[cpp-sp] 01/01: CPPSP-18 Capture work in progress

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/CPPSP-18
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/acdb0de554810e02cd476a4dacfdf1497425f7db

commit acdb0de554810e02cd476a4dacfdf1497425f7db
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Aug 20 14:43:47 2026 +0100

    CPPSP-18 Capture work in progress
---
 shibsp/remoting/impl/WinHTTPRemotingService.cpp | 35 +++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/shibsp/remoting/impl/WinHTTPRemotingService.cpp b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
index 5c6c0adf..59675ea4 100644
--- a/shibsp/remoting/impl/WinHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
@@ -21,6 +21,7 @@
 #include "internal.h"
 #include "exceptions.h"
 #include <Windows.h>
+#include <schannel.h>
 #include <winhttp.h>
 
 #include "Agent.h"
@@ -65,6 +66,8 @@ namespace {
 
         void handleCert(HINTERNET handle) const;
 
+        void handleCipher(HINTERNET handle) const;
+
         void logSecureFailure(DWORD status) const;
 
     private:
@@ -81,6 +84,7 @@ namespace {
         HCERTCHAINENGINE m_caChainEngine;
         HCERTSTORE m_caStore;
         void setupCaChecking();
+        vector<string> m_ciphers;
         string getCertName(PCCERT_CONTEXT certContext) const;
     };
 
@@ -213,9 +217,24 @@ StatusCallback(
 
     if (dwInternetStatus == WINHTTP_CALLBACK_STATUS_SENDING_REQUEST) {
         service->handleCert(hInternet);
+        service->handleCiphers(hInternet);
+        WINHTTP_SECURITY_INFO secinfo;
+        DWORD len = sizeof(secinfo);
+        if (WinHttpQueryOption(hInternet, WINHTTP_OPTION_SECURITY_INFO, &secinfo, &len)) {
+            auto foo = secinfo.ConnectionInfo;
+            auto bar = secinfo.CipherInfo;
+
+        }
+        else {
+
+            len = GetLastError();
+
+        }
     } else if (dwInternetStatus == WINHTTP_CALLBACK_STATUS_SECURE_FAILURE) {
         service->logSecureFailure(*((DWORD*)lpvStatusInformation));
     }
+
+
 };
 
 WinHTTPRemotingService::WinHTTPRemotingService(ptree& pt)
@@ -297,7 +316,7 @@ WinHTTPRemotingService::WinHTTPRemotingService(ptree& pt)
     }
     m_secure = (components.nScheme == INTERNET_SCHEME_HTTPS);
 
-    if (m_secure && (m_caChainEngine != NULL)) {
+    if (m_secure) {
         //
         // Arrange to be called back so we can check certificates
         //
@@ -308,12 +327,21 @@ WinHTTPRemotingService::WinHTTPRemotingService(ptree& pt)
             m_log.crit("WinHttpSetOption failure: %d", GetLastError());
             throw runtime_error("WinHHHTP failed to initialize: Could not set callback option");
         }
+        DWORD flags = WINHTTP_CALLBACK_STATUS_SENDING_REQUEST |
+                        WINHTTP_CALLBACK_STATUS_SECURE_FAILURE;
 
         // And register the callback
-        if (WinHttpSetStatusCallback(m_session, StatusCallback, WINHTTP_CALLBACK_STATUS_SENDING_REQUEST | WINHTTP_CALLBACK_STATUS_SECURE_FAILURE, NULL) == WINHTTP_INVALID_STATUS_CALLBACK) {
+        if (WinHttpSetStatusCallback(m_session, StatusCallback, flags, NULL) == WINHTTP_INVALID_STATUS_CALLBACK) {
             m_log.crit("WinHttpSetStatusCallback failure: %d", GetLastError());
             throw runtime_error("WinHHHTP failed to initialize: Could not register callback");
         }
+
+        flags = WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2;
+        flags = WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_3;
+        if (!WinHttpSetOption(m_session, WINHTTP_OPTION_SECURE_PROTOCOLS, &flags, sizeof(flags))) {
+            m_log.crit("WinHttpSetOption failure: %d", GetLastError());
+            throw runtime_error("WinHHHTP failed to initialize: Could not set tls options");
+        }
     }
 
     wstring host(components.lpszHostName, components.dwHostNameLength);
@@ -580,6 +608,9 @@ void WinHTTPRemotingService::handleCert(HINTERNET handle) const
     PCCERT_CONTEXT certCtx = NULL;
     DWORD size = sizeof(certCtx);
 
+    if (m_caChainEngine == NULL)
+        return;
+
     if (!WinHttpQueryOption(handle, WINHTTP_OPTION_SERVER_CERT_CONTEXT, &certCtx, &size)) {
         m_log.crit("Could not get the certificate on connect");
         throw RemotingException("Could not get certificate");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.