[ros-diffs] [akhaldi] 69394: [MBEDTLS] Use mbedtls as a lightweight schannel TLS/SSL back-end. This is an initial checkpoint and more will follow in due time. Brought to you by Peter Hater, Ismael Ferreras Mor...

Author: akhaldi
Date: Mon Sep 28 09:43:08 2015
New Revision: 69394

URL: http://svn.reactos.org/svn/reactos?rev=69394&view=rev
Log:
[MBEDTLS] Use mbedtls as a lightweight schannel TLS/SSL back-end. This is an initial
checkpoint and more will follow in due time. Brought to you by Peter Hater, Ismael
Ferreras Morezuelas, Sebastian Lackner and Michael Müller. CORE-9065

Added:
    trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec   (with props)
    trunk/reactos/dll/win32/schannel/schannel_mbedtls.c   (with props)
    trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h   (with props)
Modified:
    trunk/reactos/dll/3rdparty/CMakeLists.txt
    trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt
    trunk/reactos/dll/win32/schannel/CMakeLists.txt
    trunk/reactos/dll/win32/schannel/schannel_gnutls.c
    trunk/reactos/dll/win32/schannel/schannel_wine.c
    trunk/reactos/include/reactos/libs/mbedtls/polarssl/config.h
    trunk/reactos/include/reactos/wine/config.h

Modified: trunk/reactos/dll/3rdparty/CMakeLists.txt
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/CMakeLists.tx…
==============================================================================
--- trunk/reactos/dll/3rdparty/CMakeLists.txt	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/CMakeLists.txt	[iso-8859-1] Mon Sep 28 09:43:08 2015
@@ -7,5 +7,4 @@
 add_subdirectory(libpng)
 add_subdirectory(libtiff)
 add_subdirectory(libxslt)
-# FIXME CORE-9065
-#add_subdirectory(mbedtls)
+add_subdirectory(mbedtls)

Modified: trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/CMake…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/CMakeLists.txt	[iso-8859-1] Mon Sep 28 09:43:08
2015
@@ -1,3 +1,6 @@
+
+spec2def(mbedtls.dll mbedtls.spec ADD_IMPORTLIB)
+
 include_directories(${REACTOS_SOURCE_DIR}/include/reactos/libs/mbedtls
                     ${REACTOS_SOURCE_DIR}/include/reactos/zlib)
 
@@ -71,7 +74,10 @@
      x509write_csr.c
      xtea.c)
 
-add_library(mbedtls SHARED ${src})
+add_library(mbedtls SHARED
+    ${src}
+    ${CMAKE_CURRENT_BINARY_DIR}/mbedtls.def)
+
 set_module_type(mbedtls win32dll)
 target_link_libraries(mbedtls zlib)
 add_importlibs(mbedtls advapi32 ws2_32 msvcrt kernel32)
@@ -87,4 +93,3 @@
         add_target_compile_flags(mbedtls "-Wno-unused-but-set-variable")
     endif()
 endif()
-

Added: trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/mbedt…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec	(added)
+++ trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec	[iso-8859-1] Mon Sep 28 09:43:08 2015
@@ -0,0 +1,22 @@
+@ cdecl ctr_drbg_free(ptr)
+@ cdecl ctr_drbg_init(ptr ptr ptr str long)
+@ cdecl ctr_drbg_random(ptr str long)
+@ cdecl entropy_free(ptr)
+@ cdecl entropy_func(ptr str long)
+@ cdecl entropy_init(ptr)
+@ cdecl ssl_ciphersuite_from_id(long)
+@ cdecl ssl_free(ptr)
+@ cdecl ssl_get_ciphersuite(ptr)
+@ cdecl ssl_get_ciphersuite_id(ptr)
+@ cdecl ssl_get_version(ptr)
+@ cdecl ssl_handshake(ptr)
+@ cdecl ssl_init(ptr)
+@ cdecl ssl_read(ptr ptr long)
+@ cdecl ssl_set_authmode(ptr long)
+@ cdecl ssl_set_bio(ptr ptr ptr ptr)
+@ cdecl ssl_set_endpoint(ptr long)
+@ cdecl ssl_set_hostname(ptr str)
+@ cdecl ssl_set_max_version(ptr long long)
+@ cdecl ssl_set_min_version(ptr long long)
+@ cdecl ssl_set_rng(ptr ptr ptr)
+@ cdecl ssl_write(ptr ptr ptr)

Propchange: trunk/reactos/dll/3rdparty/mbedtls/mbedtls.spec
------------------------------------------------------------------------------
    svn:eol-style = native

Modified: trunk/reactos/dll/win32/schannel/CMakeLists.txt
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/CMakeLi…
==============================================================================
--- trunk/reactos/dll/win32/schannel/CMakeLists.txt	[iso-8859-1] (original)
+++ trunk/reactos/dll/win32/schannel/CMakeLists.txt	[iso-8859-1] Mon Sep 28 09:43:08 2015
@@ -1,7 +1,7 @@
 
 include_directories(
     ${REACTOS_SOURCE_DIR}/include/reactos/wine
-    ${REACTOS_SOURCE_DIR}/include/reactos/libs/gnutls)
+    ${REACTOS_SOURCE_DIR}/include/reactos/libs/mbedtls)
 
 
 add_definitions(-D__WINESRC__ -D_WINE)
@@ -9,7 +9,7 @@
 
 list(APPEND SOURCE
     lsamode.c
-    schannel_gnutls.c
+    schannel_mbedtls.c
     schannel_main.c
     schannel_wine.c
     secur32_wine.c
@@ -25,6 +25,6 @@
 
 set_module_type(schannel win32dll)
 target_link_libraries(schannel wine)
-add_importlibs(schannel crypt32 secur32 advapi32 msvcrt kernel32 ntdll)
+add_importlibs(schannel mbedtls crypt32 secur32 advapi32 msvcrt kernel32 ntdll)
 add_pch(schannel precomp.h SOURCE)
 add_cd_file(TARGET schannel DESTINATION reactos/system32 FOR all)

Modified: trunk/reactos/dll/win32/schannel/schannel_gnutls.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne…
==============================================================================
--- trunk/reactos/dll/win32/schannel/schannel_gnutls.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/win32/schannel/schannel_gnutls.c	[iso-8859-1] Mon Sep 28 09:43:08
2015
@@ -33,7 +33,7 @@
 
 #define __wine_dbch_secur32 __wine_dbch_schannel
 
-#if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H)
+#if defined(SONAME_LIBGNUTLS) && !defined(HAVE_SECURITY_SECURITY_H) &&
!defined(SONAME_LIBMBEDTLS)
 
 static void *libgnutls_handle;
 
@@ -602,4 +602,4 @@
     libgnutls_handle = NULL;
 }
 
-#endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H */
+#endif /* SONAME_LIBGNUTLS && !HAVE_SECURITY_SECURITY_H &&
!SONAME_LIBMBEDTLS */

Added: trunk/reactos/dll/win32/schannel/schannel_mbedtls.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne…
==============================================================================
--- trunk/reactos/dll/win32/schannel/schannel_mbedtls.c	(added)
+++ trunk/reactos/dll/win32/schannel/schannel_mbedtls.c	[iso-8859-1] Mon Sep 28 09:43:08
2015
@@ -0,0 +1,873 @@
+/*
+ * Lightweight mbedTLS-based implementation of the schannel (SSL/TLS) provider.
+ *
+ * Copyright 2015 Peter Hater
+ * Copyright 2015 Ismael Ferreras Morezuelas <swyterzone+ros(a)gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#include "config.h"
+#include "wine/port.h"
+
+#ifdef __REACTOS__
+ #include "precomp.h"
+#else
+ #include <stdarg.h>
+ #include <errno.h>
+
+ #include "windef.h"
+ #include "winbase.h"
+ #include "sspi.h"
+ #include "schannel.h"
+ #include "wine/debug.h"
+ #include "wine/library.h"
+#endif
+
+#if defined(SONAME_LIBMBEDTLS) && !defined(HAVE_SECURITY_SECURITY_H) &&
!defined(SONAME_LIBGNUTLS)
+
+#include <polarssl/ssl.h>
+#include <polarssl/entropy.h>
+#include <polarssl/ctr_drbg.h>
+
+#define ROS_SCHAN_IS_BLOCKING (0xCCCFFFFF & 0xFFF00000)
+#define ROS_SCHAN_IS_BLOCKING_MARSHALL(read_len) (ROS_SCHAN_IS_BLOCKING | (read_len &
0x000FFFFF))
+#define ROS_SCHAN_IS_BLOCKING_RETRIEVE(read_len)                          (read_len &
0x000FFFFF)
+
+#ifndef __REACTOS__
+ /* WINE defines the back-end glue in here */
+ #include "secur32_priv.h"
+
+ /* in ReactOS we use schannel instead of secur32 */
+ WINE_DEFAULT_DEBUG_CHANNEL(secur32);
+
+ /* WINE prefers to keep it optional, disable this to link explicitly */
+ #include "schannel_mbedtls_lazyload.h"
+
+ /* WINE does not define this standard win32 macro for some reason */
+ #ifndef _countof
+  #define _countof(a) (sizeof(a)/sizeof(*(a)))
+ #endif
+#endif
+
+typedef struct
+{
+    ssl_context ssl;
+    entropy_context entropy;
+    ctr_drbg_context ctr_drbg;
+    struct schan_transport *transport;
+} POLARSSL_SESSION, *PPOLARSSL_SESSION;
+
+/* custom `net_recv` callback adapter, mbedTLS uses it in ssl_read for
+   pulling data from the underlying win32 net stack */
+static int schan_pull_adapter(void *session, unsigned char *buff, size_t buff_len)
+{
+    POLARSSL_SESSION *s = session;
+    size_t requested = buff_len;
+    int status;
+
+    TRACE("POLARSSL schan_pull_adapter: (%p/%p, %p, %u)\n", s, s->transport,
buff, buff_len);
+
+    status = schan_pull(s->transport, buff, &buff_len);
+
+    TRACE("POLARSSL schan_pull_adapter: (%p/%p, %p, %u) status: %#x\n", s,
s->transport, buff, buff_len, status);
+
+    if (status == NO_ERROR)
+    {
+        /* great, no more data left */
+        if (buff_len == 0)
+        {
+            TRACE("Connection closed\n");
+            return 0;
+        }
+        /* there's still some bytes that need pulling */
+        else if (buff_len < requested)
+        {
+            TRACE("Pulled %u bytes before would block\n", buff_len);
+            return ROS_SCHAN_IS_BLOCKING_MARSHALL(buff_len);
+        }
+        else
+        {
+            TRACE("Pulled %u bytes\n", buff_len);
+            return buff_len;
+        }
+    }
+    else if (status == EAGAIN)
+    {
+        TRACE("Would block before being able to pull anything, passing
buff_len=%u\n", buff_len);
+        return ROS_SCHAN_IS_BLOCKING_MARSHALL(buff_len);
+    }
+    else
+    {
+        ERR("Unknown status code from schan_pull: %d\n", status);
+        return POLARSSL_ERR_NET_RECV_FAILED;
+    }
+
+    /* this should be unreachable */
+    return POLARSSL_ERR_NET_CONNECT_FAILED;
+}
+
+/* custom `net_send` callback adapter, mbedTLS uses it in ssl_write for
+   pushing data to the underlying win32 net stack */
+static int schan_push_adapter(void *session, const unsigned char *buff, size_t buff_len)
+{
+    POLARSSL_SESSION *s = session;
+    int status;
+
+    TRACE("POLARSSL schan_push_adapter: (%p/%p, %p, %u)\n", s, s->transport,
buff, buff_len);
+
+    status = schan_push(s->transport, buff, &buff_len);
+
+    TRACE("POLARSSL schan_push_adapter: (%p/%p, %p, %u) status: %#x\n", s,
s->transport, buff, buff_len, status);
+
+    if (status == NO_ERROR)
+    {
+        TRACE("Pushed %u bytes\n", buff_len);
+        return buff_len;
+    }
+    else if (status == EAGAIN)
+    {
+        TRACE("Would block before being able to push anything. passing %u\n",
buff_len);
+        return ROS_SCHAN_IS_BLOCKING_MARSHALL(buff_len);
+    }
+    else
+    {
+        ERR("Unknown status code from schan_push: %d\n", status);
+        return POLARSSL_ERR_NET_SEND_FAILED;
+    }
+
+    /* this should be unreachable */
+    return POLARSSL_ERR_NET_CONNECT_FAILED;
+}
+
+DWORD schan_imp_enabled_protocols(void)
+{
+    /* NOTE: No support for SSL 2.0 */
+    TRACE("POLARSSL schan_imp_enabled_protocols()\n");
+
+    return 0
+#ifdef POLARSSL_SSL_PROTO_SSL3
+        | SP_PROT_SSL3_CLIENT | SP_PROT_SSL3_SERVER
+#endif
+#ifdef POLARSSL_SSL_PROTO_TLS1
+        | SP_PROT_TLS1_0_CLIENT | SP_PROT_TLS1_0_SERVER
+#endif
+#ifdef POLARSSL_SSL_PROTO_TLS1_1
+        | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_1_SERVER
+#endif
+#ifdef POLARSSL_SSL_PROTO_TLS1_2
+        | SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_2_SERVER
+#endif
+        ;
+}
+
+BOOL schan_imp_create_session(schan_imp_session *session, schan_credentials *cred)
+{
+    POLARSSL_SESSION *s;
+    int ret;
+
+    WARN("POLARSSL schan_imp_create_session: %p %p %p\n", session, *session,
cred);
+
+    s = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(POLARSSL_SESSION));
+
+    if (!(*session = (schan_imp_session)s))
+    {
+        ERR("Not enough memory to create session\n");
+        return FALSE;
+    }
+
+    TRACE("POLARSSL init entropy\n");
+    entropy_init(&s->entropy);
+
+    TRACE("POLARSSL init random - change static entropy private data\n");
+    ret = ctr_drbg_init(&s->ctr_drbg, entropy_func, &s->entropy, (unsigned
char *) "PolarSSL", 8);
+
+    if (ret != 0)
+    {
+        ERR("ctr_drbg_init failed with -%x\n", -ret);
+
+        entropy_free(&s->entropy);
+
+        /* safely overwrite the freed context with zeroes */
+        HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, s);
+
+        return FALSE;
+    }
+
+    WARN("POLARSSL init ssl\n");
+    ret = ssl_init(&s->ssl);
+
+    if (ret != 0)
+    {
+        ERR("Error SSL initialization -%x.\n", -ret);
+
+        ctr_drbg_free(&s->ctr_drbg);
+        entropy_free(&s->entropy);
+
+        /* safely overwrite the freed context with zeroes */
+        HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, s);
+
+        return FALSE;
+    }
+
+    TRACE("POLARSSL set BIO callbacks\n");
+    ssl_set_bio(&s->ssl, schan_pull_adapter, s, schan_push_adapter, s);
+
+    TRACE("POLARSSL set endpoint %d\n", cred->credential_use);
+    ssl_set_endpoint(&s->ssl, (cred->credential_use & SECPKG_CRED_INBOUND)
? SSL_IS_SERVER : SSL_IS_CLIENT);
+
+    TRACE("POLARSSL set authmode\n");
+    ssl_set_authmode(&s->ssl, SSL_VERIFY_NONE);
+
+    TRACE("POLARSSL set rng\n");
+    ssl_set_rng(&s->ssl, ctr_drbg_random, &s->ctr_drbg);
+
+    TRACE("POLARSSL set versions\n");
+    ssl_set_min_version(&s->ssl, SSL_MIN_MAJOR_VERSION, SSL_MIN_MINOR_VERSION);
+    ssl_set_max_version(&s->ssl, SSL_MAX_MAJOR_VERSION, SSL_MAX_MINOR_VERSION);
+
+    TRACE("POLARSSL schan_imp_create_session END!\n");
+
+    return TRUE;
+}
+
+void schan_imp_dispose_session(schan_imp_session session)
+{
+    POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+    WARN("POLARSSL schan_imp_dispose_session: %p\n", session);
+
+    /* tell the other peer (a server) that we are going away */
+    //ssl_close_notify(&s->ssl);
+
+    ssl_free(&s->ssl);
+    ctr_drbg_free(&s->ctr_drbg);
+    entropy_free(&s->entropy);
+
+    /* safely overwrite the freed context with zeroes */
+    HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, s);
+}
+
+void schan_imp_set_session_transport(schan_imp_session session,
+                                     struct schan_transport *t)
+{
+    POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+
+    TRACE("POLARSSL schan_imp_set_session_transport: %p %p %d\n", session, t,
s->ssl.state);
+
+    s->transport = t;
+}
+
+void schan_imp_set_session_target(schan_imp_session session, const char *target)
+{
+    POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+
+    FIXME("POLARSSL schan_imp_set_session_target: sess: %p hostname: %s state:
%d\n", session, target, s->ssl.state);
+
+    /* FIXME: The wine tests do not pass when we set the hostname. */
+    ssl_set_hostname(&s->ssl, target);
+}
+
+SECURITY_STATUS schan_imp_handshake(schan_imp_session session)
+{
+    POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+
+    int err = ssl_handshake(&s->ssl);
+
+    TRACE("POLARSSL schan_imp_handshake: %p %d  err: %#x \n", session,
s->ssl.state, err);
+
+    if ((err & ROS_SCHAN_IS_BLOCKING) == ROS_SCHAN_IS_BLOCKING)
+    {
+        TRACE("Received ERR_NET_WANT_READ/WRITE... let's try again!\n");
+        return SEC_I_CONTINUE_NEEDED;
+    }
+    else if (err == POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE)
+    {
+        ERR("schan_imp_handshake: SSL Feature unavailable...\n");
+        return SEC_E_UNSUPPORTED_FUNCTION;
+    }
+    else if (err != 0)
+    {
+        ERR("schan_imp_handshake: Oops! ssl_handshake returned the following error
code: -%#x...\n", -err);
+        return SEC_E_INTERNAL_ERROR;
+    }
+
+    WARN("schan_imp_handshake: Handshake completed!\n");
+    WARN("schan_imp_handshake: Protocol is %s, Cipher suite is %s\n",
ssl_get_version(&s->ssl), ssl_get_ciphersuite(&s->ssl));
+    return SEC_E_OK;
+}
+
+static unsigned int schannel_get_cipher_block_size(int ciphersuite_id)
+{
+    const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id);
+    const struct
+    {
+        int algo;
+        unsigned int size;
+    }
+    algorithms[] =
+    {
+        {POLARSSL_CIPHER_NONE,                 1},
+        {POLARSSL_CIPHER_NULL,                 1},
+
+    #ifdef POLARSSL_AES_C
+        {POLARSSL_CIPHER_AES_128_ECB,         16},
+        {POLARSSL_CIPHER_AES_192_ECB,         16},
+        {POLARSSL_CIPHER_AES_256_ECB,         16},
+        {POLARSSL_CIPHER_AES_128_CBC,         16},
+        {POLARSSL_CIPHER_AES_192_CBC,         16},
+        {POLARSSL_CIPHER_AES_256_CBC,         16},
+        {POLARSSL_CIPHER_AES_128_CFB128,      16},
+        {POLARSSL_CIPHER_AES_192_CFB128,      16},
+        {POLARSSL_CIPHER_AES_256_CFB128,      16},
+        {POLARSSL_CIPHER_AES_128_CTR,         16},
+        {POLARSSL_CIPHER_AES_192_CTR,         16},
+        {POLARSSL_CIPHER_AES_256_CTR,         16},
+        {POLARSSL_CIPHER_AES_128_GCM,         16},
+        {POLARSSL_CIPHER_AES_192_GCM,         16},
+        {POLARSSL_CIPHER_AES_256_GCM,         16},
+    #endif
+
+    #ifdef POLARSSL_CAMELLIA_C
+        {POLARSSL_CIPHER_CAMELLIA_128_ECB,    16},
+        {POLARSSL_CIPHER_CAMELLIA_192_ECB,    16},
+        {POLARSSL_CIPHER_CAMELLIA_256_ECB,    16},
+        {POLARSSL_CIPHER_CAMELLIA_128_CBC,    16},
+        {POLARSSL_CIPHER_CAMELLIA_192_CBC,    16},
+        {POLARSSL_CIPHER_CAMELLIA_256_CBC,    16},
+        {POLARSSL_CIPHER_CAMELLIA_128_CFB128, 16},
+        {POLARSSL_CIPHER_CAMELLIA_192_CFB128, 16},
+        {POLARSSL_CIPHER_CAMELLIA_256_CFB128, 16},
+        {POLARSSL_CIPHER_CAMELLIA_128_CTR,    16},
+        {POLARSSL_CIPHER_CAMELLIA_192_CTR,    16},
+        {POLARSSL_CIPHER_CAMELLIA_256_CTR,    16},
+        {POLARSSL_CIPHER_CAMELLIA_128_GCM,    16},
+        {POLARSSL_CIPHER_CAMELLIA_192_GCM,    16},
+        {POLARSSL_CIPHER_CAMELLIA_256_GCM,    16},
+    #endif
+
+    #ifdef POLARSSL_DES_C
+        {POLARSSL_CIPHER_DES_ECB,              8},
+        {POLARSSL_CIPHER_DES_CBC,              8},
+        {POLARSSL_CIPHER_DES_EDE_ECB,          8},
+        {POLARSSL_CIPHER_DES_EDE_CBC,          8},
+        {POLARSSL_CIPHER_DES_EDE3_ECB,         8},
+        {POLARSSL_CIPHER_DES_EDE3_CBC,         8},
+    #endif
+
+    #ifdef POLARSSL_BLOWFISH_C
+        {POLARSSL_CIPHER_BLOWFISH_ECB,         8},
+        {POLARSSL_CIPHER_BLOWFISH_CBC,         8},
+        {POLARSSL_CIPHER_BLOWFISH_CFB64,       8},
+        {POLARSSL_CIPHER_BLOWFISH_CTR,         8},
+    #endif
+
+    #ifdef POLARSSL_ARC4_C
+        {POLARSSL_CIPHER_ARC4_128,             1},
+    #endif
+
+    #ifdef POLARSSL_CCM_C
+        {POLARSSL_CIPHER_AES_128_CCM,         16},
+        {POLARSSL_CIPHER_AES_192_CCM,         16},
+        {POLARSSL_CIPHER_AES_256_CCM,         16},
+        {POLARSSL_CIPHER_CAMELLIA_128_CCM,    16},
+        {POLARSSL_CIPHER_CAMELLIA_192_CCM,    16},
+        {POLARSSL_CIPHER_CAMELLIA_256_CCM,    16},
+    #endif
+    };
+
+    int i;
+    for (i = 0; i < _countof(algorithms); i++)
+    {
+        if (algorithms[i].algo == cipher_suite->cipher)
+            return algorithms[i].size;
+    }
+
+    TRACE("POLARSSL schannel_get_cipher_block_size: Unknown cipher %#x, returning
1\n", ciphersuite_id);
+
+    return 1;
+}
+
+static unsigned int schannel_get_cipher_key_size(int ciphersuite_id)
+{
+    const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id);
+    const struct
+    {
+        int algo;
+        unsigned int size;
+    }
+    algorithms[] =
+    {
+        {POLARSSL_CIPHER_NONE,                  0},
+        {POLARSSL_CIPHER_NULL,                  0},
+
+    #ifdef POLARSSL_AES_C
+        {POLARSSL_CIPHER_AES_128_ECB,         128},
+        {POLARSSL_CIPHER_AES_192_ECB,         192},
+        {POLARSSL_CIPHER_AES_256_ECB,         256},
+        {POLARSSL_CIPHER_AES_128_CBC,         128},
+        {POLARSSL_CIPHER_AES_192_CBC,         192},
+        {POLARSSL_CIPHER_AES_256_CBC,         256},
+        {POLARSSL_CIPHER_AES_128_CFB128,      128},
+        {POLARSSL_CIPHER_AES_192_CFB128,      192},
+        {POLARSSL_CIPHER_AES_256_CFB128,      256},
+        {POLARSSL_CIPHER_AES_128_CTR,         128},
+        {POLARSSL_CIPHER_AES_192_CTR,         192},
+        {POLARSSL_CIPHER_AES_256_CTR,         256},
+        {POLARSSL_CIPHER_AES_128_GCM,         128},
+        {POLARSSL_CIPHER_AES_192_GCM,         192},
+        {POLARSSL_CIPHER_AES_256_GCM,         256},
+    #endif
+
+    #ifdef POLARSSL_CAMELLIA_C
+        {POLARSSL_CIPHER_CAMELLIA_128_ECB,    128},
+        {POLARSSL_CIPHER_CAMELLIA_192_ECB,    192},
+        {POLARSSL_CIPHER_CAMELLIA_256_ECB,    256},
+        {POLARSSL_CIPHER_CAMELLIA_128_CBC,    128},
+        {POLARSSL_CIPHER_CAMELLIA_192_CBC,    192},
+        {POLARSSL_CIPHER_CAMELLIA_256_CBC,    256},
+        {POLARSSL_CIPHER_CAMELLIA_128_CFB128, 128},
+        {POLARSSL_CIPHER_CAMELLIA_192_CFB128, 192},
+        {POLARSSL_CIPHER_CAMELLIA_256_CFB128, 256},
+        {POLARSSL_CIPHER_CAMELLIA_128_CTR,    128},
+        {POLARSSL_CIPHER_CAMELLIA_192_CTR,    192},
+        {POLARSSL_CIPHER_CAMELLIA_256_CTR,    256},
+        {POLARSSL_CIPHER_CAMELLIA_128_GCM,    128},
+        {POLARSSL_CIPHER_CAMELLIA_192_GCM,    192},
+        {POLARSSL_CIPHER_CAMELLIA_256_GCM,    256},
+    #endif
+
+    #ifdef POLARSSL_DES_C
+        {POLARSSL_CIPHER_DES_ECB,              56},
+        {POLARSSL_CIPHER_DES_CBC,              56},
+        {POLARSSL_CIPHER_DES_EDE_ECB,         128},
+        {POLARSSL_CIPHER_DES_EDE_CBC,         128},
+        {POLARSSL_CIPHER_DES_EDE3_ECB,        192},
+        {POLARSSL_CIPHER_DES_EDE3_CBC,        192},
+    #endif
+
+    #ifdef POLARSSL_BLOWFISH_C                      /* lies! actually unlimited,    */
+        {POLARSSL_CIPHER_BLOWFISH_ECB,        128}, /* gnutls uses this same value. */
+        {POLARSSL_CIPHER_BLOWFISH_CBC,        128}, /* BLOWFISH_MAX_KEY = 448 bits  */
+        {POLARSSL_CIPHER_BLOWFISH_CFB64,      128}, /* BLOWFISH_MIN_KEY = 032 bits  */
+        {POLARSSL_CIPHER_BLOWFISH_CTR,        128}, /* see blowfish.h for more info */
+    #endif
+
+    #ifdef POLARSSL_ARC4_C
+        {POLARSSL_CIPHER_ARC4_128,            128},
+    #endif
+
+    #ifdef POLARSSL_CCM_C
+        {POLARSSL_CIPHER_AES_128_CCM,         128},
+        {POLARSSL_CIPHER_AES_192_CCM,         192},
+        {POLARSSL_CIPHER_AES_256_CCM,         256},
+        {POLARSSL_CIPHER_CAMELLIA_128_CCM,    128},
+        {POLARSSL_CIPHER_CAMELLIA_192_CCM,    192},
+        {POLARSSL_CIPHER_CAMELLIA_256_CCM,    256},
+    #endif
+    };
+
+    int i;
+
+    for (i = 0; i < _countof(algorithms); i++)
+    {
+        if (algorithms[i].algo == cipher_suite->cipher)
+            return algorithms[i].size;
+    }
+
+    TRACE("POLARSSL schannel_get_cipher_key_size: Unknown cipher %#x, returning
0\n", ciphersuite_id);
+
+    return 0;
+}
+
+static unsigned int schannel_get_mac_key_size(int ciphersuite_id)
+{
+    const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id);
+    const unsigned int algorithms[] =
+    {
+          0, /* POLARSSL_MD_NONE      */
+          0, /* POLARSSL_MD_MD2 (not used as MAC) */
+        128, /* POLARSSL_MD_MD4       */
+        128, /* POLARSSL_MD_MD5       */
+        160, /* POLARSSL_MD_SHA1      */
+        224, /* POLARSSL_MD_SHA224    */
+        256, /* POLARSSL_MD_SHA256    */
+        384, /* POLARSSL_MD_SHA384    */
+        512, /* POLARSSL_MD_SHA512    */
+        160  /* POLARSSL_MD_RIPEMD160 */
+    };
+
+    if (cipher_suite->mac >= 0 && cipher_suite->mac <
_countof(algorithms))
+    {
+        return algorithms[cipher_suite->mac];
+    }
+
+    TRACE("POLARSSL schannel_get_mac_key_size: Unknown mac %#x for ciphersuite %#x,
returning 0\n", cipher_suite->mac, ciphersuite_id);
+
+    return 0;
+}
+
+static unsigned int schannel_get_kx_key_size(const ssl_context *ssl, int ciphersuite_id)
+{
+    const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id);
+
+    /* if we are the server take ca_chain, if we are the client take server cert
(peer_cert) */
+    x509_crt *server_cert = (ssl->endpoint == SSL_IS_SERVER) ? ssl->ca_chain :
ssl->session->peer_cert;
+
+    if (cipher_suite->key_exchange != POLARSSL_KEY_EXCHANGE_NONE)
+        return server_cert->pk.pk_info->get_size(server_cert->pk.pk_ctx);
+
+    TRACE("POLARSSL schannel_get_kx_key_size: Unknown kx %#x, returning 0\n",
cipher_suite->key_exchange);
+
+    return 0;
+}
+
+static DWORD schannel_get_protocol(const ssl_context *ssl)
+{
+    /* FIXME: currently schannel only implements client connections, but
+     * there's no reason it couldn't be used for servers as well. The
+     * context doesn't tell us which it is, so decide based on ssl endpoint value.
*/
+
+    switch (ssl->minor_ver)
+    {
+        case SSL_MINOR_VERSION_0:
+            return (ssl->endpoint == SSL_IS_CLIENT) ? SP_PROT_SSL3_CLIENT :
+                                                      SP_PROT_SSL3_SERVER;
+
+        case SSL_MINOR_VERSION_1:
+            return (ssl->endpoint == SSL_IS_CLIENT) ? SP_PROT_TLS1_0_CLIENT :
+                                                      SP_PROT_TLS1_0_SERVER;
+
+        case SSL_MINOR_VERSION_2:
+            return (ssl->endpoint == SSL_IS_CLIENT) ? SP_PROT_TLS1_1_CLIENT :
+                                                      SP_PROT_TLS1_1_SERVER;
+
+        case SSL_MINOR_VERSION_3:
+            return (ssl->endpoint == SSL_IS_CLIENT) ? SP_PROT_TLS1_2_CLIENT :
+                                                      SP_PROT_TLS1_2_SERVER;
+
+        default:
+        {
+            FIXME("POLARSSL schannel_get_protocol: unknown protocol %d\n",
ssl->minor_ver);
+            return 0;
+        }
+    }
+}
+
+static ALG_ID schannel_get_cipher_algid(int ciphersuite_id)
+{
+    const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id);
+
+    switch (cipher_suite->cipher)
+    {
+        case POLARSSL_CIPHER_NONE:
+        case POLARSSL_CIPHER_NULL:
+            return 0;
+
+#ifdef POLARSSL_ARC4_C
+        /* ARC4 */
+        case POLARSSL_CIPHER_ARC4_128:
+            return CALG_RC4;
+#endif
+
+
+#ifdef POLARSSL_DES_C
+        /* DES */
+        case POLARSSL_CIPHER_DES_ECB:
+        case POLARSSL_CIPHER_DES_CBC:
+        case POLARSSL_CIPHER_DES_EDE_ECB:
+        case POLARSSL_CIPHER_DES_EDE_CBC:
+            return CALG_DES;
+
+        case POLARSSL_CIPHER_DES_EDE3_ECB:
+        case POLARSSL_CIPHER_DES_EDE3_CBC:
+            return CALG_3DES;
+#endif
+
+#ifdef POLARSSL_AES_C
+        /* AES 128 */
+        case POLARSSL_CIPHER_AES_128_ECB:
+        case POLARSSL_CIPHER_AES_128_CBC:
+        case POLARSSL_CIPHER_AES_128_CFB128:
+        case POLARSSL_CIPHER_AES_128_CTR:
+        case POLARSSL_CIPHER_AES_128_GCM:
+    #ifdef POLARSSL_CCM_C
+        case POLARSSL_CIPHER_AES_128_CCM:
+    #endif
+            return CALG_AES_128;
+
+        case POLARSSL_CIPHER_AES_192_ECB:
+        case POLARSSL_CIPHER_AES_192_CBC:
+        case POLARSSL_CIPHER_AES_192_CFB128:
+        case POLARSSL_CIPHER_AES_192_CTR:
+        case POLARSSL_CIPHER_AES_192_GCM:
+    #ifdef POLARSSL_CCM_C
+        case POLARSSL_CIPHER_AES_192_CCM:
+    #endif
+            return CALG_AES_192;
+
+        case POLARSSL_CIPHER_AES_256_ECB:
+        case POLARSSL_CIPHER_AES_256_CBC:
+        case POLARSSL_CIPHER_AES_256_CFB128:
+        case POLARSSL_CIPHER_AES_256_CTR:
+        case POLARSSL_CIPHER_AES_256_GCM:
+    #ifdef POLARSSL_CCM_C
+        case POLARSSL_CIPHER_AES_256_CCM:
+    #endif
+            return CALG_AES_256;
+#endif
+
+        /* nothing to show? fall through */
+        default:
+        {
+            FIXME("POLARSSL schannel_get_cipher_algid: unknown algorithm %d\n",
ciphersuite_id);
+            return 0;
+        }
+    }
+}
+
+static ALG_ID schannel_get_mac_algid(int ciphersuite_id)
+{
+    const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id);
+
+    switch (cipher_suite->mac)
+    {
+        case POLARSSL_MD_NONE:      return 0;
+        case POLARSSL_MD_MD2:       return CALG_MD2;
+        case POLARSSL_MD_MD4:       return CALG_MD4;
+        case POLARSSL_MD_MD5:       return CALG_MD5;
+        case POLARSSL_MD_SHA1:      return CALG_SHA1;
+        case POLARSSL_MD_SHA224:    return CALG_SHA;
+        case POLARSSL_MD_SHA256:    return CALG_SHA_256;
+        case POLARSSL_MD_SHA384:    return CALG_SHA_384;
+        case POLARSSL_MD_SHA512:    return CALG_SHA_512;
+        case POLARSSL_MD_RIPEMD160: return (ALG_CLASS_HASH | ALG_TYPE_ANY |
ALG_SID_RIPEMD160); /* there's no CALG_RIPEMD or CALG_RIPEMD160 defined in
<wincrypt.h> yet */
+
+        default:
+        {
+            FIXME("POLARSSL schannel_get_mac_algid: unknown algorithm %d\n",
cipher_suite->mac);
+            return 0;
+        }
+    }
+}
+
+static ALG_ID schannel_get_kx_algid(int ciphersuite_id)
+{
+    const ssl_ciphersuite_t *cipher_suite = ssl_ciphersuite_from_id(ciphersuite_id);
+
+    switch (cipher_suite->key_exchange)
+    {
+        case POLARSSL_KEY_EXCHANGE_NONE:
+            return 0;
+
+        case POLARSSL_KEY_EXCHANGE_ECDH_RSA:
+        case POLARSSL_KEY_EXCHANGE_ECDH_ECDSA:
+        case POLARSSL_KEY_EXCHANGE_ECDHE_PSK:
+        case POLARSSL_KEY_EXCHANGE_ECDHE_RSA:
+            return CALG_ECDH;
+
+        case POLARSSL_KEY_EXCHANGE_RSA_PSK:
+        case POLARSSL_KEY_EXCHANGE_RSA:
+            return CALG_RSA_KEYX;
+
+        case POLARSSL_KEY_EXCHANGE_DHE_PSK:
+        case POLARSSL_KEY_EXCHANGE_DHE_RSA:
+            return CALG_DH_EPHEM;
+
+        default:
+        {
+            FIXME("POLARSSL schannel_get_kx_algid: unknown algorithm %d\n",
cipher_suite->key_exchange);
+            return 0;
+        }
+    }
+}
+
+unsigned int schan_imp_get_session_cipher_block_size(schan_imp_session session)
+{
+    POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+    TRACE("POLARSSL schan_imp_get_session_cipher_block_size %p.\n", session);
+
+    return
schannel_get_cipher_block_size(ssl_get_ciphersuite_id(ssl_get_ciphersuite(&s->ssl)));
+}
+
+unsigned int schan_imp_get_max_message_size(schan_imp_session session)
+{
+    // POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+    TRACE("POLARSSL schan_imp_get_max_message_size %p.\n", session);
+
+    /* FIXME: update to mbedTLS 2.1.0 to use this function */
+    // return mbedtls_ssl_get_max_frag_len(&s->ssl);
+    return SSL_MAX_CONTENT_LEN;
+}
+
+SECURITY_STATUS schan_imp_get_connection_info(schan_imp_session session,
+                                              SecPkgContext_ConnectionInfo *info)
+{
+    POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+
+    int ciphersuite_id = ssl_get_ciphersuite_id(ssl_get_ciphersuite(&s->ssl));
+
+    TRACE("POLARSSL schan_imp_get_connection_info %p %p.\n", session, info);
+
+    info->dwProtocol       = schannel_get_protocol(&s->ssl);
+    info->aiCipher         = schannel_get_cipher_algid(ciphersuite_id);
+    info->dwCipherStrength = schannel_get_cipher_key_size(ciphersuite_id);
+    info->aiHash           = schannel_get_mac_algid(ciphersuite_id);
+    info->dwHashStrength   = schannel_get_mac_key_size(ciphersuite_id);
+    info->aiExch           = schannel_get_kx_algid(ciphersuite_id);
+    info->dwExchStrength   = schannel_get_kx_key_size(&s->ssl,
ciphersuite_id);
+
+    return SEC_E_OK;
+}
+
+SECURITY_STATUS schan_imp_get_session_peer_certificate(schan_imp_session session,
HCERTSTORE store,
+                                                       PCCERT_CONTEXT *ret)
+{
+    POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+    PCCERT_CONTEXT cert_context = NULL;
+    const x509_crt *next_cert;
+
+    TRACE("POLARSSL schan_imp_get_session_peer_certificate %p %p %p %p.\n",
session, store, ret, ret != NULL ? *ret : NULL);
+
+    if (!s->ssl.session->peer_cert)
+        return SEC_E_INTERNAL_ERROR;
+
+    for (next_cert = s->ssl.session->peer_cert; next_cert != NULL; next_cert =
next_cert->next)
+    {
+        if (!CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
next_cert->raw.p, next_cert->raw.len,
+            CERT_STORE_ADD_REPLACE_EXISTING, (next_cert !=
s->ssl.session->peer_cert) ? NULL : &cert_context))
+        {
+            if (next_cert != s->ssl.session->peer_cert)
+                CertFreeCertificateContext(cert_context);
+            return GetLastError();
+        }
+    }
+
+    *ret = cert_context;
+    return SEC_E_OK;
+}
+
+SECURITY_STATUS schan_imp_send(schan_imp_session session, const void *buffer,
+                               SIZE_T *length)
+{
+    POLARSSL_SESSION *s = (POLARSSL_SESSION *)session;
+    int ret;
+
+    ret = ssl_write(&s->ssl, (unsigned char *)buffer, *length);
+
+    TRACE("POLARSSL schan_imp_send: (%p, %p, %p/%lu)\n", s, buffer, length,
*length);
+
+    if (ret >= 0)
+    {
+        TRACE("POLARSSL schan_imp_send: ret=%i.\n", ret);
+
+        *length = ret;
+    }
+    else if ((ret & ROS_SCHAN_IS_BLOCKING) == ROS_SCHAN_IS_BLOCKING)
+    {
+        *length = ROS_SCHAN_IS_BLOCKING_RETRIEVE(ret);
+
+        if (!*length)
+        {
+            TRACE("POLARSSL schan_imp_send: ret=POLARSSL_ERR_NET_WANT_WRITE ->
SEC_I_CONTINUE_NEEDED; len=%lu", *length);
+            return SEC_I_CONTINUE_NEEDED;
+        }
+        else
+        {
+            TRACE("POLARSSL schan_imp_send: ret=POLARSSL_ERR_NET_WANT_WRITE ->
SEC_E_OK; len=%lu", *length);
+            return SEC_E_OK;
+        }
+    }
+    else
+    {
+        ERR("POLARSSL schan_imp_send: ssl_write failed with -%x\n", -ret);
+        return SEC_E_INTERNAL_ERROR;
+    }
+
+    return SEC_E_OK;
+}
+
+SECURITY_STATUS schan_imp_recv(schan_imp_session session, void *buffer,
+                               SIZE_T *length)
+{
+    PPOLARSSL_SESSION s = (PPOLARSSL_SESSION)session;
+    int ret;
+
+    TRACE("POLARSSL schan_imp_recv: (%p, %p, %p/%lu)\n", s, buffer, length,
*length);
+
+    ret = ssl_read(&s->ssl, (unsigned char *)buffer, *length);
+
+    TRACE("POLARSSL schan_imp_recv: (%p, %p, %p/%lu) ret= %#x\n", s, buffer,
length, *length, ret);
+
+    if (ret >= 0)
+    {
+        TRACE("POLARSSL schan_imp_recv: ret == %i.\n", ret);
+
+        *length = ret;
+    }
+    else if ((ret & ROS_SCHAN_IS_BLOCKING) == ROS_SCHAN_IS_BLOCKING)
+    {
+        *length = ROS_SCHAN_IS_BLOCKING_RETRIEVE(ret);
+
+        if (!*length)
+        {
+            TRACE("POLARSSL schan_imp_recv: ret=POLARSSL_ERR_NET_WANT_WRITE ->
SEC_I_CONTINUE_NEEDED; len=%lu", *length);
+            return SEC_I_CONTINUE_NEEDED;
+        }
+        else
+        {
+            TRACE("POLARSSL schan_imp_recv: ret=POLARSSL_ERR_NET_WANT_WRITE ->
SEC_E_OK; len=%lu", *length);
+            return SEC_E_OK;
+        }
+    }
+    else if (ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY)
+    {
+        TRACE("POLARSSL schan_imp_recv: ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY
-> SEC_E_OK\n");
+        return SEC_E_OK;
+    }
+    else
+    {
+        ERR("POLARSSL schan_imp_recv: ssl_read failed with -%x\n", -ret);
+        return SEC_E_INTERNAL_ERROR;
+    }
+
+    return SEC_E_OK;
+}
+
+BOOL schan_imp_allocate_certificate_credentials(schan_credentials *c)
+{
+    TRACE("POLARSSL schan_imp_allocate_certificate_credentials %p %p %d\n", c,
c->credentials, c->credential_use);
+
+    /* in our case credentials aren't really used for anything, so just stub them */
+    c->credentials = NULL;
+    return TRUE;
+}
+
+void schan_imp_free_certificate_credentials(schan_credentials *c)
+{
+    TRACE("POLARSSL schan_imp_free_certificate_credentials %p %p %d\n", c,
c->credentials, c->credential_use);
+}
+
+BOOL schan_imp_init(void)
+{
+    TRACE("Schannel POLARSSL schan_imp_init\n");
+    return TRUE;
+}
+
+void schan_imp_deinit(void)
+{
+    WARN("Schannel POLARSSL schan_imp_deinit\n");
+}
+
+#endif /* SONAME_LIBMBEDTLS && !HAVE_SECURITY_SECURITY_H &&
!SONAME_LIBGNUTLS */

Propchange: trunk/reactos/dll/win32/schannel/schannel_mbedtls.c
------------------------------------------------------------------------------
    svn:eol-style = native

Added: trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne…
==============================================================================
--- trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h	(added)
+++ trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h	[iso-8859-1] Mon Sep 28
09:43:08 2015
@@ -0,0 +1,141 @@
+/* Copyright 2015 Ismael Ferreras Morezuelas &lt;swyterzone+ros(a)gmail.com&gt;
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * --
+ *
+ * This file transparently wraps lazy-loading hooks in the schannel
+ * implementation on top of the PolarSSL/mbedTLS open source library.
+ */
+
+static void *libmbedtls_handle;
+
+#define MAKE_FUNCPTR(f) static typeof(f) * p##f;
+
+MAKE_FUNCPTR(ctr_drbg_free)
+MAKE_FUNCPTR(ctr_drbg_init)
+MAKE_FUNCPTR(ctr_drbg_random)
+MAKE_FUNCPTR(entropy_free)
+MAKE_FUNCPTR(entropy_func)
+MAKE_FUNCPTR(entropy_init)
+MAKE_FUNCPTR(ssl_ciphersuite_from_id)
+MAKE_FUNCPTR(ssl_free)
+MAKE_FUNCPTR(ssl_get_ciphersuite)
+MAKE_FUNCPTR(ssl_get_ciphersuite_id)
+MAKE_FUNCPTR(ssl_get_version)
+MAKE_FUNCPTR(ssl_handshake)
+MAKE_FUNCPTR(ssl_init)
+MAKE_FUNCPTR(ssl_read)
+MAKE_FUNCPTR(ssl_set_authmode)
+MAKE_FUNCPTR(ssl_set_bio)
+MAKE_FUNCPTR(ssl_set_endpoint)
+MAKE_FUNCPTR(ssl_set_hostname)
+MAKE_FUNCPTR(ssl_set_max_version)
+MAKE_FUNCPTR(ssl_set_min_version)
+MAKE_FUNCPTR(ssl_set_rng)
+MAKE_FUNCPTR(ssl_write)
+
+#undef MAKE_FUNCPTR
+
+/* replace the initialization functions by our own, specially tailored, ones */
+
+BOOL schan_imp_init(void)
+{
+    libmbedtls_handle = wine_dlopen(SONAME_LIBMBEDTLS, RTLD_NOW, NULL, 0);
+
+    if (!libmbedtls_handle)
+    {
+        WARN("Failed to load the mbedTLS dynamic library (" SONAME_LIBMBEDTLS
").\n");
+        return FALSE;
+    }
+
+#define LOAD_FUNCPTR(f) \
+    if (!(p##f = wine_dlsym(libmbedtls_handle, #f, NULL, 0))) \
+    { \
+        ERR("Failed to retrieve function %s from the mbedTLS dynamic library ("
SONAME_LIBMBEDTLS ")\n", #f); \
+        goto fail; \
+    }
+
+	LOAD_FUNCPTR(ctr_drbg_free)
+	LOAD_FUNCPTR(ctr_drbg_init)
+	LOAD_FUNCPTR(ctr_drbg_random)
+	LOAD_FUNCPTR(entropy_free)
+	LOAD_FUNCPTR(entropy_func)
+	LOAD_FUNCPTR(entropy_init)
+	LOAD_FUNCPTR(ssl_ciphersuite_from_id)
+	LOAD_FUNCPTR(ssl_free)
+	LOAD_FUNCPTR(ssl_get_ciphersuite)
+	LOAD_FUNCPTR(ssl_get_ciphersuite_id)
+	LOAD_FUNCPTR(ssl_get_version)
+	LOAD_FUNCPTR(ssl_handshake)
+	LOAD_FUNCPTR(ssl_init)
+	LOAD_FUNCPTR(ssl_read)
+	LOAD_FUNCPTR(ssl_set_authmode)
+	LOAD_FUNCPTR(ssl_set_bio)
+	LOAD_FUNCPTR(ssl_set_endpoint)
+	LOAD_FUNCPTR(ssl_set_hostname)
+	LOAD_FUNCPTR(ssl_set_max_version)
+	LOAD_FUNCPTR(ssl_set_min_version)
+	LOAD_FUNCPTR(ssl_set_rng)
+	LOAD_FUNCPTR(ssl_write)
+
+#undef LOAD_FUNCPTR
+
+    return TRUE;
+
+fail:
+
+    wine_dlclose(libmbedtls_handle, NULL, 0);
+    libmbedtls_handle = NULL;
+
+    return FALSE;
+}
+
+void schan_imp_deinit(void)
+{
+    wine_dlclose(libmbedtls_handle, NULL, 0);
+    libmbedtls_handle = NULL;
+}
+
+/* now that we have overridden the initialization functions
+   cancel out the original stubs used when dynamically linking */
+
+#define schan_imp_init          schan_imp_init_unused
+#define schan_imp_deinit        schan_imp_deinit_unused
+
+/* seamlessly redirect the function pointers with some preprocessor magic */
+
+#define ctr_drbg_free           pctr_drbg_free
+#define ctr_drbg_init           pctr_drbg_init
+#define ctr_drbg_random         pctr_drbg_random
+#define entropy_free            pentropy_free
+#define entropy_func            pentropy_func
+#define entropy_init            pentropy_init
+#define ssl_ciphersuite_from_id pssl_ciphersuite_from_id
+#define ssl_free                pssl_free
+#define ssl_get_ciphersuite     pssl_get_ciphersuite
+#define ssl_get_ciphersuite_id  pssl_get_ciphersuite_id
+#define ssl_get_version         pssl_get_version
+#define ssl_handshake           pssl_handshake
+#define ssl_init                pssl_init
+#define ssl_read                pssl_read
+#define ssl_set_authmode        pssl_set_authmode
+#define ssl_set_bio             pssl_set_bio
+#define ssl_set_endpoint        pssl_set_endpoint
+#define ssl_set_hostname        pssl_set_hostname
+#define ssl_set_max_version     pssl_set_max_version
+#define ssl_set_min_version     pssl_set_min_version
+#define ssl_set_rng             pssl_set_rng
+#define ssl_write               pssl_write

Propchange: trunk/reactos/dll/win32/schannel/schannel_mbedtls_lazyload.h
------------------------------------------------------------------------------
    svn:eol-style = native

Modified: trunk/reactos/dll/win32/schannel/schannel_wine.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/schannel/schanne…
==============================================================================
--- trunk/reactos/dll/win32/schannel/schannel_wine.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/win32/schannel/schannel_wine.c	[iso-8859-1] Mon Sep 28 09:43:08
2015
@@ -22,7 +22,7 @@
 
 #include <wine/config.h>
 
-#if defined(SONAME_LIBGNUTLS) || defined (HAVE_SECURITY_SECURITY_H)
+#if defined(SONAME_LIBGNUTLS) || defined (HAVE_SECURITY_SECURITY_H) || defined
(SONAME_LIBMBEDTLS)
 
 #define SCHAN_INVALID_HANDLE ~0UL
 
@@ -1459,7 +1459,7 @@
     schan_imp_deinit();
 }
 
-#else /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H */
+#else /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H || SONAME_LIBMBEDTLS  */
 
 void SECUR32_initSchannelSP(void)
 {
@@ -1468,4 +1468,4 @@
 
 void SECUR32_deinitSchannelSP(void) {}
 
-#endif /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H */
+#endif /* SONAME_LIBGNUTLS || HAVE_SECURITY_SECURITY_H || SONAME_LIBMBEDTLS  */

Modified: trunk/reactos/include/reactos/libs/mbedtls/polarssl/config.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/polarssl/config.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/polarssl/config.h	[iso-8859-1] Mon Sep 28
09:43:08 2015
@@ -88,7 +88,7 @@
  *
  * Uncomment if the CPU supports SSE2 (IA-32 specific).
  */
-//#define POLARSSL_HAVE_SSE2
+#define POLARSSL_HAVE_SSE2
 
 /**
  * \def POLARSSL_HAVE_TIME
@@ -322,7 +322,7 @@
  *
  * Uncomment this macro to remove RC4 ciphersuites by default.
  */
-//#define POLARSSL_REMOVE_ARC4_CIPHERSUITES
+#define POLARSSL_REMOVE_ARC4_CIPHERSUITES
 
 /**
  * \def POLARSSL_ECP_XXXX_ENABLED
@@ -393,7 +393,7 @@
  *      TLS_PSK_WITH_3DES_EDE_CBC_SHA
  *      TLS_PSK_WITH_RC4_128_SHA
  */
-#define POLARSSL_KEY_EXCHANGE_PSK_ENABLED
+//#define POLARSSL_KEY_EXCHANGE_PSK_ENABLED /* (swyter: we don't need pre-shared key
negotiation as schannel does not support it) */
 
 /**
  * \def POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED
@@ -417,7 +417,7 @@
  *      TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
  *      TLS_DHE_PSK_WITH_RC4_128_SHA
  */
-#define POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED
+//#define POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED /* (swyter: we don't need pre-shared
key negotiation as schannel does not support it) */
 
 /**
  * \def POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED
@@ -437,7 +437,7 @@
  *      TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
  *      TLS_ECDHE_PSK_WITH_RC4_128_SHA
  */
-#define POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED
+//#define POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED /* (swyter: we don't need
pre-shared key negotiation as schannel does not support it) */
 
 /**
  * \def POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED
@@ -462,7 +462,7 @@
  *      TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
  *      TLS_RSA_PSK_WITH_RC4_128_SHA
  */
-#define POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED
+//#define POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED /* (swyter: we don't need pre-shared
key negotiation as schannel does not support it) */
 
 /**
  * \def POLARSSL_KEY_EXCHANGE_RSA_ENABLED
@@ -516,7 +516,7 @@
  *      TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
  *      TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  */
-#define POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED
+//#define POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED /* (swyter: we don't need pre-shared
key negotiation as schannel does not support it) */
 
 /**
  * \def POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED
@@ -712,7 +712,7 @@
  * This option is only useful if both POLARSSL_SHA256_C and
  * POLARSSL_SHA512_C are defined. Otherwise the available hash module is used.
  */
-//#define POLARSSL_ENTROPY_FORCE_SHA256
+#define POLARSSL_ENTROPY_FORCE_SHA256
 
 /**
  * \def POLARSSL_MEMORY_DEBUG
@@ -776,7 +776,7 @@
  *
  * Enable the checkup functions (*_self_test).
  */
-#define POLARSSL_SELF_TEST
+//#define POLARSSL_SELF_TEST
 
 /**
  * \def POLARSSL_SSL_AEAD_RANDOM_IV
@@ -843,7 +843,7 @@
  * Enable support for Extended Master Secret, aka Session Hash
  * (draft-ietf-tls-session-hash-02).
  *
- * This was introduced as "the proper fix" to the Triple Handshake familiy of
+ * This was introduced as "the proper fix" to the Triple Handshake family of
  * attacks, but it is recommended to always use it (even if you disable
  * renegotiation), since it actually fixes a more fundamental issue in the
  * original SSL/TLS design, and has implications beyond Triple Handshake.
@@ -921,7 +921,7 @@
  *
  * Comment this macro to disable support for SSLv2 Client Hello messages.
  */
-#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
+//#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO /* (swyter: we don't want this
even if we had server-side support in schannel... which we don't) */
 
 /**
  * \def POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE
@@ -952,7 +952,7 @@
  *
  * Comment this macro to disable support for SSL 3.0
  */
-//#define POLARSSL_SSL_PROTO_SSL3
+//#define POLARSSL_SSL_PROTO_SSL3 /* (swyter: broken by the so-called 'BEAST' and
more recently 'POODLE' attacks, there's a big-ass flaw in the protocol:
http://disablessl3.com/) */
 
 /**
  * \def POLARSSL_SSL_PROTO_TLS1
@@ -1424,7 +1424,7 @@
  *
  * This module is used for testing (ssl_client/server).
  */
-#define POLARSSL_CERTS_C
+//#define POLARSSL_CERTS_C
 
 /**
  * \def POLARSSL_CIPHER_C
@@ -1464,7 +1464,9 @@
  *
  * This module provides debugging functions.
  */
-#define POLARSSL_DEBUG_C
+#if defined(DBG)
+  #define POLARSSL_DEBUG_C /* (enable debug prints only if ReactOS is being built with
tracing) */
+#endif
 
 /**
  * \def POLARSSL_DES_C
@@ -1574,7 +1576,7 @@
  *
  * This module enables polarssl_strerror().
  */
-#define POLARSSL_ERROR_C
+//#define POLARSSL_ERROR_C
 
 /**
  * \def POLARSSL_GCM_C
@@ -1710,7 +1712,7 @@
  *
  * This module provides TCP/IP networking routines.
  */
-#define POLARSSL_NET_C
+//#define POLARSSL_NET_C /* (swyter: we don't use the network routines, in fact in
schannel we replace them with our own shim to forward the managed network buffers) */
 
 /**
  * \def POLARSSL_OID_C
@@ -1840,7 +1842,7 @@
  *
  * Uncomment to enable generic public key write functions.
  */
-#define POLARSSL_PK_WRITE_C
+//#define POLARSSL_PK_WRITE_C
 
 /**
  * \def POLARSSL_PKCS5_C
@@ -1988,7 +1990,7 @@
  *
  * Requires: POLARSSL_SSL_CACHE_C
  */
-#define POLARSSL_SSL_CACHE_C
+//#define POLARSSL_SSL_CACHE_C /* (swyter: the schannel API shim thingie does not expose
enough data for this one, maybe in the future, but not prioritary) */
 
 /**
  * \def POLARSSL_SSL_CLI_C
@@ -2016,7 +2018,7 @@
  *
  * This module is required for SSL/TLS server support.
  */
-#define POLARSSL_SSL_SRV_C
+//#define POLARSSL_SSL_SRV_C
 
 /**
  * \def POLARSSL_SSL_TLS_C
@@ -2123,7 +2125,7 @@
  *
  * This module is required for X.509 CRL parsing.
  */
-#define POLARSSL_X509_CRL_PARSE_C
+//#define POLARSSL_X509_CRL_PARSE_C
 
 /**
  * \def POLARSSL_X509_CSR_PARSE_C
@@ -2137,7 +2139,7 @@
  *
  * This module is used for reading X.509 certificate request.
  */
-#define POLARSSL_X509_CSR_PARSE_C
+//#define POLARSSL_X509_CSR_PARSE_C
 
 /**
  * \def POLARSSL_X509_CREATE_C
@@ -2150,7 +2152,7 @@
  *
  * This module is the basis for creating X.509 certificates and CSRs.
  */
-#define POLARSSL_X509_CREATE_C
+//#define POLARSSL_X509_CREATE_C
 
 /**
  * \def POLARSSL_X509_CRT_WRITE_C
@@ -2163,7 +2165,7 @@
  *
  * This module is required for X.509 certificate creation.
  */
-#define POLARSSL_X509_CRT_WRITE_C
+//#define POLARSSL_X509_CRT_WRITE_C
 
 /**
  * \def POLARSSL_X509_CSR_WRITE_C
@@ -2176,7 +2178,7 @@
  *
  * This module is required for X.509 certificate request writing.
  */
-#define POLARSSL_X509_CSR_WRITE_C
+//#define POLARSSL_X509_CSR_WRITE_C
 
 /**
  * \def POLARSSL_XTEA_C

Modified: trunk/reactos/include/reactos/wine/config.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/wine/confi…
==============================================================================
--- trunk/reactos/include/reactos/wine/config.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/wine/config.h	[iso-8859-1] Mon Sep 28 09:43:08 2015
@@ -1227,7 +1227,7 @@
 /* #undef SONAME_LIBGLU */
 
 /* Define to the soname of the libgnutls library. */
-#define SONAME_LIBGNUTLS L"gnutls\\libgnutls-28.dll"
+/* #undef SONAME_LIBGNUTLS */
 
 /* Define to the soname of the libgsm library. */
 /* #undef SONAME_LIBGSM */
@@ -1240,6 +1240,9 @@
 
 /* Define to the soname of the libjpeg library. */
 #define SONAME_LIBJPEG "libjpeg"
+
+/* Define to the soname of the libmbedtls library. */
+#define SONAME_LIBMBEDTLS L"mbedtls"
 
 /* Define to the soname of the libncurses library. */
 /* #undef SONAME_LIBNCURSES */