Changeset 95681 in vbox

Timestamp:

Jul 17, 2022 6:39:27 PM (3 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

152331

Message:

IPRT/RTCrStoreCreateSnapshotById: Added two more store IDs for intermediate CAs so RTSignTool can search these when signing, only implemented for windows. Fixed an incorrect handle check in worker (windows). bugref:8691

Location:

trunk

Files:

• include/iprt/crypto/store.h (modified) (2 diffs)
• src/VBox/Runtime/r3/win/RTCrStoreCreateSnapshotById-win.cpp (modified) (2 diffs)

trunk/include/iprt/crypto/store.h

@@ -133 +133 @@
      * and certificates. */
     RTCRSTOREID_SYSTEM_TRUSTED_CAS_AND_CERTIFICATES,
+    /** Open the certificate store of the current user containing intermediate CAs.
+     * @remarks This may or may not include all the certificates in the system
+     *          store, that's host dependent.  So, you better look in both. */
+    RTCRSTOREID_USER_INTERMEDIATE_CAS,
+    /** Open the certificate store of the system containg intermediate CAs. */
+    RTCRSTOREID_SYSTEM_INTERMEDIATE_CAS,
     /** End of valid values. */
     RTCRSTOREID_END,
@@ -146 +152 @@
  *
  * @returns IPRT status code.
- * @retval  VWRN_ALREADY_EXISTS if the certificate is already present and
- *          RTCRCERTCTX_F_ADD_IF_NOT_FOUND was specified.
  * @param   phStore             Where to return the store handle. Use
  *                              RTCrStoreRelease to release it.

trunk/src/VBox/Runtime/r3/win/RTCrStoreCreateSnapshotById-win.cpp

@@ -57 +57 @@
     HCERTSTORE hNativeStore = pfnOpenStore(CERT_STORE_PROV_SYSTEM_W, PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
                                            NULL /* hCryptProv = default */, fStore | fOpenStore, pwszStoreName);
-    if (hStore)
+    if (hNativeStore)
     {
         PCCERT_CONTEXT pCurCtx = NULL;
@@ -137 +137 @@
                  * Do the work.
                  */
+                DWORD fStore = CERT_SYSTEM_STORE_CURRENT_USER;
                 switch (enmStoreId)
                 {
+                    case RTCRSTOREID_SYSTEM_TRUSTED_CAS_AND_CERTIFICATES:
+                    case RTCRSTOREID_SYSTEM_INTERMEDIATE_CAS:
+                        fStore = CERT_SYSTEM_STORE_LOCAL_MACHINE;
+                        RT_FALL_THRU();
                     case RTCRSTOREID_USER_TRUSTED_CAS_AND_CERTIFICATES:
-                    case RTCRSTOREID_SYSTEM_TRUSTED_CAS_AND_CERTIFICATES:
+                    case RTCRSTOREID_USER_INTERMEDIATE_CAS:
                     {
-                        DWORD fStore = enmStoreId == RTCRSTOREID_USER_TRUSTED_CAS_AND_CERTIFICATES
-                                     ? CERT_SYSTEM_STORE_CURRENT_USER : CERT_SYSTEM_STORE_LOCAL_MACHINE;
-                        static PCRTUTF16 const s_apwszStores[] =  { L"AuthRoot", L"CA", L"MY", L"Root" };
-                        for (uint32_t i = 0; i < RT_ELEMENTS(s_apwszStores); i++)
-                            rc = rtCrStoreAddCertsFromNative(hStore, fStore, s_apwszStores[i], pfnOpenStore, pfnCloseStore,
+                        /** @todo CA and MY in s_apwszRootStores are _very_ questionable!!! However,
+                         * curl may need them  to work correct and it doesn't seem to have any
+                         * intermediate ca file. :/ */
+                        static PCRTUTF16 const s_apwszRootStores[] = { L"AuthRoot", L"CA", L"MY", L"Root" };
+                        static PCRTUTF16 const s_apwszIntermediateStores[] = { L"CA", L"MY" };
+                        PCRTUTF16 const *papwszStores = s_apwszRootStores;
+                        uint32_t         cStores      = RT_ELEMENTS(s_apwszRootStores);
+                        if (enmStoreId == RTCRSTOREID_USER_INTERMEDIATE_CAS || enmStoreId == RTCRSTOREID_SYSTEM_INTERMEDIATE_CAS)
+                        {
+                            papwszStores = s_apwszIntermediateStores;
+                            cStores      = RT_ELEMENTS(s_apwszIntermediateStores);
+                        }
+
+                        for (uint32_t i = 0; i < cStores; i++)
+                            rc = rtCrStoreAddCertsFromNative(hStore, fStore, papwszStores[i], pfnOpenStore, pfnCloseStore,
                                                              pfnEnumCerts, rc, pErrInfo);
                         break;