http: introduce schannel streams for windows

Provide a stream interface for Schannel - the native crypto APIs - on
Windows. This allows Windows to use the same HTTP transport that all the
other platforms use, with its own native crypto.

Ultimately this allows us to deprecate WinHTTP and we need not add
support for our socket changes in two places (our HTTP stack and the
WinHTTP stack).

.github/workflows/main.yml

@@ -130,19 +130,19 @@ jobs:
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
           setup-script: osx
-        - name: "Windows (amd64, Visual Studio)"
+        - name: "Windows (amd64, Visual Studio, Schannel)"
           id: windows-amd64-vs
           os: windows-2019
           setup-script: win32
           env:
             ARCH: amd64
             CMAKE_GENERATOR: Visual Studio 16 2019
-            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_SSH=ON -DCMAKE_PREFIX_PATH=D:\Temp\libssh2
+            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel -DUSE_SSH=ON -DCMAKE_PREFIX_PATH=D:\Temp\libssh2
             BUILD_PATH: C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin;D:\Temp\libssh2\bin
             BUILD_TEMP: D:\Temp
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (x86, Visual Studio)"
+        - name: "Windows (x86, Visual Studio, WinHTTP)"
           id: windows-x86-vs
           os: windows-2019
           setup-script: win32
@@ -154,7 +154,7 @@ jobs:
             BUILD_TEMP: D:\Temp
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (amd64, mingw)"
+        - name: "Windows (amd64, mingw, WinHTTP)"
           id: windows-amd64-mingw
           os: windows-2019
           setup-script: mingw
@@ -166,14 +166,14 @@ jobs:
             BUILD_PATH: D:\Temp\mingw64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (x86, mingw)"
+        - name: "Windows (x86, mingw, Schannel)"
           id: windows-x86-mingw
           os: windows-2019
           setup-script: mingw
           env:
             ARCH: x86
             CMAKE_GENERATOR: MinGW Makefiles
-            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON
+            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel
             BUILD_TEMP: D:\Temp
             BUILD_PATH: D:\Temp\mingw32\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
             SKIP_SSH_TESTS: true

.github/workflows/nightly.yml

@@ -162,32 +162,39 @@ jobs:
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
           setup-script: osx
-        - name: "Windows (amd64, Visual Studio)"
+        - name: "Windows (amd64, Visual Studio, WinHTTP)"
           os: windows-2019
           env:
             ARCH: amd64
             CMAKE_GENERATOR: Visual Studio 16 2019
-            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON
+            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=WinHTTP
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (no mmap)"
+        - name: "Windows (x86, Visual Studio, WinHTTP)"
+          os: windows-2019
+          env:
+            ARCH: x86
+            CMAKE_GENERATOR: Visual Studio 16 2019
+            CMAKE_OPTIONS: -A Win32 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=WinHTTP -DUSE_SHA1=HTTPS -DUSE_BUNDLED_ZLIB=ON
+            SKIP_SSH_TESTS: true
+            SKIP_NEGOTIATE_TESTS: true
+        - name: "Windows (amd64, Visual Studio, Schannel)"
           os: windows-2019
           env:
             ARCH: amd64
             CMAKE_GENERATOR: Visual Studio 16 2019
-            CFLAGS: -DNO_MMAP
-            CMAKE_OPTIONS: -A x64 -DDEPRECATE_HARD=ON
+            CMAKE_OPTIONS: -A x64 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (x86, Visual Studio)"
+        - name: "Windows (x86, Visual Studio, Schannel)"
           os: windows-2019
           env:
             ARCH: x86
             CMAKE_GENERATOR: Visual Studio 16 2019
-            CMAKE_OPTIONS: -A Win32 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_SHA1=HTTPS -DUSE_BUNDLED_ZLIB=ON
+            CMAKE_OPTIONS: -A Win32 -DWIN32_LEAKCHECK=ON -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel -DUSE_BUNDLED_ZLIB=ON
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (amd64, mingw)"
+        - name: "Windows (amd64, mingw, WinHTTP)"
           os: windows-2019
           setup-script: mingw
           env:
@@ -198,17 +205,26 @@ jobs:
             BUILD_PATH: D:\Temp\mingw64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
-        - name: "Windows (x86, mingw)"
+        - name: "Windows (x86, mingw, Schannel)"
           os: windows-2019
           setup-script: mingw
           env:
             ARCH: x86
             CMAKE_GENERATOR: MinGW Makefiles
-            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON
+            CMAKE_OPTIONS: -DDEPRECATE_HARD=ON -DUSE_HTTPS=Schannel
             BUILD_TEMP: D:\Temp
             BUILD_PATH: D:\Temp\mingw32\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin
             SKIP_SSH_TESTS: true
             SKIP_NEGOTIATE_TESTS: true
+        - name: "Windows (no mmap)"
+          os: windows-2019
+          env:
+            ARCH: amd64
+            CMAKE_GENERATOR: Visual Studio 16 2019
+            CFLAGS: -DNO_MMAP
+            CMAKE_OPTIONS: -A x64 -DDEPRECATE_HARD=ON
+            SKIP_SSH_TESTS: true
+            SKIP_NEGOTIATE_TESTS: true
         - name: "Linux (Bionic, GCC, dynamically-loaded OpenSSL)"
           container:
             name: bionic

CMakeLists.txt

@@ -82,12 +82,6 @@ if(MSVC)
 	option(WIN32_LEAKCHECK     "Enable leak reporting via crtdbg"                  OFF)
 endif()
 
-if(WIN32)
-	# By default, libgit2 is built with WinHTTP.  To use the built-in
-	# HTTP transport, invoke CMake with the "-DUSE_WINHTTP=OFF" argument.
-	option(USE_WINHTTP         "Use Win32 WinHTTP routines"                         ON)
-endif()
-
 if(NOT CMAKE_CONFIGURATION_TYPES AND NOT CMAKE_BUILD_TYPE)
 	set(CMAKE_BUILD_TYPE "Debug" CACHE STRING "Choose the type of build, options are: Debug Release RelWithDebInfo MinSizeRel." FORCE)
 endif()

cmake/SelectHTTPSBackend.cmake

@@ -19,7 +19,7 @@ if(USE_HTTPS)
 				message(STATUS "Security framework is too old, falling back to OpenSSL")
 				set(USE_HTTPS "OpenSSL")
 			endif()
-		elseif(USE_WINHTTP)
+		elseif(WIN32)
 			set(USE_HTTPS "WinHTTP")
 		elseif(OPENSSL_FOUND)
 			set(USE_HTTPS "OpenSSL")
@@ -106,8 +106,27 @@ if(USE_HTTPS)
 		# https://github.com/ARMmbed/mbedtls/issues/228
 		# For now, pass its link flags as our own
 		list(APPEND LIBGIT2_PC_LIBS ${MBEDTLS_LIBRARIES})
+	elseif(USE_HTTPS STREQUAL "Schannel")
+		set(GIT_SCHANNEL 1)
+
+		list(APPEND LIBGIT2_SYSTEM_LIBS "rpcrt4" "crypt32" "ole32" "secur32")
+		list(APPEND LIBGIT2_PC_LIBS "-lrpcrt4" "-lcrypt32" "-lole32" "-lsecur32")
 	elseif(USE_HTTPS STREQUAL "WinHTTP")
-		# WinHTTP setup was handled in the WinHTTP-specific block above
+		set(GIT_WINHTTP 1)
+
+		# Since MinGW does not come with headers or an import library for winhttp,
+		# we have to include a private header and generate our own import library
+		if(MINGW)
+			add_subdirectory("${PROJECT_SOURCE_DIR}/deps/winhttp" "${PROJECT_BINARY_DIR}/deps/winhttp")
+			list(APPEND LIBGIT2_SYSTEM_LIBS winhttp)
+			list(APPEND LIBGIT2_DEPENDENCY_INCLUDES "${PROJECT_SOURCE_DIR}/deps/winhttp")
+		else()
+			list(APPEND LIBGIT2_SYSTEM_LIBS "winhttp")
+			list(APPEND LIBGIT2_PC_LIBS "-lwinhttp")
+		endif()
+
+		list(APPEND LIBGIT2_SYSTEM_LIBS "rpcrt4" "crypt32" "ole32")
+		list(APPEND LIBGIT2_PC_LIBS "-lrpcrt4" "-lcrypt32" "-lole32")
 	elseif(USE_HTTPS STREQUAL "OpenSSL-Dynamic")
 		set(GIT_OPENSSL 1)
 		set(GIT_OPENSSL_DYNAMIC 1)

cmake/SelectHashes.cmake

@@ -13,6 +13,8 @@ if(USE_SHA1 STREQUAL ON)
 elseif(USE_SHA1 STREQUAL "HTTPS")
 	if(USE_HTTPS STREQUAL "SecureTransport")
 		set(USE_SHA1 "CommonCrypto")
+	elseif(USE_HTTPS STREQUAL "Schannel")
+		set(USE_SHA1 "Win32")
 	elseif(USE_HTTPS STREQUAL "WinHTTP")
 		set(USE_SHA1 "Win32")
 	elseif(USE_HTTPS)
@@ -51,6 +53,8 @@ endif()
 if(USE_SHA256 STREQUAL "HTTPS")
 	if(USE_HTTPS STREQUAL "SecureTransport")
 		set(USE_SHA256 "CommonCrypto")
+	elseif(USE_HTTPS STREQUAL "Schannel")
+		set(USE_SHA256 "Win32")
 	elseif(USE_HTTPS STREQUAL "WinHTTP")
 		set(USE_SHA256 "Win32")
 	elseif(USE_HTTPS)

cmake/SelectWinHTTP.cmake

-if(WIN32 AND USE_WINHTTP)
-	set(GIT_WINHTTP 1)
-
-	# Since MinGW does not come with headers or an import library for winhttp,
-	# we have to include a private header and generate our own import library
-	if(MINGW)
-		add_subdirectory("${PROJECT_SOURCE_DIR}/deps/winhttp" "${PROJECT_BINARY_DIR}/deps/winhttp")
-		list(APPEND LIBGIT2_SYSTEM_LIBS winhttp)
-		list(APPEND LIBGIT2_DEPENDENCY_INCLUDES "${PROJECT_SOURCE_DIR}/deps/winhttp")
-	else()
-		list(APPEND LIBGIT2_SYSTEM_LIBS "winhttp")
-		list(APPEND LIBGIT2_PC_LIBS "-lwinhttp")
-	endif()
-
-	list(APPEND LIBGIT2_SYSTEM_LIBS "rpcrt4" "crypt32" "ole32")
-	list(APPEND LIBGIT2_PC_LIBS "-lrpcrt4" "-lcrypt32" "-lole32")
-endif()

src/CMakeLists.txt

@@ -42,7 +42,6 @@ include(SelectHashes)
 include(SelectHTTPParser)
 include(SelectRegex)
 include(SelectSSH)
-include(SelectWinHTTP)
 include(SelectZlib)
 
 #

src/libgit2/libgit2.c

@@ -30,6 +30,7 @@
 #include "streams/registry.h"
 #include "streams/mbedtls.h"
 #include "streams/openssl.h"
+#include "streams/socket.h"
 #include "transports/smart.h"
 #include "transports/http.h"
 #include "transports/ssh.h"
@@ -78,6 +79,7 @@ int git_libgit2_init(void)
 		git_merge_driver_global_init,
 		git_transport_ssh_global_init,
 		git_stream_registry_global_init,
+		git_socket_stream_global_init,
 		git_openssl_stream_global_init,
 		git_mbedtls_stream_global_init,
 		git_mwindow_global_init,

src/libgit2/streams/schannel.c

+/*
+ * Copyright (C) the libgit2 contributors. All rights reserved.
+ *
+ * This file is part of libgit2, distributed under the GNU GPL v2 with
+ * a Linking Exception. For full terms see the included COPYING file.
+ */
+
+#include "streams/schannel.h"
+
+#ifdef GIT_SCHANNEL
+
+#define SECURITY_WIN32
+
+#include <security.h>
+#include <schannel.h>
+#include <sspi.h>
+
+#include "stream.h"
+#include "streams/socket.h"
+
+#ifndef SP_PROT_TLS1_2_CLIENT
+# define SP_PROT_TLS1_2_CLIENT 2048
+#endif
+
+#ifndef SP_PROT_TLS1_3_CLIENT
+# define SP_PROT_TLS1_3_CLIENT 8192
+#endif
+
+#ifndef SECBUFFER_ALERT
+# define SECBUFFER_ALERT 17
+#endif
+
+#define READ_BLOCKSIZE (16 * 1024)
+
+typedef enum {
+	STATE_NONE = 0,
+	STATE_CRED = 1,
+	STATE_CONTEXT = 2,
+	STATE_CERTIFICATE = 3
+} schannel_state;
+
+typedef struct {
+	git_stream parent;
+	git_stream *io;
+	int owned;
+	bool connected;
+	wchar_t *host_w;
+
+	schannel_state state;
+
+	CredHandle cred;
+	CtxtHandle context;
+	SecPkgContext_StreamSizes stream_sizes;
+
+	CERT_CONTEXT *certificate;
+	const CERT_CHAIN_CONTEXT *cert_chain;
+	git_cert_x509 x509;
+
+	git_str plaintext_in;
+	git_str ciphertext_in;
+} schannel_stream;
+
+static int connect_context(schannel_stream *st)
+{
+	SCHANNEL_CRED cred = { 0 };
+	SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
+	DWORD context_flags;
+	static size_t MAX_RETRIES = 1024;
+	size_t retries;
+	ssize_t read_len;
+	int error = 0;
+
+	if (st->owned && (error = git_stream_connect(st->io)) < 0)
+		return error;
+
+	cred.dwVersion = SCHANNEL_CRED_VERSION;
+	cred.dwFlags = SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
+	               SCH_CRED_IGNORE_REVOCATION_OFFLINE |
+	               SCH_CRED_MANUAL_CRED_VALIDATION |
+	               SCH_CRED_NO_DEFAULT_CREDS |
+	               SCH_CRED_NO_SERVERNAME_CHECK;
+	cred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT |
+	                             SP_PROT_TLS1_3_CLIENT;
+
+	if (AcquireCredentialsHandleW(NULL, SCHANNEL_NAME_W,
+			SECPKG_CRED_OUTBOUND, NULL, &cred, NULL,
+			NULL, &st->cred, NULL) != SEC_E_OK) {
+		git_error_set(GIT_ERROR_OS, "could not acquire credentials handle");
+		return -1;
+	}
+
+	st->state = STATE_CRED;
+
+	context_flags = ISC_REQ_ALLOCATE_MEMORY |
+	                ISC_REQ_CONFIDENTIALITY |
+	                ISC_REQ_REPLAY_DETECT |
+	                ISC_REQ_SEQUENCE_DETECT |
+	                ISC_REQ_STREAM;
+
+	for (retries = 0; retries < MAX_RETRIES; retries++) {
+		SecBuffer input_buf[] = {
+			{ (unsigned long)st->ciphertext_in.size,
+			  SECBUFFER_TOKEN,
+			  st->ciphertext_in.size ? st->ciphertext_in.ptr : NULL },
+			{ 0, SECBUFFER_EMPTY, NULL }
+		};
+		SecBuffer output_buf[] = { { 0, SECBUFFER_TOKEN, NULL },
+		                           { 0, SECBUFFER_ALERT, NULL } };
+
+		SecBufferDesc input_buf_desc = { SECBUFFER_VERSION, 2, input_buf };
+		SecBufferDesc output_buf_desc = { SECBUFFER_VERSION, 2, output_buf };
+
+		status = InitializeSecurityContextW(&st->cred,
+			retries ? &st->context : NULL, st->host_w,
+			context_flags, 0, 0, retries ? &input_buf_desc : NULL, 0,
+			retries ? NULL : &st->context, &output_buf_desc,
+			&context_flags, NULL);
+
+		if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) {
+			st->state = STATE_CONTEXT;
+
+			if (output_buf[0].cbBuffer > 0) {
+				error = git_stream__write_full(st->io,
+					output_buf[0].pvBuffer,
+					output_buf[0].cbBuffer, 0);
+
+				FreeContextBuffer(output_buf[0].pvBuffer);
+			}
+
+			/* handle any leftover, unprocessed data */
+			if (input_buf[1].BufferType == SECBUFFER_EXTRA) {
+				GIT_ASSERT(st->ciphertext_in.size > input_buf[1].cbBuffer);
+
+				git_str_consume_bytes(&st->ciphertext_in,
+					st->ciphertext_in.size - input_buf[1].cbBuffer);
+			} else {
+				git_str_clear(&st->ciphertext_in);
+			}
+
+			if (error < 0 || status == SEC_E_OK)
+				break;
+			} else if (status == SEC_E_INCOMPLETE_MESSAGE) {
+				/* we need additional data from the client; */
+				if (git_str_grow_by(&st->ciphertext_in, READ_BLOCKSIZE) < 0) {
+					error = -1;
+				break;
+			}
+
+			if ((read_len = git_stream_read(st->io,
+					st->ciphertext_in.ptr + st->ciphertext_in.size,
+					(st->ciphertext_in.asize - st->ciphertext_in.size))) < 0) {
+				error = -1;
+				break;
+			}
+
+			GIT_ASSERT((size_t)read_len <=
+				st->ciphertext_in.asize - st->ciphertext_in.size);
+			st->ciphertext_in.size += read_len;
+		} else {
+			git_error_set(GIT_ERROR_OS,
+				"could not initialize security context");
+			error = -1;
+			break;
+		}
+
+		GIT_ASSERT(st->ciphertext_in.size < ULONG_MAX);
+	}
+
+	if (retries == MAX_RETRIES) {
+		git_error_set(GIT_ERROR_SSL,
+			"could not initialize security context: too many retries");
+		error = -1;
+	}
+
+	if (!error) {
+		if (QueryContextAttributesW(&st->context,
+				SECPKG_ATTR_STREAM_SIZES,
+				&st->stream_sizes) != SEC_E_OK) {
+			git_error_set(GIT_ERROR_SSL,
+				"could not query stream sizes");
+			error = -1;
+		}
+	}
+
+	return error;
+}
+
+static int set_certificate_lookup_error(DWORD status)
+{
+	switch (status) {
+	case CERT_TRUST_IS_NOT_TIME_VALID:
+		git_error_set(GIT_ERROR_SSL,
+			"certificate is expired or not yet valid");
+		break;
+	case CERT_TRUST_IS_REVOKED:
+		git_error_set(GIT_ERROR_SSL, "certificate is revoked");
+		break;
+	case CERT_TRUST_IS_NOT_SIGNATURE_VALID:
+	case CERT_TRUST_IS_NOT_VALID_FOR_USAGE:
+	case CERT_TRUST_INVALID_EXTENSION:
+	case CERT_TRUST_INVALID_POLICY_CONSTRAINTS:
+	case CERT_TRUST_INVALID_BASIC_CONSTRAINTS:
+	case CERT_TRUST_INVALID_NAME_CONSTRAINTS:
+	case CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT:
+	case CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT:
+	case CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT:
+	case CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT:
+	case CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY:
+	case CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT:
+		git_error_set(GIT_ERROR_SSL, "certificate is not valid");
+		break;
+	case CERT_TRUST_IS_UNTRUSTED_ROOT:
+	case CERT_TRUST_IS_CYCLIC:
+	case CERT_TRUST_IS_EXPLICIT_DISTRUST:
+		git_error_set(GIT_ERROR_SSL, "certificate is not trusted");
+		break;
+	case CERT_TRUST_REVOCATION_STATUS_UNKNOWN:
+		git_error_set(GIT_ERROR_SSL,
+			"certificate revocation status could not be verified");
+		break;
+	case CERT_TRUST_IS_OFFLINE_REVOCATION:
+		git_error_set(GIT_ERROR_SSL,
+			"certificate revocation is offline or stale");
+		break;
+	case CERT_TRUST_HAS_WEAK_SIGNATURE:
+		git_error_set(GIT_ERROR_SSL, "certificate has a weak signature");
+		break;
+	default:
+		git_error_set(GIT_ERROR_SSL,
+			"unknown certificate lookup failure: %d", status);
+		return -1;
+	}
+
+	return GIT_ECERTIFICATE;
+}
+
+static int set_certificate_validation_error(DWORD status)
+{
+	switch (status) {
+	case TRUST_E_CERT_SIGNATURE:
+		git_error_set(GIT_ERROR_SSL,
+			"the certificate cannot be verified");
+		break;
+	case CRYPT_E_REVOKED:
+		git_error_set(GIT_ERROR_SSL,
+			"the certificate or signature has been revoked");
+		break;
+	case CERT_E_UNTRUSTEDROOT:
+		git_error_set(GIT_ERROR_SSL,
+			"the certificate root is not trusted");
+		break;
+	case CERT_E_UNTRUSTEDTESTROOT:
+		git_error_set(GIT_ERROR_SSL,
+			"the certificate root is a test certificate");
+		break;
+	case CERT_E_CHAINING:
+		git_error_set(GIT_ERROR_SSL,
+			"the certificate chain is invalid");
+		break;
+	case CERT_E_WRONG_USAGE:
+	case CERT_E_PURPOSE:
+		git_error_set(GIT_ERROR_SSL,
+			"the certificate is not valid for this usage");
+		break;
+	case CERT_E_EXPIRED:
+		git_error_set(GIT_ERROR_SSL,
+			"certificate is expired or not yet valid");
+		break;
+	case CERT_E_INVALID_NAME:
+	case CERT_E_CN_NO_MATCH:
+		git_error_set(GIT_ERROR_SSL,
+			"certificate is not valid for this hostname");
+		break;
+	case CERT_E_INVALID_POLICY:
+	case TRUST_E_BASIC_CONSTRAINTS:
+	case CERT_E_CRITICAL:
+	case CERT_E_VALIDITYPERIODNESTING:
+		git_error_set(GIT_ERROR_SSL, "certificate is not valid");
+		break;
+	case CRYPT_E_NO_REVOCATION_CHECK:
+		git_error_set(GIT_ERROR_SSL,
+			"certificate revocation status could not be verified");
+		break;
+	case CRYPT_E_REVOCATION_OFFLINE:
+		git_error_set(GIT_ERROR_SSL,
+			"certificate revocation is offline or stale");
+		break;
+	case CERT_E_ROLE:
+		git_error_set(GIT_ERROR_SSL, "certificate authority is not valid");
+		break;
+	default:
+		git_error_set(GIT_ERROR_SSL,
+			"unknown certificate policy checking failure: %d",
+			status);
+		return -1;
+	}
+
+	return GIT_ECERTIFICATE;
+}
+
+static int check_certificate(schannel_stream* st)
+{
+	CERT_CHAIN_PARA cert_chain_parameters;
+	SSL_EXTRA_CERT_CHAIN_POLICY_PARA ssl_policy_parameters;
+	CERT_CHAIN_POLICY_PARA cert_policy_parameters =
+		{ sizeof(CERT_CHAIN_POLICY_PARA), 0, &ssl_policy_parameters };
+	CERT_CHAIN_POLICY_STATUS cert_policy_status;
+
+	memset(&cert_chain_parameters, 0, sizeof(CERT_CHAIN_PARA));
+	cert_chain_parameters.cbSize = sizeof(CERT_CHAIN_PARA);
+
+	if (QueryContextAttributesW(&st->context,
+			SECPKG_ATTR_REMOTE_CERT_CONTEXT,
+			&st->certificate) != SEC_E_OK) {
+		git_error_set(GIT_ERROR_OS,
+			"could not query remote certificate context");
+		return -1;
+	}
+
+	/* TODO: do we really want to do revokcation checking ? */
+	if (!CertGetCertificateChain(NULL, st->certificate, NULL,
+			st->certificate->hCertStore, &cert_chain_parameters,
+			CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT,
+			NULL, &st->cert_chain)) {
+		git_error_set(GIT_ERROR_OS, "could not query remote certificate chain");
+		CertFreeCertificateContext(st->certificate);
+		return -1;
+	}
+
+	st->state = STATE_CERTIFICATE;
+
+	/* Set up the x509 certificate data for future callbacks */
+
+	st->x509.parent.cert_type = GIT_CERT_X509;
+	st->x509.data = st->certificate->pbCertEncoded;
+	st->x509.len = st->certificate->cbCertEncoded;
+
+	/* Handle initial certificate validation */
+
+	if (st->cert_chain->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR)
+		return set_certificate_lookup_error(st->cert_chain->TrustStatus.dwErrorStatus);
+
+	ssl_policy_parameters.cbSize = sizeof(SSL_EXTRA_CERT_CHAIN_POLICY_PARA);
+	ssl_policy_parameters.dwAuthType = AUTHTYPE_SERVER;
+	ssl_policy_parameters.pwszServerName = st->host_w;
+
+	if (!CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_SSL,
+			st->cert_chain, &cert_policy_parameters,
+			&cert_policy_status)) {
+		git_error_set(GIT_ERROR_OS, "could not verify certificate chain policy");
+		return -1;
+	}
+
+	if (cert_policy_status.dwError != SEC_E_OK)
+		return set_certificate_validation_error(cert_policy_status.dwError);
+
+	return 0;
+}
+
+static int schannel_connect(git_stream *stream)
+{
+	schannel_stream *st = (schannel_stream *)stream;
+	int error;
+
+	GIT_ASSERT(st->state == STATE_NONE);
+
+	if ((error = connect_context(st)) < 0 ||
+	    (error = check_certificate(st)) < 0)
+		return error;
+
+	st->connected = 1;
+	return 0;
+}
+
+static int schannel_certificate(git_cert **out, git_stream *stream)
+{
+	schannel_stream *st = (schannel_stream *)stream;
+
+	*out = &st->x509.parent;
+	return 0;
+}
+
+static int schannel_set_proxy(
+	git_stream *stream,
+	const git_proxy_options *proxy_options)
+{
+	schannel_stream *st = (schannel_stream *)stream;
+	return git_stream_set_proxy(st->io, proxy_options);
+}
+
+static ssize_t schannel_write(
+	git_stream *stream,
+	const char *data,
+	size_t data_len,
+	int flags)
+{
+	schannel_stream *st = (schannel_stream *)stream;
+	SecBuffer encrypt_buf[3];
+	SecBufferDesc encrypt_buf_desc = { SECBUFFER_VERSION, 3, encrypt_buf };
+	git_str ciphertext_out = GIT_STR_INIT;
+	ssize_t total_len = 0;
+
+	GIT_UNUSED(flags);
+
+	if (data_len > SSIZE_MAX)
+		data_len = SSIZE_MAX;
+
+	git_str_init(&ciphertext_out,
+		st->stream_sizes.cbHeader +
+		st->stream_sizes.cbMaximumMessage +
+		st->stream_sizes.cbTrailer);
+
+	while (data_len > 0) {
+		size_t message_len = min(data_len, st->stream_sizes.cbMaximumMessage);
+		size_t ciphertext_len, ciphertext_written = 0;
+
+		encrypt_buf[0].BufferType = SECBUFFER_STREAM_HEADER;
+		encrypt_buf[0].cbBuffer = st->stream_sizes.cbHeader;
+		encrypt_buf[0].pvBuffer = ciphertext_out.ptr;
+
+		encrypt_buf[1].BufferType = SECBUFFER_DATA;
+		encrypt_buf[1].cbBuffer = (unsigned long)message_len;
+		encrypt_buf[1].pvBuffer =
+			ciphertext_out.ptr + st->stream_sizes.cbHeader;
+
+		encrypt_buf[2].BufferType = SECBUFFER_STREAM_TRAILER;
+		encrypt_buf[2].cbBuffer = st->stream_sizes.cbTrailer;
+		encrypt_buf[2].pvBuffer =
+			ciphertext_out.ptr + st->stream_sizes.cbHeader +
+			message_len;
+
+		memcpy(ciphertext_out.ptr + st->stream_sizes.cbHeader, data, message_len);
+
+		if (EncryptMessage(&st->context, 0, &encrypt_buf_desc, 0) != SEC_E_OK) {
+			git_error_set(GIT_ERROR_OS, "could not encrypt tls message");
+			total_len = -1;
+			goto done;
+		}
+
+		ciphertext_len = encrypt_buf[0].cbBuffer +
+		                 encrypt_buf[1].cbBuffer +
+		                 encrypt_buf[2].cbBuffer;
+
+		while (ciphertext_written < ciphertext_len) {
+			ssize_t chunk_len = git_stream_write(st->io,
+				ciphertext_out.ptr + ciphertext_written,
+				ciphertext_len - ciphertext_written, 0);
+
+			if (chunk_len < 0) {
+				total_len = -1;
+				goto done;
+			}
+
+			ciphertext_len -= chunk_len;
+			ciphertext_written += chunk_len;
+		}
+
+		total_len += message_len;
+
+		data += message_len;
+		data_len -= message_len;
+	}
+
+done:
+	git_str_dispose(&ciphertext_out);
+	return total_len;
+}
+
+static ssize_t schannel_read(git_stream *stream, void *_data, size_t data_len)
+{
+	schannel_stream *st = (schannel_stream *)stream;
+	char *data = (char *)_data;
+	SecBuffer decrypt_buf[4];
+	SecBufferDesc decrypt_buf_desc = { SECBUFFER_VERSION, 4, decrypt_buf };
+	SECURITY_STATUS status;
+	ssize_t chunk_len, total_len = 0;
+
+	if (data_len > SSIZE_MAX)
+		data_len = SSIZE_MAX;
+
+	/*
+	 * Loop until we have some bytes to return - we may have decrypted
+	 * bytes queued or ciphertext from the wire that we can decrypt and
+	 * return. Return any queued bytes if they're available to avoid a
+	 * network read, which may block. We may return less than the
+	 * caller requested, and they can retry for an actual network
+	 */
+	while ((size_t)total_len < data_len) {
+		if (st->plaintext_in.size > 0) {
+			size_t copy_len = min(st->plaintext_in.size, data_len);
+
+			memcpy(data, st->plaintext_in.ptr, copy_len);
+			git_str_consume_bytes(&st->plaintext_in, copy_len);
+
+			data += copy_len;
+			data_len -= copy_len;
+
+			total_len += copy_len;
+
+			continue;
+		}
+
+		if (st->ciphertext_in.size > 0) {
+			decrypt_buf[0].BufferType = SECBUFFER_DATA;
+			decrypt_buf[0].cbBuffer = (unsigned long)min(st->ciphertext_in.size, ULONG_MAX);
+			decrypt_buf[0].pvBuffer = st->ciphertext_in.ptr;
+
+			decrypt_buf[1].BufferType = SECBUFFER_EMPTY;
+			decrypt_buf[1].cbBuffer = 0;
+			decrypt_buf[1].pvBuffer = NULL;
+
+			decrypt_buf[2].BufferType = SECBUFFER_EMPTY;
+			decrypt_buf[2].cbBuffer = 0;
+			decrypt_buf[2].pvBuffer = NULL;
+
+			decrypt_buf[3].BufferType = SECBUFFER_EMPTY;
+			decrypt_buf[3].cbBuffer = 0;
+			decrypt_buf[3].pvBuffer = NULL;
+
+			status = DecryptMessage(&st->context, &decrypt_buf_desc, 0, NULL);
+
+			if (status == SEC_E_OK) {
+				GIT_ASSERT(decrypt_buf[0].BufferType == SECBUFFER_STREAM_HEADER);
+				GIT_ASSERT(decrypt_buf[1].BufferType == SECBUFFER_DATA);
+				GIT_ASSERT(decrypt_buf[2].BufferType == SECBUFFER_STREAM_TRAILER);
+
+				if (git_str_put(&st->plaintext_in, decrypt_buf[1].pvBuffer, decrypt_buf[1].cbBuffer) < 0) {
+					total_len = -1;
+					goto done;
+				}
+
+				if (decrypt_buf[3].BufferType == SECBUFFER_EXTRA) {
+					git_str_consume_bytes(&st->ciphertext_in, (st->ciphertext_in.size - decrypt_buf[3].cbBuffer));
+				} else {
+					git_str_clear(&st->ciphertext_in);
+				}
+
+				continue;
+			} else if (status == SEC_E_CONTEXT_EXPIRED) {
+				break;
+			} else if (status != SEC_E_INCOMPLETE_MESSAGE) {
+				git_error_set(GIT_ERROR_SSL, "could not decrypt tls message");
+				total_len = -1;
+				goto done;
+			}
+		}
+
+		if (total_len != 0)
+			break;
+
+		if (git_str_grow_by(&st->ciphertext_in, READ_BLOCKSIZE) < 0) {
+			total_len = -1;
+			goto done;
+		}
+
+		if ((chunk_len = git_stream_read(st->io, st->ciphertext_in.ptr + st->ciphertext_in.size, st->ciphertext_in.asize - st->ciphertext_in.size)) < 0) {
+			total_len = -1;
+			goto done;
+		}
+
+		st->ciphertext_in.size += chunk_len;
+	}
+
+done:
+	return total_len;
+}
+
+static int schannel_close(git_stream *stream)
+{
+	schannel_stream *st = (schannel_stream *)stream;
+	int error = 0;
+
+	if (st->connected) {
+		SecBuffer shutdown_buf;
+		SecBufferDesc shutdown_buf_desc =
+			{ SECBUFFER_VERSION, 1, &shutdown_buf };
+		DWORD shutdown_message = SCHANNEL_SHUTDOWN, shutdown_flags;
+
+		shutdown_buf.BufferType = SECBUFFER_TOKEN;
+		shutdown_buf.cbBuffer = sizeof(DWORD);
+		shutdown_buf.pvBuffer = &shutdown_message;
+
+		if (ApplyControlToken(&st->context, &shutdown_buf_desc) != SEC_E_OK) {
+			git_error_set(GIT_ERROR_SSL, "could not shutdown stream");
+			error = -1;
+		}
+
+		shutdown_buf.BufferType = SECBUFFER_TOKEN;
+		shutdown_buf.cbBuffer = 0;
+		shutdown_buf.pvBuffer = NULL;
+
+		shutdown_flags = ISC_REQ_ALLOCATE_MEMORY |
+		                 ISC_REQ_CONFIDENTIALITY |
+		                 ISC_REQ_REPLAY_DETECT |
+		                 ISC_REQ_SEQUENCE_DETECT |
+		                 ISC_REQ_STREAM;
+
+		if (InitializeSecurityContext(&st->cred, &st->context,
+				NULL, shutdown_flags, 0, 0,
+				&shutdown_buf_desc, 0, NULL,
+				&shutdown_buf_desc, &shutdown_flags,
+				NULL) == SEC_E_OK) {
+			if (shutdown_buf.cbBuffer > 0) {
+				if (git_stream__write_full(st->io,
+						shutdown_buf.pvBuffer,
+						shutdown_buf.cbBuffer, 0) < 0)
+					error = -1;
+
+				FreeContextBuffer(shutdown_buf.pvBuffer);
+			}
+		}
+	}
+
+	st->connected = false;
+
+	if (st->owned && git_stream_close(st->io) < 0)
+		error = -1;
+
+	return error;
+}
+
+static void schannel_free(git_stream *stream)
+{
+	schannel_stream *st = (schannel_stream *)stream;
+
+	if (st->state >= STATE_CERTIFICATE) {
+		CertFreeCertificateContext(st->certificate);
+		CertFreeCertificateChain(st->cert_chain);
+	}
+
+	if (st->state >= STATE_CONTEXT)
+		DeleteSecurityContext(&st->context);
+
+	if (st->state >= STATE_CRED)
+		FreeCredentialsHandle(&st->cred);
+
+	st->state = STATE_NONE;
+
+	git_str_dispose(&st->ciphertext_in);
+	git_str_dispose(&st->plaintext_in);
+
+	git__free(st->host_w);
+
+	if (st->owned)
+		git_stream_free(st->io);
+
+	git__free(st);
+}
+
+static int schannel_stream_wrap(
+	git_stream **out,
+	git_stream *in,
+	const char *host,
+	int owned)
+{
+	schannel_stream *st;
+
+	st = git__calloc(1, sizeof(schannel_stream));
+	GIT_ERROR_CHECK_ALLOC(st);
+
+	st->io = in;
+	st->owned = owned;
+
+	if (git__utf8_to_16_alloc(&st->host_w, host) < 0) {
+		git__free(st);
+		return -1;
+	}
+
+	st->parent.version = GIT_STREAM_VERSION;
+	st->parent.encrypted = 1;
+	st->parent.proxy_support = git_stream_supports_proxy(st->io);
+	st->parent.connect = schannel_connect;
+	st->parent.certificate = schannel_certificate;
+	st->parent.set_proxy = schannel_set_proxy;
+	st->parent.read = schannel_read;
+	st->parent.write = schannel_write;
+	st->parent.close = schannel_close;
+	st->parent.free = schannel_free;
+
+	*out = (git_stream *)st;
+	return 0;
+}
+
+extern int git_schannel_stream_new(
+	git_stream **out,
+	const char *host,
+	const char *port)
+{
+	git_stream *stream;
+	int error;
+
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(host);
+	GIT_ASSERT_ARG(port);
+
+	if ((error = git_socket_stream_new(&stream, host, port)) < 0)
+		return error;
+
+	if ((error = schannel_stream_wrap(out, stream, host, 1)) < 0) {
+		git_stream_close(stream);
+		git_stream_free(stream);
+	}
+
+	return error;
+}
+
+extern int git_schannel_stream_wrap(
+	git_stream **out,
+	git_stream *in,
+	const char *host)
+{
+	return schannel_stream_wrap(out, in, host, 0);
+}
+
+#endif

src/libgit2/streams/schannel.h

+/*
+ * Copyright (C) the libgit2 contributors. All rights reserved.
+ *
+ * This file is part of libgit2, distributed under the GNU GPL v2 with
+ * a Linking Exception. For full terms see the included COPYING file.
+ */
+#ifndef INCLUDE_steams_schannel_h__
+#define INCLUDE_steams_schannel_h__
+
+#include "common.h"
+
+#include "git2/sys/stream.h"
+
+#ifdef GIT_SCHANNEL
+
+extern int git_schannel_stream_new(
+	git_stream **out,
+	const char *host,
+	const char *port);
+
+extern int git_schannel_stream_wrap(
+	git_stream **out,
+	git_stream *in,
+	const char *host);
+
+#endif
+
+#endif

src/libgit2/streams/socket.c

@@ -10,22 +10,23 @@
 #include "posix.h"
 #include "netops.h"
 #include "registry.h"
+#include "runtime.h"
 #include "stream.h"
 
 #ifndef _WIN32
-#	include <sys/types.h>
-#	include <sys/socket.h>
-#	include <sys/select.h>
-#	include <sys/time.h>
-#	include <netdb.h>
-#	include <netinet/in.h>
-#       include <arpa/inet.h>
+# include <sys/types.h>
+# include <sys/socket.h>
+# include <sys/select.h>
+# include <sys/time.h>
+# include <netdb.h>
+# include <netinet/in.h>
+# include <arpa/inet.h>
 #else
-#	include <winsock2.h>
-#	include <ws2tcpip.h>
-#	ifdef _MSC_VER
-#		pragma comment(lib, "ws2_32")
-#	endif
+# include <winsock2.h>
+# include <ws2tcpip.h>
+# ifdef _MSC_VER
+#  pragma comment(lib, "ws2_32")
+# endif
 #endif
 
 #ifdef GIT_WIN32
@@ -54,11 +55,8 @@ static int close_socket(GIT_SOCKET s)
 		return 0;
 
 #ifdef GIT_WIN32
-	if (SOCKET_ERROR == closesocket(s))
-		return -1;
-
-	if (0 != WSACleanup()) {
-		git_error_set(GIT_ERROR_OS, "winsock cleanup failed");
+	if (closesocket(s) != 0) {
+		net_set_error("could not close socket");
 		return -1;
 	}
 
@@ -77,23 +75,6 @@ static int socket_connect(git_stream *stream)
 	GIT_SOCKET s = INVALID_SOCKET;
 	int ret;
 
-#ifdef GIT_WIN32
-	/* on win32, the WSA context needs to be initialized
-	 * before any socket calls can be performed */
-	WSADATA wsd;
-
-	if (WSAStartup(MAKEWORD(2,2), &wsd) != 0) {
-		git_error_set(GIT_ERROR_OS, "winsock init failed");
-		return -1;
-	}
-
-	if (LOBYTE(wsd.wVersion) != 2 || HIBYTE(wsd.wVersion) != 2) {
-		WSACleanup();
-		git_error_set(GIT_ERROR_OS, "winsock init failed");
-		return -1;
-	}
-#endif
-
 	memset(&hints, 0x0, sizeof(struct addrinfo));
 	hints.ai_socktype = SOCK_STREAM;
 	hints.ai_family = AF_UNSPEC;
@@ -240,3 +221,42 @@ int git_socket_stream_new(
 
 	return init(out, host, port);
 }
+
+#ifdef GIT_WIN32
+
+static void socket_stream_global_shutdown(void)
+{
+	WSACleanup();
+}
+
+int git_socket_stream_global_init(void)
+{
+	WORD winsock_version;
+	WSADATA wsa_data;
+
+	winsock_version = MAKEWORD(2, 2);
+
+	if (WSAStartup(winsock_version, &wsa_data) != 0) {
+		git_error_set(GIT_ERROR_OS, "could not initialize Windows Socket Library");
+		return -1;
+	}
+
+	if (LOBYTE(wsa_data.wVersion) != 2 ||
+	    HIBYTE(wsa_data.wVersion) != 2) {
+		git_error_set(GIT_ERROR_SSL, "Windows Socket Library does not support Winsock 2.2");
+		return -1;
+	}
+
+	return git_runtime_shutdown_register(socket_stream_global_shutdown);
+}
+ 
+#else
+
+#include "stream.h"
+
+int git_socket_stream_global_init(void)
+{
+	return 0;
+}
+
+ #endif

src/libgit2/streams/socket.h

@@ -20,4 +20,6 @@ typedef struct {
 
 extern int git_socket_stream_new(git_stream **out, const char *host, const char *port);
 
+extern int git_socket_stream_global_init(void);
+
 #endif

src/libgit2/streams/tls.c

@@ -13,6 +13,7 @@
 #include "streams/mbedtls.h"
 #include "streams/openssl.h"
 #include "streams/stransport.h"
+#include "streams/schannel.h"
 
 int git_tls_stream_new(git_stream **out, const char *host, const char *port)
 {
@@ -33,6 +34,8 @@ int git_tls_stream_new(git_stream **out, const char *host, const char *port)
 		init = git_openssl_stream_new;
 #elif defined(GIT_MBEDTLS)
 		init = git_mbedtls_stream_new;
+#elif defined(GIT_SCHANNEL)
+		init = git_schannel_stream_new;
 #endif
 	} else {
 		return error;
@@ -63,6 +66,8 @@ int git_tls_stream_wrap(git_stream **out, git_stream *in, const char *host)
 		wrap = git_openssl_stream_wrap;
 #elif defined(GIT_MBEDTLS)
 		wrap = git_mbedtls_stream_wrap;
+#elif defined(GIT_SCHANNEL)
+		wrap = git_schannel_stream_wrap;
 #endif
 	}
 

src/util/git2_features.h.in

@@ -41,6 +41,7 @@
 #cmakedefine GIT_OPENSSL_DYNAMIC 1
 #cmakedefine GIT_SECURE_TRANSPORT 1
 #cmakedefine GIT_MBEDTLS 1
+#cmakedefine GIT_SCHANNEL 1
 
 #cmakedefine GIT_SHA1_COLLISIONDETECT 1
 #cmakedefine GIT_SHA1_WIN32 1

tests/libgit2/online/clone.c

@@ -580,6 +580,17 @@ static int succeed_certificate_check(git_cert *cert, int valid, const char *host
 	return 0;
 }
 
+static int x509_succeed_certificate_check(git_cert *cert, int valid, const char *host, void *payload)
+{
+	GIT_UNUSED(valid);
+	GIT_UNUSED(payload);
+
+	cl_assert_equal_s("github.com", host);
+	cl_assert_equal_i(GIT_CERT_X509, cert->cert_type);
+
+	return 0;
+}
+
 static int fail_certificate_check(git_cert *cert, int valid, const char *host, void *payload)
 {
 	GIT_UNUSED(cert);
@@ -901,7 +912,7 @@ void test_online_clone__certificate_invalid(void)
 
 void test_online_clone__certificate_valid(void)
 {
-	g_options.fetch_opts.callbacks.certificate_check = succeed_certificate_check;
+	g_options.fetch_opts.callbacks.certificate_check = x509_succeed_certificate_check;
 
 	cl_git_pass(git_clone(&g_repo, "https://github.com/libgit2/TestGitRepository", "./foo", &g_options));
 }

tests/libgit2/stream/registration.c

@@ -81,10 +81,10 @@ void test_stream_registration__tls(void)
 	cl_git_pass(git_stream_register(GIT_STREAM_TLS, NULL));
 	error = git_tls_stream_new(&stream, "localhost", "443");
 
-	/* We don't have TLS support enabled, or we're on Windows,
-	 * which has no arbitrary TLS stream support.
+	/* We don't have TLS support enabled, or we're on Windows
+	 * with WinHTTP, which is not actually TLS stream support.
 	 */
-#if defined(GIT_WIN32) || !defined(GIT_HTTPS)
+#if defined(GIT_WINHTTP) || !defined(GIT_HTTPS)
 	cl_git_fail_with(-1, error);
 #else
 	cl_git_pass(error);