1/**
2 * This file has no copyright assigned and is placed in the Public Domain.
3 * This file is part of the mingw-w64 runtime package.
4 * No warranty is given; refer to the file DISCLAIMER.PD within this package.
5 */
6#ifndef __SCHANNEL_H__
7#define __SCHANNEL_H__
8
9#include <_mingw_unicode.h>
10#include <wincrypt.h>
11
12#define UNISP_NAME_A "Microsoft Unified Security Protocol Provider"
13#define UNISP_NAME_W L"Microsoft Unified Security Protocol Provider"
14
15#define SSL2SP_NAME_A "Microsoft SSL 2.0"
16#define SSL2SP_NAME_W L"Microsoft SSL 2.0"
17
18#define SSL3SP_NAME_A "Microsoft SSL 3.0"
19#define SSL3SP_NAME_W L"Microsoft SSL 3.0"
20
21#define TLS1SP_NAME_A "Microsoft TLS 1.0"
22#define TLS1SP_NAME_W L"Microsoft TLS 1.0"
23
24#define PCT1SP_NAME_A "Microsoft PCT 1.0"
25#define PCT1SP_NAME_W L"Microsoft PCT 1.0"
26
27#define SCHANNEL_NAME_A "Schannel"
28#define SCHANNEL_NAME_W L"Schannel"
29
30#define DEFAULT_TLS_SSP_NAME_A "Default TLS SSP"
31#define DEFAULT_TLS_SSP_NAME_W L"Default TLS SSP"
32
33#define UNISP_NAME __MINGW_NAME_UAW(UNISP_NAME)
34#define PCT1SP_NAME __MINGW_NAME_UAW(PCT1SP_NAME)
35#define SSL2SP_NAME __MINGW_NAME_UAW(SSL2SP_NAME)
36#define SSL3SP_NAME __MINGW_NAME_UAW(SSL3SP_NAME)
37#define TLS1SP_NAME __MINGW_NAME_UAW(TLS1SP_NAME)
38#define SCHANNEL_NAME __MINGW_NAME_UAW(SCHANNEL_NAME)
39#define DEFAULT_TLS_SSP_NAME __MINGW_NAME_UAW(DEFAULT_TLS_SSP_NAME_W)
40
41typedef enum _eTlsSignatureAlgorithm {
42 TlsSignatureAlgorithm_Anonymous = 0,
43 TlsSignatureAlgorithm_Rsa = 1,
44 TlsSignatureAlgorithm_Dsa = 2,
45 TlsSignatureAlgorithm_Ecdsa = 3
46} eTlsSignatureAlgorithm;
47
48typedef enum _eTlsHashAlgorithm {
49 TlsHashAlgorithm_None = 0,
50 TlsHashAlgorithm_Md5 = 1,
51 TlsHashAlgorithm_Sha1 = 2,
52 TlsHashAlgorithm_Sha224 = 3,
53 TlsHashAlgorithm_Sha256 = 4,
54 TlsHashAlgorithm_Sha384 = 5,
55 TlsHashAlgorithm_Sha512 = 6
56} eTlsHashAlgorithm;
57
58#define UNISP_RPC_ID 14
59
60#define SECPKG_ATTR_ISSUER_LIST 0x50
61#define SECPKG_ATTR_REMOTE_CRED 0x51
62#define SECPKG_ATTR_LOCAL_CRED 0x52
63#define SECPKG_ATTR_REMOTE_CERT_CONTEXT 0x53
64#define SECPKG_ATTR_LOCAL_CERT_CONTEXT 0x54
65#define SECPKG_ATTR_ROOT_STORE 0x55
66#define SECPKG_ATTR_SUPPORTED_ALGS 0x56
67#define SECPKG_ATTR_CIPHER_STRENGTHS 0x57
68#define SECPKG_ATTR_SUPPORTED_PROTOCOLS 0x58
69#define SECPKG_ATTR_ISSUER_LIST_EX 0x59
70#define SECPKG_ATTR_CONNECTION_INFO 0x5a
71#define SECPKG_ATTR_EAP_KEY_BLOCK 0x5b
72#define SECPKG_ATTR_MAPPED_CRED_ATTR 0x5c
73#define SECPKG_ATTR_SESSION_INFO 0x5d
74#define SECPKG_ATTR_APP_DATA 0x5e
75#define SECPKG_ATTR_REMOTE_CERTIFICATES 0x5F
76#define SECPKG_ATTR_CLIENT_CERT_POLICY 0x60
77#define SECPKG_ATTR_CC_POLICY_RESULT 0x61
78#define SECPKG_ATTR_USE_NCRYPT 0x62
79#define SECPKG_ATTR_LOCAL_CERT_INFO 0x63
80#define SECPKG_ATTR_CIPHER_INFO 0x64
81#define SECPKG_ATTR_EAP_PRF_INFO 0x65
82#define SECPKG_ATTR_SUPPORTED_SIGNATURES 0x66
83#define SECPKG_ATTR_REMOTE_CERT_CHAIN 0x67
84#define SECPKG_ATTR_UI_INFO 0x68
85#define SECPKG_ATTR_EARLY_START 0x69
86#define SECPKG_ATTR_KEYING_MATERIAL_INFO 0x6a
87#define SECPKG_ATTR_KEYING_MATERIAL 0x6b
88#define SECPKG_ATTR_SRTP_PARAMETERS 0x6c
89#define SECPKG_ATTR_TOKEN_BINDING 0x6d
90#define SECPKG_ATTR_CONNECTION_INFO_EX 0x6e
91#define SECPKG_ATTR_KEYING_MATERIAL_TOKEN_BINDING 0x6f
92#define SECPKG_ATTR_KEYING_MATERIAL_INPROC 0x70
93
94typedef struct _SecPkgContext_IssuerListInfo {
95 DWORD cbIssuerList;
96 PBYTE pIssuerList;
97} SecPkgContext_IssuerListInfo,*PSecPkgContext_IssuerListInfo;
98
99typedef struct _SecPkgContext_RemoteCredentialInfo {
100 DWORD cbCertificateChain;
101 PBYTE pbCertificateChain;
102 DWORD cCertificates;
103 DWORD fFlags;
104 DWORD dwBits;
105} SecPkgContext_RemoteCredentialInfo,*PSecPkgContext_RemoteCredentialInfo;
106
107typedef SecPkgContext_RemoteCredentialInfo SecPkgContext_RemoteCredenitalInfo,*PSecPkgContext_RemoteCredenitalInfo;
108
109#define RCRED_STATUS_NOCRED 0x00000000
110#define RCRED_CRED_EXISTS 0x00000001
111#define RCRED_STATUS_UNKNOWN_ISSUER 0x00000002
112
113typedef struct _SecPkgContext_LocalCredentialInfo {
114 DWORD cbCertificateChain;
115 PBYTE pbCertificateChain;
116 DWORD cCertificates;
117 DWORD fFlags;
118 DWORD dwBits;
119} SecPkgContext_LocalCredentialInfo,*PSecPkgContext_LocalCredentialInfo;
120
121typedef SecPkgContext_LocalCredentialInfo SecPkgContext_LocalCredenitalInfo,*PSecPkgContext_LocalCredenitalInfo;
122
123#define LCRED_STATUS_NOCRED 0x00000000
124#define LCRED_CRED_EXISTS 0x00000001
125#define LCRED_STATUS_UNKNOWN_ISSUER 0x00000002
126
127typedef unsigned int ALG_ID;
128
129typedef struct _SecPkgCred_SupportedAlgs {
130 DWORD cSupportedAlgs;
131 ALG_ID *palgSupportedAlgs;
132} SecPkgCred_SupportedAlgs,*PSecPkgCred_SupportedAlgs;
133
134typedef struct _SecPkgCred_CipherStrengths {
135 DWORD dwMinimumCipherStrength;
136 DWORD dwMaximumCipherStrength;
137} SecPkgCred_CipherStrengths,*PSecPkgCred_CipherStrengths;
138
139typedef struct _SecPkgCred_SupportedProtocols {
140 DWORD grbitProtocol;
141} SecPkgCred_SupportedProtocols,*PSecPkgCred_SupportedProtocols;
142
143typedef struct _SecPkgCred_ClientCertPolicy {
144 DWORD dwFlags;
145 GUID guidPolicyId;
146 DWORD dwCertFlags;
147 DWORD dwUrlRetrievalTimeout;
148 WINBOOL fCheckRevocationFreshnessTime;
149 DWORD dwRevocationFreshnessTime;
150 WINBOOL fOmitUsageCheck;
151 LPWSTR pwszSslCtlStoreName;
152 LPWSTR pwszSslCtlIdentifier;
153} SecPkgCred_ClientCertPolicy, *PSecPkgCred_ClientCertPolicy;
154
155typedef struct _SecPkgContext_ClientCertPolicyResult {
156 HRESULT dwPolicyResult;
157 GUID guidPolicyId;
158} SecPkgContext_ClientCertPolicyResult, *PSecPkgContext_ClientCertPolicyResult;
159
160typedef struct _SecPkgContext_IssuerListInfoEx {
161 PCERT_NAME_BLOB aIssuers;
162 DWORD cIssuers;
163} SecPkgContext_IssuerListInfoEx,*PSecPkgContext_IssuerListInfoEx;
164
165typedef struct _SecPkgContext_ConnectionInfo {
166 DWORD dwProtocol;
167 ALG_ID aiCipher;
168 DWORD dwCipherStrength;
169 ALG_ID aiHash;
170 DWORD dwHashStrength;
171 ALG_ID aiExch;
172 DWORD dwExchStrength;
173} SecPkgContext_ConnectionInfo,*PSecPkgContext_ConnectionInfo;
174
175#define SZ_ALG_MAX_SIZE 64
176
177#define SECPKGCONTEXT_CONNECTION_INFO_EX_V1 1
178
179typedef struct _SecPkgContext_ConnectionInfoEx {
180 DWORD dwVersion;
181 DWORD dwProtocol;
182 WCHAR szCipher[SZ_ALG_MAX_SIZE];
183 DWORD dwCipherStrength;
184 WCHAR szHash[SZ_ALG_MAX_SIZE];
185 DWORD dwHashStrength;
186 WCHAR szExchange[SZ_ALG_MAX_SIZE];
187 DWORD dwExchStrength;
188} SecPkgContext_ConnectionInfoEx, *PSecPkgContext_ConnectionInfoEx;
189
190#define SECPKGCONTEXT_CIPHERINFO_V1 1
191
192typedef struct _SecPkgContext_CipherInfo {
193 DWORD dwVersion;
194 DWORD dwProtocol;
195 DWORD dwCipherSuite;
196 DWORD dwBaseCipherSuite;
197 WCHAR szCipherSuite[SZ_ALG_MAX_SIZE];
198 WCHAR szCipher[SZ_ALG_MAX_SIZE];
199 DWORD dwCipherLen;
200 DWORD dwCipherBlockLen;
201 WCHAR szHash[SZ_ALG_MAX_SIZE];
202 DWORD dwHashLen;
203 WCHAR szExchange[SZ_ALG_MAX_SIZE];
204 DWORD dwMinExchangeLen;
205 DWORD dwMaxExchangeLen;
206 WCHAR szCertificate[SZ_ALG_MAX_SIZE];
207 DWORD dwKeyType;
208} SecPkgContext_CipherInfo, *PSecPkgContext_CipherInfo;
209
210typedef struct _SecPkgContext_EapKeyBlock {
211 BYTE rgbKeys[128];
212 BYTE rgbIVs[64];
213} SecPkgContext_EapKeyBlock,*PSecPkgContext_EapKeyBlock;
214
215typedef struct _SecPkgContext_MappedCredAttr {
216 DWORD dwAttribute;
217 PVOID pvBuffer;
218} SecPkgContext_MappedCredAttr,*PSecPkgContext_MappedCredAttr;
219
220#define SSL_SESSION_RECONNECT 1
221
222typedef struct _SecPkgContext_SessionInfo {
223 DWORD dwFlags;
224 DWORD cbSessionId;
225 BYTE rgbSessionId[32];
226} SecPkgContext_SessionInfo,*PSecPkgContext_SessionInfo;
227
228typedef struct _SecPkgContext_SessionAppData {
229 DWORD dwFlags;
230 DWORD cbAppData;
231 PBYTE pbAppData;
232} SecPkgContext_SessionAppData,*PSecPkgContext_SessionAppData;
233
234typedef struct _SecPkgContext_EapPrfInfo {
235 DWORD dwVersion;
236 DWORD cbPrfData;
237 PBYTE pbPrfData;
238} SecPkgContext_EapPrfInfo, *PSecPkgContext_EapPrfInfo;
239
240typedef struct _SecPkgContext_SupportedSignatures {
241 WORD cSignatureAndHashAlgorithms;
242 WORD *pSignatureAndHashAlgorithms;
243} SecPkgContext_SupportedSignatures, *PSecPkgContext_SupportedSignatures;
244
245typedef struct _SecPkgContext_Certificates {
246 DWORD cCertificates;
247 DWORD cbCertificateChain;
248 PBYTE pbCertificateChain;
249} SecPkgContext_Certificates, *PSecPkgContext_Certificates;
250
251typedef struct _SecPkgContext_CertInfo {
252 DWORD dwVersion;
253 DWORD cbSubjectName;
254 LPWSTR pwszSubjectName;
255 DWORD cbIssuerName;
256 LPWSTR pwszIssuerName;
257 DWORD dwKeySize;
258} SecPkgContext_CertInfo, *PSecPkgContext_CertInfo;
259
260#define KERN_CONTEXT_CERT_INFO_V1 0x00000000
261
262typedef struct _SecPkgContext_UiInfo {
263 HWND hParentWindow;
264} SecPkgContext_UiInfo, *PSecPkgContext_UiInfo;
265
266typedef struct _SecPkgContext_EarlyStart {
267 DWORD dwEarlyStartFlags;
268} SecPkgContext_EarlyStart, *PSecPkgContext_EarlyStart;
269
270#define ENABLE_TLS_CLIENT_EARLY_START 0x00000001
271
272typedef struct _SecPkgContext_KeyingMaterialInfo {
273 WORD cbLabel;
274 LPSTR pszLabel;
275 WORD cbContextValue;
276 PBYTE pbContextValue;
277 DWORD cbKeyingMaterial;
278} SecPkgContext_KeyingMaterialInfo, *PSecPkgContext_KeyingMaterialInfo;
279
280typedef struct _SecPkgContext_KeyingMaterial {
281 DWORD cbKeyingMaterial;
282 PBYTE pbKeyingMaterial;
283} SecPkgContext_KeyingMaterial, *PSecPkgContext_KeyingMaterial;
284
285typedef struct _SecPkgContext_KeyingMaterial_Inproc {
286 WORD cbLabel;
287 LPSTR pszLabel;
288 WORD cbContextValue;
289 PBYTE pbContextValue;
290 DWORD cbKeyingMaterial;
291 PBYTE pbKeyingMaterial;
292} SecPkgContext_KeyingMaterial_Inproc, *PSecPkgContext_KeyingMaterial_Inproc;
293
294typedef struct _SecPkgContext_SrtpParameters {
295 WORD ProtectionProfile;
296 BYTE MasterKeyIdentifierSize;
297 PBYTE MasterKeyIdentifier;
298} SecPkgContext_SrtpParameters, *PSecPkgContext_SrtpParameters;
299
300typedef struct _SecPkgContext_TokenBinding {
301 BYTE MajorVersion;
302 BYTE MinorVersion;
303 WORD KeyParametersSize;
304 PBYTE KeyParameters;
305} SecPkgContext_TokenBinding, *PSecPkgContext_TokenBinding;
306
307#define SCH_CRED_V1 0x00000001
308#define SCH_CRED_V2 0x00000002
309#define SCH_CRED_VERSION 0x00000002
310#define SCH_CRED_V3 0x00000003
311#define SCHANNEL_CRED_VERSION 0x00000004
312#define SCH_CREDENTIALS_VERSION 0x00000005
313
314struct _HMAPPER;
315
316typedef struct _SCHANNEL_CRED {
317 DWORD dwVersion;
318 DWORD cCreds;
319 PCCERT_CONTEXT *paCred;
320 HCERTSTORE hRootStore;
321 DWORD cMappers;
322 struct _HMAPPER **aphMappers;
323 DWORD cSupportedAlgs;
324 ALG_ID *palgSupportedAlgs;
325 DWORD grbitEnabledProtocols;
326 DWORD dwMinimumCipherStrength;
327 DWORD dwMaximumCipherStrength;
328 DWORD dwSessionLifespan;
329 DWORD dwFlags;
330 DWORD dwCredFormat;
331} SCHANNEL_CRED,*PSCHANNEL_CRED;
332
333#ifdef SCHANNEL_USE_BLACKLISTS
334
335typedef enum _eTlsAlgorithmUsage {
336 TlsParametersCngAlgUsageKeyExchange,
337 TlsParametersCngAlgUsageSignature,
338 TlsParametersCngAlgUsageCipher,
339 TlsParametersCngAlgUsageDigest,
340 TlsParametersCngAlgUsageCertSig
341} eTlsAlgorithmUsage;
342
343typedef struct _CRYPTO_SETTINGS {
344 eTlsAlgorithmUsage eAlgorithmUsage;
345 UNICODE_STRING strCngAlgId;
346 DWORD cChainingModes;
347 PUNICODE_STRING rgstrChainingModes;
348 DWORD dwMinBitLength;
349 DWORD dwMaxBitLength;
350} CRYPTO_SETTINGS, *PCRYPTO_SETTINGS;
351
352typedef struct _TLS_PARAMETERS {
353 DWORD cAlpnIds;
354 PUNICODE_STRING rgstrAlpnIds;
355 DWORD grbitDisabledProtocols;
356 DWORD cDisabledCrypto;
357 PCRYPTO_SETTINGS pDisabledCrypto;
358 DWORD dwFlags;
359} TLS_PARAMETERS, *PTLS_PARAMETERS;
360
361#define TLS_PARAMS_OPTIONAL 0x00000001
362
363typedef struct _SCH_CREDENTIALS {
364 DWORD dwVersion;
365 DWORD dwCredFormat;
366 DWORD cCreds;
367 PCCERT_CONTEXT *paCred;
368 HCERTSTORE hRootStore;
369 DWORD cMappers;
370 struct _HMAPPER **aphMappers;
371 DWORD dwSessionLifespan;
372 DWORD dwFlags;
373 DWORD cTlsParameters;
374 PTLS_PARAMETERS pTlsParameters;
375} SCH_CREDENTIALS, *PSCH_CREDENTIALS;
376
377#define SCH_CRED_MAX_SUPPORTED_PARAMETERS 16
378#define SCH_CRED_MAX_SUPPORTED_ALPN_IDS 16
379#define SCH_CRED_MAX_SUPPORTED_CRYPTO_SETTINGS 16
380#define SCH_CRED_MAX_SUPPORTED_CHAINING_MODES 16
381
382#endif /* SCHANNEL_USE_BLACKLISTS */
383
384typedef struct _SEND_GENERIC_TLS_EXTENSION {
385 WORD ExtensionType;
386 WORD HandshakeType;
387 DWORD Flags;
388 WORD BufferSize;
389 UCHAR Buffer[ANYSIZE_ARRAY];
390} SEND_GENERIC_TLS_EXTENSION, *PSEND_GENERIC_TLS_EXTENSION;
391
392typedef struct _TLS_EXTENSION_SUBSCRIPTION {
393 WORD ExtensionType;
394 WORD HandshakeType;
395} TLS_EXTENSION_SUBSCRIPTION, *PTLS_EXTENSION_SUBSCRIPTION;
396
397typedef struct _SUBSCRIBE_GENERIC_TLS_EXTENSION {
398 DWORD Flags;
399 DWORD SubscriptionsCount;
400 TLS_EXTENSION_SUBSCRIPTION Subscriptions[ANYSIZE_ARRAY];
401} SUBSCRIBE_GENERIC_TLS_EXTENSION, *PSUBSCRIBE_GENERIC_TLS_EXTENSION;
402
403#define SCH_MAX_EXT_SUBSCRIPTIONS 2
404
405#define SCH_CRED_FORMAT_CERT_CONTEXT 0x00000000
406#define SCH_CRED_FORMAT_CERT_HASH 0x00000001
407#define SCH_CRED_FORMAT_CERT_HASH_STORE 0x00000002
408
409#define SCH_CRED_MAX_STORE_NAME_SIZE 128
410#define SCH_CRED_MAX_SUPPORTED_ALGS 256
411#define SCH_CRED_MAX_SUPPORTED_CERTS 100
412
413typedef struct _SCHANNEL_CERT_HASH {
414 DWORD dwLength;
415 DWORD dwFlags;
416 HCRYPTPROV hProv;
417 BYTE ShaHash[20];
418} SCHANNEL_CERT_HASH,*PSCHANNEL_CERT_HASH;
419
420typedef struct _SCHANNEL_CERT_HASH_STORE {
421 DWORD dwLength;
422 DWORD dwFlags;
423 HCRYPTPROV hProv;
424 BYTE ShaHash[20];
425 WCHAR pwszStoreName[SCH_CRED_MAX_STORE_NAME_SIZE];
426} SCHANNEL_CERT_HASH_STORE, *PSCHANNEL_CERT_HASH_STORE;
427
428#define SCH_MACHINE_CERT_HASH 0x00000001
429
430#define SCH_CRED_NO_SYSTEM_MAPPER 0x00000002
431#define SCH_CRED_NO_SERVERNAME_CHECK 0x00000004
432#define SCH_CRED_MANUAL_CRED_VALIDATION 0x00000008
433#define SCH_CRED_NO_DEFAULT_CREDS 0x00000010
434#define SCH_CRED_AUTO_CRED_VALIDATION 0x00000020
435#define SCH_CRED_USE_DEFAULT_CREDS 0x00000040
436#define SCH_CRED_DISABLE_RECONNECTS 0x00000080
437
438#define SCH_CRED_REVOCATION_CHECK_END_CERT 0x00000100
439#define SCH_CRED_REVOCATION_CHECK_CHAIN 0x00000200
440#define SCH_CRED_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT 0x00000400
441#define SCH_CRED_IGNORE_NO_REVOCATION_CHECK 0x00000800
442#define SCH_CRED_IGNORE_REVOCATION_OFFLINE 0x00001000
443
444#define SCH_CRED_RESTRICTED_ROOTS 0x00002000
445#define SCH_CRED_REVOCATION_CHECK_CACHE_ONLY 0x00004000
446#define SCH_CRED_CACHE_ONLY_URL_RETRIEVAL 0x00008000
447
448#define SCH_CRED_MEMORY_STORE_CERT 0x00010000
449
450#define SCH_CRED_CACHE_ONLY_URL_RETRIEVAL_ON_CREATE 0x00020000
451
452#define SCH_SEND_ROOT_CERT 0x00040000
453#define SCH_CRED_SNI_CREDENTIAL 0x00080000
454#define SCH_CRED_SNI_ENABLE_OCSP 0x00100000
455#define SCH_SEND_AUX_RECORD 0x00200000
456#define SCH_USE_STRONG_CRYPTO 0x00400000
457#define SCH_USE_PRESHAREDKEY_ONLY 0x00800000
458#define SCH_USE_DTLS_ONLY 0x01000000
459#define SCH_ALLOW_NULL_ENCRYPTION 0x02000000
460
461#define SCHANNEL_RENEGOTIATE 0
462#define SCHANNEL_SHUTDOWN 1
463#define SCHANNEL_ALERT 2
464#define SCHANNEL_SESSION 3
465
466typedef struct _SCHANNEL_ALERT_TOKEN {
467 DWORD dwTokenType;
468 DWORD dwAlertType;
469 DWORD dwAlertNumber;
470} SCHANNEL_ALERT_TOKEN;
471
472#define TLS1_ALERT_WARNING 1
473#define TLS1_ALERT_FATAL 2
474
475#define TLS1_ALERT_CLOSE_NOTIFY 0
476#define TLS1_ALERT_UNEXPECTED_MESSAGE 10
477#define TLS1_ALERT_BAD_RECORD_MAC 20
478#define TLS1_ALERT_DECRYPTION_FAILED 21
479#define TLS1_ALERT_RECORD_OVERFLOW 22
480#define TLS1_ALERT_DECOMPRESSION_FAIL 30
481#define TLS1_ALERT_HANDSHAKE_FAILURE 40
482#define TLS1_ALERT_BAD_CERTIFICATE 42
483#define TLS1_ALERT_UNSUPPORTED_CERT 43
484#define TLS1_ALERT_CERTIFICATE_REVOKED 44
485#define TLS1_ALERT_CERTIFICATE_EXPIRED 45
486#define TLS1_ALERT_CERTIFICATE_UNKNOWN 46
487#define TLS1_ALERT_ILLEGAL_PARAMETER 47
488#define TLS1_ALERT_UNKNOWN_CA 48
489#define TLS1_ALERT_ACCESS_DENIED 49
490#define TLS1_ALERT_DECODE_ERROR 50
491#define TLS1_ALERT_DECRYPT_ERROR 51
492#define TLS1_ALERT_EXPORT_RESTRICTION 60
493#define TLS1_ALERT_PROTOCOL_VERSION 70
494#define TLS1_ALERT_INSUFFIENT_SECURITY 71
495#define TLS1_ALERT_INTERNAL_ERROR 80
496#define TLS1_ALERT_USER_CANCELED 90
497#define TLS1_ALERT_NO_RENEGOTIATION 100
498#define TLS1_ALERT_UNSUPPORTED_EXT 110
499#define TLS1_ALERT_UNKNOWN_PSK_IDENTITY 115
500#define TLS1_ALERT_NO_APP_PROTOCOL 120
501
502#define SSL_SESSION_ENABLE_RECONNECTS 1
503#define SSL_SESSION_DISABLE_RECONNECTS 2
504
505typedef struct _SCHANNEL_SESSION_TOKEN {
506 DWORD dwTokenType;
507 DWORD dwFlags;
508} SCHANNEL_SESSION_TOKEN;
509
510typedef struct _SCHANNEL_CLIENT_SIGNATURE {
511 DWORD cbLength;
512 ALG_ID aiHash;
513 DWORD cbHash;
514 BYTE HashValue[36];
515 BYTE CertThumbprint[20];
516} SCHANNEL_CLIENT_SIGNATURE, *PSCHANNEL_CLIENT_SIGNATURE;
517
518#define CERT_SCHANNEL_IIS_PRIVATE_KEY_PROP_ID (CERT_FIRST_USER_PROP_ID + 0)
519#define CERT_SCHANNEL_IIS_PASSWORD_PROP_ID (CERT_FIRST_USER_PROP_ID + 1)
520#define CERT_SCHANNEL_SGC_CERTIFICATE_PROP_ID (CERT_FIRST_USER_PROP_ID + 2)
521
522#define SP_PROT_PCT1_SERVER 0x00000001
523#define SP_PROT_PCT1_CLIENT 0x00000002
524#define SP_PROT_PCT1 (SP_PROT_PCT1_SERVER | SP_PROT_PCT1_CLIENT)
525
526#define SP_PROT_SSL2_SERVER 0x00000004
527#define SP_PROT_SSL2_CLIENT 0x00000008
528#define SP_PROT_SSL2 (SP_PROT_SSL2_SERVER | SP_PROT_SSL2_CLIENT)
529
530#define SP_PROT_SSL3_SERVER 0x00000010
531#define SP_PROT_SSL3_CLIENT 0x00000020
532#define SP_PROT_SSL3 (SP_PROT_SSL3_SERVER | SP_PROT_SSL3_CLIENT)
533
534#define SP_PROT_TLS1_SERVER 0x00000040
535#define SP_PROT_TLS1_CLIENT 0x00000080
536#define SP_PROT_TLS1 (SP_PROT_TLS1_SERVER | SP_PROT_TLS1_CLIENT)
537
538#define SP_PROT_SSL3TLS1_CLIENTS (SP_PROT_TLS1_CLIENT | SP_PROT_SSL3_CLIENT)
539#define SP_PROT_SSL3TLS1_SERVERS (SP_PROT_TLS1_SERVER | SP_PROT_SSL3_SERVER)
540#define SP_PROT_SSL3TLS1 (SP_PROT_SSL3 | SP_PROT_TLS1)
541
542#define SP_PROT_UNI_SERVER 0x40000000
543#define SP_PROT_UNI_CLIENT 0x80000000
544#define SP_PROT_UNI (SP_PROT_UNI_SERVER | SP_PROT_UNI_CLIENT)
545
546#define SP_PROT_ALL 0xffffffff
547#define SP_PROT_NONE 0
548#define SP_PROT_CLIENTS (SP_PROT_PCT1_CLIENT | SP_PROT_SSL2_CLIENT | SP_PROT_SSL3_CLIENT | SP_PROT_UNI_CLIENT | SP_PROT_TLS1_CLIENT)
549#define SP_PROT_SERVERS (SP_PROT_PCT1_SERVER | SP_PROT_SSL2_SERVER | SP_PROT_SSL3_SERVER | SP_PROT_UNI_SERVER | SP_PROT_TLS1_SERVER)
550
551#define SP_PROT_TLS1_0_SERVER SP_PROT_TLS1_SERVER
552#define SP_PROT_TLS1_0_CLIENT SP_PROT_TLS1_CLIENT
553#define SP_PROT_TLS1_0 (SP_PROT_TLS1_0_SERVER | SP_PROT_TLS1_0_CLIENT)
554
555#define SP_PROT_TLS1_1_SERVER 0x00000100
556#define SP_PROT_TLS1_1_CLIENT 0x00000200
557#define SP_PROT_TLS1_1 (SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_1_CLIENT)
558
559#define SP_PROT_TLS1_2_SERVER 0x00000400
560#define SP_PROT_TLS1_2_CLIENT 0x00000800
561#define SP_PROT_TLS1_2 (SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_2_CLIENT)
562
563#define SP_PROT_TLS1_3_SERVER 0x00001000
564#define SP_PROT_TLS1_3_CLIENT 0x00002000
565#define SP_PROT_TLS1_3 (SP_PROT_TLS1_3_SERVER | SP_PROT_TLS1_3_CLIENT)
566
567#define SP_PROT_DTLS_SERVER 0x00010000
568#define SP_PROT_DTLS_CLIENT 0x00020000
569#define SP_PROT_DTLS (SP_PROT_DTLS_SERVER | SP_PROT_DTLS_CLIENT )
570
571#define SP_PROT_DTLS1_0_SERVER SP_PROT_DTLS_SERVER
572#define SP_PROT_DTLS1_0_CLIENT SP_PROT_DTLS_CLIENT
573#define SP_PROT_DTLS1_0 (SP_PROT_DTLS1_0_SERVER | SP_PROT_DTLS1_0_CLIENT)
574
575#define SP_PROT_DTLS1_2_SERVER 0x00040000
576#define SP_PROT_DTLS1_2_CLIENT 0x00080000
577#define SP_PROT_DTLS1_2 (SP_PROT_DTLS1_2_SERVER | SP_PROT_DTLS1_2_CLIENT)
578
579#define SP_PROT_DTLS1_X_SERVER (SP_PROT_DTLS1_0_SERVER | SP_PROT_DTLS1_2_SERVER)
580#define SP_PROT_DTLS1_X_CLIENT (SP_PROT_DTLS1_0_CLIENT | SP_PROT_DTLS1_2_CLIENT)
581#define SP_PROT_DTLS1_X (SP_PROT_DTLS1_X_SERVER | SP_PROT_DTLS1_X_CLIENT)
582
583#define SP_PROT_TLS1_1PLUS_SERVER (SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_3_SERVER)
584#define SP_PROT_TLS1_1PLUS_CLIENT (SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_3_CLIENT)
585#define SP_PROT_TLS1_1PLUS (SP_PROT_TLS1_1PLUS_SERVER | SP_PROT_TLS1_1PLUS_CLIENT)
586
587#define SP_PROT_TLS1_3PLUS_SERVER SP_PROT_TLS1_3_SERVER
588#define SP_PROT_TLS1_3PLUS_CLIENT SP_PROT_TLS1_3_CLIENT
589#define SP_PROT_TLS1_3PLUS (SP_PROT_TLS1_3PLUS_SERVER | SP_PROT_TLS1_3PLUS_CLIENT)
590
591#define SP_PROT_TLS1_X_SERVER (SP_PROT_TLS1_0_SERVER | SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_3_SERVER)
592#define SP_PROT_TLS1_X_CLIENT (SP_PROT_TLS1_0_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_3_CLIENT)
593#define SP_PROT_TLS1_X (SP_PROT_TLS1_X_SERVER | SP_PROT_TLS1_X_CLIENT)
594
595#define SP_PROT_SSL3TLS1_X_CLIENTS (SP_PROT_TLS1_X_CLIENT | SP_PROT_SSL3_CLIENT)
596#define SP_PROT_SSL3TLS1_X_SERVERS (SP_PROT_TLS1_X_SERVER | SP_PROT_SSL3_SERVER)
597#define SP_PROT_SSL3TLS1_X (SP_PROT_SSL3 | SP_PROT_TLS1_X)
598
599#define SP_PROT_X_CLIENTS (SP_PROT_CLIENTS | SP_PROT_TLS1_X_CLIENT | SP_PROT_DTLS1_X_CLIENT )
600#define SP_PROT_X_SERVERS (SP_PROT_SERVERS | SP_PROT_TLS1_X_SERVER | SP_PROT_DTLS1_X_SERVER )
601
602typedef WINBOOL (*SSL_EMPTY_CACHE_FN_A)(LPSTR pszTargetName,DWORD dwFlags);
603
604WINBOOL SslEmptyCacheA(LPSTR pszTargetName,DWORD dwFlags);
605
606typedef WINBOOL (*SSL_EMPTY_CACHE_FN_W)(LPWSTR pszTargetName,DWORD dwFlags);
607
608WINBOOL SslEmptyCacheW(LPWSTR pszTargetName,DWORD dwFlags);
609
610#define SSL_EMPTY_CACHE_FN __MINGW_NAME_UAW(SSL_EMPTY_CACHE_FN)
611#define SslEmptyCache __MINGW_NAME_AW(SslEmptyCache)
612
613typedef struct _SSL_CREDENTIAL_CERTIFICATE {
614 DWORD cbPrivateKey;
615 PBYTE pPrivateKey;
616 DWORD cbCertificate;
617 PBYTE pCertificate;
618 PSTR pszPassword;
619} SSL_CREDENTIAL_CERTIFICATE,*PSSL_CREDENTIAL_CERTIFICATE;
620
621#define SCHANNEL_SECRET_TYPE_CAPI 0x00000001
622#define SCHANNEL_SECRET_PRIVKEY 0x00000002
623#define SCH_CRED_X509_CERTCHAIN 0x00000001
624#define SCH_CRED_X509_CAPI 0x00000002
625#define SCH_CRED_CERT_CONTEXT 0x00000003
626
627struct _HMAPPER;
628typedef struct _SCH_CRED {
629 DWORD dwVersion;
630 DWORD cCreds;
631 PVOID *paSecret;
632 PVOID *paPublic;
633 DWORD cMappers;
634 struct _HMAPPER **aphMappers;
635} SCH_CRED,*PSCH_CRED;
636
637typedef struct _SCH_CRED_SECRET_CAPI {
638 DWORD dwType;
639 HCRYPTPROV hProv;
640} SCH_CRED_SECRET_CAPI,*PSCH_CRED_SECRET_CAPI;
641
642typedef struct _SCH_CRED_SECRET_PRIVKEY {
643 DWORD dwType;
644 PBYTE pPrivateKey;
645 DWORD cbPrivateKey;
646 PSTR pszPassword;
647} SCH_CRED_SECRET_PRIVKEY,*PSCH_CRED_SECRET_PRIVKEY;
648
649typedef struct _SCH_CRED_PUBLIC_CERTCHAIN {
650 DWORD dwType;
651 DWORD cbCertChain;
652 PBYTE pCertChain;
653} SCH_CRED_PUBLIC_CERTCHAIN,*PSCH_CRED_PUBLIC_CERTCHAIN;
654
655typedef struct _SCH_CRED_PUBLIC_CAPI {
656 DWORD dwType;
657 HCRYPTPROV hProv;
658} SCH_CRED_PUBLIC_CAPI,*PSCH_CRED_PUBLIC_CAPI;
659
660typedef struct _PctPublicKey {
661 DWORD Type;
662 DWORD cbKey;
663 UCHAR pKey[1];
664} PctPublicKey;
665
666typedef struct _X509Certificate {
667 DWORD Version;
668 DWORD SerialNumber[4];
669 ALG_ID SignatureAlgorithm;
670 FILETIME ValidFrom;
671 FILETIME ValidUntil;
672 PSTR pszIssuer;
673 PSTR pszSubject;
674 PctPublicKey *pPublicKey;
675} X509Certificate,*PX509Certificate;
676
677WINBOOL SslGenerateKeyPair(PSSL_CREDENTIAL_CERTIFICATE pCerts,PSTR pszDN,PSTR pszPassword,DWORD Bits);
678VOID SslGenerateRandomBits(PUCHAR pRandomData,LONG cRandomData);
679WINBOOL SslCrackCertificate(PUCHAR pbCertificate,DWORD cbCertificate,DWORD dwFlags,PX509Certificate *ppCertificate);
680VOID SslFreeCertificate(PX509Certificate pCertificate);
681DWORD WINAPI SslGetMaximumKeySize(DWORD Reserved);
682WINBOOL SslGetDefaultIssuers(PBYTE pbIssuers,DWORD *pcbIssuers);
683
684#define SSL_CRACK_CERTIFICATE_NAME TEXT("SslCrackCertificate")
685#define SSL_FREE_CERTIFICATE_NAME TEXT("SslFreeCertificate")
686
687typedef WINBOOL (WINAPI *SSL_CRACK_CERTIFICATE_FN)(PUCHAR pbCertificate,DWORD cbCertificate,WINBOOL VerifySignature,PX509Certificate *ppCertificate);
688typedef VOID (WINAPI *SSL_FREE_CERTIFICATE_FN)(PX509Certificate pCertificate);
689
690typedef SECURITY_STATUS (WINAPI *SslGetServerIdentityFn)(PBYTE ClientHello, DWORD ClientHelloSize, PBYTE *ServerIdentity, PDWORD ServerIdentitySize, DWORD Flags);
691SECURITY_STATUS WINAPI SslGetServerIdentity(PBYTE ClientHello, DWORD ClientHelloSize, PBYTE *ServerIdentity, PDWORD ServerIdentitySize, DWORD Flags);
692
693#if NTDDI_VERSION >= NTDDI_WIN10_19H1
694
695typedef struct _SCH_EXTENSION_DATA {
696 WORD ExtensionType;
697 const BYTE *pExtData;
698 DWORD cbExtData;
699}SCH_EXTENSION_DATA;
700
701typedef enum _SchGetExtensionsOptions {
702 SCH_EXTENSIONS_OPTIONS_NONE = 0x0,
703 SCH_NO_RECORD_HEADER = 0x1
704}SchGetExtensionsOptions;
705
706typedef SECURITY_STATUS (WINAPI *SslGetExtensionsFn)(const BYTE *clientHello, DWORD clientHelloByteSize, SCH_EXTENSION_DATA *genericExtensions, BYTE genericExtensionsCount, DWORD *bytesToRead, SchGetExtensionsOptions flags);
707SECURITY_STATUS WINAPI SslGetExtensions(const BYTE *clientHello, DWORD clientHelloByteSize, SCH_EXTENSION_DATA *genericExtensions, BYTE genericExtensionsCount, DWORD *bytesToRead, SchGetExtensionsOptions flags);
708
709#endif /* NTDDI_VERSION >= NTDDI_WIN10_19H1 */
710
711#endif /* __SCHANNEL_H__ */