dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #define NONAMELESSUNION
  24 #include "windef.h"
  25 #include "winbase.h"
  26 #include "wincrypt.h"
  27 #include "winnls.h"
  28 #include "rpc.h"
  29 #include "wine/debug.h"
  30 #include "crypt32_private.h"
  31
  32 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  33
  34 /* Internal version of CertGetCertificateContextProperty that gets properties
  35  * directly from the context (or the context it's linked to, depending on its
  36  * type.) Doesn't handle special-case properties, since they are handled by
  37  * CertGetCertificateContextProperty, and are particular to the store in which
  38  * the property exists (which is separate from the context.)
  39  */
  40 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
  41  void *pvData, DWORD *pcbData);
  42
  43 /* Internal version of CertSetCertificateContextProperty that sets properties
  44  * directly on the context (or the context it's linked to, depending on its
  45  * type.) Doesn't handle special cases, since they're handled by
  46  * CertSetCertificateContextProperty anyway.
  47  */
  48 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
  49  DWORD dwFlags, const void *pvData);
  50
  51 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  52  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  53  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  54 {
  55     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  56      pbCertEncoded, cbCertEncoded);
  57     BOOL ret;
  58
  59     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  60      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  61
  62     if (cert)
  63     {
  64         ret = CertAddCertificateContextToStore(hCertStore, cert,
  65          dwAddDisposition, ppCertContext);
  66         CertFreeCertificateContext(cert);
  67     }
  68     else
  69         ret = FALSE;
  70     return ret;
  71 }
  72
  73 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
  74  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  75 {
  76     PCERT_CONTEXT cert = NULL;
  77     BOOL ret;
  78     PCERT_INFO certInfo = NULL;
  79     DWORD size = 0;
  80
  81     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
  82      cbCertEncoded);
  83
  84     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
  85      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
  86      (BYTE *)&certInfo, &size);
  87     if (ret)
  88     {
  89         BYTE *data = NULL;
  90
  91         cert = (PCERT_CONTEXT)Context_CreateDataContext(sizeof(CERT_CONTEXT));
  92         if (!cert)
  93             goto end;
  94         data = CryptMemAlloc(cbCertEncoded);
  95         if (!data)
  96         {
  97             CryptMemFree(cert);
  98             cert = NULL;
  99             goto end;
 100         }
 101         memcpy(data, pbCertEncoded, cbCertEncoded);
 102         cert->dwCertEncodingType = dwCertEncodingType;
 103         cert->pbCertEncoded      = data;
 104         cert->cbCertEncoded      = cbCertEncoded;
 105         cert->pCertInfo          = certInfo;
 106         cert->hCertStore         = 0;
 107     }
 108
 109 end:
 110     return (PCCERT_CONTEXT)cert;
 111 }
 112
 113 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
 114  PCCERT_CONTEXT pCertContext)
 115 {
 116     TRACE("(%p)\n", pCertContext);
 117     Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
 118     return pCertContext;
 119 }
 120
 121 static void CertDataContext_Free(void *context)
 122 {
 123     PCERT_CONTEXT certContext = (PCERT_CONTEXT)context;
 124
 125     CryptMemFree(certContext->pbCertEncoded);
 126     LocalFree(certContext->pCertInfo);
 127 }
 128
 129 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 130 {
 131     TRACE("(%p)\n", pCertContext);
 132
 133     if (pCertContext)
 134         Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
 135          CertDataContext_Free);
 136     return TRUE;
 137 }
 138
 139 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 140  DWORD dwPropId)
 141 {
 142     PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
 143      (void *)pCertContext, sizeof(CERT_CONTEXT));
 144     DWORD ret;
 145
 146     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 147
 148     if (properties)
 149         ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
 150     else
 151         ret = 0;
 152     return ret;
 153 }
 154
 155 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
 156  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 157  DWORD *pcbData)
 158 {
 159     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 160      pcbData);
 161     if (ret && pvData)
 162     {
 163         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 164
 165         ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
 166     }
 167     return ret;
 168 }
 169
 170 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 171  DWORD cb)
 172 {
 173     BOOL ret = TRUE;
 174
 175     if (!pvData)
 176         *pcbData = cb;
 177     else if (*pcbData < cb)
 178     {
 179         SetLastError(ERROR_MORE_DATA);
 180         *pcbData = cb;
 181         ret = FALSE;
 182     }
 183     else
 184     {
 185         memcpy(pvData, pb, cb);
 186         *pcbData = cb;
 187     }
 188     return ret;
 189 }
 190
 191 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
 192  void *pvData, DWORD *pcbData)
 193 {
 194     PCCERT_CONTEXT pCertContext = (PCCERT_CONTEXT)context;
 195     PCONTEXT_PROPERTY_LIST properties =
 196      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 197     BOOL ret;
 198     CRYPT_DATA_BLOB blob;
 199
 200     TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
 201
 202     if (properties)
 203         ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
 204     else
 205         ret = FALSE;
 206     if (ret)
 207         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 208     else
 209     {
 210         /* Implicit properties */
 211         switch (dwPropId)
 212         {
 213         case CERT_SHA1_HASH_PROP_ID:
 214             ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
 215              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 216              pcbData);
 217             break;
 218         case CERT_MD5_HASH_PROP_ID:
 219             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 220              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 221              pcbData);
 222             break;
 223         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 224             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 225              pCertContext->pCertInfo->Subject.pbData,
 226              pCertContext->pCertInfo->Subject.cbData,
 227              pvData, pcbData);
 228             break;
 229         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 230             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 231              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 232              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 233              pvData, pcbData);
 234             break;
 235         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 236             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 237              pCertContext->pCertInfo->SerialNumber.pbData,
 238              pCertContext->pCertInfo->SerialNumber.cbData,
 239              pvData, pcbData);
 240             break;
 241         case CERT_SIGNATURE_HASH_PROP_ID:
 242             FIXME("CERT_SIGNATURE_HASH_PROP_ID unimplemented\n");
 243             SetLastError(CRYPT_E_NOT_FOUND);
 244             break;
 245         case CERT_KEY_IDENTIFIER_PROP_ID:
 246         {
 247             PCERT_EXTENSION ext = CertFindExtension(
 248              szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
 249              pCertContext->pCertInfo->rgExtension);
 250
 251             if (ext)
 252             {
 253                 CRYPT_DATA_BLOB *value;
 254                 DWORD size;
 255
 256                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 257                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 258                  ext->Value.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &value,
 259                  &size);
 260                 if (ret)
 261                 {
 262                     ret = CertContext_CopyParam(pvData, pcbData, value->pbData,
 263                      value->cbData);
 264                     CertContext_SetProperty(context, dwPropId, 0, value);
 265                     LocalFree(value);
 266                 }
 267             }
 268             else
 269                 SetLastError(ERROR_INVALID_DATA);
 270             break;
 271         }
 272         default:
 273             SetLastError(CRYPT_E_NOT_FOUND);
 274         }
 275     }
 276     TRACE("returning %d\n", ret);
 277     return ret;
 278 }
 279
 280 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
 281 {
 282     DWORD i, containerLen, provNameLen;
 283     LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
 284
 285     info->pwszContainerName = (LPWSTR)data;
 286     containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 287     data += containerLen;
 288
 289     info->pwszProvName = (LPWSTR)data;
 290     provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 291     data += provNameLen;
 292
 293     info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
 294     data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 295
 296     for (i = 0; i < info->cProvParam; i++)
 297     {
 298         info->rgProvParam[i].pbData = data;
 299         data += info->rgProvParam[i].cbData;
 300     }
 301 }
 302
 303 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 304  DWORD dwPropId, void *pvData, DWORD *pcbData)
 305 {
 306     BOOL ret;
 307
 308     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 309
 310     switch (dwPropId)
 311     {
 312     case 0:
 313     case CERT_CERT_PROP_ID:
 314     case CERT_CRL_PROP_ID:
 315     case CERT_CTL_PROP_ID:
 316         SetLastError(E_INVALIDARG);
 317         ret = FALSE;
 318         break;
 319     case CERT_ACCESS_STATE_PROP_ID:
 320         if (pCertContext->hCertStore)
 321             ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
 322              pvData, pcbData);
 323         else
 324         {
 325             DWORD state = 0;
 326
 327             ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
 328         }
 329         break;
 330     case CERT_KEY_PROV_HANDLE_PROP_ID:
 331     {
 332         CERT_KEY_CONTEXT keyContext;
 333         DWORD size = sizeof(keyContext);
 334
 335         ret = CertContext_GetProperty((void *)pCertContext,
 336          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 337         if (ret)
 338             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 339              sizeof(keyContext.hCryptProv));
 340         break;
 341     }
 342     case CERT_KEY_PROV_INFO_PROP_ID:
 343         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 344          pcbData);
 345         if (ret && pvData)
 346             CRYPT_FixKeyProvInfoPointers((PCRYPT_KEY_PROV_INFO)pvData);
 347         break;
 348     default:
 349         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 350          pcbData);
 351     }
 352
 353     TRACE("returning %d\n", ret);
 354     return ret;
 355 }
 356
 357 /* Copies key provider info from from into to, where to is assumed to be a
 358  * contiguous buffer of memory large enough for from and all its associated
 359  * data, but whose pointers are uninitialized.
 360  * Upon return, to contains a contiguous copy of from, packed in the following
 361  * order:
 362  * - CRYPT_KEY_PROV_INFO
 363  * - pwszContainerName
 364  * - pwszProvName
 365  * - rgProvParam[0]...
 366  */
 367 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
 368  const CRYPT_KEY_PROV_INFO *from)
 369 {
 370     DWORD i;
 371     LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
 372
 373     if (from->pwszContainerName)
 374     {
 375         to->pwszContainerName = (LPWSTR)nextData;
 376         lstrcpyW(to->pwszContainerName, from->pwszContainerName);
 377         nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 378     }
 379     else
 380         to->pwszContainerName = NULL;
 381     if (from->pwszProvName)
 382     {
 383         to->pwszProvName = (LPWSTR)nextData;
 384         lstrcpyW(to->pwszProvName, from->pwszProvName);
 385         nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 386     }
 387     else
 388         to->pwszProvName = NULL;
 389     to->dwProvType = from->dwProvType;
 390     to->dwFlags = from->dwFlags;
 391     to->cProvParam = from->cProvParam;
 392     to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
 393     nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 394     to->dwKeySpec = from->dwKeySpec;
 395     for (i = 0; i < to->cProvParam; i++)
 396     {
 397         memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
 398          sizeof(CRYPT_KEY_PROV_PARAM));
 399         to->rgProvParam[i].pbData = nextData;
 400         memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
 401          from->rgProvParam[i].cbData);
 402         nextData += from->rgProvParam[i].cbData;
 403     }
 404 }
 405
 406 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
 407  const CRYPT_KEY_PROV_INFO *info)
 408 {
 409     BOOL ret;
 410     LPBYTE buf = NULL;
 411     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
 412
 413     if (info->pwszContainerName)
 414         containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 415     else
 416         containerSize = 0;
 417     if (info->pwszProvName)
 418         provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 419     else
 420         provNameSize = 0;
 421     size += containerSize + provNameSize;
 422     for (i = 0; i < info->cProvParam; i++)
 423         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 424     buf = CryptMemAlloc(size);
 425     if (buf)
 426     {
 427         CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
 428         ret = ContextPropertyList_SetProperty(properties,
 429          CERT_KEY_PROV_INFO_PROP_ID, buf, size);
 430         CryptMemFree(buf);
 431     }
 432     else
 433         ret = FALSE;
 434     return ret;
 435 }
 436
 437 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
 438  DWORD dwFlags, const void *pvData)
 439 {
 440     PCONTEXT_PROPERTY_LIST properties =
 441      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 442     BOOL ret;
 443
 444     TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
 445
 446     if (!properties)
 447         ret = FALSE;
 448     else
 449     {
 450         switch (dwPropId)
 451         {
 452         case CERT_AUTO_ENROLL_PROP_ID:
 453         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 454         case CERT_DESCRIPTION_PROP_ID:
 455         case CERT_FRIENDLY_NAME_PROP_ID:
 456         case CERT_HASH_PROP_ID:
 457         case CERT_KEY_IDENTIFIER_PROP_ID:
 458         case CERT_MD5_HASH_PROP_ID:
 459         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 460         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 461         case CERT_PVK_FILE_PROP_ID:
 462         case CERT_SIGNATURE_HASH_PROP_ID:
 463         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 464         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 465         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 466         case CERT_ENROLLMENT_PROP_ID:
 467         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 468         case CERT_RENEWAL_PROP_ID:
 469         {
 470             if (pvData)
 471             {
 472                 const CRYPT_DATA_BLOB *blob = (const CRYPT_DATA_BLOB *)pvData;
 473
 474                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 475                  blob->pbData, blob->cbData);
 476             }
 477             else
 478             {
 479                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 480                 ret = TRUE;
 481             }
 482             break;
 483         }
 484         case CERT_DATE_STAMP_PROP_ID:
 485             if (pvData)
 486                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 487                  (const BYTE *)pvData, sizeof(FILETIME));
 488             else
 489             {
 490                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 491                 ret = TRUE;
 492             }
 493             break;
 494         case CERT_KEY_CONTEXT_PROP_ID:
 495         {
 496             if (pvData)
 497             {
 498                 const CERT_KEY_CONTEXT *keyContext = (const CERT_KEY_CONTEXT *)pvData;
 499
 500                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 501                 {
 502                     SetLastError(E_INVALIDARG);
 503                     ret = FALSE;
 504                 }
 505                 else
 506                     ret = ContextPropertyList_SetProperty(properties, dwPropId,
 507                      (const BYTE *)keyContext, keyContext->cbSize);
 508             }
 509             else
 510             {
 511                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 512                 ret = TRUE;
 513             }
 514             break;
 515         }
 516         case CERT_KEY_PROV_INFO_PROP_ID:
 517             if (pvData)
 518                 ret = CertContext_SetKeyProvInfoProperty(properties,
 519                  (const CRYPT_KEY_PROV_INFO *)pvData);
 520             else
 521             {
 522                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 523                 ret = TRUE;
 524             }
 525             break;
 526         case CERT_KEY_PROV_HANDLE_PROP_ID:
 527         {
 528             CERT_KEY_CONTEXT keyContext;
 529             DWORD size = sizeof(keyContext);
 530
 531             ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 532              &keyContext, &size);
 533             if (ret)
 534             {
 535                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 536                     CryptReleaseContext(keyContext.hCryptProv, 0);
 537                 if (pvData)
 538                     keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 539                 else
 540                     keyContext.hCryptProv = 0;
 541                 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 542                  0, &keyContext);
 543             }
 544             break;
 545         }
 546         default:
 547             FIXME("%d: stub\n", dwPropId);
 548             ret = FALSE;
 549         }
 550     }
 551     TRACE("returning %d\n", ret);
 552     return ret;
 553 }
 554
 555 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 556  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 557 {
 558     BOOL ret;
 559
 560     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 561
 562     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 563      * crashes on most of these, I'll be safer.
 564      */
 565     switch (dwPropId)
 566     {
 567     case 0:
 568     case CERT_ACCESS_STATE_PROP_ID:
 569     case CERT_CERT_PROP_ID:
 570     case CERT_CRL_PROP_ID:
 571     case CERT_CTL_PROP_ID:
 572         SetLastError(E_INVALIDARG);
 573         return FALSE;
 574     }
 575     ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
 576      pvData);
 577     TRACE("returning %d\n", ret);
 578     return ret;
 579 }
 580
 581 /* Acquires the private key using the key provider info, retrieving info from
 582  * the certificate if info is NULL.  The acquired provider is returned in
 583  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 584  */
 585 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
 586  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 587 {
 588     DWORD size = 0;
 589     BOOL allocated = FALSE, ret = TRUE;
 590
 591     if (!info)
 592     {
 593         ret = CertGetCertificateContextProperty(pCert,
 594          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 595         if (ret)
 596         {
 597             info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(GetProcessHeap(), 0, size);
 598             if (info)
 599             {
 600                 ret = CertGetCertificateContextProperty(pCert,
 601                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 602                 allocated = TRUE;
 603             }
 604         }
 605         else
 606             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 607     }
 608     if (ret)
 609     {
 610         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 611          info->pwszProvName, info->dwProvType, 0);
 612         if (ret)
 613         {
 614             DWORD i;
 615
 616             for (i = 0; i < info->cProvParam; i++)
 617             {
 618                 CryptSetProvParam(*phCryptProv,
 619                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 620                  info->rgProvParam[i].dwFlags);
 621             }
 622             *pdwKeySpec = info->dwKeySpec;
 623         }
 624         else
 625             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 626     }
 627     if (allocated)
 628         HeapFree(GetProcessHeap(), 0, info);
 629     return ret;
 630 }
 631
 632 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 633  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 634  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 635 {
 636     BOOL ret = FALSE, cache = FALSE;
 637     PCRYPT_KEY_PROV_INFO info = NULL;
 638     CERT_KEY_CONTEXT keyContext;
 639     DWORD size;
 640
 641     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 642      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 643
 644     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 645     {
 646         DWORD size = 0;
 647
 648         ret = CertGetCertificateContextProperty(pCert,
 649          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 650         if (ret)
 651         {
 652             info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(
 653              GetProcessHeap(), 0, size);
 654             ret = CertGetCertificateContextProperty(pCert,
 655              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 656             if (ret)
 657                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 658         }
 659     }
 660     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 661         cache = TRUE;
 662     *phCryptProv = 0;
 663     if (cache)
 664     {
 665         size = sizeof(keyContext);
 666         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 667          &keyContext, &size);
 668         if (ret)
 669         {
 670             *phCryptProv = keyContext.hCryptProv;
 671             if (pdwKeySpec)
 672                 *pdwKeySpec = keyContext.dwKeySpec;
 673             if (pfCallerFreeProv)
 674                 *pfCallerFreeProv = !cache;
 675         }
 676     }
 677     if (!*phCryptProv)
 678     {
 679         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
 680          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 681         if (ret)
 682         {
 683             *phCryptProv = keyContext.hCryptProv;
 684             if (pdwKeySpec)
 685                 *pdwKeySpec = keyContext.dwKeySpec;
 686             if (cache)
 687             {
 688                 keyContext.cbSize = sizeof(keyContext);
 689                 if (CertSetCertificateContextProperty(pCert,
 690                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 691                 {
 692                     if (pfCallerFreeProv)
 693                         *pfCallerFreeProv = FALSE;
 694                 }
 695             }
 696             else
 697             {
 698                 if (pfCallerFreeProv)
 699                     *pfCallerFreeProv = TRUE;
 700             }
 701         }
 702     }
 703     HeapFree(GetProcessHeap(), 0, info);
 704     return ret;
 705 }
 706
 707 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
 708  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
 709 {
 710     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
 711
 712     return CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
 713      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
 714      &pCertId2->SerialNumber);
 715 }
 716
 717 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
 718  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
 719 {
 720     BOOL ret;
 721
 722     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
 723
 724     if (pCertName1->cbData == pCertName2->cbData)
 725     {
 726         if (pCertName1->cbData)
 727             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
 728              pCertName1->cbData);
 729         else
 730             ret = TRUE;
 731     }
 732     else
 733         ret = FALSE;
 734     return ret;
 735 }
 736
 737 /* Returns the number of significant bytes in pInt, where a byte is
 738  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
 739  * for negative numbers.  pInt is assumed to be little-endian.
 740  */
 741 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
 742 {
 743     DWORD ret = pInt->cbData;
 744
 745     while (ret > 1)
 746     {
 747         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
 748             ret--;
 749         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
 750             ret--;
 751         else
 752             break;
 753     }
 754     return ret;
 755 }
 756
 757 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
 758  PCRYPT_INTEGER_BLOB pInt2)
 759 {
 760     BOOL ret;
 761     DWORD cb1, cb2;
 762
 763     TRACE("(%p, %p)\n", pInt1, pInt2);
 764
 765     cb1 = CRYPT_significantBytes(pInt1);
 766     cb2 = CRYPT_significantBytes(pInt2);
 767     if (cb1 == cb2)
 768     {
 769         if (cb1)
 770             ret = !memcmp(pInt1->pbData, pInt1->pbData, cb1);
 771         else
 772             ret = TRUE;
 773     }
 774     else
 775         ret = FALSE;
 776     return ret;
 777 }
 778
 779 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
 780  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
 781 {
 782     BOOL ret;
 783
 784     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
 785
 786     if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
 787      pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
 788     {
 789         if (pPublicKey2->PublicKey.cbData)
 790             ret = !memcmp(pPublicKey1->PublicKey.pbData,
 791              pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
 792         else
 793             ret = TRUE;
 794     }
 795     else
 796         ret = FALSE;
 797     return ret;
 798 }
 799
 800 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
 801  PCERT_PUBLIC_KEY_INFO pPublicKey)
 802 {
 803     DWORD len = 0;
 804
 805     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
 806
 807     if (dwCertEncodingType != X509_ASN_ENCODING)
 808     {
 809         SetLastError(ERROR_FILE_NOT_FOUND);
 810         return 0;
 811     }
 812     if (pPublicKey->Algorithm.pszObjId &&
 813      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
 814     {
 815         FIXME("unimplemented for DH public keys\n");
 816         SetLastError(CRYPT_E_ASN1_BADTAG);
 817     }
 818     else
 819     {
 820         DWORD size;
 821         PBYTE buf;
 822         BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
 823          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
 824          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
 825          &size);
 826
 827         if (ret)
 828         {
 829             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)((LPBYTE)buf +
 830              sizeof(BLOBHEADER));
 831
 832             len = rsaPubKey->bitlen;
 833             LocalFree(buf);
 834         }
 835     }
 836     return len;
 837 }
 838
 839 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
 840  DWORD dwFlags, const void *pvPara);
 841
 842 static BOOL compare_cert_any(PCCERT_CONTEXT pCertContext, DWORD dwType,
 843  DWORD dwFlags, const void *pvPara)
 844 {
 845     return TRUE;
 846 }
 847
 848 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
 849  DWORD dwFlags, const void *pvPara)
 850 {
 851     BOOL ret;
 852     BYTE hash[16];
 853     DWORD size = sizeof(hash);
 854
 855     ret = CertGetCertificateContextProperty(pCertContext,
 856      CERT_MD5_HASH_PROP_ID, hash, &size);
 857     if (ret)
 858     {
 859         const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
 860
 861         if (size == pHash->cbData)
 862             ret = !memcmp(pHash->pbData, hash, size);
 863         else
 864             ret = FALSE;
 865     }
 866     return ret;
 867 }
 868
 869 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
 870  DWORD dwFlags, const void *pvPara)
 871 {
 872     BOOL ret;
 873     BYTE hash[20];
 874     DWORD size = sizeof(hash);
 875
 876     ret = CertGetCertificateContextProperty(pCertContext,
 877      CERT_SHA1_HASH_PROP_ID, hash, &size);
 878     if (ret)
 879     {
 880         const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
 881
 882         if (size == pHash->cbData)
 883             ret = !memcmp(pHash->pbData, hash, size);
 884         else
 885             ret = FALSE;
 886     }
 887     return ret;
 888 }
 889
 890 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
 891  DWORD dwFlags, const void *pvPara)
 892 {
 893     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
 894     BOOL ret;
 895
 896     if (dwType & CERT_INFO_SUBJECT_FLAG)
 897         toCompare = &pCertContext->pCertInfo->Subject;
 898     else
 899         toCompare = &pCertContext->pCertInfo->Issuer;
 900     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
 901      toCompare, blob);
 902     return ret;
 903 }
 904
 905 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
 906  DWORD dwType, DWORD dwFlags, const void *pvPara)
 907 {
 908     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
 909
 910     return CertCompareCertificateName(pCertContext->dwCertEncodingType,
 911      &pCertInfo->Issuer, &pCertContext->pCertInfo->Subject);
 912 }
 913
 914 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
 915  DWORD dwFlags, const void *pvPara)
 916 {
 917     CERT_ID *id = (CERT_ID *)pvPara;
 918     BOOL ret;
 919
 920     switch (id->dwIdChoice)
 921     {
 922     case CERT_ID_ISSUER_SERIAL_NUMBER:
 923         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
 924          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
 925         if (ret)
 926             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
 927              &id->u.IssuerSerialNumber.SerialNumber);
 928         break;
 929     case CERT_ID_SHA1_HASH:
 930         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
 931          &id->u.HashId);
 932         break;
 933     case CERT_ID_KEY_IDENTIFIER:
 934     {
 935         DWORD size = 0;
 936
 937         ret = CertGetCertificateContextProperty(pCertContext,
 938          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 939         if (ret && size == id->u.KeyId.cbData)
 940         {
 941             LPBYTE buf = CryptMemAlloc(size);
 942
 943             if (buf)
 944             {
 945                 CertGetCertificateContextProperty(pCertContext,
 946                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
 947                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
 948                 CryptMemFree(buf);
 949             }
 950         }
 951         else
 952             ret = FALSE;
 953     }
 954     default:
 955         ret = FALSE;
 956         break;
 957     }
 958     return ret;
 959 }
 960
 961 static BOOL compare_cert_by_issuer(PCCERT_CONTEXT pCertContext, DWORD dwType,
 962  DWORD dwFlags, const void *pvPara)
 963 {
 964     return compare_cert_by_subject_cert(pCertContext, dwType, dwFlags,
 965      ((PCCERT_CONTEXT)pvPara)->pCertInfo);
 966 }
 967
 968 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
 969  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
 970  PCCERT_CONTEXT pPrevCertContext)
 971 {
 972     PCCERT_CONTEXT ret;
 973     CertCompareFunc compare;
 974
 975     TRACE("(%p, %d, %d, %d, %p, %p)\n", hCertStore, dwCertEncodingType,
 976          dwFlags, dwType, pvPara, pPrevCertContext);
 977
 978     switch (dwType >> CERT_COMPARE_SHIFT)
 979     {
 980     case CERT_COMPARE_ANY:
 981         compare = compare_cert_any;
 982         break;
 983     case CERT_COMPARE_MD5_HASH:
 984         compare = compare_cert_by_md5_hash;
 985         break;
 986     case CERT_COMPARE_SHA1_HASH:
 987         compare = compare_cert_by_sha1_hash;
 988         break;
 989     case CERT_COMPARE_NAME:
 990         compare = compare_cert_by_name;
 991         break;
 992     case CERT_COMPARE_SUBJECT_CERT:
 993         compare = compare_cert_by_subject_cert;
 994         break;
 995     case CERT_COMPARE_CERT_ID:
 996         compare = compare_cert_by_cert_id;
 997         break;
 998     case CERT_COMPARE_ISSUER_OF:
 999         compare = compare_cert_by_issuer;
1000         break;
1001     default:
1002         FIXME("find type %08x unimplemented\n", dwType);
1003         compare = NULL;
1004     }
1005
1006     if (compare)
1007     {
1008         BOOL matches = FALSE;
1009
1010         ret = pPrevCertContext;
1011         do {
1012             ret = CertEnumCertificatesInStore(hCertStore, ret);
1013             if (ret)
1014                 matches = compare(ret, dwType, dwFlags, pvPara);
1015         } while (ret != NULL && !matches);
1016         if (!ret)
1017             SetLastError(CRYPT_E_NOT_FOUND);
1018     }
1019     else
1020     {
1021         SetLastError(CRYPT_E_NOT_FOUND);
1022         ret = NULL;
1023     }
1024     return ret;
1025 }
1026
1027 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1028  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1029 {
1030     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1031
1032     if (!pCertId)
1033     {
1034         SetLastError(E_INVALIDARG);
1035         return NULL;
1036     }
1037     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1038      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1039 }
1040
1041 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1042  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1043 {
1044     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1045      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1046
1047     if (*pdwFlags & ~supportedFlags)
1048     {
1049         SetLastError(E_INVALIDARG);
1050         return FALSE;
1051     }
1052     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1053     {
1054         DWORD flags = 0;
1055         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1056          NULL, &flags);
1057
1058         /* FIXME: what if the CRL has expired? */
1059         if (crl)
1060         {
1061             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1062              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1063                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1064         }
1065         else
1066             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1067     }
1068     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1069     {
1070         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1071             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1072     }
1073     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1074     {
1075         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1076          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1077          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1078             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1079     }
1080     return TRUE;
1081 }
1082
1083 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1084  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1085  DWORD *pdwFlags)
1086 {
1087     PCCERT_CONTEXT ret;
1088
1089     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1090      pPrevIssuerContext, *pdwFlags);
1091
1092     if (!pSubjectContext)
1093     {
1094         SetLastError(E_INVALIDARG);
1095         return NULL;
1096     }
1097
1098     ret = CertFindCertificateInStore(hCertStore,
1099      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1100      pSubjectContext, pPrevIssuerContext);
1101     if (ret)
1102     {
1103         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1104          pdwFlags))
1105         {
1106             CertFreeCertificateContext(ret);
1107             ret = NULL;
1108         }
1109     }
1110
1111     return ret;
1112 }
1113
1114 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1115  CRYPT_ATTRIBUTE rgAttr[])
1116 {
1117     PCRYPT_ATTRIBUTE ret = NULL;
1118     DWORD i;
1119
1120     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1121
1122     if (!cAttr)
1123         return NULL;
1124     if (!pszObjId)
1125     {
1126         SetLastError(ERROR_INVALID_PARAMETER);
1127         return NULL;
1128     }
1129
1130     for (i = 0; !ret && i < cAttr; i++)
1131         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1132             ret = &rgAttr[i];
1133     return ret;
1134 }
1135
1136 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1137  CERT_EXTENSION rgExtensions[])
1138 {
1139     PCERT_EXTENSION ret = NULL;
1140     DWORD i;
1141
1142     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1143
1144     if (!cExtensions)
1145         return NULL;
1146     if (!pszObjId)
1147     {
1148         SetLastError(ERROR_INVALID_PARAMETER);
1149         return NULL;
1150     }
1151
1152     for (i = 0; !ret && i < cExtensions; i++)
1153         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1154          rgExtensions[i].pszObjId))
1155             ret = &rgExtensions[i];
1156     return ret;
1157 }
1158
1159 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1160 {
1161     PCERT_RDN_ATTR ret = NULL;
1162     DWORD i, j;
1163
1164     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1165
1166     if (!pszObjId)
1167     {
1168         SetLastError(ERROR_INVALID_PARAMETER);
1169         return NULL;
1170     }
1171
1172     for (i = 0; !ret && i < pName->cRDN; i++)
1173         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1174             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1175              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1176                 ret = &pName->rgRDN[i].rgRDNAttr[j];
1177     return ret;
1178 }
1179
1180 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1181  PCERT_INFO pCertInfo)
1182 {
1183     FILETIME fileTime;
1184     LONG ret;
1185
1186     if (!pTimeToVerify)
1187     {
1188         SYSTEMTIME sysTime;
1189
1190         GetSystemTime(&sysTime);
1191         SystemTimeToFileTime(&sysTime, &fileTime);
1192         pTimeToVerify = &fileTime;
1193     }
1194     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1195     {
1196         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1197         if (ret < 0)
1198             ret = 0;
1199     }
1200     return ret;
1201 }
1202
1203 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1204  PCERT_INFO pIssuerInfo)
1205 {
1206     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1207
1208     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1209      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1210 }
1211
1212 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1213  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1214  DWORD *pcbComputedHash)
1215 {
1216     BOOL ret = TRUE;
1217     HCRYPTHASH hHash = 0;
1218
1219     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1220      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1221
1222     if (!hCryptProv)
1223         hCryptProv = CRYPT_GetDefaultProvider();
1224     if (!Algid)
1225         Algid = CALG_SHA1;
1226     if (ret)
1227     {
1228         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1229         if (ret)
1230         {
1231             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1232             if (ret)
1233                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1234                  pcbComputedHash, 0);
1235             CryptDestroyHash(hHash);
1236         }
1237     }
1238     return ret;
1239 }
1240
1241 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1242  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1243  BYTE *pbComputedHash, DWORD *pcbComputedHash)
1244 {
1245     BOOL ret = TRUE;
1246     HCRYPTHASH hHash = 0;
1247
1248     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1249      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1250
1251     if (!hCryptProv)
1252         hCryptProv = CRYPT_GetDefaultProvider();
1253     if (!Algid)
1254         Algid = CALG_MD5;
1255     if (ret)
1256     {
1257         BYTE *buf;
1258         DWORD size = 0;
1259
1260         ret = CryptEncodeObjectEx(dwCertEncodingType, X509_PUBLIC_KEY_INFO,
1261          pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
1262         if (ret)
1263         {
1264             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1265             if (ret)
1266             {
1267                 ret = CryptHashData(hHash, buf, size, 0);
1268                 if (ret)
1269                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1270                      pcbComputedHash, 0);
1271                 CryptDestroyHash(hHash);
1272             }
1273             LocalFree(buf);
1274         }
1275     }
1276     return ret;
1277 }
1278
1279 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1280  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
1281  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1282  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
1283 {
1284     BOOL ret;
1285     PCCRYPT_OID_INFO info;
1286     HCRYPTHASH hHash;
1287
1288     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
1289      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
1290      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
1291
1292     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1293      pSignatureAlgorithm->pszObjId, 0);
1294     if (!info)
1295     {
1296         SetLastError(NTE_BAD_ALGID);
1297         return FALSE;
1298     }
1299     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
1300     {
1301         if (!hCryptProv)
1302             hCryptProv = CRYPT_GetDefaultProvider();
1303         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1304         if (ret)
1305         {
1306             ret = CryptHashData(hHash, pbEncodedToBeSigned,
1307              cbEncodedToBeSigned, 0);
1308             if (ret)
1309                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
1310                  pcbSignature, 0);
1311             CryptDestroyHash(hHash);
1312         }
1313     }
1314     else
1315     {
1316         if (!hCryptProv)
1317         {
1318             SetLastError(ERROR_INVALID_PARAMETER);
1319             ret = FALSE;
1320         }
1321         else
1322         {
1323             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1324             if (ret)
1325             {
1326                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1327                  cbEncodedToBeSigned, 0);
1328                 if (ret)
1329                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
1330                      pcbSignature);
1331                 CryptDestroyHash(hHash);
1332             }
1333         }
1334     }
1335     return ret;
1336 }
1337
1338 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1339  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
1340  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1341  const void *pvHashAuxInfo, PBYTE pbEncoded, DWORD *pcbEncoded)
1342 {
1343     BOOL ret;
1344     DWORD encodedSize, hashSize;
1345
1346     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
1347      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
1348      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
1349
1350     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
1351      NULL, &encodedSize);
1352     if (ret)
1353     {
1354         PBYTE encoded = CryptMemAlloc(encodedSize);
1355
1356         if (encoded)
1357         {
1358             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
1359              pvStructInfo, encoded, &encodedSize);
1360             if (ret)
1361             {
1362                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1363                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
1364                  pvHashAuxInfo, NULL, &hashSize);
1365                 if (ret)
1366                 {
1367                     PBYTE hash = CryptMemAlloc(hashSize);
1368
1369                     if (hash)
1370                     {
1371                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1372                          dwCertEncodingType, encoded, encodedSize,
1373                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
1374                         if (ret)
1375                         {
1376                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
1377
1378                             info.ToBeSigned.cbData = encodedSize;
1379                             info.ToBeSigned.pbData = encoded;
1380                             memcpy(&info.SignatureAlgorithm,
1381                              pSignatureAlgorithm,
1382                              sizeof(info.SignatureAlgorithm));
1383                             info.Signature.cbData = hashSize;
1384                             info.Signature.pbData = hash;
1385                             info.Signature.cUnusedBits = 0;
1386                             ret = CryptEncodeObject(dwCertEncodingType,
1387                              X509_CERT, &info, pbEncoded, pcbEncoded);
1388                         }
1389                         CryptMemFree(hash);
1390                     }
1391                 }
1392             }
1393             CryptMemFree(encoded);
1394         }
1395     }
1396     return ret;
1397 }
1398
1399 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
1400  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1401  PCERT_PUBLIC_KEY_INFO pPublicKey)
1402 {
1403     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
1404      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
1405      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
1406 }
1407
1408 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
1409  DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
1410  const CERT_SIGNED_CONTENT_INFO *signedCert)
1411 {
1412     BOOL ret;
1413     HCRYPTKEY key;
1414     PCCRYPT_OID_INFO info;
1415     ALG_ID pubKeyID, hashID;
1416
1417     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1418      signedCert->SignatureAlgorithm.pszObjId, 0);
1419     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
1420     {
1421         SetLastError(NTE_BAD_ALGID);
1422         return FALSE;
1423     }
1424     hashID = info->u.Algid;
1425     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
1426         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
1427     else
1428         pubKeyID = hashID;
1429     /* Load the default provider if necessary */
1430     if (!hCryptProv)
1431         hCryptProv = CRYPT_GetDefaultProvider();
1432     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
1433      pubKeyInfo, pubKeyID, 0, NULL, &key);
1434     if (ret)
1435     {
1436         HCRYPTHASH hash;
1437
1438         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
1439         if (ret)
1440         {
1441             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
1442              signedCert->ToBeSigned.cbData, 0);
1443             if (ret)
1444                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
1445                  signedCert->Signature.cbData, key, NULL, 0);
1446             CryptDestroyHash(hash);
1447         }
1448         CryptDestroyKey(key);
1449     }
1450     return ret;
1451 }
1452
1453 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
1454  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
1455  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
1456 {
1457     BOOL ret = TRUE;
1458     CRYPT_DATA_BLOB subjectBlob;
1459
1460     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
1461      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
1462      dwFlags, pvReserved);
1463
1464     switch (dwSubjectType)
1465     {
1466     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
1467     {
1468         PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvSubject;
1469
1470         subjectBlob.pbData = blob->pbData;
1471         subjectBlob.cbData = blob->cbData;
1472         break;
1473     }
1474     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
1475     {
1476         PCERT_CONTEXT context = (PCERT_CONTEXT)pvSubject;
1477
1478         subjectBlob.pbData = context->pbCertEncoded;
1479         subjectBlob.cbData = context->cbCertEncoded;
1480         break;
1481     }
1482     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
1483     {
1484         PCRL_CONTEXT context = (PCRL_CONTEXT)pvSubject;
1485
1486         subjectBlob.pbData = context->pbCrlEncoded;
1487         subjectBlob.cbData = context->cbCrlEncoded;
1488         break;
1489     }
1490     default:
1491         SetLastError(E_INVALIDARG);
1492         ret = FALSE;
1493     }
1494
1495     if (ret)
1496     {
1497         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
1498         DWORD size = 0;
1499
1500         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1501          subjectBlob.pbData, subjectBlob.cbData,
1502          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1503          (BYTE *)&signedCert, &size);
1504         if (ret)
1505         {
1506             switch (dwIssuerType)
1507             {
1508             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
1509                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1510                  dwCertEncodingType, (PCERT_PUBLIC_KEY_INFO)pvIssuer,
1511                  signedCert);
1512                 break;
1513             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
1514                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1515                  dwCertEncodingType,
1516                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
1517                  signedCert);
1518                 break;
1519             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
1520                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
1521                 ret = FALSE;
1522                 break;
1523             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
1524                 if (pvIssuer)
1525                 {
1526                     SetLastError(E_INVALIDARG);
1527                     ret = FALSE;
1528                 }
1529                 else
1530                 {
1531                     FIXME("unimplemented for NULL signer\n");
1532                     SetLastError(E_INVALIDARG);
1533                     ret = FALSE;
1534                 }
1535                 break;
1536             default:
1537                 SetLastError(E_INVALIDARG);
1538                 ret = FALSE;
1539             }
1540             LocalFree(signedCert);
1541         }
1542     }
1543     return ret;
1544 }
1545
1546 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
1547  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
1548 {
1549     PCERT_ENHKEY_USAGE usage = NULL;
1550     DWORD bytesNeeded;
1551     BOOL ret = TRUE;
1552
1553     if (!pCertContext || !pcbUsage)
1554     {
1555         SetLastError(ERROR_INVALID_PARAMETER);
1556         return FALSE;
1557     }
1558
1559     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
1560
1561     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
1562     {
1563         DWORD propSize = 0;
1564
1565         if (CertGetCertificateContextProperty(pCertContext,
1566          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
1567         {
1568             LPBYTE buf = CryptMemAlloc(propSize);
1569
1570             if (buf)
1571             {
1572                 if (CertGetCertificateContextProperty(pCertContext,
1573                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
1574                 {
1575                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1576                      X509_ENHANCED_KEY_USAGE, buf, propSize,
1577                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1578                 }
1579                 CryptMemFree(buf);
1580             }
1581         }
1582     }
1583     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
1584     {
1585         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
1586          pCertContext->pCertInfo->cExtension,
1587          pCertContext->pCertInfo->rgExtension);
1588
1589         if (ext)
1590         {
1591             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1592              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
1593              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1594         }
1595     }
1596     if (!usage)
1597     {
1598         /* If a particular location is specified, this should fail.  Otherwise
1599          * it should succeed with an empty usage.  (This is true on Win2k and
1600          * later, which we emulate.)
1601          */
1602         if (dwFlags)
1603         {
1604             SetLastError(CRYPT_E_NOT_FOUND);
1605             ret = FALSE;
1606         }
1607         else
1608             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
1609     }
1610
1611     if (ret)
1612     {
1613         if (!pUsage)
1614             *pcbUsage = bytesNeeded;
1615         else if (*pcbUsage < bytesNeeded)
1616         {
1617             SetLastError(ERROR_MORE_DATA);
1618             *pcbUsage = bytesNeeded;
1619             ret = FALSE;
1620         }
1621         else
1622         {
1623             *pcbUsage = bytesNeeded;
1624             if (usage)
1625             {
1626                 DWORD i;
1627                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
1628                  sizeof(CERT_ENHKEY_USAGE) +
1629                  usage->cUsageIdentifier * sizeof(LPSTR));
1630
1631                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
1632                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
1633                  sizeof(CERT_ENHKEY_USAGE));
1634                 for (i = 0; i < usage->cUsageIdentifier; i++)
1635                 {
1636                     pUsage->rgpszUsageIdentifier[i] = nextOID;
1637                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1638                     nextOID += strlen(nextOID) + 1;
1639                 }
1640             }
1641             else
1642                 pUsage->cUsageIdentifier = 0;
1643         }
1644     }
1645     if (usage)
1646         LocalFree(usage);
1647     TRACE("returning %d\n", ret);
1648     return ret;
1649 }
1650
1651 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
1652  PCERT_ENHKEY_USAGE pUsage)
1653 {
1654     BOOL ret;
1655
1656     TRACE("(%p, %p)\n", pCertContext, pUsage);
1657
1658     if (pUsage)
1659     {
1660         CRYPT_DATA_BLOB blob = { 0, NULL };
1661
1662         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
1663          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
1664         if (ret)
1665         {
1666             ret = CertSetCertificateContextProperty(pCertContext,
1667              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
1668             LocalFree(blob.pbData);
1669         }
1670     }
1671     else
1672         ret = CertSetCertificateContextProperty(pCertContext,
1673          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
1674     return ret;
1675 }
1676
1677 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1678  LPCSTR pszUsageIdentifier)
1679 {
1680     BOOL ret;
1681     DWORD size;
1682
1683     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1684
1685     if (CertGetEnhancedKeyUsage(pCertContext,
1686      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
1687     {
1688         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
1689
1690         if (usage)
1691         {
1692             ret = CertGetEnhancedKeyUsage(pCertContext,
1693              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
1694             if (ret)
1695             {
1696                 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
1697                  sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1698
1699                 if (newUsage)
1700                 {
1701                     LPSTR nextOID;
1702                     DWORD i;
1703
1704                     newUsage->rgpszUsageIdentifier =
1705                      (LPSTR *)((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
1706                     nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier +
1707                      (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
1708                     for (i = 0; i < usage->cUsageIdentifier; i++)
1709                     {
1710                         newUsage->rgpszUsageIdentifier[i] = nextOID;
1711                         strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1712                         nextOID += strlen(nextOID) + 1;
1713                     }
1714                     newUsage->rgpszUsageIdentifier[i] = nextOID;
1715                     strcpy(nextOID, pszUsageIdentifier);
1716                     newUsage->cUsageIdentifier = i + 1;
1717                     ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
1718                     CryptMemFree(newUsage);
1719                 }
1720             }
1721             CryptMemFree(usage);
1722         }
1723         else
1724             ret = FALSE;
1725     }
1726     else
1727     {
1728         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
1729          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1730
1731         if (usage)
1732         {
1733             usage->rgpszUsageIdentifier =
1734              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
1735             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
1736              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
1737             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
1738             usage->cUsageIdentifier = 1;
1739             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
1740             CryptMemFree(usage);
1741         }
1742         else
1743             ret = FALSE;
1744     }
1745     return ret;
1746 }
1747
1748 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1749  LPCSTR pszUsageIdentifier)
1750 {
1751     BOOL ret;
1752     DWORD size;
1753     CERT_ENHKEY_USAGE usage;
1754
1755     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1756
1757     size = sizeof(usage);
1758     ret = CertGetEnhancedKeyUsage(pCertContext,
1759      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
1760     if (!ret && GetLastError() == ERROR_MORE_DATA)
1761     {
1762         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
1763
1764         if (pUsage)
1765         {
1766             ret = CertGetEnhancedKeyUsage(pCertContext,
1767              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1768             if (ret)
1769             {
1770                 if (pUsage->cUsageIdentifier)
1771                 {
1772                     DWORD i;
1773                     BOOL found = FALSE;
1774
1775                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
1776                     {
1777                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
1778                          pszUsageIdentifier))
1779                             found = TRUE;
1780                         if (found && i < pUsage->cUsageIdentifier - 1)
1781                             pUsage->rgpszUsageIdentifier[i] =
1782                              pUsage->rgpszUsageIdentifier[i + 1];
1783                     }
1784                     pUsage->cUsageIdentifier--;
1785                     /* Remove the usage if it's empty */
1786                     if (pUsage->cUsageIdentifier)
1787                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
1788                     else
1789                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
1790                 }
1791             }
1792             CryptMemFree(pUsage);
1793         }
1794         else
1795             ret = FALSE;
1796     }
1797     else
1798     {
1799         /* it fit in an empty usage, therefore there's nothing to remove */
1800         ret = TRUE;
1801     }
1802     return ret;
1803 }
1804
1805 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
1806  int *cNumOIDSs, LPSTR *rghOIDs, DWORD *pcbOIDs)
1807 {
1808     BOOL ret = TRUE;
1809     DWORD i, cbOIDs = 0;
1810     BOOL allUsagesValid = TRUE;
1811     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
1812
1813     TRACE("(%d, %p, %p, %p, %d)\n", cCerts, *rghCerts, cNumOIDSs,
1814      rghOIDs, *pcbOIDs);
1815
1816     for (i = 0; ret && i < cCerts; i++)
1817     {
1818         CERT_ENHKEY_USAGE usage;
1819         DWORD size = sizeof(usage);
1820
1821         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
1822         /* Success is deliberately ignored: it implies all usages are valid */
1823         if (!ret && GetLastError() == ERROR_MORE_DATA)
1824         {
1825             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
1826
1827             allUsagesValid = FALSE;
1828             if (pUsage)
1829             {
1830                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
1831                 if (ret)
1832                 {
1833                     if (!validUsages.cUsageIdentifier)
1834                     {
1835                         DWORD j;
1836
1837                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
1838                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
1839                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
1840                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
1841                              + 1;
1842                         validUsages.rgpszUsageIdentifier =
1843                          CryptMemAlloc(cbOIDs);
1844                         if (validUsages.rgpszUsageIdentifier)
1845                         {
1846                             LPSTR nextOID = (LPSTR)
1847                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
1848                              validUsages.cUsageIdentifier * sizeof(LPSTR));
1849
1850                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
1851                             {
1852                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
1853                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
1854                                  pUsage->rgpszUsageIdentifier[j]);
1855                                 nextOID += lstrlenA(nextOID) + 1;
1856                             }
1857                         }
1858                         else
1859                             ret = FALSE;
1860                     }
1861                     else
1862                     {
1863                         DWORD j, k, validIndexes = 0, numRemoved = 0;
1864
1865                         /* Merge: build a bitmap of all the indexes of
1866                          * validUsages.rgpszUsageIdentifier that are in pUsage.
1867                          */
1868                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
1869                         {
1870                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
1871                             {
1872                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
1873                                  validUsages.rgpszUsageIdentifier[k]))
1874                                 {
1875                                     validIndexes |= (1 << k);
1876                                     break;
1877                                 }
1878                             }
1879                         }
1880                         /* Merge by removing from validUsages those that are
1881                          * not in the bitmap.
1882                          */
1883                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
1884                         {
1885                             if (!(validIndexes & (1 << j)))
1886                             {
1887                                 if (j < validUsages.cUsageIdentifier - 1)
1888                                 {
1889                                     memcpy(&validUsages.rgpszUsageIdentifier[j],
1890                                      &validUsages.rgpszUsageIdentifier[j +
1891                                      numRemoved + 1],
1892                                      (validUsages.cUsageIdentifier - numRemoved
1893                                      - j - 1) * sizeof(LPSTR));
1894                                     cbOIDs -= lstrlenA(
1895                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
1896                                      sizeof(LPSTR);
1897                                     numRemoved++;
1898                                 }
1899                                 else
1900                                     validUsages.cUsageIdentifier--;
1901                             }
1902                         }
1903                     }
1904                 }
1905                 CryptMemFree(pUsage);
1906             }
1907             else
1908                 ret = FALSE;
1909         }
1910     }
1911     if (ret)
1912     {
1913         if (allUsagesValid)
1914         {
1915             *cNumOIDSs = -1;
1916             *pcbOIDs = 0;
1917         }
1918         else
1919         {
1920             if (!rghOIDs || *pcbOIDs < cbOIDs)
1921             {
1922                 *pcbOIDs = cbOIDs;
1923                 SetLastError(ERROR_MORE_DATA);
1924                 ret = FALSE;
1925             }
1926             else
1927             {
1928                 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
1929                  validUsages.cUsageIdentifier * sizeof(LPSTR));
1930
1931                 *pcbOIDs = cbOIDs;
1932                 *cNumOIDSs = validUsages.cUsageIdentifier;
1933                 for (i = 0; i < validUsages.cUsageIdentifier; i++)
1934                 {
1935                     rghOIDs[i] = nextOID;
1936                     lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
1937                     nextOID += lstrlenA(nextOID) + 1;
1938                 }
1939             }
1940         }
1941     }
1942     CryptMemFree(validUsages.rgpszUsageIdentifier);
1943     return ret;
1944 }
1945
1946 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
1947  * pInfo is NULL, from the attributes of hProv.
1948  */
1949 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
1950  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
1951 {
1952     CRYPT_KEY_PROV_INFO info = { 0 };
1953     BOOL ret;
1954
1955     if (!pInfo)
1956     {
1957         DWORD size;
1958         int len;
1959
1960         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
1961         if (ret)
1962         {
1963             LPSTR szContainer = CryptMemAlloc(size);
1964
1965             if (szContainer)
1966             {
1967                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
1968                  (BYTE *)szContainer, &size, 0);
1969                 if (ret)
1970                 {
1971                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
1972                      NULL, 0);
1973                     if (len)
1974                     {
1975                         info.pwszContainerName = CryptMemAlloc(len *
1976                          sizeof(WCHAR));
1977                         len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
1978                          info.pwszContainerName, len);
1979                     }
1980                 }
1981                 CryptMemFree(szContainer);
1982             }
1983         }
1984         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
1985         if (ret)
1986         {
1987             LPSTR szProvider = CryptMemAlloc(size);
1988
1989             if (szProvider)
1990             {
1991                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
1992                  &size, 0);
1993                 if (ret)
1994                 {
1995                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
1996                      NULL, 0);
1997                     if (len)
1998                     {
1999                         info.pwszProvName = CryptMemAlloc(len *
2000                          sizeof(WCHAR));
2001                         len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2002                          info.pwszProvName, len);
2003                     }
2004                 }
2005                 CryptMemFree(szProvider);
2006             }
2007         }
2008         size = sizeof(info.dwKeySpec);
2009         /* in case no CRYPT_KEY_PROV_INFO given,
2010          *  we always use AT_SIGNATURE key spec
2011          */
2012         info.dwKeySpec = AT_SIGNATURE;
2013         size = sizeof(info.dwProvType);
2014         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2015          &size, 0);
2016         if (!ret)
2017             info.dwProvType = PROV_RSA_FULL;
2018         pInfo = &info;
2019     }
2020
2021     ret = CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2022      0, pInfo);
2023
2024     if (pInfo == &info)
2025     {
2026         CryptMemFree(info.pwszContainerName);
2027         CryptMemFree(info.pwszProvName);
2028     }
2029 }
2030
2031 /* Creates a signed certificate context from the unsigned, encoded certificate
2032  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2033  */
2034 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2035  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2036 {
2037     PCCERT_CONTEXT context = NULL;
2038     BOOL ret;
2039     DWORD sigSize = 0;
2040
2041     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2042      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2043     if (ret)
2044     {
2045         LPBYTE sig = CryptMemAlloc(sigSize);
2046
2047         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2048          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2049         if (ret)
2050         {
2051             CERT_SIGNED_CONTENT_INFO signedInfo;
2052             BYTE *encodedSignedCert = NULL;
2053             DWORD encodedSignedCertSize = 0;
2054
2055             signedInfo.ToBeSigned.cbData = blob->cbData;
2056             signedInfo.ToBeSigned.pbData = blob->pbData;
2057             memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2058              sizeof(signedInfo.SignatureAlgorithm));
2059             signedInfo.Signature.cbData = sigSize;
2060             signedInfo.Signature.pbData = sig;
2061             signedInfo.Signature.cUnusedBits = 0;
2062             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2063              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2064              (BYTE *)&encodedSignedCert, &encodedSignedCertSize);
2065             if (ret)
2066             {
2067                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2068                  encodedSignedCert, encodedSignedCertSize);
2069                 LocalFree(encodedSignedCert);
2070             }
2071         }
2072         CryptMemFree(sig);
2073     }
2074     return context;
2075 }
2076
2077 /* Copies data from the parameters into info, where:
2078  * pSerialNumber: The serial number.  Must not be NULL.
2079  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2080  *                     Must not be NULL
2081  * pSignatureAlgorithm: Optional.
2082  * pStartTime: The starting time of the certificate.  If NULL, the current
2083  *             system time is used.
2084  * pEndTime: The ending time of the certificate.  If NULL, one year past the
2085  *           starting time is used.
2086  * pubKey: The public key of the certificate.  Must not be NULL.
2087  * pExtensions: Extensions to be included with the certificate.  Optional.
2088  */
2089 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2090  const CERT_NAME_BLOB *pSubjectIssuerBlob,
2091  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2092  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2093  const CERT_EXTENSIONS *pExtensions)
2094 {
2095     static CHAR oid[] = szOID_RSA_SHA1RSA;
2096
2097     assert(info);
2098     assert(pSerialNumber);
2099     assert(pSubjectIssuerBlob);
2100     assert(pubKey);
2101
2102     info->dwVersion = CERT_V3;
2103     info->SerialNumber.cbData = pSerialNumber->cbData;
2104     info->SerialNumber.pbData = pSerialNumber->pbData;
2105     if (pSignatureAlgorithm)
2106         memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2107          sizeof(info->SignatureAlgorithm));
2108     else
2109     {
2110         info->SignatureAlgorithm.pszObjId = oid;
2111         info->SignatureAlgorithm.Parameters.cbData = 0;
2112         info->SignatureAlgorithm.Parameters.pbData = NULL;
2113     }
2114     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2115     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2116     if (pStartTime)
2117         SystemTimeToFileTime(pStartTime, &info->NotBefore);
2118     else
2119         GetSystemTimeAsFileTime(&info->NotBefore);
2120     if (pEndTime)
2121         SystemTimeToFileTime(pEndTime, &info->NotAfter);
2122     else
2123     {
2124         SYSTEMTIME endTime;
2125
2126         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
2127         {
2128             endTime.wYear++;
2129             SystemTimeToFileTime(&endTime, &info->NotAfter);
2130         }
2131     }
2132     info->Subject.cbData = pSubjectIssuerBlob->cbData;
2133     info->Subject.pbData = pSubjectIssuerBlob->pbData;
2134     memcpy(&info->SubjectPublicKeyInfo, pubKey,
2135      sizeof(info->SubjectPublicKeyInfo));
2136     if (pExtensions)
2137     {
2138         info->cExtension = pExtensions->cExtension;
2139         info->rgExtension = pExtensions->rgExtension;
2140     }
2141     else
2142     {
2143         info->cExtension = 0;
2144         info->rgExtension = NULL;
2145     }
2146 }
2147
2148 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
2149 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
2150 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
2151
2152 static HCRYPTPROV CRYPT_CreateKeyProv(void)
2153 {
2154     HCRYPTPROV hProv = 0;
2155     HMODULE rpcrt = LoadLibraryA("rpcrt4");
2156
2157     if (rpcrt)
2158     {
2159         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
2160          "UuidCreate");
2161         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
2162          "UuidToStringA");
2163         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
2164          rpcrt, "RpcStringFreeA");
2165
2166         if (uuidCreate && uuidToString && rpcStringFree)
2167         {
2168             UUID uuid;
2169             RPC_STATUS status = uuidCreate(&uuid);
2170
2171             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
2172             {
2173                 unsigned char *uuidStr;
2174
2175                 status = uuidToString(&uuid, &uuidStr);
2176                 if (status == RPC_S_OK)
2177                 {
2178                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
2179                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
2180
2181                     if (ret)
2182                     {
2183                         HCRYPTKEY key;
2184
2185                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
2186                         if (ret)
2187                             CryptDestroyKey(key);
2188                     }
2189                     rpcStringFree(&uuidStr);
2190                 }
2191             }
2192         }
2193         FreeLibrary(rpcrt);
2194     }
2195     return hProv;
2196 }
2197
2198 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
2199  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
2200  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
2201  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
2202  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
2203 {
2204     PCCERT_CONTEXT context = NULL;
2205     BOOL ret, releaseContext = FALSE;
2206     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
2207     DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
2208
2209     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
2210      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
2211      pExtensions, pExtensions);
2212
2213     if(!pSubjectIssuerBlob)
2214     {
2215         SetLastError(ERROR_INVALID_PARAMETER);
2216         return NULL;
2217     }
2218
2219     if (!hProv)
2220     {
2221         if (!pKeyProvInfo)
2222         {
2223             hProv = CRYPT_CreateKeyProv();
2224             releaseContext = TRUE;
2225         }
2226         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
2227         {
2228             SetLastError(NTE_BAD_FLAGS);
2229             return NULL;
2230         }
2231         else
2232         {
2233             HCRYPTKEY hKey = 0;
2234             /* acquire the context using the given information*/
2235             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2236                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2237                     pKeyProvInfo->dwFlags);
2238             if (!ret)
2239             {
2240                 if(GetLastError() != NTE_BAD_KEYSET)
2241                     return NULL;
2242                 /* create the key set */
2243                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2244                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2245                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
2246                 if (!ret)
2247                     return NULL;
2248             }
2249             dwKeySpec = pKeyProvInfo->dwKeySpec;
2250             /* check if the key is here */
2251             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
2252             if(!ret)
2253             {
2254                 if (NTE_NO_KEY == GetLastError())
2255                 { /* generate the key */
2256                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
2257                 }
2258                 if (!ret)
2259                 {
2260                     CryptReleaseContext(hProv,0);
2261                     SetLastError(NTE_BAD_KEYSET);
2262                     return NULL;
2263                 }
2264             }
2265             CryptDestroyKey(hKey);
2266             releaseContext = TRUE;
2267         }
2268     }
2269     else if (pKeyProvInfo)
2270     {
2271         SetLastError(ERROR_INVALID_PARAMETER);
2272         return NULL;
2273     }
2274
2275     CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
2276      &pubKeySize);
2277     pubKey = CryptMemAlloc(pubKeySize);
2278     if (pubKey)
2279     {
2280         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
2281          pubKey, &pubKeySize);
2282         if (ret)
2283         {
2284             CERT_INFO info = { 0 };
2285             CRYPT_DER_BLOB blob = { 0, NULL };
2286             BYTE serial[16];
2287             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
2288
2289             CryptGenRandom(hProv, sizeof(serial), serial);
2290             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
2291              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
2292             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
2293              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&blob.pbData,
2294              &blob.cbData);
2295             if (ret)
2296             {
2297                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
2298                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
2299                      &info.SignatureAlgorithm);
2300                 else
2301                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
2302                      blob.pbData, blob.cbData);
2303                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
2304                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
2305                 LocalFree(blob.pbData);
2306             }
2307         }
2308         CryptMemFree(pubKey);
2309     }
2310     if (releaseContext)
2311         CryptReleaseContext(hProv, 0);
2312     return context;
2313 }
2314
2315 BOOL WINAPI CertGetCertificateChain(HCERTCHAINENGINE hChainEngine,
2316     PCCERT_CONTEXT pCertContext, LPFILETIME pTime, HCERTSTORE hAdditionalStore,
2317     PCERT_CHAIN_PARA pChainPara, DWORD dwFlags, LPVOID pvReserved,
2318     PCCERT_CHAIN_CONTEXT* ppChainContext)
2319 {
2320     FIXME(" %p %p %p %p %p 0x%08X %p %p - stub\n",hChainEngine, pCertContext,
2321      pTime, hAdditionalStore, pChainPara, dwFlags, pvReserved, ppChainContext);
2322
2323     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
2324     return FALSE;
2325 }