?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
crypt32/tests: Use CryptAcquireContextA instead of CryptAcquireContextW.
[wine/multimedia.git] / dlls / crypt32 / cert.c
blobd9ab22985fe991ba0459bb1fa69b0dd21624ae19
1 /*
2 * Copyright 2004-2006 Juan Lang
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17 *
18 */
19
20 #include <assert.h>
21 #include <stdarg.h>
22
23 #define NONAMELESSUNION
24 #include "windef.h"
25 #include "winbase.h"
26 #include "wincrypt.h"
27 #include "winnls.h"
28 #include "rpc.h"
29 #include "wine/debug.h"
30 #include "crypt32_private.h"
31
32 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
33
34 /* Internal version of CertGetCertificateContextProperty that gets properties
35 * directly from the context (or the context it's linked to, depending on its
36 * type.) Doesn't handle special-case properties, since they are handled by
37 * CertGetCertificateContextProperty, and are particular to the store in which
38 * the property exists (which is separate from the context.)
39 */
40 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
41 void *pvData, DWORD *pcbData);
42
43 /* Internal version of CertSetCertificateContextProperty that sets properties
44 * directly on the context (or the context it's linked to, depending on its
45 * type.) Doesn't handle special cases, since they're handled by
46 * CertSetCertificateContextProperty anyway.
47 */
48 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
49 DWORD dwFlags, const void *pvData);
50
51 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
52 DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
53 DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
54 {
55 PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
56 pbCertEncoded, cbCertEncoded);
57 BOOL ret;
58
59 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
60 pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
61
62 if (cert)
63 {
64 ret = CertAddCertificateContextToStore(hCertStore, cert,
65 dwAddDisposition, ppCertContext);
66 CertFreeCertificateContext(cert);
67 }
68 else
69 ret = FALSE;
70 return ret;
71 }
72
73 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
74 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
75 {
76 PCERT_CONTEXT cert = NULL;
77 BOOL ret;
78 PCERT_INFO certInfo = NULL;
79 DWORD size = 0;
80
81 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
82 cbCertEncoded);
83
84 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
85 pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
86 (BYTE *)&certInfo, &size);
87 if (ret)
88 {
89 BYTE *data = NULL;
90
91 cert = (PCERT_CONTEXT)Context_CreateDataContext(sizeof(CERT_CONTEXT));
92 if (!cert)
93 goto end;
94 data = CryptMemAlloc(cbCertEncoded);
95 if (!data)
96 {
97 CryptMemFree(cert);
98 cert = NULL;
99 goto end;
100 }
101 memcpy(data, pbCertEncoded, cbCertEncoded);
102 cert->dwCertEncodingType = dwCertEncodingType;
103 cert->pbCertEncoded = data;
104 cert->cbCertEncoded = cbCertEncoded;
105 cert->pCertInfo = certInfo;
106 cert->hCertStore = 0;
107 }
108
109 end:
110 return (PCCERT_CONTEXT)cert;
111 }
112
113 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
114 PCCERT_CONTEXT pCertContext)
115 {
116 TRACE("(%p)\n", pCertContext);
117 Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
118 return pCertContext;
119 }
120
121 static void CertDataContext_Free(void *context)
122 {
123 PCERT_CONTEXT certContext = (PCERT_CONTEXT)context;
124
125 CryptMemFree(certContext->pbCertEncoded);
126 LocalFree(certContext->pCertInfo);
127 }
128
129 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
130 {
131 TRACE("(%p)\n", pCertContext);
132
133 if (pCertContext)
134 Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
135 CertDataContext_Free);
136 return TRUE;
137 }
138
139 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
140 DWORD dwPropId)
141 {
142 PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
143 (void *)pCertContext, sizeof(CERT_CONTEXT));
144 DWORD ret;
145
146 TRACE("(%p, %d)\n", pCertContext, dwPropId);
147
148 if (properties)
149 ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
150 else
151 ret = 0;
152 return ret;
153 }
154
155 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
156 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
157 DWORD *pcbData)
158 {
159 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
160 pcbData);
161 if (ret && pvData)
162 {
163 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
164
165 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
166 }
167 return ret;
168 }
169
170 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
171 DWORD cb)
172 {
173 BOOL ret = TRUE;
174
175 if (!pvData)
176 *pcbData = cb;
177 else if (*pcbData < cb)
178 {
179 SetLastError(ERROR_MORE_DATA);
180 *pcbData = cb;
181 ret = FALSE;
182 }
183 else
184 {
185 memcpy(pvData, pb, cb);
186 *pcbData = cb;
187 }
188 return ret;
189 }
190
191 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
192 void *pvData, DWORD *pcbData)
193 {
194 PCCERT_CONTEXT pCertContext = (PCCERT_CONTEXT)context;
195 PCONTEXT_PROPERTY_LIST properties =
196 Context_GetProperties(context, sizeof(CERT_CONTEXT));
197 BOOL ret;
198 CRYPT_DATA_BLOB blob;
199
200 TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
201
202 if (properties)
203 ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
204 else
205 ret = FALSE;
206 if (ret)
207 ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
208 else
209 {
210 /* Implicit properties */
211 switch (dwPropId)
212 {
213 case CERT_SHA1_HASH_PROP_ID:
214 ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
215 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
216 pcbData);
217 break;
218 case CERT_MD5_HASH_PROP_ID:
219 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
220 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
221 pcbData);
222 break;
223 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
224 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
225 pCertContext->pCertInfo->Subject.pbData,
226 pCertContext->pCertInfo->Subject.cbData,
227 pvData, pcbData);
228 break;
229 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
230 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
231 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
232 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
233 pvData, pcbData);
234 break;
235 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
236 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
237 pCertContext->pCertInfo->SerialNumber.pbData,
238 pCertContext->pCertInfo->SerialNumber.cbData,
239 pvData, pcbData);
240 break;
241 case CERT_SIGNATURE_HASH_PROP_ID:
242 ret = CryptHashToBeSigned(0, pCertContext->dwCertEncodingType,
243 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
244 pcbData);
245 if (ret && pvData)
246 {
247 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
248
249 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
250 }
251 break;
252 case CERT_KEY_IDENTIFIER_PROP_ID:
253 {
254 PCERT_EXTENSION ext = CertFindExtension(
255 szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
256 pCertContext->pCertInfo->rgExtension);
257
258 if (ext)
259 {
260 CRYPT_DATA_BLOB value;
261 DWORD size = sizeof(value);
262
263 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
264 szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
265 ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
266 &size);
267 if (ret)
268 {
269 ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
270 value.cbData);
271 CertContext_SetProperty(context, dwPropId, 0, &value);
272 }
273 }
274 else
275 SetLastError(ERROR_INVALID_DATA);
276 break;
277 }
278 default:
279 SetLastError(CRYPT_E_NOT_FOUND);
280 }
281 }
282 TRACE("returning %d\n", ret);
283 return ret;
284 }
285
286 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
287 {
288 DWORD i, containerLen, provNameLen;
289 LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
290
291 info->pwszContainerName = (LPWSTR)data;
292 containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
293 data += containerLen;
294
295 info->pwszProvName = (LPWSTR)data;
296 provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
297 data += provNameLen;
298
299 info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
300 data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
301
302 for (i = 0; i < info->cProvParam; i++)
303 {
304 info->rgProvParam[i].pbData = data;
305 data += info->rgProvParam[i].cbData;
306 }
307 }
308
309 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
310 DWORD dwPropId, void *pvData, DWORD *pcbData)
311 {
312 BOOL ret;
313
314 TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
315
316 switch (dwPropId)
317 {
318 case 0:
319 case CERT_CERT_PROP_ID:
320 case CERT_CRL_PROP_ID:
321 case CERT_CTL_PROP_ID:
322 SetLastError(E_INVALIDARG);
323 ret = FALSE;
324 break;
325 case CERT_ACCESS_STATE_PROP_ID:
326 if (pCertContext->hCertStore)
327 ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
328 pvData, pcbData);
329 else
330 {
331 DWORD state = 0;
332
333 ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
334 }
335 break;
336 case CERT_KEY_PROV_HANDLE_PROP_ID:
337 {
338 CERT_KEY_CONTEXT keyContext;
339 DWORD size = sizeof(keyContext);
340
341 ret = CertContext_GetProperty((void *)pCertContext,
342 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
343 if (ret)
344 ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
345 sizeof(keyContext.hCryptProv));
346 break;
347 }
348 case CERT_KEY_PROV_INFO_PROP_ID:
349 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
350 pcbData);
351 if (ret && pvData)
352 CRYPT_FixKeyProvInfoPointers((PCRYPT_KEY_PROV_INFO)pvData);
353 break;
354 default:
355 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
356 pcbData);
357 }
358
359 TRACE("returning %d\n", ret);
360 return ret;
361 }
362
363 /* Copies key provider info from from into to, where to is assumed to be a
364 * contiguous buffer of memory large enough for from and all its associated
365 * data, but whose pointers are uninitialized.
366 * Upon return, to contains a contiguous copy of from, packed in the following
367 * order:
368 * - CRYPT_KEY_PROV_INFO
369 * - pwszContainerName
370 * - pwszProvName
371 * - rgProvParam[0]...
372 */
373 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
374 const CRYPT_KEY_PROV_INFO *from)
375 {
376 DWORD i;
377 LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
378
379 if (from->pwszContainerName)
380 {
381 to->pwszContainerName = (LPWSTR)nextData;
382 lstrcpyW(to->pwszContainerName, from->pwszContainerName);
383 nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
384 }
385 else
386 to->pwszContainerName = NULL;
387 if (from->pwszProvName)
388 {
389 to->pwszProvName = (LPWSTR)nextData;
390 lstrcpyW(to->pwszProvName, from->pwszProvName);
391 nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
392 }
393 else
394 to->pwszProvName = NULL;
395 to->dwProvType = from->dwProvType;
396 to->dwFlags = from->dwFlags;
397 to->cProvParam = from->cProvParam;
398 to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
399 nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
400 to->dwKeySpec = from->dwKeySpec;
401 for (i = 0; i < to->cProvParam; i++)
402 {
403 memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
404 sizeof(CRYPT_KEY_PROV_PARAM));
405 to->rgProvParam[i].pbData = nextData;
406 memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
407 from->rgProvParam[i].cbData);
408 nextData += from->rgProvParam[i].cbData;
409 }
410 }
411
412 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
413 const CRYPT_KEY_PROV_INFO *info)
414 {
415 BOOL ret;
416 LPBYTE buf = NULL;
417 DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
418
419 if (info->pwszContainerName)
420 containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
421 else
422 containerSize = 0;
423 if (info->pwszProvName)
424 provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
425 else
426 provNameSize = 0;
427 size += containerSize + provNameSize;
428 for (i = 0; i < info->cProvParam; i++)
429 size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
430 buf = CryptMemAlloc(size);
431 if (buf)
432 {
433 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
434 ret = ContextPropertyList_SetProperty(properties,
435 CERT_KEY_PROV_INFO_PROP_ID, buf, size);
436 CryptMemFree(buf);
437 }
438 else
439 ret = FALSE;
440 return ret;
441 }
442
443 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
444 DWORD dwFlags, const void *pvData)
445 {
446 PCONTEXT_PROPERTY_LIST properties =
447 Context_GetProperties(context, sizeof(CERT_CONTEXT));
448 BOOL ret;
449
450 TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
451
452 if (!properties)
453 ret = FALSE;
454 else
455 {
456 switch (dwPropId)
457 {
458 case CERT_AUTO_ENROLL_PROP_ID:
459 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
460 case CERT_DESCRIPTION_PROP_ID:
461 case CERT_FRIENDLY_NAME_PROP_ID:
462 case CERT_HASH_PROP_ID:
463 case CERT_KEY_IDENTIFIER_PROP_ID:
464 case CERT_MD5_HASH_PROP_ID:
465 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
466 case CERT_PUBKEY_ALG_PARA_PROP_ID:
467 case CERT_PVK_FILE_PROP_ID:
468 case CERT_SIGNATURE_HASH_PROP_ID:
469 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
470 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
471 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
472 case CERT_ENROLLMENT_PROP_ID:
473 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
474 case CERT_RENEWAL_PROP_ID:
475 {
476 if (pvData)
477 {
478 const CRYPT_DATA_BLOB *blob = (const CRYPT_DATA_BLOB *)pvData;
479
480 ret = ContextPropertyList_SetProperty(properties, dwPropId,
481 blob->pbData, blob->cbData);
482 }
483 else
484 {
485 ContextPropertyList_RemoveProperty(properties, dwPropId);
486 ret = TRUE;
487 }
488 break;
489 }
490 case CERT_DATE_STAMP_PROP_ID:
491 if (pvData)
492 ret = ContextPropertyList_SetProperty(properties, dwPropId,
493 (const BYTE *)pvData, sizeof(FILETIME));
494 else
495 {
496 ContextPropertyList_RemoveProperty(properties, dwPropId);
497 ret = TRUE;
498 }
499 break;
500 case CERT_KEY_CONTEXT_PROP_ID:
501 {
502 if (pvData)
503 {
504 const CERT_KEY_CONTEXT *keyContext = (const CERT_KEY_CONTEXT *)pvData;
505
506 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
507 {
508 SetLastError(E_INVALIDARG);
509 ret = FALSE;
510 }
511 else
512 ret = ContextPropertyList_SetProperty(properties, dwPropId,
513 (const BYTE *)keyContext, keyContext->cbSize);
514 }
515 else
516 {
517 ContextPropertyList_RemoveProperty(properties, dwPropId);
518 ret = TRUE;
519 }
520 break;
521 }
522 case CERT_KEY_PROV_INFO_PROP_ID:
523 if (pvData)
524 ret = CertContext_SetKeyProvInfoProperty(properties,
525 (const CRYPT_KEY_PROV_INFO *)pvData);
526 else
527 {
528 ContextPropertyList_RemoveProperty(properties, dwPropId);
529 ret = TRUE;
530 }
531 break;
532 case CERT_KEY_PROV_HANDLE_PROP_ID:
533 {
534 CERT_KEY_CONTEXT keyContext;
535 DWORD size = sizeof(keyContext);
536
537 ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
538 &keyContext, &size);
539 if (ret)
540 {
541 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
542 CryptReleaseContext(keyContext.hCryptProv, 0);
543 if (pvData)
544 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
545 else
546 keyContext.hCryptProv = 0;
547 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
548 0, &keyContext);
549 }
550 break;
551 }
552 default:
553 FIXME("%d: stub\n", dwPropId);
554 ret = FALSE;
555 }
556 }
557 TRACE("returning %d\n", ret);
558 return ret;
559 }
560
561 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
562 DWORD dwPropId, DWORD dwFlags, const void *pvData)
563 {
564 BOOL ret;
565
566 TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
567
568 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
569 * crashes on most of these, I'll be safer.
570 */
571 switch (dwPropId)
572 {
573 case 0:
574 case CERT_ACCESS_STATE_PROP_ID:
575 case CERT_CERT_PROP_ID:
576 case CERT_CRL_PROP_ID:
577 case CERT_CTL_PROP_ID:
578 SetLastError(E_INVALIDARG);
579 return FALSE;
580 }
581 ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
582 pvData);
583 TRACE("returning %d\n", ret);
584 return ret;
585 }
586
587 /* Acquires the private key using the key provider info, retrieving info from
588 * the certificate if info is NULL. The acquired provider is returned in
589 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
590 */
591 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
592 PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
593 {
594 DWORD size = 0;
595 BOOL allocated = FALSE, ret = TRUE;
596
597 if (!info)
598 {
599 ret = CertGetCertificateContextProperty(pCert,
600 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
601 if (ret)
602 {
603 info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(GetProcessHeap(), 0, size);
604 if (info)
605 {
606 ret = CertGetCertificateContextProperty(pCert,
607 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
608 allocated = TRUE;
609 }
610 }
611 else
612 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
613 }
614 if (ret)
615 {
616 ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
617 info->pwszProvName, info->dwProvType, 0);
618 if (ret)
619 {
620 DWORD i;
621
622 for (i = 0; i < info->cProvParam; i++)
623 {
624 CryptSetProvParam(*phCryptProv,
625 info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
626 info->rgProvParam[i].dwFlags);
627 }
628 *pdwKeySpec = info->dwKeySpec;
629 }
630 else
631 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
632 }
633 if (allocated)
634 HeapFree(GetProcessHeap(), 0, info);
635 return ret;
636 }
637
638 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
639 DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
640 DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
641 {
642 BOOL ret = FALSE, cache = FALSE;
643 PCRYPT_KEY_PROV_INFO info = NULL;
644 CERT_KEY_CONTEXT keyContext;
645 DWORD size;
646
647 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
648 phCryptProv, pdwKeySpec, pfCallerFreeProv);
649
650 if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
651 {
652 DWORD size = 0;
653
654 ret = CertGetCertificateContextProperty(pCert,
655 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
656 if (ret)
657 {
658 info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(
659 GetProcessHeap(), 0, size);
660 ret = CertGetCertificateContextProperty(pCert,
661 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
662 if (ret)
663 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
664 }
665 }
666 else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
667 cache = TRUE;
668 *phCryptProv = 0;
669 if (cache)
670 {
671 size = sizeof(keyContext);
672 ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
673 &keyContext, &size);
674 if (ret)
675 {
676 *phCryptProv = keyContext.hCryptProv;
677 if (pdwKeySpec)
678 *pdwKeySpec = keyContext.dwKeySpec;
679 if (pfCallerFreeProv)
680 *pfCallerFreeProv = !cache;
681 }
682 }
683 if (!*phCryptProv)
684 {
685 ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
686 &keyContext.hCryptProv, &keyContext.dwKeySpec);
687 if (ret)
688 {
689 *phCryptProv = keyContext.hCryptProv;
690 if (pdwKeySpec)
691 *pdwKeySpec = keyContext.dwKeySpec;
692 if (cache)
693 {
694 keyContext.cbSize = sizeof(keyContext);
695 if (CertSetCertificateContextProperty(pCert,
696 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
697 {
698 if (pfCallerFreeProv)
699 *pfCallerFreeProv = FALSE;
700 }
701 }
702 else
703 {
704 if (pfCallerFreeProv)
705 *pfCallerFreeProv = TRUE;
706 }
707 }
708 }
709 HeapFree(GetProcessHeap(), 0, info);
710 return ret;
711 }
712
713 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
714 PCERT_INFO pCertId1, PCERT_INFO pCertId2)
715 {
716 BOOL ret;
717
718 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
719
720 ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
721 &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
722 &pCertId2->SerialNumber);
723 TRACE("returning %d\n", ret);
724 return ret;
725 }
726
727 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
728 PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
729 {
730 BOOL ret;
731
732 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
733
734 if (pCertName1->cbData == pCertName2->cbData)
735 {
736 if (pCertName1->cbData)
737 ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
738 pCertName1->cbData);
739 else
740 ret = TRUE;
741 }
742 else
743 ret = FALSE;
744 TRACE("returning %d\n", ret);
745 return ret;
746 }
747
748 /* Returns the number of significant bytes in pInt, where a byte is
749 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
750 * for negative numbers. pInt is assumed to be little-endian.
751 */
752 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
753 {
754 DWORD ret = pInt->cbData;
755
756 while (ret > 1)
757 {
758 if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
759 ret--;
760 else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
761 ret--;
762 else
763 break;
764 }
765 return ret;
766 }
767
768 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
769 PCRYPT_INTEGER_BLOB pInt2)
770 {
771 BOOL ret;
772 DWORD cb1, cb2;
773
774 TRACE("(%p, %p)\n", pInt1, pInt2);
775
776 cb1 = CRYPT_significantBytes(pInt1);
777 cb2 = CRYPT_significantBytes(pInt2);
778 if (cb1 == cb2)
779 {
780 if (cb1)
781 ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
782 else
783 ret = TRUE;
784 }
785 else
786 ret = FALSE;
787 TRACE("returning %d\n", ret);
788 return ret;
789 }
790
791 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
792 PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
793 {
794 BOOL ret;
795
796 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
797
798 switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
799 {
800 case 0: /* Seems to mean "raw binary bits" */
801 if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
802 pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
803 {
804 if (pPublicKey2->PublicKey.cbData)
805 ret = !memcmp(pPublicKey1->PublicKey.pbData,
806 pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
807 else
808 ret = TRUE;
809 }
810 else
811 ret = FALSE;
812 break;
813 default:
814 WARN("Unknown encoding type %08x\n", dwCertEncodingType);
815 /* FALLTHROUGH */
816 case X509_ASN_ENCODING:
817 {
818 BLOBHEADER *pblob1, *pblob2;
819 DWORD length;
820 ret = FALSE;
821 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
822 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
823 0, NULL, &length))
824 {
825 pblob1 = CryptMemAlloc(length);
826 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
827 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
828 0, pblob1, &length))
829 {
830 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
831 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
832 0, NULL, &length))
833 {
834 pblob2 = CryptMemAlloc(length);
835 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
836 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
837 0, pblob2, &length))
838 {
839 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
840 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
841 *pk2 = (LPVOID)(pblob2 + 1);
842 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
843 && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
844 }
845 CryptMemFree(pblob2);
846 }
847 }
848 CryptMemFree(pblob1);
849 }
850
851 break;
852 }
853 }
854 return ret;
855 }
856
857 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
858 PCERT_PUBLIC_KEY_INFO pPublicKey)
859 {
860 DWORD len = 0;
861
862 TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
863
864 if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
865 {
866 SetLastError(ERROR_FILE_NOT_FOUND);
867 return 0;
868 }
869 if (pPublicKey->Algorithm.pszObjId &&
870 !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
871 {
872 FIXME("unimplemented for DH public keys\n");
873 SetLastError(CRYPT_E_ASN1_BADTAG);
874 }
875 else
876 {
877 DWORD size;
878 PBYTE buf;
879 BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
880 RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
881 pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
882 &size);
883
884 if (ret)
885 {
886 RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
887
888 len = rsaPubKey->bitlen;
889 LocalFree(buf);
890 }
891 }
892 return len;
893 }
894
895 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
896 DWORD dwFlags, const void *pvPara);
897
898 static BOOL compare_cert_any(PCCERT_CONTEXT pCertContext, DWORD dwType,
899 DWORD dwFlags, const void *pvPara)
900 {
901 return TRUE;
902 }
903
904 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
905 DWORD dwFlags, const void *pvPara)
906 {
907 BOOL ret;
908 BYTE hash[16];
909 DWORD size = sizeof(hash);
910
911 ret = CertGetCertificateContextProperty(pCertContext,
912 CERT_MD5_HASH_PROP_ID, hash, &size);
913 if (ret)
914 {
915 const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
916
917 if (size == pHash->cbData)
918 ret = !memcmp(pHash->pbData, hash, size);
919 else
920 ret = FALSE;
921 }
922 return ret;
923 }
924
925 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
926 DWORD dwFlags, const void *pvPara)
927 {
928 BOOL ret;
929 BYTE hash[20];
930 DWORD size = sizeof(hash);
931
932 ret = CertGetCertificateContextProperty(pCertContext,
933 CERT_SHA1_HASH_PROP_ID, hash, &size);
934 if (ret)
935 {
936 const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
937
938 if (size == pHash->cbData)
939 ret = !memcmp(pHash->pbData, hash, size);
940 else
941 ret = FALSE;
942 }
943 return ret;
944 }
945
946 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
947 DWORD dwFlags, const void *pvPara)
948 {
949 CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
950 BOOL ret;
951
952 if (dwType & CERT_INFO_SUBJECT_FLAG)
953 toCompare = &pCertContext->pCertInfo->Subject;
954 else
955 toCompare = &pCertContext->pCertInfo->Issuer;
956 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
957 toCompare, blob);
958 return ret;
959 }
960
961 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
962 DWORD dwType, DWORD dwFlags, const void *pvPara)
963 {
964 CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
965 BOOL ret;
966
967 /* Matching serial number and subject match.. */
968 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
969 &pCertInfo->Issuer, &pCertContext->pCertInfo->Subject);
970 if (ret)
971 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
972 &pCertInfo->SerialNumber);
973 else
974 {
975 /* failing that, if the serial number and issuer match, we match */
976 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
977 &pCertInfo->SerialNumber);
978 if (ret)
979 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
980 &pCertInfo->Issuer, &pCertContext->pCertInfo->Issuer);
981 }
982 TRACE("returning %d\n", ret);
983 return ret;
984 }
985
986 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
987 DWORD dwFlags, const void *pvPara)
988 {
989 CERT_ID *id = (CERT_ID *)pvPara;
990 BOOL ret;
991
992 switch (id->dwIdChoice)
993 {
994 case CERT_ID_ISSUER_SERIAL_NUMBER:
995 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
996 &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
997 if (ret)
998 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
999 &id->u.IssuerSerialNumber.SerialNumber);
1000 break;
1001 case CERT_ID_SHA1_HASH:
1002 ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1003 &id->u.HashId);
1004 break;
1005 case CERT_ID_KEY_IDENTIFIER:
1006 {
1007 DWORD size = 0;
1008
1009 ret = CertGetCertificateContextProperty(pCertContext,
1010 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1011 if (ret && size == id->u.KeyId.cbData)
1012 {
1013 LPBYTE buf = CryptMemAlloc(size);
1014
1015 if (buf)
1016 {
1017 CertGetCertificateContextProperty(pCertContext,
1018 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1019 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1020 CryptMemFree(buf);
1021 }
1022 }
1023 else
1024 ret = FALSE;
1025 break;
1026 }
1027 default:
1028 ret = FALSE;
1029 break;
1030 }
1031 return ret;
1032 }
1033
1034 static BOOL compare_cert_by_issuer(PCCERT_CONTEXT pCertContext, DWORD dwType,
1035 DWORD dwFlags, const void *pvPara)
1036 {
1037 BOOL ret = FALSE;
1038 PCCERT_CONTEXT subject = (PCCERT_CONTEXT)pvPara;
1039 PCERT_EXTENSION ext;
1040 DWORD size;
1041
1042 if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1043 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1044 {
1045 CERT_AUTHORITY_KEY_ID_INFO *info;
1046
1047 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1048 X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1049 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1050 &info, &size);
1051 if (ret)
1052 {
1053 CERT_ID id;
1054
1055 if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1056 {
1057 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1058 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1059 sizeof(CERT_NAME_BLOB));
1060 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1061 &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1062 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1063 &id);
1064 }
1065 else if (info->KeyId.cbData)
1066 {
1067 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1068 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1069 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1070 &id);
1071 }
1072 else
1073 ret = FALSE;
1074 LocalFree(info);
1075 }
1076 }
1077 else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1078 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1079 {
1080 CERT_AUTHORITY_KEY_ID2_INFO *info;
1081
1082 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1083 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1084 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1085 &info, &size);
1086 if (ret)
1087 {
1088 CERT_ID id;
1089
1090 if (info->AuthorityCertIssuer.cAltEntry &&
1091 info->AuthorityCertSerialNumber.cbData)
1092 {
1093 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1094 DWORD i;
1095
1096 for (i = 0; !directoryName &&
1097 i < info->AuthorityCertIssuer.cAltEntry; i++)
1098 if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1099 == CERT_ALT_NAME_DIRECTORY_NAME)
1100 directoryName =
1101 &info->AuthorityCertIssuer.rgAltEntry[i];
1102 if (directoryName)
1103 {
1104 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1105 memcpy(&id.u.IssuerSerialNumber.Issuer,
1106 &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1107 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1108 &info->AuthorityCertSerialNumber,
1109 sizeof(CRYPT_INTEGER_BLOB));
1110 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1111 &id);
1112 }
1113 else
1114 {
1115 FIXME("no supported name type in authority key id2\n");
1116 ret = FALSE;
1117 }
1118 }
1119 else if (info->KeyId.cbData)
1120 {
1121 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1122 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1123 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1124 &id);
1125 }
1126 else
1127 ret = FALSE;
1128 LocalFree(info);
1129 }
1130 }
1131 else
1132 ret = compare_cert_by_name(pCertContext,
1133 CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT, dwFlags,
1134 &subject->pCertInfo->Issuer);
1135 return ret;
1136 }
1137
1138 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1139 DWORD dwFlags, const void *pvPara)
1140 {
1141 PCCERT_CONTEXT toCompare = (PCCERT_CONTEXT)pvPara;
1142 return CertCompareCertificate(pCertContext->dwCertEncodingType,
1143 pCertContext->pCertInfo, toCompare->pCertInfo);
1144 }
1145
1146 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1147 DWORD dwFlags, const void *pvPara)
1148 {
1149 const CRYPT_HASH_BLOB *hash = (const CRYPT_HASH_BLOB *)pvPara;
1150 DWORD size = 0;
1151 BOOL ret;
1152
1153 ret = CertGetCertificateContextProperty(pCertContext,
1154 CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1155 if (ret && size == hash->cbData)
1156 {
1157 LPBYTE buf = CryptMemAlloc(size);
1158
1159 if (buf)
1160 {
1161 CertGetCertificateContextProperty(pCertContext,
1162 CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1163 ret = !memcmp(buf, hash->pbData, size);
1164 CryptMemFree(buf);
1165 }
1166 }
1167 else
1168 ret = FALSE;
1169 return ret;
1170 }
1171
1172 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1173 DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1174 PCCERT_CONTEXT pPrevCertContext)
1175 {
1176 PCCERT_CONTEXT ret;
1177 CertCompareFunc compare;
1178
1179 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1180 dwFlags, dwType, pvPara, pPrevCertContext);
1181
1182 switch (dwType >> CERT_COMPARE_SHIFT)
1183 {
1184 case CERT_COMPARE_ANY:
1185 compare = compare_cert_any;
1186 break;
1187 case CERT_COMPARE_MD5_HASH:
1188 compare = compare_cert_by_md5_hash;
1189 break;
1190 case CERT_COMPARE_SHA1_HASH:
1191 compare = compare_cert_by_sha1_hash;
1192 break;
1193 case CERT_COMPARE_NAME:
1194 compare = compare_cert_by_name;
1195 break;
1196 case CERT_COMPARE_SUBJECT_CERT:
1197 compare = compare_cert_by_subject_cert;
1198 break;
1199 case CERT_COMPARE_CERT_ID:
1200 compare = compare_cert_by_cert_id;
1201 break;
1202 case CERT_COMPARE_ISSUER_OF:
1203 compare = compare_cert_by_issuer;
1204 break;
1205 case CERT_COMPARE_EXISTING:
1206 compare = compare_existing_cert;
1207 break;
1208 case CERT_COMPARE_SIGNATURE_HASH:
1209 compare = compare_cert_by_signature_hash;
1210 break;
1211 default:
1212 FIXME("find type %08x unimplemented\n", dwType);
1213 compare = NULL;
1214 }
1215
1216 if (compare)
1217 {
1218 BOOL matches = FALSE;
1219
1220 ret = pPrevCertContext;
1221 do {
1222 ret = CertEnumCertificatesInStore(hCertStore, ret);
1223 if (ret)
1224 matches = compare(ret, dwType, dwFlags, pvPara);
1225 } while (ret != NULL && !matches);
1226 if (!ret)
1227 SetLastError(CRYPT_E_NOT_FOUND);
1228 }
1229 else
1230 {
1231 SetLastError(CRYPT_E_NOT_FOUND);
1232 ret = NULL;
1233 }
1234 TRACE("returning %p\n", ret);
1235 return ret;
1236 }
1237
1238 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1239 DWORD dwCertEncodingType, PCERT_INFO pCertId)
1240 {
1241 TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1242
1243 if (!pCertId)
1244 {
1245 SetLastError(E_INVALIDARG);
1246 return NULL;
1247 }
1248 return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1249 CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1250 }
1251
1252 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1253 PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1254 {
1255 static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1256 CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1257
1258 if (*pdwFlags & ~supportedFlags)
1259 {
1260 SetLastError(E_INVALIDARG);
1261 return FALSE;
1262 }
1263 if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1264 {
1265 DWORD flags = 0;
1266 PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1267 NULL, &flags);
1268
1269 /* FIXME: what if the CRL has expired? */
1270 if (crl)
1271 {
1272 if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1273 pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1274 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1275 }
1276 else
1277 *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1278 }
1279 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1280 {
1281 if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1282 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1283 }
1284 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1285 {
1286 if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1287 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1288 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1289 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1290 }
1291 return TRUE;
1292 }
1293
1294 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1295 PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1296 DWORD *pdwFlags)
1297 {
1298 PCCERT_CONTEXT ret;
1299
1300 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1301 pPrevIssuerContext, *pdwFlags);
1302
1303 if (!pSubjectContext)
1304 {
1305 SetLastError(E_INVALIDARG);
1306 return NULL;
1307 }
1308
1309 ret = CertFindCertificateInStore(hCertStore,
1310 pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1311 pSubjectContext, pPrevIssuerContext);
1312 if (ret)
1313 {
1314 if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1315 pdwFlags))
1316 {
1317 CertFreeCertificateContext(ret);
1318 ret = NULL;
1319 }
1320 }
1321 TRACE("returning %p\n", ret);
1322 return ret;
1323 }
1324
1325 typedef struct _OLD_CERT_REVOCATION_STATUS {
1326 DWORD cbSize;
1327 DWORD dwIndex;
1328 DWORD dwError;
1329 DWORD dwReason;
1330 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1331
1332 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1333 void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1334
1335 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1336 DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1337 PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1338 {
1339 BOOL ret;
1340
1341 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1342 cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1343
1344 if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1345 pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1346 {
1347 SetLastError(E_INVALIDARG);
1348 return FALSE;
1349 }
1350 if (cContext)
1351 {
1352 static HCRYPTOIDFUNCSET set = NULL;
1353 DWORD size;
1354
1355 if (!set)
1356 set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1357 ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1358 if (ret)
1359 {
1360 if (size == 1)
1361 {
1362 /* empty list */
1363 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1364 ret = FALSE;
1365 }
1366 else
1367 {
1368 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1369
1370 if (dllList)
1371 {
1372 ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1373 dllList, &size);
1374 if (ret)
1375 {
1376 for (ptr = dllList; ret && *ptr;
1377 ptr += lstrlenW(ptr) + 1)
1378 {
1379 CertVerifyRevocationFunc func;
1380 HCRYPTOIDFUNCADDR hFunc;
1381
1382 ret = CryptGetDefaultOIDFunctionAddress(set,
1383 dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1384 if (ret)
1385 {
1386 ret = func(dwEncodingType, dwRevType, cContext,
1387 rgpvContext, dwFlags, pRevPara, pRevStatus);
1388 CryptFreeOIDFunctionAddress(hFunc, 0);
1389 }
1390 }
1391 }
1392 CryptMemFree(dllList);
1393 }
1394 else
1395 {
1396 SetLastError(ERROR_OUTOFMEMORY);
1397 ret = FALSE;
1398 }
1399 }
1400 }
1401 }
1402 else
1403 ret = TRUE;
1404 return ret;
1405 }
1406
1407 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1408 CRYPT_ATTRIBUTE rgAttr[])
1409 {
1410 PCRYPT_ATTRIBUTE ret = NULL;
1411 DWORD i;
1412
1413 TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1414
1415 if (!cAttr)
1416 return NULL;
1417 if (!pszObjId)
1418 {
1419 SetLastError(ERROR_INVALID_PARAMETER);
1420 return NULL;
1421 }
1422
1423 for (i = 0; !ret && i < cAttr; i++)
1424 if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1425 ret = &rgAttr[i];
1426 return ret;
1427 }
1428
1429 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1430 CERT_EXTENSION rgExtensions[])
1431 {
1432 PCERT_EXTENSION ret = NULL;
1433 DWORD i;
1434
1435 TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1436
1437 if (!cExtensions)
1438 return NULL;
1439 if (!pszObjId)
1440 {
1441 SetLastError(ERROR_INVALID_PARAMETER);
1442 return NULL;
1443 }
1444
1445 for (i = 0; !ret && i < cExtensions; i++)
1446 if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1447 rgExtensions[i].pszObjId))
1448 ret = &rgExtensions[i];
1449 return ret;
1450 }
1451
1452 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1453 {
1454 PCERT_RDN_ATTR ret = NULL;
1455 DWORD i, j;
1456
1457 TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1458
1459 if (!pszObjId)
1460 {
1461 SetLastError(ERROR_INVALID_PARAMETER);
1462 return NULL;
1463 }
1464
1465 for (i = 0; !ret && i < pName->cRDN; i++)
1466 for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1467 if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1468 pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1469 ret = &pName->rgRDN[i].rgRDNAttr[j];
1470 return ret;
1471 }
1472
1473 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1474 PCERT_INFO pCertInfo)
1475 {
1476 FILETIME fileTime;
1477 LONG ret;
1478
1479 if (!pTimeToVerify)
1480 {
1481 GetSystemTimeAsFileTime(&fileTime);
1482 pTimeToVerify = &fileTime;
1483 }
1484 if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1485 {
1486 ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1487 if (ret < 0)
1488 ret = 0;
1489 }
1490 return ret;
1491 }
1492
1493 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1494 PCERT_INFO pIssuerInfo)
1495 {
1496 TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1497
1498 return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1499 && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1500 }
1501
1502 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1503 DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1504 DWORD *pcbComputedHash)
1505 {
1506 BOOL ret = TRUE;
1507 HCRYPTHASH hHash = 0;
1508
1509 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1510 pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1511
1512 if (!hCryptProv)
1513 hCryptProv = CRYPT_GetDefaultProvider();
1514 if (!Algid)
1515 Algid = CALG_SHA1;
1516 if (ret)
1517 {
1518 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1519 if (ret)
1520 {
1521 ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1522 if (ret)
1523 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1524 pcbComputedHash, 0);
1525 CryptDestroyHash(hHash);
1526 }
1527 }
1528 return ret;
1529 }
1530
1531 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1532 DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1533 BYTE *pbComputedHash, DWORD *pcbComputedHash)
1534 {
1535 BOOL ret = TRUE;
1536 HCRYPTHASH hHash = 0;
1537
1538 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1539 dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1540
1541 if (!hCryptProv)
1542 hCryptProv = CRYPT_GetDefaultProvider();
1543 if (!Algid)
1544 Algid = CALG_MD5;
1545 if (ret)
1546 {
1547 BYTE *buf;
1548 DWORD size = 0;
1549
1550 ret = CryptEncodeObjectEx(dwCertEncodingType, X509_PUBLIC_KEY_INFO,
1551 pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
1552 if (ret)
1553 {
1554 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1555 if (ret)
1556 {
1557 ret = CryptHashData(hHash, buf, size, 0);
1558 if (ret)
1559 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1560 pcbComputedHash, 0);
1561 CryptDestroyHash(hHash);
1562 }
1563 LocalFree(buf);
1564 }
1565 }
1566 return ret;
1567 }
1568
1569 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
1570 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1571 BYTE *pbComputedHash, DWORD *pcbComputedHash)
1572 {
1573 BOOL ret;
1574 CERT_SIGNED_CONTENT_INFO *info;
1575 DWORD size;
1576
1577 TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
1578 pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
1579
1580 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1581 pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, (void *)&info, &size);
1582 if (ret)
1583 {
1584 PCCRYPT_OID_INFO oidInfo;
1585 HCRYPTHASH hHash;
1586
1587 if (!hCryptProv)
1588 hCryptProv = CRYPT_GetDefaultProvider();
1589 oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1590 info->SignatureAlgorithm.pszObjId, 0);
1591 if (!oidInfo)
1592 {
1593 SetLastError(NTE_BAD_ALGID);
1594 ret = FALSE;
1595 }
1596 else
1597 {
1598 ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
1599 if (ret)
1600 {
1601 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
1602 info->ToBeSigned.cbData, 0);
1603 if (ret)
1604 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1605 pcbComputedHash, 0);
1606 CryptDestroyHash(hHash);
1607 }
1608 }
1609 LocalFree(info);
1610 }
1611 return ret;
1612 }
1613
1614 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1615 DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
1616 DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1617 const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
1618 {
1619 BOOL ret;
1620 PCCRYPT_OID_INFO info;
1621 HCRYPTHASH hHash;
1622
1623 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
1624 dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
1625 pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
1626
1627 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1628 pSignatureAlgorithm->pszObjId, 0);
1629 if (!info)
1630 {
1631 SetLastError(NTE_BAD_ALGID);
1632 return FALSE;
1633 }
1634 if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
1635 {
1636 if (!hCryptProv)
1637 hCryptProv = CRYPT_GetDefaultProvider();
1638 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1639 if (ret)
1640 {
1641 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1642 cbEncodedToBeSigned, 0);
1643 if (ret)
1644 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
1645 pcbSignature, 0);
1646 CryptDestroyHash(hHash);
1647 }
1648 }
1649 else
1650 {
1651 if (!hCryptProv)
1652 {
1653 SetLastError(ERROR_INVALID_PARAMETER);
1654 ret = FALSE;
1655 }
1656 else
1657 {
1658 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1659 if (ret)
1660 {
1661 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1662 cbEncodedToBeSigned, 0);
1663 if (ret)
1664 ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
1665 pcbSignature);
1666 CryptDestroyHash(hHash);
1667 }
1668 }
1669 }
1670 return ret;
1671 }
1672
1673 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1674 DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
1675 const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1676 const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
1677 {
1678 BOOL ret;
1679 DWORD encodedSize, hashSize;
1680
1681 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
1682 dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
1683 pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
1684
1685 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
1686 NULL, &encodedSize);
1687 if (ret)
1688 {
1689 PBYTE encoded = CryptMemAlloc(encodedSize);
1690
1691 if (encoded)
1692 {
1693 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
1694 pvStructInfo, encoded, &encodedSize);
1695 if (ret)
1696 {
1697 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1698 dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
1699 pvHashAuxInfo, NULL, &hashSize);
1700 if (ret)
1701 {
1702 PBYTE hash = CryptMemAlloc(hashSize);
1703
1704 if (hash)
1705 {
1706 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1707 dwCertEncodingType, encoded, encodedSize,
1708 pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
1709 if (ret)
1710 {
1711 CERT_SIGNED_CONTENT_INFO info = { { 0 } };
1712
1713 info.ToBeSigned.cbData = encodedSize;
1714 info.ToBeSigned.pbData = encoded;
1715 memcpy(&info.SignatureAlgorithm,
1716 pSignatureAlgorithm,
1717 sizeof(info.SignatureAlgorithm));
1718 info.Signature.cbData = hashSize;
1719 info.Signature.pbData = hash;
1720 info.Signature.cUnusedBits = 0;
1721 ret = CryptEncodeObject(dwCertEncodingType,
1722 X509_CERT, &info, pbEncoded, pcbEncoded);
1723 }
1724 CryptMemFree(hash);
1725 }
1726 }
1727 }
1728 CryptMemFree(encoded);
1729 }
1730 }
1731 return ret;
1732 }
1733
1734 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
1735 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1736 PCERT_PUBLIC_KEY_INFO pPublicKey)
1737 {
1738 return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
1739 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
1740 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
1741 }
1742
1743 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
1744 DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
1745 const CERT_SIGNED_CONTENT_INFO *signedCert)
1746 {
1747 BOOL ret;
1748 HCRYPTKEY key;
1749 PCCRYPT_OID_INFO info;
1750 ALG_ID pubKeyID, hashID;
1751
1752 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1753 signedCert->SignatureAlgorithm.pszObjId, 0);
1754 if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
1755 {
1756 SetLastError(NTE_BAD_ALGID);
1757 return FALSE;
1758 }
1759 hashID = info->u.Algid;
1760 if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
1761 pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
1762 else
1763 pubKeyID = hashID;
1764 /* Load the default provider if necessary */
1765 if (!hCryptProv)
1766 hCryptProv = CRYPT_GetDefaultProvider();
1767 ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
1768 pubKeyInfo, pubKeyID, 0, NULL, &key);
1769 if (ret)
1770 {
1771 HCRYPTHASH hash;
1772
1773 ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
1774 if (ret)
1775 {
1776 ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
1777 signedCert->ToBeSigned.cbData, 0);
1778 if (ret)
1779 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
1780 signedCert->Signature.cbData, key, NULL, 0);
1781 CryptDestroyHash(hash);
1782 }
1783 CryptDestroyKey(key);
1784 }
1785 return ret;
1786 }
1787
1788 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
1789 DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
1790 DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
1791 {
1792 BOOL ret = TRUE;
1793 CRYPT_DATA_BLOB subjectBlob;
1794
1795 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
1796 dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
1797 dwFlags, pvReserved);
1798
1799 switch (dwSubjectType)
1800 {
1801 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
1802 {
1803 PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvSubject;
1804
1805 subjectBlob.pbData = blob->pbData;
1806 subjectBlob.cbData = blob->cbData;
1807 break;
1808 }
1809 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
1810 {
1811 PCERT_CONTEXT context = (PCERT_CONTEXT)pvSubject;
1812
1813 subjectBlob.pbData = context->pbCertEncoded;
1814 subjectBlob.cbData = context->cbCertEncoded;
1815 break;
1816 }
1817 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
1818 {
1819 PCRL_CONTEXT context = (PCRL_CONTEXT)pvSubject;
1820
1821 subjectBlob.pbData = context->pbCrlEncoded;
1822 subjectBlob.cbData = context->cbCrlEncoded;
1823 break;
1824 }
1825 default:
1826 SetLastError(E_INVALIDARG);
1827 ret = FALSE;
1828 }
1829
1830 if (ret)
1831 {
1832 PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
1833 DWORD size = 0;
1834
1835 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1836 subjectBlob.pbData, subjectBlob.cbData,
1837 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1838 (BYTE *)&signedCert, &size);
1839 if (ret)
1840 {
1841 switch (dwIssuerType)
1842 {
1843 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
1844 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1845 dwCertEncodingType, (PCERT_PUBLIC_KEY_INFO)pvIssuer,
1846 signedCert);
1847 break;
1848 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
1849 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1850 dwCertEncodingType,
1851 &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
1852 signedCert);
1853 break;
1854 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
1855 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
1856 ret = FALSE;
1857 break;
1858 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
1859 if (pvIssuer)
1860 {
1861 SetLastError(E_INVALIDARG);
1862 ret = FALSE;
1863 }
1864 else
1865 {
1866 FIXME("unimplemented for NULL signer\n");
1867 SetLastError(E_INVALIDARG);
1868 ret = FALSE;
1869 }
1870 break;
1871 default:
1872 SetLastError(E_INVALIDARG);
1873 ret = FALSE;
1874 }
1875 LocalFree(signedCert);
1876 }
1877 }
1878 return ret;
1879 }
1880
1881 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
1882 PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
1883 {
1884 PCERT_ENHKEY_USAGE usage = NULL;
1885 DWORD bytesNeeded;
1886 BOOL ret = TRUE;
1887
1888 if (!pCertContext || !pcbUsage)
1889 {
1890 SetLastError(ERROR_INVALID_PARAMETER);
1891 return FALSE;
1892 }
1893
1894 TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
1895
1896 if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
1897 {
1898 DWORD propSize = 0;
1899
1900 if (CertGetCertificateContextProperty(pCertContext,
1901 CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
1902 {
1903 LPBYTE buf = CryptMemAlloc(propSize);
1904
1905 if (buf)
1906 {
1907 if (CertGetCertificateContextProperty(pCertContext,
1908 CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
1909 {
1910 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1911 X509_ENHANCED_KEY_USAGE, buf, propSize,
1912 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1913 }
1914 CryptMemFree(buf);
1915 }
1916 }
1917 }
1918 if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
1919 {
1920 PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
1921 pCertContext->pCertInfo->cExtension,
1922 pCertContext->pCertInfo->rgExtension);
1923
1924 if (ext)
1925 {
1926 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1927 X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
1928 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1929 }
1930 }
1931 if (!usage)
1932 {
1933 /* If a particular location is specified, this should fail. Otherwise
1934 * it should succeed with an empty usage. (This is true on Win2k and
1935 * later, which we emulate.)
1936 */
1937 if (dwFlags)
1938 {
1939 SetLastError(CRYPT_E_NOT_FOUND);
1940 ret = FALSE;
1941 }
1942 else
1943 bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
1944 }
1945
1946 if (ret)
1947 {
1948 if (!pUsage)
1949 *pcbUsage = bytesNeeded;
1950 else if (*pcbUsage < bytesNeeded)
1951 {
1952 SetLastError(ERROR_MORE_DATA);
1953 *pcbUsage = bytesNeeded;
1954 ret = FALSE;
1955 }
1956 else
1957 {
1958 *pcbUsage = bytesNeeded;
1959 if (usage)
1960 {
1961 DWORD i;
1962 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
1963 sizeof(CERT_ENHKEY_USAGE) +
1964 usage->cUsageIdentifier * sizeof(LPSTR));
1965
1966 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
1967 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
1968 sizeof(CERT_ENHKEY_USAGE));
1969 for (i = 0; i < usage->cUsageIdentifier; i++)
1970 {
1971 pUsage->rgpszUsageIdentifier[i] = nextOID;
1972 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1973 nextOID += strlen(nextOID) + 1;
1974 }
1975 }
1976 else
1977 pUsage->cUsageIdentifier = 0;
1978 }
1979 }
1980 if (usage)
1981 LocalFree(usage);
1982 TRACE("returning %d\n", ret);
1983 return ret;
1984 }
1985
1986 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
1987 PCERT_ENHKEY_USAGE pUsage)
1988 {
1989 BOOL ret;
1990
1991 TRACE("(%p, %p)\n", pCertContext, pUsage);
1992
1993 if (pUsage)
1994 {
1995 CRYPT_DATA_BLOB blob = { 0, NULL };
1996
1997 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
1998 pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
1999 if (ret)
2000 {
2001 ret = CertSetCertificateContextProperty(pCertContext,
2002 CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2003 LocalFree(blob.pbData);
2004 }
2005 }
2006 else
2007 ret = CertSetCertificateContextProperty(pCertContext,
2008 CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2009 return ret;
2010 }
2011
2012 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2013 LPCSTR pszUsageIdentifier)
2014 {
2015 BOOL ret;
2016 DWORD size;
2017
2018 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2019
2020 if (CertGetEnhancedKeyUsage(pCertContext,
2021 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2022 {
2023 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2024
2025 if (usage)
2026 {
2027 ret = CertGetEnhancedKeyUsage(pCertContext,
2028 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2029 if (ret)
2030 {
2031 DWORD i;
2032 BOOL exists = FALSE;
2033
2034 /* Make sure usage doesn't already exist */
2035 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2036 {
2037 if (!strcmp(usage->rgpszUsageIdentifier[i],
2038 pszUsageIdentifier))
2039 exists = TRUE;
2040 }
2041 if (!exists)
2042 {
2043 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2044 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2045
2046 if (newUsage)
2047 {
2048 LPSTR nextOID;
2049
2050 newUsage->rgpszUsageIdentifier = (LPSTR *)
2051 ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2052 nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2053 + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2054 for (i = 0; i < usage->cUsageIdentifier; i++)
2055 {
2056 newUsage->rgpszUsageIdentifier[i] = nextOID;
2057 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2058 nextOID += strlen(nextOID) + 1;
2059 }
2060 newUsage->rgpszUsageIdentifier[i] = nextOID;
2061 strcpy(nextOID, pszUsageIdentifier);
2062 newUsage->cUsageIdentifier = i + 1;
2063 ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2064 CryptMemFree(newUsage);
2065 }
2066 else
2067 ret = FALSE;
2068 }
2069 }
2070 CryptMemFree(usage);
2071 }
2072 else
2073 ret = FALSE;
2074 }
2075 else
2076 {
2077 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2078 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2079
2080 if (usage)
2081 {
2082 usage->rgpszUsageIdentifier =
2083 (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2084 usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2085 sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2086 strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2087 usage->cUsageIdentifier = 1;
2088 ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2089 CryptMemFree(usage);
2090 }
2091 else
2092 ret = FALSE;
2093 }
2094 return ret;
2095 }
2096
2097 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2098 LPCSTR pszUsageIdentifier)
2099 {
2100 BOOL ret;
2101 DWORD size;
2102 CERT_ENHKEY_USAGE usage;
2103
2104 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2105
2106 size = sizeof(usage);
2107 ret = CertGetEnhancedKeyUsage(pCertContext,
2108 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2109 if (!ret && GetLastError() == ERROR_MORE_DATA)
2110 {
2111 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2112
2113 if (pUsage)
2114 {
2115 ret = CertGetEnhancedKeyUsage(pCertContext,
2116 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2117 if (ret)
2118 {
2119 if (pUsage->cUsageIdentifier)
2120 {
2121 DWORD i;
2122 BOOL found = FALSE;
2123
2124 for (i = 0; i < pUsage->cUsageIdentifier; i++)
2125 {
2126 if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2127 pszUsageIdentifier))
2128 found = TRUE;
2129 if (found && i < pUsage->cUsageIdentifier - 1)
2130 pUsage->rgpszUsageIdentifier[i] =
2131 pUsage->rgpszUsageIdentifier[i + 1];
2132 }
2133 pUsage->cUsageIdentifier--;
2134 /* Remove the usage if it's empty */
2135 if (pUsage->cUsageIdentifier)
2136 ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2137 else
2138 ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2139 }
2140 }
2141 CryptMemFree(pUsage);
2142 }
2143 else
2144 ret = FALSE;
2145 }
2146 else
2147 {
2148 /* it fit in an empty usage, therefore there's nothing to remove */
2149 ret = TRUE;
2150 }
2151 return ret;
2152 }
2153
2154 struct BitField
2155 {
2156 DWORD cIndexes;
2157 DWORD *indexes;
2158 };
2159
2160 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2161
2162 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2163 {
2164 DWORD indexIndex = bit / BITS_PER_DWORD;
2165
2166 if (indexIndex + 1 > field->cIndexes)
2167 {
2168 if (field->cIndexes)
2169 field->indexes = CryptMemRealloc(field->indexes,
2170 (indexIndex + 1) * sizeof(DWORD));
2171 else
2172 field->indexes = CryptMemAlloc(sizeof(DWORD));
2173 if (field->indexes)
2174 {
2175 field->indexes[indexIndex] = 0;
2176 field->cIndexes = indexIndex + 1;
2177 }
2178 }
2179 if (field->indexes)
2180 field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2181 }
2182
2183 static BOOL CRYPT_IsBitInFieldSet(struct BitField *field, DWORD bit)
2184 {
2185 BOOL set = FALSE;
2186 DWORD indexIndex = bit / BITS_PER_DWORD;
2187
2188 assert(field->cIndexes);
2189 set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2190 return set;
2191 }
2192
2193 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2194 int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2195 {
2196 BOOL ret = TRUE;
2197 DWORD i, cbOIDs = 0;
2198 BOOL allUsagesValid = TRUE;
2199 CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2200
2201 TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2202 rghOIDs, *pcbOIDs);
2203
2204 for (i = 0; i < cCerts; i++)
2205 {
2206 CERT_ENHKEY_USAGE usage;
2207 DWORD size = sizeof(usage);
2208
2209 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2210 /* Success is deliberately ignored: it implies all usages are valid */
2211 if (!ret && GetLastError() == ERROR_MORE_DATA)
2212 {
2213 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2214
2215 allUsagesValid = FALSE;
2216 if (pUsage)
2217 {
2218 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2219 if (ret)
2220 {
2221 if (!validUsages.cUsageIdentifier)
2222 {
2223 DWORD j;
2224
2225 cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2226 validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2227 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2228 cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2229 + 1;
2230 validUsages.rgpszUsageIdentifier =
2231 CryptMemAlloc(cbOIDs);
2232 if (validUsages.rgpszUsageIdentifier)
2233 {
2234 LPSTR nextOID = (LPSTR)
2235 ((LPBYTE)validUsages.rgpszUsageIdentifier +
2236 validUsages.cUsageIdentifier * sizeof(LPSTR));
2237
2238 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2239 {
2240 validUsages.rgpszUsageIdentifier[j] = nextOID;
2241 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2242 pUsage->rgpszUsageIdentifier[j]);
2243 nextOID += lstrlenA(nextOID) + 1;
2244 }
2245 }
2246 }
2247 else
2248 {
2249 struct BitField validIndexes = { 0, NULL };
2250 DWORD j, k, numRemoved = 0;
2251
2252 /* Merge: build a bitmap of all the indexes of
2253 * validUsages.rgpszUsageIdentifier that are in pUsage.
2254 */
2255 for (j = 0; j < pUsage->cUsageIdentifier; j++)
2256 {
2257 for (k = 0; k < validUsages.cUsageIdentifier; k++)
2258 {
2259 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2260 validUsages.rgpszUsageIdentifier[k]))
2261 {
2262 CRYPT_SetBitInField(&validIndexes, k);
2263 break;
2264 }
2265 }
2266 }
2267 /* Merge by removing from validUsages those that are
2268 * not in the bitmap.
2269 */
2270 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2271 {
2272 if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2273 {
2274 if (j < validUsages.cUsageIdentifier - 1)
2275 {
2276 memmove(&validUsages.rgpszUsageIdentifier[j],
2277 &validUsages.rgpszUsageIdentifier[j +
2278 numRemoved + 1],
2279 (validUsages.cUsageIdentifier - numRemoved
2280 - j - 1) * sizeof(LPSTR));
2281 cbOIDs -= lstrlenA(
2282 validUsages.rgpszUsageIdentifier[j]) + 1 +
2283 sizeof(LPSTR);
2284 validUsages.cUsageIdentifier--;
2285 numRemoved++;
2286 }
2287 else
2288 validUsages.cUsageIdentifier--;
2289 }
2290 }
2291 CryptMemFree(validIndexes.indexes);
2292 }
2293 }
2294 CryptMemFree(pUsage);
2295 }
2296 }
2297 }
2298 ret = TRUE;
2299 if (allUsagesValid)
2300 {
2301 *cNumOIDs = -1;
2302 *pcbOIDs = 0;
2303 }
2304 else
2305 {
2306 *cNumOIDs = validUsages.cUsageIdentifier;
2307 if (!rghOIDs)
2308 *pcbOIDs = cbOIDs;
2309 else if (*pcbOIDs < cbOIDs)
2310 {
2311 *pcbOIDs = cbOIDs;
2312 SetLastError(ERROR_MORE_DATA);
2313 ret = FALSE;
2314 }
2315 else
2316 {
2317 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2318 validUsages.cUsageIdentifier * sizeof(LPSTR));
2319
2320 *pcbOIDs = cbOIDs;
2321 for (i = 0; i < validUsages.cUsageIdentifier; i++)
2322 {
2323 rghOIDs[i] = nextOID;
2324 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2325 nextOID += lstrlenA(nextOID) + 1;
2326 }
2327 }
2328 }
2329 CryptMemFree(validUsages.rgpszUsageIdentifier);
2330 TRACE("cNumOIDs: %d\n", *cNumOIDs);
2331 TRACE("returning %d\n", ret);
2332 return ret;
2333 }
2334
2335 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2336 * pInfo is NULL, from the attributes of hProv.
2337 */
2338 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2339 const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2340 {
2341 CRYPT_KEY_PROV_INFO info = { 0 };
2342 BOOL ret;
2343
2344 if (!pInfo)
2345 {
2346 DWORD size;
2347 int len;
2348
2349 ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2350 if (ret)
2351 {
2352 LPSTR szContainer = CryptMemAlloc(size);
2353
2354 if (szContainer)
2355 {
2356 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2357 (BYTE *)szContainer, &size, 0);
2358 if (ret)
2359 {
2360 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2361 NULL, 0);
2362 if (len)
2363 {
2364 info.pwszContainerName = CryptMemAlloc(len *
2365 sizeof(WCHAR));
2366 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2367 info.pwszContainerName, len);
2368 }
2369 }
2370 CryptMemFree(szContainer);
2371 }
2372 }
2373 ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2374 if (ret)
2375 {
2376 LPSTR szProvider = CryptMemAlloc(size);
2377
2378 if (szProvider)
2379 {
2380 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2381 &size, 0);
2382 if (ret)
2383 {
2384 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2385 NULL, 0);
2386 if (len)
2387 {
2388 info.pwszProvName = CryptMemAlloc(len *
2389 sizeof(WCHAR));
2390 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2391 info.pwszProvName, len);
2392 }
2393 }
2394 CryptMemFree(szProvider);
2395 }
2396 }
2397 size = sizeof(info.dwKeySpec);
2398 /* in case no CRYPT_KEY_PROV_INFO given,
2399 * we always use AT_SIGNATURE key spec
2400 */
2401 info.dwKeySpec = AT_SIGNATURE;
2402 size = sizeof(info.dwProvType);
2403 ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2404 &size, 0);
2405 if (!ret)
2406 info.dwProvType = PROV_RSA_FULL;
2407 pInfo = &info;
2408 }
2409
2410 ret = CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2411 0, pInfo);
2412
2413 if (pInfo == &info)
2414 {
2415 CryptMemFree(info.pwszContainerName);
2416 CryptMemFree(info.pwszProvName);
2417 }
2418 }
2419
2420 /* Creates a signed certificate context from the unsigned, encoded certificate
2421 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2422 */
2423 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2424 HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2425 {
2426 PCCERT_CONTEXT context = NULL;
2427 BOOL ret;
2428 DWORD sigSize = 0;
2429
2430 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2431 blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2432 if (ret)
2433 {
2434 LPBYTE sig = CryptMemAlloc(sigSize);
2435
2436 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2437 blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2438 if (ret)
2439 {
2440 CERT_SIGNED_CONTENT_INFO signedInfo;
2441 BYTE *encodedSignedCert = NULL;
2442 DWORD encodedSignedCertSize = 0;
2443
2444 signedInfo.ToBeSigned.cbData = blob->cbData;
2445 signedInfo.ToBeSigned.pbData = blob->pbData;
2446 memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2447 sizeof(signedInfo.SignatureAlgorithm));
2448 signedInfo.Signature.cbData = sigSize;
2449 signedInfo.Signature.pbData = sig;
2450 signedInfo.Signature.cUnusedBits = 0;
2451 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2452 &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2453 (BYTE *)&encodedSignedCert, &encodedSignedCertSize);
2454 if (ret)
2455 {
2456 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2457 encodedSignedCert, encodedSignedCertSize);
2458 LocalFree(encodedSignedCert);
2459 }
2460 }
2461 CryptMemFree(sig);
2462 }
2463 return context;
2464 }
2465
2466 /* Copies data from the parameters into info, where:
2467 * pSerialNumber: The serial number. Must not be NULL.
2468 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2469 * Must not be NULL
2470 * pSignatureAlgorithm: Optional.
2471 * pStartTime: The starting time of the certificate. If NULL, the current
2472 * system time is used.
2473 * pEndTime: The ending time of the certificate. If NULL, one year past the
2474 * starting time is used.
2475 * pubKey: The public key of the certificate. Must not be NULL.
2476 * pExtensions: Extensions to be included with the certificate. Optional.
2477 */
2478 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2479 const CERT_NAME_BLOB *pSubjectIssuerBlob,
2480 const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2481 const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2482 const CERT_EXTENSIONS *pExtensions)
2483 {
2484 static CHAR oid[] = szOID_RSA_SHA1RSA;
2485
2486 assert(info);
2487 assert(pSerialNumber);
2488 assert(pSubjectIssuerBlob);
2489 assert(pubKey);
2490
2491 info->dwVersion = CERT_V3;
2492 info->SerialNumber.cbData = pSerialNumber->cbData;
2493 info->SerialNumber.pbData = pSerialNumber->pbData;
2494 if (pSignatureAlgorithm)
2495 memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2496 sizeof(info->SignatureAlgorithm));
2497 else
2498 {
2499 info->SignatureAlgorithm.pszObjId = oid;
2500 info->SignatureAlgorithm.Parameters.cbData = 0;
2501 info->SignatureAlgorithm.Parameters.pbData = NULL;
2502 }
2503 info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2504 info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2505 if (pStartTime)
2506 SystemTimeToFileTime(pStartTime, &info->NotBefore);
2507 else
2508 GetSystemTimeAsFileTime(&info->NotBefore);
2509 if (pEndTime)
2510 SystemTimeToFileTime(pEndTime, &info->NotAfter);
2511 else
2512 {
2513 SYSTEMTIME endTime;
2514
2515 if (FileTimeToSystemTime(&info->NotBefore, &endTime))
2516 {
2517 endTime.wYear++;
2518 SystemTimeToFileTime(&endTime, &info->NotAfter);
2519 }
2520 }
2521 info->Subject.cbData = pSubjectIssuerBlob->cbData;
2522 info->Subject.pbData = pSubjectIssuerBlob->pbData;
2523 memcpy(&info->SubjectPublicKeyInfo, pubKey,
2524 sizeof(info->SubjectPublicKeyInfo));
2525 if (pExtensions)
2526 {
2527 info->cExtension = pExtensions->cExtension;
2528 info->rgExtension = pExtensions->rgExtension;
2529 }
2530 else
2531 {
2532 info->cExtension = 0;
2533 info->rgExtension = NULL;
2534 }
2535 }
2536
2537 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
2538 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
2539 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
2540
2541 static HCRYPTPROV CRYPT_CreateKeyProv(void)
2542 {
2543 HCRYPTPROV hProv = 0;
2544 HMODULE rpcrt = LoadLibraryA("rpcrt4");
2545
2546 if (rpcrt)
2547 {
2548 UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
2549 "UuidCreate");
2550 UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
2551 "UuidToStringA");
2552 RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
2553 rpcrt, "RpcStringFreeA");
2554
2555 if (uuidCreate && uuidToString && rpcStringFree)
2556 {
2557 UUID uuid;
2558 RPC_STATUS status = uuidCreate(&uuid);
2559
2560 if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
2561 {
2562 unsigned char *uuidStr;
2563
2564 status = uuidToString(&uuid, &uuidStr);
2565 if (status == RPC_S_OK)
2566 {
2567 BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
2568 MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
2569
2570 if (ret)
2571 {
2572 HCRYPTKEY key;
2573
2574 ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
2575 if (ret)
2576 CryptDestroyKey(key);
2577 }
2578 rpcStringFree(&uuidStr);
2579 }
2580 }
2581 }
2582 FreeLibrary(rpcrt);
2583 }
2584 return hProv;
2585 }
2586
2587 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
2588 PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
2589 PCRYPT_KEY_PROV_INFO pKeyProvInfo,
2590 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
2591 PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
2592 {
2593 PCCERT_CONTEXT context = NULL;
2594 BOOL ret, releaseContext = FALSE;
2595 PCERT_PUBLIC_KEY_INFO pubKey = NULL;
2596 DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
2597
2598 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
2599 pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
2600 pExtensions, pExtensions);
2601
2602 if(!pSubjectIssuerBlob)
2603 {
2604 SetLastError(ERROR_INVALID_PARAMETER);
2605 return NULL;
2606 }
2607
2608 if (!hProv)
2609 {
2610 if (!pKeyProvInfo)
2611 {
2612 hProv = CRYPT_CreateKeyProv();
2613 releaseContext = TRUE;
2614 }
2615 else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
2616 {
2617 SetLastError(NTE_BAD_FLAGS);
2618 return NULL;
2619 }
2620 else
2621 {
2622 HCRYPTKEY hKey = 0;
2623 /* acquire the context using the given information*/
2624 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2625 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2626 pKeyProvInfo->dwFlags);
2627 if (!ret)
2628 {
2629 if(GetLastError() != NTE_BAD_KEYSET)
2630 return NULL;
2631 /* create the key set */
2632 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2633 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2634 pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
2635 if (!ret)
2636 return NULL;
2637 }
2638 dwKeySpec = pKeyProvInfo->dwKeySpec;
2639 /* check if the key is here */
2640 ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
2641 if(!ret)
2642 {
2643 if (NTE_NO_KEY == GetLastError())
2644 { /* generate the key */
2645 ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
2646 }
2647 if (!ret)
2648 {
2649 CryptReleaseContext(hProv,0);
2650 SetLastError(NTE_BAD_KEYSET);
2651 return NULL;
2652 }
2653 }
2654 CryptDestroyKey(hKey);
2655 releaseContext = TRUE;
2656 }
2657 }
2658 else if (pKeyProvInfo)
2659 {
2660 SetLastError(ERROR_INVALID_PARAMETER);
2661 return NULL;
2662 }
2663
2664 CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
2665 &pubKeySize);
2666 pubKey = CryptMemAlloc(pubKeySize);
2667 if (pubKey)
2668 {
2669 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
2670 pubKey, &pubKeySize);
2671 if (ret)
2672 {
2673 CERT_INFO info = { 0 };
2674 CRYPT_DER_BLOB blob = { 0, NULL };
2675 BYTE serial[16];
2676 CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
2677
2678 CryptGenRandom(hProv, sizeof(serial), serial);
2679 CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
2680 pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
2681 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
2682 &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&blob.pbData,
2683 &blob.cbData);
2684 if (ret)
2685 {
2686 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
2687 context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
2688 &info.SignatureAlgorithm);
2689 else
2690 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2691 blob.pbData, blob.cbData);
2692 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
2693 CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
2694 LocalFree(blob.pbData);
2695 }
2696 }
2697 CryptMemFree(pubKey);
2698 }
2699 if (releaseContext)
2700 CryptReleaseContext(hProv, 0);
2701 return context;
2702 }
2703
2704 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
2705 void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
2706 PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
2707 PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
2708 {
2709 FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
2710 dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
2711 pVerifyUsageStatus);
2712 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
2713 return FALSE;
2714 }
Maarten's multimedia branch