windows-xp/Source/XPSP1/NT/ds/security/protocols/schannel/spbase/ssl3msg.c

//+---------------------------------------------------------------------------
//
//  Microsoft Windows
//  Copyright (C) Microsoft Corporation, 1992 - 1995.
//
//  File:       ssl3msg.c
//
//  Contents:   Main crypto functions for SSL3.
//
//  Classes:
//
//  Functions:
//
//  History:    04-16-96   ramas    Created.
//
//----------------------------------------------------------------------------

#include <spbase.h>

#if VERIFYHASH
BYTE  rgbF[5000];
DWORD ibF = 0;
#endif


//------------------------------------------------------------------------------------------

SP_STATUS WINAPI
Ssl3DecryptHandler(
    PSPContext pContext,
    PSPBuffer pCommInput,
    PSPBuffer pAppOutput)
{
    SP_STATUS pctRet = PCT_ERR_OK;

    if(pCommInput->cbData == 0)
    {
        return PCT_INT_INCOMPLETE_MSG;
    }

    if(!(pContext->State & SP_STATE_CONNECTED) || pContext->Decrypt == NULL)
    {
        return SP_LOG_RESULT(PCT_INT_ILLEGAL_MSG);
    }

    switch(*(PBYTE)pCommInput->pvBuffer)
    {
    case SSL3_CT_HANDSHAKE:
        if(pContext->RipeZombie->fProtocol & SP_PROT_CLIENTS)
        {
            // This should be a HelloRequest message. We should make sure, and
            // then completely consume the message.
            pctRet = pContext->Decrypt( pContext,
                                        pCommInput,  // message
                                        pAppOutput);    // Unpacked Message
            if(PCT_ERR_OK != pctRet)
            {
                return pctRet;
            }

            if(*(PBYTE)pAppOutput->pvBuffer != SSL3_HS_HELLO_REQUEST ||
               pAppOutput->cbData != sizeof(SHSH))
            {
                // This ain't no HelloRequest!
                return SP_LOG_RESULT(PCT_INT_ILLEGAL_MSG);
            }
        }
        else
        {
            // This is probably a ClientHello message. In any case, let the
            // caller deal with it (by passing it to the LSA process).
            pCommInput->cbData = 0;
        }

        pAppOutput->cbData = 0;

        pContext->State = SSL3_STATE_RENEGOTIATE;
        return SP_LOG_RESULT(PCT_INT_RENEGOTIATE);


    case SSL3_CT_ALERT:
        pctRet = pContext->Decrypt( pContext,
                                    pCommInput,
                                    pAppOutput);
        if(PCT_ERR_OK != pctRet)
        {
            return pctRet;
        }

        pctRet = ParseAlertMessage(pContext,
                                   (PBYTE)pAppOutput->pvBuffer,
                                   pAppOutput->cbData);

        // make sure that APP doesn't see Alert messages...
        pAppOutput->cbData = 0;
        
        return pctRet;


    case SSL3_CT_APPLICATIONDATA:
        pctRet = pContext->Decrypt( pContext,
                                    pCommInput,
                                    pAppOutput);

        return pctRet;


    default:
        return SP_LOG_RESULT(PCT_INT_ILLEGAL_MSG);
    }
}

SP_STATUS WINAPI
Ssl3GetHeaderSize(
    PSPContext pContext,
    PSPBuffer pCommInput,
    DWORD * pcbHeaderSize)
{
    if(pcbHeaderSize == NULL)
    {
        return SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
    }

    *pcbHeaderSize = sizeof(SWRAP);
    return PCT_ERR_OK;
}



#if   DBG
BYTE rgb3Mac[2048];
DWORD ibMac = 0;
#endif

//+---------------------------------------------------------------------------
//
//  Function:   Ssl3ComputeMac
//
//  Synopsis:
//
//  Arguments:  [pContext]      --
//              [fReadMac]      --
//              [pClean]        --
//              [cContentType]  --
//              [pbMac]         --
//              [cbMac]
//
//  History:    10-03-97   jbanes   Created.
//
//  Notes:
//
//----------------------------------------------------------------------------
SP_STATUS
Ssl3ComputeMac(
    PSPContext  pContext,
    BOOL        fReadMac,
    PSPBuffer   pClean,
    CHAR        cContentType,
    PBYTE       pbMac,
    DWORD       cbMac)
{
    HCRYPTHASH  hHash = 0;
    DWORD       dwReverseSequence;
    WORD        wReverseData;
    UCHAR       rgbDigest[SP_MAX_DIGEST_LEN];
    DWORD       cbDigest;
    BYTE        rgbPad[CB_SSL3_MAX_MAC_PAD];
    WORD        cbPad;
    HCRYPTPROV  hProv;
    HCRYPTKEY   hSecret;
    DWORD       dwSequence;
    DWORD       dwCapiFlags;
    PHashInfo   pHashInfo;
    SP_STATUS   pctRet;

    if(fReadMac)
    {
        hProv      = pContext->hReadProv;
        hSecret    = pContext->hReadMAC;
        dwSequence = pContext->ReadCounter;
        pHashInfo  = pContext->pReadHashInfo;
    }
    else
    {
        hProv      = pContext->hWriteProv;
        hSecret    = pContext->hWriteMAC;
        dwSequence = pContext->WriteCounter;
        pHashInfo  = pContext->pWriteHashInfo;
    }
    dwCapiFlags = pContext->RipeZombie->dwCapiFlags;

    if(!hProv)
    {
        return SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
    }

    // Determine size of pad_1 and pad_2.
    if(pHashInfo->aiHash == CALG_MD5)
    {
        cbPad = CB_SSL3_MD5_MAC_PAD;
    }
    else
    {
        cbPad = CB_SSL3_SHA_MAC_PAD;
    }

    //
    // hash(MAC_write_secret + pad_2 +
    //      hash(MAC_write_secret + pad_1 + seq_num +
    //           SSLCompressed.type + SSLCompressed.length +
    //           SSLCompressed.fragment));
    //

    // Create hash
    if(!SchCryptCreateHash(hProv,
                           pHashInfo->aiHash,
                           0,
                           0,
                           &hHash,
                           dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    // Hash secret
    if(!SchCryptHashSessionKey(hHash,
                               hSecret,
                               CRYPT_LITTLE_ENDIAN,
                               dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    // hash pad 1
    FillMemory(rgbPad, cbPad, PAD1_CONSTANT);
    if(!SchCryptHashData(hHash, rgbPad, cbPad, 0, dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    /* add count */
    dwReverseSequence = 0;
    if(!SchCryptHashData(hHash,
                         (PUCHAR)&dwReverseSequence,
                         sizeof(DWORD),
                         0,
                         dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    dwReverseSequence = htonl(dwSequence);
    if(!SchCryptHashData(hHash,
                         (PUCHAR)&dwReverseSequence,
                         sizeof(DWORD),
                         0,
                         dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    // Add content type.
    if(cContentType != 0)
    {
        if(!SchCryptHashData(hHash, &cContentType, 1, 0, dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
    }

    /* add length */
    wReverseData = (WORD)pClean->cbData >> 8 | (WORD)pClean->cbData << 8;
    if(!SchCryptHashData(hHash,
                         (PBYTE)&wReverseData,
                         sizeof(WORD),
                         0,
                         dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    /* add data */
    if(!SchCryptHashData(hHash,
                         pClean->pvBuffer,
                         pClean->cbData,
                         0,
                         dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    #if VERIFYHASH
        if(ibMac > 1800) ibMac = 0;
        CopyMemory(&rgb3Mac[ibMac], (BYTE *)&dw32High, sizeof(DWORD));
        ibMac += sizeof(DWORD);
        CopyMemory(&rgb3Mac[ibMac], (BYTE *)&dwReverseSeq, sizeof(DWORD));
        ibMac += sizeof(DWORD);
        CopyMemory(&rgb3Mac[ibMac], (BYTE *)&wDataReverse, sizeof(WORD));
        ibMac += sizeof(WORD);
        if(wData < 50)
        {
            CopyMemory(&rgb3Mac[ibMac], (PUCHAR)pClean->pvBuffer, wData);
            ibMac += wData;
        }
    #endif

    // Get inner hash value.
    cbDigest = sizeof(rgbDigest);
    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             rgbDigest,
                             &cbDigest,
                             0,
                             dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    SP_ASSERT(pHashInfo->cbCheckSum == cbDigest);

    SchCryptDestroyHash(hHash, dwCapiFlags);
    hHash = 0;

    #if VERIFYHASH
        CopyMemory(&rgb3Mac[ibMac], rgbDigest, pHashInfo->cbCheckSum);
        ibMac += pHashInfo->cbCheckSum;
    #endif



    // Create hash
    if(!SchCryptCreateHash(hProv,
                           pHashInfo->aiHash,
                           0,
                           0,
                           &hHash,
                           dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    // Hash secret
    if(!SchCryptHashSessionKey(hHash,
                               hSecret,
                               CRYPT_LITTLE_ENDIAN,
                               dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    // hash pad 2
    FillMemory(rgbPad, cbPad, PAD2_CONSTANT);
    if(!SchCryptHashData(hHash, rgbPad, cbPad, 0, dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    if(!SchCryptHashData(hHash, rgbDigest, cbDigest, 0, dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    // Get outer hash value.
    cbDigest = sizeof(rgbDigest);
    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             rgbDigest,
                             &cbDigest,
                             0,
                             dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    SP_ASSERT(pHashInfo->cbCheckSum == cbDigest);

    SchCryptDestroyHash(hHash, dwCapiFlags);
    hHash = 0;

    #if VERIFYHASH
        CopyMemory(&rgb3Mac[ibMac], rgbDigest, pHashInfo->cbCheckSum);
        ibMac += pHashInfo->cbCheckSum;
    #endif

    CopyMemory(pbMac, rgbDigest, cbDigest);

    pctRet = PCT_ERR_OK;

cleanup:

    if(hHash)
    {
        SchCryptDestroyHash(hHash, dwCapiFlags);
    }

    return pctRet;
}


//+---------------------------------------------------------------------------
//
//  Function:   Ssl3BuildFinishMessage
//
//  Synopsis:
//
//  Arguments:  [pContext]      --
//              [pbMd5Digest]   --
//              [pbSHADigest]   --
//              [fClient]       --
//
//  History:    10-03-97   jbanes   Added server-side CAPI integration.
//
//  Notes:
//
//----------------------------------------------------------------------------
SP_STATUS
Ssl3BuildFinishMessage(
    PSPContext pContext,
    BYTE *pbMd5Digest,
    BYTE *pbSHADigest,
    BOOL fClient)
{
    BYTE rgbPad1[CB_SSL3_MAX_MAC_PAD];
    BYTE rgbPad2[CB_SSL3_MAX_MAC_PAD];
    BYTE szClnt[] = "CLNT";
    BYTE szSrvr[] = "SRVR";
    DWORD cbMessage;
    HCRYPTHASH hHash = 0;
    DWORD cbDigest;
    SP_STATUS pctRet;

    //
    // Compute the two hash values as follows:
    //
    // enum { client(0x434c4e54), server(0x53525652) } Sender;
    // enum { client("CLNT"), server("SRVR") } Sender;
    //
    // struct {
    //     opaque md5_hash[16];
    //     opaque sha_hash[20];
    // } Finished;
    //
    // md5_hash  -  MD5(master_secret + pad2 + MD5(handshake_messages +
    //      Sender + master_secret + pad1))
    //
    // sha_hash  -  SHA(master_secret + pad2 + SHA(handshake_messages +
    //      Sender + master_secret + pad1))
    //
    // pad_1 - The character 0x36 repeated 48 times for MD5 or
    //         40 times for SHA.
    //
    // pad_2 - The character 0x5c repeated the same number of times.
    //

    FillMemory(rgbPad1, sizeof(rgbPad1), PAD1_CONSTANT);
    FillMemory(rgbPad2, sizeof(rgbPad2), PAD2_CONSTANT);


    // Make local copy of the handshake_messages MD5 hash object
    if(!SchCryptDuplicateHash(pContext->hMd5Handshake,
                              NULL,
                              0,
                              &hHash,
                              pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    // Add rest of stuff to local MD5 hash object.
    if(!SchCryptHashData(hHash,
                         fClient ? szClnt : szSrvr,
                         4,
                         0,
                         pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    if(!SchCryptHashSessionKey(hHash,
                               pContext->RipeZombie->hMasterKey,
                               CRYPT_LITTLE_ENDIAN,
                               pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashData(hHash,
                         rgbPad1,
                         CB_SSL3_MD5_MAC_PAD,
                         0,
                         pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    cbDigest = CB_MD5_DIGEST_LEN;
    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             pbMd5Digest,
                             &cbDigest,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags);
    hHash = 0;

    // Compute "parent" MD5 hash
    if(!SchCryptCreateHash(pContext->RipeZombie->hMasterProv,
                           CALG_MD5,
                           0,
                           0,
                           &hHash,
                           pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashSessionKey(hHash,
                               pContext->RipeZombie->hMasterKey,
                               CRYPT_LITTLE_ENDIAN,
                               pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashData(hHash,
                         rgbPad2,
                         CB_SSL3_MD5_MAC_PAD,
                         0,
                         pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashData(hHash,
                         pbMd5Digest,
                         CB_MD5_DIGEST_LEN,
                         0,
                         pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    cbDigest = CB_MD5_DIGEST_LEN;
    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             pbMd5Digest,
                             &cbDigest,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags);
    hHash = 0;

    // Build SHA Hash

    // Make local copy of the handshake_messages SHA hash object
    if(!SchCryptDuplicateHash(pContext->hShaHandshake,
                              NULL,
                              0,
                              &hHash,
                              pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }

    // SHA(handshake_messages + Sender + master_secret + pad1)
    if(!SchCryptHashData(hHash,
                         fClient ? szClnt : szSrvr,
                         4,
                         0,
                         pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashSessionKey(hHash,
                               pContext->RipeZombie->hMasterKey,
                               CRYPT_LITTLE_ENDIAN,
                               pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashData(hHash,
                         rgbPad1,
                         CB_SSL3_SHA_MAC_PAD,
                         0,
                         pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    cbDigest = A_SHA_DIGEST_LEN;
    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             pbSHADigest,
                             &cbDigest,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags);
    hHash = 0;

    // SHA(master_secret + pad2 + SHA-hash);
    if(!SchCryptCreateHash(pContext->RipeZombie->hMasterProv,
                           CALG_SHA,
                           0,
                           0,
                           &hHash,
                           pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashSessionKey(hHash,
                               pContext->RipeZombie->hMasterKey,
                               CRYPT_LITTLE_ENDIAN,
                               pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashData(hHash,
                         rgbPad2,
                         CB_SSL3_SHA_MAC_PAD,
                         0,
                         pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    if(!SchCryptHashData(hHash,
                         pbSHADigest,
                         A_SHA_DIGEST_LEN,
                         0,
                         pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    cbDigest = A_SHA_DIGEST_LEN;
    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             pbSHADigest,
                             &cbDigest,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto cleanup;
    }
    SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags);
        hHash = 0;

    pctRet = PCT_ERR_OK;

cleanup:

    if(hHash)
    {
        SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags);
    }

    return pctRet;
}


/*****************************************************************************/
DWORD Ssl3CiphertextLen(
    PSPContext pContext,
    DWORD cbMessage,
    BOOL fClientIsSender)
{
    DWORD cbBlock;

    // Abort early if we're not encrypting.
    if(pContext->pWriteCipherInfo == NULL)
    {
        // Add record header length.
        cbMessage += sizeof(SWRAP);

        return cbMessage;
    }

    // Add MAC length.
    cbMessage += pContext->pWriteHashInfo->cbCheckSum;

    // Add padding if we're using a block cipher.
    cbBlock = pContext->pWriteCipherInfo->dwBlockSize;
    if(cbBlock > 1)
    {
        cbMessage += cbBlock - cbMessage % cbBlock;
    }

    // Add record header length.
    cbMessage += sizeof(SWRAP);

    return cbMessage;
}

//+---------------------------------------------------------------------------
//
//  Function:   Ssl3EncryptRaw
//
//  Synopsis:   Perform the MAC and encryption steps on an SSL3 record.
//
//  Arguments:  [pContext]      --  Schannel context.
//              [pAppInput]     --  Data to be encrypted.
//              [pCommOutput]   --  (output) Encrypted SSL3 record.
//              [bContentType]  --  SSL3 context type.
//
//  History:    10-22-97   jbanes   CAPI integrated.
//
//  Notes:      This function doesn't touch the header portion of the SSL3
//              record. This is handle by the calling function.
//
//----------------------------------------------------------------------------
SP_STATUS WINAPI
Ssl3EncryptRaw(
    PSPContext pContext,
    PSPBuffer  pAppInput,
    PSPBuffer  pCommOutput,
    BYTE       bContentType)
{
    SP_STATUS pctRet;
    SPBuffer Clean;
    SPBuffer Encrypted;
    DWORD cbBlock;
    DWORD cbPadding;
    PUCHAR pbMAC = NULL;
    BOOL   fIsClient = FALSE;
    DWORD  cbBuffExpected;

    if((pContext == NULL) ||
        (pContext->RipeZombie == NULL) ||
        (pContext->pWriteHashInfo == NULL) ||
        (pContext->pWriteCipherInfo == NULL) ||
        (pAppInput == NULL) ||
        (pCommOutput == NULL) ||
        (pAppInput->pvBuffer == NULL) ||
        (pCommOutput->pvBuffer == NULL))
    {
        return SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
    }

    if(pAppInput->cbData > pAppInput->cbBuffer)
    {
        return SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
    }
    fIsClient = ( 0 != (pContext->RipeZombie->fProtocol & SP_PROT_SSL3TLS1_CLIENTS));

    cbBuffExpected = Ssl3CiphertextLen(pContext, pAppInput->cbData, fIsClient);
    if(cbBuffExpected == 0)
    {
        return SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
    }

    if(pCommOutput->cbBuffer < cbBuffExpected)
    {
        return SP_LOG_RESULT(PCT_INT_BUFF_TOO_SMALL);
    }

    Clean.cbData   = pAppInput->cbData;
    Clean.pvBuffer = (PUCHAR)pCommOutput->pvBuffer + sizeof(SWRAP);
    Clean.cbBuffer = pCommOutput->cbBuffer - sizeof(SWRAP);

    /* Move data out of the way if necessary */
    if(Clean.pvBuffer != pAppInput->pvBuffer)
    {
        DebugLog((DEB_WARN, "SSL3EncryptRaw: Unnecessary Move, performance hog\n"));
        MoveMemory(Clean.pvBuffer,
                   pAppInput->pvBuffer,
                   pAppInput->cbData);
    }

    // Transfer the write key over from the application process.
    if(pContext->hWriteKey == 0 &&
       pContext->pWriteCipherInfo->aiCipher != CALG_NULLCIPHER)
    {
        DebugLog((DEB_TRACE, "Transfer write key from user process.\n"));
        pctRet = SPGetUserKeys(pContext, SCH_FLAG_WRITE_KEY);
        if(pctRet != PCT_ERR_OK)
        {
            return SP_LOG_RESULT(pctRet);
        }
    }

    // Compute MAC and add it to end of message.
    pbMAC = (PUCHAR)Clean.pvBuffer + Clean.cbData;
    if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3)
    {
        pctRet = Ssl3ComputeMac(pContext,
                                FALSE,
                                &Clean,
                                bContentType,
                                pbMAC,
                                pContext->pWriteHashInfo->cbCheckSum);
        if(pctRet != PCT_ERR_OK)
        {
            return pctRet;
        }
    }
    else
    {
        pctRet = Tls1ComputeMac(pContext,
                                FALSE,
                                &Clean,
                                bContentType,
                                pbMAC,
                                pContext->pWriteHashInfo->cbCheckSum);
        if(pctRet != PCT_ERR_OK)
        {
            return pctRet;
        }
    }
    Clean.cbData += pContext->pWriteHashInfo->cbCheckSum;

    pContext->WriteCounter++;

    // Add block cipher padding to end of message.
    cbBlock = pContext->pWriteCipherInfo->dwBlockSize;
    if(cbBlock > 1)
    {
        // This is a block cipher.
        cbPadding = cbBlock - Clean.cbData % cbBlock;

        FillMemory((PUCHAR)Clean.pvBuffer + Clean.cbData,
                   cbPadding,
                   (UCHAR)(cbPadding - 1));
        Clean.cbData += cbPadding;
    }

    SP_ASSERT(Clean.cbData <= Clean.cbBuffer);

    Encrypted.cbData   = Clean.cbData;
    Encrypted.pvBuffer = Clean.pvBuffer;
    Encrypted.cbBuffer = Clean.cbBuffer;

    // Encrypt message.
    if(pContext->pWriteCipherInfo->aiCipher != CALG_NULLCIPHER)
    {
        if(!SchCryptEncrypt(pContext->hWriteKey,
                            0, FALSE, 0,
                            Encrypted.pvBuffer,
                            &Encrypted.cbData,
                            Encrypted.cbBuffer,
                            pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            return PCT_INT_INTERNAL_ERROR;
        }
    }

    pCommOutput->cbData = Encrypted.cbData + sizeof(SWRAP);

    return PCT_ERR_OK;
}

//+---------------------------------------------------------------------------
//
//  Function:   Ssl3EncryptMessage
//
//  Synopsis:   Encode a block of data as an SSL3 record.
//
//  Arguments:  [pContext]      --  Schannel context.
//              [pAppInput]     --  Data to be encrypted.
//              [pCommOutput]   --  (output) Completed SSL3 record.
//
//  History:    10-22-97   jbanes   CAPI integrated.
//
//  Notes:      An SSL3 record is formatted as:
//
//                  BYTE header[5];
//                  BYTE data[pAppInput->cbData];
//                  BYTE mac[mac_size];
//                  BYTE padding[padding_size];
//
//----------------------------------------------------------------------------
SP_STATUS WINAPI
Ssl3EncryptMessage( PSPContext pContext,
                    PSPBuffer   pAppInput,
                    PSPBuffer   pCommOutput)
{
    DWORD cbMessage;
    SP_STATUS pctRet;

    SP_BEGIN("Ssl3EncryptMessage");

    if((pContext == NULL) ||
        (pContext->RipeZombie == NULL) ||
        (pAppInput == NULL) ||
        (pCommOutput == NULL) ||
        (pCommOutput->pvBuffer == NULL))
    {
        return SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
    }

    DebugLog((DEB_TRACE, "Input: cbData:0x%x, cbBuffer:0x%x, pvBuffer:0x%8.8x\n",
        pAppInput->cbData,
        pAppInput->cbBuffer,
        pAppInput->pvBuffer));

    DebugLog((DEB_TRACE, "Output: cbData:0x%x, cbBuffer:0x%x, pvBuffer:0x%8.8x\n",
        pCommOutput->cbData,
        pCommOutput->cbBuffer,
        pCommOutput->pvBuffer));

    // Compute encrypted message size.
    cbMessage = Ssl3CiphertextLen(pContext, pAppInput->cbData, TRUE);

    pctRet = Ssl3EncryptRaw(pContext, pAppInput, pCommOutput, SSL3_CT_APPLICATIONDATA);
    if(pctRet != PCT_ERR_OK)
    {
        SP_RETURN(SP_LOG_RESULT(pctRet));
    }

    SetWrapNoEncrypt(pCommOutput->pvBuffer,
                     SSL3_CT_APPLICATIONDATA,
                     cbMessage - sizeof(SWRAP));
    if(pContext->RipeZombie->fProtocol & SP_PROT_TLS1)
    {
        ((PUCHAR)pCommOutput->pvBuffer)[02] = TLS1_CLIENT_VERSION_LSB;
    }

    DebugLog((DEB_TRACE, "Output: cbData:0x%x, cbBuffer:0x%x, pvBuffer:0x%8.8x\n",
        pCommOutput->cbData,
        pCommOutput->cbBuffer,
        pCommOutput->pvBuffer));

    SP_RETURN(PCT_ERR_OK);
}


//+---------------------------------------------------------------------------
//
//  Function:   Ssl3DecryptMessage
//
//  Synopsis:   Decode an SSL3 record.
//
//  Arguments:  [pContext]      --  Schannel context.
//              [pMessage]      --  Data from the remote party.
//              [pAppOutput]    --  (output) Decrypted data.
//
//  History:    10-22-97   jbanes   CAPI integrated.
//
//  Notes:      The number of input data bytes consumed by this function
//              is returned in pMessage->cbData.
//
//----------------------------------------------------------------------------
SP_STATUS WINAPI
Ssl3DecryptMessage( PSPContext         pContext,
                    PSPBuffer          pMessage,
                    PSPBuffer          pAppOutput)
{
    SP_STATUS pctRet;
    SPBuffer  Clean;
    SPBuffer  Encrypted;
    UCHAR     rgbDigest[SP_MAX_DIGEST_LEN];
    PUCHAR    pbMAC;
    DWORD     dwLength, cbActualData;
    SWRAP     *pswrap = pMessage->pvBuffer;
    DWORD     dwVersion;

    DWORD cbBlock;
    DWORD cbPadding;

    SP_BEGIN("Ssl3DecryptMessage");

    if((pContext == NULL) ||
        (pContext->pReadCipherInfo == NULL) ||
        (pContext->RipeZombie == NULL) ||
        (pAppOutput == NULL) ||
        (pMessage == NULL) ||
        (pMessage->pvBuffer == NULL))
    {
        SP_RETURN(SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR));
    }

    /* First determine the length of data, the length of padding,
     * and the location of data, and the location of MAC */
    cbActualData = pMessage->cbData;
    pMessage->cbData = sizeof(SWRAP); /* minimum amount of data we need */

    if(cbActualData < sizeof(SWRAP))
    {
        SP_RETURN(PCT_INT_INCOMPLETE_MSG);
    }

    dwVersion = COMBINEBYTES(pswrap->bMajor, pswrap->bMinor);
    if(dwVersion != SSL3_CLIENT_VERSION && dwVersion != TLS1_CLIENT_VERSION)
    {
        SP_RETURN(SP_LOG_RESULT(PCT_INT_ILLEGAL_MSG));
    }

    dwLength = COMBINEBYTES(pswrap->bcbMSBSize, pswrap->bcbLSBSize);

    Encrypted.pvBuffer = (PUCHAR)pMessage->pvBuffer + sizeof(SWRAP);
    Encrypted.cbBuffer = pMessage->cbBuffer - sizeof(SWRAP);

    pMessage->cbData += dwLength ;

    if(pMessage->cbData > cbActualData)
    {
        SP_RETURN(PCT_INT_INCOMPLETE_MSG);
    }

    Encrypted.cbData = dwLength; /* encrypted data size */

    SP_ASSERT(Encrypted.cbData != 0);

    /* check to see if we have a block size violation */
    if(Encrypted.cbData % pContext->pReadCipherInfo->dwBlockSize)
    {
        SP_RETURN(SP_LOG_RESULT(PCT_INT_MSG_ALTERED));
    }

    // Transfer the read key over from the application process.
    if(pContext->hReadKey == 0 && 
       pContext->pReadCipherInfo->aiCipher != CALG_NULLCIPHER)
    {
        DebugLog((DEB_TRACE, "Transfer read key from user process.\n"));
        pctRet = SPGetUserKeys(pContext, SCH_FLAG_READ_KEY);
        if(pctRet != PCT_ERR_OK)
        {
            return SP_LOG_RESULT(pctRet);
        }
    }

    // Decrypt message.
    if(pContext->pReadCipherInfo->aiCipher != CALG_NULLCIPHER)
    {
        if(!SchCryptDecrypt(pContext->hReadKey,
                            0, FALSE, 0,
                            Encrypted.pvBuffer,
                            &Encrypted.cbData,
                            pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            SP_RETURN(PCT_INT_INTERNAL_ERROR);
        }
    }

    // Remove block cipher padding.
    cbBlock = pContext->pReadCipherInfo->dwBlockSize;
    if(cbBlock > 1)
    {
        // This is a block cipher.
        cbPadding = *((PUCHAR)Encrypted.pvBuffer + Encrypted.cbData - 1) + 1;

        if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3)
        {
            if(cbPadding > cbBlock || cbPadding >= Encrypted.cbData)
            {
                // Invalid pad size.
                DebugLog((DEB_WARN, "FINISHED Message: Padding Invalid\n"));
                SP_RETURN(SP_LOG_RESULT(PCT_INT_MSG_ALTERED));
            }
        }
        else
        {
            if(cbPadding > 256 || cbPadding >= Encrypted.cbData)
            {
                // Invalid pad size.
                DebugLog((DEB_WARN, "FINISHED Message: Padding Invalid\n"));
                SP_RETURN(SP_LOG_RESULT(PCT_INT_MSG_ALTERED));
            }
        }
        Encrypted.cbData -= cbPadding;
    }


    if(Encrypted.cbData < pContext->pReadHashInfo->cbCheckSum)
    {
        SP_RETURN(SP_LOG_RESULT(PCT_INT_MSG_ALTERED));
    }

    // Validate MAC.
    Clean.pvBuffer = Encrypted.pvBuffer;
    Clean.cbData   = Encrypted.cbData - pContext->pReadHashInfo->cbCheckSum;
    Clean.cbBuffer = Clean.cbData;

    if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3)
    {
        pctRet = Ssl3ComputeMac(pContext,
                                TRUE,
                                &Clean,
                                pswrap->bCType,
                                rgbDigest,
                                sizeof(rgbDigest));
        if(pctRet != PCT_ERR_OK)
        {
            return pctRet;
        }
    }
    else
    {
        pctRet = Tls1ComputeMac(pContext,
                                TRUE,
                                &Clean,
                                pswrap->bCType,
                                rgbDigest,
                                sizeof(rgbDigest));
        if(pctRet != PCT_ERR_OK)
        {
            return pctRet;
        }
    }

    pContext->ReadCounter++;

    pbMAC = (PUCHAR)Clean.pvBuffer + Clean.cbData;

    if(memcmp(rgbDigest, pbMAC, pContext->pReadHashInfo->cbCheckSum))
    {
        DebugLog((DEB_WARN, "FINISHED Message: Checksum Invalid\n"));
        if(pContext->RipeZombie->fProtocol & SP_PROT_TLS1)
        {
            SetTls1Alert(pContext, TLS1_ALERT_FATAL, TLS1_ALERT_BAD_RECORD_MAC);
        }
        SP_RETURN(SP_LOG_RESULT(SEC_E_MESSAGE_ALTERED));
    }

    if(pAppOutput->pvBuffer != Clean.pvBuffer)
    {
        CopyMemory(pAppOutput->pvBuffer, Clean.pvBuffer, Clean.cbData);
    }

    pAppOutput->cbData = Clean.cbData;

    SP_RETURN(PCT_ERR_OK);
}


/*****************************************************************************/
// Create an encrypted Finish message, adding it to the end of the
// specified buffer object.
//
SP_STATUS SPBuildS3FinalFinish(PSPContext pContext, PSPBuffer pBuffer, BOOL fClient)
{
    PBYTE pbMessage = (PBYTE)pBuffer->pvBuffer + pBuffer->cbData;
    DWORD cbFinished;
    SP_STATUS pctRet;
    DWORD cbDataOut;

    BYTE rgbMd5Digest[CB_MD5_DIGEST_LEN];
    BYTE rgbSHADigest[CB_SHA_DIGEST_LEN];

    // Build Finished message body.
    pctRet = Ssl3BuildFinishMessage(pContext, rgbMd5Digest, rgbSHADigest, fClient);
    if(pctRet != PCT_ERR_OK)
    {
        return pctRet;
    }

    CopyMemory(pbMessage + sizeof(SWRAP) + sizeof(SHSH),
               rgbMd5Digest,
               CB_MD5_DIGEST_LEN);
    CopyMemory(pbMessage + sizeof(SWRAP) + sizeof(SHSH) + CB_MD5_DIGEST_LEN,
               rgbSHADigest,
               CB_SHA_DIGEST_LEN);

    // Build Finished handshake header.
    SetHandshake(pbMessage + sizeof(SWRAP),
                 SSL3_HS_FINISHED,
                 NULL,
                 CB_MD5_DIGEST_LEN + CB_SHA_DIGEST_LEN);
    cbFinished = sizeof(SHSH) + CB_MD5_DIGEST_LEN + CB_SHA_DIGEST_LEN;

    // Update handshake hash objects.
    pctRet = UpdateHandshakeHash(pContext,
                                 pbMessage + sizeof(SWRAP),
                                 cbFinished,
                                 FALSE);
    if(pctRet != PCT_ERR_OK)
    {
        return(pctRet);
    }

    // Add record header and encrypt message.
    pctRet = SPSetWrap(pContext,
            pbMessage,
            SSL3_CT_HANDSHAKE,
            cbFinished,
            fClient,
            &cbDataOut);

    if(pctRet != PCT_ERR_OK)
    {
        return pctRet;
    }

    // Update buffer length.
    pBuffer->cbData += cbDataOut;

    SP_ASSERT(pBuffer->cbData <= pBuffer->cbBuffer);

    return PCT_ERR_OK;
}

SP_STATUS
SPSetWrap(
    PSPContext pContext,
    PUCHAR pbMessage,
    UCHAR bContentType,
    DWORD cbPayload,
    BOOL fClient,
    DWORD *pcbDataOut)
{
    SWRAP *pswrap = (SWRAP *)pbMessage;
    DWORD cbMessage;
    SP_STATUS pctRet = PCT_ERR_OK;

    // Compute size of encrypted message.
    cbMessage = Ssl3CiphertextLen(pContext, cbPayload, fClient);

    if(pContext->pWriteHashInfo)
    {
        SPBuffer Clean;
        SPBuffer Encrypted;

        Clean.pvBuffer = pbMessage + sizeof(SWRAP);
        Clean.cbBuffer = cbMessage;
        Clean.cbData   = cbPayload;

        Encrypted.pvBuffer  = pbMessage;
        Encrypted.cbBuffer  = cbMessage;
        Encrypted.cbData    = cbPayload + sizeof(SWRAP);

        pctRet = Ssl3EncryptRaw(pContext, &Clean, &Encrypted, bContentType);
        cbMessage = Encrypted.cbData;
    }

    ZeroMemory(pswrap, sizeof(SWRAP));
    pswrap->bCType      = bContentType;
    pswrap->bMajor      = SSL3_CLIENT_VERSION_MSB;
    if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3)
    {
        pswrap->bMinor = (UCHAR)SSL3_CLIENT_VERSION_LSB;
    }
    else
    {
        pswrap->bMinor = (UCHAR)TLS1_CLIENT_VERSION_LSB;
    }
    pswrap->bcbMSBSize  = MSBOF(cbMessage - sizeof(SWRAP));
    pswrap->bcbLSBSize  = LSBOF(cbMessage - sizeof(SWRAP));

    if(pcbDataOut != NULL)
    {
        *pcbDataOut = cbMessage;
    }

    return(pctRet);
}

void
SetWrapNoEncrypt(
    PUCHAR pbMessage,
    UCHAR bContentType,
    DWORD cbPayload)
{
    SWRAP *pswrap = (SWRAP *)pbMessage;

    ZeroMemory(pswrap, sizeof(SWRAP));
    pswrap->bCType      = bContentType;
    pswrap->bMajor      = SSL3_CLIENT_VERSION_MSB;
    pswrap->bMinor      = SSL3_CLIENT_VERSION_LSB;
    pswrap->bcbMSBSize  = MSBOF(cbPayload);
    pswrap->bcbLSBSize  = LSBOF(cbPayload);
}


void SetHandshake(PUCHAR pb, BYTE bHandshake, PUCHAR pbData, DWORD dwSize)
{
    SHSH *pshsh = (SHSH *) pb;

    FillMemory(pshsh, sizeof(SHSH), 0);
    pshsh->typHS = bHandshake;
    pshsh->bcbMSB = MSBOF(dwSize) ;
    pshsh->bcbLSB = LSBOF(dwSize) ;
    if(NULL != pbData)
    {
        CopyMemory( pb + sizeof(SHSH) , pbData, dwSize);
    }
}



//+---------------------------------------------------------------------------
//
//  Function:   UpdateHandshakeHash
//
//  Synopsis:
//
//  Arguments:  [pContext]      --
//              [pb]            --
//              [dwcb]          --
//              [fInit]         --
//
//  History:    10-03-97   jbanes   Added server-side CAPI integration.
//
//  Notes:
//
//----------------------------------------------------------------------------
SP_STATUS
UpdateHandshakeHash(
    PSPContext  pContext,
    PUCHAR      pb,
    DWORD       dwcb,
    BOOL        fInit)
{
    if(pContext->RipeZombie->hMasterProv == 0)
    {
        return SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
    }

    if(fInit)
    {
        DebugLog((DEB_TRACE, "UpdateHandshakeHash: initializing\n"));

        if(pContext->hMd5Handshake)
        {
            SchCryptDestroyHash(pContext->hMd5Handshake,
                                pContext->RipeZombie->dwCapiFlags);
            pContext->hMd5Handshake = 0;
        }
        if(!SchCryptCreateHash(pContext->RipeZombie->hMasterProv,
                               CALG_MD5, 0, 0,
                               &pContext->hMd5Handshake,
                               pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            return PCT_INT_INTERNAL_ERROR;
        }

        if(pContext->hShaHandshake)
        {
            SchCryptDestroyHash(pContext->hShaHandshake,
                                pContext->RipeZombie->dwCapiFlags);
            pContext->hShaHandshake = 0;
        }
        if(!SchCryptCreateHash(pContext->RipeZombie->hMasterProv,
                               CALG_SHA, 0, 0,
                               &pContext->hShaHandshake,
                               pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            return PCT_INT_INTERNAL_ERROR;
        }
    }

    if(pContext->hMd5Handshake == 0 || pContext->hShaHandshake == 0)
    {
        return SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
    }

    if(dwcb && NULL != pb)
    {
        DebugLog((DEB_TRACE, "UpdateHandshakeHash: %d bytes\n", dwcb));

        if(!SchCryptHashData(pContext->hMd5Handshake,
                             pb, dwcb, 0,
                             pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            return PCT_INT_INTERNAL_ERROR;
        }
        if(!SchCryptHashData(pContext->hShaHandshake,
                             pb, dwcb, 0,
                             pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            return PCT_INT_INTERNAL_ERROR;
        }
    }

    #if VERIFYHASH
        CopyMemory(&rgbF[ibF], pb, dwcb);
        ibF += dwcb;
    #endif

    return PCT_ERR_OK;
}


//+---------------------------------------------------------------------------
//
//  Function:   Tls1ComputeCertVerifyHashes
//
//  Synopsis:   Compute the hashes contained by a TLS
//              CertificateVerify message.
//
//  Arguments:  [pContext]  --  Schannel context.
//              [pbHash]    --
//              [cbHash]    --
//
//  History:    10-14-97   jbanes   Created.
//
//  Notes:      The data generated by this routine is always 36 bytes in
//              length, and consists of an MD5 hash followed by an SHA
//              hash.
//
//              The hash values are computed as:
//
//                  md5_hash = MD5(handshake_messages);
//
//                  sha_hash = SHA(handshake_messages);
//
//----------------------------------------------------------------------------
SP_STATUS
Tls1ComputeCertVerifyHashes(
    PSPContext  pContext,   // in
    PBYTE       pbMD5,      // out
    PBYTE       pbSHA)      // out
{
    HCRYPTHASH hHash = 0;
    DWORD cbData;

    if((pContext == NULL) ||
       (pContext->RipeZombie == NULL))
    {
        return SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
    }

    if(pbMD5 != NULL)
    {
        // md5_hash = MD5(handshake_messages);
        if(!SchCryptDuplicateHash(pContext->hMd5Handshake,
                                  NULL,
                                  0,
                                  &hHash,
                                  pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            return PCT_INT_INTERNAL_ERROR;
        }
        cbData = CB_MD5_DIGEST_LEN;
        if(!SchCryptGetHashParam(hHash,
                                 HP_HASHVAL,
                                 pbMD5,
                                 &cbData,
                                 0,
                                 pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags);
            return PCT_INT_INTERNAL_ERROR;
        }
        SP_ASSERT(cbData == CB_MD5_DIGEST_LEN);
        if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
        }
    }

    if(pbSHA != NULL)
    {
        // sha_hash = SHA(handshake_messages);
        if(!SchCryptDuplicateHash(pContext->hShaHandshake,
                                  NULL,
                                  0,
                                  &hHash,
                                  pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            return PCT_INT_INTERNAL_ERROR;
        }
        cbData = CB_SHA_DIGEST_LEN;
        if(!SchCryptGetHashParam(hHash,
                                 HP_HASHVAL, pbSHA,
                                 &cbData,
                                 0,
                                 pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags);
            return PCT_INT_INTERNAL_ERROR;
        }
        SP_ASSERT(cbData == CB_SHA_DIGEST_LEN);
        if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
        }
    }

    return PCT_ERR_OK;
}

//+---------------------------------------------------------------------------
//
//  Function:   Ssl3ComputeCertVerifyHashes
//
//  Synopsis:   Compute the hashes contained by an SSL3
//              CertificateVerify message.
//
//  Arguments:  [pContext]  --  Schannel context.
//              [pbHash]    --
//              [cbHash]    --
//
//  History:    10-14-97   jbanes   Added CAPI integration.
//
//  Notes:      The data generated by this routine is always 36 bytes in
//              length, and consists of an MD5 hash followed by an SHA
//              hash.
//
//              The hash values are computed as follows:
//
//                  md5_hash = MD5(master_secret + pad2 +
//                                 MD5(handshake_messages + master_secret +
//                                     pad1));
//
//                  sha_hash = SHA(master_secret + pad2 +
//                                 SHA(handshake_messages + master_secret +
//                                     pad1));
//
//----------------------------------------------------------------------------
SP_STATUS
Ssl3ComputeCertVerifyHashes(
    PSPContext  pContext,   // in
    PBYTE       pbMD5,      // out
    PBYTE       pbSHA)      // out
{
    BYTE rgbPad1[CB_SSL3_MAX_MAC_PAD];
    BYTE rgbPad2[CB_SSL3_MAX_MAC_PAD];
    HCRYPTHASH hHash = 0;
    DWORD cbData;
    SP_STATUS pctRet;

    FillMemory(rgbPad1, sizeof(rgbPad1), PAD1_CONSTANT);
    FillMemory(rgbPad2, sizeof(rgbPad2), PAD2_CONSTANT);

    if(pbMD5 != NULL)
    {
        //
        // CertificateVerify.signature.md5_hash = MD5(master_secret + pad2 +
        //    MD5(handshake_messages + master_secret + pad1));
        //

        // Compute inner hash.
        if(!SchCryptDuplicateHash(pContext->hMd5Handshake,
                                  NULL,
                                  0,
                                  &hHash,
                                  pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashSessionKey(hHash,
                                   pContext->RipeZombie->hMasterKey,
                                   CRYPT_LITTLE_ENDIAN,
                                   pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashData(hHash,
                             rgbPad1,
                             CB_SSL3_MD5_MAC_PAD,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        cbData = CB_MD5_DIGEST_LEN;
        if(!SchCryptGetHashParam(hHash,
                                 HP_HASHVAL,
                                 pbMD5,
                                 &cbData,
                                 0,
                                 pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        SP_ASSERT(cbData == CB_MD5_DIGEST_LEN);
        if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
        }
        hHash = 0;

        // Compute outer hash.
        if(!SchCryptCreateHash(pContext->RipeZombie->hMasterProv,
                               CALG_MD5,
                               0,
                               0,
                               &hHash,
                               pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashSessionKey(hHash,
                                   pContext->RipeZombie->hMasterKey,
                                   CRYPT_LITTLE_ENDIAN,
                                   pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashData(hHash,
                             rgbPad2,
                             CB_SSL3_MD5_MAC_PAD,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashData(hHash,
                             pbMD5,
                             CB_MD5_DIGEST_LEN,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        cbData = CB_MD5_DIGEST_LEN;
        if(!SchCryptGetHashParam(hHash,
                                 HP_HASHVAL,
                                 pbMD5,
                                 &cbData,
                                 0,
                                 pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        SP_ASSERT(cbData == CB_MD5_DIGEST_LEN);
        if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
        }
        hHash = 0;
    }

    if(pbSHA != NULL)
    {
        //
        // CertificateVerify.signature.sha_hash = SHA(master_secret + pad2 +
        //    SHA(handshake_messages + master_secret + pad1));
        //

        // Compute inner hash.
        if(!SchCryptDuplicateHash(pContext->hShaHandshake,
                                  NULL,
                                  0,
                                  &hHash,
                                  pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashSessionKey(hHash,
                                   pContext->RipeZombie->hMasterKey,
                                   CRYPT_LITTLE_ENDIAN,
                                   pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashData(hHash,
                             rgbPad1,
                             CB_SSL3_SHA_MAC_PAD,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        cbData = CB_SHA_DIGEST_LEN;
        if(!SchCryptGetHashParam(hHash,
                                 HP_HASHVAL, 
                                 pbSHA,
                                 &cbData,
                                 0,
                                 pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        SP_ASSERT(cbData == CB_SHA_DIGEST_LEN);
        if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
        }
        hHash = 0;

        // Compute outer hash.
        if(!SchCryptCreateHash(pContext->RipeZombie->hMasterProv,
                               CALG_SHA,
                               0,
                               0,
                               &hHash,
                               pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashSessionKey(hHash,
                                   pContext->RipeZombie->hMasterKey,
                                   CRYPT_LITTLE_ENDIAN,
                                   pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashData(hHash,
                             rgbPad2,
                             CB_SSL3_SHA_MAC_PAD,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        if(!SchCryptHashData(hHash,
                             pbSHA,
                             CB_SHA_DIGEST_LEN,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        cbData = CB_SHA_DIGEST_LEN;
        if(!SchCryptGetHashParam(hHash,
                                 HP_HASHVAL,
                                 pbSHA,
                                 &cbData,
                                 0,
                                 pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
            pctRet = PCT_INT_INTERNAL_ERROR;
            goto cleanup;
        }
        SP_ASSERT(cbData == CB_SHA_DIGEST_LEN);
        if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
        }
        hHash = 0;
    }

    pctRet = PCT_ERR_OK;

cleanup:

    if(hHash)
    {
        SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags);
    }

    return pctRet;
}


SP_STATUS Ssl3HandleCCS(PSPContext pContext,
                   PUCHAR pb,
                   DWORD cbMessage)
{

    SP_STATUS pctRet = PCT_ERR_OK;
    BOOL fSender =
        (0 == (pContext->RipeZombie->fProtocol & SP_PROT_SSL3TLS1_CLIENTS)) ;


    SP_BEGIN("Ssl3HandleCCS");

    if(cbMessage != 1 || pb[0] != 0x1)
    {
        pctRet = SP_LOG_RESULT(PCT_ERR_ILLEGAL_MESSAGE);
        SP_RETURN(pctRet);
    }

    // We always zero out the read counter on receipt
    // of a change cipher spec message.
    pContext->ReadCounter = 0;


    // Move pending ciphers to real ciphers
    pctRet = ContextInitCiphers(pContext, TRUE, FALSE);

    if(pctRet != PCT_ERR_OK)
    {
        SP_RETURN(pctRet);
    }

    if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3)
    {
        pctRet = Ssl3MakeReadSessionKeys(pContext);
    }
    else
    {
        pctRet = Tls1MakeReadSessionKeys(pContext);
    }
    if(pctRet != PCT_ERR_OK)
    {
        SP_RETURN(pctRet);
    }

    if(fSender)
    {
        pContext->wS3CipherSuiteClient = (WORD)UniAvailableCiphers[pContext->dwPendingCipherSuiteIndex].CipherKind;
        pContext->State = SSL3_STATE_CHANGE_CIPHER_SPEC_SERVER;
    }
    else
    {
        pContext->wS3CipherSuiteServer = (WORD)UniAvailableCiphers[pContext->dwPendingCipherSuiteIndex].CipherKind;
        pContext->State = SSL3_STATE_CHANGE_CIPHER_SPEC_CLIENT;
    }
    SP_RETURN(PCT_ERR_OK);
}


/*****************************************************************************/
// Create a (possibly encrypted) ChangeCipherSpec and an encrypted
// Finish message, adding them to the end of the specified buffer object.
//
SP_STATUS
BuildCCSAndFinishMessage(
    PSPContext pContext,
    PSPBuffer pBuffer,
    BOOL fClient)
{
    SP_STATUS pctRet;
    PBYTE pbMessage = (PBYTE)pBuffer->pvBuffer + pBuffer->cbData;
    DWORD cbDataOut;

    // Build ChangeCipherSpec message body.
    *(pbMessage + sizeof(SWRAP)) = 0x1;

    // Add record header and encrypt message.
    pctRet = SPSetWrap(pContext,
            pbMessage,
            SSL3_CT_CHANGE_CIPHER_SPEC,
            1,
            fClient,
            &cbDataOut);

    if(pctRet != PCT_ERR_OK)
        return(pctRet);

    // Update buffer length.
    pBuffer->cbData += cbDataOut;

    SP_ASSERT(pBuffer->cbData <= pBuffer->cbBuffer);

    // Update cipher suites.
    pContext->WriteCounter = 0;

    pctRet = ContextInitCiphers(pContext, FALSE, TRUE);
    if(pctRet != PCT_ERR_OK)
    {
        return(pctRet);
    }

    if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3)
    {
        pctRet = Ssl3MakeWriteSessionKeys(pContext);
    }
    else
    {
        pctRet = Tls1MakeWriteSessionKeys(pContext);
    }
    if(pctRet != PCT_ERR_OK)
    {
        return(pctRet);
    }

    if(fClient)
    {
        pContext->wS3CipherSuiteClient = (WORD)UniAvailableCiphers[pContext->dwPendingCipherSuiteIndex].CipherKind;
    }
    else
    {
        pContext->wS3CipherSuiteServer = (WORD)UniAvailableCiphers[pContext->dwPendingCipherSuiteIndex].CipherKind;
    }

    // Build Finish message.
    if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3)
    {
        pctRet = SPBuildS3FinalFinish(pContext, pBuffer, fClient);
    }
    else
    {
        pctRet = SPBuildTls1FinalFinish(pContext, pBuffer, fClient);
    }

    return pctRet;
}



SP_STATUS
Ssl3SelectCipher
(
    PSPContext pContext,
    WORD       wCipher
)
{
    SP_STATUS          pctRet=PCT_ERR_ILLEGAL_MESSAGE;
    DWORD               i;
    PCipherInfo         pCipherInfo = NULL;
    PHashInfo           pHashInfo = NULL;
    PKeyExchangeInfo    pExchInfo = NULL;

    pContext->dwPendingCipherSuiteIndex = 0;

    for(i = 0; i < UniNumCiphers; i++)
    {
        // Is this an SSL3 cipher suite?
        if(!(UniAvailableCiphers[i].fProt & pContext->RipeZombie->fProtocol))
        {
            continue;
        }

        // Is this the right cipher suite?
        if(UniAvailableCiphers[i].CipherKind != wCipher)
        {
            continue;
        }

        pCipherInfo = GetCipherInfo(UniAvailableCiphers[i].aiCipher, UniAvailableCiphers[i].dwStrength);
        pHashInfo = GetHashInfo(UniAvailableCiphers[i].aiHash);
        pExchInfo = GetKeyExchangeInfo(UniAvailableCiphers[i].KeyExch);

        if(!IsCipherAllowed(pContext,
                            pCipherInfo,
                            pContext->RipeZombie->fProtocol,
                            pContext->RipeZombie->dwCF))
        {
            continue;
        }
        if(!IsHashAllowed(pContext, pHashInfo, pContext->RipeZombie->fProtocol))
        {
            continue;
        }
        if(!IsExchAllowed(pContext, pExchInfo, pContext->RipeZombie->fProtocol))
        {
            continue;
        }


        if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3TLS1_SERVERS)
        {
            // Determine the credentials (and CSP) to use, based on the
            // key exchange algorithm.
            pctRet = SPPickClientCertificate(pContext,
                                             UniAvailableCiphers[i].KeyExch);

            if(pctRet != PCT_ERR_OK)
            {
                continue;
            }
        }

        pContext->RipeZombie->dwCipherSuiteIndex = i;
        pContext->RipeZombie->aiCipher  = UniAvailableCiphers[i].aiCipher;
        pContext->RipeZombie->dwStrength  = UniAvailableCiphers[i].dwStrength;
        pContext->RipeZombie->aiHash  = UniAvailableCiphers[i].aiHash;
        pContext->RipeZombie->SessExchSpec  = UniAvailableCiphers[i].KeyExch;

        return ContextInitCiphersFromCache(pContext);
    }

    return(SP_LOG_RESULT(PCT_ERR_ILLEGAL_MESSAGE));
}

// Server side cipher selection

SP_STATUS
Ssl3SelectCipherEx(
    PSPContext pContext,
    DWORD *pCipherSpecs,
    DWORD cCipherSpecs)
{
    DWORD i, j;
    SP_STATUS pctRet;
    PCipherInfo         pCipherInfo = NULL;
    PHashInfo           pHashInfo = NULL;
    PKeyExchangeInfo    pExchInfo = NULL;
    PSPCredential       pCred = NULL;
    BOOL                fFound;

    pContext->dwPendingCipherSuiteIndex = 0;

    // Loop through the supported SSL3 cipher suites.
    for(i = 0; i < UniNumCiphers; i++)
    {
        // Is this an SSL3 cipher suite?
        if(!(UniAvailableCiphers[i].fProt & pContext->RipeZombie->fProtocol))
        {
            continue;
        }

        pCipherInfo = GetCipherInfo(UniAvailableCiphers[i].aiCipher,
                                    UniAvailableCiphers[i].dwStrength);
        pHashInfo = GetHashInfo(UniAvailableCiphers[i].aiHash);
        pExchInfo = GetKeyExchangeInfo(UniAvailableCiphers[i].KeyExch);

        // Do we currently support this hash and key exchange algorithm?
        if(!IsHashAllowed(pContext, pHashInfo, pContext->RipeZombie->fProtocol))
        {
            DebugLog((DEB_TRACE, "Cipher %d - hash not supported\n", i));
            continue;
        }
        if(!IsExchAllowed(pContext, pExchInfo, pContext->RipeZombie->fProtocol))
        {
            DebugLog((DEB_TRACE, "Cipher %d - exch not supported\n", i));
            continue;
        }

        // Do we have an appropriate certificate?
        if(pContext->RipeZombie->fProtocol & SP_PROT_SSL3TLS1_SERVERS)
        {
            pctRet = SPPickServerCertificate(pContext,
                                             UniAvailableCiphers[i].KeyExch);

            if(pctRet != PCT_ERR_OK)
            {
                DebugLog((DEB_TRACE, "Cipher %d - certificate %d not found\n",
                    i, UniAvailableCiphers[i].KeyExch));
                continue;
            }
        }
        pCred = pContext->RipeZombie->pActiveServerCred;


        // Do we support this encryption algorithm/key length?
        if(!IsCipherSuiteAllowed(pContext,
                            pCipherInfo,
                            pContext->RipeZombie->fProtocol,
                            pCred->dwCF,
                            UniAvailableCiphers[i].dwFlags))
        {
            DebugLog((DEB_TRACE, "Cipher %d - cipher not supported\n", i));
            continue;
        }

        // Is this cipher suite supported by the client?
        for(fFound = FALSE, j = 0; j < cCipherSpecs; j++)
        {
            if(UniAvailableCiphers[i].CipherKind == pCipherSpecs[j])
            {
                fFound = TRUE;
                break;
            }
        }
        if(!fFound)
        {
            DebugLog((DEB_TRACE, "Cipher %d - not supported by client\n", i));
            continue;
        }


        if(UniAvailableCiphers[i].KeyExch == SP_EXCH_RSA_PKCS1)
        {
            // This is an RSA cipher suite, so make sure that the
            // CSP supports it.
            if(!IsAlgSupportedCapi(pContext->RipeZombie->fProtocol,
                                   UniAvailableCiphers + i,
                                   pCred->pCapiAlgs,
                                   pCred->cCapiAlgs))
            {
                DebugLog((DEB_TRACE, "Cipher %d - not supported by csp\n", i));
                continue;
            }
        }


        if(UniAvailableCiphers[i].KeyExch == SP_EXCH_DH_PKCS3)
        {
            // This is a DH cipher suite, so make sure that the
            // CSP supports it.
            if(!IsAlgSupportedCapi(pContext->RipeZombie->fProtocol,
                                   UniAvailableCiphers + i,
                                   pCred->pCapiAlgs,
                                   pCred->cCapiAlgs))
            {
                DebugLog((DEB_TRACE, "Cipher %d - not supported by csp\n", i));
                continue;
            }
        }


        // Use this cipher.
        pContext->RipeZombie->dwCipherSuiteIndex = i;
        pContext->RipeZombie->aiCipher      = UniAvailableCiphers[i].aiCipher;
        pContext->RipeZombie->dwStrength    = UniAvailableCiphers[i].dwStrength;
        pContext->RipeZombie->aiHash        = UniAvailableCiphers[i].aiHash;
        pContext->RipeZombie->SessExchSpec  = UniAvailableCiphers[i].KeyExch;
        pContext->RipeZombie->dwCF          = pCred->dwCF;

        return ContextInitCiphersFromCache(pContext);
    }

    LogCipherMismatchEvent();

    return SP_LOG_RESULT(PCT_ERR_SPECS_MISMATCH);
}


/*****************************************************************************/
VOID ComputeServerExchangeHashes(
    PSPContext pContext,
    PBYTE pbServerParams,      // in
    INT   iServerParamsLen,    // in
    PBYTE pbMd5HashVal,        // out
    PBYTE pbShaHashVal)        // out
{
    MD5_CTX Md5Hash;
    A_SHA_CTX ShaHash;

    //
    // md5_hash = MD5(ClientHello.random + ServerHello.random + ServerParams);
    //
    // sha_hash = SHA(ClientHello.random + ServerHello.random + ServerParams);
    //

    MD5Init(&Md5Hash);
    MD5Update(&Md5Hash, pContext->rgbS3CRandom, 32);
    MD5Update(&Md5Hash, pContext->rgbS3SRandom, 32);
    MD5Update(&Md5Hash, pbServerParams, iServerParamsLen);
    MD5Final(&Md5Hash);
    CopyMemory(pbMd5HashVal, Md5Hash.digest, 16);

    A_SHAInit(&ShaHash);
    A_SHAUpdate(&ShaHash, pContext->rgbS3CRandom, 32);
    A_SHAUpdate(&ShaHash, pContext->rgbS3SRandom, 32);
    A_SHAUpdate(&ShaHash, pbServerParams, iServerParamsLen);
    A_SHAFinal(&ShaHash, pbShaHashVal);
}

SP_STATUS
UnwrapSsl3Message(
    PSPContext pContext,
    PSPBuffer pMsgInput)
{
    SPBuffer   Encrypted;
    SPBuffer   Clean;
    SP_STATUS pctRet;
    SWRAP *pswrap = (SWRAP *)pMsgInput->pvBuffer;
    PBYTE pbMsg = (PBYTE)pMsgInput->pvBuffer;

    //
    // Validate 5 byte header.
    //

    // ProtocolVersion version;
    if(COMBINEBYTES(pbMsg[1], pbMsg[2])  < SSL3_CLIENT_VERSION)
    {
        pctRet = SP_LOG_RESULT(PCT_ERR_ILLEGAL_MESSAGE);
    }

    if(COMBINEBYTES(pswrap->bcbMSBSize, pswrap->bcbLSBSize) <
                        pContext->pReadHashInfo->cbCheckSum)
    {
        return(PCT_ERR_ILLEGAL_MESSAGE);
    }

    Encrypted.pvBuffer = pMsgInput->pvBuffer;
    Encrypted.cbBuffer = pMsgInput->cbBuffer;
    Encrypted.cbData = pMsgInput->cbData;
    Clean.pvBuffer = (PUCHAR)pMsgInput->pvBuffer + sizeof(SWRAP);
    pctRet = Ssl3DecryptMessage(pContext, &Encrypted, &Clean);
    if(pctRet == PCT_ERR_OK)
    {
        pswrap->bcbMSBSize = MSBOF(Clean.cbData);
        pswrap->bcbLSBSize = LSBOF(Clean.cbData);
    }
    return(pctRet);
}



SP_STATUS
ParseAlertMessage(
    PSPContext pContext,
    PUCHAR pbAlertMsg,
    DWORD cbMessage
    )
{
    SP_STATUS   pctRet=PCT_ERR_OK;
    if(cbMessage != 2)
    {
        return SP_LOG_RESULT(PCT_ERR_ILLEGAL_MESSAGE);
    }

    if(pbAlertMsg[0] != SSL3_ALERT_WARNING  &&  pbAlertMsg[0] != SSL3_ALERT_FATAL)
    {
        return SP_LOG_RESULT(PCT_ERR_ILLEGAL_MESSAGE);
    }

    DebugLog((DEB_WARN, "AlertMessage, Alert Level -  %lx\n", (DWORD)pbAlertMsg[0]));
    DebugLog((DEB_WARN, "AlertMessage, Alert Description -  %lx\n", (DWORD)pbAlertMsg[1]));

    if(pbAlertMsg[0] == SSL3_ALERT_WARNING)
    {
        switch(pbAlertMsg[1])
        {
        case SSL3_ALERT_NO_CERTIFICATE:
            DebugLog((DEB_TRACE, "no_certificate alert\n"));
            pContext->State = SSL3_STATE_NO_CERT_ALERT;
            pctRet = PCT_ERR_OK;
            break;

        case SSL3_ALERT_CLOSE_NOTIFY:
            DebugLog((DEB_TRACE, "close_notify alert\n"));
            pctRet = SEC_I_CONTEXT_EXPIRED;
            break;

        default:
            DebugLog((DEB_TRACE, "Ignoring warning alert\n"));
            pctRet = PCT_ERR_OK;
            break;
        }
    }
    else
    {
        switch(pbAlertMsg[1])
        {
        case SSL3_ALERT_UNEXPECTED_MESSAGE:
            DebugLog((DEB_TRACE, "unexpected_message alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_ILLEGAL_MESSAGE);
            break;

        case TLS1_ALERT_BAD_RECORD_MAC:
            DebugLog((DEB_TRACE, "bad_record_mac alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_MESSAGE_ALTERED);
            break;

        case TLS1_ALERT_DECRYPTION_FAILED:
            DebugLog((DEB_TRACE, "decryption_failed alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_DECRYPT_FAILURE);
            break;

        case TLS1_ALERT_RECORD_OVERFLOW:
            DebugLog((DEB_TRACE, "record_overflow alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_ILLEGAL_MESSAGE);
            break;

        case SSL3_ALERT_DECOMPRESSION_FAIL:
            DebugLog((DEB_TRACE, "decompression_fail alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_MESSAGE_ALTERED);
            break;

        case SSL3_ALERT_HANDSHAKE_FAILURE:
            DebugLog((DEB_TRACE, "handshake_failure alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_ILLEGAL_MESSAGE);
            break;

        case TLS1_ALERT_BAD_CERTIFICATE:
            DebugLog((DEB_TRACE, "bad_certificate alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_CERT_UNKNOWN);
            break;

        case TLS1_ALERT_UNSUPPORTED_CERT:
            DebugLog((DEB_TRACE, "unsupported_cert alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_CERT_UNKNOWN);
            break;

        case TLS1_ALERT_CERTIFICATE_REVOKED:
            DebugLog((DEB_TRACE, "certificate_revoked alert\n"));
            pctRet = SP_LOG_RESULT(CRYPT_E_REVOKED);
            break;

        case TLS1_ALERT_CERTIFICATE_EXPIRED:
            DebugLog((DEB_TRACE, "certificate_expired alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_CERT_EXPIRED);
            break;

        case TLS1_ALERT_CERTIFICATE_UNKNOWN:
            DebugLog((DEB_TRACE, "certificate_unknown alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_CERT_UNKNOWN);
            break;

        case SSL3_ALERT_ILLEGAL_PARAMETER:
            DebugLog((DEB_TRACE, "illegal_parameter alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_ILLEGAL_MESSAGE);
            break;

        case TLS1_ALERT_UNKNOWN_CA:
            DebugLog((DEB_TRACE, "unknown_ca alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_UNTRUSTED_ROOT);
            break;

        case TLS1_ALERT_ACCESS_DENIED:
            DebugLog((DEB_TRACE, "access_denied alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_LOGON_DENIED);
            break;

        case TLS1_ALERT_DECODE_ERROR:
            DebugLog((DEB_TRACE, "decode_error alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_ILLEGAL_MESSAGE);
            break;

        case TLS1_ALERT_DECRYPT_ERROR:
            DebugLog((DEB_TRACE, "decrypt_error alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_DECRYPT_FAILURE);
            break;

        case TLS1_ALERT_EXPORT_RESTRICTION:
            DebugLog((DEB_TRACE, "export_restriction alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_ILLEGAL_MESSAGE);
            break;

        case TLS1_ALERT_PROTOCOL_VERSION:
            DebugLog((DEB_TRACE, "protocol_version alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_UNSUPPORTED_FUNCTION);
            break;

        case TLS1_ALERT_INSUFFIENT_SECURITY:
            DebugLog((DEB_TRACE, "insuffient_security alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_ALGORITHM_MISMATCH);
            break;

        case TLS1_ALERT_INTERNAL_ERROR:
            DebugLog((DEB_TRACE, "internal_error alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_INTERNAL_ERROR);
            break;

        default:
            DebugLog((DEB_TRACE, "Unknown fatal alert\n"));
            pctRet = SP_LOG_RESULT(SEC_E_ILLEGAL_MESSAGE);
            break;
        }
    }

    return pctRet;
}


void BuildAlertMessage(PBYTE pbAlertMsg, UCHAR bAlertLevel, UCHAR bAlertDesc)
{
    ALRT *palrt = (ALRT *) pbAlertMsg;

    FillMemory(palrt, sizeof(ALRT), 0);

    palrt->bCType = SSL3_CT_ALERT;
    palrt->bMajor = SSL3_CLIENT_VERSION_MSB;
//  palrt->bMinor = SSL3_CLIENT_VERSION_LSB; DONE by FillMemory
//  palrt->bcbMSBSize = 0; Done by FillMemory
    palrt->bcbLSBSize = 2;
    palrt->bAlertLevel = bAlertLevel;
    palrt->bAlertDesc  = bAlertDesc ;
}


SP_STATUS SPPacketSplit(BYTE bContentType, PSPBuffer pPlain)
    //Now let's us see whether we have the FULL-handshake
    {
        SP_STATUS pctRet = PCT_ERR_OK;
        PBYTE pb;
        DWORD cb;

        pb = pPlain->pvBuffer;

        switch(bContentType)
        {
        case SSL3_CT_HANDSHAKE:
            if(pPlain->cbData >= sizeof(SHSH))
            {
                cb = ((INT)pb[1] << 16) + ((INT)pb[2] << 8) + (INT)pb[3];
                cb += sizeof(SHSH);
                if( cb > pPlain->cbData)
                {
                    return(PCT_INT_INCOMPLETE_MSG);
                }

            }
            else
                return(PCT_INT_INCOMPLETE_MSG);
            break;
        case SSL3_CT_ALERT:
            if(pPlain->cbData != 2)
                return(PCT_INT_INCOMPLETE_MSG);
            break;
        case SSL3_CT_CHANGE_CIPHER_SPEC:
            if(pPlain->cbData != 1)
                return(PCT_INT_INTERNAL_ERROR);
        default:
            break;
        }

        return(pctRet);
    }



/*****************************************************************************/
// Create an encrypted Finish message, adding it to the end of the
// specified buffer object.
//
SP_STATUS SPBuildTls1FinalFinish(PSPContext pContext, PSPBuffer pBuffer, BOOL fClient)
{
    PBYTE pbMessage = (PBYTE)pBuffer->pvBuffer + pBuffer->cbData;
    DWORD cbFinished;
    SP_STATUS pctRet;
    DWORD cbDataOut;

    BYTE  rgbDigest[CB_TLS1_VERIFYDATA];

    // Build Finished message body.
    pctRet = Tls1BuildFinishMessage(pContext, rgbDigest, sizeof(rgbDigest), fClient);
    if(pctRet != PCT_ERR_OK)
    {
        return pctRet;
    }

    CopyMemory(pbMessage + sizeof(SWRAP) + sizeof(SHSH),
               rgbDigest,
               CB_TLS1_VERIFYDATA);

    // Build Finished handshake header.
    SetHandshake(pbMessage + sizeof(SWRAP),
                 SSL3_HS_FINISHED,
                 NULL,
                 CB_TLS1_VERIFYDATA);
    cbFinished = sizeof(SHSH) + CB_TLS1_VERIFYDATA;

    // Update handshake hash objects.
    pctRet = UpdateHandshakeHash(pContext,
                                 pbMessage + sizeof(SWRAP),
                                 cbFinished,
                                 FALSE);
    if(pctRet != PCT_ERR_OK)
    {
        return(pctRet);
    }

    // Add record header and encrypt message.
    pctRet = SPSetWrap(pContext,
            pbMessage,
            SSL3_CT_HANDSHAKE,
            cbFinished,
            fClient,
            &cbDataOut);

    if(pctRet != PCT_ERR_OK)
    {
        return(pctRet);
    }

    // Update buffer length .
    pBuffer->cbData += cbDataOut;

    SP_ASSERT(pBuffer->cbData <= pBuffer->cbBuffer);

    return pctRet;
}


//+---------------------------------------------------------------------------
//
//  Function:   Tls1BuildFinishMessage
//
//  Synopsis:   Compute a TLS MAC for the specified message.
//
//  Arguments:  [pContext]      --  Schannel context.
//              [pbVerifyData]  --  Verify data buffer.
//              [cbVerifyData]  --  Length of verify data buffer.
//              [fClient]       --  Client-generated Finished?
//
//  History:    10-13-97   jbanes   Created.
//
//  Notes:      The Finished message is computed using the following formula:
//
//              verify_data = PRF(master_secret, finished_label,
//                                MD5(handshake_messages) +
//                                SHA-1(handshake_messages)) [0..11];
//
//----------------------------------------------------------------------------
SP_STATUS
Tls1BuildFinishMessage(
    PSPContext  pContext,       // in
    PBYTE       pbVerifyData,   // out
    DWORD       cbVerifyData,   // in
    BOOL        fClient)        // in
{
    PBYTE pbLabel;
    DWORD cbLabel;
    UCHAR rgbData[CB_MD5_DIGEST_LEN + CB_SHA_DIGEST_LEN];
    DWORD cbData;
    HCRYPTHASH hHash = 0;
    CRYPT_DATA_BLOB Data;
    SP_STATUS pctRet;

    if(cbVerifyData < CB_TLS1_VERIFYDATA)
    {
        return SP_LOG_RESULT(PCT_INT_BUFF_TOO_SMALL);
    }

    if(fClient)
    {
        pbLabel = TLS1_LABEL_CLIENTFINISHED;
    }
    else
    {
        pbLabel = TLS1_LABEL_SERVERFINISHED;
    }
    cbLabel = CB_TLS1_LABEL_FINISHED;


    // Get the MD5 hash of the handshake messages so far.
    if(!SchCryptDuplicateHash(pContext->hMd5Handshake,
                              NULL,
                              0,
                              &hHash,
                              pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto error;
    }

    cbData = CB_MD5_DIGEST_LEN;
    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             rgbData,
                             &cbData,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto error;
    }

    if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
    }
    hHash = 0;

    // Get the SHA hash of the handshake messages so far.
    if(!SchCryptDuplicateHash(pContext->hShaHandshake,
                              NULL,
                              0,
                              &hHash,
                              pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto error;
    }

    cbData = A_SHA_DIGEST_LEN;
    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             rgbData + CB_MD5_DIGEST_LEN,
                             &cbData,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto error;
    }

    cbData = CB_MD5_DIGEST_LEN + CB_SHA_DIGEST_LEN;

    if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
    }
    hHash = 0;

    // Compute the PRF
    if(!SchCryptCreateHash(pContext->RipeZombie->hMasterProv,
                           CALG_TLS1PRF,
                           pContext->RipeZombie->hMasterKey,
                           0,
                           &hHash,
                           pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto error;
    }

    Data.pbData = pbLabel;
    Data.cbData = cbLabel;
    if(!SchCryptSetHashParam(hHash,
                             HP_TLS1PRF_LABEL,
                             (PBYTE)&Data,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto error;
    }

    Data.pbData = rgbData;
    Data.cbData = cbData;
    if(!SchCryptSetHashParam(hHash,
                             HP_TLS1PRF_SEED,
                             (PBYTE)&Data,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto error;
    }

    if(!SchCryptGetHashParam(hHash,
                             HP_HASHVAL,
                             pbVerifyData,
                             &cbVerifyData,
                             0,
                             pContext->RipeZombie->dwCapiFlags))
    {
        SP_LOG_RESULT(GetLastError());
        pctRet = PCT_INT_INTERNAL_ERROR;
        goto error;
    }

    pctRet = PCT_ERR_OK;


error:

    if(hHash)
    {
        if(!SchCryptDestroyHash(hHash, pContext->RipeZombie->dwCapiFlags))
        {
            SP_LOG_RESULT(GetLastError());
        }
    }

    return pctRet;
}

SP_STATUS
SPBuildTlsAlertMessage(
    PSPContext  pContext,       // in
    PSPBuffer pCommOutput)
{
    PBYTE pbMessage = NULL;
    DWORD cbMessage;
    BOOL  fAllocated = FALSE;
    SP_STATUS pctRet;
    DWORD cbDataOut;

    SP_BEGIN("SPBuildTlsAlertMessage");

    cbMessage =  sizeof(SWRAP) +
                         CB_SSL3_ALERT_ONLY +
                         SP_MAX_DIGEST_LEN +
                         SP_MAX_BLOCKCIPHER_SIZE;

    if(pContext->State != TLS1_STATE_ERROR)
    {
        SP_RETURN(SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR));
    }

    if(pCommOutput->pvBuffer)
    {
        // Application has allocated memory.
        if(pCommOutput->cbBuffer < cbMessage)
        {
            pCommOutput->cbData = cbMessage;
            return SP_LOG_RESULT(PCT_INT_BUFF_TOO_SMALL);
        }
        fAllocated = TRUE;
    }
    else
    {
        // Schannel is to allocate memory.
        pCommOutput->cbBuffer = cbMessage;
        pCommOutput->pvBuffer = SPExternalAlloc(cbMessage);
        if(pCommOutput->pvBuffer == NULL)
        {
            SP_RETURN(SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY));
        }
    }
    pCommOutput->cbData = 0;


    pbMessage = (PBYTE)pCommOutput->pvBuffer;


     // Build alert message.
    BuildAlertMessage(pbMessage,
                      pContext->bAlertLevel,
                      pContext->bAlertNumber);

#if DBG
    DBG_HEX_STRING(DEB_TRACE, pbMessage, sizeof(ALRT));
#endif

    // Build record header and encrypt message.
    pctRet = SPSetWrap(pContext,
                pbMessage,
                SSL3_CT_ALERT,
                CB_SSL3_ALERT_ONLY,
                pContext->dwProtocol & SP_PROT_SSL3TLS1_CLIENTS,
                &cbDataOut);

    if(pctRet !=  PCT_ERR_OK)
    {
        if(!fAllocated)
        {
            SPExternalFree(pCommOutput->pvBuffer);
            pCommOutput->pvBuffer = NULL;
        }
        SP_RETURN(SP_LOG_RESULT(pctRet));
    }

    // Update buffer length.
    pCommOutput->cbData = cbDataOut;

    SP_ASSERT(pCommOutput->cbData <= pCommOutput->cbBuffer);

    SP_RETURN(PCT_ERR_OK);
}


void
SetTls1Alert(
    PSPContext  pContext,
    BYTE        bAlertLevel,
    BYTE        bAlertNumber)
{
    pContext->State        = TLS1_STATE_ERROR;
    pContext->bAlertLevel  = bAlertLevel;
    pContext->bAlertNumber = bAlertNumber;
}