Ros-diffs

ros-diffs@reactos.org

81390 discussions

[cwittich] 69401: [RAPPS] add support for SSL certificate pinning
by cwittich＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: cwittich Date: Mon Sep 28 14:09:09 2015 New Revision: 69401 URL: http://svn.reactos.org/svn/reactos?rev=69401&view=rev Log: [RAPPS] add support for SSL certificate pinning Modified: trunk/reactos/base/applications/rapps/CMakeLists.txt trunk/reactos/base/applications/rapps/lang/bg-BG.rc trunk/reactos/base/applications/rapps/lang/cs-CZ.rc trunk/reactos/base/applications/rapps/lang/de-DE.rc trunk/reactos/base/applications/rapps/lang/en-US.rc trunk/reactos/base/applications/rapps/lang/es-ES.rc trunk/reactos/base/applications/rapps/lang/fr-FR.rc trunk/reactos/base/applications/rapps/lang/he-IL.rc trunk/reactos/base/applications/rapps/lang/it-IT.rc trunk/reactos/base/applications/rapps/lang/ja-JP.rc trunk/reactos/base/applications/rapps/lang/no-NO.rc trunk/reactos/base/applications/rapps/lang/pl-PL.rc trunk/reactos/base/applications/rapps/lang/pt-BR.rc trunk/reactos/base/applications/rapps/lang/ro-RO.rc trunk/reactos/base/applications/rapps/lang/ru-RU.rc trunk/reactos/base/applications/rapps/lang/sk-SK.rc trunk/reactos/base/applications/rapps/lang/sq-AL.rc trunk/reactos/base/applications/rapps/lang/sv-SE.rc trunk/reactos/base/applications/rapps/lang/tr-TR.rc trunk/reactos/base/applications/rapps/lang/uk-UA.rc trunk/reactos/base/applications/rapps/lang/zh-CN.rc trunk/reactos/base/applications/rapps/lang/zh-TW.rc trunk/reactos/base/applications/rapps/loaddlg.c trunk/reactos/base/applications/rapps/rapps.h trunk/reactos/base/applications/rapps/resource.h Modified: trunk/reactos/base/applications/rapps/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/CM… ============================================================================== --- trunk/reactos/base/applications/rapps/CMakeLists.txt [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/CMakeLists.txt [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -16,6 +16,7 @@ winmain.c rapps.h) +add_definitions(-DUSE_CERT_PINNING) file(GLOB_RECURSE rapps_rc_deps res/*.*) add_rc_deps(rapps.rc ${rapps_rc_deps}) add_executable(rapps ${SOURCE} rapps.rc) Modified: trunk/reactos/base/applications/rapps/lang/bg-BG.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/bg-BG.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/bg-BG.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -201,4 +201,5 @@ IDS_INFORMATION "Ð¡Ð²ÐµÐ´ÐµÐ½Ð¸Ñ" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "ÐÑÐµÐ¼Ð°ÑÐ²Ð°Ð½ÐµÑÐ¾ Ð½Ð° Ð´Ð°Ð½Ð½Ð¸ÑÐµ Ð·Ð° Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸ÐµÑÐ¾ Ð¾Ñ ÑÐµÐ³Ð¸ÑÑÑÑÐ° Ðµ Ð½ÐµÐ²ÑÐ·Ð¼Ð¾Ð¶Ð½Ð¾!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/cs-CZ.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/cs-CZ.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/cs-CZ.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -202,4 +202,5 @@ IDS_INFORMATION "Informace" IDS_UNABLE_TO_DOWNLOAD "Soubor se nepodaÅilo stÃ¡hnout! Adresa nenalezena!" IDS_UNABLE_TO_REMOVE "NepodaÅilo se odstranit data programu z registru!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/de-DE.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/de-DE.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/de-DE.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -197,4 +197,5 @@ IDS_INFORMATION "Informationen" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "Konnte die Daten nicht aus der Registry lÃ¶schen!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/en-US.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/en-US.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/en-US.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -197,4 +197,5 @@ IDS_INFORMATION "Information" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "Unable to remove data on the program from the registry!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/es-ES.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/es-ES.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/es-ES.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -200,4 +200,5 @@ IDS_INFORMATION "InformaciÃ³n" IDS_UNABLE_TO_DOWNLOAD "No se pudo descargar el paquete. No se ha encontrado la direcciÃ³n de Internet." IDS_UNABLE_TO_REMOVE "No se pudieron borrar del Registro los datos de instalaciÃ³n del programa." -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/fr-FR.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/fr-FR.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/fr-FR.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -197,4 +197,5 @@ IDS_INFORMATION "Information" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "Impossible de supprimer les donnÃ©es du programme du registre !" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/he-IL.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/he-IL.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/he-IL.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -199,4 +199,5 @@ IDS_INFORMATION "××××¢" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "Unable to remove data on the program from the registry!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/it-IT.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/it-IT.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/it-IT.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -197,4 +197,5 @@ IDS_INFORMATION "Informazioni" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "Impossibile cancellare i dati dal registry!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/ja-JP.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/ja-JP.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/ja-JP.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -197,4 +197,5 @@ IDS_INFORMATION "æå ±" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "ã¬ã¸ã¹ããªãããã®ããã°ã©ã ã«é¢ãããã¼ã¿ãåé¤ã§ãã¾ãã!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/no-NO.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/no-NO.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/no-NO.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -197,4 +197,5 @@ IDS_INFORMATION "Information" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "Unable to remove data on the program from the registry!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/pl-PL.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/pl-PL.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/pl-PL.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -205,4 +205,5 @@ IDS_INFORMATION "Informacja" IDS_UNABLE_TO_DOWNLOAD "Nie moÅ¼na pobraÄ pakietu! Nie znaleziono adresu!" IDS_UNABLE_TO_REMOVE "Nie moÅ¼na byÅo usunÄÄ wpisu z rejestru!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/pt-BR.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/pt-BR.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/pt-BR.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -199,4 +199,5 @@ IDS_INFORMATION "InformaÃ§Ãµes" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "NÃ£o foi possÃvel remover as informaÃ§Ãµes do programa do registro!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/ro-RO.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/ro-RO.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/ro-RO.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -203,4 +203,5 @@ IDS_INFORMATION "InformaÈie" IDS_UNABLE_TO_DOWNLOAD "Pachetul nu poate fi descÄrcat! Adresa nu este gÄsitÄ!" IDS_UNABLE_TO_REMOVE "Nu se pot elimina datele din registru pentru acest program!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/ru-RU.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/ru-RU.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/ru-RU.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -197,4 +197,5 @@ IDS_INFORMATION "ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "ÐÐµ ÑÐ´Ð°Ð»Ð¾ÑÑ ÑÐ´Ð°Ð»Ð¸ÑÑ Ð´Ð°Ð½Ð½ÑÐµ Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ðµ Ð¸Ð· ÑÐµÐµÑÑÑÐ°!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/sk-SK.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/sk-SK.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/sk-SK.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -202,4 +202,5 @@ IDS_INFORMATION "InformÃ¡cie" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "Nie je moÅ¾nÃ© odstrÃ¡niÅ¥ z registrov Ãºdaje o programe!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/sq-AL.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/sq-AL.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/sq-AL.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -201,4 +201,5 @@ IDS_INFORMATION "Informacione" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "E pamundur te fshihen informacionet e programit nga regjistri!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/sv-SE.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/sv-SE.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/sv-SE.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -204,4 +204,5 @@ IDS_INFORMATION "Information" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "Det gick ej att ta bort programmets data frÃ¥n registret!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/tr-TR.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/tr-TR.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/tr-TR.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -199,4 +199,5 @@ IDS_INFORMATION "Bilgi" IDS_UNABLE_TO_DOWNLOAD "Paket indirilemez! Adres bulunamadÄ±!" IDS_UNABLE_TO_REMOVE "Ä°zlencenin giriÅi deÄer defterinden silinemiyor." -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/uk-UA.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/uk-UA.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/uk-UA.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -205,4 +205,5 @@ IDS_INFORMATION "ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÑÑ" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "ÐÐµ Ð²Ð´Ð°Ð»Ð¾ÑÑ Ð²Ð¸Ð´Ð°Ð»Ð¸ÑÐ¸ Ð´Ð°Ð½Ñ Ð¿ÑÐ¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ñ Ð· ÑÐµÑÑÑÑÑ!" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/zh-CN.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/zh-CN.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/zh-CN.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -200,4 +200,5 @@ IDS_INFORMATION "ä¿¡æ¯" IDS_UNABLE_TO_DOWNLOAD "æ æ³ä¸è½½è¯¥è½¯ä»¶å ï¼æ¾ä¸å°ç½ç»çå°å ï¼" IDS_UNABLE_TO_REMOVE "æ æ³ä»æ³¨åè¡¨å é¤è¯¥ç¨åºçæ°æ®ï¼" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/lang/zh-TW.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/la… ============================================================================== --- trunk/reactos/base/applications/rapps/lang/zh-TW.rc [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/lang/zh-TW.rc [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -199,4 +199,5 @@ IDS_INFORMATION "è³è¨" IDS_UNABLE_TO_DOWNLOAD "Unable to download the package! Address not found!" IDS_UNABLE_TO_REMOVE "ç¡æ³å¾ç»éæªåªé¤è©²ç¨å¼çè³æï¼" -END + IDS_CERT_DOES_NOT_MATCH "SSL certificate verification failed." +END Modified: trunk/reactos/base/applications/rapps/loaddlg.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/lo… ============================================================================== --- trunk/reactos/base/applications/rapps/loaddlg.c [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/loaddlg.c [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -201,6 +201,58 @@ return (IBindStatusCallback*) This; } +#ifdef USE_CERT_PINNING +static BOOL CertIsValid(HINTERNET hInternet, LPWSTR lpszHostName) +{ + HINTERNET hConnect; + HINTERNET hRequest; + DWORD certInfoLength; + BOOL Ret = FALSE; + INTERNET_CERTIFICATE_INFOW certInfo; + + hConnect = InternetConnectW(hInternet, lpszHostName, INTERNET_DEFAULT_HTTPS_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, INTERNET_FLAG_SECURE, 0); + if (hConnect) + { + hRequest = HttpOpenRequestW(hConnect, L"HEAD", NULL, NULL, NULL, NULL, INTERNET_FLAG_SECURE, 0); + if (hRequest != NULL) + { + Ret = HttpSendRequestW(hRequest, L"", 0, NULL, 0); + if (Ret) + { + certInfoLength = sizeof(INTERNET_CERTIFICATE_INFOW); + Ret = InternetQueryOptionW(hRequest, + INTERNET_OPTION_SECURITY_CERTIFICATE_STRUCT, + &certInfo, + &certInfoLength); + if (Ret) + { + if (certInfo.lpszEncryptionAlgName) + LocalFree(certInfo.lpszEncryptionAlgName); + if (certInfo.lpszIssuerInfo) + { + if (strcmp((LPSTR)certInfo.lpszIssuerInfo, CERT_ISSUER_INFO) != 0) + Ret = FALSE; + LocalFree(certInfo.lpszIssuerInfo); + } + if (certInfo.lpszProtocolName) + LocalFree(certInfo.lpszProtocolName); + if (certInfo.lpszSignatureAlgName) + LocalFree(certInfo.lpszSignatureAlgName); + if (certInfo.lpszSubjectInfo) + { + if (strcmp((LPSTR)certInfo.lpszSubjectInfo, CERT_SUBJECT_INFO) != 0) + Ret = FALSE; + LocalFree(certInfo.lpszSubjectInfo); + } + } + } + InternetCloseHandle(hRequest); + } + } + return Ret; +} +#endif + static DWORD WINAPI ThreadFunc(LPVOID Context) @@ -307,6 +359,8 @@ urlComponents.dwSchemeLength = urlLength*sizeof(WCHAR); urlComponents.lpszScheme = malloc(urlComponents.dwSchemeLength); + urlComponents.dwHostNameLength = urlLength*sizeof(WCHAR); + urlComponents.lpszHostName = malloc(urlComponents.dwHostNameLength); if(!InternetCrackUrlW(AppInfo->szUrlDownload, urlLength+1, ICU_DECODE | ICU_ESCAPE, &urlComponents)) goto end; @@ -317,7 +371,21 @@ if(urlComponents.nScheme == INTERNET_SCHEME_FTP) dwContentLen = FtpGetFileSize(hFile, &dwStatus); +#ifdef USE_CERT_PINNING + if ((urlComponents.nScheme == INTERNET_SCHEME_HTTPS) && (!CertIsValid(hOpen, urlComponents.lpszHostName))) + { + WCHAR szMsgText[MAX_STR_LEN]; + + if (!LoadStringW(hInst, IDS_CERT_DOES_NOT_MATCH, szMsgText, sizeof(szMsgText) / sizeof(WCHAR))) + goto end; + + MessageBoxW(hMainWnd, szMsgText, NULL, MB_OK | MB_ICONERROR); + goto end; + } +#endif + free(urlComponents.lpszScheme); + free(urlComponents.lpszHostName); hOut = CreateFileW(path, GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, 0, NULL); Modified: trunk/reactos/base/applications/rapps/rapps.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/ra… ============================================================================== --- trunk/reactos/base/applications/rapps/rapps.h [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/rapps.h [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -25,6 +25,11 @@ #include <rappsmsg.h> #include "resource.h" + +#ifdef USE_CERT_PINNING + #define CERT_ISSUER_INFO "BE\r\nGlobalSign nv-sa\r\nGlobalSign Domain Validation CA - SHA256 - G2" + #define CERT_SUBJECT_INFO "Domain Control Validated\r\n*.reactos.org" +#endif #define APPLICATION_DATABASE_URL L"https://svn.reactos.org/packages/rappmgr.cab" Modified: trunk/reactos/base/applications/rapps/resource.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/re… ============================================================================== --- trunk/reactos/base/applications/rapps/resource.h [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/resource.h [iso-8859-1] Mon Sep 28 14:09:09 2015 @@ -96,6 +96,7 @@ #define IDS_INFORMATION 117 #define IDS_UNABLE_TO_REMOVE 118 #define IDS_UNABLE_TO_DOWNLOAD 119 +#define IDS_CERT_DOES_NOT_MATCH 120 /* Tooltips */ #define IDS_TOOLTIP_INSTALL 200

1 0

[sginsberg] 69400: [NTOS] Implement the KD Get/SetContextEx functionality (copying part of a CONTEXT via Offset + Byte Count instead of copying a whole context), and stub out KdpWriteCustomBreakpoi...
by sginsberg＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: sginsberg Date: Mon Sep 28 14:08:54 2015 New Revision: 69400 URL: http://svn.reactos.org/svn/reactos?rev=69400&view=rev Log: [NTOS] Implement the KD Get/SetContextEx functionality (copying part of a CONTEXT via Offset + Byte Count instead of copying a whole context), and stub out KdpWriteCustomBreakpoint. Newer WinDbg uses the GetContextEx functionality regardless of whether we report it as supported or not, and didn't seem to fall back on the regular GetContext functionality when it was missing, so whatever it was using it for should work awesome now. This had no impact on the broken Registers window though. Also small fix to use the _M_XXX checks consistently. Modified: trunk/reactos/include/reactos/windbgkd.h trunk/reactos/ntoskrnl/kd64/kdapi.c trunk/reactos/ntoskrnl/kd64/kddata.c Modified: trunk/reactos/include/reactos/windbgkd.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/windbgkd.h… ============================================================================== --- trunk/reactos/include/reactos/windbgkd.h [iso-8859-1] (original) +++ trunk/reactos/include/reactos/windbgkd.h [iso-8859-1] Mon Sep 28 14:08:54 2015 @@ -111,16 +111,10 @@ #define DbgKdFillMemoryApi 0x0000315B #define DbgKdQueryMemoryApi 0x0000315C #define DbgKdSwitchPartition 0x0000315D -#define DbgKdMaximumManipulate 0x0000315E - -/* - * Three possible new API messages as well as the new Max - * if these were to be added. Be careful about implementing these. - */ -//#define DbgKdWriteCustomBreakpointApi 0x0000315E -//#define DbgKdGetContextExApi 0x0000315F -//#define DbgKdSetContextExApi 0x00003160 -//#define DbgKdMaximumManipulate 0x00003161 +#define DbgKdWriteCustomBreakpointApi 0x0000315E +#define DbgKdGetContextExApi 0x0000315F +#define DbgKdSetContextExApi 0x00003160 +#define DbgKdMaximumManipulate 0x00003161 // // Debug I/O Types @@ -713,6 +707,22 @@ { ULONG Partition; } DBGKD_SWITCH_PARTITION; + +typedef struct _DBGKD_CONTEXT_EX +{ + ULONG Offset; + ULONG ByteCount; + ULONG BytesCopied; +} DBGKD_CONTEXT_EX, *PDBGKD_CONTEXT_EX; + +typedef struct _DBGKD_WRITE_CUSTOM_BREAKPOINT +{ + ULONG64 BreakPointAddress; + ULONG64 BreakPointInstruction; + ULONG BreakPointHandle; + UCHAR BreakPointInstructionSize; + UCHAR BreakPointInstructionAlignment; +} DBGKD_WRITE_CUSTOM_BREAKPOINT, *PDBGKD_WRITE_CUSTOM_BREAKPOINT; // // DBGKD Structure for Manipulate @@ -782,6 +792,8 @@ DBGKD_FILL_MEMORY FillMemory; DBGKD_QUERY_MEMORY QueryMemory; DBGKD_SWITCH_PARTITION SwitchPartition; + DBGKD_WRITE_CUSTOM_BREAKPOINT WriteCustomBreakpoint; + DBGKD_CONTEXT_EX ContextEx; } u; } DBGKD_MANIPULATE_STATE64, *PDBGKD_MANIPULATE_STATE64; @@ -878,22 +890,6 @@ } u; } DBGKD_TRACE_IO, *PDBGKD_TRACE_IO; -typedef struct _DBGKD_WRITE_CUSTOM_BREAKPOINT -{ - ULONG64 BreakPointAddress; - ULONG64 BreakPointInstruction; - ULONG BreakPointHandle; - UCHAR BreakPointInstructionSize; - UCHAR BreakPointInstructionAlignment; -} DBGKD_WRITE_CUSTOM_BREAKPOINT, *PDBGKD_WRITE_CUSTOM_BREAKPOINT; - -typedef struct _DBGKD_CONTEXT_EX -{ - ULONG Offset; - ULONG ByteCount; - ULONG BytesCopied; -} DBGKD_CONTEXT_EX, *PDBGKD_CONTEXT_EX; - static __inline VOID Modified: trunk/reactos/ntoskrnl/kd64/kdapi.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/kd64/kdapi.c?rev=… ============================================================================== --- trunk/reactos/ntoskrnl/kd64/kdapi.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/kd64/kdapi.c [iso-8859-1] Mon Sep 28 14:08:54 2015 @@ -315,6 +315,28 @@ VOID NTAPI +KdpWriteCustomBreakpoint(IN PDBGKD_MANIPULATE_STATE64 State, + IN PSTRING Data, + IN PCONTEXT Context) +{ + //PDBGKD_WRITE_CUSTOM_BREAKPOINT = &State->u.WriteCustomBreakpoint; + STRING Header; + + /* Not supported */ + KdpDprintf("Custom Breakpoint Write is unimplemented\n"); + + /* Send a failure packet */ + State->ReturnStatus = STATUS_UNSUCCESSFUL; + Header.Length = sizeof(DBGKD_MANIPULATE_STATE64); + Header.Buffer = (PCHAR)State; + KdSendPacket(PACKET_TYPE_KD_STATE_MANIPULATE, + &Header, + NULL, + &KdpContext); +} + +VOID +NTAPI DumpTraceData(IN PSTRING TraceData) { /* Update the buffer */ @@ -726,7 +748,8 @@ ASSERT(Data->Length == sizeof(CONTEXT)); /* Make sure that this is a valid request */ - if ((State->Processor < KeNumberProcessors) && (KdpContextSent != FALSE)) + if ((State->Processor < KeNumberProcessors) && + (KdpContextSent)) { /* Check if the request is for this CPU */ if (State->Processor == KeGetCurrentPrcb()->Number) @@ -750,6 +773,130 @@ else { /* Invalid request */ + State->ReturnStatus = STATUS_UNSUCCESSFUL; + } + + /* Send the reply */ + KdSendPacket(PACKET_TYPE_KD_STATE_MANIPULATE, + &Header, + NULL, + &KdpContext); +} + +VOID +NTAPI +KdpGetContextEx(IN PDBGKD_MANIPULATE_STATE64 State, + IN PSTRING Data, + IN PCONTEXT Context) +{ + STRING Header; + PDBGKD_CONTEXT_EX ContextEx; + PCONTEXT TargetContext; + ASSERT(Data->Length == 0); + + /* Get our struct */ + ContextEx = &State->u.ContextEx; + + /* Set up the header */ + Header.Length = sizeof(DBGKD_MANIPULATE_STATE64); + Header.Buffer = (PCHAR)State; + + /* Make sure that this is a valid request */ + if ((State->Processor < KeNumberProcessors) && + (ContextEx->Offset + ContextEx->ByteCount) <= sizeof(CONTEXT)) + { + /* Check if the request is for this CPU */ + if (State->Processor == KeGetCurrentPrcb()->Number) + { + /* We're just copying our own context */ + TargetContext = Context; + } + else + { + /* Get the context from the PRCB array */ + TargetContext = &KiProcessorBlock[State->Processor]-> + ProcessorState.ContextFrame; + } + + /* Copy what is requested */ + RtlCopyMemory(Data->Buffer, + (PVOID)((ULONG_PTR)TargetContext + ContextEx->Offset), + ContextEx->ByteCount); + + /* KD copies all */ + Data->Length = ContextEx->BytesCopied = ContextEx->ByteCount; + + /* Let the debugger set the context now */ + KdpContextSent = TRUE; + + /* Finish up */ + State->ReturnStatus = STATUS_SUCCESS; + } + else + { + /* Invalid request */ + ContextEx->BytesCopied = 0; + State->ReturnStatus = STATUS_UNSUCCESSFUL; + } + + /* Send the reply */ + KdSendPacket(PACKET_TYPE_KD_STATE_MANIPULATE, + &Header, + Data, + &KdpContext); +} + +VOID +NTAPI +KdpSetContextEx(IN PDBGKD_MANIPULATE_STATE64 State, + IN PSTRING Data, + IN PCONTEXT Context) +{ + STRING Header; + PDBGKD_CONTEXT_EX ContextEx; + PCONTEXT TargetContext; + + /* Get our struct */ + ContextEx = &State->u.ContextEx; + ASSERT(Data->Length == ContextEx->ByteCount); + + /* Set up the header */ + Header.Length = sizeof(DBGKD_MANIPULATE_STATE64); + Header.Buffer = (PCHAR)State; + + /* Make sure that this is a valid request */ + if ((State->Processor < KeNumberProcessors) && + ((ContextEx->Offset + ContextEx->ByteCount) <= sizeof(CONTEXT)) && + (KdpContextSent)) + { + /* Check if the request is for this CPU */ + if (State->Processor == KeGetCurrentPrcb()->Number) + { + /* We're just copying our own context */ + TargetContext = Context; + } + else + { + /* Get the context from the PRCB array */ + TargetContext = &KiProcessorBlock[State->Processor]-> + ProcessorState.ContextFrame; + } + + /* Copy what is requested */ + RtlCopyMemory((PVOID)((ULONG_PTR)TargetContext + ContextEx->Offset), + Data->Buffer, + ContextEx->ByteCount); + + /* KD copies all */ + ContextEx->BytesCopied = ContextEx->ByteCount; + + /* Finish up */ + State->ReturnStatus = STATUS_SUCCESS; + } + else + { + /* Invalid request */ + ContextEx->BytesCopied = 0; State->ReturnStatus = STATUS_UNSUCCESSFUL; } @@ -1359,27 +1506,29 @@ KdpNotSupported(&ManipulateState); break; + case DbgKdWriteCustomBreakpointApi: + + /* Write the customized breakpoint */ + KdpWriteCustomBreakpoint(&ManipulateState, &Data, Context); + break; + + case DbgKdGetContextExApi: + + /* Extended Context Get */ + KdpGetContextEx(&ManipulateState, &Data, Context); + break; + + case DbgKdSetContextExApi: + + /* Extended Context Set */ + KdpSetContextEx(&ManipulateState, &Data, Context); + break; + /* Unsupported Messages */ default: /* Send warning */ - KdpDprintf("Received Unhandled API %lx\n", ManipulateState.ApiNumber); - - /* - * These 3 messages are unimplemented by us, but one (DbgKdGetContextExApi) - * is sent by WinDbg as of late during kernel debugging for some reason even though - * our MaxManipulate in the version block does not report it as being available. - * - * Any of these being sent to begin with is most likely a bug in WinDbg, so these - * are ignored and do not print a warning message to not spam the debug output. - * So far, WinDbg seems perfectly fine with this. - * - * DbgKdSetContextExApi complements the Get and DbgKdWriteCustomBreakpointApi - * fills the gap after DbgKdSwitchPartition (0x315D). - */ - case 0x315E: // DbgKdWriteCustomBreakpointApi - case 0x315F: // DbgKdGetContextExApi - case 0x3160: // DbgKdSetContextExApi + KdpDprintf("Received Unrecognized API 0x%lx\n", ManipulateState.ApiNumber); /* Setup an empty message, with failure */ Data.Length = 0; Modified: trunk/reactos/ntoskrnl/kd64/kddata.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/kd64/kddata.c?rev… ============================================================================== --- trunk/reactos/ntoskrnl/kd64/kddata.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/kd64/kddata.c [iso-8859-1] Mon Sep 28 14:08:54 2015 @@ -19,11 +19,11 @@ // // Apply the KIPCR WDK workaround for x86 and AMD64 // -#if defined(_X86_) || defined(_AMD64_) +#if defined(_M_IX86) || defined(_M_AMD64) #define KPCR KIPCR #endif -#if defined(_X86_) +#if defined(_M_IX86) #define KPCR_SELF_PCR_OFFSET FIELD_OFFSET(KPCR, Self) #define KPCR_CURRENT_PRCB_OFFSET FIELD_OFFSET(KPCR, Prcb) @@ -33,7 +33,7 @@ #define KPRCB_PCR_PAGE_OFFSET 0 #define CBSTACK_FRAME_POINTER Ebp -#elif defined(_AMD64_) +#elif defined(_M_AMD64) #define KPCR_SELF_PCR_OFFSET FIELD_OFFSET(KPCR, Self) #define KPCR_CURRENT_PRCB_OFFSET FIELD_OFFSET(KPCR, CurrentPrcb) @@ -43,7 +43,7 @@ #define KPRCB_PCR_PAGE_OFFSET 0 #define CBSTACK_FRAME_POINTER Rbp -#elif defined(_ARM_) +#elif defined(_M_ARM) #define KPCR_SELF_PCR_OFFSET 0 #define KPCR_CURRENT_PRCB_OFFSET FIELD_OFFSET(KIPCR, Prcb) @@ -374,7 +374,7 @@ 0, DBGKD_64BIT_PROTOCOL_VERSION2, CURRENT_KD_SECONDARY_VERSION, -#if defined(_WIN64) +#if defined(_M_AMD64) || defined(_M_ARM64) DBGKD_VERS_FLAG_DATA | DBGKD_VERS_FLAG_PTR64, #else DBGKD_VERS_FLAG_DATA, @@ -521,7 +521,7 @@ KPRCB_PCR_PAGE_OFFSET, #endif FIELD_OFFSET(KPRCB, ProcessorState.SpecialRegisters), -#if defined(_X86_) +#if defined(_M_IX86) // // x86 GDT/LDT/TSS constants // @@ -535,7 +535,7 @@ KGDT_TSS, 0, 0, -#elif defined(_AMD64_) +#elif defined(_M_AMD64) // // AMD64 GDT/LDT/TSS constants //

1 0

[sginsberg] 69399: [NTOS] Fix kmtest
by sginsberg＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: sginsberg Date: Mon Sep 28 12:48:14 2015 New Revision: 69399 URL: http://svn.reactos.org/svn/reactos?rev=69399&view=rev Log: [NTOS] Fix kmtest Modified: trunk/reactos/ntoskrnl/ob/obwait.c Modified: trunk/reactos/ntoskrnl/ob/obwait.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ob/obwait.c?rev=6… ============================================================================== --- trunk/reactos/ntoskrnl/ob/obwait.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/ob/obwait.c [iso-8859-1] Mon Sep 28 12:48:14 2015 @@ -79,12 +79,12 @@ return STATUS_INVALID_PARAMETER_3; } - /* Enter SEH for user mode */ + /* Enter SEH */ PreviousMode = ExGetPreviousMode(); - if (PreviousMode != KernelMode) - { - /* Enter SEH */ - _SEH2_TRY + _SEH2_TRY + { + /* Probe for user mode */ + if (PreviousMode != KernelMode) { /* Check if we have a timeout */ if (TimeOut) @@ -94,34 +94,34 @@ TimeOut = &SafeTimeOut; } - /* Probe all the handles */ + /* Probe all the handles */ ProbeForRead(HandleArray, ObjectCount * sizeof(HANDLE), sizeof(HANDLE)); - - /* - * Make a copy so we don't have to guard with SEH later and keep - * track of what objects we referenced if dereferencing pointers - * suddenly fails - */ - RtlCopyMemory(Handles, - HandleArray, - ObjectCount * sizeof(HANDLE)); - } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) - { - /* Return the exception code */ - _SEH2_YIELD(return _SEH2_GetExceptionCode()); - } - _SEH2_END; - } - else - { - /* This is kernel mode, no need to wrap in SEH */ + } + + /* + * Make a copy so we don't have to guard with SEH later and keep + * track of what objects we referenced if dereferencing pointers + * suddenly fails + */ RtlCopyMemory(Handles, HandleArray, ObjectCount * sizeof(HANDLE)); } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) //ExSystemExceptionFilter() + { + /* Cover up for kernel mode */ + if (PreviousMode == KernelMode) + { + /* But don't fail silently */ + DbgPrint("Mon dieu! Covering up for BAD driver passing invalid pointer (0x%p)! Hon hon hon!\n", HandleArray); + } + + /* Return the exception code */ + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; /* Check if we can use the internal Wait Array */ if (ObjectCount > THREAD_WAIT_OBJECTS)

1 0

[pschweitzer] 69398: [KMTESTS:OB] Add a test dedicated to Stefan.
by pschweitzer＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: pschweitzer Date: Mon Sep 28 12:25:38 2015 New Revision: 69398 URL: http://svn.reactos.org/svn/reactos?rev=69398&view=rev Log: [KMTESTS:OB] Add a test dedicated to Stefan. Added: trunk/rostests/kmtests/ntos_ob/ObWait.c (with props) Modified: trunk/rostests/kmtests/CMakeLists.txt trunk/rostests/kmtests/kmtest_drv/testlist.c Modified: trunk/rostests/kmtests/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/CMakeLists.txt?re… ============================================================================== --- trunk/rostests/kmtests/CMakeLists.txt [iso-8859-1] (original) +++ trunk/rostests/kmtests/CMakeLists.txt [iso-8859-1] Mon Sep 28 12:25:38 2015 @@ -74,6 +74,7 @@ ntos_ob/ObReference.c ntos_ob/ObType.c ntos_ob/ObTypes.c + ntos_ob/ObWait.c ntos_ps/PsNotify.c ntos_se/SeHelpers.c ntos_se/SeInheritance.c Modified: trunk/rostests/kmtests/kmtest_drv/testlist.c URL: http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/kmtest_drv/testli… ============================================================================== --- trunk/rostests/kmtests/kmtest_drv/testlist.c [iso-8859-1] (original) +++ trunk/rostests/kmtests/kmtest_drv/testlist.c [iso-8859-1] Mon Sep 28 12:25:38 2015 @@ -66,6 +66,7 @@ KMT_TESTFUNC Test_ZwAllocateVirtualMemory; KMT_TESTFUNC Test_ZwCreateSection; KMT_TESTFUNC Test_ZwMapViewOfSection; +KMT_TESTFUNC Test_ZwWaitForMultipleObjects; const KMT_TEST TestList[] = { @@ -128,5 +129,6 @@ { "ZwAllocateVirtualMemory", Test_ZwAllocateVirtualMemory }, { "ZwCreateSection", Test_ZwCreateSection }, { "ZwMapViewOfSection", Test_ZwMapViewOfSection }, + { "ZwWaitForMultipleObjects", Test_ZwWaitForMultipleObjects}, { NULL, NULL } }; Added: trunk/rostests/kmtests/ntos_ob/ObWait.c URL: http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/ntos_ob/ObWait.c?… ============================================================================== --- trunk/rostests/kmtests/ntos_ob/ObWait.c (added) +++ trunk/rostests/kmtests/ntos_ob/ObWait.c [iso-8859-1] Mon Sep 28 12:25:38 2015 @@ -0,0 +1,64 @@ +/* + * PROJECT: ReactOS kernel-mode tests + * LICENSE: GPLv2+ - See COPYING in the top level directory + * PURPOSE: Kernel-Mode Test Suite *WaitForMultipleObjects + * PROGRAMMER: Pierre Schweitzer <thomas.faber(a)reactos.org> + */ + +#include <kmt_test.h> + +#define NDEBUG +#include <debug.h> + +static +VOID +NTAPI +KernelModeTest(IN PVOID Context) +{ + NTSTATUS Status; + + Status = ZwWaitForMultipleObjects(2, (void **)0x42424242, WaitAll, FALSE, NULL); + ok_eq_hex(Status, STATUS_ACCESS_VIOLATION); +} + +START_TEST(ZwWaitForMultipleObjects) +{ + NTSTATUS Status; + OBJECT_ATTRIBUTES ObjectAttributes; + HANDLE ThreadHandle; + PVOID ThreadObject = NULL; + + /* We've to be in kernel mode, so spawn a thread */ + InitializeObjectAttributes(&ObjectAttributes, + NULL, + OBJ_KERNEL_HANDLE, + NULL, + NULL); + Status = PsCreateSystemThread(&ThreadHandle, + SYNCHRONIZE, + &ObjectAttributes, + NULL, + NULL, + KernelModeTest, + NULL); + ok_eq_hex(Status, STATUS_SUCCESS); + if (Status == STATUS_SUCCESS) + { + /* Then, just wait on our thread to finish */ + Status = ObReferenceObjectByHandle(ThreadHandle, + SYNCHRONIZE, + *PsThreadType, + KernelMode, + &ThreadObject, + NULL); + ObCloseHandle(ThreadHandle, KernelMode); + + Status = KeWaitForSingleObject(ThreadObject, + Executive, + KernelMode, + FALSE, + NULL); + ok_eq_hex(Status, STATUS_SUCCESS); + ObDereferenceObject(ThreadObject); + } +} Propchange: trunk/rostests/kmtests/ntos_ob/ObWait.c ------------------------------------------------------------------------------ svn:eol-style = native

1 0

[akhaldi] 69397: [MBEDTLS] Add a resource file for the dll. By Ismael Ferreras Morezuelas with minor changes by me. CORE-9065
by akhaldi＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: akhaldi Date: Mon Sep 28 12:09:26 2015 New Revision: 69397 URL: http://svn.reactos.org/svn/reactos?rev=69397&view=rev Log: [MBEDTLS] Add a resource file for the dll. By Ismael Ferreras Morezuelas with minor changes by me. CORE-9065 Added: trunk/reactos/dll/3rdparty/mbedtls/mbedtls.rc (with props) Modified: trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt Modified: trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/CMake… ============================================================================== --- trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt [iso-8859-1] (original) +++ trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt [iso-8859-1] Mon Sep 28 12:09:26 2015 @@ -76,6 +76,7 @@ add_library(mbedtls SHARED ${src} + mbedtls.rc ${CMAKE_CURRENT_BINARY_DIR}/mbedtls.def) set_module_type(mbedtls win32dll) Added: trunk/reactos/dll/3rdparty/mbedtls/mbedtls.rc URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/mbedt… ============================================================================== --- trunk/reactos/dll/3rdparty/mbedtls/mbedtls.rc (added) +++ trunk/reactos/dll/3rdparty/mbedtls/mbedtls.rc [iso-8859-1] Mon Sep 28 12:09:26 2015 @@ -0,0 +1,21 @@ +#include <windef.h> +#define POLARSSL_CONFIG_H +#include <polarssl/version.h> + +LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL + +#define REACTOS_VERSION_DLL +#define REACTOS_STR_FILE_DESCRIPTION POLARSSL_VERSION_STRING_FULL +#define REACTOS_STR_PRODUCT_NAME POLARSSL_VERSION_STRING_FULL +#define REACTOS_STR_INTERNAL_NAME "mbedtls" +#define REACTOS_STR_ORIGINAL_FILENAME "mbedtls.dll" + +#define REACTOS_FILEVERSION POLARSSL_VERSION_MAJOR, \ + POLARSSL_VERSION_MINOR, \ + POLARSSL_VERSION_PATCH, \ + 0 + +#define REACTOS_STR_FILE_VERSION POLARSSL_VERSION_STRING + +#include <reactos/version.rc> +#include <reactos/manifest_dll.rc> Propchange: trunk/reactos/dll/3rdparty/mbedtls/mbedtls.rc ------------------------------------------------------------------------------ svn:eol-style = native

1 0

[pschweitzer] 69396: [RAPPS] Thanks to r69394, switch rapps database download to https
by pschweitzer＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: pschweitzer Date: Mon Sep 28 11:50:58 2015 New Revision: 69396 URL: http://svn.reactos.org/svn/reactos?rev=69396&view=rev Log: [RAPPS] Thanks to r69394, switch rapps database download to https Modified: trunk/reactos/base/applications/rapps/rapps.h Modified: trunk/reactos/base/applications/rapps/rapps.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/applications/rapps/ra… ============================================================================== --- trunk/reactos/base/applications/rapps/rapps.h [iso-8859-1] (original) +++ trunk/reactos/base/applications/rapps/rapps.h [iso-8859-1] Mon Sep 28 11:50:58 2015 @@ -26,8 +26,7 @@ #include "resource.h" -/* FIXME: this should be downloaded by HTTPS once is supported */ -#define APPLICATION_DATABASE_URL L"http://svn.reactos.org/packages/rappmgr.cab" +#define APPLICATION_DATABASE_URL L"https://svn.reactos.org/packages/rappmgr.cab" #define SPLIT_WIDTH 4 #define MAX_STR_LEN 256

1 0

[akhaldi] 69395: [GNUTLS] Get rid of what's left of the GnuTLS back-end. CORE-9065
by akhaldi＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: akhaldi Date: Mon Sep 28 11:23:36 2015 New Revision: 69395 URL: http://svn.reactos.org/svn/reactos?rev=69395&view=rev Log: [GNUTLS] Get rid of what's left of the GnuTLS back-end. CORE-9065 Removed: trunk/reactos/dll/win32/schannel/msvc_typeof_hack.h trunk/reactos/dll/win32/schannel/schannel_gnutls.c trunk/reactos/include/reactos/libs/gnutls/ Modified: trunk/reactos/boot/bootdata/packages/reactos.dff.in Modified: trunk/reactos/boot/bootdata/packages/reactos.dff.in URL: http://svn.reactos.org/svn/reactos/trunk/reactos/boot/bootdata/packages/rea… ============================================================================== --- trunk/reactos/boot/bootdata/packages/reactos.dff.in [iso-8859-1] (original) +++ trunk/reactos/boot/bootdata/packages/reactos.dff.in [iso-8859-1] Mon Sep 28 11:23:36 2015 @@ -69,7 +69,6 @@ 50 = security\templates 51 = system32\CatRoot 52 = system32\CatRoot2 -53 = system32\gnutls .InfEnd @@ -107,13 +106,4 @@ "modules/optional/vmx_svga.sys" 2 optional "modules/optional/wine_gecko-2.34-x86.msi" 4 optional "boot/bootdata/bootcdregtest/AHKAppTests.cmd" 7 optional -"modules/optional/gnutls/libgcc_s_sjlj-1.dll" 53 optional -"modules/optional/gnutls/libgmp-10.dll" 53 optional -"modules/optional/gnutls/libgnutls-28.dll" 53 optional -"modules/optional/gnutls/libgnutls-xssl-0.dll" 53 optional -"modules/optional/gnutls/libhogweed-2-5.dll" 53 optional -"modules/optional/gnutls/libnettle-4-7.dll" 53 optional -"modules/optional/gnutls/libp11-kit-0.dll" 53 optional -"modules/optional/gnutls/libwinpthread-1.dll" 53 optional -"modules/optional/gnutls/zlib1.dll" 53 optional ; DON'T REMOVE THE FOLLOWING NEW LINE ! THIS MEANS YOU ! Removed: trunk/reactos/dll/win32/schannel/msvc_typeof_hack.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/msvc_ty… ============================================================================== --- trunk/reactos/dll/win32/schannel/msvc_typeof_hack.h [iso-8859-1] (original) +++ trunk/reactos/dll/win32/schannel/msvc_typeof_hack.h (removed) @@ -1,48 +0,0 @@ - -#pragma once - -#define typeof(_X) __typeof_ ## _X - -typedef gnutls_alert_description_t (__cdecl typeof(gnutls_alert_get))(gnutls_session_t session); -typedef const char* (__cdecl typeof(gnutls_alert_get_name))(gnutls_alert_description_t alert); -typedef void (__cdecl typeof(gnutls_certificate_free_credentials))(gnutls_certificate_credentials_t sc); -typedef int (__cdecl typeof(gnutls_certificate_allocate_credentials))(gnutls_certificate_credentials_t - * res); -typedef const gnutls_datum_t* (__cdecl typeof(gnutls_certificate_get_peers))(gnutls_session_t - session, unsigned int - *list_size); -typedef gnutls_cipher_algorithm_t (__cdecl typeof(gnutls_cipher_get))(gnutls_session_t session); -typedef size_t (__cdecl typeof(gnutls_cipher_get_key_size))(gnutls_cipher_algorithm_t algorithm); -typedef int (__cdecl typeof(gnutls_credentials_set))(gnutls_session_t session, - gnutls_credentials_type_t type, void *cred); -typedef void (__cdecl typeof(gnutls_deinit))(gnutls_session_t session); -typedef int (__cdecl typeof(gnutls_global_init))(void); -typedef void (__cdecl typeof(gnutls_global_deinit))(void); -typedef void (__cdecl typeof(gnutls_global_set_log_function))(gnutls_log_func log_func); -typedef void (__cdecl typeof(gnutls_global_set_log_level))(int level); -typedef int (__cdecl typeof(gnutls_handshake))(gnutls_session_t session); -typedef int (__cdecl typeof(gnutls_init))(gnutls_session_t * session, unsigned int flags); -typedef gnutls_kx_algorithm_t (__cdecl typeof(gnutls_kx_get))(gnutls_session_t session); -typedef gnutls_mac_algorithm_t (__cdecl typeof(gnutls_mac_get))(gnutls_session_t session); -typedef size_t (__cdecl typeof(gnutls_mac_get_key_size))(gnutls_mac_algorithm_t algorithm); -typedef void (__cdecl typeof(gnutls_perror))(int error); -typedef gnutls_protocol_t (__cdecl typeof(gnutls_protocol_get_version))(gnutls_session_t session); -typedef int (__cdecl typeof(gnutls_priority_set_direct))(gnutls_session_t session, - const char *priorities, - const char **err_pos); -typedef size_t (__cdecl typeof(gnutls_record_get_max_size))(gnutls_session_t session); -typedef ssize_t (__cdecl typeof(gnutls_record_recv))(gnutls_session_t session, void *data, - size_t data_size); -typedef ssize_t (__cdecl typeof(gnutls_record_send))(gnutls_session_t session, const void *data, - size_t data_size); -typedef int (__cdecl typeof(gnutls_server_name_set))(gnutls_session_t session, - gnutls_server_name_type_t type, - const void *name, size_t name_length); -typedef gnutls_transport_ptr_t (__cdecl typeof(gnutls_transport_get_ptr))(gnutls_session_t session); -typedef void (__cdecl typeof(gnutls_transport_set_errno))(gnutls_session_t session, int err); -typedef void (__cdecl typeof(gnutls_transport_set_ptr))(gnutls_session_t session, - gnutls_transport_ptr_t ptr); -typedef void (__cdecl typeof(gnutls_transport_set_push_function))(gnutls_session_t session, - gnutls_push_func push_func); -typedef void (__cdecl typeof(gnutls_transport_set_pull_function))(gnutls_session_t session, - gnutls_pull_func pull_func); Removed: trunk/reactos/dll/win32/schannel/schannel_gnutls.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne… ============================================================================== --- trunk/reactos/dll/win32/schannel/schannel_gnutls.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/schannel/schannel_gnutls.c (removed) @@ -1,605 +0,0 @@ -/* - * GnuTLS-based implementation of the schannel (SSL/TLS) provider. - * - * Copyright 2005 Juan Lang - * Copyright 2008 Henri Verbeet - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA - */ - -#include "precomp.h" - -#include <wine/config.h> -#include <wine/port.h> -#include <wine/library.h> -#include <strsafe.h> - -#ifdef SONAME_LIBGNUTLS -#include <gnutls/gnutls.h> -#include <gnutls/crypto.h> -#endif - -#define __wine_dbch_secur32 __wine_dbch_schannel - -#if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H) && !defined(SONAME_LIBMBEDTLS) - -static void *libgnutls_handle; - -#ifdef _MSC_VER -#include "msvc_typeof_hack.h" -#endif - -#define MAKE_FUNCPTR(f) static typeof(f) * p##f -MAKE_FUNCPTR(gnutls_alert_get); -MAKE_FUNCPTR(gnutls_alert_get_name); -MAKE_FUNCPTR(gnutls_certificate_allocate_credentials); -MAKE_FUNCPTR(gnutls_certificate_free_credentials); -MAKE_FUNCPTR(gnutls_certificate_get_peers); -MAKE_FUNCPTR(gnutls_cipher_get); -MAKE_FUNCPTR(gnutls_cipher_get_key_size); -MAKE_FUNCPTR(gnutls_credentials_set); -MAKE_FUNCPTR(gnutls_deinit); -MAKE_FUNCPTR(gnutls_global_deinit); -MAKE_FUNCPTR(gnutls_global_init); -MAKE_FUNCPTR(gnutls_global_set_log_function); -MAKE_FUNCPTR(gnutls_global_set_log_level); -MAKE_FUNCPTR(gnutls_handshake); -MAKE_FUNCPTR(gnutls_init); -MAKE_FUNCPTR(gnutls_kx_get); -MAKE_FUNCPTR(gnutls_mac_get); -MAKE_FUNCPTR(gnutls_mac_get_key_size); -MAKE_FUNCPTR(gnutls_perror); -MAKE_FUNCPTR(gnutls_protocol_get_version); -MAKE_FUNCPTR(gnutls_priority_set_direct); -MAKE_FUNCPTR(gnutls_record_get_max_size); -MAKE_FUNCPTR(gnutls_record_recv); -MAKE_FUNCPTR(gnutls_record_send); -MAKE_FUNCPTR(gnutls_server_name_set); -MAKE_FUNCPTR(gnutls_transport_get_ptr); -MAKE_FUNCPTR(gnutls_transport_set_errno); -MAKE_FUNCPTR(gnutls_transport_set_ptr); -MAKE_FUNCPTR(gnutls_transport_set_pull_function); -MAKE_FUNCPTR(gnutls_transport_set_push_function); -#undef MAKE_FUNCPTR - - - -static ssize_t schan_pull_adapter(gnutls_transport_ptr_t transport, - void *buff, size_t buff_len) -{ - struct schan_transport *t = (struct schan_transport*)transport; - gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t); - - int ret = schan_pull(transport, buff, &buff_len); - if (ret) - { - pgnutls_transport_set_errno(s, ret); - return -1; - } - - return buff_len; -} - -static ssize_t schan_push_adapter(gnutls_transport_ptr_t transport, - const void *buff, size_t buff_len) -{ - struct schan_transport *t = (struct schan_transport*)transport; - gnutls_session_t s = (gnutls_session_t)schan_session_for_transport(t); - - int ret = schan_push(transport, buff, &buff_len); - if (ret) - { - pgnutls_transport_set_errno(s, ret); - return -1; - } - - return buff_len; -} - -static const struct { - DWORD enable_flag; - const char *gnutls_flag; -} protocol_priority_flags[] = { - {SP_PROT_TLS1_2_CLIENT, "VERS-TLS1.2"}, - {SP_PROT_TLS1_1_CLIENT, "VERS-TLS1.1"}, - {SP_PROT_TLS1_0_CLIENT, "VERS-TLS1.0"}, - {SP_PROT_SSL3_CLIENT, "VERS-SSL3.0"} - /* {SP_PROT_SSL2_CLIENT} is not supported by GnuTLS */ -}; - -DWORD schan_imp_enabled_protocols(void) -{ - /* NOTE: No support for SSL 2.0 */ - return SP_PROT_SSL3_CLIENT | SP_PROT_TLS1_0_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_2_CLIENT; -} - -BOOL schan_imp_create_session(schan_imp_session *session, schan_credentials *cred) -{ - gnutls_session_t *s = (gnutls_session_t*)session; - char priority[64] = "NORMAL", *p; - unsigned i; - - int err = pgnutls_init(s, cred->credential_use == SECPKG_CRED_INBOUND ? GNUTLS_SERVER : GNUTLS_CLIENT); - if (err != GNUTLS_E_SUCCESS) - { - pgnutls_perror(err); - return FALSE; - } - - p = priority + strlen(priority); - for(i=0; i < sizeof(protocol_priority_flags)/sizeof(*protocol_priority_flags); i++) { - *p++ = ':'; - *p++ = (cred->enabled_protocols & protocol_priority_flags[i].enable_flag) ? '+' : '-'; - strcpy(p, protocol_priority_flags[i].gnutls_flag); - p += strlen(p); - } - - TRACE("Using %s priority\n", debugstr_a(priority)); - err = pgnutls_priority_set_direct(*s, priority, NULL); - if (err != GNUTLS_E_SUCCESS) - { - pgnutls_perror(err); - pgnutls_deinit(*s); - return FALSE; - } - - err = pgnutls_credentials_set(*s, GNUTLS_CRD_CERTIFICATE, - (gnutls_certificate_credentials_t)cred->credentials); - if (err != GNUTLS_E_SUCCESS) - { - pgnutls_perror(err); - pgnutls_deinit(*s); - return FALSE; - } - - pgnutls_transport_set_pull_function(*s, schan_pull_adapter); - pgnutls_transport_set_push_function(*s, schan_push_adapter); - - return TRUE; -} - -void schan_imp_dispose_session(schan_imp_session session) -{ - gnutls_session_t s = (gnutls_session_t)session; - pgnutls_deinit(s); -} - -void schan_imp_set_session_transport(schan_imp_session session, - struct schan_transport *t) -{ - gnutls_session_t s = (gnutls_session_t)session; - pgnutls_transport_set_ptr(s, (gnutls_transport_ptr_t)t); -} - -void schan_imp_set_session_target(schan_imp_session session, const char *target) -{ - gnutls_session_t s = (gnutls_session_t)session; - - pgnutls_server_name_set( s, GNUTLS_NAME_DNS, target, strlen(target) ); -} - -SECURITY_STATUS schan_imp_handshake(schan_imp_session session) -{ - gnutls_session_t s = (gnutls_session_t)session; - int err; - - while(1) { - err = pgnutls_handshake(s); - switch(err) { - case GNUTLS_E_SUCCESS: - TRACE("Handshake completed\n"); - return SEC_E_OK; - - case GNUTLS_E_AGAIN: - TRACE("Continue...\n"); - return SEC_I_CONTINUE_NEEDED; - - case GNUTLS_E_WARNING_ALERT_RECEIVED: - { - gnutls_alert_description_t alert = pgnutls_alert_get(s); - - WARN("WARNING ALERT: %d %s\n", alert, pgnutls_alert_get_name(alert)); - - switch(alert) { - case GNUTLS_A_UNRECOGNIZED_NAME: - TRACE("Ignoring\n"); - continue; - default: - return SEC_E_INTERNAL_ERROR; - } - } - - case GNUTLS_E_FATAL_ALERT_RECEIVED: - { - gnutls_alert_description_t alert = pgnutls_alert_get(s); - WARN("FATAL ALERT: %d %s\n", alert, pgnutls_alert_get_name(alert)); - return SEC_E_INTERNAL_ERROR; - } - - default: - pgnutls_perror(err); - return SEC_E_INTERNAL_ERROR; - } - } - - /* Never reached */ - return SEC_E_OK; -} - -static unsigned int schannel_get_cipher_block_size(gnutls_cipher_algorithm_t cipher) -{ - const struct - { - gnutls_cipher_algorithm_t cipher; - unsigned int block_size; - } - algorithms[] = - { - {GNUTLS_CIPHER_3DES_CBC, 8}, - {GNUTLS_CIPHER_AES_128_CBC, 16}, - {GNUTLS_CIPHER_AES_256_CBC, 16}, - {GNUTLS_CIPHER_ARCFOUR_128, 1}, - {GNUTLS_CIPHER_ARCFOUR_40, 1}, - {GNUTLS_CIPHER_DES_CBC, 8}, - {GNUTLS_CIPHER_NULL, 1}, - {GNUTLS_CIPHER_RC2_40_CBC, 8}, - }; - unsigned int i; - - for (i = 0; i < sizeof(algorithms) / sizeof(*algorithms); ++i) - { - if (algorithms[i].cipher == cipher) - return algorithms[i].block_size; - } - - FIXME("Unknown cipher %#x, returning 1\n", cipher); - - return 1; -} - -static DWORD schannel_get_protocol(gnutls_protocol_t proto) -{ - /* FIXME: currently schannel only implements client connections, but - * there's no reason it couldn't be used for servers as well. The - * context doesn't tell us which it is, so assume client for now. - */ - switch (proto) - { - case GNUTLS_SSL3: return SP_PROT_SSL3_CLIENT; - case GNUTLS_TLS1_0: return SP_PROT_TLS1_0_CLIENT; - case GNUTLS_TLS1_1: return SP_PROT_TLS1_1_CLIENT; - case GNUTLS_TLS1_2: return SP_PROT_TLS1_2_CLIENT; - default: - FIXME("unknown protocol %d\n", proto); - return 0; - } -} - -static ALG_ID schannel_get_cipher_algid(gnutls_cipher_algorithm_t cipher) -{ - switch (cipher) - { - case GNUTLS_CIPHER_UNKNOWN: - case GNUTLS_CIPHER_NULL: return 0; - case GNUTLS_CIPHER_ARCFOUR_40: - case GNUTLS_CIPHER_ARCFOUR_128: return CALG_RC4; - case GNUTLS_CIPHER_DES_CBC: - case GNUTLS_CIPHER_3DES_CBC: return CALG_DES; - case GNUTLS_CIPHER_AES_128_CBC: - case GNUTLS_CIPHER_AES_256_CBC: return CALG_AES; - case GNUTLS_CIPHER_RC2_40_CBC: return CALG_RC2; - default: - FIXME("unknown algorithm %d\n", cipher); - return 0; - } -} - -static ALG_ID schannel_get_mac_algid(gnutls_mac_algorithm_t mac) -{ - switch (mac) - { - case GNUTLS_MAC_UNKNOWN: - case GNUTLS_MAC_NULL: return 0; - case GNUTLS_MAC_MD5: return CALG_MD5; - case GNUTLS_MAC_SHA1: - case GNUTLS_MAC_SHA256: - case GNUTLS_MAC_SHA384: - case GNUTLS_MAC_SHA512: return CALG_SHA; - default: - FIXME("unknown algorithm %d\n", mac); - return 0; - } -} - -static ALG_ID schannel_get_kx_algid(gnutls_kx_algorithm_t kx) -{ - switch (kx) - { - case GNUTLS_KX_RSA: return CALG_RSA_KEYX; - case GNUTLS_KX_DHE_DSS: - case GNUTLS_KX_DHE_RSA: return CALG_DH_EPHEM; - default: - FIXME("unknown algorithm %d\n", kx); - return 0; - } -} - -unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session) -{ - gnutls_session_t s = (gnutls_session_t)session; - gnutls_cipher_algorithm_t cipher = pgnutls_cipher_get(s); - return schannel_get_cipher_block_size(cipher); -} - -unsigned int schan_imp_get_max_message_size(schan_imp_session session) -{ - return pgnutls_record_get_max_size((gnutls_session_t)session); -} - -SECURITY_STATUS schan_imp_get_connection_info(schan_imp_session session, - SecPkgContext_ConnectionInfo *info) -{ - gnutls_session_t s = (gnutls_session_t)session; - gnutls_protocol_t proto = pgnutls_protocol_get_version(s); - gnutls_cipher_algorithm_t alg = pgnutls_cipher_get(s); - gnutls_mac_algorithm_t mac = pgnutls_mac_get(s); - gnutls_kx_algorithm_t kx = pgnutls_kx_get(s); - - info->dwProtocol = schannel_get_protocol(proto); - info->aiCipher = schannel_get_cipher_algid(alg); - info->dwCipherStrength = pgnutls_cipher_get_key_size(alg) * 8; - info->aiHash = schannel_get_mac_algid(mac); - info->dwHashStrength = pgnutls_mac_get_key_size(mac) * 8; - info->aiExch = schannel_get_kx_algid(kx); - /* FIXME: info->dwExchStrength? */ - info->dwExchStrength = 0; - return SEC_E_OK; -} - -SECURITY_STATUS schan_imp_get_session_peer_certificate(schan_imp_session session, HCERTSTORE store, - PCCERT_CONTEXT *ret) -{ - gnutls_session_t s = (gnutls_session_t)session; - PCCERT_CONTEXT cert = NULL; - const gnutls_datum_t *datum; - unsigned list_size, i; - BOOL res; - - datum = pgnutls_certificate_get_peers(s, &list_size); - if(!datum) - return SEC_E_INTERNAL_ERROR; - - for(i = 0; i < list_size; i++) { - res = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, datum[i].data, datum[i].size, - CERT_STORE_ADD_REPLACE_EXISTING, i ? NULL : &cert); - if(!res) { - if(i) - CertFreeCertificateContext(cert); - return GetLastError(); - } - } - - *ret = cert; - return SEC_E_OK; -} - -SECURITY_STATUS schan_imp_send(schan_imp_session session, const void *buffer, - SIZE_T *length) -{ - gnutls_session_t s = (gnutls_session_t)session; - ssize_t ret; - -again: - ret = pgnutls_record_send(s, buffer, *length); - - if (ret >= 0) - *length = ret; - else if (ret == GNUTLS_E_AGAIN) - { - struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s); - SIZE_T count = 0; - - if (schan_get_buffer(t, &t->out, &count)) - goto again; - - return SEC_I_CONTINUE_NEEDED; - } - else - { - pgnutls_perror(ret); - return SEC_E_INTERNAL_ERROR; - } - - return SEC_E_OK; -} - -SECURITY_STATUS schan_imp_recv(schan_imp_session session, void *buffer, - SIZE_T *length) -{ - gnutls_session_t s = (gnutls_session_t)session; - ssize_t ret; - -again: - ret = pgnutls_record_recv(s, buffer, *length); - - if (ret >= 0) - *length = ret; - else if (ret == GNUTLS_E_AGAIN) - { - struct schan_transport *t = (struct schan_transport *)pgnutls_transport_get_ptr(s); - SIZE_T count = 0; - - if (schan_get_buffer(t, &t->in, &count)) - goto again; - - return SEC_I_CONTINUE_NEEDED; - } - else - { - pgnutls_perror(ret); - return SEC_E_INTERNAL_ERROR; - } - - return SEC_E_OK; -} - -BOOL schan_imp_allocate_certificate_credentials(schan_credentials *c) -{ - int ret = pgnutls_certificate_allocate_credentials((gnutls_certificate_credentials_t*)&c->credentials); - if (ret != GNUTLS_E_SUCCESS) - pgnutls_perror(ret); - return (ret == GNUTLS_E_SUCCESS); -} - -void schan_imp_free_certificate_credentials(schan_credentials *c) -{ - pgnutls_certificate_free_credentials(c->credentials); -} - -static void schan_gnutls_log(int level, const char *msg) -{ - TRACE("<%d> %s", level, msg); -} - -BOOL schan_imp_init(void) -{ - int ret; - -#ifndef __REACTOS__ - libgnutls_handle = wine_dlopen(SONAME_LIBGNUTLS, RTLD_NOW, NULL, 0); - if (!libgnutls_handle) - { - WARN("Failed to load libgnutls.\n"); - return FALSE; - } - -#define LOAD_FUNCPTR(f) \ - if (!(p##f = wine_dlsym(libgnutls_handle, #f, NULL, 0))) \ - { \ - ERR("Failed to load %s\n", #f); \ - goto fail; \ - } -#else -/* - static const WCHAR RosSchannelKey[] = L"Software\\ReactOS\\Schannel"; - static const WCHAR PathValue[] = L"GnuTLSPath"; - WCHAR Path[MAX_PATH]; - DWORD PathSize = sizeof(Path), ValueType; - HKEY Key; - DWORD Error; - - Error = RegOpenKeyW(HKEY_LOCAL_MACHINE, RosSchannelKey, &Key); - if(Error != ERROR_SUCCESS) - return FALSE; - - Error = RegQueryValueExW(Key, PathValue, NULL, &ValueType, (LPBYTE)Path, &PathSize); - RegCloseKey(Key); - if ((Error != ERROR_SUCCESS) || (ValueType != REG_SZ)) - return FALSE; - wcscat(Path, L"\\"); - wcscat(Path, SONAME_LIBGNUTLS); -*/ - WCHAR Path[MAX_PATH]; - DWORD PathSize = sizeof(Path); - PathSize = GetSystemDirectoryW(Path, PathSize); - if(!PathSize) - return FALSE; - wcscat(Path, L"\\"); - wcscat(Path, SONAME_LIBGNUTLS); - - libgnutls_handle = LoadLibraryExW(Path, NULL, LOAD_WITH_ALTERED_SEARCH_PATH); - if (!libgnutls_handle) - { - ERR("Could not load %S.\n", Path); - return FALSE; - } - -#define LOAD_FUNCPTR(f) \ - if (!(p##f = (void*)GetProcAddress(libgnutls_handle, #f))) \ - { \ - ERR("Failed to load %s\n", #f); \ - goto fail; \ - } -#endif // __REACTOS__ - - LOAD_FUNCPTR(gnutls_alert_get) - LOAD_FUNCPTR(gnutls_alert_get_name) - LOAD_FUNCPTR(gnutls_certificate_allocate_credentials) - LOAD_FUNCPTR(gnutls_certificate_free_credentials) - LOAD_FUNCPTR(gnutls_certificate_get_peers) - LOAD_FUNCPTR(gnutls_cipher_get) - LOAD_FUNCPTR(gnutls_cipher_get_key_size) - LOAD_FUNCPTR(gnutls_credentials_set) - LOAD_FUNCPTR(gnutls_deinit) - LOAD_FUNCPTR(gnutls_global_deinit) - LOAD_FUNCPTR(gnutls_global_init) - LOAD_FUNCPTR(gnutls_global_set_log_function) - LOAD_FUNCPTR(gnutls_global_set_log_level) - LOAD_FUNCPTR(gnutls_handshake) - LOAD_FUNCPTR(gnutls_init) - LOAD_FUNCPTR(gnutls_kx_get) - LOAD_FUNCPTR(gnutls_mac_get) - LOAD_FUNCPTR(gnutls_mac_get_key_size) - LOAD_FUNCPTR(gnutls_perror) - LOAD_FUNCPTR(gnutls_protocol_get_version) - LOAD_FUNCPTR(gnutls_priority_set_direct) - LOAD_FUNCPTR(gnutls_record_get_max_size); - LOAD_FUNCPTR(gnutls_record_recv); - LOAD_FUNCPTR(gnutls_record_send); - LOAD_FUNCPTR(gnutls_server_name_set) - LOAD_FUNCPTR(gnutls_transport_get_ptr) - LOAD_FUNCPTR(gnutls_transport_set_errno) - LOAD_FUNCPTR(gnutls_transport_set_ptr) - LOAD_FUNCPTR(gnutls_transport_set_pull_function) - LOAD_FUNCPTR(gnutls_transport_set_push_function) -#undef LOAD_FUNCPTR - - ret = pgnutls_global_init(); - if (ret != GNUTLS_E_SUCCESS) - { - pgnutls_perror(ret); - goto fail; - } - - if (TRACE_ON(secur32)) - { - pgnutls_global_set_log_level(4); - pgnutls_global_set_log_function(schan_gnutls_log); - } - - return TRUE; - -fail: -#ifndef __REACTOS__ - wine_dlclose(libgnutls_handle, NULL, 0); -#else - FreeLibrary(libgnutls_handle); -#endif - libgnutls_handle = NULL; - return FALSE; -} - -void schan_imp_deinit(void) -{ - pgnutls_global_deinit(); -#ifndef __REACTOS__ - wine_dlclose(libgnutls_handle, NULL, 0); -#else - FreeLibrary(libgnutls_handle); -#endif - libgnutls_handle = NULL; -} - -#endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H && !SONAME_LIBMBEDTLS */

1 0

[akhaldi] 69394: [MBEDTLS] Use mbedtls as a lightweight schannel TLS/SSL back-end. This is an initial checkpoint and more will follow in due time. Brought to you by Peter Hater, Ismael Ferreras Mor...
by akhaldi＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: akhaldi Date: Mon Sep 28 09:43:08 2015 New Revision: 69394 URL: http://svn.reactos.org/svn/reactos?rev=69394&view=rev Log: [MBEDTLS] Use mbedtls as a lightweight schannel TLS/SSL back-end. This is an initial checkpoint and more will follow in due time. Brought to you by Peter Hater, Ismael Ferreras Morezuelas, Sebastian Lackner and Michael Müller. CORE-9065 Added: trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec (with props) trunk/reactos/dll/win32/schannel/schannel_mbedtls.c (with props) trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h (with props) Modified: trunk/reactos/dll/3rdparty/CMakeLists.txt trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt trunk/reactos/dll/win32/schannel/CMakeLists.txt trunk/reactos/dll/win32/schannel/schannel_gnutls.c trunk/reactos/dll/win32/schannel/schannel_wine.c trunk/reactos/include/reactos/libs/mbedtls/polarssl/config.h trunk/reactos/include/reactos/wine/config.h Modified: trunk/reactos/dll/3rdparty/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/CMakeLists.tx… ============================================================================== --- trunk/reactos/dll/3rdparty/CMakeLists.txt [iso-8859-1] (original) +++ trunk/reactos/dll/3rdparty/CMakeLists.txt [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -7,5 +7,4 @@ add_subdirectory(libpng) add_subdirectory(libtiff) add_subdirectory(libxslt) -# FIXME CORE-9065 -#add_subdirectory(mbedtls) +add_subdirectory(mbedtls) Modified: trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/CMake… ============================================================================== --- trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt [iso-8859-1] (original) +++ trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -1,3 +1,6 @@ + +spec2def(mbedtls.dll mbedtls.spec ADD_IMPORTLIB) + include_directories(${REACTOS_SOURCE_DIR}/include/reactos/libs/mbedtls ${REACTOS_SOURCE_DIR}/include/reactos/zlib) @@ -71,7 +74,10 @@ x509write_csr.c xtea.c) -add_library(mbedtls SHARED ${src}) +add_library(mbedtls SHARED + ${src} + ${CMAKE_CURRENT_BINARY_DIR}/mbedtls.def) + set_module_type(mbedtls win32dll) target_link_libraries(mbedtls zlib) add_importlibs(mbedtls advapi32 ws2_32 msvcrt kernel32) @@ -87,4 +93,3 @@ add_target_compile_flags(mbedtls "-Wno-unused-but-set-variable") endif() endif() - Added: trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/mbedt… ============================================================================== --- trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec (added) +++ trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -0,0 +1,22 @@ +@ cdecl ctr_drbg_free(ptr) +@ cdecl ctr_drbg_init(ptr ptr ptr str long) +@ cdecl ctr_drbg_random(ptr str long) +@ cdecl entropy_free(ptr) +@ cdecl entropy_func(ptr str long) +@ cdecl entropy_init(ptr) +@ cdecl ssl_ciphersuite_from_id(long) +@ cdecl ssl_free(ptr) +@ cdecl ssl_get_ciphersuite(ptr) +@ cdecl ssl_get_ciphersuite_id(ptr) +@ cdecl ssl_get_version(ptr) +@ cdecl ssl_handshake(ptr) +@ cdecl ssl_init(ptr) +@ cdecl ssl_read(ptr ptr long) +@ cdecl ssl_set_authmode(ptr long) +@ cdecl ssl_set_bio(ptr ptr ptr ptr) +@ cdecl ssl_set_endpoint(ptr long) +@ cdecl ssl_set_hostname(ptr str) +@ cdecl ssl_set_max_version(ptr long long) +@ cdecl ssl_set_min_version(ptr long long) +@ cdecl ssl_set_rng(ptr ptr ptr) +@ cdecl ssl_write(ptr ptr ptr) Propchange: trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec ------------------------------------------------------------------------------ svn:eol-style = native Modified: trunk/reactos/dll/win32/schannel/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/CMakeLi… ============================================================================== --- trunk/reactos/dll/win32/schannel/CMakeLists.txt [iso-8859-1] (original) +++ trunk/reactos/dll/win32/schannel/CMakeLists.txt [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -1,7 +1,7 @@ include_directories( ${REACTOS_SOURCE_DIR}/include/reactos/wine - ${REACTOS_SOURCE_DIR}/include/reactos/libs/gnutls) + ${REACTOS_SOURCE_DIR}/include/reactos/libs/mbedtls) add_definitions(-D__WINESRC__ -D_WINE) @@ -9,7 +9,7 @@ list(APPEND SOURCE lsamode.c - schannel_gnutls.c + schannel_mbedtls.c schannel_main.c schannel_wine.c secur32_wine.c @@ -25,6 +25,6 @@ set_module_type(schannel win32dll) target_link_libraries(schannel wine) -add_importlibs(schannel crypt32 secur32 advapi32 msvcrt kernel32 ntdll) +add_importlibs(schannel mbedtls crypt32 secur32 advapi32 msvcrt kernel32 ntdll) add_pch(schannel precomp.h SOURCE) add_cd_file(TARGET schannel DESTINATION reactos/system32 FOR all) Modified: trunk/reactos/dll/win32/schannel/schannel_gnutls.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne… ============================================================================== --- trunk/reactos/dll/win32/schannel/schannel_gnutls.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/schannel/schannel_gnutls.c [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -33,7 +33,7 @@ #define __wine_dbch_secur32 __wine_dbch_schannel -#if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H) +#if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H) && !defined(SONAME_LIBMBEDTLS) static void *libgnutls_handle; @@ -602,4 +602,4 @@ libgnutls_handle = NULL; } -#endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H */ +#endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H && !SONAME_LIBMBEDTLS */ Added: trunk/reactos/dll/win32/schannel/schannel_mbedtls.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne… ============================================================================== --- trunk/reactos/dll/win32/schannel/schannel_mbedtls.c (added) +++ trunk/reactos/dll/win32/schannel/schannel_mbedtls.c [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -0,0 +1,873 @@ +/* + * Lightweight mbedTLS-based implementation of the schannel (SSL/TLS) provider. + * + * Copyright 2015 Peter Hater + * Copyright 2015 Ismael Ferreras Morezuelas <swyterzone+ros(a)gmail.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +#include "config.h" +#include "wine/port.h" + +#ifdef __REACTOS__ + #include "precomp.h" +#else + #include <stdarg.h> + #include <errno.h> + + #include "windef.h" + #include "winbase.h" + #include "sspi.h" + #include "schannel.h" + #include "wine/debug.h" + #include "wine/library.h" +#endif + +#if defined(SONAME_LIBMBEDTLS) && !defined(HAVE_SECURITY_SECURITY_H) && !defined(SONAME_LIBGNUTLS) + +#include <polarssl/ssl.h> +#include <polarssl/entropy.h> +#include <polarssl/ctr_drbg.h> + +#define ROS_SCHAN_IS_BLOCKING (0xCCCFFFFF & 0xFFF00000) +#define ROS_SCHAN_IS_BLOCKING_MARSHALL(read_len) (ROS_SCHAN_IS_BLOCKING | (read_len & 0x000FFFFF)) +#define ROS_SCHAN_IS_BLOCKING_RETRIEVE(read_len) (read_len & 0x000FFFFF) + +#ifndef __REACTOS__ + /* WINE defines the back-end glue in here */ + #include "secur32_priv.h" + + /* in ReactOS we use schannel instead of secur32 */ + WINE_DEFAULT_DEBUG_CHANNEL(secur32); + + /* WINE prefers to keep it optional, disable this to link explicitly */ + #include "schannel_mbedtls_lazyload.h" + + /* WINE does not define this standard win32 macro for some reason */ + #ifndef _countof + #define _countof(a) (sizeof(a)/sizeof(*(a))) + #endif +#endif + +typedef struct +{ + ssl_context ssl; + entropy_context entropy; + ctr_drbg_context ctr_drbg; + struct schan_transport *transport; +} POLARSSL_SESSION, *PPOLARSSL_SESSION; + +/* custom `net_recv` callback adapter, mbedTLS uses it in ssl_read for + pulling data from the underlying win32 net stack */ +static int schan_pull_adapter(void *session, unsigned char *buff, size_t buff_len) +{ + POLARSSL_SESSION *s = session; + size_t requested = buff_len; + int status; + + TRACE("POLARSSL schan_pull_adapter: (%p/%p, %p, %u)\n", s, s->transport, buff, buff_len); + + status = schan_pull(s->transport, buff, &buff_len); + + TRACE("POLARSSL schan_pull_adapter: (%p/%p, %p, %u) status: %#x\n", s, s->transport, buff, buff_len, status); + + if (status == NO_ERROR) + { + /* great, no more data left */ + if (buff_len == 0) + { + TRACE("Connection closed\n"); + return 0; + } + /* there's still some bytes that need pulling */ + else if (buff_len < requested) + { + TRACE("Pulled %u bytes before would block\n", buff_len); + return ROS_SCHAN_IS_BLOCKING_MARSHALL(buff_len); + } + else + { + TRACE("Pulled %u bytes\n", buff_len); + return buff_len; + } + } + else if (status == EAGAIN) + { + TRACE("Would block before being able to pull anything, passing buff_len=%u\n", buff_len); + return ROS_SCHAN_IS_BLOCKING_MARSHALL(buff_len); + } + else + { + ERR("Unknown status code from schan_pull: %d\n", status); + return POLARSSL_ERR_NET_RECV_FAILED; + } + + /* this should be unreachable */ + return POLARSSL_ERR_NET_CONNECT_FAILED; +} + +/* custom `net_send` callback adapter, mbedTLS uses it in ssl_write for + pushing data to the underlying win32 net stack */ +static int schan_push_adapter(void *session, const unsigned char *buff, size_t buff_len) +{ + POLARSSL_SESSION *s = session; + int status; + + TRACE("POLARSSL schan_push_adapter: (%p/%p, %p, %u)\n", s, s->transport, buff, buff_len); + + status = schan_push(s->transport, buff, &buff_len); + + TRACE("POLARSSL schan_push_adapter: (%p/%p, %p, %u) status: %#x\n", s, s->transport, buff, buff_len, status); + + if (status == NO_ERROR) + { + TRACE("Pushed %u bytes\n", buff_len); + return buff_len; + } + else if (status == EAGAIN) + { + TRACE("Would block before being able to push anything. passing %u\n", buff_len); + return ROS_SCHAN_IS_BLOCKING_MARSHALL(buff_len); + } + else + { + ERR("Unknown status code from schan_push: %d\n", status); + return POLARSSL_ERR_NET_SEND_FAILED; + } + + /* this should be unreachable */ + return POLARSSL_ERR_NET_CONNECT_FAILED; +} + +DWORD schan_imp_enabled_protocols(void) +{ + /* NOTE: No support for SSL 2.0 */ + TRACE("POLARSSL schan_imp_enabled_protocols()\n"); + + return 0 +#ifdef POLARSSL_SSL_PROTO_SSL3 + | SP_PROT_SSL3_CLIENT | SP_PROT_SSL3_SERVER +#endif +#ifdef POLARSSL_SSL_PROTO_TLS1 + | SP_PROT_TLS1_0_CLIENT | SP_PROT_TLS1_0_SERVER +#endif +#ifdef POLARSSL_SSL_PROTO_TLS1_1 + | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_1_SERVER +#endif +#ifdef POLARSSL_SSL_PROTO_TLS1_2 + | SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_2_SERVER +#endif + ; +} + +BOOL schan_imp_create_session(schan_imp_session *session, schan_credentials *cred) +{ + POLARSSL_SESSION *s; + int ret; + + WARN("POLARSSL schan_imp_create_session: %p %p %p\n", session, *session, cred); + + s = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(POLARSSL_SESSION)); + + if (!(*session = (schan_imp_session)s)) + { + ERR("Not enough memory to create session\n"); + return FALSE; + } + + TRACE("POLARSSL init entropy\n"); + entropy_init(&s->entropy); + + TRACE("POLARSSL init random - change static entropy private data\n"); + ret = ctr_drbg_init(&s->ctr_drbg, entropy_func, &s->entropy, (unsigned char *) "PolarSSL", 8); + + if (ret != 0) + { + ERR("ctr_drbg_init failed with -%x\n", -ret); + + entropy_free(&s->entropy); + + /* safely overwrite the freed context with zeroes */ + HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, s); + + return FALSE; + } + + WARN("POLARSSL init ssl\n"); + ret = ssl_init(&s->ssl); + + if (ret != 0) + { + ERR("Error SSL initialization -%x.\n", -ret); + + ctr_drbg_free(&s->ctr_drbg); + entropy_free(&s->entropy); + + /* safely overwrite the freed context with zeroes */ + HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, s); + + return FALSE; + } + + TRACE("POLARSSL set BIO callbacks\n"); + ssl_set_bio(&s->ssl, schan_pull_adapter, s, schan_push_adapter, s); + + TRACE("POLARSSL set endpoint %d\n", cred->credential_use); + ssl_set_endpoint(&s->ssl, (cred->credential_use & SECPKG_CRED_INBOUND) ? SSL_IS_SERVER : SSL_IS_CLIENT); + + TRACE("POLARSSL set authmode\n"); + ssl_set_authmode(&s->ssl, SSL_VERIFY_NONE); + + TRACE("POLARSSL set rng\n"); + ssl_set_rng(&s->ssl, ctr_drbg_random, &s->ctr_drbg); + + TRACE("POLARSSL set versions\n"); + ssl_set_min_version(&s->ssl, SSL_MIN_MAJOR_VERSION, SSL_MIN_MINOR_VERSION); + ssl_set_max_version(&s->ssl, SSL_MAX_MAJOR_VERSION, SSL_MAX_MINOR_VERSION); + + TRACE("POLARSSL schan_imp_create_session END!\n"); + + return TRUE; +} + +void schan_imp_dispose_session(schan_imp_session session) +{ + POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + WARN("POLARSSL schan_imp_dispose_session: %p\n", session); + + /* tell the other peer (a server) that we are going away */ + //ssl_close_notify(&s->ssl); + + ssl_free(&s->ssl); + ctr_drbg_free(&s->ctr_drbg); + entropy_free(&s->entropy); + + /* safely overwrite the freed context with zeroes */ + HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, s); +} + +void schan_imp_set_session_transport(schan_imp_session session, + struct schan_transport *t) +{ + POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + + TRACE("POLARSSL schan_imp_set_session_transport: %p %p %d\n", session, t, s->ssl.state); + + s->transport = t; +} + +void schan_imp_set_session_target(schan_imp_session session, const char *target) +{ + POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + + FIXME("POLARSSL schan_imp_set_session_target: sess: %p hostname: %s state: %d\n", session, target, s->ssl.state); + + /* FIXME: The wine tests do not pass when we set the hostname. */ + ssl_set_hostname(&s->ssl, target); +} + +SECURITY_STATUS schan_imp_handshake(schan_imp_session session) +{ + POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + + int err = ssl_handshake(&s->ssl); + + TRACE("POLARSSL schan_imp_handshake: %p %d err: %#x \n", session, s->ssl.state, err); + + if ((err & ROS_SCHAN_IS_BLOCKING) == ROS_SCHAN_IS_BLOCKING) + { + TRACE("Received ERR_NET_WANT_READ/WRITE... let's try again!\n"); + return SEC_I_CONTINUE_NEEDED; + } + else if (err == POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE) + { + ERR("schan_imp_handshake: SSL Feature unavailable...\n"); + return SEC_E_UNSUPPORTED_FUNCTION; + } + else if (err != 0) + { + ERR("schan_imp_handshake: Oops! ssl_handshake returned the following error code: -%#x...\n", -err); + return SEC_E_INTERNAL_ERROR; + } + + WARN("schan_imp_handshake: Handshake completed!\n"); + WARN("schan_imp_handshake: Protocol is %s, Cipher suite is %s\n", ssl_get_version(&s->ssl), ssl_get_ciphersuite(&s->ssl)); + return SEC_E_OK; +} + +static unsigned int schannel_get_cipher_block_size(int ciphersuite_id) +{ + const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id); + const struct + { + int algo; + unsigned int size; + } + algorithms[] = + { + {POLARSSL_CIPHER_NONE, 1}, + {POLARSSL_CIPHER_NULL, 1}, + + #ifdef POLARSSL_AES_C + {POLARSSL_CIPHER_AES_128_ECB, 16}, + {POLARSSL_CIPHER_AES_192_ECB, 16}, + {POLARSSL_CIPHER_AES_256_ECB, 16}, + {POLARSSL_CIPHER_AES_128_CBC, 16}, + {POLARSSL_CIPHER_AES_192_CBC, 16}, + {POLARSSL_CIPHER_AES_256_CBC, 16}, + {POLARSSL_CIPHER_AES_128_CFB128, 16}, + {POLARSSL_CIPHER_AES_192_CFB128, 16}, + {POLARSSL_CIPHER_AES_256_CFB128, 16}, + {POLARSSL_CIPHER_AES_128_CTR, 16}, + {POLARSSL_CIPHER_AES_192_CTR, 16}, + {POLARSSL_CIPHER_AES_256_CTR, 16}, + {POLARSSL_CIPHER_AES_128_GCM, 16}, + {POLARSSL_CIPHER_AES_192_GCM, 16}, + {POLARSSL_CIPHER_AES_256_GCM, 16}, + #endif + + #ifdef POLARSSL_CAMELLIA_C + {POLARSSL_CIPHER_CAMELLIA_128_ECB, 16}, + {POLARSSL_CIPHER_CAMELLIA_192_ECB, 16}, + {POLARSSL_CIPHER_CAMELLIA_256_ECB, 16}, + {POLARSSL_CIPHER_CAMELLIA_128_CBC, 16}, + {POLARSSL_CIPHER_CAMELLIA_192_CBC, 16}, + {POLARSSL_CIPHER_CAMELLIA_256_CBC, 16}, + {POLARSSL_CIPHER_CAMELLIA_128_CFB128, 16}, + {POLARSSL_CIPHER_CAMELLIA_192_CFB128, 16}, + {POLARSSL_CIPHER_CAMELLIA_256_CFB128, 16}, + {POLARSSL_CIPHER_CAMELLIA_128_CTR, 16}, + {POLARSSL_CIPHER_CAMELLIA_192_CTR, 16}, + {POLARSSL_CIPHER_CAMELLIA_256_CTR, 16}, + {POLARSSL_CIPHER_CAMELLIA_128_GCM, 16}, + {POLARSSL_CIPHER_CAMELLIA_192_GCM, 16}, + {POLARSSL_CIPHER_CAMELLIA_256_GCM, 16}, + #endif + + #ifdef POLARSSL_DES_C + {POLARSSL_CIPHER_DES_ECB, 8}, + {POLARSSL_CIPHER_DES_CBC, 8}, + {POLARSSL_CIPHER_DES_EDE_ECB, 8}, + {POLARSSL_CIPHER_DES_EDE_CBC, 8}, + {POLARSSL_CIPHER_DES_EDE3_ECB, 8}, + {POLARSSL_CIPHER_DES_EDE3_CBC, 8}, + #endif + + #ifdef POLARSSL_BLOWFISH_C + {POLARSSL_CIPHER_BLOWFISH_ECB, 8}, + {POLARSSL_CIPHER_BLOWFISH_CBC, 8}, + {POLARSSL_CIPHER_BLOWFISH_CFB64, 8}, + {POLARSSL_CIPHER_BLOWFISH_CTR, 8}, + #endif + + #ifdef POLARSSL_ARC4_C + {POLARSSL_CIPHER_ARC4_128, 1}, + #endif + + #ifdef POLARSSL_CCM_C + {POLARSSL_CIPHER_AES_128_CCM, 16}, + {POLARSSL_CIPHER_AES_192_CCM, 16}, + {POLARSSL_CIPHER_AES_256_CCM, 16}, + {POLARSSL_CIPHER_CAMELLIA_128_CCM, 16}, + {POLARSSL_CIPHER_CAMELLIA_192_CCM, 16}, + {POLARSSL_CIPHER_CAMELLIA_256_CCM, 16}, + #endif + }; + + int i; + for (i = 0; i < _countof(algorithms); i++) + { + if (algorithms[i].algo == cipher_suite->cipher) + return algorithms[i].size; + } + + TRACE("POLARSSL schannel_get_cipher_block_size: Unknown cipher %#x, returning 1\n", ciphersuite_id); + + return 1; +} + +static unsigned int schannel_get_cipher_key_size(int ciphersuite_id) +{ + const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id); + const struct + { + int algo; + unsigned int size; + } + algorithms[] = + { + {POLARSSL_CIPHER_NONE, 0}, + {POLARSSL_CIPHER_NULL, 0}, + + #ifdef POLARSSL_AES_C + {POLARSSL_CIPHER_AES_128_ECB, 128}, + {POLARSSL_CIPHER_AES_192_ECB, 192}, + {POLARSSL_CIPHER_AES_256_ECB, 256}, + {POLARSSL_CIPHER_AES_128_CBC, 128}, + {POLARSSL_CIPHER_AES_192_CBC, 192}, + {POLARSSL_CIPHER_AES_256_CBC, 256}, + {POLARSSL_CIPHER_AES_128_CFB128, 128}, + {POLARSSL_CIPHER_AES_192_CFB128, 192}, + {POLARSSL_CIPHER_AES_256_CFB128, 256}, + {POLARSSL_CIPHER_AES_128_CTR, 128}, + {POLARSSL_CIPHER_AES_192_CTR, 192}, + {POLARSSL_CIPHER_AES_256_CTR, 256}, + {POLARSSL_CIPHER_AES_128_GCM, 128}, + {POLARSSL_CIPHER_AES_192_GCM, 192}, + {POLARSSL_CIPHER_AES_256_GCM, 256}, + #endif + + #ifdef POLARSSL_CAMELLIA_C + {POLARSSL_CIPHER_CAMELLIA_128_ECB, 128}, + {POLARSSL_CIPHER_CAMELLIA_192_ECB, 192}, + {POLARSSL_CIPHER_CAMELLIA_256_ECB, 256}, + {POLARSSL_CIPHER_CAMELLIA_128_CBC, 128}, + {POLARSSL_CIPHER_CAMELLIA_192_CBC, 192}, + {POLARSSL_CIPHER_CAMELLIA_256_CBC, 256}, + {POLARSSL_CIPHER_CAMELLIA_128_CFB128, 128}, + {POLARSSL_CIPHER_CAMELLIA_192_CFB128, 192}, + {POLARSSL_CIPHER_CAMELLIA_256_CFB128, 256}, + {POLARSSL_CIPHER_CAMELLIA_128_CTR, 128}, + {POLARSSL_CIPHER_CAMELLIA_192_CTR, 192}, + {POLARSSL_CIPHER_CAMELLIA_256_CTR, 256}, + {POLARSSL_CIPHER_CAMELLIA_128_GCM, 128}, + {POLARSSL_CIPHER_CAMELLIA_192_GCM, 192}, + {POLARSSL_CIPHER_CAMELLIA_256_GCM, 256}, + #endif + + #ifdef POLARSSL_DES_C + {POLARSSL_CIPHER_DES_ECB, 56}, + {POLARSSL_CIPHER_DES_CBC, 56}, + {POLARSSL_CIPHER_DES_EDE_ECB, 128}, + {POLARSSL_CIPHER_DES_EDE_CBC, 128}, + {POLARSSL_CIPHER_DES_EDE3_ECB, 192}, + {POLARSSL_CIPHER_DES_EDE3_CBC, 192}, + #endif + + #ifdef POLARSSL_BLOWFISH_C /* lies! actually unlimited, */ + {POLARSSL_CIPHER_BLOWFISH_ECB, 128}, /* gnutls uses this same value. */ + {POLARSSL_CIPHER_BLOWFISH_CBC, 128}, /* BLOWFISH_MAX_KEY = 448 bits */ + {POLARSSL_CIPHER_BLOWFISH_CFB64, 128}, /* BLOWFISH_MIN_KEY = 032 bits */ + {POLARSSL_CIPHER_BLOWFISH_CTR, 128}, /* see blowfish.h for more info */ + #endif + + #ifdef POLARSSL_ARC4_C + {POLARSSL_CIPHER_ARC4_128, 128}, + #endif + + #ifdef POLARSSL_CCM_C + {POLARSSL_CIPHER_AES_128_CCM, 128}, + {POLARSSL_CIPHER_AES_192_CCM, 192}, + {POLARSSL_CIPHER_AES_256_CCM, 256}, + {POLARSSL_CIPHER_CAMELLIA_128_CCM, 128}, + {POLARSSL_CIPHER_CAMELLIA_192_CCM, 192}, + {POLARSSL_CIPHER_CAMELLIA_256_CCM, 256}, + #endif + }; + + int i; + + for (i = 0; i < _countof(algorithms); i++) + { + if (algorithms[i].algo == cipher_suite->cipher) + return algorithms[i].size; + } + + TRACE("POLARSSL schannel_get_cipher_key_size: Unknown cipher %#x, returning 0\n", ciphersuite_id); + + return 0; +} + +static unsigned int schannel_get_mac_key_size(int ciphersuite_id) +{ + const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id); + const unsigned int algorithms[] = + { + 0, /* POLARSSL_MD_NONE */ + 0, /* POLARSSL_MD_MD2 (not used as MAC) */ + 128, /* POLARSSL_MD_MD4 */ + 128, /* POLARSSL_MD_MD5 */ + 160, /* POLARSSL_MD_SHA1 */ + 224, /* POLARSSL_MD_SHA224 */ + 256, /* POLARSSL_MD_SHA256 */ + 384, /* POLARSSL_MD_SHA384 */ + 512, /* POLARSSL_MD_SHA512 */ + 160 /* POLARSSL_MD_RIPEMD160 */ + }; + + if (cipher_suite->mac >= 0 && cipher_suite->mac < _countof(algorithms)) + { + return algorithms[cipher_suite->mac]; + } + + TRACE("POLARSSL schannel_get_mac_key_size: Unknown mac %#x for ciphersuite %#x, returning 0\n", cipher_suite->mac, ciphersuite_id); + + return 0; +} + +static unsigned int schannel_get_kx_key_size(const ssl_context *ssl, int ciphersuite_id) +{ + const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id); + + /* if we are the server take ca_chain, if we are the client take server cert (peer_cert) */ + x509_crt *server_cert = (ssl->endpoint == SSL_IS_SERVER) ? ssl->ca_chain : ssl->session->peer_cert; + + if (cipher_suite->key_exchange != POLARSSL_KEY_EXCHANGE_NONE) + return server_cert->pk.pk_info->get_size(server_cert->pk.pk_ctx); + + TRACE("POLARSSL schannel_get_kx_key_size: Unknown kx %#x, returning 0\n", cipher_suite->key_exchange); + + return 0; +} + +static DWORD schannel_get_protocol(const ssl_context *ssl) +{ + /* FIXME: currently schannel only implements client connections, but + * there's no reason it couldn't be used for servers as well. The + * context doesn't tell us which it is, so decide based on ssl endpoint value. */ + + switch (ssl->minor_ver) + { + case SSL_MINOR_VERSION_0: + return (ssl->endpoint == SSL_IS_CLIENT) ? SP_PROT_SSL3_CLIENT : + SP_PROT_SSL3_SERVER; + + case SSL_MINOR_VERSION_1: + return (ssl->endpoint == SSL_IS_CLIENT) ? SP_PROT_TLS1_0_CLIENT : + SP_PROT_TLS1_0_SERVER; + + case SSL_MINOR_VERSION_2: + return (ssl->endpoint == SSL_IS_CLIENT) ? SP_PROT_TLS1_1_CLIENT : + SP_PROT_TLS1_1_SERVER; + + case SSL_MINOR_VERSION_3: + return (ssl->endpoint == SSL_IS_CLIENT) ? SP_PROT_TLS1_2_CLIENT : + SP_PROT_TLS1_2_SERVER; + + default: + { + FIXME("POLARSSL schannel_get_protocol: unknown protocol %d\n", ssl->minor_ver); + return 0; + } + } +} + +static ALG_ID schannel_get_cipher_algid(int ciphersuite_id) +{ + const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id); + + switch (cipher_suite->cipher) + { + case POLARSSL_CIPHER_NONE: + case POLARSSL_CIPHER_NULL: + return 0; + +#ifdef POLARSSL_ARC4_C + /* ARC4 */ + case POLARSSL_CIPHER_ARC4_128: + return CALG_RC4; +#endif + + +#ifdef POLARSSL_DES_C + /* DES */ + case POLARSSL_CIPHER_DES_ECB: + case POLARSSL_CIPHER_DES_CBC: + case POLARSSL_CIPHER_DES_EDE_ECB: + case POLARSSL_CIPHER_DES_EDE_CBC: + return CALG_DES; + + case POLARSSL_CIPHER_DES_EDE3_ECB: + case POLARSSL_CIPHER_DES_EDE3_CBC: + return CALG_3DES; +#endif + +#ifdef POLARSSL_AES_C + /* AES 128 */ + case POLARSSL_CIPHER_AES_128_ECB: + case POLARSSL_CIPHER_AES_128_CBC: + case POLARSSL_CIPHER_AES_128_CFB128: + case POLARSSL_CIPHER_AES_128_CTR: + case POLARSSL_CIPHER_AES_128_GCM: + #ifdef POLARSSL_CCM_C + case POLARSSL_CIPHER_AES_128_CCM: + #endif + return CALG_AES_128; + + case POLARSSL_CIPHER_AES_192_ECB: + case POLARSSL_CIPHER_AES_192_CBC: + case POLARSSL_CIPHER_AES_192_CFB128: + case POLARSSL_CIPHER_AES_192_CTR: + case POLARSSL_CIPHER_AES_192_GCM: + #ifdef POLARSSL_CCM_C + case POLARSSL_CIPHER_AES_192_CCM: + #endif + return CALG_AES_192; + + case POLARSSL_CIPHER_AES_256_ECB: + case POLARSSL_CIPHER_AES_256_CBC: + case POLARSSL_CIPHER_AES_256_CFB128: + case POLARSSL_CIPHER_AES_256_CTR: + case POLARSSL_CIPHER_AES_256_GCM: + #ifdef POLARSSL_CCM_C + case POLARSSL_CIPHER_AES_256_CCM: + #endif + return CALG_AES_256; +#endif + + /* nothing to show? fall through */ + default: + { + FIXME("POLARSSL schannel_get_cipher_algid: unknown algorithm %d\n", ciphersuite_id); + return 0; + } + } +} + +static ALG_ID schannel_get_mac_algid(int ciphersuite_id) +{ + const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id); + + switch (cipher_suite->mac) + { + case POLARSSL_MD_NONE: return 0; + case POLARSSL_MD_MD2: return CALG_MD2; + case POLARSSL_MD_MD4: return CALG_MD4; + case POLARSSL_MD_MD5: return CALG_MD5; + case POLARSSL_MD_SHA1: return CALG_SHA1; + case POLARSSL_MD_SHA224: return CALG_SHA; + case POLARSSL_MD_SHA256: return CALG_SHA_256; + case POLARSSL_MD_SHA384: return CALG_SHA_384; + case POLARSSL_MD_SHA512: return CALG_SHA_512; + case POLARSSL_MD_RIPEMD160: return (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_RIPEMD160); /* there's no CALG_RIPEMD or CALG_RIPEMD160 defined in <wincrypt.h> yet */ + + default: + { + FIXME("POLARSSL schannel_get_mac_algid: unknown algorithm %d\n", cipher_suite->mac); + return 0; + } + } +} + +static ALG_ID schannel_get_kx_algid(int ciphersuite_id) +{ + const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id); + + switch (cipher_suite->key_exchange) + { + case POLARSSL_KEY_EXCHANGE_NONE: + return 0; + + case POLARSSL_KEY_EXCHANGE_ECDH_RSA: + case POLARSSL_KEY_EXCHANGE_ECDH_ECDSA: + case POLARSSL_KEY_EXCHANGE_ECDHE_PSK: + case POLARSSL_KEY_EXCHANGE_ECDHE_RSA: + return CALG_ECDH; + + case POLARSSL_KEY_EXCHANGE_RSA_PSK: + case POLARSSL_KEY_EXCHANGE_RSA: + return CALG_RSA_KEYX; + + case POLARSSL_KEY_EXCHANGE_DHE_PSK: + case POLARSSL_KEY_EXCHANGE_DHE_RSA: + return CALG_DH_EPHEM; + + default: + { + FIXME("POLARSSL schannel_get_kx_algid: unknown algorithm %d\n", cipher_suite->key_exchange); + return 0; + } + } +} + +unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session) +{ + POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + TRACE("POLARSSL schan_imp_get_session_cipher_block_size %p.\n", session); + + return schannel_get_cipher_block_size(ssl_get_ciphersuite_id(ssl_get_ciphersuite(&s->ssl))); +} + +unsigned int schan_imp_get_max_message_size(schan_imp_session session) +{ + // POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + TRACE("POLARSSL schan_imp_get_max_message_size %p.\n", session); + + /* FIXME: update to mbedTLS 2.1.0 to use this function */ + // return mbedtls_ssl_get_max_frag_len(&s->ssl); + return SSL_MAX_CONTENT_LEN; +} + +SECURITY_STATUS schan_imp_get_connection_info(schan_imp_session session, + SecPkgContext_ConnectionInfo *info) +{ + POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + + int ciphersuite_id = ssl_get_ciphersuite_id(ssl_get_ciphersuite(&s->ssl)); + + TRACE("POLARSSL schan_imp_get_connection_info %p %p.\n", session, info); + + info->dwProtocol = schannel_get_protocol(&s->ssl); + info->aiCipher = schannel_get_cipher_algid(ciphersuite_id); + info->dwCipherStrength = schannel_get_cipher_key_size(ciphersuite_id); + info->aiHash = schannel_get_mac_algid(ciphersuite_id); + info->dwHashStrength = schannel_get_mac_key_size(ciphersuite_id); + info->aiExch = schannel_get_kx_algid(ciphersuite_id); + info->dwExchStrength = schannel_get_kx_key_size(&s->ssl, ciphersuite_id); + + return SEC_E_OK; +} + +SECURITY_STATUS schan_imp_get_session_peer_certificate(schan_imp_session session, HCERTSTORE store, + PCCERT_CONTEXT *ret) +{ + POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + PCCERT_CONTEXT cert_context = NULL; + const x509_crt *next_cert; + + TRACE("POLARSSL schan_imp_get_session_peer_certificate %p %p %p %p.\n", session, store, ret, ret != NULL ? *ret : NULL); + + if (!s->ssl.session->peer_cert) + return SEC_E_INTERNAL_ERROR; + + for (next_cert = s->ssl.session->peer_cert; next_cert != NULL; next_cert = next_cert->next) + { + if (!CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, next_cert->raw.p, next_cert->raw.len, + CERT_STORE_ADD_REPLACE_EXISTING, (next_cert != s->ssl.session->peer_cert) ? NULL : &cert_context)) + { + if (next_cert != s->ssl.session->peer_cert) + CertFreeCertificateContext(cert_context); + return GetLastError(); + } + } + + *ret = cert_context; + return SEC_E_OK; +} + +SECURITY_STATUS schan_imp_send(schan_imp_session session, const void *buffer, + SIZE_T *length) +{ + POLARSSL_SESSION *s = (POLARSSL_SESSION *)session; + int ret; + + ret = ssl_write(&s->ssl, (unsigned char *)buffer, *length); + + TRACE("POLARSSL schan_imp_send: (%p, %p, %p/%lu)\n", s, buffer, length, *length); + + if (ret >= 0) + { + TRACE("POLARSSL schan_imp_send: ret=%i.\n", ret); + + *length = ret; + } + else if ((ret & ROS_SCHAN_IS_BLOCKING) == ROS_SCHAN_IS_BLOCKING) + { + *length = ROS_SCHAN_IS_BLOCKING_RETRIEVE(ret); + + if (!*length) + { + TRACE("POLARSSL schan_imp_send: ret=POLARSSL_ERR_NET_WANT_WRITE -> SEC_I_CONTINUE_NEEDED; len=%lu", *length); + return SEC_I_CONTINUE_NEEDED; + } + else + { + TRACE("POLARSSL schan_imp_send: ret=POLARSSL_ERR_NET_WANT_WRITE -> SEC_E_OK; len=%lu", *length); + return SEC_E_OK; + } + } + else + { + ERR("POLARSSL schan_imp_send: ssl_write failed with -%x\n", -ret); + return SEC_E_INTERNAL_ERROR; + } + + return SEC_E_OK; +} + +SECURITY_STATUS schan_imp_recv(schan_imp_session session, void *buffer, + SIZE_T *length) +{ + PPOLARSSL_SESSION s = (PPOLARSSL_SESSION)session; + int ret; + + TRACE("POLARSSL schan_imp_recv: (%p, %p, %p/%lu)\n", s, buffer, length, *length); + + ret = ssl_read(&s->ssl, (unsigned char *)buffer, *length); + + TRACE("POLARSSL schan_imp_recv: (%p, %p, %p/%lu) ret= %#x\n", s, buffer, length, *length, ret); + + if (ret >= 0) + { + TRACE("POLARSSL schan_imp_recv: ret == %i.\n", ret); + + *length = ret; + } + else if ((ret & ROS_SCHAN_IS_BLOCKING) == ROS_SCHAN_IS_BLOCKING) + { + *length = ROS_SCHAN_IS_BLOCKING_RETRIEVE(ret); + + if (!*length) + { + TRACE("POLARSSL schan_imp_recv: ret=POLARSSL_ERR_NET_WANT_WRITE -> SEC_I_CONTINUE_NEEDED; len=%lu", *length); + return SEC_I_CONTINUE_NEEDED; + } + else + { + TRACE("POLARSSL schan_imp_recv: ret=POLARSSL_ERR_NET_WANT_WRITE -> SEC_E_OK; len=%lu", *length); + return SEC_E_OK; + } + } + else if (ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY) + { + TRACE("POLARSSL schan_imp_recv: ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY -> SEC_E_OK\n"); + return SEC_E_OK; + } + else + { + ERR("POLARSSL schan_imp_recv: ssl_read failed with -%x\n", -ret); + return SEC_E_INTERNAL_ERROR; + } + + return SEC_E_OK; +} + +BOOL schan_imp_allocate_certificate_credentials(schan_credentials *c) +{ + TRACE("POLARSSL schan_imp_allocate_certificate_credentials %p %p %d\n", c, c->credentials, c->credential_use); + + /* in our case credentials aren't really used for anything, so just stub them */ + c->credentials = NULL; + return TRUE; +} + +void schan_imp_free_certificate_credentials(schan_credentials *c) +{ + TRACE("POLARSSL schan_imp_free_certificate_credentials %p %p %d\n", c, c->credentials, c->credential_use); +} + +BOOL schan_imp_init(void) +{ + TRACE("Schannel POLARSSL schan_imp_init\n"); + return TRUE; +} + +void schan_imp_deinit(void) +{ + WARN("Schannel POLARSSL schan_imp_deinit\n"); +} + +#endif /* SONAME_LIBMBEDTLS && !HAVE_SECURITY_SECURITY_H && !SONAME_LIBGNUTLS */ Propchange: trunk/reactos/dll/win32/schannel/schannel_mbedtls.c ------------------------------------------------------------------------------ svn:eol-style = native Added: trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne… ============================================================================== --- trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h (added) +++ trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -0,0 +1,141 @@ +/* Copyright 2015 Ismael Ferreras Morezuelas <swyterzone+ros(a)gmail.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + * + * -- + * + * This file transparently wraps lazy-loading hooks in the schannel + * implementation on top of the PolarSSL/mbedTLS open source library. + */ + +static void *libmbedtls_handle; + +#define MAKE_FUNCPTR(f) static typeof(f) * p##f; + +MAKE_FUNCPTR(ctr_drbg_free) +MAKE_FUNCPTR(ctr_drbg_init) +MAKE_FUNCPTR(ctr_drbg_random) +MAKE_FUNCPTR(entropy_free) +MAKE_FUNCPTR(entropy_func) +MAKE_FUNCPTR(entropy_init) +MAKE_FUNCPTR(ssl_ciphersuite_from_id) +MAKE_FUNCPTR(ssl_free) +MAKE_FUNCPTR(ssl_get_ciphersuite) +MAKE_FUNCPTR(ssl_get_ciphersuite_id) +MAKE_FUNCPTR(ssl_get_version) +MAKE_FUNCPTR(ssl_handshake) +MAKE_FUNCPTR(ssl_init) +MAKE_FUNCPTR(ssl_read) +MAKE_FUNCPTR(ssl_set_authmode) +MAKE_FUNCPTR(ssl_set_bio) +MAKE_FUNCPTR(ssl_set_endpoint) +MAKE_FUNCPTR(ssl_set_hostname) +MAKE_FUNCPTR(ssl_set_max_version) +MAKE_FUNCPTR(ssl_set_min_version) +MAKE_FUNCPTR(ssl_set_rng) +MAKE_FUNCPTR(ssl_write) + +#undef MAKE_FUNCPTR + +/* replace the initialization functions by our own, specially tailored, ones */ + +BOOL schan_imp_init(void) +{ + libmbedtls_handle = wine_dlopen(SONAME_LIBMBEDTLS, RTLD_NOW, NULL, 0); + + if (!libmbedtls_handle) + { + WARN("Failed to load the mbedTLS dynamic library (" SONAME_LIBMBEDTLS ").\n"); + return FALSE; + } + +#define LOAD_FUNCPTR(f) \ + if (!(p##f = wine_dlsym(libmbedtls_handle, #f, NULL, 0))) \ + { \ + ERR("Failed to retrieve function %s from the mbedTLS dynamic library (" SONAME_LIBMBEDTLS ")\n", #f); \ + goto fail; \ + } + + LOAD_FUNCPTR(ctr_drbg_free) + LOAD_FUNCPTR(ctr_drbg_init) + LOAD_FUNCPTR(ctr_drbg_random) + LOAD_FUNCPTR(entropy_free) + LOAD_FUNCPTR(entropy_func) + LOAD_FUNCPTR(entropy_init) + LOAD_FUNCPTR(ssl_ciphersuite_from_id) + LOAD_FUNCPTR(ssl_free) + LOAD_FUNCPTR(ssl_get_ciphersuite) + LOAD_FUNCPTR(ssl_get_ciphersuite_id) + LOAD_FUNCPTR(ssl_get_version) + LOAD_FUNCPTR(ssl_handshake) + LOAD_FUNCPTR(ssl_init) + LOAD_FUNCPTR(ssl_read) + LOAD_FUNCPTR(ssl_set_authmode) + LOAD_FUNCPTR(ssl_set_bio) + LOAD_FUNCPTR(ssl_set_endpoint) + LOAD_FUNCPTR(ssl_set_hostname) + LOAD_FUNCPTR(ssl_set_max_version) + LOAD_FUNCPTR(ssl_set_min_version) + LOAD_FUNCPTR(ssl_set_rng) + LOAD_FUNCPTR(ssl_write) + +#undef LOAD_FUNCPTR + + return TRUE; + +fail: + + wine_dlclose(libmbedtls_handle, NULL, 0); + libmbedtls_handle = NULL; + + return FALSE; +} + +void schan_imp_deinit(void) +{ + wine_dlclose(libmbedtls_handle, NULL, 0); + libmbedtls_handle = NULL; +} + +/* now that we have overridden the initialization functions + cancel out the original stubs used when dynamically linking */ + +#define schan_imp_init schan_imp_init_unused +#define schan_imp_deinit schan_imp_deinit_unused + +/* seamlessly redirect the function pointers with some preprocessor magic */ + +#define ctr_drbg_free pctr_drbg_free +#define ctr_drbg_init pctr_drbg_init +#define ctr_drbg_random pctr_drbg_random +#define entropy_free pentropy_free +#define entropy_func pentropy_func +#define entropy_init pentropy_init +#define ssl_ciphersuite_from_id pssl_ciphersuite_from_id +#define ssl_free pssl_free +#define ssl_get_ciphersuite pssl_get_ciphersuite +#define ssl_get_ciphersuite_id pssl_get_ciphersuite_id +#define ssl_get_version pssl_get_version +#define ssl_handshake pssl_handshake +#define ssl_init pssl_init +#define ssl_read pssl_read +#define ssl_set_authmode pssl_set_authmode +#define ssl_set_bio pssl_set_bio +#define ssl_set_endpoint pssl_set_endpoint +#define ssl_set_hostname pssl_set_hostname +#define ssl_set_max_version pssl_set_max_version +#define ssl_set_min_version pssl_set_min_version +#define ssl_set_rng pssl_set_rng +#define ssl_write pssl_write Propchange: trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h ------------------------------------------------------------------------------ svn:eol-style = native Modified: trunk/reactos/dll/win32/schannel/schannel_wine.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne… ============================================================================== --- trunk/reactos/dll/win32/schannel/schannel_wine.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/schannel/schannel_wine.c [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -22,7 +22,7 @@ #include <wine/config.h> -#if defined(SONAME_LIBGNUTLS) || defined (HAVE_SECURITY_SECURITY_H) +#if defined(SONAME_LIBGNUTLS) || defined (HAVE_SECURITY_SECURITY_H) || defined (SONAME_LIBMBEDTLS) #define SCHAN_INVALID_HANDLE ~0UL @@ -1459,7 +1459,7 @@ schan_imp_deinit(); } -#else /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H */ +#else /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H || SONAME_LIBMBEDTLS */ void SECUR32_initSchannelSP(void) { @@ -1468,4 +1468,4 @@ void SECUR32_deinitSchannelSP(void) {} -#endif /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H */ +#endif /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H || SONAME_LIBMBEDTLS */ Modified: trunk/reactos/include/reactos/libs/mbedtls/polarssl/config.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt… ============================================================================== --- trunk/reactos/include/reactos/libs/mbedtls/polarssl/config.h [iso-8859-1] (original) +++ trunk/reactos/include/reactos/libs/mbedtls/polarssl/config.h [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -88,7 +88,7 @@ * * Uncomment if the CPU supports SSE2 (IA-32 specific). */ -//#define POLARSSL_HAVE_SSE2 +#define POLARSSL_HAVE_SSE2 /** * \def POLARSSL_HAVE_TIME @@ -322,7 +322,7 @@ * * Uncomment this macro to remove RC4 ciphersuites by default. */ -//#define POLARSSL_REMOVE_ARC4_CIPHERSUITES +#define POLARSSL_REMOVE_ARC4_CIPHERSUITES /** * \def POLARSSL_ECP_XXXX_ENABLED @@ -393,7 +393,7 @@ * TLS_PSK_WITH_3DES_EDE_CBC_SHA * TLS_PSK_WITH_RC4_128_SHA */ -#define POLARSSL_KEY_EXCHANGE_PSK_ENABLED +//#define POLARSSL_KEY_EXCHANGE_PSK_ENABLED /* (swyter: we don't need pre-shared key negotiation as schannel does not support it) */ /** * \def POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED @@ -417,7 +417,7 @@ * TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA * TLS_DHE_PSK_WITH_RC4_128_SHA */ -#define POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED +//#define POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED /* (swyter: we don't need pre-shared key negotiation as schannel does not support it) */ /** * \def POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED @@ -437,7 +437,7 @@ * TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA * TLS_ECDHE_PSK_WITH_RC4_128_SHA */ -#define POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED +//#define POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED /* (swyter: we don't need pre-shared key negotiation as schannel does not support it) */ /** * \def POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED @@ -462,7 +462,7 @@ * TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA * TLS_RSA_PSK_WITH_RC4_128_SHA */ -#define POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED +//#define POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED /* (swyter: we don't need pre-shared key negotiation as schannel does not support it) */ /** * \def POLARSSL_KEY_EXCHANGE_RSA_ENABLED @@ -516,7 +516,7 @@ * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA * TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA */ -#define POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED +//#define POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED /* (swyter: we don't need pre-shared key negotiation as schannel does not support it) */ /** * \def POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED @@ -712,7 +712,7 @@ * This option is only useful if both POLARSSL_SHA256_C and * POLARSSL_SHA512_C are defined. Otherwise the available hash module is used. */ -//#define POLARSSL_ENTROPY_FORCE_SHA256 +#define POLARSSL_ENTROPY_FORCE_SHA256 /** * \def POLARSSL_MEMORY_DEBUG @@ -776,7 +776,7 @@ * * Enable the checkup functions (*_self_test). */ -#define POLARSSL_SELF_TEST +//#define POLARSSL_SELF_TEST /** * \def POLARSSL_SSL_AEAD_RANDOM_IV @@ -843,7 +843,7 @@ * Enable support for Extended Master Secret, aka Session Hash * (draft-ietf-tls-session-hash-02). * - * This was introduced as "the proper fix" to the Triple Handshake familiy of + * This was introduced as "the proper fix" to the Triple Handshake family of * attacks, but it is recommended to always use it (even if you disable * renegotiation), since it actually fixes a more fundamental issue in the * original SSL/TLS design, and has implications beyond Triple Handshake. @@ -921,7 +921,7 @@ * * Comment this macro to disable support for SSLv2 Client Hello messages. */ -#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO +//#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO /* (swyter: we don't want this even if we had server-side support in schannel... which we don't) */ /** * \def POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE @@ -952,7 +952,7 @@ * * Comment this macro to disable support for SSL 3.0 */ -//#define POLARSSL_SSL_PROTO_SSL3 +//#define POLARSSL_SSL_PROTO_SSL3 /* (swyter: broken by the so-called 'BEAST' and more recently 'POODLE' attacks, there's a big-ass flaw in the protocol: http://disablessl3.com/) */ /** * \def POLARSSL_SSL_PROTO_TLS1 @@ -1424,7 +1424,7 @@ * * This module is used for testing (ssl_client/server). */ -#define POLARSSL_CERTS_C +//#define POLARSSL_CERTS_C /** * \def POLARSSL_CIPHER_C @@ -1464,7 +1464,9 @@ * * This module provides debugging functions. */ -#define POLARSSL_DEBUG_C +#if defined(DBG) + #define POLARSSL_DEBUG_C /* (enable debug prints only if ReactOS is being built with tracing) */ +#endif /** * \def POLARSSL_DES_C @@ -1574,7 +1576,7 @@ * * This module enables polarssl_strerror(). */ -#define POLARSSL_ERROR_C +//#define POLARSSL_ERROR_C /** * \def POLARSSL_GCM_C @@ -1710,7 +1712,7 @@ * * This module provides TCP/IP networking routines. */ -#define POLARSSL_NET_C +//#define POLARSSL_NET_C /* (swyter: we don't use the network routines, in fact in schannel we replace them with our own shim to forward the managed network buffers) */ /** * \def POLARSSL_OID_C @@ -1840,7 +1842,7 @@ * * Uncomment to enable generic public key write functions. */ -#define POLARSSL_PK_WRITE_C +//#define POLARSSL_PK_WRITE_C /** * \def POLARSSL_PKCS5_C @@ -1988,7 +1990,7 @@ * * Requires: POLARSSL_SSL_CACHE_C */ -#define POLARSSL_SSL_CACHE_C +//#define POLARSSL_SSL_CACHE_C /* (swyter: the schannel API shim thingie does not expose enough data for this one, maybe in the future, but not prioritary) */ /** * \def POLARSSL_SSL_CLI_C @@ -2016,7 +2018,7 @@ * * This module is required for SSL/TLS server support. */ -#define POLARSSL_SSL_SRV_C +//#define POLARSSL_SSL_SRV_C /** * \def POLARSSL_SSL_TLS_C @@ -2123,7 +2125,7 @@ * * This module is required for X.509 CRL parsing. */ -#define POLARSSL_X509_CRL_PARSE_C +//#define POLARSSL_X509_CRL_PARSE_C /** * \def POLARSSL_X509_CSR_PARSE_C @@ -2137,7 +2139,7 @@ * * This module is used for reading X.509 certificate request. */ -#define POLARSSL_X509_CSR_PARSE_C +//#define POLARSSL_X509_CSR_PARSE_C /** * \def POLARSSL_X509_CREATE_C @@ -2150,7 +2152,7 @@ * * This module is the basis for creating X.509 certificates and CSRs. */ -#define POLARSSL_X509_CREATE_C +//#define POLARSSL_X509_CREATE_C /** * \def POLARSSL_X509_CRT_WRITE_C @@ -2163,7 +2165,7 @@ * * This module is required for X.509 certificate creation. */ -#define POLARSSL_X509_CRT_WRITE_C +//#define POLARSSL_X509_CRT_WRITE_C /** * \def POLARSSL_X509_CSR_WRITE_C @@ -2176,7 +2178,7 @@ * * This module is required for X.509 certificate request writing. */ -#define POLARSSL_X509_CSR_WRITE_C +//#define POLARSSL_X509_CSR_WRITE_C /** * \def POLARSSL_XTEA_C Modified: trunk/reactos/include/reactos/wine/config.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/wine/confi… ============================================================================== --- trunk/reactos/include/reactos/wine/config.h [iso-8859-1] (original) +++ trunk/reactos/include/reactos/wine/config.h [iso-8859-1] Mon Sep 28 09:43:08 2015 @@ -1227,7 +1227,7 @@ /* #undef SONAME_LIBGLU */ /* Define to the soname of the libgnutls library. */ -#define SONAME_LIBGNUTLS L"gnutls\\libgnutls-28.dll" +/* #undef SONAME_LIBGNUTLS */ /* Define to the soname of the libgsm library. */ /* #undef SONAME_LIBGSM */ @@ -1240,6 +1240,9 @@ /* Define to the soname of the libjpeg library. */ #define SONAME_LIBJPEG "libjpeg" + +/* Define to the soname of the libmbedtls library. */ +#define SONAME_LIBMBEDTLS L"mbedtls" /* Define to the soname of the libncurses library. */ /* #undef SONAME_LIBNCURSES */

1 0

[sginsberg] 69393: [NTOS] Fix the Ob wait system calls to only catch the exceptions that are expected to be raised by the Ke wait functions (and not potentially silently catching *any* exception an...
by sginsberg＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: sginsberg Date: Mon Sep 28 09:01:11 2015 New Revision: 69393 URL: http://svn.reactos.org/svn/reactos?rev=69393&view=rev Log: [NTOS] Fix the Ob wait system calls to only catch the exceptions that are expected to be raised by the Ke wait functions (and not potentially silently catching *any* exception and corrupting everything in the process). Also fixup some code logic. SEH Mega Fixup 1/??? Modified: trunk/reactos/ntoskrnl/ob/obwait.c Modified: trunk/reactos/ntoskrnl/ob/obwait.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ob/obwait.c?rev=6… ============================================================================== --- trunk/reactos/ntoskrnl/ob/obwait.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/ob/obwait.c [iso-8859-1] Mon Sep 28 09:01:11 2015 @@ -49,12 +49,12 @@ IN BOOLEAN Alertable, IN PLARGE_INTEGER TimeOut OPTIONAL) { - PKWAIT_BLOCK WaitBlockArray = NULL; + PKWAIT_BLOCK WaitBlockArray; HANDLE Handles[MAXIMUM_WAIT_OBJECTS], KernelHandle; PVOID Objects[MAXIMUM_WAIT_OBJECTS]; PVOID WaitObjects[MAXIMUM_WAIT_OBJECTS]; - ULONG i = 0, ReferencedObjects = 0, j; - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + ULONG i, ReferencedObjects, j; + KPROCESSOR_MODE PreviousMode; LARGE_INTEGER SafeTimeOut; BOOLEAN LockInUse; PHANDLE_TABLE_ENTRY HandleEntry; @@ -65,31 +65,26 @@ NTSTATUS Status; PAGED_CODE(); - /* Enter a critical region since we'll play with handles */ - LockInUse = TRUE; - KeEnterCriticalRegion(); - /* Check for valid Object Count */ if ((ObjectCount > MAXIMUM_WAIT_OBJECTS) || !(ObjectCount)) { /* Fail */ - Status = STATUS_INVALID_PARAMETER_1; - goto Quickie; + return STATUS_INVALID_PARAMETER_1; } /* Check for valid Wait Type */ if ((WaitType != WaitAll) && (WaitType != WaitAny)) { /* Fail */ - Status = STATUS_INVALID_PARAMETER_3; - goto Quickie; - } - - /* Enter SEH */ - _SEH2_TRY - { - /* Check if the call came from user mode */ - if (PreviousMode != KernelMode) + return STATUS_INVALID_PARAMETER_3; + } + + /* Enter SEH for user mode */ + PreviousMode = ExGetPreviousMode(); + if (PreviousMode != KernelMode) + { + /* Enter SEH */ + _SEH2_TRY { /* Check if we have a timeout */ if (TimeOut) @@ -103,24 +98,30 @@ ProbeForRead(HandleArray, ObjectCount * sizeof(HANDLE), sizeof(HANDLE)); - } - - /* - * Make a copy so we don't have to guard with SEH later and keep - * track of what objects we referenced if dereferencing pointers - * suddenly fails - */ + + /* + * Make a copy so we don't have to guard with SEH later and keep + * track of what objects we referenced if dereferencing pointers + * suddenly fails + */ + RtlCopyMemory(Handles, + HandleArray, + ObjectCount * sizeof(HANDLE)); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* Return the exception code */ + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; + } + else + { + /* This is kernel mode, no need to wrap in SEH */ RtlCopyMemory(Handles, HandleArray, ObjectCount * sizeof(HANDLE)); } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) - { - /* Return the exception code */ - Status = _SEH2_GetExceptionCode(); - _SEH2_YIELD(goto Quickie); - } - _SEH2_END; /* Check if we can use the internal Wait Array */ if (ObjectCount > THREAD_WAIT_OBJECTS) @@ -133,12 +134,22 @@ if (!WaitBlockArray) { /* Fail */ - Status = STATUS_INSUFFICIENT_RESOURCES; - goto Quickie; - } - } + return STATUS_INSUFFICIENT_RESOURCES; + } + } + else + { + /* No need for the array */ + WaitBlockArray = NULL; + } + + /* Enter a critical region since we'll play with handles */ + LockInUse = TRUE; + KeEnterCriticalRegion(); /* Start the loop */ + i = 0; + ReferencedObjects = 0; do { /* Use the right Executive Handle */ @@ -240,7 +251,7 @@ } while (i < ObjectCount); } - /* Now we can finally wait. Use SEH since it can raise an exception */ + /* Now we can finally wait. Always use SEH since it can raise an exception */ _SEH2_TRY { /* We're done playing with handles */ @@ -257,7 +268,9 @@ TimeOut, WaitBlockArray); } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + _SEH2_EXCEPT((_SEH2_GetExceptionCode() == STATUS_MUTANT_LIMIT_EXCEEDED) ? + EXCEPTION_EXECUTE_HANDLER : + EXCEPTION_CONTINUE_SEARCH) { /* Get the exception code */ Status = _SEH2_GetExceptionCode(); @@ -358,11 +371,12 @@ IN PLARGE_INTEGER TimeOut OPTIONAL) { PVOID Object, WaitableObject; - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + KPROCESSOR_MODE PreviousMode; LARGE_INTEGER SafeTimeOut; NTSTATUS Status; /* Check if we came with a timeout from user mode */ + PreviousMode = ExGetPreviousMode(); if ((TimeOut) && (PreviousMode != KernelMode)) { /* Enter SEH for proving */ @@ -410,7 +424,9 @@ Alertable, TimeOut); } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + _SEH2_EXCEPT((_SEH2_GetExceptionCode() == STATUS_MUTANT_LIMIT_EXCEEDED) ? + EXCEPTION_EXECUTE_HANDLER : + EXCEPTION_CONTINUE_SEARCH) { /* Get the exception code */ Status = _SEH2_GetExceptionCode(); @@ -459,7 +475,7 @@ IN BOOLEAN Alertable, IN PLARGE_INTEGER TimeOut OPTIONAL) { - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + KPROCESSOR_MODE PreviousMode; POBJECT_TYPE Type; PVOID SignalObj, WaitObj, WaitableObject; LARGE_INTEGER SafeTimeOut; @@ -467,6 +483,7 @@ NTSTATUS Status; /* Check if we came with a timeout from user mode */ + PreviousMode = ExGetPreviousMode(); if ((TimeOut) && (PreviousMode != KernelMode)) { /* Enter SEH for probing */ @@ -542,7 +559,10 @@ /* Release the mutant */ KeReleaseMutant(SignalObj, MUTANT_INCREMENT, FALSE, TRUE); } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + _SEH2_EXCEPT(((_SEH2_GetExceptionCode() == STATUS_ABANDONED) || + (_SEH2_GetExceptionCode() == STATUS_MUTANT_NOT_OWNED)) ? + EXCEPTION_EXECUTE_HANDLER : + EXCEPTION_CONTINUE_SEARCH) { /* Get the exception code */ Status = _SEH2_GetExceptionCode(); @@ -566,7 +586,9 @@ /* Release the semaphore */ KeReleaseSemaphore(SignalObj, SEMAPHORE_INCREMENT, 1, TRUE); } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + _SEH2_EXCEPT((_SEH2_GetExceptionCode() == STATUS_SEMAPHORE_LIMIT_EXCEEDED) ? + EXCEPTION_EXECUTE_HANDLER : + EXCEPTION_CONTINUE_SEARCH) { /* Get the exception code */ Status = _SEH2_GetExceptionCode(); @@ -592,7 +614,9 @@ Alertable, TimeOut); } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + _SEH2_EXCEPT((_SEH2_GetExceptionCode() == STATUS_MUTANT_LIMIT_EXCEEDED) ? + EXCEPTION_EXECUTE_HANDLER : + EXCEPTION_CONTINUE_SEARCH) { /* Get the exception code */ Status = _SEH2_GetExceptionCode();

1 0

[pschweitzer] 69392: [NTDLL_APITEST] *.S expects length in chars
by pschweitzer＠svn.reactos.org 28 Sep '15

28 Sep '15

Author: pschweitzer Date: Mon Sep 28 08:53:31 2015 New Revision: 69392 URL: http://svn.reactos.org/svn/reactos?rev=69392&view=rev Log: [NTDLL_APITEST] *.S expects length in chars Modified: trunk/rostests/apitests/ntdll/RtlGenerate8dot3Name.c Modified: trunk/rostests/apitests/ntdll/RtlGenerate8dot3Name.c URL: http://svn.reactos.org/svn/reactos/trunk/rostests/apitests/ntdll/RtlGenerat… ============================================================================== --- trunk/rostests/apitests/ntdll/RtlGenerate8dot3Name.c [iso-8859-1] (original) +++ trunk/rostests/apitests/ntdll/RtlGenerate8dot3Name.c [iso-8859-1] Mon Sep 28 08:53:31 2015 @@ -43,22 +43,22 @@ RtlGenerate8dot3Name(&LongName, FALSE, &Context, &ShortName); RtlInitUnicodeString(&Expected, ShortNames1[i]); - ok(RtlEqualUnicodeString(&Expected, &ShortName, FALSE), "Generated: %.*S. Expected: %.*S\n", ShortName.Length, ShortName.Buffer, Expected.Length, Expected.Buffer); + ok(RtlEqualUnicodeString(&Expected, &ShortName, FALSE), "Generated: %.*S. Expected: %.*S\n", ShortName.Length / sizeof(WCHAR), ShortName.Buffer, Expected.Length / sizeof(WCHAR), Expected.Buffer); ShortName.Length = 0; RtlGenerate8dot3Name(&LongName, FALSE, &Context, &ShortName); RtlInitUnicodeString(&Expected, ShortNames2[i]); - ok(RtlEqualUnicodeString(&Expected, &ShortName, FALSE), "Generated: %.*S. Expected: %.*S\n", ShortName.Length, ShortName.Buffer, Expected.Length, Expected.Buffer); + ok(RtlEqualUnicodeString(&Expected, &ShortName, FALSE), "Generated: %.*S. Expected: %.*S\n", ShortName.Length / sizeof(WCHAR), ShortName.Buffer, Expected.Length / sizeof(WCHAR), Expected.Buffer); RtlZeroMemory(&Context, sizeof(GENERATE_NAME_CONTEXT)); ShortName.Length = 0; RtlGenerate8dot3Name(&LongName, TRUE, &Context, &ShortName); RtlInitUnicodeString(&Expected, ExShortNames1[i]); - ok(RtlEqualUnicodeString(&Expected, &ShortName, FALSE), "Generated: %.*S. Expected: %.*S\n", ShortName.Length, ShortName.Buffer, Expected.Length, Expected.Buffer); + ok(RtlEqualUnicodeString(&Expected, &ShortName, FALSE), "Generated: %.*S. Expected: %.*S\n", ShortName.Length / sizeof(WCHAR), ShortName.Buffer, Expected.Length / sizeof(WCHAR), Expected.Buffer); ShortName.Length = 0; RtlGenerate8dot3Name(&LongName, TRUE, &Context, &ShortName); RtlInitUnicodeString(&Expected, ExShortNames2[i]); - ok(RtlEqualUnicodeString(&Expected, &ShortName, FALSE), "Generated: %.*S. Expected: %.*S\n", ShortName.Length, ShortName.Buffer, Expected.Length, Expected.Buffer); + ok(RtlEqualUnicodeString(&Expected, &ShortName, FALSE), "Generated: %.*S. Expected: %.*S\n", ShortName.Length / sizeof(WCHAR), ShortName.Buffer, Expected.Length / sizeof(WCHAR), Expected.Buffer); } }

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs