rootstore.c File Reference

#include <stdarg.h>
#include <stdio.h>
#include "ntstatus.h"
#include "windef.h"
#include "winbase.h"
#include "winreg.h"
#include "wincrypt.h"
#include "winternl.h"
#include "wine/debug.h"
#include "crypt32_private.h"

Include dependency graph for rootstore.c:

Go to the source code of this file.

Classes
struct	CONST_BLOB

Macros
#define	WIN32_NO_STATUS

Functions
	WINE_DEFAULT_DEBUG_CHANNEL (crypt)
static const char *	trust_status_to_str (DWORD status)
static const char *	get_cert_common_name (PCCERT_CONTEXT cert)
static void	check_and_store_certs (HCERTSTORE cached, HCERTSTORE new, HCERTSTORE to)
static void	add_ms_root_certs (HCERTSTORE to, HCERTSTORE cached)
static void	read_trusted_roots_from_known_locations (HCERTSTORE store, HCERTSTORE cached, BOOL *delete)
static HCERTSTORE	create_root_store (HCERTSTORE cached, BOOL *delete)
void	CRYPT_ImportSystemRootCertsToReg (void)

Variables
static const BYTE	authenticode []
static const BYTE	rootauthority []
static const BYTE	rootcertauthority []
static const BYTE	rootcertauthority2010 []
static const BYTE	rootcertauthority2011 []
static const struct CONST_BLOB	msRootCerts []

Macro Definition Documentation

WIN32_NO_STATUS

#define WIN32_NO_STATUS

Definition at line 23 of file rootstore.c.

Function Documentation

add_ms_root_certs()

static void add_ms_root_certs ( HCERTSTORE  to, HCERTSTORE  cached  )

static

Definition at line 598 of file rootstore.c.

{
    PCCERT_CONTEXT cert, existing;
    DWORD i;
 
    TRACE("\n");
 
    for (i = 0; i < ARRAY_SIZE(msRootCerts); i++)
    {
        if (!CertAddEncodedCertificateToStore(to, X509_ASN_ENCODING,
            msRootCerts[i].pb, msRootCerts[i].cb, CERT_STORE_ADD_NEW, &cert))
        {
            WARN("adding root cert %ld failed: %08lx\n", i, GetLastError());
            continue;
        }
        if ((existing = CertFindCertificateInStore(cached, X509_ASN_ENCODING, 0, CERT_FIND_EXISTING, cert, NULL)))
        {
            CertDeleteCertificateFromStore(existing);
            CertFreeCertificateContext(existing);
        }
        CertFreeCertificateContext(cert);
    }
}

Referenced by create_root_store().

check_and_store_certs()

static void check_and_store_certs ( HCERTSTORE  cached, HCERTSTORE  new, HCERTSTORE  to  )

static

Definition at line 101 of file rootstore.c.

{
    DWORD root_count = 0;
    CERT_CHAIN_ENGINE_CONFIG chainEngineConfig =
     { sizeof(chainEngineConfig), 0 };
    HCERTCHAINENGINE engine;
 
    TRACE("\n");
 
    CertDuplicateStore(to);
    engine = CRYPT_CreateChainEngine(to, CERT_SYSTEM_STORE_CURRENT_USER, &chainEngineConfig);
    if (engine)
    {
        PCCERT_CONTEXT cert = NULL;
 
        do {
            cert = CertEnumCertificatesInStore(new, cert);
            if (cert)
            {
                CERT_CHAIN_PARA chainPara = { sizeof(chainPara), { 0 } };
                PCCERT_CHAIN_CONTEXT chain;
                BOOL ret;
 
                ret = CertGetCertificateChain(engine, cert, NULL, cached,
                 &chainPara, CERT_CHAIN_CACHE_ONLY_URL_RETRIEVAL, NULL, &chain);
                if (!ret)
                    TRACE("rejecting %s: %s\n", get_cert_common_name(cert),
                     "chain creation failed");
                else
                {
                    DWORD allowedErrors = CERT_TRUST_IS_UNTRUSTED_ROOT |
                     CERT_TRUST_IS_NOT_VALID_FOR_USAGE |
                     CERT_TRUST_INVALID_BASIC_CONSTRAINTS |
                     CERT_TRUST_IS_NOT_TIME_VALID;
 
                    /* The certificate chain verification only allows certain
                     * invalid CA certs if they're installed locally:  CA
                     * certs missing the key usage extension, and CA certs
                     * missing the basic constraints extension.  Of course
                     * there's a chicken and egg problem:  we have to accept
                     * them here in order for them to be accepted later.
                     * Expired, locally installed certs are also allowed here,
                     * because we don't know (yet) what date will be checked
                     * for an item signed by one of these certs.
                     * Thus, accept certs with any of the allowed errors.
                     */
                    if (chain->TrustStatus.dwErrorStatus & ~allowedErrors)
                        TRACE("rejecting %s: %s\n", get_cert_common_name(cert),
                         trust_status_to_str(chain->TrustStatus.dwErrorStatus &
                         ~CERT_TRUST_IS_UNTRUSTED_ROOT));
                    else
                    {
                        DWORD i, j;
 
                        for (i = 0; i < chain->cChain; i++)
                            for (j = 0; j < chain->rgpChain[i]->cElement; j++)
                                if (CertAddCertificateContextToStore(to,
                                 chain->rgpChain[i]->rgpElement[j]->pCertContext,
                                 CERT_STORE_ADD_NEW, NULL))
                                    root_count++;
                    }
                    CertFreeCertificateChain(chain);
                }
            }
        } while (cert);
        CertFreeCertificateChainEngine(engine);
    }
    TRACE("Added %ld root certificates\n", root_count);
}

Referenced by read_trusted_roots_from_known_locations().

create_root_store()

static HCERTSTORE create_root_store ( HCERTSTORE  cached, BOOL *  delete  )

static

Definition at line 721 of file rootstore.c.

{
    HCERTSTORE memStore = CertOpenStore(CERT_STORE_PROV_MEMORY,
     X509_ASN_ENCODING, 0, CERT_STORE_CREATE_NEW_FLAG, NULL);
 
 
    *delete = FALSE;
    if (memStore)
    {
        add_ms_root_certs(memStore, cached);
        read_trusted_roots_from_known_locations(memStore, cached, delete);
    }
 
    TRACE("returning %p\n", memStore);
    return memStore;
}

Referenced by CRYPT_ImportSystemRootCertsToReg().

CRYPT_ImportSystemRootCertsToReg()

void CRYPT_ImportSystemRootCertsToReg

(

void

)

Definition at line 738 of file rootstore.c.

{
    HCERTSTORE store = NULL, reg = NULL;
    HKEY key = NULL;
    LONG rc;
    HANDLE hsem;
    BOOL delete;
 
    static BOOL root_certs_imported = FALSE;
 
    if (root_certs_imported)
        return;
 
    hsem = CreateSemaphoreW( NULL, 0, 1, L"crypt32_root_semaphore");
    if (!hsem)
    {
        ERR("Failed to create semaphore\n");
        return;
    }
 
    if(GetLastError() == ERROR_ALREADY_EXISTS)
    {
        WaitForSingleObject(hsem, INFINITE);
        goto done;
    }
 
    rc = RegCreateKeyExW(HKEY_LOCAL_MACHINE, L"Software\\Microsoft\\SystemCertificates\\Root\\Certificates", 0, NULL, 0,
            KEY_ALL_ACCESS, NULL, &key, 0);
    if (rc)
        goto done;
 
    if (!(reg = CertOpenStore(CERT_STORE_PROV_MEMORY, X509_ASN_ENCODING, 0, CERT_STORE_CREATE_NEW_FLAG, NULL)))
    {
        ERR("Failed to create memory store.\n");
        goto done;
    }
    CRYPT_RegReadSerializedFromReg(key, CERT_STORE_CERTIFICATE_CONTEXT_FLAG, reg, CERT_STORE_ADD_ALWAYS);
 
    if (!(store = create_root_store(reg, &delete)))
    {
        ERR("Failed to create root store\n");
        goto done;
    }
    if (delete && RegDeleteTreeW(key, NULL))
        ERR("Error deleting key.\n");
    if (!CRYPT_SerializeContextsToReg(key, 0, pCertInterface, store))
        ERR("Failed to import system certs into registry, %08lx\n", GetLastError());
 
done:
    RegCloseKey(key);
    CertCloseStore(store, 0);
    CertCloseStore(reg, 0);
    root_certs_imported = TRUE;
    ReleaseSemaphore(hsem, 1, NULL);
    CloseHandle(hsem);
}

Referenced by CRYPT_SysRegOpenStoreW().

get_cert_common_name()

static const char * get_cert_common_name ( PCCERT_CONTEXT  cert )

static

Definition at line 74 of file rootstore.c.

{
    static char buf[1024];
    const char *name = NULL;
    CERT_NAME_INFO *nameInfo;
    DWORD size;
    BOOL ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_NAME,
     cert->pCertInfo->Subject.pbData, cert->pCertInfo->Subject.cbData,
     CRYPT_DECODE_NOCOPY_FLAG | CRYPT_DECODE_ALLOC_FLAG, NULL, &nameInfo,
     &size);
 
    if (ret)
    {
        PCERT_RDN_ATTR commonName = CertFindRDNAttr(szOID_COMMON_NAME,
         nameInfo);
 
        if (commonName)
        {
            CertRDNValueToStrA(commonName->dwValueType,
             &commonName->Value, buf, sizeof(buf));
            name = buf;
        }
        LocalFree(nameInfo);
    }
    return name;
}

Referenced by check_and_store_certs().

read_trusted_roots_from_known_locations()

static void read_trusted_roots_from_known_locations ( HCERTSTORE  store, HCERTSTORE  cached, BOOL *  delete  )

static

Definition at line 627 of file rootstore.c.

{
    HCERTSTORE new;
    DWORD needed, size;
    struct enum_root_certs_params params = { NULL, 2048, &needed };
    HCRYPTPROV prov;
    HCRYPTHASH hash;
    BYTE hashval[20];
    DWORD hashlen;
    CRYPT_HASH_BLOB hash_blob = { sizeof(hashval), hashval };
    CRYPT_DATA_BLOB exists_blob = { 0, NULL };
    PCCERT_CONTEXT cert, existing;
    unsigned int existing_count = 0, new_count = 0;
    unsigned int cached_count = 0;
 
    new = CertOpenStore( CERT_STORE_PROV_MEMORY, X509_ASN_ENCODING, 0, CERT_STORE_CREATE_NEW_FLAG, NULL );
    if (!new) return;
 
    existing = NULL;
    while ((existing = CertEnumCertificatesInStore( cached, existing )))
        ++cached_count;
 
    CryptAcquireContextW( &prov, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT );
    params.buffer = CryptMemAlloc( params.size );
    while (!CRYPT32_CALL( enum_root_certs, &params ))
    {
        if (needed > params.size)
        {
            CryptMemFree( params.buffer );
            params.buffer = CryptMemAlloc( needed );
            params.size = needed;
            continue;
        }
        CryptCreateHash( prov, CALG_SHA1, 0, 0, &hash );
        CryptHashData( hash, params.buffer, needed, 0 );
        hashlen = sizeof(hashval);
        CryptGetHashParam( hash, HP_HASHVAL, hashval, &hashlen, 0 );
        CryptDestroyHash( hash );
        if ((existing = CertFindCertificateInStore( cached, X509_ASN_ENCODING, 0,
                                                    CERT_FIND_SHA1_HASH, &hash_blob, NULL )))
        {
            /* Skip certificate which is already cached. CERT_FIRST_USER_PROP_ID is set once the cached cert
             * is found among host imports. */
            if (!CertGetCertificateContextProperty( existing, CERT_FIRST_USER_PROP_ID, NULL, &size ))
            {
                if (!CertSetCertificateContextProperty( existing, CERT_FIRST_USER_PROP_ID, 0, &exists_blob ))
                    ERR( "Failed to set property.\n" );
                ++existing_count;
            }
            CertFreeCertificateContext( existing );
            continue;
        }
        CertAddEncodedCertificateToStore( new, X509_ASN_ENCODING, params.buffer, needed, CERT_STORE_ADD_ALWAYS, &cert );
        /* Add to cached so we can catch duplicates and check_and_store_certs() has the full chains. */
        CertAddCertificateContextToStore( cached, cert, CERT_STORE_ADD_ALWAYS, NULL );
        if (!CertSetCertificateContextProperty( cert, CERT_FIRST_USER_PROP_ID, 0, &exists_blob ))
            ERR("Failed to set property.\n");
        CertFreeCertificateContext( cert );
        ++new_count;
    }
    CryptMemFree( params.buffer );
    CryptReleaseContext( prov, 0 );
 
    if (existing_count < cached_count)
    {
        /* Some certs were removed on host. Clean up the cache and add all the certificates so cert chains
         * get revalidated. The certs present on host are now in 'cached' store and are marked with
         * CERT_FIRST_USER_PROP_ID property. */
        TRACE( "Some keys were removed, reimporting, cached %u, existing %u, new %u.\n",
                cached_count, existing_count, new_count );
        *delete = TRUE;
        existing_count = 0;
        existing = NULL;
        while ((existing = CertEnumCertificatesInStore( cached, existing )))
        {
            if (!CertGetCertificateContextProperty( existing, CERT_FIRST_USER_PROP_ID, NULL, &size ))
                continue;
            CertAddCertificateContextToStore( new, existing, CERT_STORE_ADD_NEW, NULL );
            ++new_count;
        }
    }
    if (new_count)
    {
        /* Clear custom property so it is not serialized and seen by apps. */
        cert = NULL;
        while ((cert = CertEnumCertificatesInStore( new, cert )))
            CertSetCertificateContextProperty( cert, CERT_FIRST_USER_PROP_ID, 0, NULL );
        check_and_store_certs( cached, new, store );
    }
 
    CertCloseStore( new, 0 );
    TRACE( "existing %u, new %u.\n", existing_count, new_count );
}

Referenced by create_root_store().

trust_status_to_str()

static const char * trust_status_to_str ( DWORD  status )

static

Definition at line 34 of file rootstore.c.

{
    static const struct
    {
        DWORD flag;
        char text[32];
    }
    messages[] =
    {
        { CERT_TRUST_IS_NOT_TIME_VALID, "expired" },
        { CERT_TRUST_IS_NOT_TIME_NESTED, "bad time nesting" },
        { CERT_TRUST_IS_REVOKED, "revoked" },
        { CERT_TRUST_IS_NOT_SIGNATURE_VALID, "bad signature" },
        { CERT_TRUST_IS_NOT_VALID_FOR_USAGE, "bad usage" },
        { CERT_TRUST_IS_UNTRUSTED_ROOT, "untrusted root" },
        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, "unknown revocation status" },
        { CERT_TRUST_IS_CYCLIC, "cyclic chain" },
        { CERT_TRUST_INVALID_EXTENSION, "unsupported critical extension" },
        { CERT_TRUST_INVALID_POLICY_CONSTRAINTS, "bad policy" },
        { CERT_TRUST_INVALID_BASIC_CONSTRAINTS, "bad basic constraints" },
        { CERT_TRUST_INVALID_NAME_CONSTRAINTS, "bad name constraints" },
        { CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT, "unsupported name constraint" },
        { CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT, "undefined name constraint" },
        { CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT, "disallowed name constraint" },
        { CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT, "excluded name constraint" },
        { CERT_TRUST_IS_OFFLINE_REVOCATION, "revocation server offline" },
        { CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY, "no issuance policy" },
    };
    static char buf[1024];
    int i, pos = 0;
 
    for (i = 0; i < ARRAY_SIZE(messages); i++)
    {
        if (status & messages[i].flag)
            pos += sprintf(buf + pos, "\n\t%s", messages[i].text);
    }
 
    return buf;
}

Referenced by check_and_store_certs().

WINE_DEFAULT_DEBUG_CHANNEL()

WINE_DEFAULT_DEBUG_CHANNEL

(

crypt

)

Variable Documentation

authenticode

const BYTE authenticode[]

static

Definition at line 171 of file rootstore.c.

msRootCerts

const struct CONST_BLOB msRootCerts[]

static

Initial value:

= {
    { authenticode, sizeof(authenticode) },
    { rootauthority, sizeof(rootauthority) },
    { rootcertauthority, sizeof(rootcertauthority) },
    { rootcertauthority2010, sizeof(rootcertauthority2010) },
    { rootcertauthority2011, sizeof(rootcertauthority2011) },
}

Referenced by add_ms_root_certs().

rootauthority

const BYTE rootauthority[]

static

Definition at line 234 of file rootstore.c.

rootcertauthority

const BYTE rootcertauthority[]

static

Definition at line 301 of file rootstore.c.

rootcertauthority2010

const BYTE rootcertauthority2010[]

static

Definition at line 392 of file rootstore.c.

rootcertauthority2011

const BYTE rootcertauthority2011[]

static

Definition at line 489 of file rootstore.c.