?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
crypt32: Fail earlier if CryptExportPublicKeyInfo fails.
[wine/multimedia.git] / dlls / crypt32 / cert.c
blob2d6697cc4a37b986d5519e79a1a3b3a775327e6f
1 /*
2 * Copyright 2004-2006 Juan Lang
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17 *
18 */
19
20 #include <assert.h>
21 #include <stdarg.h>
22
23 #define NONAMELESSUNION
24 #include "windef.h"
25 #include "winbase.h"
26 #include "wincrypt.h"
27 #include "winnls.h"
28 #include "rpc.h"
29 #include "wine/debug.h"
30 #include "wine/unicode.h"
31 #include "crypt32_private.h"
32
33 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
34
35 /* Internal version of CertGetCertificateContextProperty that gets properties
36 * directly from the context (or the context it's linked to, depending on its
37 * type.) Doesn't handle special-case properties, since they are handled by
38 * CertGetCertificateContextProperty, and are particular to the store in which
39 * the property exists (which is separate from the context.)
40 */
41 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
42 void *pvData, DWORD *pcbData);
43
44 /* Internal version of CertSetCertificateContextProperty that sets properties
45 * directly on the context (or the context it's linked to, depending on its
46 * type.) Doesn't handle special cases, since they're handled by
47 * CertSetCertificateContextProperty anyway.
48 */
49 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
50 DWORD dwFlags, const void *pvData);
51
52 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
53 DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
54 DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
55 {
56 PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
57 pbCertEncoded, cbCertEncoded);
58 BOOL ret;
59
60 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
61 pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
62
63 if (cert)
64 {
65 ret = CertAddCertificateContextToStore(hCertStore, cert,
66 dwAddDisposition, ppCertContext);
67 CertFreeCertificateContext(cert);
68 }
69 else
70 ret = FALSE;
71 return ret;
72 }
73
74 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
75 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
76 {
77 HCERTSTORE store;
78 BOOL ret = FALSE;
79
80 TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
81 cbCertEncoded);
82
83 store = CertOpenSystemStoreA(0, pszCertStoreName);
84 if (store)
85 {
86 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
87 pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
88 CertCloseStore(store, 0);
89 }
90 return ret;
91 }
92
93 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
94 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
95 {
96 HCERTSTORE store;
97 BOOL ret = FALSE;
98
99 TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
100 cbCertEncoded);
101
102 store = CertOpenSystemStoreW(0, pszCertStoreName);
103 if (store)
104 {
105 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
106 pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
107 CertCloseStore(store, 0);
108 }
109 return ret;
110 }
111
112 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
113 PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
114 PCCERT_CONTEXT *ppCertContext)
115 {
116 static int calls;
117 PWINECRYPT_CERTSTORE store = (PWINECRYPT_CERTSTORE)hCertStore;
118
119 if (!(calls++))
120 FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore, pCertContext,
121 dwAddDisposition, ppCertContext);
122 if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
123 return FALSE;
124 if (store->type == StoreTypeCollection)
125 {
126 SetLastError(E_INVALIDARG);
127 return FALSE;
128 }
129 return CertAddCertificateContextToStore(hCertStore, pCertContext,
130 dwAddDisposition, ppCertContext);
131 }
132
133 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
134 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
135 {
136 PCERT_CONTEXT cert = NULL;
137 BOOL ret;
138 PCERT_INFO certInfo = NULL;
139 DWORD size = 0;
140
141 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
142 cbCertEncoded);
143
144 if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
145 {
146 SetLastError(E_INVALIDARG);
147 return NULL;
148 }
149
150 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
151 pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
152 &certInfo, &size);
153 if (ret)
154 {
155 BYTE *data = NULL;
156
157 cert = Context_CreateDataContext(sizeof(CERT_CONTEXT));
158 if (!cert)
159 goto end;
160 data = CryptMemAlloc(cbCertEncoded);
161 if (!data)
162 {
163 CertFreeCertificateContext(cert);
164 cert = NULL;
165 goto end;
166 }
167 memcpy(data, pbCertEncoded, cbCertEncoded);
168 cert->dwCertEncodingType = dwCertEncodingType;
169 cert->pbCertEncoded = data;
170 cert->cbCertEncoded = cbCertEncoded;
171 cert->pCertInfo = certInfo;
172 cert->hCertStore = 0;
173 }
174
175 end:
176 return cert;
177 }
178
179 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
180 PCCERT_CONTEXT pCertContext)
181 {
182 TRACE("(%p)\n", pCertContext);
183
184 if (!pCertContext)
185 return NULL;
186
187 Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
188 return pCertContext;
189 }
190
191 static void CertDataContext_Free(void *context)
192 {
193 PCERT_CONTEXT certContext = context;
194
195 CryptMemFree(certContext->pbCertEncoded);
196 LocalFree(certContext->pCertInfo);
197 }
198
199 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
200 {
201 BOOL ret = TRUE;
202
203 TRACE("(%p)\n", pCertContext);
204
205 if (pCertContext)
206 ret = Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
207 CertDataContext_Free);
208 return ret;
209 }
210
211 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
212 DWORD dwPropId)
213 {
214 PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
215 pCertContext, sizeof(CERT_CONTEXT));
216 DWORD ret;
217
218 TRACE("(%p, %d)\n", pCertContext, dwPropId);
219
220 if (properties)
221 ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
222 else
223 ret = 0;
224 return ret;
225 }
226
227 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
228 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
229 DWORD *pcbData)
230 {
231 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
232 pcbData);
233 if (ret && pvData)
234 {
235 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
236
237 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
238 }
239 return ret;
240 }
241
242 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
243 DWORD cb)
244 {
245 BOOL ret = TRUE;
246
247 if (!pvData)
248 *pcbData = cb;
249 else if (*pcbData < cb)
250 {
251 SetLastError(ERROR_MORE_DATA);
252 *pcbData = cb;
253 ret = FALSE;
254 }
255 else
256 {
257 memcpy(pvData, pb, cb);
258 *pcbData = cb;
259 }
260 return ret;
261 }
262
263 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
264 void *pvData, DWORD *pcbData)
265 {
266 PCCERT_CONTEXT pCertContext = context;
267 PCONTEXT_PROPERTY_LIST properties =
268 Context_GetProperties(context, sizeof(CERT_CONTEXT));
269 BOOL ret;
270 CRYPT_DATA_BLOB blob;
271
272 TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
273
274 if (properties)
275 ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
276 else
277 ret = FALSE;
278 if (ret)
279 ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
280 else
281 {
282 /* Implicit properties */
283 switch (dwPropId)
284 {
285 case CERT_SHA1_HASH_PROP_ID:
286 ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
287 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
288 pcbData);
289 break;
290 case CERT_MD5_HASH_PROP_ID:
291 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
292 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
293 pcbData);
294 break;
295 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
296 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
297 pCertContext->pCertInfo->Subject.pbData,
298 pCertContext->pCertInfo->Subject.cbData,
299 pvData, pcbData);
300 break;
301 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
302 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
303 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
304 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
305 pvData, pcbData);
306 break;
307 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
308 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
309 pCertContext->pCertInfo->SerialNumber.pbData,
310 pCertContext->pCertInfo->SerialNumber.cbData,
311 pvData, pcbData);
312 break;
313 case CERT_SIGNATURE_HASH_PROP_ID:
314 ret = CryptHashToBeSigned(0, pCertContext->dwCertEncodingType,
315 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
316 pcbData);
317 if (ret && pvData)
318 {
319 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
320
321 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
322 }
323 break;
324 case CERT_KEY_IDENTIFIER_PROP_ID:
325 {
326 PCERT_EXTENSION ext = CertFindExtension(
327 szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
328 pCertContext->pCertInfo->rgExtension);
329
330 if (ext)
331 {
332 CRYPT_DATA_BLOB value;
333 DWORD size = sizeof(value);
334
335 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
336 szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
337 ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
338 &size);
339 if (ret)
340 {
341 ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
342 value.cbData);
343 CertContext_SetProperty(context, dwPropId, 0, &value);
344 }
345 }
346 else
347 SetLastError(ERROR_INVALID_DATA);
348 break;
349 }
350 default:
351 SetLastError(CRYPT_E_NOT_FOUND);
352 }
353 }
354 TRACE("returning %d\n", ret);
355 return ret;
356 }
357
358 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
359 {
360 DWORD i, containerLen, provNameLen;
361 LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
362
363 info->pwszContainerName = (LPWSTR)data;
364 containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
365 data += containerLen;
366
367 info->pwszProvName = (LPWSTR)data;
368 provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
369 data += provNameLen;
370
371 info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
372 data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
373
374 for (i = 0; i < info->cProvParam; i++)
375 {
376 info->rgProvParam[i].pbData = data;
377 data += info->rgProvParam[i].cbData;
378 }
379 }
380
381 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
382 DWORD dwPropId, void *pvData, DWORD *pcbData)
383 {
384 BOOL ret;
385
386 TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
387
388 switch (dwPropId)
389 {
390 case 0:
391 case CERT_CERT_PROP_ID:
392 case CERT_CRL_PROP_ID:
393 case CERT_CTL_PROP_ID:
394 SetLastError(E_INVALIDARG);
395 ret = FALSE;
396 break;
397 case CERT_ACCESS_STATE_PROP_ID:
398 if (pCertContext->hCertStore)
399 ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
400 pvData, pcbData);
401 else
402 {
403 DWORD state = 0;
404
405 ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
406 }
407 break;
408 case CERT_KEY_PROV_HANDLE_PROP_ID:
409 {
410 CERT_KEY_CONTEXT keyContext;
411 DWORD size = sizeof(keyContext);
412
413 ret = CertContext_GetProperty((void *)pCertContext,
414 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
415 if (ret)
416 ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
417 sizeof(keyContext.hCryptProv));
418 break;
419 }
420 case CERT_KEY_PROV_INFO_PROP_ID:
421 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
422 pcbData);
423 if (ret && pvData)
424 CRYPT_FixKeyProvInfoPointers(pvData);
425 break;
426 default:
427 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
428 pcbData);
429 }
430
431 TRACE("returning %d\n", ret);
432 return ret;
433 }
434
435 /* Copies key provider info from from into to, where to is assumed to be a
436 * contiguous buffer of memory large enough for from and all its associated
437 * data, but whose pointers are uninitialized.
438 * Upon return, to contains a contiguous copy of from, packed in the following
439 * order:
440 * - CRYPT_KEY_PROV_INFO
441 * - pwszContainerName
442 * - pwszProvName
443 * - rgProvParam[0]...
444 */
445 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
446 const CRYPT_KEY_PROV_INFO *from)
447 {
448 DWORD i;
449 LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
450
451 if (from->pwszContainerName)
452 {
453 to->pwszContainerName = (LPWSTR)nextData;
454 lstrcpyW(to->pwszContainerName, from->pwszContainerName);
455 nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
456 }
457 else
458 to->pwszContainerName = NULL;
459 if (from->pwszProvName)
460 {
461 to->pwszProvName = (LPWSTR)nextData;
462 lstrcpyW(to->pwszProvName, from->pwszProvName);
463 nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
464 }
465 else
466 to->pwszProvName = NULL;
467 to->dwProvType = from->dwProvType;
468 to->dwFlags = from->dwFlags;
469 to->cProvParam = from->cProvParam;
470 to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
471 nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
472 to->dwKeySpec = from->dwKeySpec;
473 for (i = 0; i < to->cProvParam; i++)
474 {
475 memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
476 sizeof(CRYPT_KEY_PROV_PARAM));
477 to->rgProvParam[i].pbData = nextData;
478 memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
479 from->rgProvParam[i].cbData);
480 nextData += from->rgProvParam[i].cbData;
481 }
482 }
483
484 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
485 const CRYPT_KEY_PROV_INFO *info)
486 {
487 BOOL ret;
488 LPBYTE buf = NULL;
489 DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
490
491 if (info->pwszContainerName)
492 containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
493 else
494 containerSize = 0;
495 if (info->pwszProvName)
496 provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
497 else
498 provNameSize = 0;
499 size += containerSize + provNameSize;
500 for (i = 0; i < info->cProvParam; i++)
501 size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
502 buf = CryptMemAlloc(size);
503 if (buf)
504 {
505 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
506 ret = ContextPropertyList_SetProperty(properties,
507 CERT_KEY_PROV_INFO_PROP_ID, buf, size);
508 CryptMemFree(buf);
509 }
510 else
511 ret = FALSE;
512 return ret;
513 }
514
515 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
516 DWORD dwFlags, const void *pvData)
517 {
518 PCONTEXT_PROPERTY_LIST properties =
519 Context_GetProperties(context, sizeof(CERT_CONTEXT));
520 BOOL ret;
521
522 TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
523
524 if (!properties)
525 ret = FALSE;
526 else
527 {
528 switch (dwPropId)
529 {
530 case CERT_AUTO_ENROLL_PROP_ID:
531 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
532 case CERT_DESCRIPTION_PROP_ID:
533 case CERT_FRIENDLY_NAME_PROP_ID:
534 case CERT_HASH_PROP_ID:
535 case CERT_KEY_IDENTIFIER_PROP_ID:
536 case CERT_MD5_HASH_PROP_ID:
537 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
538 case CERT_PUBKEY_ALG_PARA_PROP_ID:
539 case CERT_PVK_FILE_PROP_ID:
540 case CERT_SIGNATURE_HASH_PROP_ID:
541 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
542 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
543 case CERT_EXTENDED_ERROR_INFO_PROP_ID:
544 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
545 case CERT_ENROLLMENT_PROP_ID:
546 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
547 case CERT_RENEWAL_PROP_ID:
548 {
549 if (pvData)
550 {
551 const CRYPT_DATA_BLOB *blob = pvData;
552
553 ret = ContextPropertyList_SetProperty(properties, dwPropId,
554 blob->pbData, blob->cbData);
555 }
556 else
557 {
558 ContextPropertyList_RemoveProperty(properties, dwPropId);
559 ret = TRUE;
560 }
561 break;
562 }
563 case CERT_DATE_STAMP_PROP_ID:
564 if (pvData)
565 ret = ContextPropertyList_SetProperty(properties, dwPropId,
566 pvData, sizeof(FILETIME));
567 else
568 {
569 ContextPropertyList_RemoveProperty(properties, dwPropId);
570 ret = TRUE;
571 }
572 break;
573 case CERT_KEY_CONTEXT_PROP_ID:
574 {
575 if (pvData)
576 {
577 const CERT_KEY_CONTEXT *keyContext = pvData;
578
579 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
580 {
581 SetLastError(E_INVALIDARG);
582 ret = FALSE;
583 }
584 else
585 ret = ContextPropertyList_SetProperty(properties, dwPropId,
586 (const BYTE *)keyContext, keyContext->cbSize);
587 }
588 else
589 {
590 ContextPropertyList_RemoveProperty(properties, dwPropId);
591 ret = TRUE;
592 }
593 break;
594 }
595 case CERT_KEY_PROV_INFO_PROP_ID:
596 if (pvData)
597 ret = CertContext_SetKeyProvInfoProperty(properties, pvData);
598 else
599 {
600 ContextPropertyList_RemoveProperty(properties, dwPropId);
601 ret = TRUE;
602 }
603 break;
604 case CERT_KEY_PROV_HANDLE_PROP_ID:
605 {
606 CERT_KEY_CONTEXT keyContext;
607 DWORD size = sizeof(keyContext);
608
609 ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
610 &keyContext, &size);
611 if (ret)
612 {
613 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
614 CryptReleaseContext(keyContext.hCryptProv, 0);
615 }
616 keyContext.cbSize = sizeof(keyContext);
617 if (pvData)
618 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
619 else
620 {
621 keyContext.hCryptProv = 0;
622 keyContext.dwKeySpec = AT_SIGNATURE;
623 }
624 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
625 0, &keyContext);
626 break;
627 }
628 default:
629 FIXME("%d: stub\n", dwPropId);
630 ret = FALSE;
631 }
632 }
633 TRACE("returning %d\n", ret);
634 return ret;
635 }
636
637 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
638 DWORD dwPropId, DWORD dwFlags, const void *pvData)
639 {
640 BOOL ret;
641
642 TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
643
644 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
645 * crashes on most of these, I'll be safer.
646 */
647 switch (dwPropId)
648 {
649 case 0:
650 case CERT_ACCESS_STATE_PROP_ID:
651 case CERT_CERT_PROP_ID:
652 case CERT_CRL_PROP_ID:
653 case CERT_CTL_PROP_ID:
654 SetLastError(E_INVALIDARG);
655 return FALSE;
656 }
657 ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
658 pvData);
659 TRACE("returning %d\n", ret);
660 return ret;
661 }
662
663 /* Acquires the private key using the key provider info, retrieving info from
664 * the certificate if info is NULL. The acquired provider is returned in
665 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
666 */
667 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
668 PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
669 {
670 DWORD size = 0;
671 BOOL allocated = FALSE, ret = TRUE;
672
673 if (!info)
674 {
675 ret = CertGetCertificateContextProperty(pCert,
676 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
677 if (ret)
678 {
679 info = HeapAlloc(GetProcessHeap(), 0, size);
680 if (info)
681 {
682 ret = CertGetCertificateContextProperty(pCert,
683 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
684 allocated = TRUE;
685 }
686 else
687 {
688 SetLastError(ERROR_OUTOFMEMORY);
689 ret = FALSE;
690 }
691 }
692 else
693 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
694 }
695 if (ret)
696 {
697 ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
698 info->pwszProvName, info->dwProvType, 0);
699 if (ret)
700 {
701 DWORD i;
702
703 for (i = 0; i < info->cProvParam; i++)
704 {
705 CryptSetProvParam(*phCryptProv,
706 info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
707 info->rgProvParam[i].dwFlags);
708 }
709 *pdwKeySpec = info->dwKeySpec;
710 }
711 else
712 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
713 }
714 if (allocated)
715 HeapFree(GetProcessHeap(), 0, info);
716 return ret;
717 }
718
719 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
720 DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
721 DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
722 {
723 BOOL ret = FALSE, cache = FALSE;
724 PCRYPT_KEY_PROV_INFO info = NULL;
725 CERT_KEY_CONTEXT keyContext;
726 DWORD size;
727
728 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
729 phCryptProv, pdwKeySpec, pfCallerFreeProv);
730
731 if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
732 {
733 DWORD size = 0;
734
735 ret = CertGetCertificateContextProperty(pCert,
736 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
737 if (ret)
738 {
739 info = HeapAlloc(GetProcessHeap(), 0, size);
740 ret = CertGetCertificateContextProperty(pCert,
741 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
742 if (ret)
743 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
744 }
745 }
746 else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
747 cache = TRUE;
748 *phCryptProv = 0;
749 if (cache)
750 {
751 size = sizeof(keyContext);
752 ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
753 &keyContext, &size);
754 if (ret)
755 {
756 *phCryptProv = keyContext.hCryptProv;
757 if (pdwKeySpec)
758 *pdwKeySpec = keyContext.dwKeySpec;
759 if (pfCallerFreeProv)
760 *pfCallerFreeProv = !cache;
761 }
762 }
763 if (!*phCryptProv)
764 {
765 ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
766 &keyContext.hCryptProv, &keyContext.dwKeySpec);
767 if (ret)
768 {
769 *phCryptProv = keyContext.hCryptProv;
770 if (pdwKeySpec)
771 *pdwKeySpec = keyContext.dwKeySpec;
772 if (cache)
773 {
774 keyContext.cbSize = sizeof(keyContext);
775 if (CertSetCertificateContextProperty(pCert,
776 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
777 {
778 if (pfCallerFreeProv)
779 *pfCallerFreeProv = FALSE;
780 }
781 }
782 else
783 {
784 if (pfCallerFreeProv)
785 *pfCallerFreeProv = TRUE;
786 }
787 }
788 }
789 HeapFree(GetProcessHeap(), 0, info);
790 return ret;
791 }
792
793 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
794 const CRYPT_KEY_PROV_INFO *keyProvInfo)
795 {
796 HCRYPTPROV csp;
797 BOOL matches = FALSE;
798
799 if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
800 keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
801 {
802 DWORD size;
803
804 /* Need to sign something to verify the sig. What to sign? Why not
805 * the certificate itself?
806 */
807 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
808 pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
809 &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
810 {
811 BYTE *certEncoded = CryptMemAlloc(size);
812
813 if (certEncoded)
814 {
815 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
816 pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
817 pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
818 NULL, certEncoded, &size))
819 {
820 if (size == pCert->cbCertEncoded &&
821 !memcmp(certEncoded, pCert->pbCertEncoded, size))
822 matches = TRUE;
823 }
824 CryptMemFree(certEncoded);
825 }
826 }
827 CryptReleaseContext(csp, 0);
828 }
829 return matches;
830 }
831
832 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
833 CRYPT_KEY_PROV_INFO *keyProvInfo)
834 {
835 CRYPT_KEY_PROV_INFO copy;
836 WCHAR containerW[MAX_PATH];
837 BOOL matches = FALSE;
838
839 MultiByteToWideChar(CP_ACP, 0, container, -1,
840 containerW, sizeof(containerW) / sizeof(containerW[0]));
841 /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
842 * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
843 * name.
844 */
845 memcpy(&copy, keyProvInfo, sizeof(copy));
846 copy.pwszContainerName = containerW;
847 matches = key_prov_info_matches_cert(pCert, &copy);
848 if (matches)
849 {
850 keyProvInfo->pwszContainerName =
851 CryptMemAlloc((strlenW(containerW) + 1) * sizeof(WCHAR));
852 if (keyProvInfo->pwszContainerName)
853 {
854 strcpyW(keyProvInfo->pwszContainerName, containerW);
855 keyProvInfo->dwKeySpec = AT_SIGNATURE;
856 }
857 else
858 matches = FALSE;
859 }
860 return matches;
861 }
862
863 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
864 * private key matches pCert's public key. Upon success, updates keyProvInfo
865 * with the matching container's info (free keyProvInfo.pwszContainerName upon
866 * success.)
867 * Returns TRUE if found, FALSE if not.
868 */
869 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
870 CRYPT_KEY_PROV_INFO *keyProvInfo)
871 {
872 HCRYPTPROV defProvider;
873 BOOL ret, found = FALSE;
874 char containerA[MAX_PATH];
875
876 assert(keyProvInfo->pwszContainerName == NULL);
877 if ((ret = CryptAcquireContextW(&defProvider, NULL,
878 keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
879 keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
880 {
881 DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
882
883 while (ret && !found)
884 {
885 DWORD size = sizeof(containerA);
886
887 ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
888 (BYTE *)containerA, &size, enumFlags);
889 if (ret)
890 found = container_matches_cert(pCert, containerA, keyProvInfo);
891 if (enumFlags & CRYPT_FIRST)
892 {
893 enumFlags &= ~CRYPT_FIRST;
894 enumFlags |= CRYPT_NEXT;
895 }
896 }
897 CryptReleaseContext(defProvider, 0);
898 }
899 return found;
900 }
901
902 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
903 {
904 BOOL found = FALSE, ret = TRUE;
905 DWORD index = 0, cbProvName = 0;
906 CRYPT_KEY_PROV_INFO keyProvInfo;
907
908 TRACE("(%p, %08x)\n", pCert, dwFlags);
909
910 memset(&keyProvInfo, 0, sizeof(keyProvInfo));
911 while (ret && !found)
912 {
913 DWORD size = 0;
914
915 ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
916 NULL, &size);
917 if (ret)
918 {
919 if (size <= cbProvName)
920 ret = CryptEnumProvidersW(index, NULL, 0,
921 &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
922 else
923 {
924 CryptMemFree(keyProvInfo.pwszProvName);
925 keyProvInfo.pwszProvName = CryptMemAlloc(size);
926 if (keyProvInfo.pwszProvName)
927 {
928 cbProvName = size;
929 ret = CryptEnumProvidersW(index, NULL, 0,
930 &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
931 if (ret)
932 {
933 if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
934 keyProvInfo.dwFlags |= CRYPT_SILENT;
935 if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
936 !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
937 CRYPT_FIND_MACHINE_KEYSET_FLAG)))
938 {
939 keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
940 found = find_key_prov_info_in_provider(pCert,
941 &keyProvInfo);
942 }
943 if (!found)
944 {
945 if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
946 !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
947 CRYPT_FIND_MACHINE_KEYSET_FLAG)))
948 {
949 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
950 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
951 found = find_key_prov_info_in_provider(pCert,
952 &keyProvInfo);
953 }
954 }
955 }
956 }
957 else
958 ret = FALSE;
959 }
960 index++;
961 }
962 }
963 if (found)
964 CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
965 0, &keyProvInfo);
966 CryptMemFree(keyProvInfo.pwszProvName);
967 CryptMemFree(keyProvInfo.pwszContainerName);
968 return found;
969 }
970
971 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
972 {
973 BOOL matches = FALSE;
974 DWORD size;
975
976 if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
977 NULL, &size))
978 {
979 CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
980
981 if (keyProvInfo)
982 {
983 if (CertGetCertificateContextProperty(pCert,
984 CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
985 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
986 CryptMemFree(keyProvInfo);
987 }
988 }
989 return matches;
990 }
991
992 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
993 DWORD dwFlags, void *pvReserved)
994 {
995 BOOL matches = FALSE;
996
997 TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
998
999 matches = cert_prov_info_matches_cert(pCert);
1000 if (!matches)
1001 matches = find_matching_provider(pCert, dwFlags);
1002 return matches;
1003 }
1004
1005 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1006 PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1007 {
1008 BOOL ret;
1009
1010 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1011
1012 ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1013 &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1014 &pCertId2->SerialNumber);
1015 TRACE("returning %d\n", ret);
1016 return ret;
1017 }
1018
1019 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1020 PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1021 {
1022 BOOL ret;
1023
1024 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1025
1026 if (pCertName1->cbData == pCertName2->cbData)
1027 {
1028 if (pCertName1->cbData)
1029 ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1030 pCertName1->cbData);
1031 else
1032 ret = TRUE;
1033 }
1034 else
1035 ret = FALSE;
1036 TRACE("returning %d\n", ret);
1037 return ret;
1038 }
1039
1040 /* Returns the number of significant bytes in pInt, where a byte is
1041 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1042 * for negative numbers. pInt is assumed to be little-endian.
1043 */
1044 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1045 {
1046 DWORD ret = pInt->cbData;
1047
1048 while (ret > 1)
1049 {
1050 if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1051 ret--;
1052 else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1053 ret--;
1054 else
1055 break;
1056 }
1057 return ret;
1058 }
1059
1060 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1061 PCRYPT_INTEGER_BLOB pInt2)
1062 {
1063 BOOL ret;
1064 DWORD cb1, cb2;
1065
1066 TRACE("(%p, %p)\n", pInt1, pInt2);
1067
1068 cb1 = CRYPT_significantBytes(pInt1);
1069 cb2 = CRYPT_significantBytes(pInt2);
1070 if (cb1 == cb2)
1071 {
1072 if (cb1)
1073 ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1074 else
1075 ret = TRUE;
1076 }
1077 else
1078 ret = FALSE;
1079 TRACE("returning %d\n", ret);
1080 return ret;
1081 }
1082
1083 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1084 PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1085 {
1086 BOOL ret;
1087
1088 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1089
1090 switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1091 {
1092 case 0: /* Seems to mean "raw binary bits" */
1093 if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1094 pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1095 {
1096 if (pPublicKey2->PublicKey.cbData)
1097 ret = !memcmp(pPublicKey1->PublicKey.pbData,
1098 pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1099 else
1100 ret = TRUE;
1101 }
1102 else
1103 ret = FALSE;
1104 break;
1105 default:
1106 WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1107 /* FALLTHROUGH */
1108 case X509_ASN_ENCODING:
1109 {
1110 BLOBHEADER *pblob1, *pblob2;
1111 DWORD length;
1112 ret = FALSE;
1113 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1114 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1115 0, NULL, &length))
1116 {
1117 pblob1 = CryptMemAlloc(length);
1118 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1119 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1120 0, pblob1, &length))
1121 {
1122 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1123 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1124 0, NULL, &length))
1125 {
1126 pblob2 = CryptMemAlloc(length);
1127 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1128 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1129 0, pblob2, &length))
1130 {
1131 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1132 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1133 *pk2 = (LPVOID)(pblob2 + 1);
1134 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1135 && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1136 }
1137 CryptMemFree(pblob2);
1138 }
1139 }
1140 CryptMemFree(pblob1);
1141 }
1142
1143 break;
1144 }
1145 }
1146 return ret;
1147 }
1148
1149 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1150 PCERT_PUBLIC_KEY_INFO pPublicKey)
1151 {
1152 DWORD len = 0;
1153
1154 TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1155
1156 if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1157 {
1158 SetLastError(ERROR_FILE_NOT_FOUND);
1159 return 0;
1160 }
1161 if (pPublicKey->Algorithm.pszObjId &&
1162 !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1163 {
1164 FIXME("unimplemented for DH public keys\n");
1165 SetLastError(CRYPT_E_ASN1_BADTAG);
1166 }
1167 else
1168 {
1169 DWORD size;
1170 PBYTE buf;
1171 BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
1172 RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1173 pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1174 &size);
1175
1176 if (ret)
1177 {
1178 RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1179
1180 len = rsaPubKey->bitlen;
1181 LocalFree(buf);
1182 }
1183 }
1184 return len;
1185 }
1186
1187 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1188 DWORD dwFlags, const void *pvPara);
1189
1190 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1191 DWORD dwFlags, const void *pvPara)
1192 {
1193 BOOL ret;
1194 BYTE hash[16];
1195 DWORD size = sizeof(hash);
1196
1197 ret = CertGetCertificateContextProperty(pCertContext,
1198 CERT_MD5_HASH_PROP_ID, hash, &size);
1199 if (ret)
1200 {
1201 const CRYPT_HASH_BLOB *pHash = pvPara;
1202
1203 if (size == pHash->cbData)
1204 ret = !memcmp(pHash->pbData, hash, size);
1205 else
1206 ret = FALSE;
1207 }
1208 return ret;
1209 }
1210
1211 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1212 DWORD dwFlags, const void *pvPara)
1213 {
1214 BOOL ret;
1215 BYTE hash[20];
1216 DWORD size = sizeof(hash);
1217
1218 ret = CertGetCertificateContextProperty(pCertContext,
1219 CERT_SHA1_HASH_PROP_ID, hash, &size);
1220 if (ret)
1221 {
1222 const CRYPT_HASH_BLOB *pHash = pvPara;
1223
1224 if (size == pHash->cbData)
1225 ret = !memcmp(pHash->pbData, hash, size);
1226 else
1227 ret = FALSE;
1228 }
1229 return ret;
1230 }
1231
1232 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1233 DWORD dwFlags, const void *pvPara)
1234 {
1235 CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1236 BOOL ret;
1237
1238 if (dwType & CERT_INFO_SUBJECT_FLAG)
1239 toCompare = &pCertContext->pCertInfo->Subject;
1240 else
1241 toCompare = &pCertContext->pCertInfo->Issuer;
1242 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1243 toCompare, blob);
1244 return ret;
1245 }
1246
1247 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1248 DWORD dwType, DWORD dwFlags, const void *pvPara)
1249 {
1250 CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1251 BOOL ret;
1252
1253 ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1254 &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1255 return ret;
1256 }
1257
1258 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1259 DWORD dwType, DWORD dwFlags, const void *pvPara)
1260 {
1261 CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1262 BOOL ret;
1263
1264 /* Matching serial number and subject match.. */
1265 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1266 &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1267 if (ret)
1268 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1269 &pCertInfo->SerialNumber);
1270 else
1271 {
1272 /* failing that, if the serial number and issuer match, we match */
1273 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1274 &pCertInfo->SerialNumber);
1275 if (ret)
1276 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1277 &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1278 }
1279 TRACE("returning %d\n", ret);
1280 return ret;
1281 }
1282
1283 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1284 DWORD dwFlags, const void *pvPara)
1285 {
1286 CERT_ID *id = (CERT_ID *)pvPara;
1287 BOOL ret;
1288
1289 switch (id->dwIdChoice)
1290 {
1291 case CERT_ID_ISSUER_SERIAL_NUMBER:
1292 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1293 &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1294 if (ret)
1295 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1296 &id->u.IssuerSerialNumber.SerialNumber);
1297 break;
1298 case CERT_ID_SHA1_HASH:
1299 ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1300 &id->u.HashId);
1301 break;
1302 case CERT_ID_KEY_IDENTIFIER:
1303 {
1304 DWORD size = 0;
1305
1306 ret = CertGetCertificateContextProperty(pCertContext,
1307 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1308 if (ret && size == id->u.KeyId.cbData)
1309 {
1310 LPBYTE buf = CryptMemAlloc(size);
1311
1312 if (buf)
1313 {
1314 CertGetCertificateContextProperty(pCertContext,
1315 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1316 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1317 CryptMemFree(buf);
1318 }
1319 }
1320 else
1321 ret = FALSE;
1322 break;
1323 }
1324 default:
1325 ret = FALSE;
1326 break;
1327 }
1328 return ret;
1329 }
1330
1331 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1332 DWORD dwFlags, const void *pvPara)
1333 {
1334 PCCERT_CONTEXT toCompare = pvPara;
1335 return CertCompareCertificate(pCertContext->dwCertEncodingType,
1336 pCertContext->pCertInfo, toCompare->pCertInfo);
1337 }
1338
1339 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1340 DWORD dwFlags, const void *pvPara)
1341 {
1342 const CRYPT_HASH_BLOB *hash = pvPara;
1343 DWORD size = 0;
1344 BOOL ret;
1345
1346 ret = CertGetCertificateContextProperty(pCertContext,
1347 CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1348 if (ret && size == hash->cbData)
1349 {
1350 LPBYTE buf = CryptMemAlloc(size);
1351
1352 if (buf)
1353 {
1354 CertGetCertificateContextProperty(pCertContext,
1355 CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1356 ret = !memcmp(buf, hash->pbData, size);
1357 CryptMemFree(buf);
1358 }
1359 }
1360 else
1361 ret = FALSE;
1362 return ret;
1363 }
1364
1365 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1366 PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1367 const void *pvPara)
1368 {
1369 BOOL matches = FALSE;
1370 PCCERT_CONTEXT ret;
1371
1372 ret = prev;
1373 do {
1374 ret = CertEnumCertificatesInStore(store, ret);
1375 if (ret)
1376 matches = compare(ret, dwType, dwFlags, pvPara);
1377 } while (ret != NULL && !matches);
1378 return ret;
1379 }
1380
1381 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1382 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1383
1384 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1385 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1386 {
1387 return CertEnumCertificatesInStore(store, prev);
1388 }
1389
1390 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1391 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1392 {
1393 BOOL ret;
1394 PCCERT_CONTEXT found = NULL, subject = pvPara;
1395 PCERT_EXTENSION ext;
1396 DWORD size;
1397
1398 if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1399 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1400 {
1401 CERT_AUTHORITY_KEY_ID_INFO *info;
1402
1403 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1404 X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1405 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1406 &info, &size);
1407 if (ret)
1408 {
1409 CERT_ID id;
1410
1411 if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1412 {
1413 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1414 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1415 sizeof(CERT_NAME_BLOB));
1416 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1417 &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1418 }
1419 else if (info->KeyId.cbData)
1420 {
1421 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1422 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1423 }
1424 else
1425 ret = FALSE;
1426 if (ret)
1427 found = cert_compare_certs_in_store(store, prev,
1428 compare_cert_by_cert_id, dwType, dwFlags, &id);
1429 LocalFree(info);
1430 }
1431 }
1432 else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1433 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1434 {
1435 CERT_AUTHORITY_KEY_ID2_INFO *info;
1436
1437 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1438 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1439 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1440 &info, &size);
1441 if (ret)
1442 {
1443 CERT_ID id;
1444
1445 if (info->AuthorityCertIssuer.cAltEntry &&
1446 info->AuthorityCertSerialNumber.cbData)
1447 {
1448 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1449 DWORD i;
1450
1451 for (i = 0; !directoryName &&
1452 i < info->AuthorityCertIssuer.cAltEntry; i++)
1453 if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1454 == CERT_ALT_NAME_DIRECTORY_NAME)
1455 directoryName =
1456 &info->AuthorityCertIssuer.rgAltEntry[i];
1457 if (directoryName)
1458 {
1459 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1460 memcpy(&id.u.IssuerSerialNumber.Issuer,
1461 &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1462 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1463 &info->AuthorityCertSerialNumber,
1464 sizeof(CRYPT_INTEGER_BLOB));
1465 }
1466 else
1467 {
1468 FIXME("no supported name type in authority key id2\n");
1469 ret = FALSE;
1470 }
1471 }
1472 else if (info->KeyId.cbData)
1473 {
1474 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1475 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1476 }
1477 else
1478 ret = FALSE;
1479 if (ret)
1480 found = cert_compare_certs_in_store(store, prev,
1481 compare_cert_by_cert_id, dwType, dwFlags, &id);
1482 LocalFree(info);
1483 }
1484 }
1485 else
1486 found = cert_compare_certs_in_store(store, prev,
1487 compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1488 dwFlags, &subject->pCertInfo->Issuer);
1489 return found;
1490 }
1491
1492 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1493 DWORD dwType, DWORD dwFlags, const void *pvPara)
1494 {
1495 PCERT_NAME_BLOB name;
1496 DWORD len;
1497 BOOL ret = FALSE;
1498
1499 if (dwType & CERT_INFO_SUBJECT_FLAG)
1500 name = &pCertContext->pCertInfo->Subject;
1501 else
1502 name = &pCertContext->pCertInfo->Issuer;
1503 len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1504 CERT_SIMPLE_NAME_STR, NULL, 0);
1505 if (len)
1506 {
1507 LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1508
1509 if (str)
1510 {
1511 LPWSTR ptr;
1512
1513 CertNameToStrW(pCertContext->dwCertEncodingType, name,
1514 CERT_SIMPLE_NAME_STR, str, len);
1515 for (ptr = str; *ptr; ptr++)
1516 *ptr = tolowerW(*ptr);
1517 if (strstrW(str, pvPara))
1518 ret = TRUE;
1519 CryptMemFree(str);
1520 }
1521 }
1522 return ret;
1523 }
1524
1525 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1526 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1527 {
1528 PCCERT_CONTEXT found = NULL;
1529
1530 TRACE("%s\n", debugstr_a(pvPara));
1531
1532 if (pvPara)
1533 {
1534 int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1535 LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1536
1537 if (str)
1538 {
1539 LPWSTR ptr;
1540
1541 MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1542 for (ptr = str; *ptr; ptr++)
1543 *ptr = tolowerW(*ptr);
1544 found = cert_compare_certs_in_store(store, prev,
1545 compare_cert_by_name_str, dwType, dwFlags, str);
1546 CryptMemFree(str);
1547 }
1548 }
1549 else
1550 found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1551 return found;
1552 }
1553
1554 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1555 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1556 {
1557 PCCERT_CONTEXT found = NULL;
1558
1559 TRACE("%s\n", debugstr_w(pvPara));
1560
1561 if (pvPara)
1562 {
1563 DWORD len = strlenW(pvPara);
1564 LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1565
1566 if (str)
1567 {
1568 LPCWSTR src;
1569 LPWSTR dst;
1570
1571 for (src = pvPara, dst = str; *src; src++, dst++)
1572 *dst = tolowerW(*src);
1573 *dst = 0;
1574 found = cert_compare_certs_in_store(store, prev,
1575 compare_cert_by_name_str, dwType, dwFlags, str);
1576 CryptMemFree(str);
1577 }
1578 }
1579 else
1580 found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1581 return found;
1582 }
1583
1584 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1585 DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1586 PCCERT_CONTEXT pPrevCertContext)
1587 {
1588 PCCERT_CONTEXT ret;
1589 CertFindFunc find = NULL;
1590 CertCompareFunc compare = NULL;
1591
1592 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1593 dwFlags, dwType, pvPara, pPrevCertContext);
1594
1595 switch (dwType >> CERT_COMPARE_SHIFT)
1596 {
1597 case CERT_COMPARE_ANY:
1598 find = find_cert_any;
1599 break;
1600 case CERT_COMPARE_MD5_HASH:
1601 compare = compare_cert_by_md5_hash;
1602 break;
1603 case CERT_COMPARE_SHA1_HASH:
1604 compare = compare_cert_by_sha1_hash;
1605 break;
1606 case CERT_COMPARE_NAME:
1607 compare = compare_cert_by_name;
1608 break;
1609 case CERT_COMPARE_PUBLIC_KEY:
1610 compare = compare_cert_by_public_key;
1611 break;
1612 case CERT_COMPARE_NAME_STR_A:
1613 find = find_cert_by_name_str_a;
1614 break;
1615 case CERT_COMPARE_NAME_STR_W:
1616 find = find_cert_by_name_str_w;
1617 break;
1618 case CERT_COMPARE_SUBJECT_CERT:
1619 compare = compare_cert_by_subject_cert;
1620 break;
1621 case CERT_COMPARE_CERT_ID:
1622 compare = compare_cert_by_cert_id;
1623 break;
1624 case CERT_COMPARE_ISSUER_OF:
1625 find = find_cert_by_issuer;
1626 break;
1627 case CERT_COMPARE_EXISTING:
1628 compare = compare_existing_cert;
1629 break;
1630 case CERT_COMPARE_SIGNATURE_HASH:
1631 compare = compare_cert_by_signature_hash;
1632 break;
1633 default:
1634 FIXME("find type %08x unimplemented\n", dwType);
1635 }
1636
1637 if (find)
1638 ret = find(hCertStore, dwFlags, dwType, pvPara, pPrevCertContext);
1639 else if (compare)
1640 ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1641 compare, dwType, dwFlags, pvPara);
1642 else
1643 ret = NULL;
1644 if (!ret)
1645 SetLastError(CRYPT_E_NOT_FOUND);
1646 TRACE("returning %p\n", ret);
1647 return ret;
1648 }
1649
1650 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1651 DWORD dwCertEncodingType, PCERT_INFO pCertId)
1652 {
1653 TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1654
1655 if (!pCertId)
1656 {
1657 SetLastError(E_INVALIDARG);
1658 return NULL;
1659 }
1660 return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1661 CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1662 }
1663
1664 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1665 PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1666 {
1667 static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1668 CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1669
1670 if (*pdwFlags & ~supportedFlags)
1671 {
1672 SetLastError(E_INVALIDARG);
1673 return FALSE;
1674 }
1675 if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1676 {
1677 DWORD flags = 0;
1678 PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1679 NULL, &flags);
1680
1681 /* FIXME: what if the CRL has expired? */
1682 if (crl)
1683 {
1684 if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1685 pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1686 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1687 }
1688 else
1689 *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1690 }
1691 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1692 {
1693 if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1694 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1695 }
1696 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1697 {
1698 if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1699 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1700 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1701 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1702 }
1703 return TRUE;
1704 }
1705
1706 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1707 PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1708 DWORD *pdwFlags)
1709 {
1710 PCCERT_CONTEXT ret;
1711
1712 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1713 pPrevIssuerContext, *pdwFlags);
1714
1715 if (!pSubjectContext)
1716 {
1717 SetLastError(E_INVALIDARG);
1718 return NULL;
1719 }
1720
1721 ret = CertFindCertificateInStore(hCertStore,
1722 pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1723 pSubjectContext, pPrevIssuerContext);
1724 if (ret)
1725 {
1726 if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1727 pdwFlags))
1728 {
1729 CertFreeCertificateContext(ret);
1730 ret = NULL;
1731 }
1732 }
1733 TRACE("returning %p\n", ret);
1734 return ret;
1735 }
1736
1737 typedef struct _OLD_CERT_REVOCATION_STATUS {
1738 DWORD cbSize;
1739 DWORD dwIndex;
1740 DWORD dwError;
1741 DWORD dwReason;
1742 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1743
1744 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1745 void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1746
1747 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1748 DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1749 PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1750 {
1751 BOOL ret;
1752
1753 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1754 cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1755
1756 if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1757 pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1758 {
1759 SetLastError(E_INVALIDARG);
1760 return FALSE;
1761 }
1762 if (cContext)
1763 {
1764 static HCRYPTOIDFUNCSET set = NULL;
1765 DWORD size;
1766
1767 if (!set)
1768 set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1769 ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1770 if (ret)
1771 {
1772 if (size == 1)
1773 {
1774 /* empty list */
1775 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1776 ret = FALSE;
1777 }
1778 else
1779 {
1780 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1781
1782 if (dllList)
1783 {
1784 ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1785 dllList, &size);
1786 if (ret)
1787 {
1788 for (ptr = dllList; ret && *ptr;
1789 ptr += lstrlenW(ptr) + 1)
1790 {
1791 CertVerifyRevocationFunc func;
1792 HCRYPTOIDFUNCADDR hFunc;
1793
1794 ret = CryptGetDefaultOIDFunctionAddress(set,
1795 dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1796 if (ret)
1797 {
1798 ret = func(dwEncodingType, dwRevType, cContext,
1799 rgpvContext, dwFlags, pRevPara, pRevStatus);
1800 CryptFreeOIDFunctionAddress(hFunc, 0);
1801 }
1802 }
1803 }
1804 CryptMemFree(dllList);
1805 }
1806 else
1807 {
1808 SetLastError(ERROR_OUTOFMEMORY);
1809 ret = FALSE;
1810 }
1811 }
1812 }
1813 }
1814 else
1815 ret = TRUE;
1816 return ret;
1817 }
1818
1819 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1820 CRYPT_ATTRIBUTE rgAttr[])
1821 {
1822 PCRYPT_ATTRIBUTE ret = NULL;
1823 DWORD i;
1824
1825 TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1826
1827 if (!cAttr)
1828 return NULL;
1829 if (!pszObjId)
1830 {
1831 SetLastError(ERROR_INVALID_PARAMETER);
1832 return NULL;
1833 }
1834
1835 for (i = 0; !ret && i < cAttr; i++)
1836 if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1837 ret = &rgAttr[i];
1838 return ret;
1839 }
1840
1841 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1842 CERT_EXTENSION rgExtensions[])
1843 {
1844 PCERT_EXTENSION ret = NULL;
1845 DWORD i;
1846
1847 TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1848
1849 if (!cExtensions)
1850 return NULL;
1851 if (!pszObjId)
1852 {
1853 SetLastError(ERROR_INVALID_PARAMETER);
1854 return NULL;
1855 }
1856
1857 for (i = 0; !ret && i < cExtensions; i++)
1858 if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1859 rgExtensions[i].pszObjId))
1860 ret = &rgExtensions[i];
1861 return ret;
1862 }
1863
1864 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1865 {
1866 PCERT_RDN_ATTR ret = NULL;
1867 DWORD i, j;
1868
1869 TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1870
1871 if (!pszObjId)
1872 {
1873 SetLastError(ERROR_INVALID_PARAMETER);
1874 return NULL;
1875 }
1876
1877 for (i = 0; !ret && i < pName->cRDN; i++)
1878 for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1879 if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1880 pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1881 ret = &pName->rgRDN[i].rgRDNAttr[j];
1882 return ret;
1883 }
1884
1885 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
1886 const CERT_RDN_ATTR *attr)
1887 {
1888 DWORD i, j;
1889 BOOL match = FALSE;
1890
1891 for (i = 0; !match && i < name->cRDN; i++)
1892 {
1893 for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
1894 {
1895 if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
1896 attr->pszObjId) &&
1897 name->rgRDN[i].rgRDNAttr[j].dwValueType ==
1898 attr->dwValueType)
1899 {
1900 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
1901 {
1902 LPCWSTR nameStr =
1903 (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
1904 LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
1905
1906 if (attr->Value.cbData !=
1907 name->rgRDN[i].rgRDNAttr[j].Value.cbData)
1908 match = FALSE;
1909 else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
1910 match = !strncmpiW(nameStr, attrStr,
1911 attr->Value.cbData / sizeof(WCHAR));
1912 else
1913 match = !strncmpW(nameStr, attrStr,
1914 attr->Value.cbData / sizeof(WCHAR));
1915 TRACE("%s : %s => %d\n",
1916 debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
1917 debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
1918 match);
1919 }
1920 else
1921 {
1922 LPCSTR nameStr =
1923 (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
1924 LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
1925
1926 if (attr->Value.cbData !=
1927 name->rgRDN[i].rgRDNAttr[j].Value.cbData)
1928 match = FALSE;
1929 else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
1930 match = !strncasecmp(nameStr, attrStr,
1931 attr->Value.cbData);
1932 else
1933 match = !strncmp(nameStr, attrStr, attr->Value.cbData);
1934 TRACE("%s : %s => %d\n",
1935 debugstr_an(nameStr, attr->Value.cbData),
1936 debugstr_an(attrStr, attr->Value.cbData), match);
1937 }
1938 }
1939 }
1940 }
1941 return match;
1942 }
1943
1944 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
1945 DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
1946 {
1947 CERT_NAME_INFO *name;
1948 LPCSTR type;
1949 DWORD size;
1950 BOOL ret;
1951
1952 TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
1953 pRDN);
1954
1955 type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
1956 X509_NAME;
1957 if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
1958 pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
1959 {
1960 DWORD i;
1961
1962 for (i = 0; ret && i < pRDN->cRDNAttr; i++)
1963 ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
1964 if (!ret)
1965 SetLastError(CRYPT_E_NO_MATCH);
1966 LocalFree(name);
1967 }
1968 return ret;
1969 }
1970
1971 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1972 PCERT_INFO pCertInfo)
1973 {
1974 FILETIME fileTime;
1975 LONG ret;
1976
1977 if (!pTimeToVerify)
1978 {
1979 GetSystemTimeAsFileTime(&fileTime);
1980 pTimeToVerify = &fileTime;
1981 }
1982 if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1983 {
1984 ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1985 if (ret < 0)
1986 ret = 0;
1987 }
1988 return ret;
1989 }
1990
1991 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1992 PCERT_INFO pIssuerInfo)
1993 {
1994 TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1995
1996 return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1997 && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1998 }
1999
2000 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2001 DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2002 DWORD *pcbComputedHash)
2003 {
2004 BOOL ret = TRUE;
2005 HCRYPTHASH hHash = 0;
2006
2007 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
2008 pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2009
2010 if (!hCryptProv)
2011 hCryptProv = CRYPT_GetDefaultProvider();
2012 if (!Algid)
2013 Algid = CALG_SHA1;
2014 if (ret)
2015 {
2016 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2017 if (ret)
2018 {
2019 ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2020 if (ret)
2021 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2022 pcbComputedHash, 0);
2023 CryptDestroyHash(hHash);
2024 }
2025 }
2026 return ret;
2027 }
2028
2029 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2030 DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2031 BYTE *pbComputedHash, DWORD *pcbComputedHash)
2032 {
2033 BOOL ret = TRUE;
2034 HCRYPTHASH hHash = 0;
2035
2036 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2037 dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2038
2039 if (!hCryptProv)
2040 hCryptProv = CRYPT_GetDefaultProvider();
2041 if (!Algid)
2042 Algid = CALG_MD5;
2043 if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2044 {
2045 SetLastError(ERROR_FILE_NOT_FOUND);
2046 return FALSE;
2047 }
2048 if (ret)
2049 {
2050 BYTE *buf;
2051 DWORD size = 0;
2052
2053 ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2054 X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2055 (LPBYTE)&buf, &size);
2056 if (ret)
2057 {
2058 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2059 if (ret)
2060 {
2061 ret = CryptHashData(hHash, buf, size, 0);
2062 if (ret)
2063 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2064 pcbComputedHash, 0);
2065 CryptDestroyHash(hHash);
2066 }
2067 LocalFree(buf);
2068 }
2069 }
2070 return ret;
2071 }
2072
2073 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2074 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2075 BYTE *pbComputedHash, DWORD *pcbComputedHash)
2076 {
2077 BOOL ret;
2078 CERT_SIGNED_CONTENT_INFO *info;
2079 DWORD size;
2080
2081 TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2082 pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2083
2084 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2085 pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2086 if (ret)
2087 {
2088 PCCRYPT_OID_INFO oidInfo;
2089 HCRYPTHASH hHash;
2090
2091 if (!hCryptProv)
2092 hCryptProv = CRYPT_GetDefaultProvider();
2093 oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2094 info->SignatureAlgorithm.pszObjId, 0);
2095 if (!oidInfo)
2096 {
2097 SetLastError(NTE_BAD_ALGID);
2098 ret = FALSE;
2099 }
2100 else
2101 {
2102 ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2103 if (ret)
2104 {
2105 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2106 info->ToBeSigned.cbData, 0);
2107 if (ret)
2108 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2109 pcbComputedHash, 0);
2110 CryptDestroyHash(hHash);
2111 }
2112 }
2113 LocalFree(info);
2114 }
2115 return ret;
2116 }
2117
2118 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2119 DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2120 DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2121 const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2122 {
2123 BOOL ret;
2124 PCCRYPT_OID_INFO info;
2125 HCRYPTHASH hHash;
2126
2127 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2128 dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2129 pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2130
2131 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2132 pSignatureAlgorithm->pszObjId, 0);
2133 if (!info)
2134 {
2135 SetLastError(NTE_BAD_ALGID);
2136 return FALSE;
2137 }
2138 if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2139 {
2140 if (!hCryptProv)
2141 hCryptProv = CRYPT_GetDefaultProvider();
2142 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2143 if (ret)
2144 {
2145 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2146 cbEncodedToBeSigned, 0);
2147 if (ret)
2148 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2149 pcbSignature, 0);
2150 CryptDestroyHash(hHash);
2151 }
2152 }
2153 else
2154 {
2155 if (!hCryptProv)
2156 {
2157 SetLastError(ERROR_INVALID_PARAMETER);
2158 ret = FALSE;
2159 }
2160 else
2161 {
2162 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2163 if (ret)
2164 {
2165 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2166 cbEncodedToBeSigned, 0);
2167 if (ret)
2168 ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2169 pcbSignature);
2170 CryptDestroyHash(hHash);
2171 }
2172 }
2173 }
2174 return ret;
2175 }
2176
2177 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2178 DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2179 const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2180 const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2181 {
2182 BOOL ret;
2183 DWORD encodedSize, hashSize;
2184
2185 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2186 dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2187 pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2188
2189 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2190 NULL, &encodedSize);
2191 if (ret)
2192 {
2193 PBYTE encoded = CryptMemAlloc(encodedSize);
2194
2195 if (encoded)
2196 {
2197 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2198 pvStructInfo, encoded, &encodedSize);
2199 if (ret)
2200 {
2201 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2202 dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2203 pvHashAuxInfo, NULL, &hashSize);
2204 if (ret)
2205 {
2206 PBYTE hash = CryptMemAlloc(hashSize);
2207
2208 if (hash)
2209 {
2210 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2211 dwCertEncodingType, encoded, encodedSize,
2212 pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2213 if (ret)
2214 {
2215 CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2216
2217 info.ToBeSigned.cbData = encodedSize;
2218 info.ToBeSigned.pbData = encoded;
2219 memcpy(&info.SignatureAlgorithm,
2220 pSignatureAlgorithm,
2221 sizeof(info.SignatureAlgorithm));
2222 info.Signature.cbData = hashSize;
2223 info.Signature.pbData = hash;
2224 info.Signature.cUnusedBits = 0;
2225 ret = CryptEncodeObject(dwCertEncodingType,
2226 X509_CERT, &info, pbEncoded, pcbEncoded);
2227 }
2228 CryptMemFree(hash);
2229 }
2230 }
2231 }
2232 CryptMemFree(encoded);
2233 }
2234 }
2235 return ret;
2236 }
2237
2238 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2239 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2240 PCERT_PUBLIC_KEY_INFO pPublicKey)
2241 {
2242 CRYPT_DATA_BLOB blob = { cbEncoded, (BYTE *)pbEncoded };
2243
2244 return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2245 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &blob,
2246 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2247 }
2248
2249 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
2250 DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
2251 const CERT_SIGNED_CONTENT_INFO *signedCert)
2252 {
2253 BOOL ret;
2254 HCRYPTKEY key;
2255 PCCRYPT_OID_INFO info;
2256 ALG_ID pubKeyID, hashID;
2257
2258 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2259 signedCert->SignatureAlgorithm.pszObjId, 0);
2260 if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2261 {
2262 SetLastError(NTE_BAD_ALGID);
2263 return FALSE;
2264 }
2265 hashID = info->u.Algid;
2266 if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2267 pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2268 else
2269 pubKeyID = hashID;
2270 /* Load the default provider if necessary */
2271 if (!hCryptProv)
2272 hCryptProv = CRYPT_GetDefaultProvider();
2273 ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2274 pubKeyInfo, pubKeyID, 0, NULL, &key);
2275 if (ret)
2276 {
2277 HCRYPTHASH hash;
2278
2279 ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2280 if (ret)
2281 {
2282 ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2283 signedCert->ToBeSigned.cbData, 0);
2284 if (ret)
2285 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2286 signedCert->Signature.cbData, key, NULL, 0);
2287 CryptDestroyHash(hash);
2288 }
2289 CryptDestroyKey(key);
2290 }
2291 return ret;
2292 }
2293
2294 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2295 DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2296 DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2297 {
2298 BOOL ret = TRUE;
2299 CRYPT_DATA_BLOB subjectBlob;
2300
2301 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2302 dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2303 dwFlags, pvReserved);
2304
2305 switch (dwSubjectType)
2306 {
2307 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2308 {
2309 PCRYPT_DATA_BLOB blob = pvSubject;
2310
2311 subjectBlob.pbData = blob->pbData;
2312 subjectBlob.cbData = blob->cbData;
2313 break;
2314 }
2315 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2316 {
2317 PCERT_CONTEXT context = pvSubject;
2318
2319 subjectBlob.pbData = context->pbCertEncoded;
2320 subjectBlob.cbData = context->cbCertEncoded;
2321 break;
2322 }
2323 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2324 {
2325 PCRL_CONTEXT context = pvSubject;
2326
2327 subjectBlob.pbData = context->pbCrlEncoded;
2328 subjectBlob.cbData = context->cbCrlEncoded;
2329 break;
2330 }
2331 default:
2332 SetLastError(E_INVALIDARG);
2333 ret = FALSE;
2334 }
2335
2336 if (ret)
2337 {
2338 PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2339 DWORD size = 0;
2340
2341 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2342 subjectBlob.pbData, subjectBlob.cbData,
2343 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2344 &signedCert, &size);
2345 if (ret)
2346 {
2347 switch (dwIssuerType)
2348 {
2349 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2350 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2351 dwCertEncodingType, pvIssuer,
2352 signedCert);
2353 break;
2354 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2355 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2356 dwCertEncodingType,
2357 &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2358 signedCert);
2359 break;
2360 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2361 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2362 ret = FALSE;
2363 break;
2364 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2365 if (pvIssuer)
2366 {
2367 SetLastError(E_INVALIDARG);
2368 ret = FALSE;
2369 }
2370 else
2371 {
2372 FIXME("unimplemented for NULL signer\n");
2373 SetLastError(E_INVALIDARG);
2374 ret = FALSE;
2375 }
2376 break;
2377 default:
2378 SetLastError(E_INVALIDARG);
2379 ret = FALSE;
2380 }
2381 LocalFree(signedCert);
2382 }
2383 }
2384 return ret;
2385 }
2386
2387 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2388 PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2389 {
2390 PCERT_EXTENSION ext;
2391 BOOL ret = FALSE;
2392
2393 TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2394 cbKeyUsage);
2395
2396 ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2397 pCertInfo->rgExtension);
2398 if (ext)
2399 {
2400 CRYPT_BIT_BLOB usage;
2401 DWORD size = sizeof(usage);
2402
2403 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2404 ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2405 &usage, &size);
2406 if (ret)
2407 {
2408 if (cbKeyUsage < usage.cbData)
2409 ret = FALSE;
2410 else
2411 {
2412 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2413 if (cbKeyUsage > usage.cbData)
2414 memset(pbKeyUsage + usage.cbData, 0,
2415 cbKeyUsage - usage.cbData);
2416 }
2417 }
2418 }
2419 else
2420 SetLastError(0);
2421 return ret;
2422 }
2423
2424 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2425 PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2426 {
2427 PCERT_ENHKEY_USAGE usage = NULL;
2428 DWORD bytesNeeded;
2429 BOOL ret = TRUE;
2430
2431 if (!pCertContext || !pcbUsage)
2432 {
2433 SetLastError(ERROR_INVALID_PARAMETER);
2434 return FALSE;
2435 }
2436
2437 TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2438
2439 if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2440 {
2441 DWORD propSize = 0;
2442
2443 if (CertGetCertificateContextProperty(pCertContext,
2444 CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2445 {
2446 LPBYTE buf = CryptMemAlloc(propSize);
2447
2448 if (buf)
2449 {
2450 if (CertGetCertificateContextProperty(pCertContext,
2451 CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2452 {
2453 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2454 X509_ENHANCED_KEY_USAGE, buf, propSize,
2455 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2456 }
2457 CryptMemFree(buf);
2458 }
2459 }
2460 }
2461 if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2462 {
2463 PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2464 pCertContext->pCertInfo->cExtension,
2465 pCertContext->pCertInfo->rgExtension);
2466
2467 if (ext)
2468 {
2469 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2470 X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
2471 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2472 }
2473 }
2474 if (!usage)
2475 {
2476 /* If a particular location is specified, this should fail. Otherwise
2477 * it should succeed with an empty usage. (This is true on Win2k and
2478 * later, which we emulate.)
2479 */
2480 if (dwFlags)
2481 {
2482 SetLastError(CRYPT_E_NOT_FOUND);
2483 ret = FALSE;
2484 }
2485 else
2486 bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
2487 }
2488
2489 if (ret)
2490 {
2491 if (!pUsage)
2492 *pcbUsage = bytesNeeded;
2493 else if (*pcbUsage < bytesNeeded)
2494 {
2495 SetLastError(ERROR_MORE_DATA);
2496 *pcbUsage = bytesNeeded;
2497 ret = FALSE;
2498 }
2499 else
2500 {
2501 *pcbUsage = bytesNeeded;
2502 if (usage)
2503 {
2504 DWORD i;
2505 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
2506 sizeof(CERT_ENHKEY_USAGE) +
2507 usage->cUsageIdentifier * sizeof(LPSTR));
2508
2509 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
2510 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
2511 sizeof(CERT_ENHKEY_USAGE));
2512 for (i = 0; i < usage->cUsageIdentifier; i++)
2513 {
2514 pUsage->rgpszUsageIdentifier[i] = nextOID;
2515 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2516 nextOID += strlen(nextOID) + 1;
2517 }
2518 }
2519 else
2520 pUsage->cUsageIdentifier = 0;
2521 }
2522 }
2523 if (usage)
2524 LocalFree(usage);
2525 TRACE("returning %d\n", ret);
2526 return ret;
2527 }
2528
2529 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
2530 PCERT_ENHKEY_USAGE pUsage)
2531 {
2532 BOOL ret;
2533
2534 TRACE("(%p, %p)\n", pCertContext, pUsage);
2535
2536 if (pUsage)
2537 {
2538 CRYPT_DATA_BLOB blob = { 0, NULL };
2539
2540 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2541 pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2542 if (ret)
2543 {
2544 ret = CertSetCertificateContextProperty(pCertContext,
2545 CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2546 LocalFree(blob.pbData);
2547 }
2548 }
2549 else
2550 ret = CertSetCertificateContextProperty(pCertContext,
2551 CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2552 return ret;
2553 }
2554
2555 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2556 LPCSTR pszUsageIdentifier)
2557 {
2558 BOOL ret;
2559 DWORD size;
2560
2561 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2562
2563 if (CertGetEnhancedKeyUsage(pCertContext,
2564 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2565 {
2566 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2567
2568 if (usage)
2569 {
2570 ret = CertGetEnhancedKeyUsage(pCertContext,
2571 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2572 if (ret)
2573 {
2574 DWORD i;
2575 BOOL exists = FALSE;
2576
2577 /* Make sure usage doesn't already exist */
2578 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2579 {
2580 if (!strcmp(usage->rgpszUsageIdentifier[i],
2581 pszUsageIdentifier))
2582 exists = TRUE;
2583 }
2584 if (!exists)
2585 {
2586 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2587 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2588
2589 if (newUsage)
2590 {
2591 LPSTR nextOID;
2592
2593 newUsage->rgpszUsageIdentifier = (LPSTR *)
2594 ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2595 nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2596 + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2597 for (i = 0; i < usage->cUsageIdentifier; i++)
2598 {
2599 newUsage->rgpszUsageIdentifier[i] = nextOID;
2600 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2601 nextOID += strlen(nextOID) + 1;
2602 }
2603 newUsage->rgpszUsageIdentifier[i] = nextOID;
2604 strcpy(nextOID, pszUsageIdentifier);
2605 newUsage->cUsageIdentifier = i + 1;
2606 ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2607 CryptMemFree(newUsage);
2608 }
2609 else
2610 ret = FALSE;
2611 }
2612 }
2613 CryptMemFree(usage);
2614 }
2615 else
2616 ret = FALSE;
2617 }
2618 else
2619 {
2620 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2621 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2622
2623 if (usage)
2624 {
2625 usage->rgpszUsageIdentifier =
2626 (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2627 usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2628 sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2629 strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2630 usage->cUsageIdentifier = 1;
2631 ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2632 CryptMemFree(usage);
2633 }
2634 else
2635 ret = FALSE;
2636 }
2637 return ret;
2638 }
2639
2640 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2641 LPCSTR pszUsageIdentifier)
2642 {
2643 BOOL ret;
2644 DWORD size;
2645 CERT_ENHKEY_USAGE usage;
2646
2647 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2648
2649 size = sizeof(usage);
2650 ret = CertGetEnhancedKeyUsage(pCertContext,
2651 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2652 if (!ret && GetLastError() == ERROR_MORE_DATA)
2653 {
2654 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2655
2656 if (pUsage)
2657 {
2658 ret = CertGetEnhancedKeyUsage(pCertContext,
2659 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2660 if (ret)
2661 {
2662 if (pUsage->cUsageIdentifier)
2663 {
2664 DWORD i;
2665 BOOL found = FALSE;
2666
2667 for (i = 0; i < pUsage->cUsageIdentifier; i++)
2668 {
2669 if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2670 pszUsageIdentifier))
2671 found = TRUE;
2672 if (found && i < pUsage->cUsageIdentifier - 1)
2673 pUsage->rgpszUsageIdentifier[i] =
2674 pUsage->rgpszUsageIdentifier[i + 1];
2675 }
2676 pUsage->cUsageIdentifier--;
2677 /* Remove the usage if it's empty */
2678 if (pUsage->cUsageIdentifier)
2679 ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2680 else
2681 ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2682 }
2683 }
2684 CryptMemFree(pUsage);
2685 }
2686 else
2687 ret = FALSE;
2688 }
2689 else
2690 {
2691 /* it fit in an empty usage, therefore there's nothing to remove */
2692 ret = TRUE;
2693 }
2694 return ret;
2695 }
2696
2697 struct BitField
2698 {
2699 DWORD cIndexes;
2700 DWORD *indexes;
2701 };
2702
2703 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2704
2705 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2706 {
2707 DWORD indexIndex = bit / BITS_PER_DWORD;
2708
2709 if (indexIndex + 1 > field->cIndexes)
2710 {
2711 if (field->cIndexes)
2712 field->indexes = CryptMemRealloc(field->indexes,
2713 (indexIndex + 1) * sizeof(DWORD));
2714 else
2715 field->indexes = CryptMemAlloc(sizeof(DWORD));
2716 if (field->indexes)
2717 {
2718 field->indexes[indexIndex] = 0;
2719 field->cIndexes = indexIndex + 1;
2720 }
2721 }
2722 if (field->indexes)
2723 field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2724 }
2725
2726 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
2727 {
2728 BOOL set = FALSE;
2729 DWORD indexIndex = bit / BITS_PER_DWORD;
2730
2731 assert(field->cIndexes);
2732 set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2733 return set;
2734 }
2735
2736 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2737 int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2738 {
2739 BOOL ret = TRUE;
2740 DWORD i, cbOIDs = 0;
2741 BOOL allUsagesValid = TRUE;
2742 CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2743
2744 TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2745 rghOIDs, *pcbOIDs);
2746
2747 for (i = 0; i < cCerts; i++)
2748 {
2749 CERT_ENHKEY_USAGE usage;
2750 DWORD size = sizeof(usage);
2751
2752 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2753 /* Success is deliberately ignored: it implies all usages are valid */
2754 if (!ret && GetLastError() == ERROR_MORE_DATA)
2755 {
2756 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2757
2758 allUsagesValid = FALSE;
2759 if (pUsage)
2760 {
2761 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2762 if (ret)
2763 {
2764 if (!validUsages.cUsageIdentifier)
2765 {
2766 DWORD j;
2767
2768 cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2769 validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2770 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2771 cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2772 + 1;
2773 validUsages.rgpszUsageIdentifier =
2774 CryptMemAlloc(cbOIDs);
2775 if (validUsages.rgpszUsageIdentifier)
2776 {
2777 LPSTR nextOID = (LPSTR)
2778 ((LPBYTE)validUsages.rgpszUsageIdentifier +
2779 validUsages.cUsageIdentifier * sizeof(LPSTR));
2780
2781 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2782 {
2783 validUsages.rgpszUsageIdentifier[j] = nextOID;
2784 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2785 pUsage->rgpszUsageIdentifier[j]);
2786 nextOID += lstrlenA(nextOID) + 1;
2787 }
2788 }
2789 }
2790 else
2791 {
2792 struct BitField validIndexes = { 0, NULL };
2793 DWORD j, k, numRemoved = 0;
2794
2795 /* Merge: build a bitmap of all the indexes of
2796 * validUsages.rgpszUsageIdentifier that are in pUsage.
2797 */
2798 for (j = 0; j < pUsage->cUsageIdentifier; j++)
2799 {
2800 for (k = 0; k < validUsages.cUsageIdentifier; k++)
2801 {
2802 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2803 validUsages.rgpszUsageIdentifier[k]))
2804 {
2805 CRYPT_SetBitInField(&validIndexes, k);
2806 break;
2807 }
2808 }
2809 }
2810 /* Merge by removing from validUsages those that are
2811 * not in the bitmap.
2812 */
2813 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2814 {
2815 if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2816 {
2817 if (j < validUsages.cUsageIdentifier - 1)
2818 {
2819 memmove(&validUsages.rgpszUsageIdentifier[j],
2820 &validUsages.rgpszUsageIdentifier[j +
2821 numRemoved + 1],
2822 (validUsages.cUsageIdentifier - numRemoved
2823 - j - 1) * sizeof(LPSTR));
2824 cbOIDs -= lstrlenA(
2825 validUsages.rgpszUsageIdentifier[j]) + 1 +
2826 sizeof(LPSTR);
2827 validUsages.cUsageIdentifier--;
2828 numRemoved++;
2829 }
2830 else
2831 validUsages.cUsageIdentifier--;
2832 }
2833 }
2834 CryptMemFree(validIndexes.indexes);
2835 }
2836 }
2837 CryptMemFree(pUsage);
2838 }
2839 }
2840 }
2841 ret = TRUE;
2842 if (allUsagesValid)
2843 {
2844 *cNumOIDs = -1;
2845 *pcbOIDs = 0;
2846 }
2847 else
2848 {
2849 *cNumOIDs = validUsages.cUsageIdentifier;
2850 if (!rghOIDs)
2851 *pcbOIDs = cbOIDs;
2852 else if (*pcbOIDs < cbOIDs)
2853 {
2854 *pcbOIDs = cbOIDs;
2855 SetLastError(ERROR_MORE_DATA);
2856 ret = FALSE;
2857 }
2858 else
2859 {
2860 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2861 validUsages.cUsageIdentifier * sizeof(LPSTR));
2862
2863 *pcbOIDs = cbOIDs;
2864 for (i = 0; i < validUsages.cUsageIdentifier; i++)
2865 {
2866 rghOIDs[i] = nextOID;
2867 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2868 nextOID += lstrlenA(nextOID) + 1;
2869 }
2870 }
2871 }
2872 CryptMemFree(validUsages.rgpszUsageIdentifier);
2873 TRACE("cNumOIDs: %d\n", *cNumOIDs);
2874 TRACE("returning %d\n", ret);
2875 return ret;
2876 }
2877
2878 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2879 * pInfo is NULL, from the attributes of hProv.
2880 */
2881 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2882 const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2883 {
2884 CRYPT_KEY_PROV_INFO info = { 0 };
2885 BOOL ret;
2886
2887 if (!pInfo)
2888 {
2889 DWORD size;
2890 int len;
2891
2892 ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2893 if (ret)
2894 {
2895 LPSTR szContainer = CryptMemAlloc(size);
2896
2897 if (szContainer)
2898 {
2899 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2900 (BYTE *)szContainer, &size, 0);
2901 if (ret)
2902 {
2903 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2904 NULL, 0);
2905 if (len)
2906 {
2907 info.pwszContainerName = CryptMemAlloc(len *
2908 sizeof(WCHAR));
2909 MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2910 info.pwszContainerName, len);
2911 }
2912 }
2913 CryptMemFree(szContainer);
2914 }
2915 }
2916 ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2917 if (ret)
2918 {
2919 LPSTR szProvider = CryptMemAlloc(size);
2920
2921 if (szProvider)
2922 {
2923 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2924 &size, 0);
2925 if (ret)
2926 {
2927 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2928 NULL, 0);
2929 if (len)
2930 {
2931 info.pwszProvName = CryptMemAlloc(len *
2932 sizeof(WCHAR));
2933 MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2934 info.pwszProvName, len);
2935 }
2936 }
2937 CryptMemFree(szProvider);
2938 }
2939 }
2940 size = sizeof(info.dwKeySpec);
2941 /* in case no CRYPT_KEY_PROV_INFO given,
2942 * we always use AT_SIGNATURE key spec
2943 */
2944 info.dwKeySpec = AT_SIGNATURE;
2945 size = sizeof(info.dwProvType);
2946 ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2947 &size, 0);
2948 if (!ret)
2949 info.dwProvType = PROV_RSA_FULL;
2950 pInfo = &info;
2951 }
2952
2953 CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2954 0, pInfo);
2955
2956 if (pInfo == &info)
2957 {
2958 CryptMemFree(info.pwszContainerName);
2959 CryptMemFree(info.pwszProvName);
2960 }
2961 }
2962
2963 /* Creates a signed certificate context from the unsigned, encoded certificate
2964 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2965 */
2966 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2967 HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2968 {
2969 PCCERT_CONTEXT context = NULL;
2970 BOOL ret;
2971 DWORD sigSize = 0;
2972
2973 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2974 blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2975 if (ret)
2976 {
2977 LPBYTE sig = CryptMemAlloc(sigSize);
2978
2979 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2980 blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2981 if (ret)
2982 {
2983 CERT_SIGNED_CONTENT_INFO signedInfo;
2984 BYTE *encodedSignedCert = NULL;
2985 DWORD encodedSignedCertSize = 0;
2986
2987 signedInfo.ToBeSigned.cbData = blob->cbData;
2988 signedInfo.ToBeSigned.pbData = blob->pbData;
2989 memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2990 sizeof(signedInfo.SignatureAlgorithm));
2991 signedInfo.Signature.cbData = sigSize;
2992 signedInfo.Signature.pbData = sig;
2993 signedInfo.Signature.cUnusedBits = 0;
2994 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2995 &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2996 &encodedSignedCert, &encodedSignedCertSize);
2997 if (ret)
2998 {
2999 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3000 encodedSignedCert, encodedSignedCertSize);
3001 LocalFree(encodedSignedCert);
3002 }
3003 }
3004 CryptMemFree(sig);
3005 }
3006 return context;
3007 }
3008
3009 /* Copies data from the parameters into info, where:
3010 * pSerialNumber: The serial number. Must not be NULL.
3011 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3012 * Must not be NULL
3013 * pSignatureAlgorithm: Optional.
3014 * pStartTime: The starting time of the certificate. If NULL, the current
3015 * system time is used.
3016 * pEndTime: The ending time of the certificate. If NULL, one year past the
3017 * starting time is used.
3018 * pubKey: The public key of the certificate. Must not be NULL.
3019 * pExtensions: Extensions to be included with the certificate. Optional.
3020 */
3021 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3022 const CERT_NAME_BLOB *pSubjectIssuerBlob,
3023 const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3024 const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3025 const CERT_EXTENSIONS *pExtensions)
3026 {
3027 static CHAR oid[] = szOID_RSA_SHA1RSA;
3028
3029 assert(info);
3030 assert(pSerialNumber);
3031 assert(pSubjectIssuerBlob);
3032 assert(pubKey);
3033
3034 if (pExtensions && pExtensions->cExtension)
3035 info->dwVersion = CERT_V3;
3036 else
3037 info->dwVersion = CERT_V1;
3038 info->SerialNumber.cbData = pSerialNumber->cbData;
3039 info->SerialNumber.pbData = pSerialNumber->pbData;
3040 if (pSignatureAlgorithm)
3041 memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
3042 sizeof(info->SignatureAlgorithm));
3043 else
3044 {
3045 info->SignatureAlgorithm.pszObjId = oid;
3046 info->SignatureAlgorithm.Parameters.cbData = 0;
3047 info->SignatureAlgorithm.Parameters.pbData = NULL;
3048 }
3049 info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3050 info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3051 if (pStartTime)
3052 SystemTimeToFileTime(pStartTime, &info->NotBefore);
3053 else
3054 GetSystemTimeAsFileTime(&info->NotBefore);
3055 if (pEndTime)
3056 SystemTimeToFileTime(pEndTime, &info->NotAfter);
3057 else
3058 {
3059 SYSTEMTIME endTime;
3060
3061 if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3062 {
3063 endTime.wYear++;
3064 SystemTimeToFileTime(&endTime, &info->NotAfter);
3065 }
3066 }
3067 info->Subject.cbData = pSubjectIssuerBlob->cbData;
3068 info->Subject.pbData = pSubjectIssuerBlob->pbData;
3069 memcpy(&info->SubjectPublicKeyInfo, pubKey,
3070 sizeof(info->SubjectPublicKeyInfo));
3071 if (pExtensions)
3072 {
3073 info->cExtension = pExtensions->cExtension;
3074 info->rgExtension = pExtensions->rgExtension;
3075 }
3076 else
3077 {
3078 info->cExtension = 0;
3079 info->rgExtension = NULL;
3080 }
3081 }
3082
3083 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3084 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3085 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3086
3087 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3088 {
3089 HCRYPTPROV hProv = 0;
3090 HMODULE rpcrt = LoadLibraryA("rpcrt4");
3091
3092 if (rpcrt)
3093 {
3094 UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3095 "UuidCreate");
3096 UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3097 "UuidToStringA");
3098 RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3099 rpcrt, "RpcStringFreeA");
3100
3101 if (uuidCreate && uuidToString && rpcStringFree)
3102 {
3103 UUID uuid;
3104 RPC_STATUS status = uuidCreate(&uuid);
3105
3106 if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3107 {
3108 unsigned char *uuidStr;
3109
3110 status = uuidToString(&uuid, &uuidStr);
3111 if (status == RPC_S_OK)
3112 {
3113 BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3114 MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3115
3116 if (ret)
3117 {
3118 HCRYPTKEY key;
3119
3120 ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3121 if (ret)
3122 CryptDestroyKey(key);
3123 }
3124 rpcStringFree(&uuidStr);
3125 }
3126 }
3127 }
3128 FreeLibrary(rpcrt);
3129 }
3130 return hProv;
3131 }
3132
3133 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3134 PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3135 PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3136 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3137 PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3138 {
3139 PCCERT_CONTEXT context = NULL;
3140 BOOL ret, releaseContext = FALSE;
3141 PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3142 DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
3143
3144 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3145 pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3146 pExtensions, pExtensions);
3147
3148 if(!pSubjectIssuerBlob)
3149 {
3150 SetLastError(ERROR_INVALID_PARAMETER);
3151 return NULL;
3152 }
3153
3154 if (!hProv)
3155 {
3156 if (!pKeyProvInfo)
3157 {
3158 hProv = CRYPT_CreateKeyProv();
3159 releaseContext = TRUE;
3160 }
3161 else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3162 {
3163 SetLastError(NTE_BAD_FLAGS);
3164 return NULL;
3165 }
3166 else
3167 {
3168 HCRYPTKEY hKey = 0;
3169 /* acquire the context using the given information*/
3170 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3171 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3172 pKeyProvInfo->dwFlags);
3173 if (!ret)
3174 {
3175 if(GetLastError() != NTE_BAD_KEYSET)
3176 return NULL;
3177 /* create the key set */
3178 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3179 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3180 pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3181 if (!ret)
3182 return NULL;
3183 }
3184 dwKeySpec = pKeyProvInfo->dwKeySpec;
3185 /* check if the key is here */
3186 ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3187 if(!ret)
3188 {
3189 if (NTE_NO_KEY == GetLastError())
3190 { /* generate the key */
3191 ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3192 }
3193 if (!ret)
3194 {
3195 CryptReleaseContext(hProv,0);
3196 SetLastError(NTE_BAD_KEYSET);
3197 return NULL;
3198 }
3199 }
3200 CryptDestroyKey(hKey);
3201 releaseContext = TRUE;
3202 }
3203 }
3204
3205 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3206 &pubKeySize);
3207 if (!ret)
3208 goto end;
3209 pubKey = CryptMemAlloc(pubKeySize);
3210 if (pubKey)
3211 {
3212 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3213 pubKey, &pubKeySize);
3214 if (ret)
3215 {
3216 CERT_INFO info = { 0 };
3217 CRYPT_DER_BLOB blob = { 0, NULL };
3218 BYTE serial[16];
3219 CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3220
3221 CryptGenRandom(hProv, sizeof(serial), serial);
3222 CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3223 pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3224 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3225 &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3226 &blob.cbData);
3227 if (ret)
3228 {
3229 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3230 context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3231 &info.SignatureAlgorithm);
3232 else
3233 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3234 blob.pbData, blob.cbData);
3235 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3236 CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3237 LocalFree(blob.pbData);
3238 }
3239 }
3240 CryptMemFree(pubKey);
3241 }
3242 end:
3243 if (releaseContext)
3244 CryptReleaseContext(hProv, 0);
3245 return context;
3246 }
3247
3248 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3249 void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3250 PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3251 PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3252 {
3253 FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3254 dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3255 pVerifyUsageStatus);
3256 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3257 return FALSE;
3258 }
3259
3260 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3261 const BYTE *pbEncoded, DWORD cbEncoded,
3262 DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3263 {
3264 TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3265 pbEncoded, cbEncoded, dwFlags, pCreatePara);
3266
3267 if (dwFlags)
3268 {
3269 FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3270 return NULL;
3271 }
3272 if (pCreatePara)
3273 {
3274 FIXME("pCreatePara not handled\n");
3275 return NULL;
3276 }
3277
3278 switch (dwContextType)
3279 {
3280 case CERT_STORE_CERTIFICATE_CONTEXT:
3281 return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3282 case CERT_STORE_CRL_CONTEXT:
3283 return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3284 case CERT_STORE_CTL_CONTEXT:
3285 return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3286 default:
3287 WARN("unknown context type: 0x%x\n", dwContextType);
3288 return NULL;
3289 }
3290 }
Maarten's multimedia branch