eve.tls.windows.schannel

Windows SChannel TLS Implementation (EXPERIMENTAL)

WARNING: This module is experimental. The API may change and security properties have not been fully audited. Do not use in production without independent security review.

This module provides TLS/SSL support for Windows using the native SChannel (Secure Channel) SSPI provider. SChannel is the Windows built-in SSL/TLS implementation requiring no external dependencies.

The implementation wraps the SSPI API to provide a clean interface matching the eve.tls.api contract.

Version Compatibility:

Minimum: Windows Vista / Server 2008 (SSPI base API)
TLS 1.2: Fully supported (Windows 7 / Server 2008 R2+)
ALPN: Windows 8.1 / Server 2012 R2+
TLS 1.3: Windows 10 1809 / Server 2019+

SSPI bindings are locally declared and audited against Windows SDK headers. All type sizes use platform-correct widths (size_t for DWORD_PTR/UINT_PTR, uint for DWORD/ULONG, void* for opaque handles).

Copyright

License

Boost Software License, Version 1.0

var ASC_REQ_ALLOCATE_MEMORY ASC_REQ_CONFIDENTIALITY ASC_REQ_REPLAY_DETECT ASC_REQ_SEQUENCE_DETECT ASC_REQ_STREAM CERT_ENCODING_TYPE CERT_FIND_ANY CERT_NAME_ISSUER_FLAG CERT_NAME_SIMPLE_DISPLAY_TYPE CERT_STORE_ADD_ALWAYS CERT_STORE_PROV_MEMORY CRYPT_STRING_BASE64_ANY CRYPT_STRING_BASE64HEADER IO_BUFFER_SIZE ISC_REQ_ALLOCATE_MEMORY ISC_REQ_CONFIDENTIALITY ISC_REQ_MANUAL_CRED_VALIDATION ISC_REQ_REPLAY_DETECT ISC_REQ_SEQUENCE_DETECT ISC_REQ_STREAM ISC_REQ_USE_SUPPLIED_CREDS PKCS12_NO_PERSIST_KEY PKCS_7_ASN_ENCODING SCH_CRED_MANUAL_CRED_VALIDATION SCH_CRED_NO_DEFAULT_CREDS SCH_USE_STRONG_CRYPTO SCHANNEL_CRED_VERSION SEC_APPLICATION_PROTOCOL_NEGOTIATION_STATUS_Negotiated SEC_E_CERT_EXPIRED SEC_E_CERT_UNKNOWN SEC_E_INCOMPLETE_MESSAGE SEC_E_INTERNAL_ERROR SEC_E_INVALID_HANDLE SEC_E_INVALID_TOKEN SEC_E_OK SEC_E_UNTRUSTED_ROOT SEC_E_WRONG_PRINCIPAL SEC_I_CONTEXT_EXPIRED SEC_I_CONTINUE_NEEDED SEC_I_INCOMPLETE_CREDENTIALS SECBUFFER_ALERT SECBUFFER_DATA SECBUFFER_EMPTY SECBUFFER_EXTRA SECBUFFER_SEND_GENERIC_TLS_EXTENSION SECBUFFER_STREAM_HEADER SECBUFFER_STREAM_TRAILER SECBUFFER_TOKEN SECBUFFER_VERSION SECPKG_ATTR_APPLICATION_PROTOCOL SECPKG_ATTR_REMOTE_CERT_CONTEXT SECPKG_ATTR_STREAM_SIZES SECPKG_CRED_INBOUND SECPKG_CRED_OUTBOUND SecPkgApplicationProtocolNegotiationExt_ALPN SOCKET_ERROR SP_PROT_TLS1_0_CLIENT SP_PROT_TLS1_0_SERVER SP_PROT_TLS1_1_CLIENT SP_PROT_TLS1_1_SERVER SP_PROT_TLS1_2_CLIENT SP_PROT_TLS1_2_SERVER SP_PROT_TLS1_3_CLIENT SP_PROT_TLS1_3_SERVER TLS1_ALPN_EXTENSION TLS_MAX_RECORD_SIZE WSAEWOULDBLOCK X509_ASN_ENCODING

alias FILETIME SECURITY_STATUS

struct CERT_CONTEXT CERT_INFO CredHandle CRYPT_ALGORITHM_IDENTIFIER CRYPT_DATA_BLOB CtxtHandle SCHANNEL_CRED SchannelCredentials SecBuffer SecBufferDesc SecPkgContext_ApplicationProtocol SecPkgContext_StreamSizes SYSTEMTIME TimeStamp TlsStream

fn AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken buildProtocolFlags CertAddCertificateContextToStore CertCloseStore CertCreateCertificateContext CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringA CertOpenStore CryptStringToBinaryA DecryptMessage DeleteSecurityContext EncryptMessage FileTimeToSystemTime FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextA PFXImportCertStore QueryContextAttributesA recv send statusToErrorCode tlsClient tlsServer tlsVersionToProtocol WSAGetLastError

Types 17

aliasSECURITY_STATUS = int

Security status codes

structCredHandle

Credential handle

Fields

size_t dwLower

size_t dwUpper

structCtxtHandle

Context handle

Fields

size_t dwLower

size_t dwUpper

structTimeStamp

Timestamp structure

Fields

uint dwLowDateTime

uint dwHighDateTime

structSecBuffer

Security buffer

Fields

uint cbBuffer

uint bufferType

void * pvBuffer

structSecBufferDesc

Security buffer descriptor

Fields

uint ulVersion

uint cBuffers

SecBuffer * pBuffers

structSecPkgContext_StreamSizes

Stream sizes for encryption

Fields

uint cbHeader

uint cbTrailer

uint cbMaximumMessage

uint cBuffers

uint cbBlockSize

structSCHANNEL_CRED

SChannel credentials

Fields

uint dwVersion

uint cCreds

void * * paCred

void * hRootStore

uint cMappers

void * * aphMappers

uint cSupportedAlgs

uint * palgSupportedAlgs

uint grbitEnabledProtocols

uint dwMinimumCipherStrength

uint dwMaximumCipherStrength

uint dwSessionLifespan

uint dwFlags

uint dwCredFormat

private structSecPkgContext_ApplicationProtocol

Fields

uint ProtoNegoState

uint ProtoNegoExt

ushort ProtocolIdSize

char * ProtocolId

private structCRYPT_DATA_BLOB

Fields

uint cbData

ubyte * pbData

private structCRYPT_ALGORITHM_IDENTIFIER

Fields

char * pszObjId

CRYPT_DATA_BLOB Parameters

private aliasFILETIME = TimeStamp

private structCERT_INFO

Fields

uint dwVersion

CRYPT_DATA_BLOB SerialNumber

CRYPT_ALGORITHM_IDENTIFIER SignatureAlgorithm

CRYPT_DATA_BLOB Issuer

FILETIME NotBefore

FILETIME NotAfter

CRYPT_DATA_BLOB Subject

private structCERT_CONTEXT

Fields

uint cbCertEncoded

ubyte * pbCertEncoded

void * hCertStore

CERT_INFO * pCertInfo

private structSYSTEMTIME

Fields

ushort wYear

ushort wMonth

ushort wDayOfWeek

ushort wDay

ushort wHour

ushort wMinute

ushort wSecond

ushort wMilliseconds

structSchannelCredentials

SChannel credential handle wrapper.

Manages the lifecycle of SSPI credentials used for TLS connections. Credentials are acquired based on the TlsContext configuration and must be released when no longer needed.

Fields

private CredHandle handle

private bool valid_

private void * rootStore_

private CERT_CONTEXT * serverCert_

private void * pfxStore_

Methods

TlsErrorCode initialize(ref const(TlsContext) ctx) @trusted nothrowInitialize credentials from a TLS context.

void release() @trusted nothrow

bool isValid() const pure @safe nothrow @nogc

CredHandle * handlePtr() @trusted nothrow @nogc

private void * loadCaCertFile(string path) @trusted nothrow

private CERT_CONTEXT * loadCertFromPem(string path) @trusted nothrow

private ptrdiff_t indexOf(const(char)[] haystack, const(char)[] needle, size_t start) pure nothrow

private CERT_CONTEXT * loadCertAndKeyFromPfx(string path) @trusted nothrowLoad a certificate with its private key from a PFX (PKCS#12) file.

private bool endsWith(const(char)[] str, const(char)[] suffix) static pure nothrow @nogc

Destructors

~this

structTlsStream(Transport)

SChannel TLS Stream.

Provides TLS encryption/decryption over an underlying transport. This struct wraps the SSPI/SChannel API to implement the TLS stream interface defined in eve.tls.api.

Parameters

Transport The underlying transport type (must support read/write).

Fields

private Transport * transport_

private TlsContext context_

private SchannelCredentials credentials_

private CtxtHandle secContext_

private bool contextValid_

private TlsState state_

private HandshakeState handshakeState_

private SecPkgContext_StreamSizes streamSizes_

private bool streamSizesValid_

private ubyte[IO_BUFFER_SIZE] recvBuffer_

private size_t recvBufferLen_

private ubyte[IO_BUFFER_SIZE] decryptedBuffer_

private size_t decryptedBufferLen_

private size_t decryptedBufferPos_

private ubyte[IO_BUFFER_SIZE] pendingSendBuffer_

private size_t pendingSendLen_

private size_t pendingSendPos_

private ubyte[IO_BUFFER_SIZE] handshakeOutBuffer_

private size_t handshakeOutBufferLen_

private size_t handshakeOutBufferPos_

private TlsErrorCode lastError_

Methods

TlsState state() @property const pure @safe nothrow @nogcGet the current TLS stream state.

TlsErrorCode lastError() @property const pure @safe nothrow @nogcGet the last error code.

TlsIoInterest ioInterest() const pure @safe nothrow @nogcGet the current I/O interest for the underlying transport.

HandshakeResult handshake() @trustedPerform the TLS handshake.

TlsIOResult read(ubyte[] buffer) @trustedRead decrypted data from the TLS stream.

TlsIOResult write(const(ubyte)[] data) @trustedWrite data to be encrypted and sent.

void shutdown() @trustedInitiate graceful TLS shutdown.

CertificateInfo peerCertificate() @trustedGet the peer's certificate information.

string negotiatedProtocol() @trustedGet the negotiated ALPN protocol, if any.

private int rawSend(const(ubyte)[] data) @trusted nothrow

private int rawRecv(ubyte[] buffer) @trusted nothrow

private HandshakeResult performClientHandshake() @trusted

private HandshakeResult performServerHandshake() @trusted

private TlsErrorCode queryStreamSizes() @trusted nothrow @nogc

private size_t buildAlpnExtension(ubyte[] buf) nothrow

private TlsIOResult readAndDecrypt(ubyte[] buffer) @trusted

private TlsIOResult encryptAndSend(const(ubyte)[] data) @trusted

Constructors

this(Transport * transport, TlsContext ctx)Construct a TLS stream over the given transport.