBuffer
};
797 GNUTLS_CALL( set_application_protocols
, ¶ms
);
800 if (pInput
&& (idx
= schan_find_sec_buffer_idx(pInput
, 0, SECBUFFER_DTLS_MTU
)) != -1)
802 buffer
= &pInput
->pBuffers
[idx
];
803 if (buffer
->cbBuffer
>= sizeof(WORD
))
805 struct set_dtls_mtu_params params
= { ctx
->transport
.session
, *(WORD
*)buffer
->pvBuffer
};
806 GNUTLS_CALL( set_dtls_mtu
, ¶ms
);
808 else WARN("invalid buffer size %u\n", buffer
->cbBuffer
);
811 if (is_dtls_context(ctx
))
813 struct set_dtls_timeouts_params params
= { ctx
->transport
.session
, 0, 60000 };
814 GNUTLS_CALL( set_dtls_timeouts
, ¶ms
);
817 phNewContext
->dwLower
= handle
;
818 phNewContext
->dwUpper
= 0;
822 SIZE_T record_size
= 0;
825 if (!(ctx
= schan_get_object(phContext
->dwLower
, SCHAN_HANDLE_CTX
))) return SEC_E_INVALID_HANDLE
;
826 if (!pInput
) return is_dtls_context(ctx
) ? SEC_E_INSUFFICIENT_MEMORY
: SEC_E_INCOMPLETE_MESSAGE
;
827 if ((idx
= schan_find_sec_buffer_idx(pInput
, 0, SECBUFFER_TOKEN
)) == -1) return SEC_E_INCOMPLETE_MESSAGE
;
829 buffer
= &pInput
->pBuffers
[idx
];
830 ptr
= buffer
->pvBuffer
;
833 while (buffer
->cbBuffer
> expected_size
+ ctx
->header_size
)
835 record_size
= ctx
->header_size
+ read_record_size(ptr
, ctx
->header_size
);
837 if (buffer
->cbBuffer
< expected_size
+ record_size
) break;
838 expected_size
+= record_size
;
844 TRACE("Expected at least %lu bytes, but buffer only contains %u bytes.\n",
845 max(ctx
->header_size
+ 1, record_size
), buffer
->cbBuffer
);
846 return SEC_E_INCOMPLETE_MESSAGE
;
849 TRACE("Using expected_size %lu.\n", expected_size
);
851 if (phNewContext
) *phNewContext
= *phContext
;
854 ctx
->req_ctx_attr
= fContextReq
;
856 /* Perform the TLS handshake */
857 if (fContextReq
& ISC_REQ_ALLOCATE_MEMORY
)
859 alloc_buffer
.cbBuffer
= extra_size
;
860 alloc_buffer
.BufferType
= SECBUFFER_TOKEN
;
861 alloc_buffer
.pvBuffer
= RtlAllocateHeap( GetProcessHeap(), 0, extra_size
);
863 params
.session
= ctx
->transport
.session
;
864 params
.input
= pInput
;
865 params
.input_size
= expected_size
;
866 params
.output
= pOutput
;
867 params
.alloc_buffer
= &alloc_buffer
;
868 ret
= GNUTLS_CALL( handshake
, ¶ms
);
870 out_buffers
= &ctx
->transport
.out
;
871 if (out_buffers
->current_buffer_idx
!= -1)
873 SecBuffer
*buffer
= &out_buffers
->desc
->pBuffers
[out_buffers
->current_buffer_idx
];
874 buffer
->cbBuffer
= out_buffers
->offset
;
875 if (buffer
->pvBuffer
== alloc_buffer
.pvBuffer
)
877 RtlReAllocateHeap( GetProcessHeap(), HEAP_REALLOC_IN_PLACE_ONLY
,
878 buffer
->pvBuffer
, buffer
->cbBuffer
);
879 alloc_buffer
.pvBuffer
= NULL
;
882 else if (out_buffers
->desc
&& out_buffers
->desc
->cBuffers
> 0)
884 SecBuffer
*buffer
= &out_buffers
->desc
->pBuffers
[0];
885 buffer
->cbBuffer
= 0;
887 RtlFreeHeap( GetProcessHeap(), 0, alloc_buffer
.pvBuffer
);
889 if(ctx
->transport
.in
.offset
&& ctx
->transport
.in
.offset
!= pInput
->pBuffers
[0].cbBuffer
) {
890 if(pInput
->cBuffers
<2 || pInput
->pBuffers
[1].BufferType
!=SECBUFFER_EMPTY
)
891 return SEC_E_INVALID_TOKEN
;
893 pInput
->pBuffers
[1].BufferType
= SECBUFFER_EXTRA
;
894 pInput
->pBuffers
[1].cbBuffer
= pInput
->pBuffers
[0].cbBuffer
-ctx
->transport
.in
.offset
;
897 for (i
= 0; i
< pOutput
->cBuffers
; i
++)
899 SecBuffer
*buffer
= &pOutput
->pBuffers
[i
];
900 if (buffer
->BufferType
== SECBUFFER_ALERT
) buffer
->cbBuffer
= 0;
903 *pfContextAttr
= ISC_RET_REPLAY_DETECT
| ISC_RET_SEQUENCE_DETECT
| ISC_RET_CONFIDENTIALITY
| ISC_RET_STREAM
;
904 if (ctx
->req_ctx_attr
& ISC_REQ_EXTENDED_ERROR
) *pfContextAttr
|= ISC_RET_EXTENDED_ERROR
;
905 if (ctx
->req_ctx_attr
& ISC_REQ_DATAGRAM
) *pfContextAttr
|= ISC_RET_DATAGRAM
;
906 if (ctx
->req_ctx_attr
& ISC_REQ_ALLOCATE_MEMORY
) *pfContextAttr
|= ISC_RET_ALLOCATED_MEMORY
;
907 if (ctx
->req_ctx_attr
& ISC_REQ_USE_SUPPLIED_CREDS
) *pfContextAttr
|= ISC_RET_USED_SUPPLIED_CREDS
;
908 if (ctx
->req_ctx_attr
& ISC_REQ_MANUAL_CRED_VALIDATION
) *pfContextAttr
|= ISC_RET_MANUAL_CRED_VALIDATION
;
913 /***********************************************************************
914 * InitializeSecurityContextA
916 static SECURITY_STATUS SEC_ENTRY
schan_InitializeSecurityContextA(
917 PCredHandle phCredential
, PCtxtHandle phContext
, SEC_CHAR
*pszTargetName
,
918 ULONG fContextReq
, ULONG Reserved1
, ULONG TargetDataRep
,
919 PSecBufferDesc pInput
, ULONG Reserved2
, PCtxtHandle phNewContext
,
920 PSecBufferDesc pOutput
, ULONG
*pfContextAttr
, PTimeStamp ptsExpiry
)
923 SEC_WCHAR
*target_name
= NULL
;
925 TRACE("%p %p %s %d %d %d %p %d %p %p %p %p\n", phCredential
, phContext
,
926 debugstr_a(pszTargetName
), fContextReq
, Reserved1
, TargetDataRep
, pInput
,
927 Reserved1
, phNewContext
, pOutput
, pfContextAttr
, ptsExpiry
);
931 INT len
= MultiByteToWideChar(CP_ACP
, 0, pszTargetName
, -1, NULL
, 0);
932 if (!(target_name
= malloc(len
* sizeof(*target_name
)))) return SEC_E_INSUFFICIENT_MEMORY
;
933 MultiByteToWideChar(CP_ACP
, 0, pszTargetName
, -1, target_name
, len
);
936 ret
= schan_InitializeSecurityContextW(phCredential
, phContext
, target_name
,
937 fContextReq
, Reserved1
, TargetDataRep
, pInput
, Reserved2
,
938 phNewContext
, pOutput
, pfContextAttr
, ptsExpiry
);
944 static void *get_alg_name(ALG_ID id
, BOOL wide
)
946 static const struct {
949 const WCHAR nameW
[8];
951 { CALG_ECDSA
, "ECDSA", L
"ECDSA" },
952 { CALG_RSA_SIGN
, "RSA", L
"RSA" },
953 { CALG_DES
, "DES", L
"DES" },
954 { CALG_RC2
, "RC2", L
"RC2" },
955 { CALG_3DES
, "3DES", L
"3DES" },
956 { CALG_AES_128
, "AES", L
"AES" },
957 { CALG_AES_192
, "AES", L
"AES" },
958 { CALG_AES_256
, "AES", L
"AES" },
959 { CALG_RC4
, "RC4", L
"RC4" },
963 for (i
= 0; i
< ARRAY_SIZE(alg_name_map
); i
++)
964 if (alg_name_map
[i
].alg_id
== id
)
965 return wide
? (void*)alg_name_map
[i
].nameW
: (void*)alg_name_map
[i
].name
;
967 FIXME("Unknown ALG_ID %04x\n", id
);
971 static SECURITY_STATUS
ensure_remote_cert(struct schan_context
*ctx
)
974 PCCERT_CONTEXT cert
= NULL
;
975 SECURITY_STATUS status
;
977 ULONG count
, size
= 0;
978 struct get_session_peer_certificate_params params
= { ctx
->transport
.session
, NULL
, &size
, &count
};
980 if (ctx
->cert
) return SEC_E_OK
;
981 if (!(store
= CertOpenStore(CERT_STORE_PROV_MEMORY
, 0, 0, CERT_STORE_CREATE_NEW_FLAG
, NULL
)))
982 return GetLastError();
984 status
= GNUTLS_CALL( get_session_peer_certificate
, ¶ms
);
985 if (status
!= SEC_E_BUFFER_TOO_SMALL
) goto done
;
986 if (!(certs
= malloc( size
)))
988 status
= SEC_E_INSUFFICIENT_MEMORY
;
991 params
.certs
= certs
;
992 status
= GNUTLS_CALL( get_session_peer_certificate
, ¶ms
);
993 if (status
== SEC_E_OK
)
996 for (i
= 0; i
< count
; i
++)
998 if (!CertAddEncodedCertificateToStore(store
, X509_ASN_ENCODING
, certs
[i
].pbData
,
999 certs
[i
].cbData
, CERT_STORE_ADD_REPLACE_EXISTING
,
1002 if (i
) CertFreeCertificateContext(cert
);
1003 return GetLastError();
1010 CertCloseStore(store
, 0);
1014 static SECURITY_STATUS SEC_ENTRY
schan_QueryContextAttributesW(
1015 PCtxtHandle context_handle
, ULONG attribute
, PVOID buffer
)
1017 struct schan_context
*ctx
;
1018 SECURITY_STATUS status
;
1020 TRACE("context_handle %p, attribute %#x, buffer %p\n",
1021 context_handle
, attribute
, buffer
);
1023 if (!context_handle
) return SEC_E_INVALID_HANDLE
;
1024 ctx
= schan_get_object(context_handle
->dwLower
, SCHAN_HANDLE_CTX
);
1028 case SECPKG_ATTR_STREAM_SIZES
:
1030 SecPkgContext_ConnectionInfo info
;
1031 struct get_connection_info_params params
= { ctx
->transport
.session
, &info
};
1032 status
= GNUTLS_CALL( get_connection_info
, ¶ms
);
1033 if (status
== SEC_E_OK
)
1035 struct session_params params
= { ctx
->transport
.session
};
1036 SecPkgContext_StreamSizes
*stream_sizes
= buffer
;
1037 SIZE_T mac_size
= info
.dwHashStrength
;
1038 unsigned int block_size
= GNUTLS_CALL( get_session_cipher_block_size
, ¶ms
);
1039 unsigned int message_size
= GNUTLS_CALL( get_max_message_size
, ¶ms
);
1041 TRACE("Using header size %lu mac bytes %lu, message size %u, block size %u\n",
1042 ctx
->header_size
, mac_size
, message_size
, block_size
);
1044 /* These are defined by the TLS RFC */
1045 stream_sizes
->cbHeader
= ctx
->header_size
;
1046 stream_sizes
->cbTrailer
= mac_size
+ 256; /* Max 255 bytes padding + 1 for padding size */
1047 stream_sizes
->cbMaximumMessage
= message_size
;
1048 stream_sizes
->cbBuffers
= 4;
1049 stream_sizes
->cbBlockSize
= block_size
;
1054 case SECPKG_ATTR_KEY_INFO
:
1056 SecPkgContext_ConnectionInfo conn_info
;
1057 struct get_connection_info_params params
= { ctx
->transport
.session
, &conn_info
};
1058 status
= GNUTLS_CALL( get_connection_info
, ¶ms
);
1059 if (status
== SEC_E_OK
)
1061 struct session_params params
= { ctx
->transport
.session
};
1062 SecPkgContext_KeyInfoW
*info
= buffer
;
1063 info
->KeySize
= conn_info
.dwCipherStrength
;
1064 info
->SignatureAlgorithm
= GNUTLS_CALL( get_key_signature_algorithm
, ¶ms
);
1065 info
->EncryptAlgorithm
= conn_info
.aiCipher
;
1066 info
->sSignatureAlgorithmName
= get_alg_name(info
->SignatureAlgorithm
, TRUE
);
1067 info
->sEncryptAlgorithmName
= get_alg_name(info
->EncryptAlgorithm
, TRUE
);
1071 case SECPKG_ATTR_REMOTE_CERT_CONTEXT
:
1073 PCCERT_CONTEXT
*cert
= buffer
;
1075 status
= ensure_remote_cert(ctx
);
1076 if(status
!= SEC_E_OK
)
1079 *cert
= CertDuplicateCertificateContext(ctx
->cert
);
1082 case SECPKG_ATTR_CONNECTION_INFO
:
1084 SecPkgContext_ConnectionInfo
*info
= buffer
;
1085 struct get_connection_info_params params
= { ctx
->transport
.session
, info
};
1086 return GNUTLS_CALL( get_connection_info
, ¶ms
);
1088 case SECPKG_ATTR_ENDPOINT_BINDINGS
:
1090 SecPkgContext_Bindings
*bindings
= buffer
;
1091 CCRYPT_OID_INFO
*info
;
1092 ALG_ID hash_alg
= CALG_SHA_256
;
1098 static const char prefix
[] = "tls-server-end-point:";
1100 status
= ensure_remote_cert(ctx
);
1101 if(status
!= SEC_E_OK
)
1105 info
= CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY
, ctx
->cert
->pCertInfo
->SignatureAlgorithm
.pszObjId
, 0);
1106 if(info
&& info
->u
.Algid
!= CALG_SHA1
&& info
->u
.Algid
!= CALG_MD5
)
1107 hash_alg
= info
->u
.Algid
;
1109 hash_size
= sizeof(hash
);
1110 r
= CryptHashCertificate(0, hash_alg
, 0, ctx
->cert
->pbCertEncoded
, ctx
->cert
->cbCertEncoded
, hash
, &hash_size
);
1112 return GetLastError();
1114 bindings
->BindingsLength
= sizeof(*bindings
->Bindings
) + sizeof(prefix
)-1 + hash_size
;
1115 /* freed with FreeContextBuffer */
1116 bindings
->Bindings
= RtlAllocateHeap(GetProcessHeap(), HEAP_ZERO_MEMORY
, bindings
->BindingsLength
);
1117 if(!bindings
->Bindings
)
1118 return SEC_E_INSUFFICIENT_MEMORY
;
1120 bindings
->Bindings
->cbApplicationDataLength
= sizeof(prefix
)-1 + hash_size
;
1121 bindings
->Bindings
->dwApplicationDataOffset
= sizeof(*bindings
->Bindings
);
1123 p
= (char*)(bindings
->Bindings
+1);
1124 memcpy(p
, prefix
, sizeof(prefix
)-1);
1125 p
+= sizeof(prefix
)-1;
1126 memcpy(p
, hash
, hash_size
);
1129 case SECPKG_ATTR_UNIQUE_BINDINGS
:
1131 static const char prefix
[] = "tls-unique:";
1132 SecPkgContext_Bindings
*bindings
= buffer
;
1135 struct get_unique_channel_binding_params params
= { ctx
->transport
.session
, NULL
, &size
};
1137 if (GNUTLS_CALL( get_unique_channel_binding
, ¶ms
) != SEC_E_BUFFER_TOO_SMALL
)
1138 return SEC_E_INTERNAL_ERROR
;
1140 bindings
->BindingsLength
= sizeof(*bindings
->Bindings
) + sizeof(prefix
)-1 + size
;
1141 /* freed with FreeContextBuffer */
1142 bindings
->Bindings
= RtlAllocateHeap(GetProcessHeap(), HEAP_ZERO_MEMORY
, bindings
->BindingsLength
);
1143 if(!bindings
->Bindings
)
1144 return SEC_E_INSUFFICIENT_MEMORY
;
1146 bindings
->Bindings
->cbApplicationDataLength
= sizeof(prefix
)-1 + size
;
1147 bindings
->Bindings
->dwApplicationDataOffset
= sizeof(*bindings
->Bindings
);
1149 p
= (char*)(bindings
->Bindings
+1);
1150 memcpy(p
, prefix
, sizeof(prefix
)-1);
1151 p
+= sizeof(prefix
)-1;
1153 return GNUTLS_CALL( get_unique_channel_binding
, ¶ms
);
1155 case SECPKG_ATTR_APPLICATION_PROTOCOL
:
1157 SecPkgContext_ApplicationProtocol
*protocol
= buffer
;
1158 struct get_application_protocol_params params
= { ctx
->transport
.session
, protocol
};
1159 return GNUTLS_CALL( get_application_protocol
, ¶ms
);
1163 FIXME("Unhandled attribute %#x\n", attribute
);
1164 return SEC_E_UNSUPPORTED_FUNCTION
;
1168 static SECURITY_STATUS SEC_ENTRY
schan_QueryContextAttributesA(
1169 PCtxtHandle context_handle
, ULONG attribute
, PVOID buffer
)
1171 TRACE("context_handle %p, attribute %#x, buffer %p\n",
1172 context_handle
, attribute
, buffer
);
1176 case SECPKG_ATTR_STREAM_SIZES
:
1177 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1178 case SECPKG_ATTR_KEY_INFO
:
1180 SECURITY_STATUS status
= schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1181 if (status
== SEC_E_OK
)
1183 SecPkgContext_KeyInfoA
*info
= buffer
;
1184 info
->sSignatureAlgorithmName
= get_alg_name(info
->SignatureAlgorithm
, FALSE
);
1185 info
->sEncryptAlgorithmName
= get_alg_name(info
->EncryptAlgorithm
, FALSE
);
1189 case SECPKG_ATTR_REMOTE_CERT_CONTEXT
:
1190 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1191 case SECPKG_ATTR_CONNECTION_INFO
:
1192 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1193 case SECPKG_ATTR_ENDPOINT_BINDINGS
:
1194 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1195 case SECPKG_ATTR_UNIQUE_BINDINGS
:
1196 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1197 case SECPKG_ATTR_APPLICATION_PROTOCOL
:
1198 return schan_QueryContextAttributesW(context_handle
, attribute
, buffer
);
1201 FIXME("Unhandled attribute %#x\n", attribute
);
1202 return SEC_E_UNSUPPORTED_FUNCTION
;
1206 static SECURITY_STATUS SEC_ENTRY
schan_EncryptMessage(PCtxtHandle context_handle
,
1207 ULONG quality
, PSecBufferDesc message
, ULONG message_seq_no
)
1209 struct schan_context
*ctx
;
1210 struct send_params params
;
1211 SECURITY_STATUS status
;
1218 TRACE("context_handle %p, quality %d, message %p, message_seq_no %d\n",
1219 context_handle
, quality
, message
, message_seq_no
);
1221 if (!context_handle
) return SEC_E_INVALID_HANDLE
;
1222 ctx
= schan_get_object(context_handle
->dwLower
, SCHAN_HANDLE_CTX
);
1224 dump_buffer_desc(message
);
1226 idx
= schan_find_sec_buffer_idx(message
, 0, SECBUFFER_DATA
);
1229 WARN("No data buffer passed\n");
1230 return SEC_E_INTERNAL_ERROR
;
1232 buffer
= &message
->pBuffers
[idx
];
1234 data_size
= buffer
->cbBuffer
;
1235 data
= malloc(data_size
);
1236 memcpy(data
, buffer
->pvBuffer
, data_size
);
1239 params
.session
= ctx
->transport
.session
;
1240 params
.output
= message
;
1241 params
.buffer
= data
;
1242 params
.length
= &length
;
1243 status
= GNUTLS_CALL( send
, ¶ms
);
1245 TRACE("Sent %ld bytes.\n", length
);
1247 if (length
!= data_size
)
1248 status
= SEC_E_INTERNAL_ERROR
;
1252 TRACE("Returning %#x.\n", status
);
1257 static int schan_validate_decrypt_buffer_desc(PSecBufferDesc message
)
1260 unsigned int empty_count
= 0;
1263 if (message
->cBuffers
< 4)
1265 WARN("Less than four buffers passed\n");
1269 for (i
= 0; i
< message
->cBuffers
; ++i
)
1271 SecBuffer
*b
= &message
->pBuffers
[i
];
1272 if (b
->BufferType
== SECBUFFER_DATA
)
1276 WARN("More than one data buffer passed\n");
1281 else if (b
->BufferType
== SECBUFFER_EMPTY
)
1287 WARN("No data buffer passed\n");
1291 if (empty_count
< 3)
1293 WARN("Less than three empty buffers passed\n");
1300 static void schan_decrypt_fill_buffer(PSecBufferDesc message
, ULONG buffer_type
, void *data
, ULONG size
)
1305 idx
= schan_find_sec_buffer_idx(message
, 0, SECBUFFER_EMPTY
);
1306 buffer
= &message
->pBuffers
[idx
];
1308 buffer
->BufferType
= buffer_type
;
1309 buffer
->pvBuffer
= data
;
1310 buffer
->cbBuffer
= size
;
1313 static SECURITY_STATUS SEC_ENTRY
schan_DecryptMessage(PCtxtHandle context_handle
,
1314 PSecBufferDesc message
, ULONG message_seq_no
, PULONG quality
)
1316 SECURITY_STATUS status
= SEC_E_OK
;
1317 struct schan_context
*ctx
;
1318 struct recv_params params
;
1322 unsigned expected_size
;
1323 SIZE_T received
= 0;
1325 unsigned char *buf_ptr
;
1327 TRACE("context_handle %p, message %p, message_seq_no %d, quality %p\n",
1328 context_handle
, message
, message_seq_no
, quality
);
1330 if (!context_handle
) return SEC_E_INVALID_HANDLE
;
1331 ctx
= schan_get_object(context_handle
->dwLower
, SCHAN_HANDLE_CTX
);
1333 dump_buffer_desc(message
);
1335 idx
= schan_validate_decrypt_buffer_desc(message
);
1337 return SEC_E_INVALID_TOKEN
;
1338 buffer
= &message
->pBuffers
[idx
];
1339 buf_ptr
= buffer
->pvBuffer
;
1341 expected_size
= ctx
->header_size
+ read_record_size(buf_ptr
, ctx
->header_size
);
1342 if(buffer
->cbBuffer
< expected_size
)
1344 TRACE("Expected %u bytes, but buffer only contains %u bytes\n", expected_size
, buffer
->cbBuffer
);
1345 buffer
->BufferType
= SECBUFFER_MISSING
;
1346 buffer
->cbBuffer
= expected_size
- buffer
->cbBuffer
;
1348 /* This is a bit weird, but windows does it too */
1349 idx
= schan_find_sec_buffer_idx(message
, 0, SECBUFFER_EMPTY
);
1350 buffer
= &message
->pBuffers
[idx
];
1351 buffer
->BufferType
= SECBUFFER_MISSING
;
1352 buffer
->cbBuffer
= expected_size
- buffer
->cbBuffer
;
1354 TRACE("Returning SEC_E_INCOMPLETE_MESSAGE\n");
1355 return SEC_E_INCOMPLETE_MESSAGE
;
1358 data_size
= expected_size
- ctx
->header_size
;
1359 data
= malloc(data_size
);
1361 received
= data_size
;
1363 params
.session
= ctx
->transport
.session
;
1364 params
.input
= message
;
1365 params
.input_size
= expected_size
;
1366 params
.buffer
= data
;
1367 params
.length
= &received
;
1368 status
= GNUTLS_CALL( recv
, ¶ms
);
1370 if (status
!= SEC_E_OK
&& status
!= SEC_I_RENEGOTIATE
)
1373 ERR("Returning %x\n", status
);
1377 TRACE("Received %ld bytes\n", received
);
1379 memcpy(buf_ptr
+ ctx
->header_size
, data
, received
);
1382 schan_decrypt_fill_buffer(message
, SECBUFFER_DATA
,
1383 buf_ptr
+ ctx
->header_size
, received
);
1385 schan_decrypt_fill_buffer(message
, SECBUFFER_STREAM_TRAILER
,
1386 buf_ptr
+ ctx
->header_size
+ received
, buffer
->cbBuffer
- ctx
->header_size
- received
);
1388 if(buffer
->cbBuffer
> expected_size
)
1389 schan_decrypt_fill_buffer(message
, SECBUFFER_EXTRA
,
1390 buf_ptr
+ expected_size
, buffer
->cbBuffer
- expected_size
);
1392 buffer
->BufferType
= SECBUFFER_STREAM_HEADER
;
1393 buffer
->cbBuffer
= ctx
->header_size
;
1398 static SECURITY_STATUS SEC_ENTRY
schan_DeleteSecurityContext(PCtxtHandle context_handle
)
1400 struct schan_context
*ctx
;
1401 struct session_params params
;
1403 TRACE("context_handle %p\n", context_handle
);
1405 if (!context_handle
) return SEC_E_INVALID_HANDLE
;
1407 ctx
= schan_free_handle(context_handle
->dwLower
, SCHAN_HANDLE_CTX
);
1408 if (!ctx
) return SEC_E_INVALID_HANDLE
;
1410 if (ctx
->cert
) CertFreeCertificateContext(ctx
->cert
);
1411 params
.session
= ctx
->transport
.session
;
1412 GNUTLS_CALL( dispose_session
, ¶ms
);
1417 static const SecurityFunctionTableA schanTableA
= {
1419 NULL
, /* EnumerateSecurityPackagesA */
1420 schan_QueryCredentialsAttributesA
,
1421 schan_AcquireCredentialsHandleA
,
1422 schan_FreeCredentialsHandle
,
1423 NULL
, /* Reserved2 */
1424 schan_InitializeSecurityContextA
,
1425 NULL
, /* AcceptSecurityContext */
1426 NULL
, /* CompleteAuthToken */
1427 schan_DeleteSecurityContext
,
1428 NULL
, /* ApplyControlToken */
1429 schan_QueryContextAttributesA
,
1430 NULL
, /* ImpersonateSecurityContext */
1431 NULL
, /* RevertSecurityContext */
1432 NULL
, /* MakeSignature */
1433 NULL
, /* VerifySignature */
1435 NULL
, /* QuerySecurityPackageInfoA */
1436 NULL
, /* Reserved3 */
1437 NULL
, /* Reserved4 */
1438 NULL
, /* ExportSecurityContext */
1439 NULL
, /* ImportSecurityContextA */
1440 NULL
, /* AddCredentialsA */
1441 NULL
, /* Reserved8 */
1442 NULL
, /* QuerySecurityContextToken */
1443 schan_EncryptMessage
,
1444 schan_DecryptMessage
,
1445 NULL
, /* SetContextAttributesA */
1448 static const SecurityFunctionTableW schanTableW
= {
1450 NULL
, /* EnumerateSecurityPackagesW */
1451 schan_QueryCredentialsAttributesW
,
1452 schan_AcquireCredentialsHandleW
,
1453 schan_FreeCredentialsHandle
,
1454 NULL
, /* Reserved2 */
1455 schan_InitializeSecurityContextW
,
1456 NULL
, /* AcceptSecurityContext */
1457 NULL
, /* CompleteAuthToken */
1458 schan_DeleteSecurityContext
,
1459 NULL
, /* ApplyControlToken */
1460 schan_QueryContextAttributesW
,
1461 NULL
, /* ImpersonateSecurityContext */
1462 NULL
, /* RevertSecurityContext */
1463 NULL
, /* MakeSignature */
1464 NULL
, /* VerifySignature */
1466 NULL
, /* QuerySecurityPackageInfoW */
1467 NULL
, /* Reserved3 */
1468 NULL
, /* Reserved4 */
1469 NULL
, /* ExportSecurityContext */
1470 NULL
, /* ImportSecurityContextW */
1471 NULL
, /* AddCredentialsW */
1472 NULL
, /* Reserved8 */
1473 NULL
, /* QuerySecurityContextToken */
1474 schan_EncryptMessage
,
1475 schan_DecryptMessage
,
1476 NULL
, /* SetContextAttributesW */
1479 void SECUR32_initSchannelSP(void)
1481 /* This is what Windows reports. This shouldn't break any applications
1482 * even though the functions are missing, because the wrapper will
1483 * return SEC_E_UNSUPPORTED_FUNCTION if our function is NULL.
1485 static const LONG caps
=
1486 SECPKG_FLAG_INTEGRITY
|
1487 SECPKG_FLAG_PRIVACY
|
1488 SECPKG_FLAG_CONNECTION
|
1489 SECPKG_FLAG_MULTI_REQUIRED
|
1490 SECPKG_FLAG_EXTENDED_ERROR
|
1491 SECPKG_FLAG_IMPERSONATION
|
1492 SECPKG_FLAG_ACCEPT_WIN32_NAME
|
1494 static const short version
= 1;
1495 static const LONG maxToken
= 16384;
1496 SEC_WCHAR
*uniSPName
= (SEC_WCHAR
*)UNISP_NAME_W
,
1497 *schannel
= (SEC_WCHAR
*)SCHANNEL_NAME_W
;
1498 const SecPkgInfoW info
[] = {
1499 { caps
, version
, UNISP_RPC_ID
, maxToken
, uniSPName
, uniSPName
},
1500 { caps
, version
, UNISP_RPC_ID
, maxToken
, schannel
, (SEC_WCHAR
*)L
"Schannel Security Package" },
1502 SecureProvider
*provider
;
1506 if (NtQueryVirtualMemory( GetCurrentProcess(), hsecur32
, MemoryWineUnixFuncs
,
1507 &gnutls_handle
, sizeof(gnutls_handle
), NULL
) ||
1508 GNUTLS_CALL( process_attach
, NULL
))
1510 ERR( "no schannel support, expect problems\n" );
1515 schan_handle_table
= malloc(64 * sizeof(*schan_handle_table
));
1516 if (!schan_handle_table
)
1518 ERR("Failed to allocate schannel handle table.\n");
1521 schan_handle_table_size
= 64;
1523 provider
= SECUR32_addProvider(&schanTableA
, &schanTableW
, L
"schannel.dll");
1526 ERR("Failed to add schannel provider.\n");
1530 SECUR32_addPackages(provider
, ARRAY_SIZE(info
), NULL
, info
);
1534 free(schan_handle_table
);
1535 schan_handle_table
= NULL
;
1539 void SECUR32_deinitSchannelSP(void)
1541 SIZE_T i
= schan_handle_count
;
1543 if (!schan_handle_table
) return;
1545 /* deinitialized sessions first because a pointer to the credentials
1546 * may be stored for the session. */
1549 if (schan_handle_table
[i
].type
== SCHAN_HANDLE_CTX
)
1551 struct schan_context
*ctx
= schan_free_handle(i
, SCHAN_HANDLE_CTX
);
1552 struct session_params params
= { ctx
->transport
.session
};
1553 GNUTLS_CALL( dispose_session
, ¶ms
);
1557 i
= schan_handle_count
;
1560 if (schan_handle_table
[i
].type
!= SCHAN_HANDLE_FREE
)
1562 struct schan_credentials
*cred
= schan_free_handle(i
, SCHAN_HANDLE_CRED
);
1563 struct free_certificate_credentials_params params
= { cred
};
1564 GNUTLS_CALL( free_certificate_credentials
, ¶ms
);
1568 free(schan_handle_table
);
1569 GNUTLS_CALL( process_detach
, NULL
);