rootstore.c File Reference

#include "config.h"
#include <stdarg.h>
#include <stdio.h>
#include <sys/types.h>
#include <fcntl.h>
#include <errno.h>
#include <limits.h>
#include "ntstatus.h"
#include "windef.h"
#include "winbase.h"
#include "winreg.h"
#include "wincrypt.h"
#include "wine/winternl.h"
#include "wine/debug.h"
#include "crypt32_private.h"

Include dependency graph for rootstore.c:

Go to the source code of this file.

Classes
struct	DynamicBuffer
struct	CONST_BLOB

Macros
#define	WIN32_NO_STATUS
#define	INITIAL_CERT_BUFFER   1024

Functions
	WINE_DEFAULT_DEBUG_CHANNEL (crypt)
static void	reset_buffer (struct DynamicBuffer *buffer)
static BOOL	add_line_to_buffer (struct DynamicBuffer *buffer, LPCSTR line)
static BOOL	import_base64_certs_from_fp (FILE *fp, HCERTSTORE store)
static const char *	trust_status_to_str (DWORD status)
static const char *	get_cert_common_name (PCCERT_CONTEXT cert)
static void	check_and_store_certs (HCERTSTORE from, HCERTSTORE to)
static BOOL	import_certs_from_file (int fd, HCERTSTORE store)
static BOOL	import_certs_from_path (LPCSTR path, HCERTSTORE store, BOOL allow_dir)
static BOOL	import_certs_from_dir (LPCSTR path, HCERTSTORE store)
static void	add_ms_root_certs (HCERTSTORE to)
static void	read_trusted_roots_from_known_locations (HCERTSTORE store)
static HCERTSTORE	create_root_store (void)
void	CRYPT_ImportSystemRootCertsToReg (void)

Variables
static const char *const	CRYPT_knownLocations []
static const BYTE	authenticode []
static const BYTE	rootauthority []
static const BYTE	rootcertauthority []
static const BYTE	rootcertauthority2010 []
static const BYTE	rootcertauthority2011 []
static const struct CONST_BLOB	msRootCerts []
static const WCHAR	certs_root_pathW []
static const WCHAR	semaphoreW []

Macro Definition Documentation

INITIAL_CERT_BUFFER

#define INITIAL_CERT_BUFFER   1024

Definition at line 49 of file rootstore.c.

WIN32_NO_STATUS

#define WIN32_NO_STATUS

Definition at line 38 of file rootstore.c.

Function Documentation

add_line_to_buffer()

static BOOL add_line_to_buffer ( struct DynamicBuffer *  buffer, LPCSTR  line  )

static

Definition at line 64 of file rootstore.c.

{
    BOOL ret;
 
    if (buffer->used + strlen(line) + 1 > buffer->allocated)
    {
        if (!buffer->allocated)
        {
            buffer->data = CryptMemAlloc(INITIAL_CERT_BUFFER);
            if (buffer->data)
            {
                buffer->data[0] = 0;
                buffer->allocated = INITIAL_CERT_BUFFER;
            }
        }
        else
        {
            DWORD new_size = max(buffer->allocated * 2,
             buffer->used + strlen(line) + 1);
 
            buffer->data = CryptMemRealloc(buffer->data, new_size);
            if (buffer->data)
                buffer->allocated = new_size;
        }
    }
    if (buffer->data)
    {
        strcpy((char *)buffer->data + strlen((char *)buffer->data), line);
        /* Not strlen + 1, otherwise we'd count the NULL for every line's
         * addition (but we overwrite the previous NULL character.)  Not an
         * overrun, we allocate strlen + 1 bytes above.
         */
        buffer->used += strlen(line);
        ret = TRUE;
    }
    else
        ret = FALSE;
    return ret;
}

Referenced by import_base64_certs_from_fp().

add_ms_root_certs()

static void add_ms_root_certs ( HCERTSTORE  to )

static

Definition at line 928 of file rootstore.c.

{
    DWORD i;
 
    TRACE("\n");
 
    for (i = 0; i < ARRAY_SIZE(msRootCerts); i++)
        if (!CertAddEncodedCertificateToStore(to, X509_ASN_ENCODING,
         msRootCerts[i].pb, msRootCerts[i].cb, CERT_STORE_ADD_NEW, NULL))
            WARN("adding root cert %d failed: %08x\n", i, GetLastError());
}

Referenced by create_root_store().

check_and_store_certs()

static void check_and_store_certs ( HCERTSTORE  from, HCERTSTORE  to  )

static

Definition at line 238 of file rootstore.c.

{
    DWORD root_count = 0;
    CERT_CHAIN_ENGINE_CONFIG chainEngineConfig =
     { sizeof(chainEngineConfig), 0 };
    HCERTCHAINENGINE engine;
 
    TRACE("\n");
 
    CertDuplicateStore(to);
    engine = CRYPT_CreateChainEngine(to, CERT_SYSTEM_STORE_CURRENT_USER, &chainEngineConfig);
    if (engine)
    {
        PCCERT_CONTEXT cert = NULL;
 
        do {
            cert = CertEnumCertificatesInStore(from, cert);
            if (cert)
            {
                CERT_CHAIN_PARA chainPara = { sizeof(chainPara), { 0 } };
                PCCERT_CHAIN_CONTEXT chain;
                BOOL ret;
 
                ret = CertGetCertificateChain(engine, cert, NULL, from,
                 &chainPara, CERT_CHAIN_CACHE_ONLY_URL_RETRIEVAL, NULL, &chain);
                if (!ret)
                    TRACE("rejecting %s: %s\n", get_cert_common_name(cert),
                     "chain creation failed");
                else
                {
                    DWORD allowedErrors = CERT_TRUST_IS_UNTRUSTED_ROOT |
                     CERT_TRUST_IS_NOT_VALID_FOR_USAGE |
                     CERT_TRUST_INVALID_BASIC_CONSTRAINTS |
                     CERT_TRUST_IS_NOT_TIME_VALID;
 
                    /* The certificate chain verification only allows certain
                     * invalid CA certs if they're installed locally:  CA
                     * certs missing the key usage extension, and CA certs
                     * missing the basic constraints extension.  Of course
                     * there's a chicken and egg problem:  we have to accept
                     * them here in order for them to be accepted later.
                     * Expired, locally installed certs are also allowed here,
                     * because we don't know (yet) what date will be checked
                     * for an item signed by one of these certs.
                     * Thus, accept certs with any of the allowed errors.
                     */
                    if (chain->TrustStatus.dwErrorStatus & ~allowedErrors)
                        TRACE("rejecting %s: %s\n", get_cert_common_name(cert),
                         trust_status_to_str(chain->TrustStatus.dwErrorStatus &
                         ~CERT_TRUST_IS_UNTRUSTED_ROOT));
                    else
                    {
                        DWORD i, j;
 
                        for (i = 0; i < chain->cChain; i++)
                            for (j = 0; j < chain->rgpChain[i]->cElement; j++)
                                if (CertAddCertificateContextToStore(to,
                                 chain->rgpChain[i]->rgpElement[j]->pCertContext,
                                 CERT_STORE_ADD_NEW, NULL))
                                    root_count++;
                    }
                    CertFreeCertificateChain(chain);
                }
            }
        } while (cert);
        CertFreeCertificateChainEngine(engine);
    }
    TRACE("Added %d root certificates\n", root_count);
}

Referenced by read_trusted_roots_from_known_locations().

create_root_store()

static HCERTSTORE create_root_store ( void  )

static

Definition at line 991 of file rootstore.c.

{
#ifdef __REACTOS__
    HCERTSTORE root = NULL;
#endif
    HCERTSTORE memStore = CertOpenStore(CERT_STORE_PROV_MEMORY,
     X509_ASN_ENCODING, 0, CERT_STORE_CREATE_NEW_FLAG, NULL);
 
    if (memStore)
    {
#ifdef __REACTOS__
        HCERTSTORE regStore;
        CERT_STORE_PROV_INFO provInfo = {
         sizeof(CERT_STORE_PROV_INFO),
         sizeof(rootProvFuncs) / sizeof(rootProvFuncs[0]),
         rootProvFuncs,
         NULL,
         0,
         NULL
        };
#endif
 
        read_trusted_roots_from_known_locations(memStore);
        add_ms_root_certs(memStore);
#ifdef __REACTOS__
        root = CRYPT_ProvCreateStore(0, memStore, &provInfo);
        regStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, 0, CERT_SYSTEM_STORE_LOCAL_MACHINE, L"AuthRoot");
        if (regStore)
        {
            HCERTSTORE collStore = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
                CERT_STORE_CREATE_NEW_FLAG, NULL);
            CertAddStoreToCollection(collStore, regStore, 0, 0);
            CertAddStoreToCollection(collStore, root, 0, 0);
            root = collStore;
        }
#endif
    }
#ifdef __REACTOS__
    TRACE("returning %p\n", root);
    return root;
#else
    TRACE("returning %p\n", memStore);
    return memStore;
#endif
}

Referenced by CRYPT_ImportSystemRootCertsToReg().

CRYPT_ImportSystemRootCertsToReg()

void CRYPT_ImportSystemRootCertsToReg

(

void

)

Definition at line 1044 of file rootstore.c.

{
    HCERTSTORE store = NULL;
    HKEY key;
    LONG rc;
    HANDLE hsem;
 
    static BOOL root_certs_imported = FALSE;
 
    if (root_certs_imported)
        return;
 
    hsem = CreateSemaphoreW( NULL, 0, 1, semaphoreW);
    if (!hsem)
    {
        ERR("Failed to create semaphore\n");
        return;
    }
 
    if(GetLastError() == ERROR_ALREADY_EXISTS)
        WaitForSingleObject(hsem, INFINITE);
    else
    {
        if ((store = create_root_store()))
        {
            rc = RegCreateKeyExW(HKEY_LOCAL_MACHINE, certs_root_pathW, 0, NULL, 0,
                KEY_ALL_ACCESS, NULL, &key, 0);
            if (!rc)
            {
                if (!CRYPT_SerializeContextsToReg(key, REG_OPTION_VOLATILE, pCertInterface, store))
                    ERR("Failed to import system certs into registry, %08x\n", GetLastError());
                RegCloseKey(key);
            }
            CertCloseStore(store, 0);
        } else
            ERR("Failed to create root store\n");
    }
 
    root_certs_imported = TRUE;
    ReleaseSemaphore(hsem, 1, NULL);
    CloseHandle(hsem);
}

Referenced by CRYPT_SysRegOpenStoreW().

get_cert_common_name()

static const char * get_cert_common_name ( PCCERT_CONTEXT  cert )

static

Definition at line 211 of file rootstore.c.

{
    static char buf[1024];
    const char *name = NULL;
    CERT_NAME_INFO *nameInfo;
    DWORD size;
    BOOL ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_NAME,
     cert->pCertInfo->Subject.pbData, cert->pCertInfo->Subject.cbData,
     CRYPT_DECODE_NOCOPY_FLAG | CRYPT_DECODE_ALLOC_FLAG, NULL, &nameInfo,
     &size);
 
    if (ret)
    {
        PCERT_RDN_ATTR commonName = CertFindRDNAttr(szOID_COMMON_NAME,
         nameInfo);
 
        if (commonName)
        {
            CertRDNValueToStrA(commonName->dwValueType,
             &commonName->Value, buf, sizeof(buf));
            name = buf;
        }
        LocalFree(nameInfo);
    }
    return name;
}

Referenced by check_and_store_certs().

import_base64_certs_from_fp()

static BOOL import_base64_certs_from_fp ( FILE *  fp, HCERTSTORE  store  )

static

Definition at line 107 of file rootstore.c.

{
    char line[1024];
    BOOL in_cert = FALSE;
    struct DynamicBuffer saved_cert = { 0, 0, NULL };
    int num_certs = 0;
 
    TRACE("\n");
    while (fgets(line, sizeof(line), fp))
    {
        static const char header[] = "-----BEGIN CERTIFICATE-----";
        static const char trailer[] = "-----END CERTIFICATE-----";
 
        if (!strncmp(line, header, strlen(header)))
        {
            TRACE("begin new certificate\n");
            in_cert = TRUE;
            reset_buffer(&saved_cert);
        }
        else if (!strncmp(line, trailer, strlen(trailer)))
        {
            DWORD size;
 
            TRACE("end of certificate, adding cert\n");
            in_cert = FALSE;
            if (CryptStringToBinaryA((char *)saved_cert.data, saved_cert.used,
             CRYPT_STRING_BASE64, NULL, &size, NULL, NULL))
            {
                LPBYTE buf = CryptMemAlloc(size);
 
                if (buf)
                {
                    CryptStringToBinaryA((char *)saved_cert.data,
                     saved_cert.used, CRYPT_STRING_BASE64, buf, &size, NULL,
                     NULL);
                    if (CertAddEncodedCertificateToStore(store,
                     X509_ASN_ENCODING, buf, size, CERT_STORE_ADD_NEW, NULL))
                        num_certs++;
                    CryptMemFree(buf);
                }
            }
        }
        else if (in_cert)
            add_line_to_buffer(&saved_cert, line);
    }
    CryptMemFree(saved_cert.data);
    TRACE("Read %d certs\n", num_certs);
    return num_certs > 0;
}

Referenced by import_certs_from_file().

import_certs_from_dir()

static BOOL import_certs_from_dir ( LPCSTR  path, HCERTSTORE  store  )

static

Definition at line 362 of file rootstore.c.

{
#ifdef HAVE_READDIR
    BOOL ret = FALSE;
    DIR *dir;
 
    TRACE("(%s, %p)\n", debugstr_a(path), store);
 
    dir = opendir(path);
    if (dir)
    {
        size_t path_len = strlen(path), bufsize = 0;
        char *filebuf = NULL;
 
        struct dirent *entry;
        while ((entry = readdir(dir)))
        {
            if (strcmp(entry->d_name, ".") && strcmp(entry->d_name, ".."))
            {
                size_t name_len = strlen(entry->d_name);
 
                if (!check_buffer_resize(&filebuf, &bufsize, path_len + 1 + name_len + 1))
                {
                    ERR("Path buffer (re)allocation failed with out of memory condition\n");
                    break;
                }
                snprintf(filebuf, bufsize, "%s/%s", path, entry->d_name);
                if (import_certs_from_path(filebuf, store, FALSE) && !ret)
                    ret = TRUE;
            }
        }
        CryptMemFree(filebuf);
        closedir(dir);
    }
    return ret;
#else
    FIXME("not implemented without readdir available\n");
    return FALSE;
#endif
}

Referenced by import_certs_from_path().

import_certs_from_file()

static BOOL import_certs_from_file ( int  fd, HCERTSTORE  store  )

static

Definition at line 311 of file rootstore.c.

{
    BOOL ret = FALSE;
    FILE *fp;
 
    TRACE("\n");
 
    fp = fdopen(fd, "r");
    if (fp)
    {
        ret = import_base64_certs_from_fp(fp, store);
        fclose(fp);
    }
    return ret;
}

Referenced by import_certs_from_path().

import_certs_from_path()

static BOOL import_certs_from_path ( LPCSTR  path, HCERTSTORE  store, BOOL  allow_dir  )

static

Definition at line 407 of file rootstore.c.

{
    BOOL ret = FALSE;
    int fd;
 
    TRACE("(%s, %p, %d)\n", debugstr_a(path), store, allow_dir);
 
    fd = open(path, O_RDONLY);
    if (fd != -1)
    {
        struct stat st;
 
        if (fstat(fd, &st) == 0)
        {
            if (S_ISREG(st.st_mode))
                ret = import_certs_from_file(fd, store);
            else if (S_ISDIR(st.st_mode))
            {
                if (allow_dir)
                    ret = import_certs_from_dir(path, store);
                else
                    WARN("%s is a directory and directories are disallowed\n",
                     debugstr_a(path));
            }
            else
                ERR("%s: invalid file type\n", path);
        }
        close(fd);
    }
    return ret;
}

Referenced by import_certs_from_dir(), and read_trusted_roots_from_known_locations().

read_trusted_roots_from_known_locations()

static void read_trusted_roots_from_known_locations ( HCERTSTORE  store )

static

Definition at line 945 of file rootstore.c.

{
    HCERTSTORE from = CertOpenStore(CERT_STORE_PROV_MEMORY,
     X509_ASN_ENCODING, 0, CERT_STORE_CREATE_NEW_FLAG, NULL);
 
    if (from)
    {
        DWORD i;
        BOOL ret = FALSE;
 
#ifdef HAVE_SECURITY_SECURITY_H
        OSStatus status;
        CFArrayRef rootCerts;
 
        status = SecTrustCopyAnchorCertificates(&rootCerts);
        if (status == noErr)
        {
            int i;
            for (i = 0; i < CFArrayGetCount(rootCerts); i++)
            {
                SecCertificateRef cert = (SecCertificateRef)CFArrayGetValueAtIndex(rootCerts, i);
                CFDataRef certData;
                if ((status = SecKeychainItemExport(cert, kSecFormatX509Cert, 0, NULL, &certData)) == noErr)
                {
                    if (CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
                            CFDataGetBytePtr(certData), CFDataGetLength(certData),
                            CERT_STORE_ADD_NEW, NULL))
                        ret = TRUE;
                    else
                        WARN("adding root cert %d failed: %08x\n", i, GetLastError());
                    CFRelease(certData);
                }
                else
                    WARN("could not export certificate %d to X509 format: 0x%08x\n", i, (unsigned int)status);
            }
            CFRelease(rootCerts);
        }
#endif
 
        for (i = 0; !ret && i < ARRAY_SIZE(CRYPT_knownLocations); i++)
            ret = import_certs_from_path(CRYPT_knownLocations[i], from, TRUE);
        check_and_store_certs(from, store);
    }
    CertCloseStore(from, 0);
}

Referenced by create_root_store().

reset_buffer()

static void reset_buffer ( struct DynamicBuffer *  buffer )

inlinestatic

Definition at line 58 of file rootstore.c.

{
    buffer->used = 0;
    if (buffer->data) buffer->data[0] = 0;
}

Referenced by import_base64_certs_from_fp().

trust_status_to_str()

static const char * trust_status_to_str ( DWORD  status )

static

Definition at line 157 of file rootstore.c.

{
    static char buf[1024];
    int pos = 0;
 
    if (status & CERT_TRUST_IS_NOT_TIME_VALID)
        pos += snprintf(buf + pos, sizeof(buf) - pos, "\n\texpired");
    if (status & CERT_TRUST_IS_NOT_TIME_NESTED)
        pos += snprintf(buf + pos, sizeof(buf) - pos, "\n\tbad time nesting");
    if (status & CERT_TRUST_IS_REVOKED)
        pos += snprintf(buf + pos, sizeof(buf) - pos, "\n\trevoked");
    if (status & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
        pos += snprintf(buf + pos, sizeof(buf) - pos, "\n\tbad signature");
    if (status & CERT_TRUST_IS_NOT_VALID_FOR_USAGE)
        pos += snprintf(buf + pos, sizeof(buf) - pos, "\n\tbad usage");
    if (status & CERT_TRUST_IS_UNTRUSTED_ROOT)
        pos += snprintf(buf + pos, sizeof(buf) - pos, "\n\tuntrusted root");
    if (status & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\tunknown revocation status");
    if (status & CERT_TRUST_IS_CYCLIC)
        pos += snprintf(buf + pos, sizeof(buf) - pos, "\n\tcyclic chain");
    if (status & CERT_TRUST_INVALID_EXTENSION)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\tunsupported critical extension");
    if (status & CERT_TRUST_INVALID_POLICY_CONSTRAINTS)
        pos += snprintf(buf + pos, sizeof(buf) - pos, "\n\tbad policy");
    if (status & CERT_TRUST_INVALID_BASIC_CONSTRAINTS)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\tbad basic constraints");
    if (status & CERT_TRUST_INVALID_NAME_CONSTRAINTS)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\tbad name constraints");
    if (status & CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\tunsupported name constraint");
    if (status & CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\tundefined name constraint");
    if (status & CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\tdisallowed name constraint");
    if (status & CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\texcluded name constraint");
    if (status & CERT_TRUST_IS_OFFLINE_REVOCATION)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\trevocation server offline");
    if (status & CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY)
        pos += snprintf(buf + pos, sizeof(buf) - pos,
         "\n\tno issuance policy");
    return buf;
}

Referenced by check_and_store_certs().

WINE_DEFAULT_DEBUG_CHANNEL()

WINE_DEFAULT_DEBUG_CHANNEL

(

crypt

)

Variable Documentation

authenticode

const BYTE authenticode[]

static

Definition at line 501 of file rootstore.c.

certs_root_pathW

const WCHAR certs_root_pathW[]

static

Initial value:

=
 {'S','o','f','t','w','a','r','e','\\','M','i','c','r','o','s','o','f','t','\\',
  'S','y','s','t','e','m','C','e','r','t','i','f','i','c','a','t','e','s','\\',
  'R','o','o','t','\\', 'C','e','r','t','i','f','i','c','a','t','e','s', 0}

Definition at line 1037 of file rootstore.c.

Referenced by CRYPT_ImportSystemRootCertsToReg().

CRYPT_knownLocations

const char* const CRYPT_knownLocations[]

static

Initial value:

= {
 "/etc/ssl/certs/ca-certificates.crt",
 "/etc/ssl/certs",
 "/etc/pki/tls/certs/ca-bundle.crt",
 "/usr/share/ca-certificates/ca-bundle.crt",
 "/usr/local/share/certs/",
 "/etc/sfw/openssl/certs",
 "/etc/security/cacerts",  
}

Definition at line 491 of file rootstore.c.

Referenced by read_trusted_roots_from_known_locations().

msRootCerts

const struct CONST_BLOB msRootCerts[]

static

Initial value:

= {
    { authenticode, sizeof(authenticode) },
    { rootauthority, sizeof(rootauthority) },
    { rootcertauthority, sizeof(rootcertauthority) },
    { rootcertauthority2010, sizeof(rootcertauthority2010) },
    { rootcertauthority2011, sizeof(rootcertauthority2011) },
}

Referenced by add_ms_root_certs().

rootauthority

const BYTE rootauthority[]

static

Definition at line 564 of file rootstore.c.

rootcertauthority

const BYTE rootcertauthority[]

static

Definition at line 631 of file rootstore.c.

rootcertauthority2010

const BYTE rootcertauthority2010[]

static

Definition at line 722 of file rootstore.c.

rootcertauthority2011

const BYTE rootcertauthority2011[]

static

Definition at line 819 of file rootstore.c.

semaphoreW

const WCHAR semaphoreW[]

static

Initial value:

=
 {'c','r','y','p','t','3','2','_','r','o','o','t','_','s','e','m','a','p','h','o','r','e',0}

Definition at line 1041 of file rootstore.c.

Referenced by CRYPT_ImportSystemRootCertsToReg().