?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
push 52d6b63ba2f2d4f9b02b6b922d27bff05a60596f
[wine/hacks.git] / dlls / crypt32 / cert.c
blobf88cf95d5c8533109db55e5f936de76ca2b354ab
1 /*
2 * Copyright 2004-2006 Juan Lang
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17 *
18 */
19
20 #include <assert.h>
21 #include <stdarg.h>
22
23 #define NONAMELESSUNION
24 #include "windef.h"
25 #include "winbase.h"
26 #include "wincrypt.h"
27 #include "winnls.h"
28 #include "rpc.h"
29 #include "wine/debug.h"
30 #include "wine/unicode.h"
31 #include "crypt32_private.h"
32
33 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
34
35 /* Internal version of CertGetCertificateContextProperty that gets properties
36 * directly from the context (or the context it's linked to, depending on its
37 * type.) Doesn't handle special-case properties, since they are handled by
38 * CertGetCertificateContextProperty, and are particular to the store in which
39 * the property exists (which is separate from the context.)
40 */
41 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
42 void *pvData, DWORD *pcbData);
43
44 /* Internal version of CertSetCertificateContextProperty that sets properties
45 * directly on the context (or the context it's linked to, depending on its
46 * type.) Doesn't handle special cases, since they're handled by
47 * CertSetCertificateContextProperty anyway.
48 */
49 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
50 DWORD dwFlags, const void *pvData);
51
52 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
53 DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
54 DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
55 {
56 PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
57 pbCertEncoded, cbCertEncoded);
58 BOOL ret;
59
60 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
61 pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
62
63 if (cert)
64 {
65 ret = CertAddCertificateContextToStore(hCertStore, cert,
66 dwAddDisposition, ppCertContext);
67 CertFreeCertificateContext(cert);
68 }
69 else
70 ret = FALSE;
71 return ret;
72 }
73
74 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
75 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
76 {
77 PCERT_CONTEXT cert = NULL;
78 BOOL ret;
79 PCERT_INFO certInfo = NULL;
80 DWORD size = 0;
81
82 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
83 cbCertEncoded);
84
85 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
86 pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
87 &certInfo, &size);
88 if (ret)
89 {
90 BYTE *data = NULL;
91
92 cert = Context_CreateDataContext(sizeof(CERT_CONTEXT));
93 if (!cert)
94 goto end;
95 data = CryptMemAlloc(cbCertEncoded);
96 if (!data)
97 {
98 CryptMemFree(cert);
99 cert = NULL;
100 goto end;
101 }
102 memcpy(data, pbCertEncoded, cbCertEncoded);
103 cert->dwCertEncodingType = dwCertEncodingType;
104 cert->pbCertEncoded = data;
105 cert->cbCertEncoded = cbCertEncoded;
106 cert->pCertInfo = certInfo;
107 cert->hCertStore = 0;
108 }
109
110 end:
111 return cert;
112 }
113
114 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
115 PCCERT_CONTEXT pCertContext)
116 {
117 TRACE("(%p)\n", pCertContext);
118
119 if (!pCertContext)
120 return NULL;
121
122 Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
123 return pCertContext;
124 }
125
126 static void CertDataContext_Free(void *context)
127 {
128 PCERT_CONTEXT certContext = context;
129
130 CryptMemFree(certContext->pbCertEncoded);
131 LocalFree(certContext->pCertInfo);
132 }
133
134 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
135 {
136 TRACE("(%p)\n", pCertContext);
137
138 if (pCertContext)
139 Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
140 CertDataContext_Free);
141 return TRUE;
142 }
143
144 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
145 DWORD dwPropId)
146 {
147 PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
148 pCertContext, sizeof(CERT_CONTEXT));
149 DWORD ret;
150
151 TRACE("(%p, %d)\n", pCertContext, dwPropId);
152
153 if (properties)
154 ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
155 else
156 ret = 0;
157 return ret;
158 }
159
160 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
161 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
162 DWORD *pcbData)
163 {
164 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
165 pcbData);
166 if (ret && pvData)
167 {
168 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
169
170 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
171 }
172 return ret;
173 }
174
175 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
176 DWORD cb)
177 {
178 BOOL ret = TRUE;
179
180 if (!pvData)
181 *pcbData = cb;
182 else if (*pcbData < cb)
183 {
184 SetLastError(ERROR_MORE_DATA);
185 *pcbData = cb;
186 ret = FALSE;
187 }
188 else
189 {
190 memcpy(pvData, pb, cb);
191 *pcbData = cb;
192 }
193 return ret;
194 }
195
196 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
197 void *pvData, DWORD *pcbData)
198 {
199 PCCERT_CONTEXT pCertContext = context;
200 PCONTEXT_PROPERTY_LIST properties =
201 Context_GetProperties(context, sizeof(CERT_CONTEXT));
202 BOOL ret;
203 CRYPT_DATA_BLOB blob;
204
205 TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
206
207 if (properties)
208 ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
209 else
210 ret = FALSE;
211 if (ret)
212 ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
213 else
214 {
215 /* Implicit properties */
216 switch (dwPropId)
217 {
218 case CERT_SHA1_HASH_PROP_ID:
219 ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
220 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
221 pcbData);
222 break;
223 case CERT_MD5_HASH_PROP_ID:
224 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
225 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
226 pcbData);
227 break;
228 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
229 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
230 pCertContext->pCertInfo->Subject.pbData,
231 pCertContext->pCertInfo->Subject.cbData,
232 pvData, pcbData);
233 break;
234 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
235 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
236 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
237 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
238 pvData, pcbData);
239 break;
240 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
241 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
242 pCertContext->pCertInfo->SerialNumber.pbData,
243 pCertContext->pCertInfo->SerialNumber.cbData,
244 pvData, pcbData);
245 break;
246 case CERT_SIGNATURE_HASH_PROP_ID:
247 ret = CryptHashToBeSigned(0, pCertContext->dwCertEncodingType,
248 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
249 pcbData);
250 if (ret && pvData)
251 {
252 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
253
254 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
255 }
256 break;
257 case CERT_KEY_IDENTIFIER_PROP_ID:
258 {
259 PCERT_EXTENSION ext = CertFindExtension(
260 szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
261 pCertContext->pCertInfo->rgExtension);
262
263 if (ext)
264 {
265 CRYPT_DATA_BLOB value;
266 DWORD size = sizeof(value);
267
268 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
269 szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
270 ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
271 &size);
272 if (ret)
273 {
274 ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
275 value.cbData);
276 CertContext_SetProperty(context, dwPropId, 0, &value);
277 }
278 }
279 else
280 SetLastError(ERROR_INVALID_DATA);
281 break;
282 }
283 default:
284 SetLastError(CRYPT_E_NOT_FOUND);
285 }
286 }
287 TRACE("returning %d\n", ret);
288 return ret;
289 }
290
291 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
292 {
293 DWORD i, containerLen, provNameLen;
294 LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
295
296 info->pwszContainerName = (LPWSTR)data;
297 containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
298 data += containerLen;
299
300 info->pwszProvName = (LPWSTR)data;
301 provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
302 data += provNameLen;
303
304 info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
305 data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
306
307 for (i = 0; i < info->cProvParam; i++)
308 {
309 info->rgProvParam[i].pbData = data;
310 data += info->rgProvParam[i].cbData;
311 }
312 }
313
314 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
315 DWORD dwPropId, void *pvData, DWORD *pcbData)
316 {
317 BOOL ret;
318
319 TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
320
321 switch (dwPropId)
322 {
323 case 0:
324 case CERT_CERT_PROP_ID:
325 case CERT_CRL_PROP_ID:
326 case CERT_CTL_PROP_ID:
327 SetLastError(E_INVALIDARG);
328 ret = FALSE;
329 break;
330 case CERT_ACCESS_STATE_PROP_ID:
331 if (pCertContext->hCertStore)
332 ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
333 pvData, pcbData);
334 else
335 {
336 DWORD state = 0;
337
338 ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
339 }
340 break;
341 case CERT_KEY_PROV_HANDLE_PROP_ID:
342 {
343 CERT_KEY_CONTEXT keyContext;
344 DWORD size = sizeof(keyContext);
345
346 ret = CertContext_GetProperty((void *)pCertContext,
347 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
348 if (ret)
349 ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
350 sizeof(keyContext.hCryptProv));
351 break;
352 }
353 case CERT_KEY_PROV_INFO_PROP_ID:
354 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
355 pcbData);
356 if (ret && pvData)
357 CRYPT_FixKeyProvInfoPointers(pvData);
358 break;
359 default:
360 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
361 pcbData);
362 }
363
364 TRACE("returning %d\n", ret);
365 return ret;
366 }
367
368 /* Copies key provider info from from into to, where to is assumed to be a
369 * contiguous buffer of memory large enough for from and all its associated
370 * data, but whose pointers are uninitialized.
371 * Upon return, to contains a contiguous copy of from, packed in the following
372 * order:
373 * - CRYPT_KEY_PROV_INFO
374 * - pwszContainerName
375 * - pwszProvName
376 * - rgProvParam[0]...
377 */
378 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
379 const CRYPT_KEY_PROV_INFO *from)
380 {
381 DWORD i;
382 LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
383
384 if (from->pwszContainerName)
385 {
386 to->pwszContainerName = (LPWSTR)nextData;
387 lstrcpyW(to->pwszContainerName, from->pwszContainerName);
388 nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
389 }
390 else
391 to->pwszContainerName = NULL;
392 if (from->pwszProvName)
393 {
394 to->pwszProvName = (LPWSTR)nextData;
395 lstrcpyW(to->pwszProvName, from->pwszProvName);
396 nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
397 }
398 else
399 to->pwszProvName = NULL;
400 to->dwProvType = from->dwProvType;
401 to->dwFlags = from->dwFlags;
402 to->cProvParam = from->cProvParam;
403 to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
404 nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
405 to->dwKeySpec = from->dwKeySpec;
406 for (i = 0; i < to->cProvParam; i++)
407 {
408 memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
409 sizeof(CRYPT_KEY_PROV_PARAM));
410 to->rgProvParam[i].pbData = nextData;
411 memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
412 from->rgProvParam[i].cbData);
413 nextData += from->rgProvParam[i].cbData;
414 }
415 }
416
417 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
418 const CRYPT_KEY_PROV_INFO *info)
419 {
420 BOOL ret;
421 LPBYTE buf = NULL;
422 DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
423
424 if (info->pwszContainerName)
425 containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
426 else
427 containerSize = 0;
428 if (info->pwszProvName)
429 provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
430 else
431 provNameSize = 0;
432 size += containerSize + provNameSize;
433 for (i = 0; i < info->cProvParam; i++)
434 size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
435 buf = CryptMemAlloc(size);
436 if (buf)
437 {
438 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
439 ret = ContextPropertyList_SetProperty(properties,
440 CERT_KEY_PROV_INFO_PROP_ID, buf, size);
441 CryptMemFree(buf);
442 }
443 else
444 ret = FALSE;
445 return ret;
446 }
447
448 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
449 DWORD dwFlags, const void *pvData)
450 {
451 PCONTEXT_PROPERTY_LIST properties =
452 Context_GetProperties(context, sizeof(CERT_CONTEXT));
453 BOOL ret;
454
455 TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
456
457 if (!properties)
458 ret = FALSE;
459 else
460 {
461 switch (dwPropId)
462 {
463 case CERT_AUTO_ENROLL_PROP_ID:
464 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
465 case CERT_DESCRIPTION_PROP_ID:
466 case CERT_FRIENDLY_NAME_PROP_ID:
467 case CERT_HASH_PROP_ID:
468 case CERT_KEY_IDENTIFIER_PROP_ID:
469 case CERT_MD5_HASH_PROP_ID:
470 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
471 case CERT_PUBKEY_ALG_PARA_PROP_ID:
472 case CERT_PVK_FILE_PROP_ID:
473 case CERT_SIGNATURE_HASH_PROP_ID:
474 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
475 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
476 case CERT_EXTENDED_ERROR_INFO_PROP_ID:
477 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
478 case CERT_ENROLLMENT_PROP_ID:
479 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
480 case CERT_RENEWAL_PROP_ID:
481 {
482 if (pvData)
483 {
484 const CRYPT_DATA_BLOB *blob = pvData;
485
486 ret = ContextPropertyList_SetProperty(properties, dwPropId,
487 blob->pbData, blob->cbData);
488 }
489 else
490 {
491 ContextPropertyList_RemoveProperty(properties, dwPropId);
492 ret = TRUE;
493 }
494 break;
495 }
496 case CERT_DATE_STAMP_PROP_ID:
497 if (pvData)
498 ret = ContextPropertyList_SetProperty(properties, dwPropId,
499 pvData, sizeof(FILETIME));
500 else
501 {
502 ContextPropertyList_RemoveProperty(properties, dwPropId);
503 ret = TRUE;
504 }
505 break;
506 case CERT_KEY_CONTEXT_PROP_ID:
507 {
508 if (pvData)
509 {
510 const CERT_KEY_CONTEXT *keyContext = pvData;
511
512 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
513 {
514 SetLastError(E_INVALIDARG);
515 ret = FALSE;
516 }
517 else
518 ret = ContextPropertyList_SetProperty(properties, dwPropId,
519 (const BYTE *)keyContext, keyContext->cbSize);
520 }
521 else
522 {
523 ContextPropertyList_RemoveProperty(properties, dwPropId);
524 ret = TRUE;
525 }
526 break;
527 }
528 case CERT_KEY_PROV_INFO_PROP_ID:
529 if (pvData)
530 ret = CertContext_SetKeyProvInfoProperty(properties, pvData);
531 else
532 {
533 ContextPropertyList_RemoveProperty(properties, dwPropId);
534 ret = TRUE;
535 }
536 break;
537 case CERT_KEY_PROV_HANDLE_PROP_ID:
538 {
539 CERT_KEY_CONTEXT keyContext;
540 DWORD size = sizeof(keyContext);
541
542 ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
543 &keyContext, &size);
544 if (ret)
545 {
546 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
547 CryptReleaseContext(keyContext.hCryptProv, 0);
548 }
549 keyContext.cbSize = sizeof(keyContext);
550 if (pvData)
551 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
552 else
553 {
554 keyContext.hCryptProv = 0;
555 keyContext.dwKeySpec = AT_SIGNATURE;
556 }
557 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
558 0, &keyContext);
559 break;
560 }
561 default:
562 FIXME("%d: stub\n", dwPropId);
563 ret = FALSE;
564 }
565 }
566 TRACE("returning %d\n", ret);
567 return ret;
568 }
569
570 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
571 DWORD dwPropId, DWORD dwFlags, const void *pvData)
572 {
573 BOOL ret;
574
575 TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
576
577 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
578 * crashes on most of these, I'll be safer.
579 */
580 switch (dwPropId)
581 {
582 case 0:
583 case CERT_ACCESS_STATE_PROP_ID:
584 case CERT_CERT_PROP_ID:
585 case CERT_CRL_PROP_ID:
586 case CERT_CTL_PROP_ID:
587 SetLastError(E_INVALIDARG);
588 return FALSE;
589 }
590 ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
591 pvData);
592 TRACE("returning %d\n", ret);
593 return ret;
594 }
595
596 /* Acquires the private key using the key provider info, retrieving info from
597 * the certificate if info is NULL. The acquired provider is returned in
598 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
599 */
600 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
601 PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
602 {
603 DWORD size = 0;
604 BOOL allocated = FALSE, ret = TRUE;
605
606 if (!info)
607 {
608 ret = CertGetCertificateContextProperty(pCert,
609 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
610 if (ret)
611 {
612 info = HeapAlloc(GetProcessHeap(), 0, size);
613 if (info)
614 {
615 ret = CertGetCertificateContextProperty(pCert,
616 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
617 allocated = TRUE;
618 }
619 else
620 {
621 SetLastError(ERROR_OUTOFMEMORY);
622 ret = FALSE;
623 }
624 }
625 else
626 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
627 }
628 if (ret)
629 {
630 ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
631 info->pwszProvName, info->dwProvType, 0);
632 if (ret)
633 {
634 DWORD i;
635
636 for (i = 0; i < info->cProvParam; i++)
637 {
638 CryptSetProvParam(*phCryptProv,
639 info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
640 info->rgProvParam[i].dwFlags);
641 }
642 *pdwKeySpec = info->dwKeySpec;
643 }
644 else
645 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
646 }
647 if (allocated)
648 HeapFree(GetProcessHeap(), 0, info);
649 return ret;
650 }
651
652 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
653 DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
654 DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
655 {
656 BOOL ret = FALSE, cache = FALSE;
657 PCRYPT_KEY_PROV_INFO info = NULL;
658 CERT_KEY_CONTEXT keyContext;
659 DWORD size;
660
661 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
662 phCryptProv, pdwKeySpec, pfCallerFreeProv);
663
664 if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
665 {
666 DWORD size = 0;
667
668 ret = CertGetCertificateContextProperty(pCert,
669 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
670 if (ret)
671 {
672 info = HeapAlloc(GetProcessHeap(), 0, size);
673 ret = CertGetCertificateContextProperty(pCert,
674 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
675 if (ret)
676 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
677 }
678 }
679 else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
680 cache = TRUE;
681 *phCryptProv = 0;
682 if (cache)
683 {
684 size = sizeof(keyContext);
685 ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
686 &keyContext, &size);
687 if (ret)
688 {
689 *phCryptProv = keyContext.hCryptProv;
690 if (pdwKeySpec)
691 *pdwKeySpec = keyContext.dwKeySpec;
692 if (pfCallerFreeProv)
693 *pfCallerFreeProv = !cache;
694 }
695 }
696 if (!*phCryptProv)
697 {
698 ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
699 &keyContext.hCryptProv, &keyContext.dwKeySpec);
700 if (ret)
701 {
702 *phCryptProv = keyContext.hCryptProv;
703 if (pdwKeySpec)
704 *pdwKeySpec = keyContext.dwKeySpec;
705 if (cache)
706 {
707 keyContext.cbSize = sizeof(keyContext);
708 if (CertSetCertificateContextProperty(pCert,
709 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
710 {
711 if (pfCallerFreeProv)
712 *pfCallerFreeProv = FALSE;
713 }
714 }
715 else
716 {
717 if (pfCallerFreeProv)
718 *pfCallerFreeProv = TRUE;
719 }
720 }
721 }
722 HeapFree(GetProcessHeap(), 0, info);
723 return ret;
724 }
725
726 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
727 const CRYPT_KEY_PROV_INFO *keyProvInfo)
728 {
729 HCRYPTPROV csp;
730 BOOL matches = FALSE;
731
732 if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
733 keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
734 {
735 DWORD size;
736
737 /* Need to sign something to verify the sig. What to sign? Why not
738 * the certificate itself?
739 */
740 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
741 pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
742 &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
743 {
744 BYTE *certEncoded = CryptMemAlloc(size);
745
746 if (certEncoded)
747 {
748 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
749 pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
750 pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
751 NULL, certEncoded, &size))
752 {
753 if (size == pCert->cbCertEncoded &&
754 !memcmp(certEncoded, pCert->pbCertEncoded, size))
755 matches = TRUE;
756 }
757 CryptMemFree(certEncoded);
758 }
759 }
760 CryptReleaseContext(csp, 0);
761 }
762 return matches;
763 }
764
765 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
766 CRYPT_KEY_PROV_INFO *keyProvInfo)
767 {
768 CRYPT_KEY_PROV_INFO copy;
769 WCHAR containerW[MAX_PATH];
770 BOOL matches = FALSE;
771
772 MultiByteToWideChar(CP_ACP, 0, container, -1,
773 containerW, sizeof(containerW) / sizeof(containerW[0]));
774 /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
775 * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
776 * name.
777 */
778 memcpy(&copy, keyProvInfo, sizeof(copy));
779 copy.pwszContainerName = containerW;
780 matches = key_prov_info_matches_cert(pCert, &copy);
781 if (matches)
782 {
783 keyProvInfo->pwszContainerName =
784 CryptMemAlloc((strlenW(containerW) + 1) * sizeof(WCHAR));
785 if (keyProvInfo->pwszContainerName)
786 {
787 strcpyW(keyProvInfo->pwszContainerName, containerW);
788 keyProvInfo->dwKeySpec = AT_SIGNATURE;
789 }
790 else
791 matches = FALSE;
792 }
793 return matches;
794 }
795
796 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
797 * private key matches pCert's public key. Upon success, updates keyProvInfo
798 * with the matching container's info (free keyProvInfo.pwszContainerName upon
799 * success.)
800 * Returns TRUE if found, FALSE if not.
801 */
802 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
803 CRYPT_KEY_PROV_INFO *keyProvInfo)
804 {
805 HCRYPTPROV defProvider;
806 BOOL ret, found = FALSE;
807 char containerA[MAX_PATH];
808
809 assert(keyProvInfo->pwszContainerName == NULL);
810 if ((ret = CryptAcquireContextW(&defProvider, NULL,
811 keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
812 keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
813 {
814 DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
815
816 while (ret && !found)
817 {
818 DWORD size = sizeof(containerA);
819
820 ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
821 (BYTE *)containerA, &size, enumFlags);
822 if (ret)
823 found = container_matches_cert(pCert, containerA, keyProvInfo);
824 if (enumFlags & CRYPT_FIRST)
825 {
826 enumFlags &= ~CRYPT_FIRST;
827 enumFlags |= CRYPT_NEXT;
828 }
829 }
830 CryptReleaseContext(defProvider, 0);
831 }
832 return found;
833 }
834
835 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
836 {
837 BOOL found = FALSE, ret = TRUE;
838 DWORD index = 0, cbProvName = 0;
839 CRYPT_KEY_PROV_INFO keyProvInfo;
840
841 TRACE("(%p, %08x)\n", pCert, dwFlags);
842
843 memset(&keyProvInfo, 0, sizeof(keyProvInfo));
844 while (ret && !found)
845 {
846 DWORD size = 0;
847
848 ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
849 NULL, &size);
850 if (ret)
851 {
852 if (size <= cbProvName)
853 ret = CryptEnumProvidersW(index, NULL, 0,
854 &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
855 else
856 {
857 CryptMemFree(keyProvInfo.pwszProvName);
858 keyProvInfo.pwszProvName = CryptMemAlloc(size);
859 if (keyProvInfo.pwszProvName)
860 {
861 cbProvName = size;
862 ret = CryptEnumProvidersW(index, NULL, 0,
863 &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
864 if (ret)
865 {
866 if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
867 keyProvInfo.dwFlags |= CRYPT_SILENT;
868 if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
869 !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
870 CRYPT_FIND_MACHINE_KEYSET_FLAG)))
871 {
872 keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
873 found = find_key_prov_info_in_provider(pCert,
874 &keyProvInfo);
875 }
876 if (!found)
877 {
878 if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
879 !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
880 CRYPT_FIND_MACHINE_KEYSET_FLAG)))
881 {
882 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
883 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
884 found = find_key_prov_info_in_provider(pCert,
885 &keyProvInfo);
886 }
887 }
888 }
889 }
890 else
891 ret = FALSE;
892 }
893 index++;
894 }
895 }
896 if (found)
897 CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
898 0, &keyProvInfo);
899 CryptMemFree(keyProvInfo.pwszProvName);
900 CryptMemFree(keyProvInfo.pwszContainerName);
901 return found;
902 }
903
904 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
905 {
906 BOOL matches = FALSE;
907 DWORD size;
908
909 if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
910 NULL, &size))
911 {
912 CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
913
914 if (keyProvInfo)
915 {
916 if (CertGetCertificateContextProperty(pCert,
917 CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
918 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
919 CryptMemFree(keyProvInfo);
920 }
921 }
922 return matches;
923 }
924
925 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
926 DWORD dwFlags, void *pvReserved)
927 {
928 BOOL matches = FALSE;
929
930 TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
931
932 matches = cert_prov_info_matches_cert(pCert);
933 if (!matches)
934 matches = find_matching_provider(pCert, dwFlags);
935 return matches;
936 }
937
938 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
939 PCERT_INFO pCertId1, PCERT_INFO pCertId2)
940 {
941 BOOL ret;
942
943 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
944
945 ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
946 &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
947 &pCertId2->SerialNumber);
948 TRACE("returning %d\n", ret);
949 return ret;
950 }
951
952 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
953 PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
954 {
955 BOOL ret;
956
957 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
958
959 if (pCertName1->cbData == pCertName2->cbData)
960 {
961 if (pCertName1->cbData)
962 ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
963 pCertName1->cbData);
964 else
965 ret = TRUE;
966 }
967 else
968 ret = FALSE;
969 TRACE("returning %d\n", ret);
970 return ret;
971 }
972
973 /* Returns the number of significant bytes in pInt, where a byte is
974 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
975 * for negative numbers. pInt is assumed to be little-endian.
976 */
977 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
978 {
979 DWORD ret = pInt->cbData;
980
981 while (ret > 1)
982 {
983 if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
984 ret--;
985 else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
986 ret--;
987 else
988 break;
989 }
990 return ret;
991 }
992
993 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
994 PCRYPT_INTEGER_BLOB pInt2)
995 {
996 BOOL ret;
997 DWORD cb1, cb2;
998
999 TRACE("(%p, %p)\n", pInt1, pInt2);
1000
1001 cb1 = CRYPT_significantBytes(pInt1);
1002 cb2 = CRYPT_significantBytes(pInt2);
1003 if (cb1 == cb2)
1004 {
1005 if (cb1)
1006 ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1007 else
1008 ret = TRUE;
1009 }
1010 else
1011 ret = FALSE;
1012 TRACE("returning %d\n", ret);
1013 return ret;
1014 }
1015
1016 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1017 PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1018 {
1019 BOOL ret;
1020
1021 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1022
1023 switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1024 {
1025 case 0: /* Seems to mean "raw binary bits" */
1026 if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1027 pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1028 {
1029 if (pPublicKey2->PublicKey.cbData)
1030 ret = !memcmp(pPublicKey1->PublicKey.pbData,
1031 pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1032 else
1033 ret = TRUE;
1034 }
1035 else
1036 ret = FALSE;
1037 break;
1038 default:
1039 WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1040 /* FALLTHROUGH */
1041 case X509_ASN_ENCODING:
1042 {
1043 BLOBHEADER *pblob1, *pblob2;
1044 DWORD length;
1045 ret = FALSE;
1046 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1047 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1048 0, NULL, &length))
1049 {
1050 pblob1 = CryptMemAlloc(length);
1051 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1052 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1053 0, pblob1, &length))
1054 {
1055 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1056 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1057 0, NULL, &length))
1058 {
1059 pblob2 = CryptMemAlloc(length);
1060 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1061 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1062 0, pblob2, &length))
1063 {
1064 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1065 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1066 *pk2 = (LPVOID)(pblob2 + 1);
1067 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1068 && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1069 }
1070 CryptMemFree(pblob2);
1071 }
1072 }
1073 CryptMemFree(pblob1);
1074 }
1075
1076 break;
1077 }
1078 }
1079 return ret;
1080 }
1081
1082 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1083 PCERT_PUBLIC_KEY_INFO pPublicKey)
1084 {
1085 DWORD len = 0;
1086
1087 TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1088
1089 if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1090 {
1091 SetLastError(ERROR_FILE_NOT_FOUND);
1092 return 0;
1093 }
1094 if (pPublicKey->Algorithm.pszObjId &&
1095 !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1096 {
1097 FIXME("unimplemented for DH public keys\n");
1098 SetLastError(CRYPT_E_ASN1_BADTAG);
1099 }
1100 else
1101 {
1102 DWORD size;
1103 PBYTE buf;
1104 BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
1105 RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1106 pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1107 &size);
1108
1109 if (ret)
1110 {
1111 RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1112
1113 len = rsaPubKey->bitlen;
1114 LocalFree(buf);
1115 }
1116 }
1117 return len;
1118 }
1119
1120 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1121 DWORD dwFlags, const void *pvPara);
1122
1123 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1124 DWORD dwFlags, const void *pvPara)
1125 {
1126 BOOL ret;
1127 BYTE hash[16];
1128 DWORD size = sizeof(hash);
1129
1130 ret = CertGetCertificateContextProperty(pCertContext,
1131 CERT_MD5_HASH_PROP_ID, hash, &size);
1132 if (ret)
1133 {
1134 const CRYPT_HASH_BLOB *pHash = pvPara;
1135
1136 if (size == pHash->cbData)
1137 ret = !memcmp(pHash->pbData, hash, size);
1138 else
1139 ret = FALSE;
1140 }
1141 return ret;
1142 }
1143
1144 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1145 DWORD dwFlags, const void *pvPara)
1146 {
1147 BOOL ret;
1148 BYTE hash[20];
1149 DWORD size = sizeof(hash);
1150
1151 ret = CertGetCertificateContextProperty(pCertContext,
1152 CERT_SHA1_HASH_PROP_ID, hash, &size);
1153 if (ret)
1154 {
1155 const CRYPT_HASH_BLOB *pHash = pvPara;
1156
1157 if (size == pHash->cbData)
1158 ret = !memcmp(pHash->pbData, hash, size);
1159 else
1160 ret = FALSE;
1161 }
1162 return ret;
1163 }
1164
1165 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1166 DWORD dwFlags, const void *pvPara)
1167 {
1168 CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1169 BOOL ret;
1170
1171 if (dwType & CERT_INFO_SUBJECT_FLAG)
1172 toCompare = &pCertContext->pCertInfo->Subject;
1173 else
1174 toCompare = &pCertContext->pCertInfo->Issuer;
1175 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1176 toCompare, blob);
1177 return ret;
1178 }
1179
1180 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1181 DWORD dwType, DWORD dwFlags, const void *pvPara)
1182 {
1183 CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1184 BOOL ret;
1185
1186 ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1187 &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1188 return ret;
1189 }
1190
1191 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1192 DWORD dwType, DWORD dwFlags, const void *pvPara)
1193 {
1194 CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1195 BOOL ret;
1196
1197 /* Matching serial number and subject match.. */
1198 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1199 &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1200 if (ret)
1201 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1202 &pCertInfo->SerialNumber);
1203 else
1204 {
1205 /* failing that, if the serial number and issuer match, we match */
1206 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1207 &pCertInfo->SerialNumber);
1208 if (ret)
1209 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1210 &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1211 }
1212 TRACE("returning %d\n", ret);
1213 return ret;
1214 }
1215
1216 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1217 DWORD dwFlags, const void *pvPara)
1218 {
1219 CERT_ID *id = (CERT_ID *)pvPara;
1220 BOOL ret;
1221
1222 switch (id->dwIdChoice)
1223 {
1224 case CERT_ID_ISSUER_SERIAL_NUMBER:
1225 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1226 &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1227 if (ret)
1228 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1229 &id->u.IssuerSerialNumber.SerialNumber);
1230 break;
1231 case CERT_ID_SHA1_HASH:
1232 ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1233 &id->u.HashId);
1234 break;
1235 case CERT_ID_KEY_IDENTIFIER:
1236 {
1237 DWORD size = 0;
1238
1239 ret = CertGetCertificateContextProperty(pCertContext,
1240 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1241 if (ret && size == id->u.KeyId.cbData)
1242 {
1243 LPBYTE buf = CryptMemAlloc(size);
1244
1245 if (buf)
1246 {
1247 CertGetCertificateContextProperty(pCertContext,
1248 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1249 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1250 CryptMemFree(buf);
1251 }
1252 }
1253 else
1254 ret = FALSE;
1255 break;
1256 }
1257 default:
1258 ret = FALSE;
1259 break;
1260 }
1261 return ret;
1262 }
1263
1264 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1265 DWORD dwFlags, const void *pvPara)
1266 {
1267 PCCERT_CONTEXT toCompare = pvPara;
1268 return CertCompareCertificate(pCertContext->dwCertEncodingType,
1269 pCertContext->pCertInfo, toCompare->pCertInfo);
1270 }
1271
1272 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1273 DWORD dwFlags, const void *pvPara)
1274 {
1275 const CRYPT_HASH_BLOB *hash = pvPara;
1276 DWORD size = 0;
1277 BOOL ret;
1278
1279 ret = CertGetCertificateContextProperty(pCertContext,
1280 CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1281 if (ret && size == hash->cbData)
1282 {
1283 LPBYTE buf = CryptMemAlloc(size);
1284
1285 if (buf)
1286 {
1287 CertGetCertificateContextProperty(pCertContext,
1288 CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1289 ret = !memcmp(buf, hash->pbData, size);
1290 CryptMemFree(buf);
1291 }
1292 }
1293 else
1294 ret = FALSE;
1295 return ret;
1296 }
1297
1298 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1299 PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1300 const void *pvPara)
1301 {
1302 BOOL matches = FALSE;
1303 PCCERT_CONTEXT ret;
1304
1305 ret = prev;
1306 do {
1307 ret = CertEnumCertificatesInStore(store, ret);
1308 if (ret)
1309 matches = compare(ret, dwType, dwFlags, pvPara);
1310 } while (ret != NULL && !matches);
1311 return ret;
1312 }
1313
1314 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1315 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1316
1317 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1318 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1319 {
1320 return CertEnumCertificatesInStore(store, prev);
1321 }
1322
1323 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1324 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1325 {
1326 BOOL ret;
1327 PCCERT_CONTEXT found = NULL, subject = pvPara;
1328 PCERT_EXTENSION ext;
1329 DWORD size;
1330
1331 if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1332 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1333 {
1334 CERT_AUTHORITY_KEY_ID_INFO *info;
1335
1336 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1337 X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1338 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1339 &info, &size);
1340 if (ret)
1341 {
1342 CERT_ID id;
1343
1344 if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1345 {
1346 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1347 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1348 sizeof(CERT_NAME_BLOB));
1349 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1350 &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1351 }
1352 else if (info->KeyId.cbData)
1353 {
1354 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1355 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1356 }
1357 else
1358 ret = FALSE;
1359 if (ret)
1360 found = cert_compare_certs_in_store(store, prev,
1361 compare_cert_by_cert_id, dwType, dwFlags, &id);
1362 LocalFree(info);
1363 }
1364 }
1365 else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1366 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1367 {
1368 CERT_AUTHORITY_KEY_ID2_INFO *info;
1369
1370 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1371 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1372 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1373 &info, &size);
1374 if (ret)
1375 {
1376 CERT_ID id;
1377
1378 if (info->AuthorityCertIssuer.cAltEntry &&
1379 info->AuthorityCertSerialNumber.cbData)
1380 {
1381 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1382 DWORD i;
1383
1384 for (i = 0; !directoryName &&
1385 i < info->AuthorityCertIssuer.cAltEntry; i++)
1386 if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1387 == CERT_ALT_NAME_DIRECTORY_NAME)
1388 directoryName =
1389 &info->AuthorityCertIssuer.rgAltEntry[i];
1390 if (directoryName)
1391 {
1392 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1393 memcpy(&id.u.IssuerSerialNumber.Issuer,
1394 &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1395 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1396 &info->AuthorityCertSerialNumber,
1397 sizeof(CRYPT_INTEGER_BLOB));
1398 }
1399 else
1400 {
1401 FIXME("no supported name type in authority key id2\n");
1402 ret = FALSE;
1403 }
1404 }
1405 else if (info->KeyId.cbData)
1406 {
1407 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1408 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1409 }
1410 else
1411 ret = FALSE;
1412 if (ret)
1413 found = cert_compare_certs_in_store(store, prev,
1414 compare_cert_by_cert_id, dwType, dwFlags, &id);
1415 LocalFree(info);
1416 }
1417 }
1418 else
1419 found = cert_compare_certs_in_store(store, prev,
1420 compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1421 dwFlags, &subject->pCertInfo->Issuer);
1422 return found;
1423 }
1424
1425 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1426 DWORD dwType, DWORD dwFlags, const void *pvPara)
1427 {
1428 PCERT_NAME_BLOB name;
1429 DWORD len;
1430 BOOL ret = FALSE;
1431
1432 if (dwType & CERT_INFO_SUBJECT_FLAG)
1433 name = &pCertContext->pCertInfo->Subject;
1434 else
1435 name = &pCertContext->pCertInfo->Issuer;
1436 len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1437 CERT_SIMPLE_NAME_STR, NULL, 0);
1438 if (len)
1439 {
1440 LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1441
1442 if (str)
1443 {
1444 LPWSTR ptr;
1445
1446 CertNameToStrW(pCertContext->dwCertEncodingType, name,
1447 CERT_SIMPLE_NAME_STR, str, len);
1448 for (ptr = str; *ptr; ptr++)
1449 *ptr = tolowerW(*ptr);
1450 if (strstrW(str, pvPara))
1451 ret = TRUE;
1452 CryptMemFree(str);
1453 }
1454 }
1455 return ret;
1456 }
1457
1458 static PCCERT_CONTEXT find_cert_by_name_str(HCERTSTORE store, DWORD dwType,
1459 DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1460 {
1461 PCCERT_CONTEXT found = NULL;
1462
1463 TRACE("%s\n", debugstr_w(pvPara));
1464
1465 if (pvPara)
1466 {
1467 DWORD len = strlenW(pvPara);
1468 LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1469
1470 if (str)
1471 {
1472 LPCWSTR src;
1473 LPWSTR dst;
1474
1475 for (src = pvPara, dst = str; *src; src++, dst++)
1476 *dst = tolowerW(*src);
1477 *dst = 0;
1478 found = cert_compare_certs_in_store(store, prev,
1479 compare_cert_by_name_str, dwType, dwFlags, str);
1480 CryptMemFree(str);
1481 }
1482 }
1483 else
1484 found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1485 return found;
1486 }
1487
1488 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1489 DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1490 PCCERT_CONTEXT pPrevCertContext)
1491 {
1492 PCCERT_CONTEXT ret;
1493 CertFindFunc find = NULL;
1494 CertCompareFunc compare = NULL;
1495
1496 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1497 dwFlags, dwType, pvPara, pPrevCertContext);
1498
1499 switch (dwType >> CERT_COMPARE_SHIFT)
1500 {
1501 case CERT_COMPARE_ANY:
1502 find = find_cert_any;
1503 break;
1504 case CERT_COMPARE_MD5_HASH:
1505 compare = compare_cert_by_md5_hash;
1506 break;
1507 case CERT_COMPARE_SHA1_HASH:
1508 compare = compare_cert_by_sha1_hash;
1509 break;
1510 case CERT_COMPARE_NAME:
1511 compare = compare_cert_by_name;
1512 break;
1513 case CERT_COMPARE_PUBLIC_KEY:
1514 compare = compare_cert_by_public_key;
1515 break;
1516 case CERT_COMPARE_NAME_STR_W:
1517 find = find_cert_by_name_str;
1518 break;
1519 case CERT_COMPARE_SUBJECT_CERT:
1520 compare = compare_cert_by_subject_cert;
1521 break;
1522 case CERT_COMPARE_CERT_ID:
1523 compare = compare_cert_by_cert_id;
1524 break;
1525 case CERT_COMPARE_ISSUER_OF:
1526 find = find_cert_by_issuer;
1527 break;
1528 case CERT_COMPARE_EXISTING:
1529 compare = compare_existing_cert;
1530 break;
1531 case CERT_COMPARE_SIGNATURE_HASH:
1532 compare = compare_cert_by_signature_hash;
1533 break;
1534 default:
1535 FIXME("find type %08x unimplemented\n", dwType);
1536 }
1537
1538 if (find)
1539 ret = find(hCertStore, dwFlags, dwType, pvPara, pPrevCertContext);
1540 else if (compare)
1541 ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1542 compare, dwType, dwFlags, pvPara);
1543 else
1544 ret = NULL;
1545 if (!ret)
1546 SetLastError(CRYPT_E_NOT_FOUND);
1547 TRACE("returning %p\n", ret);
1548 return ret;
1549 }
1550
1551 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1552 DWORD dwCertEncodingType, PCERT_INFO pCertId)
1553 {
1554 TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1555
1556 if (!pCertId)
1557 {
1558 SetLastError(E_INVALIDARG);
1559 return NULL;
1560 }
1561 return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1562 CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1563 }
1564
1565 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1566 PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1567 {
1568 static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1569 CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1570
1571 if (*pdwFlags & ~supportedFlags)
1572 {
1573 SetLastError(E_INVALIDARG);
1574 return FALSE;
1575 }
1576 if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1577 {
1578 DWORD flags = 0;
1579 PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1580 NULL, &flags);
1581
1582 /* FIXME: what if the CRL has expired? */
1583 if (crl)
1584 {
1585 if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1586 pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1587 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1588 }
1589 else
1590 *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1591 }
1592 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1593 {
1594 if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1595 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1596 }
1597 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1598 {
1599 if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1600 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1601 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1602 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1603 }
1604 return TRUE;
1605 }
1606
1607 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1608 PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1609 DWORD *pdwFlags)
1610 {
1611 PCCERT_CONTEXT ret;
1612
1613 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1614 pPrevIssuerContext, *pdwFlags);
1615
1616 if (!pSubjectContext)
1617 {
1618 SetLastError(E_INVALIDARG);
1619 return NULL;
1620 }
1621
1622 ret = CertFindCertificateInStore(hCertStore,
1623 pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1624 pSubjectContext, pPrevIssuerContext);
1625 if (ret)
1626 {
1627 if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1628 pdwFlags))
1629 {
1630 CertFreeCertificateContext(ret);
1631 ret = NULL;
1632 }
1633 }
1634 TRACE("returning %p\n", ret);
1635 return ret;
1636 }
1637
1638 typedef struct _OLD_CERT_REVOCATION_STATUS {
1639 DWORD cbSize;
1640 DWORD dwIndex;
1641 DWORD dwError;
1642 DWORD dwReason;
1643 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1644
1645 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1646 void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1647
1648 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1649 DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1650 PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1651 {
1652 BOOL ret;
1653
1654 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1655 cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1656
1657 if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1658 pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1659 {
1660 SetLastError(E_INVALIDARG);
1661 return FALSE;
1662 }
1663 if (cContext)
1664 {
1665 static HCRYPTOIDFUNCSET set = NULL;
1666 DWORD size;
1667
1668 if (!set)
1669 set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1670 ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1671 if (ret)
1672 {
1673 if (size == 1)
1674 {
1675 /* empty list */
1676 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1677 ret = FALSE;
1678 }
1679 else
1680 {
1681 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1682
1683 if (dllList)
1684 {
1685 ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1686 dllList, &size);
1687 if (ret)
1688 {
1689 for (ptr = dllList; ret && *ptr;
1690 ptr += lstrlenW(ptr) + 1)
1691 {
1692 CertVerifyRevocationFunc func;
1693 HCRYPTOIDFUNCADDR hFunc;
1694
1695 ret = CryptGetDefaultOIDFunctionAddress(set,
1696 dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1697 if (ret)
1698 {
1699 ret = func(dwEncodingType, dwRevType, cContext,
1700 rgpvContext, dwFlags, pRevPara, pRevStatus);
1701 CryptFreeOIDFunctionAddress(hFunc, 0);
1702 }
1703 }
1704 }
1705 CryptMemFree(dllList);
1706 }
1707 else
1708 {
1709 SetLastError(ERROR_OUTOFMEMORY);
1710 ret = FALSE;
1711 }
1712 }
1713 }
1714 }
1715 else
1716 ret = TRUE;
1717 return ret;
1718 }
1719
1720 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1721 CRYPT_ATTRIBUTE rgAttr[])
1722 {
1723 PCRYPT_ATTRIBUTE ret = NULL;
1724 DWORD i;
1725
1726 TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1727
1728 if (!cAttr)
1729 return NULL;
1730 if (!pszObjId)
1731 {
1732 SetLastError(ERROR_INVALID_PARAMETER);
1733 return NULL;
1734 }
1735
1736 for (i = 0; !ret && i < cAttr; i++)
1737 if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1738 ret = &rgAttr[i];
1739 return ret;
1740 }
1741
1742 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1743 CERT_EXTENSION rgExtensions[])
1744 {
1745 PCERT_EXTENSION ret = NULL;
1746 DWORD i;
1747
1748 TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1749
1750 if (!cExtensions)
1751 return NULL;
1752 if (!pszObjId)
1753 {
1754 SetLastError(ERROR_INVALID_PARAMETER);
1755 return NULL;
1756 }
1757
1758 for (i = 0; !ret && i < cExtensions; i++)
1759 if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1760 rgExtensions[i].pszObjId))
1761 ret = &rgExtensions[i];
1762 return ret;
1763 }
1764
1765 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1766 {
1767 PCERT_RDN_ATTR ret = NULL;
1768 DWORD i, j;
1769
1770 TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1771
1772 if (!pszObjId)
1773 {
1774 SetLastError(ERROR_INVALID_PARAMETER);
1775 return NULL;
1776 }
1777
1778 for (i = 0; !ret && i < pName->cRDN; i++)
1779 for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1780 if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1781 pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1782 ret = &pName->rgRDN[i].rgRDNAttr[j];
1783 return ret;
1784 }
1785
1786 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1787 PCERT_INFO pCertInfo)
1788 {
1789 FILETIME fileTime;
1790 LONG ret;
1791
1792 if (!pTimeToVerify)
1793 {
1794 GetSystemTimeAsFileTime(&fileTime);
1795 pTimeToVerify = &fileTime;
1796 }
1797 if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1798 {
1799 ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1800 if (ret < 0)
1801 ret = 0;
1802 }
1803 return ret;
1804 }
1805
1806 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1807 PCERT_INFO pIssuerInfo)
1808 {
1809 TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1810
1811 return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1812 && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1813 }
1814
1815 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1816 DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1817 DWORD *pcbComputedHash)
1818 {
1819 BOOL ret = TRUE;
1820 HCRYPTHASH hHash = 0;
1821
1822 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1823 pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1824
1825 if (!hCryptProv)
1826 hCryptProv = CRYPT_GetDefaultProvider();
1827 if (!Algid)
1828 Algid = CALG_SHA1;
1829 if (ret)
1830 {
1831 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1832 if (ret)
1833 {
1834 ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1835 if (ret)
1836 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1837 pcbComputedHash, 0);
1838 CryptDestroyHash(hHash);
1839 }
1840 }
1841 return ret;
1842 }
1843
1844 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1845 DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1846 BYTE *pbComputedHash, DWORD *pcbComputedHash)
1847 {
1848 BOOL ret = TRUE;
1849 HCRYPTHASH hHash = 0;
1850
1851 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1852 dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1853
1854 if (!hCryptProv)
1855 hCryptProv = CRYPT_GetDefaultProvider();
1856 if (!Algid)
1857 Algid = CALG_MD5;
1858 if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
1859 {
1860 SetLastError(ERROR_FILE_NOT_FOUND);
1861 return FALSE;
1862 }
1863 if (ret)
1864 {
1865 BYTE *buf;
1866 DWORD size = 0;
1867
1868 ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
1869 X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
1870 (LPBYTE)&buf, &size);
1871 if (ret)
1872 {
1873 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1874 if (ret)
1875 {
1876 ret = CryptHashData(hHash, buf, size, 0);
1877 if (ret)
1878 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1879 pcbComputedHash, 0);
1880 CryptDestroyHash(hHash);
1881 }
1882 LocalFree(buf);
1883 }
1884 }
1885 return ret;
1886 }
1887
1888 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
1889 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1890 BYTE *pbComputedHash, DWORD *pcbComputedHash)
1891 {
1892 BOOL ret;
1893 CERT_SIGNED_CONTENT_INFO *info;
1894 DWORD size;
1895
1896 TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
1897 pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
1898
1899 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1900 pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
1901 if (ret)
1902 {
1903 PCCRYPT_OID_INFO oidInfo;
1904 HCRYPTHASH hHash;
1905
1906 if (!hCryptProv)
1907 hCryptProv = CRYPT_GetDefaultProvider();
1908 oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1909 info->SignatureAlgorithm.pszObjId, 0);
1910 if (!oidInfo)
1911 {
1912 SetLastError(NTE_BAD_ALGID);
1913 ret = FALSE;
1914 }
1915 else
1916 {
1917 ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
1918 if (ret)
1919 {
1920 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
1921 info->ToBeSigned.cbData, 0);
1922 if (ret)
1923 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1924 pcbComputedHash, 0);
1925 CryptDestroyHash(hHash);
1926 }
1927 }
1928 LocalFree(info);
1929 }
1930 return ret;
1931 }
1932
1933 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1934 DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
1935 DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1936 const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
1937 {
1938 BOOL ret;
1939 PCCRYPT_OID_INFO info;
1940 HCRYPTHASH hHash;
1941
1942 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
1943 dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
1944 pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
1945
1946 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1947 pSignatureAlgorithm->pszObjId, 0);
1948 if (!info)
1949 {
1950 SetLastError(NTE_BAD_ALGID);
1951 return FALSE;
1952 }
1953 if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
1954 {
1955 if (!hCryptProv)
1956 hCryptProv = CRYPT_GetDefaultProvider();
1957 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1958 if (ret)
1959 {
1960 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1961 cbEncodedToBeSigned, 0);
1962 if (ret)
1963 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
1964 pcbSignature, 0);
1965 CryptDestroyHash(hHash);
1966 }
1967 }
1968 else
1969 {
1970 if (!hCryptProv)
1971 {
1972 SetLastError(ERROR_INVALID_PARAMETER);
1973 ret = FALSE;
1974 }
1975 else
1976 {
1977 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1978 if (ret)
1979 {
1980 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1981 cbEncodedToBeSigned, 0);
1982 if (ret)
1983 ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
1984 pcbSignature);
1985 CryptDestroyHash(hHash);
1986 }
1987 }
1988 }
1989 return ret;
1990 }
1991
1992 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1993 DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
1994 const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1995 const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
1996 {
1997 BOOL ret;
1998 DWORD encodedSize, hashSize;
1999
2000 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2001 dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2002 pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2003
2004 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2005 NULL, &encodedSize);
2006 if (ret)
2007 {
2008 PBYTE encoded = CryptMemAlloc(encodedSize);
2009
2010 if (encoded)
2011 {
2012 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2013 pvStructInfo, encoded, &encodedSize);
2014 if (ret)
2015 {
2016 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2017 dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2018 pvHashAuxInfo, NULL, &hashSize);
2019 if (ret)
2020 {
2021 PBYTE hash = CryptMemAlloc(hashSize);
2022
2023 if (hash)
2024 {
2025 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2026 dwCertEncodingType, encoded, encodedSize,
2027 pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2028 if (ret)
2029 {
2030 CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2031
2032 info.ToBeSigned.cbData = encodedSize;
2033 info.ToBeSigned.pbData = encoded;
2034 memcpy(&info.SignatureAlgorithm,
2035 pSignatureAlgorithm,
2036 sizeof(info.SignatureAlgorithm));
2037 info.Signature.cbData = hashSize;
2038 info.Signature.pbData = hash;
2039 info.Signature.cUnusedBits = 0;
2040 ret = CryptEncodeObject(dwCertEncodingType,
2041 X509_CERT, &info, pbEncoded, pcbEncoded);
2042 }
2043 CryptMemFree(hash);
2044 }
2045 }
2046 }
2047 CryptMemFree(encoded);
2048 }
2049 }
2050 return ret;
2051 }
2052
2053 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2054 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2055 PCERT_PUBLIC_KEY_INFO pPublicKey)
2056 {
2057 return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2058 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
2059 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2060 }
2061
2062 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
2063 DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
2064 const CERT_SIGNED_CONTENT_INFO *signedCert)
2065 {
2066 BOOL ret;
2067 HCRYPTKEY key;
2068 PCCRYPT_OID_INFO info;
2069 ALG_ID pubKeyID, hashID;
2070
2071 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2072 signedCert->SignatureAlgorithm.pszObjId, 0);
2073 if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2074 {
2075 SetLastError(NTE_BAD_ALGID);
2076 return FALSE;
2077 }
2078 hashID = info->u.Algid;
2079 if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2080 pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2081 else
2082 pubKeyID = hashID;
2083 /* Load the default provider if necessary */
2084 if (!hCryptProv)
2085 hCryptProv = CRYPT_GetDefaultProvider();
2086 ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2087 pubKeyInfo, pubKeyID, 0, NULL, &key);
2088 if (ret)
2089 {
2090 HCRYPTHASH hash;
2091
2092 ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2093 if (ret)
2094 {
2095 ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2096 signedCert->ToBeSigned.cbData, 0);
2097 if (ret)
2098 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2099 signedCert->Signature.cbData, key, NULL, 0);
2100 CryptDestroyHash(hash);
2101 }
2102 CryptDestroyKey(key);
2103 }
2104 return ret;
2105 }
2106
2107 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2108 DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2109 DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2110 {
2111 BOOL ret = TRUE;
2112 CRYPT_DATA_BLOB subjectBlob;
2113
2114 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2115 dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2116 dwFlags, pvReserved);
2117
2118 switch (dwSubjectType)
2119 {
2120 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2121 {
2122 PCRYPT_DATA_BLOB blob = pvSubject;
2123
2124 subjectBlob.pbData = blob->pbData;
2125 subjectBlob.cbData = blob->cbData;
2126 break;
2127 }
2128 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2129 {
2130 PCERT_CONTEXT context = pvSubject;
2131
2132 subjectBlob.pbData = context->pbCertEncoded;
2133 subjectBlob.cbData = context->cbCertEncoded;
2134 break;
2135 }
2136 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2137 {
2138 PCRL_CONTEXT context = pvSubject;
2139
2140 subjectBlob.pbData = context->pbCrlEncoded;
2141 subjectBlob.cbData = context->cbCrlEncoded;
2142 break;
2143 }
2144 default:
2145 SetLastError(E_INVALIDARG);
2146 ret = FALSE;
2147 }
2148
2149 if (ret)
2150 {
2151 PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2152 DWORD size = 0;
2153
2154 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2155 subjectBlob.pbData, subjectBlob.cbData,
2156 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2157 &signedCert, &size);
2158 if (ret)
2159 {
2160 switch (dwIssuerType)
2161 {
2162 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2163 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2164 dwCertEncodingType, pvIssuer,
2165 signedCert);
2166 break;
2167 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2168 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2169 dwCertEncodingType,
2170 &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2171 signedCert);
2172 break;
2173 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2174 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2175 ret = FALSE;
2176 break;
2177 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2178 if (pvIssuer)
2179 {
2180 SetLastError(E_INVALIDARG);
2181 ret = FALSE;
2182 }
2183 else
2184 {
2185 FIXME("unimplemented for NULL signer\n");
2186 SetLastError(E_INVALIDARG);
2187 ret = FALSE;
2188 }
2189 break;
2190 default:
2191 SetLastError(E_INVALIDARG);
2192 ret = FALSE;
2193 }
2194 LocalFree(signedCert);
2195 }
2196 }
2197 return ret;
2198 }
2199
2200 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2201 PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2202 {
2203 PCERT_ENHKEY_USAGE usage = NULL;
2204 DWORD bytesNeeded;
2205 BOOL ret = TRUE;
2206
2207 if (!pCertContext || !pcbUsage)
2208 {
2209 SetLastError(ERROR_INVALID_PARAMETER);
2210 return FALSE;
2211 }
2212
2213 TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2214
2215 if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2216 {
2217 DWORD propSize = 0;
2218
2219 if (CertGetCertificateContextProperty(pCertContext,
2220 CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2221 {
2222 LPBYTE buf = CryptMemAlloc(propSize);
2223
2224 if (buf)
2225 {
2226 if (CertGetCertificateContextProperty(pCertContext,
2227 CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2228 {
2229 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2230 X509_ENHANCED_KEY_USAGE, buf, propSize,
2231 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2232 }
2233 CryptMemFree(buf);
2234 }
2235 }
2236 }
2237 if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2238 {
2239 PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2240 pCertContext->pCertInfo->cExtension,
2241 pCertContext->pCertInfo->rgExtension);
2242
2243 if (ext)
2244 {
2245 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2246 X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
2247 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2248 }
2249 }
2250 if (!usage)
2251 {
2252 /* If a particular location is specified, this should fail. Otherwise
2253 * it should succeed with an empty usage. (This is true on Win2k and
2254 * later, which we emulate.)
2255 */
2256 if (dwFlags)
2257 {
2258 SetLastError(CRYPT_E_NOT_FOUND);
2259 ret = FALSE;
2260 }
2261 else
2262 bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
2263 }
2264
2265 if (ret)
2266 {
2267 if (!pUsage)
2268 *pcbUsage = bytesNeeded;
2269 else if (*pcbUsage < bytesNeeded)
2270 {
2271 SetLastError(ERROR_MORE_DATA);
2272 *pcbUsage = bytesNeeded;
2273 ret = FALSE;
2274 }
2275 else
2276 {
2277 *pcbUsage = bytesNeeded;
2278 if (usage)
2279 {
2280 DWORD i;
2281 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
2282 sizeof(CERT_ENHKEY_USAGE) +
2283 usage->cUsageIdentifier * sizeof(LPSTR));
2284
2285 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
2286 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
2287 sizeof(CERT_ENHKEY_USAGE));
2288 for (i = 0; i < usage->cUsageIdentifier; i++)
2289 {
2290 pUsage->rgpszUsageIdentifier[i] = nextOID;
2291 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2292 nextOID += strlen(nextOID) + 1;
2293 }
2294 }
2295 else
2296 pUsage->cUsageIdentifier = 0;
2297 }
2298 }
2299 if (usage)
2300 LocalFree(usage);
2301 TRACE("returning %d\n", ret);
2302 return ret;
2303 }
2304
2305 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
2306 PCERT_ENHKEY_USAGE pUsage)
2307 {
2308 BOOL ret;
2309
2310 TRACE("(%p, %p)\n", pCertContext, pUsage);
2311
2312 if (pUsage)
2313 {
2314 CRYPT_DATA_BLOB blob = { 0, NULL };
2315
2316 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2317 pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2318 if (ret)
2319 {
2320 ret = CertSetCertificateContextProperty(pCertContext,
2321 CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2322 LocalFree(blob.pbData);
2323 }
2324 }
2325 else
2326 ret = CertSetCertificateContextProperty(pCertContext,
2327 CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2328 return ret;
2329 }
2330
2331 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2332 LPCSTR pszUsageIdentifier)
2333 {
2334 BOOL ret;
2335 DWORD size;
2336
2337 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2338
2339 if (CertGetEnhancedKeyUsage(pCertContext,
2340 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2341 {
2342 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2343
2344 if (usage)
2345 {
2346 ret = CertGetEnhancedKeyUsage(pCertContext,
2347 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2348 if (ret)
2349 {
2350 DWORD i;
2351 BOOL exists = FALSE;
2352
2353 /* Make sure usage doesn't already exist */
2354 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2355 {
2356 if (!strcmp(usage->rgpszUsageIdentifier[i],
2357 pszUsageIdentifier))
2358 exists = TRUE;
2359 }
2360 if (!exists)
2361 {
2362 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2363 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2364
2365 if (newUsage)
2366 {
2367 LPSTR nextOID;
2368
2369 newUsage->rgpszUsageIdentifier = (LPSTR *)
2370 ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2371 nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2372 + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2373 for (i = 0; i < usage->cUsageIdentifier; i++)
2374 {
2375 newUsage->rgpszUsageIdentifier[i] = nextOID;
2376 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2377 nextOID += strlen(nextOID) + 1;
2378 }
2379 newUsage->rgpszUsageIdentifier[i] = nextOID;
2380 strcpy(nextOID, pszUsageIdentifier);
2381 newUsage->cUsageIdentifier = i + 1;
2382 ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2383 CryptMemFree(newUsage);
2384 }
2385 else
2386 ret = FALSE;
2387 }
2388 }
2389 CryptMemFree(usage);
2390 }
2391 else
2392 ret = FALSE;
2393 }
2394 else
2395 {
2396 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2397 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2398
2399 if (usage)
2400 {
2401 usage->rgpszUsageIdentifier =
2402 (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2403 usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2404 sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2405 strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2406 usage->cUsageIdentifier = 1;
2407 ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2408 CryptMemFree(usage);
2409 }
2410 else
2411 ret = FALSE;
2412 }
2413 return ret;
2414 }
2415
2416 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2417 LPCSTR pszUsageIdentifier)
2418 {
2419 BOOL ret;
2420 DWORD size;
2421 CERT_ENHKEY_USAGE usage;
2422
2423 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2424
2425 size = sizeof(usage);
2426 ret = CertGetEnhancedKeyUsage(pCertContext,
2427 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2428 if (!ret && GetLastError() == ERROR_MORE_DATA)
2429 {
2430 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2431
2432 if (pUsage)
2433 {
2434 ret = CertGetEnhancedKeyUsage(pCertContext,
2435 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2436 if (ret)
2437 {
2438 if (pUsage->cUsageIdentifier)
2439 {
2440 DWORD i;
2441 BOOL found = FALSE;
2442
2443 for (i = 0; i < pUsage->cUsageIdentifier; i++)
2444 {
2445 if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2446 pszUsageIdentifier))
2447 found = TRUE;
2448 if (found && i < pUsage->cUsageIdentifier - 1)
2449 pUsage->rgpszUsageIdentifier[i] =
2450 pUsage->rgpszUsageIdentifier[i + 1];
2451 }
2452 pUsage->cUsageIdentifier--;
2453 /* Remove the usage if it's empty */
2454 if (pUsage->cUsageIdentifier)
2455 ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2456 else
2457 ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2458 }
2459 }
2460 CryptMemFree(pUsage);
2461 }
2462 else
2463 ret = FALSE;
2464 }
2465 else
2466 {
2467 /* it fit in an empty usage, therefore there's nothing to remove */
2468 ret = TRUE;
2469 }
2470 return ret;
2471 }
2472
2473 struct BitField
2474 {
2475 DWORD cIndexes;
2476 DWORD *indexes;
2477 };
2478
2479 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2480
2481 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2482 {
2483 DWORD indexIndex = bit / BITS_PER_DWORD;
2484
2485 if (indexIndex + 1 > field->cIndexes)
2486 {
2487 if (field->cIndexes)
2488 field->indexes = CryptMemRealloc(field->indexes,
2489 (indexIndex + 1) * sizeof(DWORD));
2490 else
2491 field->indexes = CryptMemAlloc(sizeof(DWORD));
2492 if (field->indexes)
2493 {
2494 field->indexes[indexIndex] = 0;
2495 field->cIndexes = indexIndex + 1;
2496 }
2497 }
2498 if (field->indexes)
2499 field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2500 }
2501
2502 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
2503 {
2504 BOOL set = FALSE;
2505 DWORD indexIndex = bit / BITS_PER_DWORD;
2506
2507 assert(field->cIndexes);
2508 set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2509 return set;
2510 }
2511
2512 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2513 int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2514 {
2515 BOOL ret = TRUE;
2516 DWORD i, cbOIDs = 0;
2517 BOOL allUsagesValid = TRUE;
2518 CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2519
2520 TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2521 rghOIDs, *pcbOIDs);
2522
2523 for (i = 0; i < cCerts; i++)
2524 {
2525 CERT_ENHKEY_USAGE usage;
2526 DWORD size = sizeof(usage);
2527
2528 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2529 /* Success is deliberately ignored: it implies all usages are valid */
2530 if (!ret && GetLastError() == ERROR_MORE_DATA)
2531 {
2532 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2533
2534 allUsagesValid = FALSE;
2535 if (pUsage)
2536 {
2537 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2538 if (ret)
2539 {
2540 if (!validUsages.cUsageIdentifier)
2541 {
2542 DWORD j;
2543
2544 cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2545 validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2546 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2547 cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2548 + 1;
2549 validUsages.rgpszUsageIdentifier =
2550 CryptMemAlloc(cbOIDs);
2551 if (validUsages.rgpszUsageIdentifier)
2552 {
2553 LPSTR nextOID = (LPSTR)
2554 ((LPBYTE)validUsages.rgpszUsageIdentifier +
2555 validUsages.cUsageIdentifier * sizeof(LPSTR));
2556
2557 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2558 {
2559 validUsages.rgpszUsageIdentifier[j] = nextOID;
2560 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2561 pUsage->rgpszUsageIdentifier[j]);
2562 nextOID += lstrlenA(nextOID) + 1;
2563 }
2564 }
2565 }
2566 else
2567 {
2568 struct BitField validIndexes = { 0, NULL };
2569 DWORD j, k, numRemoved = 0;
2570
2571 /* Merge: build a bitmap of all the indexes of
2572 * validUsages.rgpszUsageIdentifier that are in pUsage.
2573 */
2574 for (j = 0; j < pUsage->cUsageIdentifier; j++)
2575 {
2576 for (k = 0; k < validUsages.cUsageIdentifier; k++)
2577 {
2578 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2579 validUsages.rgpszUsageIdentifier[k]))
2580 {
2581 CRYPT_SetBitInField(&validIndexes, k);
2582 break;
2583 }
2584 }
2585 }
2586 /* Merge by removing from validUsages those that are
2587 * not in the bitmap.
2588 */
2589 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2590 {
2591 if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2592 {
2593 if (j < validUsages.cUsageIdentifier - 1)
2594 {
2595 memmove(&validUsages.rgpszUsageIdentifier[j],
2596 &validUsages.rgpszUsageIdentifier[j +
2597 numRemoved + 1],
2598 (validUsages.cUsageIdentifier - numRemoved
2599 - j - 1) * sizeof(LPSTR));
2600 cbOIDs -= lstrlenA(
2601 validUsages.rgpszUsageIdentifier[j]) + 1 +
2602 sizeof(LPSTR);
2603 validUsages.cUsageIdentifier--;
2604 numRemoved++;
2605 }
2606 else
2607 validUsages.cUsageIdentifier--;
2608 }
2609 }
2610 CryptMemFree(validIndexes.indexes);
2611 }
2612 }
2613 CryptMemFree(pUsage);
2614 }
2615 }
2616 }
2617 ret = TRUE;
2618 if (allUsagesValid)
2619 {
2620 *cNumOIDs = -1;
2621 *pcbOIDs = 0;
2622 }
2623 else
2624 {
2625 *cNumOIDs = validUsages.cUsageIdentifier;
2626 if (!rghOIDs)
2627 *pcbOIDs = cbOIDs;
2628 else if (*pcbOIDs < cbOIDs)
2629 {
2630 *pcbOIDs = cbOIDs;
2631 SetLastError(ERROR_MORE_DATA);
2632 ret = FALSE;
2633 }
2634 else
2635 {
2636 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2637 validUsages.cUsageIdentifier * sizeof(LPSTR));
2638
2639 *pcbOIDs = cbOIDs;
2640 for (i = 0; i < validUsages.cUsageIdentifier; i++)
2641 {
2642 rghOIDs[i] = nextOID;
2643 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2644 nextOID += lstrlenA(nextOID) + 1;
2645 }
2646 }
2647 }
2648 CryptMemFree(validUsages.rgpszUsageIdentifier);
2649 TRACE("cNumOIDs: %d\n", *cNumOIDs);
2650 TRACE("returning %d\n", ret);
2651 return ret;
2652 }
2653
2654 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2655 * pInfo is NULL, from the attributes of hProv.
2656 */
2657 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2658 const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2659 {
2660 CRYPT_KEY_PROV_INFO info = { 0 };
2661 BOOL ret;
2662
2663 if (!pInfo)
2664 {
2665 DWORD size;
2666 int len;
2667
2668 ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2669 if (ret)
2670 {
2671 LPSTR szContainer = CryptMemAlloc(size);
2672
2673 if (szContainer)
2674 {
2675 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2676 (BYTE *)szContainer, &size, 0);
2677 if (ret)
2678 {
2679 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2680 NULL, 0);
2681 if (len)
2682 {
2683 info.pwszContainerName = CryptMemAlloc(len *
2684 sizeof(WCHAR));
2685 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2686 info.pwszContainerName, len);
2687 }
2688 }
2689 CryptMemFree(szContainer);
2690 }
2691 }
2692 ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2693 if (ret)
2694 {
2695 LPSTR szProvider = CryptMemAlloc(size);
2696
2697 if (szProvider)
2698 {
2699 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2700 &size, 0);
2701 if (ret)
2702 {
2703 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2704 NULL, 0);
2705 if (len)
2706 {
2707 info.pwszProvName = CryptMemAlloc(len *
2708 sizeof(WCHAR));
2709 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2710 info.pwszProvName, len);
2711 }
2712 }
2713 CryptMemFree(szProvider);
2714 }
2715 }
2716 size = sizeof(info.dwKeySpec);
2717 /* in case no CRYPT_KEY_PROV_INFO given,
2718 * we always use AT_SIGNATURE key spec
2719 */
2720 info.dwKeySpec = AT_SIGNATURE;
2721 size = sizeof(info.dwProvType);
2722 ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2723 &size, 0);
2724 if (!ret)
2725 info.dwProvType = PROV_RSA_FULL;
2726 pInfo = &info;
2727 }
2728
2729 ret = CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2730 0, pInfo);
2731
2732 if (pInfo == &info)
2733 {
2734 CryptMemFree(info.pwszContainerName);
2735 CryptMemFree(info.pwszProvName);
2736 }
2737 }
2738
2739 /* Creates a signed certificate context from the unsigned, encoded certificate
2740 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2741 */
2742 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2743 HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2744 {
2745 PCCERT_CONTEXT context = NULL;
2746 BOOL ret;
2747 DWORD sigSize = 0;
2748
2749 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2750 blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2751 if (ret)
2752 {
2753 LPBYTE sig = CryptMemAlloc(sigSize);
2754
2755 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2756 blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2757 if (ret)
2758 {
2759 CERT_SIGNED_CONTENT_INFO signedInfo;
2760 BYTE *encodedSignedCert = NULL;
2761 DWORD encodedSignedCertSize = 0;
2762
2763 signedInfo.ToBeSigned.cbData = blob->cbData;
2764 signedInfo.ToBeSigned.pbData = blob->pbData;
2765 memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2766 sizeof(signedInfo.SignatureAlgorithm));
2767 signedInfo.Signature.cbData = sigSize;
2768 signedInfo.Signature.pbData = sig;
2769 signedInfo.Signature.cUnusedBits = 0;
2770 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2771 &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2772 &encodedSignedCert, &encodedSignedCertSize);
2773 if (ret)
2774 {
2775 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2776 encodedSignedCert, encodedSignedCertSize);
2777 LocalFree(encodedSignedCert);
2778 }
2779 }
2780 CryptMemFree(sig);
2781 }
2782 return context;
2783 }
2784
2785 /* Copies data from the parameters into info, where:
2786 * pSerialNumber: The serial number. Must not be NULL.
2787 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2788 * Must not be NULL
2789 * pSignatureAlgorithm: Optional.
2790 * pStartTime: The starting time of the certificate. If NULL, the current
2791 * system time is used.
2792 * pEndTime: The ending time of the certificate. If NULL, one year past the
2793 * starting time is used.
2794 * pubKey: The public key of the certificate. Must not be NULL.
2795 * pExtensions: Extensions to be included with the certificate. Optional.
2796 */
2797 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2798 const CERT_NAME_BLOB *pSubjectIssuerBlob,
2799 const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2800 const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2801 const CERT_EXTENSIONS *pExtensions)
2802 {
2803 static CHAR oid[] = szOID_RSA_SHA1RSA;
2804
2805 assert(info);
2806 assert(pSerialNumber);
2807 assert(pSubjectIssuerBlob);
2808 assert(pubKey);
2809
2810 if (pExtensions && pExtensions->cExtension)
2811 info->dwVersion = CERT_V3;
2812 else
2813 info->dwVersion = CERT_V1;
2814 info->SerialNumber.cbData = pSerialNumber->cbData;
2815 info->SerialNumber.pbData = pSerialNumber->pbData;
2816 if (pSignatureAlgorithm)
2817 memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2818 sizeof(info->SignatureAlgorithm));
2819 else
2820 {
2821 info->SignatureAlgorithm.pszObjId = oid;
2822 info->SignatureAlgorithm.Parameters.cbData = 0;
2823 info->SignatureAlgorithm.Parameters.pbData = NULL;
2824 }
2825 info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2826 info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2827 if (pStartTime)
2828 SystemTimeToFileTime(pStartTime, &info->NotBefore);
2829 else
2830 GetSystemTimeAsFileTime(&info->NotBefore);
2831 if (pEndTime)
2832 SystemTimeToFileTime(pEndTime, &info->NotAfter);
2833 else
2834 {
2835 SYSTEMTIME endTime;
2836
2837 if (FileTimeToSystemTime(&info->NotBefore, &endTime))
2838 {
2839 endTime.wYear++;
2840 SystemTimeToFileTime(&endTime, &info->NotAfter);
2841 }
2842 }
2843 info->Subject.cbData = pSubjectIssuerBlob->cbData;
2844 info->Subject.pbData = pSubjectIssuerBlob->pbData;
2845 memcpy(&info->SubjectPublicKeyInfo, pubKey,
2846 sizeof(info->SubjectPublicKeyInfo));
2847 if (pExtensions)
2848 {
2849 info->cExtension = pExtensions->cExtension;
2850 info->rgExtension = pExtensions->rgExtension;
2851 }
2852 else
2853 {
2854 info->cExtension = 0;
2855 info->rgExtension = NULL;
2856 }
2857 }
2858
2859 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
2860 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
2861 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
2862
2863 static HCRYPTPROV CRYPT_CreateKeyProv(void)
2864 {
2865 HCRYPTPROV hProv = 0;
2866 HMODULE rpcrt = LoadLibraryA("rpcrt4");
2867
2868 if (rpcrt)
2869 {
2870 UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
2871 "UuidCreate");
2872 UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
2873 "UuidToStringA");
2874 RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
2875 rpcrt, "RpcStringFreeA");
2876
2877 if (uuidCreate && uuidToString && rpcStringFree)
2878 {
2879 UUID uuid;
2880 RPC_STATUS status = uuidCreate(&uuid);
2881
2882 if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
2883 {
2884 unsigned char *uuidStr;
2885
2886 status = uuidToString(&uuid, &uuidStr);
2887 if (status == RPC_S_OK)
2888 {
2889 BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
2890 MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
2891
2892 if (ret)
2893 {
2894 HCRYPTKEY key;
2895
2896 ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
2897 if (ret)
2898 CryptDestroyKey(key);
2899 }
2900 rpcStringFree(&uuidStr);
2901 }
2902 }
2903 }
2904 FreeLibrary(rpcrt);
2905 }
2906 return hProv;
2907 }
2908
2909 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
2910 PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
2911 PCRYPT_KEY_PROV_INFO pKeyProvInfo,
2912 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
2913 PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
2914 {
2915 PCCERT_CONTEXT context = NULL;
2916 BOOL ret, releaseContext = FALSE;
2917 PCERT_PUBLIC_KEY_INFO pubKey = NULL;
2918 DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
2919
2920 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
2921 pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
2922 pExtensions, pExtensions);
2923
2924 if(!pSubjectIssuerBlob)
2925 {
2926 SetLastError(ERROR_INVALID_PARAMETER);
2927 return NULL;
2928 }
2929
2930 if (!hProv)
2931 {
2932 if (!pKeyProvInfo)
2933 {
2934 hProv = CRYPT_CreateKeyProv();
2935 releaseContext = TRUE;
2936 }
2937 else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
2938 {
2939 SetLastError(NTE_BAD_FLAGS);
2940 return NULL;
2941 }
2942 else
2943 {
2944 HCRYPTKEY hKey = 0;
2945 /* acquire the context using the given information*/
2946 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2947 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2948 pKeyProvInfo->dwFlags);
2949 if (!ret)
2950 {
2951 if(GetLastError() != NTE_BAD_KEYSET)
2952 return NULL;
2953 /* create the key set */
2954 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2955 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2956 pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
2957 if (!ret)
2958 return NULL;
2959 }
2960 dwKeySpec = pKeyProvInfo->dwKeySpec;
2961 /* check if the key is here */
2962 ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
2963 if(!ret)
2964 {
2965 if (NTE_NO_KEY == GetLastError())
2966 { /* generate the key */
2967 ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
2968 }
2969 if (!ret)
2970 {
2971 CryptReleaseContext(hProv,0);
2972 SetLastError(NTE_BAD_KEYSET);
2973 return NULL;
2974 }
2975 }
2976 CryptDestroyKey(hKey);
2977 releaseContext = TRUE;
2978 }
2979 }
2980 else if (pKeyProvInfo)
2981 {
2982 SetLastError(ERROR_INVALID_PARAMETER);
2983 return NULL;
2984 }
2985
2986 CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
2987 &pubKeySize);
2988 pubKey = CryptMemAlloc(pubKeySize);
2989 if (pubKey)
2990 {
2991 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
2992 pubKey, &pubKeySize);
2993 if (ret)
2994 {
2995 CERT_INFO info = { 0 };
2996 CRYPT_DER_BLOB blob = { 0, NULL };
2997 BYTE serial[16];
2998 CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
2999
3000 CryptGenRandom(hProv, sizeof(serial), serial);
3001 CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3002 pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3003 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3004 &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3005 &blob.cbData);
3006 if (ret)
3007 {
3008 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3009 context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3010 &info.SignatureAlgorithm);
3011 else
3012 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3013 blob.pbData, blob.cbData);
3014 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3015 CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3016 LocalFree(blob.pbData);
3017 }
3018 }
3019 CryptMemFree(pubKey);
3020 }
3021 if (releaseContext)
3022 CryptReleaseContext(hProv, 0);
3023 return context;
3024 }
3025
3026 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3027 void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3028 PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3029 PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3030 {
3031 FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3032 dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3033 pVerifyUsageStatus);
3034 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3035 return FALSE;
3036 }
3037
3038 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3039 const BYTE *pbEncoded, DWORD cbEncoded,
3040 DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3041 {
3042 TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3043 pbEncoded, cbEncoded, dwFlags, pCreatePara);
3044
3045 if (dwFlags)
3046 {
3047 FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3048 return NULL;
3049 }
3050 if (pCreatePara)
3051 {
3052 FIXME("pCreatePara not handled\n");
3053 return NULL;
3054 }
3055
3056 switch (dwContextType)
3057 {
3058 case CERT_STORE_CERTIFICATE_CONTEXT:
3059 return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3060 case CERT_STORE_CRL_CONTEXT:
3061 return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3062 case CERT_STORE_CTL_CONTEXT:
3063 return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3064 default:
3065 WARN("unknown context type: 0x%x\n", dwContextType);
3066 return NULL;
3067 }
3068 }
useful hacks and other patches not (yet) suitable for mainline