Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

915 lines
25 KiB

//+--------------------------------------------------------------------------
//
// Microsoft Windows
// Copyright (C) Microsoft Corporation, 1996-1996
//
// File: ch.cpp
//
// Contents:
// All Clearing house related function
//
// History:
//
// Note:
//---------------------------------------------------------------------------
#include "pch.cpp"
#include "clrhouse.h"
#include "globals.h"
#include "gencert.h"
/*****************************************************************************
*****************************************************************************/
BOOL
TLSChainIssuerCertificate(
HCRYPTPROV hCryptProv,
HCERTSTORE hChainFromStore,
HCERTSTORE hChainToStore,
PCCERT_CONTEXT pSubjectContext
)
/*
*/
{
DWORD dwStatus = ERROR_SUCCESS;
PCCERT_CONTEXT pCertIssuer=NULL;
PCCERT_CONTEXT pCurrentSubject = NULL;
DWORD dwFlags;
//
// Increase reference count on Subject context.
//
// From MSDN: Currently, a copy is not made of the context, and the
// returned pointer to a context has the same value as the pointer to a
// context that was input.
//
pCurrentSubject = CertDuplicateCertificateContext(
pSubjectContext
);
while( TRUE )
{
dwFlags = CERT_STORE_SIGNATURE_FLAG;
pCertIssuer = CertGetIssuerCertificateFromStore(
hChainFromStore,
pCurrentSubject,
NULL,
&dwFlags
);
CertFreeCertificateContext(pCurrentSubject);
if(!pCertIssuer)
{
dwStatus = GetLastError();
break;
}
if(dwFlags & CERT_STORE_SIGNATURE_FLAG)
{
//
// we have invalid signature from certificate
//
dwStatus = TLS_E_INVALID_DATA;
break;
}
if(!CertAddCertificateContextToStore(
hChainToStore,
pCertIssuer,
CERT_STORE_ADD_REPLACE_EXISTING,
NULL
))
{
dwStatus = GetLastError();
break;
}
pCurrentSubject = pCertIssuer;
}
if(dwStatus == CRYPT_E_SELF_SIGNED)
{
dwStatus = ERROR_SUCCESS;
}
SetLastError(dwStatus);
if(pCertIssuer)
{
CertFreeCertificateContext(pCertIssuer);
}
return dwStatus == ERROR_SUCCESS;
}
/*****************************************************************************
*****************************************************************************/
HCERTSTORE
CertOpenRegistryStore(
HKEY hKeyType,
LPCTSTR szSubKey,
HCRYPTPROV hCryptProv,
HKEY* phKey
)
/*
*/
{
DWORD dwStatus;
HCERTSTORE hCertStore;
dwStatus=RegOpenKeyEx(hKeyType, szSubKey, 0, KEY_ALL_ACCESS, phKey);
if(dwStatus != ERROR_SUCCESS)
{
SetLastError(dwStatus);
return NULL;
}
hCertStore = CertOpenStore(
CERT_STORE_PROV_REG,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
hCryptProv,
CERT_STORE_NO_CRYPT_RELEASE_FLAG,
(PVOID)*phKey
);
return hCertStore;
}
/*****************************************************************************
TransferCertFromStoreToStore()
*****************************************************************************/
DWORD
TransferCertFromStoreToStore(
HCERTSTORE hSrcStore,
HCERTSTORE hDestStore
)
/*
*/
{
PCCERT_CONTEXT pCertContext=NULL;
PCCERT_CONTEXT pPrevCertContext=NULL;
DWORD dwStatus=ERROR_SUCCESS;
do {
pCertContext = CertEnumCertificatesInStore(hSrcStore, pPrevCertContext);
if(pCertContext)
{
if(!CertAddCertificateContextToStore(
hDestStore,
pCertContext,
CERT_STORE_ADD_REPLACE_EXISTING,
NULL
))
{
dwStatus = GetLastError();
break;
}
}
pPrevCertContext = pCertContext;
} while( pCertContext != NULL );
if(GetLastError() == CRYPT_E_NOT_FOUND)
{
dwStatus = ERROR_SUCCESS;
}
return dwStatus;
}
/*****************************************************************************
LSSaveCertAsPKCS7()
*****************************************************************************/
DWORD
TLSSaveCertAsPKCS7(
PBYTE pbCert,
DWORD cbCert,
PBYTE* ppbEncodedCert,
PDWORD pcbEncodedCert
)
/*
*/
{
DWORD dwStatus=ERROR_SUCCESS;
HCRYPTPROV hCryptProv=g_hCryptProv;
HCERTSTORE hStore=NULL;
PCCERT_CONTEXT pCertContext=NULL;
do {
//
// Must have call CryptoInit()
//if(!CryptAcquireContext(&hCryptProv, _TEXT(KEYCONTAINER), MS_DEF_PROV, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET))
//{
// LSLogEvent(EVENTLOG_ERROR_TYPE, TLS_E_CRYPT_ACQUIRE_CONTEXT, dwStatus=GetLastError());
// break;
//}
hStore=CertOpenStore(
CERT_STORE_PROV_MEMORY,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
hCryptProv,
CERT_STORE_NO_CRYPT_RELEASE_FLAG,
NULL
);
if(!hStore)
{
TLSLogEvent(
EVENTLOG_ERROR_TYPE,
TLS_E_GENERATECLIENTELICENSE,
TLS_E_OPEN_CERT_STORE,
dwStatus=GetLastError()
);
break;
}
pCertContext = CertCreateCertificateContext(
X509_ASN_ENCODING,
pbCert,
cbCert
);
if(!pCertContext)
{
TLSLogEvent(
EVENTLOG_ERROR_TYPE,
TLS_E_GENERATECLIENTELICENSE,
TLS_E_CREATE_CERTCONTEXT,
dwStatus=GetLastError()
);
break;
}
//
// always start from empty so CERT_STORE_ADD_ALWAYS
if(!CertAddCertificateContextToStore(
hStore,
pCertContext,
CERT_STORE_ADD_ALWAYS,
NULL
))
{
TLSLogEvent(
EVENTLOG_ERROR_TYPE,
TLS_E_GENERATECLIENTELICENSE,
TLS_E_ADD_CERT_TO_STORE,
dwStatus=GetLastError()
);
break;
}
#ifdef ENFORCE_LICENSING
if(g_bHasHydraCert && g_hCaStore)
{
if(!TLSChainIssuerCertificate(
hCryptProv,
g_hCaStore,
hStore,
pCertContext
))
{
TLSLogEvent(
EVENTLOG_ERROR_TYPE,
TLS_E_GENERATECLIENTELICENSE,
TLS_E_ADD_CERT_TO_STORE,
dwStatus=GetLastError()
);
break;
}
}
#endif
CRYPT_DATA_BLOB saveBlob;
memset(&saveBlob, 0, sizeof(saveBlob));
// save certificate into memory
if(!CertSaveStore(hStore,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
LICENSE_BLOB_SAVEAS_TYPE,
CERT_STORE_SAVE_TO_MEMORY,
&saveBlob,
0) && (dwStatus=GetLastError()) != ERROR_MORE_DATA)
{
TLSLogEvent(
EVENTLOG_ERROR_TYPE,
TLS_E_GENERATECLIENTELICENSE,
TLS_E_SAVE_STORE,
dwStatus=GetLastError()
);
break;
}
if(!(saveBlob.pbData = (PBYTE)midl_user_allocate(saveBlob.cbData)))
{
dwStatus=GetLastError();
break;
}
// save certificate into memory
if(!CertSaveStore(hStore,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
LICENSE_BLOB_SAVEAS_TYPE,
CERT_STORE_SAVE_TO_MEMORY,
&saveBlob,
0))
{
TLSLogEvent(
EVENTLOG_ERROR_TYPE,
TLS_E_GENERATECLIENTELICENSE,
TLS_E_SAVE_STORE,
dwStatus=GetLastError()
);
break;
}
*ppbEncodedCert = saveBlob.pbData;
*pcbEncodedCert = saveBlob.cbData;
} while(FALSE);
if(pCertContext)
{
CertFreeCertificateContext(pCertContext);
}
if(hStore)
{
CertCloseStore(hStore, CERT_CLOSE_STORE_FORCE_FLAG);
}
return (dwStatus == ERROR_SUCCESS) ? ERROR_SUCCESS : TLS_E_SAVE_STORE;
}
//--------------------------------------------------------------------------
//
static LONG
OpenCertRegStore(
LPCTSTR szSubKey,
PHKEY phKey
)
/*
*/
{
DWORD dwDisposition;
return RegCreateKeyEx(
HKEY_LOCAL_MACHINE,
szSubKey,
0,
NULL,
REG_OPTION_NON_VOLATILE,
KEY_ALL_ACCESS,
NULL,
phKey,
&dwDisposition
);
}
//--------------------------------------------------------------------------
//
static DWORD
IsHydraRootOIDInCert(
PCCERT_CONTEXT pCertContext,
DWORD dwKeyType
)
/*
*/
{
BOOL bFound=FALSE;
PCERT_INFO pCertInfo = pCertContext->pCertInfo;
PCERT_EXTENSION pCertExtension=pCertInfo->rgExtension;
PCERT_PUBLIC_KEY_INFO pbPublicKey=NULL;
DWORD dwStatus = ERROR_SUCCESS;
DWORD dwSize = 0;
//
// Must have a CH root extension.
//
for(DWORD i=0; i < pCertInfo->cExtension && bFound == FALSE; i++, pCertExtension++)
{
bFound=(strcmp(pCertExtension->pszObjId, szOID_PKIX_HYDRA_CERT_ROOT) == 0);
}
if(bFound == TRUE)
{
//
// Public Key must be the same
//
dwStatus = TLSExportPublicKey(
g_hCryptProv,
dwKeyType,
&dwSize,
&pbPublicKey
);
if(dwStatus == ERROR_SUCCESS)
{
bFound = CertComparePublicKeyInfo(
X509_ASN_ENCODING,
pbPublicKey,
&(pCertContext->pCertInfo->SubjectPublicKeyInfo)
);
if(bFound == FALSE)
{
dwStatus = TLS_E_CH_INSTALL_NON_LSCERTIFICATE;
}
}
}
else
{
dwStatus = TLS_E_CH_LSCERTIFICATE_NOTFOUND;
}
FreeMemory(pbPublicKey);
return dwStatus;
}
//---------------------------------------------------------------------------
// Functions:
// IsCertificateLicenseServerCertificate()
//
// Abstract:
// Find License Server certificate in PKCS 7 certificate blob
//
// Parameters:
// hCryptProv - Cryto. Provider
// cbPKCS7Cert - Size of PKCS7 certificate.
// pbPKCS7Cert - pointer to PKCS7 certificate
// cbLsCert - size of encoded license server certificate.
// pbLsCert - pointer to pointer to receive license server encoded certificate.
//
// Returns:
// ERROR_SUCCESS
// TLS_E_INVALID_DATA
// Crypto. error code.
//---------------------------------------------------------------------------
DWORD
IsCertificateLicenseServerCertificate(
IN HCRYPTPROV hCryptProv,
IN DWORD dwCertType,
IN DWORD cbPKCS7Cert,
IN PBYTE pbPKCS7Cert,
IN OUT DWORD* cbLsCert,
IN OUT PBYTE* pbLsCert
)
/*
*/
{
//
// Certificate must be in PCKS 7 format.
//
DWORD dwStatus=ERROR_SUCCESS;
HCERTSTORE hCertStore=NULL;
PCCERT_CONTEXT pPrevCertContext=NULL;
PCCERT_CONTEXT pCertContext=NULL;
CRYPT_DATA_BLOB Serialized;
Serialized.pbData = pbPKCS7Cert;
Serialized.cbData = cbPKCS7Cert;
hCertStore = CertOpenStore(
CERT_STORE_PROV_PKCS7,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
hCryptProv,
CERT_STORE_NO_CRYPT_RELEASE_FLAG,
&Serialized
);
if(!hCertStore)
{
return dwStatus=GetLastError();
}
//
// enumerate all certificate and find certificate with our extension.
//
do {
pCertContext = CertEnumCertificatesInStore(
hCertStore,
pPrevCertContext
);
if(pCertContext)
{
dwStatus = IsHydraRootOIDInCert(
pCertContext,
dwCertType
);
if(dwStatus == ERROR_SUCCESS)
{
//
// this is our certificate.
//
*pbLsCert = (PBYTE)AllocateMemory(*cbLsCert = pCertContext->cbCertEncoded);
if(*pbLsCert)
{
memcpy(
*pbLsCert,
pCertContext->pbCertEncoded,
pCertContext->cbCertEncoded
);
}
else
{
dwStatus = GetLastError();
}
break;
}
else if(dwStatus == TLS_E_CH_INSTALL_NON_LSCERTIFICATE)
{
break;
}
//
// reset status code.
//
dwStatus = ERROR_SUCCESS;
}
pPrevCertContext = pCertContext;
} while( pCertContext != NULL );
if(pCertContext != NULL)
{
CertFreeCertificateContext(pPrevCertContext);
}
if(hCertStore)
{
CertCloseStore(hCertStore, CERT_CLOSE_STORE_FORCE_FLAG);
}
return dwStatus;
}
//---------------------------------------------------------------------------
// Functions:
// LSSaveCertificateToReg()
//
// Abstract:
//
//
// Parameters:
// hCryptProv - Cryto. Provider
//
//
//
//
//
// Returns:
//
//
//
//---------------------------------------------------------------------------
DWORD
TLSSaveRootCertificateToReg(
HCRYPTPROV hCryptProv,
HKEY hKey,
DWORD cbEncodedCert,
PBYTE pbEncodedCert
)
/*
*/
{
PCCERT_CONTEXT pCertContext=NULL;
HCERTSTORE hCertSaveStore=NULL;
DWORD dwStatus=ERROR_SUCCESS;
do {
hCertSaveStore = CertOpenStore(
CERT_STORE_PROV_REG,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
hCryptProv,
CERT_STORE_NO_CRYPT_RELEASE_FLAG,
(PVOID)hKey
);
if(!hCertSaveStore)
{
// dwStatus = GetLastError();
dwStatus = TLS_E_INVALID_DATA;
break;
}
pCertContext = CertCreateCertificateContext(
X509_ASN_ENCODING,
pbEncodedCert,
cbEncodedCert
);
if(!pCertContext)
{
// dwStatus = GetLastError();
dwStatus = TLS_E_INVALID_DATA;
break;
}
if(!CertAddCertificateContextToStore(
hCertSaveStore,
pCertContext,
CERT_STORE_ADD_REPLACE_EXISTING,
NULL
))
{
dwStatus=GetLastError();
}
} while(FALSE);
if(pCertContext)
{
CertFreeCertificateContext( pCertContext );
}
if(hCertSaveStore)
{
CertCloseStore(
hCertSaveStore,
CERT_CLOSE_STORE_FORCE_FLAG
);
}
return dwStatus;
}
//---------------------------------------------------------------------------
// Functions:
// LSSaveCertificateToReg()
//
// Abstract:
//
//
// Parameters:
// hCryptProv - Cryto. Provider
//
//
//
//
//
// Returns:
//
//
//
//---------------------------------------------------------------------------
DWORD
TLSSaveCertificateToReg(
HCRYPTPROV hCryptProv,
HKEY hKey,
DWORD cbPKCS7Cert,
PBYTE pbPKCS7Cert
)
/*
*/
{
//
// Certificate must be in PCKS 7 format.
//
DWORD dwStatus=ERROR_SUCCESS;
HCERTSTORE hCertOpenStore=NULL;
HCERTSTORE hCertSaveStore=NULL;
PCCERT_CONTEXT pPrevCertContext=NULL;
PCCERT_CONTEXT pCertContext=NULL;
CRYPT_DATA_BLOB Serialized;
Serialized.pbData = pbPKCS7Cert;
Serialized.cbData = cbPKCS7Cert;
hCertOpenStore = CertOpenStore(
CERT_STORE_PROV_PKCS7,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
hCryptProv,
CERT_STORE_NO_CRYPT_RELEASE_FLAG,
&Serialized
);
if(!hCertOpenStore)
{
// dwStatus = GetLastError();
dwStatus = TLS_E_INVALID_DATA;
goto cleanup;
}
hCertSaveStore = CertOpenStore(
CERT_STORE_PROV_REG,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
hCryptProv,
CERT_STORE_NO_CRYPT_RELEASE_FLAG,
(PVOID)hKey
);
if(!hCertSaveStore)
{
dwStatus = TLS_E_INVALID_DATA;
goto cleanup;
}
dwStatus = TransferCertFromStoreToStore(
hCertOpenStore,
hCertSaveStore
);
cleanup:
if(hCertSaveStore)
{
CertCloseStore(
hCertSaveStore,
CERT_CLOSE_STORE_FORCE_FLAG
);
}
if(hCertOpenStore)
{
CertCloseStore(
hCertOpenStore,
CERT_CLOSE_STORE_FORCE_FLAG
);
}
return dwStatus;
}
//---------------------------------------------------------------------------
// Functions:
// LSSaveRootCertificatesToStore()
//
// Abstract:
//
// Save root certificate to license server certificate store.
//
// Parameters:
// hCryptProv - Cryto. Provider
// cbSignatureCert - size of root's signature certificate.
// pbSignatureCert - pointer to root's signature certificate.
// cbExchangeCert - size of root's exchange certficate.
// pbExchangeCert - pointer to root's exchange certificate
//
// Returns:
//
//---------------------------------------------------------------------------
DWORD
TLSSaveRootCertificatesToStore(
IN HCRYPTPROV hCryptProv,
IN DWORD cbSignatureCert,
IN PBYTE pbSignatureCert,
IN DWORD cbExchangeCert,
IN PBYTE pbExchangeCert
)
/*
*/
{
HKEY hKey;
LONG status=ERROR_SUCCESS;
if(cbSignatureCert == 0 && cbExchangeCert == 0)
{
return status = TLS_E_INVALID_DATA;
}
if(cbSignatureCert)
{
status = OpenCertRegStore(
LSERVER_CERTIFICATE_REG_ROOT_SIGNATURE,
&hKey
);
if(status != ERROR_SUCCESS)
return status;
status = TLSSaveRootCertificateToReg(
hCryptProv,
hKey,
cbSignatureCert,
pbSignatureCert
);
RegCloseKey(hKey);
if(status != ERROR_SUCCESS)
return status;
}
if(cbExchangeCert)
{
status = OpenCertRegStore(
LSERVER_CERTIFICATE_REG_ROOT_EXCHANGE,
&hKey
);
if(status != ERROR_SUCCESS)
return status;
status=TLSSaveRootCertificateToReg(
hCryptProv,
hKey,
cbExchangeCert,
pbExchangeCert
);
RegCloseKey(hKey);
}
return status;
}
//---------------------------------------------------------------------------
// Functions:
// LSSaveCertificatesToStore()
//
// Abstract:
//
//
// Parameters:
// hCryptProv - Cryto. Provider
//
//
//
//
//
// Returns:
//
//
//
//---------------------------------------------------------------------------
DWORD
TLSSaveCertificatesToStore(
IN HCRYPTPROV hCryptProv,
IN DWORD dwCertType,
IN DWORD dwCertLevel,
IN DWORD cbSignatureCert,
IN PBYTE pbSignatureCert,
IN DWORD cbExchangeCert,
IN PBYTE pbExchangeCert
)
/*
*/
{
HKEY hKey;
LONG status = ERROR_SUCCESS;
LPTSTR szRegSignature;
LPTSTR szRegExchange;
switch(dwCertType)
{
case CERTIFICATE_CA_TYPE:
szRegSignature = LSERVER_CERTIFICATE_REG_CA_SIGNATURE;
szRegExchange = LSERVER_CERTIFICATE_REG_CA_EXCHANGE;
break;
case CERTITICATE_MF_TYPE:
szRegSignature = LSERVER_CERTIFICATE_REG_MF_SIGNATURE;
szRegExchange = LSERVER_CERTIFICATE_REG_MF_EXCHANGE;
break;
case CERTIFICATE_CH_TYPE:
szRegSignature = LSERVER_CERTIFICATE_REG_CH_SIGNATURE;
szRegExchange = LSERVER_CERTIFICATE_REG_CH_EXCHANGE;
break;
default:
status = TLS_E_INVALID_DATA;
return status;
}
if(cbSignatureCert)
{
status = OpenCertRegStore(szRegSignature, &hKey);
if(status != ERROR_SUCCESS)
return status;
status=TLSSaveCertificateToReg(
hCryptProv,
hKey,
cbSignatureCert,
pbSignatureCert
);
RegCloseKey(hKey);
if(status != ERROR_SUCCESS)
return status;
}
if(cbExchangeCert)
{
status = OpenCertRegStore(szRegExchange, &hKey);
if(status != ERROR_SUCCESS)
return status;
status=TLSSaveCertificateToReg(
hCryptProv,
hKey,
cbExchangeCert,
pbExchangeCert
);
RegCloseKey(hKey);
}
return status;
}