http: introduce schannel streams for windows

Provide a stream interface for Schannel - the native crypto APIs - on
Windows. This allows Windows to use the same HTTP transport that all the
other platforms use, with its own native crypto.

Ultimately this allows us to deprecate WinHTTP and we need not add
support for our socket changes in two places (our HTTP stack and the
WinHTTP stack).

.github/workflows/main.yml

@@ -130,19 +130,19 @@ jobs:
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
           setup-script: osx
-        - name: "Windows (amd64, Visual Studio)"
+        - name: "Windows (amd64, Visual Studio, Schannel)"
           id: windows-amd64-vs
           os: windows-2019
           setup-script: win32
           env:
             ARCH: amd64
             CMAKE_GENERATOR: Visual Studio 16 2019
-            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_SSH=ON -DCMAKE_PREFIX_PATH=D:\Temp\libssh2
+            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel -DUSE_SSH=ON -DCMAKE_PREFIX_PATH=D:\Temp\libssh2
             BUILD_PATH: C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin;D:\Temp\libssh2\bin
             BUILD_TEMP: D:\Temp
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (x86, Visual Studio)"
+        - name: "Windows (x86, Visual Studio, WinHTTP)"
           id: windows-x86-vs
           os: windows-2019
           setup-script: win32
@@ -154,7 +154,7 @@ jobs:
             BUILD_TEMP: D:\Temp
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (amd64, mingw)"
+        - name: "Windows (amd64, mingw, WinHTTP)"
           id: windows-amd64-mingw
           os: windows-2019
           setup-script: mingw
@@ -166,14 +166,14 @@ jobs:
             BUILD_PATH: D:\Temp\mingw64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (x86, mingw)"
+        - name: "Windows (x86, mingw, Schannel)"
           id: windows-x86-mingw
           os: windows-2019
           setup-script: mingw
           env:
             ARCH: x86
             CMAKE_GENERATOR: MinGW Makefiles
-            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON
+            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel
             BUILD_TEMP: D:\Temp
             BUILD_PATH: D:\Temp\mingw32\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
             SKIP_SSH_TESTS: true

.github/workflows/nightly.yml

@@ -162,32 +162,39 @@ jobs:
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
           setup-script: osx
-        - name: "Windows (amd64, Visual Studio)"
+        - name: "Windows (amd64, Visual Studio, WinHTTP)"
           os: windows-2019
           env:
             ARCH: amd64
             CMAKE_GENERATOR: Visual Studio 16 2019
-            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON
+            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=WinHTTP
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (no mmap)"
+        - name: "Windows (x86, Visual Studio, WinHTTP)"
+          os: windows-2019
+          env:
+            ARCH: x86
+            CMAKE_GENERATOR: Visual Studio 16 2019
+            CMAKE_OPTIONS: -A Win32 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=WinHTTP -DUSE_SHA1=HTTPS -DUSE_BUNDLED_ZLIB=ON
+            SKIP_SSH_TESTS: true
+            SKIP_NEGOTIATE_TESTS: true
+        - name: "Windows (amd64, Visual Studio, Schannel)"
           os: windows-2019
           env:
             ARCH: amd64
             CMAKE_GENERATOR: Visual Studio 16 2019
-            CFLAGS: -DNO_MMAP
-            CMAKE_OPTIONS: -A x64 -DDEPRECATE_HARD=ON
+            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (x86, Visual Studio)"
+        - name: "Windows (x86, Visual Studio, Schannel)"
           os: windows-2019
           env:
             ARCH: x86
             CMAKE_GENERATOR: Visual Studio 16 2019
-            CMAKE_OPTIONS: -A Win32 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_SHA1=HTTPS -DUSE_BUNDLED_ZLIB=ON
+            CMAKE_OPTIONS: -A Win32 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel -DUSE_BUNDLED_ZLIB=ON
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (amd64, mingw)"
+        - name: "Windows (amd64, mingw, WinHTTP)"
           os: windows-2019
           setup-script: mingw
           env:
@@ -198,17 +205,26 @@ jobs:
             BUILD_PATH: D:\Temp\mingw64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (x86, mingw)"
+        - name: "Windows (x86, mingw, Schannel)"
           os: windows-2019
           setup-script: mingw
           env:
             ARCH: x86
             CMAKE_GENERATOR: MinGW Makefiles
-            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON
+            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel
             BUILD_TEMP: D:\Temp
             BUILD_PATH: D:\Temp\mingw32\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
+        - name: "Windows (no mmap)"
+          os: windows-2019
+          env:
+            ARCH: amd64
+            CMAKE_GENERATOR: Visual Studio 16 2019
+            CFLAGS: -DNO_MMAP
+            CMAKE_OPTIONS: -A x64 -DDEPRECATE_HARD=ON
+            SKIP_SSH_TESTS: true
+            SKIP_NEGOTIATE_TESTS: true
         - name: "Linux (Bionic, GCC, dynamically-loaded OpenSSL)"
           container:
             name: bionic

CMakeLists.txt

@@ -82,12 +82,6 @@ if(MSVC)
 	option(WIN32_LEAKCHECK     "Enable leak reporting via crtdbg"                  OFF)
 endif()
 
-if(WIN32)
-	# By default, libgit2 is built with WinHTTP.  To use the built-in
-	# HTTP transport, invoke CMake with the "-DUSE_WINHTTP=OFF" argument.
-	option(USE_WINHTTP         "Use Win32 WinHTTP routines"                         ON)
-endif()
-
 if(NOT CMAKE_CONFIGURATION_TYPES AND NOT CMAKE_BUILD_TYPE)
 	set(CMAKE_BUILD_TYPE "Debug" CACHE STRING "Choose the type of build, options are: Debug Release RelWithDebInfo MinSizeRel." FORCE)
 endif()

cmake/SelectHTTPSBackend.cmake

@@ -19,7 +19,7 @@ if(USE_HTTPS)
 				message(STATUS "Security framework is too old, falling back to OpenSSL")
 				set(USE_HTTPS "OpenSSL")
 			endif()
-		elseif(USE_WINHTTP)
+		elseif(WIN32)
 			set(USE_HTTPS "WinHTTP")
 		elseif(OPENSSL_FOUND)
 			set(USE_HTTPS "OpenSSL")
@@ -106,8 +106,27 @@ if(USE_HTTPS)
 		# https://github.com/ARMmbed/mbedtls/issues/228
 		# For now, pass its link flags as our own
 		list(APPEND LIBGIT2_PC_LIBS ${MBEDTLS_LIBRARIES})
+	elseif(USE_HTTPS STREQUAL "Schannel")
+		set(GIT_SCHANNEL 1)
+
+		list(APPEND LIBGIT2_SYSTEM_LIBS "rpcrt4" "crypt32" "ole32" "secur32")
+		list(APPEND LIBGIT2_PC_LIBS "-lrpcrt4" "-lcrypt32" "-lole32" "-lsecur32")
 	elseif(USE_HTTPS STREQUAL "WinHTTP")
-		# WinHTTP setup was handled in the WinHTTP-specific block above
+		set(GIT_WINHTTP 1)
+
+		# Since MinGW does not come with headers or an import library for winhttp,
+		# we have to include a private header and generate our own import library
+		if(MINGW)
+			add_subdirectory("${PROJECT_SOURCE_DIR}/deps/winhttp" "${PROJECT_BINARY_DIR}/deps/winhttp")
+			list(APPEND LIBGIT2_SYSTEM_LIBS winhttp)
+			list(APPEND LIBGIT2_DEPENDENCY_INCLUDES "${PROJECT_SOURCE_DIR}/deps/winhttp")
+		else()
+			list(APPEND LIBGIT2_SYSTEM_LIBS "winhttp")
+			list(APPEND LIBGIT2_PC_LIBS "-lwinhttp")
+		endif()
+
+		list(APPEND LIBGIT2_SYSTEM_LIBS "rpcrt4" "crypt32" "ole32")
+		list(APPEND LIBGIT2_PC_LIBS "-lrpcrt4" "-lcrypt32" "-lole32")
 	elseif(USE_HTTPS STREQUAL "OpenSSL-Dynamic")
 		set(GIT_OPENSSL 1)
 		set(GIT_OPENSSL_DYNAMIC 1)

cmake/SelectHashes.cmake

@@ -13,6 +13,8 @@ if(USE_SHA1 STREQUAL ON)
 elseif(USE_SHA1 STREQUAL "HTTPS")
 	if(USE_HTTPS STREQUAL "SecureTransport")
 		set(USE_SHA1 "CommonCrypto")
+	elseif(USE_HTTPS STREQUAL "Schannel")
+		set(USE_SHA1 "Win32")
 	elseif(USE_HTTPS STREQUAL "WinHTTP")
 		set(USE_SHA1 "Win32")
 	elseif(USE_HTTPS)
@@ -51,6 +53,8 @@ endif()
 if(USE_SHA256 STREQUAL "HTTPS")
 	if(USE_HTTPS STREQUAL "SecureTransport")
 		set(USE_SHA256 "CommonCrypto")
+	elseif(USE_HTTPS STREQUAL "Schannel")
+		set(USE_SHA256 "Win32")
 	elseif(USE_HTTPS STREQUAL "WinHTTP")
 		set(USE_SHA256 "Win32")
 	elseif(USE_HTTPS)

cmake/SelectWinHTTP.cmake

-if(WIN32 AND USE_WINHTTP)
-	set(GIT_WINHTTP 1)
-
-	# Since MinGW does not come with headers or an import library for winhttp,
-	# we have to include a private header and generate our own import library
-	if(MINGW)
-		add_subdirectory("${PROJECT_SOURCE_DIR}/deps/winhttp" "${PROJECT_BINARY_DIR}/deps/winhttp")
-		list(APPEND LIBGIT2_SYSTEM_LIBS winhttp)
-		list(APPEND LIBGIT2_DEPENDENCY_INCLUDES "${PROJECT_SOURCE_DIR}/deps/winhttp")
-	else()
-		list(APPEND LIBGIT2_SYSTEM_LIBS "winhttp")
-		list(APPEND LIBGIT2_PC_LIBS "-lwinhttp")
-	endif()
-
-	list(APPEND LIBGIT2_SYSTEM_LIBS "rpcrt4" "crypt32" "ole32")
-	list(APPEND LIBGIT2_PC_LIBS "-lrpcrt4" "-lcrypt32" "-lole32")
-endif()

src/CMakeLists.txt

@@ -42,7 +42,6 @@ include(SelectHashes)
 include(SelectHTTPParser)
 include(SelectRegex)
 include(SelectSSH)
-include(SelectWinHTTP)
 include(SelectZlib)
 
 #

src/libgit2/libgit2.c

@@ -30,6 +30,7 @@
 #include "streams/registry.h"
 #include "streams/mbedtls.h"
 #include "streams/openssl.h"
+#include "streams/socket.h"
 #include "transports/smart.h"
 #include "transports/http.h"
 #include "transports/ssh.h"
@@ -78,6 +79,7 @@ int git_libgit2_init(void)
 		git_merge_driver_global_init,
 		git_transport_ssh_global_init,
 		git_stream_registry_global_init,
+		git_socket_stream_global_init,
 		git_openssl_stream_global_init,
 		git_mbedtls_stream_global_init,
 		git_mwindow_global_init,

src/libgit2/streams/schannel.h

+/*
+ * Copyright (C) the libgit2 contributors. All rights reserved.
+ *
+ * This file is part of libgit2, distributed under the GNU GPL v2 with
+ * a Linking Exception. For full terms see the included COPYING file.
+ */
+#ifndef INCLUDE_steams_schannel_h__
+#define INCLUDE_steams_schannel_h__
+
+#include "common.h"
+
+#include "git2/sys/stream.h"
+
+#ifdef GIT_SCHANNEL
+
+extern int git_schannel_stream_new(
+	git_stream **out,
+	const char *host,
+	const char *port);
+
+extern int git_schannel_stream_wrap(
+	git_stream **out,
+	git_stream *in,
+	const char *host);
+
+#endif
+
+#endif

src/libgit2/streams/socket.c

@@ -10,22 +10,23 @@
 #include "posix.h"
 #include "netops.h"
 #include "registry.h"
+#include "runtime.h"
 #include "stream.h"
 
 #ifndef _WIN32
-#	include <sys/types.h>
-#	include <sys/socket.h>
-#	include <sys/select.h>
-#	include <sys/time.h>
-#	include <netdb.h>
-#	include <netinet/in.h>
-#       include <arpa/inet.h>
+# include <sys/types.h>
+# include <sys/socket.h>
+# include <sys/select.h>
+# include <sys/time.h>
+# include <netdb.h>
+# include <netinet/in.h>
+# include <arpa/inet.h>
 #else
-#	include <winsock2.h>
-#	include <ws2tcpip.h>
-#	ifdef _MSC_VER
-#		pragma comment(lib, "ws2_32")
-#	endif
+# include <winsock2.h>
+# include <ws2tcpip.h>
+# ifdef _MSC_VER
+#  pragma comment(lib, "ws2_32")
+# endif
 #endif
 
 #ifdef GIT_WIN32
@@ -54,11 +55,8 @@ static int close_socket(GIT_SOCKET s)
 		return 0;
 
 #ifdef GIT_WIN32
-	if (SOCKET_ERROR == closesocket(s))
-		return -1;
-
-	if (0 != WSACleanup()) {
-		git_error_set(GIT_ERROR_OS, "winsock cleanup failed");
+	if (closesocket(s) != 0) {
+		net_set_error("could not close socket");
 		return -1;
 	}
 
@@ -77,23 +75,6 @@ static int socket_connect(git_stream *stream)
 	GIT_SOCKET s = INVALID_SOCKET;
 	int ret;
 
-#ifdef GIT_WIN32
-	/* on win32, the WSA context needs to be initialized
-	 * before any socket calls can be performed */
-	WSADATA wsd;
-
-	if (WSAStartup(MAKEWORD(2,2), &wsd) != 0) {
-		git_error_set(GIT_ERROR_OS, "winsock init failed");
-		return -1;
-	}
-
-	if (LOBYTE(wsd.wVersion) != 2 || HIBYTE(wsd.wVersion) != 2) {
-		WSACleanup();
-		git_error_set(GIT_ERROR_OS, "winsock init failed");
-		return -1;
-	}
-#endif
-
 	memset(&hints, 0x0, sizeof(struct addrinfo));
 	hints.ai_socktype = SOCK_STREAM;
 	hints.ai_family = AF_UNSPEC;
@@ -240,3 +221,42 @@ int git_socket_stream_new(
 
 	return init(out, host, port);
 }
+
+#ifdef GIT_WIN32
+
+static void socket_stream_global_shutdown(void)
+{
+	WSACleanup();
+}
+
+int git_socket_stream_global_init(void)
+{
+	WORD winsock_version;
+	WSADATA wsa_data;
+
+	winsock_version = MAKEWORD(2, 2);
+
+	if (WSAStartup(winsock_version, &wsa_data) != 0) {
+		git_error_set(GIT_ERROR_OS, "could not initialize Windows Socket Library");
+		return -1;
+	}
+
+	if (LOBYTE(wsa_data.wVersion) != 2 ||
+	    HIBYTE(wsa_data.wVersion) != 2) {
+		git_error_set(GIT_ERROR_SSL, "Windows Socket Library does not support Winsock 2.2");
+		return -1;
+	}
+
+	return git_runtime_shutdown_register(socket_stream_global_shutdown);
+}
+ 
+#else
+
+#include "stream.h"
+
+int git_socket_stream_global_init(void)
+{
+	return 0;
+}
+
+ #endif

src/libgit2/streams/socket.h

@@ -20,4 +20,6 @@ typedef struct {
 
 extern int git_socket_stream_new(git_stream **out, const char *host, const char *port);
 
+extern int git_socket_stream_global_init(void);
+
 #endif

src/libgit2/streams/tls.c

@@ -13,6 +13,7 @@
 #include "streams/mbedtls.h"
 #include "streams/openssl.h"
 #include "streams/stransport.h"
+#include "streams/schannel.h"
 
 int git_tls_stream_new(git_stream **out, const char *host, const char *port)
 {
@@ -33,6 +34,8 @@ int git_tls_stream_new(git_stream **out, const char *host, const char *port)
 		init = git_openssl_stream_new;
 #elif defined(GIT_MBEDTLS)
 		init = git_mbedtls_stream_new;
+#elif defined(GIT_SCHANNEL)
+		init = git_schannel_stream_new;
 #endif
 	} else {
 		return error;
@@ -63,6 +66,8 @@ int git_tls_stream_wrap(git_stream **out, git_stream *in, const char *host)
 		wrap = git_openssl_stream_wrap;
 #elif defined(GIT_MBEDTLS)
 		wrap = git_mbedtls_stream_wrap;
+#elif defined(GIT_SCHANNEL)
+		wrap = git_schannel_stream_wrap;
 #endif
 	}
 

src/util/git2_features.h.in

@@ -41,6 +41,7 @@
 #cmakedefine GIT_OPENSSL_DYNAMIC 1
 #cmakedefine GIT_SECURE_TRANSPORT 1
 #cmakedefine GIT_MBEDTLS 1
+#cmakedefine GIT_SCHANNEL 1
 
 #cmakedefine GIT_SHA1_COLLISIONDETECT 1
 #cmakedefine GIT_SHA1_WIN32 1

tests/libgit2/online/clone.c

@@ -580,6 +580,17 @@ static int succeed_certificate_check(git_cert *cert, int valid, const char *host
 	return 0;
 }
 
+static int x509_succeed_certificate_check(git_cert *cert, int valid, const char *host, void *payload)
+{
+	GIT_UNUSED(valid);
+	GIT_UNUSED(payload);
+
+	cl_assert_equal_s("github.com", host);
+	cl_assert_equal_i(GIT_CERT_X509, cert->cert_type);
+
+	return 0;
+}
+
 static int fail_certificate_check(git_cert *cert, int valid, const char *host, void *payload)
 {
 	GIT_UNUSED(cert);
@@ -901,7 +912,7 @@ void test_online_clone__certificate_invalid(void)
 
 void test_online_clone__certificate_valid(void)
 {
-	g_options.fetch_opts.callbacks.certificate_check = succeed_certificate_check;
+	g_options.fetch_opts.callbacks.certificate_check = x509_succeed_certificate_check;
 
 	cl_git_pass(git_clone(&g_repo, "https://github.com/libgit2/TestGitRepository", "./foo", &g_options));
 }

tests/libgit2/stream/registration.c

@@ -81,10 +81,10 @@ void test_stream_registration__tls(void)
 	cl_git_pass(git_stream_register(GIT_STREAM_TLS, NULL));
 	error = git_tls_stream_new(&stream, "localhost", "443");
 
-	/* We don't have TLS support enabled, or we're on Windows,
-	 * which has no arbitrary TLS stream support.
+	/* We don't have TLS support enabled, or we're on Windows
+	 * with WinHTTP, which is not actually TLS stream support.
 	 */
-#if defined(GIT_WIN32) || !defined(GIT_HTTPS)
+#if defined(GIT_WINHTTP) || !defined(GIT_HTTPS)
 	cl_git_fail_with(-1, error);
 #else
 	cl_git_pass(error);