dlls/wintrust/softpub.c

   1 /*
   2  * Copyright 2007 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18 #include <stdarg.h>
  19
  20 #define NONAMELESSUNION
  21
  22 #include "windef.h"
  23 #include "winbase.h"
  24 #include "wintrust.h"
  25 #include "mssip.h"
  26 #include "softpub.h"
  27 #include "wine/debug.h"
  28
  29 WINE_DEFAULT_DEBUG_CHANNEL(wintrust);
  30
  31 HRESULT WINAPI SoftpubDefCertInit(CRYPT_PROVIDER_DATA *data)
  32 {
  33     HRESULT ret = S_FALSE;
  34
  35     TRACE("(%p)\n", data);
  36
  37     if (data->padwTrustStepErrors &&
  38      !data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_WVTINIT])
  39         ret = S_OK;
  40     TRACE("returning %08x\n", ret);
  41     return ret;
  42 }
  43
  44 HRESULT WINAPI SoftpubInitialize(CRYPT_PROVIDER_DATA *data)
  45 {
  46     HRESULT ret = S_FALSE;
  47
  48     TRACE("(%p)\n", data);
  49
  50     if (data->padwTrustStepErrors &&
  51      !data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_WVTINIT])
  52         ret = S_OK;
  53     TRACE("returning %08x\n", ret);
  54     return ret;
  55 }
  56
  57 /* Assumes data->pWintrustData->u.pFile exists.  Makes sure a file handle is
  58  * open for the file.
  59  */
  60 static BOOL SOFTPUB_OpenFile(CRYPT_PROVIDER_DATA *data)
  61 {
  62     BOOL ret = TRUE;
  63
  64     /* PSDK implies that all values should be initialized to NULL, so callers
  65      * typically have hFile as NULL rather than INVALID_HANDLE_VALUE.  Check
  66      * for both.
  67      */
  68     if (!data->pWintrustData->u.pFile->hFile ||
  69      data->pWintrustData->u.pFile->hFile == INVALID_HANDLE_VALUE)
  70     {
  71         data->pWintrustData->u.pFile->hFile =
  72             CreateFileW(data->pWintrustData->u.pFile->pcwszFilePath, GENERIC_READ,
  73           FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  74         if (data->pWintrustData->u.pFile->hFile != INVALID_HANDLE_VALUE)
  75             data->fOpenedFile = TRUE;
  76         else
  77             ret = FALSE;
  78     }
  79     if (ret)
  80         GetFileTime(data->pWintrustData->u.pFile->hFile, &data->sftSystemTime,
  81          NULL, NULL);
  82     TRACE("returning %d\n", ret);
  83     return ret;
  84 }
  85
  86 /* Assumes data->pWintrustData->u.pFile exists.  Sets data->pPDSip->gSubject to
  87  * the file's subject GUID.
  88  */
  89 static BOOL SOFTPUB_GetFileSubject(CRYPT_PROVIDER_DATA *data)
  90 {
  91     BOOL ret;
  92
  93     if (!data->pWintrustData->u.pFile->pgKnownSubject)
  94     {
  95         ret = CryptSIPRetrieveSubjectGuid(
  96          data->pWintrustData->u.pFile->pcwszFilePath,
  97          data->pWintrustData->u.pFile->hFile,
  98          &data->u.pPDSip->gSubject);
  99     }
 100     else
 101     {
 102         data->u.pPDSip->gSubject = *data->pWintrustData->u.pFile->pgKnownSubject;
 103         ret = TRUE;
 104     }
 105     TRACE("returning %d\n", ret);
 106     return ret;
 107 }
 108
 109 /* Assumes data->u.pPDSip exists, and its gSubject member set.
 110  * Allocates data->u.pPDSip->pSip and loads it, if possible.
 111  */
 112 static BOOL SOFTPUB_GetSIP(CRYPT_PROVIDER_DATA *data)
 113 {
 114     BOOL ret;
 115
 116     data->u.pPDSip->pSip = data->psPfns->pfnAlloc(sizeof(SIP_DISPATCH_INFO));
 117     if (data->u.pPDSip->pSip)
 118         ret = CryptSIPLoad(&data->u.pPDSip->gSubject, 0, data->u.pPDSip->pSip);
 119     else
 120     {
 121         SetLastError(ERROR_OUTOFMEMORY);
 122         ret = FALSE;
 123     }
 124     TRACE("returning %d\n", ret);
 125     return ret;
 126 }
 127
 128 /* Assumes data->u.pPDSip has been loaded, and data->u.pPDSip->pSip allocated.
 129  * Calls data->u.pPDSip->pSip->pfGet to construct data->hMsg.
 130  */
 131 static BOOL SOFTPUB_GetMessageFromFile(CRYPT_PROVIDER_DATA *data)
 132 {
 133     BOOL ret;
 134     LPBYTE buf = NULL;
 135     DWORD size = 0;
 136
 137     data->u.pPDSip->psSipSubjectInfo =
 138      data->psPfns->pfnAlloc(sizeof(SIP_SUBJECTINFO));
 139     if (!data->u.pPDSip->psSipSubjectInfo)
 140     {
 141         SetLastError(ERROR_OUTOFMEMORY);
 142         return FALSE;
 143     }
 144
 145     data->u.pPDSip->psSipSubjectInfo->cbSize = sizeof(SIP_SUBJECTINFO);
 146     data->u.pPDSip->psSipSubjectInfo->pgSubjectType = &data->u.pPDSip->gSubject;
 147     data->u.pPDSip->psSipSubjectInfo->hFile = data->pWintrustData->u.pFile->hFile;
 148     data->u.pPDSip->psSipSubjectInfo->pwsFileName =
 149      data->pWintrustData->u.pFile->pcwszFilePath;
 150     data->u.pPDSip->psSipSubjectInfo->hProv = data->hProv;
 151     ret = data->u.pPDSip->pSip->pfGet(data->u.pPDSip->psSipSubjectInfo,
 152      &data->dwEncoding, 0, &size, 0);
 153     if (!ret)
 154     {
 155         SetLastError(TRUST_E_NOSIGNATURE);
 156         return FALSE;
 157     }
 158
 159     buf = data->psPfns->pfnAlloc(size);
 160     if (!buf)
 161     {
 162         SetLastError(ERROR_OUTOFMEMORY);
 163         return FALSE;
 164     }
 165
 166     ret = data->u.pPDSip->pSip->pfGet(data->u.pPDSip->psSipSubjectInfo,
 167      &data->dwEncoding, 0, &size, buf);
 168     if (ret)
 169     {
 170         data->hMsg = CryptMsgOpenToDecode(data->dwEncoding, 0, 0, data->hProv,
 171          NULL, NULL);
 172         if (data->hMsg)
 173             ret = CryptMsgUpdate(data->hMsg, buf, size, TRUE);
 174     }
 175
 176     data->psPfns->pfnFree(buf);
 177     TRACE("returning %d\n", ret);
 178     return ret;
 179 }
 180
 181 static BOOL SOFTPUB_CreateStoreFromMessage(CRYPT_PROVIDER_DATA *data)
 182 {
 183     BOOL ret = FALSE;
 184     HCERTSTORE store;
 185
 186     store = CertOpenStore(CERT_STORE_PROV_MSG, data->dwEncoding,
 187      data->hProv, CERT_STORE_NO_CRYPT_RELEASE_FLAG, data->hMsg);
 188     if (store)
 189     {
 190         ret = data->psPfns->pfnAddStore2Chain(data, store);
 191         CertCloseStore(store, 0);
 192     }
 193     TRACE("returning %d\n", ret);
 194     return ret;
 195 }
 196
 197 static DWORD SOFTPUB_DecodeInnerContent(CRYPT_PROVIDER_DATA *data)
 198 {
 199     BOOL ret;
 200     DWORD size;
 201     LPBYTE buf = NULL;
 202
 203     ret = CryptMsgGetParam(data->hMsg, CMSG_INNER_CONTENT_TYPE_PARAM, 0, NULL,
 204      &size);
 205     if (!ret)
 206         goto error;
 207     buf = data->psPfns->pfnAlloc(size);
 208     if (!buf)
 209     {
 210         SetLastError(ERROR_OUTOFMEMORY);
 211         ret = FALSE;
 212         goto error;
 213     }
 214     ret = CryptMsgGetParam(data->hMsg, CMSG_INNER_CONTENT_TYPE_PARAM, 0, buf,
 215      &size);
 216     if (!ret)
 217         goto error;
 218     if (!strcmp((LPCSTR)buf, SPC_INDIRECT_DATA_OBJID))
 219     {
 220         data->psPfns->pfnFree(buf);
 221         buf = NULL;
 222         ret = CryptMsgGetParam(data->hMsg, CMSG_CONTENT_PARAM, 0, NULL, &size);
 223         if (!ret)
 224             goto error;
 225         buf = data->psPfns->pfnAlloc(size);
 226         if (!buf)
 227         {
 228             SetLastError(ERROR_OUTOFMEMORY);
 229             ret = FALSE;
 230             goto error;
 231         }
 232         ret = CryptMsgGetParam(data->hMsg, CMSG_CONTENT_PARAM, 0, buf, &size);
 233         if (!ret)
 234             goto error;
 235         ret = CryptDecodeObject(data->dwEncoding,
 236          SPC_INDIRECT_DATA_CONTENT_STRUCT, buf, size, 0, NULL, &size);
 237         if (!ret)
 238             goto error;
 239         data->u.pPDSip->psIndirectData = data->psPfns->pfnAlloc(size);
 240         if (!data->u.pPDSip->psIndirectData)
 241         {
 242             SetLastError(ERROR_OUTOFMEMORY);
 243             ret = FALSE;
 244             goto error;
 245         }
 246         ret = CryptDecodeObject(data->dwEncoding,
 247          SPC_INDIRECT_DATA_CONTENT_STRUCT, buf, size, 0,
 248          data->u.pPDSip->psIndirectData, &size);
 249     }
 250     else
 251     {
 252         FIXME("unimplemented for OID %s\n", (LPCSTR)buf);
 253         SetLastError(TRUST_E_SUBJECT_FORM_UNKNOWN);
 254         ret = FALSE;
 255     }
 256
 257 error:
 258     TRACE("returning %d\n", ret);
 259     return ret;
 260 }
 261
 262 HRESULT WINAPI SoftpubLoadMessage(CRYPT_PROVIDER_DATA *data)
 263 {
 264     BOOL ret;
 265
 266     TRACE("(%p)\n", data);
 267
 268     if (!data->padwTrustStepErrors)
 269         return S_FALSE;
 270
 271     switch (data->pWintrustData->dwUnionChoice)
 272     {
 273     case WTD_CHOICE_CERT:
 274         if (data->pWintrustData->u.pCert &&
 275          data->pWintrustData->u.pCert->cbStruct == sizeof(WINTRUST_CERT_INFO))
 276         {
 277             if (data->psPfns)
 278             {
 279                 CRYPT_PROVIDER_SGNR signer = { sizeof(signer), { 0 } };
 280                 DWORD i;
 281
 282                 /* Add a signer with nothing but the time to verify, so we can
 283                  * add a cert to it
 284                  */
 285                 if (data->pWintrustData->u.pCert->psftVerifyAsOf)
 286                     data->sftSystemTime = signer.sftVerifyAsOf;
 287                 else
 288                 {
 289                     SYSTEMTIME sysTime;
 290
 291                     GetSystemTime(&sysTime);
 292                     SystemTimeToFileTime(&sysTime, &signer.sftVerifyAsOf);
 293                 }
 294                 ret = data->psPfns->pfnAddSgnr2Chain(data, FALSE, 0, &signer);
 295                 if (!ret)
 296                     goto error;
 297                 ret = data->psPfns->pfnAddCert2Chain(data, 0, FALSE, 0,
 298                  data->pWintrustData->u.pCert->psCertContext);
 299                 if (!ret)
 300                     goto error;
 301                 for (i = 0; ret && i < data->pWintrustData->u.pCert->chStores;
 302                  i++)
 303                     ret = data->psPfns->pfnAddStore2Chain(data,
 304                      data->pWintrustData->u.pCert->pahStores[i]);
 305             }
 306             else
 307             {
 308                 /* Do nothing!?  See the tests */
 309                 ret = TRUE;
 310             }
 311         }
 312         else
 313         {
 314             SetLastError(ERROR_INVALID_PARAMETER);
 315             ret = FALSE;
 316         }
 317         break;
 318     case WTD_CHOICE_FILE:
 319         if (!data->pWintrustData->u.pFile)
 320         {
 321             SetLastError(ERROR_INVALID_PARAMETER);
 322             ret = FALSE;
 323             goto error;
 324         }
 325         ret = SOFTPUB_OpenFile(data);
 326         if (!ret)
 327             goto error;
 328         ret = SOFTPUB_GetFileSubject(data);
 329         if (!ret)
 330             goto error;
 331         ret = SOFTPUB_GetSIP(data);
 332         if (!ret)
 333             goto error;
 334         ret = SOFTPUB_GetMessageFromFile(data);
 335         if (!ret)
 336             goto error;
 337         ret = SOFTPUB_CreateStoreFromMessage(data);
 338         if (!ret)
 339             goto error;
 340         ret = SOFTPUB_DecodeInnerContent(data);
 341         break;
 342     default:
 343         FIXME("unimplemented for %d\n", data->pWintrustData->dwUnionChoice);
 344         SetLastError(ERROR_INVALID_PARAMETER);
 345         ret = FALSE;
 346     }
 347
 348 error:
 349     if (!ret)
 350         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_OBJPROV] =
 351          GetLastError();
 352     TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
 353      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_OBJPROV]);
 354     return ret ? S_OK : S_FALSE;
 355 }
 356
 357 static CMSG_SIGNER_INFO *WINTRUST_GetSigner(CRYPT_PROVIDER_DATA *data,
 358  DWORD signerIdx)
 359 {
 360     BOOL ret;
 361     CMSG_SIGNER_INFO *signerInfo = NULL;
 362     DWORD size;
 363
 364     ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_INFO_PARAM, signerIdx,
 365      NULL, &size);
 366     if (ret)
 367     {
 368         signerInfo = data->psPfns->pfnAlloc(size);
 369         if (signerInfo)
 370         {
 371             ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_INFO_PARAM,
 372              signerIdx, signerInfo, &size);
 373             if (!ret)
 374             {
 375                 data->psPfns->pfnFree(signerInfo);
 376                 signerInfo = NULL;
 377             }
 378         }
 379         else
 380             SetLastError(ERROR_OUTOFMEMORY);
 381     }
 382     return signerInfo;
 383 }
 384
 385 static BOOL WINTRUST_SaveSigner(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
 386 {
 387     BOOL ret;
 388     CMSG_SIGNER_INFO *signerInfo = WINTRUST_GetSigner(data, signerIdx);
 389
 390     if (signerInfo)
 391     {
 392         CRYPT_PROVIDER_SGNR sgnr = { sizeof(sgnr), { 0 } };
 393
 394         sgnr.psSigner = signerInfo;
 395         sgnr.sftVerifyAsOf = data->sftSystemTime;
 396         ret = data->psPfns->pfnAddSgnr2Chain(data, FALSE, signerIdx, &sgnr);
 397     }
 398     else
 399         ret = FALSE;
 400     return ret;
 401 }
 402
 403 static CERT_INFO *WINTRUST_GetSignerCertInfo(CRYPT_PROVIDER_DATA *data,
 404  DWORD signerIdx)
 405 {
 406     BOOL ret;
 407     CERT_INFO *certInfo = NULL;
 408     DWORD size;
 409
 410     ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_CERT_INFO_PARAM, signerIdx,
 411      NULL, &size);
 412     if (ret)
 413     {
 414         certInfo = data->psPfns->pfnAlloc(size);
 415         if (certInfo)
 416         {
 417             ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_CERT_INFO_PARAM,
 418              signerIdx, certInfo, &size);
 419             if (!ret)
 420             {
 421                 data->psPfns->pfnFree(certInfo);
 422                 certInfo = NULL;
 423             }
 424         }
 425         else
 426             SetLastError(ERROR_OUTOFMEMORY);
 427     }
 428     return certInfo;
 429 }
 430
 431 static BOOL WINTRUST_VerifySigner(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
 432 {
 433     BOOL ret;
 434     CERT_INFO *certInfo = WINTRUST_GetSignerCertInfo(data, signerIdx);
 435
 436     if (certInfo)
 437     {
 438         PCCERT_CONTEXT subject = CertGetSubjectCertificateFromStore(
 439          data->pahStores[0], data->dwEncoding, certInfo);
 440
 441         if (subject)
 442         {
 443             CMSG_CTRL_VERIFY_SIGNATURE_EX_PARA para = { sizeof(para), 0,
 444              signerIdx, CMSG_VERIFY_SIGNER_CERT, (LPVOID)subject };
 445
 446             ret = CryptMsgControl(data->hMsg, 0, CMSG_CTRL_VERIFY_SIGNATURE_EX,
 447              &para);
 448             if (!ret)
 449                 SetLastError(TRUST_E_CERT_SIGNATURE);
 450             else
 451                 data->psPfns->pfnAddCert2Chain(data, signerIdx, FALSE, 0,
 452                  subject);
 453             CertFreeCertificateContext(subject);
 454         }
 455         else
 456         {
 457             SetLastError(TRUST_E_NO_SIGNER_CERT);
 458             ret = FALSE;
 459         }
 460         data->psPfns->pfnFree(certInfo);
 461     }
 462     else
 463         ret = FALSE;
 464     return ret;
 465 }
 466
 467 HRESULT WINAPI SoftpubLoadSignature(CRYPT_PROVIDER_DATA *data)
 468 {
 469     BOOL ret;
 470
 471     TRACE("(%p)\n", data);
 472
 473     if (!data->padwTrustStepErrors)
 474         return S_FALSE;
 475
 476     if (data->hMsg)
 477     {
 478         DWORD signerCount, size;
 479
 480         size = sizeof(signerCount);
 481         ret = CryptMsgGetParam(data->hMsg, CMSG_SIGNER_COUNT_PARAM, 0,
 482          &signerCount, &size);
 483         if (ret)
 484         {
 485             DWORD i;
 486
 487             for (i = 0; ret && i < signerCount; i++)
 488             {
 489                 if ((ret = WINTRUST_SaveSigner(data, i)))
 490                     ret = WINTRUST_VerifySigner(data, i);
 491             }
 492         }
 493         else
 494             SetLastError(TRUST_E_NOSIGNATURE);
 495     }
 496     else
 497         ret = TRUE;
 498     if (!ret)
 499         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_SIGPROV] =
 500          GetLastError();
 501     return ret ? S_OK : S_FALSE;
 502 }
 503
 504 BOOL WINAPI SoftpubCheckCert(CRYPT_PROVIDER_DATA *data, DWORD idxSigner,
 505  BOOL fCounterSignerChain, DWORD idxCounterSigner)
 506 {
 507     BOOL ret;
 508
 509     TRACE("(%p, %d, %d, %d)\n", data, idxSigner, fCounterSignerChain,
 510      idxCounterSigner);
 511
 512     if (fCounterSignerChain)
 513     {
 514         FIXME("unimplemented for counter signers\n");
 515         ret = FALSE;
 516     }
 517     else
 518     {
 519         PCERT_SIMPLE_CHAIN simpleChain =
 520          data->pasSigners[idxSigner].pChainContext->rgpChain[0];
 521         DWORD i;
 522
 523         ret = TRUE;
 524         for (i = 0; i < simpleChain->cElement; i++)
 525         {
 526             /* Set confidence */
 527             data->pasSigners[idxSigner].pasCertChain[i].dwConfidence = 0;
 528             if (!(simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
 529              CERT_TRUST_IS_NOT_TIME_VALID))
 530                 data->pasSigners[idxSigner].pasCertChain[i].dwConfidence
 531                  |= CERT_CONFIDENCE_TIME;
 532             if (!(simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
 533              CERT_TRUST_IS_NOT_TIME_NESTED))
 534                 data->pasSigners[idxSigner].pasCertChain[i].dwConfidence
 535                  |= CERT_CONFIDENCE_TIMENEST;
 536             if (!(simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
 537              CERT_TRUST_IS_NOT_SIGNATURE_VALID))
 538                 data->pasSigners[idxSigner].pasCertChain[i].dwConfidence
 539                  |= CERT_CONFIDENCE_SIG;
 540             /* Set additional flags */
 541             if (!(simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
 542              CERT_TRUST_IS_UNTRUSTED_ROOT))
 543                 data->pasSigners[idxSigner].pasCertChain[i].fTrustedRoot = TRUE;
 544             if (simpleChain->rgpElement[i]->TrustStatus.dwInfoStatus &
 545              CERT_TRUST_IS_SELF_SIGNED)
 546                 data->pasSigners[idxSigner].pasCertChain[i].fSelfSigned = TRUE;
 547             if (simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus &
 548              CERT_TRUST_IS_CYCLIC)
 549                 data->pasSigners[idxSigner].pasCertChain[i].fIsCyclic = TRUE;
 550         }
 551     }
 552     return ret;
 553 }
 554
 555 static DWORD WINTRUST_TrustStatusToConfidence(DWORD errorStatus)
 556 {
 557     DWORD confidence = 0;
 558
 559     confidence = 0;
 560     if (!(errorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID))
 561         confidence |= CERT_CONFIDENCE_SIG;
 562     if (!(errorStatus & CERT_TRUST_IS_NOT_TIME_VALID))
 563         confidence |= CERT_CONFIDENCE_TIME;
 564     if (!(errorStatus & CERT_TRUST_IS_NOT_TIME_NESTED))
 565         confidence |= CERT_CONFIDENCE_TIMENEST;
 566     return confidence;
 567 }
 568
 569 static DWORD WINTRUST_TrustStatusToError(DWORD errorStatus)
 570 {
 571     DWORD error;
 572
 573     if (errorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
 574         error = TRUST_E_CERT_SIGNATURE;
 575     else if (errorStatus & CERT_TRUST_IS_UNTRUSTED_ROOT)
 576         error = CERT_E_UNTRUSTEDROOT;
 577     else if (errorStatus & CERT_TRUST_IS_NOT_TIME_VALID)
 578         error = CERT_E_EXPIRED;
 579     else if (errorStatus & CERT_TRUST_IS_NOT_TIME_NESTED)
 580         error = CERT_E_VALIDITYPERIODNESTING;
 581     else if (errorStatus & CERT_TRUST_IS_REVOKED)
 582         error = CERT_E_REVOKED;
 583     else if (errorStatus & CERT_TRUST_IS_OFFLINE_REVOCATION ||
 584      errorStatus & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
 585         error = CERT_E_REVOCATION_FAILURE;
 586     else if (errorStatus & CERT_TRUST_IS_NOT_VALID_FOR_USAGE)
 587         error = CERT_E_WRONG_USAGE;
 588     else if (errorStatus & CERT_TRUST_IS_CYCLIC)
 589         error = CERT_E_CHAINING;
 590     else if (errorStatus & CERT_TRUST_INVALID_EXTENSION)
 591         error = CERT_E_CRITICAL;
 592     else if (errorStatus & CERT_TRUST_INVALID_POLICY_CONSTRAINTS)
 593         error = CERT_E_INVALID_POLICY;
 594     else if (errorStatus & CERT_TRUST_INVALID_BASIC_CONSTRAINTS)
 595         error = TRUST_E_BASIC_CONSTRAINTS;
 596     else if (errorStatus & CERT_TRUST_INVALID_NAME_CONSTRAINTS ||
 597      errorStatus & CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT ||
 598      errorStatus & CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT ||
 599      errorStatus & CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT ||
 600      errorStatus & CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT)
 601         error = CERT_E_INVALID_NAME;
 602     else if (errorStatus & CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY)
 603         error = CERT_E_INVALID_POLICY;
 604     else if (errorStatus)
 605     {
 606         FIXME("unknown error status %08x\n", errorStatus);
 607         error = TRUST_E_SYSTEM_ERROR;
 608     }
 609     else
 610         error = S_OK;
 611     return error;
 612 }
 613
 614 static BOOL WINTRUST_CopyChain(CRYPT_PROVIDER_DATA *data, DWORD signerIdx)
 615 {
 616     BOOL ret;
 617     PCERT_SIMPLE_CHAIN simpleChain =
 618      data->pasSigners[signerIdx].pChainContext->rgpChain[0];
 619     DWORD i;
 620
 621     data->pasSigners[signerIdx].pasCertChain[0].dwConfidence =
 622      WINTRUST_TrustStatusToConfidence(
 623      simpleChain->rgpElement[0]->TrustStatus.dwErrorStatus);
 624     data->pasSigners[signerIdx].pasCertChain[0].dwError =
 625      WINTRUST_TrustStatusToError(
 626      simpleChain->rgpElement[0]->TrustStatus.dwErrorStatus);
 627     data->pasSigners[signerIdx].pasCertChain[0].pChainElement =
 628      simpleChain->rgpElement[0];
 629     ret = TRUE;
 630     for (i = 1; ret && i < simpleChain->cElement; i++)
 631     {
 632         ret = data->psPfns->pfnAddCert2Chain(data, signerIdx, FALSE, 0,
 633          simpleChain->rgpElement[i]->pCertContext);
 634         if (ret)
 635         {
 636             data->pasSigners[signerIdx].pasCertChain[i].pChainElement =
 637              simpleChain->rgpElement[i];
 638             data->pasSigners[signerIdx].pasCertChain[i].dwConfidence =
 639              WINTRUST_TrustStatusToConfidence(
 640              simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus);
 641             data->pasSigners[signerIdx].pasCertChain[i].dwError =
 642              WINTRUST_TrustStatusToError(
 643              simpleChain->rgpElement[i]->TrustStatus.dwErrorStatus);
 644         }
 645     }
 646     return ret;
 647 }
 648
 649 static void WINTRUST_CreateChainPolicyCreateInfo(
 650  const CRYPT_PROVIDER_DATA *data, PWTD_GENERIC_CHAIN_POLICY_CREATE_INFO info,
 651  PCERT_CHAIN_PARA chainPara)
 652 {
 653     chainPara->cbSize = sizeof(CERT_CHAIN_PARA);
 654     if (data->pRequestUsage)
 655         chainPara->RequestedUsage = *data->pRequestUsage;
 656     else
 657     {
 658         chainPara->RequestedUsage.dwType = 0;
 659         chainPara->RequestedUsage.Usage.cUsageIdentifier = 0;
 660     }
 661     info->u.cbSize = sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO);
 662     info->hChainEngine = NULL;
 663     info->pChainPara = chainPara;
 664     if (data->dwProvFlags & CPD_REVOCATION_CHECK_END_CERT)
 665         info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_END_CERT;
 666     else if (data->dwProvFlags & CPD_REVOCATION_CHECK_CHAIN)
 667         info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN;
 668     else if (data->dwProvFlags & CPD_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT)
 669         info->dwFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT;
 670     else
 671         info->dwFlags = 0;
 672     info->pvReserved = NULL;
 673 }
 674
 675 static BOOL WINTRUST_CreateChainForSigner(CRYPT_PROVIDER_DATA *data,
 676  DWORD signer, PWTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo,
 677  PCERT_CHAIN_PARA chainPara)
 678 {
 679     BOOL ret = TRUE;
 680     HCERTSTORE store = NULL;
 681
 682     if (data->chStores)
 683     {
 684         store = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
 685          CERT_STORE_CREATE_NEW_FLAG, NULL);
 686         if (store)
 687         {
 688             DWORD i;
 689
 690             for (i = 0; i < data->chStores; i++)
 691                 CertAddStoreToCollection(store, data->pahStores[i], 0, 0);
 692         }
 693     }
 694     /* Expect the end certificate for each signer to be the only cert in the
 695      * chain:
 696      */
 697     if (data->pasSigners[signer].csCertChain)
 698     {
 699         /* Create a certificate chain for each signer */
 700         ret = CertGetCertificateChain(createInfo->hChainEngine,
 701          data->pasSigners[signer].pasCertChain[0].pCert,
 702          &data->pasSigners[signer].sftVerifyAsOf, store,
 703          chainPara, createInfo->dwFlags, createInfo->pvReserved,
 704          &data->pasSigners[signer].pChainContext);
 705         if (ret)
 706         {
 707             if (data->pasSigners[signer].pChainContext->cChain != 1)
 708             {
 709                 FIXME("unimplemented for more than 1 simple chain\n");
 710                 ret = FALSE;
 711             }
 712             else
 713             {
 714                 if ((ret = WINTRUST_CopyChain(data, signer)))
 715                 {
 716                     if (data->psPfns->pfnCertCheckPolicy)
 717                         ret = data->psPfns->pfnCertCheckPolicy(data, signer,
 718                          FALSE, 0);
 719                     else
 720                         TRACE("no cert check policy, skipping policy check\n");
 721                 }
 722             }
 723         }
 724     }
 725     CertCloseStore(store, 0);
 726     return ret;
 727 }
 728
 729 HRESULT WINAPI WintrustCertificateTrust(CRYPT_PROVIDER_DATA *data)
 730 {
 731     BOOL ret;
 732
 733     TRACE("(%p)\n", data);
 734
 735     if (!data->csSigners)
 736     {
 737         ret = FALSE;
 738         SetLastError(TRUST_E_NOSIGNATURE);
 739     }
 740     else
 741     {
 742         DWORD i;
 743         WTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo;
 744         CERT_CHAIN_PARA chainPara;
 745
 746         WINTRUST_CreateChainPolicyCreateInfo(data, &createInfo, &chainPara);
 747         ret = TRUE;
 748         for (i = 0; i < data->csSigners; i++)
 749             ret = WINTRUST_CreateChainForSigner(data, i, &createInfo,
 750              &chainPara);
 751     }
 752     if (!ret)
 753         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV] =
 754          GetLastError();
 755     TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
 756      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV]);
 757     return ret ? S_OK : S_FALSE;
 758 }
 759
 760 HRESULT WINAPI GenericChainCertificateTrust(CRYPT_PROVIDER_DATA *data)
 761 {
 762     BOOL ret;
 763     WTD_GENERIC_CHAIN_POLICY_DATA *policyData =
 764      (WTD_GENERIC_CHAIN_POLICY_DATA *)data->pWintrustData->pPolicyCallbackData;
 765
 766     TRACE("(%p)\n", data);
 767
 768     if (policyData && policyData->u.cbSize !=
 769      sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO))
 770     {
 771         SetLastError(ERROR_INVALID_PARAMETER);
 772         ret = FALSE;
 773         goto end;
 774     }
 775     if (!data->csSigners)
 776     {
 777         ret = FALSE;
 778         SetLastError(TRUST_E_NOSIGNATURE);
 779     }
 780     else
 781     {
 782         DWORD i;
 783         WTD_GENERIC_CHAIN_POLICY_CREATE_INFO createInfo, *pCreateInfo;
 784         CERT_CHAIN_PARA chainPara, *pChainPara;
 785
 786         if (policyData)
 787         {
 788             pCreateInfo = policyData->pSignerChainInfo;
 789             pChainPara = pCreateInfo->pChainPara;
 790         }
 791         else
 792         {
 793             WINTRUST_CreateChainPolicyCreateInfo(data, &createInfo, &chainPara);
 794             pChainPara = &chainPara;
 795             pCreateInfo = &createInfo;
 796         }
 797         ret = TRUE;
 798         for (i = 0; i < data->csSigners; i++)
 799             ret = WINTRUST_CreateChainForSigner(data, i, pCreateInfo,
 800              pChainPara);
 801     }
 802
 803 end:
 804     if (!ret)
 805         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV] =
 806          GetLastError();
 807     TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
 808      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_CERTPROV]);
 809     return ret ? S_OK : S_FALSE;
 810 }
 811
 812 HRESULT WINAPI SoftpubAuthenticode(CRYPT_PROVIDER_DATA *data)
 813 {
 814     BOOL ret;
 815     CERT_CHAIN_POLICY_STATUS policyStatus = { sizeof(policyStatus), 0 };
 816
 817     TRACE("(%p)\n", data);
 818
 819     if (data->pWintrustData->dwUIChoice != WTD_UI_NONE)
 820         FIXME("unimplemented for UI choice %d\n",
 821          data->pWintrustData->dwUIChoice);
 822     if (!data->csSigners)
 823     {
 824         ret = FALSE;
 825         policyStatus.dwError = TRUST_E_NOSIGNATURE;
 826     }
 827     else
 828     {
 829         DWORD i;
 830
 831         ret = TRUE;
 832         for (i = 0; ret && i < data->csSigners; i++)
 833         {
 834             BYTE hash[20];
 835             DWORD size = sizeof(hash);
 836
 837             /* First make sure cert isn't disallowed */
 838             if ((ret = CertGetCertificateContextProperty(
 839              data->pasSigners[i].pasCertChain[0].pCert,
 840              CERT_SIGNATURE_HASH_PROP_ID, hash, &size)))
 841             {
 842                 static const WCHAR disallowedW[] =
 843                  { 'D','i','s','a','l','l','o','w','e','d',0 };
 844                 HCERTSTORE disallowed = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,
 845                  X509_ASN_ENCODING, 0, CERT_SYSTEM_STORE_CURRENT_USER,
 846                  disallowedW);
 847
 848                 if (disallowed)
 849                 {
 850                     PCCERT_CONTEXT found = CertFindCertificateInStore(
 851                      disallowed, X509_ASN_ENCODING, 0, CERT_FIND_SIGNATURE_HASH,
 852                      hash, NULL);
 853
 854                     if (found)
 855                     {
 856                         /* Disallowed!  Can't verify it. */
 857                         policyStatus.dwError = TRUST_E_SUBJECT_NOT_TRUSTED;
 858                         ret = FALSE;
 859                         CertFreeCertificateContext(found);
 860                     }
 861                     CertCloseStore(disallowed, 0);
 862                 }
 863             }
 864             if (ret)
 865             {
 866                 CERT_CHAIN_POLICY_PARA policyPara = { sizeof(policyPara), 0 };
 867
 868                 if (data->dwRegPolicySettings & WTPF_TRUSTTEST)
 869                     policyPara.dwFlags |= CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG;
 870                 if (data->dwRegPolicySettings & WTPF_TESTCANBEVALID)
 871                     policyPara.dwFlags |= CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG;
 872                 if (data->dwRegPolicySettings & WTPF_IGNOREEXPIRATION)
 873                     policyPara.dwFlags |=
 874                      CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG |
 875                      CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG |
 876                      CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG;
 877                 if (data->dwRegPolicySettings & WTPF_IGNOREREVOKATION)
 878                     policyPara.dwFlags |=
 879                      CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG |
 880                      CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG |
 881                      CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG |
 882                      CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG;
 883                 CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_AUTHENTICODE,
 884                  data->pasSigners[i].pChainContext, &policyPara, &policyStatus);
 885                 if (policyStatus.dwError != NO_ERROR)
 886                     ret = FALSE;
 887             }
 888         }
 889     }
 890     if (!ret)
 891         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV] =
 892          policyStatus.dwError;
 893     TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE,
 894      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV]);
 895     return ret ? S_OK : S_FALSE;
 896 }
 897
 898 static HRESULT WINAPI WINTRUST_DefaultPolicy(CRYPT_PROVIDER_DATA *pProvData,
 899  DWORD dwStepError, DWORD dwRegPolicySettings, DWORD cSigner,
 900  PWTD_GENERIC_CHAIN_POLICY_SIGNER_INFO rgpSigner, void *pvPolicyArg)
 901 {
 902     DWORD i;
 903     CERT_CHAIN_POLICY_STATUS policyStatus = { sizeof(policyStatus), 0 };
 904
 905     for (i = 0; !policyStatus.dwError && i < cSigner; i++)
 906     {
 907         CERT_CHAIN_POLICY_PARA policyPara = { sizeof(policyPara), 0 };
 908
 909         if (dwRegPolicySettings & WTPF_IGNOREEXPIRATION)
 910             policyPara.dwFlags |=
 911              CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG |
 912              CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG |
 913              CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG;
 914         if (dwRegPolicySettings & WTPF_IGNOREREVOKATION)
 915             policyPara.dwFlags |=
 916              CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG |
 917              CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG |
 918              CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG |
 919              CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG;
 920         CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE,
 921          rgpSigner[i].pChainContext, &policyPara, &policyStatus);
 922     }
 923     return policyStatus.dwError;
 924 }
 925
 926 HRESULT WINAPI GenericChainFinalProv(CRYPT_PROVIDER_DATA *data)
 927 {
 928     HRESULT err = NO_ERROR; /* not a typo, MS confused the types */
 929     WTD_GENERIC_CHAIN_POLICY_DATA *policyData =
 930      (WTD_GENERIC_CHAIN_POLICY_DATA *)data->pWintrustData->pPolicyCallbackData;
 931
 932     TRACE("(%p)\n", data);
 933
 934     if (data->pWintrustData->dwUIChoice != WTD_UI_NONE)
 935         FIXME("unimplemented for UI choice %d\n",
 936          data->pWintrustData->dwUIChoice);
 937     if (!data->csSigners)
 938         err = TRUST_E_NOSIGNATURE;
 939     else
 940     {
 941         PFN_WTD_GENERIC_CHAIN_POLICY_CALLBACK policyCallback;
 942         void *policyArg;
 943         WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO *signers = NULL;
 944
 945         if (policyData)
 946         {
 947             policyCallback = policyData->pfnPolicyCallback;
 948             policyArg = policyData->pvPolicyArg;
 949         }
 950         else
 951         {
 952             policyCallback = WINTRUST_DefaultPolicy;
 953             policyArg = NULL;
 954         }
 955         if (data->csSigners)
 956         {
 957             DWORD i;
 958
 959             signers = data->psPfns->pfnAlloc(
 960              data->csSigners * sizeof(WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO));
 961             if (signers)
 962             {
 963                 for (i = 0; i < data->csSigners; i++)
 964                 {
 965                     signers[i].u.cbSize =
 966                      sizeof(WTD_GENERIC_CHAIN_POLICY_SIGNER_INFO);
 967                     signers[i].pChainContext =
 968                      data->pasSigners[i].pChainContext;
 969                     signers[i].dwSignerType = data->pasSigners[i].dwSignerType;
 970                     signers[i].pMsgSignerInfo = data->pasSigners[i].psSigner;
 971                     signers[i].dwError = data->pasSigners[i].dwError;
 972                     if (data->pasSigners[i].csCounterSigners)
 973                         FIXME("unimplemented for counter signers\n");
 974                     signers[i].cCounterSigner = 0;
 975                     signers[i].rgpCounterSigner = NULL;
 976                 }
 977             }
 978             else
 979                 err = ERROR_OUTOFMEMORY;
 980         }
 981         if (err == NO_ERROR)
 982             err = policyCallback(data, TRUSTERROR_STEP_FINAL_POLICYPROV,
 983              data->dwRegPolicySettings, data->csSigners, signers, policyArg);
 984         data->psPfns->pfnFree(signers);
 985     }
 986     if (err != NO_ERROR)
 987         data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV] = err;
 988     TRACE("returning %d (%08x)\n", err == NO_ERROR ? S_OK : S_FALSE,
 989      data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_POLICYPROV]);
 990     return err == NO_ERROR ? S_OK : S_FALSE;
 991 }
 992
 993 HRESULT WINAPI SoftpubCleanup(CRYPT_PROVIDER_DATA *data)
 994 {
 995     DWORD i, j;
 996
 997     for (i = 0; i < data->csSigners; i++)
 998     {
 999         for (j = 0; j < data->pasSigners[i].csCertChain; j++)
1000             CertFreeCertificateContext(data->pasSigners[i].pasCertChain[j].pCert);
1001         data->psPfns->pfnFree(data->pasSigners[i].pasCertChain);
1002         data->psPfns->pfnFree(data->pasSigners[i].psSigner);
1003         CertFreeCertificateChain(data->pasSigners[i].pChainContext);
1004     }
1005     data->psPfns->pfnFree(data->pasSigners);
1006
1007     for (i = 0; i < data->chStores; i++)
1008         CertCloseStore(data->pahStores[i], 0);
1009     data->psPfns->pfnFree(data->pahStores);
1010
1011     if (data->u.pPDSip)
1012     {
1013         data->psPfns->pfnFree(data->u.pPDSip->pSip);
1014         data->psPfns->pfnFree(data->u.pPDSip->pCATSip);
1015         data->psPfns->pfnFree(data->u.pPDSip->psSipSubjectInfo);
1016         data->psPfns->pfnFree(data->u.pPDSip->psSipCATSubjectInfo);
1017         data->psPfns->pfnFree(data->u.pPDSip->psIndirectData);
1018     }
1019
1020     CryptMsgClose(data->hMsg);
1021
1022     if (data->fOpenedFile)
1023         CloseHandle(data->pWintrustData->u.pFile->hFile);
1024
1025     return S_OK;
1026 }