2 * Copyright 2004-2006 Juan Lang
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
23 #define NONAMELESSUNION
25 #define WIN32_NO_STATUS
29 #define CRYPT_OID_INFO_HAS_EXTRA_FIELDS
35 #include "wine/debug.h"
36 #include "crypt32_private.h"
38 WINE_DEFAULT_DEBUG_CHANNEL(crypt
);
40 /* Internal version of CertGetCertificateContextProperty that gets properties
41 * directly from the context (or the context it's linked to, depending on its
42 * type.) Doesn't handle special-case properties, since they are handled by
43 * CertGetCertificateContextProperty, and are particular to the store in which
44 * the property exists (which is separate from the context.)
46 static BOOL
CertContext_GetProperty(cert_t
*cert
, DWORD dwPropId
,
47 void *pvData
, DWORD
*pcbData
);
49 /* Internal version of CertSetCertificateContextProperty that sets properties
50 * directly on the context (or the context it's linked to, depending on its
51 * type.) Doesn't handle special cases, since they're handled by
52 * CertSetCertificateContextProperty anyway.
54 static BOOL
CertContext_SetProperty(cert_t
*cert
, DWORD dwPropId
,
55 DWORD dwFlags
, const void *pvData
);
57 BOOL WINAPI
CertAddEncodedCertificateToStore(HCERTSTORE hCertStore
,
58 DWORD dwCertEncodingType
, const BYTE
*pbCertEncoded
, DWORD cbCertEncoded
,
59 DWORD dwAddDisposition
, PCCERT_CONTEXT
*ppCertContext
)
61 PCCERT_CONTEXT cert
= CertCreateCertificateContext(dwCertEncodingType
,
62 pbCertEncoded
, cbCertEncoded
);
65 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore
, dwCertEncodingType
,
66 pbCertEncoded
, cbCertEncoded
, dwAddDisposition
, ppCertContext
);
70 ret
= CertAddCertificateContextToStore(hCertStore
, cert
,
71 dwAddDisposition
, ppCertContext
);
72 CertFreeCertificateContext(cert
);
79 BOOL WINAPI
CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName
,
80 const BYTE
*pbCertEncoded
, DWORD cbCertEncoded
)
85 TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName
), pbCertEncoded
,
88 store
= CertOpenSystemStoreA(0, pszCertStoreName
);
91 ret
= CertAddEncodedCertificateToStore(store
, X509_ASN_ENCODING
,
92 pbCertEncoded
, cbCertEncoded
, CERT_STORE_ADD_USE_EXISTING
, NULL
);
93 CertCloseStore(store
, 0);
98 BOOL WINAPI
CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName
,
99 const BYTE
*pbCertEncoded
, DWORD cbCertEncoded
)
104 TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName
), pbCertEncoded
,
107 store
= CertOpenSystemStoreW(0, pszCertStoreName
);
110 ret
= CertAddEncodedCertificateToStore(store
, X509_ASN_ENCODING
,
111 pbCertEncoded
, cbCertEncoded
, CERT_STORE_ADD_USE_EXISTING
, NULL
);
112 CertCloseStore(store
, 0);
117 static const context_vtbl_t cert_vtbl
;
119 static void Cert_free(context_t
*context
)
121 cert_t
*cert
= (cert_t
*)context
;
123 CryptMemFree(cert
->ctx
.pbCertEncoded
);
124 LocalFree(cert
->ctx
.pCertInfo
);
127 static context_t
*Cert_clone(context_t
*context
, WINECRYPT_CERTSTORE
*store
, BOOL use_link
)
132 cert
= (cert_t
*)Context_CreateLinkContext(sizeof(CERT_CONTEXT
), context
, store
);
136 const cert_t
*cloned
= (const cert_t
*)context
;
140 cert
= (cert_t
*)Context_CreateDataContext(sizeof(CERT_CONTEXT
), &cert_vtbl
, store
);
144 Context_CopyProperties(&cert
->ctx
, &cloned
->ctx
);
146 cert
->ctx
.dwCertEncodingType
= cloned
->ctx
.dwCertEncodingType
;
147 cert
->ctx
.pbCertEncoded
= CryptMemAlloc(cloned
->ctx
.cbCertEncoded
);
148 memcpy(cert
->ctx
.pbCertEncoded
, cloned
->ctx
.pbCertEncoded
, cloned
->ctx
.cbCertEncoded
);
149 cert
->ctx
.cbCertEncoded
= cloned
->ctx
.cbCertEncoded
;
151 /* FIXME: We don't need to decode the object here, we could just clone cert info. */
152 res
= CryptDecodeObjectEx(cert
->ctx
.dwCertEncodingType
, X509_CERT_TO_BE_SIGNED
,
153 cert
->ctx
.pbCertEncoded
, cert
->ctx
.cbCertEncoded
, CRYPT_DECODE_ALLOC_FLAG
, NULL
,
154 &cert
->ctx
.pCertInfo
, &size
);
156 CertFreeCertificateContext(&cert
->ctx
);
161 cert
->ctx
.hCertStore
= store
;
165 static const context_vtbl_t cert_vtbl
= {
170 static BOOL
add_cert_to_store(WINECRYPT_CERTSTORE
*store
, const CERT_CONTEXT
*cert
,
171 DWORD add_disposition
, BOOL use_link
, PCCERT_CONTEXT
*ret_context
)
173 const CERT_CONTEXT
*existing
= NULL
;
174 BOOL ret
= TRUE
, inherit_props
= FALSE
;
175 context_t
*new_context
= NULL
;
177 switch (add_disposition
)
179 case CERT_STORE_ADD_ALWAYS
:
181 case CERT_STORE_ADD_NEW
:
182 case CERT_STORE_ADD_REPLACE_EXISTING
:
183 case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES
:
184 case CERT_STORE_ADD_USE_EXISTING
:
185 case CERT_STORE_ADD_NEWER
:
186 case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES
:
189 DWORD size
= sizeof(hashToAdd
);
191 ret
= CertGetCertificateContextProperty(cert
, CERT_HASH_PROP_ID
,
195 CRYPT_HASH_BLOB blob
= { sizeof(hashToAdd
), hashToAdd
};
197 existing
= CertFindCertificateInStore(store
, cert
->dwCertEncodingType
, 0,
198 CERT_FIND_SHA1_HASH
, &blob
, NULL
);
203 FIXME("Unimplemented add disposition %d\n", add_disposition
);
204 SetLastError(E_INVALIDARG
);
208 switch (add_disposition
)
210 case CERT_STORE_ADD_ALWAYS
:
212 case CERT_STORE_ADD_NEW
:
215 TRACE("found matching certificate, not adding\n");
216 SetLastError(CRYPT_E_EXISTS
);
220 case CERT_STORE_ADD_REPLACE_EXISTING
:
222 case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES
:
224 FIXME("CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES: semi-stub for links\n");
226 inherit_props
= TRUE
;
228 case CERT_STORE_ADD_USE_EXISTING
:
230 FIXME("CERT_STORE_ADD_USE_EXISTING: semi-stub for links\n");
233 Context_CopyProperties(existing
, cert
);
235 *ret_context
= CertDuplicateCertificateContext(existing
);
239 case CERT_STORE_ADD_NEWER
:
240 if (existing
&& CompareFileTime(&existing
->pCertInfo
->NotBefore
, &cert
->pCertInfo
->NotBefore
) >= 0)
242 TRACE("existing certificate is newer, not adding\n");
243 SetLastError(CRYPT_E_EXISTS
);
247 case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES
:
250 if (CompareFileTime(&existing
->pCertInfo
->NotBefore
, &cert
->pCertInfo
->NotBefore
) >= 0)
252 TRACE("existing certificate is newer, not adding\n");
253 SetLastError(CRYPT_E_EXISTS
);
256 inherit_props
= TRUE
;
261 /* FIXME: We have tests that this works, but what should we really do in this case? */
264 *ret_context
= CertDuplicateCertificateContext(cert
);
268 ret
= store
->vtbl
->certs
.addContext(store
, context_from_ptr(cert
), existing
? context_from_ptr(existing
) : NULL
,
269 (ret_context
|| inherit_props
) ? &new_context
: NULL
, use_link
);
274 Context_CopyProperties(context_ptr(new_context
), existing
);
277 *ret_context
= context_ptr(new_context
);
279 Context_Release(new_context
);
281 TRACE("returning %d\n", ret
);
285 BOOL WINAPI
CertAddCertificateContextToStore(HCERTSTORE hCertStore
, PCCERT_CONTEXT pCertContext
,
286 DWORD dwAddDisposition
, PCCERT_CONTEXT
*ppStoreContext
)
288 WINECRYPT_CERTSTORE
*store
= hCertStore
;
290 TRACE("(%p, %p, %08x, %p)\n", hCertStore
, pCertContext
, dwAddDisposition
, ppStoreContext
);
292 return add_cert_to_store(store
, pCertContext
, dwAddDisposition
, FALSE
, ppStoreContext
);
295 BOOL WINAPI
CertAddCertificateLinkToStore(HCERTSTORE hCertStore
,
296 PCCERT_CONTEXT pCertContext
, DWORD dwAddDisposition
,
297 PCCERT_CONTEXT
*ppCertContext
)
300 WINECRYPT_CERTSTORE
*store
= (WINECRYPT_CERTSTORE
*)hCertStore
;
303 FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore
, pCertContext
,
304 dwAddDisposition
, ppCertContext
);
305 if (store
->dwMagic
!= WINE_CRYPTCERTSTORE_MAGIC
)
307 if (store
->type
== StoreTypeCollection
)
309 SetLastError(E_INVALIDARG
);
312 return add_cert_to_store(hCertStore
, pCertContext
, dwAddDisposition
, TRUE
, ppCertContext
);
315 PCCERT_CONTEXT WINAPI
CertCreateCertificateContext(DWORD dwCertEncodingType
,
316 const BYTE
*pbCertEncoded
, DWORD cbCertEncoded
)
321 PCERT_INFO certInfo
= NULL
;
324 TRACE("(%08x, %p, %d)\n", dwCertEncodingType
, pbCertEncoded
,
327 if ((dwCertEncodingType
& CERT_ENCODING_TYPE_MASK
) != X509_ASN_ENCODING
)
329 SetLastError(E_INVALIDARG
);
333 ret
= CryptDecodeObjectEx(dwCertEncodingType
, X509_CERT_TO_BE_SIGNED
,
334 pbCertEncoded
, cbCertEncoded
, CRYPT_DECODE_ALLOC_FLAG
, NULL
,
339 cert
= (cert_t
*)Context_CreateDataContext(sizeof(CERT_CONTEXT
), &cert_vtbl
, &empty_store
);
342 data
= CryptMemAlloc(cbCertEncoded
);
345 Context_Release(&cert
->base
);
349 memcpy(data
, pbCertEncoded
, cbCertEncoded
);
350 cert
->ctx
.dwCertEncodingType
= dwCertEncodingType
;
351 cert
->ctx
.pbCertEncoded
= data
;
352 cert
->ctx
.cbCertEncoded
= cbCertEncoded
;
353 cert
->ctx
.pCertInfo
= certInfo
;
354 cert
->ctx
.hCertStore
= &empty_store
;
359 PCCERT_CONTEXT WINAPI
CertDuplicateCertificateContext(PCCERT_CONTEXT pCertContext
)
361 TRACE("(%p)\n", pCertContext
);
366 Context_AddRef(&cert_from_ptr(pCertContext
)->base
);
370 BOOL WINAPI
CertFreeCertificateContext(PCCERT_CONTEXT pCertContext
)
372 TRACE("(%p)\n", pCertContext
);
375 Context_Release(&cert_from_ptr(pCertContext
)->base
);
379 DWORD WINAPI
CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext
,
382 cert_t
*cert
= cert_from_ptr(pCertContext
);
385 TRACE("(%p, %d)\n", pCertContext
, dwPropId
);
387 if (cert
->base
.properties
)
388 ret
= ContextPropertyList_EnumPropIDs(cert
->base
.properties
, dwPropId
);
394 static BOOL
CertContext_GetHashProp(cert_t
*cert
, DWORD dwPropId
,
395 ALG_ID algID
, const BYTE
*toHash
, DWORD toHashLen
, void *pvData
,
398 BOOL ret
= CryptHashCertificate(0, algID
, 0, toHash
, toHashLen
, pvData
,
402 CRYPT_DATA_BLOB blob
= { *pcbData
, pvData
};
404 ret
= CertContext_SetProperty(cert
, dwPropId
, 0, &blob
);
409 static BOOL
CertContext_CopyParam(void *pvData
, DWORD
*pcbData
, const void *pb
,
416 else if (*pcbData
< cb
)
418 SetLastError(ERROR_MORE_DATA
);
424 memcpy(pvData
, pb
, cb
);
430 void CRYPT_ConvertKeyContext(const struct store_CERT_KEY_CONTEXT
*src
, CERT_KEY_CONTEXT
*dst
)
432 dst
->cbSize
= sizeof(*dst
);
433 dst
->hCryptProv
= src
->hCryptProv
;
434 dst
->dwKeySpec
= src
->dwKeySpec
;
438 * Fix offsets in a continuous block of memory of CRYPT_KEY_PROV_INFO with
439 * its associated data.
441 static void fix_KeyProvInfoProperty(CRYPT_KEY_PROV_INFO
*info
)
446 data
= (BYTE
*)(info
+ 1) + sizeof(CRYPT_KEY_PROV_PARAM
) * info
->cProvParam
;
448 if (info
->pwszContainerName
)
450 info
->pwszContainerName
= (LPWSTR
)data
;
451 data
+= (lstrlenW(info
->pwszContainerName
) + 1) * sizeof(WCHAR
);
454 if (info
->pwszProvName
)
456 info
->pwszProvName
= (LPWSTR
)data
;
457 data
+= (lstrlenW(info
->pwszProvName
) + 1) * sizeof(WCHAR
);
460 info
->rgProvParam
= info
->cProvParam
? (CRYPT_KEY_PROV_PARAM
*)(info
+ 1) : NULL
;
462 for (i
= 0; i
< info
->cProvParam
; i
++)
464 info
->rgProvParam
[i
].pbData
= info
->rgProvParam
[i
].cbData
? data
: NULL
;
465 data
+= info
->rgProvParam
[i
].cbData
;
470 * Copy to a continuous block of memory of CRYPT_KEY_PROV_INFO with
471 * its associated data.
473 static void copy_KeyProvInfoProperty(const CRYPT_KEY_PROV_INFO
*from
, CRYPT_KEY_PROV_INFO
*to
)
478 data
= (BYTE
*)(to
+ 1) + sizeof(CRYPT_KEY_PROV_PARAM
) * from
->cProvParam
;
480 if (from
->pwszContainerName
)
482 to
->pwszContainerName
= (LPWSTR
)data
;
483 lstrcpyW((LPWSTR
)data
, from
->pwszContainerName
);
484 data
+= (lstrlenW(from
->pwszContainerName
) + 1) * sizeof(WCHAR
);
487 to
->pwszContainerName
= NULL
;
489 if (from
->pwszProvName
)
491 to
->pwszProvName
= (LPWSTR
)data
;
492 lstrcpyW((LPWSTR
)data
, from
->pwszProvName
);
493 data
+= (lstrlenW(from
->pwszProvName
) + 1) * sizeof(WCHAR
);
496 to
->pwszProvName
= NULL
;
498 to
->dwProvType
= from
->dwProvType
;
499 to
->dwFlags
= from
->dwFlags
;
500 to
->cProvParam
= from
->cProvParam
;
501 to
->rgProvParam
= from
->cProvParam
? (CRYPT_KEY_PROV_PARAM
*)(to
+ 1) : NULL
;
502 to
->dwKeySpec
= from
->dwKeySpec
;
504 for (i
= 0; i
< from
->cProvParam
; i
++)
506 to
->rgProvParam
[i
].dwParam
= from
->rgProvParam
[i
].dwParam
;
507 to
->rgProvParam
[i
].dwFlags
= from
->rgProvParam
[i
].dwFlags
;
508 to
->rgProvParam
[i
].cbData
= from
->rgProvParam
[i
].cbData
;
509 to
->rgProvParam
[i
].pbData
= from
->rgProvParam
[i
].cbData
? data
: NULL
;
510 memcpy(data
, from
->rgProvParam
[i
].pbData
, from
->rgProvParam
[i
].cbData
);
511 data
+= from
->rgProvParam
[i
].cbData
;
515 static BOOL
CertContext_GetProperty(cert_t
*cert
, DWORD dwPropId
,
516 void *pvData
, DWORD
*pcbData
)
519 CRYPT_DATA_BLOB blob
;
521 TRACE("(%p, %d, %p, %p)\n", cert
, dwPropId
, pvData
, pcbData
);
523 if (cert
->base
.properties
)
524 ret
= ContextPropertyList_FindProperty(cert
->base
.properties
, dwPropId
, &blob
);
529 CERT_KEY_CONTEXT ctx
;
530 if (dwPropId
== CERT_KEY_CONTEXT_PROP_ID
)
532 CRYPT_ConvertKeyContext((const struct store_CERT_KEY_CONTEXT
*)blob
.pbData
, &ctx
);
533 blob
.pbData
= (BYTE
*)&ctx
;
534 blob
.cbData
= ctx
.cbSize
;
536 ret
= CertContext_CopyParam(pvData
, pcbData
, blob
.pbData
, blob
.cbData
);
540 /* Implicit properties */
543 case CERT_SHA1_HASH_PROP_ID
:
544 ret
= CertContext_GetHashProp(cert
, dwPropId
, CALG_SHA1
,
545 cert
->ctx
.pbCertEncoded
, cert
->ctx
.cbCertEncoded
, pvData
,
548 case CERT_MD5_HASH_PROP_ID
:
549 ret
= CertContext_GetHashProp(cert
, dwPropId
, CALG_MD5
,
550 cert
->ctx
.pbCertEncoded
, cert
->ctx
.cbCertEncoded
, pvData
,
553 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID
:
554 ret
= CertContext_GetHashProp(cert
, dwPropId
, CALG_MD5
,
555 cert
->ctx
.pCertInfo
->Subject
.pbData
,
556 cert
->ctx
.pCertInfo
->Subject
.cbData
,
559 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID
:
560 ret
= CertContext_GetHashProp(cert
, dwPropId
, CALG_MD5
,
561 cert
->ctx
.pCertInfo
->SubjectPublicKeyInfo
.PublicKey
.pbData
,
562 cert
->ctx
.pCertInfo
->SubjectPublicKeyInfo
.PublicKey
.cbData
,
565 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID
:
566 ret
= CertContext_GetHashProp(cert
, dwPropId
, CALG_MD5
,
567 cert
->ctx
.pCertInfo
->SerialNumber
.pbData
,
568 cert
->ctx
.pCertInfo
->SerialNumber
.cbData
,
571 case CERT_SIGNATURE_HASH_PROP_ID
:
572 ret
= CryptHashToBeSigned(0, cert
->ctx
.dwCertEncodingType
,
573 cert
->ctx
.pbCertEncoded
, cert
->ctx
.cbCertEncoded
, pvData
,
577 CRYPT_DATA_BLOB blob
= { *pcbData
, pvData
};
579 ret
= CertContext_SetProperty(cert
, dwPropId
, 0, &blob
);
582 case CERT_KEY_IDENTIFIER_PROP_ID
:
584 PCERT_EXTENSION ext
= CertFindExtension(
585 szOID_SUBJECT_KEY_IDENTIFIER
, cert
->ctx
.pCertInfo
->cExtension
,
586 cert
->ctx
.pCertInfo
->rgExtension
);
590 CRYPT_DATA_BLOB value
;
591 DWORD size
= sizeof(value
);
593 ret
= CryptDecodeObjectEx(X509_ASN_ENCODING
,
594 szOID_SUBJECT_KEY_IDENTIFIER
, ext
->Value
.pbData
,
595 ext
->Value
.cbData
, CRYPT_DECODE_NOCOPY_FLAG
, NULL
, &value
,
599 ret
= CertContext_CopyParam(pvData
, pcbData
, value
.pbData
,
601 CertContext_SetProperty(cert
, dwPropId
, 0, &value
);
605 SetLastError(ERROR_INVALID_DATA
);
609 SetLastError(CRYPT_E_NOT_FOUND
);
612 TRACE("returning %d\n", ret
);
616 BOOL WINAPI
CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext
,
617 DWORD dwPropId
, void *pvData
, DWORD
*pcbData
)
619 cert_t
*cert
= cert_from_ptr(pCertContext
);
622 TRACE("(%p, %d, %p, %p)\n", pCertContext
, dwPropId
, pvData
, pcbData
);
627 case CERT_CERT_PROP_ID
:
628 case CERT_CRL_PROP_ID
:
629 case CERT_CTL_PROP_ID
:
630 SetLastError(E_INVALIDARG
);
633 case CERT_ACCESS_STATE_PROP_ID
:
634 ret
= CertGetStoreProperty(cert
->ctx
.hCertStore
, dwPropId
, pvData
, pcbData
);
636 case CERT_KEY_PROV_HANDLE_PROP_ID
:
638 CERT_KEY_CONTEXT keyContext
;
639 DWORD size
= sizeof(keyContext
);
641 ret
= CertContext_GetProperty(cert
,
642 CERT_KEY_CONTEXT_PROP_ID
, &keyContext
, &size
);
644 ret
= CertContext_CopyParam(pvData
, pcbData
, &keyContext
.hCryptProv
,
645 sizeof(keyContext
.hCryptProv
));
648 case CERT_KEY_PROV_INFO_PROP_ID
:
649 ret
= CertContext_GetProperty(cert
, dwPropId
, pvData
, pcbData
);
651 fix_KeyProvInfoProperty(pvData
);
654 ret
= CertContext_GetProperty(cert
, dwPropId
, pvData
,
658 TRACE("returning %d\n", ret
);
663 * Create a continuous block of memory for CRYPT_KEY_PROV_INFO with
664 * its associated data, and add it to the certificate properties.
666 static BOOL
CertContext_SetKeyProvInfoProperty(CONTEXT_PROPERTY_LIST
*properties
, const CRYPT_KEY_PROV_INFO
*info
)
668 CRYPT_KEY_PROV_INFO
*prop
;
669 DWORD size
= sizeof(CRYPT_KEY_PROV_INFO
), i
;
672 if (info
->pwszContainerName
)
673 size
+= (lstrlenW(info
->pwszContainerName
) + 1) * sizeof(WCHAR
);
674 if (info
->pwszProvName
)
675 size
+= (lstrlenW(info
->pwszProvName
) + 1) * sizeof(WCHAR
);
677 for (i
= 0; i
< info
->cProvParam
; i
++)
678 size
+= sizeof(CRYPT_KEY_PROV_PARAM
) + info
->rgProvParam
[i
].cbData
;
680 prop
= HeapAlloc(GetProcessHeap(), 0, size
);
683 SetLastError(ERROR_OUTOFMEMORY
);
687 copy_KeyProvInfoProperty(info
, prop
);
689 ret
= ContextPropertyList_SetProperty(properties
, CERT_KEY_PROV_INFO_PROP_ID
, (const BYTE
*)prop
, size
);
690 HeapFree(GetProcessHeap(), 0, prop
);
695 static BOOL
CertContext_SetKeyContextProperty(CONTEXT_PROPERTY_LIST
*properties
,
696 const CERT_KEY_CONTEXT
*keyContext
)
698 struct store_CERT_KEY_CONTEXT ctx
;
700 ctx
.cbSize
= sizeof(ctx
);
701 ctx
.hCryptProv
= keyContext
->hCryptProv
;
702 ctx
.dwKeySpec
= keyContext
->dwKeySpec
;
704 return ContextPropertyList_SetProperty(properties
, CERT_KEY_CONTEXT_PROP_ID
,
705 (const BYTE
*)&ctx
, ctx
.cbSize
);
708 static BOOL
CertContext_SetProperty(cert_t
*cert
, DWORD dwPropId
,
709 DWORD dwFlags
, const void *pvData
)
713 TRACE("(%p, %d, %08x, %p)\n", cert
, dwPropId
, dwFlags
, pvData
);
715 if (!cert
->base
.properties
)
721 case CERT_AUTO_ENROLL_PROP_ID
:
722 case CERT_CTL_USAGE_PROP_ID
: /* same as CERT_ENHKEY_USAGE_PROP_ID */
723 case CERT_DESCRIPTION_PROP_ID
:
724 case CERT_FRIENDLY_NAME_PROP_ID
:
725 case CERT_HASH_PROP_ID
:
726 case CERT_KEY_IDENTIFIER_PROP_ID
:
727 case CERT_MD5_HASH_PROP_ID
:
728 case CERT_NEXT_UPDATE_LOCATION_PROP_ID
:
729 case CERT_PUBKEY_ALG_PARA_PROP_ID
:
730 case CERT_PVK_FILE_PROP_ID
:
731 case CERT_SIGNATURE_HASH_PROP_ID
:
732 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID
:
733 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID
:
734 case CERT_EXTENDED_ERROR_INFO_PROP_ID
:
735 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID
:
736 case CERT_ENROLLMENT_PROP_ID
:
737 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID
:
738 case CERT_OCSP_RESPONSE_PROP_ID
:
739 case CERT_RENEWAL_PROP_ID
:
743 const CRYPT_DATA_BLOB
*blob
= pvData
;
745 ret
= ContextPropertyList_SetProperty(cert
->base
.properties
, dwPropId
,
746 blob
->pbData
, blob
->cbData
);
750 ContextPropertyList_RemoveProperty(cert
->base
.properties
, dwPropId
);
755 case CERT_DATE_STAMP_PROP_ID
:
757 ret
= ContextPropertyList_SetProperty(cert
->base
.properties
, dwPropId
,
758 pvData
, sizeof(FILETIME
));
761 ContextPropertyList_RemoveProperty(cert
->base
.properties
, dwPropId
);
765 case CERT_KEY_CONTEXT_PROP_ID
:
768 const CERT_KEY_CONTEXT
*keyContext
= pvData
;
770 if (keyContext
->cbSize
!= sizeof(CERT_KEY_CONTEXT
))
772 SetLastError(E_INVALIDARG
);
776 ret
= CertContext_SetKeyContextProperty(cert
->base
.properties
, pvData
);
780 ContextPropertyList_RemoveProperty(cert
->base
.properties
, dwPropId
);
784 case CERT_KEY_PROV_INFO_PROP_ID
:
786 ret
= CertContext_SetKeyProvInfoProperty(cert
->base
.properties
, pvData
);
789 ContextPropertyList_RemoveProperty(cert
->base
.properties
, dwPropId
);
793 case CERT_KEY_PROV_HANDLE_PROP_ID
:
795 CERT_KEY_CONTEXT keyContext
;
796 DWORD size
= sizeof(keyContext
);
798 ret
= CertContext_GetProperty(cert
, CERT_KEY_CONTEXT_PROP_ID
,
802 if (!(dwFlags
& CERT_STORE_NO_CRYPT_RELEASE_FLAG
))
803 CryptReleaseContext(keyContext
.hCryptProv
, 0);
805 keyContext
.cbSize
= sizeof(keyContext
);
807 keyContext
.hCryptProv
= *(const HCRYPTPROV
*)pvData
;
810 keyContext
.hCryptProv
= 0;
811 keyContext
.dwKeySpec
= AT_SIGNATURE
;
813 ret
= CertContext_SetProperty(cert
, CERT_KEY_CONTEXT_PROP_ID
,
818 FIXME("%d: stub\n", dwPropId
);
822 TRACE("returning %d\n", ret
);
826 BOOL WINAPI
CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext
,
827 DWORD dwPropId
, DWORD dwFlags
, const void *pvData
)
831 TRACE("(%p, %d, %08x, %p)\n", pCertContext
, dwPropId
, dwFlags
, pvData
);
833 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
834 * crashes on most of these, I'll be safer.
839 case CERT_ACCESS_STATE_PROP_ID
:
840 case CERT_CERT_PROP_ID
:
841 case CERT_CRL_PROP_ID
:
842 case CERT_CTL_PROP_ID
:
843 SetLastError(E_INVALIDARG
);
846 ret
= CertContext_SetProperty(cert_from_ptr(pCertContext
), dwPropId
, dwFlags
,
848 TRACE("returning %d\n", ret
);
852 /* Acquires the private key using the key provider info, retrieving info from
853 * the certificate if info is NULL. The acquired provider is returned in
854 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
856 static BOOL
CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert
, DWORD dwFlags
,
857 PCRYPT_KEY_PROV_INFO info
, HCRYPTPROV
*phCryptProv
, DWORD
*pdwKeySpec
)
860 BOOL allocated
= FALSE
, ret
= TRUE
;
864 ret
= CertGetCertificateContextProperty(pCert
,
865 CERT_KEY_PROV_INFO_PROP_ID
, 0, &size
);
868 info
= HeapAlloc(GetProcessHeap(), 0, size
);
871 ret
= CertGetCertificateContextProperty(pCert
,
872 CERT_KEY_PROV_INFO_PROP_ID
, info
, &size
);
877 SetLastError(ERROR_OUTOFMEMORY
);
882 SetLastError(CRYPT_E_NO_KEY_PROPERTY
);
886 ret
= CryptAcquireContextW(phCryptProv
, info
->pwszContainerName
,
887 info
->pwszProvName
, info
->dwProvType
, (dwFlags
& CRYPT_ACQUIRE_SILENT_FLAG
) ? CRYPT_SILENT
: 0);
892 for (i
= 0; i
< info
->cProvParam
; i
++)
894 CryptSetProvParam(*phCryptProv
,
895 info
->rgProvParam
[i
].dwParam
, info
->rgProvParam
[i
].pbData
,
896 info
->rgProvParam
[i
].dwFlags
);
898 *pdwKeySpec
= info
->dwKeySpec
;
901 SetLastError(CRYPT_E_NO_KEY_PROPERTY
);
904 HeapFree(GetProcessHeap(), 0, info
);
908 BOOL WINAPI
CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert
,
909 DWORD dwFlags
, void *pvReserved
, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE
*phCryptProv
,
910 DWORD
*pdwKeySpec
, BOOL
*pfCallerFreeProv
)
912 BOOL ret
= FALSE
, cache
= FALSE
;
913 PCRYPT_KEY_PROV_INFO info
= NULL
;
914 CERT_KEY_CONTEXT keyContext
;
916 PCCERT_CONTEXT cert_in_store
= NULL
;
918 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert
, dwFlags
, pvReserved
,
919 phCryptProv
, pdwKeySpec
, pfCallerFreeProv
);
921 if (dwFlags
& CRYPT_ACQUIRE_USE_PROV_INFO_FLAG
)
925 ret
= CertGetCertificateContextProperty(pCert
,
926 CERT_KEY_PROV_INFO_PROP_ID
, 0, &size
);
932 hstore
= CertOpenStore(CERT_STORE_PROV_SYSTEM_W
, 0, 0,
933 CERT_SYSTEM_STORE_CURRENT_USER
, L
"My");
936 cert_in_store
= CertFindCertificateInStore(hstore
, pCert
->dwCertEncodingType
, 0,
937 CERT_FIND_EXISTING
, pCert
, NULL
);
940 ret
= CertGetCertificateContextProperty(cert_in_store
, CERT_KEY_PROV_INFO_PROP_ID
, 0, &size
);
942 pCert
= cert_in_store
;
945 CertFreeCertificateContext(cert_in_store
);
946 cert_in_store
= NULL
;
950 CertCloseStore(hstore
, 0);
956 info
= HeapAlloc(GetProcessHeap(), 0, size
);
957 ret
= CertGetCertificateContextProperty(pCert
,
958 CERT_KEY_PROV_INFO_PROP_ID
, info
, &size
);
960 cache
= info
->dwFlags
& CERT_SET_KEY_CONTEXT_PROP_ID
;
963 else if (dwFlags
& CRYPT_ACQUIRE_CACHE_FLAG
)
968 size
= sizeof(keyContext
);
969 ret
= CertGetCertificateContextProperty(pCert
, CERT_KEY_CONTEXT_PROP_ID
,
973 *phCryptProv
= keyContext
.hCryptProv
;
975 *pdwKeySpec
= keyContext
.dwKeySpec
;
976 if (pfCallerFreeProv
)
977 *pfCallerFreeProv
= FALSE
;
982 ret
= CRYPT_AcquirePrivateKeyFromProvInfo(pCert
, dwFlags
, info
,
983 &keyContext
.hCryptProv
, &keyContext
.dwKeySpec
);
986 *phCryptProv
= keyContext
.hCryptProv
;
988 *pdwKeySpec
= keyContext
.dwKeySpec
;
991 keyContext
.cbSize
= sizeof(keyContext
);
992 if (CertSetCertificateContextProperty(pCert
,
993 CERT_KEY_CONTEXT_PROP_ID
, 0, &keyContext
))
995 if (pfCallerFreeProv
)
996 *pfCallerFreeProv
= FALSE
;
1001 if (pfCallerFreeProv
)
1002 *pfCallerFreeProv
= TRUE
;
1006 HeapFree(GetProcessHeap(), 0, info
);
1008 CertFreeCertificateContext(cert_in_store
);
1012 static BOOL
key_prov_info_matches_cert(PCCERT_CONTEXT pCert
,
1013 const CRYPT_KEY_PROV_INFO
*keyProvInfo
)
1016 BOOL matches
= FALSE
;
1018 if (CryptAcquireContextW(&csp
, keyProvInfo
->pwszContainerName
,
1019 keyProvInfo
->pwszProvName
, keyProvInfo
->dwProvType
, keyProvInfo
->dwFlags
))
1023 /* Need to sign something to verify the sig. What to sign? Why not
1024 * the certificate itself?
1026 if (CryptSignAndEncodeCertificate(csp
, AT_SIGNATURE
,
1027 pCert
->dwCertEncodingType
, X509_CERT_TO_BE_SIGNED
, pCert
->pCertInfo
,
1028 &pCert
->pCertInfo
->SignatureAlgorithm
, NULL
, NULL
, &size
))
1030 BYTE
*certEncoded
= CryptMemAlloc(size
);
1034 if (CryptSignAndEncodeCertificate(csp
, AT_SIGNATURE
,
1035 pCert
->dwCertEncodingType
, X509_CERT_TO_BE_SIGNED
,
1036 pCert
->pCertInfo
, &pCert
->pCertInfo
->SignatureAlgorithm
,
1037 NULL
, certEncoded
, &size
))
1039 if (size
== pCert
->cbCertEncoded
&&
1040 !memcmp(certEncoded
, pCert
->pbCertEncoded
, size
))
1043 CryptMemFree(certEncoded
);
1046 CryptReleaseContext(csp
, 0);
1051 static BOOL
container_matches_cert(PCCERT_CONTEXT pCert
, LPCSTR container
,
1052 CRYPT_KEY_PROV_INFO
*keyProvInfo
)
1054 CRYPT_KEY_PROV_INFO copy
;
1055 WCHAR containerW
[MAX_PATH
];
1058 MultiByteToWideChar(CP_ACP
, 0, container
, -1, containerW
, ARRAY_SIZE(containerW
));
1059 /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
1060 * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
1063 copy
= *keyProvInfo
;
1064 copy
.pwszContainerName
= containerW
;
1065 matches
= key_prov_info_matches_cert(pCert
, ©
);
1068 keyProvInfo
->pwszContainerName
=
1069 CryptMemAlloc((lstrlenW(containerW
) + 1) * sizeof(WCHAR
));
1070 if (keyProvInfo
->pwszContainerName
)
1072 lstrcpyW(keyProvInfo
->pwszContainerName
, containerW
);
1073 keyProvInfo
->dwKeySpec
= AT_SIGNATURE
;
1081 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
1082 * private key matches pCert's public key. Upon success, updates keyProvInfo
1083 * with the matching container's info (free keyProvInfo.pwszContainerName upon
1085 * Returns TRUE if found, FALSE if not.
1087 static BOOL
find_key_prov_info_in_provider(PCCERT_CONTEXT pCert
,
1088 CRYPT_KEY_PROV_INFO
*keyProvInfo
)
1090 HCRYPTPROV defProvider
;
1091 BOOL ret
, found
= FALSE
;
1092 char containerA
[MAX_PATH
];
1094 assert(keyProvInfo
->pwszContainerName
== NULL
);
1095 if ((ret
= CryptAcquireContextW(&defProvider
, NULL
,
1096 keyProvInfo
->pwszProvName
, keyProvInfo
->dwProvType
,
1097 keyProvInfo
->dwFlags
| CRYPT_VERIFYCONTEXT
)))
1099 DWORD enumFlags
= keyProvInfo
->dwFlags
| CRYPT_FIRST
;
1101 while (ret
&& !found
)
1103 DWORD size
= sizeof(containerA
);
1105 ret
= CryptGetProvParam(defProvider
, PP_ENUMCONTAINERS
,
1106 (BYTE
*)containerA
, &size
, enumFlags
);
1108 found
= container_matches_cert(pCert
, containerA
, keyProvInfo
);
1109 if (enumFlags
& CRYPT_FIRST
)
1111 enumFlags
&= ~CRYPT_FIRST
;
1112 enumFlags
|= CRYPT_NEXT
;
1115 CryptReleaseContext(defProvider
, 0);
1120 static BOOL
find_matching_provider(PCCERT_CONTEXT pCert
, DWORD dwFlags
)
1122 BOOL found
= FALSE
, ret
= TRUE
;
1123 DWORD index
= 0, cbProvName
= 0;
1124 CRYPT_KEY_PROV_INFO keyProvInfo
;
1126 TRACE("(%p, %08x)\n", pCert
, dwFlags
);
1128 memset(&keyProvInfo
, 0, sizeof(keyProvInfo
));
1129 while (ret
&& !found
)
1133 ret
= CryptEnumProvidersW(index
, NULL
, 0, &keyProvInfo
.dwProvType
,
1137 if (size
<= cbProvName
)
1138 ret
= CryptEnumProvidersW(index
, NULL
, 0,
1139 &keyProvInfo
.dwProvType
, keyProvInfo
.pwszProvName
, &size
);
1142 CryptMemFree(keyProvInfo
.pwszProvName
);
1143 keyProvInfo
.pwszProvName
= CryptMemAlloc(size
);
1144 if (keyProvInfo
.pwszProvName
)
1147 ret
= CryptEnumProvidersW(index
, NULL
, 0,
1148 &keyProvInfo
.dwProvType
, keyProvInfo
.pwszProvName
, &size
);
1151 if (dwFlags
& CRYPT_FIND_SILENT_KEYSET_FLAG
)
1152 keyProvInfo
.dwFlags
|= CRYPT_SILENT
;
1153 if (dwFlags
& CRYPT_FIND_USER_KEYSET_FLAG
||
1154 !(dwFlags
& (CRYPT_FIND_USER_KEYSET_FLAG
|
1155 CRYPT_FIND_MACHINE_KEYSET_FLAG
)))
1157 keyProvInfo
.dwFlags
|= CRYPT_USER_KEYSET
;
1158 found
= find_key_prov_info_in_provider(pCert
,
1163 if (dwFlags
& CRYPT_FIND_MACHINE_KEYSET_FLAG
||
1164 !(dwFlags
& (CRYPT_FIND_USER_KEYSET_FLAG
|
1165 CRYPT_FIND_MACHINE_KEYSET_FLAG
)))
1167 keyProvInfo
.dwFlags
&= ~CRYPT_USER_KEYSET
;
1168 keyProvInfo
.dwFlags
|= CRYPT_MACHINE_KEYSET
;
1169 found
= find_key_prov_info_in_provider(pCert
,
1182 CertSetCertificateContextProperty(pCert
, CERT_KEY_PROV_INFO_PROP_ID
,
1184 CryptMemFree(keyProvInfo
.pwszProvName
);
1185 CryptMemFree(keyProvInfo
.pwszContainerName
);
1189 static BOOL
cert_prov_info_matches_cert(PCCERT_CONTEXT pCert
)
1191 BOOL matches
= FALSE
;
1194 if (CertGetCertificateContextProperty(pCert
, CERT_KEY_PROV_INFO_PROP_ID
,
1197 CRYPT_KEY_PROV_INFO
*keyProvInfo
= CryptMemAlloc(size
);
1201 if (CertGetCertificateContextProperty(pCert
,
1202 CERT_KEY_PROV_INFO_PROP_ID
, keyProvInfo
, &size
))
1203 matches
= key_prov_info_matches_cert(pCert
, keyProvInfo
);
1204 CryptMemFree(keyProvInfo
);
1210 BOOL WINAPI
CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert
,
1211 DWORD dwFlags
, void *pvReserved
)
1215 TRACE("(%p, %08x, %p)\n", pCert
, dwFlags
, pvReserved
);
1217 matches
= cert_prov_info_matches_cert(pCert
);
1219 matches
= find_matching_provider(pCert
, dwFlags
);
1223 BOOL WINAPI
CertCompareCertificate(DWORD dwCertEncodingType
,
1224 PCERT_INFO pCertId1
, PCERT_INFO pCertId2
)
1228 TRACE("(%08x, %p, %p)\n", dwCertEncodingType
, pCertId1
, pCertId2
);
1230 ret
= CertCompareCertificateName(dwCertEncodingType
, &pCertId1
->Issuer
,
1231 &pCertId2
->Issuer
) && CertCompareIntegerBlob(&pCertId1
->SerialNumber
,
1232 &pCertId2
->SerialNumber
);
1233 TRACE("returning %d\n", ret
);
1237 BOOL WINAPI
CertCompareCertificateName(DWORD dwCertEncodingType
,
1238 PCERT_NAME_BLOB pCertName1
, PCERT_NAME_BLOB pCertName2
)
1242 TRACE("(%08x, %p, %p)\n", dwCertEncodingType
, pCertName1
, pCertName2
);
1244 if (pCertName1
->cbData
== pCertName2
->cbData
)
1246 if (pCertName1
->cbData
)
1247 ret
= !memcmp(pCertName1
->pbData
, pCertName2
->pbData
,
1248 pCertName1
->cbData
);
1254 TRACE("returning %d\n", ret
);
1258 /* Returns the number of significant bytes in pInt, where a byte is
1259 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1260 * for negative numbers. pInt is assumed to be little-endian.
1262 static DWORD
CRYPT_significantBytes(const CRYPT_INTEGER_BLOB
*pInt
)
1264 DWORD ret
= pInt
->cbData
;
1268 if (pInt
->pbData
[ret
- 2] <= 0x7f && pInt
->pbData
[ret
- 1] == 0)
1270 else if (pInt
->pbData
[ret
- 2] >= 0x80 && pInt
->pbData
[ret
- 1] == 0xff)
1278 BOOL WINAPI
CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1
,
1279 PCRYPT_INTEGER_BLOB pInt2
)
1284 TRACE("(%p, %p)\n", pInt1
, pInt2
);
1286 cb1
= CRYPT_significantBytes(pInt1
);
1287 cb2
= CRYPT_significantBytes(pInt2
);
1291 ret
= !memcmp(pInt1
->pbData
, pInt2
->pbData
, cb1
);
1297 TRACE("returning %d\n", ret
);
1301 BOOL WINAPI
CertComparePublicKeyInfo(DWORD dwCertEncodingType
,
1302 PCERT_PUBLIC_KEY_INFO pPublicKey1
, PCERT_PUBLIC_KEY_INFO pPublicKey2
)
1306 TRACE("(%08x, %p, %p)\n", dwCertEncodingType
, pPublicKey1
, pPublicKey2
);
1308 /* RSA public key data should start with ASN_SEQUENCE,
1309 * otherwise it's not a RSA_CSP_PUBLICKEYBLOB.
1311 if (!pPublicKey1
->PublicKey
.cbData
|| pPublicKey1
->PublicKey
.pbData
[0] != ASN_SEQUENCE
)
1312 dwCertEncodingType
= 0;
1314 switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType
))
1316 case 0: /* Seems to mean "raw binary bits" */
1317 if (pPublicKey1
->PublicKey
.cbData
== pPublicKey2
->PublicKey
.cbData
&&
1318 pPublicKey1
->PublicKey
.cUnusedBits
== pPublicKey2
->PublicKey
.cUnusedBits
)
1320 if (pPublicKey2
->PublicKey
.cbData
)
1321 ret
= !memcmp(pPublicKey1
->PublicKey
.pbData
,
1322 pPublicKey2
->PublicKey
.pbData
, pPublicKey1
->PublicKey
.cbData
);
1330 WARN("Unknown encoding type %08x\n", dwCertEncodingType
);
1332 case X509_ASN_ENCODING
:
1334 BLOBHEADER
*pblob1
, *pblob2
;
1337 if (CryptDecodeObject(dwCertEncodingType
, RSA_CSP_PUBLICKEYBLOB
,
1338 pPublicKey1
->PublicKey
.pbData
, pPublicKey1
->PublicKey
.cbData
,
1339 CRYPT_DECODE_ALLOC_FLAG
, &pblob1
, &length
))
1341 if (CryptDecodeObject(dwCertEncodingType
, RSA_CSP_PUBLICKEYBLOB
,
1342 pPublicKey2
->PublicKey
.pbData
, pPublicKey2
->PublicKey
.cbData
,
1343 CRYPT_DECODE_ALLOC_FLAG
, &pblob2
, &length
))
1345 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1346 RSAPUBKEY
*pk1
= (LPVOID
)(pblob1
+ 1),
1347 *pk2
= (LPVOID
)(pblob2
+ 1);
1348 ret
= (pk1
->bitlen
== pk2
->bitlen
) && (pk1
->pubexp
== pk2
->pubexp
)
1349 && !memcmp(pk1
+ 1, pk2
+ 1, pk1
->bitlen
/8);
1362 DWORD WINAPI
CertGetPublicKeyLength(DWORD dwCertEncodingType
,
1363 PCERT_PUBLIC_KEY_INFO pPublicKey
)
1367 TRACE("(%08x, %p)\n", dwCertEncodingType
, pPublicKey
);
1369 if (GET_CERT_ENCODING_TYPE(dwCertEncodingType
) != X509_ASN_ENCODING
)
1371 SetLastError(ERROR_FILE_NOT_FOUND
);
1374 if (pPublicKey
->Algorithm
.pszObjId
&&
1375 !strcmp(pPublicKey
->Algorithm
.pszObjId
, szOID_RSA_DH
))
1377 FIXME("unimplemented for DH public keys\n");
1378 SetLastError(CRYPT_E_ASN1_BADTAG
);
1382 PCCRYPT_OID_INFO info
;
1387 info
= CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY
, pPublicKey
->Algorithm
.pszObjId
, 0);
1392 TRACE("public key algid %#x (%s)\n", info
->u
.Algid
, debugstr_a(pPublicKey
->Algorithm
.pszObjId
));
1394 ret
= CryptImportPublicKeyInfo(I_CryptGetDefaultCryptProv(info
->u
.Algid
), dwCertEncodingType
, pPublicKey
, &key
);
1398 ret
= CryptGetKeyParam(key
, KP_KEYLEN
, (BYTE
*)&len
, &size
, 0);
1399 CryptDestroyKey(key
);
1402 /* fallback to RSA */
1405 ret
= CryptDecodeObjectEx(dwCertEncodingType
,
1406 RSA_CSP_PUBLICKEYBLOB
, pPublicKey
->PublicKey
.pbData
,
1407 pPublicKey
->PublicKey
.cbData
, CRYPT_DECODE_ALLOC_FLAG
, NULL
, &buf
,
1412 RSAPUBKEY
*rsaPubKey
= (RSAPUBKEY
*)(buf
+ sizeof(BLOBHEADER
));
1414 len
= rsaPubKey
->bitlen
;
1421 typedef BOOL (*CertCompareFunc
)(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
1422 DWORD dwFlags
, const void *pvPara
);
1424 static BOOL
compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
1425 DWORD dwFlags
, const void *pvPara
)
1429 DWORD size
= sizeof(hash
);
1431 ret
= CertGetCertificateContextProperty(pCertContext
,
1432 CERT_MD5_HASH_PROP_ID
, hash
, &size
);
1435 const CRYPT_HASH_BLOB
*pHash
= pvPara
;
1437 if (size
== pHash
->cbData
)
1438 ret
= !memcmp(pHash
->pbData
, hash
, size
);
1445 static BOOL
compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
1446 DWORD dwFlags
, const void *pvPara
)
1450 DWORD size
= sizeof(hash
);
1452 ret
= CertGetCertificateContextProperty(pCertContext
,
1453 CERT_SHA1_HASH_PROP_ID
, hash
, &size
);
1456 const CRYPT_HASH_BLOB
*pHash
= pvPara
;
1458 if (size
== pHash
->cbData
)
1459 ret
= !memcmp(pHash
->pbData
, hash
, size
);
1466 static BOOL
compare_cert_by_name(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
1467 DWORD dwFlags
, const void *pvPara
)
1469 CERT_NAME_BLOB
*blob
= (CERT_NAME_BLOB
*)pvPara
, *toCompare
;
1472 if (dwType
& CERT_INFO_SUBJECT_FLAG
)
1473 toCompare
= &pCertContext
->pCertInfo
->Subject
;
1475 toCompare
= &pCertContext
->pCertInfo
->Issuer
;
1476 ret
= CertCompareCertificateName(pCertContext
->dwCertEncodingType
,
1481 static BOOL
compare_cert_by_public_key(PCCERT_CONTEXT pCertContext
,
1482 DWORD dwType
, DWORD dwFlags
, const void *pvPara
)
1484 CERT_PUBLIC_KEY_INFO
*publicKey
= (CERT_PUBLIC_KEY_INFO
*)pvPara
;
1487 ret
= CertComparePublicKeyInfo(pCertContext
->dwCertEncodingType
,
1488 &pCertContext
->pCertInfo
->SubjectPublicKeyInfo
, publicKey
);
1492 static BOOL
compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext
,
1493 DWORD dwType
, DWORD dwFlags
, const void *pvPara
)
1495 CERT_INFO
*pCertInfo
= (CERT_INFO
*)pvPara
;
1498 /* Matching serial number and subject match.. */
1499 ret
= CertCompareCertificateName(pCertContext
->dwCertEncodingType
,
1500 &pCertContext
->pCertInfo
->Subject
, &pCertInfo
->Issuer
);
1502 ret
= CertCompareIntegerBlob(&pCertContext
->pCertInfo
->SerialNumber
,
1503 &pCertInfo
->SerialNumber
);
1506 /* failing that, if the serial number and issuer match, we match */
1507 ret
= CertCompareIntegerBlob(&pCertContext
->pCertInfo
->SerialNumber
,
1508 &pCertInfo
->SerialNumber
);
1510 ret
= CertCompareCertificateName(pCertContext
->dwCertEncodingType
,
1511 &pCertContext
->pCertInfo
->Issuer
, &pCertInfo
->Issuer
);
1513 TRACE("returning %d\n", ret
);
1517 static BOOL
compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
1518 DWORD dwFlags
, const void *pvPara
)
1520 CERT_ID
*id
= (CERT_ID
*)pvPara
;
1523 switch (id
->dwIdChoice
)
1525 case CERT_ID_ISSUER_SERIAL_NUMBER
:
1526 ret
= CertCompareCertificateName(pCertContext
->dwCertEncodingType
,
1527 &pCertContext
->pCertInfo
->Issuer
, &id
->u
.IssuerSerialNumber
.Issuer
);
1529 ret
= CertCompareIntegerBlob(&pCertContext
->pCertInfo
->SerialNumber
,
1530 &id
->u
.IssuerSerialNumber
.SerialNumber
);
1532 case CERT_ID_SHA1_HASH
:
1533 ret
= compare_cert_by_sha1_hash(pCertContext
, dwType
, dwFlags
,
1536 case CERT_ID_KEY_IDENTIFIER
:
1540 ret
= CertGetCertificateContextProperty(pCertContext
,
1541 CERT_KEY_IDENTIFIER_PROP_ID
, NULL
, &size
);
1542 if (ret
&& size
== id
->u
.KeyId
.cbData
)
1544 LPBYTE buf
= CryptMemAlloc(size
);
1548 CertGetCertificateContextProperty(pCertContext
,
1549 CERT_KEY_IDENTIFIER_PROP_ID
, buf
, &size
);
1550 ret
= !memcmp(buf
, id
->u
.KeyId
.pbData
, size
);
1567 static BOOL
compare_existing_cert(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
1568 DWORD dwFlags
, const void *pvPara
)
1570 PCCERT_CONTEXT toCompare
= pvPara
;
1571 return CertCompareCertificate(pCertContext
->dwCertEncodingType
,
1572 pCertContext
->pCertInfo
, toCompare
->pCertInfo
);
1575 static BOOL
compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
1576 DWORD dwFlags
, const void *pvPara
)
1578 const CRYPT_HASH_BLOB
*hash
= pvPara
;
1582 ret
= CertGetCertificateContextProperty(pCertContext
,
1583 CERT_SIGNATURE_HASH_PROP_ID
, NULL
, &size
);
1584 if (ret
&& size
== hash
->cbData
)
1586 LPBYTE buf
= CryptMemAlloc(size
);
1590 CertGetCertificateContextProperty(pCertContext
,
1591 CERT_SIGNATURE_HASH_PROP_ID
, buf
, &size
);
1592 ret
= !memcmp(buf
, hash
->pbData
, size
);
1603 static inline PCCERT_CONTEXT
cert_compare_certs_in_store(HCERTSTORE store
,
1604 PCCERT_CONTEXT prev
, CertCompareFunc compare
, DWORD dwType
, DWORD dwFlags
,
1607 BOOL matches
= FALSE
;
1612 ret
= CertEnumCertificatesInStore(store
, ret
);
1614 matches
= compare(ret
, dwType
, dwFlags
, pvPara
);
1615 } while (ret
!= NULL
&& !matches
);
1619 typedef PCCERT_CONTEXT (*CertFindFunc
)(HCERTSTORE store
, DWORD dwType
,
1620 DWORD dwFlags
, const void *pvPara
, PCCERT_CONTEXT prev
);
1622 static PCCERT_CONTEXT
find_cert_any(HCERTSTORE store
, DWORD dwType
,
1623 DWORD dwFlags
, const void *pvPara
, PCCERT_CONTEXT prev
)
1625 return CertEnumCertificatesInStore(store
, prev
);
1628 static PCCERT_CONTEXT
find_cert_by_issuer(HCERTSTORE store
, DWORD dwType
,
1629 DWORD dwFlags
, const void *pvPara
, PCCERT_CONTEXT prev
)
1632 PCCERT_CONTEXT found
= NULL
, subject
= pvPara
;
1633 PCERT_EXTENSION ext
;
1636 if ((ext
= CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER
,
1637 subject
->pCertInfo
->cExtension
, subject
->pCertInfo
->rgExtension
)))
1639 CERT_AUTHORITY_KEY_ID_INFO
*info
;
1641 ret
= CryptDecodeObjectEx(subject
->dwCertEncodingType
,
1642 X509_AUTHORITY_KEY_ID
, ext
->Value
.pbData
, ext
->Value
.cbData
,
1643 CRYPT_DECODE_ALLOC_FLAG
| CRYPT_DECODE_NOCOPY_FLAG
, NULL
,
1649 if (info
->CertIssuer
.cbData
&& info
->CertSerialNumber
.cbData
)
1651 id
.dwIdChoice
= CERT_ID_ISSUER_SERIAL_NUMBER
;
1652 memcpy(&id
.u
.IssuerSerialNumber
.Issuer
, &info
->CertIssuer
,
1653 sizeof(CERT_NAME_BLOB
));
1654 memcpy(&id
.u
.IssuerSerialNumber
.SerialNumber
,
1655 &info
->CertSerialNumber
, sizeof(CRYPT_INTEGER_BLOB
));
1657 else if (info
->KeyId
.cbData
)
1659 id
.dwIdChoice
= CERT_ID_KEY_IDENTIFIER
;
1660 memcpy(&id
.u
.KeyId
, &info
->KeyId
, sizeof(CRYPT_HASH_BLOB
));
1665 found
= cert_compare_certs_in_store(store
, prev
,
1666 compare_cert_by_cert_id
, dwType
, dwFlags
, &id
);
1670 else if ((ext
= CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2
,
1671 subject
->pCertInfo
->cExtension
, subject
->pCertInfo
->rgExtension
)))
1673 CERT_AUTHORITY_KEY_ID2_INFO
*info
;
1675 ret
= CryptDecodeObjectEx(subject
->dwCertEncodingType
,
1676 X509_AUTHORITY_KEY_ID2
, ext
->Value
.pbData
, ext
->Value
.cbData
,
1677 CRYPT_DECODE_ALLOC_FLAG
| CRYPT_DECODE_NOCOPY_FLAG
, NULL
,
1683 if (info
->AuthorityCertIssuer
.cAltEntry
&&
1684 info
->AuthorityCertSerialNumber
.cbData
)
1686 PCERT_ALT_NAME_ENTRY directoryName
= NULL
;
1689 for (i
= 0; !directoryName
&&
1690 i
< info
->AuthorityCertIssuer
.cAltEntry
; i
++)
1691 if (info
->AuthorityCertIssuer
.rgAltEntry
[i
].dwAltNameChoice
1692 == CERT_ALT_NAME_DIRECTORY_NAME
)
1694 &info
->AuthorityCertIssuer
.rgAltEntry
[i
];
1697 id
.dwIdChoice
= CERT_ID_ISSUER_SERIAL_NUMBER
;
1698 memcpy(&id
.u
.IssuerSerialNumber
.Issuer
,
1699 &directoryName
->u
.DirectoryName
, sizeof(CERT_NAME_BLOB
));
1700 memcpy(&id
.u
.IssuerSerialNumber
.SerialNumber
,
1701 &info
->AuthorityCertSerialNumber
,
1702 sizeof(CRYPT_INTEGER_BLOB
));
1706 FIXME("no supported name type in authority key id2\n");
1710 else if (info
->KeyId
.cbData
)
1712 id
.dwIdChoice
= CERT_ID_KEY_IDENTIFIER
;
1713 memcpy(&id
.u
.KeyId
, &info
->KeyId
, sizeof(CRYPT_HASH_BLOB
));
1718 found
= cert_compare_certs_in_store(store
, prev
,
1719 compare_cert_by_cert_id
, dwType
, dwFlags
, &id
);
1724 found
= cert_compare_certs_in_store(store
, prev
,
1725 compare_cert_by_name
, CERT_COMPARE_NAME
| CERT_COMPARE_SUBJECT_CERT
,
1726 dwFlags
, &subject
->pCertInfo
->Issuer
);
1730 static BOOL
compare_cert_by_name_str(PCCERT_CONTEXT pCertContext
,
1731 DWORD dwType
, DWORD dwFlags
, const void *pvPara
)
1733 PCERT_NAME_BLOB name
;
1737 if (dwType
& CERT_INFO_SUBJECT_FLAG
)
1738 name
= &pCertContext
->pCertInfo
->Subject
;
1740 name
= &pCertContext
->pCertInfo
->Issuer
;
1741 len
= CertNameToStrW(pCertContext
->dwCertEncodingType
, name
,
1742 CERT_SIMPLE_NAME_STR
, NULL
, 0);
1745 LPWSTR str
= CryptMemAlloc(len
* sizeof(WCHAR
));
1749 CertNameToStrW(pCertContext
->dwCertEncodingType
, name
,
1750 CERT_SIMPLE_NAME_STR
, str
, len
);
1752 if (wcsstr(str
, pvPara
))
1760 static PCCERT_CONTEXT
find_cert_by_name_str_a(HCERTSTORE store
, DWORD dwType
,
1761 DWORD dwFlags
, const void *pvPara
, PCCERT_CONTEXT prev
)
1763 PCCERT_CONTEXT found
= NULL
;
1765 TRACE("%s\n", debugstr_a(pvPara
));
1769 int len
= MultiByteToWideChar(CP_ACP
, 0, pvPara
, -1, NULL
, 0);
1770 LPWSTR str
= CryptMemAlloc(len
* sizeof(WCHAR
));
1774 MultiByteToWideChar(CP_ACP
, 0, pvPara
, -1, str
, len
);
1776 found
= cert_compare_certs_in_store(store
, prev
,
1777 compare_cert_by_name_str
, dwType
, dwFlags
, str
);
1782 found
= find_cert_any(store
, dwType
, dwFlags
, NULL
, prev
);
1786 static PCCERT_CONTEXT
find_cert_by_name_str_w(HCERTSTORE store
, DWORD dwType
,
1787 DWORD dwFlags
, const void *pvPara
, PCCERT_CONTEXT prev
)
1789 PCCERT_CONTEXT found
= NULL
;
1791 TRACE("%s\n", debugstr_w(pvPara
));
1795 DWORD len
= lstrlenW(pvPara
);
1796 LPWSTR str
= CryptMemAlloc((len
+ 1) * sizeof(WCHAR
));
1800 wcscpy( str
, pvPara
);
1802 found
= cert_compare_certs_in_store(store
, prev
,
1803 compare_cert_by_name_str
, dwType
, dwFlags
, str
);
1808 found
= find_cert_any(store
, dwType
, dwFlags
, NULL
, prev
);
1812 PCCERT_CONTEXT WINAPI
CertFindCertificateInStore(HCERTSTORE hCertStore
,
1813 DWORD dwCertEncodingType
, DWORD dwFlags
, DWORD dwType
, const void *pvPara
,
1814 PCCERT_CONTEXT pPrevCertContext
)
1817 CertFindFunc find
= NULL
;
1818 CertCompareFunc compare
= NULL
;
1821 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore
, dwCertEncodingType
,
1822 dwFlags
, dwType
, pvPara
, pPrevCertContext
);
1824 switch (dwType
>> CERT_COMPARE_SHIFT
)
1826 case CERT_COMPARE_ANY
:
1827 find
= find_cert_any
;
1829 case CERT_COMPARE_MD5_HASH
:
1830 compare
= compare_cert_by_md5_hash
;
1832 case CERT_COMPARE_SHA1_HASH
:
1833 compare
= compare_cert_by_sha1_hash
;
1835 case CERT_COMPARE_NAME
:
1836 compare
= compare_cert_by_name
;
1838 case CERT_COMPARE_PUBLIC_KEY
:
1839 compare
= compare_cert_by_public_key
;
1841 case CERT_COMPARE_NAME_STR_A
:
1842 find
= find_cert_by_name_str_a
;
1844 case CERT_COMPARE_NAME_STR_W
:
1845 find
= find_cert_by_name_str_w
;
1847 case CERT_COMPARE_SUBJECT_CERT
:
1848 compare
= compare_cert_by_subject_cert
;
1850 case CERT_COMPARE_KEY_IDENTIFIER
:
1851 cert_id
.dwIdChoice
= CERT_ID_KEY_IDENTIFIER
;
1852 cert_id
.u
.KeyId
= *(const CRYPT_HASH_BLOB
*)pvPara
;
1855 case CERT_COMPARE_CERT_ID
:
1856 compare
= compare_cert_by_cert_id
;
1858 case CERT_COMPARE_ISSUER_OF
:
1859 find
= find_cert_by_issuer
;
1861 case CERT_COMPARE_EXISTING
:
1862 compare
= compare_existing_cert
;
1864 case CERT_COMPARE_SIGNATURE_HASH
:
1865 compare
= compare_cert_by_signature_hash
;
1868 FIXME("find type %08x unimplemented\n", dwType
);
1872 ret
= find(hCertStore
, dwType
, dwFlags
, pvPara
, pPrevCertContext
);
1874 ret
= cert_compare_certs_in_store(hCertStore
, pPrevCertContext
,
1875 compare
, dwType
, dwFlags
, pvPara
);
1879 SetLastError(CRYPT_E_NOT_FOUND
);
1880 TRACE("returning %p\n", ret
);
1884 PCCERT_CONTEXT WINAPI
CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore
,
1885 DWORD dwCertEncodingType
, PCERT_INFO pCertId
)
1887 TRACE("(%p, %08x, %p)\n", hCertStore
, dwCertEncodingType
, pCertId
);
1891 SetLastError(E_INVALIDARG
);
1894 return CertFindCertificateInStore(hCertStore
, dwCertEncodingType
, 0,
1895 CERT_FIND_SUBJECT_CERT
, pCertId
, NULL
);
1898 BOOL WINAPI
CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject
,
1899 PCCERT_CONTEXT pIssuer
, DWORD
*pdwFlags
)
1901 static const DWORD supportedFlags
= CERT_STORE_REVOCATION_FLAG
|
1902 CERT_STORE_SIGNATURE_FLAG
| CERT_STORE_TIME_VALIDITY_FLAG
;
1904 if (*pdwFlags
& ~supportedFlags
)
1906 SetLastError(E_INVALIDARG
);
1909 if (*pdwFlags
& CERT_STORE_REVOCATION_FLAG
)
1912 PCCRL_CONTEXT crl
= CertGetCRLFromStore(pSubject
->hCertStore
, pSubject
,
1915 /* FIXME: what if the CRL has expired? */
1918 if (CertVerifyCRLRevocation(pSubject
->dwCertEncodingType
,
1919 pSubject
->pCertInfo
, 1, (PCRL_INFO
*)&crl
->pCrlInfo
))
1920 *pdwFlags
&= CERT_STORE_REVOCATION_FLAG
;
1923 *pdwFlags
|= CERT_STORE_NO_CRL_FLAG
;
1925 if (*pdwFlags
& CERT_STORE_TIME_VALIDITY_FLAG
)
1927 if (0 == CertVerifyTimeValidity(NULL
, pSubject
->pCertInfo
))
1928 *pdwFlags
&= ~CERT_STORE_TIME_VALIDITY_FLAG
;
1930 if (*pdwFlags
& CERT_STORE_SIGNATURE_FLAG
)
1932 if (CryptVerifyCertificateSignatureEx(0, pSubject
->dwCertEncodingType
,
1933 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT
, (void *)pSubject
,
1934 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT
, (void *)pIssuer
, 0, NULL
))
1935 *pdwFlags
&= ~CERT_STORE_SIGNATURE_FLAG
;
1940 PCCERT_CONTEXT WINAPI
CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore
,
1941 PCCERT_CONTEXT pSubjectContext
, PCCERT_CONTEXT pPrevIssuerContext
,
1946 TRACE("(%p, %p, %p, %08x)\n", hCertStore
, pSubjectContext
,
1947 pPrevIssuerContext
, *pdwFlags
);
1949 if (!pSubjectContext
)
1951 SetLastError(E_INVALIDARG
);
1955 ret
= CertFindCertificateInStore(hCertStore
,
1956 pSubjectContext
->dwCertEncodingType
, 0, CERT_FIND_ISSUER_OF
,
1957 pSubjectContext
, pPrevIssuerContext
);
1960 if (!CertVerifySubjectCertificateContext(pSubjectContext
, ret
,
1963 CertFreeCertificateContext(ret
);
1966 if (CRYPT_IsCertificateSelfSigned(pSubjectContext
))
1968 CertFreeCertificateContext(ret
);
1970 SetLastError(CRYPT_E_SELF_SIGNED
);
1973 TRACE("returning %p\n", ret
);
1977 typedef struct _OLD_CERT_REVOCATION_STATUS
{
1982 } OLD_CERT_REVOCATION_STATUS
;
1984 typedef BOOL (WINAPI
*CertVerifyRevocationFunc
)(DWORD
, DWORD
, DWORD
,
1985 void **, DWORD
, PCERT_REVOCATION_PARA
, PCERT_REVOCATION_STATUS
);
1987 BOOL WINAPI
CertVerifyRevocation(DWORD dwEncodingType
, DWORD dwRevType
,
1988 DWORD cContext
, PVOID rgpvContext
[], DWORD dwFlags
,
1989 PCERT_REVOCATION_PARA pRevPara
, PCERT_REVOCATION_STATUS pRevStatus
)
1993 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType
, dwRevType
,
1994 cContext
, rgpvContext
, dwFlags
, pRevPara
, pRevStatus
);
1996 if (pRevStatus
->cbSize
!= sizeof(OLD_CERT_REVOCATION_STATUS
) &&
1997 pRevStatus
->cbSize
!= sizeof(CERT_REVOCATION_STATUS
))
1999 SetLastError(E_INVALIDARG
);
2004 static HCRYPTOIDFUNCSET set
= NULL
;
2008 set
= CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC
, 0);
2009 ret
= CryptGetDefaultOIDDllList(set
, dwEncodingType
, NULL
, &size
);
2015 SetLastError(CRYPT_E_NO_REVOCATION_DLL
);
2020 LPWSTR dllList
= CryptMemAlloc(size
* sizeof(WCHAR
)), ptr
;
2024 ret
= CryptGetDefaultOIDDllList(set
, dwEncodingType
,
2028 for (ptr
= dllList
; ret
&& *ptr
;
2029 ptr
+= lstrlenW(ptr
) + 1)
2031 CertVerifyRevocationFunc func
;
2032 HCRYPTOIDFUNCADDR hFunc
;
2034 ret
= CryptGetDefaultOIDFunctionAddress(set
,
2035 dwEncodingType
, ptr
, 0, (void **)&func
, &hFunc
);
2038 ret
= func(dwEncodingType
, dwRevType
, cContext
,
2039 rgpvContext
, dwFlags
, pRevPara
, pRevStatus
);
2040 CryptFreeOIDFunctionAddress(hFunc
, 0);
2044 CryptMemFree(dllList
);
2048 SetLastError(ERROR_OUTOFMEMORY
);
2059 PCRYPT_ATTRIBUTE WINAPI
CertFindAttribute(LPCSTR pszObjId
, DWORD cAttr
,
2060 CRYPT_ATTRIBUTE rgAttr
[])
2062 PCRYPT_ATTRIBUTE ret
= NULL
;
2065 TRACE("%s %d %p\n", debugstr_a(pszObjId
), cAttr
, rgAttr
);
2071 SetLastError(ERROR_INVALID_PARAMETER
);
2075 for (i
= 0; !ret
&& i
< cAttr
; i
++)
2076 if (rgAttr
[i
].pszObjId
&& !strcmp(pszObjId
, rgAttr
[i
].pszObjId
))
2081 PCERT_EXTENSION WINAPI
CertFindExtension(LPCSTR pszObjId
, DWORD cExtensions
,
2082 CERT_EXTENSION rgExtensions
[])
2084 PCERT_EXTENSION ret
= NULL
;
2087 TRACE("%s %d %p\n", debugstr_a(pszObjId
), cExtensions
, rgExtensions
);
2093 SetLastError(ERROR_INVALID_PARAMETER
);
2097 for (i
= 0; !ret
&& i
< cExtensions
; i
++)
2098 if (rgExtensions
[i
].pszObjId
&& !strcmp(pszObjId
,
2099 rgExtensions
[i
].pszObjId
))
2100 ret
= &rgExtensions
[i
];
2104 PCERT_RDN_ATTR WINAPI
CertFindRDNAttr(LPCSTR pszObjId
, PCERT_NAME_INFO pName
)
2106 PCERT_RDN_ATTR ret
= NULL
;
2109 TRACE("%s %p\n", debugstr_a(pszObjId
), pName
);
2113 SetLastError(ERROR_INVALID_PARAMETER
);
2117 for (i
= 0; !ret
&& i
< pName
->cRDN
; i
++)
2118 for (j
= 0; !ret
&& j
< pName
->rgRDN
[i
].cRDNAttr
; j
++)
2119 if (pName
->rgRDN
[i
].rgRDNAttr
[j
].pszObjId
&& !strcmp(pszObjId
,
2120 pName
->rgRDN
[i
].rgRDNAttr
[j
].pszObjId
))
2121 ret
= &pName
->rgRDN
[i
].rgRDNAttr
[j
];
2125 static BOOL
find_matching_rdn_attr(DWORD dwFlags
, const CERT_NAME_INFO
*name
,
2126 const CERT_RDN_ATTR
*attr
)
2131 for (i
= 0; !match
&& i
< name
->cRDN
; i
++)
2133 for (j
= 0; j
< name
->rgRDN
[i
].cRDNAttr
; j
++)
2135 if (!strcmp(name
->rgRDN
[i
].rgRDNAttr
[j
].pszObjId
,
2137 name
->rgRDN
[i
].rgRDNAttr
[j
].dwValueType
==
2140 if (dwFlags
& CERT_UNICODE_IS_RDN_ATTRS_FLAG
)
2143 (LPCWSTR
)name
->rgRDN
[i
].rgRDNAttr
[j
].Value
.pbData
;
2144 LPCWSTR attrStr
= (LPCWSTR
)attr
->Value
.pbData
;
2146 if (attr
->Value
.cbData
!=
2147 name
->rgRDN
[i
].rgRDNAttr
[j
].Value
.cbData
)
2149 else if (dwFlags
& CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG
)
2150 match
= !wcsnicmp(nameStr
, attrStr
,
2151 attr
->Value
.cbData
/ sizeof(WCHAR
));
2153 match
= !wcsncmp(nameStr
, attrStr
,
2154 attr
->Value
.cbData
/ sizeof(WCHAR
));
2155 TRACE("%s : %s => %d\n",
2156 debugstr_wn(nameStr
, attr
->Value
.cbData
/ sizeof(WCHAR
)),
2157 debugstr_wn(attrStr
, attr
->Value
.cbData
/ sizeof(WCHAR
)),
2163 (LPCSTR
)name
->rgRDN
[i
].rgRDNAttr
[j
].Value
.pbData
;
2164 LPCSTR attrStr
= (LPCSTR
)attr
->Value
.pbData
;
2166 if (attr
->Value
.cbData
!=
2167 name
->rgRDN
[i
].rgRDNAttr
[j
].Value
.cbData
)
2169 else if (dwFlags
& CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG
)
2170 match
= !_strnicmp(nameStr
, attrStr
,
2171 attr
->Value
.cbData
);
2173 match
= !strncmp(nameStr
, attrStr
, attr
->Value
.cbData
);
2174 TRACE("%s : %s => %d\n",
2175 debugstr_an(nameStr
, attr
->Value
.cbData
),
2176 debugstr_an(attrStr
, attr
->Value
.cbData
), match
);
2184 BOOL WINAPI
CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType
,
2185 DWORD dwFlags
, PCERT_NAME_BLOB pCertName
, PCERT_RDN pRDN
)
2187 CERT_NAME_INFO
*name
;
2192 TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType
, dwFlags
, pCertName
,
2195 type
= dwFlags
& CERT_UNICODE_IS_RDN_ATTRS_FLAG
? X509_UNICODE_NAME
:
2197 if ((ret
= CryptDecodeObjectEx(dwCertEncodingType
, type
, pCertName
->pbData
,
2198 pCertName
->cbData
, CRYPT_DECODE_ALLOC_FLAG
, NULL
, &name
, &size
)))
2202 for (i
= 0; ret
&& i
< pRDN
->cRDNAttr
; i
++)
2203 ret
= find_matching_rdn_attr(dwFlags
, name
, &pRDN
->rgRDNAttr
[i
]);
2205 SetLastError(CRYPT_E_NO_MATCH
);
2211 LONG WINAPI
CertVerifyTimeValidity(LPFILETIME pTimeToVerify
,
2212 PCERT_INFO pCertInfo
)
2219 GetSystemTimeAsFileTime(&fileTime
);
2220 pTimeToVerify
= &fileTime
;
2222 if ((ret
= CompareFileTime(pTimeToVerify
, &pCertInfo
->NotBefore
)) >= 0)
2224 ret
= CompareFileTime(pTimeToVerify
, &pCertInfo
->NotAfter
);
2231 BOOL WINAPI
CertVerifyValidityNesting(PCERT_INFO pSubjectInfo
,
2232 PCERT_INFO pIssuerInfo
)
2234 TRACE("(%p, %p)\n", pSubjectInfo
, pIssuerInfo
);
2236 return CertVerifyTimeValidity(&pSubjectInfo
->NotBefore
, pIssuerInfo
) == 0
2237 && CertVerifyTimeValidity(&pSubjectInfo
->NotAfter
, pIssuerInfo
) == 0;
2240 BOOL WINAPI
CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv
, ALG_ID Algid
,
2241 DWORD dwFlags
, const BYTE
*pbEncoded
, DWORD cbEncoded
, BYTE
*pbComputedHash
,
2242 DWORD
*pcbComputedHash
)
2245 HCRYPTHASH hHash
= 0;
2247 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv
, Algid
, dwFlags
,
2248 pbEncoded
, cbEncoded
, pbComputedHash
, pcbComputedHash
);
2251 hCryptProv
= I_CryptGetDefaultCryptProv(Algid
);
2256 ret
= CryptCreateHash(hCryptProv
, Algid
, 0, 0, &hHash
);
2259 ret
= CryptHashData(hHash
, pbEncoded
, cbEncoded
, 0);
2261 ret
= CryptGetHashParam(hHash
, HP_HASHVAL
, pbComputedHash
,
2262 pcbComputedHash
, 0);
2263 CryptDestroyHash(hHash
);
2269 BOOL WINAPI
CryptHashCertificate2(LPCWSTR pwszCNGHashAlgid
, DWORD dwFlags
,
2270 void *pvReserved
, const BYTE
*pbEncoded
, DWORD cbEncoded
, BYTE
*pbComputedHash
,
2271 DWORD
*pcbComputedHash
)
2273 BCRYPT_HASH_HANDLE hash
= NULL
;
2274 BCRYPT_ALG_HANDLE alg
= NULL
;
2277 DWORD hash_len_size
;
2279 TRACE("(%s, %08x, %p, %p, %d, %p, %p)\n", debugstr_w(pwszCNGHashAlgid
),
2280 dwFlags
, pvReserved
, pbEncoded
, cbEncoded
, pbComputedHash
, pcbComputedHash
);
2282 if ((status
= BCryptOpenAlgorithmProvider(&alg
, pwszCNGHashAlgid
, NULL
, 0)))
2284 if (status
== STATUS_NOT_IMPLEMENTED
)
2285 status
= STATUS_NOT_FOUND
;
2289 if ((status
= BCryptCreateHash(alg
, &hash
, NULL
, 0, NULL
, 0, 0)))
2292 if ((status
= BCryptGetProperty(hash
, BCRYPT_HASH_LENGTH
, (BYTE
*)&hash_len
, sizeof(hash_len
), &hash_len_size
, 0)))
2295 if (!pbComputedHash
)
2297 *pcbComputedHash
= hash_len
;
2301 if (*pcbComputedHash
< hash_len
)
2303 status
= ERROR_MORE_DATA
;
2307 *pcbComputedHash
= hash_len
;
2309 if ((status
= BCryptHashData(hash
, (BYTE
*)pbEncoded
, cbEncoded
, 0)))
2312 if ((status
= BCryptFinishHash(hash
, pbComputedHash
, hash_len
, 0)))
2316 if (hash
) BCryptDestroyHash(hash
);
2317 if (alg
) BCryptCloseAlgorithmProvider(alg
, 0);
2318 if (status
) SetLastError(status
);
2322 BOOL WINAPI
CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv
, ALG_ID Algid
,
2323 DWORD dwFlags
, DWORD dwCertEncodingType
, PCERT_PUBLIC_KEY_INFO pInfo
,
2324 BYTE
*pbComputedHash
, DWORD
*pcbComputedHash
)
2327 HCRYPTHASH hHash
= 0;
2329 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv
, Algid
, dwFlags
,
2330 dwCertEncodingType
, pInfo
, pbComputedHash
, pcbComputedHash
);
2333 hCryptProv
= I_CryptGetDefaultCryptProv(0);
2336 if ((dwCertEncodingType
& CERT_ENCODING_TYPE_MASK
) != X509_ASN_ENCODING
)
2338 SetLastError(ERROR_FILE_NOT_FOUND
);
2346 ret
= CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType
,
2347 X509_PUBLIC_KEY_INFO
, pInfo
, CRYPT_ENCODE_ALLOC_FLAG
, NULL
,
2348 (LPBYTE
)&buf
, &size
);
2351 ret
= CryptCreateHash(hCryptProv
, Algid
, 0, 0, &hHash
);
2354 ret
= CryptHashData(hHash
, buf
, size
, 0);
2356 ret
= CryptGetHashParam(hHash
, HP_HASHVAL
, pbComputedHash
,
2357 pcbComputedHash
, 0);
2358 CryptDestroyHash(hHash
);
2366 BOOL WINAPI
CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv
,
2367 DWORD dwCertEncodingType
, const BYTE
*pbEncoded
, DWORD cbEncoded
,
2368 BYTE
*pbComputedHash
, DWORD
*pcbComputedHash
)
2371 CERT_SIGNED_CONTENT_INFO
*info
;
2374 TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv
, dwCertEncodingType
,
2375 pbEncoded
, cbEncoded
, pbComputedHash
, *pcbComputedHash
);
2377 ret
= CryptDecodeObjectEx(dwCertEncodingType
, X509_CERT
,
2378 pbEncoded
, cbEncoded
, CRYPT_DECODE_ALLOC_FLAG
, NULL
, &info
, &size
);
2381 PCCRYPT_OID_INFO oidInfo
;
2385 hCryptProv
= I_CryptGetDefaultCryptProv(0);
2386 oidInfo
= CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY
,
2387 info
->SignatureAlgorithm
.pszObjId
, 0);
2390 SetLastError(NTE_BAD_ALGID
);
2395 ret
= CryptCreateHash(hCryptProv
, oidInfo
->u
.Algid
, 0, 0, &hHash
);
2398 ret
= CryptHashData(hHash
, info
->ToBeSigned
.pbData
,
2399 info
->ToBeSigned
.cbData
, 0);
2401 ret
= CryptGetHashParam(hHash
, HP_HASHVAL
, pbComputedHash
,
2402 pcbComputedHash
, 0);
2403 CryptDestroyHash(hHash
);
2411 BOOL WINAPI
CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv
,
2412 DWORD dwKeySpec
, DWORD dwCertEncodingType
, const BYTE
*pbEncodedToBeSigned
,
2413 DWORD cbEncodedToBeSigned
, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm
,
2414 const void *pvHashAuxInfo
, BYTE
*pbSignature
, DWORD
*pcbSignature
)
2417 PCCRYPT_OID_INFO info
;
2420 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv
,
2421 dwKeySpec
, dwCertEncodingType
, pbEncodedToBeSigned
, cbEncodedToBeSigned
,
2422 pSignatureAlgorithm
, pvHashAuxInfo
, pbSignature
, pcbSignature
);
2424 info
= CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY
,
2425 pSignatureAlgorithm
->pszObjId
, 0);
2428 SetLastError(NTE_BAD_ALGID
);
2431 if (info
->dwGroupId
== CRYPT_HASH_ALG_OID_GROUP_ID
)
2434 hCryptProv
= I_CryptGetDefaultCryptProv(0);
2435 ret
= CryptCreateHash(hCryptProv
, info
->u
.Algid
, 0, 0, &hHash
);
2438 ret
= CryptHashData(hHash
, pbEncodedToBeSigned
,
2439 cbEncodedToBeSigned
, 0);
2441 ret
= CryptGetHashParam(hHash
, HP_HASHVAL
, pbSignature
,
2443 CryptDestroyHash(hHash
);
2450 SetLastError(ERROR_INVALID_PARAMETER
);
2455 ret
= CryptCreateHash(hCryptProv
, info
->u
.Algid
, 0, 0, &hHash
);
2458 ret
= CryptHashData(hHash
, pbEncodedToBeSigned
,
2459 cbEncodedToBeSigned
, 0);
2461 ret
= CryptSignHashW(hHash
, dwKeySpec
, NULL
, 0, pbSignature
,
2463 CryptDestroyHash(hHash
);
2470 BOOL WINAPI
CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv
,
2471 DWORD dwKeySpec
, DWORD dwCertEncodingType
, LPCSTR lpszStructType
,
2472 const void *pvStructInfo
, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm
,
2473 const void *pvHashAuxInfo
, BYTE
*pbEncoded
, DWORD
*pcbEncoded
)
2476 DWORD encodedSize
, hashSize
;
2478 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv
, dwKeySpec
,
2479 dwCertEncodingType
, debugstr_a(lpszStructType
), pvStructInfo
,
2480 pSignatureAlgorithm
, pvHashAuxInfo
, pbEncoded
, pcbEncoded
);
2482 ret
= CryptEncodeObject(dwCertEncodingType
, lpszStructType
, pvStructInfo
,
2483 NULL
, &encodedSize
);
2486 PBYTE encoded
= CryptMemAlloc(encodedSize
);
2490 ret
= CryptEncodeObject(dwCertEncodingType
, lpszStructType
,
2491 pvStructInfo
, encoded
, &encodedSize
);
2494 ret
= CryptSignCertificate(hCryptProv
, dwKeySpec
,
2495 dwCertEncodingType
, encoded
, encodedSize
, pSignatureAlgorithm
,
2496 pvHashAuxInfo
, NULL
, &hashSize
);
2499 PBYTE hash
= CryptMemAlloc(hashSize
);
2503 ret
= CryptSignCertificate(hCryptProv
, dwKeySpec
,
2504 dwCertEncodingType
, encoded
, encodedSize
,
2505 pSignatureAlgorithm
, pvHashAuxInfo
, hash
, &hashSize
);
2508 CERT_SIGNED_CONTENT_INFO info
= { { 0 } };
2510 info
.ToBeSigned
.cbData
= encodedSize
;
2511 info
.ToBeSigned
.pbData
= encoded
;
2512 info
.SignatureAlgorithm
= *pSignatureAlgorithm
;
2513 info
.Signature
.cbData
= hashSize
;
2514 info
.Signature
.pbData
= hash
;
2515 info
.Signature
.cUnusedBits
= 0;
2516 ret
= CryptEncodeObject(dwCertEncodingType
,
2517 X509_CERT
, &info
, pbEncoded
, pcbEncoded
);
2525 CryptMemFree(encoded
);
2533 BOOL WINAPI
CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv
,
2534 DWORD dwCertEncodingType
, const BYTE
*pbEncoded
, DWORD cbEncoded
,
2535 PCERT_PUBLIC_KEY_INFO pPublicKey
)
2537 CRYPT_DATA_BLOB blob
= { cbEncoded
, (BYTE
*)pbEncoded
};
2539 return CryptVerifyCertificateSignatureEx(hCryptProv
, dwCertEncodingType
,
2540 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB
, &blob
,
2541 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY
, pPublicKey
, 0, NULL
);
2544 static BOOL
CRYPT_VerifySignature(HCRYPTPROV_LEGACY hCryptProv
, DWORD dwCertEncodingType
,
2545 CERT_PUBLIC_KEY_INFO
*pubKeyInfo
, const CERT_SIGNED_CONTENT_INFO
*signedCert
, const CRYPT_OID_INFO
*info
)
2549 ALG_ID pubKeyID
, hashID
;
2551 hashID
= info
->u
.Algid
;
2552 if (info
->ExtraInfo
.cbData
>= sizeof(ALG_ID
))
2553 pubKeyID
= *(ALG_ID
*)info
->ExtraInfo
.pbData
;
2556 /* Load the default provider if necessary */
2558 hCryptProv
= I_CryptGetDefaultCryptProv(hashID
);
2559 ret
= CryptImportPublicKeyInfoEx(hCryptProv
, dwCertEncodingType
,
2560 pubKeyInfo
, pubKeyID
, 0, NULL
, &key
);
2565 ret
= CryptCreateHash(hCryptProv
, hashID
, 0, 0, &hash
);
2568 ret
= CryptHashData(hash
, signedCert
->ToBeSigned
.pbData
,
2569 signedCert
->ToBeSigned
.cbData
, 0);
2571 ret
= CryptVerifySignatureW(hash
, signedCert
->Signature
.pbData
,
2572 signedCert
->Signature
.cbData
, key
, NULL
, 0);
2573 CryptDestroyHash(hash
);
2575 CryptDestroyKey(key
);
2580 static BOOL
CNG_CalcHash(const WCHAR
*algorithm
, const CERT_SIGNED_CONTENT_INFO
*signedCert
,
2581 BYTE
**hash_value
, DWORD
*hash_len
)
2583 BCRYPT_HASH_HANDLE hash
= NULL
;
2584 BCRYPT_ALG_HANDLE alg
= NULL
;
2588 if ((status
= BCryptOpenAlgorithmProvider(&alg
, algorithm
, NULL
, 0)))
2591 if ((status
= BCryptCreateHash(alg
, &hash
, NULL
, 0, NULL
, 0, 0)))
2594 if ((status
= BCryptHashData(hash
, signedCert
->ToBeSigned
.pbData
, signedCert
->ToBeSigned
.cbData
, 0)))
2597 if ((status
= BCryptGetProperty(hash
, BCRYPT_HASH_LENGTH
, (BYTE
*)hash_len
, sizeof(*hash_len
), &size
, 0)))
2600 if (!(*hash_value
= CryptMemAlloc(*hash_len
)))
2602 status
= STATUS_NO_MEMORY
;
2606 if ((status
= BCryptFinishHash(hash
, *hash_value
, *hash_len
, 0)))
2608 CryptMemFree(*hash_value
);
2613 if (hash
) BCryptDestroyHash(hash
);
2614 if (alg
) BCryptCloseAlgorithmProvider(alg
, 0);
2615 if (status
) SetLastError(RtlNtStatusToDosError(status
));
2619 static BOOL
CNG_ImportECCPubKey(CERT_PUBLIC_KEY_INFO
*pubKeyInfo
, BCRYPT_KEY_HANDLE
*key
)
2621 DWORD blob_magic
, ecckey_len
, size
;
2622 BCRYPT_ALG_HANDLE alg
= NULL
;
2623 BCRYPT_ECCKEY_BLOB
*ecckey
;
2624 const WCHAR
*sign_algo
;
2628 if (!pubKeyInfo
->PublicKey
.cbData
)
2630 SetLastError(NTE_BAD_ALGID
);
2634 if (pubKeyInfo
->PublicKey
.pbData
[0] != 0x4)
2636 FIXME("Compressed ECC curves (%02x) not yet supported\n", pubKeyInfo
->PublicKey
.pbData
[0]);
2637 SetLastError(NTE_BAD_ALGID
);
2641 if (!CryptDecodeObjectEx(X509_ASN_ENCODING
, X509_OBJECT_IDENTIFIER
, pubKeyInfo
->Algorithm
.Parameters
.pbData
,
2642 pubKeyInfo
->Algorithm
.Parameters
.cbData
, CRYPT_DECODE_ALLOC_FLAG
, NULL
, &ecc_curve
, &size
))
2645 if (!strcmp(*ecc_curve
, szOID_ECC_CURVE_P256
))
2647 sign_algo
= BCRYPT_ECDSA_P256_ALGORITHM
;
2648 blob_magic
= BCRYPT_ECDSA_PUBLIC_P256_MAGIC
;
2650 else if (!strcmp(*ecc_curve
, szOID_ECC_CURVE_P384
))
2652 sign_algo
= BCRYPT_ECDSA_P384_ALGORITHM
;
2653 blob_magic
= BCRYPT_ECDSA_PUBLIC_P384_MAGIC
;
2657 FIXME("Unsupported ecc curve type: %s\n", *ecc_curve
);
2661 LocalFree(ecc_curve
);
2665 SetLastError(NTE_BAD_ALGID
);
2669 if ((status
= BCryptOpenAlgorithmProvider(&alg
, sign_algo
, NULL
, 0)))
2672 ecckey_len
= sizeof(BCRYPT_ECCKEY_BLOB
) + pubKeyInfo
->PublicKey
.cbData
- 1;
2673 if (!(ecckey
= CryptMemAlloc(ecckey_len
)))
2675 status
= STATUS_NO_MEMORY
;
2679 ecckey
->dwMagic
= blob_magic
;
2680 ecckey
->cbKey
= (pubKeyInfo
->PublicKey
.cbData
- 1) / 2;
2681 memcpy(ecckey
+ 1, pubKeyInfo
->PublicKey
.pbData
+ 1, pubKeyInfo
->PublicKey
.cbData
- 1);
2683 status
= BCryptImportKeyPair(alg
, NULL
, BCRYPT_ECCPUBLIC_BLOB
, key
, (BYTE
*)ecckey
, ecckey_len
, 0);
2684 CryptMemFree(ecckey
);
2687 if (alg
) BCryptCloseAlgorithmProvider(alg
, 0);
2688 if (status
) SetLastError(RtlNtStatusToDosError(status
));
2692 static BOOL
CNG_ImportPubKey(CERT_PUBLIC_KEY_INFO
*pubKeyInfo
, BCRYPT_KEY_HANDLE
*key
)
2694 if (!strcmp(pubKeyInfo
->Algorithm
.pszObjId
, szOID_ECC_PUBLIC_KEY
))
2695 return CNG_ImportECCPubKey(pubKeyInfo
, key
);
2697 FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo
->Algorithm
.pszObjId
));
2698 SetLastError(NTE_BAD_ALGID
);
2702 static BOOL
CNG_PrepareSignatureECC(BYTE
*encoded_sig
, DWORD encoded_size
, BYTE
**sig_value
, DWORD
*sig_len
)
2704 CERT_ECC_SIGNATURE
*ecc_sig
;
2708 if (!CryptDecodeObjectEx(X509_ASN_ENCODING
, X509_ECC_SIGNATURE
, encoded_sig
, encoded_size
,
2709 CRYPT_DECODE_ALLOC_FLAG
, NULL
, &ecc_sig
, &size
))
2712 if (!ecc_sig
->r
.cbData
|| !ecc_sig
->s
.cbData
)
2715 SetLastError(ERROR_INVALID_DATA
);
2719 *sig_len
= ecc_sig
->r
.cbData
+ ecc_sig
->s
.cbData
;
2720 if (!(*sig_value
= CryptMemAlloc(*sig_len
)))
2723 SetLastError(ERROR_OUTOFMEMORY
);
2727 for (i
= 0; i
< ecc_sig
->r
.cbData
; i
++)
2728 (*sig_value
)[i
] = ecc_sig
->r
.pbData
[ecc_sig
->r
.cbData
- i
- 1];
2729 for (i
= 0; i
< ecc_sig
->s
.cbData
; i
++)
2730 (*sig_value
)[ecc_sig
->r
.cbData
+ i
] = ecc_sig
->s
.pbData
[ecc_sig
->s
.cbData
- i
- 1];
2736 static BOOL
CNG_PrepareSignature(CERT_PUBLIC_KEY_INFO
*pubKeyInfo
, const CERT_SIGNED_CONTENT_INFO
*signedCert
,
2737 BYTE
**sig_value
, DWORD
*sig_len
)
2743 if (!signedCert
->Signature
.cbData
)
2745 SetLastError(ERROR_INVALID_DATA
);
2749 if (!(encoded_sig
= CryptMemAlloc(signedCert
->Signature
.cbData
)))
2751 SetLastError(ERROR_OUTOFMEMORY
);
2755 for (i
= 0; i
< signedCert
->Signature
.cbData
; i
++)
2756 encoded_sig
[i
] = signedCert
->Signature
.pbData
[signedCert
->Signature
.cbData
- i
- 1];
2758 if (!strcmp(pubKeyInfo
->Algorithm
.pszObjId
, szOID_ECC_PUBLIC_KEY
))
2759 ret
= CNG_PrepareSignatureECC(encoded_sig
, signedCert
->Signature
.cbData
, sig_value
, sig_len
);
2762 FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo
->Algorithm
.pszObjId
));
2763 SetLastError(NTE_BAD_ALGID
);
2766 CryptMemFree(encoded_sig
);
2770 static BOOL
CNG_VerifySignature(HCRYPTPROV_LEGACY hCryptProv
, DWORD dwCertEncodingType
,
2771 CERT_PUBLIC_KEY_INFO
*pubKeyInfo
, const CERT_SIGNED_CONTENT_INFO
*signedCert
, const CRYPT_OID_INFO
*info
)
2773 BCRYPT_KEY_HANDLE key
= NULL
;
2774 BYTE
*hash_value
= NULL
, *sig_value
;
2775 DWORD hash_len
, sig_len
;
2779 ret
= CNG_ImportPubKey(pubKeyInfo
, &key
);
2782 ret
= CNG_CalcHash(info
->pwszCNGAlgid
, signedCert
, &hash_value
, &hash_len
);
2785 ret
= CNG_PrepareSignature(pubKeyInfo
, signedCert
, &sig_value
, &sig_len
);
2788 status
= BCryptVerifySignature(key
, NULL
, hash_value
, hash_len
, sig_value
, sig_len
, 0);
2791 FIXME("Failed to verify signature: %08x\n", status
);
2792 SetLastError(RtlNtStatusToDosError(status
));
2795 CryptMemFree(sig_value
);
2797 CryptMemFree(hash_value
);
2799 BCryptDestroyKey(key
);
2805 static BOOL
CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv
, DWORD dwCertEncodingType
,
2806 CERT_PUBLIC_KEY_INFO
*pubKeyInfo
, const CERT_SIGNED_CONTENT_INFO
*signedCert
)
2808 CCRYPT_OID_INFO
*info
;
2810 info
= CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY
, signedCert
->SignatureAlgorithm
.pszObjId
, 0);
2811 if (!info
|| info
->dwGroupId
!= CRYPT_SIGN_ALG_OID_GROUP_ID
)
2813 SetLastError(NTE_BAD_ALGID
);
2817 if (info
->u
.Algid
== CALG_OID_INFO_CNG_ONLY
)
2818 return CNG_VerifySignature(hCryptProv
, dwCertEncodingType
, pubKeyInfo
, signedCert
, info
);
2820 return CRYPT_VerifySignature(hCryptProv
, dwCertEncodingType
, pubKeyInfo
, signedCert
, info
);
2823 BOOL WINAPI
CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv
,
2824 DWORD dwCertEncodingType
, DWORD dwSubjectType
, void *pvSubject
,
2825 DWORD dwIssuerType
, void *pvIssuer
, DWORD dwFlags
, void *pvReserved
)
2828 CRYPT_DATA_BLOB subjectBlob
;
2830 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv
,
2831 dwCertEncodingType
, dwSubjectType
, pvSubject
, dwIssuerType
, pvIssuer
,
2832 dwFlags
, pvReserved
);
2834 switch (dwSubjectType
)
2836 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB
:
2838 PCRYPT_DATA_BLOB blob
= pvSubject
;
2840 subjectBlob
.pbData
= blob
->pbData
;
2841 subjectBlob
.cbData
= blob
->cbData
;
2844 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT
:
2846 PCERT_CONTEXT context
= pvSubject
;
2848 subjectBlob
.pbData
= context
->pbCertEncoded
;
2849 subjectBlob
.cbData
= context
->cbCertEncoded
;
2852 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL
:
2854 PCRL_CONTEXT context
= pvSubject
;
2856 subjectBlob
.pbData
= context
->pbCrlEncoded
;
2857 subjectBlob
.cbData
= context
->cbCrlEncoded
;
2861 SetLastError(E_INVALIDARG
);
2867 PCERT_SIGNED_CONTENT_INFO signedCert
= NULL
;
2870 ret
= CryptDecodeObjectEx(dwCertEncodingType
, X509_CERT
,
2871 subjectBlob
.pbData
, subjectBlob
.cbData
,
2872 CRYPT_DECODE_ALLOC_FLAG
| CRYPT_DECODE_NOCOPY_FLAG
, NULL
,
2873 &signedCert
, &size
);
2876 switch (dwIssuerType
)
2878 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY
:
2879 ret
= CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv
,
2880 dwCertEncodingType
, pvIssuer
,
2883 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT
:
2884 ret
= CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv
,
2886 &((PCCERT_CONTEXT
)pvIssuer
)->pCertInfo
->SubjectPublicKeyInfo
,
2889 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN
:
2890 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2893 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL
:
2896 SetLastError(E_INVALIDARG
);
2901 FIXME("unimplemented for NULL signer\n");
2902 SetLastError(E_INVALIDARG
);
2907 SetLastError(E_INVALIDARG
);
2910 LocalFree(signedCert
);
2916 BOOL WINAPI
CertGetIntendedKeyUsage(DWORD dwCertEncodingType
,
2917 PCERT_INFO pCertInfo
, BYTE
*pbKeyUsage
, DWORD cbKeyUsage
)
2919 PCERT_EXTENSION ext
;
2922 TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType
, pCertInfo
, pbKeyUsage
,
2925 ext
= CertFindExtension(szOID_KEY_USAGE
, pCertInfo
->cExtension
,
2926 pCertInfo
->rgExtension
);
2929 CRYPT_BIT_BLOB usage
;
2930 DWORD size
= sizeof(usage
);
2932 ret
= CryptDecodeObjectEx(dwCertEncodingType
, X509_BITS
,
2933 ext
->Value
.pbData
, ext
->Value
.cbData
, CRYPT_DECODE_NOCOPY_FLAG
, NULL
,
2937 if (cbKeyUsage
< usage
.cbData
)
2941 memcpy(pbKeyUsage
, usage
.pbData
, usage
.cbData
);
2942 if (cbKeyUsage
> usage
.cbData
)
2943 memset(pbKeyUsage
+ usage
.cbData
, 0,
2944 cbKeyUsage
- usage
.cbData
);
2953 BOOL WINAPI
CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext
, DWORD dwFlags
,
2954 PCERT_ENHKEY_USAGE pUsage
, DWORD
*pcbUsage
)
2956 PCERT_ENHKEY_USAGE usage
= NULL
;
2960 if (!pCertContext
|| !pcbUsage
)
2962 SetLastError(ERROR_INVALID_PARAMETER
);
2966 TRACE("(%p, %08x, %p, %d)\n", pCertContext
, dwFlags
, pUsage
, *pcbUsage
);
2968 if (!(dwFlags
& CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG
))
2972 if (CertGetCertificateContextProperty(pCertContext
,
2973 CERT_ENHKEY_USAGE_PROP_ID
, NULL
, &propSize
))
2975 LPBYTE buf
= CryptMemAlloc(propSize
);
2979 if (CertGetCertificateContextProperty(pCertContext
,
2980 CERT_ENHKEY_USAGE_PROP_ID
, buf
, &propSize
))
2982 ret
= CryptDecodeObjectEx(pCertContext
->dwCertEncodingType
,
2983 X509_ENHANCED_KEY_USAGE
, buf
, propSize
,
2984 CRYPT_ENCODE_ALLOC_FLAG
, NULL
, &usage
, &bytesNeeded
);
2990 if (!usage
&& !(dwFlags
& CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
))
2992 PCERT_EXTENSION ext
= CertFindExtension(szOID_ENHANCED_KEY_USAGE
,
2993 pCertContext
->pCertInfo
->cExtension
,
2994 pCertContext
->pCertInfo
->rgExtension
);
2998 ret
= CryptDecodeObjectEx(pCertContext
->dwCertEncodingType
,
2999 X509_ENHANCED_KEY_USAGE
, ext
->Value
.pbData
, ext
->Value
.cbData
,
3000 CRYPT_ENCODE_ALLOC_FLAG
, NULL
, &usage
, &bytesNeeded
);
3005 /* If a particular location is specified, this should fail. Otherwise
3006 * it should succeed with an empty usage. (This is true on Win2k and
3007 * later, which we emulate.)
3011 SetLastError(CRYPT_E_NOT_FOUND
);
3015 bytesNeeded
= sizeof(CERT_ENHKEY_USAGE
);
3021 *pcbUsage
= bytesNeeded
;
3022 else if (*pcbUsage
< bytesNeeded
)
3024 SetLastError(ERROR_MORE_DATA
);
3025 *pcbUsage
= bytesNeeded
;
3030 *pcbUsage
= bytesNeeded
;
3034 LPSTR nextOID
= (LPSTR
)((LPBYTE
)pUsage
+
3035 sizeof(CERT_ENHKEY_USAGE
) +
3036 usage
->cUsageIdentifier
* sizeof(LPSTR
));
3038 pUsage
->cUsageIdentifier
= usage
->cUsageIdentifier
;
3039 pUsage
->rgpszUsageIdentifier
= (LPSTR
*)((LPBYTE
)pUsage
+
3040 sizeof(CERT_ENHKEY_USAGE
));
3041 for (i
= 0; i
< usage
->cUsageIdentifier
; i
++)
3043 pUsage
->rgpszUsageIdentifier
[i
] = nextOID
;
3044 strcpy(nextOID
, usage
->rgpszUsageIdentifier
[i
]);
3045 nextOID
+= strlen(nextOID
) + 1;
3049 pUsage
->cUsageIdentifier
= 0;
3054 TRACE("returning %d\n", ret
);
3058 BOOL WINAPI
CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext
,
3059 PCERT_ENHKEY_USAGE pUsage
)
3063 TRACE("(%p, %p)\n", pCertContext
, pUsage
);
3067 CRYPT_DATA_BLOB blob
= { 0, NULL
};
3069 ret
= CryptEncodeObjectEx(X509_ASN_ENCODING
, X509_ENHANCED_KEY_USAGE
,
3070 pUsage
, CRYPT_ENCODE_ALLOC_FLAG
, NULL
, &blob
.pbData
, &blob
.cbData
);
3073 ret
= CertSetCertificateContextProperty(pCertContext
,
3074 CERT_ENHKEY_USAGE_PROP_ID
, 0, &blob
);
3075 LocalFree(blob
.pbData
);
3079 ret
= CertSetCertificateContextProperty(pCertContext
,
3080 CERT_ENHKEY_USAGE_PROP_ID
, 0, NULL
);
3084 BOOL WINAPI
CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext
,
3085 LPCSTR pszUsageIdentifier
)
3090 TRACE("(%p, %s)\n", pCertContext
, debugstr_a(pszUsageIdentifier
));
3092 if (CertGetEnhancedKeyUsage(pCertContext
,
3093 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
, NULL
, &size
))
3095 PCERT_ENHKEY_USAGE usage
= CryptMemAlloc(size
);
3099 ret
= CertGetEnhancedKeyUsage(pCertContext
,
3100 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
, usage
, &size
);
3104 BOOL exists
= FALSE
;
3106 /* Make sure usage doesn't already exist */
3107 for (i
= 0; !exists
&& i
< usage
->cUsageIdentifier
; i
++)
3109 if (!strcmp(usage
->rgpszUsageIdentifier
[i
],
3110 pszUsageIdentifier
))
3115 PCERT_ENHKEY_USAGE newUsage
= CryptMemAlloc(size
+
3116 sizeof(LPSTR
) + strlen(pszUsageIdentifier
) + 1);
3122 newUsage
->rgpszUsageIdentifier
= (LPSTR
*)
3123 ((LPBYTE
)newUsage
+ sizeof(CERT_ENHKEY_USAGE
));
3124 nextOID
= (LPSTR
)((LPBYTE
)newUsage
->rgpszUsageIdentifier
3125 + (usage
->cUsageIdentifier
+ 1) * sizeof(LPSTR
));
3126 for (i
= 0; i
< usage
->cUsageIdentifier
; i
++)
3128 newUsage
->rgpszUsageIdentifier
[i
] = nextOID
;
3129 strcpy(nextOID
, usage
->rgpszUsageIdentifier
[i
]);
3130 nextOID
+= strlen(nextOID
) + 1;
3132 newUsage
->rgpszUsageIdentifier
[i
] = nextOID
;
3133 strcpy(nextOID
, pszUsageIdentifier
);
3134 newUsage
->cUsageIdentifier
= i
+ 1;
3135 ret
= CertSetEnhancedKeyUsage(pCertContext
, newUsage
);
3136 CryptMemFree(newUsage
);
3142 CryptMemFree(usage
);
3149 PCERT_ENHKEY_USAGE usage
= CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE
) +
3150 sizeof(LPSTR
) + strlen(pszUsageIdentifier
) + 1);
3154 usage
->rgpszUsageIdentifier
=
3155 (LPSTR
*)((LPBYTE
)usage
+ sizeof(CERT_ENHKEY_USAGE
));
3156 usage
->rgpszUsageIdentifier
[0] = (LPSTR
)((LPBYTE
)usage
+
3157 sizeof(CERT_ENHKEY_USAGE
) + sizeof(LPSTR
));
3158 strcpy(usage
->rgpszUsageIdentifier
[0], pszUsageIdentifier
);
3159 usage
->cUsageIdentifier
= 1;
3160 ret
= CertSetEnhancedKeyUsage(pCertContext
, usage
);
3161 CryptMemFree(usage
);
3169 BOOL WINAPI
CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext
,
3170 LPCSTR pszUsageIdentifier
)
3174 CERT_ENHKEY_USAGE usage
;
3176 TRACE("(%p, %s)\n", pCertContext
, debugstr_a(pszUsageIdentifier
));
3178 size
= sizeof(usage
);
3179 ret
= CertGetEnhancedKeyUsage(pCertContext
,
3180 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
, &usage
, &size
);
3181 if (!ret
&& GetLastError() == ERROR_MORE_DATA
)
3183 PCERT_ENHKEY_USAGE pUsage
= CryptMemAlloc(size
);
3187 ret
= CertGetEnhancedKeyUsage(pCertContext
,
3188 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
, pUsage
, &size
);
3191 if (pUsage
->cUsageIdentifier
)
3196 for (i
= 0; i
< pUsage
->cUsageIdentifier
; i
++)
3198 if (!strcmp(pUsage
->rgpszUsageIdentifier
[i
],
3199 pszUsageIdentifier
))
3201 if (found
&& i
< pUsage
->cUsageIdentifier
- 1)
3202 pUsage
->rgpszUsageIdentifier
[i
] =
3203 pUsage
->rgpszUsageIdentifier
[i
+ 1];
3205 pUsage
->cUsageIdentifier
--;
3206 /* Remove the usage if it's empty */
3207 if (pUsage
->cUsageIdentifier
)
3208 ret
= CertSetEnhancedKeyUsage(pCertContext
, pUsage
);
3210 ret
= CertSetEnhancedKeyUsage(pCertContext
, NULL
);
3213 CryptMemFree(pUsage
);
3220 /* it fit in an empty usage, therefore there's nothing to remove */
3232 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
3234 static void CRYPT_SetBitInField(struct BitField
*field
, DWORD bit
)
3236 DWORD indexIndex
= bit
/ BITS_PER_DWORD
;
3238 if (indexIndex
+ 1 > field
->cIndexes
)
3240 if (field
->cIndexes
)
3241 field
->indexes
= CryptMemRealloc(field
->indexes
,
3242 (indexIndex
+ 1) * sizeof(DWORD
));
3244 field
->indexes
= CryptMemAlloc(sizeof(DWORD
));
3247 field
->indexes
[indexIndex
] = 0;
3248 field
->cIndexes
= indexIndex
+ 1;
3252 field
->indexes
[indexIndex
] |= 1 << (bit
% BITS_PER_DWORD
);
3255 static BOOL
CRYPT_IsBitInFieldSet(const struct BitField
*field
, DWORD bit
)
3258 DWORD indexIndex
= bit
/ BITS_PER_DWORD
;
3260 assert(field
->cIndexes
);
3261 set
= field
->indexes
[indexIndex
] & (1 << (bit
% BITS_PER_DWORD
));
3265 BOOL WINAPI
CertGetValidUsages(DWORD cCerts
, PCCERT_CONTEXT
*rghCerts
,
3266 int *cNumOIDs
, LPSTR
*rghOIDs
, DWORD
*pcbOIDs
)
3269 DWORD i
, cbOIDs
= 0;
3270 BOOL allUsagesValid
= TRUE
;
3271 CERT_ENHKEY_USAGE validUsages
= { 0, NULL
};
3273 TRACE("(%d, %p, %d, %p, %d)\n", cCerts
, rghCerts
, *cNumOIDs
,
3276 for (i
= 0; i
< cCerts
; i
++)
3278 CERT_ENHKEY_USAGE usage
;
3279 DWORD size
= sizeof(usage
);
3281 ret
= CertGetEnhancedKeyUsage(rghCerts
[i
], 0, &usage
, &size
);
3282 /* Success is deliberately ignored: it implies all usages are valid */
3283 if (!ret
&& GetLastError() == ERROR_MORE_DATA
)
3285 PCERT_ENHKEY_USAGE pUsage
= CryptMemAlloc(size
);
3287 allUsagesValid
= FALSE
;
3290 ret
= CertGetEnhancedKeyUsage(rghCerts
[i
], 0, pUsage
, &size
);
3293 if (!validUsages
.cUsageIdentifier
)
3297 cbOIDs
= pUsage
->cUsageIdentifier
* sizeof(LPSTR
);
3298 validUsages
.cUsageIdentifier
= pUsage
->cUsageIdentifier
;
3299 for (j
= 0; j
< validUsages
.cUsageIdentifier
; j
++)
3300 cbOIDs
+= lstrlenA(pUsage
->rgpszUsageIdentifier
[j
])
3302 validUsages
.rgpszUsageIdentifier
=
3303 CryptMemAlloc(cbOIDs
);
3304 if (validUsages
.rgpszUsageIdentifier
)
3306 LPSTR nextOID
= (LPSTR
)
3307 ((LPBYTE
)validUsages
.rgpszUsageIdentifier
+
3308 validUsages
.cUsageIdentifier
* sizeof(LPSTR
));
3310 for (j
= 0; j
< validUsages
.cUsageIdentifier
; j
++)
3312 validUsages
.rgpszUsageIdentifier
[j
] = nextOID
;
3313 lstrcpyA(validUsages
.rgpszUsageIdentifier
[j
],
3314 pUsage
->rgpszUsageIdentifier
[j
]);
3315 nextOID
+= lstrlenA(nextOID
) + 1;
3321 struct BitField validIndexes
= { 0, NULL
};
3322 DWORD j
, k
, numRemoved
= 0;
3324 /* Merge: build a bitmap of all the indexes of
3325 * validUsages.rgpszUsageIdentifier that are in pUsage.
3327 for (j
= 0; j
< pUsage
->cUsageIdentifier
; j
++)
3329 for (k
= 0; k
< validUsages
.cUsageIdentifier
; k
++)
3331 if (!strcmp(pUsage
->rgpszUsageIdentifier
[j
],
3332 validUsages
.rgpszUsageIdentifier
[k
]))
3334 CRYPT_SetBitInField(&validIndexes
, k
);
3339 /* Merge by removing from validUsages those that are
3340 * not in the bitmap.
3342 for (j
= 0; j
< validUsages
.cUsageIdentifier
; j
++)
3344 if (!CRYPT_IsBitInFieldSet(&validIndexes
, j
))
3346 if (j
< validUsages
.cUsageIdentifier
- 1)
3348 memmove(&validUsages
.rgpszUsageIdentifier
[j
],
3349 &validUsages
.rgpszUsageIdentifier
[j
+
3351 (validUsages
.cUsageIdentifier
- numRemoved
3352 - j
- 1) * sizeof(LPSTR
));
3354 validUsages
.rgpszUsageIdentifier
[j
]) + 1 +
3356 validUsages
.cUsageIdentifier
--;
3360 validUsages
.cUsageIdentifier
--;
3363 CryptMemFree(validIndexes
.indexes
);
3366 CryptMemFree(pUsage
);
3378 *cNumOIDs
= validUsages
.cUsageIdentifier
;
3381 else if (*pcbOIDs
< cbOIDs
)
3384 SetLastError(ERROR_MORE_DATA
);
3389 LPSTR nextOID
= (LPSTR
)((LPBYTE
)rghOIDs
+
3390 validUsages
.cUsageIdentifier
* sizeof(LPSTR
));
3393 for (i
= 0; i
< validUsages
.cUsageIdentifier
; i
++)
3395 rghOIDs
[i
] = nextOID
;
3396 lstrcpyA(nextOID
, validUsages
.rgpszUsageIdentifier
[i
]);
3397 nextOID
+= lstrlenA(nextOID
) + 1;
3401 CryptMemFree(validUsages
.rgpszUsageIdentifier
);
3402 TRACE("cNumOIDs: %d\n", *cNumOIDs
);
3403 TRACE("returning %d\n", ret
);
3407 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
3408 * pInfo is NULL, from the attributes of hProv.
3410 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context
,
3411 const CRYPT_KEY_PROV_INFO
*pInfo
, HCRYPTPROV hProv
)
3413 CRYPT_KEY_PROV_INFO info
= { 0 };
3421 ret
= CryptGetProvParam(hProv
, PP_CONTAINER
, NULL
, &size
, 0);
3424 LPSTR szContainer
= CryptMemAlloc(size
);
3428 ret
= CryptGetProvParam(hProv
, PP_CONTAINER
,
3429 (BYTE
*)szContainer
, &size
, 0);
3432 len
= MultiByteToWideChar(CP_ACP
, 0, szContainer
, -1,
3436 info
.pwszContainerName
= CryptMemAlloc(len
*
3438 MultiByteToWideChar(CP_ACP
, 0, szContainer
, -1,
3439 info
.pwszContainerName
, len
);
3442 CryptMemFree(szContainer
);
3445 ret
= CryptGetProvParam(hProv
, PP_NAME
, NULL
, &size
, 0);
3448 LPSTR szProvider
= CryptMemAlloc(size
);
3452 ret
= CryptGetProvParam(hProv
, PP_NAME
, (BYTE
*)szProvider
,
3456 len
= MultiByteToWideChar(CP_ACP
, 0, szProvider
, -1,
3460 info
.pwszProvName
= CryptMemAlloc(len
*
3462 MultiByteToWideChar(CP_ACP
, 0, szProvider
, -1,
3463 info
.pwszProvName
, len
);
3466 CryptMemFree(szProvider
);
3469 /* in case no CRYPT_KEY_PROV_INFO given,
3470 * we always use AT_SIGNATURE key spec
3472 info
.dwKeySpec
= AT_SIGNATURE
;
3473 size
= sizeof(info
.dwProvType
);
3474 ret
= CryptGetProvParam(hProv
, PP_PROVTYPE
, (LPBYTE
)&info
.dwProvType
,
3477 info
.dwProvType
= PROV_RSA_FULL
;
3481 CertSetCertificateContextProperty(context
, CERT_KEY_PROV_INFO_PROP_ID
,
3486 CryptMemFree(info
.pwszContainerName
);
3487 CryptMemFree(info
.pwszProvName
);
3491 /* Creates a signed certificate context from the unsigned, encoded certificate
3492 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
3494 static PCCERT_CONTEXT
CRYPT_CreateSignedCert(const CRYPT_DER_BLOB
*blob
,
3495 HCRYPTPROV hProv
, DWORD dwKeySpec
, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo
)
3497 PCCERT_CONTEXT context
= NULL
;
3501 ret
= CryptSignCertificate(hProv
, dwKeySpec
, X509_ASN_ENCODING
,
3502 blob
->pbData
, blob
->cbData
, sigAlgo
, NULL
, NULL
, &sigSize
);
3505 LPBYTE sig
= CryptMemAlloc(sigSize
);
3507 ret
= CryptSignCertificate(hProv
, dwKeySpec
, X509_ASN_ENCODING
,
3508 blob
->pbData
, blob
->cbData
, sigAlgo
, NULL
, sig
, &sigSize
);
3511 CERT_SIGNED_CONTENT_INFO signedInfo
;
3512 BYTE
*encodedSignedCert
= NULL
;
3513 DWORD encodedSignedCertSize
= 0;
3515 signedInfo
.ToBeSigned
.cbData
= blob
->cbData
;
3516 signedInfo
.ToBeSigned
.pbData
= blob
->pbData
;
3517 signedInfo
.SignatureAlgorithm
= *sigAlgo
;
3518 signedInfo
.Signature
.cbData
= sigSize
;
3519 signedInfo
.Signature
.pbData
= sig
;
3520 signedInfo
.Signature
.cUnusedBits
= 0;
3521 ret
= CryptEncodeObjectEx(X509_ASN_ENCODING
, X509_CERT
,
3522 &signedInfo
, CRYPT_ENCODE_ALLOC_FLAG
, NULL
,
3523 &encodedSignedCert
, &encodedSignedCertSize
);
3526 context
= CertCreateCertificateContext(X509_ASN_ENCODING
,
3527 encodedSignedCert
, encodedSignedCertSize
);
3528 LocalFree(encodedSignedCert
);
3536 /* Copies data from the parameters into info, where:
3537 * pSerialNumber: The serial number. Must not be NULL.
3538 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3540 * pSignatureAlgorithm: Optional.
3541 * pStartTime: The starting time of the certificate. If NULL, the current
3542 * system time is used.
3543 * pEndTime: The ending time of the certificate. If NULL, one year past the
3544 * starting time is used.
3545 * pubKey: The public key of the certificate. Must not be NULL.
3546 * pExtensions: Extensions to be included with the certificate. Optional.
3548 static void CRYPT_MakeCertInfo(PCERT_INFO info
, const CRYPT_DATA_BLOB
*pSerialNumber
,
3549 const CERT_NAME_BLOB
*pSubjectIssuerBlob
,
3550 const CRYPT_ALGORITHM_IDENTIFIER
*pSignatureAlgorithm
, const SYSTEMTIME
*pStartTime
,
3551 const SYSTEMTIME
*pEndTime
, const CERT_PUBLIC_KEY_INFO
*pubKey
,
3552 const CERT_EXTENSIONS
*pExtensions
)
3554 static CHAR oid
[] = szOID_RSA_SHA1RSA
;
3557 assert(pSerialNumber
);
3558 assert(pSubjectIssuerBlob
);
3561 if (pExtensions
&& pExtensions
->cExtension
)
3562 info
->dwVersion
= CERT_V3
;
3564 info
->dwVersion
= CERT_V1
;
3565 info
->SerialNumber
.cbData
= pSerialNumber
->cbData
;
3566 info
->SerialNumber
.pbData
= pSerialNumber
->pbData
;
3567 if (pSignatureAlgorithm
)
3568 info
->SignatureAlgorithm
= *pSignatureAlgorithm
;
3571 info
->SignatureAlgorithm
.pszObjId
= oid
;
3572 info
->SignatureAlgorithm
.Parameters
.cbData
= 0;
3573 info
->SignatureAlgorithm
.Parameters
.pbData
= NULL
;
3575 info
->Issuer
.cbData
= pSubjectIssuerBlob
->cbData
;
3576 info
->Issuer
.pbData
= pSubjectIssuerBlob
->pbData
;
3578 SystemTimeToFileTime(pStartTime
, &info
->NotBefore
);
3580 GetSystemTimeAsFileTime(&info
->NotBefore
);
3582 SystemTimeToFileTime(pEndTime
, &info
->NotAfter
);
3587 if (FileTimeToSystemTime(&info
->NotBefore
, &endTime
))
3590 SystemTimeToFileTime(&endTime
, &info
->NotAfter
);
3593 info
->Subject
.cbData
= pSubjectIssuerBlob
->cbData
;
3594 info
->Subject
.pbData
= pSubjectIssuerBlob
->pbData
;
3595 info
->SubjectPublicKeyInfo
= *pubKey
;
3598 info
->cExtension
= pExtensions
->cExtension
;
3599 info
->rgExtension
= pExtensions
->rgExtension
;
3603 info
->cExtension
= 0;
3604 info
->rgExtension
= NULL
;
3608 typedef RPC_STATUS (RPC_ENTRY
*UuidCreateFunc
)(UUID
*);
3609 typedef RPC_STATUS (RPC_ENTRY
*UuidToStringFunc
)(UUID
*, unsigned char **);
3610 typedef RPC_STATUS (RPC_ENTRY
*RpcStringFreeFunc
)(unsigned char **);
3612 static HCRYPTPROV
CRYPT_CreateKeyProv(void)
3614 HCRYPTPROV hProv
= 0;
3615 HMODULE rpcrt
= LoadLibraryW(L
"rpcrt4");
3619 UuidCreateFunc uuidCreate
= (UuidCreateFunc
)GetProcAddress(rpcrt
,
3621 UuidToStringFunc uuidToString
= (UuidToStringFunc
)GetProcAddress(rpcrt
,
3623 RpcStringFreeFunc rpcStringFree
= (RpcStringFreeFunc
)GetProcAddress(
3624 rpcrt
, "RpcStringFreeA");
3626 if (uuidCreate
&& uuidToString
&& rpcStringFree
)
3629 RPC_STATUS status
= uuidCreate(&uuid
);
3631 if (status
== RPC_S_OK
|| status
== RPC_S_UUID_LOCAL_ONLY
)
3633 unsigned char *uuidStr
;
3635 status
= uuidToString(&uuid
, &uuidStr
);
3636 if (status
== RPC_S_OK
)
3638 BOOL ret
= CryptAcquireContextA(&hProv
, (LPCSTR
)uuidStr
,
3639 MS_DEF_PROV_A
, PROV_RSA_FULL
, CRYPT_NEWKEYSET
);
3645 ret
= CryptGenKey(hProv
, AT_SIGNATURE
, 0, &key
);
3647 CryptDestroyKey(key
);
3649 rpcStringFree(&uuidStr
);
3658 PCCERT_CONTEXT WINAPI
CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv
,
3659 PCERT_NAME_BLOB pSubjectIssuerBlob
, DWORD dwFlags
,
3660 PCRYPT_KEY_PROV_INFO pKeyProvInfo
,
3661 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm
, PSYSTEMTIME pStartTime
,
3662 PSYSTEMTIME pEndTime
, PCERT_EXTENSIONS pExtensions
)
3664 PCCERT_CONTEXT context
= NULL
;
3665 BOOL ret
, releaseContext
= FALSE
;
3666 PCERT_PUBLIC_KEY_INFO pubKey
= NULL
;
3667 DWORD pubKeySize
= 0, dwKeySpec
;
3669 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv
,
3670 pSubjectIssuerBlob
, dwFlags
, pKeyProvInfo
, pSignatureAlgorithm
, pStartTime
,
3671 pExtensions
, pExtensions
);
3673 if(!pSubjectIssuerBlob
)
3675 SetLastError(ERROR_INVALID_PARAMETER
);
3679 dwKeySpec
= pKeyProvInfo
? pKeyProvInfo
->dwKeySpec
: AT_SIGNATURE
;
3684 hProv
= CRYPT_CreateKeyProv();
3685 releaseContext
= TRUE
;
3687 else if (pKeyProvInfo
->dwFlags
& CERT_SET_KEY_PROV_HANDLE_PROP_ID
)
3689 SetLastError(NTE_BAD_FLAGS
);
3695 /* acquire the context using the given information*/
3696 ret
= CryptAcquireContextW(&hProv
,pKeyProvInfo
->pwszContainerName
,
3697 pKeyProvInfo
->pwszProvName
,pKeyProvInfo
->dwProvType
,
3698 pKeyProvInfo
->dwFlags
);
3701 if(GetLastError() != NTE_BAD_KEYSET
)
3703 /* create the key set */
3704 ret
= CryptAcquireContextW(&hProv
,pKeyProvInfo
->pwszContainerName
,
3705 pKeyProvInfo
->pwszProvName
,pKeyProvInfo
->dwProvType
,
3706 pKeyProvInfo
->dwFlags
|CRYPT_NEWKEYSET
);
3710 /* check if the key is here */
3711 ret
= CryptGetUserKey(hProv
,dwKeySpec
,&hKey
);
3714 if (NTE_NO_KEY
== GetLastError())
3715 { /* generate the key */
3716 ret
= CryptGenKey(hProv
,dwKeySpec
,0,&hKey
);
3720 CryptReleaseContext(hProv
,0);
3721 SetLastError(NTE_BAD_KEYSET
);
3725 CryptDestroyKey(hKey
);
3726 releaseContext
= TRUE
;
3730 ret
= CryptExportPublicKeyInfo(hProv
, dwKeySpec
, X509_ASN_ENCODING
, NULL
,
3734 pubKey
= CryptMemAlloc(pubKeySize
);
3737 ret
= CryptExportPublicKeyInfo(hProv
, dwKeySpec
, X509_ASN_ENCODING
,
3738 pubKey
, &pubKeySize
);
3741 CERT_INFO info
= { 0 };
3742 CRYPT_DER_BLOB blob
= { 0, NULL
};
3744 CRYPT_DATA_BLOB serialBlob
= { sizeof(serial
), serial
};
3746 CryptGenRandom(hProv
, sizeof(serial
), serial
);
3747 CRYPT_MakeCertInfo(&info
, &serialBlob
, pSubjectIssuerBlob
,
3748 pSignatureAlgorithm
, pStartTime
, pEndTime
, pubKey
, pExtensions
);
3749 ret
= CryptEncodeObjectEx(X509_ASN_ENCODING
, X509_CERT_TO_BE_SIGNED
,
3750 &info
, CRYPT_ENCODE_ALLOC_FLAG
, NULL
, &blob
.pbData
,
3754 if (!(dwFlags
& CERT_CREATE_SELFSIGN_NO_SIGN
))
3755 context
= CRYPT_CreateSignedCert(&blob
, hProv
,dwKeySpec
,
3756 &info
.SignatureAlgorithm
);
3758 context
= CertCreateCertificateContext(X509_ASN_ENCODING
,
3759 blob
.pbData
, blob
.cbData
);
3760 if (context
&& !(dwFlags
& CERT_CREATE_SELFSIGN_NO_KEY_INFO
))
3761 CertContext_SetKeyProvInfo(context
, pKeyProvInfo
, hProv
);
3762 LocalFree(blob
.pbData
);
3765 CryptMemFree(pubKey
);
3769 CryptReleaseContext(hProv
, 0);
3773 BOOL WINAPI
CertVerifyCTLUsage(DWORD dwEncodingType
, DWORD dwSubjectType
,
3774 void *pvSubject
, PCTL_USAGE pSubjectUsage
, DWORD dwFlags
,
3775 PCTL_VERIFY_USAGE_PARA pVerifyUsagePara
,
3776 PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus
)
3778 FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType
,
3779 dwSubjectType
, pvSubject
, pSubjectUsage
, dwFlags
, pVerifyUsagePara
,
3780 pVerifyUsageStatus
);
3781 SetLastError(ERROR_CALL_NOT_IMPLEMENTED
);
3785 const void * WINAPI
CertCreateContext(DWORD dwContextType
, DWORD dwEncodingType
,
3786 const BYTE
*pbEncoded
, DWORD cbEncoded
,
3787 DWORD dwFlags
, PCERT_CREATE_CONTEXT_PARA pCreatePara
)
3789 TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType
, dwEncodingType
,
3790 pbEncoded
, cbEncoded
, dwFlags
, pCreatePara
);
3794 FIXME("dwFlags 0x%08x not handled\n", dwFlags
);
3799 FIXME("pCreatePara not handled\n");
3803 switch (dwContextType
)
3805 case CERT_STORE_CERTIFICATE_CONTEXT
:
3806 return CertCreateCertificateContext(dwEncodingType
, pbEncoded
, cbEncoded
);
3807 case CERT_STORE_CRL_CONTEXT
:
3808 return CertCreateCRLContext(dwEncodingType
, pbEncoded
, cbEncoded
);
3809 case CERT_STORE_CTL_CONTEXT
:
3810 return CertCreateCTLContext(dwEncodingType
, pbEncoded
, cbEncoded
);
3812 WARN("unknown context type: 0x%x\n", dwContextType
);
3817 BOOL WINAPI
CryptSetKeyIdentifierProperty(const CRYPT_HASH_BLOB
*pKeyIdentifier
, DWORD dwPropId
,
3818 DWORD dwFlags
, LPCWSTR pwszComputerName
, void *pvReserved
, const void *pvData
)
3820 FIXME("(%p, 0x%x, 0x%x, %s, %p, %p): stub\n", pKeyIdentifier
, dwPropId
, dwFlags
,
3821 debugstr_w(pwszComputerName
), pvReserved
, pvData
);