Windows CE Networking Team WebLog : Author: Igor Dvorkin

Q & A for LAP writers on Windows Mobile

cenet — Thu, 10 Aug 2006 21:10:00 GMT

I wanted to write a blog entry about LASS and LAP, but almost everything I could say has already been said by Marcus on his blog entries here. One thing I can add is taking the Q and A that appears in the comments. Here is some Q and A in no particular order.

What is master key encryption , and should my LAP support it?

Master key encryption is a feature that allows the users master key to be encrypted with non persisted data. This feature is not currently supported in Windows Mobile. When master key protection becomes supported documentation will be provided. Do not set LAP_CAPABILITIES_MASTER_KEY at this time.

I've got an activeX control/some window that never appears. What's going on?

VerifyUser is running above startup so any UI you show needs the WS_EX_ABOVESTARTUP flag set.

What is WS_EX_ABOVESTARTUP?

On PPC, when the device has timed out, and requires authentication, a blank startup screen is drawn. This is to prevent prying eyes from seeing your sensitive information. Your LAP VerifyUser UI must appear above this screen. To have windows appear above this startup screen, you must specify WS_EX_ABOVESTARTUP.

I didn't need to set WS_EX_ABOVESTARTUP in my RTM LAP? Why do I need to MSFP+?

Actually, you do even in RTM. Try this experiment:

Go to the control panel, then password screen.
You should see your LAP UI.
Now, let your device go idle.
If you hadn't specified WS_EX_ABOVESTARTUP, your LAP window will not be displayed.

Weird, why doesn't this happen when my device goes idle in RTM?

In RTM the VerifyUser call ran on the callers thread. There is magic in the shell which says all windows created on the StartupThread (the thread that draws the blanking window), window magically get WS_EX_ABOVESTARTUP. Since in RTM VerifyUser was called in the StartupThread, it automatically got WS_EX_ABOVESTARTUP.

What's that VerifyUserToTop about?

See the above experiment, in step 4 VerifyUserToTop gets called signaling the LAP to bring its Verification window to the foreground. This is needed since only one VerifyUser (LAP) calls are serialized

I call MessageBox, but it doesn't appear.

See the issue with WS_EX_ABOVESTARTUP, that’s why the new sample LAP has MessageBox replacement code.

My LAP worked on RTM but not on MSFP+ devices. What is going on?

This is usually caused by the WS_EX_ABOVE_STARTUP issues above. The other change between RTM and MSFP+ is the location where the idle time out is stored, in MSFP+ it's stored as an AE policy.

In my RTM LAP, calls to random APIs are failing, but moving my calls to another thread fixes the problem. The problem disappeared in MSFP+.

This could be an entry on its own, but the base problem is that some APIs aren't supported in a PSL. In RTM, the LAP's VerifyUser call was run in a PSL context. If you don’t understand what this means, trust me this is no longer an issue In MSFP+.

[Igor Dvorkin]

LSP installer code for Windows Mobile and Windows CE

cenet — Thu, 18 May 2006 01:23:00 GMT

Great news the installer code I've been describing on my blog is now available at codeplex. Please note, codeplex is very new, and still has some issues.

I also expect to publish the lsp_helper library on which the Windows Mobile LSPs are based.

[Author: Igor Dvorkin]

Importing a session key into CAPI

cenet — Sat, 25 Feb 2006 03:09:00 GMT

I've seen a lot of non-optimal code to import a session key into CAPI. The attached code provides a utility function to do the import. Note: KeySize depends on the algorithm of the session key.

Bugs in the CE sample LSP

cenet — Thu, 16 Feb 2006 01:42:00 GMT

I've spent the last few days looking at LSPs and have found some errors in the sample.

These are:

1. Passing the wrong WSAPROTOCOLINFO to the next person in the chain:

Symptom: WSPSocket fails when layered over another LSP.

Fix: DCATALOG::FindNextProviderInChain needs to start by setting *BaseProviderCatalogEntry=NULL

2. Assuming *lpErrno == 0:

Symptom: ssl sockets (created via SO_SECURE) stop working when layered over ssllsp

Fix: WSPSelect needs to start by setting *lpErrno=NO_ERROR.

3. Installing incorrectly:
I plan on publishing another post on this shortly.

Issues for LSPs that connect to local host

cenet — Thu, 01 Dec 2005 00:47:00 GMT

As discussed in my previous post, the autobind_lsp performs hard binding. This will cause issues for LSPs that need to connect to localhost.

About hard binding:

Hard binding is a per socket TCP options specified by:
WSAIoctl(..., SIO_UCAST_IF,..).

Once a socket is hard bound, all data on that socket must be sent/received from the same adapter. In hard binding, the loop back adapter is a distinct adapter.

When does hard binding cause a problem?

Hard binding causes a problem when you want your LSP to connect to local host after a hard bind has occurred. In this case, you do not want the hard binding to occur.

Example of common failure:

        step 1) App: connect (10.10.10.10)
        step 2) autobind_lsp: bind (10.10.10.10)
        step 3) autobind_lsp: WSAIoctl(…, SIO_UCAST_IF, …)
        step 4) autobind_lsp: connect (10.10.10.10)
        step 5) YourProxy_LSP: connect_to_your_proxy_server (127.0.0.1:1080)

step 5) Will fail since your socket is already hard bound to adapter 10.10.10.10.

The work around:

A work around is to layer your LSP under autobind, and not propagate the SIO_UCAST_IF IOCTLs to the next LSP in the stack.

When you should use the work around:

This work around should only be used for sockets on which your LSP is explicitly proxying all data to a component you control. If your LSP is not doing this, the workaround should not be used.

[Author: Igor Dvorkin]

Default LSPs in WM 5.0 [autobind_lsp].

cenet — Wed, 26 Oct 2005 03:18:00 GMT

The following description of the autobind_lsp is copied from
http://www.intrinsyc.com/whitepapers/RIL_whitepaper_MS_Intrinsyc_June2004.pdf"

When an application makes a Connection Manager connection request, Connection Manager determines which IP interface the application should use to reach the destination network requested. Connection manager passes this information to the AutoBind LSP. If the application does not explicitly bind its sockets to an interface, then the AutoBind LSP will implicitly bind the sockets to the interface specified by Connection Manager, ensuring that the packets sent over the socket will take the correct route to reach the intended destination.

autobind_LSP effects the following winsock calls:

def WSPConnect(addr):
    if not alreadyBound() and not isLoopback(addr):
        doHardBindIfRequired()

    let_connect_call_passthrough_to(addr)


def WSPBind(addr):
    if not alreadyBound():
        doHardBindIfRequired()

    let_bind_call_passthrough_to(addr)


def WSPRecvFrom(addr):
    if not alreadyBound():
        doHardBindIfRequired()

    let_recvFrom_call_passthrough_to(addr)

def WSPSendTo(addr):
    if not alreadyBound():
        doHardBindIfRequired()

    let_sendTo_call_passthrough_to(addr)

def doHardBindIfRequired():
    interfaceToBindTo = ConnectionManager::GetInterfaceToBindTo(GetProcessID())
    if (interfaceToBindTo)
        TCPStack::ForceHardBind(interfaceToBindTo)
	alreadyBound = True

[Author: Igor Dvorkin]

Default LSPs in WM 5.0

cenet — Thu, 20 Oct 2005 01:52:00 GMT

In WM 5.0 2 new LSPs are present by default, the dtpt_lsp and the autobind_lsp. This article will discuss the dtpt_lsp and the next article will talk about the autobind_lsp.

Desktop Passthrough (DTPT) is the technology that allows the CE device to talk on the desktop network while Active Sync is running.

DTPT is implemented using a socket level proxy technology. A transport proxy client runs on CE, while a proxy server runs on the desktop as part of active sync. DTPT_LSP is that transpart proxy client.

DTPT_LSP effects the following winsock calls:

def WSPConnect (addr) :
    if is_dtpt_enabled():
        connect_to_dtpt_server()
        dtpt_server_connect_to(addr)
    else:
        let_connect_call_passthrough_to(addr)

[Author: Igor Dvorkin]

How do clients know a service is ready?

cenet — Tue, 11 Oct 2005 02:18:00 GMT

Often clients start before servers, and need to be signaled when the service
is ready. In this post we'll find a good solution to this problem.

Approach #1: Server signals a named event, clients waits for the event.

    Server:
        //Create manual reset event for service started
        hEvent = CreateEvent(NULL,TRUE,FALSE, SRV_STARTED_EVENT);
        SetEvent(hEvent)

Clients:
// Create manual reset event for service started
hServiceReadyEvent = CreateEvent(NULL,TRUE,FALSE, SRV_STARTED_EVENT);

WaitForSingleObject(hServiceReadyEvent)

Problems with #1:

What if the clients accidentally create the named event as an auto reset event. E.g.

Broken Client:

        // Accidently create an auto reset event
        hServiceReadyEvent = CreateEvent(NULL,FALSE,FALSE, SRV_STARTED_EVENT);
        WaitForSingleObject(hServiceReadyEvent)

If the client code runs after the server code runs everything works as expected. However, if the client code runs before the server code, the event is created as an auto reset, and the next client that goes to check the event will block forever. This bug can be very hard to find if you have a broken client that only runs before the server a few times.

Enough people have had this problem, that the OS provides a solution. If you create a registry key under HKLM/System/Events, filesys will open the named event as manual reset unsignaled and keep them open for the lifetime of filesys.exe

Approach #2: Have filesys create your named manual-reset at startup, then have client and server use OpenEvent.

Registry Changes:

    ; @CESYSGEN IF CE_MODULES_IGOR_SERVICE
    ; HIVE BOOT SECTION
    [HKEY_LOCAL_MACHINE\SYSTEM\Events]
    "IgorsServiceReadyEventName"="Event triggered after IgorsService can be used"
    ; END HIVE BOOT SECTION
    ; @CESYSGEN ENDIF

common code:

#define SRV_STARTED_EVENT L"IgorsServiceReadyEventName"

Server:

        //Open service ready event
        hServiceReadyEvent = OpenEvent(EVENT_ALL_ACCESS,FALSE,SRV_STARTED_EVENT);
       SetEvent(hEvent)

   Clients:

hServiceReadyEvent = OpenEvent(EVENT_ALL_ACCESS,FALSE,SRV_STARTED_EVENT);
WaitForSingleObject(hServiceReadyEvent)

An interesting side effect of this solution is if OpenEvent fails, the client will know the service is not in the image, thus client code can be:

   Clients that run on multiple CE configurations:
        hServiceReadyEvent = OpenEvent(EVENT_ALL_ACCESS,FALSE,SRV_STARTED_EVENT);
        if (hServiceReadyEvent == NULL)
        {
            // fatal service is not present in this configuration.
        }
        WaitForSingleObject(hServiceReadyEvent)

[Author: Igor Dvorkin]

There is a LASS in my smartphone.

cenet — Fri, 24 Jun 2005 01:03:00 GMT

The Local Authentication SubSystem (LASS) is a new feature in Windows Mobile 5.0. This feature is available for both PPC and SP. Using LASS, applications can force users to authenticate. The most interesting LASS API is VerifyUser.

To play with LASS set up a password and then try the following code snippet:

#include <lass.h>
#include <lass_ae.h>

      BOOL bRet = VerifyUser(&AE_EVERY_TIME, NULL,NULL,0,NULL);
      if (bRet)
         MessageBox (hWnd,L"User Verified",NULL,MB_OK);
      else
         MessageBox (hWnd,L"User Failed Verification",NULL,MB_OK);

I'll continue to discuss LASS in future blog entries.

[Author:Igor Dvorkin]

Smartcards on Windows Mobile 5

cenet — Thu, 16 Jun 2005 22:09:00 GMT

Starting with Window Mobile 5 the SCRM is included in the default configuration. This means when you purchase a smartcard reader for WM 2005 you will be able to access it using the SCard APIs that are exported from winscard.lib. The SCRM on Windows Mobile is API compatible with the desktop version so if you have desktop smartcard code it should just work on WM 2005. If you have smartcard questions, feel free to post them here or on the newsgroups.

[Author:Igor Dvorkin]

How to install LSPs on Windows CE 4.2 and PPC 2003 (Part 1)

cenet — Wed, 09 Feb 2005 21:09:00 GMT

The Problems:

P1) There is no way to determine the order in which LSPs will be installed in CE 4.2
P2) The SSLLSP always installs itself over the base provider, and will ignore chains placed by other LSPs.

A work around requires the following two attributes:

W1) Allows 3rd party LSPs to install in arbitrary order.
W2) Allows SSLLSP to be the first LSP to install.

To solve I suggest the following solution:

    Create an application called lsp_install.dll. This application will install
    LSPs from HKLM\COMM\WS2\LSP\LSP_INSTALL, using the same rules Windows CE 5.0 uses
    to install LSPs from HKLM\COMM\WS2\LSP.

    Remove all entries from HKLM\COMM\WS2\LSP.
    Add lsp_install.dll to HKLM\COMM\WS2\LSP.
    Add the LSPs you need installed into HKLM\COMM\WS2\LSP_INSTALL

Why you should follow this solution exactly:

If you follow this solution exactly, you'll be able to interoperate with other
LSPs. If each LSP vendor creates their own solution to this problem, LSPs
from different vendors will have issues running on the same device.

Final registry layout:

; Only the LSP installer will be installed by the system.

[HKEY_LOCAL_MACHINE\Comm\WS2\LSP\LSP_INSTALL]
"Dll"="lsp_install.dll"

; All other LSPs are installed by the LSP_INSTALL.DLL
; Which enumerates the Comm\WS2\LSP\LSP_INSTALL key.

    [HKEY_LOCAL_MACHINE\Comm\WS2\LSP\LSP_INSTALL\SSL]
        "Dll"="ssllsp.dll"
        "Order"=dword:1

     [HKEY_LOCAL_MACHINE\Comm\WS2\LSP\LSP_INSTALL\Your_LSP]
        "Dll"="your_lsp.dll"
        ; Order defaults to 0xFFFFFFFF if not specified.

Code/Binaries for LSP_INSTALLER:
We're working on the best way to distribute this. If someone creates such a dll, fire me a mail and we'll see about putting a link up to yours.

[Author: Igor Dvorkin]

How to use SignFile.exe from multiple computers.

cenet — Tue, 04 Jan 2005 21:56:00 GMT

As you have likely realized SignFile needs a key container with a private key to sign your file. You can read more about key containers and keys here:

Often you'll generate the private/public key pair with makecert. You’ll then use the keys makecert generated when calling signfile.

But, what if you want to sign files on a machine you didn't create the public/private key pair on? In that case you'll need a tool that can:

(1) Export your private key from a named key container.

(2) Import your exported private key to a named key container.

Unfortunately I'm not away of an MS tool that will do this. However, writing such a tool for the desktop should be pretty easy. Look at the CryptExportKey/CryptImportKey API's.

When I get more time I'll post the code for this, or if someone writes this code in the mean time, feel free to attach it to this blog.

[Author: Igor Dvorkin]

LSP Installation on CE.

cenet — Tue, 07 Dec 2004 21:57:00 GMT

[Last Edited on 12/7/2004]

The target audience for this post is LSP developers who are looking to install their LSP.
Developers with experience with desktop LSP installation will also
find this very useful.

This post also explains LSP installation differences between CE
and XP, and explains how to install an LSP on CE.

Note this post applies to Windows CE 5.0 and greater. As with earlier releases, LSP chain order on CE is solely determined by the order of installation. However, prior to version 5.0 there was no “Order” key and installation order was difficult to coordinate.

1) LSP Installation differences between CE and the desktop

    Installed catalog is not persisted across reboots
No WSCWriteProviderOrder function
    No SPORDER application
    WSCEnemurateProviders returns current catalog (not catalog at time app started)
    Installing LSP on the fly can be dangerous
    All LSP Installers run on every bootup
    Order of LSP chains is based on order installation routines run
    LSPs have cooperative installers

2) Problems when installing LSPs on the fly:

* LSP change hasn’t taken effect for all apps:
    device.exe/services.exe runs for the lifetime of the CE device
    Already open sockets will not use new LSP but new sockets will
    LSP usually cache catalog at startup.
    LSP won’t see changed catalog till restart.

Example:

    Server application is creating and using sockets
    Socket A is created with one chain before the LSP installs
    Socket B is created with another chain after install
    If the application calls select with socket A and B, select fails
   because the sockets have two different providers (see the documentation for select).

3) Why select works for IPv4 / IPv6, TCP / UDP:

    SOCKET sv4 = socket (AF_INET,..);
    SOCKET sv6 = socket (AF_INET6,...);
    FDSET fds;
    FD_SET(fds,sv4);
    FD_SET(fds,sv6);
    Select (fdset1,...);

     You would expect this to fail since sv4 and sv6 should be implemented by
    different providers. But our default base providers install with same GUID,
    so this call will work with no LSPs installed. Several apps, including
    Activesync, call select on both IPv4 and IPv6 sockets in the same fd_set.

4) What should your LSP Installer do?

* Layer over TCPv4/TCPv6/UDPv4/UDPv6 with the same ProviderId GUID.
Keeps select() working for all applications.

5) How to configure CE to install your LSP

* Add a key to:

    [HKEY_LOCAL_MACHINE\Comm\WS2\LSP\<your lsp>]
    "Dll"="your_lsp.dll" ; DLL containing your installer
    ;"DllEntry"="DllRegisterServer" ; // Function called to perform installation
                                       ; // Default value is DllRegisterServer

     "Order"=dword:400    ; // Order at which you’ll install
                                    ; // Default value is 0xFFFFFFFF
                                    ; // Change this value to change your position in the
                                    ; // Protocol Stack

* On startup, before any apps have called WSAStartup, all installers will be
run in the order specified (lowest Order value first).

[Author: Igor Dvorkin]

Layered Service Providers (LSPs) on Windows CE

cenet — Wed, 01 Dec 2004 20:59:00 GMT

One of the difficulties I have supporting the LSP developer community is the

amount of time between me implementing a change, and having LSP developers become aware of it. Often, the time delta is such that I can't incorporate developer feedback till the next version of CE.

To help mitigate this issue I'd like to try putting my proposed recommendations and sample code on this blog. This will allow me to get feedback, and you to shape the growth of the CE LSP technology.

To help me understand who I should be targeting, I’d like to know what you use your LSPs for. I’d appreciate if you added a comment stating what your LSP does, what version of CE (or PPC/SP) it needs to run on, and if the LSP primarily passes through to the next level in the LSP chain.

[Author: Igor Dvorkin]

About Igor...

cenet — Wed, 01 Dec 2004 20:54:00 GMT

My name is Igor Dvorkin. I've been with Window CE since 2002. I spend my time working on security and networking. Some of my interests on the security side are smartcards, local authentication, cryptography and penetration testing. On the networking side, I spend my time working with Layered Service Providers (LSPs) and desktop pass through for active sync.

[Author: Igor Dvorkin]