Rename method_tls_tunnel to method_tls and move upstream

CRL checking was also moved upstream as method_tls triggers it.

Signed-off-by: Simon Rozman <simon@rozman.si>

lib/TLS/include/Method.h

@@ -21,12 +21,18 @@
 namespace eap
 {
     class method_defrag;
+    class method_tls;
 }
 
 #pragma once
 
+#include "Config.h"
+#include "Credentials.h"
+
 #include "../../EAPBase/include/Method.h"
 
+#include <WinStd/Sec.h>
+
 
 namespace eap
 {
@@ -111,5 +117,90 @@ namespace eap
         } m_phase;                  ///< What phase is our communication at?
     };
 
+
+    ///
+    /// EAP-TLS method
+    ///
+    class method_tls : public method
+    {
+    public:
+        ///
+        /// Constructs an EAP-TLS method
+        ///
+        /// \param[in] mod    EAP module to use for global services
+        /// \param[in] cfg    Method configuration
+        /// \param[in] cred   User credentials
+        /// \param[in] inner  Inner method
+        ///
+        method_tls(_In_ module &mod, _In_ config_method_tls &cfg, _In_ credentials_tls &cred, _In_opt_ method *inner = nullptr);
+
+        /// \name Session management
+        /// @{
+
+        virtual void begin_session(
+            _In_        DWORD         dwFlags,
+            _In_  const EapAttributes *pAttributeArray,
+            _In_        HANDLE        hTokenImpersonateUser,
+            _In_opt_    DWORD         dwMaxSendPacketSize = MAXDWORD);
+
+        /// @}
+
+        /// \name Packet processing
+        /// @{
+
+        virtual EapPeerMethodResponseAction process_request_packet(
+            _In_bytecount_(dwReceivedPacketSize) const void  *pReceivedPacket,
+            _In_                                       DWORD dwReceivedPacketSize);
+
+        virtual void get_response_packet(
+            _Out_    sanitizing_blob &packet,
+            _In_opt_ DWORD           size_max = MAXDWORD);
+
+        /// @}
+
+        virtual void get_result(
+            _In_    EapPeerMethodResultReason reason,
+            _Inout_ EapPeerMethodResult       *pResult);
+
+    protected:
+        ///
+        /// Decrypts data and forwards it to the inner method.
+        ///
+        EapPeerMethodResponseAction decrypt_request_data();
+
+#if EAP_TLS < EAP_TLS_SCHANNEL_FULL
+        ///
+        /// Verifies server certificate if trusted by configuration
+        ///
+        void verify_server_trust() const;
+#endif
+
+    protected:
+        config_method_tls &m_cfg;                   ///< Method configuration
+        credentials_tls &m_cred;                    ///< Method user credentials
+        HANDLE m_user_ctx;                          ///< Handle to user context
+        winstd::tstring m_sc_target_name;           ///< Schannel target name
+        winstd::sec_credentials m_sc_cred;          ///< Schannel client credentials
+        std::vector<unsigned char> m_sc_queue;      ///< TLS data queue
+        winstd::sec_context m_sc_ctx;               ///< Schannel context
+        winstd::cert_context m_sc_cert;             ///< Server certificate
+
+        ///
+        /// Communication phase
+        ///
+        enum class phase_t {
+            unknown = -1,                           ///< Unknown phase
+            handshake_init = 0,                     ///< Handshake initialize
+            handshake_cont,                         ///< Handshake continue
+            finished,                               ///< Exchange application data
+        } m_phase;                                  ///< What phase is our communication at?
+
+        sanitizing_blob m_packet_res;               ///< Response packet
+        bool m_packet_res_inner;                    ///< Get and encrypt data from inner method too?
+
+        std::vector<winstd::eap_attr> m_eap_attr;   ///< EAP attributes returned by get_result() method
+        EAP_ATTRIBUTES m_eap_attr_desc;             ///< EAP attributes descriptor (required to avoid memory leakage in get_result())
+    };
+
     /// @}
 }