1/*
2 *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
3 *
4 *  Use of this source code is governed by a BSD-style license
5 *  that can be found in the LICENSE file in the root of the source
6 *  tree. An additional intellectual property rights grant can be found
7 *  in the file PATENTS.  All contributing project authors may
8 *  be found in the AUTHORS file in the root of the source tree.
9 */
10
11#include "webrtc/base/win32.h"
12#define SECURITY_WIN32
13#include <security.h>
14#include <schannel.h>
15
16#include <iomanip>
17#include <vector>
18
19#include "webrtc/base/common.h"
20#include "webrtc/base/logging.h"
21#include "webrtc/base/schanneladapter.h"
22#include "webrtc/base/sec_buffer.h"
23#include "webrtc/base/thread.h"
24
25namespace rtc {
26
27/////////////////////////////////////////////////////////////////////////////
28// SChannelAdapter
29/////////////////////////////////////////////////////////////////////////////
30
31extern const ConstantLabel SECURITY_ERRORS[];
32
33const ConstantLabel SCHANNEL_BUFFER_TYPES[] = {
34  KLABEL(SECBUFFER_EMPTY),              //  0
35  KLABEL(SECBUFFER_DATA),               //  1
36  KLABEL(SECBUFFER_TOKEN),              //  2
37  KLABEL(SECBUFFER_PKG_PARAMS),         //  3
38  KLABEL(SECBUFFER_MISSING),            //  4
39  KLABEL(SECBUFFER_EXTRA),              //  5
40  KLABEL(SECBUFFER_STREAM_TRAILER),     //  6
41  KLABEL(SECBUFFER_STREAM_HEADER),      //  7
42  KLABEL(SECBUFFER_MECHLIST),           // 11
43  KLABEL(SECBUFFER_MECHLIST_SIGNATURE), // 12
44  KLABEL(SECBUFFER_TARGET),             // 13
45  KLABEL(SECBUFFER_CHANNEL_BINDINGS),   // 14
46  LASTLABEL
47};
48
49void DescribeBuffer(LoggingSeverity severity, const char* prefix,
50                    const SecBuffer& sb) {
51  LOG_V(severity)
52    << prefix
53    << "(" << sb.cbBuffer
54    << ", " << FindLabel(sb.BufferType & ~SECBUFFER_ATTRMASK,
55                          SCHANNEL_BUFFER_TYPES)
56    << ", " << sb.pvBuffer << ")";
57}
58
59void DescribeBuffers(LoggingSeverity severity, const char* prefix,
60                     const SecBufferDesc* sbd) {
61  if (!LOG_CHECK_LEVEL_V(severity))
62    return;
63  LOG_V(severity) << prefix << "(";
64  for (size_t i=0; i<sbd->cBuffers; ++i) {
65    DescribeBuffer(severity, "  ", sbd->pBuffers[i]);
66  }
67  LOG_V(severity) << ")";
68}
69
70const ULONG SSL_FLAGS_DEFAULT = ISC_REQ_ALLOCATE_MEMORY
71                              | ISC_REQ_CONFIDENTIALITY
72                              | ISC_REQ_EXTENDED_ERROR
73                              | ISC_REQ_INTEGRITY
74                              | ISC_REQ_REPLAY_DETECT
75                              | ISC_REQ_SEQUENCE_DETECT
76                              | ISC_REQ_STREAM;
77                              //| ISC_REQ_USE_SUPPLIED_CREDS;
78
79typedef std::vector<char> SChannelBuffer;
80
81struct SChannelAdapter::SSLImpl {
82  CredHandle cred;
83  CtxtHandle ctx;
84  bool cred_init, ctx_init;
85  SChannelBuffer inbuf, outbuf, readable;
86  SecPkgContext_StreamSizes sizes;
87
88  SSLImpl() : cred_init(false), ctx_init(false) { }
89};
90
91SChannelAdapter::SChannelAdapter(AsyncSocket* socket)
92  : SSLAdapter(socket), state_(SSL_NONE),
93    restartable_(false), signal_close_(false), message_pending_(false),
94    impl_(new SSLImpl) {
95}
96
97SChannelAdapter::~SChannelAdapter() {
98  Cleanup();
99}
100
101int
102SChannelAdapter::StartSSL(const char* hostname, bool restartable) {
103  if (state_ != SSL_NONE)
104    return ERROR_ALREADY_INITIALIZED;
105
106  ssl_host_name_ = hostname;
107  restartable_ = restartable;
108
109  if (socket_->GetState() != Socket::CS_CONNECTED) {
110    state_ = SSL_WAIT;
111    return 0;
112  }
113
114  state_ = SSL_CONNECTING;
115  if (int err = BeginSSL()) {
116    Error("BeginSSL", err, false);
117    return err;
118  }
119
120  return 0;
121}
122
123int
124SChannelAdapter::BeginSSL() {
125  LOG(LS_VERBOSE) << "BeginSSL: " << ssl_host_name_;
126  ASSERT(state_ == SSL_CONNECTING);
127
128  SECURITY_STATUS ret;
129
130  SCHANNEL_CRED sc_cred = { 0 };
131  sc_cred.dwVersion = SCHANNEL_CRED_VERSION;
132  //sc_cred.dwMinimumCipherStrength = 128; // Note: use system default
133  sc_cred.dwFlags = SCH_CRED_NO_DEFAULT_CREDS | SCH_CRED_AUTO_CRED_VALIDATION;
134
135  ret = AcquireCredentialsHandle(NULL, const_cast<LPTSTR>(UNISP_NAME),
136                                 SECPKG_CRED_OUTBOUND, NULL, &sc_cred, NULL,
137                                 NULL, &impl_->cred, NULL);
138  if (ret != SEC_E_OK) {
139    LOG(LS_ERROR) << "AcquireCredentialsHandle error: "
140                  << ErrorName(ret, SECURITY_ERRORS);
141    return ret;
142  }
143  impl_->cred_init = true;
144
145  if (LOG_CHECK_LEVEL(LS_VERBOSE)) {
146    SecPkgCred_CipherStrengths cipher_strengths = { 0 };
147    ret = QueryCredentialsAttributes(&impl_->cred,
148                                     SECPKG_ATTR_CIPHER_STRENGTHS,
149                                     &cipher_strengths);
150    if (SUCCEEDED(ret)) {
151      LOG(LS_VERBOSE) << "SChannel cipher strength: "
152                  << cipher_strengths.dwMinimumCipherStrength << " - "
153                  << cipher_strengths.dwMaximumCipherStrength;
154    }
155
156    SecPkgCred_SupportedAlgs supported_algs = { 0 };
157    ret = QueryCredentialsAttributes(&impl_->cred,
158                                     SECPKG_ATTR_SUPPORTED_ALGS,
159                                     &supported_algs);
160    if (SUCCEEDED(ret)) {
161      LOG(LS_VERBOSE) << "SChannel supported algorithms:";
162      for (DWORD i=0; i<supported_algs.cSupportedAlgs; ++i) {
163        ALG_ID alg_id = supported_algs.palgSupportedAlgs[i];
164        PCCRYPT_OID_INFO oinfo = CryptFindOIDInfo(CRYPT_OID_INFO_ALGID_KEY,
165                                                  &alg_id, 0);
166        LPCWSTR alg_name = (NULL != oinfo) ? oinfo->pwszName : L"Unknown";
167        LOG(LS_VERBOSE) << "  " << ToUtf8(alg_name) << " (" << alg_id << ")";
168      }
169      CSecBufferBase::FreeSSPI(supported_algs.palgSupportedAlgs);
170    }
171  }
172
173  ULONG flags = SSL_FLAGS_DEFAULT, ret_flags = 0;
174  if (ignore_bad_cert())
175    flags |= ISC_REQ_MANUAL_CRED_VALIDATION;
176
177  CSecBufferBundle<2, CSecBufferBase::FreeSSPI> sb_out;
178  ret = InitializeSecurityContextA(&impl_->cred, NULL,
179                                   const_cast<char*>(ssl_host_name_.c_str()),
180                                   flags, 0, 0, NULL, 0,
181                                   &impl_->ctx, sb_out.desc(),
182                                   &ret_flags, NULL);
183  if (SUCCEEDED(ret))
184    impl_->ctx_init = true;
185  return ProcessContext(ret, NULL, sb_out.desc());
186}
187
188int
189SChannelAdapter::ContinueSSL() {
190  LOG(LS_VERBOSE) << "ContinueSSL";
191  ASSERT(state_ == SSL_CONNECTING);
192
193  SECURITY_STATUS ret;
194
195  CSecBufferBundle<2> sb_in;
196  sb_in[0].BufferType = SECBUFFER_TOKEN;
197  sb_in[0].cbBuffer = static_cast<unsigned long>(impl_->inbuf.size());
198  sb_in[0].pvBuffer = &impl_->inbuf[0];
199  //DescribeBuffers(LS_VERBOSE, "Input Buffer ", sb_in.desc());
200
201  ULONG flags = SSL_FLAGS_DEFAULT, ret_flags = 0;
202  if (ignore_bad_cert())
203    flags |= ISC_REQ_MANUAL_CRED_VALIDATION;
204
205  CSecBufferBundle<2, CSecBufferBase::FreeSSPI> sb_out;
206  ret = InitializeSecurityContextA(&impl_->cred, &impl_->ctx,
207                                   const_cast<char*>(ssl_host_name_.c_str()),
208                                   flags, 0, 0, sb_in.desc(), 0,
209                                   NULL, sb_out.desc(),
210                                   &ret_flags, NULL);
211  return ProcessContext(ret, sb_in.desc(), sb_out.desc());
212}
213
214int
215SChannelAdapter::ProcessContext(long int status, _SecBufferDesc* sbd_in,
216                                _SecBufferDesc* sbd_out) {
217  if (status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED &&
218      status != SEC_E_INCOMPLETE_MESSAGE) {
219    LOG(LS_ERROR)
220      << "InitializeSecurityContext error: "
221      << ErrorName(status, SECURITY_ERRORS);
222  }
223  //if (sbd_in)
224  //  DescribeBuffers(LS_VERBOSE, "Input Buffer ", sbd_in);
225  //if (sbd_out)
226  //  DescribeBuffers(LS_VERBOSE, "Output Buffer ", sbd_out);
227
228  if (status == SEC_E_INCOMPLETE_MESSAGE) {
229    // Wait for more input from server.
230    return Flush();
231  }
232
233  if (FAILED(status)) {
234    // We can't continue.  Common errors:
235    // SEC_E_CERT_EXPIRED - Typically, this means the computer clock is wrong.
236    return status;
237  }
238
239  // Note: we check both input and output buffers for SECBUFFER_EXTRA.
240  // Experience shows it appearing in the input, but the documentation claims
241  // it should appear in the output.
242  size_t extra = 0;
243  if (sbd_in) {
244    for (size_t i=0; i<sbd_in->cBuffers; ++i) {
245      SecBuffer& buffer = sbd_in->pBuffers[i];
246      if (buffer.BufferType == SECBUFFER_EXTRA) {
247        extra += buffer.cbBuffer;
248      }
249    }
250  }
251  if (sbd_out) {
252    for (size_t i=0; i<sbd_out->cBuffers; ++i) {
253      SecBuffer& buffer = sbd_out->pBuffers[i];
254      if (buffer.BufferType == SECBUFFER_EXTRA) {
255        extra += buffer.cbBuffer;
256      } else if (buffer.BufferType == SECBUFFER_TOKEN) {
257        impl_->outbuf.insert(impl_->outbuf.end(),
258          reinterpret_cast<char*>(buffer.pvBuffer),
259          reinterpret_cast<char*>(buffer.pvBuffer) + buffer.cbBuffer);
260      }
261    }
262  }
263
264  if (extra) {
265    ASSERT(extra <= impl_->inbuf.size());
266    size_t consumed = impl_->inbuf.size() - extra;
267    memmove(&impl_->inbuf[0], &impl_->inbuf[consumed], extra);
268    impl_->inbuf.resize(extra);
269  } else {
270    impl_->inbuf.clear();
271  }
272
273  if (SEC_I_CONTINUE_NEEDED == status) {
274    // Send data to server and wait for response.
275    // Note: ContinueSSL will result in a Flush, anyway.
276    return impl_->inbuf.empty() ? Flush() : ContinueSSL();
277  }
278
279  if (SEC_E_OK == status) {
280    LOG(LS_VERBOSE) << "QueryContextAttributes";
281    status = QueryContextAttributes(&impl_->ctx, SECPKG_ATTR_STREAM_SIZES,
282                                    &impl_->sizes);
283    if (FAILED(status)) {
284      LOG(LS_ERROR) << "QueryContextAttributes error: "
285                    << ErrorName(status, SECURITY_ERRORS);
286      return status;
287    }
288
289    state_ = SSL_CONNECTED;
290
291    if (int err = DecryptData()) {
292      return err;
293    } else if (int err = Flush()) {
294      return err;
295    } else {
296      // If we decrypted any data, queue up a notification here
297      PostEvent();
298      // Signal our connectedness
299      AsyncSocketAdapter::OnConnectEvent(this);
300    }
301    return 0;
302  }
303
304  if (SEC_I_INCOMPLETE_CREDENTIALS == status) {
305    // We don't support client authentication in schannel.
306    return status;
307  }
308
309  // We don't expect any other codes
310  ASSERT(false);
311  return status;
312}
313
314int
315SChannelAdapter::DecryptData() {
316  SChannelBuffer& inbuf = impl_->inbuf;
317  SChannelBuffer& readable = impl_->readable;
318
319  while (!inbuf.empty()) {
320    CSecBufferBundle<4> in_buf;
321    in_buf[0].BufferType = SECBUFFER_DATA;
322    in_buf[0].cbBuffer = static_cast<unsigned long>(inbuf.size());
323    in_buf[0].pvBuffer = &inbuf[0];
324
325    //DescribeBuffers(LS_VERBOSE, "Decrypt In ", in_buf.desc());
326    SECURITY_STATUS status = DecryptMessage(&impl_->ctx, in_buf.desc(), 0, 0);
327    //DescribeBuffers(LS_VERBOSE, "Decrypt Out ", in_buf.desc());
328
329    // Note: We are explicitly treating SEC_E_OK, SEC_I_CONTEXT_EXPIRED, and
330    // any other successful results as continue.
331    if (SUCCEEDED(status)) {
332      size_t data_len = 0, extra_len = 0;
333      for (size_t i=0; i<in_buf.desc()->cBuffers; ++i) {
334        if (in_buf[i].BufferType == SECBUFFER_DATA) {
335          data_len += in_buf[i].cbBuffer;
336          readable.insert(readable.end(),
337            reinterpret_cast<char*>(in_buf[i].pvBuffer),
338            reinterpret_cast<char*>(in_buf[i].pvBuffer) + in_buf[i].cbBuffer);
339        } else if (in_buf[i].BufferType == SECBUFFER_EXTRA) {
340          extra_len += in_buf[i].cbBuffer;
341        }
342      }
343      // There is a bug on Win2K where SEC_I_CONTEXT_EXPIRED is misclassified.
344      if ((data_len == 0) && (inbuf[0] == 0x15)) {
345        status = SEC_I_CONTEXT_EXPIRED;
346      }
347      if (extra_len) {
348        size_t consumed = inbuf.size() - extra_len;
349        memmove(&inbuf[0], &inbuf[consumed], extra_len);
350        inbuf.resize(extra_len);
351      } else {
352        inbuf.clear();
353      }
354      // TODO: Handle SEC_I_CONTEXT_EXPIRED to do clean shutdown
355      if (status != SEC_E_OK) {
356        LOG(LS_INFO) << "DecryptMessage returned continuation code: "
357                      << ErrorName(status, SECURITY_ERRORS);
358      }
359      continue;
360    }
361
362    if (status == SEC_E_INCOMPLETE_MESSAGE) {
363      break;
364    } else {
365      return status;
366    }
367  }
368
369  return 0;
370}
371
372void
373SChannelAdapter::Cleanup() {
374  if (impl_->ctx_init)
375    DeleteSecurityContext(&impl_->ctx);
376  if (impl_->cred_init)
377    FreeCredentialsHandle(&impl_->cred);
378  delete impl_;
379}
380
381void
382SChannelAdapter::PostEvent() {
383  // Check if there's anything notable to signal
384  if (impl_->readable.empty() && !signal_close_)
385    return;
386
387  // Only one post in the queue at a time
388  if (message_pending_)
389    return;
390
391  if (Thread* thread = Thread::Current()) {
392    message_pending_ = true;
393    thread->Post(this);
394  } else {
395    LOG(LS_ERROR) << "No thread context available for SChannelAdapter";
396    ASSERT(false);
397  }
398}
399
400void
401SChannelAdapter::Error(const char* context, int err, bool signal) {
402  LOG(LS_WARNING) << "SChannelAdapter::Error("
403                  << context << ", "
404                  << ErrorName(err, SECURITY_ERRORS) << ")";
405  state_ = SSL_ERROR;
406  SetError(err);
407  if (signal)
408    AsyncSocketAdapter::OnCloseEvent(this, err);
409}
410
411int
412SChannelAdapter::Read() {
413  char buffer[4096];
414  SChannelBuffer& inbuf = impl_->inbuf;
415  while (true) {
416    int ret = AsyncSocketAdapter::Recv(buffer, sizeof(buffer));
417    if (ret > 0) {
418      inbuf.insert(inbuf.end(), buffer, buffer + ret);
419    } else if (GetError() == EWOULDBLOCK) {
420      return 0;  // Blocking
421    } else {
422      return GetError();
423    }
424  }
425}
426
427int
428SChannelAdapter::Flush() {
429  int result = 0;
430  size_t pos = 0;
431  SChannelBuffer& outbuf = impl_->outbuf;
432  while (pos < outbuf.size()) {
433    int sent = AsyncSocketAdapter::Send(&outbuf[pos], outbuf.size() - pos);
434    if (sent > 0) {
435      pos += sent;
436    } else if (GetError() == EWOULDBLOCK) {
437      break;  // Blocking
438    } else {
439      result = GetError();
440      break;
441    }
442  }
443  if (int remainder = static_cast<int>(outbuf.size() - pos)) {
444    memmove(&outbuf[0], &outbuf[pos], remainder);
445    outbuf.resize(remainder);
446  } else {
447    outbuf.clear();
448  }
449  return result;
450}
451
452//
453// AsyncSocket Implementation
454//
455
456int
457SChannelAdapter::Send(const void* pv, size_t cb) {
458  switch (state_) {
459  case SSL_NONE:
460    return AsyncSocketAdapter::Send(pv, cb);
461
462  case SSL_WAIT:
463  case SSL_CONNECTING:
464    SetError(EWOULDBLOCK);
465    return SOCKET_ERROR;
466
467  case SSL_CONNECTED:
468    break;
469
470  case SSL_ERROR:
471  default:
472    return SOCKET_ERROR;
473  }
474
475  size_t written = 0;
476  SChannelBuffer& outbuf = impl_->outbuf;
477  while (written < cb) {
478    const size_t encrypt_len = std::min<size_t>(cb - written,
479                                                impl_->sizes.cbMaximumMessage);
480
481    CSecBufferBundle<4> out_buf;
482    out_buf[0].BufferType = SECBUFFER_STREAM_HEADER;
483    out_buf[0].cbBuffer = impl_->sizes.cbHeader;
484    out_buf[1].BufferType = SECBUFFER_DATA;
485    out_buf[1].cbBuffer = static_cast<unsigned long>(encrypt_len);
486    out_buf[2].BufferType = SECBUFFER_STREAM_TRAILER;
487    out_buf[2].cbBuffer = impl_->sizes.cbTrailer;
488
489    size_t packet_len = out_buf[0].cbBuffer
490                      + out_buf[1].cbBuffer
491                      + out_buf[2].cbBuffer;
492
493    SChannelBuffer message;
494    message.resize(packet_len);
495    out_buf[0].pvBuffer = &message[0];
496    out_buf[1].pvBuffer = &message[out_buf[0].cbBuffer];
497    out_buf[2].pvBuffer = &message[out_buf[0].cbBuffer + out_buf[1].cbBuffer];
498
499    memcpy(out_buf[1].pvBuffer,
500           static_cast<const char*>(pv) + written,
501           encrypt_len);
502
503    //DescribeBuffers(LS_VERBOSE, "Encrypt In ", out_buf.desc());
504    SECURITY_STATUS res = EncryptMessage(&impl_->ctx, 0, out_buf.desc(), 0);
505    //DescribeBuffers(LS_VERBOSE, "Encrypt Out ", out_buf.desc());
506
507    if (FAILED(res)) {
508      Error("EncryptMessage", res, false);
509      return SOCKET_ERROR;
510    }
511
512    // We assume that the header and data segments do not change length,
513    // or else encrypting the concatenated packet in-place is wrong.
514    ASSERT(out_buf[0].cbBuffer == impl_->sizes.cbHeader);
515    ASSERT(out_buf[1].cbBuffer == static_cast<unsigned long>(encrypt_len));
516
517    // However, the length of the trailer may change due to padding.
518    ASSERT(out_buf[2].cbBuffer <= impl_->sizes.cbTrailer);
519
520    packet_len = out_buf[0].cbBuffer
521               + out_buf[1].cbBuffer
522               + out_buf[2].cbBuffer;
523
524    written += encrypt_len;
525    outbuf.insert(outbuf.end(), &message[0], &message[packet_len-1]+1);
526  }
527
528  if (int err = Flush()) {
529    state_ = SSL_ERROR;
530    SetError(err);
531    return SOCKET_ERROR;
532  }
533
534  return static_cast<int>(written);
535}
536
537int
538SChannelAdapter::Recv(void* pv, size_t cb) {
539  switch (state_) {
540  case SSL_NONE:
541    return AsyncSocketAdapter::Recv(pv, cb);
542
543  case SSL_WAIT:
544  case SSL_CONNECTING:
545    SetError(EWOULDBLOCK);
546    return SOCKET_ERROR;
547
548  case SSL_CONNECTED:
549    break;
550
551  case SSL_ERROR:
552  default:
553    return SOCKET_ERROR;
554  }
555
556  SChannelBuffer& readable = impl_->readable;
557  if (readable.empty()) {
558    SetError(EWOULDBLOCK);
559    return SOCKET_ERROR;
560  }
561  size_t read = _min(cb, readable.size());
562  memcpy(pv, &readable[0], read);
563  if (size_t remaining = readable.size() - read) {
564    memmove(&readable[0], &readable[read], remaining);
565    readable.resize(remaining);
566  } else {
567    readable.clear();
568  }
569
570  PostEvent();
571  return static_cast<int>(read);
572}
573
574int
575SChannelAdapter::Close() {
576  if (!impl_->readable.empty()) {
577    LOG(WARNING) << "SChannelAdapter::Close with readable data";
578    // Note: this isn't strictly an error, but we're using it temporarily to
579    // track bugs.
580    //ASSERT(false);
581  }
582  if (state_ == SSL_CONNECTED) {
583    DWORD token = SCHANNEL_SHUTDOWN;
584    CSecBufferBundle<1> sb_in;
585    sb_in[0].BufferType = SECBUFFER_TOKEN;
586    sb_in[0].cbBuffer = sizeof(token);
587    sb_in[0].pvBuffer = &token;
588    ApplyControlToken(&impl_->ctx, sb_in.desc());
589    // TODO: In theory, to do a nice shutdown, we need to begin shutdown
590    // negotiation with more calls to InitializeSecurityContext.  Since the
591    // socket api doesn't support nice shutdown at this point, we don't bother.
592  }
593  Cleanup();
594  impl_ = new SSLImpl;
595  state_ = restartable_ ? SSL_WAIT : SSL_NONE;
596  signal_close_ = false;
597  message_pending_ = false;
598  return AsyncSocketAdapter::Close();
599}
600
601Socket::ConnState
602SChannelAdapter::GetState() const {
603  if (signal_close_)
604    return CS_CONNECTED;
605  ConnState state = socket_->GetState();
606  if ((state == CS_CONNECTED)
607      && ((state_ == SSL_WAIT) || (state_ == SSL_CONNECTING)))
608    state = CS_CONNECTING;
609  return state;
610}
611
612void
613SChannelAdapter::OnConnectEvent(AsyncSocket* socket) {
614  LOG(LS_VERBOSE) << "SChannelAdapter::OnConnectEvent";
615  if (state_ != SSL_WAIT) {
616    ASSERT(state_ == SSL_NONE);
617    AsyncSocketAdapter::OnConnectEvent(socket);
618    return;
619  }
620
621  state_ = SSL_CONNECTING;
622  if (int err = BeginSSL()) {
623    Error("BeginSSL", err);
624  }
625}
626
627void
628SChannelAdapter::OnReadEvent(AsyncSocket* socket) {
629  if (state_ == SSL_NONE) {
630    AsyncSocketAdapter::OnReadEvent(socket);
631    return;
632  }
633
634  if (int err = Read()) {
635    Error("Read", err);
636    return;
637  }
638
639  if (impl_->inbuf.empty())
640    return;
641
642  if (state_ == SSL_CONNECTED) {
643    if (int err = DecryptData()) {
644      Error("DecryptData", err);
645    } else if (!impl_->readable.empty()) {
646      AsyncSocketAdapter::OnReadEvent(this);
647    }
648  } else if (state_ == SSL_CONNECTING) {
649    if (int err = ContinueSSL()) {
650      Error("ContinueSSL", err);
651    }
652  }
653}
654
655void
656SChannelAdapter::OnWriteEvent(AsyncSocket* socket) {
657  if (state_ == SSL_NONE) {
658    AsyncSocketAdapter::OnWriteEvent(socket);
659    return;
660  }
661
662  if (int err = Flush()) {
663    Error("Flush", err);
664    return;
665  }
666
667  // See if we have more data to write
668  if (!impl_->outbuf.empty())
669    return;
670
671  // Buffer is empty, submit notification
672  if (state_ == SSL_CONNECTED) {
673    AsyncSocketAdapter::OnWriteEvent(socket);
674  }
675}
676
677void
678SChannelAdapter::OnCloseEvent(AsyncSocket* socket, int err) {
679  if ((state_ == SSL_NONE) || impl_->readable.empty()) {
680    AsyncSocketAdapter::OnCloseEvent(socket, err);
681    return;
682  }
683
684  // If readable is non-empty, then we have a pending Message
685  // that will allow us to signal close (eventually).
686  signal_close_ = true;
687}
688
689void
690SChannelAdapter::OnMessage(Message* pmsg) {
691  if (!message_pending_)
692    return;  // This occurs when socket is closed
693
694  message_pending_ = false;
695  if (!impl_->readable.empty()) {
696    AsyncSocketAdapter::OnReadEvent(this);
697  } else if (signal_close_) {
698    signal_close_ = false;
699    AsyncSocketAdapter::OnCloseEvent(this, 0); // TODO: cache this error?
700  }
701}
702
703} // namespace rtc
704