// implements much of the exported CKey #include "stdafx.h" #include "resource.h" #include "KeyObjs.h" #include "passdlg.h" #include "AdmnInfo.h" #include "NKChseCA.h" #include "NKDN.h" #include "NKDN2.h" #include "NKKyInfo.h" #include "NKUsrInf.h" #include "creating.h" #include "resource.h" #include "intrlkey.h" #include #define SECURITY_WIN32 extern "C" { #include // #include #include #include #include } #include "mismtchd.h" #define CRLF "\r\n" // NON_LOCALIZABLE strings for use in the request header #define HEADER_ADMINISTRATOR _T(CRLF "Webmaster: ") #define HEADER_PHONE _T(CRLF "Phone: ") #define HEADER_SERVER _T(CRLF "Server: ") #define HEADER_COMMON_NAME _T(CRLF CRLF "Common-name: ") #define HEADER_ORG_UNIT _T(CRLF "Organization Unit: ") #define HEADER_ORGANIZATION _T(CRLF "Organization: ") #define HEADER_LOCALITY _T(CRLF "Locality: ") #define HEADER_STATE _T(CRLF "State: ") #define HEADER_COUNTRY _T(CRLF "Country: ") #define HEADER_END_SPACING _T(CRLF CRLF ) // defines taken from the old KeyGen utility #define MESSAGE_HEADER "-----BEGIN NEW CERTIFICATE REQUEST-----\r\n" #define MESSAGE_TRAILER "-----END NEW CERTIFICATE REQUEST-----\r\n" #define MIME_TYPE "Content-Type: application/x-pkcs10\r\n" #define MIME_ENCODING "Content-Transfer-Encoding: base64\r\n\r\n" int HTUU_encode(unsigned char *bufin, unsigned int nbytes, char *bufcoded); #define BACKUP_ID 'KRBK' IMPLEMENT_DYNCREATE(CKey, CTreeItem); //------------------------------------------------------------------------------ CKey::CKey(): m_cbPrivateKey( 0 ), m_pPrivateKey( NULL ), m_cbCertificate( 0 ), m_pCertificate( NULL ), m_cbCertificateRequest( 0 ), m_pCertificateRequest( NULL ) {;} //------------------------------------------------------------------------------ CKey::~CKey() { LPTSTR pBuff; // specifically write zeros out over the password try { pBuff = m_szPassword.GetBuffer(256); } catch( CException e ) { pBuff = NULL; } if ( pBuff ) { // zero out the buffer ZeroMemory( pBuff, 256 ); // release the buffer m_szPassword.ReleaseBuffer(0); } // zero out the private key and the certificate if ( m_pPrivateKey ) { // zero out the buffer ZeroMemory( m_pPrivateKey, m_cbPrivateKey ); // free the pointer GlobalFree( (HANDLE)m_pPrivateKey ); m_pPrivateKey = NULL; } if ( m_pCertificate ) { // zero out the buffer ZeroMemory( m_pCertificate, m_cbCertificate ); // free the pointer GlobalFree( (HANDLE)m_pCertificate ); m_pCertificate = NULL; } if ( m_pCertificateRequest ) { // zero out the buffer ZeroMemory( m_pCertificateRequest, m_cbCertificateRequest ); // free the pointer GlobalFree( (HANDLE)m_pCertificateRequest ); m_pCertificate = NULL; } } //------------------------------------------------------------------------------ CKey* CKey::PClone( void ) { CKey* pClone = NULL; // TRY to make a new key object try { pClone = new CKey(); // copy over all the data pClone->CopyDataFrom( this ); } catch( CException e ) { // if the object had been made, delete it if ( pClone ) delete pClone; return NULL; } return pClone; } //------------------------------------------------------------------------------ void CKey::CopyDataFrom( CKey* pKey ) { // make sure this is ok ASSERT( pKey ); ASSERT( pKey->IsKindOf(RUNTIME_CLASS(CKey)) ); if ( !pKey ) return; // delete any data currently in this key // zero out the private key and the certificate if ( m_pPrivateKey ) { ZeroMemory( m_pPrivateKey, m_cbPrivateKey ); GlobalFree( (HANDLE)m_pPrivateKey ); m_pPrivateKey = NULL; } if ( m_pCertificate ) { ZeroMemory( m_pCertificate, m_cbCertificate ); GlobalFree( (HANDLE)m_pCertificate ); m_pCertificate = NULL; } if ( m_pCertificateRequest ) { ZeroMemory( m_pCertificateRequest, m_cbCertificateRequest ); GlobalFree( (HANDLE)m_pCertificateRequest ); m_pCertificate = NULL; } // copy over the basic stuff m_szItemName = pKey->m_szItemName; m_iImage = pKey->m_iImage; m_szPassword = pKey->m_szPassword; m_cbPrivateKey = pKey->m_cbPrivateKey; m_cbCertificate = pKey->m_cbCertificate; m_cbCertificateRequest = pKey->m_cbCertificateRequest; // now the pointer based data if ( pKey->m_pPrivateKey ) { m_pPrivateKey = GlobalAlloc( GPTR, m_cbPrivateKey ); if ( !m_pPrivateKey ) AfxThrowMemoryException(); memcpy( m_pPrivateKey, pKey->m_pPrivateKey, m_cbPrivateKey ); } if ( pKey->m_pCertificate ) { m_pCertificate = GlobalAlloc( GPTR, m_cbCertificate ); if ( !m_pCertificate ) AfxThrowMemoryException(); memcpy( m_pCertificate, pKey->m_pCertificate, m_cbCertificate ); } if ( pKey->m_pCertificateRequest ) { m_pCertificateRequest = GlobalAlloc( GPTR, m_cbCertificateRequest ); if ( !m_pCertificateRequest ) AfxThrowMemoryException(); memcpy( m_pCertificateRequest, pKey->m_pCertificateRequest, m_cbCertificateRequest ); } } //------------------------------------------------------------------------------ void CKey::SetName( CString &szNewName ) { m_szItemName = szNewName; UpdateCaption(); SetDirty( TRUE ); } //------------------------------------------------------------------------------ void CKey::UpdateIcon( void ) { // if there is no certificate, then the immature key if ( !m_pCertificate ) { m_iImage = TREE_ICON_KEY_IMMATURE; FSetImage( m_iImage ); return; } // there is a certificate, but we need to see if it has // expired or not. We do that by cracking the certificate // default the key to being ok m_iImage = TREE_ICON_KEY_OK; CKeyCrackedData cracker; // crack the key if ( cracker.CrackKey(this) ) { // get the expiration time CTime ctimeExpires( cracker.GetValidUntil() ); // get the current time CTime ctimeCurrent = CTime::GetCurrentTime(); // test if it has expired first if ( ctimeCurrent > ctimeExpires ) m_iImage = TREE_ICON_KEY_EXPIRED; } // set the image FSetImage( m_iImage ); } //------------------------------------------------------------------------------ BOOL CKey::FInstallCertificate( CString szPath, CString szPass ) { CFile cfile; PVOID pData = NULL; BOOL fSuccess =FALSE;; // open the file if ( !cfile.Open( szPath, CFile::modeRead | CFile::shareDenyNone ) ) return FALSE; // how big is the file - add one so we can zero terminate the buffer DWORD cbCertificate = cfile.GetLength() + 1; // make sure the file has some size if ( !cbCertificate ) { AfxMessageBox( IDS_ERR_INVALID_CERTIFICATE, MB_OK | MB_ICONINFORMATION ); return FALSE; } // put the rest of the operation in a try/catch // specifically write zeros out over the password try { // allocate space for the data pData = GlobalAlloc( GPTR, cbCertificate ); if ( !pData ) AfxThrowMemoryException(); // copy in the data from the file to the pointer - will throw and exception DWORD cbRead = cfile.Read( pData, cbCertificate ); // zero terminate for decoding ((BYTE*)pData)[cbRead] = 0; // great. The last thing left is to uudecode the data we got uudecode_cert( (char*)pData, &cbCertificate ); // close the file cfile.Close(); // install the certificate fSuccess = FInstallCertificate( pData, cbCertificate, szPass ); } catch( CException e ) { // if the pointer was allocated, deallocate it if ( pData ) { GlobalFree( pData ); pData = NULL; } // return failure return FALSE; } // return success return fSuccess; } //------------------------------------------------------------------------------ // it is up to the module to verify the certificate BOOL CKey::FInstallCertificate( PVOID pCert, DWORD cbCert, CString &szPass ) { // cache the old certificate in case the new one fails DWORD old_cbCertificate = m_cbCertificate; PVOID old_pCertificate = m_pCertificate; // set the new one into place m_cbCertificate = cbCert; m_pCertificate = pCert; /* // MOVED TO THE MODULE // verify the password if ( !FVerifyValidPassword(szPass) ) { // resore the old values m_cbCertificate = old_cbCertificate; m_pCertificate = old_pCertificate; // dispose of the new stuff GlobalFree( pCert ); // return false return FALSE; } */ // Re-Set the password, incase we stored a request from Backup file. m_szPassword = szPass; // it checks out ok, so we can get rid of the old stuff // be careful not to get rid of the current test cert if that is whats there if ( old_pCertificate && (old_pCertificate != pCert) ) { GlobalFree( old_pCertificate ); old_pCertificate = NULL; } // mark the key as dirty SetDirty( TRUE ); return TRUE; } //------------------------------------------------------------------------------ // verfying a valid password is now a several-stop process. First we have to verify // that the certificate is the correct one that was requested. Apparenly lots of // users out there are attempting to install either invalid certificates, or valid // certificates on the wrong key. Then, when they can't figure out that they messed // it up, they call us. Or Verisign. To do this we use CAPI2 to get a certificate context // from the certificate. If that fails is in an invalid cert (say... an EXE file). // Then we test that certificat's public key to see if it matches the public key // stored in the request (which we also have to use CAPI2 to crack) If there is no // request (keyset files) then tough bannanas. They will have to rely on the errors // returned by the AcquireCredentialsHandle routine. BOOL CKey::FVerifyValidPassword( CString szPassword ) { PVOID pRequestObject = NULL; PCCERT_CONTEXT pcontextCertificate = NULL; BOOL fAnswer = TRUE; SSL_CREDENTIAL_CERTIFICATE creds; CredHandle hCreds; SECURITY_STATUS scRet; TimeStamp ts; DWORD err; CString sz; CString szErr; // skip the private, internal request header PUCHAR pRequest = NULL; DWORD cbRequest = 0; PUCHAR pcert = (PUCHAR)m_pCertificate; DWORD cbcert = m_cbCertificate; // if the request is there, get its context if ( m_pCertificateRequest ) { // see if this request has a header block in front of it. If it does, then use // it to get the real request. If it doesn't then just use the request. // if it does have a header the first DWORD will be REQUEST_HEADER_IDENTIFIER if ( *(DWORD*)m_pCertificateRequest == REQUEST_HEADER_IDENTIFIER ) { // get the real request that comes after the request header pRequest = (PUCHAR)m_pCertificateRequest + ((LPREQUEST_HEADER)m_pCertificateRequest)->cbSizeOfHeader; cbRequest = ((LPREQUEST_HEADER)m_pCertificateRequest)->cbRequestSize; } else { // there is no header pRequest = (PUCHAR)m_pCertificateRequest; cbRequest = m_cbCertificateRequest; } // note that if the request isn't there or if it is invalid it is still // ok to try and verify the certificate DWORD cbBuffSize = 0; // start by decoding the request object - get the size of the required buffer CryptDecodeObject( X509_ASN_ENCODING, X509_CERT_REQUEST_TO_BE_SIGNED, pRequest, cbRequest, 0, NULL, &cbBuffSize ); // now make an attempt to decode it pRequestObject = GlobalAlloc( GPTR, cbBuffSize ); if ( !pRequestObject ) goto GetCredentials; if ( !CryptDecodeObject( X509_ASN_ENCODING, X509_CERT_REQUEST_TO_BE_SIGNED, pRequest, cbRequest, 0, pRequestObject, &cbBuffSize ) ) { GlobalFree( pRequestObject ); pRequestObject = NULL; goto GetCredentials; } } GetCredentials: // OK. Verisign and Certsrv and probably others too wrap the certificate in a wrapper // that, while following the normal formatting convensions, causes the context routine // below to fail. This means that we have to detect if the wrapper is there and, if it // is, we need to skip it. Fortunately, the wrapper contains the word "certificate" // yes, this is sorta grungy, but its what petesk said to do. sz = pcert; sz = sz.Left(20); if ( sz.Find("certificate") == 6 ) { pcert += 17; } // get the context on the certificate pcontextCertificate = CertCreateCertificateContext( X509_ASN_ENCODING, pcert, cbcert ); // if we were unable to create the context, then fail with an appropriate error message if ( !pcontextCertificate ) { // get the error for the dialog err = GetLastError(); // tell the user that they chose an invalid certificate sz.LoadString( IDS_CERTERR_INVALID_CERTIFICATE ); sz.Format( "%s%x", sz, err ); AfxMessageBox( sz ); // time to leave with a failure fAnswer = FALSE; goto cleanup; } // if we have both a cert context AND a decoded request object, then we can confirm that // they are in fact matched to each other. if ( pcontextCertificate && pRequestObject ) { // use CAPI2 to do the comparison between the two public key info structures if ( !CertComparePublicKeyInfo( X509_ASN_ENCODING, &((PCERT_REQUEST_INFO)pRequestObject)->SubjectPublicKeyInfo, &pcontextCertificate->pCertInfo->SubjectPublicKeyInfo ) ) { // The certificate is mis-matched to the request. Fail with the right message CMismatchedCertDlg mismatchdlg( &((PCERT_REQUEST_INFO)pRequestObject)->Subject, &pcontextCertificate->pCertInfo->Subject); mismatchdlg.DoModal(); fAnswer = FALSE; goto cleanup; } } // use SSL to finish verifying the password // fill in the credentials record creds.cbPrivateKey = m_cbPrivateKey; creds.pPrivateKey = (PUCHAR)m_pPrivateKey; creds.cbCertificate = m_cbCertificate; creds.pCertificate = (PUCHAR)m_pCertificate; // prepare the password creds.pszPassword = (PSTR)LPCTSTR(szPassword); // attempt to get the credentials scRet = AcquireCredentialsHandleW( NULL, // My name (ignored) UNISP_NAME_W, // Package SECPKG_CRED_INBOUND, // Use NULL, // Logon ID (ignored) &creds, // auth data NULL, // dce-stuff NULL, // dce-stuff &hCreds, // handle &ts ); // we really get it below // check the results if ( FAILED(scRet) ) { sz.Empty(); // add on the appropriate sub-error message switch( scRet ) { case SEC_E_UNKNOWN_CREDENTIALS: case SEC_E_NO_CREDENTIALS: case SEC_E_INTERNAL_ERROR: // Unfortunately, SChannel returns the "internal error" when a bad password // is returned. There may or may not be other circumstances under which this // error is returned, but this is by far the most common. Also I taked to // PeteSk about it and he agreed that this is how it should be used. // bad password sz.LoadString( IDS_CERTERROR_BADPASSWORD ); break; case SEC_E_SECPKG_NOT_FOUND: case SEC_E_BAD_PKGID: // the system does not have the package installed sz.LoadString( IDS_CERTERROR_PACKAGELOAD_ERROR ); break; case SEC_E_INSUFFICIENT_MEMORY: sz.LoadString( IDS_CERTERR_LOMEM ); break; case SEC_E_CANNOT_INSTALL: sz.LoadString( EDS_CERTERR_SCHNL_BAD_INIT ); break; default: sz.LoadString( IDS_CERTERR_SCHNL_GENERIC ); break; } // put up the error message szErr.LoadString( IDS_CERTERR_SCHANNEL_ERR ); sz.Format( "%s%s%x", sz, szErr, scRet ); AfxMessageBox( sz ); // return failure fAnswer = FALSE; goto cleanup; } // close the credentials handle FreeCredentialsHandle( &hCreds ); // clean up the certificate contexts cleanup: if ( pRequestObject ) GlobalFree( pRequestObject ); if ( pcontextCertificate ) CertFreeCertificateContext( pcontextCertificate ); // return success return fAnswer; } //------------------------------------------------------------------------------ void CKey::OutputHeader( CFile* pFile, PVOID privData1, PVOID privData2 ) { PADMIN_INFO pInfo = (PADMIN_INFO)privData1; // we start this by getting the DN strings from either the dialog that was // passed in through privData or throught cracking the certificate. CString szCN, szOU, szO, szL, szS, szC; CKeyCrackedData cracker; // the only way to get the info is from cracking an existing cert if ( cracker.CrackKey(this) ) { cracker.GetDNNetAddress( szCN ); cracker.GetDNUnit( szOU ); cracker.GetDNOrganization( szO ); cracker.GetDNLocality( szL ); cracker.GetDNState( szS ); cracker.GetDNCountry( szC ); } else { if (pInfo->pCommonName) szCN = *pInfo->pCommonName; if (pInfo->pOrgUnit) szOU = *pInfo->pOrgUnit; if (pInfo->pOrg) szO = *pInfo->pOrg; if (pInfo->pLocality) szL = *pInfo->pLocality; if (pInfo->pState) szS = *pInfo->pState; if (pInfo->pCountry) szC = *pInfo->pCountry; } // ok, output all the strings, starting with the administrator information CString sz = HEADER_ADMINISTRATOR; pFile->Write( sz, sz.GetLength() ); if ( pInfo->pEmail ) pFile->Write( *pInfo->pEmail, pInfo->pEmail->GetLength() ); sz = HEADER_PHONE; pFile->Write( sz, sz.GetLength() ); if ( pInfo->pPhone ) pFile->Write( *pInfo->pPhone, pInfo->pPhone->GetLength() ); sz = HEADER_SERVER; pFile->Write( sz, sz.GetLength() ); sz.LoadString( IDS_SERVER_INFO_STRING ); pFile->Write( sz, sz.GetLength() ); sz = HEADER_COMMON_NAME; pFile->Write( sz, sz.GetLength() ); pFile->Write( szCN, szCN.GetLength() ); sz = HEADER_ORG_UNIT; pFile->Write( sz, sz.GetLength() ); pFile->Write( szOU, szOU.GetLength() ); sz = HEADER_ORGANIZATION; pFile->Write( sz, sz.GetLength() ); pFile->Write( szO, szO.GetLength() ); sz = HEADER_LOCALITY; pFile->Write( sz, sz.GetLength() ); pFile->Write( szL, szL.GetLength() ); sz = HEADER_STATE; pFile->Write( sz, sz.GetLength() ); pFile->Write( szS, szS.GetLength() ); sz = HEADER_COUNTRY; pFile->Write( sz, sz.GetLength() ); pFile->Write( szC, szC.GetLength() ); sz = HEADER_END_SPACING; pFile->Write( sz, sz.GetLength() ); } //------------------------------------------------------------------------------ // this routine is based on the routine "Requestify" from KeyGen BOOL CKey::FOutputRequestFile( CString szFile, BOOL fMime, PVOID privData ) { PADMIN_INFO pAdminInfo= (PADMIN_INFO)privData; ADMIN_INFO AdminInfo; CAdminInfoDlg aiDlg; // ok, the priv data points to a structure that contains three strings // describing the admin requesting this request. If it is null, then we // must ask this information. if ( !pAdminInfo ) { if ( aiDlg.DoModal() != IDOK ) return FALSE; // fill the darned thing in ZeroMemory( &AdminInfo, sizeof(AdminInfo) ); pAdminInfo = &AdminInfo; AdminInfo.pEmail = &aiDlg.m_sz_email; AdminInfo.pPhone = &aiDlg.m_sz_phone; } PUCHAR pEncoded; DWORD cbData = m_cbCertificateRequest; // encode the request into a new pointer pEncoded = PCreateEncodedRequest( m_pCertificateRequest, &cbData, FALSE ); /* PUCHAR pb; DWORD cb; PUCHAR p; DWORD Size; PUCHAR pSource; DWORD cbSource; ASSERT( pSource ); ASSERT( cbSource ); // we don't actually want to change the source data, so make a copy of it first pSource = (PUCHAR)GlobalAlloc( GPTR, m_cbCertificateRequest ); if ( !pSource ) { AfxThrowMemoryException(); return FALSE; } cbSource = m_cbCertificateRequest; // copy over the data CopyMemory( pSource, m_pCertificateRequest, cbSource ); cb = (cbSource * 3 / 4) + 1024; pb = (PUCHAR)LocalAlloc( LMEM_FIXED, cb ); if ( !pb ) return FALSE; p = pb; if ( fMime ) { Size = strlen( MIME_TYPE ); CopyMemory( p, MIME_TYPE, Size ); p += Size; Size = strlen( MIME_ENCODING ); CopyMemory( p, MIME_ENCODING, Size ); p += Size; } else { Size = strlen( MESSAGE_HEADER ); CopyMemory( p, MESSAGE_HEADER, Size ); p += Size; } do { Size = HTUU_encode( pSource, (cbSource > 48 ? 48 : cbSource), (PCHAR)p ); p += Size; *p++ = '\r'; *p++ = '\n'; if ( cbSource < 48 ) break; cbSource -= 48; pSource += 48; } while (cbSource); if ( !fMime ) { Size = strlen( MESSAGE_TRAILER ); CopyMemory( p, MESSAGE_TRAILER, Size ); p += Size; } */ // write the requestified data into the target file try { // try to open the file CFile cfile; if ( !cfile.Open(szFile, CFile::modeCreate | CFile::modeWrite) ) { AfxMessageBox( IDS_IO_ERROR ); return FALSE; } // write out the header stuff that simon at Verisign // requested at the LAST POSSIBLE MINUTE!!! OutputHeader( &cfile, pAdminInfo, NULL ); // write the data to the file // cfile.Write( pb, (p - pb) ); cfile.Write( pEncoded, cbData ); // close the file cfile.Close(); } catch( CException e ) { if ( pEncoded ) LocalFree( pEncoded ); return FALSE; } if ( pEncoded ) LocalFree( pEncoded ); return TRUE; } //------------------------------------------------------------------------ PUCHAR PCreateEncodedRequest( PVOID pRequest, DWORD* pcb, BOOL fMime ) { PUCHAR pb; DWORD cb; PUCHAR p; DWORD Size; PUCHAR pSource; DWORD cbSource; DWORD cbRequest = *pcb; ASSERT( pcb && *pcb ); ASSERT( pRequest ); // get the correct pointer to and size of the request, taking into account the header LPREQUEST_HEADER pHeader = (LPREQUEST_HEADER)pRequest; if ( pHeader->Identifier == REQUEST_HEADER_IDENTIFIER ) { pRequest = (PUCHAR)pRequest + pHeader->cbSizeOfHeader; cbRequest = *pcb = pHeader->cbRequestSize; } // we don't actually want to change the source data, so make a copy of it first pSource = (PUCHAR)GlobalAlloc( GPTR, cbRequest ); if ( !pSource ) { AfxThrowMemoryException(); return FALSE; } cbSource = cbRequest; // copy over the data CopyMemory( pSource, pRequest, cbSource ); cb = (cbSource * 3 / 4) + 1024; pb = (PUCHAR)LocalAlloc( LMEM_FIXED, cb ); if ( !pb ) return FALSE; p = pb; if ( fMime ) { Size = strlen( MIME_TYPE ); CopyMemory( p, MIME_TYPE, Size ); p += Size; Size = strlen( MIME_ENCODING ); CopyMemory( p, MIME_ENCODING, Size ); p += Size; } else { Size = strlen( MESSAGE_HEADER ); CopyMemory( p, MESSAGE_HEADER, Size ); p += Size; } do { Size = HTUU_encode( pSource, (cbSource > 48 ? 48 : cbSource), (PCHAR)p ); p += Size; *p++ = '\r'; *p++ = '\n'; if ( cbSource < 48 ) break; cbSource -= 48; pSource += 48; } while (cbSource); if ( !fMime ) { Size = strlen( MESSAGE_TRAILER ); CopyMemory( p, MESSAGE_TRAILER, Size ); p += Size; } // set the count of bytes into place *pcb = DIFF(p - pb); //return the pointer to the encoded information return pb; } // Taken right out of KenGen.c static char six2pr[64] = { 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', '/' }; // Taken right out of KenGen.c /*--- function HTUU_encode ----------------------------------------------- * * Encode a single line of binary data to a standard format that * uses only printing ASCII characters (but takes up 33% more bytes). * * Entry bufin points to a buffer of bytes. If nbytes is not * a multiple of three, then the byte just beyond * the last byte in the buffer must be 0. * nbytes is the number of bytes in that buffer. * This cannot be more than 48. * bufcoded points to an output buffer. Be sure that this * can hold at least 1 + (4*nbytes)/3 characters. * * Exit bufcoded contains the coded line. The first 4*nbytes/3 bytes * contain printing ASCII characters representing * those binary bytes. This may include one or * two '=' characters used as padding at the end. * The last byte is a zero byte. * Returns the number of ASCII characters in "bufcoded". */ // Now the HTUU_encode is taken from infocomm/common/fcache and has been fixed by amallet // it has been modified slightly to take into account that the output buffer was resized above int HTUU_encode(unsigned char *bufin, unsigned int nbytes, char *bufcoded) { register char *outptr = bufcoded; unsigned int i; BOOL fOneByteDiff = FALSE; BOOL fTwoByteDiff = FALSE; unsigned int iRemainder = 0; unsigned int iClosestMultOfThree = 0; iRemainder = nbytes % 3; //also works for nbytes == 1, 2 fOneByteDiff = (iRemainder == 1 ? TRUE : FALSE); fTwoByteDiff = (iRemainder == 2 ? TRUE : FALSE); iClosestMultOfThree = ((nbytes - iRemainder)/3) * 3 ; // // Encode bytes in buffer up to multiple of 3 that is closest to nbytes. // for (i=0; i< iClosestMultOfThree ; i += 3) { *(outptr++) = six2pr[*bufin >> 2]; /* c1 */ *(outptr++) = six2pr[((*bufin << 4) & 060) | ((bufin[1] >> 4) & 017)]; /*c2*/ *(outptr++) = six2pr[((bufin[1] << 2) & 074) | ((bufin[2] >> 6) & 03)];/*c3*/ *(outptr++) = six2pr[bufin[2] & 077]; /* c4 */ bufin += 3; } // // We deal with trailing bytes by pretending that the input buffer has been padded with // zeros. Expressions are thus the same as above, but the second half drops off b'cos // ( a | ( b & 0) ) = ( a | 0 ) = a // if (fOneByteDiff) { *(outptr++) = six2pr[*bufin >> 2]; /* c1 */ *(outptr++) = six2pr[((*bufin << 4) & 060)]; /* c2 */ //pad with '=' *(outptr++) = '='; /* c3 */ *(outptr++) = '='; /* c4 */ } else if (fTwoByteDiff) { *(outptr++) = six2pr[*bufin >> 2]; /* c1 */ *(outptr++) = six2pr[((*bufin << 4) & 060) | ((bufin[1] >> 4) & 017)]; /*c2*/ *(outptr++) = six2pr[((bufin[1] << 2) & 074)];/*c3*/ //pad with '=' *(outptr++) = '='; /* c4 */ } //encoded buffer must be zero-terminated *outptr = '\0'; return DIFF(outptr - bufcoded); } //============================ BASED ON SETKEY const int pr2six[256]={ 64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64, 64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,62,64,64,64,63, 52,53,54,55,56,57,58,59,60,61,64,64,64,64,64,64,64,0,1,2,3,4,5,6,7,8,9, 10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,64,64,64,64,64,64,26,27, 28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51, 64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64, 64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64, 64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64, 64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64, 64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64, 64,64,64,64,64,64,64,64,64,64,64,64,64 }; // // We have to squirt a record into the decoded stream // #define CERT_RECORD 13 #define CERT_SIZE_HIBYTE 2 // Index into record of record size #define CERT_SIZE_LOBYTE 3 unsigned char abCertHeader[] = {0x30, 0x82, // Record 0x00, 0x00, // Size of cert + buff 0x04, 0x0b, 0x63, 0x65,// Cert record data 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65 }; void uudecode_cert(char *bufcoded, DWORD *pcbDecoded ) { int nbytesdecoded; char *bufin = bufcoded; unsigned char *bufout = (unsigned char *)bufcoded; unsigned char *pbuf; int nprbytes; char * beginbuf = bufcoded; ASSERT(bufcoded); ASSERT(pcbDecoded); /* Strip leading whitespace. */ while(*bufcoded==' ' || *bufcoded == '\t' || *bufcoded == '\r' || *bufcoded == '\n' ) { bufcoded++; } // // If there is a beginning '---- ....' then skip the first line // if ( bufcoded[0] == '-' && bufcoded[1] == '-' ) { bufin = strchr( bufcoded, '\n' ); if ( bufin ) { bufin++; bufcoded = bufin; } else { bufin = bufcoded; } } else { bufin = bufcoded; } // // Strip all cr/lf from the block // pbuf = (unsigned char *)bufin; while ( *pbuf ) { if ( *pbuf == '\r' || *pbuf == '\n' ) { memmove( (void*)pbuf, pbuf+1, strlen( (char*)pbuf + 1) + 1 ); } else { pbuf++; } } /* Figure out how many characters are in the input buffer. * If this would decode into more bytes than would fit into * the output buffer, adjust the number of input bytes downwards. */ while(pr2six[*(bufin++)] <= 63); nprbytes = DIFF(bufin - bufcoded) - 1; nbytesdecoded = ((nprbytes+3)/4) * 3; bufin = bufcoded; while (nprbytes > 0) { *(bufout++) = (unsigned char) (pr2six[*bufin] << 2 | pr2six[bufin[1]] >> 4); *(bufout++) = (unsigned char) (pr2six[bufin[1]] << 4 | pr2six[bufin[2]] >> 2); *(bufout++) = (unsigned char) (pr2six[bufin[2]] << 6 | pr2six[bufin[3]]); bufin += 4; nprbytes -= 4; } if(nprbytes & 03) { if(pr2six[bufin[-2]] > 63) nbytesdecoded -= 2; else nbytesdecoded -= 1; } // // Now we need to add a new wrapper sequence around the certificate // indicating this is a certificate // memmove( beginbuf + sizeof(abCertHeader), beginbuf, nbytesdecoded ); memcpy( beginbuf, abCertHeader, sizeof(abCertHeader) ); // // The beginning record size is the total number of bytes decoded plus // the number of bytes in the certificate header // beginbuf[CERT_SIZE_HIBYTE] = (BYTE) (((USHORT)nbytesdecoded+CERT_RECORD) >> 8); beginbuf[CERT_SIZE_LOBYTE] = (BYTE) ((USHORT)nbytesdecoded+CERT_RECORD); nbytesdecoded += sizeof(abCertHeader); if ( pcbDecoded ) *pcbDecoded = nbytesdecoded; } // ============ END BASED ON SETKEY //------------------------------------------------------------------------------ BOOL CKey::FImportKeySetFiles( CString szPrivate, CString szPublic, CString &szPass ) { BOOL fSuccess = TRUE; // in this routine, we load the data from the file, initialize it, and ask // the user for a password, which we then confirm with AcquireCredHandle. // several things we will be doing can throw, so use a try/catch try { // start by opening the private data file CFile cfile( szPrivate, CFile::modeRead|CFile::shareDenyWrite ); // get the length of the file m_cbPrivateKey = cfile.GetLength(); // create a handle to hold the data m_pPrivateKey = GlobalAlloc( GPTR, m_cbPrivateKey ); if ( !m_pPrivateKey ) { cfile.Close(); AfxThrowMemoryException(); }; // great, now read the data out of the file cfile.Read( m_pPrivateKey, m_cbPrivateKey ); // close the file cfile.Close(); // reading in the certificate is easy because that was done elsewhere if ( szPublic && !szPublic.IsEmpty() ) { fSuccess = FInstallCertificate( szPublic, szPass ); if ( fSuccess ) // set the password m_szPassword = szPass; } } catch( CException e ) { return FALSE; } return fSuccess; } //------------------------------------------------------------------------------ void ReadWriteDWORD( CFile *pFile, DWORD *pDword, BOOL fRead ); void ReadWriteString( CFile *pFile, CString &sz, BOOL fRead ); void ReadWriteBlob( CFile *pFile, PVOID pBlob, DWORD cbBlob, BOOL fRead ); //------------------------------------------------------------------------------ BOOL CKey::FImportExportBackupFile( CString szFile, BOOL fImport ) { DWORD dword; UINT nOpenFlags; CConfirmPassDlg dlgconfirm; // set up the right open flags if ( fImport ) nOpenFlags = CFile::modeRead | CFile::shareDenyNone; else nOpenFlags = CFile::modeCreate | CFile::modeReadWrite | CFile::shareExclusive; // put it in a try/catch to get any errors try { CFile file( szFile, nOpenFlags ); // do the backup id dword = BACKUP_ID; ReadWriteDWORD( &file, &dword, fImport ); // check the backup id if ( dword != BACKUP_ID ) { AfxMessageBox( IDS_KEY_FILE_INVALID ); return FALSE; } // start with the name of the key CString szName = GetName(); ReadWriteString( &file, szName, fImport ); if ( fImport ) SetName( szName ); // now the private key data size ReadWriteDWORD( &file, &m_cbPrivateKey, fImport ); // make a private key data pointer if necessary if ( fImport && m_cbPrivateKey ) { m_pPrivateKey = GlobalAlloc( GPTR, m_cbPrivateKey ); if ( !m_pPrivateKey ) AfxThrowMemoryException(); } // use the private key pointer if ( m_cbPrivateKey ) ReadWriteBlob( &file, m_pPrivateKey, m_cbPrivateKey, fImport ); // now the certificate ReadWriteDWORD( &file, &m_cbCertificate, fImport ); // make a data pointer if necessary if ( fImport && m_cbCertificate ) { m_pCertificate = GlobalAlloc( GPTR, m_cbCertificate ); if ( !m_pCertificate ) AfxThrowMemoryException(); } // use the private key pointer if ( m_cbCertificate ) ReadWriteBlob( &file, m_pCertificate, m_cbCertificate, fImport ); // now the request ReadWriteDWORD( &file, &m_cbCertificateRequest, fImport ); // make a data pointer if necessary if ( fImport && m_cbCertificateRequest ) { m_pCertificateRequest = GlobalAlloc( GPTR, m_cbCertificateRequest ); if ( !m_pCertificateRequest ) AfxThrowMemoryException(); } // use the private key pointer if ( m_cbCertificateRequest ) ReadWriteBlob( &file, m_pCertificateRequest, m_cbCertificateRequest, fImport ); // finally, if we are importing, we need to confirm the password // Except if there is no Cert, which means Import of a Request if ( m_cbCertificate && fImport ) { //if we are importing, get the password first if ( dlgconfirm.DoModal() != IDOK ) return FALSE; if ( !FVerifyValidPassword(dlgconfirm.m_szPassword) ) { // the Verify Valid Password routine puts up all // the correct error dialogs now return FALSE; } // set the password into place m_szPassword = dlgconfirm.m_szPassword; } } catch( CException e ) { // return failure return FALSE; } // return success return TRUE; } // file utilities //--------------------------------------------------------------------------- void ReadWriteDWORD( CFile *pFile, DWORD *pDword, BOOL fRead ) { ASSERT(pFile); ASSERT(pDword); // read it or write it if ( fRead ) pFile->Read( (void*)pDword, sizeof(DWORD) ); else pFile->Write( (void*)pDword, sizeof(DWORD) ); } //--------------------------------------------------------------------------- void ReadWriteString( CFile *pFile, CString &sz, BOOL fRead ) { ASSERT(pFile); ASSERT(sz); // get the length of the string DWORD cbLength = sz.GetLength(); ReadWriteDWORD(pFile,&cbLength,fRead ); // read or write the string LPTSTR psz = sz.GetBuffer( cbLength+1 ); ReadWriteBlob(pFile, psz, cbLength+1, fRead); // free the string buffer sz.ReleaseBuffer(); } //--------------------------------------------------------------------------- void ReadWriteBlob( CFile *pFile, PVOID pBlob, DWORD cbBlob, BOOL fRead ) { ASSERT(pFile); ASSERT(pBlob); ASSERT(cbBlob); // read it or write it if ( fRead ) pFile->Read( pBlob, cbBlob ); else pFile->Write( pBlob, cbBlob ); }