?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
winejoystick: Fix a crash on accessing a CFArray past its end due to an off-by-one...
[wine/multimedia.git] / dlls / crypt32 / cert.c
blob0cda2c44f61ed5d6f3c7c47bfbefd7dc2ead72c6
1 /*
2 * Copyright 2004-2006 Juan Lang
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17 *
18 */
19
20 #include <assert.h>
21 #include <stdarg.h>
22
23 #define NONAMELESSUNION
24 #include "windef.h"
25 #include "winbase.h"
26 #include "wincrypt.h"
27 #include "winnls.h"
28 #include "rpc.h"
29 #include "wine/debug.h"
30 #include "wine/unicode.h"
31 #include "crypt32_private.h"
32
33 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
34
35 /* Internal version of CertGetCertificateContextProperty that gets properties
36 * directly from the context (or the context it's linked to, depending on its
37 * type.) Doesn't handle special-case properties, since they are handled by
38 * CertGetCertificateContextProperty, and are particular to the store in which
39 * the property exists (which is separate from the context.)
40 */
41 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
42 void *pvData, DWORD *pcbData);
43
44 /* Internal version of CertSetCertificateContextProperty that sets properties
45 * directly on the context (or the context it's linked to, depending on its
46 * type.) Doesn't handle special cases, since they're handled by
47 * CertSetCertificateContextProperty anyway.
48 */
49 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
50 DWORD dwFlags, const void *pvData);
51
52 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
53 DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
54 DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
55 {
56 PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
57 pbCertEncoded, cbCertEncoded);
58 BOOL ret;
59
60 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
61 pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
62
63 if (cert)
64 {
65 ret = CertAddCertificateContextToStore(hCertStore, cert,
66 dwAddDisposition, ppCertContext);
67 CertFreeCertificateContext(cert);
68 }
69 else
70 ret = FALSE;
71 return ret;
72 }
73
74 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
75 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
76 {
77 HCERTSTORE store;
78 BOOL ret = FALSE;
79
80 TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
81 cbCertEncoded);
82
83 store = CertOpenSystemStoreA(0, pszCertStoreName);
84 if (store)
85 {
86 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
87 pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
88 CertCloseStore(store, 0);
89 }
90 return ret;
91 }
92
93 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
94 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
95 {
96 HCERTSTORE store;
97 BOOL ret = FALSE;
98
99 TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
100 cbCertEncoded);
101
102 store = CertOpenSystemStoreW(0, pszCertStoreName);
103 if (store)
104 {
105 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
106 pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
107 CertCloseStore(store, 0);
108 }
109 return ret;
110 }
111
112 static const context_vtbl_t cert_vtbl;
113
114 static void Cert_free(context_t *context)
115 {
116 cert_t *cert = (cert_t*)context;
117
118 CryptMemFree(cert->ctx.pbCertEncoded);
119 LocalFree(cert->ctx.pCertInfo);
120 }
121
122 static context_t *Cert_clone(context_t *context, WINECRYPT_CERTSTORE *store, BOOL use_link)
123 {
124 cert_t *cert;
125
126 if(use_link) {
127 cert = (cert_t*)Context_CreateLinkContext(sizeof(CERT_CONTEXT), context, store);
128 if(!cert)
129 return NULL;
130 }else {
131 const cert_t *cloned = (const cert_t*)context;
132 DWORD size = 0;
133 BOOL res;
134
135 cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, store);
136 if(!cert)
137 return NULL;
138
139 Context_CopyProperties(&cert->ctx, &cloned->ctx);
140
141 cert->ctx.dwCertEncodingType = cloned->ctx.dwCertEncodingType;
142 cert->ctx.pbCertEncoded = CryptMemAlloc(cloned->ctx.cbCertEncoded);
143 memcpy(cert->ctx.pbCertEncoded, cloned->ctx.pbCertEncoded, cloned->ctx.cbCertEncoded);
144 cert->ctx.cbCertEncoded = cloned->ctx.cbCertEncoded;
145
146 /* FIXME: We don't need to decode the object here, we could just clone cert info. */
147 res = CryptDecodeObjectEx(cert->ctx.dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
148 cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
149 &cert->ctx.pCertInfo, &size);
150 if(!res) {
151 CertFreeCertificateContext(&cert->ctx);
152 return NULL;
153 }
154 }
155
156 cert->ctx.hCertStore = store;
157 return &cert->base;
158 }
159
160 static const context_vtbl_t cert_vtbl = {
161 Cert_free,
162 Cert_clone
163 };
164
165 static BOOL add_cert_to_store(WINECRYPT_CERTSTORE *store, const CERT_CONTEXT *cert,
166 DWORD add_disposition, BOOL use_link, PCCERT_CONTEXT *ret_context)
167 {
168 const CERT_CONTEXT *existing = NULL;
169 BOOL ret = TRUE, inherit_props = FALSE;
170 context_t *new_context = NULL;
171
172 switch (add_disposition)
173 {
174 case CERT_STORE_ADD_ALWAYS:
175 break;
176 case CERT_STORE_ADD_NEW:
177 case CERT_STORE_ADD_REPLACE_EXISTING:
178 case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
179 case CERT_STORE_ADD_USE_EXISTING:
180 case CERT_STORE_ADD_NEWER:
181 case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
182 {
183 BYTE hashToAdd[20];
184 DWORD size = sizeof(hashToAdd);
185
186 ret = CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID,
187 hashToAdd, &size);
188 if (ret)
189 {
190 CRYPT_HASH_BLOB blob = { sizeof(hashToAdd), hashToAdd };
191
192 existing = CertFindCertificateInStore(store, cert->dwCertEncodingType, 0,
193 CERT_FIND_SHA1_HASH, &blob, NULL);
194 }
195 break;
196 }
197 default:
198 FIXME("Unimplemented add disposition %d\n", add_disposition);
199 SetLastError(E_INVALIDARG);
200 return FALSE;
201 }
202
203 switch (add_disposition)
204 {
205 case CERT_STORE_ADD_ALWAYS:
206 break;
207 case CERT_STORE_ADD_NEW:
208 if (existing)
209 {
210 TRACE("found matching certificate, not adding\n");
211 SetLastError(CRYPT_E_EXISTS);
212 return FALSE;
213 }
214 break;
215 case CERT_STORE_ADD_REPLACE_EXISTING:
216 break;
217 case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
218 if (use_link)
219 FIXME("CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES: semi-stub for links\n");
220 if (existing)
221 inherit_props = TRUE;
222 break;
223 case CERT_STORE_ADD_USE_EXISTING:
224 if(use_link)
225 FIXME("CERT_STORE_ADD_USE_EXISTING: semi-stub for links\n");
226 if (existing)
227 {
228 Context_CopyProperties(existing, cert);
229 if (ret_context)
230 *ret_context = CertDuplicateCertificateContext(existing);
231 return TRUE;
232 }
233 break;
234 case CERT_STORE_ADD_NEWER:
235 if (existing && CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
236 {
237 TRACE("existing certificate is newer, not adding\n");
238 SetLastError(CRYPT_E_EXISTS);
239 return FALSE;
240 }
241 break;
242 case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
243 if (existing)
244 {
245 if (CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
246 {
247 TRACE("existing certificate is newer, not adding\n");
248 SetLastError(CRYPT_E_EXISTS);
249 return FALSE;
250 }
251 inherit_props = TRUE;
252 }
253 break;
254 }
255
256 /* FIXME: We have tests that this works, but what should we really do in this case? */
257 if(!store) {
258 if(ret_context)
259 *ret_context = CertDuplicateCertificateContext(cert);
260 return TRUE;
261 }
262
263 ret = store->vtbl->certs.addContext(store, context_from_ptr(cert), existing ? context_from_ptr(existing) : NULL,
264 (ret_context || inherit_props) ? &new_context : NULL, use_link);
265 if(!ret)
266 return FALSE;
267
268 if(inherit_props)
269 Context_CopyProperties(context_ptr(new_context), existing);
270
271 if(ret_context)
272 *ret_context = context_ptr(new_context);
273 else if(new_context)
274 Context_Release(new_context);
275
276 TRACE("returning %d\n", ret);
277 return ret;
278 }
279
280 BOOL WINAPI CertAddCertificateContextToStore(HCERTSTORE hCertStore, PCCERT_CONTEXT pCertContext,
281 DWORD dwAddDisposition, PCCERT_CONTEXT *ppStoreContext)
282 {
283 WINECRYPT_CERTSTORE *store = hCertStore;
284
285 TRACE("(%p, %p, %08x, %p)\n", hCertStore, pCertContext, dwAddDisposition, ppStoreContext);
286
287 return add_cert_to_store(store, pCertContext, dwAddDisposition, FALSE, ppStoreContext);
288 }
289
290 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
291 PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
292 PCCERT_CONTEXT *ppCertContext)
293 {
294 static int calls;
295 WINECRYPT_CERTSTORE *store = (WINECRYPT_CERTSTORE*)hCertStore;
296
297 if (!(calls++))
298 FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore, pCertContext,
299 dwAddDisposition, ppCertContext);
300 if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
301 return FALSE;
302 if (store->type == StoreTypeCollection)
303 {
304 SetLastError(E_INVALIDARG);
305 return FALSE;
306 }
307 return add_cert_to_store(hCertStore, pCertContext, dwAddDisposition, TRUE, ppCertContext);
308 }
309
310 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
311 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
312 {
313 cert_t *cert = NULL;
314 BYTE *data = NULL;
315 BOOL ret;
316 PCERT_INFO certInfo = NULL;
317 DWORD size = 0;
318
319 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
320 cbCertEncoded);
321
322 if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
323 {
324 SetLastError(E_INVALIDARG);
325 return NULL;
326 }
327
328 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
329 pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
330 &certInfo, &size);
331 if (!ret)
332 return NULL;
333
334 cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, &empty_store);
335 if (!cert)
336 return NULL;
337 data = CryptMemAlloc(cbCertEncoded);
338 if (!data)
339 {
340 Context_Release(&cert->base);
341 return NULL;
342 }
343
344 memcpy(data, pbCertEncoded, cbCertEncoded);
345 cert->ctx.dwCertEncodingType = dwCertEncodingType;
346 cert->ctx.pbCertEncoded = data;
347 cert->ctx.cbCertEncoded = cbCertEncoded;
348 cert->ctx.pCertInfo = certInfo;
349 cert->ctx.hCertStore = &empty_store;
350
351 return &cert->ctx;
352 }
353
354 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(PCCERT_CONTEXT pCertContext)
355 {
356 TRACE("(%p)\n", pCertContext);
357
358 if (!pCertContext)
359 return NULL;
360
361 Context_AddRef(&cert_from_ptr(pCertContext)->base);
362 return pCertContext;
363 }
364
365 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
366 {
367 TRACE("(%p)\n", pCertContext);
368
369 if (pCertContext)
370 Context_Release(&cert_from_ptr(pCertContext)->base);
371 return TRUE;
372 }
373
374 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
375 DWORD dwPropId)
376 {
377 cert_t *cert = cert_from_ptr(pCertContext);
378 DWORD ret;
379
380 TRACE("(%p, %d)\n", pCertContext, dwPropId);
381
382 if (cert->base.properties)
383 ret = ContextPropertyList_EnumPropIDs(cert->base.properties, dwPropId);
384 else
385 ret = 0;
386 return ret;
387 }
388
389 static BOOL CertContext_GetHashProp(cert_t *cert, DWORD dwPropId,
390 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
391 DWORD *pcbData)
392 {
393 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
394 pcbData);
395 if (ret && pvData)
396 {
397 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
398
399 ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
400 }
401 return ret;
402 }
403
404 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
405 DWORD cb)
406 {
407 BOOL ret = TRUE;
408
409 if (!pvData)
410 *pcbData = cb;
411 else if (*pcbData < cb)
412 {
413 SetLastError(ERROR_MORE_DATA);
414 *pcbData = cb;
415 ret = FALSE;
416 }
417 else
418 {
419 memcpy(pvData, pb, cb);
420 *pcbData = cb;
421 }
422 return ret;
423 }
424
425 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
426 void *pvData, DWORD *pcbData)
427 {
428 BOOL ret;
429 CRYPT_DATA_BLOB blob;
430
431 TRACE("(%p, %d, %p, %p)\n", cert, dwPropId, pvData, pcbData);
432
433 if (cert->base.properties)
434 ret = ContextPropertyList_FindProperty(cert->base.properties, dwPropId, &blob);
435 else
436 ret = FALSE;
437 if (ret)
438 ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
439 else
440 {
441 /* Implicit properties */
442 switch (dwPropId)
443 {
444 case CERT_SHA1_HASH_PROP_ID:
445 ret = CertContext_GetHashProp(cert, dwPropId, CALG_SHA1,
446 cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
447 pcbData);
448 break;
449 case CERT_MD5_HASH_PROP_ID:
450 ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
451 cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
452 pcbData);
453 break;
454 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
455 ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
456 cert->ctx.pCertInfo->Subject.pbData,
457 cert->ctx.pCertInfo->Subject.cbData,
458 pvData, pcbData);
459 break;
460 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
461 ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
462 cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
463 cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
464 pvData, pcbData);
465 break;
466 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
467 ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
468 cert->ctx.pCertInfo->SerialNumber.pbData,
469 cert->ctx.pCertInfo->SerialNumber.cbData,
470 pvData, pcbData);
471 break;
472 case CERT_SIGNATURE_HASH_PROP_ID:
473 ret = CryptHashToBeSigned(0, cert->ctx.dwCertEncodingType,
474 cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
475 pcbData);
476 if (ret && pvData)
477 {
478 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
479
480 ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
481 }
482 break;
483 case CERT_KEY_IDENTIFIER_PROP_ID:
484 {
485 PCERT_EXTENSION ext = CertFindExtension(
486 szOID_SUBJECT_KEY_IDENTIFIER, cert->ctx.pCertInfo->cExtension,
487 cert->ctx.pCertInfo->rgExtension);
488
489 if (ext)
490 {
491 CRYPT_DATA_BLOB value;
492 DWORD size = sizeof(value);
493
494 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
495 szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
496 ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
497 &size);
498 if (ret)
499 {
500 ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
501 value.cbData);
502 CertContext_SetProperty(cert, dwPropId, 0, &value);
503 }
504 }
505 else
506 SetLastError(ERROR_INVALID_DATA);
507 break;
508 }
509 default:
510 SetLastError(CRYPT_E_NOT_FOUND);
511 }
512 }
513 TRACE("returning %d\n", ret);
514 return ret;
515 }
516
517 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
518 {
519 DWORD i, containerLen, provNameLen;
520 LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
521
522 info->pwszContainerName = (LPWSTR)data;
523 containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
524 data += containerLen;
525
526 info->pwszProvName = (LPWSTR)data;
527 provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
528 data += provNameLen;
529
530 info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
531 data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
532
533 for (i = 0; i < info->cProvParam; i++)
534 {
535 info->rgProvParam[i].pbData = data;
536 data += info->rgProvParam[i].cbData;
537 }
538 }
539
540 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
541 DWORD dwPropId, void *pvData, DWORD *pcbData)
542 {
543 cert_t *cert = cert_from_ptr(pCertContext);
544 BOOL ret;
545
546 TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
547
548 switch (dwPropId)
549 {
550 case 0:
551 case CERT_CERT_PROP_ID:
552 case CERT_CRL_PROP_ID:
553 case CERT_CTL_PROP_ID:
554 SetLastError(E_INVALIDARG);
555 ret = FALSE;
556 break;
557 case CERT_ACCESS_STATE_PROP_ID:
558 ret = CertGetStoreProperty(cert->ctx.hCertStore, dwPropId, pvData, pcbData);
559 break;
560 case CERT_KEY_PROV_HANDLE_PROP_ID:
561 {
562 CERT_KEY_CONTEXT keyContext;
563 DWORD size = sizeof(keyContext);
564
565 ret = CertContext_GetProperty(cert,
566 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
567 if (ret)
568 ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
569 sizeof(keyContext.hCryptProv));
570 break;
571 }
572 case CERT_KEY_PROV_INFO_PROP_ID:
573 ret = CertContext_GetProperty(cert, dwPropId, pvData,
574 pcbData);
575 if (ret && pvData)
576 CRYPT_FixKeyProvInfoPointers(pvData);
577 break;
578 default:
579 ret = CertContext_GetProperty(cert, dwPropId, pvData,
580 pcbData);
581 }
582
583 TRACE("returning %d\n", ret);
584 return ret;
585 }
586
587 /* Copies key provider info from from into to, where to is assumed to be a
588 * contiguous buffer of memory large enough for from and all its associated
589 * data, but whose pointers are uninitialized.
590 * Upon return, to contains a contiguous copy of from, packed in the following
591 * order:
592 * - CRYPT_KEY_PROV_INFO
593 * - pwszContainerName
594 * - pwszProvName
595 * - rgProvParam[0]...
596 */
597 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
598 const CRYPT_KEY_PROV_INFO *from)
599 {
600 DWORD i;
601 LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
602
603 if (from->pwszContainerName)
604 {
605 to->pwszContainerName = (LPWSTR)nextData;
606 lstrcpyW(to->pwszContainerName, from->pwszContainerName);
607 nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
608 }
609 else
610 to->pwszContainerName = NULL;
611 if (from->pwszProvName)
612 {
613 to->pwszProvName = (LPWSTR)nextData;
614 lstrcpyW(to->pwszProvName, from->pwszProvName);
615 nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
616 }
617 else
618 to->pwszProvName = NULL;
619 to->dwProvType = from->dwProvType;
620 to->dwFlags = from->dwFlags;
621 to->cProvParam = from->cProvParam;
622 to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
623 nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
624 to->dwKeySpec = from->dwKeySpec;
625 for (i = 0; i < to->cProvParam; i++)
626 {
627 memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
628 sizeof(CRYPT_KEY_PROV_PARAM));
629 to->rgProvParam[i].pbData = nextData;
630 memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
631 from->rgProvParam[i].cbData);
632 nextData += from->rgProvParam[i].cbData;
633 }
634 }
635
636 static BOOL CertContext_SetKeyProvInfoProperty(CONTEXT_PROPERTY_LIST *properties,
637 const CRYPT_KEY_PROV_INFO *info)
638 {
639 BOOL ret;
640 LPBYTE buf = NULL;
641 DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
642
643 if (info->pwszContainerName)
644 containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
645 else
646 containerSize = 0;
647 if (info->pwszProvName)
648 provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
649 else
650 provNameSize = 0;
651 size += containerSize + provNameSize;
652 for (i = 0; i < info->cProvParam; i++)
653 size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
654 buf = CryptMemAlloc(size);
655 if (buf)
656 {
657 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
658 ret = ContextPropertyList_SetProperty(properties,
659 CERT_KEY_PROV_INFO_PROP_ID, buf, size);
660 CryptMemFree(buf);
661 }
662 else
663 ret = FALSE;
664 return ret;
665 }
666
667 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
668 DWORD dwFlags, const void *pvData)
669 {
670 BOOL ret;
671
672 TRACE("(%p, %d, %08x, %p)\n", cert, dwPropId, dwFlags, pvData);
673
674 if (!cert->base.properties)
675 ret = FALSE;
676 else
677 {
678 switch (dwPropId)
679 {
680 case CERT_AUTO_ENROLL_PROP_ID:
681 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
682 case CERT_DESCRIPTION_PROP_ID:
683 case CERT_FRIENDLY_NAME_PROP_ID:
684 case CERT_HASH_PROP_ID:
685 case CERT_KEY_IDENTIFIER_PROP_ID:
686 case CERT_MD5_HASH_PROP_ID:
687 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
688 case CERT_PUBKEY_ALG_PARA_PROP_ID:
689 case CERT_PVK_FILE_PROP_ID:
690 case CERT_SIGNATURE_HASH_PROP_ID:
691 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
692 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
693 case CERT_EXTENDED_ERROR_INFO_PROP_ID:
694 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
695 case CERT_ENROLLMENT_PROP_ID:
696 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
697 case CERT_RENEWAL_PROP_ID:
698 {
699 if (pvData)
700 {
701 const CRYPT_DATA_BLOB *blob = pvData;
702
703 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
704 blob->pbData, blob->cbData);
705 }
706 else
707 {
708 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
709 ret = TRUE;
710 }
711 break;
712 }
713 case CERT_DATE_STAMP_PROP_ID:
714 if (pvData)
715 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
716 pvData, sizeof(FILETIME));
717 else
718 {
719 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
720 ret = TRUE;
721 }
722 break;
723 case CERT_KEY_CONTEXT_PROP_ID:
724 {
725 if (pvData)
726 {
727 const CERT_KEY_CONTEXT *keyContext = pvData;
728
729 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
730 {
731 SetLastError(E_INVALIDARG);
732 ret = FALSE;
733 }
734 else
735 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
736 (const BYTE *)keyContext, keyContext->cbSize);
737 }
738 else
739 {
740 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
741 ret = TRUE;
742 }
743 break;
744 }
745 case CERT_KEY_PROV_INFO_PROP_ID:
746 if (pvData)
747 ret = CertContext_SetKeyProvInfoProperty(cert->base.properties, pvData);
748 else
749 {
750 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
751 ret = TRUE;
752 }
753 break;
754 case CERT_KEY_PROV_HANDLE_PROP_ID:
755 {
756 CERT_KEY_CONTEXT keyContext;
757 DWORD size = sizeof(keyContext);
758
759 ret = CertContext_GetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
760 &keyContext, &size);
761 if (ret)
762 {
763 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
764 CryptReleaseContext(keyContext.hCryptProv, 0);
765 }
766 keyContext.cbSize = sizeof(keyContext);
767 if (pvData)
768 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
769 else
770 {
771 keyContext.hCryptProv = 0;
772 keyContext.dwKeySpec = AT_SIGNATURE;
773 }
774 ret = CertContext_SetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
775 0, &keyContext);
776 break;
777 }
778 default:
779 FIXME("%d: stub\n", dwPropId);
780 ret = FALSE;
781 }
782 }
783 TRACE("returning %d\n", ret);
784 return ret;
785 }
786
787 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
788 DWORD dwPropId, DWORD dwFlags, const void *pvData)
789 {
790 BOOL ret;
791
792 TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
793
794 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
795 * crashes on most of these, I'll be safer.
796 */
797 switch (dwPropId)
798 {
799 case 0:
800 case CERT_ACCESS_STATE_PROP_ID:
801 case CERT_CERT_PROP_ID:
802 case CERT_CRL_PROP_ID:
803 case CERT_CTL_PROP_ID:
804 SetLastError(E_INVALIDARG);
805 return FALSE;
806 }
807 ret = CertContext_SetProperty(cert_from_ptr(pCertContext), dwPropId, dwFlags,
808 pvData);
809 TRACE("returning %d\n", ret);
810 return ret;
811 }
812
813 /* Acquires the private key using the key provider info, retrieving info from
814 * the certificate if info is NULL. The acquired provider is returned in
815 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
816 */
817 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
818 PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
819 {
820 DWORD size = 0;
821 BOOL allocated = FALSE, ret = TRUE;
822
823 if (!info)
824 {
825 ret = CertGetCertificateContextProperty(pCert,
826 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
827 if (ret)
828 {
829 info = HeapAlloc(GetProcessHeap(), 0, size);
830 if (info)
831 {
832 ret = CertGetCertificateContextProperty(pCert,
833 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
834 allocated = TRUE;
835 }
836 else
837 {
838 SetLastError(ERROR_OUTOFMEMORY);
839 ret = FALSE;
840 }
841 }
842 else
843 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
844 }
845 if (ret)
846 {
847 ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
848 info->pwszProvName, info->dwProvType, 0);
849 if (ret)
850 {
851 DWORD i;
852
853 for (i = 0; i < info->cProvParam; i++)
854 {
855 CryptSetProvParam(*phCryptProv,
856 info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
857 info->rgProvParam[i].dwFlags);
858 }
859 *pdwKeySpec = info->dwKeySpec;
860 }
861 else
862 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
863 }
864 if (allocated)
865 HeapFree(GetProcessHeap(), 0, info);
866 return ret;
867 }
868
869 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
870 DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
871 DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
872 {
873 BOOL ret = FALSE, cache = FALSE;
874 PCRYPT_KEY_PROV_INFO info = NULL;
875 CERT_KEY_CONTEXT keyContext;
876 DWORD size;
877
878 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
879 phCryptProv, pdwKeySpec, pfCallerFreeProv);
880
881 if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
882 {
883 DWORD size = 0;
884
885 ret = CertGetCertificateContextProperty(pCert,
886 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
887 if (ret)
888 {
889 info = HeapAlloc(GetProcessHeap(), 0, size);
890 ret = CertGetCertificateContextProperty(pCert,
891 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
892 if (ret)
893 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
894 }
895 }
896 else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
897 cache = TRUE;
898 *phCryptProv = 0;
899 if (cache)
900 {
901 size = sizeof(keyContext);
902 ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
903 &keyContext, &size);
904 if (ret)
905 {
906 *phCryptProv = keyContext.hCryptProv;
907 if (pdwKeySpec)
908 *pdwKeySpec = keyContext.dwKeySpec;
909 if (pfCallerFreeProv)
910 *pfCallerFreeProv = !cache;
911 }
912 }
913 if (!*phCryptProv)
914 {
915 ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
916 &keyContext.hCryptProv, &keyContext.dwKeySpec);
917 if (ret)
918 {
919 *phCryptProv = keyContext.hCryptProv;
920 if (pdwKeySpec)
921 *pdwKeySpec = keyContext.dwKeySpec;
922 if (cache)
923 {
924 keyContext.cbSize = sizeof(keyContext);
925 if (CertSetCertificateContextProperty(pCert,
926 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
927 {
928 if (pfCallerFreeProv)
929 *pfCallerFreeProv = FALSE;
930 }
931 }
932 else
933 {
934 if (pfCallerFreeProv)
935 *pfCallerFreeProv = TRUE;
936 }
937 }
938 }
939 HeapFree(GetProcessHeap(), 0, info);
940 return ret;
941 }
942
943 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
944 const CRYPT_KEY_PROV_INFO *keyProvInfo)
945 {
946 HCRYPTPROV csp;
947 BOOL matches = FALSE;
948
949 if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
950 keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
951 {
952 DWORD size;
953
954 /* Need to sign something to verify the sig. What to sign? Why not
955 * the certificate itself?
956 */
957 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
958 pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
959 &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
960 {
961 BYTE *certEncoded = CryptMemAlloc(size);
962
963 if (certEncoded)
964 {
965 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
966 pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
967 pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
968 NULL, certEncoded, &size))
969 {
970 if (size == pCert->cbCertEncoded &&
971 !memcmp(certEncoded, pCert->pbCertEncoded, size))
972 matches = TRUE;
973 }
974 CryptMemFree(certEncoded);
975 }
976 }
977 CryptReleaseContext(csp, 0);
978 }
979 return matches;
980 }
981
982 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
983 CRYPT_KEY_PROV_INFO *keyProvInfo)
984 {
985 CRYPT_KEY_PROV_INFO copy;
986 WCHAR containerW[MAX_PATH];
987 BOOL matches;
988
989 MultiByteToWideChar(CP_ACP, 0, container, -1,
990 containerW, sizeof(containerW) / sizeof(containerW[0]));
991 /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
992 * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
993 * name.
994 */
995 copy = *keyProvInfo;
996 copy.pwszContainerName = containerW;
997 matches = key_prov_info_matches_cert(pCert, &copy);
998 if (matches)
999 {
1000 keyProvInfo->pwszContainerName =
1001 CryptMemAlloc((strlenW(containerW) + 1) * sizeof(WCHAR));
1002 if (keyProvInfo->pwszContainerName)
1003 {
1004 strcpyW(keyProvInfo->pwszContainerName, containerW);
1005 keyProvInfo->dwKeySpec = AT_SIGNATURE;
1006 }
1007 else
1008 matches = FALSE;
1009 }
1010 return matches;
1011 }
1012
1013 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
1014 * private key matches pCert's public key. Upon success, updates keyProvInfo
1015 * with the matching container's info (free keyProvInfo.pwszContainerName upon
1016 * success.)
1017 * Returns TRUE if found, FALSE if not.
1018 */
1019 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
1020 CRYPT_KEY_PROV_INFO *keyProvInfo)
1021 {
1022 HCRYPTPROV defProvider;
1023 BOOL ret, found = FALSE;
1024 char containerA[MAX_PATH];
1025
1026 assert(keyProvInfo->pwszContainerName == NULL);
1027 if ((ret = CryptAcquireContextW(&defProvider, NULL,
1028 keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
1029 keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
1030 {
1031 DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
1032
1033 while (ret && !found)
1034 {
1035 DWORD size = sizeof(containerA);
1036
1037 ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
1038 (BYTE *)containerA, &size, enumFlags);
1039 if (ret)
1040 found = container_matches_cert(pCert, containerA, keyProvInfo);
1041 if (enumFlags & CRYPT_FIRST)
1042 {
1043 enumFlags &= ~CRYPT_FIRST;
1044 enumFlags |= CRYPT_NEXT;
1045 }
1046 }
1047 CryptReleaseContext(defProvider, 0);
1048 }
1049 return found;
1050 }
1051
1052 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
1053 {
1054 BOOL found = FALSE, ret = TRUE;
1055 DWORD index = 0, cbProvName = 0;
1056 CRYPT_KEY_PROV_INFO keyProvInfo;
1057
1058 TRACE("(%p, %08x)\n", pCert, dwFlags);
1059
1060 memset(&keyProvInfo, 0, sizeof(keyProvInfo));
1061 while (ret && !found)
1062 {
1063 DWORD size = 0;
1064
1065 ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
1066 NULL, &size);
1067 if (ret)
1068 {
1069 if (size <= cbProvName)
1070 ret = CryptEnumProvidersW(index, NULL, 0,
1071 &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1072 else
1073 {
1074 CryptMemFree(keyProvInfo.pwszProvName);
1075 keyProvInfo.pwszProvName = CryptMemAlloc(size);
1076 if (keyProvInfo.pwszProvName)
1077 {
1078 cbProvName = size;
1079 ret = CryptEnumProvidersW(index, NULL, 0,
1080 &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1081 if (ret)
1082 {
1083 if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
1084 keyProvInfo.dwFlags |= CRYPT_SILENT;
1085 if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
1086 !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1087 CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1088 {
1089 keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
1090 found = find_key_prov_info_in_provider(pCert,
1091 &keyProvInfo);
1092 }
1093 if (!found)
1094 {
1095 if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
1096 !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1097 CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1098 {
1099 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
1100 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
1101 found = find_key_prov_info_in_provider(pCert,
1102 &keyProvInfo);
1103 }
1104 }
1105 }
1106 }
1107 else
1108 ret = FALSE;
1109 }
1110 index++;
1111 }
1112 }
1113 if (found)
1114 CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1115 0, &keyProvInfo);
1116 CryptMemFree(keyProvInfo.pwszProvName);
1117 CryptMemFree(keyProvInfo.pwszContainerName);
1118 return found;
1119 }
1120
1121 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
1122 {
1123 BOOL matches = FALSE;
1124 DWORD size;
1125
1126 if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1127 NULL, &size))
1128 {
1129 CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
1130
1131 if (keyProvInfo)
1132 {
1133 if (CertGetCertificateContextProperty(pCert,
1134 CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
1135 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
1136 CryptMemFree(keyProvInfo);
1137 }
1138 }
1139 return matches;
1140 }
1141
1142 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
1143 DWORD dwFlags, void *pvReserved)
1144 {
1145 BOOL matches;
1146
1147 TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
1148
1149 matches = cert_prov_info_matches_cert(pCert);
1150 if (!matches)
1151 matches = find_matching_provider(pCert, dwFlags);
1152 return matches;
1153 }
1154
1155 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1156 PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1157 {
1158 BOOL ret;
1159
1160 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1161
1162 ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1163 &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1164 &pCertId2->SerialNumber);
1165 TRACE("returning %d\n", ret);
1166 return ret;
1167 }
1168
1169 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1170 PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1171 {
1172 BOOL ret;
1173
1174 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1175
1176 if (pCertName1->cbData == pCertName2->cbData)
1177 {
1178 if (pCertName1->cbData)
1179 ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1180 pCertName1->cbData);
1181 else
1182 ret = TRUE;
1183 }
1184 else
1185 ret = FALSE;
1186 TRACE("returning %d\n", ret);
1187 return ret;
1188 }
1189
1190 /* Returns the number of significant bytes in pInt, where a byte is
1191 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1192 * for negative numbers. pInt is assumed to be little-endian.
1193 */
1194 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1195 {
1196 DWORD ret = pInt->cbData;
1197
1198 while (ret > 1)
1199 {
1200 if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1201 ret--;
1202 else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1203 ret--;
1204 else
1205 break;
1206 }
1207 return ret;
1208 }
1209
1210 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1211 PCRYPT_INTEGER_BLOB pInt2)
1212 {
1213 BOOL ret;
1214 DWORD cb1, cb2;
1215
1216 TRACE("(%p, %p)\n", pInt1, pInt2);
1217
1218 cb1 = CRYPT_significantBytes(pInt1);
1219 cb2 = CRYPT_significantBytes(pInt2);
1220 if (cb1 == cb2)
1221 {
1222 if (cb1)
1223 ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1224 else
1225 ret = TRUE;
1226 }
1227 else
1228 ret = FALSE;
1229 TRACE("returning %d\n", ret);
1230 return ret;
1231 }
1232
1233 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1234 PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1235 {
1236 BOOL ret;
1237
1238 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1239
1240 switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1241 {
1242 case 0: /* Seems to mean "raw binary bits" */
1243 if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1244 pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1245 {
1246 if (pPublicKey2->PublicKey.cbData)
1247 ret = !memcmp(pPublicKey1->PublicKey.pbData,
1248 pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1249 else
1250 ret = TRUE;
1251 }
1252 else
1253 ret = FALSE;
1254 break;
1255 default:
1256 WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1257 /* FALLTHROUGH */
1258 case X509_ASN_ENCODING:
1259 {
1260 BLOBHEADER *pblob1, *pblob2;
1261 DWORD length;
1262 ret = FALSE;
1263 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1264 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1265 0, NULL, &length))
1266 {
1267 pblob1 = CryptMemAlloc(length);
1268 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1269 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1270 0, pblob1, &length))
1271 {
1272 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1273 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1274 0, NULL, &length))
1275 {
1276 pblob2 = CryptMemAlloc(length);
1277 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1278 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1279 0, pblob2, &length))
1280 {
1281 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1282 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1283 *pk2 = (LPVOID)(pblob2 + 1);
1284 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1285 && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1286 }
1287 CryptMemFree(pblob2);
1288 }
1289 }
1290 CryptMemFree(pblob1);
1291 }
1292
1293 break;
1294 }
1295 }
1296 return ret;
1297 }
1298
1299 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1300 PCERT_PUBLIC_KEY_INFO pPublicKey)
1301 {
1302 DWORD len = 0;
1303
1304 TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1305
1306 if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1307 {
1308 SetLastError(ERROR_FILE_NOT_FOUND);
1309 return 0;
1310 }
1311 if (pPublicKey->Algorithm.pszObjId &&
1312 !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1313 {
1314 FIXME("unimplemented for DH public keys\n");
1315 SetLastError(CRYPT_E_ASN1_BADTAG);
1316 }
1317 else
1318 {
1319 DWORD size;
1320 PBYTE buf;
1321 BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
1322 RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1323 pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1324 &size);
1325
1326 if (ret)
1327 {
1328 RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1329
1330 len = rsaPubKey->bitlen;
1331 LocalFree(buf);
1332 }
1333 }
1334 return len;
1335 }
1336
1337 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1338 DWORD dwFlags, const void *pvPara);
1339
1340 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1341 DWORD dwFlags, const void *pvPara)
1342 {
1343 BOOL ret;
1344 BYTE hash[16];
1345 DWORD size = sizeof(hash);
1346
1347 ret = CertGetCertificateContextProperty(pCertContext,
1348 CERT_MD5_HASH_PROP_ID, hash, &size);
1349 if (ret)
1350 {
1351 const CRYPT_HASH_BLOB *pHash = pvPara;
1352
1353 if (size == pHash->cbData)
1354 ret = !memcmp(pHash->pbData, hash, size);
1355 else
1356 ret = FALSE;
1357 }
1358 return ret;
1359 }
1360
1361 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1362 DWORD dwFlags, const void *pvPara)
1363 {
1364 BOOL ret;
1365 BYTE hash[20];
1366 DWORD size = sizeof(hash);
1367
1368 ret = CertGetCertificateContextProperty(pCertContext,
1369 CERT_SHA1_HASH_PROP_ID, hash, &size);
1370 if (ret)
1371 {
1372 const CRYPT_HASH_BLOB *pHash = pvPara;
1373
1374 if (size == pHash->cbData)
1375 ret = !memcmp(pHash->pbData, hash, size);
1376 else
1377 ret = FALSE;
1378 }
1379 return ret;
1380 }
1381
1382 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1383 DWORD dwFlags, const void *pvPara)
1384 {
1385 CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1386 BOOL ret;
1387
1388 if (dwType & CERT_INFO_SUBJECT_FLAG)
1389 toCompare = &pCertContext->pCertInfo->Subject;
1390 else
1391 toCompare = &pCertContext->pCertInfo->Issuer;
1392 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1393 toCompare, blob);
1394 return ret;
1395 }
1396
1397 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1398 DWORD dwType, DWORD dwFlags, const void *pvPara)
1399 {
1400 CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1401 BOOL ret;
1402
1403 ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1404 &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1405 return ret;
1406 }
1407
1408 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1409 DWORD dwType, DWORD dwFlags, const void *pvPara)
1410 {
1411 CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1412 BOOL ret;
1413
1414 /* Matching serial number and subject match.. */
1415 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1416 &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1417 if (ret)
1418 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1419 &pCertInfo->SerialNumber);
1420 else
1421 {
1422 /* failing that, if the serial number and issuer match, we match */
1423 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1424 &pCertInfo->SerialNumber);
1425 if (ret)
1426 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1427 &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1428 }
1429 TRACE("returning %d\n", ret);
1430 return ret;
1431 }
1432
1433 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1434 DWORD dwFlags, const void *pvPara)
1435 {
1436 CERT_ID *id = (CERT_ID *)pvPara;
1437 BOOL ret;
1438
1439 switch (id->dwIdChoice)
1440 {
1441 case CERT_ID_ISSUER_SERIAL_NUMBER:
1442 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1443 &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1444 if (ret)
1445 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1446 &id->u.IssuerSerialNumber.SerialNumber);
1447 break;
1448 case CERT_ID_SHA1_HASH:
1449 ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1450 &id->u.HashId);
1451 break;
1452 case CERT_ID_KEY_IDENTIFIER:
1453 {
1454 DWORD size = 0;
1455
1456 ret = CertGetCertificateContextProperty(pCertContext,
1457 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1458 if (ret && size == id->u.KeyId.cbData)
1459 {
1460 LPBYTE buf = CryptMemAlloc(size);
1461
1462 if (buf)
1463 {
1464 CertGetCertificateContextProperty(pCertContext,
1465 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1466 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1467 CryptMemFree(buf);
1468 }
1469 else
1470 ret = FALSE;
1471 }
1472 else
1473 ret = FALSE;
1474 break;
1475 }
1476 default:
1477 ret = FALSE;
1478 break;
1479 }
1480 return ret;
1481 }
1482
1483 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1484 DWORD dwFlags, const void *pvPara)
1485 {
1486 PCCERT_CONTEXT toCompare = pvPara;
1487 return CertCompareCertificate(pCertContext->dwCertEncodingType,
1488 pCertContext->pCertInfo, toCompare->pCertInfo);
1489 }
1490
1491 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1492 DWORD dwFlags, const void *pvPara)
1493 {
1494 const CRYPT_HASH_BLOB *hash = pvPara;
1495 DWORD size = 0;
1496 BOOL ret;
1497
1498 ret = CertGetCertificateContextProperty(pCertContext,
1499 CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1500 if (ret && size == hash->cbData)
1501 {
1502 LPBYTE buf = CryptMemAlloc(size);
1503
1504 if (buf)
1505 {
1506 CertGetCertificateContextProperty(pCertContext,
1507 CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1508 ret = !memcmp(buf, hash->pbData, size);
1509 CryptMemFree(buf);
1510 }
1511 else
1512 ret = FALSE;
1513 }
1514 else
1515 ret = FALSE;
1516 return ret;
1517 }
1518
1519 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1520 PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1521 const void *pvPara)
1522 {
1523 BOOL matches = FALSE;
1524 PCCERT_CONTEXT ret;
1525
1526 ret = prev;
1527 do {
1528 ret = CertEnumCertificatesInStore(store, ret);
1529 if (ret)
1530 matches = compare(ret, dwType, dwFlags, pvPara);
1531 } while (ret != NULL && !matches);
1532 return ret;
1533 }
1534
1535 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1536 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1537
1538 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1539 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1540 {
1541 return CertEnumCertificatesInStore(store, prev);
1542 }
1543
1544 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1545 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1546 {
1547 BOOL ret;
1548 PCCERT_CONTEXT found = NULL, subject = pvPara;
1549 PCERT_EXTENSION ext;
1550 DWORD size;
1551
1552 if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1553 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1554 {
1555 CERT_AUTHORITY_KEY_ID_INFO *info;
1556
1557 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1558 X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1559 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1560 &info, &size);
1561 if (ret)
1562 {
1563 CERT_ID id;
1564
1565 if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1566 {
1567 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1568 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1569 sizeof(CERT_NAME_BLOB));
1570 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1571 &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1572 }
1573 else if (info->KeyId.cbData)
1574 {
1575 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1576 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1577 }
1578 else
1579 ret = FALSE;
1580 if (ret)
1581 found = cert_compare_certs_in_store(store, prev,
1582 compare_cert_by_cert_id, dwType, dwFlags, &id);
1583 LocalFree(info);
1584 }
1585 }
1586 else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1587 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1588 {
1589 CERT_AUTHORITY_KEY_ID2_INFO *info;
1590
1591 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1592 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1593 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1594 &info, &size);
1595 if (ret)
1596 {
1597 CERT_ID id;
1598
1599 if (info->AuthorityCertIssuer.cAltEntry &&
1600 info->AuthorityCertSerialNumber.cbData)
1601 {
1602 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1603 DWORD i;
1604
1605 for (i = 0; !directoryName &&
1606 i < info->AuthorityCertIssuer.cAltEntry; i++)
1607 if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1608 == CERT_ALT_NAME_DIRECTORY_NAME)
1609 directoryName =
1610 &info->AuthorityCertIssuer.rgAltEntry[i];
1611 if (directoryName)
1612 {
1613 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1614 memcpy(&id.u.IssuerSerialNumber.Issuer,
1615 &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1616 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1617 &info->AuthorityCertSerialNumber,
1618 sizeof(CRYPT_INTEGER_BLOB));
1619 }
1620 else
1621 {
1622 FIXME("no supported name type in authority key id2\n");
1623 ret = FALSE;
1624 }
1625 }
1626 else if (info->KeyId.cbData)
1627 {
1628 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1629 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1630 }
1631 else
1632 ret = FALSE;
1633 if (ret)
1634 found = cert_compare_certs_in_store(store, prev,
1635 compare_cert_by_cert_id, dwType, dwFlags, &id);
1636 LocalFree(info);
1637 }
1638 }
1639 else
1640 found = cert_compare_certs_in_store(store, prev,
1641 compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1642 dwFlags, &subject->pCertInfo->Issuer);
1643 return found;
1644 }
1645
1646 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1647 DWORD dwType, DWORD dwFlags, const void *pvPara)
1648 {
1649 PCERT_NAME_BLOB name;
1650 DWORD len;
1651 BOOL ret = FALSE;
1652
1653 if (dwType & CERT_INFO_SUBJECT_FLAG)
1654 name = &pCertContext->pCertInfo->Subject;
1655 else
1656 name = &pCertContext->pCertInfo->Issuer;
1657 len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1658 CERT_SIMPLE_NAME_STR, NULL, 0);
1659 if (len)
1660 {
1661 LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1662
1663 if (str)
1664 {
1665 LPWSTR ptr;
1666
1667 CertNameToStrW(pCertContext->dwCertEncodingType, name,
1668 CERT_SIMPLE_NAME_STR, str, len);
1669 for (ptr = str; *ptr; ptr++)
1670 *ptr = tolowerW(*ptr);
1671 if (strstrW(str, pvPara))
1672 ret = TRUE;
1673 CryptMemFree(str);
1674 }
1675 }
1676 return ret;
1677 }
1678
1679 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1680 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1681 {
1682 PCCERT_CONTEXT found = NULL;
1683
1684 TRACE("%s\n", debugstr_a(pvPara));
1685
1686 if (pvPara)
1687 {
1688 int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1689 LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1690
1691 if (str)
1692 {
1693 LPWSTR ptr;
1694
1695 MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1696 for (ptr = str; *ptr; ptr++)
1697 *ptr = tolowerW(*ptr);
1698 found = cert_compare_certs_in_store(store, prev,
1699 compare_cert_by_name_str, dwType, dwFlags, str);
1700 CryptMemFree(str);
1701 }
1702 }
1703 else
1704 found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1705 return found;
1706 }
1707
1708 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1709 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1710 {
1711 PCCERT_CONTEXT found = NULL;
1712
1713 TRACE("%s\n", debugstr_w(pvPara));
1714
1715 if (pvPara)
1716 {
1717 DWORD len = strlenW(pvPara);
1718 LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1719
1720 if (str)
1721 {
1722 LPCWSTR src;
1723 LPWSTR dst;
1724
1725 for (src = pvPara, dst = str; *src; src++, dst++)
1726 *dst = tolowerW(*src);
1727 *dst = 0;
1728 found = cert_compare_certs_in_store(store, prev,
1729 compare_cert_by_name_str, dwType, dwFlags, str);
1730 CryptMemFree(str);
1731 }
1732 }
1733 else
1734 found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1735 return found;
1736 }
1737
1738 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1739 DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1740 PCCERT_CONTEXT pPrevCertContext)
1741 {
1742 PCCERT_CONTEXT ret;
1743 CertFindFunc find = NULL;
1744 CertCompareFunc compare = NULL;
1745
1746 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1747 dwFlags, dwType, pvPara, pPrevCertContext);
1748
1749 switch (dwType >> CERT_COMPARE_SHIFT)
1750 {
1751 case CERT_COMPARE_ANY:
1752 find = find_cert_any;
1753 break;
1754 case CERT_COMPARE_MD5_HASH:
1755 compare = compare_cert_by_md5_hash;
1756 break;
1757 case CERT_COMPARE_SHA1_HASH:
1758 compare = compare_cert_by_sha1_hash;
1759 break;
1760 case CERT_COMPARE_NAME:
1761 compare = compare_cert_by_name;
1762 break;
1763 case CERT_COMPARE_PUBLIC_KEY:
1764 compare = compare_cert_by_public_key;
1765 break;
1766 case CERT_COMPARE_NAME_STR_A:
1767 find = find_cert_by_name_str_a;
1768 break;
1769 case CERT_COMPARE_NAME_STR_W:
1770 find = find_cert_by_name_str_w;
1771 break;
1772 case CERT_COMPARE_SUBJECT_CERT:
1773 compare = compare_cert_by_subject_cert;
1774 break;
1775 case CERT_COMPARE_CERT_ID:
1776 compare = compare_cert_by_cert_id;
1777 break;
1778 case CERT_COMPARE_ISSUER_OF:
1779 find = find_cert_by_issuer;
1780 break;
1781 case CERT_COMPARE_EXISTING:
1782 compare = compare_existing_cert;
1783 break;
1784 case CERT_COMPARE_SIGNATURE_HASH:
1785 compare = compare_cert_by_signature_hash;
1786 break;
1787 default:
1788 FIXME("find type %08x unimplemented\n", dwType);
1789 }
1790
1791 if (find)
1792 ret = find(hCertStore, dwFlags, dwType, pvPara, pPrevCertContext);
1793 else if (compare)
1794 ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1795 compare, dwType, dwFlags, pvPara);
1796 else
1797 ret = NULL;
1798 if (!ret)
1799 SetLastError(CRYPT_E_NOT_FOUND);
1800 TRACE("returning %p\n", ret);
1801 return ret;
1802 }
1803
1804 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1805 DWORD dwCertEncodingType, PCERT_INFO pCertId)
1806 {
1807 TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1808
1809 if (!pCertId)
1810 {
1811 SetLastError(E_INVALIDARG);
1812 return NULL;
1813 }
1814 return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1815 CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1816 }
1817
1818 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1819 PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1820 {
1821 static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1822 CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1823
1824 if (*pdwFlags & ~supportedFlags)
1825 {
1826 SetLastError(E_INVALIDARG);
1827 return FALSE;
1828 }
1829 if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1830 {
1831 DWORD flags = 0;
1832 PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1833 NULL, &flags);
1834
1835 /* FIXME: what if the CRL has expired? */
1836 if (crl)
1837 {
1838 if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1839 pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1840 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1841 }
1842 else
1843 *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1844 }
1845 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1846 {
1847 if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1848 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1849 }
1850 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1851 {
1852 if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1853 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1854 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1855 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1856 }
1857 return TRUE;
1858 }
1859
1860 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1861 PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1862 DWORD *pdwFlags)
1863 {
1864 PCCERT_CONTEXT ret;
1865
1866 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1867 pPrevIssuerContext, *pdwFlags);
1868
1869 if (!pSubjectContext)
1870 {
1871 SetLastError(E_INVALIDARG);
1872 return NULL;
1873 }
1874
1875 ret = CertFindCertificateInStore(hCertStore,
1876 pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1877 pSubjectContext, pPrevIssuerContext);
1878 if (ret)
1879 {
1880 if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1881 pdwFlags))
1882 {
1883 CertFreeCertificateContext(ret);
1884 ret = NULL;
1885 }
1886 if (CRYPT_IsCertificateSelfSigned(pSubjectContext))
1887 {
1888 CertFreeCertificateContext(ret);
1889 ret = NULL;
1890 SetLastError(CRYPT_E_SELF_SIGNED);
1891 }
1892 }
1893 TRACE("returning %p\n", ret);
1894 return ret;
1895 }
1896
1897 typedef struct _OLD_CERT_REVOCATION_STATUS {
1898 DWORD cbSize;
1899 DWORD dwIndex;
1900 DWORD dwError;
1901 DWORD dwReason;
1902 } OLD_CERT_REVOCATION_STATUS;
1903
1904 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1905 void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1906
1907 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1908 DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1909 PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1910 {
1911 BOOL ret;
1912
1913 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1914 cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1915
1916 if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1917 pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1918 {
1919 SetLastError(E_INVALIDARG);
1920 return FALSE;
1921 }
1922 if (cContext)
1923 {
1924 static HCRYPTOIDFUNCSET set = NULL;
1925 DWORD size;
1926
1927 if (!set)
1928 set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1929 ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1930 if (ret)
1931 {
1932 if (size == 1)
1933 {
1934 /* empty list */
1935 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1936 ret = FALSE;
1937 }
1938 else
1939 {
1940 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1941
1942 if (dllList)
1943 {
1944 ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1945 dllList, &size);
1946 if (ret)
1947 {
1948 for (ptr = dllList; ret && *ptr;
1949 ptr += lstrlenW(ptr) + 1)
1950 {
1951 CertVerifyRevocationFunc func;
1952 HCRYPTOIDFUNCADDR hFunc;
1953
1954 ret = CryptGetDefaultOIDFunctionAddress(set,
1955 dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1956 if (ret)
1957 {
1958 ret = func(dwEncodingType, dwRevType, cContext,
1959 rgpvContext, dwFlags, pRevPara, pRevStatus);
1960 CryptFreeOIDFunctionAddress(hFunc, 0);
1961 }
1962 }
1963 }
1964 CryptMemFree(dllList);
1965 }
1966 else
1967 {
1968 SetLastError(ERROR_OUTOFMEMORY);
1969 ret = FALSE;
1970 }
1971 }
1972 }
1973 }
1974 else
1975 ret = TRUE;
1976 return ret;
1977 }
1978
1979 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1980 CRYPT_ATTRIBUTE rgAttr[])
1981 {
1982 PCRYPT_ATTRIBUTE ret = NULL;
1983 DWORD i;
1984
1985 TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1986
1987 if (!cAttr)
1988 return NULL;
1989 if (!pszObjId)
1990 {
1991 SetLastError(ERROR_INVALID_PARAMETER);
1992 return NULL;
1993 }
1994
1995 for (i = 0; !ret && i < cAttr; i++)
1996 if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1997 ret = &rgAttr[i];
1998 return ret;
1999 }
2000
2001 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
2002 CERT_EXTENSION rgExtensions[])
2003 {
2004 PCERT_EXTENSION ret = NULL;
2005 DWORD i;
2006
2007 TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
2008
2009 if (!cExtensions)
2010 return NULL;
2011 if (!pszObjId)
2012 {
2013 SetLastError(ERROR_INVALID_PARAMETER);
2014 return NULL;
2015 }
2016
2017 for (i = 0; !ret && i < cExtensions; i++)
2018 if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
2019 rgExtensions[i].pszObjId))
2020 ret = &rgExtensions[i];
2021 return ret;
2022 }
2023
2024 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
2025 {
2026 PCERT_RDN_ATTR ret = NULL;
2027 DWORD i, j;
2028
2029 TRACE("%s %p\n", debugstr_a(pszObjId), pName);
2030
2031 if (!pszObjId)
2032 {
2033 SetLastError(ERROR_INVALID_PARAMETER);
2034 return NULL;
2035 }
2036
2037 for (i = 0; !ret && i < pName->cRDN; i++)
2038 for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
2039 if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
2040 pName->rgRDN[i].rgRDNAttr[j].pszObjId))
2041 ret = &pName->rgRDN[i].rgRDNAttr[j];
2042 return ret;
2043 }
2044
2045 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
2046 const CERT_RDN_ATTR *attr)
2047 {
2048 DWORD i, j;
2049 BOOL match = FALSE;
2050
2051 for (i = 0; !match && i < name->cRDN; i++)
2052 {
2053 for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
2054 {
2055 if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
2056 attr->pszObjId) &&
2057 name->rgRDN[i].rgRDNAttr[j].dwValueType ==
2058 attr->dwValueType)
2059 {
2060 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
2061 {
2062 LPCWSTR nameStr =
2063 (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2064 LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
2065
2066 if (attr->Value.cbData !=
2067 name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2068 match = FALSE;
2069 else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2070 match = !strncmpiW(nameStr, attrStr,
2071 attr->Value.cbData / sizeof(WCHAR));
2072 else
2073 match = !strncmpW(nameStr, attrStr,
2074 attr->Value.cbData / sizeof(WCHAR));
2075 TRACE("%s : %s => %d\n",
2076 debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
2077 debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
2078 match);
2079 }
2080 else
2081 {
2082 LPCSTR nameStr =
2083 (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2084 LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
2085
2086 if (attr->Value.cbData !=
2087 name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2088 match = FALSE;
2089 else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2090 match = !strncasecmp(nameStr, attrStr,
2091 attr->Value.cbData);
2092 else
2093 match = !strncmp(nameStr, attrStr, attr->Value.cbData);
2094 TRACE("%s : %s => %d\n",
2095 debugstr_an(nameStr, attr->Value.cbData),
2096 debugstr_an(attrStr, attr->Value.cbData), match);
2097 }
2098 }
2099 }
2100 }
2101 return match;
2102 }
2103
2104 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
2105 DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
2106 {
2107 CERT_NAME_INFO *name;
2108 LPCSTR type;
2109 DWORD size;
2110 BOOL ret;
2111
2112 TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
2113 pRDN);
2114
2115 type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
2116 X509_NAME;
2117 if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
2118 pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
2119 {
2120 DWORD i;
2121
2122 for (i = 0; ret && i < pRDN->cRDNAttr; i++)
2123 ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
2124 if (!ret)
2125 SetLastError(CRYPT_E_NO_MATCH);
2126 LocalFree(name);
2127 }
2128 return ret;
2129 }
2130
2131 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
2132 PCERT_INFO pCertInfo)
2133 {
2134 FILETIME fileTime;
2135 LONG ret;
2136
2137 if (!pTimeToVerify)
2138 {
2139 GetSystemTimeAsFileTime(&fileTime);
2140 pTimeToVerify = &fileTime;
2141 }
2142 if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
2143 {
2144 ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
2145 if (ret < 0)
2146 ret = 0;
2147 }
2148 return ret;
2149 }
2150
2151 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
2152 PCERT_INFO pIssuerInfo)
2153 {
2154 TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
2155
2156 return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
2157 && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
2158 }
2159
2160 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2161 DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2162 DWORD *pcbComputedHash)
2163 {
2164 BOOL ret = TRUE;
2165 HCRYPTHASH hHash = 0;
2166
2167 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
2168 pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2169
2170 if (!hCryptProv)
2171 hCryptProv = CRYPT_GetDefaultProvider();
2172 if (!Algid)
2173 Algid = CALG_SHA1;
2174 if (ret)
2175 {
2176 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2177 if (ret)
2178 {
2179 ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2180 if (ret)
2181 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2182 pcbComputedHash, 0);
2183 CryptDestroyHash(hHash);
2184 }
2185 }
2186 return ret;
2187 }
2188
2189 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2190 DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2191 BYTE *pbComputedHash, DWORD *pcbComputedHash)
2192 {
2193 BOOL ret = TRUE;
2194 HCRYPTHASH hHash = 0;
2195
2196 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2197 dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2198
2199 if (!hCryptProv)
2200 hCryptProv = CRYPT_GetDefaultProvider();
2201 if (!Algid)
2202 Algid = CALG_MD5;
2203 if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2204 {
2205 SetLastError(ERROR_FILE_NOT_FOUND);
2206 return FALSE;
2207 }
2208 if (ret)
2209 {
2210 BYTE *buf;
2211 DWORD size = 0;
2212
2213 ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2214 X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2215 (LPBYTE)&buf, &size);
2216 if (ret)
2217 {
2218 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2219 if (ret)
2220 {
2221 ret = CryptHashData(hHash, buf, size, 0);
2222 if (ret)
2223 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2224 pcbComputedHash, 0);
2225 CryptDestroyHash(hHash);
2226 }
2227 LocalFree(buf);
2228 }
2229 }
2230 return ret;
2231 }
2232
2233 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2234 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2235 BYTE *pbComputedHash, DWORD *pcbComputedHash)
2236 {
2237 BOOL ret;
2238 CERT_SIGNED_CONTENT_INFO *info;
2239 DWORD size;
2240
2241 TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2242 pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2243
2244 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2245 pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2246 if (ret)
2247 {
2248 PCCRYPT_OID_INFO oidInfo;
2249 HCRYPTHASH hHash;
2250
2251 if (!hCryptProv)
2252 hCryptProv = CRYPT_GetDefaultProvider();
2253 oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2254 info->SignatureAlgorithm.pszObjId, 0);
2255 if (!oidInfo)
2256 {
2257 SetLastError(NTE_BAD_ALGID);
2258 ret = FALSE;
2259 }
2260 else
2261 {
2262 ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2263 if (ret)
2264 {
2265 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2266 info->ToBeSigned.cbData, 0);
2267 if (ret)
2268 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2269 pcbComputedHash, 0);
2270 CryptDestroyHash(hHash);
2271 }
2272 }
2273 LocalFree(info);
2274 }
2275 return ret;
2276 }
2277
2278 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2279 DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2280 DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2281 const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2282 {
2283 BOOL ret;
2284 PCCRYPT_OID_INFO info;
2285 HCRYPTHASH hHash;
2286
2287 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2288 dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2289 pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2290
2291 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2292 pSignatureAlgorithm->pszObjId, 0);
2293 if (!info)
2294 {
2295 SetLastError(NTE_BAD_ALGID);
2296 return FALSE;
2297 }
2298 if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2299 {
2300 if (!hCryptProv)
2301 hCryptProv = CRYPT_GetDefaultProvider();
2302 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2303 if (ret)
2304 {
2305 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2306 cbEncodedToBeSigned, 0);
2307 if (ret)
2308 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2309 pcbSignature, 0);
2310 CryptDestroyHash(hHash);
2311 }
2312 }
2313 else
2314 {
2315 if (!hCryptProv)
2316 {
2317 SetLastError(ERROR_INVALID_PARAMETER);
2318 ret = FALSE;
2319 }
2320 else
2321 {
2322 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2323 if (ret)
2324 {
2325 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2326 cbEncodedToBeSigned, 0);
2327 if (ret)
2328 ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2329 pcbSignature);
2330 CryptDestroyHash(hHash);
2331 }
2332 }
2333 }
2334 return ret;
2335 }
2336
2337 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2338 DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2339 const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2340 const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2341 {
2342 BOOL ret;
2343 DWORD encodedSize, hashSize;
2344
2345 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2346 dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2347 pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2348
2349 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2350 NULL, &encodedSize);
2351 if (ret)
2352 {
2353 PBYTE encoded = CryptMemAlloc(encodedSize);
2354
2355 if (encoded)
2356 {
2357 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2358 pvStructInfo, encoded, &encodedSize);
2359 if (ret)
2360 {
2361 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2362 dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2363 pvHashAuxInfo, NULL, &hashSize);
2364 if (ret)
2365 {
2366 PBYTE hash = CryptMemAlloc(hashSize);
2367
2368 if (hash)
2369 {
2370 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2371 dwCertEncodingType, encoded, encodedSize,
2372 pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2373 if (ret)
2374 {
2375 CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2376
2377 info.ToBeSigned.cbData = encodedSize;
2378 info.ToBeSigned.pbData = encoded;
2379 info.SignatureAlgorithm = *pSignatureAlgorithm;
2380 info.Signature.cbData = hashSize;
2381 info.Signature.pbData = hash;
2382 info.Signature.cUnusedBits = 0;
2383 ret = CryptEncodeObject(dwCertEncodingType,
2384 X509_CERT, &info, pbEncoded, pcbEncoded);
2385 }
2386 CryptMemFree(hash);
2387 }
2388 else
2389 ret = FALSE;
2390 }
2391 }
2392 CryptMemFree(encoded);
2393 }
2394 else
2395 ret = FALSE;
2396 }
2397 return ret;
2398 }
2399
2400 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2401 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2402 PCERT_PUBLIC_KEY_INFO pPublicKey)
2403 {
2404 CRYPT_DATA_BLOB blob = { cbEncoded, (BYTE *)pbEncoded };
2405
2406 return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2407 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &blob,
2408 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2409 }
2410
2411 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
2412 DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
2413 const CERT_SIGNED_CONTENT_INFO *signedCert)
2414 {
2415 BOOL ret;
2416 HCRYPTKEY key;
2417 PCCRYPT_OID_INFO info;
2418 ALG_ID pubKeyID, hashID;
2419
2420 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2421 signedCert->SignatureAlgorithm.pszObjId, 0);
2422 if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2423 {
2424 SetLastError(NTE_BAD_ALGID);
2425 return FALSE;
2426 }
2427 hashID = info->u.Algid;
2428 if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2429 pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2430 else
2431 pubKeyID = hashID;
2432 /* Load the default provider if necessary */
2433 if (!hCryptProv)
2434 hCryptProv = CRYPT_GetDefaultProvider();
2435 ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2436 pubKeyInfo, pubKeyID, 0, NULL, &key);
2437 if (ret)
2438 {
2439 HCRYPTHASH hash;
2440
2441 ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2442 if (ret)
2443 {
2444 ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2445 signedCert->ToBeSigned.cbData, 0);
2446 if (ret)
2447 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2448 signedCert->Signature.cbData, key, NULL, 0);
2449 CryptDestroyHash(hash);
2450 }
2451 CryptDestroyKey(key);
2452 }
2453 return ret;
2454 }
2455
2456 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2457 DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2458 DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2459 {
2460 BOOL ret = TRUE;
2461 CRYPT_DATA_BLOB subjectBlob;
2462
2463 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2464 dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2465 dwFlags, pvReserved);
2466
2467 switch (dwSubjectType)
2468 {
2469 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2470 {
2471 PCRYPT_DATA_BLOB blob = pvSubject;
2472
2473 subjectBlob.pbData = blob->pbData;
2474 subjectBlob.cbData = blob->cbData;
2475 break;
2476 }
2477 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2478 {
2479 PCERT_CONTEXT context = pvSubject;
2480
2481 subjectBlob.pbData = context->pbCertEncoded;
2482 subjectBlob.cbData = context->cbCertEncoded;
2483 break;
2484 }
2485 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2486 {
2487 PCRL_CONTEXT context = pvSubject;
2488
2489 subjectBlob.pbData = context->pbCrlEncoded;
2490 subjectBlob.cbData = context->cbCrlEncoded;
2491 break;
2492 }
2493 default:
2494 SetLastError(E_INVALIDARG);
2495 ret = FALSE;
2496 }
2497
2498 if (ret)
2499 {
2500 PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2501 DWORD size = 0;
2502
2503 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2504 subjectBlob.pbData, subjectBlob.cbData,
2505 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2506 &signedCert, &size);
2507 if (ret)
2508 {
2509 switch (dwIssuerType)
2510 {
2511 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2512 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2513 dwCertEncodingType, pvIssuer,
2514 signedCert);
2515 break;
2516 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2517 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2518 dwCertEncodingType,
2519 &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2520 signedCert);
2521 break;
2522 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2523 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2524 ret = FALSE;
2525 break;
2526 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2527 if (pvIssuer)
2528 {
2529 SetLastError(E_INVALIDARG);
2530 ret = FALSE;
2531 }
2532 else
2533 {
2534 FIXME("unimplemented for NULL signer\n");
2535 SetLastError(E_INVALIDARG);
2536 ret = FALSE;
2537 }
2538 break;
2539 default:
2540 SetLastError(E_INVALIDARG);
2541 ret = FALSE;
2542 }
2543 LocalFree(signedCert);
2544 }
2545 }
2546 return ret;
2547 }
2548
2549 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2550 PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2551 {
2552 PCERT_EXTENSION ext;
2553 BOOL ret = FALSE;
2554
2555 TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2556 cbKeyUsage);
2557
2558 ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2559 pCertInfo->rgExtension);
2560 if (ext)
2561 {
2562 CRYPT_BIT_BLOB usage;
2563 DWORD size = sizeof(usage);
2564
2565 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2566 ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2567 &usage, &size);
2568 if (ret)
2569 {
2570 if (cbKeyUsage < usage.cbData)
2571 ret = FALSE;
2572 else
2573 {
2574 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2575 if (cbKeyUsage > usage.cbData)
2576 memset(pbKeyUsage + usage.cbData, 0,
2577 cbKeyUsage - usage.cbData);
2578 }
2579 }
2580 }
2581 else
2582 SetLastError(0);
2583 return ret;
2584 }
2585
2586 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2587 PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2588 {
2589 PCERT_ENHKEY_USAGE usage = NULL;
2590 DWORD bytesNeeded;
2591 BOOL ret = TRUE;
2592
2593 if (!pCertContext || !pcbUsage)
2594 {
2595 SetLastError(ERROR_INVALID_PARAMETER);
2596 return FALSE;
2597 }
2598
2599 TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2600
2601 if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2602 {
2603 DWORD propSize = 0;
2604
2605 if (CertGetCertificateContextProperty(pCertContext,
2606 CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2607 {
2608 LPBYTE buf = CryptMemAlloc(propSize);
2609
2610 if (buf)
2611 {
2612 if (CertGetCertificateContextProperty(pCertContext,
2613 CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2614 {
2615 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2616 X509_ENHANCED_KEY_USAGE, buf, propSize,
2617 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2618 }
2619 CryptMemFree(buf);
2620 }
2621 }
2622 }
2623 if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2624 {
2625 PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2626 pCertContext->pCertInfo->cExtension,
2627 pCertContext->pCertInfo->rgExtension);
2628
2629 if (ext)
2630 {
2631 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2632 X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
2633 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2634 }
2635 }
2636 if (!usage)
2637 {
2638 /* If a particular location is specified, this should fail. Otherwise
2639 * it should succeed with an empty usage. (This is true on Win2k and
2640 * later, which we emulate.)
2641 */
2642 if (dwFlags)
2643 {
2644 SetLastError(CRYPT_E_NOT_FOUND);
2645 ret = FALSE;
2646 }
2647 else
2648 bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
2649 }
2650
2651 if (ret)
2652 {
2653 if (!pUsage)
2654 *pcbUsage = bytesNeeded;
2655 else if (*pcbUsage < bytesNeeded)
2656 {
2657 SetLastError(ERROR_MORE_DATA);
2658 *pcbUsage = bytesNeeded;
2659 ret = FALSE;
2660 }
2661 else
2662 {
2663 *pcbUsage = bytesNeeded;
2664 if (usage)
2665 {
2666 DWORD i;
2667 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
2668 sizeof(CERT_ENHKEY_USAGE) +
2669 usage->cUsageIdentifier * sizeof(LPSTR));
2670
2671 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
2672 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
2673 sizeof(CERT_ENHKEY_USAGE));
2674 for (i = 0; i < usage->cUsageIdentifier; i++)
2675 {
2676 pUsage->rgpszUsageIdentifier[i] = nextOID;
2677 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2678 nextOID += strlen(nextOID) + 1;
2679 }
2680 }
2681 else
2682 pUsage->cUsageIdentifier = 0;
2683 }
2684 }
2685 if (usage)
2686 LocalFree(usage);
2687 TRACE("returning %d\n", ret);
2688 return ret;
2689 }
2690
2691 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
2692 PCERT_ENHKEY_USAGE pUsage)
2693 {
2694 BOOL ret;
2695
2696 TRACE("(%p, %p)\n", pCertContext, pUsage);
2697
2698 if (pUsage)
2699 {
2700 CRYPT_DATA_BLOB blob = { 0, NULL };
2701
2702 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2703 pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2704 if (ret)
2705 {
2706 ret = CertSetCertificateContextProperty(pCertContext,
2707 CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2708 LocalFree(blob.pbData);
2709 }
2710 }
2711 else
2712 ret = CertSetCertificateContextProperty(pCertContext,
2713 CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2714 return ret;
2715 }
2716
2717 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2718 LPCSTR pszUsageIdentifier)
2719 {
2720 BOOL ret;
2721 DWORD size;
2722
2723 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2724
2725 if (CertGetEnhancedKeyUsage(pCertContext,
2726 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2727 {
2728 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2729
2730 if (usage)
2731 {
2732 ret = CertGetEnhancedKeyUsage(pCertContext,
2733 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2734 if (ret)
2735 {
2736 DWORD i;
2737 BOOL exists = FALSE;
2738
2739 /* Make sure usage doesn't already exist */
2740 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2741 {
2742 if (!strcmp(usage->rgpszUsageIdentifier[i],
2743 pszUsageIdentifier))
2744 exists = TRUE;
2745 }
2746 if (!exists)
2747 {
2748 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2749 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2750
2751 if (newUsage)
2752 {
2753 LPSTR nextOID;
2754
2755 newUsage->rgpszUsageIdentifier = (LPSTR *)
2756 ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2757 nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2758 + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2759 for (i = 0; i < usage->cUsageIdentifier; i++)
2760 {
2761 newUsage->rgpszUsageIdentifier[i] = nextOID;
2762 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2763 nextOID += strlen(nextOID) + 1;
2764 }
2765 newUsage->rgpszUsageIdentifier[i] = nextOID;
2766 strcpy(nextOID, pszUsageIdentifier);
2767 newUsage->cUsageIdentifier = i + 1;
2768 ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2769 CryptMemFree(newUsage);
2770 }
2771 else
2772 ret = FALSE;
2773 }
2774 }
2775 CryptMemFree(usage);
2776 }
2777 else
2778 ret = FALSE;
2779 }
2780 else
2781 {
2782 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2783 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2784
2785 if (usage)
2786 {
2787 usage->rgpszUsageIdentifier =
2788 (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2789 usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2790 sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2791 strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2792 usage->cUsageIdentifier = 1;
2793 ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2794 CryptMemFree(usage);
2795 }
2796 else
2797 ret = FALSE;
2798 }
2799 return ret;
2800 }
2801
2802 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2803 LPCSTR pszUsageIdentifier)
2804 {
2805 BOOL ret;
2806 DWORD size;
2807 CERT_ENHKEY_USAGE usage;
2808
2809 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2810
2811 size = sizeof(usage);
2812 ret = CertGetEnhancedKeyUsage(pCertContext,
2813 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2814 if (!ret && GetLastError() == ERROR_MORE_DATA)
2815 {
2816 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2817
2818 if (pUsage)
2819 {
2820 ret = CertGetEnhancedKeyUsage(pCertContext,
2821 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2822 if (ret)
2823 {
2824 if (pUsage->cUsageIdentifier)
2825 {
2826 DWORD i;
2827 BOOL found = FALSE;
2828
2829 for (i = 0; i < pUsage->cUsageIdentifier; i++)
2830 {
2831 if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2832 pszUsageIdentifier))
2833 found = TRUE;
2834 if (found && i < pUsage->cUsageIdentifier - 1)
2835 pUsage->rgpszUsageIdentifier[i] =
2836 pUsage->rgpszUsageIdentifier[i + 1];
2837 }
2838 pUsage->cUsageIdentifier--;
2839 /* Remove the usage if it's empty */
2840 if (pUsage->cUsageIdentifier)
2841 ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2842 else
2843 ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2844 }
2845 }
2846 CryptMemFree(pUsage);
2847 }
2848 else
2849 ret = FALSE;
2850 }
2851 else
2852 {
2853 /* it fit in an empty usage, therefore there's nothing to remove */
2854 ret = TRUE;
2855 }
2856 return ret;
2857 }
2858
2859 struct BitField
2860 {
2861 DWORD cIndexes;
2862 DWORD *indexes;
2863 };
2864
2865 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2866
2867 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2868 {
2869 DWORD indexIndex = bit / BITS_PER_DWORD;
2870
2871 if (indexIndex + 1 > field->cIndexes)
2872 {
2873 if (field->cIndexes)
2874 field->indexes = CryptMemRealloc(field->indexes,
2875 (indexIndex + 1) * sizeof(DWORD));
2876 else
2877 field->indexes = CryptMemAlloc(sizeof(DWORD));
2878 if (field->indexes)
2879 {
2880 field->indexes[indexIndex] = 0;
2881 field->cIndexes = indexIndex + 1;
2882 }
2883 }
2884 if (field->indexes)
2885 field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2886 }
2887
2888 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
2889 {
2890 BOOL set;
2891 DWORD indexIndex = bit / BITS_PER_DWORD;
2892
2893 assert(field->cIndexes);
2894 set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2895 return set;
2896 }
2897
2898 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2899 int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2900 {
2901 BOOL ret = TRUE;
2902 DWORD i, cbOIDs = 0;
2903 BOOL allUsagesValid = TRUE;
2904 CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2905
2906 TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2907 rghOIDs, *pcbOIDs);
2908
2909 for (i = 0; i < cCerts; i++)
2910 {
2911 CERT_ENHKEY_USAGE usage;
2912 DWORD size = sizeof(usage);
2913
2914 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2915 /* Success is deliberately ignored: it implies all usages are valid */
2916 if (!ret && GetLastError() == ERROR_MORE_DATA)
2917 {
2918 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2919
2920 allUsagesValid = FALSE;
2921 if (pUsage)
2922 {
2923 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2924 if (ret)
2925 {
2926 if (!validUsages.cUsageIdentifier)
2927 {
2928 DWORD j;
2929
2930 cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2931 validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2932 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2933 cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2934 + 1;
2935 validUsages.rgpszUsageIdentifier =
2936 CryptMemAlloc(cbOIDs);
2937 if (validUsages.rgpszUsageIdentifier)
2938 {
2939 LPSTR nextOID = (LPSTR)
2940 ((LPBYTE)validUsages.rgpszUsageIdentifier +
2941 validUsages.cUsageIdentifier * sizeof(LPSTR));
2942
2943 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2944 {
2945 validUsages.rgpszUsageIdentifier[j] = nextOID;
2946 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2947 pUsage->rgpszUsageIdentifier[j]);
2948 nextOID += lstrlenA(nextOID) + 1;
2949 }
2950 }
2951 }
2952 else
2953 {
2954 struct BitField validIndexes = { 0, NULL };
2955 DWORD j, k, numRemoved = 0;
2956
2957 /* Merge: build a bitmap of all the indexes of
2958 * validUsages.rgpszUsageIdentifier that are in pUsage.
2959 */
2960 for (j = 0; j < pUsage->cUsageIdentifier; j++)
2961 {
2962 for (k = 0; k < validUsages.cUsageIdentifier; k++)
2963 {
2964 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2965 validUsages.rgpszUsageIdentifier[k]))
2966 {
2967 CRYPT_SetBitInField(&validIndexes, k);
2968 break;
2969 }
2970 }
2971 }
2972 /* Merge by removing from validUsages those that are
2973 * not in the bitmap.
2974 */
2975 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2976 {
2977 if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2978 {
2979 if (j < validUsages.cUsageIdentifier - 1)
2980 {
2981 memmove(&validUsages.rgpszUsageIdentifier[j],
2982 &validUsages.rgpszUsageIdentifier[j +
2983 numRemoved + 1],
2984 (validUsages.cUsageIdentifier - numRemoved
2985 - j - 1) * sizeof(LPSTR));
2986 cbOIDs -= lstrlenA(
2987 validUsages.rgpszUsageIdentifier[j]) + 1 +
2988 sizeof(LPSTR);
2989 validUsages.cUsageIdentifier--;
2990 numRemoved++;
2991 }
2992 else
2993 validUsages.cUsageIdentifier--;
2994 }
2995 }
2996 CryptMemFree(validIndexes.indexes);
2997 }
2998 }
2999 CryptMemFree(pUsage);
3000 }
3001 }
3002 }
3003 ret = TRUE;
3004 if (allUsagesValid)
3005 {
3006 *cNumOIDs = -1;
3007 *pcbOIDs = 0;
3008 }
3009 else
3010 {
3011 *cNumOIDs = validUsages.cUsageIdentifier;
3012 if (!rghOIDs)
3013 *pcbOIDs = cbOIDs;
3014 else if (*pcbOIDs < cbOIDs)
3015 {
3016 *pcbOIDs = cbOIDs;
3017 SetLastError(ERROR_MORE_DATA);
3018 ret = FALSE;
3019 }
3020 else
3021 {
3022 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
3023 validUsages.cUsageIdentifier * sizeof(LPSTR));
3024
3025 *pcbOIDs = cbOIDs;
3026 for (i = 0; i < validUsages.cUsageIdentifier; i++)
3027 {
3028 rghOIDs[i] = nextOID;
3029 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
3030 nextOID += lstrlenA(nextOID) + 1;
3031 }
3032 }
3033 }
3034 CryptMemFree(validUsages.rgpszUsageIdentifier);
3035 TRACE("cNumOIDs: %d\n", *cNumOIDs);
3036 TRACE("returning %d\n", ret);
3037 return ret;
3038 }
3039
3040 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
3041 * pInfo is NULL, from the attributes of hProv.
3042 */
3043 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
3044 const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
3045 {
3046 CRYPT_KEY_PROV_INFO info = { 0 };
3047 BOOL ret;
3048
3049 if (!pInfo)
3050 {
3051 DWORD size;
3052 int len;
3053
3054 ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
3055 if (ret)
3056 {
3057 LPSTR szContainer = CryptMemAlloc(size);
3058
3059 if (szContainer)
3060 {
3061 ret = CryptGetProvParam(hProv, PP_CONTAINER,
3062 (BYTE *)szContainer, &size, 0);
3063 if (ret)
3064 {
3065 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3066 NULL, 0);
3067 if (len)
3068 {
3069 info.pwszContainerName = CryptMemAlloc(len *
3070 sizeof(WCHAR));
3071 MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3072 info.pwszContainerName, len);
3073 }
3074 }
3075 CryptMemFree(szContainer);
3076 }
3077 }
3078 ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
3079 if (ret)
3080 {
3081 LPSTR szProvider = CryptMemAlloc(size);
3082
3083 if (szProvider)
3084 {
3085 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
3086 &size, 0);
3087 if (ret)
3088 {
3089 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3090 NULL, 0);
3091 if (len)
3092 {
3093 info.pwszProvName = CryptMemAlloc(len *
3094 sizeof(WCHAR));
3095 MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3096 info.pwszProvName, len);
3097 }
3098 }
3099 CryptMemFree(szProvider);
3100 }
3101 }
3102 /* in case no CRYPT_KEY_PROV_INFO given,
3103 * we always use AT_SIGNATURE key spec
3104 */
3105 info.dwKeySpec = AT_SIGNATURE;
3106 size = sizeof(info.dwProvType);
3107 ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
3108 &size, 0);
3109 if (!ret)
3110 info.dwProvType = PROV_RSA_FULL;
3111 pInfo = &info;
3112 }
3113
3114 CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
3115 0, pInfo);
3116
3117 if (pInfo == &info)
3118 {
3119 CryptMemFree(info.pwszContainerName);
3120 CryptMemFree(info.pwszProvName);
3121 }
3122 }
3123
3124 /* Creates a signed certificate context from the unsigned, encoded certificate
3125 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
3126 */
3127 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
3128 HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
3129 {
3130 PCCERT_CONTEXT context = NULL;
3131 BOOL ret;
3132 DWORD sigSize = 0;
3133
3134 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3135 blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
3136 if (ret)
3137 {
3138 LPBYTE sig = CryptMemAlloc(sigSize);
3139
3140 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3141 blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
3142 if (ret)
3143 {
3144 CERT_SIGNED_CONTENT_INFO signedInfo;
3145 BYTE *encodedSignedCert = NULL;
3146 DWORD encodedSignedCertSize = 0;
3147
3148 signedInfo.ToBeSigned.cbData = blob->cbData;
3149 signedInfo.ToBeSigned.pbData = blob->pbData;
3150 signedInfo.SignatureAlgorithm = *sigAlgo;
3151 signedInfo.Signature.cbData = sigSize;
3152 signedInfo.Signature.pbData = sig;
3153 signedInfo.Signature.cUnusedBits = 0;
3154 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
3155 &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
3156 &encodedSignedCert, &encodedSignedCertSize);
3157 if (ret)
3158 {
3159 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3160 encodedSignedCert, encodedSignedCertSize);
3161 LocalFree(encodedSignedCert);
3162 }
3163 }
3164 CryptMemFree(sig);
3165 }
3166 return context;
3167 }
3168
3169 /* Copies data from the parameters into info, where:
3170 * pSerialNumber: The serial number. Must not be NULL.
3171 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3172 * Must not be NULL
3173 * pSignatureAlgorithm: Optional.
3174 * pStartTime: The starting time of the certificate. If NULL, the current
3175 * system time is used.
3176 * pEndTime: The ending time of the certificate. If NULL, one year past the
3177 * starting time is used.
3178 * pubKey: The public key of the certificate. Must not be NULL.
3179 * pExtensions: Extensions to be included with the certificate. Optional.
3180 */
3181 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3182 const CERT_NAME_BLOB *pSubjectIssuerBlob,
3183 const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3184 const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3185 const CERT_EXTENSIONS *pExtensions)
3186 {
3187 static CHAR oid[] = szOID_RSA_SHA1RSA;
3188
3189 assert(info);
3190 assert(pSerialNumber);
3191 assert(pSubjectIssuerBlob);
3192 assert(pubKey);
3193
3194 if (pExtensions && pExtensions->cExtension)
3195 info->dwVersion = CERT_V3;
3196 else
3197 info->dwVersion = CERT_V1;
3198 info->SerialNumber.cbData = pSerialNumber->cbData;
3199 info->SerialNumber.pbData = pSerialNumber->pbData;
3200 if (pSignatureAlgorithm)
3201 info->SignatureAlgorithm = *pSignatureAlgorithm;
3202 else
3203 {
3204 info->SignatureAlgorithm.pszObjId = oid;
3205 info->SignatureAlgorithm.Parameters.cbData = 0;
3206 info->SignatureAlgorithm.Parameters.pbData = NULL;
3207 }
3208 info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3209 info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3210 if (pStartTime)
3211 SystemTimeToFileTime(pStartTime, &info->NotBefore);
3212 else
3213 GetSystemTimeAsFileTime(&info->NotBefore);
3214 if (pEndTime)
3215 SystemTimeToFileTime(pEndTime, &info->NotAfter);
3216 else
3217 {
3218 SYSTEMTIME endTime;
3219
3220 if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3221 {
3222 endTime.wYear++;
3223 SystemTimeToFileTime(&endTime, &info->NotAfter);
3224 }
3225 }
3226 info->Subject.cbData = pSubjectIssuerBlob->cbData;
3227 info->Subject.pbData = pSubjectIssuerBlob->pbData;
3228 info->SubjectPublicKeyInfo = *pubKey;
3229 if (pExtensions)
3230 {
3231 info->cExtension = pExtensions->cExtension;
3232 info->rgExtension = pExtensions->rgExtension;
3233 }
3234 else
3235 {
3236 info->cExtension = 0;
3237 info->rgExtension = NULL;
3238 }
3239 }
3240
3241 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3242 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3243 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3244
3245 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3246 {
3247 HCRYPTPROV hProv = 0;
3248 HMODULE rpcrt = LoadLibraryA("rpcrt4");
3249
3250 if (rpcrt)
3251 {
3252 UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3253 "UuidCreate");
3254 UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3255 "UuidToStringA");
3256 RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3257 rpcrt, "RpcStringFreeA");
3258
3259 if (uuidCreate && uuidToString && rpcStringFree)
3260 {
3261 UUID uuid;
3262 RPC_STATUS status = uuidCreate(&uuid);
3263
3264 if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3265 {
3266 unsigned char *uuidStr;
3267
3268 status = uuidToString(&uuid, &uuidStr);
3269 if (status == RPC_S_OK)
3270 {
3271 BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3272 MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3273
3274 if (ret)
3275 {
3276 HCRYPTKEY key;
3277
3278 ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3279 if (ret)
3280 CryptDestroyKey(key);
3281 }
3282 rpcStringFree(&uuidStr);
3283 }
3284 }
3285 }
3286 FreeLibrary(rpcrt);
3287 }
3288 return hProv;
3289 }
3290
3291 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3292 PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3293 PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3294 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3295 PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3296 {
3297 PCCERT_CONTEXT context = NULL;
3298 BOOL ret, releaseContext = FALSE;
3299 PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3300 DWORD pubKeySize = 0, dwKeySpec;
3301
3302 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3303 pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3304 pExtensions, pExtensions);
3305
3306 if(!pSubjectIssuerBlob)
3307 {
3308 SetLastError(ERROR_INVALID_PARAMETER);
3309 return NULL;
3310 }
3311
3312 dwKeySpec = pKeyProvInfo ? pKeyProvInfo->dwKeySpec : AT_SIGNATURE;
3313 if (!hProv)
3314 {
3315 if (!pKeyProvInfo)
3316 {
3317 hProv = CRYPT_CreateKeyProv();
3318 releaseContext = TRUE;
3319 }
3320 else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3321 {
3322 SetLastError(NTE_BAD_FLAGS);
3323 return NULL;
3324 }
3325 else
3326 {
3327 HCRYPTKEY hKey = 0;
3328 /* acquire the context using the given information*/
3329 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3330 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3331 pKeyProvInfo->dwFlags);
3332 if (!ret)
3333 {
3334 if(GetLastError() != NTE_BAD_KEYSET)
3335 return NULL;
3336 /* create the key set */
3337 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3338 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3339 pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3340 if (!ret)
3341 return NULL;
3342 }
3343 /* check if the key is here */
3344 ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3345 if(!ret)
3346 {
3347 if (NTE_NO_KEY == GetLastError())
3348 { /* generate the key */
3349 ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3350 }
3351 if (!ret)
3352 {
3353 CryptReleaseContext(hProv,0);
3354 SetLastError(NTE_BAD_KEYSET);
3355 return NULL;
3356 }
3357 }
3358 CryptDestroyKey(hKey);
3359 releaseContext = TRUE;
3360 }
3361 }
3362
3363 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3364 &pubKeySize);
3365 if (!ret)
3366 goto end;
3367 pubKey = CryptMemAlloc(pubKeySize);
3368 if (pubKey)
3369 {
3370 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3371 pubKey, &pubKeySize);
3372 if (ret)
3373 {
3374 CERT_INFO info = { 0 };
3375 CRYPT_DER_BLOB blob = { 0, NULL };
3376 BYTE serial[16];
3377 CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3378
3379 CryptGenRandom(hProv, sizeof(serial), serial);
3380 CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3381 pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3382 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3383 &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3384 &blob.cbData);
3385 if (ret)
3386 {
3387 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3388 context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3389 &info.SignatureAlgorithm);
3390 else
3391 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3392 blob.pbData, blob.cbData);
3393 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3394 CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3395 LocalFree(blob.pbData);
3396 }
3397 }
3398 CryptMemFree(pubKey);
3399 }
3400 end:
3401 if (releaseContext)
3402 CryptReleaseContext(hProv, 0);
3403 return context;
3404 }
3405
3406 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3407 void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3408 PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3409 PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3410 {
3411 FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3412 dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3413 pVerifyUsageStatus);
3414 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3415 return FALSE;
3416 }
3417
3418 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3419 const BYTE *pbEncoded, DWORD cbEncoded,
3420 DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3421 {
3422 TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3423 pbEncoded, cbEncoded, dwFlags, pCreatePara);
3424
3425 if (dwFlags)
3426 {
3427 FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3428 return NULL;
3429 }
3430 if (pCreatePara)
3431 {
3432 FIXME("pCreatePara not handled\n");
3433 return NULL;
3434 }
3435
3436 switch (dwContextType)
3437 {
3438 case CERT_STORE_CERTIFICATE_CONTEXT:
3439 return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3440 case CERT_STORE_CRL_CONTEXT:
3441 return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3442 case CERT_STORE_CTL_CONTEXT:
3443 return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3444 default:
3445 WARN("unknown context type: 0x%x\n", dwContextType);
3446 return NULL;
3447 }
3448 }
Maarten's multimedia branch