dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #define NONAMELESSUNION
  24 #include "windef.h"
  25 #include "winbase.h"
  26 #include "wincrypt.h"
  27 #include "winnls.h"
  28 #include "rpc.h"
  29 #include "wine/debug.h"
  30 #include "crypt32_private.h"
  31
  32 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  33
  34 /* Internal version of CertGetCertificateContextProperty that gets properties
  35  * directly from the context (or the context it's linked to, depending on its
  36  * type.) Doesn't handle special-case properties, since they are handled by
  37  * CertGetCertificateContextProperty, and are particular to the store in which
  38  * the property exists (which is separate from the context.)
  39  */
  40 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
  41  void *pvData, DWORD *pcbData);
  42
  43 /* Internal version of CertSetCertificateContextProperty that sets properties
  44  * directly on the context (or the context it's linked to, depending on its
  45  * type.) Doesn't handle special cases, since they're handled by
  46  * CertSetCertificateContextProperty anyway.
  47  */
  48 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
  49  DWORD dwFlags, const void *pvData);
  50
  51 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  52  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  53  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  54 {
  55     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  56      pbCertEncoded, cbCertEncoded);
  57     BOOL ret;
  58
  59     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  60      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  61
  62     if (cert)
  63     {
  64         ret = CertAddCertificateContextToStore(hCertStore, cert,
  65          dwAddDisposition, ppCertContext);
  66         CertFreeCertificateContext(cert);
  67     }
  68     else
  69         ret = FALSE;
  70     return ret;
  71 }
  72
  73 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
  74  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  75 {
  76     PCERT_CONTEXT cert = NULL;
  77     BOOL ret;
  78     PCERT_INFO certInfo = NULL;
  79     DWORD size = 0;
  80
  81     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
  82      cbCertEncoded);
  83
  84     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
  85      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
  86      (BYTE *)&certInfo, &size);
  87     if (ret)
  88     {
  89         BYTE *data = NULL;
  90
  91         cert = (PCERT_CONTEXT)Context_CreateDataContext(sizeof(CERT_CONTEXT));
  92         if (!cert)
  93             goto end;
  94         data = CryptMemAlloc(cbCertEncoded);
  95         if (!data)
  96         {
  97             CryptMemFree(cert);
  98             cert = NULL;
  99             goto end;
 100         }
 101         memcpy(data, pbCertEncoded, cbCertEncoded);
 102         cert->dwCertEncodingType = dwCertEncodingType;
 103         cert->pbCertEncoded      = data;
 104         cert->cbCertEncoded      = cbCertEncoded;
 105         cert->pCertInfo          = certInfo;
 106         cert->hCertStore         = 0;
 107     }
 108
 109 end:
 110     return (PCCERT_CONTEXT)cert;
 111 }
 112
 113 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
 114  PCCERT_CONTEXT pCertContext)
 115 {
 116     TRACE("(%p)\n", pCertContext);
 117     Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
 118     return pCertContext;
 119 }
 120
 121 static void CertDataContext_Free(void *context)
 122 {
 123     PCERT_CONTEXT certContext = (PCERT_CONTEXT)context;
 124
 125     CryptMemFree(certContext->pbCertEncoded);
 126     LocalFree(certContext->pCertInfo);
 127 }
 128
 129 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 130 {
 131     TRACE("(%p)\n", pCertContext);
 132
 133     if (pCertContext)
 134         Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
 135          CertDataContext_Free);
 136     return TRUE;
 137 }
 138
 139 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 140  DWORD dwPropId)
 141 {
 142     PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
 143      (void *)pCertContext, sizeof(CERT_CONTEXT));
 144     DWORD ret;
 145
 146     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 147
 148     if (properties)
 149         ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
 150     else
 151         ret = 0;
 152     return ret;
 153 }
 154
 155 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
 156  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 157  DWORD *pcbData)
 158 {
 159     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 160      pcbData);
 161     if (ret)
 162     {
 163         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 164
 165         ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
 166     }
 167     return ret;
 168 }
 169
 170 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
 171  void *pvData, DWORD *pcbData)
 172 {
 173     PCCERT_CONTEXT pCertContext = (PCCERT_CONTEXT)context;
 174     PCONTEXT_PROPERTY_LIST properties =
 175      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 176     BOOL ret;
 177     CRYPT_DATA_BLOB blob;
 178
 179     TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
 180
 181     if (properties)
 182         ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
 183     else
 184         ret = FALSE;
 185     if (ret)
 186     {
 187         if (!pvData)
 188         {
 189             *pcbData = blob.cbData;
 190             ret = TRUE;
 191         }
 192         else if (*pcbData < blob.cbData)
 193         {
 194             SetLastError(ERROR_MORE_DATA);
 195             *pcbData = blob.cbData;
 196         }
 197         else
 198         {
 199             memcpy(pvData, blob.pbData, blob.cbData);
 200             *pcbData = blob.cbData;
 201             ret = TRUE;
 202         }
 203     }
 204     else
 205     {
 206         /* Implicit properties */
 207         switch (dwPropId)
 208         {
 209         case CERT_SHA1_HASH_PROP_ID:
 210             ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
 211              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 212              pcbData);
 213             break;
 214         case CERT_MD5_HASH_PROP_ID:
 215             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 216              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 217              pcbData);
 218             break;
 219         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 220             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 221              pCertContext->pCertInfo->Subject.pbData,
 222              pCertContext->pCertInfo->Subject.cbData,
 223              pvData, pcbData);
 224             break;
 225         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 226             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 227              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 228              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 229              pvData, pcbData);
 230             break;
 231         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 232             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 233              pCertContext->pCertInfo->SerialNumber.pbData,
 234              pCertContext->pCertInfo->SerialNumber.cbData,
 235              pvData, pcbData);
 236             break;
 237         case CERT_SIGNATURE_HASH_PROP_ID:
 238             FIXME("CERT_SIGNATURE_HASH_PROP_ID unimplemented\n");
 239             SetLastError(CRYPT_E_NOT_FOUND);
 240             break;
 241         default:
 242             SetLastError(CRYPT_E_NOT_FOUND);
 243         }
 244     }
 245     TRACE("returning %d\n", ret);
 246     return ret;
 247 }
 248
 249 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
 250 {
 251     DWORD i, containerLen, provNameLen;
 252     LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
 253
 254     info->pwszContainerName = (LPWSTR)data;
 255     containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 256     data += containerLen;
 257
 258     info->pwszProvName = (LPWSTR)data;
 259     provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 260     data += provNameLen;
 261
 262     info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
 263     data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 264
 265     for (i = 0; i < info->cProvParam; i++)
 266     {
 267         info->rgProvParam[i].pbData = data;
 268         data += info->rgProvParam[i].cbData;
 269     }
 270 }
 271
 272 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 273  DWORD dwPropId, void *pvData, DWORD *pcbData)
 274 {
 275     BOOL ret;
 276
 277     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 278
 279     switch (dwPropId)
 280     {
 281     case 0:
 282     case CERT_CERT_PROP_ID:
 283     case CERT_CRL_PROP_ID:
 284     case CERT_CTL_PROP_ID:
 285         SetLastError(E_INVALIDARG);
 286         ret = FALSE;
 287         break;
 288     case CERT_ACCESS_STATE_PROP_ID:
 289         if (!pvData)
 290         {
 291             *pcbData = sizeof(DWORD);
 292             ret = TRUE;
 293         }
 294         else if (*pcbData < sizeof(DWORD))
 295         {
 296             SetLastError(ERROR_MORE_DATA);
 297             *pcbData = sizeof(DWORD);
 298             ret = FALSE;
 299         }
 300         else
 301         {
 302             *(DWORD *)pvData =
 303              CertStore_GetAccessState(pCertContext->hCertStore);
 304             ret = TRUE;
 305         }
 306         break;
 307     case CERT_KEY_IDENTIFIER_PROP_ID:
 308         ret = CertContext_GetProperty((void *)pCertContext, dwPropId,
 309          pvData, pcbData);
 310         if (!ret)
 311             SetLastError(ERROR_INVALID_DATA);
 312         break;
 313     case CERT_KEY_PROV_HANDLE_PROP_ID:
 314     {
 315         CERT_KEY_CONTEXT keyContext;
 316         DWORD size = sizeof(keyContext);
 317
 318         ret = CertContext_GetProperty((void *)pCertContext,
 319          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 320         if (ret)
 321         {
 322             if (!pvData)
 323             {
 324                 *pcbData = sizeof(HCRYPTPROV);
 325                 ret = TRUE;
 326             }
 327             else if (*pcbData < sizeof(HCRYPTPROV))
 328             {
 329                 SetLastError(ERROR_MORE_DATA);
 330                 *pcbData = sizeof(HCRYPTPROV);
 331                 ret = FALSE;
 332             }
 333             else
 334             {
 335                 *(HCRYPTPROV *)pvData = keyContext.hCryptProv;
 336                 ret = TRUE;
 337             }
 338         }
 339         break;
 340     }
 341     case CERT_KEY_PROV_INFO_PROP_ID:
 342         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 343          pcbData);
 344         if (ret && pvData)
 345             CRYPT_FixKeyProvInfoPointers((PCRYPT_KEY_PROV_INFO)pvData);
 346         break;
 347     default:
 348         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 349          pcbData);
 350     }
 351
 352     TRACE("returning %d\n", ret);
 353     return ret;
 354 }
 355
 356 /* Copies key provider info from from into to, where to is assumed to be a
 357  * contiguous buffer of memory large enough for from and all its associated
 358  * data, but whose pointers are uninitialized.
 359  * Upon return, to contains a contiguous copy of from, packed in the following
 360  * order:
 361  * - CRYPT_KEY_PROV_INFO
 362  * - pwszContainerName
 363  * - pwszProvName
 364  * - rgProvParam[0]...
 365  */
 366 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
 367  const CRYPT_KEY_PROV_INFO *from)
 368 {
 369     DWORD i;
 370     LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
 371
 372     if (from->pwszContainerName)
 373     {
 374         to->pwszContainerName = (LPWSTR)nextData;
 375         lstrcpyW(to->pwszContainerName, from->pwszContainerName);
 376         nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 377     }
 378     else
 379         to->pwszContainerName = NULL;
 380     if (from->pwszProvName)
 381     {
 382         to->pwszProvName = (LPWSTR)nextData;
 383         lstrcpyW(to->pwszProvName, from->pwszProvName);
 384         nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 385     }
 386     else
 387         to->pwszProvName = NULL;
 388     to->dwProvType = from->dwProvType;
 389     to->dwFlags = from->dwFlags;
 390     to->cProvParam = from->cProvParam;
 391     to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
 392     nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 393     to->dwKeySpec = from->dwKeySpec;
 394     for (i = 0; i < to->cProvParam; i++)
 395     {
 396         memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
 397          sizeof(CRYPT_KEY_PROV_PARAM));
 398         to->rgProvParam[i].pbData = nextData;
 399         memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
 400          from->rgProvParam[i].cbData);
 401         nextData += from->rgProvParam[i].cbData;
 402     }
 403 }
 404
 405 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
 406  const CRYPT_KEY_PROV_INFO *info)
 407 {
 408     BOOL ret;
 409     LPBYTE buf = NULL;
 410     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
 411
 412     if (info->pwszContainerName)
 413         containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 414     else
 415         containerSize = 0;
 416     if (info->pwszProvName)
 417         provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 418     else
 419         provNameSize = 0;
 420     size += containerSize + provNameSize;
 421     for (i = 0; i < info->cProvParam; i++)
 422         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 423     buf = CryptMemAlloc(size);
 424     if (buf)
 425     {
 426         CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
 427         ret = ContextPropertyList_SetProperty(properties,
 428          CERT_KEY_PROV_INFO_PROP_ID, buf, size);
 429         CryptMemFree(buf);
 430     }
 431     else
 432         ret = FALSE;
 433     return ret;
 434 }
 435
 436 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
 437  DWORD dwFlags, const void *pvData)
 438 {
 439     PCONTEXT_PROPERTY_LIST properties =
 440      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 441     BOOL ret;
 442
 443     TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
 444
 445     if (!properties)
 446         ret = FALSE;
 447     else
 448     {
 449         switch (dwPropId)
 450         {
 451         case CERT_AUTO_ENROLL_PROP_ID:
 452         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 453         case CERT_DESCRIPTION_PROP_ID:
 454         case CERT_FRIENDLY_NAME_PROP_ID:
 455         case CERT_HASH_PROP_ID:
 456         case CERT_KEY_IDENTIFIER_PROP_ID:
 457         case CERT_MD5_HASH_PROP_ID:
 458         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 459         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 460         case CERT_PVK_FILE_PROP_ID:
 461         case CERT_SIGNATURE_HASH_PROP_ID:
 462         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 463         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 464         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 465         case CERT_ENROLLMENT_PROP_ID:
 466         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 467         case CERT_RENEWAL_PROP_ID:
 468         {
 469             if (pvData)
 470             {
 471                 const CRYPT_DATA_BLOB *blob = (const CRYPT_DATA_BLOB *)pvData;
 472
 473                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 474                  blob->pbData, blob->cbData);
 475             }
 476             else
 477             {
 478                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 479                 ret = TRUE;
 480             }
 481             break;
 482         }
 483         case CERT_DATE_STAMP_PROP_ID:
 484             if (pvData)
 485                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 486                  (const BYTE *)pvData, sizeof(FILETIME));
 487             else
 488             {
 489                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 490                 ret = TRUE;
 491             }
 492             break;
 493         case CERT_KEY_CONTEXT_PROP_ID:
 494         {
 495             if (pvData)
 496             {
 497                 const CERT_KEY_CONTEXT *keyContext = (const CERT_KEY_CONTEXT *)pvData;
 498
 499                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 500                  (const BYTE *)keyContext, keyContext->cbSize);
 501             }
 502             else
 503             {
 504                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 505                 ret = TRUE;
 506             }
 507             break;
 508         }
 509         case CERT_KEY_PROV_INFO_PROP_ID:
 510             if (pvData)
 511                 ret = CertContext_SetKeyProvInfoProperty(properties,
 512                  (const CRYPT_KEY_PROV_INFO *)pvData);
 513             else
 514             {
 515                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 516                 ret = TRUE;
 517             }
 518             break;
 519         case CERT_KEY_PROV_HANDLE_PROP_ID:
 520         {
 521             CERT_KEY_CONTEXT keyContext;
 522             DWORD size = sizeof(keyContext);
 523
 524             ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 525              &keyContext, &size);
 526             if (ret)
 527             {
 528                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 529                     CryptReleaseContext(keyContext.hCryptProv, 0);
 530                 if (pvData)
 531                     keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 532                 else
 533                     keyContext.hCryptProv = 0;
 534                 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 535                  0, &keyContext);
 536             }
 537             break;
 538         }
 539         default:
 540             FIXME("%d: stub\n", dwPropId);
 541             ret = FALSE;
 542         }
 543     }
 544     TRACE("returning %d\n", ret);
 545     return ret;
 546 }
 547
 548 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 549  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 550 {
 551     BOOL ret;
 552
 553     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 554
 555     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 556      * crashes on most of these, I'll be safer.
 557      */
 558     switch (dwPropId)
 559     {
 560     case 0:
 561     case CERT_ACCESS_STATE_PROP_ID:
 562     case CERT_CERT_PROP_ID:
 563     case CERT_CRL_PROP_ID:
 564     case CERT_CTL_PROP_ID:
 565         SetLastError(E_INVALIDARG);
 566         return FALSE;
 567     }
 568     ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
 569      pvData);
 570     TRACE("returning %d\n", ret);
 571     return ret;
 572 }
 573
 574 /* Acquires the private key using the key provider info, retrieving info from
 575  * the certificate if info is NULL.  The acquired provider is returned in
 576  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 577  */
 578 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
 579  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 580 {
 581     DWORD size = 0;
 582     BOOL allocated = FALSE, ret = TRUE;
 583
 584     if (!info)
 585     {
 586         ret = CertGetCertificateContextProperty(pCert,
 587          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 588         if (ret)
 589         {
 590             info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(GetProcessHeap(), 0, size);
 591             if (info)
 592             {
 593                 ret = CertGetCertificateContextProperty(pCert,
 594                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 595                 allocated = TRUE;
 596             }
 597         }
 598         else
 599             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 600     }
 601     if (ret)
 602     {
 603         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 604          info->pwszProvName, info->dwProvType, 0);
 605         if (ret)
 606         {
 607             DWORD i;
 608
 609             for (i = 0; i < info->cProvParam; i++)
 610             {
 611                 CryptSetProvParam(*phCryptProv,
 612                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 613                  info->rgProvParam[i].dwFlags);
 614             }
 615             *pdwKeySpec = info->dwKeySpec;
 616         }
 617         else
 618             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 619     }
 620     if (allocated)
 621         HeapFree(GetProcessHeap(), 0, info);
 622     return ret;
 623 }
 624
 625 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 626  DWORD dwFlags, void *pvReserved, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec,
 627  BOOL *pfCallerFreeProv)
 628 {
 629     BOOL ret = FALSE, cache = FALSE;
 630     PCRYPT_KEY_PROV_INFO info = NULL;
 631     CERT_KEY_CONTEXT keyContext;
 632     DWORD size;
 633
 634     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 635      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 636
 637     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 638     {
 639         DWORD size = 0;
 640
 641         ret = CertGetCertificateContextProperty(pCert,
 642          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 643         if (ret)
 644         {
 645             info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(
 646              GetProcessHeap(), 0, size);
 647             ret = CertGetCertificateContextProperty(pCert,
 648              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 649             if (ret)
 650                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 651         }
 652     }
 653     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 654         cache = TRUE;
 655     *phCryptProv = 0;
 656     if (cache)
 657     {
 658         size = sizeof(keyContext);
 659         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 660          &keyContext, &size);
 661         if (ret)
 662         {
 663             *phCryptProv = keyContext.hCryptProv;
 664             if (pdwKeySpec)
 665                 *pdwKeySpec = keyContext.dwKeySpec;
 666             if (pfCallerFreeProv)
 667                 *pfCallerFreeProv = !cache;
 668         }
 669     }
 670     if (!*phCryptProv)
 671     {
 672         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
 673          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 674         if (ret)
 675         {
 676             *phCryptProv = keyContext.hCryptProv;
 677             if (pdwKeySpec)
 678                 *pdwKeySpec = keyContext.dwKeySpec;
 679             if (cache)
 680             {
 681                 keyContext.cbSize = sizeof(keyContext);
 682                 if (CertSetCertificateContextProperty(pCert,
 683                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 684                 {
 685                     if (pfCallerFreeProv)
 686                         *pfCallerFreeProv = FALSE;
 687                 }
 688             }
 689             else
 690             {
 691                 if (pfCallerFreeProv)
 692                     *pfCallerFreeProv = TRUE;
 693             }
 694         }
 695     }
 696     HeapFree(GetProcessHeap(), 0, info);
 697     return ret;
 698 }
 699
 700 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
 701  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
 702 {
 703     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
 704
 705     return CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
 706      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
 707      &pCertId2->SerialNumber);
 708 }
 709
 710 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
 711  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
 712 {
 713     BOOL ret;
 714
 715     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
 716
 717     if (pCertName1->cbData == pCertName2->cbData)
 718     {
 719         if (pCertName1->cbData)
 720             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
 721              pCertName1->cbData);
 722         else
 723             ret = TRUE;
 724     }
 725     else
 726         ret = FALSE;
 727     return ret;
 728 }
 729
 730 /* Returns the number of significant bytes in pInt, where a byte is
 731  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
 732  * for negative numbers.  pInt is assumed to be little-endian.
 733  */
 734 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
 735 {
 736     DWORD ret = pInt->cbData;
 737
 738     while (ret > 1)
 739     {
 740         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
 741             ret--;
 742         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
 743             ret--;
 744         else
 745             break;
 746     }
 747     return ret;
 748 }
 749
 750 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
 751  PCRYPT_INTEGER_BLOB pInt2)
 752 {
 753     BOOL ret;
 754     DWORD cb1, cb2;
 755
 756     TRACE("(%p, %p)\n", pInt1, pInt2);
 757
 758     cb1 = CRYPT_significantBytes(pInt1);
 759     cb2 = CRYPT_significantBytes(pInt2);
 760     if (cb1 == cb2)
 761     {
 762         if (cb1)
 763             ret = !memcmp(pInt1->pbData, pInt1->pbData, cb1);
 764         else
 765             ret = TRUE;
 766     }
 767     else
 768         ret = FALSE;
 769     return ret;
 770 }
 771
 772 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
 773  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
 774 {
 775     BOOL ret;
 776
 777     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
 778
 779     if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
 780      pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
 781     {
 782         if (pPublicKey2->PublicKey.cbData)
 783             ret = !memcmp(pPublicKey1->PublicKey.pbData,
 784              pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
 785         else
 786             ret = TRUE;
 787     }
 788     else
 789         ret = FALSE;
 790     return ret;
 791 }
 792
 793 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
 794  PCERT_PUBLIC_KEY_INFO pPublicKey)
 795 {
 796     DWORD len = 0;
 797
 798     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
 799
 800     if (dwCertEncodingType != X509_ASN_ENCODING)
 801     {
 802         SetLastError(ERROR_FILE_NOT_FOUND);
 803         return 0;
 804     }
 805     if (pPublicKey->Algorithm.pszObjId &&
 806      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
 807     {
 808         FIXME("unimplemented for DH public keys\n");
 809         SetLastError(CRYPT_E_ASN1_BADTAG);
 810     }
 811     else
 812     {
 813         DWORD size;
 814         PBYTE buf;
 815         BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
 816          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
 817          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
 818          &size);
 819
 820         if (ret)
 821         {
 822             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)((LPBYTE)buf +
 823              sizeof(BLOBHEADER));
 824
 825             len = rsaPubKey->bitlen;
 826             LocalFree(buf);
 827         }
 828     }
 829     return len;
 830 }
 831
 832 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
 833  DWORD dwFlags, const void *pvPara);
 834
 835 static BOOL compare_cert_any(PCCERT_CONTEXT pCertContext, DWORD dwType,
 836  DWORD dwFlags, const void *pvPara)
 837 {
 838     return TRUE;
 839 }
 840
 841 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
 842  DWORD dwFlags, const void *pvPara)
 843 {
 844     BOOL ret;
 845     BYTE hash[16];
 846     DWORD size = sizeof(hash);
 847
 848     ret = CertGetCertificateContextProperty(pCertContext,
 849      CERT_MD5_HASH_PROP_ID, hash, &size);
 850     if (ret)
 851     {
 852         const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
 853
 854         if (size == pHash->cbData)
 855             ret = !memcmp(pHash->pbData, hash, size);
 856         else
 857             ret = FALSE;
 858     }
 859     return ret;
 860 }
 861
 862 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
 863  DWORD dwFlags, const void *pvPara)
 864 {
 865     BOOL ret;
 866     BYTE hash[20];
 867     DWORD size = sizeof(hash);
 868
 869     ret = CertGetCertificateContextProperty(pCertContext,
 870      CERT_SHA1_HASH_PROP_ID, hash, &size);
 871     if (ret)
 872     {
 873         const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
 874
 875         if (size == pHash->cbData)
 876             ret = !memcmp(pHash->pbData, hash, size);
 877         else
 878             ret = FALSE;
 879     }
 880     return ret;
 881 }
 882
 883 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
 884  DWORD dwFlags, const void *pvPara)
 885 {
 886     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
 887     BOOL ret;
 888
 889     if (dwType & CERT_INFO_SUBJECT_FLAG)
 890         toCompare = &pCertContext->pCertInfo->Subject;
 891     else
 892         toCompare = &pCertContext->pCertInfo->Issuer;
 893     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
 894      toCompare, blob);
 895     return ret;
 896 }
 897
 898 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
 899  DWORD dwType, DWORD dwFlags, const void *pvPara)
 900 {
 901     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
 902
 903     return CertCompareCertificateName(pCertContext->dwCertEncodingType,
 904      &pCertInfo->Issuer, &pCertContext->pCertInfo->Subject);
 905 }
 906
 907 static BOOL compare_cert_by_issuer(PCCERT_CONTEXT pCertContext,
 908  DWORD dwType, DWORD dwFlags, const void *pvPara)
 909 {
 910     return compare_cert_by_subject_cert(pCertContext, dwType, dwFlags,
 911      ((PCCERT_CONTEXT)pvPara)->pCertInfo);
 912 }
 913
 914 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
 915  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
 916  PCCERT_CONTEXT pPrevCertContext)
 917 {
 918     PCCERT_CONTEXT ret;
 919     CertCompareFunc compare;
 920
 921     TRACE("(%p, %d, %d, %d, %p, %p)\n", hCertStore, dwCertEncodingType,
 922          dwFlags, dwType, pvPara, pPrevCertContext);
 923
 924     switch (dwType >> CERT_COMPARE_SHIFT)
 925     {
 926     case CERT_COMPARE_ANY:
 927         compare = compare_cert_any;
 928         break;
 929     case CERT_COMPARE_MD5_HASH:
 930         compare = compare_cert_by_md5_hash;
 931         break;
 932     case CERT_COMPARE_SHA1_HASH:
 933         compare = compare_cert_by_sha1_hash;
 934         break;
 935     case CERT_COMPARE_NAME:
 936         compare = compare_cert_by_name;
 937         break;
 938     case CERT_COMPARE_SUBJECT_CERT:
 939         compare = compare_cert_by_subject_cert;
 940         break;
 941     case CERT_COMPARE_ISSUER_OF:
 942         compare = compare_cert_by_issuer;
 943         break;
 944     default:
 945         FIXME("find type %08x unimplemented\n", dwType);
 946         compare = NULL;
 947     }
 948
 949     if (compare)
 950     {
 951         BOOL matches = FALSE;
 952
 953         ret = pPrevCertContext;
 954         do {
 955             ret = CertEnumCertificatesInStore(hCertStore, ret);
 956             if (ret)
 957                 matches = compare(ret, dwType, dwFlags, pvPara);
 958         } while (ret != NULL && !matches);
 959         if (!ret)
 960             SetLastError(CRYPT_E_NOT_FOUND);
 961     }
 962     else
 963     {
 964         SetLastError(CRYPT_E_NOT_FOUND);
 965         ret = NULL;
 966     }
 967     return ret;
 968 }
 969
 970 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
 971  DWORD dwCertEncodingType, PCERT_INFO pCertId)
 972 {
 973     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
 974
 975     if (!pCertId)
 976     {
 977         SetLastError(E_INVALIDARG);
 978         return NULL;
 979     }
 980     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
 981      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
 982 }
 983
 984 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
 985  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
 986 {
 987     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
 988      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
 989
 990     if (*pdwFlags & ~supportedFlags)
 991     {
 992         SetLastError(E_INVALIDARG);
 993         return FALSE;
 994     }
 995     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
 996     {
 997         DWORD flags = 0;
 998         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
 999          NULL, &flags);
1000
1001         /* FIXME: what if the CRL has expired? */
1002         if (crl)
1003         {
1004             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1005              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1006                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1007         }
1008         else
1009             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1010     }
1011     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1012     {
1013         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1014             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1015     }
1016     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1017     {
1018         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1019          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1020          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1021             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1022     }
1023     return TRUE;
1024 }
1025
1026 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1027  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1028  DWORD *pdwFlags)
1029 {
1030     PCCERT_CONTEXT ret;
1031
1032     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1033      pPrevIssuerContext, *pdwFlags);
1034
1035     if (!pSubjectContext)
1036     {
1037         SetLastError(E_INVALIDARG);
1038         return NULL;
1039     }
1040
1041     ret = CertFindCertificateInStore(hCertStore,
1042      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1043      pSubjectContext, pPrevIssuerContext);
1044     if (ret)
1045     {
1046         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1047          pdwFlags))
1048         {
1049             CertFreeCertificateContext(ret);
1050             ret = NULL;
1051         }
1052     }
1053
1054     return ret;
1055 }
1056
1057 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1058  CRYPT_ATTRIBUTE rgAttr[])
1059 {
1060     PCRYPT_ATTRIBUTE ret = NULL;
1061     DWORD i;
1062
1063     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1064
1065     if (!cAttr)
1066         return NULL;
1067     if (!pszObjId)
1068     {
1069         SetLastError(ERROR_INVALID_PARAMETER);
1070         return NULL;
1071     }
1072
1073     for (i = 0; !ret && i < cAttr; i++)
1074         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1075             ret = &rgAttr[i];
1076     return ret;
1077 }
1078
1079 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1080  CERT_EXTENSION rgExtensions[])
1081 {
1082     PCERT_EXTENSION ret = NULL;
1083     DWORD i;
1084
1085     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1086
1087     if (!cExtensions)
1088         return NULL;
1089     if (!pszObjId)
1090     {
1091         SetLastError(ERROR_INVALID_PARAMETER);
1092         return NULL;
1093     }
1094
1095     for (i = 0; !ret && i < cExtensions; i++)
1096         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1097          rgExtensions[i].pszObjId))
1098             ret = &rgExtensions[i];
1099     return ret;
1100 }
1101
1102 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1103 {
1104     PCERT_RDN_ATTR ret = NULL;
1105     DWORD i, j;
1106
1107     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1108
1109     if (!pszObjId)
1110     {
1111         SetLastError(ERROR_INVALID_PARAMETER);
1112         return NULL;
1113     }
1114
1115     for (i = 0; !ret && i < pName->cRDN; i++)
1116         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1117             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1118              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1119                 ret = &pName->rgRDN[i].rgRDNAttr[j];
1120     return ret;
1121 }
1122
1123 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1124  PCERT_INFO pCertInfo)
1125 {
1126     FILETIME fileTime;
1127     LONG ret;
1128
1129     if (!pTimeToVerify)
1130     {
1131         SYSTEMTIME sysTime;
1132
1133         GetSystemTime(&sysTime);
1134         SystemTimeToFileTime(&sysTime, &fileTime);
1135         pTimeToVerify = &fileTime;
1136     }
1137     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1138     {
1139         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1140         if (ret < 0)
1141             ret = 0;
1142     }
1143     return ret;
1144 }
1145
1146 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1147  PCERT_INFO pIssuerInfo)
1148 {
1149     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1150
1151     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1152      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1153 }
1154
1155 BOOL WINAPI CryptHashCertificate(HCRYPTPROV hCryptProv, ALG_ID Algid,
1156  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1157  DWORD *pcbComputedHash)
1158 {
1159     BOOL ret = TRUE;
1160     HCRYPTHASH hHash = 0;
1161
1162     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1163      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1164
1165     if (!hCryptProv)
1166         hCryptProv = CRYPT_GetDefaultProvider();
1167     if (!Algid)
1168         Algid = CALG_SHA1;
1169     if (ret)
1170     {
1171         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1172         if (ret)
1173         {
1174             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1175             if (ret)
1176                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1177                  pcbComputedHash, 0);
1178             CryptDestroyHash(hHash);
1179         }
1180     }
1181     return ret;
1182 }
1183
1184 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV hCryptProv, ALG_ID Algid,
1185  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1186  BYTE *pbComputedHash, DWORD *pcbComputedHash)
1187 {
1188     BOOL ret = TRUE;
1189     HCRYPTHASH hHash = 0;
1190
1191     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1192      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1193
1194     if (!hCryptProv)
1195         hCryptProv = CRYPT_GetDefaultProvider();
1196     if (!Algid)
1197         Algid = CALG_MD5;
1198     if (ret)
1199     {
1200         BYTE *buf;
1201         DWORD size = 0;
1202
1203         ret = CryptEncodeObjectEx(dwCertEncodingType, X509_PUBLIC_KEY_INFO,
1204          pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
1205         if (ret)
1206         {
1207             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1208             if (ret)
1209             {
1210                 ret = CryptHashData(hHash, buf, size, 0);
1211                 if (ret)
1212                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1213                      pcbComputedHash, 0);
1214                 CryptDestroyHash(hHash);
1215             }
1216             LocalFree(buf);
1217         }
1218     }
1219     return ret;
1220 }
1221
1222 BOOL WINAPI CryptSignCertificate(HCRYPTPROV hCryptProv, DWORD dwKeySpec,
1223  DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
1224  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1225  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
1226 {
1227     BOOL ret;
1228     PCCRYPT_OID_INFO info;
1229     HCRYPTHASH hHash;
1230
1231     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
1232      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
1233      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
1234
1235     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1236      pSignatureAlgorithm->pszObjId, 0);
1237     if (!info)
1238     {
1239         SetLastError(NTE_BAD_ALGID);
1240         return FALSE;
1241     }
1242     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
1243     {
1244         if (!hCryptProv)
1245             hCryptProv = CRYPT_GetDefaultProvider();
1246         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1247         if (ret)
1248         {
1249             ret = CryptHashData(hHash, pbEncodedToBeSigned,
1250              cbEncodedToBeSigned, 0);
1251             if (ret)
1252                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
1253                  pcbSignature, 0);
1254             CryptDestroyHash(hHash);
1255         }
1256     }
1257     else
1258     {
1259         if (!hCryptProv)
1260         {
1261             SetLastError(ERROR_INVALID_PARAMETER);
1262             ret = FALSE;
1263         }
1264         else
1265         {
1266             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1267             if (ret)
1268             {
1269                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1270                  cbEncodedToBeSigned, 0);
1271                 if (ret)
1272                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
1273                      pcbSignature);
1274                 CryptDestroyHash(hHash);
1275             }
1276         }
1277     }
1278     return ret;
1279 }
1280
1281 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV hCryptProv,
1282  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
1283  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1284  const void *pvHashAuxInfo, PBYTE pbEncoded, DWORD *pcbEncoded)
1285 {
1286     BOOL ret;
1287     DWORD encodedSize, hashSize;
1288
1289     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
1290      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
1291      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
1292
1293     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
1294      NULL, &encodedSize);
1295     if (ret)
1296     {
1297         PBYTE encoded = CryptMemAlloc(encodedSize);
1298
1299         if (encoded)
1300         {
1301             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
1302              pvStructInfo, encoded, &encodedSize);
1303             if (ret)
1304             {
1305                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1306                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
1307                  pvHashAuxInfo, NULL, &hashSize);
1308                 if (ret)
1309                 {
1310                     PBYTE hash = CryptMemAlloc(hashSize);
1311
1312                     if (hash)
1313                     {
1314                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1315                          dwCertEncodingType, encoded, encodedSize,
1316                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
1317                         if (ret)
1318                         {
1319                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
1320
1321                             info.ToBeSigned.cbData = encodedSize;
1322                             info.ToBeSigned.pbData = encoded;
1323                             memcpy(&info.SignatureAlgorithm,
1324                              pSignatureAlgorithm,
1325                              sizeof(info.SignatureAlgorithm));
1326                             info.Signature.cbData = hashSize;
1327                             info.Signature.pbData = hash;
1328                             info.Signature.cUnusedBits = 0;
1329                             ret = CryptEncodeObject(dwCertEncodingType,
1330                              X509_CERT, &info, pbEncoded, pcbEncoded);
1331                         }
1332                         CryptMemFree(hash);
1333                     }
1334                 }
1335             }
1336             CryptMemFree(encoded);
1337         }
1338     }
1339     return ret;
1340 }
1341
1342 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV hCryptProv,
1343  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1344  PCERT_PUBLIC_KEY_INFO pPublicKey)
1345 {
1346     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
1347      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
1348      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
1349 }
1350
1351 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV hCryptProv,
1352  DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
1353  const CERT_SIGNED_CONTENT_INFO *signedCert)
1354 {
1355     BOOL ret;
1356     HCRYPTKEY key;
1357     PCCRYPT_OID_INFO info;
1358     ALG_ID pubKeyID, hashID;
1359
1360     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1361      pubKeyInfo->Algorithm.pszObjId, 0);
1362     if (!info || (info->dwGroupId != CRYPT_PUBKEY_ALG_OID_GROUP_ID &&
1363      info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID))
1364     {
1365         SetLastError(NTE_BAD_ALGID);
1366         return FALSE;
1367     }
1368     if (info->dwGroupId == CRYPT_PUBKEY_ALG_OID_GROUP_ID)
1369     {
1370         switch (info->u.Algid)
1371         {
1372             case CALG_RSA_KEYX:
1373                 pubKeyID = CALG_RSA_SIGN;
1374                 hashID = CALG_SHA1;
1375                 break;
1376             case CALG_RSA_SIGN:
1377                 pubKeyID = CALG_RSA_SIGN;
1378                 hashID = CALG_SHA1;
1379                 break;
1380             default:
1381                 FIXME("unimplemented for %s\n", pubKeyInfo->Algorithm.pszObjId);
1382                 return FALSE;
1383         }
1384     }
1385     else
1386     {
1387         hashID = info->u.Algid;
1388         if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
1389             pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
1390         else
1391             pubKeyID = hashID;
1392     }
1393     /* Load the default provider if necessary */
1394     if (!hCryptProv)
1395         hCryptProv = CRYPT_GetDefaultProvider();
1396     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
1397      pubKeyInfo, pubKeyID, 0, NULL, &key);
1398     if (ret)
1399     {
1400         HCRYPTHASH hash;
1401
1402         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
1403         if (ret)
1404         {
1405             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
1406              signedCert->ToBeSigned.cbData, 0);
1407             if (ret)
1408                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
1409                  signedCert->Signature.cbData, key, NULL, 0);
1410             CryptDestroyHash(hash);
1411         }
1412         CryptDestroyKey(key);
1413     }
1414     return ret;
1415 }
1416
1417 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV hCryptProv,
1418  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
1419  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
1420 {
1421     BOOL ret = TRUE;
1422     CRYPT_DATA_BLOB subjectBlob;
1423
1424     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
1425      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
1426      dwFlags, pvReserved);
1427
1428     switch (dwSubjectType)
1429     {
1430     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
1431     {
1432         PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvSubject;
1433
1434         subjectBlob.pbData = blob->pbData;
1435         subjectBlob.cbData = blob->cbData;
1436         break;
1437     }
1438     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
1439     {
1440         PCERT_CONTEXT context = (PCERT_CONTEXT)pvSubject;
1441
1442         subjectBlob.pbData = context->pbCertEncoded;
1443         subjectBlob.cbData = context->cbCertEncoded;
1444         break;
1445     }
1446     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
1447     {
1448         PCRL_CONTEXT context = (PCRL_CONTEXT)pvSubject;
1449
1450         subjectBlob.pbData = context->pbCrlEncoded;
1451         subjectBlob.cbData = context->cbCrlEncoded;
1452         break;
1453     }
1454     default:
1455         SetLastError(E_INVALIDARG);
1456         ret = FALSE;
1457     }
1458
1459     if (ret)
1460     {
1461         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
1462         DWORD size = 0;
1463
1464         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1465          subjectBlob.pbData, subjectBlob.cbData,
1466          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1467          (BYTE *)&signedCert, &size);
1468         if (ret)
1469         {
1470             switch (dwIssuerType)
1471             {
1472             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
1473                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1474                  dwCertEncodingType, (PCERT_PUBLIC_KEY_INFO)pvIssuer,
1475                  signedCert);
1476                 break;
1477             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
1478                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1479                  dwCertEncodingType,
1480                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
1481                  signedCert);
1482                 break;
1483             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
1484                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
1485                 ret = FALSE;
1486                 break;
1487             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
1488                 if (pvIssuer)
1489                 {
1490                     SetLastError(E_INVALIDARG);
1491                     ret = FALSE;
1492                 }
1493                 else
1494                 {
1495                     FIXME("unimplemented for NULL signer\n");
1496                     SetLastError(E_INVALIDARG);
1497                     ret = FALSE;
1498                 }
1499                 break;
1500             default:
1501                 SetLastError(E_INVALIDARG);
1502                 ret = FALSE;
1503             }
1504             LocalFree(signedCert);
1505         }
1506     }
1507     return ret;
1508 }
1509
1510 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
1511  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
1512 {
1513     PCERT_ENHKEY_USAGE usage = NULL;
1514     DWORD bytesNeeded;
1515     BOOL ret = TRUE;
1516
1517     if (!pCertContext || !pcbUsage)
1518     {
1519         SetLastError(ERROR_INVALID_PARAMETER);
1520         return FALSE;
1521     }
1522
1523     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
1524
1525     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
1526     {
1527         DWORD propSize = 0;
1528
1529         if (CertGetCertificateContextProperty(pCertContext,
1530          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
1531         {
1532             LPBYTE buf = CryptMemAlloc(propSize);
1533
1534             if (buf)
1535             {
1536                 if (CertGetCertificateContextProperty(pCertContext,
1537                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
1538                 {
1539                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1540                      X509_ENHANCED_KEY_USAGE, buf, propSize,
1541                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1542                 }
1543                 CryptMemFree(buf);
1544             }
1545         }
1546     }
1547     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
1548     {
1549         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
1550          pCertContext->pCertInfo->cExtension,
1551          pCertContext->pCertInfo->rgExtension);
1552
1553         if (ext)
1554         {
1555             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1556              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
1557              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1558         }
1559     }
1560     if (!usage)
1561     {
1562         /* If a particular location is specified, this should fail.  Otherwise
1563          * it should succeed with an empty usage.  (This is true on Win2k and
1564          * later, which we emulate.)
1565          */
1566         if (dwFlags)
1567         {
1568             SetLastError(CRYPT_E_NOT_FOUND);
1569             ret = FALSE;
1570         }
1571         else
1572             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
1573     }
1574
1575     if (ret)
1576     {
1577         if (!pUsage)
1578             *pcbUsage = bytesNeeded;
1579         else if (*pcbUsage < bytesNeeded)
1580         {
1581             SetLastError(ERROR_MORE_DATA);
1582             *pcbUsage = bytesNeeded;
1583             ret = FALSE;
1584         }
1585         else
1586         {
1587             *pcbUsage = bytesNeeded;
1588             if (usage)
1589             {
1590                 DWORD i;
1591                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
1592                  sizeof(CERT_ENHKEY_USAGE) +
1593                  usage->cUsageIdentifier * sizeof(LPSTR));
1594
1595                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
1596                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
1597                  sizeof(CERT_ENHKEY_USAGE));
1598                 for (i = 0; i < usage->cUsageIdentifier; i++)
1599                 {
1600                     pUsage->rgpszUsageIdentifier[i] = nextOID;
1601                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1602                     nextOID += strlen(nextOID) + 1;
1603                 }
1604             }
1605             else
1606                 pUsage->cUsageIdentifier = 0;
1607         }
1608     }
1609     if (usage)
1610         LocalFree(usage);
1611     TRACE("returning %d\n", ret);
1612     return ret;
1613 }
1614
1615 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
1616  PCERT_ENHKEY_USAGE pUsage)
1617 {
1618     BOOL ret;
1619
1620     TRACE("(%p, %p)\n", pCertContext, pUsage);
1621
1622     if (pUsage)
1623     {
1624         CRYPT_DATA_BLOB blob = { 0, NULL };
1625
1626         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
1627          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
1628         if (ret)
1629         {
1630             ret = CertSetCertificateContextProperty(pCertContext,
1631              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
1632             LocalFree(blob.pbData);
1633         }
1634     }
1635     else
1636         ret = CertSetCertificateContextProperty(pCertContext,
1637          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
1638     return ret;
1639 }
1640
1641 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1642  LPCSTR pszUsageIdentifier)
1643 {
1644     BOOL ret;
1645     DWORD size;
1646
1647     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1648
1649     if (CertGetEnhancedKeyUsage(pCertContext,
1650      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
1651     {
1652         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
1653
1654         if (usage)
1655         {
1656             ret = CertGetEnhancedKeyUsage(pCertContext,
1657              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
1658             if (ret)
1659             {
1660                 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
1661                  sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1662
1663                 if (newUsage)
1664                 {
1665                     LPSTR nextOID;
1666                     DWORD i;
1667
1668                     newUsage->rgpszUsageIdentifier =
1669                      (LPSTR *)((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
1670                     nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier +
1671                      (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
1672                     for (i = 0; i < usage->cUsageIdentifier; i++)
1673                     {
1674                         newUsage->rgpszUsageIdentifier[i] = nextOID;
1675                         strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1676                         nextOID += strlen(nextOID) + 1;
1677                     }
1678                     newUsage->rgpszUsageIdentifier[i] = nextOID;
1679                     strcpy(nextOID, pszUsageIdentifier);
1680                     newUsage->cUsageIdentifier = i + 1;
1681                     ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
1682                     CryptMemFree(newUsage);
1683                 }
1684             }
1685             CryptMemFree(usage);
1686         }
1687         else
1688             ret = FALSE;
1689     }
1690     else
1691     {
1692         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
1693          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1694
1695         if (usage)
1696         {
1697             usage->rgpszUsageIdentifier =
1698              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
1699             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
1700              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
1701             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
1702             usage->cUsageIdentifier = 1;
1703             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
1704             CryptMemFree(usage);
1705         }
1706         else
1707             ret = FALSE;
1708     }
1709     return ret;
1710 }
1711
1712 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1713  LPCSTR pszUsageIdentifier)
1714 {
1715     BOOL ret;
1716     DWORD size;
1717     CERT_ENHKEY_USAGE usage;
1718
1719     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1720
1721     size = sizeof(usage);
1722     ret = CertGetEnhancedKeyUsage(pCertContext,
1723      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
1724     if (!ret && GetLastError() == ERROR_MORE_DATA)
1725     {
1726         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
1727
1728         if (pUsage)
1729         {
1730             ret = CertGetEnhancedKeyUsage(pCertContext,
1731              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1732             if (ret)
1733             {
1734                 if (pUsage->cUsageIdentifier)
1735                 {
1736                     DWORD i;
1737                     BOOL found = FALSE;
1738
1739                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
1740                     {
1741                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
1742                          pszUsageIdentifier))
1743                             found = TRUE;
1744                         if (found && i < pUsage->cUsageIdentifier - 1)
1745                             pUsage->rgpszUsageIdentifier[i] =
1746                              pUsage->rgpszUsageIdentifier[i + 1];
1747                     }
1748                     pUsage->cUsageIdentifier--;
1749                     /* Remove the usage if it's empty */
1750                     if (pUsage->cUsageIdentifier)
1751                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
1752                     else
1753                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
1754                 }
1755             }
1756             CryptMemFree(pUsage);
1757         }
1758         else
1759             ret = FALSE;
1760     }
1761     else
1762     {
1763         /* it fit in an empty usage, therefore there's nothing to remove */
1764         ret = TRUE;
1765     }
1766     return ret;
1767 }
1768
1769 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
1770  int *cNumOIDSs, LPSTR *rghOIDs, DWORD *pcbOIDs)
1771 {
1772     BOOL ret = TRUE;
1773     DWORD i, cbOIDs = 0;
1774     BOOL allUsagesValid = TRUE;
1775     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
1776
1777     TRACE("(%d, %p, %p, %p, %d)\n", cCerts, *rghCerts, cNumOIDSs,
1778      rghOIDs, *pcbOIDs);
1779
1780     for (i = 0; ret && i < cCerts; i++)
1781     {
1782         CERT_ENHKEY_USAGE usage;
1783         DWORD size = sizeof(usage);
1784
1785         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
1786         /* Success is deliberately ignored: it implies all usages are valid */
1787         if (!ret && GetLastError() == ERROR_MORE_DATA)
1788         {
1789             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
1790
1791             allUsagesValid = FALSE;
1792             if (pUsage)
1793             {
1794                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
1795                 if (ret)
1796                 {
1797                     if (!validUsages.cUsageIdentifier)
1798                     {
1799                         DWORD j;
1800
1801                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
1802                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
1803                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
1804                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
1805                              + 1;
1806                         validUsages.rgpszUsageIdentifier =
1807                          CryptMemAlloc(cbOIDs);
1808                         if (validUsages.rgpszUsageIdentifier)
1809                         {
1810                             LPSTR nextOID = (LPSTR)
1811                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
1812                              validUsages.cUsageIdentifier * sizeof(LPSTR));
1813
1814                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
1815                             {
1816                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
1817                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
1818                                  pUsage->rgpszUsageIdentifier[j]);
1819                                 nextOID += lstrlenA(nextOID) + 1;
1820                             }
1821                         }
1822                         else
1823                             ret = FALSE;
1824                     }
1825                     else
1826                     {
1827                         DWORD j, k, validIndexes = 0, numRemoved = 0;
1828
1829                         /* Merge: build a bitmap of all the indexes of
1830                          * validUsages.rgpszUsageIdentifier that are in pUsage.
1831                          */
1832                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
1833                         {
1834                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
1835                             {
1836                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
1837                                  validUsages.rgpszUsageIdentifier[k]))
1838                                 {
1839                                     validIndexes |= (1 << k);
1840                                     break;
1841                                 }
1842                             }
1843                         }
1844                         /* Merge by removing from validUsages those that are
1845                          * not in the bitmap.
1846                          */
1847                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
1848                         {
1849                             if (!(validIndexes & (1 << j)))
1850                             {
1851                                 if (j < validUsages.cUsageIdentifier - 1)
1852                                 {
1853                                     memcpy(&validUsages.rgpszUsageIdentifier[j],
1854                                      &validUsages.rgpszUsageIdentifier[j +
1855                                      numRemoved + 1],
1856                                      (validUsages.cUsageIdentifier - numRemoved
1857                                      - j - 1) * sizeof(LPSTR));
1858                                     cbOIDs -= lstrlenA(
1859                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
1860                                      sizeof(LPSTR);
1861                                     numRemoved++;
1862                                 }
1863                                 else
1864                                     validUsages.cUsageIdentifier--;
1865                             }
1866                         }
1867                     }
1868                 }
1869                 CryptMemFree(pUsage);
1870             }
1871             else
1872                 ret = FALSE;
1873         }
1874     }
1875     if (ret)
1876     {
1877         if (allUsagesValid)
1878         {
1879             *cNumOIDSs = -1;
1880             *pcbOIDs = 0;
1881         }
1882         else
1883         {
1884             if (!rghOIDs || *pcbOIDs < cbOIDs)
1885             {
1886                 *pcbOIDs = cbOIDs;
1887                 SetLastError(ERROR_MORE_DATA);
1888                 ret = FALSE;
1889             }
1890             else
1891             {
1892                 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
1893                  validUsages.cUsageIdentifier * sizeof(LPSTR));
1894
1895                 *pcbOIDs = cbOIDs;
1896                 *cNumOIDSs = validUsages.cUsageIdentifier;
1897                 for (i = 0; i < validUsages.cUsageIdentifier; i++)
1898                 {
1899                     rghOIDs[i] = nextOID;
1900                     lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
1901                     nextOID += lstrlenA(nextOID) + 1;
1902                 }
1903             }
1904         }
1905     }
1906     CryptMemFree(validUsages.rgpszUsageIdentifier);
1907     return ret;
1908 }
1909
1910 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
1911  * pInfo is NULL, from the attributes of hProv.
1912  */
1913 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
1914  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
1915 {
1916     CRYPT_KEY_PROV_INFO info = { 0 };
1917     BOOL ret;
1918
1919     if (!pInfo)
1920     {
1921         DWORD size;
1922         int len;
1923
1924         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
1925         if (ret)
1926         {
1927             LPSTR szContainer = CryptMemAlloc(size);
1928
1929             if (szContainer)
1930             {
1931                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
1932                  (BYTE *)szContainer, &size, 0);
1933                 if (ret)
1934                 {
1935                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
1936                      NULL, 0);
1937                     if (len)
1938                     {
1939                         info.pwszContainerName = CryptMemAlloc(len *
1940                          sizeof(WCHAR));
1941                         len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
1942                          info.pwszContainerName, len);
1943                     }
1944                 }
1945                 CryptMemFree(szContainer);
1946             }
1947         }
1948         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
1949         if (ret)
1950         {
1951             LPSTR szProvider = CryptMemAlloc(size);
1952
1953             if (szProvider)
1954             {
1955                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
1956                  &size, 0);
1957                 if (ret)
1958                 {
1959                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
1960                      NULL, 0);
1961                     if (len)
1962                     {
1963                         info.pwszProvName = CryptMemAlloc(len *
1964                          sizeof(WCHAR));
1965                         len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
1966                          info.pwszProvName, len);
1967                     }
1968                 }
1969                 CryptMemFree(szProvider);
1970             }
1971         }
1972         size = sizeof(info.dwKeySpec);
1973         ret = CryptGetProvParam(hProv, PP_KEYSPEC, (LPBYTE)&info.dwKeySpec,
1974          &size, 0);
1975         if (!ret)
1976             info.dwKeySpec = AT_SIGNATURE;
1977         size = sizeof(info.dwProvType);
1978         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
1979          &size, 0);
1980         if (!ret)
1981             info.dwProvType = PROV_RSA_FULL;
1982         pInfo = &info;
1983     }
1984
1985     ret = CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
1986      0, pInfo);
1987
1988     if (pInfo == &info)
1989     {
1990         CryptMemFree(info.pwszContainerName);
1991         CryptMemFree(info.pwszProvName);
1992     }
1993 }
1994
1995 /* Creates a signed certificate context from the unsigned, encoded certificate
1996  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
1997  */
1998 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
1999  HCRYPTPROV hProv, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2000 {
2001     PCCERT_CONTEXT context = NULL;
2002     BOOL ret;
2003     DWORD sigSize = 0;
2004
2005     ret = CryptSignCertificate(hProv, AT_SIGNATURE, X509_ASN_ENCODING,
2006      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2007     if (ret)
2008     {
2009         LPBYTE sig = CryptMemAlloc(sigSize);
2010
2011         ret = CryptSignCertificate(hProv, AT_SIGNATURE, X509_ASN_ENCODING,
2012          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2013         if (ret)
2014         {
2015             CERT_SIGNED_CONTENT_INFO signedInfo;
2016             BYTE *encodedSignedCert = NULL;
2017             DWORD encodedSignedCertSize = 0;
2018
2019             signedInfo.ToBeSigned.cbData = blob->cbData;
2020             signedInfo.ToBeSigned.pbData = blob->pbData;
2021             memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2022              sizeof(signedInfo.SignatureAlgorithm));
2023             signedInfo.Signature.cbData = sigSize;
2024             signedInfo.Signature.pbData = sig;
2025             signedInfo.Signature.cUnusedBits = 0;
2026             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2027              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2028              (BYTE *)&encodedSignedCert, &encodedSignedCertSize);
2029             if (ret)
2030             {
2031                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2032                  encodedSignedCert, encodedSignedCertSize);
2033                 LocalFree(encodedSignedCert);
2034             }
2035         }
2036         CryptMemFree(sig);
2037     }
2038     return context;
2039 }
2040
2041 /* Copies data from the parameters into info, where:
2042  * pSerialNumber: The serial number.  Must not be NULL.
2043  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2044  *                     Must not be NULL
2045  * pSignatureAlgorithm: Optional.
2046  * pStartTime: The starting time of the certificate.  If NULL, the current
2047  *             system time is used.
2048  * pEndTime: The ending time of the certificate.  If NULL, one year past the
2049  *           starting time is used.
2050  * pubKey: The public key of the certificate.  Must not be NULL.
2051  * pExtensions: Extensions to be included with the certificate.  Optional.
2052  */
2053 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2054  const CERT_NAME_BLOB *pSubjectIssuerBlob,
2055  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2056  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2057  const CERT_EXTENSIONS *pExtensions)
2058 {
2059     static CHAR oid[] = szOID_RSA_SHA1RSA;
2060
2061     assert(info);
2062     assert(pSerialNumber);
2063     assert(pSubjectIssuerBlob);
2064     assert(pubKey);
2065
2066     info->dwVersion = CERT_V3;
2067     info->SerialNumber.cbData = pSerialNumber->cbData;
2068     info->SerialNumber.pbData = pSerialNumber->pbData;
2069     if (pSignatureAlgorithm)
2070         memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2071          sizeof(info->SignatureAlgorithm));
2072     else
2073     {
2074         info->SignatureAlgorithm.pszObjId = oid;
2075         info->SignatureAlgorithm.Parameters.cbData = 0;
2076         info->SignatureAlgorithm.Parameters.pbData = NULL;
2077     }
2078     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2079     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2080     if (pStartTime)
2081         SystemTimeToFileTime(pStartTime, &info->NotBefore);
2082     else
2083         GetSystemTimeAsFileTime(&info->NotBefore);
2084     if (pEndTime)
2085         SystemTimeToFileTime(pEndTime, &info->NotAfter);
2086     else
2087     {
2088         SYSTEMTIME endTime;
2089
2090         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
2091         {
2092             endTime.wYear++;
2093             SystemTimeToFileTime(&endTime, &info->NotAfter);
2094         }
2095     }
2096     info->Subject.cbData = pSubjectIssuerBlob->cbData;
2097     info->Subject.pbData = pSubjectIssuerBlob->pbData;
2098     memcpy(&info->SubjectPublicKeyInfo, pubKey,
2099      sizeof(info->SubjectPublicKeyInfo));
2100     if (pExtensions)
2101     {
2102         info->cExtension = pExtensions->cExtension;
2103         info->rgExtension = pExtensions->rgExtension;
2104     }
2105     else
2106     {
2107         info->cExtension = 0;
2108         info->rgExtension = NULL;
2109     }
2110 }
2111
2112 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
2113 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
2114 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
2115
2116 static HCRYPTPROV CRYPT_CreateKeyProv(void)
2117 {
2118     HCRYPTPROV hProv = 0;
2119     HMODULE rpcrt = LoadLibraryA("rpcrt4");
2120
2121     if (rpcrt)
2122     {
2123         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
2124          "UuidCreate");
2125         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
2126          "UuidToStringA");
2127         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
2128          rpcrt, "RpcStringFreeA");
2129
2130         if (uuidCreate && uuidToString && rpcStringFree)
2131         {
2132             UUID uuid;
2133             RPC_STATUS status = uuidCreate(&uuid);
2134
2135             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
2136             {
2137                 unsigned char *uuidStr;
2138
2139                 status = uuidToString(&uuid, &uuidStr);
2140                 if (status == RPC_S_OK)
2141                 {
2142                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
2143                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
2144
2145                     if (ret)
2146                     {
2147                         HCRYPTKEY key;
2148
2149                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
2150                         if (ret)
2151                             CryptDestroyKey(key);
2152                     }
2153                     rpcStringFree(&uuidStr);
2154                 }
2155             }
2156         }
2157         FreeLibrary(rpcrt);
2158     }
2159     return hProv;
2160 }
2161
2162 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV hProv,
2163  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
2164  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
2165  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
2166  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
2167 {
2168     PCCERT_CONTEXT context = NULL;
2169     BOOL ret, releaseContext = FALSE;
2170     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
2171     DWORD pubKeySize = 0;
2172
2173     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
2174      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
2175      pExtensions, pExtensions);
2176
2177     if (!hProv)
2178     {
2179         hProv = CRYPT_CreateKeyProv();
2180         releaseContext = TRUE;
2181     }
2182
2183     CryptExportPublicKeyInfo(hProv, AT_SIGNATURE, X509_ASN_ENCODING, NULL,
2184      &pubKeySize);
2185     pubKey = CryptMemAlloc(pubKeySize);
2186     if (pubKey)
2187     {
2188         ret = CryptExportPublicKeyInfo(hProv, AT_SIGNATURE, X509_ASN_ENCODING,
2189          pubKey, &pubKeySize);
2190         if (ret)
2191         {
2192             CERT_INFO info = { 0 };
2193             CRYPT_DER_BLOB blob = { 0, NULL };
2194             BYTE serial[16];
2195             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
2196
2197             CryptGenRandom(hProv, sizeof(serial), serial);
2198             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
2199              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
2200             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
2201              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&blob.pbData,
2202              &blob.cbData);
2203             if (ret)
2204             {
2205                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
2206                     context = CRYPT_CreateSignedCert(&blob, hProv,
2207                      &info.SignatureAlgorithm);
2208                 else
2209                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
2210                      blob.pbData, blob.cbData);
2211                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
2212                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
2213                 LocalFree(blob.pbData);
2214             }
2215         }
2216         CryptMemFree(pubKey);
2217     }
2218     if (releaseContext)
2219         CryptReleaseContext(hProv, 0);
2220     return context;
2221 }