]> git.ipfire.org Git - thirdparty/cups.git/blob - cups/tls-sspi.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
License change: Apache License, Version 2.0.
[thirdparty/cups.git] / cups / tls-sspi.c
1 /*
2 * TLS support for CUPS on Windows using the Security Support Provider
3 * Interface (SSPI).
4 *
5 * Copyright 2010-2017 by Apple Inc.
6 *
7 * Licensed under Apache License v2.0. See the file "LICENSE" for more information.
8 */
9
10 /**** This file is included from tls.c ****/
11
12 /*
13 * Include necessary headers...
14 */
15
16 #include "debug-private.h"
17
18
19 /*
20 * Include necessary libraries...
21 */
22
23 #pragma comment(lib, "Crypt32.lib")
24 #pragma comment(lib, "Secur32.lib")
25 #pragma comment(lib, "Ws2_32.lib")
26
27
28 /*
29 * Constants...
30 */
31
32 #ifndef SECURITY_FLAG_IGNORE_UNKNOWN_CA
33 # define SECURITY_FLAG_IGNORE_UNKNOWN_CA 0x00000100 /* Untrusted root */
34 #endif /* SECURITY_FLAG_IGNORE_UNKNOWN_CA */
35
36 #ifndef SECURITY_FLAG_IGNORE_CERT_CN_INVALID
37 # define SECURITY_FLAG_IGNORE_CERT_CN_INVALID 0x00001000 /* Common name does not match */
38 #endif /* !SECURITY_FLAG_IGNORE_CERT_CN_INVALID */
39
40 #ifndef SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
41 # define SECURITY_FLAG_IGNORE_CERT_DATE_INVALID 0x00002000 /* Expired X509 Cert. */
42 #endif /* !SECURITY_FLAG_IGNORE_CERT_DATE_INVALID */
43
44
45 /*
46 * Local globals...
47 */
48
49 static int tls_options = -1,/* Options for TLS connections */
50 tls_min_version = _HTTP_TLS_1_0,
51 tls_max_version = _HTTP_TLS_MAX;
52
53
54 /*
55 * Local functions...
56 */
57
58 static _http_sspi_t *http_sspi_alloc(void);
59 static int http_sspi_client(http_t *http, const char *hostname);
60 static PCCERT_CONTEXT http_sspi_create_credential(http_credential_t *cred);
61 static BOOL http_sspi_find_credentials(http_t *http, const LPWSTR containerName, const char *common_name);
62 static void http_sspi_free(_http_sspi_t *sspi);
63 static BOOL http_sspi_make_credentials(_http_sspi_t *sspi, const LPWSTR containerName, const char *common_name, _http_mode_t mode, int years);
64 static int http_sspi_server(http_t *http, const char *hostname);
65 static void http_sspi_set_allows_any_root(_http_sspi_t *sspi, BOOL allow);
66 static void http_sspi_set_allows_expired_certs(_http_sspi_t *sspi, BOOL allow);
67 static const char *http_sspi_strerror(char *buffer, size_t bufsize, DWORD code);
68 static DWORD http_sspi_verify(PCCERT_CONTEXT cert, const char *common_name, DWORD dwCertFlags);
69
70
71 /*
72 * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
73 *
74 * @since CUPS 2.0/OS 10.10@
75 */
76
77 int /* O - 1 on success, 0 on failure */
78 cupsMakeServerCredentials(
79 const char *path, /* I - Keychain path or @code NULL@ for default */
80 const char *common_name, /* I - Common name */
81 int num_alt_names, /* I - Number of subject alternate names */
82 const char **alt_names, /* I - Subject Alternate Names */
83 time_t expiration_date) /* I - Expiration date */
84 {
85 _http_sspi_t *sspi; /* SSPI data */
86 int ret; /* Return value */
87
88
89 DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
90
91 (void)path;
92 (void)num_alt_names;
93 (void)alt_names;
94
95 sspi = http_sspi_alloc();
96 ret = http_sspi_make_credentials(sspi, L"ServerContainer", common_name, _HTTP_MODE_SERVER, (int)((expiration_date - time(NULL) + 86399) / 86400 / 365));
97
98 http_sspi_free(sspi);
99
100 return (ret);
101 }
102
103
104 /*
105 * 'cupsSetServerCredentials()' - Set the default server credentials.
106 *
107 * Note: The server credentials are used by all threads in the running process.
108 * This function is threadsafe.
109 *
110 * @since CUPS 2.0/OS 10.10@
111 */
112
113 int /* O - 1 on success, 0 on failure */
114 cupsSetServerCredentials(
115 const char *path, /* I - Keychain path or @code NULL@ for default */
116 const char *common_name, /* I - Default common name for server */
117 int auto_create) /* I - 1 = automatically create self-signed certificates */
118 {
119 DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
120
121 (void)path;
122 (void)common_name;
123 (void)auto_create;
124
125 return (0);
126 }
127
128
129 /*
130 * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
131 * an encrypted connection.
132 *
133 * @since CUPS 1.5/macOS 10.7@
134 */
135
136 int /* O - Status of call (0 = success) */
137 httpCopyCredentials(
138 http_t *http, /* I - Connection to server */
139 cups_array_t **credentials) /* O - Array of credentials */
140 {
141 DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", http, credentials));
142
143 if (!http || !http->tls || !http->tls->remoteCert || !credentials)
144 {
145 if (credentials)
146 *credentials = NULL;
147
148 return (-1);
149 }
150
151 *credentials = cupsArrayNew(NULL, NULL);
152 httpAddCredential(*credentials, http->tls->remoteCert->pbCertEncoded, http->tls->remoteCert->cbCertEncoded);
153
154 return (0);
155 }
156
157
158 /*
159 * '_httpCreateCredentials()' - Create credentials in the internal format.
160 */
161
162 http_tls_credentials_t /* O - Internal credentials */
163 _httpCreateCredentials(
164 cups_array_t *credentials) /* I - Array of credentials */
165 {
166 return (http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials)));
167 }
168
169
170 /*
171 * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
172 *
173 * @since CUPS 2.0/OS 10.10@
174 */
175
176 int /* O - 1 if valid, 0 otherwise */
177 httpCredentialsAreValidForName(
178 cups_array_t *credentials, /* I - Credentials */
179 const char *common_name) /* I - Name to check */
180 {
181 int valid = 1; /* Valid name? */
182 PCCERT_CONTEXT cert = http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials));
183 /* Certificate */
184 char cert_name[1024]; /* Name from certificate */
185
186
187 if (cert)
188 {
189 if (CertNameToStr(X509_ASN_ENCODING, &(cert->pCertInfo->Subject), CERT_SIMPLE_NAME_STR, cert_name, sizeof(cert_name)))
190 {
191 /*
192 * Extract common name at end...
193 */
194
195 char *ptr = strrchr(cert_name, ',');
196 if (ptr && ptr[1])
197 _cups_strcpy(cert_name, ptr + 2);
198 }
199 else
200 strlcpy(cert_name, "unknown", sizeof(cert_name));
201
202 CertFreeCertificateContext(cert);
203 }
204 else
205 strlcpy(cert_name, "unknown", sizeof(cert_name));
206
207 /*
208 * Compare the common names...
209 */
210
211 if (_cups_strcasecmp(common_name, cert_name))
212 {
213 /*
214 * Not an exact match for the common name, check for wildcard certs...
215 */
216
217 const char *domain = strchr(common_name, '.');
218 /* Domain in common name */
219
220 if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1))
221 {
222 /*
223 * Not a wildcard match.
224 */
225
226 /* TODO: Check subject alternate names */
227 valid = 0;
228 }
229 }
230
231 return (valid);
232 }
233
234
235 /*
236 * 'httpCredentialsGetTrust()' - Return the trust of credentials.
237 *
238 * @since CUPS 2.0/OS 10.10@
239 */
240
241 http_trust_t /* O - Level of trust */
242 httpCredentialsGetTrust(
243 cups_array_t *credentials, /* I - Credentials */
244 const char *common_name) /* I - Common name for trust lookup */
245 {
246 http_trust_t trust = HTTP_TRUST_OK; /* Level of trust */
247 PCCERT_CONTEXT cert = NULL; /* Certificate to validate */
248 DWORD certFlags = 0; /* Cert verification flags */
249 _cups_globals_t *cg = _cupsGlobals(); /* Per-thread global data */
250
251
252 if (!common_name)
253 return (HTTP_TRUST_UNKNOWN);
254
255 cert = http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials));
256 if (!cert)
257 return (HTTP_TRUST_UNKNOWN);
258
259 if (cg->any_root < 0)
260 _cupsSetDefaults();
261
262 if (cg->any_root)
263 certFlags |= SECURITY_FLAG_IGNORE_UNKNOWN_CA;
264
265 if (cg->expired_certs)
266 certFlags |= SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
267
268 if (!cg->validate_certs)
269 certFlags |= SECURITY_FLAG_IGNORE_CERT_CN_INVALID;
270
271 if (http_sspi_verify(cert, common_name, certFlags) != SEC_E_OK)
272 trust = HTTP_TRUST_INVALID;
273
274 CertFreeCertificateContext(cert);
275
276 return (trust);
277 }
278
279
280 /*
281 * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
282 *
283 * @since CUPS 2.0/OS 10.10@
284 */
285
286 time_t /* O - Expiration date of credentials */
287 httpCredentialsGetExpiration(
288 cups_array_t *credentials) /* I - Credentials */
289 {
290 time_t expiration_date = 0; /* Expiration data of credentials */
291 PCCERT_CONTEXT cert = http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials));
292 /* Certificate */
293
294 if (cert)
295 {
296 SYSTEMTIME systime; /* System time */
297 struct tm tm; /* UNIX date/time */
298
299 FileTimeToSystemTime(&(cert->pCertInfo->NotAfter), &systime);
300
301 tm.tm_year = systime.wYear - 1900;
302 tm.tm_mon = systime.wMonth - 1;
303 tm.tm_mday = systime.wDay;
304 tm.tm_hour = systime.wHour;
305 tm.tm_min = systime.wMinute;
306 tm.tm_sec = systime.wSecond;
307
308 expiration_date = mktime(&tm);
309
310 CertFreeCertificateContext(cert);
311 }
312
313 return (expiration_date);
314 }
315
316
317 /*
318 * 'httpCredentialsString()' - Return a string representing the credentials.
319 *
320 * @since CUPS 2.0/OS 10.10@
321 */
322
323 size_t /* O - Total size of credentials string */
324 httpCredentialsString(
325 cups_array_t *credentials, /* I - Credentials */
326 char *buffer, /* I - Buffer or @code NULL@ */
327 size_t bufsize) /* I - Size of buffer */
328 {
329 http_credential_t *first = (http_credential_t *)cupsArrayFirst(credentials);
330 /* First certificate */
331 PCCERT_CONTEXT cert; /* Certificate */
332
333
334 DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", credentials, buffer, CUPS_LLCAST bufsize));
335
336 if (!buffer)
337 return (0);
338
339 if (buffer && bufsize > 0)
340 *buffer = '\0';
341
342 cert = http_sspi_create_credential(first);
343
344 if (cert)
345 {
346 char cert_name[256]; /* Common name */
347 SYSTEMTIME systime; /* System time */
348 struct tm tm; /* UNIX date/time */
349 time_t expiration; /* Expiration date of cert */
350 unsigned char md5_digest[16]; /* MD5 result */
351
352 FileTimeToSystemTime(&(cert->pCertInfo->NotAfter), &systime);
353
354 tm.tm_year = systime.wYear - 1900;
355 tm.tm_mon = systime.wMonth - 1;
356 tm.tm_mday = systime.wDay;
357 tm.tm_hour = systime.wHour;
358 tm.tm_min = systime.wMinute;
359 tm.tm_sec = systime.wSecond;
360
361 expiration = mktime(&tm);
362
363 if (CertNameToStr(X509_ASN_ENCODING, &(cert->pCertInfo->Subject), CERT_SIMPLE_NAME_STR, cert_name, sizeof(cert_name)))
364 {
365 /*
366 * Extract common name at end...
367 */
368
369 char *ptr = strrchr(cert_name, ',');
370 if (ptr && ptr[1])
371 _cups_strcpy(cert_name, ptr + 2);
372 }
373 else
374 strlcpy(cert_name, "unknown", sizeof(cert_name));
375
376 cupsHashData("md5", first->data, first->datalen, md5_digest, sizeof(md5_digest));
377
378 snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", cert_name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
379
380 CertFreeCertificateContext(cert);
381 }
382
383 DEBUG_printf(("1httpCredentialsString: Returning \"%s\".", buffer));
384
385 return (strlen(buffer));
386 }
387
388
389 /*
390 * '_httpFreeCredentials()' - Free internal credentials.
391 */
392
393 void
394 _httpFreeCredentials(
395 http_tls_credentials_t credentials) /* I - Internal credentials */
396 {
397 if (!credentials)
398 return;
399
400 CertFreeCertificateContext(credentials);
401 }
402
403
404 /*
405 * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
406 *
407 * @since CUPS 2.0/OS 10.10@
408 */
409
410 int /* O - 0 on success, -1 on error */
411 httpLoadCredentials(
412 const char *path, /* I - Keychain path or @code NULL@ for default */
413 cups_array_t **credentials, /* IO - Credentials */
414 const char *common_name) /* I - Common name for credentials */
415 {
416 HCERTSTORE store = NULL; /* Certificate store */
417 PCCERT_CONTEXT storedContext = NULL; /* Context created from the store */
418 DWORD dwSize = 0; /* 32 bit size */
419 PBYTE p = NULL; /* Temporary storage */
420 HCRYPTPROV hProv = (HCRYPTPROV)NULL;
421 /* Handle to a CSP */
422 CERT_NAME_BLOB sib; /* Arbitrary array of bytes */
423 #ifdef DEBUG
424 char error[1024]; /* Error message buffer */
425 #endif /* DEBUG */
426
427
428 DEBUG_printf(("httpLoadCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, credentials, common_name));
429
430 (void)path;
431
432 if (credentials)
433 {
434 *credentials = NULL;
435 }
436 else
437 {
438 DEBUG_puts("1httpLoadCredentials: NULL credentials pointer, returning -1.");
439 return (-1);
440 }
441
442 if (!common_name)
443 {
444 DEBUG_puts("1httpLoadCredentials: Bad common name, returning -1.");
445 return (-1);
446 }
447
448 if (!CryptAcquireContextW(&hProv, L"RememberedContainer", MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET))
449 {
450 if (GetLastError() == NTE_EXISTS)
451 {
452 if (!CryptAcquireContextW(&hProv, L"RememberedContainer", MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
453 {
454 DEBUG_printf(("1httpLoadCredentials: CryptAcquireContext failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
455 goto cleanup;
456 }
457 }
458 }
459
460 store = CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING|PKCS_7_ASN_ENCODING, hProv, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_NO_CRYPT_RELEASE_FLAG | CERT_STORE_OPEN_EXISTING_FLAG, L"MY");
461
462 if (!store)
463 {
464 DEBUG_printf(("1httpLoadCredentials: CertOpenSystemStore failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
465 goto cleanup;
466 }
467
468 dwSize = 0;
469
470 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, NULL, &dwSize, NULL))
471 {
472 DEBUG_printf(("1httpLoadCredentials: CertStrToName failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
473 goto cleanup;
474 }
475
476 p = (PBYTE)malloc(dwSize);
477
478 if (!p)
479 {
480 DEBUG_printf(("1httpLoadCredentials: malloc failed for %d bytes.", dwSize));
481 goto cleanup;
482 }
483
484 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, p, &dwSize, NULL))
485 {
486 DEBUG_printf(("1httpLoadCredentials: CertStrToName failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
487 goto cleanup;
488 }
489
490 sib.cbData = dwSize;
491 sib.pbData = p;
492
493 storedContext = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_SUBJECT_NAME, &sib, NULL);
494
495 if (!storedContext)
496 {
497 DEBUG_printf(("1httpLoadCredentials: Unable to find credentials for \"%s\".", common_name));
498 goto cleanup;
499 }
500
501 *credentials = cupsArrayNew(NULL, NULL);
502 httpAddCredential(*credentials, storedContext->pbCertEncoded, storedContext->cbCertEncoded);
503
504 cleanup:
505
506 /*
507 * Cleanup
508 */
509
510 if (storedContext)
511 CertFreeCertificateContext(storedContext);
512
513 if (p)
514 free(p);
515
516 if (store)
517 CertCloseStore(store, 0);
518
519 if (hProv)
520 CryptReleaseContext(hProv, 0);
521
522 DEBUG_printf(("1httpLoadCredentials: Returning %d.", *credentials ? 0 : -1));
523
524 return (*credentials ? 0 : -1);
525 }
526
527
528 /*
529 * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
530 *
531 * @since CUPS 2.0/OS 10.10@
532 */
533
534 int /* O - -1 on error, 0 on success */
535 httpSaveCredentials(
536 const char *path, /* I - Keychain path or @code NULL@ for default */
537 cups_array_t *credentials, /* I - Credentials */
538 const char *common_name) /* I - Common name for credentials */
539 {
540 HCERTSTORE store = NULL; /* Certificate store */
541 PCCERT_CONTEXT storedContext = NULL; /* Context created from the store */
542 PCCERT_CONTEXT createdContext = NULL; /* Context created by us */
543 DWORD dwSize = 0; /* 32 bit size */
544 PBYTE p = NULL; /* Temporary storage */
545 HCRYPTPROV hProv = (HCRYPTPROV)NULL;
546 /* Handle to a CSP */
547 CRYPT_KEY_PROV_INFO ckp; /* Handle to crypto key */
548 int ret = -1; /* Return value */
549 #ifdef DEBUG
550 char error[1024]; /* Error message buffer */
551 #endif /* DEBUG */
552
553
554 DEBUG_printf(("httpSaveCredentials(path=\"%s\", credentials=%p, common_name=\"%s\")", path, credentials, common_name));
555
556 (void)path;
557
558 if (!common_name)
559 {
560 DEBUG_puts("1httpSaveCredentials: Bad common name, returning -1.");
561 return (-1);
562 }
563
564 createdContext = http_sspi_create_credential((http_credential_t *)cupsArrayFirst(credentials));
565 if (!createdContext)
566 {
567 DEBUG_puts("1httpSaveCredentials: Bad credentials, returning -1.");
568 return (-1);
569 }
570
571 if (!CryptAcquireContextW(&hProv, L"RememberedContainer", MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET))
572 {
573 if (GetLastError() == NTE_EXISTS)
574 {
575 if (!CryptAcquireContextW(&hProv, L"RememberedContainer", MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
576 {
577 DEBUG_printf(("1httpSaveCredentials: CryptAcquireContext failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
578 goto cleanup;
579 }
580 }
581 }
582
583 store = CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING|PKCS_7_ASN_ENCODING, hProv, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_NO_CRYPT_RELEASE_FLAG | CERT_STORE_OPEN_EXISTING_FLAG, L"MY");
584
585 if (!store)
586 {
587 DEBUG_printf(("1httpSaveCredentials: CertOpenSystemStore failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
588 goto cleanup;
589 }
590
591 dwSize = 0;
592
593 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, NULL, &dwSize, NULL))
594 {
595 DEBUG_printf(("1httpSaveCredentials: CertStrToName failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
596 goto cleanup;
597 }
598
599 p = (PBYTE)malloc(dwSize);
600
601 if (!p)
602 {
603 DEBUG_printf(("1httpSaveCredentials: malloc failed for %d bytes.", dwSize));
604 goto cleanup;
605 }
606
607 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, p, &dwSize, NULL))
608 {
609 DEBUG_printf(("1httpSaveCredentials: CertStrToName failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
610 goto cleanup;
611 }
612
613 /*
614 * Add the created context to the named store, and associate it with the named
615 * container...
616 */
617
618 if (!CertAddCertificateContextToStore(store, createdContext, CERT_STORE_ADD_REPLACE_EXISTING, &storedContext))
619 {
620 DEBUG_printf(("1httpSaveCredentials: CertAddCertificateContextToStore failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
621 goto cleanup;
622 }
623
624 ZeroMemory(&ckp, sizeof(ckp));
625 ckp.pwszContainerName = L"RememberedContainer";
626 ckp.pwszProvName = MS_DEF_PROV_W;
627 ckp.dwProvType = PROV_RSA_FULL;
628 ckp.dwFlags = CRYPT_MACHINE_KEYSET;
629 ckp.dwKeySpec = AT_KEYEXCHANGE;
630
631 if (!CertSetCertificateContextProperty(storedContext, CERT_KEY_PROV_INFO_PROP_ID, 0, &ckp))
632 {
633 DEBUG_printf(("1httpSaveCredentials: CertSetCertificateContextProperty failed: %s", http_sspi_strerror(error, sizeof(error), GetLastError())));
634 goto cleanup;
635 }
636
637 ret = 0;
638
639 cleanup:
640
641 /*
642 * Cleanup
643 */
644
645 if (createdContext)
646 CertFreeCertificateContext(createdContext);
647
648 if (storedContext)
649 CertFreeCertificateContext(storedContext);
650
651 if (p)
652 free(p);
653
654 if (store)
655 CertCloseStore(store, 0);
656
657 if (hProv)
658 CryptReleaseContext(hProv, 0);
659
660 DEBUG_printf(("1httpSaveCredentials: Returning %d.", ret));
661 return (ret);
662 }
663
664
665 /*
666 * '_httpTLSInitialize()' - Initialize the TLS stack.
667 */
668
669 void
670 _httpTLSInitialize(void)
671 {
672 /*
673 * Nothing to do...
674 */
675 }
676
677
678 /*
679 * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
680 */
681
682 size_t /* O - Bytes available */
683 _httpTLSPending(http_t *http) /* I - HTTP connection */
684 {
685 if (http->tls)
686 return (http->tls->readBufferUsed);
687 else
688 return (0);
689 }
690
691
692 /*
693 * '_httpTLSRead()' - Read from a SSL/TLS connection.
694 */
695
696 int /* O - Bytes read */
697 _httpTLSRead(http_t *http, /* I - HTTP connection */
698 char *buf, /* I - Buffer to store data */
699 int len) /* I - Length of buffer */
700 {
701 int i; /* Looping var */
702 _http_sspi_t *sspi = http->tls; /* SSPI data */
703 SecBufferDesc message; /* Array of SecBuffer struct */
704 SecBuffer buffers[4] = { 0 }; /* Security package buffer */
705 int num = 0; /* Return value */
706 PSecBuffer pDataBuffer; /* Data buffer */
707 PSecBuffer pExtraBuffer; /* Excess data buffer */
708 SECURITY_STATUS scRet; /* SSPI status */
709
710
711 DEBUG_printf(("4_httpTLSRead(http=%p, buf=%p, len=%d)", http, buf, len));
712
713 /*
714 * If there are bytes that have already been decrypted and have not yet been
715 * read, return those...
716 */
717
718 if (sspi->readBufferUsed > 0)
719 {
720 int bytesToCopy = min(sspi->readBufferUsed, len);
721 /* Number of bytes to copy */
722
723 memcpy(buf, sspi->readBuffer, bytesToCopy);
724 sspi->readBufferUsed -= bytesToCopy;
725
726 if (sspi->readBufferUsed > 0)
727 memmove(sspi->readBuffer, sspi->readBuffer + bytesToCopy, sspi->readBufferUsed);
728
729 DEBUG_printf(("5_httpTLSRead: Returning %d bytes previously decrypted.", bytesToCopy));
730
731 return (bytesToCopy);
732 }
733
734 /*
735 * Initialize security buffer structs
736 */
737
738 message.ulVersion = SECBUFFER_VERSION;
739 message.cBuffers = 4;
740 message.pBuffers = buffers;
741
742 do
743 {
744 /*
745 * If there is not enough space in the buffer, then increase its size...
746 */
747
748 if (sspi->decryptBufferLength <= sspi->decryptBufferUsed)
749 {
750 BYTE *temp; /* New buffer */
751
752 if (sspi->decryptBufferLength >= 262144)
753 {
754 WSASetLastError(E_OUTOFMEMORY);
755 DEBUG_puts("_httpTLSRead: Decryption buffer too large (>256k)");
756 return (-1);
757 }
758
759 if ((temp = realloc(sspi->decryptBuffer, sspi->decryptBufferLength + 4096)) == NULL)
760 {
761 DEBUG_printf(("_httpTLSRead: Unable to allocate %d byte decryption buffer.", sspi->decryptBufferLength + 4096));
762 WSASetLastError(E_OUTOFMEMORY);
763 return (-1);
764 }
765
766 sspi->decryptBufferLength += 4096;
767 sspi->decryptBuffer = temp;
768
769 DEBUG_printf(("_httpTLSRead: Resized decryption buffer to %d bytes.", sspi->decryptBufferLength));
770 }
771
772 buffers[0].pvBuffer = sspi->decryptBuffer;
773 buffers[0].cbBuffer = (unsigned long)sspi->decryptBufferUsed;
774 buffers[0].BufferType = SECBUFFER_DATA;
775 buffers[1].BufferType = SECBUFFER_EMPTY;
776 buffers[2].BufferType = SECBUFFER_EMPTY;
777 buffers[3].BufferType = SECBUFFER_EMPTY;
778
779 DEBUG_printf(("5_httpTLSRead: decryptBufferUsed=%d", sspi->decryptBufferUsed));
780
781 scRet = DecryptMessage(&sspi->context, &message, 0, NULL);
782
783 if (scRet == SEC_E_INCOMPLETE_MESSAGE)
784 {
785 num = recv(http->fd, sspi->decryptBuffer + sspi->decryptBufferUsed, (int)(sspi->decryptBufferLength - sspi->decryptBufferUsed), 0);
786 if (num < 0)
787 {
788 DEBUG_printf(("5_httpTLSRead: recv failed: %d", WSAGetLastError()));
789 return (-1);
790 }
791 else if (num == 0)
792 {
793 DEBUG_puts("5_httpTLSRead: Server disconnected.");
794 return (0);
795 }
796
797 DEBUG_printf(("5_httpTLSRead: Read %d bytes into decryption buffer.", num));
798
799 sspi->decryptBufferUsed += num;
800 }
801 }
802 while (scRet == SEC_E_INCOMPLETE_MESSAGE);
803
804 if (scRet == SEC_I_CONTEXT_EXPIRED)
805 {
806 DEBUG_puts("5_httpTLSRead: Context expired.");
807 WSASetLastError(WSAECONNRESET);
808 return (-1);
809 }
810 else if (scRet != SEC_E_OK)
811 {
812 DEBUG_printf(("5_httpTLSRead: DecryptMessage failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
813 WSASetLastError(WSASYSCALLFAILURE);
814 return (-1);
815 }
816
817 /*
818 * The decryption worked. Now, locate data buffer.
819 */
820
821 pDataBuffer = NULL;
822 pExtraBuffer = NULL;
823
824 for (i = 1; i < 4; i++)
825 {
826 if (buffers[i].BufferType == SECBUFFER_DATA)
827 pDataBuffer = &buffers[i];
828 else if (!pExtraBuffer && (buffers[i].BufferType == SECBUFFER_EXTRA))
829 pExtraBuffer = &buffers[i];
830 }
831
832 /*
833 * If a data buffer is found, then copy the decrypted bytes to the passed-in
834 * buffer...
835 */
836
837 if (pDataBuffer)
838 {
839 int bytesToCopy = min((int)pDataBuffer->cbBuffer, len);
840 /* Number of bytes to copy into buf */
841 int bytesToSave = pDataBuffer->cbBuffer - bytesToCopy;
842 /* Number of bytes to save in our read buffer */
843
844 if (bytesToCopy)
845 memcpy(buf, pDataBuffer->pvBuffer, bytesToCopy);
846
847 /*
848 * If there are more decrypted bytes than can be copied to the passed in
849 * buffer, then save them...
850 */
851
852 if (bytesToSave)
853 {
854 if ((sspi->readBufferLength - sspi->readBufferUsed) < bytesToSave)
855 {
856 BYTE *temp; /* New buffer pointer */
857
858 if ((temp = realloc(sspi->readBuffer, sspi->readBufferUsed + bytesToSave)) == NULL)
859 {
860 DEBUG_printf(("_httpTLSRead: Unable to allocate %d bytes.", sspi->readBufferUsed + bytesToSave));
861 WSASetLastError(E_OUTOFMEMORY);
862 return (-1);
863 }
864
865 sspi->readBufferLength = sspi->readBufferUsed + bytesToSave;
866 sspi->readBuffer = temp;
867 }
868
869 memcpy(((BYTE *)sspi->readBuffer) + sspi->readBufferUsed, ((BYTE *)pDataBuffer->pvBuffer) + bytesToCopy, bytesToSave);
870
871 sspi->readBufferUsed += bytesToSave;
872 }
873
874 num = bytesToCopy;
875 }
876 else
877 {
878 DEBUG_puts("_httpTLSRead: Unable to find data buffer.");
879 WSASetLastError(WSASYSCALLFAILURE);
880 return (-1);
881 }
882
883 /*
884 * If the decryption process left extra bytes, then save those back in
885 * decryptBuffer. They will be processed the next time through the loop.
886 */
887
888 if (pExtraBuffer)
889 {
890 memmove(sspi->decryptBuffer, pExtraBuffer->pvBuffer, pExtraBuffer->cbBuffer);
891 sspi->decryptBufferUsed = pExtraBuffer->cbBuffer;
892 }
893 else
894 {
895 sspi->decryptBufferUsed = 0;
896 }
897
898 return (num);
899 }
900
901
902 /*
903 * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
904 */
905
906 void
907 _httpTLSSetOptions(int options) /* I - Options */
908 {
909 if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
910 {
911 tls_options = options;
912 tls_min_version = min_version;
913 tls_max_version = max_version;
914 }
915 }
916
917
918 /*
919 * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
920 */
921
922 int /* O - 0 on success, -1 on failure */
923 _httpTLSStart(http_t *http) /* I - HTTP connection */
924 {
925 char hostname[256], /* Hostname */
926 *hostptr; /* Pointer into hostname */
927
928
929 DEBUG_printf(("3_httpTLSStart(http=%p)", http));
930
931 if (tls_options < 0)
932 {
933 DEBUG_puts("4_httpTLSStart: Setting defaults.");
934 _cupsSetDefaults();
935 DEBUG_printf(("4_httpTLSStart: tls_options=%x", tls_options));
936 }
937
938 if ((http->tls = http_sspi_alloc()) == NULL)
939 return (-1);
940
941 if (http->mode == _HTTP_MODE_CLIENT)
942 {
943 /*
944 * Client: determine hostname...
945 */
946
947 if (httpAddrLocalhost(http->hostaddr))
948 {
949 strlcpy(hostname, "localhost", sizeof(hostname));
950 }
951 else
952 {
953 /*
954 * Otherwise make sure the hostname we have does not end in a trailing dot.
955 */
956
957 strlcpy(hostname, http->hostname, sizeof(hostname));
958 if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
959 *hostptr == '.')
960 *hostptr = '\0';
961 }
962
963 return (http_sspi_client(http, hostname));
964 }
965 else
966 {
967 /*
968 * Server: determine hostname to use...
969 */
970
971 if (http->fields[HTTP_FIELD_HOST][0])
972 {
973 /*
974 * Use hostname for TLS upgrade...
975 */
976
977 strlcpy(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
978 }
979 else
980 {
981 /*
982 * Resolve hostname from connection address...
983 */
984
985 http_addr_t addr; /* Connection address */
986 socklen_t addrlen; /* Length of address */
987
988 addrlen = sizeof(addr);
989 if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
990 {
991 DEBUG_printf(("4_httpTLSStart: Unable to get socket address: %s", strerror(errno)));
992 hostname[0] = '\0';
993 }
994 else if (httpAddrLocalhost(&addr))
995 hostname[0] = '\0';
996 else
997 {
998 httpAddrLookup(&addr, hostname, sizeof(hostname));
999 DEBUG_printf(("4_httpTLSStart: Resolved socket address to \"%s\".", hostname));
1000 }
1001 }
1002
1003 return (http_sspi_server(http, hostname));
1004 }
1005 }
1006
1007
1008 /*
1009 * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
1010 */
1011
1012 void
1013 _httpTLSStop(http_t *http) /* I - HTTP connection */
1014 {
1015 _http_sspi_t *sspi = http->tls; /* SSPI data */
1016
1017
1018 if (sspi->contextInitialized && http->fd >= 0)
1019 {
1020 SecBufferDesc message; /* Array of SecBuffer struct */
1021 SecBuffer buffers[1] = { 0 };
1022 /* Security package buffer */
1023 DWORD dwType; /* Type */
1024 DWORD status; /* Status */
1025
1026 /*
1027 * Notify schannel that we are about to close the connection.
1028 */
1029
1030 dwType = SCHANNEL_SHUTDOWN;
1031
1032 buffers[0].pvBuffer = &dwType;
1033 buffers[0].BufferType = SECBUFFER_TOKEN;
1034 buffers[0].cbBuffer = sizeof(dwType);
1035
1036 message.cBuffers = 1;
1037 message.pBuffers = buffers;
1038 message.ulVersion = SECBUFFER_VERSION;
1039
1040 status = ApplyControlToken(&sspi->context, &message);
1041
1042 if (SUCCEEDED(status))
1043 {
1044 PBYTE pbMessage; /* Message buffer */
1045 DWORD cbMessage; /* Message buffer count */
1046 DWORD cbData; /* Data count */
1047 DWORD dwSSPIFlags; /* SSL attributes we requested */
1048 DWORD dwSSPIOutFlags; /* SSL attributes we received */
1049 TimeStamp tsExpiry; /* Time stamp */
1050
1051 dwSSPIFlags = ASC_REQ_SEQUENCE_DETECT |
1052 ASC_REQ_REPLAY_DETECT |
1053 ASC_REQ_CONFIDENTIALITY |
1054 ASC_REQ_EXTENDED_ERROR |
1055 ASC_REQ_ALLOCATE_MEMORY |
1056 ASC_REQ_STREAM;
1057
1058 buffers[0].pvBuffer = NULL;
1059 buffers[0].BufferType = SECBUFFER_TOKEN;
1060 buffers[0].cbBuffer = 0;
1061
1062 message.cBuffers = 1;
1063 message.pBuffers = buffers;
1064 message.ulVersion = SECBUFFER_VERSION;
1065
1066 status = AcceptSecurityContext(&sspi->creds, &sspi->context, NULL,
1067 dwSSPIFlags, SECURITY_NATIVE_DREP, NULL,
1068 &message, &dwSSPIOutFlags, &tsExpiry);
1069
1070 if (SUCCEEDED(status))
1071 {
1072 pbMessage = buffers[0].pvBuffer;
1073 cbMessage = buffers[0].cbBuffer;
1074
1075 /*
1076 * Send the close notify message to the client.
1077 */
1078
1079 if (pbMessage && cbMessage)
1080 {
1081 cbData = send(http->fd, pbMessage, cbMessage, 0);
1082 if ((cbData == SOCKET_ERROR) || (cbData == 0))
1083 {
1084 status = WSAGetLastError();
1085 DEBUG_printf(("_httpTLSStop: sending close notify failed: %d", status));
1086 }
1087 else
1088 {
1089 FreeContextBuffer(pbMessage);
1090 }
1091 }
1092 }
1093 else
1094 {
1095 DEBUG_printf(("_httpTLSStop: AcceptSecurityContext failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), status)));
1096 }
1097 }
1098 else
1099 {
1100 DEBUG_printf(("_httpTLSStop: ApplyControlToken failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), status)));
1101 }
1102 }
1103
1104 http_sspi_free(sspi);
1105
1106 http->tls = NULL;
1107 }
1108
1109
1110 /*
1111 * '_httpTLSWrite()' - Write to a SSL/TLS connection.
1112 */
1113
1114 int /* O - Bytes written */
1115 _httpTLSWrite(http_t *http, /* I - HTTP connection */
1116 const char *buf, /* I - Buffer holding data */
1117 int len) /* I - Length of buffer */
1118 {
1119 _http_sspi_t *sspi = http->tls; /* SSPI data */
1120 SecBufferDesc message; /* Array of SecBuffer struct */
1121 SecBuffer buffers[4] = { 0 }; /* Security package buffer */
1122 int bufferLen; /* Buffer length */
1123 int bytesLeft; /* Bytes left to write */
1124 const char *bufptr; /* Pointer into buffer */
1125 int num = 0; /* Return value */
1126
1127
1128 bufferLen = sspi->streamSizes.cbMaximumMessage + sspi->streamSizes.cbHeader + sspi->streamSizes.cbTrailer;
1129
1130 if (bufferLen > sspi->writeBufferLength)
1131 {
1132 BYTE *temp; /* New buffer pointer */
1133
1134 if ((temp = (BYTE *)realloc(sspi->writeBuffer, bufferLen)) == NULL)
1135 {
1136 DEBUG_printf(("_httpTLSWrite: Unable to allocate buffer of %d bytes.", bufferLen));
1137 WSASetLastError(E_OUTOFMEMORY);
1138 return (-1);
1139 }
1140
1141 sspi->writeBuffer = temp;
1142 sspi->writeBufferLength = bufferLen;
1143 }
1144
1145 bytesLeft = len;
1146 bufptr = buf;
1147
1148 while (bytesLeft)
1149 {
1150 int chunk = min((int)sspi->streamSizes.cbMaximumMessage, bytesLeft);
1151 /* Size of data to write */
1152 SECURITY_STATUS scRet; /* SSPI status */
1153
1154 /*
1155 * Copy user data into the buffer, starting just past the header...
1156 */
1157
1158 memcpy(sspi->writeBuffer + sspi->streamSizes.cbHeader, bufptr, chunk);
1159
1160 /*
1161 * Setup the SSPI buffers
1162 */
1163
1164 message.ulVersion = SECBUFFER_VERSION;
1165 message.cBuffers = 4;
1166 message.pBuffers = buffers;
1167
1168 buffers[0].pvBuffer = sspi->writeBuffer;
1169 buffers[0].cbBuffer = sspi->streamSizes.cbHeader;
1170 buffers[0].BufferType = SECBUFFER_STREAM_HEADER;
1171 buffers[1].pvBuffer = sspi->writeBuffer + sspi->streamSizes.cbHeader;
1172 buffers[1].cbBuffer = (unsigned long) chunk;
1173 buffers[1].BufferType = SECBUFFER_DATA;
1174 buffers[2].pvBuffer = sspi->writeBuffer + sspi->streamSizes.cbHeader + chunk;
1175 buffers[2].cbBuffer = sspi->streamSizes.cbTrailer;
1176 buffers[2].BufferType = SECBUFFER_STREAM_TRAILER;
1177 buffers[3].BufferType = SECBUFFER_EMPTY;
1178
1179 /*
1180 * Encrypt the data
1181 */
1182
1183 scRet = EncryptMessage(&sspi->context, 0, &message, 0);
1184
1185 if (FAILED(scRet))
1186 {
1187 DEBUG_printf(("_httpTLSWrite: EncryptMessage failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1188 WSASetLastError(WSASYSCALLFAILURE);
1189 return (-1);
1190 }
1191
1192 /*
1193 * Send the data. Remember the size of the total data to send is the size
1194 * of the header, the size of the data the caller passed in and the size
1195 * of the trailer...
1196 */
1197
1198 num = send(http->fd, sspi->writeBuffer, buffers[0].cbBuffer + buffers[1].cbBuffer + buffers[2].cbBuffer, 0);
1199
1200 if (num <= 0)
1201 {
1202 DEBUG_printf(("_httpTLSWrite: send failed: %ld", WSAGetLastError()));
1203 return (num);
1204 }
1205
1206 bytesLeft -= chunk;
1207 bufptr += chunk;
1208 }
1209
1210 return (len);
1211 }
1212
1213
1214 #if 0
1215 /*
1216 * 'http_setup_ssl()' - Set up SSL/TLS support on a connection.
1217 */
1218
1219 static int /* O - 0 on success, -1 on failure */
1220 http_setup_ssl(http_t *http) /* I - Connection to server */
1221 {
1222 char hostname[256], /* Hostname */
1223 *hostptr; /* Pointer into hostname */
1224
1225 TCHAR username[256]; /* Username returned from GetUserName() */
1226 TCHAR commonName[256];/* Common name for certificate */
1227 DWORD dwSize; /* 32 bit size */
1228
1229
1230 DEBUG_printf(("7http_setup_ssl(http=%p)", http));
1231
1232 /*
1233 * Get the hostname to use for SSL...
1234 */
1235
1236 if (httpAddrLocalhost(http->hostaddr))
1237 {
1238 strlcpy(hostname, "localhost", sizeof(hostname));
1239 }
1240 else
1241 {
1242 /*
1243 * Otherwise make sure the hostname we have does not end in a trailing dot.
1244 */
1245
1246 strlcpy(hostname, http->hostname, sizeof(hostname));
1247 if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
1248 *hostptr == '.')
1249 *hostptr = '\0';
1250 }
1251
1252 http->tls = http_sspi_alloc();
1253
1254 if (!http->tls)
1255 {
1256 _cupsSetHTTPError(HTTP_STATUS_ERROR);
1257 return (-1);
1258 }
1259
1260 dwSize = sizeof(username) / sizeof(TCHAR);
1261 GetUserName(username, &dwSize);
1262 _sntprintf_s(commonName, sizeof(commonName) / sizeof(TCHAR),
1263 sizeof(commonName) / sizeof(TCHAR), TEXT("CN=%s"), username);
1264
1265 if (!_sspiGetCredentials(http->tls, L"ClientContainer",
1266 commonName, FALSE))
1267 {
1268 _sspiFree(http->tls);
1269 http->tls = NULL;
1270
1271 http->error = EIO;
1272 http->status = HTTP_STATUS_ERROR;
1273
1274 _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI,
1275 _("Unable to establish a secure connection to host."), 1);
1276
1277 return (-1);
1278 }
1279
1280 _sspiSetAllowsAnyRoot(http->tls, TRUE);
1281 _sspiSetAllowsExpiredCerts(http->tls, TRUE);
1282
1283 if (!_sspiConnect(http->tls, hostname))
1284 {
1285 _sspiFree(http->tls);
1286 http->tls = NULL;
1287
1288 http->error = EIO;
1289 http->status = HTTP_STATUS_ERROR;
1290
1291 _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI,
1292 _("Unable to establish a secure connection to host."), 1);
1293
1294 return (-1);
1295 }
1296
1297 return (0);
1298 }
1299 #endif // 0
1300
1301
1302 /*
1303 * 'http_sspi_alloc()' - Allocate SSPI object.
1304 */
1305
1306 static _http_sspi_t * /* O - New SSPI/SSL object */
1307 http_sspi_alloc(void)
1308 {
1309 return ((_http_sspi_t *)calloc(sizeof(_http_sspi_t), 1));
1310 }
1311
1312
1313 /*
1314 * 'http_sspi_client()' - Negotiate a TLS connection as a client.
1315 */
1316
1317 static int /* O - 0 on success, -1 on failure */
1318 http_sspi_client(http_t *http, /* I - Client connection */
1319 const char *hostname) /* I - Server hostname */
1320 {
1321 _http_sspi_t *sspi = http->tls; /* SSPI data */
1322 DWORD dwSize; /* Size for buffer */
1323 DWORD dwSSPIFlags; /* SSL connection attributes we want */
1324 DWORD dwSSPIOutFlags; /* SSL connection attributes we got */
1325 TimeStamp tsExpiry; /* Time stamp */
1326 SECURITY_STATUS scRet; /* Status */
1327 int cbData; /* Data count */
1328 SecBufferDesc inBuffer; /* Array of SecBuffer structs */
1329 SecBuffer inBuffers[2]; /* Security package buffer */
1330 SecBufferDesc outBuffer; /* Array of SecBuffer structs */
1331 SecBuffer outBuffers[1]; /* Security package buffer */
1332 int ret = 0; /* Return value */
1333 char username[1024], /* Current username */
1334 common_name[1024]; /* CN=username */
1335
1336
1337 DEBUG_printf(("4http_sspi_client(http=%p, hostname=\"%s\")", http, hostname));
1338
1339 dwSSPIFlags = ISC_REQ_SEQUENCE_DETECT |
1340 ISC_REQ_REPLAY_DETECT |
1341 ISC_REQ_CONFIDENTIALITY |
1342 ISC_RET_EXTENDED_ERROR |
1343 ISC_REQ_ALLOCATE_MEMORY |
1344 ISC_REQ_STREAM;
1345
1346 /*
1347 * Lookup the client certificate...
1348 */
1349
1350 dwSize = sizeof(username);
1351 GetUserName(username, &dwSize);
1352 snprintf(common_name, sizeof(common_name), "CN=%s", username);
1353
1354 if (!http_sspi_find_credentials(http, L"ClientContainer", common_name))
1355 if (!http_sspi_make_credentials(http->tls, L"ClientContainer", common_name, _HTTP_MODE_CLIENT, 10))
1356 {
1357 DEBUG_puts("5http_sspi_client: Unable to get client credentials.");
1358 return (-1);
1359 }
1360
1361 /*
1362 * Initiate a ClientHello message and generate a token.
1363 */
1364
1365 outBuffers[0].pvBuffer = NULL;
1366 outBuffers[0].BufferType = SECBUFFER_TOKEN;
1367 outBuffers[0].cbBuffer = 0;
1368
1369 outBuffer.cBuffers = 1;
1370 outBuffer.pBuffers = outBuffers;
1371 outBuffer.ulVersion = SECBUFFER_VERSION;
1372
1373 scRet = InitializeSecurityContext(&sspi->creds, NULL, TEXT(""), dwSSPIFlags, 0, SECURITY_NATIVE_DREP, NULL, 0, &sspi->context, &outBuffer, &dwSSPIOutFlags, &tsExpiry);
1374
1375 if (scRet != SEC_I_CONTINUE_NEEDED)
1376 {
1377 DEBUG_printf(("5http_sspi_client: InitializeSecurityContext(1) failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1378 return (-1);
1379 }
1380
1381 /*
1382 * Send response to server if there is one.
1383 */
1384
1385 if (outBuffers[0].cbBuffer && outBuffers[0].pvBuffer)
1386 {
1387 if ((cbData = send(http->fd, outBuffers[0].pvBuffer, outBuffers[0].cbBuffer, 0)) <= 0)
1388 {
1389 DEBUG_printf(("5http_sspi_client: send failed: %d", WSAGetLastError()));
1390 FreeContextBuffer(outBuffers[0].pvBuffer);
1391 DeleteSecurityContext(&sspi->context);
1392 return (-1);
1393 }
1394
1395 DEBUG_printf(("5http_sspi_client: %d bytes of handshake data sent.", cbData));
1396
1397 FreeContextBuffer(outBuffers[0].pvBuffer);
1398 outBuffers[0].pvBuffer = NULL;
1399 }
1400
1401 dwSSPIFlags = ISC_REQ_MANUAL_CRED_VALIDATION |
1402 ISC_REQ_SEQUENCE_DETECT |
1403 ISC_REQ_REPLAY_DETECT |
1404 ISC_REQ_CONFIDENTIALITY |
1405 ISC_RET_EXTENDED_ERROR |
1406 ISC_REQ_ALLOCATE_MEMORY |
1407 ISC_REQ_STREAM;
1408
1409 sspi->decryptBufferUsed = 0;
1410
1411 /*
1412 * Loop until the handshake is finished or an error occurs.
1413 */
1414
1415 scRet = SEC_I_CONTINUE_NEEDED;
1416
1417 while(scRet == SEC_I_CONTINUE_NEEDED ||
1418 scRet == SEC_E_INCOMPLETE_MESSAGE ||
1419 scRet == SEC_I_INCOMPLETE_CREDENTIALS)
1420 {
1421 if (sspi->decryptBufferUsed == 0 || scRet == SEC_E_INCOMPLETE_MESSAGE)
1422 {
1423 if (sspi->decryptBufferLength <= sspi->decryptBufferUsed)
1424 {
1425 BYTE *temp; /* New buffer */
1426
1427 if (sspi->decryptBufferLength >= 262144)
1428 {
1429 WSASetLastError(E_OUTOFMEMORY);
1430 DEBUG_puts("5http_sspi_client: Decryption buffer too large (>256k)");
1431 return (-1);
1432 }
1433
1434 if ((temp = realloc(sspi->decryptBuffer, sspi->decryptBufferLength + 4096)) == NULL)
1435 {
1436 DEBUG_printf(("5http_sspi_client: Unable to allocate %d byte buffer.", sspi->decryptBufferLength + 4096));
1437 WSASetLastError(E_OUTOFMEMORY);
1438 return (-1);
1439 }
1440
1441 sspi->decryptBufferLength += 4096;
1442 sspi->decryptBuffer = temp;
1443 }
1444
1445 cbData = recv(http->fd, sspi->decryptBuffer + sspi->decryptBufferUsed, (int)(sspi->decryptBufferLength - sspi->decryptBufferUsed), 0);
1446
1447 if (cbData < 0)
1448 {
1449 DEBUG_printf(("5http_sspi_client: recv failed: %d", WSAGetLastError()));
1450 return (-1);
1451 }
1452 else if (cbData == 0)
1453 {
1454 DEBUG_printf(("5http_sspi_client: Server unexpectedly disconnected."));
1455 return (-1);
1456 }
1457
1458 DEBUG_printf(("5http_sspi_client: %d bytes of handshake data received", cbData));
1459
1460 sspi->decryptBufferUsed += cbData;
1461 }
1462
1463 /*
1464 * Set up the input buffers. Buffer 0 is used to pass in data received from
1465 * the server. Schannel will consume some or all of this. Leftover data
1466 * (if any) will be placed in buffer 1 and given a buffer type of
1467 * SECBUFFER_EXTRA.
1468 */
1469
1470 inBuffers[0].pvBuffer = sspi->decryptBuffer;
1471 inBuffers[0].cbBuffer = (unsigned long)sspi->decryptBufferUsed;
1472 inBuffers[0].BufferType = SECBUFFER_TOKEN;
1473
1474 inBuffers[1].pvBuffer = NULL;
1475 inBuffers[1].cbBuffer = 0;
1476 inBuffers[1].BufferType = SECBUFFER_EMPTY;
1477
1478 inBuffer.cBuffers = 2;
1479 inBuffer.pBuffers = inBuffers;
1480 inBuffer.ulVersion = SECBUFFER_VERSION;
1481
1482 /*
1483 * Set up the output buffers. These are initialized to NULL so as to make it
1484 * less likely we'll attempt to free random garbage later.
1485 */
1486
1487 outBuffers[0].pvBuffer = NULL;
1488 outBuffers[0].BufferType = SECBUFFER_TOKEN;
1489 outBuffers[0].cbBuffer = 0;
1490
1491 outBuffer.cBuffers = 1;
1492 outBuffer.pBuffers = outBuffers;
1493 outBuffer.ulVersion = SECBUFFER_VERSION;
1494
1495 /*
1496 * Call InitializeSecurityContext.
1497 */
1498
1499 scRet = InitializeSecurityContext(&sspi->creds, &sspi->context, NULL, dwSSPIFlags, 0, SECURITY_NATIVE_DREP, &inBuffer, 0, NULL, &outBuffer, &dwSSPIOutFlags, &tsExpiry);
1500
1501 /*
1502 * If InitializeSecurityContext was successful (or if the error was one of
1503 * the special extended ones), send the contents of the output buffer to the
1504 * server.
1505 */
1506
1507 if (scRet == SEC_E_OK ||
1508 scRet == SEC_I_CONTINUE_NEEDED ||
1509 FAILED(scRet) && (dwSSPIOutFlags & ISC_RET_EXTENDED_ERROR))
1510 {
1511 if (outBuffers[0].cbBuffer && outBuffers[0].pvBuffer)
1512 {
1513 cbData = send(http->fd, outBuffers[0].pvBuffer, outBuffers[0].cbBuffer, 0);
1514
1515 if (cbData <= 0)
1516 {
1517 DEBUG_printf(("5http_sspi_client: send failed: %d", WSAGetLastError()));
1518 FreeContextBuffer(outBuffers[0].pvBuffer);
1519 DeleteSecurityContext(&sspi->context);
1520 return (-1);
1521 }
1522
1523 DEBUG_printf(("5http_sspi_client: %d bytes of handshake data sent.", cbData));
1524
1525 /*
1526 * Free output buffer.
1527 */
1528
1529 FreeContextBuffer(outBuffers[0].pvBuffer);
1530 outBuffers[0].pvBuffer = NULL;
1531 }
1532 }
1533
1534 /*
1535 * If InitializeSecurityContext returned SEC_E_INCOMPLETE_MESSAGE, then we
1536 * need to read more data from the server and try again.
1537 */
1538
1539 if (scRet == SEC_E_INCOMPLETE_MESSAGE)
1540 continue;
1541
1542 /*
1543 * If InitializeSecurityContext returned SEC_E_OK, then the handshake
1544 * completed successfully.
1545 */
1546
1547 if (scRet == SEC_E_OK)
1548 {
1549 /*
1550 * If the "extra" buffer contains data, this is encrypted application
1551 * protocol layer stuff. It needs to be saved. The application layer will
1552 * later decrypt it with DecryptMessage.
1553 */
1554
1555 DEBUG_puts("5http_sspi_client: Handshake was successful.");
1556
1557 if (inBuffers[1].BufferType == SECBUFFER_EXTRA)
1558 {
1559 memmove(sspi->decryptBuffer, sspi->decryptBuffer + sspi->decryptBufferUsed - inBuffers[1].cbBuffer, inBuffers[1].cbBuffer);
1560
1561 sspi->decryptBufferUsed = inBuffers[1].cbBuffer;
1562
1563 DEBUG_printf(("5http_sspi_client: %d bytes of app data was bundled with handshake data", sspi->decryptBufferUsed));
1564 }
1565 else
1566 sspi->decryptBufferUsed = 0;
1567
1568 /*
1569 * Bail out to quit
1570 */
1571
1572 break;
1573 }
1574
1575 /*
1576 * Check for fatal error.
1577 */
1578
1579 if (FAILED(scRet))
1580 {
1581 DEBUG_printf(("5http_sspi_client: InitializeSecurityContext(2) failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1582 ret = -1;
1583 break;
1584 }
1585
1586 /*
1587 * If InitializeSecurityContext returned SEC_I_INCOMPLETE_CREDENTIALS,
1588 * then the server just requested client authentication.
1589 */
1590
1591 if (scRet == SEC_I_INCOMPLETE_CREDENTIALS)
1592 {
1593 /*
1594 * Unimplemented
1595 */
1596
1597 DEBUG_printf(("5http_sspi_client: server requested client credentials."));
1598 ret = -1;
1599 break;
1600 }
1601
1602 /*
1603 * Copy any leftover data from the "extra" buffer, and go around again.
1604 */
1605
1606 if (inBuffers[1].BufferType == SECBUFFER_EXTRA)
1607 {
1608 memmove(sspi->decryptBuffer, sspi->decryptBuffer + sspi->decryptBufferUsed - inBuffers[1].cbBuffer, inBuffers[1].cbBuffer);
1609
1610 sspi->decryptBufferUsed = inBuffers[1].cbBuffer;
1611 }
1612 else
1613 {
1614 sspi->decryptBufferUsed = 0;
1615 }
1616 }
1617
1618 if (!ret)
1619 {
1620 /*
1621 * Success! Get the server cert
1622 */
1623
1624 sspi->contextInitialized = TRUE;
1625
1626 scRet = QueryContextAttributes(&sspi->context, SECPKG_ATTR_REMOTE_CERT_CONTEXT, (VOID *)&(sspi->remoteCert));
1627
1628 if (scRet != SEC_E_OK)
1629 {
1630 DEBUG_printf(("5http_sspi_client: QueryContextAttributes failed(SECPKG_ATTR_REMOTE_CERT_CONTEXT): %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1631 return (-1);
1632 }
1633
1634 /*
1635 * Find out how big the header/trailer will be:
1636 */
1637
1638 scRet = QueryContextAttributes(&sspi->context, SECPKG_ATTR_STREAM_SIZES, &sspi->streamSizes);
1639
1640 if (scRet != SEC_E_OK)
1641 {
1642 DEBUG_printf(("5http_sspi_client: QueryContextAttributes failed(SECPKG_ATTR_STREAM_SIZES): %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
1643 ret = -1;
1644 }
1645 }
1646
1647 return (ret);
1648 }
1649
1650
1651 /*
1652 * 'http_sspi_create_credential()' - Create an SSPI certificate context.
1653 */
1654
1655 static PCCERT_CONTEXT /* O - Certificate context */
1656 http_sspi_create_credential(
1657 http_credential_t *cred) /* I - Credential */
1658 {
1659 if (cred)
1660 return (CertCreateCertificateContext(X509_ASN_ENCODING, cred->data, cred->datalen));
1661 else
1662 return (NULL);
1663 }
1664
1665
1666 /*
1667 * 'http_sspi_find_credentials()' - Retrieve a TLS certificate from the system store.
1668 */
1669
1670 static BOOL /* O - 1 on success, 0 on failure */
1671 http_sspi_find_credentials(
1672 http_t *http, /* I - HTTP connection */
1673 const LPWSTR container, /* I - Cert container name */
1674 const char *common_name) /* I - Common name of certificate */
1675 {
1676 _http_sspi_t *sspi = http->tls; /* SSPI data */
1677 HCERTSTORE store = NULL; /* Certificate store */
1678 PCCERT_CONTEXT storedContext = NULL; /* Context created from the store */
1679 DWORD dwSize = 0; /* 32 bit size */
1680 PBYTE p = NULL; /* Temporary storage */
1681 HCRYPTPROV hProv = (HCRYPTPROV)NULL;
1682 /* Handle to a CSP */
1683 CERT_NAME_BLOB sib; /* Arbitrary array of bytes */
1684 SCHANNEL_CRED SchannelCred; /* Schannel credential data */
1685 TimeStamp tsExpiry; /* Time stamp */
1686 SECURITY_STATUS Status; /* Status */
1687 BOOL ok = TRUE; /* Return value */
1688
1689
1690 if (!CryptAcquireContextW(&hProv, (LPWSTR)container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET))
1691 {
1692 if (GetLastError() == NTE_EXISTS)
1693 {
1694 if (!CryptAcquireContextW(&hProv, (LPWSTR)container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
1695 {
1696 DEBUG_printf(("5http_sspi_find_credentials: CryptAcquireContext failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1697 ok = FALSE;
1698 goto cleanup;
1699 }
1700 }
1701 }
1702
1703 store = CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING|PKCS_7_ASN_ENCODING, hProv, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_NO_CRYPT_RELEASE_FLAG | CERT_STORE_OPEN_EXISTING_FLAG, L"MY");
1704
1705 if (!store)
1706 {
1707 DEBUG_printf(("5http_sspi_find_credentials: CertOpenSystemStore failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1708 ok = FALSE;
1709 goto cleanup;
1710 }
1711
1712 dwSize = 0;
1713
1714 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, NULL, &dwSize, NULL))
1715 {
1716 DEBUG_printf(("5http_sspi_find_credentials: CertStrToName failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1717 ok = FALSE;
1718 goto cleanup;
1719 }
1720
1721 p = (PBYTE)malloc(dwSize);
1722
1723 if (!p)
1724 {
1725 DEBUG_printf(("5http_sspi_find_credentials: malloc failed for %d bytes.", dwSize));
1726 ok = FALSE;
1727 goto cleanup;
1728 }
1729
1730 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, p, &dwSize, NULL))
1731 {
1732 DEBUG_printf(("5http_sspi_find_credentials: CertStrToName failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1733 ok = FALSE;
1734 goto cleanup;
1735 }
1736
1737 sib.cbData = dwSize;
1738 sib.pbData = p;
1739
1740 storedContext = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_SUBJECT_NAME, &sib, NULL);
1741
1742 if (!storedContext)
1743 {
1744 DEBUG_printf(("5http_sspi_find_credentials: Unable to find credentials for \"%s\".", common_name));
1745 ok = FALSE;
1746 goto cleanup;
1747 }
1748
1749 ZeroMemory(&SchannelCred, sizeof(SchannelCred));
1750
1751 SchannelCred.dwVersion = SCHANNEL_CRED_VERSION;
1752 SchannelCred.cCreds = 1;
1753 SchannelCred.paCred = &storedContext;
1754
1755 /*
1756 * Set supported protocols (can also be overriden in the registry...)
1757 */
1758
1759 #ifdef SP_PROT_TLS1_2_SERVER
1760 if (http->mode == _HTTP_MODE_SERVER)
1761 {
1762 if (tls_options & _HTTP_TLS_DENY_TLS10)
1763 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER;
1764 else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
1765 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_0_SERVER | SP_PROT_SSL3_SERVER;
1766 else
1767 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_0_SERVER;
1768 }
1769 else
1770 {
1771 if (tls_options & _HTTP_TLS_DENY_TLS10)
1772 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT;
1773 else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
1774 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_0_CLIENT | SP_PROT_SSL3_CLIENT;
1775 else
1776 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_0_CLIENT;
1777 }
1778
1779 #else
1780 if (http->mode == _HTTP_MODE_SERVER)
1781 {
1782 if (tls_min_version == _HTTP_TLS_SSL3)
1783 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_SERVER | SP_PROT_SSL3_SERVER;
1784 else
1785 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_SERVER;
1786 }
1787 else
1788 {
1789 if (tls_min_version == _HTTP_TLS_SSL3)
1790 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT | SP_PROT_SSL3_CLIENT;
1791 else
1792 SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT;
1793 }
1794 #endif /* SP_PROT_TLS1_2_SERVER */
1795
1796 /* TODO: Support _HTTP_TLS_ALLOW_RC4, _HTTP_TLS_ALLOW_DH, and _HTTP_TLS_DENY_CBC options; right now we'll rely on Windows registry to enable/disable RC4/DH/CBC... */
1797
1798 /*
1799 * Create an SSPI credential.
1800 */
1801
1802 Status = AcquireCredentialsHandle(NULL, UNISP_NAME, http->mode == _HTTP_MODE_SERVER ? SECPKG_CRED_INBOUND : SECPKG_CRED_OUTBOUND, NULL, &SchannelCred, NULL, NULL, &sspi->creds, &tsExpiry);
1803 if (Status != SEC_E_OK)
1804 {
1805 DEBUG_printf(("5http_sspi_find_credentials: AcquireCredentialsHandle failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), Status)));
1806 ok = FALSE;
1807 goto cleanup;
1808 }
1809
1810 cleanup:
1811
1812 /*
1813 * Cleanup
1814 */
1815
1816 if (storedContext)
1817 CertFreeCertificateContext(storedContext);
1818
1819 if (p)
1820 free(p);
1821
1822 if (store)
1823 CertCloseStore(store, 0);
1824
1825 if (hProv)
1826 CryptReleaseContext(hProv, 0);
1827
1828 return (ok);
1829 }
1830
1831
1832 /*
1833 * 'http_sspi_free()' - Close a connection and free resources.
1834 */
1835
1836 static void
1837 http_sspi_free(_http_sspi_t *sspi) /* I - SSPI data */
1838 {
1839 if (!sspi)
1840 return;
1841
1842 if (sspi->contextInitialized)
1843 DeleteSecurityContext(&sspi->context);
1844
1845 if (sspi->decryptBuffer)
1846 free(sspi->decryptBuffer);
1847
1848 if (sspi->readBuffer)
1849 free(sspi->readBuffer);
1850
1851 if (sspi->writeBuffer)
1852 free(sspi->writeBuffer);
1853
1854 if (sspi->localCert)
1855 CertFreeCertificateContext(sspi->localCert);
1856
1857 if (sspi->remoteCert)
1858 CertFreeCertificateContext(sspi->remoteCert);
1859
1860 free(sspi);
1861 }
1862
1863
1864 /*
1865 * 'http_sspi_make_credentials()' - Create a TLS certificate in the system store.
1866 */
1867
1868 static BOOL /* O - 1 on success, 0 on failure */
1869 http_sspi_make_credentials(
1870 _http_sspi_t *sspi, /* I - SSPI data */
1871 const LPWSTR container, /* I - Cert container name */
1872 const char *common_name, /* I - Common name of certificate */
1873 _http_mode_t mode, /* I - Client or server? */
1874 int years) /* I - Years until expiration */
1875 {
1876 HCERTSTORE store = NULL; /* Certificate store */
1877 PCCERT_CONTEXT storedContext = NULL; /* Context created from the store */
1878 PCCERT_CONTEXT createdContext = NULL; /* Context created by us */
1879 DWORD dwSize = 0; /* 32 bit size */
1880 PBYTE p = NULL; /* Temporary storage */
1881 HCRYPTPROV hProv = (HCRYPTPROV)NULL;
1882 /* Handle to a CSP */
1883 CERT_NAME_BLOB sib; /* Arbitrary array of bytes */
1884 SCHANNEL_CRED SchannelCred; /* Schannel credential data */
1885 TimeStamp tsExpiry; /* Time stamp */
1886 SECURITY_STATUS Status; /* Status */
1887 HCRYPTKEY hKey = (HCRYPTKEY)NULL; /* Handle to crypto key */
1888 CRYPT_KEY_PROV_INFO kpi; /* Key container info */
1889 SYSTEMTIME et; /* System time */
1890 CERT_EXTENSIONS exts; /* Array of cert extensions */
1891 CRYPT_KEY_PROV_INFO ckp; /* Handle to crypto key */
1892 BOOL ok = TRUE; /* Return value */
1893
1894
1895 DEBUG_printf(("4http_sspi_make_credentials(sspi=%p, container=%p, common_name=\"%s\", mode=%d, years=%d)", sspi, container, common_name, mode, years));
1896
1897 if (!CryptAcquireContextW(&hProv, (LPWSTR)container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET))
1898 {
1899 if (GetLastError() == NTE_EXISTS)
1900 {
1901 if (!CryptAcquireContextW(&hProv, (LPWSTR)container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
1902 {
1903 DEBUG_printf(("5http_sspi_make_credentials: CryptAcquireContext failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1904 ok = FALSE;
1905 goto cleanup;
1906 }
1907 }
1908 }
1909
1910 store = CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING|PKCS_7_ASN_ENCODING, hProv, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_NO_CRYPT_RELEASE_FLAG | CERT_STORE_OPEN_EXISTING_FLAG, L"MY");
1911
1912 if (!store)
1913 {
1914 DEBUG_printf(("5http_sspi_make_credentials: CertOpenSystemStore failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1915 ok = FALSE;
1916 goto cleanup;
1917 }
1918
1919 dwSize = 0;
1920
1921 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, NULL, &dwSize, NULL))
1922 {
1923 DEBUG_printf(("5http_sspi_make_credentials: CertStrToName failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1924 ok = FALSE;
1925 goto cleanup;
1926 }
1927
1928 p = (PBYTE)malloc(dwSize);
1929
1930 if (!p)
1931 {
1932 DEBUG_printf(("5http_sspi_make_credentials: malloc failed for %d bytes", dwSize));
1933 ok = FALSE;
1934 goto cleanup;
1935 }
1936
1937 if (!CertStrToName(X509_ASN_ENCODING, common_name, CERT_OID_NAME_STR, NULL, p, &dwSize, NULL))
1938 {
1939 DEBUG_printf(("5http_sspi_make_credentials: CertStrToName failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1940 ok = FALSE;
1941 goto cleanup;
1942 }
1943
1944 /*
1945 * Create a private key and self-signed certificate...
1946 */
1947
1948 if (!CryptGenKey(hProv, AT_KEYEXCHANGE, CRYPT_EXPORTABLE, &hKey))
1949 {
1950 DEBUG_printf(("5http_sspi_make_credentials: CryptGenKey failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1951 ok = FALSE;
1952 goto cleanup;
1953 }
1954
1955 ZeroMemory(&kpi, sizeof(kpi));
1956 kpi.pwszContainerName = (LPWSTR)container;
1957 kpi.pwszProvName = MS_DEF_PROV_W;
1958 kpi.dwProvType = PROV_RSA_FULL;
1959 kpi.dwFlags = CERT_SET_KEY_CONTEXT_PROP_ID;
1960 kpi.dwKeySpec = AT_KEYEXCHANGE;
1961
1962 GetSystemTime(&et);
1963 et.wYear += years;
1964
1965 ZeroMemory(&exts, sizeof(exts));
1966
1967 createdContext = CertCreateSelfSignCertificate(hProv, &sib, 0, &kpi, NULL, NULL, &et, &exts);
1968
1969 if (!createdContext)
1970 {
1971 DEBUG_printf(("5http_sspi_make_credentials: CertCreateSelfSignCertificate failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1972 ok = FALSE;
1973 goto cleanup;
1974 }
1975
1976 /*
1977 * Add the created context to the named store, and associate it with the named
1978 * container...
1979 */
1980
1981 if (!CertAddCertificateContextToStore(store, createdContext, CERT_STORE_ADD_REPLACE_EXISTING, &storedContext))
1982 {
1983 DEBUG_printf(("5http_sspi_make_credentials: CertAddCertificateContextToStore failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1984 ok = FALSE;
1985 goto cleanup;
1986 }
1987
1988 ZeroMemory(&ckp, sizeof(ckp));
1989 ckp.pwszContainerName = (LPWSTR) container;
1990 ckp.pwszProvName = MS_DEF_PROV_W;
1991 ckp.dwProvType = PROV_RSA_FULL;
1992 ckp.dwFlags = CRYPT_MACHINE_KEYSET;
1993 ckp.dwKeySpec = AT_KEYEXCHANGE;
1994
1995 if (!CertSetCertificateContextProperty(storedContext, CERT_KEY_PROV_INFO_PROP_ID, 0, &ckp))
1996 {
1997 DEBUG_printf(("5http_sspi_make_credentials: CertSetCertificateContextProperty failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), GetLastError())));
1998 ok = FALSE;
1999 goto cleanup;
2000 }
2001
2002 /*
2003 * Get a handle to use the certificate...
2004 */
2005
2006 ZeroMemory(&SchannelCred, sizeof(SchannelCred));
2007
2008 SchannelCred.dwVersion = SCHANNEL_CRED_VERSION;
2009 SchannelCred.cCreds = 1;
2010 SchannelCred.paCred = &storedContext;
2011
2012 /*
2013 * SSPI doesn't seem to like it if grbitEnabledProtocols is set for a client.
2014 */
2015
2016 if (mode == _HTTP_MODE_SERVER)
2017 SchannelCred.grbitEnabledProtocols = SP_PROT_SSL3TLS1;
2018
2019 /*
2020 * Create an SSPI credential.
2021 */
2022
2023 Status = AcquireCredentialsHandle(NULL, UNISP_NAME, mode == _HTTP_MODE_SERVER ? SECPKG_CRED_INBOUND : SECPKG_CRED_OUTBOUND, NULL, &SchannelCred, NULL, NULL, &sspi->creds, &tsExpiry);
2024 if (Status != SEC_E_OK)
2025 {
2026 DEBUG_printf(("5http_sspi_make_credentials: AcquireCredentialsHandle failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), Status)));
2027 ok = FALSE;
2028 goto cleanup;
2029 }
2030
2031 cleanup:
2032
2033 /*
2034 * Cleanup
2035 */
2036
2037 if (hKey)
2038 CryptDestroyKey(hKey);
2039
2040 if (createdContext)
2041 CertFreeCertificateContext(createdContext);
2042
2043 if (storedContext)
2044 CertFreeCertificateContext(storedContext);
2045
2046 if (p)
2047 free(p);
2048
2049 if (store)
2050 CertCloseStore(store, 0);
2051
2052 if (hProv)
2053 CryptReleaseContext(hProv, 0);
2054
2055 return (ok);
2056 }
2057
2058
2059 /*
2060 * 'http_sspi_server()' - Negotiate a TLS connection as a server.
2061 */
2062
2063 static int /* O - 0 on success, -1 on failure */
2064 http_sspi_server(http_t *http, /* I - HTTP connection */
2065 const char *hostname) /* I - Hostname of server */
2066 {
2067 _http_sspi_t *sspi = http->tls; /* I - SSPI data */
2068 char common_name[512]; /* Common name for cert */
2069 DWORD dwSSPIFlags; /* SSL connection attributes we want */
2070 DWORD dwSSPIOutFlags; /* SSL connection attributes we got */
2071 TimeStamp tsExpiry; /* Time stamp */
2072 SECURITY_STATUS scRet; /* SSPI Status */
2073 SecBufferDesc inBuffer; /* Array of SecBuffer structs */
2074 SecBuffer inBuffers[2]; /* Security package buffer */
2075 SecBufferDesc outBuffer; /* Array of SecBuffer structs */
2076 SecBuffer outBuffers[1]; /* Security package buffer */
2077 int num = 0; /* 32 bit status value */
2078 BOOL fInitContext = TRUE; /* Has the context been init'd? */
2079 int ret = 0; /* Return value */
2080
2081
2082 DEBUG_printf(("4http_sspi_server(http=%p, hostname=\"%s\")", http, hostname));
2083
2084 dwSSPIFlags = ASC_REQ_SEQUENCE_DETECT |
2085 ASC_REQ_REPLAY_DETECT |
2086 ASC_REQ_CONFIDENTIALITY |
2087 ASC_REQ_EXTENDED_ERROR |
2088 ASC_REQ_ALLOCATE_MEMORY |
2089 ASC_REQ_STREAM;
2090
2091 sspi->decryptBufferUsed = 0;
2092
2093 /*
2094 * Lookup the server certificate...
2095 */
2096
2097 snprintf(common_name, sizeof(common_name), "CN=%s", hostname);
2098
2099 if (!http_sspi_find_credentials(http, L"ServerContainer", common_name))
2100 if (!http_sspi_make_credentials(http->tls, L"ServerContainer", common_name, _HTTP_MODE_SERVER, 10))
2101 {
2102 DEBUG_puts("5http_sspi_server: Unable to get server credentials.");
2103 return (-1);
2104 }
2105
2106 /*
2107 * Set OutBuffer for AcceptSecurityContext call
2108 */
2109
2110 outBuffer.cBuffers = 1;
2111 outBuffer.pBuffers = outBuffers;
2112 outBuffer.ulVersion = SECBUFFER_VERSION;
2113
2114 scRet = SEC_I_CONTINUE_NEEDED;
2115
2116 while (scRet == SEC_I_CONTINUE_NEEDED ||
2117 scRet == SEC_E_INCOMPLETE_MESSAGE ||
2118 scRet == SEC_I_INCOMPLETE_CREDENTIALS)
2119 {
2120 if (sspi->decryptBufferUsed == 0 || scRet == SEC_E_INCOMPLETE_MESSAGE)
2121 {
2122 if (sspi->decryptBufferLength <= sspi->decryptBufferUsed)
2123 {
2124 BYTE *temp; /* New buffer */
2125
2126 if (sspi->decryptBufferLength >= 262144)
2127 {
2128 WSASetLastError(E_OUTOFMEMORY);
2129 DEBUG_puts("5http_sspi_server: Decryption buffer too large (>256k)");
2130 return (-1);
2131 }
2132
2133 if ((temp = realloc(sspi->decryptBuffer, sspi->decryptBufferLength + 4096)) == NULL)
2134 {
2135 DEBUG_printf(("5http_sspi_server: Unable to allocate %d byte buffer.", sspi->decryptBufferLength + 4096));
2136 WSASetLastError(E_OUTOFMEMORY);
2137 return (-1);
2138 }
2139
2140 sspi->decryptBufferLength += 4096;
2141 sspi->decryptBuffer = temp;
2142 }
2143
2144 for (;;)
2145 {
2146 num = recv(http->fd, sspi->decryptBuffer + sspi->decryptBufferUsed, (int)(sspi->decryptBufferLength - sspi->decryptBufferUsed), 0);
2147
2148 if (num == -1 && WSAGetLastError() == WSAEWOULDBLOCK)
2149 Sleep(1);
2150 else
2151 break;
2152 }
2153
2154 if (num < 0)
2155 {
2156 DEBUG_printf(("5http_sspi_server: recv failed: %d", WSAGetLastError()));
2157 return (-1);
2158 }
2159 else if (num == 0)
2160 {
2161 DEBUG_puts("5http_sspi_server: client disconnected");
2162 return (-1);
2163 }
2164
2165 DEBUG_printf(("5http_sspi_server: received %d (handshake) bytes from client.", num));
2166 sspi->decryptBufferUsed += num;
2167 }
2168
2169 /*
2170 * InBuffers[1] is for getting extra data that SSPI/SCHANNEL doesn't process
2171 * on this run around the loop.
2172 */
2173
2174 inBuffers[0].pvBuffer = sspi->decryptBuffer;
2175 inBuffers[0].cbBuffer = (unsigned long)sspi->decryptBufferUsed;
2176 inBuffers[0].BufferType = SECBUFFER_TOKEN;
2177
2178 inBuffers[1].pvBuffer = NULL;
2179 inBuffers[1].cbBuffer = 0;
2180 inBuffers[1].BufferType = SECBUFFER_EMPTY;
2181
2182 inBuffer.cBuffers = 2;
2183 inBuffer.pBuffers = inBuffers;
2184 inBuffer.ulVersion = SECBUFFER_VERSION;
2185
2186 /*
2187 * Initialize these so if we fail, pvBuffer contains NULL, so we don't try to
2188 * free random garbage at the quit.
2189 */
2190
2191 outBuffers[0].pvBuffer = NULL;
2192 outBuffers[0].BufferType = SECBUFFER_TOKEN;
2193 outBuffers[0].cbBuffer = 0;
2194
2195 scRet = AcceptSecurityContext(&sspi->creds, (fInitContext?NULL:&sspi->context), &inBuffer, dwSSPIFlags, SECURITY_NATIVE_DREP, (fInitContext?&sspi->context:NULL), &outBuffer, &dwSSPIOutFlags, &tsExpiry);
2196
2197 fInitContext = FALSE;
2198
2199 if (scRet == SEC_E_OK ||
2200 scRet == SEC_I_CONTINUE_NEEDED ||
2201 (FAILED(scRet) && ((dwSSPIOutFlags & ISC_RET_EXTENDED_ERROR) != 0)))
2202 {
2203 if (outBuffers[0].cbBuffer && outBuffers[0].pvBuffer)
2204 {
2205 /*
2206 * Send response to server if there is one.
2207 */
2208
2209 num = send(http->fd, outBuffers[0].pvBuffer, outBuffers[0].cbBuffer, 0);
2210
2211 if (num <= 0)
2212 {
2213 DEBUG_printf(("5http_sspi_server: handshake send failed: %d", WSAGetLastError()));
2214 return (-1);
2215 }
2216
2217 DEBUG_printf(("5http_sspi_server: sent %d handshake bytes to client.", outBuffers[0].cbBuffer));
2218
2219 FreeContextBuffer(outBuffers[0].pvBuffer);
2220 outBuffers[0].pvBuffer = NULL;
2221 }
2222 }
2223
2224 if (scRet == SEC_E_OK)
2225 {
2226 /*
2227 * If there's extra data then save it for next time we go to decrypt.
2228 */
2229
2230 if (inBuffers[1].BufferType == SECBUFFER_EXTRA)
2231 {
2232 memcpy(sspi->decryptBuffer, (LPBYTE)(sspi->decryptBuffer + sspi->decryptBufferUsed - inBuffers[1].cbBuffer), inBuffers[1].cbBuffer);
2233 sspi->decryptBufferUsed = inBuffers[1].cbBuffer;
2234 }
2235 else
2236 {
2237 sspi->decryptBufferUsed = 0;
2238 }
2239 break;
2240 }
2241 else if (FAILED(scRet) && scRet != SEC_E_INCOMPLETE_MESSAGE)
2242 {
2243 DEBUG_printf(("5http_sspi_server: AcceptSecurityContext failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
2244 ret = -1;
2245 break;
2246 }
2247
2248 if (scRet != SEC_E_INCOMPLETE_MESSAGE &&
2249 scRet != SEC_I_INCOMPLETE_CREDENTIALS)
2250 {
2251 if (inBuffers[1].BufferType == SECBUFFER_EXTRA)
2252 {
2253 memcpy(sspi->decryptBuffer, (LPBYTE)(sspi->decryptBuffer + sspi->decryptBufferUsed - inBuffers[1].cbBuffer), inBuffers[1].cbBuffer);
2254 sspi->decryptBufferUsed = inBuffers[1].cbBuffer;
2255 }
2256 else
2257 {
2258 sspi->decryptBufferUsed = 0;
2259 }
2260 }
2261 }
2262
2263 if (!ret)
2264 {
2265 sspi->contextInitialized = TRUE;
2266
2267 /*
2268 * Find out how big the header will be:
2269 */
2270
2271 scRet = QueryContextAttributes(&sspi->context, SECPKG_ATTR_STREAM_SIZES, &sspi->streamSizes);
2272
2273 if (scRet != SEC_E_OK)
2274 {
2275 DEBUG_printf(("5http_sspi_server: QueryContextAttributes failed: %s", http_sspi_strerror(sspi->error, sizeof(sspi->error), scRet)));
2276 ret = -1;
2277 }
2278 }
2279
2280 return (ret);
2281 }
2282
2283
2284 /*
2285 * 'http_sspi_strerror()' - Return a string for the specified error code.
2286 */
2287
2288 static const char * /* O - String for error */
2289 http_sspi_strerror(char *buffer, /* I - Error message buffer */
2290 size_t bufsize, /* I - Size of buffer */
2291 DWORD code) /* I - Error code */
2292 {
2293 if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, code, 0, buffer, bufsize, NULL))
2294 {
2295 /*
2296 * Strip trailing CR + LF...
2297 */
2298
2299 char *ptr; /* Pointer into error message */
2300
2301 for (ptr = buffer + strlen(buffer) - 1; ptr >= buffer; ptr --)
2302 if (*ptr == '\n' || *ptr == '\r')
2303 *ptr = '\0';
2304 else
2305 break;
2306 }
2307 else
2308 snprintf(buffer, bufsize, "Unknown error %x", code);
2309
2310 return (buffer);
2311 }
2312
2313
2314 /*
2315 * 'http_sspi_verify()' - Verify a certificate.
2316 */
2317
2318 static DWORD /* O - Error code (0 == No error) */
2319 http_sspi_verify(
2320 PCCERT_CONTEXT cert, /* I - Server certificate */
2321 const char *common_name, /* I - Common name */
2322 DWORD dwCertFlags) /* I - Verification flags */
2323 {
2324 HTTPSPolicyCallbackData httpsPolicy; /* HTTPS Policy Struct */
2325 CERT_CHAIN_POLICY_PARA policyPara; /* Cert chain policy parameters */
2326 CERT_CHAIN_POLICY_STATUS policyStatus;/* Cert chain policy status */
2327 CERT_CHAIN_PARA chainPara; /* Used for searching and matching criteria */
2328 PCCERT_CHAIN_CONTEXT chainContext = NULL;
2329 /* Certificate chain */
2330 PWSTR commonNameUnicode = NULL;
2331 /* Unicode common name */
2332 LPSTR rgszUsages[] = { szOID_PKIX_KP_SERVER_AUTH,
2333 szOID_SERVER_GATED_CRYPTO,
2334 szOID_SGC_NETSCAPE };
2335 /* How are we using this certificate? */
2336 DWORD cUsages = sizeof(rgszUsages) / sizeof(LPSTR);
2337 /* Number of ites in rgszUsages */
2338 DWORD count; /* 32 bit count variable */
2339 DWORD status; /* Return value */
2340 #ifdef DEBUG
2341 char error[1024]; /* Error message string */
2342 #endif /* DEBUG */
2343
2344
2345 if (!cert)
2346 return (SEC_E_WRONG_PRINCIPAL);
2347
2348 /*
2349 * Convert common name to Unicode.
2350 */
2351
2352 if (!common_name || !*common_name)
2353 return (SEC_E_WRONG_PRINCIPAL);
2354
2355 count = MultiByteToWideChar(CP_ACP, 0, common_name, -1, NULL, 0);
2356 commonNameUnicode = LocalAlloc(LMEM_FIXED, count * sizeof(WCHAR));
2357 if (!commonNameUnicode)
2358 return (SEC_E_INSUFFICIENT_MEMORY);
2359
2360 if (!MultiByteToWideChar(CP_ACP, 0, common_name, -1, commonNameUnicode, count))
2361 {
2362 LocalFree(commonNameUnicode);
2363 return (SEC_E_WRONG_PRINCIPAL);
2364 }
2365
2366 /*
2367 * Build certificate chain.
2368 */
2369
2370 ZeroMemory(&chainPara, sizeof(chainPara));
2371
2372 chainPara.cbSize = sizeof(chainPara);
2373 chainPara.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR;
2374 chainPara.RequestedUsage.Usage.cUsageIdentifier = cUsages;
2375 chainPara.RequestedUsage.Usage.rgpszUsageIdentifier = rgszUsages;
2376
2377 if (!CertGetCertificateChain(NULL, cert, NULL, cert->hCertStore, &chainPara, 0, NULL, &chainContext))
2378 {
2379 status = GetLastError();
2380
2381 DEBUG_printf(("CertGetCertificateChain returned: %s", http_sspi_strerror(error, sizeof(error), status)));
2382
2383 LocalFree(commonNameUnicode);
2384 return (status);
2385 }
2386
2387 /*
2388 * Validate certificate chain.
2389 */
2390
2391 ZeroMemory(&httpsPolicy, sizeof(HTTPSPolicyCallbackData));
2392 httpsPolicy.cbStruct = sizeof(HTTPSPolicyCallbackData);
2393 httpsPolicy.dwAuthType = AUTHTYPE_SERVER;
2394 httpsPolicy.fdwChecks = dwCertFlags;
2395 httpsPolicy.pwszServerName = commonNameUnicode;
2396
2397 memset(&policyPara, 0, sizeof(policyPara));
2398 policyPara.cbSize = sizeof(policyPara);
2399 policyPara.pvExtraPolicyPara = &httpsPolicy;
2400
2401 memset(&policyStatus, 0, sizeof(policyStatus));
2402 policyStatus.cbSize = sizeof(policyStatus);
2403
2404 if (!CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_SSL, chainContext, &policyPara, &policyStatus))
2405 {
2406 status = GetLastError();
2407
2408 DEBUG_printf(("CertVerifyCertificateChainPolicy returned %s", http_sspi_strerror(error, sizeof(error), status)));
2409 }
2410 else if (policyStatus.dwError)
2411 status = policyStatus.dwError;
2412 else
2413 status = SEC_E_OK;
2414
2415 if (chainContext)
2416 CertFreeCertificateChain(chainContext);
2417
2418 if (commonNameUnicode)
2419 LocalFree(commonNameUnicode);
2420
2421 return (status);
2422 }
Unnamed repository; edit this file 'description' to name the repository.