?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
push 5b66f3b36e7323272378316c923222b908f6e2d3
[wine/hacks.git] / dlls / crypt32 / cert.c
blob2ab147a6992939aa90feeee42cad8d862504f8c6
1 /*
2 * Copyright 2004-2006 Juan Lang
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17 *
18 */
19
20 #include <assert.h>
21 #include <stdarg.h>
22
23 #define NONAMELESSUNION
24 #include "windef.h"
25 #include "winbase.h"
26 #include "wincrypt.h"
27 #include "winnls.h"
28 #include "rpc.h"
29 #include "wine/debug.h"
30 #include "crypt32_private.h"
31
32 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
33
34 /* Internal version of CertGetCertificateContextProperty that gets properties
35 * directly from the context (or the context it's linked to, depending on its
36 * type.) Doesn't handle special-case properties, since they are handled by
37 * CertGetCertificateContextProperty, and are particular to the store in which
38 * the property exists (which is separate from the context.)
39 */
40 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
41 void *pvData, DWORD *pcbData);
42
43 /* Internal version of CertSetCertificateContextProperty that sets properties
44 * directly on the context (or the context it's linked to, depending on its
45 * type.) Doesn't handle special cases, since they're handled by
46 * CertSetCertificateContextProperty anyway.
47 */
48 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
49 DWORD dwFlags, const void *pvData);
50
51 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
52 DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
53 DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
54 {
55 PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
56 pbCertEncoded, cbCertEncoded);
57 BOOL ret;
58
59 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
60 pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
61
62 if (cert)
63 {
64 ret = CertAddCertificateContextToStore(hCertStore, cert,
65 dwAddDisposition, ppCertContext);
66 CertFreeCertificateContext(cert);
67 }
68 else
69 ret = FALSE;
70 return ret;
71 }
72
73 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
74 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
75 {
76 PCERT_CONTEXT cert = NULL;
77 BOOL ret;
78 PCERT_INFO certInfo = NULL;
79 DWORD size = 0;
80
81 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
82 cbCertEncoded);
83
84 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
85 pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
86 (BYTE *)&certInfo, &size);
87 if (ret)
88 {
89 BYTE *data = NULL;
90
91 cert = (PCERT_CONTEXT)Context_CreateDataContext(sizeof(CERT_CONTEXT));
92 if (!cert)
93 goto end;
94 data = CryptMemAlloc(cbCertEncoded);
95 if (!data)
96 {
97 CryptMemFree(cert);
98 cert = NULL;
99 goto end;
100 }
101 memcpy(data, pbCertEncoded, cbCertEncoded);
102 cert->dwCertEncodingType = dwCertEncodingType;
103 cert->pbCertEncoded = data;
104 cert->cbCertEncoded = cbCertEncoded;
105 cert->pCertInfo = certInfo;
106 cert->hCertStore = 0;
107 }
108
109 end:
110 return (PCCERT_CONTEXT)cert;
111 }
112
113 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
114 PCCERT_CONTEXT pCertContext)
115 {
116 TRACE("(%p)\n", pCertContext);
117 Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
118 return pCertContext;
119 }
120
121 static void CertDataContext_Free(void *context)
122 {
123 PCERT_CONTEXT certContext = (PCERT_CONTEXT)context;
124
125 CryptMemFree(certContext->pbCertEncoded);
126 LocalFree(certContext->pCertInfo);
127 }
128
129 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
130 {
131 TRACE("(%p)\n", pCertContext);
132
133 if (pCertContext)
134 Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
135 CertDataContext_Free);
136 return TRUE;
137 }
138
139 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
140 DWORD dwPropId)
141 {
142 PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
143 (void *)pCertContext, sizeof(CERT_CONTEXT));
144 DWORD ret;
145
146 TRACE("(%p, %d)\n", pCertContext, dwPropId);
147
148 if (properties)
149 ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
150 else
151 ret = 0;
152 return ret;
153 }
154
155 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
156 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
157 DWORD *pcbData)
158 {
159 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
160 pcbData);
161 if (ret && pvData)
162 {
163 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
164
165 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
166 }
167 return ret;
168 }
169
170 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
171 DWORD cb)
172 {
173 BOOL ret = TRUE;
174
175 if (!pvData)
176 *pcbData = cb;
177 else if (*pcbData < cb)
178 {
179 SetLastError(ERROR_MORE_DATA);
180 *pcbData = cb;
181 ret = FALSE;
182 }
183 else
184 {
185 memcpy(pvData, pb, cb);
186 *pcbData = cb;
187 }
188 return ret;
189 }
190
191 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
192 void *pvData, DWORD *pcbData)
193 {
194 PCCERT_CONTEXT pCertContext = (PCCERT_CONTEXT)context;
195 PCONTEXT_PROPERTY_LIST properties =
196 Context_GetProperties(context, sizeof(CERT_CONTEXT));
197 BOOL ret;
198 CRYPT_DATA_BLOB blob;
199
200 TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
201
202 if (properties)
203 ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
204 else
205 ret = FALSE;
206 if (ret)
207 ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
208 else
209 {
210 /* Implicit properties */
211 switch (dwPropId)
212 {
213 case CERT_SHA1_HASH_PROP_ID:
214 ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
215 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
216 pcbData);
217 break;
218 case CERT_MD5_HASH_PROP_ID:
219 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
220 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
221 pcbData);
222 break;
223 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
224 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
225 pCertContext->pCertInfo->Subject.pbData,
226 pCertContext->pCertInfo->Subject.cbData,
227 pvData, pcbData);
228 break;
229 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
230 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
231 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
232 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
233 pvData, pcbData);
234 break;
235 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
236 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
237 pCertContext->pCertInfo->SerialNumber.pbData,
238 pCertContext->pCertInfo->SerialNumber.cbData,
239 pvData, pcbData);
240 break;
241 case CERT_SIGNATURE_HASH_PROP_ID:
242 FIXME("CERT_SIGNATURE_HASH_PROP_ID unimplemented\n");
243 SetLastError(CRYPT_E_NOT_FOUND);
244 break;
245 case CERT_KEY_IDENTIFIER_PROP_ID:
246 {
247 PCERT_EXTENSION ext = CertFindExtension(
248 szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
249 pCertContext->pCertInfo->rgExtension);
250
251 if (ext)
252 {
253 CRYPT_DATA_BLOB value;
254 DWORD size = sizeof(value);
255
256 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
257 szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
258 ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
259 &size);
260 if (ret)
261 {
262 ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
263 value.cbData);
264 CertContext_SetProperty(context, dwPropId, 0, &value);
265 }
266 }
267 else
268 SetLastError(ERROR_INVALID_DATA);
269 break;
270 }
271 default:
272 SetLastError(CRYPT_E_NOT_FOUND);
273 }
274 }
275 TRACE("returning %d\n", ret);
276 return ret;
277 }
278
279 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
280 {
281 DWORD i, containerLen, provNameLen;
282 LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
283
284 info->pwszContainerName = (LPWSTR)data;
285 containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
286 data += containerLen;
287
288 info->pwszProvName = (LPWSTR)data;
289 provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
290 data += provNameLen;
291
292 info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
293 data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
294
295 for (i = 0; i < info->cProvParam; i++)
296 {
297 info->rgProvParam[i].pbData = data;
298 data += info->rgProvParam[i].cbData;
299 }
300 }
301
302 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
303 DWORD dwPropId, void *pvData, DWORD *pcbData)
304 {
305 BOOL ret;
306
307 TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
308
309 switch (dwPropId)
310 {
311 case 0:
312 case CERT_CERT_PROP_ID:
313 case CERT_CRL_PROP_ID:
314 case CERT_CTL_PROP_ID:
315 SetLastError(E_INVALIDARG);
316 ret = FALSE;
317 break;
318 case CERT_ACCESS_STATE_PROP_ID:
319 if (pCertContext->hCertStore)
320 ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
321 pvData, pcbData);
322 else
323 {
324 DWORD state = 0;
325
326 ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
327 }
328 break;
329 case CERT_KEY_PROV_HANDLE_PROP_ID:
330 {
331 CERT_KEY_CONTEXT keyContext;
332 DWORD size = sizeof(keyContext);
333
334 ret = CertContext_GetProperty((void *)pCertContext,
335 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
336 if (ret)
337 ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
338 sizeof(keyContext.hCryptProv));
339 break;
340 }
341 case CERT_KEY_PROV_INFO_PROP_ID:
342 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
343 pcbData);
344 if (ret && pvData)
345 CRYPT_FixKeyProvInfoPointers((PCRYPT_KEY_PROV_INFO)pvData);
346 break;
347 default:
348 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
349 pcbData);
350 }
351
352 TRACE("returning %d\n", ret);
353 return ret;
354 }
355
356 /* Copies key provider info from from into to, where to is assumed to be a
357 * contiguous buffer of memory large enough for from and all its associated
358 * data, but whose pointers are uninitialized.
359 * Upon return, to contains a contiguous copy of from, packed in the following
360 * order:
361 * - CRYPT_KEY_PROV_INFO
362 * - pwszContainerName
363 * - pwszProvName
364 * - rgProvParam[0]...
365 */
366 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
367 const CRYPT_KEY_PROV_INFO *from)
368 {
369 DWORD i;
370 LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
371
372 if (from->pwszContainerName)
373 {
374 to->pwszContainerName = (LPWSTR)nextData;
375 lstrcpyW(to->pwszContainerName, from->pwszContainerName);
376 nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
377 }
378 else
379 to->pwszContainerName = NULL;
380 if (from->pwszProvName)
381 {
382 to->pwszProvName = (LPWSTR)nextData;
383 lstrcpyW(to->pwszProvName, from->pwszProvName);
384 nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
385 }
386 else
387 to->pwszProvName = NULL;
388 to->dwProvType = from->dwProvType;
389 to->dwFlags = from->dwFlags;
390 to->cProvParam = from->cProvParam;
391 to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
392 nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
393 to->dwKeySpec = from->dwKeySpec;
394 for (i = 0; i < to->cProvParam; i++)
395 {
396 memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
397 sizeof(CRYPT_KEY_PROV_PARAM));
398 to->rgProvParam[i].pbData = nextData;
399 memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
400 from->rgProvParam[i].cbData);
401 nextData += from->rgProvParam[i].cbData;
402 }
403 }
404
405 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
406 const CRYPT_KEY_PROV_INFO *info)
407 {
408 BOOL ret;
409 LPBYTE buf = NULL;
410 DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
411
412 if (info->pwszContainerName)
413 containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
414 else
415 containerSize = 0;
416 if (info->pwszProvName)
417 provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
418 else
419 provNameSize = 0;
420 size += containerSize + provNameSize;
421 for (i = 0; i < info->cProvParam; i++)
422 size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
423 buf = CryptMemAlloc(size);
424 if (buf)
425 {
426 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
427 ret = ContextPropertyList_SetProperty(properties,
428 CERT_KEY_PROV_INFO_PROP_ID, buf, size);
429 CryptMemFree(buf);
430 }
431 else
432 ret = FALSE;
433 return ret;
434 }
435
436 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
437 DWORD dwFlags, const void *pvData)
438 {
439 PCONTEXT_PROPERTY_LIST properties =
440 Context_GetProperties(context, sizeof(CERT_CONTEXT));
441 BOOL ret;
442
443 TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
444
445 if (!properties)
446 ret = FALSE;
447 else
448 {
449 switch (dwPropId)
450 {
451 case CERT_AUTO_ENROLL_PROP_ID:
452 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
453 case CERT_DESCRIPTION_PROP_ID:
454 case CERT_FRIENDLY_NAME_PROP_ID:
455 case CERT_HASH_PROP_ID:
456 case CERT_KEY_IDENTIFIER_PROP_ID:
457 case CERT_MD5_HASH_PROP_ID:
458 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
459 case CERT_PUBKEY_ALG_PARA_PROP_ID:
460 case CERT_PVK_FILE_PROP_ID:
461 case CERT_SIGNATURE_HASH_PROP_ID:
462 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
463 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
464 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
465 case CERT_ENROLLMENT_PROP_ID:
466 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
467 case CERT_RENEWAL_PROP_ID:
468 {
469 if (pvData)
470 {
471 const CRYPT_DATA_BLOB *blob = (const CRYPT_DATA_BLOB *)pvData;
472
473 ret = ContextPropertyList_SetProperty(properties, dwPropId,
474 blob->pbData, blob->cbData);
475 }
476 else
477 {
478 ContextPropertyList_RemoveProperty(properties, dwPropId);
479 ret = TRUE;
480 }
481 break;
482 }
483 case CERT_DATE_STAMP_PROP_ID:
484 if (pvData)
485 ret = ContextPropertyList_SetProperty(properties, dwPropId,
486 (const BYTE *)pvData, sizeof(FILETIME));
487 else
488 {
489 ContextPropertyList_RemoveProperty(properties, dwPropId);
490 ret = TRUE;
491 }
492 break;
493 case CERT_KEY_CONTEXT_PROP_ID:
494 {
495 if (pvData)
496 {
497 const CERT_KEY_CONTEXT *keyContext = (const CERT_KEY_CONTEXT *)pvData;
498
499 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
500 {
501 SetLastError(E_INVALIDARG);
502 ret = FALSE;
503 }
504 else
505 ret = ContextPropertyList_SetProperty(properties, dwPropId,
506 (const BYTE *)keyContext, keyContext->cbSize);
507 }
508 else
509 {
510 ContextPropertyList_RemoveProperty(properties, dwPropId);
511 ret = TRUE;
512 }
513 break;
514 }
515 case CERT_KEY_PROV_INFO_PROP_ID:
516 if (pvData)
517 ret = CertContext_SetKeyProvInfoProperty(properties,
518 (const CRYPT_KEY_PROV_INFO *)pvData);
519 else
520 {
521 ContextPropertyList_RemoveProperty(properties, dwPropId);
522 ret = TRUE;
523 }
524 break;
525 case CERT_KEY_PROV_HANDLE_PROP_ID:
526 {
527 CERT_KEY_CONTEXT keyContext;
528 DWORD size = sizeof(keyContext);
529
530 ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
531 &keyContext, &size);
532 if (ret)
533 {
534 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
535 CryptReleaseContext(keyContext.hCryptProv, 0);
536 if (pvData)
537 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
538 else
539 keyContext.hCryptProv = 0;
540 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
541 0, &keyContext);
542 }
543 break;
544 }
545 default:
546 FIXME("%d: stub\n", dwPropId);
547 ret = FALSE;
548 }
549 }
550 TRACE("returning %d\n", ret);
551 return ret;
552 }
553
554 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
555 DWORD dwPropId, DWORD dwFlags, const void *pvData)
556 {
557 BOOL ret;
558
559 TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
560
561 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
562 * crashes on most of these, I'll be safer.
563 */
564 switch (dwPropId)
565 {
566 case 0:
567 case CERT_ACCESS_STATE_PROP_ID:
568 case CERT_CERT_PROP_ID:
569 case CERT_CRL_PROP_ID:
570 case CERT_CTL_PROP_ID:
571 SetLastError(E_INVALIDARG);
572 return FALSE;
573 }
574 ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
575 pvData);
576 TRACE("returning %d\n", ret);
577 return ret;
578 }
579
580 /* Acquires the private key using the key provider info, retrieving info from
581 * the certificate if info is NULL. The acquired provider is returned in
582 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
583 */
584 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
585 PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
586 {
587 DWORD size = 0;
588 BOOL allocated = FALSE, ret = TRUE;
589
590 if (!info)
591 {
592 ret = CertGetCertificateContextProperty(pCert,
593 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
594 if (ret)
595 {
596 info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(GetProcessHeap(), 0, size);
597 if (info)
598 {
599 ret = CertGetCertificateContextProperty(pCert,
600 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
601 allocated = TRUE;
602 }
603 }
604 else
605 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
606 }
607 if (ret)
608 {
609 ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
610 info->pwszProvName, info->dwProvType, 0);
611 if (ret)
612 {
613 DWORD i;
614
615 for (i = 0; i < info->cProvParam; i++)
616 {
617 CryptSetProvParam(*phCryptProv,
618 info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
619 info->rgProvParam[i].dwFlags);
620 }
621 *pdwKeySpec = info->dwKeySpec;
622 }
623 else
624 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
625 }
626 if (allocated)
627 HeapFree(GetProcessHeap(), 0, info);
628 return ret;
629 }
630
631 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
632 DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
633 DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
634 {
635 BOOL ret = FALSE, cache = FALSE;
636 PCRYPT_KEY_PROV_INFO info = NULL;
637 CERT_KEY_CONTEXT keyContext;
638 DWORD size;
639
640 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
641 phCryptProv, pdwKeySpec, pfCallerFreeProv);
642
643 if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
644 {
645 DWORD size = 0;
646
647 ret = CertGetCertificateContextProperty(pCert,
648 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
649 if (ret)
650 {
651 info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(
652 GetProcessHeap(), 0, size);
653 ret = CertGetCertificateContextProperty(pCert,
654 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
655 if (ret)
656 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
657 }
658 }
659 else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
660 cache = TRUE;
661 *phCryptProv = 0;
662 if (cache)
663 {
664 size = sizeof(keyContext);
665 ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
666 &keyContext, &size);
667 if (ret)
668 {
669 *phCryptProv = keyContext.hCryptProv;
670 if (pdwKeySpec)
671 *pdwKeySpec = keyContext.dwKeySpec;
672 if (pfCallerFreeProv)
673 *pfCallerFreeProv = !cache;
674 }
675 }
676 if (!*phCryptProv)
677 {
678 ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
679 &keyContext.hCryptProv, &keyContext.dwKeySpec);
680 if (ret)
681 {
682 *phCryptProv = keyContext.hCryptProv;
683 if (pdwKeySpec)
684 *pdwKeySpec = keyContext.dwKeySpec;
685 if (cache)
686 {
687 keyContext.cbSize = sizeof(keyContext);
688 if (CertSetCertificateContextProperty(pCert,
689 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
690 {
691 if (pfCallerFreeProv)
692 *pfCallerFreeProv = FALSE;
693 }
694 }
695 else
696 {
697 if (pfCallerFreeProv)
698 *pfCallerFreeProv = TRUE;
699 }
700 }
701 }
702 HeapFree(GetProcessHeap(), 0, info);
703 return ret;
704 }
705
706 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
707 PCERT_INFO pCertId1, PCERT_INFO pCertId2)
708 {
709 BOOL ret;
710
711 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
712
713 ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
714 &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
715 &pCertId2->SerialNumber);
716 TRACE("returning %d\n", ret);
717 return ret;
718 }
719
720 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
721 PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
722 {
723 BOOL ret;
724
725 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
726
727 if (pCertName1->cbData == pCertName2->cbData)
728 {
729 if (pCertName1->cbData)
730 ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
731 pCertName1->cbData);
732 else
733 ret = TRUE;
734 }
735 else
736 ret = FALSE;
737 TRACE("returning %d\n", ret);
738 return ret;
739 }
740
741 /* Returns the number of significant bytes in pInt, where a byte is
742 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
743 * for negative numbers. pInt is assumed to be little-endian.
744 */
745 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
746 {
747 DWORD ret = pInt->cbData;
748
749 while (ret > 1)
750 {
751 if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
752 ret--;
753 else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
754 ret--;
755 else
756 break;
757 }
758 return ret;
759 }
760
761 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
762 PCRYPT_INTEGER_BLOB pInt2)
763 {
764 BOOL ret;
765 DWORD cb1, cb2;
766
767 TRACE("(%p, %p)\n", pInt1, pInt2);
768
769 cb1 = CRYPT_significantBytes(pInt1);
770 cb2 = CRYPT_significantBytes(pInt2);
771 if (cb1 == cb2)
772 {
773 if (cb1)
774 ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
775 else
776 ret = TRUE;
777 }
778 else
779 ret = FALSE;
780 TRACE("returning %d\n", ret);
781 return ret;
782 }
783
784 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
785 PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
786 {
787 BOOL ret;
788
789 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
790
791 switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
792 {
793 case 0: /* Seems to mean "raw binary bits" */
794 if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
795 pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
796 {
797 if (pPublicKey2->PublicKey.cbData)
798 ret = !memcmp(pPublicKey1->PublicKey.pbData,
799 pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
800 else
801 ret = TRUE;
802 }
803 else
804 ret = FALSE;
805 break;
806 default:
807 WARN("Unknown encoding type %08x\n", dwCertEncodingType);
808 /* FALLTHROUGH */
809 case X509_ASN_ENCODING:
810 {
811 BLOBHEADER *pblob1, *pblob2;
812 DWORD length;
813 ret = FALSE;
814 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
815 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
816 0, NULL, &length))
817 {
818 pblob1 = CryptMemAlloc(length);
819 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
820 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
821 0, pblob1, &length))
822 {
823 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
824 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
825 0, NULL, &length))
826 {
827 pblob2 = CryptMemAlloc(length);
828 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
829 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
830 0, pblob2, &length))
831 {
832 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
833 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
834 *pk2 = (LPVOID)(pblob2 + 1);
835 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
836 && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
837 }
838 CryptMemFree(pblob2);
839 }
840 }
841 CryptMemFree(pblob1);
842 }
843
844 break;
845 }
846 }
847 return ret;
848 }
849
850 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
851 PCERT_PUBLIC_KEY_INFO pPublicKey)
852 {
853 DWORD len = 0;
854
855 TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
856
857 if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
858 {
859 SetLastError(ERROR_FILE_NOT_FOUND);
860 return 0;
861 }
862 if (pPublicKey->Algorithm.pszObjId &&
863 !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
864 {
865 FIXME("unimplemented for DH public keys\n");
866 SetLastError(CRYPT_E_ASN1_BADTAG);
867 }
868 else
869 {
870 DWORD size;
871 PBYTE buf;
872 BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
873 RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
874 pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
875 &size);
876
877 if (ret)
878 {
879 RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
880
881 len = rsaPubKey->bitlen;
882 LocalFree(buf);
883 }
884 }
885 return len;
886 }
887
888 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
889 DWORD dwFlags, const void *pvPara);
890
891 static BOOL compare_cert_any(PCCERT_CONTEXT pCertContext, DWORD dwType,
892 DWORD dwFlags, const void *pvPara)
893 {
894 return TRUE;
895 }
896
897 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
898 DWORD dwFlags, const void *pvPara)
899 {
900 BOOL ret;
901 BYTE hash[16];
902 DWORD size = sizeof(hash);
903
904 ret = CertGetCertificateContextProperty(pCertContext,
905 CERT_MD5_HASH_PROP_ID, hash, &size);
906 if (ret)
907 {
908 const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
909
910 if (size == pHash->cbData)
911 ret = !memcmp(pHash->pbData, hash, size);
912 else
913 ret = FALSE;
914 }
915 return ret;
916 }
917
918 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
919 DWORD dwFlags, const void *pvPara)
920 {
921 BOOL ret;
922 BYTE hash[20];
923 DWORD size = sizeof(hash);
924
925 ret = CertGetCertificateContextProperty(pCertContext,
926 CERT_SHA1_HASH_PROP_ID, hash, &size);
927 if (ret)
928 {
929 const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
930
931 if (size == pHash->cbData)
932 ret = !memcmp(pHash->pbData, hash, size);
933 else
934 ret = FALSE;
935 }
936 return ret;
937 }
938
939 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
940 DWORD dwFlags, const void *pvPara)
941 {
942 CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
943 BOOL ret;
944
945 if (dwType & CERT_INFO_SUBJECT_FLAG)
946 toCompare = &pCertContext->pCertInfo->Subject;
947 else
948 toCompare = &pCertContext->pCertInfo->Issuer;
949 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
950 toCompare, blob);
951 return ret;
952 }
953
954 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
955 DWORD dwType, DWORD dwFlags, const void *pvPara)
956 {
957 CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
958 BOOL ret;
959
960 /* Matching serial number and subject match.. */
961 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
962 &pCertInfo->Issuer, &pCertContext->pCertInfo->Subject);
963 if (ret)
964 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
965 &pCertInfo->SerialNumber);
966 else
967 {
968 /* failing that, if the serial number and issuer match, we match */
969 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
970 &pCertInfo->SerialNumber);
971 if (ret)
972 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
973 &pCertInfo->Issuer, &pCertContext->pCertInfo->Issuer);
974 }
975 TRACE("returning %d\n", ret);
976 return ret;
977 }
978
979 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
980 DWORD dwFlags, const void *pvPara)
981 {
982 CERT_ID *id = (CERT_ID *)pvPara;
983 BOOL ret;
984
985 switch (id->dwIdChoice)
986 {
987 case CERT_ID_ISSUER_SERIAL_NUMBER:
988 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
989 &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
990 if (ret)
991 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
992 &id->u.IssuerSerialNumber.SerialNumber);
993 break;
994 case CERT_ID_SHA1_HASH:
995 ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
996 &id->u.HashId);
997 break;
998 case CERT_ID_KEY_IDENTIFIER:
999 {
1000 DWORD size = 0;
1001
1002 ret = CertGetCertificateContextProperty(pCertContext,
1003 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1004 if (ret && size == id->u.KeyId.cbData)
1005 {
1006 LPBYTE buf = CryptMemAlloc(size);
1007
1008 if (buf)
1009 {
1010 CertGetCertificateContextProperty(pCertContext,
1011 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1012 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1013 CryptMemFree(buf);
1014 }
1015 }
1016 else
1017 ret = FALSE;
1018 break;
1019 }
1020 default:
1021 ret = FALSE;
1022 break;
1023 }
1024 return ret;
1025 }
1026
1027 static BOOL compare_cert_by_issuer(PCCERT_CONTEXT pCertContext, DWORD dwType,
1028 DWORD dwFlags, const void *pvPara)
1029 {
1030 BOOL ret = FALSE;
1031 PCCERT_CONTEXT subject = (PCCERT_CONTEXT)pvPara;
1032 PCERT_EXTENSION ext;
1033 DWORD size;
1034
1035 if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1036 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1037 {
1038 CERT_AUTHORITY_KEY_ID_INFO *info;
1039
1040 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1041 X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1042 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1043 &info, &size);
1044 if (ret)
1045 {
1046 CERT_ID id;
1047
1048 if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1049 {
1050 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1051 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1052 sizeof(CERT_NAME_BLOB));
1053 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1054 &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1055 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1056 &id);
1057 }
1058 else if (info->KeyId.cbData)
1059 {
1060 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1061 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1062 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1063 &id);
1064 }
1065 else
1066 ret = FALSE;
1067 LocalFree(info);
1068 }
1069 }
1070 else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1071 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1072 {
1073 CERT_AUTHORITY_KEY_ID2_INFO *info;
1074
1075 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1076 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1077 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1078 &info, &size);
1079 if (ret)
1080 {
1081 CERT_ID id;
1082
1083 if (info->AuthorityCertIssuer.cAltEntry &&
1084 info->AuthorityCertSerialNumber.cbData)
1085 {
1086 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1087 DWORD i;
1088
1089 for (i = 0; !directoryName &&
1090 i < info->AuthorityCertIssuer.cAltEntry; i++)
1091 if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1092 == CERT_ALT_NAME_DIRECTORY_NAME)
1093 directoryName =
1094 &info->AuthorityCertIssuer.rgAltEntry[i];
1095 if (directoryName)
1096 {
1097 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1098 memcpy(&id.u.IssuerSerialNumber.Issuer,
1099 &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1100 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1101 &info->AuthorityCertSerialNumber,
1102 sizeof(CRYPT_INTEGER_BLOB));
1103 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1104 &id);
1105 }
1106 else
1107 {
1108 FIXME("no supported name type in authority key id2\n");
1109 ret = FALSE;
1110 }
1111 }
1112 else if (info->KeyId.cbData)
1113 {
1114 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1115 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1116 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1117 &id);
1118 }
1119 else
1120 ret = FALSE;
1121 LocalFree(info);
1122 }
1123 }
1124 else
1125 ret = compare_cert_by_name(pCertContext,
1126 CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT, dwFlags,
1127 &subject->pCertInfo->Issuer);
1128 return ret;
1129 }
1130
1131 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1132 DWORD dwFlags, const void *pvPara)
1133 {
1134 PCCERT_CONTEXT toCompare = (PCCERT_CONTEXT)pvPara;
1135 return CertCompareCertificate(pCertContext->dwCertEncodingType,
1136 pCertContext->pCertInfo, toCompare->pCertInfo);
1137 }
1138
1139 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1140 DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1141 PCCERT_CONTEXT pPrevCertContext)
1142 {
1143 PCCERT_CONTEXT ret;
1144 CertCompareFunc compare;
1145
1146 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1147 dwFlags, dwType, pvPara, pPrevCertContext);
1148
1149 switch (dwType >> CERT_COMPARE_SHIFT)
1150 {
1151 case CERT_COMPARE_ANY:
1152 compare = compare_cert_any;
1153 break;
1154 case CERT_COMPARE_MD5_HASH:
1155 compare = compare_cert_by_md5_hash;
1156 break;
1157 case CERT_COMPARE_SHA1_HASH:
1158 compare = compare_cert_by_sha1_hash;
1159 break;
1160 case CERT_COMPARE_NAME:
1161 compare = compare_cert_by_name;
1162 break;
1163 case CERT_COMPARE_SUBJECT_CERT:
1164 compare = compare_cert_by_subject_cert;
1165 break;
1166 case CERT_COMPARE_CERT_ID:
1167 compare = compare_cert_by_cert_id;
1168 break;
1169 case CERT_COMPARE_ISSUER_OF:
1170 compare = compare_cert_by_issuer;
1171 break;
1172 case CERT_COMPARE_EXISTING:
1173 compare = compare_existing_cert;
1174 break;
1175 default:
1176 FIXME("find type %08x unimplemented\n", dwType);
1177 compare = NULL;
1178 }
1179
1180 if (compare)
1181 {
1182 BOOL matches = FALSE;
1183
1184 ret = pPrevCertContext;
1185 do {
1186 ret = CertEnumCertificatesInStore(hCertStore, ret);
1187 if (ret)
1188 matches = compare(ret, dwType, dwFlags, pvPara);
1189 } while (ret != NULL && !matches);
1190 if (!ret)
1191 SetLastError(CRYPT_E_NOT_FOUND);
1192 }
1193 else
1194 {
1195 SetLastError(CRYPT_E_NOT_FOUND);
1196 ret = NULL;
1197 }
1198 TRACE("returning %p\n", ret);
1199 return ret;
1200 }
1201
1202 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1203 DWORD dwCertEncodingType, PCERT_INFO pCertId)
1204 {
1205 TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1206
1207 if (!pCertId)
1208 {
1209 SetLastError(E_INVALIDARG);
1210 return NULL;
1211 }
1212 return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1213 CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1214 }
1215
1216 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1217 PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1218 {
1219 static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1220 CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1221
1222 if (*pdwFlags & ~supportedFlags)
1223 {
1224 SetLastError(E_INVALIDARG);
1225 return FALSE;
1226 }
1227 if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1228 {
1229 DWORD flags = 0;
1230 PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1231 NULL, &flags);
1232
1233 /* FIXME: what if the CRL has expired? */
1234 if (crl)
1235 {
1236 if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1237 pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1238 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1239 }
1240 else
1241 *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1242 }
1243 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1244 {
1245 if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1246 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1247 }
1248 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1249 {
1250 if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1251 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1252 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1253 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1254 }
1255 return TRUE;
1256 }
1257
1258 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1259 PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1260 DWORD *pdwFlags)
1261 {
1262 PCCERT_CONTEXT ret;
1263
1264 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1265 pPrevIssuerContext, *pdwFlags);
1266
1267 if (!pSubjectContext)
1268 {
1269 SetLastError(E_INVALIDARG);
1270 return NULL;
1271 }
1272
1273 ret = CertFindCertificateInStore(hCertStore,
1274 pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1275 pSubjectContext, pPrevIssuerContext);
1276 if (ret)
1277 {
1278 if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1279 pdwFlags))
1280 {
1281 CertFreeCertificateContext(ret);
1282 ret = NULL;
1283 }
1284 }
1285 TRACE("returning %p\n", ret);
1286 return ret;
1287 }
1288
1289 typedef struct _OLD_CERT_REVOCATION_STATUS {
1290 DWORD cbSize;
1291 DWORD dwIndex;
1292 DWORD dwError;
1293 DWORD dwReason;
1294 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1295
1296 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1297 void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1298
1299 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1300 DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1301 PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1302 {
1303 BOOL ret;
1304
1305 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1306 cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1307
1308 if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1309 pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1310 {
1311 SetLastError(E_INVALIDARG);
1312 return FALSE;
1313 }
1314 if (cContext)
1315 {
1316 static HCRYPTOIDFUNCSET set = NULL;
1317 DWORD size;
1318
1319 if (!set)
1320 set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1321 ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1322 if (ret)
1323 {
1324 if (size == 1)
1325 {
1326 /* empty list */
1327 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1328 ret = FALSE;
1329 }
1330 else
1331 {
1332 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1333
1334 if (dllList)
1335 {
1336 ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1337 dllList, &size);
1338 if (ret)
1339 {
1340 for (ptr = dllList; ret && *ptr;
1341 ptr += lstrlenW(ptr) + 1)
1342 {
1343 CertVerifyRevocationFunc func;
1344 HCRYPTOIDFUNCADDR hFunc;
1345
1346 ret = CryptGetDefaultOIDFunctionAddress(set,
1347 dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1348 if (ret)
1349 {
1350 ret = func(dwEncodingType, dwRevType, cContext,
1351 rgpvContext, dwFlags, pRevPara, pRevStatus);
1352 CryptFreeOIDFunctionAddress(hFunc, 0);
1353 }
1354 }
1355 }
1356 CryptMemFree(dllList);
1357 }
1358 else
1359 {
1360 SetLastError(ERROR_OUTOFMEMORY);
1361 ret = FALSE;
1362 }
1363 }
1364 }
1365 }
1366 else
1367 ret = TRUE;
1368 return ret;
1369 }
1370
1371 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1372 CRYPT_ATTRIBUTE rgAttr[])
1373 {
1374 PCRYPT_ATTRIBUTE ret = NULL;
1375 DWORD i;
1376
1377 TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1378
1379 if (!cAttr)
1380 return NULL;
1381 if (!pszObjId)
1382 {
1383 SetLastError(ERROR_INVALID_PARAMETER);
1384 return NULL;
1385 }
1386
1387 for (i = 0; !ret && i < cAttr; i++)
1388 if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1389 ret = &rgAttr[i];
1390 return ret;
1391 }
1392
1393 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1394 CERT_EXTENSION rgExtensions[])
1395 {
1396 PCERT_EXTENSION ret = NULL;
1397 DWORD i;
1398
1399 TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1400
1401 if (!cExtensions)
1402 return NULL;
1403 if (!pszObjId)
1404 {
1405 SetLastError(ERROR_INVALID_PARAMETER);
1406 return NULL;
1407 }
1408
1409 for (i = 0; !ret && i < cExtensions; i++)
1410 if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1411 rgExtensions[i].pszObjId))
1412 ret = &rgExtensions[i];
1413 return ret;
1414 }
1415
1416 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1417 {
1418 PCERT_RDN_ATTR ret = NULL;
1419 DWORD i, j;
1420
1421 TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1422
1423 if (!pszObjId)
1424 {
1425 SetLastError(ERROR_INVALID_PARAMETER);
1426 return NULL;
1427 }
1428
1429 for (i = 0; !ret && i < pName->cRDN; i++)
1430 for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1431 if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1432 pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1433 ret = &pName->rgRDN[i].rgRDNAttr[j];
1434 return ret;
1435 }
1436
1437 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1438 PCERT_INFO pCertInfo)
1439 {
1440 FILETIME fileTime;
1441 LONG ret;
1442
1443 if (!pTimeToVerify)
1444 {
1445 GetSystemTimeAsFileTime(&fileTime);
1446 pTimeToVerify = &fileTime;
1447 }
1448 if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1449 {
1450 ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1451 if (ret < 0)
1452 ret = 0;
1453 }
1454 return ret;
1455 }
1456
1457 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1458 PCERT_INFO pIssuerInfo)
1459 {
1460 TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1461
1462 return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1463 && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1464 }
1465
1466 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1467 DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1468 DWORD *pcbComputedHash)
1469 {
1470 BOOL ret = TRUE;
1471 HCRYPTHASH hHash = 0;
1472
1473 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1474 pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1475
1476 if (!hCryptProv)
1477 hCryptProv = CRYPT_GetDefaultProvider();
1478 if (!Algid)
1479 Algid = CALG_SHA1;
1480 if (ret)
1481 {
1482 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1483 if (ret)
1484 {
1485 ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1486 if (ret)
1487 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1488 pcbComputedHash, 0);
1489 CryptDestroyHash(hHash);
1490 }
1491 }
1492 return ret;
1493 }
1494
1495 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1496 DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1497 BYTE *pbComputedHash, DWORD *pcbComputedHash)
1498 {
1499 BOOL ret = TRUE;
1500 HCRYPTHASH hHash = 0;
1501
1502 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1503 dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1504
1505 if (!hCryptProv)
1506 hCryptProv = CRYPT_GetDefaultProvider();
1507 if (!Algid)
1508 Algid = CALG_MD5;
1509 if (ret)
1510 {
1511 BYTE *buf;
1512 DWORD size = 0;
1513
1514 ret = CryptEncodeObjectEx(dwCertEncodingType, X509_PUBLIC_KEY_INFO,
1515 pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
1516 if (ret)
1517 {
1518 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1519 if (ret)
1520 {
1521 ret = CryptHashData(hHash, buf, size, 0);
1522 if (ret)
1523 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1524 pcbComputedHash, 0);
1525 CryptDestroyHash(hHash);
1526 }
1527 LocalFree(buf);
1528 }
1529 }
1530 return ret;
1531 }
1532
1533 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1534 DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
1535 DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1536 const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
1537 {
1538 BOOL ret;
1539 PCCRYPT_OID_INFO info;
1540 HCRYPTHASH hHash;
1541
1542 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
1543 dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
1544 pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
1545
1546 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1547 pSignatureAlgorithm->pszObjId, 0);
1548 if (!info)
1549 {
1550 SetLastError(NTE_BAD_ALGID);
1551 return FALSE;
1552 }
1553 if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
1554 {
1555 if (!hCryptProv)
1556 hCryptProv = CRYPT_GetDefaultProvider();
1557 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1558 if (ret)
1559 {
1560 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1561 cbEncodedToBeSigned, 0);
1562 if (ret)
1563 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
1564 pcbSignature, 0);
1565 CryptDestroyHash(hHash);
1566 }
1567 }
1568 else
1569 {
1570 if (!hCryptProv)
1571 {
1572 SetLastError(ERROR_INVALID_PARAMETER);
1573 ret = FALSE;
1574 }
1575 else
1576 {
1577 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1578 if (ret)
1579 {
1580 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1581 cbEncodedToBeSigned, 0);
1582 if (ret)
1583 ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
1584 pcbSignature);
1585 CryptDestroyHash(hHash);
1586 }
1587 }
1588 }
1589 return ret;
1590 }
1591
1592 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1593 DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
1594 const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1595 const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
1596 {
1597 BOOL ret;
1598 DWORD encodedSize, hashSize;
1599
1600 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
1601 dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
1602 pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
1603
1604 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
1605 NULL, &encodedSize);
1606 if (ret)
1607 {
1608 PBYTE encoded = CryptMemAlloc(encodedSize);
1609
1610 if (encoded)
1611 {
1612 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
1613 pvStructInfo, encoded, &encodedSize);
1614 if (ret)
1615 {
1616 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1617 dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
1618 pvHashAuxInfo, NULL, &hashSize);
1619 if (ret)
1620 {
1621 PBYTE hash = CryptMemAlloc(hashSize);
1622
1623 if (hash)
1624 {
1625 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1626 dwCertEncodingType, encoded, encodedSize,
1627 pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
1628 if (ret)
1629 {
1630 CERT_SIGNED_CONTENT_INFO info = { { 0 } };
1631
1632 info.ToBeSigned.cbData = encodedSize;
1633 info.ToBeSigned.pbData = encoded;
1634 memcpy(&info.SignatureAlgorithm,
1635 pSignatureAlgorithm,
1636 sizeof(info.SignatureAlgorithm));
1637 info.Signature.cbData = hashSize;
1638 info.Signature.pbData = hash;
1639 info.Signature.cUnusedBits = 0;
1640 ret = CryptEncodeObject(dwCertEncodingType,
1641 X509_CERT, &info, pbEncoded, pcbEncoded);
1642 }
1643 CryptMemFree(hash);
1644 }
1645 }
1646 }
1647 CryptMemFree(encoded);
1648 }
1649 }
1650 return ret;
1651 }
1652
1653 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
1654 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1655 PCERT_PUBLIC_KEY_INFO pPublicKey)
1656 {
1657 return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
1658 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
1659 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
1660 }
1661
1662 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
1663 DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
1664 const CERT_SIGNED_CONTENT_INFO *signedCert)
1665 {
1666 BOOL ret;
1667 HCRYPTKEY key;
1668 PCCRYPT_OID_INFO info;
1669 ALG_ID pubKeyID, hashID;
1670
1671 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1672 signedCert->SignatureAlgorithm.pszObjId, 0);
1673 if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
1674 {
1675 SetLastError(NTE_BAD_ALGID);
1676 return FALSE;
1677 }
1678 hashID = info->u.Algid;
1679 if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
1680 pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
1681 else
1682 pubKeyID = hashID;
1683 /* Load the default provider if necessary */
1684 if (!hCryptProv)
1685 hCryptProv = CRYPT_GetDefaultProvider();
1686 ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
1687 pubKeyInfo, pubKeyID, 0, NULL, &key);
1688 if (ret)
1689 {
1690 HCRYPTHASH hash;
1691
1692 ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
1693 if (ret)
1694 {
1695 ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
1696 signedCert->ToBeSigned.cbData, 0);
1697 if (ret)
1698 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
1699 signedCert->Signature.cbData, key, NULL, 0);
1700 CryptDestroyHash(hash);
1701 }
1702 CryptDestroyKey(key);
1703 }
1704 return ret;
1705 }
1706
1707 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
1708 DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
1709 DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
1710 {
1711 BOOL ret = TRUE;
1712 CRYPT_DATA_BLOB subjectBlob;
1713
1714 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
1715 dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
1716 dwFlags, pvReserved);
1717
1718 switch (dwSubjectType)
1719 {
1720 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
1721 {
1722 PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvSubject;
1723
1724 subjectBlob.pbData = blob->pbData;
1725 subjectBlob.cbData = blob->cbData;
1726 break;
1727 }
1728 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
1729 {
1730 PCERT_CONTEXT context = (PCERT_CONTEXT)pvSubject;
1731
1732 subjectBlob.pbData = context->pbCertEncoded;
1733 subjectBlob.cbData = context->cbCertEncoded;
1734 break;
1735 }
1736 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
1737 {
1738 PCRL_CONTEXT context = (PCRL_CONTEXT)pvSubject;
1739
1740 subjectBlob.pbData = context->pbCrlEncoded;
1741 subjectBlob.cbData = context->cbCrlEncoded;
1742 break;
1743 }
1744 default:
1745 SetLastError(E_INVALIDARG);
1746 ret = FALSE;
1747 }
1748
1749 if (ret)
1750 {
1751 PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
1752 DWORD size = 0;
1753
1754 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1755 subjectBlob.pbData, subjectBlob.cbData,
1756 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1757 (BYTE *)&signedCert, &size);
1758 if (ret)
1759 {
1760 switch (dwIssuerType)
1761 {
1762 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
1763 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1764 dwCertEncodingType, (PCERT_PUBLIC_KEY_INFO)pvIssuer,
1765 signedCert);
1766 break;
1767 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
1768 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1769 dwCertEncodingType,
1770 &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
1771 signedCert);
1772 break;
1773 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
1774 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
1775 ret = FALSE;
1776 break;
1777 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
1778 if (pvIssuer)
1779 {
1780 SetLastError(E_INVALIDARG);
1781 ret = FALSE;
1782 }
1783 else
1784 {
1785 FIXME("unimplemented for NULL signer\n");
1786 SetLastError(E_INVALIDARG);
1787 ret = FALSE;
1788 }
1789 break;
1790 default:
1791 SetLastError(E_INVALIDARG);
1792 ret = FALSE;
1793 }
1794 LocalFree(signedCert);
1795 }
1796 }
1797 return ret;
1798 }
1799
1800 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
1801 PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
1802 {
1803 PCERT_ENHKEY_USAGE usage = NULL;
1804 DWORD bytesNeeded;
1805 BOOL ret = TRUE;
1806
1807 if (!pCertContext || !pcbUsage)
1808 {
1809 SetLastError(ERROR_INVALID_PARAMETER);
1810 return FALSE;
1811 }
1812
1813 TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
1814
1815 if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
1816 {
1817 DWORD propSize = 0;
1818
1819 if (CertGetCertificateContextProperty(pCertContext,
1820 CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
1821 {
1822 LPBYTE buf = CryptMemAlloc(propSize);
1823
1824 if (buf)
1825 {
1826 if (CertGetCertificateContextProperty(pCertContext,
1827 CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
1828 {
1829 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1830 X509_ENHANCED_KEY_USAGE, buf, propSize,
1831 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1832 }
1833 CryptMemFree(buf);
1834 }
1835 }
1836 }
1837 if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
1838 {
1839 PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
1840 pCertContext->pCertInfo->cExtension,
1841 pCertContext->pCertInfo->rgExtension);
1842
1843 if (ext)
1844 {
1845 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1846 X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
1847 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1848 }
1849 }
1850 if (!usage)
1851 {
1852 /* If a particular location is specified, this should fail. Otherwise
1853 * it should succeed with an empty usage. (This is true on Win2k and
1854 * later, which we emulate.)
1855 */
1856 if (dwFlags)
1857 {
1858 SetLastError(CRYPT_E_NOT_FOUND);
1859 ret = FALSE;
1860 }
1861 else
1862 bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
1863 }
1864
1865 if (ret)
1866 {
1867 if (!pUsage)
1868 *pcbUsage = bytesNeeded;
1869 else if (*pcbUsage < bytesNeeded)
1870 {
1871 SetLastError(ERROR_MORE_DATA);
1872 *pcbUsage = bytesNeeded;
1873 ret = FALSE;
1874 }
1875 else
1876 {
1877 *pcbUsage = bytesNeeded;
1878 if (usage)
1879 {
1880 DWORD i;
1881 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
1882 sizeof(CERT_ENHKEY_USAGE) +
1883 usage->cUsageIdentifier * sizeof(LPSTR));
1884
1885 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
1886 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
1887 sizeof(CERT_ENHKEY_USAGE));
1888 for (i = 0; i < usage->cUsageIdentifier; i++)
1889 {
1890 pUsage->rgpszUsageIdentifier[i] = nextOID;
1891 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1892 nextOID += strlen(nextOID) + 1;
1893 }
1894 }
1895 else
1896 pUsage->cUsageIdentifier = 0;
1897 }
1898 }
1899 if (usage)
1900 LocalFree(usage);
1901 TRACE("returning %d\n", ret);
1902 return ret;
1903 }
1904
1905 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
1906 PCERT_ENHKEY_USAGE pUsage)
1907 {
1908 BOOL ret;
1909
1910 TRACE("(%p, %p)\n", pCertContext, pUsage);
1911
1912 if (pUsage)
1913 {
1914 CRYPT_DATA_BLOB blob = { 0, NULL };
1915
1916 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
1917 pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
1918 if (ret)
1919 {
1920 ret = CertSetCertificateContextProperty(pCertContext,
1921 CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
1922 LocalFree(blob.pbData);
1923 }
1924 }
1925 else
1926 ret = CertSetCertificateContextProperty(pCertContext,
1927 CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
1928 return ret;
1929 }
1930
1931 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1932 LPCSTR pszUsageIdentifier)
1933 {
1934 BOOL ret;
1935 DWORD size;
1936
1937 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1938
1939 if (CertGetEnhancedKeyUsage(pCertContext,
1940 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
1941 {
1942 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
1943
1944 if (usage)
1945 {
1946 ret = CertGetEnhancedKeyUsage(pCertContext,
1947 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
1948 if (ret)
1949 {
1950 DWORD i;
1951 BOOL exists = FALSE;
1952
1953 /* Make sure usage doesn't already exist */
1954 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
1955 {
1956 if (!strcmp(usage->rgpszUsageIdentifier[i],
1957 pszUsageIdentifier))
1958 exists = TRUE;
1959 }
1960 if (!exists)
1961 {
1962 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
1963 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1964
1965 if (newUsage)
1966 {
1967 LPSTR nextOID;
1968
1969 newUsage->rgpszUsageIdentifier = (LPSTR *)
1970 ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
1971 nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
1972 + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
1973 for (i = 0; i < usage->cUsageIdentifier; i++)
1974 {
1975 newUsage->rgpszUsageIdentifier[i] = nextOID;
1976 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1977 nextOID += strlen(nextOID) + 1;
1978 }
1979 newUsage->rgpszUsageIdentifier[i] = nextOID;
1980 strcpy(nextOID, pszUsageIdentifier);
1981 newUsage->cUsageIdentifier = i + 1;
1982 ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
1983 CryptMemFree(newUsage);
1984 }
1985 else
1986 ret = FALSE;
1987 }
1988 }
1989 CryptMemFree(usage);
1990 }
1991 else
1992 ret = FALSE;
1993 }
1994 else
1995 {
1996 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
1997 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1998
1999 if (usage)
2000 {
2001 usage->rgpszUsageIdentifier =
2002 (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2003 usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2004 sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2005 strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2006 usage->cUsageIdentifier = 1;
2007 ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2008 CryptMemFree(usage);
2009 }
2010 else
2011 ret = FALSE;
2012 }
2013 return ret;
2014 }
2015
2016 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2017 LPCSTR pszUsageIdentifier)
2018 {
2019 BOOL ret;
2020 DWORD size;
2021 CERT_ENHKEY_USAGE usage;
2022
2023 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2024
2025 size = sizeof(usage);
2026 ret = CertGetEnhancedKeyUsage(pCertContext,
2027 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2028 if (!ret && GetLastError() == ERROR_MORE_DATA)
2029 {
2030 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2031
2032 if (pUsage)
2033 {
2034 ret = CertGetEnhancedKeyUsage(pCertContext,
2035 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2036 if (ret)
2037 {
2038 if (pUsage->cUsageIdentifier)
2039 {
2040 DWORD i;
2041 BOOL found = FALSE;
2042
2043 for (i = 0; i < pUsage->cUsageIdentifier; i++)
2044 {
2045 if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2046 pszUsageIdentifier))
2047 found = TRUE;
2048 if (found && i < pUsage->cUsageIdentifier - 1)
2049 pUsage->rgpszUsageIdentifier[i] =
2050 pUsage->rgpszUsageIdentifier[i + 1];
2051 }
2052 pUsage->cUsageIdentifier--;
2053 /* Remove the usage if it's empty */
2054 if (pUsage->cUsageIdentifier)
2055 ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2056 else
2057 ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2058 }
2059 }
2060 CryptMemFree(pUsage);
2061 }
2062 else
2063 ret = FALSE;
2064 }
2065 else
2066 {
2067 /* it fit in an empty usage, therefore there's nothing to remove */
2068 ret = TRUE;
2069 }
2070 return ret;
2071 }
2072
2073 struct BitField
2074 {
2075 DWORD cIndexes;
2076 DWORD *indexes;
2077 };
2078
2079 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2080
2081 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2082 {
2083 DWORD indexIndex = bit / BITS_PER_DWORD;
2084
2085 if (indexIndex + 1 > field->cIndexes)
2086 {
2087 if (field->cIndexes)
2088 field->indexes = CryptMemRealloc(field->indexes,
2089 (indexIndex + 1) * sizeof(DWORD));
2090 else
2091 field->indexes = CryptMemAlloc(sizeof(DWORD));
2092 if (field->indexes)
2093 {
2094 field->indexes[indexIndex] = 0;
2095 field->cIndexes = indexIndex + 1;
2096 }
2097 }
2098 if (field->indexes)
2099 field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2100 }
2101
2102 static BOOL CRYPT_IsBitInFieldSet(struct BitField *field, DWORD bit)
2103 {
2104 BOOL set = FALSE;
2105 DWORD indexIndex = bit / BITS_PER_DWORD;
2106
2107 assert(field->cIndexes);
2108 set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2109 return set;
2110 }
2111
2112 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2113 int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2114 {
2115 BOOL ret = TRUE;
2116 DWORD i, cbOIDs = 0;
2117 BOOL allUsagesValid = TRUE;
2118 CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2119
2120 TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2121 rghOIDs, *pcbOIDs);
2122
2123 for (i = 0; i < cCerts; i++)
2124 {
2125 CERT_ENHKEY_USAGE usage;
2126 DWORD size = sizeof(usage);
2127
2128 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2129 /* Success is deliberately ignored: it implies all usages are valid */
2130 if (!ret && GetLastError() == ERROR_MORE_DATA)
2131 {
2132 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2133
2134 allUsagesValid = FALSE;
2135 if (pUsage)
2136 {
2137 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2138 if (ret)
2139 {
2140 if (!validUsages.cUsageIdentifier)
2141 {
2142 DWORD j;
2143
2144 cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2145 validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2146 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2147 cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2148 + 1;
2149 validUsages.rgpszUsageIdentifier =
2150 CryptMemAlloc(cbOIDs);
2151 if (validUsages.rgpszUsageIdentifier)
2152 {
2153 LPSTR nextOID = (LPSTR)
2154 ((LPBYTE)validUsages.rgpszUsageIdentifier +
2155 validUsages.cUsageIdentifier * sizeof(LPSTR));
2156
2157 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2158 {
2159 validUsages.rgpszUsageIdentifier[j] = nextOID;
2160 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2161 pUsage->rgpszUsageIdentifier[j]);
2162 nextOID += lstrlenA(nextOID) + 1;
2163 }
2164 }
2165 }
2166 else
2167 {
2168 struct BitField validIndexes = { 0, NULL };
2169 DWORD j, k, numRemoved = 0;
2170
2171 /* Merge: build a bitmap of all the indexes of
2172 * validUsages.rgpszUsageIdentifier that are in pUsage.
2173 */
2174 for (j = 0; j < pUsage->cUsageIdentifier; j++)
2175 {
2176 for (k = 0; k < validUsages.cUsageIdentifier; k++)
2177 {
2178 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2179 validUsages.rgpszUsageIdentifier[k]))
2180 {
2181 CRYPT_SetBitInField(&validIndexes, k);
2182 break;
2183 }
2184 }
2185 }
2186 /* Merge by removing from validUsages those that are
2187 * not in the bitmap.
2188 */
2189 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2190 {
2191 if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2192 {
2193 if (j < validUsages.cUsageIdentifier - 1)
2194 {
2195 memmove(&validUsages.rgpszUsageIdentifier[j],
2196 &validUsages.rgpszUsageIdentifier[j +
2197 numRemoved + 1],
2198 (validUsages.cUsageIdentifier - numRemoved
2199 - j - 1) * sizeof(LPSTR));
2200 cbOIDs -= lstrlenA(
2201 validUsages.rgpszUsageIdentifier[j]) + 1 +
2202 sizeof(LPSTR);
2203 validUsages.cUsageIdentifier--;
2204 numRemoved++;
2205 }
2206 else
2207 validUsages.cUsageIdentifier--;
2208 }
2209 }
2210 CryptMemFree(validIndexes.indexes);
2211 }
2212 }
2213 CryptMemFree(pUsage);
2214 }
2215 }
2216 }
2217 ret = TRUE;
2218 if (allUsagesValid)
2219 {
2220 *cNumOIDs = -1;
2221 *pcbOIDs = 0;
2222 }
2223 else
2224 {
2225 *cNumOIDs = validUsages.cUsageIdentifier;
2226 if (!rghOIDs)
2227 *pcbOIDs = cbOIDs;
2228 else if (*pcbOIDs < cbOIDs)
2229 {
2230 *pcbOIDs = cbOIDs;
2231 SetLastError(ERROR_MORE_DATA);
2232 ret = FALSE;
2233 }
2234 else
2235 {
2236 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2237 validUsages.cUsageIdentifier * sizeof(LPSTR));
2238
2239 *pcbOIDs = cbOIDs;
2240 for (i = 0; i < validUsages.cUsageIdentifier; i++)
2241 {
2242 rghOIDs[i] = nextOID;
2243 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2244 nextOID += lstrlenA(nextOID) + 1;
2245 }
2246 }
2247 }
2248 CryptMemFree(validUsages.rgpszUsageIdentifier);
2249 TRACE("cNumOIDs: %d\n", *cNumOIDs);
2250 TRACE("returning %d\n", ret);
2251 return ret;
2252 }
2253
2254 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2255 * pInfo is NULL, from the attributes of hProv.
2256 */
2257 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2258 const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2259 {
2260 CRYPT_KEY_PROV_INFO info = { 0 };
2261 BOOL ret;
2262
2263 if (!pInfo)
2264 {
2265 DWORD size;
2266 int len;
2267
2268 ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2269 if (ret)
2270 {
2271 LPSTR szContainer = CryptMemAlloc(size);
2272
2273 if (szContainer)
2274 {
2275 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2276 (BYTE *)szContainer, &size, 0);
2277 if (ret)
2278 {
2279 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2280 NULL, 0);
2281 if (len)
2282 {
2283 info.pwszContainerName = CryptMemAlloc(len *
2284 sizeof(WCHAR));
2285 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2286 info.pwszContainerName, len);
2287 }
2288 }
2289 CryptMemFree(szContainer);
2290 }
2291 }
2292 ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2293 if (ret)
2294 {
2295 LPSTR szProvider = CryptMemAlloc(size);
2296
2297 if (szProvider)
2298 {
2299 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2300 &size, 0);
2301 if (ret)
2302 {
2303 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2304 NULL, 0);
2305 if (len)
2306 {
2307 info.pwszProvName = CryptMemAlloc(len *
2308 sizeof(WCHAR));
2309 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2310 info.pwszProvName, len);
2311 }
2312 }
2313 CryptMemFree(szProvider);
2314 }
2315 }
2316 size = sizeof(info.dwKeySpec);
2317 /* in case no CRYPT_KEY_PROV_INFO given,
2318 * we always use AT_SIGNATURE key spec
2319 */
2320 info.dwKeySpec = AT_SIGNATURE;
2321 size = sizeof(info.dwProvType);
2322 ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2323 &size, 0);
2324 if (!ret)
2325 info.dwProvType = PROV_RSA_FULL;
2326 pInfo = &info;
2327 }
2328
2329 ret = CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2330 0, pInfo);
2331
2332 if (pInfo == &info)
2333 {
2334 CryptMemFree(info.pwszContainerName);
2335 CryptMemFree(info.pwszProvName);
2336 }
2337 }
2338
2339 /* Creates a signed certificate context from the unsigned, encoded certificate
2340 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2341 */
2342 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2343 HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2344 {
2345 PCCERT_CONTEXT context = NULL;
2346 BOOL ret;
2347 DWORD sigSize = 0;
2348
2349 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2350 blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2351 if (ret)
2352 {
2353 LPBYTE sig = CryptMemAlloc(sigSize);
2354
2355 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2356 blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2357 if (ret)
2358 {
2359 CERT_SIGNED_CONTENT_INFO signedInfo;
2360 BYTE *encodedSignedCert = NULL;
2361 DWORD encodedSignedCertSize = 0;
2362
2363 signedInfo.ToBeSigned.cbData = blob->cbData;
2364 signedInfo.ToBeSigned.pbData = blob->pbData;
2365 memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2366 sizeof(signedInfo.SignatureAlgorithm));
2367 signedInfo.Signature.cbData = sigSize;
2368 signedInfo.Signature.pbData = sig;
2369 signedInfo.Signature.cUnusedBits = 0;
2370 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2371 &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2372 (BYTE *)&encodedSignedCert, &encodedSignedCertSize);
2373 if (ret)
2374 {
2375 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2376 encodedSignedCert, encodedSignedCertSize);
2377 LocalFree(encodedSignedCert);
2378 }
2379 }
2380 CryptMemFree(sig);
2381 }
2382 return context;
2383 }
2384
2385 /* Copies data from the parameters into info, where:
2386 * pSerialNumber: The serial number. Must not be NULL.
2387 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2388 * Must not be NULL
2389 * pSignatureAlgorithm: Optional.
2390 * pStartTime: The starting time of the certificate. If NULL, the current
2391 * system time is used.
2392 * pEndTime: The ending time of the certificate. If NULL, one year past the
2393 * starting time is used.
2394 * pubKey: The public key of the certificate. Must not be NULL.
2395 * pExtensions: Extensions to be included with the certificate. Optional.
2396 */
2397 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2398 const CERT_NAME_BLOB *pSubjectIssuerBlob,
2399 const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2400 const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2401 const CERT_EXTENSIONS *pExtensions)
2402 {
2403 static CHAR oid[] = szOID_RSA_SHA1RSA;
2404
2405 assert(info);
2406 assert(pSerialNumber);
2407 assert(pSubjectIssuerBlob);
2408 assert(pubKey);
2409
2410 info->dwVersion = CERT_V3;
2411 info->SerialNumber.cbData = pSerialNumber->cbData;
2412 info->SerialNumber.pbData = pSerialNumber->pbData;
2413 if (pSignatureAlgorithm)
2414 memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2415 sizeof(info->SignatureAlgorithm));
2416 else
2417 {
2418 info->SignatureAlgorithm.pszObjId = oid;
2419 info->SignatureAlgorithm.Parameters.cbData = 0;
2420 info->SignatureAlgorithm.Parameters.pbData = NULL;
2421 }
2422 info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2423 info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2424 if (pStartTime)
2425 SystemTimeToFileTime(pStartTime, &info->NotBefore);
2426 else
2427 GetSystemTimeAsFileTime(&info->NotBefore);
2428 if (pEndTime)
2429 SystemTimeToFileTime(pEndTime, &info->NotAfter);
2430 else
2431 {
2432 SYSTEMTIME endTime;
2433
2434 if (FileTimeToSystemTime(&info->NotBefore, &endTime))
2435 {
2436 endTime.wYear++;
2437 SystemTimeToFileTime(&endTime, &info->NotAfter);
2438 }
2439 }
2440 info->Subject.cbData = pSubjectIssuerBlob->cbData;
2441 info->Subject.pbData = pSubjectIssuerBlob->pbData;
2442 memcpy(&info->SubjectPublicKeyInfo, pubKey,
2443 sizeof(info->SubjectPublicKeyInfo));
2444 if (pExtensions)
2445 {
2446 info->cExtension = pExtensions->cExtension;
2447 info->rgExtension = pExtensions->rgExtension;
2448 }
2449 else
2450 {
2451 info->cExtension = 0;
2452 info->rgExtension = NULL;
2453 }
2454 }
2455
2456 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
2457 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
2458 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
2459
2460 static HCRYPTPROV CRYPT_CreateKeyProv(void)
2461 {
2462 HCRYPTPROV hProv = 0;
2463 HMODULE rpcrt = LoadLibraryA("rpcrt4");
2464
2465 if (rpcrt)
2466 {
2467 UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
2468 "UuidCreate");
2469 UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
2470 "UuidToStringA");
2471 RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
2472 rpcrt, "RpcStringFreeA");
2473
2474 if (uuidCreate && uuidToString && rpcStringFree)
2475 {
2476 UUID uuid;
2477 RPC_STATUS status = uuidCreate(&uuid);
2478
2479 if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
2480 {
2481 unsigned char *uuidStr;
2482
2483 status = uuidToString(&uuid, &uuidStr);
2484 if (status == RPC_S_OK)
2485 {
2486 BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
2487 MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
2488
2489 if (ret)
2490 {
2491 HCRYPTKEY key;
2492
2493 ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
2494 if (ret)
2495 CryptDestroyKey(key);
2496 }
2497 rpcStringFree(&uuidStr);
2498 }
2499 }
2500 }
2501 FreeLibrary(rpcrt);
2502 }
2503 return hProv;
2504 }
2505
2506 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
2507 PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
2508 PCRYPT_KEY_PROV_INFO pKeyProvInfo,
2509 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
2510 PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
2511 {
2512 PCCERT_CONTEXT context = NULL;
2513 BOOL ret, releaseContext = FALSE;
2514 PCERT_PUBLIC_KEY_INFO pubKey = NULL;
2515 DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
2516
2517 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
2518 pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
2519 pExtensions, pExtensions);
2520
2521 if(!pSubjectIssuerBlob)
2522 {
2523 SetLastError(ERROR_INVALID_PARAMETER);
2524 return NULL;
2525 }
2526
2527 if (!hProv)
2528 {
2529 if (!pKeyProvInfo)
2530 {
2531 hProv = CRYPT_CreateKeyProv();
2532 releaseContext = TRUE;
2533 }
2534 else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
2535 {
2536 SetLastError(NTE_BAD_FLAGS);
2537 return NULL;
2538 }
2539 else
2540 {
2541 HCRYPTKEY hKey = 0;
2542 /* acquire the context using the given information*/
2543 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2544 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2545 pKeyProvInfo->dwFlags);
2546 if (!ret)
2547 {
2548 if(GetLastError() != NTE_BAD_KEYSET)
2549 return NULL;
2550 /* create the key set */
2551 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2552 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2553 pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
2554 if (!ret)
2555 return NULL;
2556 }
2557 dwKeySpec = pKeyProvInfo->dwKeySpec;
2558 /* check if the key is here */
2559 ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
2560 if(!ret)
2561 {
2562 if (NTE_NO_KEY == GetLastError())
2563 { /* generate the key */
2564 ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
2565 }
2566 if (!ret)
2567 {
2568 CryptReleaseContext(hProv,0);
2569 SetLastError(NTE_BAD_KEYSET);
2570 return NULL;
2571 }
2572 }
2573 CryptDestroyKey(hKey);
2574 releaseContext = TRUE;
2575 }
2576 }
2577 else if (pKeyProvInfo)
2578 {
2579 SetLastError(ERROR_INVALID_PARAMETER);
2580 return NULL;
2581 }
2582
2583 CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
2584 &pubKeySize);
2585 pubKey = CryptMemAlloc(pubKeySize);
2586 if (pubKey)
2587 {
2588 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
2589 pubKey, &pubKeySize);
2590 if (ret)
2591 {
2592 CERT_INFO info = { 0 };
2593 CRYPT_DER_BLOB blob = { 0, NULL };
2594 BYTE serial[16];
2595 CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
2596
2597 CryptGenRandom(hProv, sizeof(serial), serial);
2598 CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
2599 pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
2600 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
2601 &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&blob.pbData,
2602 &blob.cbData);
2603 if (ret)
2604 {
2605 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
2606 context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
2607 &info.SignatureAlgorithm);
2608 else
2609 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2610 blob.pbData, blob.cbData);
2611 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
2612 CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
2613 LocalFree(blob.pbData);
2614 }
2615 }
2616 CryptMemFree(pubKey);
2617 }
2618 if (releaseContext)
2619 CryptReleaseContext(hProv, 0);
2620 return context;
2621 }
2622
2623 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
2624 void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
2625 PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
2626 PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
2627 {
2628 FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
2629 dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
2630 pVerifyUsageStatus);
2631 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
2632 return FALSE;
2633 }
useful hacks and other patches not (yet) suitable for mainline