| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/test_root_certs.h" | 5 #include "net/cert/test_root_certs.h" |
| 6 | 6 |
| 7 #include <windows.h> | 7 #include <windows.h> |
| 8 #include <wincrypt.h> | 8 #include <wincrypt.h> |
| 9 | 9 |
| 10 #include "base/basictypes.h" | 10 #include "base/basictypes.h" |
| (...skipping 28 matching lines...) Expand all Loading... |
| 39 // I_CertDllOpenSystemStoreProvW function. | 39 // I_CertDllOpenSystemStoreProvW function. |
| 40 PFN_CERT_DLL_OPEN_STORE_PROV_FUNC original_function; | 40 PFN_CERT_DLL_OPEN_STORE_PROV_FUNC original_function; |
| 41 | 41 |
| 42 // The handle that CryptoAPI uses to ensure the DLL implementing | 42 // The handle that CryptoAPI uses to ensure the DLL implementing |
| 43 // |original_function| remains loaded in memory. | 43 // |original_function| remains loaded in memory. |
| 44 HCRYPTOIDFUNCADDR original_handle; | 44 HCRYPTOIDFUNCADDR original_handle; |
| 45 | 45 |
| 46 private: | 46 private: |
| 47 friend struct base::DefaultLazyInstanceTraits<CryptoAPIInjector>; | 47 friend struct base::DefaultLazyInstanceTraits<CryptoAPIInjector>; |
| 48 | 48 |
| 49 CryptoAPIInjector() | 49 CryptoAPIInjector() : original_function(NULL), original_handle(NULL) { |
| 50 : original_function(NULL), | |
| 51 original_handle(NULL) { | |
| 52 HCRYPTOIDFUNCSET registered_functions = | 50 HCRYPTOIDFUNCSET registered_functions = |
| 53 CryptInitOIDFunctionSet(CRYPT_OID_OPEN_STORE_PROV_FUNC, 0); | 51 CryptInitOIDFunctionSet(CRYPT_OID_OPEN_STORE_PROV_FUNC, 0); |
| 54 | 52 |
| 55 // Preserve the original handler function in |original_function|. If other | 53 // Preserve the original handler function in |original_function|. If other |
| 56 // functions are overridden, they will also need to be preserved. | 54 // functions are overridden, they will also need to be preserved. |
| 57 BOOL ok = CryptGetOIDFunctionAddress( | 55 BOOL ok = |
| 58 registered_functions, 0, CERT_STORE_PROV_SYSTEM_W, 0, | 56 CryptGetOIDFunctionAddress(registered_functions, |
| 59 reinterpret_cast<void**>(&original_function), &original_handle); | 57 0, |
| 58 CERT_STORE_PROV_SYSTEM_W, |
| 59 0, |
| 60 reinterpret_cast<void**>(&original_function), |
| 61 &original_handle); |
| 60 DCHECK(ok); | 62 DCHECK(ok); |
| 61 | 63 |
| 62 // For now, intercept only the numeric form of the system store | 64 // For now, intercept only the numeric form of the system store |
| 63 // function, CERT_STORE_PROV_SYSTEM_W (0x0A), which is what Crypt32 | 65 // function, CERT_STORE_PROV_SYSTEM_W (0x0A), which is what Crypt32 |
| 64 // functionality uses exclusively. Depending on the machine that tests | 66 // functionality uses exclusively. Depending on the machine that tests |
| 65 // are being run on, it may prove necessary to also intercept | 67 // are being run on, it may prove necessary to also intercept |
| 66 // sz_CERT_STORE_PROV_SYSTEM_[A/W] and CERT_STORE_PROV_SYSTEM_A, based | 68 // sz_CERT_STORE_PROV_SYSTEM_[A/W] and CERT_STORE_PROV_SYSTEM_A, based |
| 67 // on whether or not any third-party CryptoAPI modules have been | 69 // on whether or not any third-party CryptoAPI modules have been |
| 68 // installed. | 70 // installed. |
| 69 const CRYPT_OID_FUNC_ENTRY kFunctionToIntercept = | 71 const CRYPT_OID_FUNC_ENTRY kFunctionToIntercept = {CERT_STORE_PROV_SYSTEM_W, |
| 70 { CERT_STORE_PROV_SYSTEM_W, &InterceptedOpenStoreW }; | 72 &InterceptedOpenStoreW}; |
| 71 | 73 |
| 72 // Inject kFunctionToIntercept at the front of the linked list that | 74 // Inject kFunctionToIntercept at the front of the linked list that |
| 73 // crypt32 uses when CertOpenStore is called, replacing the existing | 75 // crypt32 uses when CertOpenStore is called, replacing the existing |
| 74 // registered function. | 76 // registered function. |
| 75 ok = CryptInstallOIDFunctionAddress(NULL, 0, | 77 ok = CryptInstallOIDFunctionAddress(NULL, |
| 76 CRYPT_OID_OPEN_STORE_PROV_FUNC, 1, | 78 0, |
| 79 CRYPT_OID_OPEN_STORE_PROV_FUNC, |
| 80 1, |
| 77 &kFunctionToIntercept, | 81 &kFunctionToIntercept, |
| 78 CRYPT_INSTALL_OID_FUNC_BEFORE_FLAG); | 82 CRYPT_INSTALL_OID_FUNC_BEFORE_FLAG); |
| 79 DCHECK(ok); | 83 DCHECK(ok); |
| 80 } | 84 } |
| 81 | 85 |
| 82 // This is never called, because this object is intentionally leaked. | 86 // This is never called, because this object is intentionally leaked. |
| 83 // Certificate verification happens on a non-joinable worker thread, which | 87 // Certificate verification happens on a non-joinable worker thread, which |
| 84 // may still be running when ~AtExitManager is called, so the LazyInstance | 88 // may still be running when ~AtExitManager is called, so the LazyInstance |
| 85 // must be leaky. | 89 // must be leaky. |
| 86 ~CryptoAPIInjector() { | 90 ~CryptoAPIInjector() { |
| 87 original_function = NULL; | 91 original_function = NULL; |
| 88 CryptFreeOIDFunctionAddress(original_handle, NULL); | 92 CryptFreeOIDFunctionAddress(original_handle, NULL); |
| 89 } | 93 } |
| 90 }; | 94 }; |
| 91 | 95 |
| 92 base::LazyInstance<CryptoAPIInjector>::Leaky | 96 base::LazyInstance<CryptoAPIInjector>::Leaky g_capi_injector = |
| 93 g_capi_injector = LAZY_INSTANCE_INITIALIZER; | 97 LAZY_INSTANCE_INITIALIZER; |
| 94 | 98 |
| 95 BOOL WINAPI InterceptedOpenStoreW(LPCSTR store_provider, | 99 BOOL WINAPI InterceptedOpenStoreW(LPCSTR store_provider, |
| 96 DWORD encoding, | 100 DWORD encoding, |
| 97 HCRYPTPROV crypt_provider, | 101 HCRYPTPROV crypt_provider, |
| 98 DWORD flags, | 102 DWORD flags, |
| 99 const void* store_name, | 103 const void* store_name, |
| 100 HCERTSTORE memory_store, | 104 HCERTSTORE memory_store, |
| 101 PCERT_STORE_PROV_INFO store_info) { | 105 PCERT_STORE_PROV_INFO store_info) { |
| 102 // If the high word is all zeroes, then |store_provider| is a numeric ID. | 106 // If the high word is all zeroes, then |store_provider| is a numeric ID. |
| 103 // Otherwise, it's a pointer to a null-terminated ASCII string. See the | 107 // Otherwise, it's a pointer to a null-terminated ASCII string. See the |
| 104 // documentation for CryptGetOIDFunctionAddress for more information. | 108 // documentation for CryptGetOIDFunctionAddress for more information. |
| 105 uint32 store_as_uint = reinterpret_cast<uint32>(store_provider); | 109 uint32 store_as_uint = reinterpret_cast<uint32>(store_provider); |
| 106 if (store_as_uint > 0xFFFF || store_provider != CERT_STORE_PROV_SYSTEM_W || | 110 if (store_as_uint > 0xFFFF || store_provider != CERT_STORE_PROV_SYSTEM_W || |
| 107 !g_capi_injector.Get().original_function) | 111 !g_capi_injector.Get().original_function) |
| 108 return FALSE; | 112 return FALSE; |
| 109 | 113 |
| 110 BOOL ok = g_capi_injector.Get().original_function(store_provider, encoding, | 114 BOOL ok = g_capi_injector.Get().original_function(store_provider, |
| 111 crypt_provider, flags, | 115 encoding, |
| 112 store_name, memory_store, | 116 crypt_provider, |
| 117 flags, |
| 118 store_name, |
| 119 memory_store, |
| 113 store_info); | 120 store_info); |
| 114 // Only the Root store should have certificates injected. If | 121 // Only the Root store should have certificates injected. If |
| 115 // CERT_SYSTEM_STORE_RELOCATE_FLAG is set, then |store_name| points to a | 122 // CERT_SYSTEM_STORE_RELOCATE_FLAG is set, then |store_name| points to a |
| 116 // CERT_SYSTEM_STORE_RELOCATE_PARA structure, rather than a | 123 // CERT_SYSTEM_STORE_RELOCATE_PARA structure, rather than a |
| 117 // NULL-terminated wide string, so check before making a string | 124 // NULL-terminated wide string, so check before making a string |
| 118 // comparison. | 125 // comparison. |
| 119 if (!ok || TestRootCerts::GetInstance()->IsEmpty() || | 126 if (!ok || TestRootCerts::GetInstance()->IsEmpty() || |
| 120 (flags & CERT_SYSTEM_STORE_RELOCATE_FLAG) || | 127 (flags & CERT_SYSTEM_STORE_RELOCATE_FLAG) || |
| 121 lstrcmpiW(reinterpret_cast<LPCWSTR>(store_name), L"root")) | 128 lstrcmpiW(reinterpret_cast<LPCWSTR>(store_name), L"root")) |
| 122 return ok; | 129 return ok; |
| (...skipping 15 matching lines...) Expand all Loading... |
| 138 } | 145 } |
| 139 | 146 |
| 140 } // namespace | 147 } // namespace |
| 141 | 148 |
| 142 bool TestRootCerts::Add(X509Certificate* certificate) { | 149 bool TestRootCerts::Add(X509Certificate* certificate) { |
| 143 // Ensure that the default CryptoAPI functionality has been intercepted. | 150 // Ensure that the default CryptoAPI functionality has been intercepted. |
| 144 // If a test certificate is never added, then no interception should | 151 // If a test certificate is never added, then no interception should |
| 145 // happen. | 152 // happen. |
| 146 g_capi_injector.Get(); | 153 g_capi_injector.Get(); |
| 147 | 154 |
| 148 BOOL ok = CertAddCertificateContextToStore( | 155 BOOL ok = CertAddCertificateContextToStore(temporary_roots_, |
| 149 temporary_roots_, certificate->os_cert_handle(), | 156 certificate->os_cert_handle(), |
| 150 CERT_STORE_ADD_NEW, NULL); | 157 CERT_STORE_ADD_NEW, |
| 158 NULL); |
| 151 if (!ok) { | 159 if (!ok) { |
| 152 // If the certificate is already added, return successfully. | 160 // If the certificate is already added, return successfully. |
| 153 return GetLastError() == CRYPT_E_EXISTS; | 161 return GetLastError() == CRYPT_E_EXISTS; |
| 154 } | 162 } |
| 155 | 163 |
| 156 empty_ = false; | 164 empty_ = false; |
| 157 return true; | 165 return true; |
| 158 } | 166 } |
| 159 | 167 |
| 160 void TestRootCerts::Clear() { | 168 void TestRootCerts::Clear() { |
| 161 empty_ = true; | 169 empty_ = true; |
| 162 | 170 |
| 163 PCCERT_CONTEXT prev_cert = NULL; | 171 PCCERT_CONTEXT prev_cert = NULL; |
| 164 while (prev_cert = CertEnumCertificatesInStore(temporary_roots_, NULL)) | 172 while (prev_cert = CertEnumCertificatesInStore(temporary_roots_, NULL)) |
| 165 CertDeleteCertificateFromStore(prev_cert); | 173 CertDeleteCertificateFromStore(prev_cert); |
| 166 } | 174 } |
| 167 | 175 |
| 168 bool TestRootCerts::IsEmpty() const { | 176 bool TestRootCerts::IsEmpty() const { |
| 169 return empty_; | 177 return empty_; |
| 170 } | 178 } |
| 171 | 179 |
| 172 HCERTCHAINENGINE TestRootCerts::GetChainEngine() const { | 180 HCERTCHAINENGINE TestRootCerts::GetChainEngine() const { |
| 173 if (IsEmpty()) | 181 if (IsEmpty()) |
| 174 return NULL; // Default chain engine will suffice. | 182 return NULL; // Default chain engine will suffice. |
| 175 | 183 |
| 176 // Windows versions before 7 don't accept the struct size for later versions. | 184 // Windows versions before 7 don't accept the struct size for later versions. |
| 177 // We report the size of the old struct since we don't need the new members. | 185 // We report the size of the old struct since we don't need the new members. |
| 178 static const DWORD kSizeofCertChainEngineConfig = | 186 static const DWORD kSizeofCertChainEngineConfig = |
| 179 SIZEOF_STRUCT_WITH_SPECIFIED_LAST_MEMBER( | 187 SIZEOF_STRUCT_WITH_SPECIFIED_LAST_MEMBER(CERT_CHAIN_ENGINE_CONFIG, |
| 180 CERT_CHAIN_ENGINE_CONFIG, CycleDetectionModulus); | 188 CycleDetectionModulus); |
| 181 | 189 |
| 182 // Each HCERTCHAINENGINE caches both the configured system stores and | 190 // Each HCERTCHAINENGINE caches both the configured system stores and |
| 183 // information about each chain that has been built. In order to ensure | 191 // information about each chain that has been built. In order to ensure |
| 184 // that changes to |temporary_roots_| are properly propagated and that the | 192 // that changes to |temporary_roots_| are properly propagated and that the |
| 185 // various caches are flushed, when at least one certificate is added, | 193 // various caches are flushed, when at least one certificate is added, |
| 186 // return a new chain engine for every call. Each chain engine creation | 194 // return a new chain engine for every call. Each chain engine creation |
| 187 // should re-open the root store, ensuring the most recent changes are | 195 // should re-open the root store, ensuring the most recent changes are |
| 188 // visible. | 196 // visible. |
| 189 CERT_CHAIN_ENGINE_CONFIG engine_config = { | 197 CERT_CHAIN_ENGINE_CONFIG engine_config = {kSizeofCertChainEngineConfig}; |
| 190 kSizeofCertChainEngineConfig | |
| 191 }; | |
| 192 engine_config.dwFlags = | 198 engine_config.dwFlags = |
| 193 CERT_CHAIN_ENABLE_CACHE_AUTO_UPDATE | | 199 CERT_CHAIN_ENABLE_CACHE_AUTO_UPDATE | CERT_CHAIN_ENABLE_SHARE_STORE; |
| 194 CERT_CHAIN_ENABLE_SHARE_STORE; | |
| 195 HCERTCHAINENGINE chain_engine = NULL; | 200 HCERTCHAINENGINE chain_engine = NULL; |
| 196 BOOL ok = CertCreateCertificateChainEngine(&engine_config, &chain_engine); | 201 BOOL ok = CertCreateCertificateChainEngine(&engine_config, &chain_engine); |
| 197 DCHECK(ok); | 202 DCHECK(ok); |
| 198 return chain_engine; | 203 return chain_engine; |
| 199 } | 204 } |
| 200 | 205 |
| 201 TestRootCerts::~TestRootCerts() { | 206 TestRootCerts::~TestRootCerts() { |
| 202 CertCloseStore(temporary_roots_, 0); | 207 CertCloseStore(temporary_roots_, 0); |
| 203 } | 208 } |
| 204 | 209 |
| 205 void TestRootCerts::Init() { | 210 void TestRootCerts::Init() { |
| 206 empty_ = true; | 211 empty_ = true; |
| 207 temporary_roots_ = CertOpenStore( | 212 temporary_roots_ = CertOpenStore(CERT_STORE_PROV_MEMORY, |
| 208 CERT_STORE_PROV_MEMORY, 0, NULL, | 213 0, |
| 209 CERT_STORE_DEFER_CLOSE_UNTIL_LAST_FREE_FLAG, NULL); | 214 NULL, |
| 215 CERT_STORE_DEFER_CLOSE_UNTIL_LAST_FREE_FLAG, |
| 216 NULL); |
| 210 DCHECK(temporary_roots_); | 217 DCHECK(temporary_roots_); |
| 211 } | 218 } |
| 212 | 219 |
| 213 } // namespace net | 220 } // namespace net |
| OLD | NEW |