dlls/cryptnet/cryptnet_main.c

   1 /*
   2  * Copyright (C) 2006 Maarten Lankhorst
   3  * Copyright 2007 Juan Lang
   4  *
   5  * This library is free software; you can redistribute it and/or
   6  * modify it under the terms of the GNU Lesser General Public
   7  * License as published by the Free Software Foundation; either
   8  * version 2.1 of the License, or (at your option) any later version.
   9  *
  10  * This library is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13  * Lesser General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU Lesser General Public
  16  * License along with this library; if not, write to the Free Software
  17  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  18  *
  19  */
  20
  21 #include "config.h"
  22 #include "wine/port.h"
  23
  24 #define NONAMELESSUNION
  25 #define NONAMELESSSTRUCT
  26 #define CERT_REVOCATION_PARA_HAS_EXTRA_FIELDS
  27
  28 #include <stdio.h>
  29 #include <stdarg.h>
  30
  31 #include "windef.h"
  32 #include "winbase.h"
  33 #include "winnt.h"
  34 #include "winnls.h"
  35 #include "wininet.h"
  36 #include "objbase.h"
  37 #include "wincrypt.h"
  38
  39 #include "wine/debug.h"
  40
  41 WINE_DEFAULT_DEBUG_CHANNEL(cryptnet);
  42
  43 #define IS_INTOID(x)    (((ULONG_PTR)(x) >> 16) == 0)
  44
  45 static const WCHAR cryptNet[] = { 'c','r','y','p','t','n','e','t','.',
  46    'd','l','l',0 };
  47
  48 /***********************************************************************
  49  *    DllRegisterServer (CRYPTNET.@)
  50  */
  51 HRESULT WINAPI DllRegisterServer(void)
  52 {
  53    TRACE("\n");
  54    CryptRegisterDefaultOIDFunction(X509_ASN_ENCODING,
  55     CRYPT_OID_VERIFY_REVOCATION_FUNC, 0, cryptNet);
  56    CryptRegisterOIDFunction(0, CRYPT_OID_OPEN_STORE_PROV_FUNC, "Ldap",
  57     cryptNet, "LdapProvOpenStore");
  58    CryptRegisterOIDFunction(0, CRYPT_OID_OPEN_STORE_PROV_FUNC,
  59     CERT_STORE_PROV_LDAP_W, cryptNet, "LdapProvOpenStore");
  60    return S_OK;
  61 }
  62
  63 /***********************************************************************
  64  *    DllUnregisterServer (CRYPTNET.@)
  65  */
  66 HRESULT WINAPI DllUnregisterServer(void)
  67 {
  68    TRACE("\n");
  69    CryptUnregisterDefaultOIDFunction(X509_ASN_ENCODING,
  70     CRYPT_OID_VERIFY_REVOCATION_FUNC, cryptNet);
  71    CryptUnregisterOIDFunction(0, CRYPT_OID_OPEN_STORE_PROV_FUNC, "Ldap");
  72    CryptUnregisterOIDFunction(0, CRYPT_OID_OPEN_STORE_PROV_FUNC,
  73     CERT_STORE_PROV_LDAP_W);
  74    return S_OK;
  75 }
  76
  77 static const char *url_oid_to_str(LPCSTR oid)
  78 {
  79     if (IS_INTOID(oid))
  80     {
  81         static char buf[10];
  82
  83         switch (LOWORD(oid))
  84         {
  85 #define _x(oid) case LOWORD(oid): return #oid
  86         _x(URL_OID_CERTIFICATE_ISSUER);
  87         _x(URL_OID_CERTIFICATE_CRL_DIST_POINT);
  88         _x(URL_OID_CTL_ISSUER);
  89         _x(URL_OID_CTL_NEXT_UPDATE);
  90         _x(URL_OID_CRL_ISSUER);
  91         _x(URL_OID_CERTIFICATE_FRESHEST_CRL);
  92         _x(URL_OID_CRL_FRESHEST_CRL);
  93         _x(URL_OID_CROSS_CERT_DIST_POINT);
  94 #undef _x
  95         default:
  96             snprintf(buf, sizeof(buf), "%d", LOWORD(oid));
  97             return buf;
  98         }
  99     }
 100     else
 101         return oid;
 102 }
 103
 104 typedef BOOL (WINAPI *UrlDllGetObjectUrlFunc)(LPCSTR, LPVOID, DWORD,
 105  PCRYPT_URL_ARRAY, DWORD *, PCRYPT_URL_INFO, DWORD *, LPVOID);
 106
 107 static BOOL WINAPI CRYPT_GetUrlFromCertificateIssuer(LPCSTR pszUrlOid,
 108  LPVOID pvPara, DWORD dwFlags, PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray,
 109  PCRYPT_URL_INFO pUrlInfo, DWORD *pcbUrlInfo, LPVOID pvReserved)
 110 {
 111     PCCERT_CONTEXT cert = pvPara;
 112     PCERT_EXTENSION ext;
 113     BOOL ret = FALSE;
 114
 115     /* The only applicable flag is CRYPT_GET_URL_FROM_EXTENSION */
 116     if (dwFlags && !(dwFlags & CRYPT_GET_URL_FROM_EXTENSION))
 117     {
 118         SetLastError(CRYPT_E_NOT_FOUND);
 119         return FALSE;
 120     }
 121     if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS,
 122      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
 123     {
 124         CERT_AUTHORITY_INFO_ACCESS *aia;
 125         DWORD size;
 126
 127         ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_AUTHORITY_INFO_ACCESS,
 128          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL,
 129          &aia, &size);
 130         if (ret)
 131         {
 132             DWORD i, cUrl, bytesNeeded = sizeof(CRYPT_URL_ARRAY);
 133
 134             for (i = 0, cUrl = 0; i < aia->cAccDescr; i++)
 135                 if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
 136                  szOID_PKIX_CA_ISSUERS))
 137                 {
 138                     if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice ==
 139                      CERT_ALT_NAME_URL)
 140                     {
 141                         if (aia->rgAccDescr[i].AccessLocation.u.pwszURL)
 142                         {
 143                             cUrl++;
 144                             bytesNeeded += sizeof(LPWSTR) +
 145                              (lstrlenW(aia->rgAccDescr[i].AccessLocation.u.
 146                              pwszURL) + 1) * sizeof(WCHAR);
 147                         }
 148                     }
 149                     else
 150                         FIXME("unsupported alt name type %d\n",
 151                          aia->rgAccDescr[i].AccessLocation.dwAltNameChoice);
 152                 }
 153             if (!pcbUrlArray)
 154             {
 155                 SetLastError(E_INVALIDARG);
 156                 ret = FALSE;
 157             }
 158             else if (!pUrlArray)
 159                 *pcbUrlArray = bytesNeeded;
 160             else if (*pcbUrlArray < bytesNeeded)
 161             {
 162                 SetLastError(ERROR_MORE_DATA);
 163                 *pcbUrlArray = bytesNeeded;
 164                 ret = FALSE;
 165             }
 166             else
 167             {
 168                 LPWSTR nextUrl;
 169
 170                 *pcbUrlArray = bytesNeeded;
 171                 pUrlArray->cUrl = 0;
 172                 pUrlArray->rgwszUrl =
 173                  (LPWSTR *)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY));
 174                 nextUrl = (LPWSTR)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY)
 175                  + cUrl * sizeof(LPWSTR));
 176                 for (i = 0; i < aia->cAccDescr; i++)
 177                     if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
 178                      szOID_PKIX_CA_ISSUERS))
 179                     {
 180                         if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice
 181                          == CERT_ALT_NAME_URL)
 182                         {
 183                             if (aia->rgAccDescr[i].AccessLocation.u.pwszURL)
 184                             {
 185                                 lstrcpyW(nextUrl,
 186                                  aia->rgAccDescr[i].AccessLocation.u.pwszURL);
 187                                 pUrlArray->rgwszUrl[pUrlArray->cUrl++] =
 188                                  nextUrl;
 189                                 nextUrl += (lstrlenW(nextUrl) + 1);
 190                             }
 191                         }
 192                     }
 193             }
 194             if (ret)
 195             {
 196                 if (pcbUrlInfo)
 197                 {
 198                     FIXME("url info: stub\n");
 199                     if (!pUrlInfo)
 200                         *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
 201                     else if (*pcbUrlInfo < sizeof(CRYPT_URL_INFO))
 202                     {
 203                         *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
 204                         SetLastError(ERROR_MORE_DATA);
 205                         ret = FALSE;
 206                     }
 207                     else
 208                     {
 209                         *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
 210                         memset(pUrlInfo, 0, sizeof(CRYPT_URL_INFO));
 211                     }
 212                 }
 213             }
 214             LocalFree(aia);
 215         }
 216     }
 217     else
 218         SetLastError(CRYPT_E_NOT_FOUND);
 219     return ret;
 220 }
 221
 222 static BOOL CRYPT_GetUrlFromCRLDistPointsExt(const CRYPT_DATA_BLOB *value,
 223  PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray, PCRYPT_URL_INFO pUrlInfo,
 224  DWORD *pcbUrlInfo)
 225 {
 226     BOOL ret;
 227     CRL_DIST_POINTS_INFO *info;
 228     DWORD size;
 229
 230     ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_CRL_DIST_POINTS,
 231      value->pbData, value->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
 232     if (ret)
 233     {
 234         DWORD i, cUrl, bytesNeeded = sizeof(CRYPT_URL_ARRAY);
 235
 236         for (i = 0, cUrl = 0; i < info->cDistPoint; i++)
 237             if (info->rgDistPoint[i].DistPointName.dwDistPointNameChoice
 238              == CRL_DIST_POINT_FULL_NAME)
 239             {
 240                 DWORD j;
 241                 CERT_ALT_NAME_INFO *name =
 242                  &info->rgDistPoint[i].DistPointName.u.FullName;
 243
 244                 for (j = 0; j < name->cAltEntry; j++)
 245                     if (name->rgAltEntry[j].dwAltNameChoice ==
 246                      CERT_ALT_NAME_URL)
 247                     {
 248                         if (name->rgAltEntry[j].u.pwszURL)
 249                         {
 250                             cUrl++;
 251                             bytesNeeded += sizeof(LPWSTR) +
 252                              (lstrlenW(name->rgAltEntry[j].u.pwszURL) + 1)
 253                              * sizeof(WCHAR);
 254                         }
 255                     }
 256             }
 257         if (!pcbUrlArray)
 258         {
 259             SetLastError(E_INVALIDARG);
 260             ret = FALSE;
 261         }
 262         else if (!pUrlArray)
 263             *pcbUrlArray = bytesNeeded;
 264         else if (*pcbUrlArray < bytesNeeded)
 265         {
 266             SetLastError(ERROR_MORE_DATA);
 267             *pcbUrlArray = bytesNeeded;
 268             ret = FALSE;
 269         }
 270         else
 271         {
 272             LPWSTR nextUrl;
 273
 274             *pcbUrlArray = bytesNeeded;
 275             pUrlArray->cUrl = 0;
 276             pUrlArray->rgwszUrl =
 277              (LPWSTR *)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY));
 278             nextUrl = (LPWSTR)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY)
 279              + cUrl * sizeof(LPWSTR));
 280             for (i = 0; i < info->cDistPoint; i++)
 281                 if (info->rgDistPoint[i].DistPointName.dwDistPointNameChoice
 282                  == CRL_DIST_POINT_FULL_NAME)
 283                 {
 284                     DWORD j;
 285                     CERT_ALT_NAME_INFO *name =
 286                      &info->rgDistPoint[i].DistPointName.u.FullName;
 287
 288                     for (j = 0; j < name->cAltEntry; j++)
 289                         if (name->rgAltEntry[j].dwAltNameChoice ==
 290                          CERT_ALT_NAME_URL)
 291                         {
 292                             if (name->rgAltEntry[j].u.pwszURL)
 293                             {
 294                                 lstrcpyW(nextUrl,
 295                                  name->rgAltEntry[j].u.pwszURL);
 296                                 pUrlArray->rgwszUrl[pUrlArray->cUrl++] =
 297                                  nextUrl;
 298                                 nextUrl +=
 299                                  (lstrlenW(name->rgAltEntry[j].u.pwszURL) + 1);
 300                             }
 301                         }
 302                 }
 303         }
 304         if (ret)
 305         {
 306             if (pcbUrlInfo)
 307             {
 308                 FIXME("url info: stub\n");
 309                 if (!pUrlInfo)
 310                     *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
 311                 else if (*pcbUrlInfo < sizeof(CRYPT_URL_INFO))
 312                 {
 313                     *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
 314                     SetLastError(ERROR_MORE_DATA);
 315                     ret = FALSE;
 316                 }
 317                 else
 318                 {
 319                     *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
 320                     memset(pUrlInfo, 0, sizeof(CRYPT_URL_INFO));
 321                 }
 322             }
 323         }
 324         LocalFree(info);
 325     }
 326     return ret;
 327 }
 328
 329 static BOOL WINAPI CRYPT_GetUrlFromCertificateCRLDistPoint(LPCSTR pszUrlOid,
 330  LPVOID pvPara, DWORD dwFlags, PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray,
 331  PCRYPT_URL_INFO pUrlInfo, DWORD *pcbUrlInfo, LPVOID pvReserved)
 332 {
 333     PCCERT_CONTEXT cert = pvPara;
 334     PCERT_EXTENSION ext;
 335     BOOL ret = FALSE;
 336
 337     /* The only applicable flag is CRYPT_GET_URL_FROM_EXTENSION */
 338     if (dwFlags && !(dwFlags & CRYPT_GET_URL_FROM_EXTENSION))
 339     {
 340         SetLastError(CRYPT_E_NOT_FOUND);
 341         return FALSE;
 342     }
 343     if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
 344      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
 345         ret = CRYPT_GetUrlFromCRLDistPointsExt(&ext->Value, pUrlArray,
 346          pcbUrlArray, pUrlInfo, pcbUrlInfo);
 347     else
 348         SetLastError(CRYPT_E_NOT_FOUND);
 349     return ret;
 350 }
 351
 352 /***********************************************************************
 353  *    CryptGetObjectUrl (CRYPTNET.@)
 354  */
 355 BOOL WINAPI CryptGetObjectUrl(LPCSTR pszUrlOid, LPVOID pvPara, DWORD dwFlags,
 356  PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray, PCRYPT_URL_INFO pUrlInfo,
 357  DWORD *pcbUrlInfo, LPVOID pvReserved)
 358 {
 359     UrlDllGetObjectUrlFunc func = NULL;
 360     HCRYPTOIDFUNCADDR hFunc = NULL;
 361     BOOL ret = FALSE;
 362
 363     TRACE("(%s, %p, %08x, %p, %p, %p, %p, %p)\n", debugstr_a(pszUrlOid),
 364      pvPara, dwFlags, pUrlArray, pcbUrlArray, pUrlInfo, pcbUrlInfo, pvReserved);
 365
 366     if (IS_INTOID(pszUrlOid))
 367     {
 368         switch (LOWORD(pszUrlOid))
 369         {
 370         case LOWORD(URL_OID_CERTIFICATE_ISSUER):
 371             func = CRYPT_GetUrlFromCertificateIssuer;
 372             break;
 373         case LOWORD(URL_OID_CERTIFICATE_CRL_DIST_POINT):
 374             func = CRYPT_GetUrlFromCertificateCRLDistPoint;
 375             break;
 376         default:
 377             FIXME("unimplemented for %s\n", url_oid_to_str(pszUrlOid));
 378             SetLastError(ERROR_FILE_NOT_FOUND);
 379         }
 380     }
 381     else
 382     {
 383         static HCRYPTOIDFUNCSET set = NULL;
 384
 385         if (!set)
 386             set = CryptInitOIDFunctionSet(URL_OID_GET_OBJECT_URL_FUNC, 0);
 387         CryptGetOIDFunctionAddress(set, X509_ASN_ENCODING, pszUrlOid, 0,
 388          (void **)&func, &hFunc);
 389     }
 390     if (func)
 391         ret = func(pszUrlOid, pvPara, dwFlags, pUrlArray, pcbUrlArray,
 392          pUrlInfo, pcbUrlInfo, pvReserved);
 393     if (hFunc)
 394         CryptFreeOIDFunctionAddress(hFunc, 0);
 395     return ret;
 396 }
 397
 398 /***********************************************************************
 399  *    CryptRetrieveObjectByUrlA (CRYPTNET.@)
 400  */
 401 BOOL WINAPI CryptRetrieveObjectByUrlA(LPCSTR pszURL, LPCSTR pszObjectOid,
 402  DWORD dwRetrievalFlags, DWORD dwTimeout, LPVOID *ppvObject,
 403  HCRYPTASYNC hAsyncRetrieve, PCRYPT_CREDENTIALS pCredentials, LPVOID pvVerify,
 404  PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
 405 {
 406     BOOL ret = FALSE;
 407     int len;
 408
 409     TRACE("(%s, %s, %08x, %d, %p, %p, %p, %p, %p)\n", debugstr_a(pszURL),
 410      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, ppvObject,
 411      hAsyncRetrieve, pCredentials, pvVerify, pAuxInfo);
 412
 413     if (!pszURL)
 414     {
 415         SetLastError(ERROR_INVALID_PARAMETER);
 416         return FALSE;
 417     }
 418     len = MultiByteToWideChar(CP_ACP, 0, pszURL, -1, NULL, 0);
 419     if (len)
 420     {
 421         LPWSTR url = CryptMemAlloc(len * sizeof(WCHAR));
 422
 423         if (url)
 424         {
 425             MultiByteToWideChar(CP_ACP, 0, pszURL, -1, url, len);
 426             ret = CryptRetrieveObjectByUrlW(url, pszObjectOid,
 427              dwRetrievalFlags, dwTimeout, ppvObject, hAsyncRetrieve,
 428              pCredentials, pvVerify, pAuxInfo);
 429             CryptMemFree(url);
 430         }
 431         else
 432             SetLastError(ERROR_OUTOFMEMORY);
 433     }
 434     return ret;
 435 }
 436
 437 static void WINAPI CRYPT_FreeBlob(LPCSTR pszObjectOid,
 438  PCRYPT_BLOB_ARRAY pObject, void *pvFreeContext)
 439 {
 440     DWORD i;
 441
 442     for (i = 0; i < pObject->cBlob; i++)
 443         CryptMemFree(pObject->rgBlob[i].pbData);
 444     CryptMemFree(pObject->rgBlob);
 445 }
 446
 447 static BOOL CRYPT_GetObjectFromFile(HANDLE hFile, PCRYPT_BLOB_ARRAY pObject)
 448 {
 449     BOOL ret;
 450     LARGE_INTEGER size;
 451
 452     if ((ret = GetFileSizeEx(hFile, &size)))
 453     {
 454         if (size.u.HighPart)
 455         {
 456             WARN("file too big\n");
 457             SetLastError(ERROR_INVALID_DATA);
 458             ret = FALSE;
 459         }
 460         else
 461         {
 462             CRYPT_DATA_BLOB blob;
 463
 464             blob.pbData = CryptMemAlloc(size.u.LowPart);
 465             if (blob.pbData)
 466             {
 467                 ret = ReadFile(hFile, blob.pbData, size.u.LowPart, &blob.cbData,
 468                  NULL);
 469                 if (ret)
 470                 {
 471                     pObject->rgBlob = CryptMemAlloc(sizeof(CRYPT_DATA_BLOB));
 472                     if (pObject->rgBlob)
 473                     {
 474                         pObject->cBlob = 1;
 475                         memcpy(pObject->rgBlob, &blob, sizeof(CRYPT_DATA_BLOB));
 476                     }
 477                     else
 478                     {
 479                         SetLastError(ERROR_OUTOFMEMORY);
 480                         ret = FALSE;
 481                     }
 482                 }
 483                 if (!ret)
 484                     CryptMemFree(blob.pbData);
 485             }
 486             else
 487             {
 488                 SetLastError(ERROR_OUTOFMEMORY);
 489                 ret = FALSE;
 490             }
 491         }
 492     }
 493     return ret;
 494 }
 495
 496 static BOOL CRYPT_GetObjectFromCache(LPCWSTR pszURL, PCRYPT_BLOB_ARRAY pObject,
 497  PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
 498 {
 499     BOOL ret = FALSE;
 500     INTERNET_CACHE_ENTRY_INFOW *pCacheInfo = NULL;
 501     DWORD size = 0;
 502
 503     TRACE("(%s, %p, %p)\n", debugstr_w(pszURL), pObject, pAuxInfo);
 504
 505     RetrieveUrlCacheEntryFileW(pszURL, NULL, &size, 0);
 506     if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
 507         return FALSE;
 508
 509     pCacheInfo = CryptMemAlloc(size);
 510     if (!pCacheInfo)
 511     {
 512         SetLastError(ERROR_OUTOFMEMORY);
 513         return FALSE;
 514     }
 515
 516     if ((ret = RetrieveUrlCacheEntryFileW(pszURL, pCacheInfo, &size, 0)))
 517     {
 518         FILETIME ft;
 519
 520         GetSystemTimeAsFileTime(&ft);
 521         if (CompareFileTime(&pCacheInfo->ExpireTime, &ft) >= 0)
 522         {
 523             HANDLE hFile = CreateFileW(pCacheInfo->lpszLocalFileName, GENERIC_READ,
 524              FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 525
 526             if (hFile != INVALID_HANDLE_VALUE)
 527             {
 528                 if ((ret = CRYPT_GetObjectFromFile(hFile, pObject)))
 529                 {
 530                     if (pAuxInfo && pAuxInfo->cbSize >=
 531                      offsetof(CRYPT_RETRIEVE_AUX_INFO,
 532                      pLastSyncTime) + sizeof(PFILETIME) &&
 533                      pAuxInfo->pLastSyncTime)
 534                         memcpy(pAuxInfo->pLastSyncTime,
 535                          &pCacheInfo->LastSyncTime,
 536                          sizeof(FILETIME));
 537                 }
 538                 CloseHandle(hFile);
 539             }
 540             else
 541             {
 542                 DeleteUrlCacheEntryW(pszURL);
 543                 ret = FALSE;
 544             }
 545         }
 546         else
 547         {
 548             DeleteUrlCacheEntryW(pszURL);
 549             ret = FALSE;
 550         }
 551         UnlockUrlCacheEntryFileW(pszURL, 0);
 552     }
 553     CryptMemFree(pCacheInfo);
 554     TRACE("returning %d\n", ret);
 555     return ret;
 556 }
 557
 558 /* Parses the URL, and sets components' lpszHostName and lpszUrlPath members
 559  * to NULL-terminated copies of those portions of the URL (to be freed with
 560  * CryptMemFree.)
 561  */
 562 static BOOL CRYPT_CrackUrl(LPCWSTR pszURL, URL_COMPONENTSW *components)
 563 {
 564     BOOL ret;
 565
 566     TRACE("(%s, %p)\n", debugstr_w(pszURL), components);
 567
 568     memset(components, 0, sizeof(*components));
 569     components->dwStructSize = sizeof(*components);
 570     components->lpszHostName = CryptMemAlloc(INTERNET_MAX_HOST_NAME_LENGTH * sizeof(WCHAR));
 571     components->dwHostNameLength = INTERNET_MAX_HOST_NAME_LENGTH;
 572     if (!components->lpszHostName)
 573     {
 574         SetLastError(ERROR_OUTOFMEMORY);
 575         return FALSE;
 576     }
 577     components->lpszUrlPath = CryptMemAlloc(INTERNET_MAX_PATH_LENGTH * sizeof(WCHAR));
 578     components->dwUrlPathLength = INTERNET_MAX_PATH_LENGTH;
 579     if (!components->lpszUrlPath)
 580     {
 581         CryptMemFree(components->lpszHostName);
 582         SetLastError(ERROR_OUTOFMEMORY);
 583         return FALSE;
 584     }
 585
 586     ret = InternetCrackUrlW(pszURL, 0, ICU_DECODE, components);
 587     if (ret)
 588     {
 589         switch (components->nScheme)
 590         {
 591         case INTERNET_SCHEME_FTP:
 592             if (!components->nPort)
 593                 components->nPort = INTERNET_DEFAULT_FTP_PORT;
 594             break;
 595         case INTERNET_SCHEME_HTTP:
 596             if (!components->nPort)
 597                 components->nPort = INTERNET_DEFAULT_HTTP_PORT;
 598             break;
 599         default:
 600             ; /* do nothing */
 601         }
 602     }
 603     TRACE("returning %d\n", ret);
 604     return ret;
 605 }
 606
 607 struct InetContext
 608 {
 609     HANDLE event;
 610     DWORD  timeout;
 611     DWORD  error;
 612 };
 613
 614 static struct InetContext *CRYPT_MakeInetContext(DWORD dwTimeout)
 615 {
 616     struct InetContext *context = CryptMemAlloc(sizeof(struct InetContext));
 617
 618     if (context)
 619     {
 620         context->event = CreateEventW(NULL, FALSE, FALSE, NULL);
 621         if (!context->event)
 622         {
 623             CryptMemFree(context);
 624             context = NULL;
 625         }
 626         else
 627         {
 628             context->timeout = dwTimeout;
 629             context->error = ERROR_SUCCESS;
 630         }
 631     }
 632     return context;
 633 }
 634
 635 static BOOL CRYPT_DownloadObject(DWORD dwRetrievalFlags, HINTERNET hHttp,
 636  struct InetContext *context, PCRYPT_BLOB_ARRAY pObject,
 637  PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
 638 {
 639     CRYPT_DATA_BLOB object = { 0, NULL };
 640     DWORD bytesAvailable;
 641     BOOL ret;
 642
 643     do {
 644         if ((ret = InternetQueryDataAvailable(hHttp, &bytesAvailable, 0, 0)))
 645         {
 646             if (bytesAvailable)
 647             {
 648                 if (object.pbData)
 649                     object.pbData = CryptMemRealloc(object.pbData,
 650                      object.cbData + bytesAvailable);
 651                 else
 652                     object.pbData = CryptMemAlloc(bytesAvailable);
 653                 if (object.pbData)
 654                 {
 655                     INTERNET_BUFFERSA buffer = { sizeof(buffer), 0 };
 656
 657                     buffer.dwBufferLength = bytesAvailable;
 658                     buffer.lpvBuffer = object.pbData + object.cbData;
 659                     if (!(ret = InternetReadFileExA(hHttp, &buffer, IRF_NO_WAIT,
 660                      (DWORD_PTR)context)))
 661                     {
 662                         if (GetLastError() == ERROR_IO_PENDING)
 663                         {
 664                             if (WaitForSingleObject(context->event,
 665                              context->timeout) == WAIT_TIMEOUT)
 666                                 SetLastError(ERROR_TIMEOUT);
 667                             else if (context->error)
 668                                 SetLastError(context->error);
 669                             else
 670                                 ret = TRUE;
 671                         }
 672                     }
 673                     if (ret)
 674                         object.cbData += buffer.dwBufferLength;
 675                 }
 676                 else
 677                 {
 678                     SetLastError(ERROR_OUTOFMEMORY);
 679                     ret = FALSE;
 680                 }
 681             }
 682         }
 683         else if (GetLastError() == ERROR_IO_PENDING)
 684         {
 685             if (WaitForSingleObject(context->event, context->timeout) ==
 686              WAIT_TIMEOUT)
 687                 SetLastError(ERROR_TIMEOUT);
 688             else
 689                 ret = TRUE;
 690         }
 691     } while (ret && bytesAvailable);
 692     if (ret)
 693     {
 694         pObject->rgBlob = CryptMemAlloc(sizeof(CRYPT_DATA_BLOB));
 695         if (!pObject->rgBlob)
 696         {
 697             CryptMemFree(object.pbData);
 698             SetLastError(ERROR_OUTOFMEMORY);
 699             ret = FALSE;
 700         }
 701         else
 702         {
 703             pObject->rgBlob[0].cbData = object.cbData;
 704             pObject->rgBlob[0].pbData = object.pbData;
 705             pObject->cBlob = 1;
 706         }
 707     }
 708     TRACE("returning %d\n", ret);
 709     return ret;
 710 }
 711
 712 /* Finds the object specified by pszURL in the cache.  If it's not found,
 713  * creates a new cache entry for the object and writes the object to it.
 714  * Sets the expiration time of the cache entry to expires.
 715  */
 716 static void CRYPT_CacheURL(LPCWSTR pszURL, const CRYPT_BLOB_ARRAY *pObject,
 717  DWORD dwRetrievalFlags, FILETIME expires)
 718 {
 719     WCHAR cacheFileName[MAX_PATH];
 720     HANDLE hCacheFile;
 721     DWORD size = 0, entryType;
 722     FILETIME ft;
 723
 724     GetUrlCacheEntryInfoW(pszURL, NULL, &size);
 725     if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
 726     {
 727         INTERNET_CACHE_ENTRY_INFOW *info = CryptMemAlloc(size);
 728
 729         if (!info)
 730         {
 731             ERR("out of memory\n");
 732             return;
 733         }
 734
 735         if (GetUrlCacheEntryInfoW(pszURL, info, &size))
 736         {
 737             lstrcpyW(cacheFileName, info->lpszLocalFileName);
 738             /* Check if the existing cache entry is up to date.  If it isn't,
 739              * remove the existing cache entry, and create a new one with the
 740              * new value.
 741              */
 742             GetSystemTimeAsFileTime(&ft);
 743             if (CompareFileTime(&info->ExpireTime, &ft) < 0)
 744             {
 745                 DeleteUrlCacheEntryW(pszURL);
 746             }
 747             else
 748             {
 749                 info->ExpireTime = expires;
 750                 SetUrlCacheEntryInfoW(pszURL, info, CACHE_ENTRY_EXPTIME_FC);
 751                 CryptMemFree(info);
 752                 return;
 753             }
 754         }
 755         CryptMemFree(info);
 756     }
 757
 758     if (!CreateUrlCacheEntryW(pszURL, pObject->rgBlob[0].cbData, NULL, cacheFileName, 0))
 759         return;
 760
 761     hCacheFile = CreateFileW(cacheFileName, GENERIC_WRITE, 0,
 762             NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 763     if(hCacheFile == INVALID_HANDLE_VALUE)
 764         return;
 765
 766     WriteFile(hCacheFile, pObject->rgBlob[0].pbData,
 767             pObject->rgBlob[0].cbData, &size, NULL);
 768     CloseHandle(hCacheFile);
 769
 770     if (!(dwRetrievalFlags & CRYPT_STICKY_CACHE_RETRIEVAL))
 771         entryType = NORMAL_CACHE_ENTRY;
 772     else
 773         entryType = STICKY_CACHE_ENTRY;
 774     memset(&ft, 0, sizeof(ft));
 775     CommitUrlCacheEntryW(pszURL, cacheFileName, expires, ft, entryType,
 776             NULL, 0, NULL, NULL);
 777 }
 778
 779 static void CALLBACK CRYPT_InetStatusCallback(HINTERNET hInt,
 780  DWORD_PTR dwContext, DWORD status, void *statusInfo, DWORD statusInfoLen)
 781 {
 782     struct InetContext *context = (struct InetContext *)dwContext;
 783     LPINTERNET_ASYNC_RESULT result;
 784
 785     switch (status)
 786     {
 787     case INTERNET_STATUS_REQUEST_COMPLETE:
 788         result = statusInfo;
 789         context->error = result->dwError;
 790         SetEvent(context->event);
 791     }
 792 }
 793
 794 static BOOL CRYPT_Connect(const URL_COMPONENTSW *components,
 795  struct InetContext *context, PCRYPT_CREDENTIALS pCredentials,
 796  HINTERNET *phInt, HINTERNET *phHost)
 797 {
 798     BOOL ret;
 799
 800     TRACE("(%s:%d, %p, %p, %p, %p)\n", debugstr_w(components->lpszHostName),
 801      components->nPort, context, pCredentials, phInt, phInt);
 802
 803     *phHost = NULL;
 804     *phInt = InternetOpenW(NULL, INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL,
 805      context ? INTERNET_FLAG_ASYNC : 0);
 806     if (*phInt)
 807     {
 808         DWORD service;
 809
 810         if (context)
 811             InternetSetStatusCallbackW(*phInt, CRYPT_InetStatusCallback);
 812         switch (components->nScheme)
 813         {
 814         case INTERNET_SCHEME_FTP:
 815             service = INTERNET_SERVICE_FTP;
 816             break;
 817         case INTERNET_SCHEME_HTTP:
 818             service = INTERNET_SERVICE_HTTP;
 819             break;
 820         default:
 821             service = 0;
 822         }
 823         /* FIXME: use pCredentials for username/password */
 824         *phHost = InternetConnectW(*phInt, components->lpszHostName,
 825          components->nPort, NULL, NULL, service, 0, (DWORD_PTR)context);
 826         if (!*phHost)
 827         {
 828             InternetCloseHandle(*phInt);
 829             *phInt = NULL;
 830             ret = FALSE;
 831         }
 832         else
 833             ret = TRUE;
 834     }
 835     else
 836         ret = FALSE;
 837     TRACE("returning %d\n", ret);
 838     return ret;
 839 }
 840
 841 static BOOL WINAPI FTP_RetrieveEncodedObjectW(LPCWSTR pszURL,
 842  LPCSTR pszObjectOid, DWORD dwRetrievalFlags, DWORD dwTimeout,
 843  PCRYPT_BLOB_ARRAY pObject, PFN_FREE_ENCODED_OBJECT_FUNC *ppfnFreeObject,
 844  void **ppvFreeContext, HCRYPTASYNC hAsyncRetrieve,
 845  PCRYPT_CREDENTIALS pCredentials, PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
 846 {
 847     FIXME("(%s, %s, %08x, %d, %p, %p, %p, %p, %p, %p)\n", debugstr_w(pszURL),
 848      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, pObject,
 849      ppfnFreeObject, ppvFreeContext, hAsyncRetrieve, pCredentials, pAuxInfo);
 850
 851     pObject->cBlob = 0;
 852     pObject->rgBlob = NULL;
 853     *ppfnFreeObject = CRYPT_FreeBlob;
 854     *ppvFreeContext = NULL;
 855     return FALSE;
 856 }
 857
 858 static const WCHAR x509cacert[] = { 'a','p','p','l','i','c','a','t','i','o','n',
 859  '/','x','-','x','5','0','9','-','c','a','-','c','e','r','t',0 };
 860 static const WCHAR x509emailcert[] = { 'a','p','p','l','i','c','a','t','i','o',
 861  'n','/','x','-','x','5','0','9','-','e','m','a','i','l','-','c','e','r','t',
 862  0 };
 863 static const WCHAR x509servercert[] = { 'a','p','p','l','i','c','a','t','i','o',
 864  'n','/','x','-','x','5','0','9','-','s','e','r','v','e','r','-','c','e','r',
 865  't',0 };
 866 static const WCHAR x509usercert[] = { 'a','p','p','l','i','c','a','t','i','o',
 867  'n','/','x','-','x','5','0','9','-','u','s','e','r','-','c','e','r','t',0 };
 868 static const WCHAR pkcs7cert[] = { 'a','p','p','l','i','c','a','t','i','o','n',
 869  '/','x','-','p','k','c','s','7','-','c','e','r','t','i','f','c','a','t','e',
 870  's',0 };
 871 static const WCHAR pkixCRL[] = { 'a','p','p','l','i','c','a','t','i','o','n',
 872  '/','p','k','i','x','-','c','r','l',0 };
 873 static const WCHAR pkcs7CRL[] = { 'a','p','p','l','i','c','a','t','i','o','n',
 874  '/','x','-','p','k','c','s','7','-','c','r','l',0 };
 875 static const WCHAR pkcs7sig[] = { 'a','p','p','l','i','c','a','t','i','o','n',
 876  '/','x','-','p','k','c','s','7','-','s','i','g','n','a','t','u','r','e',0 };
 877 static const WCHAR pkcs7mime[] = { 'a','p','p','l','i','c','a','t','i','o','n',
 878  '/','x','-','p','k','c','s','7','-','m','i','m','e',0 };
 879
 880 static BOOL WINAPI HTTP_RetrieveEncodedObjectW(LPCWSTR pszURL,
 881  LPCSTR pszObjectOid, DWORD dwRetrievalFlags, DWORD dwTimeout,
 882  PCRYPT_BLOB_ARRAY pObject, PFN_FREE_ENCODED_OBJECT_FUNC *ppfnFreeObject,
 883  void **ppvFreeContext, HCRYPTASYNC hAsyncRetrieve,
 884  PCRYPT_CREDENTIALS pCredentials, PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
 885 {
 886     BOOL ret = FALSE;
 887
 888     TRACE("(%s, %s, %08x, %d, %p, %p, %p, %p, %p, %p)\n", debugstr_w(pszURL),
 889      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, pObject,
 890      ppfnFreeObject, ppvFreeContext, hAsyncRetrieve, pCredentials, pAuxInfo);
 891
 892     pObject->cBlob = 0;
 893     pObject->rgBlob = NULL;
 894     *ppfnFreeObject = CRYPT_FreeBlob;
 895     *ppvFreeContext = NULL;
 896
 897     if (!(dwRetrievalFlags & CRYPT_WIRE_ONLY_RETRIEVAL))
 898         ret = CRYPT_GetObjectFromCache(pszURL, pObject, pAuxInfo);
 899     if (!ret && (!(dwRetrievalFlags & CRYPT_CACHE_ONLY_RETRIEVAL) ||
 900      (dwRetrievalFlags & CRYPT_WIRE_ONLY_RETRIEVAL)))
 901     {
 902         URL_COMPONENTSW components;
 903
 904         if ((ret = CRYPT_CrackUrl(pszURL, &components)))
 905         {
 906             HINTERNET hInt, hHost;
 907             struct InetContext *context = NULL;
 908
 909             if (dwTimeout)
 910                 context = CRYPT_MakeInetContext(dwTimeout);
 911             ret = CRYPT_Connect(&components, context, pCredentials, &hInt,
 912              &hHost);
 913             if (ret)
 914             {
 915                 static LPCWSTR types[] = { x509cacert, x509emailcert,
 916                  x509servercert, x509usercert, pkcs7cert, pkixCRL, pkcs7CRL,
 917                  pkcs7sig, pkcs7mime, NULL };
 918                 HINTERNET hHttp = HttpOpenRequestW(hHost, NULL,
 919                  components.lpszUrlPath, NULL, NULL, types,
 920                  INTERNET_FLAG_NO_COOKIES | INTERNET_FLAG_NO_UI,
 921                  (DWORD_PTR)context);
 922
 923                 if (hHttp)
 924                 {
 925                     if (dwTimeout)
 926                     {
 927                         InternetSetOptionW(hHttp,
 928                          INTERNET_OPTION_RECEIVE_TIMEOUT, &dwTimeout,
 929                          sizeof(dwTimeout));
 930                         InternetSetOptionW(hHttp, INTERNET_OPTION_SEND_TIMEOUT,
 931                          &dwTimeout, sizeof(dwTimeout));
 932                     }
 933                     ret = HttpSendRequestExW(hHttp, NULL, NULL, 0,
 934                      (DWORD_PTR)context);
 935                     if (!ret && GetLastError() == ERROR_IO_PENDING)
 936                     {
 937                         if (WaitForSingleObject(context->event,
 938                          context->timeout) == WAIT_TIMEOUT)
 939                             SetLastError(ERROR_TIMEOUT);
 940                         else
 941                             ret = TRUE;
 942                     }
 943                     if (ret &&
 944                      !(ret = HttpEndRequestW(hHttp, NULL, 0, (DWORD_PTR)context)) &&
 945                      GetLastError() == ERROR_IO_PENDING)
 946                     {
 947                         if (WaitForSingleObject(context->event,
 948                          context->timeout) == WAIT_TIMEOUT)
 949                             SetLastError(ERROR_TIMEOUT);
 950                         else
 951                             ret = TRUE;
 952                     }
 953                     if (ret)
 954                         ret = CRYPT_DownloadObject(dwRetrievalFlags, hHttp,
 955                          context, pObject, pAuxInfo);
 956                     if (ret && !(dwRetrievalFlags & CRYPT_DONT_CACHE_RESULT))
 957                     {
 958                         SYSTEMTIME st;
 959                         FILETIME ft;
 960                         DWORD len = sizeof(st);
 961
 962                         if (HttpQueryInfoW(hHttp, HTTP_QUERY_EXPIRES | HTTP_QUERY_FLAG_SYSTEMTIME,
 963                                     &st, &len, NULL) && SystemTimeToFileTime(&st, &ft))
 964                             CRYPT_CacheURL(pszURL, pObject, dwRetrievalFlags, ft);
 965                     }
 966                     InternetCloseHandle(hHttp);
 967                 }
 968                 InternetCloseHandle(hHost);
 969                 InternetCloseHandle(hInt);
 970             }
 971             if (context)
 972             {
 973                 CloseHandle(context->event);
 974                 CryptMemFree(context);
 975             }
 976             CryptMemFree(components.lpszUrlPath);
 977             CryptMemFree(components.lpszHostName);
 978         }
 979     }
 980     TRACE("returning %d\n", ret);
 981     return ret;
 982 }
 983
 984 static BOOL WINAPI File_RetrieveEncodedObjectW(LPCWSTR pszURL,
 985  LPCSTR pszObjectOid, DWORD dwRetrievalFlags, DWORD dwTimeout,
 986  PCRYPT_BLOB_ARRAY pObject, PFN_FREE_ENCODED_OBJECT_FUNC *ppfnFreeObject,
 987  void **ppvFreeContext, HCRYPTASYNC hAsyncRetrieve,
 988  PCRYPT_CREDENTIALS pCredentials, PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
 989 {
 990     URL_COMPONENTSW components = { sizeof(components), 0 };
 991     BOOL ret;
 992
 993     TRACE("(%s, %s, %08x, %d, %p, %p, %p, %p, %p, %p)\n", debugstr_w(pszURL),
 994      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, pObject,
 995      ppfnFreeObject, ppvFreeContext, hAsyncRetrieve, pCredentials, pAuxInfo);
 996
 997     pObject->cBlob = 0;
 998     pObject->rgBlob = NULL;
 999     *ppfnFreeObject = CRYPT_FreeBlob;
1000     *ppvFreeContext = NULL;
1001
1002     components.lpszUrlPath = CryptMemAlloc(INTERNET_MAX_PATH_LENGTH * sizeof(WCHAR));
1003     components.dwUrlPathLength = INTERNET_MAX_PATH_LENGTH;
1004     if (!components.lpszUrlPath)
1005     {
1006         SetLastError(ERROR_OUTOFMEMORY);
1007         return FALSE;
1008     }
1009
1010     ret = InternetCrackUrlW(pszURL, 0, ICU_DECODE, &components);
1011     if (ret)
1012     {
1013         LPWSTR path;
1014
1015         /* 3 == lstrlenW(L"c:") + 1 */
1016         path = CryptMemAlloc((components.dwUrlPathLength + 3) * sizeof(WCHAR));
1017         if (path)
1018         {
1019             HANDLE hFile;
1020
1021             /* Try to create the file directly - Wine handles / in pathnames */
1022             lstrcpynW(path, components.lpszUrlPath,
1023              components.dwUrlPathLength + 1);
1024             hFile = CreateFileW(path, GENERIC_READ, FILE_SHARE_READ,
1025              NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1026             if (hFile == INVALID_HANDLE_VALUE)
1027             {
1028                 /* Try again on the current drive */
1029                 GetCurrentDirectoryW(components.dwUrlPathLength, path);
1030                 if (path[1] == ':')
1031                 {
1032                     lstrcpynW(path + 2, components.lpszUrlPath,
1033                      components.dwUrlPathLength + 1);
1034                     hFile = CreateFileW(path, GENERIC_READ, FILE_SHARE_READ,
1035                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1036                 }
1037                 if (hFile == INVALID_HANDLE_VALUE)
1038                 {
1039                     /* Try again on the Windows drive */
1040                     GetWindowsDirectoryW(path, components.dwUrlPathLength);
1041                     if (path[1] == ':')
1042                     {
1043                         lstrcpynW(path + 2, components.lpszUrlPath,
1044                          components.dwUrlPathLength + 1);
1045                         hFile = CreateFileW(path, GENERIC_READ, FILE_SHARE_READ,
1046                          NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1047                     }
1048                 }
1049             }
1050             if (hFile != INVALID_HANDLE_VALUE)
1051             {
1052                 if ((ret = CRYPT_GetObjectFromFile(hFile, pObject)))
1053                 {
1054                     if (pAuxInfo && pAuxInfo->cbSize >=
1055                      offsetof(CRYPT_RETRIEVE_AUX_INFO,
1056                      pLastSyncTime) + sizeof(PFILETIME) &&
1057                      pAuxInfo->pLastSyncTime)
1058                         GetFileTime(hFile, NULL, NULL,
1059                          pAuxInfo->pLastSyncTime);
1060                 }
1061                 CloseHandle(hFile);
1062             }
1063             else
1064                 ret = FALSE;
1065             CryptMemFree(path);
1066         }
1067         else
1068         {
1069             SetLastError(ERROR_OUTOFMEMORY);
1070             ret = FALSE;
1071         }
1072     }
1073     CryptMemFree(components.lpszUrlPath);
1074     return ret;
1075 }
1076
1077 typedef BOOL (WINAPI *SchemeDllRetrieveEncodedObjectW)(LPCWSTR pwszUrl,
1078  LPCSTR pszObjectOid, DWORD dwRetrievalFlags, DWORD dwTimeout,
1079  PCRYPT_BLOB_ARRAY pObject, PFN_FREE_ENCODED_OBJECT_FUNC *ppfnFreeObject,
1080  void **ppvFreeContext, HCRYPTASYNC hAsyncRetrieve,
1081  PCRYPT_CREDENTIALS pCredentials, PCRYPT_RETRIEVE_AUX_INFO pAuxInfo);
1082
1083 static BOOL CRYPT_GetRetrieveFunction(LPCWSTR pszURL,
1084  SchemeDllRetrieveEncodedObjectW *pFunc, HCRYPTOIDFUNCADDR *phFunc)
1085 {
1086     URL_COMPONENTSW components = { sizeof(components), 0 };
1087     BOOL ret;
1088
1089     TRACE("(%s, %p, %p)\n", debugstr_w(pszURL), pFunc, phFunc);
1090
1091     *pFunc = NULL;
1092     *phFunc = 0;
1093     components.dwSchemeLength = 1;
1094     ret = InternetCrackUrlW(pszURL, 0, 0, &components);
1095     if (ret)
1096     {
1097         /* Microsoft always uses CryptInitOIDFunctionSet/
1098          * CryptGetOIDFunctionAddress, but there doesn't seem to be a pressing
1099          * reason to do so for builtin schemes.
1100          */
1101         switch (components.nScheme)
1102         {
1103         case INTERNET_SCHEME_FTP:
1104             *pFunc = FTP_RetrieveEncodedObjectW;
1105             break;
1106         case INTERNET_SCHEME_HTTP:
1107             *pFunc = HTTP_RetrieveEncodedObjectW;
1108             break;
1109         case INTERNET_SCHEME_FILE:
1110             *pFunc = File_RetrieveEncodedObjectW;
1111             break;
1112         default:
1113         {
1114             int len = WideCharToMultiByte(CP_ACP, 0, components.lpszScheme,
1115              components.dwSchemeLength, NULL, 0, NULL, NULL);
1116
1117             if (len)
1118             {
1119                 LPSTR scheme = CryptMemAlloc(len);
1120
1121                 if (scheme)
1122                 {
1123                     static HCRYPTOIDFUNCSET set = NULL;
1124
1125                     if (!set)
1126                         set = CryptInitOIDFunctionSet(
1127                          SCHEME_OID_RETRIEVE_ENCODED_OBJECTW_FUNC, 0);
1128                     WideCharToMultiByte(CP_ACP, 0, components.lpszScheme,
1129                      components.dwSchemeLength, scheme, len, NULL, NULL);
1130                     ret = CryptGetOIDFunctionAddress(set, X509_ASN_ENCODING,
1131                      scheme, 0, (void **)pFunc, phFunc);
1132                     CryptMemFree(scheme);
1133                 }
1134                 else
1135                 {
1136                     SetLastError(ERROR_OUTOFMEMORY);
1137                     ret = FALSE;
1138                 }
1139             }
1140             else
1141                 ret = FALSE;
1142         }
1143         }
1144     }
1145     TRACE("returning %d\n", ret);
1146     return ret;
1147 }
1148
1149 static BOOL WINAPI CRYPT_CreateBlob(LPCSTR pszObjectOid,
1150  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1151 {
1152     DWORD size, i;
1153     CRYPT_BLOB_ARRAY *context;
1154     BOOL ret = FALSE;
1155
1156     size = sizeof(CRYPT_BLOB_ARRAY) + pObject->cBlob * sizeof(CRYPT_DATA_BLOB);
1157     for (i = 0; i < pObject->cBlob; i++)
1158         size += pObject->rgBlob[i].cbData;
1159     context = CryptMemAlloc(size);
1160     if (context)
1161     {
1162         LPBYTE nextData;
1163
1164         context->cBlob = 0;
1165         context->rgBlob =
1166          (CRYPT_DATA_BLOB *)((LPBYTE)context + sizeof(CRYPT_BLOB_ARRAY));
1167         nextData =
1168          (LPBYTE)context->rgBlob + pObject->cBlob * sizeof(CRYPT_DATA_BLOB);
1169         for (i = 0; i < pObject->cBlob; i++)
1170         {
1171             memcpy(nextData, pObject->rgBlob[i].pbData,
1172              pObject->rgBlob[i].cbData);
1173             context->rgBlob[i].pbData = nextData;
1174             context->rgBlob[i].cbData = pObject->rgBlob[i].cbData;
1175             nextData += pObject->rgBlob[i].cbData;
1176             context->cBlob++;
1177         }
1178         *ppvContext = context;
1179         ret = TRUE;
1180     }
1181     return ret;
1182 }
1183
1184 typedef BOOL (WINAPI *AddContextToStore)(HCERTSTORE hCertStore,
1185  const void *pContext, DWORD dwAddDisposition, const void **ppStoreContext);
1186
1187 static BOOL CRYPT_CreateContext(const CRYPT_BLOB_ARRAY *pObject,
1188  DWORD dwExpectedContentTypeFlags, AddContextToStore addFunc, void **ppvContext)
1189 {
1190     BOOL ret = TRUE;
1191
1192     if (!pObject->cBlob)
1193     {
1194         SetLastError(ERROR_INVALID_DATA);
1195         *ppvContext = NULL;
1196         ret = FALSE;
1197     }
1198     else if (pObject->cBlob == 1)
1199     {
1200         if (!CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &pObject->rgBlob[0],
1201          dwExpectedContentTypeFlags, CERT_QUERY_FORMAT_FLAG_BINARY, 0, NULL,
1202          NULL, NULL, NULL, NULL, (const void **)ppvContext))
1203         {
1204             SetLastError(CRYPT_E_NO_MATCH);
1205             ret = FALSE;
1206         }
1207     }
1208     else
1209     {
1210         HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1211          CERT_STORE_CREATE_NEW_FLAG, NULL);
1212
1213         if (store)
1214         {
1215             DWORD i;
1216             const void *context;
1217
1218             for (i = 0; i < pObject->cBlob; i++)
1219             {
1220                 if (CryptQueryObject(CERT_QUERY_OBJECT_BLOB,
1221                  &pObject->rgBlob[i], dwExpectedContentTypeFlags,
1222                  CERT_QUERY_FORMAT_FLAG_BINARY, 0, NULL, NULL, NULL, NULL,
1223                  NULL, &context))
1224                 {
1225                     if (!addFunc(store, context, CERT_STORE_ADD_ALWAYS, NULL))
1226                         ret = FALSE;
1227                 }
1228                 else
1229                 {
1230                     SetLastError(CRYPT_E_NO_MATCH);
1231                     ret = FALSE;
1232                 }
1233             }
1234         }
1235         else
1236             ret = FALSE;
1237         *ppvContext = store;
1238     }
1239     return ret;
1240 }
1241
1242 static BOOL WINAPI CRYPT_CreateCert(LPCSTR pszObjectOid,
1243  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1244 {
1245     return CRYPT_CreateContext(pObject, CERT_QUERY_CONTENT_FLAG_CERT,
1246      (AddContextToStore)CertAddCertificateContextToStore, ppvContext);
1247 }
1248
1249 static BOOL WINAPI CRYPT_CreateCRL(LPCSTR pszObjectOid,
1250  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1251 {
1252     return CRYPT_CreateContext(pObject, CERT_QUERY_CONTENT_FLAG_CRL,
1253      (AddContextToStore)CertAddCRLContextToStore, ppvContext);
1254 }
1255
1256 static BOOL WINAPI CRYPT_CreateCTL(LPCSTR pszObjectOid,
1257  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1258 {
1259     return CRYPT_CreateContext(pObject, CERT_QUERY_CONTENT_FLAG_CTL,
1260      (AddContextToStore)CertAddCTLContextToStore, ppvContext);
1261 }
1262
1263 static BOOL WINAPI CRYPT_CreatePKCS7(LPCSTR pszObjectOid,
1264  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1265 {
1266     BOOL ret;
1267
1268     if (!pObject->cBlob)
1269     {
1270         SetLastError(ERROR_INVALID_DATA);
1271         *ppvContext = NULL;
1272         ret = FALSE;
1273     }
1274     else if (pObject->cBlob == 1)
1275         ret = CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &pObject->rgBlob[0],
1276          CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED |
1277          CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED, CERT_QUERY_FORMAT_FLAG_BINARY,
1278          0, NULL, NULL, NULL, ppvContext, NULL, NULL);
1279     else
1280     {
1281         FIXME("multiple messages unimplemented\n");
1282         ret = FALSE;
1283     }
1284     return ret;
1285 }
1286
1287 static BOOL WINAPI CRYPT_CreateAny(LPCSTR pszObjectOid,
1288  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1289 {
1290     BOOL ret;
1291
1292     if (!pObject->cBlob)
1293     {
1294         SetLastError(ERROR_INVALID_DATA);
1295         *ppvContext = NULL;
1296         ret = FALSE;
1297     }
1298     else
1299     {
1300         HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
1301          CERT_STORE_CREATE_NEW_FLAG, NULL);
1302
1303         if (store)
1304         {
1305             HCERTSTORE memStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1306              CERT_STORE_CREATE_NEW_FLAG, NULL);
1307
1308             if (memStore)
1309             {
1310                 CertAddStoreToCollection(store, memStore,
1311                  CERT_PHYSICAL_STORE_ADD_ENABLE_FLAG, 0);
1312                 CertCloseStore(memStore, 0);
1313             }
1314             else
1315             {
1316                 CertCloseStore(store, 0);
1317                 store = NULL;
1318             }
1319         }
1320         if (store)
1321         {
1322             DWORD i;
1323
1324             ret = TRUE;
1325             for (i = 0; i < pObject->cBlob; i++)
1326             {
1327                 DWORD contentType, expectedContentTypes =
1328                  CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED |
1329                  CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED |
1330                  CERT_QUERY_CONTENT_FLAG_CERT |
1331                  CERT_QUERY_CONTENT_FLAG_CRL |
1332                  CERT_QUERY_CONTENT_FLAG_CTL;
1333                 HCERTSTORE contextStore;
1334                 const void *context;
1335
1336                 if (CryptQueryObject(CERT_QUERY_OBJECT_BLOB,
1337                  &pObject->rgBlob[i], expectedContentTypes,
1338                  CERT_QUERY_FORMAT_FLAG_BINARY, 0, NULL, &contentType, NULL,
1339                  &contextStore, NULL, &context))
1340                 {
1341                     switch (contentType)
1342                     {
1343                     case CERT_QUERY_CONTENT_CERT:
1344                         if (!CertAddCertificateContextToStore(store,
1345                          context, CERT_STORE_ADD_ALWAYS, NULL))
1346                             ret = FALSE;
1347                         CertFreeCertificateContext(context);
1348                         break;
1349                     case CERT_QUERY_CONTENT_CRL:
1350                         if (!CertAddCRLContextToStore(store,
1351                          context, CERT_STORE_ADD_ALWAYS, NULL))
1352                              ret = FALSE;
1353                         CertFreeCRLContext(context);
1354                         break;
1355                     case CERT_QUERY_CONTENT_CTL:
1356                         if (!CertAddCTLContextToStore(store,
1357                          context, CERT_STORE_ADD_ALWAYS, NULL))
1358                              ret = FALSE;
1359                         CertFreeCTLContext(context);
1360                         break;
1361                     default:
1362                         CertAddStoreToCollection(store, contextStore, 0, 0);
1363                     }
1364                     CertCloseStore(contextStore, 0);
1365                 }
1366                 else
1367                     ret = FALSE;
1368             }
1369         }
1370         else
1371             ret = FALSE;
1372         *ppvContext = store;
1373     }
1374     return ret;
1375 }
1376
1377 typedef BOOL (WINAPI *ContextDllCreateObjectContext)(LPCSTR pszObjectOid,
1378  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext);
1379
1380 static BOOL CRYPT_GetCreateFunction(LPCSTR pszObjectOid,
1381  ContextDllCreateObjectContext *pFunc, HCRYPTOIDFUNCADDR *phFunc)
1382 {
1383     BOOL ret = TRUE;
1384
1385     TRACE("(%s, %p, %p)\n", debugstr_a(pszObjectOid), pFunc, phFunc);
1386
1387     *pFunc = NULL;
1388     *phFunc = 0;
1389     if (IS_INTOID(pszObjectOid))
1390     {
1391         switch (LOWORD(pszObjectOid))
1392         {
1393         case 0:
1394             *pFunc = CRYPT_CreateBlob;
1395             break;
1396         case LOWORD(CONTEXT_OID_CERTIFICATE):
1397             *pFunc = CRYPT_CreateCert;
1398             break;
1399         case LOWORD(CONTEXT_OID_CRL):
1400             *pFunc = CRYPT_CreateCRL;
1401             break;
1402         case LOWORD(CONTEXT_OID_CTL):
1403             *pFunc = CRYPT_CreateCTL;
1404             break;
1405         case LOWORD(CONTEXT_OID_PKCS7):
1406             *pFunc = CRYPT_CreatePKCS7;
1407             break;
1408         case LOWORD(CONTEXT_OID_CAPI2_ANY):
1409             *pFunc = CRYPT_CreateAny;
1410             break;
1411         }
1412     }
1413     if (!*pFunc)
1414     {
1415         static HCRYPTOIDFUNCSET set = NULL;
1416
1417         if (!set)
1418             set = CryptInitOIDFunctionSet(
1419              CONTEXT_OID_CREATE_OBJECT_CONTEXT_FUNC, 0);
1420         ret = CryptGetOIDFunctionAddress(set, X509_ASN_ENCODING, pszObjectOid,
1421          0, (void **)pFunc, phFunc);
1422     }
1423     TRACE("returning %d\n", ret);
1424     return ret;
1425 }
1426
1427 typedef BOOL (*get_object_expiration_func)(const void *pvContext,
1428  FILETIME *expiration);
1429
1430 static BOOL CRYPT_GetExpirationFromCert(const void *pvObject, FILETIME *expiration)
1431 {
1432     PCCERT_CONTEXT cert = pvObject;
1433
1434     *expiration = cert->pCertInfo->NotAfter;
1435     return TRUE;
1436 }
1437
1438 static BOOL CRYPT_GetExpirationFromCRL(const void *pvObject, FILETIME *expiration)
1439 {
1440     PCCRL_CONTEXT cert = pvObject;
1441
1442     *expiration = cert->pCrlInfo->NextUpdate;
1443     return TRUE;
1444 }
1445
1446 static BOOL CRYPT_GetExpirationFromCTL(const void *pvObject, FILETIME *expiration)
1447 {
1448     PCCTL_CONTEXT cert = pvObject;
1449
1450     *expiration = cert->pCtlInfo->NextUpdate;
1451     return TRUE;
1452 }
1453
1454 static BOOL CRYPT_GetExpirationFunction(LPCSTR pszObjectOid,
1455  get_object_expiration_func *getExpiration)
1456 {
1457     BOOL ret;
1458
1459     if (IS_INTOID(pszObjectOid))
1460     {
1461         switch (LOWORD(pszObjectOid))
1462         {
1463         case LOWORD(CONTEXT_OID_CERTIFICATE):
1464             *getExpiration = CRYPT_GetExpirationFromCert;
1465             ret = TRUE;
1466             break;
1467         case LOWORD(CONTEXT_OID_CRL):
1468             *getExpiration = CRYPT_GetExpirationFromCRL;
1469             ret = TRUE;
1470             break;
1471         case LOWORD(CONTEXT_OID_CTL):
1472             *getExpiration = CRYPT_GetExpirationFromCTL;
1473             ret = TRUE;
1474             break;
1475         default:
1476             ret = FALSE;
1477         }
1478     }
1479     else
1480         ret = FALSE;
1481     return ret;
1482 }
1483
1484 /***********************************************************************
1485  *    CryptRetrieveObjectByUrlW (CRYPTNET.@)
1486  */
1487 BOOL WINAPI CryptRetrieveObjectByUrlW(LPCWSTR pszURL, LPCSTR pszObjectOid,
1488  DWORD dwRetrievalFlags, DWORD dwTimeout, LPVOID *ppvObject,
1489  HCRYPTASYNC hAsyncRetrieve, PCRYPT_CREDENTIALS pCredentials, LPVOID pvVerify,
1490  PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
1491 {
1492     BOOL ret;
1493     SchemeDllRetrieveEncodedObjectW retrieve;
1494     ContextDllCreateObjectContext create;
1495     HCRYPTOIDFUNCADDR hRetrieve = 0, hCreate = 0;
1496
1497     TRACE("(%s, %s, %08x, %d, %p, %p, %p, %p, %p)\n", debugstr_w(pszURL),
1498      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, ppvObject,
1499      hAsyncRetrieve, pCredentials, pvVerify, pAuxInfo);
1500
1501     if (!pszURL)
1502     {
1503         SetLastError(ERROR_INVALID_PARAMETER);
1504         return FALSE;
1505     }
1506     ret = CRYPT_GetRetrieveFunction(pszURL, &retrieve, &hRetrieve);
1507     if (ret)
1508         ret = CRYPT_GetCreateFunction(pszObjectOid, &create, &hCreate);
1509     if (ret)
1510     {
1511         CRYPT_BLOB_ARRAY object = { 0, NULL };
1512         PFN_FREE_ENCODED_OBJECT_FUNC freeObject;
1513         void *freeContext;
1514
1515         ret = retrieve(pszURL, pszObjectOid, dwRetrievalFlags, dwTimeout,
1516          &object, &freeObject, &freeContext, hAsyncRetrieve, pCredentials,
1517          pAuxInfo);
1518         if (ret)
1519         {
1520             get_object_expiration_func getExpiration;
1521
1522             ret = create(pszObjectOid, dwRetrievalFlags, &object, ppvObject);
1523             if (ret && !(dwRetrievalFlags & CRYPT_DONT_CACHE_RESULT) &&
1524              CRYPT_GetExpirationFunction(pszObjectOid, &getExpiration))
1525             {
1526                 FILETIME expires;
1527
1528                 if (getExpiration(*ppvObject, &expires))
1529                     CRYPT_CacheURL(pszURL, &object, dwRetrievalFlags, expires);
1530             }
1531             freeObject(pszObjectOid, &object, freeContext);
1532         }
1533     }
1534     if (hCreate)
1535         CryptFreeOIDFunctionAddress(hCreate, 0);
1536     if (hRetrieve)
1537         CryptFreeOIDFunctionAddress(hRetrieve, 0);
1538     TRACE("returning %d\n", ret);
1539     return ret;
1540 }
1541
1542 static DWORD verify_cert_revocation_with_crl_online(PCCERT_CONTEXT cert,
1543  PCCRL_CONTEXT crl, DWORD index, FILETIME *pTime,
1544  PCERT_REVOCATION_STATUS pRevStatus)
1545 {
1546     DWORD error;
1547     PCRL_ENTRY entry = NULL;
1548
1549     CertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
1550     if (entry)
1551     {
1552         error = CRYPT_E_REVOKED;
1553         pRevStatus->dwIndex = index;
1554     }
1555     else
1556     {
1557         /* Since the CRL was retrieved for the cert being checked, then it's
1558          * guaranteed to be fresh, and the cert is not revoked.
1559          */
1560         error = ERROR_SUCCESS;
1561     }
1562     return error;
1563 }
1564
1565 static DWORD verify_cert_revocation_from_dist_points_ext(
1566  const CRYPT_DATA_BLOB *value, PCCERT_CONTEXT cert, DWORD index,
1567  FILETIME *pTime, DWORD dwFlags, const CERT_REVOCATION_PARA *pRevPara,
1568  PCERT_REVOCATION_STATUS pRevStatus)
1569 {
1570     DWORD error = ERROR_SUCCESS, cbUrlArray;
1571
1572     if (CRYPT_GetUrlFromCRLDistPointsExt(value, NULL, &cbUrlArray, NULL, NULL))
1573     {
1574         CRYPT_URL_ARRAY *urlArray = CryptMemAlloc(cbUrlArray);
1575
1576         if (urlArray)
1577         {
1578             DWORD j, retrievalFlags = 0, startTime, endTime, timeout;
1579             BOOL ret;
1580
1581             ret = CRYPT_GetUrlFromCRLDistPointsExt(value, urlArray,
1582              &cbUrlArray, NULL, NULL);
1583             if (dwFlags & CERT_VERIFY_CACHE_ONLY_BASED_REVOCATION)
1584                 retrievalFlags |= CRYPT_CACHE_ONLY_RETRIEVAL;
1585             if (dwFlags & CERT_VERIFY_REV_ACCUMULATIVE_TIMEOUT_FLAG &&
1586              pRevPara && pRevPara->cbSize >= offsetof(CERT_REVOCATION_PARA,
1587              dwUrlRetrievalTimeout) + sizeof(DWORD))
1588             {
1589                 startTime = GetTickCount();
1590                 endTime = startTime + pRevPara->dwUrlRetrievalTimeout;
1591                 timeout = pRevPara->dwUrlRetrievalTimeout;
1592             }
1593             else
1594                 endTime = timeout = 0;
1595             if (!ret)
1596                 error = GetLastError();
1597             for (j = 0; !error && j < urlArray->cUrl; j++)
1598             {
1599                 PCCRL_CONTEXT crl;
1600
1601                 ret = CryptRetrieveObjectByUrlW(urlArray->rgwszUrl[j],
1602                  CONTEXT_OID_CRL, retrievalFlags, timeout, (void **)&crl,
1603                  NULL, NULL, NULL, NULL);
1604                 if (ret)
1605                 {
1606                     error = verify_cert_revocation_with_crl_online(cert, crl,
1607                      index, pTime, pRevStatus);
1608                     if (!error && timeout)
1609                     {
1610                         DWORD time = GetTickCount();
1611
1612                         if ((int)(endTime - time) <= 0)
1613                         {
1614                             error = ERROR_TIMEOUT;
1615                             pRevStatus->dwIndex = index;
1616                         }
1617                         else
1618                             timeout = endTime - time;
1619                     }
1620                     CertFreeCRLContext(crl);
1621                 }
1622                 else
1623                     error = CRYPT_E_REVOCATION_OFFLINE;
1624             }
1625             CryptMemFree(urlArray);
1626         }
1627         else
1628         {
1629             error = ERROR_OUTOFMEMORY;
1630             pRevStatus->dwIndex = index;
1631         }
1632     }
1633     else
1634     {
1635         error = GetLastError();
1636         pRevStatus->dwIndex = index;
1637     }
1638     return error;
1639 }
1640
1641 static DWORD verify_cert_revocation_from_aia_ext(
1642  const CRYPT_DATA_BLOB *value, PCCERT_CONTEXT cert, DWORD index,
1643  FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara,
1644  PCERT_REVOCATION_STATUS pRevStatus)
1645 {
1646     BOOL ret;
1647     DWORD error, size;
1648     CERT_AUTHORITY_INFO_ACCESS *aia;
1649
1650     ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_AUTHORITY_INFO_ACCESS,
1651      value->pbData, value->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &aia, &size);
1652     if (ret)
1653     {
1654         DWORD i;
1655
1656         for (i = 0; i < aia->cAccDescr; i++)
1657             if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
1658              szOID_PKIX_OCSP))
1659             {
1660                 if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice ==
1661                  CERT_ALT_NAME_URL)
1662                     FIXME("OCSP URL = %s\n",
1663                      debugstr_w(aia->rgAccDescr[i].AccessLocation.u.pwszURL));
1664                 else
1665                     FIXME("unsupported AccessLocation type %d\n",
1666                      aia->rgAccDescr[i].AccessLocation.dwAltNameChoice);
1667             }
1668         LocalFree(aia);
1669         /* FIXME: lie and pretend OCSP validated the cert */
1670         error = ERROR_SUCCESS;
1671     }
1672     else
1673         error = GetLastError();
1674     return error;
1675 }
1676
1677 static DWORD verify_cert_revocation_with_crl_offline(PCCERT_CONTEXT cert,
1678  PCCRL_CONTEXT crl, DWORD index, FILETIME *pTime,
1679  PCERT_REVOCATION_STATUS pRevStatus)
1680 {
1681     DWORD error;
1682     LONG valid;
1683
1684     valid = CompareFileTime(pTime, &crl->pCrlInfo->ThisUpdate);
1685     if (valid <= 0)
1686     {
1687         /* If this CRL is not older than the time being verified, there's no
1688          * way to know whether the certificate was revoked.
1689          */
1690         TRACE("CRL not old enough\n");
1691         error = CRYPT_E_REVOCATION_OFFLINE;
1692     }
1693     else
1694     {
1695         PCRL_ENTRY entry = NULL;
1696
1697         CertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
1698         if (entry)
1699         {
1700             error = CRYPT_E_REVOKED;
1701             pRevStatus->dwIndex = index;
1702         }
1703         else
1704         {
1705             /* Since the CRL was not retrieved for the cert being checked,
1706              * there's no guarantee it's fresh, so the cert *might* be okay,
1707              * but it's safer not to guess.
1708              */
1709             TRACE("certificate not found\n");
1710             error = CRYPT_E_REVOCATION_OFFLINE;
1711         }
1712     }
1713     return error;
1714 }
1715
1716 static DWORD verify_cert_revocation(PCCERT_CONTEXT cert, DWORD index,
1717  FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara,
1718  PCERT_REVOCATION_STATUS pRevStatus)
1719 {
1720     DWORD error = ERROR_SUCCESS;
1721     PCERT_EXTENSION ext;
1722
1723     if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
1724      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
1725         error = verify_cert_revocation_from_dist_points_ext(&ext->Value, cert,
1726          index, pTime, dwFlags, pRevPara, pRevStatus);
1727     else if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS,
1728      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
1729         error = verify_cert_revocation_from_aia_ext(&ext->Value, cert,
1730          index, pTime, dwFlags, pRevPara, pRevStatus);
1731     else
1732     {
1733         if (pRevPara && pRevPara->hCrlStore && pRevPara->pIssuerCert)
1734         {
1735             PCCRL_CONTEXT crl = NULL;
1736             BOOL canSignCRLs;
1737
1738             /* If the caller told us about the issuer, make sure the issuer
1739              * can sign CRLs before looking for one.
1740              */
1741             if ((ext = CertFindExtension(szOID_KEY_USAGE,
1742              pRevPara->pIssuerCert->pCertInfo->cExtension,
1743              pRevPara->pIssuerCert->pCertInfo->rgExtension)))
1744             {
1745                 CRYPT_BIT_BLOB usage;
1746                 DWORD size = sizeof(usage);
1747
1748                 if (!CryptDecodeObjectEx(cert->dwCertEncodingType, X509_BITS,
1749                  ext->Value.pbData, ext->Value.cbData,
1750                  CRYPT_DECODE_NOCOPY_FLAG, NULL, &usage, &size))
1751                     canSignCRLs = FALSE;
1752                 else if (usage.cbData > 2)
1753                 {
1754                     /* The key usage extension only defines 9 bits => no more
1755                      * than 2 bytes are needed to encode all known usages.
1756                      */
1757                     canSignCRLs = FALSE;
1758                 }
1759                 else
1760                 {
1761                     BYTE usageBits = usage.pbData[usage.cbData - 1];
1762
1763                     canSignCRLs = usageBits & CERT_CRL_SIGN_KEY_USAGE;
1764                 }
1765             }
1766             else
1767                 canSignCRLs = TRUE;
1768             if (canSignCRLs)
1769             {
1770                 /* If the caller was helpful enough to tell us where to find a
1771                  * CRL for the cert, look for one and check it.
1772                  */
1773                 crl = CertFindCRLInStore(pRevPara->hCrlStore,
1774                  cert->dwCertEncodingType,
1775                  CRL_FIND_ISSUED_BY_SIGNATURE_FLAG |
1776                  CRL_FIND_ISSUED_BY_AKI_FLAG,
1777                  CRL_FIND_ISSUED_BY, pRevPara->pIssuerCert, NULL);
1778             }
1779             if (crl)
1780             {
1781                 error = verify_cert_revocation_with_crl_offline(cert, crl,
1782                  index, pTime, pRevStatus);
1783                 CertFreeCRLContext(crl);
1784             }
1785             else
1786             {
1787                 TRACE("no CRL found\n");
1788                 error = CRYPT_E_NO_REVOCATION_CHECK;
1789                 pRevStatus->dwIndex = index;
1790             }
1791         }
1792         else
1793         {
1794             if (!pRevPara)
1795                 WARN("no CERT_REVOCATION_PARA\n");
1796             else if (!pRevPara->hCrlStore)
1797                 WARN("no dist points/aia extension and no CRL store\n");
1798             else if (!pRevPara->pIssuerCert)
1799                 WARN("no dist points/aia extension and no issuer\n");
1800             error = CRYPT_E_NO_REVOCATION_CHECK;
1801             pRevStatus->dwIndex = index;
1802         }
1803     }
1804     return error;
1805 }
1806
1807 typedef struct _CERT_REVOCATION_PARA_NO_EXTRA_FIELDS {
1808     DWORD                     cbSize;
1809     PCCERT_CONTEXT            pIssuerCert;
1810     DWORD                     cCertStore;
1811     HCERTSTORE               *rgCertStore;
1812     HCERTSTORE                hCrlStore;
1813     LPFILETIME                pftTimeToUse;
1814 } CERT_REVOCATION_PARA_NO_EXTRA_FIELDS;
1815
1816 typedef struct _OLD_CERT_REVOCATION_STATUS {
1817     DWORD cbSize;
1818     DWORD dwIndex;
1819     DWORD dwError;
1820     DWORD dwReason;
1821 } OLD_CERT_REVOCATION_STATUS;
1822
1823 /***********************************************************************
1824  *    CertDllVerifyRevocation (CRYPTNET.@)
1825  */
1826 BOOL WINAPI CertDllVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1827  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1828  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1829 {
1830     DWORD error = 0, i;
1831     FILETIME now;
1832     LPFILETIME pTime = NULL;
1833
1834     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1835      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1836
1837     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1838      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1839     {
1840         SetLastError(E_INVALIDARG);
1841         return FALSE;
1842     }
1843     if (!cContext)
1844     {
1845         SetLastError(E_INVALIDARG);
1846         return FALSE;
1847     }
1848     if (pRevPara && pRevPara->cbSize >=
1849      sizeof(CERT_REVOCATION_PARA_NO_EXTRA_FIELDS))
1850         pTime = pRevPara->pftTimeToUse;
1851     if (!pTime)
1852     {
1853         GetSystemTimeAsFileTime(&now);
1854         pTime = &now;
1855     }
1856     memset(&pRevStatus->dwIndex, 0, pRevStatus->cbSize - sizeof(DWORD));
1857     if (dwRevType != CERT_CONTEXT_REVOCATION_TYPE)
1858         error = CRYPT_E_NO_REVOCATION_CHECK;
1859     else
1860     {
1861         for (i = 0; !error && i < cContext; i++)
1862             error = verify_cert_revocation(rgpvContext[i], i, pTime, dwFlags,
1863              pRevPara, pRevStatus);
1864     }
1865     if (error)
1866     {
1867         SetLastError(error);
1868         pRevStatus->dwError = error;
1869     }
1870     TRACE("returning %d (%08x)\n", !error, error);
1871     return !error;
1872 }