Using Secure Socket Extensions

The following example code demonstrates the usage of the Winsock secure socket extension functions.

Securing a Socket

#define WIN32_LEAN_AND_MEAN

#ifndef UNICODE
#define UNICODE
#endif

#include <windows.h>
#include <winsock2.h>
#include <mstcpip.h>
#include <ws2tcpip.h>
#include <rpc.h>
#include <ntdsapi.h>
#include <stdio.h>
#include <tchar.h>

#define RECV_DATA_BUF_SIZE 256

// Link with ws2_32.lib
#pragma comment(lib, "Ws2_32.lib")

// link with fwpuclnt.lib for Winsock secure socket extensions
#pragma comment(lib, "fwpuclnt.lib")

// link with ntdsapi.lib for DsMakeSpn function
#pragma comment(lib, "ntdsapi.lib")

// The following function assumes that Winsock 
// has already been initialized

int
SecureTcpConnect(IN const struct sockaddr *serverAddr,
 IN ULONG serverAddrLen,
 IN const wchar_t * serverSPN,
 IN const SOCKET_SECURITY_SETTINGS * securitySettings,
 IN ULONG settingsLen)
/**
Routine Description:

 This routine creates a TCP client socket, securely connects to the 
 specified server, sends & receives data from the server, and then closes 
 the socket

Arguments:

 serverAddr - a pointer to the sockaddr structure for the server.

 serverAddrLen - length of serverAddr in bytes

 serverSPN - a NULL-terminated string representing the SPN 
 (service principal name) of the server host computer

 securitySettings - pointer to the socket security settings that should be
 applied to the connection

 settingsLen - length of securitySettings in bytes

Return Value:

 Winsock error code indicating the status of the operation, or NO_ERROR if 
 the operation succeeded.

--*/
{
 int iResult = 0;
 int sockErr = 0;
 SOCKET sock = INVALID_SOCKET;

 WSABUF wsaBuf = { 0 };
 char *dataBuf = "12345678";
 DWORD bytesSent = 0;
 char recvBuf[RECV_DATA_BUF_SIZE] = { 0 };

 DWORD bytesRecvd = 0;
 DWORD flags = 0;
 SOCKET_PEER_TARGET_NAME *peerTargetName = NULL;
 DWORD serverSpnStringLen = (DWORD) wcslen(serverSPN);
 DWORD peerTargetNameLen = sizeof (SOCKET_PEER_TARGET_NAME) +
 (serverSpnStringLen * sizeof (wchar_t));

 //-----------------------------------------
 // Create a TCP socket
 sock = WSASocket(serverAddr->sa_family,
 SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
 if (sock == INVALID_SOCKET) {
 iResult = WSAGetLastError();
 wprintf(L"WSASocket returned error %ld\n", iResult);
 goto cleanup;
 }
 //-----------------------------------------
 // Turn on security for the socket.
 sockErr = WSASetSocketSecurity(sock,
 securitySettings, settingsLen, NULL, NULL);
 if (sockErr == SOCKET_ERROR) {
 iResult = WSAGetLastError();
 wprintf(L"WSASetSocketSecurity returned error %ld\n", iResult);
 goto cleanup;
 }
 //-----------------------------------------
 // Specify the server SPN
 peerTargetName = (SOCKET_PEER_TARGET_NAME *) HeapAlloc(GetProcessHeap(),
 HEAP_ZERO_MEMORY, peerTargetNameLen);
 if (!peerTargetName) {
 iResult = ERROR_NOT_ENOUGH_MEMORY;
 wprintf(L"Out of memory\n");
 goto cleanup;
 }
 // Use the security protocol as specified by the settings
 peerTargetName->SecurityProtocol = securitySettings->SecurityProtocol;
 // Specify the server SPN 
 peerTargetName->PeerTargetNameStringLen = serverSpnStringLen;
 RtlCopyMemory((BYTE *) peerTargetName->AllStrings,
 (BYTE *) serverSPN, serverSpnStringLen * sizeof (wchar_t)
 );

 sockErr = WSASetSocketPeerTargetName(sock,
 peerTargetName,
 peerTargetNameLen, NULL, NULL);
 if (sockErr == SOCKET_ERROR) {
 iResult = WSAGetLastError();
 wprintf(L"WSASetSocketPeerTargetName returned error %ld\n", iResult);
 goto cleanup;
 }
 //-----------------------------------------
 // Connect to the server
 sockErr = WSAConnect(sock,
 serverAddr, serverAddrLen, NULL, NULL, NULL, NULL);
 if (sockErr == SOCKET_ERROR) {
 iResult = WSAGetLastError();
 wprintf(L"WSAConnect returned error %ld\n", iResult);
 goto cleanup;
 }
 // At this point a secure connection must have been established.
 wprintf(L"Secure connection established to the server\n");

 //-----------------------------------------
 // Send some data securely
 wsaBuf.len = (ULONG) strlen(dataBuf);
 wsaBuf.buf = dataBuf;
 sockErr = WSASend(sock, &wsaBuf, 1, &bytesSent, 0, NULL, NULL);
 if (sockErr == SOCKET_ERROR) {
 iResult = WSAGetLastError();
 wprintf(L"WSASend returned error %ld\n", iResult);
 goto cleanup;
 }
 wprintf(L"Sent %d bytes of data to the server\n", bytesSent);

 //-----------------------------------------
 // Receive server's response securely
 wsaBuf.len = RECV_DATA_BUF_SIZE;
 wsaBuf.buf = recvBuf;
 sockErr = WSARecv(sock, &wsaBuf, 1, &bytesRecvd, &flags, NULL, NULL);
 if (sockErr == SOCKET_ERROR) {
 iResult = WSAGetLastError();
 wprintf(L"WSARecv returned error %ld\n", iResult);
 goto cleanup;
 }
 wprintf(L"Received %d bytes of data from the server\n", bytesRecvd);

 cleanup:
 if (sock != INVALID_SOCKET) {
 //This will trigger the cleanup of all IPsec filters and policies that
 //were added for this socket. The cleanup will happen only after all
 //outstanding data has been sent out on the wire.
 closesocket(sock);
 }
 if (peerTargetName) {
 HeapFree(GetProcessHeap(), 0, peerTargetName);
 }
 return iResult;
}

Querying the Security on a Socket

#ifndef UNICODE
#define UNICODE
#endif

#define WIN32_LEAN_AND_MEAN

#include <windows.h>
#include <winsock2.h>
#include <mstcpip.h>
#include <ws2tcpip.h>
#include <stdio.h>

// Link with ws2_32.lib
#pragma comment(lib, "Ws2_32.lib")

// link with fwpuclnt.lib for Winsock secure socket extensions
#pragma comment(lib, "fwpuclnt.lib")

#define MALLOC(x) HeapAlloc(GetProcessHeap(), 0, (x))
#define FREE(x) HeapFree(GetProcessHeap(), 0, (x))

/* Note: could also use malloc() and free() */

// The following function assumes that Winsock 
// has already been initialized

int QueryTcpSocketSecurity(IN SOCKET sock)
{
 int iResult = 0;
 SOCKET_SECURITY_QUERY_INFO *queryInfo = NULL;
 ULONG infoLength = 0;

 //First query the number of bytes to allocate
 iResult = WSAQuerySocketSecurity(sock, NULL, NULL, NULL, &infoLength, NULL, NULL);

 if ((iResult == SOCKET_ERROR) && (WSAGetLastError() == WSAEFAULT)) {
 //Allocate the space
 queryInfo = (SOCKET_SECURITY_QUERY_INFO *) MALLOC(infoLength);
 if (!queryInfo) {
 wprintf(L"Unable to allocate memory\n");
 return 1;
 }
 } else {
 wprintf(L"WSAQuerySocketSecurity failed with %u\n", WSAGetLastError());
 return 1;
 }

 //Get the IPsec info
 iResult = WSAQuerySocketSecurity(sock, NULL, NULL, queryInfo, &infoLength, NULL, NULL);

 if (iResult) {
 wprintf(L"WSAQuerySocketSecurity failed with %u\n", WSAGetLastError());
 if (queryInfo)
 FREE(queryInfo);
 return 1;
 }

 // Now queryInfo contains various pieces of information about the
 // security applied to the socket. For instance a server application
 // will be able to access the client access token and impersonate 
 // the client if it wants.

 // Note that the SecurityQueryTemplate parameter passed to the 
 // WSAQuerySocketSecurity function would need to have the
 // PeerTokenAccessMask member set in the 
 // SOCKET_SECURITY_QUERY_TEMPLATE struct to request 
 // the return of the PeerApplicationAccessTokenHandle or 
 // PeerMachineAccessTokenHandle members in the queryInfo struct
 // returned by WSAQuerySocketSecurit

 // When done, free the memory allocation and exit
 if (queryInfo)
 FREE(queryInfo);
 return iResult;
}

Related topics

About Windows Filtering Platform

Advanced Winsock Samples Using Secure Socket Extensions

Application Layer Enforcement (ALE)

IPsec Configuration

IPsec Functions

Security Support Provider Interface (SSPI)

Windows Filtering Platform

Windows Filtering Platform API Functions

Winsock Secure Socket Extensions