2
0

schannel_verify.c 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Marc Hoersken, <info@marc-hoersken.de>
  9. * Copyright (C) Mark Salisbury, <mark.salisbury@hp.com>
  10. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  11. *
  12. * This software is licensed as described in the file COPYING, which
  13. * you should have received as part of this distribution. The terms
  14. * are also available at https://curl.se/docs/copyright.html.
  15. *
  16. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  17. * copies of the Software, and permit persons to whom the Software is
  18. * furnished to do so, under the terms of the COPYING file.
  19. *
  20. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  21. * KIND, either express or implied.
  22. *
  23. * SPDX-License-Identifier: curl
  24. *
  25. ***************************************************************************/
  26. /*
  27. * Source file for Schannel-specific certificate verification. This code should
  28. * only be invoked by code in schannel.c.
  29. */
  30. #include "curl_setup.h"
  31. #ifdef USE_SCHANNEL
  32. #ifndef USE_WINDOWS_SSPI
  33. # error "Can't compile SCHANNEL support without SSPI."
  34. #endif
  35. #include "schannel.h"
  36. #include "schannel_int.h"
  37. #ifdef HAS_MANUAL_VERIFY_API
  38. #include "vtls.h"
  39. #include "vtls_int.h"
  40. #include "sendf.h"
  41. #include "strerror.h"
  42. #include "curl_multibyte.h"
  43. #include "curl_printf.h"
  44. #include "hostcheck.h"
  45. #include "version_win32.h"
  46. /* The last #include file should be: */
  47. #include "curl_memory.h"
  48. #include "memdebug.h"
  49. #define BACKEND ((struct schannel_ssl_backend_data *)connssl->backend)
  50. #define MAX_CAFILE_SIZE 1048576 /* 1 MiB */
  51. #define BEGIN_CERT "-----BEGIN CERTIFICATE-----"
  52. #define END_CERT "\n-----END CERTIFICATE-----"
  53. struct cert_chain_engine_config_win7 {
  54. DWORD cbSize;
  55. HCERTSTORE hRestrictedRoot;
  56. HCERTSTORE hRestrictedTrust;
  57. HCERTSTORE hRestrictedOther;
  58. DWORD cAdditionalStore;
  59. HCERTSTORE *rghAdditionalStore;
  60. DWORD dwFlags;
  61. DWORD dwUrlRetrievalTimeout;
  62. DWORD MaximumCachedCertificates;
  63. DWORD CycleDetectionModulus;
  64. HCERTSTORE hExclusiveRoot;
  65. HCERTSTORE hExclusiveTrustedPeople;
  66. };
  67. static int is_cr_or_lf(char c)
  68. {
  69. return c == '\r' || c == '\n';
  70. }
  71. /* Search the substring needle,needlelen into string haystack,haystacklen
  72. * Strings don't need to be terminated by a '\0'.
  73. * Similar of OSX/Linux memmem (not available on Visual Studio).
  74. * Return position of beginning of first occurrence or NULL if not found
  75. */
  76. static const char *c_memmem(const void *haystack, size_t haystacklen,
  77. const void *needle, size_t needlelen)
  78. {
  79. const char *p;
  80. char first;
  81. const char *str_limit = (const char *)haystack + haystacklen;
  82. if(!needlelen || needlelen > haystacklen)
  83. return NULL;
  84. first = *(const char *)needle;
  85. for(p = (const char *)haystack; p <= (str_limit - needlelen); p++)
  86. if(((*p) == first) && (memcmp(p, needle, needlelen) == 0))
  87. return p;
  88. return NULL;
  89. }
  90. static CURLcode add_certs_data_to_store(HCERTSTORE trust_store,
  91. const char *ca_buffer,
  92. size_t ca_buffer_size,
  93. const char *ca_file_text,
  94. struct Curl_easy *data)
  95. {
  96. const size_t begin_cert_len = strlen(BEGIN_CERT);
  97. const size_t end_cert_len = strlen(END_CERT);
  98. CURLcode result = CURLE_OK;
  99. int num_certs = 0;
  100. bool more_certs = 1;
  101. const char *current_ca_file_ptr = ca_buffer;
  102. const char *ca_buffer_limit = ca_buffer + ca_buffer_size;
  103. while(more_certs && (current_ca_file_ptr<ca_buffer_limit)) {
  104. const char *begin_cert_ptr = c_memmem(current_ca_file_ptr,
  105. ca_buffer_limit-current_ca_file_ptr,
  106. BEGIN_CERT,
  107. begin_cert_len);
  108. if(!begin_cert_ptr || !is_cr_or_lf(begin_cert_ptr[begin_cert_len])) {
  109. more_certs = 0;
  110. }
  111. else {
  112. const char *end_cert_ptr = c_memmem(begin_cert_ptr,
  113. ca_buffer_limit-begin_cert_ptr,
  114. END_CERT,
  115. end_cert_len);
  116. if(!end_cert_ptr) {
  117. failf(data,
  118. "schannel: CA file '%s' is not correctly formatted",
  119. ca_file_text);
  120. result = CURLE_SSL_CACERT_BADFILE;
  121. more_certs = 0;
  122. }
  123. else {
  124. CERT_BLOB cert_blob;
  125. CERT_CONTEXT *cert_context = NULL;
  126. BOOL add_cert_result = FALSE;
  127. DWORD actual_content_type = 0;
  128. DWORD cert_size = (DWORD)
  129. ((end_cert_ptr + end_cert_len) - begin_cert_ptr);
  130. cert_blob.pbData = (BYTE *)begin_cert_ptr;
  131. cert_blob.cbData = cert_size;
  132. if(!CryptQueryObject(CERT_QUERY_OBJECT_BLOB,
  133. &cert_blob,
  134. CERT_QUERY_CONTENT_FLAG_CERT,
  135. CERT_QUERY_FORMAT_FLAG_ALL,
  136. 0,
  137. NULL,
  138. &actual_content_type,
  139. NULL,
  140. NULL,
  141. NULL,
  142. (const void **)&cert_context)) {
  143. char buffer[STRERROR_LEN];
  144. failf(data,
  145. "schannel: failed to extract certificate from CA file "
  146. "'%s': %s",
  147. ca_file_text,
  148. Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
  149. result = CURLE_SSL_CACERT_BADFILE;
  150. more_certs = 0;
  151. }
  152. else {
  153. current_ca_file_ptr = begin_cert_ptr + cert_size;
  154. /* Sanity check that the cert_context object is the right type */
  155. if(CERT_QUERY_CONTENT_CERT != actual_content_type) {
  156. failf(data,
  157. "schannel: unexpected content type '%d' when extracting "
  158. "certificate from CA file '%s'",
  159. actual_content_type, ca_file_text);
  160. result = CURLE_SSL_CACERT_BADFILE;
  161. more_certs = 0;
  162. }
  163. else {
  164. add_cert_result =
  165. CertAddCertificateContextToStore(trust_store,
  166. cert_context,
  167. CERT_STORE_ADD_ALWAYS,
  168. NULL);
  169. CertFreeCertificateContext(cert_context);
  170. if(!add_cert_result) {
  171. char buffer[STRERROR_LEN];
  172. failf(data,
  173. "schannel: failed to add certificate from CA file '%s' "
  174. "to certificate store: %s",
  175. ca_file_text,
  176. Curl_winapi_strerror(GetLastError(), buffer,
  177. sizeof(buffer)));
  178. result = CURLE_SSL_CACERT_BADFILE;
  179. more_certs = 0;
  180. }
  181. else {
  182. num_certs++;
  183. }
  184. }
  185. }
  186. }
  187. }
  188. }
  189. if(result == CURLE_OK) {
  190. if(!num_certs) {
  191. infof(data,
  192. "schannel: did not add any certificates from CA file '%s'",
  193. ca_file_text);
  194. }
  195. else {
  196. infof(data,
  197. "schannel: added %d certificate(s) from CA file '%s'",
  198. num_certs, ca_file_text);
  199. }
  200. }
  201. return result;
  202. }
  203. static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
  204. const char *ca_file,
  205. struct Curl_easy *data)
  206. {
  207. CURLcode result;
  208. HANDLE ca_file_handle = INVALID_HANDLE_VALUE;
  209. LARGE_INTEGER file_size;
  210. char *ca_file_buffer = NULL;
  211. TCHAR *ca_file_tstr = NULL;
  212. size_t ca_file_bufsize = 0;
  213. DWORD total_bytes_read = 0;
  214. ca_file_tstr = curlx_convert_UTF8_to_tchar((char *)ca_file);
  215. if(!ca_file_tstr) {
  216. char buffer[STRERROR_LEN];
  217. failf(data,
  218. "schannel: invalid path name for CA file '%s': %s",
  219. ca_file,
  220. Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
  221. result = CURLE_SSL_CACERT_BADFILE;
  222. goto cleanup;
  223. }
  224. /*
  225. * Read the CA file completely into memory before parsing it. This
  226. * optimizes for the common case where the CA file will be relatively
  227. * small ( < 1 MiB ).
  228. */
  229. ca_file_handle = CreateFile(ca_file_tstr,
  230. GENERIC_READ,
  231. FILE_SHARE_READ,
  232. NULL,
  233. OPEN_EXISTING,
  234. FILE_ATTRIBUTE_NORMAL,
  235. NULL);
  236. if(ca_file_handle == INVALID_HANDLE_VALUE) {
  237. char buffer[STRERROR_LEN];
  238. failf(data,
  239. "schannel: failed to open CA file '%s': %s",
  240. ca_file,
  241. Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
  242. result = CURLE_SSL_CACERT_BADFILE;
  243. goto cleanup;
  244. }
  245. if(!GetFileSizeEx(ca_file_handle, &file_size)) {
  246. char buffer[STRERROR_LEN];
  247. failf(data,
  248. "schannel: failed to determine size of CA file '%s': %s",
  249. ca_file,
  250. Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
  251. result = CURLE_SSL_CACERT_BADFILE;
  252. goto cleanup;
  253. }
  254. if(file_size.QuadPart > MAX_CAFILE_SIZE) {
  255. failf(data,
  256. "schannel: CA file exceeds max size of %u bytes",
  257. MAX_CAFILE_SIZE);
  258. result = CURLE_SSL_CACERT_BADFILE;
  259. goto cleanup;
  260. }
  261. ca_file_bufsize = (size_t)file_size.QuadPart;
  262. ca_file_buffer = (char *)malloc(ca_file_bufsize + 1);
  263. if(!ca_file_buffer) {
  264. result = CURLE_OUT_OF_MEMORY;
  265. goto cleanup;
  266. }
  267. while(total_bytes_read < ca_file_bufsize) {
  268. DWORD bytes_to_read = (DWORD)(ca_file_bufsize - total_bytes_read);
  269. DWORD bytes_read = 0;
  270. if(!ReadFile(ca_file_handle, ca_file_buffer + total_bytes_read,
  271. bytes_to_read, &bytes_read, NULL)) {
  272. char buffer[STRERROR_LEN];
  273. failf(data,
  274. "schannel: failed to read from CA file '%s': %s",
  275. ca_file,
  276. Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
  277. result = CURLE_SSL_CACERT_BADFILE;
  278. goto cleanup;
  279. }
  280. if(bytes_read == 0) {
  281. /* Premature EOF -- adjust the bufsize to the new value */
  282. ca_file_bufsize = total_bytes_read;
  283. }
  284. else {
  285. total_bytes_read += bytes_read;
  286. }
  287. }
  288. /* Null terminate the buffer */
  289. ca_file_buffer[ca_file_bufsize] = '\0';
  290. result = add_certs_data_to_store(trust_store,
  291. ca_file_buffer, ca_file_bufsize,
  292. ca_file,
  293. data);
  294. cleanup:
  295. if(ca_file_handle != INVALID_HANDLE_VALUE) {
  296. CloseHandle(ca_file_handle);
  297. }
  298. Curl_safefree(ca_file_buffer);
  299. curlx_unicodefree(ca_file_tstr);
  300. return result;
  301. }
  302. /*
  303. * Returns the number of characters necessary to populate all the host_names.
  304. * If host_names is not NULL, populate it with all the host names. Each string
  305. * in the host_names is null-terminated and the last string is double
  306. * null-terminated. If no DNS names are found, a single null-terminated empty
  307. * string is returned.
  308. */
  309. static DWORD cert_get_name_string(struct Curl_easy *data,
  310. CERT_CONTEXT *cert_context,
  311. LPTSTR host_names,
  312. DWORD length)
  313. {
  314. DWORD actual_length = 0;
  315. BOOL compute_content = FALSE;
  316. CERT_INFO *cert_info = NULL;
  317. CERT_EXTENSION *extension = NULL;
  318. CRYPT_DECODE_PARA decode_para = {0, 0, 0};
  319. CERT_ALT_NAME_INFO *alt_name_info = NULL;
  320. DWORD alt_name_info_size = 0;
  321. BOOL ret_val = FALSE;
  322. LPTSTR current_pos = NULL;
  323. DWORD i;
  324. /* CERT_NAME_SEARCH_ALL_NAMES_FLAG is available from Windows 8 onwards. */
  325. if(curlx_verify_windows_version(6, 2, 0, PLATFORM_WINNT,
  326. VERSION_GREATER_THAN_EQUAL)) {
  327. #ifdef CERT_NAME_SEARCH_ALL_NAMES_FLAG
  328. /* CertGetNameString will provide the 8-bit character string without
  329. * any decoding */
  330. DWORD name_flags =
  331. CERT_NAME_DISABLE_IE4_UTF8_FLAG | CERT_NAME_SEARCH_ALL_NAMES_FLAG;
  332. actual_length = CertGetNameString(cert_context,
  333. CERT_NAME_DNS_TYPE,
  334. name_flags,
  335. NULL,
  336. host_names,
  337. length);
  338. return actual_length;
  339. #endif
  340. }
  341. compute_content = host_names != NULL && length != 0;
  342. /* Initialize default return values. */
  343. actual_length = 1;
  344. if(compute_content) {
  345. *host_names = '\0';
  346. }
  347. if(!cert_context) {
  348. failf(data, "schannel: Null certificate context.");
  349. return actual_length;
  350. }
  351. cert_info = cert_context->pCertInfo;
  352. if(!cert_info) {
  353. failf(data, "schannel: Null certificate info.");
  354. return actual_length;
  355. }
  356. extension = CertFindExtension(szOID_SUBJECT_ALT_NAME2,
  357. cert_info->cExtension,
  358. cert_info->rgExtension);
  359. if(!extension) {
  360. failf(data, "schannel: CertFindExtension() returned no extension.");
  361. return actual_length;
  362. }
  363. decode_para.cbSize = sizeof(CRYPT_DECODE_PARA);
  364. ret_val =
  365. CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
  366. szOID_SUBJECT_ALT_NAME2,
  367. extension->Value.pbData,
  368. extension->Value.cbData,
  369. CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG,
  370. &decode_para,
  371. &alt_name_info,
  372. &alt_name_info_size);
  373. if(!ret_val) {
  374. failf(data,
  375. "schannel: CryptDecodeObjectEx() returned no alternate name "
  376. "information.");
  377. return actual_length;
  378. }
  379. current_pos = host_names;
  380. /* Iterate over the alternate names and populate host_names. */
  381. for(i = 0; i < alt_name_info->cAltEntry; i++) {
  382. const CERT_ALT_NAME_ENTRY *entry = &alt_name_info->rgAltEntry[i];
  383. wchar_t *dns_w = NULL;
  384. size_t current_length = 0;
  385. if(entry->dwAltNameChoice != CERT_ALT_NAME_DNS_NAME) {
  386. continue;
  387. }
  388. if(!entry->pwszDNSName) {
  389. infof(data, "schannel: Empty DNS name.");
  390. continue;
  391. }
  392. current_length = wcslen(entry->pwszDNSName) + 1;
  393. if(!compute_content) {
  394. actual_length += (DWORD)current_length;
  395. continue;
  396. }
  397. /* Sanity check to prevent buffer overrun. */
  398. if((actual_length + current_length) > length) {
  399. failf(data, "schannel: Not enough memory to list all host names.");
  400. break;
  401. }
  402. dns_w = entry->pwszDNSName;
  403. /* pwszDNSName is in ia5 string format and hence doesn't contain any
  404. * non-ascii characters. */
  405. while(*dns_w != '\0') {
  406. *current_pos++ = (char)(*dns_w++);
  407. }
  408. *current_pos++ = '\0';
  409. actual_length += (DWORD)current_length;
  410. }
  411. if(compute_content) {
  412. /* Last string has double null-terminator. */
  413. *current_pos = '\0';
  414. }
  415. return actual_length;
  416. }
  417. static CURLcode verify_host(struct Curl_easy *data,
  418. CERT_CONTEXT *pCertContextServer,
  419. const char *conn_hostname)
  420. {
  421. CURLcode result = CURLE_PEER_FAILED_VERIFICATION;
  422. TCHAR *cert_hostname_buff = NULL;
  423. size_t cert_hostname_buff_index = 0;
  424. size_t hostlen = strlen(conn_hostname);
  425. DWORD len = 0;
  426. DWORD actual_len = 0;
  427. /* Determine the size of the string needed for the cert hostname */
  428. len = cert_get_name_string(data, pCertContextServer, NULL, 0);
  429. if(len == 0) {
  430. failf(data,
  431. "schannel: CertGetNameString() returned no "
  432. "certificate name information");
  433. result = CURLE_PEER_FAILED_VERIFICATION;
  434. goto cleanup;
  435. }
  436. /* CertGetNameString guarantees that the returned name will not contain
  437. * embedded null bytes. This appears to be undocumented behavior.
  438. */
  439. cert_hostname_buff = (LPTSTR)malloc(len * sizeof(TCHAR));
  440. if(!cert_hostname_buff) {
  441. result = CURLE_OUT_OF_MEMORY;
  442. goto cleanup;
  443. }
  444. actual_len = cert_get_name_string(
  445. data, pCertContextServer, (LPTSTR)cert_hostname_buff, len);
  446. /* Sanity check */
  447. if(actual_len != len) {
  448. failf(data,
  449. "schannel: CertGetNameString() returned certificate "
  450. "name information of unexpected size");
  451. result = CURLE_PEER_FAILED_VERIFICATION;
  452. goto cleanup;
  453. }
  454. /* If HAVE_CERT_NAME_SEARCH_ALL_NAMES is available, the output
  455. * will contain all DNS names, where each name is null-terminated
  456. * and the last DNS name is double null-terminated. Due to this
  457. * encoding, use the length of the buffer to iterate over all names.
  458. */
  459. result = CURLE_PEER_FAILED_VERIFICATION;
  460. while(cert_hostname_buff_index < len &&
  461. cert_hostname_buff[cert_hostname_buff_index] != TEXT('\0') &&
  462. result == CURLE_PEER_FAILED_VERIFICATION) {
  463. char *cert_hostname;
  464. /* Comparing the cert name and the connection hostname encoded as UTF-8
  465. * is acceptable since both values are assumed to use ASCII
  466. * (or some equivalent) encoding
  467. */
  468. cert_hostname = curlx_convert_tchar_to_UTF8(
  469. &cert_hostname_buff[cert_hostname_buff_index]);
  470. if(!cert_hostname) {
  471. result = CURLE_OUT_OF_MEMORY;
  472. }
  473. else {
  474. if(Curl_cert_hostcheck(cert_hostname, strlen(cert_hostname),
  475. conn_hostname, hostlen)) {
  476. infof(data,
  477. "schannel: connection hostname (%s) validated "
  478. "against certificate name (%s)",
  479. conn_hostname, cert_hostname);
  480. result = CURLE_OK;
  481. }
  482. else {
  483. size_t cert_hostname_len;
  484. infof(data,
  485. "schannel: connection hostname (%s) did not match "
  486. "against certificate name (%s)",
  487. conn_hostname, cert_hostname);
  488. cert_hostname_len =
  489. _tcslen(&cert_hostname_buff[cert_hostname_buff_index]);
  490. /* Move on to next cert name */
  491. cert_hostname_buff_index += cert_hostname_len + 1;
  492. result = CURLE_PEER_FAILED_VERIFICATION;
  493. }
  494. curlx_unicodefree(cert_hostname);
  495. }
  496. }
  497. if(result == CURLE_PEER_FAILED_VERIFICATION) {
  498. failf(data,
  499. "schannel: CertGetNameString() failed to match "
  500. "connection hostname (%s) against server certificate names",
  501. conn_hostname);
  502. }
  503. else if(result != CURLE_OK)
  504. failf(data, "schannel: server certificate name verification failed");
  505. cleanup:
  506. Curl_safefree(cert_hostname_buff);
  507. return result;
  508. }
  509. CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
  510. struct Curl_easy *data)
  511. {
  512. struct ssl_connect_data *connssl = cf->ctx;
  513. struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
  514. struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
  515. SECURITY_STATUS sspi_status;
  516. CURLcode result = CURLE_OK;
  517. CERT_CONTEXT *pCertContextServer = NULL;
  518. const CERT_CHAIN_CONTEXT *pChainContext = NULL;
  519. HCERTCHAINENGINE cert_chain_engine = NULL;
  520. HCERTSTORE trust_store = NULL;
  521. DEBUGASSERT(BACKEND);
  522. sspi_status =
  523. s_pSecFn->QueryContextAttributes(&BACKEND->ctxt->ctxt_handle,
  524. SECPKG_ATTR_REMOTE_CERT_CONTEXT,
  525. &pCertContextServer);
  526. if((sspi_status != SEC_E_OK) || !pCertContextServer) {
  527. char buffer[STRERROR_LEN];
  528. failf(data, "schannel: Failed to read remote certificate context: %s",
  529. Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
  530. result = CURLE_PEER_FAILED_VERIFICATION;
  531. }
  532. if(result == CURLE_OK &&
  533. (conn_config->CAfile || conn_config->ca_info_blob) &&
  534. BACKEND->use_manual_cred_validation) {
  535. /*
  536. * Create a chain engine that uses the certificates in the CA file as
  537. * trusted certificates. This is only supported on Windows 7+.
  538. */
  539. if(curlx_verify_windows_version(6, 1, 0, PLATFORM_WINNT,
  540. VERSION_LESS_THAN)) {
  541. failf(data, "schannel: this version of Windows is too old to support "
  542. "certificate verification via CA bundle file.");
  543. result = CURLE_SSL_CACERT_BADFILE;
  544. }
  545. else {
  546. /* Open the certificate store */
  547. trust_store = CertOpenStore(CERT_STORE_PROV_MEMORY,
  548. 0,
  549. (HCRYPTPROV)NULL,
  550. CERT_STORE_CREATE_NEW_FLAG,
  551. NULL);
  552. if(!trust_store) {
  553. char buffer[STRERROR_LEN];
  554. failf(data, "schannel: failed to create certificate store: %s",
  555. Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
  556. result = CURLE_SSL_CACERT_BADFILE;
  557. }
  558. else {
  559. const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
  560. if(ca_info_blob) {
  561. result = add_certs_data_to_store(trust_store,
  562. (const char *)ca_info_blob->data,
  563. ca_info_blob->len,
  564. "(memory blob)",
  565. data);
  566. }
  567. else {
  568. result = add_certs_file_to_store(trust_store,
  569. conn_config->CAfile,
  570. data);
  571. }
  572. }
  573. }
  574. if(result == CURLE_OK) {
  575. struct cert_chain_engine_config_win7 engine_config;
  576. BOOL create_engine_result;
  577. memset(&engine_config, 0, sizeof(engine_config));
  578. engine_config.cbSize = sizeof(engine_config);
  579. engine_config.hExclusiveRoot = trust_store;
  580. /* CertCreateCertificateChainEngine will check the expected size of the
  581. * CERT_CHAIN_ENGINE_CONFIG structure and fail if the specified size
  582. * does not match the expected size. When this occurs, it indicates that
  583. * CAINFO is not supported on the version of Windows in use.
  584. */
  585. create_engine_result =
  586. CertCreateCertificateChainEngine(
  587. (CERT_CHAIN_ENGINE_CONFIG *)&engine_config, &cert_chain_engine);
  588. if(!create_engine_result) {
  589. char buffer[STRERROR_LEN];
  590. failf(data,
  591. "schannel: failed to create certificate chain engine: %s",
  592. Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
  593. result = CURLE_SSL_CACERT_BADFILE;
  594. }
  595. }
  596. }
  597. if(result == CURLE_OK) {
  598. CERT_CHAIN_PARA ChainPara;
  599. memset(&ChainPara, 0, sizeof(ChainPara));
  600. ChainPara.cbSize = sizeof(ChainPara);
  601. if(!CertGetCertificateChain(cert_chain_engine,
  602. pCertContextServer,
  603. NULL,
  604. pCertContextServer->hCertStore,
  605. &ChainPara,
  606. (ssl_config->no_revoke ? 0 :
  607. CERT_CHAIN_REVOCATION_CHECK_CHAIN),
  608. NULL,
  609. &pChainContext)) {
  610. char buffer[STRERROR_LEN];
  611. failf(data, "schannel: CertGetCertificateChain failed: %s",
  612. Curl_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
  613. pChainContext = NULL;
  614. result = CURLE_PEER_FAILED_VERIFICATION;
  615. }
  616. if(result == CURLE_OK) {
  617. CERT_SIMPLE_CHAIN *pSimpleChain = pChainContext->rgpChain[0];
  618. DWORD dwTrustErrorMask = ~(DWORD)(CERT_TRUST_IS_NOT_TIME_NESTED);
  619. dwTrustErrorMask &= pSimpleChain->TrustStatus.dwErrorStatus;
  620. if(data->set.ssl.revoke_best_effort) {
  621. /* Ignore errors when root certificates are missing the revocation
  622. * list URL, or when the list could not be downloaded because the
  623. * server is currently unreachable. */
  624. dwTrustErrorMask &= ~(DWORD)(CERT_TRUST_REVOCATION_STATUS_UNKNOWN |
  625. CERT_TRUST_IS_OFFLINE_REVOCATION);
  626. }
  627. if(dwTrustErrorMask) {
  628. if(dwTrustErrorMask & CERT_TRUST_IS_REVOKED)
  629. failf(data, "schannel: CertGetCertificateChain trust error"
  630. " CERT_TRUST_IS_REVOKED");
  631. else if(dwTrustErrorMask & CERT_TRUST_IS_PARTIAL_CHAIN)
  632. failf(data, "schannel: CertGetCertificateChain trust error"
  633. " CERT_TRUST_IS_PARTIAL_CHAIN");
  634. else if(dwTrustErrorMask & CERT_TRUST_IS_UNTRUSTED_ROOT)
  635. failf(data, "schannel: CertGetCertificateChain trust error"
  636. " CERT_TRUST_IS_UNTRUSTED_ROOT");
  637. else if(dwTrustErrorMask & CERT_TRUST_IS_NOT_TIME_VALID)
  638. failf(data, "schannel: CertGetCertificateChain trust error"
  639. " CERT_TRUST_IS_NOT_TIME_VALID");
  640. else if(dwTrustErrorMask & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
  641. failf(data, "schannel: CertGetCertificateChain trust error"
  642. " CERT_TRUST_REVOCATION_STATUS_UNKNOWN");
  643. else
  644. failf(data, "schannel: CertGetCertificateChain error mask: 0x%08x",
  645. dwTrustErrorMask);
  646. result = CURLE_PEER_FAILED_VERIFICATION;
  647. }
  648. }
  649. }
  650. if(result == CURLE_OK) {
  651. if(conn_config->verifyhost) {
  652. result = verify_host(data, pCertContextServer, connssl->hostname);
  653. }
  654. }
  655. if(cert_chain_engine) {
  656. CertFreeCertificateChainEngine(cert_chain_engine);
  657. }
  658. if(trust_store) {
  659. CertCloseStore(trust_store, 0);
  660. }
  661. if(pChainContext)
  662. CertFreeCertificateChain(pChainContext);
  663. if(pCertContextServer)
  664. CertFreeCertificateContext(pCertContextServer);
  665. return result;
  666. }
  667. #endif /* HAS_MANUAL_VERIFY_API */
  668. #endif /* USE_SCHANNEL */