windows-xp/Source/XPSP1/NT/ds/security/protocols/schannel/lsa/spreg.c

//+---------------------------------------------------------------------------
//
//  Microsoft Windows
//  Copyright (C) Microsoft Corporation, 1992 - 2000.
//
//  File:       spreg.c
//
//  Contents:   Schannel registry management routines. 
//
//  Classes:
//
//  Functions:
//
//  History:    11-24-97   jbanes   Enabled TLS
//
//----------------------------------------------------------------------------

#include <sslp.h>
#include "spreg.h"

HKEY   g_hkBase      = NULL;
HANDLE g_hParamEvent = NULL;
HANDLE g_hWait       = NULL;

HKEY   g_hkFipsBase      = NULL;
HANDLE g_hFipsParamEvent = NULL;
HANDLE g_hFipsWait       = NULL;

BOOL g_fManualCredValidation        = MANUAL_CRED_VALIDATION_SETTING;
BOOL g_PctClientDisabledByDefault   = PCT_CLIENT_DISABLED_SETTING;
BOOL g_Ssl2ClientDisabledByDefault  = SSL2_CLIENT_DISABLED_SETTING;

DWORD g_dwEventLogging              = DEFAULT_EVENT_LOGGING_SETTING;
DWORD g_ProtEnabled                 = DEFAULT_ENABLED_PROTOCOLS_SETTING; 

BOOL g_fFipsMode = FALSE;
BOOL g_fFranceLocale = FALSE;

typedef struct enamap
{
    TCHAR *pKey;
    DWORD Mask;
} enamap;

enamap g_ProtMap[] =
{
    {SP_REG_KEY_UNIHELLO TEXT("\\") SP_REG_KEY_CLIENT, SP_PROT_UNI_CLIENT},
    {SP_REG_KEY_UNIHELLO TEXT("\\") SP_REG_KEY_SERVER, SP_PROT_UNI_SERVER},
    {SP_REG_KEY_PCT1 TEXT("\\") SP_REG_KEY_CLIENT, SP_PROT_PCT1_CLIENT},
    {SP_REG_KEY_PCT1 TEXT("\\") SP_REG_KEY_SERVER, SP_PROT_PCT1_SERVER},
    {SP_REG_KEY_SSL2 TEXT("\\") SP_REG_KEY_CLIENT, SP_PROT_SSL2_CLIENT},
    {SP_REG_KEY_SSL2 TEXT("\\") SP_REG_KEY_SERVER, SP_PROT_SSL2_SERVER},
    {SP_REG_KEY_SSL3 TEXT("\\") SP_REG_KEY_CLIENT, SP_PROT_SSL3_CLIENT},
    {SP_REG_KEY_SSL3 TEXT("\\") SP_REG_KEY_SERVER, SP_PROT_SSL3_SERVER},
    {SP_REG_KEY_TLS1 TEXT("\\") SP_REG_KEY_CLIENT, SP_PROT_TLS1_CLIENT},
    {SP_REG_KEY_TLS1 TEXT("\\") SP_REG_KEY_SERVER, SP_PROT_TLS1_SERVER}
};

VOID
SslWatchParamKey(
    PVOID    pCtxt,
    BOOLEAN  fWaitStatus);

VOID
FipsWatchParamKey(
    PVOID    pCtxt,
    BOOLEAN  fWaitStatus);

BOOL 
SslReadRegOptions(
    BOOL fFirstTime);

BOOL SPLoadRegOptions(void)
{
    g_hParamEvent = CreateEvent(NULL,
                           FALSE,
                           FALSE,
                           NULL);

    SslWatchParamKey(g_hParamEvent, FALSE);

    g_hFipsParamEvent = CreateEvent(NULL,
                           FALSE,
                           FALSE,
                           NULL);

    FipsWatchParamKey(g_hFipsParamEvent, FALSE);

    return TRUE;
}

void SPUnloadRegOptions(void)
{
    if (NULL != g_hWait) 
    {
        RtlDeregisterWait(g_hWait);
        g_hWait = NULL;
    }

    if(NULL != g_hkBase)
    {
        RegCloseKey(g_hkBase);
    }

    if(NULL != g_hParamEvent)
    {
        CloseHandle(g_hParamEvent);
    }

    if (NULL != g_hFipsWait) 
    {
        RtlDeregisterWait(g_hFipsWait);
        g_hFipsWait = NULL;
    }

    if(NULL != g_hkFipsBase)
    {
        RegCloseKey(g_hkFipsBase);
    }

    if(NULL != g_hFipsParamEvent)
    {
        CloseHandle(g_hFipsParamEvent);
    }
}

BOOL
ReadRegistrySetting(
    HKEY    hReadKey,
    HKEY    hWriteKey,
    LPCTSTR pszValueName,
    DWORD * pdwValue,
    DWORD   dwDefaultValue)
{
    DWORD dwSize;
    DWORD dwType;
    DWORD dwOriginalValue = *pdwValue;

    dwSize = sizeof(DWORD);
    if(RegQueryValueEx(hReadKey, 
                       pszValueName, 
                       NULL, 
                       &dwType, 
                       (PUCHAR)pdwValue, 
                       &dwSize) != STATUS_SUCCESS)
    {
        *pdwValue = dwDefaultValue;

        if(hWriteKey)
        {
            RegSetValueEx(hWriteKey, 
                          pszValueName, 
                          0, 
                          REG_DWORD, 
                          (PUCHAR)pdwValue, 
                          sizeof(DWORD));
        }
    }

    return (dwOriginalValue != *pdwValue);
}


////////////////////////////////////////////////////////////////////
//
//  Name:       SslWatchParamKey
//
//  Synopsis:   Sets RegNotifyChangeKeyValue() on param key, initializes
//              debug level, then utilizes thread pool to wait on
//              changes to this registry key.  Enables dynamic debug
//              level changes, as this function will also be callback
//              if registry key modified.
//
//  Arguments:  pCtxt is actually a HANDLE to an event.  This event
//              will be triggered when key is modified.
//
//  Notes:      .
//
VOID
SslWatchParamKey(
    PVOID    pCtxt,
    BOOLEAN  fWaitStatus)
{
    NTSTATUS    Status;
    LONG        lRes = ERROR_SUCCESS;
    BOOL        fFirstTime = FALSE;
    DWORD       disp;

    if(g_hkBase == NULL)
    {
        // First time we've been called.
        Status = RegCreateKeyEx(HKEY_LOCAL_MACHINE,
                                SP_REG_KEY_BASE,
                                0,
                                TEXT(""),
                                REG_OPTION_NON_VOLATILE,
                                KEY_READ,
                                NULL,
                                &g_hkBase,
                                &disp);
        if(Status)
        {
            DebugLog((DEB_WARN,"Failed to open SCHANNEL key: 0x%x\n", Status));
            return;
        }

        fFirstTime = TRUE;
    }

    if(pCtxt != NULL)
    {
        if (NULL != g_hWait) 
        {
            Status = RtlDeregisterWait(g_hWait);
            if(!NT_SUCCESS(Status))
            {
                DebugLog((DEB_WARN, "Failed to Deregister wait on registry key: 0x%x\n", Status));
                goto Reregister;
            }
        }

        lRes = RegNotifyChangeKeyValue(
                    g_hkBase,
                    TRUE,
                    REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET,
                    (HANDLE)pCtxt,
                    TRUE);

        if (ERROR_SUCCESS != lRes) 
        {
            DebugLog((DEB_ERROR,"Debug RegNotify setup failed: 0x%x\n", lRes));
            // we're tanked now. No further notifications, so get this one
        }
    }

    SslReadRegOptions(fFirstTime);

#if DBG
    InitDebugSupport(g_hkBase);
#endif

Reregister:

    if(pCtxt != NULL)
    {
        Status = RtlRegisterWait(&g_hWait,
                                 (HANDLE)pCtxt,
                                 SslWatchParamKey,
                                 (HANDLE)pCtxt,
                                 INFINITE,
                                 WT_EXECUTEINPERSISTENTIOTHREAD|
                                 WT_EXECUTEONLYONCE);
    }
}                       


////////////////////////////////////////////////////////////////////
//
//  Name:       FipsWatchParamKey
//
//  Synopsis:   Sets RegNotifyChangeKeyValue() on param key, initializes
//              debug level, then utilizes thread pool to wait on
//              changes to this registry key.  Enables dynamic debug
//              level changes, as this function will also be callback
//              if registry key modified.
//
//  Arguments:  pCtxt is actually a HANDLE to an event.  This event
//              will be triggered when key is modified.
//
//  Notes:      .
//
VOID
FipsWatchParamKey(
    PVOID    pCtxt,
    BOOLEAN  fWaitStatus)
{
    NTSTATUS    Status;
    LONG        lRes = ERROR_SUCCESS;
    DWORD       disp;

    if(g_hkFipsBase == NULL)
    {
        // First time we've been called.
        Status = RegCreateKeyEx(HKEY_LOCAL_MACHINE,
                                SP_REG_FIPS_BASE_KEY,
                                0,
                                TEXT(""),
                                REG_OPTION_NON_VOLATILE,
                                KEY_READ,
                                NULL,
                                &g_hkFipsBase,
                                &disp);
        if(Status)
        {
            DebugLog((DEB_WARN,"Failed to open FIPS key: 0x%x\n", Status));
            return;
        }
    }

    if(pCtxt != NULL)
    {
        if (NULL != g_hFipsWait) 
        {
            Status = RtlDeregisterWait(g_hFipsWait);
            if(!NT_SUCCESS(Status))
            {
                DebugLog((DEB_WARN, "Failed to Deregister wait on registry key: 0x%x\n", Status));
                goto Reregister;
            }
        }

        lRes = RegNotifyChangeKeyValue(
                    g_hkFipsBase,
                    TRUE,
                    REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET,
                    (HANDLE)pCtxt,
                    TRUE);

        if (ERROR_SUCCESS != lRes) 
        {
            DebugLog((DEB_ERROR,"Debug RegNotify setup failed: 0x%x\n", lRes));
            // we're tanked now. No further notifications, so get this one
        }
    }

    SslReadRegOptions(FALSE);

Reregister:

    if(pCtxt != NULL)
    {
        Status = RtlRegisterWait(&g_hFipsWait,
                                 (HANDLE)pCtxt,
                                 FipsWatchParamKey,
                                 (HANDLE)pCtxt,
                                 INFINITE,
                                 WT_EXECUTEINPERSISTENTIOTHREAD|
                                 WT_EXECUTEONLYONCE);
    }
}                       

                        
BOOL 
SslReadRegOptions(
    BOOL fFirstTime)
{
    DWORD       err;
    DWORD       dwType;
    DWORD       fVal;
    DWORD       dwSize;
    DWORD       dwValue;
    HKEY        hKey;
    HKEY        hWriteKey;
    DWORD       disp;
    HKEY        hSubKey;
    DWORD       i;
    HKEY        hkProtocols = NULL;
    HKEY        hkCiphers = NULL;
    HKEY        hkHashes = NULL;
    HKEY        hkKeyExch = NULL;
    BOOL        fFipsMode = FALSE;
    BOOL        fSettingsChanged = FALSE;
    DWORD       dwOriginalValue;

    DebugLog((DEB_TRACE,"Load configuration parameters from registry.\n"));


    // "FipsAlgorithmPolicy"
    ReadRegistrySetting(
        g_hkFipsBase,
        0,
        SP_REG_FIPS_POLICY,
        &dwValue,
        0);
    if(dwValue == 1)
    {
        fFipsMode = TRUE;
    }
    if(fFipsMode != g_fFipsMode)
    {
        g_fFipsMode = fFipsMode;
        fSettingsChanged = TRUE;
    }


    //
    // Read top-level configuration options.
    //

    // Open top-level key that has write access.
    if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
                    SP_REG_KEY_BASE,
                    0,
                    KEY_READ | KEY_SET_VALUE,
                    &hWriteKey) != STATUS_SUCCESS)
    {
        hWriteKey = 0;
    }

    // "EventLogging"
    if(ReadRegistrySetting(
        g_hkBase,
        hWriteKey,
        SP_REG_VAL_EVENTLOG,
        &g_dwEventLogging,
        DEFAULT_EVENT_LOGGING_SETTING))
    {
        fSettingsChanged = TRUE;
    }

    // "ManualCredValidation"
    if(ReadRegistrySetting(
        g_hkBase,
        0,
        SP_REG_VAL_MANUAL_CRED_VALIDATION,
        &g_fManualCredValidation,
        MANUAL_CRED_VALIDATION_SETTING))
    {
        fSettingsChanged = TRUE;
    }

    // "ClientCacheTime"
    if(ReadRegistrySetting(
        g_hkBase,
        0,
        SP_REG_VAL_CLIENT_CACHE_TIME,
        &SchannelCache.dwClientLifespan,
        SP_CACHE_CLIENT_LIFESPAN))
    {
        fSettingsChanged = TRUE;
    }

    // "ServerCacheTime"
    if(ReadRegistrySetting(
        g_hkBase,
        0,
        SP_REG_VAL_SERVER_CACHE_TIME,
        &SchannelCache.dwServerLifespan,
        SP_CACHE_SERVER_LIFESPAN))
    {
        fSettingsChanged = TRUE;
    }

    // "MaximumCacheSize"
    if(ReadRegistrySetting(
        g_hkBase,
        0,
        SP_REG_VAL_MAXUMUM_CACHE_SIZE,
        &SchannelCache.dwMaximumEntries,
        SP_MAXIMUM_CACHE_ELEMENTS))
    {
        fSettingsChanged = TRUE;
    }

    if(fFirstTime)
    {
        SchannelCache.dwCacheSize = SchannelCache.dwMaximumEntries;
    }

    // "MultipleProcessClientCache"
    if(ReadRegistrySetting(
        g_hkBase,
        0,
        SP_REG_VAL_MULTI_PROC_CLIENT_CACHE,
        &g_fMultipleProcessClientCache,
        FALSE))
    {
        fSettingsChanged = TRUE;
    }

    if(hWriteKey)
    {
        RegCloseKey(hWriteKey);
        hWriteKey = 0;
    }


    //
    // Enable/Disable Protocols
    //

    if(fFipsMode)
    {
        // Disable everything except TLS.
        g_ProtEnabled = SP_PROT_TLS1;
    }
    else
    {
        DWORD dwProtEnabled = DEFAULT_ENABLED_PROTOCOLS_SETTING; 

        err = RegCreateKeyEx(   g_hkBase,
                                SP_REG_KEY_PROTOCOL,
                                0,
                                TEXT(""),
                                REG_OPTION_NON_VOLATILE,
                                KEY_READ,
                                NULL,
                                &hkProtocols,
                                &disp);

        if(err == ERROR_SUCCESS)
        {
            for(i=0; i < (sizeof(g_ProtMap)/sizeof(enamap)); i++)
            {
                if(g_ProtMap[i].Mask & SP_PROT_PCT1)
                {
                    if(g_fFranceLocale)
                    {
                        // Don't allow PCT to be enabled in France.
                        continue;
                    }
                }

                err = RegCreateKeyEx(   hkProtocols,
                                        g_ProtMap[i].pKey,
                                        0,
                                        TEXT(""),
                                        REG_OPTION_NON_VOLATILE,
                                        KEY_READ,
                                        NULL,
                                        &hKey,
                                        &disp);
                if(!err)
                {
                    dwSize = sizeof(DWORD);
                    err = RegQueryValueEx(hKey, SP_REG_VAL_ENABLED, NULL, &dwType, (PUCHAR)&fVal, &dwSize);

                    if(!err)
                    {
                        if(fVal)
                        {
                            dwProtEnabled |= g_ProtMap[i].Mask;
                        }
                        else
                        {
                            dwProtEnabled &= ~g_ProtMap[i].Mask;
                        }
                    }

                    if(g_ProtMap[i].Mask & SP_PROT_PCT1_CLIENT)
                    {
                        // "DisabledByDefault"
                        ReadRegistrySetting(
                            hKey,
                            0,
                            SP_REG_VAL_DISABLED_BY_DEFAULT,
                            &g_PctClientDisabledByDefault,
                            PCT_CLIENT_DISABLED_SETTING);
                    }
                    if(g_ProtMap[i].Mask & SP_PROT_SSL2_CLIENT)
                    {
                        // "DisabledByDefault"
                        ReadRegistrySetting(
                            hKey,
                            0,
                            SP_REG_VAL_DISABLED_BY_DEFAULT,
                            &g_Ssl2ClientDisabledByDefault,
                            SSL2_CLIENT_DISABLED_SETTING);
                    }

                    RegCloseKey(hKey);
                }
            }

            RegCloseKey(hkProtocols);
        }

        if(g_ProtEnabled != dwProtEnabled)
        {
            g_ProtEnabled = dwProtEnabled;
            fSettingsChanged = TRUE;
        }
    }


    //
    // Enable/Disable Ciphers
    //

    if(fFipsMode)
    {
        // Disable everything except 3DES.
        for(i=0; i < g_cAvailableCiphers; i++)
        {
            if(g_AvailableCiphers[i].aiCipher != CALG_3DES)
            {
                g_AvailableCiphers[i].fProtocol = 0;
            }
        }
    }
    else
    {
        err = RegCreateKeyEx(   g_hkBase,
                                SP_REG_KEY_CIPHERS,
                                0,
                                TEXT(""),
                                REG_OPTION_NON_VOLATILE,
                                KEY_READ,
                                NULL,
                                &hkCiphers,
                                &disp);

        if(err == ERROR_SUCCESS)
        {
            for(i=0; i < g_cAvailableCiphers; i++)
            {
                dwOriginalValue = g_AvailableCiphers[i].fProtocol;

                g_AvailableCiphers[i].fProtocol = g_AvailableCiphers[i].fDefault;
                fVal = g_AvailableCiphers[i].fDefault;
                err = RegCreateKeyExA(  hkCiphers,
                                        g_AvailableCiphers[i].szName,
                                        0,
                                        "",
                                        REG_OPTION_NON_VOLATILE,
                                        KEY_READ,
                                        NULL,
                                        &hKey,
                                        &disp);
                if(!err)
                {
                    dwSize = sizeof(DWORD);
                    err = RegQueryValueEx(hKey, SP_REG_VAL_ENABLED, NULL, &dwType, (PUCHAR)&fVal, &dwSize);

                    if(err)
                    {
                        fVal = g_AvailableCiphers[i].fDefault;
                    }
                    RegCloseKey(hKey);
                }
                g_AvailableCiphers[i].fProtocol &= fVal;

                if(g_AvailableCiphers[i].fProtocol != dwOriginalValue)
                {
                    fSettingsChanged = TRUE;
                }
            }

            RegCloseKey(hkCiphers);
        }
    }


    //
    // Enable/Disable Hashes
    //

    err = RegCreateKeyEx(   g_hkBase,
                            SP_REG_KEY_HASHES,
                            0,
                            TEXT(""),
                            REG_OPTION_NON_VOLATILE,
                            KEY_READ,
                            NULL,
                            &hkHashes,
                            &disp);

    if(err == ERROR_SUCCESS)
    {
        for(i = 0; i < g_cAvailableHashes; i++)
        {
            dwOriginalValue = g_AvailableHashes[i].fProtocol;

            g_AvailableHashes[i].fProtocol = g_AvailableHashes[i].fDefault;
            fVal = g_AvailableHashes[i].fDefault;
            err = RegCreateKeyExA(  hkHashes,
                                    g_AvailableHashes[i].szName,
                                    0,
                                    "",
                                    REG_OPTION_NON_VOLATILE,
                                    KEY_READ,
                                    NULL,
                                    &hKey,
                                    &disp);
            if(!err)
            {
                dwSize = sizeof(DWORD);
                err = RegQueryValueEx(hKey, SP_REG_VAL_ENABLED, NULL, &dwType, (PUCHAR)&fVal, &dwSize);

                if(err)
                {
                    fVal = g_AvailableHashes[i].fDefault;
                }
                RegCloseKey(hKey);
            }
            g_AvailableHashes[i].fProtocol &= fVal;

            if(dwOriginalValue != g_AvailableHashes[i].fProtocol)
            {
                fSettingsChanged = TRUE;
            }
        }

        RegCloseKey(hkHashes);
    }


    //
    // Enable/Disable Key Exchange algs.
    //

    if(fFipsMode)
    {
        // Disable everything except RSA.
        for(i=0; i < g_cAvailableExch; i++)
        {
            if(g_AvailableExch[i].aiExch != CALG_RSA_KEYX && 
               g_AvailableExch[i].aiExch != CALG_RSA_SIGN)
            {
                g_AvailableExch[i].fProtocol = 0;
            }
        }
    }
    else
    {
        err = RegCreateKeyEx(   g_hkBase,
                                SP_REG_KEY_KEYEXCH,
                                0,
                                TEXT(""),
                                REG_OPTION_NON_VOLATILE,
                                KEY_READ,
                                NULL,
                                &hkKeyExch,
                                &disp);

        if(err == ERROR_SUCCESS)
        {
            for(i = 0; i < g_cAvailableExch; i++)
            {
                dwOriginalValue = g_AvailableExch[i].fProtocol;

                g_AvailableExch[i].fProtocol = g_AvailableExch[i].fDefault;
                fVal = g_AvailableExch[i].fDefault;
                err = RegCreateKeyExA(  hkKeyExch,
                                        g_AvailableExch[i].szName,
                                        0,
                                        "",
                                        REG_OPTION_NON_VOLATILE,
                                        KEY_READ,
                                        NULL,
                                        &hKey,
                                        &disp);
                if(!err)
                {
                    dwSize = sizeof(DWORD);
                    err = RegQueryValueEx(hKey, SP_REG_VAL_ENABLED, NULL, &dwType, (PUCHAR)&fVal, &dwSize);

                    if(err)
                    {
                        fVal = g_AvailableExch[i].fDefault;
                    }
                    g_AvailableExch[i].fProtocol &= fVal;

                    RegCloseKey(hKey);
                }

                if(dwOriginalValue != g_AvailableExch[i].fProtocol)
                {
                    fSettingsChanged = TRUE;
                }
            }

            RegCloseKey(hkKeyExch);
        }
    }

    //
    // Purge the session cache.
    //

    if(g_fCacheInitialized && fSettingsChanged)
    {
        SPCachePurgeEntries(NULL,
                            0,
                            NULL,
                            SSL_PURGE_CLIENT_ALL_ENTRIES |
                            SSL_PURGE_SERVER_ALL_ENTRIES);
    }

    return TRUE;
}