|
|
/*++
Copyright (c) 1996 Microsoft Corporation
Module Name:
certcach.cxx
Abstract:
Contains class implementation for certificate cache object. This object will hold various Certificate entries.
Contents: SECURITY_CACHE_LIST_ENTRY::SECURITY_CACHE_LIST_ENTRY SECURITY_CACHE_LIST_ENTRY::~SECURITY_CACHE_LIST_ENTRY SECURITY_CACHE_LIST_ENTRY::AddRef SECURITY_CACHE_LIST_ENTRY::Release SECURITY_CACHE_LIST_ENTRY::Clear SECURITY_CACHE_LIST::Find SECURITY_CACHE_LIST::Add SECURITY_CACHE_LIST::ClearList SECURITY_CACHE_LIST::ClearClientAuthCertChains
TODO: Add Cert validation. What if Cert is given but different?
Author:
Arthur L Bierer (arthurbi) 20-Apr-1996
Revision History:
20-Apr-1996 arthurbi Created
--*/#include <wininetp.h>
//
// private manifests
//
#define MAX_CERT_CACHE_CERTS 16
//
// private types
//
//
// SECURITY_CACHE_LIST_ENTRY member functions
//
SECURITY_CACHE_LIST_ENTRY::SECURITY_CACHE_LIST_ENTRY( IN LPSTR lpszHostName )
/*++
Routine Description:
SECURITY_CACHE_LIST_ENTRY constructor. Create object; don't add it to list
Arguments:
lpszHostName - name of host for which this cache entry created
Return Value:
None.
--*/
{ DEBUG_ENTER((DBG_OBJECTS, None, "SECURITY_CACHE_LIST_ENTRY::SECURITY_CACHE_LIST_ENTRY", "%q", lpszHostName ));
#if INET_DEBUG
_List.Flink = _List.Blink = NULL;#endif
_cRef = 1; _fInCache = FALSE; _ServerName = lpszHostName; ZeroMemory(&_CertInfo, sizeof(_CertInfo)); _dwSecurityFlags = 0; _pCertContextArray = NULL; _fForceNewSession = FALSE; _fValidateAll = FALSE;
#if INET_DEBUG
m_Signature = 0x454c4353; // 'SCLE'
#endif
DEBUG_LEAVE(0);}
SECURITY_CACHE_LIST_ENTRY::~SECURITY_CACHE_LIST_ENTRY()
/*++
Routine Description:
SECURITY_CACHE_LIST_ENTRY destructor.
Arguments:
None.
Return Value:
None.
--*/
{ DEBUG_ENTER((DBG_OBJECTS, None, "~SECURITY_CACHE_LIST_ENTRY", "{%#x [%q]}", this, _ServerName.StringAddress() ));
INET_ASSERT((_List.Flink == NULL) && (_List.Blink == NULL));
Clear();
DEBUG_LEAVE(0);}
LONGSECURITY_CACHE_LIST_ENTRY::AddRef( VOID )
/*++
Routine Description:
Increment reference count of SECURITY_CACHE_LIST_ENTRY
Arguments:
None.
Return Value:
LONG - reference count after increment
--*/
{ DEBUG_ENTER((DBG_OBJECTS, Int, "SECURITY_CACHE_LIST_ENTRY::AddRef", "{%#x [%q, %d]}", this, _ServerName.StringAddress(), _cRef ));
InterlockedIncrement(&_cRef);
DEBUG_LEAVE(_cRef);
return _cRef;}
LONGSECURITY_CACHE_LIST_ENTRY::Release( VOID )
/*++
Routine Description:
Decrement reference count and destroy object if (<=) zero
Arguments:
None.
Return Value:
LONG - reference count after decrement
--*/
{ DEBUG_ENTER((DBG_OBJECTS, Int, "SECURITY_CACHE_LIST_ENTRY::Release", "{%q [%d]}", _ServerName.StringAddress(), _cRef ));
LONG cRet;
if (0 >= (cRet = InterlockedDecrement(&_cRef))) { delete this; }
DEBUG_LEAVE(cRet);
return cRet;}
VOIDSECURITY_CACHE_LIST_ENTRY::Clear()
/*++
Routine Description:
Clear out SECURITY_CACHE_LIST_ENTRY
Arguments:
Clear -
Return Value:
None.
--*/
{ if (_CertInfo.pCertificate != NULL) { __try { CertFreeCertificateContext(_CertInfo.pCertificate); } __except(EXCEPTION_EXECUTE_HANDLER) { } ENDEXCEPT _CertInfo.pCertificate = NULL; }
ZeroMemory(&_CertInfo, sizeof(_CertInfo)); _CertInfo.dwSize = sizeof(_CertInfo);
_dwSecurityFlags = 0; _ServerName = NULL; _pCertContextArray = NULL; if( _pCertContextArray ) { delete _pCertContextArray; _pCertContextArray = NULL; }}
//
// SECURITY_CACHE_LIST member functions
//
VOIDSECURITY_CACHE_LIST::ClearList( VOID )
/*++
Routine Description:
description-of-function.
Arguments:
None.
Return Value:
None.
--*/
{ DEBUG_ENTER((DBG_OBJECTS, None, "SECURITY_CACHE_LIST::ClearList", NULL ));
LockSerializedList(&_List);
while (!IsSerializedListEmpty(&_List)) {
SECURITY_CACHE_LIST_ENTRY * CacheEntry;
//
// remove the PROXY_SERVER_LIST_ENTRY at the head of the serialized
// list
//
LPVOID entry = SlDequeueHead(&_List);
//
// entry should not be NULL - IsSerializedListEmpty() told us we
// could expect something
//
INET_ASSERT(entry != NULL);
//
// get the address of the object (should be the same as entry) and
// delete it
//
CacheEntry = CONTAINING_RECORD(entry, SECURITY_CACHE_LIST_ENTRY, _List);
DEBUG_PRINT(OBJECTS, INFO, ("releasing %q (%d)\n", CacheEntry->_ServerName.StringAddress(), CacheEntry->_cRef ));
CacheEntry->Release(); }
UnlockSerializedList(&_List);
DEBUG_LEAVE(0);}
DWORDSECURITY_CACHE_LIST::Add( IN SECURITY_CACHE_LIST_ENTRY * entry )
/*++
Routine Description:
Adds a CertInfo Structure to the list front of the list.
Arguments:
lpszHost - Hostname to add.
Return Value:
DWORD Success - ERROR_SUCCESS
Failure - ERROR_NOT_ENOUGH_MEMORY
--*/
{ DEBUG_ENTER((DBG_HTTP, Dword, "SECURITY_CACHE_LIST::Add", "%#x [%q, %d]", entry, entry ? entry->_ServerName.StringAddress() : "", entry ? entry->_cRef : 0 ));
DWORD error = ERROR_SUCCESS;
INET_ASSERT(entry != NULL);
if (entry != NULL) { LockSerializedList(&_List);
//
// If we've grown too much, nuke the oldest one.
//
if (ElementsOnSerializedList(&_List) >= MAX_CERT_CACHE_CERTS) {
SECURITY_CACHE_LIST_ENTRY *pOld; LPVOID old_entry = SlDequeueTail(&_List);
INET_ASSERT(old_entry != NULL);
pOld = CONTAINING_RECORD(old_entry, SECURITY_CACHE_LIST_ENTRY, _List);
//
// entry should not be NULL - IsSerializedListEmpty() told us we
// could expect something
//
pOld->_fInCache = FALSE;
//
// Clean Our old object, and reinstatiate with a new name.
//
pOld->Release(); } InsertAtHeadOfSerializedList(&_List, &entry->_List); entry->AddRef(); entry->_fInCache = TRUE; UnlockSerializedList(&_List); }
DEBUG_LEAVE(error);
return error;}
SECURITY_CACHE_LIST_ENTRY *SECURITY_CACHE_LIST::Find( IN LPSTR lpszHost )
/*++
Routine Description:
Searches the linked list for the Cert, and returns the found entry, or NULL if not found.
Arguments:
lpszHost - Hostname to search on.
Return Value:
CERT_CACHE_LIST_ENTRY * Success - Pointer to found entry.
Failure - NULL, not found.
--*/
{ DEBUG_ENTER((DBG_HTTP, Pointer, "SECURITY_CACHE_LIST::Find", "%q", lpszHost ));
SECURITY_CACHE_LIST_ENTRY * info = NULL;
//
// BUGBUG need to validate against Server Certifcate on every
// connection, this Find only validates by Hostname.
// What about DNS spoofing? Won't we be hosed?
//
//
// TODO if found, need to push to front of list.
//
LockSerializedList(&_List); for (PLIST_ENTRY entry = HeadOfSerializedList(&_List); entry != (PLIST_ENTRY)SlSelf(&_List); entry = entry->Flink) { info = CONTAINING_RECORD(entry, SECURITY_CACHE_LIST_ENTRY, _List);
//
// check to see if they match.
//
if (info->_ServerName.Stricmp(lpszHost) == 0) { info->AddRef(); break; // match.
} info = NULL; } UnlockSerializedList(&_List);
DEBUG_LEAVE(info);
return info;}
VOIDSECURITY_CACHE_LIST::Remove( IN LPSTR lpszHost )
/*++
Routine Description:
Searches the linked list for the Cert, and removes the entry.
Arguments:
lpszHost - Hostname to search on.
Return Value:
None
--*/
{ DEBUG_ENTER((DBG_HTTP, Pointer, "SECURITY_CACHE_LIST::Remove", "%q", lpszHost ));
SECURITY_CACHE_LIST_ENTRY * info = NULL;
LockSerializedList(&_List); for (PLIST_ENTRY entry = HeadOfSerializedList(&_List); entry != (PLIST_ENTRY)SlSelf(&_List); entry = entry->Flink) { info = CONTAINING_RECORD(entry, SECURITY_CACHE_LIST_ENTRY, _List);
//
// check to see if they match.
//
if (info->_ServerName.Stricmp(lpszHost) == 0) { RemoveFromSerializedList(&_List, entry); break; // match.
} info->_fInCache = FALSE; info = NULL; } UnlockSerializedList(&_List);
DEBUG_LEAVE(0);
}
VOIDSECURITY_CACHE_LIST::ClearClientAuthCertChains( VOID )/*++
Routine Description:
This function walks the cache and releases any client auth chains associated with each entry. This method is called in response to the "Clear SSL State" button being pressed in inetcpl. Starting with Whistler, client certificates are cached for the logon session, rather than the process.
Arguments:
None.
Return Value:
None.
--*/{ DEBUG_ENTER((DBG_HTTP, None, "SECURITY_CACHE_LIST::ClearClientAuthCertChains", NULL ));
SECURITY_CACHE_LIST_ENTRY * pInfo = NULL;
LockSerializedList(&_List); for (PLIST_ENTRY entry = HeadOfSerializedList(&_List); entry != (PLIST_ENTRY)SlSelf(&_List); entry = entry->Flink) { pInfo = CONTAINING_RECORD(entry, SECURITY_CACHE_LIST_ENTRY, _List);
// This will delete and NULL the array
pInfo->SetCertContextArray(NULL);
// Ensure new session is negotiated for next SSL connection to server
pInfo->SetForceNewSession(TRUE); } UnlockSerializedList(&_List);
DEBUG_LEAVE(0);}
|
