Compare commits
7 Commits
1.0-alpha1
...
1.0-alpha1
| Author | SHA1 | Date | |
|---|---|---|---|
| e4c3f5cbd8 | |||
| 1df98af5a1 | |||
| 3cbd749966 | |||
| 2125679385 | |||
| fb5d969c2b | |||
| f39cb94ee5 | |||
| 59768e8097 |
@@ -32,7 +32,7 @@
|
||||
<ItemDefinitionGroup>
|
||||
<ClCompile>
|
||||
<WarningLevel>Level4</WarningLevel>
|
||||
<PreprocessorDefinitions>_WIN32_WINNT=0x0600;ISOLATION_AWARE_ENABLED=1;SECURITY_WIN32;CERT_CHAIN_PARA_HAS_EXTRA_FIELDS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<PreprocessorDefinitions>_WIN32_WINNT=0x0600;ISOLATION_AWARE_ENABLED=1;CERT_CHAIN_PARA_HAS_EXTRA_FIELDS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>StdAfx.h</PrecompiledHeaderFile>
|
||||
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
|
||||
|
||||
@@ -45,7 +45,7 @@
|
||||
//
|
||||
// Human readable product version and build year for UI
|
||||
//
|
||||
#define PRODUCT_VERSION_STR "1.0-alpha10"
|
||||
#define PRODUCT_VERSION_STR "1.0-alpha10-owntls"
|
||||
#define PRODUCT_BUILD_YEAR_STR "2016"
|
||||
|
||||
//
|
||||
@@ -58,7 +58,7 @@
|
||||
// The product code for ProductCode property in MSI packages
|
||||
// Replace with new on every version change, regardless how minor it is.
|
||||
//
|
||||
#define PRODUCT_VERSION_GUID "{2A743CF3-8AAE-416B-B779-2EC1F509121D}"
|
||||
#define PRODUCT_VERSION_GUID "{C3675615-0D70-47C7-9BCB-B683A77C6ED6}"
|
||||
|
||||
//
|
||||
// Since the product name is not finally confirmed at the time of
|
||||
|
||||
@@ -102,12 +102,6 @@ EAP_ERROR* eap::module::make_error(_In_ std::exception &err) const
|
||||
return make_error(HRESULT_CODE(e.number()), what.c_str());
|
||||
}
|
||||
|
||||
{
|
||||
sec_runtime_error &e(dynamic_cast<sec_runtime_error&>(err));
|
||||
if (&e)
|
||||
return make_error(HRESULT_CODE(e.number()), what.c_str());
|
||||
}
|
||||
|
||||
{
|
||||
invalid_argument &e(dynamic_cast<invalid_argument&>(err));
|
||||
if (&e)
|
||||
|
||||
@@ -30,6 +30,5 @@
|
||||
|
||||
#include <WinStd/Cred.h>
|
||||
#include <WinStd/ETW.h>
|
||||
#include <WinStd/Sec.h>
|
||||
|
||||
#include <EventsETW.h>
|
||||
|
||||
@@ -1,172 +1,176 @@
|
||||
/*
|
||||
Copyright 2015-2016 Amebis
|
||||
Copyright 2016 GÉANT
|
||||
|
||||
This file is part of GÉANTLink.
|
||||
|
||||
GÉANTLink is free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
GÉANTLink is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with GÉANTLink. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include <WinStd/Common.h>
|
||||
|
||||
#include <Windows.h>
|
||||
#include <WinCrypt.h> // Must include after <Windows.h>
|
||||
|
||||
#include <sal.h>
|
||||
|
||||
namespace eap
|
||||
{
|
||||
///
|
||||
/// TLS configuration
|
||||
///
|
||||
class config_method_tls;
|
||||
|
||||
///
|
||||
/// Helper function to compile human-readable certificate name for UI display
|
||||
///
|
||||
winstd::tstring get_cert_title(PCCERT_CONTEXT cert);
|
||||
}
|
||||
|
||||
#pragma once
|
||||
|
||||
#include "Credentials.h"
|
||||
#include "Method.h"
|
||||
#include "TLS.h"
|
||||
|
||||
#include "../../EAPBase/include/Config.h"
|
||||
|
||||
#include <WinStd/Crypt.h>
|
||||
|
||||
#include <Windows.h>
|
||||
|
||||
#include <list>
|
||||
#include <string>
|
||||
|
||||
|
||||
namespace eap
|
||||
{
|
||||
class config_method_tls : public config_method_with_cred
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs configuration
|
||||
///
|
||||
/// \param[in] mod EAP module to use for global services
|
||||
///
|
||||
config_method_tls(_In_ module &mod);
|
||||
|
||||
///
|
||||
/// Copies configuration
|
||||
///
|
||||
/// \param[in] other Configuration to copy from
|
||||
///
|
||||
config_method_tls(_In_ const config_method_tls &other);
|
||||
|
||||
///
|
||||
/// Moves configuration
|
||||
///
|
||||
/// \param[in] other Configuration to move from
|
||||
///
|
||||
config_method_tls(_Inout_ config_method_tls &&other);
|
||||
|
||||
///
|
||||
/// Copies configuration
|
||||
///
|
||||
/// \param[in] other Configuration to copy from
|
||||
///
|
||||
/// \returns Reference to this object
|
||||
///
|
||||
config_method_tls& operator=(_In_ const config_method_tls &other);
|
||||
|
||||
///
|
||||
/// Moves configuration
|
||||
///
|
||||
/// \param[in] other Configuration to move from
|
||||
///
|
||||
/// \returns Reference to this object
|
||||
///
|
||||
config_method_tls& operator=(_Inout_ config_method_tls &&other);
|
||||
|
||||
///
|
||||
/// Clones configuration
|
||||
///
|
||||
/// \returns Pointer to cloned configuration
|
||||
///
|
||||
virtual config* clone() const;
|
||||
|
||||
/// \name XML configuration management
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Save to XML document
|
||||
///
|
||||
/// \param[in] pDoc XML document
|
||||
/// \param[in] pConfigRoot Suggested root element for saving
|
||||
///
|
||||
virtual void save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const;
|
||||
|
||||
///
|
||||
/// Load from XML document
|
||||
///
|
||||
/// \param[in] pConfigRoot Root element for loading
|
||||
///
|
||||
virtual void load(_In_ IXMLDOMNode *pConfigRoot);
|
||||
|
||||
/// @}
|
||||
|
||||
/// \name BLOB management
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Packs a configuration
|
||||
///
|
||||
/// \param[inout] cursor Memory cursor
|
||||
///
|
||||
virtual void operator<<(_Inout_ cursor_out &cursor) const;
|
||||
|
||||
///
|
||||
/// Returns packed size of a configuration
|
||||
///
|
||||
/// \returns Size of data when packed (in bytes)
|
||||
///
|
||||
virtual size_t get_pk_size() const;
|
||||
|
||||
///
|
||||
/// Unpacks a configuration
|
||||
///
|
||||
/// \param[inout] cursor Memory cursor
|
||||
///
|
||||
virtual void operator>>(_Inout_ cursor_in &cursor);
|
||||
|
||||
/// @}
|
||||
|
||||
///
|
||||
/// Returns EAP method type of this configuration
|
||||
///
|
||||
/// \returns `eap::type_tls`
|
||||
///
|
||||
virtual winstd::eap_type_t get_method_id() const;
|
||||
|
||||
///
|
||||
/// Adds CA to the list of trusted root CA's
|
||||
///
|
||||
/// \sa [CertCreateCertificateContext function](https://msdn.microsoft.com/en-us/library/windows/desktop/aa376033.aspx)
|
||||
///
|
||||
bool add_trusted_ca(_In_ DWORD dwCertEncodingType, _In_ const BYTE *pbCertEncoded, _In_ DWORD cbCertEncoded);
|
||||
|
||||
public:
|
||||
std::list<winstd::cert_context> m_trusted_root_ca; ///< Trusted root CAs
|
||||
std::list<std::wstring> m_server_names; ///< Acceptable authenticating server names
|
||||
};
|
||||
}
|
||||
/*
|
||||
Copyright 2015-2016 Amebis
|
||||
Copyright 2016 GÉANT
|
||||
|
||||
This file is part of GÉANTLink.
|
||||
|
||||
GÉANTLink is free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
GÉANTLink is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with GÉANTLink. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include <WinStd/Common.h>
|
||||
|
||||
#include <Windows.h>
|
||||
#include <WinCrypt.h> // Must include after <Windows.h>
|
||||
|
||||
#include <sal.h>
|
||||
|
||||
namespace eap
|
||||
{
|
||||
///
|
||||
/// TLS configuration
|
||||
///
|
||||
class config_method_tls;
|
||||
|
||||
///
|
||||
/// Helper function to compile human-readable certificate name for UI display
|
||||
///
|
||||
winstd::tstring get_cert_title(PCCERT_CONTEXT cert);
|
||||
}
|
||||
|
||||
#pragma once
|
||||
|
||||
#include "Credentials.h"
|
||||
#include "Method.h"
|
||||
#include "TLS.h"
|
||||
|
||||
#include "../../EAPBase/include/Config.h"
|
||||
|
||||
#include <WinStd/Crypt.h>
|
||||
|
||||
#include <Windows.h>
|
||||
|
||||
#include <list>
|
||||
#include <string>
|
||||
|
||||
|
||||
namespace eap
|
||||
{
|
||||
class config_method_tls : public config_method_with_cred
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs configuration
|
||||
///
|
||||
/// \param[in] mod EAP module to use for global services
|
||||
///
|
||||
config_method_tls(_In_ module &mod);
|
||||
|
||||
///
|
||||
/// Copies configuration
|
||||
///
|
||||
/// \param[in] other Configuration to copy from
|
||||
///
|
||||
config_method_tls(_In_ const config_method_tls &other);
|
||||
|
||||
///
|
||||
/// Moves configuration
|
||||
///
|
||||
/// \param[in] other Configuration to move from
|
||||
///
|
||||
config_method_tls(_Inout_ config_method_tls &&other);
|
||||
|
||||
///
|
||||
/// Copies configuration
|
||||
///
|
||||
/// \param[in] other Configuration to copy from
|
||||
///
|
||||
/// \returns Reference to this object
|
||||
///
|
||||
config_method_tls& operator=(_In_ const config_method_tls &other);
|
||||
|
||||
///
|
||||
/// Moves configuration
|
||||
///
|
||||
/// \param[in] other Configuration to move from
|
||||
///
|
||||
/// \returns Reference to this object
|
||||
///
|
||||
config_method_tls& operator=(_Inout_ config_method_tls &&other);
|
||||
|
||||
///
|
||||
/// Clones configuration
|
||||
///
|
||||
/// \returns Pointer to cloned configuration
|
||||
///
|
||||
virtual config* clone() const;
|
||||
|
||||
/// \name XML configuration management
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Save to XML document
|
||||
///
|
||||
/// \param[in] pDoc XML document
|
||||
/// \param[in] pConfigRoot Suggested root element for saving
|
||||
///
|
||||
virtual void save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const;
|
||||
|
||||
///
|
||||
/// Load from XML document
|
||||
///
|
||||
/// \param[in] pConfigRoot Root element for loading
|
||||
///
|
||||
virtual void load(_In_ IXMLDOMNode *pConfigRoot);
|
||||
|
||||
/// @}
|
||||
|
||||
/// \name BLOB management
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Packs a configuration
|
||||
///
|
||||
/// \param[inout] cursor Memory cursor
|
||||
///
|
||||
virtual void operator<<(_Inout_ cursor_out &cursor) const;
|
||||
|
||||
///
|
||||
/// Returns packed size of a configuration
|
||||
///
|
||||
/// \returns Size of data when packed (in bytes)
|
||||
///
|
||||
virtual size_t get_pk_size() const;
|
||||
|
||||
///
|
||||
/// Unpacks a configuration
|
||||
///
|
||||
/// \param[inout] cursor Memory cursor
|
||||
///
|
||||
virtual void operator>>(_Inout_ cursor_in &cursor);
|
||||
|
||||
/// @}
|
||||
|
||||
///
|
||||
/// Returns EAP method type of this configuration
|
||||
///
|
||||
/// \returns `eap::type_tls`
|
||||
///
|
||||
virtual winstd::eap_type_t get_method_id() const;
|
||||
|
||||
///
|
||||
/// Adds CA to the list of trusted root CA's
|
||||
///
|
||||
/// \sa [CertCreateCertificateContext function](https://msdn.microsoft.com/en-us/library/windows/desktop/aa376033.aspx)
|
||||
///
|
||||
bool add_trusted_ca(_In_ DWORD dwCertEncodingType, _In_ const BYTE *pbCertEncoded, _In_ DWORD cbCertEncoded);
|
||||
|
||||
public:
|
||||
std::list<winstd::cert_context> m_trusted_root_ca; ///< Trusted root CAs
|
||||
std::list<std::wstring> m_server_names; ///< Acceptable authenticating server names
|
||||
|
||||
// Following members are used for session resumptions. They are not exported/imported to XML.
|
||||
sanitizing_blob m_session_id; ///< TLS session ID
|
||||
tls_master_secret m_master_secret; ///< TLS master secret
|
||||
};
|
||||
}
|
||||
|
||||
@@ -36,7 +36,6 @@ namespace eap
|
||||
#include "../../EAPBase/include/Method.h"
|
||||
|
||||
#include <WinStd/Crypt.h>
|
||||
#include <WinStd/Sec.h>
|
||||
|
||||
#include <list>
|
||||
#include <vector>
|
||||
@@ -128,6 +127,19 @@ namespace eap
|
||||
std::vector<unsigned char> m_data; ///< Packet data
|
||||
};
|
||||
|
||||
#pragma pack(push)
|
||||
#pragma pack(1)
|
||||
///
|
||||
/// TLS message
|
||||
///
|
||||
struct message_header
|
||||
{
|
||||
tls_message_type_t type; ///< Message type (one of `message_type_t` constants)
|
||||
tls_version version; ///< SSL/TLS version
|
||||
unsigned char length[2]; ///< Message length (in network byte order)
|
||||
};
|
||||
#pragma pack(pop)
|
||||
|
||||
public:
|
||||
///
|
||||
/// Constructs an EAP method
|
||||
@@ -204,30 +216,271 @@ namespace eap
|
||||
/// @}
|
||||
|
||||
protected:
|
||||
///
|
||||
/// Process handshake
|
||||
///
|
||||
void process_handshake();
|
||||
/// \name Client handshake message generation
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Process application data
|
||||
/// Makes a TLS client hello message
|
||||
///
|
||||
void process_application_data();
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 7.4.1.2. Client Hello)](https://tools.ietf.org/html/rfc5246#section-7.4.1.2)
|
||||
///
|
||||
/// \returns Client hello message
|
||||
///
|
||||
sanitizing_blob make_client_hello();
|
||||
|
||||
///
|
||||
/// Processes an application message
|
||||
/// Makes a TLS client certificate message
|
||||
///
|
||||
/// \param[in] msg Application message data
|
||||
/// \param[in] size_msg Application message data size
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 7.4.6. Client Certificate)](https://tools.ietf.org/html/rfc5246#section-7.4.6)
|
||||
///
|
||||
virtual void process_application_data(_In_bytecount_(size_msg) const void *msg, _In_ size_t size_msg);
|
||||
/// \returns Client certificate message
|
||||
///
|
||||
sanitizing_blob make_client_cert() const;
|
||||
|
||||
///
|
||||
/// Makes a TLS client key exchange message
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 7.4.7. Client Key Exchange Message )](https://tools.ietf.org/html/rfc5246#section-7.4.7)
|
||||
///
|
||||
/// \param[in] pms Pre-master secret
|
||||
///
|
||||
/// \returns Client key exchange message
|
||||
///
|
||||
sanitizing_blob make_client_key_exchange(_In_ const tls_master_secret &pms) const;
|
||||
|
||||
///
|
||||
/// Makes a TLS finished message
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter A.1. Record Layer)](https://tools.ietf.org/html/rfc5246#appendix-A.1)
|
||||
///
|
||||
/// \returns Change cipher spec
|
||||
///
|
||||
eap::sanitizing_blob make_finished() const;
|
||||
|
||||
/// @}
|
||||
|
||||
/// \name Client/Server handshake hashing
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Hashes handshake message for "finished" message validation.
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 7.4.9. Finished)](https://tools.ietf.org/html/rfc5246#section-7.4.9)
|
||||
///
|
||||
/// \param[in] data Data to hash
|
||||
/// \param[in] size \p data size in bytes
|
||||
///
|
||||
inline void hash_handshake(_In_count_(size) const void *data, _In_ size_t size)
|
||||
{
|
||||
CryptHashData(m_hash_handshake_msgs_md5 , (const BYTE*)data, (DWORD)size, 0);
|
||||
CryptHashData(m_hash_handshake_msgs_sha1 , (const BYTE*)data, (DWORD)size, 0);
|
||||
CryptHashData(m_hash_handshake_msgs_sha256, (const BYTE*)data, (DWORD)size, 0);
|
||||
}
|
||||
|
||||
///
|
||||
/// Hashes handshake message for "finished" message validation.
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 7.4.9. Finished)](https://tools.ietf.org/html/rfc5246#section-7.4.9)
|
||||
///
|
||||
/// \param[in] data Data to hash
|
||||
/// \param[in] size \p data size in bytes
|
||||
///
|
||||
template<class _Ty, class _Ax>
|
||||
inline void hash_handshake(_In_ const std::vector<_Ty, _Ax> &data)
|
||||
{
|
||||
hash_handshake(data.data(), data.size() * sizeof(_Ty));
|
||||
}
|
||||
|
||||
/// @}
|
||||
|
||||
///
|
||||
/// Makes a TLS message
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter A.1. Record Layer)](https://tools.ietf.org/html/rfc5246#appendix-A.1)
|
||||
///
|
||||
/// \param[in] type Message type
|
||||
/// \param[inout] data Message data contents
|
||||
///
|
||||
/// \returns TLS message message
|
||||
///
|
||||
eap::sanitizing_blob make_message(_In_ tls_message_type_t type, _Inout_ sanitizing_blob &&data);
|
||||
|
||||
/// @}
|
||||
|
||||
/// \name Key derivation
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Generates master session key
|
||||
///
|
||||
/// \sa [The EAP-TLS Authentication Protocol (Chapter 2.3. Key Hierarchy)](https://tools.ietf.org/html/rfc5216#section-2.3)
|
||||
///
|
||||
virtual void derive_msk();
|
||||
|
||||
/// @}
|
||||
|
||||
/// \name Server message processing
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Processes messages in a TLS packet
|
||||
///
|
||||
/// \param[in] pck Packet data
|
||||
/// \param[in] size_pck \p pck size in bytes
|
||||
///
|
||||
void process_packet(_In_bytecount_(size_pck) const void *pck, _In_ size_t size_pck);
|
||||
|
||||
///
|
||||
/// Processes a TLS change_cipher_spec message
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 7.1. Change Cipher Spec Protocol)](https://tools.ietf.org/html/rfc5246#section-7.1)
|
||||
///
|
||||
/// \param[in] msg TLS change_cipher_spec message data
|
||||
/// \param[in] msg_size TLS change_cipher_spec message data size
|
||||
///
|
||||
virtual void process_change_cipher_spec(_In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size);
|
||||
|
||||
///
|
||||
/// Processes a TLS alert message
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 7.2. Alert Protocol)](https://tools.ietf.org/html/rfc5246#section-7.2)
|
||||
///
|
||||
/// \param[in] msg TLS alert message data
|
||||
/// \param[in] msg_size TLS alert message data size
|
||||
///
|
||||
virtual void process_alert(_In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size);
|
||||
|
||||
///
|
||||
/// Processes a TLS handshake message
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 7.4. Handshake Protocol)](https://tools.ietf.org/html/rfc5246#section-7.4)
|
||||
///
|
||||
/// \param[in] msg TLS handshake message data
|
||||
/// \param[in] msg_size TLS handshake message data size
|
||||
///
|
||||
virtual void process_handshake(_In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size);
|
||||
|
||||
///
|
||||
/// Processes a TLS application_data message
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 10. Application Data Protocol)](https://tools.ietf.org/html/rfc5246#section-10)
|
||||
///
|
||||
/// \param[in] msg TLS application_data message data
|
||||
/// \param[in] msg_size TLS application_data message data size
|
||||
///
|
||||
virtual void process_application_data(_In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size);
|
||||
|
||||
/////
|
||||
///// Processes a vendor-specific TLS message
|
||||
/////
|
||||
///// \note Please see `m_cipher_spec` member if the message data came encrypted.
|
||||
/////
|
||||
///// \param[in] type TLS message type
|
||||
///// \param[in] msg TLS message data
|
||||
///// \param[in] msg_size TLS message data size
|
||||
/////
|
||||
//virtual void process_vendor_data(_In_ tls_message_type_t type, _In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size);
|
||||
|
||||
/// @}
|
||||
|
||||
#ifndef SCHANNEL_SRV_CERT_CHECK
|
||||
///
|
||||
/// Verifies server's certificate if trusted by configuration
|
||||
///
|
||||
void verify_server_trust() const;
|
||||
#endif
|
||||
|
||||
/// \name Encryption
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Encrypt TLS message
|
||||
///
|
||||
/// \param[in] type Message type
|
||||
/// \param[inout] data TLS message to encrypt
|
||||
///
|
||||
void encrypt_message(_In_ tls_message_type_t type, _Inout_ sanitizing_blob &data);
|
||||
|
||||
///
|
||||
/// Decrypt TLS message
|
||||
///
|
||||
/// \param[in] type Original message type for HMAC verification
|
||||
/// \param[inout] data TLS message to decrypt
|
||||
///
|
||||
void decrypt_message(_In_ tls_message_type_t type, _Inout_ sanitizing_blob &data);
|
||||
|
||||
/// @}
|
||||
|
||||
/// \name Pseudo-random generation
|
||||
/// @{
|
||||
|
||||
///
|
||||
/// Calculates pseudo-random P_hash data defined in RFC 5246
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.1 (Chapter 5. HMAC and the Pseudorandom Function)](https://tools.ietf.org/html/rfc4346#section-5)
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 5. HMAC and the Pseudorandom Function)](https://tools.ietf.org/html/rfc5246#section-5)
|
||||
///
|
||||
/// \param[in] cp Handle of the cryptographics provider
|
||||
/// \param[in] alg Hashing Algorithm to use (CALG_TLS1PRF = combination of MD5 and SHA-1, CALG_SHA_256...)
|
||||
/// \param[in] secret Hashing secret key
|
||||
/// \param[in] seed Random seed
|
||||
/// \param[in] size_seed \p seed size
|
||||
/// \param[in] size Number of bytes of pseudo-random data required
|
||||
///
|
||||
/// \returns Generated pseudo-random data (\p size bytes)
|
||||
///
|
||||
static sanitizing_blob prf(
|
||||
_In_ HCRYPTPROV cp,
|
||||
_In_ ALG_ID alg,
|
||||
_In_ const tls_master_secret &secret,
|
||||
_In_bytecount_(size_seed) const void *seed,
|
||||
_In_ size_t size_seed,
|
||||
_In_ size_t size);
|
||||
|
||||
///
|
||||
/// Calculates pseudo-random P_hash data defined in RFC 5246
|
||||
///
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.1 (Chapter 5. HMAC and the Pseudorandom Function)](https://tools.ietf.org/html/rfc4346#section-5)
|
||||
/// \sa [The Transport Layer Security (TLS) Protocol Version 1.2 (Chapter 5. HMAC and the Pseudorandom Function)](https://tools.ietf.org/html/rfc5246#section-5)
|
||||
///
|
||||
/// \param[in] cp Handle of the cryptographics provider
|
||||
/// \param[in] alg Hashing Algorithm to use (CALG_TLS1PRF = combination of MD5 and SHA-1, CALG_SHA_256...)
|
||||
/// \param[in] secret Hashing secret key
|
||||
/// \param[in] seed Random seed
|
||||
/// \param[in] size Number of bytes of pseudo-random data required
|
||||
///
|
||||
/// \returns Generated pseudo-random data (\p size bytes)
|
||||
///
|
||||
template<class _Ty, class _Ax>
|
||||
inline static sanitizing_blob prf(
|
||||
_In_ HCRYPTPROV cp,
|
||||
_In_ ALG_ID alg,
|
||||
_In_ const tls_master_secret &secret,
|
||||
_In_ const std::vector<_Ty, _Ax> &seed,
|
||||
_In_ size_t size)
|
||||
{
|
||||
return prf(cp, alg, secret, seed.data(), seed.size() * sizeof(_Ty), size);
|
||||
}
|
||||
|
||||
/// @}
|
||||
|
||||
///
|
||||
/// Creates a key
|
||||
///
|
||||
/// \sa [How to export and import plain text session keys by using CryptoAPI](https://support.microsoft.com/en-us/kb/228786)
|
||||
///
|
||||
/// \param[in] cp Handle of the cryptographics provider
|
||||
/// \param[in] alg Key algorithm
|
||||
/// \param[in] key Key that decrypts \p secret
|
||||
/// \param[in] secret Key data
|
||||
/// \param[in] size_secret \p secret size
|
||||
///
|
||||
/// \returns Key
|
||||
///
|
||||
HCRYPTKEY create_key(
|
||||
_In_ HCRYPTPROV cp,
|
||||
_In_ ALG_ID alg,
|
||||
_In_ HCRYPTKEY key,
|
||||
_In_bytecount_(size_secret) const void *secret,
|
||||
_In_ size_t size_secret);
|
||||
|
||||
protected:
|
||||
credentials_tls &m_cred; ///< EAP-TLS user credentials
|
||||
@@ -235,20 +488,47 @@ namespace eap
|
||||
packet m_packet_req; ///< Request packet
|
||||
packet m_packet_res; ///< Response packet
|
||||
|
||||
HANDLE m_user_ctx; ///< Handle to user context
|
||||
winstd::tstring m_sc_target_name; ///< Schannel target name
|
||||
winstd::sec_credentials m_sc_cred; ///< Schannel client credentials
|
||||
std::vector<unsigned char> m_sc_queue; ///< TLS data queue
|
||||
winstd::sec_context m_sc_ctx; ///< Schannel context
|
||||
winstd::crypt_prov m_cp; ///< Cryptography provider for general services
|
||||
winstd::crypt_prov m_cp_enc_client; ///< Cryptography provider for encryption
|
||||
winstd::crypt_prov m_cp_enc_server; ///< Cryptography provider for encryption
|
||||
winstd::crypt_key m_key_exp1; ///< Key for importing derived keys
|
||||
|
||||
tls_version m_tls_version; ///< TLS version in use
|
||||
ALG_ID m_alg_prf; ///< Pseudo-random function algorithm in use
|
||||
|
||||
tls_conn_state m_state_client; ///< Client TLS connection state
|
||||
tls_conn_state m_state_client_pending; ///< Client TLS connection state (pending)
|
||||
tls_conn_state m_state_server; ///< Server TLS connection state
|
||||
tls_conn_state m_state_server_pending; ///< Server TLS connection state (pending)
|
||||
|
||||
tls_master_secret m_master_secret; ///< TLS master secret
|
||||
tls_random m_random_client; ///< Client random
|
||||
tls_random m_random_server; ///< Server random
|
||||
|
||||
tls_random m_key_mppe_client; ///< MS-MPPE-Recv-Key
|
||||
tls_random m_key_mppe_server; ///< MS-MPPE-Send-Key
|
||||
|
||||
sanitizing_blob m_session_id; ///< TLS session ID
|
||||
|
||||
std::list<winstd::cert_context> m_server_cert_chain; ///< Server certificate chain
|
||||
|
||||
winstd::crypt_hash m_hash_handshake_msgs_md5; ///< Running MD5 hash of handshake messages
|
||||
winstd::crypt_hash m_hash_handshake_msgs_sha1; ///< Running SHA-1 hash of handshake messages
|
||||
winstd::crypt_hash m_hash_handshake_msgs_sha256; ///< Running SHA-256 hash of handshake messages
|
||||
|
||||
bool m_handshake[tls_handshake_type_max]; ///< Handshake flags (map od handshake messages received)
|
||||
|
||||
enum {
|
||||
phase_unknown = -1, ///< Unknown phase
|
||||
phase_handshake_init = 0, ///< Handshake initialize
|
||||
phase_handshake_cont, ///< Handshake continue
|
||||
phase_application_data, ///< Exchange application data
|
||||
phase_shutdown, ///< Connection shut down
|
||||
phase_client_hello = 0, ///< Send client hello
|
||||
phase_server_hello, ///< Wait for server hello
|
||||
phase_change_cipher_spec, ///< Wait for change cipher spec
|
||||
phase_application_data ///< Exchange application data
|
||||
} m_phase; ///< What phase is our communication at?
|
||||
|
||||
unsigned __int64 m_seq_num_client; ///< Sequence number for encrypting
|
||||
unsigned __int64 m_seq_num_server; ///< Sequence number for decrypting
|
||||
|
||||
// The following members are required to avoid memory leakage in get_result()
|
||||
EAP_ATTRIBUTES m_eap_attr_desc; ///< EAP Radius attributes descriptor
|
||||
std::vector<winstd::eap_attr> m_eap_attr; ///< EAP Radius attributes
|
||||
|
||||
@@ -1,284 +1,298 @@
|
||||
/*
|
||||
Copyright 2015-2016 Amebis
|
||||
Copyright 2016 GÉANT
|
||||
|
||||
This file is part of GÉANTLink.
|
||||
|
||||
GÉANTLink is free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
GÉANTLink is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with GÉANTLink. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "StdAfx.h"
|
||||
|
||||
#pragma comment(lib, "Cryptui.lib")
|
||||
|
||||
using namespace std;
|
||||
using namespace winstd;
|
||||
|
||||
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
// eap::get_cert_title
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
|
||||
tstring eap::get_cert_title(PCCERT_CONTEXT cert)
|
||||
{
|
||||
tstring name, str, issuer, title;
|
||||
FILETIME ft;
|
||||
SYSTEMTIME st;
|
||||
|
||||
// Prepare certificate information
|
||||
CertGetNameString(cert, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, NULL, name);
|
||||
title += name;
|
||||
|
||||
FileTimeToLocalFileTime(&(cert->pCertInfo->NotBefore), &ft);
|
||||
FileTimeToSystemTime(&ft, &st);
|
||||
GetDateFormat(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &st, NULL, str);
|
||||
title += _T(", ");
|
||||
title += str;
|
||||
|
||||
FileTimeToLocalFileTime(&(cert->pCertInfo->NotAfter ), &ft);
|
||||
FileTimeToSystemTime(&ft, &st);
|
||||
GetDateFormat(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &st, NULL, str);
|
||||
title += _T('-');
|
||||
title += str;
|
||||
|
||||
CertGetNameString(cert, CERT_NAME_SIMPLE_DISPLAY_TYPE, CERT_NAME_ISSUER_FLAG, NULL, issuer);
|
||||
if (name != issuer) {
|
||||
title += _T(", ");
|
||||
title += issuer;
|
||||
}
|
||||
|
||||
return title;
|
||||
}
|
||||
|
||||
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
// eap::config_method_tls
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
|
||||
eap::config_method_tls::config_method_tls(_In_ module &mod) : config_method_with_cred(mod)
|
||||
{
|
||||
m_preshared.reset(new credentials_tls(mod));
|
||||
}
|
||||
|
||||
|
||||
eap::config_method_tls::config_method_tls(_In_ const config_method_tls &other) :
|
||||
m_trusted_root_ca(other.m_trusted_root_ca),
|
||||
m_server_names(other.m_server_names),
|
||||
config_method_with_cred(other)
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
eap::config_method_tls::config_method_tls(_Inout_ config_method_tls &&other) :
|
||||
m_trusted_root_ca(std::move(other.m_trusted_root_ca)),
|
||||
m_server_names(std::move(other.m_server_names)),
|
||||
config_method_with_cred(std::move(other))
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
eap::config_method_tls& eap::config_method_tls::operator=(_In_ const config_method_tls &other)
|
||||
{
|
||||
if (this != &other) {
|
||||
(config_method_with_cred&)*this = other;
|
||||
m_trusted_root_ca = other.m_trusted_root_ca;
|
||||
m_server_names = other.m_server_names;
|
||||
}
|
||||
|
||||
return *this;
|
||||
}
|
||||
|
||||
|
||||
eap::config_method_tls& eap::config_method_tls::operator=(_Inout_ config_method_tls &&other)
|
||||
{
|
||||
if (this != &other) {
|
||||
(config_method_with_cred&&)*this = std::move(other);
|
||||
m_trusted_root_ca = std::move(other.m_trusted_root_ca);
|
||||
m_server_names = std::move(other.m_server_names);
|
||||
}
|
||||
|
||||
return *this;
|
||||
}
|
||||
|
||||
|
||||
eap::config* eap::config_method_tls::clone() const
|
||||
{
|
||||
return new config_method_tls(*this);
|
||||
}
|
||||
|
||||
|
||||
void eap::config_method_tls::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const
|
||||
{
|
||||
assert(pDoc);
|
||||
assert(pConfigRoot);
|
||||
|
||||
config_method_with_cred::save(pDoc, pConfigRoot);
|
||||
|
||||
const bstr bstrNamespace(L"urn:ietf:params:xml:ns:yang:ietf-eap-metadata");
|
||||
HRESULT hr;
|
||||
|
||||
// <ServerSideCredential>
|
||||
com_obj<IXMLDOMElement> pXmlElServerSideCredential;
|
||||
if (FAILED(hr = eapxml::create_element(pDoc, pConfigRoot, bstr(L"eap-metadata:ServerSideCredential"), bstr(L"ServerSideCredential"), bstrNamespace, &pXmlElServerSideCredential)))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <ServerSideCredential> element.");
|
||||
|
||||
for (list<cert_context>::const_iterator i = m_trusted_root_ca.begin(), i_end = m_trusted_root_ca.end(); i != i_end; ++i) {
|
||||
// <CA>
|
||||
com_obj<IXMLDOMElement> pXmlElCA;
|
||||
if (FAILED(hr = eapxml::create_element(pDoc, bstr(L"CA"), bstrNamespace, &pXmlElCA)))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <CA> element.");
|
||||
|
||||
// <CA>/<format>
|
||||
if (FAILED(hr = eapxml::put_element_value(pDoc, pXmlElCA, bstr(L"format"), bstrNamespace, bstr(L"PEM"))))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <format> element.");
|
||||
|
||||
// <CA>/<cert-data>
|
||||
const cert_context &cc = *i;
|
||||
if (FAILED(hr = eapxml::put_element_base64(pDoc, pXmlElCA, bstr(L"cert-data"), bstrNamespace, cc->pbCertEncoded, cc->cbCertEncoded)))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <cert-data> element.");
|
||||
|
||||
if (FAILED(hr = pXmlElServerSideCredential->appendChild(pXmlElCA, NULL)))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error appending <CA> element.");
|
||||
}
|
||||
|
||||
// <ServerName>
|
||||
for (list<wstring>::const_iterator i = m_server_names.begin(), i_end = m_server_names.end(); i != i_end; ++i) {
|
||||
if (FAILED(hr = eapxml::put_element_value(pDoc, pXmlElServerSideCredential, bstr(L"ServerName"), bstrNamespace, bstr(*i))))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <ServerName> element.");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void eap::config_method_tls::load(_In_ IXMLDOMNode *pConfigRoot)
|
||||
{
|
||||
assert(pConfigRoot);
|
||||
|
||||
config_method_with_cred::load(pConfigRoot);
|
||||
|
||||
std::wstring xpath(eapxml::get_xpath(pConfigRoot));
|
||||
|
||||
m_trusted_root_ca.clear();
|
||||
m_server_names.clear();
|
||||
|
||||
// <ServerSideCredential>
|
||||
com_obj<IXMLDOMElement> pXmlElServerSideCredential;
|
||||
if (SUCCEEDED(eapxml::select_element(pConfigRoot, bstr(L"eap-metadata:ServerSideCredential"), &pXmlElServerSideCredential))) {
|
||||
std::wstring xpathServerSideCredential(xpath + L"/ServerSideCredential");
|
||||
|
||||
// <CA>
|
||||
com_obj<IXMLDOMNodeList> pXmlListCAs;
|
||||
long lCACount = 0;
|
||||
if (SUCCEEDED(eapxml::select_nodes(pXmlElServerSideCredential, bstr(L"eap-metadata:CA"), &pXmlListCAs)) && SUCCEEDED(pXmlListCAs->get_length(&lCACount))) {
|
||||
for (long j = 0; j < lCACount; j++) {
|
||||
// Load CA certificate.
|
||||
com_obj<IXMLDOMNode> pXmlElCA;
|
||||
pXmlListCAs->get_item(j, &pXmlElCA);
|
||||
bstr bstrFormat;
|
||||
if (FAILED(eapxml::get_element_value(pXmlElCA, bstr(L"eap-metadata:format"), &bstrFormat))) {
|
||||
// <format> not specified.
|
||||
continue;
|
||||
}
|
||||
|
||||
if (CompareStringEx(LOCALE_NAME_INVARIANT, NORM_IGNORECASE, bstrFormat, bstrFormat.length(), L"PEM", -1, NULL, NULL, 0) != CSTR_EQUAL) {
|
||||
// Certificate must be PEM encoded.
|
||||
continue;
|
||||
}
|
||||
|
||||
vector<unsigned char> aData;
|
||||
if (FAILED(eapxml::get_element_base64(pXmlElCA, bstr(L"eap-metadata:cert-data"), aData))) {
|
||||
// Error reading <cert-data> element.
|
||||
continue;
|
||||
}
|
||||
|
||||
add_trusted_ca(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, aData.data(), (DWORD)aData.size());
|
||||
}
|
||||
|
||||
// Log loaded CA certificates.
|
||||
list<tstring> cert_names;
|
||||
for (std::list<winstd::cert_context>::const_iterator cert = m_trusted_root_ca.cbegin(), cert_end = m_trusted_root_ca.cend(); cert != cert_end; ++cert)
|
||||
cert_names.push_back(std::move(get_cert_title(*cert)));
|
||||
m_module.log_config((xpathServerSideCredential + L"/CA").c_str(), cert_names);
|
||||
}
|
||||
|
||||
// <ServerName>
|
||||
com_obj<IXMLDOMNodeList> pXmlListServerIDs;
|
||||
long lServerIDCount = 0;
|
||||
if (SUCCEEDED(eapxml::select_nodes(pXmlElServerSideCredential, bstr(L"eap-metadata:ServerName"), &pXmlListServerIDs)) && SUCCEEDED(pXmlListServerIDs->get_length(&lServerIDCount))) {
|
||||
for (long j = 0; j < lServerIDCount; j++) {
|
||||
// Load server name (<ServerName>).
|
||||
com_obj<IXMLDOMNode> pXmlElServerID;
|
||||
pXmlListServerIDs->get_item(j, &pXmlElServerID);
|
||||
bstr bstrServerID;
|
||||
pXmlElServerID->get_text(&bstrServerID);
|
||||
m_server_names.push_back(wstring(bstrServerID));
|
||||
}
|
||||
|
||||
m_module.log_config((xpathServerSideCredential + L"/ServerName").c_str(), m_server_names);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void eap::config_method_tls::operator<<(_Inout_ cursor_out &cursor) const
|
||||
{
|
||||
config_method_with_cred::operator<<(cursor);
|
||||
cursor << m_trusted_root_ca;
|
||||
cursor << m_server_names ;
|
||||
}
|
||||
|
||||
|
||||
size_t eap::config_method_tls::get_pk_size() const
|
||||
{
|
||||
return
|
||||
config_method_with_cred::get_pk_size() +
|
||||
pksizeof(m_trusted_root_ca) +
|
||||
pksizeof(m_server_names );
|
||||
}
|
||||
|
||||
|
||||
void eap::config_method_tls::operator>>(_Inout_ cursor_in &cursor)
|
||||
{
|
||||
config_method_with_cred::operator>>(cursor);
|
||||
cursor >> m_trusted_root_ca;
|
||||
cursor >> m_server_names ;
|
||||
}
|
||||
|
||||
|
||||
eap_type_t eap::config_method_tls::get_method_id() const
|
||||
{
|
||||
return eap_type_tls;
|
||||
}
|
||||
|
||||
|
||||
bool eap::config_method_tls::add_trusted_ca(_In_ DWORD dwCertEncodingType, _In_ const BYTE *pbCertEncoded, _In_ DWORD cbCertEncoded)
|
||||
{
|
||||
cert_context cert;
|
||||
if (!cert.create(dwCertEncodingType, pbCertEncoded, cbCertEncoded)) {
|
||||
// Invalid or unsupported certificate.
|
||||
return false;
|
||||
}
|
||||
|
||||
for (list<cert_context>::const_iterator i = m_trusted_root_ca.cbegin(), i_end = m_trusted_root_ca.cend();; ++i) {
|
||||
if (i != i_end) {
|
||||
if (*i == cert) {
|
||||
// This certificate is already on the list.
|
||||
return false;
|
||||
}
|
||||
} else {
|
||||
// End of list reached. Append certificate.
|
||||
m_trusted_root_ca.push_back(std::move(cert));
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
/*
|
||||
Copyright 2015-2016 Amebis
|
||||
Copyright 2016 GÉANT
|
||||
|
||||
This file is part of GÉANTLink.
|
||||
|
||||
GÉANTLink is free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
GÉANTLink is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with GÉANTLink. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "StdAfx.h"
|
||||
|
||||
#pragma comment(lib, "Cryptui.lib")
|
||||
|
||||
using namespace std;
|
||||
using namespace winstd;
|
||||
|
||||
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
// eap::get_cert_title
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
|
||||
tstring eap::get_cert_title(PCCERT_CONTEXT cert)
|
||||
{
|
||||
tstring name, str, issuer, title;
|
||||
FILETIME ft;
|
||||
SYSTEMTIME st;
|
||||
|
||||
// Prepare certificate information
|
||||
CertGetNameString(cert, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, NULL, name);
|
||||
title += name;
|
||||
|
||||
FileTimeToLocalFileTime(&(cert->pCertInfo->NotBefore), &ft);
|
||||
FileTimeToSystemTime(&ft, &st);
|
||||
GetDateFormat(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &st, NULL, str);
|
||||
title += _T(", ");
|
||||
title += str;
|
||||
|
||||
FileTimeToLocalFileTime(&(cert->pCertInfo->NotAfter ), &ft);
|
||||
FileTimeToSystemTime(&ft, &st);
|
||||
GetDateFormat(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &st, NULL, str);
|
||||
title += _T('-');
|
||||
title += str;
|
||||
|
||||
CertGetNameString(cert, CERT_NAME_SIMPLE_DISPLAY_TYPE, CERT_NAME_ISSUER_FLAG, NULL, issuer);
|
||||
if (name != issuer) {
|
||||
title += _T(", ");
|
||||
title += issuer;
|
||||
}
|
||||
|
||||
return title;
|
||||
}
|
||||
|
||||
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
// eap::config_method_tls
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
|
||||
eap::config_method_tls::config_method_tls(_In_ module &mod) : config_method_with_cred(mod)
|
||||
{
|
||||
m_preshared.reset(new credentials_tls(mod));
|
||||
}
|
||||
|
||||
|
||||
eap::config_method_tls::config_method_tls(_In_ const config_method_tls &other) :
|
||||
m_trusted_root_ca(other.m_trusted_root_ca),
|
||||
m_server_names(other.m_server_names),
|
||||
m_session_id(other.m_session_id),
|
||||
m_master_secret(other.m_master_secret),
|
||||
config_method_with_cred(other)
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
eap::config_method_tls::config_method_tls(_Inout_ config_method_tls &&other) :
|
||||
m_trusted_root_ca(std::move(other.m_trusted_root_ca)),
|
||||
m_server_names(std::move(other.m_server_names)),
|
||||
m_session_id(std::move(other.m_session_id)),
|
||||
m_master_secret(std::move(other.m_master_secret)),
|
||||
config_method_with_cred(std::move(other))
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
eap::config_method_tls& eap::config_method_tls::operator=(_In_ const config_method_tls &other)
|
||||
{
|
||||
if (this != &other) {
|
||||
(config_method_with_cred&)*this = other;
|
||||
m_trusted_root_ca = other.m_trusted_root_ca;
|
||||
m_server_names = other.m_server_names;
|
||||
m_session_id = other.m_session_id;
|
||||
m_master_secret = other.m_master_secret;
|
||||
}
|
||||
|
||||
return *this;
|
||||
}
|
||||
|
||||
|
||||
eap::config_method_tls& eap::config_method_tls::operator=(_Inout_ config_method_tls &&other)
|
||||
{
|
||||
if (this != &other) {
|
||||
(config_method_with_cred&&)*this = std::move(other);
|
||||
m_trusted_root_ca = std::move(other.m_trusted_root_ca);
|
||||
m_server_names = std::move(other.m_server_names);
|
||||
m_session_id = std::move(other.m_session_id);
|
||||
m_master_secret = std::move(other.m_master_secret);
|
||||
}
|
||||
|
||||
return *this;
|
||||
}
|
||||
|
||||
|
||||
eap::config* eap::config_method_tls::clone() const
|
||||
{
|
||||
return new config_method_tls(*this);
|
||||
}
|
||||
|
||||
|
||||
void eap::config_method_tls::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const
|
||||
{
|
||||
assert(pDoc);
|
||||
assert(pConfigRoot);
|
||||
|
||||
config_method_with_cred::save(pDoc, pConfigRoot);
|
||||
|
||||
const bstr bstrNamespace(L"urn:ietf:params:xml:ns:yang:ietf-eap-metadata");
|
||||
HRESULT hr;
|
||||
|
||||
// <ServerSideCredential>
|
||||
com_obj<IXMLDOMElement> pXmlElServerSideCredential;
|
||||
if (FAILED(hr = eapxml::create_element(pDoc, pConfigRoot, bstr(L"eap-metadata:ServerSideCredential"), bstr(L"ServerSideCredential"), bstrNamespace, &pXmlElServerSideCredential)))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <ServerSideCredential> element.");
|
||||
|
||||
for (list<cert_context>::const_iterator i = m_trusted_root_ca.begin(), i_end = m_trusted_root_ca.end(); i != i_end; ++i) {
|
||||
// <CA>
|
||||
com_obj<IXMLDOMElement> pXmlElCA;
|
||||
if (FAILED(hr = eapxml::create_element(pDoc, bstr(L"CA"), bstrNamespace, &pXmlElCA)))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <CA> element.");
|
||||
|
||||
// <CA>/<format>
|
||||
if (FAILED(hr = eapxml::put_element_value(pDoc, pXmlElCA, bstr(L"format"), bstrNamespace, bstr(L"PEM"))))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <format> element.");
|
||||
|
||||
// <CA>/<cert-data>
|
||||
const cert_context &cc = *i;
|
||||
if (FAILED(hr = eapxml::put_element_base64(pDoc, pXmlElCA, bstr(L"cert-data"), bstrNamespace, cc->pbCertEncoded, cc->cbCertEncoded)))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <cert-data> element.");
|
||||
|
||||
if (FAILED(hr = pXmlElServerSideCredential->appendChild(pXmlElCA, NULL)))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error appending <CA> element.");
|
||||
}
|
||||
|
||||
// <ServerName>
|
||||
for (list<wstring>::const_iterator i = m_server_names.begin(), i_end = m_server_names.end(); i != i_end; ++i) {
|
||||
if (FAILED(hr = eapxml::put_element_value(pDoc, pXmlElServerSideCredential, bstr(L"ServerName"), bstrNamespace, bstr(*i))))
|
||||
throw com_runtime_error(hr, __FUNCTION__ " Error creating <ServerName> element.");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void eap::config_method_tls::load(_In_ IXMLDOMNode *pConfigRoot)
|
||||
{
|
||||
assert(pConfigRoot);
|
||||
|
||||
config_method_with_cred::load(pConfigRoot);
|
||||
|
||||
std::wstring xpath(eapxml::get_xpath(pConfigRoot));
|
||||
|
||||
m_trusted_root_ca.clear();
|
||||
m_server_names.clear();
|
||||
|
||||
// <ServerSideCredential>
|
||||
com_obj<IXMLDOMElement> pXmlElServerSideCredential;
|
||||
if (SUCCEEDED(eapxml::select_element(pConfigRoot, bstr(L"eap-metadata:ServerSideCredential"), &pXmlElServerSideCredential))) {
|
||||
std::wstring xpathServerSideCredential(xpath + L"/ServerSideCredential");
|
||||
|
||||
// <CA>
|
||||
com_obj<IXMLDOMNodeList> pXmlListCAs;
|
||||
long lCACount = 0;
|
||||
if (SUCCEEDED(eapxml::select_nodes(pXmlElServerSideCredential, bstr(L"eap-metadata:CA"), &pXmlListCAs)) && SUCCEEDED(pXmlListCAs->get_length(&lCACount))) {
|
||||
for (long j = 0; j < lCACount; j++) {
|
||||
// Load CA certificate.
|
||||
com_obj<IXMLDOMNode> pXmlElCA;
|
||||
pXmlListCAs->get_item(j, &pXmlElCA);
|
||||
bstr bstrFormat;
|
||||
if (FAILED(eapxml::get_element_value(pXmlElCA, bstr(L"eap-metadata:format"), &bstrFormat))) {
|
||||
// <format> not specified.
|
||||
continue;
|
||||
}
|
||||
|
||||
if (CompareStringEx(LOCALE_NAME_INVARIANT, NORM_IGNORECASE, bstrFormat, bstrFormat.length(), L"PEM", -1, NULL, NULL, 0) != CSTR_EQUAL) {
|
||||
// Certificate must be PEM encoded.
|
||||
continue;
|
||||
}
|
||||
|
||||
vector<unsigned char> aData;
|
||||
if (FAILED(eapxml::get_element_base64(pXmlElCA, bstr(L"eap-metadata:cert-data"), aData))) {
|
||||
// Error reading <cert-data> element.
|
||||
continue;
|
||||
}
|
||||
|
||||
add_trusted_ca(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, aData.data(), (DWORD)aData.size());
|
||||
}
|
||||
|
||||
// Log loaded CA certificates.
|
||||
list<tstring> cert_names;
|
||||
for (std::list<winstd::cert_context>::const_iterator cert = m_trusted_root_ca.cbegin(), cert_end = m_trusted_root_ca.cend(); cert != cert_end; ++cert)
|
||||
cert_names.push_back(std::move(get_cert_title(*cert)));
|
||||
m_module.log_config((xpathServerSideCredential + L"/CA").c_str(), cert_names);
|
||||
}
|
||||
|
||||
// <ServerName>
|
||||
com_obj<IXMLDOMNodeList> pXmlListServerIDs;
|
||||
long lServerIDCount = 0;
|
||||
if (SUCCEEDED(eapxml::select_nodes(pXmlElServerSideCredential, bstr(L"eap-metadata:ServerName"), &pXmlListServerIDs)) && SUCCEEDED(pXmlListServerIDs->get_length(&lServerIDCount))) {
|
||||
for (long j = 0; j < lServerIDCount; j++) {
|
||||
// Load server name (<ServerName>).
|
||||
com_obj<IXMLDOMNode> pXmlElServerID;
|
||||
pXmlListServerIDs->get_item(j, &pXmlElServerID);
|
||||
bstr bstrServerID;
|
||||
pXmlElServerID->get_text(&bstrServerID);
|
||||
m_server_names.push_back(wstring(bstrServerID));
|
||||
}
|
||||
|
||||
m_module.log_config((xpathServerSideCredential + L"/ServerName").c_str(), m_server_names);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void eap::config_method_tls::operator<<(_Inout_ cursor_out &cursor) const
|
||||
{
|
||||
config_method_with_cred::operator<<(cursor);
|
||||
cursor << m_trusted_root_ca;
|
||||
cursor << m_server_names ;
|
||||
cursor << m_session_id ;
|
||||
cursor << m_master_secret ;
|
||||
}
|
||||
|
||||
|
||||
size_t eap::config_method_tls::get_pk_size() const
|
||||
{
|
||||
return
|
||||
config_method_with_cred::get_pk_size() +
|
||||
pksizeof(m_trusted_root_ca) +
|
||||
pksizeof(m_server_names ) +
|
||||
pksizeof(m_session_id ) +
|
||||
pksizeof(m_master_secret );
|
||||
}
|
||||
|
||||
|
||||
void eap::config_method_tls::operator>>(_Inout_ cursor_in &cursor)
|
||||
{
|
||||
config_method_with_cred::operator>>(cursor);
|
||||
cursor >> m_trusted_root_ca;
|
||||
cursor >> m_server_names ;
|
||||
cursor >> m_session_id ;
|
||||
cursor >> m_master_secret ;
|
||||
}
|
||||
|
||||
|
||||
eap_type_t eap::config_method_tls::get_method_id() const
|
||||
{
|
||||
return eap_type_tls;
|
||||
}
|
||||
|
||||
|
||||
bool eap::config_method_tls::add_trusted_ca(_In_ DWORD dwCertEncodingType, _In_ const BYTE *pbCertEncoded, _In_ DWORD cbCertEncoded)
|
||||
{
|
||||
cert_context cert;
|
||||
if (!cert.create(dwCertEncodingType, pbCertEncoded, cbCertEncoded)) {
|
||||
// Invalid or unsupported certificate.
|
||||
return false;
|
||||
}
|
||||
|
||||
for (list<cert_context>::const_iterator i = m_trusted_root_ca.cbegin(), i_end = m_trusted_root_ca.cend();; ++i) {
|
||||
if (i != i_end) {
|
||||
if (*i == cert) {
|
||||
// This certificate is already on the list.
|
||||
return false;
|
||||
}
|
||||
} else {
|
||||
// End of list reached. Append certificate.
|
||||
m_trusted_root_ca.push_back(std::move(cert));
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -31,7 +31,6 @@
|
||||
#include <WinStd/EAP.h>
|
||||
|
||||
#include <EapHostError.h>
|
||||
#include <schnlsp.h>
|
||||
#include <time.h>
|
||||
|
||||
#include <algorithm>
|
||||
|
||||
@@ -1,341 +1,342 @@
|
||||
/*
|
||||
Copyright 2015-2016 Amebis
|
||||
Copyright 2016 GÉANT
|
||||
|
||||
This file is part of GÉANTLink.
|
||||
|
||||
GÉANTLink is free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
GÉANTLink is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with GÉANTLink. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "../../EAPBase_UI/include/EAP_UI.h"
|
||||
#include "../../TLS/include/Config.h"
|
||||
#include "../../TLS/include/Credentials.h"
|
||||
|
||||
#include <WinStd/Common.h>
|
||||
|
||||
#include <wx/filedlg.h>
|
||||
#include <wx/msgdlg.h>
|
||||
|
||||
#include <Windows.h>
|
||||
#include <cryptuiapi.h>
|
||||
#include <WinCrypt.h> // Must include after <Windows.h>
|
||||
|
||||
#include <list>
|
||||
#include <string>
|
||||
|
||||
|
||||
///
|
||||
/// Helper class for auto-destroyable certificates used in wxWidget's item containers
|
||||
///
|
||||
class wxCertificateClientData;
|
||||
|
||||
///
|
||||
/// Validator for host name
|
||||
///
|
||||
class wxHostNameValidator;
|
||||
|
||||
///
|
||||
/// Validator for FQDN
|
||||
///
|
||||
class wxFQDNValidator;
|
||||
|
||||
///
|
||||
/// Validator for FQDN lists
|
||||
///
|
||||
class wxFQDNListValidator;
|
||||
|
||||
///
|
||||
/// TLS credential panel
|
||||
///
|
||||
class wxTLSCredentialsPanel;
|
||||
|
||||
///
|
||||
/// TLS server trust configuration panel
|
||||
///
|
||||
class wxTLSServerTrustPanel;
|
||||
|
||||
///
|
||||
/// TLS credentials configuration panel
|
||||
///
|
||||
typedef wxEAPCredentialsConfigPanel<eap::credentials_tls, wxTLSCredentialsPanel> wxTLSCredentialsConfigPanel;
|
||||
|
||||
///
|
||||
/// TLS configuration panel
|
||||
///
|
||||
class wxTLSConfigPanel;
|
||||
|
||||
#pragma once
|
||||
|
||||
#include "../res/wxTLS_UI.h"
|
||||
|
||||
#include <WinStd/Win.h>
|
||||
|
||||
#include <wx/clntdata.h>
|
||||
#include <wx/icon.h>
|
||||
#include <wx/panel.h>
|
||||
#include <wx/textctrl.h>
|
||||
#include <wx/validate.h>
|
||||
|
||||
#include <list>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
|
||||
class wxCertificateClientData : public wxClientData
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs client data object with existing handle
|
||||
///
|
||||
wxCertificateClientData(PCCERT_CONTEXT cert);
|
||||
|
||||
///
|
||||
/// Releases certificate handle and destructs the object
|
||||
///
|
||||
virtual ~wxCertificateClientData();
|
||||
|
||||
public:
|
||||
PCCERT_CONTEXT m_cert; ///< Certificate
|
||||
};
|
||||
|
||||
|
||||
class wxHostNameValidator : public wxValidator
|
||||
{
|
||||
wxDECLARE_DYNAMIC_CLASS(wxHostNameValidator);
|
||||
wxDECLARE_NO_ASSIGN_CLASS(wxHostNameValidator);
|
||||
|
||||
public:
|
||||
///
|
||||
/// Construct the validator with a value to store data
|
||||
///
|
||||
wxHostNameValidator(std::wstring *val = NULL);
|
||||
|
||||
///
|
||||
/// Copy constructor
|
||||
///
|
||||
wxHostNameValidator(const wxHostNameValidator &other);
|
||||
|
||||
///
|
||||
/// Copies this validator
|
||||
///
|
||||
virtual wxObject* Clone() const;
|
||||
|
||||
///
|
||||
/// Validates the value
|
||||
///
|
||||
virtual bool Validate(wxWindow *parent);
|
||||
|
||||
///
|
||||
/// Transfers the value to the window
|
||||
///
|
||||
virtual bool TransferToWindow();
|
||||
|
||||
///
|
||||
/// Transfers the value from the window
|
||||
///
|
||||
virtual bool TransferFromWindow();
|
||||
|
||||
///
|
||||
/// Parses FQDN value
|
||||
///
|
||||
static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::wstring *val_out = NULL);
|
||||
|
||||
protected:
|
||||
std::wstring *m_val; ///< Pointer to variable to receive control's parsed value
|
||||
};
|
||||
|
||||
|
||||
class wxFQDNValidator : public wxValidator
|
||||
{
|
||||
wxDECLARE_DYNAMIC_CLASS(wxFQDNValidator);
|
||||
wxDECLARE_NO_ASSIGN_CLASS(wxFQDNValidator);
|
||||
|
||||
public:
|
||||
///
|
||||
/// Construct the validator with a value to store data
|
||||
///
|
||||
wxFQDNValidator(std::wstring *val = NULL);
|
||||
|
||||
///
|
||||
/// Copy constructor
|
||||
///
|
||||
wxFQDNValidator(const wxFQDNValidator &other);
|
||||
|
||||
///
|
||||
/// Copies this validator
|
||||
///
|
||||
virtual wxObject* Clone() const;
|
||||
|
||||
///
|
||||
/// Validates the value
|
||||
///
|
||||
virtual bool Validate(wxWindow *parent);
|
||||
|
||||
///
|
||||
/// Transfers the value to the window
|
||||
///
|
||||
virtual bool TransferToWindow();
|
||||
|
||||
///
|
||||
/// Transfers the value from the window
|
||||
///
|
||||
virtual bool TransferFromWindow();
|
||||
|
||||
///
|
||||
/// Parses FQDN value
|
||||
///
|
||||
static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::wstring *val_out = NULL);
|
||||
|
||||
protected:
|
||||
std::wstring *m_val; ///< Pointer to variable to receive control's parsed value
|
||||
};
|
||||
|
||||
|
||||
class wxFQDNListValidator : public wxValidator
|
||||
{
|
||||
wxDECLARE_DYNAMIC_CLASS(wxFQDNListValidator);
|
||||
wxDECLARE_NO_ASSIGN_CLASS(wxFQDNListValidator);
|
||||
|
||||
public:
|
||||
///
|
||||
/// Construct the validator with a value to store data
|
||||
///
|
||||
wxFQDNListValidator(std::list<std::wstring> *val = NULL);
|
||||
|
||||
///
|
||||
/// Copy constructor
|
||||
///
|
||||
wxFQDNListValidator(const wxFQDNListValidator &other);
|
||||
|
||||
///
|
||||
/// Copies this validator
|
||||
///
|
||||
virtual wxObject* Clone() const;
|
||||
|
||||
///
|
||||
/// Validates the value
|
||||
///
|
||||
virtual bool Validate(wxWindow *parent);
|
||||
|
||||
///
|
||||
/// Transfers the value to the window
|
||||
///
|
||||
virtual bool TransferToWindow();
|
||||
|
||||
///
|
||||
/// Transfers the value from the window
|
||||
///
|
||||
virtual bool TransferFromWindow();
|
||||
|
||||
///
|
||||
/// Parses FQDN list value
|
||||
///
|
||||
static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::list<std::wstring> *val_out = NULL);
|
||||
|
||||
protected:
|
||||
std::list<std::wstring> *m_val; ///< Pointer to variable to receive control's parsed value
|
||||
};
|
||||
|
||||
|
||||
class wxTLSCredentialsPanel : public wxEAPCredentialsPanelBase<eap::credentials_tls, wxTLSCredentialsPanelBase>
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs a configuration panel
|
||||
///
|
||||
/// \param[in] prov Provider configuration data
|
||||
/// \param[in] cfg Configuration data
|
||||
/// \param[inout] cred Credentials data
|
||||
/// \param[in] pszCredTarget Target name of credentials in Windows Credential Manager. Can be further decorated to create final target name.
|
||||
/// \param[in] parent Parent window
|
||||
/// \param[in] is_config Is this panel used to pre-enter credentials? When \c true, the "Remember" checkbox is always selected and disabled.
|
||||
///
|
||||
wxTLSCredentialsPanel(const eap::config_provider &prov, const eap::config_method_with_cred &cfg, eap::credentials_tls &cred, LPCTSTR pszCredTarget, wxWindow* parent, bool is_config = false);
|
||||
|
||||
protected:
|
||||
/// \cond internal
|
||||
virtual bool TransferDataToWindow();
|
||||
virtual bool TransferDataFromWindow();
|
||||
virtual void OnUpdateUI(wxUpdateUIEvent& event);
|
||||
/// \endcond
|
||||
|
||||
protected:
|
||||
winstd::library m_shell32; ///< shell32.dll resource library reference
|
||||
wxIcon m_icon; ///< Panel icon
|
||||
};
|
||||
|
||||
|
||||
class wxTLSServerTrustPanel : public wxEAPTLSServerTrustConfigPanelBase
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs a configuration panel
|
||||
///
|
||||
wxTLSServerTrustPanel(const eap::config_provider &prov, eap::config_method_tls &cfg, wxWindow* parent);
|
||||
|
||||
protected:
|
||||
/// \cond internal
|
||||
virtual bool TransferDataToWindow();
|
||||
virtual bool TransferDataFromWindow();
|
||||
virtual void OnUpdateUI(wxUpdateUIEvent& event);
|
||||
virtual void OnRootCADClick(wxCommandEvent& event);
|
||||
virtual void OnRootCAAddStore(wxCommandEvent& event);
|
||||
virtual void OnRootCAAddFile(wxCommandEvent& event);
|
||||
virtual void OnRootCARemove(wxCommandEvent& event);
|
||||
/// \endcond
|
||||
|
||||
///
|
||||
/// Adds a certificate to the list of trusted root CA list
|
||||
///
|
||||
/// \param[in] cert Certificate
|
||||
///
|
||||
/// \returns
|
||||
/// - \c true if certificate was added;
|
||||
/// - \c false if duplicate found or an error occured.
|
||||
///
|
||||
bool AddRootCA(PCCERT_CONTEXT cert);
|
||||
|
||||
protected:
|
||||
const eap::config_provider &m_prov; ///< EAP provider
|
||||
eap::config_method_tls &m_cfg; ///< TLS configuration
|
||||
winstd::library m_certmgr; ///< certmgr.dll resource library reference
|
||||
wxIcon m_icon; ///< Panel icon
|
||||
std::list<std::wstring> m_server_names_val; ///< Acceptable authenticating server names
|
||||
};
|
||||
|
||||
|
||||
class wxTLSConfigPanel : public wxPanel
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs a configuration panel
|
||||
///
|
||||
wxTLSConfigPanel(const eap::config_provider &prov, eap::config_method_tls &cfg, LPCTSTR pszCredTarget, wxWindow* parent);
|
||||
|
||||
///
|
||||
/// Destructs the configuration panel
|
||||
///
|
||||
virtual ~wxTLSConfigPanel();
|
||||
|
||||
protected:
|
||||
/// \cond internal
|
||||
virtual void OnInitDialog(wxInitDialogEvent& event);
|
||||
/// \endcond
|
||||
|
||||
protected:
|
||||
const eap::config_provider &m_prov; ///< EAP provider
|
||||
eap::config_method_tls &m_cfg; ///< TLS configuration
|
||||
wxTLSServerTrustPanel *m_server_trust; ///< Server trust configuration panel
|
||||
wxTLSCredentialsConfigPanel *m_credentials; ///< Credentials configuration panel
|
||||
};
|
||||
/*
|
||||
Copyright 2015-2016 Amebis
|
||||
Copyright 2016 GÉANT
|
||||
|
||||
This file is part of GÉANTLink.
|
||||
|
||||
GÉANTLink is free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
GÉANTLink is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with GÉANTLink. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "../../EAPBase_UI/include/EAP_UI.h"
|
||||
#include "../../TLS/include/Config.h"
|
||||
#include "../../TLS/include/Credentials.h"
|
||||
|
||||
#include <WinStd/Common.h>
|
||||
|
||||
#include <wx/filedlg.h>
|
||||
#include <wx/msgdlg.h>
|
||||
|
||||
#include <Windows.h>
|
||||
#include <cryptuiapi.h>
|
||||
#include <WinCrypt.h> // Must include after <Windows.h>
|
||||
|
||||
#include <list>
|
||||
#include <string>
|
||||
|
||||
|
||||
///
|
||||
/// Helper class for auto-destroyable certificates used in wxWidget's item containers
|
||||
///
|
||||
class wxCertificateClientData;
|
||||
|
||||
///
|
||||
/// Validator for host name
|
||||
///
|
||||
class wxHostNameValidator;
|
||||
|
||||
///
|
||||
/// Validator for FQDN
|
||||
///
|
||||
class wxFQDNValidator;
|
||||
|
||||
///
|
||||
/// Validator for FQDN lists
|
||||
///
|
||||
class wxFQDNListValidator;
|
||||
|
||||
///
|
||||
/// TLS credential panel
|
||||
///
|
||||
class wxTLSCredentialsPanel;
|
||||
|
||||
///
|
||||
/// TLS server trust configuration panel
|
||||
///
|
||||
class wxTLSServerTrustPanel;
|
||||
|
||||
///
|
||||
/// TLS credentials configuration panel
|
||||
///
|
||||
typedef wxEAPCredentialsConfigPanel<eap::credentials_tls, wxTLSCredentialsPanel> wxTLSCredentialsConfigPanel;
|
||||
|
||||
///
|
||||
/// TLS configuration panel
|
||||
///
|
||||
class wxTLSConfigPanel;
|
||||
|
||||
#pragma once
|
||||
|
||||
#include "../res/wxTLS_UI.h"
|
||||
|
||||
#include <WinStd/Win.h>
|
||||
|
||||
#include <wx/clntdata.h>
|
||||
#include <wx/icon.h>
|
||||
#include <wx/panel.h>
|
||||
#include <wx/textctrl.h>
|
||||
#include <wx/validate.h>
|
||||
|
||||
#include <list>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
|
||||
class wxCertificateClientData : public wxClientData
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs client data object with existing handle
|
||||
///
|
||||
wxCertificateClientData(PCCERT_CONTEXT cert);
|
||||
|
||||
///
|
||||
/// Releases certificate handle and destructs the object
|
||||
///
|
||||
virtual ~wxCertificateClientData();
|
||||
|
||||
public:
|
||||
PCCERT_CONTEXT m_cert; ///< Certificate
|
||||
};
|
||||
|
||||
|
||||
class wxHostNameValidator : public wxValidator
|
||||
{
|
||||
wxDECLARE_DYNAMIC_CLASS(wxHostNameValidator);
|
||||
wxDECLARE_NO_ASSIGN_CLASS(wxHostNameValidator);
|
||||
|
||||
public:
|
||||
///
|
||||
/// Construct the validator with a value to store data
|
||||
///
|
||||
wxHostNameValidator(std::wstring *val = NULL);
|
||||
|
||||
///
|
||||
/// Copy constructor
|
||||
///
|
||||
wxHostNameValidator(const wxHostNameValidator &other);
|
||||
|
||||
///
|
||||
/// Copies this validator
|
||||
///
|
||||
virtual wxObject* Clone() const;
|
||||
|
||||
///
|
||||
/// Validates the value
|
||||
///
|
||||
virtual bool Validate(wxWindow *parent);
|
||||
|
||||
///
|
||||
/// Transfers the value to the window
|
||||
///
|
||||
virtual bool TransferToWindow();
|
||||
|
||||
///
|
||||
/// Transfers the value from the window
|
||||
///
|
||||
virtual bool TransferFromWindow();
|
||||
|
||||
///
|
||||
/// Parses FQDN value
|
||||
///
|
||||
static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::wstring *val_out = NULL);
|
||||
|
||||
protected:
|
||||
std::wstring *m_val; ///< Pointer to variable to receive control's parsed value
|
||||
};
|
||||
|
||||
|
||||
class wxFQDNValidator : public wxValidator
|
||||
{
|
||||
wxDECLARE_DYNAMIC_CLASS(wxFQDNValidator);
|
||||
wxDECLARE_NO_ASSIGN_CLASS(wxFQDNValidator);
|
||||
|
||||
public:
|
||||
///
|
||||
/// Construct the validator with a value to store data
|
||||
///
|
||||
wxFQDNValidator(std::wstring *val = NULL);
|
||||
|
||||
///
|
||||
/// Copy constructor
|
||||
///
|
||||
wxFQDNValidator(const wxFQDNValidator &other);
|
||||
|
||||
///
|
||||
/// Copies this validator
|
||||
///
|
||||
virtual wxObject* Clone() const;
|
||||
|
||||
///
|
||||
/// Validates the value
|
||||
///
|
||||
virtual bool Validate(wxWindow *parent);
|
||||
|
||||
///
|
||||
/// Transfers the value to the window
|
||||
///
|
||||
virtual bool TransferToWindow();
|
||||
|
||||
///
|
||||
/// Transfers the value from the window
|
||||
///
|
||||
virtual bool TransferFromWindow();
|
||||
|
||||
///
|
||||
/// Parses FQDN value
|
||||
///
|
||||
static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::wstring *val_out = NULL);
|
||||
|
||||
protected:
|
||||
std::wstring *m_val; ///< Pointer to variable to receive control's parsed value
|
||||
};
|
||||
|
||||
|
||||
class wxFQDNListValidator : public wxValidator
|
||||
{
|
||||
wxDECLARE_DYNAMIC_CLASS(wxFQDNListValidator);
|
||||
wxDECLARE_NO_ASSIGN_CLASS(wxFQDNListValidator);
|
||||
|
||||
public:
|
||||
///
|
||||
/// Construct the validator with a value to store data
|
||||
///
|
||||
wxFQDNListValidator(std::list<std::wstring> *val = NULL);
|
||||
|
||||
///
|
||||
/// Copy constructor
|
||||
///
|
||||
wxFQDNListValidator(const wxFQDNListValidator &other);
|
||||
|
||||
///
|
||||
/// Copies this validator
|
||||
///
|
||||
virtual wxObject* Clone() const;
|
||||
|
||||
///
|
||||
/// Validates the value
|
||||
///
|
||||
virtual bool Validate(wxWindow *parent);
|
||||
|
||||
///
|
||||
/// Transfers the value to the window
|
||||
///
|
||||
virtual bool TransferToWindow();
|
||||
|
||||
///
|
||||
/// Transfers the value from the window
|
||||
///
|
||||
virtual bool TransferFromWindow();
|
||||
|
||||
///
|
||||
/// Parses FQDN list value
|
||||
///
|
||||
static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::list<std::wstring> *val_out = NULL);
|
||||
|
||||
protected:
|
||||
std::list<std::wstring> *m_val; ///< Pointer to variable to receive control's parsed value
|
||||
};
|
||||
|
||||
|
||||
class wxTLSCredentialsPanel : public wxEAPCredentialsPanelBase<eap::credentials_tls, wxTLSCredentialsPanelBase>
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs a configuration panel
|
||||
///
|
||||
/// \param[in] prov Provider configuration data
|
||||
/// \param[in] cfg Configuration data
|
||||
/// \param[inout] cred Credentials data
|
||||
/// \param[in] pszCredTarget Target name of credentials in Windows Credential Manager. Can be further decorated to create final target name.
|
||||
/// \param[in] parent Parent window
|
||||
/// \param[in] is_config Is this panel used to pre-enter credentials? When \c true, the "Remember" checkbox is always selected and disabled.
|
||||
///
|
||||
wxTLSCredentialsPanel(const eap::config_provider &prov, const eap::config_method_with_cred &cfg, eap::credentials_tls &cred, LPCTSTR pszCredTarget, wxWindow* parent, bool is_config = false);
|
||||
|
||||
protected:
|
||||
/// \cond internal
|
||||
virtual bool TransferDataToWindow();
|
||||
virtual bool TransferDataFromWindow();
|
||||
virtual void OnUpdateUI(wxUpdateUIEvent& event);
|
||||
/// \endcond
|
||||
|
||||
protected:
|
||||
winstd::library m_shell32; ///< shell32.dll resource library reference
|
||||
wxIcon m_icon; ///< Panel icon
|
||||
};
|
||||
|
||||
|
||||
class wxTLSServerTrustPanel : public wxEAPTLSServerTrustConfigPanelBase
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs a configuration panel
|
||||
///
|
||||
wxTLSServerTrustPanel(const eap::config_provider &prov, eap::config_method_tls &cfg, wxWindow* parent);
|
||||
|
||||
protected:
|
||||
/// \cond internal
|
||||
virtual bool TransferDataToWindow();
|
||||
virtual bool TransferDataFromWindow();
|
||||
virtual void OnUpdateUI(wxUpdateUIEvent& event);
|
||||
virtual void OnRootCADClick(wxCommandEvent& event);
|
||||
virtual void OnRootCAAddStore(wxCommandEvent& event);
|
||||
virtual void OnRootCAAddFile(wxCommandEvent& event);
|
||||
virtual void OnRootCARemove(wxCommandEvent& event);
|
||||
/// \endcond
|
||||
|
||||
///
|
||||
/// Adds a certificate to the list of trusted root CA list
|
||||
///
|
||||
/// \param[in] cert Certificate
|
||||
///
|
||||
/// \returns
|
||||
/// - \c true if certificate was added;
|
||||
/// - \c false if duplicate found or an error occured.
|
||||
///
|
||||
bool AddRootCA(PCCERT_CONTEXT cert);
|
||||
|
||||
protected:
|
||||
const eap::config_provider &m_prov; ///< EAP provider
|
||||
eap::config_method_tls &m_cfg; ///< TLS configuration
|
||||
winstd::library m_certmgr; ///< certmgr.dll resource library reference
|
||||
wxIcon m_icon; ///< Panel icon
|
||||
std::list<std::wstring> m_server_names_val; ///< Acceptable authenticating server names
|
||||
};
|
||||
|
||||
|
||||
class wxTLSConfigPanel : public wxPanel
|
||||
{
|
||||
public:
|
||||
///
|
||||
/// Constructs a configuration panel
|
||||
///
|
||||
wxTLSConfigPanel(const eap::config_provider &prov, eap::config_method_tls &cfg, LPCTSTR pszCredTarget, wxWindow* parent);
|
||||
|
||||
///
|
||||
/// Destructs the configuration panel
|
||||
///
|
||||
virtual ~wxTLSConfigPanel();
|
||||
|
||||
protected:
|
||||
/// \cond internal
|
||||
virtual void OnInitDialog(wxInitDialogEvent& event);
|
||||
virtual bool TransferDataFromWindow();
|
||||
/// \endcond
|
||||
|
||||
protected:
|
||||
const eap::config_provider &m_prov; ///< EAP provider
|
||||
eap::config_method_tls &m_cfg; ///< TLS configuration
|
||||
wxTLSServerTrustPanel *m_server_trust; ///< Server trust configuration panel
|
||||
wxTLSCredentialsConfigPanel *m_credentials; ///< Credentials configuration panel
|
||||
};
|
||||
|
||||
@@ -1,182 +1,182 @@
|
||||
///////////////////////////////////////////////////////////////////////////
|
||||
// C++ code generated with wxFormBuilder (version Jun 17 2015)
|
||||
// http://www.wxformbuilder.org/
|
||||
//
|
||||
// PLEASE DO "NOT" EDIT THIS FILE!
|
||||
///////////////////////////////////////////////////////////////////////////
|
||||
|
||||
#include <StdAfx.h>
|
||||
|
||||
#include "wxTLS_UI.h"
|
||||
|
||||
///////////////////////////////////////////////////////////////////////////
|
||||
|
||||
wxEAPTLSServerTrustConfigPanelBase::wxEAPTLSServerTrustConfigPanelBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
|
||||
{
|
||||
wxStaticBoxSizer* sb_server_trust;
|
||||
sb_server_trust = new wxStaticBoxSizer( new wxStaticBox( this, wxID_ANY, _("Server Trust") ), wxVERTICAL );
|
||||
|
||||
wxBoxSizer* sb_server_trust_horiz;
|
||||
sb_server_trust_horiz = new wxBoxSizer( wxHORIZONTAL );
|
||||
|
||||
m_server_trust_icon = new wxStaticBitmap( sb_server_trust->GetStaticBox(), wxID_ANY, wxNullBitmap, wxDefaultPosition, wxDefaultSize, 0 );
|
||||
sb_server_trust_horiz->Add( m_server_trust_icon, 0, wxALL, 5 );
|
||||
|
||||
wxBoxSizer* sb_server_trust_vert;
|
||||
sb_server_trust_vert = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_server_trust_label = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("Describe the servers you trust to prevent credential interception in case of man-in-the-middle attacks."), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_server_trust_label->Wrap( 446 );
|
||||
sb_server_trust_vert->Add( m_server_trust_label, 0, wxALL|wxEXPAND, 5 );
|
||||
|
||||
wxBoxSizer* sb_root_ca;
|
||||
sb_root_ca = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_root_ca_lbl = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("Acceptable Certificate Authorities:"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_root_ca_lbl->Wrap( -1 );
|
||||
sb_root_ca->Add( m_root_ca_lbl, 0, wxEXPAND|wxBOTTOM, 5 );
|
||||
|
||||
m_root_ca = new wxListBox( sb_server_trust->GetStaticBox(), wxID_ANY, wxDefaultPosition, wxDefaultSize, 0, NULL, wxLB_SORT );
|
||||
m_root_ca->SetToolTip( _("List of certificate authorities server's certificate must be issued by") );
|
||||
|
||||
sb_root_ca->Add( m_root_ca, 1, wxEXPAND|wxBOTTOM, 5 );
|
||||
|
||||
wxBoxSizer* sb_root_ca_btn;
|
||||
sb_root_ca_btn = new wxBoxSizer( wxHORIZONTAL );
|
||||
|
||||
m_root_ca_add_store = new wxButton( sb_server_trust->GetStaticBox(), wxID_ANY, _("Add CA from Store..."), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_root_ca_add_store->SetToolTip( _("Adds a new certificate authority from the certificate store to the list") );
|
||||
|
||||
sb_root_ca_btn->Add( m_root_ca_add_store, 0, wxRIGHT, 5 );
|
||||
|
||||
m_root_ca_add_file = new wxButton( sb_server_trust->GetStaticBox(), wxID_ANY, _("Add CA from File..."), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_root_ca_add_file->SetToolTip( _("Adds a new certificate authority from the file to the list") );
|
||||
|
||||
sb_root_ca_btn->Add( m_root_ca_add_file, 0, wxRIGHT|wxLEFT, 5 );
|
||||
|
||||
m_root_ca_remove = new wxButton( sb_server_trust->GetStaticBox(), wxID_ANY, _("&Remove CA"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_root_ca_remove->Enable( false );
|
||||
m_root_ca_remove->SetToolTip( _("Removes selected certificate authorities from the list") );
|
||||
|
||||
sb_root_ca_btn->Add( m_root_ca_remove, 0, wxLEFT, 5 );
|
||||
|
||||
|
||||
sb_root_ca->Add( sb_root_ca_btn, 0, wxALIGN_RIGHT, 5 );
|
||||
|
||||
|
||||
sb_server_trust_vert->Add( sb_root_ca, 1, wxEXPAND|wxALL, 5 );
|
||||
|
||||
wxBoxSizer* sb_server_names;
|
||||
sb_server_names = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_server_names_label = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("Acceptable server &names:"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_server_names_label->Wrap( -1 );
|
||||
sb_server_names->Add( m_server_names_label, 0, wxBOTTOM, 5 );
|
||||
|
||||
m_server_names = new wxTextCtrl( sb_server_trust->GetStaticBox(), wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_server_names->SetToolTip( _("A semicolon delimited list of acceptable server FQDN names; blank to skip name check; Unicode characters allowed") );
|
||||
|
||||
sb_server_names->Add( m_server_names, 0, wxEXPAND|wxBOTTOM, 5 );
|
||||
|
||||
m_server_names_note = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("(Example: foo.bar.com;server2.bar.com)"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_server_names_note->Wrap( -1 );
|
||||
sb_server_names->Add( m_server_names_note, 0, wxALIGN_RIGHT, 5 );
|
||||
|
||||
|
||||
sb_server_trust_vert->Add( sb_server_names, 0, wxEXPAND|wxALL, 5 );
|
||||
|
||||
|
||||
sb_server_trust_horiz->Add( sb_server_trust_vert, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_server_trust->Add( sb_server_trust_horiz, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
this->SetSizer( sb_server_trust );
|
||||
this->Layout();
|
||||
|
||||
// Connect Events
|
||||
this->Connect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnUpdateUI ) );
|
||||
m_root_ca->Connect( wxEVT_COMMAND_LISTBOX_DOUBLECLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCADClick ), NULL, this );
|
||||
m_root_ca_add_store->Connect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCAAddStore ), NULL, this );
|
||||
m_root_ca_add_file->Connect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCAAddFile ), NULL, this );
|
||||
m_root_ca_remove->Connect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCARemove ), NULL, this );
|
||||
}
|
||||
|
||||
wxEAPTLSServerTrustConfigPanelBase::~wxEAPTLSServerTrustConfigPanelBase()
|
||||
{
|
||||
// Disconnect Events
|
||||
this->Disconnect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnUpdateUI ) );
|
||||
m_root_ca->Disconnect( wxEVT_COMMAND_LISTBOX_DOUBLECLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCADClick ), NULL, this );
|
||||
m_root_ca_add_store->Disconnect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCAAddStore ), NULL, this );
|
||||
m_root_ca_add_file->Disconnect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCAAddFile ), NULL, this );
|
||||
m_root_ca_remove->Disconnect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCARemove ), NULL, this );
|
||||
|
||||
}
|
||||
|
||||
wxTLSCredentialsPanelBase::wxTLSCredentialsPanelBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
|
||||
{
|
||||
wxStaticBoxSizer* sb_credentials;
|
||||
sb_credentials = new wxStaticBoxSizer( new wxStaticBox( this, wxID_ANY, _("TLS Client Certificate") ), wxVERTICAL );
|
||||
|
||||
wxBoxSizer* sb_credentials_horiz;
|
||||
sb_credentials_horiz = new wxBoxSizer( wxHORIZONTAL );
|
||||
|
||||
m_credentials_icon = new wxStaticBitmap( sb_credentials->GetStaticBox(), wxID_ANY, wxNullBitmap, wxDefaultPosition, wxDefaultSize, 0 );
|
||||
sb_credentials_horiz->Add( m_credentials_icon, 0, wxALL, 5 );
|
||||
|
||||
wxBoxSizer* sb_credentials_vert;
|
||||
sb_credentials_vert = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_credentials_label = new wxStaticText( sb_credentials->GetStaticBox(), wxID_ANY, _("Please select your client certificate to use for authentication."), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_credentials_label->Wrap( 446 );
|
||||
sb_credentials_vert->Add( m_credentials_label, 0, wxALL|wxEXPAND, 5 );
|
||||
|
||||
wxBoxSizer* sb_cert_radio;
|
||||
sb_cert_radio = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_cert_none = new wxRadioButton( sb_credentials->GetStaticBox(), wxID_ANY, _("Co&nnect without providing a client certificate"), wxDefaultPosition, wxDefaultSize, wxRB_GROUP );
|
||||
m_cert_none->SetToolTip( _("Select if your server does not require you to provide a client certificate") );
|
||||
|
||||
sb_cert_radio->Add( m_cert_none, 1, wxEXPAND, 5 );
|
||||
|
||||
wxBoxSizer* sb_cert_select;
|
||||
sb_cert_select = new wxBoxSizer( wxHORIZONTAL );
|
||||
|
||||
m_cert_select = new wxRadioButton( sb_credentials->GetStaticBox(), wxID_ANY, _("Use the following &certificate:"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_cert_select->SetToolTip( _("Select if you need to provide a client certificate when connecting") );
|
||||
|
||||
sb_cert_select->Add( m_cert_select, 0, wxEXPAND, 5 );
|
||||
|
||||
wxArrayString m_cert_select_valChoices;
|
||||
m_cert_select_val = new wxChoice( sb_credentials->GetStaticBox(), wxID_ANY, wxDefaultPosition, wxDefaultSize, m_cert_select_valChoices, wxCB_SORT );
|
||||
m_cert_select_val->SetSelection( 0 );
|
||||
m_cert_select_val->SetToolTip( _("Client certificate to use for authentication") );
|
||||
|
||||
sb_cert_select->Add( m_cert_select_val, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_cert_radio->Add( sb_cert_select, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_credentials_vert->Add( sb_cert_radio, 0, wxEXPAND|wxALL, 5 );
|
||||
|
||||
m_remember = new wxCheckBox( sb_credentials->GetStaticBox(), wxID_ANY, _("&Remember"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_remember->SetHelpText( _("Check if you would like to save certificate selection") );
|
||||
|
||||
sb_credentials_vert->Add( m_remember, 0, wxALL|wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_credentials_horiz->Add( sb_credentials_vert, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_credentials->Add( sb_credentials_horiz, 0, wxEXPAND, 5 );
|
||||
|
||||
|
||||
this->SetSizer( sb_credentials );
|
||||
this->Layout();
|
||||
}
|
||||
|
||||
wxTLSCredentialsPanelBase::~wxTLSCredentialsPanelBase()
|
||||
{
|
||||
}
|
||||
///////////////////////////////////////////////////////////////////////////
|
||||
// C++ code generated with wxFormBuilder (version Jun 17 2015)
|
||||
// http://www.wxformbuilder.org/
|
||||
//
|
||||
// PLEASE DO "NOT" EDIT THIS FILE!
|
||||
///////////////////////////////////////////////////////////////////////////
|
||||
|
||||
#include <StdAfx.h>
|
||||
|
||||
#include "wxTLS_UI.h"
|
||||
|
||||
///////////////////////////////////////////////////////////////////////////
|
||||
|
||||
wxEAPTLSServerTrustConfigPanelBase::wxEAPTLSServerTrustConfigPanelBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
|
||||
{
|
||||
wxStaticBoxSizer* sb_server_trust;
|
||||
sb_server_trust = new wxStaticBoxSizer( new wxStaticBox( this, wxID_ANY, _("Server Trust") ), wxVERTICAL );
|
||||
|
||||
wxBoxSizer* sb_server_trust_horiz;
|
||||
sb_server_trust_horiz = new wxBoxSizer( wxHORIZONTAL );
|
||||
|
||||
m_server_trust_icon = new wxStaticBitmap( sb_server_trust->GetStaticBox(), wxID_ANY, wxNullBitmap, wxDefaultPosition, wxDefaultSize, 0 );
|
||||
sb_server_trust_horiz->Add( m_server_trust_icon, 0, wxALL, 5 );
|
||||
|
||||
wxBoxSizer* sb_server_trust_vert;
|
||||
sb_server_trust_vert = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_server_trust_label = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("Describe the servers you trust to prevent credential interception in case of man-in-the-middle attacks."), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_server_trust_label->Wrap( 446 );
|
||||
sb_server_trust_vert->Add( m_server_trust_label, 0, wxALL|wxEXPAND, 5 );
|
||||
|
||||
wxBoxSizer* sb_root_ca;
|
||||
sb_root_ca = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_root_ca_lbl = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("Acceptable Certificate Authorities:"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_root_ca_lbl->Wrap( -1 );
|
||||
sb_root_ca->Add( m_root_ca_lbl, 0, wxEXPAND|wxBOTTOM, 5 );
|
||||
|
||||
m_root_ca = new wxListBox( sb_server_trust->GetStaticBox(), wxID_ANY, wxDefaultPosition, wxDefaultSize, 0, NULL, wxLB_SORT );
|
||||
m_root_ca->SetToolTip( _("List of certificate authorities server's certificate must be issued by") );
|
||||
|
||||
sb_root_ca->Add( m_root_ca, 1, wxEXPAND|wxBOTTOM, 5 );
|
||||
|
||||
wxBoxSizer* sb_root_ca_btn;
|
||||
sb_root_ca_btn = new wxBoxSizer( wxHORIZONTAL );
|
||||
|
||||
m_root_ca_add_store = new wxButton( sb_server_trust->GetStaticBox(), wxID_ANY, _("Add CA from Store..."), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_root_ca_add_store->SetToolTip( _("Adds a new certificate authority from the certificate store to the list") );
|
||||
|
||||
sb_root_ca_btn->Add( m_root_ca_add_store, 0, wxRIGHT, 5 );
|
||||
|
||||
m_root_ca_add_file = new wxButton( sb_server_trust->GetStaticBox(), wxID_ANY, _("Add CA from File..."), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_root_ca_add_file->SetToolTip( _("Adds a new certificate authority from the file to the list") );
|
||||
|
||||
sb_root_ca_btn->Add( m_root_ca_add_file, 0, wxRIGHT|wxLEFT, 5 );
|
||||
|
||||
m_root_ca_remove = new wxButton( sb_server_trust->GetStaticBox(), wxID_ANY, _("&Remove CA"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_root_ca_remove->Enable( false );
|
||||
m_root_ca_remove->SetToolTip( _("Removes selected certificate authorities from the list") );
|
||||
|
||||
sb_root_ca_btn->Add( m_root_ca_remove, 0, wxLEFT, 5 );
|
||||
|
||||
|
||||
sb_root_ca->Add( sb_root_ca_btn, 0, wxALIGN_RIGHT, 5 );
|
||||
|
||||
|
||||
sb_server_trust_vert->Add( sb_root_ca, 1, wxEXPAND|wxALL, 5 );
|
||||
|
||||
wxBoxSizer* sb_server_names;
|
||||
sb_server_names = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_server_names_label = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("Acceptable server &names:"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_server_names_label->Wrap( -1 );
|
||||
sb_server_names->Add( m_server_names_label, 0, wxBOTTOM, 5 );
|
||||
|
||||
m_server_names = new wxTextCtrl( sb_server_trust->GetStaticBox(), wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_server_names->SetToolTip( _("A semicolon delimited list of acceptable server FQDN names; blank to skip name check; Unicode characters allowed") );
|
||||
|
||||
sb_server_names->Add( m_server_names, 0, wxEXPAND|wxBOTTOM, 5 );
|
||||
|
||||
m_server_names_note = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("(Example: foo.bar.com;server2.bar.com)"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_server_names_note->Wrap( -1 );
|
||||
sb_server_names->Add( m_server_names_note, 0, wxALIGN_RIGHT, 5 );
|
||||
|
||||
|
||||
sb_server_trust_vert->Add( sb_server_names, 0, wxEXPAND|wxALL, 5 );
|
||||
|
||||
|
||||
sb_server_trust_horiz->Add( sb_server_trust_vert, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_server_trust->Add( sb_server_trust_horiz, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
this->SetSizer( sb_server_trust );
|
||||
this->Layout();
|
||||
|
||||
// Connect Events
|
||||
this->Connect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnUpdateUI ) );
|
||||
m_root_ca->Connect( wxEVT_COMMAND_LISTBOX_DOUBLECLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCADClick ), NULL, this );
|
||||
m_root_ca_add_store->Connect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCAAddStore ), NULL, this );
|
||||
m_root_ca_add_file->Connect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCAAddFile ), NULL, this );
|
||||
m_root_ca_remove->Connect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCARemove ), NULL, this );
|
||||
}
|
||||
|
||||
wxEAPTLSServerTrustConfigPanelBase::~wxEAPTLSServerTrustConfigPanelBase()
|
||||
{
|
||||
// Disconnect Events
|
||||
this->Disconnect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnUpdateUI ) );
|
||||
m_root_ca->Disconnect( wxEVT_COMMAND_LISTBOX_DOUBLECLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCADClick ), NULL, this );
|
||||
m_root_ca_add_store->Disconnect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCAAddStore ), NULL, this );
|
||||
m_root_ca_add_file->Disconnect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCAAddFile ), NULL, this );
|
||||
m_root_ca_remove->Disconnect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPTLSServerTrustConfigPanelBase::OnRootCARemove ), NULL, this );
|
||||
|
||||
}
|
||||
|
||||
wxTLSCredentialsPanelBase::wxTLSCredentialsPanelBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
|
||||
{
|
||||
wxStaticBoxSizer* sb_credentials;
|
||||
sb_credentials = new wxStaticBoxSizer( new wxStaticBox( this, wxID_ANY, _("TLS Client Certificate") ), wxVERTICAL );
|
||||
|
||||
wxBoxSizer* sb_credentials_horiz;
|
||||
sb_credentials_horiz = new wxBoxSizer( wxHORIZONTAL );
|
||||
|
||||
m_credentials_icon = new wxStaticBitmap( sb_credentials->GetStaticBox(), wxID_ANY, wxNullBitmap, wxDefaultPosition, wxDefaultSize, 0 );
|
||||
sb_credentials_horiz->Add( m_credentials_icon, 0, wxALL, 5 );
|
||||
|
||||
wxBoxSizer* sb_credentials_vert;
|
||||
sb_credentials_vert = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_credentials_label = new wxStaticText( sb_credentials->GetStaticBox(), wxID_ANY, _("Please select your client certificate to use for authentication."), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_credentials_label->Wrap( 446 );
|
||||
sb_credentials_vert->Add( m_credentials_label, 0, wxALL|wxEXPAND, 5 );
|
||||
|
||||
wxBoxSizer* sb_cert_radio;
|
||||
sb_cert_radio = new wxBoxSizer( wxVERTICAL );
|
||||
|
||||
m_cert_none = new wxRadioButton( sb_credentials->GetStaticBox(), wxID_ANY, _("Co&nnect without providing a client certificate"), wxDefaultPosition, wxDefaultSize, wxRB_GROUP );
|
||||
m_cert_none->SetToolTip( _("Select if your server does not require you to provide a client certificate") );
|
||||
|
||||
sb_cert_radio->Add( m_cert_none, 1, wxEXPAND, 5 );
|
||||
|
||||
wxBoxSizer* sb_cert_select;
|
||||
sb_cert_select = new wxBoxSizer( wxHORIZONTAL );
|
||||
|
||||
m_cert_select = new wxRadioButton( sb_credentials->GetStaticBox(), wxID_ANY, _("Use the following &certificate:"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_cert_select->SetToolTip( _("Select if you need to provide a client certificate when connecting") );
|
||||
|
||||
sb_cert_select->Add( m_cert_select, 0, wxEXPAND, 5 );
|
||||
|
||||
wxArrayString m_cert_select_valChoices;
|
||||
m_cert_select_val = new wxChoice( sb_credentials->GetStaticBox(), wxID_ANY, wxDefaultPosition, wxDefaultSize, m_cert_select_valChoices, wxCB_SORT );
|
||||
m_cert_select_val->SetSelection( 0 );
|
||||
m_cert_select_val->SetToolTip( _("Client certificate to use for authentication") );
|
||||
|
||||
sb_cert_select->Add( m_cert_select_val, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_cert_radio->Add( sb_cert_select, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_credentials_vert->Add( sb_cert_radio, 0, wxEXPAND|wxALL, 5 );
|
||||
|
||||
m_remember = new wxCheckBox( sb_credentials->GetStaticBox(), wxID_ANY, _("&Remember"), wxDefaultPosition, wxDefaultSize, 0 );
|
||||
m_remember->SetHelpText( _("Check if you would like to save certificate selection") );
|
||||
|
||||
sb_credentials_vert->Add( m_remember, 0, wxALL|wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_credentials_horiz->Add( sb_credentials_vert, 1, wxEXPAND, 5 );
|
||||
|
||||
|
||||
sb_credentials->Add( sb_credentials_horiz, 0, wxEXPAND, 5 );
|
||||
|
||||
|
||||
this->SetSizer( sb_credentials );
|
||||
this->Layout();
|
||||
}
|
||||
|
||||
wxTLSCredentialsPanelBase::~wxTLSCredentialsPanelBase()
|
||||
{
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -112,15 +112,14 @@ namespace eap
|
||||
|
||||
/// @}
|
||||
|
||||
protected:
|
||||
///
|
||||
/// Processes an application message
|
||||
/// Generates master session key
|
||||
///
|
||||
/// \param[in] msg Application message data
|
||||
/// \param[in] size_msg Application message data size
|
||||
/// \sa [The EAP-TLS Authentication Protocol (Chapter 2.3. Key Hierarchy)](https://tools.ietf.org/html/rfc5216#section-2.3)
|
||||
///
|
||||
virtual void process_application_data(_In_bytecount_(size_msg) const void *msg, _In_ size_t size_msg);
|
||||
virtual void derive_msk();
|
||||
|
||||
protected:
|
||||
///
|
||||
/// Makes a PAP client message
|
||||
///
|
||||
|
||||
@@ -71,6 +71,23 @@ void eap::method_ttls::process_request_packet(
|
||||
|
||||
// Do the TLS.
|
||||
method_tls::process_request_packet(pReceivedPacket, dwReceivedPacketSize, pEapOutput);
|
||||
|
||||
if (m_phase == phase_application_data) {
|
||||
// Send inner authentication.
|
||||
if (!m_state_client.m_alg_encrypt)
|
||||
throw runtime_error(__FUNCTION__ " Refusing to send credentials unencrypted.");
|
||||
|
||||
m_module.log_event(&EAPMETHOD_TTLS_INNER_CRED, event_data((unsigned int)eap_type_ttls), event_data(m_cred.m_inner->get_name()), event_data::blank);
|
||||
|
||||
m_packet_res.m_code = EapCodeResponse;
|
||||
m_packet_res.m_id = m_packet_req.m_id;
|
||||
m_packet_res.m_flags = 0;
|
||||
sanitizing_blob msg_application(make_message(tls_message_type_application_data, make_pap_client()));
|
||||
m_packet_res.m_data.insert(m_packet_res.m_data.end(), msg_application.begin(), msg_application.end());
|
||||
|
||||
pEapOutput->fAllowNotifications = FALSE;
|
||||
pEapOutput->action = EapPeerMethodResponseActionSend;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -116,13 +133,6 @@ void eap::method_ttls::get_result(
|
||||
throw win_runtime_error(ERROR_NOT_SUPPORTED, __FUNCTION__ " Not supported.");
|
||||
}
|
||||
|
||||
// EAP-TTLS uses different label in PRF for MSK derivation than EAP-TLS.
|
||||
static const DWORD s_key_id = 0x01; // EAP-TTLSv0 Keying Material
|
||||
static const SecPkgContext_EapPrfInfo s_prf_info = { 0, sizeof(s_key_id), (PBYTE)&s_key_id };
|
||||
SECURITY_STATUS status = SetContextAttributes(m_sc_ctx, SECPKG_ATTR_EAP_PRF_INFO, (void*)&s_prf_info, sizeof(s_prf_info));
|
||||
if (FAILED(status))
|
||||
throw sec_runtime_error(status, __FUNCTION__ "Error setting EAP-TTLS PRF in Schannel.");
|
||||
|
||||
// The TLS was OK.
|
||||
method_tls::get_result(EapPeerMethodResultSuccess, ppResult);
|
||||
|
||||
@@ -136,51 +146,37 @@ void eap::method_ttls::get_result(
|
||||
}
|
||||
|
||||
|
||||
void eap::method_ttls::process_application_data(_In_bytecount_(size_msg) const void *msg, _In_ size_t size_msg)
|
||||
void eap::method_ttls::derive_msk()
|
||||
{
|
||||
UNREFERENCED_PARAMETER(msg);
|
||||
UNREFERENCED_PARAMETER(size_msg);
|
||||
//
|
||||
// TLS versions 1.0 [RFC2246] and 1.1 [RFC4346] define the same PRF
|
||||
// function, and any EAP-TTLSv0 implementation based on these versions
|
||||
// of TLS must use the PRF defined therein. It is expected that future
|
||||
// versions of or extensions to the TLS protocol will permit alternative
|
||||
// PRF functions to be negotiated. If an alternative PRF function is
|
||||
// specified for the underlying TLS version or has been negotiated
|
||||
// during the TLS handshake negotiation, then that alternative PRF
|
||||
// function must be used in EAP-TTLSv0 computations instead of the TLS
|
||||
// 1.0/1.1 PRF.
|
||||
//
|
||||
// [Extensible Authentication Protocol Tunneled Transport Layer Security Authenticated Protocol Version 0 (EAP-TTLSv0) (Chapter 7.8. Use of TLS PRF)](https://tools.ietf.org/html/rfc5281#section-7.8)
|
||||
//
|
||||
// If we use PRF_SHA256() the key exchange fails. Therefore we use PRF of TLS 1.0/1.1.
|
||||
//
|
||||
static const unsigned char s_label[] = "ttls keying material";
|
||||
sanitizing_blob seed(s_label, s_label + _countof(s_label) - 1);
|
||||
seed.insert(seed.end(), (const unsigned char*)&m_random_client, (const unsigned char*)(&m_random_client + 1));
|
||||
seed.insert(seed.end(), (const unsigned char*)&m_random_server, (const unsigned char*)(&m_random_server + 1));
|
||||
sanitizing_blob key_block(prf(m_cp, CALG_TLS1PRF, m_master_secret, seed, 2*sizeof(tls_random)));
|
||||
const unsigned char *_key_block = key_block.data();
|
||||
|
||||
// Prepare inner authentication.
|
||||
if (!(m_sc_ctx.m_attrib & ISC_RET_CONFIDENTIALITY))
|
||||
throw runtime_error(__FUNCTION__ " Refusing to send credentials unencrypted.");
|
||||
// MSK: MPPE-Recv-Key
|
||||
memcpy(&m_key_mppe_client, _key_block, sizeof(tls_random));
|
||||
_key_block += sizeof(tls_random);
|
||||
|
||||
m_module.log_event(&EAPMETHOD_TTLS_INNER_CRED, event_data((unsigned int)eap_type_ttls), event_data(m_cred.m_inner->get_name()), event_data::blank);
|
||||
|
||||
SECURITY_STATUS status;
|
||||
|
||||
// Get maximum message sizes.
|
||||
SecPkgContext_StreamSizes sizes;
|
||||
status = QueryContextAttributes(m_sc_ctx, SECPKG_ATTR_STREAM_SIZES, &sizes);
|
||||
if (FAILED(status))
|
||||
throw sec_runtime_error(status, __FUNCTION__ " Error getting Schannel required encryption sizes.");
|
||||
|
||||
// Make PAP message.
|
||||
sanitizing_blob msg_pap(make_pap_client());
|
||||
assert(msg_pap.size() < sizes.cbMaximumMessage);
|
||||
unsigned long size_data = std::min<unsigned long>(sizes.cbMaximumMessage, (unsigned long)msg_pap.size()); // Truncate
|
||||
|
||||
sanitizing_blob data(sizes.cbHeader + size_data + sizes.cbTrailer, 0);
|
||||
memcpy(data.data() + sizes.cbHeader, msg_pap.data(), size_data);
|
||||
|
||||
// Prepare input/output buffer(s).
|
||||
SecBuffer buf[] = {
|
||||
{ sizes.cbHeader, SECBUFFER_STREAM_HEADER , data.data() },
|
||||
{ size_data, SECBUFFER_DATA , data.data() + sizes.cbHeader },
|
||||
{ sizes.cbTrailer, SECBUFFER_STREAM_TRAILER, data.data() + sizes.cbHeader + size_data },
|
||||
{ 0, SECBUFFER_EMPTY , NULL },
|
||||
};
|
||||
SecBufferDesc buf_desc = {
|
||||
SECBUFFER_VERSION,
|
||||
_countof(buf),
|
||||
buf
|
||||
};
|
||||
|
||||
// Encrypt the message.
|
||||
status = EncryptMessage(m_sc_ctx, 0, &buf_desc, 0);
|
||||
if (FAILED(status))
|
||||
throw sec_runtime_error(status, __FUNCTION__ " Error encrypting message.");
|
||||
m_packet_res.m_data.insert(m_packet_res.m_data.end(), (const unsigned char*)buf[0].pvBuffer, (const unsigned char*)buf[0].pvBuffer + buf[0].cbBuffer + buf[1].cbBuffer + buf[2].cbBuffer);
|
||||
// MSK: MPPE-Send-Key
|
||||
memcpy(&m_key_mppe_server, _key_block, sizeof(tls_random));
|
||||
_key_block += sizeof(tls_random);
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -30,4 +30,3 @@
|
||||
#include <WinStd/EAP.h>
|
||||
|
||||
#include <EapHostError.h>
|
||||
#include <schannel.h>
|
||||
|
||||
Reference in New Issue
Block a user