Mirrored_Repos/LookingGlass
1
0
Fork 0
mirror of https://github.com/gnif/LookingGlass.git synced 2026-11-12 23:07:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[idd] network: validate server certificate identity

Browse Source
This commit is contained in:
Geoffrey McRae
2026-10-01 07:29:27 +10:00
parent c497fe00c6
commit d1bbcbcb45
2 changed files with 138 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
idd/LGIddInstall/NetworkIdentity.c
View File

@@ -140,6 +140,37 @@ openKey:
return true;
}
static bool networkIdentityCanUsePrivateKey(PCCERT_CONTEXT certificate)
{
HCRYPTPROV_OR_NCRYPT_KEY_HANDLE key = 0;
DWORD keySpec = 0;
BOOL callerFree = FALSE;
const DWORD flags =
CRYPT_ACQUIRE_COMPARE_KEY_FLAG |
CRYPT_ACQUIRE_ONLY_NCRYPT_KEY_FLAG |
CRYPT_ACQUIRE_SILENT_FLAG;
const bool acquired = CryptAcquireCertificatePrivateKey(
certificate,
flags,
NULL,
&key,
&keySpec,
&callerFree);
const bool result = acquired &&
key &&
keySpec == CERT_NCRYPT_KEY_SPEC;
if (callerFree && key)
{
if (keySpec == CERT_NCRYPT_KEY_SPEC)
NCryptFreeObject((NCRYPT_HANDLE)key);
else
CryptReleaseContext((HCRYPTPROV)key, 0);
}
return result;
}
static bool networkIdentityMatchesKey(PCCERT_CONTEXT certificate)
{
DWORD size = 0;
@@ -158,7 +189,8 @@ static bool networkIdentityMatchesKey(PCCERT_CONTEXT certificate)
LG_NETWORK_CERTIFICATE_KEY_NAME) == 0 &&
info->pwszProvName &&
wcscmp(info->pwszProvName, MS_KEY_STORAGE_PROVIDER) == 0 &&
CertVerifyTimeValidity(NULL, certificate->pCertInfo) == 0;
CertVerifyTimeValidity(NULL, certificate->pCertInfo) == 0 &&
networkIdentityCanUsePrivateKey(certificate);
free(info);
return result;