]> git.ipfire.org Git - thirdparty/cups.git/blob - cups/tls-sspi.c
projects / thirdparty / cups.git / blob
? search:


962ad6d1732d7dc2846f2566298f9e5a069746bd
[thirdparty/cups.git] / cups / tls-sspi.c
1 /*
2 * TLS support for CUPS on Windows using the Security Support Provider
3 * Interface (SSPI).
4 *
5 * Copyright 2010-2017 by Apple Inc.
6 *
7 * These coded instructions, statements, and computer programs are the
8 * property of Apple Inc. and are protected by Federal copyright
9 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
10 * which should have been included with this file. If this file is
11 * missing or damaged, see the license at "http://www.cups.org/".
12 *
13 * This file is subject to the Apple OS-Developed Software exception.
14 */
15
16 /**** This file is included from tls.c ****/
17
18 /*
19 * Include necessary headers...
20 */
21
22 #include "debug-private.h"
23
24
25 /*
26 * Include necessary libraries...
27 */
28
29 #pragma comment(lib, "Crypt32.lib")
30 #pragma comment(lib, "Secur32.lib")
31 #pragma comment(lib, "Ws2_32.lib")
32
33
34 /*
35 * Constants...
36 */
37
38 #ifndef SECURITY_FLAG_IGNORE_UNKNOWN_CA
39 # define SECURITY_FLAG_IGNORE_UNKNOWN_CA 0x00000100 /* Untrusted root */
40 #endif /* SECURITY_FLAG_IGNORE_UNKNOWN_CA */
41
42 #ifndef SECURITY_FLAG_IGNORE_CERT_CN_INVALID
43 # define SECURITY_FLAG_IGNORE_CERT_CN_INVALID 0x00001000 /* Common name does not match */
44 #endif /* !SECURITY_FLAG_IGNORE_CERT_CN_INVALID */
45
46 #ifndef SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
47 # define SECURITY_FLAG_IGNORE_CERT_DATE_INVALID 0x00002000 /* Expired X509 Cert. */
48 #endif /* !SECURITY_FLAG_IGNORE_CERT_DATE_INVALID */
49
50
51 /*
52 * Local globals...
53 */
54
55 static int tls_options = -1,/* Options for TLS connections */
56 tls_min_version = _HTTP_TLS_1_0,
57 tls_max_version = _HTTP_TLS_MAX;
58
59
60 /*
61 * Local functions...
62 */
63
64 static _http_sspi_t *http_sspi_alloc(void);
65 static int http_sspi_client(http_t *http, const char *hostname);
66 static PCCERT_CONTEXT http_sspi_create_credential(http_credential_t *cred);
67 static BOOL http_sspi_find_credentials(http_t *http, const LPWSTR containerName, const char *common_name);
68 static void http_sspi_free(_http_sspi_t *sspi);
69 static BOOL http_sspi_make_credentials(_http_sspi_t *sspi, const LPWSTR containerName, const char *common_name, _http_mode_t mode, int years);
70 static int http_sspi_server(http_t *http, const char *hostname);
71 static void http_sspi_set_allows_any_root(_http_sspi_t *sspi, BOOL allow);
72 static void http_sspi_set_allows_expired_certs(_http_sspi_t *sspi, BOOL allow);
73 static const char *http_sspi_strerror(char *buffer, size_t bufsize, DWORD code);
74 static DWORD http_sspi_verify(PCCERT_CONTEXT cert, const char *common_name, DWORD dwCertFlags);
75
76
77 /*
78 * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
79 *
80 * @since CUPS 2.0/OS 10.10@
81 */
82
83 int /* O - 1 on success, 0 on failure */
84 cupsMakeServerCredentials(
85 const char *path, /* I - Keychain path or @code NULL@ for default */
86 const char *common_name, /* I - Common name */
87 int num_alt_names, /* I - Number of subject alternate names */
88 const char **alt_names, /* I - Subject Alternate Names */
89 time_t expiration_date) /* I - Expiration date */
90 {
91 _http_sspi_t *sspi; /* SSPI data */
92 int ret; /* Return value */
93
94
95 DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
96
97 (void)path;
98 (void)num_alt_names;
99 (void)alt_names;
100
101 sspi = http_sspi_alloc();
102 ret = http_sspi_make_credentials(sspi, L"ServerContainer", common_name, _HTTP_MODE_SERVER, (int)((expiration_date - time(NULL) + 86399) / 86400 / 365));
103
104 http_sspi_free(sspi);
105
106 return (ret);
107 }
108
109
110 /*
111 * 'cupsSetServerCredentials()' - Set the default server credentials.
112 *
113 * Note: The server credentials are used by all threads in the running process.
114 * This function is threadsafe.
115 *
116 * @since CUPS 2.0/OS 10.10@
117 */
118
119 int /* O - 1 on success, 0 on failure */
120 cupsSetServerCredentials(
121 const char *path, /* I - Keychain path or @code NULL@ for default */
122 const char *common_name, /* I - Default common name for server */
123 int auto_create) /* I - 1 = automatically create self-signed certificates */
124 {
125 DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
126
127 (void)path;
128 (void)common_name;
129 (void)auto_create;
130
131 return (0);
132 }
133
134
135 /*
136 * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
137 * an encrypted connection.
138 *
139 * @since CUPS 1.5/macOS 10.7@
140 */
141
142 int /* O - Status of call (0 = success) */
143 httpCopyCredentials(
144 http_t *http, /* I - Connection to server */
145 cups_array_t **credentials) /* O - Array of credentials */
146 {
147 DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", http, credentials));
148
149 if (!http || !http->tls || !http->tls->remoteCert || !credentials)
150 {
151 if (credentials)
152 *credentials = NULL;
153
154 return (-1);
155 }
156
157 *credentials = cupsArrayNew(NULL, NULL);
158 httpAddCredential(*credentials, http->tls->remoteCert->pbCertEncoded, http->tls->remoteCert->cbCertEncoded);
159
160 return (0);
161 }
162
163
164 /*
165 * '_httpCreateCredentials()' - Create credentials in the internal format.
166 */
167
168 http_tls_credentials_t /* O - Internal credentials */
169 _httpCreateCredentials(
170 cups_array_t *credentials) /* I - Array of credentials */
171 {
172 return (http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials)));
173 }
174
175
176 /*
177 * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
178 *
179 * @since CUPS 2.0/OS 10.10@
180 */
181
182 int /* O - 1 if valid, 0 otherwise */
183 httpCredentialsAreValidForName(
184 cups_array_t *credentials, /* I - Credentials */
185 const char *common_name) /* I - Name to check */
186 {
187 int valid = 1; /* Valid name? */
188 PCCERT_CONTEXT cert = http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials));
189 /* Certificate */
190 char cert_name[1024]; /* Name from certificate */
191
192
193 if (cert)
194 {
195 if (CertNameToStr(X509_ASN_ENCODING, &(cert->pCertInfo->Subject), CERT_SIMPLE_NAME_STR, cert_name, sizeof(cert_name)))
196 {
197 /*
198 * Extract common name at end...
199 */
200
201 char *ptr = strrchr(cert_name, ',');
202 if (ptr && ptr[1])
203 _cups_strcpy(cert_name, ptr + 2);
204 }
205 else
206 strlcpy(cert_name, "unknown", sizeof(cert_name));
207
208 CertFreeCertificateContext(cert);
209 }
210 else
211 strlcpy(cert_name, "unknown", sizeof(cert_name));
212
213 /*
214 * Compare the common names...
215 */
216
217 if (_cups_strcasecmp(common_name, cert_name))
218 {
219 /*
220 * Not an exact match for the common name, check for wildcard certs...
221 */
222
223 const char *domain = strchr(common_name, '.');
224 /* Domain in common name */
225
226 if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1))
227 {
228 /*
229 * Not a wildcard match.
230 */
231
232 /* TODO: Check subject alternate names */
233 valid = 0;
234 }
235 }
236
237 return (valid);
238 }
239
240
241 /*
242 * 'httpCredentialsGetTrust()' - Return the trust of credentials.
243 *
244 * @since CUPS 2.0/OS 10.10@
245 */
246
247 http_trust_t /* O - Level of trust */
248 httpCredentialsGetTrust(
249 cups_array_t *credentials, /* I - Credentials */
250 const char *common_name) /* I - Common name for trust lookup */
251 {
252 http_trust_t trust = HTTP_TRUST_OK; /* Level of trust */
253 PCCERT_CONTEXT cert = NULL; /* Certificate to validate */
254 DWORD certFlags = 0; /* Cert verification flags */
255 _cups_globals_t *cg = _cupsGlobals(); /* Per-thread global data */
256
257
258 if (!common_name)
259 return (HTTP_TRUST_UNKNOWN);
260
261 cert = http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials));
262 if (!cert)
263 return (HTTP_TRUST_UNKNOWN);
264
265 if (cg->any_root < 0)
266 _cupsSetDefaults();
267
268 if (cg->any_root)
269 certFlags |= SECURITY_FLAG_IGNORE_UNKNOWN_CA;
270
271 if (cg->expired_certs)
272 certFlags |= SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
273
274 if (!cg->validate_certs)
275 certFlags |= SECURITY_FLAG_IGNORE_CERT_CN_INVALID;
276
277 if (http_sspi_verify(cert, common_name, certFlags) != SEC_E_OK)
278 trust = HTTP_TRUST_INVALID;
279
280 CertFreeCertificateContext(cert);
281
282 return (trust);
283 }
284
285
286 /*
287 * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
288 *
289 * @since CUPS 2.0/OS 10.10@
290 */
291
292 time_t /* O - Expiration date of credentials */
293 httpCredentialsGetExpiration(
294 cups_array_t *credentials) /* I - Credentials */
295 {
296 time_t expiration_date = 0; /* Expiration data of credentials */
297 PCCERT_CONTEXT cert = http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials));
298 /* Certificate */
299
300 if (cert)
301 {
302 SYSTEMTIME systime; /* System time */
303 struct tm tm; /* UNIX date/time */
304
305 FileTimeToSystemTime(&(cert->pCertInfo->NotAfter), &systime);
306
307 tm.tm_year = systime.wYear - 1900;
308 tm.tm_mon = systime.wMonth - 1;
309 tm.tm_mday = systime.wDay;
310 tm.tm_hour = systime.wHour;
311 tm.tm_min = systime.wMinute;
312 tm.tm_sec = systime.wSecond;
313
314 expiration_date = mktime(&tm);
315
316 CertFreeCertificateContext(cert);
317 }
318
319 return (expiration_date);
320 }
321
322
323 /*
324 * 'httpCredentialsString()' - Return a string representing the credentials.
325 *
326 * @since CUPS 2.0/OS 10.10@
327 */
328
329 size_t /* O - Total size of credentials string */
330 httpCredentialsString(
331 cups_array_t *credentials, /* I - Credentials */
332 char *buffer, /* I - Buffer or @code NULL@ */
333 size_t bufsize) /* I - Size of buffer */
334 {
335 http_credential_t *first = (http_credential_t *)cupsArrayFirst(credentials);
336 /* First certificate */
337 PCCERT_CONTEXT cert; /* Certificate */
338
339
340 DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", credentials, buffer, CUPS_LLCAST bufsize));
341
342 if (!buffer)
343 return (0);
344
345 if (buffer && bufsize > 0)
346 *buffer = '\0';
347
348 cert = http_sspi_create_credential(first);
349
350 if (cert)
351 {
352 char cert_name[256]; /* Common name */
353 SYSTEMTIME systime; /* System time */
354 struct tm tm; /* UNIX date/time */
355 time_t expiration; /* Expiration date of cert */
356 _cups_md5_state_t md5_state; /* MD5 state */
357 unsigned char md5_digest[16]; /* MD5 result */
358
359 FileTimeToSystemTime(&(cert->pCertInfo->NotAfter), &systime);
360
361 tm.tm_year = systime.wYear - 1900;
362 tm.tm_mon = systime.wMonth - 1;
363 tm.tm_mday = systime.wDay;
364 tm.tm_hour = systime.wHour;
365 tm.tm_min = systime.wMinute;
366 tm.tm_sec = systime.wSecond;
367
368 expiration = mktime(&tm);
369
370 if (CertNameToStr(X509_ASN_ENCODING, &(cert->pCertInfo->Subject), CERT_SIMPLE_NAME_STR, cert_name, sizeof(cert_name)))
371 {
372 /*
373 * Extract common name at end...
374 */
375
376 char *ptr = strrchr(cert_name, ',');
377 if (ptr && ptr[1])
378 _cups_strcpy(cert_name, ptr + 2);
379 }
380 else
381 strlcpy(cert_name, "unknown", sizeof(cert_name));
382
383 _cupsMD5Init(&md5_state);
384 _cupsMD5Append(&md5_state, first->data, (int)first->datalen);
385 _cupsMD5Finish(&md5_state, md5_digest);
386
387 snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", cert_name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
388
389 CertFreeCertificateContext(cert);
390 }
391
392 DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
393
394 return (strlen(buffer));
395 }
396
397
398 /*
399 * '_httpFreeCredentials()' - Free internal credentials.
400 */
401
402 void
403 _httpFreeCredentials(
404 http_tls_credentials_t credentials) /* I - Internal credentials */
405 {
406 if (!credentials)
407 return;
408
409 CertFreeCertificateContext(credentials);
410 }
411
412
413 /*
414 * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
415 *
416 * @since CUPS 2.0/OS 10.10@
417 */
418
419 int /* O - 0 on success, -1 on error */
420 httpLoadCredentials(
421 const char *path, /* I - Keychain path or @code NULL@ for default */
422 cups_array_t **credentials, /* IO - Credentials */
423 const char *common_name) /* I - Common name for credentials */
424 {
425 HCERTSTORE store = NULL; /* Certificate store */
426 PCCERT_CONTEXT storedContext = NULL; /* Context created from the store */
427 DWORD dwSize = 0; /* 32 bit size */
428 PBYTE p = NULL; /* Temporary storage */
429 HCRYPTPROV hProv = (HCRYPTPROV)NULL;
430 /* Handle to a CSP */
431 CERT_NAME_BLOB sib; /* Arbitrary array of bytes */
432 #ifdef DEBUG
433 char error[1024]; /* Error message buffer */
434 #endif /* DEBUG */
435
436
437 DEBUG_printf(("httpLoadCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, credentials, common_name));
438
439 (void)path;
440
441 if (credentials)
442 {
443 *credentials = NULL;
444 }
445 else
446 {
447 DEBUG_puts("1httpLoadCredentials: NULL credentials pointer, returning -1.");
448 return (-1);
449 }
450
451 if (!common_name)
452 {
453 DEBUG_puts("1httpLoadCredentials: Bad common name, returning -1.");
454 return (-1);
455 }
456
457 if (!CryptAcquireContextW(&hProv, L"RememberedContainer", MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET))
458 {
459 if (GetLastError() == NTE_EXISTS)
460 {
461 if (!CryptAcquireContextW(&hProv, L"RememberedContainer", MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
462 {
463 DEBUG_printf(("1httpLoadCredentials: CryptAcquireContext failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
464 goto cleanup;
465 }
466 }
467 }
468
469 store = CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING|PKCS_7_ASN_ENCODING, hProv, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_NO_CRYPT_RELEASE_FLAG | CERT_STORE_OPEN_EXISTING_FLAG, L"MY");
470
471 if (!store)
472 {
473 DEBUG_printf(("1httpLoadCredentials: CertOpenSystemStore failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
474 goto cleanup;
475 }
476
477 dwSize = 0;
478
479 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, NULL, &dwSize, NULL))
480 {
481 DEBUG_printf(("1httpLoadCredentials: CertStrToName failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
482 goto cleanup;
483 }
484
485 p = (PBYTE)malloc(dwSize);
486
487 if (!p)
488 {
489 DEBUG_printf(("1httpLoadCredentials: malloc failed for %d bytes.", dwSize));
490 goto cleanup;
491 }
492
493 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, p, &dwSize, NULL))
494 {
495 DEBUG_printf(("1httpLoadCredentials: CertStrToName failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
496 goto cleanup;
497 }
498
499 sib.cbData = dwSize;
500 sib.pbData = p;
501
502 storedContext = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_SUBJECT_NAME, &sib, NULL);
503
504 if (!storedContext)
505 {
506 DEBUG_printf(("1httpLoadCredentials: Unable to find credentials for \"%s\".", common_name));
507 goto cleanup;
508 }
509
510 *credentials = cupsArrayNew(NULL, NULL);
511 httpAddCredential(*credentials, storedContext->pbCertEncoded, storedContext->cbCertEncoded);
512
513 cleanup:
514
515 /*
516 * Cleanup
517 */
518
519 if (storedContext)
520 CertFreeCertificateContext(storedContext);
521
522 if (p)
523 free(p);
524
525 if (store)
526 CertCloseStore(store, 0);
527
528 if (hProv)
529 CryptReleaseContext(hProv, 0);
530
531 DEBUG_printf(("1httpLoadCredentials: Returning %d.", *credentials ? 0 : -1));
532
533 return (*credentials ? 0 : -1);
534 }
535
536
537 /*
538 * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
539 *
540 * @since CUPS 2.0/OS 10.10@
541 */
542
543 int /* O - -1 on error, 0 on success */
544 httpSaveCredentials(
545 const char *path, /* I - Keychain path or @code NULL@ for default */
546 cups_array_t *credentials, /* I - Credentials */
547 const char *common_name) /* I - Common name for credentials */
548 {
549 HCERTSTORE store = NULL; /* Certificate store */
550 PCCERT_CONTEXT storedContext = NULL; /* Context created from the store */
551 PCCERT_CONTEXT createdContext = NULL; /* Context created by us */
552 DWORD dwSize = 0; /* 32 bit size */
553 PBYTE p = NULL; /* Temporary storage */
554 HCRYPTPROV hProv = (HCRYPTPROV)NULL;
555 /* Handle to a CSP */
556 CRYPT_KEY_PROV_INFO ckp; /* Handle to crypto key */
557 int ret = -1; /* Return value */
558 #ifdef DEBUG
559 char error[1024]; /* Error message buffer */
560 #endif /* DEBUG */
561
562
563 DEBUG_printf(("httpSaveCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, credentials, common_name));
564
565 (void)path;
566
567 if (!common_name)
568 {
569 DEBUG_puts("1httpSaveCredentials: Bad common name, returning -1.");
570 return (-1);
571 }
572
573 createdContext = http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials));
574 if (!createdContext)
575 {
576 DEBUG_puts("1httpSaveCredentials: Bad credentials, returning -1.");
577 return (-1);
578 }
579
580 if (!CryptAcquireContextW(&hProv, L"RememberedContainer", MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET))
581 {
582 if (GetLastError() == NTE_EXISTS)
583 {
584 if (!CryptAcquireContextW(&hProv, L"RememberedContainer", MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
585 {
586 DEBUG_printf(("1httpSaveCredentials: CryptAcquireContext failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
587 goto cleanup;
588 }
589 }
590 }
591
592 store = CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING|PKCS_7_ASN_ENCODING, hProv, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_NO_CRYPT_RELEASE_FLAG | CERT_STORE_OPEN_EXISTING_FLAG, L"MY");
593
594 if (!store)
595 {
596 DEBUG_printf(("1httpSaveCredentials: CertOpenSystemStore failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
597 goto cleanup;
598 }
599
600 dwSize = 0;
601
602 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, NULL, &dwSize, NULL))
603 {
604 DEBUG_printf(("1httpSaveCredentials: CertStrToName failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
605 goto cleanup;
606 }
607
608 p = (PBYTE)malloc(dwSize);
609
610 if (!p)
611 {
612 DEBUG_printf(("1httpSaveCredentials: malloc failed for %d bytes.", dwSize));
613 goto cleanup;
614 }
615
616 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, p, &dwSize, NULL))
617 {
618 DEBUG_printf(("1httpSaveCredentials: CertStrToName failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
619 goto cleanup;
620 }
621
622 /*
623 * Add the created context to the named store, and associate it with the named
624 * container...
625 */
626
627 if (!CertAddCertificateContextToStore(store, createdContext, CERT_STORE_ADD_REPLACE_EXISTING, &storedContext))
628 {
629 DEBUG_printf(("1httpSaveCredentials: CertAddCertificateContextToStore failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
630 goto cleanup;
631 }
632
633 ZeroMemory(&ckp, sizeof(ckp));
634 ckp.pwszContainerName = L"RememberedContainer";
635 ckp.pwszProvName = MS_DEF_PROV_W;
636 ckp.dwProvType = PROV_RSA_FULL;
637 ckp.dwFlags = CRYPT_MACHINE_KEYSET;
638 ckp.dwKeySpec = AT_KEYEXCHANGE;
639
640 if (!CertSetCertificateContextProperty(storedContext, CERT_KEY_PROV_INFO_PROP_ID, 0, &ckp))
641 {
642 DEBUG_printf(("1httpSaveCredentials: CertSetCertificateContextProperty failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
643 goto cleanup;
644 }
645
646 ret = 0;
647
648 cleanup:
649
650 /*
651 * Cleanup
652 */
653
654 if (createdContext)
655 CertFreeCertificateContext(createdContext);
656
657 if (storedContext)
658 CertFreeCertificateContext(storedContext);
659
660 if (p)
661 free(p);
662
663 if (store)
664 CertCloseStore(store, 0);
665
666 if (hProv)
667 CryptReleaseContext(hProv, 0);
668
669 DEBUG_printf(("1httpSaveCredentials: Returning %d.", ret));
670 return (ret);
671 }
672
673
674 /*
675 * '_httpTLSInitialize()' - Initialize the TLS stack.
676 */
677
678 void
679 _httpTLSInitialize(void)
680 {
681 /*
682 * Nothing to do...
683 */
684 }
685
686
687 /*
688 * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
689 */
690
691 size_t /* O - Bytes available */
692 _httpTLSPending(http_t *http) /* I - HTTP connection */
693 {
694 if (http->tls)
695 return (http->tls->readBufferUsed);
696 else
697 return (0);
698 }
699
700
701 /*
702 * '_httpTLSRead()' - Read from a SSL/TLS connection.
703 */
704
705 int /* O - Bytes read */
706 _httpTLSRead(http_t *http, /* I - HTTP connection */
707 char *buf, /* I - Buffer to store data */
708 int len) /* I - Length of buffer */
709 {
710 int i; /* Looping var */
711 _http_sspi_t *sspi = http->tls; /* SSPI data */
712 SecBufferDesc message; /* Array of SecBuffer struct */
713 SecBuffer buffers[4] = { 0 }; /* Security package buffer */
714 int num = 0; /* Return value */
715 PSecBuffer pDataBuffer; /* Data buffer */
716 PSecBuffer pExtraBuffer; /* Excess data buffer */
717 SECURITY_STATUS scRet; /* SSPI status */
718
719
720 DEBUG_printf(("4_httpTLSRead(http=%p, buf=%p, len=%d)", http, buf, len));
721
722 /*
723 * If there are bytes that have already been decrypted and have not yet been
724 * read, return those...
725 */
726
727 if (sspi->readBufferUsed > 0)
728 {
729 int bytesToCopy = min(sspi->readBufferUsed, len);
730 /* Number of bytes to copy */
731
732 memcpy(buf, sspi->readBuffer, bytesToCopy);
733 sspi->readBufferUsed -= bytesToCopy;
734
735 if (sspi->readBufferUsed > 0)
736 memmove(sspi->readBuffer, sspi->readBuffer + bytesToCopy, sspi->readBufferUsed);
737
738 DEBUG_printf(("5_httpTLSRead: Returning %d bytes previously decrypted.", bytesToCopy));
739
740 return (bytesToCopy);
741 }
742
743 /*
744 * Initialize security buffer structs
745 */
746
747 message.ulVersion = SECBUFFER_VERSION;
748 message.cBuffers = 4;
749 message.pBuffers = buffers;
750
751 do
752 {
753 /*
754 * If there is not enough space in the buffer, then increase its size...
755 */
756
757 if (sspi->decryptBufferLength <= sspi->decryptBufferUsed)
758 {
759 BYTE *temp; /* New buffer */
760
761 if (sspi->decryptBufferLength >= 262144)
762 {
763 WSASetLastError(E_OUTOFMEMORY);
764 DEBUG_puts("_httpTLSRead: Decryption buffer too large (>256k)");
765 return (-1);
766 }
767
768 if ((temp = realloc(sspi->decryptBuffer, sspi->decryptBufferLength + 4096)) == NULL)
769 {
770 DEBUG_printf(("_httpTLSRead: Unable to allocate %d byte decryption buffer.", sspi->decryptBufferLength + 4096));
771 WSASetLastError(E_OUTOFMEMORY);
772 return (-1);
773 }
774
775 sspi->decryptBufferLength += 4096;
776 sspi->decryptBuffer = temp;
777
778 DEBUG_printf(("_httpTLSRead: Resized decryption buffer to %d bytes.", sspi->decryptBufferLength));
779 }
780
781 buffers[0].pvBuffer = sspi->decryptBuffer;
782 buffers[0].cbBuffer = (unsigned long)sspi->decryptBufferUsed;
783 buffers[0].BufferType = SECBUFFER_DATA;
784 buffers[1].BufferType = SECBUFFER_EMPTY;
785 buffers[2].BufferType = SECBUFFER_EMPTY;
786 buffers[3].BufferType = SECBUFFER_EMPTY;
787
788 DEBUG_printf(("5_httpTLSRead: decryptBufferUsed=%d", sspi->decryptBufferUsed));
789
790 scRet = DecryptMessage(&sspi->context, &message, 0, NULL);
791
792 if (scRet == SEC_E_INCOMPLETE_MESSAGE)
793 {
794 num = recv(http->fd, sspi->decryptBuffer + sspi->decryptBufferUsed, (int)(sspi->decryptBufferLength - sspi->decryptBufferUsed), 0);
795 if (num < 0)
796 {
797 DEBUG_printf(("5_httpTLSRead: recv failed: %d", WSAGetLastError()));
798 return (-1);
799 }
800 else if (num == 0)
801 {
802 DEBUG_puts("5_httpTLSRead: Server disconnected.");
803 return (0);
804 }
805
806 DEBUG_printf(("5_httpTLSRead: Read %d bytes into decryption buffer.", num));
807
808 sspi->decryptBufferUsed += num;
809 }
810 }
811 while (scRet == SEC_E_INCOMPLETE_MESSAGE);
812
813 if (scRet == SEC_I_CONTEXT_EXPIRED)
814 {
815 DEBUG_puts("5_httpTLSRead: Context expired.");
816 WSASetLastError(WSAECONNRESET);
817 return (-1);
818 }
819 else if (scRet != SEC_E_OK)
820 {
821 DEBUG_printf(("5_httpTLSRead: DecryptMessage failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
822 WSASetLastError(WSASYSCALLFAILURE);
823 return (-1);
824 }
825
826 /*
827 * The decryption worked. Now, locate data buffer.
828 */
829
830 pDataBuffer = NULL;
831 pExtraBuffer = NULL;
832
833 for (i = 1; i < 4; i++)
834 {
835 if (buffers[i].BufferType == SECBUFFER_DATA)
836 pDataBuffer = &buffers[i];
837 else if (!pExtraBuffer && (buffers[i].BufferType == SECBUFFER_EXTRA))
838 pExtraBuffer = &buffers[i];
839 }
840
841 /*
842 * If a data buffer is found, then copy the decrypted bytes to the passed-in
843 * buffer...
844 */
845
846 if (pDataBuffer)
847 {
848 int bytesToCopy = min((int)pDataBuffer->cbBuffer, len);
849 /* Number of bytes to copy into buf */
850 int bytesToSave = pDataBuffer->cbBuffer - bytesToCopy;
851 /* Number of bytes to save in our read buffer */
852
853 if (bytesToCopy)
854 memcpy(buf, pDataBuffer->pvBuffer, bytesToCopy);
855
856 /*
857 * If there are more decrypted bytes than can be copied to the passed in
858 * buffer, then save them...
859 */
860
861 if (bytesToSave)
862 {
863 if ((sspi->readBufferLength - sspi->readBufferUsed) < bytesToSave)
864 {
865 BYTE *temp; /* New buffer pointer */
866
867 if ((temp = realloc(sspi->readBuffer, sspi->readBufferUsed + bytesToSave)) == NULL)
868 {
869 DEBUG_printf(("_httpTLSRead: Unable to allocate %d bytes.", sspi->readBufferUsed + bytesToSave));
870 WSASetLastError(E_OUTOFMEMORY);
871 return (-1);
872 }
873
874 sspi->readBufferLength = sspi->readBufferUsed + bytesToSave;
875 sspi->readBuffer = temp;
876 }
877
878 memcpy(((BYTE *)sspi->readBuffer) + sspi->readBufferUsed, ((BYTE *)pDataBuffer->pvBuffer) + bytesToCopy, bytesToSave);
879
880 sspi->readBufferUsed += bytesToSave;
881 }
882
883 num = bytesToCopy;
884 }
885 else
886 {
887 DEBUG_puts("_httpTLSRead: Unable to find data buffer.");
888 WSASetLastError(WSASYSCALLFAILURE);
889 return (-1);
890 }
891
892 /*
893 * If the decryption process left extra bytes, then save those back in
894 * decryptBuffer. They will be processed the next time through the loop.
895 */
896
897 if (pExtraBuffer)
898 {
899 memmove(sspi->decryptBuffer, pExtraBuffer->pvBuffer, pExtraBuffer->cbBuffer);
900 sspi->decryptBufferUsed = pExtraBuffer->cbBuffer;
901 }
902 else
903 {
904 sspi->decryptBufferUsed = 0;
905 }
906
907 return (num);
908 }
909
910
911 /*
912 * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
913 */
914
915 void
916 _httpTLSSetOptions(int options) /* I - Options */
917 {
918 if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
919 {
920 tls_options = options;
921 tls_min_version = min_version;
922 tls_max_version = max_version;
923 }
924 }
925
926
927 /*
928 * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
929 */
930
931 int /* O - 0 on success, -1 on failure */
932 _httpTLSStart(http_t *http) /* I - HTTP connection */
933 {
934 char hostname[256], /* Hostname */
935 *hostptr; /* Pointer into hostname */
936
937
938 DEBUG_printf(("3_httpTLSStart(http=%p)", http));
939
940 if (tls_options < 0)
941 {
942 DEBUG_puts("4_httpTLSStart: Setting defaults.");
943 _cupsSetDefaults();
944 DEBUG_printf(("4_httpTLSStart: tls_options=%x", tls_options));
945 }
946
947 if ((http->tls = http_sspi_alloc()) == NULL)
948 return (-1);
949
950 if (http->mode == _HTTP_MODE_CLIENT)
951 {
952 /*
953 * Client: determine hostname...
954 */
955
956 if (httpAddrLocalhost(http->hostaddr))
957 {
958 strlcpy(hostname, "localhost", sizeof(hostname));
959 }
960 else
961 {
962 /*
963 * Otherwise make sure the hostname we have does not end in a trailing dot.
964 */
965
966 strlcpy(hostname, http->hostname, sizeof(hostname));
967 if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
968 *hostptr == '.')
969 *hostptr = '\0';
970 }
971
972 return (http_sspi_client(http, hostname));
973 }
974 else
975 {
976 /*
977 * Server: determine hostname to use...
978 */
979
980 if (http->fields[HTTP_FIELD_HOST][0])
981 {
982 /*
983 * Use hostname for TLS upgrade...
984 */
985
986 strlcpy(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
987 }
988 else
989 {
990 /*
991 * Resolve hostname from connection address...
992 */
993
994 http_addr_t addr; /* Connection address */
995 socklen_t addrlen; /* Length of address */
996
997 addrlen = sizeof(addr);
998 if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
999 {
1000 DEBUG_printf(("4_httpTLSStart: Unable to get socket address: %s", strerror(errno)));
1001 hostname[0] = '\0';
1002 }
1003 else if (httpAddrLocalhost(&addr))
1004 hostname[0] = '\0';
1005 else
1006 {
1007 httpAddrLookup(&addr, hostname, sizeof(hostname));
1008 DEBUG_printf(("4_httpTLSStart: Resolved socket address to \"%s\".", hostname));
1009 }
1010 }
1011
1012 return (http_sspi_server(http, hostname));
1013 }
1014 }
1015
1016
1017 /*
1018 * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
1019 */
1020
1021 void
1022 _httpTLSStop(http_t *http) /* I - HTTP connection */
1023 {
1024 _http_sspi_t *sspi = http->tls; /* SSPI data */
1025
1026
1027 if (sspi->contextInitialized && http->fd >= 0)
1028 {
1029 SecBufferDesc message; /* Array of SecBuffer struct */
1030 SecBuffer buffers[1] = { 0 };
1031 /* Security package buffer */
1032 DWORD dwType; /* Type */
1033 DWORD status; /* Status */
1034
1035 /*
1036 * Notify schannel that we are about to close the connection.
1037 */
1038
1039 dwType = SCHANNEL_SHUTDOWN;
1040
1041 buffers[0].pvBuffer = &dwType;
1042 buffers[0].BufferType = SECBUFFER_TOKEN;
1043 buffers[0].cbBuffer = sizeof(dwType);
1044
1045 message.cBuffers = 1;
1046 message.pBuffers = buffers;
1047 message.ulVersion = SECBUFFER_VERSION;
1048
1049 status = ApplyControlToken(&sspi->context, &message);
1050
1051 if (SUCCEEDED(status))
1052 {
1053 PBYTE pbMessage; /* Message buffer */
1054 DWORD cbMessage; /* Message buffer count */
1055 DWORD cbData; /* Data count */
1056 DWORD dwSSPIFlags; /* SSL attributes we requested */
1057 DWORD dwSSPIOutFlags; /* SSL attributes we received */
1058 TimeStamp tsExpiry; /* Time stamp */
1059
1060 dwSSPIFlags = ASC_REQ_SEQUENCE_DETECT |
1061 ASC_REQ_REPLAY_DETECT |
1062 ASC_REQ_CONFIDENTIALITY |
1063 ASC_REQ_EXTENDED_ERROR |
1064 ASC_REQ_ALLOCATE_MEMORY |
1065 ASC_REQ_STREAM;
1066
1067 buffers[0].pvBuffer = NULL;
1068 buffers[0].BufferType = SECBUFFER_TOKEN;
1069 buffers[0].cbBuffer = 0;
1070
1071 message.cBuffers = 1;
1072 message.pBuffers = buffers;
1073 message.ulVersion = SECBUFFER_VERSION;
1074
1075 status = AcceptSecurityContext(&sspi->creds, &sspi->context, NULL,
1076 dwSSPIFlags, SECURITY_NATIVE_DREP, NULL,
1077 &message, &dwSSPIOutFlags, &tsExpiry);
1078
1079 if (SUCCEEDED(status))
1080 {
1081 pbMessage = buffers[0].pvBuffer;
1082 cbMessage = buffers[0].cbBuffer;
1083
1084 /*
1085 * Send the close notify message to the client.
1086 */
1087
1088 if (pbMessage && cbMessage)
1089 {
1090 cbData = send(http->fd, pbMessage, cbMessage, 0);
1091 if ((cbData == SOCKET_ERROR) || (cbData == 0))
1092 {
1093 status = WSAGetLastError();
1094 DEBUG_printf(("_httpTLSStop: sending close notify failed: %d", status));
1095 }
1096 else
1097 {
1098 FreeContextBuffer(pbMessage);
1099 }
1100 }
1101 }
1102 else
1103 {
1104 DEBUG_printf(("_httpTLSStop: AcceptSecurityContext failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), status)));
1105 }
1106 }
1107 else
1108 {
1109 DEBUG_printf(("_httpTLSStop: ApplyControlToken failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), status)));
1110 }
1111 }
1112
1113 http_sspi_free(sspi);
1114
1115 http->tls = NULL;
1116 }
1117
1118
1119 /*
1120 * '_httpTLSWrite()' - Write to a SSL/TLS connection.
1121 */
1122
1123 int /* O - Bytes written */
1124 _httpTLSWrite(http_t *http, /* I - HTTP connection */
1125 const char *buf, /* I - Buffer holding data */
1126 int len) /* I - Length of buffer */
1127 {
1128 _http_sspi_t *sspi = http->tls; /* SSPI data */
1129 SecBufferDesc message; /* Array of SecBuffer struct */
1130 SecBuffer buffers[4] = { 0 }; /* Security package buffer */
1131 int bufferLen; /* Buffer length */
1132 int bytesLeft; /* Bytes left to write */
1133 const char *bufptr; /* Pointer into buffer */
1134 int num = 0; /* Return value */
1135
1136
1137 bufferLen = sspi->streamSizes.cbMaximumMessage + sspi->streamSizes.cbHeader + sspi->streamSizes.cbTrailer;
1138
1139 if (bufferLen > sspi->writeBufferLength)
1140 {
1141 BYTE *temp; /* New buffer pointer */
1142
1143 if ((temp = (BYTE *)realloc(sspi->writeBuffer, bufferLen)) == NULL)
1144 {
1145 DEBUG_printf(("_httpTLSWrite: Unable to allocate buffer of %d bytes.", bufferLen));
1146 WSASetLastError(E_OUTOFMEMORY);
1147 return (-1);
1148 }
1149
1150 sspi->writeBuffer = temp;
1151 sspi->writeBufferLength = bufferLen;
1152 }
1153
1154 bytesLeft = len;
1155 bufptr = buf;
1156
1157 while (bytesLeft)
1158 {
1159 int chunk = min((int)sspi->streamSizes.cbMaximumMessage, bytesLeft);
1160 /* Size of data to write */
1161 SECURITY_STATUS scRet; /* SSPI status */
1162
1163 /*
1164 * Copy user data into the buffer, starting just past the header...
1165 */
1166
1167 memcpy(sspi->writeBuffer + sspi->streamSizes.cbHeader, bufptr, chunk);
1168
1169 /*
1170 * Setup the SSPI buffers
1171 */
1172
1173 message.ulVersion = SECBUFFER_VERSION;
1174 message.cBuffers = 4;
1175 message.pBuffers = buffers;
1176
1177 buffers[0].pvBuffer = sspi->writeBuffer;
1178 buffers[0].cbBuffer = sspi->streamSizes.cbHeader;
1179 buffers[0].BufferType = SECBUFFER_STREAM_HEADER;
1180 buffers[1].pvBuffer = sspi->writeBuffer + sspi->streamSizes.cbHeader;
1181 buffers[1].cbBuffer = (unsigned long) chunk;
1182 buffers[1].BufferType = SECBUFFER_DATA;
1183 buffers[2].pvBuffer = sspi->writeBuffer + sspi->streamSizes.cbHeader + chunk;
1184 buffers[2].cbBuffer = sspi->streamSizes.cbTrailer;
1185 buffers[2].BufferType = SECBUFFER_STREAM_TRAILER;
1186 buffers[3].BufferType = SECBUFFER_EMPTY;
1187
1188 /*
1189 * Encrypt the data
1190 */
1191
1192 scRet = EncryptMessage(&sspi->context, 0, &message, 0);
1193
1194 if (FAILED(scRet))
1195 {
1196 DEBUG_printf(("_httpTLSWrite: EncryptMessage failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1197 WSASetLastError(WSASYSCALLFAILURE);
1198 return (-1);
1199 }
1200
1201 /*
1202 * Send the data. Remember the size of the total data to send is the size
1203 * of the header, the size of the data the caller passed in and the size
1204 * of the trailer...
1205 */
1206
1207 num = send(http->fd, sspi->writeBuffer, buffers[0].cbBuffer + buffers[1].cbBuffer + buffers[2].cbBuffer, 0);
1208
1209 if (num <= 0)
1210 {
1211 DEBUG_printf(("_httpTLSWrite: send failed: %ld", WSAGetLastError()));
1212 return (num);
1213 }
1214
1215 bytesLeft -= chunk;
1216 bufptr += chunk;
1217 }
1218
1219 return (len);
1220 }
1221
1222
1223 #if 0
1224 /*
1225 * 'http_setup_ssl()' - Set up SSL/TLS support on a connection.
1226 */
1227
1228 static int /* O - 0 on success, -1 on failure */
1229 http_setup_ssl(http_t *http) /* I - Connection to server */
1230 {
1231 char hostname[256], /* Hostname */
1232 *hostptr; /* Pointer into hostname */
1233
1234 TCHAR username[256]; /* Username returned from GetUserName() */
1235 TCHAR commonName[256];/* Common name for certificate */
1236 DWORD dwSize; /* 32 bit size */
1237
1238
1239 DEBUG_printf(("7http_setup_ssl(http=%p)", http));
1240
1241 /*
1242 * Get the hostname to use for SSL...
1243 */
1244
1245 if (httpAddrLocalhost(http->hostaddr))
1246 {
1247 strlcpy(hostname, "localhost", sizeof(hostname));
1248 }
1249 else
1250 {
1251 /*
1252 * Otherwise make sure the hostname we have does not end in a trailing dot.
1253 */
1254
1255 strlcpy(hostname, http->hostname, sizeof(hostname));
1256 if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
1257 *hostptr == '.')
1258 *hostptr = '\0';
1259 }
1260
1261 http->tls = http_sspi_alloc();
1262
1263 if (!http->tls)
1264 {
1265 _cupsSetHTTPError(HTTP_STATUS_ERROR);
1266 return (-1);
1267 }
1268
1269 dwSize = sizeof(username) / sizeof(TCHAR);
1270 GetUserName(username, &dwSize);
1271 _sntprintf_s(commonName, sizeof(commonName) / sizeof(TCHAR),
1272 sizeof(commonName) / sizeof(TCHAR), TEXT("CN=%s"), username);
1273
1274 if (!_sspiGetCredentials(http->tls, L"ClientContainer",
1275 commonName, FALSE))
1276 {
1277 _sspiFree(http->tls);
1278 http->tls = NULL;
1279
1280 http->error = EIO;
1281 http->status = HTTP_STATUS_ERROR;
1282
1283 _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI,
1284 _("Unable to establish a secure connection to host."), 1);
1285
1286 return (-1);
1287 }
1288
1289 _sspiSetAllowsAnyRoot(http->tls, TRUE);
1290 _sspiSetAllowsExpiredCerts(http->tls, TRUE);
1291
1292 if (!_sspiConnect(http->tls, hostname))
1293 {
1294 _sspiFree(http->tls);
1295 http->tls = NULL;
1296
1297 http->error = EIO;
1298 http->status = HTTP_STATUS_ERROR;
1299
1300 _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI,
1301 _("Unable to establish a secure connection to host."), 1);
1302
1303 return (-1);
1304 }
1305
1306 return (0);
1307 }
1308 #endif // 0
1309
1310
1311 /*
1312 * 'http_sspi_alloc()' - Allocate SSPI object.
1313 */
1314
1315 static _http_sspi_t * /* O - New SSPI/SSL object */
1316 http_sspi_alloc(void)
1317 {
1318 return ((_http_sspi_t *)calloc(sizeof(_http_sspi_t), 1));
1319 }
1320
1321
1322 /*
1323 * 'http_sspi_client()' - Negotiate a TLS connection as a client.
1324 */
1325
1326 static int /* O - 0 on success, -1 on failure */
1327 http_sspi_client(http_t *http, /* I - Client connection */
1328 const char *hostname) /* I - Server hostname */
1329 {
1330 _http_sspi_t *sspi = http->tls; /* SSPI data */
1331 DWORD dwSize; /* Size for buffer */
1332 DWORD dwSSPIFlags; /* SSL connection attributes we want */
1333 DWORD dwSSPIOutFlags; /* SSL connection attributes we got */
1334 TimeStamp tsExpiry; /* Time stamp */
1335 SECURITY_STATUS scRet; /* Status */
1336 int cbData; /* Data count */
1337 SecBufferDesc inBuffer; /* Array of SecBuffer structs */
1338 SecBuffer inBuffers[2]; /* Security package buffer */
1339 SecBufferDesc outBuffer; /* Array of SecBuffer structs */
1340 SecBuffer outBuffers[1]; /* Security package buffer */
1341 int ret = 0; /* Return value */
1342 char username[1024], /* Current username */
1343 common_name[1024]; /* CN=username */
1344
1345
1346 DEBUG_printf(("4http_sspi_client(http=%p, hostname=\"%s\")", http, hostname));
1347
1348 dwSSPIFlags = ISC_REQ_SEQUENCE_DETECT |
1349 ISC_REQ_REPLAY_DETECT |
1350 ISC_REQ_CONFIDENTIALITY |
1351 ISC_RET_EXTENDED_ERROR |
1352 ISC_REQ_ALLOCATE_MEMORY |
1353 ISC_REQ_STREAM;
1354
1355 /*
1356 * Lookup the client certificate...
1357 */
1358
1359 dwSize = sizeof(username);
1360 GetUserName(username, &dwSize);
1361 snprintf(common_name, sizeof(common_name), "CN=%s", username);
1362
1363 if (!http_sspi_find_credentials(http, L"ClientContainer", common_name))
1364 if (!http_sspi_make_credentials(http->tls, L"ClientContainer", common_name, _HTTP_MODE_CLIENT, 10))
1365 {
1366 DEBUG_puts("5http_sspi_client: Unable to get client credentials.");
1367 return (-1);
1368 }
1369
1370 /*
1371 * Initiate a ClientHello message and generate a token.
1372 */
1373
1374 outBuffers[0].pvBuffer = NULL;
1375 outBuffers[0].BufferType = SECBUFFER_TOKEN;
1376 outBuffers[0].cbBuffer = 0;
1377
1378 outBuffer.cBuffers = 1;
1379 outBuffer.pBuffers = outBuffers;
1380 outBuffer.ulVersion = SECBUFFER_VERSION;
1381
1382 scRet = InitializeSecurityContext(&sspi->creds, NULL, TEXT(""), dwSSPIFlags, 0, SECURITY_NATIVE_DREP, NULL, 0, &sspi->context, &outBuffer, &dwSSPIOutFlags, &tsExpiry);
1383
1384 if (scRet != SEC_I_CONTINUE_NEEDED)
1385 {
1386 DEBUG_printf(("5http_sspi_client: InitializeSecurityContext(1) failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1387 return (-1);
1388 }
1389
1390 /*
1391 * Send response to server if there is one.
1392 */
1393
1394 if (outBuffers[0].cbBuffer && outBuffers[0].pvBuffer)
1395 {
1396 if ((cbData = send(http->fd, outBuffers[0].pvBuffer, outBuffers[0].cbBuffer, 0)) <= 0)
1397 {
1398 DEBUG_printf(("5http_sspi_client: send failed: %d", WSAGetLastError()));
1399 FreeContextBuffer(outBuffers[0].pvBuffer);
1400 DeleteSecurityContext(&sspi->context);
1401 return (-1);
1402 }
1403
1404 DEBUG_printf(("5http_sspi_client: %d bytes of handshake data sent.", cbData));
1405
1406 FreeContextBuffer(outBuffers[0].pvBuffer);
1407 outBuffers[0].pvBuffer = NULL;
1408 }
1409
1410 dwSSPIFlags = ISC_REQ_MANUAL_CRED_VALIDATION |
1411 ISC_REQ_SEQUENCE_DETECT |
1412 ISC_REQ_REPLAY_DETECT |
1413 ISC_REQ_CONFIDENTIALITY |
1414 ISC_RET_EXTENDED_ERROR |
1415 ISC_REQ_ALLOCATE_MEMORY |
1416 ISC_REQ_STREAM;
1417
1418 sspi->decryptBufferUsed = 0;
1419
1420 /*
1421 * Loop until the handshake is finished or an error occurs.
1422 */
1423
1424 scRet = SEC_I_CONTINUE_NEEDED;
1425
1426 while(scRet == SEC_I_CONTINUE_NEEDED ||
1427 scRet == SEC_E_INCOMPLETE_MESSAGE ||
1428 scRet == SEC_I_INCOMPLETE_CREDENTIALS)
1429 {
1430 if (sspi->decryptBufferUsed == 0 || scRet == SEC_E_INCOMPLETE_MESSAGE)
1431 {
1432 if (sspi->decryptBufferLength <= sspi->decryptBufferUsed)
1433 {
1434 BYTE *temp; /* New buffer */
1435
1436 if (sspi->decryptBufferLength >= 262144)
1437 {
1438 WSASetLastError(E_OUTOFMEMORY);
1439 DEBUG_puts("5http_sspi_client: Decryption buffer too large (>256k)");
1440 return (-1);
1441 }
1442
1443 if ((temp = realloc(sspi->decryptBuffer, sspi->decryptBufferLength + 4096)) == NULL)
1444 {
1445 DEBUG_printf(("5http_sspi_client: Unable to allocate %d byte buffer.", sspi->decryptBufferLength + 4096));
1446 WSASetLastError(E_OUTOFMEMORY);
1447 return (-1);
1448 }
1449
1450 sspi->decryptBufferLength += 4096;
1451 sspi->decryptBuffer = temp;
1452 }
1453
1454 cbData = recv(http->fd, sspi->decryptBuffer + sspi->decryptBufferUsed, (int)(sspi->decryptBufferLength - sspi->decryptBufferUsed), 0);
1455
1456 if (cbData < 0)
1457 {
1458 DEBUG_printf(("5http_sspi_client: recv failed: %d", WSAGetLastError()));
1459 return (-1);
1460 }
1461 else if (cbData == 0)
1462 {
1463 DEBUG_printf(("5http_sspi_client: Server unexpectedly disconnected."));
1464 return (-1);
1465 }
1466
1467 DEBUG_printf(("5http_sspi_client: %d bytes of handshake data received", cbData));
1468
1469 sspi->decryptBufferUsed += cbData;
1470 }
1471
1472 /*
1473 * Set up the input buffers. Buffer 0 is used to pass in data received from
1474 * the server. Schannel will consume some or all of this. Leftover data
1475 * (if any) will be placed in buffer 1 and given a buffer type of
1476 * SECBUFFER_EXTRA.
1477 */
1478
1479 inBuffers[0].pvBuffer = sspi->decryptBuffer;
1480 inBuffers[0].cbBuffer = (unsigned long)sspi->decryptBufferUsed;
1481 inBuffers[0].BufferType = SECBUFFER_TOKEN;
1482
1483 inBuffers[1].pvBuffer = NULL;
1484 inBuffers[1].cbBuffer = 0;
1485 inBuffers[1].BufferType = SECBUFFER_EMPTY;
1486
1487 inBuffer.cBuffers = 2;
1488 inBuffer.pBuffers = inBuffers;
1489 inBuffer.ulVersion = SECBUFFER_VERSION;
1490
1491 /*
1492 * Set up the output buffers. These are initialized to NULL so as to make it
1493 * less likely we'll attempt to free random garbage later.
1494 */
1495
1496 outBuffers[0].pvBuffer = NULL;
1497 outBuffers[0].BufferType = SECBUFFER_TOKEN;
1498 outBuffers[0].cbBuffer = 0;
1499
1500 outBuffer.cBuffers = 1;
1501 outBuffer.pBuffers = outBuffers;
1502 outBuffer.ulVersion = SECBUFFER_VERSION;
1503
1504 /*
1505 * Call InitializeSecurityContext.
1506 */
1507
1508 scRet = InitializeSecurityContext(&sspi->creds, &sspi->context, NULL, dwSSPIFlags, 0, SECURITY_NATIVE_DREP, &inBuffer, 0, NULL, &outBuffer, &dwSSPIOutFlags, &tsExpiry);
1509
1510 /*
1511 * If InitializeSecurityContext was successful (or if the error was one of
1512 * the special extended ones), send the contents of the output buffer to the
1513 * server.
1514 */
1515
1516 if (scRet == SEC_E_OK ||
1517 scRet == SEC_I_CONTINUE_NEEDED ||
1518 FAILED(scRet) && (dwSSPIOutFlags & ISC_RET_EXTENDED_ERROR))
1519 {
1520 if (outBuffers[0].cbBuffer && outBuffers[0].pvBuffer)
1521 {
1522 cbData = send(http->fd, outBuffers[0].pvBuffer, outBuffers[0].cbBuffer, 0);
1523
1524 if (cbData <= 0)
1525 {
1526 DEBUG_printf(("5http_sspi_client: send failed: %d", WSAGetLastError()));
1527 FreeContextBuffer(outBuffers[0].pvBuffer);
1528 DeleteSecurityContext(&sspi->context);
1529 return (-1);
1530 }
1531
1532 DEBUG_printf(("5http_sspi_client: %d bytes of handshake data sent.", cbData));
1533
1534 /*
1535 * Free output buffer.
1536 */
1537
1538 FreeContextBuffer(outBuffers[0].pvBuffer);
1539 outBuffers[0].pvBuffer = NULL;
1540 }
1541 }
1542
1543 /*
1544 * If InitializeSecurityContext returned SEC_E_INCOMPLETE_MESSAGE, then we
1545 * need to read more data from the server and try again.
1546 */
1547
1548 if (scRet == SEC_E_INCOMPLETE_MESSAGE)
1549 continue;
1550
1551 /*
1552 * If InitializeSecurityContext returned SEC_E_OK, then the handshake
1553 * completed successfully.
1554 */
1555
1556 if (scRet == SEC_E_OK)
1557 {
1558 /*
1559 * If the "extra" buffer contains data, this is encrypted application
1560 * protocol layer stuff. It needs to be saved. The application layer will
1561 * later decrypt it with DecryptMessage.
1562 */
1563
1564 DEBUG_puts("5http_sspi_client: Handshake was successful.");
1565
1566 if (inBuffers[1].BufferType == SECBUFFER_EXTRA)
1567 {
1568 memmove(sspi->decryptBuffer, sspi->decryptBuffer + sspi->decryptBufferUsed - inBuffers[1].cbBuffer, inBuffers[1].cbBuffer);
1569
1570 sspi->decryptBufferUsed = inBuffers[1].cbBuffer;
1571
1572 DEBUG_printf(("5http_sspi_client: %d bytes of app data was bundled with handshake data", sspi->decryptBufferUsed));
1573 }
1574 else
1575 sspi->decryptBufferUsed = 0;
1576
1577 /*
1578 * Bail out to quit
1579 */
1580
1581 break;
1582 }
1583
1584 /*
1585 * Check for fatal error.
1586 */
1587
1588 if (FAILED(scRet))
1589 {
1590 DEBUG_printf(("5http_sspi_client: InitializeSecurityContext(2) failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1591 ret = -1;
1592 break;
1593 }
1594
1595 /*
1596 * If InitializeSecurityContext returned SEC_I_INCOMPLETE_CREDENTIALS,
1597 * then the server just requested client authentication.
1598 */
1599
1600 if (scRet == SEC_I_INCOMPLETE_CREDENTIALS)
1601 {
1602 /*
1603 * Unimplemented
1604 */
1605
1606 DEBUG_printf(("5http_sspi_client: server requested client credentials."));
1607 ret = -1;
1608 break;
1609 }
1610
1611 /*
1612 * Copy any leftover data from the "extra" buffer, and go around again.
1613 */
1614
1615 if (inBuffers[1].BufferType == SECBUFFER_EXTRA)
1616 {
1617 memmove(sspi->decryptBuffer, sspi->decryptBuffer + sspi->decryptBufferUsed - inBuffers[1].cbBuffer, inBuffers[1].cbBuffer);
1618
1619 sspi->decryptBufferUsed = inBuffers[1].cbBuffer;
1620 }
1621 else
1622 {
1623 sspi->decryptBufferUsed = 0;
1624 }
1625 }
1626
1627 if (!ret)
1628 {
1629 /*
1630 * Success! Get the server cert
1631 */
1632
1633 sspi->contextInitialized = TRUE;
1634
1635 scRet = QueryContextAttributes(&sspi->context, SECPKG_ATTR_REMOTE_CERT_CONTEXT, (VOID *)&(sspi->remoteCert));
1636
1637 if (scRet != SEC_E_OK)
1638 {
1639 DEBUG_printf(("5http_sspi_client: QueryContextAttributes failed(SECPKG_ATTR_REMOTE_CERT_CONTEXT): %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1640 return (-1);
1641 }
1642
1643 /*
1644 * Find out how big the header/trailer will be:
1645 */
1646
1647 scRet = QueryContextAttributes(&sspi->context, SECPKG_ATTR_STREAM_SIZES, &sspi->streamSizes);
1648
1649 if (scRet != SEC_E_OK)
1650 {
1651 DEBUG_printf(("5http_sspi_client: QueryContextAttributes failed(SECPKG_ATTR_STREAM_SIZES): %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1652 ret = -1;
1653 }
1654 }
1655
1656 return (ret);
1657 }
1658
1659
1660 /*
1661 * 'http_sspi_create_credential()' - Create an SSPI certificate context.
1662 */
1663
1664 static PCCERT_CONTEXT /* O - Certificate context */
1665 http_sspi_create_credential(
1666 http_credential_t *cred) /* I - Credential */
1667 {
1668 if (cred)
1669 return (CertCreateCertificateContext(X509_ASN_ENCODING, cred->data, cred->datalen));
1670 else
1671 return (NULL);
1672 }
1673
1674
1675 /*
1676 * 'http_sspi_find_credentials()' - Retrieve a TLS certificate from the system store.
1677 */
1678
1679 static BOOL /* O - 1 on success, 0 on failure */
1680 http_sspi_find_credentials(
1681 http_t *http, /* I - HTTP connection */
1682 const LPWSTR container, /* I - Cert container name */
1683 const char *common_name) /* I - Common name of certificate */
1684 {
1685 _http_sspi_t *sspi = http->tls; /* SSPI data */
1686 HCERTSTORE store = NULL; /* Certificate store */
1687 PCCERT_CONTEXT storedContext = NULL; /* Context created from the store */
1688 DWORD dwSize = 0; /* 32 bit size */
1689 PBYTE p = NULL; /* Temporary storage */
1690 HCRYPTPROV hProv = (HCRYPTPROV)NULL;
1691 /* Handle to a CSP */
1692 CERT_NAME_BLOB sib; /* Arbitrary array of bytes */
1693 SCHANNEL_CRED SchannelCred; /* Schannel credential data */
1694 TimeStamp tsExpiry; /* Time stamp */
1695 SECURITY_STATUS Status; /* Status */
1696 BOOL ok = TRUE; /* Return value */
1697
1698
1699 if (!CryptAcquireContextW(&hProv, (LPWSTR)container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET))
1700 {
1701 if (GetLastError() == NTE_EXISTS)
1702 {
1703 if (!CryptAcquireContextW(&hProv, (LPWSTR)container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
1704 {
1705 DEBUG_printf(("5http_sspi_find_credentials: CryptAcquireContext failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1706 ok = FALSE;
1707 goto cleanup;
1708 }
1709 }
1710 }
1711
1712 store = CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING|PKCS_7_ASN_ENCODING, hProv, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_NO_CRYPT_RELEASE_FLAG | CERT_STORE_OPEN_EXISTING_FLAG, L"MY");
1713
1714 if (!store)
1715 {
1716 DEBUG_printf(("5http_sspi_find_credentials: CertOpenSystemStore failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1717 ok = FALSE;
1718 goto cleanup;
1719 }
1720
1721 dwSize = 0;
1722
1723 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, NULL, &dwSize, NULL))
1724 {
1725 DEBUG_printf(("5http_sspi_find_credentials: CertStrToName failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1726 ok = FALSE;
1727 goto cleanup;
1728 }
1729
1730 p = (PBYTE)malloc(dwSize);
1731
1732 if (!p)
1733 {
1734 DEBUG_printf(("5http_sspi_find_credentials: malloc failed for %d bytes.", dwSize));
1735 ok = FALSE;
1736 goto cleanup;
1737 }
1738
1739 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, p, &dwSize, NULL))
1740 {
1741 DEBUG_printf(("5http_sspi_find_credentials: CertStrToName failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1742 ok = FALSE;
1743 goto cleanup;
1744 }
1745
1746 sib.cbData = dwSize;
1747 sib.pbData = p;
1748
1749 storedContext = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_SUBJECT_NAME, &sib, NULL);
1750
1751 if (!storedContext)
1752 {
1753 DEBUG_printf(("5http_sspi_find_credentials: Unable to find credentials for \"%s\".", common_name));
1754 ok = FALSE;
1755 goto cleanup;
1756 }
1757
1758 ZeroMemory(&SchannelCred, sizeof(SchannelCred));
1759
1760 SchannelCred.dwVersion = SCHANNEL_CRED_VERSION;
1761 SchannelCred.cCreds = 1;
1762 SchannelCred.paCred = &storedContext;
1763
1764 /*
1765 * Set supported protocols (can also be overriden in the registry...)
1766 */
1767
1768 #ifdef SP_PROT_TLS1_2_SERVER
1769 if (http->mode == _HTTP_MODE_SERVER)
1770 {
1771 if (tls_options & _HTTP_TLS_DENY_TLS10)
1772 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER;
1773 else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
1774 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_0_SERVER | SP_PROT_SSL3_SERVER;
1775 else
1776 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_0_SERVER;
1777 }
1778 else
1779 {
1780 if (tls_options & _HTTP_TLS_DENY_TLS10)
1781 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT;
1782 else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
1783 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_0_CLIENT | SP_PROT_SSL3_CLIENT;
1784 else
1785 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_0_CLIENT;
1786 }
1787
1788 #else
1789 if (http->mode == _HTTP_MODE_SERVER)
1790 {
1791 if (tls_min_version == _HTTP_TLS_SSL3)
1792 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_SERVER | SP_PROT_SSL3_SERVER;
1793 else
1794 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_SERVER;
1795 }
1796 else
1797 {
1798 if (tls_min_version == _HTTP_TLS_SSL3)
1799 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT | SP_PROT_SSL3_CLIENT;
1800 else
1801 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT;
1802 }
1803 #endif /* SP_PROT_TLS1_2_SERVER */
1804
1805 /* TODO: Support _HTTP_TLS_ALLOW_RC4, _HTTP_TLS_ALLOW_DH, and _HTTP_TLS_DENY_CBC options; right now we'll rely on Windows registry to enable/disable RC4/DH/CBC... */
1806
1807 /*
1808 * Create an SSPI credential.
1809 */
1810
1811 Status = AcquireCredentialsHandle(NULL, UNISP_NAME, http->mode == _HTTP_MODE_SERVER ? SECPKG_CRED_INBOUND : SECPKG_CRED_OUTBOUND, NULL, &SchannelCred, NULL, NULL, &sspi->creds, &tsExpiry);
1812 if (Status != SEC_E_OK)
1813 {
1814 DEBUG_printf(("5http_sspi_find_credentials: AcquireCredentialsHandle failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), Status)));
1815 ok = FALSE;
1816 goto cleanup;
1817 }
1818
1819 cleanup:
1820
1821 /*
1822 * Cleanup
1823 */
1824
1825 if (storedContext)
1826 CertFreeCertificateContext(storedContext);
1827
1828 if (p)
1829 free(p);
1830
1831 if (store)
1832 CertCloseStore(store, 0);
1833
1834 if (hProv)
1835 CryptReleaseContext(hProv, 0);
1836
1837 return (ok);
1838 }
1839
1840
1841 /*
1842 * 'http_sspi_free()' - Close a connection and free resources.
1843 */
1844
1845 static void
1846 http_sspi_free(_http_sspi_t *sspi) /* I - SSPI data */
1847 {
1848 if (!sspi)
1849 return;
1850
1851 if (sspi->contextInitialized)
1852 DeleteSecurityContext(&sspi->context);
1853
1854 if (sspi->decryptBuffer)
1855 free(sspi->decryptBuffer);
1856
1857 if (sspi->readBuffer)
1858 free(sspi->readBuffer);
1859
1860 if (sspi->writeBuffer)
1861 free(sspi->writeBuffer);
1862
1863 if (sspi->localCert)
1864 CertFreeCertificateContext(sspi->localCert);
1865
1866 if (sspi->remoteCert)
1867 CertFreeCertificateContext(sspi->remoteCert);
1868
1869 free(sspi);
1870 }
1871
1872
1873 /*
1874 * 'http_sspi_make_credentials()' - Create a TLS certificate in the system store.
1875 */
1876
1877 static BOOL /* O - 1 on success, 0 on failure */
1878 http_sspi_make_credentials(
1879 _http_sspi_t *sspi, /* I - SSPI data */
1880 const LPWSTR container, /* I - Cert container name */
1881 const char *common_name, /* I - Common name of certificate */
1882 _http_mode_t mode, /* I - Client or server? */
1883 int years) /* I - Years until expiration */
1884 {
1885 HCERTSTORE store = NULL; /* Certificate store */
1886 PCCERT_CONTEXT storedContext = NULL; /* Context created from the store */
1887 PCCERT_CONTEXT createdContext = NULL; /* Context created by us */
1888 DWORD dwSize = 0; /* 32 bit size */
1889 PBYTE p = NULL; /* Temporary storage */
1890 HCRYPTPROV hProv = (HCRYPTPROV)NULL;
1891 /* Handle to a CSP */
1892 CERT_NAME_BLOB sib; /* Arbitrary array of bytes */
1893 SCHANNEL_CRED SchannelCred; /* Schannel credential data */
1894 TimeStamp tsExpiry; /* Time stamp */
1895 SECURITY_STATUS Status; /* Status */
1896 HCRYPTKEY hKey = (HCRYPTKEY)NULL; /* Handle to crypto key */
1897 CRYPT_KEY_PROV_INFO kpi; /* Key container info */
1898 SYSTEMTIME et; /* System time */
1899 CERT_EXTENSIONS exts; /* Array of cert extensions */
1900 CRYPT_KEY_PROV_INFO ckp; /* Handle to crypto key */
1901 BOOL ok = TRUE; /* Return value */
1902
1903
1904 DEBUG_printf(("4http_sspi_make_credentials(sspi=%p, container=%p, common_name=\"%s\", mode=%d, years=%d)", sspi, container, common_name, mode, years));
1905
1906 if (!CryptAcquireContextW(&hProv, (LPWSTR)container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET))
1907 {
1908 if (GetLastError() == NTE_EXISTS)
1909 {
1910 if (!CryptAcquireContextW(&hProv, (LPWSTR)container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
1911 {
1912 DEBUG_printf(("5http_sspi_make_credentials: CryptAcquireContext failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1913 ok = FALSE;
1914 goto cleanup;
1915 }
1916 }
1917 }
1918
1919 store = CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING|PKCS_7_ASN_ENCODING, hProv, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_NO_CRYPT_RELEASE_FLAG | CERT_STORE_OPEN_EXISTING_FLAG, L"MY");
1920
1921 if (!store)
1922 {
1923 DEBUG_printf(("5http_sspi_make_credentials: CertOpenSystemStore failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1924 ok = FALSE;
1925 goto cleanup;
1926 }
1927
1928 dwSize = 0;
1929
1930 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, NULL, &dwSize, NULL))
1931 {
1932 DEBUG_printf(("5http_sspi_make_credentials: CertStrToName failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1933 ok = FALSE;
1934 goto cleanup;
1935 }
1936
1937 p = (PBYTE)malloc(dwSize);
1938
1939 if (!p)
1940 {
1941 DEBUG_printf(("5http_sspi_make_credentials: malloc failed for %d bytes", dwSize));
1942 ok = FALSE;
1943 goto cleanup;
1944 }
1945
1946 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, p, &dwSize, NULL))
1947 {
1948 DEBUG_printf(("5http_sspi_make_credentials: CertStrToName failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1949 ok = FALSE;
1950 goto cleanup;
1951 }
1952
1953 /*
1954 * Create a private key and self-signed certificate...
1955 */
1956
1957 if (!CryptGenKey(hProv, AT_KEYEXCHANGE, CRYPT_EXPORTABLE, &hKey))
1958 {
1959 DEBUG_printf(("5http_sspi_make_credentials: CryptGenKey failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1960 ok = FALSE;
1961 goto cleanup;
1962 }
1963
1964 ZeroMemory(&kpi, sizeof(kpi));
1965 kpi.pwszContainerName = (LPWSTR)container;
1966 kpi.pwszProvName = MS_DEF_PROV_W;
1967 kpi.dwProvType = PROV_RSA_FULL;
1968 kpi.dwFlags = CERT_SET_KEY_CONTEXT_PROP_ID;
1969 kpi.dwKeySpec = AT_KEYEXCHANGE;
1970
1971 GetSystemTime(&et);
1972 et.wYear += years;
1973
1974 ZeroMemory(&exts, sizeof(exts));
1975
1976 createdContext = CertCreateSelfSignCertificate(hProv, &sib, 0, &kpi, NULL, NULL, &et, &exts);
1977
1978 if (!createdContext)
1979 {
1980 DEBUG_printf(("5http_sspi_make_credentials: CertCreateSelfSignCertificate failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1981 ok = FALSE;
1982 goto cleanup;
1983 }
1984
1985 /*
1986 * Add the created context to the named store, and associate it with the named
1987 * container...
1988 */
1989
1990 if (!CertAddCertificateContextToStore(store, createdContext, CERT_STORE_ADD_REPLACE_EXISTING, &storedContext))
1991 {
1992 DEBUG_printf(("5http_sspi_make_credentials: CertAddCertificateContextToStore failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1993 ok = FALSE;
1994 goto cleanup;
1995 }
1996
1997 ZeroMemory(&ckp, sizeof(ckp));
1998 ckp.pwszContainerName = (LPWSTR) container;
1999 ckp.pwszProvName = MS_DEF_PROV_W;
2000 ckp.dwProvType = PROV_RSA_FULL;
2001 ckp.dwFlags = CRYPT_MACHINE_KEYSET;
2002 ckp.dwKeySpec = AT_KEYEXCHANGE;
2003
2004 if (!CertSetCertificateContextProperty(storedContext, CERT_KEY_PROV_INFO_PROP_ID, 0, &ckp))
2005 {
2006 DEBUG_printf(("5http_sspi_make_credentials: CertSetCertificateContextProperty failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
2007 ok = FALSE;
2008 goto cleanup;
2009 }
2010
2011 /*
2012 * Get a handle to use the certificate...
2013 */
2014
2015 ZeroMemory(&SchannelCred, sizeof(SchannelCred));
2016
2017 SchannelCred.dwVersion = SCHANNEL_CRED_VERSION;
2018 SchannelCred.cCreds = 1;
2019 SchannelCred.paCred = &storedContext;
2020
2021 /*
2022 * SSPI doesn't seem to like it if grbitEnabledProtocols is set for a client.
2023 */
2024
2025 if (mode == _HTTP_MODE_SERVER)
2026 SchannelCred.grbitEnabledProtocols = SP_PROT_SSL3TLS1;
2027
2028 /*
2029 * Create an SSPI credential.
2030 */
2031
2032 Status = AcquireCredentialsHandle(NULL, UNISP_NAME, mode == _HTTP_MODE_SERVER ? SECPKG_CRED_INBOUND : SECPKG_CRED_OUTBOUND, NULL, &SchannelCred, NULL, NULL, &sspi->creds, &tsExpiry);
2033 if (Status != SEC_E_OK)
2034 {
2035 DEBUG_printf(("5http_sspi_make_credentials: AcquireCredentialsHandle failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), Status)));
2036 ok = FALSE;
2037 goto cleanup;
2038 }
2039
2040 cleanup:
2041
2042 /*
2043 * Cleanup
2044 */
2045
2046 if (hKey)
2047 CryptDestroyKey(hKey);
2048
2049 if (createdContext)
2050 CertFreeCertificateContext(createdContext);
2051
2052 if (storedContext)
2053 CertFreeCertificateContext(storedContext);
2054
2055 if (p)
2056 free(p);
2057
2058 if (store)
2059 CertCloseStore(store, 0);
2060
2061 if (hProv)
2062 CryptReleaseContext(hProv, 0);
2063
2064 return (ok);
2065 }
2066
2067
2068 /*
2069 * 'http_sspi_server()' - Negotiate a TLS connection as a server.
2070 */
2071
2072 static int /* O - 0 on success, -1 on failure */
2073 http_sspi_server(http_t *http, /* I - HTTP connection */
2074 const char *hostname) /* I - Hostname of server */
2075 {
2076 _http_sspi_t *sspi = http->tls; /* I - SSPI data */
2077 char common_name[512]; /* Common name for cert */
2078 DWORD dwSSPIFlags; /* SSL connection attributes we want */
2079 DWORD dwSSPIOutFlags; /* SSL connection attributes we got */
2080 TimeStamp tsExpiry; /* Time stamp */
2081 SECURITY_STATUS scRet; /* SSPI Status */
2082 SecBufferDesc inBuffer; /* Array of SecBuffer structs */
2083 SecBuffer inBuffers[2]; /* Security package buffer */
2084 SecBufferDesc outBuffer; /* Array of SecBuffer structs */
2085 SecBuffer outBuffers[1]; /* Security package buffer */
2086 int num = 0; /* 32 bit status value */
2087 BOOL fInitContext = TRUE; /* Has the context been init'd? */
2088 int ret = 0; /* Return value */
2089
2090
2091 DEBUG_printf(("4http_sspi_server(http=%p, hostname=\"%s\")", http, hostname));
2092
2093 dwSSPIFlags = ASC_REQ_SEQUENCE_DETECT |
2094 ASC_REQ_REPLAY_DETECT |
2095 ASC_REQ_CONFIDENTIALITY |
2096 ASC_REQ_EXTENDED_ERROR |
2097 ASC_REQ_ALLOCATE_MEMORY |
2098 ASC_REQ_STREAM;
2099
2100 sspi->decryptBufferUsed = 0;
2101
2102 /*
2103 * Lookup the server certificate...
2104 */
2105
2106 snprintf(common_name, sizeof(common_name), "CN=%s", hostname);
2107
2108 if (!http_sspi_find_credentials(http, L"ServerContainer", common_name))
2109 if (!http_sspi_make_credentials(http->tls, L"ServerContainer", common_name, _HTTP_MODE_SERVER, 10))
2110 {
2111 DEBUG_puts("5http_sspi_server: Unable to get server credentials.");
2112 return (-1);
2113 }
2114
2115 /*
2116 * Set OutBuffer for AcceptSecurityContext call
2117 */
2118
2119 outBuffer.cBuffers = 1;
2120 outBuffer.pBuffers = outBuffers;
2121 outBuffer.ulVersion = SECBUFFER_VERSION;
2122
2123 scRet = SEC_I_CONTINUE_NEEDED;
2124
2125 while (scRet == SEC_I_CONTINUE_NEEDED ||
2126 scRet == SEC_E_INCOMPLETE_MESSAGE ||
2127 scRet == SEC_I_INCOMPLETE_CREDENTIALS)
2128 {
2129 if (sspi->decryptBufferUsed == 0 || scRet == SEC_E_INCOMPLETE_MESSAGE)
2130 {
2131 if (sspi->decryptBufferLength <= sspi->decryptBufferUsed)
2132 {
2133 BYTE *temp; /* New buffer */
2134
2135 if (sspi->decryptBufferLength >= 262144)
2136 {
2137 WSASetLastError(E_OUTOFMEMORY);
2138 DEBUG_puts("5http_sspi_server: Decryption buffer too large (>256k)");
2139 return (-1);
2140 }
2141
2142 if ((temp = realloc(sspi->decryptBuffer, sspi->decryptBufferLength + 4096)) == NULL)
2143 {
2144 DEBUG_printf(("5http_sspi_server: Unable to allocate %d byte buffer.", sspi->decryptBufferLength + 4096));
2145 WSASetLastError(E_OUTOFMEMORY);
2146 return (-1);
2147 }
2148
2149 sspi->decryptBufferLength += 4096;
2150 sspi->decryptBuffer = temp;
2151 }
2152
2153 for (;;)
2154 {
2155 num = recv(http->fd, sspi->decryptBuffer + sspi->decryptBufferUsed, (int)(sspi->decryptBufferLength - sspi->decryptBufferUsed), 0);
2156
2157 if (num == -1 && WSAGetLastError() == WSAEWOULDBLOCK)
2158 Sleep(1);
2159 else
2160 break;
2161 }
2162
2163 if (num < 0)
2164 {
2165 DEBUG_printf(("5http_sspi_server: recv failed: %d", WSAGetLastError()));
2166 return (-1);
2167 }
2168 else if (num == 0)
2169 {
2170 DEBUG_puts("5http_sspi_server: client disconnected");
2171 return (-1);
2172 }
2173
2174 DEBUG_printf(("5http_sspi_server: received %d (handshake) bytes from client.", num));
2175 sspi->decryptBufferUsed += num;
2176 }
2177
2178 /*
2179 * InBuffers[1] is for getting extra data that SSPI/SCHANNEL doesn't process
2180 * on this run around the loop.
2181 */
2182
2183 inBuffers[0].pvBuffer = sspi->decryptBuffer;
2184 inBuffers[0].cbBuffer = (unsigned long)sspi->decryptBufferUsed;
2185 inBuffers[0].BufferType = SECBUFFER_TOKEN;
2186
2187 inBuffers[1].pvBuffer = NULL;
2188 inBuffers[1].cbBuffer = 0;
2189 inBuffers[1].BufferType = SECBUFFER_EMPTY;
2190
2191 inBuffer.cBuffers = 2;
2192 inBuffer.pBuffers = inBuffers;
2193 inBuffer.ulVersion = SECBUFFER_VERSION;
2194
2195 /*
2196 * Initialize these so if we fail, pvBuffer contains NULL, so we don't try to
2197 * free random garbage at the quit.
2198 */
2199
2200 outBuffers[0].pvBuffer = NULL;
2201 outBuffers[0].BufferType = SECBUFFER_TOKEN;
2202 outBuffers[0].cbBuffer = 0;
2203
2204 scRet = AcceptSecurityContext(&sspi->creds, (fInitContext?NULL:&sspi->context), &inBuffer, dwSSPIFlags, SECURITY_NATIVE_DREP, (fInitContext?&sspi->context:NULL), &outBuffer, &dwSSPIOutFlags, &tsExpiry);
2205
2206 fInitContext = FALSE;
2207
2208 if (scRet == SEC_E_OK ||
2209 scRet == SEC_I_CONTINUE_NEEDED ||
2210 (FAILED(scRet) && ((dwSSPIOutFlags & ISC_RET_EXTENDED_ERROR) != 0)))
2211 {
2212 if (outBuffers[0].cbBuffer && outBuffers[0].pvBuffer)
2213 {
2214 /*
2215 * Send response to server if there is one.
2216 */
2217
2218 num = send(http->fd, outBuffers[0].pvBuffer, outBuffers[0].cbBuffer, 0);
2219
2220 if (num <= 0)
2221 {
2222 DEBUG_printf(("5http_sspi_server: handshake send failed: %d", WSAGetLastError()));
2223 return (-1);
2224 }
2225
2226 DEBUG_printf(("5http_sspi_server: sent %d handshake bytes to client.", outBuffers[0].cbBuffer));
2227
2228 FreeContextBuffer(outBuffers[0].pvBuffer);
2229 outBuffers[0].pvBuffer = NULL;
2230 }
2231 }
2232
2233 if (scRet == SEC_E_OK)
2234 {
2235 /*
2236 * If there's extra data then save it for next time we go to decrypt.
2237 */
2238
2239 if (inBuffers[1].BufferType == SECBUFFER_EXTRA)
2240 {
2241 memcpy(sspi->decryptBuffer, (LPBYTE)(sspi->decryptBuffer + sspi->decryptBufferUsed - inBuffers[1].cbBuffer), inBuffers[1].cbBuffer);
2242 sspi->decryptBufferUsed = inBuffers[1].cbBuffer;
2243 }
2244 else
2245 {
2246 sspi->decryptBufferUsed = 0;
2247 }
2248 break;
2249 }
2250 else if (FAILED(scRet) && scRet != SEC_E_INCOMPLETE_MESSAGE)
2251 {
2252 DEBUG_printf(("5http_sspi_server: AcceptSecurityContext failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
2253 ret = -1;
2254 break;
2255 }
2256
2257 if (scRet != SEC_E_INCOMPLETE_MESSAGE &&
2258 scRet != SEC_I_INCOMPLETE_CREDENTIALS)
2259 {
2260 if (inBuffers[1].BufferType == SECBUFFER_EXTRA)
2261 {
2262 memcpy(sspi->decryptBuffer, (LPBYTE)(sspi->decryptBuffer + sspi->decryptBufferUsed - inBuffers[1].cbBuffer), inBuffers[1].cbBuffer);
2263 sspi->decryptBufferUsed = inBuffers[1].cbBuffer;
2264 }
2265 else
2266 {
2267 sspi->decryptBufferUsed = 0;
2268 }
2269 }
2270 }
2271
2272 if (!ret)
2273 {
2274 sspi->contextInitialized = TRUE;
2275
2276 /*
2277 * Find out how big the header will be:
2278 */
2279
2280 scRet = QueryContextAttributes(&sspi->context, SECPKG_ATTR_STREAM_SIZES, &sspi->streamSizes);
2281
2282 if (scRet != SEC_E_OK)
2283 {
2284 DEBUG_printf(("5http_sspi_server: QueryContextAttributes failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
2285 ret = -1;
2286 }
2287 }
2288
2289 return (ret);
2290 }
2291
2292
2293 /*
2294 * 'http_sspi_strerror()' - Return a string for the specified error code.
2295 */
2296
2297 static const char * /* O - String for error */
2298 http_sspi_strerror(char *buffer, /* I - Error message buffer */
2299 size_t bufsize, /* I - Size of buffer */
2300 DWORD code) /* I - Error code */
2301 {
2302 if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, code, 0, buffer, bufsize, NULL))
2303 {
2304 /*
2305 * Strip trailing CR + LF...
2306 */
2307
2308 char *ptr; /* Pointer into error message */
2309
2310 for (ptr = buffer + strlen(buffer) - 1; ptr >= buffer; ptr --)
2311 if (*ptr == '\n' || *ptr == '\r')
2312 *ptr = '\0';
2313 else
2314 break;
2315 }
2316 else
2317 snprintf(buffer, bufsize, "Unknown error %x", code);
2318
2319 return (buffer);
2320 }
2321
2322
2323 /*
2324 * 'http_sspi_verify()' - Verify a certificate.
2325 */
2326
2327 static DWORD /* O - Error code (0 == No error) */
2328 http_sspi_verify(
2329 PCCERT_CONTEXT cert, /* I - Server certificate */
2330 const char *common_name, /* I - Common name */
2331 DWORD dwCertFlags) /* I - Verification flags */
2332 {
2333 HTTPSPolicyCallbackData httpsPolicy; /* HTTPS Policy Struct */
2334 CERT_CHAIN_POLICY_PARA policyPara; /* Cert chain policy parameters */
2335 CERT_CHAIN_POLICY_STATUS policyStatus;/* Cert chain policy status */
2336 CERT_CHAIN_PARA chainPara; /* Used for searching and matching criteria */
2337 PCCERT_CHAIN_CONTEXT chainContext = NULL;
2338 /* Certificate chain */
2339 PWSTR commonNameUnicode = NULL;
2340 /* Unicode common name */
2341 LPSTR rgszUsages[] = { szOID_PKIX_KP_SERVER_AUTH,
2342 szOID_SERVER_GATED_CRYPTO,
2343 szOID_SGC_NETSCAPE };
2344 /* How are we using this certificate? */
2345 DWORD cUsages = sizeof(rgszUsages) / sizeof(LPSTR);
2346 /* Number of ites in rgszUsages */
2347 DWORD count; /* 32 bit count variable */
2348 DWORD status; /* Return value */
2349 #ifdef DEBUG
2350 char error[1024]; /* Error message string */
2351 #endif /* DEBUG */
2352
2353
2354 if (!cert)
2355 return (SEC_E_WRONG_PRINCIPAL);
2356
2357 /*
2358 * Convert common name to Unicode.
2359 */
2360
2361 if (!common_name || !*common_name)
2362 return (SEC_E_WRONG_PRINCIPAL);
2363
2364 count = MultiByteToWideChar(CP_ACP, 0, common_name, -1, NULL, 0);
2365 commonNameUnicode = LocalAlloc(LMEM_FIXED, count * sizeof(WCHAR));
2366 if (!commonNameUnicode)
2367 return (SEC_E_INSUFFICIENT_MEMORY);
2368
2369 if (!MultiByteToWideChar(CP_ACP, 0, common_name, -1, commonNameUnicode, count))
2370 {
2371 LocalFree(commonNameUnicode);
2372 return (SEC_E_WRONG_PRINCIPAL);
2373 }
2374
2375 /*
2376 * Build certificate chain.
2377 */
2378
2379 ZeroMemory(&chainPara, sizeof(chainPara));
2380
2381 chainPara.cbSize = sizeof(chainPara);
2382 chainPara.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR;
2383 chainPara.RequestedUsage.Usage.cUsageIdentifier = cUsages;
2384 chainPara.RequestedUsage.Usage.rgpszUsageIdentifier = rgszUsages;
2385
2386 if (!CertGetCertificateChain(NULL, cert, NULL, cert->hCertStore, &chainPara, 0, NULL, &chainContext))
2387 {
2388 status = GetLastError();
2389
2390 DEBUG_printf(("CertGetCertificateChain returned: %s", http_sspi_strerror(error, sizeof(error), status)));
2391
2392 LocalFree(commonNameUnicode);
2393 return (status);
2394 }
2395
2396 /*
2397 * Validate certificate chain.
2398 */
2399
2400 ZeroMemory(&httpsPolicy, sizeof(HTTPSPolicyCallbackData));
2401 httpsPolicy.cbStruct = sizeof(HTTPSPolicyCallbackData);
2402 httpsPolicy.dwAuthType = AUTHTYPE_SERVER;
2403 httpsPolicy.fdwChecks = dwCertFlags;
2404 httpsPolicy.pwszServerName = commonNameUnicode;
2405
2406 memset(&policyPara, 0, sizeof(policyPara));
2407 policyPara.cbSize = sizeof(policyPara);
2408 policyPara.pvExtraPolicyPara = &httpsPolicy;
2409
2410 memset(&policyStatus, 0, sizeof(policyStatus));
2411 policyStatus.cbSize = sizeof(policyStatus);
2412
2413 if (!CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_SSL, chainContext, &policyPara, &policyStatus))
2414 {
2415 status = GetLastError();
2416
2417 DEBUG_printf(("CertVerifyCertificateChainPolicy returned %s", http_sspi_strerror(error, sizeof(error), status)));
2418 }
2419 else if (policyStatus.dwError)
2420 status = policyStatus.dwError;
2421 else
2422 status = SEC_E_OK;
2423
2424 if (chainContext)
2425 CertFreeCertificateChain(chainContext);
2426
2427 if (commonNameUnicode)
2428 LocalFree(commonNameUnicode);
2429
2430 return (status);
2431 }
Unnamed repository; edit this file 'description' to name the repository.