//+---------------------------------------------------------------------------
/////////////////////////////////////////////////////////////////////////////////
//
//  Microsoft Windows
//  Copyright (C) Microsoft Corporation, 1997-2002.
//
//  File:       ComponentDataRSOP.cpp
//
//  Contents:   Implementation of RSOP portions CCertMgrComponentData
//
//----------------------------------------------------------------------------

#include "stdafx.h"

#include <gpedit.h>
#include "compdata.h"
#include "dataobj.h"
#include "cookie.h"
#include "Certifct.h"
#pragma warning(push, 3)
#include <wintrust.h>
#include <cryptui.h>
#include <sceattch.h>
#pragma warning(pop)
#include "StoreRSOP.h"

#ifdef _DEBUG
#ifndef ALPHA
#define new DEBUG_NEW
#endif
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif


//
// CCertMgrComponentData
//


HRESULT CCertMgrComponentData::BuildWMIList (LPDATAOBJECT pDataObject, bool bIsComputer)
{
    _TRACE (1, L"Entering CCertMgrComponentData::BuildWMIList (%s)\n", bIsComputer ? L"computer" : L"user");
    HRESULT hr = S_OK;

#if DBG
    if ( bIsComputer )
    {
        _TRACE (0, L"m_rsopObjectArrayComputer contains %d objects\n", 
                m_rsopObjectArrayComputer.GetUpperBound ());
    }
    else
    {
        _TRACE (0, L"m_rsopObjectArrayUser contains %d objects\n", 
                m_rsopObjectArrayUser.GetUpperBound ());
    }
#endif
    int     nIndex = 0;
    if ( bIsComputer )
    {
        INT_PTR nUpperBound = m_rsopObjectArrayComputer.GetUpperBound ();
        while ( nUpperBound >= nIndex )
        {
            CRSOPObject* pCurrObject = m_rsopObjectArrayComputer.GetAt (nIndex);
            if ( pCurrObject )
            {
                delete pCurrObject;
            }
            nIndex++;
        }
        m_rsopObjectArrayComputer.RemoveAll ();
    }
    else
    {
        INT_PTR nUpperBound = m_rsopObjectArrayUser.GetUpperBound ();
        while ( nUpperBound >= nIndex )
        {
            CRSOPObject* pCurrObject = m_rsopObjectArrayUser.GetAt (nIndex);
            if ( pCurrObject )
            {
                delete pCurrObject;
            }
            nIndex++;
        }
        m_rsopObjectArrayUser.RemoveAll ();
    }

    if ( ((bIsComputer && !m_pRSOPInformationComputer) || 
                (!bIsComputer && !m_pRSOPInformationUser) ) 
            && pDataObject )
    {
	    IUnknown* pIUnknown = 0;

	    hr = ExtractData (pDataObject,
		    CCertMgrDataObject::m_CFSCE_RSOPUnknown,
		    &pIUnknown, sizeof (IUnknown*));
	    ASSERT (SUCCEEDED (hr));
	    if ( SUCCEEDED (hr) )
	    {
            if ( bIsComputer )
            {
		        hr = pIUnknown->QueryInterface (
				        IID_PPV_ARG (IRSOPInformation, &m_pRSOPInformationComputer));
            }
            else
            {
		        hr = pIUnknown->QueryInterface (
				        IID_PPV_ARG (IRSOPInformation, &m_pRSOPInformationUser));
            }
		    ASSERT (SUCCEEDED (hr));
            if ( SUCCEEDED (hr) )
            {
                if ( bIsComputer )
                {
                    hr = m_pRSOPInformationComputer->GetFlags (&m_dwRSOPFlagsComputer);
                }
                else
                {
                     hr = m_pRSOPInformationUser->GetFlags (&m_dwRSOPFlagsUser);
                }
                ASSERT (SUCCEEDED (hr));

                int cchMaxLength = 512;
                LPOLESTR    pszNameSpace = (LPOLESTR) LocalAlloc (LPTR, cchMaxLength * sizeof (WCHAR));
                if ( pszNameSpace )
                {
                    DWORD   dwSection = 0;

                    switch (m_dwSCEMode)
                    {
                    case SCE_MODE_LOCAL_USER:
                    case SCE_MODE_DOMAIN_USER:
                    case SCE_MODE_OU_USER:
                    case SCE_MODE_REMOTE_USER:
                    case SCE_MODE_RSOP_USER:
                        dwSection = GPO_SECTION_USER;
                        break;

                    case SCE_MODE_LOCAL_COMPUTER:
                    case SCE_MODE_DOMAIN_COMPUTER:
                    case SCE_MODE_OU_COMPUTER:
                    case SCE_MODE_RSOP_COMPUTER:
                    case SCE_MODE_REMOTE_COMPUTER:
                        dwSection = GPO_SECTION_MACHINE;
                        break;

                    default:
                        ASSERT (0);
                        return E_UNEXPECTED;
                    }
                    if ( bIsComputer )
                    {
                        hr = m_pRSOPInformationComputer->GetNamespace (
                                dwSection, 
                                pszNameSpace,
                                cchMaxLength);
                    }
                    else
                    {
                        hr = m_pRSOPInformationUser->GetNamespace (
                                dwSection, 
                                pszNameSpace,
                                cchMaxLength);
                    }
                    if ( SUCCEEDED (hr) )
                    {
                        IWbemLocator *pIWbemLocator = 0;
                        // ISSUE
                        // NTRAID 544154 TRACKING:  PKP GrpPol:  Verify that WMI communication with the store can be secured
                        hr = ::CoCreateInstance (CLSID_WbemLocator, 
                                NULL,
                                CLSCTX_INPROC_SERVER,
                                IID_PPV_ARG(IWbemLocator, &pIWbemLocator));
                        if ( SUCCEEDED (hr) )
                        {
                            BSTR    bstrNameSpace = SysAllocString (pszNameSpace);
                            if ( bstrNameSpace )
                            {
                                if ( bIsComputer )
                                {
                                    hr = pIWbemLocator->ConnectServer (bstrNameSpace,
                                            NULL, NULL, 0, 0, NULL, NULL,
                                            &m_pIWbemServicesComputer);
                                }
                                else
                                {
                                    hr = pIWbemLocator->ConnectServer (bstrNameSpace,
                                            NULL, NULL, 0, 0, NULL, NULL,
                                            &m_pIWbemServicesUser);
                                }
					            if ( FAILED (hr) )
					            {
						            _TRACE (0, L"IWbemLocator::ConnectServer (%s) failed: 0x%x(%s)\n", 
								            bstrNameSpace, hr, (PCWSTR) GetSystemMessage (hr));
					            }
                                SysFreeString (bstrNameSpace);
                            }
				            else
					            hr = E_OUTOFMEMORY;
				            pIWbemLocator->Release ();
                        }
                    }
                    LocalFree (pszNameSpace);
                }
                else
                    hr = E_OUTOFMEMORY;
            }
	    }
    }

    if ( SUCCEEDED (hr) && ((bIsComputer && m_pIWbemServicesComputer) || 
            (!bIsComputer && m_pIWbemServicesUser)) )
    {
        IEnumWbemClassObject * pEnum = 0;
        IWbemClassObject *pObject = 0;
        ULONG   ulRet = 0;


        //
        // Execute the query
        //
        if ( bIsComputer )
        {
            hr = m_pIWbemServicesComputer->ExecQuery (m_pbstrLanguage, m_pbstrQuery, 
                    WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, 
                    NULL, &pEnum);
        }
        else
        {
            hr = m_pIWbemServicesUser->ExecQuery (m_pbstrLanguage, m_pbstrQuery, 
                    WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, 
                    NULL, &pEnum);
        }
        if ( SUCCEEDED (hr) )
        {
            //
            // Loop through the results retrieving the registry key and value names
            //
            while ( (hr = pEnum->Next(WBEM_INFINITE, 1, &pObject, &ulRet)) == WBEM_S_NO_ERROR )
            {
                hr = GetValuesAndInsertInRSOPObjectList (pObject, 
                        bIsComputer ? m_rsopObjectArrayComputer : m_rsopObjectArrayUser,
                        bIsComputer);

                pObject->Release ();

                if ( FAILED (hr) )
                    break;
            }

            pEnum->Release();

#if DBG
            int     nSpewIndex = 0;
            INT_PTR nUpperBound = 0;
            
            if ( bIsComputer )
                nUpperBound = m_rsopObjectArrayComputer.GetUpperBound ();
            else
                nUpperBound = m_rsopObjectArrayUser.GetUpperBound ();

            while ( nUpperBound >= nSpewIndex )
            {
                CRSOPObject* pCurrObject = 0;
                if ( bIsComputer )
                    pCurrObject = m_rsopObjectArrayComputer.GetAt (nSpewIndex);
                else
                    pCurrObject = m_rsopObjectArrayUser.GetAt (nSpewIndex);
                if ( !pCurrObject )
                    break;
                _TRACE (0, L"\t%d\t%s\t%s\t%s\n", pCurrObject->GetPrecedence (), 
                        (PCWSTR) pCurrObject->GetRegistryKey (),
                        (PCWSTR) pCurrObject->GetValueName (),
                        (PCWSTR) pCurrObject->GetPolicyName ());
                nSpewIndex++;
            }
#endif
        }
    }

    _TRACE (-1, L"Leaving CCertMgrComponentData::BuildWMIList (): 0x%x\n", hr);
    return hr;
}

HRESULT CCertMgrComponentData::GetValuesAndInsertInRSOPObjectList (
           IWbemClassObject* pObject, 
           CRSOPObjectArray& rRsopObjectArray,
           bool bIsComputer)
{
    HRESULT         hr = S_OK;

    if ( !pObject )
        return E_POINTER;

    //
    // Check if the allocations succeeded
    //

    if ( m_pbstrLanguage && m_pbstrQuery && m_pbstrRegistryKey && 
            m_pbstrValueName && m_pbstrValue && 
            m_pbstrPrecedence && m_pbstrGPOid )
    {
        COleVariant varRegistryKey;
        COleVariant varValueName;
        COleVariant varValue;
        COleVariant varPrecedence;
        COleVariant varGPOid;
        hr = pObject->Get (m_pbstrRegistryKey, 0, &varRegistryKey, NULL, NULL);
        if (SUCCEEDED(hr))
        {
            hr = pObject->Get (m_pbstrValueName, 0, &varValueName, NULL, NULL);
            if (SUCCEEDED(hr))
            {
                hr = pObject->Get (m_pbstrValue, 0, &varValue, NULL, NULL);
                if (SUCCEEDED(hr))
                {
//#ifndef DBG
                    // only include objects that have a value name
                    if ( varValueName.bstrVal[0] )
//#endif
                    {
//#ifndef DBG
                        // Only include those objects that are in the system store registry 
                        // path or in the cryptography\autoenrollment path
                        if ( FoundInRSOPFilter (varRegistryKey.bstrVal) )
//#endif
                        {
                            hr = pObject->Get (m_pbstrPrecedence, 0, &varPrecedence, NULL, NULL);
                            if (SUCCEEDED(hr))
                            {
                                hr = pObject->Get (m_pbstrGPOid, 0, &varGPOid, NULL, NULL);
                                if (SUCCEEDED(hr))
                                {
                                    PWSTR lpGPOName = 0;

                                    hr = GetGPOFriendlyName ( 
                                                varGPOid.bstrVal,
                                                &lpGPOName,
                                                bIsComputer);

                                    if (SUCCEEDED(hr))
                                    {

                                        CRSOPObject* pRSOPObject = new CRSOPObject (
                                                varRegistryKey.bstrVal, 
                                                varValueName.bstrVal,
                                                lpGPOName,
                                                varPrecedence.uintVal,
                                                varValue,
                                                varGPOid.bstrVal);
                                        if ( pRSOPObject )
                                        {
                                            CRSOPObject*    pCurrObject = 0;
                                            int             nIndex = 0;
                                            bool            bInserted = false;
                                            INT_PTR         nUpperBound = rRsopObjectArray.GetUpperBound ();

                                            while ( nUpperBound >= nIndex )
                                            {
                                                pCurrObject = rRsopObjectArray.GetAt (nIndex);
                                                if ( !pCurrObject )
                                                    break;

                                                // Sort first by registry key name, 
                                                // then by value name, then by 
                                                // precedence
                                                // security review 2/22/2002 BryanWal ok
                                                int nCmpVal = wcscmp (pCurrObject->GetRegistryKey (),
                                                        pRSOPObject->GetRegistryKey ());
                                                if ( nCmpVal > 0 )
                                                {
                                                    rRsopObjectArray.InsertAt (nIndex, pRSOPObject);
                                                    bInserted = true;
                                                    break;
                                                }
                                                else if ( nCmpVal == 0 )
                                                {
                                                    // Sort by value name
                                                    // security review 2/22/2002 BryanWal ok
                                                    nCmpVal = wcscmp (pCurrObject->GetValueName (),
                                                            pRSOPObject->GetValueName ());
                                                    if ( nCmpVal > 0 )
                                                    {
                                                        rRsopObjectArray.InsertAt (nIndex, pRSOPObject);
                                                        bInserted = true;
                                                        break;
                                                    }
                                                    else if ( nCmpVal == 0 )
                                                    {
                                                        // Sort by precedence
                                                        if ( pCurrObject->GetPrecedence () >
                                                                pRSOPObject->GetPrecedence () )
                                                        {
                                                            rRsopObjectArray.InsertAt (nIndex, pRSOPObject);
                                                            bInserted = true;
                                                            break;
                                                        }
                                                        else if ( pCurrObject->GetPrecedence () ==
                                                                pRSOPObject->GetPrecedence () )
                                                        {
                                                            // The registry key, value name and precedence
                                                            // are the same - this is a duplicate. Pretend
                                                            // we've added it and move on.
                                                            bInserted = true;
                                                            break;
                                                        }
                                                    }
                                                }
                                                nIndex++;
                                            }
                                            if ( !bInserted )
                                                rRsopObjectArray.Add (pRSOPObject);
                                        }

                                        LocalFree (lpGPOName);
                                    }
                                    varGPOid.Clear ();
                                }

                                varPrecedence.Clear ();
                            }
                        }
                    }
                    varValue.Clear ();
                }

                varValueName.Clear ();
            }

            varRegistryKey.Clear ();
        }
    }
    else
        hr = E_OUTOFMEMORY;

    return hr;
}


HRESULT CCertMgrComponentData::GetGPOFriendlyName (PCWSTR pwszOID, PWSTR *ppwszGPOName, bool bIsComputer)
{
    ASSERT (pwszOID);
    if ( !pwszOID )
        return E_POINTER;

    ASSERT (ppwszGPOName);
    if ( !ppwszGPOName )
        return E_POINTER;


    HRESULT hr = S_OK;

    //
    // Set the default
    //

    *ppwszGPOName = NULL;


    //
    // Build the query
    //
    PCWSTR  pwszQueryFormat = L"SELECT name, id FROM RSOP_GPO where id=\"%s\"";
    // security review 2/22/2002 BryanWal ok
    PWSTR   pwszQuery = (PWSTR) ::LocalAlloc (LPTR, ((wcslen(pwszOID) + wcslen (pwszQueryFormat) + 1) * sizeof(WCHAR)));
    if ( pwszQuery )
    {
        // security review 2/22/2002 BryanWal ok
        wsprintf (pwszQuery, pwszQueryFormat, pwszOID);


        BSTR bstrQuery = SysAllocString (pwszQuery);
        if (bstrQuery)
        {
            //
            // Allocate BSTRs for the property names we want to retreive
            //

            BSTR bstrName = SysAllocString (TEXT("name"));
            if (bstrName)
            {
                //
                // Execute the query
                //

                IEnumWbemClassObject* pEnum = 0;
                if ( bIsComputer )
                {
                    hr = m_pIWbemServicesComputer->ExecQuery (m_pbstrLanguage, bstrQuery,
                            WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,
                            NULL, &pEnum);
                }
                else
                {
                    hr = m_pIWbemServicesUser->ExecQuery (m_pbstrLanguage, bstrQuery,
                            WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,
                            NULL, &pEnum);
                }


                if ( SUCCEEDED (hr) )
                {
                    //
                    // Loop through the results
                    //
                    IWbemClassObject*   pObjects[2] = {0, 0};
                    ULONG               ulRet = 0;
                    hr = pEnum->Next(WBEM_INFINITE, 1, pObjects, &ulRet);
                    if ( SUCCEEDED (hr) )
                    {
                        //
                        // Check for the "data not available case"
                        //

                        if (ulRet != 0)
                        {
                            //
                            // Get the name
                            //
                            VARIANT varGPOName;
                            hr = pObjects[0]->Get (bstrName, 0, &varGPOName, NULL, NULL);
                            if ( SUCCEEDED (hr) )
                            {
                                //
                                // Save the name
                                //

                                // security review 2/22/2002 BryanWal ok
                                *ppwszGPOName = (PWSTR) ::LocalAlloc (LPTR, (wcslen (varGPOName.bstrVal) + 1) * sizeof(WCHAR));

                                if ( *ppwszGPOName )
                                {
                                    // security review 2/22/2002 BryanWal ok
                                    wcscpy (*ppwszGPOName, varGPOName.bstrVal);

                                    VariantClear (&varGPOName);

                                    hr = S_OK;
                                }
                                else
                                {
                                    _TRACE (0, L"CCertMgrComponentData::GetGPOFriendlyName: Failed to allocate memory for GPO Name");
                                    hr = E_OUTOFMEMORY;
                                }
                            }
                            else
                            {
                                _TRACE (0, L"CCertMgrComponentData::GetGPOFriendlyName: Failed to get gponame in query results for %s with 0x%x\n",
                                          bstrQuery, hr);
                            }
                        }
                    }
                    else
                    {
                        _TRACE (0, L"CCertMgrComponentData::GetGPOFriendlyName: Failed to get first item in query results for %s with 0x%x\n",
                                  bstrQuery, hr);
                    }

                    pEnum->Release ();
                }
                else
                {
                    _TRACE (0, L"CCertMgrComponentData::GetGPOFriendlyName: Failed to query for %s with 0x%x\n",
                              bstrQuery, hr);
                }

                SysFreeString (bstrName);
            }
            else
            {
               _TRACE (0, L"CCertMgrComponentData::GetGPOFriendlyName: Failed to allocate memory for name");
                hr = HRESULT_FROM_WIN32(ERROR_OUTOFMEMORY);
            }

            SysFreeString (bstrQuery);
        }
        else
        {
            _TRACE (0, L"CCertMgrComponentData::GetGPOFriendlyName: Failed to allocate memory for query");
            hr = E_OUTOFMEMORY;
        }
        ::LocalFree (pwszQuery);
    }
    else
    {
        _TRACE (0, L"CCertMgrComponentData::GetGPOFriendlyName: Failed to allocate memory for unicode query");
        hr = E_OUTOFMEMORY;
    }

    return hr;
}




///////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////
bool CCertMgrPKPolExtension::FoundInRSOPFilter (BSTR bstrKey) const
{
    ASSERT (bstrKey);
    if ( !bstrKey )
        return false;

    // security review 2/22/2002 BryanWal ok for all
    static  size_t  nRegPathLen = wcslen (CERT_GROUP_POLICY_SYSTEM_STORE_REGPATH);
    static  size_t  nTrustedPublisherKeyLen = 
                wcslen (CERT_TRUST_PUB_SAFER_GROUP_POLICY_TRUSTED_PUBLISHER_STORE_REGPATH);
    static  size_t  nDisallowedKeyLen = 
                wcslen (CERT_TRUST_PUB_SAFER_GROUP_POLICY_DISALLOWED_STORE_REGPATH);
	static  size_t  nSaferKeyLen = wcslen (SAFER_HKLM_REGBASE);
    static  size_t  nEFSKeyLen = wcslen (EFS_SETTINGS_REGPATH);


    //Include group policy system stores but not trusted publisher or disallowed
    // security review 2/22/2002 BryanWal ok for all
    if ( !_wcsnicmp (CERT_GROUP_POLICY_SYSTEM_STORE_REGPATH, bstrKey, nRegPathLen) &&
				(_wcsnicmp (CERT_TRUST_PUB_SAFER_GROUP_POLICY_TRUSTED_PUBLISHER_STORE_REGPATH, 
						bstrKey, nTrustedPublisherKeyLen) &&
				_wcsnicmp (CERT_TRUST_PUB_SAFER_GROUP_POLICY_DISALLOWED_STORE_REGPATH, 
						bstrKey, nDisallowedKeyLen)) )
    {
        return true;
    }
    else if ( !_wcsnicmp (SAFER_HKLM_REGBASE, bstrKey, nSaferKeyLen) ||
             !_wcsnicmp (EFS_SETTINGS_REGPATH, bstrKey, nEFSKeyLen) ||
             !_wcsicmp (AUTO_ENROLLMENT_KEY, bstrKey) )
    {
        return true;
    }
    else
        return false;
}