diff options
Diffstat (limited to 'cpp/src/IceSSL/SChannelEngine.cpp')
| -rw-r--r-- | cpp/src/IceSSL/SChannelEngine.cpp | 664 |
1 files changed, 664 insertions, 0 deletions
diff --git a/cpp/src/IceSSL/SChannelEngine.cpp b/cpp/src/IceSSL/SChannelEngine.cpp new file mode 100644 index 00000000000..89254a433bb --- /dev/null +++ b/cpp/src/IceSSL/SChannelEngine.cpp @@ -0,0 +1,664 @@ +// ********************************************************************** +// +// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved. +// +// This copy of Ice is licensed to you under the terms described in the +// ICE_LICENSE file included in this distribution. +// +// ********************************************************************** + +#include <IceSSL/SSLEngine.h> +#include <IceSSL/Plugin.h> + +#include <Ice/LocalException.h> +#include <Ice/Logger.h> +#include <Ice/Communicator.h> + +#include <IceUtil/StringUtil.h> +#include <IceUtil/FileUtil.h> +#include <IceUtil/UUID.h> + +using namespace std; +using namespace Ice; +using namespace IceUtil; +using namespace IceSSL; + +#ifdef ICE_USE_SCHANNEL + +IceUtil::Shared* IceSSL::upCast(IceSSL::SChannelEngine* p) { return p; } + +namespace +{ + +void +addCertificateToStore(const string& file, HCERTSTORE store, PCCERT_CONTEXT* cert = 0) +{ + vector<char> buffer; + readFile(file, buffer); + vector<BYTE> outBuffer; + outBuffer.resize(buffer.size()); + DWORD outLength = static_cast<DWORD>(outBuffer.size()); + + if(!CryptStringToBinary(&buffer[0], static_cast<DWORD>(buffer.size()), CRYPT_STRING_BASE64HEADER, + &outBuffer[0], &outLength, 0, 0)) + { + // + // Base64 data should always be bigger than binary + // + assert(GetLastError() != ERROR_MORE_DATA); + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error decoding certificate:\n" + IceUtilInternal::lastErrorToString()); + } + + if(!CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &outBuffer[0], + outLength, CERT_STORE_ADD_NEW, cert)) + { + if(GetLastError() != static_cast<DWORD>(CRYPT_E_EXISTS)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error decoding certificate:\n" + IceUtilInternal::lastErrorToString()); + } + } +} + +DWORD +parseProtocols(const StringSeq& protocols) +{ + DWORD v = 0; + + for(Ice::StringSeq::const_iterator p = protocols.begin(); p != protocols.end(); ++p) + { + string prot = *p; + + if(prot == "ssl3" || prot == "sslv3") + { + v |= SP_PROT_SSL3_SERVER; + v |= SP_PROT_SSL3_CLIENT; + } + else if(prot == "tls" || prot == "tls1" || prot == "tlsv1" || prot == "tls1_0" || prot == "tlsv1_0") + { + v |= SP_PROT_TLS1_SERVER; + v |= SP_PROT_TLS1_CLIENT; + } + else if(prot == "tls1_1" || prot == "tlsv1_1") + { + v |= SP_PROT_TLS1_1_SERVER; + v |= SP_PROT_TLS1_1_CLIENT; + } + else if(prot == "tls1_2" || prot == "tlsv1_2") + { + v |= SP_PROT_TLS1_2_SERVER; + v |= SP_PROT_TLS1_2_CLIENT; + } + else + { + throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unrecognized protocol `" + prot + "'"); + } + } + + return v; +} + +const ALG_ID supportedChipers[] = {CALG_3DES, CALG_AES_128, CALG_AES_256, CALG_DES, CALG_RC2, CALG_RC4}; +const int supportedChipersSize = sizeof(supportedChipers)/sizeof(ALG_ID); + +ALG_ID +algorithmId(const string& name) +{ + if(name == "3DES") + { + return CALG_3DES; + } + if(name == "AES_128") + { + return CALG_AES_128; + } + if(name == "AES_256") + { + return CALG_AES_256; + } + if(name == "DES") + { + return CALG_DES; + } + if(name == "RC2") + { + return CALG_RC2; + } + if(name == "RC4") + { + return CALG_RC4; + } + return 0; +} + +} + +SChannelEngine::SChannelEngine(const CommunicatorPtr& communicator) : + SSLEngine(communicator), + _initialized(false), + _rootStore(0), + _chainEngine(0) +{ +} + +void +SChannelEngine::initialize() +{ + IceUtil::Mutex::Lock lock(_mutex); + if(_initialized) + { + return; + } + + SSLEngine::initialize(); + + const string prefix = "IceSSL."; + const PropertiesPtr properties = communicator()->getProperties(); + + // + // Protocols selects which protocols to enable. + // + const_cast<DWORD&>(_protocols) = parseProtocols(properties->getPropertyAsList(prefix + "Protocols")); + + // + // Check for a default directory. We look in this directory for + // files mentioned in the configuration. + // + string defaultDir = properties->getProperty(prefix + "DefaultDir"); + + int passwordRetryMax = properties->getPropertyAsIntWithDefault(prefix + "PasswordRetryMax", 3); + PasswordPromptPtr passwordPrompt = getPasswordPrompt(); + setPassword(properties->getProperty(prefix + "Password")); + + string ciphers = properties->getProperty(prefix + "Ciphers"); + if(!ciphers.empty()) + { + parseCiphers(ciphers); + } + + if(securityTraceLevel() >= 1) + { + ostringstream os; + os << "enabling SSL ciphersuites:"; + if(_ciphers.empty()) + { + for(int i = 0; i < supportedChipersSize; ++i) + { + os << "\n " << getCipherName(supportedChipers[i]); + } + } + else + { + for(vector<ALG_ID>::const_iterator i = _ciphers.begin(); i != _ciphers.end(); ++i) + { + os << "\n " << getCipherName(*i); + } + } + getLogger()->trace(securityTraceCategory(), os.str()); + } + + string certStore = properties->getPropertyWithDefault(prefix + "CertStore", "CurrentUser"); + if(certStore != "CurrentUser" && certStore != "LocalMachine") + { + getLogger()->warning("Invalid IceSSL.CertStore value `" + certStore + "' adjusted to `CurrentUser'"); + certStore = "CurrentUser"; + } + + // + // Create trusted CA store with contents of CertAuthFile + // + string caFile = properties->getProperty(prefix + "CertAuthFile"); + if(!caFile.empty()) + { + _rootStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0); + if(!_rootStore) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error creating in memory certificate store:\n" + IceUtilInternal::lastErrorToString()); + } + + if(!checkPath(caFile, defaultDir, false)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: CA certificate file not found:\n" + caFile); + } + + addCertificateToStore(caFile, _rootStore); + + // + // Create a chain engine that uses our Trusted Root Store + // +#ifdef __MINGW32__ + CertChainEngineConfig config; + memset(&config, 0, sizeof(CertChainEngineConfig)); + config.cbSize = sizeof(CertChainEngineConfig); +#else + CERT_CHAIN_ENGINE_CONFIG config; + memset(&config, 0, sizeof(CERT_CHAIN_ENGINE_CONFIG)); + config.cbSize = sizeof(CERT_CHAIN_ENGINE_CONFIG); +#endif + config.hExclusiveRoot = _rootStore; + + // + // Build the chain using the LocalMachine registry location as opposed + // to the CurrentUser location. + // + if(certStore == "LocalMachine") + { + config.dwFlags = CERT_CHAIN_USE_LOCAL_MACHINE_STORE; + } + +#ifdef __MINGW32__ + if(!CertCreateCertificateChainEngine(reinterpret_cast<CERT_CHAIN_ENGINE_CONFIG*>(&config), &_chainEngine)) +#else + if(!CertCreateCertificateChainEngine(&config, &_chainEngine)) +#endif + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error creating certificate chain engine:\n" + IceUtilInternal::lastErrorToString()); + } + } + else + { + _chainEngine = (certStore == "LocalMachine") ? HCCE_LOCAL_MACHINE : HCCE_CURRENT_USER; + } + + // + // Import the application certificate and private keys. + // + string keySet = properties->getPropertyWithDefault(prefix + "KeySet", "DefaultKeySet"); + if(keySet != "DefaultKeySet" && keySet != "UserKeySet" && keySet != "MachineKeySet") + { + getLogger()->warning("Invalid IceSSL.KeySet value `" + keySet + "' adjusted to `DefaultKeySet'"); + keySet = "DefaultKeySet"; + } + + DWORD importFlags = (keySet == "MachineKeySet") ? CRYPT_MACHINE_KEYSET : CRYPT_USER_KEYSET; + + string certFile = properties->getProperty(prefix + "CertFile"); + string keyFile = properties->getPropertyWithDefault(prefix + "KeyFile", certFile); + + if(!certFile.empty()) + { + vector<string> certFiles; + if(!IceUtilInternal::splitString(certFile, IceUtilInternal::pathsep, certFiles) || certFiles.size() > 2) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: invalid value for " + prefix + "CertFile:\n" + certFile); + } + + vector<string> keyFiles; + if(!IceUtilInternal::splitString(keyFile, IceUtilInternal::pathsep, keyFiles) || keyFiles.size() > 2) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: invalid value for " + prefix + "KeyFile:\n" + keyFile); + } + + if(certFiles.size() != keyFiles.size()) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: " + prefix + "KeyFile does not agree with " + prefix + "CertFile"); + } + + for(size_t i = 0; i < certFiles.size(); ++i) + { + string certFile = certFiles[i]; + if(!checkPath(certFile, defaultDir, false)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: certificate file not found:\n" + certFile); + } + + vector<char> buffer; + readFile(certFile, buffer); + + CRYPT_DATA_BLOB pfxBlob; + pfxBlob.cbData = static_cast<DWORD>(buffer.size()); + pfxBlob.pbData = reinterpret_cast<BYTE*>(&buffer[0]); + + HCERTSTORE store = 0; + PCCERT_CONTEXT cert = 0; + int err = 0; + int count = 0; + do + { + string s = password(false); + store = PFXImportCertStore(&pfxBlob, stringToWstring(s).c_str(), importFlags); + err = store ? 0 : GetLastError(); + } + while(err == ERROR_INVALID_PASSWORD && passwordPrompt && ++count < passwordRetryMax); + + if(store) + { + _stores.push_back(store); + cert = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0, CERT_FIND_ANY, 0, cert); + if(!cert) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: certificate error:\n" + IceUtilInternal::lastErrorToString()); + } + _certs.push_back(cert); + continue; + } + + assert(err); + + if(err != CRYPT_E_BAD_ENCODE) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error decoding certificate:\n" + IceUtilInternal::lastErrorToString()); + } + + // + // Try to load certificate & key as PEM files. + // + err = 0; + keyFile = keyFiles[i]; + if(!checkPath(keyFile, defaultDir, false)) + { + throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: key file not found:\n" + keyFile); + } + + readFile(keyFile, buffer); + + vector<BYTE> outBuffer; + outBuffer.resize(buffer.size()); + DWORD outLength = static_cast<DWORD>(buffer.size()); + + // + // Convert the PEM encoded buffer to DER binary format. + // + if(!CryptStringToBinary(&buffer[0], static_cast<DWORD>(buffer.size()), CRYPT_STRING_BASE64HEADER, + &outBuffer[0], &outLength, 0, 0)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error decoding key:\n" + IceUtilInternal::lastErrorToString()); + } + + PCRYPT_PRIVATE_KEY_INFO keyInfo = 0; + BYTE* key = 0; + HCRYPTKEY hKey = 0; + + try + { + DWORD decodedLength = 0; + if(!CryptDecodeObjectEx(X509_ASN_ENCODING, PKCS_PRIVATE_KEY_INFO, &outBuffer[0], outLength, + CRYPT_DECODE_ALLOC_FLAG, 0, &keyInfo, &decodedLength)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error decoding key:\n" + IceUtilInternal::lastErrorToString()); + } + + // + // Check that we are using a RSA Key + // + if(strcmp(keyInfo->Algorithm.pszObjId, szOID_RSA_RSA)) + { + throw PluginInitializationException(__FILE__, __LINE__, + string("IceSSL: error unknow key algorithm: `") + keyInfo->Algorithm.pszObjId + "'"); + } + + // + // Create a new RSA key set to store our key + // + const wstring keySetName = stringToWstring(IceUtil::generateUUID()); + HCRYPTPROV cryptProv = 0; + + DWORD contextFlags = (keySet == "MachineKeySet") ? CRYPT_MACHINE_KEYSET | CRYPT_NEWKEYSET : + CRYPT_NEWKEYSET; + + if(!CryptAcquireContextW(&cryptProv, keySetName.c_str(), MS_DEF_PROV_W, PROV_RSA_FULL, contextFlags)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error acquiring cryptographic context:\n" + IceUtilInternal::lastErrorToString()); + } + + // + // Decode the private key BLOB + // + if(!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, PKCS_RSA_PRIVATE_KEY, + keyInfo->PrivateKey.pbData, keyInfo->PrivateKey.cbData, + CRYPT_DECODE_ALLOC_FLAG, 0, &key, &outLength)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error decoding key:\n" + IceUtilInternal::lastErrorToString()); + } + LocalFree(keyInfo); + keyInfo = 0; + + // + // Import the private key + // + if(!CryptImportKey(cryptProv, key, outLength, 0, 0, &hKey)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error importing key:\n" + IceUtilInternal::lastErrorToString()); + } + LocalFree(key); + key = 0; + + CryptDestroyKey(hKey); + hKey = 0; + + // + // Create a new memory store to place the certificate + // + store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0); + if(!store) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error creating certificate store:\n" + IceUtilInternal::lastErrorToString()); + } + + addCertificateToStore(certFile, store, &cert); + + // + // Associate key & certificate + // + CRYPT_KEY_PROV_INFO keyProvInfo; + memset(&keyProvInfo, 0, sizeof(keyProvInfo)); + keyProvInfo.pwszContainerName = const_cast<wchar_t*>(keySetName.c_str()); + keyProvInfo.pwszProvName = const_cast<wchar_t*>(MS_DEF_PROV_W); + keyProvInfo.dwProvType = PROV_RSA_FULL; + keyProvInfo.dwKeySpec = AT_KEYEXCHANGE; + + if(!CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, &keyProvInfo)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error seting certificate property:\n" + IceUtilInternal::lastErrorToString()); + } + + _certs.push_back(cert); + _stores.push_back(store); + } + catch(...) + { + if(keyInfo) + { + LocalFree(keyInfo); + } + + if(key) + { + LocalFree(key); + } + + if(hKey) + { + CryptDestroyKey(hKey); + } + + if(cert) + { + CertFreeCertificateContext(cert); + } + + if(store) + { + CertCloseStore(store, 0); + } + throw; + } + } + } + _initialized = true; +} + +string +SChannelEngine::getCipherName(ALG_ID cipher) const +{ + switch(cipher) + { + case CALG_RSA_KEYX: + return "RSA_KEYX"; + case CALG_RSA_SIGN: + return "RSA_SIGN"; + case CALG_DSS_SIGN: + return "DSS_SIGN"; + case CALG_KEA_KEYX: + return "KEA_KEYX"; + case CALG_DH_EPHEM: + return "DH_EPHEM"; + case CALG_ECDH: + return "ECDH"; + case CALG_ECDSA: + return "ECDSA"; + case CALG_3DES: + return "3DES"; + case CALG_AES_128: + return "AES_128"; + case CALG_AES_256: + return "AES_256"; + case CALG_DES: + return "DES"; + case CALG_RC2: + return "RC2"; + case CALG_RC4: + return "RC4"; + default: + return "Unknown"; + } +} + +bool +SChannelEngine::initialized() const +{ + IceUtil::Mutex::Lock lock(_mutex); + return _initialized; +} + +CredHandle +SChannelEngine::newCredentialsHandle(bool incoming) +{ + SCHANNEL_CRED cred; + memset(&cred, 0, sizeof(cred)); + cred.dwVersion = SCHANNEL_CRED_VERSION; + + if(!_certs.empty()) + { + cred.cCreds = static_cast<DWORD>(_certs.size()); + cred.paCred = &_certs[0]; + } + + cred.grbitEnabledProtocols = _protocols; + + if(incoming) + { + cred.dwFlags = SCH_CRED_NO_SYSTEM_MAPPER | SCH_SEND_ROOT_CERT; + } + else + { + cred.dwFlags = SCH_CRED_MANUAL_CRED_VALIDATION | SCH_CRED_NO_SERVERNAME_CHECK | SCH_CRED_NO_DEFAULT_CREDS; + } + + if(!_ciphers.empty()) + { + cred.cSupportedAlgs = static_cast<DWORD>(_ciphers.size()); + cred.palgSupportedAlgs = &_ciphers[0]; + } + + CredHandle credHandle; + memset(&credHandle, 0, sizeof(credHandle)); + + SECURITY_STATUS err = + AcquireCredentialsHandle(0, const_cast<char*>(UNISP_NAME), (incoming ? SECPKG_CRED_INBOUND : SECPKG_CRED_OUTBOUND), 0, &cred, 0, + 0, &credHandle, 0); + + if(err != SEC_E_OK) + { + throw SecurityException(__FILE__, __LINE__, + "IceSSL: failed to acquire credentials handle:\n" + IceUtilInternal::lastErrorToString()); + } + return credHandle; +} + +HCERTCHAINENGINE +SChannelEngine::chainEngine() const +{ + return _chainEngine; +} + +void +SChannelEngine::parseCiphers(const std::string& ciphers) +{ + vector<string> tokens; + IceUtilInternal::splitString(ciphers, " \t", tokens); + for(vector<string>::const_iterator i = tokens.begin(); i != tokens.end(); ++i) + { + ALG_ID id = algorithmId(*i); + if(id) + { + _ciphers.push_back(id); + } + } +} + +void +SChannelEngine::destroy() +{ + if(_chainEngine && _chainEngine != HCCE_CURRENT_USER && _chainEngine != HCCE_LOCAL_MACHINE) + { + CertFreeCertificateChainEngine(_chainEngine); + } + + if(_rootStore) + { + CertCloseStore(_rootStore, 0); + } + + for(vector<PCCERT_CONTEXT>::const_iterator i = _certs.begin(); i != _certs.end(); ++i) + { + PCCERT_CONTEXT cert = *i; + + UniquePtr<CRYPT_KEY_PROV_INFO> keyProvInfo; + DWORD size = 0; + + // + // Retrieve the certificate CERT_KEY_PROV_INFO_PROP_ID property, we use the CRYPT_KEY_PROV_INFO + // data to then remove the key set associated with the certificate. + // + if(CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, &size)) + { + vector<char> buf(size); + if(CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, &buf[0], &size)) + { + CRYPT_KEY_PROV_INFO* keyProvInfo = reinterpret_cast<CRYPT_KEY_PROV_INFO*>(&buf[0]); + HCRYPTPROV cryptProv = 0; + if(CryptAcquireContextW(&cryptProv, keyProvInfo->pwszContainerName, keyProvInfo->pwszProvName, + keyProvInfo->dwProvType, 0)) + { + CryptAcquireContextW(&cryptProv, keyProvInfo->pwszContainerName, keyProvInfo->pwszProvName, + keyProvInfo->dwProvType, CRYPT_DELETEKEYSET); + } + } + CertFreeCertificateContext(cert); + } + } + + for(vector<HCERTSTORE>::const_iterator i = _stores.begin(); i != _stores.end(); ++i) + { + CertCloseStore(*i, 0); + } +} +#endif |