2 * Wininet - networking layer. Uses unix sockets or OpenSSL.
4 * Copyright 2002 TransGaming Technologies Inc.
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
24 #include "wine/port.h"
26 #define NONAMELESSUNION
28 #if defined(__MINGW32__) || defined (_MSC_VER)
32 #include <sys/types.h>
36 #ifdef HAVE_SYS_POLL_H
37 # include <sys/poll.h>
39 #ifdef HAVE_SYS_TIME_H
40 # include <sys/time.h>
42 #ifdef HAVE_SYS_SOCKET_H
43 # include <sys/socket.h>
45 #ifdef HAVE_SYS_FILIO_H
46 # include <sys/filio.h>
51 #ifdef HAVE_SYS_IOCTL_H
52 # include <sys/ioctl.h>
58 #ifdef HAVE_NETINET_IN_H
59 # include <netinet/in.h>
61 #ifdef HAVE_OPENSSL_SSL_H
62 # include <openssl/ssl.h>
63 # include <openssl/opensslv.h>
74 #include "wine/library.h"
81 #include "wine/debug.h"
84 /* To avoid conflicts with the Unix socket headers. we only need it for
85 * the error codes anyway. */
89 #define RESPONSE_TIMEOUT 30 /* FROM internet.c */
92 WINE_DEFAULT_DEBUG_CHANNEL(wininet
);
95 * This should use winsock - To use winsock the functions will have to change a bit
96 * as they are designed for unix sockets.
97 * SSL stuff should use crypt32.dll
102 #include <openssl/err.h>
104 static CRITICAL_SECTION init_ssl_cs
;
105 static CRITICAL_SECTION_DEBUG init_ssl_cs_debug
=
108 { &init_ssl_cs_debug
.ProcessLocksList
,
109 &init_ssl_cs_debug
.ProcessLocksList
},
110 0, 0, { (DWORD_PTR
)(__FILE__
": init_ssl_cs") }
112 static CRITICAL_SECTION init_ssl_cs
= { &init_ssl_cs_debug
, -1, 0, 0, 0, 0 };
114 static void *OpenSSL_ssl_handle
;
115 static void *OpenSSL_crypto_handle
;
117 #if defined(OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER > 0x10000000)
118 static const SSL_METHOD
*meth
;
120 static SSL_METHOD
*meth
;
123 static int hostname_idx
;
124 static int error_idx
;
127 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
129 /* OpenSSL functions that we use */
130 MAKE_FUNCPTR(SSL_library_init
);
131 MAKE_FUNCPTR(SSL_load_error_strings
);
132 MAKE_FUNCPTR(SSLv23_method
);
133 MAKE_FUNCPTR(SSL_CTX_free
);
134 MAKE_FUNCPTR(SSL_CTX_new
);
135 MAKE_FUNCPTR(SSL_new
);
136 MAKE_FUNCPTR(SSL_free
);
137 MAKE_FUNCPTR(SSL_set_fd
);
138 MAKE_FUNCPTR(SSL_connect
);
139 MAKE_FUNCPTR(SSL_shutdown
);
140 MAKE_FUNCPTR(SSL_write
);
141 MAKE_FUNCPTR(SSL_read
);
142 MAKE_FUNCPTR(SSL_pending
);
143 MAKE_FUNCPTR(SSL_get_error
);
144 MAKE_FUNCPTR(SSL_get_ex_new_index
);
145 MAKE_FUNCPTR(SSL_get_ex_data
);
146 MAKE_FUNCPTR(SSL_set_ex_data
);
147 MAKE_FUNCPTR(SSL_get_ex_data_X509_STORE_CTX_idx
);
148 MAKE_FUNCPTR(SSL_get_peer_certificate
);
149 MAKE_FUNCPTR(SSL_CTX_get_timeout
);
150 MAKE_FUNCPTR(SSL_CTX_set_timeout
);
151 MAKE_FUNCPTR(SSL_CTX_set_default_verify_paths
);
152 MAKE_FUNCPTR(SSL_CTX_set_verify
);
153 MAKE_FUNCPTR(SSL_get_current_cipher
);
154 MAKE_FUNCPTR(SSL_CIPHER_get_bits
);
156 /* OpenSSL's libcrypto functions that we use */
157 MAKE_FUNCPTR(BIO_new_fp
);
158 MAKE_FUNCPTR(CRYPTO_num_locks
);
159 MAKE_FUNCPTR(CRYPTO_set_id_callback
);
160 MAKE_FUNCPTR(CRYPTO_set_locking_callback
);
161 MAKE_FUNCPTR(ERR_free_strings
);
162 MAKE_FUNCPTR(ERR_get_error
);
163 MAKE_FUNCPTR(ERR_error_string
);
164 MAKE_FUNCPTR(X509_STORE_CTX_get_ex_data
);
165 MAKE_FUNCPTR(i2d_X509
);
166 MAKE_FUNCPTR(sk_num
);
167 MAKE_FUNCPTR(sk_value
);
170 static CRITICAL_SECTION
*ssl_locks
;
171 static unsigned int num_ssl_locks
;
173 static unsigned long ssl_thread_id(void)
175 return GetCurrentThreadId();
178 static void ssl_lock_callback(int mode
, int type
, const char *file
, int line
)
180 if (mode
& CRYPTO_LOCK
)
181 EnterCriticalSection(&ssl_locks
[type
]);
183 LeaveCriticalSection(&ssl_locks
[type
]);
186 static PCCERT_CONTEXT
X509_to_cert_context(X509
*cert
)
188 unsigned char* buffer
,*p
;
190 BOOL malloced
= FALSE
;
194 len
= pi2d_X509(cert
,&p
);
196 * SSL 0.9.7 and above malloc the buffer if it is null.
197 * however earlier version do not and so we would need to alloc the buffer.
199 * see the i2d_X509 man page for more details.
203 buffer
= HeapAlloc(GetProcessHeap(),0,len
);
205 len
= pi2d_X509(cert
,&p
);
213 ret
= CertCreateCertificateContext(X509_ASN_ENCODING
,buffer
,len
);
218 HeapFree(GetProcessHeap(),0,buffer
);
223 static DWORD
netconn_verify_cert(PCCERT_CONTEXT cert
, HCERTSTORE store
,
224 WCHAR
*server
, DWORD security_flags
)
227 CERT_CHAIN_PARA chainPara
= { sizeof(chainPara
), { 0 } };
228 PCCERT_CHAIN_CONTEXT chain
;
229 char oid_server_auth
[] = szOID_PKIX_KP_SERVER_AUTH
;
230 char *server_auth
[] = { oid_server_auth
};
231 DWORD err
= ERROR_SUCCESS
, chainFlags
= 0;
233 TRACE("verifying %s\n", debugstr_w(server
));
234 chainPara
.RequestedUsage
.Usage
.cUsageIdentifier
= 1;
235 chainPara
.RequestedUsage
.Usage
.rgpszUsageIdentifier
= server_auth
;
236 if (!(security_flags
& SECURITY_FLAG_IGNORE_REVOCATION
))
237 chainFlags
|= CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT
;
238 if ((ret
= CertGetCertificateChain(NULL
, cert
, NULL
, store
, &chainPara
,
239 chainFlags
, NULL
, &chain
)))
241 if (chain
->TrustStatus
.dwErrorStatus
)
243 static const DWORD supportedErrors
=
244 CERT_TRUST_IS_NOT_TIME_VALID
|
245 CERT_TRUST_IS_UNTRUSTED_ROOT
|
246 CERT_TRUST_IS_OFFLINE_REVOCATION
|
247 CERT_TRUST_REVOCATION_STATUS_UNKNOWN
|
248 CERT_TRUST_IS_REVOKED
|
249 CERT_TRUST_IS_NOT_VALID_FOR_USAGE
;
251 if (chain
->TrustStatus
.dwErrorStatus
& CERT_TRUST_IS_NOT_TIME_VALID
&&
252 !(security_flags
& SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
))
253 err
= ERROR_INTERNET_SEC_CERT_DATE_INVALID
;
254 else if (chain
->TrustStatus
.dwErrorStatus
&
255 CERT_TRUST_IS_UNTRUSTED_ROOT
&&
256 !(security_flags
& SECURITY_FLAG_IGNORE_UNKNOWN_CA
))
257 err
= ERROR_INTERNET_INVALID_CA
;
258 else if (!(security_flags
& SECURITY_FLAG_IGNORE_REVOCATION
) &&
259 ((chain
->TrustStatus
.dwErrorStatus
&
260 CERT_TRUST_IS_OFFLINE_REVOCATION
) ||
261 (chain
->TrustStatus
.dwErrorStatus
&
262 CERT_TRUST_REVOCATION_STATUS_UNKNOWN
)))
263 err
= ERROR_INTERNET_SEC_CERT_NO_REV
;
264 else if (!(security_flags
& SECURITY_FLAG_IGNORE_REVOCATION
) &&
265 (chain
->TrustStatus
.dwErrorStatus
& CERT_TRUST_IS_REVOKED
))
266 err
= ERROR_INTERNET_SEC_CERT_REVOKED
;
267 else if (!(security_flags
& SECURITY_FLAG_IGNORE_WRONG_USAGE
) &&
268 (chain
->TrustStatus
.dwErrorStatus
&
269 CERT_TRUST_IS_NOT_VALID_FOR_USAGE
))
270 err
= ERROR_INTERNET_SEC_INVALID_CERT
;
271 else if (chain
->TrustStatus
.dwErrorStatus
& ~supportedErrors
)
272 err
= ERROR_INTERNET_SEC_INVALID_CERT
;
276 CERT_CHAIN_POLICY_PARA policyPara
;
277 SSL_EXTRA_CERT_CHAIN_POLICY_PARA sslExtraPolicyPara
;
278 CERT_CHAIN_POLICY_STATUS policyStatus
;
279 CERT_CHAIN_CONTEXT chainCopy
;
281 /* Clear chain->TrustStatus.dwErrorStatus so
282 * CertVerifyCertificateChainPolicy will verify additional checks
283 * rather than stopping with an existing, ignored error.
285 memcpy(&chainCopy
, chain
, sizeof(chainCopy
));
286 chainCopy
.TrustStatus
.dwErrorStatus
= 0;
287 sslExtraPolicyPara
.u
.cbSize
= sizeof(sslExtraPolicyPara
);
288 sslExtraPolicyPara
.dwAuthType
= AUTHTYPE_SERVER
;
289 sslExtraPolicyPara
.pwszServerName
= server
;
290 sslExtraPolicyPara
.fdwChecks
= security_flags
;
291 policyPara
.cbSize
= sizeof(policyPara
);
292 policyPara
.dwFlags
= 0;
293 policyPara
.pvExtraPolicyPara
= &sslExtraPolicyPara
;
294 ret
= CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_SSL
,
295 &chainCopy
, &policyPara
, &policyStatus
);
296 /* Any error in the policy status indicates that the
297 * policy couldn't be verified.
299 if (ret
&& policyStatus
.dwError
)
301 if (policyStatus
.dwError
== CERT_E_CN_NO_MATCH
)
302 err
= ERROR_INTERNET_SEC_CERT_CN_INVALID
;
304 err
= ERROR_INTERNET_SEC_INVALID_CERT
;
307 CertFreeCertificateChain(chain
);
309 TRACE("returning %08x\n", err
);
313 static int netconn_secure_verify(int preverify_ok
, X509_STORE_CTX
*ctx
)
318 HCERTSTORE store
= CertOpenStore(CERT_STORE_PROV_MEMORY
, 0, 0,
319 CERT_STORE_CREATE_NEW_FLAG
, NULL
);
320 WININET_NETCONNECTION
*conn
;
322 ssl
= pX509_STORE_CTX_get_ex_data(ctx
,
323 pSSL_get_ex_data_X509_STORE_CTX_idx());
324 server
= pSSL_get_ex_data(ssl
, hostname_idx
);
325 conn
= pSSL_get_ex_data(ssl
, conn_idx
);
330 PCCERT_CONTEXT endCert
= NULL
;
333 for (i
= 0; ret
&& i
< psk_num((struct stack_st
*)ctx
->chain
); i
++)
335 PCCERT_CONTEXT context
;
337 cert
= (X509
*)psk_value((struct stack_st
*)ctx
->chain
, i
);
338 if ((context
= X509_to_cert_context(cert
)))
341 ret
= CertAddCertificateContextToStore(store
, context
,
342 CERT_STORE_ADD_ALWAYS
, &endCert
);
344 ret
= CertAddCertificateContextToStore(store
, context
,
345 CERT_STORE_ADD_ALWAYS
, NULL
);
346 CertFreeCertificateContext(context
);
349 if (!endCert
) ret
= FALSE
;
352 DWORD_PTR err
= netconn_verify_cert(endCert
, store
, server
,
353 conn
->security_flags
);
357 pSSL_set_ex_data(ssl
, error_idx
, (void *)err
);
361 CertFreeCertificateContext(endCert
);
362 CertCloseStore(store
, 0);
369 DWORD
NETCON_init(WININET_NETCONNECTION
*connection
, BOOL useSSL
)
371 connection
->useSSL
= useSSL
;
372 connection
->socketFD
= -1;
375 #if defined(SONAME_LIBSSL) && defined(SONAME_LIBCRYPTO)
378 TRACE("using SSL connection\n");
379 EnterCriticalSection(&init_ssl_cs
);
380 if (OpenSSL_ssl_handle
) /* already initialized everything */
382 LeaveCriticalSection(&init_ssl_cs
);
383 return ERROR_SUCCESS
;
385 OpenSSL_ssl_handle
= wine_dlopen(SONAME_LIBSSL
, RTLD_NOW
, NULL
, 0);
386 if (!OpenSSL_ssl_handle
)
388 ERR("trying to use a SSL connection, but couldn't load %s. Expect trouble.\n",
390 LeaveCriticalSection(&init_ssl_cs
);
391 return ERROR_INTERNET_SECURITY_CHANNEL_ERROR
;
393 OpenSSL_crypto_handle
= wine_dlopen(SONAME_LIBCRYPTO
, RTLD_NOW
, NULL
, 0);
394 if (!OpenSSL_crypto_handle
)
396 ERR("trying to use a SSL connection, but couldn't load %s. Expect trouble.\n",
398 LeaveCriticalSection(&init_ssl_cs
);
399 return ERROR_INTERNET_SECURITY_CHANNEL_ERROR
;
402 /* mmm nice ugly macroness */
404 p##x = wine_dlsym(OpenSSL_ssl_handle, #x, NULL, 0); \
407 ERR("failed to load symbol %s\n", #x); \
408 LeaveCriticalSection(&init_ssl_cs); \
409 return ERROR_INTERNET_SECURITY_CHANNEL_ERROR; \
412 DYNSSL(SSL_library_init
);
413 DYNSSL(SSL_load_error_strings
);
414 DYNSSL(SSLv23_method
);
415 DYNSSL(SSL_CTX_free
);
421 DYNSSL(SSL_shutdown
);
425 DYNSSL(SSL_get_error
);
426 DYNSSL(SSL_get_ex_new_index
);
427 DYNSSL(SSL_get_ex_data
);
428 DYNSSL(SSL_set_ex_data
);
429 DYNSSL(SSL_get_ex_data_X509_STORE_CTX_idx
);
430 DYNSSL(SSL_get_peer_certificate
);
431 DYNSSL(SSL_CTX_get_timeout
);
432 DYNSSL(SSL_CTX_set_timeout
);
433 DYNSSL(SSL_CTX_set_default_verify_paths
);
434 DYNSSL(SSL_CTX_set_verify
);
435 DYNSSL(SSL_get_current_cipher
);
436 DYNSSL(SSL_CIPHER_get_bits
);
439 #define DYNCRYPTO(x) \
440 p##x = wine_dlsym(OpenSSL_crypto_handle, #x, NULL, 0); \
443 ERR("failed to load symbol %s\n", #x); \
444 LeaveCriticalSection(&init_ssl_cs); \
445 return ERROR_INTERNET_SECURITY_CHANNEL_ERROR; \
447 DYNCRYPTO(BIO_new_fp
);
448 DYNCRYPTO(CRYPTO_num_locks
);
449 DYNCRYPTO(CRYPTO_set_id_callback
);
450 DYNCRYPTO(CRYPTO_set_locking_callback
);
451 DYNCRYPTO(ERR_free_strings
);
452 DYNCRYPTO(ERR_get_error
);
453 DYNCRYPTO(ERR_error_string
);
454 DYNCRYPTO(X509_STORE_CTX_get_ex_data
);
461 pSSL_load_error_strings();
462 pBIO_new_fp(stderr
, BIO_NOCLOSE
); /* FIXME: should use winedebug stuff */
464 meth
= pSSLv23_method();
465 ctx
= pSSL_CTX_new(meth
);
466 if (!pSSL_CTX_set_default_verify_paths(ctx
))
468 ERR("SSL_CTX_set_default_verify_paths failed: %s\n",
469 pERR_error_string(pERR_get_error(), 0));
470 LeaveCriticalSection(&init_ssl_cs
);
471 return ERROR_OUTOFMEMORY
;
473 hostname_idx
= pSSL_get_ex_new_index(0, (void *)"hostname index",
475 if (hostname_idx
== -1)
477 ERR("SSL_get_ex_new_index failed; %s\n",
478 pERR_error_string(pERR_get_error(), 0));
479 LeaveCriticalSection(&init_ssl_cs
);
480 return ERROR_OUTOFMEMORY
;
482 error_idx
= pSSL_get_ex_new_index(0, (void *)"error index",
486 ERR("SSL_get_ex_new_index failed; %s\n",
487 pERR_error_string(pERR_get_error(), 0));
488 LeaveCriticalSection(&init_ssl_cs
);
489 return ERROR_OUTOFMEMORY
;
491 conn_idx
= pSSL_get_ex_new_index(0, (void *)"netconn index",
495 ERR("SSL_get_ex_new_index failed; %s\n",
496 pERR_error_string(pERR_get_error(), 0));
497 LeaveCriticalSection(&init_ssl_cs
);
498 return ERROR_OUTOFMEMORY
;
500 pSSL_CTX_set_verify(ctx
, SSL_VERIFY_PEER
, netconn_secure_verify
);
502 pCRYPTO_set_id_callback(ssl_thread_id
);
503 num_ssl_locks
= pCRYPTO_num_locks();
504 ssl_locks
= HeapAlloc(GetProcessHeap(), 0, num_ssl_locks
* sizeof(CRITICAL_SECTION
));
507 LeaveCriticalSection(&init_ssl_cs
);
508 return ERROR_OUTOFMEMORY
;
510 for (i
= 0; i
< num_ssl_locks
; i
++)
511 InitializeCriticalSection(&ssl_locks
[i
]);
512 pCRYPTO_set_locking_callback(ssl_lock_callback
);
513 LeaveCriticalSection(&init_ssl_cs
);
515 FIXME("can't use SSL, not compiled in.\n");
516 return ERROR_INTERNET_SECURITY_CHANNEL_ERROR
;
519 return ERROR_SUCCESS
;
522 void NETCON_unload(void)
524 #if defined(SONAME_LIBSSL) && defined(SONAME_LIBCRYPTO)
525 if (OpenSSL_crypto_handle
)
528 wine_dlclose(OpenSSL_crypto_handle
, NULL
, 0);
530 if (OpenSSL_ssl_handle
)
534 wine_dlclose(OpenSSL_ssl_handle
, NULL
, 0);
539 for (i
= 0; i
< num_ssl_locks
; i
++) DeleteCriticalSection(&ssl_locks
[i
]);
540 HeapFree(GetProcessHeap(), 0, ssl_locks
);
545 BOOL
NETCON_connected(WININET_NETCONNECTION
*connection
)
547 return connection
->socketFD
!= -1;
550 /* translate a unix error code into a winsock one */
551 int sock_get_error( int err
)
553 #if !defined(__MINGW32__) && !defined (_MSC_VER)
556 case EINTR
: return WSAEINTR
;
557 case EBADF
: return WSAEBADF
;
559 case EACCES
: return WSAEACCES
;
560 case EFAULT
: return WSAEFAULT
;
561 case EINVAL
: return WSAEINVAL
;
562 case EMFILE
: return WSAEMFILE
;
563 case EWOULDBLOCK
: return WSAEWOULDBLOCK
;
564 case EINPROGRESS
: return WSAEINPROGRESS
;
565 case EALREADY
: return WSAEALREADY
;
566 case ENOTSOCK
: return WSAENOTSOCK
;
567 case EDESTADDRREQ
: return WSAEDESTADDRREQ
;
568 case EMSGSIZE
: return WSAEMSGSIZE
;
569 case EPROTOTYPE
: return WSAEPROTOTYPE
;
570 case ENOPROTOOPT
: return WSAENOPROTOOPT
;
571 case EPROTONOSUPPORT
: return WSAEPROTONOSUPPORT
;
572 case ESOCKTNOSUPPORT
: return WSAESOCKTNOSUPPORT
;
573 case EOPNOTSUPP
: return WSAEOPNOTSUPP
;
574 case EPFNOSUPPORT
: return WSAEPFNOSUPPORT
;
575 case EAFNOSUPPORT
: return WSAEAFNOSUPPORT
;
576 case EADDRINUSE
: return WSAEADDRINUSE
;
577 case EADDRNOTAVAIL
: return WSAEADDRNOTAVAIL
;
578 case ENETDOWN
: return WSAENETDOWN
;
579 case ENETUNREACH
: return WSAENETUNREACH
;
580 case ENETRESET
: return WSAENETRESET
;
581 case ECONNABORTED
: return WSAECONNABORTED
;
583 case ECONNRESET
: return WSAECONNRESET
;
584 case ENOBUFS
: return WSAENOBUFS
;
585 case EISCONN
: return WSAEISCONN
;
586 case ENOTCONN
: return WSAENOTCONN
;
587 case ESHUTDOWN
: return WSAESHUTDOWN
;
588 case ETOOMANYREFS
: return WSAETOOMANYREFS
;
589 case ETIMEDOUT
: return WSAETIMEDOUT
;
590 case ECONNREFUSED
: return WSAECONNREFUSED
;
591 case ELOOP
: return WSAELOOP
;
592 case ENAMETOOLONG
: return WSAENAMETOOLONG
;
593 case EHOSTDOWN
: return WSAEHOSTDOWN
;
594 case EHOSTUNREACH
: return WSAEHOSTUNREACH
;
595 case ENOTEMPTY
: return WSAENOTEMPTY
;
597 case EPROCLIM
: return WSAEPROCLIM
;
600 case EUSERS
: return WSAEUSERS
;
603 case EDQUOT
: return WSAEDQUOT
;
606 case ESTALE
: return WSAESTALE
;
609 case EREMOTE
: return WSAEREMOTE
;
611 default: errno
=err
; perror("sock_set_error"); return WSAEFAULT
;
617 /******************************************************************************
619 * Basically calls 'socket()'
621 DWORD
NETCON_create(WININET_NETCONNECTION
*connection
, int domain
,
622 int type
, int protocol
)
625 if (connection
->ssl_s
)
626 return ERROR_NOT_SUPPORTED
;
629 connection
->socketFD
= socket(domain
, type
, protocol
);
630 if (connection
->socketFD
== -1)
631 return sock_get_error(errno
);
633 return ERROR_SUCCESS
;
636 /******************************************************************************
638 * Basically calls 'close()' unless we should use SSL
640 DWORD
NETCON_close(WININET_NETCONNECTION
*connection
)
644 if (!NETCON_connected(connection
)) return ERROR_SUCCESS
;
647 if (connection
->ssl_s
)
649 pSSL_shutdown(connection
->ssl_s
);
650 pSSL_free(connection
->ssl_s
);
651 connection
->ssl_s
= NULL
;
655 result
= closesocket(connection
->socketFD
);
656 connection
->socketFD
= -1;
659 return sock_get_error(errno
);
660 return ERROR_SUCCESS
;
663 /******************************************************************************
664 * NETCON_secure_connect
665 * Initiates a secure connection over an existing plaintext connection.
667 DWORD
NETCON_secure_connect(WININET_NETCONNECTION
*connection
, LPWSTR hostname
)
670 DWORD res
= ERROR_NOT_SUPPORTED
;
673 /* can't connect if we are already connected */
674 if (connection
->ssl_s
)
676 ERR("already connected\n");
677 return ERROR_INTERNET_CANNOT_CONNECT
;
680 ssl_s
= pSSL_new(ctx
);
683 ERR("SSL_new failed: %s\n",
684 pERR_error_string(pERR_get_error(), 0));
685 return ERROR_OUTOFMEMORY
;
688 if (!pSSL_set_fd(ssl_s
, connection
->socketFD
))
690 ERR("SSL_set_fd failed: %s\n",
691 pERR_error_string(pERR_get_error(), 0));
692 res
= ERROR_INTERNET_SECURITY_CHANNEL_ERROR
;
696 if (!pSSL_set_ex_data(ssl_s
, hostname_idx
, hostname
))
698 ERR("SSL_set_ex_data failed: %s\n",
699 pERR_error_string(pERR_get_error(), 0));
700 res
= ERROR_INTERNET_SECURITY_CHANNEL_ERROR
;
703 if (!pSSL_set_ex_data(ssl_s
, conn_idx
, connection
))
705 ERR("SSL_set_ex_data failed: %s\n",
706 pERR_error_string(pERR_get_error(), 0));
707 res
= ERROR_INTERNET_SECURITY_CHANNEL_ERROR
;
710 if (pSSL_connect(ssl_s
) <= 0)
712 res
= (DWORD_PTR
)pSSL_get_ex_data(ssl_s
, error_idx
);
714 res
= ERROR_INTERNET_SECURITY_CHANNEL_ERROR
;
715 ERR("SSL_connect failed: %d\n", res
);
719 connection
->ssl_s
= ssl_s
;
720 return ERROR_SUCCESS
;
725 pSSL_shutdown(ssl_s
);
732 /******************************************************************************
734 * Connects to the specified address.
736 DWORD
NETCON_connect(WININET_NETCONNECTION
*connection
, const struct sockaddr
*serv_addr
,
737 unsigned int addrlen
)
741 result
= connect(connection
->socketFD
, serv_addr
, addrlen
);
744 WARN("Unable to connect to host (%s)\n", strerror(errno
));
746 closesocket(connection
->socketFD
);
747 connection
->socketFD
= -1;
748 return sock_get_error(errno
);
751 return ERROR_SUCCESS
;
754 /******************************************************************************
756 * Basically calls 'send()' unless we should use SSL
757 * number of chars send is put in *sent
759 DWORD
NETCON_send(WININET_NETCONNECTION
*connection
, const void *msg
, size_t len
, int flags
,
762 if (!NETCON_connected(connection
)) return ERROR_INTERNET_CONNECTION_ABORTED
;
763 if (!connection
->useSSL
)
765 *sent
= send(connection
->socketFD
, msg
, len
, flags
);
767 return sock_get_error(errno
);
768 return ERROR_SUCCESS
;
773 if(!connection
->ssl_s
) {
774 FIXME("not connected\n");
775 return ERROR_NOT_SUPPORTED
;
778 FIXME("SSL_write doesn't support any flags (%08x)\n", flags
);
779 *sent
= pSSL_write(connection
->ssl_s
, msg
, len
);
780 if (*sent
< 1 && len
)
781 return ERROR_INTERNET_CONNECTION_ABORTED
;
782 return ERROR_SUCCESS
;
784 return ERROR_NOT_SUPPORTED
;
789 /******************************************************************************
791 * Basically calls 'recv()' unless we should use SSL
792 * number of chars received is put in *recvd
794 DWORD
NETCON_recv(WININET_NETCONNECTION
*connection
, void *buf
, size_t len
, int flags
,
795 int *recvd
/* out */)
798 if (!NETCON_connected(connection
)) return ERROR_INTERNET_CONNECTION_ABORTED
;
800 return ERROR_SUCCESS
;
801 if (!connection
->useSSL
)
803 *recvd
= recv(connection
->socketFD
, buf
, len
, flags
);
805 NETCON_close(connection
);
806 return *recvd
== -1 ? sock_get_error(errno
) : ERROR_SUCCESS
;
811 if(!connection
->ssl_s
) {
812 FIXME("not connected\n");
813 return ERROR_NOT_SUPPORTED
;
815 *recvd
= pSSL_read(connection
->ssl_s
, buf
, len
);
817 /* Check if EOF was received */
818 if(!*recvd
&& (pSSL_get_error(connection
->ssl_s
, *recvd
)==SSL_ERROR_ZERO_RETURN
819 || pSSL_get_error(connection
->ssl_s
, *recvd
)==SSL_ERROR_SYSCALL
)) {
820 NETCON_close(connection
);
821 return ERROR_SUCCESS
;
824 return *recvd
> 0 ? ERROR_SUCCESS
: ERROR_INTERNET_CONNECTION_ABORTED
;
826 return ERROR_NOT_SUPPORTED
;
831 /******************************************************************************
832 * NETCON_query_data_available
833 * Returns the number of bytes of peeked data plus the number of bytes of
834 * queued, but unread data.
836 BOOL
NETCON_query_data_available(WININET_NETCONNECTION
*connection
, DWORD
*available
)
839 if (!NETCON_connected(connection
))
842 if (!connection
->useSSL
)
846 int retval
= ioctlsocket(connection
->socketFD
, FIONREAD
, &unread
);
849 TRACE("%d bytes of queued, but unread data\n", unread
);
850 *available
+= unread
;
857 *available
= connection
->ssl_s
? pSSL_pending(connection
->ssl_s
) : 0;
863 LPCVOID
NETCON_GetCert(WININET_NETCONNECTION
*connection
)
869 if (!connection
->ssl_s
)
872 cert
= pSSL_get_peer_certificate(connection
->ssl_s
);
873 r
= X509_to_cert_context(cert
);
880 int NETCON_GetCipherStrength(WININET_NETCONNECTION
*connection
)
883 #if defined(OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x0090707f)
884 const SSL_CIPHER
*cipher
;
890 if (!connection
->ssl_s
)
892 cipher
= pSSL_get_current_cipher(connection
->ssl_s
);
895 pSSL_CIPHER_get_bits(cipher
, &bits
);
902 DWORD
NETCON_set_timeout(WININET_NETCONNECTION
*connection
, BOOL send
, int value
)
907 /* FIXME: we should probably store the timeout in the connection to set
908 * when we do connect */
909 if (!NETCON_connected(connection
))
910 return ERROR_SUCCESS
;
912 /* value is in milliseconds, convert to struct timeval */
913 tv
.tv_sec
= value
/ 1000;
914 tv
.tv_usec
= (value
% 1000) * 1000;
916 result
= setsockopt(connection
->socketFD
, SOL_SOCKET
,
917 send
? SO_SNDTIMEO
: SO_RCVTIMEO
, (void*)&tv
,
922 WARN("setsockopt failed (%s)\n", strerror(errno
));
923 return sock_get_error(errno
);
926 return ERROR_SUCCESS
;