configure: Changes from running autconf after previous patch.
[wine/hacks.git] / dlls / wintrust / softpub.c
blob9fa0d05d406cba2f8dd6947d7cd8600e7185816d
1 /*
2 * Copyright 2007 Juan Lang
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
18 #include <stdarg.h>
20 #define NONAMELESSUNION
22 #include "windef.h"
23 #include "winbase.h"
24 #include "wintrust.h"
25 #include "mssip.h"
26 #include "softpub.h"
27 #include "wine/debug.h"
29 WINE_DEFAULT_DEBUG_CHANNEL(wintrust);
31 HRESULT WINAPI SoftpubDefCertInit(CRYPT_PROVIDER_DATA *data)
33 HRESULT ret = S_FALSE;
35 TRACE("(%p)\n", data);
37 if (data->padwTrustStepErrors &&
38 !data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_WVTINIT])
39 ret = S_OK;
40 TRACE("returning %08x\n", ret);
41 return ret;
44 HRESULT WINAPI SoftpubInitialize(CRYPT_PROVIDER_DATA *data)
46 HRESULT ret = S_FALSE;
48 TRACE("(%p)\n", data);
50 if (data->padwTrustStepErrors &&
51 !data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_WVTINIT])
52 ret = S_OK;
53 TRACE("returning %08x\n", ret);
54 return ret;
57 HRESULT WINAPI DriverInitializePolicy(CRYPT_PROVIDER_DATA *data)
59 FIXME("stub\n");
60 return S_OK;
63 HRESULT WINAPI DriverCleanupPolicy(CRYPT_PROVIDER_DATA *data)
65 FIXME("stub\n");
66 return S_OK;
69 HRESULT WINAPI DriverFinalPolicy(CRYPT_PROVIDER_DATA *data)
71 FIXME("stub\n");
72 return S_OK;
75 /* Assumes data->pWintrustData->u.pFile exists. Makes sure a file handle is
76 * open for the file.
78 static DWORD SOFTPUB_OpenFile(CRYPT_PROVIDER_DATA *data)
80 DWORD err = ERROR_SUCCESS;
82 /* PSDK implies that all values should be initialized to NULL, so callers
83 * typically have hFile as NULL rather than INVALID_HANDLE_VALUE. Check
84 * for both.
86 if (!data->pWintrustData->u.pFile->hFile ||
87 data->pWintrustData->u.pFile->hFile == INVALID_HANDLE_VALUE)
89 data->pWintrustData->u.pFile->hFile =
90 CreateFileW(data->pWintrustData->u.pFile->pcwszFilePath, GENERIC_READ,
91 FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
92 if (data->pWintrustData->u.pFile->hFile != INVALID_HANDLE_VALUE)
93 data->fOpenedFile = TRUE;
94 else
95 err = GetLastError();
97 if (!err)
98 GetFileTime(data->pWintrustData->u.pFile->hFile, &data->sftSystemTime,
99 NULL, NULL);
100 TRACE("returning %d\n", err);
101 return err;
104 /* Assumes data->pWintrustData->u.pFile exists. Sets data->pPDSip->gSubject to
105 * the file's subject GUID.
107 static DWORD SOFTPUB_GetFileSubject(CRYPT_PROVIDER_DATA *data)
109 DWORD err = ERROR_SUCCESS;
111 if (!WVT_ISINSTRUCT(WINTRUST_FILE_INFO,
112 data->pWintrustData->u.pFile->cbStruct, pgKnownSubject) ||
113 !data->pWintrustData->u.pFile->pgKnownSubject)
115 if (!CryptSIPRetrieveSubjectGuid(
116 data->pWintrustData->u.pFile->pcwszFilePath,
117 data->pWintrustData->u.pFile->hFile,
118 &data->u.pPDSip->gSubject))
119 err = GetLastError();
121 else
122 data->u.pPDSip->gSubject = *data->pWintrustData->u.pFile->pgKnownSubject;
123 TRACE("returning %d\n", err);
124 return err;
127 /* Assumes data->u.pPDSip exists, and its gSubject member set.
128 * Allocates data->u.pPDSip->pSip and loads it, if possible.
130 static DWORD SOFTPUB_GetSIP(CRYPT_PROVIDER_DATA *data)
132 DWORD err = ERROR_SUCCESS;
134 data->u.pPDSip->pSip = data->psPfns->pfnAlloc(sizeof(SIP_DISPATCH_INFO));
135 if (data->u.pPDSip->pSip)
137 if (!CryptSIPLoad(&data->u.pPDSip->gSubject, 0, data->u.pPDSip->pSip))
138 err = GetLastError();
140 else
141 err = ERROR_OUTOFMEMORY;
142 TRACE("returning %d\n", err);
143 return err;
146 /* Assumes data->u.pPDSip has been loaded, and data->u.pPDSip->pSip allocated.
147 * Calls data->u.pPDSip->pSip->pfGet to construct data->hMsg.
149 static DWORD SOFTPUB_GetMessageFromFile(CRYPT_PROVIDER_DATA *data, HANDLE file,
150 LPCWSTR filePath)
152 DWORD err = ERROR_SUCCESS;
153 BOOL ret;
154 LPBYTE buf = NULL;
155 DWORD size = 0;
157 data->u.pPDSip->psSipSubjectInfo =
158 data->psPfns->pfnAlloc(sizeof(SIP_SUBJECTINFO));
159 if (!data->u.pPDSip->psSipSubjectInfo)
160 return ERROR_OUTOFMEMORY;
162 data->u.pPDSip->psSipSubjectInfo->cbSize = sizeof(SIP_SUBJECTINFO);
163 data->u.pPDSip->psSipSubjectInfo->pgSubjectType = &data->u.pPDSip->gSubject;
164 data->u.pPDSip->psSipSubjectInfo->hFile = file;
165 data->u.pPDSip->psSipSubjectInfo->pwsFileName = filePath;
166 data->u.pPDSip->psSipSubjectInfo->hProv = data->hProv;
167 ret = data->u.pPDSip->pSip->pfGet(data->u.pPDSip->psSipSubjectInfo,
168 &data->dwEncoding, 0, &size, 0);
169 if (!ret)
170 return TRUST_E_NOSIGNATURE;
172 buf = data->psPfns->pfnAlloc(size);
173 if (!buf)
174 return ERROR_OUTOFMEMORY;
176 ret = data->u.pPDSip->pSip->pfGet(data->u.pPDSip->psSipSubjectInfo,
177 &data->dwEncoding, 0, &size, buf);
178 if (ret)
180 data->hMsg = CryptMsgOpenToDecode(data->dwEncoding, 0, 0, data->hProv,
181 NULL, NULL);
182 if (data->hMsg)
184 ret = CryptMsgUpdate(data->hMsg, buf, size, TRUE);
185 if (!ret)
186 err = GetLastError();
189 else
190 err = GetLastError();
192 data->psPfns->pfnFree(buf);
193 TRACE("returning %d\n", err);
194 return err;
197 static DWORD SOFTPUB_CreateStoreFromMessage(CRYPT_PROVIDER_DATA *data)
199 DWORD err = ERROR_SUCCESS;
200 HCERTSTORE store;
202 store = CertOpenStore(CERT_STORE_PROV_MSG, data->dwEncoding,
203 data->hProv, CERT_STORE_NO_CRYPT_RELEASE_FLAG, data->hMsg);
204 if (store)
206 if (!data->psPfns->pfnAddStore2Chain(data, store))
207 err = GetLastError();
208 CertCloseStore(store, 0);
210 else
211 err = GetLastError();
212 TRACE("returning %d\n", err);
213 return err;
216 static DWORD SOFTPUB_DecodeInnerContent(CRYPT_PROVIDER_DATA *data)
218 BOOL ret;
219 DWORD size, err = ERROR_SUCCESS;
220 LPSTR oid = NULL;
221 LPBYTE buf = NULL;
223 ret = CryptMsgGetParam(data->hMsg, CMSG_INNER_CONTENT_TYPE_PARAM, 0, NULL,
224 &size);
225 if (!ret)
227 err = GetLastError();
228 goto error;
230 oid = data->psPfns->pfnAlloc(size);
231 if (!oid)
233 err = ERROR_OUTOFMEMORY;
234 goto error;
236 ret = CryptMsgGetParam(data->hMsg, CMSG_INNER_CONTENT_TYPE_PARAM, 0, oid,
237 &size);
238 if (!ret)
240 err = GetLastError();
241 goto error;
243 ret = CryptMsgGetParam(data->hMsg, CMSG_CONTENT_PARAM, 0, NULL, &size);
244 if (!ret)
246 err = GetLastError();
247 goto error;
249 buf = data->psPfns->pfnAlloc(size);
250 if (!buf)
252 err = ERROR_OUTOFMEMORY;
253 goto error;
255 ret = CryptMsgGetParam(data->hMsg, CMSG_CONTENT_PARAM, 0, buf, &size);
256 if (!ret)
258 err = GetLastError();
259 goto error;
261 ret = CryptDecodeObject(data->dwEncoding, oid, buf, size, 0, NULL, &size);
262 if (!ret)
264 err = GetLastError();
265 goto error;
267 data->u.pPDSip->psIndirectData = data->psPfns->pfnAlloc(size);
268 if (!data->u.pPDSip->psIndirectData)
270 err = ERROR_OUTOFMEMORY;
271 goto error;
273 ret = CryptDecodeObject(data->dwEncoding, oid, buf, size, 0,
274 data->u.pPDSip->psIndirectData, &size);
275 if (!ret)
276 err = GetLastError();
278 error:
279 TRACE("returning %d\n", err);
280 data->psPfns->pfnFree(oid);
281 data->psPfns->pfnFree(buf);
282 return err;
285 static DWORD SOFTPUB_LoadCertMessage(CRYPT_PROVIDER_DATA *data)
287 DWORD err = ERROR_SUCCESS;
289 if (data->pWintrustData->u.pCert &&
290 WVT_IS_CBSTRUCT_GT_MEMBEROFFSET(WINTRUST_CERT_INFO,
291 data->pWintrustData->u.pCert->cbStruct, psCertContext))
293 if (data->psPfns)
295 CRYPT_PROVIDER_SGNR signer = { sizeof(signer), { 0 } };
296 DWORD i;
297 BOOL ret;
299 /* Add a signer with nothing but the time to verify, so we can
300 * add a cert to it
302 if (WVT_ISINSTRUCT(WINTRUST_CERT_INFO,
303 data->pWintrustData->u.pCert->cbStruct, psftVerifyAsOf) &&
304 data->pWintrustData->u.pCert->psftVerifyAsOf)
305 data->sftSystemTime = signer.sftVerifyAsOf;
306 else
308 SYSTEMTIME sysTime;
310 GetSystemTime(&sysTime);
311 SystemTimeToFileTime(&sysTime, &signer.sftVerifyAsOf);
313 ret = data->psPfns->pfnAddSgnr2Chain(data, FALSE, 0, &signer);
314 if (ret)
316 ret = data->psPfns->pfnAddCert2Chain(data, 0, FALSE, 0,
317 data->pWintrustData->u.pCert->psCertContext);
318 if (WVT_ISINSTRUCT(WINTRUST_CERT_INFO,
319 data->pWintrustData->u.pCert->cbStruct, pahStores))
320 for (i = 0;
321 ret && i < data->pWintrustData->u.pCert->chStores; i++)
322 ret = data->psPfns->pfnAddStore2Chain(data,
323 data->pWintrustData->u.pCert->pahStores[i]);
325 if (!ret)
326 err = GetLastError();
329 else
330 err = ERROR_INVALID_PARAMETER;
331 return err;
334 static DWORD SOFTPUB_LoadFileMessage(CRYPT_PROVIDER_DATA *data)
336 DWORD err = ERROR_SUCCESS;
338 if (!data->pWintrustData->u.pFile)
340 err = ERROR_INVALID_PARAMETER;
341 goto error;
343 err = SOFTPUB_OpenFile(data);
344 if (err)
345 goto error;
346 err = SOFTPUB_GetFileSubject(data);
347 if (err)
348 goto error;
349 err = SOFTPUB_GetSIP(data);
350 if (err)
351 goto error;
352 err = SOFTPUB_GetMessageFromFile(data, data->pWintrustData->u.pFile->hFile,
353 data->pWintrustData->u.pFile->pcwszFilePath);
354 if (err)
355 goto error;
356 err = SOFTPUB_CreateStoreFromMessage(data);
357 if (err)
358 goto error;
359 err = SOFTPUB_DecodeInnerContent(data);
361 error:
362 if (err && data->fOpenedFile && data->pWintrustData->u.pFile)
364 /* The caller won't expect the file to be open on failure, so close it.
366 CloseHandle(data->pWintrustData->u.pFile->hFile);
367 data->pWintrustData->u.pFile->hFile = INVALID_HANDLE_VALUE;
368 data->fOpenedFile = FALSE;
370 return err;
373 static DWORD SOFTPUB_LoadCatalogMessage(CRYPT_PROVIDER_DATA *data)
375 DWORD err;
376 HANDLE catalog = INVALID_HANDLE_VALUE;
378 if (!data->pWintrustData->u.pCatalog)
380 SetLastError(ERROR_INVALID_PARAMETER);
381 return FALSE;
383 catalog = CreateFileW(data->pWintrustData->u.pCatalog->pcwszCatalogFilePath,
384 GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,
385 NULL);
386 if (catalog == INVALID_HANDLE_VALUE)
387 return GetLastError();
388 if (!CryptSIPRetrieveSubjectGuid(
389 data->pWintrustData->u.pCatalog->pcwszCatalogFilePath, catalog,
390 &data->u.pPDSip->gSubject))
392 err = GetLastError();
393 goto error;
395 err = SOFTPUB_GetSIP(data);
396 if (err)
397 goto error;
398 err = SOFTPUB_GetMessageFromFile(data, catalog,
399 data->pWintrustData->u.pCatalog->pcwszCatalogFilePath);
400 if (err)
401 goto error;
402 err = SOFTPUB_CreateStoreFromMessage(data);
403 if (err)
404 goto error;
405 err = SOFTPUB_DecodeInnerContent(data);
406 /* FIXME: this loads the catalog file, but doesn't validate the member. */
407 error:
408 CloseHandle(catalog);
409 return err;
412 HRESULT WINAPI SoftpubLoadMessage(CRYPT_PROVIDER_DATA *data)
414 DWORD err = ERROR_SUCCESS;
416 TRACE("(%p)\n", data);
418 if (!data->padwTrustStepErrors)
419 return S_FALSE;
421 switch (data->pWintrustData->dwUnionChoice)
423 case WTD_CHOICE_CERT:
424 err = SOFTPUB_LoadCertMessage(data);
425 break;
426 case WTD_CHOICE_FILE:
427 err = SOFTPUB_LoadFileMessage(data);
428 break;
429 case WTD_CHOICE_CATALOG:
430 err = SOFTPUB_LoadCatalogMessage(data);
431 break;
432 default:
433 FIXME("unimplemented for %d\n", data->pWintrustData->dwUnionChoice);
434 err = ERROR_INVALID_PARAMETER;
437 if (err)
438 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_OBJPROV] = err;
439 TRACE("returning %d (%08x)\n", !err ? S_OK : S_FALSE,
440 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_OBJPROV]);
441 return !err ? S_OK : S_FALSE;
444 static CMSG_SIGNER_INFO *WINTRUST_GetSigner(CRYPT_PROVIDER_DATA *data,
445 DWORD signerIdx)
447 BOOL ret;
448 CMSG_SIGNER_INFO *signerInfo = NULL;
449 DWORD size;
451 ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_INFO_PARAM, signerIdx,
452 NULL, &size);
453 if (ret)
455 signerInfo = data->psPfns->pfnAlloc(size);
456 if (signerInfo)
458 ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_INFO_PARAM,
459 signerIdx, signerInfo, &size);
460 if (!ret)
462 data->psPfns->pfnFree(signerInfo);
463 signerInfo = NULL;
466 else
467 SetLastError(ERROR_OUTOFMEMORY);
469 return signerInfo;
472 static DWORD WINTRUST_SaveSigner(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
474 DWORD err;
475 CMSG_SIGNER_INFO *signerInfo = WINTRUST_GetSigner(data, signerIdx);
477 if (signerInfo)
479 CRYPT_PROVIDER_SGNR sgnr = { sizeof(sgnr), { 0 } };
481 sgnr.psSigner = signerInfo;
482 sgnr.sftVerifyAsOf = data->sftSystemTime;
483 if (!data->psPfns->pfnAddSgnr2Chain(data, FALSE, signerIdx, &sgnr))
484 err = GetLastError();
485 else
486 err = ERROR_SUCCESS;
488 else
489 err = GetLastError();
490 return err;
493 static CERT_INFO *WINTRUST_GetSignerCertInfo(CRYPT_PROVIDER_DATA *data,
494 DWORD signerIdx)
496 BOOL ret;
497 CERT_INFO *certInfo = NULL;
498 DWORD size;
500 ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_CERT_INFO_PARAM, signerIdx,
501 NULL, &size);
502 if (ret)
504 certInfo = data->psPfns->pfnAlloc(size);
505 if (certInfo)
507 ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_CERT_INFO_PARAM,
508 signerIdx, certInfo, &size);
509 if (!ret)
511 data->psPfns->pfnFree(certInfo);
512 certInfo = NULL;
515 else
516 SetLastError(ERROR_OUTOFMEMORY);
518 return certInfo;
521 static DWORD WINTRUST_VerifySigner(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
523 DWORD err;
524 CERT_INFO *certInfo = WINTRUST_GetSignerCertInfo(data, signerIdx);
526 if (certInfo)
528 PCCERT_CONTEXT subject = CertGetSubjectCertificateFromStore(
529 data->pahStores[0], data->dwEncoding, certInfo);
531 if (subject)
533 CMSG_CTRL_VERIFY_SIGNATURE_EX_PARA para = { sizeof(para), 0,
534 signerIdx, CMSG_VERIFY_SIGNER_CERT, (LPVOID)subject };
536 if (!CryptMsgControl(data->hMsg, 0, CMSG_CTRL_VERIFY_SIGNATURE_EX,
537 &para))
538 err = TRUST_E_CERT_SIGNATURE;
539 else
541 data->psPfns->pfnAddCert2Chain(data, signerIdx, FALSE, 0,
542 subject);
543 err = ERROR_SUCCESS;
545 CertFreeCertificateContext(subject);
547 else
548 err = TRUST_E_NO_SIGNER_CERT;
549 data->psPfns->pfnFree(certInfo);
551 else
552 err = GetLastError();
553 return err;
556 HRESULT WINAPI SoftpubLoadSignature(CRYPT_PROVIDER_DATA *data)
558 DWORD err;
560 TRACE("(%p)\n", data);
562 if (!data->padwTrustStepErrors)
563 return S_FALSE;
565 if (data->hMsg)
567 DWORD signerCount, size;
569 size = sizeof(signerCount);
570 if (CryptMsgGetParam(data->hMsg, CMSG_SIGNER_COUNT_PARAM, 0,
571 &signerCount, &size))
573 DWORD i;
575 err = ERROR_SUCCESS;
576 for (i = 0; !err && i < signerCount; i++)
578 if (!(err = WINTRUST_SaveSigner(data, i)))
579 err = WINTRUST_VerifySigner(data, i);
582 else
583 err = TRUST_E_NOSIGNATURE;
585 else
586 err = ERROR_SUCCESS;
587 if (err)
588 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_SIGPROV] = err;
589 return !err ? S_OK : S_FALSE;
592 static DWORD WINTRUST_TrustStatusToConfidence(DWORD errorStatus)
594 DWORD confidence = 0;
596 confidence = 0;
597 if (!(errorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID))
598 confidence |= CERT_CONFIDENCE_SIG;
599 if (!(errorStatus & CERT_TRUST_IS_NOT_TIME_VALID))
600 confidence |= CERT_CONFIDENCE_TIME;
601 if (!(errorStatus & CERT_TRUST_IS_NOT_TIME_NESTED))
602 confidence |= CERT_CONFIDENCE_TIMENEST;
603 return confidence;
606 BOOL WINAPI SoftpubCheckCert(CRYPT_PROVIDER_DATA *data, DWORD idxSigner,
607 BOOL fCounterSignerChain, DWORD idxCounterSigner)
609 BOOL ret;
611 TRACE("(%p, %d, %d, %d)\n", data, idxSigner, fCounterSignerChain,
612 idxCounterSigner);
614 if (fCounterSignerChain)
616 FIXME("unimplemented for counter signers\n");
617 ret = FALSE;
619 else
621 PCERT_SIMPLE_CHAIN simpleChain =
622 data->pasSigners[idxSigner].pChainContext->rgpChain[0];
623 DWORD i;
625 ret = TRUE;
626 for (i = 0; i < simpleChain->cElement; i++)
628 /* Set confidence */
629 data->pasSigners[idxSigner].pasCertChain[i].dwConfidence =
630 WINTRUST_TrustStatusToConfidence(
631 simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus);
632 /* Set additional flags */
633 if (!(simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
634 CERT_TRUST_IS_UNTRUSTED_ROOT))
635 data->pasSigners[idxSigner].pasCertChain[i].fTrustedRoot = TRUE;
636 if (simpleChain->rgpElement[i]->TrustStatus.dwInfoStatus &
637 CERT_TRUST_IS_SELF_SIGNED)
638 data->pasSigners[idxSigner].pasCertChain[i].fSelfSigned = TRUE;
639 if (simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
640 CERT_TRUST_IS_CYCLIC)
641 data->pasSigners[idxSigner].pasCertChain[i].fIsCyclic = TRUE;
644 return ret;
647 static DWORD WINTRUST_TrustStatusToError(DWORD errorStatus)
649 DWORD error;
651 if (errorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
652 error = TRUST_E_CERT_SIGNATURE;
653 else if (errorStatus & CERT_TRUST_IS_UNTRUSTED_ROOT)
654 error = CERT_E_UNTRUSTEDROOT;
655 else if (errorStatus & CERT_TRUST_IS_NOT_TIME_VALID)
656 error = CERT_E_EXPIRED;
657 else if (errorStatus & CERT_TRUST_IS_NOT_TIME_NESTED)
658 error = CERT_E_VALIDITYPERIODNESTING;
659 else if (errorStatus & CERT_TRUST_IS_REVOKED)
660 error = CERT_E_REVOKED;
661 else if (errorStatus & CERT_TRUST_IS_OFFLINE_REVOCATION ||
662 errorStatus & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
663 error = CERT_E_REVOCATION_FAILURE;
664 else if (errorStatus & CERT_TRUST_IS_NOT_VALID_FOR_USAGE)
665 error = CERT_E_WRONG_USAGE;
666 else if (errorStatus & CERT_TRUST_IS_CYCLIC)
667 error = CERT_E_CHAINING;
668 else if (errorStatus & CERT_TRUST_INVALID_EXTENSION)
669 error = CERT_E_CRITICAL;
670 else if (errorStatus & CERT_TRUST_INVALID_POLICY_CONSTRAINTS)
671 error = CERT_E_INVALID_POLICY;
672 else if (errorStatus & CERT_TRUST_INVALID_BASIC_CONSTRAINTS)
673 error = TRUST_E_BASIC_CONSTRAINTS;
674 else if (errorStatus & CERT_TRUST_INVALID_NAME_CONSTRAINTS ||
675 errorStatus & CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT ||
676 errorStatus & CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT ||
677 errorStatus & CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT ||
678 errorStatus & CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT)
679 error = CERT_E_INVALID_NAME;
680 else if (errorStatus & CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY)
681 error = CERT_E_INVALID_POLICY;
682 else if (errorStatus)
684 FIXME("unknown error status %08x\n", errorStatus);
685 error = TRUST_E_SYSTEM_ERROR;
687 else
688 error = S_OK;
689 return error;
692 static DWORD WINTRUST_CopyChain(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
694 DWORD err, i;
695 PCERT_SIMPLE_CHAIN simpleChain =
696 data->pasSigners[signerIdx].pChainContext->rgpChain[0];
698 data->pasSigners[signerIdx].pasCertChain[0].dwConfidence =
699 WINTRUST_TrustStatusToConfidence(
700 simpleChain->rgpElement[0]->TrustStatus.dwErrorStatus);
701 data->pasSigners[signerIdx].pasCertChain[0].pChainElement =
702 simpleChain->rgpElement[0];
703 err = ERROR_SUCCESS;
704 for (i = 1; !err && i < simpleChain->cElement; i++)
706 if (data->psPfns->pfnAddCert2Chain(data, signerIdx, FALSE, 0,
707 simpleChain->rgpElement[i]->pCertContext))
709 data->pasSigners[signerIdx].pasCertChain[i].pChainElement =
710 simpleChain->rgpElement[i];
711 data->pasSigners[signerIdx].pasCertChain[i].dwConfidence =
712 WINTRUST_TrustStatusToConfidence(
713 simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus);
715 else
716 err = GetLastError();
718 data->pasSigners[signerIdx].pasCertChain[simpleChain->cElement - 1].dwError
719 = WINTRUST_TrustStatusToError(
720 simpleChain->rgpElement[simpleChain->cElement - 1]->
721 TrustStatus.dwErrorStatus);
722 return err;
725 static void WINTRUST_CreateChainPolicyCreateInfo(
726 const CRYPT_PROVIDER_DATA *data, PWTD_GENERIC_CHAIN_POLICY_CREATE_INFO info,
727 PCERT_CHAIN_PARA chainPara)
729 chainPara->cbSize = sizeof(CERT_CHAIN_PARA);
730 if (data->pRequestUsage)
731 chainPara->RequestedUsage = *data->pRequestUsage;
732 else
734 chainPara->RequestedUsage.dwType = 0;
735 chainPara->RequestedUsage.Usage.cUsageIdentifier = 0;
737 info->u.cbSize = sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO);
738 info->hChainEngine = NULL;
739 info->pChainPara = chainPara;
740 if (data->dwProvFlags & CPD_REVOCATION_CHECK_END_CERT)
741 info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_END_CERT;
742 else if (data->dwProvFlags & CPD_REVOCATION_CHECK_CHAIN)
743 info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN;
744 else if (data->dwProvFlags & CPD_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT)
745 info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT;
746 else
747 info->dwFlags = 0;
748 info->pvReserved = NULL;
751 static DWORD WINTRUST_CreateChainForSigner(CRYPT_PROVIDER_DATA *data,
752 DWORD signer, PWTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo,
753 PCERT_CHAIN_PARA chainPara)
755 DWORD err = ERROR_SUCCESS;
756 HCERTSTORE store = NULL;
758 if (data->chStores)
760 store = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
761 CERT_STORE_CREATE_NEW_FLAG, NULL);
762 if (store)
764 DWORD i;
766 for (i = 0; i < data->chStores; i++)
767 CertAddStoreToCollection(store, data->pahStores[i], 0, 0);
769 else
770 err = GetLastError();
772 if (!err)
774 /* Expect the end certificate for each signer to be the only cert in
775 * the chain:
777 if (data->pasSigners[signer].csCertChain)
779 BOOL ret;
781 /* Create a certificate chain for each signer */
782 ret = CertGetCertificateChain(createInfo->hChainEngine,
783 data->pasSigners[signer].pasCertChain[0].pCert,
784 &data->pasSigners[signer].sftVerifyAsOf, store,
785 chainPara, createInfo->dwFlags, createInfo->pvReserved,
786 &data->pasSigners[signer].pChainContext);
787 if (ret)
789 if (data->pasSigners[signer].pChainContext->cChain != 1)
791 FIXME("unimplemented for more than 1 simple chain\n");
792 err = E_NOTIMPL;
794 else
796 if (!(err = WINTRUST_CopyChain(data, signer)))
798 if (data->psPfns->pfnCertCheckPolicy)
800 ret = data->psPfns->pfnCertCheckPolicy(data, signer,
801 FALSE, 0);
802 if (!ret)
803 err = GetLastError();
805 else
806 TRACE(
807 "no cert check policy, skipping policy check\n");
811 else
812 err = GetLastError();
814 CertCloseStore(store, 0);
816 return err;
819 HRESULT WINAPI WintrustCertificateTrust(CRYPT_PROVIDER_DATA *data)
821 DWORD err;
823 TRACE("(%p)\n", data);
825 if (!data->csSigners)
826 err = TRUST_E_NOSIGNATURE;
827 else
829 DWORD i;
830 WTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo;
831 CERT_CHAIN_PARA chainPara;
833 WINTRUST_CreateChainPolicyCreateInfo(data, &createInfo, &chainPara);
834 err = ERROR_SUCCESS;
835 for (i = 0; !err && i < data->csSigners; i++)
836 err = WINTRUST_CreateChainForSigner(data, i, &createInfo,
837 &chainPara);
839 if (err)
840 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV] = err;
841 TRACE("returning %d (%08x)\n", !err ? S_OK : S_FALSE,
842 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV]);
843 return !err ? S_OK : S_FALSE;
846 HRESULT WINAPI GenericChainCertificateTrust(CRYPT_PROVIDER_DATA *data)
848 DWORD err;
849 WTD_GENERIC_CHAIN_POLICY_DATA *policyData =
850 data->pWintrustData->pPolicyCallbackData;
852 TRACE("(%p)\n", data);
854 if (policyData && policyData->u.cbSize !=
855 sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO))
857 err = ERROR_INVALID_PARAMETER;
858 goto end;
860 if (!data->csSigners)
861 err = TRUST_E_NOSIGNATURE;
862 else
864 DWORD i;
865 WTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo, *pCreateInfo;
866 CERT_CHAIN_PARA chainPara, *pChainPara;
868 if (policyData)
870 pCreateInfo = policyData->pSignerChainInfo;
871 pChainPara = pCreateInfo->pChainPara;
873 else
875 WINTRUST_CreateChainPolicyCreateInfo(data, &createInfo, &chainPara);
876 pChainPara = &chainPara;
877 pCreateInfo = &createInfo;
879 err = ERROR_SUCCESS;
880 for (i = 0; !err && i < data->csSigners; i++)
881 err = WINTRUST_CreateChainForSigner(data, i, pCreateInfo,
882 pChainPara);
885 end:
886 if (err)
887 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV] = err;
888 TRACE("returning %d (%08x)\n", !err ? S_OK : S_FALSE,
889 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV]);
890 return !err ? S_OK : S_FALSE;
893 HRESULT WINAPI SoftpubAuthenticode(CRYPT_PROVIDER_DATA *data)
895 BOOL ret;
896 CERT_CHAIN_POLICY_STATUS policyStatus = { sizeof(policyStatus), 0 };
898 TRACE("(%p)\n", data);
900 if (data->pWintrustData->dwUIChoice != WTD_UI_NONE)
901 FIXME("unimplemented for UI choice %d\n",
902 data->pWintrustData->dwUIChoice);
903 if (!data->csSigners)
905 ret = FALSE;
906 policyStatus.dwError = TRUST_E_NOSIGNATURE;
908 else
910 DWORD i;
912 ret = TRUE;
913 for (i = 0; ret && i < data->csSigners; i++)
915 BYTE hash[20];
916 DWORD size = sizeof(hash);
918 /* First make sure cert isn't disallowed */
919 if ((ret = CertGetCertificateContextProperty(
920 data->pasSigners[i].pasCertChain[0].pCert,
921 CERT_SIGNATURE_HASH_PROP_ID, hash, &size)))
923 static const WCHAR disallowedW[] =
924 { 'D','i','s','a','l','l','o','w','e','d',0 };
925 HCERTSTORE disallowed = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,
926 X509_ASN_ENCODING, 0, CERT_SYSTEM_STORE_CURRENT_USER,
927 disallowedW);
929 if (disallowed)
931 PCCERT_CONTEXT found = CertFindCertificateInStore(
932 disallowed, X509_ASN_ENCODING, 0, CERT_FIND_SIGNATURE_HASH,
933 hash, NULL);
935 if (found)
937 /* Disallowed! Can't verify it. */
938 policyStatus.dwError = TRUST_E_SUBJECT_NOT_TRUSTED;
939 ret = FALSE;
940 CertFreeCertificateContext(found);
942 CertCloseStore(disallowed, 0);
945 if (ret)
947 CERT_CHAIN_POLICY_PARA policyPara = { sizeof(policyPara), 0 };
949 if (data->dwRegPolicySettings & WTPF_TRUSTTEST)
950 policyPara.dwFlags |= CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG;
951 if (data->dwRegPolicySettings & WTPF_TESTCANBEVALID)
952 policyPara.dwFlags |= CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG;
953 if (data->dwRegPolicySettings & WTPF_IGNOREEXPIRATION)
954 policyPara.dwFlags |=
955 CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG |
956 CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG |
957 CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG;
958 if (data->dwRegPolicySettings & WTPF_IGNOREREVOKATION)
959 policyPara.dwFlags |=
960 CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG |
961 CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG |
962 CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG |
963 CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG;
964 CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_AUTHENTICODE,
965 data->pasSigners[i].pChainContext, &policyPara, &policyStatus);
966 if (policyStatus.dwError != NO_ERROR)
967 ret = FALSE;
971 if (!ret)
972 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV] =
973 policyStatus.dwError;
974 TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
975 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV]);
976 return ret ? S_OK : S_FALSE;
979 static HRESULT WINAPI WINTRUST_DefaultPolicy(CRYPT_PROVIDER_DATA *pProvData,
980 DWORD dwStepError, DWORD dwRegPolicySettings, DWORD cSigner,
981 PWTD_GENERIC_CHAIN_POLICY_SIGNER_INFO rgpSigner, void *pvPolicyArg)
983 DWORD i;
984 CERT_CHAIN_POLICY_STATUS policyStatus = { sizeof(policyStatus), 0 };
986 for (i = 0; !policyStatus.dwError && i < cSigner; i++)
988 CERT_CHAIN_POLICY_PARA policyPara = { sizeof(policyPara), 0 };
990 if (dwRegPolicySettings & WTPF_IGNOREEXPIRATION)
991 policyPara.dwFlags |=
992 CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG |
993 CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG |
994 CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG;
995 if (dwRegPolicySettings & WTPF_IGNOREREVOKATION)
996 policyPara.dwFlags |=
997 CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG |
998 CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG |
999 CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG |
1000 CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG;
1001 CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE,
1002 rgpSigner[i].pChainContext, &policyPara, &policyStatus);
1004 return policyStatus.dwError;
1007 HRESULT WINAPI GenericChainFinalProv(CRYPT_PROVIDER_DATA *data)
1009 HRESULT err = NO_ERROR; /* not a typo, MS confused the types */
1010 WTD_GENERIC_CHAIN_POLICY_DATA *policyData =
1011 data->pWintrustData->pPolicyCallbackData;
1013 TRACE("(%p)\n", data);
1015 if (data->pWintrustData->dwUIChoice != WTD_UI_NONE)
1016 FIXME("unimplemented for UI choice %d\n",
1017 data->pWintrustData->dwUIChoice);
1018 if (!data->csSigners)
1019 err = TRUST_E_NOSIGNATURE;
1020 else
1022 PFN_WTD_GENERIC_CHAIN_POLICY_CALLBACK policyCallback;
1023 void *policyArg;
1024 WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO *signers = NULL;
1026 if (policyData)
1028 policyCallback = policyData->pfnPolicyCallback;
1029 policyArg = policyData->pvPolicyArg;
1031 else
1033 policyCallback = WINTRUST_DefaultPolicy;
1034 policyArg = NULL;
1036 if (data->csSigners)
1038 DWORD i;
1040 signers = data->psPfns->pfnAlloc(
1041 data->csSigners * sizeof(WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO));
1042 if (signers)
1044 for (i = 0; i < data->csSigners; i++)
1046 signers[i].u.cbSize =
1047 sizeof(WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO);
1048 signers[i].pChainContext =
1049 data->pasSigners[i].pChainContext;
1050 signers[i].dwSignerType = data->pasSigners[i].dwSignerType;
1051 signers[i].pMsgSignerInfo = data->pasSigners[i].psSigner;
1052 signers[i].dwError = data->pasSigners[i].dwError;
1053 if (data->pasSigners[i].csCounterSigners)
1054 FIXME("unimplemented for counter signers\n");
1055 signers[i].cCounterSigner = 0;
1056 signers[i].rgpCounterSigner = NULL;
1059 else
1060 err = ERROR_OUTOFMEMORY;
1062 if (err == NO_ERROR)
1063 err = policyCallback(data, TRUSTERROR_STEP_FINAL_POLICYPROV,
1064 data->dwRegPolicySettings, data->csSigners, signers, policyArg);
1065 data->psPfns->pfnFree(signers);
1067 if (err != NO_ERROR)
1068 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV] = err;
1069 TRACE("returning %d (%08x)\n", err == NO_ERROR ? S_OK : S_FALSE,
1070 data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV]);
1071 return err == NO_ERROR ? S_OK : S_FALSE;
1074 HRESULT WINAPI SoftpubCleanup(CRYPT_PROVIDER_DATA *data)
1076 DWORD i, j;
1078 for (i = 0; i < data->csSigners; i++)
1080 for (j = 0; j < data->pasSigners[i].csCertChain; j++)
1081 CertFreeCertificateContext(data->pasSigners[i].pasCertChain[j].pCert);
1082 data->psPfns->pfnFree(data->pasSigners[i].pasCertChain);
1083 data->psPfns->pfnFree(data->pasSigners[i].psSigner);
1084 CertFreeCertificateChain(data->pasSigners[i].pChainContext);
1086 data->psPfns->pfnFree(data->pasSigners);
1088 for (i = 0; i < data->chStores; i++)
1089 CertCloseStore(data->pahStores[i], 0);
1090 data->psPfns->pfnFree(data->pahStores);
1092 if (data->u.pPDSip)
1094 data->psPfns->pfnFree(data->u.pPDSip->pSip);
1095 data->psPfns->pfnFree(data->u.pPDSip->pCATSip);
1096 data->psPfns->pfnFree(data->u.pPDSip->psSipSubjectInfo);
1097 data->psPfns->pfnFree(data->u.pPDSip->psSipCATSubjectInfo);
1098 data->psPfns->pfnFree(data->u.pPDSip->psIndirectData);
1101 CryptMsgClose(data->hMsg);
1103 if (data->fOpenedFile &&
1104 data->pWintrustData->dwUnionChoice == WTD_CHOICE_FILE)
1105 CloseHandle(data->pWintrustData->u.pFile->hFile);
1107 return S_OK;
1110 HRESULT WINAPI HTTPSCertificateTrust(CRYPT_PROVIDER_DATA *data)
1112 FIXME("(%p)\n", data);
1113 return S_OK;
1116 HRESULT WINAPI HTTPSFinalProv(CRYPT_PROVIDER_DATA *data)
1118 FIXME("(%p)\n", data);
1119 return S_OK;