OS_Develop/Windows-Server-2003
OS_Develop/Windows-Server-2003
1
0
Fork 0
Code Pull Requests Activity
master
Windows-Server-2003/base/pnp/setupapi/fileutil.c

7117 lines
249 KiB
C
Raw Permalink Blame History

/*++
Copyright (c) Microsoft Corporation. All rights reserved.
Module Name:
fileutil.c
Abstract:
File-related functions for Windows NT Setup API dll.
Author:
Ted Miller (tedm) 11-Jan-1995
Revision History:
--*/
#include "precomp.h"
#pragma hdrstop
#include <ntverp.h>
//
// This guid is used for file signing/verification.
//
GUID DriverVerifyGuid = DRIVER_ACTION_VERIFY;
GUID AuthenticodeVerifyGuid = WINTRUST_ACTION_GENERIC_VERIFY_V2;
//
// Instantiate exception class GUID.
//
#include <initguid.h>
DEFINE_GUID( GUID_DEVCLASS_WINDOWS_COMPONENT_PUBLISHER, 0xF5776D81L, 0xAE53, 0x4935, 0x8E, 0x84, 0xB0, 0xB2, 0x83, 0xD8, 0xBC, 0xEF );
// Bit 0 indicates policy for filters (0 = critical, 1 = non-critical)
#define DDB_DRIVER_POLICY_CRITICAL_BIT (1 << 0)
// Bit 1 indicates policy for user-mode setup blocking (0 = block, 1 = no-block)
#define DDB_DRIVER_POLICY_SETUP_NO_BLOCK_BIT (1 << 1)
#define MIN_HASH_LEN 16
#define MAX_HASH_LEN 20
//
// Global list of device setup classes subject to driver signing policy, along
// with validation platform overrides (where applicable).
//
DRVSIGN_POLICY_LIST GlobalDrvSignPolicyList;
//
// private function prototypes
//
BOOL
ClassGuidInDrvSignPolicyList(
IN PSETUP_LOG_CONTEXT LogContext, OPTIONAL
IN CONST GUID *DeviceSetupClassGuid, OPTIONAL
OUT PSP_ALTPLATFORM_INFO_V2 *ValidationPlatform OPTIONAL
);
DWORD
_VerifyCatalogFile(
IN PSETUP_LOG_CONTEXT LogContext,
IN LPCTSTR CatalogFullPath,
IN PSP_ALTPLATFORM_INFO_V2 AltPlatformInfo, OPTIONAL
IN BOOL UseAuthenticodePolicy,
IN OUT HCERTSTORE *hStoreTrustedPublisher, OPTIONAL
OUT HANDLE *hWVTStateData OPTIONAL
);
BOOL
pSetupIsAuthenticodePublisherTrusted(
IN PCCERT_CONTEXT pcSignerCertContext,
IN OUT HCERTSTORE *hStoreTrustedPublisher OPTIONAL
);
BOOL
IsAutoCertInstallAllowed(
VOID
);
DWORD
pSetupInstallCertificate(
IN PCCERT_CONTEXT pcSignerCertContext
);
//
// helper to determine log level to use
//
__inline
DWORD
GetCatLogLevel(
IN DWORD Err,
IN BOOL DriverLevel
)
{
switch(Err) {
case ERROR_FILE_NOT_FOUND:
case ERROR_PATH_NOT_FOUND:
case E_NOTIMPL:
return (DriverLevel ? DRIVER_LOG_VVERBOSE : SETUP_LOG_VVERBOSE);
default:
return (DriverLevel ? DRIVER_LOG_INFO : SETUP_LOG_INFO);
}
}
DWORD
ReadAsciiOrUnicodeTextFile(
IN HANDLE FileHandle,
OUT PTEXTFILE_READ_BUFFER Result,
IN PSETUP_LOG_CONTEXT LogContext OPTIONAL
)
/*++
Routine Description:
Read in a text file that may be in either ascii or unicode format.
If the file is ascii, it is assumed to be ANSI format and is converted
to Unicode.
Arguments:
FileHandle - Supplies the handle of the text file to be read.
Result - supplies the address of a TEXTFILE_READ_BUFFER structure that
receives information about the text file buffer read. The structure
is defined as follows:
typedef struct _TEXTFILE_READ_BUFFER {
PCTSTR TextBuffer;
DWORD TextBufferSize;
HANDLE FileHandle;
HANDLE MappingHandle;
PVOID ViewAddress;
} TEXTFILE_READ_BUFFER, *PTEXTFILE_READ_BUFFER;
TextBuffer - pointer to the read-only character string containing
the entire text of the file.
(NOTE: If the file is a Unicode file with a Byte Order Mark
prefix, this Unicode character is not included in the returned
buffer.)
TextBufferSize - size of the TextBuffer (in characters).
FileHandle - If this is a valid handle (i.e., it's not equal to
INVALID_HANDLE_VALUE), then the file was already the native
character type, so the TextBuffer is simply the mapped-in image
of the file. This field is reserved for use by the
DestroyTextFileReadBuffer routine, and should not be accessed.
MappingHandle - If FileHandle is valid, then this contains the
mapping handle for the file image mapping.
This field is reserved for use by the DestroyTextFileReadBuffer
routine, and should not be accessed.
ViewAddress - If FileHandle is valid, then this contains the
starting memory address where the file image was mapped in.
This field is reserved for use by the DestroyTextFileReadBuffer
routine, and should not be accessed.
LogContext - for logging of errors/tracing
Return Value:
Win32 error value indicating the outcome.
Remarks:
Upon return from this routine, the caller MUST NOT attempt to close
FileHandle. This routine with either close the handle itself (after it's
finished with it, or upon error), or it will store the handle away in the
TEXTFILE_READ_BUFFER struct, to be later closed via
DestroyTextFileReadBuffer().
--*/
{
DWORD rc;
DWORD FileSize;
HANDLE MappingHandle;
PVOID ViewAddress, TextStartAddress;
BOOL IsNativeChar;
UINT SysCodePage = CP_ACP;
//
// Map the file for read access.
//
rc = pSetupMapFileForRead(
FileHandle,
&FileSize,
&MappingHandle,
&ViewAddress
);
if(rc != NO_ERROR) {
//
// We couldn't map the file--close the file handle now.
//
CloseHandle(FileHandle);
} else {
//
// Determine whether the file is unicode. Guard with try/except in
// case we get an inpage error.
//
try {
//
// Check to see if the file starts with a Unicode Byte Order Mark
// (BOM) character (0xFEFF). If so, then we know that the file
// is Unicode, and don't have to go through the slow process of
// trying to figure it out.
//
TextStartAddress = ViewAddress;
if((FileSize >= sizeof(WCHAR)) && (*(PWCHAR)TextStartAddress == 0xFEFF)) {
//
// The file has the BOM prefix. Adjust the pointer to the
// start of the text, so that we don't include the marker
// in the text buffer we return.
//
IsNativeChar = TRUE;
((PWCHAR)TextStartAddress)++;
FileSize -= sizeof(WCHAR);
} else {
IsNativeChar = IsTextUnicode(TextStartAddress,FileSize,NULL);
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_READ_FAULT, &rc);
}
if(rc == NO_ERROR) {
if(IsNativeChar) {
//
// No conversion is required--we'll just use the mapped-in
// image in memory.
//
Result->TextBuffer = TextStartAddress;
Result->TextBufferSize = FileSize / sizeof(TCHAR);
Result->FileHandle = FileHandle;
Result->MappingHandle = MappingHandle;
Result->ViewAddress = ViewAddress;
} else {
DWORD NativeCharCount;
PTCHAR Buffer;
//
// Need to convert the file to the native character type.
// Allocate a buffer that is maximally sized.
// The maximum size of the unicode text is
// double the size of the oem text, and would occur
// when each oem character is single-byte.
//
if(Buffer = MyMalloc(FileSize * sizeof(TCHAR))) {
try {
//
// FUTURE-1999/09/01-JamieHun -- Implement ANSI Inf Language=xxxx
// Need to come up with a better way of determining
// what code-page to interpret INF file under.
// Currently we use the install-base.
//
SysCodePage = CP_ACP;
rc = GLE_FN_CALL(0,
NativeCharCount = MultiByteToWideChar(
SysCodePage,
MB_PRECOMPOSED,
TextStartAddress,
FileSize,
Buffer,
FileSize)
);
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(),
ERROR_READ_FAULT,
&rc
);
}
} else {
rc = ERROR_NOT_ENOUGH_MEMORY;
}
if(rc == NO_ERROR) {
//
// If the converted buffer doesn't require the entire block
// we allocated, attempt to reallocate the buffer to its
// correct size. We don't care if this fails, since the
// buffer we have is perfectly fine (just bigger than we
// need).
//
if(!(Result->TextBuffer = MyRealloc(Buffer, NativeCharCount * sizeof(TCHAR)))) {
Result->TextBuffer = Buffer;
}
Result->TextBufferSize = NativeCharCount;
Result->FileHandle = INVALID_HANDLE_VALUE;
} else {
//
// Free the buffer, if it was previously allocated.
//
if(Buffer) {
MyFree(Buffer);
}
}
}
}
//
// If the file was already in native character form and we didn't
// enounter any errors, then we don't want to close it, because we
// use the mapped-in view directly.
//
if((rc != NO_ERROR) || !IsNativeChar) {
pSetupUnmapAndCloseFile(FileHandle, MappingHandle, ViewAddress);
}
}
return rc;
}
BOOL
DestroyTextFileReadBuffer(
IN PTEXTFILE_READ_BUFFER ReadBuffer
)
/*++
Routine Description:
Destroy a textfile read buffer created by ReadAsciiOrUnicodeTextFile.
Arguments:
ReadBuffer - supplies the address of a TEXTFILE_READ_BUFFER structure
for the buffer to be destroyed.
Return Value:
BOOLean value indicating success or failure.
--*/
{
//
// If our ReadBuffer structure has a valid FileHandle, then we must
// unmap and close the file, otherwise, we simply need to free the
// allocated buffer.
//
if(ReadBuffer->FileHandle != INVALID_HANDLE_VALUE) {
return pSetupUnmapAndCloseFile(ReadBuffer->FileHandle,
ReadBuffer->MappingHandle,
ReadBuffer->ViewAddress
);
} else {
MyFree(ReadBuffer->TextBuffer);
return TRUE;
}
}
BOOL
GetVersionInfoFromImage(
IN PCTSTR FileName,
OUT PDWORDLONG Version,
OUT LANGID *Language
)
/*++
Routine Description:
Retrieve file version and language info from a file.
The version is specified in the dwFileVersionMS and dwFileVersionLS fields
of a VS_FIXEDFILEINFO, as filled in by the win32 version APIs. For the
language we look at the translation table in the version resources and
assume that the first langid/codepage pair specifies the language.
If the file is not a coff image or does not have version resources,
the function fails. The function does not fail if we are able to retrieve
the version but not the language.
Arguments:
FileName - supplies the full path of the file whose version data is desired.
Version - receives the version stamp of the file. If the file is not a coff
image or does not contain the appropriate version resource data, the
function fails.
Language - receives the language id of the file. If the file is not a coff
image or does not contain the appropriate version resource data, this
will be 0 and the function succeeds.
Return Value:
TRUE if we were able to retreive at least the version stamp.
FALSE otherwise.
--*/
{
DWORD d;
PVOID VersionBlock = NULL;
VS_FIXEDFILEINFO *FixedVersionInfo;
UINT DataLength;
BOOL b;
PWORD Translation;
DWORD Ignored;
//
// Assume failure
//
b = FALSE;
try {
//
// Get the size of version info block.
//
d = GetFileVersionInfoSize((PTSTR)FileName, &Ignored);
if(!d) {
leave;
}
//
// Allocate memory block of sufficient size to hold version info block
//
VersionBlock = MyMalloc(d);
if(!VersionBlock) {
leave;
}
//
// Get the version block from the file.
//
if(!GetFileVersionInfo((PTSTR)FileName, 0, d, VersionBlock)) {
leave;
}
//
// Get fixed version info.
//
if(VerQueryValue(VersionBlock,
TEXT("\\"),
&FixedVersionInfo,
&DataLength)) {
//
// If we get here, we declare success, even if there is no
// language.
//
b = TRUE;
//
// Return version to caller.
//
*Version = (((DWORDLONG)FixedVersionInfo->dwFileVersionMS) << 32)
+ FixedVersionInfo->dwFileVersionLS;
//
// Attempt to get language of file. We'll simply ask for the
// translation table and use the first language id we find in there
// as *the* language of the file.
//
// The translation table consists of LANGID/Codepage pairs.
//
if(VerQueryValue(VersionBlock,
TEXT("\\VarFileInfo\\Translation"),
&Translation,
&DataLength)
&& (DataLength >= (2*sizeof(WORD)))) {
*Language = Translation[0];
} else {
//
// No language
//
*Language = 0;
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_READ_FAULT, NULL);
b = FALSE;
}
if(VersionBlock) {
MyFree(VersionBlock);
}
return b;
}
BOOL
pSetupGetVersionInfoFromImage(
IN PCTSTR FileName,
OUT PULARGE_INTEGER Version,
OUT LANGID *Language
)
/*++
Routine Description:
See GetVersionInfoFromImage for description
Semi-public version that uses the more friendly ULARGE_INTEGER
Arguments:
FileName - supplies the full path of the file whose version data is
desired.
Version - receives the version stamp of the file. If the file is not a coff
image or does not contain the appropriate version resource data, the
function fails.
Language - receives the language id of the file. If the file is not a coff
image or does not contain the appropriate version resource data, this
will be 0 and the function succeeds.
Return Value:
TRUE if we were able to retreive at least the version stamp.
FALSE otherwise.
--*/
{
DWORDLONG privateVersion=0;
BOOL result;
result = GetVersionInfoFromImage(FileName, &privateVersion, Language);
if(result && Version) {
Version->QuadPart = privateVersion;
}
return result;
}
BOOL
AddFileTimeSeconds(
IN const FILETIME *Base,
OUT FILETIME *Target,
IN INT Seconds
)
/*++
Routine Description:
Bias the filetime by specified number of seconds
Arguments:
Base - original file time
Target - new file time
Seconds - number of seconds to bias it by
Return Value:
If successful, returns TRUE
If out of bounds, returns FALSE and Target set to be same as Base
--*/
{
ULARGE_INTEGER Fuddle;
//
// bias off FileTimeThen as it's the greater time
//
Fuddle.LowPart = Base->dwLowDateTime;
Fuddle.HighPart = Base->dwHighDateTime;
Fuddle.QuadPart += 10000000i64 * Seconds;
if(Fuddle.HighPart < 0x80000000) {
Target->dwHighDateTime = Fuddle.HighPart;
Target->dwLowDateTime = Fuddle.LowPart;
return TRUE;
} else {
*Target = *Base;
return FALSE;
}
}
DWORD
GetSetFileTimestamp(
IN PCTSTR FileName,
IN OUT FILETIME *CreateTime, OPTIONAL
OUT FILETIME *AccessTime, OPTIONAL
OUT FILETIME *WriteTime, OPTIONAL
IN BOOL Set
)
/*++
Routine Description:
Get or set a file's timestamp values.
Arguments:
FileName - supplies full path of file to get or set timestamps
CreateTime - if specified and the underlying filesystem supports it,
receives the creation time of the file.
AccessTime - if specified and the underlying filesystem supports it,
receives the last access time of the file.
WriteTime - if specified, receives the last write time of the file.
Set - if TRUE, set the file's timestamp(s) to the caller-supplied value(s).
Otherwise, simply retrieve the value(s).
Return Value:
If successful, returns NO_ERROR, otherwise returns the Win32 error
indicating the cause of failure.
--*/
{
HANDLE h = INVALID_HANDLE_VALUE;
DWORD d;
try {
d = GLE_FN_CALL(INVALID_HANDLE_VALUE,
h = CreateFile(FileName,
Set ? GENERIC_WRITE : GENERIC_READ,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
0,
NULL)
);
if(d != NO_ERROR) {
leave;
}
if(Set) {
d = GLE_FN_CALL(FALSE,
SetFileTime(h, CreateTime, AccessTime, WriteTime)
);
} else {
d = GLE_FN_CALL(FALSE,
GetFileTime(h, CreateTime, AccessTime, WriteTime)
);
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_READ_FAULT, &d);
}
if(h != INVALID_HANDLE_VALUE) {
CloseHandle(h);
}
return d;
}
DWORD
RetreiveFileSecurity(
IN PCTSTR FileName,
OUT PSECURITY_DESCRIPTOR *SecurityDescriptor
)
/*++
Routine Description:
Retrieve security information from a file and place it into a buffer.
Arguments:
FileName - supplies name of file whose security information is desired.
SecurityDescriptor - If the function is successful, receives pointer
to buffer containing security information for the file. The pointer
may be NULL, indicating that there is no security information
associated with the file or that the underlying filesystem does not
support file security.
Return Value:
Win32 error code indicating outcome. If NO_ERROR check the value returned
in SecurityDescriptor.
The caller can free the buffer with MyFree() when done with it.
--*/
{
DWORD d;
DWORD BytesRequired;
PSECURITY_DESCRIPTOR p = NULL;
try {
BytesRequired = 1024; // start out with a reasonably-sized buffer
while(NULL != (p = MyMalloc(BytesRequired))) {
//
// Get the security.
//
d = GLE_FN_CALL(FALSE,
GetFileSecurity(
FileName,
OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
p,
BytesRequired,
&BytesRequired)
);
if(d == NO_ERROR) {
*SecurityDescriptor = p;
p = NULL; // so we won't try to free it later
leave;
}
//
// Return an error code, unless we just need a bigger buffer
//
MyFree(p);
p = NULL;
if(d != ERROR_INSUFFICIENT_BUFFER) {
leave;
}
//
// Otherwise, we'll try again with a bigger buffer
//
}
//
// If we get to here, then we failed due to insufficient memory.
//
d = ERROR_NOT_ENOUGH_MEMORY;
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_READ_FAULT, &d);
}
if(p) {
MyFree(p);
}
return d;
}
DWORD
StampFileSecurity(
IN PCTSTR FileName,
IN PSECURITY_DESCRIPTOR SecurityInfo
)
/*++
Routine Description:
Set security information on a file.
Arguments:
FileName - supplies name of file whose security information is desired.
SecurityDescriptor - supplies pointer to buffer containing security
information for the file. This buffer should have been returned by a
call to RetreiveFileSecurity. If the underlying filesystem does not
support file security, the function fails.
Return Value:
Win32 error code indicating outcome.
--*/
{
return GLE_FN_CALL(FALSE,
SetFileSecurity(FileName,
(OWNER_SECURITY_INFORMATION
| GROUP_SECURITY_INFORMATION
| DACL_SECURITY_INFORMATION),
SecurityInfo)
);
}
DWORD
TakeOwnershipOfFile(
IN PCTSTR Filename
)
/*++
Routine Description:
Sets the owner of a given file to the default owner specified in
the current process token.
Arguments:
FileName - supplies fully-qualified path of the file of which to take
ownership.
Return Value:
Win32 error code indicating outcome.
--*/
{
SECURITY_DESCRIPTOR SecurityDescriptor;
DWORD Err;
HANDLE Token;
DWORD BytesRequired;
PTOKEN_OWNER OwnerInfo = NULL;
//
// Open the process token.
//
Err = GLE_FN_CALL(FALSE,
OpenProcessToken(GetCurrentProcess(),
TOKEN_QUERY,
&Token)
);
if(Err != NO_ERROR) {
return Err;
}
try {
//
// Get the current process's default owner sid.
//
Err = GLE_FN_CALL(FALSE,
GetTokenInformation(Token,
TokenOwner,
NULL,
0,
&BytesRequired)
);
MYASSERT(Err != NO_ERROR);
if(Err != ERROR_INSUFFICIENT_BUFFER) {
leave;
}
OwnerInfo = MyMalloc(BytesRequired);
if(!OwnerInfo) {
Err = ERROR_NOT_ENOUGH_MEMORY;
leave;
}
Err = GLE_FN_CALL(FALSE,
GetTokenInformation(Token,
TokenOwner,
OwnerInfo,
BytesRequired,
&BytesRequired)
);
if(Err != NO_ERROR) {
leave;
}
//
// Initialize the security descriptor.
//
Err = GLE_FN_CALL(FALSE,
InitializeSecurityDescriptor(
&SecurityDescriptor,
SECURITY_DESCRIPTOR_REVISION)
);
if(Err != NO_ERROR) {
leave;
}
Err = GLE_FN_CALL(FALSE,
SetSecurityDescriptorOwner(&SecurityDescriptor,
OwnerInfo->Owner,
FALSE)
);
if(Err != NO_ERROR) {
leave;
}
//
// Set file security.
//
Err = GLE_FN_CALL(FALSE,
SetFileSecurity(Filename,
OWNER_SECURITY_INFORMATION,
&SecurityDescriptor)
);
//
// Not all filesystems support this operation.
//
if(Err == ERROR_NOT_SUPPORTED) {
Err = NO_ERROR;
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_READ_FAULT, &Err);
}
if(OwnerInfo) {
MyFree(OwnerInfo);
}
CloseHandle(Token);
return Err;
}
DWORD
SearchForInfFile(
IN PCTSTR InfName,
OUT LPWIN32_FIND_DATA FindData,
IN DWORD SearchControl,
OUT PTSTR FullInfPath,
IN UINT FullInfPathSize,
OUT PUINT RequiredSize OPTIONAL
)
/*++
Routine Description:
This routine searches for an INF file in the manner specified
by the SearchControl parameter. If the file is found, its
full path is returned.
Arguments:
InfName - Supplies name of INF to search for. This name is simply
appended to the two search directory paths, so if the name
contains directories, the file will searched for in the
subdirectory under the search directory. I.e.:
\foo\bar.inf
will be searched for as %windir%\inf\foo\bar.inf and
%windir%\system32\foo\bar.inf.
FindData - Supplies the address of a Win32 Find Data structure that
receives information about the file specified (if it is found).
SearchControl - Specifies the order in which directories should
be searched:
INFINFO_DEFAULT_SEARCH : search %windir%\inf, then %windir%\system32
INFINFO_REVERSE_DEFAULT_SEARCH : reverse of the above
INFINFO_INF_PATH_LIST_SEARCH : search for the INF in each of the
directories listed in the DevicePath value entry under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion.
FullInfPath - If the file is found, receives the full path of the INF.
FullInfPathSize - Supplies the size of the FullInfPath buffer (in
characters).
RequiredSize - Optionally, receives the number of characters (including
terminating NULL) required to store the FullInfPath.
Return Value:
Win32 error code indicating whether the function was successful. Common
return values are:
NO_ERROR if the file was found, and the INF file path returned
successfully.
ERROR_INSUFFICIENT_BUFFER if the supplied buffer was not large enough
to hold the full INF path (RequiredSize will indicated how large
the buffer needs to be)
ERROR_FILE_NOT_FOUND if the file was not found.
ERROR_INVALID_PARAMETER if the SearchControl parameter is invalid.
--*/
{
PCTSTR PathList;
TCHAR CurInfPath[MAX_PATH];
PCTSTR PathPtr, InfPathLocation;
DWORD PathLength;
BOOL b, FreePathList;
DWORD d;
//
// Retrieve the path list.
//
if(SearchControl == INFINFO_INF_PATH_LIST_SEARCH) {
//
// Just use our global list of INF search paths.
//
PathList = InfSearchPaths;
FreePathList = FALSE;
} else {
if(!(PathList = AllocAndReturnDriverSearchList(SearchControl))) {
return ERROR_NOT_ENOUGH_MEMORY;
}
FreePathList = TRUE;
}
d = NO_ERROR;
InfPathLocation = NULL;
try {
//
// Now look for the INF in each path in our MultiSz list.
//
for(PathPtr = PathList; *PathPtr; PathPtr += (lstrlen(PathPtr) + 1)) {
//
// Concatenate the INF file name with the current search path.
//
if(FAILED(StringCchCopy(CurInfPath, SIZECHARS(CurInfPath), PathPtr))) {
//
// not a valid path, don't bother trying to do FileExists
//
continue;
}
if(!pSetupConcatenatePaths(CurInfPath,
InfName,
SIZECHARS(CurInfPath),
&PathLength)) {
//
// not a valid path, don't bother trying to do FileExists
//
continue;
}
d = GLE_FN_CALL(FALSE, FileExists(CurInfPath, FindData));
if(d == NO_ERROR) {
if(!(FindData->dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)) {
InfPathLocation = CurInfPath;
break;
}
} else {
//
// See if we got a 'real' error
//
if((d != ERROR_NO_MORE_FILES) &&
(d != ERROR_FILE_NOT_FOUND) &&
(d != ERROR_PATH_NOT_FOUND)) {
//
// This is a 'real' error, abort the search.
//
break;
}
//
// reset error to NO_ERROR and continue search
//
d = NO_ERROR;
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, &d);
}
//
// Whatever the outcome, we're through with the PathList buffer.
//
if(FreePathList) {
MyFree(PathList);
}
if(d != NO_ERROR) {
return d;
} else if(!InfPathLocation) {
return ERROR_FILE_NOT_FOUND;
}
if(RequiredSize) {
*RequiredSize = PathLength;
}
if(PathLength > FullInfPathSize) {
return ERROR_INSUFFICIENT_BUFFER;
}
CopyMemory(FullInfPath,
InfPathLocation,
PathLength * sizeof(TCHAR)
);
return NO_ERROR;
}
DWORD
MultiSzFromSearchControl(
IN DWORD SearchControl,
OUT PTCHAR PathList,
IN DWORD PathListSize,
OUT PDWORD RequiredSize OPTIONAL
)
/*++
Routine Description:
This routine takes a search control ordinal and builds a MultiSz list
based on the search list it specifies.
Arguments:
SearchControl - Specifies the directory list to be built. May be one
of the following values:
INFINFO_DEFAULT_SEARCH : %windir%\inf, then %windir%\system32
INFINFO_REVERSE_DEFAULT_SEARCH : reverse of the above
INFINFO_INF_PATH_LIST_SEARCH : Each of the directories listed in
the DevicePath value entry under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion.
PathList - Supplies the address of a character buffer that will receive
the MultiSz list.
PathListSize - Supplies the size, in characters, of the PathList buffer.
RequiredSize - Optionally, receives the number of characters required
to store the MultiSz PathList.
(NOTE: The user-supplied buffer is used to retrieve the value entry
from the registry. Therefore, if the value is a REG_EXPAND_SZ entry,
the RequiredSize parameter may be set too small on an
ERROR_INSUFFICIENT_BUFFER error. This will happen if the buffer was
too small to retrieve the value entry, before expansion. In this case,
calling the API again with a buffer sized according to the RequiredSize
output may fail with an ERROR_INSUFFICIENT_BUFFER yet again, since
expansion may require an even larger buffer.)
Return Value:
If successful, returns NO_ERROR.
If failure, returns a Win32 error code indicating the cause of the failure.
--*/
{
HKEY hk;
PCTSTR Path1, Path2;
PTSTR PathBuffer;
DWORD RegDataType, PathLength, PathLength1, PathLength2;
DWORD NumPaths, Err;
BOOL UseDefaultDevicePath;
if(PathList) {
Err = NO_ERROR; // assume success.
} else {
return ERROR_INVALID_PARAMETER;
}
UseDefaultDevicePath = FALSE;
if(SearchControl == INFINFO_INF_PATH_LIST_SEARCH) {
//
// Retrieve the INF search path list from the registry.
//
if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
pszPathSetup,
0,
KEY_READ,
&hk) != ERROR_SUCCESS) {
//
// Fall back to default (just the Inf directory).
//
UseDefaultDevicePath = TRUE;
} else {
PathBuffer = NULL;
try {
//
// Get the DevicePath value entry. Support REG_SZ or
// REG_EXPAND_SZ data.
//
PathLength = PathListSize * sizeof(TCHAR);
Err = RegQueryValueEx(hk,
pszDevicePath,
NULL,
&RegDataType,
(LPBYTE)PathList,
&PathLength
);
//
// Need path length in characters from now on.
//
PathLength /= sizeof(TCHAR);
if(Err == ERROR_SUCCESS) {
//
// Check if the caller's buffer has room for extra NULL
// terminator.
//
if(PathLength >= PathListSize) {
PathLength++;
Err = ERROR_INSUFFICIENT_BUFFER;
} else if((RegDataType == REG_SZ) || (RegDataType == REG_EXPAND_SZ)) {
//
// Convert this semicolon-delimited list to a
// REG_MULTI_SZ.
//
NumPaths = DelimStringToMultiSz(PathList,
PathLength,
TEXT(';')
);
//
// Allocate a temporary buffer large enough to hold the
// number of paths in the MULTI_SZ list, each having
// maximum length (plus an extra terminating NULL at
// the end).
//
if(!(PathBuffer = MyMalloc((NumPaths * MAX_PATH * sizeof(TCHAR))
+ sizeof(TCHAR)))) {
Err = ERROR_NOT_ENOUGH_MEMORY;
leave;
}
PathLength = 0;
for(Path1 = PathList;
*Path1;
Path1 += lstrlen(Path1) + 1) {
if(RegDataType == REG_EXPAND_SZ) {
DWORD SubPathLength;
SubPathLength = ExpandEnvironmentStrings(
Path1,
PathBuffer + PathLength,
MAX_PATH
);
if(SubPathLength <= MAX_PATH) {
PathLength += lstrlen(PathBuffer+PathLength) + 1;
}
} else {
if(SUCCEEDED(StringCchCopy(PathBuffer + PathLength,
MAX_PATH,
Path1))) {
PathLength += lstrlen(PathBuffer+PathLength) + 1;
}
}
//
// If the last character in this path is a
// backslash, then strip it off.
// PathLength at this point includes terminating
// NULL char at PathBuffer[PathLength-1] is (or
// should be) NULL char at PathBuffer[PathLength-2]
// may be '\'
//
if(*CharPrev(PathBuffer, PathBuffer + PathLength - 1) == TEXT('\\')) {
*(PathBuffer + PathLength - 2) = TEXT('\0');
PathLength--;
}
}
//
// Add additional terminating NULL at the end.
//
*(PathBuffer + PathLength) = TEXT('\0');
if(++PathLength > PathListSize) {
Err = ERROR_INSUFFICIENT_BUFFER;
} else {
CopyMemory(PathList,
PathBuffer,
PathLength * sizeof(TCHAR)
);
}
MyFree(PathBuffer);
PathBuffer = NULL;
} else {
//
// Bad data type--just use the Inf directory.
//
UseDefaultDevicePath = TRUE;
}
} else if(Err == ERROR_MORE_DATA){
Err = ERROR_INSUFFICIENT_BUFFER;
} else {
//
// Fall back to default (just the Inf directory).
//
UseDefaultDevicePath = TRUE;
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
//
// Fall back to default (just the Inf directory).
//
UseDefaultDevicePath = TRUE;
if(PathBuffer) {
MyFree(PathBuffer);
}
}
RegCloseKey(hk);
}
}
if(UseDefaultDevicePath) {
PathLength = lstrlen(InfDirectory) + 2;
if(PathLength > PathListSize) {
Err = ERROR_INSUFFICIENT_BUFFER;
} else {
Err = NO_ERROR;
CopyMemory(PathList, InfDirectory, (PathLength - 1) * sizeof(TCHAR));
//
// Add extra NULL to terminate the list.
//
PathList[PathLength - 1] = TEXT('\0');
}
} else if((Err == NO_ERROR) && (SearchControl != INFINFO_INF_PATH_LIST_SEARCH)) {
switch(SearchControl) {
case INFINFO_DEFAULT_SEARCH :
Path1 = InfDirectory;
Path2 = SystemDirectory;
break;
case INFINFO_REVERSE_DEFAULT_SEARCH :
Path1 = SystemDirectory;
Path2 = InfDirectory;
break;
default :
return ERROR_INVALID_PARAMETER;
}
PathLength1 = lstrlen(Path1) + 1;
PathLength2 = lstrlen(Path2) + 1;
PathLength = PathLength1 + PathLength2 + 1;
if(PathLength > PathListSize) {
Err = ERROR_INSUFFICIENT_BUFFER;
} else {
CopyMemory(PathList, Path1, PathLength1 * sizeof(TCHAR));
CopyMemory(&(PathList[PathLength1]), Path2, PathLength2 * sizeof(TCHAR));
//
// Add additional terminating NULL at the end.
//
PathList[PathLength - 1] = TEXT('\0');
}
}
if(((Err == NO_ERROR) || (Err == ERROR_INSUFFICIENT_BUFFER)) && RequiredSize) {
*RequiredSize = PathLength;
}
return Err;
}
PTSTR
AllocAndReturnDriverSearchList(
IN DWORD SearchControl
)
/*++
Routine Description:
This routine returns a buffer contains a multi-sz list of all directory
paths in our driver search path list.
The buffer returned must be freed with MyFree().
Arguments:
SearchControl - Specifies the directory list to be retrieved. May be one
of the following values:
INFINFO_DEFAULT_SEARCH : %windir%\inf, then %windir%\system32
INFINFO_REVERSE_DEFAULT_SEARCH : reverse of the above
INFINFO_INF_PATH_LIST_SEARCH : Each of the directories listed in
the DevicePath value entry under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion.
Returns:
Pointer to the allocated buffer containing the list, or NULL if a failure
was encountered (typically, due to out-of-memory).
--*/
{
PTSTR PathListBuffer = NULL, TrimBuffer = NULL;
DWORD BufferSize;
DWORD Err;
try {
//
// Start out with a buffer of MAX_PATH length, which should cover most cases.
//
BufferSize = MAX_PATH;
//
// Loop on a call to MultiSzFromSearchControl until we succeed or hit
// some error other than buffer-too-small. There are two reasons for
// this. First, it is possible that someone could have added a new
// path to the registry list between calls, and second, since that
// routine uses our buffer to retrieve the original (non-expanded)
// list, it can only report the size it needs to retrieve the
// unexpanded list. After it is given enough space to retrieve it,
// _then_ it can tell us how much space we really need.
//
// With all that said, we'll almost never see this call made more than
// once.
//
while(NULL != (PathListBuffer = MyMalloc((BufferSize+2) * sizeof(TCHAR)))) {
if((Err = MultiSzFromSearchControl(SearchControl,
PathListBuffer,
BufferSize,
&BufferSize)) == NO_ERROR) {
//
// We've successfully retrieved the path list. If the list is
// larger than necessary (the normal case), then trim it down
// before returning. (If this fails it's no big deal--we'll
// just keep on using the original buffer.)
//
TrimBuffer = MyRealloc(PathListBuffer,
(BufferSize+2) * sizeof(TCHAR)
);
if(TrimBuffer) {
PathListBuffer = TrimBuffer;
}
//
// We succeeded--break out of the loop.
//
break;
} else {
//
// Free our current buffer before we find out what went wrong.
//
MyFree(PathListBuffer);
PathListBuffer = NULL;
if(Err != ERROR_INSUFFICIENT_BUFFER) {
//
// We failed.
//
leave;
}
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
if(TrimBuffer) {
MyFree(TrimBuffer);
} else if(PathListBuffer) {
MyFree(PathListBuffer);
}
PathListBuffer = NULL;
}
return PathListBuffer;
}
BOOL
DoMove(
IN PCTSTR CurrentName,
IN PCTSTR NewName
)
/*++
Routine Description:
Wrapper for MoveFileEx on NT
Arguments:
CurrentName - supplies the name of the file as it exists currently.
NewName - supplies the new name
Returns:
Boolean value indicating outcome. If failure, last error is set.
--*/
{
return MoveFileEx(CurrentName, NewName, MOVEFILE_REPLACE_EXISTING);
}
BOOL
DelayedMove(
IN PCTSTR CurrentName,
IN PCTSTR NewName OPTIONAL
)
/*++
Routine Description:
Queue a file for copy or delete on next reboot.
On Windows NT this means using MoveFileEx().
Arguments:
CurrentName - supplies the name of the file as it exists currently.
NewName - if specified supplies the new name. If not specified
then the file named by CurrentName is deleted on next reboot.
Returns:
Boolean value indicating outcome. If failure, last error is set.
--*/
{
return MoveFileEx(CurrentName,
NewName,
MOVEFILE_REPLACE_EXISTING | MOVEFILE_DELAY_UNTIL_REBOOT
);
}
typedef enum _OEM_FILE_TYPE {
OemFiletypeInf,
OemFiletypeCat
} OEM_FILE_TYPE, *POEM_FILE_TYPE;
BOOL
IsInstalledFileFromOem(
IN PCTSTR Filename,
IN OEM_FILE_TYPE Filetype
)
/*++
Routine Description:
Determine whether a file has the proper format for an (installed) OEM INF
or catalog.
Arguments:
Filename - supplies filename (sans path) to be checked.
Filetype - specifies the type of file indicating how validation should be
performed for the caller-supplied Filename. May be one of the
following values:
OemFiletypeInf - file must be OEM INF filename format (i.e., OEM<n>.INF)
OemFiletypeCat - file must be OEM CAT filename format (i.e., OEM<n>.CAT)
Return Value:
If the file conforms to the format for an installed OEM file of the
specified type, the return is non-zero. Otherwise, it is FALSE.
--*/
{
PTSTR p;
BOOL b;
//
// Catalog filename must not contain path...
//
MYASSERT(pSetupGetFileTitle(Filename) == Filename);
//
// First check that the first 3 characters are OEM
//
if(_tcsnicmp(Filename, TEXT("oem"), 3)) {
return FALSE;
}
//
// Next verify that any characters after "oem" and before ".cat"
// are digits.
//
p = (PTSTR)Filename;
p = CharNext(p);
p = CharNext(p);
p = CharNext(p);
while((*p != TEXT('\0')) && (*p != TEXT('.'))) {
if((*p < TEXT('0')) || (*p > TEXT('9'))) {
return FALSE;
}
p = CharNext(p);
}
//
// Finally, verify that the last 4 characters are either ".inf" or ".cat",
// depending on what type of file the caller specified.
//
switch(Filetype) {
case OemFiletypeInf :
b = !_tcsicmp(p, TEXT(".INF"));
break;
case OemFiletypeCat :
b = !_tcsicmp(p, TEXT(".CAT"));
break;
default :
MYASSERT(FALSE);
return FALSE;
}
return b;
}
DWORD
pSetupInstallCatalog(
IN LPCTSTR CatalogFullPath,
IN LPCTSTR NewBaseName,
OUT LPTSTR NewCatalogFullPath OPTIONAL
)
/*++
Routine Description:
This routine installs a catalog file. The file is copied by the system
into a special directory, and is optionally renamed.
Arguments:
CatalogFullPath - supplies the fully-qualified win32 path of the catalog
to be installed on the system.
NewBaseName - specifies the new base name to use when the catalog file is
copied into the catalog store.
NewCatalogFullPath - optionally receives the fully-qualified path of the
catalog file within the catalog store. This buffer should be at least
MAX_PATH bytes (ANSI version) or chars (Unicode version).
** NOTE: If we're running in "minimal embedded" mode, then we don't **
** actually call any of the Crypto APIs, and instead always simply **
** report success. In this case, the caller had better not have **
** specified an OUT buffer for NewCatalogFullPath, because we won't **
** have a path to report. If we run into this case, we'll instead **
** report failure. What this really says is that nobody other than **
** setupapi should ever be passing a non-NULL value for this arg. **
Return Value:
If successful, the return value is NO_ERROR.
If failure, the return value is a Win32 error code indicating the cause of
the failure.
--*/
{
DWORD Err;
HCATADMIN hCatAdmin;
HCATINFO hCatInfo;
CATALOG_INFO CatalogInfo;
LPWSTR LocalCatalogFullPath;
LPWSTR LocalNewBaseName;
MYASSERT(NewBaseName);
if(!NewBaseName) {
return ERROR_INVALID_PARAMETER;
}
if(GlobalSetupFlags & PSPGF_MINIMAL_EMBEDDED) {
//
// If someone called us expecting the new catalog's full path to be
// returned, they're outta luck...
//
MYASSERT(!NewCatalogFullPath);
if(NewCatalogFullPath) {
//
// In minimal embedded mode, a non-NULL NewCatalogFullPath arg is
// an invalid parameter...
//
return ERROR_INVALID_PARAMETER;
} else {
//
// Simply report success.
//
return NO_ERROR;
}
}
if(GlobalSetupFlags & PSPGF_AUTOFAIL_VERIFIES) {
return TRUST_E_FAIL;
}
Err = NO_ERROR;
LocalCatalogFullPath = NULL;
LocalNewBaseName = NULL;
hCatInfo = NULL;
Err = GLE_FN_CALL(FALSE, CryptCATAdminAcquireContext(&hCatAdmin,
&DriverVerifyGuid,
0)
);
if(Err != NO_ERROR) {
return Err;
}
try {
//
// Duplicate our catalog pathname and basename since the
// CryptCATAdminAddCatalog prototype doesn't specify these arguments as
// being const strings.
//
LocalCatalogFullPath = DuplicateString(CatalogFullPath);
LocalNewBaseName = DuplicateString(NewBaseName);
if(!LocalCatalogFullPath || !LocalNewBaseName) {
Err = ERROR_NOT_ENOUGH_MEMORY;
leave;
}
Err = GLE_FN_CALL(NULL,
hCatInfo = CryptCATAdminAddCatalog(
hCatAdmin,
LocalCatalogFullPath,
LocalNewBaseName,
0)
);
if(Err != NO_ERROR) {
//
// If the error we received is ERROR_ALREADY_EXISTS, then that
// indicates that the exact same catalog was already present
// (and installed under the same name). Treat this as a
// success (assuming we can get the full pathname of the
// existing catalog).
//
if(Err == ERROR_ALREADY_EXISTS) {
if(NewCatalogFullPath) {
//
// Resolve the catalog base filename to a fully-
// qualified path.
//
CatalogInfo.cbStruct = sizeof(CATALOG_INFO);
Err = GLE_FN_CALL(FALSE,
CryptCATAdminResolveCatalogPath(
hCatAdmin,
LocalNewBaseName,
&CatalogInfo,
0)
);
} else {
//
// Caller isn't interested in finding out what pathname
// the catalog was installed under...
//
Err = NO_ERROR;
}
}
} else if(NewCatalogFullPath) {
//
// The caller wants to know the full path under which the catalog
// got installed.
//
CatalogInfo.cbStruct = sizeof(CATALOG_INFO);
Err = GLE_FN_CALL(FALSE,
CryptCATCatalogInfoFromContext(hCatInfo,
&CatalogInfo,
0)
);
}
//
// If we succeeded in retrieving the installed catalog's full path
// (and the caller requested it), fill in the caller's buffer now.
//
if((Err == NO_ERROR) && NewCatalogFullPath) {
MYVERIFY(SUCCEEDED(StringCchCopy(NewCatalogFullPath,
MAX_PATH,
CatalogInfo.wszCatalogFile)));
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, &Err);
}
if(hCatInfo) {
CryptCATAdminReleaseCatalogContext(hCatAdmin, hCatInfo, 0);
}
CryptCATAdminReleaseContext(hCatAdmin, 0);
if(LocalCatalogFullPath) {
MyFree(LocalCatalogFullPath);
}
if(LocalNewBaseName) {
MyFree(LocalNewBaseName);
}
return Err;
}
DWORD
pSetupVerifyCatalogFile(
IN LPCTSTR CatalogFullPath
)
/*++
Routine Description:
This routine verifies a single catalog file using standard OS codesigning
(i.e., driver signing) policy.
Arguments:
CatalogFullPath - supplies the fully-qualified Win32 path of
the catalog file to be verified.
Return Value:
If successful, the return value is ERROR_SUCCESS.
If failure, the return value is the error returned from WinVerifyTrust.
--*/
{
return _VerifyCatalogFile(NULL, CatalogFullPath, NULL, FALSE, NULL, NULL);
}
DWORD
_VerifyCatalogFile(
IN PSETUP_LOG_CONTEXT LogContext, OPTIONAL
IN LPCTSTR CatalogFullPath,
IN PSP_ALTPLATFORM_INFO_V2 AltPlatformInfo, OPTIONAL
IN BOOL UseAuthenticodePolicy,
IN OUT HCERTSTORE *hStoreTrustedPublisher, OPTIONAL
OUT HANDLE *hWVTStateData OPTIONAL
)
/*++
Routine Description:
This routine verifies a single catalog file using the specified policy.
Arguments:
LogContext - optionally, supplies the context to be used when logging
information about the routine's activities.
CatalogFullPath - supplies the fully-qualified Win32 path of the catalog
file to be verified.
AltPlatformInfo - optionally, supplies alternate platform information used
to fill in a DRIVER_VER_INFO structure (defined in sdk\inc\softpub.h)
that is passed to WinVerifyTrust.
** NOTE: This structure _must_ have its cbSize field set to **
** sizeof(SP_ALTPLATFORM_INFO_V2) -- validation on client-supplied **
** buffer is the responsibility of the caller. **
UseAuthenticodePolicy - if TRUE, verification is to be done using
Authenticode policy instead of standard driver signing policy.
hStoreTrustedPublisher - optionally, supplies the address of a certificate
store handle. If the handle pointed to is NULL, a handle will be
acquired (if possible) via CertOpenStore and returned to the caller.
If the handle pointed to is non-NULL, then that handle will be used by
this routine. If the pointer itself is NULL, then an HCERTSTORE will
be acquired for the duration of this call, and released before
returning.
NOTE: it is the caller's responsibility to free the certificate store
handle returned by this routine by calling CertCloseStore. This handle
may be opened in either success or failure cases, so the caller must
check for non-NULL returned handle in both cases.
hWVTStateData - if supplied, this parameter points to a buffer that
receives a handle to WinVerifyTrust state data. This handle will be
returned only when validation was successfully performed using
Authenticode policy. This handle may be used, for example, to retrieve
signer info when prompting the user about whether they trust the
publisher. (The status code returned will indicate whether or not this
is necessary, see "Return Value" section below.)
This parameter should only be supplied if UseAuthenticodePolicy is
TRUE. If the routine fails, then this handle will be set to NULL.
It is the caller's responsibility to close this handle when they're
finished with it by calling pSetupCloseWVTStateData().
Return Value:
If the catalog was successfully validated via driver signing policy, then
the return value is NO_ERROR.
If the catalog was successfully validated via Authenticode policy, and the
publisher was in the TrustedPublisher store, then the return value is
ERROR_AUTHENTICODE_TRUSTED_PUBLISHER.
If the catalog was successfully validated via Authenticode policy, and the
publisher was not in the TrustedPublisher store (hence we must prompt the
user to establish their trust of the publisher), then the return value is
ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED
If a failure occurred, the return value is a Win32 error code indicating
the cause of the failure.
Remarks:
If we're in initial system setup (i.e., GUI-mode setup or mini-setup), we
automatically install the certificates for any Authenticode-signed packages
we encounter. This is done to make OEM and corporate deployment as
painless as possible. In order to avoid being spoofed into thinking we're
in system setup when we're not, we check to see if we're in LocalSystem
security context (which both GUI setup and mini-setup are), and that we're
on an interactive windowstation (which umpnpmgr is not).
--*/
{
WINTRUST_DATA WintrustData;
WINTRUST_FILE_INFO WintrustFileInfo;
DRIVER_VER_INFO VersionInfo;
DWORD Err, CertAutoInstallErr;
PCRYPT_PROVIDER_DATA ProviderData;
PCRYPT_PROVIDER_SGNR ProviderSigner;
PCRYPT_PROVIDER_CERT ProviderCert;
TCHAR PublisherName[MAX_PATH];
//
// If the caller requested that we return WinVerifyTrust state data upon
// successful Authenticode validation, then they'd better have actually
// requested Authenticode validation!
//
MYASSERT(!hWVTStateData || UseAuthenticodePolicy);
if(hWVTStateData) {
*hWVTStateData = NULL;
}
if(GlobalSetupFlags & PSPGF_MINIMAL_EMBEDDED) {
//
// Not valid to call us requesting Authenticode validation!
//
MYASSERT(!UseAuthenticodePolicy);
return ERROR_SUCCESS;
}
if(GlobalSetupFlags & PSPGF_AUTOFAIL_VERIFIES) {
return TRUST_E_FAIL;
}
if (!FileExists(CatalogFullPath, NULL)) {
return ERROR_NO_CATALOG_FOR_OEM_INF;
}
ZeroMemory(&WintrustData, sizeof(WINTRUST_DATA));
WintrustData.cbStruct = sizeof(WINTRUST_DATA);
WintrustData.dwUIChoice = WTD_UI_NONE;
WintrustData.dwUnionChoice = WTD_CHOICE_FILE;
WintrustData.pFile = &WintrustFileInfo;
WintrustData.dwProvFlags = WTD_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT |
WTD_CACHE_ONLY_URL_RETRIEVAL;
ZeroMemory(&WintrustFileInfo, sizeof(WINTRUST_FILE_INFO));
WintrustFileInfo.cbStruct = sizeof(WINTRUST_FILE_INFO);
WintrustFileInfo.pcwszFilePath = CatalogFullPath;
if(UseAuthenticodePolicy) {
//
// We want WinVerifyTrust to return a handle to its state data, so we
// can retrieve the publisher's cert...
//
WintrustData.dwStateAction = WTD_STATEACTION_VERIFY;
} else {
//
// Specify driver version info structure so that we can control the
// range of OS versions against which this catalog should validate.
//
ZeroMemory(&VersionInfo, sizeof(DRIVER_VER_INFO));
VersionInfo.cbStruct = sizeof(DRIVER_VER_INFO);
if(AltPlatformInfo) {
MYASSERT(AltPlatformInfo->cbSize == sizeof(SP_ALTPLATFORM_INFO_V2));
//
// Caller wants the file validated for an alternate platform, so we
// must fill in a DRIVER_VER_INFO structure to be passed to the policy
// module.
//
VersionInfo.dwPlatform = AltPlatformInfo->Platform;
VersionInfo.dwVersion = AltPlatformInfo->MajorVersion;
VersionInfo.sOSVersionLow.dwMajor = AltPlatformInfo->FirstValidatedMajorVersion;
VersionInfo.sOSVersionLow.dwMinor = AltPlatformInfo->FirstValidatedMinorVersion;
VersionInfo.sOSVersionHigh.dwMajor = AltPlatformInfo->MajorVersion;
VersionInfo.sOSVersionHigh.dwMinor = AltPlatformInfo->MinorVersion;
} else {
//
// If an AltPlatformInfo was not passed in then set the
// WTD_USE_DEFAULT_OSVER_CHECK flag. This flag tells WinVerifyTrust to
// use its default osversion checking, even though a DRIVER_VER_INFO
// structure was passed in.
//
WintrustData.dwProvFlags |= WTD_USE_DEFAULT_OSVER_CHECK;
}
//
// Specify a DRIVER_VER_INFO structure so we can get back signer
// information about the catalog.
//
WintrustData.pPolicyCallbackData = (PVOID)&VersionInfo;
}
//
// Our call to WinVerifyTrust may allocate a resource we need to free
// (namely, the signer cert context). Wrap the following in try/except
// so we won't leak resources in case of exception.
//
try {
Err = (DWORD)WinVerifyTrust(NULL,
(UseAuthenticodePolicy
? &AuthenticodeVerifyGuid
: &DriverVerifyGuid),
&WintrustData
);
if((Err != NO_ERROR) || !UseAuthenticodePolicy) {
//
// If we're using driver signing policy, and we failed because of
// an osattribute mismatch, then convert this error to a specific
// error (with more sensible text).
//
if(!UseAuthenticodePolicy && (Err == ERROR_APP_WRONG_OS)) {
Err = ERROR_SIGNATURE_OSATTRIBUTE_MISMATCH;
}
leave;
}
//
// If we get to this point, we successfully validated the catalog via
// Authenticode policy, and we have a handle to the WinVerifyTrust
// state data we need in order to: (a) return the handle to the caller
// (if requested), and (b) get at the certificate we need to search for
// in the TrustedPublisher certificate store.
//
MYASSERT(WintrustData.hWVTStateData);
if(!WintrustData.hWVTStateData) {
Err = ERROR_UNIDENTIFIED_ERROR;
leave;
}
//
// Now we need to ascertain whether the publisher is already trusted,
// or whether we must prompt the user.
//
ProviderData = WTHelperProvDataFromStateData(WintrustData.hWVTStateData);
MYASSERT(ProviderData);
if(!ProviderData) {
Err = ERROR_UNIDENTIFIED_ERROR;
leave;
}
ProviderSigner = WTHelperGetProvSignerFromChain(ProviderData,
0,
FALSE,
0
);
MYASSERT(ProviderSigner);
if(!ProviderSigner) {
Err = ERROR_UNIDENTIFIED_ERROR;
leave;
}
ProviderCert = WTHelperGetProvCertFromChain(ProviderSigner, 0);
MYASSERT(ProviderCert);
if(!ProviderCert) {
Err = ERROR_UNIDENTIFIED_ERROR;
leave;
}
if(pSetupIsAuthenticodePublisherTrusted(ProviderCert->pCert,
hStoreTrustedPublisher)) {
Err = ERROR_AUTHENTICODE_TRUSTED_PUBLISHER;
} else {
//
// If we're running in a context where it's acceptable to auto-
// install the cert, then do that now. Otherwise, we report a
// status code that informs the caller they must prompt the user
// about whether this publisher is to be trusted.
//
if(IsAutoCertInstallAllowed()) {
//
// Retrieve the publisher's name, so we can include it when
// logging either success or failure of the certificate
// installation.
//
MYVERIFY(1 <= CertGetNameString(
ProviderCert->pCert,
CERT_NAME_SIMPLE_DISPLAY_TYPE,
0,
NULL,
PublisherName,
SIZECHARS(PublisherName))
);
CertAutoInstallErr = pSetupInstallCertificate(ProviderCert->pCert);
if(CertAutoInstallErr == NO_ERROR) {
//
// Log the fact that we auto-installed a certificate.
//
WriteLogEntry(LogContext,
DRIVER_LOG_INFO,
MSG_LOG_AUTHENTICODE_CERT_AUTOINSTALLED,
NULL,
PublisherName
);
//
// Now publisher is trusted, so return status indicating
// that.
//
Err = ERROR_AUTHENTICODE_TRUSTED_PUBLISHER;
} else {
//
// Log the fact that we couldn't install the certificate.
// Don't treat this as a fatal error, however.
//
WriteLogEntry(LogContext,
DRIVER_LOG_WARNING | SETUP_LOG_BUFFER,
MSG_LOG_AUTHENTICODE_CERT_AUTOINSTALL_FAILED,
NULL,
PublisherName
);
WriteLogError(LogContext,
DRIVER_LOG_WARNING,
CertAutoInstallErr
);
//
// Report status indicating that the user must be prompted
// to establish trust of this publisher.
//
Err = ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED;
}
} else {
Err = ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED;
}
}
//
// If we get to here, then we've successfully verified the catalog, and
// ascertained whether the certificate should be implicitly trusted.
// If the caller requested that we return the WinVerifyTrust state data
// to them, then we can store that in their output buffer now.
//
if(hWVTStateData) {
*hWVTStateData = WintrustData.hWVTStateData;
//
// WinVerifyTrust state data handle successfully transferred to
// caller's output buffer. Clear it out of the WintrustData
// structure so we won't end up trying to free it twice in case of
// error.
//
WintrustData.hWVTStateData = NULL;
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, &Err);
}
if(!UseAuthenticodePolicy && VersionInfo.pcSignerCertContext) {
CertFreeCertificateContext(VersionInfo.pcSignerCertContext);
}
if((Err != ERROR_AUTHENTICODE_TRUSTED_PUBLISHER) &&
(Err != ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED)) {
//
// If our error is NO_ERROR, then we shouldn't have WinVerifyTrust
// state data, because that indicates we validated using standard
// driver signing policy, not Authenticode policy.
//
MYASSERT((Err != NO_ERROR) || !hWVTStateData || !*hWVTStateData);
if(hWVTStateData && *hWVTStateData) {
pSetupCloseWVTStateData(*hWVTStateData);
*hWVTStateData = NULL;
//
// We'd better not also have a WinVerifyTrust state data handle in
// the WintrustData structure...
//
MYASSERT(!WintrustData.hWVTStateData);
}
}
if(WintrustData.hWVTStateData) {
pSetupCloseWVTStateData(WintrustData.hWVTStateData);
}
return Err;
}
VOID
pSetupCloseWVTStateData(
IN HANDLE hWVTStateData
)
/*++
Routine Description:
This routine closes the WinVerifyTrust state data handle returned from
certain routines (e.g., _VerifyCatalogFile) for prompting the user to
establish trust of an Authenticode publisher.
Arguments:
hWVTStateData - supplies the WinVerifyTrust state data handle to be closed.
Return Value:
None.
--*/
{
WINTRUST_DATA WintrustData;
ZeroMemory(&WintrustData, sizeof(WINTRUST_DATA));
WintrustData.cbStruct = sizeof(WINTRUST_DATA);
WintrustData.dwStateAction = WTD_STATEACTION_CLOSE;
WintrustData.hWVTStateData = hWVTStateData;
MYVERIFY(NO_ERROR == WinVerifyTrust(NULL,
&AuthenticodeVerifyGuid,
&WintrustData));
}
DWORD
pSetupUninstallCatalog(
IN LPCTSTR CatalogFilename
)
/*++
Routine Description:
This routine uninstalls a catalog, so it can no longer be used to validate
digital signatures.
Arguments:
CatalogFilename - supplies the simple filename of the catalog to be
uninstalled.
Return Value:
If successful, the return value is NO_ERROR.
If failure, the return value is a Win32 error code indicating the cause of
the failure.
--*/
{
DWORD Err;
HCATADMIN hCatAdmin;
if(GlobalSetupFlags & PSPGF_MINIMAL_EMBEDDED) {
return NO_ERROR;
}
if(GlobalSetupFlags & PSPGF_AUTOFAIL_VERIFIES) {
return TRUST_E_FAIL;
}
Err = GLE_FN_CALL(FALSE,
CryptCATAdminAcquireContext(&hCatAdmin,
&DriverVerifyGuid,
0)
);
if(Err != NO_ERROR) {
return Err;
}
try {
Err = GLE_FN_CALL(FALSE,
CryptCATAdminRemoveCatalog(hCatAdmin,
CatalogFilename,
0)
);
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, &Err);
}
CryptCATAdminReleaseContext(hCatAdmin, 0);
return Err;
}
BOOL
pAnyDeviceUsingInf(
IN LPCTSTR InfFullPath,
IN PSETUP_LOG_CONTEXT LogContext OPTIONAL
)
/*++
Routine Description:
This routine checks if any device, live or phantom, is using this INF file,
and logs if they are.
Arguments:
InfFullPath - supplies the full path of the INF.
LogContext - optionally, supplies the log context to be used if a device
using this INF is encountered.
Return Value:
TRUE if this INF is being used by any device, or if an error occurred (if
an error was encountered, we don't want to end up deleting the INF
erroneously.
FALSE if no devices are using this INF (and no errors were encountered).
--*/
{
DWORD Err;
HDEVINFO DeviceInfoSet;
SP_DEVINFO_DATA DeviceInfoData;
DWORD MemberIndex = 0;
HKEY hkey = INVALID_HANDLE_VALUE;
TCHAR CurrentDeviceInfFile[MAX_PATH];
DWORD cbSize, dwType;
PTSTR pInfFile;
//
// If we are passed a NULL InfFullPath or an enpty string then just return
// FALSE since nobody is using this.
//
if(!InfFullPath || (InfFullPath[0] == TEXT('\0'))) {
return FALSE;
}
pInfFile = (PTSTR)pSetupGetFileTitle(InfFullPath);
DeviceInfoSet = SetupDiGetClassDevs(NULL, NULL, NULL, DIGCF_ALLCLASSES);
if(DeviceInfoSet == INVALID_HANDLE_VALUE) {
//
// We can't retrieve a list of devices, hence we cannot make a
// determination of whether this inf is in-use. Safe thing to do is
// assume it is in-use...
//
return TRUE;
}
Err = NO_ERROR; // assume we won't find any devices using this INF.
try {
DeviceInfoData.cbSize = sizeof(DeviceInfoData);
while(SetupDiEnumDeviceInfo(DeviceInfoSet,
MemberIndex++,
&DeviceInfoData)) {
//
// Open the 'driver' key for this device.
//
hkey = SetupDiOpenDevRegKey(DeviceInfoSet,
&DeviceInfoData,
DICS_FLAG_GLOBAL,
0,
DIREG_DRV,
KEY_READ);
if(hkey != INVALID_HANDLE_VALUE) {
cbSize = sizeof(CurrentDeviceInfFile);
dwType = REG_SZ;
if ((RegQueryValueEx(hkey,
pszInfPath,
NULL,
&dwType,
(LPBYTE)CurrentDeviceInfFile,
&cbSize) == ERROR_SUCCESS) &&
!lstrcmpi(CurrentDeviceInfFile, pInfFile)) {
//
// This key is using this INF file so the INF can't be
// deleted.
//
Err = ERROR_SHARING_VIOLATION; // any error will do
if(LogContext) {
TCHAR DeviceId[MAX_DEVICE_ID_LEN];
if(CM_Get_Device_ID(DeviceInfoData.DevInst,
DeviceId,
SIZECHARS(DeviceId),
0
) != CR_SUCCESS) {
DeviceId[0] = TEXT('\0');
}
WriteLogEntry(LogContext,
SETUP_LOG_WARNING,
MSG_LOG_INF_IN_USE,
NULL,
pInfFile,
DeviceId
);
}
}
RegCloseKey(hkey);
hkey = INVALID_HANDLE_VALUE;
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, &Err);
}
SetupDiDestroyDeviceInfoList(DeviceInfoSet);
if(hkey != INVALID_HANDLE_VALUE) {
RegCloseKey(hkey);
}
return (Err != NO_ERROR);
}
VOID
pSetupUninstallOEMInf(
IN LPCTSTR InfFullPath,
IN PSETUP_LOG_CONTEXT LogContext, OPTIONAL
IN DWORD Flags,
OUT PDWORD InfDeleteErr OPTIONAL
)
/*++
Routine Description:
This routine uninstalls a 3rd-party INF, PNF, and CAT (if one exists). It
can also be used to uninstall an exception package INF, PNF, and CAT.
By default this routine will first verify that there aren't any other
device's, live and phantom, that are pointing their InfPath to this
INF. This behavior can be overridden by the SUOI_FORCEDELETE flag.
Arguments:
InfFullPath - supplies the full path of the INF to be uninstalled.
LogContext - optionally, supplies the log context to be used if we
encounter an error when attempting to delete the catalog.
Flags - the following flags are supported:
SUOI_FORCEDELETE - delete the INF even if other driver keys are
have their InfPath pointing to it.
InfDeleteErr - optionally, supplies the address of a variable that receives
the error (if any) encountered when attempting to delete the INF.
Note that we delete the INF last (to avoid race conditions), so the
corresponding CAT and PNF may have already been deleted at this point.
Return Value:
None.
--*/
{
DWORD Err;
TCHAR FileNameBuffer[MAX_PATH+4]; // +4 in case filename is blahblah. not blahblah.inf
BOOL FreeLogContext = FALSE;
LPTSTR ExtPtr= NULL;
HINF hInf = INVALID_HANDLE_VALUE;
if(!LogContext) {
if(NO_ERROR == CreateLogContext(NULL, TRUE, &LogContext)) {
//
// Remember that we created this log context locally, so we can
// free it when we're done with this routine.
//
FreeLogContext = TRUE;
} else {
//
// Ensure LogContext is still NULL so we won't try to use it.
//
LogContext = NULL;
}
}
try {
//
// Make sure the specified INF is in %windir%\Inf, and that it's an OEM
// INF (i.e, filename is OEM<n>.INF).
//
if(pSetupInfIsFromOemLocation(InfFullPath, TRUE)) {
Err = ERROR_NOT_AN_INSTALLED_OEM_INF;
goto LogAnyUninstallErrors;
} else if(!IsInstalledFileFromOem(pSetupGetFileTitle(InfFullPath), OemFiletypeInf)) {
BOOL IsExceptionInf = FALSE;
GUID ClassGuid;
//
// The INF is in %windir%\Inf, but is not of the form oem<n>.inf.
// It may still be OK to uninstall it, if it's an exception INF...
//
hInf = SetupOpenInfFile(InfFullPath, NULL, INF_STYLE_WIN4, NULL);
if(hInf != INVALID_HANDLE_VALUE) {
//
// We don't need to lock the INF because it'll never be
// accessible outside of this routine.
//
if(ClassGuidFromInfVersionNode(&(((PLOADED_INF)hInf)->VersionBlock), &ClassGuid)
&& IsEqualGUID(&ClassGuid, &GUID_DEVCLASS_WINDOWS_COMPONENT_PUBLISHER)) {
IsExceptionInf = TRUE;
}
//
// Close the INF handle now so we won't still have it open if
// we end up deleting the INF.
//
SetupCloseInfFile(hInf);
hInf = INVALID_HANDLE_VALUE; // no need to close if we hit an exception
}
if(!IsExceptionInf) {
Err = ERROR_NOT_AN_INSTALLED_OEM_INF;
goto LogAnyUninstallErrors;
}
}
//
// Unless the caller passed in the SUOI_FORCEDELETE flag first check
// that no devices are using this INF file.
//
if(!(Flags & SUOI_FORCEDELETE) &&
pAnyDeviceUsingInf(InfFullPath, LogContext)) {
//
// Some device is still using this INF so we can't delete it.
//
Err = ERROR_INF_IN_USE_BY_DEVICES;
goto LogAnyUninstallErrors;
}
//
// Copy the caller-supplied INF name into a local buffer, so we can
// modify it when deleting the various files (INF, PNF, and CAT).
//
if(FAILED(StringCchCopy(FileNameBuffer, SIZECHARS(FileNameBuffer), InfFullPath))) {
//
// This error would be returned by DeleteFile if we let it go
// through.
//
Err = ERROR_PATH_NOT_FOUND;
goto LogAnyUninstallErrors;
}
//
// Uninstall the catalog (if any) first, because as soon as we delete
// the INF, that slot is "open" for use by another INF, and we wouldn't
// want to inadvertently delete someone else's catalog due to a race
// condition.
//
ExtPtr = _tcsrchr(FileNameBuffer, TEXT('.'));
MYASSERT(ExtPtr); // we already validated the filename's format
if(FAILED(StringCchCopy(ExtPtr,
SIZECHARS(FileNameBuffer)-(ExtPtr-FileNameBuffer),
pszCatSuffix))) {
Err = ERROR_BUFFER_OVERFLOW;
} else {
Err = pSetupUninstallCatalog(pSetupGetFileTitle(FileNameBuffer));
}
if((Err != NO_ERROR) && LogContext) {
//
// It's kinda important that we were unable to delete the catalog,
// but not important enough to fail the routine. Log this fact to
// setupapi.log...
//
WriteLogEntry(LogContext,
DEL_ERR_LOG_LEVEL(Err) | SETUP_LOG_BUFFER,
MSG_LOG_OEM_CAT_UNINSTALL_FAILED,
NULL,
pSetupGetFileTitle(FileNameBuffer)
);
WriteLogError(LogContext,
DEL_ERR_LOG_LEVEL(Err),
Err
);
}
//
// Now delete the PNF (we don't care so much if this succeeds or
// fails)...
//
if(SUCCEEDED(StringCchCopy(ExtPtr,
SIZECHARS(FileNameBuffer)-(ExtPtr-FileNameBuffer),
pszPnfSuffix))) {
SetFileAttributes(FileNameBuffer, FILE_ATTRIBUTE_NORMAL);
DeleteFile(FileNameBuffer);
}
//
// and finally the INF itself...
//
SetFileAttributes(InfFullPath, FILE_ATTRIBUTE_NORMAL);
Err = GLE_FN_CALL(FALSE, DeleteFile(InfFullPath));
LogAnyUninstallErrors:
if((Err != NO_ERROR) && LogContext) {
WriteLogEntry(LogContext,
SETUP_LOG_ERROR | SETUP_LOG_BUFFER,
MSG_LOG_OEM_INF_UNINSTALL_FAILED,
NULL,
InfFullPath
);
WriteLogError(LogContext,
SETUP_LOG_ERROR,
Err
);
}
if(InfDeleteErr) {
*InfDeleteErr = Err;
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(),
ERROR_INVALID_PARAMETER,
InfDeleteErr
);
if(hInf != INVALID_HANDLE_VALUE) {
SetupCloseInfFile(hInf);
}
}
if(FreeLogContext) {
DeleteLogContext(LogContext);
}
}
DWORD
_VerifyFile(
IN PSETUP_LOG_CONTEXT LogContext,
IN OUT PVERIFY_CONTEXT VerifyContext, OPTIONAL
IN LPCTSTR Catalog, OPTIONAL
IN PVOID CatalogBaseAddress, OPTIONAL
IN DWORD CatalogImageSize,
IN LPCTSTR Key,
IN LPCTSTR FileFullPath,
OUT SetupapiVerifyProblem *Problem, OPTIONAL
OUT LPTSTR ProblemFile, OPTIONAL
IN BOOL CatalogAlreadyVerified,
IN PSP_ALTPLATFORM_INFO_V2 AltPlatformInfo, OPTIONAL
IN DWORD Flags, OPTIONAL
OUT LPTSTR CatalogFileUsed, OPTIONAL
OUT PDWORD NumCatalogsConsidered, OPTIONAL
OUT LPTSTR DigitalSigner, OPTIONAL
OUT LPTSTR SignerVersion, OPTIONAL
OUT HANDLE *hWVTStateData OPTIONAL
)
/*++
Routine Description:
This routine verifies a single file against a particular catalog file, or
against any installed catalog file.
Arguments:
LogContext - supplies the context to be used when logging information about
the routine's activities.
VerifyContext - optionally, supplies the address of a structure that caches
various verification context handles. These handles may be NULL (if
not previously acquired, and they may be filled in upon return (in
either success or failure) if they were acquired during the processing
of this verification request. It is the caller's responsibility to
free these various context handles when they are no longer needed by
calling pSetupFreeVerifyContextMembers.
Catalog - optionally, supplies the path of the catalog file to be used for
the verification. If this argument is not specified, then this routine
will attempt to find a catalog that can verify it from among all
catalogs installed in the system.
If this path is a simple filename (no path components), then we'll look
up that catalog file in the CatAdmin's list of installed catalogs, else
we'll use the name as-is.
CatalogBaseAddress - optionally, supplies the address of a buffer
containing the entire catalog image with which our enumerated catalog
must match before being considered a correct validation. This is used
when copying OEM INFs, for example, when there may be multiple
installed catalogs that can validate an INF, but we want to make sure
that we pick _the_ catalog that matches the one we're contemplating
installing before we'll consider our INF/CAT files to be duplicates of
the previously-existing files.
This parameter (and its partner, CatalogImageSize) are only used when
Catalog doesn't specify a file path.
CatalogImageSize - if CatalogBaseAddress is specified, this parameter give
the size, in bytes, of that buffer.
Key - supplies a value that "indexes" the catalog, telling the verify APIs
which signature datum within the catalog it should use. Typically
the key is the (original) filename of a file.
FileFullPath - supplies the full path of the file to be verified.
Problem - if supplied, this parameter points to a variable that will be
filled in upon unsuccessful return with the cause of failure. If this
parameter is not supplied, then the ProblemFile parameter is ignored.
ProblemFile - if supplied, this parameter points to a character buffer of
at least MAX_PATH characters that receives the name of the file for
which a verification error occurred (the contents of this buffer are
undefined if verification succeeds.
If the Problem parameter is supplied, then the ProblemFile parameter
must also be specified.
CatalogAlreadyVerified - if TRUE, then verification won't be done on the
catalog--we'll just use that catalog to validate the file of interest.
If this is TRUE, then Catalog must be specified, must contain the path
to the catalog file (i.e., it can't be a simple filename).
** This flag is ignored when validating via Authenticode policy--the **
** catalog is always verified. **
AltPlatformInfo - optionally, supplies alternate platform information used
to fill in a DRIVER_VER_INFO structure (defined in sdk\inc\softpub.h)
that is passed to WinVerifyTrust.
** NOTE: This structure _must_ have its cbSize field set to **
** sizeof(SP_ALTPLATFORM_INFO_V2) -- validation on client-supplied **
** buffer is the responsibility of the caller. **
Flags - supplies flags that alter that behavior of this routine. May be a
combination of the following values:
VERIFY_FILE_IGNORE_SELFSIGNED - if this bit is set, then this routine
will fail validation for self-signed
binaries.
VERIFY_FILE_USE_OEM_CATALOGS - if this bit is set, then all catalogs
installed in the system will be scanned
to verify the given file. Otherwise,
OEM (3rd party) catalogs will NOT be
scanned to verify the given file. This
is only applicable if a catalog is not
specified.
VERIFY_FILE_USE_AUTHENTICODE_CATALOG - Validate the file using a
catalog signed with Authenticode
policy. If this flag is set,
we'll _only_ check for
Authenticode signatures, so if
the caller wants to first try
validating a file for OS code-
signing usage, then falling back
to Authenticode, they'll have to
call this routine twice.
If this flag is set, then the
caller may also supply the
hWVTStateData output parameter,
which can be used to prompt user
in order to establish that the
publisher should be trusted.
_VerifyFile will return one of
two error codes upon successful
validation via Authenticode
policy. Refer to the "Return
Value" section for details.
VERIFY_FILE_DRIVERBLOCKED_ONLY - Only check if the file is in the bad
driver database, don't do any digital
sigature validation.
VERIFY_FILE_NO_DRIVERBLOCKED_CHECK - Don't check if the file is blocked
via the Bad Driver Database.
CatalogFileUsed - if supplied, this parameter points to a character buffer
at least MAX_PATH characters big that receives the name of the catalog
file used to verify the specified file. This is only filled in upon
successful return, or when the Problem is SetupapiVerifyFileProblem
(i.e., the catalog verified, but the file did not). If this buffer is
set to the empty string upon a SetupapiVerifyFileProblem failure, then
we didn't find any applicable catalogs to use for validation.
Also, this buffer will contain an empty string upon successful return
if the file was validated without using a catalog (i.e., the file
contains its own signature).
NumCatalogsConsidered - if supplied, this parameter receives a count of the
number of catalogs against which verification was attempted. Of course,
if Catalog is specified, this number will always be either zero or one.
DigitalSigner - if supplied, this parameter points to a character buffer of
at least MAX_PATH characters that receives the name of who digitally
signed the specified file. This value is only set if the Key is
correctly signed (i.e. the function returns NO_ERROR).
** This parameter should not be supplied when validating using **
** Authenticode policy. Information about signer, date, etc., may **
** be acquired from the hWVTStateData in that case. **
SignerVersion - if supplied, this parameter points to a character buffer of
at least MAX_PATH characters that receives the signer version as
returned in the szwVerion field of the DRIVER_VER_INFO structure in our
call to WinVerifyTrust.
** This parameter should not be supplied when validating using **
** Authenticode policy. Information about signer, date, etc., may **
** be acquired from the hWVTStateData in that case. **
hWVTStateData - if supplied, this parameter points to a buffer that
receives a handle to WinVerifyTrust state data. This handle will be
returned only when validation was successfully performed using
Authenticode policy. This handle may be used, for example, to retrieve
signer info when prompting the user about whether they trust the
publisher. (The status code returned will indicate whether or not this
is necessary, see "Return Value" section below.)
This parameter should only be supplied if the
VERIFY_FILE_USE_AUTHENTICODE_CATALOG bit is set in the supplied Flags.
If the routine fails, then this handle will be set to NULL.
It is the caller's responsibility to close this handle when they're
finished with it by calling pSetupCloseWVTStateData().
Return Value:
If the file was successfully validated via driver signing policy (or we
didn't perform digital signature verification and everything else
succeeded), then the return value is NO_ERROR.
If the file was successfully validated via Authenticode policy, and the
publisher was in the TrustedPublisher store, then the return value is
ERROR_AUTHENTICODE_TRUSTED_PUBLISHER.
If the file was successfully validated via Authenticode policy, and the
publisher was not in the TrustedPublisher store (hence we must prompt the
user to establish their trust of the publisher), then the return value is
ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED
If a failure occurred, the return value is a Win32 error code indicating
the cause of the failure.
--*/
{
LPBYTE Hash;
DWORD HashSize;
CATALOG_INFO CatInfo;
HANDLE hFile;
HCATINFO hCatInfo;
HCATINFO PrevCat;
DWORD Err, AuthenticodeErr;
WINTRUST_DATA WintrustData;
WINTRUST_CATALOG_INFO WintrustCatalogInfo;
WINTRUST_FILE_INFO WintrustFileInfo;
DRIVER_VER_INFO VersionInfo;
LPTSTR CatalogFullPath;
WCHAR UnicodeKey[MAX_PATH];
WIN32_FILE_ATTRIBUTE_DATA FileAttribData;
BOOL FoundMatchingImage;
DWORD CurCatFileSize;
HANDLE CurCatFileHandle, CurCatMappingHandle;
PVOID CurCatBaseAddress;
BOOL LoggedWarning;
BOOL TrySelfSign;
DWORD AltPlatSlot;
TAGREF tagref;
HCATADMIN LocalhCatAdmin;
HSDB LocalhSDBDrvMain;
BOOL UseAuthenticodePolicy = Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG;
//
// Initialize the CatalogFileUsed parameter to an empty string (i.e., no
// applicable catalog at this point).
//
if(CatalogFileUsed) {
*CatalogFileUsed = TEXT('\0');
}
//
// Initialize the output counter indicating the number of catalog files we
// processed during the attempted verification.
//
if(NumCatalogsConsidered) {
*NumCatalogsConsidered = 0;
}
//
// Initialize the output handle for WinVerifyTrust state data.
//
if(hWVTStateData) {
*hWVTStateData = NULL;
}
//
// If Authenticode validation is requested, then the caller shouldn't have
// passed in the DigitalSigner and SignerVersion output parameters.
//
MYASSERT(!UseAuthenticodePolicy || (!DigitalSigner && !SignerVersion));
if(GlobalSetupFlags & PSPGF_MINIMAL_EMBEDDED) {
//
// The old behavior of this API in the ANSI case where the crypto
// APIs weren't available was to set the CatalogFileUsed OUT param to
// an empty string and report NO_ERROR. We'll do the same thing here
// (but we'll also assert, because no external callers should care, and
// if they do, an empty string probably isn't going to make them very
// happy).
//
MYASSERT(!CatalogFileUsed);
MYASSERT(!NumCatalogsConsidered);
//
// We'd better not be called in minimal embedded scenarios where we're
// asked to provide signer info...
//
MYASSERT(!DigitalSigner);
MYASSERT(!SignerVersion);
//
// Likewise, we'd better not be called asking to validate using
// Authenticode policy (and hence, to return WinVerifyTrust state data
// regarding the signing certificate).
//
MYASSERT(!UseAuthenticodePolicy);
return NO_ERROR;
}
//
// If the caller requested that we return WinVerifyTrust state data upon
// successful Authenticode validation, then they'd better have actually
// requested Authenticode validation!
//
MYASSERT(!hWVTStateData || UseAuthenticodePolicy);
//
// Doesn't make sense to have both these flags set!
//
MYASSERT((Flags & (VERIFY_FILE_DRIVERBLOCKED_ONLY | VERIFY_FILE_NO_DRIVERBLOCKED_CHECK))
!= (VERIFY_FILE_DRIVERBLOCKED_ONLY | VERIFY_FILE_NO_DRIVERBLOCKED_CHECK)
);
//
// If Problem is supplied, then ProblemFile must also be supplied.
//
MYASSERT(!Problem || ProblemFile);
//
// If the caller claims to have already verified the catalog file, make
// sure they passed us the full path to one.
//
MYASSERT(!CatalogAlreadyVerified || (Catalog && (Catalog != pSetupGetFileTitle(Catalog))));
//
// If a catalog image is specified, we'd better have been given a size.
//
MYASSERT((CatalogBaseAddress && CatalogImageSize) ||
!(CatalogBaseAddress || CatalogImageSize));
//
// If a catalog image was supplied for comparison, there shouldn't be a
// file path specified in the Catalog parameter.
//
MYASSERT(!CatalogBaseAddress || !(Catalog && (Catalog != pSetupGetFileTitle(Catalog))));
//
// OK, preliminary checking is over--prepare to enter try/except block...
//
hFile = INVALID_HANDLE_VALUE;
Hash = NULL;
LoggedWarning = FALSE;
TrySelfSign = FALSE;
AltPlatSlot = 0;
tagref = TAGREF_NULL;
LocalhCatAdmin = NULL;
LocalhSDBDrvMain = NULL;
hCatInfo = NULL;
AuthenticodeErr = NO_ERROR;
//
// Go ahead and initialize the VersionInfo structure as well.
// WinVerifyTrust will sometimes fill in the pcSignerCertContext field with
// a cert context that must be freed, and we don't want to introduce the
// possibility of leaking this if we hit an exception at an inopportune
// moment. (We don't need to do this for Authenticode verification,
// because Authenticode pays no attention to the driver version info.)
//
if(!UseAuthenticodePolicy) {
ZeroMemory(&VersionInfo, sizeof(DRIVER_VER_INFO));
VersionInfo.cbStruct = sizeof(DRIVER_VER_INFO);
}
try {
if(GlobalSetupFlags & PSPGF_AUTOFAIL_VERIFIES) {
if(Problem) {
*Problem = SetupapiVerifyAutoFailProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileFullPath);
}
Err = TRUST_E_FAIL;
leave;
}
if(AltPlatformInfo) {
AltPlatSlot = AllocLogInfoSlotOrLevel(LogContext,SETUP_LOG_VERBOSE,FALSE);
WriteLogEntry(LogContext,
AltPlatSlot,
MSG_LOG_VERIFYFILE_ALTPLATFORM,
NULL, // text message
AltPlatformInfo->Platform,
AltPlatformInfo->MajorVersion,
AltPlatformInfo->MinorVersion,
AltPlatformInfo->FirstValidatedMajorVersion,
AltPlatformInfo->FirstValidatedMinorVersion
);
}
if(VerifyContext && VerifyContext->hCatAdmin) {
LocalhCatAdmin = VerifyContext->hCatAdmin;
} else {
Err = GLE_FN_CALL(FALSE,
CryptCATAdminAcquireContext(&LocalhCatAdmin,
&DriverVerifyGuid,
0)
);
if(Err != NO_ERROR) {
//
// Failure encountered--ensure local handle is still NULL.
//
LocalhCatAdmin = NULL;
if(Problem) {
//
// We failed too early to blame the file as the problem,
// but it's the only filename we currently have to return
// as the problematic file.
//
*Problem = SetupapiVerifyFileProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileFullPath);
}
leave;
}
//
// If requested, store the handle to be returned to the caller.
//
if(VerifyContext) {
VerifyContext->hCatAdmin = LocalhCatAdmin;
}
}
//
// Calculate the hash value for the inf.
//
Err = GLE_FN_CALL(INVALID_HANDLE_VALUE,
hFile = CreateFile(FileFullPath,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
0,
NULL)
);
if(Err != NO_ERROR) {
if(Problem) {
*Problem = SetupapiVerifyFileProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileFullPath);
}
leave;
}
//
// Only check if the driver is in the defective driver database if we
// are NOT in GUI setup, and the caller has NOT passed in the
// VERIFY_FILE_NO_DRIVERBLOCKED_CHECK flag.
//
if(!GuiSetupInProgress &&
!(Flags & VERIFY_FILE_NO_DRIVERBLOCKED_CHECK)) {
//
// Shim database APIs have been known to crash from time to time,
// so guard ourselves against that because failure to do a lookup
// in the bad driver database should not result in a verification
// failure.
//
try {
if(VerifyContext && VerifyContext->hSDBDrvMain) {
LocalhSDBDrvMain = VerifyContext->hSDBDrvMain;
} else {
LocalhSDBDrvMain = SdbInitDatabaseEx(SDB_DATABASE_MAIN_DRIVERS,
NULL,
DEFAULT_IMAGE
);
if(LocalhSDBDrvMain) {
//
// If requested, store the handle to be returned to the
// caller.
//
if(VerifyContext) {
VerifyContext->hSDBDrvMain = LocalhSDBDrvMain;
}
} else {
//
// Log a warning that we couldn't access the bad driver
// database to check if this is a blocked driver.
// (SdbInitDatabase doesn't set last error, so we don't
// know why this failed--only that it did.)
//
WriteLogEntry(LogContext,
SETUP_LOG_WARNING,
MSG_LOG_CANT_ACCESS_BDD,
NULL,
FileFullPath
);
}
}
//
// Check the bad driver database to see if this file is blocked.
//
if(LocalhSDBDrvMain) {
tagref = SdbGetDatabaseMatch(LocalhSDBDrvMain,
Key,
hFile,
NULL,
0);
if(tagref != TAGREF_NULL) {
//
// Read the driver policy to see if this should be
// blocked by usermode or not.
// If the 1st bit is set then this should NOT be blocked
// by usermode.
//
ULONG type, size, policy;
size = sizeof(policy);
policy = 0;
type = REG_DWORD;
if(SdbQueryDriverInformation(LocalhSDBDrvMain,
tagref,
TEXT("Policy"),
&type,
&policy,
&size) != ERROR_SUCCESS) {
//
// If we can't read the policy then default to 0.
// This means we will block in usermode!
//
policy = 0;
}
if(!(policy & DDB_DRIVER_POLICY_SETUP_NO_BLOCK_BIT)) {
//
// This driver is in the database and needs to be
// blocked!
//
WriteLogEntry(LogContext,
SETUP_LOG_VERBOSE,
MSG_LOG_DRIVER_BLOCKED_ERROR,
NULL,
FileFullPath
);
LoggedWarning = TRUE;
if(Problem) {
*Problem = SetupapiVerifyDriverBlocked;
StringCchCopy(ProblemFile, MAX_PATH, FileFullPath);
}
Err = ERROR_DRIVER_BLOCKED;
leave;
}
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(),
ERROR_INVALID_PARAMETER,
&Err
);
WriteLogEntry(LogContext,
SETUP_LOG_WARNING | SETUP_LOG_BUFFER,
MSG_LOG_CANT_ACCESS_BDD_EXCEPTION,
NULL,
FileFullPath
);
WriteLogError(LogContext, SETUP_LOG_WARNING, Err);
}
}
//
// If the caller only wanted to check if the file was in the bad driver
// database then we are done.
//
if(Flags & VERIFY_FILE_DRIVERBLOCKED_ONLY) {
Err = NO_ERROR;
leave;
}
//
// Initialize some of the structures that will be used later on
// in calls to WinVerifyTrust. We don't know if we're verifying
// against a catalog or against a file yet.
//
ZeroMemory(&WintrustData, sizeof(WINTRUST_DATA));
WintrustData.cbStruct = sizeof(WINTRUST_DATA);
WintrustData.dwUIChoice = WTD_UI_NONE;
WintrustData.dwProvFlags = WTD_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT |
WTD_CACHE_ONLY_URL_RETRIEVAL;
if(!UseAuthenticodePolicy) {
//
// We only supply a driver version info structure if we're doing
// validation via driver signing policy. Authenticode completely
// ignores this...
//
if(AltPlatformInfo) {
MYASSERT(AltPlatformInfo->cbSize == sizeof(SP_ALTPLATFORM_INFO_V2));
//
// Caller wants the file validated for an alternate
// platform, so we must fill in a DRIVER_VER_INFO structure
// to be passed to the policy module.
//
VersionInfo.dwPlatform = AltPlatformInfo->Platform;
VersionInfo.dwVersion = AltPlatformInfo->MajorVersion;
VersionInfo.sOSVersionLow.dwMajor = AltPlatformInfo->FirstValidatedMajorVersion;
VersionInfo.sOSVersionLow.dwMinor = AltPlatformInfo->FirstValidatedMinorVersion;
VersionInfo.sOSVersionHigh.dwMajor = AltPlatformInfo->MajorVersion;
VersionInfo.sOSVersionHigh.dwMinor = AltPlatformInfo->MinorVersion;
} else {
//
// If an AltPlatformInfo was not passed in then set the
// WTD_USE_DEFAULT_OSVER_CHECK flag. This flag tells
// WinVerifyTrust to use its default osversion checking, even
// though a DRIVER_VER_INFO structure was passed in.
//
WintrustData.dwProvFlags |= WTD_USE_DEFAULT_OSVER_CHECK;
}
//
// Specify a DRIVER_VER_INFO structure so we can get back
// who signed the file and the signer version information.
// If we don't have an AltPlatformInfo then set the
// WTD_USE_DEFAULT_OSVER_CHECK flag so that WinVerifyTrust will do
// its default checking, just as if a DRIVER_VER_INFO structure
// was not passed in.
//
WintrustData.pPolicyCallbackData = (PVOID)&VersionInfo;
//
// "auto-cache" feature only works for driver signing policy...
//
WintrustData.dwStateAction = WTD_STATEACTION_AUTO_CACHE;
}
//
// Compute the cryptographic hash for the file. If we fail to compute
// this hash, we want to bail immediately. We don't want to attempt to
// fallback to self-signed binaries, because in the future the hash may
// be used to revoke a signature, and we wouldn't want to automatically
// trust a self-signed binary in that case.
//
HashSize = 100; // start out with a reasonable size for most requests.
do {
Hash = MyMalloc(HashSize);
if(!Hash) {
Err = ERROR_NOT_ENOUGH_MEMORY;
} else {
Err = GLE_FN_CALL(FALSE,
CryptCATAdminCalcHashFromFileHandle(hFile,
&HashSize,
Hash,
0)
);
}
if(Err != NO_ERROR) {
if(Hash) {
MyFree(Hash);
Hash = NULL;
}
if(Err != ERROR_INSUFFICIENT_BUFFER) {
//
// We failed for some reason other than buffer-too-small.
//
WriteLogEntry(LogContext,
SETUP_LOG_WARNING | SETUP_LOG_BUFFER,
MSG_LOG_HASH_ERROR,
NULL,
FileFullPath,
Catalog ? Catalog : TEXT(""),
Key
);
WriteLogError(LogContext, SETUP_LOG_WARNING, Err);
LoggedWarning = TRUE;
if(Problem) {
*Problem = SetupapiVerifyFileProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileFullPath);
}
leave;
}
}
} while(Err != NO_ERROR);
//
// Now we have the file's hash. Initialize the structures that will be
// used later on in calls to WinVerifyTrust.
//
WintrustData.dwUnionChoice = WTD_CHOICE_CATALOG;
WintrustData.pCatalog = &WintrustCatalogInfo;
ZeroMemory(&WintrustCatalogInfo, sizeof(WINTRUST_CATALOG_INFO));
WintrustCatalogInfo.cbStruct = sizeof(WINTRUST_CATALOG_INFO);
WintrustCatalogInfo.pbCalculatedFileHash = Hash;
WintrustCatalogInfo.cbCalculatedFileHash = HashSize;
//
// WinVerifyTrust is case-sensitive, so ensure that the key being used
// is all lower-case. (We copy the key to a writable Unicode character
// buffer so we can lower-case it.)
//
StringCchCopy(UnicodeKey, SIZECHARS(UnicodeKey), Key);
CharLower(UnicodeKey);
WintrustCatalogInfo.pcwszMemberTag = UnicodeKey;
if(Catalog && (Catalog != pSetupGetFileTitle(Catalog))) {
//
// We know in this case we're always going to examine exactly one
// catalog.
//
if(NumCatalogsConsidered) {
*NumCatalogsConsidered = 1;
}
//
// Fill in the catalog information since we know which catalog
// we're going to be using...
//
WintrustCatalogInfo.pcwszCatalogFilePath = Catalog;
//
// The caller supplied the path to the catalog file to be used for
// verification--we're ready to go! First, verify the catalog
// (unless the caller already did it), and if that succeeds, then
// verify the file.
//
if(!CatalogAlreadyVerified || UseAuthenticodePolicy) {
//
// Before validating the catalog, we'll flush the crypto cache.
// Otherwise, it can get fooled when validating against a
// catalog at a specific location, because that catalog can
// change "behind its back".
//
if(WintrustData.dwStateAction == WTD_STATEACTION_AUTO_CACHE) {
WintrustData.dwStateAction = WTD_STATEACTION_AUTO_CACHE_FLUSH;
Err = (DWORD)WinVerifyTrust(NULL,
&DriverVerifyGuid,
&WintrustData
);
if(Err != NO_ERROR) {
//
// This shouldn't fail, but log a warning if it does...
//
WriteLogEntry(LogContext,
SETUP_LOG_WARNING | SETUP_LOG_BUFFER,
MSG_LOG_CRYPTO_CACHE_FLUSH_FAILURE,
NULL,
Catalog
);
WriteLogError(LogContext,
SETUP_LOG_WARNING,
Err
);
//
// treat this error as non-fatal
//
}
//
// When flushing the cache, crypto isn't supposed to be
// allocating a pcSignerCertContext...
//
MYASSERT(!VersionInfo.pcSignerCertContext);
if(VersionInfo.pcSignerCertContext) {
CertFreeCertificateContext(VersionInfo.pcSignerCertContext);
VersionInfo.pcSignerCertContext = NULL;
}
//
// Now back to our regularly-scheduled programming...
//
WintrustData.dwStateAction = WTD_STATEACTION_AUTO_CACHE;
}
//
// NTRAID#NTBUG9-705286-2002/09/17-LonnyM superfluous validation of catalog
// Apparently, WinVerifyTrust validates both the catalog, and
// the file vouched thereby. We should clean this up, although
// the performance delta is probably insignificant.
//
Err = _VerifyCatalogFile(LogContext,
Catalog,
AltPlatformInfo,
UseAuthenticodePolicy,
(VerifyContext
? &(VerifyContext->hStoreTrustedPublisher)
: NULL),
hWVTStateData
);
//
// If we got one of the two "successful" errors when validating
// via Authenticode policy, then reset our error, and save the
// Authenticode error for use later, if we don't subsequently
// encounter some other failure.
//
if((Err == ERROR_AUTHENTICODE_TRUSTED_PUBLISHER) ||
(Err == ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED)) {
MYASSERT(UseAuthenticodePolicy);
MYASSERT(!hWVTStateData || *hWVTStateData);
AuthenticodeErr = Err;
Err = NO_ERROR;
}
}
if(Err != NO_ERROR) {
MYASSERT(!hWVTStateData || !*hWVTStateData);
WriteLogEntry(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy) | SETUP_LOG_BUFFER,
(UseAuthenticodePolicy
? MSG_LOG_VERIFYCAT_VIA_AUTHENTICODE_ERROR
: MSG_LOG_VERIFYCAT_ERROR),
NULL,
Catalog
);
WriteLogError(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy),
Err
);
LoggedWarning = TRUE;
if(Problem) {
*Problem = SetupapiVerifyCatalogProblem;
StringCchCopy(ProblemFile, MAX_PATH, Catalog);
}
leave;
}
//
// Catalog was verified, now verify the file using that catalog.
//
if(CatalogFileUsed) {
StringCchCopy(CatalogFileUsed, MAX_PATH, Catalog);
}
Err = (DWORD)WinVerifyTrust(NULL,
(UseAuthenticodePolicy
? &AuthenticodeVerifyGuid
: &DriverVerifyGuid),
&WintrustData
);
//
// Fill in the DigitalSigner and SignerVersion if they were passed
// in.
//
if(Err == NO_ERROR) {
if(DigitalSigner) {
StringCchCopy(DigitalSigner, MAX_PATH, VersionInfo.wszSignedBy);
}
if(SignerVersion) {
StringCchCopy(SignerVersion, MAX_PATH, VersionInfo.wszVersion);
}
} else if(!UseAuthenticodePolicy && (Err == ERROR_APP_WRONG_OS)) {
//
// We failed validation via driver signing policy because of an
// osattribute mismatch. Translate this error into something
// with more understandable text.
//
Err = ERROR_SIGNATURE_OSATTRIBUTE_MISMATCH;
}
if(Err != NO_ERROR) {
WriteLogEntry(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy) | SETUP_LOG_BUFFER,
(UseAuthenticodePolicy
? MSG_LOG_VERIFYFILE_AUTHENTICODE_AGAINST_FULLCATPATH_ERROR
: MSG_LOG_VERIFYFILE_AGAINST_FULLCATPATH_ERROR),
NULL,
FileFullPath,
Catalog,
Key
);
WriteLogError(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy),
Err
);
LoggedWarning = TRUE;
if(Problem) {
*Problem = SetupapiVerifyFileProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileFullPath);
}
} else {
//
// Log the successful validation against the caller-specified
// catalog.
//
if(UseAuthenticodePolicy) {
WriteLogEntry(LogContext,
DRIVER_LOG_INFO | SETUP_LOG_BUFFER,
MSG_LOG_VERIFYFILE_AUTHENTICODE_AGAINST_FULLCATPATH_OK,
NULL,
FileFullPath,
Catalog,
Key
);
WriteLogError(LogContext, DRIVER_LOG_INFO, AuthenticodeErr);
} else {
WriteLogEntry(LogContext,
SETUP_LOG_VERBOSE,
MSG_LOG_VERIFYFILE_AGAINST_FULLCATPATH_OK,
NULL,
FileFullPath,
Catalog,
Key
);
}
}
//
// We don't attempt to fallback to self-contained signatures in
// cases where the catalog is specifically specified. Thus, we're
// done, regardless of whether or not we were successful.
//
leave;
}
//
// We'd better have a catalog name (i.e., not be doing global
// validation) if we're supposed to be verifying via Authenticode
// policy!
//
MYASSERT(!UseAuthenticodePolicy || Catalog);
//
// Search through installed catalogs looking for those that contain
// data for a file with the hash we just calculated (aka, "global
// validation").
//
PrevCat = NULL;
Err = GLE_FN_CALL(NULL,
hCatInfo = CryptCATAdminEnumCatalogFromHash(
LocalhCatAdmin,
Hash,
HashSize,
0,
&PrevCat)
);
while(hCatInfo) {
CatInfo.cbStruct = sizeof(CATALOG_INFO);
if(CryptCATCatalogInfoFromContext(hCatInfo, &CatInfo, 0)) {
CatalogFullPath = CatInfo.wszCatalogFile;
//
// If we have a catalog name we're looking for, see if the
// current catalog matches. If the caller didn't specify a
// catalog, then just attempt to validate against each
// catalog we enumerate. Note that the catalog file info
// we get back gives us a fully qualified path.
//
if(Catalog) {
FoundMatchingImage = !lstrcmpi(
pSetupGetFileTitle(CatalogFullPath),
Catalog
);
} else {
if((Flags & VERIFY_FILE_USE_OEM_CATALOGS) ||
!IsInstalledFileFromOem(pSetupGetFileTitle(CatalogFullPath),
OemFiletypeCat)) {
FoundMatchingImage = TRUE;
} else {
FoundMatchingImage = FALSE;
}
}
if(FoundMatchingImage) {
//
// Increment our counter of how many catalogs we've
// considered.
//
if(NumCatalogsConsidered) {
(*NumCatalogsConsidered)++;
}
//
// If the caller supplied a mapped-in image of the
// catalog we're looking for, then check to see if this
// catalog matches by doing a binary compare.
//
if(CatalogBaseAddress) {
FoundMatchingImage = GetFileAttributesEx(
CatalogFullPath,
GetFileExInfoStandard,
&FileAttribData
);
//
// Check to see if the catalog we're looking
// at is the same size as the one we're
// verifying.
//
if(FoundMatchingImage &&
(FileAttribData.nFileSizeLow != CatalogImageSize)) {
FoundMatchingImage = FALSE;
}
if(FoundMatchingImage) {
if(NO_ERROR == pSetupOpenAndMapFileForRead(
CatalogFullPath,
&CurCatFileSize,
&CurCatFileHandle,
&CurCatMappingHandle,
&CurCatBaseAddress)) {
MYASSERT(CurCatFileSize == CatalogImageSize);
//
// Wrap this binary compare in its own try/
// except block, because if we run across a
// catalog we can't read for some reason,
// we don't want this to abort our search.
//
try {
FoundMatchingImage =
!memcmp(CatalogBaseAddress,
CurCatBaseAddress,
CatalogImageSize
);
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(),
ERROR_READ_FAULT,
NULL);
FoundMatchingImage = FALSE;
}
pSetupUnmapAndCloseFile(CurCatFileHandle,
CurCatMappingHandle,
CurCatBaseAddress
);
} else {
FoundMatchingImage = FALSE;
}
}
} else {
//
// Since there was no catalog image supplied to
// match against, the catalog we're currently
// looking at is considered a valid match
// candidate.
//
FoundMatchingImage = TRUE;
}
if(FoundMatchingImage) {
//
// We found an applicable catalog, now validate the
// file against that catalog (this also validates the
// catalog itself).
//
WintrustCatalogInfo.pcwszCatalogFilePath = CatInfo.wszCatalogFile;
Err = (DWORD)WinVerifyTrust(NULL,
(UseAuthenticodePolicy
? &AuthenticodeVerifyGuid
: &DriverVerifyGuid),
&WintrustData
);
//
// Fill in the DigitalSigner and SignerVersion if
// they were passed in.
//
if(Err == NO_ERROR) {
if(DigitalSigner) {
StringCchCopy(DigitalSigner, MAX_PATH, VersionInfo.wszSignedBy);
}
if(SignerVersion) {
StringCchCopy(SignerVersion, MAX_PATH, VersionInfo.wszVersion);
}
} else if(!UseAuthenticodePolicy && (Err == ERROR_APP_WRONG_OS)) {
//
// We failed validation via driver signing policy
// because of an osattribute mismatch. Translate
// this error into something with more
// understandable text.
//
// NOTE: Unfortunately, the crypto APIs report
// ERROR_APP_WRONG_OS in two quite different cases:
//
// 1. Valid driver signing catalog has an
// osattribute mismatch.
// 2. Authenticode catalog is being validated
// using driver signing policy.
//
// We want to translate the error in the first case
// but not in the second. The only way to
// distinguish these two cases is to re-attempt
// verification against _all_ os versions. Thus,
// any failure encountered must be due to #2.
//
//
// The DRIVER_VER_INFO structure was filled in
// during our previous call to WinVerifyTrust with
// a pointer that we must free!
//
if(VersionInfo.pcSignerCertContext) {
CertFreeCertificateContext(VersionInfo.pcSignerCertContext);
}
//
// Now reset the structure and clear the flag so
// that we'll validate against _any_ OS version
// (irrespective of the catalog's osattributes).
//
ZeroMemory(&VersionInfo, sizeof(DRIVER_VER_INFO));
VersionInfo.cbStruct = sizeof(DRIVER_VER_INFO);
WintrustData.dwProvFlags &= ~WTD_USE_DEFAULT_OSVER_CHECK;
if(NO_ERROR == WinVerifyTrust(NULL,
&DriverVerifyGuid,
&WintrustData)) {
//
// The catalog is a valid driver signing
// catalog (i.e., case #1 discussed above).
// Translate this into more specific/meaningful
// error.
//
Err = ERROR_SIGNATURE_OSATTRIBUTE_MISMATCH;
}
}
//
// If we successfully validated via Authenticode
// policy, then we need to determine whether the
// catalog's publisher is in the TrustedPublisher cert
// store.
//
if((Err == NO_ERROR) && UseAuthenticodePolicy) {
AuthenticodeErr = _VerifyCatalogFile(
LogContext,
WintrustCatalogInfo.pcwszCatalogFilePath,
NULL,
TRUE,
(VerifyContext
? &(VerifyContext->hStoreTrustedPublisher)
: NULL),
hWVTStateData
);
MYASSERT((AuthenticodeErr == ERROR_AUTHENTICODE_TRUSTED_PUBLISHER) ||
(AuthenticodeErr == ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED));
if((AuthenticodeErr != ERROR_AUTHENTICODE_TRUSTED_PUBLISHER) &&
(AuthenticodeErr != ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED)) {
//
// This shouldn't have failed, but since it
// did, we'll propagate this over to our error
// status so we treat it appropriately.
//
Err = AuthenticodeErr;
}
}
if(!UseAuthenticodePolicy) {
//
// The DRIVER_VER_INFO structure was filled in with
// a pointer that we must free!
//
if(VersionInfo.pcSignerCertContext) {
CertFreeCertificateContext(VersionInfo.pcSignerCertContext);
VersionInfo.pcSignerCertContext = NULL;
}
}
if(Err != NO_ERROR) {
WriteLogEntry(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy) | SETUP_LOG_BUFFER,
(UseAuthenticodePolicy
? MSG_LOG_VERIFYFILE_AUTHENTICODE_GLOBAL_VALIDATION_ERROR
: MSG_LOG_VERIFYFILE_GLOBAL_VALIDATION_ERROR),
NULL,
FileFullPath,
CatInfo.wszCatalogFile,
Key
);
WriteLogError(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy),
Err
);
LoggedWarning = TRUE;
} else {
if(UseAuthenticodePolicy) {
WriteLogEntry(LogContext,
DRIVER_LOG_INFO | SETUP_LOG_BUFFER,
MSG_LOG_VERIFYFILE_AUTHENTICODE_GLOBAL_VALIDATION_OK,
NULL,
FileFullPath,
CatInfo.wszCatalogFile,
Key
);
WriteLogError(LogContext,
DRIVER_LOG_INFO,
AuthenticodeErr
);
} else {
WriteLogEntry(LogContext,
SETUP_LOG_VERBOSE,
MSG_LOG_VERIFYFILE_GLOBAL_VALIDATION_OK,
NULL,
FileFullPath,
CatInfo.wszCatalogFile,
Key
);
}
}
if(Err == NO_ERROR) {
//
// We successfully verified the file--store the
// name of the catalog used, if the caller
// requested it.
//
if(CatalogFileUsed) {
StringCchCopy(CatalogFileUsed, MAX_PATH, CatalogFullPath);
}
} else {
if(Catalog || CatalogBaseAddress) {
//
// We only want to return the catalog file used
// in cases where we believe the catalog to be
// valid. In this situation, the only case we
// can tell for certain is when we encounter an
// osattribute mismatch.
//
if(CatalogFileUsed && (Err == ERROR_SIGNATURE_OSATTRIBUTE_MISMATCH)) {
StringCchCopy(CatalogFileUsed, MAX_PATH, CatalogFullPath);
}
if(Problem) {
*Problem = SetupapiVerifyFileProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileFullPath);
}
}
}
//
// If the result of the above validations is success,
// then we're done. If not, and we're looking for a
// relevant catalog file (i.e., the INF didn't specify
// one), then we move on to the next catalog.
// Otherwise, we've failed.
//
if((Err == NO_ERROR) || Catalog || CatalogBaseAddress) {
CryptCATAdminReleaseCatalogContext(LocalhCatAdmin, hCatInfo, 0);
hCatInfo = NULL;
break;
}
}
}
}
PrevCat = hCatInfo;
Err = GLE_FN_CALL(NULL,
hCatInfo = CryptCATAdminEnumCatalogFromHash(
LocalhCatAdmin,
Hash,
HashSize,
0,
&PrevCat)
);
}
if(Err == NO_ERROR) {
//
// We successfully validated the file--we're done!
//
leave;
}
//
// report failure if we haven't already done so
//
if(!LoggedWarning) {
WriteLogEntry(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy) | SETUP_LOG_BUFFER,
(UseAuthenticodePolicy
? MSG_LOG_VERIFYFILE_AUTHENTICODE_GLOBAL_VALIDATION_NO_CATS_FOUND
: MSG_LOG_VERIFYFILE_GLOBAL_VALIDATION_NO_CATS_FOUND),
NULL,
FileFullPath,
Catalog ? Catalog : TEXT(""),
Key
);
WriteLogError(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy),
Err
);
LoggedWarning = TRUE;
}
if(!(Flags & (VERIFY_FILE_IGNORE_SELFSIGNED | VERIFY_FILE_USE_AUTHENTICODE_CATALOG))) {
//
// We've been instructed to allow self-signed files to be
// considered valid, so check for self-contained signature now.
//
WintrustData.dwUnionChoice = WTD_CHOICE_FILE;
WintrustData.pFile = &WintrustFileInfo;
ZeroMemory(&WintrustFileInfo, sizeof(WINTRUST_FILE_INFO));
WintrustFileInfo.cbStruct = sizeof(WINTRUST_FILE_INFO);
WintrustFileInfo.pcwszFilePath = FileFullPath;
Err = (DWORD)WinVerifyTrust(NULL,
&DriverVerifyGuid,
&WintrustData
);
//
// Fill in the DigitalSigner and SignerVersion if
// they were passed in.
//
if(Err == NO_ERROR) {
if(DigitalSigner) {
StringCchCopy(DigitalSigner, MAX_PATH, VersionInfo.wszSignedBy);
}
if(SignerVersion) {
StringCchCopy(SignerVersion, MAX_PATH, VersionInfo.wszVersion);
}
}
//
// The DRIVER_VER_INFO structure was filled in with a pointer that
// we must free!
//
if(VersionInfo.pcSignerCertContext) {
CertFreeCertificateContext(VersionInfo.pcSignerCertContext);
VersionInfo.pcSignerCertContext = NULL;
}
if(Err != NO_ERROR) {
WriteLogEntry(LogContext,
SETUP_LOG_VERBOSE | SETUP_LOG_BUFFER,
MSG_LOG_SELFSIGN_ERROR,
NULL,
FileFullPath,
Key
);
WriteLogError(LogContext, SETUP_LOG_VERBOSE, Err);
LoggedWarning = TRUE;
} else {
WriteLogEntry(LogContext,
SETUP_LOG_VERBOSE,
MSG_LOG_SELFSIGN_OK,
NULL,
FileFullPath,
Key
);
}
}
if(Err == NO_ERROR) {
//
// The file validated without a catalog. Store an empty string
// in the CatalogFileUsed buffer (if supplied).
//
if(CatalogFileUsed) {
*CatalogFileUsed = TEXT('\0');
}
} else {
//
// report error prior to Self-Sign check
//
if(Problem) {
*Problem = SetupapiVerifyFileProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileFullPath);
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, &Err);
}
if(Err == NO_ERROR) {
//
// If we successfully validated via Authenticode policy, then we should
// have squirrelled away one of two "special" errors to be returned to
// the caller...
//
MYASSERT((AuthenticodeErr == NO_ERROR) || UseAuthenticodePolicy);
Err = AuthenticodeErr;
} else {
//
// If we failed, and we haven't already logged a message indicating the
// cause of the failure, log a generic message now.
//
if(!LoggedWarning) {
WriteLogEntry(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy) | SETUP_LOG_BUFFER,
(UseAuthenticodePolicy
? MSG_LOG_VERIFYFILE_AUTHENTICODE_ERROR
: MSG_LOG_VERIFYFILE_ERROR),
NULL,
FileFullPath,
Catalog ? Catalog : TEXT(""),
Key
);
WriteLogError(LogContext,
GetCatLogLevel(Err, UseAuthenticodePolicy),
Err
);
}
if(hWVTStateData && *hWVTStateData) {
//
// We must've hit an exception after retrieving the WinVerifyTrust
// state data. This is extremely unlikely, but if this happens,
// we need to free this here and now.
//
pSetupCloseWVTStateData(*hWVTStateData);
*hWVTStateData = NULL;
}
}
if(!VerifyContext && LocalhSDBDrvMain) {
//
// Don't need to return our HSDB to the caller, so free it now.
//
SdbReleaseDatabase(LocalhSDBDrvMain);
}
if(hFile != INVALID_HANDLE_VALUE) {
CloseHandle(hFile);
}
if(AltPlatSlot) {
ReleaseLogInfoSlot(LogContext, AltPlatSlot);
}
if(Hash) {
MyFree(Hash);
}
if(!UseAuthenticodePolicy && VersionInfo.pcSignerCertContext) {
CertFreeCertificateContext(VersionInfo.pcSignerCertContext);
}
if(hCatInfo) {
MYASSERT(LocalhCatAdmin);
CryptCATAdminReleaseCatalogContext(LocalhCatAdmin, hCatInfo, 0);
}
if(!VerifyContext && LocalhCatAdmin) {
CryptCATAdminReleaseContext(LocalhCatAdmin, 0);
}
return Err;
}
DWORD
pSetupVerifyFile(
IN PSETUP_LOG_CONTEXT LogContext,
IN LPCTSTR Catalog, OPTIONAL
IN PVOID CatalogBaseAddress, OPTIONAL
IN DWORD CatalogImageSize,
IN LPCTSTR Key,
IN LPCTSTR FileFullPath,
OUT SetupapiVerifyProblem *Problem, OPTIONAL
OUT LPTSTR ProblemFile, OPTIONAL
IN BOOL CatalogAlreadyVerified,
IN PSP_ALTPLATFORM_INFO_V2 AltPlatformInfo, OPTIONAL
OUT LPTSTR CatalogFileUsed, OPTIONAL
OUT PDWORD NumCatalogsConsidered OPTIONAL
)
/*++
Routine Description:
See _VerifyFile
Since this private API is exported for use by other system components
(e.g., syssetup), we make a check to ensure that the AltPlatformInfo, if
specified, is of the correct version.
--*/
{
if(AltPlatformInfo) {
if(AltPlatformInfo->cbSize != sizeof(SP_ALTPLATFORM_INFO_V2)) {
return ERROR_INVALID_PARAMETER;
}
if(!(AltPlatformInfo->Flags & SP_ALTPLATFORM_FLAGS_VERSION_RANGE)) {
//
// this flag must be set to indicate the version range fields are
// valid
//
return ERROR_INVALID_PARAMETER;
}
}
return _VerifyFile(LogContext,
NULL,
Catalog,
CatalogBaseAddress,
CatalogImageSize,
Key,
FileFullPath,
Problem,
ProblemFile,
CatalogAlreadyVerified,
AltPlatformInfo,
0,
CatalogFileUsed,
NumCatalogsConsidered,
NULL,
NULL,
NULL
);
}
BOOL
IsInfForDeviceInstall(
IN PSETUP_LOG_CONTEXT LogContext, OPTIONAL
IN CONST GUID *DeviceSetupClassGuid, OPTIONAL
IN PLOADED_INF LoadedInf, OPTIONAL
OUT PTSTR *DeviceDesc, OPTIONAL
OUT PSP_ALTPLATFORM_INFO_V2 *ValidationPlatform, OPTIONAL
OUT PDWORD PolicyToUse, OPTIONAL
OUT PBOOL UseOriginalInfName, OPTIONAL
IN BOOL ForceNonDrvSignPolicy
)
/*++
Routine Description:
This routine determines whether the specified INF is a device INF. If so,
it returns a generic string to use in identifying the device installation
when there is no device description available (e.g., installing a printer).
It can also return the appropriate platform parameters to be used in
digital signature verification for this INF, as well as the codesigning
policy to employ should a digital signature validation failure occur.
Finally, this routine can indicate whether the INF should be installed
under its original name (i.e., because it's an exception package INF).
Arguments:
LogContext - Optionally, supplies the log context for any log entries that
might be generated by this routine.
DeviceSetupClassGuid - Optionally, supplies the address of a GUID that
indicates which device setup class is to be used in determining
information such as description, validation platform, and policy to
use. If this parameter is NULL, then the GUID is retrieved from the
INF list supplied via the LoadedInf parameter.
LoadedInf - Optionally, supplies the address of a loaded INF list we need
to examine to see if any of the members therein are device INFs. An
INF is a device INF if it specifies a class association (via either
Class= or ClassGUID= entries) in its [Version] section. If the
DeviceSetupClassGuid parameter is supplied (i.e., non-NULL), then this
parameter is ignored. If this parameter is also NULL, then it is
assumed the installation is not device-related.
The presence of a device INF anywhere in this list will cause us to
consider this a device installation. However, the _first_ INF we
encounter having a class association is what will be used in
determining the device description (see below).
** NOTE: The caller is responsible for locking the loaded INF **
** list prior to calling this routine! **
DeviceDesc - Optionally, supplies the address of a string pointer that will
be filled in upon return with a (newly-allocated) descriptive string to
be used when referring to this installation (e.g., for doing driver
signing failure popups). We will first try to retrieve the friendly
name for this INF's class (whose determination is described above). If
that's not possible (e.g., the class isn't yet installed), then we'll
return the class name. If that's not possible, then we'll return a
(localized) generic string such as "Unknown driver software package".
This output parameter (if supplied) will only ever be set to a non-NULL
value when the routine returns TRUE. The caller is responsible for
freeing this character buffer. If an out-of-memory failure is
encountered when trying to allocate memory for this buffer, the
DeviceDesc pointer will simply be set to NULL. It will also be set to
NULL if we're dealing with an exception package (since we don't want
to treat this like a "hardware install" for purposes of codesigning
blocking UI).
ValidationPlatform - Optionally, supplies the address of a (version 2)
altplatform info pointer that is filled in upon return with a newly-
allocated structure specifying the appropriate parameters to be passed
to WinVerifyTrust when validating this INF. These parameters are
retrieved from certclas.inf for the relevant device setup class GUID.
If no special parameters are specified for this class (or if the INF
has no class at all), then this pointer is returned as NULL, which
causes us to use WinVerifyTrust's default validation. Note that if
we fail to allocate this structure due to low-memory, the pointer will
be returned as NULL in that case as well. This is OK, because this
simply means we'll do default validation in that case.
By this mechanism, we can easily deal with the different validation
policies in effect for the various device classes we have in the
system.
The caller is responsible for freeing the memory allocated for this
structure.
PolicyToUse - Optionally, supplies the address of a dword variable that is
set upon return to indicate what codesigning policy (i.e., Ignore,
Warn, or Block) should be used for this INF. This determination is
made based on whether any INF in the list is of a class that WHQL has a
certification program for (as specified in %windir%\Inf\certclas.inf).
Additionally, if any INF in the list is of the exception class, then
the policy is automatically set to Block (i.e., it's not configurable
via driver signing or non-driver-signing policy/preference settings).
If it's appropriate to allow for a fallback to an Authenticode
signature, then the high bit of the policy value will be set (i.e.,
DRIVERSIGN_ALLOW_AUTHENTICODE).
UseOriginalInfName - Optionally, supplies the address of a boolean variable
that is set upon return to indicate whether the INF should be installed
into %windir%\Inf under its original name. This will only be true if
the INF is an exception INF.
ForceNonDrvSignPolicy - if TRUE, then we'll use non-driver signing policy,
regardless of whether the INF has an associated device setup class
GUID. (Note: this override won't work if that class GUID is in the
WHQL logo-able list contained in certclas.inf--in that case, we always
want to use driver signing policy.)
This override will also cause us to report that the INF is _not_ a
device INF (assuming it's not a WHQL class, as described above).
Return Value:
If the INF is a device INF, the return value is TRUE. Otherwise, it is
FALSE.
--*/
{
PLOADED_INF CurInf, NextInf;
GUID ClassGuid;
BOOL DeviceInfFound, ClassInDrvSignList;
TCHAR ClassDescBuffer[LINE_LEN];
PCTSTR ClassDesc;
DWORD Err;
BOOL IsExceptionInf = FALSE;
if(DeviceDesc) {
*DeviceDesc = NULL;
}
if(ValidationPlatform) {
*ValidationPlatform = NULL;
}
if(UseOriginalInfName) {
*UseOriginalInfName = FALSE;
}
if(!DeviceSetupClassGuid && !LoadedInf) {
//
// Not a whole lot to do here. Assume non-driver-signing policy and
// return.
//
if(PolicyToUse) {
*PolicyToUse = pSetupGetCurrentDriverSigningPolicy(FALSE);
//
// Non-device installs are always candidates for Authenticode
// signatures.
//
*PolicyToUse |= DRIVERSIGN_ALLOW_AUTHENTICODE;
}
return FALSE;
}
if(PolicyToUse) {
*PolicyToUse = DRIVERSIGN_NONE;
}
//
// If DeviceSetupClassGuid was specified, then retrieve information
// pertaining to that class. Otherwise, traverse the individual INFs in
// the LOADED_INF list, examining each one to see if it's a device INF.
//
DeviceInfFound = FALSE;
ClassInDrvSignList = FALSE;
try {
for(CurInf = LoadedInf; CurInf || DeviceSetupClassGuid; CurInf = NextInf) {
//
// Setup a "NextInf" pointer so we won't dereference NULL when we
// go back through the loop in the case where we have a
// DeviceSetupClassGuid instead of a LoadedInf list.
//
NextInf = CurInf ? CurInf->Next : NULL;
if(!DeviceSetupClassGuid) {
if(ClassGuidFromInfVersionNode(&(CurInf->VersionBlock), &ClassGuid)) {
DeviceSetupClassGuid = &ClassGuid;
} else {
//
// This INF doesn't have an associated device setup class
// GUID, so skip it and continue on with our search for a
// device INF.
//
continue;
}
}
//
// NOTE: From this point forward, you must reset the
// DeviceSetupClasGuid pointer to NULL before making another pass
// through the loop. Otherwise, we'll enter an infinite loop,
// since we can enter the loop if that pointer is non-NULL.
//
if(IsEqualGUID(DeviceSetupClassGuid, &GUID_NULL)) {
//
// The INF specified a ClassGUID of GUID_NULL (e.g., like some
// of our non-device system INFs such as layout.inf do). Skip
// it, and continue on with our search for a device INF.
//
DeviceSetupClassGuid = NULL;
continue;
}
//
// If we get to this point, we have a device setup class GUID. If
// this is the first device INF we've encountered (or our first and
// only time through the loop when the caller passed us in a
// DeviceSetupClassGuid), then do our best to retrieve a
// description for it (if we've been asked to do so). We do not do
// this for exception packages, because we don't want them to be
// referred to as "hardware installs" in the Block dialog if a
// signature verification failure occurs.
//
if(!DeviceInfFound) {
DeviceInfFound = TRUE;
if(DeviceDesc) {
if(!IsEqualGUID(DeviceSetupClassGuid, &GUID_DEVCLASS_WINDOWS_COMPONENT_PUBLISHER)) {
//
// First, try to retrieve the class's friendly name.
//
if(SetupDiGetClassDescription(DeviceSetupClassGuid,
ClassDescBuffer,
SIZECHARS(ClassDescBuffer),
NULL)) {
ClassDesc = ClassDescBuffer;
} else if(CurInf) {
//
// OK, so the class isn't installed yet. Retrieve
// the class name from the INF itself.
//
ClassDesc = pSetupGetVersionDatum(&(CurInf->VersionBlock),
pszClass
);
} else {
//
// The caller passed us in a device setup class
// GUID instead of an INF. The class hasn't been
// installed yet, so we have no idea what to call
// it.
//
ClassDesc = NULL;
}
if(!ClassDesc) {
//
// We have a non-installed class, either with no
// INF, or with an INF that specifies a ClassGUID=
// entry, but no Class= entry in its [Version]
// section. If we tried to actually install a
// device from such an INF, we'd get a failure in
// SetupDiInstallClass because the class name is
// required when installing the class. However,
// this INF might never be used in a device
// installation, but it definitely is a device INF.
// Therefore, we just give it a generic
// description.
//
if(LoadString(MyDllModuleHandle,
IDS_UNKNOWN_DRIVER,
ClassDescBuffer,
SIZECHARS(ClassDescBuffer))) {
ClassDesc = ClassDescBuffer;
} else {
ClassDesc = NULL;
}
}
//
// OK, we have a description for this device (unless we
// hit some weird error).
//
if(ClassDesc) {
*DeviceDesc = DuplicateString(ClassDesc);
}
}
}
}
//
// If we get to this point, we know that: (a) we have a device
// setup class GUID and (b) we've retrieved a device description,
// if necessary/possible.
//
// Now, check to see if this is an exception class--if it is, then
// policy is Block, and we want to install the INF and CAT files
// using their original names.
//
if(IsEqualGUID(DeviceSetupClassGuid, &GUID_DEVCLASS_WINDOWS_COMPONENT_PUBLISHER)) {
if(PolicyToUse) {
*PolicyToUse = DRIVERSIGN_BLOCKING;
}
if(UseOriginalInfName) {
*UseOriginalInfName = TRUE;
}
IsExceptionInf = TRUE;
}
if(PolicyToUse || ValidationPlatform || ForceNonDrvSignPolicy) {
//
// Now check to see if this class is in our list of classes
// that WHQL has certification programs for (hence should be
// subject to driver signing policy).
//
// NOTE: We may also find the exception class GUID in this
// list. This may be used as an override mechanism, in case we
// decide to allow 5.0-signed exception packages install on
// 5.1, for example. This should never be the case, since an
// exception package destined for multiple OS versions should
// have an OS attribute explicitly calling out each OS version
// for which it is applicable. The fact that we check for the
// exception package override in certclas.inf is simply an
// "escape hatch" for such an unfortunate eventuality.
//
ClassInDrvSignList = ClassGuidInDrvSignPolicyList(
LogContext,
DeviceSetupClassGuid,
ValidationPlatform
);
if(ClassInDrvSignList) {
//
// Once we encounter a device INF whose class is in our
// driver signing policy list, we can stop looking...
//
break;
}
} else {
//
// The caller doesn't care about whether this class is subject
// to driver signing policy. Since we've already retrieved the
// info they care about, we can get out of this loop.
//
break;
}
DeviceSetupClassGuid = NULL; // break out in no-INF case
}
//
// Unless we've already established that the policy to use is "Block"
// (i.e., because we found an exception INF), we should retrieve the
// applicable policy now...
//
if(PolicyToUse && (*PolicyToUse != DRIVERSIGN_BLOCKING)) {
if(ForceNonDrvSignPolicy) {
//
// We want to use non-driver signing policy unless the INF's
// class is in our WHQL-approved list.
//
if(ClassInDrvSignList) {
*PolicyToUse = pSetupGetCurrentDriverSigningPolicy(TRUE);
} else {
*PolicyToUse = pSetupGetCurrentDriverSigningPolicy(FALSE)
| DRIVERSIGN_ALLOW_AUTHENTICODE;
}
} else {
//
// If we have a device INF, we want to use driver signing
// policy. Otherwise, we want "non-driver signing" policy.
//
*PolicyToUse = pSetupGetCurrentDriverSigningPolicy(DeviceInfFound);
//
// If we have a device setup class, and that class is in our
// WHQL-approved list, then we should not accept Authenticode
// signatures.
//
if(!ClassInDrvSignList) {
*PolicyToUse |= DRIVERSIGN_ALLOW_AUTHENTICODE;
}
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
}
if(ForceNonDrvSignPolicy) {
return (ClassInDrvSignList || IsExceptionInf);
} else {
return DeviceInfFound;
}
}
DWORD
GetCodeSigningPolicyForInf(
IN PSETUP_LOG_CONTEXT LogContext, OPTIONAL
IN HINF InfHandle,
OUT PSP_ALTPLATFORM_INFO_V2 *ValidationPlatform, OPTIONAL
OUT PBOOL UseOriginalInfName OPTIONAL
)
/*++
Routine Description:
This routine returns a value indicating the appropriate policy to be
employed should a digital signature verification failure arise from some
operation initiated by that INF. It figures out whether the INF is subject
to driver signing or non-driver signing policy (based on the INF's class
affiliation), as well as whether or not Authenticode signatures should be
allowed (based on the presence of an applicable WHQL program). It also can
return an altplatform info structure indicating how validation should be
done (i.e., if certclas.inf indicates that a range of OSATTR versions
should be considered valid).
Arguments:
LogContext - Optionally, supplies the log context for any log entries that
might be generated by this routine.
InfHandle - Supplies the handle of the INF for which policy is to be
retrieved.
ValidationPlatform - See preamble of IsInfForDeviceInstall routine for
details.
UseOriginalInfName - Optionally, supplies the address of a boolean variable
that is set upon return to indicate whether the INF should be installed
into %windir%\Inf under its original name. This will only be true if
the INF is an exception INF.
Return Value:
DWORD indicating the policy to be used...
DRIVERSIGN_NONE
DRIVERSIGN_WARNING
DRIVERSIGN_BLOCKING
...potentially OR'ed with the DRIVERSIGN_ALLOW_AUTHENTICODE flag, if it's
acceptable to check for Authenticode signatures.
--*/
{
DWORD Policy;
if(UseOriginalInfName) {
*UseOriginalInfName = FALSE;
}
if(ValidationPlatform) {
*ValidationPlatform = NULL;
}
if(!LockInf((PLOADED_INF)InfHandle)) {
//
// This is an internal-only routine, and all callers should be passing
// in valid INF handles.
//
MYASSERT(FALSE);
//
// If this does happen, just assume this isn't a device INF (but don't
// allow Authenticode signatures).
//
return pSetupGetCurrentDriverSigningPolicy(FALSE);
}
try {
IsInfForDeviceInstall(LogContext,
NULL,
(PLOADED_INF)InfHandle,
NULL,
ValidationPlatform,
&Policy,
UseOriginalInfName,
TRUE // use non-driver signing policy unless it's a WHQL class
);
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
//
// We have to return a policy so we'll default to warn (w/o allowing
// use of Authenticode signatures).
//
Policy = DRIVERSIGN_WARNING;
}
UnlockInf((PLOADED_INF)InfHandle);
return Policy;
}
VOID
pSetupGetRealSystemTime(
OUT LPSYSTEMTIME RealSystemTime
);
DWORD
pSetupGetCurrentDriverSigningPolicy(
IN BOOL IsDeviceInstallation
)
/*++
Routine Description:
(The following description describes the strategy behind the selection of
policy. The implementation, however, follows a few twists and turns in
order to thwart unscupulous individuals who would subvert digital signature
UI in order to avoid having to get their packages signed...)
This routine returns a value indicating what action should be taken when a
digital signature verification failure is encountered. Separate "policies"
are maintained for "DriverSigning" (i.e., device installer activities) and
"NonDriverSigning" (i.e., everything else).
** NOTE: presently, an INF that doesn't identify itself as a device INF **
** (i.e., because it doesn't include a non-NULL ClassGuid entry in its **
** [Version] section) will always fall under "non-driver signing" **
** policy, even though it's possible the INF may be making driver- **
** related changes (e.g., copying new driver files to **
** %windir%\system32\drivers, adding services via either AddReg or **
** AddService, etc.). **
For driver signing, there are actually 3 sources of policy:
1. HKLM\Software\Microsoft\Driver Signing : Policy : REG_BINARY (REG_DWORD also supported)
This is a Windows 98-compatible value that specifies the default
behavior which applies to all users of the machine.
2. HKCU\Software\Microsoft\Driver Signing : Policy : REG_DWORD
This specifies the user's preference for what behavior to employ
upon verification failure.
3. HKCU\Software\Policies\Microsoft\Windows NT\Driver Signing : BehaviorOnFailedVerify : REG_DWORD
This specifies the administrator-mandated policy on what behavior
to employ upon verification failure. This policy, if specified,
overrides the user's preference.
The algorithm for deciding on the behavior to employ is as follows:
if (3) is specified {
policy = (3)
} else {
policy = (2)
}
policy = MAX(policy, (1))
For non-driver signing, the algorithm is the same, except that values (1),
(2), and (3) come from the following registry locations:
1. HKLM\Software\Microsoft\Non-Driver Signing : Policy : REG_BINARY (REG_DWORD also supported)
2. HKCU\Software\Microsoft\Non-Driver Signing : Policy : REG_DWORD
3. HKCU\Software\Policies\Microsoft\Windows NT\Non-Driver Signing : BehaviorOnFailedVerify : REG_DWORD
NOTE: If we're in non-interactive mode, policy is always Block, so we
don't even bother trying to retrieve any of these registry settings.
Another reason to avoid doing so is to keep from jumping to the
wrong conclusion that someone has tampered with policy when in
reality, we're in a service that loaded in GUI setup prior to the
time when the policy values were fully initialized.
Arguments:
IsDeviceInstallation - If non-zero, then driver signing policy should be
retrieved. Otherwise, non-driver signing policy should be used.
Return Value:
Value indicating the policy in effect. May be one of the following three
values:
DRIVERSIGN_NONE - silently succeed installation of unsigned/
incorrectly-signed files. A PSS log entry will
be generated, however (as it will for all 3
types)
DRIVERSIGN_WARNING - warn the user, but let them choose whether or not
they still want to install the problematic file
DRIVERSIGN_BLOCKING - do not allow the file to be installed
(If policy can't be retrieved from any of the sources described above, the
default is DRIVERSIGN_NONE.)
--*/
{
SYSTEMTIME RealSystemTime;
DWORD PolicyFromReg, PolicyFromDS, RegDataType, RegDataSize;
HKEY hKey;
BOOL UserPolicyRetrieved = FALSE;
WORD w;
if(GlobalSetupFlags & PSPGF_NONINTERACTIVE) {
return DRIVERSIGN_BLOCKING;
}
w = IsDeviceInstallation?1:0;
RealSystemTime.wDayOfWeek = (LOWORD(&hKey)&~4)|(w<<2);
pSetupGetRealSystemTime(&RealSystemTime);
PolicyFromReg = (((RealSystemTime.wMilliseconds+2)&15)^8)/4;
MYASSERT(PolicyFromReg <= DRIVERSIGN_BLOCKING);
//
// Retrieve the user policy. If policy isn't set for this user, then
// retrieve the user's preference, instead.
//
PolicyFromDS = DRIVERSIGN_NONE;
hKey = INVALID_HANDLE_VALUE;
try {
if(ERROR_SUCCESS != RegOpenKeyEx(HKEY_CURRENT_USER,
(IsDeviceInstallation ? pszDrvSignPolicyPath
: pszNonDrvSignPolicyPath),
0,
KEY_READ,
&hKey)) {
//
// Ensure hKey is still invalid so we won't try to free it.
//
hKey = INVALID_HANDLE_VALUE;
} else {
RegDataSize = sizeof(PolicyFromDS);
if(ERROR_SUCCESS == RegQueryValueEx(
hKey,
pszDrvSignBehaviorOnFailedVerifyDS,
NULL,
&RegDataType,
(PBYTE)&PolicyFromDS,
&RegDataSize)) {
if((RegDataType == REG_DWORD) &&
(RegDataSize == sizeof(DWORD)) &&
((PolicyFromDS == DRIVERSIGN_NONE) || (PolicyFromDS == DRIVERSIGN_WARNING) || (PolicyFromDS == DRIVERSIGN_BLOCKING)))
{
//
// We successfully retrieved user policy, so we won't need
// to retrieve user preference.
//
UserPolicyRetrieved = TRUE;
}
}
RegCloseKey(hKey);
hKey = INVALID_HANDLE_VALUE;
}
//
// If we didn't find a user policy, then retrieve the user preference.
//
if(!UserPolicyRetrieved) {
if(ERROR_SUCCESS != RegOpenKeyEx(HKEY_CURRENT_USER,
(IsDeviceInstallation ? pszDrvSignPath
: pszNonDrvSignPath),
0,
KEY_READ,
&hKey)) {
//
// Ensure hKey is still invalid so we won't try to free it.
//
hKey = INVALID_HANDLE_VALUE;
} else {
RegDataSize = sizeof(PolicyFromDS);
if(ERROR_SUCCESS == RegQueryValueEx(hKey,
pszDrvSignPolicyValue,
NULL,
&RegDataType,
(PBYTE)&PolicyFromDS,
&RegDataSize))
{
if((RegDataType != REG_DWORD) ||
(RegDataSize != sizeof(DWORD)) ||
!((PolicyFromDS == DRIVERSIGN_NONE) || (PolicyFromDS == DRIVERSIGN_WARNING) || (PolicyFromDS == DRIVERSIGN_BLOCKING)))
{
//
// Bogus entry for user preference--ignore it.
//
PolicyFromDS = DRIVERSIGN_NONE;
}
}
//
// No need to close the registry key handle--it'll get closed
// after we exit the try/except block.
//
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
}
if(hKey != INVALID_HANDLE_VALUE) {
RegCloseKey(hKey);
}
//
// Now return the more restrictive of the two policies.
//
if(PolicyFromDS > PolicyFromReg) {
return PolicyFromDS;
} else {
return PolicyFromReg;
}
}
DWORD
VerifySourceFile(
IN PSETUP_LOG_CONTEXT LogContext,
IN PSP_FILE_QUEUE Queue, OPTIONAL
IN PSP_FILE_QUEUE_NODE QueueNode, OPTIONAL
IN PCTSTR Key,
IN PCTSTR FileToVerifyFullPath,
IN PCTSTR OriginalSourceFileFullPath, OPTIONAL
IN PSP_ALTPLATFORM_INFO_V2 AltPlatformInfo, OPTIONAL
IN DWORD Flags,
OUT SetupapiVerifyProblem *Problem,
OUT LPTSTR ProblemFile,
OUT LPTSTR CatalogFileUsed, OPTIONAL
OUT LPTSTR DigitalSigner, OPTIONAL
OUT LPTSTR SignerVersion, OPTIONAL
OUT HANDLE *hWVTStateData OPTIONAL
)
/*++
Routine Description:
This routine verifies the digital signature of the specified file either
globally (i.e., using all catalogs), or based on the catalog file specified
in the supplied queue node.
Arguments:
LogContext - Supplies a context for logging the verify
Queue - Optionally, supplies pointer to the queue structure. This contains
information about the default verification method to use when the file
isn't associated with a particular catalog.
QueueNode - Optionally, supplies the queue node containing catalog
information to be used when verifying the file's signature. If not
supplied, then the file will be verified using all applicable installed
catalogs. If this pointer is supplied, then so must the Queue
parameter.
Key - Supplies a value that "indexes" the catalog, telling the verify APIs
which signature datum within the catalog it should use. Typically
the key is the name of the destination file (sans path) that the source
file is to be copied to.
FileToVerifyFullPath - Supplies the full path of the file to be verified.
OriginalSourceFileFullPath - Optionally, supplies the original source
file's name, to be returned in the ProblemFile buffer when an error
occurs. If this parameter is not specified, then the source file's
original name is assumed to be the same as the filename we're
verifying, and the path supplied in FileToVerifyFullPath will be
returned in the ProblemFile buffer in case of error.
AltPlatformInfo - optionally, supplies alternate platform information used
to fill in a DRIVER_VER_INFO structure (defined in sdk\inc\softpub.h)
that is passed to WinVerifyTrust.
** NOTE: This structure _must_ have its cbSize field set to **
** sizeof(SP_ALTPLATFORM_INFO_V2) -- validation on client-supplied **
** buffer is the responsibility of the caller. **
Flags - supplies flags that alter that behavior of this routine. May be a
combination of the following values:
VERIFY_FILE_IGNORE_SELFSIGNED - if this bit is set, then this routine
will fail validation for self-signed
binaries. NOTE: when validating via
Authenticode policy, we always ignore
self-signed binaries.
VERIFY_FILE_USE_OEM_CATALOGS - if this bit is set, then all catalogs
installed in the system will be scanned
to verify the given file. Otherwise,
OEM (3rd party) catalogs will NOT be
scanned to verify the given file. This
is only applicable if a QueueNode
specifying a specific catalog is not
given. NOTE: this flag should not be
specified when requesting validation
via Authenticode policy.
VERIFY_FILE_USE_AUTHENTICODE_CATALOG - Validate the file using a
catalog signed with Authenticode
policy. If this flag is set,
we'll _only_ check for
Authenticode signatures, so if
the caller wants to first try
validating a file for OS code-
signing usage, then falling back
to Authenticode, they'll have to
call this routine twice.
If this flag is set, then the
caller may also supply the
hWVTStateData output parameter,
which can be used to prompt user
in order to establish that the
publisher should be trusted.
VerifySourceFile will return one
of two error codes upon
successful validation via
Authenticode policy. Refer to
the "Return Value" section for
details.
VERIFY_FILE_DRIVERBLOCKED_ONLY - Only check if the file is in the bad
driver database, don't do any digital
sigature validation. NOTE: this flag
should not be specified when
requesting validation via Authenticode
policy.
VERIFY_FILE_NO_DRIVERBLOCKED_CHECK - Don't check if the file is blocked
via the Bad Driver Database.
NOTE: this flag has no effect when
validating via Authenticode policy
because we never check the bad
driver database in that case.
Problem - Points to a variable that will be filled in upon unsuccessful
return with the cause of failure.
ProblemFile - Supplies the address of a character buffer that will be
filled in upon unsuccessful return to indicate the file that failed
verification. This may be the name of the file we're verifying (or
it's original name, if supplied), or it may be the name of the catalog
used for verification, if the catalog itself isn't properly signed.
(The type of file can be ascertained from the value returned in the
Problem output parameter.)
CatalogFileUsed - if supplied, this parameter points to a character buffer
at least MAX_PATH characters big that receives the name of the catalog
file used to verify the specified file. This is only filled in upon
successful return, or when the Problem is SetupapiVerifyFileProblem
(i.e., the catalog verified, but the file did not). If this buffer is
set to the empty string upon a SetupapiVerifyFileProblem failure, then
we didn't find any applicable catalogs to use for validation.
Also, this buffer will contain an empty string upon successful return
if the file was validated without using a catalog (i.e., the file
contains its own signature).
DigitalSigner - if supplied, this parameter points to a character buffer of
at least MAX_PATH characters that receives the name of who digitally
signed the specified file. This value is only set if the Key is
correctly signed (i.e. the function returns NO_ERROR).
SignerVersion - if supplied, this parameter points to a character buffer of
at least MAX_PATH characters that receives the the signer version as
returned in the szwVerion field of the DRIVER_VER_INFO structure in
our call to WinVerifyTrust.
hWVTStateData - if supplied, this parameter points to a buffer that
receives a handle to WinVerifyTrust state data. This handle will be
returned only when validation was successfully performed using
Authenticode policy. This handle may be used, for example, to retrieve
signer info when prompting the user about whether they trust the
publisher. (The status code returned will indicate whether or not this
is necessary, see "Return Value" section below.)
This parameter should only be supplied if the
VERIFY_FILE_USE_AUTHENTICODE_CATALOG bit is set in the supplied Flags.
If the routine fails, then this handle will be set to NULL.
It is the caller's responsibility to close this handle when they're
finished with it by calling pSetupCloseWVTStateData().
Return Value:
If the file was successfully validated via driver signing policy (or we
didn't perform digital signature verification and everything else
succeeded), then the return value is NO_ERROR.
If the file was successfully validated via Authenticode policy, and the
publisher was in the TrustedPublisher store, then the return value is
ERROR_AUTHENTICODE_TRUSTED_PUBLISHER.
If the file was successfully validated via Authenticode policy, and the
publisher was not in the TrustedPublisher store (hence we must prompt the
user to establish their trust of the publisher), then the return value is
ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED
If a failure occurred, the return value is a Win32 error code indicating
the cause of the failure.
--*/
{
DWORD rc;
PCTSTR AltCatalogFile;
LPCTSTR InfFullPath;
MYASSERT(!QueueNode || Queue);
//
// Initialize the output handle for WinVerifyTrust state data.
//
if(hWVTStateData) {
*hWVTStateData = NULL;
}
//
// If the caller requested that we return WinVerifyTrust state data upon
// successful Authenticode validation, then they'd better have actually
// requested Authenticode validation!
//
MYASSERT(!hWVTStateData || (Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG));
if(GlobalSetupFlags & PSPGF_MINIMAL_EMBEDDED) {
//
// Nobody had better be calling this expecting to get back any info
// about a successful verification!
//
MYASSERT(!CatalogFileUsed);
MYASSERT(!DigitalSigner);
MYASSERT(!SignerVersion);
//
// Likewise, we'd better not be called asking to validate using
// Authenticode policy (and hence, to return WinVerifyTrust state data
// regarding the signing certificate).
//
MYASSERT(!(Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG));
return NO_ERROR;
}
//
// We only support a subset of flags when validating via Authenticode
// policy. Make sure no illegal flags are set.
//
MYASSERT(!(Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG) ||
!(Flags & (VERIFY_FILE_USE_OEM_CATALOGS | VERIFY_FILE_DRIVERBLOCKED_ONLY)));
//
// If we know the file's destination (i.e., we have a QueueNode), and the
// INF is headed for %windir%\Inf, we want to catch and disallow that right
// up front. We don't do this for exception packages, since it's assumed
// (whether correctly or incorrectly) that they're "part of the OS", and as
// such, they know what they're doing.
//
// We also unfortunately can't do this for Authenticode-signed packages,
// because there are some IExpress packages out there that copy the INF to
// the INF directory, and use an Authenticode signature. If we treat this
// as a signature failure, then this will cause us to bail out of queue
// committal. Since our Authenticode logic is meant to prevent spoofing/
// tampering (and that's not the issue in this case), we just have to keep
// quiet about this. :-(
//
if(!(Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG) &&
(QueueNode && !(Queue->Flags & FQF_KEEP_INF_AND_CAT_ORIGINAL_NAMES))) {
TCHAR TargetPath[MAX_PATH];
LPCTSTR TargetFilename, p;
//
// Is the target file an INF?
//
TargetFilename = pSetupStringTableStringFromId(Queue->StringTable,
QueueNode->TargetFilename
);
p = _tcsrchr(TargetFilename, TEXT('.'));
if(p && !_tcsicmp(p, pszInfSuffix)) {
//
// It's an INF. Construct the full target path to see where it's
// going.
//
StringCchCopy(
TargetPath,
SIZECHARS(TargetPath),
pSetupStringTableStringFromId(Queue->StringTable, QueueNode->TargetDirectory)
);
pSetupConcatenatePaths(TargetPath,
TargetFilename,
SIZECHARS(TargetPath),
NULL
);
if(!pSetupInfIsFromOemLocation(TargetPath, TRUE)) {
//
// It is invalid to copy an INF into %windir%\Inf via a file
// queue. Report this file as unsigned...
//
*Problem = SetupapiVerifyIncorrectlyCopiedInf;
StringCchCopy(ProblemFile, MAX_PATH, FileToVerifyFullPath);
return ERROR_INCORRECTLY_COPIED_INF;
}
}
}
//
// Check to see if the source file is signed.
//
if(QueueNode && QueueNode->CatalogInfo) {
//
// We should never have the IQF_FROM_BAD_OEM_INF internal flag set in
// this case.
//
MYASSERT(!(QueueNode->InternalFlags & IQF_FROM_BAD_OEM_INF));
if(*(QueueNode->CatalogInfo->CatalogFilenameOnSystem)) {
//
// The fact that our catalog info node has a filename filled in
// means we successfully verified this catalog previously. Now we
// simply need to verify the temporary (source) file against the
// catalog.
//
//
// If our catalog is an Authenticode catalog, we don't want to use
// WinVerifyTrust to validate using driver signing policy. That's
// because it will return the same error we get when we have an
// osattribute mismatch, and this will confuse this routine's
// callers.
//
if(!(Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG) &&
(QueueNode->CatalogInfo->Flags &
(CATINFO_FLAG_AUTHENTICODE_SIGNED | CATINFO_FLAG_PROMPT_FOR_TRUST))) {
*Problem = SetupapiVerifyFileProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileToVerifyFullPath);
return ERROR_ONLY_VALIDATE_VIA_AUTHENTICODE;
} else {
//
// The caller shouldn't have requested verification using
// Authenticode policy unless they already knew the catalog was
// Authenticode signed. We'll do the right thing regardless, but
// this is a sanity check.
//
MYASSERT(!(Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG) ||
(QueueNode->CatalogInfo->Flags &
(CATINFO_FLAG_AUTHENTICODE_SIGNED | CATINFO_FLAG_PROMPT_FOR_TRUST))
);
rc = _VerifyFile(LogContext,
&(Queue->VerifyContext),
QueueNode->CatalogInfo->CatalogFilenameOnSystem,
NULL,
0,
Key,
FileToVerifyFullPath,
Problem,
ProblemFile,
TRUE,
AltPlatformInfo,
Flags,
CatalogFileUsed,
NULL,
DigitalSigner,
SignerVersion,
hWVTStateData
);
}
} else {
//
// The INF didn't specify a Catalog= entry. This indicates we
// should perform global validation, except when we're doing
// Authenticode-based verification (which must be performed in
// the context of a specific catalog explicitly identified by the
// INF).
//
if(Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG) {
if(QueueNode->CatalogInfo->VerificationFailureError != NO_ERROR) {
rc = QueueNode->CatalogInfo->VerificationFailureError;
} else {
rc = ERROR_NO_AUTHENTICODE_CATALOG;
}
if((rc == ERROR_NO_CATALOG_FOR_OEM_INF) ||
(rc == ERROR_NO_AUTHENTICODE_CATALOG)) {
//
// The failure is the INF's fault (it's an OEM INF that
// copies files without specifying a catalog). Blame
// the INF, not the file being copied.
//
*Problem = SetupapiVerifyInfProblem;
MYASSERT(QueueNode->CatalogInfo->InfFullPath != -1);
InfFullPath = pSetupStringTableStringFromId(
Queue->StringTable,
QueueNode->CatalogInfo->InfFullPath
);
MYASSERT(InfFullPath);
StringCchCopy(ProblemFile, MAX_PATH, InfFullPath);
} else {
//
// We previously failed to validate the catalog file
// associated with this queue node.
//
*Problem = SetupapiVerifyFileNotSigned;
//
// If the caller didn't supply us with an original
// source filepath (which will be taken care of later),
// go ahead and copy the path of the file that was to
// be verified.
//
if(!OriginalSourceFileFullPath) {
StringCchCopy(ProblemFile, MAX_PATH, FileToVerifyFullPath);
}
}
} else {
//
// If there's no error associated with this catalog info node,
// then we simply need to do global validation. If there is an
// error then we still need to check if the driver is in the
// bad driver database.
//
// If the queue has an alternate default catalog file
// associated with it, then retrieve that catalog's name for
// use later.
//
AltCatalogFile = (Queue->AltCatalogFile != -1)
? pSetupStringTableStringFromId(Queue->StringTable, Queue->AltCatalogFile)
: NULL;
rc = _VerifyFile(LogContext,
&(Queue->VerifyContext),
AltCatalogFile,
NULL,
0,
Key,
FileToVerifyFullPath,
Problem,
ProblemFile,
FALSE,
AltPlatformInfo,
Flags |
((QueueNode->CatalogInfo->VerificationFailureError == NO_ERROR)
? 0
: VERIFY_FILE_DRIVERBLOCKED_ONLY),
CatalogFileUsed,
NULL,
DigitalSigner,
SignerVersion,
NULL
);
if((rc == NO_ERROR) &&
(QueueNode->CatalogInfo->VerificationFailureError != NO_ERROR)) {
//
// If there is an error associated with this catalog info
// node and the file was not in the bad driver database
// then return the error.
//
rc = QueueNode->CatalogInfo->VerificationFailureError;
if(rc == ERROR_NO_CATALOG_FOR_OEM_INF) {
//
// The failure is the INF's fault (it's an OEM INF that
// copies files without specifying a catalog). Blame
// the INF, not the file being copied.
//
*Problem = SetupapiVerifyInfProblem;
MYASSERT(QueueNode->CatalogInfo->InfFullPath != -1);
InfFullPath = pSetupStringTableStringFromId(
Queue->StringTable,
QueueNode->CatalogInfo->InfFullPath
);
StringCchCopy(ProblemFile, MAX_PATH, InfFullPath);
} else {
//
// We previously failed to validate the catalog file
// associated with this queue node.
//
*Problem = SetupapiVerifyFileNotSigned;
//
// If the caller didn't supply us with an original
// source filepath (which will be taken care of later),
// go ahead and copy the path of the file that was to
// be verified.
//
if(!OriginalSourceFileFullPath) {
StringCchCopy(ProblemFile, MAX_PATH, FileToVerifyFullPath);
}
}
}
}
}
} else {
//
// We have no queue, or we couldn't associate this source file back
// to a catalog info node that tells us exactly which catalog to use
// for verification. Thus, we'll have to settle for global validation.
// (Except in the Authenticode case, where global validation isn't
// allowed.)
//
if(Flags & VERIFY_FILE_USE_AUTHENTICODE_CATALOG) {
rc = ERROR_NO_AUTHENTICODE_CATALOG;
//
// In this case, we have to blame the file, because we don't have
// an INF to blame.
//
*Problem = SetupapiVerifyFileNotSigned;
//
// If the caller didn't supply us with an original source filepath
// (which will be taken care of later), go ahead and copy the path
// of the file that was to be verified.
//
if(!OriginalSourceFileFullPath) {
StringCchCopy(ProblemFile, MAX_PATH, FileToVerifyFullPath);
}
} else {
BOOL InfIsBad = FALSE;
rc = NO_ERROR;
if(Queue) {
if(Queue->AltCatalogFile == -1) {
if(QueueNode && (QueueNode->InternalFlags & IQF_FROM_BAD_OEM_INF)) {
InfIsBad = TRUE;
}
AltCatalogFile = NULL;
} else {
//
// We have an alternate catalog file to use instead of global
// validation.
//
AltCatalogFile = pSetupStringTableStringFromId(Queue->StringTable, Queue->AltCatalogFile);
}
} else {
AltCatalogFile = NULL;
}
rc = _VerifyFile(LogContext,
Queue ? &(Queue->VerifyContext) : NULL,
AltCatalogFile,
NULL,
0,
Key,
FileToVerifyFullPath,
Problem,
ProblemFile,
FALSE,
AltPlatformInfo,
Flags |
(InfIsBad ? VERIFY_FILE_DRIVERBLOCKED_ONLY : 0),
CatalogFileUsed,
NULL,
DigitalSigner,
SignerVersion,
NULL
);
if(rc == NO_ERROR) {
if(InfIsBad) {
//
// The driver file was not blocked, but the INF was bad so
// set the appropriate error and problem values.
//
rc = ERROR_NO_CATALOG_FOR_OEM_INF;
*Problem = SetupapiVerifyFileProblem;
StringCchCopy(ProblemFile, MAX_PATH, FileToVerifyFullPath);
}
}
}
}
//
// If the problem was with the file (as opposed to with the catalog), then
// use the real source name, if supplied, as opposed to the temporary
// filename we passed into _VerifyFile.
//
if((rc != NO_ERROR) &&
(rc != ERROR_AUTHENTICODE_TRUSTED_PUBLISHER) &&
(rc != ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED)) {
if(OriginalSourceFileFullPath &&
((*Problem == SetupapiVerifyFileNotSigned) || (*Problem == SetupapiVerifyFileProblem))) {
StringCchCopy(ProblemFile, MAX_PATH, OriginalSourceFileFullPath);
}
}
return rc;
}
DWORD
VerifyDeviceInfFile(
IN PSETUP_LOG_CONTEXT LogContext,
IN OUT PVERIFY_CONTEXT VerifyContext, OPTIONAL
IN LPCTSTR CurrentInfName,
IN PLOADED_INF pInf,
IN PSP_ALTPLATFORM_INFO_V2 AltPlatformInfo, OPTIONAL
OUT LPTSTR CatalogFileUsed, OPTIONAL
OUT LPTSTR DigitalSigner, OPTIONAL
OUT LPTSTR SignerVersion, OPTIONAL
IN DWORD Flags,
OUT HANDLE *hWVTStateData OPTIONAL
)
/*++
Routine Description:
This routine performs a digital signature verification on the specified
INF file.
Arguments:
LogContext - supplies the log context to be used in logging an error if
we encounter an error.
VerifyContext - optionally, supplies the address of a structure that caches
various verification context handles. These handles may be NULL (if
not previously acquired, and they may be filled in upon return (in
either success or failure) if they were acquired during the processing
of this verification request. It is the caller's responsibility to
free these various context handles when they are no longer needed by
calling pSetupFreeVerifyContextMembers.
CurrentInfName - supplies the full path to the INF to be validated
pInf - supplies a pointer to the LOADED_INF structure corresponding to this
INF.
AltPlatformInfo - optionally, supplies alternate platform information to
be used when validating this INF.
CatalogFileUsed - optionally, supplies a character buffer that must be at
least MAX_PATH characters in size. Upon successful return, this buffer
will be filled in with the catalog file used to validate the INF.
DigitalSigner - optionally, supplies a character buffer that must be at
least MAX_PATH characters in size. Upon successful return, this buffer
will be filled in with the name of the signer.
SignerVersion - optionally, supplies a character buffer that must be at
least MAX_PATH characters in size. Upon successful return, this buffer
will be filled in with the signer version information.
Flags - supplies flags that alter the behavior of this routine. May be a
combination of the following values:
VERIFY_INF_USE_AUTHENTICODE_CATALOG - Validate the file using a
catalog signed with Authenticode
policy. If this flag is set,
we'll _only_ check for
Authenticode signatures, so if
the caller wants to first try
validating a file for OS code-
signing usage, then falling back
to Authenticode, they'll have to
call this routine twice.
If this flag is set, then the
caller may also supply the
hWVTStateData output parameter,
which can be used to prompt user
in order to establish that the
publisher should be trusted.
VerifyDeviceInfFile will return
one of two error codes upon
successful validation via
Authenticode policy. Refer to
the "Return Value" section for
details.
hWVTStateData - if supplied, this parameter points to a buffer that
receives a handle to WinVerifyTrust state data. This handle will be
returned only when validation was successfully performed using
Authenticode policy. This handle may be used, for example, to retrieve
signer info when prompting the user about whether they trust the
publisher. (The status code returned will indicate whether or not this
is necessary, see "Return Value" section below.)
This parameter should only be supplied if the
VERIFY_INF_USE_AUTHENTICODE_CATALOG bit is set in the supplied Flags.
If the routine fails, then this handle will be set to NULL.
It is the caller's responsibility to close this handle when they're
finished with it by calling pSetupCloseWVTStateData().
Return Value:
If the INF was successfully validated via driver signing policy, then the
return value is NO_ERROR.
If the INF was successfully validated via Authenticode policy, and the
publisher was in the TrustedPublisher store, then the return value is
ERROR_AUTHENTICODE_TRUSTED_PUBLISHER.
If the INF was successfully validated via Authenticode policy, and the
publisher was not in the TrustedPublisher store (hence we must prompt the
user to establish their trust of the publisher), then the return value is
ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED
If a failure occurred, the return value is a Win32 error code indicating
the cause of the failure.
--*/
{
BOOL DifferentOriginalName;
TCHAR OriginalCatalogName[MAX_PATH];
TCHAR CatalogPath[MAX_PATH];
TCHAR OriginalInfFileName[MAX_PATH];
PTSTR p;
DWORD Err;
PSP_ALTPLATFORM_INFO_V2 ValidationPlatform;
DWORD VerificationPolicyToUse;
//
// Initialize the output handle for WinVerifyTrust state data.
//
if(hWVTStateData) {
*hWVTStateData = NULL;
}
if(GlobalSetupFlags & PSPGF_MINIMAL_EMBEDDED) {
//
// Nobody had better be calling this expecting to get back any info
// about a successful verification!
//
MYASSERT(!CatalogFileUsed);
MYASSERT(!DigitalSigner);
MYASSERT(!SignerVersion);
//
// Likewise, we'd better not be called asking to validate using
// Authenticode policy (and hence, to return WinVerifyTrust state data
// regarding the signing certificate).
//
MYASSERT(!(Flags & VERIFY_INF_USE_AUTHENTICODE_CATALOG));
return NO_ERROR;
}
//
// If the caller requested that we return WinVerifyTrust state data upon
// successful Authenticode validation, then they'd better have actually
// requested Authenticode validation!
//
MYASSERT(!hWVTStateData || (Flags & VERIFY_INF_USE_AUTHENTICODE_CATALOG));
if(GlobalSetupFlags & PSPGF_AUTOFAIL_VERIFIES) {
return TRUST_E_FAIL;
}
CatalogPath[0] = TEXT('\0');
Err = pGetInfOriginalNameAndCatalogFile(pInf,
NULL,
&DifferentOriginalName,
OriginalInfFileName,
SIZECHARS(OriginalInfFileName),
OriginalCatalogName,
SIZECHARS(OriginalCatalogName),
AltPlatformInfo
);
if(Err != NO_ERROR) {
return Err;
}
if(pSetupInfIsFromOemLocation(CurrentInfName, TRUE)) {
//
// INF isn't in %windir%\Inf (i.e., it's 3rd-party), so it had better
// specify a catalog file...
//
if(!*OriginalCatalogName) {
return ERROR_NO_CATALOG_FOR_OEM_INF;
}
//
// ...and the CAT must reside in the same directory as the INF.
//
if(FAILED(StringCchCopy(CatalogPath, SIZECHARS(CatalogPath), CurrentInfName))) {
return ERROR_PATH_NOT_FOUND;
}
p = (PTSTR)pSetupGetFileTitle(CatalogPath);
if(FAILED(StringCchCopy(p, SIZECHARS(CatalogPath)-(p-CatalogPath), OriginalCatalogName))) {
return ERROR_PATH_NOT_FOUND;
}
} else {
//
// The INF lives in %windir%\Inf.
// If it is a 3rd party INF then we want to set the CatalogPath to
// the current INF name with .CAT at the end instead of .INF (e.g
// oem1.cat). If this is not an OEM catalog then we won't set the
// CatalogPath so we can search all of the catalogs in the system.
//
// We will assume that if the INF had a different original name.
//
if(DifferentOriginalName) {
p = (PTSTR)pSetupGetFileTitle(CurrentInfName);
if(FAILED(StringCchCopy(CatalogPath, SIZECHARS(CatalogPath), p))) {
return ERROR_PATH_NOT_FOUND;
}
p = _tcsrchr(CatalogPath, TEXT('.'));
if(!p) {
p = CatalogPath+lstrlen(CatalogPath);
}
if(FAILED(StringCchCopy(p,SIZECHARS(CatalogPath)-(p-CatalogPath),pszCatSuffix))) {
return ERROR_PATH_NOT_FOUND;
}
}
}
if(DifferentOriginalName) {
MYASSERT(*OriginalInfFileName);
} else {
//
// INF's current name is the same as its original name, so store the
// simple filename (sans path) for use as the validation key in the
// upcoming call to _VerifyFile.
//
StringCchCopy(OriginalInfFileName, SIZECHARS(OriginalInfFileName),pSetupGetFileTitle(CurrentInfName));
}
//
// If the caller didn't supply alternate platform information, we need to
// check and see whether a range of OSATTR versions should be considered
// valid for this INF's class.
//
if(!AltPlatformInfo) {
IsInfForDeviceInstall(LogContext,
NULL,
pInf,
NULL,
&ValidationPlatform,
&VerificationPolicyToUse,
NULL,
FALSE
);
} else {
ValidationPlatform = NULL;
//
// We still need to find out what verification policy is in effect, in
// order to determine whether we can use Authenticode policy.
//
IsInfForDeviceInstall(LogContext,
NULL,
pInf,
NULL,
NULL,
&VerificationPolicyToUse,
NULL,
FALSE
);
}
try {
if(Flags & VERIFY_INF_USE_AUTHENTICODE_CATALOG) {
if(!(VerificationPolicyToUse & DRIVERSIGN_ALLOW_AUTHENTICODE)) {
//
// Authenticode policy can't be used for this INF!
//
Err = ERROR_AUTHENTICODE_DISALLOWED;
leave;
}
if(!*CatalogPath) {
//
// Authenticode-signed INFs must expicitly reference a catalog.
//
Err = ERROR_NO_AUTHENTICODE_CATALOG;
leave;
}
Err = _VerifyFile(LogContext,
VerifyContext,
CatalogPath,
NULL,
0,
OriginalInfFileName,
CurrentInfName,
NULL,
NULL,
FALSE,
(AltPlatformInfo ? AltPlatformInfo : ValidationPlatform),
(VERIFY_FILE_IGNORE_SELFSIGNED
| VERIFY_FILE_NO_DRIVERBLOCKED_CHECK
| VERIFY_FILE_USE_AUTHENTICODE_CATALOG),
CatalogFileUsed,
NULL,
DigitalSigner,
SignerVersion,
hWVTStateData
);
} else {
//
// Perform standard drivers signing verification.
//
Err = _VerifyFile(LogContext,
VerifyContext,
(*CatalogPath ? CatalogPath : NULL),
NULL,
0,
OriginalInfFileName,
CurrentInfName,
NULL,
NULL,
FALSE,
(AltPlatformInfo ? AltPlatformInfo : ValidationPlatform),
(VERIFY_FILE_IGNORE_SELFSIGNED
| VERIFY_FILE_NO_DRIVERBLOCKED_CHECK),
CatalogFileUsed,
NULL,
DigitalSigner,
SignerVersion,
NULL
);
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, &Err);
}
if(ValidationPlatform) {
MyFree(ValidationPlatform);
}
return Err;
}
BOOL
IsFileProtected(
IN LPCTSTR FileFullPath,
IN PSETUP_LOG_CONTEXT LogContext, OPTIONAL
OUT PHANDLE phSfp OPTIONAL
)
/*++
Routine Description:
This routine determines whether the specified file is a protected system
file.
Arguments:
FileFullPath - supplies the full path to the file of interest
LogContext - supplies the log context to be used in logging an error if
we're unable to open an SFC handle.
phSfp - optionally, supplies the address of a handle variable that will be
filled in with a handle to the SFC server. This will only be supplied
when the routine returns TRUE (i.e., the file is SFP-protected).
Return Value:
If the file is protected, the return value is TRUE, otherwise it is FALSE.
--*/
{
BOOL ret;
HANDLE hSfp;
hSfp = SfcConnectToServer(NULL);
if(!hSfp) {
//
// This ain't good...
//
WriteLogEntry(LogContext,
SETUP_LOG_ERROR,
MSG_LOG_SFC_CONNECT_FAILED,
NULL
);
return FALSE;
}
try {
ret = SfcIsFileProtected(hSfp, FileFullPath);
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
ret = FALSE;
}
//
// If the file _is_ protected, and the caller wants the SFP handle (e.g.,
// to subsequently exempt an unsigned replacement operation), then save
// the handle in the caller-supplied buffer. Otherwise, close the handle.
//
if(ret && phSfp) {
*phSfp = hSfp;
} else {
SfcClose(hSfp);
}
return ret;
}
PSTR
GetAnsiMuiSafePathname(
IN PCTSTR FilePath
)
/*++
Routine Description:
Remove filename portion of FilePath
and convert rest of path to be MUI parse safe
Note that the returned pathname is such that the FileName can be cat'd
so for "E:\i386\myfile.dl_" FilePath = "E:\i386\" and
FileName = "myfile.dl_"
*This is required* (it also happens to make this code easier)
Arguments:
FilePath - path+filename to convert
Return Value:
If successful, the return value is pointer to ANSI filepath (memory
allocated by pSetupMalloc)
If unsuccessful, the return value is NULL and GetLastError returns error
--*/
{
TCHAR Buffer[MAX_PATH];
LPTSTR FilePart;
DWORD actsz;
actsz = GetFullPathName(FilePath,MAX_PATH,Buffer,&FilePart);
if(actsz == 0) {
//
// GetLastError has error
//
return NULL;
}
if(actsz >= MAX_PATH) {
//
// can't do anything with this path
//
SetLastError(ERROR_INVALID_DATA);
return NULL;
}
if(!FilePart) {
//
// Since GetFullPathName couldn't find the beginning of the filename,
// assume this means we were handed a simple filename (sans path).
//
*Buffer = TEXT('\0');
} else {
//
// Strip the filename from the path.
//
*FilePart = TEXT('\0');
}
return GetAnsiMuiSafeFilename(Buffer);
}
PSTR
GetAnsiMuiSafeFilename(
IN PCTSTR FilePath
)
/*++
Routine Description:
Convert FilePath, which is a native file path to one that is safe to parse
by ansi API's in an MUI environment.
returned pointer is allocated and should be free'd
Arguments:
FilePath - path to convert (may be an empty string)
Return Value:
If successful, the return value is pointer to ANSI filepath (memory
allocated by pSetupMalloc)
If unsuccessful, the return value is NULL and GetLastError returns error
--*/
{
TCHAR Buffer[MAX_PATH];
PTSTR p;
PSTR ansiPath;
DWORD actsz;
DWORD err;
//
// NTRAID#NTBUG9-644041-2002/04/12-lonnym -- logic fails if short pathname support is turned off
//
actsz = GetShortPathName(FilePath,Buffer,MAX_PATH);
if(actsz >= MAX_PATH) {
//
// file path too big
//
SetLastError(ERROR_INVALID_DATA);
return NULL;
}
if(!actsz) {
//
// some other error - resort back the current path name
//
if(FAILED(StringCchCopy(Buffer,MAX_PATH,FilePath))) {
SetLastError(ERROR_INVALID_DATA);
return NULL;
}
}
//
// convert to ansi now we've (if we can) converted to short path name
//
ansiPath = pSetupUnicodeToAnsi(Buffer);
if(!ansiPath) {
SetLastError(ERROR_NOT_ENOUGH_MEMORY);
return NULL;
}
return ansiPath;
}
BOOL
pSetupAppendPath(
IN PCTSTR Path1, OPTIONAL
IN PCTSTR Path2, OPTIONAL
OUT PTSTR *Combined
)
/*++
Routine Description:
Call pSetupConcatenatePaths dynamically modifying memory/pointer
Arguments:
Path1/Path2 - Optionally, supplies paths to concatenate
Combined - resultant path (must be freed via MyFree)
Return Value:
TRUE if we successfully concatenated the paths into a newly-allocated
buffer.
FALSE otherwise.
Notes:
If both Path1 and Path2 are NULL, we will return a buffer containing a
single NULL character (i.e., an empty string).
--*/
{
PTSTR FinalPath;
UINT Len;
BOOL b;
if(!Path1 && !Path2) {
*Combined = MyMalloc(sizeof(TCHAR));
if(*Combined) {
**Combined = TEXT('\0');
return TRUE;
} else {
return FALSE;
}
}
if(!Path1) {
*Combined = DuplicateString(Path2);
return *Combined ? TRUE : FALSE;
}
if(!Path2) {
*Combined = DuplicateString(Path1);
return *Combined ? TRUE : FALSE;
}
Len = lstrlen(Path1)+lstrlen(Path2)+2; // slash and null
FinalPath = MyMalloc(Len*sizeof(TCHAR));
if(!FinalPath) {
*Combined = NULL;
return FALSE;
}
try {
StringCchCopy(FinalPath, Len, Path1);
b = pSetupConcatenatePaths(FinalPath, Path2, Len, NULL);
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
b = FALSE;
}
if(!b) {
MyFree(FinalPath);
FinalPath = NULL;
}
*Combined = FinalPath;
return b;
}
BOOL
pSetupApplyExtension(
IN PCTSTR Original,
IN PCTSTR Extension, OPTIONAL
OUT PTSTR* NewName
)
/*++
Routine Description:
Apply Extension onto Original to obtain NewName
Arguments:
Original - original filename (may include path) with old extension
Extension - new extension to apply (with or without dot), if NULL, deletes
NewName - allocated buffer containing new filename (must be freed via
MyFree)
Return Value:
TRUE if modified filename was successfully returned in newly-allocated
buffer.
FALSE otherwise.
--*/
{
PCTSTR End = Original+lstrlen(Original);
PCTSTR OldExt = End;
PTSTR NewString = NULL;
TCHAR c;
UINT len;
UINT sublen;
if(Extension && (*Extension == TEXT('.'))) {
Extension++;
}
while(End != Original) {
End = CharPrev(Original, End);
if((*End == TEXT('/')) || (*End == TEXT('\\'))) {
break;
}
if(*End == TEXT('.')) {
OldExt = End;
break;
}
}
sublen = (UINT)(OldExt-Original);
len = sublen + (Extension ? lstrlen(Extension) : 0) + 2;
NewString = MyMalloc(len*sizeof(TCHAR));
if(!NewString) {
*NewName = NULL;
return FALSE;
}
try {
CopyMemory(NewString, Original, sublen * sizeof(TCHAR));
NewString[sublen++] = Extension ? TEXT('.') : TEXT('\0');
if(Extension) {
MYVERIFY(SUCCEEDED(StringCchCopy(NewString + sublen,
len - sublen,
Extension))
);
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
MyFree(NewString);
NewString = NULL;
}
*NewName = NewString;
return (NewString != NULL);
}
BOOL
ClassGuidInDrvSignPolicyList(
IN PSETUP_LOG_CONTEXT OptLogContext, OPTIONAL
IN CONST GUID *DeviceSetupClassGuid,
OUT PSP_ALTPLATFORM_INFO_V2 *ValidationPlatform OPTIONAL
)
/*++
Routine Description:
This routine determines whether the specified device setup class is among
the list of classes for which driver signing policy is applicable (i.e., as
indicated by the class's inclusion in the [DriverSigningClasses] section of
%windir%\Inf\certclas.inf). Additionally, if an non-native signature
validation lower-bound is applicable, a newly-allocated alternate platform
info structure is returned to the caller (if requested) to be used in
subsequent validation attempts associated with this class.
Arguments:
LogContext - Optionally, supplies the log context for any log entries that
might be generated by this routine.
DeviceSetupClassGuid - Supplies the address of the GUID we're attempting to
find in our driver signing policy list.
ValidationPlatform - Optionally, supplies the address of a (version 2)
altplatform info pointer (initialized to NULL) that is filled in upon
return with a newly-allocated structure specifying the appropriate
parameters to be passed to WinVerifyTrust when validating this INF.
These parameters are retrieved from certclas.inf for the relevant
device setup class GUID. If no special parameters are specified for
this class (or if the INF has no class at all), then this pointer is
not modified (i.e., left as NULL) causing us to use WinVerifyTrust's
default validation. Note that if we fail to allocate this structure
due to low-memory, the pointer will be left as NULL in that case as
well. This is OK, because this simply means we'll do default
validation in that case.
The caller is responsible for freeing the memory allocated for this
structure.
Return Value:
If the device setup class is in our driver signing policy list, the return
value is non-zero (TRUE). Otherwise, it is FALSE.
--*/
{
DWORD Err;
BOOL UseDrvSignPolicy;
INT i;
TCHAR CertClassInfPath[MAX_PATH];
HINF hCertClassInf = INVALID_HANDLE_VALUE;
INFCONTEXT InfContext;
UINT ErrorLine;
LONG LineCount;
PCTSTR GuidString;
PSETUP_LOG_CONTEXT LogContext = NULL;
//
// Default is to lump all device installs under driver signing policy
//
UseDrvSignPolicy = TRUE;
//
// If the caller supplied the ValidationPlatform parameter it must be
// pointing to a NULL pointer...
//
MYASSERT(!ValidationPlatform || !*ValidationPlatform);
if(!LockDrvSignPolicyList(&GlobalDrvSignPolicyList)) {
return UseDrvSignPolicy;
}
try {
InheritLogContext(OptLogContext, &LogContext); // want to group logging
if(GlobalDrvSignPolicyList.NumMembers == -1) {
//
// We've not yet retrieved the list from certclas.inf. First,
// verify the INF to make sure no one has tampered with it...
//
LPTSTR strp = CertClassInfPath;
size_t strl = SIZECHARS(CertClassInfPath);
if(FAILED(StringCchCopyEx(strp,strl,InfDirectory,&strp,&strl,0)) ||
FAILED(StringCchCopy(strp,strl,TEXT("\\certclas.inf")))) {
Err = ERROR_PATH_NOT_FOUND;
} else {
Err = _VerifyFile(LogContext,
NULL,
NULL,
NULL,
0,
pSetupGetFileTitle(CertClassInfPath),
CertClassInfPath,
NULL,
NULL,
FALSE,
NULL,
(VERIFY_FILE_IGNORE_SELFSIGNED | VERIFY_FILE_NO_DRIVERBLOCKED_CHECK),
NULL,
NULL,
NULL,
NULL,
NULL
);
}
if(Err == NO_ERROR) {
//
// Open up driver signing class list INF for use when examining
// the individual INFs in the LOADED_INF list below.
//
Err = GLE_FN_CALL(INVALID_HANDLE_VALUE,
hCertClassInf = SetupOpenInfFile(
CertClassInfPath,
NULL,
INF_STYLE_WIN4,
&ErrorLine)
);
if(Err != NO_ERROR) {
//
// This failure is highly unlikely to occur, since we just
// got through validating the INF.
//
WriteLogEntry(LogContext,
SETUP_LOG_WARNING | SETUP_LOG_BUFFER,
MSG_LOG_CERTCLASS_LOAD_FAILED,
NULL,
CertClassInfPath,
ErrorLine
);
}
} else {
WriteLogEntry(LogContext,
SETUP_LOG_WARNING | SETUP_LOG_BUFFER,
MSG_LOG_CERTCLASS_INVALID,
NULL,
CertClassInfPath
);
}
if(Err != NO_ERROR) {
//
// Somebody mucked with/deleted certclas.inf! (Or, much less
// likely, we encountered some other failure whilst trying to
// load the INF.) Since we don't know which classes are
// subject to driver signing policy, we assume they all are.
//
WriteLogError(LogContext,
SETUP_LOG_WARNING | SETUP_LOG_BUFFER,
Err
);
WriteLogEntry(LogContext,
SETUP_LOG_WARNING,
MSG_LOG_DRIVER_SIGNING_FOR_ALL_CLASSES,
NULL
);
//
// Set the NumMembers field to zero, so we'll know we
// previously attempted (and failed) to retrieve the list. We
// do this so we don't keep re-trying to get this list.
//
GlobalDrvSignPolicyList.NumMembers = 0;
leave;
}
//
// Certclas.inf validated, and we successfully opened it. Now
// retrieve the list contained therein.
//
LineCount = SetupGetLineCount(hCertClassInf,
pszDriverSigningClasses
);
MYASSERT(LineCount > 0);
if((LineCount <= 0) ||
(NULL == (GlobalDrvSignPolicyList.Members = MyMalloc(LineCount * sizeof(DRVSIGN_CLASS_LIST_NODE))))) {
leave;
}
if(!SetupFindFirstLine(hCertClassInf,
pszDriverSigningClasses,
NULL,
&InfContext)) {
MYASSERT(FALSE);
leave;
}
i = 0;
do {
MYASSERT(i < LineCount);
//
// The format of a line in the [DriverSigningClasses]
// section is as follows:
//
// {GUID} [= FirstValidatedMajorVersion, FirstValidatedMinorVersion]
//
GuidString = pSetupGetField(&InfContext, 0);
if(GuidString &&
(NO_ERROR == pSetupGuidFromString(GuidString, &(GlobalDrvSignPolicyList.Members[i].DeviceSetupClassGuid)))) {
if(SetupGetIntField(&InfContext, 1, &(GlobalDrvSignPolicyList.Members[i].MajorVerLB)) &&
SetupGetIntField(&InfContext, 2, &(GlobalDrvSignPolicyList.Members[i].MinorVerLB))) {
//
// We successfully retrieved major/minor
// version info for validation lower-bound.
// Do a sanity-check on these.
//
if(GlobalDrvSignPolicyList.Members[i].MajorVerLB <= 0) {
GlobalDrvSignPolicyList.Members[i].MajorVerLB = -1;
GlobalDrvSignPolicyList.Members[i].MinorVerLB = -1;
}
} else {
//
// Set major/minor version info to -1 to
// indicate there's no validation platform
// override.
//
GlobalDrvSignPolicyList.Members[i].MajorVerLB = -1;
GlobalDrvSignPolicyList.Members[i].MinorVerLB = -1;
}
i++;
}
} while(SetupFindNextLine(&InfContext, &InfContext));
//
// Update NumMembers field in our list to indicate the
// number of class GUID entries we actually found.
//
GlobalDrvSignPolicyList.NumMembers = i;
}
//
// We now have a list. If the list is empty, this means we
// encountered some problem retrieving the list, thus all device
// classes should be subject to driver signing policy. Otherwise,
// try to find the caller-specified class in our list.
//
if(GlobalDrvSignPolicyList.NumMembers) {
//
// OK, we know we have a valid list--now default to non-driver
// signing policy unless our list search proves fruitful.
//
UseDrvSignPolicy = FALSE;
for(i = 0; i < GlobalDrvSignPolicyList.NumMembers; i++) {
if(!memcmp(DeviceSetupClassGuid,
&(GlobalDrvSignPolicyList.Members[i].DeviceSetupClassGuid),
sizeof(GUID))) {
//
// We found a match!
//
UseDrvSignPolicy = TRUE;
//
// Now, check to see if we have any validation platform
// override info...
//
if(ValidationPlatform &&
(GlobalDrvSignPolicyList.Members[i].MajorVerLB != -1)) {
MYASSERT(GlobalDrvSignPolicyList.Members[i].MinorVerLB != -1);
*ValidationPlatform = MyMalloc(sizeof(SP_ALTPLATFORM_INFO_V2));
//
// If the memory allocation fails, we just won't report
// the altplatform info, so the validation will be done
// based on the current OS version (instead of widening
// it up to allow a range of valid versions).
//
if(*ValidationPlatform) {
ZeroMemory(*ValidationPlatform, sizeof(SP_ALTPLATFORM_INFO_V2));
(*ValidationPlatform)->cbSize = sizeof(SP_ALTPLATFORM_INFO_V2);
(*ValidationPlatform)->Platform = VER_PLATFORM_WIN32_NT;
(*ValidationPlatform)->Flags = SP_ALTPLATFORM_FLAGS_VERSION_RANGE;
(*ValidationPlatform)->MajorVersion = VER_PRODUCTMAJORVERSION;
(*ValidationPlatform)->MinorVersion = VER_PRODUCTMINORVERSION;
(*ValidationPlatform)->ProcessorArchitecture =
#if defined(_X86_)
PROCESSOR_ARCHITECTURE_INTEL;
#elif defined(_IA64_)
PROCESSOR_ARCHITECTURE_IA64;
#elif defined(_AMD64_)
PROCESSOR_ARCHITECTURE_AMD64;
#else
#error "no target architecture"
#endif
(*ValidationPlatform)->FirstValidatedMajorVersion
= (DWORD)(GlobalDrvSignPolicyList.Members[i].MajorVerLB);
(*ValidationPlatform)->FirstValidatedMinorVersion
= (DWORD)(GlobalDrvSignPolicyList.Members[i].MinorVerLB);
}
}
//
// Since we've found a match, we can break out of the loop.
//
break;
}
}
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
//
// If we hit an exception, don't trust information in newly-allocated
// validation platform buffer (if any)
//
if(ValidationPlatform && *ValidationPlatform) {
MyFree(*ValidationPlatform);
*ValidationPlatform = NULL;
}
}
if(hCertClassInf != INVALID_HANDLE_VALUE) {
SetupCloseInfFile(hCertClassInf);
}
if(LogContext) {
DeleteLogContext(LogContext);
}
UnlockDrvSignPolicyList(&GlobalDrvSignPolicyList);
return UseDrvSignPolicy;
}
BOOL
InitDrvSignPolicyList(
VOID
)
/*++
Routine Description:
This routine initializes the global "Driver Signing Policy" list that is
retrieved (on first use) from %windir%\Inf\certclas.inf.
Arguments:
None
Return Value:
If success, the return value is TRUE, otherwise, it is FALSE.
--*/
{
ZeroMemory(&GlobalDrvSignPolicyList, sizeof(DRVSIGN_POLICY_LIST));
GlobalDrvSignPolicyList.NumMembers = -1;
return InitializeSynchronizedAccess(&GlobalDrvSignPolicyList.Lock);
}
VOID
DestroyDrvSignPolicyList(
VOID
)
/*++
Routine Description:
This routine destroys the global "Driver Signing Policy" list that is
retrieved (on first use) from %windir%\Inf\certclas.inf.
Arguments:
None
Return Value:
None
--*/
{
if(LockDrvSignPolicyList(&GlobalDrvSignPolicyList)) {
if(GlobalDrvSignPolicyList.Members) {
MyFree(GlobalDrvSignPolicyList.Members);
}
DestroySynchronizedAccess(&GlobalDrvSignPolicyList.Lock);
}
}
VOID
pSetupFreeVerifyContextMembers(
IN PVERIFY_CONTEXT VerifyContext
)
/*++
Routine Description:
This routine frees the various context handles contained in the specified
VerifyContext structure.
Arguments:
VerifyContext - supplies a pointer to a verification context structure
whose non-NULL members are to be freed.
Return Value:
None
--*/
{
//
// Release the crypto context (if there is one)
//
if(VerifyContext->hCatAdmin) {
CryptCATAdminReleaseContext(VerifyContext->hCatAdmin, 0);
}
//
// Release the handle to the bad driver database (if there is one)
//
if(VerifyContext->hSDBDrvMain) {
SdbReleaseDatabase(VerifyContext->hSDBDrvMain);
}
//
// Release the handle to the trusted publisher cert store (if there is
// one)
//
if(VerifyContext->hStoreTrustedPublisher) {
CertCloseStore(VerifyContext->hStoreTrustedPublisher, 0);
}
}
BOOL
pSetupIsAuthenticodePublisherTrusted(
IN PCCERT_CONTEXT CertContext,
IN OUT HCERTSTORE *hStoreTrustedPublisher OPTIONAL
)
/*++
Routine Description:
This routine checks to see whether the specified certificate is in the
"TrustedPublisher" certificate store.
Arguments:
CertContext - supplies the certificate context to look for in the
TrustedPublisher certificate store.
hStoreTrustedPublisher - optionally, supplies the address of a certificate
store handle. If the handle pointed to is NULL, a handle will be
acquired (if possible) via CertOpenStore and returned to the caller.
If the handle pointed to is non-NULL, then that handle will be used by
this routine. If the pointer itself is NULL, then an HCERTSTORE will
be acquired for the duration of this call, and released before
returning.
NOTE: it is the caller's responsibility to free the certificate store
handle returned by this routine by calling CertCloseStore. This handle
may be opened in either success or failure cases, so the caller must
check for non-NULL returned handle in both cases.
Return Value:
If the certificate was located in the "TrustedPublisher" certificate store,
the return value is non-zero (i.e., TRUE).
Otherwise, the return value is FALSE.
--*/
{
BYTE rgbHash[MAX_HASH_LEN];
CRYPT_DATA_BLOB HashBlob;
PCCERT_CONTEXT pFoundCert = NULL;
BOOL IsPublisherTrusted = FALSE;
HCERTSTORE LocalhStore = NULL;
try {
HashBlob.pbData = rgbHash;
HashBlob.cbData = sizeof(rgbHash);
if(!CertGetCertificateContextProperty(CertContext,
CERT_SIGNATURE_HASH_PROP_ID,
rgbHash,
&HashBlob.cbData)
|| (MIN_HASH_LEN > HashBlob.cbData))
{
leave;
}
//
// Check if trusted publisher
//
if(hStoreTrustedPublisher && *hStoreTrustedPublisher) {
LocalhStore = *hStoreTrustedPublisher;
} else {
LocalhStore = CertOpenStore(
CERT_STORE_PROV_SYSTEM_W,
0,
(HCRYPTPROV)NULL,
(CERT_SYSTEM_STORE_CURRENT_USER |
CERT_STORE_MAXIMUM_ALLOWED_FLAG |
CERT_STORE_SHARE_CONTEXT_FLAG),
(const void *) L"TrustedPublisher"
);
if(!LocalhStore) {
leave;
}
//
// Try to setup for auto-resync, but it's not a critical failure if
// we can't do this...
//
CertControlStore(LocalhStore,
0,
CERT_STORE_CTRL_AUTO_RESYNC,
NULL
);
if(hStoreTrustedPublisher) {
*hStoreTrustedPublisher = LocalhStore;
}
}
pFoundCert = CertFindCertificateInStore(LocalhStore,
0,
0,
CERT_FIND_SIGNATURE_HASH,
(const void *) &HashBlob,
NULL
);
if(pFoundCert) {
IsPublisherTrusted = TRUE;
}
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, NULL);
}
if(pFoundCert) {
CertFreeCertificateContext(pFoundCert);
}
if(!hStoreTrustedPublisher && LocalhStore) {
CertCloseStore(LocalhStore, 0);
}
return IsPublisherTrusted;
}
BOOL
IsAutoCertInstallAllowed(
VOID
)
/*++
Routine Description:
This routine indicates whether a certificate should automatically be
installed. The criteria it uses are:
1. Must be in GUI-mode setup or mini-setup.
2. Must be on an interactive windowstation
3. Must be in LocalSystem security context.
(#2 & #3) are to prevent spoofing of registry values in #1.)
Arguments:
None.
Return Value:
If the certificate should be auto-installed, the return value is TRUE.
Otherwise, it is FALSE.
--*/
{
//
// Only auto-install certificates if we're in GUI-mode setup (or
// mini-setup)...
//
if(!GuiSetupInProgress) {
return FALSE;
}
//
// ...and if we're on an interactive windowstation...
//
if(!IsInteractiveWindowStation()) {
return FALSE;
}
//
// ...and if we're in LocalSystem security context.
//
if(!pSetupIsLocalSystem()) {
return FALSE;
}
return TRUE;
}
DWORD
pSetupInstallCertificate(
IN PCCERT_CONTEXT CertContext
)
/*++
Routine Description:
This routine will install the specified certificate into the
TrustedPublisher certificate store.
Arguments:
CertContext - supplies the context for the certificate to be installed.
Return Value:
If the certificate was successfully installed, the return value is
NO_ERROR.
Otherwise, it is a Win32 error indicating the cause of the failure.
--*/
{
DWORD Err;
HCERTSTORE hCertStore;
Err = GLE_FN_CALL(NULL,
hCertStore = CertOpenStore(
CERT_STORE_PROV_SYSTEM_W,
0,
(HCRYPTPROV)NULL,
(CERT_SYSTEM_STORE_LOCAL_MACHINE
| CERT_STORE_OPEN_EXISTING_FLAG),
(const void *) L"TrustedPublisher")
);
if(Err != NO_ERROR) {
return Err;
}
try {
Err = GLE_FN_CALL(FALSE,
CertAddCertificateContextToStore(hCertStore,
CertContext,
CERT_STORE_ADD_USE_EXISTING,
NULL)
);
} except(pSetupExceptionFilter(GetExceptionCode())) {
pSetupExceptionHandler(GetExceptionCode(), ERROR_INVALID_PARAMETER, &Err);
}
if(hCertStore) {
CertCloseStore(hCertStore, 0);
}
return Err;
}
View Git Blame Copy Permalink