dlls/wintrust/softpub.c

   1 /*
   2  * Copyright 2007 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18 #include <stdarg.h>
  19
  20 #define NONAMELESSUNION
  21
  22 #include "windef.h"
  23 #include "winbase.h"
  24 #include "wintrust.h"
  25 #include "mssip.h"
  26 #include "softpub.h"
  27 #include "wine/debug.h"
  28
  29 WINE_DEFAULT_DEBUG_CHANNEL(wintrust);
  30
  31 HRESULT WINAPI SoftpubDefCertInit(CRYPT_PROVIDER_DATA *data)
  32 {
  33     HRESULT ret = S_FALSE;
  34
  35     TRACE("(%p)\n", data);
  36
  37     if (data->padwTrustStepErrors &&
  38      !data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_WVTINIT])
  39         ret = S_OK;
  40     TRACE("returning %08x\n", ret);
  41     return ret;
  42 }
  43
  44 HRESULT WINAPI SoftpubInitialize(CRYPT_PROVIDER_DATA *data)
  45 {
  46     HRESULT ret = S_FALSE;
  47
  48     TRACE("(%p)\n", data);
  49
  50     if (data->padwTrustStepErrors &&
  51      !data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_WVTINIT])
  52         ret = S_OK;
  53     TRACE("returning %08x\n", ret);
  54     return ret;
  55 }
  56
  57 /* Assumes data->pWintrustData->u.pFile exists.  Makes sure a file handle is
  58  * open for the file.
  59  */
  60 static BOOL SOFTPUB_OpenFile(CRYPT_PROVIDER_DATA *data)
  61 {
  62     BOOL ret = TRUE;
  63
  64     /* PSDK implies that all values should be initialized to NULL, so callers
  65      * typically have hFile as NULL rather than INVALID_HANDLE_VALUE.  Check
  66      * for both.
  67      */
  68     if (!data->pWintrustData->u.pFile->hFile ||
  69      data->pWintrustData->u.pFile->hFile == INVALID_HANDLE_VALUE)
  70     {
  71         data->pWintrustData->u.pFile->hFile =
  72             CreateFileW(data->pWintrustData->u.pFile->pcwszFilePath, GENERIC_READ,
  73           FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  74         if (data->pWintrustData->u.pFile->hFile != INVALID_HANDLE_VALUE)
  75             data->fOpenedFile = TRUE;
  76         else
  77             ret = FALSE;
  78     }
  79     if (ret)
  80         GetFileTime(data->pWintrustData->u.pFile->hFile, &data->sftSystemTime,
  81          NULL, NULL);
  82     TRACE("returning %d\n", ret);
  83     return ret;
  84 }
  85
  86 /* Assumes data->pWintrustData->u.pFile exists.  Sets data->pPDSip->gSubject to
  87  * the file's subject GUID.
  88  */
  89 static BOOL SOFTPUB_GetFileSubject(CRYPT_PROVIDER_DATA *data)
  90 {
  91     BOOL ret;
  92
  93     if (!data->pWintrustData->u.pFile->pgKnownSubject)
  94     {
  95         ret = CryptSIPRetrieveSubjectGuid(
  96          data->pWintrustData->u.pFile->pcwszFilePath,
  97          data->pWintrustData->u.pFile->hFile,
  98          &data->u.pPDSip->gSubject);
  99     }
 100     else
 101     {
 102         data->u.pPDSip->gSubject = *data->pWintrustData->u.pFile->pgKnownSubject;
 103         ret = TRUE;
 104     }
 105     TRACE("returning %d\n", ret);
 106     return ret;
 107 }
 108
 109 /* Assumes data->u.pPDSip exists, and its gSubject member set.
 110  * Allocates data->u.pPDSip->pSip and loads it, if possible.
 111  */
 112 static BOOL SOFTPUB_GetSIP(CRYPT_PROVIDER_DATA *data)
 113 {
 114     BOOL ret;
 115
 116     data->u.pPDSip->pSip = data->psPfns->pfnAlloc(sizeof(SIP_DISPATCH_INFO));
 117     if (data->u.pPDSip->pSip)
 118         ret = CryptSIPLoad(&data->u.pPDSip->gSubject, 0, data->u.pPDSip->pSip);
 119     else
 120     {
 121         SetLastError(ERROR_OUTOFMEMORY);
 122         ret = FALSE;
 123     }
 124     TRACE("returning %d\n", ret);
 125     return ret;
 126 }
 127
 128 /* Assumes data->u.pPDSip has been loaded, and data->u.pPDSip->pSip allocated.
 129  * Calls data->u.pPDSip->pSip->pfGet to construct data->hMsg.
 130  */
 131 static BOOL SOFTPUB_GetMessageFromFile(CRYPT_PROVIDER_DATA *data)
 132 {
 133     BOOL ret;
 134     LPBYTE buf = NULL;
 135     DWORD size = 0;
 136
 137     data->u.pPDSip->psSipSubjectInfo =
 138      data->psPfns->pfnAlloc(sizeof(SIP_SUBJECTINFO));
 139     if (!data->u.pPDSip->psSipSubjectInfo)
 140     {
 141         SetLastError(ERROR_OUTOFMEMORY);
 142         return FALSE;
 143     }
 144
 145     data->u.pPDSip->psSipSubjectInfo->cbSize = sizeof(SIP_SUBJECTINFO);
 146     data->u.pPDSip->psSipSubjectInfo->pgSubjectType = &data->u.pPDSip->gSubject;
 147     data->u.pPDSip->psSipSubjectInfo->hFile = data->pWintrustData->u.pFile->hFile;
 148     data->u.pPDSip->psSipSubjectInfo->pwsFileName =
 149      data->pWintrustData->u.pFile->pcwszFilePath;
 150     data->u.pPDSip->psSipSubjectInfo->hProv = data->hProv;
 151     ret = data->u.pPDSip->pSip->pfGet(data->u.pPDSip->psSipSubjectInfo,
 152      &data->dwEncoding, 0, &size, 0);
 153     if (!ret)
 154     {
 155         SetLastError(TRUST_E_NOSIGNATURE);
 156         return FALSE;
 157     }
 158
 159     buf = data->psPfns->pfnAlloc(size);
 160     if (!buf)
 161     {
 162         SetLastError(ERROR_OUTOFMEMORY);
 163         return FALSE;
 164     }
 165
 166     ret = data->u.pPDSip->pSip->pfGet(data->u.pPDSip->psSipSubjectInfo,
 167      &data->dwEncoding, 0, &size, buf);
 168     if (ret)
 169     {
 170         data->hMsg = CryptMsgOpenToDecode(data->dwEncoding, 0, 0, data->hProv,
 171          NULL, NULL);
 172         if (data->hMsg)
 173             ret = CryptMsgUpdate(data->hMsg, buf, size, TRUE);
 174     }
 175
 176     data->psPfns->pfnFree(buf);
 177     TRACE("returning %d\n", ret);
 178     return ret;
 179 }
 180
 181 static BOOL SOFTPUB_CreateStoreFromMessage(CRYPT_PROVIDER_DATA *data)
 182 {
 183     BOOL ret = FALSE;
 184     HCERTSTORE store;
 185
 186     store = CertOpenStore(CERT_STORE_PROV_MSG, data->dwEncoding,
 187      data->hProv, CERT_STORE_NO_CRYPT_RELEASE_FLAG, data->hMsg);
 188     if (store)
 189     {
 190         ret = data->psPfns->pfnAddStore2Chain(data, store);
 191         CertCloseStore(store, 0);
 192     }
 193     TRACE("returning %d\n", ret);
 194     return ret;
 195 }
 196
 197 static DWORD SOFTPUB_DecodeInnerContent(CRYPT_PROVIDER_DATA *data)
 198 {
 199     BOOL ret;
 200     DWORD size;
 201     LPSTR oid = NULL;
 202     LPBYTE buf = NULL;
 203
 204     ret = CryptMsgGetParam(data->hMsg, CMSG_INNER_CONTENT_TYPE_PARAM, 0, NULL,
 205      &size);
 206     if (!ret)
 207         goto error;
 208     oid = data->psPfns->pfnAlloc(size);
 209     if (!oid)
 210     {
 211         SetLastError(ERROR_OUTOFMEMORY);
 212         ret = FALSE;
 213         goto error;
 214     }
 215     ret = CryptMsgGetParam(data->hMsg, CMSG_INNER_CONTENT_TYPE_PARAM, 0, oid,
 216      &size);
 217     if (!ret)
 218         goto error;
 219     ret = CryptMsgGetParam(data->hMsg, CMSG_CONTENT_PARAM, 0, NULL, &size);
 220     if (!ret)
 221         goto error;
 222     buf = data->psPfns->pfnAlloc(size);
 223     if (!buf)
 224     {
 225         SetLastError(ERROR_OUTOFMEMORY);
 226         ret = FALSE;
 227         goto error;
 228     }
 229     ret = CryptMsgGetParam(data->hMsg, CMSG_CONTENT_PARAM, 0, buf, &size);
 230     if (!ret)
 231         goto error;
 232     ret = CryptDecodeObject(data->dwEncoding, oid, buf, size, 0, NULL, &size);
 233     if (!ret)
 234         goto error;
 235     data->u.pPDSip->psIndirectData = data->psPfns->pfnAlloc(size);
 236     if (!data->u.pPDSip->psIndirectData)
 237     {
 238         SetLastError(ERROR_OUTOFMEMORY);
 239         ret = FALSE;
 240         goto error;
 241     }
 242     ret = CryptDecodeObject(data->dwEncoding, oid, buf, size, 0,
 243      data->u.pPDSip->psIndirectData, &size);
 244
 245 error:
 246     TRACE("returning %d\n", ret);
 247     data->psPfns->pfnFree(oid);
 248     data->psPfns->pfnFree(buf);
 249     return ret;
 250 }
 251
 252 static BOOL SOFTPUB_LoadCertMessage(CRYPT_PROVIDER_DATA *data)
 253 {
 254     BOOL ret;
 255
 256     if (data->pWintrustData->u.pCert &&
 257      data->pWintrustData->u.pCert->cbStruct == sizeof(WINTRUST_CERT_INFO))
 258     {
 259         if (data->psPfns)
 260         {
 261             CRYPT_PROVIDER_SGNR signer = { sizeof(signer), { 0 } };
 262             DWORD i;
 263
 264             /* Add a signer with nothing but the time to verify, so we can
 265              * add a cert to it
 266              */
 267             if (data->pWintrustData->u.pCert->psftVerifyAsOf)
 268                 data->sftSystemTime = signer.sftVerifyAsOf;
 269             else
 270             {
 271                 SYSTEMTIME sysTime;
 272
 273                 GetSystemTime(&sysTime);
 274                 SystemTimeToFileTime(&sysTime, &signer.sftVerifyAsOf);
 275             }
 276             ret = data->psPfns->pfnAddSgnr2Chain(data, FALSE, 0, &signer);
 277             if (ret)
 278             {
 279                 ret = data->psPfns->pfnAddCert2Chain(data, 0, FALSE, 0,
 280                  data->pWintrustData->u.pCert->psCertContext);
 281                 for (i = 0; ret && i < data->pWintrustData->u.pCert->chStores;
 282                  i++)
 283                     ret = data->psPfns->pfnAddStore2Chain(data,
 284                      data->pWintrustData->u.pCert->pahStores[i]);
 285             }
 286         }
 287         else
 288         {
 289             /* Do nothing!?  See the tests */
 290             ret = TRUE;
 291         }
 292     }
 293     else
 294     {
 295         SetLastError(ERROR_INVALID_PARAMETER);
 296         ret = FALSE;
 297     }
 298     return ret;
 299 }
 300
 301 HRESULT WINAPI SoftpubLoadMessage(CRYPT_PROVIDER_DATA *data)
 302 {
 303     BOOL ret;
 304
 305     TRACE("(%p)\n", data);
 306
 307     if (!data->padwTrustStepErrors)
 308         return S_FALSE;
 309
 310     switch (data->pWintrustData->dwUnionChoice)
 311     {
 312     case WTD_CHOICE_CERT:
 313         ret = SOFTPUB_LoadCertMessage(data);
 314         break;
 315     case WTD_CHOICE_FILE:
 316         if (!data->pWintrustData->u.pFile)
 317         {
 318             SetLastError(ERROR_INVALID_PARAMETER);
 319             ret = FALSE;
 320             goto error;
 321         }
 322         ret = SOFTPUB_OpenFile(data);
 323         if (!ret)
 324             goto error;
 325         ret = SOFTPUB_GetFileSubject(data);
 326         if (!ret)
 327             goto error;
 328         ret = SOFTPUB_GetSIP(data);
 329         if (!ret)
 330             goto error;
 331         ret = SOFTPUB_GetMessageFromFile(data);
 332         if (!ret)
 333             goto error;
 334         ret = SOFTPUB_CreateStoreFromMessage(data);
 335         if (!ret)
 336             goto error;
 337         ret = SOFTPUB_DecodeInnerContent(data);
 338         break;
 339     default:
 340         FIXME("unimplemented for %d\n", data->pWintrustData->dwUnionChoice);
 341         SetLastError(ERROR_INVALID_PARAMETER);
 342         ret = FALSE;
 343     }
 344
 345 error:
 346     if (!ret)
 347         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_OBJPROV] =
 348          GetLastError();
 349     TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
 350      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_OBJPROV]);
 351     return ret ? S_OK : S_FALSE;
 352 }
 353
 354 static CMSG_SIGNER_INFO *WINTRUST_GetSigner(CRYPT_PROVIDER_DATA *data,
 355  DWORD signerIdx)
 356 {
 357     BOOL ret;
 358     CMSG_SIGNER_INFO *signerInfo = NULL;
 359     DWORD size;
 360
 361     ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_INFO_PARAM, signerIdx,
 362      NULL, &size);
 363     if (ret)
 364     {
 365         signerInfo = data->psPfns->pfnAlloc(size);
 366         if (signerInfo)
 367         {
 368             ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_INFO_PARAM,
 369              signerIdx, signerInfo, &size);
 370             if (!ret)
 371             {
 372                 data->psPfns->pfnFree(signerInfo);
 373                 signerInfo = NULL;
 374             }
 375         }
 376         else
 377             SetLastError(ERROR_OUTOFMEMORY);
 378     }
 379     return signerInfo;
 380 }
 381
 382 static BOOL WINTRUST_SaveSigner(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
 383 {
 384     BOOL ret;
 385     CMSG_SIGNER_INFO *signerInfo = WINTRUST_GetSigner(data, signerIdx);
 386
 387     if (signerInfo)
 388     {
 389         CRYPT_PROVIDER_SGNR sgnr = { sizeof(sgnr), { 0 } };
 390
 391         sgnr.psSigner = signerInfo;
 392         sgnr.sftVerifyAsOf = data->sftSystemTime;
 393         ret = data->psPfns->pfnAddSgnr2Chain(data, FALSE, signerIdx, &sgnr);
 394     }
 395     else
 396         ret = FALSE;
 397     return ret;
 398 }
 399
 400 static CERT_INFO *WINTRUST_GetSignerCertInfo(CRYPT_PROVIDER_DATA *data,
 401  DWORD signerIdx)
 402 {
 403     BOOL ret;
 404     CERT_INFO *certInfo = NULL;
 405     DWORD size;
 406
 407     ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_CERT_INFO_PARAM, signerIdx,
 408      NULL, &size);
 409     if (ret)
 410     {
 411         certInfo = data->psPfns->pfnAlloc(size);
 412         if (certInfo)
 413         {
 414             ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_CERT_INFO_PARAM,
 415              signerIdx, certInfo, &size);
 416             if (!ret)
 417             {
 418                 data->psPfns->pfnFree(certInfo);
 419                 certInfo = NULL;
 420             }
 421         }
 422         else
 423             SetLastError(ERROR_OUTOFMEMORY);
 424     }
 425     return certInfo;
 426 }
 427
 428 static BOOL WINTRUST_VerifySigner(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
 429 {
 430     BOOL ret;
 431     CERT_INFO *certInfo = WINTRUST_GetSignerCertInfo(data, signerIdx);
 432
 433     if (certInfo)
 434     {
 435         PCCERT_CONTEXT subject = CertGetSubjectCertificateFromStore(
 436          data->pahStores[0], data->dwEncoding, certInfo);
 437
 438         if (subject)
 439         {
 440             CMSG_CTRL_VERIFY_SIGNATURE_EX_PARA para = { sizeof(para), 0,
 441              signerIdx, CMSG_VERIFY_SIGNER_CERT, (LPVOID)subject };
 442
 443             ret = CryptMsgControl(data->hMsg, 0, CMSG_CTRL_VERIFY_SIGNATURE_EX,
 444              &para);
 445             if (!ret)
 446                 SetLastError(TRUST_E_CERT_SIGNATURE);
 447             else
 448                 data->psPfns->pfnAddCert2Chain(data, signerIdx, FALSE, 0,
 449                  subject);
 450             CertFreeCertificateContext(subject);
 451         }
 452         else
 453         {
 454             SetLastError(TRUST_E_NO_SIGNER_CERT);
 455             ret = FALSE;
 456         }
 457         data->psPfns->pfnFree(certInfo);
 458     }
 459     else
 460         ret = FALSE;
 461     return ret;
 462 }
 463
 464 HRESULT WINAPI SoftpubLoadSignature(CRYPT_PROVIDER_DATA *data)
 465 {
 466     BOOL ret;
 467
 468     TRACE("(%p)\n", data);
 469
 470     if (!data->padwTrustStepErrors)
 471         return S_FALSE;
 472
 473     if (data->hMsg)
 474     {
 475         DWORD signerCount, size;
 476
 477         size = sizeof(signerCount);
 478         ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_COUNT_PARAM, 0,
 479          &signerCount, &size);
 480         if (ret)
 481         {
 482             DWORD i;
 483
 484             for (i = 0; ret && i < signerCount; i++)
 485             {
 486                 if ((ret = WINTRUST_SaveSigner(data, i)))
 487                     ret = WINTRUST_VerifySigner(data, i);
 488             }
 489         }
 490         else
 491             SetLastError(TRUST_E_NOSIGNATURE);
 492     }
 493     else
 494         ret = TRUE;
 495     if (!ret)
 496         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_SIGPROV] =
 497          GetLastError();
 498     return ret ? S_OK : S_FALSE;
 499 }
 500
 501 static DWORD WINTRUST_TrustStatusToConfidence(DWORD errorStatus)
 502 {
 503     DWORD confidence = 0;
 504
 505     confidence = 0;
 506     if (!(errorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID))
 507         confidence |= CERT_CONFIDENCE_SIG;
 508     if (!(errorStatus & CERT_TRUST_IS_NOT_TIME_VALID))
 509         confidence |= CERT_CONFIDENCE_TIME;
 510     if (!(errorStatus & CERT_TRUST_IS_NOT_TIME_NESTED))
 511         confidence |= CERT_CONFIDENCE_TIMENEST;
 512     return confidence;
 513 }
 514
 515 BOOL WINAPI SoftpubCheckCert(CRYPT_PROVIDER_DATA *data, DWORD idxSigner,
 516  BOOL fCounterSignerChain, DWORD idxCounterSigner)
 517 {
 518     BOOL ret;
 519
 520     TRACE("(%p, %d, %d, %d)\n", data, idxSigner, fCounterSignerChain,
 521      idxCounterSigner);
 522
 523     if (fCounterSignerChain)
 524     {
 525         FIXME("unimplemented for counter signers\n");
 526         ret = FALSE;
 527     }
 528     else
 529     {
 530         PCERT_SIMPLE_CHAIN simpleChain =
 531          data->pasSigners[idxSigner].pChainContext->rgpChain[0];
 532         DWORD i;
 533
 534         ret = TRUE;
 535         for (i = 0; i < simpleChain->cElement; i++)
 536         {
 537             /* Set confidence */
 538             data->pasSigners[idxSigner].pasCertChain[i].dwConfidence =
 539              WINTRUST_TrustStatusToConfidence(
 540              simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus);
 541             /* Set additional flags */
 542             if (!(simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
 543              CERT_TRUST_IS_UNTRUSTED_ROOT))
 544                 data->pasSigners[idxSigner].pasCertChain[i].fTrustedRoot = TRUE;
 545             if (simpleChain->rgpElement[i]->TrustStatus.dwInfoStatus &
 546              CERT_TRUST_IS_SELF_SIGNED)
 547                 data->pasSigners[idxSigner].pasCertChain[i].fSelfSigned = TRUE;
 548             if (simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
 549              CERT_TRUST_IS_CYCLIC)
 550                 data->pasSigners[idxSigner].pasCertChain[i].fIsCyclic = TRUE;
 551         }
 552     }
 553     return ret;
 554 }
 555
 556 static DWORD WINTRUST_TrustStatusToError(DWORD errorStatus)
 557 {
 558     DWORD error;
 559
 560     if (errorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
 561         error = TRUST_E_CERT_SIGNATURE;
 562     else if (errorStatus & CERT_TRUST_IS_UNTRUSTED_ROOT)
 563         error = CERT_E_UNTRUSTEDROOT;
 564     else if (errorStatus & CERT_TRUST_IS_NOT_TIME_VALID)
 565         error = CERT_E_EXPIRED;
 566     else if (errorStatus & CERT_TRUST_IS_NOT_TIME_NESTED)
 567         error = CERT_E_VALIDITYPERIODNESTING;
 568     else if (errorStatus & CERT_TRUST_IS_REVOKED)
 569         error = CERT_E_REVOKED;
 570     else if (errorStatus & CERT_TRUST_IS_OFFLINE_REVOCATION ||
 571      errorStatus & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
 572         error = CERT_E_REVOCATION_FAILURE;
 573     else if (errorStatus & CERT_TRUST_IS_NOT_VALID_FOR_USAGE)
 574         error = CERT_E_WRONG_USAGE;
 575     else if (errorStatus & CERT_TRUST_IS_CYCLIC)
 576         error = CERT_E_CHAINING;
 577     else if (errorStatus & CERT_TRUST_INVALID_EXTENSION)
 578         error = CERT_E_CRITICAL;
 579     else if (errorStatus & CERT_TRUST_INVALID_POLICY_CONSTRAINTS)
 580         error = CERT_E_INVALID_POLICY;
 581     else if (errorStatus & CERT_TRUST_INVALID_BASIC_CONSTRAINTS)
 582         error = TRUST_E_BASIC_CONSTRAINTS;
 583     else if (errorStatus & CERT_TRUST_INVALID_NAME_CONSTRAINTS ||
 584      errorStatus & CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT ||
 585      errorStatus & CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT ||
 586      errorStatus & CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT ||
 587      errorStatus & CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT)
 588         error = CERT_E_INVALID_NAME;
 589     else if (errorStatus & CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY)
 590         error = CERT_E_INVALID_POLICY;
 591     else if (errorStatus)
 592     {
 593         FIXME("unknown error status %08x\n", errorStatus);
 594         error = TRUST_E_SYSTEM_ERROR;
 595     }
 596     else
 597         error = S_OK;
 598     return error;
 599 }
 600
 601 static BOOL WINTRUST_CopyChain(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
 602 {
 603     BOOL ret;
 604     PCERT_SIMPLE_CHAIN simpleChain =
 605      data->pasSigners[signerIdx].pChainContext->rgpChain[0];
 606     DWORD i;
 607
 608     data->pasSigners[signerIdx].pasCertChain[0].dwConfidence =
 609      WINTRUST_TrustStatusToConfidence(
 610      simpleChain->rgpElement[0]->TrustStatus.dwErrorStatus);
 611     data->pasSigners[signerIdx].pasCertChain[0].pChainElement =
 612      simpleChain->rgpElement[0];
 613     ret = TRUE;
 614     for (i = 1; ret && i < simpleChain->cElement; i++)
 615     {
 616         ret = data->psPfns->pfnAddCert2Chain(data, signerIdx, FALSE, 0,
 617          simpleChain->rgpElement[i]->pCertContext);
 618         if (ret)
 619         {
 620             data->pasSigners[signerIdx].pasCertChain[i].pChainElement =
 621              simpleChain->rgpElement[i];
 622             data->pasSigners[signerIdx].pasCertChain[i].dwConfidence =
 623              WINTRUST_TrustStatusToConfidence(
 624              simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus);
 625         }
 626     }
 627     data->pasSigners[signerIdx].pasCertChain[simpleChain->cElement - 1].dwError
 628      = WINTRUST_TrustStatusToError(
 629      simpleChain->rgpElement[simpleChain->cElement - 1]->
 630      TrustStatus.dwErrorStatus);
 631     return ret;
 632 }
 633
 634 static void WINTRUST_CreateChainPolicyCreateInfo(
 635  const CRYPT_PROVIDER_DATA *data, PWTD_GENERIC_CHAIN_POLICY_CREATE_INFO info,
 636  PCERT_CHAIN_PARA chainPara)
 637 {
 638     chainPara->cbSize = sizeof(CERT_CHAIN_PARA);
 639     if (data->pRequestUsage)
 640         chainPara->RequestedUsage = *data->pRequestUsage;
 641     else
 642     {
 643         chainPara->RequestedUsage.dwType = 0;
 644         chainPara->RequestedUsage.Usage.cUsageIdentifier = 0;
 645     }
 646     info->u.cbSize = sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO);
 647     info->hChainEngine = NULL;
 648     info->pChainPara = chainPara;
 649     if (data->dwProvFlags & CPD_REVOCATION_CHECK_END_CERT)
 650         info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_END_CERT;
 651     else if (data->dwProvFlags & CPD_REVOCATION_CHECK_CHAIN)
 652         info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN;
 653     else if (data->dwProvFlags & CPD_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT)
 654         info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT;
 655     else
 656         info->dwFlags = 0;
 657     info->pvReserved = NULL;
 658 }
 659
 660 static BOOL WINTRUST_CreateChainForSigner(CRYPT_PROVIDER_DATA *data,
 661  DWORD signer, PWTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo,
 662  PCERT_CHAIN_PARA chainPara)
 663 {
 664     BOOL ret = TRUE;
 665     HCERTSTORE store = NULL;
 666
 667     if (data->chStores)
 668     {
 669         store = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
 670          CERT_STORE_CREATE_NEW_FLAG, NULL);
 671         if (store)
 672         {
 673             DWORD i;
 674
 675             for (i = 0; i < data->chStores; i++)
 676                 CertAddStoreToCollection(store, data->pahStores[i], 0, 0);
 677         }
 678     }
 679     /* Expect the end certificate for each signer to be the only cert in the
 680      * chain:
 681      */
 682     if (data->pasSigners[signer].csCertChain)
 683     {
 684         /* Create a certificate chain for each signer */
 685         ret = CertGetCertificateChain(createInfo->hChainEngine,
 686          data->pasSigners[signer].pasCertChain[0].pCert,
 687          &data->pasSigners[signer].sftVerifyAsOf, store,
 688          chainPara, createInfo->dwFlags, createInfo->pvReserved,
 689          &data->pasSigners[signer].pChainContext);
 690         if (ret)
 691         {
 692             if (data->pasSigners[signer].pChainContext->cChain != 1)
 693             {
 694                 FIXME("unimplemented for more than 1 simple chain\n");
 695                 ret = FALSE;
 696             }
 697             else
 698             {
 699                 if ((ret = WINTRUST_CopyChain(data, signer)))
 700                 {
 701                     if (data->psPfns->pfnCertCheckPolicy)
 702                         ret = data->psPfns->pfnCertCheckPolicy(data, signer,
 703                          FALSE, 0);
 704                     else
 705                         TRACE("no cert check policy, skipping policy check\n");
 706                 }
 707             }
 708         }
 709     }
 710     CertCloseStore(store, 0);
 711     return ret;
 712 }
 713
 714 HRESULT WINAPI WintrustCertificateTrust(CRYPT_PROVIDER_DATA *data)
 715 {
 716     BOOL ret;
 717
 718     TRACE("(%p)\n", data);
 719
 720     if (!data->csSigners)
 721     {
 722         ret = FALSE;
 723         SetLastError(TRUST_E_NOSIGNATURE);
 724     }
 725     else
 726     {
 727         DWORD i;
 728         WTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo;
 729         CERT_CHAIN_PARA chainPara;
 730
 731         WINTRUST_CreateChainPolicyCreateInfo(data, &createInfo, &chainPara);
 732         ret = TRUE;
 733         for (i = 0; i < data->csSigners; i++)
 734             ret = WINTRUST_CreateChainForSigner(data, i, &createInfo,
 735              &chainPara);
 736     }
 737     if (!ret)
 738         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV] =
 739          GetLastError();
 740     TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
 741      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV]);
 742     return ret ? S_OK : S_FALSE;
 743 }
 744
 745 HRESULT WINAPI GenericChainCertificateTrust(CRYPT_PROVIDER_DATA *data)
 746 {
 747     BOOL ret;
 748     WTD_GENERIC_CHAIN_POLICY_DATA *policyData =
 749      (WTD_GENERIC_CHAIN_POLICY_DATA *)data->pWintrustData->pPolicyCallbackData;
 750
 751     TRACE("(%p)\n", data);
 752
 753     if (policyData && policyData->u.cbSize !=
 754      sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO))
 755     {
 756         SetLastError(ERROR_INVALID_PARAMETER);
 757         ret = FALSE;
 758         goto end;
 759     }
 760     if (!data->csSigners)
 761     {
 762         ret = FALSE;
 763         SetLastError(TRUST_E_NOSIGNATURE);
 764     }
 765     else
 766     {
 767         DWORD i;
 768         WTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo, *pCreateInfo;
 769         CERT_CHAIN_PARA chainPara, *pChainPara;
 770
 771         if (policyData)
 772         {
 773             pCreateInfo = policyData->pSignerChainInfo;
 774             pChainPara = pCreateInfo->pChainPara;
 775         }
 776         else
 777         {
 778             WINTRUST_CreateChainPolicyCreateInfo(data, &createInfo, &chainPara);
 779             pChainPara = &chainPara;
 780             pCreateInfo = &createInfo;
 781         }
 782         ret = TRUE;
 783         for (i = 0; i < data->csSigners; i++)
 784             ret = WINTRUST_CreateChainForSigner(data, i, pCreateInfo,
 785              pChainPara);
 786     }
 787
 788 end:
 789     if (!ret)
 790         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV] =
 791          GetLastError();
 792     TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
 793      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV]);
 794     return ret ? S_OK : S_FALSE;
 795 }
 796
 797 HRESULT WINAPI SoftpubAuthenticode(CRYPT_PROVIDER_DATA *data)
 798 {
 799     BOOL ret;
 800     CERT_CHAIN_POLICY_STATUS policyStatus = { sizeof(policyStatus), 0 };
 801
 802     TRACE("(%p)\n", data);
 803
 804     if (data->pWintrustData->dwUIChoice != WTD_UI_NONE)
 805         FIXME("unimplemented for UI choice %d\n",
 806          data->pWintrustData->dwUIChoice);
 807     if (!data->csSigners)
 808     {
 809         ret = FALSE;
 810         policyStatus.dwError = TRUST_E_NOSIGNATURE;
 811     }
 812     else
 813     {
 814         DWORD i;
 815
 816         ret = TRUE;
 817         for (i = 0; ret && i < data->csSigners; i++)
 818         {
 819             BYTE hash[20];
 820             DWORD size = sizeof(hash);
 821
 822             /* First make sure cert isn't disallowed */
 823             if ((ret = CertGetCertificateContextProperty(
 824              data->pasSigners[i].pasCertChain[0].pCert,
 825              CERT_SIGNATURE_HASH_PROP_ID, hash, &size)))
 826             {
 827                 static const WCHAR disallowedW[] =
 828                  { 'D','i','s','a','l','l','o','w','e','d',0 };
 829                 HCERTSTORE disallowed = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,
 830                  X509_ASN_ENCODING, 0, CERT_SYSTEM_STORE_CURRENT_USER,
 831                  disallowedW);
 832
 833                 if (disallowed)
 834                 {
 835                     PCCERT_CONTEXT found = CertFindCertificateInStore(
 836                      disallowed, X509_ASN_ENCODING, 0, CERT_FIND_SIGNATURE_HASH,
 837                      hash, NULL);
 838
 839                     if (found)
 840                     {
 841                         /* Disallowed!  Can't verify it. */
 842                         policyStatus.dwError = TRUST_E_SUBJECT_NOT_TRUSTED;
 843                         ret = FALSE;
 844                         CertFreeCertificateContext(found);
 845                     }
 846                     CertCloseStore(disallowed, 0);
 847                 }
 848             }
 849             if (ret)
 850             {
 851                 CERT_CHAIN_POLICY_PARA policyPara = { sizeof(policyPara), 0 };
 852
 853                 if (data->dwRegPolicySettings & WTPF_TRUSTTEST)
 854                     policyPara.dwFlags |= CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG;
 855                 if (data->dwRegPolicySettings & WTPF_TESTCANBEVALID)
 856                     policyPara.dwFlags |= CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG;
 857                 if (data->dwRegPolicySettings & WTPF_IGNOREEXPIRATION)
 858                     policyPara.dwFlags |=
 859                      CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG |
 860                      CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG |
 861                      CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG;
 862                 if (data->dwRegPolicySettings & WTPF_IGNOREREVOKATION)
 863                     policyPara.dwFlags |=
 864                      CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG |
 865                      CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG |
 866                      CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG |
 867                      CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG;
 868                 CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_AUTHENTICODE,
 869                  data->pasSigners[i].pChainContext, &policyPara, &policyStatus);
 870                 if (policyStatus.dwError != NO_ERROR)
 871                     ret = FALSE;
 872             }
 873         }
 874     }
 875     if (!ret)
 876         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV] =
 877          policyStatus.dwError;
 878     TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
 879      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV]);
 880     return ret ? S_OK : S_FALSE;
 881 }
 882
 883 static HRESULT WINAPI WINTRUST_DefaultPolicy(CRYPT_PROVIDER_DATA *pProvData,
 884  DWORD dwStepError, DWORD dwRegPolicySettings, DWORD cSigner,
 885  PWTD_GENERIC_CHAIN_POLICY_SIGNER_INFO rgpSigner, void *pvPolicyArg)
 886 {
 887     DWORD i;
 888     CERT_CHAIN_POLICY_STATUS policyStatus = { sizeof(policyStatus), 0 };
 889
 890     for (i = 0; !policyStatus.dwError && i < cSigner; i++)
 891     {
 892         CERT_CHAIN_POLICY_PARA policyPara = { sizeof(policyPara), 0 };
 893
 894         if (dwRegPolicySettings & WTPF_IGNOREEXPIRATION)
 895             policyPara.dwFlags |=
 896              CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG |
 897              CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG |
 898              CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG;
 899         if (dwRegPolicySettings & WTPF_IGNOREREVOKATION)
 900             policyPara.dwFlags |=
 901              CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG |
 902              CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG |
 903              CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG |
 904              CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG;
 905         CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE,
 906          rgpSigner[i].pChainContext, &policyPara, &policyStatus);
 907     }
 908     return policyStatus.dwError;
 909 }
 910
 911 HRESULT WINAPI GenericChainFinalProv(CRYPT_PROVIDER_DATA *data)
 912 {
 913     HRESULT err = NO_ERROR; /* not a typo, MS confused the types */
 914     WTD_GENERIC_CHAIN_POLICY_DATA *policyData =
 915      (WTD_GENERIC_CHAIN_POLICY_DATA *)data->pWintrustData->pPolicyCallbackData;
 916
 917     TRACE("(%p)\n", data);
 918
 919     if (data->pWintrustData->dwUIChoice != WTD_UI_NONE)
 920         FIXME("unimplemented for UI choice %d\n",
 921          data->pWintrustData->dwUIChoice);
 922     if (!data->csSigners)
 923         err = TRUST_E_NOSIGNATURE;
 924     else
 925     {
 926         PFN_WTD_GENERIC_CHAIN_POLICY_CALLBACK policyCallback;
 927         void *policyArg;
 928         WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO *signers = NULL;
 929
 930         if (policyData)
 931         {
 932             policyCallback = policyData->pfnPolicyCallback;
 933             policyArg = policyData->pvPolicyArg;
 934         }
 935         else
 936         {
 937             policyCallback = WINTRUST_DefaultPolicy;
 938             policyArg = NULL;
 939         }
 940         if (data->csSigners)
 941         {
 942             DWORD i;
 943
 944             signers = data->psPfns->pfnAlloc(
 945              data->csSigners * sizeof(WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO));
 946             if (signers)
 947             {
 948                 for (i = 0; i < data->csSigners; i++)
 949                 {
 950                     signers[i].u.cbSize =
 951                      sizeof(WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO);
 952                     signers[i].pChainContext =
 953                      data->pasSigners[i].pChainContext;
 954                     signers[i].dwSignerType = data->pasSigners[i].dwSignerType;
 955                     signers[i].pMsgSignerInfo = data->pasSigners[i].psSigner;
 956                     signers[i].dwError = data->pasSigners[i].dwError;
 957                     if (data->pasSigners[i].csCounterSigners)
 958                         FIXME("unimplemented for counter signers\n");
 959                     signers[i].cCounterSigner = 0;
 960                     signers[i].rgpCounterSigner = NULL;
 961                 }
 962             }
 963             else
 964                 err = ERROR_OUTOFMEMORY;
 965         }
 966         if (err == NO_ERROR)
 967             err = policyCallback(data, TRUSTERROR_STEP_FINAL_POLICYPROV,
 968              data->dwRegPolicySettings, data->csSigners, signers, policyArg);
 969         data->psPfns->pfnFree(signers);
 970     }
 971     if (err != NO_ERROR)
 972         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV] = err;
 973     TRACE("returning %d (%08x)\n", err == NO_ERROR ? S_OK : S_FALSE,
 974      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV]);
 975     return err == NO_ERROR ? S_OK : S_FALSE;
 976 }
 977
 978 HRESULT WINAPI SoftpubCleanup(CRYPT_PROVIDER_DATA *data)
 979 {
 980     DWORD i, j;
 981
 982     for (i = 0; i < data->csSigners; i++)
 983     {
 984         for (j = 0; j < data->pasSigners[i].csCertChain; j++)
 985             CertFreeCertificateContext(data->pasSigners[i].pasCertChain[j].pCert);
 986         data->psPfns->pfnFree(data->pasSigners[i].pasCertChain);
 987         data->psPfns->pfnFree(data->pasSigners[i].psSigner);
 988         CertFreeCertificateChain(data->pasSigners[i].pChainContext);
 989     }
 990     data->psPfns->pfnFree(data->pasSigners);
 991
 992     for (i = 0; i < data->chStores; i++)
 993         CertCloseStore(data->pahStores[i], 0);
 994     data->psPfns->pfnFree(data->pahStores);
 995
 996     if (data->u.pPDSip)
 997     {
 998         data->psPfns->pfnFree(data->u.pPDSip->pSip);
 999         data->psPfns->pfnFree(data->u.pPDSip->pCATSip);
1000         data->psPfns->pfnFree(data->u.pPDSip->psSipSubjectInfo);
1001         data->psPfns->pfnFree(data->u.pPDSip->psSipCATSubjectInfo);
1002         data->psPfns->pfnFree(data->u.pPDSip->psIndirectData);
1003     }
1004
1005     CryptMsgClose(data->hMsg);
1006
1007     if (data->fOpenedFile)
1008         CloseHandle(data->pWintrustData->u.pFile->hFile);
1009
1010     return S_OK;
1011 }