1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824 |
- #include "curl_setup.h"
- #ifdef USE_SCHANNEL
- #ifndef USE_WINDOWS_SSPI
- # error "cannot compile SCHANNEL support without SSPI."
- #endif
- #include "schannel.h"
- #include "schannel_int.h"
- #include "vtls.h"
- #include "vtls_int.h"
- #include "strcase.h"
- #include "sendf.h"
- #include "connect.h"
- #include "strerror.h"
- #include "select.h"
- #include "inet_pton.h"
- #include "curl_multibyte.h"
- #include "warnless.h"
- #include "x509asn1.h"
- #include "curl_printf.h"
- #include "multiif.h"
- #include "version_win32.h"
- #include "rand.h"
- #include "curl_memory.h"
- #include "memdebug.h"
- #ifdef CURL_SCHANNEL_DEV_DEBUG
- #define SCH_DEV(x) x
- #else
- #define SCH_DEV(x) do { } while(0)
- #endif
- #if defined(_MSC_VER) && (_MSC_VER >= 1800) && !defined(_USING_V110_SDK71_)
- # define HAS_ALPN 1
- #endif
- #ifndef BCRYPT_CHACHA20_POLY1305_ALGORITHM
- #define BCRYPT_CHACHA20_POLY1305_ALGORITHM L"CHACHA20_POLY1305"
- #endif
- #ifndef BCRYPT_CHAIN_MODE_CCM
- #define BCRYPT_CHAIN_MODE_CCM L"ChainingModeCCM"
- #endif
- #ifndef BCRYPT_CHAIN_MODE_GCM
- #define BCRYPT_CHAIN_MODE_GCM L"ChainingModeGCM"
- #endif
- #ifndef BCRYPT_AES_ALGORITHM
- #define BCRYPT_AES_ALGORITHM L"AES"
- #endif
- #ifndef BCRYPT_SHA256_ALGORITHM
- #define BCRYPT_SHA256_ALGORITHM L"SHA256"
- #endif
- #ifndef BCRYPT_SHA384_ALGORITHM
- #define BCRYPT_SHA384_ALGORITHM L"SHA384"
- #endif
- #ifdef HAS_CLIENT_CERT_PATH
- #ifdef UNICODE
- #define CURL_CERT_STORE_PROV_SYSTEM CERT_STORE_PROV_SYSTEM_W
- #else
- #define CURL_CERT_STORE_PROV_SYSTEM CERT_STORE_PROV_SYSTEM_A
- #endif
- #endif
- #ifndef SP_PROT_TLS1_0_CLIENT
- #define SP_PROT_TLS1_0_CLIENT SP_PROT_TLS1_CLIENT
- #endif
- #ifndef SP_PROT_TLS1_1_CLIENT
- #define SP_PROT_TLS1_1_CLIENT 0x00000200
- #endif
- #ifndef SP_PROT_TLS1_2_CLIENT
- #define SP_PROT_TLS1_2_CLIENT 0x00000800
- #endif
- #ifndef SP_PROT_TLS1_3_CLIENT
- #define SP_PROT_TLS1_3_CLIENT 0x00002000
- #endif
- #ifndef SCH_USE_STRONG_CRYPTO
- #define SCH_USE_STRONG_CRYPTO 0x00400000
- #endif
- #ifndef SECBUFFER_ALERT
- #define SECBUFFER_ALERT 17
- #endif
- #define CURL_SCHANNEL_BUFFER_INIT_SIZE 4096
- #define CURL_SCHANNEL_BUFFER_FREE_SIZE 1024
- #define CERT_THUMBPRINT_STR_LEN 40
- #define CERT_THUMBPRINT_DATA_LEN 20
- #ifndef CALG_SHA_256
- # define CALG_SHA_256 0x0000800c
- #endif
- #ifndef PKCS12_NO_PERSIST_KEY
- #define PKCS12_NO_PERSIST_KEY 0x00008000
- #endif
- static CURLcode schannel_pkp_pin_peer_pubkey(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- const char *pinnedpubkey);
- static void InitSecBuffer(SecBuffer *buffer, unsigned long BufType,
- void *BufDataPtr, unsigned long BufByteSize)
- {
- buffer->cbBuffer = BufByteSize;
- buffer->BufferType = BufType;
- buffer->pvBuffer = BufDataPtr;
- }
- static void InitSecBufferDesc(SecBufferDesc *desc, SecBuffer *BufArr,
- unsigned long NumArrElem)
- {
- desc->ulVersion = SECBUFFER_VERSION;
- desc->pBuffers = BufArr;
- desc->cBuffers = NumArrElem;
- }
- static CURLcode
- schannel_set_ssl_version_min_max(DWORD *enabled_protocols,
- struct Curl_cfilter *cf,
- struct Curl_easy *data)
- {
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- long ssl_version = conn_config->version;
- long ssl_version_max = (long)conn_config->version_max;
- long i = ssl_version;
- switch(ssl_version_max) {
- case CURL_SSLVERSION_MAX_NONE:
- case CURL_SSLVERSION_MAX_DEFAULT:
-
- if(curlx_verify_windows_version(10, 0, 20348, PLATFORM_WINNT,
- VERSION_GREATER_THAN_EQUAL)) {
- ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_3;
- }
- else
- ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_2;
- break;
- }
- for(; i <= (ssl_version_max >> 16); ++i) {
- switch(i) {
- case CURL_SSLVERSION_TLSv1_0:
- (*enabled_protocols) |= SP_PROT_TLS1_0_CLIENT;
- break;
- case CURL_SSLVERSION_TLSv1_1:
- (*enabled_protocols) |= SP_PROT_TLS1_1_CLIENT;
- break;
- case CURL_SSLVERSION_TLSv1_2:
- (*enabled_protocols) |= SP_PROT_TLS1_2_CLIENT;
- break;
- case CURL_SSLVERSION_TLSv1_3:
-
- if(curlx_verify_windows_version(10, 0, 20348, PLATFORM_WINNT,
- VERSION_GREATER_THAN_EQUAL)) {
- (*enabled_protocols) |= SP_PROT_TLS1_3_CLIENT;
- break;
- }
- else {
- failf(data, "schannel: TLS 1.3 not supported on Windows prior to 11");
- return CURLE_SSL_CONNECT_ERROR;
- }
- }
- }
- return CURLE_OK;
- }
- #define LONGEST_ALG_ID 32
- #define CIPHEROPTION(x) {#x, x}
- struct algo {
- const char *name;
- int id;
- };
- static const struct algo algs[]= {
- CIPHEROPTION(CALG_MD2),
- CIPHEROPTION(CALG_MD4),
- CIPHEROPTION(CALG_MD5),
- CIPHEROPTION(CALG_SHA),
- CIPHEROPTION(CALG_SHA1),
- CIPHEROPTION(CALG_MAC),
- CIPHEROPTION(CALG_RSA_SIGN),
- CIPHEROPTION(CALG_DSS_SIGN),
- #ifdef CALG_NO_SIGN
- CIPHEROPTION(CALG_NO_SIGN),
- #endif
- CIPHEROPTION(CALG_RSA_KEYX),
- CIPHEROPTION(CALG_DES),
- #ifdef CALG_3DES_112
- CIPHEROPTION(CALG_3DES_112),
- #endif
- CIPHEROPTION(CALG_3DES),
- CIPHEROPTION(CALG_DESX),
- CIPHEROPTION(CALG_RC2),
- CIPHEROPTION(CALG_RC4),
- CIPHEROPTION(CALG_SEAL),
- #ifdef CALG_DH_SF
- CIPHEROPTION(CALG_DH_SF),
- #endif
- CIPHEROPTION(CALG_DH_EPHEM),
- #ifdef CALG_AGREEDKEY_ANY
- CIPHEROPTION(CALG_AGREEDKEY_ANY),
- #endif
- #ifdef CALG_HUGHES_MD5
- CIPHEROPTION(CALG_HUGHES_MD5),
- #endif
- CIPHEROPTION(CALG_SKIPJACK),
- #ifdef CALG_TEK
- CIPHEROPTION(CALG_TEK),
- #endif
- CIPHEROPTION(CALG_CYLINK_MEK),
- CIPHEROPTION(CALG_SSL3_SHAMD5),
- #ifdef CALG_SSL3_MASTER
- CIPHEROPTION(CALG_SSL3_MASTER),
- #endif
- #ifdef CALG_SCHANNEL_MASTER_HASH
- CIPHEROPTION(CALG_SCHANNEL_MASTER_HASH),
- #endif
- #ifdef CALG_SCHANNEL_MAC_KEY
- CIPHEROPTION(CALG_SCHANNEL_MAC_KEY),
- #endif
- #ifdef CALG_SCHANNEL_ENC_KEY
- CIPHEROPTION(CALG_SCHANNEL_ENC_KEY),
- #endif
- #ifdef CALG_PCT1_MASTER
- CIPHEROPTION(CALG_PCT1_MASTER),
- #endif
- #ifdef CALG_SSL2_MASTER
- CIPHEROPTION(CALG_SSL2_MASTER),
- #endif
- #ifdef CALG_TLS1_MASTER
- CIPHEROPTION(CALG_TLS1_MASTER),
- #endif
- #ifdef CALG_RC5
- CIPHEROPTION(CALG_RC5),
- #endif
- #ifdef CALG_HMAC
- CIPHEROPTION(CALG_HMAC),
- #endif
- #ifdef CALG_TLS1PRF
- CIPHEROPTION(CALG_TLS1PRF),
- #endif
- #ifdef CALG_HASH_REPLACE_OWF
- CIPHEROPTION(CALG_HASH_REPLACE_OWF),
- #endif
- #ifdef CALG_AES_128
- CIPHEROPTION(CALG_AES_128),
- #endif
- #ifdef CALG_AES_192
- CIPHEROPTION(CALG_AES_192),
- #endif
- #ifdef CALG_AES_256
- CIPHEROPTION(CALG_AES_256),
- #endif
- #ifdef CALG_AES
- CIPHEROPTION(CALG_AES),
- #endif
- #ifdef CALG_SHA_256
- CIPHEROPTION(CALG_SHA_256),
- #endif
- #ifdef CALG_SHA_384
- CIPHEROPTION(CALG_SHA_384),
- #endif
- #ifdef CALG_SHA_512
- CIPHEROPTION(CALG_SHA_512),
- #endif
- #ifdef CALG_ECDH
- CIPHEROPTION(CALG_ECDH),
- #endif
- #ifdef CALG_ECMQV
- CIPHEROPTION(CALG_ECMQV),
- #endif
- #ifdef CALG_ECDSA
- CIPHEROPTION(CALG_ECDSA),
- #endif
- #ifdef CALG_ECDH_EPHEM
- CIPHEROPTION(CALG_ECDH_EPHEM),
- #endif
- {NULL, 0},
- };
- static int
- get_alg_id_by_name(char *name)
- {
- char *nameEnd = strchr(name, ':');
- size_t n = nameEnd ? (size_t)(nameEnd - name) : strlen(name);
- int i;
- for(i = 0; algs[i].name; i++) {
- if((n == strlen(algs[i].name) && !strncmp(algs[i].name, name, n)))
- return algs[i].id;
- }
- return 0;
- }
- #define NUM_CIPHERS 47
- static CURLcode
- set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
- ALG_ID *algIds)
- {
- char *startCur = ciphers;
- int algCount = 0;
- while(startCur && (0 != *startCur) && (algCount < NUM_CIPHERS)) {
- long alg = strtol(startCur, 0, 0);
- if(!alg)
- alg = get_alg_id_by_name(startCur);
- if(alg)
- algIds[algCount++] = (ALG_ID)alg;
- else if(!strncmp(startCur, "USE_STRONG_CRYPTO",
- sizeof("USE_STRONG_CRYPTO") - 1) ||
- !strncmp(startCur, "SCH_USE_STRONG_CRYPTO",
- sizeof("SCH_USE_STRONG_CRYPTO") - 1))
- schannel_cred->dwFlags |= SCH_USE_STRONG_CRYPTO;
- else
- return CURLE_SSL_CIPHER;
- startCur = strchr(startCur, ':');
- if(startCur)
- startCur++;
- }
- schannel_cred->palgSupportedAlgs = algIds;
- schannel_cred->cSupportedAlgs = (DWORD)algCount;
- return CURLE_OK;
- }
- #ifdef HAS_CLIENT_CERT_PATH
- static CURLcode
- get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
- TCHAR **thumbprint)
- {
- TCHAR *sep;
- TCHAR *store_path_start;
- size_t store_name_len;
- sep = _tcschr(path, TEXT('\\'));
- if(!sep)
- return CURLE_SSL_CERTPROBLEM;
- store_name_len = sep - path;
- if(_tcsncmp(path, TEXT("CurrentUser"), store_name_len) == 0)
- *store_name = CERT_SYSTEM_STORE_CURRENT_USER;
- else if(_tcsncmp(path, TEXT("LocalMachine"), store_name_len) == 0)
- *store_name = CERT_SYSTEM_STORE_LOCAL_MACHINE;
- else if(_tcsncmp(path, TEXT("CurrentService"), store_name_len) == 0)
- *store_name = CERT_SYSTEM_STORE_CURRENT_SERVICE;
- else if(_tcsncmp(path, TEXT("Services"), store_name_len) == 0)
- *store_name = CERT_SYSTEM_STORE_SERVICES;
- else if(_tcsncmp(path, TEXT("Users"), store_name_len) == 0)
- *store_name = CERT_SYSTEM_STORE_USERS;
- else if(_tcsncmp(path, TEXT("CurrentUserGroupPolicy"),
- store_name_len) == 0)
- *store_name = CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY;
- else if(_tcsncmp(path, TEXT("LocalMachineGroupPolicy"),
- store_name_len) == 0)
- *store_name = CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY;
- else if(_tcsncmp(path, TEXT("LocalMachineEnterprise"),
- store_name_len) == 0)
- *store_name = CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE;
- else
- return CURLE_SSL_CERTPROBLEM;
- store_path_start = sep + 1;
- sep = _tcschr(store_path_start, TEXT('\\'));
- if(!sep)
- return CURLE_SSL_CERTPROBLEM;
- *thumbprint = sep + 1;
- if(_tcslen(*thumbprint) != CERT_THUMBPRINT_STR_LEN)
- return CURLE_SSL_CERTPROBLEM;
- *sep = TEXT('\0');
- *store_path = _tcsdup(store_path_start);
- *sep = TEXT('\\');
- if(!*store_path)
- return CURLE_OUT_OF_MEMORY;
- return CURLE_OK;
- }
- #endif
- static CURLcode
- schannel_acquire_credential_handle(struct Curl_cfilter *cf,
- struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
- #ifdef HAS_CLIENT_CERT_PATH
- PCCERT_CONTEXT client_certs[1] = { NULL };
- HCERTSTORE client_cert_store = NULL;
- #endif
- SECURITY_STATUS sspi_status = SEC_E_OK;
- CURLcode result;
-
- DWORD flags = 0;
- DWORD enabled_protocols = 0;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)(connssl->backend);
- DEBUGASSERT(backend);
- if(conn_config->verifypeer) {
- #ifdef HAS_MANUAL_VERIFY_API
- if(backend->use_manual_cred_validation)
- flags = SCH_CRED_MANUAL_CRED_VALIDATION;
- else
- #endif
- flags = SCH_CRED_AUTO_CRED_VALIDATION;
- if(ssl_config->no_revoke) {
- flags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
- SCH_CRED_IGNORE_REVOCATION_OFFLINE;
- DEBUGF(infof(data, "schannel: disabled server certificate revocation "
- "checks"));
- }
- else if(ssl_config->revoke_best_effort) {
- flags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
- SCH_CRED_IGNORE_REVOCATION_OFFLINE | SCH_CRED_REVOCATION_CHECK_CHAIN;
- DEBUGF(infof(data, "schannel: ignore revocation offline errors"));
- }
- else {
- flags |= SCH_CRED_REVOCATION_CHECK_CHAIN;
- DEBUGF(infof(data,
- "schannel: checking server certificate revocation"));
- }
- }
- else {
- flags = SCH_CRED_MANUAL_CRED_VALIDATION |
- SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
- SCH_CRED_IGNORE_REVOCATION_OFFLINE;
- DEBUGF(infof(data,
- "schannel: disabled server cert revocation checks"));
- }
- if(!conn_config->verifyhost) {
- flags |= SCH_CRED_NO_SERVERNAME_CHECK;
- DEBUGF(infof(data, "schannel: verifyhost setting prevents Schannel from "
- "comparing the supplied target name with the subject "
- "names in server certificates."));
- }
- if(!ssl_config->auto_client_cert) {
- flags &= ~(DWORD)SCH_CRED_USE_DEFAULT_CREDS;
- flags |= SCH_CRED_NO_DEFAULT_CREDS;
- infof(data, "schannel: disabled automatic use of client certificate");
- }
- else
- infof(data, "schannel: enabled automatic use of client certificate");
- switch(conn_config->version) {
- case CURL_SSLVERSION_DEFAULT:
- case CURL_SSLVERSION_TLSv1:
- case CURL_SSLVERSION_TLSv1_0:
- case CURL_SSLVERSION_TLSv1_1:
- case CURL_SSLVERSION_TLSv1_2:
- case CURL_SSLVERSION_TLSv1_3:
- {
- result = schannel_set_ssl_version_min_max(&enabled_protocols, cf, data);
- if(result != CURLE_OK)
- return result;
- break;
- }
- case CURL_SSLVERSION_SSLv3:
- case CURL_SSLVERSION_SSLv2:
- failf(data, "SSL versions not supported");
- return CURLE_NOT_BUILT_IN;
- default:
- failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
- return CURLE_SSL_CONNECT_ERROR;
- }
- #ifdef HAS_CLIENT_CERT_PATH
-
- if(data->set.ssl.primary.clientcert || data->set.ssl.primary.cert_blob) {
- DWORD cert_store_name = 0;
- TCHAR *cert_store_path = NULL;
- TCHAR *cert_thumbprint_str = NULL;
- CRYPT_HASH_BLOB cert_thumbprint;
- BYTE cert_thumbprint_data[CERT_THUMBPRINT_DATA_LEN];
- HCERTSTORE cert_store = NULL;
- FILE *fInCert = NULL;
- void *certdata = NULL;
- size_t certsize = 0;
- bool blob = data->set.ssl.primary.cert_blob != NULL;
- TCHAR *cert_path = NULL;
- if(blob) {
- certdata = data->set.ssl.primary.cert_blob->data;
- certsize = data->set.ssl.primary.cert_blob->len;
- }
- else {
- cert_path = curlx_convert_UTF8_to_tchar(
- data->set.ssl.primary.clientcert);
- if(!cert_path)
- return CURLE_OUT_OF_MEMORY;
- result = get_cert_location(cert_path, &cert_store_name,
- &cert_store_path, &cert_thumbprint_str);
- if(result && (data->set.ssl.primary.clientcert[0]!='\0'))
- fInCert = fopen(data->set.ssl.primary.clientcert, "rb");
- if(result && !fInCert) {
- failf(data, "schannel: Failed to get certificate location"
- " or file for %s",
- data->set.ssl.primary.clientcert);
- curlx_unicodefree(cert_path);
- return result;
- }
- }
- if((fInCert || blob) && (data->set.ssl.cert_type) &&
- (!strcasecompare(data->set.ssl.cert_type, "P12"))) {
- failf(data, "schannel: certificate format compatibility error "
- " for %s",
- blob ? "(memory blob)" : data->set.ssl.primary.clientcert);
- curlx_unicodefree(cert_path);
- return CURLE_SSL_CERTPROBLEM;
- }
- if(fInCert || blob) {
-
- CRYPT_DATA_BLOB datablob;
- WCHAR* pszPassword;
- size_t pwd_len = 0;
- int str_w_len = 0;
- const char *cert_showfilename_error = blob ?
- "(memory blob)" : data->set.ssl.primary.clientcert;
- curlx_unicodefree(cert_path);
- if(fInCert) {
- long cert_tell = 0;
- bool continue_reading = fseek(fInCert, 0, SEEK_END) == 0;
- if(continue_reading)
- cert_tell = ftell(fInCert);
- if(cert_tell < 0)
- continue_reading = FALSE;
- else
- certsize = (size_t)cert_tell;
- if(continue_reading)
- continue_reading = fseek(fInCert, 0, SEEK_SET) == 0;
- if(continue_reading)
- certdata = malloc(certsize + 1);
- if((!certdata) ||
- ((int) fread(certdata, certsize, 1, fInCert) != 1))
- continue_reading = FALSE;
- fclose(fInCert);
- if(!continue_reading) {
- failf(data, "schannel: Failed to read cert file %s",
- data->set.ssl.primary.clientcert);
- free(certdata);
- return CURLE_SSL_CERTPROBLEM;
- }
- }
-
- datablob.pbData = (BYTE*)certdata;
- datablob.cbData = (DWORD)certsize;
- if(data->set.ssl.key_passwd)
- pwd_len = strlen(data->set.ssl.key_passwd);
- pszPassword = (WCHAR*)malloc(sizeof(WCHAR)*(pwd_len + 1));
- if(pszPassword) {
- if(pwd_len > 0)
- str_w_len = MultiByteToWideChar(CP_UTF8,
- MB_ERR_INVALID_CHARS,
- data->set.ssl.key_passwd,
- (int)pwd_len,
- pszPassword, (int)(pwd_len + 1));
- if((str_w_len >= 0) && (str_w_len <= (int)pwd_len))
- pszPassword[str_w_len] = 0;
- else
- pszPassword[0] = 0;
- if(curlx_verify_windows_version(6, 0, 0, PLATFORM_WINNT,
- VERSION_GREATER_THAN_EQUAL))
- cert_store = PFXImportCertStore(&datablob, pszPassword,
- PKCS12_NO_PERSIST_KEY);
- else
- cert_store = PFXImportCertStore(&datablob, pszPassword, 0);
- free(pszPassword);
- }
- if(!blob)
- free(certdata);
- if(!cert_store) {
- DWORD errorcode = GetLastError();
- if(errorcode == ERROR_INVALID_PASSWORD)
- failf(data, "schannel: Failed to import cert file %s, "
- "password is bad",
- cert_showfilename_error);
- else
- failf(data, "schannel: Failed to import cert file %s, "
- "last error is 0x%lx",
- cert_showfilename_error, errorcode);
- return CURLE_SSL_CERTPROBLEM;
- }
- client_certs[0] = CertFindCertificateInStore(
- cert_store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
- CERT_FIND_ANY, NULL, NULL);
- if(!client_certs[0]) {
- failf(data, "schannel: Failed to get certificate from file %s"
- ", last error is 0x%lx",
- cert_showfilename_error, GetLastError());
- CertCloseStore(cert_store, 0);
- return CURLE_SSL_CERTPROBLEM;
- }
- }
- else {
- cert_store =
- CertOpenStore(CURL_CERT_STORE_PROV_SYSTEM, 0,
- (HCRYPTPROV)NULL,
- CERT_STORE_OPEN_EXISTING_FLAG | cert_store_name,
- cert_store_path);
- if(!cert_store) {
- char *path_utf8 =
- curlx_convert_tchar_to_UTF8(cert_store_path);
- failf(data, "schannel: Failed to open cert store %lx %s, "
- "last error is 0x%lx",
- cert_store_name,
- (path_utf8 ? path_utf8 : "(unknown)"),
- GetLastError());
- free(cert_store_path);
- curlx_unicodefree(path_utf8);
- curlx_unicodefree(cert_path);
- return CURLE_SSL_CERTPROBLEM;
- }
- free(cert_store_path);
- cert_thumbprint.pbData = cert_thumbprint_data;
- cert_thumbprint.cbData = CERT_THUMBPRINT_DATA_LEN;
- if(!CryptStringToBinary(cert_thumbprint_str,
- CERT_THUMBPRINT_STR_LEN,
- CRYPT_STRING_HEX,
- cert_thumbprint_data,
- &cert_thumbprint.cbData,
- NULL, NULL)) {
- curlx_unicodefree(cert_path);
- CertCloseStore(cert_store, 0);
- return CURLE_SSL_CERTPROBLEM;
- }
- client_certs[0] = CertFindCertificateInStore(
- cert_store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
- CERT_FIND_HASH, &cert_thumbprint, NULL);
- curlx_unicodefree(cert_path);
- if(!client_certs[0]) {
-
- CertCloseStore(cert_store, 0);
- return CURLE_SSL_CERTPROBLEM;
- }
- }
- client_cert_store = cert_store;
- }
- #else
- if(data->set.ssl.primary.clientcert || data->set.ssl.primary.cert_blob) {
- failf(data, "schannel: client cert support not built in");
- return CURLE_NOT_BUILT_IN;
- }
- #endif
-
- backend->cred = (struct Curl_schannel_cred *)
- calloc(1, sizeof(struct Curl_schannel_cred));
- if(!backend->cred) {
- failf(data, "schannel: unable to allocate memory");
- #ifdef HAS_CLIENT_CERT_PATH
- if(client_certs[0])
- CertFreeCertificateContext(client_certs[0]);
- if(client_cert_store)
- CertCloseStore(client_cert_store, 0);
- #endif
- return CURLE_OUT_OF_MEMORY;
- }
- backend->cred->refcount = 1;
- #ifdef HAS_CLIENT_CERT_PATH
-
- backend->cred->client_cert_store = client_cert_store;
- #endif
-
- if(!conn_config->cipher_list &&
- curlx_verify_windows_version(10, 0, 17763, PLATFORM_WINNT,
- VERSION_GREATER_THAN_EQUAL)) {
- SCH_CREDENTIALS credentials = { 0 };
- TLS_PARAMETERS tls_parameters = { 0 };
- CRYPTO_SETTINGS crypto_settings[1] = { { 0 } };
- tls_parameters.pDisabledCrypto = crypto_settings;
-
- tls_parameters.cDisabledCrypto = (DWORD)0;
- credentials.pTlsParameters = &tls_parameters;
- credentials.cTlsParameters = 1;
- credentials.dwVersion = SCH_CREDENTIALS_VERSION;
- credentials.dwFlags = flags | SCH_USE_STRONG_CRYPTO;
- credentials.pTlsParameters->grbitDisabledProtocols =
- (DWORD)~enabled_protocols;
- #ifdef HAS_CLIENT_CERT_PATH
- if(client_certs[0]) {
- credentials.cCreds = 1;
- credentials.paCred = client_certs;
- }
- #endif
- sspi_status =
- Curl_pSecFn->AcquireCredentialsHandle(NULL, (TCHAR*)UNISP_NAME,
- SECPKG_CRED_OUTBOUND, NULL,
- &credentials, NULL, NULL,
- &backend->cred->cred_handle,
- &backend->cred->time_stamp);
- }
- else {
-
- ALG_ID algIds[NUM_CIPHERS];
- char *ciphers = conn_config->cipher_list;
- SCHANNEL_CRED schannel_cred = { 0 };
- schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
- schannel_cred.dwFlags = flags;
- schannel_cred.grbitEnabledProtocols = enabled_protocols;
- if(ciphers) {
- if((enabled_protocols & SP_PROT_TLS1_3_CLIENT)) {
- infof(data, "schannel: WARNING: This version of Schannel "
- "negotiates a less-secure TLS version than TLS 1.3 because the "
- "user set an algorithm cipher list.");
- }
- result = set_ssl_ciphers(&schannel_cred, ciphers, algIds);
- if(CURLE_OK != result) {
- failf(data, "schannel: Failed setting algorithm cipher list");
- return result;
- }
- }
- else {
- schannel_cred.dwFlags = flags | SCH_USE_STRONG_CRYPTO;
- }
- #ifdef HAS_CLIENT_CERT_PATH
- if(client_certs[0]) {
- schannel_cred.cCreds = 1;
- schannel_cred.paCred = client_certs;
- }
- #endif
- sspi_status =
- Curl_pSecFn->AcquireCredentialsHandle(NULL, (TCHAR*)UNISP_NAME,
- SECPKG_CRED_OUTBOUND, NULL,
- &schannel_cred, NULL, NULL,
- &backend->cred->cred_handle,
- &backend->cred->time_stamp);
- }
- #ifdef HAS_CLIENT_CERT_PATH
- if(client_certs[0])
- CertFreeCertificateContext(client_certs[0]);
- #endif
- if(sspi_status != SEC_E_OK) {
- char buffer[STRERROR_LEN];
- failf(data, "schannel: AcquireCredentialsHandle failed: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- Curl_safefree(backend->cred);
- switch(sspi_status) {
- case SEC_E_INSUFFICIENT_MEMORY:
- return CURLE_OUT_OF_MEMORY;
- case SEC_E_NO_CREDENTIALS:
- case SEC_E_SECPKG_NOT_FOUND:
- case SEC_E_NOT_OWNER:
- case SEC_E_UNKNOWN_CREDENTIALS:
- case SEC_E_INTERNAL_ERROR:
- default:
- return CURLE_SSL_CONNECT_ERROR;
- }
- }
- return CURLE_OK;
- }
- static CURLcode
- schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- ssize_t written = -1;
- struct ssl_connect_data *connssl = cf->ctx;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
- SecBuffer outbuf;
- SecBufferDesc outbuf_desc;
- SecBuffer inbuf;
- SecBufferDesc inbuf_desc;
- #ifdef HAS_ALPN
- unsigned char alpn_buffer[128];
- #endif
- SECURITY_STATUS sspi_status = SEC_E_OK;
- struct Curl_schannel_cred *old_cred = NULL;
- CURLcode result;
- DEBUGASSERT(backend);
- DEBUGF(infof(data,
- "schannel: SSL/TLS connection with %s port %d (step 1/3)",
- connssl->peer.hostname, connssl->peer.port));
- if(curlx_verify_windows_version(5, 1, 0, PLATFORM_WINNT,
- VERSION_LESS_THAN_EQUAL)) {
-
- infof(data, "schannel: Windows version is old and may not be able to "
- "connect to some servers due to lack of SNI, algorithms, etc.");
- }
- #ifdef HAS_ALPN
-
- backend->use_alpn = connssl->alpn &&
- !GetProcAddress(GetModuleHandle(TEXT("ntdll")),
- "wine_get_version") &&
- curlx_verify_windows_version(6, 3, 0, PLATFORM_WINNT,
- VERSION_GREATER_THAN_EQUAL);
- #else
- backend->use_alpn = FALSE;
- #endif
- #ifdef _WIN32_WCE
- #ifdef HAS_MANUAL_VERIFY_API
-
- backend->use_manual_cred_validation = TRUE;
- #else
- #error "compiler too old to support Windows CE requisite manual cert verify"
- #endif
- #else
- #ifdef HAS_MANUAL_VERIFY_API
- if(conn_config->CAfile || conn_config->ca_info_blob) {
- if(curlx_verify_windows_version(6, 1, 0, PLATFORM_WINNT,
- VERSION_GREATER_THAN_EQUAL)) {
- backend->use_manual_cred_validation = TRUE;
- }
- else {
- failf(data, "schannel: this version of Windows is too old to support "
- "certificate verification via CA bundle file.");
- return CURLE_SSL_CACERT_BADFILE;
- }
- }
- else
- backend->use_manual_cred_validation = FALSE;
- #else
- if(conn_config->CAfile || conn_config->ca_info_blob) {
- failf(data, "schannel: CA cert support not built in");
- return CURLE_NOT_BUILT_IN;
- }
- #endif
- #endif
- backend->cred = NULL;
-
- if(ssl_config->primary.cache_session) {
- Curl_ssl_sessionid_lock(data);
- if(!Curl_ssl_getsessionid(cf, data, &connssl->peer,
- (void **)&old_cred, NULL, NULL)) {
- backend->cred = old_cred;
- DEBUGF(infof(data, "schannel: reusing existing credential handle"));
-
- backend->cred->refcount++;
- DEBUGF(infof(data,
- "schannel: incremented credential handle refcount = %d",
- backend->cred->refcount));
- }
- Curl_ssl_sessionid_unlock(data);
- }
- if(!backend->cred) {
- char *snihost;
- result = schannel_acquire_credential_handle(cf, data);
- if(result)
- return result;
-
-
- snihost = connssl->peer.sni ? connssl->peer.sni : connssl->peer.hostname;
- backend->cred->sni_hostname = curlx_convert_UTF8_to_tchar(snihost);
- if(!backend->cred->sni_hostname)
- return CURLE_OUT_OF_MEMORY;
- }
-
- if(connssl->peer.type != CURL_SSL_PEER_DNS) {
- infof(data, "schannel: using IP address, SNI is not supported by OS.");
- }
- #ifdef HAS_ALPN
- if(backend->use_alpn) {
- int cur = 0;
- int list_start_index = 0;
- unsigned int *extension_len = NULL;
- unsigned short* list_len = NULL;
- struct alpn_proto_buf proto;
-
- extension_len = (unsigned int *)(void *)(&alpn_buffer[cur]);
- cur += (int)sizeof(unsigned int);
-
- *(unsigned int *)(void *)&alpn_buffer[cur] =
- SecApplicationProtocolNegotiationExt_ALPN;
- cur += (int)sizeof(unsigned int);
-
- list_len = (unsigned short*)(void *)(&alpn_buffer[cur]);
- cur += (int)sizeof(unsigned short);
- list_start_index = cur;
- result = Curl_alpn_to_proto_buf(&proto, connssl->alpn);
- if(result) {
- failf(data, "Error setting ALPN");
- return CURLE_SSL_CONNECT_ERROR;
- }
- memcpy(&alpn_buffer[cur], proto.data, proto.len);
- cur += proto.len;
- *list_len = curlx_uitous(cur - list_start_index);
- *extension_len = (unsigned int)(*list_len +
- sizeof(unsigned int) + sizeof(unsigned short));
- InitSecBuffer(&inbuf, SECBUFFER_APPLICATION_PROTOCOLS, alpn_buffer, cur);
- InitSecBufferDesc(&inbuf_desc, &inbuf, 1);
- Curl_alpn_to_proto_str(&proto, connssl->alpn);
- infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
- }
- else {
- InitSecBuffer(&inbuf, SECBUFFER_EMPTY, NULL, 0);
- InitSecBufferDesc(&inbuf_desc, &inbuf, 1);
- }
- #else
- InitSecBuffer(&inbuf, SECBUFFER_EMPTY, NULL, 0);
- InitSecBufferDesc(&inbuf_desc, &inbuf, 1);
- #endif
-
- InitSecBuffer(&outbuf, SECBUFFER_EMPTY, NULL, 0);
- InitSecBufferDesc(&outbuf_desc, &outbuf, 1);
-
- backend->req_flags = ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT |
- ISC_REQ_CONFIDENTIALITY | ISC_REQ_ALLOCATE_MEMORY |
- ISC_REQ_STREAM;
- if(!ssl_config->auto_client_cert) {
- backend->req_flags |= ISC_REQ_USE_SUPPLIED_CREDS;
- }
-
- backend->ctxt = (struct Curl_schannel_ctxt *)
- calloc(1, sizeof(struct Curl_schannel_ctxt));
- if(!backend->ctxt) {
- failf(data, "schannel: unable to allocate memory");
- return CURLE_OUT_OF_MEMORY;
- }
-
- sspi_status = Curl_pSecFn->InitializeSecurityContext(
- &backend->cred->cred_handle, NULL, backend->cred->sni_hostname,
- backend->req_flags, 0, 0,
- (backend->use_alpn ? &inbuf_desc : NULL),
- 0, &backend->ctxt->ctxt_handle,
- &outbuf_desc, &backend->ret_flags, &backend->ctxt->time_stamp);
- if(sspi_status != SEC_I_CONTINUE_NEEDED) {
- char buffer[STRERROR_LEN];
- Curl_safefree(backend->ctxt);
- switch(sspi_status) {
- case SEC_E_INSUFFICIENT_MEMORY:
- failf(data, "schannel: initial InitializeSecurityContext failed: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- return CURLE_OUT_OF_MEMORY;
- case SEC_E_WRONG_PRINCIPAL:
- failf(data, "schannel: SNI or certificate check failed: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- return CURLE_PEER_FAILED_VERIFICATION;
-
- default:
- failf(data, "schannel: initial InitializeSecurityContext failed: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- return CURLE_SSL_CONNECT_ERROR;
- }
- }
- DEBUGF(infof(data, "schannel: sending initial handshake data: "
- "sending %lu bytes.", outbuf.cbBuffer));
-
- written = Curl_conn_cf_send(cf->next, data,
- outbuf.pvBuffer, outbuf.cbBuffer, FALSE,
- &result);
- Curl_pSecFn->FreeContextBuffer(outbuf.pvBuffer);
- if((result != CURLE_OK) || (outbuf.cbBuffer != (size_t) written)) {
- failf(data, "schannel: failed to send initial handshake data: "
- "sent %zd of %lu bytes", written, outbuf.cbBuffer);
- return CURLE_SSL_CONNECT_ERROR;
- }
- DEBUGF(infof(data, "schannel: sent initial handshake data: "
- "sent %zd bytes", written));
- backend->recv_unrecoverable_err = CURLE_OK;
- backend->recv_sspi_close_notify = FALSE;
- backend->recv_connection_closed = FALSE;
- backend->recv_renegotiating = FALSE;
- backend->encdata_is_incomplete = FALSE;
-
- connssl->connecting_state = ssl_connect_2;
- return CURLE_OK;
- }
- static CURLcode
- schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- int i;
- ssize_t nread = -1, written = -1;
- unsigned char *reallocated_buffer;
- SecBuffer outbuf[3];
- SecBufferDesc outbuf_desc;
- SecBuffer inbuf[2];
- SecBufferDesc inbuf_desc;
- SECURITY_STATUS sspi_status = SEC_E_OK;
- CURLcode result;
- bool doread;
- const char *pubkey_ptr;
- DEBUGASSERT(backend);
- doread = (connssl->io_need & CURL_SSL_IO_NEED_SEND) ? FALSE : TRUE;
- connssl->io_need = CURL_SSL_IO_NEED_NONE;
- DEBUGF(infof(data,
- "schannel: SSL/TLS connection with %s port %d (step 2/3)",
- connssl->peer.hostname, connssl->peer.port));
- if(!backend->cred || !backend->ctxt)
- return CURLE_SSL_CONNECT_ERROR;
-
- if(!backend->decdata_buffer) {
- backend->decdata_offset = 0;
- backend->decdata_length = CURL_SCHANNEL_BUFFER_INIT_SIZE;
- backend->decdata_buffer = malloc(backend->decdata_length);
- if(!backend->decdata_buffer) {
- failf(data, "schannel: unable to allocate memory");
- return CURLE_OUT_OF_MEMORY;
- }
- }
-
- if(!backend->encdata_buffer) {
- backend->encdata_is_incomplete = FALSE;
- backend->encdata_offset = 0;
- backend->encdata_length = CURL_SCHANNEL_BUFFER_INIT_SIZE;
- backend->encdata_buffer = malloc(backend->encdata_length);
- if(!backend->encdata_buffer) {
- failf(data, "schannel: unable to allocate memory");
- return CURLE_OUT_OF_MEMORY;
- }
- }
-
- if(backend->encdata_length - backend->encdata_offset <
- CURL_SCHANNEL_BUFFER_FREE_SIZE) {
-
- size_t reallocated_length = backend->encdata_offset +
- CURL_SCHANNEL_BUFFER_FREE_SIZE;
- reallocated_buffer = realloc(backend->encdata_buffer,
- reallocated_length);
- if(!reallocated_buffer) {
- failf(data, "schannel: unable to re-allocate memory");
- return CURLE_OUT_OF_MEMORY;
- }
- else {
- backend->encdata_buffer = reallocated_buffer;
- backend->encdata_length = reallocated_length;
- }
- }
- for(;;) {
- if(doread) {
-
- nread = Curl_conn_cf_recv(cf->next, data,
- (char *) (backend->encdata_buffer +
- backend->encdata_offset),
- backend->encdata_length -
- backend->encdata_offset,
- &result);
- if(result == CURLE_AGAIN) {
- connssl->io_need = CURL_SSL_IO_NEED_RECV;
- DEBUGF(infof(data, "schannel: failed to receive handshake, "
- "need more data"));
- return CURLE_OK;
- }
- else if((result != CURLE_OK) || (nread == 0)) {
- failf(data, "schannel: failed to receive handshake, "
- "SSL/TLS connection failed");
- return CURLE_SSL_CONNECT_ERROR;
- }
-
- backend->encdata_offset += nread;
- backend->encdata_is_incomplete = FALSE;
- SCH_DEV(infof(data, "schannel: encrypted data got %zd", nread));
- }
- SCH_DEV(infof(data,
- "schannel: encrypted data buffer: offset %zu length %zu",
- backend->encdata_offset, backend->encdata_length));
-
- InitSecBuffer(&inbuf[0], SECBUFFER_TOKEN, malloc(backend->encdata_offset),
- curlx_uztoul(backend->encdata_offset));
- InitSecBuffer(&inbuf[1], SECBUFFER_EMPTY, NULL, 0);
- InitSecBufferDesc(&inbuf_desc, inbuf, 2);
-
- InitSecBuffer(&outbuf[0], SECBUFFER_TOKEN, NULL, 0);
- InitSecBuffer(&outbuf[1], SECBUFFER_ALERT, NULL, 0);
- InitSecBuffer(&outbuf[2], SECBUFFER_EMPTY, NULL, 0);
- InitSecBufferDesc(&outbuf_desc, outbuf, 3);
- if(!inbuf[0].pvBuffer) {
- failf(data, "schannel: unable to allocate memory");
- return CURLE_OUT_OF_MEMORY;
- }
-
- memcpy(inbuf[0].pvBuffer, backend->encdata_buffer,
- backend->encdata_offset);
- sspi_status = Curl_pSecFn->InitializeSecurityContext(
- &backend->cred->cred_handle, &backend->ctxt->ctxt_handle,
- backend->cred->sni_hostname, backend->req_flags,
- 0, 0, &inbuf_desc, 0, NULL,
- &outbuf_desc, &backend->ret_flags, &backend->ctxt->time_stamp);
-
- Curl_safefree(inbuf[0].pvBuffer);
-
- if(sspi_status == SEC_E_INCOMPLETE_MESSAGE) {
- backend->encdata_is_incomplete = TRUE;
- connssl->io_need = CURL_SSL_IO_NEED_RECV;
- DEBUGF(infof(data,
- "schannel: received incomplete message, need more data"));
- return CURLE_OK;
- }
-
- if(sspi_status == SEC_I_INCOMPLETE_CREDENTIALS &&
- !(backend->req_flags & ISC_REQ_USE_SUPPLIED_CREDS)) {
- backend->req_flags |= ISC_REQ_USE_SUPPLIED_CREDS;
- connssl->io_need = CURL_SSL_IO_NEED_SEND;
- DEBUGF(infof(data,
- "schannel: a client certificate has been requested"));
- return CURLE_OK;
- }
-
- if(sspi_status == SEC_I_CONTINUE_NEEDED || sspi_status == SEC_E_OK) {
- for(i = 0; i < 3; i++) {
-
- if(outbuf[i].BufferType == SECBUFFER_TOKEN && outbuf[i].cbBuffer > 0) {
- DEBUGF(infof(data, "schannel: sending next handshake data: "
- "sending %lu bytes.", outbuf[i].cbBuffer));
-
- written = Curl_conn_cf_send(cf->next, data,
- outbuf[i].pvBuffer, outbuf[i].cbBuffer,
- FALSE, &result);
- if((result != CURLE_OK) ||
- (outbuf[i].cbBuffer != (size_t) written)) {
- failf(data, "schannel: failed to send next handshake data: "
- "sent %zd of %lu bytes", written, outbuf[i].cbBuffer);
- return CURLE_SSL_CONNECT_ERROR;
- }
- }
-
- if(outbuf[i].pvBuffer) {
- Curl_pSecFn->FreeContextBuffer(outbuf[i].pvBuffer);
- }
- }
- }
- else {
- char buffer[STRERROR_LEN];
- switch(sspi_status) {
- case SEC_E_INSUFFICIENT_MEMORY:
- failf(data, "schannel: next InitializeSecurityContext failed: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- return CURLE_OUT_OF_MEMORY;
- case SEC_E_WRONG_PRINCIPAL:
- failf(data, "schannel: SNI or certificate check failed: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- return CURLE_PEER_FAILED_VERIFICATION;
- case SEC_E_UNTRUSTED_ROOT:
- failf(data, "schannel: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- return CURLE_PEER_FAILED_VERIFICATION;
-
- default:
- failf(data, "schannel: next InitializeSecurityContext failed: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- return CURLE_SSL_CONNECT_ERROR;
- }
- }
-
- if(inbuf[1].BufferType == SECBUFFER_EXTRA && inbuf[1].cbBuffer > 0) {
- SCH_DEV(infof(data, "schannel: encrypted data length: %lu",
- inbuf[1].cbBuffer));
-
-
- if(backend->encdata_offset > inbuf[1].cbBuffer) {
- memmove(backend->encdata_buffer,
- (backend->encdata_buffer + backend->encdata_offset) -
- inbuf[1].cbBuffer, inbuf[1].cbBuffer);
- backend->encdata_offset = inbuf[1].cbBuffer;
- if(sspi_status == SEC_I_CONTINUE_NEEDED) {
- doread = FALSE;
- continue;
- }
- }
- }
- else {
- backend->encdata_offset = 0;
- }
- break;
- }
-
- if(sspi_status == SEC_I_CONTINUE_NEEDED) {
- connssl->io_need = CURL_SSL_IO_NEED_RECV;
- return CURLE_OK;
- }
-
- if(sspi_status == SEC_E_OK) {
- connssl->connecting_state = ssl_connect_3;
- DEBUGF(infof(data, "schannel: SSL/TLS handshake complete"));
- }
- #ifndef CURL_DISABLE_PROXY
- pubkey_ptr = Curl_ssl_cf_is_proxy(cf) ?
- data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
- #else
- pubkey_ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
- #endif
- if(pubkey_ptr) {
- result = schannel_pkp_pin_peer_pubkey(cf, data, pubkey_ptr);
- if(result) {
- failf(data, "SSL: public key does not match pinned public key");
- return result;
- }
- }
- #ifdef HAS_MANUAL_VERIFY_API
- if(conn_config->verifypeer && backend->use_manual_cred_validation) {
-
- return Curl_verify_certificate(cf, data);
- }
- #endif
-
- if(!conn_config->verifypeer && conn_config->verifyhost)
- return Curl_verify_host(cf, data);
- return CURLE_OK;
- }
- static bool
- valid_cert_encoding(const CERT_CONTEXT *cert_context)
- {
- return (cert_context != NULL) &&
- ((cert_context->dwCertEncodingType & X509_ASN_ENCODING) != 0) &&
- (cert_context->pbCertEncoded != NULL) &&
- (cert_context->cbCertEncoded > 0);
- }
- typedef bool(*Read_crt_func)(const CERT_CONTEXT *ccert_context,
- bool reverse_order, void *arg);
- static void
- traverse_cert_store(const CERT_CONTEXT *context, Read_crt_func func,
- void *arg)
- {
- const CERT_CONTEXT *current_context = NULL;
- bool should_continue = TRUE;
- bool first = TRUE;
- bool reverse_order = FALSE;
- while(should_continue &&
- (current_context = CertEnumCertificatesInStore(
- context->hCertStore,
- current_context)) != NULL) {
-
- if(first && context->pbCertEncoded != current_context->pbCertEncoded)
- reverse_order = TRUE;
- should_continue = func(current_context, reverse_order, arg);
- first = FALSE;
- }
- if(current_context)
- CertFreeCertificateContext(current_context);
- }
- static bool
- cert_counter_callback(const CERT_CONTEXT *ccert_context, bool reverse_order,
- void *certs_count)
- {
- (void)reverse_order;
- if(valid_cert_encoding(ccert_context))
- (*(int *)certs_count)++;
- return TRUE;
- }
- struct Adder_args
- {
- struct Curl_easy *data;
- CURLcode result;
- int idx;
- int certs_count;
- };
- static bool
- add_cert_to_certinfo(const CERT_CONTEXT *ccert_context, bool reverse_order,
- void *raw_arg)
- {
- struct Adder_args *args = (struct Adder_args*)raw_arg;
- args->result = CURLE_OK;
- if(valid_cert_encoding(ccert_context)) {
- const char *beg = (const char *) ccert_context->pbCertEncoded;
- const char *end = beg + ccert_context->cbCertEncoded;
- int insert_index = reverse_order ? (args->certs_count - 1) - args->idx :
- args->idx;
- args->result = Curl_extract_certinfo(args->data, insert_index,
- beg, end);
- args->idx++;
- }
- return args->result == CURLE_OK;
- }
- static void schannel_session_free(void *sessionid, size_t idsize)
- {
-
- struct Curl_schannel_cred *cred = sessionid;
- (void)idsize;
- if(cred) {
- cred->refcount--;
- if(cred->refcount == 0) {
- Curl_pSecFn->FreeCredentialsHandle(&cred->cred_handle);
- curlx_unicodefree(cred->sni_hostname);
- #ifdef HAS_CLIENT_CERT_PATH
- if(cred->client_cert_store) {
- CertCloseStore(cred->client_cert_store, 0);
- cred->client_cert_store = NULL;
- }
- #endif
- Curl_safefree(cred);
- }
- }
- }
- static CURLcode
- schannel_connect_step3(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
- CURLcode result = CURLE_OK;
- SECURITY_STATUS sspi_status = SEC_E_OK;
- CERT_CONTEXT *ccert_context = NULL;
- #ifdef HAS_ALPN
- SecPkgContext_ApplicationProtocol alpn_result;
- #endif
- DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
- DEBUGASSERT(backend);
- DEBUGF(infof(data,
- "schannel: SSL/TLS connection with %s port %d (step 3/3)",
- connssl->peer.hostname, connssl->peer.port));
- if(!backend->cred)
- return CURLE_SSL_CONNECT_ERROR;
-
- if(backend->ret_flags != backend->req_flags) {
- if(!(backend->ret_flags & ISC_RET_SEQUENCE_DETECT))
- failf(data, "schannel: failed to setup sequence detection");
- if(!(backend->ret_flags & ISC_RET_REPLAY_DETECT))
- failf(data, "schannel: failed to setup replay detection");
- if(!(backend->ret_flags & ISC_RET_CONFIDENTIALITY))
- failf(data, "schannel: failed to setup confidentiality");
- if(!(backend->ret_flags & ISC_RET_ALLOCATED_MEMORY))
- failf(data, "schannel: failed to setup memory allocation");
- if(!(backend->ret_flags & ISC_RET_STREAM))
- failf(data, "schannel: failed to setup stream orientation");
- return CURLE_SSL_CONNECT_ERROR;
- }
- #ifdef HAS_ALPN
- if(backend->use_alpn) {
- sspi_status =
- Curl_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
- SECPKG_ATTR_APPLICATION_PROTOCOL,
- &alpn_result);
- if(sspi_status != SEC_E_OK) {
- failf(data, "schannel: failed to retrieve ALPN result");
- return CURLE_SSL_CONNECT_ERROR;
- }
- if(alpn_result.ProtoNegoStatus ==
- SecApplicationProtocolNegotiationStatus_Success) {
- unsigned char prev_alpn = cf->conn->alpn;
- Curl_alpn_set_negotiated(cf, data, connssl, alpn_result.ProtocolId,
- alpn_result.ProtocolIdSize);
- if(backend->recv_renegotiating) {
- if(prev_alpn != cf->conn->alpn &&
- prev_alpn != CURL_HTTP_VERSION_NONE) {
-
- failf(data, "schannel: server selected an ALPN protocol too late");
- return CURLE_SSL_CONNECT_ERROR;
- }
- }
- }
- else {
- if(!backend->recv_renegotiating)
- Curl_alpn_set_negotiated(cf, data, connssl, NULL, 0);
- }
- }
- #endif
-
- if(ssl_config->primary.cache_session) {
- Curl_ssl_sessionid_lock(data);
-
- backend->cred->refcount++;
- result = Curl_ssl_set_sessionid(cf, data, &connssl->peer, NULL,
- backend->cred,
- sizeof(struct Curl_schannel_cred),
- schannel_session_free);
- Curl_ssl_sessionid_unlock(data);
- if(result)
- return result;
- }
- if(data->set.ssl.certinfo) {
- int certs_count = 0;
- sspi_status =
- Curl_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
- SECPKG_ATTR_REMOTE_CERT_CONTEXT,
- &ccert_context);
- if((sspi_status != SEC_E_OK) || !ccert_context) {
- failf(data, "schannel: failed to retrieve remote cert context");
- return CURLE_PEER_FAILED_VERIFICATION;
- }
- traverse_cert_store(ccert_context, cert_counter_callback, &certs_count);
- result = Curl_ssl_init_certinfo(data, certs_count);
- if(!result) {
- struct Adder_args args;
- args.data = data;
- args.idx = 0;
- args.certs_count = certs_count;
- traverse_cert_store(ccert_context, add_cert_to_certinfo, &args);
- result = args.result;
- }
- CertFreeCertificateContext(ccert_context);
- if(result)
- return result;
- }
- connssl->connecting_state = ssl_connect_done;
- return CURLE_OK;
- }
- static CURLcode
- schannel_connect_common(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool nonblocking, bool *done)
- {
- CURLcode result;
- struct ssl_connect_data *connssl = cf->ctx;
- curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
- timediff_t timeout_ms;
- int what;
-
- if(ssl_connection_complete == connssl->state) {
- *done = TRUE;
- return CURLE_OK;
- }
- if(ssl_connect_1 == connssl->connecting_state) {
-
- timeout_ms = Curl_timeleft(data, NULL, TRUE);
- if(timeout_ms < 0) {
-
- failf(data, "SSL/TLS connection timeout");
- return CURLE_OPERATION_TIMEDOUT;
- }
- result = schannel_connect_step1(cf, data);
- if(result)
- return result;
- }
- while(ssl_connect_2 == connssl->connecting_state) {
-
- timeout_ms = Curl_timeleft(data, NULL, TRUE);
- if(timeout_ms < 0) {
-
- failf(data, "SSL/TLS connection timeout");
- return CURLE_OPERATION_TIMEDOUT;
- }
-
- if(connssl->io_need) {
- curl_socket_t writefd = (connssl->io_need & CURL_SSL_IO_NEED_SEND) ?
- sockfd : CURL_SOCKET_BAD;
- curl_socket_t readfd = (connssl->io_need & CURL_SSL_IO_NEED_RECV) ?
- sockfd : CURL_SOCKET_BAD;
- what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
- nonblocking ? 0 : timeout_ms);
- if(what < 0) {
-
- failf(data, "select/poll on SSL/TLS socket, errno: %d", SOCKERRNO);
- return CURLE_SSL_CONNECT_ERROR;
- }
- else if(0 == what) {
- if(nonblocking) {
- *done = FALSE;
- return CURLE_OK;
- }
- else {
-
- failf(data, "SSL/TLS connection timeout");
- return CURLE_OPERATION_TIMEDOUT;
- }
- }
-
- }
-
- result = schannel_connect_step2(cf, data);
- if(result || (nonblocking && (ssl_connect_2 == connssl->connecting_state)))
- return result;
- }
- if(ssl_connect_3 == connssl->connecting_state) {
- result = schannel_connect_step3(cf, data);
- if(result)
- return result;
- }
- if(ssl_connect_done == connssl->connecting_state) {
- connssl->state = ssl_connection_complete;
- #ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
-
- {
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- DEBUGASSERT(backend);
- cf->conn->sslContext = &backend->ctxt->ctxt_handle;
- }
- #endif
- *done = TRUE;
- }
- else
- *done = FALSE;
-
- connssl->connecting_state = ssl_connect_1;
- return CURLE_OK;
- }
- static ssize_t
- schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
- const void *buf, size_t len, CURLcode *err)
- {
- ssize_t written = -1;
- size_t data_len = 0;
- unsigned char *ptr = NULL;
- struct ssl_connect_data *connssl = cf->ctx;
- SecBuffer outbuf[4];
- SecBufferDesc outbuf_desc;
- SECURITY_STATUS sspi_status = SEC_E_OK;
- CURLcode result;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- DEBUGASSERT(backend);
-
- if(backend->stream_sizes.cbMaximumMessage == 0) {
- sspi_status = Curl_pSecFn->QueryContextAttributes(
- &backend->ctxt->ctxt_handle,
- SECPKG_ATTR_STREAM_SIZES,
- &backend->stream_sizes);
- if(sspi_status != SEC_E_OK) {
- *err = CURLE_SEND_ERROR;
- return -1;
- }
- }
-
- if(len > backend->stream_sizes.cbMaximumMessage) {
- len = backend->stream_sizes.cbMaximumMessage;
- }
-
- data_len = backend->stream_sizes.cbHeader + len +
- backend->stream_sizes.cbTrailer;
- ptr = (unsigned char *) malloc(data_len);
- if(!ptr) {
- *err = CURLE_OUT_OF_MEMORY;
- return -1;
- }
-
- InitSecBuffer(&outbuf[0], SECBUFFER_STREAM_HEADER,
- ptr, backend->stream_sizes.cbHeader);
- InitSecBuffer(&outbuf[1], SECBUFFER_DATA,
- ptr + backend->stream_sizes.cbHeader, curlx_uztoul(len));
- InitSecBuffer(&outbuf[2], SECBUFFER_STREAM_TRAILER,
- ptr + backend->stream_sizes.cbHeader + len,
- backend->stream_sizes.cbTrailer);
- InitSecBuffer(&outbuf[3], SECBUFFER_EMPTY, NULL, 0);
- InitSecBufferDesc(&outbuf_desc, outbuf, 4);
-
- memcpy(outbuf[1].pvBuffer, buf, len);
-
- sspi_status = Curl_pSecFn->EncryptMessage(&backend->ctxt->ctxt_handle, 0,
- &outbuf_desc, 0);
-
- if(sspi_status == SEC_E_OK) {
- written = 0;
-
- len = outbuf[0].cbBuffer + outbuf[1].cbBuffer + outbuf[2].cbBuffer;
-
-
- while(len > (size_t)written) {
- ssize_t this_write = 0;
- int what;
- timediff_t timeout_ms = Curl_timeleft(data, NULL, FALSE);
- if(timeout_ms < 0) {
-
- failf(data, "schannel: timed out sending data "
- "(bytes sent: %zd)", written);
- *err = CURLE_OPERATION_TIMEDOUT;
- written = -1;
- break;
- }
- else if(!timeout_ms)
- timeout_ms = TIMEDIFF_T_MAX;
- what = SOCKET_WRITABLE(Curl_conn_cf_get_socket(cf, data), timeout_ms);
- if(what < 0) {
-
- failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
- *err = CURLE_SEND_ERROR;
- written = -1;
- break;
- }
- else if(0 == what) {
- failf(data, "schannel: timed out sending data "
- "(bytes sent: %zd)", written);
- *err = CURLE_OPERATION_TIMEDOUT;
- written = -1;
- break;
- }
-
- this_write = Curl_conn_cf_send(cf->next, data,
- ptr + written, len - written,
- FALSE, &result);
- if(result == CURLE_AGAIN)
- continue;
- else if(result != CURLE_OK) {
- *err = result;
- written = -1;
- break;
- }
- written += this_write;
- }
- }
- else if(sspi_status == SEC_E_INSUFFICIENT_MEMORY) {
- *err = CURLE_OUT_OF_MEMORY;
- }
- else{
- *err = CURLE_SEND_ERROR;
- }
- Curl_safefree(ptr);
- if(len == (size_t)written)
-
- written = outbuf[1].cbBuffer;
- return written;
- }
- static ssize_t
- schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
- char *buf, size_t len, CURLcode *err)
- {
- size_t size = 0;
- ssize_t nread = -1;
- struct ssl_connect_data *connssl = cf->ctx;
- unsigned char *reallocated_buffer;
- size_t reallocated_length;
- bool done = FALSE;
- SecBuffer inbuf[4];
- SecBufferDesc inbuf_desc;
- SECURITY_STATUS sspi_status = SEC_E_OK;
-
- size_t min_encdata_length = len + CURL_SCHANNEL_BUFFER_FREE_SIZE;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- DEBUGASSERT(backend);
-
- SCH_DEV(infof(data, "schannel: client wants to read %zu bytes", len));
- *err = CURLE_OK;
- if(len && len <= backend->decdata_offset) {
- SCH_DEV(infof(data,
- "schannel: enough decrypted data is already available"));
- goto cleanup;
- }
- else if(backend->recv_unrecoverable_err) {
- *err = backend->recv_unrecoverable_err;
- infof(data, "schannel: an unrecoverable error occurred in a prior call");
- goto cleanup;
- }
- else if(backend->recv_sspi_close_notify) {
-
- infof(data, "schannel: server indicated shutdown in a prior call");
- goto cleanup;
- }
-
- else if(len && !backend->recv_connection_closed) {
-
- size = backend->encdata_length - backend->encdata_offset;
- if(size < CURL_SCHANNEL_BUFFER_FREE_SIZE ||
- backend->encdata_length < min_encdata_length) {
- reallocated_length = backend->encdata_offset +
- CURL_SCHANNEL_BUFFER_FREE_SIZE;
- if(reallocated_length < min_encdata_length) {
- reallocated_length = min_encdata_length;
- }
- reallocated_buffer = realloc(backend->encdata_buffer,
- reallocated_length);
- if(!reallocated_buffer) {
- *err = CURLE_OUT_OF_MEMORY;
- failf(data, "schannel: unable to re-allocate memory");
- goto cleanup;
- }
- backend->encdata_buffer = reallocated_buffer;
- backend->encdata_length = reallocated_length;
- size = backend->encdata_length - backend->encdata_offset;
- SCH_DEV(infof(data, "schannel: encdata_buffer resized %zu",
- backend->encdata_length));
- }
- SCH_DEV(infof(data,
- "schannel: encrypted data buffer: offset %zu length %zu",
- backend->encdata_offset, backend->encdata_length));
-
- nread = Curl_conn_cf_recv(cf->next, data,
- (char *)(backend->encdata_buffer +
- backend->encdata_offset),
- size, err);
- if(*err) {
- nread = -1;
- if(*err == CURLE_AGAIN)
- SCH_DEV(infof(data, "schannel: recv returned CURLE_AGAIN"));
- else if(*err == CURLE_RECV_ERROR)
- infof(data, "schannel: recv returned CURLE_RECV_ERROR");
- else
- infof(data, "schannel: recv returned error %d", *err);
- }
- else if(nread == 0) {
- backend->recv_connection_closed = TRUE;
- DEBUGF(infof(data, "schannel: server closed the connection"));
- }
- else if(nread > 0) {
- backend->encdata_offset += (size_t)nread;
- backend->encdata_is_incomplete = FALSE;
- SCH_DEV(infof(data, "schannel: encrypted data got %zd", nread));
- }
- }
- SCH_DEV(infof(data, "schannel: encrypted data buffer: offset %zu length %zu",
- backend->encdata_offset, backend->encdata_length));
-
- while(backend->encdata_offset > 0 && sspi_status == SEC_E_OK &&
- (!len || backend->decdata_offset < len ||
- backend->recv_connection_closed)) {
-
- InitSecBuffer(&inbuf[0], SECBUFFER_DATA, backend->encdata_buffer,
- curlx_uztoul(backend->encdata_offset));
-
- InitSecBuffer(&inbuf[1], SECBUFFER_EMPTY, NULL, 0);
- InitSecBuffer(&inbuf[2], SECBUFFER_EMPTY, NULL, 0);
- InitSecBuffer(&inbuf[3], SECBUFFER_EMPTY, NULL, 0);
- InitSecBufferDesc(&inbuf_desc, inbuf, 4);
-
- sspi_status = Curl_pSecFn->DecryptMessage(&backend->ctxt->ctxt_handle,
- &inbuf_desc, 0, NULL);
-
- if(sspi_status == SEC_E_OK || sspi_status == SEC_I_RENEGOTIATE ||
- sspi_status == SEC_I_CONTEXT_EXPIRED) {
-
- if(inbuf[1].BufferType == SECBUFFER_DATA) {
- SCH_DEV(infof(data, "schannel: decrypted data length: %lu",
- inbuf[1].cbBuffer));
-
- size = inbuf[1].cbBuffer > CURL_SCHANNEL_BUFFER_FREE_SIZE ?
- inbuf[1].cbBuffer : CURL_SCHANNEL_BUFFER_FREE_SIZE;
- if(backend->decdata_length - backend->decdata_offset < size ||
- backend->decdata_length < len) {
-
- reallocated_length = backend->decdata_offset + size;
-
- if(reallocated_length < len) {
- reallocated_length = len;
- }
- reallocated_buffer = realloc(backend->decdata_buffer,
- reallocated_length);
- if(!reallocated_buffer) {
- *err = CURLE_OUT_OF_MEMORY;
- failf(data, "schannel: unable to re-allocate memory");
- goto cleanup;
- }
- backend->decdata_buffer = reallocated_buffer;
- backend->decdata_length = reallocated_length;
- }
-
- size = inbuf[1].cbBuffer;
- if(size) {
- memcpy(backend->decdata_buffer + backend->decdata_offset,
- inbuf[1].pvBuffer, size);
- backend->decdata_offset += size;
- }
- SCH_DEV(infof(data, "schannel: decrypted data added: %zu", size));
- SCH_DEV(infof(data,
- "schannel: decrypted cached: offset %zu length %zu",
- backend->decdata_offset, backend->decdata_length));
- }
-
- if(inbuf[3].BufferType == SECBUFFER_EXTRA && inbuf[3].cbBuffer > 0) {
- SCH_DEV(infof(data, "schannel: encrypted data length: %lu",
- inbuf[3].cbBuffer));
-
- if(backend->encdata_offset > inbuf[3].cbBuffer) {
-
- memmove(backend->encdata_buffer,
- (backend->encdata_buffer + backend->encdata_offset) -
- inbuf[3].cbBuffer, inbuf[3].cbBuffer);
- backend->encdata_offset = inbuf[3].cbBuffer;
- }
- SCH_DEV(infof(data,
- "schannel: encrypted cached: offset %zu length %zu",
- backend->encdata_offset, backend->encdata_length));
- }
- else {
-
- backend->encdata_offset = 0;
- }
-
- if(sspi_status == SEC_I_RENEGOTIATE) {
- infof(data, "schannel: remote party requests renegotiation");
- if(*err && *err != CURLE_AGAIN) {
- infof(data, "schannel: cannot renegotiate, an error is pending");
- goto cleanup;
- }
-
- infof(data, "schannel: renegotiating SSL/TLS connection");
- connssl->state = ssl_connection_negotiating;
- connssl->connecting_state = ssl_connect_2;
- connssl->io_need = CURL_SSL_IO_NEED_SEND;
- backend->recv_renegotiating = TRUE;
- *err = schannel_connect_common(cf, data, FALSE, &done);
- backend->recv_renegotiating = FALSE;
- if(*err) {
- infof(data, "schannel: renegotiation failed");
- goto cleanup;
- }
-
- sspi_status = SEC_E_OK;
- infof(data, "schannel: SSL/TLS connection renegotiated");
- continue;
- }
-
- else if(sspi_status == SEC_I_CONTEXT_EXPIRED) {
-
- backend->recv_sspi_close_notify = TRUE;
- if(!backend->recv_connection_closed)
- backend->recv_connection_closed = TRUE;
-
- if(*err == CURLE_RECV_ERROR)
- *err = CURLE_OK;
- infof(data,
- "schannel: server close notification received (close_notify)");
- goto cleanup;
- }
- }
- else if(sspi_status == SEC_E_INCOMPLETE_MESSAGE) {
- backend->encdata_is_incomplete = TRUE;
- if(!*err)
- *err = CURLE_AGAIN;
- SCH_DEV(infof(data, "schannel: failed to decrypt data, need more data"));
- goto cleanup;
- }
- else {
- #ifndef CURL_DISABLE_VERBOSE_STRINGS
- char buffer[STRERROR_LEN];
- failf(data, "schannel: failed to read data from server: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- #endif
- *err = CURLE_RECV_ERROR;
- goto cleanup;
- }
- }
- SCH_DEV(infof(data, "schannel: encrypted data buffer: offset %zu length %zu",
- backend->encdata_offset, backend->encdata_length));
- SCH_DEV(infof(data, "schannel: decrypted data buffer: offset %zu length %zu",
- backend->decdata_offset, backend->decdata_length));
- cleanup:
-
- SCH_DEV(infof(data, "schannel: schannel_recv cleanup"));
-
- if(len && !backend->decdata_offset && backend->recv_connection_closed &&
- !backend->recv_sspi_close_notify) {
- bool isWin2k = curlx_verify_windows_version(5, 0, 0, PLATFORM_WINNT,
- VERSION_EQUAL);
- if(isWin2k && sspi_status == SEC_E_OK)
- backend->recv_sspi_close_notify = TRUE;
- else {
- *err = CURLE_RECV_ERROR;
- failf(data, "schannel: server closed abruptly (missing close_notify)");
- }
- }
-
- if(*err && *err != CURLE_AGAIN)
- backend->recv_unrecoverable_err = *err;
- size = len < backend->decdata_offset ? len : backend->decdata_offset;
- if(size) {
- memcpy(buf, backend->decdata_buffer, size);
- memmove(backend->decdata_buffer, backend->decdata_buffer + size,
- backend->decdata_offset - size);
- backend->decdata_offset -= size;
- SCH_DEV(infof(data, "schannel: decrypted data returned %zu", size));
- SCH_DEV(infof(data,
- "schannel: decrypted data buffer: offset %zu length %zu",
- backend->decdata_offset, backend->decdata_length));
- *err = CURLE_OK;
- return (ssize_t)size;
- }
- if(!*err && !backend->recv_connection_closed)
- *err = CURLE_AGAIN;
-
- if(!len)
- *err = CURLE_OK;
- return *err ? -1 : 0;
- }
- static CURLcode schannel_connect_nonblocking(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool *done)
- {
- return schannel_connect_common(cf, data, TRUE, done);
- }
- static CURLcode schannel_connect(struct Curl_cfilter *cf,
- struct Curl_easy *data)
- {
- CURLcode result;
- bool done = FALSE;
- result = schannel_connect_common(cf, data, FALSE, &done);
- if(result)
- return result;
- DEBUGASSERT(done);
- return CURLE_OK;
- }
- static bool schannel_data_pending(struct Curl_cfilter *cf,
- const struct Curl_easy *data)
- {
- const struct ssl_connect_data *connssl = cf->ctx;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- (void)data;
- DEBUGASSERT(backend);
- if(backend->ctxt)
- return (backend->decdata_offset > 0 ||
- (backend->encdata_offset > 0 && !backend->encdata_is_incomplete) ||
- backend->recv_connection_closed ||
- backend->recv_sspi_close_notify ||
- backend->recv_unrecoverable_err);
- else
- return FALSE;
- }
- static CURLcode schannel_shutdown(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool send_shutdown, bool *done)
- {
-
- struct ssl_connect_data *connssl = cf->ctx;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- CURLcode result = CURLE_OK;
- if(cf->shutdown) {
- *done = TRUE;
- return CURLE_OK;
- }
- DEBUGASSERT(data);
- DEBUGASSERT(backend);
-
- (void)send_shutdown;
- *done = FALSE;
- if(backend->ctxt) {
- infof(data, "schannel: shutting down SSL/TLS connection with %s port %d",
- connssl->peer.hostname, connssl->peer.port);
- }
- if(!backend->ctxt || cf->shutdown) {
- *done = TRUE;
- goto out;
- }
- if(backend->cred && backend->ctxt && !backend->sent_shutdown) {
- SecBufferDesc BuffDesc;
- SecBuffer Buffer;
- SECURITY_STATUS sspi_status;
- SecBuffer outbuf;
- SecBufferDesc outbuf_desc;
- DWORD dwshut = SCHANNEL_SHUTDOWN;
- InitSecBuffer(&Buffer, SECBUFFER_TOKEN, &dwshut, sizeof(dwshut));
- InitSecBufferDesc(&BuffDesc, &Buffer, 1);
- sspi_status = Curl_pSecFn->ApplyControlToken(&backend->ctxt->ctxt_handle,
- &BuffDesc);
- if(sspi_status != SEC_E_OK) {
- char buffer[STRERROR_LEN];
- failf(data, "schannel: ApplyControlToken failure: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- result = CURLE_SEND_ERROR;
- goto out;
- }
-
- InitSecBuffer(&outbuf, SECBUFFER_EMPTY, NULL, 0);
- InitSecBufferDesc(&outbuf_desc, &outbuf, 1);
- sspi_status = Curl_pSecFn->InitializeSecurityContext(
- &backend->cred->cred_handle,
- &backend->ctxt->ctxt_handle,
- backend->cred->sni_hostname,
- backend->req_flags,
- 0,
- 0,
- NULL,
- 0,
- &backend->ctxt->ctxt_handle,
- &outbuf_desc,
- &backend->ret_flags,
- &backend->ctxt->time_stamp);
- if((sspi_status == SEC_E_OK) || (sspi_status == SEC_I_CONTEXT_EXPIRED)) {
-
- ssize_t written = Curl_conn_cf_send(cf->next, data,
- outbuf.pvBuffer, outbuf.cbBuffer,
- FALSE, &result);
- Curl_pSecFn->FreeContextBuffer(outbuf.pvBuffer);
- if(!result) {
- if(written < (ssize_t)outbuf.cbBuffer) {
-
- failf(data, "schannel: failed to send close msg: %s"
- " (bytes written: %zd)", curl_easy_strerror(result), written);
- result = CURLE_SEND_ERROR;
- goto out;
- }
- backend->sent_shutdown = TRUE;
- *done = TRUE;
- }
- else if(result == CURLE_AGAIN) {
- connssl->io_need = CURL_SSL_IO_NEED_SEND;
- result = CURLE_OK;
- goto out;
- }
- else {
- if(!backend->recv_connection_closed) {
- failf(data, "schannel: error sending close msg: %d", result);
- result = CURLE_SEND_ERROR;
- goto out;
- }
-
- *done = TRUE;
- result = CURLE_OK;
- }
- }
- }
-
- if(backend->cred && backend->ctxt &&
- !backend->recv_sspi_close_notify && !backend->recv_connection_closed) {
- char buffer[1024];
- ssize_t nread;
- nread = schannel_recv(cf, data, buffer, sizeof(buffer), &result);
- if(nread > 0) {
-
- }
- else if(nread == 0) {
-
- backend->recv_connection_closed = TRUE;
- *done = TRUE;
- }
- else if(nread < 0 && result == CURLE_AGAIN) {
- connssl->io_need = CURL_SSL_IO_NEED_RECV;
- }
- else {
- CURL_TRC_CF(data, cf, "SSL shutdown, error %d", result);
- result = CURLE_RECV_ERROR;
- }
- }
- out:
- cf->shutdown = (result || *done);
- return result;
- }
- static void schannel_close(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- DEBUGASSERT(data);
- DEBUGASSERT(backend);
-
- if(backend->ctxt) {
- DEBUGF(infof(data, "schannel: clear security context handle"));
- Curl_pSecFn->DeleteSecurityContext(&backend->ctxt->ctxt_handle);
- Curl_safefree(backend->ctxt);
- }
-
- if(backend->cred) {
- Curl_ssl_sessionid_lock(data);
- schannel_session_free(backend->cred, 0);
- Curl_ssl_sessionid_unlock(data);
- backend->cred = NULL;
- }
-
- if(backend->encdata_buffer) {
- Curl_safefree(backend->encdata_buffer);
- backend->encdata_length = 0;
- backend->encdata_offset = 0;
- backend->encdata_is_incomplete = FALSE;
- }
-
- if(backend->decdata_buffer) {
- Curl_safefree(backend->decdata_buffer);
- backend->decdata_length = 0;
- backend->decdata_offset = 0;
- }
- }
- static int schannel_init(void)
- {
- return (Curl_sspi_global_init() == CURLE_OK ? 1 : 0);
- }
- static void schannel_cleanup(void)
- {
- Curl_sspi_global_cleanup();
- }
- static size_t schannel_version(char *buffer, size_t size)
- {
- return msnprintf(buffer, size, "Schannel");
- }
- static CURLcode schannel_random(struct Curl_easy *data UNUSED_PARAM,
- unsigned char *entropy, size_t length)
- {
- (void)data;
- return Curl_win32_random(entropy, length);
- }
- static CURLcode schannel_pkp_pin_peer_pubkey(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- const char *pinnedpubkey)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- CERT_CONTEXT *pCertContextServer = NULL;
-
- CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
- DEBUGASSERT(backend);
-
- if(!pinnedpubkey)
- return CURLE_OK;
- do {
- SECURITY_STATUS sspi_status;
- const char *x509_der;
- DWORD x509_der_len;
- struct Curl_X509certificate x509_parsed;
- struct Curl_asn1Element *pubkey;
- sspi_status =
- Curl_pSecFn->QueryContextAttributes(&backend->ctxt->ctxt_handle,
- SECPKG_ATTR_REMOTE_CERT_CONTEXT,
- &pCertContextServer);
- if((sspi_status != SEC_E_OK) || !pCertContextServer) {
- char buffer[STRERROR_LEN];
- failf(data, "schannel: Failed to read remote certificate context: %s",
- Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
- break;
- }
- if(!(((pCertContextServer->dwCertEncodingType & X509_ASN_ENCODING) != 0) &&
- (pCertContextServer->cbCertEncoded > 0)))
- break;
- x509_der = (const char *)pCertContextServer->pbCertEncoded;
- x509_der_len = pCertContextServer->cbCertEncoded;
- memset(&x509_parsed, 0, sizeof(x509_parsed));
- if(Curl_parseX509(&x509_parsed, x509_der, x509_der + x509_der_len))
- break;
- pubkey = &x509_parsed.subjectPublicKeyInfo;
- if(!pubkey->header || pubkey->end <= pubkey->header) {
- failf(data, "SSL: failed retrieving public key from server certificate");
- break;
- }
- result = Curl_pin_peer_pubkey(data,
- pinnedpubkey,
- (const unsigned char *)pubkey->header,
- (size_t)(pubkey->end - pubkey->header));
- if(result) {
- failf(data, "SSL: public key does not match pinned public key");
- }
- } while(0);
- if(pCertContextServer)
- CertFreeCertificateContext(pCertContextServer);
- return result;
- }
- static void schannel_checksum(const unsigned char *input,
- size_t inputlen,
- unsigned char *checksum,
- size_t checksumlen,
- DWORD provType,
- const unsigned int algId)
- {
- #ifdef CURL_WINDOWS_UWP
- (void)input;
- (void)inputlen;
- (void)provType;
- (void)algId;
- memset(checksum, 0, checksumlen);
- #else
- HCRYPTPROV hProv = 0;
- HCRYPTHASH hHash = 0;
- DWORD cbHashSize = 0;
- DWORD dwHashSizeLen = (DWORD)sizeof(cbHashSize);
- DWORD dwChecksumLen = (DWORD)checksumlen;
-
- memset(checksum, 0, checksumlen);
- if(!CryptAcquireContext(&hProv, NULL, NULL, provType,
- CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
- return;
- do {
- if(!CryptCreateHash(hProv, algId, 0, 0, &hHash))
- break;
- if(!CryptHashData(hHash, input, (DWORD)inputlen, 0))
- break;
-
- if(!CryptGetHashParam(hHash, HP_HASHSIZE, (BYTE *)&cbHashSize,
- &dwHashSizeLen, 0))
- break;
-
- if(checksumlen < cbHashSize)
- break;
- if(CryptGetHashParam(hHash, HP_HASHVAL, checksum, &dwChecksumLen, 0))
- break;
- } while(0);
- if(hHash)
- CryptDestroyHash(hHash);
- if(hProv)
- CryptReleaseContext(hProv, 0);
- #endif
- }
- static CURLcode schannel_sha256sum(const unsigned char *input,
- size_t inputlen,
- unsigned char *sha256sum,
- size_t sha256len)
- {
- schannel_checksum(input, inputlen, sha256sum, sha256len,
- PROV_RSA_AES, CALG_SHA_256);
- return CURLE_OK;
- }
- static void *schannel_get_internals(struct ssl_connect_data *connssl,
- CURLINFO info UNUSED_PARAM)
- {
- struct schannel_ssl_backend_data *backend =
- (struct schannel_ssl_backend_data *)connssl->backend;
- (void)info;
- DEBUGASSERT(backend);
- return &backend->ctxt->ctxt_handle;
- }
- HCERTSTORE Curl_schannel_get_cached_cert_store(struct Curl_cfilter *cf,
- const struct Curl_easy *data)
- {
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- struct Curl_multi *multi = data->multi;
- const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
- struct schannel_cert_share *share;
- const struct ssl_general_config *cfg = &data->set.general_ssl;
- timediff_t timeout_ms;
- timediff_t elapsed_ms;
- struct curltime now;
- unsigned char info_blob_digest[CURL_SHA256_DIGEST_LENGTH];
- DEBUGASSERT(multi);
- if(!multi) {
- return NULL;
- }
- share = Curl_hash_pick(&multi->proto_hash,
- (void *)MPROTO_SCHANNEL_CERT_SHARE_KEY,
- sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY)-1);
- if(!share || !share->cert_store) {
- return NULL;
- }
-
- if(!cfg->ca_cache_timeout) {
- return NULL;
- }
-
- timeout_ms = cfg->ca_cache_timeout * (timediff_t)1000;
- if(timeout_ms >= 0) {
- now = Curl_now();
- elapsed_ms = Curl_timediff(now, share->time);
- if(elapsed_ms >= timeout_ms) {
- return NULL;
- }
- }
- if(ca_info_blob) {
- if(share->CAinfo_blob_size != ca_info_blob->len) {
- return NULL;
- }
- schannel_sha256sum((const unsigned char *)ca_info_blob->data,
- ca_info_blob->len,
- info_blob_digest,
- CURL_SHA256_DIGEST_LENGTH);
- if(memcmp(share->CAinfo_blob_digest, info_blob_digest,
- CURL_SHA256_DIGEST_LENGTH)) {
- return NULL;
- }
- }
- else {
- if(!conn_config->CAfile || !share->CAfile ||
- strcmp(share->CAfile, conn_config->CAfile)) {
- return NULL;
- }
- }
- return share->cert_store;
- }
- static void schannel_cert_share_free(void *key, size_t key_len, void *p)
- {
- struct schannel_cert_share *share = p;
- DEBUGASSERT(key_len == (sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY)-1));
- DEBUGASSERT(!memcmp(MPROTO_SCHANNEL_CERT_SHARE_KEY, key, key_len));
- (void)key;
- (void)key_len;
- if(share->cert_store) {
- CertCloseStore(share->cert_store, 0);
- }
- free(share->CAfile);
- free(share);
- }
- bool Curl_schannel_set_cached_cert_store(struct Curl_cfilter *cf,
- const struct Curl_easy *data,
- HCERTSTORE cert_store)
- {
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- struct Curl_multi *multi = data->multi;
- const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
- struct schannel_cert_share *share;
- size_t CAinfo_blob_size = 0;
- char *CAfile = NULL;
- DEBUGASSERT(multi);
- if(!multi) {
- return FALSE;
- }
- share = Curl_hash_pick(&multi->proto_hash,
- (void *)MPROTO_SCHANNEL_CERT_SHARE_KEY,
- sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY)-1);
- if(!share) {
- share = calloc(1, sizeof(*share));
- if(!share) {
- return FALSE;
- }
- if(!Curl_hash_add2(&multi->proto_hash,
- (void *)MPROTO_SCHANNEL_CERT_SHARE_KEY,
- sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY)-1,
- share, schannel_cert_share_free)) {
- free(share);
- return FALSE;
- }
- }
- if(ca_info_blob) {
- schannel_sha256sum((const unsigned char *)ca_info_blob->data,
- ca_info_blob->len,
- share->CAinfo_blob_digest,
- CURL_SHA256_DIGEST_LENGTH);
- CAinfo_blob_size = ca_info_blob->len;
- }
- else {
- if(conn_config->CAfile) {
- CAfile = strdup(conn_config->CAfile);
- if(!CAfile) {
- return FALSE;
- }
- }
- }
-
- if(share->cert_store) {
- CertCloseStore(share->cert_store, 0);
- }
- free(share->CAfile);
- share->time = Curl_now();
- share->cert_store = cert_store;
- share->CAinfo_blob_size = CAinfo_blob_size;
- share->CAfile = CAfile;
- return TRUE;
- }
- const struct Curl_ssl Curl_ssl_schannel = {
- { CURLSSLBACKEND_SCHANNEL, "schannel" },
- SSLSUPP_CERTINFO |
- #ifdef HAS_MANUAL_VERIFY_API
- SSLSUPP_CAINFO_BLOB |
- #endif
- #ifndef CURL_WINDOWS_UWP
- SSLSUPP_PINNEDPUBKEY |
- #endif
- SSLSUPP_CA_CACHE |
- SSLSUPP_HTTPS_PROXY |
- SSLSUPP_CIPHER_LIST,
- sizeof(struct schannel_ssl_backend_data),
- schannel_init,
- schannel_cleanup,
- schannel_version,
- Curl_none_check_cxn,
- schannel_shutdown,
- schannel_data_pending,
- schannel_random,
- Curl_none_cert_status_request,
- schannel_connect,
- schannel_connect_nonblocking,
- Curl_ssl_adjust_pollset,
- schannel_get_internals,
- schannel_close,
- Curl_none_close_all,
- Curl_none_set_engine,
- Curl_none_set_engine_default,
- Curl_none_engines_list,
- Curl_none_false_start,
- schannel_sha256sum,
- NULL,
- NULL,
- schannel_recv,
- schannel_send,
- NULL,
- };
- #endif
|