2 * Copyright 2007 Juan Lang
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
20 #define NONAMELESSUNION
27 #include "wine/debug.h"
29 WINE_DEFAULT_DEBUG_CHANNEL(wintrust
);
31 HRESULT WINAPI
SoftpubDefCertInit(CRYPT_PROVIDER_DATA
*data
)
33 HRESULT ret
= S_FALSE
;
35 TRACE("(%p)\n", data
);
37 if (data
->padwTrustStepErrors
&&
38 !data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_WVTINIT
])
40 TRACE("returning %08x\n", ret
);
44 HRESULT WINAPI
SoftpubInitialize(CRYPT_PROVIDER_DATA
*data
)
46 HRESULT ret
= S_FALSE
;
48 TRACE("(%p)\n", data
);
50 if (data
->padwTrustStepErrors
&&
51 !data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_WVTINIT
])
53 TRACE("returning %08x\n", ret
);
57 HRESULT WINAPI
DriverInitializePolicy(CRYPT_PROVIDER_DATA
*data
)
63 HRESULT WINAPI
DriverCleanupPolicy(CRYPT_PROVIDER_DATA
*data
)
69 HRESULT WINAPI
DriverFinalPolicy(CRYPT_PROVIDER_DATA
*data
)
75 /* Assumes data->pWintrustData->u.pFile exists. Makes sure a file handle is
78 static DWORD
SOFTPUB_OpenFile(CRYPT_PROVIDER_DATA
*data
)
80 DWORD err
= ERROR_SUCCESS
;
82 /* PSDK implies that all values should be initialized to NULL, so callers
83 * typically have hFile as NULL rather than INVALID_HANDLE_VALUE. Check
86 if (!data
->pWintrustData
->u
.pFile
->hFile
||
87 data
->pWintrustData
->u
.pFile
->hFile
== INVALID_HANDLE_VALUE
)
89 data
->pWintrustData
->u
.pFile
->hFile
=
90 CreateFileW(data
->pWintrustData
->u
.pFile
->pcwszFilePath
, GENERIC_READ
,
91 FILE_SHARE_READ
, NULL
, OPEN_EXISTING
, FILE_ATTRIBUTE_NORMAL
, NULL
);
92 if (data
->pWintrustData
->u
.pFile
->hFile
!= INVALID_HANDLE_VALUE
)
93 data
->fOpenedFile
= TRUE
;
98 GetFileTime(data
->pWintrustData
->u
.pFile
->hFile
, &data
->sftSystemTime
,
100 TRACE("returning %d\n", err
);
104 /* Assumes data->pWintrustData->u.pFile exists. Sets data->pPDSip->gSubject to
105 * the file's subject GUID.
107 static DWORD
SOFTPUB_GetFileSubject(CRYPT_PROVIDER_DATA
*data
)
109 DWORD err
= ERROR_SUCCESS
;
111 if (!WVT_ISINSTRUCT(WINTRUST_FILE_INFO
,
112 data
->pWintrustData
->u
.pFile
->cbStruct
, pgKnownSubject
) ||
113 !data
->pWintrustData
->u
.pFile
->pgKnownSubject
)
115 if (!CryptSIPRetrieveSubjectGuid(
116 data
->pWintrustData
->u
.pFile
->pcwszFilePath
,
117 data
->pWintrustData
->u
.pFile
->hFile
,
118 &data
->u
.pPDSip
->gSubject
))
119 err
= GetLastError();
122 data
->u
.pPDSip
->gSubject
= *data
->pWintrustData
->u
.pFile
->pgKnownSubject
;
123 TRACE("returning %d\n", err
);
127 /* Assumes data->u.pPDSip exists, and its gSubject member set.
128 * Allocates data->u.pPDSip->pSip and loads it, if possible.
130 static DWORD
SOFTPUB_GetSIP(CRYPT_PROVIDER_DATA
*data
)
132 DWORD err
= ERROR_SUCCESS
;
134 data
->u
.pPDSip
->pSip
= data
->psPfns
->pfnAlloc(sizeof(SIP_DISPATCH_INFO
));
135 if (data
->u
.pPDSip
->pSip
)
137 if (!CryptSIPLoad(&data
->u
.pPDSip
->gSubject
, 0, data
->u
.pPDSip
->pSip
))
138 err
= GetLastError();
141 err
= ERROR_OUTOFMEMORY
;
142 TRACE("returning %d\n", err
);
146 /* Assumes data->u.pPDSip has been loaded, and data->u.pPDSip->pSip allocated.
147 * Calls data->u.pPDSip->pSip->pfGet to construct data->hMsg.
149 static DWORD
SOFTPUB_GetMessageFromFile(CRYPT_PROVIDER_DATA
*data
, HANDLE file
,
152 DWORD err
= ERROR_SUCCESS
;
157 data
->u
.pPDSip
->psSipSubjectInfo
=
158 data
->psPfns
->pfnAlloc(sizeof(SIP_SUBJECTINFO
));
159 if (!data
->u
.pPDSip
->psSipSubjectInfo
)
160 return ERROR_OUTOFMEMORY
;
162 data
->u
.pPDSip
->psSipSubjectInfo
->cbSize
= sizeof(SIP_SUBJECTINFO
);
163 data
->u
.pPDSip
->psSipSubjectInfo
->pgSubjectType
= &data
->u
.pPDSip
->gSubject
;
164 data
->u
.pPDSip
->psSipSubjectInfo
->hFile
= file
;
165 data
->u
.pPDSip
->psSipSubjectInfo
->pwsFileName
= filePath
;
166 data
->u
.pPDSip
->psSipSubjectInfo
->hProv
= data
->hProv
;
167 ret
= data
->u
.pPDSip
->pSip
->pfGet(data
->u
.pPDSip
->psSipSubjectInfo
,
168 &data
->dwEncoding
, 0, &size
, 0);
170 return TRUST_E_NOSIGNATURE
;
172 buf
= data
->psPfns
->pfnAlloc(size
);
174 return ERROR_OUTOFMEMORY
;
176 ret
= data
->u
.pPDSip
->pSip
->pfGet(data
->u
.pPDSip
->psSipSubjectInfo
,
177 &data
->dwEncoding
, 0, &size
, buf
);
180 data
->hMsg
= CryptMsgOpenToDecode(data
->dwEncoding
, 0, 0, data
->hProv
,
184 ret
= CryptMsgUpdate(data
->hMsg
, buf
, size
, TRUE
);
186 err
= GetLastError();
190 err
= GetLastError();
192 data
->psPfns
->pfnFree(buf
);
193 TRACE("returning %d\n", err
);
197 static DWORD
SOFTPUB_CreateStoreFromMessage(CRYPT_PROVIDER_DATA
*data
)
199 DWORD err
= ERROR_SUCCESS
;
202 store
= CertOpenStore(CERT_STORE_PROV_MSG
, data
->dwEncoding
,
203 data
->hProv
, CERT_STORE_NO_CRYPT_RELEASE_FLAG
, data
->hMsg
);
206 if (!data
->psPfns
->pfnAddStore2Chain(data
, store
))
207 err
= GetLastError();
208 CertCloseStore(store
, 0);
211 err
= GetLastError();
212 TRACE("returning %d\n", err
);
216 static DWORD
SOFTPUB_DecodeInnerContent(CRYPT_PROVIDER_DATA
*data
)
219 DWORD size
, err
= ERROR_SUCCESS
;
223 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_INNER_CONTENT_TYPE_PARAM
, 0, NULL
,
227 err
= GetLastError();
230 oid
= data
->psPfns
->pfnAlloc(size
);
233 err
= ERROR_OUTOFMEMORY
;
236 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_INNER_CONTENT_TYPE_PARAM
, 0, oid
,
240 err
= GetLastError();
243 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_CONTENT_PARAM
, 0, NULL
, &size
);
246 err
= GetLastError();
249 buf
= data
->psPfns
->pfnAlloc(size
);
252 err
= ERROR_OUTOFMEMORY
;
255 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_CONTENT_PARAM
, 0, buf
, &size
);
258 err
= GetLastError();
261 ret
= CryptDecodeObject(data
->dwEncoding
, oid
, buf
, size
, 0, NULL
, &size
);
264 err
= GetLastError();
267 data
->u
.pPDSip
->psIndirectData
= data
->psPfns
->pfnAlloc(size
);
268 if (!data
->u
.pPDSip
->psIndirectData
)
270 err
= ERROR_OUTOFMEMORY
;
273 ret
= CryptDecodeObject(data
->dwEncoding
, oid
, buf
, size
, 0,
274 data
->u
.pPDSip
->psIndirectData
, &size
);
276 err
= GetLastError();
279 TRACE("returning %d\n", err
);
280 data
->psPfns
->pfnFree(oid
);
281 data
->psPfns
->pfnFree(buf
);
285 static DWORD
SOFTPUB_LoadCertMessage(CRYPT_PROVIDER_DATA
*data
)
289 if (data
->pWintrustData
->u
.pCert
&&
290 WVT_IS_CBSTRUCT_GT_MEMBEROFFSET(WINTRUST_CERT_INFO
,
291 data
->pWintrustData
->u
.pCert
->cbStruct
, psCertContext
))
295 CRYPT_PROVIDER_SGNR signer
= { sizeof(signer
), { 0 } };
299 /* Add a signer with nothing but the time to verify, so we can
302 if (WVT_ISINSTRUCT(WINTRUST_CERT_INFO
,
303 data
->pWintrustData
->u
.pCert
->cbStruct
, psftVerifyAsOf
) &&
304 data
->pWintrustData
->u
.pCert
->psftVerifyAsOf
)
305 data
->sftSystemTime
= signer
.sftVerifyAsOf
;
310 GetSystemTime(&sysTime
);
311 SystemTimeToFileTime(&sysTime
, &signer
.sftVerifyAsOf
);
313 ret
= data
->psPfns
->pfnAddSgnr2Chain(data
, FALSE
, 0, &signer
);
316 ret
= data
->psPfns
->pfnAddCert2Chain(data
, 0, FALSE
, 0,
317 data
->pWintrustData
->u
.pCert
->psCertContext
);
318 if (WVT_ISINSTRUCT(WINTRUST_CERT_INFO
,
319 data
->pWintrustData
->u
.pCert
->cbStruct
, pahStores
))
321 ret
&& i
< data
->pWintrustData
->u
.pCert
->chStores
; i
++)
322 ret
= data
->psPfns
->pfnAddStore2Chain(data
,
323 data
->pWintrustData
->u
.pCert
->pahStores
[i
]);
326 err
= GetLastError();
330 /* Do nothing!? See the tests */
335 err
= ERROR_INVALID_PARAMETER
;
339 static DWORD
SOFTPUB_LoadFileMessage(CRYPT_PROVIDER_DATA
*data
)
341 DWORD err
= ERROR_SUCCESS
;
343 if (!data
->pWintrustData
->u
.pFile
)
345 err
= ERROR_INVALID_PARAMETER
;
348 err
= SOFTPUB_OpenFile(data
);
351 err
= SOFTPUB_GetFileSubject(data
);
354 err
= SOFTPUB_GetSIP(data
);
357 err
= SOFTPUB_GetMessageFromFile(data
, data
->pWintrustData
->u
.pFile
->hFile
,
358 data
->pWintrustData
->u
.pFile
->pcwszFilePath
);
361 err
= SOFTPUB_CreateStoreFromMessage(data
);
364 err
= SOFTPUB_DecodeInnerContent(data
);
367 if (err
&& data
->fOpenedFile
&& data
->pWintrustData
->u
.pFile
)
369 /* The caller won't expect the file to be open on failure, so close it.
371 CloseHandle(data
->pWintrustData
->u
.pFile
->hFile
);
372 data
->pWintrustData
->u
.pFile
->hFile
= INVALID_HANDLE_VALUE
;
373 data
->fOpenedFile
= FALSE
;
378 static DWORD
SOFTPUB_LoadCatalogMessage(CRYPT_PROVIDER_DATA
*data
)
381 HANDLE catalog
= INVALID_HANDLE_VALUE
;
383 if (!data
->pWintrustData
->u
.pCatalog
)
385 SetLastError(ERROR_INVALID_PARAMETER
);
388 catalog
= CreateFileW(data
->pWintrustData
->u
.pCatalog
->pcwszCatalogFilePath
,
389 GENERIC_READ
, FILE_SHARE_READ
, NULL
, OPEN_EXISTING
, FILE_ATTRIBUTE_NORMAL
,
391 if (catalog
== INVALID_HANDLE_VALUE
)
392 return GetLastError();
393 if (!CryptSIPRetrieveSubjectGuid(
394 data
->pWintrustData
->u
.pCatalog
->pcwszCatalogFilePath
, catalog
,
395 &data
->u
.pPDSip
->gSubject
))
397 err
= GetLastError();
400 err
= SOFTPUB_GetSIP(data
);
403 err
= SOFTPUB_GetMessageFromFile(data
, data
->pWintrustData
->u
.pFile
->hFile
,
404 data
->pWintrustData
->u
.pFile
->pcwszFilePath
);
407 err
= SOFTPUB_CreateStoreFromMessage(data
);
410 err
= SOFTPUB_DecodeInnerContent(data
);
411 /* FIXME: this loads the catalog file, but doesn't validate the member. */
413 CloseHandle(catalog
);
417 HRESULT WINAPI
SoftpubLoadMessage(CRYPT_PROVIDER_DATA
*data
)
419 DWORD err
= ERROR_SUCCESS
;
421 TRACE("(%p)\n", data
);
423 if (!data
->padwTrustStepErrors
)
426 switch (data
->pWintrustData
->dwUnionChoice
)
428 case WTD_CHOICE_CERT
:
429 err
= SOFTPUB_LoadCertMessage(data
);
431 case WTD_CHOICE_FILE
:
432 err
= SOFTPUB_LoadFileMessage(data
);
434 case WTD_CHOICE_CATALOG
:
435 err
= SOFTPUB_LoadCatalogMessage(data
);
438 FIXME("unimplemented for %d\n", data
->pWintrustData
->dwUnionChoice
);
439 err
= ERROR_INVALID_PARAMETER
;
443 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_OBJPROV
] = err
;
444 TRACE("returning %d (%08x)\n", !err
? S_OK
: S_FALSE
,
445 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_OBJPROV
]);
446 return !err
? S_OK
: S_FALSE
;
449 static CMSG_SIGNER_INFO
*WINTRUST_GetSigner(CRYPT_PROVIDER_DATA
*data
,
453 CMSG_SIGNER_INFO
*signerInfo
= NULL
;
456 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_SIGNER_INFO_PARAM
, signerIdx
,
460 signerInfo
= data
->psPfns
->pfnAlloc(size
);
463 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_SIGNER_INFO_PARAM
,
464 signerIdx
, signerInfo
, &size
);
467 data
->psPfns
->pfnFree(signerInfo
);
472 SetLastError(ERROR_OUTOFMEMORY
);
477 static BOOL
WINTRUST_SaveSigner(CRYPT_PROVIDER_DATA
*data
, DWORD signerIdx
)
480 CMSG_SIGNER_INFO
*signerInfo
= WINTRUST_GetSigner(data
, signerIdx
);
484 CRYPT_PROVIDER_SGNR sgnr
= { sizeof(sgnr
), { 0 } };
486 sgnr
.psSigner
= signerInfo
;
487 sgnr
.sftVerifyAsOf
= data
->sftSystemTime
;
488 ret
= data
->psPfns
->pfnAddSgnr2Chain(data
, FALSE
, signerIdx
, &sgnr
);
495 static CERT_INFO
*WINTRUST_GetSignerCertInfo(CRYPT_PROVIDER_DATA
*data
,
499 CERT_INFO
*certInfo
= NULL
;
502 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_SIGNER_CERT_INFO_PARAM
, signerIdx
,
506 certInfo
= data
->psPfns
->pfnAlloc(size
);
509 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_SIGNER_CERT_INFO_PARAM
,
510 signerIdx
, certInfo
, &size
);
513 data
->psPfns
->pfnFree(certInfo
);
518 SetLastError(ERROR_OUTOFMEMORY
);
523 static BOOL
WINTRUST_VerifySigner(CRYPT_PROVIDER_DATA
*data
, DWORD signerIdx
)
526 CERT_INFO
*certInfo
= WINTRUST_GetSignerCertInfo(data
, signerIdx
);
530 PCCERT_CONTEXT subject
= CertGetSubjectCertificateFromStore(
531 data
->pahStores
[0], data
->dwEncoding
, certInfo
);
535 CMSG_CTRL_VERIFY_SIGNATURE_EX_PARA para
= { sizeof(para
), 0,
536 signerIdx
, CMSG_VERIFY_SIGNER_CERT
, (LPVOID
)subject
};
538 ret
= CryptMsgControl(data
->hMsg
, 0, CMSG_CTRL_VERIFY_SIGNATURE_EX
,
541 SetLastError(TRUST_E_CERT_SIGNATURE
);
543 data
->psPfns
->pfnAddCert2Chain(data
, signerIdx
, FALSE
, 0,
545 CertFreeCertificateContext(subject
);
549 SetLastError(TRUST_E_NO_SIGNER_CERT
);
552 data
->psPfns
->pfnFree(certInfo
);
559 HRESULT WINAPI
SoftpubLoadSignature(CRYPT_PROVIDER_DATA
*data
)
563 TRACE("(%p)\n", data
);
565 if (!data
->padwTrustStepErrors
)
570 DWORD signerCount
, size
;
572 size
= sizeof(signerCount
);
573 ret
= CryptMsgGetParam(data
->hMsg
, CMSG_SIGNER_COUNT_PARAM
, 0,
574 &signerCount
, &size
);
579 for (i
= 0; ret
&& i
< signerCount
; i
++)
581 if ((ret
= WINTRUST_SaveSigner(data
, i
)))
582 ret
= WINTRUST_VerifySigner(data
, i
);
586 SetLastError(TRUST_E_NOSIGNATURE
);
591 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_SIGPROV
] =
593 return ret
? S_OK
: S_FALSE
;
596 static DWORD
WINTRUST_TrustStatusToConfidence(DWORD errorStatus
)
598 DWORD confidence
= 0;
601 if (!(errorStatus
& CERT_TRUST_IS_NOT_SIGNATURE_VALID
))
602 confidence
|= CERT_CONFIDENCE_SIG
;
603 if (!(errorStatus
& CERT_TRUST_IS_NOT_TIME_VALID
))
604 confidence
|= CERT_CONFIDENCE_TIME
;
605 if (!(errorStatus
& CERT_TRUST_IS_NOT_TIME_NESTED
))
606 confidence
|= CERT_CONFIDENCE_TIMENEST
;
610 BOOL WINAPI
SoftpubCheckCert(CRYPT_PROVIDER_DATA
*data
, DWORD idxSigner
,
611 BOOL fCounterSignerChain
, DWORD idxCounterSigner
)
615 TRACE("(%p, %d, %d, %d)\n", data
, idxSigner
, fCounterSignerChain
,
618 if (fCounterSignerChain
)
620 FIXME("unimplemented for counter signers\n");
625 PCERT_SIMPLE_CHAIN simpleChain
=
626 data
->pasSigners
[idxSigner
].pChainContext
->rgpChain
[0];
630 for (i
= 0; i
< simpleChain
->cElement
; i
++)
633 data
->pasSigners
[idxSigner
].pasCertChain
[i
].dwConfidence
=
634 WINTRUST_TrustStatusToConfidence(
635 simpleChain
->rgpElement
[i
]->TrustStatus
.dwErrorStatus
);
636 /* Set additional flags */
637 if (!(simpleChain
->rgpElement
[i
]->TrustStatus
.dwErrorStatus
&
638 CERT_TRUST_IS_UNTRUSTED_ROOT
))
639 data
->pasSigners
[idxSigner
].pasCertChain
[i
].fTrustedRoot
= TRUE
;
640 if (simpleChain
->rgpElement
[i
]->TrustStatus
.dwInfoStatus
&
641 CERT_TRUST_IS_SELF_SIGNED
)
642 data
->pasSigners
[idxSigner
].pasCertChain
[i
].fSelfSigned
= TRUE
;
643 if (simpleChain
->rgpElement
[i
]->TrustStatus
.dwErrorStatus
&
644 CERT_TRUST_IS_CYCLIC
)
645 data
->pasSigners
[idxSigner
].pasCertChain
[i
].fIsCyclic
= TRUE
;
651 static DWORD
WINTRUST_TrustStatusToError(DWORD errorStatus
)
655 if (errorStatus
& CERT_TRUST_IS_NOT_SIGNATURE_VALID
)
656 error
= TRUST_E_CERT_SIGNATURE
;
657 else if (errorStatus
& CERT_TRUST_IS_UNTRUSTED_ROOT
)
658 error
= CERT_E_UNTRUSTEDROOT
;
659 else if (errorStatus
& CERT_TRUST_IS_NOT_TIME_VALID
)
660 error
= CERT_E_EXPIRED
;
661 else if (errorStatus
& CERT_TRUST_IS_NOT_TIME_NESTED
)
662 error
= CERT_E_VALIDITYPERIODNESTING
;
663 else if (errorStatus
& CERT_TRUST_IS_REVOKED
)
664 error
= CERT_E_REVOKED
;
665 else if (errorStatus
& CERT_TRUST_IS_OFFLINE_REVOCATION
||
666 errorStatus
& CERT_TRUST_REVOCATION_STATUS_UNKNOWN
)
667 error
= CERT_E_REVOCATION_FAILURE
;
668 else if (errorStatus
& CERT_TRUST_IS_NOT_VALID_FOR_USAGE
)
669 error
= CERT_E_WRONG_USAGE
;
670 else if (errorStatus
& CERT_TRUST_IS_CYCLIC
)
671 error
= CERT_E_CHAINING
;
672 else if (errorStatus
& CERT_TRUST_INVALID_EXTENSION
)
673 error
= CERT_E_CRITICAL
;
674 else if (errorStatus
& CERT_TRUST_INVALID_POLICY_CONSTRAINTS
)
675 error
= CERT_E_INVALID_POLICY
;
676 else if (errorStatus
& CERT_TRUST_INVALID_BASIC_CONSTRAINTS
)
677 error
= TRUST_E_BASIC_CONSTRAINTS
;
678 else if (errorStatus
& CERT_TRUST_INVALID_NAME_CONSTRAINTS
||
679 errorStatus
& CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT
||
680 errorStatus
& CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT
||
681 errorStatus
& CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT
||
682 errorStatus
& CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT
)
683 error
= CERT_E_INVALID_NAME
;
684 else if (errorStatus
& CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY
)
685 error
= CERT_E_INVALID_POLICY
;
686 else if (errorStatus
)
688 FIXME("unknown error status %08x\n", errorStatus
);
689 error
= TRUST_E_SYSTEM_ERROR
;
696 static BOOL
WINTRUST_CopyChain(CRYPT_PROVIDER_DATA
*data
, DWORD signerIdx
)
699 PCERT_SIMPLE_CHAIN simpleChain
=
700 data
->pasSigners
[signerIdx
].pChainContext
->rgpChain
[0];
703 data
->pasSigners
[signerIdx
].pasCertChain
[0].dwConfidence
=
704 WINTRUST_TrustStatusToConfidence(
705 simpleChain
->rgpElement
[0]->TrustStatus
.dwErrorStatus
);
706 data
->pasSigners
[signerIdx
].pasCertChain
[0].pChainElement
=
707 simpleChain
->rgpElement
[0];
709 for (i
= 1; ret
&& i
< simpleChain
->cElement
; i
++)
711 ret
= data
->psPfns
->pfnAddCert2Chain(data
, signerIdx
, FALSE
, 0,
712 simpleChain
->rgpElement
[i
]->pCertContext
);
715 data
->pasSigners
[signerIdx
].pasCertChain
[i
].pChainElement
=
716 simpleChain
->rgpElement
[i
];
717 data
->pasSigners
[signerIdx
].pasCertChain
[i
].dwConfidence
=
718 WINTRUST_TrustStatusToConfidence(
719 simpleChain
->rgpElement
[i
]->TrustStatus
.dwErrorStatus
);
722 data
->pasSigners
[signerIdx
].pasCertChain
[simpleChain
->cElement
- 1].dwError
723 = WINTRUST_TrustStatusToError(
724 simpleChain
->rgpElement
[simpleChain
->cElement
- 1]->
725 TrustStatus
.dwErrorStatus
);
729 static void WINTRUST_CreateChainPolicyCreateInfo(
730 const CRYPT_PROVIDER_DATA
*data
, PWTD_GENERIC_CHAIN_POLICY_CREATE_INFO info
,
731 PCERT_CHAIN_PARA chainPara
)
733 chainPara
->cbSize
= sizeof(CERT_CHAIN_PARA
);
734 if (data
->pRequestUsage
)
735 chainPara
->RequestedUsage
= *data
->pRequestUsage
;
738 chainPara
->RequestedUsage
.dwType
= 0;
739 chainPara
->RequestedUsage
.Usage
.cUsageIdentifier
= 0;
741 info
->u
.cbSize
= sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO
);
742 info
->hChainEngine
= NULL
;
743 info
->pChainPara
= chainPara
;
744 if (data
->dwProvFlags
& CPD_REVOCATION_CHECK_END_CERT
)
745 info
->dwFlags
= CERT_CHAIN_REVOCATION_CHECK_END_CERT
;
746 else if (data
->dwProvFlags
& CPD_REVOCATION_CHECK_CHAIN
)
747 info
->dwFlags
= CERT_CHAIN_REVOCATION_CHECK_CHAIN
;
748 else if (data
->dwProvFlags
& CPD_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT
)
749 info
->dwFlags
= CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT
;
752 info
->pvReserved
= NULL
;
755 static BOOL
WINTRUST_CreateChainForSigner(CRYPT_PROVIDER_DATA
*data
,
756 DWORD signer
, PWTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo
,
757 PCERT_CHAIN_PARA chainPara
)
760 HCERTSTORE store
= NULL
;
764 store
= CertOpenStore(CERT_STORE_PROV_COLLECTION
, 0, 0,
765 CERT_STORE_CREATE_NEW_FLAG
, NULL
);
770 for (i
= 0; i
< data
->chStores
; i
++)
771 CertAddStoreToCollection(store
, data
->pahStores
[i
], 0, 0);
774 /* Expect the end certificate for each signer to be the only cert in the
777 if (data
->pasSigners
[signer
].csCertChain
)
779 /* Create a certificate chain for each signer */
780 ret
= CertGetCertificateChain(createInfo
->hChainEngine
,
781 data
->pasSigners
[signer
].pasCertChain
[0].pCert
,
782 &data
->pasSigners
[signer
].sftVerifyAsOf
, store
,
783 chainPara
, createInfo
->dwFlags
, createInfo
->pvReserved
,
784 &data
->pasSigners
[signer
].pChainContext
);
787 if (data
->pasSigners
[signer
].pChainContext
->cChain
!= 1)
789 FIXME("unimplemented for more than 1 simple chain\n");
794 if ((ret
= WINTRUST_CopyChain(data
, signer
)))
796 if (data
->psPfns
->pfnCertCheckPolicy
)
797 ret
= data
->psPfns
->pfnCertCheckPolicy(data
, signer
,
800 TRACE("no cert check policy, skipping policy check\n");
805 CertCloseStore(store
, 0);
809 HRESULT WINAPI
WintrustCertificateTrust(CRYPT_PROVIDER_DATA
*data
)
813 TRACE("(%p)\n", data
);
815 if (!data
->csSigners
)
818 SetLastError(TRUST_E_NOSIGNATURE
);
823 WTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo
;
824 CERT_CHAIN_PARA chainPara
;
826 WINTRUST_CreateChainPolicyCreateInfo(data
, &createInfo
, &chainPara
);
828 for (i
= 0; i
< data
->csSigners
; i
++)
829 ret
= WINTRUST_CreateChainForSigner(data
, i
, &createInfo
,
833 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_CERTPROV
] =
835 TRACE("returning %d (%08x)\n", ret
? S_OK
: S_FALSE
,
836 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_CERTPROV
]);
837 return ret
? S_OK
: S_FALSE
;
840 HRESULT WINAPI
GenericChainCertificateTrust(CRYPT_PROVIDER_DATA
*data
)
843 WTD_GENERIC_CHAIN_POLICY_DATA
*policyData
=
844 data
->pWintrustData
->pPolicyCallbackData
;
846 TRACE("(%p)\n", data
);
848 if (policyData
&& policyData
->u
.cbSize
!=
849 sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO
))
851 SetLastError(ERROR_INVALID_PARAMETER
);
855 if (!data
->csSigners
)
858 SetLastError(TRUST_E_NOSIGNATURE
);
863 WTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo
, *pCreateInfo
;
864 CERT_CHAIN_PARA chainPara
, *pChainPara
;
868 pCreateInfo
= policyData
->pSignerChainInfo
;
869 pChainPara
= pCreateInfo
->pChainPara
;
873 WINTRUST_CreateChainPolicyCreateInfo(data
, &createInfo
, &chainPara
);
874 pChainPara
= &chainPara
;
875 pCreateInfo
= &createInfo
;
878 for (i
= 0; i
< data
->csSigners
; i
++)
879 ret
= WINTRUST_CreateChainForSigner(data
, i
, pCreateInfo
,
885 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_CERTPROV
] =
887 TRACE("returning %d (%08x)\n", ret
? S_OK
: S_FALSE
,
888 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_CERTPROV
]);
889 return ret
? S_OK
: S_FALSE
;
892 HRESULT WINAPI
SoftpubAuthenticode(CRYPT_PROVIDER_DATA
*data
)
895 CERT_CHAIN_POLICY_STATUS policyStatus
= { sizeof(policyStatus
), 0 };
897 TRACE("(%p)\n", data
);
899 if (data
->pWintrustData
->dwUIChoice
!= WTD_UI_NONE
)
900 FIXME("unimplemented for UI choice %d\n",
901 data
->pWintrustData
->dwUIChoice
);
902 if (!data
->csSigners
)
905 policyStatus
.dwError
= TRUST_E_NOSIGNATURE
;
912 for (i
= 0; ret
&& i
< data
->csSigners
; i
++)
915 DWORD size
= sizeof(hash
);
917 /* First make sure cert isn't disallowed */
918 if ((ret
= CertGetCertificateContextProperty(
919 data
->pasSigners
[i
].pasCertChain
[0].pCert
,
920 CERT_SIGNATURE_HASH_PROP_ID
, hash
, &size
)))
922 static const WCHAR disallowedW
[] =
923 { 'D','i','s','a','l','l','o','w','e','d',0 };
924 HCERTSTORE disallowed
= CertOpenStore(CERT_STORE_PROV_SYSTEM_W
,
925 X509_ASN_ENCODING
, 0, CERT_SYSTEM_STORE_CURRENT_USER
,
930 PCCERT_CONTEXT found
= CertFindCertificateInStore(
931 disallowed
, X509_ASN_ENCODING
, 0, CERT_FIND_SIGNATURE_HASH
,
936 /* Disallowed! Can't verify it. */
937 policyStatus
.dwError
= TRUST_E_SUBJECT_NOT_TRUSTED
;
939 CertFreeCertificateContext(found
);
941 CertCloseStore(disallowed
, 0);
946 CERT_CHAIN_POLICY_PARA policyPara
= { sizeof(policyPara
), 0 };
948 if (data
->dwRegPolicySettings
& WTPF_TRUSTTEST
)
949 policyPara
.dwFlags
|= CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG
;
950 if (data
->dwRegPolicySettings
& WTPF_TESTCANBEVALID
)
951 policyPara
.dwFlags
|= CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG
;
952 if (data
->dwRegPolicySettings
& WTPF_IGNOREEXPIRATION
)
953 policyPara
.dwFlags
|=
954 CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG
|
955 CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG
|
956 CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG
;
957 if (data
->dwRegPolicySettings
& WTPF_IGNOREREVOKATION
)
958 policyPara
.dwFlags
|=
959 CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG
|
960 CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG
|
961 CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG
|
962 CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG
;
963 CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_AUTHENTICODE
,
964 data
->pasSigners
[i
].pChainContext
, &policyPara
, &policyStatus
);
965 if (policyStatus
.dwError
!= NO_ERROR
)
971 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_POLICYPROV
] =
972 policyStatus
.dwError
;
973 TRACE("returning %d (%08x)\n", ret
? S_OK
: S_FALSE
,
974 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_POLICYPROV
]);
975 return ret
? S_OK
: S_FALSE
;
978 static HRESULT WINAPI
WINTRUST_DefaultPolicy(CRYPT_PROVIDER_DATA
*pProvData
,
979 DWORD dwStepError
, DWORD dwRegPolicySettings
, DWORD cSigner
,
980 PWTD_GENERIC_CHAIN_POLICY_SIGNER_INFO rgpSigner
, void *pvPolicyArg
)
983 CERT_CHAIN_POLICY_STATUS policyStatus
= { sizeof(policyStatus
), 0 };
985 for (i
= 0; !policyStatus
.dwError
&& i
< cSigner
; i
++)
987 CERT_CHAIN_POLICY_PARA policyPara
= { sizeof(policyPara
), 0 };
989 if (dwRegPolicySettings
& WTPF_IGNOREEXPIRATION
)
990 policyPara
.dwFlags
|=
991 CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG
|
992 CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG
|
993 CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG
;
994 if (dwRegPolicySettings
& WTPF_IGNOREREVOKATION
)
995 policyPara
.dwFlags
|=
996 CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG
|
997 CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG
|
998 CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG
|
999 CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG
;
1000 CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE
,
1001 rgpSigner
[i
].pChainContext
, &policyPara
, &policyStatus
);
1003 return policyStatus
.dwError
;
1006 HRESULT WINAPI
GenericChainFinalProv(CRYPT_PROVIDER_DATA
*data
)
1008 HRESULT err
= NO_ERROR
; /* not a typo, MS confused the types */
1009 WTD_GENERIC_CHAIN_POLICY_DATA
*policyData
=
1010 data
->pWintrustData
->pPolicyCallbackData
;
1012 TRACE("(%p)\n", data
);
1014 if (data
->pWintrustData
->dwUIChoice
!= WTD_UI_NONE
)
1015 FIXME("unimplemented for UI choice %d\n",
1016 data
->pWintrustData
->dwUIChoice
);
1017 if (!data
->csSigners
)
1018 err
= TRUST_E_NOSIGNATURE
;
1021 PFN_WTD_GENERIC_CHAIN_POLICY_CALLBACK policyCallback
;
1023 WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO
*signers
= NULL
;
1027 policyCallback
= policyData
->pfnPolicyCallback
;
1028 policyArg
= policyData
->pvPolicyArg
;
1032 policyCallback
= WINTRUST_DefaultPolicy
;
1035 if (data
->csSigners
)
1039 signers
= data
->psPfns
->pfnAlloc(
1040 data
->csSigners
* sizeof(WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO
));
1043 for (i
= 0; i
< data
->csSigners
; i
++)
1045 signers
[i
].u
.cbSize
=
1046 sizeof(WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO
);
1047 signers
[i
].pChainContext
=
1048 data
->pasSigners
[i
].pChainContext
;
1049 signers
[i
].dwSignerType
= data
->pasSigners
[i
].dwSignerType
;
1050 signers
[i
].pMsgSignerInfo
= data
->pasSigners
[i
].psSigner
;
1051 signers
[i
].dwError
= data
->pasSigners
[i
].dwError
;
1052 if (data
->pasSigners
[i
].csCounterSigners
)
1053 FIXME("unimplemented for counter signers\n");
1054 signers
[i
].cCounterSigner
= 0;
1055 signers
[i
].rgpCounterSigner
= NULL
;
1059 err
= ERROR_OUTOFMEMORY
;
1061 if (err
== NO_ERROR
)
1062 err
= policyCallback(data
, TRUSTERROR_STEP_FINAL_POLICYPROV
,
1063 data
->dwRegPolicySettings
, data
->csSigners
, signers
, policyArg
);
1064 data
->psPfns
->pfnFree(signers
);
1066 if (err
!= NO_ERROR
)
1067 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_POLICYPROV
] = err
;
1068 TRACE("returning %d (%08x)\n", err
== NO_ERROR
? S_OK
: S_FALSE
,
1069 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_POLICYPROV
]);
1070 return err
== NO_ERROR
? S_OK
: S_FALSE
;
1073 HRESULT WINAPI
SoftpubCleanup(CRYPT_PROVIDER_DATA
*data
)
1077 for (i
= 0; i
< data
->csSigners
; i
++)
1079 for (j
= 0; j
< data
->pasSigners
[i
].csCertChain
; j
++)
1080 CertFreeCertificateContext(data
->pasSigners
[i
].pasCertChain
[j
].pCert
);
1081 data
->psPfns
->pfnFree(data
->pasSigners
[i
].pasCertChain
);
1082 data
->psPfns
->pfnFree(data
->pasSigners
[i
].psSigner
);
1083 CertFreeCertificateChain(data
->pasSigners
[i
].pChainContext
);
1085 data
->psPfns
->pfnFree(data
->pasSigners
);
1087 for (i
= 0; i
< data
->chStores
; i
++)
1088 CertCloseStore(data
->pahStores
[i
], 0);
1089 data
->psPfns
->pfnFree(data
->pahStores
);
1093 data
->psPfns
->pfnFree(data
->u
.pPDSip
->pSip
);
1094 data
->psPfns
->pfnFree(data
->u
.pPDSip
->pCATSip
);
1095 data
->psPfns
->pfnFree(data
->u
.pPDSip
->psSipSubjectInfo
);
1096 data
->psPfns
->pfnFree(data
->u
.pPDSip
->psSipCATSubjectInfo
);
1097 data
->psPfns
->pfnFree(data
->u
.pPDSip
->psIndirectData
);
1100 CryptMsgClose(data
->hMsg
);
1102 if (data
->fOpenedFile
&&
1103 data
->pWintrustData
->dwUnionChoice
== WTD_CHOICE_FILE
)
1104 CloseHandle(data
->pWintrustData
->u
.pFile
->hFile
);
1109 HRESULT WINAPI
HTTPSCertificateTrust(CRYPT_PROVIDER_DATA
*data
)
1111 FIXME("(%p)\n", data
);
1115 HRESULT WINAPI
HTTPSFinalProv(CRYPT_PROVIDER_DATA
*data
)
1117 FIXME("(%p)\n", data
);