able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/inetsrv/iis/ui/itools/keyring/ckey.cpp

1324 lines
40 KiB
C++
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
// implements much of the exported CKey
#include "stdafx.h"
#include "resource.h"
#include "KeyObjs.h"
#include "passdlg.h"
#include "AdmnInfo.h"
#include "NKChseCA.h"
#include "NKDN.h"
#include "NKDN2.h"
#include "NKKyInfo.h"
#include "NKUsrInf.h"
#include "creating.h"
#include "resource.h"
#include "intrlkey.h"
#include <iis64.h>
#define SECURITY_WIN32
extern "C"
{
#include <wincrypt.h>
// #include <sslsp.h>
#include <schnlsp.h>
#include <sspi.h>
#include <ISSPERR.h>
}
#include "mismtchd.h"
#define CRLF "\r\n"
// NON_LOCALIZABLE strings for use in the request header
#define HEADER_ADMINISTRATOR _T(CRLF "Webmaster: ")
#define HEADER_PHONE _T(CRLF "Phone: ")
#define HEADER_SERVER _T(CRLF "Server: ")
#define HEADER_COMMON_NAME _T(CRLF CRLF "Common-name: ")
#define HEADER_ORG_UNIT _T(CRLF "Organization Unit: ")
#define HEADER_ORGANIZATION _T(CRLF "Organization: ")
#define HEADER_LOCALITY _T(CRLF "Locality: ")
#define HEADER_STATE _T(CRLF "State: ")
#define HEADER_COUNTRY _T(CRLF "Country: ")
#define HEADER_END_SPACING _T(CRLF CRLF )
// defines taken from the old KeyGen utility
#define MESSAGE_HEADER "-----BEGIN NEW CERTIFICATE REQUEST-----\r\n"
#define MESSAGE_TRAILER "-----END NEW CERTIFICATE REQUEST-----\r\n"
#define MIME_TYPE "Content-Type: application/x-pkcs10\r\n"
#define MIME_ENCODING "Content-Transfer-Encoding: base64\r\n\r\n"
int HTUU_encode(unsigned char *bufin, unsigned int nbytes, char *bufcoded);
#define BACKUP_ID 'KRBK'
IMPLEMENT_DYNCREATE(CKey, CTreeItem);
//------------------------------------------------------------------------------
CKey::CKey():
m_cbPrivateKey( 0 ),
m_pPrivateKey( NULL ),
m_cbCertificate( 0 ),
m_pCertificate( NULL ),
m_cbCertificateRequest( 0 ),
m_pCertificateRequest( NULL )
{;}
//------------------------------------------------------------------------------
CKey::~CKey()
{
LPTSTR pBuff;
// specifically write zeros out over the password
try
{
pBuff = m_szPassword.GetBuffer(256);
}
catch( CException e )
{
pBuff = NULL;
}
if ( pBuff )
{
// zero out the buffer
ZeroMemory( pBuff, 256 );
// release the buffer
m_szPassword.ReleaseBuffer(0);
}
// zero out the private key and the certificate
if ( m_pPrivateKey )
{
// zero out the buffer
ZeroMemory( m_pPrivateKey, m_cbPrivateKey );
// free the pointer
GlobalFree( (HANDLE)m_pPrivateKey );
m_pPrivateKey = NULL;
}
if ( m_pCertificate )
{
// zero out the buffer
ZeroMemory( m_pCertificate, m_cbCertificate );
// free the pointer
GlobalFree( (HANDLE)m_pCertificate );
m_pCertificate = NULL;
}
if ( m_pCertificateRequest )
{
// zero out the buffer
ZeroMemory( m_pCertificateRequest, m_cbCertificateRequest );
// free the pointer
GlobalFree( (HANDLE)m_pCertificateRequest );
m_pCertificate = NULL;
}
}
//------------------------------------------------------------------------------
CKey* CKey::PClone( void )
{
CKey* pClone = NULL;
// TRY to make a new key object
try
{
pClone = new CKey();
// copy over all the data
pClone->CopyDataFrom( this );
}
catch( CException e )
{
// if the object had been made, delete it
if ( pClone )
delete pClone;
return NULL;
}
return pClone;
}
//------------------------------------------------------------------------------
void CKey::CopyDataFrom( CKey* pKey )
{
// make sure this is ok
ASSERT( pKey );
ASSERT( pKey->IsKindOf(RUNTIME_CLASS(CKey)) );
if ( !pKey ) return;
// delete any data currently in this key
// zero out the private key and the certificate
if ( m_pPrivateKey )
{
ZeroMemory( m_pPrivateKey, m_cbPrivateKey );
GlobalFree( (HANDLE)m_pPrivateKey );
m_pPrivateKey = NULL;
}
if ( m_pCertificate )
{
ZeroMemory( m_pCertificate, m_cbCertificate );
GlobalFree( (HANDLE)m_pCertificate );
m_pCertificate = NULL;
}
if ( m_pCertificateRequest )
{
ZeroMemory( m_pCertificateRequest, m_cbCertificateRequest );
GlobalFree( (HANDLE)m_pCertificateRequest );
m_pCertificate = NULL;
}
// copy over the basic stuff
m_szItemName = pKey->m_szItemName;
m_iImage = pKey->m_iImage;
m_szPassword = pKey->m_szPassword;
m_cbPrivateKey = pKey->m_cbPrivateKey;
m_cbCertificate = pKey->m_cbCertificate;
m_cbCertificateRequest = pKey->m_cbCertificateRequest;
// now the pointer based data
if ( pKey->m_pPrivateKey )
{
m_pPrivateKey = GlobalAlloc( GPTR, m_cbPrivateKey );
if ( !m_pPrivateKey ) AfxThrowMemoryException();
memcpy( m_pPrivateKey, pKey->m_pPrivateKey, m_cbPrivateKey );
}
if ( pKey->m_pCertificate )
{
m_pCertificate = GlobalAlloc( GPTR, m_cbCertificate );
if ( !m_pCertificate ) AfxThrowMemoryException();
memcpy( m_pCertificate, pKey->m_pCertificate, m_cbCertificate );
}
if ( pKey->m_pCertificateRequest )
{
m_pCertificateRequest = GlobalAlloc( GPTR, m_cbCertificateRequest );
if ( !m_pCertificateRequest ) AfxThrowMemoryException();
memcpy( m_pCertificateRequest, pKey->m_pCertificateRequest,
m_cbCertificateRequest );
}
}
//------------------------------------------------------------------------------
void CKey::SetName( CString &szNewName )
{
m_szItemName = szNewName;
UpdateCaption();
SetDirty( TRUE );
}
//------------------------------------------------------------------------------
void CKey::UpdateIcon( void )
{
// if there is no certificate, then the immature key
if ( !m_pCertificate )
{
m_iImage = TREE_ICON_KEY_IMMATURE;
FSetImage( m_iImage );
return;
}
// there is a certificate, but we need to see if it has
// expired or not. We do that by cracking the certificate
// default the key to being ok
m_iImage = TREE_ICON_KEY_OK;
CKeyCrackedData cracker;
// crack the key
if ( cracker.CrackKey(this) )
{
// get the expiration time
CTime ctimeExpires( cracker.GetValidUntil() );
// get the current time
CTime ctimeCurrent = CTime::GetCurrentTime();
// test if it has expired first
if ( ctimeCurrent > ctimeExpires )
m_iImage = TREE_ICON_KEY_EXPIRED;
}
// set the image
FSetImage( m_iImage );
}
//------------------------------------------------------------------------------
BOOL CKey::FInstallCertificate( CString szPath, CString szPass )
{
CFile cfile;
PVOID pData = NULL;
BOOL fSuccess =FALSE;;
// open the file
if ( !cfile.Open( szPath, CFile::modeRead | CFile::shareDenyNone ) )
return FALSE;
// how big is the file - add one so we can zero terminate the buffer
DWORD cbCertificate = cfile.GetLength() + 1;
// make sure the file has some size
if ( !cbCertificate )
{
AfxMessageBox( IDS_ERR_INVALID_CERTIFICATE, MB_OK | MB_ICONINFORMATION );
return FALSE;
}
// put the rest of the operation in a try/catch
// specifically write zeros out over the password
try
{
// allocate space for the data
pData = GlobalAlloc( GPTR, cbCertificate );
if ( !pData ) AfxThrowMemoryException();
// copy in the data from the file to the pointer - will throw and exception
DWORD cbRead = cfile.Read( pData, cbCertificate );
// zero terminate for decoding
((BYTE*)pData)[cbRead] = 0;
// great. The last thing left is to uudecode the data we got
uudecode_cert( (char*)pData, &cbCertificate );
// close the file
cfile.Close();
// install the certificate
fSuccess = FInstallCertificate( pData, cbCertificate, szPass );
}
catch( CException e )
{
// if the pointer was allocated, deallocate it
if ( pData )
{
GlobalFree( pData );
pData = NULL;
}
// return failure
return FALSE;
}
// return success
return fSuccess;
}
//------------------------------------------------------------------------------
// it is up to the module to verify the certificate
BOOL CKey::FInstallCertificate( PVOID pCert, DWORD cbCert, CString &szPass )
{
// cache the old certificate in case the new one fails
DWORD old_cbCertificate = m_cbCertificate;
PVOID old_pCertificate = m_pCertificate;
// set the new one into place
m_cbCertificate = cbCert;
m_pCertificate = pCert;
/* // MOVED TO THE MODULE
// verify the password
if ( !FVerifyValidPassword(szPass) )
{
// resore the old values
m_cbCertificate = old_cbCertificate;
m_pCertificate = old_pCertificate;
// dispose of the new stuff
GlobalFree( pCert );
// return false
return FALSE;
}
*/
// Re-Set the password, incase we stored a request from Backup file.
m_szPassword = szPass;
// it checks out ok, so we can get rid of the old stuff
// be careful not to get rid of the current test cert if that is whats there
if ( old_pCertificate && (old_pCertificate != pCert) )
{
GlobalFree( old_pCertificate );
old_pCertificate = NULL;
}
// mark the key as dirty
SetDirty( TRUE );
return TRUE;
}
//------------------------------------------------------------------------------
// verfying a valid password is now a several-stop process. First we have to verify
// that the certificate is the correct one that was requested. Apparenly lots of
// users out there are attempting to install either invalid certificates, or valid
// certificates on the wrong key. Then, when they can't figure out that they messed
// it up, they call us. Or Verisign. To do this we use CAPI2 to get a certificate context
// from the certificate. If that fails is in an invalid cert (say... an EXE file).
// Then we test that certificat's public key to see if it matches the public key
// stored in the request (which we also have to use CAPI2 to crack) If there is no
// request (keyset files) then tough bannanas. They will have to rely on the errors
// returned by the AcquireCredentialsHandle routine.
BOOL CKey::FVerifyValidPassword( CString szPassword )
{
PVOID pRequestObject = NULL;
PCCERT_CONTEXT pcontextCertificate = NULL;
BOOL fAnswer = TRUE;
SSL_CREDENTIAL_CERTIFICATE creds;
CredHandle hCreds;
SECURITY_STATUS scRet;
TimeStamp ts;
DWORD err;
CString sz;
CString szErr;
// skip the private, internal request header
PUCHAR pRequest = NULL;
DWORD cbRequest = 0;
PUCHAR pcert = (PUCHAR)m_pCertificate;
DWORD cbcert = m_cbCertificate;
// if the request is there, get its context
if ( m_pCertificateRequest )
{
// see if this request has a header block in front of it. If it does, then use
// it to get the real request. If it doesn't then just use the request.
// if it does have a header the first DWORD will be REQUEST_HEADER_IDENTIFIER
if ( *(DWORD*)m_pCertificateRequest == REQUEST_HEADER_IDENTIFIER )
{
// get the real request that comes after the request header
pRequest = (PUCHAR)m_pCertificateRequest +
((LPREQUEST_HEADER)m_pCertificateRequest)->cbSizeOfHeader;
cbRequest = ((LPREQUEST_HEADER)m_pCertificateRequest)->cbRequestSize;
}
else
{
// there is no header
pRequest = (PUCHAR)m_pCertificateRequest;
cbRequest = m_cbCertificateRequest;
}
// note that if the request isn't there or if it is invalid it is still
// ok to try and verify the certificate
DWORD cbBuffSize = 0;
// start by decoding the request object - get the size of the required buffer
CryptDecodeObject( X509_ASN_ENCODING,
X509_CERT_REQUEST_TO_BE_SIGNED,
pRequest,
cbRequest,
0,
NULL,
&cbBuffSize );
// now make an attempt to decode it
pRequestObject = GlobalAlloc( GPTR, cbBuffSize );
if ( !pRequestObject )
goto GetCredentials;
if ( !CryptDecodeObject( X509_ASN_ENCODING,
X509_CERT_REQUEST_TO_BE_SIGNED,
pRequest,
cbRequest,
0,
pRequestObject,
&cbBuffSize ) )
{
GlobalFree( pRequestObject );
pRequestObject = NULL;
goto GetCredentials;
}
}
GetCredentials:
// OK. Verisign and Certsrv and probably others too wrap the certificate in a wrapper
// that, while following the normal formatting convensions, causes the context routine
// below to fail. This means that we have to detect if the wrapper is there and, if it
// is, we need to skip it. Fortunately, the wrapper contains the word "certificate"
// yes, this is sorta grungy, but its what petesk said to do.
sz = pcert;
sz = sz.Left(20);
if ( sz.Find("certificate") == 6 )
{
pcert += 17;
}
// get the context on the certificate
pcontextCertificate = CertCreateCertificateContext( X509_ASN_ENCODING, pcert, cbcert );
// if we were unable to create the context, then fail with an appropriate error message
if ( !pcontextCertificate )
{
// get the error for the dialog
err = GetLastError();
// tell the user that they chose an invalid certificate
sz.LoadString( IDS_CERTERR_INVALID_CERTIFICATE );
sz.Format( "%s%x", sz, err );
AfxMessageBox( sz );
// time to leave with a failure
fAnswer = FALSE;
goto cleanup;
}
// if we have both a cert context AND a decoded request object, then we can confirm that
// they are in fact matched to each other.
if ( pcontextCertificate && pRequestObject )
{
// use CAPI2 to do the comparison between the two public key info structures
if ( !CertComparePublicKeyInfo( X509_ASN_ENCODING,
&((PCERT_REQUEST_INFO)pRequestObject)->SubjectPublicKeyInfo,
&pcontextCertificate->pCertInfo->SubjectPublicKeyInfo ) )
{
// The certificate is mis-matched to the request. Fail with the right message
CMismatchedCertDlg mismatchdlg(
&((PCERT_REQUEST_INFO)pRequestObject)->Subject,
&pcontextCertificate->pCertInfo->Subject);
mismatchdlg.DoModal();
fAnswer = FALSE;
goto cleanup;
}
}
// use SSL to finish verifying the password
// fill in the credentials record
creds.cbPrivateKey = m_cbPrivateKey;
creds.pPrivateKey = (PUCHAR)m_pPrivateKey;
creds.cbCertificate = m_cbCertificate;
creds.pCertificate = (PUCHAR)m_pCertificate;
// prepare the password
creds.pszPassword = (PSTR)LPCTSTR(szPassword);
// attempt to get the credentials
scRet = AcquireCredentialsHandleW( NULL, // My name (ignored)
UNISP_NAME_W, // Package
SECPKG_CRED_INBOUND, // Use
NULL, // Logon ID (ignored)
&creds, // auth data
NULL, // dce-stuff
NULL, // dce-stuff
&hCreds, // handle
&ts ); // we really get it below
// check the results
if ( FAILED(scRet) )
{
sz.Empty();
// add on the appropriate sub-error message
switch( scRet )
{
case SEC_E_UNKNOWN_CREDENTIALS:
case SEC_E_NO_CREDENTIALS:
case SEC_E_INTERNAL_ERROR:
// Unfortunately, SChannel returns the "internal error" when a bad password
// is returned. There may or may not be other circumstances under which this
// error is returned, but this is by far the most common. Also I taked to
// PeteSk about it and he agreed that this is how it should be used.
// bad password
sz.LoadString( IDS_CERTERROR_BADPASSWORD );
break;
case SEC_E_SECPKG_NOT_FOUND:
case SEC_E_BAD_PKGID:
// the system does not have the package installed
sz.LoadString( IDS_CERTERROR_PACKAGELOAD_ERROR );
break;
case SEC_E_INSUFFICIENT_MEMORY:
sz.LoadString( IDS_CERTERR_LOMEM );
break;
case SEC_E_CANNOT_INSTALL:
sz.LoadString( EDS_CERTERR_SCHNL_BAD_INIT );
break;
default:
sz.LoadString( IDS_CERTERR_SCHNL_GENERIC );
break;
}
// put up the error message
szErr.LoadString( IDS_CERTERR_SCHANNEL_ERR );
sz.Format( "%s%s%x", sz, szErr, scRet );
AfxMessageBox( sz );
// return failure
fAnswer = FALSE;
goto cleanup;
}
// close the credentials handle
FreeCredentialsHandle( &hCreds );
// clean up the certificate contexts
cleanup:
if ( pRequestObject )
GlobalFree( pRequestObject );
if ( pcontextCertificate )
CertFreeCertificateContext( pcontextCertificate );
// return success
return fAnswer;
}
//------------------------------------------------------------------------------
void CKey::OutputHeader( CFile* pFile, PVOID privData1, PVOID privData2 )
{
PADMIN_INFO pInfo = (PADMIN_INFO)privData1;
// we start this by getting the DN strings from either the dialog that was
// passed in through privData or throught cracking the certificate.
CString szCN, szOU, szO, szL, szS, szC;
CKeyCrackedData cracker;
// the only way to get the info is from cracking an existing cert
if ( cracker.CrackKey(this) )
{
cracker.GetDNNetAddress( szCN );
cracker.GetDNUnit( szOU );
cracker.GetDNOrganization( szO );
cracker.GetDNLocality( szL );
cracker.GetDNState( szS );
cracker.GetDNCountry( szC );
}
else
{
if (pInfo->pCommonName) szCN = *pInfo->pCommonName;
if (pInfo->pOrgUnit) szOU = *pInfo->pOrgUnit;
if (pInfo->pOrg) szO = *pInfo->pOrg;
if (pInfo->pLocality) szL = *pInfo->pLocality;
if (pInfo->pState) szS = *pInfo->pState;
if (pInfo->pCountry) szC = *pInfo->pCountry;
}
// ok, output all the strings, starting with the administrator information
CString sz = HEADER_ADMINISTRATOR;
pFile->Write( sz, sz.GetLength() );
if ( pInfo->pEmail )
pFile->Write( *pInfo->pEmail, pInfo->pEmail->GetLength() );
sz = HEADER_PHONE;
pFile->Write( sz, sz.GetLength() );
if ( pInfo->pPhone )
pFile->Write( *pInfo->pPhone, pInfo->pPhone->GetLength() );
sz = HEADER_SERVER;
pFile->Write( sz, sz.GetLength() );
sz.LoadString( IDS_SERVER_INFO_STRING );
pFile->Write( sz, sz.GetLength() );
sz = HEADER_COMMON_NAME;
pFile->Write( sz, sz.GetLength() );
pFile->Write( szCN, szCN.GetLength() );
sz = HEADER_ORG_UNIT;
pFile->Write( sz, sz.GetLength() );
pFile->Write( szOU, szOU.GetLength() );
sz = HEADER_ORGANIZATION;
pFile->Write( sz, sz.GetLength() );
pFile->Write( szO, szO.GetLength() );
sz = HEADER_LOCALITY;
pFile->Write( sz, sz.GetLength() );
pFile->Write( szL, szL.GetLength() );
sz = HEADER_STATE;
pFile->Write( sz, sz.GetLength() );
pFile->Write( szS, szS.GetLength() );
sz = HEADER_COUNTRY;
pFile->Write( sz, sz.GetLength() );
pFile->Write( szC, szC.GetLength() );
sz = HEADER_END_SPACING;
pFile->Write( sz, sz.GetLength() );
}
//------------------------------------------------------------------------------
// this routine is based on the routine "Requestify" from KeyGen
BOOL CKey::FOutputRequestFile( CString szFile, BOOL fMime, PVOID privData )
{
PADMIN_INFO pAdminInfo= (PADMIN_INFO)privData;
ADMIN_INFO AdminInfo;
CAdminInfoDlg aiDlg;
// ok, the priv data points to a structure that contains three strings
// describing the admin requesting this request. If it is null, then we
// must ask this information.
if ( !pAdminInfo )
{
if ( aiDlg.DoModal() != IDOK )
return FALSE;
// fill the darned thing in
ZeroMemory( &AdminInfo, sizeof(AdminInfo) );
pAdminInfo = &AdminInfo;
AdminInfo.pEmail = &aiDlg.m_sz_email;
AdminInfo.pPhone = &aiDlg.m_sz_phone;
}
PUCHAR pEncoded;
DWORD cbData = m_cbCertificateRequest;
// encode the request into a new pointer
pEncoded = PCreateEncodedRequest( m_pCertificateRequest, &cbData, FALSE );
/*
PUCHAR pb;
DWORD cb;
PUCHAR p;
DWORD Size;
PUCHAR pSource;
DWORD cbSource;
ASSERT( pSource );
ASSERT( cbSource );
// we don't actually want to change the source data, so make a copy of it first
pSource = (PUCHAR)GlobalAlloc( GPTR, m_cbCertificateRequest );
if ( !pSource )
{
AfxThrowMemoryException();
return FALSE;
}
cbSource = m_cbCertificateRequest;
// copy over the data
CopyMemory( pSource, m_pCertificateRequest, cbSource );
cb = (cbSource * 3 / 4) + 1024;
pb = (PUCHAR)LocalAlloc( LMEM_FIXED, cb );
if ( !pb )
return FALSE;
p = pb;
if ( fMime )
{
Size = strlen( MIME_TYPE );
CopyMemory( p, MIME_TYPE, Size );
p += Size;
Size = strlen( MIME_ENCODING );
CopyMemory( p, MIME_ENCODING, Size );
p += Size;
}
else
{
Size = strlen( MESSAGE_HEADER );
CopyMemory( p, MESSAGE_HEADER, Size );
p += Size;
}
do
{
Size = HTUU_encode( pSource,
(cbSource > 48 ? 48 : cbSource),
(PCHAR)p );
p += Size;
*p++ = '\r';
*p++ = '\n';
if ( cbSource < 48 )
break;
cbSource -= 48;
pSource += 48;
} while (cbSource);
if ( !fMime )
{
Size = strlen( MESSAGE_TRAILER );
CopyMemory( p, MESSAGE_TRAILER, Size );
p += Size;
}
*/
// write the requestified data into the target file
try
{
// try to open the file
CFile cfile;
if ( !cfile.Open(szFile, CFile::modeCreate | CFile::modeWrite) )
{
AfxMessageBox( IDS_IO_ERROR );
return FALSE;
}
// write out the header stuff that simon at Verisign
// requested at the LAST POSSIBLE MINUTE!!!
OutputHeader( &cfile, pAdminInfo, NULL );
// write the data to the file
// cfile.Write( pb, (p - pb) );
cfile.Write( pEncoded, cbData );
// close the file
cfile.Close();
}
catch( CException e )
{
if ( pEncoded )
LocalFree( pEncoded );
return FALSE;
}
if ( pEncoded )
LocalFree( pEncoded );
return TRUE;
}
//------------------------------------------------------------------------
PUCHAR PCreateEncodedRequest( PVOID pRequest, DWORD* pcb, BOOL fMime )
{
PUCHAR pb;
DWORD cb;
PUCHAR p;
DWORD Size;
PUCHAR pSource;
DWORD cbSource;
DWORD cbRequest = *pcb;
ASSERT( pcb && *pcb );
ASSERT( pRequest );
// get the correct pointer to and size of the request, taking into account the header
LPREQUEST_HEADER pHeader = (LPREQUEST_HEADER)pRequest;
if ( pHeader->Identifier == REQUEST_HEADER_IDENTIFIER )
{
pRequest = (PUCHAR)pRequest + pHeader->cbSizeOfHeader;
cbRequest = *pcb = pHeader->cbRequestSize;
}
// we don't actually want to change the source data, so make a copy of it first
pSource = (PUCHAR)GlobalAlloc( GPTR, cbRequest );
if ( !pSource )
{
AfxThrowMemoryException();
return FALSE;
}
cbSource = cbRequest;
// copy over the data
CopyMemory( pSource, pRequest, cbSource );
cb = (cbSource * 3 / 4) + 1024;
pb = (PUCHAR)LocalAlloc( LMEM_FIXED, cb );
if ( !pb )
return FALSE;
p = pb;
if ( fMime )
{
Size = strlen( MIME_TYPE );
CopyMemory( p, MIME_TYPE, Size );
p += Size;
Size = strlen( MIME_ENCODING );
CopyMemory( p, MIME_ENCODING, Size );
p += Size;
}
else
{
Size = strlen( MESSAGE_HEADER );
CopyMemory( p, MESSAGE_HEADER, Size );
p += Size;
}
do
{
Size = HTUU_encode( pSource,
(cbSource > 48 ? 48 : cbSource),
(PCHAR)p );
p += Size;
*p++ = '\r';
*p++ = '\n';
if ( cbSource < 48 )
break;
cbSource -= 48;
pSource += 48;
} while (cbSource);
if ( !fMime )
{
Size = strlen( MESSAGE_TRAILER );
CopyMemory( p, MESSAGE_TRAILER, Size );
p += Size;
}
// set the count of bytes into place
*pcb = DIFF(p - pb);
//return the pointer to the encoded information
return pb;
}
// Taken right out of KenGen.c
static char six2pr[64] =
{
'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', '/'
};
// Taken right out of KenGen.c
/*--- function HTUU_encode -----------------------------------------------
*
* Encode a single line of binary data to a standard format that
* uses only printing ASCII characters (but takes up 33% more bytes).
*
* Entry bufin points to a buffer of bytes. If nbytes is not
* a multiple of three, then the byte just beyond
* the last byte in the buffer must be 0.
* nbytes is the number of bytes in that buffer.
* This cannot be more than 48.
* bufcoded points to an output buffer. Be sure that this
* can hold at least 1 + (4*nbytes)/3 characters.
*
* Exit bufcoded contains the coded line. The first 4*nbytes/3 bytes
* contain printing ASCII characters representing
* those binary bytes. This may include one or
* two '=' characters used as padding at the end.
* The last byte is a zero byte.
* Returns the number of ASCII characters in "bufcoded".
*/
// Now the HTUU_encode is taken from infocomm/common/fcache and has been fixed by amallet
// it has been modified slightly to take into account that the output buffer was resized above
int HTUU_encode(unsigned char *bufin, unsigned int nbytes, char *bufcoded)
{
register char *outptr = bufcoded;
unsigned int i;
BOOL fOneByteDiff = FALSE;
BOOL fTwoByteDiff = FALSE;
unsigned int iRemainder = 0;
unsigned int iClosestMultOfThree = 0;
iRemainder = nbytes % 3; //also works for nbytes == 1, 2
fOneByteDiff = (iRemainder == 1 ? TRUE : FALSE);
fTwoByteDiff = (iRemainder == 2 ? TRUE : FALSE);
iClosestMultOfThree = ((nbytes - iRemainder)/3) * 3 ;
//
// Encode bytes in buffer up to multiple of 3 that is closest to nbytes.
//
for (i=0; i< iClosestMultOfThree ; i += 3) {
*(outptr++) = six2pr[*bufin >> 2]; /* c1 */
*(outptr++) = six2pr[((*bufin << 4) & 060) | ((bufin[1] >> 4) & 017)]; /*c2*/
*(outptr++) = six2pr[((bufin[1] << 2) & 074) | ((bufin[2] >> 6) & 03)];/*c3*/
*(outptr++) = six2pr[bufin[2] & 077]; /* c4 */
bufin += 3;
}
//
// We deal with trailing bytes by pretending that the input buffer has been padded with
// zeros. Expressions are thus the same as above, but the second half drops off b'cos
// ( a | ( b & 0) ) = ( a | 0 ) = a
//
if (fOneByteDiff)
{
*(outptr++) = six2pr[*bufin >> 2]; /* c1 */
*(outptr++) = six2pr[((*bufin << 4) & 060)]; /* c2 */
//pad with '='
*(outptr++) = '='; /* c3 */
*(outptr++) = '='; /* c4 */
}
else if (fTwoByteDiff)
{
*(outptr++) = six2pr[*bufin >> 2]; /* c1 */
*(outptr++) = six2pr[((*bufin << 4) & 060) | ((bufin[1] >> 4) & 017)]; /*c2*/
*(outptr++) = six2pr[((bufin[1] << 2) & 074)];/*c3*/
//pad with '='
*(outptr++) = '='; /* c4 */
}
//encoded buffer must be zero-terminated
*outptr = '\0';
return DIFF(outptr - bufcoded);
}
//============================ BASED ON SETKEY
const int pr2six[256]={
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,62,64,64,64,63,
52,53,54,55,56,57,58,59,60,61,64,64,64,64,64,64,64,0,1,2,3,4,5,6,7,8,9,
10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,64,64,64,64,64,64,26,27,
28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,
64,64,64,64,64,64,64,64,64,64,64,64,64
};
//
// We have to squirt a record into the decoded stream
//
#define CERT_RECORD 13
#define CERT_SIZE_HIBYTE 2 // Index into record of record size
#define CERT_SIZE_LOBYTE 3
unsigned char abCertHeader[] = {0x30, 0x82, // Record
0x00, 0x00, // Size of cert + buff
0x04, 0x0b, 0x63, 0x65,// Cert record data
0x72, 0x74, 0x69, 0x66,
0x69, 0x63, 0x61, 0x74,
0x65 };
void uudecode_cert(char *bufcoded, DWORD *pcbDecoded )
{
int nbytesdecoded;
char *bufin = bufcoded;
unsigned char *bufout = (unsigned char *)bufcoded;
unsigned char *pbuf;
int nprbytes;
char * beginbuf = bufcoded;
ASSERT(bufcoded);
ASSERT(pcbDecoded);
/* Strip leading whitespace. */
while(*bufcoded==' ' ||
*bufcoded == '\t' ||
*bufcoded == '\r' ||
*bufcoded == '\n' )
{
bufcoded++;
}
//
// If there is a beginning '---- ....' then skip the first line
//
if ( bufcoded[0] == '-' && bufcoded[1] == '-' )
{
bufin = strchr( bufcoded, '\n' );
if ( bufin )
{
bufin++;
bufcoded = bufin;
}
else
{
bufin = bufcoded;
}
}
else
{
bufin = bufcoded;
}
//
// Strip all cr/lf from the block
//
pbuf = (unsigned char *)bufin;
while ( *pbuf )
{
if ( *pbuf == '\r' || *pbuf == '\n' )
{
memmove( (void*)pbuf, pbuf+1, strlen( (char*)pbuf + 1) + 1 );
}
else
{
pbuf++;
}
}
/* Figure out how many characters are in the input buffer.
* If this would decode into more bytes than would fit into
* the output buffer, adjust the number of input bytes downwards.
*/
while(pr2six[*(bufin++)] <= 63);
nprbytes = DIFF(bufin - bufcoded) - 1;
nbytesdecoded = ((nprbytes+3)/4) * 3;
bufin = bufcoded;
while (nprbytes > 0) {
*(bufout++) =
(unsigned char) (pr2six[*bufin] << 2 | pr2six[bufin[1]] >> 4);
*(bufout++) =
(unsigned char) (pr2six[bufin[1]] << 4 | pr2six[bufin[2]] >> 2);
*(bufout++) =
(unsigned char) (pr2six[bufin[2]] << 6 | pr2six[bufin[3]]);
bufin += 4;
nprbytes -= 4;
}
if(nprbytes & 03) {
if(pr2six[bufin[-2]] > 63)
nbytesdecoded -= 2;
else
nbytesdecoded -= 1;
}
//
// Now we need to add a new wrapper sequence around the certificate
// indicating this is a certificate
//
memmove( beginbuf + sizeof(abCertHeader),
beginbuf,
nbytesdecoded );
memcpy( beginbuf,
abCertHeader,
sizeof(abCertHeader) );
//
// The beginning record size is the total number of bytes decoded plus
// the number of bytes in the certificate header
//
beginbuf[CERT_SIZE_HIBYTE] = (BYTE) (((USHORT)nbytesdecoded+CERT_RECORD) >> 8);
beginbuf[CERT_SIZE_LOBYTE] = (BYTE) ((USHORT)nbytesdecoded+CERT_RECORD);
nbytesdecoded += sizeof(abCertHeader);
if ( pcbDecoded )
*pcbDecoded = nbytesdecoded;
}
// ============ END BASED ON SETKEY
//------------------------------------------------------------------------------
BOOL CKey::FImportKeySetFiles( CString szPrivate, CString szPublic, CString &szPass )
{
BOOL fSuccess = TRUE;
// in this routine, we load the data from the file, initialize it, and ask
// the user for a password, which we then confirm with AcquireCredHandle.
// several things we will be doing can throw, so use a try/catch
try
{
// start by opening the private data file
CFile cfile( szPrivate, CFile::modeRead|CFile::shareDenyWrite );
// get the length of the file
m_cbPrivateKey = cfile.GetLength();
// create a handle to hold the data
m_pPrivateKey = GlobalAlloc( GPTR, m_cbPrivateKey );
if ( !m_pPrivateKey )
{
cfile.Close();
AfxThrowMemoryException();
};
// great, now read the data out of the file
cfile.Read( m_pPrivateKey, m_cbPrivateKey );
// close the file
cfile.Close();
// reading in the certificate is easy because that was done elsewhere
if ( szPublic && !szPublic.IsEmpty() )
{
fSuccess = FInstallCertificate( szPublic, szPass );
if ( fSuccess )
// set the password
m_szPassword = szPass;
}
}
catch( CException e )
{
return FALSE;
}
return fSuccess;
}
//------------------------------------------------------------------------------
void ReadWriteDWORD( CFile *pFile, DWORD *pDword, BOOL fRead );
void ReadWriteString( CFile *pFile, CString &sz, BOOL fRead );
void ReadWriteBlob( CFile *pFile, PVOID pBlob, DWORD cbBlob, BOOL fRead );
//------------------------------------------------------------------------------
BOOL CKey::FImportExportBackupFile( CString szFile, BOOL fImport )
{
DWORD dword;
UINT nOpenFlags;
CConfirmPassDlg dlgconfirm;
// set up the right open flags
if ( fImport )
nOpenFlags = CFile::modeRead | CFile::shareDenyNone;
else
nOpenFlags = CFile::modeCreate | CFile::modeReadWrite | CFile::shareExclusive;
// put it in a try/catch to get any errors
try
{
CFile file( szFile, nOpenFlags );
// do the backup id
dword = BACKUP_ID;
ReadWriteDWORD( &file, &dword, fImport );
// check the backup id
if ( dword != BACKUP_ID )
{
AfxMessageBox( IDS_KEY_FILE_INVALID );
return FALSE;
}
// start with the name of the key
CString szName = GetName();
ReadWriteString( &file, szName, fImport );
if ( fImport ) SetName( szName );
// now the private key data size
ReadWriteDWORD( &file, &m_cbPrivateKey, fImport );
// make a private key data pointer if necessary
if ( fImport && m_cbPrivateKey )
{
m_pPrivateKey = GlobalAlloc( GPTR, m_cbPrivateKey );
if ( !m_pPrivateKey ) AfxThrowMemoryException();
}
// use the private key pointer
if ( m_cbPrivateKey )
ReadWriteBlob( &file, m_pPrivateKey, m_cbPrivateKey, fImport );
// now the certificate
ReadWriteDWORD( &file, &m_cbCertificate, fImport );
// make a data pointer if necessary
if ( fImport && m_cbCertificate )
{
m_pCertificate = GlobalAlloc( GPTR, m_cbCertificate );
if ( !m_pCertificate ) AfxThrowMemoryException();
}
// use the private key pointer
if ( m_cbCertificate )
ReadWriteBlob( &file, m_pCertificate, m_cbCertificate, fImport );
// now the request
ReadWriteDWORD( &file, &m_cbCertificateRequest, fImport );
// make a data pointer if necessary
if ( fImport && m_cbCertificateRequest )
{
m_pCertificateRequest = GlobalAlloc( GPTR, m_cbCertificateRequest );
if ( !m_pCertificateRequest ) AfxThrowMemoryException();
}
// use the private key pointer
if ( m_cbCertificateRequest )
ReadWriteBlob( &file, m_pCertificateRequest, m_cbCertificateRequest, fImport );
// finally, if we are importing, we need to confirm the password
// Except if there is no Cert, which means Import of a Request
if ( m_cbCertificate && fImport )
{
//if we are importing, get the password first
if ( dlgconfirm.DoModal() != IDOK )
return FALSE;
if ( !FVerifyValidPassword(dlgconfirm.m_szPassword) )
{
// the Verify Valid Password routine puts up all
// the correct error dialogs now
return FALSE;
}
// set the password into place
m_szPassword = dlgconfirm.m_szPassword;
}
}
catch( CException e )
{
// return failure
return FALSE;
}
// return success
return TRUE;
}
// file utilities
//---------------------------------------------------------------------------
void ReadWriteDWORD( CFile *pFile, DWORD *pDword, BOOL fRead )
{
ASSERT(pFile);
ASSERT(pDword);
// read it or write it
if ( fRead )
pFile->Read( (void*)pDword, sizeof(DWORD) );
else
pFile->Write( (void*)pDword, sizeof(DWORD) );
}
//---------------------------------------------------------------------------
void ReadWriteString( CFile *pFile, CString &sz, BOOL fRead )
{
ASSERT(pFile);
ASSERT(sz);
// get the length of the string
DWORD cbLength = sz.GetLength();
ReadWriteDWORD(pFile,&cbLength,fRead );
// read or write the string
LPTSTR psz = sz.GetBuffer( cbLength+1 );
ReadWriteBlob(pFile, psz, cbLength+1, fRead);
// free the string buffer
sz.ReleaseBuffer();
}
//---------------------------------------------------------------------------
void ReadWriteBlob( CFile *pFile, PVOID pBlob, DWORD cbBlob, BOOL fRead )
{
ASSERT(pFile);
ASSERT(pBlob);
ASSERT(cbBlob);
// read it or write it
if ( fRead )
pFile->Read( pBlob, cbBlob );
else
pFile->Write( pBlob, cbBlob );
}
Reference in a new issue Copy permalink