wincerts.c 6.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172
  1. /********************************************************************
  2. * *
  3. * THIS FILE IS PART OF THE libopusfile SOFTWARE CODEC SOURCE CODE. *
  4. * USE, DISTRIBUTION AND REPRODUCTION OF THIS LIBRARY SOURCE IS *
  5. * GOVERNED BY A BSD-STYLE SOURCE LICENSE INCLUDED WITH THIS SOURCE *
  6. * IN 'COPYING'. PLEASE READ THESE TERMS BEFORE DISTRIBUTING. *
  7. * *
  8. * THE libopusfile SOURCE CODE IS (C) COPYRIGHT 2013 *
  9. * by the Xiph.Org Foundation and contributors http://www.xiph.org/ *
  10. * *
  11. ********************************************************************/
  12. /*This should really be part of OpenSSL, but there's been a patch [1] sitting
  13. in their bugtracker for over two years that implements this, without any
  14. action, so I'm giving up and re-implementing it locally.
  15. [1] <http://rt.openssl.org/Ticket/Display.html?id=2158>*/
  16. #ifdef HAVE_CONFIG_H
  17. #include "config.h"
  18. #endif
  19. #include "internal.h"
  20. #if defined(OP_ENABLE_HTTP)&&defined(_WIN32)
  21. /*You must include windows.h before wincrypt.h and x509.h.*/
  22. # define WIN32_LEAN_AND_MEAN
  23. # define WIN32_EXTRA_LEAN
  24. # include <windows.h>
  25. /*You must include wincrypt.h before x509.h, too, or X509_NAME doesn't get
  26. defined properly.*/
  27. # include <wincrypt.h>
  28. # include <openssl/ssl.h>
  29. # include <openssl/err.h>
  30. # include <openssl/x509.h>
  31. static int op_capi_new(X509_LOOKUP *_lu){
  32. HCERTSTORE h_store;
  33. h_store=CertOpenStore(CERT_STORE_PROV_SYSTEM_A,0,0,
  34. CERT_STORE_OPEN_EXISTING_FLAG|CERT_STORE_READONLY_FLAG|
  35. CERT_SYSTEM_STORE_CURRENT_USER|CERT_STORE_SHARE_CONTEXT_FLAG,"ROOT");
  36. if(h_store!=NULL){
  37. _lu->method_data=(char *)h_store;
  38. return 1;
  39. }
  40. return 0;
  41. }
  42. static void op_capi_free(X509_LOOKUP *_lu){
  43. HCERTSTORE h_store;
  44. h_store=(HCERTSTORE)_lu->method_data;
  45. # if defined(OP_ENABLE_ASSERTIONS)
  46. OP_ALWAYS_TRUE(CertCloseStore(h_store,CERT_CLOSE_STORE_CHECK_FLAG));
  47. # else
  48. CertCloseStore(h_store,0);
  49. # endif
  50. }
  51. static int op_capi_retrieve_by_subject(X509_LOOKUP *_lu,int _type,
  52. X509_NAME *_name,X509_OBJECT *_ret){
  53. X509_OBJECT *obj;
  54. CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
  55. obj=X509_OBJECT_retrieve_by_subject(_lu->store_ctx->objs,_type,_name);
  56. CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
  57. if(obj!=NULL){
  58. _ret->type=obj->type;
  59. memcpy(&_ret->data,&obj->data,sizeof(_ret->data));
  60. return 1;
  61. }
  62. return 0;
  63. }
  64. static int op_capi_get_by_subject(X509_LOOKUP *_lu,int _type,X509_NAME *_name,
  65. X509_OBJECT *_ret){
  66. HCERTSTORE h_store;
  67. if(_name==NULL)return 0;
  68. if(_name->bytes==NULL||_name->bytes->length<=0||_name->modified){
  69. if(i2d_X509_NAME(_name,NULL)<0)return 0;
  70. OP_ASSERT(_name->bytes->length>0);
  71. }
  72. h_store=(HCERTSTORE)_lu->method_data;
  73. switch(_type){
  74. case X509_LU_X509:{
  75. CERT_NAME_BLOB find_para;
  76. PCCERT_CONTEXT cert;
  77. X509 *x;
  78. int ret;
  79. /*Although X509_NAME contains a canon_enc field, that "canonical" [1]
  80. encoding was just made up by OpenSSL.
  81. It doesn't correspond to any actual standard, and since it drops the
  82. initial sequence header, won't be recognized by the Crypto API.
  83. The assumption here is that CertFindCertificateInStore() will allow any
  84. appropriate variations in the encoding when it does its comparison.
  85. This is, however, emphatically not true under Wine, which just compares
  86. the encodings with memcmp().
  87. Most of the time things work anyway, though, and there isn't really
  88. anything we can do to make the situation better.
  89. [1] A "canonical form" is defined as the one where, if you locked 10
  90. mathematicians in a room and asked them to come up with a
  91. representation for something, it's the answer that 9 of them would
  92. give you back.
  93. I don't think OpenSSL's encoding qualifies.*/
  94. find_para.cbData=_name->bytes->length;
  95. find_para.pbData=(unsigned char *)_name->bytes->data;
  96. cert=CertFindCertificateInStore(h_store,X509_ASN_ENCODING,0,
  97. CERT_FIND_SUBJECT_NAME,&find_para,NULL);
  98. if(cert==NULL)return 0;
  99. x=d2i_X509(NULL,(const unsigned char **)&cert->pbCertEncoded,
  100. cert->cbCertEncoded);
  101. CertFreeCertificateContext(cert);
  102. if(x==NULL)return 0;
  103. ret=X509_STORE_add_cert(_lu->store_ctx,x);
  104. X509_free(x);
  105. if(ret)return op_capi_retrieve_by_subject(_lu,_type,_name,_ret);
  106. }break;
  107. case X509_LU_CRL:{
  108. CERT_INFO cert_info;
  109. CERT_CONTEXT find_para;
  110. PCCRL_CONTEXT crl;
  111. X509_CRL *x;
  112. int ret;
  113. ret=op_capi_retrieve_by_subject(_lu,_type,_name,_ret);
  114. if(ret>0)return ret;
  115. memset(&cert_info,0,sizeof(cert_info));
  116. cert_info.Issuer.cbData=_name->bytes->length;
  117. cert_info.Issuer.pbData=(unsigned char *)_name->bytes->data;
  118. memset(&find_para,0,sizeof(find_para));
  119. find_para.pCertInfo=&cert_info;
  120. crl=CertFindCRLInStore(h_store,0,0,CRL_FIND_ISSUED_BY,&find_para,NULL);
  121. if(crl==NULL)return 0;
  122. x=d2i_X509_CRL(NULL,(const unsigned char **)&crl->pbCrlEncoded,
  123. crl->cbCrlEncoded);
  124. CertFreeCRLContext(crl);
  125. if(x==NULL)return 0;
  126. ret=X509_STORE_add_crl(_lu->store_ctx,x);
  127. X509_CRL_free(x);
  128. if(ret)return op_capi_retrieve_by_subject(_lu,_type,_name,_ret);
  129. }break;
  130. }
  131. return 0;
  132. }
  133. /*This is not const because OpenSSL doesn't allow it, even though it won't
  134. write to it.*/
  135. static X509_LOOKUP_METHOD X509_LOOKUP_CAPI={
  136. "Load Crypto API store into cache",
  137. op_capi_new,
  138. op_capi_free,
  139. NULL,
  140. NULL,
  141. NULL,
  142. op_capi_get_by_subject,
  143. NULL,
  144. NULL,
  145. NULL
  146. };
  147. int SSL_CTX_set_default_verify_paths_win32(SSL_CTX *_ssl_ctx){
  148. X509_STORE *store;
  149. X509_LOOKUP *lu;
  150. /*We intentionally do not add the normal default paths, as they are usually
  151. wrong, and are just asking to be used as an exploit vector.*/
  152. store=SSL_CTX_get_cert_store(_ssl_ctx);
  153. OP_ASSERT(store!=NULL);
  154. lu=X509_STORE_add_lookup(store,&X509_LOOKUP_CAPI);
  155. if(lu==NULL)return 0;
  156. ERR_clear_error();
  157. return 1;
  158. }
  159. #endif