//+-------------------------------------------------------------------------
//
// Microsoft Windows
//
// Copyright (C) Microsoft Corporation, 1996 - 1999
//
// File: trustapi.cpp
//
// Contents: Microsoft Internet Security Trust APIs
//
// Functions: TrustFindIssuerCertificate
// TrustOpenStores
// TrustDecode
// TrustFreeDecode
//
// *** local functions ***
// _CompareAuthKeyId
// _CompareAuthKeyId2
// _SetCertErrorAndHygiene
// _GetExternalIssuerCert
//
// History: 20-Nov-1997 pberkman created
//
//--------------------------------------------------------------------------
#include "global.hxx"
BOOL _CompareAuthKeyId(DWORD dwEncoding, PCCERT_CONTEXT pChildContext,
PCCERT_CONTEXT pParentContext);
BOOL _CompareAuthKeyId2(DWORD dwEncoding, PCCERT_CONTEXT pChildContext,
PCCERT_CONTEXT pParentContext);
BOOL _SetCertErrorAndHygiene(PCCERT_CONTEXT pSubjectContext,
PCCERT_CONTEXT pIssuerContext,
DWORD dwCurrentConfidence, DWORD *pdwError);
PCCERT_CONTEXT _GetExternalIssuerCert(PCCERT_CONTEXT pContext,
DWORD dwEncoding,
DWORD *pdwRetError,
DWORD *pdwConfidence,
FILETIME *psftVerifyAsOf);
void _SetConfidenceOnIssuer(DWORD dwEncoding, PCCERT_CONTEXT pChildCert, PCCERT_CONTEXT pTestIssuerCert,
DWORD dwVerificationFlag, FILETIME *psftVerifyAsOf, DWORD *pdwConfidence,
DWORD *pdwError);
PCCERT_CONTEXT WINAPI TrustFindIssuerCertificate(PCCERT_CONTEXT pChildContext,
DWORD dwEncoding,
DWORD chStores,
HCERTSTORE *pahStores,
FILETIME *psftVerifyAsOf,
DWORD *pdwConfidence,
DWORD *pdwError,
DWORD dwFlags)
{
if (!(pChildContext) ||
!(pahStores) ||
!(psftVerifyAsOf) ||
(dwFlags != 0))
{
SetLastError(ERROR_INVALID_PARAMETER);
return(NULL);
}
PCCERT_CONTEXT pCertContext;
DWORD fdwRetError;
DWORD fdwWork;
DWORD dwError;
PCCERT_CONTEXT pCertWithHighestConfidence;
DWORD dwHighestConfidence;
DWORD dwConfidence;
if (pdwError)
{
*pdwError = ERROR_SUCCESS;
}
dwConfidence = 0;
dwHighestConfidence = 0;
pCertWithHighestConfidence = NULL;
fdwRetError = 0;
fdwWork = 0;
for (int i = 0; i < (int)chStores; i++)
{
fdwWork = CERT_STORE_SIGNATURE_FLAG;
pCertContext = NULL;
while (pCertContext = CertGetIssuerCertificateFromStore(pahStores[i],
pChildContext,
pCertContext,
&fdwWork))
{
_SetConfidenceOnIssuer(dwEncoding, pChildContext, pCertContext, fdwWork,
psftVerifyAsOf, &dwConfidence, &dwError);
if (dwConfidence > dwHighestConfidence)
{
if (pCertWithHighestConfidence)
{
CertFreeCertificateContext(pCertWithHighestConfidence);
}
dwHighestConfidence = dwConfidence;
pCertWithHighestConfidence = CertDuplicateCertificateContext(pCertContext);
fdwRetError = dwError;
}
if (dwConfidence >= CERT_CONFIDENCE_HIGHEST)
{
if (pdwError)
{
*pdwError = dwError;
}
if (pdwConfidence)
{
*pdwConfidence = dwConfidence;
}
CertFreeCertificateContext(pCertContext);
return(pCertWithHighestConfidence);
}
fdwWork = CERT_STORE_SIGNATURE_FLAG;
}
}
if (!(dwHighestConfidence & CERT_CONFIDENCE_HYGIENE))
{
if (pCertContext = _GetExternalIssuerCert(pChildContext,
dwEncoding,
&fdwRetError,
&dwConfidence,
psftVerifyAsOf))
{
if (dwHighestConfidence < dwConfidence)
{
CertFreeCertificateContext(pCertWithHighestConfidence);
pCertWithHighestConfidence = pCertContext;
dwHighestConfidence = dwConfidence;
}
}
}
if (pdwError)
{
*pdwError = fdwRetError;
}
if (pdwConfidence)
{
*pdwConfidence = dwHighestConfidence;
}
return(pCertWithHighestConfidence);
}
BOOL WINAPI TrustOpenStores(HCRYPTPROV hProv, OUT DWORD *pchStores,
HCERTSTORE *pahStores, DWORD dwFlags)
{
BOOL fRet;
DWORD cs = 0;
HCERTSTORE pas[WVT_STOREID_MAX];
fRet = FALSE;
if (!(pchStores) ||
(dwFlags != 0))
{
goto ErrorInvalidParam;
}
//
// ROOT store - ALWAYS #0 !!!!
//
if (!(pas[cs] = StoreProviderGetStore(hProv, WVT_STOREID_ROOT)))
{
goto ErrorNoRootStore;
}
cs++;
if (pas[cs] = StoreProviderGetStore(hProv, WVT_STOREID_TRUST))
{
cs++;
}
if (pas[cs] = StoreProviderGetStore(hProv, WVT_STOREID_CA))
{
cs++;
}
if (pas[cs] = StoreProviderGetStore(hProv, WVT_STOREID_MY))
{
cs++;
}
if ((pahStores) && (cs > *pchStores))
{
*pchStores = cs;
goto ErrorMoreData;
}
*pchStores = cs;
fRet = TRUE;
if (!(pahStores))
{
goto ErrorMoreData;
}
DWORD i;
for (i = 0; i < cs; i++)
{
pahStores[i] = pas[i];
}
CommonReturn:
return(fRet);
ErrorReturn:
while (cs > 0)
{
CertCloseStore(pas[cs - 1], 0);
cs--;
}
goto CommonReturn;
SET_ERROR_VAR_EX(DBG_SS, ErrorMoreData, ERROR_MORE_DATA);
SET_ERROR_VAR_EX(DBG_SS, ErrorNoRootStore, TRUST_E_SYSTEM_ERROR);
SET_ERROR_VAR_EX(DBG_SS, ErrorInvalidParam, ERROR_INVALID_PARAMETER);
}
BOOL WINAPI TrustIsCertificateSelfSigned(PCCERT_CONTEXT pContext,
DWORD dwEncoding,
DWORD dwFlags)
{
if (!(pContext) ||
(dwFlags != 0))
{
SetLastError(ERROR_INVALID_PARAMETER);
return(FALSE);
}
if (!(CertCompareCertificateName(dwEncoding,
&pContext->pCertInfo->Issuer,
&pContext->pCertInfo->Subject)))
{
return(FALSE);
}
DWORD dwFlag;
dwFlag = CERT_STORE_SIGNATURE_FLAG;
if (!(CertVerifySubjectCertificateContext(pContext, pContext, &dwFlag)) ||
(dwFlag & CERT_STORE_SIGNATURE_FLAG))
{
return(FALSE);
}
return(TRUE);
}
#define sz_CRYPTNET_DLL "cryptnet.dll"
#define sz_CryptGetObjectUrl "CryptGetObjectUrl"
#define sz_CryptRetrieveObjectByUrlW "CryptRetrieveObjectByUrlW"
typedef BOOL (WINAPI *PFN_CRYPT_GET_OBJECT_URL)(
IN LPCSTR pszUrlOid,
IN LPVOID pvPara,
IN DWORD dwFlags,
OUT OPTIONAL PCRYPT_URL_ARRAY pUrlArray,
IN OUT DWORD* pcbUrlArray,
OUT OPTIONAL PCRYPT_URL_INFO pUrlInfo,
IN OUT OPTIONAL DWORD* pcbUrlInfo,
IN OPTIONAL LPVOID pvReserved
);
typedef BOOL (WINAPI *PFN_CRYPT_RETRIEVE_OBJECT_BY_URLW)(
IN LPCWSTR pszUrl,
IN LPCSTR pszObjectOid,
IN DWORD dwRetrievalFlags,
IN DWORD dwTimeout,
OUT LPVOID* ppvObject,
IN HCRYPTASYNC hAsyncRetrieve,
IN OPTIONAL PCRYPT_CREDENTIALS pCredentials,
IN OPTIONAL LPVOID pvVerify,
IN OPTIONAL LPVOID pvReserved
);
PCCERT_CONTEXT _GetExternalIssuerCert(PCCERT_CONTEXT pContext,
DWORD dwEncoding,
DWORD *pdwRetError,
DWORD *pdwConfidence,
FILETIME *psftVerifyAsOf)
{
*pdwConfidence = 0;
#if (USE_IEv4CRYPT32)
return(NULL);
#else
DWORD cbUrlArray;
CRYPT_URL_ARRAY *pUrlArray;
PCCERT_CONTEXT pIssuer;
PCCERT_CONTEXT pCertBestMatch;
DWORD dwHighestConfidence;
DWORD dwConfidence;
DWORD dwStatus;
DWORD dwError;
DWORD i;
pCertBestMatch = NULL;
pIssuer = NULL;
pUrlArray = NULL;
cbUrlArray = 0;
dwHighestConfidence = 0;
HMODULE hDll = NULL;
PFN_CRYPT_GET_OBJECT_URL pfnCryptGetObjectUrl;
PFN_CRYPT_RETRIEVE_OBJECT_BY_URLW pfnCryptRetrieveObjectByUrlW;
if (NULL == (hDll = LoadLibraryA(sz_CRYPTNET_DLL)))
goto LoadCryptNetDllError;
if (NULL == (pfnCryptGetObjectUrl =
(PFN_CRYPT_GET_OBJECT_URL) GetProcAddress(hDll,
sz_CryptGetObjectUrl)))
goto CryptGetObjectUrlProcAddressError;
if (NULL == (pfnCryptRetrieveObjectByUrlW =
(PFN_CRYPT_RETRIEVE_OBJECT_BY_URLW) GetProcAddress(hDll,
sz_CryptRetrieveObjectByUrlW)))
goto CryptRetrieveObjectByUrlWProcAddressError;
if (!(pfnCryptGetObjectUrl(URL_OID_CERTIFICATE_ISSUER, (void *)pContext, 0, NULL, &cbUrlArray, NULL, NULL, NULL)) ||
(cbUrlArray < 1))
{
goto GetObjectUrlFailed;
}
if (!(pUrlArray = (CRYPT_URL_ARRAY *) new BYTE[cbUrlArray]))
{
goto MemoryError;
}
memset(pUrlArray, 0x00, cbUrlArray);
if (!(pfnCryptGetObjectUrl(URL_OID_CERTIFICATE_ISSUER, (void *)pContext, 0, pUrlArray, &cbUrlArray, NULL, NULL, NULL)))
{
goto GetObjectUrlFailed;
}
for (i = 0; i < pUrlArray->cUrl; i++)
{
if (pIssuer)
{
CertFreeCertificateContext(pIssuer);
pIssuer = NULL;
}
if (pfnCryptRetrieveObjectByUrlW(pUrlArray->rgwszUrl[i], CONTEXT_OID_CERTIFICATE, 0, 0, (void **)&pIssuer,
NULL, NULL, NULL, NULL))
{
if (!(CertCompareCertificateName(X509_ASN_ENCODING, &pContext->pCertInfo->Issuer,
&pIssuer->pCertInfo->Subject)))
{
continue;
}
dwStatus = CERT_STORE_SIGNATURE_FLAG;
if (!(CertVerifySubjectCertificateContext(pContext, pIssuer, &dwStatus)))
{
continue;
}
dwError = 0;
_SetConfidenceOnIssuer(dwEncoding, pContext, pIssuer, dwStatus, psftVerifyAsOf,
&dwConfidence, &dwError);
if (dwError != 0)
{
continue;
}
if (dwConfidence > dwHighestConfidence)
{
if (pCertBestMatch)
{
CertFreeCertificateContext(pCertBestMatch);
}
dwHighestConfidence = dwConfidence;
pCertBestMatch = CertDuplicateCertificateContext(pIssuer);
}
if (dwConfidence >= CERT_CONFIDENCE_HIGHEST)
{
goto CommonReturn;
}
}
}
goto RetrieveObjectFailed;
CommonReturn:
if (hDll)
FreeLibrary(hDll);
if (pIssuer)
{
CertFreeCertificateContext(pIssuer);
}
if (pUrlArray)
{
delete pUrlArray;
}
*pdwConfidence = dwHighestConfidence;
return(pCertBestMatch);
ErrorReturn:
if (pCertBestMatch)
{
CertFreeCertificateContext(pCertBestMatch);
pCertBestMatch = NULL;
}
goto CommonReturn;
TRACE_ERROR_EX(DBG_SS, LoadCryptNetDllError)
TRACE_ERROR_EX(DBG_SS, CryptGetObjectUrlProcAddressError)
TRACE_ERROR_EX(DBG_SS, CryptRetrieveObjectByUrlWProcAddressError)
TRACE_ERROR_EX(DBG_SS, GetObjectUrlFailed);
TRACE_ERROR_EX(DBG_SS, RetrieveObjectFailed);
SET_ERROR_VAR_EX(DBG_SS, MemoryError, ERROR_NOT_ENOUGH_MEMORY);
#endif // USE_IEv4CRYPT32
}
BOOL WINAPI TrustDecode(DWORD dwModuleId, BYTE **ppbRet, DWORD *pcbRet, DWORD cbHint,
DWORD dwEncoding, const char *pcszOID, const BYTE *pbEncoded, DWORD cbEncoded,
DWORD dwDecodeFlags)
{
if (!(*ppbRet = new BYTE[cbHint]))
{
goto MemoryError;
}
*pcbRet = cbHint;
if (!(CryptDecodeObject(dwEncoding, pcszOID, pbEncoded, cbEncoded, dwDecodeFlags,
*ppbRet, pcbRet)))
{
if (GetLastError() != ERROR_MORE_DATA)
{
goto DecodeError;
}
}
if (cbHint < *pcbRet)
{
DBG_PRINTF((DBG_SS, "****** TrustDecode(0x%08.8lX): recalling due to bad size: hint: %lu actual: %lu\r\n",
dwModuleId, cbHint, *pcbRet));
DELETE_OBJECT(*ppbRet);
return(TrustDecode(dwModuleId, ppbRet, pcbRet, *pcbRet, dwEncoding, pcszOID,
pbEncoded, cbEncoded, dwDecodeFlags));
}
# if DBG
if ((cbHint / 3) > *pcbRet)
{
DBG_PRINTF((DBG_SS, "TrustDecode(0x%08.8lX): hint too big. hint: %lu actual: %lu\r\n",
dwModuleId, cbHint, *pcbRet));
}
# endif
return(TRUE);
ErrorReturn:
DELETE_OBJECT(*ppbRet);
return(FALSE);
TRACE_ERROR_EX(DBG_SS, DecodeError);
SET_ERROR_VAR_EX(DBG_SS, MemoryError, ERROR_NOT_ENOUGH_MEMORY);
}
BOOL WINAPI TrustFreeDecode(DWORD dwModuleId, BYTE **pbAllocated)
{
DELETE_OBJECT(*pbAllocated);
return(TRUE);
}
void _SetConfidenceOnIssuer(DWORD dwEncoding, PCCERT_CONTEXT pChildCert, PCCERT_CONTEXT pTestIssuerCert,
DWORD dwVerificationFlag, FILETIME *psftVerifyAsOf, DWORD *pdwConfidence,
DWORD *pdwError)
{
*pdwConfidence = 0;
if (!(dwVerificationFlag & CERT_STORE_SIGNATURE_FLAG))
{
*pdwConfidence |= CERT_CONFIDENCE_SIG;
}
if (CertVerifyTimeValidity(psftVerifyAsOf, pTestIssuerCert->pCertInfo) == 0)
{
*pdwConfidence |= CERT_CONFIDENCE_TIME;
}
if (CertVerifyValidityNesting(pChildCert->pCertInfo, pTestIssuerCert->pCertInfo))
{
*pdwConfidence |= CERT_CONFIDENCE_TIMENEST;
}
if (_CompareAuthKeyId(dwEncoding, pChildCert, pTestIssuerCert))
{
*pdwConfidence |= CERT_CONFIDENCE_AUTHIDEXT;
}
else if (_CompareAuthKeyId2(dwEncoding, pChildCert, pTestIssuerCert))
{
*pdwConfidence |= CERT_CONFIDENCE_AUTHIDEXT;
}
if (_SetCertErrorAndHygiene(pChildCert, pTestIssuerCert, *pdwConfidence, pdwError))
{
*pdwConfidence |= CERT_CONFIDENCE_HYGIENE;
}
}
BOOL _SetCertErrorAndHygiene(PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pIssuerContext,
DWORD dwCurrentConfidence, DWORD *pdwError)
{
*pdwError = ERROR_SUCCESS;
if (!(dwCurrentConfidence & CERT_CONFIDENCE_SIG))
{
*pdwError = TRUST_E_CERT_SIGNATURE;
return(FALSE);
}
if ((dwCurrentConfidence & CERT_CONFIDENCE_SIG) &&
(dwCurrentConfidence & CERT_CONFIDENCE_TIME) &&
(dwCurrentConfidence & CERT_CONFIDENCE_TIMENEST) &&
(dwCurrentConfidence & CERT_CONFIDENCE_AUTHIDEXT))
{
return(TRUE);
}
if (dwCurrentConfidence & CERT_CONFIDENCE_AUTHIDEXT)
{
return(TRUE);
}
return(FALSE);
}
BOOL _CompareAuthKeyId2(DWORD dwEncoding, PCCERT_CONTEXT pChildContext, PCCERT_CONTEXT pParentContext)
{
DWORD i;
PCERT_EXTENSION pExt;
DWORD cbIdInfo;
PCERT_AUTHORITY_KEY_ID2_INFO pIdInfo;
BOOL fRet;
pIdInfo = NULL;
if (pChildContext->pCertInfo->cExtension < 1)
{
goto NoExtensions;
}
if (!(pExt = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2, pChildContext->pCertInfo->cExtension,
pChildContext->pCertInfo->rgExtension)))
{
goto NoExtensions;
}
if (!(TrustDecode(WVT_MODID_WINTRUST, (BYTE **)&pIdInfo, &cbIdInfo, 103,
dwEncoding, X509_AUTHORITY_KEY_ID2, pExt->Value.pbData, pExt->Value.cbData,
CRYPT_DECODE_NOCOPY_FLAG)))
{
goto DecodeFailed;
}
for (i = 0; i < pIdInfo->AuthorityCertIssuer.cAltEntry; i++)
{
if (pIdInfo->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice ==
CERT_ALT_NAME_DIRECTORY_NAME)
{
break;
}
}
if (i == pIdInfo->AuthorityCertIssuer.cAltEntry)
{
goto NoAltDirectoryName;
}
if (!(CertCompareCertificateName(dwEncoding,
&pIdInfo->AuthorityCertIssuer.rgAltEntry[i].DirectoryName,
&pParentContext->pCertInfo->Issuer)))
{
goto IncorrectIssuer;
}
//
// issuer certificate's serial number must match
//
if (!(CertCompareIntegerBlob(&pIdInfo->AuthorityCertSerialNumber,
&pParentContext->pCertInfo->SerialNumber)))
{
goto IncorrectIssuer;
}
fRet = TRUE;
CommonReturn:
if (pIdInfo)
{
TrustFreeDecode(WVT_MODID_WINTRUST, (BYTE **)&pIdInfo);
}
return(fRet);
ErrorReturn:
fRet = FALSE;
goto CommonReturn;
TRACE_ERROR_EX(DBG_SS, NoExtensions);
TRACE_ERROR_EX(DBG_SS, DecodeFailed);
TRACE_ERROR_EX(DBG_SS, IncorrectIssuer);
TRACE_ERROR_EX(DBG_SS, NoAltDirectoryName);
}
BOOL _CompareAuthKeyId(DWORD dwEncoding, PCCERT_CONTEXT pChildContext, PCCERT_CONTEXT pParentContext)
{
PCERT_EXTENSION pExt;
PCERT_AUTHORITY_KEY_ID_INFO pChildKeyIdInfo;
DWORD cbKeyIdInfo;
BOOL fRet;
pChildKeyIdInfo = NULL;
pExt = NULL;
if (pChildContext->pCertInfo->cExtension < 1)
{
goto NoExtensions;
}
pChildKeyIdInfo = NULL;
if (!(pExt = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
pChildContext->pCertInfo->cExtension,
pChildContext->pCertInfo->rgExtension)))
{
goto NoExtensions;
}
if (!(TrustDecode(WVT_MODID_WINTRUST, (BYTE **)&pChildKeyIdInfo, &cbKeyIdInfo, 104,
dwEncoding, X509_AUTHORITY_KEY_ID, pExt->Value.pbData, pExt->Value.cbData,
CRYPT_DECODE_NOCOPY_FLAG)))
{
goto DecodeFailed;
}
if ((pChildKeyIdInfo->CertIssuer.cbData < 1) ||
(pChildKeyIdInfo->CertSerialNumber.cbData < 1))
{
goto NoKeyId;
}
//
// issuer certificate's issuer name must match
//
if (!(CertCompareCertificateName(dwEncoding, &pChildKeyIdInfo->CertIssuer,
&pParentContext->pCertInfo->Issuer)))
{
goto IncorrectIssuer;
}
//
// issuer certificate's serial number must match
//
if (!(CertCompareIntegerBlob(&pChildKeyIdInfo->CertSerialNumber,
&pParentContext->pCertInfo->SerialNumber)))
{
goto IncorrectIssuer;
}
fRet = TRUE;
CommonReturn:
if (pChildKeyIdInfo)
{
TrustFreeDecode(WVT_MODID_WINTRUST, (BYTE **)&pChildKeyIdInfo);
}
return(fRet);
ErrorReturn:
fRet = FALSE;
goto CommonReturn;
TRACE_ERROR_EX(DBG_SS, NoExtensions);
TRACE_ERROR_EX(DBG_SS, DecodeFailed);
TRACE_ERROR_EX(DBG_SS, NoKeyId);
TRACE_ERROR_EX(DBG_SS, IncorrectIssuer);
}