Only support encrypting string variants.
Sean Hall committed
Jul 17, 2020 at 21:48 UTC
6d763d9c86405644cc72530ad64978efd6ba5828
3 files changed
+32
-119
src/engine/variant.cpp
+27
-113
@@ -6,22 +6,12 @@
6
7
// internal function declarations
8
9
-static HRESULT BVariantEncryptNumeric(
10
- __in BURN_VARIANT* pVariant,
11
- __in BOOL fEncrypt
12
- );
13
-
9
static HRESULT BVariantEncryptString(
10
__in BURN_VARIANT* pVariant,
11
__in BOOL fEncrypt
12
);
13
19
-static HRESULT BVariantEncryptVersion(
20
- __in BURN_VARIANT* pVariant,
21
- __in BOOL fEncrypt
22
- );
23
-
24
-static HRESULT BVariantRetrieveDecryptedNumeric(
14
+static void BVariantRetrieveNumeric(
15
__in BURN_VARIANT* pVariant,
16
__out LONGLONG* pllValue
17
);
@@ -31,7 +21,7 @@ static HRESULT BVariantRetrieveDecryptedString(
21
__out LPWSTR* psczValue
22
);
23
34
-static HRESULT BVariantRetrieveDecryptedVersion(
24
+static void BVariantRetrieveVersion(
25
__in BURN_VARIANT* pVariant,
26
__out DWORD64* pqwValue
27
);
@@ -61,7 +51,7 @@ extern "C" HRESULT BVariantGetNumeric(
51
switch (pVariant->Type)
52
{
53
case BURN_VARIANT_TYPE_NUMERIC:
64
- BVariantRetrieveDecryptedNumeric(pVariant, pllValue);
54
+ BVariantRetrieveNumeric(pVariant, pllValue);
55
break;
56
case BURN_VARIANT_TYPE_STRING:
57
hr = BVariantRetrieveDecryptedString(pVariant, &sczValue);
@@ -76,7 +66,7 @@ extern "C" HRESULT BVariantGetNumeric(
66
StrSecureZeroFreeString(sczValue);
67
break;
68
case BURN_VARIANT_TYPE_VERSION:
79
- BVariantRetrieveDecryptedVersion(pVariant, (DWORD64*)pllValue);
69
+ BVariantRetrieveVersion(pVariant, (DWORD64*)pllValue);
70
break;
71
default:
72
hr = E_INVALIDARG;
@@ -99,7 +89,7 @@ extern "C" HRESULT BVariantGetString(
89
switch (pVariant->Type)
90
{
91
case BURN_VARIANT_TYPE_NUMERIC:
102
- hr = BVariantRetrieveDecryptedNumeric(pVariant, &llValue);
92
+ BVariantRetrieveNumeric(pVariant, &llValue);
93
if (SUCCEEDED(hr))
94
{
95
hr = StrAllocFormattedSecure(psczValue, L"%I64d", llValue);
@@ -111,7 +101,7 @@ extern "C" HRESULT BVariantGetString(
101
hr = BVariantRetrieveDecryptedString(pVariant, psczValue);
102
break;
103
case BURN_VARIANT_TYPE_VERSION:
114
- hr = BVariantRetrieveDecryptedVersion(pVariant, &qwValue);
104
+ BVariantRetrieveVersion(pVariant, &qwValue);
105
if (SUCCEEDED(hr))
106
{
107
hr = StrAllocFormattedSecure(psczValue, L"%hu.%hu.%hu.%hu",
@@ -144,7 +134,7 @@ extern "C" HRESULT BVariantGetVersion(
134
switch (pVariant->Type)
135
{
136
case BURN_VARIANT_TYPE_NUMERIC:
147
- BVariantRetrieveDecryptedNumeric(pVariant, (LONGLONG*)pqwValue);
137
+ BVariantRetrieveNumeric(pVariant, (LONGLONG*)pqwValue);
138
break;
139
case BURN_VARIANT_TYPE_STRING:
140
hr = BVariantRetrieveDecryptedString(pVariant, &sczValue);
@@ -159,7 +149,7 @@ extern "C" HRESULT BVariantGetVersion(
149
StrSecureZeroFreeString(sczValue);
150
break;
151
case BURN_VARIANT_TYPE_VERSION:
162
- BVariantRetrieveDecryptedVersion(pVariant, pqwValue);
152
+ BVariantRetrieveVersion(pVariant, pqwValue);
153
break;
154
default:
155
hr = E_INVALIDARG;
@@ -175,7 +165,7 @@ extern "C" HRESULT BVariantSetNumeric(
165
)
166
{
167
HRESULT hr = S_OK;
178
- BOOL fEncryptValue = pVariant->fEncryptValue;
168
+ BOOL fEncrypt = pVariant->fEncryptString;
169
170
if (BURN_VARIANT_TYPE_STRING == pVariant->Type)
171
{
@@ -184,7 +174,7 @@ extern "C" HRESULT BVariantSetNumeric(
174
memset(pVariant, 0, sizeof(BURN_VARIANT));
175
pVariant->llValue = llValue;
176
pVariant->Type = BURN_VARIANT_TYPE_NUMERIC;
187
- BVariantSetEncryption(pVariant, fEncryptValue);
177
+ BVariantSetEncryption(pVariant, fEncrypt);
178
179
return hr;
180
}
@@ -196,7 +186,7 @@ extern "C" HRESULT BVariantSetString(
186
)
187
{
188
HRESULT hr = S_OK;
199
- BOOL fEncryptValue = pVariant->fEncryptValue;
189
+ BOOL fEncrypt = pVariant->fEncryptString;
190
191
if (!wzValue) // if we're nulling out the string, make the variable NONE.
192
{
@@ -211,7 +201,7 @@ extern "C" HRESULT BVariantSetString(
201
else
202
{
203
// We're about to copy an unencrypted value.
214
- pVariant->fEncryptValue = FALSE;
204
+ pVariant->fEncryptString = FALSE;
205
}
206
207
hr = StrAllocStringSecure(&pVariant->sczValue, wzValue, cchValue);
@@ -221,7 +211,7 @@ extern "C" HRESULT BVariantSetString(
211
}
212
213
LExit:
224
- BVariantSetEncryption(pVariant, fEncryptValue);
214
+ BVariantSetEncryption(pVariant, fEncrypt);
215
return hr;
216
}
217
@@ -231,7 +221,7 @@ extern "C" HRESULT BVariantSetVersion(
221
)
222
{
223
HRESULT hr = S_OK;
234
- BOOL fEncryptValue = pVariant->fEncryptValue;
224
+ BOOL fEncryptValue = pVariant->fEncryptString;
225
226
if (BURN_VARIANT_TYPE_STRING == pVariant->Type)
227
{
@@ -254,7 +244,7 @@ extern "C" HRESULT BVariantSetValue(
244
LONGLONG llValue = 0;
245
LPWSTR sczValue = NULL;
246
DWORD64 qwValue = 0;
257
- BOOL fEncrypt = pVariant->fEncryptValue;
247
+ BOOL fEncrypt = pVariant->fEncryptString;
248
249
switch (pValue->Type)
250
{
@@ -341,7 +331,7 @@ extern "C" HRESULT BVariantCopy(
331
}
332
ExitOnFailure(hr, "Failed to copy variant.");
333
344
- hr = BVariantSetEncryption(pTarget, pSource->fEncryptValue);
334
+ hr = BVariantSetEncryption(pTarget, pSource->fEncryptString);
335
336
LExit:
337
return hr;
@@ -354,7 +344,7 @@ extern "C" HRESULT BVariantChangeType(
344
{
345
HRESULT hr = S_OK;
346
BURN_VARIANT variant = { };
357
- BOOL fEncryptValue = pVariant->fEncryptValue;
347
+ BOOL fEncrypt = pVariant->fEncryptString;
348
349
if (pVariant->Type == type)
350
{
@@ -384,7 +374,7 @@ extern "C" HRESULT BVariantChangeType(
374
BVariantUninitialize(pVariant);
375
memcpy_s(pVariant, sizeof(BURN_VARIANT), &variant, sizeof(BURN_VARIANT));
376
SecureZeroMemory(&variant, sizeof(BURN_VARIANT));
387
- BVariantSetEncryption(pVariant, fEncryptValue);
377
+ BVariantSetEncryption(pVariant, fEncrypt);
378
379
LExit:
380
return hr;
@@ -397,7 +387,7 @@ extern "C" HRESULT BVariantSetEncryption(
387
{
388
HRESULT hr = S_OK;
389
400
- if (pVariant->fEncryptValue == fEncrypt)
390
+ if (pVariant->fEncryptString == fEncrypt)
391
{
392
// The requested encryption state is already applied.
393
ExitFunction();
@@ -406,47 +396,23 @@ extern "C" HRESULT BVariantSetEncryption(
396
switch (pVariant->Type)
397
{
398
case BURN_VARIANT_TYPE_NONE:
409
- hr = S_OK;
410
- break;
399
case BURN_VARIANT_TYPE_NUMERIC:
412
- hr = BVariantEncryptNumeric(pVariant, fEncrypt);
400
+ case BURN_VARIANT_TYPE_VERSION:
401
+ hr = S_OK;
402
break;
403
case BURN_VARIANT_TYPE_STRING:
404
hr = BVariantEncryptString(pVariant, fEncrypt);
405
break;
417
- case BURN_VARIANT_TYPE_VERSION:
418
- hr = BVariantEncryptVersion(pVariant, fEncrypt);
419
- break;
406
default:
407
hr = E_INVALIDARG;
408
}
409
ExitOnFailure(hr, "Failed to set the variant's encryption state");
424
- pVariant->fEncryptValue = fEncrypt;
410
+ pVariant->fEncryptString = fEncrypt;
411
412
LExit:
413
return hr;
414
}
415
430
-static HRESULT BVariantEncryptNumeric(
431
- __in BURN_VARIANT* pVariant,
432
- __in BOOL fEncrypt
433
- )
434
-{
435
- HRESULT hr = S_OK;
436
-
437
- if (fEncrypt)
438
- {
439
- hr = CrypEncryptMemory(&pVariant->llValue, sizeof(pVariant->encryptionPadding), VARIANT_ENCRYPTION_SCOPE);
440
- }
441
- else
442
- {
443
- hr = CrypDecryptMemory(&pVariant->llValue, sizeof(pVariant->encryptionPadding), VARIANT_ENCRYPTION_SCOPE);
444
- }
445
-
446
-//LExit:
447
- return hr;
448
-}
449
-
416
static HRESULT BVariantEncryptString(
417
__in BURN_VARIANT* pVariant,
418
__in BOOL fEncrypt
@@ -496,50 +462,14 @@ LExit:
462
return hr;
463
}
464
499
-static HRESULT BVariantEncryptVersion(
500
- __in BURN_VARIANT* pVariant,
501
- __in BOOL fEncrypt
502
- )
503
-{
504
- HRESULT hr = S_OK;
505
-
506
- if (fEncrypt)
507
- {
508
- hr = CrypEncryptMemory(&pVariant->qwValue, sizeof(pVariant->encryptionPadding), VARIANT_ENCRYPTION_SCOPE);
509
- }
510
- else
511
- {
512
- hr = CrypDecryptMemory(&pVariant->qwValue, sizeof(pVariant->encryptionPadding), VARIANT_ENCRYPTION_SCOPE);
513
- }
514
-
515
-//LExit:
516
- return hr;
517
-}
518
-
519
-// The contents of pllValue may be sensitive, should keep encrypted and SecureZeroMemory.
520
-static HRESULT BVariantRetrieveDecryptedNumeric(
465
+static void BVariantRetrieveNumeric(
466
__in BURN_VARIANT* pVariant,
467
__out LONGLONG* pllValue
468
)
469
{
525
- HRESULT hr = S_OK;
526
-
470
Assert(NULL != pllValue);
528
- if (pVariant->fEncryptValue)
529
- {
530
- hr = BVariantEncryptNumeric(pVariant, FALSE);
531
- ExitOnFailure(hr, "Failed to decrypt numeric");
532
- }
471
472
*pllValue = pVariant->llValue;
535
-
536
- if (pVariant->fEncryptValue)
537
- {
538
- hr = BVariantEncryptNumeric(pVariant, TRUE);
539
- }
540
-
541
-LExit:
542
- return hr;
473
}
474
475
// The contents of psczValue may be sensitive, should keep encrypted and SecureZeroFree.
@@ -550,13 +480,13 @@ static HRESULT BVariantRetrieveDecryptedString(
480
{
481
HRESULT hr = S_OK;
482
553
- if (NULL == pVariant->sczValue)
483
+ if (!pVariant->sczValue)
484
{
485
*psczValue = NULL;
486
ExitFunction();
487
}
488
559
- if (pVariant->fEncryptValue)
489
+ if (pVariant->fEncryptString)
490
{
491
hr = BVariantEncryptString(pVariant, FALSE);
492
ExitOnFailure(hr, "Failed to decrypt string");
@@ -565,7 +495,7 @@ static HRESULT BVariantRetrieveDecryptedString(
495
hr = StrAllocStringSecure(psczValue, pVariant->sczValue, 0);
496
ExitOnFailure(hr, "Failed to copy value.");
497
568
- if (pVariant->fEncryptValue)
498
+ if (pVariant->fEncryptString)
499
{
500
hr = BVariantEncryptString(pVariant, TRUE);
501
}
@@ -574,28 +504,12 @@ LExit:
504
return hr;
505
}
506
577
-// The contents of pqwValue may be sensitive, should keep encrypted and SecureZeroMemory.
578
-static HRESULT BVariantRetrieveDecryptedVersion(
507
+static void BVariantRetrieveVersion(
508
__in BURN_VARIANT* pVariant,
509
__out DWORD64* pqwValue
510
)
511
{
583
- HRESULT hr = S_OK;
584
-
512
Assert(NULL != pqwValue);
586
- if (pVariant->fEncryptValue)
587
- {
588
- hr = BVariantEncryptVersion(pVariant, FALSE);
589
- ExitOnFailure(hr, "Failed to decrypt version");
590
- }
513
514
*pqwValue = pVariant->qwValue;
593
-
594
- if (pVariant->fEncryptValue)
595
- {
596
- hr = BVariantEncryptVersion(pVariant, TRUE);
597
- }
598
-
599
-LExit:
600
- return hr;
515
}
src/engine/variant.h
+1
-2
@@ -27,10 +27,9 @@ typedef struct _BURN_VARIANT
27
LONGLONG llValue;
28
DWORD64 qwValue;
29
LPWSTR sczValue;
30
- BYTE encryptionPadding[CRYP_ENCRYPT_MEMORY_SIZE];
30
};
31
BURN_VARIANT_TYPE Type;
33
- BOOL fEncryptValue;
32
+ BOOL fEncryptString;
33
} BURN_VARIANT;
34
35
src/test/BurnUnitTest/VariantTest.cpp
+4
-4
@@ -77,7 +77,7 @@ namespace Bootstrapper
77
hr = BVariantSetEncryption(pActualValue, TRUE);
78
NativeAssert::Succeeded(hr, "Failed to encrypt variant {0}", wz);
79
80
- NativeAssert::True(pActualValue->fEncryptValue);
80
+ NativeAssert::True(pActualValue->fEncryptString);
81
}
82
}
83
@@ -95,7 +95,7 @@ namespace Bootstrapper
95
hr = BVariantSetEncryption(pActualValue, TRUE);
96
NativeAssert::Succeeded(hr, "Failed to encrypt variant {0}", wz);
97
98
- NativeAssert::True(pActualValue->fEncryptValue);
98
+ NativeAssert::True(pActualValue->fEncryptString);
99
}
100
}
101
@@ -115,7 +115,7 @@ namespace Bootstrapper
115
hr = BVariantSetEncryption(pActualValue, TRUE);
116
NativeAssert::Succeeded(hr, "Failed to encrypt variant {0}", wz);
117
118
- NativeAssert::True(pActualValue->fEncryptValue);
118
+ NativeAssert::True(pActualValue->fEncryptString);
119
}
120
}
121
@@ -133,7 +133,7 @@ namespace Bootstrapper
133
hr = BVariantSetEncryption(pActualValue, TRUE);
134
NativeAssert::Succeeded(hr, "Failed to encrypt variant {0}", wz);
135
136
- NativeAssert::True(pActualValue->fEncryptValue);
136
+ NativeAssert::True(pActualValue->fEncryptString);
137
}
138
}
139