vieter-v
/
v
2
0
Fork 0
Code Issues Pull Requests Releases Activity

vlib.http: schannel cleanup. use ctx struct instead of passing args everywhere

pull/1572/head
joe-conigliaro 2019-08-11 21:13:33 +10:00 committed by Alexander Medvednikov
parent 68a4c125c5
commit 5a84a4e507
2 changed files with 130 additions and 150 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

260
thirdparty/vschannel/vschannel.c vendored
View File

@ -1,9 +1,5 @@
#include <vschannel.h> #include <vschannel.h>
// TODO: joe-c
// create context struct instead of using global
// Proxy // Proxy
CHAR * psz_proxy_server = "proxy"; CHAR * psz_proxy_server = "proxy";
INT i_proxy_port = 80; INT i_proxy_port = 80;
@ -14,34 +10,36 @@ BOOL use_proxy = FALSE;
DWORD protocol = 0; DWORD protocol = 0;
ALG_ID aid_key_exch = 0; ALG_ID aid_key_exch = 0;
// Cred store
HCERTSTORE cert_store = NULL;
SCHANNEL_CRED schannel_cred;
// Loaded sec lib
HMODULE g_hsecurity = NULL;
// SSPI
PSecurityFunctionTable sspi;
struct TlsContext tls_ctx; struct TlsContext tls_ctx;
// TODO: joe-c
// socket / tls ctx
struct TlsContext { struct TlsContext {
SOCKET Socket; // SSPI
WSADATA WsaData; PSecurityFunctionTable sspi;
CredHandle hClientCreds; // Cred store
CtxtHandle hContext; HCERTSTORE cert_store;
BOOL fCredsInitialized; SCHANNEL_CRED schannel_cred;
BOOL fContextInitialized; // Loaded sec lib
PCCERT_CONTEXT pRemoteCertContext; HMODULE g_hsecurity;
// Socket
SOCKET socket;
WSADATA wsa_data;
CredHandle h_client_creds;
CtxtHandle h_context;
BOOL creds_initialized;
BOOL context_initialized;
PCCERT_CONTEXT p_pemote_cert_context;
}; };
struct TlsContext new_tls_context() { struct TlsContext new_tls_context() {
return (struct TlsContext) { return (struct TlsContext) {
.Socket = INVALID_SOCKET, .cert_store = NULL,
.fCredsInitialized = FALSE, .g_hsecurity = NULL,
.fContextInitialized = FALSE, .socket = INVALID_SOCKET,
.pRemoteCertContext = NULL .creds_initialized = FALSE,
.context_initialized = FALSE,
.p_pemote_cert_context = NULL
}; };
}; };
@ -49,22 +47,22 @@ BOOL load_security_library(void) {
INIT_SECURITY_INTERFACE pInitSecurityInterface; INIT_SECURITY_INTERFACE pInitSecurityInterface;
// Load Security DLL // Load Security DLL
g_hsecurity = LoadLibraryA("schannel.dll"); tls_ctx.g_hsecurity = LoadLibraryA("schannel.dll");
if(g_hsecurity == NULL) { if(tls_ctx.g_hsecurity == NULL) {
printf("Error 0x%x loading %s.\n", GetLastError(), "schannel.dll"); printf("Error 0x%x loading %s.\n", GetLastError(), "schannel.dll");
return FALSE; return FALSE;
} }
pInitSecurityInterface = (INIT_SECURITY_INTERFACE)GetProcAddress(g_hsecurity, "InitSecurityInterfaceA"); pInitSecurityInterface = (INIT_SECURITY_INTERFACE)GetProcAddress(tls_ctx.g_hsecurity, "InitSecurityInterfaceA");
if(pInitSecurityInterface == NULL) { if(pInitSecurityInterface == NULL) {
printf("Error 0x%x reading InitSecurityInterface entry point.\n", GetLastError()); printf("Error 0x%x reading InitSecurityInterface entry point.\n", GetLastError());
return FALSE; return FALSE;
} }
sspi = pInitSecurityInterface(); tls_ctx.sspi = pInitSecurityInterface();
if(sspi == NULL) { if(tls_ctx.sspi == NULL) {
printf("Error 0x%x reading security interface.\n", printf("Error 0x%x reading security interface.\n",
GetLastError()); GetLastError());
return FALSE; return FALSE;
@ -74,40 +72,40 @@ BOOL load_security_library(void) {
} }
void unload_security_library(void) { void unload_security_library(void) {
FreeLibrary(g_hsecurity); FreeLibrary(tls_ctx.g_hsecurity);
g_hsecurity = NULL; tls_ctx.g_hsecurity = NULL;
} }
void vschannel_cleanup() { void vschannel_cleanup() {
// Free the server certificate context. // Free the server certificate context.
if(tls_ctx.pRemoteCertContext) { if(tls_ctx.p_pemote_cert_context) {
CertFreeCertificateContext(tls_ctx.pRemoteCertContext); CertFreeCertificateContext(tls_ctx.p_pemote_cert_context);
tls_ctx.pRemoteCertContext = NULL; tls_ctx.p_pemote_cert_context = NULL;
} }
// Free SSPI context handle. // Free SSPI context handle.
if(tls_ctx.fContextInitialized) { if(tls_ctx.context_initialized) {
sspi->DeleteSecurityContext(&tls_ctx.hContext); tls_ctx.sspi->DeleteSecurityContext(&tls_ctx.h_context);
tls_ctx.fContextInitialized = FALSE; tls_ctx.context_initialized = FALSE;
} }
// Free SSPI credentials handle. // Free SSPI credentials handle.
if(tls_ctx.fCredsInitialized) { if(tls_ctx.creds_initialized) {
sspi->FreeCredentialsHandle(&tls_ctx.hClientCreds); tls_ctx.sspi->FreeCredentialsHandle(&tls_ctx.h_client_creds);
tls_ctx.fCredsInitialized = FALSE; tls_ctx.creds_initialized = FALSE;
} }
// Close socket. // Close socket.
if(tls_ctx.Socket != INVALID_SOCKET) { if(tls_ctx.socket != INVALID_SOCKET) {
closesocket(tls_ctx.Socket); closesocket(tls_ctx.socket);
} }
// Shutdown WinSock subsystem. // Shutdown WinSock subsystem.
WSACleanup(); WSACleanup();
// Close "MY" certificate store. // Close "MY" certificate store.
if(cert_store) { if(tls_ctx.cert_store) {
CertCloseStore(cert_store, 0); CertCloseStore(tls_ctx.cert_store, 0);
} }
unload_security_library(); unload_security_library();
@ -122,17 +120,17 @@ void vschannel_init() {
} }
// Initialize the WinSock subsystem. // Initialize the WinSock subsystem.
if(WSAStartup(0x0101, &tls_ctx.WsaData) == SOCKET_ERROR) { if(WSAStartup(0x0101, &tls_ctx.wsa_data) == SOCKET_ERROR) {
printf("Error %d returned by WSAStartup\n", GetLastError()); printf("Error %d returned by WSAStartup\n", GetLastError());
vschannel_cleanup(); vschannel_cleanup();
} }
// Create credentials. // Create credentials.
if(create_credentials(&tls_ctx.hClientCreds)) { if(create_credentials()) {
printf("Error creating credentials\n"); printf("Error creating credentials\n");
vschannel_cleanup(); vschannel_cleanup();
} }
tls_ctx.fCredsInitialized = TRUE; tls_ctx.creds_initialized = TRUE;
} }
INT request(CHAR *host, CHAR *req, CHAR *out) INT request(CHAR *host, CHAR *req, CHAR *out)
@ -149,26 +147,26 @@ INT request(CHAR *host, CHAR *req, CHAR *out)
protocol = SP_PROT_TLS1_2_CLIENT; protocol = SP_PROT_TLS1_2_CLIENT;
// Connect to server. // Connect to server.
if(connect_to_server(host, port_number, &tls_ctx.Socket)) { if(connect_to_server(host, port_number)) {
printf("Error connecting to server\n"); printf("Error connecting to server\n");
vschannel_cleanup(); vschannel_cleanup();
return resp_length; return resp_length;
} }
// Perform handshake // Perform handshake
if(perform_client_handshake(tls_ctx.Socket, &tls_ctx.hClientCreds, host, &tls_ctx.hContext, &ExtraData)) { if(perform_client_handshake(host, &ExtraData)) {
printf("Error performing handshake\n"); printf("Error performing handshake\n");
vschannel_cleanup(); vschannel_cleanup();
return resp_length; return resp_length;
} }
tls_ctx.fContextInitialized = TRUE; tls_ctx.context_initialized = TRUE;
// Authenticate server's credentials. // Authenticate server's credentials.
// Get server's certificate. // Get server's certificate.
Status = sspi->QueryContextAttributes(&tls_ctx.hContext, Status = tls_ctx.sspi->QueryContextAttributes(&tls_ctx.h_context,
SECPKG_ATTR_REMOTE_CERT_CONTEXT, SECPKG_ATTR_REMOTE_CERT_CONTEXT,
(PVOID)&tls_ctx.pRemoteCertContext); (PVOID)&tls_ctx.p_pemote_cert_context);
if(Status != SEC_E_OK) { if(Status != SEC_E_OK) {
printf("Error 0x%x querying remote certificate\n", Status); printf("Error 0x%x querying remote certificate\n", Status);
vschannel_cleanup(); vschannel_cleanup();
@ -176,7 +174,7 @@ INT request(CHAR *host, CHAR *req, CHAR *out)
} }
// Attempt to validate server certificate. // Attempt to validate server certificate.
Status = verify_server_certificate(tls_ctx.pRemoteCertContext, host,0); Status = verify_server_certificate(tls_ctx.p_pemote_cert_context, host,0);
if(Status) { if(Status) {
// The server certificate did not validate correctly. At this // The server certificate did not validate correctly. At this
// point, we cannot tell if we are connecting to the correct // point, we cannot tell if we are connecting to the correct
@ -191,11 +189,11 @@ INT request(CHAR *host, CHAR *req, CHAR *out)
} }
// Free the server certificate context. // Free the server certificate context.
CertFreeCertificateContext(tls_ctx.pRemoteCertContext); CertFreeCertificateContext(tls_ctx.p_pemote_cert_context);
tls_ctx.pRemoteCertContext = NULL; tls_ctx.p_pemote_cert_context = NULL;
// Request from server // Request from server
if(https_make_request(tls_ctx.Socket, &tls_ctx.hClientCreds, &tls_ctx.hContext, req, out, &resp_length)) { if(https_make_request(req, out, &resp_length)) {
vschannel_cleanup(); vschannel_cleanup();
return resp_length; return resp_length;
} }
@ -203,19 +201,19 @@ INT request(CHAR *host, CHAR *req, CHAR *out)
// Send a close_notify alert to the server and // Send a close_notify alert to the server and
// close down the connection. // close down the connection.
if(disconnect_from_server(tls_ctx.Socket, &tls_ctx.hClientCreds, &tls_ctx.hContext)) { if(disconnect_from_server()) {
printf("Error disconnecting from server\n"); printf("Error disconnecting from server\n");
vschannel_cleanup(); vschannel_cleanup();
return resp_length; return resp_length;
} }
tls_ctx.fContextInitialized = FALSE; tls_ctx.context_initialized = FALSE;
tls_ctx.Socket = INVALID_SOCKET; tls_ctx.socket = INVALID_SOCKET;
return resp_length; return resp_length;
} }
static SECURITY_STATUS create_credentials(PCredHandle phCreds) { static SECURITY_STATUS create_credentials() {
TimeStamp tsExpiry; TimeStamp tsExpiry;
SECURITY_STATUS Status; SECURITY_STATUS Status;
@ -226,10 +224,10 @@ static SECURITY_STATUS create_credentials(PCredHandle phCreds) {
// Open the "MY" certificate store, which is where Internet Explorer // Open the "MY" certificate store, which is where Internet Explorer
// stores its client certificates. // stores its client certificates.
if(cert_store == NULL) { if(tls_ctx.cert_store == NULL) {
cert_store = CertOpenSystemStore(0, "MY"); tls_ctx.cert_store = CertOpenSystemStore(0, "MY");
if(!cert_store) { if(!tls_ctx.cert_store) {
printf("Error 0x%x returned by CertOpenSystemStore\n", printf("Error 0x%x returned by CertOpenSystemStore\n",
GetLastError()); GetLastError());
return SEC_E_NO_CREDENTIALS; return SEC_E_NO_CREDENTIALS;
@ -241,16 +239,16 @@ static SECURITY_STATUS create_credentials(PCredHandle phCreds) {
// of course). Real applications may wish to specify other parameters // of course). Real applications may wish to specify other parameters
// as well. // as well.
ZeroMemory(&schannel_cred, sizeof(schannel_cred)); ZeroMemory(&tls_ctx.schannel_cred, sizeof(tls_ctx.schannel_cred));
schannel_cred.dwVersion = SCHANNEL_CRED_VERSION; tls_ctx.schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
if(pCertContext) if(pCertContext)
{ {
schannel_cred.cCreds = 1; tls_ctx.schannel_cred.cCreds = 1;
schannel_cred.paCred = &pCertContext; tls_ctx.schannel_cred.paCred = &pCertContext;
} }
schannel_cred.grbitEnabledProtocols = protocol; tls_ctx.schannel_cred.grbitEnabledProtocols = protocol;
if(aid_key_exch) if(aid_key_exch)
{ {
@ -259,11 +257,11 @@ static SECURITY_STATUS create_credentials(PCredHandle phCreds) {
if(cSupportedAlgs) if(cSupportedAlgs)
{ {
schannel_cred.cSupportedAlgs = cSupportedAlgs; tls_ctx.schannel_cred.cSupportedAlgs = cSupportedAlgs;
schannel_cred.palgSupportedAlgs = rgbSupportedAlgs; tls_ctx.schannel_cred.palgSupportedAlgs = rgbSupportedAlgs;
} }
schannel_cred.dwFlags |= SCH_CRED_NO_DEFAULT_CREDS; tls_ctx.schannel_cred.dwFlags |= SCH_CRED_NO_DEFAULT_CREDS;
// The SCH_CRED_MANUAL_CRED_VALIDATION flag is specified because // The SCH_CRED_MANUAL_CRED_VALIDATION flag is specified because
// this sample verifies the server certificate manually. // this sample verifies the server certificate manually.
@ -272,19 +270,19 @@ static SECURITY_STATUS create_credentials(PCredHandle phCreds) {
// certificate. Applications running on newer versions of Windows can // certificate. Applications running on newer versions of Windows can
// leave off this flag, in which case the InitializeSecurityContext // leave off this flag, in which case the InitializeSecurityContext
// function will validate the server certificate automatically. // function will validate the server certificate automatically.
// schannel_cred.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION; // tls_ctx.schannel_cred.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION;
// Create an SSPI credential. // Create an SSPI credential.
Status = sspi->AcquireCredentialsHandle( Status = tls_ctx.sspi->AcquireCredentialsHandle(
NULL, // Name of principal NULL, // Name of principal
UNISP_NAME_A, // Name of package UNISP_NAME_A, // Name of package
SECPKG_CRED_OUTBOUND, // Flags indicating use SECPKG_CRED_OUTBOUND, // Flags indicating use
NULL, // Pointer to logon ID NULL, // Pointer to logon ID
&schannel_cred, // Package specific data &tls_ctx.schannel_cred, // Package specific data
NULL, // Pointer to GetKey() func NULL, // Pointer to GetKey() func
NULL, // Value to pass to GetKey() NULL, // Value to pass to GetKey()
phCreds, // (out) Cred Handle &tls_ctx.h_client_creds, // (out) Cred Handle
&tsExpiry); // (out) Lifetime (optional) &tsExpiry); // (out) Lifetime (optional)
if(Status != SEC_E_OK) { if(Status != SEC_E_OK) {
printf("Error 0x%x returned by AcquireCredentialsHandle\n", Status); printf("Error 0x%x returned by AcquireCredentialsHandle\n", Status);
@ -304,7 +302,7 @@ cleanup:
} }
static INT connect_to_server( CHAR *host, INT port_number, SOCKET *pSocket) { static INT connect_to_server(CHAR *host, INT port_number) {
SOCKET Socket; SOCKET Socket;
struct sockaddr_in sin; struct sockaddr_in sin;
struct hostent *hp; struct hostent *hp;
@ -381,13 +379,13 @@ static INT connect_to_server( CHAR *host, INT port_number, SOCKET *pSocket) {
// should continue to receive until CR LF CR LF is received // should continue to receive until CR LF CR LF is received
} }
*pSocket = Socket; tls_ctx.socket = Socket;
return SEC_E_OK; return SEC_E_OK;
} }
static LONG disconnect_from_server(SOCKET Socket, PCredHandle phCreds, CtxtHandle *phContext) { static LONG disconnect_from_server() {
DWORD dwType; DWORD dwType;
PBYTE pbMessage; PBYTE pbMessage;
DWORD cbMessage; DWORD cbMessage;
@ -412,7 +410,7 @@ static LONG disconnect_from_server(SOCKET Socket, PCredHandle phCreds, CtxtHandl
OutBuffer.pBuffers = OutBuffers; OutBuffer.pBuffers = OutBuffers;
OutBuffer.ulVersion = SECBUFFER_VERSION; OutBuffer.ulVersion = SECBUFFER_VERSION;
Status = sspi->ApplyControlToken(phContext, &OutBuffer); Status = tls_ctx.sspi->ApplyControlToken(&tls_ctx.h_context, &OutBuffer);
if(FAILED(Status)) { if(FAILED(Status)) {
printf("Error 0x%x returned by ApplyControlToken\n", Status); printf("Error 0x%x returned by ApplyControlToken\n", Status);
@ -436,9 +434,9 @@ static LONG disconnect_from_server(SOCKET Socket, PCredHandle phCreds, CtxtHandl
OutBuffer.pBuffers = OutBuffers; OutBuffer.pBuffers = OutBuffers;
OutBuffer.ulVersion = SECBUFFER_VERSION; OutBuffer.ulVersion = SECBUFFER_VERSION;
Status = sspi->InitializeSecurityContext( Status = tls_ctx.sspi->InitializeSecurityContext(
phCreds, phContext, NULL, dwSSPIFlags, 0, SECURITY_NATIVE_DREP, &tls_ctx.h_client_creds, &tls_ctx.h_context, NULL, dwSSPIFlags, 0, SECURITY_NATIVE_DREP,
NULL, 0, phContext, &OutBuffer, &dwSSPIOutFlags, &tsExpiry); NULL, 0, &tls_ctx.h_context, &OutBuffer, &dwSSPIOutFlags, &tsExpiry);
if(FAILED(Status)) { if(FAILED(Status)) {
printf("Error 0x%x returned by InitializeSecurityContext\n", Status); printf("Error 0x%x returned by InitializeSecurityContext\n", Status);
@ -451,7 +449,7 @@ static LONG disconnect_from_server(SOCKET Socket, PCredHandle phCreds, CtxtHandl
// Send the close notify message to the server. // Send the close notify message to the server.
if(pbMessage != NULL && cbMessage != 0) { if(pbMessage != NULL && cbMessage != 0) {
cbData = send(Socket, pbMessage, cbMessage, 0); cbData = send(tls_ctx.socket, pbMessage, cbMessage, 0);
if(cbData == SOCKET_ERROR || cbData == 0) { if(cbData == SOCKET_ERROR || cbData == 0) {
Status = WSAGetLastError(); Status = WSAGetLastError();
printf("Error %d sending close notify\n", Status); printf("Error %d sending close notify\n", Status);
@ -459,31 +457,23 @@ static LONG disconnect_from_server(SOCKET Socket, PCredHandle phCreds, CtxtHandl
} }
// Free output buffer. // Free output buffer.
sspi->FreeContextBuffer(pbMessage); tls_ctx.sspi->FreeContextBuffer(pbMessage);
} }
cleanup: cleanup:
// Free the security context. // Free the security context.
sspi->DeleteSecurityContext(phContext); tls_ctx.sspi->DeleteSecurityContext(&tls_ctx.h_context);
// Close the socket. // Close the socket.
closesocket(Socket); closesocket(tls_ctx.socket);
return Status; return Status;
} }
static static SECURITY_STATUS perform_client_handshake(CHAR *host, SecBuffer *pExtraData) {
SECURITY_STATUS
perform_client_handshake(
SOCKET Socket, // in
PCredHandle phCreds, // in
CHAR * host, // in
CtxtHandle * phContext, // out
SecBuffer * pExtraData) // out
{
SecBufferDesc OutBuffer; SecBufferDesc OutBuffer;
SecBuffer OutBuffers[1]; SecBuffer OutBuffers[1];
DWORD dwSSPIFlags; DWORD dwSSPIFlags;
@ -511,8 +501,8 @@ perform_client_handshake(
OutBuffer.pBuffers = OutBuffers; OutBuffer.pBuffers = OutBuffers;
OutBuffer.ulVersion = SECBUFFER_VERSION; OutBuffer.ulVersion = SECBUFFER_VERSION;
scRet = sspi->InitializeSecurityContext( scRet = tls_ctx.sspi->InitializeSecurityContext(
phCreds, &tls_ctx.h_client_creds,
NULL, NULL,
host, host,
dwSSPIFlags, dwSSPIFlags,
@ -520,7 +510,7 @@ perform_client_handshake(
SECURITY_NATIVE_DREP, SECURITY_NATIVE_DREP,
NULL, NULL,
0, 0,
phContext, &tls_ctx.h_context,
&OutBuffer, &OutBuffer,
&dwSSPIOutFlags, &dwSSPIOutFlags,
&tsExpiry); &tsExpiry);
@ -534,30 +524,24 @@ perform_client_handshake(
// Send response to server if there is one. // Send response to server if there is one.
if(OutBuffers[0].cbBuffer != 0 && OutBuffers[0].pvBuffer != NULL) if(OutBuffers[0].cbBuffer != 0 && OutBuffers[0].pvBuffer != NULL)
{ {
cbData = send(Socket, OutBuffers[0].pvBuffer, OutBuffers[0].cbBuffer, 0); cbData = send(tls_ctx.socket, OutBuffers[0].pvBuffer, OutBuffers[0].cbBuffer, 0);
if(cbData == SOCKET_ERROR || cbData == 0) { if(cbData == SOCKET_ERROR || cbData == 0) {
printf("Error %d sending data to server (1)\n", WSAGetLastError()); printf("Error %d sending data to server (1)\n", WSAGetLastError());
sspi->FreeContextBuffer(OutBuffers[0].pvBuffer); tls_ctx.sspi->FreeContextBuffer(OutBuffers[0].pvBuffer);
sspi->DeleteSecurityContext(phContext); tls_ctx.sspi->DeleteSecurityContext(&tls_ctx.h_context);
return SEC_E_INTERNAL_ERROR; return SEC_E_INTERNAL_ERROR;
} }
// Free output buffer. // Free output buffer.
sspi->FreeContextBuffer(OutBuffers[0].pvBuffer); tls_ctx.sspi->FreeContextBuffer(OutBuffers[0].pvBuffer);
OutBuffers[0].pvBuffer = NULL; OutBuffers[0].pvBuffer = NULL;
} }
return client_handshake_loop(Socket, phCreds, phContext, TRUE, pExtraData); return client_handshake_loop(TRUE, pExtraData);
} }
static SECURITY_STATUS client_handshake_loop( static SECURITY_STATUS client_handshake_loop(BOOL fDoInitialRead, SecBuffer *pExtraData) {
SOCKET Socket, // in
PCredHandle phCreds, // in
CtxtHandle * phContext, // in, out
BOOL fDoInitialRead, // in
SecBuffer * pExtraData) // out
{
SecBufferDesc InBuffer; SecBufferDesc InBuffer;
SecBuffer InBuffers[2]; SecBuffer InBuffers[2];
SecBufferDesc OutBuffer; SecBufferDesc OutBuffer;
@ -608,7 +592,7 @@ static SECURITY_STATUS client_handshake_loop(
// Read data from server. // Read data from server.
if(0 == cbIoBuffer || scRet == SEC_E_INCOMPLETE_MESSAGE) { if(0 == cbIoBuffer || scRet == SEC_E_INCOMPLETE_MESSAGE) {
if(fDoRead) { if(fDoRead) {
cbData = recv(Socket, cbData = recv(tls_ctx.socket,
IoBuffer + cbIoBuffer, IoBuffer + cbIoBuffer,
IO_BUFFER_SIZE - cbIoBuffer, IO_BUFFER_SIZE - cbIoBuffer,
0); 0);
@ -661,8 +645,8 @@ static SECURITY_STATUS client_handshake_loop(
// Call InitializeSecurityContext. // Call InitializeSecurityContext.
scRet = sspi->InitializeSecurityContext( scRet = tls_ctx.sspi->InitializeSecurityContext(
phCreds, phContext, NULL, dwSSPIFlags, 0, SECURITY_NATIVE_DREP, &tls_ctx.h_client_creds, &tls_ctx.h_context, NULL, dwSSPIFlags, 0, SECURITY_NATIVE_DREP,
&InBuffer, 0, NULL, &OutBuffer, &dwSSPIOutFlags, &tsExpiry); &InBuffer, 0, NULL, &OutBuffer, &dwSSPIOutFlags, &tsExpiry);
// If InitializeSecurityContext was successful (or if the error was // If InitializeSecurityContext was successful (or if the error was
@ -673,20 +657,20 @@ static SECURITY_STATUS client_handshake_loop(
scRet == SEC_I_CONTINUE_NEEDED || scRet == SEC_I_CONTINUE_NEEDED ||
FAILED(scRet) && (dwSSPIOutFlags & ISC_RET_EXTENDED_ERROR)) { FAILED(scRet) && (dwSSPIOutFlags & ISC_RET_EXTENDED_ERROR)) {
if(OutBuffers[0].cbBuffer != 0 && OutBuffers[0].pvBuffer != NULL) { if(OutBuffers[0].cbBuffer != 0 && OutBuffers[0].pvBuffer != NULL) {
cbData = send(Socket, cbData = send(tls_ctx.socket,
OutBuffers[0].pvBuffer, OutBuffers[0].pvBuffer,
OutBuffers[0].cbBuffer, OutBuffers[0].cbBuffer,
0); 0);
if(cbData == SOCKET_ERROR || cbData == 0) { if(cbData == SOCKET_ERROR || cbData == 0) {
printf("Error %d sending data to server (2)\n", printf("Error %d sending data to server (2)\n",
WSAGetLastError()); WSAGetLastError());
sspi->FreeContextBuffer(OutBuffers[0].pvBuffer); tls_ctx.sspi->FreeContextBuffer(OutBuffers[0].pvBuffer);
sspi->DeleteSecurityContext(phContext); tls_ctx.sspi->DeleteSecurityContext(&tls_ctx.h_context);
return SEC_E_INTERNAL_ERROR; return SEC_E_INTERNAL_ERROR;
} }
// Free output buffer. // Free output buffer.
sspi->FreeContextBuffer(OutBuffers[0].pvBuffer); tls_ctx.sspi->FreeContextBuffer(OutBuffers[0].pvBuffer);
OutBuffers[0].pvBuffer = NULL; OutBuffers[0].pvBuffer = NULL;
} }
} }
@ -753,7 +737,7 @@ static SECURITY_STATUS client_handshake_loop(
// we will attempt to connect anonymously (using our current // we will attempt to connect anonymously (using our current
// credentials). // credentials).
get_new_client_credentials(phCreds, phContext); get_new_client_credentials();
// Go around again. // Go around again.
fDoRead = FALSE; fDoRead = FALSE;
@ -778,7 +762,7 @@ static SECURITY_STATUS client_handshake_loop(
// Delete the security context in the case of a fatal error. // Delete the security context in the case of a fatal error.
if(FAILED(scRet)) { if(FAILED(scRet)) {
sspi->DeleteSecurityContext(phContext); tls_ctx.sspi->DeleteSecurityContext(&tls_ctx.h_context);
} }
LocalFree(IoBuffer); LocalFree(IoBuffer);
@ -787,7 +771,7 @@ static SECURITY_STATUS client_handshake_loop(
} }
static SECURITY_STATUS https_make_request(SOCKET Socket, PCredHandle phCreds, CtxtHandle *phContext, CHAR *req, CHAR *out, int *length) { static SECURITY_STATUS https_make_request(CHAR *req, CHAR *out, int *length) {
SecPkgContext_StreamSizes Sizes; SecPkgContext_StreamSizes Sizes;
SECURITY_STATUS scRet; SECURITY_STATUS scRet;
SecBufferDesc Message; SecBufferDesc Message;
@ -807,7 +791,7 @@ static SECURITY_STATUS https_make_request(SOCKET Socket, PCredHandle phCreds, Ct
// Read stream encryption properties. // Read stream encryption properties.
scRet = sspi->QueryContextAttributes(phContext, SECPKG_ATTR_STREAM_SIZES, &Sizes); scRet = tls_ctx.sspi->QueryContextAttributes(&tls_ctx.h_context, SECPKG_ATTR_STREAM_SIZES, &Sizes);
if(scRet != SEC_E_OK) { if(scRet != SEC_E_OK) {
printf("Error 0x%x reading SECPKG_ATTR_STREAM_SIZES\n", scRet); printf("Error 0x%x reading SECPKG_ATTR_STREAM_SIZES\n", scRet);
return scRet; return scRet;
@ -857,7 +841,7 @@ static SECURITY_STATUS https_make_request(SOCKET Socket, PCredHandle phCreds, Ct
Message.cBuffers = 4; Message.cBuffers = 4;
Message.pBuffers = Buffers; Message.pBuffers = Buffers;
scRet = sspi->EncryptMessage(phContext, 0, &Message, 0); scRet = tls_ctx.sspi->EncryptMessage(&tls_ctx.h_context, 0, &Message, 0);
if(FAILED(scRet)) { if(FAILED(scRet)) {
printf("Error 0x%x returned by EncryptMessage\n", scRet); printf("Error 0x%x returned by EncryptMessage\n", scRet);
@ -865,10 +849,10 @@ static SECURITY_STATUS https_make_request(SOCKET Socket, PCredHandle phCreds, Ct
} }
// Send the encrypted data to the server. // Send the encrypted data to the server.
cbData = send(Socket, pbIoBuffer, Buffers[0].cbBuffer + Buffers[1].cbBuffer + Buffers[2].cbBuffer, 0); cbData = send(tls_ctx.socket, pbIoBuffer, Buffers[0].cbBuffer + Buffers[1].cbBuffer + Buffers[2].cbBuffer, 0);
if(cbData == SOCKET_ERROR || cbData == 0) { if(cbData == SOCKET_ERROR || cbData == 0) {
printf("Error %d sending data to server (3)\n", WSAGetLastError()); printf("Error %d sending data to server (3)\n", WSAGetLastError());
sspi->DeleteSecurityContext(phContext); tls_ctx.sspi->DeleteSecurityContext(&tls_ctx.h_context);
return SEC_E_INTERNAL_ERROR; return SEC_E_INTERNAL_ERROR;
} }
@ -877,7 +861,7 @@ static SECURITY_STATUS https_make_request(SOCKET Socket, PCredHandle phCreds, Ct
while(TRUE){ while(TRUE){
// Read some data. // Read some data.
if(0 == cbIoBuffer || scRet == SEC_E_INCOMPLETE_MESSAGE) { if(0 == cbIoBuffer || scRet == SEC_E_INCOMPLETE_MESSAGE) {
cbData = recv(Socket, pbIoBuffer + cbIoBuffer, cbIoBufferLength - cbIoBuffer, 0); cbData = recv(tls_ctx.socket, pbIoBuffer + cbIoBuffer, cbIoBufferLength - cbIoBuffer, 0);
if(cbData == SOCKET_ERROR) { if(cbData == SOCKET_ERROR) {
printf("Error %d reading data from server\n", WSAGetLastError()); printf("Error %d reading data from server\n", WSAGetLastError());
scRet = SEC_E_INTERNAL_ERROR; scRet = SEC_E_INTERNAL_ERROR;
@ -912,7 +896,7 @@ static SECURITY_STATUS https_make_request(SOCKET Socket, PCredHandle phCreds, Ct
Message.cBuffers = 4; Message.cBuffers = 4;
Message.pBuffers = Buffers; Message.pBuffers = Buffers;
scRet = sspi->DecryptMessage(phContext, &Message, 0, NULL); scRet = tls_ctx.sspi->DecryptMessage(&tls_ctx.h_context, &Message, 0, NULL);
if(scRet == SEC_E_INCOMPLETE_MESSAGE) { if(scRet == SEC_E_INCOMPLETE_MESSAGE) {
// The input buffer contains only a fragment of an // The input buffer contains only a fragment of an
@ -966,7 +950,7 @@ static SECURITY_STATUS https_make_request(SOCKET Socket, PCredHandle phCreds, Ct
if(scRet == SEC_I_RENEGOTIATE) if(scRet == SEC_I_RENEGOTIATE)
{ {
// The server wants to perform another handshake sequence. // The server wants to perform another handshake sequence.
scRet = client_handshake_loop(Socket, phCreds, phContext, FALSE, &ExtraBuffer); scRet = client_handshake_loop(FALSE, &ExtraBuffer);
if(scRet != SEC_E_OK) { if(scRet != SEC_E_OK) {
return scRet; return scRet;
} }
@ -1082,7 +1066,7 @@ cleanup:
} }
static void get_new_client_credentials(CredHandle *phCreds, CtxtHandle *phContext) { static void get_new_client_credentials() {
CredHandle hCreds; CredHandle hCreds;
SecPkgContext_IssuerListInfoEx IssuerListInfo; SecPkgContext_IssuerListInfoEx IssuerListInfo;
PCCERT_CHAIN_CONTEXT pChainContext; PCCERT_CHAIN_CONTEXT pChainContext;
@ -1092,7 +1076,7 @@ static void get_new_client_credentials(CredHandle *phCreds, CtxtHandle *phContex
SECURITY_STATUS Status; SECURITY_STATUS Status;
// Read list of trusted issuers from schannel. // Read list of trusted issuers from schannel.
Status = sspi->QueryContextAttributes(phContext, SECPKG_ATTR_ISSUER_LIST_EX, (PVOID)&IssuerListInfo); Status = tls_ctx.sspi->QueryContextAttributes(&tls_ctx.h_context, SECPKG_ATTR_ISSUER_LIST_EX, (PVOID)&IssuerListInfo);
if(Status != SEC_E_OK) { if(Status != SEC_E_OK) {
printf("Error 0x%x querying issuer list info\n", Status); printf("Error 0x%x querying issuer list info\n", Status);
return; return;
@ -1112,7 +1096,7 @@ static void get_new_client_credentials(CredHandle *phCreds, CtxtHandle *phContex
while(TRUE) { while(TRUE) {
// Find a certificate chain. // Find a certificate chain.
pChainContext = CertFindChainInStore(cert_store, pChainContext = CertFindChainInStore(tls_ctx.cert_store,
X509_ASN_ENCODING, X509_ASN_ENCODING,
0, 0,
CERT_CHAIN_FIND_BY_ISSUER, CERT_CHAIN_FIND_BY_ISSUER,
@ -1127,16 +1111,16 @@ static void get_new_client_credentials(CredHandle *phCreds, CtxtHandle *phContex
pCertContext = pChainContext->rgpChain[0]->rgpElement[0]->pCertContext; pCertContext = pChainContext->rgpChain[0]->rgpElement[0]->pCertContext;
// Create schannel credential. // Create schannel credential.
schannel_cred.dwVersion = SCHANNEL_CRED_VERSION; tls_ctx.schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
schannel_cred.cCreds = 1; tls_ctx.schannel_cred.cCreds = 1;
schannel_cred.paCred = &pCertContext; tls_ctx.schannel_cred.paCred = &pCertContext;
Status = sspi->AcquireCredentialsHandle( Status = tls_ctx.sspi->AcquireCredentialsHandle(
NULL, // Name of principal NULL, // Name of principal
UNISP_NAME_A, // Name of package UNISP_NAME_A, // Name of package
SECPKG_CRED_OUTBOUND, // Flags indicating use SECPKG_CRED_OUTBOUND, // Flags indicating use
NULL, // Pointer to logon ID NULL, // Pointer to logon ID
&schannel_cred, // Package specific data &tls_ctx.schannel_cred, // Package specific data
NULL, // Pointer to GetKey() func NULL, // Pointer to GetKey() func
NULL, // Value to pass to GetKey() NULL, // Value to pass to GetKey()
&hCreds, // (out) Cred Handle &hCreds, // (out) Cred Handle
@ -1147,9 +1131,9 @@ static void get_new_client_credentials(CredHandle *phCreds, CtxtHandle *phContex
} }
// Destroy the old credentials. // Destroy the old credentials.
sspi->FreeCredentialsHandle(phCreds); tls_ctx.sspi->FreeCredentialsHandle(&tls_ctx.h_client_creds);
*phCreds = hCreds; tls_ctx.h_client_creds = hCreds;
// //
// As you can see, this sample code maintains a single credential // As you can see, this sample code maintains a single credential

20
thirdparty/vschannel/vschannel.h vendored
View File

@ -27,26 +27,22 @@ static void vschannel_cleanup();
static INT request(CHAR *host, CHAR *req, CHAR *out); static INT request(CHAR *host, CHAR *req, CHAR *out);
static SECURITY_STATUS create_credentials(PCredHandle phCreds); static SECURITY_STATUS https_make_request(
CHAR *req, CHAR *out, int *length);
static INT connect_to_server(CHAR *host, INT port_number, SOCKET *pSocket); static INT connect_to_server(CHAR *host, INT port_number);
static LONG disconnect_from_server();
static SECURITY_STATUS perform_client_handshake( static SECURITY_STATUS perform_client_handshake(
SOCKET Socket, PCredHandle phCreds, CHAR *host, CHAR *host, SecBuffer *pExtraData);
CtxtHandle *phContext, SecBuffer *pExtraData);
static SECURITY_STATUS client_handshake_loop( static SECURITY_STATUS client_handshake_loop(
SOCKET Socket, PCredHandle phCreds, CtxtHandle *phContext,
BOOL fDoInitialRead, SecBuffer *pExtraData); BOOL fDoInitialRead, SecBuffer *pExtraData);
static SECURITY_STATUS https_make_request(
SOCKET Socket, PCredHandle phCreds,
CtxtHandle *phContext, CHAR *req, CHAR *out, int *length);
static DWORD verify_server_certificate( static DWORD verify_server_certificate(
PCCERT_CONTEXT pServerCert, PSTR host, DWORD dwCertFlags); PCCERT_CONTEXT pServerCert, PSTR host, DWORD dwCertFlags);
static LONG disconnect_from_server( static SECURITY_STATUS create_credentials();
SOCKET Socket, PCredHandle phCreds, CtxtHandle *phContext);
static void get_new_client_credentials(CredHandle *phCreds, CtxtHandle *phContext); static void get_new_client_credentials();