Revision Summary Date Revision History Revision Comments 2/22/2007 0.01 New Version 0.01 release 4/3/2007 0.01 None Version 0.01 release 6/1/2007 1.0 Major Updated and revised the technical content. 7/3/2007 1.1 Minor Updated technical content. 7/20/2007 1.1.1 Editorial Changed language and formatting in the technical content. 8/10/2007 1.1.2 Editorial Changed language and formatting in the technical content. 9/28/2007 1.1.3 Editorial Changed language and formatting in the technical content. 10/23/2007 1.1.4 Editorial Changed language and formatting in the technical content. 11/30/2007 1.1.5 Editorial Changed language and formatting in the technical content.
1/25/2008 1.1.6 Editorial Changed language and formatting in the technical content. 3/14/2008 2.0 Updated and revised the technical content. 5/16/2008 2.0.1 Editorial Changed language and formatting in the technical content. 6/20/2008 2.0.2 Editorial Changed language and formatting in the technical content. 7/25/2008 2.0.3 Editorial Changed language and formatting in the technical content. 8/29/2008 2.0.4 Editorial Changed language and formatting in the technical content. 10/24/2008 2.0.5 Editorial Changed language and formatting in the technical content. 12/5/2008 3.0 Major Updated and revised the technical content. 1/16/2009 3.0.1 Editorial Changed language
and formatting in the technical content. 2/27/2009 3.0.2 Editorial Changed language and formatting in the technical content. 4/10/2009 4.0 Updated and revised the technical content. 5/22/2009 5.0 Updated and revised the technical content. 7/2/2009 6.0 Major Updated and revised the technical content. 8/14/2009 7.0 Major Updated and revised the technical content. 9/25/2009 8.0 Major Updated and revised the technical content. 11/6/2009 8.0.1 Editorial Changed language and formatting in the technical content. 12/18/2009 8.0.2 Editorial Changed language and formatting in the technical content. 1/29/2010 8.0.3 Editorial Changed language
2/11/2011 11.1 None No changes to the meaning, language, or formatting of the technical content. 3/25/2011 11.1 None No changes to the meaning, language, or formatting of the technical content. 5/6/2011 11.1 None No changes to the meaning, language, or formatting of the technical content. 6/17/2011 11.2 Minor Clarified the meaning of the technical content. 9/23/2011 12.0 Major Updated and revised the technical content. 12/16/2011 13.0 Major Updated and revised the technical content. 3/30/2012 13.0 None No changes to the meaning, language, or formatting of the technical content. 7/12/2012 13.0 None No changes to the meaning, language,
or formatting of the technical content. 10/25/2012 13.0 None No changes to the meaning, language, or formatting of the technical content. 1/31/2013 13.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 14.0 Major Updated and revised the technical content. 11/14/2013 14.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 14.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 14.0 None No changes to the meaning, language, or formatting of the technical content.
6/30/2015 15.0 Major Significantly changed the technical content. 10/16/2015 15.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 16.0 Major Significantly changed the technical content.
Figure 8: SSTP call setup for a proxy scenario Handling the Termination Proxy If an SSTP tunnel is established through an HTTPS termination proxy, the HTTPS connection terminates at the proxy and a new HTTP bidirectional connection to the SSTP server is attempted. The query variable tenantid (section ) can be used to select the SSTP server behind the proxy. After the connection is established, the proxy forwards the data across the two connections. Crypto Binding The client sends an SSTP_MSG_CALL_CONNECT_REQUEST that encapsulates the PPP protocol. The actual data bytes are as follows. 10 01 00 0E 00 01 00 01 00 01 00 06 00 01 The details for the packet are as follows. Version: 0x10 Version: 0x1, Minor Version: 0x0) C: 1 (Control Packet) Length: 0x00E Message Type: 0x0001 (SSTP_MSG_CALL_CONNECT_REQUEST) Num Attributes: 0x0001 Attribute 1: Attribute ID: 0x01 (SSTP_ATTRIB_ENCAPSULATED_PROTOCOL_ID) Length: 0x006 Value: 0x0001 (SSTP_ENCAPSULATED_PROTOCOL_PPP) The server responds to the client with SSTP_MSG_CALL_CONNECT_ACK. In this case, the server supports only the SHA256 hash algorithm for . The actual data bytes are as follows. 10 01 00 30 00 02 00 01 00 04 00 28 00 00 00 02 41 2B 48 9A EB D7 EC C7 D0 89 66 F2 6B E7 CD 72 B2 31 A0 E9 21 0D 7C 91 B3 08 86 2B 03 44 C4 35 The details are as follows. Version: 0x10 Version: 0x1, Minor Version: 0x0) C: 1 (Control Packet) Length: 0x030 Message Type: 0x0002 (SSTP_MSG_CALL_CONNECT_ACK) Num Attributes: 0x0001 Attribute 1:
Length: 0x068 Value: Hash Protocol Bitmask: 0x02 (CERT_HASH_PROTOCOL_SHA256) 41 2B 48 9A EB D7 EC C7 D0 89 66 F2 6B E7 CD 72 B2 31 A0 E9 21 0D 7C 91 B3 08 86 2B 03 44 C4 35 Certificate Hash: 79 93 EF 31 4C 49 3D AC E9 F0 2D 60 E7 E6 1C 84 B6 69 0A AF E9 D7 AE EA 92 CB BE 8A D5 99 42 2D Compound MAC: 52 A6 8E FD 8C FF BF 52 77 0B 8F 0F E8 EC 73 71 65 83 AF 6D 61 1E B6 D1 79 B3 B2 08 40 98 54 49 In this example, the server uses a SHA1 hash for crypto binding. The following is a sample SSTP_MSG_CALL_CONNECT_ACK in this scenario. 10 01 00 30 00 02 00 01 00 04 00 28 00 00 00 01 0F 1A 2D 58 D4 A3 E3 00 0F AD 3C E4 90 6E 07 B7 07 AA 9E 44 1C CE AC 5C BD 7B 2C C1 C9 D8 6C DF The details of the packet are as follows. Version: 0x10 (Major Version: 0x1, Minor Version: 0x0) C: 1 (Control Packet) Length: 0x030 Message Type: 0x0002 (SSTP_MSG_CALL_CONNECT_ACK) Num Attributes: 0x0001 Attribute 1: Attribute ID: 0x04 (SSTP_ATTRIB_CRYPTO_BINDING_REQ) Length: 0x028 Hash Protocol Bitmask: 0x01 (CERT_HASH_PROTOCOL_SHA1) Nonce: 0F 1A 2D 58 D4 A3 E3 00 0F AD 3C E4 90 6E 07 B7
Index A Abort timers ( 41, 43) Abstract data model client ( 38, 44) server ( 38, 58) 12 77 C 40 Call abort message 55 65 32 32 25 53 62 54 30 24 63 27 38 36 Call disconnect acknowledgment message 56 66 Call disconnect message 55 65 34 34 Call establishment 46 59 25 30 24 27 12 85 Client abstract data model ( 38, 44) 55 53 54 56 55 46 49 56 57 error handling ( 42, 49) higher-layer triggered events ( 42, 47) initialization ( 42, 47) local events ( 43, 57) message processing ( 42, 49) message status ( 42, 49) negotiation timer ( 47, 57) 57 overview ( 38, 44) 53 53 sequencing ( 42, 49) 43 state machine ( 38, 46) events ( 43, 57) timers ( 41, 47) Crypto binding 49 72 19 18 19 18 D Data model - abstract client ( 38, 44) server ( 38, 58) Disconnect timers ( 41, 43) E Echo Request message 56 66 Echo Response message 57 66 17 17 Error handling client ( 42, 49) server ( 42, 62) Examples 72 71 69 69 70 70 F 12 G 7 H 71 Hello timer ( 42, 43) Higher-layer triggered events client ( 42, 47) server ( 42, 62)
HMAC-SHA1-160 50 50 HMAC-SHA256-256 52 52 69 69 I 77 77 9 Initialization client ( 42, 47) server ( 42, 61) Input data 50 52 7 K Key 50 52 L Local events client ( 43, 57) server ( 43, 67) M 79 Message processing client ( 42, 49) server ( 42, 62) Messages 32 25 30 24 27 36 34 19 18 17 16 14 15 13 status - client ( 42, 49) status - server ( 42, 62) 21 13 13 79 N Negotiation timer client ( 47, 57) server ( 61, 67) 8 O Other local events 57 67 10 P Packet processing 53 62 Packet validation 53 62 77 77 11 11 82 Protocol Details 38 R 8 9 8 11 77 78 S Security 77 77 79 77 77 77 78 Sequencing client ( 42, 49) server ( 42, 62) Server abstract data ( 38, 58) 65 62 63 66 65 59 66 66 error handling ( 42, 62) higher-layer triggered events ( 42, 62) initialization ( 42, 61) local events ( 43, 67) message processing ( 42, 62)