Imort system certificates in crypt32 at Wine
Donat Enikeev
donat at enikeev.net
Wed Oct 26 14:29:38 CDT 2016
Hi Jacek,
Following your proposal over the previous patch, that it should be a step forward to the implementation closer to the original behaviour,
I've prepared different version of patch:
1. sligthly changed existing functions saving certs to the registry (to be able to pass the REG_OPTION_VOLATILE flag)
2. replaced the RootStore entity and everything related with new CRYPT_ImportSystemRootCertsToReg() that does actual import (once) into REG_OPTION_VOLATILE keys
3. start calling this import whenever an application is reaching necessity to work with HKLM\Root certs store as previously, however the latter call could be moved to the DllMain
Does it look better?
P.s. The CiscoIP and certmgr apps are working without problems, registry keys of system certs are not saved with the wine unload as expected; though tests are not ready yet
Best,
Donnie
Signed-off-by: Donat Enikeev <donat at enikeev.net>
---
dlls/crypt32/crypt32_private.h | 6 +-
dlls/crypt32/main.c | 3 +-
dlls/crypt32/regstore.c | 10 ++--
dlls/crypt32/rootstore.c | 121 +++++++++++++----------------------------
dlls/crypt32/store.c | 13 ++---
5 files changed, 53 insertions(+), 100 deletions(-)
diff --git a/dlls/crypt32/crypt32_private.h b/dlls/crypt32/crypt32_private.h
index ad4a827..8d415dc 100644
--- a/dlls/crypt32/crypt32_private.h
+++ b/dlls/crypt32/crypt32_private.h
@@ -336,7 +336,11 @@ WINECRYPT_CERTSTORE *CRYPT_FileNameOpenStoreA(HCRYPTPROV hCryptProv,
DWORD dwFlags, const void *pvPara) DECLSPEC_HIDDEN;
WINECRYPT_CERTSTORE *CRYPT_FileNameOpenStoreW(HCRYPTPROV hCryptProv,
DWORD dwFlags, const void *pvPara) DECLSPEC_HIDDEN;
-WINECRYPT_CERTSTORE *CRYPT_RootOpenStore(HCRYPTPROV hCryptProv, DWORD dwFlags) DECLSPEC_HIDDEN;
+
+BOOL CRYPT_ImportSystemRootCertsToReg(void) DECLSPEC_HIDDEN;
+BOOL CRYPT_SerializeContextsToReg(HKEY key, DWORD dwFlags, const WINE_CONTEXT_INTERFACE *contextInterface,
+ HCERTSTORE memStore) DECLSPEC_HIDDEN;
+
BOOL CRYPT_IsCertificateSelfSigned(PCCERT_CONTEXT cert) DECLSPEC_HIDDEN;
/* Allocates and initializes a certificate chain engine, but without creating
diff --git a/dlls/crypt32/main.c b/dlls/crypt32/main.c
index 241a1d9..cf6c66a 100644
--- a/dlls/crypt32/main.c
+++ b/dlls/crypt32/main.c
@@ -49,7 +49,6 @@ BOOL WINAPI DllMain(HINSTANCE hInst, DWORD fdwReason, PVOID pvReserved)
if (pvReserved) break;
crypt_oid_free();
crypt_sip_free();
- root_store_free();
default_chain_engine_free();
if (hDefProv) CryptReleaseContext(hDefProv, 0);
break;
@@ -194,7 +193,7 @@ HCRYPTPROV WINAPI I_CryptGetDefaultCryptProv(DWORD reserved)
BOOL WINAPI I_CryptReadTrustedPublisherDWORDValueFromRegistry(LPCWSTR name,
DWORD *value)
{
- static const WCHAR safer[] = {
+ static const WCHAR safer[] = {
'S','o','f','t','w','a','r','e','\\','P','o','l','i','c','i','e','s','\\',
'M','i','c','r','o','s','o','f','t','\\','S','y','s','t','e','m',
'C','e','r','t','i','f','i','c','a','t','e','s','\\',
diff --git a/dlls/crypt32/regstore.c b/dlls/crypt32/regstore.c
index b79387f..750f315 100644
--- a/dlls/crypt32/regstore.c
+++ b/dlls/crypt32/regstore.c
@@ -179,7 +179,7 @@ static void CRYPT_RegReadFromReg(HKEY key, HCERTSTORE store)
}
/* Hash is assumed to be 20 bytes in length (a SHA-1 hash) */
-static BOOL CRYPT_WriteSerializedToReg(HKEY key, const BYTE *hash, const BYTE *buf,
+static BOOL CRYPT_WriteSerializedToReg(HKEY key, DWORD dwFlags, const BYTE *hash, const BYTE *buf,
DWORD len)
{
WCHAR asciiHash[20 * 2 + 1];
@@ -188,7 +188,7 @@ static BOOL CRYPT_WriteSerializedToReg(HKEY key, const BYTE *hash, const BYTE *b
BOOL ret;
CRYPT_HashToStr(hash, asciiHash);
- rc = RegCreateKeyExW(key, asciiHash, 0, NULL, 0, KEY_ALL_ACCESS, NULL,
+ rc = RegCreateKeyExW(key, asciiHash, 0, NULL, dwFlags, KEY_ALL_ACCESS, NULL,
&subKey, NULL);
if (!rc)
{
@@ -205,7 +205,7 @@ static BOOL CRYPT_WriteSerializedToReg(HKEY key, const BYTE *hash, const BYTE *b
return ret;
}
-static BOOL CRYPT_SerializeContextsToReg(HKEY key,
+BOOL CRYPT_SerializeContextsToReg(HKEY key, DWORD dwFlags,
const WINE_CONTEXT_INTERFACE *contextInterface, HCERTSTORE memStore)
{
const void *context = NULL;
@@ -232,7 +232,7 @@ static BOOL CRYPT_SerializeContextsToReg(HKEY key,
{
ret = contextInterface->serialize(context, 0, buf, &size);
if (ret)
- ret = CRYPT_WriteSerializedToReg(key, hash, buf, size);
+ ret = CRYPT_WriteSerializedToReg(key, dwFlags, hash, buf, size);
}
CryptMemFree(buf);
}
@@ -287,7 +287,7 @@ static BOOL CRYPT_RegWriteToReg(WINE_REGSTOREINFO *store)
}
LeaveCriticalSection(&store->cs);
}
- ret = CRYPT_SerializeContextsToReg(key, interfaces[i],
+ ret = CRYPT_SerializeContextsToReg(key, 0, interfaces[i],
store->memStore);
RegCloseKey(key);
}
diff --git a/dlls/crypt32/rootstore.c b/dlls/crypt32/rootstore.c
index 5cee235..9ad330c 100644
--- a/dlls/crypt32/rootstore.c
+++ b/dlls/crypt32/rootstore.c
@@ -435,53 +435,6 @@ static BOOL import_certs_from_path(LPCSTR path, HCERTSTORE store,
return ret;
}
-static BOOL WINAPI CRYPT_RootWriteCert(HCERTSTORE hCertStore,
- PCCERT_CONTEXT cert, DWORD dwFlags)
-{
- /* The root store can't have certs added */
- return FALSE;
-}
-
-static BOOL WINAPI CRYPT_RootDeleteCert(HCERTSTORE hCertStore,
- PCCERT_CONTEXT cert, DWORD dwFlags)
-{
- /* The root store can't have certs deleted */
- return FALSE;
-}
-
-static BOOL WINAPI CRYPT_RootWriteCRL(HCERTSTORE hCertStore,
- PCCRL_CONTEXT crl, DWORD dwFlags)
-{
- /* The root store can have CRLs added. At worst, a malicious application
- * can DoS itself, as the changes aren't persisted in any way.
- */
- return TRUE;
-}
-
-static BOOL WINAPI CRYPT_RootDeleteCRL(HCERTSTORE hCertStore,
- PCCRL_CONTEXT crl, DWORD dwFlags)
-{
- /* The root store can't have CRLs deleted */
- return FALSE;
-}
-
-static void *rootProvFuncs[] = {
- NULL, /* CERT_STORE_PROV_CLOSE_FUNC */
- NULL, /* CERT_STORE_PROV_READ_CERT_FUNC */
- CRYPT_RootWriteCert,
- CRYPT_RootDeleteCert,
- NULL, /* CERT_STORE_PROV_SET_CERT_PROPERTY_FUNC */
- NULL, /* CERT_STORE_PROV_READ_CRL_FUNC */
- CRYPT_RootWriteCRL,
- CRYPT_RootDeleteCRL,
- NULL, /* CERT_STORE_PROV_SET_CRL_PROPERTY_FUNC */
- NULL, /* CERT_STORE_PROV_READ_CTL_FUNC */
- NULL, /* CERT_STORE_PROV_WRITE_CTL_FUNC */
- NULL, /* CERT_STORE_PROV_DELETE_CTL_FUNC */
- NULL, /* CERT_STORE_PROV_SET_CTL_PROPERTY_FUNC */
- NULL, /* CERT_STORE_PROV_CONTROL_FUNC */
-};
-
static const char * const CRYPT_knownLocations[] = {
"/etc/ssl/certs/ca-certificates.crt",
"/etc/ssl/certs",
@@ -492,6 +445,7 @@ static const char * const CRYPT_knownLocations[] = {
"/etc/security/cacerts", /* Android */
};
+/* This cert had been expired on 31.12.1999, shoult we delete it ? */
static const BYTE authenticode[] = {
0x30,0x82,0x03,0xd6,0x30,0x82,0x02,0xbe,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x04,0x05,0x00,0x30,
@@ -555,6 +509,10 @@ static const BYTE authenticode[] = {
0x60,0xdc,0x82,0x1f,0xfb,0xce,0x74,0x06,0x7e,0xd6,0xf1,0xac,0x19,0x6a,0x4f,0x74,
0x5c,0xc5,0x15,0x66,0x31,0x6c,0xc1,0x62,0x71,0x91,0x0f,0x59,0x5b,0x7d,0x2a,0x82,
0x1a,0xdf,0xb1,0xb4,0xd8,0x1d,0x37,0xde,0x0d,0x0f };
+
+/* Microsoft Root Authority
+ * Valid to 31.12.2020, please consider update after this date
+ */
static const BYTE rootauthority[] = {
0x30,0x82,0x04,0x12,0x30,0x82,0x02,0xfa,0xa0,0x03,0x02,0x01,0x02,0x02,0x0f,0x00,
0xc1,0x00,0x8b,0x3c,0x3c,0x88,0x11,0xd1,0x3e,0xf6,0x63,0xec,0xdf,0x40,0x30,0x0d,
@@ -622,6 +580,10 @@ static const BYTE rootauthority[] = {
0x04,0xe4,0xa8,0x45,0x04,0xc8,0x5a,0x33,0x38,0x6e,0x4d,0x1c,0x0d,0x62,0xb7,0x0a,
0xa2,0x8c,0xd3,0xd5,0x54,0x3f,0x46,0xcd,0x1c,0x55,0xa6,0x70,0xdb,0x12,0x3a,0x87,
0x93,0x75,0x9f,0xa7,0xd2,0xa0 };
+
+/* Microsoft Root Authority Certificate
+ * Valid to 09.05.2021, please consider update after this date
+ */
static const BYTE rootcertauthority[] = {
0x30,0x82,0x05,0x99,0x30,0x82,0x03,0x81,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,0x79,
0xad,0x16,0xa1,0x4a,0xa0,0xa5,0xad,0x4c,0x73,0x58,0xf4,0x07,0x13,0x2e,0x65,0x30,
@@ -790,55 +752,48 @@ static void read_trusted_roots_from_known_locations(HCERTSTORE store)
static HCERTSTORE create_root_store(void)
{
- HCERTSTORE root = NULL;
HCERTSTORE memStore = CertOpenStore(CERT_STORE_PROV_MEMORY,
X509_ASN_ENCODING, 0, CERT_STORE_CREATE_NEW_FLAG, NULL);
if (memStore)
{
- CERT_STORE_PROV_INFO provInfo = {
- sizeof(CERT_STORE_PROV_INFO),
- sizeof(rootProvFuncs) / sizeof(rootProvFuncs[0]),
- rootProvFuncs,
- NULL,
- 0,
- NULL
- };
-
read_trusted_roots_from_known_locations(memStore);
add_ms_root_certs(memStore);
- root = CRYPT_ProvCreateStore(0, memStore, &provInfo);
}
- TRACE("returning %p\n", root);
- return root;
+ TRACE("returning %p\n", memStore);
+ return memStore;
}
-static WINECRYPT_CERTSTORE *CRYPT_rootStore;
+static LONG root_certs_imported = 0;
-WINECRYPT_CERTSTORE *CRYPT_RootOpenStore(HCRYPTPROV hCryptProv, DWORD dwFlags)
+static const WCHAR certs_root_path[] =
+ {'S','o','f','t','w','a','r','e','\\','M','i','c','r','o','s','o','f','t','\\',
+ 'S','y','s','t','e','m','C','e','r','t','i','f','i','c','a','t','e','s','\\',
+ 'R','o','o','t','\\', 'C','e','r','t','i','f','i','c','a','t','e','s', 0};
+
+BOOL CRYPT_ImportSystemRootCertsToReg(void)
{
- TRACE("(%ld, %08x)\n", hCryptProv, dwFlags);
+ HCERTSTORE store = NULL;
+ HKEY key;
+ BOOL ret = FALSE;
+ LONG rc;
- if (dwFlags & CERT_STORE_DELETE_FLAG)
- {
- WARN("root store can't be deleted\n");
- SetLastError(ERROR_ACCESS_DENIED);
- return NULL;
- }
- if (!CRYPT_rootStore)
- {
- HCERTSTORE root = create_root_store();
+ TRACE("\n");
+
+ if (root_certs_imported) return FALSE;
- InterlockedCompareExchangePointer((PVOID *)&CRYPT_rootStore, root,
- NULL);
- if (CRYPT_rootStore != root)
- CertCloseStore(root, 0);
+ store = create_root_store();
+ if (!store) return FALSE;
+
+ rc = RegCreateKeyExW(HKEY_LOCAL_MACHINE, certs_root_path, 0, NULL, 0, KEY_ALL_ACCESS, NULL, &key, 0);
+ if (!rc)
+ {
+ ret = CRYPT_SerializeContextsToReg(key, REG_OPTION_VOLATILE, pCertInterface, store);
+ if (ret)
+ InterlockedIncrement(&root_certs_imported);
+ RegCloseKey(key);
}
- CRYPT_rootStore->vtbl->addref(CRYPT_rootStore);
- return CRYPT_rootStore;
-}
-void root_store_free(void)
-{
- CertCloseStore(CRYPT_rootStore, 0);
-}
+ CertCloseStore(store, 0);
+ return ret;
+}
\ No newline at end of file
diff --git a/dlls/crypt32/store.c b/dlls/crypt32/store.c
index 356712b..9e1980e 100644
--- a/dlls/crypt32/store.c
+++ b/dlls/crypt32/store.c
@@ -424,21 +424,15 @@ static WINECRYPT_CERTSTORE *CRYPT_SysRegOpenStoreW(HCRYPTPROV hCryptProv,
SetLastError(E_INVALIDARG);
return NULL;
}
- /* FIXME: In Windows, the root store (even the current user location) is
- * protected: adding to it or removing from it present a user interface,
- * and the keys are owned by the system process, not the current user.
- * Wine's registry doesn't implement access controls, so a similar
- * mechanism isn't possible yet.
- */
- if ((dwFlags & CERT_SYSTEM_STORE_LOCATION_MASK) ==
- CERT_SYSTEM_STORE_LOCAL_MACHINE && !lstrcmpiW(storeName, rootW))
- return CRYPT_RootOpenStore(hCryptProv, dwFlags);
switch (dwFlags & CERT_SYSTEM_STORE_LOCATION_MASK)
{
case CERT_SYSTEM_STORE_LOCAL_MACHINE:
root = HKEY_LOCAL_MACHINE;
base = CERT_LOCAL_MACHINE_SYSTEM_STORE_REGPATH;
+ /* If the HKLM\Root certs are requested, expressing system certs into the registry */
+ if (!lstrcmpiW(storeName, rootW))
+ CRYPT_ImportSystemRootCertsToReg();
break;
case CERT_SYSTEM_STORE_CURRENT_USER:
root = HKEY_CURRENT_USER;
@@ -491,6 +485,7 @@ static WINECRYPT_CERTSTORE *CRYPT_SysRegOpenStoreW(HCRYPTPROV hCryptProv,
KEY_ALL_ACCESS;
wsprintfW(storePath, fmt, base, storeName);
+
if (dwFlags & CERT_STORE_OPEN_EXISTING_FLAG)
rc = RegOpenKeyExW(root, storePath, 0, sam, &key);
else
--
2.7.4
More information about the wine-devel
mailing list