Merge 73913 - When performing SSL client authentication on Windows via NSS, c...

net/third_party/nss/ssl/sslplatf.c

 /*
  * Platform specific crypto wrappers
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 83 matching lines @@
     if (arena) {
         PORT_FreeArena(arena, PR_FALSE);
     }
     return NULL;
 }
 
 #if defined(XP_WIN32)
 void
 ssl_FreePlatformKey(PlatformKey key)
 {
-    CryptReleaseContext(key, 0);
+    if (key) {
+        if (key->dwKeySpec != CERT_NCRYPT_KEY_SPEC)
+            CryptReleaseContext(key->hCryptProv, 0);
+        /* FIXME(rsleevi): Close CNG keys. */
+        PORT_Free(key);
+    }
 }
 
 void
 ssl_FreePlatformAuthInfo(PlatformAuthInfo* info)
 {
     if (info->provider != NULL) {
         PORT_Free(info->provider);
         info->provider = NULL;
     }
     if (info->container != NULL) {
@@ skipping 26 matching lines @@
     CryptReleaseContext(prov, 0);
     return PR_TRUE;
 }
 
 void
 ssl_GetPlatformAuthInfoForKey(PlatformKey key,
                               PlatformAuthInfo *info)
 {
     DWORD bytesNeeded = 0;
     ssl_InitPlatformAuthInfo(info);
+    if (!key || key->dwKeySpec == CERT_NCRYPT_KEY_SPEC)
+        goto error;
+
     bytesNeeded = sizeof(info->provType);
-    if (!CryptGetProvParam(key, PP_PROVTYPE, (BYTE*)&info->provType,
-                           &bytesNeeded, 0))
+    if (!CryptGetProvParam(key->hCryptProv, PP_PROVTYPE,
+                           (BYTE*)&info->provType, &bytesNeeded, 0))
         goto error;
 
     bytesNeeded = 0;
-    if (!CryptGetProvParam(key, PP_CONTAINER, NULL, &bytesNeeded, 0))
+    if (!CryptGetProvParam(key->hCryptProv, PP_CONTAINER, NULL, &bytesNeeded,
+                           0))
         goto error;
     info->container = (char*)PORT_Alloc(bytesNeeded);
     if (info->container == NULL)
         goto error;
-    if (!CryptGetProvParam(key, PP_CONTAINER, (BYTE*)info->container,
-                           &bytesNeeded, 0))
+    if (!CryptGetProvParam(key->hCryptProv, PP_CONTAINER,
+                           (BYTE*)info->container, &bytesNeeded, 0))
         goto error;
 
     bytesNeeded = 0;
-    if (!CryptGetProvParam(key, PP_NAME, NULL, &bytesNeeded, 0))
+    if (!CryptGetProvParam(key->hCryptProv, PP_NAME, NULL, &bytesNeeded, 0))
         goto error;
     info->provider = (char*)PORT_Alloc(bytesNeeded);
     if (info->provider == NULL)
         goto error;
-    if (!CryptGetProvParam(key, PP_NAME, (BYTE*)info->provider,
+    if (!CryptGetProvParam(key->hCryptProv, PP_NAME, (BYTE*)info->provider,
                            &bytesNeeded, 0))
         goto error;
 
     goto done;
 error:
     ssl_FreePlatformAuthInfo(info);
 
 done:
     return;
 }
 
 SECStatus
 ssl3_PlatformSignHashes(SSL3Hashes *hash, PlatformKey key, SECItem *buf, 
                         PRBool isTLS)
 {
     SECStatus    rv             = SECFailure;
     PRBool       doDerEncode    = PR_FALSE;
     SECItem      hashItem;
-    /* TODO(rsleevi): Should AT_SIGNATURE also be checked if doing client
-     * auth? 
-     */
-    DWORD        keySpec        = AT_KEYEXCHANGE;
     HCRYPTKEY    hKey           = 0;
     DWORD        argLen         = 0;
     ALG_ID       keyAlg         = 0;
     DWORD        signatureLen   = 0;
     ALG_ID       hashAlg        = 0;
     HCRYPTHASH   hHash          = 0;
     DWORD        hashLen        = 0;
     unsigned int i              = 0;
 
     buf->data = NULL;
-    if (!CryptGetUserKey(key, keySpec, &hKey)) {
+    if (!CryptGetUserKey(key->hCryptProv, key->dwKeySpec, &hKey)) {
         PORT_SetError(SEC_ERROR_INVALID_KEY);
         goto done;
     }
 
     argLen = sizeof(keyAlg);
     if (!CryptGetKeyParam(hKey, KP_ALGID, (BYTE*)&keyAlg, &argLen, 0)) {
         PORT_SetError(SEC_ERROR_INVALID_KEY);
         goto done;
     }
 
     switch (keyAlg) {
         case CALG_RSA_KEYX:
         case CALG_RSA_SIGN:
             hashAlg       = CALG_SSL3_SHAMD5;
             hashItem.data = hash->md5;
             hashItem.len  = sizeof(SSL3Hashes);
             break;
         case CALG_DSS_SIGN:
-        /* TODO: Support CALG_ECDSA once tested */
         case CALG_ECDSA:
             if (keyAlg == CALG_ECDSA) {
                 doDerEncode = PR_TRUE;
             } else {
                 doDerEncode = isTLS;
             }
             hashAlg       = CALG_SHA1;
             hashItem.data = hash->sha;
             hashItem.len  = sizeof(hash->sha);
             break;
         default:
             PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
             goto done;
     }
     PRINT_BUF(60, (NULL, "hash(es) to be signed", hashItem.data, hashItem.len));
 
-    if (!CryptCreateHash(key, hashAlg, 0, 0, &hHash)) {
+    if (!CryptCreateHash(key->hCryptProv, hashAlg, 0, 0, &hHash)) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;    
     }
     argLen = sizeof(hashLen);
     if (!CryptGetHashParam(hHash, HP_HASHSIZE, (BYTE*)&hashLen, &argLen, 0)) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
     if (hashLen != hashItem.len) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
     if (!CryptSetHashParam(hHash, HP_HASHVAL, (BYTE*)hashItem.data, 0)) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
-    if (!CryptSignHash(hHash, keySpec, NULL, CRYPT_NOHASHOID,
+    if (!CryptSignHash(hHash, key->dwKeySpec, NULL, CRYPT_NOHASHOID,
                        NULL, &signatureLen) || signatureLen == 0) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
     buf->data = (unsigned char *)PORT_Alloc(signatureLen);
     if (!buf->data)
         goto done;    /* error code was set. */
 
-    if (!CryptSignHash(hHash, keySpec, NULL, CRYPT_NOHASHOID,
+    if (!CryptSignHash(hHash, key->dwKeySpec, NULL, CRYPT_NOHASHOID,
                        (BYTE*)buf->data, &signatureLen)) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
     buf->len = signatureLen;
 
     /* CryptoAPI signs in little-endian, so reverse */
     for (i = 0; i < buf->len / 2; ++i) {
         unsigned char tmp = buf->data[i];
         buf->data[i] = buf->data[buf->len - 1 - i];
@@ skipping 274 matching lines @@
 SECStatus
 ssl3_PlatformSignHashes(SSL3Hashes *hash, PlatformKey key, SECItem *buf,
                         PRBool isTLS)
 {
     PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
     return SECFailure;
 }
 #endif
 
 #endif /* NSS_PLATFORM_CLIENT_AUTH */