dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #define NONAMELESSUNION
  24 #include "ntstatus.h"
  25 #define WIN32_NO_STATUS
  26 #include "windef.h"
  27 #include "winbase.h"
  28 #include "winternl.h"
  29 #define CRYPT_OID_INFO_HAS_EXTRA_FIELDS
  30 #include "wincrypt.h"
  31 #include "snmp.h"
  32 #include "bcrypt.h"
  33 #include "winnls.h"
  34 #include "rpc.h"
  35 #include "wine/debug.h"
  36 #include "crypt32_private.h"
  37
  38 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  39
  40 /* Internal version of CertGetCertificateContextProperty that gets properties
  41  * directly from the context (or the context it's linked to, depending on its
  42  * type.) Doesn't handle special-case properties, since they are handled by
  43  * CertGetCertificateContextProperty, and are particular to the store in which
  44  * the property exists (which is separate from the context.)
  45  */
  46 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
  47  void *pvData, DWORD *pcbData);
  48
  49 /* Internal version of CertSetCertificateContextProperty that sets properties
  50  * directly on the context (or the context it's linked to, depending on its
  51  * type.) Doesn't handle special cases, since they're handled by
  52  * CertSetCertificateContextProperty anyway.
  53  */
  54 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
  55  DWORD dwFlags, const void *pvData);
  56
  57 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  58  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  59  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  60 {
  61     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  62      pbCertEncoded, cbCertEncoded);
  63     BOOL ret;
  64
  65     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  66      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  67
  68     if (cert)
  69     {
  70         ret = CertAddCertificateContextToStore(hCertStore, cert,
  71          dwAddDisposition, ppCertContext);
  72         CertFreeCertificateContext(cert);
  73     }
  74     else
  75         ret = FALSE;
  76     return ret;
  77 }
  78
  79 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
  80  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  81 {
  82     HCERTSTORE store;
  83     BOOL ret = FALSE;
  84
  85     TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
  86      cbCertEncoded);
  87
  88     store = CertOpenSystemStoreA(0, pszCertStoreName);
  89     if (store)
  90     {
  91         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  92          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  93         CertCloseStore(store, 0);
  94     }
  95     return ret;
  96 }
  97
  98 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
  99  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 100 {
 101     HCERTSTORE store;
 102     BOOL ret = FALSE;
 103
 104     TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
 105      cbCertEncoded);
 106
 107     store = CertOpenSystemStoreW(0, pszCertStoreName);
 108     if (store)
 109     {
 110         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 111          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
 112         CertCloseStore(store, 0);
 113     }
 114     return ret;
 115 }
 116
 117 static const context_vtbl_t cert_vtbl;
 118
 119 static void Cert_free(context_t *context)
 120 {
 121     cert_t *cert = (cert_t*)context;
 122
 123     CryptMemFree(cert->ctx.pbCertEncoded);
 124     LocalFree(cert->ctx.pCertInfo);
 125 }
 126
 127 static context_t *Cert_clone(context_t *context, WINECRYPT_CERTSTORE *store, BOOL use_link)
 128 {
 129     cert_t *cert;
 130
 131     if(use_link) {
 132         cert = (cert_t*)Context_CreateLinkContext(sizeof(CERT_CONTEXT), context, store);
 133         if(!cert)
 134             return NULL;
 135     }else {
 136         const cert_t *cloned = (const cert_t*)context;
 137         DWORD size = 0;
 138         BOOL res;
 139
 140         cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, store);
 141         if(!cert)
 142             return NULL;
 143
 144         Context_CopyProperties(&cert->ctx, &cloned->ctx);
 145
 146         cert->ctx.dwCertEncodingType = cloned->ctx.dwCertEncodingType;
 147         cert->ctx.pbCertEncoded = CryptMemAlloc(cloned->ctx.cbCertEncoded);
 148         memcpy(cert->ctx.pbCertEncoded, cloned->ctx.pbCertEncoded, cloned->ctx.cbCertEncoded);
 149         cert->ctx.cbCertEncoded = cloned->ctx.cbCertEncoded;
 150
 151         /* FIXME: We don't need to decode the object here, we could just clone cert info. */
 152         res = CryptDecodeObjectEx(cert->ctx.dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 153          cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 154          &cert->ctx.pCertInfo, &size);
 155         if(!res) {
 156             CertFreeCertificateContext(&cert->ctx);
 157             return NULL;
 158         }
 159     }
 160
 161     cert->ctx.hCertStore = store;
 162     return &cert->base;
 163 }
 164
 165 static const context_vtbl_t cert_vtbl = {
 166     Cert_free,
 167     Cert_clone
 168 };
 169
 170 static BOOL add_cert_to_store(WINECRYPT_CERTSTORE *store, const CERT_CONTEXT *cert,
 171  DWORD add_disposition, BOOL use_link, PCCERT_CONTEXT *ret_context)
 172 {
 173     const CERT_CONTEXT *existing = NULL;
 174     BOOL ret = TRUE, inherit_props = FALSE;
 175     context_t *new_context = NULL;
 176
 177     switch (add_disposition)
 178     {
 179     case CERT_STORE_ADD_ALWAYS:
 180         break;
 181     case CERT_STORE_ADD_NEW:
 182     case CERT_STORE_ADD_REPLACE_EXISTING:
 183     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 184     case CERT_STORE_ADD_USE_EXISTING:
 185     case CERT_STORE_ADD_NEWER:
 186     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 187     {
 188         BYTE hashToAdd[20];
 189         DWORD size = sizeof(hashToAdd);
 190
 191         ret = CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID,
 192          hashToAdd, &size);
 193         if (ret)
 194         {
 195             CRYPT_HASH_BLOB blob = { sizeof(hashToAdd), hashToAdd };
 196
 197             existing = CertFindCertificateInStore(store, cert->dwCertEncodingType, 0,
 198              CERT_FIND_SHA1_HASH, &blob, NULL);
 199         }
 200         break;
 201     }
 202     default:
 203         FIXME("Unimplemented add disposition %d\n", add_disposition);
 204         SetLastError(E_INVALIDARG);
 205         return FALSE;
 206     }
 207
 208     switch (add_disposition)
 209     {
 210     case CERT_STORE_ADD_ALWAYS:
 211         break;
 212     case CERT_STORE_ADD_NEW:
 213         if (existing)
 214         {
 215             TRACE("found matching certificate, not adding\n");
 216             SetLastError(CRYPT_E_EXISTS);
 217             return FALSE;
 218         }
 219         break;
 220     case CERT_STORE_ADD_REPLACE_EXISTING:
 221         break;
 222     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 223         if (use_link)
 224             FIXME("CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES: semi-stub for links\n");
 225         if (existing)
 226             inherit_props = TRUE;
 227         break;
 228     case CERT_STORE_ADD_USE_EXISTING:
 229         if(use_link)
 230             FIXME("CERT_STORE_ADD_USE_EXISTING: semi-stub for links\n");
 231         if (existing)
 232         {
 233             Context_CopyProperties(existing, cert);
 234             if (ret_context)
 235                 *ret_context = CertDuplicateCertificateContext(existing);
 236             return TRUE;
 237         }
 238         break;
 239     case CERT_STORE_ADD_NEWER:
 240         if (existing && CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 241         {
 242             TRACE("existing certificate is newer, not adding\n");
 243             SetLastError(CRYPT_E_EXISTS);
 244             return FALSE;
 245         }
 246         break;
 247     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 248         if (existing)
 249         {
 250             if (CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 251             {
 252                 TRACE("existing certificate is newer, not adding\n");
 253                 SetLastError(CRYPT_E_EXISTS);
 254                 return FALSE;
 255             }
 256             inherit_props = TRUE;
 257         }
 258         break;
 259     }
 260
 261     /* FIXME: We have tests that this works, but what should we really do in this case? */
 262     if(!store) {
 263         if(ret_context)
 264             *ret_context = CertDuplicateCertificateContext(cert);
 265         return TRUE;
 266     }
 267
 268     ret = store->vtbl->certs.addContext(store, context_from_ptr(cert), existing ? context_from_ptr(existing) : NULL,
 269      (ret_context || inherit_props) ? &new_context : NULL, use_link);
 270     if(!ret)
 271         return FALSE;
 272
 273     if(inherit_props)
 274         Context_CopyProperties(context_ptr(new_context), existing);
 275
 276     if(ret_context)
 277         *ret_context = context_ptr(new_context);
 278     else if(new_context)
 279         Context_Release(new_context);
 280
 281     TRACE("returning %d\n", ret);
 282     return ret;
 283 }
 284
 285 BOOL WINAPI CertAddCertificateContextToStore(HCERTSTORE hCertStore, PCCERT_CONTEXT pCertContext,
 286  DWORD dwAddDisposition, PCCERT_CONTEXT *ppStoreContext)
 287 {
 288     WINECRYPT_CERTSTORE *store = hCertStore;
 289
 290     TRACE("(%p, %p, %08x, %p)\n", hCertStore, pCertContext, dwAddDisposition, ppStoreContext);
 291
 292     return add_cert_to_store(store, pCertContext, dwAddDisposition, FALSE, ppStoreContext);
 293 }
 294
 295 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
 296  PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
 297  PCCERT_CONTEXT *ppCertContext)
 298 {
 299     static int calls;
 300     WINECRYPT_CERTSTORE *store = (WINECRYPT_CERTSTORE*)hCertStore;
 301
 302     if (!(calls++))
 303         FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore, pCertContext,
 304          dwAddDisposition, ppCertContext);
 305     if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
 306         return FALSE;
 307     if (store->type == StoreTypeCollection)
 308     {
 309         SetLastError(E_INVALIDARG);
 310         return FALSE;
 311     }
 312     return add_cert_to_store(hCertStore, pCertContext, dwAddDisposition, TRUE, ppCertContext);
 313 }
 314
 315 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
 316  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 317 {
 318     cert_t *cert = NULL;
 319     BYTE *data = NULL;
 320     BOOL ret;
 321     PCERT_INFO certInfo = NULL;
 322     DWORD size = 0;
 323
 324     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
 325      cbCertEncoded);
 326
 327     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
 328     {
 329         SetLastError(E_INVALIDARG);
 330         return NULL;
 331     }
 332
 333     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 334      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 335      &certInfo, &size);
 336     if (!ret)
 337         return NULL;
 338
 339     cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, &empty_store);
 340     if (!cert)
 341         return NULL;
 342     data = CryptMemAlloc(cbCertEncoded);
 343     if (!data)
 344     {
 345         Context_Release(&cert->base);
 346         return NULL;
 347     }
 348
 349     memcpy(data, pbCertEncoded, cbCertEncoded);
 350     cert->ctx.dwCertEncodingType = dwCertEncodingType;
 351     cert->ctx.pbCertEncoded      = data;
 352     cert->ctx.cbCertEncoded      = cbCertEncoded;
 353     cert->ctx.pCertInfo          = certInfo;
 354     cert->ctx.hCertStore         = &empty_store;
 355
 356     return &cert->ctx;
 357 }
 358
 359 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(PCCERT_CONTEXT pCertContext)
 360 {
 361     TRACE("(%p)\n", pCertContext);
 362
 363     if (!pCertContext)
 364         return NULL;
 365
 366     Context_AddRef(&cert_from_ptr(pCertContext)->base);
 367     return pCertContext;
 368 }
 369
 370 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 371 {
 372     TRACE("(%p)\n", pCertContext);
 373
 374     if (pCertContext)
 375         Context_Release(&cert_from_ptr(pCertContext)->base);
 376     return TRUE;
 377 }
 378
 379 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 380  DWORD dwPropId)
 381 {
 382     cert_t *cert = cert_from_ptr(pCertContext);
 383     DWORD ret;
 384
 385     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 386
 387     if (cert->base.properties)
 388         ret = ContextPropertyList_EnumPropIDs(cert->base.properties, dwPropId);
 389     else
 390         ret = 0;
 391     return ret;
 392 }
 393
 394 static BOOL CertContext_GetHashProp(cert_t *cert, DWORD dwPropId,
 395  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 396  DWORD *pcbData)
 397 {
 398     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 399      pcbData);
 400     if (ret && pvData)
 401     {
 402         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 403
 404         ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 405     }
 406     return ret;
 407 }
 408
 409 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 410  DWORD cb)
 411 {
 412     BOOL ret = TRUE;
 413
 414     if (!pvData)
 415         *pcbData = cb;
 416     else if (*pcbData < cb)
 417     {
 418         SetLastError(ERROR_MORE_DATA);
 419         *pcbData = cb;
 420         ret = FALSE;
 421     }
 422     else
 423     {
 424         memcpy(pvData, pb, cb);
 425         *pcbData = cb;
 426     }
 427     return ret;
 428 }
 429
 430 void CRYPT_ConvertKeyContext(const struct store_CERT_KEY_CONTEXT *src, CERT_KEY_CONTEXT *dst)
 431 {
 432     dst->cbSize = sizeof(*dst);
 433     dst->hCryptProv = src->hCryptProv;
 434     dst->dwKeySpec = src->dwKeySpec;
 435 }
 436
 437 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
 438  void *pvData, DWORD *pcbData)
 439 {
 440     BOOL ret;
 441     CRYPT_DATA_BLOB blob;
 442
 443     TRACE("(%p, %d, %p, %p)\n", cert, dwPropId, pvData, pcbData);
 444
 445     if (cert->base.properties)
 446         ret = ContextPropertyList_FindProperty(cert->base.properties, dwPropId, &blob);
 447     else
 448         ret = FALSE;
 449     if (ret)
 450     {
 451         CERT_KEY_CONTEXT ctx;
 452         if (dwPropId == CERT_KEY_CONTEXT_PROP_ID)
 453         {
 454             CRYPT_ConvertKeyContext((const struct store_CERT_KEY_CONTEXT *)blob.pbData, &ctx);
 455             blob.pbData = (BYTE *)&ctx;
 456             blob.cbData = ctx.cbSize;
 457         }
 458         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 459     }
 460     else
 461     {
 462         /* Implicit properties */
 463         switch (dwPropId)
 464         {
 465         case CERT_SHA1_HASH_PROP_ID:
 466             ret = CertContext_GetHashProp(cert, dwPropId, CALG_SHA1,
 467              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 468              pcbData);
 469             break;
 470         case CERT_MD5_HASH_PROP_ID:
 471             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 472              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 473              pcbData);
 474             break;
 475         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 476             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 477              cert->ctx.pCertInfo->Subject.pbData,
 478              cert->ctx.pCertInfo->Subject.cbData,
 479              pvData, pcbData);
 480             break;
 481         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 482             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 483              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 484              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 485              pvData, pcbData);
 486             break;
 487         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 488             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 489              cert->ctx.pCertInfo->SerialNumber.pbData,
 490              cert->ctx.pCertInfo->SerialNumber.cbData,
 491              pvData, pcbData);
 492             break;
 493         case CERT_SIGNATURE_HASH_PROP_ID:
 494             ret = CryptHashToBeSigned(0, cert->ctx.dwCertEncodingType,
 495              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 496              pcbData);
 497             if (ret && pvData)
 498             {
 499                 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 500
 501                 ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 502             }
 503             break;
 504         case CERT_KEY_IDENTIFIER_PROP_ID:
 505         {
 506             PCERT_EXTENSION ext = CertFindExtension(
 507              szOID_SUBJECT_KEY_IDENTIFIER, cert->ctx.pCertInfo->cExtension,
 508              cert->ctx.pCertInfo->rgExtension);
 509
 510             if (ext)
 511             {
 512                 CRYPT_DATA_BLOB value;
 513                 DWORD size = sizeof(value);
 514
 515                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 516                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 517                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 518                  &size);
 519                 if (ret)
 520                 {
 521                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 522                      value.cbData);
 523                     CertContext_SetProperty(cert, dwPropId, 0, &value);
 524                 }
 525             }
 526             else
 527                 SetLastError(ERROR_INVALID_DATA);
 528             break;
 529         }
 530         default:
 531             SetLastError(CRYPT_E_NOT_FOUND);
 532         }
 533     }
 534     TRACE("returning %d\n", ret);
 535     return ret;
 536 }
 537
 538 /* 64-bit compatible layout, so that 64-bit crypt32 is able to read
 539  * the structure saved by 32-bit crypt32.
 540  */
 541 typedef struct
 542 {
 543     ULONG64 pwszContainerName;
 544     ULONG64 pwszProvName;
 545     DWORD dwProvType;
 546     DWORD dwFlags;
 547     DWORD cProvParam;
 548     ULONG64 rgProvParam;
 549     DWORD dwKeySpec;
 550 } store_CRYPT_KEY_PROV_INFO;
 551
 552 typedef struct
 553 {
 554     DWORD dwParam;
 555     ULONG64 pbData;
 556     DWORD cbData;
 557     DWORD dwFlags;
 558 } store_CRYPT_KEY_PROV_PARAM;
 559
 560 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO buf)
 561 {
 562     CRYPT_KEY_PROV_INFO info;
 563     store_CRYPT_KEY_PROV_INFO *store = (store_CRYPT_KEY_PROV_INFO *)buf;
 564     BYTE *p = (BYTE *)(store + 1);
 565
 566     if (store->pwszContainerName)
 567     {
 568         info.pwszContainerName = (LPWSTR)((BYTE *)store + store->pwszContainerName);
 569         p += (lstrlenW(info.pwszContainerName) + 1) * sizeof(WCHAR);
 570     }
 571     else
 572         info.pwszContainerName = NULL;
 573
 574     if (store->pwszProvName)
 575     {
 576         info.pwszProvName = (LPWSTR)((BYTE *)store + store->pwszProvName);
 577         p += (lstrlenW(info.pwszProvName) + 1) * sizeof(WCHAR);
 578     }
 579     else
 580         info.pwszProvName = NULL;
 581
 582     info.dwProvType = store->dwProvType;
 583     info.dwFlags = store->dwFlags;
 584     info.dwKeySpec = store->dwKeySpec;
 585     info.cProvParam = store->cProvParam;
 586
 587     if (info.cProvParam)
 588     {
 589         DWORD i;
 590
 591         info.rgProvParam = (CRYPT_KEY_PROV_PARAM *)p;
 592
 593         for (i = 0; i < store->cProvParam; i++)
 594         {
 595             CRYPT_KEY_PROV_PARAM param;
 596             store_CRYPT_KEY_PROV_PARAM *store_param;
 597
 598             store_param = (store_CRYPT_KEY_PROV_PARAM *)p;
 599             p += sizeof(*store_param);
 600
 601             param.dwParam = store_param[i].dwParam;
 602             param.dwFlags = store_param[i].dwFlags;
 603             param.cbData = store_param[i].cbData;
 604             param.pbData = param.cbData ? p : NULL;
 605             p += store_param[i].cbData;
 606
 607             memcpy(&info.rgProvParam[i], &param, sizeof(param));
 608         }
 609     }
 610     else
 611         info.rgProvParam = NULL;
 612
 613     TRACE("%s,%s,%u,%08x,%u,%p,%u\n", debugstr_w(info.pwszContainerName), debugstr_w(info.pwszProvName),
 614           info.dwProvType, info.dwFlags, info.cProvParam, info.rgProvParam, info.dwKeySpec);
 615
 616     *buf = info;
 617 }
 618
 619 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 620  DWORD dwPropId, void *pvData, DWORD *pcbData)
 621 {
 622     cert_t *cert = cert_from_ptr(pCertContext);
 623     BOOL ret;
 624
 625     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 626
 627     switch (dwPropId)
 628     {
 629     case 0:
 630     case CERT_CERT_PROP_ID:
 631     case CERT_CRL_PROP_ID:
 632     case CERT_CTL_PROP_ID:
 633         SetLastError(E_INVALIDARG);
 634         ret = FALSE;
 635         break;
 636     case CERT_ACCESS_STATE_PROP_ID:
 637         ret = CertGetStoreProperty(cert->ctx.hCertStore, dwPropId, pvData, pcbData);
 638         break;
 639     case CERT_KEY_PROV_HANDLE_PROP_ID:
 640     {
 641         CERT_KEY_CONTEXT keyContext;
 642         DWORD size = sizeof(keyContext);
 643
 644         ret = CertContext_GetProperty(cert,
 645          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 646         if (ret)
 647             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 648              sizeof(keyContext.hCryptProv));
 649         break;
 650     }
 651     case CERT_KEY_PROV_INFO_PROP_ID:
 652         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 653          pcbData);
 654         if (ret && pvData)
 655             CRYPT_FixKeyProvInfoPointers(pvData);
 656         break;
 657     default:
 658         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 659          pcbData);
 660     }
 661
 662     TRACE("returning %d\n", ret);
 663     return ret;
 664 }
 665
 666 /* Copies key provider info from from into to, where to is assumed to be a
 667  * contiguous buffer of memory large enough for from and all its associated
 668  * data, but whose pointers are uninitialized.
 669  * Upon return, to contains a contiguous copy of from, packed in the following
 670  * order:
 671  * - store_CRYPT_KEY_PROV_INFO
 672  * - pwszContainerName
 673  * - pwszProvName
 674  * - store_CRYPT_KEY_PROV_PARAM[0]
 675  * - store_CRYPT_KEY_PROV_PARAM[0].data
 676  * - ...
 677  */
 678 static void CRYPT_CopyKeyProvInfo(store_CRYPT_KEY_PROV_INFO *to, const CRYPT_KEY_PROV_INFO *from)
 679 {
 680     DWORD i;
 681     BYTE *p;
 682     store_CRYPT_KEY_PROV_PARAM *param;
 683
 684     p = (BYTE *)(to + 1);
 685
 686     if (from->pwszContainerName)
 687     {
 688         to->pwszContainerName = p - (BYTE *)to;
 689         lstrcpyW((LPWSTR)p, from->pwszContainerName);
 690         p += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 691     }
 692     else
 693         to->pwszContainerName = 0;
 694
 695     if (from->pwszProvName)
 696     {
 697         to->pwszProvName = p - (BYTE *)to;
 698         lstrcpyW((LPWSTR)p, from->pwszProvName);
 699         p += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 700     }
 701     else
 702         to->pwszProvName = 0;
 703
 704     to->dwProvType = from->dwProvType;
 705     to->dwFlags = from->dwFlags;
 706     to->cProvParam = from->cProvParam;
 707     to->rgProvParam = 0;
 708     to->dwKeySpec = from->dwKeySpec;
 709
 710     for (i = 0; i < to->cProvParam; i++)
 711     {
 712         param = (store_CRYPT_KEY_PROV_PARAM *)p;
 713         p += sizeof(*param);
 714
 715         param->dwParam = from->rgProvParam[i].dwParam;
 716         param->pbData = 0;
 717         param->cbData = from->rgProvParam[i].cbData;
 718         param->dwFlags = from->rgProvParam[i].dwFlags;
 719         memcpy(p, from->rgProvParam[i].pbData, from->rgProvParam[i].cbData);
 720         p += from->rgProvParam[i].cbData;
 721     }
 722 }
 723
 724 static BOOL CertContext_SetKeyProvInfoProperty(CONTEXT_PROPERTY_LIST *properties,
 725  const CRYPT_KEY_PROV_INFO *info)
 726 {
 727     BYTE *buf;
 728     DWORD size = sizeof(store_CRYPT_KEY_PROV_INFO), i;
 729     BOOL ret;
 730
 731     if (info->pwszContainerName)
 732         size += (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 733     if (info->pwszProvName)
 734         size += (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 735
 736     for (i = 0; i < info->cProvParam; i++)
 737         size += sizeof(store_CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 738
 739     buf = CryptMemAlloc(size);
 740     if (buf)
 741     {
 742         CRYPT_CopyKeyProvInfo((store_CRYPT_KEY_PROV_INFO *)buf, info);
 743         ret = ContextPropertyList_SetProperty(properties,
 744          CERT_KEY_PROV_INFO_PROP_ID, buf, size);
 745         CryptMemFree(buf);
 746     }
 747     else
 748         ret = FALSE;
 749     return ret;
 750 }
 751
 752 static BOOL CertContext_SetKeyContextProperty(CONTEXT_PROPERTY_LIST *properties,
 753  const CERT_KEY_CONTEXT *keyContext)
 754 {
 755     struct store_CERT_KEY_CONTEXT ctx;
 756
 757     ctx.cbSize = sizeof(ctx);
 758     ctx.hCryptProv = keyContext->hCryptProv;
 759     ctx.dwKeySpec = keyContext->dwKeySpec;
 760
 761     return ContextPropertyList_SetProperty(properties, CERT_KEY_CONTEXT_PROP_ID,
 762      (const BYTE *)&ctx, ctx.cbSize);
 763 }
 764
 765 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
 766  DWORD dwFlags, const void *pvData)
 767 {
 768     BOOL ret;
 769
 770     TRACE("(%p, %d, %08x, %p)\n", cert, dwPropId, dwFlags, pvData);
 771
 772     if (!cert->base.properties)
 773         ret = FALSE;
 774     else
 775     {
 776         switch (dwPropId)
 777         {
 778         case CERT_AUTO_ENROLL_PROP_ID:
 779         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 780         case CERT_DESCRIPTION_PROP_ID:
 781         case CERT_FRIENDLY_NAME_PROP_ID:
 782         case CERT_HASH_PROP_ID:
 783         case CERT_KEY_IDENTIFIER_PROP_ID:
 784         case CERT_MD5_HASH_PROP_ID:
 785         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 786         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 787         case CERT_PVK_FILE_PROP_ID:
 788         case CERT_SIGNATURE_HASH_PROP_ID:
 789         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 790         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 791         case CERT_EXTENDED_ERROR_INFO_PROP_ID:
 792         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 793         case CERT_ENROLLMENT_PROP_ID:
 794         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 795         case CERT_OCSP_RESPONSE_PROP_ID:
 796         case CERT_RENEWAL_PROP_ID:
 797         {
 798             if (pvData)
 799             {
 800                 const CRYPT_DATA_BLOB *blob = pvData;
 801
 802                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 803                  blob->pbData, blob->cbData);
 804             }
 805             else
 806             {
 807                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 808                 ret = TRUE;
 809             }
 810             break;
 811         }
 812         case CERT_DATE_STAMP_PROP_ID:
 813             if (pvData)
 814                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 815                  pvData, sizeof(FILETIME));
 816             else
 817             {
 818                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 819                 ret = TRUE;
 820             }
 821             break;
 822         case CERT_KEY_CONTEXT_PROP_ID:
 823             if (pvData)
 824             {
 825                 const CERT_KEY_CONTEXT *keyContext = pvData;
 826
 827                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 828                 {
 829                     SetLastError(E_INVALIDARG);
 830                     ret = FALSE;
 831                 }
 832                 else
 833                     ret = CertContext_SetKeyContextProperty(cert->base.properties, pvData);
 834             }
 835             else
 836             {
 837                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 838                 ret = TRUE;
 839             }
 840             break;
 841         case CERT_KEY_PROV_INFO_PROP_ID:
 842             if (pvData)
 843                 ret = CertContext_SetKeyProvInfoProperty(cert->base.properties, pvData);
 844             else
 845             {
 846                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 847                 ret = TRUE;
 848             }
 849             break;
 850         case CERT_KEY_PROV_HANDLE_PROP_ID:
 851         {
 852             CERT_KEY_CONTEXT keyContext;
 853             DWORD size = sizeof(keyContext);
 854
 855             ret = CertContext_GetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 856              &keyContext, &size);
 857             if (ret)
 858             {
 859                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 860                     CryptReleaseContext(keyContext.hCryptProv, 0);
 861             }
 862             keyContext.cbSize = sizeof(keyContext);
 863             if (pvData)
 864                 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 865             else
 866             {
 867                 keyContext.hCryptProv = 0;
 868                 keyContext.dwKeySpec = AT_SIGNATURE;
 869             }
 870             ret = CertContext_SetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 871              0, &keyContext);
 872             break;
 873         }
 874         default:
 875             FIXME("%d: stub\n", dwPropId);
 876             ret = FALSE;
 877         }
 878     }
 879     TRACE("returning %d\n", ret);
 880     return ret;
 881 }
 882
 883 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 884  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 885 {
 886     BOOL ret;
 887
 888     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 889
 890     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 891      * crashes on most of these, I'll be safer.
 892      */
 893     switch (dwPropId)
 894     {
 895     case 0:
 896     case CERT_ACCESS_STATE_PROP_ID:
 897     case CERT_CERT_PROP_ID:
 898     case CERT_CRL_PROP_ID:
 899     case CERT_CTL_PROP_ID:
 900         SetLastError(E_INVALIDARG);
 901         return FALSE;
 902     }
 903     ret = CertContext_SetProperty(cert_from_ptr(pCertContext), dwPropId, dwFlags,
 904      pvData);
 905     TRACE("returning %d\n", ret);
 906     return ret;
 907 }
 908
 909 /* Acquires the private key using the key provider info, retrieving info from
 910  * the certificate if info is NULL.  The acquired provider is returned in
 911  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 912  */
 913 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert, DWORD dwFlags,
 914  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 915 {
 916     DWORD size = 0;
 917     BOOL allocated = FALSE, ret = TRUE;
 918
 919     if (!info)
 920     {
 921         ret = CertGetCertificateContextProperty(pCert,
 922          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 923         if (ret)
 924         {
 925             info = HeapAlloc(GetProcessHeap(), 0, size);
 926             if (info)
 927             {
 928                 ret = CertGetCertificateContextProperty(pCert,
 929                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 930                 allocated = TRUE;
 931             }
 932             else
 933             {
 934                 SetLastError(ERROR_OUTOFMEMORY);
 935                 ret = FALSE;
 936             }
 937         }
 938         else
 939             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 940     }
 941     if (ret)
 942     {
 943         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 944          info->pwszProvName, info->dwProvType, (dwFlags & CRYPT_ACQUIRE_SILENT_FLAG) ? CRYPT_SILENT : 0);
 945         if (ret)
 946         {
 947             DWORD i;
 948
 949             for (i = 0; i < info->cProvParam; i++)
 950             {
 951                 CryptSetProvParam(*phCryptProv,
 952                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 953                  info->rgProvParam[i].dwFlags);
 954             }
 955             *pdwKeySpec = info->dwKeySpec;
 956         }
 957         else
 958             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 959     }
 960     if (allocated)
 961         HeapFree(GetProcessHeap(), 0, info);
 962     return ret;
 963 }
 964
 965 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 966  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 967  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 968 {
 969     BOOL ret = FALSE, cache = FALSE;
 970     PCRYPT_KEY_PROV_INFO info = NULL;
 971     CERT_KEY_CONTEXT keyContext;
 972     DWORD size;
 973     PCCERT_CONTEXT cert_in_store = NULL;
 974
 975     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 976      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 977
 978     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 979     {
 980         DWORD size = 0;
 981
 982         ret = CertGetCertificateContextProperty(pCert,
 983          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 984
 985         if (!ret)
 986         {
 987             HCERTSTORE hstore;
 988
 989             hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, 0,
 990                                    CERT_SYSTEM_STORE_CURRENT_USER, L"My");
 991             if (hstore)
 992             {
 993                 cert_in_store = CertFindCertificateInStore(hstore, pCert->dwCertEncodingType, 0,
 994                                                            CERT_FIND_EXISTING, pCert, NULL);
 995                 if (cert_in_store)
 996                 {
 997                     ret = CertGetCertificateContextProperty(cert_in_store, CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 998                     if (ret)
 999                         pCert = cert_in_store;
1000                     else
1001                     {
1002                         CertFreeCertificateContext(cert_in_store);
1003                         cert_in_store = NULL;
1004                     }
1005                 }
1006
1007                 CertCloseStore(hstore, 0);
1008             }
1009         }
1010
1011         if (ret)
1012         {
1013             info = HeapAlloc(GetProcessHeap(), 0, size);
1014             ret = CertGetCertificateContextProperty(pCert,
1015              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
1016             if (ret)
1017                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
1018         }
1019     }
1020     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
1021         cache = TRUE;
1022     *phCryptProv = 0;
1023     if (cache)
1024     {
1025         size = sizeof(keyContext);
1026         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
1027          &keyContext, &size);
1028         if (ret)
1029         {
1030             *phCryptProv = keyContext.hCryptProv;
1031             if (pdwKeySpec)
1032                 *pdwKeySpec = keyContext.dwKeySpec;
1033             if (pfCallerFreeProv)
1034                 *pfCallerFreeProv = FALSE;
1035         }
1036     }
1037     if (!*phCryptProv)
1038     {
1039         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, dwFlags, info,
1040          &keyContext.hCryptProv, &keyContext.dwKeySpec);
1041         if (ret)
1042         {
1043             *phCryptProv = keyContext.hCryptProv;
1044             if (pdwKeySpec)
1045                 *pdwKeySpec = keyContext.dwKeySpec;
1046             if (cache)
1047             {
1048                 keyContext.cbSize = sizeof(keyContext);
1049                 if (CertSetCertificateContextProperty(pCert,
1050                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
1051                 {
1052                     if (pfCallerFreeProv)
1053                         *pfCallerFreeProv = FALSE;
1054                 }
1055             }
1056             else
1057             {
1058                 if (pfCallerFreeProv)
1059                     *pfCallerFreeProv = TRUE;
1060             }
1061         }
1062     }
1063     HeapFree(GetProcessHeap(), 0, info);
1064     if (cert_in_store)
1065         CertFreeCertificateContext(cert_in_store);
1066     return ret;
1067 }
1068
1069 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
1070  const CRYPT_KEY_PROV_INFO *keyProvInfo)
1071 {
1072     HCRYPTPROV csp;
1073     BOOL matches = FALSE;
1074
1075     if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
1076      keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
1077     {
1078         DWORD size;
1079
1080         /* Need to sign something to verify the sig.  What to sign?  Why not
1081          * the certificate itself?
1082          */
1083         if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
1084          pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
1085          &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
1086         {
1087             BYTE *certEncoded = CryptMemAlloc(size);
1088
1089             if (certEncoded)
1090             {
1091                 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
1092                  pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
1093                  pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
1094                  NULL, certEncoded, &size))
1095                 {
1096                     if (size == pCert->cbCertEncoded &&
1097                      !memcmp(certEncoded, pCert->pbCertEncoded, size))
1098                         matches = TRUE;
1099                 }
1100                 CryptMemFree(certEncoded);
1101             }
1102         }
1103         CryptReleaseContext(csp, 0);
1104     }
1105     return matches;
1106 }
1107
1108 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
1109  CRYPT_KEY_PROV_INFO *keyProvInfo)
1110 {
1111     CRYPT_KEY_PROV_INFO copy;
1112     WCHAR containerW[MAX_PATH];
1113     BOOL matches;
1114
1115     MultiByteToWideChar(CP_ACP, 0, container, -1, containerW, ARRAY_SIZE(containerW));
1116     /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
1117      * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
1118      * name.
1119      */
1120     copy = *keyProvInfo;
1121     copy.pwszContainerName = containerW;
1122     matches = key_prov_info_matches_cert(pCert, &copy);
1123     if (matches)
1124     {
1125         keyProvInfo->pwszContainerName =
1126          CryptMemAlloc((lstrlenW(containerW) + 1) * sizeof(WCHAR));
1127         if (keyProvInfo->pwszContainerName)
1128         {
1129             lstrcpyW(keyProvInfo->pwszContainerName, containerW);
1130             keyProvInfo->dwKeySpec = AT_SIGNATURE;
1131         }
1132         else
1133             matches = FALSE;
1134     }
1135     return matches;
1136 }
1137
1138 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
1139  * private key matches pCert's public key.  Upon success, updates keyProvInfo
1140  * with the matching container's info (free keyProvInfo.pwszContainerName upon
1141  * success.)
1142  * Returns TRUE if found, FALSE if not.
1143  */
1144 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
1145  CRYPT_KEY_PROV_INFO *keyProvInfo)
1146 {
1147     HCRYPTPROV defProvider;
1148     BOOL ret, found = FALSE;
1149     char containerA[MAX_PATH];
1150
1151     assert(keyProvInfo->pwszContainerName == NULL);
1152     if ((ret = CryptAcquireContextW(&defProvider, NULL,
1153      keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
1154      keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
1155     {
1156         DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
1157
1158         while (ret && !found)
1159         {
1160             DWORD size = sizeof(containerA);
1161
1162             ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
1163              (BYTE *)containerA, &size, enumFlags);
1164             if (ret)
1165                 found = container_matches_cert(pCert, containerA, keyProvInfo);
1166             if (enumFlags & CRYPT_FIRST)
1167             {
1168                 enumFlags &= ~CRYPT_FIRST;
1169                 enumFlags |= CRYPT_NEXT;
1170             }
1171         }
1172         CryptReleaseContext(defProvider, 0);
1173     }
1174     return found;
1175 }
1176
1177 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
1178 {
1179     BOOL found = FALSE, ret = TRUE;
1180     DWORD index = 0, cbProvName = 0;
1181     CRYPT_KEY_PROV_INFO keyProvInfo;
1182
1183     TRACE("(%p, %08x)\n", pCert, dwFlags);
1184
1185     memset(&keyProvInfo, 0, sizeof(keyProvInfo));
1186     while (ret && !found)
1187     {
1188         DWORD size = 0;
1189
1190         ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
1191          NULL, &size);
1192         if (ret)
1193         {
1194             if (size <= cbProvName)
1195                 ret = CryptEnumProvidersW(index, NULL, 0,
1196                  &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1197             else
1198             {
1199                 CryptMemFree(keyProvInfo.pwszProvName);
1200                 keyProvInfo.pwszProvName = CryptMemAlloc(size);
1201                 if (keyProvInfo.pwszProvName)
1202                 {
1203                     cbProvName = size;
1204                     ret = CryptEnumProvidersW(index, NULL, 0,
1205                      &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1206                     if (ret)
1207                     {
1208                         if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
1209                             keyProvInfo.dwFlags |= CRYPT_SILENT;
1210                         if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
1211                          !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1212                          CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1213                         {
1214                             keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
1215                             found = find_key_prov_info_in_provider(pCert,
1216                              &keyProvInfo);
1217                         }
1218                         if (!found)
1219                         {
1220                             if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
1221                              !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1222                              CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1223                             {
1224                                 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
1225                                 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
1226                                 found = find_key_prov_info_in_provider(pCert,
1227                                  &keyProvInfo);
1228                             }
1229                         }
1230                     }
1231                 }
1232                 else
1233                     ret = FALSE;
1234             }
1235             index++;
1236         }
1237     }
1238     if (found)
1239         CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1240          0, &keyProvInfo);
1241     CryptMemFree(keyProvInfo.pwszProvName);
1242     CryptMemFree(keyProvInfo.pwszContainerName);
1243     return found;
1244 }
1245
1246 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
1247 {
1248     BOOL matches = FALSE;
1249     DWORD size;
1250
1251     if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1252      NULL, &size))
1253     {
1254         CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
1255
1256         if (keyProvInfo)
1257         {
1258             if (CertGetCertificateContextProperty(pCert,
1259              CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
1260                 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
1261             CryptMemFree(keyProvInfo);
1262         }
1263     }
1264     return matches;
1265 }
1266
1267 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
1268  DWORD dwFlags, void *pvReserved)
1269 {
1270     BOOL matches;
1271
1272     TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
1273
1274     matches = cert_prov_info_matches_cert(pCert);
1275     if (!matches)
1276         matches = find_matching_provider(pCert, dwFlags);
1277     return matches;
1278 }
1279
1280 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1281  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1282 {
1283     BOOL ret;
1284
1285     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1286
1287     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1288      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1289      &pCertId2->SerialNumber);
1290     TRACE("returning %d\n", ret);
1291     return ret;
1292 }
1293
1294 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1295  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1296 {
1297     BOOL ret;
1298
1299     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1300
1301     if (pCertName1->cbData == pCertName2->cbData)
1302     {
1303         if (pCertName1->cbData)
1304             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1305              pCertName1->cbData);
1306         else
1307             ret = TRUE;
1308     }
1309     else
1310         ret = FALSE;
1311     TRACE("returning %d\n", ret);
1312     return ret;
1313 }
1314
1315 /* Returns the number of significant bytes in pInt, where a byte is
1316  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1317  * for negative numbers.  pInt is assumed to be little-endian.
1318  */
1319 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1320 {
1321     DWORD ret = pInt->cbData;
1322
1323     while (ret > 1)
1324     {
1325         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1326             ret--;
1327         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1328             ret--;
1329         else
1330             break;
1331     }
1332     return ret;
1333 }
1334
1335 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1336  PCRYPT_INTEGER_BLOB pInt2)
1337 {
1338     BOOL ret;
1339     DWORD cb1, cb2;
1340
1341     TRACE("(%p, %p)\n", pInt1, pInt2);
1342
1343     cb1 = CRYPT_significantBytes(pInt1);
1344     cb2 = CRYPT_significantBytes(pInt2);
1345     if (cb1 == cb2)
1346     {
1347         if (cb1)
1348             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1349         else
1350             ret = TRUE;
1351     }
1352     else
1353         ret = FALSE;
1354     TRACE("returning %d\n", ret);
1355     return ret;
1356 }
1357
1358 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1359  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1360 {
1361     BOOL ret;
1362
1363     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1364
1365     /* RSA public key data should start with ASN_SEQUENCE,
1366      * otherwise it's not a RSA_CSP_PUBLICKEYBLOB.
1367      */
1368     if (!pPublicKey1->PublicKey.cbData || pPublicKey1->PublicKey.pbData[0] != ASN_SEQUENCE)
1369         dwCertEncodingType = 0;
1370
1371     switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1372     {
1373     case 0:     /* Seems to mean "raw binary bits" */
1374         if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1375          pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1376         {
1377           if (pPublicKey2->PublicKey.cbData)
1378               ret = !memcmp(pPublicKey1->PublicKey.pbData,
1379                pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1380           else
1381               ret = TRUE;
1382         }
1383         else
1384             ret = FALSE;
1385         break;
1386     default:
1387         WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1388         /* FALLTHROUGH */
1389     case X509_ASN_ENCODING:
1390     {
1391         BLOBHEADER *pblob1, *pblob2;
1392         DWORD length;
1393         ret = FALSE;
1394         if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1395                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1396                     CRYPT_DECODE_ALLOC_FLAG, &pblob1, &length))
1397         {
1398             if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1399                         pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1400                         CRYPT_DECODE_ALLOC_FLAG, &pblob2, &length))
1401             {
1402                 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1403                 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1404                           *pk2 = (LPVOID)(pblob2 + 1);
1405                 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1406                          && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1407
1408                 LocalFree(pblob2);
1409             }
1410             LocalFree(pblob1);
1411         }
1412
1413         break;
1414     }
1415     }
1416     return ret;
1417 }
1418
1419 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1420  PCERT_PUBLIC_KEY_INFO pPublicKey)
1421 {
1422     DWORD len = 0;
1423
1424     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1425
1426     if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1427     {
1428         SetLastError(ERROR_FILE_NOT_FOUND);
1429         return 0;
1430     }
1431     if (pPublicKey->Algorithm.pszObjId &&
1432      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1433     {
1434         FIXME("unimplemented for DH public keys\n");
1435         SetLastError(CRYPT_E_ASN1_BADTAG);
1436     }
1437     else
1438     {
1439         PCCRYPT_OID_INFO info;
1440         DWORD size;
1441         PBYTE buf;
1442         BOOL ret;
1443
1444         info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY, pPublicKey->Algorithm.pszObjId, 0);
1445         if (info)
1446         {
1447             HCRYPTKEY key;
1448
1449             TRACE("public key algid %#x (%s)\n", info->u.Algid, debugstr_a(pPublicKey->Algorithm.pszObjId));
1450
1451             ret = CryptImportPublicKeyInfo(I_CryptGetDefaultCryptProv(info->u.Algid), dwCertEncodingType, pPublicKey, &key);
1452             if (ret)
1453             {
1454                 size = sizeof(len);
1455                 ret = CryptGetKeyParam(key, KP_KEYLEN, (BYTE *)&len, &size, 0);
1456                 CryptDestroyKey(key);
1457                 return len;
1458             }
1459             /* fallback to RSA */
1460         }
1461
1462         ret = CryptDecodeObjectEx(dwCertEncodingType,
1463          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1464          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1465          &size);
1466
1467         if (ret)
1468         {
1469             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1470
1471             len = rsaPubKey->bitlen;
1472             LocalFree(buf);
1473         }
1474     }
1475     return len;
1476 }
1477
1478 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1479  DWORD dwFlags, const void *pvPara);
1480
1481 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1482  DWORD dwFlags, const void *pvPara)
1483 {
1484     BOOL ret;
1485     BYTE hash[16];
1486     DWORD size = sizeof(hash);
1487
1488     ret = CertGetCertificateContextProperty(pCertContext,
1489      CERT_MD5_HASH_PROP_ID, hash, &size);
1490     if (ret)
1491     {
1492         const CRYPT_HASH_BLOB *pHash = pvPara;
1493
1494         if (size == pHash->cbData)
1495             ret = !memcmp(pHash->pbData, hash, size);
1496         else
1497             ret = FALSE;
1498     }
1499     return ret;
1500 }
1501
1502 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1503  DWORD dwFlags, const void *pvPara)
1504 {
1505     BOOL ret;
1506     BYTE hash[20];
1507     DWORD size = sizeof(hash);
1508
1509     ret = CertGetCertificateContextProperty(pCertContext,
1510      CERT_SHA1_HASH_PROP_ID, hash, &size);
1511     if (ret)
1512     {
1513         const CRYPT_HASH_BLOB *pHash = pvPara;
1514
1515         if (size == pHash->cbData)
1516             ret = !memcmp(pHash->pbData, hash, size);
1517         else
1518             ret = FALSE;
1519     }
1520     return ret;
1521 }
1522
1523 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1524  DWORD dwFlags, const void *pvPara)
1525 {
1526     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1527     BOOL ret;
1528
1529     if (dwType & CERT_INFO_SUBJECT_FLAG)
1530         toCompare = &pCertContext->pCertInfo->Subject;
1531     else
1532         toCompare = &pCertContext->pCertInfo->Issuer;
1533     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1534      toCompare, blob);
1535     return ret;
1536 }
1537
1538 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1539  DWORD dwType, DWORD dwFlags, const void *pvPara)
1540 {
1541     CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1542     BOOL ret;
1543
1544     ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1545      &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1546     return ret;
1547 }
1548
1549 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1550  DWORD dwType, DWORD dwFlags, const void *pvPara)
1551 {
1552     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1553     BOOL ret;
1554
1555     /* Matching serial number and subject match.. */
1556     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1557      &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1558     if (ret)
1559         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1560          &pCertInfo->SerialNumber);
1561     else
1562     {
1563         /* failing that, if the serial number and issuer match, we match */
1564         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1565          &pCertInfo->SerialNumber);
1566         if (ret)
1567             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1568              &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1569     }
1570     TRACE("returning %d\n", ret);
1571     return ret;
1572 }
1573
1574 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1575  DWORD dwFlags, const void *pvPara)
1576 {
1577     CERT_ID *id = (CERT_ID *)pvPara;
1578     BOOL ret;
1579
1580     switch (id->dwIdChoice)
1581     {
1582     case CERT_ID_ISSUER_SERIAL_NUMBER:
1583         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1584          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1585         if (ret)
1586             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1587              &id->u.IssuerSerialNumber.SerialNumber);
1588         break;
1589     case CERT_ID_SHA1_HASH:
1590         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1591          &id->u.HashId);
1592         break;
1593     case CERT_ID_KEY_IDENTIFIER:
1594     {
1595         DWORD size = 0;
1596
1597         ret = CertGetCertificateContextProperty(pCertContext,
1598          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1599         if (ret && size == id->u.KeyId.cbData)
1600         {
1601             LPBYTE buf = CryptMemAlloc(size);
1602
1603             if (buf)
1604             {
1605                 CertGetCertificateContextProperty(pCertContext,
1606                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1607                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1608                 CryptMemFree(buf);
1609             }
1610             else
1611                 ret = FALSE;
1612         }
1613         else
1614             ret = FALSE;
1615         break;
1616     }
1617     default:
1618         ret = FALSE;
1619         break;
1620     }
1621     return ret;
1622 }
1623
1624 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1625  DWORD dwFlags, const void *pvPara)
1626 {
1627     PCCERT_CONTEXT toCompare = pvPara;
1628     return CertCompareCertificate(pCertContext->dwCertEncodingType,
1629      pCertContext->pCertInfo, toCompare->pCertInfo);
1630 }
1631
1632 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1633  DWORD dwFlags, const void *pvPara)
1634 {
1635     const CRYPT_HASH_BLOB *hash = pvPara;
1636     DWORD size = 0;
1637     BOOL ret;
1638
1639     ret = CertGetCertificateContextProperty(pCertContext,
1640      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1641     if (ret && size == hash->cbData)
1642     {
1643         LPBYTE buf = CryptMemAlloc(size);
1644
1645         if (buf)
1646         {
1647             CertGetCertificateContextProperty(pCertContext,
1648              CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1649             ret = !memcmp(buf, hash->pbData, size);
1650             CryptMemFree(buf);
1651         }
1652         else
1653             ret = FALSE;
1654     }
1655     else
1656         ret = FALSE;
1657     return ret;
1658 }
1659
1660 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1661  PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1662  const void *pvPara)
1663 {
1664     BOOL matches = FALSE;
1665     PCCERT_CONTEXT ret;
1666
1667     ret = prev;
1668     do {
1669         ret = CertEnumCertificatesInStore(store, ret);
1670         if (ret)
1671             matches = compare(ret, dwType, dwFlags, pvPara);
1672     } while (ret != NULL && !matches);
1673     return ret;
1674 }
1675
1676 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1677  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1678
1679 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1680  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1681 {
1682     return CertEnumCertificatesInStore(store, prev);
1683 }
1684
1685 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1686  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1687 {
1688     BOOL ret;
1689     PCCERT_CONTEXT found = NULL, subject = pvPara;
1690     PCERT_EXTENSION ext;
1691     DWORD size;
1692
1693     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1694      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1695     {
1696         CERT_AUTHORITY_KEY_ID_INFO *info;
1697
1698         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1699          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1700          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1701          &info, &size);
1702         if (ret)
1703         {
1704             CERT_ID id;
1705
1706             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1707             {
1708                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1709                 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1710                  sizeof(CERT_NAME_BLOB));
1711                 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1712                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1713             }
1714             else if (info->KeyId.cbData)
1715             {
1716                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1717                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1718             }
1719             else
1720                 ret = FALSE;
1721             if (ret)
1722                 found = cert_compare_certs_in_store(store, prev,
1723                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1724             LocalFree(info);
1725         }
1726     }
1727     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1728      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1729     {
1730         CERT_AUTHORITY_KEY_ID2_INFO *info;
1731
1732         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1733          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1734          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1735          &info, &size);
1736         if (ret)
1737         {
1738             CERT_ID id;
1739
1740             if (info->AuthorityCertIssuer.cAltEntry &&
1741              info->AuthorityCertSerialNumber.cbData)
1742             {
1743                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1744                 DWORD i;
1745
1746                 for (i = 0; !directoryName &&
1747                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1748                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1749                      == CERT_ALT_NAME_DIRECTORY_NAME)
1750                         directoryName =
1751                          &info->AuthorityCertIssuer.rgAltEntry[i];
1752                 if (directoryName)
1753                 {
1754                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1755                     memcpy(&id.u.IssuerSerialNumber.Issuer,
1756                      &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1757                     memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1758                      &info->AuthorityCertSerialNumber,
1759                      sizeof(CRYPT_INTEGER_BLOB));
1760                 }
1761                 else
1762                 {
1763                     FIXME("no supported name type in authority key id2\n");
1764                     ret = FALSE;
1765                 }
1766             }
1767             else if (info->KeyId.cbData)
1768             {
1769                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1770                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1771             }
1772             else
1773                 ret = FALSE;
1774             if (ret)
1775                 found = cert_compare_certs_in_store(store, prev,
1776                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1777             LocalFree(info);
1778         }
1779     }
1780     else
1781        found = cert_compare_certs_in_store(store, prev,
1782         compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1783         dwFlags, &subject->pCertInfo->Issuer);
1784     return found;
1785 }
1786
1787 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1788  DWORD dwType, DWORD dwFlags, const void *pvPara)
1789 {
1790     PCERT_NAME_BLOB name;
1791     DWORD len;
1792     BOOL ret = FALSE;
1793
1794     if (dwType & CERT_INFO_SUBJECT_FLAG)
1795         name = &pCertContext->pCertInfo->Subject;
1796     else
1797         name = &pCertContext->pCertInfo->Issuer;
1798     len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1799      CERT_SIMPLE_NAME_STR, NULL, 0);
1800     if (len)
1801     {
1802         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1803
1804         if (str)
1805         {
1806             CertNameToStrW(pCertContext->dwCertEncodingType, name,
1807              CERT_SIMPLE_NAME_STR, str, len);
1808             wcslwr(str);
1809             if (wcsstr(str, pvPara))
1810                 ret = TRUE;
1811             CryptMemFree(str);
1812         }
1813     }
1814     return ret;
1815 }
1816
1817 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1818  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1819 {
1820     PCCERT_CONTEXT found = NULL;
1821
1822     TRACE("%s\n", debugstr_a(pvPara));
1823
1824     if (pvPara)
1825     {
1826         int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1827         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1828
1829         if (str)
1830         {
1831             MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1832             wcslwr(str);
1833             found = cert_compare_certs_in_store(store, prev,
1834              compare_cert_by_name_str, dwType, dwFlags, str);
1835             CryptMemFree(str);
1836         }
1837     }
1838     else
1839         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1840     return found;
1841 }
1842
1843 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1844  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1845 {
1846     PCCERT_CONTEXT found = NULL;
1847
1848     TRACE("%s\n", debugstr_w(pvPara));
1849
1850     if (pvPara)
1851     {
1852         DWORD len = lstrlenW(pvPara);
1853         LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1854
1855         if (str)
1856         {
1857             wcscpy( str, pvPara );
1858             wcslwr( str );
1859            found = cert_compare_certs_in_store(store, prev,
1860             compare_cert_by_name_str, dwType, dwFlags, str);
1861            CryptMemFree(str);
1862         }
1863     }
1864     else
1865         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1866     return found;
1867 }
1868
1869 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1870  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1871  PCCERT_CONTEXT pPrevCertContext)
1872 {
1873     PCCERT_CONTEXT ret;
1874     CertFindFunc find = NULL;
1875     CertCompareFunc compare = NULL;
1876     CERT_ID cert_id;
1877
1878     TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1879          dwFlags, dwType, pvPara, pPrevCertContext);
1880
1881     switch (dwType >> CERT_COMPARE_SHIFT)
1882     {
1883     case CERT_COMPARE_ANY:
1884         find = find_cert_any;
1885         break;
1886     case CERT_COMPARE_MD5_HASH:
1887         compare = compare_cert_by_md5_hash;
1888         break;
1889     case CERT_COMPARE_SHA1_HASH:
1890         compare = compare_cert_by_sha1_hash;
1891         break;
1892     case CERT_COMPARE_NAME:
1893         compare = compare_cert_by_name;
1894         break;
1895     case CERT_COMPARE_PUBLIC_KEY:
1896         compare = compare_cert_by_public_key;
1897         break;
1898     case CERT_COMPARE_NAME_STR_A:
1899         find = find_cert_by_name_str_a;
1900         break;
1901     case CERT_COMPARE_NAME_STR_W:
1902         find = find_cert_by_name_str_w;
1903         break;
1904     case CERT_COMPARE_SUBJECT_CERT:
1905         compare = compare_cert_by_subject_cert;
1906         break;
1907     case CERT_COMPARE_KEY_IDENTIFIER:
1908         cert_id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1909         cert_id.u.KeyId = *(const CRYPT_HASH_BLOB *)pvPara;
1910         pvPara = &cert_id;
1911         /* fall through */
1912     case CERT_COMPARE_CERT_ID:
1913         compare = compare_cert_by_cert_id;
1914         break;
1915     case CERT_COMPARE_ISSUER_OF:
1916         find = find_cert_by_issuer;
1917         break;
1918     case CERT_COMPARE_EXISTING:
1919         compare = compare_existing_cert;
1920         break;
1921     case CERT_COMPARE_SIGNATURE_HASH:
1922         compare = compare_cert_by_signature_hash;
1923         break;
1924     default:
1925         FIXME("find type %08x unimplemented\n", dwType);
1926     }
1927
1928     if (find)
1929         ret = find(hCertStore, dwType, dwFlags, pvPara, pPrevCertContext);
1930     else if (compare)
1931         ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1932          compare, dwType, dwFlags, pvPara);
1933     else
1934         ret = NULL;
1935     if (!ret)
1936         SetLastError(CRYPT_E_NOT_FOUND);
1937     TRACE("returning %p\n", ret);
1938     return ret;
1939 }
1940
1941 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1942  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1943 {
1944     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1945
1946     if (!pCertId)
1947     {
1948         SetLastError(E_INVALIDARG);
1949         return NULL;
1950     }
1951     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1952      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1953 }
1954
1955 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1956  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1957 {
1958     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1959      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1960
1961     if (*pdwFlags & ~supportedFlags)
1962     {
1963         SetLastError(E_INVALIDARG);
1964         return FALSE;
1965     }
1966     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1967     {
1968         DWORD flags = 0;
1969         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1970          NULL, &flags);
1971
1972         /* FIXME: what if the CRL has expired? */
1973         if (crl)
1974         {
1975             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1976              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1977                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1978         }
1979         else
1980             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1981     }
1982     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1983     {
1984         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1985             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1986     }
1987     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1988     {
1989         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1990          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1991          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1992             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1993     }
1994     return TRUE;
1995 }
1996
1997 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1998  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1999  DWORD *pdwFlags)
2000 {
2001     PCCERT_CONTEXT ret;
2002
2003     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
2004      pPrevIssuerContext, *pdwFlags);
2005
2006     if (!pSubjectContext)
2007     {
2008         SetLastError(E_INVALIDARG);
2009         return NULL;
2010     }
2011
2012     ret = CertFindCertificateInStore(hCertStore,
2013      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
2014      pSubjectContext, pPrevIssuerContext);
2015     if (ret)
2016     {
2017         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
2018          pdwFlags))
2019         {
2020             CertFreeCertificateContext(ret);
2021             ret = NULL;
2022         }
2023         if (CRYPT_IsCertificateSelfSigned(pSubjectContext))
2024         {
2025             CertFreeCertificateContext(ret);
2026             ret = NULL;
2027             SetLastError(CRYPT_E_SELF_SIGNED);
2028         }
2029     }
2030     TRACE("returning %p\n", ret);
2031     return ret;
2032 }
2033
2034 typedef struct _OLD_CERT_REVOCATION_STATUS {
2035     DWORD cbSize;
2036     DWORD dwIndex;
2037     DWORD dwError;
2038     DWORD dwReason;
2039 } OLD_CERT_REVOCATION_STATUS;
2040
2041 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
2042  void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
2043
2044 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
2045  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
2046  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
2047 {
2048     BOOL ret;
2049
2050     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
2051      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
2052
2053     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
2054      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
2055     {
2056         SetLastError(E_INVALIDARG);
2057         return FALSE;
2058     }
2059     if (cContext)
2060     {
2061         static HCRYPTOIDFUNCSET set = NULL;
2062         DWORD size;
2063
2064         if (!set)
2065             set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
2066         ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
2067         if (ret)
2068         {
2069             if (size == 1)
2070             {
2071                 /* empty list */
2072                 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
2073                 ret = FALSE;
2074             }
2075             else
2076             {
2077                 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
2078
2079                 if (dllList)
2080                 {
2081                     ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
2082                      dllList, &size);
2083                     if (ret)
2084                     {
2085                         for (ptr = dllList; ret && *ptr;
2086                          ptr += lstrlenW(ptr) + 1)
2087                         {
2088                             CertVerifyRevocationFunc func;
2089                             HCRYPTOIDFUNCADDR hFunc;
2090
2091                             ret = CryptGetDefaultOIDFunctionAddress(set,
2092                              dwEncodingType, ptr, 0, (void **)&func, &hFunc);
2093                             if (ret)
2094                             {
2095                                 ret = func(dwEncodingType, dwRevType, cContext,
2096                                  rgpvContext, dwFlags, pRevPara, pRevStatus);
2097                                 CryptFreeOIDFunctionAddress(hFunc, 0);
2098                             }
2099                         }
2100                     }
2101                     CryptMemFree(dllList);
2102                 }
2103                 else
2104                 {
2105                     SetLastError(ERROR_OUTOFMEMORY);
2106                     ret = FALSE;
2107                 }
2108             }
2109         }
2110     }
2111     else
2112         ret = TRUE;
2113     return ret;
2114 }
2115
2116 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
2117  CRYPT_ATTRIBUTE rgAttr[])
2118 {
2119     PCRYPT_ATTRIBUTE ret = NULL;
2120     DWORD i;
2121
2122     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
2123
2124     if (!cAttr)
2125         return NULL;
2126     if (!pszObjId)
2127     {
2128         SetLastError(ERROR_INVALID_PARAMETER);
2129         return NULL;
2130     }
2131
2132     for (i = 0; !ret && i < cAttr; i++)
2133         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
2134             ret = &rgAttr[i];
2135     return ret;
2136 }
2137
2138 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
2139  CERT_EXTENSION rgExtensions[])
2140 {
2141     PCERT_EXTENSION ret = NULL;
2142     DWORD i;
2143
2144     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
2145
2146     if (!cExtensions)
2147         return NULL;
2148     if (!pszObjId)
2149     {
2150         SetLastError(ERROR_INVALID_PARAMETER);
2151         return NULL;
2152     }
2153
2154     for (i = 0; !ret && i < cExtensions; i++)
2155         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
2156          rgExtensions[i].pszObjId))
2157             ret = &rgExtensions[i];
2158     return ret;
2159 }
2160
2161 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
2162 {
2163     PCERT_RDN_ATTR ret = NULL;
2164     DWORD i, j;
2165
2166     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
2167
2168     if (!pszObjId)
2169     {
2170         SetLastError(ERROR_INVALID_PARAMETER);
2171         return NULL;
2172     }
2173
2174     for (i = 0; !ret && i < pName->cRDN; i++)
2175         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
2176             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
2177              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
2178                 ret = &pName->rgRDN[i].rgRDNAttr[j];
2179     return ret;
2180 }
2181
2182 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
2183  const CERT_RDN_ATTR *attr)
2184 {
2185     DWORD i, j;
2186     BOOL match = FALSE;
2187
2188     for (i = 0; !match && i < name->cRDN; i++)
2189     {
2190         for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
2191         {
2192             if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
2193              attr->pszObjId) &&
2194              name->rgRDN[i].rgRDNAttr[j].dwValueType ==
2195              attr->dwValueType)
2196             {
2197                 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
2198                 {
2199                     LPCWSTR nameStr =
2200                      (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2201                     LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
2202
2203                     if (attr->Value.cbData !=
2204                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2205                         match = FALSE;
2206                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2207                         match = !wcsnicmp(nameStr, attrStr,
2208                          attr->Value.cbData / sizeof(WCHAR));
2209                     else
2210                         match = !wcsncmp(nameStr, attrStr,
2211                          attr->Value.cbData / sizeof(WCHAR));
2212                     TRACE("%s : %s => %d\n",
2213                      debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
2214                      debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
2215                      match);
2216                 }
2217                 else
2218                 {
2219                     LPCSTR nameStr =
2220                      (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2221                     LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
2222
2223                     if (attr->Value.cbData !=
2224                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2225                         match = FALSE;
2226                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2227                         match = !_strnicmp(nameStr, attrStr,
2228                          attr->Value.cbData);
2229                     else
2230                         match = !strncmp(nameStr, attrStr, attr->Value.cbData);
2231                     TRACE("%s : %s => %d\n",
2232                      debugstr_an(nameStr, attr->Value.cbData),
2233                      debugstr_an(attrStr, attr->Value.cbData), match);
2234                 }
2235             }
2236         }
2237     }
2238     return match;
2239 }
2240
2241 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
2242  DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
2243 {
2244     CERT_NAME_INFO *name;
2245     LPCSTR type;
2246     DWORD size;
2247     BOOL ret;
2248
2249     TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
2250      pRDN);
2251
2252     type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
2253      X509_NAME;
2254     if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
2255      pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
2256     {
2257         DWORD i;
2258
2259         for (i = 0; ret && i < pRDN->cRDNAttr; i++)
2260             ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
2261         if (!ret)
2262             SetLastError(CRYPT_E_NO_MATCH);
2263         LocalFree(name);
2264     }
2265     return ret;
2266 }
2267
2268 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
2269  PCERT_INFO pCertInfo)
2270 {
2271     FILETIME fileTime;
2272     LONG ret;
2273
2274     if (!pTimeToVerify)
2275     {
2276         GetSystemTimeAsFileTime(&fileTime);
2277         pTimeToVerify = &fileTime;
2278     }
2279     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
2280     {
2281         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
2282         if (ret < 0)
2283             ret = 0;
2284     }
2285     return ret;
2286 }
2287
2288 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
2289  PCERT_INFO pIssuerInfo)
2290 {
2291     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
2292
2293     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
2294      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
2295 }
2296
2297 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2298  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2299  DWORD *pcbComputedHash)
2300 {
2301     BOOL ret = TRUE;
2302     HCRYPTHASH hHash = 0;
2303
2304     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
2305      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2306
2307     if (!hCryptProv)
2308         hCryptProv = I_CryptGetDefaultCryptProv(Algid);
2309     if (!Algid)
2310         Algid = CALG_SHA1;
2311     if (ret)
2312     {
2313         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2314         if (ret)
2315         {
2316             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2317             if (ret)
2318                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2319                  pcbComputedHash, 0);
2320             CryptDestroyHash(hHash);
2321         }
2322     }
2323     return ret;
2324 }
2325
2326 BOOL WINAPI CryptHashCertificate2(LPCWSTR pwszCNGHashAlgid, DWORD dwFlags,
2327  void *pvReserved, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2328  DWORD *pcbComputedHash)
2329 {
2330     BCRYPT_HASH_HANDLE hash = NULL;
2331     BCRYPT_ALG_HANDLE alg = NULL;
2332     NTSTATUS status;
2333     DWORD hash_len;
2334     DWORD hash_len_size;
2335
2336     TRACE("(%s, %08x, %p, %p, %d, %p, %p)\n", debugstr_w(pwszCNGHashAlgid),
2337      dwFlags, pvReserved, pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2338
2339     if ((status = BCryptOpenAlgorithmProvider(&alg, pwszCNGHashAlgid, NULL, 0)))
2340     {
2341         if (status == STATUS_NOT_IMPLEMENTED)
2342             status = STATUS_NOT_FOUND;
2343         goto done;
2344     }
2345
2346     if ((status = BCryptCreateHash(alg, &hash, NULL, 0, NULL, 0, 0)))
2347         goto done;
2348
2349     if ((status = BCryptGetProperty(hash, BCRYPT_HASH_LENGTH, (BYTE *)&hash_len, sizeof(hash_len), &hash_len_size, 0)))
2350         goto done;
2351
2352     if (!pbComputedHash)
2353     {
2354         *pcbComputedHash = hash_len;
2355         goto done;
2356     }
2357
2358     if (*pcbComputedHash < hash_len)
2359     {
2360         status = ERROR_MORE_DATA;
2361         goto done;
2362     }
2363
2364     *pcbComputedHash = hash_len;
2365
2366     if ((status = BCryptHashData(hash, (BYTE *)pbEncoded, cbEncoded, 0)))
2367         goto done;
2368
2369     if ((status = BCryptFinishHash(hash, pbComputedHash, hash_len, 0)))
2370         goto done;
2371
2372 done:
2373     if (hash) BCryptDestroyHash(hash);
2374     if (alg)  BCryptCloseAlgorithmProvider(alg, 0);
2375     if (status) SetLastError(status);
2376     return !status;
2377 }
2378
2379 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2380  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2381  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2382 {
2383     BOOL ret = TRUE;
2384     HCRYPTHASH hHash = 0;
2385
2386     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2387      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2388
2389     if (!hCryptProv)
2390         hCryptProv = I_CryptGetDefaultCryptProv(0);
2391     if (!Algid)
2392         Algid = CALG_MD5;
2393     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2394     {
2395         SetLastError(ERROR_FILE_NOT_FOUND);
2396         return FALSE;
2397     }
2398     if (ret)
2399     {
2400         BYTE *buf;
2401         DWORD size = 0;
2402
2403         ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2404          X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2405          (LPBYTE)&buf, &size);
2406         if (ret)
2407         {
2408             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2409             if (ret)
2410             {
2411                 ret = CryptHashData(hHash, buf, size, 0);
2412                 if (ret)
2413                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2414                      pcbComputedHash, 0);
2415                 CryptDestroyHash(hHash);
2416             }
2417             LocalFree(buf);
2418         }
2419     }
2420     return ret;
2421 }
2422
2423 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2424  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2425  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2426 {
2427     BOOL ret;
2428     CERT_SIGNED_CONTENT_INFO *info;
2429     DWORD size;
2430
2431     TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2432      pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2433
2434     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2435      pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2436     if (ret)
2437     {
2438         PCCRYPT_OID_INFO oidInfo;
2439         HCRYPTHASH hHash;
2440
2441         if (!hCryptProv)
2442             hCryptProv = I_CryptGetDefaultCryptProv(0);
2443         oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2444          info->SignatureAlgorithm.pszObjId, 0);
2445         if (!oidInfo)
2446         {
2447             SetLastError(NTE_BAD_ALGID);
2448             ret = FALSE;
2449         }
2450         else
2451         {
2452             ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2453             if (ret)
2454             {
2455                 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2456                  info->ToBeSigned.cbData, 0);
2457                 if (ret)
2458                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2459                      pcbComputedHash, 0);
2460                 CryptDestroyHash(hHash);
2461             }
2462         }
2463         LocalFree(info);
2464     }
2465     return ret;
2466 }
2467
2468 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2469  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2470  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2471  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2472 {
2473     BOOL ret;
2474     PCCRYPT_OID_INFO info;
2475     HCRYPTHASH hHash;
2476
2477     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2478      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2479      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2480
2481     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2482      pSignatureAlgorithm->pszObjId, 0);
2483     if (!info)
2484     {
2485         SetLastError(NTE_BAD_ALGID);
2486         return FALSE;
2487     }
2488     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2489     {
2490         if (!hCryptProv)
2491             hCryptProv = I_CryptGetDefaultCryptProv(0);
2492         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2493         if (ret)
2494         {
2495             ret = CryptHashData(hHash, pbEncodedToBeSigned,
2496              cbEncodedToBeSigned, 0);
2497             if (ret)
2498                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2499                  pcbSignature, 0);
2500             CryptDestroyHash(hHash);
2501         }
2502     }
2503     else
2504     {
2505         if (!hCryptProv)
2506         {
2507             SetLastError(ERROR_INVALID_PARAMETER);
2508             ret = FALSE;
2509         }
2510         else
2511         {
2512             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2513             if (ret)
2514             {
2515                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2516                  cbEncodedToBeSigned, 0);
2517                 if (ret)
2518                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2519                      pcbSignature);
2520                 CryptDestroyHash(hHash);
2521             }
2522         }
2523     }
2524     return ret;
2525 }
2526
2527 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2528  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2529  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2530  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2531 {
2532     BOOL ret;
2533     DWORD encodedSize, hashSize;
2534
2535     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2536      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2537      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2538
2539     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2540      NULL, &encodedSize);
2541     if (ret)
2542     {
2543         PBYTE encoded = CryptMemAlloc(encodedSize);
2544
2545         if (encoded)
2546         {
2547             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2548              pvStructInfo, encoded, &encodedSize);
2549             if (ret)
2550             {
2551                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2552                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2553                  pvHashAuxInfo, NULL, &hashSize);
2554                 if (ret)
2555                 {
2556                     PBYTE hash = CryptMemAlloc(hashSize);
2557
2558                     if (hash)
2559                     {
2560                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2561                          dwCertEncodingType, encoded, encodedSize,
2562                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2563                         if (ret)
2564                         {
2565                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2566
2567                             info.ToBeSigned.cbData = encodedSize;
2568                             info.ToBeSigned.pbData = encoded;
2569                             info.SignatureAlgorithm = *pSignatureAlgorithm;
2570                             info.Signature.cbData = hashSize;
2571                             info.Signature.pbData = hash;
2572                             info.Signature.cUnusedBits = 0;
2573                             ret = CryptEncodeObject(dwCertEncodingType,
2574                              X509_CERT, &info, pbEncoded, pcbEncoded);
2575                         }
2576                         CryptMemFree(hash);
2577                     }
2578                     else
2579                         ret = FALSE;
2580                 }
2581             }
2582             CryptMemFree(encoded);
2583         }
2584         else
2585             ret = FALSE;
2586     }
2587     return ret;
2588 }
2589
2590 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2591  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2592  PCERT_PUBLIC_KEY_INFO pPublicKey)
2593 {
2594     CRYPT_DATA_BLOB blob = { cbEncoded, (BYTE *)pbEncoded };
2595
2596     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2597      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &blob,
2598      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2599 }
2600
2601 static BOOL CRYPT_VerifySignature(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2602     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert, const CRYPT_OID_INFO *info)
2603 {
2604     BOOL ret;
2605     HCRYPTKEY key;
2606     ALG_ID pubKeyID, hashID;
2607
2608     hashID = info->u.Algid;
2609     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2610         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2611     else
2612         pubKeyID = hashID;
2613     /* Load the default provider if necessary */
2614     if (!hCryptProv)
2615         hCryptProv = I_CryptGetDefaultCryptProv(hashID);
2616     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2617      pubKeyInfo, pubKeyID, 0, NULL, &key);
2618     if (ret)
2619     {
2620         HCRYPTHASH hash;
2621
2622         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2623         if (ret)
2624         {
2625             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2626              signedCert->ToBeSigned.cbData, 0);
2627             if (ret)
2628                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2629                  signedCert->Signature.cbData, key, NULL, 0);
2630             CryptDestroyHash(hash);
2631         }
2632         CryptDestroyKey(key);
2633     }
2634     return ret;
2635 }
2636
2637 static BOOL CNG_CalcHash(const WCHAR *algorithm, const CERT_SIGNED_CONTENT_INFO *signedCert,
2638         BYTE **hash_value, DWORD *hash_len)
2639 {
2640     BCRYPT_HASH_HANDLE hash = NULL;
2641     BCRYPT_ALG_HANDLE alg = NULL;
2642     NTSTATUS status;
2643     DWORD size;
2644
2645     if ((status = BCryptOpenAlgorithmProvider(&alg, algorithm, NULL, 0)))
2646         goto done;
2647
2648     if ((status = BCryptCreateHash(alg, &hash, NULL, 0, NULL, 0, 0)))
2649         goto done;
2650
2651     if ((status = BCryptHashData(hash, signedCert->ToBeSigned.pbData, signedCert->ToBeSigned.cbData, 0)))
2652         goto done;
2653
2654     if ((status = BCryptGetProperty(hash, BCRYPT_HASH_LENGTH, (BYTE *)hash_len, sizeof(*hash_len), &size, 0)))
2655         goto done;
2656
2657     if (!(*hash_value = CryptMemAlloc(*hash_len)))
2658     {
2659         status = STATUS_NO_MEMORY;
2660         goto done;
2661     }
2662
2663     if ((status = BCryptFinishHash(hash, *hash_value, *hash_len, 0)))
2664     {
2665         CryptMemFree(*hash_value);
2666         goto done;
2667     }
2668
2669 done:
2670     if (hash) BCryptDestroyHash(hash);
2671     if (alg)  BCryptCloseAlgorithmProvider(alg, 0);
2672     if (status) SetLastError(RtlNtStatusToDosError(status));
2673     return status == 0;
2674 }
2675
2676 static BOOL CNG_ImportECCPubKey(CERT_PUBLIC_KEY_INFO *pubKeyInfo, BCRYPT_KEY_HANDLE *key)
2677 {
2678     DWORD blob_magic, ecckey_len, size;
2679     BCRYPT_ALG_HANDLE alg = NULL;
2680     BCRYPT_ECCKEY_BLOB *ecckey;
2681     const WCHAR *sign_algo;
2682     char **ecc_curve;
2683     NTSTATUS status;
2684
2685     if (!pubKeyInfo->PublicKey.cbData)
2686     {
2687         SetLastError(NTE_BAD_ALGID);
2688         return FALSE;
2689     }
2690
2691     if (pubKeyInfo->PublicKey.pbData[0] != 0x4)
2692     {
2693         FIXME("Compressed ECC curves (%02x) not yet supported\n", pubKeyInfo->PublicKey.pbData[0]);
2694         SetLastError(NTE_BAD_ALGID);
2695         return FALSE;
2696     }
2697
2698     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_OBJECT_IDENTIFIER, pubKeyInfo->Algorithm.Parameters.pbData,
2699             pubKeyInfo->Algorithm.Parameters.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &ecc_curve, &size))
2700         return FALSE;
2701
2702     if (!strcmp(*ecc_curve, szOID_ECC_CURVE_P256))
2703     {
2704         sign_algo = BCRYPT_ECDSA_P256_ALGORITHM;
2705         blob_magic = BCRYPT_ECDSA_PUBLIC_P256_MAGIC;
2706     }
2707     else if (!strcmp(*ecc_curve, szOID_ECC_CURVE_P384))
2708     {
2709         sign_algo = BCRYPT_ECDSA_P384_ALGORITHM;
2710         blob_magic = BCRYPT_ECDSA_PUBLIC_P384_MAGIC;
2711     }
2712     else
2713     {
2714         FIXME("Unsupported ecc curve type: %s\n", *ecc_curve);
2715         sign_algo = NULL;
2716         blob_magic = 0;
2717     }
2718     LocalFree(ecc_curve);
2719
2720     if (!sign_algo)
2721     {
2722         SetLastError(NTE_BAD_ALGID);
2723         return FALSE;
2724     }
2725
2726     if ((status = BCryptOpenAlgorithmProvider(&alg, sign_algo, NULL, 0)))
2727         goto done;
2728
2729     ecckey_len = sizeof(BCRYPT_ECCKEY_BLOB) + pubKeyInfo->PublicKey.cbData - 1;
2730     if (!(ecckey = CryptMemAlloc(ecckey_len)))
2731     {
2732         status = STATUS_NO_MEMORY;
2733         goto done;
2734     }
2735
2736     ecckey->dwMagic = blob_magic;
2737     ecckey->cbKey = (pubKeyInfo->PublicKey.cbData - 1) / 2;
2738     memcpy(ecckey + 1, pubKeyInfo->PublicKey.pbData + 1, pubKeyInfo->PublicKey.cbData - 1);
2739
2740     status = BCryptImportKeyPair(alg, NULL, BCRYPT_ECCPUBLIC_BLOB, key, (BYTE*)ecckey, ecckey_len, 0);
2741     CryptMemFree(ecckey);
2742
2743 done:
2744     if (alg) BCryptCloseAlgorithmProvider(alg, 0);
2745     if (status) SetLastError(RtlNtStatusToDosError(status));
2746     return !status;
2747 }
2748
2749 static BOOL CNG_ImportPubKey(CERT_PUBLIC_KEY_INFO *pubKeyInfo, BCRYPT_KEY_HANDLE *key)
2750 {
2751     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_ECC_PUBLIC_KEY))
2752         return CNG_ImportECCPubKey(pubKeyInfo, key);
2753
2754     FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo->Algorithm.pszObjId));
2755     SetLastError(NTE_BAD_ALGID);
2756     return FALSE;
2757 }
2758
2759 static BOOL CNG_PrepareSignatureECC(BYTE *encoded_sig, DWORD encoded_size, BYTE **sig_value, DWORD *sig_len)
2760 {
2761     CERT_ECC_SIGNATURE *ecc_sig;
2762     DWORD size;
2763     int i;
2764
2765     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ECC_SIGNATURE, encoded_sig, encoded_size,
2766             CRYPT_DECODE_ALLOC_FLAG, NULL, &ecc_sig, &size))
2767         return FALSE;
2768
2769     if (!ecc_sig->r.cbData || !ecc_sig->s.cbData)
2770     {
2771         LocalFree(ecc_sig);
2772         SetLastError(ERROR_INVALID_DATA);
2773         return FALSE;
2774     }
2775
2776     *sig_len = ecc_sig->r.cbData + ecc_sig->s.cbData;
2777     if (!(*sig_value = CryptMemAlloc(*sig_len)))
2778     {
2779         LocalFree(ecc_sig);
2780         SetLastError(ERROR_OUTOFMEMORY);
2781         return FALSE;
2782     }
2783
2784     for (i = 0; i < ecc_sig->r.cbData; i++)
2785         (*sig_value)[i] = ecc_sig->r.pbData[ecc_sig->r.cbData - i - 1];
2786     for (i = 0; i < ecc_sig->s.cbData; i++)
2787         (*sig_value)[ecc_sig->r.cbData + i] = ecc_sig->s.pbData[ecc_sig->s.cbData - i - 1];
2788
2789     LocalFree(ecc_sig);
2790     return TRUE;
2791 }
2792
2793 static BOOL CNG_PrepareSignature(CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert,
2794     BYTE **sig_value, DWORD *sig_len)
2795 {
2796     BYTE *encoded_sig;
2797     BOOL ret = FALSE;
2798     int i;
2799
2800     if (!signedCert->Signature.cbData)
2801     {
2802         SetLastError(ERROR_INVALID_DATA);
2803         return FALSE;
2804     }
2805
2806     if (!(encoded_sig = CryptMemAlloc(signedCert->Signature.cbData)))
2807     {
2808         SetLastError(ERROR_OUTOFMEMORY);
2809         return FALSE;
2810     }
2811
2812     for (i = 0; i < signedCert->Signature.cbData; i++)
2813         encoded_sig[i] = signedCert->Signature.pbData[signedCert->Signature.cbData - i - 1];
2814
2815     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_ECC_PUBLIC_KEY))
2816         ret = CNG_PrepareSignatureECC(encoded_sig, signedCert->Signature.cbData, sig_value, sig_len);
2817     else
2818     {
2819         FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo->Algorithm.pszObjId));
2820         SetLastError(NTE_BAD_ALGID);
2821     }
2822
2823     CryptMemFree(encoded_sig);
2824     return ret;
2825 }
2826
2827 static BOOL CNG_VerifySignature(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2828     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert, const CRYPT_OID_INFO *info)
2829 {
2830     BCRYPT_KEY_HANDLE key = NULL;
2831     BYTE *hash_value = NULL, *sig_value;
2832     DWORD hash_len, sig_len;
2833     NTSTATUS status;
2834     BOOL ret;
2835
2836     ret = CNG_ImportPubKey(pubKeyInfo, &key);
2837     if (ret)
2838     {
2839         ret = CNG_CalcHash(info->pwszCNGAlgid, signedCert, &hash_value, &hash_len);
2840         if (ret)
2841         {
2842             ret = CNG_PrepareSignature(pubKeyInfo, signedCert, &sig_value, &sig_len);
2843             if (ret)
2844             {
2845                 status = BCryptVerifySignature(key, NULL, hash_value, hash_len, sig_value, sig_len, 0);
2846                 if (status)
2847                 {
2848                     FIXME("Failed to verify signature: %08x\n", status);
2849                     SetLastError(RtlNtStatusToDosError(status));
2850                     ret = FALSE;
2851                 }
2852                 CryptMemFree(sig_value);
2853             }
2854             CryptMemFree(hash_value);
2855         }
2856         BCryptDestroyKey(key);
2857     }
2858
2859     return ret;
2860 }
2861
2862 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2863     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert)
2864 {
2865     CCRYPT_OID_INFO *info;
2866
2867     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY, signedCert->SignatureAlgorithm.pszObjId, 0);
2868     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2869     {
2870         SetLastError(NTE_BAD_ALGID);
2871         return FALSE;
2872     }
2873
2874     if (info->u.Algid == CALG_OID_INFO_CNG_ONLY)
2875         return CNG_VerifySignature(hCryptProv, dwCertEncodingType, pubKeyInfo, signedCert, info);
2876     else
2877         return CRYPT_VerifySignature(hCryptProv, dwCertEncodingType, pubKeyInfo, signedCert, info);
2878 }
2879
2880 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2881  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2882  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2883 {
2884     BOOL ret = TRUE;
2885     CRYPT_DATA_BLOB subjectBlob;
2886
2887     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2888      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2889      dwFlags, pvReserved);
2890
2891     switch (dwSubjectType)
2892     {
2893     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2894     {
2895         PCRYPT_DATA_BLOB blob = pvSubject;
2896
2897         subjectBlob.pbData = blob->pbData;
2898         subjectBlob.cbData = blob->cbData;
2899         break;
2900     }
2901     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2902     {
2903         PCERT_CONTEXT context = pvSubject;
2904
2905         subjectBlob.pbData = context->pbCertEncoded;
2906         subjectBlob.cbData = context->cbCertEncoded;
2907         break;
2908     }
2909     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2910     {
2911         PCRL_CONTEXT context = pvSubject;
2912
2913         subjectBlob.pbData = context->pbCrlEncoded;
2914         subjectBlob.cbData = context->cbCrlEncoded;
2915         break;
2916     }
2917     default:
2918         SetLastError(E_INVALIDARG);
2919         ret = FALSE;
2920     }
2921
2922     if (ret)
2923     {
2924         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2925         DWORD size = 0;
2926
2927         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2928          subjectBlob.pbData, subjectBlob.cbData,
2929          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2930          &signedCert, &size);
2931         if (ret)
2932         {
2933             switch (dwIssuerType)
2934             {
2935             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2936                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2937                  dwCertEncodingType, pvIssuer,
2938                  signedCert);
2939                 break;
2940             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2941                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2942                  dwCertEncodingType,
2943                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2944                  signedCert);
2945                 break;
2946             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2947                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2948                 ret = FALSE;
2949                 break;
2950             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2951                 if (pvIssuer)
2952                 {
2953                     SetLastError(E_INVALIDARG);
2954                     ret = FALSE;
2955                 }
2956                 else
2957                 {
2958                     FIXME("unimplemented for NULL signer\n");
2959                     SetLastError(E_INVALIDARG);
2960                     ret = FALSE;
2961                 }
2962                 break;
2963             default:
2964                 SetLastError(E_INVALIDARG);
2965                 ret = FALSE;
2966             }
2967             LocalFree(signedCert);
2968         }
2969     }
2970     return ret;
2971 }
2972
2973 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2974  PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2975 {
2976     PCERT_EXTENSION ext;
2977     BOOL ret = FALSE;
2978
2979     TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2980      cbKeyUsage);
2981
2982     ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2983      pCertInfo->rgExtension);
2984     if (ext)
2985     {
2986         CRYPT_BIT_BLOB usage;
2987         DWORD size = sizeof(usage);
2988
2989         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2990          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2991          &usage, &size);
2992         if (ret)
2993         {
2994             if (cbKeyUsage < usage.cbData)
2995                 ret = FALSE;
2996             else
2997             {
2998                 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2999                 if (cbKeyUsage > usage.cbData)
3000                     memset(pbKeyUsage + usage.cbData, 0,
3001                      cbKeyUsage - usage.cbData);
3002             }
3003         }
3004     }
3005     else
3006         SetLastError(0);
3007     return ret;
3008 }
3009
3010 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
3011  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
3012 {
3013     PCERT_ENHKEY_USAGE usage = NULL;
3014     DWORD bytesNeeded;
3015     BOOL ret = TRUE;
3016
3017     if (!pCertContext || !pcbUsage)
3018     {
3019         SetLastError(ERROR_INVALID_PARAMETER);
3020         return FALSE;
3021     }
3022
3023     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
3024
3025     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
3026     {
3027         DWORD propSize = 0;
3028
3029         if (CertGetCertificateContextProperty(pCertContext,
3030          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
3031         {
3032             LPBYTE buf = CryptMemAlloc(propSize);
3033
3034             if (buf)
3035             {
3036                 if (CertGetCertificateContextProperty(pCertContext,
3037                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
3038                 {
3039                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
3040                      X509_ENHANCED_KEY_USAGE, buf, propSize,
3041                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
3042                 }
3043                 CryptMemFree(buf);
3044             }
3045         }
3046     }
3047     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
3048     {
3049         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
3050          pCertContext->pCertInfo->cExtension,
3051          pCertContext->pCertInfo->rgExtension);
3052
3053         if (ext)
3054         {
3055             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
3056              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
3057              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
3058         }
3059     }
3060     if (!usage)
3061     {
3062         /* If a particular location is specified, this should fail.  Otherwise
3063          * it should succeed with an empty usage.  (This is true on Win2k and
3064          * later, which we emulate.)
3065          */
3066         if (dwFlags)
3067         {
3068             SetLastError(CRYPT_E_NOT_FOUND);
3069             ret = FALSE;
3070         }
3071         else
3072             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
3073     }
3074
3075     if (ret)
3076     {
3077         if (!pUsage)
3078             *pcbUsage = bytesNeeded;
3079         else if (*pcbUsage < bytesNeeded)
3080         {
3081             SetLastError(ERROR_MORE_DATA);
3082             *pcbUsage = bytesNeeded;
3083             ret = FALSE;
3084         }
3085         else
3086         {
3087             *pcbUsage = bytesNeeded;
3088             if (usage)
3089             {
3090                 DWORD i;
3091                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
3092                  sizeof(CERT_ENHKEY_USAGE) +
3093                  usage->cUsageIdentifier * sizeof(LPSTR));
3094
3095                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
3096                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
3097                  sizeof(CERT_ENHKEY_USAGE));
3098                 for (i = 0; i < usage->cUsageIdentifier; i++)
3099                 {
3100                     pUsage->rgpszUsageIdentifier[i] = nextOID;
3101                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
3102                     nextOID += strlen(nextOID) + 1;
3103                 }
3104             }
3105             else
3106                 pUsage->cUsageIdentifier = 0;
3107         }
3108     }
3109     if (usage)
3110         LocalFree(usage);
3111     TRACE("returning %d\n", ret);
3112     return ret;
3113 }
3114
3115 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
3116  PCERT_ENHKEY_USAGE pUsage)
3117 {
3118     BOOL ret;
3119
3120     TRACE("(%p, %p)\n", pCertContext, pUsage);
3121
3122     if (pUsage)
3123     {
3124         CRYPT_DATA_BLOB blob = { 0, NULL };
3125
3126         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
3127          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
3128         if (ret)
3129         {
3130             ret = CertSetCertificateContextProperty(pCertContext,
3131              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
3132             LocalFree(blob.pbData);
3133         }
3134     }
3135     else
3136         ret = CertSetCertificateContextProperty(pCertContext,
3137          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
3138     return ret;
3139 }
3140
3141 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
3142  LPCSTR pszUsageIdentifier)
3143 {
3144     BOOL ret;
3145     DWORD size;
3146
3147     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
3148
3149     if (CertGetEnhancedKeyUsage(pCertContext,
3150      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
3151     {
3152         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
3153
3154         if (usage)
3155         {
3156             ret = CertGetEnhancedKeyUsage(pCertContext,
3157              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
3158             if (ret)
3159             {
3160                 DWORD i;
3161                 BOOL exists = FALSE;
3162
3163                 /* Make sure usage doesn't already exist */
3164                 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
3165                 {
3166                     if (!strcmp(usage->rgpszUsageIdentifier[i],
3167                      pszUsageIdentifier))
3168                         exists = TRUE;
3169                 }
3170                 if (!exists)
3171                 {
3172                     PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
3173                      sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
3174
3175                     if (newUsage)
3176                     {
3177                         LPSTR nextOID;
3178
3179                         newUsage->rgpszUsageIdentifier = (LPSTR *)
3180                          ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
3181                         nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
3182                           + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
3183                         for (i = 0; i < usage->cUsageIdentifier; i++)
3184                         {
3185                             newUsage->rgpszUsageIdentifier[i] = nextOID;
3186                             strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
3187                             nextOID += strlen(nextOID) + 1;
3188                         }
3189                         newUsage->rgpszUsageIdentifier[i] = nextOID;
3190                         strcpy(nextOID, pszUsageIdentifier);
3191                         newUsage->cUsageIdentifier = i + 1;
3192                         ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
3193                         CryptMemFree(newUsage);
3194                     }
3195                     else
3196                         ret = FALSE;
3197                 }
3198             }
3199             CryptMemFree(usage);
3200         }
3201         else
3202             ret = FALSE;
3203     }
3204     else
3205     {
3206         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
3207          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
3208
3209         if (usage)
3210         {
3211             usage->rgpszUsageIdentifier =
3212              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
3213             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
3214              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
3215             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
3216             usage->cUsageIdentifier = 1;
3217             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
3218             CryptMemFree(usage);
3219         }
3220         else
3221             ret = FALSE;
3222     }
3223     return ret;
3224 }
3225
3226 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
3227  LPCSTR pszUsageIdentifier)
3228 {
3229     BOOL ret;
3230     DWORD size;
3231     CERT_ENHKEY_USAGE usage;
3232
3233     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
3234
3235     size = sizeof(usage);
3236     ret = CertGetEnhancedKeyUsage(pCertContext,
3237      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
3238     if (!ret && GetLastError() == ERROR_MORE_DATA)
3239     {
3240         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
3241
3242         if (pUsage)
3243         {
3244             ret = CertGetEnhancedKeyUsage(pCertContext,
3245              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
3246             if (ret)
3247             {
3248                 if (pUsage->cUsageIdentifier)
3249                 {
3250                     DWORD i;
3251                     BOOL found = FALSE;
3252
3253                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
3254                     {
3255                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
3256                          pszUsageIdentifier))
3257                             found = TRUE;
3258                         if (found && i < pUsage->cUsageIdentifier - 1)
3259                             pUsage->rgpszUsageIdentifier[i] =
3260                              pUsage->rgpszUsageIdentifier[i + 1];
3261                     }
3262                     pUsage->cUsageIdentifier--;
3263                     /* Remove the usage if it's empty */
3264                     if (pUsage->cUsageIdentifier)
3265                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
3266                     else
3267                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
3268                 }
3269             }
3270             CryptMemFree(pUsage);
3271         }
3272         else
3273             ret = FALSE;
3274     }
3275     else
3276     {
3277         /* it fit in an empty usage, therefore there's nothing to remove */
3278         ret = TRUE;
3279     }
3280     return ret;
3281 }
3282
3283 struct BitField
3284 {
3285     DWORD  cIndexes;
3286     DWORD *indexes;
3287 };
3288
3289 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
3290
3291 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
3292 {
3293     DWORD indexIndex = bit / BITS_PER_DWORD;
3294
3295     if (indexIndex + 1 > field->cIndexes)
3296     {
3297         if (field->cIndexes)
3298             field->indexes = CryptMemRealloc(field->indexes,
3299              (indexIndex + 1) * sizeof(DWORD));
3300         else
3301             field->indexes = CryptMemAlloc(sizeof(DWORD));
3302         if (field->indexes)
3303         {
3304             field->indexes[indexIndex] = 0;
3305             field->cIndexes = indexIndex + 1;
3306         }
3307     }
3308     if (field->indexes)
3309         field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
3310 }
3311
3312 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
3313 {
3314     BOOL set;
3315     DWORD indexIndex = bit / BITS_PER_DWORD;
3316
3317     assert(field->cIndexes);
3318     set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
3319     return set;
3320 }
3321
3322 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
3323  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
3324 {
3325     BOOL ret = TRUE;
3326     DWORD i, cbOIDs = 0;
3327     BOOL allUsagesValid = TRUE;
3328     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
3329
3330     TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
3331      rghOIDs, *pcbOIDs);
3332
3333     for (i = 0; i < cCerts; i++)
3334     {
3335         CERT_ENHKEY_USAGE usage;
3336         DWORD size = sizeof(usage);
3337
3338         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
3339         /* Success is deliberately ignored: it implies all usages are valid */
3340         if (!ret && GetLastError() == ERROR_MORE_DATA)
3341         {
3342             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
3343
3344             allUsagesValid = FALSE;
3345             if (pUsage)
3346             {
3347                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
3348                 if (ret)
3349                 {
3350                     if (!validUsages.cUsageIdentifier)
3351                     {
3352                         DWORD j;
3353
3354                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
3355                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
3356                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
3357                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
3358                              + 1;
3359                         validUsages.rgpszUsageIdentifier =
3360                          CryptMemAlloc(cbOIDs);
3361                         if (validUsages.rgpszUsageIdentifier)
3362                         {
3363                             LPSTR nextOID = (LPSTR)
3364                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
3365                              validUsages.cUsageIdentifier * sizeof(LPSTR));
3366
3367                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
3368                             {
3369                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
3370                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
3371                                  pUsage->rgpszUsageIdentifier[j]);
3372                                 nextOID += lstrlenA(nextOID) + 1;
3373                             }
3374                         }
3375                     }
3376                     else
3377                     {
3378                         struct BitField validIndexes = { 0, NULL };
3379                         DWORD j, k, numRemoved = 0;
3380
3381                         /* Merge: build a bitmap of all the indexes of
3382                          * validUsages.rgpszUsageIdentifier that are in pUsage.
3383                          */
3384                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
3385                         {
3386                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
3387                             {
3388                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
3389                                  validUsages.rgpszUsageIdentifier[k]))
3390                                 {
3391                                     CRYPT_SetBitInField(&validIndexes, k);
3392                                     break;
3393                                 }
3394                             }
3395                         }
3396                         /* Merge by removing from validUsages those that are
3397                          * not in the bitmap.
3398                          */
3399                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
3400                         {
3401                             if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
3402                             {
3403                                 if (j < validUsages.cUsageIdentifier - 1)
3404                                 {
3405                                     memmove(&validUsages.rgpszUsageIdentifier[j],
3406                                      &validUsages.rgpszUsageIdentifier[j +
3407                                      numRemoved + 1],
3408                                      (validUsages.cUsageIdentifier - numRemoved
3409                                      - j - 1) * sizeof(LPSTR));
3410                                     cbOIDs -= lstrlenA(
3411                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
3412                                      sizeof(LPSTR);
3413                                     validUsages.cUsageIdentifier--;
3414                                     numRemoved++;
3415                                 }
3416                                 else
3417                                     validUsages.cUsageIdentifier--;
3418                             }
3419                         }
3420                         CryptMemFree(validIndexes.indexes);
3421                     }
3422                 }
3423                 CryptMemFree(pUsage);
3424             }
3425         }
3426     }
3427     ret = TRUE;
3428     if (allUsagesValid)
3429     {
3430         *cNumOIDs = -1;
3431         *pcbOIDs = 0;
3432     }
3433     else
3434     {
3435         *cNumOIDs = validUsages.cUsageIdentifier;
3436         if (!rghOIDs)
3437             *pcbOIDs = cbOIDs;
3438         else if (*pcbOIDs < cbOIDs)
3439         {
3440             *pcbOIDs = cbOIDs;
3441             SetLastError(ERROR_MORE_DATA);
3442             ret = FALSE;
3443         }
3444         else
3445         {
3446             LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
3447              validUsages.cUsageIdentifier * sizeof(LPSTR));
3448
3449             *pcbOIDs = cbOIDs;
3450             for (i = 0; i < validUsages.cUsageIdentifier; i++)
3451             {
3452                 rghOIDs[i] = nextOID;
3453                 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
3454                 nextOID += lstrlenA(nextOID) + 1;
3455             }
3456         }
3457     }
3458     CryptMemFree(validUsages.rgpszUsageIdentifier);
3459     TRACE("cNumOIDs: %d\n", *cNumOIDs);
3460     TRACE("returning %d\n", ret);
3461     return ret;
3462 }
3463
3464 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
3465  * pInfo is NULL, from the attributes of hProv.
3466  */
3467 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
3468  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
3469 {
3470     CRYPT_KEY_PROV_INFO info = { 0 };
3471     BOOL ret;
3472
3473     if (!pInfo)
3474     {
3475         DWORD size;
3476         int len;
3477
3478         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
3479         if (ret)
3480         {
3481             LPSTR szContainer = CryptMemAlloc(size);
3482
3483             if (szContainer)
3484             {
3485                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
3486                  (BYTE *)szContainer, &size, 0);
3487                 if (ret)
3488                 {
3489                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3490                      NULL, 0);
3491                     if (len)
3492                     {
3493                         info.pwszContainerName = CryptMemAlloc(len *
3494                          sizeof(WCHAR));
3495                         MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3496                          info.pwszContainerName, len);
3497                     }
3498                 }
3499                 CryptMemFree(szContainer);
3500             }
3501         }
3502         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
3503         if (ret)
3504         {
3505             LPSTR szProvider = CryptMemAlloc(size);
3506
3507             if (szProvider)
3508             {
3509                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
3510                  &size, 0);
3511                 if (ret)
3512                 {
3513                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3514                      NULL, 0);
3515                     if (len)
3516                     {
3517                         info.pwszProvName = CryptMemAlloc(len *
3518                          sizeof(WCHAR));
3519                         MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3520                          info.pwszProvName, len);
3521                     }
3522                 }
3523                 CryptMemFree(szProvider);
3524             }
3525         }
3526         /* in case no CRYPT_KEY_PROV_INFO given,
3527          *  we always use AT_SIGNATURE key spec
3528          */
3529         info.dwKeySpec = AT_SIGNATURE;
3530         size = sizeof(info.dwProvType);
3531         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
3532          &size, 0);
3533         if (!ret)
3534             info.dwProvType = PROV_RSA_FULL;
3535         pInfo = &info;
3536     }
3537
3538     CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
3539      0, pInfo);
3540
3541     if (pInfo == &info)
3542     {
3543         CryptMemFree(info.pwszContainerName);
3544         CryptMemFree(info.pwszProvName);
3545     }
3546 }
3547
3548 /* Creates a signed certificate context from the unsigned, encoded certificate
3549  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
3550  */
3551 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
3552  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
3553 {
3554     PCCERT_CONTEXT context = NULL;
3555     BOOL ret;
3556     DWORD sigSize = 0;
3557
3558     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3559      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
3560     if (ret)
3561     {
3562         LPBYTE sig = CryptMemAlloc(sigSize);
3563
3564         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3565          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
3566         if (ret)
3567         {
3568             CERT_SIGNED_CONTENT_INFO signedInfo;
3569             BYTE *encodedSignedCert = NULL;
3570             DWORD encodedSignedCertSize = 0;
3571
3572             signedInfo.ToBeSigned.cbData = blob->cbData;
3573             signedInfo.ToBeSigned.pbData = blob->pbData;
3574             signedInfo.SignatureAlgorithm = *sigAlgo;
3575             signedInfo.Signature.cbData = sigSize;
3576             signedInfo.Signature.pbData = sig;
3577             signedInfo.Signature.cUnusedBits = 0;
3578             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
3579              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
3580              &encodedSignedCert, &encodedSignedCertSize);
3581             if (ret)
3582             {
3583                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3584                  encodedSignedCert, encodedSignedCertSize);
3585                 LocalFree(encodedSignedCert);
3586             }
3587         }
3588         CryptMemFree(sig);
3589     }
3590     return context;
3591 }
3592
3593 /* Copies data from the parameters into info, where:
3594  * pSerialNumber: The serial number.  Must not be NULL.
3595  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3596  *                     Must not be NULL
3597  * pSignatureAlgorithm: Optional.
3598  * pStartTime: The starting time of the certificate.  If NULL, the current
3599  *             system time is used.
3600  * pEndTime: The ending time of the certificate.  If NULL, one year past the
3601  *           starting time is used.
3602  * pubKey: The public key of the certificate.  Must not be NULL.
3603  * pExtensions: Extensions to be included with the certificate.  Optional.
3604  */
3605 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3606  const CERT_NAME_BLOB *pSubjectIssuerBlob,
3607  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3608  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3609  const CERT_EXTENSIONS *pExtensions)
3610 {
3611     static CHAR oid[] = szOID_RSA_SHA1RSA;
3612
3613     assert(info);
3614     assert(pSerialNumber);
3615     assert(pSubjectIssuerBlob);
3616     assert(pubKey);
3617
3618     if (pExtensions && pExtensions->cExtension)
3619         info->dwVersion = CERT_V3;
3620     else
3621         info->dwVersion = CERT_V1;
3622     info->SerialNumber.cbData = pSerialNumber->cbData;
3623     info->SerialNumber.pbData = pSerialNumber->pbData;
3624     if (pSignatureAlgorithm)
3625         info->SignatureAlgorithm = *pSignatureAlgorithm;
3626     else
3627     {
3628         info->SignatureAlgorithm.pszObjId = oid;
3629         info->SignatureAlgorithm.Parameters.cbData = 0;
3630         info->SignatureAlgorithm.Parameters.pbData = NULL;
3631     }
3632     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3633     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3634     if (pStartTime)
3635         SystemTimeToFileTime(pStartTime, &info->NotBefore);
3636     else
3637         GetSystemTimeAsFileTime(&info->NotBefore);
3638     if (pEndTime)
3639         SystemTimeToFileTime(pEndTime, &info->NotAfter);
3640     else
3641     {
3642         SYSTEMTIME endTime;
3643
3644         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3645         {
3646             endTime.wYear++;
3647             SystemTimeToFileTime(&endTime, &info->NotAfter);
3648         }
3649     }
3650     info->Subject.cbData = pSubjectIssuerBlob->cbData;
3651     info->Subject.pbData = pSubjectIssuerBlob->pbData;
3652     info->SubjectPublicKeyInfo = *pubKey;
3653     if (pExtensions)
3654     {
3655         info->cExtension = pExtensions->cExtension;
3656         info->rgExtension = pExtensions->rgExtension;
3657     }
3658     else
3659     {
3660         info->cExtension = 0;
3661         info->rgExtension = NULL;
3662     }
3663 }
3664
3665 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3666 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3667 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3668
3669 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3670 {
3671     HCRYPTPROV hProv = 0;
3672     HMODULE rpcrt = LoadLibraryW(L"rpcrt4");
3673
3674     if (rpcrt)
3675     {
3676         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3677          "UuidCreate");
3678         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3679          "UuidToStringA");
3680         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3681          rpcrt, "RpcStringFreeA");
3682
3683         if (uuidCreate && uuidToString && rpcStringFree)
3684         {
3685             UUID uuid;
3686             RPC_STATUS status = uuidCreate(&uuid);
3687
3688             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3689             {
3690                 unsigned char *uuidStr;
3691
3692                 status = uuidToString(&uuid, &uuidStr);
3693                 if (status == RPC_S_OK)
3694                 {
3695                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3696                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3697
3698                     if (ret)
3699                     {
3700                         HCRYPTKEY key;
3701
3702                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3703                         if (ret)
3704                             CryptDestroyKey(key);
3705                     }
3706                     rpcStringFree(&uuidStr);
3707                 }
3708             }
3709         }
3710         FreeLibrary(rpcrt);
3711     }
3712     return hProv;
3713 }
3714
3715 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3716  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3717  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3718  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3719  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3720 {
3721     PCCERT_CONTEXT context = NULL;
3722     BOOL ret, releaseContext = FALSE;
3723     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3724     DWORD pubKeySize = 0, dwKeySpec;
3725
3726     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3727      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3728      pExtensions, pExtensions);
3729
3730     if(!pSubjectIssuerBlob)
3731     {
3732         SetLastError(ERROR_INVALID_PARAMETER);
3733         return NULL;
3734     }
3735
3736     dwKeySpec = pKeyProvInfo ? pKeyProvInfo->dwKeySpec : AT_SIGNATURE;
3737     if (!hProv)
3738     {
3739         if (!pKeyProvInfo)
3740         {
3741             hProv = CRYPT_CreateKeyProv();
3742             releaseContext = TRUE;
3743         }
3744         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3745         {
3746             SetLastError(NTE_BAD_FLAGS);
3747             return NULL;
3748         }
3749         else
3750         {
3751             HCRYPTKEY hKey = 0;
3752             /* acquire the context using the given information*/
3753             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3754                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3755                     pKeyProvInfo->dwFlags);
3756             if (!ret)
3757             {
3758                 if(GetLastError() != NTE_BAD_KEYSET)
3759                     return NULL;
3760                 /* create the key set */
3761                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3762                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3763                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3764                 if (!ret)
3765                     return NULL;
3766             }
3767             /* check if the key is here */
3768             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3769             if(!ret)
3770             {
3771                 if (NTE_NO_KEY == GetLastError())
3772                 { /* generate the key */
3773                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3774                 }
3775                 if (!ret)
3776                 {
3777                     CryptReleaseContext(hProv,0);
3778                     SetLastError(NTE_BAD_KEYSET);
3779                     return NULL;
3780                 }
3781             }
3782             CryptDestroyKey(hKey);
3783             releaseContext = TRUE;
3784         }
3785     }
3786
3787     ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3788      &pubKeySize);
3789     if (!ret)
3790         goto end;
3791     pubKey = CryptMemAlloc(pubKeySize);
3792     if (pubKey)
3793     {
3794         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3795          pubKey, &pubKeySize);
3796         if (ret)
3797         {
3798             CERT_INFO info = { 0 };
3799             CRYPT_DER_BLOB blob = { 0, NULL };
3800             BYTE serial[16];
3801             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3802
3803             CryptGenRandom(hProv, sizeof(serial), serial);
3804             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3805              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3806             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3807              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3808              &blob.cbData);
3809             if (ret)
3810             {
3811                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3812                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3813                      &info.SignatureAlgorithm);
3814                 else
3815                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
3816                      blob.pbData, blob.cbData);
3817                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3818                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3819                 LocalFree(blob.pbData);
3820             }
3821         }
3822         CryptMemFree(pubKey);
3823     }
3824 end:
3825     if (releaseContext)
3826         CryptReleaseContext(hProv, 0);
3827     return context;
3828 }
3829
3830 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3831                                void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3832                                PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3833                                PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3834 {
3835     FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3836           dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3837           pVerifyUsageStatus);
3838     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3839     return FALSE;
3840 }
3841
3842 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3843                                       const BYTE *pbEncoded, DWORD cbEncoded,
3844                                       DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3845 {
3846     TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3847           pbEncoded, cbEncoded, dwFlags, pCreatePara);
3848
3849     if (dwFlags)
3850     {
3851         FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3852         return NULL;
3853     }
3854     if (pCreatePara)
3855     {
3856         FIXME("pCreatePara not handled\n");
3857         return NULL;
3858     }
3859
3860     switch (dwContextType)
3861     {
3862     case CERT_STORE_CERTIFICATE_CONTEXT:
3863         return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3864     case CERT_STORE_CRL_CONTEXT:
3865         return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3866     case CERT_STORE_CTL_CONTEXT:
3867         return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3868     default:
3869         WARN("unknown context type: 0x%x\n", dwContextType);
3870         return NULL;
3871     }
3872 }
3873
3874 BOOL WINAPI CryptSetKeyIdentifierProperty(const CRYPT_HASH_BLOB *pKeyIdentifier, DWORD dwPropId,
3875     DWORD dwFlags, LPCWSTR pwszComputerName, void *pvReserved, const void *pvData)
3876 {
3877     FIXME("(%p, 0x%x, 0x%x, %s, %p, %p): stub\n", pKeyIdentifier, dwPropId, dwFlags,
3878         debugstr_w(pwszComputerName), pvReserved, pvData);
3879     return FALSE;
3880 }