2
0

schannel.h 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198
  1. #ifndef HEADER_CURL_SCHANNEL_H
  2. #define HEADER_CURL_SCHANNEL_H
  3. /***************************************************************************
  4. * _ _ ____ _
  5. * Project ___| | | | _ \| |
  6. * / __| | | | |_) | |
  7. * | (__| |_| | _ <| |___
  8. * \___|\___/|_| \_\_____|
  9. *
  10. * Copyright (C) 2012, Marc Hoersken, <info@marc-hoersken.de>, et al.
  11. * Copyright (C) 2012 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
  12. *
  13. * This software is licensed as described in the file COPYING, which
  14. * you should have received as part of this distribution. The terms
  15. * are also available at https://curl.se/docs/copyright.html.
  16. *
  17. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  18. * copies of the Software, and permit persons to whom the Software is
  19. * furnished to do so, under the terms of the COPYING file.
  20. *
  21. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  22. * KIND, either express or implied.
  23. *
  24. * SPDX-License-Identifier: curl
  25. *
  26. ***************************************************************************/
  27. #include "curl_setup.h"
  28. #ifdef USE_SCHANNEL
  29. #define SCHANNEL_USE_BLACKLISTS 1
  30. #ifdef _MSC_VER
  31. #pragma warning(push)
  32. #pragma warning(disable: 4201)
  33. #endif
  34. #include <subauth.h>
  35. #ifdef _MSC_VER
  36. #pragma warning(pop)
  37. #endif
  38. /* Wincrypt must be included before anything that could include OpenSSL. */
  39. #if defined(USE_WIN32_CRYPTO)
  40. #include <wincrypt.h>
  41. /* Undefine wincrypt conflicting symbols for BoringSSL. */
  42. #undef X509_NAME
  43. #undef X509_EXTENSIONS
  44. #undef PKCS7_ISSUER_AND_SERIAL
  45. #undef PKCS7_SIGNER_INFO
  46. #undef OCSP_REQUEST
  47. #undef OCSP_RESPONSE
  48. #endif
  49. #include <schnlsp.h>
  50. #include <schannel.h>
  51. #include "curl_sspi.h"
  52. #include "urldata.h"
  53. /* <wincrypt.h> has been included via the above <schnlsp.h>.
  54. * Or in case of ldap.c, it was included via <winldap.h>.
  55. * And since <wincrypt.h> has this:
  56. * #define X509_NAME ((LPCSTR) 7)
  57. *
  58. * And in BoringSSL's <openssl/base.h> there is:
  59. * typedef struct X509_name_st X509_NAME;
  60. * etc.
  61. *
  62. * this will cause all kinds of C-preprocessing paste errors in
  63. * BoringSSL's <openssl/x509.h>: So just undefine those defines here
  64. * (and only here).
  65. */
  66. #if defined(HAVE_BORINGSSL) || defined(OPENSSL_IS_BORINGSSL)
  67. # undef X509_NAME
  68. # undef X509_CERT_PAIR
  69. # undef X509_EXTENSIONS
  70. #endif
  71. extern const struct Curl_ssl Curl_ssl_schannel;
  72. CURLcode Curl_verify_certificate(struct Curl_easy *data,
  73. struct connectdata *conn, int sockindex);
  74. /* structs to expose only in schannel.c and schannel_verify.c */
  75. #ifdef EXPOSE_SCHANNEL_INTERNAL_STRUCTS
  76. #ifdef __MINGW32__
  77. #ifdef __MINGW64_VERSION_MAJOR
  78. #define HAS_MANUAL_VERIFY_API
  79. #endif
  80. #else
  81. #ifdef CERT_CHAIN_REVOCATION_CHECK_CHAIN
  82. #define HAS_MANUAL_VERIFY_API
  83. #endif
  84. #endif
  85. #if defined(CryptStringToBinary) && defined(CRYPT_STRING_HEX) \
  86. && !defined(DISABLE_SCHANNEL_CLIENT_CERT)
  87. #define HAS_CLIENT_CERT_PATH
  88. #endif
  89. #ifndef SCH_CREDENTIALS_VERSION
  90. #define SCH_CREDENTIALS_VERSION 0x00000005
  91. typedef enum _eTlsAlgorithmUsage
  92. {
  93. TlsParametersCngAlgUsageKeyExchange,
  94. TlsParametersCngAlgUsageSignature,
  95. TlsParametersCngAlgUsageCipher,
  96. TlsParametersCngAlgUsageDigest,
  97. TlsParametersCngAlgUsageCertSig
  98. } eTlsAlgorithmUsage;
  99. typedef struct _CRYPTO_SETTINGS
  100. {
  101. eTlsAlgorithmUsage eAlgorithmUsage;
  102. UNICODE_STRING strCngAlgId;
  103. DWORD cChainingModes;
  104. PUNICODE_STRING rgstrChainingModes;
  105. DWORD dwMinBitLength;
  106. DWORD dwMaxBitLength;
  107. } CRYPTO_SETTINGS, * PCRYPTO_SETTINGS;
  108. typedef struct _TLS_PARAMETERS
  109. {
  110. DWORD cAlpnIds;
  111. PUNICODE_STRING rgstrAlpnIds;
  112. DWORD grbitDisabledProtocols;
  113. DWORD cDisabledCrypto;
  114. PCRYPTO_SETTINGS pDisabledCrypto;
  115. DWORD dwFlags;
  116. } TLS_PARAMETERS, * PTLS_PARAMETERS;
  117. typedef struct _SCH_CREDENTIALS
  118. {
  119. DWORD dwVersion;
  120. DWORD dwCredFormat;
  121. DWORD cCreds;
  122. PCCERT_CONTEXT* paCred;
  123. HCERTSTORE hRootStore;
  124. DWORD cMappers;
  125. struct _HMAPPER **aphMappers;
  126. DWORD dwSessionLifespan;
  127. DWORD dwFlags;
  128. DWORD cTlsParameters;
  129. PTLS_PARAMETERS pTlsParameters;
  130. } SCH_CREDENTIALS, * PSCH_CREDENTIALS;
  131. #define SCH_CRED_MAX_SUPPORTED_PARAMETERS 16
  132. #define SCH_CRED_MAX_SUPPORTED_ALPN_IDS 16
  133. #define SCH_CRED_MAX_SUPPORTED_CRYPTO_SETTINGS 16
  134. #define SCH_CRED_MAX_SUPPORTED_CHAINING_MODES 16
  135. #endif
  136. struct Curl_schannel_cred {
  137. CredHandle cred_handle;
  138. TimeStamp time_stamp;
  139. TCHAR *sni_hostname;
  140. #ifdef HAS_CLIENT_CERT_PATH
  141. HCERTSTORE client_cert_store;
  142. #endif
  143. int refcount;
  144. };
  145. struct Curl_schannel_ctxt {
  146. CtxtHandle ctxt_handle;
  147. TimeStamp time_stamp;
  148. };
  149. struct ssl_backend_data {
  150. struct Curl_schannel_cred *cred;
  151. struct Curl_schannel_ctxt *ctxt;
  152. SecPkgContext_StreamSizes stream_sizes;
  153. size_t encdata_length, decdata_length;
  154. size_t encdata_offset, decdata_offset;
  155. unsigned char *encdata_buffer, *decdata_buffer;
  156. /* encdata_is_incomplete: if encdata contains only a partial record that
  157. can't be decrypted without another Curl_read_plain (that is, status is
  158. SEC_E_INCOMPLETE_MESSAGE) then set this true. after Curl_read_plain writes
  159. more bytes into encdata then set this back to false. */
  160. bool encdata_is_incomplete;
  161. unsigned long req_flags, ret_flags;
  162. CURLcode recv_unrecoverable_err; /* schannel_recv had an unrecoverable err */
  163. bool recv_sspi_close_notify; /* true if connection closed by close_notify */
  164. bool recv_connection_closed; /* true if connection closed, regardless how */
  165. bool recv_renegotiating; /* true if recv is doing renegotiation */
  166. bool use_alpn; /* true if ALPN is used for this connection */
  167. #ifdef HAS_MANUAL_VERIFY_API
  168. bool use_manual_cred_validation; /* true if manual cred validation is used */
  169. #endif
  170. };
  171. #endif /* EXPOSE_SCHANNEL_INTERNAL_STRUCTS */
  172. #endif /* USE_SCHANNEL */
  173. #endif /* HEADER_CURL_SCHANNEL_H */