delta/curl.git/lib/vtls/schannel.c, branch karpenko/sclient-cert-store-open

schannel: client certificate store opening fix

2018-08-23T12:47:31+00:00

1) Using CERT_STORE_OPEN_EXISTING_FLAG ( or CERT_STORE_READONLY_FLAG )
while opening certificate store would be sufficient in this scenario and
less-demanding in sense of required user credentials ( for example,
IIS_IUSRS will get "Access Denied" 0x05 error for existing CertOpenStore
call without any of flags mentioned above ),

2) as 'cert_store_name' is a DWORD, attempt to format its value like a
string ( in "Failed to open cert store" error message ) will throw null
pointer exception

3) adding GetLastError(), in my opinion, will make error message more
useful.

Bug: https://curl.haxx.se/mail/lib-2018-08/0198.html

schannel: enable CALG_TLS1PRF for w32api >= 5.1

2018-07-12T12:38:55+00:00

The definition of CALG_TLS1PRF has been fixed in the 5.1 branch:
https://osdn.net/projects/mingw/scm/git/mingw-org-wsl/commits/73aedcc0f2e6ba370de0d86ab878ad76a0dda7b5

schannel: fix MinGW compile break

2018-07-11T11:04:15+00:00

Original MinGW's w32api has a sytax error in its definition of
CALG_TLS1PRF [0]. Don't use original MinGW w32api's CALG_TLS1PRF
until this bug [1] is fixed.

[0] https://osdn.net/projects/mingw/scm/git/mingw-org-wsl/blobs/d1d4a17e51a2b78e252ef0147d483267d56c90cc/w32api/include/wincrypt.h
[1] https://osdn.net/projects/mingw/ticket/38391

Fixes https://github.com/curl/curl/pull/2721#issuecomment-403636043
Closes https://github.com/curl/curl/pull/2728

schannel: fix -Wsign-compare warning

2018-07-09T16:09:05+00:00

MinGW warns:
/lib/vtls/schannel.c:219:64: warning: signed and unsigned type in
conditional expression [-Wsign-compare]

Fix this by casting the ptrdiff_t to size_t as we know it's positive.

Closes https://github.com/curl/curl/pull/2721

schannel: workaround for wrong function signature in w32api

2018-07-09T16:08:56+00:00

Original MinGW's w32api has CryptHashData's second parameter as BYTE *
instead of const BYTE *.

Closes https://github.com/curl/curl/pull/2721

schannel: make more cipher options conditional

2018-07-09T16:08:46+00:00

They are not defined in the original MinGW's .

Closes https://github.com/curl/curl/pull/2721

schannel: support selecting ciphers

2018-06-12T10:08:40+00:00

Given the contstraints of SChannel, I'm exposing these as the algorithms
themselves instead; while replicating the ciphersuite as specified by
OpenSSL would have been preferable, I found no way in the SChannel API
to do so.

To use this from the commandline, you need to pass the names of contants
defining the desired algorithms. For example, curl --ciphers
"CALG_SHA1:CALG_RSA_SIGN:CALG_RSA_KEYX:CALG_AES_128:CALG_DH_EPHEM"
https://github.com The specific names come from wincrypt.h

Closes #2630

schannel: add failf calls for client certificate failures

2018-05-27T21:30:23+00:00

Closes #2604

checksrc: make sure sizeof() is used with parentheses

2018-05-21T21:21:47+00:00

... and unify the source code to adhere.

Closes #2563

schannel: disable manual verify if APIs not available

2018-05-16T06:21:05+00:00

.. because original MinGW and old compilers do not have the Windows API
definitions needed to support manual verification.