753 lines
25 KiB
C++
753 lines
25 KiB
C++
|
//+---------------------------------------------------------------------------
|
||
|
|
//
|
||
|
|
// Microsoft Windows
|
||
|
|
// Copyright (C) Microsoft Corporation, 1997-2001.
|
||
|
|
//
|
||
|
|
// File: StoreGPE.cpp
|
||
|
|
//
|
||
|
|
// Contents: Implementation of CCertStoreGPE
|
||
|
|
//
|
||
|
|
//----------------------------------------------------------------------------
|
||
|
|
#include "stdafx.h"
|
||
|
|
#include <gpedit.h>
|
||
|
|
#include "cookie.h"
|
||
|
|
#include "storegpe.h"
|
||
|
|
#include "certifct.h"
|
||
|
|
|
||
|
|
USE_HANDLE_MACROS("CERTMGR(storegpe.cpp)")
|
||
|
|
|
||
|
|
#ifdef _DEBUG
|
||
|
|
#ifndef ALPHA
|
||
|
|
#define new DEBUG_NEW
|
||
|
|
#endif
|
||
|
|
#undef THIS_FILE
|
||
|
|
static char THIS_FILE[] = __FILE__;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
GUID g_guidExtension = { 0xb1be8d72, 0x6eac, 0x11d2, {0xa4, 0xea, 0x00, 0xc0, 0x4f, 0x79, 0xf8, 0x3a }};
|
||
|
|
GUID g_guidRegExt = REGISTRY_EXTENSION_GUID;
|
||
|
|
GUID g_guidSnapin = CLSID_CertificateManager;
|
||
|
|
|
||
|
|
///////////////////////////////////////////////////////////////////////////////
|
||
|
|
///////////////////////////////////////////////////////////////////////////////
|
||
|
|
HRESULT CCertStoreGPE::Commit ()
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::Commit - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
HRESULT hr = S_OK;
|
||
|
|
|
||
|
|
|
||
|
|
if ( GetStoreType () == EFS_STORE && !m_fIsNullEFSPolicy )
|
||
|
|
{
|
||
|
|
if ( SUCCEEDED (hr) )
|
||
|
|
hr = WriteEFSBlobToRegistry ();
|
||
|
|
}
|
||
|
|
|
||
|
|
if ( SUCCEEDED (hr) && m_bDirty )
|
||
|
|
{
|
||
|
|
hr = CCertStore::Commit ();
|
||
|
|
ASSERT (SUCCEEDED (hr));
|
||
|
|
ASSERT (m_pGPEInformation);
|
||
|
|
if ( SUCCEEDED (hr) && m_pGPEInformation )
|
||
|
|
{
|
||
|
|
hr = m_pGPEInformation->PolicyChanged (
|
||
|
|
m_fIsComputerType ? TRUE : FALSE,
|
||
|
|
TRUE, &g_guidExtension, &g_guidSnapin );
|
||
|
|
hr = m_pGPEInformation->PolicyChanged (
|
||
|
|
m_fIsComputerType ? TRUE : FALSE,
|
||
|
|
TRUE, &g_guidRegExt, &g_guidSnapin );
|
||
|
|
ASSERT (SUCCEEDED (hr));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::Commit - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return hr;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
CCertStoreGPE::CCertStoreGPE (
|
||
|
|
DWORD dwFlags,
|
||
|
|
LPCWSTR lpcszMachineName,
|
||
|
|
LPCWSTR objectName,
|
||
|
|
const CString & pcszLogStoreName,
|
||
|
|
const CString & pcszPhysStoreName,
|
||
|
|
IGPEInformation * pGPTInformation,
|
||
|
|
const GUID& compDataGUID,
|
||
|
|
IConsole* pConsole)
|
||
|
|
: CCertStore (CERTMGR_LOG_STORE_GPE,
|
||
|
|
CERT_STORE_PROV_SYSTEM, dwFlags, lpcszMachineName, objectName,
|
||
|
|
pcszLogStoreName, pcszPhysStoreName,
|
||
|
|
StoreNameToType (pcszLogStoreName),
|
||
|
|
0,
|
||
|
|
pConsole),
|
||
|
|
m_pGPEInformation (pGPTInformation),
|
||
|
|
m_fIsComputerType (false),
|
||
|
|
m_fIsNullEFSPolicy (true), // assume NULL policy until proven otherwise
|
||
|
|
m_hGroupPolicyKey (0)
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::CCertStoreGPE - %s\n",
|
||
|
|
(LPCWSTR) pcszLogStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
ASSERT (m_pGPEInformation);
|
||
|
|
if ( m_pGPEInformation )
|
||
|
|
{
|
||
|
|
m_pGPEInformation->AddRef ();
|
||
|
|
if ( ::IsEqualGUID (compDataGUID, NODEID_User) )
|
||
|
|
{
|
||
|
|
m_fIsComputerType = false;
|
||
|
|
m_dwFlags |= CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY;
|
||
|
|
}
|
||
|
|
else if ( ::IsEqualGUID (compDataGUID, NODEID_Machine) )
|
||
|
|
{
|
||
|
|
m_fIsComputerType = true;
|
||
|
|
m_dwFlags |= CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY;
|
||
|
|
}
|
||
|
|
else
|
||
|
|
ASSERT (0);
|
||
|
|
}
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::CCertStoreGPE - %s\n",
|
||
|
|
(LPCWSTR) pcszLogStoreName);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
CCertStoreGPE::~CCertStoreGPE ()
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::~CCertStoreGPE - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);;
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
|
||
|
|
if ( m_hGroupPolicyKey )
|
||
|
|
RegCloseKey (m_hGroupPolicyKey);
|
||
|
|
|
||
|
|
if ( m_pGPEInformation )
|
||
|
|
{
|
||
|
|
m_pGPEInformation->Release ();
|
||
|
|
m_pGPEInformation = 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
CERT_CONTEXT_PSID_STRUCT* pCert = 0;
|
||
|
|
while (!m_EFSCertList.IsEmpty () )
|
||
|
|
{
|
||
|
|
pCert = m_EFSCertList.RemoveHead ();
|
||
|
|
ASSERT (pCert);
|
||
|
|
if ( pCert )
|
||
|
|
delete pCert;
|
||
|
|
}
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::~CCertStoreGPE - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
}
|
||
|
|
|
||
|
|
HCERTSTORE CCertStoreGPE::GetStoreHandle (BOOL bSilent /*= FALSE*/, HRESULT* phr /* = 0*/)
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::GetStoreHandle - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
CERT_SYSTEM_STORE_RELOCATE_PARA RelocatePara;
|
||
|
|
void* pvPara = 0;
|
||
|
|
|
||
|
|
if ( !m_hCertStore )
|
||
|
|
{
|
||
|
|
DWORD dwErr = 0;
|
||
|
|
|
||
|
|
if ( EFS_STORE == GetStoreType () && m_fIsNullEFSPolicy )
|
||
|
|
{
|
||
|
|
// Test to see if EFS key exists, if not, flag this as
|
||
|
|
// having no EFS policy and return.
|
||
|
|
HKEY hEFSKey = 0;
|
||
|
|
LONG lResult = ::RegOpenKeyEx (GetGroupPolicyKey (), CERT_EFSBLOB_REGPATH, 0,
|
||
|
|
KEY_ALL_ACCESS, &hEFSKey);
|
||
|
|
if ( ERROR_SUCCESS == lResult )
|
||
|
|
{
|
||
|
|
m_fIsNullEFSPolicy = false;
|
||
|
|
VERIFY (ERROR_SUCCESS == ::RegCloseKey (hEFSKey));
|
||
|
|
}
|
||
|
|
else
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
RelocatePara.hKeyBase = GetGroupPolicyKey ();
|
||
|
|
RelocatePara.pwszSystemStore = (LPCWSTR) m_pcszStoreName;
|
||
|
|
pvPara = (void*) &RelocatePara;
|
||
|
|
m_hCertStore = ::CertOpenStore (m_storeProvider,
|
||
|
|
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, NULL,
|
||
|
|
m_dwFlags | CERT_STORE_SET_LOCALIZED_NAME_FLAG | CERT_STORE_MAXIMUM_ALLOWED_FLAG,
|
||
|
|
pvPara);
|
||
|
|
if ( !m_hCertStore )
|
||
|
|
{
|
||
|
|
dwErr = GetLastError ();
|
||
|
|
if ( phr )
|
||
|
|
*phr = HRESULT_FROM_WIN32 (dwErr);
|
||
|
|
m_hCertStore = ::CertOpenStore (m_storeProvider,
|
||
|
|
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, NULL,
|
||
|
|
m_dwFlags | CERT_STORE_READONLY_FLAG | CERT_STORE_SET_LOCALIZED_NAME_FLAG,
|
||
|
|
pvPara);
|
||
|
|
if ( m_hCertStore )
|
||
|
|
m_bReadOnly = true;
|
||
|
|
else
|
||
|
|
{
|
||
|
|
dwErr = GetLastError ();
|
||
|
|
if ( phr )
|
||
|
|
*phr = HRESULT_FROM_WIN32 (dwErr);
|
||
|
|
_TRACE (0, L"CertOpenStore (%s) failed: 0x%x\n",
|
||
|
|
(PCWSTR) m_pcszStoreName, dwErr);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if ( !m_hCertStore && !m_bUnableToOpenMsgDisplayed && !bSilent &&
|
||
|
|
(USERDS_STORE != GetStoreType ()) )
|
||
|
|
{
|
||
|
|
m_bUnableToOpenMsgDisplayed = true;
|
||
|
|
CString caption;
|
||
|
|
CString text;
|
||
|
|
int iRetVal = 0;
|
||
|
|
|
||
|
|
VERIFY (caption.LoadString (IDS_CERTIFICATE_MANAGER));
|
||
|
|
text.FormatMessage (IDS_UNABLE_TO_OPEN_STORE, GetStoreName (),
|
||
|
|
GetSystemMessage (dwErr));
|
||
|
|
if ( m_pConsole )
|
||
|
|
m_pConsole->MessageBox (text, caption, MB_OK | MB_ICONINFORMATION, &iRetVal);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::GetStoreHandle - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
|
||
|
|
return m_hCertStore;
|
||
|
|
}
|
||
|
|
|
||
|
|
bool CCertStoreGPE::CanContain(CertificateManagerObjectType nodeType)
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::CanContain - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
bool bCanContain = false;
|
||
|
|
|
||
|
|
switch (nodeType)
|
||
|
|
{
|
||
|
|
case CERTMGR_CERTIFICATE:
|
||
|
|
if ( ROOT_STORE == GetStoreType () ||
|
||
|
|
EFS_STORE == GetStoreType () )
|
||
|
|
{
|
||
|
|
bCanContain = true;
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
|
||
|
|
case CERTMGR_CTL:
|
||
|
|
if ( TRUST_STORE == GetStoreType () )
|
||
|
|
{
|
||
|
|
bCanContain = true;
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
|
||
|
|
default:
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::CanContain - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return bCanContain;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
bool CCertStoreGPE::IsMachineStore()
|
||
|
|
{
|
||
|
|
_TRACE (0, L"Entering and leaving CCertStoreGPE::IsMachineStore - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
|
||
|
|
if (m_dwFlags & CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY)
|
||
|
|
return true;
|
||
|
|
else
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
HKEY CCertStoreGPE::GetGroupPolicyKey()
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::GetGroupPolicyKey - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
if ( !m_hGroupPolicyKey )
|
||
|
|
{
|
||
|
|
if ( m_fIsComputerType )
|
||
|
|
{
|
||
|
|
HRESULT hr = m_pGPEInformation->GetRegistryKey (GPO_SECTION_MACHINE,
|
||
|
|
&m_hGroupPolicyKey);
|
||
|
|
ASSERT (SUCCEEDED (hr));
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
HRESULT hr = m_pGPEInformation->GetRegistryKey (GPO_SECTION_USER,
|
||
|
|
&m_hGroupPolicyKey);
|
||
|
|
ASSERT (SUCCEEDED (hr));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::GetGroupPolicyKey - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return m_hGroupPolicyKey;
|
||
|
|
}
|
||
|
|
|
||
|
|
IGPEInformation * CCertStoreGPE::GetGPEInformation() const
|
||
|
|
{
|
||
|
|
_TRACE (0, L"Entering and leaving CCertStoreGPE::GetGPEInformation - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
return m_pGPEInformation;
|
||
|
|
}
|
||
|
|
|
||
|
|
HRESULT CCertStoreGPE::WriteEFSBlobToRegistry()
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::WriteEFSBlobToRegistry - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
HRESULT hr = S_OK;
|
||
|
|
|
||
|
|
if ( !m_fIsNullEFSPolicy )
|
||
|
|
{
|
||
|
|
HKEY hGroupPolicyKey = GetGroupPolicyKey ();
|
||
|
|
if ( hGroupPolicyKey )
|
||
|
|
{
|
||
|
|
DWORD dwDisposition = 0;
|
||
|
|
HKEY efsBlobKey = 0;
|
||
|
|
int nCertCnt = GetCertCount ();
|
||
|
|
|
||
|
|
LONG lResult = ::RegCreateKeyEx (hGroupPolicyKey, // handle of an open key
|
||
|
|
CERT_EFSBLOB_REGPATH, // address of subkey name
|
||
|
|
0, // reserved
|
||
|
|
L"", // address of class string
|
||
|
|
REG_OPTION_NON_VOLATILE, // special options flag
|
||
|
|
KEY_ALL_ACCESS, // desired security access
|
||
|
|
NULL, // address of key security structure
|
||
|
|
&efsBlobKey, // address of buffer for opened handle
|
||
|
|
&dwDisposition); // address of disposition value buffer
|
||
|
|
ASSERT (lResult == ERROR_SUCCESS);
|
||
|
|
if ( lResult == ERROR_SUCCESS )
|
||
|
|
{
|
||
|
|
PEFS_PUBLIC_KEY_INFO* pEFSPKI = new PEFS_PUBLIC_KEY_INFO[nCertCnt];
|
||
|
|
DWORD* cbPKI = new DWORD[nCertCnt];
|
||
|
|
PRECOVERY_KEY_1_1* pRecoveryKey = new PRECOVERY_KEY_1_1[nCertCnt];
|
||
|
|
DWORD* cbRecoveryKey = new DWORD[nCertCnt];
|
||
|
|
PRECOVERY_POLICY_1_1 pRecoveryPolicy = 0;
|
||
|
|
DWORD cbRecoveryPolicy = 0;
|
||
|
|
BYTE* pData = 0;
|
||
|
|
DWORD cbData = 0;
|
||
|
|
int nActualCertCnt = 0;
|
||
|
|
PCCERT_CONTEXT pCertContext = 0;
|
||
|
|
|
||
|
|
if ( !pEFSPKI || ! cbPKI || ! pRecoveryKey || !cbRecoveryKey )
|
||
|
|
{
|
||
|
|
VERIFY (ERROR_SUCCESS == ::RegCloseKey (efsBlobKey));
|
||
|
|
hr = E_OUTOFMEMORY;
|
||
|
|
}
|
||
|
|
|
||
|
|
::ZeroMemory (pEFSPKI, nCertCnt*sizeof (PEFS_PUBLIC_KEY_INFO));
|
||
|
|
::ZeroMemory (cbPKI, nCertCnt*sizeof (DWORD));
|
||
|
|
::ZeroMemory (pRecoveryKey, nCertCnt*sizeof (PRECOVERY_KEY_1_1));
|
||
|
|
::ZeroMemory (cbRecoveryKey, nCertCnt*sizeof (DWORD));
|
||
|
|
|
||
|
|
while ( 1 )
|
||
|
|
{
|
||
|
|
// Subsequent calls to CertEnumCertificatesInStore () free pCertContext. If
|
||
|
|
// we must break prematurely out of this loop, we must CertFreeCertificateContext ()
|
||
|
|
// explicitly on the last pCertContext
|
||
|
|
pCertContext = EnumCertificates (pCertContext);
|
||
|
|
if ( pCertContext )
|
||
|
|
{
|
||
|
|
hr = CreatePublicKeyInformationCertificate (
|
||
|
|
GetPSIDFromCert (pCertContext),
|
||
|
|
pCertContext->pbCertEncoded,
|
||
|
|
pCertContext->cbCertEncoded,
|
||
|
|
&pEFSPKI[nActualCertCnt],
|
||
|
|
&cbPKI[nActualCertCnt]);
|
||
|
|
if ( SUCCEEDED (hr) )
|
||
|
|
{
|
||
|
|
cbRecoveryKey[nActualCertCnt] = sizeof (ULONG) + cbPKI[nActualCertCnt];
|
||
|
|
pRecoveryKey[nActualCertCnt] = (PRECOVERY_KEY_1_1) ::LocalAlloc (LPTR, cbRecoveryKey[nActualCertCnt]);
|
||
|
|
if ( pRecoveryKey[nActualCertCnt] )
|
||
|
|
{
|
||
|
|
pRecoveryKey[nActualCertCnt]->TotalLength = cbRecoveryKey[nActualCertCnt];
|
||
|
|
memcpy (&(pRecoveryKey[nActualCertCnt]->PublicKeyInfo),
|
||
|
|
pEFSPKI[nActualCertCnt],
|
||
|
|
cbPKI[nActualCertCnt]);
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
hr = E_OUTOFMEMORY;
|
||
|
|
::CertFreeCertificateContext (pCertContext);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
nActualCertCnt++;
|
||
|
|
if ( nActualCertCnt > nCertCnt )
|
||
|
|
{
|
||
|
|
ASSERT (0);
|
||
|
|
::CertFreeCertificateContext (pCertContext);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
else
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
Close ();
|
||
|
|
ASSERT (nActualCertCnt == nCertCnt);
|
||
|
|
if ( SUCCEEDED (hr) )
|
||
|
|
{
|
||
|
|
|
||
|
|
cbRecoveryPolicy = sizeof (RECOVERY_POLICY_HEADER);
|
||
|
|
for (int nIndex = 0; nIndex < nActualCertCnt; nIndex++)
|
||
|
|
cbRecoveryPolicy += cbRecoveryKey[nIndex];
|
||
|
|
pRecoveryPolicy = (PRECOVERY_POLICY_1_1) ::LocalAlloc (LPTR, cbRecoveryPolicy);
|
||
|
|
if ( pRecoveryPolicy )
|
||
|
|
{
|
||
|
|
pRecoveryPolicy->RecoveryPolicyHeader.MajorRevision = EFS_RECOVERY_POLICY_MAJOR_REVISION_1;
|
||
|
|
pRecoveryPolicy->RecoveryPolicyHeader.MinorRevision = EFS_RECOVERY_POLICY_MINOR_REVISION_1;
|
||
|
|
pRecoveryPolicy->RecoveryPolicyHeader.RecoveryKeyCount = nActualCertCnt;
|
||
|
|
|
||
|
|
// Build array of variable size recovery keys.
|
||
|
|
BYTE* ptr = (BYTE*) pRecoveryPolicy->RecoveryKeyList;
|
||
|
|
for (int nIndex = 0; nIndex < nActualCertCnt; nIndex++)
|
||
|
|
{
|
||
|
|
memcpy (ptr, pRecoveryKey[nIndex], cbRecoveryKey[nIndex]);
|
||
|
|
ptr += cbRecoveryKey[nIndex];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
hr = E_OUTOFMEMORY;
|
||
|
|
}
|
||
|
|
|
||
|
|
if ( pRecoveryPolicy ) // otherwise, the value is set to 0
|
||
|
|
{
|
||
|
|
pData = (BYTE*) pRecoveryPolicy;
|
||
|
|
cbData = cbRecoveryPolicy;
|
||
|
|
}
|
||
|
|
lResult = RegSetValueEx (efsBlobKey, // handle of key to set value for
|
||
|
|
CERT_EFSBLOB_VALUE_NAME, // address of value to set
|
||
|
|
0, // reserved
|
||
|
|
REG_BINARY, // flag for value type
|
||
|
|
pData, // address of value data
|
||
|
|
cbData); // size of value data
|
||
|
|
if ( lResult == ERROR_SUCCESS )
|
||
|
|
{
|
||
|
|
m_bDirty = true;
|
||
|
|
}
|
||
|
|
else
|
||
|
|
DisplaySystemError (NULL, lResult);
|
||
|
|
}
|
||
|
|
VERIFY (ERROR_SUCCESS == ::RegCloseKey (efsBlobKey));
|
||
|
|
efsBlobKey = 0;
|
||
|
|
|
||
|
|
// Free all the allocated pointers in the arrays.
|
||
|
|
for (int nIndex = 0; nIndex < nActualCertCnt; nIndex++)
|
||
|
|
{
|
||
|
|
if ( pEFSPKI[nIndex] )
|
||
|
|
::LocalFree (pEFSPKI[nIndex]);
|
||
|
|
if ( pRecoveryKey[nIndex] )
|
||
|
|
::LocalFree (pRecoveryKey[nIndex]);
|
||
|
|
}
|
||
|
|
|
||
|
|
// Free the allocated arrays
|
||
|
|
if ( pEFSPKI )
|
||
|
|
delete [] pEFSPKI;
|
||
|
|
if ( cbPKI )
|
||
|
|
delete [] cbPKI;
|
||
|
|
if ( cbRecoveryKey )
|
||
|
|
delete [] cbRecoveryKey;
|
||
|
|
if ( pRecoveryKey )
|
||
|
|
delete [] pRecoveryKey;
|
||
|
|
|
||
|
|
if ( pRecoveryPolicy )
|
||
|
|
::LocalFree (pRecoveryPolicy);
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
hr = HRESULT_FROM_WIN32 (lResult);
|
||
|
|
DisplaySystemError (NULL, lResult);
|
||
|
|
}
|
||
|
|
if ( SUCCEEDED (hr) )
|
||
|
|
m_bDirty = true;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::WriteEFSBlobToRegistry - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return hr;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
#define POINTER_TO_OFFSET( Pointer, Base ) (((PUCHAR)(Pointer)) - ((PUCHAR)(Base)))
|
||
|
|
|
||
|
|
HRESULT CCertStoreGPE::CreatePublicKeyInformationCertificate(
|
||
|
|
IN PSID pUserSid OPTIONAL,
|
||
|
|
PBYTE pbCert,
|
||
|
|
DWORD cbCert,
|
||
|
|
OUT PEFS_PUBLIC_KEY_INFO * PublicKeyInformation,
|
||
|
|
DWORD* pcbPublicKeyInfo)
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::CreatePublicKeyInformationCertificate - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
ASSERT (PublicKeyInformation && pcbPublicKeyInfo);
|
||
|
|
if ( !PublicKeyInformation || !pcbPublicKeyInfo )
|
||
|
|
return E_POINTER;
|
||
|
|
|
||
|
|
DWORD PublicKeyInformationLength = 0;
|
||
|
|
DWORD UserSidLength = 0;
|
||
|
|
PWCHAR Base = 0;
|
||
|
|
|
||
|
|
if (pUserSid != NULL)
|
||
|
|
{
|
||
|
|
UserSidLength = GetLengthSid( pUserSid );
|
||
|
|
}
|
||
|
|
|
||
|
|
PublicKeyInformationLength = sizeof( EFS_PUBLIC_KEY_INFO ) + UserSidLength + cbCert;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Allocate and fill in the PublicKeyInformation structure
|
||
|
|
//
|
||
|
|
|
||
|
|
*PublicKeyInformation = (PEFS_PUBLIC_KEY_INFO) ::LocalAlloc (LPTR, PublicKeyInformationLength);
|
||
|
|
|
||
|
|
if ( !(*PublicKeyInformation) )
|
||
|
|
{
|
||
|
|
return ERROR_NOT_ENOUGH_MEMORY;
|
||
|
|
}
|
||
|
|
|
||
|
|
(*PublicKeyInformation)->Length = PublicKeyInformationLength;
|
||
|
|
(*PublicKeyInformation)->KeySourceTag = (ULONG)EfsCertificate;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Copy the string and SID data to the end of the structure.
|
||
|
|
//
|
||
|
|
|
||
|
|
Base = (PWCHAR)(*PublicKeyInformation);
|
||
|
|
Base = (PWCHAR)((PBYTE)Base + sizeof( EFS_PUBLIC_KEY_INFO ));
|
||
|
|
|
||
|
|
if (pUserSid != NULL)
|
||
|
|
{
|
||
|
|
(*PublicKeyInformation)->PossibleKeyOwner = (ULONG)POINTER_TO_OFFSET( Base, *PublicKeyInformation );
|
||
|
|
CopySid( UserSidLength, (PSID)Base, pUserSid );
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
(*PublicKeyInformation)->PossibleKeyOwner = (ULONG)NULL;
|
||
|
|
}
|
||
|
|
|
||
|
|
Base = (PWCHAR)((PBYTE)Base + UserSidLength);
|
||
|
|
|
||
|
|
(*PublicKeyInformation)->CertificateInfo.CertificateLength = cbCert;
|
||
|
|
(*PublicKeyInformation)->CertificateInfo.Certificate = (ULONG)POINTER_TO_OFFSET( Base, *PublicKeyInformation );
|
||
|
|
|
||
|
|
memcpy( (PBYTE)Base, pbCert, cbCert );
|
||
|
|
*pcbPublicKeyInfo = PublicKeyInformationLength;
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::CreatePublicKeyInformationCertificate - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
void CCertStoreGPE::AddCertToList(PCCERT_CONTEXT pCertContext, PSID userPSID)
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::AddCertToList - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
if ( pCertContext && userPSID )
|
||
|
|
{
|
||
|
|
CERT_CONTEXT_PSID_STRUCT* pCert = new CERT_CONTEXT_PSID_STRUCT (
|
||
|
|
pCertContext, userPSID);
|
||
|
|
if ( pCert )
|
||
|
|
{
|
||
|
|
m_EFSCertList.AddTail (pCert);
|
||
|
|
m_bDirty = true;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::AddCertToList - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
}
|
||
|
|
|
||
|
|
PSID CCertStoreGPE::GetPSIDFromCert (PCCERT_CONTEXT pCertContext)
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::GetPSIDFromCert - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
PSID pSID = 0;
|
||
|
|
CERT_CONTEXT_PSID_STRUCT* pCert = 0;
|
||
|
|
POSITION curPos = 0;
|
||
|
|
|
||
|
|
for (POSITION nextPos = m_EFSCertList.GetHeadPosition (); nextPos; )
|
||
|
|
{
|
||
|
|
curPos = nextPos;
|
||
|
|
pCert = m_EFSCertList.GetNext (nextPos);
|
||
|
|
if ( CertCompareCertificate (
|
||
|
|
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
|
||
|
|
pCert->m_pCertContext->pCertInfo,
|
||
|
|
pCertContext->pCertInfo) )
|
||
|
|
{
|
||
|
|
pSID = pCert->m_psid;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::GetPSIDFromCert - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return pSID;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
void CCertStoreGPE::FinalCommit()
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::FinalCommit - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (CERTMGR_LOG_STORE_GPE == m_objecttype);
|
||
|
|
// Called only from destructor
|
||
|
|
// Cannot commit here for GPT: GPT has already freed all pertinent data
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::FinalCommit - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
bool CCertStoreGPE::IsNullEFSPolicy()
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::IsNullEFSPolicy - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
GetStoreHandle (); // to initialize
|
||
|
|
Close ();
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::IsNullEFSPolicy - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return m_fIsNullEFSPolicy;
|
||
|
|
}
|
||
|
|
|
||
|
|
void CCertStoreGPE::AllowEmptyEFSPolicy()
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::AllowEmptyEFSPolicy - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
m_fIsNullEFSPolicy = false;
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::AllowEmptyEFSPolicy - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
}
|
||
|
|
|
||
|
|
HRESULT CCertStoreGPE::AddCertificateContext(PCCERT_CONTEXT pContext, LPCONSOLE pConsole, bool bDeletePrivateKey)
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::AddCertificateContext - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
HRESULT hr = S_OK;
|
||
|
|
AllowEmptyEFSPolicy ();
|
||
|
|
hr = CCertStore::AddCertificateContext (pContext, pConsole, bDeletePrivateKey);
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::AddCertificateContext - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return hr;
|
||
|
|
}
|
||
|
|
|
||
|
|
HRESULT CCertStoreGPE::DeleteEFSPolicy(bool bCommitChanges)
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::DeleteEFSPolicy - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
ASSERT (EFS_STORE == GetStoreType ());
|
||
|
|
if ( EFS_STORE == GetStoreType () )
|
||
|
|
{
|
||
|
|
// If the store is open, close it first
|
||
|
|
if ( m_hCertStore )
|
||
|
|
{
|
||
|
|
CERT_CONTEXT_PSID_STRUCT* pCert = 0;
|
||
|
|
while (!m_EFSCertList.IsEmpty () )
|
||
|
|
{
|
||
|
|
pCert = m_EFSCertList.RemoveHead ();
|
||
|
|
ASSERT (pCert);
|
||
|
|
if ( pCert )
|
||
|
|
delete pCert;
|
||
|
|
}
|
||
|
|
|
||
|
|
VERIFY (::CertCloseStore (m_hCertStore, CERT_CLOSE_STORE_FORCE_FLAG)); //CERT_CLOSE_STORE_CHECK_FLAG);
|
||
|
|
m_hCertStore = 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
LRESULT lResult = ::RegDelnode (GetGroupPolicyKey (), CERT_EFSBLOB_REGPATH);
|
||
|
|
if ( ERROR_SUCCESS == lResult )
|
||
|
|
{
|
||
|
|
m_fIsNullEFSPolicy = true;
|
||
|
|
m_bDirty = true;
|
||
|
|
|
||
|
|
if ( bCommitChanges )
|
||
|
|
Commit ();
|
||
|
|
}
|
||
|
|
else
|
||
|
|
DisplaySystemError (NULL, (DWORD)lResult);
|
||
|
|
}
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::DeleteEFSPolicy - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return S_OK;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
HRESULT CCertStoreGPE::PolicyChanged()
|
||
|
|
{
|
||
|
|
_TRACE (1, L"Entering CCertStoreGPE::PolicyChanged - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
HRESULT hr = E_FAIL;
|
||
|
|
|
||
|
|
if ( m_pGPEInformation )
|
||
|
|
{
|
||
|
|
hr = m_pGPEInformation->PolicyChanged (
|
||
|
|
m_fIsComputerType ? TRUE : FALSE,
|
||
|
|
TRUE, &g_guidExtension, &g_guidSnapin);
|
||
|
|
hr = m_pGPEInformation->PolicyChanged (
|
||
|
|
m_fIsComputerType ? TRUE : FALSE,
|
||
|
|
TRUE, &g_guidRegExt, &g_guidSnapin);
|
||
|
|
}
|
||
|
|
|
||
|
|
_TRACE (-1, L"Leaving CCertStoreGPE::PolicyChanged - %s\n",
|
||
|
|
(LPCWSTR) m_pcszStoreName);
|
||
|
|
return hr;
|
||
|
|
}
|
||
|
|
|
||
|
|
PCCERT_CONTEXT CCertStoreGPE::EnumCertificates (PCCERT_CONTEXT pPrevCertContext)
|
||
|
|
{
|
||
|
|
PCCERT_CONTEXT pCertContext = CCertStore::EnumCertificates (pPrevCertContext);
|
||
|
|
|
||
|
|
if ( pCertContext )
|
||
|
|
m_fIsNullEFSPolicy = false;
|
||
|
|
|
||
|
|
return pCertContext;
|
||
|
|
}
|
||
|
|
|
||
|
|
CERT_CONTEXT_PSID_STRUCT::CERT_CONTEXT_PSID_STRUCT (PCCERT_CONTEXT pCertContext, PSID psid) :
|
||
|
|
m_pCertContext (0),
|
||
|
|
m_psid (0)
|
||
|
|
{
|
||
|
|
if ( pCertContext && psid )
|
||
|
|
{
|
||
|
|
m_pCertContext = CertDuplicateCertificateContext (pCertContext);
|
||
|
|
DWORD dwSidSize = ::GetLengthSid (psid);
|
||
|
|
if ( dwSidSize > 0 )
|
||
|
|
{
|
||
|
|
m_psid = new BYTE[dwSidSize];
|
||
|
|
if ( m_psid )
|
||
|
|
{
|
||
|
|
::ZeroMemory (m_psid, dwSidSize);
|
||
|
|
if ( !::CopySid (dwSidSize, m_psid, psid) )
|
||
|
|
{
|
||
|
|
ASSERT (0);
|
||
|
|
delete [] m_psid;
|
||
|
|
m_psid = 0;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
CERT_CONTEXT_PSID_STRUCT::~CERT_CONTEXT_PSID_STRUCT ()
|
||
|
|
{
|
||
|
|
if ( m_pCertContext )
|
||
|
|
::CertFreeCertificateContext (m_pCertContext);
|
||
|
|
if ( m_psid )
|
||
|
|
delete [] m_psid;
|
||
|
|
}
|
||
|
|
|
||
|
|
|