?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Convert remaining source files to utf-8.
[wine/multimedia.git] / dlls / crypt32 / cert.c
blobe29499771141664c75510f1218d9f167cd789f46
1 /*
2 * Copyright 2004-2006 Juan Lang
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17 *
18 */
19
20 #include <assert.h>
21 #include <stdarg.h>
22
23 #define NONAMELESSUNION
24 #include "windef.h"
25 #include "winbase.h"
26 #include "wincrypt.h"
27 #include "winnls.h"
28 #include "rpc.h"
29 #include "wine/debug.h"
30 #include "crypt32_private.h"
31
32 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
33
34 /* Internal version of CertGetCertificateContextProperty that gets properties
35 * directly from the context (or the context it's linked to, depending on its
36 * type.) Doesn't handle special-case properties, since they are handled by
37 * CertGetCertificateContextProperty, and are particular to the store in which
38 * the property exists (which is separate from the context.)
39 */
40 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
41 void *pvData, DWORD *pcbData);
42
43 /* Internal version of CertSetCertificateContextProperty that sets properties
44 * directly on the context (or the context it's linked to, depending on its
45 * type.) Doesn't handle special cases, since they're handled by
46 * CertSetCertificateContextProperty anyway.
47 */
48 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
49 DWORD dwFlags, const void *pvData);
50
51 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
52 DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
53 DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
54 {
55 PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
56 pbCertEncoded, cbCertEncoded);
57 BOOL ret;
58
59 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
60 pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
61
62 if (cert)
63 {
64 ret = CertAddCertificateContextToStore(hCertStore, cert,
65 dwAddDisposition, ppCertContext);
66 CertFreeCertificateContext(cert);
67 }
68 else
69 ret = FALSE;
70 return ret;
71 }
72
73 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
74 const BYTE *pbCertEncoded, DWORD cbCertEncoded)
75 {
76 PCERT_CONTEXT cert = NULL;
77 BOOL ret;
78 PCERT_INFO certInfo = NULL;
79 DWORD size = 0;
80
81 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
82 cbCertEncoded);
83
84 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
85 pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
86 (BYTE *)&certInfo, &size);
87 if (ret)
88 {
89 BYTE *data = NULL;
90
91 cert = (PCERT_CONTEXT)Context_CreateDataContext(sizeof(CERT_CONTEXT));
92 if (!cert)
93 goto end;
94 data = CryptMemAlloc(cbCertEncoded);
95 if (!data)
96 {
97 CryptMemFree(cert);
98 cert = NULL;
99 goto end;
100 }
101 memcpy(data, pbCertEncoded, cbCertEncoded);
102 cert->dwCertEncodingType = dwCertEncodingType;
103 cert->pbCertEncoded = data;
104 cert->cbCertEncoded = cbCertEncoded;
105 cert->pCertInfo = certInfo;
106 cert->hCertStore = 0;
107 }
108
109 end:
110 return (PCCERT_CONTEXT)cert;
111 }
112
113 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
114 PCCERT_CONTEXT pCertContext)
115 {
116 TRACE("(%p)\n", pCertContext);
117 Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
118 return pCertContext;
119 }
120
121 static void CertDataContext_Free(void *context)
122 {
123 PCERT_CONTEXT certContext = (PCERT_CONTEXT)context;
124
125 CryptMemFree(certContext->pbCertEncoded);
126 LocalFree(certContext->pCertInfo);
127 }
128
129 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
130 {
131 TRACE("(%p)\n", pCertContext);
132
133 if (pCertContext)
134 Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
135 CertDataContext_Free);
136 return TRUE;
137 }
138
139 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
140 DWORD dwPropId)
141 {
142 PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
143 (void *)pCertContext, sizeof(CERT_CONTEXT));
144 DWORD ret;
145
146 TRACE("(%p, %d)\n", pCertContext, dwPropId);
147
148 if (properties)
149 ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
150 else
151 ret = 0;
152 return ret;
153 }
154
155 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
156 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
157 DWORD *pcbData)
158 {
159 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
160 pcbData);
161 if (ret && pvData)
162 {
163 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
164
165 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
166 }
167 return ret;
168 }
169
170 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
171 DWORD cb)
172 {
173 BOOL ret = TRUE;
174
175 if (!pvData)
176 *pcbData = cb;
177 else if (*pcbData < cb)
178 {
179 SetLastError(ERROR_MORE_DATA);
180 *pcbData = cb;
181 ret = FALSE;
182 }
183 else
184 {
185 memcpy(pvData, pb, cb);
186 *pcbData = cb;
187 }
188 return ret;
189 }
190
191 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
192 void *pvData, DWORD *pcbData)
193 {
194 PCCERT_CONTEXT pCertContext = (PCCERT_CONTEXT)context;
195 PCONTEXT_PROPERTY_LIST properties =
196 Context_GetProperties(context, sizeof(CERT_CONTEXT));
197 BOOL ret;
198 CRYPT_DATA_BLOB blob;
199
200 TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
201
202 if (properties)
203 ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
204 else
205 ret = FALSE;
206 if (ret)
207 ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
208 else
209 {
210 /* Implicit properties */
211 switch (dwPropId)
212 {
213 case CERT_SHA1_HASH_PROP_ID:
214 ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
215 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
216 pcbData);
217 break;
218 case CERT_MD5_HASH_PROP_ID:
219 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
220 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
221 pcbData);
222 break;
223 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
224 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
225 pCertContext->pCertInfo->Subject.pbData,
226 pCertContext->pCertInfo->Subject.cbData,
227 pvData, pcbData);
228 break;
229 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
230 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
231 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
232 pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
233 pvData, pcbData);
234 break;
235 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
236 ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
237 pCertContext->pCertInfo->SerialNumber.pbData,
238 pCertContext->pCertInfo->SerialNumber.cbData,
239 pvData, pcbData);
240 break;
241 case CERT_SIGNATURE_HASH_PROP_ID:
242 ret = CryptHashToBeSigned(0, pCertContext->dwCertEncodingType,
243 pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
244 pcbData);
245 if (ret && pvData)
246 {
247 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
248
249 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
250 }
251 break;
252 case CERT_KEY_IDENTIFIER_PROP_ID:
253 {
254 PCERT_EXTENSION ext = CertFindExtension(
255 szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
256 pCertContext->pCertInfo->rgExtension);
257
258 if (ext)
259 {
260 CRYPT_DATA_BLOB value;
261 DWORD size = sizeof(value);
262
263 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
264 szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
265 ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
266 &size);
267 if (ret)
268 {
269 ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
270 value.cbData);
271 CertContext_SetProperty(context, dwPropId, 0, &value);
272 }
273 }
274 else
275 SetLastError(ERROR_INVALID_DATA);
276 break;
277 }
278 default:
279 SetLastError(CRYPT_E_NOT_FOUND);
280 }
281 }
282 TRACE("returning %d\n", ret);
283 return ret;
284 }
285
286 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
287 {
288 DWORD i, containerLen, provNameLen;
289 LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
290
291 info->pwszContainerName = (LPWSTR)data;
292 containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
293 data += containerLen;
294
295 info->pwszProvName = (LPWSTR)data;
296 provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
297 data += provNameLen;
298
299 info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
300 data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
301
302 for (i = 0; i < info->cProvParam; i++)
303 {
304 info->rgProvParam[i].pbData = data;
305 data += info->rgProvParam[i].cbData;
306 }
307 }
308
309 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
310 DWORD dwPropId, void *pvData, DWORD *pcbData)
311 {
312 BOOL ret;
313
314 TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
315
316 switch (dwPropId)
317 {
318 case 0:
319 case CERT_CERT_PROP_ID:
320 case CERT_CRL_PROP_ID:
321 case CERT_CTL_PROP_ID:
322 SetLastError(E_INVALIDARG);
323 ret = FALSE;
324 break;
325 case CERT_ACCESS_STATE_PROP_ID:
326 if (pCertContext->hCertStore)
327 ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
328 pvData, pcbData);
329 else
330 {
331 DWORD state = 0;
332
333 ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
334 }
335 break;
336 case CERT_KEY_PROV_HANDLE_PROP_ID:
337 {
338 CERT_KEY_CONTEXT keyContext;
339 DWORD size = sizeof(keyContext);
340
341 ret = CertContext_GetProperty((void *)pCertContext,
342 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
343 if (ret)
344 ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
345 sizeof(keyContext.hCryptProv));
346 break;
347 }
348 case CERT_KEY_PROV_INFO_PROP_ID:
349 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
350 pcbData);
351 if (ret && pvData)
352 CRYPT_FixKeyProvInfoPointers((PCRYPT_KEY_PROV_INFO)pvData);
353 break;
354 default:
355 ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
356 pcbData);
357 }
358
359 TRACE("returning %d\n", ret);
360 return ret;
361 }
362
363 /* Copies key provider info from from into to, where to is assumed to be a
364 * contiguous buffer of memory large enough for from and all its associated
365 * data, but whose pointers are uninitialized.
366 * Upon return, to contains a contiguous copy of from, packed in the following
367 * order:
368 * - CRYPT_KEY_PROV_INFO
369 * - pwszContainerName
370 * - pwszProvName
371 * - rgProvParam[0]...
372 */
373 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
374 const CRYPT_KEY_PROV_INFO *from)
375 {
376 DWORD i;
377 LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
378
379 if (from->pwszContainerName)
380 {
381 to->pwszContainerName = (LPWSTR)nextData;
382 lstrcpyW(to->pwszContainerName, from->pwszContainerName);
383 nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
384 }
385 else
386 to->pwszContainerName = NULL;
387 if (from->pwszProvName)
388 {
389 to->pwszProvName = (LPWSTR)nextData;
390 lstrcpyW(to->pwszProvName, from->pwszProvName);
391 nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
392 }
393 else
394 to->pwszProvName = NULL;
395 to->dwProvType = from->dwProvType;
396 to->dwFlags = from->dwFlags;
397 to->cProvParam = from->cProvParam;
398 to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
399 nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
400 to->dwKeySpec = from->dwKeySpec;
401 for (i = 0; i < to->cProvParam; i++)
402 {
403 memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
404 sizeof(CRYPT_KEY_PROV_PARAM));
405 to->rgProvParam[i].pbData = nextData;
406 memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
407 from->rgProvParam[i].cbData);
408 nextData += from->rgProvParam[i].cbData;
409 }
410 }
411
412 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
413 const CRYPT_KEY_PROV_INFO *info)
414 {
415 BOOL ret;
416 LPBYTE buf = NULL;
417 DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
418
419 if (info->pwszContainerName)
420 containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
421 else
422 containerSize = 0;
423 if (info->pwszProvName)
424 provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
425 else
426 provNameSize = 0;
427 size += containerSize + provNameSize;
428 for (i = 0; i < info->cProvParam; i++)
429 size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
430 buf = CryptMemAlloc(size);
431 if (buf)
432 {
433 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
434 ret = ContextPropertyList_SetProperty(properties,
435 CERT_KEY_PROV_INFO_PROP_ID, buf, size);
436 CryptMemFree(buf);
437 }
438 else
439 ret = FALSE;
440 return ret;
441 }
442
443 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
444 DWORD dwFlags, const void *pvData)
445 {
446 PCONTEXT_PROPERTY_LIST properties =
447 Context_GetProperties(context, sizeof(CERT_CONTEXT));
448 BOOL ret;
449
450 TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
451
452 if (!properties)
453 ret = FALSE;
454 else
455 {
456 switch (dwPropId)
457 {
458 case CERT_AUTO_ENROLL_PROP_ID:
459 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
460 case CERT_DESCRIPTION_PROP_ID:
461 case CERT_FRIENDLY_NAME_PROP_ID:
462 case CERT_HASH_PROP_ID:
463 case CERT_KEY_IDENTIFIER_PROP_ID:
464 case CERT_MD5_HASH_PROP_ID:
465 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
466 case CERT_PUBKEY_ALG_PARA_PROP_ID:
467 case CERT_PVK_FILE_PROP_ID:
468 case CERT_SIGNATURE_HASH_PROP_ID:
469 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
470 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
471 case CERT_EXTENDED_ERROR_INFO_PROP_ID:
472 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
473 case CERT_ENROLLMENT_PROP_ID:
474 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
475 case CERT_RENEWAL_PROP_ID:
476 {
477 if (pvData)
478 {
479 const CRYPT_DATA_BLOB *blob = (const CRYPT_DATA_BLOB *)pvData;
480
481 ret = ContextPropertyList_SetProperty(properties, dwPropId,
482 blob->pbData, blob->cbData);
483 }
484 else
485 {
486 ContextPropertyList_RemoveProperty(properties, dwPropId);
487 ret = TRUE;
488 }
489 break;
490 }
491 case CERT_DATE_STAMP_PROP_ID:
492 if (pvData)
493 ret = ContextPropertyList_SetProperty(properties, dwPropId,
494 (const BYTE *)pvData, sizeof(FILETIME));
495 else
496 {
497 ContextPropertyList_RemoveProperty(properties, dwPropId);
498 ret = TRUE;
499 }
500 break;
501 case CERT_KEY_CONTEXT_PROP_ID:
502 {
503 if (pvData)
504 {
505 const CERT_KEY_CONTEXT *keyContext = (const CERT_KEY_CONTEXT *)pvData;
506
507 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
508 {
509 SetLastError(E_INVALIDARG);
510 ret = FALSE;
511 }
512 else
513 ret = ContextPropertyList_SetProperty(properties, dwPropId,
514 (const BYTE *)keyContext, keyContext->cbSize);
515 }
516 else
517 {
518 ContextPropertyList_RemoveProperty(properties, dwPropId);
519 ret = TRUE;
520 }
521 break;
522 }
523 case CERT_KEY_PROV_INFO_PROP_ID:
524 if (pvData)
525 ret = CertContext_SetKeyProvInfoProperty(properties,
526 (const CRYPT_KEY_PROV_INFO *)pvData);
527 else
528 {
529 ContextPropertyList_RemoveProperty(properties, dwPropId);
530 ret = TRUE;
531 }
532 break;
533 case CERT_KEY_PROV_HANDLE_PROP_ID:
534 {
535 CERT_KEY_CONTEXT keyContext;
536 DWORD size = sizeof(keyContext);
537
538 ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
539 &keyContext, &size);
540 if (ret)
541 {
542 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
543 CryptReleaseContext(keyContext.hCryptProv, 0);
544 if (pvData)
545 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
546 else
547 keyContext.hCryptProv = 0;
548 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
549 0, &keyContext);
550 }
551 break;
552 }
553 default:
554 FIXME("%d: stub\n", dwPropId);
555 ret = FALSE;
556 }
557 }
558 TRACE("returning %d\n", ret);
559 return ret;
560 }
561
562 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
563 DWORD dwPropId, DWORD dwFlags, const void *pvData)
564 {
565 BOOL ret;
566
567 TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
568
569 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
570 * crashes on most of these, I'll be safer.
571 */
572 switch (dwPropId)
573 {
574 case 0:
575 case CERT_ACCESS_STATE_PROP_ID:
576 case CERT_CERT_PROP_ID:
577 case CERT_CRL_PROP_ID:
578 case CERT_CTL_PROP_ID:
579 SetLastError(E_INVALIDARG);
580 return FALSE;
581 }
582 ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
583 pvData);
584 TRACE("returning %d\n", ret);
585 return ret;
586 }
587
588 /* Acquires the private key using the key provider info, retrieving info from
589 * the certificate if info is NULL. The acquired provider is returned in
590 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
591 */
592 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
593 PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
594 {
595 DWORD size = 0;
596 BOOL allocated = FALSE, ret = TRUE;
597
598 if (!info)
599 {
600 ret = CertGetCertificateContextProperty(pCert,
601 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
602 if (ret)
603 {
604 info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(GetProcessHeap(), 0, size);
605 if (info)
606 {
607 ret = CertGetCertificateContextProperty(pCert,
608 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
609 allocated = TRUE;
610 }
611 else
612 {
613 SetLastError(ERROR_OUTOFMEMORY);
614 ret = FALSE;
615 }
616 }
617 else
618 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
619 }
620 if (ret)
621 {
622 ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
623 info->pwszProvName, info->dwProvType, 0);
624 if (ret)
625 {
626 DWORD i;
627
628 for (i = 0; i < info->cProvParam; i++)
629 {
630 CryptSetProvParam(*phCryptProv,
631 info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
632 info->rgProvParam[i].dwFlags);
633 }
634 *pdwKeySpec = info->dwKeySpec;
635 }
636 else
637 SetLastError(CRYPT_E_NO_KEY_PROPERTY);
638 }
639 if (allocated)
640 HeapFree(GetProcessHeap(), 0, info);
641 return ret;
642 }
643
644 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
645 DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
646 DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
647 {
648 BOOL ret = FALSE, cache = FALSE;
649 PCRYPT_KEY_PROV_INFO info = NULL;
650 CERT_KEY_CONTEXT keyContext;
651 DWORD size;
652
653 TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
654 phCryptProv, pdwKeySpec, pfCallerFreeProv);
655
656 if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
657 {
658 DWORD size = 0;
659
660 ret = CertGetCertificateContextProperty(pCert,
661 CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
662 if (ret)
663 {
664 info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(
665 GetProcessHeap(), 0, size);
666 ret = CertGetCertificateContextProperty(pCert,
667 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
668 if (ret)
669 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
670 }
671 }
672 else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
673 cache = TRUE;
674 *phCryptProv = 0;
675 if (cache)
676 {
677 size = sizeof(keyContext);
678 ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
679 &keyContext, &size);
680 if (ret)
681 {
682 *phCryptProv = keyContext.hCryptProv;
683 if (pdwKeySpec)
684 *pdwKeySpec = keyContext.dwKeySpec;
685 if (pfCallerFreeProv)
686 *pfCallerFreeProv = !cache;
687 }
688 }
689 if (!*phCryptProv)
690 {
691 ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
692 &keyContext.hCryptProv, &keyContext.dwKeySpec);
693 if (ret)
694 {
695 *phCryptProv = keyContext.hCryptProv;
696 if (pdwKeySpec)
697 *pdwKeySpec = keyContext.dwKeySpec;
698 if (cache)
699 {
700 keyContext.cbSize = sizeof(keyContext);
701 if (CertSetCertificateContextProperty(pCert,
702 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
703 {
704 if (pfCallerFreeProv)
705 *pfCallerFreeProv = FALSE;
706 }
707 }
708 else
709 {
710 if (pfCallerFreeProv)
711 *pfCallerFreeProv = TRUE;
712 }
713 }
714 }
715 HeapFree(GetProcessHeap(), 0, info);
716 return ret;
717 }
718
719 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
720 PCERT_INFO pCertId1, PCERT_INFO pCertId2)
721 {
722 BOOL ret;
723
724 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
725
726 ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
727 &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
728 &pCertId2->SerialNumber);
729 TRACE("returning %d\n", ret);
730 return ret;
731 }
732
733 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
734 PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
735 {
736 BOOL ret;
737
738 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
739
740 if (pCertName1->cbData == pCertName2->cbData)
741 {
742 if (pCertName1->cbData)
743 ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
744 pCertName1->cbData);
745 else
746 ret = TRUE;
747 }
748 else
749 ret = FALSE;
750 TRACE("returning %d\n", ret);
751 return ret;
752 }
753
754 /* Returns the number of significant bytes in pInt, where a byte is
755 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
756 * for negative numbers. pInt is assumed to be little-endian.
757 */
758 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
759 {
760 DWORD ret = pInt->cbData;
761
762 while (ret > 1)
763 {
764 if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
765 ret--;
766 else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
767 ret--;
768 else
769 break;
770 }
771 return ret;
772 }
773
774 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
775 PCRYPT_INTEGER_BLOB pInt2)
776 {
777 BOOL ret;
778 DWORD cb1, cb2;
779
780 TRACE("(%p, %p)\n", pInt1, pInt2);
781
782 cb1 = CRYPT_significantBytes(pInt1);
783 cb2 = CRYPT_significantBytes(pInt2);
784 if (cb1 == cb2)
785 {
786 if (cb1)
787 ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
788 else
789 ret = TRUE;
790 }
791 else
792 ret = FALSE;
793 TRACE("returning %d\n", ret);
794 return ret;
795 }
796
797 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
798 PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
799 {
800 BOOL ret;
801
802 TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
803
804 switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
805 {
806 case 0: /* Seems to mean "raw binary bits" */
807 if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
808 pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
809 {
810 if (pPublicKey2->PublicKey.cbData)
811 ret = !memcmp(pPublicKey1->PublicKey.pbData,
812 pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
813 else
814 ret = TRUE;
815 }
816 else
817 ret = FALSE;
818 break;
819 default:
820 WARN("Unknown encoding type %08x\n", dwCertEncodingType);
821 /* FALLTHROUGH */
822 case X509_ASN_ENCODING:
823 {
824 BLOBHEADER *pblob1, *pblob2;
825 DWORD length;
826 ret = FALSE;
827 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
828 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
829 0, NULL, &length))
830 {
831 pblob1 = CryptMemAlloc(length);
832 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
833 pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
834 0, pblob1, &length))
835 {
836 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
837 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
838 0, NULL, &length))
839 {
840 pblob2 = CryptMemAlloc(length);
841 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
842 pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
843 0, pblob2, &length))
844 {
845 /* The RSAPUBKEY structure directly follows the BLOBHEADER */
846 RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
847 *pk2 = (LPVOID)(pblob2 + 1);
848 ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
849 && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
850 }
851 CryptMemFree(pblob2);
852 }
853 }
854 CryptMemFree(pblob1);
855 }
856
857 break;
858 }
859 }
860 return ret;
861 }
862
863 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
864 PCERT_PUBLIC_KEY_INFO pPublicKey)
865 {
866 DWORD len = 0;
867
868 TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
869
870 if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
871 {
872 SetLastError(ERROR_FILE_NOT_FOUND);
873 return 0;
874 }
875 if (pPublicKey->Algorithm.pszObjId &&
876 !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
877 {
878 FIXME("unimplemented for DH public keys\n");
879 SetLastError(CRYPT_E_ASN1_BADTAG);
880 }
881 else
882 {
883 DWORD size;
884 PBYTE buf;
885 BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
886 RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
887 pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
888 &size);
889
890 if (ret)
891 {
892 RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
893
894 len = rsaPubKey->bitlen;
895 LocalFree(buf);
896 }
897 }
898 return len;
899 }
900
901 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
902 DWORD dwFlags, const void *pvPara);
903
904 static BOOL compare_cert_any(PCCERT_CONTEXT pCertContext, DWORD dwType,
905 DWORD dwFlags, const void *pvPara)
906 {
907 return TRUE;
908 }
909
910 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
911 DWORD dwFlags, const void *pvPara)
912 {
913 BOOL ret;
914 BYTE hash[16];
915 DWORD size = sizeof(hash);
916
917 ret = CertGetCertificateContextProperty(pCertContext,
918 CERT_MD5_HASH_PROP_ID, hash, &size);
919 if (ret)
920 {
921 const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
922
923 if (size == pHash->cbData)
924 ret = !memcmp(pHash->pbData, hash, size);
925 else
926 ret = FALSE;
927 }
928 return ret;
929 }
930
931 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
932 DWORD dwFlags, const void *pvPara)
933 {
934 BOOL ret;
935 BYTE hash[20];
936 DWORD size = sizeof(hash);
937
938 ret = CertGetCertificateContextProperty(pCertContext,
939 CERT_SHA1_HASH_PROP_ID, hash, &size);
940 if (ret)
941 {
942 const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
943
944 if (size == pHash->cbData)
945 ret = !memcmp(pHash->pbData, hash, size);
946 else
947 ret = FALSE;
948 }
949 return ret;
950 }
951
952 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
953 DWORD dwFlags, const void *pvPara)
954 {
955 CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
956 BOOL ret;
957
958 if (dwType & CERT_INFO_SUBJECT_FLAG)
959 toCompare = &pCertContext->pCertInfo->Subject;
960 else
961 toCompare = &pCertContext->pCertInfo->Issuer;
962 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
963 toCompare, blob);
964 return ret;
965 }
966
967 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
968 DWORD dwType, DWORD dwFlags, const void *pvPara)
969 {
970 CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
971 BOOL ret;
972
973 /* Matching serial number and subject match.. */
974 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
975 &pCertInfo->Issuer, &pCertContext->pCertInfo->Subject);
976 if (ret)
977 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
978 &pCertInfo->SerialNumber);
979 else
980 {
981 /* failing that, if the serial number and issuer match, we match */
982 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
983 &pCertInfo->SerialNumber);
984 if (ret)
985 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
986 &pCertInfo->Issuer, &pCertContext->pCertInfo->Issuer);
987 }
988 TRACE("returning %d\n", ret);
989 return ret;
990 }
991
992 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
993 DWORD dwFlags, const void *pvPara)
994 {
995 CERT_ID *id = (CERT_ID *)pvPara;
996 BOOL ret;
997
998 switch (id->dwIdChoice)
999 {
1000 case CERT_ID_ISSUER_SERIAL_NUMBER:
1001 ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1002 &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1003 if (ret)
1004 ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1005 &id->u.IssuerSerialNumber.SerialNumber);
1006 break;
1007 case CERT_ID_SHA1_HASH:
1008 ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1009 &id->u.HashId);
1010 break;
1011 case CERT_ID_KEY_IDENTIFIER:
1012 {
1013 DWORD size = 0;
1014
1015 ret = CertGetCertificateContextProperty(pCertContext,
1016 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1017 if (ret && size == id->u.KeyId.cbData)
1018 {
1019 LPBYTE buf = CryptMemAlloc(size);
1020
1021 if (buf)
1022 {
1023 CertGetCertificateContextProperty(pCertContext,
1024 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1025 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1026 CryptMemFree(buf);
1027 }
1028 }
1029 else
1030 ret = FALSE;
1031 break;
1032 }
1033 default:
1034 ret = FALSE;
1035 break;
1036 }
1037 return ret;
1038 }
1039
1040 static BOOL compare_cert_by_issuer(PCCERT_CONTEXT pCertContext, DWORD dwType,
1041 DWORD dwFlags, const void *pvPara)
1042 {
1043 BOOL ret = FALSE;
1044 PCCERT_CONTEXT subject = (PCCERT_CONTEXT)pvPara;
1045 PCERT_EXTENSION ext;
1046 DWORD size;
1047
1048 if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1049 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1050 {
1051 CERT_AUTHORITY_KEY_ID_INFO *info;
1052
1053 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1054 X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1055 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1056 &info, &size);
1057 if (ret)
1058 {
1059 CERT_ID id;
1060
1061 if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1062 {
1063 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1064 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1065 sizeof(CERT_NAME_BLOB));
1066 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1067 &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1068 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1069 &id);
1070 }
1071 else if (info->KeyId.cbData)
1072 {
1073 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1074 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1075 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1076 &id);
1077 }
1078 else
1079 ret = FALSE;
1080 LocalFree(info);
1081 }
1082 }
1083 else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1084 subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1085 {
1086 CERT_AUTHORITY_KEY_ID2_INFO *info;
1087
1088 ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1089 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1090 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1091 &info, &size);
1092 if (ret)
1093 {
1094 CERT_ID id;
1095
1096 if (info->AuthorityCertIssuer.cAltEntry &&
1097 info->AuthorityCertSerialNumber.cbData)
1098 {
1099 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1100 DWORD i;
1101
1102 for (i = 0; !directoryName &&
1103 i < info->AuthorityCertIssuer.cAltEntry; i++)
1104 if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1105 == CERT_ALT_NAME_DIRECTORY_NAME)
1106 directoryName =
1107 &info->AuthorityCertIssuer.rgAltEntry[i];
1108 if (directoryName)
1109 {
1110 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1111 memcpy(&id.u.IssuerSerialNumber.Issuer,
1112 &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1113 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1114 &info->AuthorityCertSerialNumber,
1115 sizeof(CRYPT_INTEGER_BLOB));
1116 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1117 &id);
1118 }
1119 else
1120 {
1121 FIXME("no supported name type in authority key id2\n");
1122 ret = FALSE;
1123 }
1124 }
1125 else if (info->KeyId.cbData)
1126 {
1127 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1128 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1129 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1130 &id);
1131 }
1132 else
1133 ret = FALSE;
1134 LocalFree(info);
1135 }
1136 }
1137 else
1138 ret = compare_cert_by_name(pCertContext,
1139 CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT, dwFlags,
1140 &subject->pCertInfo->Issuer);
1141 return ret;
1142 }
1143
1144 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1145 DWORD dwFlags, const void *pvPara)
1146 {
1147 PCCERT_CONTEXT toCompare = (PCCERT_CONTEXT)pvPara;
1148 return CertCompareCertificate(pCertContext->dwCertEncodingType,
1149 pCertContext->pCertInfo, toCompare->pCertInfo);
1150 }
1151
1152 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1153 DWORD dwFlags, const void *pvPara)
1154 {
1155 const CRYPT_HASH_BLOB *hash = (const CRYPT_HASH_BLOB *)pvPara;
1156 DWORD size = 0;
1157 BOOL ret;
1158
1159 ret = CertGetCertificateContextProperty(pCertContext,
1160 CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1161 if (ret && size == hash->cbData)
1162 {
1163 LPBYTE buf = CryptMemAlloc(size);
1164
1165 if (buf)
1166 {
1167 CertGetCertificateContextProperty(pCertContext,
1168 CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1169 ret = !memcmp(buf, hash->pbData, size);
1170 CryptMemFree(buf);
1171 }
1172 }
1173 else
1174 ret = FALSE;
1175 return ret;
1176 }
1177
1178 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1179 DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1180 PCCERT_CONTEXT pPrevCertContext)
1181 {
1182 PCCERT_CONTEXT ret;
1183 CertCompareFunc compare;
1184
1185 TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1186 dwFlags, dwType, pvPara, pPrevCertContext);
1187
1188 switch (dwType >> CERT_COMPARE_SHIFT)
1189 {
1190 case CERT_COMPARE_ANY:
1191 compare = compare_cert_any;
1192 break;
1193 case CERT_COMPARE_MD5_HASH:
1194 compare = compare_cert_by_md5_hash;
1195 break;
1196 case CERT_COMPARE_SHA1_HASH:
1197 compare = compare_cert_by_sha1_hash;
1198 break;
1199 case CERT_COMPARE_NAME:
1200 compare = compare_cert_by_name;
1201 break;
1202 case CERT_COMPARE_SUBJECT_CERT:
1203 compare = compare_cert_by_subject_cert;
1204 break;
1205 case CERT_COMPARE_CERT_ID:
1206 compare = compare_cert_by_cert_id;
1207 break;
1208 case CERT_COMPARE_ISSUER_OF:
1209 compare = compare_cert_by_issuer;
1210 break;
1211 case CERT_COMPARE_EXISTING:
1212 compare = compare_existing_cert;
1213 break;
1214 case CERT_COMPARE_SIGNATURE_HASH:
1215 compare = compare_cert_by_signature_hash;
1216 break;
1217 default:
1218 FIXME("find type %08x unimplemented\n", dwType);
1219 compare = NULL;
1220 }
1221
1222 if (compare)
1223 {
1224 BOOL matches = FALSE;
1225
1226 ret = pPrevCertContext;
1227 do {
1228 ret = CertEnumCertificatesInStore(hCertStore, ret);
1229 if (ret)
1230 matches = compare(ret, dwType, dwFlags, pvPara);
1231 } while (ret != NULL && !matches);
1232 if (!ret)
1233 SetLastError(CRYPT_E_NOT_FOUND);
1234 }
1235 else
1236 {
1237 SetLastError(CRYPT_E_NOT_FOUND);
1238 ret = NULL;
1239 }
1240 TRACE("returning %p\n", ret);
1241 return ret;
1242 }
1243
1244 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1245 DWORD dwCertEncodingType, PCERT_INFO pCertId)
1246 {
1247 TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1248
1249 if (!pCertId)
1250 {
1251 SetLastError(E_INVALIDARG);
1252 return NULL;
1253 }
1254 return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1255 CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1256 }
1257
1258 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1259 PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1260 {
1261 static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1262 CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1263
1264 if (*pdwFlags & ~supportedFlags)
1265 {
1266 SetLastError(E_INVALIDARG);
1267 return FALSE;
1268 }
1269 if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1270 {
1271 DWORD flags = 0;
1272 PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1273 NULL, &flags);
1274
1275 /* FIXME: what if the CRL has expired? */
1276 if (crl)
1277 {
1278 if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1279 pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1280 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1281 }
1282 else
1283 *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1284 }
1285 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1286 {
1287 if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1288 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1289 }
1290 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1291 {
1292 if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1293 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1294 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1295 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1296 }
1297 return TRUE;
1298 }
1299
1300 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1301 PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1302 DWORD *pdwFlags)
1303 {
1304 PCCERT_CONTEXT ret;
1305
1306 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1307 pPrevIssuerContext, *pdwFlags);
1308
1309 if (!pSubjectContext)
1310 {
1311 SetLastError(E_INVALIDARG);
1312 return NULL;
1313 }
1314
1315 ret = CertFindCertificateInStore(hCertStore,
1316 pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1317 pSubjectContext, pPrevIssuerContext);
1318 if (ret)
1319 {
1320 if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1321 pdwFlags))
1322 {
1323 CertFreeCertificateContext(ret);
1324 ret = NULL;
1325 }
1326 }
1327 TRACE("returning %p\n", ret);
1328 return ret;
1329 }
1330
1331 typedef struct _OLD_CERT_REVOCATION_STATUS {
1332 DWORD cbSize;
1333 DWORD dwIndex;
1334 DWORD dwError;
1335 DWORD dwReason;
1336 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1337
1338 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1339 void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1340
1341 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1342 DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1343 PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1344 {
1345 BOOL ret;
1346
1347 TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1348 cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1349
1350 if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1351 pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1352 {
1353 SetLastError(E_INVALIDARG);
1354 return FALSE;
1355 }
1356 if (cContext)
1357 {
1358 static HCRYPTOIDFUNCSET set = NULL;
1359 DWORD size;
1360
1361 if (!set)
1362 set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1363 ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1364 if (ret)
1365 {
1366 if (size == 1)
1367 {
1368 /* empty list */
1369 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1370 ret = FALSE;
1371 }
1372 else
1373 {
1374 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1375
1376 if (dllList)
1377 {
1378 ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1379 dllList, &size);
1380 if (ret)
1381 {
1382 for (ptr = dllList; ret && *ptr;
1383 ptr += lstrlenW(ptr) + 1)
1384 {
1385 CertVerifyRevocationFunc func;
1386 HCRYPTOIDFUNCADDR hFunc;
1387
1388 ret = CryptGetDefaultOIDFunctionAddress(set,
1389 dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1390 if (ret)
1391 {
1392 ret = func(dwEncodingType, dwRevType, cContext,
1393 rgpvContext, dwFlags, pRevPara, pRevStatus);
1394 CryptFreeOIDFunctionAddress(hFunc, 0);
1395 }
1396 }
1397 }
1398 CryptMemFree(dllList);
1399 }
1400 else
1401 {
1402 SetLastError(ERROR_OUTOFMEMORY);
1403 ret = FALSE;
1404 }
1405 }
1406 }
1407 }
1408 else
1409 ret = TRUE;
1410 return ret;
1411 }
1412
1413 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1414 CRYPT_ATTRIBUTE rgAttr[])
1415 {
1416 PCRYPT_ATTRIBUTE ret = NULL;
1417 DWORD i;
1418
1419 TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1420
1421 if (!cAttr)
1422 return NULL;
1423 if (!pszObjId)
1424 {
1425 SetLastError(ERROR_INVALID_PARAMETER);
1426 return NULL;
1427 }
1428
1429 for (i = 0; !ret && i < cAttr; i++)
1430 if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1431 ret = &rgAttr[i];
1432 return ret;
1433 }
1434
1435 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1436 CERT_EXTENSION rgExtensions[])
1437 {
1438 PCERT_EXTENSION ret = NULL;
1439 DWORD i;
1440
1441 TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1442
1443 if (!cExtensions)
1444 return NULL;
1445 if (!pszObjId)
1446 {
1447 SetLastError(ERROR_INVALID_PARAMETER);
1448 return NULL;
1449 }
1450
1451 for (i = 0; !ret && i < cExtensions; i++)
1452 if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1453 rgExtensions[i].pszObjId))
1454 ret = &rgExtensions[i];
1455 return ret;
1456 }
1457
1458 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1459 {
1460 PCERT_RDN_ATTR ret = NULL;
1461 DWORD i, j;
1462
1463 TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1464
1465 if (!pszObjId)
1466 {
1467 SetLastError(ERROR_INVALID_PARAMETER);
1468 return NULL;
1469 }
1470
1471 for (i = 0; !ret && i < pName->cRDN; i++)
1472 for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1473 if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1474 pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1475 ret = &pName->rgRDN[i].rgRDNAttr[j];
1476 return ret;
1477 }
1478
1479 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1480 PCERT_INFO pCertInfo)
1481 {
1482 FILETIME fileTime;
1483 LONG ret;
1484
1485 if (!pTimeToVerify)
1486 {
1487 GetSystemTimeAsFileTime(&fileTime);
1488 pTimeToVerify = &fileTime;
1489 }
1490 if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1491 {
1492 ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1493 if (ret < 0)
1494 ret = 0;
1495 }
1496 return ret;
1497 }
1498
1499 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1500 PCERT_INFO pIssuerInfo)
1501 {
1502 TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1503
1504 return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1505 && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1506 }
1507
1508 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1509 DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1510 DWORD *pcbComputedHash)
1511 {
1512 BOOL ret = TRUE;
1513 HCRYPTHASH hHash = 0;
1514
1515 TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1516 pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1517
1518 if (!hCryptProv)
1519 hCryptProv = CRYPT_GetDefaultProvider();
1520 if (!Algid)
1521 Algid = CALG_SHA1;
1522 if (ret)
1523 {
1524 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1525 if (ret)
1526 {
1527 ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1528 if (ret)
1529 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1530 pcbComputedHash, 0);
1531 CryptDestroyHash(hHash);
1532 }
1533 }
1534 return ret;
1535 }
1536
1537 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1538 DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1539 BYTE *pbComputedHash, DWORD *pcbComputedHash)
1540 {
1541 BOOL ret = TRUE;
1542 HCRYPTHASH hHash = 0;
1543
1544 TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1545 dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1546
1547 if (!hCryptProv)
1548 hCryptProv = CRYPT_GetDefaultProvider();
1549 if (!Algid)
1550 Algid = CALG_MD5;
1551 if (ret)
1552 {
1553 BYTE *buf;
1554 DWORD size = 0;
1555
1556 ret = CryptEncodeObjectEx(dwCertEncodingType, X509_PUBLIC_KEY_INFO,
1557 pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
1558 if (ret)
1559 {
1560 ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1561 if (ret)
1562 {
1563 ret = CryptHashData(hHash, buf, size, 0);
1564 if (ret)
1565 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1566 pcbComputedHash, 0);
1567 CryptDestroyHash(hHash);
1568 }
1569 LocalFree(buf);
1570 }
1571 }
1572 return ret;
1573 }
1574
1575 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
1576 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1577 BYTE *pbComputedHash, DWORD *pcbComputedHash)
1578 {
1579 BOOL ret;
1580 CERT_SIGNED_CONTENT_INFO *info;
1581 DWORD size;
1582
1583 TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
1584 pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
1585
1586 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1587 pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, (void *)&info, &size);
1588 if (ret)
1589 {
1590 PCCRYPT_OID_INFO oidInfo;
1591 HCRYPTHASH hHash;
1592
1593 if (!hCryptProv)
1594 hCryptProv = CRYPT_GetDefaultProvider();
1595 oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1596 info->SignatureAlgorithm.pszObjId, 0);
1597 if (!oidInfo)
1598 {
1599 SetLastError(NTE_BAD_ALGID);
1600 ret = FALSE;
1601 }
1602 else
1603 {
1604 ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
1605 if (ret)
1606 {
1607 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
1608 info->ToBeSigned.cbData, 0);
1609 if (ret)
1610 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1611 pcbComputedHash, 0);
1612 CryptDestroyHash(hHash);
1613 }
1614 }
1615 LocalFree(info);
1616 }
1617 return ret;
1618 }
1619
1620 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1621 DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
1622 DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1623 const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
1624 {
1625 BOOL ret;
1626 PCCRYPT_OID_INFO info;
1627 HCRYPTHASH hHash;
1628
1629 TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
1630 dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
1631 pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
1632
1633 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1634 pSignatureAlgorithm->pszObjId, 0);
1635 if (!info)
1636 {
1637 SetLastError(NTE_BAD_ALGID);
1638 return FALSE;
1639 }
1640 if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
1641 {
1642 if (!hCryptProv)
1643 hCryptProv = CRYPT_GetDefaultProvider();
1644 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1645 if (ret)
1646 {
1647 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1648 cbEncodedToBeSigned, 0);
1649 if (ret)
1650 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
1651 pcbSignature, 0);
1652 CryptDestroyHash(hHash);
1653 }
1654 }
1655 else
1656 {
1657 if (!hCryptProv)
1658 {
1659 SetLastError(ERROR_INVALID_PARAMETER);
1660 ret = FALSE;
1661 }
1662 else
1663 {
1664 ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1665 if (ret)
1666 {
1667 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1668 cbEncodedToBeSigned, 0);
1669 if (ret)
1670 ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
1671 pcbSignature);
1672 CryptDestroyHash(hHash);
1673 }
1674 }
1675 }
1676 return ret;
1677 }
1678
1679 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1680 DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
1681 const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1682 const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
1683 {
1684 BOOL ret;
1685 DWORD encodedSize, hashSize;
1686
1687 TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
1688 dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
1689 pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
1690
1691 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
1692 NULL, &encodedSize);
1693 if (ret)
1694 {
1695 PBYTE encoded = CryptMemAlloc(encodedSize);
1696
1697 if (encoded)
1698 {
1699 ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
1700 pvStructInfo, encoded, &encodedSize);
1701 if (ret)
1702 {
1703 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1704 dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
1705 pvHashAuxInfo, NULL, &hashSize);
1706 if (ret)
1707 {
1708 PBYTE hash = CryptMemAlloc(hashSize);
1709
1710 if (hash)
1711 {
1712 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1713 dwCertEncodingType, encoded, encodedSize,
1714 pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
1715 if (ret)
1716 {
1717 CERT_SIGNED_CONTENT_INFO info = { { 0 } };
1718
1719 info.ToBeSigned.cbData = encodedSize;
1720 info.ToBeSigned.pbData = encoded;
1721 memcpy(&info.SignatureAlgorithm,
1722 pSignatureAlgorithm,
1723 sizeof(info.SignatureAlgorithm));
1724 info.Signature.cbData = hashSize;
1725 info.Signature.pbData = hash;
1726 info.Signature.cUnusedBits = 0;
1727 ret = CryptEncodeObject(dwCertEncodingType,
1728 X509_CERT, &info, pbEncoded, pcbEncoded);
1729 }
1730 CryptMemFree(hash);
1731 }
1732 }
1733 }
1734 CryptMemFree(encoded);
1735 }
1736 }
1737 return ret;
1738 }
1739
1740 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
1741 DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1742 PCERT_PUBLIC_KEY_INFO pPublicKey)
1743 {
1744 return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
1745 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
1746 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
1747 }
1748
1749 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
1750 DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
1751 const CERT_SIGNED_CONTENT_INFO *signedCert)
1752 {
1753 BOOL ret;
1754 HCRYPTKEY key;
1755 PCCRYPT_OID_INFO info;
1756 ALG_ID pubKeyID, hashID;
1757
1758 info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1759 signedCert->SignatureAlgorithm.pszObjId, 0);
1760 if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
1761 {
1762 SetLastError(NTE_BAD_ALGID);
1763 return FALSE;
1764 }
1765 hashID = info->u.Algid;
1766 if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
1767 pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
1768 else
1769 pubKeyID = hashID;
1770 /* Load the default provider if necessary */
1771 if (!hCryptProv)
1772 hCryptProv = CRYPT_GetDefaultProvider();
1773 ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
1774 pubKeyInfo, pubKeyID, 0, NULL, &key);
1775 if (ret)
1776 {
1777 HCRYPTHASH hash;
1778
1779 ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
1780 if (ret)
1781 {
1782 ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
1783 signedCert->ToBeSigned.cbData, 0);
1784 if (ret)
1785 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
1786 signedCert->Signature.cbData, key, NULL, 0);
1787 CryptDestroyHash(hash);
1788 }
1789 CryptDestroyKey(key);
1790 }
1791 return ret;
1792 }
1793
1794 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
1795 DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
1796 DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
1797 {
1798 BOOL ret = TRUE;
1799 CRYPT_DATA_BLOB subjectBlob;
1800
1801 TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
1802 dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
1803 dwFlags, pvReserved);
1804
1805 switch (dwSubjectType)
1806 {
1807 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
1808 {
1809 PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvSubject;
1810
1811 subjectBlob.pbData = blob->pbData;
1812 subjectBlob.cbData = blob->cbData;
1813 break;
1814 }
1815 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
1816 {
1817 PCERT_CONTEXT context = (PCERT_CONTEXT)pvSubject;
1818
1819 subjectBlob.pbData = context->pbCertEncoded;
1820 subjectBlob.cbData = context->cbCertEncoded;
1821 break;
1822 }
1823 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
1824 {
1825 PCRL_CONTEXT context = (PCRL_CONTEXT)pvSubject;
1826
1827 subjectBlob.pbData = context->pbCrlEncoded;
1828 subjectBlob.cbData = context->cbCrlEncoded;
1829 break;
1830 }
1831 default:
1832 SetLastError(E_INVALIDARG);
1833 ret = FALSE;
1834 }
1835
1836 if (ret)
1837 {
1838 PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
1839 DWORD size = 0;
1840
1841 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1842 subjectBlob.pbData, subjectBlob.cbData,
1843 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1844 (BYTE *)&signedCert, &size);
1845 if (ret)
1846 {
1847 switch (dwIssuerType)
1848 {
1849 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
1850 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1851 dwCertEncodingType, (PCERT_PUBLIC_KEY_INFO)pvIssuer,
1852 signedCert);
1853 break;
1854 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
1855 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1856 dwCertEncodingType,
1857 &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
1858 signedCert);
1859 break;
1860 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
1861 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
1862 ret = FALSE;
1863 break;
1864 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
1865 if (pvIssuer)
1866 {
1867 SetLastError(E_INVALIDARG);
1868 ret = FALSE;
1869 }
1870 else
1871 {
1872 FIXME("unimplemented for NULL signer\n");
1873 SetLastError(E_INVALIDARG);
1874 ret = FALSE;
1875 }
1876 break;
1877 default:
1878 SetLastError(E_INVALIDARG);
1879 ret = FALSE;
1880 }
1881 LocalFree(signedCert);
1882 }
1883 }
1884 return ret;
1885 }
1886
1887 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
1888 PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
1889 {
1890 PCERT_ENHKEY_USAGE usage = NULL;
1891 DWORD bytesNeeded;
1892 BOOL ret = TRUE;
1893
1894 if (!pCertContext || !pcbUsage)
1895 {
1896 SetLastError(ERROR_INVALID_PARAMETER);
1897 return FALSE;
1898 }
1899
1900 TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
1901
1902 if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
1903 {
1904 DWORD propSize = 0;
1905
1906 if (CertGetCertificateContextProperty(pCertContext,
1907 CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
1908 {
1909 LPBYTE buf = CryptMemAlloc(propSize);
1910
1911 if (buf)
1912 {
1913 if (CertGetCertificateContextProperty(pCertContext,
1914 CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
1915 {
1916 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1917 X509_ENHANCED_KEY_USAGE, buf, propSize,
1918 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1919 }
1920 CryptMemFree(buf);
1921 }
1922 }
1923 }
1924 if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
1925 {
1926 PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
1927 pCertContext->pCertInfo->cExtension,
1928 pCertContext->pCertInfo->rgExtension);
1929
1930 if (ext)
1931 {
1932 ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1933 X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
1934 CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1935 }
1936 }
1937 if (!usage)
1938 {
1939 /* If a particular location is specified, this should fail. Otherwise
1940 * it should succeed with an empty usage. (This is true on Win2k and
1941 * later, which we emulate.)
1942 */
1943 if (dwFlags)
1944 {
1945 SetLastError(CRYPT_E_NOT_FOUND);
1946 ret = FALSE;
1947 }
1948 else
1949 bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
1950 }
1951
1952 if (ret)
1953 {
1954 if (!pUsage)
1955 *pcbUsage = bytesNeeded;
1956 else if (*pcbUsage < bytesNeeded)
1957 {
1958 SetLastError(ERROR_MORE_DATA);
1959 *pcbUsage = bytesNeeded;
1960 ret = FALSE;
1961 }
1962 else
1963 {
1964 *pcbUsage = bytesNeeded;
1965 if (usage)
1966 {
1967 DWORD i;
1968 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
1969 sizeof(CERT_ENHKEY_USAGE) +
1970 usage->cUsageIdentifier * sizeof(LPSTR));
1971
1972 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
1973 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
1974 sizeof(CERT_ENHKEY_USAGE));
1975 for (i = 0; i < usage->cUsageIdentifier; i++)
1976 {
1977 pUsage->rgpszUsageIdentifier[i] = nextOID;
1978 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1979 nextOID += strlen(nextOID) + 1;
1980 }
1981 }
1982 else
1983 pUsage->cUsageIdentifier = 0;
1984 }
1985 }
1986 if (usage)
1987 LocalFree(usage);
1988 TRACE("returning %d\n", ret);
1989 return ret;
1990 }
1991
1992 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
1993 PCERT_ENHKEY_USAGE pUsage)
1994 {
1995 BOOL ret;
1996
1997 TRACE("(%p, %p)\n", pCertContext, pUsage);
1998
1999 if (pUsage)
2000 {
2001 CRYPT_DATA_BLOB blob = { 0, NULL };
2002
2003 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2004 pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2005 if (ret)
2006 {
2007 ret = CertSetCertificateContextProperty(pCertContext,
2008 CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2009 LocalFree(blob.pbData);
2010 }
2011 }
2012 else
2013 ret = CertSetCertificateContextProperty(pCertContext,
2014 CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2015 return ret;
2016 }
2017
2018 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2019 LPCSTR pszUsageIdentifier)
2020 {
2021 BOOL ret;
2022 DWORD size;
2023
2024 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2025
2026 if (CertGetEnhancedKeyUsage(pCertContext,
2027 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2028 {
2029 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2030
2031 if (usage)
2032 {
2033 ret = CertGetEnhancedKeyUsage(pCertContext,
2034 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2035 if (ret)
2036 {
2037 DWORD i;
2038 BOOL exists = FALSE;
2039
2040 /* Make sure usage doesn't already exist */
2041 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2042 {
2043 if (!strcmp(usage->rgpszUsageIdentifier[i],
2044 pszUsageIdentifier))
2045 exists = TRUE;
2046 }
2047 if (!exists)
2048 {
2049 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2050 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2051
2052 if (newUsage)
2053 {
2054 LPSTR nextOID;
2055
2056 newUsage->rgpszUsageIdentifier = (LPSTR *)
2057 ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2058 nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2059 + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2060 for (i = 0; i < usage->cUsageIdentifier; i++)
2061 {
2062 newUsage->rgpszUsageIdentifier[i] = nextOID;
2063 strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2064 nextOID += strlen(nextOID) + 1;
2065 }
2066 newUsage->rgpszUsageIdentifier[i] = nextOID;
2067 strcpy(nextOID, pszUsageIdentifier);
2068 newUsage->cUsageIdentifier = i + 1;
2069 ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2070 CryptMemFree(newUsage);
2071 }
2072 else
2073 ret = FALSE;
2074 }
2075 }
2076 CryptMemFree(usage);
2077 }
2078 else
2079 ret = FALSE;
2080 }
2081 else
2082 {
2083 PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2084 sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2085
2086 if (usage)
2087 {
2088 usage->rgpszUsageIdentifier =
2089 (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2090 usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2091 sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2092 strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2093 usage->cUsageIdentifier = 1;
2094 ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2095 CryptMemFree(usage);
2096 }
2097 else
2098 ret = FALSE;
2099 }
2100 return ret;
2101 }
2102
2103 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2104 LPCSTR pszUsageIdentifier)
2105 {
2106 BOOL ret;
2107 DWORD size;
2108 CERT_ENHKEY_USAGE usage;
2109
2110 TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2111
2112 size = sizeof(usage);
2113 ret = CertGetEnhancedKeyUsage(pCertContext,
2114 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2115 if (!ret && GetLastError() == ERROR_MORE_DATA)
2116 {
2117 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2118
2119 if (pUsage)
2120 {
2121 ret = CertGetEnhancedKeyUsage(pCertContext,
2122 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2123 if (ret)
2124 {
2125 if (pUsage->cUsageIdentifier)
2126 {
2127 DWORD i;
2128 BOOL found = FALSE;
2129
2130 for (i = 0; i < pUsage->cUsageIdentifier; i++)
2131 {
2132 if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2133 pszUsageIdentifier))
2134 found = TRUE;
2135 if (found && i < pUsage->cUsageIdentifier - 1)
2136 pUsage->rgpszUsageIdentifier[i] =
2137 pUsage->rgpszUsageIdentifier[i + 1];
2138 }
2139 pUsage->cUsageIdentifier--;
2140 /* Remove the usage if it's empty */
2141 if (pUsage->cUsageIdentifier)
2142 ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2143 else
2144 ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2145 }
2146 }
2147 CryptMemFree(pUsage);
2148 }
2149 else
2150 ret = FALSE;
2151 }
2152 else
2153 {
2154 /* it fit in an empty usage, therefore there's nothing to remove */
2155 ret = TRUE;
2156 }
2157 return ret;
2158 }
2159
2160 struct BitField
2161 {
2162 DWORD cIndexes;
2163 DWORD *indexes;
2164 };
2165
2166 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2167
2168 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2169 {
2170 DWORD indexIndex = bit / BITS_PER_DWORD;
2171
2172 if (indexIndex + 1 > field->cIndexes)
2173 {
2174 if (field->cIndexes)
2175 field->indexes = CryptMemRealloc(field->indexes,
2176 (indexIndex + 1) * sizeof(DWORD));
2177 else
2178 field->indexes = CryptMemAlloc(sizeof(DWORD));
2179 if (field->indexes)
2180 {
2181 field->indexes[indexIndex] = 0;
2182 field->cIndexes = indexIndex + 1;
2183 }
2184 }
2185 if (field->indexes)
2186 field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2187 }
2188
2189 static BOOL CRYPT_IsBitInFieldSet(struct BitField *field, DWORD bit)
2190 {
2191 BOOL set = FALSE;
2192 DWORD indexIndex = bit / BITS_PER_DWORD;
2193
2194 assert(field->cIndexes);
2195 set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2196 return set;
2197 }
2198
2199 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2200 int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2201 {
2202 BOOL ret = TRUE;
2203 DWORD i, cbOIDs = 0;
2204 BOOL allUsagesValid = TRUE;
2205 CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2206
2207 TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2208 rghOIDs, *pcbOIDs);
2209
2210 for (i = 0; i < cCerts; i++)
2211 {
2212 CERT_ENHKEY_USAGE usage;
2213 DWORD size = sizeof(usage);
2214
2215 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2216 /* Success is deliberately ignored: it implies all usages are valid */
2217 if (!ret && GetLastError() == ERROR_MORE_DATA)
2218 {
2219 PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2220
2221 allUsagesValid = FALSE;
2222 if (pUsage)
2223 {
2224 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2225 if (ret)
2226 {
2227 if (!validUsages.cUsageIdentifier)
2228 {
2229 DWORD j;
2230
2231 cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2232 validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2233 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2234 cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2235 + 1;
2236 validUsages.rgpszUsageIdentifier =
2237 CryptMemAlloc(cbOIDs);
2238 if (validUsages.rgpszUsageIdentifier)
2239 {
2240 LPSTR nextOID = (LPSTR)
2241 ((LPBYTE)validUsages.rgpszUsageIdentifier +
2242 validUsages.cUsageIdentifier * sizeof(LPSTR));
2243
2244 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2245 {
2246 validUsages.rgpszUsageIdentifier[j] = nextOID;
2247 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2248 pUsage->rgpszUsageIdentifier[j]);
2249 nextOID += lstrlenA(nextOID) + 1;
2250 }
2251 }
2252 }
2253 else
2254 {
2255 struct BitField validIndexes = { 0, NULL };
2256 DWORD j, k, numRemoved = 0;
2257
2258 /* Merge: build a bitmap of all the indexes of
2259 * validUsages.rgpszUsageIdentifier that are in pUsage.
2260 */
2261 for (j = 0; j < pUsage->cUsageIdentifier; j++)
2262 {
2263 for (k = 0; k < validUsages.cUsageIdentifier; k++)
2264 {
2265 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2266 validUsages.rgpszUsageIdentifier[k]))
2267 {
2268 CRYPT_SetBitInField(&validIndexes, k);
2269 break;
2270 }
2271 }
2272 }
2273 /* Merge by removing from validUsages those that are
2274 * not in the bitmap.
2275 */
2276 for (j = 0; j < validUsages.cUsageIdentifier; j++)
2277 {
2278 if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2279 {
2280 if (j < validUsages.cUsageIdentifier - 1)
2281 {
2282 memmove(&validUsages.rgpszUsageIdentifier[j],
2283 &validUsages.rgpszUsageIdentifier[j +
2284 numRemoved + 1],
2285 (validUsages.cUsageIdentifier - numRemoved
2286 - j - 1) * sizeof(LPSTR));
2287 cbOIDs -= lstrlenA(
2288 validUsages.rgpszUsageIdentifier[j]) + 1 +
2289 sizeof(LPSTR);
2290 validUsages.cUsageIdentifier--;
2291 numRemoved++;
2292 }
2293 else
2294 validUsages.cUsageIdentifier--;
2295 }
2296 }
2297 CryptMemFree(validIndexes.indexes);
2298 }
2299 }
2300 CryptMemFree(pUsage);
2301 }
2302 }
2303 }
2304 ret = TRUE;
2305 if (allUsagesValid)
2306 {
2307 *cNumOIDs = -1;
2308 *pcbOIDs = 0;
2309 }
2310 else
2311 {
2312 *cNumOIDs = validUsages.cUsageIdentifier;
2313 if (!rghOIDs)
2314 *pcbOIDs = cbOIDs;
2315 else if (*pcbOIDs < cbOIDs)
2316 {
2317 *pcbOIDs = cbOIDs;
2318 SetLastError(ERROR_MORE_DATA);
2319 ret = FALSE;
2320 }
2321 else
2322 {
2323 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2324 validUsages.cUsageIdentifier * sizeof(LPSTR));
2325
2326 *pcbOIDs = cbOIDs;
2327 for (i = 0; i < validUsages.cUsageIdentifier; i++)
2328 {
2329 rghOIDs[i] = nextOID;
2330 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2331 nextOID += lstrlenA(nextOID) + 1;
2332 }
2333 }
2334 }
2335 CryptMemFree(validUsages.rgpszUsageIdentifier);
2336 TRACE("cNumOIDs: %d\n", *cNumOIDs);
2337 TRACE("returning %d\n", ret);
2338 return ret;
2339 }
2340
2341 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2342 * pInfo is NULL, from the attributes of hProv.
2343 */
2344 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2345 const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2346 {
2347 CRYPT_KEY_PROV_INFO info = { 0 };
2348 BOOL ret;
2349
2350 if (!pInfo)
2351 {
2352 DWORD size;
2353 int len;
2354
2355 ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2356 if (ret)
2357 {
2358 LPSTR szContainer = CryptMemAlloc(size);
2359
2360 if (szContainer)
2361 {
2362 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2363 (BYTE *)szContainer, &size, 0);
2364 if (ret)
2365 {
2366 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2367 NULL, 0);
2368 if (len)
2369 {
2370 info.pwszContainerName = CryptMemAlloc(len *
2371 sizeof(WCHAR));
2372 len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2373 info.pwszContainerName, len);
2374 }
2375 }
2376 CryptMemFree(szContainer);
2377 }
2378 }
2379 ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2380 if (ret)
2381 {
2382 LPSTR szProvider = CryptMemAlloc(size);
2383
2384 if (szProvider)
2385 {
2386 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2387 &size, 0);
2388 if (ret)
2389 {
2390 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2391 NULL, 0);
2392 if (len)
2393 {
2394 info.pwszProvName = CryptMemAlloc(len *
2395 sizeof(WCHAR));
2396 len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2397 info.pwszProvName, len);
2398 }
2399 }
2400 CryptMemFree(szProvider);
2401 }
2402 }
2403 size = sizeof(info.dwKeySpec);
2404 /* in case no CRYPT_KEY_PROV_INFO given,
2405 * we always use AT_SIGNATURE key spec
2406 */
2407 info.dwKeySpec = AT_SIGNATURE;
2408 size = sizeof(info.dwProvType);
2409 ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2410 &size, 0);
2411 if (!ret)
2412 info.dwProvType = PROV_RSA_FULL;
2413 pInfo = &info;
2414 }
2415
2416 ret = CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2417 0, pInfo);
2418
2419 if (pInfo == &info)
2420 {
2421 CryptMemFree(info.pwszContainerName);
2422 CryptMemFree(info.pwszProvName);
2423 }
2424 }
2425
2426 /* Creates a signed certificate context from the unsigned, encoded certificate
2427 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2428 */
2429 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2430 HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2431 {
2432 PCCERT_CONTEXT context = NULL;
2433 BOOL ret;
2434 DWORD sigSize = 0;
2435
2436 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2437 blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2438 if (ret)
2439 {
2440 LPBYTE sig = CryptMemAlloc(sigSize);
2441
2442 ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2443 blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2444 if (ret)
2445 {
2446 CERT_SIGNED_CONTENT_INFO signedInfo;
2447 BYTE *encodedSignedCert = NULL;
2448 DWORD encodedSignedCertSize = 0;
2449
2450 signedInfo.ToBeSigned.cbData = blob->cbData;
2451 signedInfo.ToBeSigned.pbData = blob->pbData;
2452 memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2453 sizeof(signedInfo.SignatureAlgorithm));
2454 signedInfo.Signature.cbData = sigSize;
2455 signedInfo.Signature.pbData = sig;
2456 signedInfo.Signature.cUnusedBits = 0;
2457 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2458 &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2459 (BYTE *)&encodedSignedCert, &encodedSignedCertSize);
2460 if (ret)
2461 {
2462 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2463 encodedSignedCert, encodedSignedCertSize);
2464 LocalFree(encodedSignedCert);
2465 }
2466 }
2467 CryptMemFree(sig);
2468 }
2469 return context;
2470 }
2471
2472 /* Copies data from the parameters into info, where:
2473 * pSerialNumber: The serial number. Must not be NULL.
2474 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2475 * Must not be NULL
2476 * pSignatureAlgorithm: Optional.
2477 * pStartTime: The starting time of the certificate. If NULL, the current
2478 * system time is used.
2479 * pEndTime: The ending time of the certificate. If NULL, one year past the
2480 * starting time is used.
2481 * pubKey: The public key of the certificate. Must not be NULL.
2482 * pExtensions: Extensions to be included with the certificate. Optional.
2483 */
2484 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2485 const CERT_NAME_BLOB *pSubjectIssuerBlob,
2486 const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2487 const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2488 const CERT_EXTENSIONS *pExtensions)
2489 {
2490 static CHAR oid[] = szOID_RSA_SHA1RSA;
2491
2492 assert(info);
2493 assert(pSerialNumber);
2494 assert(pSubjectIssuerBlob);
2495 assert(pubKey);
2496
2497 info->dwVersion = CERT_V3;
2498 info->SerialNumber.cbData = pSerialNumber->cbData;
2499 info->SerialNumber.pbData = pSerialNumber->pbData;
2500 if (pSignatureAlgorithm)
2501 memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2502 sizeof(info->SignatureAlgorithm));
2503 else
2504 {
2505 info->SignatureAlgorithm.pszObjId = oid;
2506 info->SignatureAlgorithm.Parameters.cbData = 0;
2507 info->SignatureAlgorithm.Parameters.pbData = NULL;
2508 }
2509 info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2510 info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2511 if (pStartTime)
2512 SystemTimeToFileTime(pStartTime, &info->NotBefore);
2513 else
2514 GetSystemTimeAsFileTime(&info->NotBefore);
2515 if (pEndTime)
2516 SystemTimeToFileTime(pEndTime, &info->NotAfter);
2517 else
2518 {
2519 SYSTEMTIME endTime;
2520
2521 if (FileTimeToSystemTime(&info->NotBefore, &endTime))
2522 {
2523 endTime.wYear++;
2524 SystemTimeToFileTime(&endTime, &info->NotAfter);
2525 }
2526 }
2527 info->Subject.cbData = pSubjectIssuerBlob->cbData;
2528 info->Subject.pbData = pSubjectIssuerBlob->pbData;
2529 memcpy(&info->SubjectPublicKeyInfo, pubKey,
2530 sizeof(info->SubjectPublicKeyInfo));
2531 if (pExtensions)
2532 {
2533 info->cExtension = pExtensions->cExtension;
2534 info->rgExtension = pExtensions->rgExtension;
2535 }
2536 else
2537 {
2538 info->cExtension = 0;
2539 info->rgExtension = NULL;
2540 }
2541 }
2542
2543 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
2544 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
2545 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
2546
2547 static HCRYPTPROV CRYPT_CreateKeyProv(void)
2548 {
2549 HCRYPTPROV hProv = 0;
2550 HMODULE rpcrt = LoadLibraryA("rpcrt4");
2551
2552 if (rpcrt)
2553 {
2554 UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
2555 "UuidCreate");
2556 UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
2557 "UuidToStringA");
2558 RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
2559 rpcrt, "RpcStringFreeA");
2560
2561 if (uuidCreate && uuidToString && rpcStringFree)
2562 {
2563 UUID uuid;
2564 RPC_STATUS status = uuidCreate(&uuid);
2565
2566 if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
2567 {
2568 unsigned char *uuidStr;
2569
2570 status = uuidToString(&uuid, &uuidStr);
2571 if (status == RPC_S_OK)
2572 {
2573 BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
2574 MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
2575
2576 if (ret)
2577 {
2578 HCRYPTKEY key;
2579
2580 ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
2581 if (ret)
2582 CryptDestroyKey(key);
2583 }
2584 rpcStringFree(&uuidStr);
2585 }
2586 }
2587 }
2588 FreeLibrary(rpcrt);
2589 }
2590 return hProv;
2591 }
2592
2593 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
2594 PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
2595 PCRYPT_KEY_PROV_INFO pKeyProvInfo,
2596 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
2597 PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
2598 {
2599 PCCERT_CONTEXT context = NULL;
2600 BOOL ret, releaseContext = FALSE;
2601 PCERT_PUBLIC_KEY_INFO pubKey = NULL;
2602 DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
2603
2604 TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
2605 pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
2606 pExtensions, pExtensions);
2607
2608 if(!pSubjectIssuerBlob)
2609 {
2610 SetLastError(ERROR_INVALID_PARAMETER);
2611 return NULL;
2612 }
2613
2614 if (!hProv)
2615 {
2616 if (!pKeyProvInfo)
2617 {
2618 hProv = CRYPT_CreateKeyProv();
2619 releaseContext = TRUE;
2620 }
2621 else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
2622 {
2623 SetLastError(NTE_BAD_FLAGS);
2624 return NULL;
2625 }
2626 else
2627 {
2628 HCRYPTKEY hKey = 0;
2629 /* acquire the context using the given information*/
2630 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2631 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2632 pKeyProvInfo->dwFlags);
2633 if (!ret)
2634 {
2635 if(GetLastError() != NTE_BAD_KEYSET)
2636 return NULL;
2637 /* create the key set */
2638 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2639 pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2640 pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
2641 if (!ret)
2642 return NULL;
2643 }
2644 dwKeySpec = pKeyProvInfo->dwKeySpec;
2645 /* check if the key is here */
2646 ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
2647 if(!ret)
2648 {
2649 if (NTE_NO_KEY == GetLastError())
2650 { /* generate the key */
2651 ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
2652 }
2653 if (!ret)
2654 {
2655 CryptReleaseContext(hProv,0);
2656 SetLastError(NTE_BAD_KEYSET);
2657 return NULL;
2658 }
2659 }
2660 CryptDestroyKey(hKey);
2661 releaseContext = TRUE;
2662 }
2663 }
2664 else if (pKeyProvInfo)
2665 {
2666 SetLastError(ERROR_INVALID_PARAMETER);
2667 return NULL;
2668 }
2669
2670 CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
2671 &pubKeySize);
2672 pubKey = CryptMemAlloc(pubKeySize);
2673 if (pubKey)
2674 {
2675 ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
2676 pubKey, &pubKeySize);
2677 if (ret)
2678 {
2679 CERT_INFO info = { 0 };
2680 CRYPT_DER_BLOB blob = { 0, NULL };
2681 BYTE serial[16];
2682 CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
2683
2684 CryptGenRandom(hProv, sizeof(serial), serial);
2685 CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
2686 pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
2687 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
2688 &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&blob.pbData,
2689 &blob.cbData);
2690 if (ret)
2691 {
2692 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
2693 context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
2694 &info.SignatureAlgorithm);
2695 else
2696 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2697 blob.pbData, blob.cbData);
2698 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
2699 CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
2700 LocalFree(blob.pbData);
2701 }
2702 }
2703 CryptMemFree(pubKey);
2704 }
2705 if (releaseContext)
2706 CryptReleaseContext(hProv, 0);
2707 return context;
2708 }
2709
2710 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
2711 void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
2712 PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
2713 PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
2714 {
2715 FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
2716 dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
2717 pVerifyUsageStatus);
2718 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
2719 return FALSE;
2720 }
Maarten's multimedia branch