dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #define NONAMELESSUNION
  24 #include "ntstatus.h"
  25 #define WIN32_NO_STATUS
  26 #include "windef.h"
  27 #include "winbase.h"
  28 #include "winternl.h"
  29 #define CRYPT_OID_INFO_HAS_EXTRA_FIELDS
  30 #include "wincrypt.h"
  31 #include "snmp.h"
  32 #include "bcrypt.h"
  33 #include "winnls.h"
  34 #include "rpc.h"
  35 #include "wine/debug.h"
  36 #include "crypt32_private.h"
  37
  38 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  39
  40 /* Internal version of CertGetCertificateContextProperty that gets properties
  41  * directly from the context (or the context it's linked to, depending on its
  42  * type.) Doesn't handle special-case properties, since they are handled by
  43  * CertGetCertificateContextProperty, and are particular to the store in which
  44  * the property exists (which is separate from the context.)
  45  */
  46 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
  47  void *pvData, DWORD *pcbData);
  48
  49 /* Internal version of CertSetCertificateContextProperty that sets properties
  50  * directly on the context (or the context it's linked to, depending on its
  51  * type.) Doesn't handle special cases, since they're handled by
  52  * CertSetCertificateContextProperty anyway.
  53  */
  54 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
  55  DWORD dwFlags, const void *pvData);
  56
  57 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  58  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  59  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  60 {
  61     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  62      pbCertEncoded, cbCertEncoded);
  63     BOOL ret;
  64
  65     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  66      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  67
  68     if (cert)
  69     {
  70         ret = CertAddCertificateContextToStore(hCertStore, cert,
  71          dwAddDisposition, ppCertContext);
  72         CertFreeCertificateContext(cert);
  73     }
  74     else
  75         ret = FALSE;
  76     return ret;
  77 }
  78
  79 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
  80  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  81 {
  82     HCERTSTORE store;
  83     BOOL ret = FALSE;
  84
  85     TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
  86      cbCertEncoded);
  87
  88     store = CertOpenSystemStoreA(0, pszCertStoreName);
  89     if (store)
  90     {
  91         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  92          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  93         CertCloseStore(store, 0);
  94     }
  95     return ret;
  96 }
  97
  98 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
  99  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 100 {
 101     HCERTSTORE store;
 102     BOOL ret = FALSE;
 103
 104     TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
 105      cbCertEncoded);
 106
 107     store = CertOpenSystemStoreW(0, pszCertStoreName);
 108     if (store)
 109     {
 110         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 111          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
 112         CertCloseStore(store, 0);
 113     }
 114     return ret;
 115 }
 116
 117 static const context_vtbl_t cert_vtbl;
 118
 119 static void Cert_free(context_t *context)
 120 {
 121     cert_t *cert = (cert_t*)context;
 122
 123     CryptMemFree(cert->ctx.pbCertEncoded);
 124     LocalFree(cert->ctx.pCertInfo);
 125 }
 126
 127 static context_t *Cert_clone(context_t *context, WINECRYPT_CERTSTORE *store, BOOL use_link)
 128 {
 129     cert_t *cert;
 130
 131     if(use_link) {
 132         cert = (cert_t*)Context_CreateLinkContext(sizeof(CERT_CONTEXT), context, store);
 133         if(!cert)
 134             return NULL;
 135     }else {
 136         const cert_t *cloned = (const cert_t*)context;
 137         DWORD size = 0;
 138         BOOL res;
 139
 140         cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, store);
 141         if(!cert)
 142             return NULL;
 143
 144         Context_CopyProperties(&cert->ctx, &cloned->ctx);
 145
 146         cert->ctx.dwCertEncodingType = cloned->ctx.dwCertEncodingType;
 147         cert->ctx.pbCertEncoded = CryptMemAlloc(cloned->ctx.cbCertEncoded);
 148         memcpy(cert->ctx.pbCertEncoded, cloned->ctx.pbCertEncoded, cloned->ctx.cbCertEncoded);
 149         cert->ctx.cbCertEncoded = cloned->ctx.cbCertEncoded;
 150
 151         /* FIXME: We don't need to decode the object here, we could just clone cert info. */
 152         res = CryptDecodeObjectEx(cert->ctx.dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 153          cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 154          &cert->ctx.pCertInfo, &size);
 155         if(!res) {
 156             CertFreeCertificateContext(&cert->ctx);
 157             return NULL;
 158         }
 159     }
 160
 161     cert->ctx.hCertStore = store;
 162     return &cert->base;
 163 }
 164
 165 static const context_vtbl_t cert_vtbl = {
 166     Cert_free,
 167     Cert_clone
 168 };
 169
 170 static BOOL add_cert_to_store(WINECRYPT_CERTSTORE *store, const CERT_CONTEXT *cert,
 171  DWORD add_disposition, BOOL use_link, PCCERT_CONTEXT *ret_context)
 172 {
 173     const CERT_CONTEXT *existing = NULL;
 174     BOOL ret = TRUE, inherit_props = FALSE;
 175     context_t *new_context = NULL;
 176
 177     switch (add_disposition)
 178     {
 179     case CERT_STORE_ADD_ALWAYS:
 180         break;
 181     case CERT_STORE_ADD_NEW:
 182     case CERT_STORE_ADD_REPLACE_EXISTING:
 183     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 184     case CERT_STORE_ADD_USE_EXISTING:
 185     case CERT_STORE_ADD_NEWER:
 186     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 187     {
 188         BYTE hashToAdd[20];
 189         DWORD size = sizeof(hashToAdd);
 190
 191         ret = CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID,
 192          hashToAdd, &size);
 193         if (ret)
 194         {
 195             CRYPT_HASH_BLOB blob = { sizeof(hashToAdd), hashToAdd };
 196
 197             existing = CertFindCertificateInStore(store, cert->dwCertEncodingType, 0,
 198              CERT_FIND_SHA1_HASH, &blob, NULL);
 199         }
 200         break;
 201     }
 202     default:
 203         FIXME("Unimplemented add disposition %d\n", add_disposition);
 204         SetLastError(E_INVALIDARG);
 205         return FALSE;
 206     }
 207
 208     switch (add_disposition)
 209     {
 210     case CERT_STORE_ADD_ALWAYS:
 211         break;
 212     case CERT_STORE_ADD_NEW:
 213         if (existing)
 214         {
 215             TRACE("found matching certificate, not adding\n");
 216             SetLastError(CRYPT_E_EXISTS);
 217             return FALSE;
 218         }
 219         break;
 220     case CERT_STORE_ADD_REPLACE_EXISTING:
 221         break;
 222     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 223         if (use_link)
 224             FIXME("CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES: semi-stub for links\n");
 225         if (existing)
 226             inherit_props = TRUE;
 227         break;
 228     case CERT_STORE_ADD_USE_EXISTING:
 229         if(use_link)
 230             FIXME("CERT_STORE_ADD_USE_EXISTING: semi-stub for links\n");
 231         if (existing)
 232         {
 233             Context_CopyProperties(existing, cert);
 234             if (ret_context)
 235                 *ret_context = CertDuplicateCertificateContext(existing);
 236             return TRUE;
 237         }
 238         break;
 239     case CERT_STORE_ADD_NEWER:
 240         if (existing && CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 241         {
 242             TRACE("existing certificate is newer, not adding\n");
 243             SetLastError(CRYPT_E_EXISTS);
 244             return FALSE;
 245         }
 246         break;
 247     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 248         if (existing)
 249         {
 250             if (CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 251             {
 252                 TRACE("existing certificate is newer, not adding\n");
 253                 SetLastError(CRYPT_E_EXISTS);
 254                 return FALSE;
 255             }
 256             inherit_props = TRUE;
 257         }
 258         break;
 259     }
 260
 261     /* FIXME: We have tests that this works, but what should we really do in this case? */
 262     if(!store) {
 263         if(ret_context)
 264             *ret_context = CertDuplicateCertificateContext(cert);
 265         return TRUE;
 266     }
 267
 268     ret = store->vtbl->certs.addContext(store, context_from_ptr(cert), existing ? context_from_ptr(existing) : NULL,
 269      (ret_context || inherit_props) ? &new_context : NULL, use_link);
 270     if(!ret)
 271         return FALSE;
 272
 273     if(inherit_props)
 274         Context_CopyProperties(context_ptr(new_context), existing);
 275
 276     if(ret_context)
 277         *ret_context = context_ptr(new_context);
 278     else if(new_context)
 279         Context_Release(new_context);
 280
 281     TRACE("returning %d\n", ret);
 282     return ret;
 283 }
 284
 285 BOOL WINAPI CertAddCertificateContextToStore(HCERTSTORE hCertStore, PCCERT_CONTEXT pCertContext,
 286  DWORD dwAddDisposition, PCCERT_CONTEXT *ppStoreContext)
 287 {
 288     WINECRYPT_CERTSTORE *store = hCertStore;
 289
 290     TRACE("(%p, %p, %08x, %p)\n", hCertStore, pCertContext, dwAddDisposition, ppStoreContext);
 291
 292     return add_cert_to_store(store, pCertContext, dwAddDisposition, FALSE, ppStoreContext);
 293 }
 294
 295 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
 296  PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
 297  PCCERT_CONTEXT *ppCertContext)
 298 {
 299     static int calls;
 300     WINECRYPT_CERTSTORE *store = (WINECRYPT_CERTSTORE*)hCertStore;
 301
 302     if (!(calls++))
 303         FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore, pCertContext,
 304          dwAddDisposition, ppCertContext);
 305     if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
 306         return FALSE;
 307     if (store->type == StoreTypeCollection)
 308     {
 309         SetLastError(E_INVALIDARG);
 310         return FALSE;
 311     }
 312     return add_cert_to_store(hCertStore, pCertContext, dwAddDisposition, TRUE, ppCertContext);
 313 }
 314
 315 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
 316  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 317 {
 318     cert_t *cert = NULL;
 319     BYTE *data = NULL;
 320     BOOL ret;
 321     PCERT_INFO certInfo = NULL;
 322     DWORD size = 0;
 323
 324     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
 325      cbCertEncoded);
 326
 327     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
 328     {
 329         SetLastError(E_INVALIDARG);
 330         return NULL;
 331     }
 332
 333     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 334      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 335      &certInfo, &size);
 336     if (!ret)
 337         return NULL;
 338
 339     cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, &empty_store);
 340     if (!cert)
 341         return NULL;
 342     data = CryptMemAlloc(cbCertEncoded);
 343     if (!data)
 344     {
 345         Context_Release(&cert->base);
 346         return NULL;
 347     }
 348
 349     memcpy(data, pbCertEncoded, cbCertEncoded);
 350     cert->ctx.dwCertEncodingType = dwCertEncodingType;
 351     cert->ctx.pbCertEncoded      = data;
 352     cert->ctx.cbCertEncoded      = cbCertEncoded;
 353     cert->ctx.pCertInfo          = certInfo;
 354     cert->ctx.hCertStore         = &empty_store;
 355
 356     return &cert->ctx;
 357 }
 358
 359 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(PCCERT_CONTEXT pCertContext)
 360 {
 361     TRACE("(%p)\n", pCertContext);
 362
 363     if (!pCertContext)
 364         return NULL;
 365
 366     Context_AddRef(&cert_from_ptr(pCertContext)->base);
 367     return pCertContext;
 368 }
 369
 370 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 371 {
 372     TRACE("(%p)\n", pCertContext);
 373
 374     if (pCertContext)
 375         Context_Release(&cert_from_ptr(pCertContext)->base);
 376     return TRUE;
 377 }
 378
 379 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 380  DWORD dwPropId)
 381 {
 382     cert_t *cert = cert_from_ptr(pCertContext);
 383     DWORD ret;
 384
 385     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 386
 387     if (cert->base.properties)
 388         ret = ContextPropertyList_EnumPropIDs(cert->base.properties, dwPropId);
 389     else
 390         ret = 0;
 391     return ret;
 392 }
 393
 394 static BOOL CertContext_GetHashProp(cert_t *cert, DWORD dwPropId,
 395  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 396  DWORD *pcbData)
 397 {
 398     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 399      pcbData);
 400     if (ret && pvData)
 401     {
 402         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 403
 404         ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 405     }
 406     return ret;
 407 }
 408
 409 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 410  DWORD cb)
 411 {
 412     BOOL ret = TRUE;
 413
 414     if (!pvData)
 415         *pcbData = cb;
 416     else if (*pcbData < cb)
 417     {
 418         SetLastError(ERROR_MORE_DATA);
 419         *pcbData = cb;
 420         ret = FALSE;
 421     }
 422     else
 423     {
 424         memcpy(pvData, pb, cb);
 425         *pcbData = cb;
 426     }
 427     return ret;
 428 }
 429
 430 void CRYPT_ConvertKeyContext(const struct store_CERT_KEY_CONTEXT *src, CERT_KEY_CONTEXT *dst)
 431 {
 432     dst->cbSize = sizeof(*dst);
 433     dst->hCryptProv = src->hCryptProv;
 434     dst->dwKeySpec = src->dwKeySpec;
 435 }
 436
 437 /*
 438  * Fix offsets in a continuous block of memory of CRYPT_KEY_PROV_INFO with
 439  * its associated data.
 440  */
 441 static void fix_KeyProvInfoProperty(CRYPT_KEY_PROV_INFO *info)
 442 {
 443     BYTE *data;
 444     DWORD i;
 445
 446     data = (BYTE *)(info + 1) + sizeof(CRYPT_KEY_PROV_PARAM) * info->cProvParam;
 447
 448     if (info->pwszContainerName)
 449     {
 450         info->pwszContainerName = (LPWSTR)data;
 451         data += (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 452     }
 453
 454     if (info->pwszProvName)
 455     {
 456         info->pwszProvName = (LPWSTR)data;
 457         data += (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 458     }
 459
 460     info->rgProvParam = info->cProvParam ? (CRYPT_KEY_PROV_PARAM *)(info + 1) : NULL;
 461
 462     for (i = 0; i < info->cProvParam; i++)
 463     {
 464         info->rgProvParam[i].pbData = info->rgProvParam[i].cbData ? data : NULL;
 465         data += info->rgProvParam[i].cbData;
 466     }
 467 }
 468
 469 /*
 470  * Copy to a continuous block of memory of CRYPT_KEY_PROV_INFO with
 471  * its associated data.
 472  */
 473 static void copy_KeyProvInfoProperty(const CRYPT_KEY_PROV_INFO *from, CRYPT_KEY_PROV_INFO *to)
 474 {
 475     BYTE *data;
 476     DWORD i;
 477
 478     data = (BYTE *)(to + 1) + sizeof(CRYPT_KEY_PROV_PARAM) * from->cProvParam;
 479
 480     if (from->pwszContainerName)
 481     {
 482         to->pwszContainerName = (LPWSTR)data;
 483         lstrcpyW((LPWSTR)data, from->pwszContainerName);
 484         data += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 485     }
 486     else
 487         to->pwszContainerName = NULL;
 488
 489     if (from->pwszProvName)
 490     {
 491         to->pwszProvName = (LPWSTR)data;
 492         lstrcpyW((LPWSTR)data, from->pwszProvName);
 493         data += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 494     }
 495     else
 496         to->pwszProvName = NULL;
 497
 498     to->dwProvType = from->dwProvType;
 499     to->dwFlags = from->dwFlags;
 500     to->cProvParam = from->cProvParam;
 501     to->rgProvParam = from->cProvParam ? (CRYPT_KEY_PROV_PARAM *)(to + 1) : NULL;
 502     to->dwKeySpec = from->dwKeySpec;
 503
 504     for (i = 0; i < from->cProvParam; i++)
 505     {
 506         to->rgProvParam[i].dwParam = from->rgProvParam[i].dwParam;
 507         to->rgProvParam[i].dwFlags = from->rgProvParam[i].dwFlags;
 508         to->rgProvParam[i].cbData = from->rgProvParam[i].cbData;
 509         to->rgProvParam[i].pbData = from->rgProvParam[i].cbData ? data : NULL;
 510         memcpy(data, from->rgProvParam[i].pbData, from->rgProvParam[i].cbData);
 511         data += from->rgProvParam[i].cbData;
 512     }
 513 }
 514
 515 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
 516  void *pvData, DWORD *pcbData)
 517 {
 518     BOOL ret;
 519     CRYPT_DATA_BLOB blob;
 520
 521     TRACE("(%p, %d, %p, %p)\n", cert, dwPropId, pvData, pcbData);
 522
 523     if (cert->base.properties)
 524         ret = ContextPropertyList_FindProperty(cert->base.properties, dwPropId, &blob);
 525     else
 526         ret = FALSE;
 527     if (ret)
 528     {
 529         CERT_KEY_CONTEXT ctx;
 530         if (dwPropId == CERT_KEY_CONTEXT_PROP_ID)
 531         {
 532             CRYPT_ConvertKeyContext((const struct store_CERT_KEY_CONTEXT *)blob.pbData, &ctx);
 533             blob.pbData = (BYTE *)&ctx;
 534             blob.cbData = ctx.cbSize;
 535         }
 536         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 537     }
 538     else
 539     {
 540         /* Implicit properties */
 541         switch (dwPropId)
 542         {
 543         case CERT_SHA1_HASH_PROP_ID:
 544             ret = CertContext_GetHashProp(cert, dwPropId, CALG_SHA1,
 545              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 546              pcbData);
 547             break;
 548         case CERT_MD5_HASH_PROP_ID:
 549             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 550              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 551              pcbData);
 552             break;
 553         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 554             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 555              cert->ctx.pCertInfo->Subject.pbData,
 556              cert->ctx.pCertInfo->Subject.cbData,
 557              pvData, pcbData);
 558             break;
 559         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 560             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 561              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 562              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 563              pvData, pcbData);
 564             break;
 565         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 566             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 567              cert->ctx.pCertInfo->SerialNumber.pbData,
 568              cert->ctx.pCertInfo->SerialNumber.cbData,
 569              pvData, pcbData);
 570             break;
 571         case CERT_SIGNATURE_HASH_PROP_ID:
 572             ret = CryptHashToBeSigned(0, cert->ctx.dwCertEncodingType,
 573              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 574              pcbData);
 575             if (ret && pvData)
 576             {
 577                 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 578
 579                 ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 580             }
 581             break;
 582         case CERT_KEY_IDENTIFIER_PROP_ID:
 583         {
 584             PCERT_EXTENSION ext = CertFindExtension(
 585              szOID_SUBJECT_KEY_IDENTIFIER, cert->ctx.pCertInfo->cExtension,
 586              cert->ctx.pCertInfo->rgExtension);
 587
 588             if (ext)
 589             {
 590                 CRYPT_DATA_BLOB value;
 591                 DWORD size = sizeof(value);
 592
 593                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 594                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 595                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 596                  &size);
 597                 if (ret)
 598                 {
 599                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 600                      value.cbData);
 601                     CertContext_SetProperty(cert, dwPropId, 0, &value);
 602                 }
 603             }
 604             else
 605                 SetLastError(ERROR_INVALID_DATA);
 606             break;
 607         }
 608         default:
 609             SetLastError(CRYPT_E_NOT_FOUND);
 610         }
 611     }
 612     TRACE("returning %d\n", ret);
 613     return ret;
 614 }
 615
 616 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 617  DWORD dwPropId, void *pvData, DWORD *pcbData)
 618 {
 619     cert_t *cert = cert_from_ptr(pCertContext);
 620     BOOL ret;
 621
 622     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 623
 624     switch (dwPropId)
 625     {
 626     case 0:
 627     case CERT_CERT_PROP_ID:
 628     case CERT_CRL_PROP_ID:
 629     case CERT_CTL_PROP_ID:
 630         SetLastError(E_INVALIDARG);
 631         ret = FALSE;
 632         break;
 633     case CERT_ACCESS_STATE_PROP_ID:
 634         ret = CertGetStoreProperty(cert->ctx.hCertStore, dwPropId, pvData, pcbData);
 635         break;
 636     case CERT_KEY_PROV_HANDLE_PROP_ID:
 637     {
 638         CERT_KEY_CONTEXT keyContext;
 639         DWORD size = sizeof(keyContext);
 640
 641         ret = CertContext_GetProperty(cert,
 642          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 643         if (ret)
 644             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 645              sizeof(keyContext.hCryptProv));
 646         break;
 647     }
 648     case CERT_KEY_PROV_INFO_PROP_ID:
 649         ret = CertContext_GetProperty(cert, dwPropId, pvData, pcbData);
 650         if (ret && pvData)
 651             fix_KeyProvInfoProperty(pvData);
 652         break;
 653     default:
 654         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 655          pcbData);
 656     }
 657
 658     TRACE("returning %d\n", ret);
 659     return ret;
 660 }
 661
 662 /*
 663  * Create a continuous block of memory for CRYPT_KEY_PROV_INFO with
 664  * its associated data, and add it to the certificate properties.
 665  */
 666 static BOOL CertContext_SetKeyProvInfoProperty(CONTEXT_PROPERTY_LIST *properties, const CRYPT_KEY_PROV_INFO *info)
 667 {
 668     CRYPT_KEY_PROV_INFO *prop;
 669     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i;
 670     BOOL ret;
 671
 672     if (info->pwszContainerName)
 673         size += (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 674     if (info->pwszProvName)
 675         size += (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 676
 677     for (i = 0; i < info->cProvParam; i++)
 678         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 679
 680     prop = HeapAlloc(GetProcessHeap(), 0, size);
 681     if (!prop)
 682     {
 683         SetLastError(ERROR_OUTOFMEMORY);
 684         return FALSE;
 685     }
 686
 687     copy_KeyProvInfoProperty(info, prop);
 688
 689     ret = ContextPropertyList_SetProperty(properties, CERT_KEY_PROV_INFO_PROP_ID, (const BYTE *)prop, size);
 690     HeapFree(GetProcessHeap(), 0, prop);
 691
 692     return ret;
 693 }
 694
 695 static BOOL CertContext_SetKeyContextProperty(CONTEXT_PROPERTY_LIST *properties,
 696  const CERT_KEY_CONTEXT *keyContext)
 697 {
 698     struct store_CERT_KEY_CONTEXT ctx;
 699
 700     ctx.cbSize = sizeof(ctx);
 701     ctx.hCryptProv = keyContext->hCryptProv;
 702     ctx.dwKeySpec = keyContext->dwKeySpec;
 703
 704     return ContextPropertyList_SetProperty(properties, CERT_KEY_CONTEXT_PROP_ID,
 705      (const BYTE *)&ctx, ctx.cbSize);
 706 }
 707
 708 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
 709  DWORD dwFlags, const void *pvData)
 710 {
 711     BOOL ret;
 712
 713     TRACE("(%p, %d, %08x, %p)\n", cert, dwPropId, dwFlags, pvData);
 714
 715     if (!cert->base.properties)
 716         ret = FALSE;
 717     else
 718     {
 719         switch (dwPropId)
 720         {
 721         case CERT_AUTO_ENROLL_PROP_ID:
 722         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 723         case CERT_DESCRIPTION_PROP_ID:
 724         case CERT_FRIENDLY_NAME_PROP_ID:
 725         case CERT_HASH_PROP_ID:
 726         case CERT_KEY_IDENTIFIER_PROP_ID:
 727         case CERT_MD5_HASH_PROP_ID:
 728         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 729         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 730         case CERT_PVK_FILE_PROP_ID:
 731         case CERT_SIGNATURE_HASH_PROP_ID:
 732         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 733         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 734         case CERT_EXTENDED_ERROR_INFO_PROP_ID:
 735         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 736         case CERT_ENROLLMENT_PROP_ID:
 737         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 738         case CERT_OCSP_RESPONSE_PROP_ID:
 739         case CERT_RENEWAL_PROP_ID:
 740         {
 741             if (pvData)
 742             {
 743                 const CRYPT_DATA_BLOB *blob = pvData;
 744
 745                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 746                  blob->pbData, blob->cbData);
 747             }
 748             else
 749             {
 750                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 751                 ret = TRUE;
 752             }
 753             break;
 754         }
 755         case CERT_DATE_STAMP_PROP_ID:
 756             if (pvData)
 757                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 758                  pvData, sizeof(FILETIME));
 759             else
 760             {
 761                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 762                 ret = TRUE;
 763             }
 764             break;
 765         case CERT_KEY_CONTEXT_PROP_ID:
 766             if (pvData)
 767             {
 768                 const CERT_KEY_CONTEXT *keyContext = pvData;
 769
 770                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 771                 {
 772                     SetLastError(E_INVALIDARG);
 773                     ret = FALSE;
 774                 }
 775                 else
 776                     ret = CertContext_SetKeyContextProperty(cert->base.properties, pvData);
 777             }
 778             else
 779             {
 780                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 781                 ret = TRUE;
 782             }
 783             break;
 784         case CERT_KEY_PROV_INFO_PROP_ID:
 785             if (pvData)
 786                 ret = CertContext_SetKeyProvInfoProperty(cert->base.properties, pvData);
 787             else
 788             {
 789                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 790                 ret = TRUE;
 791             }
 792             break;
 793         case CERT_KEY_PROV_HANDLE_PROP_ID:
 794         {
 795             CERT_KEY_CONTEXT keyContext;
 796             DWORD size = sizeof(keyContext);
 797
 798             ret = CertContext_GetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 799              &keyContext, &size);
 800             if (ret)
 801             {
 802                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 803                     CryptReleaseContext(keyContext.hCryptProv, 0);
 804             }
 805             keyContext.cbSize = sizeof(keyContext);
 806             if (pvData)
 807                 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 808             else
 809             {
 810                 keyContext.hCryptProv = 0;
 811                 keyContext.dwKeySpec = AT_SIGNATURE;
 812             }
 813             ret = CertContext_SetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 814              0, &keyContext);
 815             break;
 816         }
 817         default:
 818             FIXME("%d: stub\n", dwPropId);
 819             ret = FALSE;
 820         }
 821     }
 822     TRACE("returning %d\n", ret);
 823     return ret;
 824 }
 825
 826 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 827  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 828 {
 829     BOOL ret;
 830
 831     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 832
 833     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 834      * crashes on most of these, I'll be safer.
 835      */
 836     switch (dwPropId)
 837     {
 838     case 0:
 839     case CERT_ACCESS_STATE_PROP_ID:
 840     case CERT_CERT_PROP_ID:
 841     case CERT_CRL_PROP_ID:
 842     case CERT_CTL_PROP_ID:
 843         SetLastError(E_INVALIDARG);
 844         return FALSE;
 845     }
 846     ret = CertContext_SetProperty(cert_from_ptr(pCertContext), dwPropId, dwFlags,
 847      pvData);
 848     TRACE("returning %d\n", ret);
 849     return ret;
 850 }
 851
 852 /* Acquires the private key using the key provider info, retrieving info from
 853  * the certificate if info is NULL.  The acquired provider is returned in
 854  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 855  */
 856 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert, DWORD dwFlags,
 857  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 858 {
 859     DWORD size = 0;
 860     BOOL allocated = FALSE, ret = TRUE;
 861
 862     if (!info)
 863     {
 864         ret = CertGetCertificateContextProperty(pCert,
 865          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 866         if (ret)
 867         {
 868             info = HeapAlloc(GetProcessHeap(), 0, size);
 869             if (info)
 870             {
 871                 ret = CertGetCertificateContextProperty(pCert,
 872                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 873                 allocated = TRUE;
 874             }
 875             else
 876             {
 877                 SetLastError(ERROR_OUTOFMEMORY);
 878                 ret = FALSE;
 879             }
 880         }
 881         else
 882             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 883     }
 884     if (ret)
 885     {
 886         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 887          info->pwszProvName, info->dwProvType, (dwFlags & CRYPT_ACQUIRE_SILENT_FLAG) ? CRYPT_SILENT : 0);
 888         if (ret)
 889         {
 890             DWORD i;
 891
 892             for (i = 0; i < info->cProvParam; i++)
 893             {
 894                 CryptSetProvParam(*phCryptProv,
 895                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 896                  info->rgProvParam[i].dwFlags);
 897             }
 898             *pdwKeySpec = info->dwKeySpec;
 899         }
 900         else
 901             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 902     }
 903     if (allocated)
 904         HeapFree(GetProcessHeap(), 0, info);
 905     return ret;
 906 }
 907
 908 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 909  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 910  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 911 {
 912     BOOL ret = FALSE, cache = FALSE;
 913     PCRYPT_KEY_PROV_INFO info = NULL;
 914     CERT_KEY_CONTEXT keyContext;
 915     DWORD size;
 916     PCCERT_CONTEXT cert_in_store = NULL;
 917
 918     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 919      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 920
 921     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 922     {
 923         DWORD size = 0;
 924
 925         ret = CertGetCertificateContextProperty(pCert,
 926          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 927
 928         if (!ret)
 929         {
 930             HCERTSTORE hstore;
 931
 932             hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, 0,
 933                                    CERT_SYSTEM_STORE_CURRENT_USER, L"My");
 934             if (hstore)
 935             {
 936                 cert_in_store = CertFindCertificateInStore(hstore, pCert->dwCertEncodingType, 0,
 937                                                            CERT_FIND_EXISTING, pCert, NULL);
 938                 if (cert_in_store)
 939                 {
 940                     ret = CertGetCertificateContextProperty(cert_in_store, CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 941                     if (ret)
 942                         pCert = cert_in_store;
 943                     else
 944                     {
 945                         CertFreeCertificateContext(cert_in_store);
 946                         cert_in_store = NULL;
 947                     }
 948                 }
 949
 950                 CertCloseStore(hstore, 0);
 951             }
 952         }
 953
 954         if (ret)
 955         {
 956             info = HeapAlloc(GetProcessHeap(), 0, size);
 957             ret = CertGetCertificateContextProperty(pCert,
 958              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 959             if (ret)
 960                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 961         }
 962     }
 963     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 964         cache = TRUE;
 965     *phCryptProv = 0;
 966     if (cache)
 967     {
 968         size = sizeof(keyContext);
 969         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 970          &keyContext, &size);
 971         if (ret)
 972         {
 973             *phCryptProv = keyContext.hCryptProv;
 974             if (pdwKeySpec)
 975                 *pdwKeySpec = keyContext.dwKeySpec;
 976             if (pfCallerFreeProv)
 977                 *pfCallerFreeProv = FALSE;
 978         }
 979     }
 980     if (!*phCryptProv)
 981     {
 982         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, dwFlags, info,
 983          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 984         if (ret)
 985         {
 986             *phCryptProv = keyContext.hCryptProv;
 987             if (pdwKeySpec)
 988                 *pdwKeySpec = keyContext.dwKeySpec;
 989             if (cache)
 990             {
 991                 keyContext.cbSize = sizeof(keyContext);
 992                 if (CertSetCertificateContextProperty(pCert,
 993                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 994                 {
 995                     if (pfCallerFreeProv)
 996                         *pfCallerFreeProv = FALSE;
 997                 }
 998             }
 999             else
1000             {
1001                 if (pfCallerFreeProv)
1002                     *pfCallerFreeProv = TRUE;
1003             }
1004         }
1005     }
1006     HeapFree(GetProcessHeap(), 0, info);
1007     if (cert_in_store)
1008         CertFreeCertificateContext(cert_in_store);
1009     return ret;
1010 }
1011
1012 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
1013  const CRYPT_KEY_PROV_INFO *keyProvInfo)
1014 {
1015     HCRYPTPROV csp;
1016     BOOL matches = FALSE;
1017
1018     if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
1019      keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
1020     {
1021         DWORD size;
1022
1023         /* Need to sign something to verify the sig.  What to sign?  Why not
1024          * the certificate itself?
1025          */
1026         if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
1027          pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
1028          &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
1029         {
1030             BYTE *certEncoded = CryptMemAlloc(size);
1031
1032             if (certEncoded)
1033             {
1034                 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
1035                  pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
1036                  pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
1037                  NULL, certEncoded, &size))
1038                 {
1039                     if (size == pCert->cbCertEncoded &&
1040                      !memcmp(certEncoded, pCert->pbCertEncoded, size))
1041                         matches = TRUE;
1042                 }
1043                 CryptMemFree(certEncoded);
1044             }
1045         }
1046         CryptReleaseContext(csp, 0);
1047     }
1048     return matches;
1049 }
1050
1051 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
1052  CRYPT_KEY_PROV_INFO *keyProvInfo)
1053 {
1054     CRYPT_KEY_PROV_INFO copy;
1055     WCHAR containerW[MAX_PATH];
1056     BOOL matches;
1057
1058     MultiByteToWideChar(CP_ACP, 0, container, -1, containerW, ARRAY_SIZE(containerW));
1059     /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
1060      * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
1061      * name.
1062      */
1063     copy = *keyProvInfo;
1064     copy.pwszContainerName = containerW;
1065     matches = key_prov_info_matches_cert(pCert, &copy);
1066     if (matches)
1067     {
1068         keyProvInfo->pwszContainerName =
1069          CryptMemAlloc((lstrlenW(containerW) + 1) * sizeof(WCHAR));
1070         if (keyProvInfo->pwszContainerName)
1071         {
1072             lstrcpyW(keyProvInfo->pwszContainerName, containerW);
1073             keyProvInfo->dwKeySpec = AT_SIGNATURE;
1074         }
1075         else
1076             matches = FALSE;
1077     }
1078     return matches;
1079 }
1080
1081 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
1082  * private key matches pCert's public key.  Upon success, updates keyProvInfo
1083  * with the matching container's info (free keyProvInfo.pwszContainerName upon
1084  * success.)
1085  * Returns TRUE if found, FALSE if not.
1086  */
1087 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
1088  CRYPT_KEY_PROV_INFO *keyProvInfo)
1089 {
1090     HCRYPTPROV defProvider;
1091     BOOL ret, found = FALSE;
1092     char containerA[MAX_PATH];
1093
1094     assert(keyProvInfo->pwszContainerName == NULL);
1095     if ((ret = CryptAcquireContextW(&defProvider, NULL,
1096      keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
1097      keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
1098     {
1099         DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
1100
1101         while (ret && !found)
1102         {
1103             DWORD size = sizeof(containerA);
1104
1105             ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
1106              (BYTE *)containerA, &size, enumFlags);
1107             if (ret)
1108                 found = container_matches_cert(pCert, containerA, keyProvInfo);
1109             if (enumFlags & CRYPT_FIRST)
1110             {
1111                 enumFlags &= ~CRYPT_FIRST;
1112                 enumFlags |= CRYPT_NEXT;
1113             }
1114         }
1115         CryptReleaseContext(defProvider, 0);
1116     }
1117     return found;
1118 }
1119
1120 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
1121 {
1122     BOOL found = FALSE, ret = TRUE;
1123     DWORD index = 0, cbProvName = 0;
1124     CRYPT_KEY_PROV_INFO keyProvInfo;
1125
1126     TRACE("(%p, %08x)\n", pCert, dwFlags);
1127
1128     memset(&keyProvInfo, 0, sizeof(keyProvInfo));
1129     while (ret && !found)
1130     {
1131         DWORD size = 0;
1132
1133         ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
1134          NULL, &size);
1135         if (ret)
1136         {
1137             if (size <= cbProvName)
1138                 ret = CryptEnumProvidersW(index, NULL, 0,
1139                  &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1140             else
1141             {
1142                 CryptMemFree(keyProvInfo.pwszProvName);
1143                 keyProvInfo.pwszProvName = CryptMemAlloc(size);
1144                 if (keyProvInfo.pwszProvName)
1145                 {
1146                     cbProvName = size;
1147                     ret = CryptEnumProvidersW(index, NULL, 0,
1148                      &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1149                     if (ret)
1150                     {
1151                         if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
1152                             keyProvInfo.dwFlags |= CRYPT_SILENT;
1153                         if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
1154                          !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1155                          CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1156                         {
1157                             keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
1158                             found = find_key_prov_info_in_provider(pCert,
1159                              &keyProvInfo);
1160                         }
1161                         if (!found)
1162                         {
1163                             if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
1164                              !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1165                              CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1166                             {
1167                                 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
1168                                 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
1169                                 found = find_key_prov_info_in_provider(pCert,
1170                                  &keyProvInfo);
1171                             }
1172                         }
1173                     }
1174                 }
1175                 else
1176                     ret = FALSE;
1177             }
1178             index++;
1179         }
1180     }
1181     if (found)
1182         CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1183          0, &keyProvInfo);
1184     CryptMemFree(keyProvInfo.pwszProvName);
1185     CryptMemFree(keyProvInfo.pwszContainerName);
1186     return found;
1187 }
1188
1189 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
1190 {
1191     BOOL matches = FALSE;
1192     DWORD size;
1193
1194     if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1195      NULL, &size))
1196     {
1197         CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
1198
1199         if (keyProvInfo)
1200         {
1201             if (CertGetCertificateContextProperty(pCert,
1202              CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
1203                 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
1204             CryptMemFree(keyProvInfo);
1205         }
1206     }
1207     return matches;
1208 }
1209
1210 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
1211  DWORD dwFlags, void *pvReserved)
1212 {
1213     BOOL matches;
1214
1215     TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
1216
1217     matches = cert_prov_info_matches_cert(pCert);
1218     if (!matches)
1219         matches = find_matching_provider(pCert, dwFlags);
1220     return matches;
1221 }
1222
1223 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1224  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1225 {
1226     BOOL ret;
1227
1228     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1229
1230     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1231      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1232      &pCertId2->SerialNumber);
1233     TRACE("returning %d\n", ret);
1234     return ret;
1235 }
1236
1237 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1238  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1239 {
1240     BOOL ret;
1241
1242     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1243
1244     if (pCertName1->cbData == pCertName2->cbData)
1245     {
1246         if (pCertName1->cbData)
1247             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1248              pCertName1->cbData);
1249         else
1250             ret = TRUE;
1251     }
1252     else
1253         ret = FALSE;
1254     TRACE("returning %d\n", ret);
1255     return ret;
1256 }
1257
1258 /* Returns the number of significant bytes in pInt, where a byte is
1259  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1260  * for negative numbers.  pInt is assumed to be little-endian.
1261  */
1262 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1263 {
1264     DWORD ret = pInt->cbData;
1265
1266     while (ret > 1)
1267     {
1268         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1269             ret--;
1270         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1271             ret--;
1272         else
1273             break;
1274     }
1275     return ret;
1276 }
1277
1278 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1279  PCRYPT_INTEGER_BLOB pInt2)
1280 {
1281     BOOL ret;
1282     DWORD cb1, cb2;
1283
1284     TRACE("(%p, %p)\n", pInt1, pInt2);
1285
1286     cb1 = CRYPT_significantBytes(pInt1);
1287     cb2 = CRYPT_significantBytes(pInt2);
1288     if (cb1 == cb2)
1289     {
1290         if (cb1)
1291             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1292         else
1293             ret = TRUE;
1294     }
1295     else
1296         ret = FALSE;
1297     TRACE("returning %d\n", ret);
1298     return ret;
1299 }
1300
1301 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1302  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1303 {
1304     BOOL ret;
1305
1306     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1307
1308     /* RSA public key data should start with ASN_SEQUENCE,
1309      * otherwise it's not a RSA_CSP_PUBLICKEYBLOB.
1310      */
1311     if (!pPublicKey1->PublicKey.cbData || pPublicKey1->PublicKey.pbData[0] != ASN_SEQUENCE)
1312         dwCertEncodingType = 0;
1313
1314     switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1315     {
1316     case 0:     /* Seems to mean "raw binary bits" */
1317         if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1318          pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1319         {
1320           if (pPublicKey2->PublicKey.cbData)
1321               ret = !memcmp(pPublicKey1->PublicKey.pbData,
1322                pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1323           else
1324               ret = TRUE;
1325         }
1326         else
1327             ret = FALSE;
1328         break;
1329     default:
1330         WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1331         /* FALLTHROUGH */
1332     case X509_ASN_ENCODING:
1333     {
1334         BLOBHEADER *pblob1, *pblob2;
1335         DWORD length;
1336         ret = FALSE;
1337         if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1338                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1339                     CRYPT_DECODE_ALLOC_FLAG, &pblob1, &length))
1340         {
1341             if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1342                         pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1343                         CRYPT_DECODE_ALLOC_FLAG, &pblob2, &length))
1344             {
1345                 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1346                 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1347                           *pk2 = (LPVOID)(pblob2 + 1);
1348                 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1349                          && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1350
1351                 LocalFree(pblob2);
1352             }
1353             LocalFree(pblob1);
1354         }
1355
1356         break;
1357     }
1358     }
1359     return ret;
1360 }
1361
1362 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1363  PCERT_PUBLIC_KEY_INFO pPublicKey)
1364 {
1365     DWORD len = 0;
1366
1367     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1368
1369     if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1370     {
1371         SetLastError(ERROR_FILE_NOT_FOUND);
1372         return 0;
1373     }
1374     if (pPublicKey->Algorithm.pszObjId &&
1375      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1376     {
1377         FIXME("unimplemented for DH public keys\n");
1378         SetLastError(CRYPT_E_ASN1_BADTAG);
1379     }
1380     else
1381     {
1382         PCCRYPT_OID_INFO info;
1383         DWORD size;
1384         PBYTE buf;
1385         BOOL ret;
1386
1387         info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY, pPublicKey->Algorithm.pszObjId, 0);
1388         if (info)
1389         {
1390             HCRYPTKEY key;
1391
1392             TRACE("public key algid %#x (%s)\n", info->u.Algid, debugstr_a(pPublicKey->Algorithm.pszObjId));
1393
1394             ret = CryptImportPublicKeyInfo(I_CryptGetDefaultCryptProv(info->u.Algid), dwCertEncodingType, pPublicKey, &key);
1395             if (ret)
1396             {
1397                 size = sizeof(len);
1398                 ret = CryptGetKeyParam(key, KP_KEYLEN, (BYTE *)&len, &size, 0);
1399                 CryptDestroyKey(key);
1400                 return len;
1401             }
1402             /* fallback to RSA */
1403         }
1404
1405         ret = CryptDecodeObjectEx(dwCertEncodingType,
1406          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1407          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1408          &size);
1409
1410         if (ret)
1411         {
1412             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1413
1414             len = rsaPubKey->bitlen;
1415             LocalFree(buf);
1416         }
1417     }
1418     return len;
1419 }
1420
1421 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1422  DWORD dwFlags, const void *pvPara);
1423
1424 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1425  DWORD dwFlags, const void *pvPara)
1426 {
1427     BOOL ret;
1428     BYTE hash[16];
1429     DWORD size = sizeof(hash);
1430
1431     ret = CertGetCertificateContextProperty(pCertContext,
1432      CERT_MD5_HASH_PROP_ID, hash, &size);
1433     if (ret)
1434     {
1435         const CRYPT_HASH_BLOB *pHash = pvPara;
1436
1437         if (size == pHash->cbData)
1438             ret = !memcmp(pHash->pbData, hash, size);
1439         else
1440             ret = FALSE;
1441     }
1442     return ret;
1443 }
1444
1445 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1446  DWORD dwFlags, const void *pvPara)
1447 {
1448     BOOL ret;
1449     BYTE hash[20];
1450     DWORD size = sizeof(hash);
1451
1452     ret = CertGetCertificateContextProperty(pCertContext,
1453      CERT_SHA1_HASH_PROP_ID, hash, &size);
1454     if (ret)
1455     {
1456         const CRYPT_HASH_BLOB *pHash = pvPara;
1457
1458         if (size == pHash->cbData)
1459             ret = !memcmp(pHash->pbData, hash, size);
1460         else
1461             ret = FALSE;
1462     }
1463     return ret;
1464 }
1465
1466 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1467  DWORD dwFlags, const void *pvPara)
1468 {
1469     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1470     BOOL ret;
1471
1472     if (dwType & CERT_INFO_SUBJECT_FLAG)
1473         toCompare = &pCertContext->pCertInfo->Subject;
1474     else
1475         toCompare = &pCertContext->pCertInfo->Issuer;
1476     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1477      toCompare, blob);
1478     return ret;
1479 }
1480
1481 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1482  DWORD dwType, DWORD dwFlags, const void *pvPara)
1483 {
1484     CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1485     BOOL ret;
1486
1487     ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1488      &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1489     return ret;
1490 }
1491
1492 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1493  DWORD dwType, DWORD dwFlags, const void *pvPara)
1494 {
1495     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1496     BOOL ret;
1497
1498     /* Matching serial number and subject match.. */
1499     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1500      &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1501     if (ret)
1502         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1503          &pCertInfo->SerialNumber);
1504     else
1505     {
1506         /* failing that, if the serial number and issuer match, we match */
1507         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1508          &pCertInfo->SerialNumber);
1509         if (ret)
1510             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1511              &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1512     }
1513     TRACE("returning %d\n", ret);
1514     return ret;
1515 }
1516
1517 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1518  DWORD dwFlags, const void *pvPara)
1519 {
1520     CERT_ID *id = (CERT_ID *)pvPara;
1521     BOOL ret;
1522
1523     switch (id->dwIdChoice)
1524     {
1525     case CERT_ID_ISSUER_SERIAL_NUMBER:
1526         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1527          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1528         if (ret)
1529             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1530              &id->u.IssuerSerialNumber.SerialNumber);
1531         break;
1532     case CERT_ID_SHA1_HASH:
1533         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1534          &id->u.HashId);
1535         break;
1536     case CERT_ID_KEY_IDENTIFIER:
1537     {
1538         DWORD size = 0;
1539
1540         ret = CertGetCertificateContextProperty(pCertContext,
1541          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1542         if (ret && size == id->u.KeyId.cbData)
1543         {
1544             LPBYTE buf = CryptMemAlloc(size);
1545
1546             if (buf)
1547             {
1548                 CertGetCertificateContextProperty(pCertContext,
1549                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1550                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1551                 CryptMemFree(buf);
1552             }
1553             else
1554                 ret = FALSE;
1555         }
1556         else
1557             ret = FALSE;
1558         break;
1559     }
1560     default:
1561         ret = FALSE;
1562         break;
1563     }
1564     return ret;
1565 }
1566
1567 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1568  DWORD dwFlags, const void *pvPara)
1569 {
1570     PCCERT_CONTEXT toCompare = pvPara;
1571     return CertCompareCertificate(pCertContext->dwCertEncodingType,
1572      pCertContext->pCertInfo, toCompare->pCertInfo);
1573 }
1574
1575 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1576  DWORD dwFlags, const void *pvPara)
1577 {
1578     const CRYPT_HASH_BLOB *hash = pvPara;
1579     DWORD size = 0;
1580     BOOL ret;
1581
1582     ret = CertGetCertificateContextProperty(pCertContext,
1583      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1584     if (ret && size == hash->cbData)
1585     {
1586         LPBYTE buf = CryptMemAlloc(size);
1587
1588         if (buf)
1589         {
1590             CertGetCertificateContextProperty(pCertContext,
1591              CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1592             ret = !memcmp(buf, hash->pbData, size);
1593             CryptMemFree(buf);
1594         }
1595         else
1596             ret = FALSE;
1597     }
1598     else
1599         ret = FALSE;
1600     return ret;
1601 }
1602
1603 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1604  PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1605  const void *pvPara)
1606 {
1607     BOOL matches = FALSE;
1608     PCCERT_CONTEXT ret;
1609
1610     ret = prev;
1611     do {
1612         ret = CertEnumCertificatesInStore(store, ret);
1613         if (ret)
1614             matches = compare(ret, dwType, dwFlags, pvPara);
1615     } while (ret != NULL && !matches);
1616     return ret;
1617 }
1618
1619 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1620  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1621
1622 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1623  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1624 {
1625     return CertEnumCertificatesInStore(store, prev);
1626 }
1627
1628 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1629  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1630 {
1631     BOOL ret;
1632     PCCERT_CONTEXT found = NULL, subject = pvPara;
1633     PCERT_EXTENSION ext;
1634     DWORD size;
1635
1636     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1637      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1638     {
1639         CERT_AUTHORITY_KEY_ID_INFO *info;
1640
1641         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1642          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1643          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1644          &info, &size);
1645         if (ret)
1646         {
1647             CERT_ID id;
1648
1649             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1650             {
1651                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1652                 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1653                  sizeof(CERT_NAME_BLOB));
1654                 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1655                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1656             }
1657             else if (info->KeyId.cbData)
1658             {
1659                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1660                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1661             }
1662             else
1663                 ret = FALSE;
1664             if (ret)
1665                 found = cert_compare_certs_in_store(store, prev,
1666                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1667             LocalFree(info);
1668         }
1669     }
1670     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1671      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1672     {
1673         CERT_AUTHORITY_KEY_ID2_INFO *info;
1674
1675         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1676          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1677          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1678          &info, &size);
1679         if (ret)
1680         {
1681             CERT_ID id;
1682
1683             if (info->AuthorityCertIssuer.cAltEntry &&
1684              info->AuthorityCertSerialNumber.cbData)
1685             {
1686                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1687                 DWORD i;
1688
1689                 for (i = 0; !directoryName &&
1690                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1691                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1692                      == CERT_ALT_NAME_DIRECTORY_NAME)
1693                         directoryName =
1694                          &info->AuthorityCertIssuer.rgAltEntry[i];
1695                 if (directoryName)
1696                 {
1697                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1698                     memcpy(&id.u.IssuerSerialNumber.Issuer,
1699                      &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1700                     memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1701                      &info->AuthorityCertSerialNumber,
1702                      sizeof(CRYPT_INTEGER_BLOB));
1703                 }
1704                 else
1705                 {
1706                     FIXME("no supported name type in authority key id2\n");
1707                     ret = FALSE;
1708                 }
1709             }
1710             else if (info->KeyId.cbData)
1711             {
1712                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1713                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1714             }
1715             else
1716                 ret = FALSE;
1717             if (ret)
1718                 found = cert_compare_certs_in_store(store, prev,
1719                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1720             LocalFree(info);
1721         }
1722     }
1723     else
1724        found = cert_compare_certs_in_store(store, prev,
1725         compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1726         dwFlags, &subject->pCertInfo->Issuer);
1727     return found;
1728 }
1729
1730 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1731  DWORD dwType, DWORD dwFlags, const void *pvPara)
1732 {
1733     PCERT_NAME_BLOB name;
1734     DWORD len;
1735     BOOL ret = FALSE;
1736
1737     if (dwType & CERT_INFO_SUBJECT_FLAG)
1738         name = &pCertContext->pCertInfo->Subject;
1739     else
1740         name = &pCertContext->pCertInfo->Issuer;
1741     len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1742      CERT_SIMPLE_NAME_STR, NULL, 0);
1743     if (len)
1744     {
1745         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1746
1747         if (str)
1748         {
1749             CertNameToStrW(pCertContext->dwCertEncodingType, name,
1750              CERT_SIMPLE_NAME_STR, str, len);
1751             wcslwr(str);
1752             if (wcsstr(str, pvPara))
1753                 ret = TRUE;
1754             CryptMemFree(str);
1755         }
1756     }
1757     return ret;
1758 }
1759
1760 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1761  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1762 {
1763     PCCERT_CONTEXT found = NULL;
1764
1765     TRACE("%s\n", debugstr_a(pvPara));
1766
1767     if (pvPara)
1768     {
1769         int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1770         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1771
1772         if (str)
1773         {
1774             MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1775             wcslwr(str);
1776             found = cert_compare_certs_in_store(store, prev,
1777              compare_cert_by_name_str, dwType, dwFlags, str);
1778             CryptMemFree(str);
1779         }
1780     }
1781     else
1782         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1783     return found;
1784 }
1785
1786 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1787  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1788 {
1789     PCCERT_CONTEXT found = NULL;
1790
1791     TRACE("%s\n", debugstr_w(pvPara));
1792
1793     if (pvPara)
1794     {
1795         DWORD len = lstrlenW(pvPara);
1796         LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1797
1798         if (str)
1799         {
1800             wcscpy( str, pvPara );
1801             wcslwr( str );
1802            found = cert_compare_certs_in_store(store, prev,
1803             compare_cert_by_name_str, dwType, dwFlags, str);
1804            CryptMemFree(str);
1805         }
1806     }
1807     else
1808         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1809     return found;
1810 }
1811
1812 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1813  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1814  PCCERT_CONTEXT pPrevCertContext)
1815 {
1816     PCCERT_CONTEXT ret;
1817     CertFindFunc find = NULL;
1818     CertCompareFunc compare = NULL;
1819     CERT_ID cert_id;
1820
1821     TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1822          dwFlags, dwType, pvPara, pPrevCertContext);
1823
1824     switch (dwType >> CERT_COMPARE_SHIFT)
1825     {
1826     case CERT_COMPARE_ANY:
1827         find = find_cert_any;
1828         break;
1829     case CERT_COMPARE_MD5_HASH:
1830         compare = compare_cert_by_md5_hash;
1831         break;
1832     case CERT_COMPARE_SHA1_HASH:
1833         compare = compare_cert_by_sha1_hash;
1834         break;
1835     case CERT_COMPARE_NAME:
1836         compare = compare_cert_by_name;
1837         break;
1838     case CERT_COMPARE_PUBLIC_KEY:
1839         compare = compare_cert_by_public_key;
1840         break;
1841     case CERT_COMPARE_NAME_STR_A:
1842         find = find_cert_by_name_str_a;
1843         break;
1844     case CERT_COMPARE_NAME_STR_W:
1845         find = find_cert_by_name_str_w;
1846         break;
1847     case CERT_COMPARE_SUBJECT_CERT:
1848         compare = compare_cert_by_subject_cert;
1849         break;
1850     case CERT_COMPARE_KEY_IDENTIFIER:
1851         cert_id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1852         cert_id.u.KeyId = *(const CRYPT_HASH_BLOB *)pvPara;
1853         pvPara = &cert_id;
1854         /* fall through */
1855     case CERT_COMPARE_CERT_ID:
1856         compare = compare_cert_by_cert_id;
1857         break;
1858     case CERT_COMPARE_ISSUER_OF:
1859         find = find_cert_by_issuer;
1860         break;
1861     case CERT_COMPARE_EXISTING:
1862         compare = compare_existing_cert;
1863         break;
1864     case CERT_COMPARE_SIGNATURE_HASH:
1865         compare = compare_cert_by_signature_hash;
1866         break;
1867     default:
1868         FIXME("find type %08x unimplemented\n", dwType);
1869     }
1870
1871     if (find)
1872         ret = find(hCertStore, dwType, dwFlags, pvPara, pPrevCertContext);
1873     else if (compare)
1874         ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1875          compare, dwType, dwFlags, pvPara);
1876     else
1877         ret = NULL;
1878     if (!ret)
1879         SetLastError(CRYPT_E_NOT_FOUND);
1880     TRACE("returning %p\n", ret);
1881     return ret;
1882 }
1883
1884 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1885  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1886 {
1887     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1888
1889     if (!pCertId)
1890     {
1891         SetLastError(E_INVALIDARG);
1892         return NULL;
1893     }
1894     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1895      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1896 }
1897
1898 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1899  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1900 {
1901     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1902      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1903
1904     if (*pdwFlags & ~supportedFlags)
1905     {
1906         SetLastError(E_INVALIDARG);
1907         return FALSE;
1908     }
1909     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1910     {
1911         DWORD flags = 0;
1912         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1913          NULL, &flags);
1914
1915         /* FIXME: what if the CRL has expired? */
1916         if (crl)
1917         {
1918             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1919              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1920                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1921         }
1922         else
1923             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1924     }
1925     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1926     {
1927         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1928             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1929     }
1930     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1931     {
1932         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1933          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1934          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1935             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1936     }
1937     return TRUE;
1938 }
1939
1940 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1941  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1942  DWORD *pdwFlags)
1943 {
1944     PCCERT_CONTEXT ret;
1945
1946     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1947      pPrevIssuerContext, *pdwFlags);
1948
1949     if (!pSubjectContext)
1950     {
1951         SetLastError(E_INVALIDARG);
1952         return NULL;
1953     }
1954
1955     ret = CertFindCertificateInStore(hCertStore,
1956      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1957      pSubjectContext, pPrevIssuerContext);
1958     if (ret)
1959     {
1960         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1961          pdwFlags))
1962         {
1963             CertFreeCertificateContext(ret);
1964             ret = NULL;
1965         }
1966         if (CRYPT_IsCertificateSelfSigned(pSubjectContext))
1967         {
1968             CertFreeCertificateContext(ret);
1969             ret = NULL;
1970             SetLastError(CRYPT_E_SELF_SIGNED);
1971         }
1972     }
1973     TRACE("returning %p\n", ret);
1974     return ret;
1975 }
1976
1977 typedef struct _OLD_CERT_REVOCATION_STATUS {
1978     DWORD cbSize;
1979     DWORD dwIndex;
1980     DWORD dwError;
1981     DWORD dwReason;
1982 } OLD_CERT_REVOCATION_STATUS;
1983
1984 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1985  void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1986
1987 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1988  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1989  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1990 {
1991     BOOL ret;
1992
1993     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1994      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1995
1996     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1997      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1998     {
1999         SetLastError(E_INVALIDARG);
2000         return FALSE;
2001     }
2002     if (cContext)
2003     {
2004         static HCRYPTOIDFUNCSET set = NULL;
2005         DWORD size;
2006
2007         if (!set)
2008             set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
2009         ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
2010         if (ret)
2011         {
2012             if (size == 1)
2013             {
2014                 /* empty list */
2015                 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
2016                 ret = FALSE;
2017             }
2018             else
2019             {
2020                 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
2021
2022                 if (dllList)
2023                 {
2024                     ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
2025                      dllList, &size);
2026                     if (ret)
2027                     {
2028                         for (ptr = dllList; ret && *ptr;
2029                          ptr += lstrlenW(ptr) + 1)
2030                         {
2031                             CertVerifyRevocationFunc func;
2032                             HCRYPTOIDFUNCADDR hFunc;
2033
2034                             ret = CryptGetDefaultOIDFunctionAddress(set,
2035                              dwEncodingType, ptr, 0, (void **)&func, &hFunc);
2036                             if (ret)
2037                             {
2038                                 ret = func(dwEncodingType, dwRevType, cContext,
2039                                  rgpvContext, dwFlags, pRevPara, pRevStatus);
2040                                 CryptFreeOIDFunctionAddress(hFunc, 0);
2041                             }
2042                         }
2043                     }
2044                     CryptMemFree(dllList);
2045                 }
2046                 else
2047                 {
2048                     SetLastError(ERROR_OUTOFMEMORY);
2049                     ret = FALSE;
2050                 }
2051             }
2052         }
2053     }
2054     else
2055         ret = TRUE;
2056     return ret;
2057 }
2058
2059 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
2060  CRYPT_ATTRIBUTE rgAttr[])
2061 {
2062     PCRYPT_ATTRIBUTE ret = NULL;
2063     DWORD i;
2064
2065     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
2066
2067     if (!cAttr)
2068         return NULL;
2069     if (!pszObjId)
2070     {
2071         SetLastError(ERROR_INVALID_PARAMETER);
2072         return NULL;
2073     }
2074
2075     for (i = 0; !ret && i < cAttr; i++)
2076         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
2077             ret = &rgAttr[i];
2078     return ret;
2079 }
2080
2081 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
2082  CERT_EXTENSION rgExtensions[])
2083 {
2084     PCERT_EXTENSION ret = NULL;
2085     DWORD i;
2086
2087     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
2088
2089     if (!cExtensions)
2090         return NULL;
2091     if (!pszObjId)
2092     {
2093         SetLastError(ERROR_INVALID_PARAMETER);
2094         return NULL;
2095     }
2096
2097     for (i = 0; !ret && i < cExtensions; i++)
2098         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
2099          rgExtensions[i].pszObjId))
2100             ret = &rgExtensions[i];
2101     return ret;
2102 }
2103
2104 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
2105 {
2106     PCERT_RDN_ATTR ret = NULL;
2107     DWORD i, j;
2108
2109     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
2110
2111     if (!pszObjId)
2112     {
2113         SetLastError(ERROR_INVALID_PARAMETER);
2114         return NULL;
2115     }
2116
2117     for (i = 0; !ret && i < pName->cRDN; i++)
2118         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
2119             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
2120              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
2121                 ret = &pName->rgRDN[i].rgRDNAttr[j];
2122     return ret;
2123 }
2124
2125 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
2126  const CERT_RDN_ATTR *attr)
2127 {
2128     DWORD i, j;
2129     BOOL match = FALSE;
2130
2131     for (i = 0; !match && i < name->cRDN; i++)
2132     {
2133         for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
2134         {
2135             if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
2136              attr->pszObjId) &&
2137              name->rgRDN[i].rgRDNAttr[j].dwValueType ==
2138              attr->dwValueType)
2139             {
2140                 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
2141                 {
2142                     LPCWSTR nameStr =
2143                      (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2144                     LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
2145
2146                     if (attr->Value.cbData !=
2147                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2148                         match = FALSE;
2149                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2150                         match = !wcsnicmp(nameStr, attrStr,
2151                          attr->Value.cbData / sizeof(WCHAR));
2152                     else
2153                         match = !wcsncmp(nameStr, attrStr,
2154                          attr->Value.cbData / sizeof(WCHAR));
2155                     TRACE("%s : %s => %d\n",
2156                      debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
2157                      debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
2158                      match);
2159                 }
2160                 else
2161                 {
2162                     LPCSTR nameStr =
2163                      (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2164                     LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
2165
2166                     if (attr->Value.cbData !=
2167                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2168                         match = FALSE;
2169                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2170                         match = !_strnicmp(nameStr, attrStr,
2171                          attr->Value.cbData);
2172                     else
2173                         match = !strncmp(nameStr, attrStr, attr->Value.cbData);
2174                     TRACE("%s : %s => %d\n",
2175                      debugstr_an(nameStr, attr->Value.cbData),
2176                      debugstr_an(attrStr, attr->Value.cbData), match);
2177                 }
2178             }
2179         }
2180     }
2181     return match;
2182 }
2183
2184 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
2185  DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
2186 {
2187     CERT_NAME_INFO *name;
2188     LPCSTR type;
2189     DWORD size;
2190     BOOL ret;
2191
2192     TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
2193      pRDN);
2194
2195     type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
2196      X509_NAME;
2197     if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
2198      pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
2199     {
2200         DWORD i;
2201
2202         for (i = 0; ret && i < pRDN->cRDNAttr; i++)
2203             ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
2204         if (!ret)
2205             SetLastError(CRYPT_E_NO_MATCH);
2206         LocalFree(name);
2207     }
2208     return ret;
2209 }
2210
2211 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
2212  PCERT_INFO pCertInfo)
2213 {
2214     FILETIME fileTime;
2215     LONG ret;
2216
2217     if (!pTimeToVerify)
2218     {
2219         GetSystemTimeAsFileTime(&fileTime);
2220         pTimeToVerify = &fileTime;
2221     }
2222     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
2223     {
2224         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
2225         if (ret < 0)
2226             ret = 0;
2227     }
2228     return ret;
2229 }
2230
2231 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
2232  PCERT_INFO pIssuerInfo)
2233 {
2234     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
2235
2236     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
2237      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
2238 }
2239
2240 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2241  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2242  DWORD *pcbComputedHash)
2243 {
2244     BOOL ret = TRUE;
2245     HCRYPTHASH hHash = 0;
2246
2247     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
2248      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2249
2250     if (!hCryptProv)
2251         hCryptProv = I_CryptGetDefaultCryptProv(Algid);
2252     if (!Algid)
2253         Algid = CALG_SHA1;
2254     if (ret)
2255     {
2256         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2257         if (ret)
2258         {
2259             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2260             if (ret)
2261                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2262                  pcbComputedHash, 0);
2263             CryptDestroyHash(hHash);
2264         }
2265     }
2266     return ret;
2267 }
2268
2269 BOOL WINAPI CryptHashCertificate2(LPCWSTR pwszCNGHashAlgid, DWORD dwFlags,
2270  void *pvReserved, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2271  DWORD *pcbComputedHash)
2272 {
2273     BCRYPT_HASH_HANDLE hash = NULL;
2274     BCRYPT_ALG_HANDLE alg = NULL;
2275     NTSTATUS status;
2276     DWORD hash_len;
2277     DWORD hash_len_size;
2278
2279     TRACE("(%s, %08x, %p, %p, %d, %p, %p)\n", debugstr_w(pwszCNGHashAlgid),
2280      dwFlags, pvReserved, pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2281
2282     if ((status = BCryptOpenAlgorithmProvider(&alg, pwszCNGHashAlgid, NULL, 0)))
2283     {
2284         if (status == STATUS_NOT_IMPLEMENTED)
2285             status = STATUS_NOT_FOUND;
2286         goto done;
2287     }
2288
2289     if ((status = BCryptCreateHash(alg, &hash, NULL, 0, NULL, 0, 0)))
2290         goto done;
2291
2292     if ((status = BCryptGetProperty(hash, BCRYPT_HASH_LENGTH, (BYTE *)&hash_len, sizeof(hash_len), &hash_len_size, 0)))
2293         goto done;
2294
2295     if (!pbComputedHash)
2296     {
2297         *pcbComputedHash = hash_len;
2298         goto done;
2299     }
2300
2301     if (*pcbComputedHash < hash_len)
2302     {
2303         status = ERROR_MORE_DATA;
2304         goto done;
2305     }
2306
2307     *pcbComputedHash = hash_len;
2308
2309     if ((status = BCryptHashData(hash, (BYTE *)pbEncoded, cbEncoded, 0)))
2310         goto done;
2311
2312     if ((status = BCryptFinishHash(hash, pbComputedHash, hash_len, 0)))
2313         goto done;
2314
2315 done:
2316     if (hash) BCryptDestroyHash(hash);
2317     if (alg)  BCryptCloseAlgorithmProvider(alg, 0);
2318     if (status) SetLastError(status);
2319     return !status;
2320 }
2321
2322 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2323  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2324  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2325 {
2326     BOOL ret = TRUE;
2327     HCRYPTHASH hHash = 0;
2328
2329     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2330      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2331
2332     if (!hCryptProv)
2333         hCryptProv = I_CryptGetDefaultCryptProv(0);
2334     if (!Algid)
2335         Algid = CALG_MD5;
2336     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2337     {
2338         SetLastError(ERROR_FILE_NOT_FOUND);
2339         return FALSE;
2340     }
2341     if (ret)
2342     {
2343         BYTE *buf;
2344         DWORD size = 0;
2345
2346         ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2347          X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2348          (LPBYTE)&buf, &size);
2349         if (ret)
2350         {
2351             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2352             if (ret)
2353             {
2354                 ret = CryptHashData(hHash, buf, size, 0);
2355                 if (ret)
2356                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2357                      pcbComputedHash, 0);
2358                 CryptDestroyHash(hHash);
2359             }
2360             LocalFree(buf);
2361         }
2362     }
2363     return ret;
2364 }
2365
2366 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2367  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2368  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2369 {
2370     BOOL ret;
2371     CERT_SIGNED_CONTENT_INFO *info;
2372     DWORD size;
2373
2374     TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2375      pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2376
2377     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2378      pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2379     if (ret)
2380     {
2381         PCCRYPT_OID_INFO oidInfo;
2382         HCRYPTHASH hHash;
2383
2384         if (!hCryptProv)
2385             hCryptProv = I_CryptGetDefaultCryptProv(0);
2386         oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2387          info->SignatureAlgorithm.pszObjId, 0);
2388         if (!oidInfo)
2389         {
2390             SetLastError(NTE_BAD_ALGID);
2391             ret = FALSE;
2392         }
2393         else
2394         {
2395             ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2396             if (ret)
2397             {
2398                 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2399                  info->ToBeSigned.cbData, 0);
2400                 if (ret)
2401                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2402                      pcbComputedHash, 0);
2403                 CryptDestroyHash(hHash);
2404             }
2405         }
2406         LocalFree(info);
2407     }
2408     return ret;
2409 }
2410
2411 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2412  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2413  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2414  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2415 {
2416     BOOL ret;
2417     PCCRYPT_OID_INFO info;
2418     HCRYPTHASH hHash;
2419
2420     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2421      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2422      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2423
2424     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2425      pSignatureAlgorithm->pszObjId, 0);
2426     if (!info)
2427     {
2428         SetLastError(NTE_BAD_ALGID);
2429         return FALSE;
2430     }
2431     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2432     {
2433         if (!hCryptProv)
2434             hCryptProv = I_CryptGetDefaultCryptProv(0);
2435         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2436         if (ret)
2437         {
2438             ret = CryptHashData(hHash, pbEncodedToBeSigned,
2439              cbEncodedToBeSigned, 0);
2440             if (ret)
2441                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2442                  pcbSignature, 0);
2443             CryptDestroyHash(hHash);
2444         }
2445     }
2446     else
2447     {
2448         if (!hCryptProv)
2449         {
2450             SetLastError(ERROR_INVALID_PARAMETER);
2451             ret = FALSE;
2452         }
2453         else
2454         {
2455             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2456             if (ret)
2457             {
2458                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2459                  cbEncodedToBeSigned, 0);
2460                 if (ret)
2461                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2462                      pcbSignature);
2463                 CryptDestroyHash(hHash);
2464             }
2465         }
2466     }
2467     return ret;
2468 }
2469
2470 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2471  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2472  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2473  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2474 {
2475     BOOL ret;
2476     DWORD encodedSize, hashSize;
2477
2478     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2479      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2480      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2481
2482     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2483      NULL, &encodedSize);
2484     if (ret)
2485     {
2486         PBYTE encoded = CryptMemAlloc(encodedSize);
2487
2488         if (encoded)
2489         {
2490             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2491              pvStructInfo, encoded, &encodedSize);
2492             if (ret)
2493             {
2494                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2495                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2496                  pvHashAuxInfo, NULL, &hashSize);
2497                 if (ret)
2498                 {
2499                     PBYTE hash = CryptMemAlloc(hashSize);
2500
2501                     if (hash)
2502                     {
2503                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2504                          dwCertEncodingType, encoded, encodedSize,
2505                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2506                         if (ret)
2507                         {
2508                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2509
2510                             info.ToBeSigned.cbData = encodedSize;
2511                             info.ToBeSigned.pbData = encoded;
2512                             info.SignatureAlgorithm = *pSignatureAlgorithm;
2513                             info.Signature.cbData = hashSize;
2514                             info.Signature.pbData = hash;
2515                             info.Signature.cUnusedBits = 0;
2516                             ret = CryptEncodeObject(dwCertEncodingType,
2517                              X509_CERT, &info, pbEncoded, pcbEncoded);
2518                         }
2519                         CryptMemFree(hash);
2520                     }
2521                     else
2522                         ret = FALSE;
2523                 }
2524             }
2525             CryptMemFree(encoded);
2526         }
2527         else
2528             ret = FALSE;
2529     }
2530     return ret;
2531 }
2532
2533 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2534  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2535  PCERT_PUBLIC_KEY_INFO pPublicKey)
2536 {
2537     CRYPT_DATA_BLOB blob = { cbEncoded, (BYTE *)pbEncoded };
2538
2539     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2540      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &blob,
2541      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2542 }
2543
2544 static BOOL CRYPT_VerifySignature(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2545     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert, const CRYPT_OID_INFO *info)
2546 {
2547     BOOL ret;
2548     HCRYPTKEY key;
2549     ALG_ID pubKeyID, hashID;
2550
2551     hashID = info->u.Algid;
2552     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2553         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2554     else
2555         pubKeyID = hashID;
2556     /* Load the default provider if necessary */
2557     if (!hCryptProv)
2558         hCryptProv = I_CryptGetDefaultCryptProv(hashID);
2559     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2560      pubKeyInfo, pubKeyID, 0, NULL, &key);
2561     if (ret)
2562     {
2563         HCRYPTHASH hash;
2564
2565         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2566         if (ret)
2567         {
2568             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2569              signedCert->ToBeSigned.cbData, 0);
2570             if (ret)
2571                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2572                  signedCert->Signature.cbData, key, NULL, 0);
2573             CryptDestroyHash(hash);
2574         }
2575         CryptDestroyKey(key);
2576     }
2577     return ret;
2578 }
2579
2580 static BOOL CNG_CalcHash(const WCHAR *algorithm, const CERT_SIGNED_CONTENT_INFO *signedCert,
2581         BYTE **hash_value, DWORD *hash_len)
2582 {
2583     BCRYPT_HASH_HANDLE hash = NULL;
2584     BCRYPT_ALG_HANDLE alg = NULL;
2585     NTSTATUS status;
2586     DWORD size;
2587
2588     if ((status = BCryptOpenAlgorithmProvider(&alg, algorithm, NULL, 0)))
2589         goto done;
2590
2591     if ((status = BCryptCreateHash(alg, &hash, NULL, 0, NULL, 0, 0)))
2592         goto done;
2593
2594     if ((status = BCryptHashData(hash, signedCert->ToBeSigned.pbData, signedCert->ToBeSigned.cbData, 0)))
2595         goto done;
2596
2597     if ((status = BCryptGetProperty(hash, BCRYPT_HASH_LENGTH, (BYTE *)hash_len, sizeof(*hash_len), &size, 0)))
2598         goto done;
2599
2600     if (!(*hash_value = CryptMemAlloc(*hash_len)))
2601     {
2602         status = STATUS_NO_MEMORY;
2603         goto done;
2604     }
2605
2606     if ((status = BCryptFinishHash(hash, *hash_value, *hash_len, 0)))
2607     {
2608         CryptMemFree(*hash_value);
2609         goto done;
2610     }
2611
2612 done:
2613     if (hash) BCryptDestroyHash(hash);
2614     if (alg)  BCryptCloseAlgorithmProvider(alg, 0);
2615     if (status) SetLastError(RtlNtStatusToDosError(status));
2616     return status == 0;
2617 }
2618
2619 static BOOL CNG_ImportECCPubKey(CERT_PUBLIC_KEY_INFO *pubKeyInfo, BCRYPT_KEY_HANDLE *key)
2620 {
2621     DWORD blob_magic, ecckey_len, size;
2622     BCRYPT_ALG_HANDLE alg = NULL;
2623     BCRYPT_ECCKEY_BLOB *ecckey;
2624     const WCHAR *sign_algo;
2625     char **ecc_curve;
2626     NTSTATUS status;
2627
2628     if (!pubKeyInfo->PublicKey.cbData)
2629     {
2630         SetLastError(NTE_BAD_ALGID);
2631         return FALSE;
2632     }
2633
2634     if (pubKeyInfo->PublicKey.pbData[0] != 0x4)
2635     {
2636         FIXME("Compressed ECC curves (%02x) not yet supported\n", pubKeyInfo->PublicKey.pbData[0]);
2637         SetLastError(NTE_BAD_ALGID);
2638         return FALSE;
2639     }
2640
2641     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_OBJECT_IDENTIFIER, pubKeyInfo->Algorithm.Parameters.pbData,
2642             pubKeyInfo->Algorithm.Parameters.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &ecc_curve, &size))
2643         return FALSE;
2644
2645     if (!strcmp(*ecc_curve, szOID_ECC_CURVE_P256))
2646     {
2647         sign_algo = BCRYPT_ECDSA_P256_ALGORITHM;
2648         blob_magic = BCRYPT_ECDSA_PUBLIC_P256_MAGIC;
2649     }
2650     else if (!strcmp(*ecc_curve, szOID_ECC_CURVE_P384))
2651     {
2652         sign_algo = BCRYPT_ECDSA_P384_ALGORITHM;
2653         blob_magic = BCRYPT_ECDSA_PUBLIC_P384_MAGIC;
2654     }
2655     else
2656     {
2657         FIXME("Unsupported ecc curve type: %s\n", *ecc_curve);
2658         sign_algo = NULL;
2659         blob_magic = 0;
2660     }
2661     LocalFree(ecc_curve);
2662
2663     if (!sign_algo)
2664     {
2665         SetLastError(NTE_BAD_ALGID);
2666         return FALSE;
2667     }
2668
2669     if ((status = BCryptOpenAlgorithmProvider(&alg, sign_algo, NULL, 0)))
2670         goto done;
2671
2672     ecckey_len = sizeof(BCRYPT_ECCKEY_BLOB) + pubKeyInfo->PublicKey.cbData - 1;
2673     if (!(ecckey = CryptMemAlloc(ecckey_len)))
2674     {
2675         status = STATUS_NO_MEMORY;
2676         goto done;
2677     }
2678
2679     ecckey->dwMagic = blob_magic;
2680     ecckey->cbKey = (pubKeyInfo->PublicKey.cbData - 1) / 2;
2681     memcpy(ecckey + 1, pubKeyInfo->PublicKey.pbData + 1, pubKeyInfo->PublicKey.cbData - 1);
2682
2683     status = BCryptImportKeyPair(alg, NULL, BCRYPT_ECCPUBLIC_BLOB, key, (BYTE*)ecckey, ecckey_len, 0);
2684     CryptMemFree(ecckey);
2685
2686 done:
2687     if (alg) BCryptCloseAlgorithmProvider(alg, 0);
2688     if (status) SetLastError(RtlNtStatusToDosError(status));
2689     return !status;
2690 }
2691
2692 static BOOL CNG_ImportPubKey(CERT_PUBLIC_KEY_INFO *pubKeyInfo, BCRYPT_KEY_HANDLE *key)
2693 {
2694     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_ECC_PUBLIC_KEY))
2695         return CNG_ImportECCPubKey(pubKeyInfo, key);
2696
2697     FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo->Algorithm.pszObjId));
2698     SetLastError(NTE_BAD_ALGID);
2699     return FALSE;
2700 }
2701
2702 static BOOL CNG_PrepareSignatureECC(BYTE *encoded_sig, DWORD encoded_size, BYTE **sig_value, DWORD *sig_len)
2703 {
2704     CERT_ECC_SIGNATURE *ecc_sig;
2705     DWORD size;
2706     int i;
2707
2708     if (!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ECC_SIGNATURE, encoded_sig, encoded_size,
2709             CRYPT_DECODE_ALLOC_FLAG, NULL, &ecc_sig, &size))
2710         return FALSE;
2711
2712     if (!ecc_sig->r.cbData || !ecc_sig->s.cbData)
2713     {
2714         LocalFree(ecc_sig);
2715         SetLastError(ERROR_INVALID_DATA);
2716         return FALSE;
2717     }
2718
2719     *sig_len = ecc_sig->r.cbData + ecc_sig->s.cbData;
2720     if (!(*sig_value = CryptMemAlloc(*sig_len)))
2721     {
2722         LocalFree(ecc_sig);
2723         SetLastError(ERROR_OUTOFMEMORY);
2724         return FALSE;
2725     }
2726
2727     for (i = 0; i < ecc_sig->r.cbData; i++)
2728         (*sig_value)[i] = ecc_sig->r.pbData[ecc_sig->r.cbData - i - 1];
2729     for (i = 0; i < ecc_sig->s.cbData; i++)
2730         (*sig_value)[ecc_sig->r.cbData + i] = ecc_sig->s.pbData[ecc_sig->s.cbData - i - 1];
2731
2732     LocalFree(ecc_sig);
2733     return TRUE;
2734 }
2735
2736 static BOOL CNG_PrepareSignature(CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert,
2737     BYTE **sig_value, DWORD *sig_len)
2738 {
2739     BYTE *encoded_sig;
2740     BOOL ret = FALSE;
2741     int i;
2742
2743     if (!signedCert->Signature.cbData)
2744     {
2745         SetLastError(ERROR_INVALID_DATA);
2746         return FALSE;
2747     }
2748
2749     if (!(encoded_sig = CryptMemAlloc(signedCert->Signature.cbData)))
2750     {
2751         SetLastError(ERROR_OUTOFMEMORY);
2752         return FALSE;
2753     }
2754
2755     for (i = 0; i < signedCert->Signature.cbData; i++)
2756         encoded_sig[i] = signedCert->Signature.pbData[signedCert->Signature.cbData - i - 1];
2757
2758     if (!strcmp(pubKeyInfo->Algorithm.pszObjId, szOID_ECC_PUBLIC_KEY))
2759         ret = CNG_PrepareSignatureECC(encoded_sig, signedCert->Signature.cbData, sig_value, sig_len);
2760     else
2761     {
2762         FIXME("Unsupported public key type: %s\n", debugstr_a(pubKeyInfo->Algorithm.pszObjId));
2763         SetLastError(NTE_BAD_ALGID);
2764     }
2765
2766     CryptMemFree(encoded_sig);
2767     return ret;
2768 }
2769
2770 static BOOL CNG_VerifySignature(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2771     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert, const CRYPT_OID_INFO *info)
2772 {
2773     BCRYPT_KEY_HANDLE key = NULL;
2774     BYTE *hash_value = NULL, *sig_value;
2775     DWORD hash_len, sig_len;
2776     NTSTATUS status;
2777     BOOL ret;
2778
2779     ret = CNG_ImportPubKey(pubKeyInfo, &key);
2780     if (ret)
2781     {
2782         ret = CNG_CalcHash(info->pwszCNGAlgid, signedCert, &hash_value, &hash_len);
2783         if (ret)
2784         {
2785             ret = CNG_PrepareSignature(pubKeyInfo, signedCert, &sig_value, &sig_len);
2786             if (ret)
2787             {
2788                 status = BCryptVerifySignature(key, NULL, hash_value, hash_len, sig_value, sig_len, 0);
2789                 if (status)
2790                 {
2791                     FIXME("Failed to verify signature: %08x\n", status);
2792                     SetLastError(RtlNtStatusToDosError(status));
2793                     ret = FALSE;
2794                 }
2795                 CryptMemFree(sig_value);
2796             }
2797             CryptMemFree(hash_value);
2798         }
2799         BCryptDestroyKey(key);
2800     }
2801
2802     return ret;
2803 }
2804
2805 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, DWORD dwCertEncodingType,
2806     CERT_PUBLIC_KEY_INFO *pubKeyInfo, const CERT_SIGNED_CONTENT_INFO *signedCert)
2807 {
2808     CCRYPT_OID_INFO *info;
2809
2810     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY, signedCert->SignatureAlgorithm.pszObjId, 0);
2811     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2812     {
2813         SetLastError(NTE_BAD_ALGID);
2814         return FALSE;
2815     }
2816
2817     if (info->u.Algid == CALG_OID_INFO_CNG_ONLY)
2818         return CNG_VerifySignature(hCryptProv, dwCertEncodingType, pubKeyInfo, signedCert, info);
2819     else
2820         return CRYPT_VerifySignature(hCryptProv, dwCertEncodingType, pubKeyInfo, signedCert, info);
2821 }
2822
2823 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2824  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2825  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2826 {
2827     BOOL ret = TRUE;
2828     CRYPT_DATA_BLOB subjectBlob;
2829
2830     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2831      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2832      dwFlags, pvReserved);
2833
2834     switch (dwSubjectType)
2835     {
2836     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2837     {
2838         PCRYPT_DATA_BLOB blob = pvSubject;
2839
2840         subjectBlob.pbData = blob->pbData;
2841         subjectBlob.cbData = blob->cbData;
2842         break;
2843     }
2844     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2845     {
2846         PCERT_CONTEXT context = pvSubject;
2847
2848         subjectBlob.pbData = context->pbCertEncoded;
2849         subjectBlob.cbData = context->cbCertEncoded;
2850         break;
2851     }
2852     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2853     {
2854         PCRL_CONTEXT context = pvSubject;
2855
2856         subjectBlob.pbData = context->pbCrlEncoded;
2857         subjectBlob.cbData = context->cbCrlEncoded;
2858         break;
2859     }
2860     default:
2861         SetLastError(E_INVALIDARG);
2862         ret = FALSE;
2863     }
2864
2865     if (ret)
2866     {
2867         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2868         DWORD size = 0;
2869
2870         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2871          subjectBlob.pbData, subjectBlob.cbData,
2872          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2873          &signedCert, &size);
2874         if (ret)
2875         {
2876             switch (dwIssuerType)
2877             {
2878             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2879                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2880                  dwCertEncodingType, pvIssuer,
2881                  signedCert);
2882                 break;
2883             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2884                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2885                  dwCertEncodingType,
2886                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2887                  signedCert);
2888                 break;
2889             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2890                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2891                 ret = FALSE;
2892                 break;
2893             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2894                 if (pvIssuer)
2895                 {
2896                     SetLastError(E_INVALIDARG);
2897                     ret = FALSE;
2898                 }
2899                 else
2900                 {
2901                     FIXME("unimplemented for NULL signer\n");
2902                     SetLastError(E_INVALIDARG);
2903                     ret = FALSE;
2904                 }
2905                 break;
2906             default:
2907                 SetLastError(E_INVALIDARG);
2908                 ret = FALSE;
2909             }
2910             LocalFree(signedCert);
2911         }
2912     }
2913     return ret;
2914 }
2915
2916 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2917  PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2918 {
2919     PCERT_EXTENSION ext;
2920     BOOL ret = FALSE;
2921
2922     TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2923      cbKeyUsage);
2924
2925     ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2926      pCertInfo->rgExtension);
2927     if (ext)
2928     {
2929         CRYPT_BIT_BLOB usage;
2930         DWORD size = sizeof(usage);
2931
2932         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2933          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2934          &usage, &size);
2935         if (ret)
2936         {
2937             if (cbKeyUsage < usage.cbData)
2938                 ret = FALSE;
2939             else
2940             {
2941                 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2942                 if (cbKeyUsage > usage.cbData)
2943                     memset(pbKeyUsage + usage.cbData, 0,
2944                      cbKeyUsage - usage.cbData);
2945             }
2946         }
2947     }
2948     else
2949         SetLastError(0);
2950     return ret;
2951 }
2952
2953 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2954  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2955 {
2956     PCERT_ENHKEY_USAGE usage = NULL;
2957     DWORD bytesNeeded;
2958     BOOL ret = TRUE;
2959
2960     if (!pCertContext || !pcbUsage)
2961     {
2962         SetLastError(ERROR_INVALID_PARAMETER);
2963         return FALSE;
2964     }
2965
2966     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2967
2968     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2969     {
2970         DWORD propSize = 0;
2971
2972         if (CertGetCertificateContextProperty(pCertContext,
2973          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2974         {
2975             LPBYTE buf = CryptMemAlloc(propSize);
2976
2977             if (buf)
2978             {
2979                 if (CertGetCertificateContextProperty(pCertContext,
2980                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2981                 {
2982                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2983                      X509_ENHANCED_KEY_USAGE, buf, propSize,
2984                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2985                 }
2986                 CryptMemFree(buf);
2987             }
2988         }
2989     }
2990     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2991     {
2992         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2993          pCertContext->pCertInfo->cExtension,
2994          pCertContext->pCertInfo->rgExtension);
2995
2996         if (ext)
2997         {
2998             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2999              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
3000              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
3001         }
3002     }
3003     if (!usage)
3004     {
3005         /* If a particular location is specified, this should fail.  Otherwise
3006          * it should succeed with an empty usage.  (This is true on Win2k and
3007          * later, which we emulate.)
3008          */
3009         if (dwFlags)
3010         {
3011             SetLastError(CRYPT_E_NOT_FOUND);
3012             ret = FALSE;
3013         }
3014         else
3015             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
3016     }
3017
3018     if (ret)
3019     {
3020         if (!pUsage)
3021             *pcbUsage = bytesNeeded;
3022         else if (*pcbUsage < bytesNeeded)
3023         {
3024             SetLastError(ERROR_MORE_DATA);
3025             *pcbUsage = bytesNeeded;
3026             ret = FALSE;
3027         }
3028         else
3029         {
3030             *pcbUsage = bytesNeeded;
3031             if (usage)
3032             {
3033                 DWORD i;
3034                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
3035                  sizeof(CERT_ENHKEY_USAGE) +
3036                  usage->cUsageIdentifier * sizeof(LPSTR));
3037
3038                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
3039                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
3040                  sizeof(CERT_ENHKEY_USAGE));
3041                 for (i = 0; i < usage->cUsageIdentifier; i++)
3042                 {
3043                     pUsage->rgpszUsageIdentifier[i] = nextOID;
3044                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
3045                     nextOID += strlen(nextOID) + 1;
3046                 }
3047             }
3048             else
3049                 pUsage->cUsageIdentifier = 0;
3050         }
3051     }
3052     if (usage)
3053         LocalFree(usage);
3054     TRACE("returning %d\n", ret);
3055     return ret;
3056 }
3057
3058 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
3059  PCERT_ENHKEY_USAGE pUsage)
3060 {
3061     BOOL ret;
3062
3063     TRACE("(%p, %p)\n", pCertContext, pUsage);
3064
3065     if (pUsage)
3066     {
3067         CRYPT_DATA_BLOB blob = { 0, NULL };
3068
3069         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
3070          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
3071         if (ret)
3072         {
3073             ret = CertSetCertificateContextProperty(pCertContext,
3074              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
3075             LocalFree(blob.pbData);
3076         }
3077     }
3078     else
3079         ret = CertSetCertificateContextProperty(pCertContext,
3080          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
3081     return ret;
3082 }
3083
3084 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
3085  LPCSTR pszUsageIdentifier)
3086 {
3087     BOOL ret;
3088     DWORD size;
3089
3090     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
3091
3092     if (CertGetEnhancedKeyUsage(pCertContext,
3093      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
3094     {
3095         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
3096
3097         if (usage)
3098         {
3099             ret = CertGetEnhancedKeyUsage(pCertContext,
3100              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
3101             if (ret)
3102             {
3103                 DWORD i;
3104                 BOOL exists = FALSE;
3105
3106                 /* Make sure usage doesn't already exist */
3107                 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
3108                 {
3109                     if (!strcmp(usage->rgpszUsageIdentifier[i],
3110                      pszUsageIdentifier))
3111                         exists = TRUE;
3112                 }
3113                 if (!exists)
3114                 {
3115                     PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
3116                      sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
3117
3118                     if (newUsage)
3119                     {
3120                         LPSTR nextOID;
3121
3122                         newUsage->rgpszUsageIdentifier = (LPSTR *)
3123                          ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
3124                         nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
3125                           + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
3126                         for (i = 0; i < usage->cUsageIdentifier; i++)
3127                         {
3128                             newUsage->rgpszUsageIdentifier[i] = nextOID;
3129                             strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
3130                             nextOID += strlen(nextOID) + 1;
3131                         }
3132                         newUsage->rgpszUsageIdentifier[i] = nextOID;
3133                         strcpy(nextOID, pszUsageIdentifier);
3134                         newUsage->cUsageIdentifier = i + 1;
3135                         ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
3136                         CryptMemFree(newUsage);
3137                     }
3138                     else
3139                         ret = FALSE;
3140                 }
3141             }
3142             CryptMemFree(usage);
3143         }
3144         else
3145             ret = FALSE;
3146     }
3147     else
3148     {
3149         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
3150          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
3151
3152         if (usage)
3153         {
3154             usage->rgpszUsageIdentifier =
3155              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
3156             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
3157              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
3158             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
3159             usage->cUsageIdentifier = 1;
3160             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
3161             CryptMemFree(usage);
3162         }
3163         else
3164             ret = FALSE;
3165     }
3166     return ret;
3167 }
3168
3169 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
3170  LPCSTR pszUsageIdentifier)
3171 {
3172     BOOL ret;
3173     DWORD size;
3174     CERT_ENHKEY_USAGE usage;
3175
3176     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
3177
3178     size = sizeof(usage);
3179     ret = CertGetEnhancedKeyUsage(pCertContext,
3180      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
3181     if (!ret && GetLastError() == ERROR_MORE_DATA)
3182     {
3183         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
3184
3185         if (pUsage)
3186         {
3187             ret = CertGetEnhancedKeyUsage(pCertContext,
3188              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
3189             if (ret)
3190             {
3191                 if (pUsage->cUsageIdentifier)
3192                 {
3193                     DWORD i;
3194                     BOOL found = FALSE;
3195
3196                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
3197                     {
3198                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
3199                          pszUsageIdentifier))
3200                             found = TRUE;
3201                         if (found && i < pUsage->cUsageIdentifier - 1)
3202                             pUsage->rgpszUsageIdentifier[i] =
3203                              pUsage->rgpszUsageIdentifier[i + 1];
3204                     }
3205                     pUsage->cUsageIdentifier--;
3206                     /* Remove the usage if it's empty */
3207                     if (pUsage->cUsageIdentifier)
3208                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
3209                     else
3210                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
3211                 }
3212             }
3213             CryptMemFree(pUsage);
3214         }
3215         else
3216             ret = FALSE;
3217     }
3218     else
3219     {
3220         /* it fit in an empty usage, therefore there's nothing to remove */
3221         ret = TRUE;
3222     }
3223     return ret;
3224 }
3225
3226 struct BitField
3227 {
3228     DWORD  cIndexes;
3229     DWORD *indexes;
3230 };
3231
3232 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
3233
3234 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
3235 {
3236     DWORD indexIndex = bit / BITS_PER_DWORD;
3237
3238     if (indexIndex + 1 > field->cIndexes)
3239     {
3240         if (field->cIndexes)
3241             field->indexes = CryptMemRealloc(field->indexes,
3242              (indexIndex + 1) * sizeof(DWORD));
3243         else
3244             field->indexes = CryptMemAlloc(sizeof(DWORD));
3245         if (field->indexes)
3246         {
3247             field->indexes[indexIndex] = 0;
3248             field->cIndexes = indexIndex + 1;
3249         }
3250     }
3251     if (field->indexes)
3252         field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
3253 }
3254
3255 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
3256 {
3257     BOOL set;
3258     DWORD indexIndex = bit / BITS_PER_DWORD;
3259
3260     assert(field->cIndexes);
3261     set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
3262     return set;
3263 }
3264
3265 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
3266  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
3267 {
3268     BOOL ret = TRUE;
3269     DWORD i, cbOIDs = 0;
3270     BOOL allUsagesValid = TRUE;
3271     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
3272
3273     TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
3274      rghOIDs, *pcbOIDs);
3275
3276     for (i = 0; i < cCerts; i++)
3277     {
3278         CERT_ENHKEY_USAGE usage;
3279         DWORD size = sizeof(usage);
3280
3281         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
3282         /* Success is deliberately ignored: it implies all usages are valid */
3283         if (!ret && GetLastError() == ERROR_MORE_DATA)
3284         {
3285             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
3286
3287             allUsagesValid = FALSE;
3288             if (pUsage)
3289             {
3290                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
3291                 if (ret)
3292                 {
3293                     if (!validUsages.cUsageIdentifier)
3294                     {
3295                         DWORD j;
3296
3297                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
3298                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
3299                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
3300                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
3301                              + 1;
3302                         validUsages.rgpszUsageIdentifier =
3303                          CryptMemAlloc(cbOIDs);
3304                         if (validUsages.rgpszUsageIdentifier)
3305                         {
3306                             LPSTR nextOID = (LPSTR)
3307                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
3308                              validUsages.cUsageIdentifier * sizeof(LPSTR));
3309
3310                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
3311                             {
3312                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
3313                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
3314                                  pUsage->rgpszUsageIdentifier[j]);
3315                                 nextOID += lstrlenA(nextOID) + 1;
3316                             }
3317                         }
3318                     }
3319                     else
3320                     {
3321                         struct BitField validIndexes = { 0, NULL };
3322                         DWORD j, k, numRemoved = 0;
3323
3324                         /* Merge: build a bitmap of all the indexes of
3325                          * validUsages.rgpszUsageIdentifier that are in pUsage.
3326                          */
3327                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
3328                         {
3329                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
3330                             {
3331                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
3332                                  validUsages.rgpszUsageIdentifier[k]))
3333                                 {
3334                                     CRYPT_SetBitInField(&validIndexes, k);
3335                                     break;
3336                                 }
3337                             }
3338                         }
3339                         /* Merge by removing from validUsages those that are
3340                          * not in the bitmap.
3341                          */
3342                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
3343                         {
3344                             if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
3345                             {
3346                                 if (j < validUsages.cUsageIdentifier - 1)
3347                                 {
3348                                     memmove(&validUsages.rgpszUsageIdentifier[j],
3349                                      &validUsages.rgpszUsageIdentifier[j +
3350                                      numRemoved + 1],
3351                                      (validUsages.cUsageIdentifier - numRemoved
3352                                      - j - 1) * sizeof(LPSTR));
3353                                     cbOIDs -= lstrlenA(
3354                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
3355                                      sizeof(LPSTR);
3356                                     validUsages.cUsageIdentifier--;
3357                                     numRemoved++;
3358                                 }
3359                                 else
3360                                     validUsages.cUsageIdentifier--;
3361                             }
3362                         }
3363                         CryptMemFree(validIndexes.indexes);
3364                     }
3365                 }
3366                 CryptMemFree(pUsage);
3367             }
3368         }
3369     }
3370     ret = TRUE;
3371     if (allUsagesValid)
3372     {
3373         *cNumOIDs = -1;
3374         *pcbOIDs = 0;
3375     }
3376     else
3377     {
3378         *cNumOIDs = validUsages.cUsageIdentifier;
3379         if (!rghOIDs)
3380             *pcbOIDs = cbOIDs;
3381         else if (*pcbOIDs < cbOIDs)
3382         {
3383             *pcbOIDs = cbOIDs;
3384             SetLastError(ERROR_MORE_DATA);
3385             ret = FALSE;
3386         }
3387         else
3388         {
3389             LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
3390              validUsages.cUsageIdentifier * sizeof(LPSTR));
3391
3392             *pcbOIDs = cbOIDs;
3393             for (i = 0; i < validUsages.cUsageIdentifier; i++)
3394             {
3395                 rghOIDs[i] = nextOID;
3396                 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
3397                 nextOID += lstrlenA(nextOID) + 1;
3398             }
3399         }
3400     }
3401     CryptMemFree(validUsages.rgpszUsageIdentifier);
3402     TRACE("cNumOIDs: %d\n", *cNumOIDs);
3403     TRACE("returning %d\n", ret);
3404     return ret;
3405 }
3406
3407 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
3408  * pInfo is NULL, from the attributes of hProv.
3409  */
3410 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
3411  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
3412 {
3413     CRYPT_KEY_PROV_INFO info = { 0 };
3414     BOOL ret;
3415
3416     if (!pInfo)
3417     {
3418         DWORD size;
3419         int len;
3420
3421         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
3422         if (ret)
3423         {
3424             LPSTR szContainer = CryptMemAlloc(size);
3425
3426             if (szContainer)
3427             {
3428                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
3429                  (BYTE *)szContainer, &size, 0);
3430                 if (ret)
3431                 {
3432                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3433                      NULL, 0);
3434                     if (len)
3435                     {
3436                         info.pwszContainerName = CryptMemAlloc(len *
3437                          sizeof(WCHAR));
3438                         MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3439                          info.pwszContainerName, len);
3440                     }
3441                 }
3442                 CryptMemFree(szContainer);
3443             }
3444         }
3445         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
3446         if (ret)
3447         {
3448             LPSTR szProvider = CryptMemAlloc(size);
3449
3450             if (szProvider)
3451             {
3452                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
3453                  &size, 0);
3454                 if (ret)
3455                 {
3456                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3457                      NULL, 0);
3458                     if (len)
3459                     {
3460                         info.pwszProvName = CryptMemAlloc(len *
3461                          sizeof(WCHAR));
3462                         MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3463                          info.pwszProvName, len);
3464                     }
3465                 }
3466                 CryptMemFree(szProvider);
3467             }
3468         }
3469         /* in case no CRYPT_KEY_PROV_INFO given,
3470          *  we always use AT_SIGNATURE key spec
3471          */
3472         info.dwKeySpec = AT_SIGNATURE;
3473         size = sizeof(info.dwProvType);
3474         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
3475          &size, 0);
3476         if (!ret)
3477             info.dwProvType = PROV_RSA_FULL;
3478         pInfo = &info;
3479     }
3480
3481     CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
3482      0, pInfo);
3483
3484     if (pInfo == &info)
3485     {
3486         CryptMemFree(info.pwszContainerName);
3487         CryptMemFree(info.pwszProvName);
3488     }
3489 }
3490
3491 /* Creates a signed certificate context from the unsigned, encoded certificate
3492  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
3493  */
3494 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
3495  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
3496 {
3497     PCCERT_CONTEXT context = NULL;
3498     BOOL ret;
3499     DWORD sigSize = 0;
3500
3501     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3502      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
3503     if (ret)
3504     {
3505         LPBYTE sig = CryptMemAlloc(sigSize);
3506
3507         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3508          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
3509         if (ret)
3510         {
3511             CERT_SIGNED_CONTENT_INFO signedInfo;
3512             BYTE *encodedSignedCert = NULL;
3513             DWORD encodedSignedCertSize = 0;
3514
3515             signedInfo.ToBeSigned.cbData = blob->cbData;
3516             signedInfo.ToBeSigned.pbData = blob->pbData;
3517             signedInfo.SignatureAlgorithm = *sigAlgo;
3518             signedInfo.Signature.cbData = sigSize;
3519             signedInfo.Signature.pbData = sig;
3520             signedInfo.Signature.cUnusedBits = 0;
3521             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
3522              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
3523              &encodedSignedCert, &encodedSignedCertSize);
3524             if (ret)
3525             {
3526                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3527                  encodedSignedCert, encodedSignedCertSize);
3528                 LocalFree(encodedSignedCert);
3529             }
3530         }
3531         CryptMemFree(sig);
3532     }
3533     return context;
3534 }
3535
3536 /* Copies data from the parameters into info, where:
3537  * pSerialNumber: The serial number.  Must not be NULL.
3538  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3539  *                     Must not be NULL
3540  * pSignatureAlgorithm: Optional.
3541  * pStartTime: The starting time of the certificate.  If NULL, the current
3542  *             system time is used.
3543  * pEndTime: The ending time of the certificate.  If NULL, one year past the
3544  *           starting time is used.
3545  * pubKey: The public key of the certificate.  Must not be NULL.
3546  * pExtensions: Extensions to be included with the certificate.  Optional.
3547  */
3548 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3549  const CERT_NAME_BLOB *pSubjectIssuerBlob,
3550  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3551  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3552  const CERT_EXTENSIONS *pExtensions)
3553 {
3554     static CHAR oid[] = szOID_RSA_SHA1RSA;
3555
3556     assert(info);
3557     assert(pSerialNumber);
3558     assert(pSubjectIssuerBlob);
3559     assert(pubKey);
3560
3561     if (pExtensions && pExtensions->cExtension)
3562         info->dwVersion = CERT_V3;
3563     else
3564         info->dwVersion = CERT_V1;
3565     info->SerialNumber.cbData = pSerialNumber->cbData;
3566     info->SerialNumber.pbData = pSerialNumber->pbData;
3567     if (pSignatureAlgorithm)
3568         info->SignatureAlgorithm = *pSignatureAlgorithm;
3569     else
3570     {
3571         info->SignatureAlgorithm.pszObjId = oid;
3572         info->SignatureAlgorithm.Parameters.cbData = 0;
3573         info->SignatureAlgorithm.Parameters.pbData = NULL;
3574     }
3575     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3576     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3577     if (pStartTime)
3578         SystemTimeToFileTime(pStartTime, &info->NotBefore);
3579     else
3580         GetSystemTimeAsFileTime(&info->NotBefore);
3581     if (pEndTime)
3582         SystemTimeToFileTime(pEndTime, &info->NotAfter);
3583     else
3584     {
3585         SYSTEMTIME endTime;
3586
3587         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3588         {
3589             endTime.wYear++;
3590             SystemTimeToFileTime(&endTime, &info->NotAfter);
3591         }
3592     }
3593     info->Subject.cbData = pSubjectIssuerBlob->cbData;
3594     info->Subject.pbData = pSubjectIssuerBlob->pbData;
3595     info->SubjectPublicKeyInfo = *pubKey;
3596     if (pExtensions)
3597     {
3598         info->cExtension = pExtensions->cExtension;
3599         info->rgExtension = pExtensions->rgExtension;
3600     }
3601     else
3602     {
3603         info->cExtension = 0;
3604         info->rgExtension = NULL;
3605     }
3606 }
3607
3608 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3609 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3610 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3611
3612 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3613 {
3614     HCRYPTPROV hProv = 0;
3615     HMODULE rpcrt = LoadLibraryW(L"rpcrt4");
3616
3617     if (rpcrt)
3618     {
3619         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3620          "UuidCreate");
3621         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3622          "UuidToStringA");
3623         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3624          rpcrt, "RpcStringFreeA");
3625
3626         if (uuidCreate && uuidToString && rpcStringFree)
3627         {
3628             UUID uuid;
3629             RPC_STATUS status = uuidCreate(&uuid);
3630
3631             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3632             {
3633                 unsigned char *uuidStr;
3634
3635                 status = uuidToString(&uuid, &uuidStr);
3636                 if (status == RPC_S_OK)
3637                 {
3638                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3639                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3640
3641                     if (ret)
3642                     {
3643                         HCRYPTKEY key;
3644
3645                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3646                         if (ret)
3647                             CryptDestroyKey(key);
3648                     }
3649                     rpcStringFree(&uuidStr);
3650                 }
3651             }
3652         }
3653         FreeLibrary(rpcrt);
3654     }
3655     return hProv;
3656 }
3657
3658 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3659  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3660  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3661  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3662  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3663 {
3664     PCCERT_CONTEXT context = NULL;
3665     BOOL ret, releaseContext = FALSE;
3666     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3667     DWORD pubKeySize = 0, dwKeySpec;
3668
3669     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3670      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3671      pExtensions, pExtensions);
3672
3673     if(!pSubjectIssuerBlob)
3674     {
3675         SetLastError(ERROR_INVALID_PARAMETER);
3676         return NULL;
3677     }
3678
3679     dwKeySpec = pKeyProvInfo ? pKeyProvInfo->dwKeySpec : AT_SIGNATURE;
3680     if (!hProv)
3681     {
3682         if (!pKeyProvInfo)
3683         {
3684             hProv = CRYPT_CreateKeyProv();
3685             releaseContext = TRUE;
3686         }
3687         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3688         {
3689             SetLastError(NTE_BAD_FLAGS);
3690             return NULL;
3691         }
3692         else
3693         {
3694             HCRYPTKEY hKey = 0;
3695             /* acquire the context using the given information*/
3696             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3697                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3698                     pKeyProvInfo->dwFlags);
3699             if (!ret)
3700             {
3701                 if(GetLastError() != NTE_BAD_KEYSET)
3702                     return NULL;
3703                 /* create the key set */
3704                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3705                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3706                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3707                 if (!ret)
3708                     return NULL;
3709             }
3710             /* check if the key is here */
3711             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3712             if(!ret)
3713             {
3714                 if (NTE_NO_KEY == GetLastError())
3715                 { /* generate the key */
3716                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3717                 }
3718                 if (!ret)
3719                 {
3720                     CryptReleaseContext(hProv,0);
3721                     SetLastError(NTE_BAD_KEYSET);
3722                     return NULL;
3723                 }
3724             }
3725             CryptDestroyKey(hKey);
3726             releaseContext = TRUE;
3727         }
3728     }
3729
3730     ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3731      &pubKeySize);
3732     if (!ret)
3733         goto end;
3734     pubKey = CryptMemAlloc(pubKeySize);
3735     if (pubKey)
3736     {
3737         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3738          pubKey, &pubKeySize);
3739         if (ret)
3740         {
3741             CERT_INFO info = { 0 };
3742             CRYPT_DER_BLOB blob = { 0, NULL };
3743             BYTE serial[16];
3744             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3745
3746             CryptGenRandom(hProv, sizeof(serial), serial);
3747             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3748              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3749             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3750              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3751              &blob.cbData);
3752             if (ret)
3753             {
3754                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3755                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3756                      &info.SignatureAlgorithm);
3757                 else
3758                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
3759                      blob.pbData, blob.cbData);
3760                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3761                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3762                 LocalFree(blob.pbData);
3763             }
3764         }
3765         CryptMemFree(pubKey);
3766     }
3767 end:
3768     if (releaseContext)
3769         CryptReleaseContext(hProv, 0);
3770     return context;
3771 }
3772
3773 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3774                                void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3775                                PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3776                                PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3777 {
3778     FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3779           dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3780           pVerifyUsageStatus);
3781     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3782     return FALSE;
3783 }
3784
3785 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3786                                       const BYTE *pbEncoded, DWORD cbEncoded,
3787                                       DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3788 {
3789     TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3790           pbEncoded, cbEncoded, dwFlags, pCreatePara);
3791
3792     if (dwFlags)
3793     {
3794         FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3795         return NULL;
3796     }
3797     if (pCreatePara)
3798     {
3799         FIXME("pCreatePara not handled\n");
3800         return NULL;
3801     }
3802
3803     switch (dwContextType)
3804     {
3805     case CERT_STORE_CERTIFICATE_CONTEXT:
3806         return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3807     case CERT_STORE_CRL_CONTEXT:
3808         return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3809     case CERT_STORE_CTL_CONTEXT:
3810         return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3811     default:
3812         WARN("unknown context type: 0x%x\n", dwContextType);
3813         return NULL;
3814     }
3815 }
3816
3817 BOOL WINAPI CryptSetKeyIdentifierProperty(const CRYPT_HASH_BLOB *pKeyIdentifier, DWORD dwPropId,
3818     DWORD dwFlags, LPCWSTR pwszComputerName, void *pvReserved, const void *pvData)
3819 {
3820     FIXME("(%p, 0x%x, 0x%x, %s, %p, %p): stub\n", pKeyIdentifier, dwPropId, dwFlags,
3821         debugstr_w(pwszComputerName), pvReserved, pvData);
3822     return FALSE;
3823 }