SecuritySupport.cs

/********************************************************************++
Copyright (c) Microsoft Corporation.  All rights reserved.
--********************************************************************/

#pragma warning disable 1634, 1691
#pragma warning disable 56523

using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.IO;
using Microsoft.PowerShell;
using Microsoft.PowerShell.Commands;
using System.Management.Automation.Security;
using System.Management.Automation.Internal;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Globalization;

using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.Runtime.InteropServices;

using Microsoft.Win32;

using DWORD = System.UInt32;
using BOOL = System.UInt32;

namespace Microsoft.PowerShell
{
    /// <summary>
    /// Defines the different Execution Policies supported by the
    /// PSAuthorizationManager class.
    /// 
    /// </summary>
    public enum ExecutionPolicy
    {
        /// Unrestricted - No files must be signed.  If a file originates from the
        ///    internet, Monad provides a warning prompt to alert the user.  To
        ///    suppress this warning message, right-click on the file in File Explorer,
        ///    select "Properties," and then "Unblock."
        Unrestricted = 0,

        /// RemoteSigned - Only .msh and .mshxml files originating from the internet
        ///    must be digitally signed.  If remote, signed, and executed, Monad 
        ///    prompts to determine if files from the signing publisher should be 
        ///    run or not.  This is the default setting.
        RemoteSigned = 1,

        /// AllSigned - All .msh and .mshxml files must be digitally signed.  If
        ///    signed and executed, Monad prompts to determine if files from the 
        ///    signing publisher should be run or not.
        AllSigned = 2,

        /// Restricted - All .msh files are blocked.  Mshxml files must be digitally 
        ///    signed, and by a trusted publisher.  If you haven't made a trust decision
        ///    on the publisher yet, prompting is done as in AllSigned mode.
        Restricted = 3,

        /// Bypass - No files must be signed, and internet origin is not verified
        Bypass = 4,

        /// Undefined - Not specified at this scope
        Undefined = 5,

        /// <summary>
        /// Default - The most restrictive policy available.
        /// </summary>
        Default = Restricted
    };

    /// <summary>
    /// Defines the available configuration scopes for an execution
    /// policy. They are in the following priority, with successive
    /// elements overriding the items that precede them:
    /// LocalMachine -> CurrentUser -> Runspace
    /// 
    /// </summary>
    public enum ExecutionPolicyScope
    {
        /// Execution policy is retrieved from the
        /// PSExecutionPolicyPreference environment variable.
        Process = 0,

        /// Execution policy is retrieved from the HKEY_CURRENT_USER
        /// registry hive for the current ShellId.
        CurrentUser = 1,

        /// Execution policy is retrieved from the HKEY_LOCAL_MACHINE
        /// registry hive for the current ShellId.
        LocalMachine = 2,

        /// Execution policy is retrieved from the current user's
        /// group policy setting.
        UserPolicy = 3,

        /// Execution policy is retrieved from the machine-wide
        /// group policy setting.
        MachinePolicy = 4
    }
}

namespace System.Management.Automation.Internal
{
    /// <summary>
    /// The SAFER policy associated with this file
    /// 
    /// </summary>
    internal enum SaferPolicy
    {
        /// Explicitly allowed through an Allow rule
        ExplicitlyAllowed = 0,

        /// Allowed because it has not been explicitly disallowed
        Allowed = 1,

        /// Disallowed by a rule or policy.
        Disallowed = 2
    }

    /// <summary>
    /// Security Support APIs
    /// </summary>
    public static class SecuritySupport
    {
        #region execution policy

        internal static ExecutionPolicyScope[] ExecutionPolicyScopePreferences
        {
            get
            {
                return new ExecutionPolicyScope[] {
                        ExecutionPolicyScope.MachinePolicy,
                        ExecutionPolicyScope.UserPolicy,
                        ExecutionPolicyScope.Process,
                        ExecutionPolicyScope.CurrentUser,
                        ExecutionPolicyScope.LocalMachine
                    };
            }
        }

        internal static void SetExecutionPolicy(ExecutionPolicyScope scope, ExecutionPolicy policy, string shellId)
        {
#if UNIX
            throw new PlatformNotSupportedException();
#else
            string executionPolicy = "Restricted";
            string preferenceKey = Utils.GetRegistryConfigurationPath(shellId);

            switch (policy)
            {
                case ExecutionPolicy.Restricted:
                    executionPolicy = "Restricted"; break;
                case ExecutionPolicy.AllSigned:
                    executionPolicy = "AllSigned"; break;
                case ExecutionPolicy.RemoteSigned:
                    executionPolicy = "RemoteSigned"; break;
                case ExecutionPolicy.Unrestricted:
                    executionPolicy = "Unrestricted"; break;
                case ExecutionPolicy.Bypass:
                    executionPolicy = "Bypass"; break;
            }

            // Set the execution policy
            switch (scope)
            {
                case ExecutionPolicyScope.Process:
                {
                    if (policy == ExecutionPolicy.Undefined)
                        executionPolicy = null;

                    Environment.SetEnvironmentVariable("PSExecutionPolicyPreference", executionPolicy);
                    break;
                }

                case ExecutionPolicyScope.CurrentUser:
                {
                    // They want to remove it
                    if (policy == ExecutionPolicy.Undefined)
                    {
                        ConfigPropertyAccessor.Instance.RemoveExecutionPolicy(ConfigPropertyAccessor.PropertyScope.CurrentUser, shellId);
                        CleanKeyParents(Registry.CurrentUser, preferenceKey);
                    }
                    else
                    {
                        ConfigPropertyAccessor.Instance.SetExecutionPolicy(ConfigPropertyAccessor.PropertyScope.CurrentUser, shellId, executionPolicy);
                    }
                    break;
                }

                case ExecutionPolicyScope.LocalMachine:
                {
                    // They want to remove it
                    if (policy == ExecutionPolicy.Undefined)
                    {
                        ConfigPropertyAccessor.Instance.RemoveExecutionPolicy(ConfigPropertyAccessor.PropertyScope.SystemWide, shellId);
                        CleanKeyParents(Registry.LocalMachine, preferenceKey);
                    }
                    else
                    {
                        ConfigPropertyAccessor.Instance.SetExecutionPolicy(ConfigPropertyAccessor.PropertyScope.SystemWide, shellId, executionPolicy);
                    }
                    break;
                }
            }
#endif
        }

        // Clean up the parents of a registry key as long as they
        // contain at most a single child
        private static void CleanKeyParents(RegistryKey baseKey, string keyPath)
        {
#if CORECLR
            if (!Platform.IsInbox)
                return;
#endif
            using (RegistryKey key = baseKey.OpenSubKey(keyPath, true))
            {
                // Verify the child key has no children
                if ((key == null) || ((key.ValueCount == 0) && (key.SubKeyCount == 0)))
                {
                    // If so, split the key into its path elements
                    string[] parentKeys = keyPath.Split(Utils.Separators.Backslash);

                    // Verify we aren't traveling into SOFTWARE\Microsoft
                    if (parentKeys.Length <= 2)
                        return;

                    string currentItem = parentKeys[parentKeys.Length - 1];

                    // Figure out the parent key name
                    string parentKeyPath = keyPath.Remove(keyPath.Length - currentItem.Length - 1);

                    // Open the parent, and clear the child key
                    if (key != null)
                    {
                        using (RegistryKey parentKey = baseKey.OpenSubKey(parentKeyPath, true))
                        {
                            parentKey.DeleteSubKey(currentItem, true);
                        }
                    }

                    // Now, process the parent key
                    CleanKeyParents(baseKey, parentKeyPath);
                }
                else
                {
                    return;
                }
            }
        }

        internal static ExecutionPolicy GetExecutionPolicy(string shellId)
        {
            foreach (ExecutionPolicyScope scope in ExecutionPolicyScopePreferences)
            {
                ExecutionPolicy policy = GetExecutionPolicy(shellId, scope);
                if (policy != ExecutionPolicy.Undefined)
                    return policy;
            }

            return ExecutionPolicy.Restricted;
        }

        internal static ExecutionPolicy GetExecutionPolicy(string shellId, ExecutionPolicyScope scope)
        {
#if UNIX
            return ExecutionPolicy.Unrestricted;
#else
            switch (scope)
            {
                case ExecutionPolicyScope.Process:
                    {
                        string policy = Environment.GetEnvironmentVariable("PSExecutionPolicyPreference");

                        if (!String.IsNullOrEmpty(policy))
                            return ParseExecutionPolicy(policy);
                        else
                            return ExecutionPolicy.Undefined;
                    }

                case ExecutionPolicyScope.CurrentUser:
                case ExecutionPolicyScope.LocalMachine:
                    {
                        string policy = GetLocalPreferenceValue(shellId, scope);

                        if (!String.IsNullOrEmpty(policy))
                            return ParseExecutionPolicy(policy);
                        else
                            return ExecutionPolicy.Undefined;
                    }

                // TODO: Group Policy is only supported on Full systems, but !LINUX && CORECLR 
                // will run there as well, so I don't think we should remove it.
                case ExecutionPolicyScope.UserPolicy:
                case ExecutionPolicyScope.MachinePolicy:
                    {
                        string groupPolicyPreference = GetGroupPolicyValue(shellId, scope);
                        if (!String.IsNullOrEmpty(groupPolicyPreference))
                        {
                            // Be sure we aren't being called by Group Policy
                            // itself. A group policy should never block a logon /
                            // logoff script.
                            Process currentProcess = Process.GetCurrentProcess();
                            string gpScriptPath = IO.Path.Combine(
                                Environment.GetFolderPath(Environment.SpecialFolder.System),
                                "gpscript.exe");
                            bool foundGpScriptParent = false;

                            try
                            {
                                while (currentProcess != null)
                                {
                                    if (String.Equals(gpScriptPath,
                                            PsUtils.GetMainModule(currentProcess).FileName, StringComparison.OrdinalIgnoreCase))
                                    {
                                        foundGpScriptParent = true;
                                        break;
                                    }
                                    else
                                    {
                                        currentProcess = PsUtils.GetParentProcess(currentProcess);
                                    }
                                }
                            }
                            catch (System.ComponentModel.Win32Exception)
                            {
                                // If you attempt to retrieve the MainModule of a 64-bit process
                                // from a WOW64 (32-bit) process, the Win32 API has a fatal
                                // flaw that causes this to return the error:
                                //   "Only part of a ReadProcessMemory or WriteProcessMemory
                                //   request was completed."
                                // In this case, we just catch the exception and eat it.
                                // The implication is that logon / logoff scripts that somehow
                                // launch the Wow64 version of PowerShell will be subject
                                // to the execution policy deployed by Group Policy (where
                                // our goal here is to not have the Group Policy execution policy
                                // affect logon / logoff scripts.
                            }

                            if (!foundGpScriptParent)
                            {
                                return ParseExecutionPolicy(groupPolicyPreference);
                            }
                        }

                        return ExecutionPolicy.Undefined;
                    }
            }

            return ExecutionPolicy.Restricted;
#endif
        }

        internal static ExecutionPolicy ParseExecutionPolicy(string policy)
        {
            if (String.Equals(policy, "Bypass",
                                   StringComparison.OrdinalIgnoreCase))
            {
                return ExecutionPolicy.Bypass;
            }
            else if (String.Equals(policy, "Unrestricted",
                                   StringComparison.OrdinalIgnoreCase))
            {
                return ExecutionPolicy.Unrestricted;
            }
            else if (String.Equals(policy, "RemoteSigned",
                                   StringComparison.OrdinalIgnoreCase))
            {
                return ExecutionPolicy.RemoteSigned;
            }
            else if (String.Equals(policy, "AllSigned",
                              StringComparison.OrdinalIgnoreCase))
            {
                return ExecutionPolicy.AllSigned;
            }
            else if (String.Equals(policy, "Restricted",
                         StringComparison.OrdinalIgnoreCase))
            {
                return ExecutionPolicy.Restricted;
            }
            else
            {
                return ExecutionPolicy.Default;
            }
        }

        internal static string GetExecutionPolicy(ExecutionPolicy policy)
        {
            switch (policy)
            {
                case ExecutionPolicy.Bypass: return "Bypass";
                case ExecutionPolicy.Unrestricted: return "Unrestricted";
                case ExecutionPolicy.RemoteSigned: return "RemoteSigned";
                case ExecutionPolicy.AllSigned: return "AllSigned";
                case ExecutionPolicy.Restricted: return "Restricted";
                default: return "Restricted";
            }
        }

        /// <summary>
        /// Returns true if file has product binary signature
        /// </summary>
        /// <param name="file">Name of file to check</param>
        /// <returns>True when file has product binary signature</returns>
        public static bool IsProductBinary(string file)
        {
            if (String.IsNullOrEmpty(file) || (!IO.File.Exists(file)))
            {
                return false;
            }

            // Check if it is in the product folder, if not, skip checking the catalog
            // and any other checks.
            var isUnderProductFolder = Utils.IsUnderProductFolder(file);
            if (!isUnderProductFolder)
            {
                return false;
            }

#if UNIX
            // There is no signature support on non-Windows platforms (yet), when
            // execution reaches here, we are sure the file is under product folder
            return true;
#else
            // Check the file signature
            Signature fileSignature = SignatureHelper.GetSignature(file, null);
            if ((fileSignature != null) && (fileSignature.IsOSBinary))
            {
                return true;
            }

            // WTGetSignatureInfo is used to verify catalog signature.
            // On Win7, catalog API is not available.
            // On OneCore SKUs like NanoServer/IoT, the API has a bug that makes it not able to find the
            // corresponding catalog file for a given product file, so it doesn't work properly.
            // In these cases, we just trust the 'isUnderProductFolder' check.
            if (Signature.CatalogApiAvailable.HasValue && !Signature.CatalogApiAvailable.Value)
            {
                // When execution reaches here, we are sure the file is under product folder
                return true;
            }

            return false;
#endif
        }

#if !CORECLR
        /// <summary>
        /// Get the pass / fail result of calling the SAFER API
        /// </summary>
        ///
        /// <param name="path">The path to the file in question</param>
        /// <param name="handle">A file handle to the file in question, if available.</param>
        [ArchitectureSensitive]
        [SuppressMessage("Microsoft.Reliability", "CA2001:AvoidCallingProblematicMethods")]
        internal static SaferPolicy GetSaferPolicy(string path, SafeHandle handle)
        {
            SaferPolicy status = SaferPolicy.Allowed;

            SAFER_CODE_PROPERTIES codeProperties = new SAFER_CODE_PROPERTIES();
            IntPtr hAuthzLevel;

            // Prepare the code properties struct.
            codeProperties.cbSize = (uint)Marshal.SizeOf(typeof(SAFER_CODE_PROPERTIES));
            codeProperties.dwCheckFlags = (
                NativeConstants.SAFER_CRITERIA_IMAGEPATH |
                NativeConstants.SAFER_CRITERIA_IMAGEHASH |
                NativeConstants.SAFER_CRITERIA_AUTHENTICODE);
            codeProperties.ImagePath = path;

            if (handle != null)
            {
                codeProperties.hImageFileHandle = handle.DangerousGetHandle();
            }

            // turn off WinVerifyTrust UI
            codeProperties.dwWVTUIChoice = NativeConstants.WTD_UI_NONE;

            // Identify the level associated with the code
            if (NativeMethods.SaferIdentifyLevel(1, ref codeProperties, out hAuthzLevel, NativeConstants.SRP_POLICY_SCRIPT))
            {
                // We found an Authorization Level applicable to this application.
                IntPtr hRestrictedToken = IntPtr.Zero;
                try
                {
                    if (!NativeMethods.SaferComputeTokenFromLevel(
                                               hAuthzLevel,                    // Safer Level
                                               IntPtr.Zero,                    // Test current process' token
                                               ref hRestrictedToken,           // target token
                                               NativeConstants.SAFER_TOKEN_NULL_IF_EQUAL,
                                               IntPtr.Zero))
                    {
                        int lastError = Marshal.GetLastWin32Error();
                        if ((lastError == NativeConstants.ERROR_ACCESS_DISABLED_BY_POLICY) ||
                            (lastError == NativeConstants.ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY))
                        {
                            status = SaferPolicy.Disallowed;
                        }
                        else
                        {
                            throw new System.ComponentModel.Win32Exception();
                        }
                    }
                    else
                    {
                        if (hRestrictedToken == IntPtr.Zero)
                        {
                            // This is not necessarily the "fully trusted" level, 
                            // it means that the thread token is complies with the requested level
                            status = SaferPolicy.Allowed;
                        }
                        else
                        {
                            status = SaferPolicy.Disallowed;
                            NativeMethods.CloseHandle(hRestrictedToken);
                        }
                    }
                }
                finally
                {
                    NativeMethods.SaferCloseLevel(hAuthzLevel);
                }
            }
            else
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }

            return status;
        }
#endif
        /// <summary>
        /// Returns the value of the Execution Policy as retrieved
        /// from group policy.
        /// </summary>
        /// <returns>NULL if it is not defined at this level</returns>
        private static string GetGroupPolicyValue(string shellId, ExecutionPolicyScope scope)
        {
            RegistryKey[] scopeKey = null;

            switch (scope)
            {
                case ExecutionPolicyScope.MachinePolicy:
                    {
                        scopeKey = Utils.RegLocalMachine;
                    }; break;

                case ExecutionPolicyScope.UserPolicy:
                    {
                        scopeKey = Utils.RegCurrentUser;
                    }; break;
            }

            Dictionary<string, object> groupPolicySettings = Utils.GetGroupPolicySetting(".", scopeKey);
            if (groupPolicySettings == null)
            {
                return null;
            }

            Object enableScriptsValue = null;
            if (groupPolicySettings.TryGetValue("EnableScripts", out enableScriptsValue))
            {
                if (String.Equals(enableScriptsValue.ToString(), "0", StringComparison.OrdinalIgnoreCase))
                {
                    return "Restricted";
                }
                else if (String.Equals(enableScriptsValue.ToString(), "1", StringComparison.OrdinalIgnoreCase))
                {
                    Object executionPolicyValue = null;
                    if (groupPolicySettings.TryGetValue("ExecutionPolicy", out executionPolicyValue))
                    {
                        return executionPolicyValue.ToString();
                    }
                }
            }

            return null;
        }

        /// <summary>
        /// Returns the value of the Execution Policy as retrieved
        /// from the local preference.
        /// </summary>
        /// <returns>NULL if it is not defined at this level</returns>
        private static string GetLocalPreferenceValue(string shellId, ExecutionPolicyScope scope)
        {
            switch (scope)
            {
                // 1: Look up the current-user preference
                case ExecutionPolicyScope.CurrentUser:
                    return ConfigPropertyAccessor.Instance.GetExecutionPolicy(ConfigPropertyAccessor.PropertyScope.CurrentUser, shellId);

                // 2: Look up the system-wide preference
                case ExecutionPolicyScope.LocalMachine:
                    return ConfigPropertyAccessor.Instance.GetExecutionPolicy(ConfigPropertyAccessor.PropertyScope.SystemWide, shellId);
            }

            return null;
        }

#endregion execution policy

        /// <summary>
        /// throw if file does not exist
        /// </summary>
        ///
        /// <param name="filePath"> path to file </param>
        ///
        /// <returns> Does not return a value </returns>
        ///
        /// <remarks>  </remarks>
        ///
        internal static void CheckIfFileExists(string filePath)
        {
            if (!File.Exists(filePath))
            {
                throw new FileNotFoundException(filePath);
            }
        }

        /// <summary>
        /// check to see if the specified cert is suitable to be
        /// used as a code signing cert
        /// </summary>
        ///
        /// <param name="c"> certificate object </param>
        ///
        /// <returns> true on success, false otherwise </returns>
        ///
        /// <remarks>  </remarks>
        ///
        internal static bool CertIsGoodForSigning(X509Certificate2 c)
        {
            if (!CertHasPrivatekey(c))
            {
                return false;
            }

            return CertHasOid(c, CertificateFilterInfo.CodeSigningOid);
        }

        /// <summary>
        /// check to see if the specified cert is suitable to be
        /// used as an encryption cert for PKI encryption. Note
        /// that this cert doesn't require the private key.
        /// </summary>
        ///
        /// <param name="c"> certificate object </param>
        ///
        /// <returns> true on success, false otherwise </returns>
        ///
        /// <remarks>  </remarks>
        ///
        internal static bool CertIsGoodForEncryption(X509Certificate2 c)
        {
            return (
                CertHasOid(c, CertificateFilterInfo.DocumentEncryptionOid) &&
                (CertHasKeyUsage(c, X509KeyUsageFlags.DataEncipherment) ||
                 CertHasKeyUsage(c, X509KeyUsageFlags.KeyEncipherment)));
        }

        private static bool CertHasOid(X509Certificate2 c, string oid)
        {
            Collection<string> ekus = GetCertEKU(c);

            foreach (string testOid in ekus)
            {
                if (testOid == oid)
                {
                    return true;
                }
            }

            return false;
        }

        private static bool CertHasKeyUsage(X509Certificate2 c, X509KeyUsageFlags keyUsage)
        {
            foreach (X509Extension extension in c.Extensions)
            {
                X509KeyUsageExtension keyUsageExtension = extension as X509KeyUsageExtension;
                if (keyUsageExtension != null)
                {
                    if ((keyUsageExtension.KeyUsages & keyUsage) == keyUsage)
                    {
                        return true;
                    }
                    break;
                }
            }

            return false;
        }

        /// <summary>
        /// check if the specified cert has a private key in it
        /// </summary>
        ///
        /// <param name="cert"> certificate object </param>
        ///
        /// <returns> true on success, false otherwise </returns>
        ///
        /// <remarks>  </remarks>
        ///
        internal static bool CertHasPrivatekey(X509Certificate2 cert)
        {
            return cert.HasPrivateKey;
        }

        /// <summary>
        /// Get the EKUs of a cert
        /// </summary>
        ///
        /// <param name="cert"> certificate object </param>
        ///
        /// <returns> a collection of cert eku strings </returns>
        ///
        /// <remarks>  </remarks>
        ///
        [ArchitectureSensitive]
        internal static Collection<string> GetCertEKU(X509Certificate2 cert)
        {
            Collection<string> ekus = new Collection<string>();
            IntPtr pCert = cert.Handle;
            int structSize = 0;
            IntPtr dummy = IntPtr.Zero;

            if (Security.NativeMethods.CertGetEnhancedKeyUsage(pCert, 0, dummy,
                                                      out structSize))
            {
                if (structSize > 0)
                {
                    IntPtr ekuBuffer = Marshal.AllocHGlobal(structSize);

                    try
                    {
                        if (Security.NativeMethods.CertGetEnhancedKeyUsage(pCert, 0,
                                                                  ekuBuffer,
                                                                  out structSize))
                        {
                            Security.NativeMethods.CERT_ENHKEY_USAGE ekuStruct =
                                (Security.NativeMethods.CERT_ENHKEY_USAGE)
                                ClrFacade.PtrToStructure<Security.NativeMethods.CERT_ENHKEY_USAGE>(ekuBuffer);
                            IntPtr ep = ekuStruct.rgpszUsageIdentifier;
                            IntPtr ekuptr;

                            for (int i = 0; i < ekuStruct.cUsageIdentifier; i++)
                            {
                                ekuptr = Marshal.ReadIntPtr(ep, i * Marshal.SizeOf(ep));
                                string eku = Marshal.PtrToStringAnsi(ekuptr);
                                ekus.Add(eku);
                            }
                        }
                        else
                        {
                            throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
                        }
                    }
                    finally
                    {
                        Marshal.FreeHGlobal(ekuBuffer);
                    }
                }
            }
            else
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }

            return ekus;
        }

        /// <summary>
        /// convert an int to a DWORD
        /// </summary>
        ///
        /// <param name="n"> signed int number  </param>
        ///
        /// <returns> DWORD </returns>
        ///
        /// <remarks>  </remarks>
        ///
        internal static DWORD GetDWORDFromInt(int n)
        {
            UInt32 result = BitConverter.ToUInt32(BitConverter.GetBytes(n), 0);
            return (DWORD)result;
        }

        /// <summary>
        /// convert a DWORD to int
        /// </summary>
        ///
        /// <param name="n"> number </param>
        ///
        /// <returns> int </returns>
        ///
        /// <remarks>  </remarks>
        ///
        internal static int GetIntFromDWORD(DWORD n)
        {
            Int64 n64 = n - 0x100000000L;
            return (int)n64;
        }
    }

    /// <summary>
    /// information used for filtering a set of certs
    /// </summary>
    internal sealed class CertificateFilterInfo
    {
        internal CertificateFilterInfo()
        {
        }

        /// <summary>
        /// purpose of a certificate
        /// </summary>
        internal CertificatePurpose Purpose
        {
            get { return _purpose; }
            set { _purpose = value; }
        }

        /// <summary>
        /// SSL Server Authentication
        /// </summary>
        internal bool SSLServerAuthentication
        {
            get { return _sslServerAuthentication; }
            set { _sslServerAuthentication = value; }
        }

        /// <summary>
        /// DNS name of a certificate
        /// </summary>
        internal string DnsName
        {
            set { _dnsName = value; }
        }

        /// <summary>
        /// EKU OID list of a certificate
        /// </summary>
        internal string[] Eku
        {
            set { _eku = value; }
        }

        /// <summary>
        /// remaining validity period in days for a certificate
        /// </summary>
        internal int ExpiringInDays
        {
            set { _expiringInDays = value; }
        }

        /// <summary>
        /// combine properties into a filter string
        /// </summary>
        internal string FilterString
        {
            get
            {
                string filterString = "";

                if (_dnsName != null)
                {
                    filterString = AppendFilter(filterString, "dns", _dnsName);
                }

                string ekuT = "";
                if (_eku != null)
                {
                    for (int i = 0; i < _eku.Length; i++)
                    {
                        if (ekuT.Length != 0)
                        {
                            ekuT = ekuT + ",";
                        }
                        ekuT = ekuT + _eku[i];
                    }
                }
                if (_purpose == CertificatePurpose.CodeSigning)
                {
                    if (ekuT.Length != 0)
                    {
                        ekuT = ekuT + ",";
                    }
                    ekuT = ekuT + CodeSigningOid;
                }
                if (_purpose == CertificatePurpose.DocumentEncryption)
                {
                    if (ekuT.Length != 0)
                    {
                        ekuT = ekuT + ",";
                    }
                    ekuT = ekuT + DocumentEncryptionOid;
                }
                if (_sslServerAuthentication)
                {
                    if (ekuT.Length != 0)
                    {
                        ekuT = ekuT + ",";
                    }
                    ekuT = ekuT + szOID_PKIX_KP_SERVER_AUTH;
                }
                if (ekuT.Length != 0)
                {
                    filterString = AppendFilter(filterString, "eku", ekuT);
                    if (_purpose == CertificatePurpose.CodeSigning ||
                        _sslServerAuthentication)
                    {
                        filterString = AppendFilter(filterString, "key", "*");
                    }
                }
                if (_expiringInDays >= 0)
                {
                    filterString = AppendFilter(
                                    filterString,
                                    "ExpiringInDays",
                                    _expiringInDays.ToString(System.Globalization.CultureInfo.InvariantCulture));
                }

                if (filterString.Length == 0)
                {
                    filterString = null;
                }
                return filterString;
            }
        }

        private string AppendFilter(
                            string filterString,
                            string name,
                            string value)
        {
            string newfilter = value;

            // append a "name=value" filter to the existing filter string.
            // insert a separating "&" if existing filter string is not empty.

            // if the value is empty, do nothing.

            if (newfilter.Length != 0)
            {
                // if the value contains an equal sign or an ampersand, throw
                // an exception to avoid compromising the native code parser.

                if (newfilter.Contains("=") || newfilter.Contains("&"))
                {
                    throw Marshal.GetExceptionForHR(
                                    Security.NativeMethods.E_INVALID_DATA);
                }
                newfilter = name + "=" + newfilter;
                if (filterString.Length != 0)
                {
                    newfilter = "&" + newfilter;
                }
            }
            return filterString + newfilter;
        }

        private CertificatePurpose _purpose = 0;
        private bool _sslServerAuthentication = false;
        private string _dnsName = null;
        private string[] _eku = null;
        private int _expiringInDays = -1;

        internal const string CodeSigningOid = "1.3.6.1.5.5.7.3.3";
        internal const string szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1";

        // The OID arc 1.3.6.1.4.1.311.80 is assigned to PowerShell. If we need
        // new OIDs, we can assign them under this branch.
        internal const string DocumentEncryptionOid = "1.3.6.1.4.1.311.80.1";
    }
}

namespace Microsoft.PowerShell.Commands
{
    /// <summary>
    /// Defines the valid purposes by which
    /// we can filter certificates.
    /// </summary>    
    internal enum CertificatePurpose
    {
        /// <summary>
        /// Certificates where a purpose has not been specified.
        /// </summary>
        NotSpecified = 0,

        /// <summary>
        /// Certificates that can be used to sign
        /// code and scripts.
        /// </summary>    
        CodeSigning = 0x1,

        /// <summary>
        /// Certificates that can be used to encrypt
        /// data.