mirror of
https://github.com/moparisthebest/curl
synced 2024-12-25 17:48:48 -05:00
schannel: move code out of SChannel_connect_step1
Reviewed-by: Marc Hoersken Closes #7168
This commit is contained in:
Ebe Janchivdorj
Daniel Stenberg
parent
510e6e9a19
commit
68d388061c
@ -413,108 +413,17 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
|
|||||||
return CURLE_OK;
|
return CURLE_OK;
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
static CURLcode
|
static CURLcode
|
||||||
schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn,
|
schannel_acquire_credential_handle(struct Curl_easy *data,
|
||||||
|
struct connectdata *conn,
|
||||||
int sockindex)
|
int sockindex)
|
||||||
{
|
{
|
||||||
ssize_t written = -1;
|
|
||||||
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
|
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
|
||||||
SecBuffer outbuf;
|
|
||||||
SecBufferDesc outbuf_desc;
|
|
||||||
SecBuffer inbuf;
|
|
||||||
SecBufferDesc inbuf_desc;
|
|
||||||
#ifdef HAS_ALPN
|
|
||||||
unsigned char alpn_buffer[128];
|
|
||||||
#endif
|
|
||||||
SCHANNEL_CRED schannel_cred;
|
SCHANNEL_CRED schannel_cred;
|
||||||
PCCERT_CONTEXT client_certs[1] = { NULL };
|
PCCERT_CONTEXT client_certs[1] = { NULL };
|
||||||
SECURITY_STATUS sspi_status = SEC_E_OK;
|
SECURITY_STATUS sspi_status = SEC_E_OK;
|
||||||
struct Curl_schannel_cred *old_cred = NULL;
|
|
||||||
struct in_addr addr;
|
|
||||||
#ifdef ENABLE_IPV6
|
|
||||||
struct in6_addr addr6;
|
|
||||||
#endif
|
|
||||||
TCHAR *host_name;
|
|
||||||
CURLcode result;
|
CURLcode result;
|
||||||
char * const hostname = SSL_HOST_NAME();
|
|
||||||
|
|
||||||
DEBUGF(infof(data,
|
|
||||||
"schannel: SSL/TLS connection with %s port %hu (step 1/3)\n",
|
|
||||||
hostname, conn->remote_port));
|
|
||||||
|
|
||||||
if(curlx_verify_windows_version(5, 1, PLATFORM_WINNT,
|
|
||||||
VERSION_LESS_THAN_EQUAL)) {
|
|
||||||
/* Schannel in Windows XP (OS version 5.1) uses legacy handshakes and
|
|
||||||
algorithms that may not be supported by all servers. */
|
|
||||||
infof(data, "schannel: Windows version is old and may not be able to "
|
|
||||||
"connect to some servers due to lack of SNI, algorithms, etc.\n");
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef HAS_ALPN
|
|
||||||
/* ALPN is only supported on Windows 8.1 / Server 2012 R2 and above.
|
|
||||||
Also it doesn't seem to be supported for Wine, see curl bug #983. */
|
|
||||||
BACKEND->use_alpn = conn->bits.tls_enable_alpn &&
|
|
||||||
!GetProcAddress(GetModuleHandle(TEXT("ntdll")),
|
|
||||||
"wine_get_version") &&
|
|
||||||
curlx_verify_windows_version(6, 3, PLATFORM_WINNT,
|
|
||||||
VERSION_GREATER_THAN_EQUAL);
|
|
||||||
#else
|
|
||||||
BACKEND->use_alpn = false;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef _WIN32_WCE
|
|
||||||
#ifdef HAS_MANUAL_VERIFY_API
|
|
||||||
/* certificate validation on CE doesn't seem to work right; we'll
|
|
||||||
* do it following a more manual process. */
|
|
||||||
BACKEND->use_manual_cred_validation = true;
|
|
||||||
#else
|
|
||||||
#error "compiler too old to support requisite manual cert verify for Win CE"
|
|
||||||
#endif
|
|
||||||
#else
|
|
||||||
#ifdef HAS_MANUAL_VERIFY_API
|
|
||||||
if(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(ca_info_blob)) {
|
|
||||||
if(curlx_verify_windows_version(6, 1, PLATFORM_WINNT,
|
|
||||||
VERSION_GREATER_THAN_EQUAL)) {
|
|
||||||
BACKEND->use_manual_cred_validation = true;
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
failf(data, "schannel: this version of Windows is too old to support "
|
|
||||||
"certificate verification via CA bundle file.");
|
|
||||||
return CURLE_SSL_CACERT_BADFILE;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else
|
|
||||||
BACKEND->use_manual_cred_validation = false;
|
|
||||||
#else
|
|
||||||
if(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(ca_info_blob)) {
|
|
||||||
failf(data, "schannel: CA cert support not built in");
|
|
||||||
return CURLE_NOT_BUILT_IN;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#endif
|
|
||||||
|
|
||||||
BACKEND->cred = NULL;
|
|
||||||
|
|
||||||
/* check for an existing re-usable credential handle */
|
|
||||||
if(SSL_SET_OPTION(primary.sessionid)) {
|
|
||||||
Curl_ssl_sessionid_lock(data);
|
|
||||||
if(!Curl_ssl_getsessionid(data, conn,
|
|
||||||
SSL_IS_PROXY() ? TRUE : FALSE,
|
|
||||||
(void **)&old_cred, NULL, sockindex)) {
|
|
||||||
BACKEND->cred = old_cred;
|
|
||||||
DEBUGF(infof(data, "schannel: re-using existing credential handle\n"));
|
|
||||||
|
|
||||||
/* increment the reference counter of the credential/session handle */
|
|
||||||
BACKEND->cred->refcount++;
|
|
||||||
DEBUGF(infof(data,
|
|
||||||
"schannel: incremented credential handle refcount = %d\n",
|
|
||||||
BACKEND->cred->refcount));
|
|
||||||
}
|
|
||||||
Curl_ssl_sessionid_unlock(data);
|
|
||||||
}
|
|
||||||
|
|
||||||
if(!BACKEND->cred) {
|
|
||||||
/* setup Schannel API options */
|
/* setup Schannel API options */
|
||||||
memset(&schannel_cred, 0, sizeof(schannel_cred));
|
memset(&schannel_cred, 0, sizeof(schannel_cred));
|
||||||
schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
|
schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
|
||||||
@ -836,6 +745,113 @@ schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn,
|
|||||||
return CURLE_SSL_CONNECT_ERROR;
|
return CURLE_SSL_CONNECT_ERROR;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
return CURLE_OK;
|
||||||
|
}
|
||||||
|
|
||||||
|
static CURLcode
|
||||||
|
schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn,
|
||||||
|
int sockindex)
|
||||||
|
{
|
||||||
|
ssize_t written = -1;
|
||||||
|
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
|
||||||
|
SecBuffer outbuf;
|
||||||
|
SecBufferDesc outbuf_desc;
|
||||||
|
SecBuffer inbuf;
|
||||||
|
SecBufferDesc inbuf_desc;
|
||||||
|
#ifdef HAS_ALPN
|
||||||
|
unsigned char alpn_buffer[128];
|
||||||
|
#endif
|
||||||
|
SECURITY_STATUS sspi_status = SEC_E_OK;
|
||||||
|
struct Curl_schannel_cred *old_cred = NULL;
|
||||||
|
struct in_addr addr;
|
||||||
|
#ifdef ENABLE_IPV6
|
||||||
|
struct in6_addr addr6;
|
||||||
|
#endif
|
||||||
|
TCHAR *host_name;
|
||||||
|
CURLcode result;
|
||||||
|
char * const hostname = SSL_HOST_NAME();
|
||||||
|
|
||||||
|
DEBUGF(infof(data,
|
||||||
|
"schannel: SSL/TLS connection with %s port %hu (step 1/3)\n",
|
||||||
|
hostname, conn->remote_port));
|
||||||
|
|
||||||
|
if(curlx_verify_windows_version(5, 1, PLATFORM_WINNT,
|
||||||
|
VERSION_LESS_THAN_EQUAL)) {
|
||||||
|
/* Schannel in Windows XP (OS version 5.1) uses legacy handshakes and
|
||||||
|
algorithms that may not be supported by all servers. */
|
||||||
|
infof(data, "schannel: Windows version is old and may not be able to "
|
||||||
|
"connect to some servers due to lack of SNI, algorithms, etc.\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
#ifdef HAS_ALPN
|
||||||
|
/* ALPN is only supported on Windows 8.1 / Server 2012 R2 and above.
|
||||||
|
Also it doesn't seem to be supported for Wine, see curl bug #983. */
|
||||||
|
BACKEND->use_alpn = conn->bits.tls_enable_alpn &&
|
||||||
|
!GetProcAddress(GetModuleHandle(TEXT("ntdll")),
|
||||||
|
"wine_get_version") &&
|
||||||
|
curlx_verify_windows_version(6, 3, PLATFORM_WINNT,
|
||||||
|
VERSION_GREATER_THAN_EQUAL);
|
||||||
|
#else
|
||||||
|
BACKEND->use_alpn = false;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#ifdef _WIN32_WCE
|
||||||
|
#ifdef HAS_MANUAL_VERIFY_API
|
||||||
|
/* certificate validation on CE doesn't seem to work right; we'll
|
||||||
|
* do it following a more manual process. */
|
||||||
|
BACKEND->use_manual_cred_validation = true;
|
||||||
|
#else
|
||||||
|
#error "compiler too old to support requisite manual cert verify for Win CE"
|
||||||
|
#endif
|
||||||
|
#else
|
||||||
|
#ifdef HAS_MANUAL_VERIFY_API
|
||||||
|
if(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(ca_info_blob)) {
|
||||||
|
if(curlx_verify_windows_version(6, 1, PLATFORM_WINNT,
|
||||||
|
VERSION_GREATER_THAN_EQUAL)) {
|
||||||
|
BACKEND->use_manual_cred_validation = true;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
failf(data, "schannel: this version of Windows is too old to support "
|
||||||
|
"certificate verification via CA bundle file.");
|
||||||
|
return CURLE_SSL_CACERT_BADFILE;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
BACKEND->use_manual_cred_validation = false;
|
||||||
|
#else
|
||||||
|
if(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(ca_info_blob)) {
|
||||||
|
failf(data, "schannel: CA cert support not built in");
|
||||||
|
return CURLE_NOT_BUILT_IN;
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
#endif
|
||||||
|
|
||||||
|
BACKEND->cred = NULL;
|
||||||
|
|
||||||
|
/* check for an existing re-usable credential handle */
|
||||||
|
if(SSL_SET_OPTION(primary.sessionid)) {
|
||||||
|
Curl_ssl_sessionid_lock(data);
|
||||||
|
if(!Curl_ssl_getsessionid(data, conn,
|
||||||
|
SSL_IS_PROXY() ? TRUE : FALSE,
|
||||||
|
(void **)&old_cred, NULL, sockindex)) {
|
||||||
|
BACKEND->cred = old_cred;
|
||||||
|
DEBUGF(infof(data, "schannel: re-using existing credential handle\n"));
|
||||||
|
|
||||||
|
/* increment the reference counter of the credential/session handle */
|
||||||
|
BACKEND->cred->refcount++;
|
||||||
|
DEBUGF(infof(data,
|
||||||
|
"schannel: incremented credential handle refcount = %d\n",
|
||||||
|
BACKEND->cred->refcount));
|
||||||
|
}
|
||||||
|
Curl_ssl_sessionid_unlock(data);
|
||||||
|
}
|
||||||
|
|
||||||
|
if(!BACKEND->cred) {
|
||||||
|
result = schannel_acquire_credential_handle(data, conn, sockindex);
|
||||||
|
if(result != CURLE_OK) {
|
||||||
|
return result;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Warn if SNI is disabled due to use of an IP address */
|
/* Warn if SNI is disabled due to use of an IP address */
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user