Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

728 lines
20 KiB

//+---------------------------------------------------------------------------
//
// Microsoft Windows NT Security
// Copyright (C) Microsoft Corporation, 1997 - 1999
//
// File: api.cpp
//
// Contents: Certificate Chaining Infrastructure
//
// History: 28-Jan-98 kirtd Created
//
//----------------------------------------------------------------------------
#include <global.hxx>
#include <dbgdef.h>
//
// Globals
//
HMODULE g_hCryptnet = NULL;
CRITICAL_SECTION g_CryptnetLock;
CDefaultChainEngineMgr DefaultChainEngineMgr;
CRITICAL_SECTION g_RoamingLogoffNotificationLock;
BOOL g_fRoamingLogoffNotificationInitialized = FALSE;
HMODULE g_hChainInst;
VOID WINAPI
CreateRoamingLogoffNotificationEvent();
VOID WINAPI
InitializeRoamingLogoffNotification();
VOID WINAPI
UninitializeRoamingLogoffNotification();
//+---------------------------------------------------------------------------
//
// Function: ChainDllMain
//
// Synopsis: Chaining infrastructure initialization
//
//----------------------------------------------------------------------------
BOOL WINAPI
ChainDllMain (
IN HMODULE hModule,
IN ULONG ulReason,
IN LPVOID pvReserved
)
{
BOOL fResult = TRUE;
switch ( ulReason )
{
case DLL_PROCESS_ATTACH:
g_hChainInst = hModule;
fResult = Pki_InitializeCriticalSection( &g_CryptnetLock );
if (fResult)
{
fResult = Pki_InitializeCriticalSection(
&g_RoamingLogoffNotificationLock );
if (fResult)
{
fResult = DefaultChainEngineMgr.Initialize();
if (fResult)
{
CreateRoamingLogoffNotificationEvent();
}
else
{
DeleteCriticalSection( &g_RoamingLogoffNotificationLock );
}
}
if (!fResult)
{
DeleteCriticalSection( &g_CryptnetLock );
}
}
break;
case DLL_PROCESS_DETACH:
UninitializeRoamingLogoffNotification();
DefaultChainEngineMgr.Uninitialize();
if ( g_hCryptnet != NULL )
{
FreeLibrary( g_hCryptnet );
}
DeleteCriticalSection( &g_CryptnetLock );
DeleteCriticalSection( &g_RoamingLogoffNotificationLock );
break;
}
return( fResult );
}
//+---------------------------------------------------------------------------
//
// Function: InternalCertCreateCertificateChainEngine
//
// Synopsis: create a chain engine handle
//
//----------------------------------------------------------------------------
BOOL WINAPI
InternalCertCreateCertificateChainEngine (
IN PCERT_CHAIN_ENGINE_CONFIG pConfig,
IN BOOL fDefaultEngine,
OUT HCERTCHAINENGINE* phChainEngine
)
{
BOOL fResult = TRUE;
PCCERTCHAINENGINE pChainEngine = NULL;
CERT_CHAIN_ENGINE_CONFIG Config;
if ( pConfig->cbSize != sizeof( CERT_CHAIN_ENGINE_CONFIG ) )
{
SetLastError( (DWORD) E_INVALIDARG );
return( FALSE );
}
Config = *pConfig;
if ( Config.MaximumCachedCertificates == 0 )
{
Config.MaximumCachedCertificates = DEFAULT_MAX_INDEX_ENTRIES;
}
pChainEngine = new CCertChainEngine( &Config, fDefaultEngine, fResult );
if ( pChainEngine == NULL )
{
SetLastError( (DWORD) E_OUTOFMEMORY );
fResult = FALSE;
}
if ( fResult == TRUE )
{
*phChainEngine = (HCERTCHAINENGINE)pChainEngine;
}
else
{
delete pChainEngine;
}
return( fResult );
}
//+---------------------------------------------------------------------------
//
// Function: CertCreateCertificateChainEngine
//
// Synopsis: create a certificate chain engine
//
//----------------------------------------------------------------------------
BOOL WINAPI
CertCreateCertificateChainEngine (
IN PCERT_CHAIN_ENGINE_CONFIG pConfig,
OUT HCERTCHAINENGINE* phChainEngine
)
{
return( InternalCertCreateCertificateChainEngine(
pConfig,
FALSE,
phChainEngine
) );
}
//+---------------------------------------------------------------------------
//
// Function: CertFreeCertificateChainEngine
//
// Synopsis: free the chain engine handle
//
//----------------------------------------------------------------------------
VOID WINAPI
CertFreeCertificateChainEngine (
IN HCERTCHAINENGINE hChainEngine
)
{
if ( ( hChainEngine == HCCE_CURRENT_USER ) ||
( hChainEngine == HCCE_LOCAL_MACHINE ) )
{
DefaultChainEngineMgr.FlushDefaultEngine( hChainEngine );
return;
}
( (PCCERTCHAINENGINE)hChainEngine )->Release();
}
//+---------------------------------------------------------------------------
//
// Function: CertResyncCertificateChainEngine
//
// Synopsis: resync the chain engine
//
//----------------------------------------------------------------------------
BOOL WINAPI
CertResyncCertificateChainEngine (
IN HCERTCHAINENGINE hChainEngine
)
{
BOOL fResult;
PCCERTCHAINENGINE pChainEngine = (PCCERTCHAINENGINE)hChainEngine;
PCCHAINCALLCONTEXT pCallContext = NULL;
if ( ( hChainEngine == HCCE_LOCAL_MACHINE ) ||
( hChainEngine == HCCE_CURRENT_USER ) )
{
if ( DefaultChainEngineMgr.GetDefaultEngine(
hChainEngine,
(HCERTCHAINENGINE *)&pChainEngine
) == FALSE )
{
return( FALSE );
}
}
else
{
pChainEngine->AddRef();
}
fResult = CallContextCreateCallObject(
pChainEngine,
NULL, // pRequestedTime
NULL, // pChainPara
CERT_CHAIN_CACHE_ONLY_URL_RETRIEVAL,
&pCallContext
);
if (fResult)
{
pChainEngine->LockEngine();
fResult = pChainEngine->Resync( pCallContext, TRUE );
CertPerfIncrementChainRequestedEngineResyncCount();
pChainEngine->UnlockEngine();
CallContextFreeCallObject(pCallContext);
}
pChainEngine->Release();
return( fResult );
}
//+---------------------------------------------------------------------------
//
// Function: CertGetCertificateChain
//
// Synopsis: get the certificate chain for the given end certificate
//
//----------------------------------------------------------------------------
BOOL WINAPI
CertGetCertificateChain (
IN OPTIONAL HCERTCHAINENGINE hChainEngine,
IN PCCERT_CONTEXT pCertContext,
IN OPTIONAL LPFILETIME pTime,
IN OPTIONAL HCERTSTORE hAdditionalStore,
IN OPTIONAL PCERT_CHAIN_PARA pChainPara,
IN DWORD dwFlags,
IN LPVOID pvReserved,
OUT PCCERT_CHAIN_CONTEXT* ppChainContext
)
{
BOOL fResult;
PCCERTCHAINENGINE pChainEngine = (PCCERTCHAINENGINE)hChainEngine;
InitializeRoamingLogoffNotification();
if ( ( pChainPara == NULL ) || ( pvReserved != NULL ) )
{
SetLastError( (DWORD) E_INVALIDARG );
return( FALSE );
}
if ( ( hChainEngine == HCCE_LOCAL_MACHINE ) ||
( hChainEngine == HCCE_CURRENT_USER ) )
{
if ( DefaultChainEngineMgr.GetDefaultEngine(
hChainEngine,
(HCERTCHAINENGINE *)&pChainEngine
) == FALSE )
{
return( FALSE );
}
}
else
{
pChainEngine->AddRef();
}
fResult = pChainEngine->GetChainContext(
pCertContext,
pTime,
hAdditionalStore,
pChainPara,
dwFlags,
pvReserved,
ppChainContext
);
pChainEngine->Release();
return( fResult );
}
//+---------------------------------------------------------------------------
//
// Function: CertFreeCertificateChain
//
// Synopsis: free a certificate chain context
//
//----------------------------------------------------------------------------
VOID WINAPI
CertFreeCertificateChain (
IN PCCERT_CHAIN_CONTEXT pChainContext
)
{
ChainReleaseInternalChainContext(
(PINTERNAL_CERT_CHAIN_CONTEXT)pChainContext
);
}
//+---------------------------------------------------------------------------
//
// Function: CertDuplicateCertificateChain
//
// Synopsis: duplicate (add a reference to) a certificate chain
//
//----------------------------------------------------------------------------
PCCERT_CHAIN_CONTEXT WINAPI
CertDuplicateCertificateChain (
IN PCCERT_CHAIN_CONTEXT pChainContext
)
{
ChainAddRefInternalChainContext(
(PINTERNAL_CERT_CHAIN_CONTEXT)pChainContext
);
return( pChainContext );
}
//+---------------------------------------------------------------------------
//
// Function: ChainGetCryptnetModule
//
// Synopsis: get the cryptnet.dll module handle
//
//----------------------------------------------------------------------------
HMODULE WINAPI
ChainGetCryptnetModule ()
{
HMODULE hModule;
EnterCriticalSection( &g_CryptnetLock );
if ( g_hCryptnet == NULL )
{
g_hCryptnet = LoadLibraryA( "cryptnet.dll" );
}
hModule = g_hCryptnet;
LeaveCriticalSection( &g_CryptnetLock );
return( hModule );
}
//+===========================================================================
// RegisterWaitForSingleObject and UnregisterWaitEx are only supported
// in kernel32.dll on NT5.
//
// Internal functions to do dynamic calls
//-===========================================================================
typedef BOOL (WINAPI *PFN_REGISTER_WAIT_FOR_SINGLE_OBJECT)(
PHANDLE hNewWaitObject,
HANDLE hObject,
WAITORTIMERCALLBACK Callback,
PVOID Context,
ULONG dwMilliseconds,
ULONG dwFlags
);
typedef BOOL (WINAPI *PFN_UNREGISTER_WAIT_EX)(
HANDLE WaitHandle,
HANDLE CompletionEvent // INVALID_HANDLE_VALUE => create event
// to wait for
);
#define sz_KERNEL32_DLL "kernel32.dll"
#define sz_RegisterWaitForSingleObject "RegisterWaitForSingleObject"
#define sz_UnregisterWaitEx "UnregisterWaitEx"
BOOL
WINAPI
InternalRegisterWaitForSingleObject(
PHANDLE hNewWaitObject,
HANDLE hObject,
WAITORTIMERCALLBACK Callback,
PVOID Context,
ULONG dwMilliseconds,
ULONG dwFlags
)
{
BOOL fResult;
HMODULE hKernel32Dll = NULL;
PFN_REGISTER_WAIT_FOR_SINGLE_OBJECT pfnRegisterWaitForSingleObject;
if (NULL == (hKernel32Dll = LoadLibraryA(sz_KERNEL32_DLL)))
goto LoadKernel32DllError;
if (NULL == (pfnRegisterWaitForSingleObject =
(PFN_REGISTER_WAIT_FOR_SINGLE_OBJECT) GetProcAddress(
hKernel32Dll, sz_RegisterWaitForSingleObject)))
goto GetRegisterWaitForSingleObjectProcAddressError;
fResult = pfnRegisterWaitForSingleObject(
hNewWaitObject,
hObject,
Callback,
Context,
dwMilliseconds,
dwFlags
);
CommonReturn:
if (hKernel32Dll) {
DWORD dwErr = GetLastError();
FreeLibrary(hKernel32Dll);
SetLastError(dwErr);
}
return fResult;
ErrorReturn:
*hNewWaitObject = NULL;
fResult = FALSE;
goto CommonReturn;
TRACE_ERROR(LoadKernel32DllError)
TRACE_ERROR(GetRegisterWaitForSingleObjectProcAddressError)
}
BOOL
WINAPI
InternalUnregisterWaitEx(
HANDLE WaitHandle,
HANDLE CompletionEvent // INVALID_HANDLE_VALUE => create event
// to wait for
)
{
BOOL fResult;
HMODULE hKernel32Dll = NULL;
PFN_UNREGISTER_WAIT_EX pfnUnregisterWaitEx;
if (NULL == (hKernel32Dll = LoadLibraryA(sz_KERNEL32_DLL)))
goto LoadKernel32DllError;
if (NULL == (pfnUnregisterWaitEx =
(PFN_UNREGISTER_WAIT_EX) GetProcAddress(
hKernel32Dll, sz_UnregisterWaitEx)))
goto GetUnregisterWaitExProcAddressError;
fResult = pfnUnregisterWaitEx(
WaitHandle,
CompletionEvent
);
CommonReturn:
if (hKernel32Dll) {
DWORD dwErr = GetLastError();
FreeLibrary(hKernel32Dll);
SetLastError(dwErr);
}
return fResult;
ErrorReturn:
fResult = FALSE;
goto CommonReturn;
TRACE_ERROR(LoadKernel32DllError)
TRACE_ERROR(GetUnregisterWaitExProcAddressError)
}
//+===========================================================================
// We only get logoff notification in winlogon.exe.
//
// The work around is to have the winlogon ChainWlxLogoffEvent pulse a
// named event. All processes where crypt32.dll is loaded will be doing
// a RegisterWaitForObject for this event.
//
// Note, there is a very small window where we might not be waiting at the
// time the event is pulsed.
//-===========================================================================
#define CRYPT32_LOGOFF_EVENT "Global\\crypt32LogoffEvent"
HANDLE g_hLogoffEvent;
HANDLE g_hLogoffRegWaitFor;
typedef BOOL (WINAPI *PFN_WLX_LOGOFF)(
PWLX_NOTIFICATION_INFO pNotificationInfo
);
VOID NTAPI LogoffWaitForCallback(
PVOID Context,
BOOLEAN fWaitOrTimedOut // ???
)
{
HMODULE hModule;
CertFreeCertificateChainEngine( HCCE_CURRENT_USER );
// Only call if cryptnet has been loaded
if (NULL != GetModuleHandleA("cryptnet.dll")) {
hModule = ChainGetCryptnetModule();
if (hModule) {
PFN_WLX_LOGOFF pfn;
pfn = (PFN_WLX_LOGOFF) GetProcAddress(hModule,
"CryptnetWlxLogoffEvent");
if (pfn)
pfn(NULL);
}
}
}
// Note, the event must not be created while impersonating. That's why it
// is created at ProcessAttach.
VOID WINAPI
CreateRoamingLogoffNotificationEvent()
{
SECURITY_ATTRIBUTES sa;
SECURITY_DESCRIPTOR sd;
SID_IDENTIFIER_AUTHORITY siaNtAuthority = SECURITY_NT_AUTHORITY;
SID_IDENTIFIER_AUTHORITY siaWorldSidAuthority =
SECURITY_WORLD_SID_AUTHORITY;
PSID psidLocalSystem = NULL;
PSID psidEveryone = NULL;
PACL pDacl = NULL;
DWORD dwAclSize;
if (!FIsWinNT5())
return;
// Allow Everyone to have SYNCHRONIZE access to the logoff event.
// Only allow LocalSystem to have ALL access
if (!AllocateAndInitializeSid(
&siaNtAuthority,
1,
SECURITY_LOCAL_SYSTEM_RID,
0, 0, 0, 0, 0, 0, 0,
&psidLocalSystem
))
goto AllocateAndInitializeSidError;
if (!AllocateAndInitializeSid(
&siaWorldSidAuthority,
1,
SECURITY_WORLD_RID,
0, 0, 0, 0, 0, 0, 0,
&psidEveryone
))
goto AllocateAndInitializeSidError;
//
// compute size of ACL
//
dwAclSize = sizeof(ACL) +
2 * ( sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) ) +
GetLengthSid(psidLocalSystem) +
GetLengthSid(psidEveryone)
;
//
// allocate storage for Acl
//
if (NULL == (pDacl = (PACL) PkiNonzeroAlloc(dwAclSize)))
goto OutOfMemory;
if (!InitializeAcl(pDacl, dwAclSize, ACL_REVISION))
goto InitializeAclError;
if (!AddAccessAllowedAce(
pDacl,
ACL_REVISION,
EVENT_ALL_ACCESS,
psidLocalSystem
))
goto AddAceError;
if (!AddAccessAllowedAce(
pDacl,
ACL_REVISION,
SYNCHRONIZE,
psidEveryone
))
goto AddAceError;
if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
goto InitializeSecurityDescriptorError;
if (!SetSecurityDescriptorDacl(&sd, TRUE, pDacl, FALSE))
goto SetSecurityDescriptorDaclError;
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = &sd;
sa.bInheritHandle = FALSE;
g_hLogoffEvent = CreateEventA(
&sa,
TRUE, // fManualReset, must be TRUE to pulse all waitors
FALSE, // fInitialState
CRYPT32_LOGOFF_EVENT
);
if (NULL == g_hLogoffEvent) {
// Try to open with only SYNCHRONIZE access
g_hLogoffEvent = OpenEventA(
SYNCHRONIZE,
FALSE, // fInherit
CRYPT32_LOGOFF_EVENT
);
if (NULL == g_hLogoffEvent)
goto CreateEventError;
}
CommonReturn:
if (psidLocalSystem)
FreeSid(psidLocalSystem);
if (psidEveryone)
FreeSid(psidEveryone);
PkiFree(pDacl);
return;
ErrorReturn:
goto CommonReturn;
TRACE_ERROR(AllocateAndInitializeSidError)
TRACE_ERROR(OutOfMemory)
TRACE_ERROR(InitializeAclError)
TRACE_ERROR(AddAceError)
TRACE_ERROR(InitializeSecurityDescriptorError)
TRACE_ERROR(SetSecurityDescriptorDaclError)
TRACE_ERROR(CreateEventError)
}
VOID WINAPI
InitializeRoamingLogoffNotification()
{
if (!FIsWinNT5())
return;
if (g_fRoamingLogoffNotificationInitialized)
return;
EnterCriticalSection(&g_RoamingLogoffNotificationLock);
if (g_fRoamingLogoffNotificationInitialized)
goto CommonReturn;
if (NULL == g_hLogoffEvent)
goto NoLogoffEvent;
// No need to do roaming logoff notification for TS processes
if (0 != GetSystemMetrics(SM_REMOTESESSION))
goto CommonReturn;
// Note, this can't be called at ProcessAttach
if (!InternalRegisterWaitForSingleObject(
&g_hLogoffRegWaitFor,
g_hLogoffEvent,
LogoffWaitForCallback,
NULL, // Context
INFINITE, // no timeout
WT_EXECUTEINWAITTHREAD
))
goto RegisterWaitForError;
CommonReturn:
g_fRoamingLogoffNotificationInitialized = TRUE;
LeaveCriticalSection(&g_RoamingLogoffNotificationLock);
return;
ErrorReturn:
goto CommonReturn;
SET_ERROR(NoLogoffEvent, E_UNEXPECTED)
TRACE_ERROR(RegisterWaitForError)
}
VOID WINAPI
UninitializeRoamingLogoffNotification()
{
if (g_hLogoffRegWaitFor) {
InternalUnregisterWaitEx(g_hLogoffRegWaitFor, INVALID_HANDLE_VALUE);
g_hLogoffRegWaitFor = NULL;
}
if (g_hLogoffEvent) {
CloseHandle(g_hLogoffEvent);
g_hLogoffEvent = NULL;
}
}
//+---------------------------------------------------------------------------
//
// Function: ChainWlxLogoffEvent
//
// Synopsis: logoff event processing
//
//----------------------------------------------------------------------------
BOOL WINAPI
ChainWlxLogoffEvent (PWLX_NOTIFICATION_INFO pNotificationInfo)
{
if (g_hLogoffRegWaitFor) {
InternalUnregisterWaitEx(g_hLogoffRegWaitFor, INVALID_HANDLE_VALUE);
g_hLogoffRegWaitFor = NULL;
}
CertFreeCertificateChainEngine( HCCE_CURRENT_USER );
if (g_hLogoffEvent) {
// Trigger all non-winlogon processes to do logoff processing
PulseEvent(g_hLogoffEvent);
}
return( TRUE );
}