dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #include "ntstatus.h"
  24 #define WIN32_NO_STATUS
  25 #include "windef.h"
  26 #include "winbase.h"
  27 #include "winternl.h"
  28 #define CRYPT_OID_INFO_HAS_EXTRA_FIELDS
  29 #include "wincrypt.h"
  30 #include "snmp.h"
  31 #include "bcrypt.h"
  32 #include "winnls.h"
  33 #include "rpc.h"
  34 #include "wine/debug.h"
  35 #include "crypt32_private.h"
  36
  37 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  38
  39 /* Internal version of CertGetCertificateContextProperty that gets properties
  40  * directly from the context (or the context it's linked to, depending on its
  41  * type.) Doesn't handle special-case properties, since they are handled by
  42  * CertGetCertificateContextProperty, and are particular to the store in which
  43  * the property exists (which is separate from the context.)
  44  */
  45 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
  46  void *pvData, DWORD *pcbData);
  47
  48 /* Internal version of CertSetCertificateContextProperty that sets properties
  49  * directly on the context (or the context it's linked to, depending on its
  50  * type.) Doesn't handle special cases, since they're handled by
  51  * CertSetCertificateContextProperty anyway.
  52  */
  53 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
  54  DWORD dwFlags, const void *pvData);
  55
  56 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  57  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  58  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  59 {
  60     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  61      pbCertEncoded, cbCertEncoded);
  62     BOOL ret;
  63
  64     TRACE("(%p, %08lx, %p, %ld, %08lx, %p)\n", hCertStore, dwCertEncodingType,
  65      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  66
  67     if (cert)
  68     {
  69         ret = CertAddCertificateContextToStore(hCertStore, cert,
  70          dwAddDisposition, ppCertContext);
  71         CertFreeCertificateContext(cert);
  72     }
  73     else
  74         ret = FALSE;
  75     return ret;
  76 }
  77
  78 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
  79  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  80 {
  81     HCERTSTORE store;
  82     BOOL ret = FALSE;
  83
  84     TRACE("(%s, %p, %ld)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
  85      cbCertEncoded);
  86
  87     store = CertOpenSystemStoreA(0, pszCertStoreName);
  88     if (store)
  89     {
  90         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  91          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  92         CertCloseStore(store, 0);
  93     }
  94     return ret;
  95 }
  96
  97 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
  98  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  99 {
 100     HCERTSTORE store;
 101     BOOL ret = FALSE;
 102
 103     TRACE("(%s, %p, %ld)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
 104      cbCertEncoded);
 105
 106     store = CertOpenSystemStoreW(0, pszCertStoreName);
 107     if (store)
 108     {
 109         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 110          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
 111         CertCloseStore(store, 0);
 112     }
 113     return ret;
 114 }
 115
 116 static const context_vtbl_t cert_vtbl;
 117
 118 static void Cert_free(context_t *context)
 119 {
 120     cert_t *cert = (cert_t*)context;
 121
 122     CryptMemFree(cert->ctx.pbCertEncoded);
 123     LocalFree(cert->ctx.pCertInfo);
 124 }
 125
 126 static context_t *Cert_clone(context_t *context, WINECRYPT_CERTSTORE *store, BOOL use_link)
 127 {
 128     cert_t *cert;
 129
 130     if(use_link) {
 131         cert = (cert_t*)Context_CreateLinkContext(sizeof(CERT_CONTEXT), context, store);
 132         if(!cert)
 133             return NULL;
 134     }else {
 135         const cert_t *cloned = (const cert_t*)context;
 136         DWORD size = 0;
 137         BOOL res;
 138
 139         cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, store);
 140         if(!cert)
 141             return NULL;
 142
 143         Context_CopyProperties(&cert->ctx, &cloned->ctx);
 144
 145         cert->ctx.dwCertEncodingType = cloned->ctx.dwCertEncodingType;
 146         cert->ctx.pbCertEncoded = CryptMemAlloc(cloned->ctx.cbCertEncoded);
 147         memcpy(cert->ctx.pbCertEncoded, cloned->ctx.pbCertEncoded, cloned->ctx.cbCertEncoded);
 148         cert->ctx.cbCertEncoded = cloned->ctx.cbCertEncoded;
 149
 150         /* FIXME: We don't need to decode the object here, we could just clone cert info. */
 151         res = CryptDecodeObjectEx(cert->ctx.dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 152          cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 153          &cert->ctx.pCertInfo, &size);
 154         if(!res) {
 155             CertFreeCertificateContext(&cert->ctx);
 156             return NULL;
 157         }
 158     }
 159
 160     cert->ctx.hCertStore = store;
 161     return &cert->base;
 162 }
 163
 164 static const context_vtbl_t cert_vtbl = {
 165     Cert_free,
 166     Cert_clone
 167 };
 168
 169 static BOOL add_cert_to_store(WINECRYPT_CERTSTORE *store, const CERT_CONTEXT *cert,
 170  DWORD add_disposition, BOOL use_link, PCCERT_CONTEXT *ret_context)
 171 {
 172     const CERT_CONTEXT *existing = NULL;
 173     BOOL ret = TRUE, inherit_props = FALSE;
 174     context_t *new_context = NULL;
 175
 176     switch (add_disposition)
 177     {
 178     case CERT_STORE_ADD_ALWAYS:
 179         break;
 180     case CERT_STORE_ADD_NEW:
 181     case CERT_STORE_ADD_REPLACE_EXISTING:
 182     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 183     case CERT_STORE_ADD_USE_EXISTING:
 184     case CERT_STORE_ADD_NEWER:
 185     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 186     {
 187         BYTE hashToAdd[20];
 188         DWORD size = sizeof(hashToAdd);
 189
 190         ret = CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID,
 191          hashToAdd, &size);
 192         if (ret)
 193         {
 194             CRYPT_HASH_BLOB blob = { sizeof(hashToAdd), hashToAdd };
 195
 196             existing = CertFindCertificateInStore(store, cert->dwCertEncodingType, 0,
 197              CERT_FIND_SHA1_HASH, &blob, NULL);
 198         }
 199         break;
 200     }
 201     default:
 202         FIXME("Unimplemented add disposition %ld\n", add_disposition);
 203         SetLastError(E_INVALIDARG);
 204         return FALSE;
 205     }
 206
 207     switch (add_disposition)
 208     {
 209     case CERT_STORE_ADD_ALWAYS:
 210         break;
 211     case CERT_STORE_ADD_NEW:
 212         if (existing)
 213         {
 214             TRACE("found matching certificate, not adding\n");
 215             SetLastError(CRYPT_E_EXISTS);
 216             return FALSE;
 217         }
 218         break;
 219     case CERT_STORE_ADD_REPLACE_EXISTING:
 220         break;
 221     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 222         if (use_link)
 223             FIXME("CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES: semi-stub for links\n");
 224         if (existing)
 225             inherit_props = TRUE;
 226         break;
 227     case CERT_STORE_ADD_USE_EXISTING:
 228         if(use_link)
 229             FIXME("CERT_STORE_ADD_USE_EXISTING: semi-stub for links\n");
 230         if (existing)
 231         {
 232             Context_CopyProperties(existing, cert);
 233             if (ret_context)
 234                 *ret_context = CertDuplicateCertificateContext(existing);
 235             return TRUE;
 236         }
 237         break;
 238     case CERT_STORE_ADD_NEWER:
 239         if (existing && CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 240         {
 241             TRACE("existing certificate is newer, not adding\n");
 242             SetLastError(CRYPT_E_EXISTS);
 243             return FALSE;
 244         }
 245         break;
 246     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 247         if (existing)
 248         {
 249             if (CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 250             {
 251                 TRACE("existing certificate is newer, not adding\n");
 252                 SetLastError(CRYPT_E_EXISTS);
 253                 return FALSE;
 254             }
 255             inherit_props = TRUE;
 256         }
 257         break;
 258     }
 259
 260     /* FIXME: We have tests that this works, but what should we really do in this case? */
 261     if(!store) {
 262         if(ret_context)
 263             *ret_context = CertDuplicateCertificateContext(cert);
 264         return TRUE;
 265     }
 266
 267     ret = store->vtbl->certs.addContext(store, context_from_ptr(cert), existing ? context_from_ptr(existing) : NULL,
 268      (ret_context || inherit_props) ? &new_context : NULL, use_link);
 269     if(!ret)
 270         return FALSE;
 271
 272     if(inherit_props)
 273         Context_CopyProperties(context_ptr(new_context), existing);
 274
 275     if(ret_context)
 276         *ret_context = context_ptr(new_context);
 277     else if(new_context)
 278         Context_Release(new_context);
 279
 280     TRACE("returning %d\n", ret);
 281     return ret;
 282 }
 283
 284 BOOL WINAPI CertAddCertificateContextToStore(HCERTSTORE hCertStore, PCCERT_CONTEXT pCertContext,
 285  DWORD dwAddDisposition, PCCERT_CONTEXT *ppStoreContext)
 286 {
 287     WINECRYPT_CERTSTORE *store = hCertStore;
 288
 289     TRACE("(%p, %p, %08lx, %p)\n", hCertStore, pCertContext, dwAddDisposition, ppStoreContext);
 290
 291     return add_cert_to_store(store, pCertContext, dwAddDisposition, FALSE, ppStoreContext);
 292 }
 293
 294 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
 295  PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
 296  PCCERT_CONTEXT *ppCertContext)
 297 {
 298     static int calls;
 299     WINECRYPT_CERTSTORE *store = (WINECRYPT_CERTSTORE*)hCertStore;
 300
 301     if (!(calls++))
 302         FIXME("(%p, %p, %08lx, %p): semi-stub\n", hCertStore, pCertContext,
 303          dwAddDisposition, ppCertContext);
 304     if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
 305         return FALSE;
 306     if (store->type == StoreTypeCollection)
 307     {
 308         SetLastError(E_INVALIDARG);
 309         return FALSE;
 310     }
 311     return add_cert_to_store(hCertStore, pCertContext, dwAddDisposition, TRUE, ppCertContext);
 312 }
 313
 314 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
 315  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 316 {
 317     cert_t *cert = NULL;
 318     BYTE *data = NULL;
 319     BOOL ret;
 320     PCERT_INFO certInfo = NULL;
 321     DWORD size = 0;
 322
 323     TRACE("(%08lx, %p, %ld)\n", dwCertEncodingType, pbCertEncoded,
 324      cbCertEncoded);
 325
 326     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
 327     {
 328         SetLastError(E_INVALIDARG);
 329         return NULL;
 330     }
 331
 332     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 333      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 334      &certInfo, &size);
 335     if (!ret)
 336         return NULL;
 337
 338     cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, &empty_store);
 339     if (!cert)
 340         return NULL;
 341     data = CryptMemAlloc(cbCertEncoded);
 342     if (!data)
 343     {
 344         Context_Release(&cert->base);
 345         return NULL;
 346     }
 347
 348     memcpy(data, pbCertEncoded, cbCertEncoded);
 349     cert->ctx.dwCertEncodingType = dwCertEncodingType;
 350     cert->ctx.pbCertEncoded      = data;
 351     cert->ctx.cbCertEncoded      = cbCertEncoded;
 352     cert->ctx.pCertInfo          = certInfo;
 353     cert->ctx.hCertStore         = &empty_store;
 354
 355     return &cert->ctx;
 356 }
 357
 358 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(PCCERT_CONTEXT pCertContext)
 359 {
 360     TRACE("(%p)\n", pCertContext);
 361
 362     if (!pCertContext)
 363         return NULL;
 364
 365     Context_AddRef(&cert_from_ptr(pCertContext)->base);
 366     return pCertContext;
 367 }
 368
 369 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 370 {
 371     TRACE("(%p)\n", pCertContext);
 372
 373     if (pCertContext)
 374         Context_Release(&cert_from_ptr(pCertContext)->base);
 375     return TRUE;
 376 }
 377
 378 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 379  DWORD dwPropId)
 380 {
 381     cert_t *cert = cert_from_ptr(pCertContext);
 382     DWORD ret;
 383
 384     TRACE("(%p, %ld)\n", pCertContext, dwPropId);
 385
 386     if (cert->base.properties)
 387         ret = ContextPropertyList_EnumPropIDs(cert->base.properties, dwPropId);
 388     else
 389         ret = 0;
 390     return ret;
 391 }
 392
 393 static BOOL CertContext_GetHashProp(cert_t *cert, DWORD dwPropId,
 394  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 395  DWORD *pcbData)
 396 {
 397     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 398      pcbData);
 399     if (ret && pvData)
 400     {
 401         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 402
 403         ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 404     }
 405     return ret;
 406 }
 407
 408 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 409  DWORD cb)
 410 {
 411     BOOL ret = TRUE;
 412
 413     if (!pvData)
 414         *pcbData = cb;
 415     else if (*pcbData < cb)
 416     {
 417         SetLastError(ERROR_MORE_DATA);
 418         *pcbData = cb;
 419         ret = FALSE;
 420     }
 421     else
 422     {
 423         memcpy(pvData, pb, cb);
 424         *pcbData = cb;
 425     }
 426     return ret;
 427 }
 428
 429 void CRYPT_ConvertKeyContext(const struct store_CERT_KEY_CONTEXT *src, CERT_KEY_CONTEXT *dst)
 430 {
 431     dst->cbSize = sizeof(*dst);
 432     dst->hCryptProv = src->hCryptProv;
 433     dst->dwKeySpec = src->dwKeySpec;
 434 }
 435
 436 /*
 437  * Fix offsets in a continuous block of memory of CRYPT_KEY_PROV_INFO with
 438  * its associated data.
 439  */
 440 static void fix_KeyProvInfoProperty(CRYPT_KEY_PROV_INFO *info)
 441 {
 442     BYTE *data;
 443     DWORD i;
 444
 445     data = (BYTE *)(info + 1) + sizeof(CRYPT_KEY_PROV_PARAM) * info->cProvParam;
 446
 447     if (info->pwszContainerName)
 448     {
 449         info->pwszContainerName = (LPWSTR)data;
 450         data += (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 451     }
 452
 453     if (info->pwszProvName)
 454     {
 455         info->pwszProvName = (LPWSTR)data;
 456         data += (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 457     }
 458
 459     info->rgProvParam = info->cProvParam ? (CRYPT_KEY_PROV_PARAM *)(info + 1) : NULL;
 460
 461     for (i = 0; i < info->cProvParam; i++)
 462     {
 463         info->rgProvParam[i].pbData = info->rgProvParam[i].cbData ? data : NULL;
 464         data += info->rgProvParam[i].cbData;
 465     }
 466 }
 467
 468 /*
 469  * Copy to a continuous block of memory of CRYPT_KEY_PROV_INFO with
 470  * its associated data.
 471  */
 472 static void copy_KeyProvInfoProperty(const CRYPT_KEY_PROV_INFO *from, CRYPT_KEY_PROV_INFO *to)
 473 {
 474     BYTE *data;
 475     DWORD i;
 476
 477     data = (BYTE *)(to + 1) + sizeof(CRYPT_KEY_PROV_PARAM) * from->cProvParam;
 478
 479     if (from->pwszContainerName)
 480     {
 481         to->pwszContainerName = (LPWSTR)data;
 482         lstrcpyW((LPWSTR)data, from->pwszContainerName);
 483         data += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 484     }
 485     else
 486         to->pwszContainerName = NULL;
 487
 488     if (from->pwszProvName)
 489     {
 490         to->pwszProvName = (LPWSTR)data;
 491         lstrcpyW((LPWSTR)data, from->pwszProvName);
 492         data += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 493     }
 494     else
 495         to->pwszProvName = NULL;
 496
 497     to->dwProvType = from->dwProvType;
 498     to->dwFlags = from->dwFlags;
 499     to->cProvParam = from->cProvParam;
 500     to->rgProvParam = from->cProvParam ? (CRYPT_KEY_PROV_PARAM *)(to + 1) : NULL;
 501     to->dwKeySpec = from->dwKeySpec;
 502
 503     for (i = 0; i < from->cProvParam; i++)
 504     {
 505         to->rgProvParam[i].dwParam = from->rgProvParam[i].dwParam;
 506         to->rgProvParam[i].dwFlags = from->rgProvParam[i].dwFlags;
 507         to->rgProvParam[i].cbData = from->rgProvParam[i].cbData;
 508         to->rgProvParam[i].pbData = from->rgProvParam[i].cbData ? data : NULL;
 509         memcpy(data, from->rgProvParam[i].pbData, from->rgProvParam[i].cbData);
 510         data += from->rgProvParam[i].cbData;
 511     }
 512 }
 513
 514 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
 515  void *pvData, DWORD *pcbData)
 516 {
 517     BOOL ret;
 518     CRYPT_DATA_BLOB blob;
 519
 520     TRACE("(%p, %ld, %p, %p)\n", cert, dwPropId, pvData, pcbData);
 521
 522     if (cert->base.properties)
 523         ret = ContextPropertyList_FindProperty(cert->base.properties, dwPropId, &blob);
 524     else
 525         ret = FALSE;
 526     if (ret)
 527     {
 528         CERT_KEY_CONTEXT ctx;
 529         if (dwPropId == CERT_KEY_CONTEXT_PROP_ID)
 530         {
 531             CRYPT_ConvertKeyContext((const struct store_CERT_KEY_CONTEXT *)blob.pbData, &ctx);
 532             blob.pbData = (BYTE *)&ctx;
 533             blob.cbData = ctx.cbSize;
 534         }
 535         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 536     }
 537     else
 538     {
 539         /* Implicit properties */
 540         switch (dwPropId)
 541         {
 542         case CERT_SHA1_HASH_PROP_ID:
 543             ret = CertContext_GetHashProp(cert, dwPropId, CALG_SHA1,
 544              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 545              pcbData);
 546             break;
 547         case CERT_MD5_HASH_PROP_ID:
 548             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 549              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 550              pcbData);
 551             break;
 552         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 553             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 554              cert->ctx.pCertInfo->Subject.pbData,
 555              cert->ctx.pCertInfo->Subject.cbData,
 556              pvData, pcbData);
 557             break;
 558         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 559             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 560              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 561              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 562              pvData, pcbData);
 563             break;
 564         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 565             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 566              cert->ctx.pCertInfo->SerialNumber.pbData,
 567              cert->ctx.pCertInfo->SerialNumber.cbData,
 568              pvData, pcbData);
 569             break;
 570         case CERT_SIGNATURE_HASH_PROP_ID:
 571             ret = CryptHashToBeSigned(0, cert->ctx.dwCertEncodingType,
 572              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 573              pcbData);
 574             if (ret && pvData)
 575             {
 576                 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 577
 578                 ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 579             }
 580             break;
 581         case CERT_KEY_IDENTIFIER_PROP_ID:
 582         {
 583             PCERT_EXTENSION ext = CertFindExtension(
 584              szOID_SUBJECT_KEY_IDENTIFIER, cert->ctx.pCertInfo->cExtension,
 585              cert->ctx.pCertInfo->rgExtension);
 586
 587             if (ext)
 588             {
 589                 CRYPT_DATA_BLOB value;
 590                 DWORD size = sizeof(value);
 591
 592                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 593                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 594                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 595                  &size);
 596                 if (ret)
 597                 {
 598                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 599                      value.cbData);
 600                     CertContext_SetProperty(cert, dwPropId, 0, &value);
 601                 }
 602             }
 603             else
 604                 SetLastError(ERROR_INVALID_DATA);
 605             break;
 606         }
 607         default:
 608             SetLastError(CRYPT_E_NOT_FOUND);
 609         }
 610     }
 611     TRACE("returning %d\n", ret);
 612     return ret;
 613 }
 614
 615 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 616  DWORD dwPropId, void *pvData, DWORD *pcbData)
 617 {
 618     cert_t *cert = cert_from_ptr(pCertContext);
 619     BOOL ret;
 620
 621     TRACE("(%p, %ld, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 622
 623     switch (dwPropId)
 624     {
 625     case 0:
 626     case CERT_CERT_PROP_ID:
 627     case CERT_CRL_PROP_ID:
 628     case CERT_CTL_PROP_ID:
 629         SetLastError(E_INVALIDARG);
 630         ret = FALSE;
 631         break;
 632     case CERT_ACCESS_STATE_PROP_ID:
 633         ret = CertGetStoreProperty(cert->ctx.hCertStore, dwPropId, pvData, pcbData);
 634         break;
 635     case CERT_KEY_PROV_HANDLE_PROP_ID:
 636     {
 637         CERT_KEY_CONTEXT keyContext;
 638         DWORD size = sizeof(keyContext);
 639
 640         ret = CertContext_GetProperty(cert,
 641          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 642         if (ret)
 643             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 644              sizeof(keyContext.hCryptProv));
 645         break;
 646     }
 647     case CERT_KEY_PROV_INFO_PROP_ID:
 648         ret = CertContext_GetProperty(cert, dwPropId, pvData, pcbData);
 649         if (ret && pvData)
 650             fix_KeyProvInfoProperty(pvData);
 651         break;
 652     default:
 653         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 654          pcbData);
 655     }
 656
 657     TRACE("returning %d\n", ret);
 658     return ret;
 659 }
 660
 661 /*
 662  * Create a continuous block of memory for CRYPT_KEY_PROV_INFO with
 663  * its associated data, and add it to the certificate properties.
 664  */
 665 static BOOL CertContext_SetKeyProvInfoProperty(CONTEXT_PROPERTY_LIST *properties, const CRYPT_KEY_PROV_INFO *info)
 666 {
 667     CRYPT_KEY_PROV_INFO *prop;
 668     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i;
 669     BOOL ret;
 670
 671     if (info->pwszContainerName)
 672         size += (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 673     if (info->pwszProvName)
 674         size += (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 675
 676     for (i = 0; i < info->cProvParam; i++)
 677         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 678
 679     prop = CryptMemAlloc(size);
 680     if (!prop)
 681     {
 682         SetLastError(ERROR_OUTOFMEMORY);
 683         return FALSE;
 684     }
 685
 686     copy_KeyProvInfoProperty(info, prop);
 687
 688     ret = ContextPropertyList_SetProperty(properties, CERT_KEY_PROV_INFO_PROP_ID, (const BYTE *)prop, size);
 689     CryptMemFree(prop);
 690
 691     return ret;
 692 }
 693
 694 static BOOL CertContext_SetKeyContextProperty(CONTEXT_PROPERTY_LIST *properties,
 695  const CERT_KEY_CONTEXT *keyContext)
 696 {
 697     struct store_CERT_KEY_CONTEXT ctx;
 698
 699     ctx.cbSize = sizeof(ctx);
 700     ctx.hCryptProv = keyContext->hCryptProv;
 701     ctx.dwKeySpec = keyContext->dwKeySpec;
 702
 703     return ContextPropertyList_SetProperty(properties, CERT_KEY_CONTEXT_PROP_ID,
 704      (const BYTE *)&ctx, ctx.cbSize);
 705 }
 706
 707 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
 708  DWORD dwFlags, const void *pvData)
 709 {
 710     BOOL ret;
 711
 712     TRACE("(%p, %ld, %08lx, %p)\n", cert, dwPropId, dwFlags, pvData);
 713
 714     if (!cert->base.properties)
 715         ret = FALSE;
 716     else if (dwPropId >= CERT_FIRST_USER_PROP_ID && dwPropId <= CERT_LAST_USER_PROP_ID)
 717     {
 718         if (pvData)
 719         {
 720             const CRYPT_DATA_BLOB *blob = pvData;
 721             ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId, blob->pbData, blob->cbData);
 722         }
 723         else
 724         {
 725             ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 726             ret = TRUE;
 727         }
 728     }
 729     else
 730     {
 731         switch (dwPropId)
 732         {
 733         case CERT_AUTO_ENROLL_PROP_ID:
 734         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 735         case CERT_DESCRIPTION_PROP_ID:
 736         case CERT_FRIENDLY_NAME_PROP_ID:
 737         case CERT_HASH_PROP_ID:
 738         case CERT_KEY_IDENTIFIER_PROP_ID:
 739         case CERT_MD5_HASH_PROP_ID:
 740         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 741         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 742         case CERT_PVK_FILE_PROP_ID:
 743         case CERT_SIGNATURE_HASH_PROP_ID:
 744         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 745         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 746         case CERT_EXTENDED_ERROR_INFO_PROP_ID:
 747         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 748         case CERT_ENROLLMENT_PROP_ID:
 749         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 750         case CERT_OCSP_RESPONSE_PROP_ID:
 751         case CERT_RENEWAL_PROP_ID:
 752         {
 753             if (pvData)
 754             {
 755                 const CRYPT_DATA_BLOB *blob = pvData;
 756
 757                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 758                  blob->pbData, blob->cbData);
 759             }
 760             else
 761             {
 762                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 763                 ret = TRUE;
 764             }
 765             break;
 766         }
 767         case CERT_DATE_STAMP_PROP_ID:
 768             if (pvData)
 769                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 770                  pvData, sizeof(FILETIME));
 771             else
 772             {
 773                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 774                 ret = TRUE;
 775             }
 776             break;
 777         case CERT_KEY_CONTEXT_PROP_ID:
 778             if (pvData)
 779             {
 780                 const CERT_KEY_CONTEXT *keyContext = pvData;
 781
 782                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 783                 {
 784                     SetLastError(E_INVALIDARG);
 785                     ret = FALSE;
 786                 }
 787                 else
 788                     ret = CertContext_SetKeyContextProperty(cert->base.properties, pvData);
 789             }
 790             else
 791             {
 792                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 793                 ret = TRUE;
 794             }
 795             break;
 796         case CERT_KEY_PROV_INFO_PROP_ID:
 797             if (pvData)
 798                 ret = CertContext_SetKeyProvInfoProperty(cert->base.properties, pvData);
 799             else
 800             {
 801                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 802                 ret = TRUE;
 803             }
 804             break;
 805         case CERT_KEY_PROV_HANDLE_PROP_ID:
 806         {
 807             CERT_KEY_CONTEXT keyContext;
 808             DWORD size = sizeof(keyContext);
 809
 810             ret = CertContext_GetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 811              &keyContext, &size);
 812             if (ret)
 813             {
 814                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 815                     CryptReleaseContext(keyContext.hCryptProv, 0);
 816             }
 817             keyContext.cbSize = sizeof(keyContext);
 818             if (pvData)
 819                 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 820             else
 821             {
 822                 keyContext.hCryptProv = 0;
 823                 keyContext.dwKeySpec = AT_SIGNATURE;
 824             }
 825             ret = CertContext_SetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 826              0, &keyContext);
 827             break;
 828         }
 829         default:
 830             FIXME("%ld: stub\n", dwPropId);
 831             ret = FALSE;
 832         }
 833     }
 834     TRACE("returning %d\n", ret);
 835     return ret;
 836 }
 837
 838 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 839  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 840 {
 841     BOOL ret;
 842
 843     TRACE("(%p, %ld, %08lx, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 844
 845     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 846      * crashes on most of these, I'll be safer.
 847      */
 848     switch (dwPropId)
 849     {
 850     case 0:
 851     case CERT_ACCESS_STATE_PROP_ID:
 852     case CERT_CERT_PROP_ID:
 853     case CERT_CRL_PROP_ID:
 854     case CERT_CTL_PROP_ID:
 855         SetLastError(E_INVALIDARG);
 856         return FALSE;
 857     }
 858     ret = CertContext_SetProperty(cert_from_ptr(pCertContext), dwPropId, dwFlags,
 859      pvData);
 860     TRACE("returning %d\n", ret);
 861     return ret;
 862 }
 863
 864 /* Acquires the private key using the key provider info, retrieving info from
 865  * the certificate if info is NULL.  The acquired provider is returned in
 866  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 867  */
 868 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert, DWORD dwFlags,
 869  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 870 {
 871     DWORD size = 0;
 872     BOOL allocated = FALSE, ret = TRUE;
 873
 874     if (!info)
 875     {
 876         ret = CertGetCertificateContextProperty(pCert,
 877          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 878         if (ret)
 879         {
 880             info = CryptMemAlloc(size);
 881             if (info)
 882             {
 883                 ret = CertGetCertificateContextProperty(pCert,
 884                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 885                 allocated = TRUE;
 886             }
 887             else
 888             {
 889                 SetLastError(ERROR_OUTOFMEMORY);
 890                 ret = FALSE;
 891             }
 892         }
 893         else
 894             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 895     }
 896     if (ret)
 897     {
 898         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 899          info->pwszProvName, info->dwProvType, (dwFlags & CRYPT_ACQUIRE_SILENT_FLAG) ? CRYPT_SILENT : 0);
 900         if (ret)
 901         {
 902             DWORD i;
 903
 904             for (i = 0; i < info->cProvParam; i++)
 905             {
 906                 CryptSetProvParam(*phCryptProv,
 907                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 908                  info->rgProvParam[i].dwFlags);
 909             }
 910             *pdwKeySpec = info->dwKeySpec;
 911         }
 912         else
 913             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 914     }
 915     if (allocated)
 916         CryptMemFree(info);
 917     return ret;
 918 }
 919
 920 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 921  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 922  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 923 {
 924     BOOL ret = FALSE, cache = FALSE;
 925     PCRYPT_KEY_PROV_INFO info = NULL;
 926     CERT_KEY_CONTEXT keyContext;
 927     DWORD size;
 928     PCCERT_CONTEXT cert_in_store = NULL;
 929
 930     TRACE("(%p, %08lx, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 931      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 932
 933     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 934     {
 935         DWORD size = 0;
 936
 937         ret = CertGetCertificateContextProperty(pCert,
 938          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 939
 940         if (!ret)
 941         {
 942             HCERTSTORE hstore;
 943
 944             hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, 0,
 945                                    CERT_SYSTEM_STORE_CURRENT_USER, L"My");
 946             if (hstore)
 947             {
 948                 cert_in_store = CertFindCertificateInStore(hstore, pCert->dwCertEncodingType, 0,
 949                                                            CERT_FIND_EXISTING, pCert, NULL);
 950                 if (cert_in_store)
 951                 {
 952                     ret = CertGetCertificateContextProperty(cert_in_store, CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 953                     if (ret)
 954                         pCert = cert_in_store;
 955                     else
 956                     {
 957                         CertFreeCertificateContext(cert_in_store);
 958                         cert_in_store = NULL;
 959                     }
 960                 }
 961
 962                 CertCloseStore(hstore, 0);
 963             }
 964         }
 965
 966         if (ret)
 967         {
 968             info = CryptMemAlloc(size);
 969             ret = CertGetCertificateContextProperty(pCert,
 970              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 971             if (ret)
 972                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 973         }
 974     }
 975     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 976         cache = TRUE;
 977     *phCryptProv = 0;
 978     if (cache)
 979     {
 980         size = sizeof(keyContext);
 981         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 982          &keyContext, &size);
 983         if (ret)
 984         {
 985             *phCryptProv = keyContext.hCryptProv;
 986             if (pdwKeySpec)
 987                 *pdwKeySpec = keyContext.dwKeySpec;
 988             if (pfCallerFreeProv)
 989                 *pfCallerFreeProv = FALSE;
 990         }
 991     }
 992     if (!*phCryptProv)
 993     {
 994         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, dwFlags, info,
 995          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 996         if (ret)
 997         {
 998             *phCryptProv = keyContext.hCryptProv;
 999             if (pdwKeySpec)
1000                 *pdwKeySpec = keyContext.dwKeySpec;
1001             if (cache)
1002             {
1003                 keyContext.cbSize = sizeof(keyContext);
1004                 if (CertSetCertificateContextProperty(pCert,
1005                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
1006                 {
1007                     if (pfCallerFreeProv)
1008                         *pfCallerFreeProv = FALSE;
1009                 }
1010             }
1011             else
1012             {
1013                 if (pfCallerFreeProv)
1014                     *pfCallerFreeProv = TRUE;
1015             }
1016         }
1017     }
1018     CryptMemFree(info);
1019     if (cert_in_store)
1020         CertFreeCertificateContext(cert_in_store);
1021     if (ret) SetLastError(0);
1022     return ret;
1023 }
1024
1025 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
1026  const CRYPT_KEY_PROV_INFO *keyProvInfo)
1027 {
1028     HCRYPTPROV csp;
1029     BOOL matches = FALSE;
1030
1031     if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
1032      keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
1033     {
1034         DWORD size;
1035
1036         /* Need to sign something to verify the sig.  What to sign?  Why not
1037          * the certificate itself?
1038          */
1039         if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
1040          pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
1041          &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
1042         {
1043             BYTE *certEncoded = CryptMemAlloc(size);
1044
1045             if (certEncoded)
1046             {
1047                 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
1048                  pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
1049                  pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
1050                  NULL, certEncoded, &size))
1051                 {
1052                     if (size == pCert->cbCertEncoded &&
1053                      !memcmp(certEncoded, pCert->pbCertEncoded, size))
1054                         matches = TRUE;
1055                 }
1056                 CryptMemFree(certEncoded);
1057             }
1058         }
1059         CryptReleaseContext(csp, 0);
1060     }
1061     return matches;
1062 }
1063
1064 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
1065  CRYPT_KEY_PROV_INFO *keyProvInfo)
1066 {
1067     CRYPT_KEY_PROV_INFO copy;
1068     WCHAR containerW[MAX_PATH];
1069     BOOL matches;
1070
1071     MultiByteToWideChar(CP_ACP, 0, container, -1, containerW, ARRAY_SIZE(containerW));
1072     /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
1073      * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
1074      * name.
1075      */
1076     copy = *keyProvInfo;
1077     copy.pwszContainerName = containerW;
1078     matches = key_prov_info_matches_cert(pCert, &copy);
1079     if (matches)
1080     {
1081         keyProvInfo->pwszContainerName =
1082          CryptMemAlloc((lstrlenW(containerW) + 1) * sizeof(WCHAR));
1083         if (keyProvInfo->pwszContainerName)
1084         {
1085             lstrcpyW(keyProvInfo->pwszContainerName, containerW);
1086             keyProvInfo->dwKeySpec = AT_SIGNATURE;
1087         }
1088         else
1089             matches = FALSE;
1090     }
1091     return matches;
1092 }
1093
1094 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
1095  * private key matches pCert's public key.  Upon success, updates keyProvInfo
1096  * with the matching container's info (free keyProvInfo.pwszContainerName upon
1097  * success.)
1098  * Returns TRUE if found, FALSE if not.
1099  */
1100 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
1101  CRYPT_KEY_PROV_INFO *keyProvInfo)
1102 {
1103     HCRYPTPROV defProvider;
1104     BOOL ret, found = FALSE;
1105     char containerA[MAX_PATH];
1106
1107     assert(keyProvInfo->pwszContainerName == NULL);
1108     if ((ret = CryptAcquireContextW(&defProvider, NULL,
1109      keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
1110      keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
1111     {
1112         DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
1113
1114         while (ret && !found)
1115         {
1116             DWORD size = sizeof(containerA);
1117
1118             ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
1119              (BYTE *)containerA, &size, enumFlags);
1120             if (ret)
1121                 found = container_matches_cert(pCert, containerA, keyProvInfo);
1122             if (enumFlags & CRYPT_FIRST)
1123             {
1124                 enumFlags &= ~CRYPT_FIRST;
1125                 enumFlags |= CRYPT_NEXT;
1126             }
1127         }
1128         CryptReleaseContext(defProvider, 0);
1129     }
1130     return found;
1131 }
1132
1133 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
1134 {
1135     BOOL found = FALSE, ret = TRUE;
1136     DWORD index = 0, cbProvName = 0;
1137     CRYPT_KEY_PROV_INFO keyProvInfo;
1138
1139     TRACE("(%p, %08lx)\n", pCert, dwFlags);
1140
1141     memset(&keyProvInfo, 0, sizeof(keyProvInfo));
1142     while (ret && !found)
1143     {
1144         DWORD size = 0;
1145
1146         ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
1147          NULL, &size);
1148         if (ret)
1149         {
1150             if (size <= cbProvName)
1151                 ret = CryptEnumProvidersW(index, NULL, 0,
1152                  &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1153             else
1154             {
1155                 CryptMemFree(keyProvInfo.pwszProvName);
1156                 keyProvInfo.pwszProvName = CryptMemAlloc(size);
1157                 if (keyProvInfo.pwszProvName)
1158                 {
1159                     cbProvName = size;
1160                     ret = CryptEnumProvidersW(index, NULL, 0,
1161                      &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1162                     if (ret)
1163                     {
1164                         if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
1165                             keyProvInfo.dwFlags |= CRYPT_SILENT;
1166                         if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
1167                          !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1168                          CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1169                         {
1170                             keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
1171                             found = find_key_prov_info_in_provider(pCert,
1172                              &keyProvInfo);
1173                         }
1174                         if (!found)
1175                         {
1176                             if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
1177                              !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1178                              CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1179                             {
1180                                 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
1181                                 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
1182                                 found = find_key_prov_info_in_provider(pCert,
1183                                  &keyProvInfo);
1184                             }
1185                         }
1186                     }
1187                 }
1188                 else
1189                     ret = FALSE;
1190             }
1191             index++;
1192         }
1193     }
1194     if (found)
1195         CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1196          0, &keyProvInfo);
1197     CryptMemFree(keyProvInfo.pwszProvName);
1198     CryptMemFree(keyProvInfo.pwszContainerName);
1199     return found;
1200 }
1201
1202 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
1203 {
1204     BOOL matches = FALSE;
1205     DWORD size;
1206
1207     if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1208      NULL, &size))
1209     {
1210         CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
1211
1212         if (keyProvInfo)
1213         {
1214             if (CertGetCertificateContextProperty(pCert,
1215              CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
1216                 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
1217             CryptMemFree(keyProvInfo);
1218         }
1219     }
1220     return matches;
1221 }
1222
1223 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
1224  DWORD dwFlags, void *pvReserved)
1225 {
1226     BOOL matches;
1227
1228     TRACE("(%p, %08lx, %p)\n", pCert, dwFlags, pvReserved);
1229
1230     matches = cert_prov_info_matches_cert(pCert);
1231     if (!matches)
1232         matches = find_matching_provider(pCert, dwFlags);
1233     return matches;
1234 }
1235
1236 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1237  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1238 {
1239     BOOL ret;
1240
1241     TRACE("(%08lx, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1242
1243     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1244      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1245      &pCertId2->SerialNumber);
1246     TRACE("returning %d\n", ret);
1247     return ret;
1248 }
1249
1250 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1251  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1252 {
1253     BOOL ret;
1254
1255     TRACE("(%08lx, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1256
1257     if (pCertName1->cbData == pCertName2->cbData)
1258     {
1259         if (pCertName1->cbData)
1260             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1261              pCertName1->cbData);
1262         else
1263             ret = TRUE;
1264     }
1265     else
1266         ret = FALSE;
1267     TRACE("returning %d\n", ret);
1268     return ret;
1269 }
1270
1271 /* Returns the number of significant bytes in pInt, where a byte is
1272  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1273  * for negative numbers.  pInt is assumed to be little-endian.
1274  */
1275 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1276 {
1277     DWORD ret = pInt->cbData;
1278
1279     while (ret > 1)
1280     {
1281         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1282             ret--;
1283         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1284             ret--;
1285         else
1286             break;
1287     }
1288     return ret;
1289 }
1290
1291 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1292  PCRYPT_INTEGER_BLOB pInt2)
1293 {
1294     BOOL ret;
1295     DWORD cb1, cb2;
1296
1297     TRACE("(%p, %p)\n", pInt1, pInt2);
1298
1299     cb1 = CRYPT_significantBytes(pInt1);
1300     cb2 = CRYPT_significantBytes(pInt2);
1301     if (cb1 == cb2)
1302     {
1303         if (cb1)
1304             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1305         else
1306             ret = TRUE;
1307     }
1308     else
1309         ret = FALSE;
1310     TRACE("returning %d\n", ret);
1311     return ret;
1312 }
1313
1314 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1315  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1316 {
1317     BOOL ret;
1318
1319     TRACE("(%08lx, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1320
1321     /* RSA public key data should start with ASN_SEQUENCE,
1322      * otherwise it's not a RSA_CSP_PUBLICKEYBLOB.
1323      */
1324     if (!pPublicKey1->PublicKey.cbData || pPublicKey1->PublicKey.pbData[0] != ASN_SEQUENCE)
1325         dwCertEncodingType = 0;
1326
1327     switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1328     {
1329     case 0:     /* Seems to mean "raw binary bits" */
1330         if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1331          pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1332         {
1333           if (pPublicKey2->PublicKey.cbData)
1334               ret = !memcmp(pPublicKey1->PublicKey.pbData,
1335                pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1336           else
1337               ret = TRUE;
1338         }
1339         else
1340             ret = FALSE;
1341         break;
1342     default:
1343         WARN("Unknown encoding type %08lx\n", dwCertEncodingType);
1344         /* FALLTHROUGH */
1345     case X509_ASN_ENCODING:
1346     {
1347         BLOBHEADER *pblob1, *pblob2;
1348         DWORD length;
1349         ret = FALSE;
1350         if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1351                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1352                     CRYPT_DECODE_ALLOC_FLAG, &pblob1, &length))
1353         {
1354             if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1355                         pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1356                         CRYPT_DECODE_ALLOC_FLAG, &pblob2, &length))
1357             {
1358                 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1359                 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1360                           *pk2 = (LPVOID)(pblob2 + 1);
1361                 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1362                          && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1363
1364                 LocalFree(pblob2);
1365             }
1366             LocalFree(pblob1);
1367         }
1368
1369         break;
1370     }
1371     }
1372     return ret;
1373 }
1374
1375 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1376  PCERT_PUBLIC_KEY_INFO pPublicKey)
1377 {
1378     DWORD len = 0;
1379
1380     TRACE("(%08lx, %p)\n", dwCertEncodingType, pPublicKey);
1381
1382     if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1383     {
1384         SetLastError(ERROR_FILE_NOT_FOUND);
1385         return 0;
1386     }
1387     if (pPublicKey->Algorithm.pszObjId &&
1388      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1389     {
1390         FIXME("unimplemented for DH public keys\n");
1391         SetLastError(CRYPT_E_ASN1_BADTAG);
1392     }
1393     else
1394     {
1395         PCCRYPT_OID_INFO info;
1396         DWORD size;
1397         PBYTE buf;
1398         BOOL ret;
1399
1400         info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY, pPublicKey->Algorithm.pszObjId, 0);
1401         if (info)
1402         {
1403             HCRYPTKEY key;
1404
1405             TRACE("public key algid %#x (%s)\n", info->Algid, debugstr_a(pPublicKey->Algorithm.pszObjId));
1406
1407             ret = CryptImportPublicKeyInfo(I_CryptGetDefaultCryptProv(info->Algid), dwCertEncodingType, pPublicKey, &key);
1408             if (ret)
1409             {
1410                 size = sizeof(len);
1411                 ret = CryptGetKeyParam(key, KP_KEYLEN, (BYTE *)&len, &size, 0);
1412                 CryptDestroyKey(key);
1413                 return len;
1414             }
1415             /* fallback to RSA */
1416         }
1417
1418         ret = CryptDecodeObjectEx(dwCertEncodingType,
1419          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1420          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1421          &size);
1422
1423         if (ret)
1424         {
1425             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1426
1427             len = rsaPubKey->bitlen;
1428             LocalFree(buf);
1429         }
1430     }
1431     return len;
1432 }
1433
1434 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1435  DWORD dwFlags, const void *pvPara);
1436
1437 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1438  DWORD dwFlags, const void *pvPara)
1439 {
1440     BOOL ret;
1441     BYTE hash[16];
1442     DWORD size = sizeof(hash);
1443
1444     ret = CertGetCertificateContextProperty(pCertContext,
1445      CERT_MD5_HASH_PROP_ID, hash, &size);
1446     if (ret)
1447     {
1448         const CRYPT_HASH_BLOB *pHash = pvPara;
1449
1450         if (size == pHash->cbData)
1451             ret = !memcmp(pHash->pbData, hash, size);
1452         else
1453             ret = FALSE;
1454     }
1455     return ret;
1456 }
1457
1458 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1459  DWORD dwFlags, const void *pvPara)
1460 {
1461     BOOL ret;
1462     BYTE hash[20];
1463     DWORD size = sizeof(hash);
1464
1465     ret = CertGetCertificateContextProperty(pCertContext,
1466      CERT_SHA1_HASH_PROP_ID, hash, &size);
1467     if (ret)
1468     {
1469         const CRYPT_HASH_BLOB *pHash = pvPara;
1470
1471         if (size == pHash->cbData)
1472             ret = !memcmp(pHash->pbData, hash, size);
1473         else
1474             ret = FALSE;
1475     }
1476     return ret;
1477 }
1478
1479 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1480  DWORD dwFlags, const void *pvPara)
1481 {
1482     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1483     BOOL ret;
1484
1485     if (dwType & CERT_INFO_SUBJECT_FLAG)
1486         toCompare = &pCertContext->pCertInfo->Subject;
1487     else
1488         toCompare = &pCertContext->pCertInfo->Issuer;
1489     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1490      toCompare, blob);
1491     return ret;
1492 }
1493
1494 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1495  DWORD dwType, DWORD dwFlags, const void *pvPara)
1496 {
1497     CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1498     BOOL ret;
1499
1500     ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1501      &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1502     return ret;
1503 }
1504
1505 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1506  DWORD dwType, DWORD dwFlags, const void *pvPara)
1507 {
1508     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1509     BOOL ret;
1510
1511     /* Matching serial number and subject match.. */
1512     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1513      &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1514     if (ret)
1515         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1516          &pCertInfo->SerialNumber);
1517     else
1518     {
1519         /* failing that, if the serial number and issuer match, we match */
1520         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1521          &pCertInfo->SerialNumber);
1522         if (ret)
1523             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1524              &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1525     }
1526     TRACE("returning %d\n", ret);
1527     return ret;
1528 }
1529
1530 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1531  DWORD dwFlags, const void *pvPara)
1532 {
1533     CERT_ID *id = (CERT_ID *)pvPara;
1534     BOOL ret;
1535
1536     switch (id->dwIdChoice)
1537     {
1538     case CERT_ID_ISSUER_SERIAL_NUMBER:
1539         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1540          &pCertContext->pCertInfo->Issuer, &id->IssuerSerialNumber.Issuer);
1541         if (ret)
1542             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1543              &id->IssuerSerialNumber.SerialNumber);
1544         break;
1545     case CERT_ID_SHA1_HASH:
1546         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1547          &id->HashId);
1548         break;
1549     case CERT_ID_KEY_IDENTIFIER:
1550     {
1551         DWORD size = 0;
1552
1553         ret = CertGetCertificateContextProperty(pCertContext,
1554          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1555         if (ret && size == id->KeyId.cbData)
1556         {
1557             LPBYTE buf = CryptMemAlloc(size);
1558
1559             if (buf)
1560             {
1561                 CertGetCertificateContextProperty(pCertContext,
1562                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1563                 ret = !memcmp(buf, id->KeyId.pbData, size);
1564                 CryptMemFree(buf);
1565             }
1566             else
1567                 ret = FALSE;
1568         }
1569         else
1570             ret = FALSE;
1571         break;
1572     }
1573     default:
1574         ret = FALSE;
1575         break;
1576     }
1577     return ret;
1578 }
1579
1580 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1581  DWORD dwFlags, const void *pvPara)
1582 {
1583     PCCERT_CONTEXT toCompare = pvPara;
1584     return CertCompareCertificate(pCertContext->dwCertEncodingType,
1585      pCertContext->pCertInfo, toCompare->pCertInfo);
1586 }
1587
1588 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1589  DWORD dwFlags, const void *pvPara)
1590 {
1591     const CRYPT_HASH_BLOB *hash = pvPara;
1592     DWORD size = 0;
1593     BOOL ret;
1594
1595     ret = CertGetCertificateContextProperty(pCertContext,
1596      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1597     if (ret && size == hash->cbData)
1598     {
1599         LPBYTE buf = CryptMemAlloc(size);
1600
1601         if (buf)
1602         {
1603             CertGetCertificateContextProperty(pCertContext,
1604              CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1605             ret = !memcmp(buf, hash->pbData, size);
1606             CryptMemFree(buf);
1607         }
1608         else
1609             ret = FALSE;
1610     }
1611     else
1612         ret = FALSE;
1613     return ret;
1614 }
1615
1616 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1617  PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1618  const void *pvPara)
1619 {
1620     BOOL matches = FALSE;
1621     PCCERT_CONTEXT ret;
1622
1623     ret = prev;
1624     do {
1625         ret = CertEnumCertificatesInStore(store, ret);
1626         if (ret)
1627             matches = compare(ret, dwType, dwFlags, pvPara);
1628     } while (ret != NULL && !matches);
1629     return ret;
1630 }
1631
1632 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1633  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1634
1635 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1636  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1637 {
1638     return CertEnumCertificatesInStore(store, prev);
1639 }
1640
1641 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1642  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1643 {
1644     BOOL ret;
1645     PCCERT_CONTEXT found = NULL, subject = pvPara;
1646     PCERT_EXTENSION ext;
1647     DWORD size;
1648
1649     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1650      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1651     {
1652         CERT_AUTHORITY_KEY_ID_INFO *info;
1653
1654         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1655          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1656          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1657          &info, &size);
1658         if (ret)
1659         {
1660             CERT_ID id;
1661
1662             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1663             {
1664                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1665                 memcpy(&id.IssuerSerialNumber.Issuer, &info->CertIssuer,
1666                  sizeof(CERT_NAME_BLOB));
1667                 memcpy(&id.IssuerSerialNumber.SerialNumber,
1668                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1669             }
1670             else if (info->KeyId.cbData)
1671             {
1672                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1673                 memcpy(&id.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1674             }
1675             else
1676                 ret = FALSE;
1677             if (ret)
1678                 found = cert_compare_certs_in_store(store, prev,
1679                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1680             LocalFree(info);
1681         }
1682     }
1683     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1684      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1685     {
1686         CERT_AUTHORITY_KEY_ID2_INFO *info;
1687
1688         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1689          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1690          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1691          &info, &size);
1692         if (ret)
1693         {
1694             CERT_ID id;
1695
1696             if (info->AuthorityCertIssuer.cAltEntry &&
1697              info->AuthorityCertSerialNumber.cbData)
1698             {
1699                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1700                 DWORD i;
1701
1702                 for (i = 0; !directoryName &&
1703                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1704                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1705                      == CERT_ALT_NAME_DIRECTORY_NAME)
1706                         directoryName =
1707                          &info->AuthorityCertIssuer.rgAltEntry[i];
1708                 if (directoryName)
1709                 {
1710                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1711                     memcpy(&id.IssuerSerialNumber.Issuer,
1712                      &directoryName->DirectoryName, sizeof(CERT_NAME_BLOB));
1713                     memcpy(&id.IssuerSerialNumber.SerialNumber,
1714                      &info->AuthorityCertSerialNumber,
1715                      sizeof(CRYPT_INTEGER_BLOB));
1716                 }
1717                 else
1718                 {
1719                     FIXME("no supported name type in authority key id2\n");
1720                     ret = FALSE;
1721                 }
1722             }
1723             else if (info->KeyId.cbData)
1724             {
1725                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1726                 memcpy(&id.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1727             }
1728             else
1729                 ret = FALSE;
1730             if (ret)
1731                 found = cert_compare_certs_in_store(store, prev,
1732                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1733             LocalFree(info);
1734         }
1735     }
1736     else
1737        found = cert_compare_certs_in_store(store, prev,
1738         compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1739         dwFlags, &subject->pCertInfo->Issuer);
1740     return found;
1741 }
1742
1743 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1744  DWORD dwType, DWORD dwFlags, const void *pvPara)
1745 {
1746     PCERT_NAME_BLOB name;
1747     DWORD len;
1748     BOOL ret = FALSE;
1749
1750     if (dwType & CERT_INFO_SUBJECT_FLAG)
1751         name = &pCertContext->pCertInfo->Subject;
1752     else
1753         name = &pCertContext->pCertInfo->Issuer;
1754     len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1755      CERT_SIMPLE_NAME_STR, NULL, 0);
1756     if (len)
1757     {
1758         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1759
1760         if (str)
1761         {
1762             CertNameToStrW(pCertContext->dwCertEncodingType, name,
1763              CERT_SIMPLE_NAME_STR, str, len);
1764             wcslwr(str);
1765             if (wcsstr(str, pvPara))
1766                 ret = TRUE;
1767             CryptMemFree(str);
1768         }
1769     }
1770     return ret;
1771 }
1772
1773 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1774  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1775 {
1776     PCCERT_CONTEXT found = NULL;
1777
1778     TRACE("%s\n", debugstr_a(pvPara));
1779
1780     if (pvPara)
1781     {
1782         int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1783         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1784
1785         if (str)
1786         {
1787             MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1788             wcslwr(str);
1789             found = cert_compare_certs_in_store(store, prev,
1790              compare_cert_by_name_str, dwType, dwFlags, str);
1791             CryptMemFree(str);
1792         }
1793     }
1794     else
1795         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1796     return found;
1797 }
1798
1799 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1800  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1801 {
1802     PCCERT_CONTEXT found = NULL;
1803
1804     TRACE("%s\n", debugstr_w(pvPara));
1805
1806     if (pvPara)
1807     {
1808         DWORD len = lstrlenW(pvPara);
1809         LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1810
1811         if (str)
1812         {
1813             wcscpy( str, pvPara );
1814             wcslwr( str );
1815            found = cert_compare_certs_in_store(store, prev,
1816             compare_cert_by_name_str, dwType, dwFlags, str);
1817            CryptMemFree(str);
1818         }
1819     }
1820     else
1821         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1822     return found;
1823 }
1824
1825 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1826  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1827  PCCERT_CONTEXT pPrevCertContext)
1828 {
1829     PCCERT_CONTEXT ret;
1830     CertFindFunc find = NULL;
1831     CertCompareFunc compare = NULL;
1832     CERT_ID cert_id;
1833
1834     TRACE("(%p, %08lx, %08lx, %08lx, %p, %p)\n", hCertStore, dwCertEncodingType,
1835          dwFlags, dwType, pvPara, pPrevCertContext);
1836
1837     switch (dwType >> CERT_COMPARE_SHIFT)
1838     {
1839     case CERT_COMPARE_ANY:
1840         find = find_cert_any;
1841         break;
1842     case CERT_COMPARE_MD5_HASH:
1843         compare = compare_cert_by_md5_hash;
1844         break;
1845     case CERT_COMPARE_SHA1_HASH:
1846         compare = compare_cert_by_sha1_hash;
1847         break;
1848     case CERT_COMPARE_NAME:
1849         compare = compare_cert_by_name;
1850         break;
1851     case CERT_COMPARE_PUBLIC_KEY:
1852         compare = compare_cert_by_public_key;
1853         break;
1854     case CERT_COMPARE_NAME_STR_A:
1855         find = find_cert_by_name_str_a;
1856         break;
1857     case CERT_COMPARE_NAME_STR_W:
1858         find = find_cert_by_name_str_w;
1859         break;
1860     case CERT_COMPARE_SUBJECT_CERT:
1861         compare = compare_cert_by_subject_cert;
1862         break;
1863     case CERT_COMPARE_KEY_IDENTIFIER:
1864         cert_id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1865         cert_id.KeyId = *(const CRYPT_HASH_BLOB *)pvPara;
1866         pvPara = &cert_id;
1867         /* fall through */
1868     case CERT_COMPARE_CERT_ID:
1869         compare = compare_cert_by_cert_id;
1870         break;
1871     case CERT_COMPARE_ISSUER_OF:
1872         find = find_cert_by_issuer;
1873         break;
1874     case CERT_COMPARE_EXISTING:
1875         compare = compare_existing_cert;
1876         break;
1877     case CERT_COMPARE_SIGNATURE_HASH:
1878         compare = compare_cert_by_signature_hash;
1879         break;
1880     default:
1881         FIXME("find type %08lx unimplemented\n", dwType);
1882     }
1883
1884     if (find)
1885         ret = find(hCertStore, dwType, dwFlags, pvPara, pPrevCertContext);
1886     else if (compare)
1887         ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1888          compare, dwType, dwFlags, pvPara);
1889     else
1890         ret = NULL;
1891     if (!ret)
1892         SetLastError(CRYPT_E_NOT_FOUND);
1893     TRACE("returning %p\n", ret);
1894     return ret;
1895 }
1896
1897 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1898  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1899 {
1900     TRACE("(%p, %08lx, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1901
1902     if (!pCertId)
1903     {
1904         SetLastError(E_INVALIDARG);
1905         return NULL;
1906     }
1907     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1908      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1909 }
1910
1911 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1912  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1913 {
1914     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1915      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1916
1917     if (*pdwFlags & ~supportedFlags)
1918     {
1919         SetLastError(E_INVALIDARG);
1920         return FALSE;
1921     }
1922     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1923     {
1924         DWORD flags = 0;
1925         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1926          NULL, &flags);
1927
1928         /* FIXME: what if the CRL has expired? */
1929         if (crl)
1930         {
1931             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1932              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1933                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1934         }
1935         else
1936             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1937     }
1938     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1939     {
1940         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1941             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1942     }
1943     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1944     {
1945         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1946          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1947          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1948             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1949     }
1950     return TRUE;
1951 }
1952
1953 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1954  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1955  DWORD *pdwFlags)
1956 {
1957     PCCERT_CONTEXT ret;
1958
1959     TRACE("(%p, %p, %p, %08lx)\n", hCertStore, pSubjectContext,
1960      pPrevIssuerContext, *pdwFlags);
1961
1962     if (!pSubjectContext)
1963     {
1964         SetLastError(E_INVALIDARG);
1965         return NULL;
1966     }
1967
1968     ret = CertFindCertificateInStore(hCertStore,
1969      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1970      pSubjectContext, pPrevIssuerContext);
1971     if (ret)
1972     {
1973         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1974          pdwFlags))
1975         {
1976             CertFreeCertificateContext(ret);
1977             ret = NULL;
1978         }
1979         if (CRYPT_IsCertificateSelfSigned(pSubjectContext))
1980         {
1981             CertFreeCertificateContext(ret);
1982             ret = NULL;
1983             SetLastError(CRYPT_E_SELF_SIGNED);
1984         }
1985     }
1986     TRACE("returning %p\n", ret);
1987     return ret;
1988 }
1989
1990 typedef struct _OLD_CERT_REVOCATION_STATUS {
1991     DWORD cbSize;
1992     DWORD dwIndex;
1993     DWORD dwError;
1994     DWORD dwReason;
1995 } OLD_CERT_REVOCATION_STATUS;
1996
1997 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1998  void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1999
2000 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
2001  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
2002  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
2003 {
2004     BOOL ret;
2005
2006     TRACE("(%08lx, %ld, %ld, %p, %08lx, %p, %p)\n", dwEncodingType, dwRevType,
2007      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
2008
2009     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
2010      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
2011     {
2012         SetLastError(E_INVALIDARG);
2013         return FALSE;
2014     }
2015     if (cContext)
2016     {
2017         static HCRYPTOIDFUNCSET set = NULL;
2018         DWORD size;
2019
2020         if (!set)
2021             set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
2022         ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
2023         if (ret)
2024         {
2025             if (size == 1)
2026             {
2027                 /* empty list */
2028                 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
2029                 ret = FALSE;
2030             }
2031             else
2032             {
2033                 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
2034
2035                 if (dllList)
2036                 {
2037                     ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
2038                      dllList, &size);
2039                     if (ret)
2040                     {
2041                         for (ptr = dllList; ret && *ptr;
2042                          ptr += lstrlenW(ptr) + 1)
2043                         {
2044                             CertVerifyRevocationFunc func;
2045                             HCRYPTOIDFUNCADDR hFunc;
2046
2047                             ret = CryptGetDefaultOIDFunctionAddress(set,
2048                              dwEncodingType, ptr, 0, (void **)&func, &hFunc);
2049                             if (ret)
2050                             {
2051                                 ret = func(dwEncodingType, dwRevType, cContext,
2052                                  rgpvContext, dwFlags, pRevPara, pRevStatus);
2053                                 CryptFreeOIDFunctionAddress(hFunc, 0);
2054                             }
2055                         }
2056                     }
2057                     CryptMemFree(dllList);
2058                 }
2059                 else
2060                 {
2061                     SetLastError(ERROR_OUTOFMEMORY);
2062                     ret = FALSE;
2063                 }
2064             }
2065         }
2066     }
2067     else
2068         ret = TRUE;
2069     return ret;
2070 }
2071
2072 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
2073  CRYPT_ATTRIBUTE rgAttr[])
2074 {
2075     PCRYPT_ATTRIBUTE ret = NULL;
2076     DWORD i;
2077
2078     TRACE("%s %ld %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
2079
2080     if (!cAttr)
2081         return NULL;
2082     if (!pszObjId)
2083     {
2084         SetLastError(ERROR_INVALID_PARAMETER);
2085         return NULL;
2086     }
2087
2088     for (i = 0; !ret && i < cAttr; i++)
2089         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
2090             ret = &rgAttr[i];
2091     return ret;
2092 }
2093
2094 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
2095  CERT_EXTENSION rgExtensions[])
2096 {
2097     PCERT_EXTENSION ret = NULL;
2098     DWORD i;
2099
2100     TRACE("%s %ld %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
2101
2102     if (!cExtensions)
2103         return NULL;
2104     if (!pszObjId)
2105     {
2106         SetLastError(ERROR_INVALID_PARAMETER);
2107         return NULL;
2108     }
2109
2110     for (i = 0; !ret && i < cExtensions; i++)
2111         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
2112          rgExtensions[i].pszObjId))
2113             ret = &rgExtensions[i];
2114     return ret;
2115 }
2116
2117 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
2118 {
2119     PCERT_RDN_ATTR ret = NULL;
2120     DWORD i, j;
2121
2122     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
2123
2124     if (!pszObjId)
2125     {
2126         SetLastError(ERROR_INVALID_PARAMETER);
2127         return NULL;
2128     }
2129
2130     for (i = 0; !ret && i < pName->cRDN; i++)
2131         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
2132             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
2133              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
2134                 ret = &pName->rgRDN[i].rgRDNAttr[j];
2135     return ret;
2136 }
2137
2138 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
2139  const CERT_RDN_ATTR *attr)
2140 {
2141     DWORD i, j;
2142     BOOL match = FALSE;
2143
2144     for (i = 0; !match && i < name->cRDN; i++)
2145     {
2146         for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
2147         {
2148             if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
2149              attr->pszObjId) &&
2150              name->rgRDN[i].rgRDNAttr[j].dwValueType ==
2151              attr->dwValueType)
2152             {
2153                 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
2154                 {
2155                     LPCWSTR nameStr =
2156                      (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2157                     LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
2158
2159                     if (attr->Value.cbData !=
2160                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2161                         match = FALSE;
2162                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2163                         match = !wcsnicmp(nameStr, attrStr,
2164                          attr->Value.cbData / sizeof(WCHAR));
2165                     else
2166                         match = !wcsncmp(nameStr, attrStr,
2167                          attr->Value.cbData / sizeof(WCHAR));
2168                     TRACE("%s : %s => %d\n",
2169                      debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
2170                      debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
2171                      match);
2172                 }
2173                 else
2174                 {
2175                     LPCSTR nameStr =
2176                      (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2177                     LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
2178
2179                     if (attr->Value.cbData !=
2180                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2181                         match = FALSE;
2182                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2183                         match = !_strnicmp(nameStr, attrStr,
2184                          attr->Value.cbData);
2185                     else
2186                         match = !strncmp(nameStr, attrStr, attr->Value.cbData);
2187                     TRACE("%s : %s => %d\n",
2188                      debugstr_an(nameStr, attr->Value.cbData),
2189                      debugstr_an(attrStr, attr->Value.cbData), match);
2190                 }
2191             }
2192         }
2193     }
2194     return match;
2195 }
2196
2197 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
2198  DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
2199 {
2200     CERT_NAME_INFO *name;
2201     LPCSTR type;
2202     DWORD size;
2203     BOOL ret;
2204
2205     TRACE("(%08lx, %08lx, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
2206      pRDN);
2207
2208     type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
2209      X509_NAME;
2210     if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
2211      pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
2212     {
2213         DWORD i;
2214
2215         for (i = 0; ret && i < pRDN->cRDNAttr; i++)
2216             ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
2217         if (!ret)
2218             SetLastError(CRYPT_E_NO_MATCH);
2219         LocalFree(name);
2220     }
2221     return ret;
2222 }
2223
2224 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
2225  PCERT_INFO pCertInfo)
2226 {
2227     FILETIME fileTime;
2228     LONG ret;
2229
2230     if (!pTimeToVerify)
2231     {
2232         GetSystemTimeAsFileTime(&fileTime);
2233         pTimeToVerify = &fileTime;
2234     }
2235     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
2236     {
2237         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
2238         if (ret < 0)
2239             ret = 0;
2240     }
2241     return ret;
2242 }
2243
2244 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
2245  PCERT_INFO pIssuerInfo)
2246 {
2247     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
2248
2249     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
2250      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
2251 }
2252
2253 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2254  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2255  DWORD *pcbComputedHash)
2256 {
2257     BOOL ret = TRUE;
2258     HCRYPTHASH hHash = 0;
2259
2260     TRACE("(%08Ix, %d, %08lx, %p, %ld, %p, %p)\n", hCryptProv, Algid, dwFlags,
2261      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2262
2263     if (!hCryptProv)
2264         hCryptProv = I_CryptGetDefaultCryptProv(Algid);
2265     if (!Algid)
2266         Algid = CALG_SHA1;
2267     if (ret)
2268     {
2269         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2270         if (ret)
2271         {
2272             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2273             if (ret)
2274                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2275                  pcbComputedHash, 0);
2276             CryptDestroyHash(hHash);
2277         }
2278     }
2279     return ret;
2280 }
2281
2282 BOOL WINAPI CryptHashCertificate2(LPCWSTR pwszCNGHashAlgid, DWORD dwFlags,
2283  void *pvReserved, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2284  DWORD *pcbComputedHash)
2285 {
2286     BCRYPT_HASH_HANDLE hash = NULL;
2287     BCRYPT_ALG_HANDLE alg = NULL;
2288     NTSTATUS status;
2289     DWORD hash_len;
2290     DWORD hash_len_size;
2291
2292     TRACE("(%s, %08lx, %p, %p, %ld, %p, %p)\n", debugstr_w(pwszCNGHashAlgid),
2293      dwFlags, pvReserved, pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2294
2295     if ((status = BCryptOpenAlgorithmProvider(&alg, pwszCNGHashAlgid, NULL, 0)))
2296     {
2297         if (status == STATUS_NOT_IMPLEMENTED)
2298             status = STATUS_NOT_FOUND;
2299         goto done;
2300     }
2301
2302     if ((status = BCryptCreateHash(alg, &hash, NULL, 0, NULL, 0, 0)))
2303         goto done;
2304
2305     if ((status = BCryptGetProperty(hash, BCRYPT_HASH_LENGTH, (BYTE *)&hash_len, sizeof(hash_len), &hash_len_size, 0)))
2306         goto done;
2307
2308     if (!pbComputedHash)
2309     {
2310         *pcbComputedHash = hash_len;
2311         goto done;
2312     }
2313
2314     if (*pcbComputedHash < hash_len)
2315     {
2316         status = ERROR_MORE_DATA;
2317         goto done;
2318     }
2319
2320     *pcbComputedHash = hash_len;
2321
2322     if ((status = BCryptHashData(hash, (BYTE *)pbEncoded, cbEncoded, 0)))
2323         goto done;
2324
2325     if ((status = BCryptFinishHash(hash, pbComputedHash, hash_len, 0)))
2326         goto done;
2327
2328 done:
2329     if (hash) BCryptDestroyHash(hash);
2330     if (alg)  BCryptCloseAlgorithmProvider(alg, 0);
2331     if (status) SetLastError(status);
2332     return !status;
2333 }
2334
2335 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2336  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2337  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2338 {
2339     BOOL ret = TRUE;
2340     HCRYPTHASH hHash = 0;
2341
2342     TRACE("(%08Ix, %d, %08lx, %ld, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2343      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2344
2345     if (!hCryptProv)
2346         hCryptProv = I_CryptGetDefaultCryptProv(0);
2347     if (!Algid)
2348         Algid = CALG_MD5;
2349     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2350     {
2351         SetLastError(ERROR_FILE_NOT_FOUND);
2352         return FALSE;
2353     }
2354     if (ret)
2355     {
2356         BYTE *buf;
2357         DWORD size = 0;
2358
2359         ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2360          X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2361          (LPBYTE)&buf, &size);
2362         if (ret)
2363         {
2364             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2365             if (ret)
2366             {
2367                 ret = CryptHashData(hHash, buf, size, 0);
2368                 if (ret)
2369                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2370                      pcbComputedHash, 0);
2371                 CryptDestroyHash(hHash);
2372             }
2373             LocalFree(buf);
2374         }
2375     }
2376     return ret;
2377 }
2378
2379 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2380  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2381  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2382 {
2383     BOOL ret;
2384     CERT_SIGNED_CONTENT_INFO *info;
2385     DWORD size;
2386
2387     TRACE("(%08Ix, %08lx, %p, %ld, %p, %ld)\n", hCryptProv, dwCertEncodingType,
2388      pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2389
2390     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2391      pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2392     if (ret)
2393     {
2394         PCCRYPT_OID_INFO oidInfo;
2395         HCRYPTHASH hHash;
2396
2397         if (!hCryptProv)
2398             hCryptProv = I_CryptGetDefaultCryptProv(0);
2399         oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2400          info->SignatureAlgorithm.pszObjId, 0);
2401         if (!oidInfo)
2402         {
2403             SetLastError(NTE_BAD_ALGID);
2404             ret = FALSE;
2405         }
2406         else
2407         {
2408             ret = CryptCreateHash(hCryptProv, oidInfo->Algid, 0, 0, &hHash);
2409             if (ret)
2410             {
2411                 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2412                  info->ToBeSigned.cbData, 0);
2413                 if (ret)
2414                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2415                      pcbComputedHash, 0);
2416                 CryptDestroyHash(hHash);
2417             }
2418         }
2419         LocalFree(info);
2420     }
2421     return ret;
2422 }
2423
2424 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2425  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2426  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2427  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2428 {
2429     BOOL ret;
2430     PCCRYPT_OID_INFO info;
2431     HCRYPTHASH hHash;
2432
2433     TRACE("(%08Ix, %ld, %ld, %p, %ld, %p, %p, %p, %p)\n", hCryptProv,
2434      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2435      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2436
2437     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2438      pSignatureAlgorithm->pszObjId, 0);
2439     if (!info)
2440     {
2441         SetLastError(NTE_BAD_ALGID);
2442         return FALSE;
2443     }
2444     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2445     {
2446         if (!hCryptProv)
2447             hCryptProv = I_CryptGetDefaultCryptProv(0);
2448         ret = CryptCreateHash(hCryptProv, info->Algid, 0, 0, &hHash);
2449         if (ret)
2450         {
2451             ret = CryptHashData(hHash, pbEncodedToBeSigned,
2452              cbEncodedToBeSigned, 0);
2453             if (ret)
2454                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2455                  pcbSignature, 0);
2456             CryptDestroyHash(hHash);
2457         }
2458     }
2459     else
2460     {
2461         if (!hCryptProv)
2462         {
2463             SetLastError(ERROR_INVALID_PARAMETER);
2464             ret = FALSE;
2465         }
2466         else
2467         {
2468             ret = CryptCreateHash(hCryptProv, info->Algid, 0, 0, &hHash);
2469             if (ret)
2470             {
2471                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2472                  cbEncodedToBeSigned, 0);
2473                 if (ret)
2474                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2475                      pcbSignature);
2476                 CryptDestroyHash(hHash);
2477             }
2478         }
2479     }
2480     return ret;
2481 }
2482
2483 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2484  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2485  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2486  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2487 {
2488     BOOL ret;
2489     DWORD encodedSize, hashSize;
2490
2491     TRACE("(%08Ix, %ld, %ld, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2492      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2493      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2494
2495     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2496      NULL, &encodedSize);
2497     if (ret)
2498     {
2499         PBYTE encoded = CryptMemAlloc(encodedSize);
2500
2501         if (encoded)
2502         {
2503             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2504              pvStructInfo, encoded, &encodedSize);
2505             if (ret)
2506             {
2507                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2508                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2509                  pvHashAuxInfo, NULL, &hashSize);
2510                 if (ret)
2511                 {
2512                     PBYTE hash = CryptMemAlloc(hashSize);
2513
2514                     if (hash)
2515                     {
2516                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2517                          dwCertEncodingType, encoded, encodedSize,
2518                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2519                         if (ret)
2520                         {
2521                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2522
2523                             info.ToBeSigned.cbData = encodedSize;
2524                             info.ToBeSigned.pbData = encoded;
2525                             info.SignatureAlgorithm = *pSignatureAlgorithm;
2526                             info.Signature.cbData = hashSize;
2527                             info.Signature.pbData = hash;
2528                             info.Signature.cUnusedBits = 0;
2529                             ret = CryptEncodeObject(dwCertEncodingType,
2530                              X509_CERT, &info, pbEncoded, pcbEncoded);
2531                         }
2532                         CryptMemFree(hash);
2533                     }
2534                     else
2535                         ret = FALSE;
2536                 }
2537             }
2538             CryptMemFree(encoded);
2539         }
2540         else
2541             ret = FALSE;
2542     }
2543     return ret;
2544 }
2545
2546 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2547  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2548  PCERT_PUBLIC_KEY_INFO pPublicKey)
2549 {
2550     CRYPT_DATA_BLOB blob = { cbEncoded, (BYTE *)pbEncoded };
2551
2552     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2553      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &blob,
2554      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2555 }
2556
2557 static BOOL CRYPT_VerifySignature(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2558     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert, const CRYPT_OID_INFO *info)
2559 {
2560     BOOL ret;
2561     HCRYPTKEY key;
2562     ALG_ID pubKeyID, hashID;
2563
2564     hashID = info->Algid;
2565     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2566         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2567     else
2568         pubKeyID = hashID;
2569     /* Load the default provider if necessary */
2570     if (!hCryptProv)
2571         hCryptProv = I_CryptGetDefaultCryptProv(hashID);
2572     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2573      pubKeyInfo, pubKeyID, 0, NULL, &key);
2574     if (ret)
2575     {
2576         HCRYPTHASH hash;
2577
2578         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2579         if (ret)
2580         {
2581             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2582              signedCert->ToBeSigned.cbData, 0);
2583             if (ret)
2584                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2585                  signedCert->Signature.cbData, key, NULL, 0);
2586             CryptDestroyHash(hash);
2587         }
2588         CryptDestroyKey(key);
2589     }
2590     return ret;
2591 }
2592
2593 static BOOL CNG_CalcHash(const WCHAR *algorithm, const CERT_SIGNED_CONTENT_INFO *signedCert,
2594         BYTE **hash_value, DWORD *hash_len)
2595 {
2596     BCRYPT_HASH_HANDLE hash = NULL;
2597     BCRYPT_ALG_HANDLE alg = NULL;
2598     NTSTATUS status;
2599     DWORD size;
2600
2601     if ((status = BCryptOpenAlgorithmProvider(&alg, algorithm, NULL, 0)))
2602         goto done;
2603
2604     if ((status = BCryptCreateHash(alg, &hash, NULL, 0, NULL, 0, 0)))
2605         goto done;
2606
2607     if ((status = BCryptHashData(hash, signedCert->ToBeSigned.pbData, signedCert->ToBeSigned.cbData, 0)))
2608         goto done;
2609
2610     if ((status = BCryptGetProperty(hash, BCRYPT_HASH_LENGTH, (BYTE *)hash_len, sizeof(*hash_len), &size, 0)))
2611         goto done;
2612
2613     if (!(*hash_value = CryptMemAlloc(*hash_len)))
2614     {
2615         status = STATUS_NO_MEMORY;
2616         goto done;
2617     }
2618
2619     if ((status = BCryptFinishHash(hash, *hash_value, *hash_len, 0)))
2620     {
2621         CryptMemFree(*hash_value);
2622         goto done;
2623     }
2624
2625 done:
2626     if (hash) BCryptDestroyHash(hash);
2627     if (alg)  BCryptCloseAlgorithmProvider(alg, 0);
2628     if (status) SetLastError(RtlNtStatusToDosError(status));
2629     return status == 0;
2630 }
2631
2632 static BOOL CNG_ImportECCPubKey(CERT_PUBLIC_KEY_INFO *pubKeyInfo, BCRYPT_KEY_HANDLE *key)
2633 {
2634     DWORD blob_magic, ecckey_len, size;
2635     BCRYPT_ALG_HANDLE alg_handle;
2636     BCRYPT_ECCKEY_BLOB *ecckey;
2637     char **ecc_curve;
2638     NTSTATUS status;
2639
2640     if (!pubKeyInfo->PublicKey.cbData)
2641     {
2642         SetLastError(NTE_BAD_ALGID);
2643         return FALSE;
2644     }
2645
2646     if (pubKeyInfo->PublicKey.pbData[0] != 0x4)
2647     {
2648         FIXME("Compressed ECC curves (%02x) not yet supported\n", pubKeyInfo->PublicKey.pbData[0]);
2649         SetLastError(NTE_BAD_ALGID);
2650         return FALSE;
2651     }
2652
2653     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_OBJECT_IDENTIFIER, pubKeyInfo->Algorithm.Parameters.pbData,
2654             pubKeyInfo->Algorithm.Parameters.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &ecc_curve, &size))
2655         return FALSE;
2656
2657     if (!strcmp(*ecc_curve, szOID_ECC_CURVE_P256))
2658     {
2659         alg_handle = BCRYPT_ECDSA_P256_ALG_HANDLE;
2660         blob_magic = BCRYPT_ECDSA_PUBLIC_P256_MAGIC;
2661     }
2662     else if (!strcmp(*ecc_curve, szOID_ECC_CURVE_P384))
2663     {
2664         alg_handle = BCRYPT_ECDSA_P384_ALG_HANDLE;
2665         blob_magic = BCRYPT_ECDSA_PUBLIC_P384_MAGIC;
2666     }
2667     else
2668     {
2669         FIXME("Unsupported ecc curve type: %s\n", *ecc_curve);
2670         alg_handle = NULL;
2671         blob_magic = 0;
2672     }
2673     LocalFree(ecc_curve);
2674
2675     if (!alg_handle)
2676     {
2677         SetLastError(NTE_BAD_ALGID);
2678         return FALSE;
2679     }
2680
2681     ecckey_len = sizeof(BCRYPT_ECCKEY_BLOB) + pubKeyInfo->PublicKey.cbData - 1;
2682     if (!(ecckey = CryptMemAlloc(ecckey_len)))
2683         return STATUS_NO_MEMORY;
2684
2685     ecckey->dwMagic = blob_magic;
2686     ecckey->cbKey = (pubKeyInfo->PublicKey.cbData - 1) / 2;
2687     memcpy(ecckey + 1, pubKeyInfo->PublicKey.pbData + 1, pubKeyInfo->PublicKey.cbData - 1);
2688
2689     status = BCryptImportKeyPair(alg_handle, NULL, BCRYPT_ECCPUBLIC_BLOB, key, (BYTE*)ecckey, ecckey_len, 0);
2690     CryptMemFree(ecckey);
2691
2692     if (status) SetLastError(RtlNtStatusToDosError(status));
2693     return !status;
2694 }
2695
2696 static BOOL CNG_ImportRSAPubKey(CERT_PUBLIC_KEY_INFO *info, BCRYPT_KEY_HANDLE *key)
2697 {
2698     DWORD size, modulus_len, i;
2699     BLOBHEADER *hdr;
2700     RSAPUBKEY *rsapubkey;
2701     BCRYPT_ALG_HANDLE alg_handle;
2702     BCRYPT_RSAKEY_BLOB *rsakey;
2703     BYTE *s, *d;
2704     NTSTATUS status;
2705
2706     if (!info->PublicKey.cbData)
2707     {
2708         SetLastError(NTE_BAD_ALGID);
2709         return FALSE;
2710     }
2711
2712     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, RSA_CSP_PUBLICKEYBLOB, info->PublicKey.pbData,
2713             info->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &hdr, &size))
2714     {
2715         WARN("CryptDecodeObjectEx failed\n");
2716         return FALSE;
2717     }
2718
2719     if (hdr->aiKeyAlg == CALG_RSA_KEYX)
2720         alg_handle = BCRYPT_RSA_ALG_HANDLE;
2721     else if (hdr->aiKeyAlg == CALG_RSA_SIGN)
2722         alg_handle = BCRYPT_RSA_SIGN_ALG_HANDLE;
2723     else
2724     {
2725         FIXME("Unsupported RSA algorithm: %#x\n", hdr->aiKeyAlg);
2726         LocalFree(hdr);
2727         SetLastError(NTE_BAD_ALGID);
2728         return FALSE;
2729     }
2730
2731     rsapubkey = (RSAPUBKEY *)(hdr + 1);
2732
2733     modulus_len = size - sizeof(*hdr) - sizeof(*rsapubkey);
2734     if (modulus_len != rsapubkey->bitlen / 8)
2735         FIXME("RSA pubkey has wrong modulus_len %lu\n", modulus_len);
2736
2737     size = sizeof(*rsakey) + sizeof(ULONG) + modulus_len;
2738     if (!(rsakey = CryptMemAlloc(size)))
2739         return STATUS_NO_MEMORY;
2740
2741     rsakey->Magic = BCRYPT_RSAPUBLIC_MAGIC;
2742     rsakey->BitLength = rsapubkey->bitlen;
2743     rsakey->cbPublicExp = sizeof(ULONG);
2744     rsakey->cbModulus = modulus_len;
2745     rsakey->cbPrime1 = 0;
2746     rsakey->cbPrime2 = 0;
2747
2748     d = (BYTE *)(rsakey + 1);
2749     /* According to MSDN modulus and pubexp are in LE while
2750      * BCRYPT_RSAKEY_BLOB is supposed to have them in BE format */
2751     *(ULONG *)d = RtlUlongByteSwap(rsapubkey->pubexp);
2752     d += sizeof(ULONG);
2753     s = (BYTE *)(rsapubkey + 1);
2754     for (i = 0; i < modulus_len; i++)
2755         d[i] = s[modulus_len - i - 1];
2756
2757     status = BCryptImportKeyPair(alg_handle, NULL, BCRYPT_RSAPUBLIC_BLOB, key, (BYTE *)rsakey, size, 0);
2758     CryptMemFree(rsakey);
2759
2760     LocalFree(hdr);
2761     if (status) SetLastError(RtlNtStatusToDosError(status));
2762     return !status;
2763 }
2764
2765 BOOL CNG_ImportPubKey(CERT_PUBLIC_KEY_INFO *pubKeyInfo, BCRYPT_KEY_HANDLE *key)
2766 {
2767     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_ECC_PUBLIC_KEY))
2768         return CNG_ImportECCPubKey(pubKeyInfo, key);
2769
2770     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_RSA_RSA))
2771         return CNG_ImportRSAPubKey(pubKeyInfo, key);
2772
2773     FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo->Algorithm.pszObjId));
2774     SetLastError(NTE_BAD_ALGID);
2775     return FALSE;
2776 }
2777
2778 static BOOL CNG_PrepareSignatureECC(BYTE *encoded_sig, DWORD encoded_size, BYTE **sig_value, DWORD *sig_len)
2779 {
2780     CERT_ECC_SIGNATURE *ecc_sig;
2781     DWORD size;
2782     int i;
2783
2784     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ECC_SIGNATURE, encoded_sig, encoded_size,
2785             CRYPT_DECODE_ALLOC_FLAG, NULL, &ecc_sig, &size))
2786         return FALSE;
2787
2788     if (!ecc_sig->r.cbData || !ecc_sig->s.cbData)
2789     {
2790         LocalFree(ecc_sig);
2791         SetLastError(ERROR_INVALID_DATA);
2792         return FALSE;
2793     }
2794
2795     *sig_len = ecc_sig->r.cbData + ecc_sig->s.cbData;
2796     if (!(*sig_value = CryptMemAlloc(*sig_len)))
2797     {
2798         LocalFree(ecc_sig);
2799         SetLastError(ERROR_OUTOFMEMORY);
2800         return FALSE;
2801     }
2802
2803     for (i = 0; i < ecc_sig->r.cbData; i++)
2804         (*sig_value)[i] = ecc_sig->r.pbData[ecc_sig->r.cbData - i - 1];
2805     for (i = 0; i < ecc_sig->s.cbData; i++)
2806         (*sig_value)[ecc_sig->r.cbData + i] = ecc_sig->s.pbData[ecc_sig->s.cbData - i - 1];
2807
2808     LocalFree(ecc_sig);
2809     return TRUE;
2810 }
2811
2812 BOOL cng_prepare_signature(const char *alg_oid, BYTE *encoded_sig, DWORD encoded_sig_len,
2813     BYTE **sig_value, DWORD *sig_len)
2814 {
2815     if (!strcmp(alg_oid, szOID_ECC_PUBLIC_KEY))
2816         return CNG_PrepareSignatureECC(encoded_sig, encoded_sig_len, sig_value, sig_len);
2817
2818     FIXME("Unsupported public key type: %s\n", debugstr_a(alg_oid));
2819     SetLastError(NTE_BAD_ALGID);
2820     return FALSE;
2821 }
2822
2823 static BOOL CNG_PrepareCertSignature(CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert,
2824     BYTE **sig_value, DWORD *sig_len)
2825 {
2826     BYTE *encoded_sig;
2827     BOOL ret = FALSE;
2828     int i;
2829
2830     if (!signedCert->Signature.cbData)
2831     {
2832         SetLastError(ERROR_INVALID_DATA);
2833         return FALSE;
2834     }
2835
2836     if (!(encoded_sig = CryptMemAlloc(signedCert->Signature.cbData)))
2837     {
2838         SetLastError(ERROR_OUTOFMEMORY);
2839         return FALSE;
2840     }
2841
2842     for (i = 0; i < signedCert->Signature.cbData; i++)
2843         encoded_sig[i] = signedCert->Signature.pbData[signedCert->Signature.cbData - i - 1];
2844
2845     ret = cng_prepare_signature(pubKeyInfo->Algorithm.pszObjId, encoded_sig, signedCert->Signature.cbData,
2846             sig_value, sig_len);
2847     CryptMemFree(encoded_sig);
2848     return ret;
2849 }
2850
2851 static BOOL CNG_VerifySignature(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2852     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert, const CRYPT_OID_INFO *info)
2853 {
2854     BCRYPT_KEY_HANDLE key = NULL;
2855     BYTE *hash_value = NULL, *sig_value;
2856     DWORD hash_len, sig_len;
2857     NTSTATUS status;
2858     BOOL ret;
2859
2860     ret = CNG_ImportPubKey(pubKeyInfo, &key);
2861     if (ret)
2862     {
2863         ret = CNG_CalcHash(info->pwszCNGAlgid, signedCert, &hash_value, &hash_len);
2864         if (ret)
2865         {
2866             ret = CNG_PrepareCertSignature(pubKeyInfo, signedCert, &sig_value, &sig_len);
2867             if (ret)
2868             {
2869                 status = BCryptVerifySignature(key, NULL, hash_value, hash_len, sig_value, sig_len, 0);
2870                 if (status)
2871                 {
2872                     FIXME("Failed to verify signature: %08lx\n", status);
2873                     SetLastError(RtlNtStatusToDosError(status));
2874                     ret = FALSE;
2875                 }
2876                 CryptMemFree(sig_value);
2877             }
2878             CryptMemFree(hash_value);
2879         }
2880         BCryptDestroyKey(key);
2881     }
2882
2883     return ret;
2884 }
2885
2886 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2887     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert)
2888 {
2889     CCRYPT_OID_INFO *info;
2890
2891     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY, signedCert->SignatureAlgorithm.pszObjId, 0);
2892     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2893     {
2894         SetLastError(NTE_BAD_ALGID);
2895         return FALSE;
2896     }
2897
2898     if (info->Algid == CALG_OID_INFO_CNG_ONLY)
2899         return CNG_VerifySignature(hCryptProv, dwCertEncodingType, pubKeyInfo, signedCert, info);
2900     else
2901         return CRYPT_VerifySignature(hCryptProv, dwCertEncodingType, pubKeyInfo, signedCert, info);
2902 }
2903
2904 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2905  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2906  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2907 {
2908     BOOL ret = TRUE;
2909     CRYPT_DATA_BLOB subjectBlob;
2910
2911     TRACE("(%08Ix, %ld, %ld, %p, %ld, %p, %08lx, %p)\n", hCryptProv,
2912      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2913      dwFlags, pvReserved);
2914
2915     switch (dwSubjectType)
2916     {
2917     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2918     {
2919         PCRYPT_DATA_BLOB blob = pvSubject;
2920
2921         subjectBlob.pbData = blob->pbData;
2922         subjectBlob.cbData = blob->cbData;
2923         break;
2924     }
2925     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2926     {
2927         PCERT_CONTEXT context = pvSubject;
2928
2929         subjectBlob.pbData = context->pbCertEncoded;
2930         subjectBlob.cbData = context->cbCertEncoded;
2931         break;
2932     }
2933     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2934     {
2935         PCRL_CONTEXT context = pvSubject;
2936
2937         subjectBlob.pbData = context->pbCrlEncoded;
2938         subjectBlob.cbData = context->cbCrlEncoded;
2939         break;
2940     }
2941     default:
2942         SetLastError(E_INVALIDARG);
2943         ret = FALSE;
2944     }
2945
2946     if (ret)
2947     {
2948         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2949         DWORD size = 0;
2950
2951         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2952          subjectBlob.pbData, subjectBlob.cbData,
2953          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2954          &signedCert, &size);
2955         if (ret)
2956         {
2957             switch (dwIssuerType)
2958             {
2959             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2960                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2961                  dwCertEncodingType, pvIssuer,
2962                  signedCert);
2963                 break;
2964             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2965                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2966                  dwCertEncodingType,
2967                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2968                  signedCert);
2969                 break;
2970             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2971                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2972                 ret = FALSE;
2973                 break;
2974             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2975                 if (pvIssuer)
2976                 {
2977                     SetLastError(E_INVALIDARG);
2978                     ret = FALSE;
2979                 }
2980                 else
2981                 {
2982                     FIXME("unimplemented for NULL signer\n");
2983                     SetLastError(E_INVALIDARG);
2984                     ret = FALSE;
2985                 }
2986                 break;
2987             default:
2988                 SetLastError(E_INVALIDARG);
2989                 ret = FALSE;
2990             }
2991             LocalFree(signedCert);
2992         }
2993     }
2994     return ret;
2995 }
2996
2997 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2998  PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2999 {
3000     PCERT_EXTENSION ext;
3001     BOOL ret = FALSE;
3002
3003     TRACE("(%08lx, %p, %p, %ld)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
3004      cbKeyUsage);
3005
3006     ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
3007      pCertInfo->rgExtension);
3008     if (ext)
3009     {
3010         CRYPT_BIT_BLOB usage;
3011         DWORD size = sizeof(usage);
3012
3013         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
3014          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
3015          &usage, &size);
3016         if (ret)
3017         {
3018             if (cbKeyUsage < usage.cbData)
3019                 ret = FALSE;
3020             else
3021             {
3022                 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
3023                 if (cbKeyUsage > usage.cbData)
3024                     memset(pbKeyUsage + usage.cbData, 0,
3025                      cbKeyUsage - usage.cbData);
3026             }
3027         }
3028     }
3029     else
3030         SetLastError(0);
3031     return ret;
3032 }
3033
3034 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
3035  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
3036 {
3037     PCERT_ENHKEY_USAGE usage = NULL;
3038     DWORD bytesNeeded;
3039     BOOL ret = TRUE;
3040
3041     if (!pCertContext || !pcbUsage)
3042     {
3043         SetLastError(ERROR_INVALID_PARAMETER);
3044         return FALSE;
3045     }
3046
3047     TRACE("(%p, %08lx, %p, %ld)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
3048
3049     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
3050     {
3051         DWORD propSize = 0;
3052
3053         if (CertGetCertificateContextProperty(pCertContext,
3054          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
3055         {
3056             LPBYTE buf = CryptMemAlloc(propSize);
3057
3058             if (buf)
3059             {
3060                 if (CertGetCertificateContextProperty(pCertContext,
3061                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
3062                 {
3063                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
3064                      X509_ENHANCED_KEY_USAGE, buf, propSize,
3065                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
3066                 }
3067                 CryptMemFree(buf);
3068             }
3069         }
3070     }
3071     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
3072     {
3073         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
3074          pCertContext->pCertInfo->cExtension,
3075          pCertContext->pCertInfo->rgExtension);
3076
3077         if (ext)
3078         {
3079             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
3080              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
3081              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
3082         }
3083     }
3084     if (!usage)
3085     {
3086         /* If a particular location is specified, this should fail.  Otherwise
3087          * it should succeed with an empty usage.  (This is true on Win2k and
3088          * later, which we emulate.)
3089          */
3090         if (dwFlags)
3091         {
3092             SetLastError(CRYPT_E_NOT_FOUND);
3093             ret = FALSE;
3094         }
3095         else
3096             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
3097     }
3098
3099     if (ret)
3100     {
3101         if (!pUsage)
3102             *pcbUsage = bytesNeeded;
3103         else if (*pcbUsage < bytesNeeded)
3104         {
3105             SetLastError(ERROR_MORE_DATA);
3106             *pcbUsage = bytesNeeded;
3107             ret = FALSE;
3108         }
3109         else
3110         {
3111             *pcbUsage = bytesNeeded;
3112             if (usage)
3113             {
3114                 DWORD i;
3115                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
3116                  sizeof(CERT_ENHKEY_USAGE) +
3117                  usage->cUsageIdentifier * sizeof(LPSTR));
3118
3119                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
3120                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
3121                  sizeof(CERT_ENHKEY_USAGE));
3122                 for (i = 0; i < usage->cUsageIdentifier; i++)
3123                 {
3124                     pUsage->rgpszUsageIdentifier[i] = nextOID;
3125                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
3126                     nextOID += strlen(nextOID) + 1;
3127                 }
3128             }
3129             else
3130                 pUsage->cUsageIdentifier = 0;
3131         }
3132     }
3133     if (usage)
3134         LocalFree(usage);
3135     TRACE("returning %d\n", ret);
3136     return ret;
3137 }
3138
3139 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
3140  PCERT_ENHKEY_USAGE pUsage)
3141 {
3142     BOOL ret;
3143
3144     TRACE("(%p, %p)\n", pCertContext, pUsage);
3145
3146     if (pUsage)
3147     {
3148         CRYPT_DATA_BLOB blob = { 0, NULL };
3149
3150         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
3151          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
3152         if (ret)
3153         {
3154             ret = CertSetCertificateContextProperty(pCertContext,
3155              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
3156             LocalFree(blob.pbData);
3157         }
3158     }
3159     else
3160         ret = CertSetCertificateContextProperty(pCertContext,
3161          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
3162     return ret;
3163 }
3164
3165 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
3166  LPCSTR pszUsageIdentifier)
3167 {
3168     BOOL ret;
3169     DWORD size;
3170
3171     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
3172
3173     if (CertGetEnhancedKeyUsage(pCertContext,
3174      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
3175     {
3176         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
3177
3178         if (usage)
3179         {
3180             ret = CertGetEnhancedKeyUsage(pCertContext,
3181              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
3182             if (ret)
3183             {
3184                 DWORD i;
3185                 BOOL exists = FALSE;
3186
3187                 /* Make sure usage doesn't already exist */
3188                 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
3189                 {
3190                     if (!strcmp(usage->rgpszUsageIdentifier[i],
3191                      pszUsageIdentifier))
3192                         exists = TRUE;
3193                 }
3194                 if (!exists)
3195                 {
3196                     PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
3197                      sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
3198
3199                     if (newUsage)
3200                     {
3201                         LPSTR nextOID;
3202
3203                         newUsage->rgpszUsageIdentifier = (LPSTR *)
3204                          ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
3205                         nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
3206                           + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
3207                         for (i = 0; i < usage->cUsageIdentifier; i++)
3208                         {
3209                             newUsage->rgpszUsageIdentifier[i] = nextOID;
3210                             strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
3211                             nextOID += strlen(nextOID) + 1;
3212                         }
3213                         newUsage->rgpszUsageIdentifier[i] = nextOID;
3214                         strcpy(nextOID, pszUsageIdentifier);
3215                         newUsage->cUsageIdentifier = i + 1;
3216                         ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
3217                         CryptMemFree(newUsage);
3218                     }
3219                     else
3220                         ret = FALSE;
3221                 }
3222             }
3223             CryptMemFree(usage);
3224         }
3225         else
3226             ret = FALSE;
3227     }
3228     else
3229     {
3230         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
3231          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
3232
3233         if (usage)
3234         {
3235             usage->rgpszUsageIdentifier =
3236              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
3237             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
3238              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
3239             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
3240             usage->cUsageIdentifier = 1;
3241             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
3242             CryptMemFree(usage);
3243         }
3244         else
3245             ret = FALSE;
3246     }
3247     return ret;
3248 }
3249
3250 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
3251  LPCSTR pszUsageIdentifier)
3252 {
3253     BOOL ret;
3254     DWORD size;
3255     CERT_ENHKEY_USAGE usage;
3256
3257     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
3258
3259     size = sizeof(usage);
3260     ret = CertGetEnhancedKeyUsage(pCertContext,
3261      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
3262     if (!ret && GetLastError() == ERROR_MORE_DATA)
3263     {
3264         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
3265
3266         if (pUsage)
3267         {
3268             ret = CertGetEnhancedKeyUsage(pCertContext,
3269              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
3270             if (ret)
3271             {
3272                 if (pUsage->cUsageIdentifier)
3273                 {
3274                     DWORD i;
3275                     BOOL found = FALSE;
3276
3277                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
3278                     {
3279                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
3280                          pszUsageIdentifier))
3281                             found = TRUE;
3282                         if (found && i < pUsage->cUsageIdentifier - 1)
3283                             pUsage->rgpszUsageIdentifier[i] =
3284                              pUsage->rgpszUsageIdentifier[i + 1];
3285                     }
3286                     pUsage->cUsageIdentifier--;
3287                     /* Remove the usage if it's empty */
3288                     if (pUsage->cUsageIdentifier)
3289                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
3290                     else
3291                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
3292                 }
3293             }
3294             CryptMemFree(pUsage);
3295         }
3296         else
3297             ret = FALSE;
3298     }
3299     else
3300     {
3301         /* it fit in an empty usage, therefore there's nothing to remove */
3302         ret = TRUE;
3303     }
3304     return ret;
3305 }
3306
3307 struct BitField
3308 {
3309     DWORD  cIndexes;
3310     DWORD *indexes;
3311 };
3312
3313 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
3314
3315 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
3316 {
3317     DWORD indexIndex = bit / BITS_PER_DWORD;
3318
3319     if (indexIndex + 1 > field->cIndexes)
3320     {
3321         if (field->cIndexes)
3322             field->indexes = CryptMemRealloc(field->indexes,
3323              (indexIndex + 1) * sizeof(DWORD));
3324         else
3325             field->indexes = CryptMemAlloc(sizeof(DWORD));
3326         if (field->indexes)
3327         {
3328             field->indexes[indexIndex] = 0;
3329             field->cIndexes = indexIndex + 1;
3330         }
3331     }
3332     if (field->indexes)
3333         field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
3334 }
3335
3336 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
3337 {
3338     BOOL set;
3339     DWORD indexIndex = bit / BITS_PER_DWORD;
3340
3341     assert(field->cIndexes);
3342     set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
3343     return set;
3344 }
3345
3346 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
3347  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
3348 {
3349     BOOL ret = TRUE;
3350     DWORD i, cbOIDs = 0;
3351     BOOL allUsagesValid = TRUE;
3352     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
3353
3354     TRACE("(%ld, %p, %d, %p, %ld)\n", cCerts, rghCerts, *cNumOIDs,
3355      rghOIDs, *pcbOIDs);
3356
3357     for (i = 0; i < cCerts; i++)
3358     {
3359         CERT_ENHKEY_USAGE usage;
3360         DWORD size = sizeof(usage);
3361
3362         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
3363         /* Success is deliberately ignored: it implies all usages are valid */
3364         if (!ret && GetLastError() == ERROR_MORE_DATA)
3365         {
3366             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
3367
3368             allUsagesValid = FALSE;
3369             if (pUsage)
3370             {
3371                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
3372                 if (ret)
3373                 {
3374                     if (!validUsages.cUsageIdentifier)
3375                     {
3376                         DWORD j;
3377
3378                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
3379                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
3380                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
3381                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
3382                              + 1;
3383                         validUsages.rgpszUsageIdentifier =
3384                          CryptMemAlloc(cbOIDs);
3385                         if (validUsages.rgpszUsageIdentifier)
3386                         {
3387                             LPSTR nextOID = (LPSTR)
3388                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
3389                              validUsages.cUsageIdentifier * sizeof(LPSTR));
3390
3391                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
3392                             {
3393                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
3394                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
3395                                  pUsage->rgpszUsageIdentifier[j]);
3396                                 nextOID += lstrlenA(nextOID) + 1;
3397                             }
3398                         }
3399                     }
3400                     else
3401                     {
3402                         struct BitField validIndexes = { 0, NULL };
3403                         DWORD j, k, numRemoved = 0;
3404
3405                         /* Merge: build a bitmap of all the indexes of
3406                          * validUsages.rgpszUsageIdentifier that are in pUsage.
3407                          */
3408                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
3409                         {
3410                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
3411                             {
3412                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
3413                                  validUsages.rgpszUsageIdentifier[k]))
3414                                 {
3415                                     CRYPT_SetBitInField(&validIndexes, k);
3416                                     break;
3417                                 }
3418                             }
3419                         }
3420                         /* Merge by removing from validUsages those that are
3421                          * not in the bitmap.
3422                          */
3423                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
3424                         {
3425                             if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
3426                             {
3427                                 if (j < validUsages.cUsageIdentifier - 1)
3428                                 {
3429                                     memmove(&validUsages.rgpszUsageIdentifier[j],
3430                                      &validUsages.rgpszUsageIdentifier[j +
3431                                      numRemoved + 1],
3432                                      (validUsages.cUsageIdentifier - numRemoved
3433                                      - j - 1) * sizeof(LPSTR));
3434                                     cbOIDs -= lstrlenA(
3435                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
3436                                      sizeof(LPSTR);
3437                                     validUsages.cUsageIdentifier--;
3438                                     numRemoved++;
3439                                 }
3440                                 else
3441                                     validUsages.cUsageIdentifier--;
3442                             }
3443                         }
3444                         CryptMemFree(validIndexes.indexes);
3445                     }
3446                 }
3447                 CryptMemFree(pUsage);
3448             }
3449         }
3450     }
3451     ret = TRUE;
3452     if (allUsagesValid)
3453     {
3454         *cNumOIDs = -1;
3455         *pcbOIDs = 0;
3456     }
3457     else
3458     {
3459         *cNumOIDs = validUsages.cUsageIdentifier;
3460         if (!rghOIDs)
3461             *pcbOIDs = cbOIDs;
3462         else if (*pcbOIDs < cbOIDs)
3463         {
3464             *pcbOIDs = cbOIDs;
3465             SetLastError(ERROR_MORE_DATA);
3466             ret = FALSE;
3467         }
3468         else
3469         {
3470             LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
3471              validUsages.cUsageIdentifier * sizeof(LPSTR));
3472
3473             *pcbOIDs = cbOIDs;
3474             for (i = 0; i < validUsages.cUsageIdentifier; i++)
3475             {
3476                 rghOIDs[i] = nextOID;
3477                 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
3478                 nextOID += lstrlenA(nextOID) + 1;
3479             }
3480         }
3481     }
3482     CryptMemFree(validUsages.rgpszUsageIdentifier);
3483     TRACE("cNumOIDs: %d\n", *cNumOIDs);
3484     TRACE("returning %d\n", ret);
3485     return ret;
3486 }
3487
3488 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
3489  * pInfo is NULL, from the attributes of hProv.
3490  */
3491 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
3492  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
3493 {
3494     CRYPT_KEY_PROV_INFO info = { 0 };
3495     BOOL ret;
3496
3497     if (!pInfo)
3498     {
3499         DWORD size;
3500         int len;
3501
3502         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
3503         if (ret)
3504         {
3505             LPSTR szContainer = CryptMemAlloc(size);
3506
3507             if (szContainer)
3508             {
3509                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
3510                  (BYTE *)szContainer, &size, 0);
3511                 if (ret)
3512                 {
3513                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3514                      NULL, 0);
3515                     if (len)
3516                     {
3517                         info.pwszContainerName = CryptMemAlloc(len *
3518                          sizeof(WCHAR));
3519                         MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3520                          info.pwszContainerName, len);
3521                     }
3522                 }
3523                 CryptMemFree(szContainer);
3524             }
3525         }
3526         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
3527         if (ret)
3528         {
3529             LPSTR szProvider = CryptMemAlloc(size);
3530
3531             if (szProvider)
3532             {
3533                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
3534                  &size, 0);
3535                 if (ret)
3536                 {
3537                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3538                      NULL, 0);
3539                     if (len)
3540                     {
3541                         info.pwszProvName = CryptMemAlloc(len *
3542                          sizeof(WCHAR));
3543                         MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3544                          info.pwszProvName, len);
3545                     }
3546                 }
3547                 CryptMemFree(szProvider);
3548             }
3549         }
3550         /* in case no CRYPT_KEY_PROV_INFO given,
3551          *  we always use AT_SIGNATURE key spec
3552          */
3553         info.dwKeySpec = AT_SIGNATURE;
3554         size = sizeof(info.dwProvType);
3555         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
3556          &size, 0);
3557         if (!ret)
3558             info.dwProvType = PROV_RSA_FULL;
3559         pInfo = &info;
3560     }
3561
3562     CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
3563      0, pInfo);
3564
3565     if (pInfo == &info)
3566     {
3567         CryptMemFree(info.pwszContainerName);
3568         CryptMemFree(info.pwszProvName);
3569     }
3570 }
3571
3572 /* Creates a signed certificate context from the unsigned, encoded certificate
3573  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
3574  */
3575 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
3576  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
3577 {
3578     PCCERT_CONTEXT context = NULL;
3579     BOOL ret;
3580     DWORD sigSize = 0;
3581
3582     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3583      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
3584     if (ret)
3585     {
3586         LPBYTE sig = CryptMemAlloc(sigSize);
3587
3588         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3589          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
3590         if (ret)
3591         {
3592             CERT_SIGNED_CONTENT_INFO signedInfo;
3593             BYTE *encodedSignedCert = NULL;
3594             DWORD encodedSignedCertSize = 0;
3595
3596             signedInfo.ToBeSigned.cbData = blob->cbData;
3597             signedInfo.ToBeSigned.pbData = blob->pbData;
3598             signedInfo.SignatureAlgorithm = *sigAlgo;
3599             signedInfo.Signature.cbData = sigSize;
3600             signedInfo.Signature.pbData = sig;
3601             signedInfo.Signature.cUnusedBits = 0;
3602             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
3603              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
3604              &encodedSignedCert, &encodedSignedCertSize);
3605             if (ret)
3606             {
3607                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3608                  encodedSignedCert, encodedSignedCertSize);
3609                 LocalFree(encodedSignedCert);
3610             }
3611         }
3612         CryptMemFree(sig);
3613     }
3614     return context;
3615 }
3616
3617 /* Copies data from the parameters into info, where:
3618  * pSerialNumber: The serial number.  Must not be NULL.
3619  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3620  *                     Must not be NULL
3621  * pSignatureAlgorithm: Optional.
3622  * pStartTime: The starting time of the certificate.  If NULL, the current
3623  *             system time is used.
3624  * pEndTime: The ending time of the certificate.  If NULL, one year past the
3625  *           starting time is used.
3626  * pubKey: The public key of the certificate.  Must not be NULL.
3627  * pExtensions: Extensions to be included with the certificate.  Optional.
3628  */
3629 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3630  const CERT_NAME_BLOB *pSubjectIssuerBlob,
3631  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3632  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3633  const CERT_EXTENSIONS *pExtensions)
3634 {
3635     static CHAR oid[] = szOID_RSA_SHA1RSA;
3636
3637     assert(info);
3638     assert(pSerialNumber);
3639     assert(pSubjectIssuerBlob);
3640     assert(pubKey);
3641
3642     if (pExtensions && pExtensions->cExtension)
3643         info->dwVersion = CERT_V3;
3644     else
3645         info->dwVersion = CERT_V1;
3646     info->SerialNumber.cbData = pSerialNumber->cbData;
3647     info->SerialNumber.pbData = pSerialNumber->pbData;
3648     if (pSignatureAlgorithm)
3649         info->SignatureAlgorithm = *pSignatureAlgorithm;
3650     else
3651     {
3652         info->SignatureAlgorithm.pszObjId = oid;
3653         info->SignatureAlgorithm.Parameters.cbData = 0;
3654         info->SignatureAlgorithm.Parameters.pbData = NULL;
3655     }
3656     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3657     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3658     if (pStartTime)
3659         SystemTimeToFileTime(pStartTime, &info->NotBefore);
3660     else
3661         GetSystemTimeAsFileTime(&info->NotBefore);
3662     if (pEndTime)
3663         SystemTimeToFileTime(pEndTime, &info->NotAfter);
3664     else
3665     {
3666         SYSTEMTIME endTime;
3667
3668         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3669         {
3670             endTime.wYear++;
3671             SystemTimeToFileTime(&endTime, &info->NotAfter);
3672         }
3673     }
3674     info->Subject.cbData = pSubjectIssuerBlob->cbData;
3675     info->Subject.pbData = pSubjectIssuerBlob->pbData;
3676     info->SubjectPublicKeyInfo = *pubKey;
3677     if (pExtensions)
3678     {
3679         info->cExtension = pExtensions->cExtension;
3680         info->rgExtension = pExtensions->rgExtension;
3681     }
3682     else
3683     {
3684         info->cExtension = 0;
3685         info->rgExtension = NULL;
3686     }
3687 }
3688
3689 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3690 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3691 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3692
3693 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3694 {
3695     HCRYPTPROV hProv = 0;
3696     HMODULE rpcrt = LoadLibraryW(L"rpcrt4");
3697
3698     if (rpcrt)
3699     {
3700         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3701          "UuidCreate");
3702         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3703          "UuidToStringA");
3704         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3705          rpcrt, "RpcStringFreeA");
3706
3707         if (uuidCreate && uuidToString && rpcStringFree)
3708         {
3709             UUID uuid;
3710             RPC_STATUS status = uuidCreate(&uuid);
3711
3712             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3713             {
3714                 unsigned char *uuidStr;
3715
3716                 status = uuidToString(&uuid, &uuidStr);
3717                 if (status == RPC_S_OK)
3718                 {
3719                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3720                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3721
3722                     if (ret)
3723                     {
3724                         HCRYPTKEY key;
3725
3726                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3727                         if (ret)
3728                             CryptDestroyKey(key);
3729                     }
3730                     rpcStringFree(&uuidStr);
3731                 }
3732             }
3733         }
3734         FreeLibrary(rpcrt);
3735     }
3736     return hProv;
3737 }
3738
3739 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3740  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3741  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3742  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3743  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3744 {
3745     PCCERT_CONTEXT context = NULL;
3746     BOOL ret, releaseContext = FALSE;
3747     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3748     DWORD pubKeySize = 0, dwKeySpec;
3749
3750     TRACE("(%08Ix, %p, %08lx, %p, %p, %p, %p, %p)\n", hProv,
3751      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3752      pExtensions, pExtensions);
3753
3754     if(!pSubjectIssuerBlob)
3755     {
3756         SetLastError(ERROR_INVALID_PARAMETER);
3757         return NULL;
3758     }
3759
3760     dwKeySpec = pKeyProvInfo ? pKeyProvInfo->dwKeySpec : AT_SIGNATURE;
3761     if (!hProv)
3762     {
3763         if (!pKeyProvInfo)
3764         {
3765             hProv = CRYPT_CreateKeyProv();
3766             releaseContext = TRUE;
3767         }
3768         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3769         {
3770             SetLastError(NTE_BAD_FLAGS);
3771             return NULL;
3772         }
3773         else
3774         {
3775             HCRYPTKEY hKey = 0;
3776             /* acquire the context using the given information*/
3777             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3778                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3779                     pKeyProvInfo->dwFlags);
3780             if (!ret)
3781             {
3782                 if(GetLastError() != NTE_BAD_KEYSET)
3783                     return NULL;
3784                 /* create the key set */
3785                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3786                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3787                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3788                 if (!ret)
3789                     return NULL;
3790             }
3791             /* check if the key is here */
3792             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3793             if(!ret)
3794             {
3795                 if (NTE_NO_KEY == GetLastError())
3796                 { /* generate the key */
3797                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3798                 }
3799                 if (!ret)
3800                 {
3801                     CryptReleaseContext(hProv,0);
3802                     SetLastError(NTE_BAD_KEYSET);
3803                     return NULL;
3804                 }
3805             }
3806             CryptDestroyKey(hKey);
3807             releaseContext = TRUE;
3808         }
3809     }
3810
3811     ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3812      &pubKeySize);
3813     if (!ret)
3814         goto end;
3815     pubKey = CryptMemAlloc(pubKeySize);
3816     if (pubKey)
3817     {
3818         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3819          pubKey, &pubKeySize);
3820         if (ret)
3821         {
3822             CERT_INFO info = { 0 };
3823             CRYPT_DER_BLOB blob = { 0, NULL };
3824             BYTE serial[16];
3825             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3826
3827             CryptGenRandom(hProv, sizeof(serial), serial);
3828             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3829              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3830             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3831              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3832              &blob.cbData);
3833             if (ret)
3834             {
3835                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3836                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3837                      &info.SignatureAlgorithm);
3838                 else
3839                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
3840                      blob.pbData, blob.cbData);
3841                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3842                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3843                 LocalFree(blob.pbData);
3844             }
3845         }
3846         CryptMemFree(pubKey);
3847     }
3848 end:
3849     if (releaseContext)
3850         CryptReleaseContext(hProv, 0);
3851     return context;
3852 }
3853
3854 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3855                                void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3856                                PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3857                                PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3858 {
3859     FIXME("(0x%lx, %ld, %p, %p, 0x%lx, %p, %p): stub\n", dwEncodingType,
3860           dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3861           pVerifyUsageStatus);
3862     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3863     return FALSE;
3864 }
3865
3866 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3867                                       const BYTE *pbEncoded, DWORD cbEncoded,
3868                                       DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3869 {
3870     TRACE("(0x%lx, 0x%lx, %p, %ld, 0x%08lx, %p)\n", dwContextType, dwEncodingType,
3871           pbEncoded, cbEncoded, dwFlags, pCreatePara);
3872
3873     if (dwFlags)
3874     {
3875         FIXME("dwFlags 0x%08lx not handled\n", dwFlags);
3876         return NULL;
3877     }
3878     if (pCreatePara)
3879     {
3880         FIXME("pCreatePara not handled\n");
3881         return NULL;
3882     }
3883
3884     switch (dwContextType)
3885     {
3886     case CERT_STORE_CERTIFICATE_CONTEXT:
3887         return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3888     case CERT_STORE_CRL_CONTEXT:
3889         return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3890     case CERT_STORE_CTL_CONTEXT:
3891         return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3892     default:
3893         WARN("unknown context type: 0x%lx\n", dwContextType);
3894         return NULL;
3895     }
3896 }
3897
3898 BOOL WINAPI CryptSetKeyIdentifierProperty(const CRYPT_HASH_BLOB *pKeyIdentifier, DWORD dwPropId,
3899     DWORD dwFlags, LPCWSTR pwszComputerName, void *pvReserved, const void *pvData)
3900 {
3901     FIXME("(%p, 0x%lx, 0x%lx, %s, %p, %p): stub\n", pKeyIdentifier, dwPropId, dwFlags,
3902         debugstr_w(pwszComputerName), pvReserved, pvData);
3903     return FALSE;
3904 }