dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #define NONAMELESSUNION
  24 #include "ntstatus.h"
  25 #define WIN32_NO_STATUS
  26 #include "windef.h"
  27 #include "winbase.h"
  28 #include "winternl.h"
  29 #define CRYPT_OID_INFO_HAS_EXTRA_FIELDS
  30 #include "wincrypt.h"
  31 #include "snmp.h"
  32 #include "bcrypt.h"
  33 #include "winnls.h"
  34 #include "rpc.h"
  35 #include "wine/debug.h"
  36 #include "crypt32_private.h"
  37
  38 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  39
  40 /* Internal version of CertGetCertificateContextProperty that gets properties
  41  * directly from the context (or the context it's linked to, depending on its
  42  * type.) Doesn't handle special-case properties, since they are handled by
  43  * CertGetCertificateContextProperty, and are particular to the store in which
  44  * the property exists (which is separate from the context.)
  45  */
  46 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
  47  void *pvData, DWORD *pcbData);
  48
  49 /* Internal version of CertSetCertificateContextProperty that sets properties
  50  * directly on the context (or the context it's linked to, depending on its
  51  * type.) Doesn't handle special cases, since they're handled by
  52  * CertSetCertificateContextProperty anyway.
  53  */
  54 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
  55  DWORD dwFlags, const void *pvData);
  56
  57 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  58  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  59  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  60 {
  61     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  62      pbCertEncoded, cbCertEncoded);
  63     BOOL ret;
  64
  65     TRACE("(%p, %08lx, %p, %ld, %08lx, %p)\n", hCertStore, dwCertEncodingType,
  66      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  67
  68     if (cert)
  69     {
  70         ret = CertAddCertificateContextToStore(hCertStore, cert,
  71          dwAddDisposition, ppCertContext);
  72         CertFreeCertificateContext(cert);
  73     }
  74     else
  75         ret = FALSE;
  76     return ret;
  77 }
  78
  79 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
  80  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  81 {
  82     HCERTSTORE store;
  83     BOOL ret = FALSE;
  84
  85     TRACE("(%s, %p, %ld)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
  86      cbCertEncoded);
  87
  88     store = CertOpenSystemStoreA(0, pszCertStoreName);
  89     if (store)
  90     {
  91         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  92          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  93         CertCloseStore(store, 0);
  94     }
  95     return ret;
  96 }
  97
  98 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
  99  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 100 {
 101     HCERTSTORE store;
 102     BOOL ret = FALSE;
 103
 104     TRACE("(%s, %p, %ld)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
 105      cbCertEncoded);
 106
 107     store = CertOpenSystemStoreW(0, pszCertStoreName);
 108     if (store)
 109     {
 110         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 111          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
 112         CertCloseStore(store, 0);
 113     }
 114     return ret;
 115 }
 116
 117 static const context_vtbl_t cert_vtbl;
 118
 119 static void Cert_free(context_t *context)
 120 {
 121     cert_t *cert = (cert_t*)context;
 122
 123     CryptMemFree(cert->ctx.pbCertEncoded);
 124     LocalFree(cert->ctx.pCertInfo);
 125 }
 126
 127 static context_t *Cert_clone(context_t *context, WINECRYPT_CERTSTORE *store, BOOL use_link)
 128 {
 129     cert_t *cert;
 130
 131     if(use_link) {
 132         cert = (cert_t*)Context_CreateLinkContext(sizeof(CERT_CONTEXT), context, store);
 133         if(!cert)
 134             return NULL;
 135     }else {
 136         const cert_t *cloned = (const cert_t*)context;
 137         DWORD size = 0;
 138         BOOL res;
 139
 140         cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, store);
 141         if(!cert)
 142             return NULL;
 143
 144         Context_CopyProperties(&cert->ctx, &cloned->ctx);
 145
 146         cert->ctx.dwCertEncodingType = cloned->ctx.dwCertEncodingType;
 147         cert->ctx.pbCertEncoded = CryptMemAlloc(cloned->ctx.cbCertEncoded);
 148         memcpy(cert->ctx.pbCertEncoded, cloned->ctx.pbCertEncoded, cloned->ctx.cbCertEncoded);
 149         cert->ctx.cbCertEncoded = cloned->ctx.cbCertEncoded;
 150
 151         /* FIXME: We don't need to decode the object here, we could just clone cert info. */
 152         res = CryptDecodeObjectEx(cert->ctx.dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 153          cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 154          &cert->ctx.pCertInfo, &size);
 155         if(!res) {
 156             CertFreeCertificateContext(&cert->ctx);
 157             return NULL;
 158         }
 159     }
 160
 161     cert->ctx.hCertStore = store;
 162     return &cert->base;
 163 }
 164
 165 static const context_vtbl_t cert_vtbl = {
 166     Cert_free,
 167     Cert_clone
 168 };
 169
 170 static BOOL add_cert_to_store(WINECRYPT_CERTSTORE *store, const CERT_CONTEXT *cert,
 171  DWORD add_disposition, BOOL use_link, PCCERT_CONTEXT *ret_context)
 172 {
 173     const CERT_CONTEXT *existing = NULL;
 174     BOOL ret = TRUE, inherit_props = FALSE;
 175     context_t *new_context = NULL;
 176
 177     switch (add_disposition)
 178     {
 179     case CERT_STORE_ADD_ALWAYS:
 180         break;
 181     case CERT_STORE_ADD_NEW:
 182     case CERT_STORE_ADD_REPLACE_EXISTING:
 183     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 184     case CERT_STORE_ADD_USE_EXISTING:
 185     case CERT_STORE_ADD_NEWER:
 186     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 187     {
 188         BYTE hashToAdd[20];
 189         DWORD size = sizeof(hashToAdd);
 190
 191         ret = CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID,
 192          hashToAdd, &size);
 193         if (ret)
 194         {
 195             CRYPT_HASH_BLOB blob = { sizeof(hashToAdd), hashToAdd };
 196
 197             existing = CertFindCertificateInStore(store, cert->dwCertEncodingType, 0,
 198              CERT_FIND_SHA1_HASH, &blob, NULL);
 199         }
 200         break;
 201     }
 202     default:
 203         FIXME("Unimplemented add disposition %ld\n", add_disposition);
 204         SetLastError(E_INVALIDARG);
 205         return FALSE;
 206     }
 207
 208     switch (add_disposition)
 209     {
 210     case CERT_STORE_ADD_ALWAYS:
 211         break;
 212     case CERT_STORE_ADD_NEW:
 213         if (existing)
 214         {
 215             TRACE("found matching certificate, not adding\n");
 216             SetLastError(CRYPT_E_EXISTS);
 217             return FALSE;
 218         }
 219         break;
 220     case CERT_STORE_ADD_REPLACE_EXISTING:
 221         break;
 222     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 223         if (use_link)
 224             FIXME("CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES: semi-stub for links\n");
 225         if (existing)
 226             inherit_props = TRUE;
 227         break;
 228     case CERT_STORE_ADD_USE_EXISTING:
 229         if(use_link)
 230             FIXME("CERT_STORE_ADD_USE_EXISTING: semi-stub for links\n");
 231         if (existing)
 232         {
 233             Context_CopyProperties(existing, cert);
 234             if (ret_context)
 235                 *ret_context = CertDuplicateCertificateContext(existing);
 236             return TRUE;
 237         }
 238         break;
 239     case CERT_STORE_ADD_NEWER:
 240         if (existing && CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 241         {
 242             TRACE("existing certificate is newer, not adding\n");
 243             SetLastError(CRYPT_E_EXISTS);
 244             return FALSE;
 245         }
 246         break;
 247     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 248         if (existing)
 249         {
 250             if (CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 251             {
 252                 TRACE("existing certificate is newer, not adding\n");
 253                 SetLastError(CRYPT_E_EXISTS);
 254                 return FALSE;
 255             }
 256             inherit_props = TRUE;
 257         }
 258         break;
 259     }
 260
 261     /* FIXME: We have tests that this works, but what should we really do in this case? */
 262     if(!store) {
 263         if(ret_context)
 264             *ret_context = CertDuplicateCertificateContext(cert);
 265         return TRUE;
 266     }
 267
 268     ret = store->vtbl->certs.addContext(store, context_from_ptr(cert), existing ? context_from_ptr(existing) : NULL,
 269      (ret_context || inherit_props) ? &new_context : NULL, use_link);
 270     if(!ret)
 271         return FALSE;
 272
 273     if(inherit_props)
 274         Context_CopyProperties(context_ptr(new_context), existing);
 275
 276     if(ret_context)
 277         *ret_context = context_ptr(new_context);
 278     else if(new_context)
 279         Context_Release(new_context);
 280
 281     TRACE("returning %d\n", ret);
 282     return ret;
 283 }
 284
 285 BOOL WINAPI CertAddCertificateContextToStore(HCERTSTORE hCertStore, PCCERT_CONTEXT pCertContext,
 286  DWORD dwAddDisposition, PCCERT_CONTEXT *ppStoreContext)
 287 {
 288     WINECRYPT_CERTSTORE *store = hCertStore;
 289
 290     TRACE("(%p, %p, %08lx, %p)\n", hCertStore, pCertContext, dwAddDisposition, ppStoreContext);
 291
 292     return add_cert_to_store(store, pCertContext, dwAddDisposition, FALSE, ppStoreContext);
 293 }
 294
 295 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
 296  PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
 297  PCCERT_CONTEXT *ppCertContext)
 298 {
 299     static int calls;
 300     WINECRYPT_CERTSTORE *store = (WINECRYPT_CERTSTORE*)hCertStore;
 301
 302     if (!(calls++))
 303         FIXME("(%p, %p, %08lx, %p): semi-stub\n", hCertStore, pCertContext,
 304          dwAddDisposition, ppCertContext);
 305     if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
 306         return FALSE;
 307     if (store->type == StoreTypeCollection)
 308     {
 309         SetLastError(E_INVALIDARG);
 310         return FALSE;
 311     }
 312     return add_cert_to_store(hCertStore, pCertContext, dwAddDisposition, TRUE, ppCertContext);
 313 }
 314
 315 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
 316  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 317 {
 318     cert_t *cert = NULL;
 319     BYTE *data = NULL;
 320     BOOL ret;
 321     PCERT_INFO certInfo = NULL;
 322     DWORD size = 0;
 323
 324     TRACE("(%08lx, %p, %ld)\n", dwCertEncodingType, pbCertEncoded,
 325      cbCertEncoded);
 326
 327     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
 328     {
 329         SetLastError(E_INVALIDARG);
 330         return NULL;
 331     }
 332
 333     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 334      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 335      &certInfo, &size);
 336     if (!ret)
 337         return NULL;
 338
 339     cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, &empty_store);
 340     if (!cert)
 341         return NULL;
 342     data = CryptMemAlloc(cbCertEncoded);
 343     if (!data)
 344     {
 345         Context_Release(&cert->base);
 346         return NULL;
 347     }
 348
 349     memcpy(data, pbCertEncoded, cbCertEncoded);
 350     cert->ctx.dwCertEncodingType = dwCertEncodingType;
 351     cert->ctx.pbCertEncoded      = data;
 352     cert->ctx.cbCertEncoded      = cbCertEncoded;
 353     cert->ctx.pCertInfo          = certInfo;
 354     cert->ctx.hCertStore         = &empty_store;
 355
 356     return &cert->ctx;
 357 }
 358
 359 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(PCCERT_CONTEXT pCertContext)
 360 {
 361     TRACE("(%p)\n", pCertContext);
 362
 363     if (!pCertContext)
 364         return NULL;
 365
 366     Context_AddRef(&cert_from_ptr(pCertContext)->base);
 367     return pCertContext;
 368 }
 369
 370 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 371 {
 372     TRACE("(%p)\n", pCertContext);
 373
 374     if (pCertContext)
 375         Context_Release(&cert_from_ptr(pCertContext)->base);
 376     return TRUE;
 377 }
 378
 379 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 380  DWORD dwPropId)
 381 {
 382     cert_t *cert = cert_from_ptr(pCertContext);
 383     DWORD ret;
 384
 385     TRACE("(%p, %ld)\n", pCertContext, dwPropId);
 386
 387     if (cert->base.properties)
 388         ret = ContextPropertyList_EnumPropIDs(cert->base.properties, dwPropId);
 389     else
 390         ret = 0;
 391     return ret;
 392 }
 393
 394 static BOOL CertContext_GetHashProp(cert_t *cert, DWORD dwPropId,
 395  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 396  DWORD *pcbData)
 397 {
 398     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 399      pcbData);
 400     if (ret && pvData)
 401     {
 402         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 403
 404         ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 405     }
 406     return ret;
 407 }
 408
 409 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 410  DWORD cb)
 411 {
 412     BOOL ret = TRUE;
 413
 414     if (!pvData)
 415         *pcbData = cb;
 416     else if (*pcbData < cb)
 417     {
 418         SetLastError(ERROR_MORE_DATA);
 419         *pcbData = cb;
 420         ret = FALSE;
 421     }
 422     else
 423     {
 424         memcpy(pvData, pb, cb);
 425         *pcbData = cb;
 426     }
 427     return ret;
 428 }
 429
 430 void CRYPT_ConvertKeyContext(const struct store_CERT_KEY_CONTEXT *src, CERT_KEY_CONTEXT *dst)
 431 {
 432     dst->cbSize = sizeof(*dst);
 433     dst->hCryptProv = src->hCryptProv;
 434     dst->dwKeySpec = src->dwKeySpec;
 435 }
 436
 437 /*
 438  * Fix offsets in a continuous block of memory of CRYPT_KEY_PROV_INFO with
 439  * its associated data.
 440  */
 441 static void fix_KeyProvInfoProperty(CRYPT_KEY_PROV_INFO *info)
 442 {
 443     BYTE *data;
 444     DWORD i;
 445
 446     data = (BYTE *)(info + 1) + sizeof(CRYPT_KEY_PROV_PARAM) * info->cProvParam;
 447
 448     if (info->pwszContainerName)
 449     {
 450         info->pwszContainerName = (LPWSTR)data;
 451         data += (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 452     }
 453
 454     if (info->pwszProvName)
 455     {
 456         info->pwszProvName = (LPWSTR)data;
 457         data += (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 458     }
 459
 460     info->rgProvParam = info->cProvParam ? (CRYPT_KEY_PROV_PARAM *)(info + 1) : NULL;
 461
 462     for (i = 0; i < info->cProvParam; i++)
 463     {
 464         info->rgProvParam[i].pbData = info->rgProvParam[i].cbData ? data : NULL;
 465         data += info->rgProvParam[i].cbData;
 466     }
 467 }
 468
 469 /*
 470  * Copy to a continuous block of memory of CRYPT_KEY_PROV_INFO with
 471  * its associated data.
 472  */
 473 static void copy_KeyProvInfoProperty(const CRYPT_KEY_PROV_INFO *from, CRYPT_KEY_PROV_INFO *to)
 474 {
 475     BYTE *data;
 476     DWORD i;
 477
 478     data = (BYTE *)(to + 1) + sizeof(CRYPT_KEY_PROV_PARAM) * from->cProvParam;
 479
 480     if (from->pwszContainerName)
 481     {
 482         to->pwszContainerName = (LPWSTR)data;
 483         lstrcpyW((LPWSTR)data, from->pwszContainerName);
 484         data += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 485     }
 486     else
 487         to->pwszContainerName = NULL;
 488
 489     if (from->pwszProvName)
 490     {
 491         to->pwszProvName = (LPWSTR)data;
 492         lstrcpyW((LPWSTR)data, from->pwszProvName);
 493         data += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 494     }
 495     else
 496         to->pwszProvName = NULL;
 497
 498     to->dwProvType = from->dwProvType;
 499     to->dwFlags = from->dwFlags;
 500     to->cProvParam = from->cProvParam;
 501     to->rgProvParam = from->cProvParam ? (CRYPT_KEY_PROV_PARAM *)(to + 1) : NULL;
 502     to->dwKeySpec = from->dwKeySpec;
 503
 504     for (i = 0; i < from->cProvParam; i++)
 505     {
 506         to->rgProvParam[i].dwParam = from->rgProvParam[i].dwParam;
 507         to->rgProvParam[i].dwFlags = from->rgProvParam[i].dwFlags;
 508         to->rgProvParam[i].cbData = from->rgProvParam[i].cbData;
 509         to->rgProvParam[i].pbData = from->rgProvParam[i].cbData ? data : NULL;
 510         memcpy(data, from->rgProvParam[i].pbData, from->rgProvParam[i].cbData);
 511         data += from->rgProvParam[i].cbData;
 512     }
 513 }
 514
 515 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
 516  void *pvData, DWORD *pcbData)
 517 {
 518     BOOL ret;
 519     CRYPT_DATA_BLOB blob;
 520
 521     TRACE("(%p, %ld, %p, %p)\n", cert, dwPropId, pvData, pcbData);
 522
 523     if (cert->base.properties)
 524         ret = ContextPropertyList_FindProperty(cert->base.properties, dwPropId, &blob);
 525     else
 526         ret = FALSE;
 527     if (ret)
 528     {
 529         CERT_KEY_CONTEXT ctx;
 530         if (dwPropId == CERT_KEY_CONTEXT_PROP_ID)
 531         {
 532             CRYPT_ConvertKeyContext((const struct store_CERT_KEY_CONTEXT *)blob.pbData, &ctx);
 533             blob.pbData = (BYTE *)&ctx;
 534             blob.cbData = ctx.cbSize;
 535         }
 536         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 537     }
 538     else
 539     {
 540         /* Implicit properties */
 541         switch (dwPropId)
 542         {
 543         case CERT_SHA1_HASH_PROP_ID:
 544             ret = CertContext_GetHashProp(cert, dwPropId, CALG_SHA1,
 545              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 546              pcbData);
 547             break;
 548         case CERT_MD5_HASH_PROP_ID:
 549             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 550              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 551              pcbData);
 552             break;
 553         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 554             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 555              cert->ctx.pCertInfo->Subject.pbData,
 556              cert->ctx.pCertInfo->Subject.cbData,
 557              pvData, pcbData);
 558             break;
 559         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 560             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 561              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 562              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 563              pvData, pcbData);
 564             break;
 565         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 566             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 567              cert->ctx.pCertInfo->SerialNumber.pbData,
 568              cert->ctx.pCertInfo->SerialNumber.cbData,
 569              pvData, pcbData);
 570             break;
 571         case CERT_SIGNATURE_HASH_PROP_ID:
 572             ret = CryptHashToBeSigned(0, cert->ctx.dwCertEncodingType,
 573              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 574              pcbData);
 575             if (ret && pvData)
 576             {
 577                 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 578
 579                 ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 580             }
 581             break;
 582         case CERT_KEY_IDENTIFIER_PROP_ID:
 583         {
 584             PCERT_EXTENSION ext = CertFindExtension(
 585              szOID_SUBJECT_KEY_IDENTIFIER, cert->ctx.pCertInfo->cExtension,
 586              cert->ctx.pCertInfo->rgExtension);
 587
 588             if (ext)
 589             {
 590                 CRYPT_DATA_BLOB value;
 591                 DWORD size = sizeof(value);
 592
 593                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 594                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 595                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 596                  &size);
 597                 if (ret)
 598                 {
 599                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 600                      value.cbData);
 601                     CertContext_SetProperty(cert, dwPropId, 0, &value);
 602                 }
 603             }
 604             else
 605                 SetLastError(ERROR_INVALID_DATA);
 606             break;
 607         }
 608         default:
 609             SetLastError(CRYPT_E_NOT_FOUND);
 610         }
 611     }
 612     TRACE("returning %d\n", ret);
 613     return ret;
 614 }
 615
 616 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 617  DWORD dwPropId, void *pvData, DWORD *pcbData)
 618 {
 619     cert_t *cert = cert_from_ptr(pCertContext);
 620     BOOL ret;
 621
 622     TRACE("(%p, %ld, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 623
 624     switch (dwPropId)
 625     {
 626     case 0:
 627     case CERT_CERT_PROP_ID:
 628     case CERT_CRL_PROP_ID:
 629     case CERT_CTL_PROP_ID:
 630         SetLastError(E_INVALIDARG);
 631         ret = FALSE;
 632         break;
 633     case CERT_ACCESS_STATE_PROP_ID:
 634         ret = CertGetStoreProperty(cert->ctx.hCertStore, dwPropId, pvData, pcbData);
 635         break;
 636     case CERT_KEY_PROV_HANDLE_PROP_ID:
 637     {
 638         CERT_KEY_CONTEXT keyContext;
 639         DWORD size = sizeof(keyContext);
 640
 641         ret = CertContext_GetProperty(cert,
 642          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 643         if (ret)
 644             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 645              sizeof(keyContext.hCryptProv));
 646         break;
 647     }
 648     case CERT_KEY_PROV_INFO_PROP_ID:
 649         ret = CertContext_GetProperty(cert, dwPropId, pvData, pcbData);
 650         if (ret && pvData)
 651             fix_KeyProvInfoProperty(pvData);
 652         break;
 653     default:
 654         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 655          pcbData);
 656     }
 657
 658     TRACE("returning %d\n", ret);
 659     return ret;
 660 }
 661
 662 /*
 663  * Create a continuous block of memory for CRYPT_KEY_PROV_INFO with
 664  * its associated data, and add it to the certificate properties.
 665  */
 666 static BOOL CertContext_SetKeyProvInfoProperty(CONTEXT_PROPERTY_LIST *properties, const CRYPT_KEY_PROV_INFO *info)
 667 {
 668     CRYPT_KEY_PROV_INFO *prop;
 669     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i;
 670     BOOL ret;
 671
 672     if (info->pwszContainerName)
 673         size += (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 674     if (info->pwszProvName)
 675         size += (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 676
 677     for (i = 0; i < info->cProvParam; i++)
 678         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 679
 680     prop = CryptMemAlloc(size);
 681     if (!prop)
 682     {
 683         SetLastError(ERROR_OUTOFMEMORY);
 684         return FALSE;
 685     }
 686
 687     copy_KeyProvInfoProperty(info, prop);
 688
 689     ret = ContextPropertyList_SetProperty(properties, CERT_KEY_PROV_INFO_PROP_ID, (const BYTE *)prop, size);
 690     CryptMemFree(prop);
 691
 692     return ret;
 693 }
 694
 695 static BOOL CertContext_SetKeyContextProperty(CONTEXT_PROPERTY_LIST *properties,
 696  const CERT_KEY_CONTEXT *keyContext)
 697 {
 698     struct store_CERT_KEY_CONTEXT ctx;
 699
 700     ctx.cbSize = sizeof(ctx);
 701     ctx.hCryptProv = keyContext->hCryptProv;
 702     ctx.dwKeySpec = keyContext->dwKeySpec;
 703
 704     return ContextPropertyList_SetProperty(properties, CERT_KEY_CONTEXT_PROP_ID,
 705      (const BYTE *)&ctx, ctx.cbSize);
 706 }
 707
 708 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
 709  DWORD dwFlags, const void *pvData)
 710 {
 711     BOOL ret;
 712
 713     TRACE("(%p, %ld, %08lx, %p)\n", cert, dwPropId, dwFlags, pvData);
 714
 715     if (!cert->base.properties)
 716         ret = FALSE;
 717     else
 718     {
 719         switch (dwPropId)
 720         {
 721         case CERT_AUTO_ENROLL_PROP_ID:
 722         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 723         case CERT_DESCRIPTION_PROP_ID:
 724         case CERT_FRIENDLY_NAME_PROP_ID:
 725         case CERT_HASH_PROP_ID:
 726         case CERT_KEY_IDENTIFIER_PROP_ID:
 727         case CERT_MD5_HASH_PROP_ID:
 728         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 729         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 730         case CERT_PVK_FILE_PROP_ID:
 731         case CERT_SIGNATURE_HASH_PROP_ID:
 732         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 733         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 734         case CERT_EXTENDED_ERROR_INFO_PROP_ID:
 735         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 736         case CERT_ENROLLMENT_PROP_ID:
 737         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 738         case CERT_OCSP_RESPONSE_PROP_ID:
 739         case CERT_RENEWAL_PROP_ID:
 740         {
 741             if (pvData)
 742             {
 743                 const CRYPT_DATA_BLOB *blob = pvData;
 744
 745                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 746                  blob->pbData, blob->cbData);
 747             }
 748             else
 749             {
 750                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 751                 ret = TRUE;
 752             }
 753             break;
 754         }
 755         case CERT_DATE_STAMP_PROP_ID:
 756             if (pvData)
 757                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 758                  pvData, sizeof(FILETIME));
 759             else
 760             {
 761                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 762                 ret = TRUE;
 763             }
 764             break;
 765         case CERT_KEY_CONTEXT_PROP_ID:
 766             if (pvData)
 767             {
 768                 const CERT_KEY_CONTEXT *keyContext = pvData;
 769
 770                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 771                 {
 772                     SetLastError(E_INVALIDARG);
 773                     ret = FALSE;
 774                 }
 775                 else
 776                     ret = CertContext_SetKeyContextProperty(cert->base.properties, pvData);
 777             }
 778             else
 779             {
 780                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 781                 ret = TRUE;
 782             }
 783             break;
 784         case CERT_KEY_PROV_INFO_PROP_ID:
 785             if (pvData)
 786                 ret = CertContext_SetKeyProvInfoProperty(cert->base.properties, pvData);
 787             else
 788             {
 789                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 790                 ret = TRUE;
 791             }
 792             break;
 793         case CERT_KEY_PROV_HANDLE_PROP_ID:
 794         {
 795             CERT_KEY_CONTEXT keyContext;
 796             DWORD size = sizeof(keyContext);
 797
 798             ret = CertContext_GetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 799              &keyContext, &size);
 800             if (ret)
 801             {
 802                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 803                     CryptReleaseContext(keyContext.hCryptProv, 0);
 804             }
 805             keyContext.cbSize = sizeof(keyContext);
 806             if (pvData)
 807                 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 808             else
 809             {
 810                 keyContext.hCryptProv = 0;
 811                 keyContext.dwKeySpec = AT_SIGNATURE;
 812             }
 813             ret = CertContext_SetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 814              0, &keyContext);
 815             break;
 816         }
 817         default:
 818             FIXME("%ld: stub\n", dwPropId);
 819             ret = FALSE;
 820         }
 821     }
 822     TRACE("returning %d\n", ret);
 823     return ret;
 824 }
 825
 826 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 827  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 828 {
 829     BOOL ret;
 830
 831     TRACE("(%p, %ld, %08lx, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 832
 833     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 834      * crashes on most of these, I'll be safer.
 835      */
 836     switch (dwPropId)
 837     {
 838     case 0:
 839     case CERT_ACCESS_STATE_PROP_ID:
 840     case CERT_CERT_PROP_ID:
 841     case CERT_CRL_PROP_ID:
 842     case CERT_CTL_PROP_ID:
 843         SetLastError(E_INVALIDARG);
 844         return FALSE;
 845     }
 846     ret = CertContext_SetProperty(cert_from_ptr(pCertContext), dwPropId, dwFlags,
 847      pvData);
 848     TRACE("returning %d\n", ret);
 849     return ret;
 850 }
 851
 852 /* Acquires the private key using the key provider info, retrieving info from
 853  * the certificate if info is NULL.  The acquired provider is returned in
 854  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 855  */
 856 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert, DWORD dwFlags,
 857  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 858 {
 859     DWORD size = 0;
 860     BOOL allocated = FALSE, ret = TRUE;
 861
 862     if (!info)
 863     {
 864         ret = CertGetCertificateContextProperty(pCert,
 865          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 866         if (ret)
 867         {
 868             info = CryptMemAlloc(size);
 869             if (info)
 870             {
 871                 ret = CertGetCertificateContextProperty(pCert,
 872                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 873                 allocated = TRUE;
 874             }
 875             else
 876             {
 877                 SetLastError(ERROR_OUTOFMEMORY);
 878                 ret = FALSE;
 879             }
 880         }
 881         else
 882             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 883     }
 884     if (ret)
 885     {
 886         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 887          info->pwszProvName, info->dwProvType, (dwFlags & CRYPT_ACQUIRE_SILENT_FLAG) ? CRYPT_SILENT : 0);
 888         if (ret)
 889         {
 890             DWORD i;
 891
 892             for (i = 0; i < info->cProvParam; i++)
 893             {
 894                 CryptSetProvParam(*phCryptProv,
 895                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 896                  info->rgProvParam[i].dwFlags);
 897             }
 898             *pdwKeySpec = info->dwKeySpec;
 899         }
 900         else
 901             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 902     }
 903     if (allocated)
 904         CryptMemFree(info);
 905     return ret;
 906 }
 907
 908 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 909  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 910  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 911 {
 912     BOOL ret = FALSE, cache = FALSE;
 913     PCRYPT_KEY_PROV_INFO info = NULL;
 914     CERT_KEY_CONTEXT keyContext;
 915     DWORD size;
 916     PCCERT_CONTEXT cert_in_store = NULL;
 917
 918     TRACE("(%p, %08lx, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 919      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 920
 921     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 922     {
 923         DWORD size = 0;
 924
 925         ret = CertGetCertificateContextProperty(pCert,
 926          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 927
 928         if (!ret)
 929         {
 930             HCERTSTORE hstore;
 931
 932             hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, 0,
 933                                    CERT_SYSTEM_STORE_CURRENT_USER, L"My");
 934             if (hstore)
 935             {
 936                 cert_in_store = CertFindCertificateInStore(hstore, pCert->dwCertEncodingType, 0,
 937                                                            CERT_FIND_EXISTING, pCert, NULL);
 938                 if (cert_in_store)
 939                 {
 940                     ret = CertGetCertificateContextProperty(cert_in_store, CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 941                     if (ret)
 942                         pCert = cert_in_store;
 943                     else
 944                     {
 945                         CertFreeCertificateContext(cert_in_store);
 946                         cert_in_store = NULL;
 947                     }
 948                 }
 949
 950                 CertCloseStore(hstore, 0);
 951             }
 952         }
 953
 954         if (ret)
 955         {
 956             info = CryptMemAlloc(size);
 957             ret = CertGetCertificateContextProperty(pCert,
 958              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 959             if (ret)
 960                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 961         }
 962     }
 963     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 964         cache = TRUE;
 965     *phCryptProv = 0;
 966     if (cache)
 967     {
 968         size = sizeof(keyContext);
 969         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 970          &keyContext, &size);
 971         if (ret)
 972         {
 973             *phCryptProv = keyContext.hCryptProv;
 974             if (pdwKeySpec)
 975                 *pdwKeySpec = keyContext.dwKeySpec;
 976             if (pfCallerFreeProv)
 977                 *pfCallerFreeProv = FALSE;
 978         }
 979     }
 980     if (!*phCryptProv)
 981     {
 982         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, dwFlags, info,
 983          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 984         if (ret)
 985         {
 986             *phCryptProv = keyContext.hCryptProv;
 987             if (pdwKeySpec)
 988                 *pdwKeySpec = keyContext.dwKeySpec;
 989             if (cache)
 990             {
 991                 keyContext.cbSize = sizeof(keyContext);
 992                 if (CertSetCertificateContextProperty(pCert,
 993                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 994                 {
 995                     if (pfCallerFreeProv)
 996                         *pfCallerFreeProv = FALSE;
 997                 }
 998             }
 999             else
1000             {
1001                 if (pfCallerFreeProv)
1002                     *pfCallerFreeProv = TRUE;
1003             }
1004         }
1005     }
1006     CryptMemFree(info);
1007     if (cert_in_store)
1008         CertFreeCertificateContext(cert_in_store);
1009     if (ret) SetLastError(0);
1010     return ret;
1011 }
1012
1013 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
1014  const CRYPT_KEY_PROV_INFO *keyProvInfo)
1015 {
1016     HCRYPTPROV csp;
1017     BOOL matches = FALSE;
1018
1019     if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
1020      keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
1021     {
1022         DWORD size;
1023
1024         /* Need to sign something to verify the sig.  What to sign?  Why not
1025          * the certificate itself?
1026          */
1027         if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
1028          pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
1029          &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
1030         {
1031             BYTE *certEncoded = CryptMemAlloc(size);
1032
1033             if (certEncoded)
1034             {
1035                 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
1036                  pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
1037                  pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
1038                  NULL, certEncoded, &size))
1039                 {
1040                     if (size == pCert->cbCertEncoded &&
1041                      !memcmp(certEncoded, pCert->pbCertEncoded, size))
1042                         matches = TRUE;
1043                 }
1044                 CryptMemFree(certEncoded);
1045             }
1046         }
1047         CryptReleaseContext(csp, 0);
1048     }
1049     return matches;
1050 }
1051
1052 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
1053  CRYPT_KEY_PROV_INFO *keyProvInfo)
1054 {
1055     CRYPT_KEY_PROV_INFO copy;
1056     WCHAR containerW[MAX_PATH];
1057     BOOL matches;
1058
1059     MultiByteToWideChar(CP_ACP, 0, container, -1, containerW, ARRAY_SIZE(containerW));
1060     /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
1061      * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
1062      * name.
1063      */
1064     copy = *keyProvInfo;
1065     copy.pwszContainerName = containerW;
1066     matches = key_prov_info_matches_cert(pCert, &copy);
1067     if (matches)
1068     {
1069         keyProvInfo->pwszContainerName =
1070          CryptMemAlloc((lstrlenW(containerW) + 1) * sizeof(WCHAR));
1071         if (keyProvInfo->pwszContainerName)
1072         {
1073             lstrcpyW(keyProvInfo->pwszContainerName, containerW);
1074             keyProvInfo->dwKeySpec = AT_SIGNATURE;
1075         }
1076         else
1077             matches = FALSE;
1078     }
1079     return matches;
1080 }
1081
1082 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
1083  * private key matches pCert's public key.  Upon success, updates keyProvInfo
1084  * with the matching container's info (free keyProvInfo.pwszContainerName upon
1085  * success.)
1086  * Returns TRUE if found, FALSE if not.
1087  */
1088 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
1089  CRYPT_KEY_PROV_INFO *keyProvInfo)
1090 {
1091     HCRYPTPROV defProvider;
1092     BOOL ret, found = FALSE;
1093     char containerA[MAX_PATH];
1094
1095     assert(keyProvInfo->pwszContainerName == NULL);
1096     if ((ret = CryptAcquireContextW(&defProvider, NULL,
1097      keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
1098      keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
1099     {
1100         DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
1101
1102         while (ret && !found)
1103         {
1104             DWORD size = sizeof(containerA);
1105
1106             ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
1107              (BYTE *)containerA, &size, enumFlags);
1108             if (ret)
1109                 found = container_matches_cert(pCert, containerA, keyProvInfo);
1110             if (enumFlags & CRYPT_FIRST)
1111             {
1112                 enumFlags &= ~CRYPT_FIRST;
1113                 enumFlags |= CRYPT_NEXT;
1114             }
1115         }
1116         CryptReleaseContext(defProvider, 0);
1117     }
1118     return found;
1119 }
1120
1121 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
1122 {
1123     BOOL found = FALSE, ret = TRUE;
1124     DWORD index = 0, cbProvName = 0;
1125     CRYPT_KEY_PROV_INFO keyProvInfo;
1126
1127     TRACE("(%p, %08lx)\n", pCert, dwFlags);
1128
1129     memset(&keyProvInfo, 0, sizeof(keyProvInfo));
1130     while (ret && !found)
1131     {
1132         DWORD size = 0;
1133
1134         ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
1135          NULL, &size);
1136         if (ret)
1137         {
1138             if (size <= cbProvName)
1139                 ret = CryptEnumProvidersW(index, NULL, 0,
1140                  &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1141             else
1142             {
1143                 CryptMemFree(keyProvInfo.pwszProvName);
1144                 keyProvInfo.pwszProvName = CryptMemAlloc(size);
1145                 if (keyProvInfo.pwszProvName)
1146                 {
1147                     cbProvName = size;
1148                     ret = CryptEnumProvidersW(index, NULL, 0,
1149                      &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1150                     if (ret)
1151                     {
1152                         if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
1153                             keyProvInfo.dwFlags |= CRYPT_SILENT;
1154                         if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
1155                          !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1156                          CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1157                         {
1158                             keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
1159                             found = find_key_prov_info_in_provider(pCert,
1160                              &keyProvInfo);
1161                         }
1162                         if (!found)
1163                         {
1164                             if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
1165                              !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1166                              CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1167                             {
1168                                 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
1169                                 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
1170                                 found = find_key_prov_info_in_provider(pCert,
1171                                  &keyProvInfo);
1172                             }
1173                         }
1174                     }
1175                 }
1176                 else
1177                     ret = FALSE;
1178             }
1179             index++;
1180         }
1181     }
1182     if (found)
1183         CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1184          0, &keyProvInfo);
1185     CryptMemFree(keyProvInfo.pwszProvName);
1186     CryptMemFree(keyProvInfo.pwszContainerName);
1187     return found;
1188 }
1189
1190 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
1191 {
1192     BOOL matches = FALSE;
1193     DWORD size;
1194
1195     if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1196      NULL, &size))
1197     {
1198         CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
1199
1200         if (keyProvInfo)
1201         {
1202             if (CertGetCertificateContextProperty(pCert,
1203              CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
1204                 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
1205             CryptMemFree(keyProvInfo);
1206         }
1207     }
1208     return matches;
1209 }
1210
1211 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
1212  DWORD dwFlags, void *pvReserved)
1213 {
1214     BOOL matches;
1215
1216     TRACE("(%p, %08lx, %p)\n", pCert, dwFlags, pvReserved);
1217
1218     matches = cert_prov_info_matches_cert(pCert);
1219     if (!matches)
1220         matches = find_matching_provider(pCert, dwFlags);
1221     return matches;
1222 }
1223
1224 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1225  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1226 {
1227     BOOL ret;
1228
1229     TRACE("(%08lx, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1230
1231     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1232      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1233      &pCertId2->SerialNumber);
1234     TRACE("returning %d\n", ret);
1235     return ret;
1236 }
1237
1238 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1239  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1240 {
1241     BOOL ret;
1242
1243     TRACE("(%08lx, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1244
1245     if (pCertName1->cbData == pCertName2->cbData)
1246     {
1247         if (pCertName1->cbData)
1248             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1249              pCertName1->cbData);
1250         else
1251             ret = TRUE;
1252     }
1253     else
1254         ret = FALSE;
1255     TRACE("returning %d\n", ret);
1256     return ret;
1257 }
1258
1259 /* Returns the number of significant bytes in pInt, where a byte is
1260  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1261  * for negative numbers.  pInt is assumed to be little-endian.
1262  */
1263 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1264 {
1265     DWORD ret = pInt->cbData;
1266
1267     while (ret > 1)
1268     {
1269         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1270             ret--;
1271         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1272             ret--;
1273         else
1274             break;
1275     }
1276     return ret;
1277 }
1278
1279 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1280  PCRYPT_INTEGER_BLOB pInt2)
1281 {
1282     BOOL ret;
1283     DWORD cb1, cb2;
1284
1285     TRACE("(%p, %p)\n", pInt1, pInt2);
1286
1287     cb1 = CRYPT_significantBytes(pInt1);
1288     cb2 = CRYPT_significantBytes(pInt2);
1289     if (cb1 == cb2)
1290     {
1291         if (cb1)
1292             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1293         else
1294             ret = TRUE;
1295     }
1296     else
1297         ret = FALSE;
1298     TRACE("returning %d\n", ret);
1299     return ret;
1300 }
1301
1302 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1303  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1304 {
1305     BOOL ret;
1306
1307     TRACE("(%08lx, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1308
1309     /* RSA public key data should start with ASN_SEQUENCE,
1310      * otherwise it's not a RSA_CSP_PUBLICKEYBLOB.
1311      */
1312     if (!pPublicKey1->PublicKey.cbData || pPublicKey1->PublicKey.pbData[0] != ASN_SEQUENCE)
1313         dwCertEncodingType = 0;
1314
1315     switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1316     {
1317     case 0:     /* Seems to mean "raw binary bits" */
1318         if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1319          pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1320         {
1321           if (pPublicKey2->PublicKey.cbData)
1322               ret = !memcmp(pPublicKey1->PublicKey.pbData,
1323                pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1324           else
1325               ret = TRUE;
1326         }
1327         else
1328             ret = FALSE;
1329         break;
1330     default:
1331         WARN("Unknown encoding type %08lx\n", dwCertEncodingType);
1332         /* FALLTHROUGH */
1333     case X509_ASN_ENCODING:
1334     {
1335         BLOBHEADER *pblob1, *pblob2;
1336         DWORD length;
1337         ret = FALSE;
1338         if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1339                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1340                     CRYPT_DECODE_ALLOC_FLAG, &pblob1, &length))
1341         {
1342             if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1343                         pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1344                         CRYPT_DECODE_ALLOC_FLAG, &pblob2, &length))
1345             {
1346                 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1347                 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1348                           *pk2 = (LPVOID)(pblob2 + 1);
1349                 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1350                          && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1351
1352                 LocalFree(pblob2);
1353             }
1354             LocalFree(pblob1);
1355         }
1356
1357         break;
1358     }
1359     }
1360     return ret;
1361 }
1362
1363 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1364  PCERT_PUBLIC_KEY_INFO pPublicKey)
1365 {
1366     DWORD len = 0;
1367
1368     TRACE("(%08lx, %p)\n", dwCertEncodingType, pPublicKey);
1369
1370     if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1371     {
1372         SetLastError(ERROR_FILE_NOT_FOUND);
1373         return 0;
1374     }
1375     if (pPublicKey->Algorithm.pszObjId &&
1376      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1377     {
1378         FIXME("unimplemented for DH public keys\n");
1379         SetLastError(CRYPT_E_ASN1_BADTAG);
1380     }
1381     else
1382     {
1383         PCCRYPT_OID_INFO info;
1384         DWORD size;
1385         PBYTE buf;
1386         BOOL ret;
1387
1388         info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY, pPublicKey->Algorithm.pszObjId, 0);
1389         if (info)
1390         {
1391             HCRYPTKEY key;
1392
1393             TRACE("public key algid %#x (%s)\n", info->u.Algid, debugstr_a(pPublicKey->Algorithm.pszObjId));
1394
1395             ret = CryptImportPublicKeyInfo(I_CryptGetDefaultCryptProv(info->u.Algid), dwCertEncodingType, pPublicKey, &key);
1396             if (ret)
1397             {
1398                 size = sizeof(len);
1399                 ret = CryptGetKeyParam(key, KP_KEYLEN, (BYTE *)&len, &size, 0);
1400                 CryptDestroyKey(key);
1401                 return len;
1402             }
1403             /* fallback to RSA */
1404         }
1405
1406         ret = CryptDecodeObjectEx(dwCertEncodingType,
1407          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1408          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1409          &size);
1410
1411         if (ret)
1412         {
1413             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1414
1415             len = rsaPubKey->bitlen;
1416             LocalFree(buf);
1417         }
1418     }
1419     return len;
1420 }
1421
1422 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1423  DWORD dwFlags, const void *pvPara);
1424
1425 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1426  DWORD dwFlags, const void *pvPara)
1427 {
1428     BOOL ret;
1429     BYTE hash[16];
1430     DWORD size = sizeof(hash);
1431
1432     ret = CertGetCertificateContextProperty(pCertContext,
1433      CERT_MD5_HASH_PROP_ID, hash, &size);
1434     if (ret)
1435     {
1436         const CRYPT_HASH_BLOB *pHash = pvPara;
1437
1438         if (size == pHash->cbData)
1439             ret = !memcmp(pHash->pbData, hash, size);
1440         else
1441             ret = FALSE;
1442     }
1443     return ret;
1444 }
1445
1446 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1447  DWORD dwFlags, const void *pvPara)
1448 {
1449     BOOL ret;
1450     BYTE hash[20];
1451     DWORD size = sizeof(hash);
1452
1453     ret = CertGetCertificateContextProperty(pCertContext,
1454      CERT_SHA1_HASH_PROP_ID, hash, &size);
1455     if (ret)
1456     {
1457         const CRYPT_HASH_BLOB *pHash = pvPara;
1458
1459         if (size == pHash->cbData)
1460             ret = !memcmp(pHash->pbData, hash, size);
1461         else
1462             ret = FALSE;
1463     }
1464     return ret;
1465 }
1466
1467 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1468  DWORD dwFlags, const void *pvPara)
1469 {
1470     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1471     BOOL ret;
1472
1473     if (dwType & CERT_INFO_SUBJECT_FLAG)
1474         toCompare = &pCertContext->pCertInfo->Subject;
1475     else
1476         toCompare = &pCertContext->pCertInfo->Issuer;
1477     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1478      toCompare, blob);
1479     return ret;
1480 }
1481
1482 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1483  DWORD dwType, DWORD dwFlags, const void *pvPara)
1484 {
1485     CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1486     BOOL ret;
1487
1488     ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1489      &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1490     return ret;
1491 }
1492
1493 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1494  DWORD dwType, DWORD dwFlags, const void *pvPara)
1495 {
1496     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1497     BOOL ret;
1498
1499     /* Matching serial number and subject match.. */
1500     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1501      &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1502     if (ret)
1503         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1504          &pCertInfo->SerialNumber);
1505     else
1506     {
1507         /* failing that, if the serial number and issuer match, we match */
1508         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1509          &pCertInfo->SerialNumber);
1510         if (ret)
1511             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1512              &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1513     }
1514     TRACE("returning %d\n", ret);
1515     return ret;
1516 }
1517
1518 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1519  DWORD dwFlags, const void *pvPara)
1520 {
1521     CERT_ID *id = (CERT_ID *)pvPara;
1522     BOOL ret;
1523
1524     switch (id->dwIdChoice)
1525     {
1526     case CERT_ID_ISSUER_SERIAL_NUMBER:
1527         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1528          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1529         if (ret)
1530             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1531              &id->u.IssuerSerialNumber.SerialNumber);
1532         break;
1533     case CERT_ID_SHA1_HASH:
1534         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1535          &id->u.HashId);
1536         break;
1537     case CERT_ID_KEY_IDENTIFIER:
1538     {
1539         DWORD size = 0;
1540
1541         ret = CertGetCertificateContextProperty(pCertContext,
1542          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1543         if (ret && size == id->u.KeyId.cbData)
1544         {
1545             LPBYTE buf = CryptMemAlloc(size);
1546
1547             if (buf)
1548             {
1549                 CertGetCertificateContextProperty(pCertContext,
1550                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1551                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1552                 CryptMemFree(buf);
1553             }
1554             else
1555                 ret = FALSE;
1556         }
1557         else
1558             ret = FALSE;
1559         break;
1560     }
1561     default:
1562         ret = FALSE;
1563         break;
1564     }
1565     return ret;
1566 }
1567
1568 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1569  DWORD dwFlags, const void *pvPara)
1570 {
1571     PCCERT_CONTEXT toCompare = pvPara;
1572     return CertCompareCertificate(pCertContext->dwCertEncodingType,
1573      pCertContext->pCertInfo, toCompare->pCertInfo);
1574 }
1575
1576 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1577  DWORD dwFlags, const void *pvPara)
1578 {
1579     const CRYPT_HASH_BLOB *hash = pvPara;
1580     DWORD size = 0;
1581     BOOL ret;
1582
1583     ret = CertGetCertificateContextProperty(pCertContext,
1584      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1585     if (ret && size == hash->cbData)
1586     {
1587         LPBYTE buf = CryptMemAlloc(size);
1588
1589         if (buf)
1590         {
1591             CertGetCertificateContextProperty(pCertContext,
1592              CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1593             ret = !memcmp(buf, hash->pbData, size);
1594             CryptMemFree(buf);
1595         }
1596         else
1597             ret = FALSE;
1598     }
1599     else
1600         ret = FALSE;
1601     return ret;
1602 }
1603
1604 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1605  PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1606  const void *pvPara)
1607 {
1608     BOOL matches = FALSE;
1609     PCCERT_CONTEXT ret;
1610
1611     ret = prev;
1612     do {
1613         ret = CertEnumCertificatesInStore(store, ret);
1614         if (ret)
1615             matches = compare(ret, dwType, dwFlags, pvPara);
1616     } while (ret != NULL && !matches);
1617     return ret;
1618 }
1619
1620 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1621  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1622
1623 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1624  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1625 {
1626     return CertEnumCertificatesInStore(store, prev);
1627 }
1628
1629 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1630  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1631 {
1632     BOOL ret;
1633     PCCERT_CONTEXT found = NULL, subject = pvPara;
1634     PCERT_EXTENSION ext;
1635     DWORD size;
1636
1637     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1638      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1639     {
1640         CERT_AUTHORITY_KEY_ID_INFO *info;
1641
1642         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1643          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1644          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1645          &info, &size);
1646         if (ret)
1647         {
1648             CERT_ID id;
1649
1650             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1651             {
1652                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1653                 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1654                  sizeof(CERT_NAME_BLOB));
1655                 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1656                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1657             }
1658             else if (info->KeyId.cbData)
1659             {
1660                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1661                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1662             }
1663             else
1664                 ret = FALSE;
1665             if (ret)
1666                 found = cert_compare_certs_in_store(store, prev,
1667                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1668             LocalFree(info);
1669         }
1670     }
1671     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1672      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1673     {
1674         CERT_AUTHORITY_KEY_ID2_INFO *info;
1675
1676         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1677          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1678          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1679          &info, &size);
1680         if (ret)
1681         {
1682             CERT_ID id;
1683
1684             if (info->AuthorityCertIssuer.cAltEntry &&
1685              info->AuthorityCertSerialNumber.cbData)
1686             {
1687                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1688                 DWORD i;
1689
1690                 for (i = 0; !directoryName &&
1691                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1692                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1693                      == CERT_ALT_NAME_DIRECTORY_NAME)
1694                         directoryName =
1695                          &info->AuthorityCertIssuer.rgAltEntry[i];
1696                 if (directoryName)
1697                 {
1698                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1699                     memcpy(&id.u.IssuerSerialNumber.Issuer,
1700                      &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1701                     memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1702                      &info->AuthorityCertSerialNumber,
1703                      sizeof(CRYPT_INTEGER_BLOB));
1704                 }
1705                 else
1706                 {
1707                     FIXME("no supported name type in authority key id2\n");
1708                     ret = FALSE;
1709                 }
1710             }
1711             else if (info->KeyId.cbData)
1712             {
1713                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1714                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1715             }
1716             else
1717                 ret = FALSE;
1718             if (ret)
1719                 found = cert_compare_certs_in_store(store, prev,
1720                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1721             LocalFree(info);
1722         }
1723     }
1724     else
1725        found = cert_compare_certs_in_store(store, prev,
1726         compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1727         dwFlags, &subject->pCertInfo->Issuer);
1728     return found;
1729 }
1730
1731 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1732  DWORD dwType, DWORD dwFlags, const void *pvPara)
1733 {
1734     PCERT_NAME_BLOB name;
1735     DWORD len;
1736     BOOL ret = FALSE;
1737
1738     if (dwType & CERT_INFO_SUBJECT_FLAG)
1739         name = &pCertContext->pCertInfo->Subject;
1740     else
1741         name = &pCertContext->pCertInfo->Issuer;
1742     len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1743      CERT_SIMPLE_NAME_STR, NULL, 0);
1744     if (len)
1745     {
1746         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1747
1748         if (str)
1749         {
1750             CertNameToStrW(pCertContext->dwCertEncodingType, name,
1751              CERT_SIMPLE_NAME_STR, str, len);
1752             wcslwr(str);
1753             if (wcsstr(str, pvPara))
1754                 ret = TRUE;
1755             CryptMemFree(str);
1756         }
1757     }
1758     return ret;
1759 }
1760
1761 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1762  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1763 {
1764     PCCERT_CONTEXT found = NULL;
1765
1766     TRACE("%s\n", debugstr_a(pvPara));
1767
1768     if (pvPara)
1769     {
1770         int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1771         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1772
1773         if (str)
1774         {
1775             MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1776             wcslwr(str);
1777             found = cert_compare_certs_in_store(store, prev,
1778              compare_cert_by_name_str, dwType, dwFlags, str);
1779             CryptMemFree(str);
1780         }
1781     }
1782     else
1783         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1784     return found;
1785 }
1786
1787 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1788  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1789 {
1790     PCCERT_CONTEXT found = NULL;
1791
1792     TRACE("%s\n", debugstr_w(pvPara));
1793
1794     if (pvPara)
1795     {
1796         DWORD len = lstrlenW(pvPara);
1797         LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1798
1799         if (str)
1800         {
1801             wcscpy( str, pvPara );
1802             wcslwr( str );
1803            found = cert_compare_certs_in_store(store, prev,
1804             compare_cert_by_name_str, dwType, dwFlags, str);
1805            CryptMemFree(str);
1806         }
1807     }
1808     else
1809         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1810     return found;
1811 }
1812
1813 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1814  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1815  PCCERT_CONTEXT pPrevCertContext)
1816 {
1817     PCCERT_CONTEXT ret;
1818     CertFindFunc find = NULL;
1819     CertCompareFunc compare = NULL;
1820     CERT_ID cert_id;
1821
1822     TRACE("(%p, %08lx, %08lx, %08lx, %p, %p)\n", hCertStore, dwCertEncodingType,
1823          dwFlags, dwType, pvPara, pPrevCertContext);
1824
1825     switch (dwType >> CERT_COMPARE_SHIFT)
1826     {
1827     case CERT_COMPARE_ANY:
1828         find = find_cert_any;
1829         break;
1830     case CERT_COMPARE_MD5_HASH:
1831         compare = compare_cert_by_md5_hash;
1832         break;
1833     case CERT_COMPARE_SHA1_HASH:
1834         compare = compare_cert_by_sha1_hash;
1835         break;
1836     case CERT_COMPARE_NAME:
1837         compare = compare_cert_by_name;
1838         break;
1839     case CERT_COMPARE_PUBLIC_KEY:
1840         compare = compare_cert_by_public_key;
1841         break;
1842     case CERT_COMPARE_NAME_STR_A:
1843         find = find_cert_by_name_str_a;
1844         break;
1845     case CERT_COMPARE_NAME_STR_W:
1846         find = find_cert_by_name_str_w;
1847         break;
1848     case CERT_COMPARE_SUBJECT_CERT:
1849         compare = compare_cert_by_subject_cert;
1850         break;
1851     case CERT_COMPARE_KEY_IDENTIFIER:
1852         cert_id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1853         cert_id.u.KeyId = *(const CRYPT_HASH_BLOB *)pvPara;
1854         pvPara = &cert_id;
1855         /* fall through */
1856     case CERT_COMPARE_CERT_ID:
1857         compare = compare_cert_by_cert_id;
1858         break;
1859     case CERT_COMPARE_ISSUER_OF:
1860         find = find_cert_by_issuer;
1861         break;
1862     case CERT_COMPARE_EXISTING:
1863         compare = compare_existing_cert;
1864         break;
1865     case CERT_COMPARE_SIGNATURE_HASH:
1866         compare = compare_cert_by_signature_hash;
1867         break;
1868     default:
1869         FIXME("find type %08lx unimplemented\n", dwType);
1870     }
1871
1872     if (find)
1873         ret = find(hCertStore, dwType, dwFlags, pvPara, pPrevCertContext);
1874     else if (compare)
1875         ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1876          compare, dwType, dwFlags, pvPara);
1877     else
1878         ret = NULL;
1879     if (!ret)
1880         SetLastError(CRYPT_E_NOT_FOUND);
1881     TRACE("returning %p\n", ret);
1882     return ret;
1883 }
1884
1885 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1886  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1887 {
1888     TRACE("(%p, %08lx, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1889
1890     if (!pCertId)
1891     {
1892         SetLastError(E_INVALIDARG);
1893         return NULL;
1894     }
1895     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1896      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1897 }
1898
1899 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1900  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1901 {
1902     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1903      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1904
1905     if (*pdwFlags & ~supportedFlags)
1906     {
1907         SetLastError(E_INVALIDARG);
1908         return FALSE;
1909     }
1910     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1911     {
1912         DWORD flags = 0;
1913         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1914          NULL, &flags);
1915
1916         /* FIXME: what if the CRL has expired? */
1917         if (crl)
1918         {
1919             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1920              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1921                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1922         }
1923         else
1924             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1925     }
1926     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1927     {
1928         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1929             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1930     }
1931     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1932     {
1933         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1934          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1935          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1936             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1937     }
1938     return TRUE;
1939 }
1940
1941 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1942  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1943  DWORD *pdwFlags)
1944 {
1945     PCCERT_CONTEXT ret;
1946
1947     TRACE("(%p, %p, %p, %08lx)\n", hCertStore, pSubjectContext,
1948      pPrevIssuerContext, *pdwFlags);
1949
1950     if (!pSubjectContext)
1951     {
1952         SetLastError(E_INVALIDARG);
1953         return NULL;
1954     }
1955
1956     ret = CertFindCertificateInStore(hCertStore,
1957      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1958      pSubjectContext, pPrevIssuerContext);
1959     if (ret)
1960     {
1961         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1962          pdwFlags))
1963         {
1964             CertFreeCertificateContext(ret);
1965             ret = NULL;
1966         }
1967         if (CRYPT_IsCertificateSelfSigned(pSubjectContext))
1968         {
1969             CertFreeCertificateContext(ret);
1970             ret = NULL;
1971             SetLastError(CRYPT_E_SELF_SIGNED);
1972         }
1973     }
1974     TRACE("returning %p\n", ret);
1975     return ret;
1976 }
1977
1978 typedef struct _OLD_CERT_REVOCATION_STATUS {
1979     DWORD cbSize;
1980     DWORD dwIndex;
1981     DWORD dwError;
1982     DWORD dwReason;
1983 } OLD_CERT_REVOCATION_STATUS;
1984
1985 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1986  void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1987
1988 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1989  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1990  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1991 {
1992     BOOL ret;
1993
1994     TRACE("(%08lx, %ld, %ld, %p, %08lx, %p, %p)\n", dwEncodingType, dwRevType,
1995      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1996
1997     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1998      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1999     {
2000         SetLastError(E_INVALIDARG);
2001         return FALSE;
2002     }
2003     if (cContext)
2004     {
2005         static HCRYPTOIDFUNCSET set = NULL;
2006         DWORD size;
2007
2008         if (!set)
2009             set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
2010         ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
2011         if (ret)
2012         {
2013             if (size == 1)
2014             {
2015                 /* empty list */
2016                 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
2017                 ret = FALSE;
2018             }
2019             else
2020             {
2021                 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
2022
2023                 if (dllList)
2024                 {
2025                     ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
2026                      dllList, &size);
2027                     if (ret)
2028                     {
2029                         for (ptr = dllList; ret && *ptr;
2030                          ptr += lstrlenW(ptr) + 1)
2031                         {
2032                             CertVerifyRevocationFunc func;
2033                             HCRYPTOIDFUNCADDR hFunc;
2034
2035                             ret = CryptGetDefaultOIDFunctionAddress(set,
2036                              dwEncodingType, ptr, 0, (void **)&func, &hFunc);
2037                             if (ret)
2038                             {
2039                                 ret = func(dwEncodingType, dwRevType, cContext,
2040                                  rgpvContext, dwFlags, pRevPara, pRevStatus);
2041                                 CryptFreeOIDFunctionAddress(hFunc, 0);
2042                             }
2043                         }
2044                     }
2045                     CryptMemFree(dllList);
2046                 }
2047                 else
2048                 {
2049                     SetLastError(ERROR_OUTOFMEMORY);
2050                     ret = FALSE;
2051                 }
2052             }
2053         }
2054     }
2055     else
2056         ret = TRUE;
2057     return ret;
2058 }
2059
2060 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
2061  CRYPT_ATTRIBUTE rgAttr[])
2062 {
2063     PCRYPT_ATTRIBUTE ret = NULL;
2064     DWORD i;
2065
2066     TRACE("%s %ld %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
2067
2068     if (!cAttr)
2069         return NULL;
2070     if (!pszObjId)
2071     {
2072         SetLastError(ERROR_INVALID_PARAMETER);
2073         return NULL;
2074     }
2075
2076     for (i = 0; !ret && i < cAttr; i++)
2077         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
2078             ret = &rgAttr[i];
2079     return ret;
2080 }
2081
2082 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
2083  CERT_EXTENSION rgExtensions[])
2084 {
2085     PCERT_EXTENSION ret = NULL;
2086     DWORD i;
2087
2088     TRACE("%s %ld %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
2089
2090     if (!cExtensions)
2091         return NULL;
2092     if (!pszObjId)
2093     {
2094         SetLastError(ERROR_INVALID_PARAMETER);
2095         return NULL;
2096     }
2097
2098     for (i = 0; !ret && i < cExtensions; i++)
2099         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
2100          rgExtensions[i].pszObjId))
2101             ret = &rgExtensions[i];
2102     return ret;
2103 }
2104
2105 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
2106 {
2107     PCERT_RDN_ATTR ret = NULL;
2108     DWORD i, j;
2109
2110     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
2111
2112     if (!pszObjId)
2113     {
2114         SetLastError(ERROR_INVALID_PARAMETER);
2115         return NULL;
2116     }
2117
2118     for (i = 0; !ret && i < pName->cRDN; i++)
2119         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
2120             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
2121              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
2122                 ret = &pName->rgRDN[i].rgRDNAttr[j];
2123     return ret;
2124 }
2125
2126 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
2127  const CERT_RDN_ATTR *attr)
2128 {
2129     DWORD i, j;
2130     BOOL match = FALSE;
2131
2132     for (i = 0; !match && i < name->cRDN; i++)
2133     {
2134         for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
2135         {
2136             if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
2137              attr->pszObjId) &&
2138              name->rgRDN[i].rgRDNAttr[j].dwValueType ==
2139              attr->dwValueType)
2140             {
2141                 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
2142                 {
2143                     LPCWSTR nameStr =
2144                      (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2145                     LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
2146
2147                     if (attr->Value.cbData !=
2148                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2149                         match = FALSE;
2150                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2151                         match = !wcsnicmp(nameStr, attrStr,
2152                          attr->Value.cbData / sizeof(WCHAR));
2153                     else
2154                         match = !wcsncmp(nameStr, attrStr,
2155                          attr->Value.cbData / sizeof(WCHAR));
2156                     TRACE("%s : %s => %d\n",
2157                      debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
2158                      debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
2159                      match);
2160                 }
2161                 else
2162                 {
2163                     LPCSTR nameStr =
2164                      (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2165                     LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
2166
2167                     if (attr->Value.cbData !=
2168                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2169                         match = FALSE;
2170                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2171                         match = !_strnicmp(nameStr, attrStr,
2172                          attr->Value.cbData);
2173                     else
2174                         match = !strncmp(nameStr, attrStr, attr->Value.cbData);
2175                     TRACE("%s : %s => %d\n",
2176                      debugstr_an(nameStr, attr->Value.cbData),
2177                      debugstr_an(attrStr, attr->Value.cbData), match);
2178                 }
2179             }
2180         }
2181     }
2182     return match;
2183 }
2184
2185 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
2186  DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
2187 {
2188     CERT_NAME_INFO *name;
2189     LPCSTR type;
2190     DWORD size;
2191     BOOL ret;
2192
2193     TRACE("(%08lx, %08lx, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
2194      pRDN);
2195
2196     type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
2197      X509_NAME;
2198     if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
2199      pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
2200     {
2201         DWORD i;
2202
2203         for (i = 0; ret && i < pRDN->cRDNAttr; i++)
2204             ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
2205         if (!ret)
2206             SetLastError(CRYPT_E_NO_MATCH);
2207         LocalFree(name);
2208     }
2209     return ret;
2210 }
2211
2212 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
2213  PCERT_INFO pCertInfo)
2214 {
2215     FILETIME fileTime;
2216     LONG ret;
2217
2218     if (!pTimeToVerify)
2219     {
2220         GetSystemTimeAsFileTime(&fileTime);
2221         pTimeToVerify = &fileTime;
2222     }
2223     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
2224     {
2225         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
2226         if (ret < 0)
2227             ret = 0;
2228     }
2229     return ret;
2230 }
2231
2232 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
2233  PCERT_INFO pIssuerInfo)
2234 {
2235     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
2236
2237     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
2238      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
2239 }
2240
2241 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2242  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2243  DWORD *pcbComputedHash)
2244 {
2245     BOOL ret = TRUE;
2246     HCRYPTHASH hHash = 0;
2247
2248     TRACE("(%08Ix, %d, %08lx, %p, %ld, %p, %p)\n", hCryptProv, Algid, dwFlags,
2249      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2250
2251     if (!hCryptProv)
2252         hCryptProv = I_CryptGetDefaultCryptProv(Algid);
2253     if (!Algid)
2254         Algid = CALG_SHA1;
2255     if (ret)
2256     {
2257         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2258         if (ret)
2259         {
2260             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2261             if (ret)
2262                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2263                  pcbComputedHash, 0);
2264             CryptDestroyHash(hHash);
2265         }
2266     }
2267     return ret;
2268 }
2269
2270 BOOL WINAPI CryptHashCertificate2(LPCWSTR pwszCNGHashAlgid, DWORD dwFlags,
2271  void *pvReserved, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2272  DWORD *pcbComputedHash)
2273 {
2274     BCRYPT_HASH_HANDLE hash = NULL;
2275     BCRYPT_ALG_HANDLE alg = NULL;
2276     NTSTATUS status;
2277     DWORD hash_len;
2278     DWORD hash_len_size;
2279
2280     TRACE("(%s, %08lx, %p, %p, %ld, %p, %p)\n", debugstr_w(pwszCNGHashAlgid),
2281      dwFlags, pvReserved, pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2282
2283     if ((status = BCryptOpenAlgorithmProvider(&alg, pwszCNGHashAlgid, NULL, 0)))
2284     {
2285         if (status == STATUS_NOT_IMPLEMENTED)
2286             status = STATUS_NOT_FOUND;
2287         goto done;
2288     }
2289
2290     if ((status = BCryptCreateHash(alg, &hash, NULL, 0, NULL, 0, 0)))
2291         goto done;
2292
2293     if ((status = BCryptGetProperty(hash, BCRYPT_HASH_LENGTH, (BYTE *)&hash_len, sizeof(hash_len), &hash_len_size, 0)))
2294         goto done;
2295
2296     if (!pbComputedHash)
2297     {
2298         *pcbComputedHash = hash_len;
2299         goto done;
2300     }
2301
2302     if (*pcbComputedHash < hash_len)
2303     {
2304         status = ERROR_MORE_DATA;
2305         goto done;
2306     }
2307
2308     *pcbComputedHash = hash_len;
2309
2310     if ((status = BCryptHashData(hash, (BYTE *)pbEncoded, cbEncoded, 0)))
2311         goto done;
2312
2313     if ((status = BCryptFinishHash(hash, pbComputedHash, hash_len, 0)))
2314         goto done;
2315
2316 done:
2317     if (hash) BCryptDestroyHash(hash);
2318     if (alg)  BCryptCloseAlgorithmProvider(alg, 0);
2319     if (status) SetLastError(status);
2320     return !status;
2321 }
2322
2323 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2324  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2325  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2326 {
2327     BOOL ret = TRUE;
2328     HCRYPTHASH hHash = 0;
2329
2330     TRACE("(%08Ix, %d, %08lx, %ld, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2331      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2332
2333     if (!hCryptProv)
2334         hCryptProv = I_CryptGetDefaultCryptProv(0);
2335     if (!Algid)
2336         Algid = CALG_MD5;
2337     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2338     {
2339         SetLastError(ERROR_FILE_NOT_FOUND);
2340         return FALSE;
2341     }
2342     if (ret)
2343     {
2344         BYTE *buf;
2345         DWORD size = 0;
2346
2347         ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2348          X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2349          (LPBYTE)&buf, &size);
2350         if (ret)
2351         {
2352             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2353             if (ret)
2354             {
2355                 ret = CryptHashData(hHash, buf, size, 0);
2356                 if (ret)
2357                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2358                      pcbComputedHash, 0);
2359                 CryptDestroyHash(hHash);
2360             }
2361             LocalFree(buf);
2362         }
2363     }
2364     return ret;
2365 }
2366
2367 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2368  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2369  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2370 {
2371     BOOL ret;
2372     CERT_SIGNED_CONTENT_INFO *info;
2373     DWORD size;
2374
2375     TRACE("(%08Ix, %08lx, %p, %ld, %p, %ld)\n", hCryptProv, dwCertEncodingType,
2376      pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2377
2378     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2379      pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2380     if (ret)
2381     {
2382         PCCRYPT_OID_INFO oidInfo;
2383         HCRYPTHASH hHash;
2384
2385         if (!hCryptProv)
2386             hCryptProv = I_CryptGetDefaultCryptProv(0);
2387         oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2388          info->SignatureAlgorithm.pszObjId, 0);
2389         if (!oidInfo)
2390         {
2391             SetLastError(NTE_BAD_ALGID);
2392             ret = FALSE;
2393         }
2394         else
2395         {
2396             ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2397             if (ret)
2398             {
2399                 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2400                  info->ToBeSigned.cbData, 0);
2401                 if (ret)
2402                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2403                      pcbComputedHash, 0);
2404                 CryptDestroyHash(hHash);
2405             }
2406         }
2407         LocalFree(info);
2408     }
2409     return ret;
2410 }
2411
2412 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2413  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2414  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2415  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2416 {
2417     BOOL ret;
2418     PCCRYPT_OID_INFO info;
2419     HCRYPTHASH hHash;
2420
2421     TRACE("(%08Ix, %ld, %ld, %p, %ld, %p, %p, %p, %p)\n", hCryptProv,
2422      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2423      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2424
2425     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2426      pSignatureAlgorithm->pszObjId, 0);
2427     if (!info)
2428     {
2429         SetLastError(NTE_BAD_ALGID);
2430         return FALSE;
2431     }
2432     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2433     {
2434         if (!hCryptProv)
2435             hCryptProv = I_CryptGetDefaultCryptProv(0);
2436         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2437         if (ret)
2438         {
2439             ret = CryptHashData(hHash, pbEncodedToBeSigned,
2440              cbEncodedToBeSigned, 0);
2441             if (ret)
2442                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2443                  pcbSignature, 0);
2444             CryptDestroyHash(hHash);
2445         }
2446     }
2447     else
2448     {
2449         if (!hCryptProv)
2450         {
2451             SetLastError(ERROR_INVALID_PARAMETER);
2452             ret = FALSE;
2453         }
2454         else
2455         {
2456             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2457             if (ret)
2458             {
2459                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2460                  cbEncodedToBeSigned, 0);
2461                 if (ret)
2462                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2463                      pcbSignature);
2464                 CryptDestroyHash(hHash);
2465             }
2466         }
2467     }
2468     return ret;
2469 }
2470
2471 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2472  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2473  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2474  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2475 {
2476     BOOL ret;
2477     DWORD encodedSize, hashSize;
2478
2479     TRACE("(%08Ix, %ld, %ld, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2480      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2481      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2482
2483     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2484      NULL, &encodedSize);
2485     if (ret)
2486     {
2487         PBYTE encoded = CryptMemAlloc(encodedSize);
2488
2489         if (encoded)
2490         {
2491             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2492              pvStructInfo, encoded, &encodedSize);
2493             if (ret)
2494             {
2495                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2496                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2497                  pvHashAuxInfo, NULL, &hashSize);
2498                 if (ret)
2499                 {
2500                     PBYTE hash = CryptMemAlloc(hashSize);
2501
2502                     if (hash)
2503                     {
2504                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2505                          dwCertEncodingType, encoded, encodedSize,
2506                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2507                         if (ret)
2508                         {
2509                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2510
2511                             info.ToBeSigned.cbData = encodedSize;
2512                             info.ToBeSigned.pbData = encoded;
2513                             info.SignatureAlgorithm = *pSignatureAlgorithm;
2514                             info.Signature.cbData = hashSize;
2515                             info.Signature.pbData = hash;
2516                             info.Signature.cUnusedBits = 0;
2517                             ret = CryptEncodeObject(dwCertEncodingType,
2518                              X509_CERT, &info, pbEncoded, pcbEncoded);
2519                         }
2520                         CryptMemFree(hash);
2521                     }
2522                     else
2523                         ret = FALSE;
2524                 }
2525             }
2526             CryptMemFree(encoded);
2527         }
2528         else
2529             ret = FALSE;
2530     }
2531     return ret;
2532 }
2533
2534 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2535  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2536  PCERT_PUBLIC_KEY_INFO pPublicKey)
2537 {
2538     CRYPT_DATA_BLOB blob = { cbEncoded, (BYTE *)pbEncoded };
2539
2540     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2541      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &blob,
2542      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2543 }
2544
2545 static BOOL CRYPT_VerifySignature(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2546     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert, const CRYPT_OID_INFO *info)
2547 {
2548     BOOL ret;
2549     HCRYPTKEY key;
2550     ALG_ID pubKeyID, hashID;
2551
2552     hashID = info->u.Algid;
2553     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2554         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2555     else
2556         pubKeyID = hashID;
2557     /* Load the default provider if necessary */
2558     if (!hCryptProv)
2559         hCryptProv = I_CryptGetDefaultCryptProv(hashID);
2560     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2561      pubKeyInfo, pubKeyID, 0, NULL, &key);
2562     if (ret)
2563     {
2564         HCRYPTHASH hash;
2565
2566         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2567         if (ret)
2568         {
2569             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2570              signedCert->ToBeSigned.cbData, 0);
2571             if (ret)
2572                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2573                  signedCert->Signature.cbData, key, NULL, 0);
2574             CryptDestroyHash(hash);
2575         }
2576         CryptDestroyKey(key);
2577     }
2578     return ret;
2579 }
2580
2581 static BOOL CNG_CalcHash(const WCHAR *algorithm, const CERT_SIGNED_CONTENT_INFO *signedCert,
2582         BYTE **hash_value, DWORD *hash_len)
2583 {
2584     BCRYPT_HASH_HANDLE hash = NULL;
2585     BCRYPT_ALG_HANDLE alg = NULL;
2586     NTSTATUS status;
2587     DWORD size;
2588
2589     if ((status = BCryptOpenAlgorithmProvider(&alg, algorithm, NULL, 0)))
2590         goto done;
2591
2592     if ((status = BCryptCreateHash(alg, &hash, NULL, 0, NULL, 0, 0)))
2593         goto done;
2594
2595     if ((status = BCryptHashData(hash, signedCert->ToBeSigned.pbData, signedCert->ToBeSigned.cbData, 0)))
2596         goto done;
2597
2598     if ((status = BCryptGetProperty(hash, BCRYPT_HASH_LENGTH, (BYTE *)hash_len, sizeof(*hash_len), &size, 0)))
2599         goto done;
2600
2601     if (!(*hash_value = CryptMemAlloc(*hash_len)))
2602     {
2603         status = STATUS_NO_MEMORY;
2604         goto done;
2605     }
2606
2607     if ((status = BCryptFinishHash(hash, *hash_value, *hash_len, 0)))
2608     {
2609         CryptMemFree(*hash_value);
2610         goto done;
2611     }
2612
2613 done:
2614     if (hash) BCryptDestroyHash(hash);
2615     if (alg)  BCryptCloseAlgorithmProvider(alg, 0);
2616     if (status) SetLastError(RtlNtStatusToDosError(status));
2617     return status == 0;
2618 }
2619
2620 static BOOL CNG_ImportECCPubKey(CERT_PUBLIC_KEY_INFO *pubKeyInfo, BCRYPT_KEY_HANDLE *key)
2621 {
2622     DWORD blob_magic, ecckey_len, size;
2623     BCRYPT_ALG_HANDLE alg = NULL;
2624     BCRYPT_ECCKEY_BLOB *ecckey;
2625     const WCHAR *sign_algo;
2626     char **ecc_curve;
2627     NTSTATUS status;
2628
2629     if (!pubKeyInfo->PublicKey.cbData)
2630     {
2631         SetLastError(NTE_BAD_ALGID);
2632         return FALSE;
2633     }
2634
2635     if (pubKeyInfo->PublicKey.pbData[0] != 0x4)
2636     {
2637         FIXME("Compressed ECC curves (%02x) not yet supported\n", pubKeyInfo->PublicKey.pbData[0]);
2638         SetLastError(NTE_BAD_ALGID);
2639         return FALSE;
2640     }
2641
2642     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_OBJECT_IDENTIFIER, pubKeyInfo->Algorithm.Parameters.pbData,
2643             pubKeyInfo->Algorithm.Parameters.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &ecc_curve, &size))
2644         return FALSE;
2645
2646     if (!strcmp(*ecc_curve, szOID_ECC_CURVE_P256))
2647     {
2648         sign_algo = BCRYPT_ECDSA_P256_ALGORITHM;
2649         blob_magic = BCRYPT_ECDSA_PUBLIC_P256_MAGIC;
2650     }
2651     else if (!strcmp(*ecc_curve, szOID_ECC_CURVE_P384))
2652     {
2653         sign_algo = BCRYPT_ECDSA_P384_ALGORITHM;
2654         blob_magic = BCRYPT_ECDSA_PUBLIC_P384_MAGIC;
2655     }
2656     else
2657     {
2658         FIXME("Unsupported ecc curve type: %s\n", *ecc_curve);
2659         sign_algo = NULL;
2660         blob_magic = 0;
2661     }
2662     LocalFree(ecc_curve);
2663
2664     if (!sign_algo)
2665     {
2666         SetLastError(NTE_BAD_ALGID);
2667         return FALSE;
2668     }
2669
2670     if ((status = BCryptOpenAlgorithmProvider(&alg, sign_algo, NULL, 0)))
2671         goto done;
2672
2673     ecckey_len = sizeof(BCRYPT_ECCKEY_BLOB) + pubKeyInfo->PublicKey.cbData - 1;
2674     if (!(ecckey = CryptMemAlloc(ecckey_len)))
2675     {
2676         status = STATUS_NO_MEMORY;
2677         goto done;
2678     }
2679
2680     ecckey->dwMagic = blob_magic;
2681     ecckey->cbKey = (pubKeyInfo->PublicKey.cbData - 1) / 2;
2682     memcpy(ecckey + 1, pubKeyInfo->PublicKey.pbData + 1, pubKeyInfo->PublicKey.cbData - 1);
2683
2684     status = BCryptImportKeyPair(alg, NULL, BCRYPT_ECCPUBLIC_BLOB, key, (BYTE*)ecckey, ecckey_len, 0);
2685     CryptMemFree(ecckey);
2686
2687 done:
2688     if (alg) BCryptCloseAlgorithmProvider(alg, 0);
2689     if (status) SetLastError(RtlNtStatusToDosError(status));
2690     return !status;
2691 }
2692
2693 static BOOL CNG_ImportRSAPubKey(CERT_PUBLIC_KEY_INFO *info, BCRYPT_KEY_HANDLE *key)
2694 {
2695     DWORD size, modulus_len, i;
2696     BLOBHEADER *hdr;
2697     RSAPUBKEY *rsapubkey;
2698     const WCHAR *rsa_algo;
2699     BCRYPT_ALG_HANDLE alg = NULL;
2700     BCRYPT_RSAKEY_BLOB *rsakey;
2701     BYTE *s, *d;
2702     NTSTATUS status;
2703
2704     if (!info->PublicKey.cbData)
2705     {
2706         SetLastError(NTE_BAD_ALGID);
2707         return FALSE;
2708     }
2709
2710     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, RSA_CSP_PUBLICKEYBLOB, info->PublicKey.pbData,
2711             info->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &hdr, &size))
2712     {
2713         WARN("CryptDecodeObjectEx failed\n");
2714         return FALSE;
2715     }
2716
2717     if (hdr->aiKeyAlg == CALG_RSA_KEYX)
2718         rsa_algo = BCRYPT_RSA_ALGORITHM;
2719     else if (hdr->aiKeyAlg == CALG_RSA_SIGN)
2720         rsa_algo = BCRYPT_RSA_SIGN_ALGORITHM;
2721     else
2722     {
2723         FIXME("Unsupported RSA algorithm: %#x\n", hdr->aiKeyAlg);
2724         LocalFree(hdr);
2725         SetLastError(NTE_BAD_ALGID);
2726         return FALSE;
2727     }
2728
2729     if ((status = BCryptOpenAlgorithmProvider(&alg, rsa_algo, NULL, 0)))
2730         goto done;
2731
2732     rsapubkey = (RSAPUBKEY *)(hdr + 1);
2733
2734     modulus_len = size - sizeof(*hdr) - sizeof(*rsapubkey);
2735     if (modulus_len != rsapubkey->bitlen / 8)
2736         FIXME("RSA pubkey has wrong modulus_len %lu\n", modulus_len);
2737
2738     size = sizeof(*rsakey) + sizeof(ULONG) + modulus_len;
2739
2740     if (!(rsakey = CryptMemAlloc(size)))
2741     {
2742         status = STATUS_NO_MEMORY;
2743         goto done;
2744     }
2745
2746     rsakey->Magic = BCRYPT_RSAPUBLIC_MAGIC;
2747     rsakey->BitLength = rsapubkey->bitlen;
2748     rsakey->cbPublicExp = sizeof(ULONG);
2749     rsakey->cbModulus = modulus_len;
2750     rsakey->cbPrime1 = 0;
2751     rsakey->cbPrime2 = 0;
2752
2753     d = (BYTE *)(rsakey + 1);
2754     /* According to MSDN modulus and pubexp are in LE while
2755      * BCRYPT_RSAKEY_BLOB is supposed to have them in BE format */
2756     *(ULONG *)d = RtlUlongByteSwap(rsapubkey->pubexp);
2757     d += sizeof(ULONG);
2758     s = (BYTE *)(rsapubkey + 1);
2759     for (i = 0; i < modulus_len; i++)
2760         d[i] = s[modulus_len - i - 1];
2761
2762     status = BCryptImportKeyPair(alg, NULL, BCRYPT_RSAPUBLIC_BLOB, key, (BYTE *)rsakey, size, 0);
2763     CryptMemFree(rsakey);
2764
2765 done:
2766     LocalFree(hdr);
2767     if (alg) BCryptCloseAlgorithmProvider(alg, 0);
2768     if (status) SetLastError(RtlNtStatusToDosError(status));
2769     return !status;
2770 }
2771
2772 BOOL CNG_ImportPubKey(CERT_PUBLIC_KEY_INFO *pubKeyInfo, BCRYPT_KEY_HANDLE *key)
2773 {
2774     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_ECC_PUBLIC_KEY))
2775         return CNG_ImportECCPubKey(pubKeyInfo, key);
2776
2777     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_RSA_RSA))
2778         return CNG_ImportRSAPubKey(pubKeyInfo, key);
2779
2780     FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo->Algorithm.pszObjId));
2781     SetLastError(NTE_BAD_ALGID);
2782     return FALSE;
2783 }
2784
2785 static BOOL CNG_PrepareSignatureECC(BYTE *encoded_sig, DWORD encoded_size, BYTE **sig_value, DWORD *sig_len)
2786 {
2787     CERT_ECC_SIGNATURE *ecc_sig;
2788     DWORD size;
2789     int i;
2790
2791     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ECC_SIGNATURE, encoded_sig, encoded_size,
2792             CRYPT_DECODE_ALLOC_FLAG, NULL, &ecc_sig, &size))
2793         return FALSE;
2794
2795     if (!ecc_sig->r.cbData || !ecc_sig->s.cbData)
2796     {
2797         LocalFree(ecc_sig);
2798         SetLastError(ERROR_INVALID_DATA);
2799         return FALSE;
2800     }
2801
2802     *sig_len = ecc_sig->r.cbData + ecc_sig->s.cbData;
2803     if (!(*sig_value = CryptMemAlloc(*sig_len)))
2804     {
2805         LocalFree(ecc_sig);
2806         SetLastError(ERROR_OUTOFMEMORY);
2807         return FALSE;
2808     }
2809
2810     for (i = 0; i < ecc_sig->r.cbData; i++)
2811         (*sig_value)[i] = ecc_sig->r.pbData[ecc_sig->r.cbData - i - 1];
2812     for (i = 0; i < ecc_sig->s.cbData; i++)
2813         (*sig_value)[ecc_sig->r.cbData + i] = ecc_sig->s.pbData[ecc_sig->s.cbData - i - 1];
2814
2815     LocalFree(ecc_sig);
2816     return TRUE;
2817 }
2818
2819 static BOOL CNG_PrepareSignature(CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert,
2820     BYTE **sig_value, DWORD *sig_len)
2821 {
2822     BYTE *encoded_sig;
2823     BOOL ret = FALSE;
2824     int i;
2825
2826     if (!signedCert->Signature.cbData)
2827     {
2828         SetLastError(ERROR_INVALID_DATA);
2829         return FALSE;
2830     }
2831
2832     if (!(encoded_sig = CryptMemAlloc(signedCert->Signature.cbData)))
2833     {
2834         SetLastError(ERROR_OUTOFMEMORY);
2835         return FALSE;
2836     }
2837
2838     for (i = 0; i < signedCert->Signature.cbData; i++)
2839         encoded_sig[i] = signedCert->Signature.pbData[signedCert->Signature.cbData - i - 1];
2840
2841     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_ECC_PUBLIC_KEY))
2842         ret = CNG_PrepareSignatureECC(encoded_sig, signedCert->Signature.cbData, sig_value, sig_len);
2843     else
2844     {
2845         FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo->Algorithm.pszObjId));
2846         SetLastError(NTE_BAD_ALGID);
2847     }
2848
2849     CryptMemFree(encoded_sig);
2850     return ret;
2851 }
2852
2853 static BOOL CNG_VerifySignature(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2854     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert, const CRYPT_OID_INFO *info)
2855 {
2856     BCRYPT_KEY_HANDLE key = NULL;
2857     BYTE *hash_value = NULL, *sig_value;
2858     DWORD hash_len, sig_len;
2859     NTSTATUS status;
2860     BOOL ret;
2861
2862     ret = CNG_ImportPubKey(pubKeyInfo, &key);
2863     if (ret)
2864     {
2865         ret = CNG_CalcHash(info->pwszCNGAlgid, signedCert, &hash_value, &hash_len);
2866         if (ret)
2867         {
2868             ret = CNG_PrepareSignature(pubKeyInfo, signedCert, &sig_value, &sig_len);
2869             if (ret)
2870             {
2871                 status = BCryptVerifySignature(key, NULL, hash_value, hash_len, sig_value, sig_len, 0);
2872                 if (status)
2873                 {
2874                     FIXME("Failed to verify signature: %08lx\n", status);
2875                     SetLastError(RtlNtStatusToDosError(status));
2876                     ret = FALSE;
2877                 }
2878                 CryptMemFree(sig_value);
2879             }
2880             CryptMemFree(hash_value);
2881         }
2882         BCryptDestroyKey(key);
2883     }
2884
2885     return ret;
2886 }
2887
2888 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2889     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert)
2890 {
2891     CCRYPT_OID_INFO *info;
2892
2893     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY, signedCert->SignatureAlgorithm.pszObjId, 0);
2894     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2895     {
2896         SetLastError(NTE_BAD_ALGID);
2897         return FALSE;
2898     }
2899
2900     if (info->u.Algid == CALG_OID_INFO_CNG_ONLY)
2901         return CNG_VerifySignature(hCryptProv, dwCertEncodingType, pubKeyInfo, signedCert, info);
2902     else
2903         return CRYPT_VerifySignature(hCryptProv, dwCertEncodingType, pubKeyInfo, signedCert, info);
2904 }
2905
2906 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2907  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2908  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2909 {
2910     BOOL ret = TRUE;
2911     CRYPT_DATA_BLOB subjectBlob;
2912
2913     TRACE("(%08Ix, %ld, %ld, %p, %ld, %p, %08lx, %p)\n", hCryptProv,
2914      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2915      dwFlags, pvReserved);
2916
2917     switch (dwSubjectType)
2918     {
2919     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2920     {
2921         PCRYPT_DATA_BLOB blob = pvSubject;
2922
2923         subjectBlob.pbData = blob->pbData;
2924         subjectBlob.cbData = blob->cbData;
2925         break;
2926     }
2927     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2928     {
2929         PCERT_CONTEXT context = pvSubject;
2930
2931         subjectBlob.pbData = context->pbCertEncoded;
2932         subjectBlob.cbData = context->cbCertEncoded;
2933         break;
2934     }
2935     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2936     {
2937         PCRL_CONTEXT context = pvSubject;
2938
2939         subjectBlob.pbData = context->pbCrlEncoded;
2940         subjectBlob.cbData = context->cbCrlEncoded;
2941         break;
2942     }
2943     default:
2944         SetLastError(E_INVALIDARG);
2945         ret = FALSE;
2946     }
2947
2948     if (ret)
2949     {
2950         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2951         DWORD size = 0;
2952
2953         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2954          subjectBlob.pbData, subjectBlob.cbData,
2955          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2956          &signedCert, &size);
2957         if (ret)
2958         {
2959             switch (dwIssuerType)
2960             {
2961             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2962                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2963                  dwCertEncodingType, pvIssuer,
2964                  signedCert);
2965                 break;
2966             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2967                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2968                  dwCertEncodingType,
2969                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2970                  signedCert);
2971                 break;
2972             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2973                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2974                 ret = FALSE;
2975                 break;
2976             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2977                 if (pvIssuer)
2978                 {
2979                     SetLastError(E_INVALIDARG);
2980                     ret = FALSE;
2981                 }
2982                 else
2983                 {
2984                     FIXME("unimplemented for NULL signer\n");
2985                     SetLastError(E_INVALIDARG);
2986                     ret = FALSE;
2987                 }
2988                 break;
2989             default:
2990                 SetLastError(E_INVALIDARG);
2991                 ret = FALSE;
2992             }
2993             LocalFree(signedCert);
2994         }
2995     }
2996     return ret;
2997 }
2998
2999 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
3000  PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
3001 {
3002     PCERT_EXTENSION ext;
3003     BOOL ret = FALSE;
3004
3005     TRACE("(%08lx, %p, %p, %ld)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
3006      cbKeyUsage);
3007
3008     ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
3009      pCertInfo->rgExtension);
3010     if (ext)
3011     {
3012         CRYPT_BIT_BLOB usage;
3013         DWORD size = sizeof(usage);
3014
3015         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
3016          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
3017          &usage, &size);
3018         if (ret)
3019         {
3020             if (cbKeyUsage < usage.cbData)
3021                 ret = FALSE;
3022             else
3023             {
3024                 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
3025                 if (cbKeyUsage > usage.cbData)
3026                     memset(pbKeyUsage + usage.cbData, 0,
3027                      cbKeyUsage - usage.cbData);
3028             }
3029         }
3030     }
3031     else
3032         SetLastError(0);
3033     return ret;
3034 }
3035
3036 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
3037  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
3038 {
3039     PCERT_ENHKEY_USAGE usage = NULL;
3040     DWORD bytesNeeded;
3041     BOOL ret = TRUE;
3042
3043     if (!pCertContext || !pcbUsage)
3044     {
3045         SetLastError(ERROR_INVALID_PARAMETER);
3046         return FALSE;
3047     }
3048
3049     TRACE("(%p, %08lx, %p, %ld)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
3050
3051     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
3052     {
3053         DWORD propSize = 0;
3054
3055         if (CertGetCertificateContextProperty(pCertContext,
3056          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
3057         {
3058             LPBYTE buf = CryptMemAlloc(propSize);
3059
3060             if (buf)
3061             {
3062                 if (CertGetCertificateContextProperty(pCertContext,
3063                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
3064                 {
3065                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
3066                      X509_ENHANCED_KEY_USAGE, buf, propSize,
3067                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
3068                 }
3069                 CryptMemFree(buf);
3070             }
3071         }
3072     }
3073     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
3074     {
3075         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
3076          pCertContext->pCertInfo->cExtension,
3077          pCertContext->pCertInfo->rgExtension);
3078
3079         if (ext)
3080         {
3081             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
3082              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
3083              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
3084         }
3085     }
3086     if (!usage)
3087     {
3088         /* If a particular location is specified, this should fail.  Otherwise
3089          * it should succeed with an empty usage.  (This is true on Win2k and
3090          * later, which we emulate.)
3091          */
3092         if (dwFlags)
3093         {
3094             SetLastError(CRYPT_E_NOT_FOUND);
3095             ret = FALSE;
3096         }
3097         else
3098             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
3099     }
3100
3101     if (ret)
3102     {
3103         if (!pUsage)
3104             *pcbUsage = bytesNeeded;
3105         else if (*pcbUsage < bytesNeeded)
3106         {
3107             SetLastError(ERROR_MORE_DATA);
3108             *pcbUsage = bytesNeeded;
3109             ret = FALSE;
3110         }
3111         else
3112         {
3113             *pcbUsage = bytesNeeded;
3114             if (usage)
3115             {
3116                 DWORD i;
3117                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
3118                  sizeof(CERT_ENHKEY_USAGE) +
3119                  usage->cUsageIdentifier * sizeof(LPSTR));
3120
3121                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
3122                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
3123                  sizeof(CERT_ENHKEY_USAGE));
3124                 for (i = 0; i < usage->cUsageIdentifier; i++)
3125                 {
3126                     pUsage->rgpszUsageIdentifier[i] = nextOID;
3127                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
3128                     nextOID += strlen(nextOID) + 1;
3129                 }
3130             }
3131             else
3132                 pUsage->cUsageIdentifier = 0;
3133         }
3134     }
3135     if (usage)
3136         LocalFree(usage);
3137     TRACE("returning %d\n", ret);
3138     return ret;
3139 }
3140
3141 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
3142  PCERT_ENHKEY_USAGE pUsage)
3143 {
3144     BOOL ret;
3145
3146     TRACE("(%p, %p)\n", pCertContext, pUsage);
3147
3148     if (pUsage)
3149     {
3150         CRYPT_DATA_BLOB blob = { 0, NULL };
3151
3152         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
3153          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
3154         if (ret)
3155         {
3156             ret = CertSetCertificateContextProperty(pCertContext,
3157              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
3158             LocalFree(blob.pbData);
3159         }
3160     }
3161     else
3162         ret = CertSetCertificateContextProperty(pCertContext,
3163          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
3164     return ret;
3165 }
3166
3167 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
3168  LPCSTR pszUsageIdentifier)
3169 {
3170     BOOL ret;
3171     DWORD size;
3172
3173     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
3174
3175     if (CertGetEnhancedKeyUsage(pCertContext,
3176      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
3177     {
3178         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
3179
3180         if (usage)
3181         {
3182             ret = CertGetEnhancedKeyUsage(pCertContext,
3183              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
3184             if (ret)
3185             {
3186                 DWORD i;
3187                 BOOL exists = FALSE;
3188
3189                 /* Make sure usage doesn't already exist */
3190                 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
3191                 {
3192                     if (!strcmp(usage->rgpszUsageIdentifier[i],
3193                      pszUsageIdentifier))
3194                         exists = TRUE;
3195                 }
3196                 if (!exists)
3197                 {
3198                     PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
3199                      sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
3200
3201                     if (newUsage)
3202                     {
3203                         LPSTR nextOID;
3204
3205                         newUsage->rgpszUsageIdentifier = (LPSTR *)
3206                          ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
3207                         nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
3208                           + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
3209                         for (i = 0; i < usage->cUsageIdentifier; i++)
3210                         {
3211                             newUsage->rgpszUsageIdentifier[i] = nextOID;
3212                             strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
3213                             nextOID += strlen(nextOID) + 1;
3214                         }
3215                         newUsage->rgpszUsageIdentifier[i] = nextOID;
3216                         strcpy(nextOID, pszUsageIdentifier);
3217                         newUsage->cUsageIdentifier = i + 1;
3218                         ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
3219                         CryptMemFree(newUsage);
3220                     }
3221                     else
3222                         ret = FALSE;
3223                 }
3224             }
3225             CryptMemFree(usage);
3226         }
3227         else
3228             ret = FALSE;
3229     }
3230     else
3231     {
3232         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
3233          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
3234
3235         if (usage)
3236         {
3237             usage->rgpszUsageIdentifier =
3238              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
3239             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
3240              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
3241             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
3242             usage->cUsageIdentifier = 1;
3243             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
3244             CryptMemFree(usage);
3245         }
3246         else
3247             ret = FALSE;
3248     }
3249     return ret;
3250 }
3251
3252 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
3253  LPCSTR pszUsageIdentifier)
3254 {
3255     BOOL ret;
3256     DWORD size;
3257     CERT_ENHKEY_USAGE usage;
3258
3259     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
3260
3261     size = sizeof(usage);
3262     ret = CertGetEnhancedKeyUsage(pCertContext,
3263      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
3264     if (!ret && GetLastError() == ERROR_MORE_DATA)
3265     {
3266         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
3267
3268         if (pUsage)
3269         {
3270             ret = CertGetEnhancedKeyUsage(pCertContext,
3271              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
3272             if (ret)
3273             {
3274                 if (pUsage->cUsageIdentifier)
3275                 {
3276                     DWORD i;
3277                     BOOL found = FALSE;
3278
3279                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
3280                     {
3281                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
3282                          pszUsageIdentifier))
3283                             found = TRUE;
3284                         if (found && i < pUsage->cUsageIdentifier - 1)
3285                             pUsage->rgpszUsageIdentifier[i] =
3286                              pUsage->rgpszUsageIdentifier[i + 1];
3287                     }
3288                     pUsage->cUsageIdentifier--;
3289                     /* Remove the usage if it's empty */
3290                     if (pUsage->cUsageIdentifier)
3291                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
3292                     else
3293                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
3294                 }
3295             }
3296             CryptMemFree(pUsage);
3297         }
3298         else
3299             ret = FALSE;
3300     }
3301     else
3302     {
3303         /* it fit in an empty usage, therefore there's nothing to remove */
3304         ret = TRUE;
3305     }
3306     return ret;
3307 }
3308
3309 struct BitField
3310 {
3311     DWORD  cIndexes;
3312     DWORD *indexes;
3313 };
3314
3315 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
3316
3317 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
3318 {
3319     DWORD indexIndex = bit / BITS_PER_DWORD;
3320
3321     if (indexIndex + 1 > field->cIndexes)
3322     {
3323         if (field->cIndexes)
3324             field->indexes = CryptMemRealloc(field->indexes,
3325              (indexIndex + 1) * sizeof(DWORD));
3326         else
3327             field->indexes = CryptMemAlloc(sizeof(DWORD));
3328         if (field->indexes)
3329         {
3330             field->indexes[indexIndex] = 0;
3331             field->cIndexes = indexIndex + 1;
3332         }
3333     }
3334     if (field->indexes)
3335         field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
3336 }
3337
3338 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
3339 {
3340     BOOL set;
3341     DWORD indexIndex = bit / BITS_PER_DWORD;
3342
3343     assert(field->cIndexes);
3344     set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
3345     return set;
3346 }
3347
3348 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
3349  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
3350 {
3351     BOOL ret = TRUE;
3352     DWORD i, cbOIDs = 0;
3353     BOOL allUsagesValid = TRUE;
3354     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
3355
3356     TRACE("(%ld, %p, %d, %p, %ld)\n", cCerts, rghCerts, *cNumOIDs,
3357      rghOIDs, *pcbOIDs);
3358
3359     for (i = 0; i < cCerts; i++)
3360     {
3361         CERT_ENHKEY_USAGE usage;
3362         DWORD size = sizeof(usage);
3363
3364         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
3365         /* Success is deliberately ignored: it implies all usages are valid */
3366         if (!ret && GetLastError() == ERROR_MORE_DATA)
3367         {
3368             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
3369
3370             allUsagesValid = FALSE;
3371             if (pUsage)
3372             {
3373                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
3374                 if (ret)
3375                 {
3376                     if (!validUsages.cUsageIdentifier)
3377                     {
3378                         DWORD j;
3379
3380                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
3381                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
3382                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
3383                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
3384                              + 1;
3385                         validUsages.rgpszUsageIdentifier =
3386                          CryptMemAlloc(cbOIDs);
3387                         if (validUsages.rgpszUsageIdentifier)
3388                         {
3389                             LPSTR nextOID = (LPSTR)
3390                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
3391                              validUsages.cUsageIdentifier * sizeof(LPSTR));
3392
3393                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
3394                             {
3395                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
3396                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
3397                                  pUsage->rgpszUsageIdentifier[j]);
3398                                 nextOID += lstrlenA(nextOID) + 1;
3399                             }
3400                         }
3401                     }
3402                     else
3403                     {
3404                         struct BitField validIndexes = { 0, NULL };
3405                         DWORD j, k, numRemoved = 0;
3406
3407                         /* Merge: build a bitmap of all the indexes of
3408                          * validUsages.rgpszUsageIdentifier that are in pUsage.
3409                          */
3410                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
3411                         {
3412                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
3413                             {
3414                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
3415                                  validUsages.rgpszUsageIdentifier[k]))
3416                                 {
3417                                     CRYPT_SetBitInField(&validIndexes, k);
3418                                     break;
3419                                 }
3420                             }
3421                         }
3422                         /* Merge by removing from validUsages those that are
3423                          * not in the bitmap.
3424                          */
3425                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
3426                         {
3427                             if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
3428                             {
3429                                 if (j < validUsages.cUsageIdentifier - 1)
3430                                 {
3431                                     memmove(&validUsages.rgpszUsageIdentifier[j],
3432                                      &validUsages.rgpszUsageIdentifier[j +
3433                                      numRemoved + 1],
3434                                      (validUsages.cUsageIdentifier - numRemoved
3435                                      - j - 1) * sizeof(LPSTR));
3436                                     cbOIDs -= lstrlenA(
3437                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
3438                                      sizeof(LPSTR);
3439                                     validUsages.cUsageIdentifier--;
3440                                     numRemoved++;
3441                                 }
3442                                 else
3443                                     validUsages.cUsageIdentifier--;
3444                             }
3445                         }
3446                         CryptMemFree(validIndexes.indexes);
3447                     }
3448                 }
3449                 CryptMemFree(pUsage);
3450             }
3451         }
3452     }
3453     ret = TRUE;
3454     if (allUsagesValid)
3455     {
3456         *cNumOIDs = -1;
3457         *pcbOIDs = 0;
3458     }
3459     else
3460     {
3461         *cNumOIDs = validUsages.cUsageIdentifier;
3462         if (!rghOIDs)
3463             *pcbOIDs = cbOIDs;
3464         else if (*pcbOIDs < cbOIDs)
3465         {
3466             *pcbOIDs = cbOIDs;
3467             SetLastError(ERROR_MORE_DATA);
3468             ret = FALSE;
3469         }
3470         else
3471         {
3472             LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
3473              validUsages.cUsageIdentifier * sizeof(LPSTR));
3474
3475             *pcbOIDs = cbOIDs;
3476             for (i = 0; i < validUsages.cUsageIdentifier; i++)
3477             {
3478                 rghOIDs[i] = nextOID;
3479                 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
3480                 nextOID += lstrlenA(nextOID) + 1;
3481             }
3482         }
3483     }
3484     CryptMemFree(validUsages.rgpszUsageIdentifier);
3485     TRACE("cNumOIDs: %d\n", *cNumOIDs);
3486     TRACE("returning %d\n", ret);
3487     return ret;
3488 }
3489
3490 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
3491  * pInfo is NULL, from the attributes of hProv.
3492  */
3493 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
3494  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
3495 {
3496     CRYPT_KEY_PROV_INFO info = { 0 };
3497     BOOL ret;
3498
3499     if (!pInfo)
3500     {
3501         DWORD size;
3502         int len;
3503
3504         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
3505         if (ret)
3506         {
3507             LPSTR szContainer = CryptMemAlloc(size);
3508
3509             if (szContainer)
3510             {
3511                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
3512                  (BYTE *)szContainer, &size, 0);
3513                 if (ret)
3514                 {
3515                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3516                      NULL, 0);
3517                     if (len)
3518                     {
3519                         info.pwszContainerName = CryptMemAlloc(len *
3520                          sizeof(WCHAR));
3521                         MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3522                          info.pwszContainerName, len);
3523                     }
3524                 }
3525                 CryptMemFree(szContainer);
3526             }
3527         }
3528         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
3529         if (ret)
3530         {
3531             LPSTR szProvider = CryptMemAlloc(size);
3532
3533             if (szProvider)
3534             {
3535                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
3536                  &size, 0);
3537                 if (ret)
3538                 {
3539                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3540                      NULL, 0);
3541                     if (len)
3542                     {
3543                         info.pwszProvName = CryptMemAlloc(len *
3544                          sizeof(WCHAR));
3545                         MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3546                          info.pwszProvName, len);
3547                     }
3548                 }
3549                 CryptMemFree(szProvider);
3550             }
3551         }
3552         /* in case no CRYPT_KEY_PROV_INFO given,
3553          *  we always use AT_SIGNATURE key spec
3554          */
3555         info.dwKeySpec = AT_SIGNATURE;
3556         size = sizeof(info.dwProvType);
3557         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
3558          &size, 0);
3559         if (!ret)
3560             info.dwProvType = PROV_RSA_FULL;
3561         pInfo = &info;
3562     }
3563
3564     CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
3565      0, pInfo);
3566
3567     if (pInfo == &info)
3568     {
3569         CryptMemFree(info.pwszContainerName);
3570         CryptMemFree(info.pwszProvName);
3571     }
3572 }
3573
3574 /* Creates a signed certificate context from the unsigned, encoded certificate
3575  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
3576  */
3577 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
3578  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
3579 {
3580     PCCERT_CONTEXT context = NULL;
3581     BOOL ret;
3582     DWORD sigSize = 0;
3583
3584     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3585      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
3586     if (ret)
3587     {
3588         LPBYTE sig = CryptMemAlloc(sigSize);
3589
3590         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3591          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
3592         if (ret)
3593         {
3594             CERT_SIGNED_CONTENT_INFO signedInfo;
3595             BYTE *encodedSignedCert = NULL;
3596             DWORD encodedSignedCertSize = 0;
3597
3598             signedInfo.ToBeSigned.cbData = blob->cbData;
3599             signedInfo.ToBeSigned.pbData = blob->pbData;
3600             signedInfo.SignatureAlgorithm = *sigAlgo;
3601             signedInfo.Signature.cbData = sigSize;
3602             signedInfo.Signature.pbData = sig;
3603             signedInfo.Signature.cUnusedBits = 0;
3604             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
3605              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
3606              &encodedSignedCert, &encodedSignedCertSize);
3607             if (ret)
3608             {
3609                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3610                  encodedSignedCert, encodedSignedCertSize);
3611                 LocalFree(encodedSignedCert);
3612             }
3613         }
3614         CryptMemFree(sig);
3615     }
3616     return context;
3617 }
3618
3619 /* Copies data from the parameters into info, where:
3620  * pSerialNumber: The serial number.  Must not be NULL.
3621  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3622  *                     Must not be NULL
3623  * pSignatureAlgorithm: Optional.
3624  * pStartTime: The starting time of the certificate.  If NULL, the current
3625  *             system time is used.
3626  * pEndTime: The ending time of the certificate.  If NULL, one year past the
3627  *           starting time is used.
3628  * pubKey: The public key of the certificate.  Must not be NULL.
3629  * pExtensions: Extensions to be included with the certificate.  Optional.
3630  */
3631 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3632  const CERT_NAME_BLOB *pSubjectIssuerBlob,
3633  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3634  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3635  const CERT_EXTENSIONS *pExtensions)
3636 {
3637     static CHAR oid[] = szOID_RSA_SHA1RSA;
3638
3639     assert(info);
3640     assert(pSerialNumber);
3641     assert(pSubjectIssuerBlob);
3642     assert(pubKey);
3643
3644     if (pExtensions && pExtensions->cExtension)
3645         info->dwVersion = CERT_V3;
3646     else
3647         info->dwVersion = CERT_V1;
3648     info->SerialNumber.cbData = pSerialNumber->cbData;
3649     info->SerialNumber.pbData = pSerialNumber->pbData;
3650     if (pSignatureAlgorithm)
3651         info->SignatureAlgorithm = *pSignatureAlgorithm;
3652     else
3653     {
3654         info->SignatureAlgorithm.pszObjId = oid;
3655         info->SignatureAlgorithm.Parameters.cbData = 0;
3656         info->SignatureAlgorithm.Parameters.pbData = NULL;
3657     }
3658     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3659     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3660     if (pStartTime)
3661         SystemTimeToFileTime(pStartTime, &info->NotBefore);
3662     else
3663         GetSystemTimeAsFileTime(&info->NotBefore);
3664     if (pEndTime)
3665         SystemTimeToFileTime(pEndTime, &info->NotAfter);
3666     else
3667     {
3668         SYSTEMTIME endTime;
3669
3670         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3671         {
3672             endTime.wYear++;
3673             SystemTimeToFileTime(&endTime, &info->NotAfter);
3674         }
3675     }
3676     info->Subject.cbData = pSubjectIssuerBlob->cbData;
3677     info->Subject.pbData = pSubjectIssuerBlob->pbData;
3678     info->SubjectPublicKeyInfo = *pubKey;
3679     if (pExtensions)
3680     {
3681         info->cExtension = pExtensions->cExtension;
3682         info->rgExtension = pExtensions->rgExtension;
3683     }
3684     else
3685     {
3686         info->cExtension = 0;
3687         info->rgExtension = NULL;
3688     }
3689 }
3690
3691 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3692 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3693 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3694
3695 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3696 {
3697     HCRYPTPROV hProv = 0;
3698     HMODULE rpcrt = LoadLibraryW(L"rpcrt4");
3699
3700     if (rpcrt)
3701     {
3702         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3703          "UuidCreate");
3704         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3705          "UuidToStringA");
3706         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3707          rpcrt, "RpcStringFreeA");
3708
3709         if (uuidCreate && uuidToString && rpcStringFree)
3710         {
3711             UUID uuid;
3712             RPC_STATUS status = uuidCreate(&uuid);
3713
3714             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3715             {
3716                 unsigned char *uuidStr;
3717
3718                 status = uuidToString(&uuid, &uuidStr);
3719                 if (status == RPC_S_OK)
3720                 {
3721                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3722                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3723
3724                     if (ret)
3725                     {
3726                         HCRYPTKEY key;
3727
3728                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3729                         if (ret)
3730                             CryptDestroyKey(key);
3731                     }
3732                     rpcStringFree(&uuidStr);
3733                 }
3734             }
3735         }
3736         FreeLibrary(rpcrt);
3737     }
3738     return hProv;
3739 }
3740
3741 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3742  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3743  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3744  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3745  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3746 {
3747     PCCERT_CONTEXT context = NULL;
3748     BOOL ret, releaseContext = FALSE;
3749     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3750     DWORD pubKeySize = 0, dwKeySpec;
3751
3752     TRACE("(%08Ix, %p, %08lx, %p, %p, %p, %p, %p)\n", hProv,
3753      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3754      pExtensions, pExtensions);
3755
3756     if(!pSubjectIssuerBlob)
3757     {
3758         SetLastError(ERROR_INVALID_PARAMETER);
3759         return NULL;
3760     }
3761
3762     dwKeySpec = pKeyProvInfo ? pKeyProvInfo->dwKeySpec : AT_SIGNATURE;
3763     if (!hProv)
3764     {
3765         if (!pKeyProvInfo)
3766         {
3767             hProv = CRYPT_CreateKeyProv();
3768             releaseContext = TRUE;
3769         }
3770         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3771         {
3772             SetLastError(NTE_BAD_FLAGS);
3773             return NULL;
3774         }
3775         else
3776         {
3777             HCRYPTKEY hKey = 0;
3778             /* acquire the context using the given information*/
3779             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3780                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3781                     pKeyProvInfo->dwFlags);
3782             if (!ret)
3783             {
3784                 if(GetLastError() != NTE_BAD_KEYSET)
3785                     return NULL;
3786                 /* create the key set */
3787                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3788                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3789                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3790                 if (!ret)
3791                     return NULL;
3792             }
3793             /* check if the key is here */
3794             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3795             if(!ret)
3796             {
3797                 if (NTE_NO_KEY == GetLastError())
3798                 { /* generate the key */
3799                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3800                 }
3801                 if (!ret)
3802                 {
3803                     CryptReleaseContext(hProv,0);
3804                     SetLastError(NTE_BAD_KEYSET);
3805                     return NULL;
3806                 }
3807             }
3808             CryptDestroyKey(hKey);
3809             releaseContext = TRUE;
3810         }
3811     }
3812
3813     ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3814      &pubKeySize);
3815     if (!ret)
3816         goto end;
3817     pubKey = CryptMemAlloc(pubKeySize);
3818     if (pubKey)
3819     {
3820         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3821          pubKey, &pubKeySize);
3822         if (ret)
3823         {
3824             CERT_INFO info = { 0 };
3825             CRYPT_DER_BLOB blob = { 0, NULL };
3826             BYTE serial[16];
3827             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3828
3829             CryptGenRandom(hProv, sizeof(serial), serial);
3830             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3831              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3832             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3833              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3834              &blob.cbData);
3835             if (ret)
3836             {
3837                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3838                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3839                      &info.SignatureAlgorithm);
3840                 else
3841                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
3842                      blob.pbData, blob.cbData);
3843                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3844                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3845                 LocalFree(blob.pbData);
3846             }
3847         }
3848         CryptMemFree(pubKey);
3849     }
3850 end:
3851     if (releaseContext)
3852         CryptReleaseContext(hProv, 0);
3853     return context;
3854 }
3855
3856 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3857                                void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3858                                PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3859                                PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3860 {
3861     FIXME("(0x%lx, %ld, %p, %p, 0x%lx, %p, %p): stub\n", dwEncodingType,
3862           dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3863           pVerifyUsageStatus);
3864     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3865     return FALSE;
3866 }
3867
3868 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3869                                       const BYTE *pbEncoded, DWORD cbEncoded,
3870                                       DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3871 {
3872     TRACE("(0x%lx, 0x%lx, %p, %ld, 0x%08lx, %p)\n", dwContextType, dwEncodingType,
3873           pbEncoded, cbEncoded, dwFlags, pCreatePara);
3874
3875     if (dwFlags)
3876     {
3877         FIXME("dwFlags 0x%08lx not handled\n", dwFlags);
3878         return NULL;
3879     }
3880     if (pCreatePara)
3881     {
3882         FIXME("pCreatePara not handled\n");
3883         return NULL;
3884     }
3885
3886     switch (dwContextType)
3887     {
3888     case CERT_STORE_CERTIFICATE_CONTEXT:
3889         return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3890     case CERT_STORE_CRL_CONTEXT:
3891         return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3892     case CERT_STORE_CTL_CONTEXT:
3893         return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3894     default:
3895         WARN("unknown context type: 0x%lx\n", dwContextType);
3896         return NULL;
3897     }
3898 }
3899
3900 BOOL WINAPI CryptSetKeyIdentifierProperty(const CRYPT_HASH_BLOB *pKeyIdentifier, DWORD dwPropId,
3901     DWORD dwFlags, LPCWSTR pwszComputerName, void *pvReserved, const void *pvData)
3902 {
3903     FIXME("(%p, 0x%lx, 0x%lx, %s, %p, %p): stub\n", pKeyIdentifier, dwPropId, dwFlags,
3904         debugstr_w(pwszComputerName), pvReserved, pvData);
3905     return FALSE;
3906 }