michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: #include <stdio.h>
michael@0: #include <stdlib.h>
michael@0: #include <windows.h>
michael@0: #include <softpub.h>
michael@0: #include <wintrust.h>
michael@0: 
michael@0: #include "certificatecheck.h"
michael@0: #include "servicebase.h"
michael@0: 
michael@0: #pragma comment(lib, "wintrust.lib")
michael@0: #pragma comment(lib, "crypt32.lib")
michael@0: 
michael@0: static const int ENCODING = X509_ASN_ENCODING | PKCS_7_ASN_ENCODING;
michael@0: 
michael@0: /**
michael@0:  * Checks to see if a file stored at filePath matches the specified info.
michael@0:  *
michael@0:  * @param  filePath    The PE file path to check
michael@0:  * @param  infoToMatch The acceptable information to match
michael@0:  * @return ERROR_SUCCESS if successful, ERROR_NOT_FOUND if the info 
michael@0:  *         does not match, or the last error otherwise.
michael@0:  */
michael@0: DWORD
michael@0: CheckCertificateForPEFile(LPCWSTR filePath, 
michael@0:                           CertificateCheckInfo &infoToMatch)
michael@0: {
michael@0:   HCERTSTORE certStore = nullptr;
michael@0:   HCRYPTMSG cryptMsg = nullptr; 
michael@0:   PCCERT_CONTEXT certContext = nullptr;
michael@0:   PCMSG_SIGNER_INFO signerInfo = nullptr;
michael@0:   DWORD lastError = ERROR_SUCCESS;
michael@0: 
michael@0:   // Get the HCERTSTORE and HCRYPTMSG from the signed file.
michael@0:   DWORD encoding, contentType, formatType;
michael@0:   BOOL result = CryptQueryObject(CERT_QUERY_OBJECT_FILE,
michael@0:                                   filePath, 
michael@0:                                   CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED,
michael@0:                                   CERT_QUERY_CONTENT_FLAG_ALL, 
michael@0:                                   0, &encoding, &contentType,
michael@0:                                   &formatType, &certStore, &cryptMsg, nullptr);
michael@0:   if (!result) {
michael@0:     lastError = GetLastError();
michael@0:     LOG_WARN(("CryptQueryObject failed.  (%d)", lastError));
michael@0:     goto cleanup;
michael@0:   }
michael@0: 
michael@0:   // Pass in nullptr to get the needed signer information size.
michael@0:   DWORD signerInfoSize;
michael@0:   result = CryptMsgGetParam(cryptMsg, CMSG_SIGNER_INFO_PARAM, 0, 
michael@0:                             nullptr, &signerInfoSize);
michael@0:   if (!result) {
michael@0:     lastError = GetLastError();
michael@0:     LOG_WARN(("CryptMsgGetParam failed.  (%d)", lastError));
michael@0:     goto cleanup;
michael@0:   }
michael@0: 
michael@0:   // Allocate the needed size for the signer information.
michael@0:   signerInfo = (PCMSG_SIGNER_INFO)LocalAlloc(LPTR, signerInfoSize);
michael@0:   if (!signerInfo) {
michael@0:     lastError = GetLastError();
michael@0:     LOG_WARN(("Unable to allocate memory for Signer Info.  (%d)", lastError));
michael@0:     goto cleanup;
michael@0:   }
michael@0: 
michael@0:   // Get the signer information (PCMSG_SIGNER_INFO).
michael@0:   // In particular we want the issuer and serial number.
michael@0:   result = CryptMsgGetParam(cryptMsg, CMSG_SIGNER_INFO_PARAM, 0, 
michael@0:                             (PVOID)signerInfo, &signerInfoSize);
michael@0:   if (!result) {
michael@0:     lastError = GetLastError();
michael@0:     LOG_WARN(("CryptMsgGetParam failed.  (%d)", lastError));
michael@0:     goto cleanup;
michael@0:   }
michael@0: 
michael@0:   // Search for the signer certificate in the certificate store.
michael@0:   CERT_INFO certInfo;     
michael@0:   certInfo.Issuer = signerInfo->Issuer;
michael@0:   certInfo.SerialNumber = signerInfo->SerialNumber;
michael@0:   certContext = CertFindCertificateInStore(certStore, ENCODING, 0, 
michael@0:                                            CERT_FIND_SUBJECT_CERT,
michael@0:                                            (PVOID)&certInfo, nullptr);
michael@0:   if (!certContext) {
michael@0:     lastError = GetLastError();
michael@0:     LOG_WARN(("CertFindCertificateInStore failed.  (%d)", lastError));
michael@0:     goto cleanup;
michael@0:   }
michael@0: 
michael@0:   if (!DoCertificateAttributesMatch(certContext, infoToMatch)) {
michael@0:     lastError = ERROR_NOT_FOUND;
michael@0:     LOG_WARN(("Certificate did not match issuer or name.  (%d)", lastError));
michael@0:     goto cleanup;
michael@0:   }
michael@0: 
michael@0: cleanup:
michael@0:   if (signerInfo) {
michael@0:     LocalFree(signerInfo);
michael@0:   }
michael@0:   if (certContext) {
michael@0:     CertFreeCertificateContext(certContext);
michael@0:   }
michael@0:   if (certStore) { 
michael@0:     CertCloseStore(certStore, 0);
michael@0:   }
michael@0:   if (cryptMsg) { 
michael@0:     CryptMsgClose(cryptMsg);
michael@0:   }
michael@0:   return lastError;
michael@0: }
michael@0: 
michael@0: /**
michael@0:  * Checks to see if a file stored at filePath matches the specified info.
michael@0:  *
michael@0:  * @param  certContext  The certificate context of the file
michael@0:  * @param  infoToMatch  The acceptable information to match
michael@0:  * @return FALSE if the info does not match or if any error occurs in the check
michael@0:  */
michael@0: BOOL 
michael@0: DoCertificateAttributesMatch(PCCERT_CONTEXT certContext, 
michael@0:                              CertificateCheckInfo &infoToMatch)
michael@0: {
michael@0:   DWORD dwData;
michael@0:   LPTSTR szName = nullptr;
michael@0: 
michael@0:   if (infoToMatch.issuer) {
michael@0:     // Pass in nullptr to get the needed size of the issuer buffer.
michael@0:     dwData = CertGetNameString(certContext, 
michael@0:                                CERT_NAME_SIMPLE_DISPLAY_TYPE,
michael@0:                                CERT_NAME_ISSUER_FLAG, nullptr,
michael@0:                                nullptr, 0);
michael@0: 
michael@0:     if (!dwData) {
michael@0:       LOG_WARN(("CertGetNameString failed.  (%d)", GetLastError()));
michael@0:       return FALSE;
michael@0:     }
michael@0: 
michael@0:     // Allocate memory for Issuer name buffer.
michael@0:     LPTSTR szName = (LPTSTR)LocalAlloc(LPTR, dwData * sizeof(WCHAR));
michael@0:     if (!szName) {
michael@0:       LOG_WARN(("Unable to allocate memory for issuer name.  (%d)",
michael@0:                 GetLastError()));
michael@0:       return FALSE;
michael@0:     }
michael@0: 
michael@0:     // Get Issuer name.
michael@0:     if (!CertGetNameString(certContext, CERT_NAME_SIMPLE_DISPLAY_TYPE,
michael@0:                            CERT_NAME_ISSUER_FLAG, nullptr, szName, dwData)) {
michael@0:       LOG_WARN(("CertGetNameString failed.  (%d)", GetLastError()));
michael@0:       LocalFree(szName);
michael@0:       return FALSE;
michael@0:     }
michael@0: 
michael@0:     // If the issuer does not match, return a failure.
michael@0:     if (!infoToMatch.issuer ||
michael@0:         wcscmp(szName, infoToMatch.issuer)) {
michael@0:       LocalFree(szName);
michael@0:       return FALSE;
michael@0:     }
michael@0: 
michael@0:     LocalFree(szName);
michael@0:     szName = nullptr;
michael@0:   }
michael@0: 
michael@0:   if (infoToMatch.name) {
michael@0:     // Pass in nullptr to get the needed size of the name buffer.
michael@0:     dwData = CertGetNameString(certContext, CERT_NAME_SIMPLE_DISPLAY_TYPE,
michael@0:                                0, nullptr, nullptr, 0);
michael@0:     if (!dwData) {
michael@0:       LOG_WARN(("CertGetNameString failed.  (%d)", GetLastError()));
michael@0:       return FALSE;
michael@0:     }
michael@0: 
michael@0:     // Allocate memory for the name buffer.
michael@0:     szName = (LPTSTR)LocalAlloc(LPTR, dwData * sizeof(WCHAR));
michael@0:     if (!szName) {
michael@0:       LOG_WARN(("Unable to allocate memory for subject name.  (%d)",
michael@0:                 GetLastError()));
michael@0:       return FALSE;
michael@0:     }
michael@0: 
michael@0:     // Obtain the name.
michael@0:     if (!(CertGetNameString(certContext, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0,
michael@0:                             nullptr, szName, dwData))) {
michael@0:       LOG_WARN(("CertGetNameString failed.  (%d)", GetLastError()));
michael@0:       LocalFree(szName);
michael@0:       return FALSE;
michael@0:     }
michael@0: 
michael@0:     // If the issuer does not match, return a failure.
michael@0:     if (!infoToMatch.name || 
michael@0:         wcscmp(szName, infoToMatch.name)) {
michael@0:       LocalFree(szName);
michael@0:       return FALSE;
michael@0:     }
michael@0: 
michael@0:     // We have a match!
michael@0:     LocalFree(szName);
michael@0:   }
michael@0: 
michael@0:   // If there were any errors we would have aborted by now.
michael@0:   return TRUE;
michael@0: }
michael@0: 
michael@0: /**
michael@0:  * Duplicates the specified string
michael@0:  *
michael@0:  * @param  inputString The string to duplicate
michael@0:  * @return The duplicated string which should be freed by the caller.
michael@0:  */
michael@0: LPWSTR 
michael@0: AllocateAndCopyWideString(LPCWSTR inputString)
michael@0: {
michael@0:   LPWSTR outputString = 
michael@0:     (LPWSTR)LocalAlloc(LPTR, (wcslen(inputString) + 1) * sizeof(WCHAR));
michael@0:   if (outputString) {
michael@0:     lstrcpyW(outputString, inputString);
michael@0:   }
michael@0:   return outputString;
michael@0: }
michael@0: 
michael@0: /**
michael@0:  * Verifies the trust of the specified file path.
michael@0:  *
michael@0:  * @param  filePath  The file path to check.
michael@0:  * @return ERROR_SUCCESS if successful, or the last error code otherwise.
michael@0:  */
michael@0: DWORD
michael@0: VerifyCertificateTrustForFile(LPCWSTR filePath)
michael@0: {
michael@0:   // Setup the file to check.
michael@0:   WINTRUST_FILE_INFO fileToCheck;
michael@0:   ZeroMemory(&fileToCheck, sizeof(fileToCheck));
michael@0:   fileToCheck.cbStruct = sizeof(WINTRUST_FILE_INFO);
michael@0:   fileToCheck.pcwszFilePath = filePath;
michael@0: 
michael@0:   // Setup what to check, we want to check it is signed and trusted.
michael@0:   WINTRUST_DATA trustData;
michael@0:   ZeroMemory(&trustData, sizeof(trustData));
michael@0:   trustData.cbStruct = sizeof(trustData);
michael@0:   trustData.pPolicyCallbackData = nullptr;
michael@0:   trustData.pSIPClientData = nullptr;
michael@0:   trustData.dwUIChoice = WTD_UI_NONE;
michael@0:   trustData.fdwRevocationChecks = WTD_REVOKE_NONE; 
michael@0:   trustData.dwUnionChoice = WTD_CHOICE_FILE;
michael@0:   trustData.dwStateAction = 0;
michael@0:   trustData.hWVTStateData = nullptr;
michael@0:   trustData.pwszURLReference = nullptr;
michael@0:   // no UI
michael@0:   trustData.dwUIContext = 0;
michael@0:   trustData.pFile = &fileToCheck;
michael@0: 
michael@0:   GUID policyGUID = WINTRUST_ACTION_GENERIC_VERIFY_V2;
michael@0:   // Check if the file is signed by something that is trusted.
michael@0:   LONG ret = WinVerifyTrust(nullptr, &policyGUID, &trustData);
michael@0:   if (ERROR_SUCCESS == ret) {
michael@0:     // The hash that represents the subject is trusted and there were no
michael@0:     // verification errors.  No publisher nor time stamp chain errors.
michael@0:     LOG(("The file \"%ls\" is signed and the signature was verified.",
michael@0:          filePath));
michael@0:       return ERROR_SUCCESS;
michael@0:   }
michael@0: 
michael@0:   DWORD lastError = GetLastError();
michael@0:   LOG_WARN(("There was an error validating trust of the certificate for file"
michael@0:             " \"%ls\". Returned: %d.  (%d)", filePath, ret, lastError));
michael@0:   return ret;
michael@0: }