1092 lines
29 KiB
C
1092 lines
29 KiB
C
|
//+---------------------------------------------------------------------------
|
||
|
|
//
|
||
|
|
// Microsoft Widows
|
||
|
|
// Copyright (C) Microsoft Corporation, 1992 - 1997.
|
||
|
|
//
|
||
|
|
// File: defcreds.c
|
||
|
|
//
|
||
|
|
// Contents: Routines for acquiring default credentials.
|
||
|
|
//
|
||
|
|
// Classes:
|
||
|
|
//
|
||
|
|
// Functions:
|
||
|
|
//
|
||
|
|
// History: 12-05-97 jbanes Created.
|
||
|
|
//
|
||
|
|
//----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
#include <spbase.h>
|
||
|
|
#include <softpub.h>
|
||
|
|
|
||
|
|
void
|
||
|
|
GetImplementationType(
|
||
|
|
PCCERT_CONTEXT pCertContext,
|
||
|
|
PDWORD pdwImpType);
|
||
|
|
|
||
|
|
|
||
|
|
NTSTATUS
|
||
|
|
AssignNewClientCredential(
|
||
|
|
PSPContext pContext,
|
||
|
|
PCCERT_CONTEXT pCertContext,
|
||
|
|
BOOL fPromptNow)
|
||
|
|
{
|
||
|
|
PSPCredential pCred = NULL;
|
||
|
|
NTSTATUS Status;
|
||
|
|
BOOL fEventLogged;
|
||
|
|
LSA_SCHANNEL_SUB_CRED SubCred;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Does this certificate have an acceptable public key type?
|
||
|
|
//
|
||
|
|
|
||
|
|
{
|
||
|
|
BOOL fFound;
|
||
|
|
DWORD dwKeyType;
|
||
|
|
DWORD i;
|
||
|
|
|
||
|
|
fFound = FALSE;
|
||
|
|
dwKeyType = MapOidToCertType(pCertContext->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId);
|
||
|
|
|
||
|
|
for(i = 0; i < pContext->cSsl3ClientCertTypes; i++)
|
||
|
|
{
|
||
|
|
if(pContext->Ssl3ClientCertTypes[i] == dwKeyType)
|
||
|
|
{
|
||
|
|
fFound = TRUE;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if(!fFound)
|
||
|
|
{
|
||
|
|
// Don't use this certificate.
|
||
|
|
Status = SP_LOG_RESULT(PCT_INT_UNKNOWN_CREDENTIAL);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Build a credential structure for the certificate.
|
||
|
|
//
|
||
|
|
|
||
|
|
pCred = SPExternalAlloc(sizeof(SPCredential));
|
||
|
|
if(pCred == NULL)
|
||
|
|
{
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
memset(&SubCred, 0, sizeof(SubCred));
|
||
|
|
|
||
|
|
SubCred.pCert = pCertContext;
|
||
|
|
|
||
|
|
Status = SPCreateCred(pContext->dwProtocol,
|
||
|
|
&SubCred,
|
||
|
|
pCred,
|
||
|
|
&fEventLogged);
|
||
|
|
if(Status != PCT_ERR_OK)
|
||
|
|
{
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Release the existing credential, if one exists.
|
||
|
|
//
|
||
|
|
|
||
|
|
if(pContext->RipeZombie->pClientCred)
|
||
|
|
{
|
||
|
|
SPDeleteCred(pContext->RipeZombie->pClientCred);
|
||
|
|
pContext->RipeZombie->pClientCred = NULL;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Assign the credential to the cache element.
|
||
|
|
//
|
||
|
|
|
||
|
|
pContext->RipeZombie->pClientCred = pCred;
|
||
|
|
pContext->pActiveClientCred = pCred;
|
||
|
|
|
||
|
|
if(fPromptNow == FALSE)
|
||
|
|
{
|
||
|
|
pContext->RipeZombie->dwFlags |= SP_CACHE_FLAG_USE_VALIDATED;
|
||
|
|
}
|
||
|
|
|
||
|
|
Status = PCT_ERR_OK;
|
||
|
|
|
||
|
|
|
||
|
|
cleanup:
|
||
|
|
|
||
|
|
if(pCred && Status != PCT_ERR_OK)
|
||
|
|
{
|
||
|
|
SPDeleteCred(pCred);
|
||
|
|
}
|
||
|
|
|
||
|
|
return Status;
|
||
|
|
}
|
||
|
|
|
||
|
|
NTSTATUS
|
||
|
|
QueryCredentialManagerForCert(
|
||
|
|
PSPContext pContext,
|
||
|
|
LPWSTR pszTarget)
|
||
|
|
{
|
||
|
|
PCCERT_CONTEXT pCertContext = NULL;
|
||
|
|
LUID LogonId;
|
||
|
|
PENCRYPTED_CREDENTIALW pCredential = NULL;
|
||
|
|
BOOL fImpersonating = FALSE;
|
||
|
|
CRYPT_HASH_BLOB HashBlob;
|
||
|
|
NTSTATUS Status;
|
||
|
|
HCERTSTORE hStore = 0;
|
||
|
|
PCERT_CREDENTIAL_INFO pCertInfo = NULL;
|
||
|
|
CRED_MARSHAL_TYPE CredType;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Obtain client logon id.
|
||
|
|
//
|
||
|
|
|
||
|
|
Status = SslGetClientLogonId(&LogonId);
|
||
|
|
|
||
|
|
if(!NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
SP_LOG_RESULT(Status);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
fImpersonating = SslImpersonateClient();
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Query the credential manager for a certificate.
|
||
|
|
//
|
||
|
|
|
||
|
|
Status = LsaTable->CrediRead(&LogonId,
|
||
|
|
CREDP_FLAGS_IN_PROCESS,
|
||
|
|
pszTarget,
|
||
|
|
CRED_TYPE_DOMAIN_CERTIFICATE,
|
||
|
|
0,
|
||
|
|
&pCredential);
|
||
|
|
if(!NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
if(Status == STATUS_NOT_FOUND)
|
||
|
|
{
|
||
|
|
DebugLog((DEB_WARN, "No certificate found in credential manager.\n"));
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
SP_LOG_RESULT(Status);
|
||
|
|
}
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Extract the certificate thumbprint and (optional) PIN.
|
||
|
|
//
|
||
|
|
|
||
|
|
if(!CredIsMarshaledCredentialW(pCredential->Cred.UserName))
|
||
|
|
{
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_UNKNOWN_CREDENTIALS);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
if(!CredUnmarshalCredentialW(pCredential->Cred.UserName,
|
||
|
|
&CredType,
|
||
|
|
&pCertInfo))
|
||
|
|
{
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_UNKNOWN_CREDENTIALS);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
if(CredType != CertCredential)
|
||
|
|
{
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_UNKNOWN_CREDENTIALS);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Look up the certificate in the MY certificate store.
|
||
|
|
//
|
||
|
|
|
||
|
|
hStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,
|
||
|
|
X509_ASN_ENCODING, 0,
|
||
|
|
CERT_SYSTEM_STORE_CURRENT_USER |
|
||
|
|
CERT_STORE_DEFER_CLOSE_UNTIL_LAST_FREE_FLAG,
|
||
|
|
L"MY");
|
||
|
|
if(!hStore)
|
||
|
|
{
|
||
|
|
SP_LOG_RESULT(GetLastError());
|
||
|
|
Status = SEC_E_NO_CREDENTIALS;
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
HashBlob.cbData = sizeof(pCertInfo->rgbHashOfCert);
|
||
|
|
HashBlob.pbData = pCertInfo->rgbHashOfCert;
|
||
|
|
|
||
|
|
pCertContext = CertFindCertificateInStore(hStore,
|
||
|
|
X509_ASN_ENCODING,
|
||
|
|
0,
|
||
|
|
CERT_FIND_HASH,
|
||
|
|
&HashBlob,
|
||
|
|
NULL);
|
||
|
|
if(pCertContext == NULL)
|
||
|
|
{
|
||
|
|
DebugLog((DEB_ERROR, "Certificate designated by credential manager was not found in certificate store (0x%x).\n", GetLastError()));
|
||
|
|
Status = SEC_E_NO_CREDENTIALS;
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Attempt to add this certificate context to the current credential.
|
||
|
|
//
|
||
|
|
|
||
|
|
Status = AssignNewClientCredential(pContext,
|
||
|
|
pCertContext,
|
||
|
|
pCredential->Cred.Flags & CRED_FLAGS_PROMPT_NOW);
|
||
|
|
if(!NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
SP_LOG_RESULT(Status);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
Status = STATUS_SUCCESS;
|
||
|
|
|
||
|
|
cleanup:
|
||
|
|
|
||
|
|
if(pCertContext)
|
||
|
|
{
|
||
|
|
CertFreeCertificateContext(pCertContext);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(hStore)
|
||
|
|
{
|
||
|
|
CertCloseStore(hStore, 0);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(pCredential)
|
||
|
|
{
|
||
|
|
LsaTable->FreeLsaHeap(pCredential);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(pCertInfo)
|
||
|
|
{
|
||
|
|
CredFree(pCertInfo);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(fImpersonating)
|
||
|
|
{
|
||
|
|
RevertToSelf();
|
||
|
|
}
|
||
|
|
|
||
|
|
return Status;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
DWORD
|
||
|
|
IsThreadLocalSystem(
|
||
|
|
BOOL *pfIsLocalSystem)
|
||
|
|
{
|
||
|
|
DWORD Status;
|
||
|
|
HANDLE hToken = 0;
|
||
|
|
UCHAR InfoBuffer[1024];
|
||
|
|
DWORD dwInfoBufferSize = sizeof(InfoBuffer);
|
||
|
|
PTOKEN_USER SlowBuffer = NULL;
|
||
|
|
PTOKEN_USER pTokenUser = (PTOKEN_USER)InfoBuffer;
|
||
|
|
PSID psidLocalSystem = NULL;
|
||
|
|
PSID psidNetworkService = NULL;
|
||
|
|
SID_IDENTIFIER_AUTHORITY siaNtAuthority = SECURITY_NT_AUTHORITY;
|
||
|
|
|
||
|
|
*pfIsLocalSystem = FALSE;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Get SID of calling thread.
|
||
|
|
//
|
||
|
|
|
||
|
|
if(!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &hToken))
|
||
|
|
{
|
||
|
|
Status = GetLastError();
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
if(!GetTokenInformation(hToken, TokenUser, pTokenUser,
|
||
|
|
dwInfoBufferSize, &dwInfoBufferSize))
|
||
|
|
{
|
||
|
|
//
|
||
|
|
// if fast buffer wasn't big enough, allocate enough storage
|
||
|
|
// and try again.
|
||
|
|
//
|
||
|
|
|
||
|
|
Status = GetLastError();
|
||
|
|
if(Status != ERROR_INSUFFICIENT_BUFFER)
|
||
|
|
{
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
SlowBuffer = (PTOKEN_USER)LocalAlloc(LPTR, dwInfoBufferSize);
|
||
|
|
if(NULL == SlowBuffer)
|
||
|
|
{
|
||
|
|
Status = ERROR_NOT_ENOUGH_MEMORY;
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
pTokenUser = SlowBuffer;
|
||
|
|
if(!GetTokenInformation(hToken, TokenUser, pTokenUser,
|
||
|
|
dwInfoBufferSize, &dwInfoBufferSize))
|
||
|
|
{
|
||
|
|
Status = GetLastError();
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Check for local system.
|
||
|
|
//
|
||
|
|
|
||
|
|
if(!AllocateAndInitializeSid(&siaNtAuthority,
|
||
|
|
1,
|
||
|
|
SECURITY_LOCAL_SYSTEM_RID,
|
||
|
|
0, 0, 0, 0, 0, 0, 0,
|
||
|
|
&psidLocalSystem))
|
||
|
|
{
|
||
|
|
Status = GetLastError();
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (EqualSid(psidLocalSystem, pTokenUser->User.Sid))
|
||
|
|
{
|
||
|
|
DebugLog((DEB_TRACE, "Client is using the LOCAL SYSTEM account.\n"));
|
||
|
|
*pfIsLocalSystem = TRUE;
|
||
|
|
Status = ERROR_SUCCESS;
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Check for network service.
|
||
|
|
//
|
||
|
|
|
||
|
|
if(!AllocateAndInitializeSid(&siaNtAuthority,
|
||
|
|
1,
|
||
|
|
SECURITY_NETWORK_SERVICE_RID,
|
||
|
|
0, 0, 0, 0, 0, 0, 0,
|
||
|
|
&psidNetworkService))
|
||
|
|
{
|
||
|
|
Status = GetLastError();
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (EqualSid(psidNetworkService, pTokenUser->User.Sid))
|
||
|
|
{
|
||
|
|
DebugLog((DEB_TRACE, "Client is using the NETWORK SERVICE account.\n"));
|
||
|
|
*pfIsLocalSystem = TRUE;
|
||
|
|
Status = ERROR_SUCCESS;
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
Status = ERROR_SUCCESS;
|
||
|
|
|
||
|
|
cleanup:
|
||
|
|
|
||
|
|
if(NULL != SlowBuffer)
|
||
|
|
{
|
||
|
|
LocalFree(SlowBuffer);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(NULL != psidLocalSystem)
|
||
|
|
{
|
||
|
|
FreeSid(psidLocalSystem);
|
||
|
|
}
|
||
|
|
if(NULL != psidNetworkService)
|
||
|
|
{
|
||
|
|
FreeSid(psidNetworkService);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(NULL != hToken)
|
||
|
|
{
|
||
|
|
CloseHandle(hToken);
|
||
|
|
}
|
||
|
|
|
||
|
|
return Status;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
NTSTATUS
|
||
|
|
FindClientCertificate(
|
||
|
|
PSPContext pContext,
|
||
|
|
HCERTSTORE hMyStore,
|
||
|
|
CERT_CHAIN_FIND_BY_ISSUER_PARA *pFindByIssuerPara,
|
||
|
|
BOOL fSkipExpiredCerts,
|
||
|
|
BOOL fSoftwareCspOnly)
|
||
|
|
{
|
||
|
|
PCCERT_CHAIN_CONTEXT pChainContext = NULL;
|
||
|
|
HTTPSPolicyCallbackData polHttps;
|
||
|
|
CERT_CHAIN_POLICY_PARA PolicyPara;
|
||
|
|
CERT_CHAIN_POLICY_STATUS PolicyStatus;
|
||
|
|
PCCERT_CONTEXT pCertContext;
|
||
|
|
NTSTATUS Status;
|
||
|
|
ULONG j;
|
||
|
|
|
||
|
|
pChainContext = NULL;
|
||
|
|
|
||
|
|
while(TRUE)
|
||
|
|
{
|
||
|
|
// Find a certificate chain.
|
||
|
|
pChainContext = CertFindChainInStore(hMyStore,
|
||
|
|
X509_ASN_ENCODING,
|
||
|
|
0,
|
||
|
|
CERT_CHAIN_FIND_BY_ISSUER,
|
||
|
|
pFindByIssuerPara,
|
||
|
|
pChainContext);
|
||
|
|
if(pChainContext == NULL)
|
||
|
|
{
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Make sure that every certificate in the chain either has the
|
||
|
|
// client auth EKU or it has no EKUs at all.
|
||
|
|
{
|
||
|
|
PCERT_SIMPLE_CHAIN pSimpleChain;
|
||
|
|
PCCERT_CONTEXT pCurrentCert;
|
||
|
|
BOOL fIsAllowed = FALSE;
|
||
|
|
|
||
|
|
pSimpleChain = pChainContext->rgpChain[0];
|
||
|
|
|
||
|
|
for(j = 0; j < pSimpleChain->cElement; j++)
|
||
|
|
{
|
||
|
|
pCurrentCert = pSimpleChain->rgpElement[j]->pCertContext;
|
||
|
|
|
||
|
|
Status = SPCheckKeyUsage(pCurrentCert,
|
||
|
|
szOID_PKIX_KP_CLIENT_AUTH,
|
||
|
|
TRUE,
|
||
|
|
&fIsAllowed);
|
||
|
|
if(Status != SEC_E_OK || !fIsAllowed)
|
||
|
|
{
|
||
|
|
fIsAllowed = FALSE;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if(!fIsAllowed)
|
||
|
|
{
|
||
|
|
// skip this certificate chain.
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
// Set up validate chain structures.
|
||
|
|
ZeroMemory(&polHttps, sizeof(HTTPSPolicyCallbackData));
|
||
|
|
polHttps.cbStruct = sizeof(HTTPSPolicyCallbackData);
|
||
|
|
polHttps.dwAuthType = AUTHTYPE_CLIENT;
|
||
|
|
polHttps.fdwChecks = 0;
|
||
|
|
polHttps.pwszServerName = NULL;
|
||
|
|
|
||
|
|
ZeroMemory(&PolicyStatus, sizeof(PolicyStatus));
|
||
|
|
PolicyStatus.cbSize = sizeof(PolicyStatus);
|
||
|
|
|
||
|
|
ZeroMemory(&PolicyPara, sizeof(PolicyPara));
|
||
|
|
PolicyPara.cbSize = sizeof(PolicyPara);
|
||
|
|
PolicyPara.pvExtraPolicyPara= &polHttps;
|
||
|
|
|
||
|
|
PolicyPara.dwFlags = CERT_CHAIN_POLICY_IGNORE_WRONG_USAGE_FLAG |
|
||
|
|
CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAG;
|
||
|
|
if(!fSkipExpiredCerts)
|
||
|
|
{
|
||
|
|
PolicyPara.dwFlags |= CERT_CHAIN_POLICY_IGNORE_ALL_NOT_TIME_VALID_FLAGS;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Validate chain
|
||
|
|
if(!CertVerifyCertificateChainPolicy(
|
||
|
|
CERT_CHAIN_POLICY_SSL,
|
||
|
|
pChainContext,
|
||
|
|
&PolicyPara,
|
||
|
|
&PolicyStatus))
|
||
|
|
{
|
||
|
|
DebugLog((DEB_WARN,"Error 0x%x returned by CertVerifyCertificateChainPolicy!\n", GetLastError()));
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
Status = MapWinTrustError(PolicyStatus.dwError, 0, 0);
|
||
|
|
if(Status)
|
||
|
|
{
|
||
|
|
// Certificate did not validate, move on to the next one.
|
||
|
|
DebugLog((DEB_WARN, "Client certificate failed validation with 0x%x\n", Status));
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Get pointer to leaf certificate context.
|
||
|
|
if(pChainContext->cChain == 0 || pChainContext->rgpChain[0] == NULL)
|
||
|
|
{
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_INTERNAL_ERROR);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
if(pChainContext->rgpChain[0]->cElement == 0 ||
|
||
|
|
pChainContext->rgpChain[0]->rgpElement == NULL)
|
||
|
|
{
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_INTERNAL_ERROR);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
pCertContext = pChainContext->rgpChain[0]->rgpElement[0]->pCertContext;
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Is the private key stored in a software CSP?
|
||
|
|
//
|
||
|
|
|
||
|
|
if(fSoftwareCspOnly)
|
||
|
|
{
|
||
|
|
DWORD dwImpType;
|
||
|
|
|
||
|
|
GetImplementationType(pCertContext, &dwImpType);
|
||
|
|
|
||
|
|
if(dwImpType != CRYPT_IMPL_SOFTWARE)
|
||
|
|
{
|
||
|
|
// Skip this certificate
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Assign the certificate to the current context.
|
||
|
|
//
|
||
|
|
|
||
|
|
Status = AssignNewClientCredential(pContext,
|
||
|
|
pCertContext,
|
||
|
|
FALSE);
|
||
|
|
if(NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
// Success! Our work here is done.
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// No suitable client credential was found.
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_INCOMPLETE_CREDENTIALS);
|
||
|
|
|
||
|
|
cleanup:
|
||
|
|
|
||
|
|
if(pChainContext)
|
||
|
|
{
|
||
|
|
CertFreeCertificateChain(pChainContext);
|
||
|
|
}
|
||
|
|
|
||
|
|
return Status;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
NTSTATUS
|
||
|
|
AcquireDefaultClientCredential(
|
||
|
|
PSPContext pContext,
|
||
|
|
BOOL fCredManagerOnly)
|
||
|
|
{
|
||
|
|
CERT_CHAIN_FIND_BY_ISSUER_PARA FindByIssuerPara;
|
||
|
|
CERT_NAME_BLOB * prgIssuers = NULL;
|
||
|
|
DWORD cIssuers = 0;
|
||
|
|
HCERTSTORE hStore = 0;
|
||
|
|
NTSTATUS Status;
|
||
|
|
BOOL fImpersonating = FALSE;
|
||
|
|
BOOL fLocalSystem = FALSE;
|
||
|
|
ULONG i;
|
||
|
|
|
||
|
|
DebugLog((DEB_TRACE,"AcquireDefaultClientCredential\n"));
|
||
|
|
|
||
|
|
//
|
||
|
|
// Is the application running under local system?
|
||
|
|
//
|
||
|
|
|
||
|
|
fImpersonating = SslImpersonateClient();
|
||
|
|
|
||
|
|
if(fImpersonating)
|
||
|
|
{
|
||
|
|
Status = IsThreadLocalSystem(&fLocalSystem);
|
||
|
|
if(Status)
|
||
|
|
{
|
||
|
|
DebugLog((DEB_WARN, "IsThreadLocalSystem returned error 0x%x.\n", Status));
|
||
|
|
}
|
||
|
|
|
||
|
|
RevertToSelf();
|
||
|
|
fImpersonating = FALSE;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Ask the credential manager to select a certificate for us.
|
||
|
|
//
|
||
|
|
|
||
|
|
Status = QueryCredentialManagerForCert(
|
||
|
|
pContext,
|
||
|
|
pContext->pszTarget);
|
||
|
|
|
||
|
|
if(NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
DebugLog((DEB_TRACE, "Credential manager found a certificate for us.\n"));
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
if(fCredManagerOnly)
|
||
|
|
{
|
||
|
|
// No suitable client credential was found.
|
||
|
|
Status = SP_LOG_RESULT(SEC_I_INCOMPLETE_CREDENTIALS);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Get list of trusted issuers as a list of CERT_NAME_BLOBs.
|
||
|
|
//
|
||
|
|
|
||
|
|
if(pContext->pbIssuerList && pContext->cbIssuerList > 2)
|
||
|
|
{
|
||
|
|
PBYTE pbIssuerList = pContext->pbIssuerList + 2;
|
||
|
|
DWORD cbIssuerList = pContext->cbIssuerList - 2;
|
||
|
|
PBYTE pbIssuer;
|
||
|
|
|
||
|
|
// Count issuers.
|
||
|
|
cIssuers = 0;
|
||
|
|
pbIssuer = pbIssuerList;
|
||
|
|
while(pbIssuer + 1 < pbIssuerList + cbIssuerList)
|
||
|
|
{
|
||
|
|
pbIssuer += 2 + COMBINEBYTES(pbIssuer[0], pbIssuer[1]);
|
||
|
|
cIssuers++;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Allocate memory for list of blobs.
|
||
|
|
prgIssuers = SPExternalAlloc(cIssuers * sizeof(CERT_NAME_BLOB));
|
||
|
|
if(prgIssuers == NULL)
|
||
|
|
{
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Build the issuer blob list.
|
||
|
|
pbIssuer = pbIssuerList;
|
||
|
|
for(i = 0; i < cIssuers; i++)
|
||
|
|
{
|
||
|
|
prgIssuers[i].pbData = pbIssuer + 2;
|
||
|
|
prgIssuers[i].cbData = COMBINEBYTES(pbIssuer[0], pbIssuer[1]);
|
||
|
|
|
||
|
|
pbIssuer += 2 + prgIssuers[i].cbData;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Enumerate the certificates in the MY store, looking for a suitable
|
||
|
|
// client certificate.
|
||
|
|
//
|
||
|
|
|
||
|
|
fImpersonating = SslImpersonateClient();
|
||
|
|
|
||
|
|
if(fLocalSystem)
|
||
|
|
{
|
||
|
|
hStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,
|
||
|
|
X509_ASN_ENCODING, 0,
|
||
|
|
CERT_SYSTEM_STORE_LOCAL_MACHINE |
|
||
|
|
CERT_STORE_READONLY_FLAG |
|
||
|
|
CERT_STORE_OPEN_EXISTING_FLAG,
|
||
|
|
L"MY");
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
hStore = CertOpenSystemStore(0, "MY");
|
||
|
|
}
|
||
|
|
|
||
|
|
if(!hStore)
|
||
|
|
{
|
||
|
|
SP_LOG_RESULT(GetLastError());
|
||
|
|
Status = SEC_E_INTERNAL_ERROR;
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
ZeroMemory(&FindByIssuerPara, sizeof(FindByIssuerPara));
|
||
|
|
FindByIssuerPara.cbSize = sizeof(FindByIssuerPara);
|
||
|
|
FindByIssuerPara.pszUsageIdentifier = szOID_PKIX_KP_CLIENT_AUTH;
|
||
|
|
FindByIssuerPara.dwKeySpec = 0;
|
||
|
|
FindByIssuerPara.cIssuer = cIssuers;
|
||
|
|
FindByIssuerPara.rgIssuer = prgIssuers;
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Attempt to find a suitable certificate.
|
||
|
|
//
|
||
|
|
|
||
|
|
Status = FindClientCertificate(pContext,
|
||
|
|
hStore,
|
||
|
|
&FindByIssuerPara,
|
||
|
|
TRUE, // skip expired certs
|
||
|
|
TRUE); // software CSPs only
|
||
|
|
|
||
|
|
if(NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
// Success! Our work here is done.
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
Status = FindClientCertificate(pContext,
|
||
|
|
hStore,
|
||
|
|
&FindByIssuerPara,
|
||
|
|
TRUE, // skip expired certs
|
||
|
|
FALSE); // software CSPs only
|
||
|
|
|
||
|
|
if(NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
// Success! Our work here is done.
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
Status = FindClientCertificate(pContext,
|
||
|
|
hStore,
|
||
|
|
&FindByIssuerPara,
|
||
|
|
FALSE, // skip expired certs
|
||
|
|
TRUE); // software CSPs only
|
||
|
|
|
||
|
|
if(NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
// Success! Our work here is done.
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
Status = FindClientCertificate(pContext,
|
||
|
|
hStore,
|
||
|
|
&FindByIssuerPara,
|
||
|
|
FALSE, // skip expired certs
|
||
|
|
FALSE); // software CSPs only
|
||
|
|
|
||
|
|
if(NT_SUCCESS(Status))
|
||
|
|
{
|
||
|
|
// Success! Our work here is done.
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
// No suitable client credential was found.
|
||
|
|
Status = SP_LOG_RESULT(SEC_I_INCOMPLETE_CREDENTIALS);
|
||
|
|
|
||
|
|
|
||
|
|
cleanup:
|
||
|
|
|
||
|
|
|
||
|
|
if(hStore)
|
||
|
|
{
|
||
|
|
CertCloseStore(hStore, 0);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(fImpersonating)
|
||
|
|
{
|
||
|
|
RevertToSelf();
|
||
|
|
}
|
||
|
|
|
||
|
|
if(prgIssuers)
|
||
|
|
{
|
||
|
|
SPExternalFree(prgIssuers);
|
||
|
|
}
|
||
|
|
|
||
|
|
DebugLog((DEB_TRACE,"AcquireDefaultClientCredential returned 0x%x\n", Status));
|
||
|
|
|
||
|
|
return Status;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
NTSTATUS
|
||
|
|
FindDefaultMachineCred(
|
||
|
|
PSPCredentialGroup *ppCred,
|
||
|
|
DWORD dwProtocol)
|
||
|
|
{
|
||
|
|
HTTPSPolicyCallbackData polHttps;
|
||
|
|
CERT_CHAIN_POLICY_PARA PolicyPara;
|
||
|
|
CERT_CHAIN_POLICY_STATUS PolicyStatus;
|
||
|
|
CERT_CHAIN_PARA ChainPara;
|
||
|
|
PCCERT_CHAIN_CONTEXT pChainContext = NULL;
|
||
|
|
PCCERT_CONTEXT pCertContext = NULL;
|
||
|
|
LSA_SCHANNEL_CRED SchannelCred;
|
||
|
|
LSA_SCHANNEL_SUB_CRED SubCred;
|
||
|
|
HCERTSTORE hStore = 0;
|
||
|
|
|
||
|
|
#define SERVER_USAGE_COUNT 3
|
||
|
|
LPSTR rgszUsages[SERVER_USAGE_COUNT] = {
|
||
|
|
szOID_PKIX_KP_SERVER_AUTH,
|
||
|
|
szOID_SERVER_GATED_CRYPTO,
|
||
|
|
szOID_SGC_NETSCAPE };
|
||
|
|
|
||
|
|
LPWSTR pwszMachineName = NULL;
|
||
|
|
DWORD cchMachineName;
|
||
|
|
DWORD Status;
|
||
|
|
DWORD i;
|
||
|
|
|
||
|
|
// Get the machine name
|
||
|
|
cchMachineName = 0;
|
||
|
|
if(!GetComputerNameExW(ComputerNameDnsFullyQualified, NULL, &cchMachineName))
|
||
|
|
{
|
||
|
|
if(GetLastError() != ERROR_MORE_DATA)
|
||
|
|
{
|
||
|
|
DebugLog((DEB_ERROR,"Failed to get computer name size: 0x%x\n",GetLastError()));
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_WRONG_PRINCIPAL);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
pwszMachineName = SPExternalAlloc(cchMachineName * sizeof(WCHAR));
|
||
|
|
if(pwszMachineName == NULL)
|
||
|
|
{
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
if(!GetComputerNameExW(ComputerNameDnsFullyQualified, pwszMachineName, &cchMachineName))
|
||
|
|
{
|
||
|
|
DebugLog((DEB_ERROR,"Failed to get computer name: 0x%x\n",GetLastError()));
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_WRONG_PRINCIPAL);
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Remove the trailing "." if any. This can happen in the stand-alone
|
||
|
|
// server case.
|
||
|
|
cchMachineName = lstrlenW(pwszMachineName);
|
||
|
|
if(cchMachineName > 0 && pwszMachineName[cchMachineName - 1] == L'.')
|
||
|
|
{
|
||
|
|
pwszMachineName[cchMachineName - 1] = L'\0';
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
DebugLog((DEB_TRACE,"Computer name: %ls\n",pwszMachineName));
|
||
|
|
|
||
|
|
|
||
|
|
// Open the system MY store.
|
||
|
|
hStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,
|
||
|
|
X509_ASN_ENCODING, 0,
|
||
|
|
CERT_SYSTEM_STORE_LOCAL_MACHINE |
|
||
|
|
CERT_STORE_READONLY_FLAG |
|
||
|
|
CERT_STORE_OPEN_EXISTING_FLAG,
|
||
|
|
L"MY");
|
||
|
|
if(hStore == NULL)
|
||
|
|
{
|
||
|
|
SP_LOG_RESULT(GetLastError());
|
||
|
|
Status = SEC_E_NO_CREDENTIALS;
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Enumerate the certificates in the MY store, looking for a suitable
|
||
|
|
// server certificate. Do this twice, the first time looking for the
|
||
|
|
// perfect certificate, and if this fails then look again, this time
|
||
|
|
// being a little less picky.
|
||
|
|
//
|
||
|
|
|
||
|
|
for(i = 0; i < 2; i++)
|
||
|
|
{
|
||
|
|
pCertContext = NULL;
|
||
|
|
|
||
|
|
while(TRUE)
|
||
|
|
{
|
||
|
|
// Get leaf certificate in the MY store.
|
||
|
|
pCertContext = CertEnumCertificatesInStore(hStore, pCertContext);
|
||
|
|
if(pCertContext == NULL)
|
||
|
|
{
|
||
|
|
// No more certificates.
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
|
||
|
|
//
|
||
|
|
// Build a certificate chain from the leaf certificate.
|
||
|
|
//
|
||
|
|
|
||
|
|
ZeroMemory(&ChainPara, sizeof(ChainPara));
|
||
|
|
ChainPara.cbSize = sizeof(ChainPara);
|
||
|
|
ChainPara.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR;
|
||
|
|
ChainPara.RequestedUsage.Usage.cUsageIdentifier = SERVER_USAGE_COUNT;
|
||
|
|
ChainPara.RequestedUsage.Usage.rgpszUsageIdentifier = rgszUsages;
|
||
|
|
|
||
|
|
if(!CertGetCertificateChain(
|
||
|
|
NULL,
|
||
|
|
pCertContext,
|
||
|
|
NULL,
|
||
|
|
0,
|
||
|
|
&ChainPara,
|
||
|
|
CERT_CHAIN_REVOCATION_CHECK_END_CERT,
|
||
|
|
NULL,
|
||
|
|
&pChainContext))
|
||
|
|
{
|
||
|
|
DebugLog((DEB_WARN, "Error 0x%x returned by CertGetCertificateChain!\n", GetLastError()));
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Set up validate chain structures.
|
||
|
|
ZeroMemory(&polHttps, sizeof(HTTPSPolicyCallbackData));
|
||
|
|
polHttps.cbStruct = sizeof(HTTPSPolicyCallbackData);
|
||
|
|
polHttps.dwAuthType = AUTHTYPE_SERVER;
|
||
|
|
polHttps.fdwChecks = 0;
|
||
|
|
polHttps.pwszServerName = pwszMachineName;
|
||
|
|
|
||
|
|
ZeroMemory(&PolicyStatus, sizeof(PolicyStatus));
|
||
|
|
PolicyStatus.cbSize = sizeof(PolicyStatus);
|
||
|
|
|
||
|
|
ZeroMemory(&PolicyPara, sizeof(PolicyPara));
|
||
|
|
PolicyPara.cbSize = sizeof(PolicyPara);
|
||
|
|
PolicyPara.pvExtraPolicyPara= &polHttps;
|
||
|
|
if(i == 0)
|
||
|
|
{
|
||
|
|
// Look for the perfect certificate.
|
||
|
|
PolicyPara.dwFlags = 0;
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
// Ignore expiration.
|
||
|
|
PolicyPara.dwFlags = CERT_CHAIN_POLICY_IGNORE_ALL_NOT_TIME_VALID_FLAGS;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Validate chain
|
||
|
|
if(!CertVerifyCertificateChainPolicy(
|
||
|
|
CERT_CHAIN_POLICY_SSL,
|
||
|
|
pChainContext,
|
||
|
|
&PolicyPara,
|
||
|
|
&PolicyStatus))
|
||
|
|
{
|
||
|
|
SP_LOG_RESULT(GetLastError());
|
||
|
|
CertFreeCertificateChain(pChainContext);
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
Status = MapWinTrustError(PolicyStatus.dwError,
|
||
|
|
0,
|
||
|
|
CRED_FLAG_IGNORE_NO_REVOCATION_CHECK | CRED_FLAG_IGNORE_REVOCATION_OFFLINE);
|
||
|
|
if(Status)
|
||
|
|
{
|
||
|
|
// Certificate did not validate, move on to the next one.
|
||
|
|
DebugLog((DEB_WARN, "Machine certificate failed validation with 0x%x\n", Status));
|
||
|
|
CertFreeCertificateChain(pChainContext);
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
|
||
|
|
CertFreeCertificateChain(pChainContext);
|
||
|
|
|
||
|
|
|
||
|
|
// Build an schannel credential.
|
||
|
|
ZeroMemory(&SchannelCred, sizeof(SchannelCred));
|
||
|
|
|
||
|
|
SchannelCred.dwVersion = SCHANNEL_CRED_VERSION;
|
||
|
|
SchannelCred.cSubCreds = 1;
|
||
|
|
SchannelCred.paSubCred = &SubCred;
|
||
|
|
|
||
|
|
ZeroMemory(&SubCred, sizeof(SubCred));
|
||
|
|
|
||
|
|
SubCred.pCert = pCertContext;
|
||
|
|
|
||
|
|
Status = SPCreateCredential(ppCred,
|
||
|
|
dwProtocol,
|
||
|
|
&SchannelCred);
|
||
|
|
if(Status != PCT_ERR_OK)
|
||
|
|
{
|
||
|
|
// Don't use this certificate.
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
|
||
|
|
// We have a winner!
|
||
|
|
DebugLog((DEB_TRACE, "Machine certificate automatically acquired\n"));
|
||
|
|
Status = PCT_ERR_OK;
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// No suitable machine credential was found.
|
||
|
|
Status = SP_LOG_RESULT(SEC_E_NO_CREDENTIALS);
|
||
|
|
|
||
|
|
cleanup:
|
||
|
|
|
||
|
|
if(Status != PCT_ERR_OK)
|
||
|
|
{
|
||
|
|
LogNoDefaultServerCredEvent();
|
||
|
|
}
|
||
|
|
|
||
|
|
if(pwszMachineName)
|
||
|
|
{
|
||
|
|
SPExternalFree(pwszMachineName);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(pCertContext)
|
||
|
|
{
|
||
|
|
CertFreeCertificateContext(pCertContext);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(hStore)
|
||
|
|
{
|
||
|
|
CertCloseStore(hStore, 0);
|
||
|
|
}
|
||
|
|
|
||
|
|
return Status;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
void
|
||
|
|
GetImplementationType(
|
||
|
|
PCCERT_CONTEXT pCertContext,
|
||
|
|
PDWORD pdwImpType)
|
||
|
|
{
|
||
|
|
PCRYPT_KEY_PROV_INFO pProvInfo = NULL;
|
||
|
|
HCRYPTPROV hProv = 0;
|
||
|
|
DWORD cbSize;
|
||
|
|
DWORD dwImpType;
|
||
|
|
|
||
|
|
*pdwImpType = CRYPT_IMPL_UNKNOWN;
|
||
|
|
|
||
|
|
if(!CertGetCertificateContextProperty(pCertContext,
|
||
|
|
CERT_KEY_PROV_INFO_PROP_ID,
|
||
|
|
NULL,
|
||
|
|
&cbSize))
|
||
|
|
{
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
pProvInfo = SPExternalAlloc(cbSize);
|
||
|
|
if(pProvInfo == NULL)
|
||
|
|
{
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
if(!CertGetCertificateContextProperty(pCertContext,
|
||
|
|
CERT_KEY_PROV_INFO_PROP_ID,
|
||
|
|
pProvInfo,
|
||
|
|
&cbSize))
|
||
|
|
{
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
// HACKHACK - clear the smart-card specific flag.
|
||
|
|
pProvInfo->dwFlags &= ~CERT_SET_KEY_CONTEXT_PROP_ID;
|
||
|
|
|
||
|
|
if(!CryptAcquireContextW(&hProv,
|
||
|
|
pProvInfo->pwszContainerName,
|
||
|
|
pProvInfo->pwszProvName,
|
||
|
|
pProvInfo->dwProvType,
|
||
|
|
pProvInfo->dwFlags | CRYPT_SILENT))
|
||
|
|
{
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
cbSize = sizeof(dwImpType);
|
||
|
|
if(!CryptGetProvParam(hProv,
|
||
|
|
PP_IMPTYPE,
|
||
|
|
(PBYTE)&dwImpType,
|
||
|
|
&cbSize,
|
||
|
|
0))
|
||
|
|
{
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
|
||
|
|
*pdwImpType = dwImpType;
|
||
|
|
|
||
|
|
cleanup:
|
||
|
|
|
||
|
|
if(pProvInfo)
|
||
|
|
{
|
||
|
|
SPExternalFree(pProvInfo);
|
||
|
|
}
|
||
|
|
|
||
|
|
if(hProv)
|
||
|
|
{
|
||
|
|
CryptReleaseContext(hProv, 0);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|