Botan 3.8.1
Crypto and TLS for C&
Botan::Certificate_Store_Windows Class Referencefinal

#include <certstor_windows.h>

Inheritance diagram for Botan::Certificate_Store_Windows:
Botan::Certificate_Store

Public Member Functions

std::vector< X509_DNall_subjects () const override
 
bool certificate_known (const X509_Certificate &cert) const
 
 Certificate_Store_Windows ()
 
 Certificate_Store_Windows (Certificate_Store_Windows &&)=default
 
 Certificate_Store_Windows (const Certificate_Store_Windows &)=default
 
std::vector< X509_Certificatefind_all_certs (const X509_DN &subject_dn, const std::vector< uint8_t > &key_id) const override
 
std::optional< X509_Certificatefind_cert (const X509_DN &subject_dn, const std::vector< uint8_t > &key_id) const override
 
std::optional< X509_Certificatefind_cert_by_pubkey_sha1 (const std::vector< uint8_t > &key_hash) const override
 
std::optional< X509_Certificatefind_cert_by_raw_subject_dn_sha256 (const std::vector< uint8_t > &subject_hash) const override
 
std::optional< X509_CRLfind_crl_for (const X509_Certificate &subject) const override
 
Certificate_Store_Windowsoperator= (Certificate_Store_Windows &&)=default
 
Certificate_Store_Windowsoperator= (const Certificate_Store_Windows &)=default
 

Detailed Description

Certificate Store that is backed by the system trust store on Windows.

Definition at line 21 of file certstor_windows.h.

Constructor & Destructor Documentation

◆ Certificate_Store_Windows() [1/3]

Botan::Certificate_Store_Windows::Certificate_Store_Windows ( )

◆ Certificate_Store_Windows() [2/3]

Botan::Certificate_Store_Windows::Certificate_Store_Windows ( const Certificate_Store_Windows & )
default

◆ Certificate_Store_Windows() [3/3]

Botan::Certificate_Store_Windows::Certificate_Store_Windows ( Certificate_Store_Windows && )
default

Member Function Documentation

◆ all_subjects()

std::vector< X509_DN > Botan::Certificate_Store_Windows::all_subjects ( ) const
overridevirtual
Returns
DNs for all certificates managed by the store

Implements Botan::Certificate_Store.

Definition at line 158 of file certstor_windows.cpp.

158 {
159 std::vector<X509_DN> subject_dns;
160 for(const auto store_name : cert_store_names) {
161 Handle_Guard<HCERTSTORE> windows_cert_store = open_cert_store(store_name);
162 Handle_Guard<PCCERT_CONTEXT> cert_context = nullptr;
163
164 // Handle_Guard::assign exchanges the underlying pointer. No RAII is needed here, because the Windows API takes care of
165 // freeing the previous context.
166 while(cert_context.assign(CertEnumCertificatesInStore(windows_cert_store.get(), cert_context.get()))) {
167 BER_Decoder dec(cert_context->pCertInfo->Subject.pbData, cert_context->pCertInfo->Subject.cbData);
168
169 X509_DN dn;
170 dn.decode_from(dec);
171 subject_dns.emplace_back(std::move(dn));
172 }
173 }
174
175 return subject_dns;
176}
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AES void dec(uint8x16_t &B, uint8x16_t K)
Definition aes_armv8.cpp:45

References Botan::X509_DN::decode_from().

Referenced by operator=().

◆ certificate_known()

bool Botan::Certificate_Store::certificate_known ( const X509_Certificate & cert) const
inlineinherited
Returns
whether the certificate is known
Parameters
certcertififcate to be searched

Definition at line 70 of file certstor.h.

70 {
71 return find_cert(cert.subject_dn(), cert.subject_key_id()).has_value();
72 }
virtual std::optional< X509_Certificate > find_cert(const X509_DN &subject_dn, const std::vector< uint8_t > &key_id) const
Definition certstor.cpp:20

References find_cert(), Botan::X509_Certificate::subject_dn(), and Botan::X509_Certificate::subject_key_id().

◆ find_all_certs()

std::vector< X509_Certificate > Botan::Certificate_Store_Windows::find_all_certs ( const X509_DN & subject_dn,
const std::vector< uint8_t > & key_id ) const
overridevirtual

Find all certificates with a given Subject DN. Subject DN and even the key identifier might not be unique.

Implements Botan::Certificate_Store.

Definition at line 187 of file certstor_windows.cpp.

188 {
189 return find_cert_by_dn_and_key_id(subject_dn, key_id, false);
190}

Referenced by operator=().

◆ find_cert()

std::optional< X509_Certificate > Botan::Certificate_Store_Windows::find_cert ( const X509_DN & subject_dn,
const std::vector< uint8_t > & key_id ) const
overridevirtual

Find a certificate by Subject DN and (optionally) key identifier

Returns
the first certificate that matches

Reimplemented from Botan::Certificate_Store.

Definition at line 178 of file certstor_windows.cpp.

179 {
180 const auto certs = find_cert_by_dn_and_key_id(subject_dn, key_id, true);
181 if(certs.empty())
182 return std::nullopt;
183 else
184 return certs.front();
185}

Referenced by operator=().

◆ find_cert_by_pubkey_sha1()

std::optional< X509_Certificate > Botan::Certificate_Store_Windows::find_cert_by_pubkey_sha1 ( const std::vector< uint8_t > & key_hash) const
overridevirtual

Find a certificate by searching for one with a matching SHA-1 hash of public key.

Returns
a matching certificate or nullptr otherwise

Implements Botan::Certificate_Store.

Definition at line 192 of file certstor_windows.cpp.

193 {
194 if(key_hash.size() != 20) {
195 throw Invalid_Argument("Certificate_Store_Windows::find_cert_by_pubkey_sha1 invalid hash");
196 }
197
198 CRYPT_HASH_BLOB blob;
199 blob.cbData = static_cast<DWORD>(key_hash.size());
200 blob.pbData = const_cast<BYTE*>(key_hash.data());
201
202 auto filter = [&](const std::vector<X509_Certificate>&, const X509_Certificate&) { return true; };
203
204 // This assumes that the to-be-found certificate adheres to RFC 3280 (Section 4.2.1.2), because
205 // the windows API does not allow to search for the SHA-1 of the certificate's public key directly.
206 // Most certificates adhere to the above mentioned convention...
207 const auto certs = search_cert_stores(blob, CERT_FIND_KEY_IDENTIFIER, filter, true);
208 if(!certs.empty())
209 return certs.front();
210
211 // ... for certificates that don't adhere to RFC 3280 (Section 4.2.1.2), we will need to use a
212 // fallback implementation that does an exhaustive search of all available certificates.
213 return find_cert_by_pubkey_sha1_via_exhaustive_search(key_hash);
214}

Referenced by operator=().

◆ find_cert_by_raw_subject_dn_sha256()

std::optional< X509_Certificate > Botan::Certificate_Store_Windows::find_cert_by_raw_subject_dn_sha256 ( const std::vector< uint8_t > & subject_hash) const
overridevirtual
Exceptions
Not_Implementedas this is not possible in the Windows system cert API

Implements Botan::Certificate_Store.

Definition at line 216 of file certstor_windows.cpp.

217 {
218 BOTAN_UNUSED(subject_hash);
219 throw Not_Implemented("Certificate_Store_Windows::find_cert_by_raw_subject_dn_sha256");
220}
#define BOTAN_UNUSED
Definition assert.h:120

References BOTAN_UNUSED.

Referenced by operator=().

◆ find_crl_for()

std::optional< X509_CRL > Botan::Certificate_Store_Windows::find_crl_for ( const X509_Certificate & subject) const
overridevirtual

Not Yet Implemented

Returns
nullptr;

Reimplemented from Botan::Certificate_Store.

Definition at line 222 of file certstor_windows.cpp.

222 {
223 // TODO: this could be implemented by using the CertFindCRLInStore function
224 BOTAN_UNUSED(subject);
225 return std::nullopt;
226}

References BOTAN_UNUSED.

Referenced by operator=().

◆ operator=() [1/2]

◆ operator=() [2/2]

Certificate_Store_Windows & Botan::Certificate_Store_Windows::operator= ( const Certificate_Store_Windows & )
default

The documentation for this class was generated from the following files: