1600 lines
42 KiB
C
1600 lines
42 KiB
C
//+---------------------------------------------------------------------------
|
|
//
|
|
// Microsoft Windows
|
|
// Copyright (C) Microsoft Corporation, 1992 - 1995.
|
|
//
|
|
// File: cred.c
|
|
//
|
|
// Contents: Schannel credential management routines.
|
|
//
|
|
// Classes:
|
|
//
|
|
// Functions:
|
|
//
|
|
// History: 09-23-97 jbanes LSA integration stuff.
|
|
// 03-15-99 jbanes Remove dead code, fix legacy SGC.
|
|
//
|
|
//----------------------------------------------------------------------------
|
|
|
|
#include <spbase.h>
|
|
#include <wincrypt.h>
|
|
#include <oidenc.h>
|
|
#include <mapper.h>
|
|
#include <userenv.h>
|
|
|
|
|
|
RTL_CRITICAL_SECTION g_SslCredLock;
|
|
LIST_ENTRY g_SslCredList;
|
|
HANDLE g_GPEvent;
|
|
|
|
SP_STATUS
|
|
GetPrivateFromCert(
|
|
PSPCredential pCred,
|
|
DWORD dwProtocol,
|
|
PLSA_SCHANNEL_SUB_CRED pSubCred);
|
|
|
|
|
|
BOOL
|
|
SslInitCredentialManager(VOID)
|
|
{
|
|
BOOL fImpersonating = FALSE;
|
|
NTSTATUS Status;
|
|
|
|
Status = RtlInitializeCriticalSection( &g_SslCredLock );
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
InitializeListHead( &g_SslCredList );
|
|
|
|
fImpersonating = SslImpersonateClient();
|
|
|
|
g_GPEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
|
|
if(g_GPEvent)
|
|
{
|
|
if(!RegisterGPNotification(g_GPEvent, FALSE))
|
|
{
|
|
DebugLog((DEB_ERROR, "Error 0x%x registering for user GP notification\n", GetLastError()));
|
|
}
|
|
if(!RegisterGPNotification(g_GPEvent, TRUE))
|
|
{
|
|
DebugLog((DEB_ERROR, "Error 0x%x registering for machine GP notification\n", GetLastError()));
|
|
}
|
|
}
|
|
|
|
if(fImpersonating)
|
|
{
|
|
RevertToSelf();
|
|
}
|
|
|
|
return( TRUE );
|
|
}
|
|
|
|
|
|
BOOL
|
|
SslFreeCredentialManager(VOID)
|
|
{
|
|
BOOL fImpersonating = FALSE;
|
|
|
|
fImpersonating = SslImpersonateClient();
|
|
|
|
if(g_GPEvent)
|
|
{
|
|
if(!UnregisterGPNotification(g_GPEvent))
|
|
{
|
|
DebugLog((DEB_ERROR, "Error 0x%x unregistering for user GP notification\n", GetLastError()));
|
|
}
|
|
if(!UnregisterGPNotification(g_GPEvent))
|
|
{
|
|
DebugLog((DEB_ERROR, "Error 0x%x unregistering for machine GP notification\n", GetLastError()));
|
|
}
|
|
|
|
CloseHandle(g_GPEvent);
|
|
g_GPEvent = NULL;
|
|
}
|
|
|
|
if(fImpersonating)
|
|
{
|
|
RevertToSelf();
|
|
}
|
|
|
|
RtlDeleteCriticalSection( &g_SslCredLock );
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
BOOL
|
|
SslCheckForGPEvent(void)
|
|
{
|
|
PLIST_ENTRY pList;
|
|
PSPCredentialGroup pCredGroup;
|
|
DWORD Status;
|
|
|
|
if(g_GPEvent)
|
|
{
|
|
Status = WaitForSingleObjectEx(g_GPEvent, 0, FALSE);
|
|
if(Status == WAIT_OBJECT_0)
|
|
{
|
|
DebugLog((DEB_WARN, "GP event detected, so download new trusted issuer list\n"));
|
|
|
|
RtlEnterCriticalSection( &g_SslCredLock );
|
|
|
|
pList = g_SslCredList.Flink ;
|
|
|
|
while ( pList != &g_SslCredList )
|
|
{
|
|
pCredGroup = CONTAINING_RECORD( pList, SPCredentialGroup, ListEntry.Flink );
|
|
|
|
pCredGroup->dwFlags |= CRED_FLAG_UPDATE_ISSUER_LIST;
|
|
|
|
pList = pList->Flink ;
|
|
}
|
|
|
|
RtlLeaveCriticalSection( &g_SslCredLock );
|
|
|
|
return TRUE;
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
SP_STATUS
|
|
IsCredentialInGroup(
|
|
PSPCredentialGroup pCredGroup,
|
|
PCCERT_CONTEXT pCertContext,
|
|
PBOOL pfInGroup)
|
|
{
|
|
PSPCredential pCred;
|
|
BYTE rgbThumbprint[20];
|
|
DWORD cbThumbprint;
|
|
BYTE rgbHash[20];
|
|
DWORD cbHash;
|
|
DWORD i;
|
|
|
|
*pfInGroup = FALSE;
|
|
|
|
// Get thumbprint of certificate.
|
|
cbThumbprint = sizeof(rgbThumbprint);
|
|
if(!CertGetCertificateContextProperty(pCertContext,
|
|
CERT_MD5_HASH_PROP_ID,
|
|
rgbThumbprint,
|
|
&cbThumbprint))
|
|
{
|
|
SP_LOG_RESULT(GetLastError());
|
|
return PCT_INT_UNKNOWN_CREDENTIAL;
|
|
}
|
|
|
|
for(i = 0; i < pCredGroup->cCredList; i++)
|
|
{
|
|
pCred = pCredGroup->pCredList + i;
|
|
|
|
// Get thumbprint of certificate.
|
|
cbHash = sizeof(rgbHash);
|
|
if(!CertGetCertificateContextProperty(pCred->pCert,
|
|
CERT_MD5_HASH_PROP_ID,
|
|
rgbHash,
|
|
&cbHash))
|
|
{
|
|
SP_LOG_RESULT(GetLastError());
|
|
return PCT_INT_UNKNOWN_CREDENTIAL;
|
|
}
|
|
|
|
if(memcmp(rgbThumbprint, rgbHash, cbThumbprint) == 0)
|
|
{
|
|
*pfInGroup = TRUE;
|
|
break;
|
|
}
|
|
}
|
|
|
|
return PCT_ERR_OK;
|
|
}
|
|
|
|
BOOL
|
|
IsValidThumbprint(
|
|
PCRED_THUMBPRINT Thumbprint)
|
|
{
|
|
if(Thumbprint->LowPart == 0 && Thumbprint->HighPart == 0)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
BOOL
|
|
IsSameThumbprint(
|
|
PCRED_THUMBPRINT Thumbprint1,
|
|
PCRED_THUMBPRINT Thumbprint2)
|
|
{
|
|
if(Thumbprint1->LowPart == Thumbprint2->LowPart &&
|
|
Thumbprint1->HighPart == Thumbprint2->HighPart)
|
|
{
|
|
return TRUE;
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
void
|
|
GenerateCertThumbprint(
|
|
PCCERT_CONTEXT pCertContext,
|
|
PCRED_THUMBPRINT Thumbprint)
|
|
{
|
|
MD5_CTX Md5Hash;
|
|
|
|
MD5Init(&Md5Hash);
|
|
MD5Update(&Md5Hash,
|
|
pCertContext->pbCertEncoded,
|
|
pCertContext->cbCertEncoded);
|
|
MD5Final(&Md5Hash);
|
|
CopyMemory((PBYTE)Thumbprint,
|
|
Md5Hash.digest,
|
|
sizeof(CRED_THUMBPRINT));
|
|
}
|
|
|
|
void
|
|
GenerateRandomThumbprint(
|
|
PCRED_THUMBPRINT Thumbprint)
|
|
{
|
|
GenerateRandomBits((PBYTE)Thumbprint, sizeof(CRED_THUMBPRINT));
|
|
}
|
|
|
|
BOOL
|
|
DoesCredThumbprintMatch(
|
|
PSPCredentialGroup pCredGroup,
|
|
PCRED_THUMBPRINT pThumbprint)
|
|
{
|
|
PSPCredential pCurrentCred;
|
|
BOOL fFound = FALSE;
|
|
DWORD i;
|
|
|
|
for(i = 0; i < pCredGroup->cCredList; i++)
|
|
{
|
|
pCurrentCred = pCredGroup->pCredList + i;
|
|
|
|
if(IsSameThumbprint(pThumbprint, &pCurrentCred->CertThumbprint))
|
|
{
|
|
fFound = TRUE;
|
|
break;
|
|
}
|
|
}
|
|
|
|
return fFound;
|
|
}
|
|
|
|
SP_STATUS
|
|
SPCreateCred(
|
|
DWORD dwProtocol,
|
|
PLSA_SCHANNEL_SUB_CRED pSubCred,
|
|
PSPCredential pCurrentCred,
|
|
BOOL * pfEventLogged)
|
|
{
|
|
SP_STATUS pctRet;
|
|
|
|
pCurrentCred->pCert = CertDuplicateCertificateContext(pSubCred->pCert);
|
|
if(pCurrentCred->pCert == NULL)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_CERT_UNKNOWN);
|
|
goto error;
|
|
}
|
|
|
|
pctRet = SPPublicKeyFromCert(pCurrentCred->pCert,
|
|
&pCurrentCred->pPublicKey,
|
|
&pCurrentCred->dwExchSpec);
|
|
if(pctRet != PCT_ERR_OK)
|
|
{
|
|
goto error;
|
|
}
|
|
|
|
pctRet = GetPrivateFromCert(pCurrentCred, dwProtocol, pSubCred);
|
|
if(pctRet != PCT_ERR_OK)
|
|
{
|
|
*pfEventLogged = TRUE;
|
|
goto error;
|
|
}
|
|
|
|
pCurrentCred->dwCF = CF_EXPORT;
|
|
|
|
if(SslGlobalStrongEncryptionPermitted)
|
|
{
|
|
pCurrentCred->dwCF |= CF_DOMESTIC;
|
|
}
|
|
|
|
|
|
// Generate the credential thumbprint. This is computed by
|
|
// taking the hash of the certificate.
|
|
GenerateCertThumbprint(pCurrentCred->pCert,
|
|
&pCurrentCred->CertThumbprint);
|
|
|
|
DebugLog((DEB_TRACE, "Credential thumbprint: %x %x\n",
|
|
pCurrentCred->CertThumbprint.LowPart,
|
|
pCurrentCred->CertThumbprint.HighPart));
|
|
|
|
|
|
// Read list of supported algorithms.
|
|
if((dwProtocol & SP_PROT_SERVERS) && pCurrentCred->hProv)
|
|
{
|
|
GetSupportedCapiAlgs(pCurrentCred->hProv,
|
|
pCurrentCred->dwCapiFlags,
|
|
&pCurrentCred->pCapiAlgs,
|
|
&pCurrentCred->cCapiAlgs);
|
|
}
|
|
|
|
|
|
// Build SSL3 serialized certificate chain. This is an optimization
|
|
// so that we won't have to build it for each connection.
|
|
pctRet = SPSerializeCertificate(
|
|
SP_PROT_SSL3,
|
|
TRUE,
|
|
&pCurrentCred->pbSsl3SerializedChain,
|
|
&pCurrentCred->cbSsl3SerializedChain,
|
|
pCurrentCred->pCert,
|
|
CERT_CHAIN_CACHE_ONLY_URL_RETRIEVAL);
|
|
if(pctRet != PCT_ERR_OK)
|
|
{
|
|
goto error;
|
|
}
|
|
|
|
error:
|
|
|
|
return pctRet;
|
|
}
|
|
|
|
|
|
SP_STATUS
|
|
SPCreateCredential(
|
|
PSPCredentialGroup *ppCred,
|
|
DWORD grbitProtocol,
|
|
PLSA_SCHANNEL_CRED pSchannelCred)
|
|
{
|
|
PSPCredentialGroup pCred = NULL;
|
|
PSPCredential pCurrentCred = NULL;
|
|
SECPKG_CALL_INFO CallInfo;
|
|
|
|
SP_STATUS pctRet = PCT_ERR_OK;
|
|
DWORD i;
|
|
DWORD dwKeySpec;
|
|
HMAPPER * pMapper;
|
|
BOOL fSelectiveCrypto;
|
|
NTSTATUS Status;
|
|
BOOL fImpersonating = FALSE;
|
|
BOOL fEventLogged = FALSE;
|
|
|
|
SP_BEGIN("SPCreateCredential");
|
|
|
|
DebugLog((DEB_TRACE, " dwVersion: %d\n", pSchannelCred->dwVersion));
|
|
DebugLog((DEB_TRACE, " cCreds: %d\n", pSchannelCred->cSubCreds));
|
|
DebugLog((DEB_TRACE, " paCred: 0x%p\n", pSchannelCred->paSubCred));
|
|
DebugLog((DEB_TRACE, " hRootStore: 0x%p\n", pSchannelCred->hRootStore));
|
|
DebugLog((DEB_TRACE, " cMappers: %d\n", pSchannelCred->cMappers));
|
|
DebugLog((DEB_TRACE, " aphMappers: 0x%p\n", pSchannelCred->aphMappers));
|
|
DebugLog((DEB_TRACE, " cSupportedAlgs: %d\n", pSchannelCred->cSupportedAlgs));
|
|
DebugLog((DEB_TRACE, " palgSupportedAlgs: 0x%p\n", pSchannelCred->palgSupportedAlgs));
|
|
DebugLog((DEB_TRACE, " grbitEnabledProtocols: 0x%x\n", pSchannelCred->grbitEnabledProtocols));
|
|
DebugLog((DEB_TRACE, " dwMinimumCipherStrength:%d\n", pSchannelCred->dwMinimumCipherStrength));
|
|
DebugLog((DEB_TRACE, " dwMaximumCipherStrength:%d\n", pSchannelCred->dwMaximumCipherStrength));
|
|
DebugLog((DEB_TRACE, " dwSessionLifespan: %d\n", pSchannelCred->dwSessionLifespan));
|
|
DebugLog((DEB_TRACE, " dwFlags: 0x%x\n", pSchannelCred->dwFlags));
|
|
DebugLog((DEB_TRACE, " reserved: 0x%x\n", pSchannelCred->reserved));
|
|
|
|
LogCreateCredEvent(grbitProtocol, pSchannelCred);
|
|
|
|
|
|
//
|
|
// Allocate the internal credential structure and perform
|
|
// basic initialization.
|
|
//
|
|
|
|
pCred = SPExternalAlloc(sizeof(SPCredentialGroup));
|
|
if(pCred == NULL)
|
|
{
|
|
SP_RETURN(SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY));
|
|
}
|
|
|
|
DebugLog((DEB_TRACE, "New cred:%p, Protocol:%x\n", pCred, grbitProtocol));
|
|
|
|
|
|
pCred->Magic = PCT_CRED_MAGIC;
|
|
pCred->grbitProtocol = grbitProtocol;
|
|
|
|
Status = RtlInitializeCriticalSection(&pCred->csLock);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
pctRet = SEC_E_NO_CREDENTIALS;
|
|
goto error;
|
|
}
|
|
|
|
pCred->RefCount = 0;
|
|
pCred->cMappers = 0;
|
|
pCred->pahMappers = NULL;
|
|
pCred->dwFlags = 0;
|
|
pCred->pCredList = NULL;
|
|
|
|
GenerateRandomThumbprint(&pCred->CredThumbprint);
|
|
|
|
if((grbitProtocol & SP_PROT_SERVERS) && (pSchannelCred->cSubCreds == 0))
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_NO_CREDENTIALS);
|
|
goto error;
|
|
}
|
|
|
|
if(LsaTable->GetCallInfo(&CallInfo))
|
|
{
|
|
pCred->ProcessId = CallInfo.ProcessId;
|
|
}
|
|
|
|
|
|
//
|
|
// Walk through and initialize all certs and keys.
|
|
//
|
|
|
|
if(pSchannelCred->cSubCreds)
|
|
{
|
|
pCred->pCredList = SPExternalAlloc(pSchannelCred->cSubCreds * sizeof(SPCredential));
|
|
if(pCred->pCredList == NULL)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
|
goto error;
|
|
}
|
|
pCred->cCredList = pSchannelCred->cSubCreds;
|
|
|
|
for(i = 0; i < pSchannelCred->cSubCreds; i++)
|
|
{
|
|
pCurrentCred = pCred->pCredList + i;
|
|
|
|
pctRet = SPCreateCred(grbitProtocol,
|
|
pSchannelCred->paSubCred + i,
|
|
pCurrentCred,
|
|
&fEventLogged);
|
|
if(pctRet != PCT_ERR_OK)
|
|
{
|
|
goto error;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
//
|
|
// Determine which protocols are to be supported.
|
|
//
|
|
|
|
if(pSchannelCred->grbitEnabledProtocols == 0)
|
|
{
|
|
pCred->grbitEnabledProtocols = g_ProtEnabled;
|
|
|
|
if(g_PctClientDisabledByDefault)
|
|
{
|
|
pCred->grbitEnabledProtocols &= ~SP_PROT_PCT1_CLIENT;
|
|
}
|
|
if(g_Ssl2ClientDisabledByDefault)
|
|
{
|
|
pCred->grbitEnabledProtocols &= ~SP_PROT_SSL2_CLIENT;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
pCred->grbitEnabledProtocols = pSchannelCred->grbitEnabledProtocols & g_ProtEnabled;
|
|
}
|
|
|
|
// Force credential to client-only or server only.
|
|
if(grbitProtocol & SP_PROT_SERVERS)
|
|
{
|
|
pCred->grbitEnabledProtocols &= SP_PROT_SERVERS;
|
|
}
|
|
else
|
|
{
|
|
pCred->grbitEnabledProtocols &= SP_PROT_CLIENTS;
|
|
}
|
|
|
|
|
|
//
|
|
// Propagate flags from SCHANNEL_CRED structure.
|
|
//
|
|
|
|
if(pSchannelCred->dwFlags & SCH_CRED_NO_SYSTEM_MAPPER)
|
|
{
|
|
pCred->dwFlags |= CRED_FLAG_NO_SYSTEM_MAPPER;
|
|
}
|
|
if(pSchannelCred->dwFlags & SCH_CRED_NO_SERVERNAME_CHECK)
|
|
{
|
|
pCred->dwFlags |= CRED_FLAG_NO_SERVERNAME_CHECK;
|
|
}
|
|
if(pSchannelCred->dwFlags & SCH_CRED_MANUAL_CRED_VALIDATION)
|
|
{
|
|
pCred->dwFlags |= CRED_FLAG_MANUAL_CRED_VALIDATION;
|
|
}
|
|
if(pSchannelCred->dwFlags & SCH_CRED_NO_DEFAULT_CREDS)
|
|
{
|
|
pCred->dwFlags |= CRED_FLAG_NO_DEFAULT_CREDS;
|
|
}
|
|
if(pSchannelCred->dwFlags & SCH_CRED_AUTO_CRED_VALIDATION)
|
|
{
|
|
// Automatically validate server credentials.
|
|
pCred->dwFlags &= ~CRED_FLAG_MANUAL_CRED_VALIDATION;
|
|
}
|
|
if(pSchannelCred->dwFlags & SCH_CRED_USE_DEFAULT_CREDS)
|
|
{
|
|
// Use default client credentials.
|
|
pCred->dwFlags &= ~CRED_FLAG_NO_DEFAULT_CREDS;
|
|
}
|
|
if(pSchannelCred->dwFlags & SCH_CRED_DISABLE_RECONNECTS)
|
|
{
|
|
// Disable reconnects.
|
|
pCred->dwFlags |= CRED_FLAG_DISABLE_RECONNECTS;
|
|
}
|
|
|
|
// set revocation flags
|
|
if(pSchannelCred->dwFlags & SCH_CRED_REVOCATION_CHECK_END_CERT)
|
|
pCred->dwFlags |= CRED_FLAG_REVCHECK_END_CERT;
|
|
if(pSchannelCred->dwFlags & SCH_CRED_REVOCATION_CHECK_CHAIN)
|
|
pCred->dwFlags |= CRED_FLAG_REVCHECK_CHAIN;
|
|
if(pSchannelCred->dwFlags & SCH_CRED_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT)
|
|
pCred->dwFlags |= CRED_FLAG_REVCHECK_CHAIN_EXCLUDE_ROOT;
|
|
if(pSchannelCred->dwFlags & SCH_CRED_IGNORE_NO_REVOCATION_CHECK)
|
|
pCred->dwFlags |= CRED_FLAG_IGNORE_NO_REVOCATION_CHECK;
|
|
if(pSchannelCred->dwFlags & SCH_CRED_IGNORE_REVOCATION_OFFLINE)
|
|
pCred->dwFlags |= CRED_FLAG_IGNORE_REVOCATION_OFFLINE;
|
|
|
|
|
|
// set up the min and max strength
|
|
GetBaseCipherSizes(&pCred->dwMinStrength, &pCred->dwMaxStrength);
|
|
|
|
if(pSchannelCred->dwMinimumCipherStrength == 0)
|
|
{
|
|
pCred->dwMinStrength = max(40, pCred->dwMinStrength);
|
|
}
|
|
else if(pSchannelCred->dwMinimumCipherStrength == (DWORD)(-1))
|
|
{
|
|
// Turn on NULL cipher.
|
|
pCred->dwMinStrength = 0;
|
|
}
|
|
else
|
|
{
|
|
pCred->dwMinStrength = pSchannelCred->dwMinimumCipherStrength;
|
|
}
|
|
|
|
if(pSchannelCred->dwMaximumCipherStrength == (DWORD)(-1))
|
|
{
|
|
// NULL cipher only.
|
|
pCred->dwMaxStrength = 0;
|
|
}
|
|
else if(pSchannelCred->dwMaximumCipherStrength != 0)
|
|
{
|
|
pCred->dwMaxStrength = pSchannelCred->dwMaximumCipherStrength;
|
|
}
|
|
|
|
// set up the allowed ciphers
|
|
BuildAlgList(pCred, pSchannelCred->palgSupportedAlgs, pSchannelCred->cSupportedAlgs);
|
|
|
|
|
|
//
|
|
// Set up all of the applications mappers and add in the default mapper.
|
|
//
|
|
|
|
pCred->cMappers = pSchannelCred->cMappers + 1;
|
|
pCred->pahMappers = SPExternalAlloc(pCred->cMappers * sizeof(HMAPPER *));
|
|
if(pCred->pahMappers == NULL)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
|
goto error;
|
|
}
|
|
|
|
// Make system certificate mapper the first mapper in the list.
|
|
pCred->pahMappers[0] = SslGetMapper(TRUE);
|
|
|
|
if(pCred->dwFlags & CRED_FLAG_REVCHECK_END_CERT)
|
|
pCred->pahMappers[0]->m_dwFlags |= SCH_FLAG_REVCHECK_END_CERT;
|
|
if(pCred->dwFlags & CRED_FLAG_REVCHECK_CHAIN)
|
|
pCred->pahMappers[0]->m_dwFlags |= SCH_FLAG_REVCHECK_CHAIN;
|
|
if(pCred->dwFlags & CRED_FLAG_REVCHECK_CHAIN_EXCLUDE_ROOT)
|
|
pCred->pahMappers[0]->m_dwFlags |= SCH_FLAG_REVCHECK_CHAIN_EXCLUDE_ROOT;
|
|
if(pCred->dwFlags & CRED_FLAG_IGNORE_NO_REVOCATION_CHECK)
|
|
pCred->pahMappers[0]->m_dwFlags |= SCH_FLAG_IGNORE_NO_REVOCATION_CHECK;
|
|
if(pCred->dwFlags & CRED_FLAG_IGNORE_REVOCATION_OFFLINE)
|
|
pCred->pahMappers[0]->m_dwFlags |= SCH_FLAG_IGNORE_REVOCATION_OFFLINE;
|
|
|
|
SslReferenceMapper(pCred->pahMappers[0]);
|
|
|
|
for(i = 0; i < pSchannelCred->cMappers; i++)
|
|
{
|
|
pCred->pahMappers[i + 1] = pSchannelCred->aphMappers[i];
|
|
pSchannelCred->aphMappers[i] = NULL;
|
|
|
|
SslReferenceMapper(pCred->pahMappers[i + 1]);
|
|
}
|
|
|
|
|
|
// set up timeouts.
|
|
if(pSchannelCred->dwSessionLifespan == 0)
|
|
{
|
|
if(grbitProtocol & SP_PROT_CLIENTS)
|
|
{
|
|
pCred->dwSessionLifespan = SchannelCache.dwClientLifespan;
|
|
}
|
|
else
|
|
{
|
|
pCred->dwSessionLifespan = SchannelCache.dwServerLifespan;
|
|
}
|
|
}
|
|
else if(pSchannelCred->dwSessionLifespan == (DWORD)(-1))
|
|
{
|
|
pCred->dwSessionLifespan = 0;
|
|
}
|
|
else
|
|
{
|
|
pCred->dwSessionLifespan = pSchannelCred->dwSessionLifespan;
|
|
}
|
|
|
|
|
|
//
|
|
// Add credential to global list of credentials.
|
|
//
|
|
|
|
RtlEnterCriticalSection( &g_SslCredLock );
|
|
InsertTailList( &g_SslCredList, &pCred->ListEntry );
|
|
RtlLeaveCriticalSection( &g_SslCredLock );
|
|
|
|
|
|
//
|
|
// Get list of trusted issuers.
|
|
//
|
|
|
|
if(grbitProtocol & SP_PROT_SERVERS)
|
|
{
|
|
if(pSchannelCred->hRootStore)
|
|
{
|
|
pCred->hApplicationRoots = CertDuplicateStore(pSchannelCred->hRootStore);
|
|
if(!pCred->hApplicationRoots)
|
|
{
|
|
DebugLog((DEB_ERROR, "Error 0x%x duplicating app root store\n", GetLastError()));
|
|
}
|
|
}
|
|
|
|
fImpersonating = SslImpersonateClient();
|
|
|
|
pCred->hUserRoots = CertOpenSystemStore(0, "ROOT");
|
|
if(!pCred->hUserRoots)
|
|
{
|
|
DebugLog((DEB_ERROR, "Error 0x%x opening user root store\n", GetLastError()));
|
|
}
|
|
else
|
|
{
|
|
if(!CertControlStore(pCred->hUserRoots,
|
|
0,
|
|
CERT_STORE_CTRL_NOTIFY_CHANGE,
|
|
&g_GPEvent))
|
|
{
|
|
DebugLog((DEB_ERROR, "Error 0x%x registering user root change notification\n", GetLastError()));
|
|
}
|
|
}
|
|
|
|
if(fImpersonating)
|
|
{
|
|
RevertToSelf();
|
|
fImpersonating = FALSE;
|
|
}
|
|
}
|
|
|
|
|
|
SPReferenceCredential(pCred);
|
|
|
|
*ppCred = pCred;
|
|
|
|
SP_RETURN(PCT_ERR_OK);
|
|
|
|
|
|
error:
|
|
|
|
if(fEventLogged == FALSE)
|
|
{
|
|
LogCreateCredFailedEvent(grbitProtocol);
|
|
}
|
|
|
|
// Error case, free the credential
|
|
if(pCred)
|
|
{
|
|
SPDeleteCredential(pCred);
|
|
}
|
|
|
|
SP_RETURN(pctRet);
|
|
}
|
|
|
|
|
|
BOOL
|
|
SPDeleteCredential(
|
|
PSPCredentialGroup pCred)
|
|
{
|
|
DWORD i;
|
|
|
|
SP_BEGIN("SPDeleteCredential");
|
|
|
|
if(pCred == NULL)
|
|
{
|
|
SP_RETURN(TRUE);
|
|
}
|
|
|
|
if(pCred->Magic != PCT_CRED_MAGIC)
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Attempting to delete invalid credential!\n"));
|
|
SP_RETURN (FALSE);
|
|
}
|
|
|
|
LockCredential(pCred);
|
|
|
|
if(pCred->pCredList)
|
|
{
|
|
for(i = 0; i < pCred->cCredList; i++)
|
|
{
|
|
SPDeleteCred(pCred->pCredList + i);
|
|
}
|
|
SPExternalFree(pCred->pCredList);
|
|
pCred->pCredList = NULL;
|
|
pCred->cCredList = 0;
|
|
}
|
|
|
|
if(pCred->cMappers && pCred->pahMappers)
|
|
{
|
|
for(i=0; i < (DWORD)pCred->cMappers; i++)
|
|
{
|
|
SslDereferenceMapper(pCred->pahMappers[i]);
|
|
}
|
|
SPExternalFree(pCred->pahMappers);
|
|
}
|
|
|
|
|
|
if(pCred->palgSupportedAlgs)
|
|
{
|
|
SPExternalFree(pCred->palgSupportedAlgs);
|
|
}
|
|
pCred->Magic = PCT_INVALID_MAGIC;
|
|
|
|
if(pCred->ListEntry.Flink)
|
|
{
|
|
RtlEnterCriticalSection( &g_SslCredLock );
|
|
RemoveEntryList( &pCred->ListEntry );
|
|
RtlLeaveCriticalSection( &g_SslCredLock );
|
|
}
|
|
|
|
if(pCred->pbTrustedIssuers)
|
|
{
|
|
// LocalFree is used for the issuer list because realloc
|
|
// is used when building the list and the LSA doesn't
|
|
// provide a realloc helper function.
|
|
LocalFree(pCred->pbTrustedIssuers);
|
|
}
|
|
|
|
if(pCred->hApplicationRoots)
|
|
{
|
|
CertCloseStore(pCred->hApplicationRoots, 0);
|
|
}
|
|
|
|
if(pCred->hUserRoots)
|
|
{
|
|
BOOL fImpersonating = SslImpersonateClient();
|
|
CertCloseStore(pCred->hUserRoots, 0);
|
|
if(fImpersonating) RevertToSelf();
|
|
}
|
|
|
|
UnlockCredential(pCred);
|
|
|
|
RtlDeleteCriticalSection(&pCred->csLock);
|
|
|
|
ZeroMemory(pCred, sizeof(SPCredentialGroup));
|
|
SPExternalFree(pCred);
|
|
|
|
SP_RETURN(TRUE);
|
|
}
|
|
|
|
void
|
|
SPDeleteCred(PSPCredential pCred)
|
|
{
|
|
BOOL fImpersonating = FALSE;
|
|
|
|
if(pCred == NULL)
|
|
{
|
|
return;
|
|
}
|
|
|
|
if(pCred->pPublicKey)
|
|
{
|
|
SPExternalFree(pCred->pPublicKey);
|
|
pCred->pPublicKey = NULL;
|
|
}
|
|
if(pCred->pCert)
|
|
{
|
|
CertFreeCertificateContext(pCred->pCert);
|
|
pCred->pCert = NULL;
|
|
}
|
|
|
|
if(pCred->hTek)
|
|
{
|
|
if(!CryptDestroyKey(pCred->hTek))
|
|
{
|
|
SP_LOG_RESULT(GetLastError());
|
|
}
|
|
pCred->hTek = 0;
|
|
}
|
|
|
|
if(pCred->hProv)
|
|
{
|
|
fImpersonating = SslImpersonateClient();
|
|
|
|
if(!SchCryptReleaseContext(
|
|
pCred->hProv,
|
|
0,
|
|
pCred->dwCapiFlags))
|
|
{
|
|
SP_LOG_RESULT(GetLastError());
|
|
}
|
|
pCred->hProv = 0;
|
|
|
|
if(fImpersonating)
|
|
{
|
|
RevertToSelf();
|
|
fImpersonating = FALSE;
|
|
}
|
|
}
|
|
if(pCred->pCapiAlgs)
|
|
{
|
|
SPExternalFree(pCred->pCapiAlgs);
|
|
pCred->pCapiAlgs = NULL;
|
|
}
|
|
if(pCred->hRemoteProv && !pCred->fAppRemoteProv)
|
|
{
|
|
if(!RemoteCryptReleaseContext(
|
|
pCred->hRemoteProv,
|
|
0,
|
|
pCred->dwCapiFlags))
|
|
{
|
|
SP_LOG_RESULT(GetLastError());
|
|
}
|
|
pCred->hRemoteProv = 0;
|
|
}
|
|
if(pCred->hEphem512Prov)
|
|
{
|
|
if(!SchCryptReleaseContext(pCred->hEphem512Prov,
|
|
0,
|
|
pCred->dwCapiFlags))
|
|
{
|
|
SP_LOG_RESULT(GetLastError());
|
|
}
|
|
pCred->hEphem512Prov = 0;
|
|
}
|
|
|
|
if(pCred->pbSsl3SerializedChain)
|
|
{
|
|
SPExternalFree(pCred->pbSsl3SerializedChain);
|
|
}
|
|
}
|
|
|
|
// Reference a credential.
|
|
// Note: This should only be called by someone who already
|
|
// has a reference to the credential, or by the CreateCredential
|
|
// call.
|
|
|
|
BOOL
|
|
SPReferenceCredential(
|
|
PSPCredentialGroup pCred)
|
|
{
|
|
BOOL fRet = FALSE;
|
|
|
|
fRet = (InterlockedIncrement(&pCred->RefCount) > 0);
|
|
|
|
DebugLog((SP_LOG_TRACE, "Reference Cred %lx: %d\n", pCred, pCred->RefCount));
|
|
|
|
return fRet;
|
|
}
|
|
|
|
|
|
BOOL
|
|
SPDereferenceCredential(
|
|
PSPCredentialGroup pCred)
|
|
{
|
|
LONG Ref;
|
|
BOOL fRet = FALSE;
|
|
|
|
if(pCred == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
if(pCred->Magic != PCT_CRED_MAGIC)
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Attempting to dereference invalid credential!\n"));
|
|
return FALSE;
|
|
}
|
|
|
|
fRet = TRUE;
|
|
|
|
DebugLog((SP_LOG_TRACE, "Dereference Cred %lx: %d\n", pCred, pCred->RefCount-1));
|
|
|
|
if(0 == InterlockedDecrement(&pCred->RefCount))
|
|
{
|
|
fRet = SPDeleteCredential(pCred);
|
|
}
|
|
|
|
return fRet;
|
|
}
|
|
|
|
|
|
SECURITY_STATUS
|
|
UpdateCredentialFormat(
|
|
PSCH_CRED pSchCred, // in
|
|
PLSA_SCHANNEL_CRED pSchannelCred) // out
|
|
{
|
|
DWORD dwVersion;
|
|
DWORD dwType;
|
|
SP_STATUS pctRet;
|
|
DWORD i;
|
|
PBYTE pbChain;
|
|
DWORD cbChain;
|
|
PSCH_CRED_PUBLIC_CERTCHAIN pCertChain;
|
|
CRYPT_DATA_BLOB DataBlob;
|
|
|
|
SP_BEGIN("UpdateCredentialFormat");
|
|
|
|
//
|
|
// Initialize the output structure to null credential.
|
|
//
|
|
|
|
if(pSchannelCred == NULL)
|
|
{
|
|
SP_RETURN(SP_LOG_RESULT(SEC_E_INTERNAL_ERROR));
|
|
}
|
|
|
|
memset(pSchannelCred, 0, sizeof(LSA_SCHANNEL_CRED));
|
|
pSchannelCred->dwVersion = SCHANNEL_CRED_VERSION;
|
|
|
|
|
|
//
|
|
// If input buffer is empty then we're done.
|
|
//
|
|
|
|
if(pSchCred == NULL)
|
|
{
|
|
SP_RETURN(SEC_E_OK);
|
|
}
|
|
|
|
|
|
//
|
|
// Copy over the mapper fields.
|
|
//
|
|
|
|
pSchannelCred->cMappers = pSchCred->cMappers;
|
|
pSchannelCred->aphMappers = pSchCred->aphMappers;
|
|
|
|
|
|
//
|
|
// Convert the certificates and private keys.
|
|
//
|
|
|
|
if(pSchCred->cCreds == 0)
|
|
{
|
|
SP_RETURN(SEC_E_OK);
|
|
}
|
|
|
|
|
|
pSchannelCred->cSubCreds = pSchCred->cCreds;
|
|
|
|
pSchannelCred->paSubCred = SPExternalAlloc(sizeof(LSA_SCHANNEL_SUB_CRED) * pSchannelCred->cSubCreds);
|
|
if(pSchannelCred->paSubCred == NULL)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
|
goto error;
|
|
}
|
|
|
|
// Loop through each of the creds, and convert them into something we know
|
|
for(i = 0; i < pSchannelCred->cSubCreds; i++)
|
|
{
|
|
PLSA_SCHANNEL_SUB_CRED pSubCred = pSchannelCred->paSubCred + i;
|
|
|
|
//
|
|
// Decode the certificate.
|
|
//
|
|
|
|
dwType = *(PDWORD)pSchCred->paPublic[i];
|
|
|
|
if(dwType != SCH_CRED_X509_CERTCHAIN)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_UNKNOWN_CREDENTIALS);
|
|
goto error;
|
|
}
|
|
|
|
pCertChain = (PSCH_CRED_PUBLIC_CERTCHAIN)pSchCred->paPublic[i];
|
|
|
|
pbChain = pCertChain->pCertChain;
|
|
cbChain = pCertChain->cbCertChain;
|
|
|
|
// Decode the credential
|
|
pctRet = SPLoadCertificate(0,
|
|
X509_ASN_ENCODING,
|
|
pbChain,
|
|
cbChain,
|
|
&pSubCred->pCert);
|
|
if(pctRet != PCT_ERR_OK)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_UNKNOWN_CREDENTIALS);
|
|
goto error;
|
|
}
|
|
|
|
|
|
//
|
|
// Now deal with the private key.
|
|
//
|
|
|
|
dwType = *(DWORD *)pSchCred->paSecret[i];
|
|
|
|
if(dwType == SCHANNEL_SECRET_PRIVKEY)
|
|
{
|
|
PUCHAR pPrivateKeySave;
|
|
PSCH_CRED_SECRET_PRIVKEY pPrivKey;
|
|
DWORD Size;
|
|
|
|
pPrivKey = (PSCH_CRED_SECRET_PRIVKEY)pSchCred->paSecret[i];
|
|
|
|
pSubCred->pPrivateKey = SPExternalAlloc(pPrivKey->cbPrivateKey);
|
|
if(pSubCred->pPrivateKey == NULL)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
|
goto error;
|
|
}
|
|
memcpy(pSubCred->pPrivateKey, pPrivKey->pPrivateKey, pPrivKey->cbPrivateKey);
|
|
pSubCred->cbPrivateKey = pPrivKey->cbPrivateKey;
|
|
|
|
Size = strlen(pPrivKey->pszPassword) + sizeof(CHAR);
|
|
pSubCred->pszPassword = SPExternalAlloc(Size);
|
|
if(pSubCred->pszPassword == NULL)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
|
goto error;
|
|
}
|
|
memcpy(pSubCred->pszPassword, pPrivKey->pszPassword, Size);
|
|
|
|
break;
|
|
}
|
|
|
|
else if(dwType == SCHANNEL_SECRET_TYPE_CAPI)
|
|
{
|
|
PSCH_CRED_SECRET_CAPI pCapiKey;
|
|
|
|
pCapiKey = (PSCH_CRED_SECRET_CAPI)pSchCred->paSecret[i];
|
|
|
|
pSubCred->hRemoteProv = pCapiKey->hProv;
|
|
break;
|
|
}
|
|
|
|
else
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_UNKNOWN_CREDENTIALS);
|
|
goto error;
|
|
}
|
|
}
|
|
|
|
SP_RETURN(SEC_E_OK);
|
|
|
|
error:
|
|
|
|
if(pSchannelCred->paSubCred)
|
|
{
|
|
SPExternalFree((PVOID)pSchannelCred->paSubCred);
|
|
pSchannelCred->paSubCred = NULL;
|
|
}
|
|
|
|
SP_RETURN(pctRet);
|
|
}
|
|
|
|
|
|
SP_STATUS
|
|
GetIisPrivateFromCert(
|
|
PSPCredential pCred,
|
|
PLSA_SCHANNEL_SUB_CRED pSubCred)
|
|
{
|
|
PBYTE pbPrivate = NULL;
|
|
DWORD cbPrivate;
|
|
PBYTE pbPassword = NULL;
|
|
DWORD cbPassword;
|
|
|
|
PPRIVATE_KEY_FILE_ENCODE pPrivateFile = NULL;
|
|
DWORD cbPrivateFile;
|
|
|
|
BLOBHEADER *pPrivateBlob = NULL;
|
|
DWORD cbPrivateBlob;
|
|
HCRYPTKEY hPrivateKey;
|
|
PKeyExchangeInfo pExchInfo;
|
|
HCRYPTPROV hProv = 0;
|
|
SP_STATUS pctRet;
|
|
|
|
MD5_CTX md5Ctx;
|
|
struct RC4_KEYSTRUCT rc4Key;
|
|
DWORD i;
|
|
|
|
if(pSubCred->cbPrivateKey == 0 ||
|
|
pSubCred->pPrivateKey == NULL ||
|
|
pSubCred->pszPassword == NULL)
|
|
{
|
|
return SP_LOG_RESULT(SEC_E_NO_CREDENTIALS);
|
|
}
|
|
|
|
pbPrivate = pSubCred->pPrivateKey;
|
|
cbPrivate = pSubCred->cbPrivateKey;
|
|
|
|
pbPassword = pSubCred->pszPassword;
|
|
cbPassword = strlen(pbPassword);
|
|
|
|
|
|
// We have to do a little fixup here. Old versions of
|
|
// schannel wrote the wrong header data into the ASN
|
|
// for private key files, so we must fix the size data.
|
|
pbPrivate[2] = MSBOF(cbPrivate - 4);
|
|
pbPrivate[3] = LSBOF(cbPrivate - 4);
|
|
|
|
|
|
// ASN.1 decode the private key.
|
|
if(!CryptDecodeObject(X509_ASN_ENCODING,
|
|
szPrivateKeyFileEncode,
|
|
pbPrivate,
|
|
cbPrivate,
|
|
0,
|
|
NULL,
|
|
&cbPrivateFile))
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Error 0x%x decoding the private key\n",
|
|
GetLastError()));
|
|
pctRet = SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
|
|
goto error;
|
|
}
|
|
|
|
pPrivateFile = SPExternalAlloc(cbPrivateFile);
|
|
if(pPrivateFile == NULL)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
|
goto error;
|
|
}
|
|
|
|
if(!CryptDecodeObject(X509_ASN_ENCODING,
|
|
szPrivateKeyFileEncode,
|
|
pbPrivate,
|
|
cbPrivate,
|
|
0,
|
|
pPrivateFile,
|
|
&cbPrivateFile))
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Error 0x%x decoding the private key\n",
|
|
GetLastError()));
|
|
pctRet = SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
|
|
goto error;
|
|
}
|
|
|
|
|
|
// Decrypt the decoded private key using the password.
|
|
MD5Init(&md5Ctx);
|
|
MD5Update(&md5Ctx, pbPassword, cbPassword);
|
|
MD5Final(&md5Ctx);
|
|
|
|
rc4_key(&rc4Key, 16, md5Ctx.digest);
|
|
|
|
rc4(&rc4Key,
|
|
pPrivateFile->EncryptedBlob.cbData,
|
|
pPrivateFile->EncryptedBlob.pbData);
|
|
|
|
// Build a PRIVATEKEYBLOB from the decrypted private key.
|
|
if(!CryptDecodeObject(X509_ASN_ENCODING,
|
|
szPrivateKeyInfoEncode,
|
|
pPrivateFile->EncryptedBlob.pbData,
|
|
pPrivateFile->EncryptedBlob.cbData,
|
|
0,
|
|
NULL,
|
|
&cbPrivateBlob))
|
|
{
|
|
// Maybe this was a SGC style key.
|
|
// Re-encrypt it, and build the SGC decrypting
|
|
// key, and re-decrypt it.
|
|
BYTE md5Digest[MD5DIGESTLEN];
|
|
|
|
rc4_key(&rc4Key, 16, md5Ctx.digest);
|
|
rc4(&rc4Key,
|
|
pPrivateFile->EncryptedBlob.cbData,
|
|
pPrivateFile->EncryptedBlob.pbData);
|
|
CopyMemory(md5Digest, md5Ctx.digest, MD5DIGESTLEN);
|
|
|
|
MD5Init(&md5Ctx);
|
|
MD5Update(&md5Ctx, md5Digest, MD5DIGESTLEN);
|
|
MD5Update(&md5Ctx, SGC_KEY_SALT, lstrlen(SGC_KEY_SALT));
|
|
MD5Final(&md5Ctx);
|
|
rc4_key(&rc4Key, 16, md5Ctx.digest);
|
|
rc4(&rc4Key,
|
|
pPrivateFile->EncryptedBlob.cbData,
|
|
pPrivateFile->EncryptedBlob.pbData);
|
|
|
|
// Try again...
|
|
if(!CryptDecodeObject(X509_ASN_ENCODING,
|
|
szPrivateKeyInfoEncode,
|
|
pPrivateFile->EncryptedBlob.pbData,
|
|
pPrivateFile->EncryptedBlob.cbData,
|
|
0,
|
|
NULL,
|
|
&cbPrivateBlob))
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Error 0x%x building PRIVATEKEYBLOB\n",
|
|
GetLastError()));
|
|
ZeroMemory(&md5Ctx, sizeof(md5Ctx));
|
|
pctRet = SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
|
|
goto error;
|
|
}
|
|
}
|
|
ZeroMemory(&md5Ctx, sizeof(md5Ctx));
|
|
|
|
|
|
pPrivateBlob = SPExternalAlloc(cbPrivateBlob);
|
|
if(pPrivateBlob == NULL)
|
|
{
|
|
pctRet = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
|
goto error;
|
|
}
|
|
|
|
if(!CryptDecodeObject(X509_ASN_ENCODING,
|
|
szPrivateKeyInfoEncode,
|
|
pPrivateFile->EncryptedBlob.pbData,
|
|
pPrivateFile->EncryptedBlob.cbData,
|
|
0,
|
|
pPrivateBlob,
|
|
&cbPrivateBlob))
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Error 0x%x building PRIVATEKEYBLOB\n",
|
|
GetLastError()));
|
|
pctRet = SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
|
|
goto error;
|
|
}
|
|
|
|
// HACKHACK - Make sure that the key contained within the private
|
|
// key blob is marked for "key exchange".
|
|
pPrivateBlob->aiKeyAlg = CALG_RSA_KEYX;
|
|
|
|
// Create an in-memory key container.
|
|
if(!CryptAcquireContext(&hProv,
|
|
NULL,
|
|
NULL,
|
|
PROV_RSA_SCHANNEL,
|
|
CRYPT_VERIFYCONTEXT))
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Couldn't Acquire RSA Provider %lx\n", GetLastError()));
|
|
pctRet = SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
|
|
goto error;
|
|
}
|
|
|
|
// Import the private key blob into the key container.
|
|
if(!CryptImportKey(hProv,
|
|
(PBYTE)pPrivateBlob,
|
|
cbPrivateBlob,
|
|
0, 0,
|
|
&hPrivateKey))
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Error 0x%x importing PRIVATEKEYBLOB\n",
|
|
GetLastError()));
|
|
pctRet = SP_LOG_RESULT(PCT_INT_INTERNAL_ERROR);
|
|
goto error;
|
|
}
|
|
CryptDestroyKey(hPrivateKey);
|
|
|
|
// Obtain a matching CSP handle in the application process.
|
|
pctRet = RemoteCryptAcquireContextW(
|
|
&pCred->hRemoteProv,
|
|
NULL,
|
|
NULL,
|
|
PROV_RSA_SCHANNEL,
|
|
CRYPT_VERIFYCONTEXT,
|
|
SCH_CAPI_USE_CSP);
|
|
if(!NT_SUCCESS(pctRet))
|
|
{
|
|
pCred->hRemoteProv = 0;
|
|
SP_LOG_RESULT(pctRet);
|
|
goto error;
|
|
}
|
|
|
|
pCred->hProv = hProv;
|
|
pCred->dwKeySpec = AT_KEYEXCHANGE;
|
|
pCred->dwCapiFlags = SCH_CAPI_USE_CSP;
|
|
|
|
pctRet = PCT_ERR_OK;
|
|
|
|
|
|
error:
|
|
if(pPrivateFile) SPExternalFree(pPrivateFile);
|
|
if(pPrivateBlob) SPExternalFree(pPrivateBlob);
|
|
|
|
return pctRet;
|
|
}
|
|
|
|
SP_STATUS
|
|
LocalCryptAcquireContext(
|
|
HCRYPTPROV * phProv,
|
|
PCRYPT_KEY_PROV_INFO pProvInfo,
|
|
DWORD dwProtocol,
|
|
BOOL * pfEventLogged)
|
|
{
|
|
BOOL fImpersonating = FALSE;
|
|
BOOL fSuccess;
|
|
SP_STATUS Status;
|
|
HCRYPTPROV hProv;
|
|
|
|
// If the private key belongs to one of the Microsoft PROV_RSA_FULL
|
|
// CSPs, then manually divert it to the Microsoft PROV_RSA_SCHANNEL
|
|
// CSP. This works because both CSP types use the same private key
|
|
// storage scheme.
|
|
if(pProvInfo->dwProvType == PROV_RSA_FULL)
|
|
{
|
|
if(lstrcmpW(pProvInfo->pwszProvName, MS_DEF_PROV_W) == 0 ||
|
|
lstrcmpW(pProvInfo->pwszProvName, MS_STRONG_PROV_W) == 0 ||
|
|
lstrcmpW(pProvInfo->pwszProvName, MS_ENHANCED_PROV_W) == 0)
|
|
{
|
|
DebugLog((DEB_WARN, "Force CSP type to PROV_RSA_SCHANNEL.\n"));
|
|
pProvInfo->pwszProvName = MS_DEF_RSA_SCHANNEL_PROV_W;
|
|
pProvInfo->dwProvType = PROV_RSA_SCHANNEL;
|
|
}
|
|
}
|
|
|
|
if(pProvInfo->dwProvType != PROV_RSA_SCHANNEL &&
|
|
pProvInfo->dwProvType != PROV_DH_SCHANNEL)
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Bad server CSP type:%d\n", pProvInfo->dwProvType));
|
|
return SP_LOG_RESULT(PCT_ERR_UNKNOWN_CREDENTIAL);
|
|
}
|
|
|
|
fImpersonating = SslImpersonateClient();
|
|
|
|
fSuccess = CryptAcquireContextW(&hProv,
|
|
pProvInfo->pwszContainerName,
|
|
pProvInfo->pwszProvName,
|
|
pProvInfo->dwProvType,
|
|
pProvInfo->dwFlags | CRYPT_SILENT);
|
|
if(fImpersonating)
|
|
{
|
|
RevertToSelf();
|
|
fImpersonating = FALSE;
|
|
}
|
|
|
|
if(!fSuccess)
|
|
{
|
|
Status = GetLastError();
|
|
DebugLog((SP_LOG_ERROR, "Error 0x%x calling CryptAcquireContextW\n", Status));
|
|
LogCredAcquireContextFailedEvent(dwProtocol, Status);
|
|
*pfEventLogged = TRUE;
|
|
|
|
return SP_LOG_RESULT(PCT_ERR_UNKNOWN_CREDENTIAL);
|
|
}
|
|
|
|
|
|
DebugLog((SP_LOG_TRACE, "Local CSP handle acquired (0x%p)\n", hProv));
|
|
|
|
*phProv = hProv;
|
|
|
|
return PCT_ERR_OK;
|
|
}
|
|
|
|
|
|
//+---------------------------------------------------------------------------
|
|
//
|
|
// Function: GetPrivateFromCert
|
|
//
|
|
// Synopsis: Given a certificate context, somehow obtain a handle to the
|
|
// corresponding key container. Determine the key spec of the
|
|
// private key.
|
|
//
|
|
// Arguments: [pCred] -- Pointer to the credential.
|
|
//
|
|
// History: 09-24-96 jbanes Hacked for LSA integration.
|
|
//
|
|
// Notes: The private key often lives in a CSP. In this case, a handle
|
|
// to the CSP context is obtained by either reading the
|
|
// CERT_KEY_REMOTE_PROV_HANDLE_PROP_ID property, or by reading
|
|
// the CERT_KEY_PROV_INFO_PROP_ID property and then calling
|
|
// CryptAcquireContext.
|
|
//
|
|
// If this fails, then check and see if the private key is
|
|
// stored by IIS. If this is the case, then the encrypted
|
|
// private key is obtained by reading the
|
|
//
|
|
//----------------------------------------------------------------------------
|
|
SP_STATUS
|
|
GetPrivateFromCert(
|
|
PSPCredential pCred,
|
|
DWORD dwProtocol,
|
|
PLSA_SCHANNEL_SUB_CRED pSubCred)
|
|
{
|
|
PCRYPT_KEY_PROV_INFO pProvInfo = NULL;
|
|
HCRYPTPROV hProv;
|
|
DWORD cbSize;
|
|
BOOL fRemoteProvider = FALSE;
|
|
NTSTATUS Status;
|
|
BOOL fEventLogged = FALSE;
|
|
|
|
|
|
//
|
|
// Set the output fields to default values.
|
|
//
|
|
|
|
pCred->hProv = 0;
|
|
pCred->hRemoteProv = 0;
|
|
pCred->dwCapiFlags = SCH_CAPI_USE_CSP;
|
|
pCred->dwKeySpec = AT_KEYEXCHANGE;
|
|
|
|
|
|
if(dwProtocol & SP_PROT_CLIENTS)
|
|
{
|
|
// Access the CSP from the application process.
|
|
fRemoteProvider = TRUE;
|
|
}
|
|
|
|
|
|
//
|
|
// Check to see if the application called CryptAcquireContext. If so then
|
|
// we don't have to. This will typically not be the case.
|
|
//
|
|
|
|
if(fRemoteProvider && pSubCred->hRemoteProv)
|
|
{
|
|
DebugLog((SP_LOG_TRACE, "Application provided CSP handle (0x%p)\n", pSubCred->hRemoteProv));
|
|
pCred->hRemoteProv = pSubCred->hRemoteProv;
|
|
pCred->fAppRemoteProv = TRUE;
|
|
}
|
|
|
|
|
|
//
|
|
// Read the certificate context's "key info" property.
|
|
//
|
|
|
|
if(CertGetCertificateContextProperty(pCred->pCert,
|
|
CERT_KEY_PROV_INFO_PROP_ID,
|
|
NULL,
|
|
&cbSize))
|
|
{
|
|
pProvInfo = SPExternalAlloc(cbSize);
|
|
if(pProvInfo == NULL)
|
|
{
|
|
Status = SP_LOG_RESULT(SEC_E_INSUFFICIENT_MEMORY);
|
|
goto cleanup;
|
|
}
|
|
|
|
if(!CertGetCertificateContextProperty(pCred->pCert,
|
|
CERT_KEY_PROV_INFO_PROP_ID,
|
|
pProvInfo,
|
|
&cbSize))
|
|
{
|
|
DebugLog((SP_LOG_ERROR, "Error 0x%x reading CERT_KEY_PROV_INFO_PROP_ID\n",GetLastError()));
|
|
SPExternalFree(pProvInfo);
|
|
pProvInfo = NULL;
|
|
}
|
|
else
|
|
{
|
|
// Success.
|
|
pCred->dwKeySpec = pProvInfo->dwKeySpec;
|
|
|
|
DebugLog((SP_LOG_TRACE, "Container:%ls\n", pProvInfo->pwszContainerName));
|
|
DebugLog((SP_LOG_TRACE, "Provider: %ls\n", pProvInfo->pwszProvName));
|
|
DebugLog((SP_LOG_TRACE, "Type: 0x%8.8x\n", pProvInfo->dwProvType));
|
|
DebugLog((SP_LOG_TRACE, "Flags: 0x%8.8x\n", pProvInfo->dwFlags));
|
|
DebugLog((SP_LOG_TRACE, "Key spec: %d\n", pProvInfo->dwKeySpec));
|
|
|
|
LogCredPropertiesEvent(dwProtocol, pProvInfo, pCred->pCert);
|
|
}
|
|
}
|
|
|
|
|
|
if(pCred->hRemoteProv)
|
|
{
|
|
// The application supplied an hProv for us to use.
|
|
|
|
Status = PCT_ERR_OK;
|
|
goto cleanup;
|
|
}
|
|
|
|
|
|
if(pProvInfo)
|
|
{
|
|
//
|
|
// We read the "key info" property successfully, so call
|
|
// CryptAcquireContext in order to get a handle to the appropriate
|
|
// key container.
|
|
//
|
|
|
|
if(!fRemoteProvider)
|
|
{
|
|
// Call CryptAcquireContext from the LSA process.
|
|
Status = LocalCryptAcquireContext(&hProv, pProvInfo, dwProtocol, &fEventLogged);
|
|
if(Status != PCT_ERR_OK)
|
|
{
|
|
goto cleanup;
|
|
}
|
|
|
|
pCred->hProv = hProv;
|
|
}
|
|
|
|
// Obtain a matching CSP handle in the application process.
|
|
Status = RemoteCryptAcquireContextW(
|
|
&pCred->hRemoteProv,
|
|
pProvInfo->pwszContainerName,
|
|
pProvInfo->pwszProvName,
|
|
pProvInfo->dwProvType,
|
|
pProvInfo->dwFlags,
|
|
pCred->dwCapiFlags);
|
|
if(!NT_SUCCESS(Status))
|
|
{
|
|
LogCredAcquireContextFailedEvent(dwProtocol, Status);
|
|
fEventLogged = TRUE;
|
|
|
|
Status = SP_LOG_RESULT(PCT_ERR_UNKNOWN_CREDENTIAL);
|
|
goto cleanup;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// We weren't able to read the "key info" property, so attempt to
|
|
// read the "iis private key" property, and build the private key
|
|
// up from that.
|
|
//
|
|
|
|
DebugLog((SP_LOG_TRACE, "Attempt IIS 4.0 compatibility hack.\n"));
|
|
|
|
Status = GetIisPrivateFromCert(pCred, pSubCred);
|
|
|
|
if(Status != PCT_ERR_OK)
|
|
{
|
|
SP_LOG_RESULT(Status);
|
|
goto cleanup;
|
|
}
|
|
}
|
|
|
|
Status = PCT_ERR_OK;
|
|
|
|
cleanup:
|
|
|
|
if(Status != PCT_ERR_OK && fEventLogged == FALSE)
|
|
{
|
|
if(pProvInfo == NULL)
|
|
{
|
|
LogNoPrivateKeyEvent(dwProtocol);
|
|
}
|
|
else
|
|
{
|
|
LogCreateCredFailedEvent(dwProtocol);
|
|
}
|
|
}
|
|
|
|
if(pProvInfo)
|
|
{
|
|
SPExternalFree(pProvInfo);
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
DWORD
|
|
GetCredentialKeySize(
|
|
PSPCredential pCred)
|
|
{
|
|
BLOBHEADER *pPublic;
|
|
RSAPUBKEY * pRsaPublic;
|
|
|
|
if(pCred->pPublicKey == NULL)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
pPublic = pCred->pPublicKey->pPublic;
|
|
|
|
if(pPublic == NULL || pPublic->bType != PUBLICKEYBLOB)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
pRsaPublic = (RSAPUBKEY *)(pPublic + 1);
|
|
|
|
return pRsaPublic->bitlen;
|
|
}
|
|
|