1 /*
2 * Copyright 2004 The WebRTC Project Authors. All rights reserved.
3 *
4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree.
9 */
10
11 #include "webrtc/base/win32.h"
12 #define SECURITY_WIN32
13 #include <security.h>
14 #include <schannel.h>
15
16 #include <iomanip>
17 #include <vector>
18
19 #include "webrtc/base/common.h"
20 #include "webrtc/base/logging.h"
21 #include "webrtc/base/schanneladapter.h"
22 #include "webrtc/base/sec_buffer.h"
23 #include "webrtc/base/thread.h"
24
25 namespace rtc {
26
27 /////////////////////////////////////////////////////////////////////////////
28 // SChannelAdapter
29 /////////////////////////////////////////////////////////////////////////////
30
31 extern const ConstantLabel SECURITY_ERRORS[];
32
33 const ConstantLabel SCHANNEL_BUFFER_TYPES[] = {
34 KLABEL(SECBUFFER_EMPTY), // 0
35 KLABEL(SECBUFFER_DATA), // 1
36 KLABEL(SECBUFFER_TOKEN), // 2
37 KLABEL(SECBUFFER_PKG_PARAMS), // 3
38 KLABEL(SECBUFFER_MISSING), // 4
39 KLABEL(SECBUFFER_EXTRA), // 5
40 KLABEL(SECBUFFER_STREAM_TRAILER), // 6
41 KLABEL(SECBUFFER_STREAM_HEADER), // 7
42 KLABEL(SECBUFFER_MECHLIST), // 11
43 KLABEL(SECBUFFER_MECHLIST_SIGNATURE), // 12
44 KLABEL(SECBUFFER_TARGET), // 13
45 KLABEL(SECBUFFER_CHANNEL_BINDINGS), // 14
46 LASTLABEL
47 };
48
DescribeBuffer(LoggingSeverity severity,const char * prefix,const SecBuffer & sb)49 void DescribeBuffer(LoggingSeverity severity, const char* prefix,
50 const SecBuffer& sb) {
51 LOG_V(severity)
52 << prefix
53 << "(" << sb.cbBuffer
54 << ", " << FindLabel(sb.BufferType & ~SECBUFFER_ATTRMASK,
55 SCHANNEL_BUFFER_TYPES)
56 << ", " << sb.pvBuffer << ")";
57 }
58
DescribeBuffers(LoggingSeverity severity,const char * prefix,const SecBufferDesc * sbd)59 void DescribeBuffers(LoggingSeverity severity, const char* prefix,
60 const SecBufferDesc* sbd) {
61 if (!LOG_CHECK_LEVEL_V(severity))
62 return;
63 LOG_V(severity) << prefix << "(";
64 for (size_t i=0; i<sbd->cBuffers; ++i) {
65 DescribeBuffer(severity, " ", sbd->pBuffers[i]);
66 }
67 LOG_V(severity) << ")";
68 }
69
70 const ULONG SSL_FLAGS_DEFAULT = ISC_REQ_ALLOCATE_MEMORY
71 | ISC_REQ_CONFIDENTIALITY
72 | ISC_REQ_EXTENDED_ERROR
73 | ISC_REQ_INTEGRITY
74 | ISC_REQ_REPLAY_DETECT
75 | ISC_REQ_SEQUENCE_DETECT
76 | ISC_REQ_STREAM;
77 //| ISC_REQ_USE_SUPPLIED_CREDS;
78
79 typedef std::vector<char> SChannelBuffer;
80
81 struct SChannelAdapter::SSLImpl {
82 CredHandle cred;
83 CtxtHandle ctx;
84 bool cred_init, ctx_init;
85 SChannelBuffer inbuf, outbuf, readable;
86 SecPkgContext_StreamSizes sizes;
87
SSLImplrtc::SChannelAdapter::SSLImpl88 SSLImpl() : cred_init(false), ctx_init(false) { }
89 };
90
SChannelAdapter(AsyncSocket * socket)91 SChannelAdapter::SChannelAdapter(AsyncSocket* socket)
92 : SSLAdapter(socket), state_(SSL_NONE),
93 restartable_(false), signal_close_(false), message_pending_(false),
94 impl_(new SSLImpl) {
95 }
96
~SChannelAdapter()97 SChannelAdapter::~SChannelAdapter() {
98 Cleanup();
99 }
100
101 int
StartSSL(const char * hostname,bool restartable)102 SChannelAdapter::StartSSL(const char* hostname, bool restartable) {
103 if (state_ != SSL_NONE)
104 return ERROR_ALREADY_INITIALIZED;
105
106 ssl_host_name_ = hostname;
107 restartable_ = restartable;
108
109 if (socket_->GetState() != Socket::CS_CONNECTED) {
110 state_ = SSL_WAIT;
111 return 0;
112 }
113
114 state_ = SSL_CONNECTING;
115 if (int err = BeginSSL()) {
116 Error("BeginSSL", err, false);
117 return err;
118 }
119
120 return 0;
121 }
122
123 int
BeginSSL()124 SChannelAdapter::BeginSSL() {
125 LOG(LS_VERBOSE) << "BeginSSL: " << ssl_host_name_;
126 ASSERT(state_ == SSL_CONNECTING);
127
128 SECURITY_STATUS ret;
129
130 SCHANNEL_CRED sc_cred = { 0 };
131 sc_cred.dwVersion = SCHANNEL_CRED_VERSION;
132 //sc_cred.dwMinimumCipherStrength = 128; // Note: use system default
133 sc_cred.dwFlags = SCH_CRED_NO_DEFAULT_CREDS | SCH_CRED_AUTO_CRED_VALIDATION;
134
135 ret = AcquireCredentialsHandle(NULL, const_cast<LPTSTR>(UNISP_NAME),
136 SECPKG_CRED_OUTBOUND, NULL, &sc_cred, NULL,
137 NULL, &impl_->cred, NULL);
138 if (ret != SEC_E_OK) {
139 LOG(LS_ERROR) << "AcquireCredentialsHandle error: "
140 << ErrorName(ret, SECURITY_ERRORS);
141 return ret;
142 }
143 impl_->cred_init = true;
144
145 if (LOG_CHECK_LEVEL(LS_VERBOSE)) {
146 SecPkgCred_CipherStrengths cipher_strengths = { 0 };
147 ret = QueryCredentialsAttributes(&impl_->cred,
148 SECPKG_ATTR_CIPHER_STRENGTHS,
149 &cipher_strengths);
150 if (SUCCEEDED(ret)) {
151 LOG(LS_VERBOSE) << "SChannel cipher strength: "
152 << cipher_strengths.dwMinimumCipherStrength << " - "
153 << cipher_strengths.dwMaximumCipherStrength;
154 }
155
156 SecPkgCred_SupportedAlgs supported_algs = { 0 };
157 ret = QueryCredentialsAttributes(&impl_->cred,
158 SECPKG_ATTR_SUPPORTED_ALGS,
159 &supported_algs);
160 if (SUCCEEDED(ret)) {
161 LOG(LS_VERBOSE) << "SChannel supported algorithms:";
162 for (DWORD i=0; i<supported_algs.cSupportedAlgs; ++i) {
163 ALG_ID alg_id = supported_algs.palgSupportedAlgs[i];
164 PCCRYPT_OID_INFO oinfo = CryptFindOIDInfo(CRYPT_OID_INFO_ALGID_KEY,
165 &alg_id, 0);
166 LPCWSTR alg_name = (NULL != oinfo) ? oinfo->pwszName : L"Unknown";
167 LOG(LS_VERBOSE) << " " << ToUtf8(alg_name) << " (" << alg_id << ")";
168 }
169 CSecBufferBase::FreeSSPI(supported_algs.palgSupportedAlgs);
170 }
171 }
172
173 ULONG flags = SSL_FLAGS_DEFAULT, ret_flags = 0;
174 if (ignore_bad_cert())
175 flags |= ISC_REQ_MANUAL_CRED_VALIDATION;
176
177 CSecBufferBundle<2, CSecBufferBase::FreeSSPI> sb_out;
178 ret = InitializeSecurityContextA(&impl_->cred, NULL,
179 const_cast<char*>(ssl_host_name_.c_str()),
180 flags, 0, 0, NULL, 0,
181 &impl_->ctx, sb_out.desc(),
182 &ret_flags, NULL);
183 if (SUCCEEDED(ret))
184 impl_->ctx_init = true;
185 return ProcessContext(ret, NULL, sb_out.desc());
186 }
187
188 int
ContinueSSL()189 SChannelAdapter::ContinueSSL() {
190 LOG(LS_VERBOSE) << "ContinueSSL";
191 ASSERT(state_ == SSL_CONNECTING);
192
193 SECURITY_STATUS ret;
194
195 CSecBufferBundle<2> sb_in;
196 sb_in[0].BufferType = SECBUFFER_TOKEN;
197 sb_in[0].cbBuffer = static_cast<unsigned long>(impl_->inbuf.size());
198 sb_in[0].pvBuffer = &impl_->inbuf[0];
199 //DescribeBuffers(LS_VERBOSE, "Input Buffer ", sb_in.desc());
200
201 ULONG flags = SSL_FLAGS_DEFAULT, ret_flags = 0;
202 if (ignore_bad_cert())
203 flags |= ISC_REQ_MANUAL_CRED_VALIDATION;
204
205 CSecBufferBundle<2, CSecBufferBase::FreeSSPI> sb_out;
206 ret = InitializeSecurityContextA(&impl_->cred, &impl_->ctx,
207 const_cast<char*>(ssl_host_name_.c_str()),
208 flags, 0, 0, sb_in.desc(), 0,
209 NULL, sb_out.desc(),
210 &ret_flags, NULL);
211 return ProcessContext(ret, sb_in.desc(), sb_out.desc());
212 }
213
214 int
ProcessContext(long int status,_SecBufferDesc * sbd_in,_SecBufferDesc * sbd_out)215 SChannelAdapter::ProcessContext(long int status, _SecBufferDesc* sbd_in,
216 _SecBufferDesc* sbd_out) {
217 if (status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED &&
218 status != SEC_E_INCOMPLETE_MESSAGE) {
219 LOG(LS_ERROR)
220 << "InitializeSecurityContext error: "
221 << ErrorName(status, SECURITY_ERRORS);
222 }
223 //if (sbd_in)
224 // DescribeBuffers(LS_VERBOSE, "Input Buffer ", sbd_in);
225 //if (sbd_out)
226 // DescribeBuffers(LS_VERBOSE, "Output Buffer ", sbd_out);
227
228 if (status == SEC_E_INCOMPLETE_MESSAGE) {
229 // Wait for more input from server.
230 return Flush();
231 }
232
233 if (FAILED(status)) {
234 // We can't continue. Common errors:
235 // SEC_E_CERT_EXPIRED - Typically, this means the computer clock is wrong.
236 return status;
237 }
238
239 // Note: we check both input and output buffers for SECBUFFER_EXTRA.
240 // Experience shows it appearing in the input, but the documentation claims
241 // it should appear in the output.
242 size_t extra = 0;
243 if (sbd_in) {
244 for (size_t i=0; i<sbd_in->cBuffers; ++i) {
245 SecBuffer& buffer = sbd_in->pBuffers[i];
246 if (buffer.BufferType == SECBUFFER_EXTRA) {
247 extra += buffer.cbBuffer;
248 }
249 }
250 }
251 if (sbd_out) {
252 for (size_t i=0; i<sbd_out->cBuffers; ++i) {
253 SecBuffer& buffer = sbd_out->pBuffers[i];
254 if (buffer.BufferType == SECBUFFER_EXTRA) {
255 extra += buffer.cbBuffer;
256 } else if (buffer.BufferType == SECBUFFER_TOKEN) {
257 impl_->outbuf.insert(impl_->outbuf.end(),
258 reinterpret_cast<char*>(buffer.pvBuffer),
259 reinterpret_cast<char*>(buffer.pvBuffer) + buffer.cbBuffer);
260 }
261 }
262 }
263
264 if (extra) {
265 ASSERT(extra <= impl_->inbuf.size());
266 size_t consumed = impl_->inbuf.size() - extra;
267 memmove(&impl_->inbuf[0], &impl_->inbuf[consumed], extra);
268 impl_->inbuf.resize(extra);
269 } else {
270 impl_->inbuf.clear();
271 }
272
273 if (SEC_I_CONTINUE_NEEDED == status) {
274 // Send data to server and wait for response.
275 // Note: ContinueSSL will result in a Flush, anyway.
276 return impl_->inbuf.empty() ? Flush() : ContinueSSL();
277 }
278
279 if (SEC_E_OK == status) {
280 LOG(LS_VERBOSE) << "QueryContextAttributes";
281 status = QueryContextAttributes(&impl_->ctx, SECPKG_ATTR_STREAM_SIZES,
282 &impl_->sizes);
283 if (FAILED(status)) {
284 LOG(LS_ERROR) << "QueryContextAttributes error: "
285 << ErrorName(status, SECURITY_ERRORS);
286 return status;
287 }
288
289 state_ = SSL_CONNECTED;
290
291 if (int err = DecryptData()) {
292 return err;
293 } else if (int err = Flush()) {
294 return err;
295 } else {
296 // If we decrypted any data, queue up a notification here
297 PostEvent();
298 // Signal our connectedness
299 AsyncSocketAdapter::OnConnectEvent(this);
300 }
301 return 0;
302 }
303
304 if (SEC_I_INCOMPLETE_CREDENTIALS == status) {
305 // We don't support client authentication in schannel.
306 return status;
307 }
308
309 // We don't expect any other codes
310 ASSERT(false);
311 return status;
312 }
313
314 int
DecryptData()315 SChannelAdapter::DecryptData() {
316 SChannelBuffer& inbuf = impl_->inbuf;
317 SChannelBuffer& readable = impl_->readable;
318
319 while (!inbuf.empty()) {
320 CSecBufferBundle<4> in_buf;
321 in_buf[0].BufferType = SECBUFFER_DATA;
322 in_buf[0].cbBuffer = static_cast<unsigned long>(inbuf.size());
323 in_buf[0].pvBuffer = &inbuf[0];
324
325 //DescribeBuffers(LS_VERBOSE, "Decrypt In ", in_buf.desc());
326 SECURITY_STATUS status = DecryptMessage(&impl_->ctx, in_buf.desc(), 0, 0);
327 //DescribeBuffers(LS_VERBOSE, "Decrypt Out ", in_buf.desc());
328
329 // Note: We are explicitly treating SEC_E_OK, SEC_I_CONTEXT_EXPIRED, and
330 // any other successful results as continue.
331 if (SUCCEEDED(status)) {
332 size_t data_len = 0, extra_len = 0;
333 for (size_t i=0; i<in_buf.desc()->cBuffers; ++i) {
334 if (in_buf[i].BufferType == SECBUFFER_DATA) {
335 data_len += in_buf[i].cbBuffer;
336 readable.insert(readable.end(),
337 reinterpret_cast<char*>(in_buf[i].pvBuffer),
338 reinterpret_cast<char*>(in_buf[i].pvBuffer) + in_buf[i].cbBuffer);
339 } else if (in_buf[i].BufferType == SECBUFFER_EXTRA) {
340 extra_len += in_buf[i].cbBuffer;
341 }
342 }
343 // There is a bug on Win2K where SEC_I_CONTEXT_EXPIRED is misclassified.
344 if ((data_len == 0) && (inbuf[0] == 0x15)) {
345 status = SEC_I_CONTEXT_EXPIRED;
346 }
347 if (extra_len) {
348 size_t consumed = inbuf.size() - extra_len;
349 memmove(&inbuf[0], &inbuf[consumed], extra_len);
350 inbuf.resize(extra_len);
351 } else {
352 inbuf.clear();
353 }
354 // TODO: Handle SEC_I_CONTEXT_EXPIRED to do clean shutdown
355 if (status != SEC_E_OK) {
356 LOG(LS_INFO) << "DecryptMessage returned continuation code: "
357 << ErrorName(status, SECURITY_ERRORS);
358 }
359 continue;
360 }
361
362 if (status == SEC_E_INCOMPLETE_MESSAGE) {
363 break;
364 } else {
365 return status;
366 }
367 }
368
369 return 0;
370 }
371
372 void
Cleanup()373 SChannelAdapter::Cleanup() {
374 if (impl_->ctx_init)
375 DeleteSecurityContext(&impl_->ctx);
376 if (impl_->cred_init)
377 FreeCredentialsHandle(&impl_->cred);
378 delete impl_;
379 }
380
381 void
PostEvent()382 SChannelAdapter::PostEvent() {
383 // Check if there's anything notable to signal
384 if (impl_->readable.empty() && !signal_close_)
385 return;
386
387 // Only one post in the queue at a time
388 if (message_pending_)
389 return;
390
391 if (Thread* thread = Thread::Current()) {
392 message_pending_ = true;
393 thread->Post(this);
394 } else {
395 LOG(LS_ERROR) << "No thread context available for SChannelAdapter";
396 ASSERT(false);
397 }
398 }
399
400 void
Error(const char * context,int err,bool signal)401 SChannelAdapter::Error(const char* context, int err, bool signal) {
402 LOG(LS_WARNING) << "SChannelAdapter::Error("
403 << context << ", "
404 << ErrorName(err, SECURITY_ERRORS) << ")";
405 state_ = SSL_ERROR;
406 SetError(err);
407 if (signal)
408 AsyncSocketAdapter::OnCloseEvent(this, err);
409 }
410
411 int
Read()412 SChannelAdapter::Read() {
413 char buffer[4096];
414 SChannelBuffer& inbuf = impl_->inbuf;
415 while (true) {
416 int ret = AsyncSocketAdapter::Recv(buffer, sizeof(buffer));
417 if (ret > 0) {
418 inbuf.insert(inbuf.end(), buffer, buffer + ret);
419 } else if (GetError() == EWOULDBLOCK) {
420 return 0; // Blocking
421 } else {
422 return GetError();
423 }
424 }
425 }
426
427 int
Flush()428 SChannelAdapter::Flush() {
429 int result = 0;
430 size_t pos = 0;
431 SChannelBuffer& outbuf = impl_->outbuf;
432 while (pos < outbuf.size()) {
433 int sent = AsyncSocketAdapter::Send(&outbuf[pos], outbuf.size() - pos);
434 if (sent > 0) {
435 pos += sent;
436 } else if (GetError() == EWOULDBLOCK) {
437 break; // Blocking
438 } else {
439 result = GetError();
440 break;
441 }
442 }
443 if (int remainder = static_cast<int>(outbuf.size() - pos)) {
444 memmove(&outbuf[0], &outbuf[pos], remainder);
445 outbuf.resize(remainder);
446 } else {
447 outbuf.clear();
448 }
449 return result;
450 }
451
452 //
453 // AsyncSocket Implementation
454 //
455
456 int
Send(const void * pv,size_t cb)457 SChannelAdapter::Send(const void* pv, size_t cb) {
458 switch (state_) {
459 case SSL_NONE:
460 return AsyncSocketAdapter::Send(pv, cb);
461
462 case SSL_WAIT:
463 case SSL_CONNECTING:
464 SetError(EWOULDBLOCK);
465 return SOCKET_ERROR;
466
467 case SSL_CONNECTED:
468 break;
469
470 case SSL_ERROR:
471 default:
472 return SOCKET_ERROR;
473 }
474
475 size_t written = 0;
476 SChannelBuffer& outbuf = impl_->outbuf;
477 while (written < cb) {
478 const size_t encrypt_len = std::min<size_t>(cb - written,
479 impl_->sizes.cbMaximumMessage);
480
481 CSecBufferBundle<4> out_buf;
482 out_buf[0].BufferType = SECBUFFER_STREAM_HEADER;
483 out_buf[0].cbBuffer = impl_->sizes.cbHeader;
484 out_buf[1].BufferType = SECBUFFER_DATA;
485 out_buf[1].cbBuffer = static_cast<unsigned long>(encrypt_len);
486 out_buf[2].BufferType = SECBUFFER_STREAM_TRAILER;
487 out_buf[2].cbBuffer = impl_->sizes.cbTrailer;
488
489 size_t packet_len = out_buf[0].cbBuffer
490 + out_buf[1].cbBuffer
491 + out_buf[2].cbBuffer;
492
493 SChannelBuffer message;
494 message.resize(packet_len);
495 out_buf[0].pvBuffer = &message[0];
496 out_buf[1].pvBuffer = &message[out_buf[0].cbBuffer];
497 out_buf[2].pvBuffer = &message[out_buf[0].cbBuffer + out_buf[1].cbBuffer];
498
499 memcpy(out_buf[1].pvBuffer,
500 static_cast<const char*>(pv) + written,
501 encrypt_len);
502
503 //DescribeBuffers(LS_VERBOSE, "Encrypt In ", out_buf.desc());
504 SECURITY_STATUS res = EncryptMessage(&impl_->ctx, 0, out_buf.desc(), 0);
505 //DescribeBuffers(LS_VERBOSE, "Encrypt Out ", out_buf.desc());
506
507 if (FAILED(res)) {
508 Error("EncryptMessage", res, false);
509 return SOCKET_ERROR;
510 }
511
512 // We assume that the header and data segments do not change length,
513 // or else encrypting the concatenated packet in-place is wrong.
514 ASSERT(out_buf[0].cbBuffer == impl_->sizes.cbHeader);
515 ASSERT(out_buf[1].cbBuffer == static_cast<unsigned long>(encrypt_len));
516
517 // However, the length of the trailer may change due to padding.
518 ASSERT(out_buf[2].cbBuffer <= impl_->sizes.cbTrailer);
519
520 packet_len = out_buf[0].cbBuffer
521 + out_buf[1].cbBuffer
522 + out_buf[2].cbBuffer;
523
524 written += encrypt_len;
525 outbuf.insert(outbuf.end(), &message[0], &message[packet_len-1]+1);
526 }
527
528 if (int err = Flush()) {
529 state_ = SSL_ERROR;
530 SetError(err);
531 return SOCKET_ERROR;
532 }
533
534 return static_cast<int>(written);
535 }
536
537 int
Recv(void * pv,size_t cb)538 SChannelAdapter::Recv(void* pv, size_t cb) {
539 switch (state_) {
540 case SSL_NONE:
541 return AsyncSocketAdapter::Recv(pv, cb);
542
543 case SSL_WAIT:
544 case SSL_CONNECTING:
545 SetError(EWOULDBLOCK);
546 return SOCKET_ERROR;
547
548 case SSL_CONNECTED:
549 break;
550
551 case SSL_ERROR:
552 default:
553 return SOCKET_ERROR;
554 }
555
556 SChannelBuffer& readable = impl_->readable;
557 if (readable.empty()) {
558 SetError(EWOULDBLOCK);
559 return SOCKET_ERROR;
560 }
561 size_t read = _min(cb, readable.size());
562 memcpy(pv, &readable[0], read);
563 if (size_t remaining = readable.size() - read) {
564 memmove(&readable[0], &readable[read], remaining);
565 readable.resize(remaining);
566 } else {
567 readable.clear();
568 }
569
570 PostEvent();
571 return static_cast<int>(read);
572 }
573
574 int
Close()575 SChannelAdapter::Close() {
576 if (!impl_->readable.empty()) {
577 LOG(WARNING) << "SChannelAdapter::Close with readable data";
578 // Note: this isn't strictly an error, but we're using it temporarily to
579 // track bugs.
580 //ASSERT(false);
581 }
582 if (state_ == SSL_CONNECTED) {
583 DWORD token = SCHANNEL_SHUTDOWN;
584 CSecBufferBundle<1> sb_in;
585 sb_in[0].BufferType = SECBUFFER_TOKEN;
586 sb_in[0].cbBuffer = sizeof(token);
587 sb_in[0].pvBuffer = &token;
588 ApplyControlToken(&impl_->ctx, sb_in.desc());
589 // TODO: In theory, to do a nice shutdown, we need to begin shutdown
590 // negotiation with more calls to InitializeSecurityContext. Since the
591 // socket api doesn't support nice shutdown at this point, we don't bother.
592 }
593 Cleanup();
594 impl_ = new SSLImpl;
595 state_ = restartable_ ? SSL_WAIT : SSL_NONE;
596 signal_close_ = false;
597 message_pending_ = false;
598 return AsyncSocketAdapter::Close();
599 }
600
601 Socket::ConnState
GetState() const602 SChannelAdapter::GetState() const {
603 if (signal_close_)
604 return CS_CONNECTED;
605 ConnState state = socket_->GetState();
606 if ((state == CS_CONNECTED)
607 && ((state_ == SSL_WAIT) || (state_ == SSL_CONNECTING)))
608 state = CS_CONNECTING;
609 return state;
610 }
611
612 void
OnConnectEvent(AsyncSocket * socket)613 SChannelAdapter::OnConnectEvent(AsyncSocket* socket) {
614 LOG(LS_VERBOSE) << "SChannelAdapter::OnConnectEvent";
615 if (state_ != SSL_WAIT) {
616 ASSERT(state_ == SSL_NONE);
617 AsyncSocketAdapter::OnConnectEvent(socket);
618 return;
619 }
620
621 state_ = SSL_CONNECTING;
622 if (int err = BeginSSL()) {
623 Error("BeginSSL", err);
624 }
625 }
626
627 void
OnReadEvent(AsyncSocket * socket)628 SChannelAdapter::OnReadEvent(AsyncSocket* socket) {
629 if (state_ == SSL_NONE) {
630 AsyncSocketAdapter::OnReadEvent(socket);
631 return;
632 }
633
634 if (int err = Read()) {
635 Error("Read", err);
636 return;
637 }
638
639 if (impl_->inbuf.empty())
640 return;
641
642 if (state_ == SSL_CONNECTED) {
643 if (int err = DecryptData()) {
644 Error("DecryptData", err);
645 } else if (!impl_->readable.empty()) {
646 AsyncSocketAdapter::OnReadEvent(this);
647 }
648 } else if (state_ == SSL_CONNECTING) {
649 if (int err = ContinueSSL()) {
650 Error("ContinueSSL", err);
651 }
652 }
653 }
654
655 void
OnWriteEvent(AsyncSocket * socket)656 SChannelAdapter::OnWriteEvent(AsyncSocket* socket) {
657 if (state_ == SSL_NONE) {
658 AsyncSocketAdapter::OnWriteEvent(socket);
659 return;
660 }
661
662 if (int err = Flush()) {
663 Error("Flush", err);
664 return;
665 }
666
667 // See if we have more data to write
668 if (!impl_->outbuf.empty())
669 return;
670
671 // Buffer is empty, submit notification
672 if (state_ == SSL_CONNECTED) {
673 AsyncSocketAdapter::OnWriteEvent(socket);
674 }
675 }
676
677 void
OnCloseEvent(AsyncSocket * socket,int err)678 SChannelAdapter::OnCloseEvent(AsyncSocket* socket, int err) {
679 if ((state_ == SSL_NONE) || impl_->readable.empty()) {
680 AsyncSocketAdapter::OnCloseEvent(socket, err);
681 return;
682 }
683
684 // If readable is non-empty, then we have a pending Message
685 // that will allow us to signal close (eventually).
686 signal_close_ = true;
687 }
688
689 void
OnMessage(Message * pmsg)690 SChannelAdapter::OnMessage(Message* pmsg) {
691 if (!message_pending_)
692 return; // This occurs when socket is closed
693
694 message_pending_ = false;
695 if (!impl_->readable.empty()) {
696 AsyncSocketAdapter::OnReadEvent(this);
697 } else if (signal_close_) {
698 signal_close_ = false;
699 AsyncSocketAdapter::OnCloseEvent(this, 0); // TODO: cache this error?
700 }
701 }
702
703 } // namespace rtc
704