?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ole32/tests: Test creation of a storage on an ILockBytes containing data.
[wine.git] / dlls / crypt32 / cert.c
blob75b0e12ad049f13a9e01df30d4d3880b02deb1e5
1 /*
2 * Copyright 2004-2006 Juan Lang
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17 *
18 */
19
20 #include <assert.h>
21 #include <stdarg.h>
22
23 #define NONAMELESSUNION
24 #include "windef.h"
25 #include "winbase.h"
26 #include "wincrypt.h"
27 #include "winnls.h"
28 #include "rpc.h"
29 #include "wine/debug.h"
30 #include "wine/unicode.h"
31 #include "crypt32_private.h"
32
33 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
34
35 /* Internal version of CertGetCertificateContextProperty that gets properties
36 * directly from the context (or the context it's linked to, depending on its
37 * type.) Doesn't handle special-case properties, since they are handled by
38 * CertGetCertificateContextProperty, and are particular to the store in which
39 * the property exists (which is separate from the context.)
40 */
41 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
42 void *pvData, DWORD *pcbData);
43
44 /* Internal version of CertSetCertificateContextProperty that sets properties
45 * directly on the context (or the context it's linked to, depending on its
46 * type.) Doesn't handle special cases, since they're handled by
47 * CertSetCertificateContextProperty anyway.
48 */
49 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
50 DWORD dwFlags, const void *pvData);
51
52 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
53 DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
54 DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
55 {
56 PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
57 pbCertEncoded, cbCertEncoded);
58 BOOL ret;
59
60 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
61 pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
62
63 if (cert)
64 {
65 ret = CertAddCertificateContextToStore(hCertStore, cert,
66 dwAddDisposition, ppCertContext);
67 CertFreeCertificateContext(cert);
68 }
69 else
70 ret = FALSE;
71 return ret;
72 }
73
74 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
75 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
76 {
77 HCERTSTORE store;
78 BOOL ret = FALSE;
79
80 TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
81 cbCertEncoded);
82
83 store = CertOpenSystemStoreA(0, pszCertStoreName);
84 if (store)
85 {
86 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
87 pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
88 CertCloseStore(store, 0);
89 }
90 return ret;
91 }
92
93 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
94 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
95 {
96 HCERTSTORE store;
97 BOOL ret = FALSE;
98
99 TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
100 cbCertEncoded);
101
102 store = CertOpenSystemStoreW(0, pszCertStoreName);
103 if (store)
104 {
105 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
106 pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
107 CertCloseStore(store, 0);
108 }
109 return ret;
110 }
111
112 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
113 PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
114 PCCERT_CONTEXT *ppCertContext)
115 {
116 static int calls;
117 PWINECRYPT_CERTSTORE store = (PWINECRYPT_CERTSTORE)hCertStore;
118
119 if (!(calls++))
120 FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore, pCertContext,
121 dwAddDisposition, ppCertContext);
122 if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
123 return FALSE;
124 if (store->type == StoreTypeCollection)
125 {
126 SetLastError(E_INVALIDARG);
127 return FALSE;
128 }
129 return CertAddCertificateContextToStore(hCertStore, pCertContext,
130 dwAddDisposition, ppCertContext);
131 }
132
133 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
134 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
135 {
136 PCERT_CONTEXT cert = NULL;
137 BOOL ret;
138 PCERT_INFO certInfo = NULL;
139 DWORD size = 0;
140
141 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
142 cbCertEncoded);
143
144 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
145 pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
146 &certInfo, &size);
147 if (ret)
148 {
149 BYTE *data = NULL;
150
151 cert = Context_CreateDataContext(sizeof(CERT_CONTEXT));
152 if (!cert)
153 goto end;
154 data = CryptMemAlloc(cbCertEncoded);
155 if (!data)
156 {
157 CryptMemFree(cert);
158 cert = NULL;
159 goto end;
160 }
161 memcpy(data, pbCertEncoded, cbCertEncoded);
162 cert->dwCertEncodingType = dwCertEncodingType;
163 cert->pbCertEncoded = data;
164 cert->cbCertEncoded = cbCertEncoded;
165 cert->pCertInfo = certInfo;
166 cert->hCertStore = 0;
167 }
168
169 end:
170 return cert;
171 }
172
173 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
174 PCCERT_CONTEXT pCertContext)
175 {
176 TRACE("(%p)\n", pCertContext);
177
178 if (!pCertContext)
179 return NULL;
180
181 Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
182 return pCertContext;
183 }
184
185 static void CertDataContext_Free(void *context)
186 {
187 PCERT_CONTEXT certContext = context;
188
189 CryptMemFree(certContext->pbCertEncoded);
190 LocalFree(certContext->pCertInfo);
191 }
192
193 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
194 {
195 BOOL ret = TRUE;
196
197 TRACE("(%p)\n", pCertContext);
198
199 if (pCertContext)
200 ret = Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
201 CertDataContext_Free);
202 return ret;
203 }
204
205 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
206 DWORD dwPropId)
207 {
208 PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
209 pCertContext, sizeof(CERT_CONTEXT));
210 DWORD ret;
211
212 TRACE("(%p, %d)\n", pCertContext, dwPropId);
213
214 if (properties)
215 ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
216 else
217 ret = 0;
218 return ret;
219 }
220
221 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
222 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
223 DWORD *pcbData)
224 {
225 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
226 pcbData);
227 if (ret && pvData)
228 {
229 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
230
231 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
232 }
233 return ret;
234 }
235
236 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
237 DWORD cb)
238 {
239 BOOL ret = TRUE;
240
241 if (!pvData)
242 *pcbData = cb;
243 else if (*pcbData < cb)
244 {
245 SetLastError(ERROR_MORE_DATA);
246 *pcbData = cb;
247 ret = FALSE;
248 }
249 else
250 {
251 memcpy(pvData, pb, cb);
252 *pcbData = cb;
253 }
254 return ret;
255 }
256
257 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
258 void *pvData, DWORD *pcbData)
259 {
260 PCCERT_CONTEXT pCertContext = context;
261 PCONTEXT_PROPERTY_LIST properties =
262 Context_GetProperties(context, sizeof(CERT_CONTEXT));
263 BOOL ret;
264 CRYPT_DATA_BLOB blob;
265
266 TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
267
268 if (properties)
269 ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
270 else
271 ret = FALSE;
272 if (ret)
273 ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
274 else
275 {
276 /* Implicit properties */
277 switch (dwPropId)
278 {
279 case CERT_SHA1_HASH_PROP_ID:
280 ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
281 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
282 pcbData);
283 break;
284 case CERT_MD5_HASH_PROP_ID:
285 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
286 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
287 pcbData);
288 break;
289 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
290 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
291 pCertContext->pCertInfo->Subject.pbData,
292 pCertContext->pCertInfo->Subject.cbData,
293 pvData, pcbData);
294 break;
295 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
296 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
297 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
298 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
299 pvData, pcbData);
300 break;
301 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
302 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
303 pCertContext->pCertInfo->SerialNumber.pbData,
304 pCertContext->pCertInfo->SerialNumber.cbData,
305 pvData, pcbData);
306 break;
307 case CERT_SIGNATURE_HASH_PROP_ID:
308 ret = CryptHashToBeSigned(0, pCertContext->dwCertEncodingType,
309 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
310 pcbData);
311 if (ret && pvData)
312 {
313 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
314
315 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
316 }
317 break;
318 case CERT_KEY_IDENTIFIER_PROP_ID:
319 {
320 PCERT_EXTENSION ext = CertFindExtension(
321 szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
322 pCertContext->pCertInfo->rgExtension);
323
324 if (ext)
325 {
326 CRYPT_DATA_BLOB value;
327 DWORD size = sizeof(value);
328
329 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
330 szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
331 ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
332 &size);
333 if (ret)
334 {
335 ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
336 value.cbData);
337 CertContext_SetProperty(context, dwPropId, 0, &value);
338 }
339 }
340 else
341 SetLastError(ERROR_INVALID_DATA);
342 break;
343 }
344 default:
345 SetLastError(CRYPT_E_NOT_FOUND);
346 }
347 }
348 TRACE("returning %d\n", ret);
349 return ret;
350 }
351
352 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
353 {
354 DWORD i, containerLen, provNameLen;
355 LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
356
357 info->pwszContainerName = (LPWSTR)data;
358 containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
359 data += containerLen;
360
361 info->pwszProvName = (LPWSTR)data;
362 provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
363 data += provNameLen;
364
365 info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
366 data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
367
368 for (i = 0; i < info->cProvParam; i++)
369 {
370 info->rgProvParam[i].pbData = data;
371 data += info->rgProvParam[i].cbData;
372 }
373 }
374
375 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
376 DWORD dwPropId, void *pvData, DWORD *pcbData)
377 {
378 BOOL ret;
379
380 TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
381
382 switch (dwPropId)
383 {
384 case 0:
385 case CERT_CERT_PROP_ID:
386 case CERT_CRL_PROP_ID:
387 case CERT_CTL_PROP_ID:
388 SetLastError(E_INVALIDARG);
389 ret = FALSE;
390 break;
391 case CERT_ACCESS_STATE_PROP_ID:
392 if (pCertContext->hCertStore)
393 ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
394 pvData, pcbData);
395 else
396 {
397 DWORD state = 0;
398
399 ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
400 }
401 break;
402 case CERT_KEY_PROV_HANDLE_PROP_ID:
403 {
404 CERT_KEY_CONTEXT keyContext;
405 DWORD size = sizeof(keyContext);
406
407 ret = CertContext_GetProperty((void *)pCertContext,
408 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
409 if (ret)
410 ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
411 sizeof(keyContext.hCryptProv));
412 break;
413 }
414 case CERT_KEY_PROV_INFO_PROP_ID:
415 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
416 pcbData);
417 if (ret && pvData)
418 CRYPT_FixKeyProvInfoPointers(pvData);
419 break;
420 default:
421 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
422 pcbData);
423 }
424
425 TRACE("returning %d\n", ret);
426 return ret;
427 }
428
429 /* Copies key provider info from from into to, where to is assumed to be a
430 * contiguous buffer of memory large enough for from and all its associated
431 * data, but whose pointers are uninitialized.
432 * Upon return, to contains a contiguous copy of from, packed in the following
433 * order:
434 * - CRYPT_KEY_PROV_INFO
435 * - pwszContainerName
436 * - pwszProvName
437 * - rgProvParam[0]...
438 */
439 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
440 const CRYPT_KEY_PROV_INFO *from)
441 {
442 DWORD i;
443 LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
444
445 if (from->pwszContainerName)
446 {
447 to->pwszContainerName = (LPWSTR)nextData;
448 lstrcpyW(to->pwszContainerName, from->pwszContainerName);
449 nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
450 }
451 else
452 to->pwszContainerName = NULL;
453 if (from->pwszProvName)
454 {
455 to->pwszProvName = (LPWSTR)nextData;
456 lstrcpyW(to->pwszProvName, from->pwszProvName);
457 nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
458 }
459 else
460 to->pwszProvName = NULL;
461 to->dwProvType = from->dwProvType;
462 to->dwFlags = from->dwFlags;
463 to->cProvParam = from->cProvParam;
464 to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
465 nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
466 to->dwKeySpec = from->dwKeySpec;
467 for (i = 0; i < to->cProvParam; i++)
468 {
469 memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
470 sizeof(CRYPT_KEY_PROV_PARAM));
471 to->rgProvParam[i].pbData = nextData;
472 memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
473 from->rgProvParam[i].cbData);
474 nextData += from->rgProvParam[i].cbData;
475 }
476 }
477
478 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
479 const CRYPT_KEY_PROV_INFO *info)
480 {
481 BOOL ret;
482 LPBYTE buf = NULL;
483 DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
484
485 if (info->pwszContainerName)
486 containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
487 else
488 containerSize = 0;
489 if (info->pwszProvName)
490 provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
491 else
492 provNameSize = 0;
493 size += containerSize + provNameSize;
494 for (i = 0; i < info->cProvParam; i++)
495 size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
496 buf = CryptMemAlloc(size);
497 if (buf)
498 {
499 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
500 ret = ContextPropertyList_SetProperty(properties,
501 CERT_KEY_PROV_INFO_PROP_ID, buf, size);
502 CryptMemFree(buf);
503 }
504 else
505 ret = FALSE;
506 return ret;
507 }
508
509 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
510 DWORD dwFlags, const void *pvData)
511 {
512 PCONTEXT_PROPERTY_LIST properties =
513 Context_GetProperties(context, sizeof(CERT_CONTEXT));
514 BOOL ret;
515
516 TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
517
518 if (!properties)
519 ret = FALSE;
520 else
521 {
522 switch (dwPropId)
523 {
524 case CERT_AUTO_ENROLL_PROP_ID:
525 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
526 case CERT_DESCRIPTION_PROP_ID:
527 case CERT_FRIENDLY_NAME_PROP_ID:
528 case CERT_HASH_PROP_ID:
529 case CERT_KEY_IDENTIFIER_PROP_ID:
530 case CERT_MD5_HASH_PROP_ID:
531 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
532 case CERT_PUBKEY_ALG_PARA_PROP_ID:
533 case CERT_PVK_FILE_PROP_ID:
534 case CERT_SIGNATURE_HASH_PROP_ID:
535 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
536 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
537 case CERT_EXTENDED_ERROR_INFO_PROP_ID:
538 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
539 case CERT_ENROLLMENT_PROP_ID:
540 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
541 case CERT_RENEWAL_PROP_ID:
542 {
543 if (pvData)
544 {
545 const CRYPT_DATA_BLOB *blob = pvData;
546
547 ret = ContextPropertyList_SetProperty(properties, dwPropId,
548 blob->pbData, blob->cbData);
549 }
550 else
551 {
552 ContextPropertyList_RemoveProperty(properties, dwPropId);
553 ret = TRUE;
554 }
555 break;
556 }
557 case CERT_DATE_STAMP_PROP_ID:
558 if (pvData)
559 ret = ContextPropertyList_SetProperty(properties, dwPropId,
560 pvData, sizeof(FILETIME));
561 else
562 {
563 ContextPropertyList_RemoveProperty(properties, dwPropId);
564 ret = TRUE;
565 }
566 break;
567 case CERT_KEY_CONTEXT_PROP_ID:
568 {
569 if (pvData)
570 {
571 const CERT_KEY_CONTEXT *keyContext = pvData;
572
573 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
574 {
575 SetLastError(E_INVALIDARG);
576 ret = FALSE;
577 }
578 else
579 ret = ContextPropertyList_SetProperty(properties, dwPropId,
580 (const BYTE *)keyContext, keyContext->cbSize);
581 }
582 else
583 {
584 ContextPropertyList_RemoveProperty(properties, dwPropId);
585 ret = TRUE;
586 }
587 break;
588 }
589 case CERT_KEY_PROV_INFO_PROP_ID:
590 if (pvData)
591 ret = CertContext_SetKeyProvInfoProperty(properties, pvData);
592 else
593 {
594 ContextPropertyList_RemoveProperty(properties, dwPropId);
595 ret = TRUE;
596 }
597 break;
598 case CERT_KEY_PROV_HANDLE_PROP_ID:
599 {
600 CERT_KEY_CONTEXT keyContext;
601 DWORD size = sizeof(keyContext);
602
603 ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
604 &keyContext, &size);
605 if (ret)
606 {
607 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
608 CryptReleaseContext(keyContext.hCryptProv, 0);
609 }
610 keyContext.cbSize = sizeof(keyContext);
611 if (pvData)
612 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
613 else
614 {
615 keyContext.hCryptProv = 0;
616 keyContext.dwKeySpec = AT_SIGNATURE;
617 }
618 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
619 0, &keyContext);
620 break;
621 }
622 default:
623 FIXME("%d: stub\n", dwPropId);
624 ret = FALSE;
625 }
626 }
627 TRACE("returning %d\n", ret);
628 return ret;
629 }
630
631 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
632 DWORD dwPropId, DWORD dwFlags, const void *pvData)
633 {
634 BOOL ret;
635
636 TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
637
638 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
639 * crashes on most of these, I'll be safer.
640 */
641 switch (dwPropId)
642 {
643 case 0:
644 case CERT_ACCESS_STATE_PROP_ID:
645 case CERT_CERT_PROP_ID:
646 case CERT_CRL_PROP_ID:
647 case CERT_CTL_PROP_ID:
648 SetLastError(E_INVALIDARG);
649 return FALSE;
650 }
651 ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
652 pvData);
653 TRACE("returning %d\n", ret);
654 return ret;
655 }
656
657 /* Acquires the private key using the key provider info, retrieving info from
658 * the certificate if info is NULL. The acquired provider is returned in
659 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
660 */
661 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
662 PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
663 {
664 DWORD size = 0;
665 BOOL allocated = FALSE, ret = TRUE;
666
667 if (!info)
668 {
669 ret = CertGetCertificateContextProperty(pCert,
670 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
671 if (ret)
672 {
673 info = HeapAlloc(GetProcessHeap(), 0, size);
674 if (info)
675 {
676 ret = CertGetCertificateContextProperty(pCert,
677 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
678 allocated = TRUE;
679 }
680 else
681 {
682 SetLastError(ERROR_OUTOFMEMORY);
683 ret = FALSE;
684 }
685 }
686 else
687 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
688 }
689 if (ret)
690 {
691 ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
692 info->pwszProvName, info->dwProvType, 0);
693 if (ret)
694 {
695 DWORD i;
696
697 for (i = 0; i < info->cProvParam; i++)
698 {
699 CryptSetProvParam(*phCryptProv,
700 info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
701 info->rgProvParam[i].dwFlags);
702 }
703 *pdwKeySpec = info->dwKeySpec;
704 }
705 else
706 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
707 }
708 if (allocated)
709 HeapFree(GetProcessHeap(), 0, info);
710 return ret;
711 }
712
713 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
714 DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
715 DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
716 {
717 BOOL ret = FALSE, cache = FALSE;
718 PCRYPT_KEY_PROV_INFO info = NULL;
719 CERT_KEY_CONTEXT keyContext;
720 DWORD size;
721
722 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
723 phCryptProv, pdwKeySpec, pfCallerFreeProv);
724
725 if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
726 {
727 DWORD size = 0;
728
729 ret = CertGetCertificateContextProperty(pCert,
730 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
731 if (ret)
732 {
733 info = HeapAlloc(GetProcessHeap(), 0, size);
734 ret = CertGetCertificateContextProperty(pCert,
735 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
736 if (ret)
737 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
738 }
739 }
740 else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
741 cache = TRUE;
742 *phCryptProv = 0;
743 if (cache)
744 {
745 size = sizeof(keyContext);
746 ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
747 &keyContext, &size);
748 if (ret)
749 {
750 *phCryptProv = keyContext.hCryptProv;
751 if (pdwKeySpec)
752 *pdwKeySpec = keyContext.dwKeySpec;
753 if (pfCallerFreeProv)
754 *pfCallerFreeProv = !cache;
755 }
756 }
757 if (!*phCryptProv)
758 {
759 ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
760 &keyContext.hCryptProv, &keyContext.dwKeySpec);
761 if (ret)
762 {
763 *phCryptProv = keyContext.hCryptProv;
764 if (pdwKeySpec)
765 *pdwKeySpec = keyContext.dwKeySpec;
766 if (cache)
767 {
768 keyContext.cbSize = sizeof(keyContext);
769 if (CertSetCertificateContextProperty(pCert,
770 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
771 {
772 if (pfCallerFreeProv)
773 *pfCallerFreeProv = FALSE;
774 }
775 }
776 else
777 {
778 if (pfCallerFreeProv)
779 *pfCallerFreeProv = TRUE;
780 }
781 }
782 }
783 HeapFree(GetProcessHeap(), 0, info);
784 return ret;
785 }
786
787 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
788 const CRYPT_KEY_PROV_INFO *keyProvInfo)
789 {
790 HCRYPTPROV csp;
791 BOOL matches = FALSE;
792
793 if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
794 keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
795 {
796 DWORD size;
797
798 /* Need to sign something to verify the sig. What to sign? Why not
799 * the certificate itself?
800 */
801 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
802 pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
803 &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
804 {
805 BYTE *certEncoded = CryptMemAlloc(size);
806
807 if (certEncoded)
808 {
809 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
810 pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
811 pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
812 NULL, certEncoded, &size))
813 {
814 if (size == pCert->cbCertEncoded &&
815 !memcmp(certEncoded, pCert->pbCertEncoded, size))
816 matches = TRUE;
817 }
818 CryptMemFree(certEncoded);
819 }
820 }
821 CryptReleaseContext(csp, 0);
822 }
823 return matches;
824 }
825
826 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
827 CRYPT_KEY_PROV_INFO *keyProvInfo)
828 {
829 CRYPT_KEY_PROV_INFO copy;
830 WCHAR containerW[MAX_PATH];
831 BOOL matches = FALSE;
832
833 MultiByteToWideChar(CP_ACP, 0, container, -1,
834 containerW, sizeof(containerW) / sizeof(containerW[0]));
835 /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
836 * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
837 * name.
838 */
839 memcpy(&copy, keyProvInfo, sizeof(copy));
840 copy.pwszContainerName = containerW;
841 matches = key_prov_info_matches_cert(pCert, &copy);
842 if (matches)
843 {
844 keyProvInfo->pwszContainerName =
845 CryptMemAlloc((strlenW(containerW) + 1) * sizeof(WCHAR));
846 if (keyProvInfo->pwszContainerName)
847 {
848 strcpyW(keyProvInfo->pwszContainerName, containerW);
849 keyProvInfo->dwKeySpec = AT_SIGNATURE;
850 }
851 else
852 matches = FALSE;
853 }
854 return matches;
855 }
856
857 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
858 * private key matches pCert's public key. Upon success, updates keyProvInfo
859 * with the matching container's info (free keyProvInfo.pwszContainerName upon
860 * success.)
861 * Returns TRUE if found, FALSE if not.
862 */
863 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
864 CRYPT_KEY_PROV_INFO *keyProvInfo)
865 {
866 HCRYPTPROV defProvider;
867 BOOL ret, found = FALSE;
868 char containerA[MAX_PATH];
869
870 assert(keyProvInfo->pwszContainerName == NULL);
871 if ((ret = CryptAcquireContextW(&defProvider, NULL,
872 keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
873 keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
874 {
875 DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
876
877 while (ret && !found)
878 {
879 DWORD size = sizeof(containerA);
880
881 ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
882 (BYTE *)containerA, &size, enumFlags);
883 if (ret)
884 found = container_matches_cert(pCert, containerA, keyProvInfo);
885 if (enumFlags & CRYPT_FIRST)
886 {
887 enumFlags &= ~CRYPT_FIRST;
888 enumFlags |= CRYPT_NEXT;
889 }
890 }
891 CryptReleaseContext(defProvider, 0);
892 }
893 return found;
894 }
895
896 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
897 {
898 BOOL found = FALSE, ret = TRUE;
899 DWORD index = 0, cbProvName = 0;
900 CRYPT_KEY_PROV_INFO keyProvInfo;
901
902 TRACE("(%p, %08x)\n", pCert, dwFlags);
903
904 memset(&keyProvInfo, 0, sizeof(keyProvInfo));
905 while (ret && !found)
906 {
907 DWORD size = 0;
908
909 ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
910 NULL, &size);
911 if (ret)
912 {
913 if (size <= cbProvName)
914 ret = CryptEnumProvidersW(index, NULL, 0,
915 &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
916 else
917 {
918 CryptMemFree(keyProvInfo.pwszProvName);
919 keyProvInfo.pwszProvName = CryptMemAlloc(size);
920 if (keyProvInfo.pwszProvName)
921 {
922 cbProvName = size;
923 ret = CryptEnumProvidersW(index, NULL, 0,
924 &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
925 if (ret)
926 {
927 if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
928 keyProvInfo.dwFlags |= CRYPT_SILENT;
929 if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
930 !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
931 CRYPT_FIND_MACHINE_KEYSET_FLAG)))
932 {
933 keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
934 found = find_key_prov_info_in_provider(pCert,
935 &keyProvInfo);
936 }
937 if (!found)
938 {
939 if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
940 !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
941 CRYPT_FIND_MACHINE_KEYSET_FLAG)))
942 {
943 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
944 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
945 found = find_key_prov_info_in_provider(pCert,
946 &keyProvInfo);
947 }
948 }
949 }
950 }
951 else
952 ret = FALSE;
953 }
954 index++;
955 }
956 }
957 if (found)
958 CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
959 0, &keyProvInfo);
960 CryptMemFree(keyProvInfo.pwszProvName);
961 CryptMemFree(keyProvInfo.pwszContainerName);
962 return found;
963 }
964
965 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
966 {
967 BOOL matches = FALSE;
968 DWORD size;
969
970 if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
971 NULL, &size))
972 {
973 CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
974
975 if (keyProvInfo)
976 {
977 if (CertGetCertificateContextProperty(pCert,
978 CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
979 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
980 CryptMemFree(keyProvInfo);
981 }
982 }
983 return matches;
984 }
985
986 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
987 DWORD dwFlags, void *pvReserved)
988 {
989 BOOL matches = FALSE;
990
991 TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
992
993 matches = cert_prov_info_matches_cert(pCert);
994 if (!matches)
995 matches = find_matching_provider(pCert, dwFlags);
996 return matches;
997 }
998
999 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1000 PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1001 {
1002 BOOL ret;
1003
1004 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1005
1006 ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1007 &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1008 &pCertId2->SerialNumber);
1009 TRACE("returning %d\n", ret);
1010 return ret;
1011 }
1012
1013 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1014 PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1015 {
1016 BOOL ret;
1017
1018 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1019
1020 if (pCertName1->cbData == pCertName2->cbData)
1021 {
1022 if (pCertName1->cbData)
1023 ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1024 pCertName1->cbData);
1025 else
1026 ret = TRUE;
1027 }
1028 else
1029 ret = FALSE;
1030 TRACE("returning %d\n", ret);
1031 return ret;
1032 }
1033
1034 /* Returns the number of significant bytes in pInt, where a byte is
1035 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1036 * for negative numbers. pInt is assumed to be little-endian.
1037 */
1038 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1039 {
1040 DWORD ret = pInt->cbData;
1041
1042 while (ret > 1)
1043 {
1044 if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1045 ret--;
1046 else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1047 ret--;
1048 else
1049 break;
1050 }
1051 return ret;
1052 }
1053
1054 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1055 PCRYPT_INTEGER_BLOB pInt2)
1056 {
1057 BOOL ret;
1058 DWORD cb1, cb2;
1059
1060 TRACE("(%p, %p)\n", pInt1, pInt2);
1061
1062 cb1 = CRYPT_significantBytes(pInt1);
1063 cb2 = CRYPT_significantBytes(pInt2);
1064 if (cb1 == cb2)
1065 {
1066 if (cb1)
1067 ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1068 else
1069 ret = TRUE;
1070 }
1071 else
1072 ret = FALSE;
1073 TRACE("returning %d\n", ret);
1074 return ret;
1075 }
1076
1077 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1078 PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1079 {
1080 BOOL ret;
1081
1082 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1083
1084 switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1085 {
1086 case 0: /* Seems to mean "raw binary bits" */
1087 if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1088 pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1089 {
1090 if (pPublicKey2->PublicKey.cbData)
1091 ret = !memcmp(pPublicKey1->PublicKey.pbData,
1092 pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1093 else
1094 ret = TRUE;
1095 }
1096 else
1097 ret = FALSE;
1098 break;
1099 default:
1100 WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1101 /* FALLTHROUGH */
1102 case X509_ASN_ENCODING:
1103 {
1104 BLOBHEADER *pblob1, *pblob2;
1105 DWORD length;
1106 ret = FALSE;
1107 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1108 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1109 0, NULL, &length))
1110 {
1111 pblob1 = CryptMemAlloc(length);
1112 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1113 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1114 0, pblob1, &length))
1115 {
1116 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1117 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1118 0, NULL, &length))
1119 {
1120 pblob2 = CryptMemAlloc(length);
1121 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1122 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1123 0, pblob2, &length))
1124 {
1125 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1126 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1127 *pk2 = (LPVOID)(pblob2 + 1);
1128 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1129 && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1130 }
1131 CryptMemFree(pblob2);
1132 }
1133 }
1134 CryptMemFree(pblob1);
1135 }
1136
1137 break;
1138 }
1139 }
1140 return ret;
1141 }
1142
1143 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1144 PCERT_PUBLIC_KEY_INFO pPublicKey)
1145 {
1146 DWORD len = 0;
1147
1148 TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1149
1150 if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1151 {
1152 SetLastError(ERROR_FILE_NOT_FOUND);
1153 return 0;
1154 }
1155 if (pPublicKey->Algorithm.pszObjId &&
1156 !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1157 {
1158 FIXME("unimplemented for DH public keys\n");
1159 SetLastError(CRYPT_E_ASN1_BADTAG);
1160 }
1161 else
1162 {
1163 DWORD size;
1164 PBYTE buf;
1165 BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
1166 RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1167 pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1168 &size);
1169
1170 if (ret)
1171 {
1172 RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1173
1174 len = rsaPubKey->bitlen;
1175 LocalFree(buf);
1176 }
1177 }
1178 return len;
1179 }
1180
1181 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1182 DWORD dwFlags, const void *pvPara);
1183
1184 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1185 DWORD dwFlags, const void *pvPara)
1186 {
1187 BOOL ret;
1188 BYTE hash[16];
1189 DWORD size = sizeof(hash);
1190
1191 ret = CertGetCertificateContextProperty(pCertContext,
1192 CERT_MD5_HASH_PROP_ID, hash, &size);
1193 if (ret)
1194 {
1195 const CRYPT_HASH_BLOB *pHash = pvPara;
1196
1197 if (size == pHash->cbData)
1198 ret = !memcmp(pHash->pbData, hash, size);
1199 else
1200 ret = FALSE;
1201 }
1202 return ret;
1203 }
1204
1205 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1206 DWORD dwFlags, const void *pvPara)
1207 {
1208 BOOL ret;
1209 BYTE hash[20];
1210 DWORD size = sizeof(hash);
1211
1212 ret = CertGetCertificateContextProperty(pCertContext,
1213 CERT_SHA1_HASH_PROP_ID, hash, &size);
1214 if (ret)
1215 {
1216 const CRYPT_HASH_BLOB *pHash = pvPara;
1217
1218 if (size == pHash->cbData)
1219 ret = !memcmp(pHash->pbData, hash, size);
1220 else
1221 ret = FALSE;
1222 }
1223 return ret;
1224 }
1225
1226 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1227 DWORD dwFlags, const void *pvPara)
1228 {
1229 CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1230 BOOL ret;
1231
1232 if (dwType & CERT_INFO_SUBJECT_FLAG)
1233 toCompare = &pCertContext->pCertInfo->Subject;
1234 else
1235 toCompare = &pCertContext->pCertInfo->Issuer;
1236 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1237 toCompare, blob);
1238 return ret;
1239 }
1240
1241 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1242 DWORD dwType, DWORD dwFlags, const void *pvPara)
1243 {
1244 CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1245 BOOL ret;
1246
1247 ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1248 &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1249 return ret;
1250 }
1251
1252 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1253 DWORD dwType, DWORD dwFlags, const void *pvPara)
1254 {
1255 CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1256 BOOL ret;
1257
1258 /* Matching serial number and subject match.. */
1259 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1260 &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1261 if (ret)
1262 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1263 &pCertInfo->SerialNumber);
1264 else
1265 {
1266 /* failing that, if the serial number and issuer match, we match */
1267 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1268 &pCertInfo->SerialNumber);
1269 if (ret)
1270 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1271 &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1272 }
1273 TRACE("returning %d\n", ret);
1274 return ret;
1275 }
1276
1277 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1278 DWORD dwFlags, const void *pvPara)
1279 {
1280 CERT_ID *id = (CERT_ID *)pvPara;
1281 BOOL ret;
1282
1283 switch (id->dwIdChoice)
1284 {
1285 case CERT_ID_ISSUER_SERIAL_NUMBER:
1286 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1287 &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1288 if (ret)
1289 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1290 &id->u.IssuerSerialNumber.SerialNumber);
1291 break;
1292 case CERT_ID_SHA1_HASH:
1293 ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1294 &id->u.HashId);
1295 break;
1296 case CERT_ID_KEY_IDENTIFIER:
1297 {
1298 DWORD size = 0;
1299
1300 ret = CertGetCertificateContextProperty(pCertContext,
1301 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1302 if (ret && size == id->u.KeyId.cbData)
1303 {
1304 LPBYTE buf = CryptMemAlloc(size);
1305
1306 if (buf)
1307 {
1308 CertGetCertificateContextProperty(pCertContext,
1309 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1310 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1311 CryptMemFree(buf);
1312 }
1313 }
1314 else
1315 ret = FALSE;
1316 break;
1317 }
1318 default:
1319 ret = FALSE;
1320 break;
1321 }
1322 return ret;
1323 }
1324
1325 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1326 DWORD dwFlags, const void *pvPara)
1327 {
1328 PCCERT_CONTEXT toCompare = pvPara;
1329 return CertCompareCertificate(pCertContext->dwCertEncodingType,
1330 pCertContext->pCertInfo, toCompare->pCertInfo);
1331 }
1332
1333 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1334 DWORD dwFlags, const void *pvPara)
1335 {
1336 const CRYPT_HASH_BLOB *hash = pvPara;
1337 DWORD size = 0;
1338 BOOL ret;
1339
1340 ret = CertGetCertificateContextProperty(pCertContext,
1341 CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1342 if (ret && size == hash->cbData)
1343 {
1344 LPBYTE buf = CryptMemAlloc(size);
1345
1346 if (buf)
1347 {
1348 CertGetCertificateContextProperty(pCertContext,
1349 CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1350 ret = !memcmp(buf, hash->pbData, size);
1351 CryptMemFree(buf);
1352 }
1353 }
1354 else
1355 ret = FALSE;
1356 return ret;
1357 }
1358
1359 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1360 PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1361 const void *pvPara)
1362 {
1363 BOOL matches = FALSE;
1364 PCCERT_CONTEXT ret;
1365
1366 ret = prev;
1367 do {
1368 ret = CertEnumCertificatesInStore(store, ret);
1369 if (ret)
1370 matches = compare(ret, dwType, dwFlags, pvPara);
1371 } while (ret != NULL && !matches);
1372 return ret;
1373 }
1374
1375 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1376 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1377
1378 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1379 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1380 {
1381 return CertEnumCertificatesInStore(store, prev);
1382 }
1383
1384 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1385 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1386 {
1387 BOOL ret;
1388 PCCERT_CONTEXT found = NULL, subject = pvPara;
1389 PCERT_EXTENSION ext;
1390 DWORD size;
1391
1392 if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1393 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1394 {
1395 CERT_AUTHORITY_KEY_ID_INFO *info;
1396
1397 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1398 X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1399 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1400 &info, &size);
1401 if (ret)
1402 {
1403 CERT_ID id;
1404
1405 if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1406 {
1407 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1408 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1409 sizeof(CERT_NAME_BLOB));
1410 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1411 &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1412 }
1413 else if (info->KeyId.cbData)
1414 {
1415 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1416 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1417 }
1418 else
1419 ret = FALSE;
1420 if (ret)
1421 found = cert_compare_certs_in_store(store, prev,
1422 compare_cert_by_cert_id, dwType, dwFlags, &id);
1423 LocalFree(info);
1424 }
1425 }
1426 else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1427 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1428 {
1429 CERT_AUTHORITY_KEY_ID2_INFO *info;
1430
1431 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1432 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1433 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1434 &info, &size);
1435 if (ret)
1436 {
1437 CERT_ID id;
1438
1439 if (info->AuthorityCertIssuer.cAltEntry &&
1440 info->AuthorityCertSerialNumber.cbData)
1441 {
1442 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1443 DWORD i;
1444
1445 for (i = 0; !directoryName &&
1446 i < info->AuthorityCertIssuer.cAltEntry; i++)
1447 if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1448 == CERT_ALT_NAME_DIRECTORY_NAME)
1449 directoryName =
1450 &info->AuthorityCertIssuer.rgAltEntry[i];
1451 if (directoryName)
1452 {
1453 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1454 memcpy(&id.u.IssuerSerialNumber.Issuer,
1455 &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1456 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1457 &info->AuthorityCertSerialNumber,
1458 sizeof(CRYPT_INTEGER_BLOB));
1459 }
1460 else
1461 {
1462 FIXME("no supported name type in authority key id2\n");
1463 ret = FALSE;
1464 }
1465 }
1466 else if (info->KeyId.cbData)
1467 {
1468 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1469 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1470 }
1471 else
1472 ret = FALSE;
1473 if (ret)
1474 found = cert_compare_certs_in_store(store, prev,
1475 compare_cert_by_cert_id, dwType, dwFlags, &id);
1476 LocalFree(info);
1477 }
1478 }
1479 else
1480 found = cert_compare_certs_in_store(store, prev,
1481 compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1482 dwFlags, &subject->pCertInfo->Issuer);
1483 return found;
1484 }
1485
1486 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1487 DWORD dwType, DWORD dwFlags, const void *pvPara)
1488 {
1489 PCERT_NAME_BLOB name;
1490 DWORD len;
1491 BOOL ret = FALSE;
1492
1493 if (dwType & CERT_INFO_SUBJECT_FLAG)
1494 name = &pCertContext->pCertInfo->Subject;
1495 else
1496 name = &pCertContext->pCertInfo->Issuer;
1497 len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1498 CERT_SIMPLE_NAME_STR, NULL, 0);
1499 if (len)
1500 {
1501 LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1502
1503 if (str)
1504 {
1505 LPWSTR ptr;
1506
1507 CertNameToStrW(pCertContext->dwCertEncodingType, name,
1508 CERT_SIMPLE_NAME_STR, str, len);
1509 for (ptr = str; *ptr; ptr++)
1510 *ptr = tolowerW(*ptr);
1511 if (strstrW(str, pvPara))
1512 ret = TRUE;
1513 CryptMemFree(str);
1514 }
1515 }
1516 return ret;
1517 }
1518
1519 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1520 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1521 {
1522 PCCERT_CONTEXT found = NULL;
1523
1524 TRACE("%s\n", debugstr_a(pvPara));
1525
1526 if (pvPara)
1527 {
1528 int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1529 LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1530
1531 if (str)
1532 {
1533 LPWSTR ptr;
1534
1535 MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1536 for (ptr = str; *ptr; ptr++)
1537 *ptr = tolowerW(*ptr);
1538 found = cert_compare_certs_in_store(store, prev,
1539 compare_cert_by_name_str, dwType, dwFlags, str);
1540 CryptMemFree(str);
1541 }
1542 }
1543 else
1544 found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1545 return found;
1546 }
1547
1548 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1549 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1550 {
1551 PCCERT_CONTEXT found = NULL;
1552
1553 TRACE("%s\n", debugstr_w(pvPara));
1554
1555 if (pvPara)
1556 {
1557 DWORD len = strlenW(pvPara);
1558 LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1559
1560 if (str)
1561 {
1562 LPCWSTR src;
1563 LPWSTR dst;
1564
1565 for (src = pvPara, dst = str; *src; src++, dst++)
1566 *dst = tolowerW(*src);
1567 *dst = 0;
1568 found = cert_compare_certs_in_store(store, prev,
1569 compare_cert_by_name_str, dwType, dwFlags, str);
1570 CryptMemFree(str);
1571 }
1572 }
1573 else
1574 found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1575 return found;
1576 }
1577
1578 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1579 DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1580 PCCERT_CONTEXT pPrevCertContext)
1581 {
1582 PCCERT_CONTEXT ret;
1583 CertFindFunc find = NULL;
1584 CertCompareFunc compare = NULL;
1585
1586 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1587 dwFlags, dwType, pvPara, pPrevCertContext);
1588
1589 switch (dwType >> CERT_COMPARE_SHIFT)
1590 {
1591 case CERT_COMPARE_ANY:
1592 find = find_cert_any;
1593 break;
1594 case CERT_COMPARE_MD5_HASH:
1595 compare = compare_cert_by_md5_hash;
1596 break;
1597 case CERT_COMPARE_SHA1_HASH:
1598 compare = compare_cert_by_sha1_hash;
1599 break;
1600 case CERT_COMPARE_NAME:
1601 compare = compare_cert_by_name;
1602 break;
1603 case CERT_COMPARE_PUBLIC_KEY:
1604 compare = compare_cert_by_public_key;
1605 break;
1606 case CERT_COMPARE_NAME_STR_A:
1607 find = find_cert_by_name_str_a;
1608 break;
1609 case CERT_COMPARE_NAME_STR_W:
1610 find = find_cert_by_name_str_w;
1611 break;
1612 case CERT_COMPARE_SUBJECT_CERT:
1613 compare = compare_cert_by_subject_cert;
1614 break;
1615 case CERT_COMPARE_CERT_ID:
1616 compare = compare_cert_by_cert_id;
1617 break;
1618 case CERT_COMPARE_ISSUER_OF:
1619 find = find_cert_by_issuer;
1620 break;
1621 case CERT_COMPARE_EXISTING:
1622 compare = compare_existing_cert;
1623 break;
1624 case CERT_COMPARE_SIGNATURE_HASH:
1625 compare = compare_cert_by_signature_hash;
1626 break;
1627 default:
1628 FIXME("find type %08x unimplemented\n", dwType);
1629 }
1630
1631 if (find)
1632 ret = find(hCertStore, dwFlags, dwType, pvPara, pPrevCertContext);
1633 else if (compare)
1634 ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1635 compare, dwType, dwFlags, pvPara);
1636 else
1637 ret = NULL;
1638 if (!ret)
1639 SetLastError(CRYPT_E_NOT_FOUND);
1640 TRACE("returning %p\n", ret);
1641 return ret;
1642 }
1643
1644 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1645 DWORD dwCertEncodingType, PCERT_INFO pCertId)
1646 {
1647 TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1648
1649 if (!pCertId)
1650 {
1651 SetLastError(E_INVALIDARG);
1652 return NULL;
1653 }
1654 return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1655 CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1656 }
1657
1658 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1659 PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1660 {
1661 static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1662 CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1663
1664 if (*pdwFlags & ~supportedFlags)
1665 {
1666 SetLastError(E_INVALIDARG);
1667 return FALSE;
1668 }
1669 if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1670 {
1671 DWORD flags = 0;
1672 PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1673 NULL, &flags);
1674
1675 /* FIXME: what if the CRL has expired? */
1676 if (crl)
1677 {
1678 if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1679 pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1680 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1681 }
1682 else
1683 *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1684 }
1685 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1686 {
1687 if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1688 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1689 }
1690 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1691 {
1692 if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1693 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1694 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1695 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1696 }
1697 return TRUE;
1698 }
1699
1700 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1701 PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1702 DWORD *pdwFlags)
1703 {
1704 PCCERT_CONTEXT ret;
1705
1706 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1707 pPrevIssuerContext, *pdwFlags);
1708
1709 if (!pSubjectContext)
1710 {
1711 SetLastError(E_INVALIDARG);
1712 return NULL;
1713 }
1714
1715 ret = CertFindCertificateInStore(hCertStore,
1716 pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1717 pSubjectContext, pPrevIssuerContext);
1718 if (ret)
1719 {
1720 if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1721 pdwFlags))
1722 {
1723 CertFreeCertificateContext(ret);
1724 ret = NULL;
1725 }
1726 }
1727 TRACE("returning %p\n", ret);
1728 return ret;
1729 }
1730
1731 typedef struct _OLD_CERT_REVOCATION_STATUS {
1732 DWORD cbSize;
1733 DWORD dwIndex;
1734 DWORD dwError;
1735 DWORD dwReason;
1736 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1737
1738 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1739 void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1740
1741 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1742 DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1743 PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1744 {
1745 BOOL ret;
1746
1747 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1748 cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1749
1750 if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1751 pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1752 {
1753 SetLastError(E_INVALIDARG);
1754 return FALSE;
1755 }
1756 if (cContext)
1757 {
1758 static HCRYPTOIDFUNCSET set = NULL;
1759 DWORD size;
1760
1761 if (!set)
1762 set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1763 ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1764 if (ret)
1765 {
1766 if (size == 1)
1767 {
1768 /* empty list */
1769 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1770 ret = FALSE;
1771 }
1772 else
1773 {
1774 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1775
1776 if (dllList)
1777 {
1778 ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1779 dllList, &size);
1780 if (ret)
1781 {
1782 for (ptr = dllList; ret && *ptr;
1783 ptr += lstrlenW(ptr) + 1)
1784 {
1785 CertVerifyRevocationFunc func;
1786 HCRYPTOIDFUNCADDR hFunc;
1787
1788 ret = CryptGetDefaultOIDFunctionAddress(set,
1789 dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1790 if (ret)
1791 {
1792 ret = func(dwEncodingType, dwRevType, cContext,
1793 rgpvContext, dwFlags, pRevPara, pRevStatus);
1794 CryptFreeOIDFunctionAddress(hFunc, 0);
1795 }
1796 }
1797 }
1798 CryptMemFree(dllList);
1799 }
1800 else
1801 {
1802 SetLastError(ERROR_OUTOFMEMORY);
1803 ret = FALSE;
1804 }
1805 }
1806 }
1807 }
1808 else
1809 ret = TRUE;
1810 return ret;
1811 }
1812
1813 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1814 CRYPT_ATTRIBUTE rgAttr[])
1815 {
1816 PCRYPT_ATTRIBUTE ret = NULL;
1817 DWORD i;
1818
1819 TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1820
1821 if (!cAttr)
1822 return NULL;
1823 if (!pszObjId)
1824 {
1825 SetLastError(ERROR_INVALID_PARAMETER);
1826 return NULL;
1827 }
1828
1829 for (i = 0; !ret && i < cAttr; i++)
1830 if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1831 ret = &rgAttr[i];
1832 return ret;
1833 }
1834
1835 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1836 CERT_EXTENSION rgExtensions[])
1837 {
1838 PCERT_EXTENSION ret = NULL;
1839 DWORD i;
1840
1841 TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1842
1843 if (!cExtensions)
1844 return NULL;
1845 if (!pszObjId)
1846 {
1847 SetLastError(ERROR_INVALID_PARAMETER);
1848 return NULL;
1849 }
1850
1851 for (i = 0; !ret && i < cExtensions; i++)
1852 if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1853 rgExtensions[i].pszObjId))
1854 ret = &rgExtensions[i];
1855 return ret;
1856 }
1857
1858 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1859 {
1860 PCERT_RDN_ATTR ret = NULL;
1861 DWORD i, j;
1862
1863 TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1864
1865 if (!pszObjId)
1866 {
1867 SetLastError(ERROR_INVALID_PARAMETER);
1868 return NULL;
1869 }
1870
1871 for (i = 0; !ret && i < pName->cRDN; i++)
1872 for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1873 if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1874 pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1875 ret = &pName->rgRDN[i].rgRDNAttr[j];
1876 return ret;
1877 }
1878
1879 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
1880 const CERT_RDN_ATTR *attr)
1881 {
1882 DWORD i, j;
1883 BOOL match = FALSE;
1884
1885 for (i = 0; !match && i < name->cRDN; i++)
1886 {
1887 for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
1888 {
1889 if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
1890 attr->pszObjId) &&
1891 name->rgRDN[i].rgRDNAttr[j].dwValueType ==
1892 attr->dwValueType)
1893 {
1894 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
1895 {
1896 LPCWSTR nameStr =
1897 (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
1898 LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
1899
1900 if (attr->Value.cbData !=
1901 name->rgRDN[i].rgRDNAttr[j].Value.cbData)
1902 match = FALSE;
1903 else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
1904 match = !strncmpiW(nameStr, attrStr,
1905 attr->Value.cbData / sizeof(WCHAR));
1906 else
1907 match = !strncmpW(nameStr, attrStr,
1908 attr->Value.cbData / sizeof(WCHAR));
1909 TRACE("%s : %s => %d\n",
1910 debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
1911 debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
1912 match);
1913 }
1914 else
1915 {
1916 LPCSTR nameStr =
1917 (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
1918 LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
1919
1920 if (attr->Value.cbData !=
1921 name->rgRDN[i].rgRDNAttr[j].Value.cbData)
1922 match = FALSE;
1923 else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
1924 match = !strncasecmp(nameStr, attrStr,
1925 attr->Value.cbData);
1926 else
1927 match = !strncmp(nameStr, attrStr, attr->Value.cbData);
1928 TRACE("%s : %s => %d\n",
1929 debugstr_an(nameStr, attr->Value.cbData),
1930 debugstr_an(attrStr, attr->Value.cbData), match);
1931 }
1932 }
1933 }
1934 }
1935 return match;
1936 }
1937
1938 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
1939 DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
1940 {
1941 CERT_NAME_INFO *name;
1942 LPCSTR type;
1943 DWORD size;
1944 BOOL ret;
1945
1946 TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
1947 pRDN);
1948
1949 type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
1950 X509_NAME;
1951 if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
1952 pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
1953 {
1954 DWORD i;
1955
1956 for (i = 0; ret && i < pRDN->cRDNAttr; i++)
1957 ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
1958 if (!ret)
1959 SetLastError(CRYPT_E_NO_MATCH);
1960 LocalFree(name);
1961 }
1962 return ret;
1963 }
1964
1965 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1966 PCERT_INFO pCertInfo)
1967 {
1968 FILETIME fileTime;
1969 LONG ret;
1970
1971 if (!pTimeToVerify)
1972 {
1973 GetSystemTimeAsFileTime(&fileTime);
1974 pTimeToVerify = &fileTime;
1975 }
1976 if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1977 {
1978 ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1979 if (ret < 0)
1980 ret = 0;
1981 }
1982 return ret;
1983 }
1984
1985 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1986 PCERT_INFO pIssuerInfo)
1987 {
1988 TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1989
1990 return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1991 && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1992 }
1993
1994 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1995 DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1996 DWORD *pcbComputedHash)
1997 {
1998 BOOL ret = TRUE;
1999 HCRYPTHASH hHash = 0;
2000
2001 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
2002 pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2003
2004 if (!hCryptProv)
2005 hCryptProv = CRYPT_GetDefaultProvider();
2006 if (!Algid)
2007 Algid = CALG_SHA1;
2008 if (ret)
2009 {
2010 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2011 if (ret)
2012 {
2013 ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2014 if (ret)
2015 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2016 pcbComputedHash, 0);
2017 CryptDestroyHash(hHash);
2018 }
2019 }
2020 return ret;
2021 }
2022
2023 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2024 DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2025 BYTE *pbComputedHash, DWORD *pcbComputedHash)
2026 {
2027 BOOL ret = TRUE;
2028 HCRYPTHASH hHash = 0;
2029
2030 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2031 dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2032
2033 if (!hCryptProv)
2034 hCryptProv = CRYPT_GetDefaultProvider();
2035 if (!Algid)
2036 Algid = CALG_MD5;
2037 if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2038 {
2039 SetLastError(ERROR_FILE_NOT_FOUND);
2040 return FALSE;
2041 }
2042 if (ret)
2043 {
2044 BYTE *buf;
2045 DWORD size = 0;
2046
2047 ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2048 X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2049 (LPBYTE)&buf, &size);
2050 if (ret)
2051 {
2052 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2053 if (ret)
2054 {
2055 ret = CryptHashData(hHash, buf, size, 0);
2056 if (ret)
2057 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2058 pcbComputedHash, 0);
2059 CryptDestroyHash(hHash);
2060 }
2061 LocalFree(buf);
2062 }
2063 }
2064 return ret;
2065 }
2066
2067 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2068 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2069 BYTE *pbComputedHash, DWORD *pcbComputedHash)
2070 {
2071 BOOL ret;
2072 CERT_SIGNED_CONTENT_INFO *info;
2073 DWORD size;
2074
2075 TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2076 pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2077
2078 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2079 pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2080 if (ret)
2081 {
2082 PCCRYPT_OID_INFO oidInfo;
2083 HCRYPTHASH hHash;
2084
2085 if (!hCryptProv)
2086 hCryptProv = CRYPT_GetDefaultProvider();
2087 oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2088 info->SignatureAlgorithm.pszObjId, 0);
2089 if (!oidInfo)
2090 {
2091 SetLastError(NTE_BAD_ALGID);
2092 ret = FALSE;
2093 }
2094 else
2095 {
2096 ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2097 if (ret)
2098 {
2099 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2100 info->ToBeSigned.cbData, 0);
2101 if (ret)
2102 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2103 pcbComputedHash, 0);
2104 CryptDestroyHash(hHash);
2105 }
2106 }
2107 LocalFree(info);
2108 }
2109 return ret;
2110 }
2111
2112 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2113 DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2114 DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2115 const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2116 {
2117 BOOL ret;
2118 PCCRYPT_OID_INFO info;
2119 HCRYPTHASH hHash;
2120
2121 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2122 dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2123 pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2124
2125 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2126 pSignatureAlgorithm->pszObjId, 0);
2127 if (!info)
2128 {
2129 SetLastError(NTE_BAD_ALGID);
2130 return FALSE;
2131 }
2132 if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2133 {
2134 if (!hCryptProv)
2135 hCryptProv = CRYPT_GetDefaultProvider();
2136 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2137 if (ret)
2138 {
2139 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2140 cbEncodedToBeSigned, 0);
2141 if (ret)
2142 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2143 pcbSignature, 0);
2144 CryptDestroyHash(hHash);
2145 }
2146 }
2147 else
2148 {
2149 if (!hCryptProv)
2150 {
2151 SetLastError(ERROR_INVALID_PARAMETER);
2152 ret = FALSE;
2153 }
2154 else
2155 {
2156 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2157 if (ret)
2158 {
2159 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2160 cbEncodedToBeSigned, 0);
2161 if (ret)
2162 ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2163 pcbSignature);
2164 CryptDestroyHash(hHash);
2165 }
2166 }
2167 }
2168 return ret;
2169 }
2170
2171 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2172 DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2173 const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2174 const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2175 {
2176 BOOL ret;
2177 DWORD encodedSize, hashSize;
2178
2179 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2180 dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2181 pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2182
2183 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2184 NULL, &encodedSize);
2185 if (ret)
2186 {
2187 PBYTE encoded = CryptMemAlloc(encodedSize);
2188
2189 if (encoded)
2190 {
2191 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2192 pvStructInfo, encoded, &encodedSize);
2193 if (ret)
2194 {
2195 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2196 dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2197 pvHashAuxInfo, NULL, &hashSize);
2198 if (ret)
2199 {
2200 PBYTE hash = CryptMemAlloc(hashSize);
2201
2202 if (hash)
2203 {
2204 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2205 dwCertEncodingType, encoded, encodedSize,
2206 pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2207 if (ret)
2208 {
2209 CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2210
2211 info.ToBeSigned.cbData = encodedSize;
2212 info.ToBeSigned.pbData = encoded;
2213 memcpy(&info.SignatureAlgorithm,
2214 pSignatureAlgorithm,
2215 sizeof(info.SignatureAlgorithm));
2216 info.Signature.cbData = hashSize;
2217 info.Signature.pbData = hash;
2218 info.Signature.cUnusedBits = 0;
2219 ret = CryptEncodeObject(dwCertEncodingType,
2220 X509_CERT, &info, pbEncoded, pcbEncoded);
2221 }
2222 CryptMemFree(hash);
2223 }
2224 }
2225 }
2226 CryptMemFree(encoded);
2227 }
2228 }
2229 return ret;
2230 }
2231
2232 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2233 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2234 PCERT_PUBLIC_KEY_INFO pPublicKey)
2235 {
2236 return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2237 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
2238 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2239 }
2240
2241 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
2242 DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
2243 const CERT_SIGNED_CONTENT_INFO *signedCert)
2244 {
2245 BOOL ret;
2246 HCRYPTKEY key;
2247 PCCRYPT_OID_INFO info;
2248 ALG_ID pubKeyID, hashID;
2249
2250 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2251 signedCert->SignatureAlgorithm.pszObjId, 0);
2252 if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2253 {
2254 SetLastError(NTE_BAD_ALGID);
2255 return FALSE;
2256 }
2257 hashID = info->u.Algid;
2258 if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2259 pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2260 else
2261 pubKeyID = hashID;
2262 /* Load the default provider if necessary */
2263 if (!hCryptProv)
2264 hCryptProv = CRYPT_GetDefaultProvider();
2265 ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2266 pubKeyInfo, pubKeyID, 0, NULL, &key);
2267 if (ret)
2268 {
2269 HCRYPTHASH hash;
2270
2271 ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2272 if (ret)
2273 {
2274 ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2275 signedCert->ToBeSigned.cbData, 0);
2276 if (ret)
2277 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2278 signedCert->Signature.cbData, key, NULL, 0);
2279 CryptDestroyHash(hash);
2280 }
2281 CryptDestroyKey(key);
2282 }
2283 return ret;
2284 }
2285
2286 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2287 DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2288 DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2289 {
2290 BOOL ret = TRUE;
2291 CRYPT_DATA_BLOB subjectBlob;
2292
2293 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2294 dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2295 dwFlags, pvReserved);
2296
2297 switch (dwSubjectType)
2298 {
2299 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2300 {
2301 PCRYPT_DATA_BLOB blob = pvSubject;
2302
2303 subjectBlob.pbData = blob->pbData;
2304 subjectBlob.cbData = blob->cbData;
2305 break;
2306 }
2307 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2308 {
2309 PCERT_CONTEXT context = pvSubject;
2310
2311 subjectBlob.pbData = context->pbCertEncoded;
2312 subjectBlob.cbData = context->cbCertEncoded;
2313 break;
2314 }
2315 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2316 {
2317 PCRL_CONTEXT context = pvSubject;
2318
2319 subjectBlob.pbData = context->pbCrlEncoded;
2320 subjectBlob.cbData = context->cbCrlEncoded;
2321 break;
2322 }
2323 default:
2324 SetLastError(E_INVALIDARG);
2325 ret = FALSE;
2326 }
2327
2328 if (ret)
2329 {
2330 PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2331 DWORD size = 0;
2332
2333 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2334 subjectBlob.pbData, subjectBlob.cbData,
2335 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2336 &signedCert, &size);
2337 if (ret)
2338 {
2339 switch (dwIssuerType)
2340 {
2341 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2342 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2343 dwCertEncodingType, pvIssuer,
2344 signedCert);
2345 break;
2346 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2347 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2348 dwCertEncodingType,
2349 &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2350 signedCert);
2351 break;
2352 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2353 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2354 ret = FALSE;
2355 break;
2356 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2357 if (pvIssuer)
2358 {
2359 SetLastError(E_INVALIDARG);
2360 ret = FALSE;
2361 }
2362 else
2363 {
2364 FIXME("unimplemented for NULL signer\n");
2365 SetLastError(E_INVALIDARG);
2366 ret = FALSE;
2367 }
2368 break;
2369 default:
2370 SetLastError(E_INVALIDARG);
2371 ret = FALSE;
2372 }
2373 LocalFree(signedCert);
2374 }
2375 }
2376 return ret;
2377 }
2378
2379 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2380 PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2381 {
2382 PCERT_EXTENSION ext;
2383 BOOL ret = FALSE;
2384
2385 TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2386 cbKeyUsage);
2387
2388 ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2389 pCertInfo->rgExtension);
2390 if (ext)
2391 {
2392 CRYPT_BIT_BLOB usage;
2393 DWORD size = sizeof(usage);
2394
2395 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2396 ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2397 &usage, &size);
2398 if (ret)
2399 {
2400 if (cbKeyUsage < usage.cbData)
2401 ret = FALSE;
2402 else
2403 {
2404 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2405 if (cbKeyUsage > usage.cbData)
2406 memset(pbKeyUsage + usage.cbData, 0,
2407 cbKeyUsage - usage.cbData);
2408 }
2409 }
2410 }
2411 else
2412 SetLastError(0);
2413 return ret;
2414 }
2415
2416 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2417 PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2418 {
2419 PCERT_ENHKEY_USAGE usage = NULL;
2420 DWORD bytesNeeded;
2421 BOOL ret = TRUE;
2422
2423 if (!pCertContext || !pcbUsage)
2424 {
2425 SetLastError(ERROR_INVALID_PARAMETER);
2426 return FALSE;
2427 }
2428
2429 TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2430
2431 if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2432 {
2433 DWORD propSize = 0;
2434
2435 if (CertGetCertificateContextProperty(pCertContext,
2436 CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2437 {
2438 LPBYTE buf = CryptMemAlloc(propSize);
2439
2440 if (buf)
2441 {
2442 if (CertGetCertificateContextProperty(pCertContext,
2443 CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2444 {
2445 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2446 X509_ENHANCED_KEY_USAGE, buf, propSize,
2447 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2448 }
2449 CryptMemFree(buf);
2450 }
2451 }
2452 }
2453 if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2454 {
2455 PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2456 pCertContext->pCertInfo->cExtension,
2457 pCertContext->pCertInfo->rgExtension);
2458
2459 if (ext)
2460 {
2461 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2462 X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
2463 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2464 }
2465 }
2466 if (!usage)
2467 {
2468 /* If a particular location is specified, this should fail. Otherwise
2469 * it should succeed with an empty usage. (This is true on Win2k and
2470 * later, which we emulate.)
2471 */
2472 if (dwFlags)
2473 {
2474 SetLastError(CRYPT_E_NOT_FOUND);
2475 ret = FALSE;
2476 }
2477 else
2478 bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
2479 }
2480
2481 if (ret)
2482 {
2483 if (!pUsage)
2484 *pcbUsage = bytesNeeded;
2485 else if (*pcbUsage < bytesNeeded)
2486 {
2487 SetLastError(ERROR_MORE_DATA);
2488 *pcbUsage = bytesNeeded;
2489 ret = FALSE;
2490 }
2491 else
2492 {
2493 *pcbUsage = bytesNeeded;
2494 if (usage)
2495 {
2496 DWORD i;
2497 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
2498 sizeof(CERT_ENHKEY_USAGE) +
2499 usage->cUsageIdentifier * sizeof(LPSTR));
2500
2501 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
2502 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
2503 sizeof(CERT_ENHKEY_USAGE));
2504 for (i = 0; i < usage->cUsageIdentifier; i++)
2505 {
2506 pUsage->rgpszUsageIdentifier[i] = nextOID;
2507 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2508 nextOID += strlen(nextOID) + 1;
2509 }
2510 }
2511 else
2512 pUsage->cUsageIdentifier = 0;
2513 }
2514 }
2515 if (usage)
2516 LocalFree(usage);
2517 TRACE("returning %d\n", ret);
2518 return ret;
2519 }
2520
2521 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
2522 PCERT_ENHKEY_USAGE pUsage)
2523 {
2524 BOOL ret;
2525
2526 TRACE("(%p, %p)\n", pCertContext, pUsage);
2527
2528 if (pUsage)
2529 {
2530 CRYPT_DATA_BLOB blob = { 0, NULL };
2531
2532 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2533 pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2534 if (ret)
2535 {
2536 ret = CertSetCertificateContextProperty(pCertContext,
2537 CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2538 LocalFree(blob.pbData);
2539 }
2540 }
2541 else
2542 ret = CertSetCertificateContextProperty(pCertContext,
2543 CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2544 return ret;
2545 }
2546
2547 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2548 LPCSTR pszUsageIdentifier)
2549 {
2550 BOOL ret;
2551 DWORD size;
2552
2553 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2554
2555 if (CertGetEnhancedKeyUsage(pCertContext,
2556 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2557 {
2558 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2559
2560 if (usage)
2561 {
2562 ret = CertGetEnhancedKeyUsage(pCertContext,
2563 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2564 if (ret)
2565 {
2566 DWORD i;
2567 BOOL exists = FALSE;
2568
2569 /* Make sure usage doesn't already exist */
2570 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2571 {
2572 if (!strcmp(usage->rgpszUsageIdentifier[i],
2573 pszUsageIdentifier))
2574 exists = TRUE;
2575 }
2576 if (!exists)
2577 {
2578 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2579 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2580
2581 if (newUsage)
2582 {
2583 LPSTR nextOID;
2584
2585 newUsage->rgpszUsageIdentifier = (LPSTR *)
2586 ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2587 nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2588 + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2589 for (i = 0; i < usage->cUsageIdentifier; i++)
2590 {
2591 newUsage->rgpszUsageIdentifier[i] = nextOID;
2592 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2593 nextOID += strlen(nextOID) + 1;
2594 }
2595 newUsage->rgpszUsageIdentifier[i] = nextOID;
2596 strcpy(nextOID, pszUsageIdentifier);
2597 newUsage->cUsageIdentifier = i + 1;
2598 ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2599 CryptMemFree(newUsage);
2600 }
2601 else
2602 ret = FALSE;
2603 }
2604 }
2605 CryptMemFree(usage);
2606 }
2607 else
2608 ret = FALSE;
2609 }
2610 else
2611 {
2612 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2613 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2614
2615 if (usage)
2616 {
2617 usage->rgpszUsageIdentifier =
2618 (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2619 usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2620 sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2621 strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2622 usage->cUsageIdentifier = 1;
2623 ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2624 CryptMemFree(usage);
2625 }
2626 else
2627 ret = FALSE;
2628 }
2629 return ret;
2630 }
2631
2632 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2633 LPCSTR pszUsageIdentifier)
2634 {
2635 BOOL ret;
2636 DWORD size;
2637 CERT_ENHKEY_USAGE usage;
2638
2639 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2640
2641 size = sizeof(usage);
2642 ret = CertGetEnhancedKeyUsage(pCertContext,
2643 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2644 if (!ret && GetLastError() == ERROR_MORE_DATA)
2645 {
2646 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2647
2648 if (pUsage)
2649 {
2650 ret = CertGetEnhancedKeyUsage(pCertContext,
2651 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2652 if (ret)
2653 {
2654 if (pUsage->cUsageIdentifier)
2655 {
2656 DWORD i;
2657 BOOL found = FALSE;
2658
2659 for (i = 0; i < pUsage->cUsageIdentifier; i++)
2660 {
2661 if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2662 pszUsageIdentifier))
2663 found = TRUE;
2664 if (found && i < pUsage->cUsageIdentifier - 1)
2665 pUsage->rgpszUsageIdentifier[i] =
2666 pUsage->rgpszUsageIdentifier[i + 1];
2667 }
2668 pUsage->cUsageIdentifier--;
2669 /* Remove the usage if it's empty */
2670 if (pUsage->cUsageIdentifier)
2671 ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2672 else
2673 ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2674 }
2675 }
2676 CryptMemFree(pUsage);
2677 }
2678 else
2679 ret = FALSE;
2680 }
2681 else
2682 {
2683 /* it fit in an empty usage, therefore there's nothing to remove */
2684 ret = TRUE;
2685 }
2686 return ret;
2687 }
2688
2689 struct BitField
2690 {
2691 DWORD cIndexes;
2692 DWORD *indexes;
2693 };
2694
2695 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2696
2697 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2698 {
2699 DWORD indexIndex = bit / BITS_PER_DWORD;
2700
2701 if (indexIndex + 1 > field->cIndexes)
2702 {
2703 if (field->cIndexes)
2704 field->indexes = CryptMemRealloc(field->indexes,
2705 (indexIndex + 1) * sizeof(DWORD));
2706 else
2707 field->indexes = CryptMemAlloc(sizeof(DWORD));
2708 if (field->indexes)
2709 {
2710 field->indexes[indexIndex] = 0;
2711 field->cIndexes = indexIndex + 1;
2712 }
2713 }
2714 if (field->indexes)
2715 field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2716 }
2717
2718 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
2719 {
2720 BOOL set = FALSE;
2721 DWORD indexIndex = bit / BITS_PER_DWORD;
2722
2723 assert(field->cIndexes);
2724 set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2725 return set;
2726 }
2727
2728 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2729 int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2730 {
2731 BOOL ret = TRUE;
2732 DWORD i, cbOIDs = 0;
2733 BOOL allUsagesValid = TRUE;
2734 CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2735
2736 TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2737 rghOIDs, *pcbOIDs);
2738
2739 for (i = 0; i < cCerts; i++)
2740 {
2741 CERT_ENHKEY_USAGE usage;
2742 DWORD size = sizeof(usage);
2743
2744 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2745 /* Success is deliberately ignored: it implies all usages are valid */
2746 if (!ret && GetLastError() == ERROR_MORE_DATA)
2747 {
2748 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2749
2750 allUsagesValid = FALSE;
2751 if (pUsage)
2752 {
2753 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2754 if (ret)
2755 {
2756 if (!validUsages.cUsageIdentifier)
2757 {
2758 DWORD j;
2759
2760 cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2761 validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2762 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2763 cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2764 + 1;
2765 validUsages.rgpszUsageIdentifier =
2766 CryptMemAlloc(cbOIDs);
2767 if (validUsages.rgpszUsageIdentifier)
2768 {
2769 LPSTR nextOID = (LPSTR)
2770 ((LPBYTE)validUsages.rgpszUsageIdentifier +
2771 validUsages.cUsageIdentifier * sizeof(LPSTR));
2772
2773 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2774 {
2775 validUsages.rgpszUsageIdentifier[j] = nextOID;
2776 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2777 pUsage->rgpszUsageIdentifier[j]);
2778 nextOID += lstrlenA(nextOID) + 1;
2779 }
2780 }
2781 }
2782 else
2783 {
2784 struct BitField validIndexes = { 0, NULL };
2785 DWORD j, k, numRemoved = 0;
2786
2787 /* Merge: build a bitmap of all the indexes of
2788 * validUsages.rgpszUsageIdentifier that are in pUsage.
2789 */
2790 for (j = 0; j < pUsage->cUsageIdentifier; j++)
2791 {
2792 for (k = 0; k < validUsages.cUsageIdentifier; k++)
2793 {
2794 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2795 validUsages.rgpszUsageIdentifier[k]))
2796 {
2797 CRYPT_SetBitInField(&validIndexes, k);
2798 break;
2799 }
2800 }
2801 }
2802 /* Merge by removing from validUsages those that are
2803 * not in the bitmap.
2804 */
2805 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2806 {
2807 if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2808 {
2809 if (j < validUsages.cUsageIdentifier - 1)
2810 {
2811 memmove(&validUsages.rgpszUsageIdentifier[j],
2812 &validUsages.rgpszUsageIdentifier[j +
2813 numRemoved + 1],
2814 (validUsages.cUsageIdentifier - numRemoved
2815 - j - 1) * sizeof(LPSTR));
2816 cbOIDs -= lstrlenA(
2817 validUsages.rgpszUsageIdentifier[j]) + 1 +
2818 sizeof(LPSTR);
2819 validUsages.cUsageIdentifier--;
2820 numRemoved++;
2821 }
2822 else
2823 validUsages.cUsageIdentifier--;
2824 }
2825 }
2826 CryptMemFree(validIndexes.indexes);
2827 }
2828 }
2829 CryptMemFree(pUsage);
2830 }
2831 }
2832 }
2833 ret = TRUE;
2834 if (allUsagesValid)
2835 {
2836 *cNumOIDs = -1;
2837 *pcbOIDs = 0;
2838 }
2839 else
2840 {
2841 *cNumOIDs = validUsages.cUsageIdentifier;
2842 if (!rghOIDs)
2843 *pcbOIDs = cbOIDs;
2844 else if (*pcbOIDs < cbOIDs)
2845 {
2846 *pcbOIDs = cbOIDs;
2847 SetLastError(ERROR_MORE_DATA);
2848 ret = FALSE;
2849 }
2850 else
2851 {
2852 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2853 validUsages.cUsageIdentifier * sizeof(LPSTR));
2854
2855 *pcbOIDs = cbOIDs;
2856 for (i = 0; i < validUsages.cUsageIdentifier; i++)
2857 {
2858 rghOIDs[i] = nextOID;
2859 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2860 nextOID += lstrlenA(nextOID) + 1;
2861 }
2862 }
2863 }
2864 CryptMemFree(validUsages.rgpszUsageIdentifier);
2865 TRACE("cNumOIDs: %d\n", *cNumOIDs);
2866 TRACE("returning %d\n", ret);
2867 return ret;
2868 }
2869
2870 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2871 * pInfo is NULL, from the attributes of hProv.
2872 */
2873 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2874 const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2875 {
2876 CRYPT_KEY_PROV_INFO info = { 0 };
2877 BOOL ret;
2878
2879 if (!pInfo)
2880 {
2881 DWORD size;
2882 int len;
2883
2884 ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2885 if (ret)
2886 {
2887 LPSTR szContainer = CryptMemAlloc(size);
2888
2889 if (szContainer)
2890 {
2891 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2892 (BYTE *)szContainer, &size, 0);
2893 if (ret)
2894 {
2895 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2896 NULL, 0);
2897 if (len)
2898 {
2899 info.pwszContainerName = CryptMemAlloc(len *
2900 sizeof(WCHAR));
2901 MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2902 info.pwszContainerName, len);
2903 }
2904 }
2905 CryptMemFree(szContainer);
2906 }
2907 }
2908 ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2909 if (ret)
2910 {
2911 LPSTR szProvider = CryptMemAlloc(size);
2912
2913 if (szProvider)
2914 {
2915 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2916 &size, 0);
2917 if (ret)
2918 {
2919 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2920 NULL, 0);
2921 if (len)
2922 {
2923 info.pwszProvName = CryptMemAlloc(len *
2924 sizeof(WCHAR));
2925 MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2926 info.pwszProvName, len);
2927 }
2928 }
2929 CryptMemFree(szProvider);
2930 }
2931 }
2932 size = sizeof(info.dwKeySpec);
2933 /* in case no CRYPT_KEY_PROV_INFO given,
2934 * we always use AT_SIGNATURE key spec
2935 */
2936 info.dwKeySpec = AT_SIGNATURE;
2937 size = sizeof(info.dwProvType);
2938 ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2939 &size, 0);
2940 if (!ret)
2941 info.dwProvType = PROV_RSA_FULL;
2942 pInfo = &info;
2943 }
2944
2945 CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2946 0, pInfo);
2947
2948 if (pInfo == &info)
2949 {
2950 CryptMemFree(info.pwszContainerName);
2951 CryptMemFree(info.pwszProvName);
2952 }
2953 }
2954
2955 /* Creates a signed certificate context from the unsigned, encoded certificate
2956 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2957 */
2958 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2959 HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2960 {
2961 PCCERT_CONTEXT context = NULL;
2962 BOOL ret;
2963 DWORD sigSize = 0;
2964
2965 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2966 blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2967 if (ret)
2968 {
2969 LPBYTE sig = CryptMemAlloc(sigSize);
2970
2971 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2972 blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2973 if (ret)
2974 {
2975 CERT_SIGNED_CONTENT_INFO signedInfo;
2976 BYTE *encodedSignedCert = NULL;
2977 DWORD encodedSignedCertSize = 0;
2978
2979 signedInfo.ToBeSigned.cbData = blob->cbData;
2980 signedInfo.ToBeSigned.pbData = blob->pbData;
2981 memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2982 sizeof(signedInfo.SignatureAlgorithm));
2983 signedInfo.Signature.cbData = sigSize;
2984 signedInfo.Signature.pbData = sig;
2985 signedInfo.Signature.cUnusedBits = 0;
2986 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2987 &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2988 &encodedSignedCert, &encodedSignedCertSize);
2989 if (ret)
2990 {
2991 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2992 encodedSignedCert, encodedSignedCertSize);
2993 LocalFree(encodedSignedCert);
2994 }
2995 }
2996 CryptMemFree(sig);
2997 }
2998 return context;
2999 }
3000
3001 /* Copies data from the parameters into info, where:
3002 * pSerialNumber: The serial number. Must not be NULL.
3003 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3004 * Must not be NULL
3005 * pSignatureAlgorithm: Optional.
3006 * pStartTime: The starting time of the certificate. If NULL, the current
3007 * system time is used.
3008 * pEndTime: The ending time of the certificate. If NULL, one year past the
3009 * starting time is used.
3010 * pubKey: The public key of the certificate. Must not be NULL.
3011 * pExtensions: Extensions to be included with the certificate. Optional.
3012 */
3013 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3014 const CERT_NAME_BLOB *pSubjectIssuerBlob,
3015 const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3016 const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3017 const CERT_EXTENSIONS *pExtensions)
3018 {
3019 static CHAR oid[] = szOID_RSA_SHA1RSA;
3020
3021 assert(info);
3022 assert(pSerialNumber);
3023 assert(pSubjectIssuerBlob);
3024 assert(pubKey);
3025
3026 if (pExtensions && pExtensions->cExtension)
3027 info->dwVersion = CERT_V3;
3028 else
3029 info->dwVersion = CERT_V1;
3030 info->SerialNumber.cbData = pSerialNumber->cbData;
3031 info->SerialNumber.pbData = pSerialNumber->pbData;
3032 if (pSignatureAlgorithm)
3033 memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
3034 sizeof(info->SignatureAlgorithm));
3035 else
3036 {
3037 info->SignatureAlgorithm.pszObjId = oid;
3038 info->SignatureAlgorithm.Parameters.cbData = 0;
3039 info->SignatureAlgorithm.Parameters.pbData = NULL;
3040 }
3041 info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3042 info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3043 if (pStartTime)
3044 SystemTimeToFileTime(pStartTime, &info->NotBefore);
3045 else
3046 GetSystemTimeAsFileTime(&info->NotBefore);
3047 if (pEndTime)
3048 SystemTimeToFileTime(pEndTime, &info->NotAfter);
3049 else
3050 {
3051 SYSTEMTIME endTime;
3052
3053 if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3054 {
3055 endTime.wYear++;
3056 SystemTimeToFileTime(&endTime, &info->NotAfter);
3057 }
3058 }
3059 info->Subject.cbData = pSubjectIssuerBlob->cbData;
3060 info->Subject.pbData = pSubjectIssuerBlob->pbData;
3061 memcpy(&info->SubjectPublicKeyInfo, pubKey,
3062 sizeof(info->SubjectPublicKeyInfo));
3063 if (pExtensions)
3064 {
3065 info->cExtension = pExtensions->cExtension;
3066 info->rgExtension = pExtensions->rgExtension;
3067 }
3068 else
3069 {
3070 info->cExtension = 0;
3071 info->rgExtension = NULL;
3072 }
3073 }
3074
3075 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3076 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3077 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3078
3079 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3080 {
3081 HCRYPTPROV hProv = 0;
3082 HMODULE rpcrt = LoadLibraryA("rpcrt4");
3083
3084 if (rpcrt)
3085 {
3086 UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3087 "UuidCreate");
3088 UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3089 "UuidToStringA");
3090 RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3091 rpcrt, "RpcStringFreeA");
3092
3093 if (uuidCreate && uuidToString && rpcStringFree)
3094 {
3095 UUID uuid;
3096 RPC_STATUS status = uuidCreate(&uuid);
3097
3098 if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3099 {
3100 unsigned char *uuidStr;
3101
3102 status = uuidToString(&uuid, &uuidStr);
3103 if (status == RPC_S_OK)
3104 {
3105 BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3106 MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3107
3108 if (ret)
3109 {
3110 HCRYPTKEY key;
3111
3112 ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3113 if (ret)
3114 CryptDestroyKey(key);
3115 }
3116 rpcStringFree(&uuidStr);
3117 }
3118 }
3119 }
3120 FreeLibrary(rpcrt);
3121 }
3122 return hProv;
3123 }
3124
3125 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3126 PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3127 PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3128 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3129 PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3130 {
3131 PCCERT_CONTEXT context = NULL;
3132 BOOL ret, releaseContext = FALSE;
3133 PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3134 DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
3135
3136 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3137 pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3138 pExtensions, pExtensions);
3139
3140 if(!pSubjectIssuerBlob)
3141 {
3142 SetLastError(ERROR_INVALID_PARAMETER);
3143 return NULL;
3144 }
3145
3146 if (!hProv)
3147 {
3148 if (!pKeyProvInfo)
3149 {
3150 hProv = CRYPT_CreateKeyProv();
3151 releaseContext = TRUE;
3152 }
3153 else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3154 {
3155 SetLastError(NTE_BAD_FLAGS);
3156 return NULL;
3157 }
3158 else
3159 {
3160 HCRYPTKEY hKey = 0;
3161 /* acquire the context using the given information*/
3162 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3163 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3164 pKeyProvInfo->dwFlags);
3165 if (!ret)
3166 {
3167 if(GetLastError() != NTE_BAD_KEYSET)
3168 return NULL;
3169 /* create the key set */
3170 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3171 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3172 pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3173 if (!ret)
3174 return NULL;
3175 }
3176 dwKeySpec = pKeyProvInfo->dwKeySpec;
3177 /* check if the key is here */
3178 ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3179 if(!ret)
3180 {
3181 if (NTE_NO_KEY == GetLastError())
3182 { /* generate the key */
3183 ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3184 }
3185 if (!ret)
3186 {
3187 CryptReleaseContext(hProv,0);
3188 SetLastError(NTE_BAD_KEYSET);
3189 return NULL;
3190 }
3191 }
3192 CryptDestroyKey(hKey);
3193 releaseContext = TRUE;
3194 }
3195 }
3196 else if (pKeyProvInfo)
3197 {
3198 SetLastError(ERROR_INVALID_PARAMETER);
3199 return NULL;
3200 }
3201
3202 CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3203 &pubKeySize);
3204 pubKey = CryptMemAlloc(pubKeySize);
3205 if (pubKey)
3206 {
3207 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3208 pubKey, &pubKeySize);
3209 if (ret)
3210 {
3211 CERT_INFO info = { 0 };
3212 CRYPT_DER_BLOB blob = { 0, NULL };
3213 BYTE serial[16];
3214 CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3215
3216 CryptGenRandom(hProv, sizeof(serial), serial);
3217 CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3218 pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3219 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3220 &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3221 &blob.cbData);
3222 if (ret)
3223 {
3224 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3225 context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3226 &info.SignatureAlgorithm);
3227 else
3228 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3229 blob.pbData, blob.cbData);
3230 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3231 CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3232 LocalFree(blob.pbData);
3233 }
3234 }
3235 CryptMemFree(pubKey);
3236 }
3237 if (releaseContext)
3238 CryptReleaseContext(hProv, 0);
3239 return context;
3240 }
3241
3242 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3243 void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3244 PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3245 PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3246 {
3247 FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3248 dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3249 pVerifyUsageStatus);
3250 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3251 return FALSE;
3252 }
3253
3254 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3255 const BYTE *pbEncoded, DWORD cbEncoded,
3256 DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3257 {
3258 TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3259 pbEncoded, cbEncoded, dwFlags, pCreatePara);
3260
3261 if (dwFlags)
3262 {
3263 FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3264 return NULL;
3265 }
3266 if (pCreatePara)
3267 {
3268 FIXME("pCreatePara not handled\n");
3269 return NULL;
3270 }
3271
3272 switch (dwContextType)
3273 {
3274 case CERT_STORE_CERTIFICATE_CONTEXT:
3275 return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3276 case CERT_STORE_CRL_CONTEXT:
3277 return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3278 case CERT_STORE_CTL_CONTEXT:
3279 return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3280 default:
3281 WARN("unknown context type: 0x%x\n", dwContextType);
3282 return NULL;
3283 }
3284 }
Windows API implementation