/*++
Copyright (c) 1995 Microsoft Corporation
Module Name:
httpfilt.cxx
Abstract:
This module contains the code to create or set the HTTP PCT/SSL keys and
password
Author:
John Ludeman (johnl) 19-Oct-1995
Revision History:
--*/
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#include <ntsecapi.h>
#include <windows.h>
#define SECURITY_WIN32
#include <sspi.h>
#include <spseal.h>
#include <issperr.h>
#include <sslsp.h>
#include <w3svc.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <io.h>
#include <strings.h>
//
// macros
//
#define IS_ARG(c) ((c) == L'-' || (c) == L'/')
#define TO_UNICODE( pch, ach ) \
MultiByteToWideChar( CP_ACP, MB_PRECOMPOSED, (pch), -1, (ach), sizeof((ach))/sizeof(WCHAR))
#define TO_ANSI( pch, ach ) \
WideCharToMultiByte( CP_ACP, WC_COMPOSITECHECK, pch, -1, ach, sizeof(ach), 0, 0 )
//
// Private constants.
//
//
// Private types.
//
BOOL fUUDecode = TRUE;
//
// Private prototypes.
//
DWORD
SetRegKeys(
IN LPWSTR pszServer,
IN LPWSTR pszPrivateKeyFile,
IN LPWSTR pszCertificateFile,
IN LPWSTR pszPassword,
IN LPWSTR pszAddress
);
BOOL
SetKeySecret(
WCHAR * pszServer,
WCHAR * pszFormat,
WCHAR * pszAddress,
VOID * pvData,
DWORD cbData
);
void usage();
VOID
uudecode_cert(
char * bufcoded,
DWORD * pcbDecoded
);
VOID
printfids(
DWORD ids,
...
);
DWORD
DeleteAll(
WCHAR * pszServer
);
BOOL
TsGetSecretW(
WCHAR * pszSecretName,
WCHAR * * ppchValue
);
//
// Public functions.
//
int
__cdecl
main(
int argc,
char * argv[]
)
{
DWORD err;
CHAR buff[MAX_PATH+1];
BOOL fDeleteAll = FALSE;
LPWSTR password = NULL;
LPWSTR privatekey = NULL;
LPWSTR cert = NULL;
LPWSTR address = NULL;
LPWSTR server = NULL;
WCHAR achpassword[MAX_PATH+1];
WCHAR achprivatekey[MAX_PATH+1];
WCHAR achcert[MAX_PATH+1];
WCHAR achaddress[MAX_PATH+1];
WCHAR achserver[MAX_PATH+1];
printfids( IDS_BANNER1 );
printfids( IDS_BANNER2 );
for (--argc, ++argv; argc; --argc, ++argv) {
if (IS_ARG(**argv)) {
switch (*++*argv) {
case 'u':
case 'U':
fUUDecode = FALSE;
break;
case 'd':
case 'D':
fDeleteAll = TRUE;
break;
default:
printfids( IDS_BAD_FLAG, **argv );
usage();
}
} else if ( !server && (*argv)[0] == L'\\' && (*argv)[1] == L'\\'
&& !password ) {
TO_UNICODE( (*argv) + 2, achserver );
server = achserver;
} else if (!password) {
TO_UNICODE( *argv, achpassword );
password = achpassword;
} else if (!privatekey) {
TO_UNICODE( *argv, achprivatekey );
privatekey = achprivatekey;
} else if (!cert) {
TO_UNICODE( *argv, achcert );
cert = achcert;
} else if (!address) {
TO_UNICODE( *argv, achaddress );
address = achaddress;
} else {
printfids( IDS_BAD_ARG, *argv);
usage();
}
}
if ( fDeleteAll )
{
return DeleteAll( server );
}
//
// Address and server are optional
//
if (!(password && privatekey && cert)) {
printfids( IDS_MISSING_ARG );
usage();
}
if ( err = SetRegKeys( server, privatekey, cert, password, address ) )
{
printfids( IDS_FAILED_TO_SET );
}
else
{
if ( address )
{
TO_ANSI( address, buff );
printfids( IDS_SUCCESSFUL_SET,
buff );
}
else
{
printfids( IDS_SUCCESSFUL_SET_DEF );
}
}
return err;
} // main
void usage()
{
printfids( IDS_USAGE1 );
printfids( IDS_USAGE2 );
//printfids( IDS_USAGE3 ); // -p help
printfids( IDS_USAGE4 );
printfids( IDS_USAGE5 );
printfids( IDS_USAGE6 );
printfids( IDS_USAGE7 );
printfids( IDS_USAGE8 );
printfids( IDS_USAGE9 );
printfids( IDS_USAGE10 );
printfids( IDS_USAGE11 );
printfids( IDS_USAGE12 );
printfids( IDS_USAGE13 );
//printfids( IDS_USAGE14 ); // -p help
printfids( IDS_USAGE15 );
printfids( IDS_USAGE16 );
printfids( IDS_USAGE17 );
printfids( IDS_USAGE18 );
printfids( IDS_USAGE19 );
printfids( IDS_USAGE20 );
exit(1);
}
//+---------------------------------------------------------------------------
//
// Function: SetRegKeys
//
// Synopsis: This loads the data contained in two files, a private key
// file, which contains the key, and a certificate file,
// which contains the certificate of the public portion of the key.
// These are loaded, then turned into a credential handle, then
// set in the registry as secrets
//
// Arguments: [pszServer] -- Server to create secrets, NULL for local
// [pszPrivateKeyFile] -- Unicode file name
// [pszCertificateFile] -- Unicode file name
// [pszPassword] -- Unicode password
// [pszAddress] -- Unicode IP address for name or NULL
//
// History: 9-27-95 RichardW Created
//
// Notes:
//
//----------------------------------------------------------------------------
DWORD
SetRegKeys(
IN LPWSTR pszServer,
IN LPWSTR pszPrivateKeyFile,
IN LPWSTR pszCertificateFile,
IN LPWSTR pszPassword,
IN LPWSTR pszAddress
)
{
HANDLE hFile;
SSL_CREDENTIAL_CERTIFICATE creds;
DWORD cbRead;
SECURITY_STATUS scRet = 0;
TimeStamp tsExpiry;
CHAR achPassword[MAX_PATH + 1];
CredHandle hCreds;
DWORD cch;
CHAR buff[MAX_PATH+1];
//
// Fetch data from files:
//
hFile = CreateFileW( pszPrivateKeyFile,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
0,
NULL
);
if (hFile == INVALID_HANDLE_VALUE)
{
TO_ANSI( pszPrivateKeyFile, buff );
printfids( IDS_FILE_NOT_FOUND,
GetLastError(),
buff );
return GetLastError();
}
creds.cbPrivateKey = GetFileSize( hFile, NULL );
if (creds.cbPrivateKey == (DWORD) -1 )
{
CloseHandle( hFile );
return GetLastError();
}
creds.pPrivateKey = LocalAlloc( LMEM_FIXED, creds.cbPrivateKey );
if ( !creds.pPrivateKey )
{
CloseHandle( hFile );
return GetLastError();
}
if (! ReadFile( hFile,
creds.pPrivateKey,
creds.cbPrivateKey,
&cbRead,
NULL ) )
{
CloseHandle( hFile );
LocalFree( creds.pPrivateKey );
return GetLastError();
}
CloseHandle( hFile );
//
// Only the certificate is UUencoded
//
hFile = CreateFileW( pszCertificateFile,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
0,
NULL );
if (hFile == INVALID_HANDLE_VALUE)
{
TO_ANSI( pszCertificateFile, buff );
printfids( IDS_FILE_NOT_FOUND,
GetLastError(),
buff );
LocalFree( creds.pPrivateKey );
return GetLastError();
}
creds.cbCertificate = GetFileSize( hFile, NULL );
if (creds.cbCertificate == (DWORD) -1 )
{
CloseHandle( hFile );
LocalFree( creds.pPrivateKey );
return GetLastError();
}
creds.pCertificate = LocalAlloc( LMEM_FIXED, creds.cbCertificate + 1);
if ( !creds.pCertificate )
{
CloseHandle( hFile );
LocalFree( creds.pPrivateKey );
return GetLastError();
}
if (! ReadFile( hFile,
creds.pCertificate,
creds.cbCertificate,
&cbRead,
NULL ) )
{
CloseHandle( hFile );
LocalFree( creds.pPrivateKey );
LocalFree( creds.pCertificate );
return GetLastError();
}
CloseHandle( hFile );
//
// Zero terminate so we can uudecode
//
((BYTE *)creds.pCertificate)[cbRead] = '\0';
if ( fUUDecode )
{
uudecode_cert( creds.pCertificate,
&creds.cbCertificate );
}
//
// Whew! Now that we have safely loaded the keys from disk, get a cred
// handle based on the certificate/prv key combo
//
//
// BUGBUG - password field should be Unicode, do a quick conversion
// until structure is fixed
//
cch = TO_ANSI( pszPassword, achPassword );
if ( !cch )
{
return GetLastError();
}
creds.pszPassword = achPassword;
//
// Note we always do the credential check locally even if the server is
// remote. This means the local machine must have the correct security
// provider package installed.
//
#if 0
if ( !pszServer )
{
#endif
scRet = AcquireCredentialsHandleW( NULL, // My name (ignored)
SSLSP_NAME_W, // Package
SECPKG_CRED_INBOUND,// Use
NULL, // Logon Id (ign.)
&creds, // auth data
NULL, // dce-stuff
NULL, // dce-stuff
&hCreds, // Handle
&tsExpiry );
if ( FAILED(scRet) )
{
if ( scRet == SEC_E_NOT_OWNER )
{
printfids( IDS_BAD_PASSWORD );
}
else if ( scRet == SEC_E_SECPKG_NOT_FOUND )
{
printfids( IDS_SECPKG_NOT_FOUND );
}
else
{
printfids( IDS_KEYCHECK_FAILED,
scRet );
}
}
#if 0
}
else
{
printf("\nWarning! Bypassing credential check because target is remote\n");
}
#endif
//
// If we successfully acquired a credential handle, set the secrets
//
if ( !FAILED( scRet ))
{
if ( !pszServer )
{
FreeCredentialsHandle( &hCreds );
}
//
// Supply the default name if none was supplied
//
if ( !pszAddress )
pszAddress = L"Default";
//
// Set the secrets
//
if ( !SetKeySecret( pszServer,
L"W3_PUBLIC_KEY_%s",
pszAddress,
creds.pCertificate,
creds.cbCertificate ) ||
!SetKeySecret( pszServer,
L"W3_PRIVATE_KEY_%s",
pszAddress,
creds.pPrivateKey,
creds.cbPrivateKey ) ||
!SetKeySecret( pszServer,
L"W3_KEY_PASSWORD_%s",
pszAddress,
achPassword,
strlen( achPassword ) + 1) )
{
printfids( IDS_SETSECRET_FAILED,
GetLastError());
scRet = (SECURITY_STATUS) GetLastError();
}
else
{
WCHAR InstalledKeys[16384];
WCHAR * pchKeys;
*InstalledKeys = L'\0';
//
// Ok if this fails, it may not exist yet
//
if ( TsGetSecretW( W3_SSL_KEY_LIST_SECRET,
&pchKeys ))
{
wcscpy( InstalledKeys, pchKeys );
}
wcscat( InstalledKeys, pszAddress );
wcscat( InstalledKeys, L"," );
#if DBG
printf("New list: %S\n", InstalledKeys);
#endif
if ( !SetKeySecret( pszServer,
L"W3_KEY_LIST",
pszAddress,
InstalledKeys,
(wcslen( InstalledKeys ) + 1) * sizeof(WCHAR)))
{
#if DBG
printf("Warning: failed to set key list data, error %d\n");
#endif
scRet = (SECURITY_STATUS) GetLastError();
}
}
}
//
// Zero out and free the key data memory, on success or fail
//
ZeroMemory( creds.pPrivateKey, creds.cbPrivateKey );
ZeroMemory( creds.pCertificate, creds.cbCertificate );
ZeroMemory( achPassword, cch );
ZeroMemory( pszPassword, cch );
LocalFree( creds.pPrivateKey );
LocalFree( creds.pCertificate );
//
// Tell the caller about it.
//
return( scRet );
}
BOOL
SetKeySecret(
WCHAR * pszServer,
WCHAR * pszFormat,
WCHAR * pszAddress,
VOID * pvData,
DWORD cbData
)
{
BOOL fResult;
NTSTATUS ntStatus;
LSA_UNICODE_STRING unicodeName;
LSA_UNICODE_STRING unicodeSecret;
LSA_UNICODE_STRING unicodeServer;
LSA_HANDLE hPolicy;
LSA_OBJECT_ATTRIBUTES ObjectAttributes;
WCHAR achSecretName[MAX_PATH+1];
CHAR buff[MAX_PATH+1];
//
// Open a policy to the remote LSA
//
InitializeObjectAttributes( &ObjectAttributes,
NULL,
0L,
NULL,
NULL );
if ( pszServer )
{
unicodeServer.Buffer = pszServer;
unicodeServer.Length = wcslen( pszServer ) * sizeof(WCHAR);
unicodeServer.MaximumLength = unicodeServer.Length + sizeof(WCHAR);
}
ntStatus = LsaOpenPolicy( pszServer ? &unicodeServer : NULL,
&ObjectAttributes,
POLICY_ALL_ACCESS,
&hPolicy );
if ( !NT_SUCCESS( ntStatus ) )
{
SetLastError( LsaNtStatusToWinError( ntStatus ) );
TO_ANSI( pszServer, buff );
printfids(IDS_FAILED_OPENING_SERVER,
buff,
GetLastError() );
return FALSE;
}
//
// Build the secret name
//
wsprintfW( achSecretName,
pszFormat,
pszAddress );
unicodeSecret.Buffer = pvData;
unicodeSecret.Length = (USHORT) cbData;
unicodeSecret.MaximumLength = (USHORT) cbData;
unicodeName.Buffer = achSecretName;
unicodeName.Length = wcslen( achSecretName ) * sizeof(WCHAR);
unicodeName.MaximumLength = unicodeName.Length + sizeof(WCHAR);
//
// Query the secret value.
//
ntStatus = LsaStorePrivateData( hPolicy,
&unicodeName,
pvData ? &unicodeSecret : NULL );
fResult = NT_SUCCESS(ntStatus);
//
// Cleanup & exit.
//
LsaClose( hPolicy );
if ( !fResult )
SetLastError( LsaNtStatusToWinError( ntStatus ));
return fResult;
} // SetKeySecret
VOID
printfids(
DWORD ids,
...
)
{
CHAR szBuff[2048];
CHAR szString[2048];
va_list argList;
//
// Try and load the string
//
if ( !LoadString( GetModuleHandle( NULL ),
ids,
szString,
sizeof( szString ) ))
{
printf( "Error loading string ID %d\n",
ids );
return;
}
va_start( argList, ids );
vsprintf( szBuff, szString, argList );
va_end( argList );
printf( szBuff );
}
const int pr2six[256]={
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,62,64,64,64,63,
52,53,54,55,56,57,58,59,60,61,64,64,64,64,64,64,64,0,1,2,3,4,5,6,7,8,9,
10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,64,64,64,64,64,64,26,27,
28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64
};
//
// We have to squirt a record into the decoded stream
//
#define CERT_RECORD 13
#define CERT_SIZE_HIBYTE 2 // Index into record of record size
#define CERT_SIZE_LOBYTE 3
unsigned char abCertHeader[] = {0x30, 0x82, // Record
0x00, 0x00, // Size of cert + buff
0x04, 0x0b, 0x63, 0x65,// Cert record data
0x72, 0x74, 0x69, 0x66,
0x69, 0x63, 0x61, 0x74,
0x65 };
VOID uudecode_cert(char * bufcoded,
DWORD * pcbDecoded )
{
int nbytesdecoded;
char *bufin = bufcoded;
unsigned char *bufout = bufcoded;
unsigned char *pbuf;
int nprbytes;
char * beginbuf = bufcoded;
/* Strip leading whitespace. */
while(*bufcoded==' ' ||
*bufcoded == '\t' ||
*bufcoded == '\r' ||
*bufcoded == '\n' )
{
bufcoded++;
}
//
// If there is a beginning '---- ....' then skip the first line
//
if ( bufcoded[0] == '-' && bufcoded[1] == '-' )
{
bufin = strchr( bufcoded, '\n' );
if ( bufin )
{
bufin++;
bufcoded = bufin;
}
else
{
bufin = bufcoded;
}
}
else
{
bufin = bufcoded;
}
//
// Strip all cr/lf from the block
//
pbuf = bufin;
while ( *pbuf )
{
if ( *pbuf == '\r' || *pbuf == '\n' )
{
memmove( pbuf, pbuf+1, strlen( pbuf + 1) + 1 );
}
else
{
pbuf++;
}
}
/* Figure out how many characters are in the input buffer.
* If this would decode into more bytes than would fit into
* the output buffer, adjust the number of input bytes downwards.
*/
while(pr2six[*(bufin++)] <= 63);
nprbytes = bufin - bufcoded - 1;
nbytesdecoded = ((nprbytes+3)/4) * 3;
bufin = bufcoded;
while (nprbytes > 0) {
*(bufout++) =
(unsigned char) (pr2six[*bufin] << 2 | pr2six[bufin[1]] >> 4);
*(bufout++) =
(unsigned char) (pr2six[bufin[1]] << 4 | pr2six[bufin[2]] >> 2);
*(bufout++) =
(unsigned char) (pr2six[bufin[2]] << 6 | pr2six[bufin[3]]);
bufin += 4;
nprbytes -= 4;
}
if(nprbytes & 03) {
if(pr2six[bufin[-2]] > 63)
nbytesdecoded -= 2;
else
nbytesdecoded -= 1;
}
//
// Now we need to add a new wrapper sequence around the certificate
// indicating this is a certificate
//
memmove( beginbuf + sizeof(abCertHeader),
beginbuf,
nbytesdecoded );
memcpy( beginbuf,
abCertHeader,
sizeof(abCertHeader) );
//
// The beginning record size is the total number of bytes decoded plus
// the number of bytes in the certificate header
//
beginbuf[CERT_SIZE_HIBYTE] = (BYTE) (((USHORT)nbytesdecoded+CERT_RECORD) >> 8);
beginbuf[CERT_SIZE_LOBYTE] = (BYTE) ((USHORT)nbytesdecoded+CERT_RECORD);
nbytesdecoded += sizeof(abCertHeader);
if ( pcbDecoded )
*pcbDecoded = nbytesdecoded;
}
BOOL
TsGetSecretW(
WCHAR * pszSecretName,
WCHAR * * ppchValue
)
/*++
Description:
Retrieves the specified unicode secret
Note we're loose with the allocated buffer since we're a simple
command line app.
Arguments:
pszSecretName - LSA Secret to retrieve
ppchValue - Receives pointer to allocated buffer
Returns:
TRUE on success and FALSE if any failure.
--*/
{
NTSTATUS ntStatus;
LSA_UNICODE_STRING * punicodePassword = NULL;
LSA_UNICODE_STRING unicodeSecret;
LSA_HANDLE hPolicy;
LSA_OBJECT_ATTRIBUTES ObjectAttributes;
//
// Open a policy to the remote LSA
//
InitializeObjectAttributes( &ObjectAttributes,
NULL,
0L,
NULL,
NULL );
ntStatus = LsaOpenPolicy( NULL,
&ObjectAttributes,
POLICY_ALL_ACCESS,
&hPolicy );
if ( !NT_SUCCESS( ntStatus ) )
{
SetLastError( LsaNtStatusToWinError( ntStatus ) );
return FALSE;
}
unicodeSecret.Buffer = pszSecretName;
unicodeSecret.Length = wcslen( pszSecretName ) * sizeof(WCHAR);
unicodeSecret.MaximumLength = unicodeSecret.Length + sizeof(WCHAR);
//
// Query the secret value.
//
ntStatus = LsaRetrievePrivateData( hPolicy,
&unicodeSecret,
&punicodePassword );
if( NT_SUCCESS(ntStatus) )
{
*ppchValue = (WCHAR *) punicodePassword->Buffer;
return TRUE;
}
return FALSE;
} // TsGetSecretW
DWORD
DeleteAll(
WCHAR * pszServer
)
{
WCHAR * pchKeys;
WCHAR * pszAddress;
if ( !TsGetSecretW( L"W3_KEY_LIST",
&pchKeys ))
{
printfids( IDS_NO_KEYS_INSTALLED );
return NO_ERROR;
}
#if DBG
printf("Installed keys: %S\n", pchKeys);
#endif
pszAddress = pchKeys;
while ( pchKeys = wcschr( pchKeys, L',' ))
{
//
// Ignore empty segments
//
if ( *pszAddress != L',' )
{
*pchKeys = L'\0';
#if DBG
printf("deleting %S\n", pszAddress );
#endif
//
// Nuke the secrets
//
SetKeySecret( pszServer,
L"W3_PUBLIC_KEY_%s",
pszAddress,
NULL,
0 );
SetKeySecret( pszServer,
L"W3_PRIVATE_KEY_%s",
pszAddress,
NULL,
0 );
SetKeySecret( pszServer,
L"W3_KEY_PASSWORD_%s",
pszAddress,
NULL,
0 );
}
pchKeys++;
pszAddress = pchKeys;
}
//
// Now delete the list key
//
if ( !SetKeySecret( pszServer,
L"W3_KEY_LIST",
L"",
NULL,
0 ))
{
#if DBG
printf("Warning: failed to set key list data, error %d\n");
#endif
return GetLastError();
}
printfids( IDS_DELETE_SUCCESSFUL );
return NO_ERROR;
}