windows-server-2003/inetsrv/iis/svcs/irtl/iiscrypt/lib/blob.c

/*++

Copyright (c) 1997 Microsoft Corporation

Module Name:

    blob.c

Abstract:

    Generic blob manipulators for the IIS cryptographic package.

    The following routines are exported by this module:

        IISCryptoReadBlobFromRegistry
        IISCryptoWriteBlobToRegistry
        IISCryptoIsValidBlob
        IISCryptoFreeBlob
        IISCryptoCompareBlobs
        IISCryptoCloneBlobFromRawData
        IISCryptoCreateCleartextBlob
        IcpCreateBlob

Author:

    Keith Moore (keithmo)        02-Dec-1996

Revision History:

--*/


#include "precomp.h"
#pragma hdrstop


//
// Private constants.
//


//
// Private types.
//


//
// Private globals.
//


//
// Private prototypes.
//


//
// Public functions.
//


HRESULT
WINAPI
IISCryptoReadBlobFromRegistry(
    OUT PIIS_CRYPTO_BLOB * ppBlob,
    IN HKEY hRegistryKey,
    IN LPCTSTR pszRegistryValueName
    )

/*++

Routine Description:

    This routine creates a new blob, reading the blob out of the
    registry.

Arguments:

    ppBlob - Receives a pointer to the newly created blob if successful.

    hRegistryKey - An open handle to a registry key.

    pszRegistryValueName - The name of the REG_BINARY registry value
        containing the blob.

Return Value:

    HRESULT - Completion status, 0 if successful, !0 otherwise.

--*/

{

    HRESULT result;
    PIIS_CRYPTO_BLOB blob;
    long status;
    DWORD type;
    long length;

    //
    // Sanity check.
    //

    DBG_ASSERT( IcpGlobals.Initialized );
    DBG_ASSERT( ppBlob != NULL );
    DBG_ASSERT( hRegistryKey != NULL );
    DBG_ASSERT( pszRegistryValueName != NULL );

    //
    // Setup our locals so we know how to cleanup on exit.
    //

    blob = NULL;

    //
    // Determine the size of the blob.
    //

    length = 0;

    status = RegQueryValueEx(
                 hRegistryKey,
                 pszRegistryValueName,
                 NULL,
                 &type,
                 NULL,
                 ( LPDWORD )&length
                 );

    if( status != NO_ERROR ) {
        result = RETURNCODETOHRESULT(status);
        goto fatal;
    }

    //
    // Allocate a new blob.
    //

    blob = IcpAllocMemory( length );

    if( blob == NULL ) {
        result = HRESULT_FROM_WIN32( ERROR_NOT_ENOUGH_MEMORY );
        goto fatal;
    }

    //
    // Read the blob.
    //

    status = RegQueryValueEx(
                 hRegistryKey,
                 pszRegistryValueName,
                 NULL,
                 &type,
                 (LPBYTE)blob,
                 ( LPDWORD )&length
                 );

    if( status != NO_ERROR ) {
        result = RETURNCODETOHRESULT(status);
        goto fatal;
    }

    //
    // Validate the blob.
    //

    if( !IISCryptoIsValidBlob( blob ) ) {
        result = HRESULT_FROM_WIN32( ERROR_INVALID_PARAMETER );
        goto fatal;
    }

    //
    // Success!
    //

    *ppBlob = blob;

    UpdateBlobsCreated();
    return NO_ERROR;

fatal:

    if( blob != NULL ) {
        IcpFreeMemory( blob );
    }

    DBG_ASSERT( FAILED(result) );
    return result;

}   // IISCryptoReadBlobFromRegistry


HRESULT
WINAPI
IISCryptoWriteBlobToRegistry(
    IN PIIS_CRYPTO_BLOB pBlob,
    IN HKEY hRegistryKey,
    IN LPCTSTR pszRegistryValueName
    )

/*++

Routine Description:

    This routine writes the given blob to the given registry location.

Arguments:

    pBlob - A pointer to the blob to write.

    hRegistryKey - An open handle to a registry key.

    pszRegistryValueName - The name of the REG_BINARY registry value
        that will receive the blob.

Return Value:

    HRESULT - Completion status, 0 if successful, !0 otherwise.

--*/

{

    long status;

    //
    // Sanity check.
    //

    DBG_ASSERT( IcpGlobals.Initialized );
    DBG_ASSERT( pBlob != NULL );
    DBG_ASSERT( IISCryptoIsValidBlob( pBlob ) );
    DBG_ASSERT( hRegistryKey != NULL );
    DBG_ASSERT( pszRegistryValueName != NULL );

    //
    // Write the blob.
    //

    status = RegSetValueEx(
                 hRegistryKey,
                 pszRegistryValueName,
                 0,
                 REG_BINARY,
                 (LPBYTE)pBlob,
                 IISCryptoGetBlobLength( pBlob )
                 );

    return RETURNCODETOHRESULT(status);

}   // IISCryptoWriteBlobToRegistry


BOOL
WINAPI
IISCryptoIsValidBlob(
    IN PIIS_CRYPTO_BLOB pBlob
    )

/*++

Routine Description:

    This routine determines if the specified blob is indeed a valid
    blob.

Arguments:

    pBlob - The blob to validate.

Return Value:

    BOOL - TRUE if the blob is valid, FALSE otherwise.

--*/

{

    PIC_BLOB blob;
    BOOL result;

    //
    // Sanity check.
    //

    DBG_ASSERT( IcpGlobals.Initialized );
    DBG_ASSERT( pBlob != NULL );

    //
    // Validate the signature.
    //

    blob = (PIC_BLOB)pBlob;

    switch( blob->Header.BlobSignature ) {

    case KEY_BLOB_SIGNATURE :
    case PUBLIC_KEY_BLOB_SIGNATURE :
    case DATA_BLOB_SIGNATURE :
    case HASH_BLOB_SIGNATURE :
    case CLEARTEXT_BLOB_SIGNATURE :
        result = TRUE;
        break;

    default :
        result = FALSE;
        break;

    }

    if( result &&
        blob->Header.BlobSignature != CLEARTEXT_BLOB_SIGNATURE ) {

        //
        // Validate some of the blob internal structure. Note that we
        // don't validate the internal structure of the cleartext blobs,
        // as they do not conform to the normal IC_BLOB structure.
        //

        if( blob->DataLength == 0 ||
            blob->Header.BlobDataLength !=
                CALC_BLOB_DATA_LENGTH( blob->DataLength, blob->SignatureLength ) ) {

            result = FALSE;

        }

    }

    return result;

}   // IISCryptoIsValidBlob

BOOL
WINAPI
IISCryptoIsValidBlob2(
    IN PIIS_CRYPTO_BLOB pBlob
    )

/*++

Routine Description:

    This routine determines if the specified blob is indeed a valid
    blob.

Arguments:

    pBlob - The blob to validate.

Return Value:

    BOOL - TRUE if the blob is valid, FALSE otherwise.

--*/

{

    PIC_BLOB2 blob;
    BOOL      result;

    //
    // Sanity check.
    //

    DBG_ASSERT( IcpGlobals.Initialized );
    DBG_ASSERT( pBlob != NULL );

    //
    // Validate the signature.
    //

    blob = (PIC_BLOB2)pBlob;

    switch( blob->Header.BlobSignature ) {

    case SALT_BLOB_SIGNATURE :
        result = TRUE;
        break;

    default :
        result = FALSE;
        break;

    }

    if( result ) {

        //
        // Validate some of the blob internal structure. Note that we
        // don't validate the internal structure of the cleartext blobs,
        // as they do not conform to the normal IC_BLOB structure.
        //

        if( blob->DataLength == 0 ||
            blob->Header.BlobDataLength !=
                CALC_BLOB_DATA_LENGTH2( blob->DataLength, blob->SaltLength ) ) {

            result = FALSE;

        }

    }

    return result;

}   // IISCryptoIsValidBlob2


HRESULT
WINAPI
IISCryptoFreeBlob(
    IN PIIS_CRYPTO_BLOB pBlob
    )

/*++

Routine Description:

    This routine frees all resources associated with the given blob.
    After this routine completes, the blob is unusable.

Arguments:

    pBlob - The blob to free.

Return Value:

    HRESULT - Completion status, 0 if successful, !0 otherwise.

--*/

{

    //
    // Sanity check.
    //

    DBG_ASSERT( IcpGlobals.Initialized );
    DBG_ASSERT( pBlob != NULL );
    DBG_ASSERT( IISCryptoIsValidBlob( pBlob ) );

    //
    // Corrupt the structure signature before freeing the blob.
    //

    *(PCHAR)(&pBlob->BlobSignature) = 'X';

    //
    // Free the resources.
    //

    IcpFreeMemory( pBlob );

    //
    // Success!
    //

    UpdateBlobsFreed();
    return NO_ERROR;

}   // IISCryptoFreeBlob

HRESULT
WINAPI
IISCryptoFreeBlob2(
    IN PIIS_CRYPTO_BLOB pBlob
    )

/*++

Routine Description:

    This routine frees all resources associated with the given blob.
    After this routine completes, the blob is unusable.

Arguments:

    pBlob - The blob to free.

Return Value:

    HRESULT - Completion status, 0 if successful, !0 otherwise.

--*/

{

    //
    // Sanity check.
    //

    DBG_ASSERT( IcpGlobals.Initialized );
    DBG_ASSERT( pBlob != NULL );
    DBG_ASSERT( IISCryptoIsValidBlob2( pBlob ) );

    //
    // Corrupt the structure signature before freeing the blob.
    //

    *(PCHAR)(&pBlob->BlobSignature) = 'X';

    //
    // Free the resources.
    //

    IcpFreeMemory( pBlob );

    //
    // Success!
    //

    UpdateBlobsFreed();
    return NO_ERROR;

}   // IISCryptoFreeBlob2


BOOL
WINAPI
IISCryptoCompareBlobs(
    IN PIIS_CRYPTO_BLOB pBlob1,
    IN PIIS_CRYPTO_BLOB pBlob2
    )

/*++

Routine Description:

    This routine compares two blobs to determine if they are identical.

Arguments:

    pBlob1 - Pointer to a blob.

    pBlob2 - Pointer to another blob.

Return Value:

    BOOL - TRUE if the blobs match, FALSE otherwise, or if the blobs
        are invalid.

--*/

{

    //
    // Sanity check.
    //

    DBG_ASSERT( IcpGlobals.Initialized );
    DBG_ASSERT( pBlob1 != NULL );
    DBG_ASSERT( pBlob2 != NULL );
    DBG_ASSERT( IISCryptoIsValidBlob( pBlob1 ) );
    DBG_ASSERT( IISCryptoIsValidBlob( pBlob2 ) );

    //
    // Just do a straight memory compare of the two blobs.
    //

    if( memcmp( pBlob1, pBlob2, sizeof(*pBlob1) ) == 0 ) {
        return TRUE;
    }

    //
    // No match.
    //

    return FALSE;

}   // IISCryptoCompareBlobs


HRESULT
WINAPI
IISCryptoCloneBlobFromRawData(
    OUT PIIS_CRYPTO_BLOB * ppBlob,
    IN PBYTE pRawBlob,
    IN DWORD dwRawBlobLength
    )

/*++

Routine Description:

    This routine makes a copy of a blob from raw data. The raw data
    buffer may be unaligned.

Arguments:

    ppBlob - Receives a pointer to the newly created blob if successful.

    pRawBlob - Pointer to the raw blob data.

    dwRawBlobLength - Length of the raw blob data.

Return Value:

    HRESULT - Completion status, 0 if successful, !0 otherwise.

--*/

{

    PIIS_CRYPTO_BLOB newBlob;
    IIS_CRYPTO_BLOB UNALIGNED *unalignedBlob;
    DWORD blobLength;

    //
    // Sanity check.
    //

    DBG_ASSERT( ppBlob != NULL );
    DBG_ASSERT( pRawBlob != NULL );

    //
    // Allocate space for the new blob.
    //

    unalignedBlob = (IIS_CRYPTO_BLOB UNALIGNED *)pRawBlob;
    blobLength = IISCryptoGetBlobLength( unalignedBlob );

    if( blobLength != dwRawBlobLength ) {
        return HRESULT_FROM_WIN32( ERROR_INVALID_DATA );
    }

    newBlob = IcpAllocMemory( blobLength );
    if( newBlob != NULL ) {

        //
        // Clone it. The (PCHAR) casts are necessary to force the compiler
        // to copy BYTE-wise.
        //

        RtlCopyMemory(
            (PCHAR)newBlob,
            (PCHAR)unalignedBlob,
            blobLength
            );

        //
        // Validate its contents.
        //

        if( IISCryptoIsValidBlob( newBlob ) ) {

            *ppBlob = newBlob;

            UpdateBlobsCreated();
            return NO_ERROR;

        }

        IcpFreeMemory( newBlob );
        return HRESULT_FROM_WIN32( ERROR_INVALID_DATA );

    }

    return HRESULT_FROM_WIN32( ERROR_NOT_ENOUGH_MEMORY );

}   // IISCryptoCloneBlobFromRawData

HRESULT
WINAPI
IISCryptoCloneBlobFromRawData2(
    OUT PIIS_CRYPTO_BLOB * ppBlob,
    IN PBYTE pRawBlob,
    IN DWORD dwRawBlobLength
    )

/*++

Routine Description:

    This routine makes a copy of a blob from raw data. The raw data
    buffer may be unaligned.

Arguments:

    ppBlob - Receives a pointer to the newly created blob if successful.

    pRawBlob - Pointer to the raw blob data.

    dwRawBlobLength - Length of the raw blob data.

Return Value:

    HRESULT - Completion status, 0 if successful, !0 otherwise.

--*/

{

    PIIS_CRYPTO_BLOB newBlob;
    IIS_CRYPTO_BLOB UNALIGNED *unalignedBlob;
    DWORD blobLength;

    //
    // Sanity check.
    //

    DBG_ASSERT( ppBlob != NULL );
    DBG_ASSERT( pRawBlob != NULL );

    //
    // Allocate space for the new blob.
    //

    unalignedBlob = (IIS_CRYPTO_BLOB UNALIGNED *)pRawBlob;
    blobLength = IISCryptoGetBlobLength( unalignedBlob );

    if( blobLength != dwRawBlobLength ) {
        return HRESULT_FROM_WIN32( ERROR_INVALID_DATA );
    }

    newBlob = IcpAllocMemory( blobLength );
    if( newBlob != NULL ) {

        //
        // Clone it. The (PCHAR) casts are necessary to force the compiler
        // to copy BYTE-wise.
        //

        RtlCopyMemory(
            (PCHAR)newBlob,
            (PCHAR)unalignedBlob,
            blobLength
            );

        //
        // Validate its contents.
        //

        if( IISCryptoIsValidBlob2( newBlob ) ) {

            *ppBlob = newBlob;

            UpdateBlobsCreated();
            return NO_ERROR;

        }

        IcpFreeMemory( newBlob );
        return HRESULT_FROM_WIN32( ERROR_INVALID_DATA );

    }

    return HRESULT_FROM_WIN32( ERROR_NOT_ENOUGH_MEMORY );

}   // IISCryptoCloneBlobFromRawData2


HRESULT
WINAPI
IISCryptoCreateCleartextBlob(
    OUT PIIS_CRYPTO_BLOB * ppBlob,
    IN PBYTE pBlobData,
    IN DWORD dwBlobDataLength
    )

/*++

Routine Description:

    This routine creates a cleartext blob containing the specified
    data.

Arguments:

    ppBlob - Receives a pointer to the newly created blob if successful.

    pBlobData - Pointer to the blob data.

    dwBlobDataLength - Length of the blob data.

Return Value:

    HRESULT - Completion status, 0 if successful, !0 otherwise.

--*/

{

    PIIS_CRYPTO_BLOB blob;

    //
    // Sanity check.
    //

    DBG_ASSERT( ppBlob != NULL );
    DBG_ASSERT( pBlobData != NULL );

    //
    // Allocate space for the new blob.
    //

    blob = IcpAllocMemory( dwBlobDataLength + sizeof(*blob) );

    if( blob != NULL ) {

        //
        // Initialize the blob.
        //

        blob->BlobSignature = CLEARTEXT_BLOB_SIGNATURE;
        blob->BlobDataLength = dwBlobDataLength;

        RtlCopyMemory(
            blob + 1,
            pBlobData,
            dwBlobDataLength
            );

        *ppBlob = blob;

        UpdateBlobsCreated();
        return NO_ERROR;

    }

    return HRESULT_FROM_WIN32( ERROR_NOT_ENOUGH_MEMORY );

}   // IISCryptoCreateCleartextBlob


PIC_BLOB
IcpCreateBlob(
    IN DWORD dwBlobSignature,
    IN DWORD dwDataLength,
    IN DWORD dwSignatureLength OPTIONAL
    )

/*++

Routine Description:

    This routine creates a new blob.

Arguments:

    dwBlobSignature - The structure signature for the new blob.

    dwDataLength - The data length for the blob.

    dwSignatureLength - The length of the digital signature, 0 if
        there is no signature for this blob. This value cannot be
        CLEARTEXT_BLOB_SIGNATURE; cleartext blobs are "special".

Return Value:

    PIC_BLOB - Pointer to the newly created blob if successful,
        NULL otherwise.

--*/

{

    PIC_BLOB blob;
    DWORD blobDataLength;

    //
    // Sanity check.
    //

    DBG_ASSERT( dwBlobSignature == KEY_BLOB_SIGNATURE ||
                dwBlobSignature == PUBLIC_KEY_BLOB_SIGNATURE ||
                dwBlobSignature == DATA_BLOB_SIGNATURE ||
                dwBlobSignature == HASH_BLOB_SIGNATURE );

    //
    // Allocate storage for the blob.
    //

    blobDataLength = CALC_BLOB_DATA_LENGTH( dwDataLength, dwSignatureLength );
    blob = IcpAllocMemory( blobDataLength + sizeof(IIS_CRYPTO_BLOB) );

    if( blob != NULL ) {

        //
        // Initialize the blob.
        //

        blob->Header.BlobSignature = dwBlobSignature;
        blob->Header.BlobDataLength = blobDataLength;

        blob->DataLength = dwDataLength;
        blob->SignatureLength = dwSignatureLength;

    }

    return blob;

}   // IcpCreateBlob

PIC_BLOB2
IcpCreateBlob2(
    IN DWORD dwBlobSignature,
    IN DWORD dwDataLength,
    IN DWORD dwSaltLength OPTIONAL
    )

/*++

Routine Description:

    This routine creates a new blob.

Arguments:

    dwBlobSignature - The structure signature for the new blob.

    dwDataLength - The data length for the blob.

    dwSaltLength - The length of the random salt

Return Value:

    PIC_BLOB2 - Pointer to the newly created blob if successful,
        NULL otherwise.

--*/

{

    PIC_BLOB2 blob;
    DWORD blobDataLength;

    //
    // Sanity check.
    //

    DBG_ASSERT( dwBlobSignature == SALT_BLOB_SIGNATURE );

    //
    // Allocate storage for the blob.
    //

    blobDataLength = CALC_BLOB_DATA_LENGTH( dwDataLength, dwSaltLength );
    blob = IcpAllocMemory( blobDataLength + sizeof(IIS_CRYPTO_BLOB) );

    if( blob != NULL ) {

        //
        // Initialize the blob.
        //

        blob->Header.BlobSignature = dwBlobSignature;
        blob->Header.BlobDataLength = blobDataLength;

        blob->DataLength = dwDataLength;
        blob->SaltLength = dwSaltLength;

    }

    return blob;

}   // IcpCreateBlob2


//
// Private functions.
//