2 * Copyright 2004-2006 Juan Lang
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
27 #include "wine/debug.h"
28 #include "crypt32_private.h"
30 WINE_DEFAULT_DEBUG_CHANNEL(crypt
);
32 /* Internal version of CertGetCertificateContextProperty that gets properties
33 * directly from the context (or the context it's linked to, depending on its
34 * type.) Doesn't handle special-case properties, since they are handled by
35 * CertGetCertificateContextProperty, and are particular to the store in which
36 * the property exists (which is separate from the context.)
38 static BOOL WINAPI
CertContext_GetProperty(void *context
, DWORD dwPropId
,
39 void *pvData
, DWORD
*pcbData
);
41 /* Internal version of CertSetCertificateContextProperty that sets properties
42 * directly on the context (or the context it's linked to, depending on its
43 * type.) Doesn't handle special cases, since they're handled by
44 * CertSetCertificateContextProperty anyway.
46 static BOOL WINAPI
CertContext_SetProperty(void *context
, DWORD dwPropId
,
47 DWORD dwFlags
, const void *pvData
);
49 BOOL WINAPI
CertAddEncodedCertificateToStore(HCERTSTORE hCertStore
,
50 DWORD dwCertEncodingType
, const BYTE
*pbCertEncoded
, DWORD cbCertEncoded
,
51 DWORD dwAddDisposition
, PCCERT_CONTEXT
*ppCertContext
)
53 PCCERT_CONTEXT cert
= CertCreateCertificateContext(dwCertEncodingType
,
54 pbCertEncoded
, cbCertEncoded
);
57 TRACE("(%p, %08lx, %p, %ld, %08lx, %p)\n", hCertStore
, dwCertEncodingType
,
58 pbCertEncoded
, cbCertEncoded
, dwAddDisposition
, ppCertContext
);
62 ret
= CertAddCertificateContextToStore(hCertStore
, cert
,
63 dwAddDisposition
, ppCertContext
);
64 CertFreeCertificateContext(cert
);
71 PCCERT_CONTEXT WINAPI
CertCreateCertificateContext(DWORD dwCertEncodingType
,
72 const BYTE
*pbCertEncoded
, DWORD cbCertEncoded
)
74 PCERT_CONTEXT cert
= NULL
;
76 PCERT_INFO certInfo
= NULL
;
79 TRACE("(%08lx, %p, %ld)\n", dwCertEncodingType
, pbCertEncoded
,
82 ret
= CryptDecodeObjectEx(dwCertEncodingType
, X509_CERT_TO_BE_SIGNED
,
83 pbCertEncoded
, cbCertEncoded
, CRYPT_DECODE_ALLOC_FLAG
, NULL
,
84 (BYTE
*)&certInfo
, &size
);
89 cert
= (PCERT_CONTEXT
)Context_CreateDataContext(sizeof(CERT_CONTEXT
));
92 data
= CryptMemAlloc(cbCertEncoded
);
99 memcpy(data
, pbCertEncoded
, cbCertEncoded
);
100 cert
->dwCertEncodingType
= dwCertEncodingType
;
101 cert
->pbCertEncoded
= data
;
102 cert
->cbCertEncoded
= cbCertEncoded
;
103 cert
->pCertInfo
= certInfo
;
104 cert
->hCertStore
= 0;
108 return (PCCERT_CONTEXT
)cert
;
111 PCCERT_CONTEXT WINAPI
CertDuplicateCertificateContext(
112 PCCERT_CONTEXT pCertContext
)
114 TRACE("(%p)\n", pCertContext
);
115 Context_AddRef((void *)pCertContext
, sizeof(CERT_CONTEXT
));
119 static void CertDataContext_Free(void *context
)
121 PCERT_CONTEXT certContext
= (PCERT_CONTEXT
)context
;
123 CryptMemFree(certContext
->pbCertEncoded
);
124 LocalFree(certContext
->pCertInfo
);
127 BOOL WINAPI
CertFreeCertificateContext(PCCERT_CONTEXT pCertContext
)
129 TRACE("(%p)\n", pCertContext
);
132 Context_Release((void *)pCertContext
, sizeof(CERT_CONTEXT
),
133 CertDataContext_Free
);
137 DWORD WINAPI
CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext
,
140 PCONTEXT_PROPERTY_LIST properties
= Context_GetProperties(
141 (void *)pCertContext
, sizeof(CERT_CONTEXT
));
144 TRACE("(%p, %ld)\n", pCertContext
, dwPropId
);
147 ret
= ContextPropertyList_EnumPropIDs(properties
, dwPropId
);
153 static BOOL
CertContext_GetHashProp(void *context
, DWORD dwPropId
,
154 ALG_ID algID
, const BYTE
*toHash
, DWORD toHashLen
, void *pvData
,
157 BOOL ret
= CryptHashCertificate(0, algID
, 0, toHash
, toHashLen
, pvData
,
161 CRYPT_DATA_BLOB blob
= { *pcbData
, pvData
};
163 ret
= CertContext_SetProperty(context
, dwPropId
, 0, &blob
);
168 static BOOL WINAPI
CertContext_GetProperty(void *context
, DWORD dwPropId
,
169 void *pvData
, DWORD
*pcbData
)
171 PCCERT_CONTEXT pCertContext
= (PCCERT_CONTEXT
)context
;
172 PCONTEXT_PROPERTY_LIST properties
=
173 Context_GetProperties(context
, sizeof(CERT_CONTEXT
));
175 CRYPT_DATA_BLOB blob
;
177 TRACE("(%p, %ld, %p, %p)\n", context
, dwPropId
, pvData
, pcbData
);
180 ret
= ContextPropertyList_FindProperty(properties
, dwPropId
, &blob
);
187 *pcbData
= blob
.cbData
;
190 else if (*pcbData
< blob
.cbData
)
192 SetLastError(ERROR_MORE_DATA
);
193 *pcbData
= blob
.cbData
;
197 memcpy(pvData
, blob
.pbData
, blob
.cbData
);
198 *pcbData
= blob
.cbData
;
204 /* Implicit properties */
207 case CERT_SHA1_HASH_PROP_ID
:
208 ret
= CertContext_GetHashProp(context
, dwPropId
, CALG_SHA1
,
209 pCertContext
->pbCertEncoded
, pCertContext
->cbCertEncoded
, pvData
,
212 case CERT_MD5_HASH_PROP_ID
:
213 ret
= CertContext_GetHashProp(context
, dwPropId
, CALG_MD5
,
214 pCertContext
->pbCertEncoded
, pCertContext
->cbCertEncoded
, pvData
,
217 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID
:
218 ret
= CertContext_GetHashProp(context
, dwPropId
, CALG_MD5
,
219 pCertContext
->pCertInfo
->Subject
.pbData
,
220 pCertContext
->pCertInfo
->Subject
.cbData
,
223 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID
:
224 ret
= CertContext_GetHashProp(context
, dwPropId
, CALG_MD5
,
225 pCertContext
->pCertInfo
->SubjectPublicKeyInfo
.PublicKey
.pbData
,
226 pCertContext
->pCertInfo
->SubjectPublicKeyInfo
.PublicKey
.cbData
,
229 case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID
:
230 ret
= CertContext_GetHashProp(context
, dwPropId
, CALG_MD5
,
231 pCertContext
->pCertInfo
->SerialNumber
.pbData
,
232 pCertContext
->pCertInfo
->SerialNumber
.cbData
,
235 case CERT_SIGNATURE_HASH_PROP_ID
:
236 FIXME("CERT_SIGNATURE_HASH_PROP_ID unimplemented\n");
237 SetLastError(CRYPT_E_NOT_FOUND
);
240 SetLastError(CRYPT_E_NOT_FOUND
);
243 TRACE("returning %d\n", ret
);
247 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info
)
249 DWORD i
, containerLen
, provNameLen
;
250 LPBYTE data
= (LPBYTE
)info
+ sizeof(CRYPT_KEY_PROV_INFO
);
252 info
->pwszContainerName
= (LPWSTR
)data
;
253 containerLen
= (lstrlenW(info
->pwszContainerName
) + 1) * sizeof(WCHAR
);
254 data
+= containerLen
;
256 info
->pwszProvName
= (LPWSTR
)data
;
257 provNameLen
= (lstrlenW(info
->pwszProvName
) + 1) * sizeof(WCHAR
);
260 info
->rgProvParam
= (PCRYPT_KEY_PROV_PARAM
)data
;
261 data
+= info
->cProvParam
* sizeof(CRYPT_KEY_PROV_PARAM
);
263 for (i
= 0; i
< info
->cProvParam
; i
++)
265 info
->rgProvParam
[i
].pbData
= data
;
266 data
+= info
->rgProvParam
[i
].cbData
;
270 BOOL WINAPI
CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext
,
271 DWORD dwPropId
, void *pvData
, DWORD
*pcbData
)
275 TRACE("(%p, %ld, %p, %p)\n", pCertContext
, dwPropId
, pvData
, pcbData
);
280 case CERT_CERT_PROP_ID
:
281 case CERT_CRL_PROP_ID
:
282 case CERT_CTL_PROP_ID
:
283 SetLastError(E_INVALIDARG
);
286 case CERT_ACCESS_STATE_PROP_ID
:
289 *pcbData
= sizeof(DWORD
);
292 else if (*pcbData
< sizeof(DWORD
))
294 SetLastError(ERROR_MORE_DATA
);
295 *pcbData
= sizeof(DWORD
);
301 CertStore_GetAccessState(pCertContext
->hCertStore
);
305 case CERT_KEY_IDENTIFIER_PROP_ID
:
306 ret
= CertContext_GetProperty((void *)pCertContext
, dwPropId
,
309 SetLastError(ERROR_INVALID_DATA
);
311 case CERT_KEY_PROV_HANDLE_PROP_ID
:
313 CERT_KEY_CONTEXT keyContext
;
314 DWORD size
= sizeof(keyContext
);
316 ret
= CertContext_GetProperty((void *)pCertContext
,
317 CERT_KEY_CONTEXT_PROP_ID
, &keyContext
, &size
);
322 *pcbData
= sizeof(HCRYPTPROV
);
325 else if (*pcbData
< sizeof(HCRYPTPROV
))
327 SetLastError(ERROR_MORE_DATA
);
328 *pcbData
= sizeof(HCRYPTPROV
);
333 *(HCRYPTPROV
*)pvData
= keyContext
.hCryptProv
;
339 case CERT_KEY_PROV_INFO_PROP_ID
:
340 ret
= CertContext_GetProperty((void *)pCertContext
, dwPropId
, pvData
,
343 CRYPT_FixKeyProvInfoPointers((PCRYPT_KEY_PROV_INFO
)pvData
);
346 ret
= CertContext_GetProperty((void *)pCertContext
, dwPropId
, pvData
,
350 TRACE("returning %d\n", ret
);
354 /* Copies key provider info from from into to, where to is assumed to be a
355 * contiguous buffer of memory large enough for from and all its associated
356 * data, but whose pointers are uninitialized.
357 * Upon return, to contains a contiguous copy of from, packed in the following
359 * - CRYPT_KEY_PROV_INFO
360 * - pwszContainerName
362 * - rgProvParam[0]...
364 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to
,
365 PCRYPT_KEY_PROV_INFO from
)
368 LPBYTE nextData
= (LPBYTE
)to
+ sizeof(CRYPT_KEY_PROV_INFO
);
370 to
->pwszContainerName
= (LPWSTR
)nextData
;
371 lstrcpyW(to
->pwszContainerName
, from
->pwszContainerName
);
372 nextData
+= (lstrlenW(from
->pwszContainerName
) + 1) * sizeof(WCHAR
);
373 to
->pwszProvName
= (LPWSTR
)nextData
;
374 lstrcpyW(to
->pwszProvName
, from
->pwszProvName
);
375 nextData
+= (lstrlenW(from
->pwszProvName
) + 1) * sizeof(WCHAR
);
376 to
->dwProvType
= from
->dwProvType
;
377 to
->dwFlags
= from
->dwFlags
;
378 to
->cProvParam
= from
->cProvParam
;
379 to
->rgProvParam
= (PCRYPT_KEY_PROV_PARAM
)nextData
;
380 nextData
+= to
->cProvParam
* sizeof(CRYPT_KEY_PROV_PARAM
);
381 to
->dwKeySpec
= from
->dwKeySpec
;
382 for (i
= 0; i
< to
->cProvParam
; i
++)
384 memcpy(&to
->rgProvParam
[i
], &from
->rgProvParam
[i
],
385 sizeof(CRYPT_KEY_PROV_PARAM
));
386 to
->rgProvParam
[i
].pbData
= nextData
;
387 memcpy(to
->rgProvParam
[i
].pbData
, from
->rgProvParam
[i
].pbData
,
388 from
->rgProvParam
[i
].cbData
);
389 nextData
+= from
->rgProvParam
[i
].cbData
;
393 static BOOL
CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties
,
394 PCRYPT_KEY_PROV_INFO info
)
398 DWORD size
= sizeof(CRYPT_KEY_PROV_INFO
), i
, containerSize
, provNameSize
;
400 containerSize
= (lstrlenW(info
->pwszContainerName
) + 1) * sizeof(WCHAR
);
401 provNameSize
= (lstrlenW(info
->pwszProvName
) + 1) * sizeof(WCHAR
);
402 size
+= containerSize
+ provNameSize
;
403 for (i
= 0; i
< info
->cProvParam
; i
++)
404 size
+= sizeof(CRYPT_KEY_PROV_PARAM
) + info
->rgProvParam
[i
].cbData
;
405 buf
= CryptMemAlloc(size
);
408 CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO
)buf
, info
);
409 ret
= ContextPropertyList_SetProperty(properties
,
410 CERT_KEY_PROV_INFO_PROP_ID
, buf
, size
);
418 static BOOL WINAPI
CertContext_SetProperty(void *context
, DWORD dwPropId
,
419 DWORD dwFlags
, const void *pvData
)
421 PCONTEXT_PROPERTY_LIST properties
=
422 Context_GetProperties(context
, sizeof(CERT_CONTEXT
));
425 TRACE("(%p, %ld, %08lx, %p)\n", context
, dwPropId
, dwFlags
, pvData
);
433 case CERT_AUTO_ENROLL_PROP_ID
:
434 case CERT_CTL_USAGE_PROP_ID
: /* same as CERT_ENHKEY_USAGE_PROP_ID */
435 case CERT_DESCRIPTION_PROP_ID
:
436 case CERT_FRIENDLY_NAME_PROP_ID
:
437 case CERT_HASH_PROP_ID
:
438 case CERT_KEY_IDENTIFIER_PROP_ID
:
439 case CERT_MD5_HASH_PROP_ID
:
440 case CERT_NEXT_UPDATE_LOCATION_PROP_ID
:
441 case CERT_PUBKEY_ALG_PARA_PROP_ID
:
442 case CERT_PVK_FILE_PROP_ID
:
443 case CERT_SIGNATURE_HASH_PROP_ID
:
444 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID
:
445 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID
:
446 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID
:
447 case CERT_ENROLLMENT_PROP_ID
:
448 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID
:
449 case CERT_RENEWAL_PROP_ID
:
453 PCRYPT_DATA_BLOB blob
= (PCRYPT_DATA_BLOB
)pvData
;
455 ret
= ContextPropertyList_SetProperty(properties
, dwPropId
,
456 blob
->pbData
, blob
->cbData
);
460 ContextPropertyList_RemoveProperty(properties
, dwPropId
);
465 case CERT_DATE_STAMP_PROP_ID
:
467 ret
= ContextPropertyList_SetProperty(properties
, dwPropId
,
468 (LPBYTE
)pvData
, sizeof(FILETIME
));
471 ContextPropertyList_RemoveProperty(properties
, dwPropId
);
475 case CERT_KEY_CONTEXT_PROP_ID
:
479 PCERT_KEY_CONTEXT keyContext
= (PCERT_KEY_CONTEXT
)pvData
;
481 ret
= ContextPropertyList_SetProperty(properties
, dwPropId
,
482 (const BYTE
*)keyContext
, keyContext
->cbSize
);
486 ContextPropertyList_RemoveProperty(properties
, dwPropId
);
491 case CERT_KEY_PROV_INFO_PROP_ID
:
493 ret
= CertContext_SetKeyProvInfoProperty(properties
,
494 (PCRYPT_KEY_PROV_INFO
)pvData
);
497 ContextPropertyList_RemoveProperty(properties
, dwPropId
);
501 case CERT_KEY_PROV_HANDLE_PROP_ID
:
503 CERT_KEY_CONTEXT keyContext
;
504 DWORD size
= sizeof(keyContext
);
506 ret
= CertContext_GetProperty(context
, CERT_KEY_CONTEXT_PROP_ID
,
510 if (!(dwFlags
& CERT_STORE_NO_CRYPT_RELEASE_FLAG
))
511 CryptReleaseContext(keyContext
.hCryptProv
, 0);
513 keyContext
.hCryptProv
= *(HCRYPTPROV
*)pvData
;
515 keyContext
.hCryptProv
= 0;
516 ret
= CertContext_SetProperty(context
, CERT_KEY_CONTEXT_PROP_ID
,
522 FIXME("%ld: stub\n", dwPropId
);
526 TRACE("returning %d\n", ret
);
530 BOOL WINAPI
CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext
,
531 DWORD dwPropId
, DWORD dwFlags
, const void *pvData
)
535 TRACE("(%p, %ld, %08lx, %p)\n", pCertContext
, dwPropId
, dwFlags
, pvData
);
537 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
538 * crashes on most of these, I'll be safer.
543 case CERT_ACCESS_STATE_PROP_ID
:
544 case CERT_CERT_PROP_ID
:
545 case CERT_CRL_PROP_ID
:
546 case CERT_CTL_PROP_ID
:
547 SetLastError(E_INVALIDARG
);
550 ret
= CertContext_SetProperty((void *)pCertContext
, dwPropId
, dwFlags
,
552 TRACE("returning %d\n", ret
);
556 /* Acquires the private key using the key provider info, retrieving info from
557 * the certificate if info is NULL. The acquired provider is returned in
558 * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
560 static BOOL
CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert
,
561 PCRYPT_KEY_PROV_INFO info
, HCRYPTPROV
*phCryptProv
, DWORD
*pdwKeySpec
)
564 BOOL allocated
= FALSE
, ret
= TRUE
;
568 ret
= CertGetCertificateContextProperty(pCert
,
569 CERT_KEY_PROV_INFO_PROP_ID
, 0, &size
);
572 info
= (PCRYPT_KEY_PROV_INFO
)HeapAlloc(GetProcessHeap(), 0, size
);
575 ret
= CertGetCertificateContextProperty(pCert
,
576 CERT_KEY_PROV_INFO_PROP_ID
, info
, &size
);
581 SetLastError(CRYPT_E_NO_KEY_PROPERTY
);
585 ret
= CryptAcquireContextW(phCryptProv
, info
->pwszContainerName
,
586 info
->pwszProvName
, info
->dwProvType
, 0);
591 for (i
= 0; i
< info
->cProvParam
; i
++)
593 CryptSetProvParam(*phCryptProv
,
594 info
->rgProvParam
[i
].dwParam
, info
->rgProvParam
[i
].pbData
,
595 info
->rgProvParam
[i
].dwFlags
);
597 *pdwKeySpec
= info
->dwKeySpec
;
600 SetLastError(CRYPT_E_NO_KEY_PROPERTY
);
603 HeapFree(GetProcessHeap(), 0, info
);
607 BOOL WINAPI
CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert
,
608 DWORD dwFlags
, void *pvReserved
, HCRYPTPROV
*phCryptProv
, DWORD
*pdwKeySpec
,
609 BOOL
*pfCallerFreeProv
)
611 BOOL ret
= FALSE
, cache
= FALSE
;
612 PCRYPT_KEY_PROV_INFO info
= NULL
;
613 CERT_KEY_CONTEXT keyContext
;
616 TRACE("(%p, %08lx, %p, %p, %p, %p)\n", pCert
, dwFlags
, pvReserved
,
617 phCryptProv
, pdwKeySpec
, pfCallerFreeProv
);
619 if (dwFlags
& CRYPT_ACQUIRE_USE_PROV_INFO_FLAG
)
623 ret
= CertGetCertificateContextProperty(pCert
,
624 CERT_KEY_PROV_INFO_PROP_ID
, 0, &size
);
627 info
= (PCRYPT_KEY_PROV_INFO
)HeapAlloc(
628 GetProcessHeap(), 0, size
);
629 ret
= CertGetCertificateContextProperty(pCert
,
630 CERT_KEY_PROV_INFO_PROP_ID
, info
, &size
);
632 cache
= info
->dwFlags
& CERT_SET_KEY_CONTEXT_PROP_ID
;
635 else if (dwFlags
& CRYPT_ACQUIRE_CACHE_FLAG
)
640 size
= sizeof(keyContext
);
641 ret
= CertGetCertificateContextProperty(pCert
, CERT_KEY_CONTEXT_PROP_ID
,
645 *phCryptProv
= keyContext
.hCryptProv
;
647 *pdwKeySpec
= keyContext
.dwKeySpec
;
648 if (pfCallerFreeProv
)
649 *pfCallerFreeProv
= !cache
;
654 ret
= CRYPT_AcquirePrivateKeyFromProvInfo(pCert
, info
,
655 &keyContext
.hCryptProv
, &keyContext
.dwKeySpec
);
658 *phCryptProv
= keyContext
.hCryptProv
;
660 *pdwKeySpec
= keyContext
.dwKeySpec
;
663 keyContext
.cbSize
= sizeof(keyContext
);
664 if (CertSetCertificateContextProperty(pCert
,
665 CERT_KEY_CONTEXT_PROP_ID
, 0, &keyContext
))
667 if (pfCallerFreeProv
)
668 *pfCallerFreeProv
= FALSE
;
673 if (pfCallerFreeProv
)
674 *pfCallerFreeProv
= TRUE
;
678 HeapFree(GetProcessHeap(), 0, info
);
682 BOOL WINAPI
CertCompareCertificate(DWORD dwCertEncodingType
,
683 PCERT_INFO pCertId1
, PCERT_INFO pCertId2
)
685 TRACE("(%08lx, %p, %p)\n", dwCertEncodingType
, pCertId1
, pCertId2
);
687 return CertCompareCertificateName(dwCertEncodingType
, &pCertId1
->Issuer
,
688 &pCertId2
->Issuer
) && CertCompareIntegerBlob(&pCertId1
->SerialNumber
,
689 &pCertId2
->SerialNumber
);
692 BOOL WINAPI
CertCompareCertificateName(DWORD dwCertEncodingType
,
693 PCERT_NAME_BLOB pCertName1
, PCERT_NAME_BLOB pCertName2
)
697 TRACE("(%08lx, %p, %p)\n", dwCertEncodingType
, pCertName1
, pCertName2
);
699 if (pCertName1
->cbData
== pCertName2
->cbData
)
701 if (pCertName1
->cbData
)
702 ret
= !memcmp(pCertName1
->pbData
, pCertName2
->pbData
,
712 /* Returns the number of significant bytes in pInt, where a byte is
713 * insignificant if it's a leading 0 for positive numbers or a leading 0xff
714 * for negative numbers. pInt is assumed to be little-endian.
716 static DWORD
CRYPT_significantBytes(PCRYPT_INTEGER_BLOB pInt
)
718 DWORD ret
= pInt
->cbData
;
722 if (pInt
->pbData
[ret
- 2] <= 0x7f && pInt
->pbData
[ret
- 1] == 0)
724 else if (pInt
->pbData
[ret
- 2] >= 0x80 && pInt
->pbData
[ret
- 1] == 0xff)
732 BOOL WINAPI
CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1
,
733 PCRYPT_INTEGER_BLOB pInt2
)
738 TRACE("(%p, %p)\n", pInt1
, pInt2
);
740 cb1
= CRYPT_significantBytes(pInt1
);
741 cb2
= CRYPT_significantBytes(pInt2
);
745 ret
= !memcmp(pInt1
->pbData
, pInt1
->pbData
, cb1
);
754 BOOL WINAPI
CertComparePublicKeyInfo(DWORD dwCertEncodingType
,
755 PCERT_PUBLIC_KEY_INFO pPublicKey1
, PCERT_PUBLIC_KEY_INFO pPublicKey2
)
759 TRACE("(%08lx, %p, %p)\n", dwCertEncodingType
, pPublicKey1
, pPublicKey2
);
761 if (pPublicKey1
->PublicKey
.cbData
== pPublicKey2
->PublicKey
.cbData
&&
762 pPublicKey1
->PublicKey
.cUnusedBits
== pPublicKey2
->PublicKey
.cUnusedBits
)
764 if (pPublicKey2
->PublicKey
.cbData
)
765 ret
= !memcmp(pPublicKey1
->PublicKey
.pbData
,
766 pPublicKey2
->PublicKey
.pbData
, pPublicKey1
->PublicKey
.cbData
);
775 typedef BOOL (*CertCompareFunc
)(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
776 DWORD dwFlags
, const void *pvPara
);
778 static BOOL
compare_cert_any(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
779 DWORD dwFlags
, const void *pvPara
)
784 static BOOL
compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
785 DWORD dwFlags
, const void *pvPara
)
789 DWORD size
= sizeof(hash
);
791 ret
= CertGetCertificateContextProperty(pCertContext
,
792 CERT_MD5_HASH_PROP_ID
, hash
, &size
);
795 const CRYPT_HASH_BLOB
*pHash
= (const CRYPT_HASH_BLOB
*)pvPara
;
797 if (size
== pHash
->cbData
)
798 ret
= !memcmp(pHash
->pbData
, hash
, size
);
805 static BOOL
compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
806 DWORD dwFlags
, const void *pvPara
)
810 DWORD size
= sizeof(hash
);
812 ret
= CertGetCertificateContextProperty(pCertContext
,
813 CERT_SHA1_HASH_PROP_ID
, hash
, &size
);
816 const CRYPT_HASH_BLOB
*pHash
= (const CRYPT_HASH_BLOB
*)pvPara
;
818 if (size
== pHash
->cbData
)
819 ret
= !memcmp(pHash
->pbData
, hash
, size
);
826 static BOOL
compare_cert_by_name(PCCERT_CONTEXT pCertContext
, DWORD dwType
,
827 DWORD dwFlags
, const void *pvPara
)
829 CERT_NAME_BLOB
*blob
= (CERT_NAME_BLOB
*)pvPara
, *toCompare
;
832 if (dwType
& CERT_INFO_SUBJECT_FLAG
)
833 toCompare
= &pCertContext
->pCertInfo
->Subject
;
835 toCompare
= &pCertContext
->pCertInfo
->Issuer
;
836 ret
= CertCompareCertificateName(pCertContext
->dwCertEncodingType
,
841 static BOOL
compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext
,
842 DWORD dwType
, DWORD dwFlags
, const void *pvPara
)
844 CERT_INFO
*pCertInfo
= (CERT_INFO
*)pvPara
;
846 return CertCompareCertificateName(pCertContext
->dwCertEncodingType
,
847 &pCertInfo
->Issuer
, &pCertContext
->pCertInfo
->Subject
);
850 static BOOL
compare_cert_by_issuer(PCCERT_CONTEXT pCertContext
,
851 DWORD dwType
, DWORD dwFlags
, const void *pvPara
)
853 return compare_cert_by_subject_cert(pCertContext
, dwType
, dwFlags
,
854 ((PCCERT_CONTEXT
)pvPara
)->pCertInfo
);
857 PCCERT_CONTEXT WINAPI
CertFindCertificateInStore(HCERTSTORE hCertStore
,
858 DWORD dwCertEncodingType
, DWORD dwFlags
, DWORD dwType
, const void *pvPara
,
859 PCCERT_CONTEXT pPrevCertContext
)
862 CertCompareFunc compare
;
864 TRACE("(%p, %ld, %ld, %ld, %p, %p)\n", hCertStore
, dwCertEncodingType
,
865 dwFlags
, dwType
, pvPara
, pPrevCertContext
);
867 switch (dwType
>> CERT_COMPARE_SHIFT
)
869 case CERT_COMPARE_ANY
:
870 compare
= compare_cert_any
;
872 case CERT_COMPARE_MD5_HASH
:
873 compare
= compare_cert_by_md5_hash
;
875 case CERT_COMPARE_SHA1_HASH
:
876 compare
= compare_cert_by_sha1_hash
;
878 case CERT_COMPARE_NAME
:
879 compare
= compare_cert_by_name
;
881 case CERT_COMPARE_SUBJECT_CERT
:
882 compare
= compare_cert_by_subject_cert
;
884 case CERT_COMPARE_ISSUER_OF
:
885 compare
= compare_cert_by_issuer
;
888 FIXME("find type %08lx unimplemented\n", dwType
);
894 BOOL matches
= FALSE
;
896 ret
= pPrevCertContext
;
898 ret
= CertEnumCertificatesInStore(hCertStore
, ret
);
900 matches
= compare(ret
, dwType
, dwFlags
, pvPara
);
901 } while (ret
!= NULL
&& !matches
);
903 SetLastError(CRYPT_E_NOT_FOUND
);
907 SetLastError(CRYPT_E_NOT_FOUND
);
913 PCCERT_CONTEXT WINAPI
CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore
,
914 DWORD dwCertEncodingType
, PCERT_INFO pCertId
)
916 TRACE("(%p, %08lx, %p)\n", hCertStore
, dwCertEncodingType
, pCertId
);
920 SetLastError(E_INVALIDARG
);
923 return CertFindCertificateInStore(hCertStore
, dwCertEncodingType
, 0,
924 CERT_FIND_SUBJECT_CERT
, pCertId
, NULL
);
927 BOOL WINAPI
CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject
,
928 PCCERT_CONTEXT pIssuer
, DWORD
*pdwFlags
)
930 static const DWORD supportedFlags
= CERT_STORE_REVOCATION_FLAG
|
931 CERT_STORE_SIGNATURE_FLAG
| CERT_STORE_TIME_VALIDITY_FLAG
;
933 if (*pdwFlags
& ~supportedFlags
)
935 SetLastError(E_INVALIDARG
);
938 if (*pdwFlags
& CERT_STORE_REVOCATION_FLAG
)
941 PCCRL_CONTEXT crl
= CertGetCRLFromStore(pSubject
->hCertStore
, pSubject
,
944 /* FIXME: what if the CRL has expired? */
947 if (CertVerifyCRLRevocation(pSubject
->dwCertEncodingType
,
948 pSubject
->pCertInfo
, 1, (PCRL_INFO
*)&crl
->pCrlInfo
))
949 *pdwFlags
&= CERT_STORE_REVOCATION_FLAG
;
952 *pdwFlags
|= CERT_STORE_NO_CRL_FLAG
;
954 if (*pdwFlags
& CERT_STORE_TIME_VALIDITY_FLAG
)
956 if (0 == CertVerifyTimeValidity(NULL
, pSubject
->pCertInfo
))
957 *pdwFlags
&= ~CERT_STORE_TIME_VALIDITY_FLAG
;
959 if (*pdwFlags
& CERT_STORE_SIGNATURE_FLAG
)
961 if (CryptVerifyCertificateSignatureEx(0, pSubject
->dwCertEncodingType
,
962 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT
, (void *)pSubject
,
963 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT
, (void *)pIssuer
, 0, NULL
))
964 *pdwFlags
&= ~CERT_STORE_SIGNATURE_FLAG
;
969 PCCERT_CONTEXT WINAPI
CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore
,
970 PCCERT_CONTEXT pSubjectContext
, PCCERT_CONTEXT pPrevIssuerContext
,
975 TRACE("(%p, %p, %p, %08lx)\n", hCertStore
, pSubjectContext
,
976 pPrevIssuerContext
, *pdwFlags
);
978 if (!pSubjectContext
)
980 SetLastError(E_INVALIDARG
);
984 ret
= CertFindCertificateInStore(hCertStore
,
985 pSubjectContext
->dwCertEncodingType
, 0, CERT_FIND_ISSUER_OF
,
986 pSubjectContext
, pPrevIssuerContext
);
989 if (!CertVerifySubjectCertificateContext(pSubjectContext
, ret
,
992 CertFreeCertificateContext(ret
);
1000 PCRYPT_ATTRIBUTE WINAPI
CertFindAttribute(LPCSTR pszObjId
, DWORD cAttr
,
1001 CRYPT_ATTRIBUTE rgAttr
[])
1003 PCRYPT_ATTRIBUTE ret
= NULL
;
1006 TRACE("%s %ld %p\n", debugstr_a(pszObjId
), cAttr
, rgAttr
);
1012 SetLastError(ERROR_INVALID_PARAMETER
);
1016 for (i
= 0; !ret
&& i
< cAttr
; i
++)
1017 if (rgAttr
[i
].pszObjId
&& !strcmp(pszObjId
, rgAttr
[i
].pszObjId
))
1022 PCERT_EXTENSION WINAPI
CertFindExtension(LPCSTR pszObjId
, DWORD cExtensions
,
1023 CERT_EXTENSION rgExtensions
[])
1025 PCERT_EXTENSION ret
= NULL
;
1028 TRACE("%s %ld %p\n", debugstr_a(pszObjId
), cExtensions
, rgExtensions
);
1034 SetLastError(ERROR_INVALID_PARAMETER
);
1038 for (i
= 0; !ret
&& i
< cExtensions
; i
++)
1039 if (rgExtensions
[i
].pszObjId
&& !strcmp(pszObjId
,
1040 rgExtensions
[i
].pszObjId
))
1041 ret
= &rgExtensions
[i
];
1045 PCERT_RDN_ATTR WINAPI
CertFindRDNAttr(LPCSTR pszObjId
, PCERT_NAME_INFO pName
)
1047 PCERT_RDN_ATTR ret
= NULL
;
1050 TRACE("%s %p\n", debugstr_a(pszObjId
), pName
);
1054 SetLastError(ERROR_INVALID_PARAMETER
);
1058 for (i
= 0; !ret
&& i
< pName
->cRDN
; i
++)
1059 for (j
= 0; !ret
&& j
< pName
->rgRDN
[i
].cRDNAttr
; j
++)
1060 if (pName
->rgRDN
[i
].rgRDNAttr
[j
].pszObjId
&& !strcmp(pszObjId
,
1061 pName
->rgRDN
[i
].rgRDNAttr
[j
].pszObjId
))
1062 ret
= &pName
->rgRDN
[i
].rgRDNAttr
[j
];
1066 LONG WINAPI
CertVerifyTimeValidity(LPFILETIME pTimeToVerify
,
1067 PCERT_INFO pCertInfo
)
1076 GetSystemTime(&sysTime
);
1077 SystemTimeToFileTime(&sysTime
, &fileTime
);
1078 pTimeToVerify
= &fileTime
;
1080 if ((ret
= CompareFileTime(pTimeToVerify
, &pCertInfo
->NotBefore
)) >= 0)
1082 ret
= CompareFileTime(pTimeToVerify
, &pCertInfo
->NotAfter
);
1089 BOOL WINAPI
CryptHashCertificate(HCRYPTPROV hCryptProv
, ALG_ID Algid
,
1090 DWORD dwFlags
, const BYTE
*pbEncoded
, DWORD cbEncoded
, BYTE
*pbComputedHash
,
1091 DWORD
*pcbComputedHash
)
1094 HCRYPTHASH hHash
= 0;
1096 TRACE("(%ld, %d, %08lx, %p, %ld, %p, %p)\n", hCryptProv
, Algid
, dwFlags
,
1097 pbEncoded
, cbEncoded
, pbComputedHash
, pcbComputedHash
);
1100 hCryptProv
= CRYPT_GetDefaultProvider();
1105 ret
= CryptCreateHash(hCryptProv
, Algid
, 0, 0, &hHash
);
1108 ret
= CryptHashData(hHash
, pbEncoded
, cbEncoded
, 0);
1110 ret
= CryptGetHashParam(hHash
, HP_HASHVAL
, pbComputedHash
,
1111 pcbComputedHash
, 0);
1112 CryptDestroyHash(hHash
);
1118 BOOL WINAPI
CryptHashPublicKeyInfo(HCRYPTPROV hCryptProv
, ALG_ID Algid
,
1119 DWORD dwFlags
, DWORD dwCertEncodingType
, PCERT_PUBLIC_KEY_INFO pInfo
,
1120 BYTE
*pbComputedHash
, DWORD
*pcbComputedHash
)
1123 HCRYPTHASH hHash
= 0;
1125 TRACE("(%ld, %d, %08lx, %ld, %p, %p, %p)\n", hCryptProv
, Algid
, dwFlags
,
1126 dwCertEncodingType
, pInfo
, pbComputedHash
, pcbComputedHash
);
1129 hCryptProv
= CRYPT_GetDefaultProvider();
1137 ret
= CryptEncodeObjectEx(dwCertEncodingType
, X509_PUBLIC_KEY_INFO
,
1138 pInfo
, CRYPT_ENCODE_ALLOC_FLAG
, NULL
, &buf
, &size
);
1141 ret
= CryptCreateHash(hCryptProv
, Algid
, 0, 0, &hHash
);
1144 ret
= CryptHashData(hHash
, buf
, size
, 0);
1146 ret
= CryptGetHashParam(hHash
, HP_HASHVAL
, pbComputedHash
,
1147 pcbComputedHash
, 0);
1148 CryptDestroyHash(hHash
);
1156 BOOL WINAPI
CryptSignCertificate(HCRYPTPROV hCryptProv
, DWORD dwKeySpec
,
1157 DWORD dwCertEncodingType
, const BYTE
*pbEncodedToBeSigned
,
1158 DWORD cbEncodedToBeSigned
, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm
,
1159 const void *pvHashAuxInfo
, BYTE
*pbSignature
, DWORD
*pcbSignature
)
1165 TRACE("(%08lx, %ld, %ld, %p, %ld, %p, %p, %p, %p)\n", hCryptProv
,
1166 dwKeySpec
, dwCertEncodingType
, pbEncodedToBeSigned
, cbEncodedToBeSigned
,
1167 pSignatureAlgorithm
, pvHashAuxInfo
, pbSignature
, pcbSignature
);
1169 algID
= CertOIDToAlgId(pSignatureAlgorithm
->pszObjId
);
1172 SetLastError(NTE_BAD_ALGID
);
1177 SetLastError(ERROR_INVALID_PARAMETER
);
1181 ret
= CryptCreateHash(hCryptProv
, algID
, 0, 0, &hHash
);
1184 ret
= CryptHashData(hHash
, pbEncodedToBeSigned
, cbEncodedToBeSigned
, 0);
1186 ret
= CryptSignHashW(hHash
, dwKeySpec
, NULL
, 0, pbSignature
,
1188 CryptDestroyHash(hHash
);
1193 BOOL WINAPI
CryptVerifyCertificateSignature(HCRYPTPROV hCryptProv
,
1194 DWORD dwCertEncodingType
, const BYTE
*pbEncoded
, DWORD cbEncoded
,
1195 PCERT_PUBLIC_KEY_INFO pPublicKey
)
1197 return CryptVerifyCertificateSignatureEx(hCryptProv
, dwCertEncodingType
,
1198 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB
, (void *)pbEncoded
,
1199 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY
, pPublicKey
, 0, NULL
);
1202 static BOOL
CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV hCryptProv
,
1203 DWORD dwCertEncodingType
, PCERT_PUBLIC_KEY_INFO pubKeyInfo
,
1204 PCERT_SIGNED_CONTENT_INFO signedCert
)
1207 ALG_ID algID
= CertOIDToAlgId(pubKeyInfo
->Algorithm
.pszObjId
);
1210 /* Load the default provider if necessary */
1212 hCryptProv
= CRYPT_GetDefaultProvider();
1213 ret
= CryptImportPublicKeyInfoEx(hCryptProv
, dwCertEncodingType
,
1214 pubKeyInfo
, algID
, 0, NULL
, &key
);
1219 /* Some key algorithms aren't hash algorithms, so map them */
1220 if (algID
== CALG_RSA_SIGN
|| algID
== CALG_RSA_KEYX
)
1222 ret
= CryptCreateHash(hCryptProv
, algID
, 0, 0, &hash
);
1225 ret
= CryptHashData(hash
, signedCert
->ToBeSigned
.pbData
,
1226 signedCert
->ToBeSigned
.cbData
, 0);
1228 ret
= CryptVerifySignatureW(hash
, signedCert
->Signature
.pbData
,
1229 signedCert
->Signature
.cbData
, key
, NULL
, 0);
1230 CryptDestroyHash(hash
);
1232 CryptDestroyKey(key
);
1237 BOOL WINAPI
CryptVerifyCertificateSignatureEx(HCRYPTPROV hCryptProv
,
1238 DWORD dwCertEncodingType
, DWORD dwSubjectType
, void *pvSubject
,
1239 DWORD dwIssuerType
, void *pvIssuer
, DWORD dwFlags
, void *pvReserved
)
1242 CRYPT_DATA_BLOB subjectBlob
;
1244 TRACE("(%08lx, %ld, %ld, %p, %ld, %p, %08lx, %p)\n", hCryptProv
,
1245 dwCertEncodingType
, dwSubjectType
, pvSubject
, dwIssuerType
, pvIssuer
,
1246 dwFlags
, pvReserved
);
1248 switch (dwSubjectType
)
1250 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB
:
1252 PCRYPT_DATA_BLOB blob
= (PCRYPT_DATA_BLOB
)pvSubject
;
1254 subjectBlob
.pbData
= blob
->pbData
;
1255 subjectBlob
.cbData
= blob
->cbData
;
1258 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT
:
1260 PCERT_CONTEXT context
= (PCERT_CONTEXT
)pvSubject
;
1262 subjectBlob
.pbData
= context
->pbCertEncoded
;
1263 subjectBlob
.cbData
= context
->cbCertEncoded
;
1266 case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL
:
1268 PCRL_CONTEXT context
= (PCRL_CONTEXT
)pvSubject
;
1270 subjectBlob
.pbData
= context
->pbCrlEncoded
;
1271 subjectBlob
.cbData
= context
->cbCrlEncoded
;
1275 SetLastError(E_INVALIDARG
);
1281 PCERT_SIGNED_CONTENT_INFO signedCert
= NULL
;
1284 ret
= CryptDecodeObjectEx(dwCertEncodingType
, X509_CERT
,
1285 subjectBlob
.pbData
, subjectBlob
.cbData
,
1286 CRYPT_DECODE_ALLOC_FLAG
| CRYPT_DECODE_NOCOPY_FLAG
, NULL
,
1287 (BYTE
*)&signedCert
, &size
);
1290 switch (dwIssuerType
)
1292 case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY
:
1293 ret
= CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv
,
1294 dwCertEncodingType
, (PCERT_PUBLIC_KEY_INFO
)pvIssuer
,
1297 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT
:
1298 ret
= CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv
,
1300 &((PCCERT_CONTEXT
)pvIssuer
)->pCertInfo
->SubjectPublicKeyInfo
,
1303 case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN
:
1304 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
1307 case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL
:
1310 SetLastError(E_INVALIDARG
);
1315 FIXME("unimplemented for NULL signer\n");
1316 SetLastError(E_INVALIDARG
);
1321 SetLastError(E_INVALIDARG
);
1324 LocalFree(signedCert
);
1330 BOOL WINAPI
CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext
, DWORD dwFlags
,
1331 PCERT_ENHKEY_USAGE pUsage
, DWORD
*pcbUsage
)
1333 PCERT_ENHKEY_USAGE usage
= NULL
;
1337 if (!pCertContext
|| !pcbUsage
)
1339 SetLastError(ERROR_INVALID_PARAMETER
);
1343 TRACE("(%p, %08lx, %p, %ld)\n", pCertContext
, dwFlags
, pUsage
, *pcbUsage
);
1345 if (!(dwFlags
& CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG
))
1349 if (CertGetCertificateContextProperty(pCertContext
,
1350 CERT_ENHKEY_USAGE_PROP_ID
, NULL
, &propSize
))
1352 LPBYTE buf
= CryptMemAlloc(propSize
);
1356 if (CertGetCertificateContextProperty(pCertContext
,
1357 CERT_ENHKEY_USAGE_PROP_ID
, buf
, &propSize
))
1359 ret
= CryptDecodeObjectEx(pCertContext
->dwCertEncodingType
,
1360 X509_ENHANCED_KEY_USAGE
, buf
, propSize
,
1361 CRYPT_ENCODE_ALLOC_FLAG
, NULL
, &usage
, &bytesNeeded
);
1367 if (!usage
&& !(dwFlags
& CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
))
1369 PCERT_EXTENSION ext
= CertFindExtension(szOID_ENHANCED_KEY_USAGE
,
1370 pCertContext
->pCertInfo
->cExtension
,
1371 pCertContext
->pCertInfo
->rgExtension
);
1375 ret
= CryptDecodeObjectEx(pCertContext
->dwCertEncodingType
,
1376 X509_ENHANCED_KEY_USAGE
, ext
->Value
.pbData
, ext
->Value
.cbData
,
1377 CRYPT_ENCODE_ALLOC_FLAG
, NULL
, &usage
, &bytesNeeded
);
1382 /* If a particular location is specified, this should fail. Otherwise
1383 * it should succeed with an empty usage. (This is true on Win2k and
1384 * later, which we emulate.)
1388 SetLastError(CRYPT_E_NOT_FOUND
);
1392 bytesNeeded
= sizeof(CERT_ENHKEY_USAGE
);
1398 *pcbUsage
= bytesNeeded
;
1399 else if (*pcbUsage
< bytesNeeded
)
1401 SetLastError(ERROR_MORE_DATA
);
1402 *pcbUsage
= bytesNeeded
;
1407 *pcbUsage
= bytesNeeded
;
1411 LPSTR nextOID
= (LPSTR
)((LPBYTE
)pUsage
+
1412 sizeof(CERT_ENHKEY_USAGE
) +
1413 usage
->cUsageIdentifier
* sizeof(LPSTR
));
1415 pUsage
->cUsageIdentifier
= usage
->cUsageIdentifier
;
1416 pUsage
->rgpszUsageIdentifier
= (LPSTR
*)((LPBYTE
)pUsage
+
1417 sizeof(CERT_ENHKEY_USAGE
));
1418 for (i
= 0; i
< usage
->cUsageIdentifier
; i
++)
1420 pUsage
->rgpszUsageIdentifier
[i
] = nextOID
;
1421 strcpy(nextOID
, usage
->rgpszUsageIdentifier
[i
]);
1422 nextOID
+= strlen(nextOID
) + 1;
1426 pUsage
->cUsageIdentifier
= 0;
1431 TRACE("returning %d\n", ret
);
1435 BOOL WINAPI
CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext
,
1436 PCERT_ENHKEY_USAGE pUsage
)
1440 TRACE("(%p, %p)\n", pCertContext
, pUsage
);
1444 CRYPT_DATA_BLOB blob
= { 0, NULL
};
1446 ret
= CryptEncodeObjectEx(X509_ASN_ENCODING
, X509_ENHANCED_KEY_USAGE
,
1447 pUsage
, CRYPT_ENCODE_ALLOC_FLAG
, NULL
, &blob
.pbData
, &blob
.cbData
);
1450 ret
= CertSetCertificateContextProperty(pCertContext
,
1451 CERT_ENHKEY_USAGE_PROP_ID
, 0, &blob
);
1452 LocalFree(blob
.pbData
);
1456 ret
= CertSetCertificateContextProperty(pCertContext
,
1457 CERT_ENHKEY_USAGE_PROP_ID
, 0, NULL
);
1461 BOOL WINAPI
CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext
,
1462 LPCSTR pszUsageIdentifier
)
1467 TRACE("(%p, %s)\n", pCertContext
, debugstr_a(pszUsageIdentifier
));
1469 if (CertGetEnhancedKeyUsage(pCertContext
,
1470 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
, NULL
, &size
))
1472 PCERT_ENHKEY_USAGE usage
= CryptMemAlloc(size
);
1476 ret
= CertGetEnhancedKeyUsage(pCertContext
,
1477 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
, usage
, &size
);
1480 PCERT_ENHKEY_USAGE newUsage
= CryptMemAlloc(size
+
1481 sizeof(LPSTR
) + strlen(pszUsageIdentifier
) + 1);
1488 newUsage
->rgpszUsageIdentifier
=
1489 (LPSTR
*)((LPBYTE
)newUsage
+ sizeof(CERT_ENHKEY_USAGE
));
1490 nextOID
= (LPSTR
)((LPBYTE
)newUsage
->rgpszUsageIdentifier
+
1491 (usage
->cUsageIdentifier
+ 1) * sizeof(LPSTR
));
1492 for (i
= 0; i
< usage
->cUsageIdentifier
; i
++)
1494 newUsage
->rgpszUsageIdentifier
[i
] = nextOID
;
1495 strcpy(nextOID
, usage
->rgpszUsageIdentifier
[i
]);
1496 nextOID
+= strlen(nextOID
) + 1;
1498 newUsage
->rgpszUsageIdentifier
[i
] = nextOID
;
1499 strcpy(nextOID
, pszUsageIdentifier
);
1500 newUsage
->cUsageIdentifier
= i
+ 1;
1501 ret
= CertSetEnhancedKeyUsage(pCertContext
, newUsage
);
1502 CryptMemFree(newUsage
);
1505 CryptMemFree(usage
);
1512 PCERT_ENHKEY_USAGE usage
= CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE
) +
1513 sizeof(LPSTR
) + strlen(pszUsageIdentifier
) + 1);
1517 usage
->rgpszUsageIdentifier
=
1518 (LPSTR
*)((LPBYTE
)usage
+ sizeof(CERT_ENHKEY_USAGE
));
1519 usage
->rgpszUsageIdentifier
[0] = (LPSTR
)((LPBYTE
)usage
+
1520 sizeof(CERT_ENHKEY_USAGE
) + sizeof(LPSTR
));
1521 strcpy(usage
->rgpszUsageIdentifier
[0], pszUsageIdentifier
);
1522 usage
->cUsageIdentifier
= 1;
1523 ret
= CertSetEnhancedKeyUsage(pCertContext
, usage
);
1524 CryptMemFree(usage
);
1532 BOOL WINAPI
CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext
,
1533 LPCSTR pszUsageIdentifier
)
1537 CERT_ENHKEY_USAGE usage
;
1539 TRACE("(%p, %s)\n", pCertContext
, debugstr_a(pszUsageIdentifier
));
1541 size
= sizeof(usage
);
1542 ret
= CertGetEnhancedKeyUsage(pCertContext
,
1543 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
, &usage
, &size
);
1544 if (!ret
&& GetLastError() == ERROR_MORE_DATA
)
1546 PCERT_ENHKEY_USAGE pUsage
= CryptMemAlloc(size
);
1550 ret
= CertGetEnhancedKeyUsage(pCertContext
,
1551 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG
, pUsage
, &size
);
1554 if (pUsage
->cUsageIdentifier
)
1559 for (i
= 0; i
< pUsage
->cUsageIdentifier
; i
++)
1561 if (!strcmp(pUsage
->rgpszUsageIdentifier
[i
],
1562 pszUsageIdentifier
))
1564 if (found
&& i
< pUsage
->cUsageIdentifier
- 1)
1565 pUsage
->rgpszUsageIdentifier
[i
] =
1566 pUsage
->rgpszUsageIdentifier
[i
+ 1];
1568 pUsage
->cUsageIdentifier
--;
1569 /* Remove the usage if it's empty */
1570 if (pUsage
->cUsageIdentifier
)
1571 ret
= CertSetEnhancedKeyUsage(pCertContext
, pUsage
);
1573 ret
= CertSetEnhancedKeyUsage(pCertContext
, NULL
);
1576 CryptMemFree(pUsage
);
1583 /* it fit in an empty usage, therefore there's nothing to remove */
1589 BOOL WINAPI
CertGetValidUsages(DWORD cCerts
, PCCERT_CONTEXT
*rghCerts
,
1590 int *cNumOIDSs
, LPSTR
*rghOIDs
, DWORD
*pcbOIDs
)
1593 DWORD i
, cbOIDs
= 0;
1594 BOOL allUsagesValid
= TRUE
;
1595 CERT_ENHKEY_USAGE validUsages
= { 0, NULL
};
1597 TRACE("(%ld, %p, %p, %p, %ld)\n", cCerts
, *rghCerts
, cNumOIDSs
,
1600 for (i
= 0; ret
&& i
< cCerts
; i
++)
1602 CERT_ENHKEY_USAGE usage
;
1603 DWORD size
= sizeof(usage
);
1605 ret
= CertGetEnhancedKeyUsage(rghCerts
[i
], 0, &usage
, &size
);
1606 /* Success is deliberately ignored: it implies all usages are valid */
1607 if (!ret
&& GetLastError() == ERROR_MORE_DATA
)
1609 PCERT_ENHKEY_USAGE pUsage
= CryptMemAlloc(size
);
1611 allUsagesValid
= FALSE
;
1614 ret
= CertGetEnhancedKeyUsage(rghCerts
[i
], 0, pUsage
, &size
);
1617 if (!validUsages
.cUsageIdentifier
)
1621 cbOIDs
= pUsage
->cUsageIdentifier
* sizeof(LPSTR
);
1622 validUsages
.cUsageIdentifier
= pUsage
->cUsageIdentifier
;
1623 for (j
= 0; j
< validUsages
.cUsageIdentifier
; j
++)
1624 cbOIDs
+= lstrlenA(pUsage
->rgpszUsageIdentifier
[j
])
1626 validUsages
.rgpszUsageIdentifier
=
1627 CryptMemAlloc(cbOIDs
);
1628 if (validUsages
.rgpszUsageIdentifier
)
1630 LPSTR nextOID
= (LPSTR
)
1631 ((LPBYTE
)validUsages
.rgpszUsageIdentifier
+
1632 validUsages
.cUsageIdentifier
* sizeof(LPSTR
));
1634 for (j
= 0; j
< validUsages
.cUsageIdentifier
; j
++)
1636 validUsages
.rgpszUsageIdentifier
[j
] = nextOID
;
1637 lstrcpyA(validUsages
.rgpszUsageIdentifier
[j
],
1638 pUsage
->rgpszUsageIdentifier
[j
]);
1639 nextOID
+= lstrlenA(nextOID
) + 1;
1647 DWORD j
, k
, validIndexes
= 0, numRemoved
= 0;
1649 /* Merge: build a bitmap of all the indexes of
1650 * validUsages.rgpszUsageIdentifier that are in pUsage.
1652 for (j
= 0; j
< pUsage
->cUsageIdentifier
; j
++)
1654 for (k
= 0; k
< validUsages
.cUsageIdentifier
; k
++)
1656 if (!strcmp(pUsage
->rgpszUsageIdentifier
[j
],
1657 validUsages
.rgpszUsageIdentifier
[k
]))
1659 validIndexes
|= (1 << k
);
1664 /* Merge by removing from validUsages those that are
1665 * not in the bitmap.
1667 for (j
= 0; j
< validUsages
.cUsageIdentifier
; j
++)
1669 if (!(validIndexes
& (1 << j
)))
1671 if (j
< validUsages
.cUsageIdentifier
- 1)
1673 memcpy(&validUsages
.rgpszUsageIdentifier
[j
],
1674 &validUsages
.rgpszUsageIdentifier
[j
+
1676 (validUsages
.cUsageIdentifier
- numRemoved
1677 - j
- 1) * sizeof(LPSTR
));
1679 validUsages
.rgpszUsageIdentifier
[j
]) + 1 +
1684 validUsages
.cUsageIdentifier
--;
1689 CryptMemFree(pUsage
);
1704 if (!rghOIDs
|| *pcbOIDs
< cbOIDs
)
1707 SetLastError(ERROR_MORE_DATA
);
1712 LPSTR nextOID
= (LPSTR
)((LPBYTE
)rghOIDs
+
1713 validUsages
.cUsageIdentifier
* sizeof(LPSTR
));
1716 *cNumOIDSs
= validUsages
.cUsageIdentifier
;
1717 for (i
= 0; i
< validUsages
.cUsageIdentifier
; i
++)
1719 rghOIDs
[i
] = nextOID
;
1720 lstrcpyA(nextOID
, validUsages
.rgpszUsageIdentifier
[i
]);
1721 nextOID
+= lstrlenA(nextOID
) + 1;
1726 CryptMemFree(validUsages
.rgpszUsageIdentifier
);
1730 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
1731 * pInfo is NULL, from the attributes of hProv.
1733 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context
,
1734 PCRYPT_KEY_PROV_INFO pInfo
, HCRYPTPROV hProv
)
1736 CRYPT_KEY_PROV_INFO info
= { 0 };
1744 ret
= CryptGetProvParam(hProv
, PP_CONTAINER
, NULL
, &size
, 0);
1747 LPSTR szContainer
= CryptMemAlloc(size
);
1751 ret
= CryptGetProvParam(hProv
, PP_CONTAINER
,
1752 (BYTE
*)szContainer
, &size
, 0);
1755 len
= MultiByteToWideChar(CP_ACP
, 0, szContainer
, -1,
1759 info
.pwszContainerName
= CryptMemAlloc(len
*
1761 len
= MultiByteToWideChar(CP_ACP
, 0, szContainer
, -1,
1762 info
.pwszContainerName
, len
);
1765 CryptMemFree(szContainer
);
1768 ret
= CryptGetProvParam(hProv
, PP_NAME
, NULL
, &size
, 0);
1771 LPSTR szProvider
= CryptMemAlloc(size
);
1775 ret
= CryptGetProvParam(hProv
, PP_NAME
, (BYTE
*)szProvider
,
1779 len
= MultiByteToWideChar(CP_ACP
, 0, szProvider
, -1,
1783 info
.pwszProvName
= CryptMemAlloc(len
*
1785 len
= MultiByteToWideChar(CP_ACP
, 0, szProvider
, -1,
1786 info
.pwszProvName
, len
);
1789 CryptMemFree(szProvider
);
1792 size
= sizeof(info
.dwKeySpec
);
1793 ret
= CryptGetProvParam(hProv
, PP_KEYSPEC
, (LPBYTE
)&info
.dwKeySpec
,
1796 info
.dwKeySpec
= AT_SIGNATURE
;
1797 size
= sizeof(info
.dwProvType
);
1798 ret
= CryptGetProvParam(hProv
, PP_PROVTYPE
, (LPBYTE
)&info
.dwProvType
,
1801 info
.dwProvType
= PROV_RSA_FULL
;
1805 ret
= CertSetCertificateContextProperty(context
, CERT_KEY_PROV_INFO_PROP_ID
,
1810 CryptMemFree(info
.pwszContainerName
);
1811 CryptMemFree(info
.pwszProvName
);
1815 /* Creates a signed certificate context from the unsigned, encoded certificate
1816 * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
1818 static PCCERT_CONTEXT
CRYPT_CreateSignedCert(PCRYPT_DER_BLOB blob
,
1819 HCRYPTPROV hProv
, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo
)
1821 PCCERT_CONTEXT context
= NULL
;
1825 ret
= CryptSignCertificate(hProv
, AT_SIGNATURE
, X509_ASN_ENCODING
,
1826 blob
->pbData
, blob
->cbData
, sigAlgo
, NULL
, NULL
, &sigSize
);
1829 LPBYTE sig
= CryptMemAlloc(sigSize
);
1831 ret
= CryptSignCertificate(hProv
, AT_SIGNATURE
, X509_ASN_ENCODING
,
1832 blob
->pbData
, blob
->cbData
, sigAlgo
, NULL
, sig
, &sigSize
);
1835 CERT_SIGNED_CONTENT_INFO signedInfo
;
1836 BYTE
*encodedSignedCert
= NULL
;
1837 DWORD encodedSignedCertSize
= 0;
1839 signedInfo
.ToBeSigned
.cbData
= blob
->cbData
;
1840 signedInfo
.ToBeSigned
.pbData
= blob
->pbData
;
1841 memcpy(&signedInfo
.SignatureAlgorithm
, sigAlgo
,
1842 sizeof(signedInfo
.SignatureAlgorithm
));
1843 signedInfo
.Signature
.cbData
= sigSize
;
1844 signedInfo
.Signature
.pbData
= sig
;
1845 signedInfo
.Signature
.cUnusedBits
= 0;
1846 ret
= CryptEncodeObjectEx(X509_ASN_ENCODING
, X509_CERT
,
1847 &signedInfo
, CRYPT_ENCODE_ALLOC_FLAG
, NULL
,
1848 (BYTE
*)&encodedSignedCert
, &encodedSignedCertSize
);
1851 context
= CertCreateCertificateContext(X509_ASN_ENCODING
,
1852 encodedSignedCert
, encodedSignedCertSize
);
1853 LocalFree(encodedSignedCert
);
1861 /* Copies data from the parameters into info, where:
1862 * pSerialNumber: The serial number. Must not be NULL.
1863 * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
1865 * pSignatureAlgorithm: Optional.
1866 * pStartTime: The starting time of the certificate. If NULL, the current
1867 * system time is used.
1868 * pEndTime: The ending time of the certificate. If NULL, one year past the
1869 * starting time is used.
1870 * pubKey: The public key of the certificate. Must not be NULL.
1871 * pExtensions: Extensions to be included with the certificate. Optional.
1873 static void CRYPT_MakeCertInfo(PCERT_INFO info
, PCRYPT_DATA_BLOB pSerialNumber
,
1874 PCERT_NAME_BLOB pSubjectIssuerBlob
,
1875 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm
, PSYSTEMTIME pStartTime
,
1876 PSYSTEMTIME pEndTime
, PCERT_PUBLIC_KEY_INFO pubKey
,
1877 PCERT_EXTENSIONS pExtensions
)
1879 static CHAR oid
[] = szOID_RSA_SHA1RSA
;
1882 assert(pSerialNumber
);
1883 assert(pSubjectIssuerBlob
);
1886 info
->dwVersion
= CERT_V3
;
1887 info
->SerialNumber
.cbData
= pSerialNumber
->cbData
;
1888 info
->SerialNumber
.pbData
= pSerialNumber
->pbData
;
1889 if (pSignatureAlgorithm
)
1890 memcpy(&info
->SignatureAlgorithm
, pSignatureAlgorithm
,
1891 sizeof(info
->SignatureAlgorithm
));
1894 info
->SignatureAlgorithm
.pszObjId
= oid
;
1895 info
->SignatureAlgorithm
.Parameters
.cbData
= 0;
1896 info
->SignatureAlgorithm
.Parameters
.pbData
= NULL
;
1898 info
->Issuer
.cbData
= pSubjectIssuerBlob
->cbData
;
1899 info
->Issuer
.pbData
= pSubjectIssuerBlob
->pbData
;
1901 SystemTimeToFileTime(pStartTime
, &info
->NotBefore
);
1903 GetSystemTimeAsFileTime(&info
->NotBefore
);
1905 SystemTimeToFileTime(pEndTime
, &info
->NotAfter
);
1910 if (FileTimeToSystemTime(&info
->NotBefore
, &endTime
))
1913 SystemTimeToFileTime(&endTime
, &info
->NotAfter
);
1916 info
->Subject
.cbData
= pSubjectIssuerBlob
->cbData
;
1917 info
->Subject
.pbData
= pSubjectIssuerBlob
->pbData
;
1918 memcpy(&info
->SubjectPublicKeyInfo
, pubKey
,
1919 sizeof(info
->SubjectPublicKeyInfo
));
1922 info
->cExtension
= pExtensions
->cExtension
;
1923 info
->rgExtension
= pExtensions
->rgExtension
;
1927 info
->cExtension
= 0;
1928 info
->rgExtension
= NULL
;
1932 typedef RPC_STATUS (RPC_ENTRY
*UuidCreateFunc
)(UUID
*);
1933 typedef RPC_STATUS (RPC_ENTRY
*UuidToStringFunc
)(UUID
*, unsigned char **);
1934 typedef RPC_STATUS (RPC_ENTRY
*RpcStringFreeFunc
)(unsigned char **);
1936 static HCRYPTPROV
CRYPT_CreateKeyProv(void)
1938 HCRYPTPROV hProv
= 0;
1939 HMODULE rpcrt
= LoadLibraryA("rpcrt4");
1943 UuidCreateFunc uuidCreate
= (UuidCreateFunc
)GetProcAddress(rpcrt
,
1945 UuidToStringFunc uuidToString
= (UuidToStringFunc
)GetProcAddress(rpcrt
,
1947 RpcStringFreeFunc rpcStringFree
= (RpcStringFreeFunc
)GetProcAddress(
1948 rpcrt
, "RpcStringFreeA");
1950 if (uuidCreate
&& uuidToString
&& rpcStringFree
)
1953 RPC_STATUS status
= uuidCreate(&uuid
);
1955 if (status
== RPC_S_OK
|| status
== RPC_S_UUID_LOCAL_ONLY
)
1957 unsigned char *uuidStr
;
1959 status
= uuidToString(&uuid
, &uuidStr
);
1960 if (status
== RPC_S_OK
)
1962 BOOL ret
= CryptAcquireContextA(&hProv
, (LPCSTR
)uuidStr
,
1963 MS_DEF_PROV_A
, PROV_RSA_FULL
, CRYPT_NEWKEYSET
);
1969 ret
= CryptGenKey(hProv
, AT_SIGNATURE
, 0, &key
);
1971 CryptDestroyKey(key
);
1973 rpcStringFree(&uuidStr
);
1982 PCCERT_CONTEXT WINAPI
CertCreateSelfSignCertificate(HCRYPTPROV hProv
,
1983 PCERT_NAME_BLOB pSubjectIssuerBlob
, DWORD dwFlags
,
1984 PCRYPT_KEY_PROV_INFO pKeyProvInfo
,
1985 PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm
, PSYSTEMTIME pStartTime
,
1986 PSYSTEMTIME pEndTime
, PCERT_EXTENSIONS pExtensions
)
1988 PCCERT_CONTEXT context
= NULL
;
1989 BOOL ret
, releaseContext
= FALSE
;
1990 PCERT_PUBLIC_KEY_INFO pubKey
= NULL
;
1991 DWORD pubKeySize
= 0;
1993 TRACE("(0x%08lx, %p, %08lx, %p, %p, %p, %p, %p)\n", hProv
,
1994 pSubjectIssuerBlob
, dwFlags
, pKeyProvInfo
, pSignatureAlgorithm
, pStartTime
,
1995 pExtensions
, pExtensions
);
1999 hProv
= CRYPT_CreateKeyProv();
2000 releaseContext
= TRUE
;
2003 CryptExportPublicKeyInfo(hProv
, AT_SIGNATURE
, X509_ASN_ENCODING
, NULL
,
2005 pubKey
= CryptMemAlloc(pubKeySize
);
2008 ret
= CryptExportPublicKeyInfo(hProv
, AT_SIGNATURE
, X509_ASN_ENCODING
,
2009 pubKey
, &pubKeySize
);
2012 CERT_INFO info
= { 0 };
2013 CRYPT_DER_BLOB blob
= { 0, NULL
};
2015 CRYPT_DATA_BLOB serialBlob
= { sizeof(serial
), serial
};
2017 CryptGenRandom(hProv
, sizeof(serial
), serial
);
2018 CRYPT_MakeCertInfo(&info
, &serialBlob
, pSubjectIssuerBlob
,
2019 pSignatureAlgorithm
, pStartTime
, pEndTime
, pubKey
, pExtensions
);
2020 ret
= CryptEncodeObjectEx(X509_ASN_ENCODING
, X509_CERT_TO_BE_SIGNED
,
2021 &info
, CRYPT_ENCODE_ALLOC_FLAG
, NULL
, (BYTE
*)&blob
.pbData
,
2025 if (!(dwFlags
& CERT_CREATE_SELFSIGN_NO_SIGN
))
2026 context
= CRYPT_CreateSignedCert(&blob
, hProv
,
2027 &info
.SignatureAlgorithm
);
2029 context
= CertCreateCertificateContext(X509_ASN_ENCODING
,
2030 blob
.pbData
, blob
.cbData
);
2031 if (context
&& !(dwFlags
& CERT_CREATE_SELFSIGN_NO_KEY_INFO
))
2032 CertContext_SetKeyProvInfo(context
, pKeyProvInfo
, hProv
);
2033 LocalFree(blob
.pbData
);
2036 CryptMemFree(pubKey
);
2039 CryptReleaseContext(hProv
, 0);