dll/win32/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include "crypt32_private.h"
  21
  22 #include <rpc.h>
  23
  24 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  25
  26 /* Internal version of CertGetCertificateContextProperty that gets properties
  27  * directly from the context (or the context it's linked to, depending on its
  28  * type.) Doesn't handle special-case properties, since they are handled by
  29  * CertGetCertificateContextProperty, and are particular to the store in which
  30  * the property exists (which is separate from the context.)
  31  */
  32 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
  33  void *pvData, DWORD *pcbData);
  34
  35 /* Internal version of CertSetCertificateContextProperty that sets properties
  36  * directly on the context (or the context it's linked to, depending on its
  37  * type.) Doesn't handle special cases, since they're handled by
  38  * CertSetCertificateContextProperty anyway.
  39  */
  40 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
  41  DWORD dwFlags, const void *pvData);
  42
  43 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  44  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  45  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  46 {
  47     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  48      pbCertEncoded, cbCertEncoded);
  49     BOOL ret;
  50
  51     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  52      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  53
  54     if (cert)
  55     {
  56         ret = CertAddCertificateContextToStore(hCertStore, cert,
  57          dwAddDisposition, ppCertContext);
  58         CertFreeCertificateContext(cert);
  59     }
  60     else
  61         ret = FALSE;
  62     return ret;
  63 }
  64
  65 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
  66  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  67 {
  68     HCERTSTORE store;
  69     BOOL ret = FALSE;
  70
  71     TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
  72      cbCertEncoded);
  73
  74     store = CertOpenSystemStoreA(0, pszCertStoreName);
  75     if (store)
  76     {
  77         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  78          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  79         CertCloseStore(store, 0);
  80     }
  81     return ret;
  82 }
  83
  84 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
  85  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  86 {
  87     HCERTSTORE store;
  88     BOOL ret = FALSE;
  89
  90     TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
  91      cbCertEncoded);
  92
  93     store = CertOpenSystemStoreW(0, pszCertStoreName);
  94     if (store)
  95     {
  96         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  97          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  98         CertCloseStore(store, 0);
  99     }
 100     return ret;
 101 }
 102
 103 static const context_vtbl_t cert_vtbl;
 104
 105 static void Cert_free(context_t *context)
 106 {
 107     cert_t *cert = (cert_t*)context;
 108
 109     CryptMemFree(cert->ctx.pbCertEncoded);
 110     LocalFree(cert->ctx.pCertInfo);
 111 }
 112
 113 static context_t *Cert_clone(context_t *context, WINECRYPT_CERTSTORE *store, BOOL use_link)
 114 {
 115     cert_t *cert;
 116
 117     if(use_link) {
 118         cert = (cert_t*)Context_CreateLinkContext(sizeof(CERT_CONTEXT), context, store);
 119         if(!cert)
 120             return NULL;
 121     }else {
 122         const cert_t *cloned = (const cert_t*)context;
 123         DWORD size = 0;
 124         BOOL res;
 125
 126         cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, store);
 127         if(!cert)
 128             return NULL;
 129
 130         Context_CopyProperties(&cert->ctx, &cloned->ctx);
 131
 132         cert->ctx.dwCertEncodingType = cloned->ctx.dwCertEncodingType;
 133         cert->ctx.pbCertEncoded = CryptMemAlloc(cloned->ctx.cbCertEncoded);
 134         memcpy(cert->ctx.pbCertEncoded, cloned->ctx.pbCertEncoded, cloned->ctx.cbCertEncoded);
 135         cert->ctx.cbCertEncoded = cloned->ctx.cbCertEncoded;
 136
 137         /* FIXME: We don't need to decode the object here, we could just clone cert info. */
 138         res = CryptDecodeObjectEx(cert->ctx.dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 139          cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 140          &cert->ctx.pCertInfo, &size);
 141         if(!res) {
 142             CertFreeCertificateContext(&cert->ctx);
 143             return NULL;
 144         }
 145     }
 146
 147     cert->ctx.hCertStore = store;
 148     return &cert->base;
 149 }
 150
 151 static const context_vtbl_t cert_vtbl = {
 152     Cert_free,
 153     Cert_clone
 154 };
 155
 156 static BOOL add_cert_to_store(WINECRYPT_CERTSTORE *store, const CERT_CONTEXT *cert,
 157  DWORD add_disposition, BOOL use_link, PCCERT_CONTEXT *ret_context)
 158 {
 159     const CERT_CONTEXT *existing = NULL;
 160     BOOL ret = TRUE, inherit_props = FALSE;
 161     context_t *new_context = NULL;
 162
 163     switch (add_disposition)
 164     {
 165     case CERT_STORE_ADD_ALWAYS:
 166         break;
 167     case CERT_STORE_ADD_NEW:
 168     case CERT_STORE_ADD_REPLACE_EXISTING:
 169     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 170     case CERT_STORE_ADD_USE_EXISTING:
 171     case CERT_STORE_ADD_NEWER:
 172     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 173     {
 174         BYTE hashToAdd[20];
 175         DWORD size = sizeof(hashToAdd);
 176
 177         ret = CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID,
 178          hashToAdd, &size);
 179         if (ret)
 180         {
 181             CRYPT_HASH_BLOB blob = { sizeof(hashToAdd), hashToAdd };
 182
 183             existing = CertFindCertificateInStore(store, cert->dwCertEncodingType, 0,
 184              CERT_FIND_SHA1_HASH, &blob, NULL);
 185         }
 186         break;
 187     }
 188     default:
 189         FIXME("Unimplemented add disposition %d\n", add_disposition);
 190         SetLastError(E_INVALIDARG);
 191         return FALSE;
 192     }
 193
 194     switch (add_disposition)
 195     {
 196     case CERT_STORE_ADD_ALWAYS:
 197         break;
 198     case CERT_STORE_ADD_NEW:
 199         if (existing)
 200         {
 201             TRACE("found matching certificate, not adding\n");
 202             SetLastError(CRYPT_E_EXISTS);
 203             return FALSE;
 204         }
 205         break;
 206     case CERT_STORE_ADD_REPLACE_EXISTING:
 207         break;
 208     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 209         if (use_link)
 210             FIXME("CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES: semi-stub for links\n");
 211         if (existing)
 212             inherit_props = TRUE;
 213         break;
 214     case CERT_STORE_ADD_USE_EXISTING:
 215         if(use_link)
 216             FIXME("CERT_STORE_ADD_USE_EXISTING: semi-stub for links\n");
 217         if (existing)
 218         {
 219             Context_CopyProperties(existing, cert);
 220             if (ret_context)
 221                 *ret_context = CertDuplicateCertificateContext(existing);
 222             return TRUE;
 223         }
 224         break;
 225     case CERT_STORE_ADD_NEWER:
 226         if (existing && CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 227         {
 228             TRACE("existing certificate is newer, not adding\n");
 229             SetLastError(CRYPT_E_EXISTS);
 230             return FALSE;
 231         }
 232         break;
 233     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 234         if (existing)
 235         {
 236             if (CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 237             {
 238                 TRACE("existing certificate is newer, not adding\n");
 239                 SetLastError(CRYPT_E_EXISTS);
 240                 return FALSE;
 241             }
 242             inherit_props = TRUE;
 243         }
 244         break;
 245     }
 246
 247     /* FIXME: We have tests that this works, but what should we really do in this case? */
 248     if(!store) {
 249         if(ret_context)
 250             *ret_context = CertDuplicateCertificateContext(cert);
 251         return TRUE;
 252     }
 253
 254     ret = store->vtbl->certs.addContext(store, context_from_ptr(cert), existing ? context_from_ptr(existing) : NULL,
 255      (ret_context || inherit_props) ? &new_context : NULL, use_link);
 256     if(!ret)
 257         return FALSE;
 258
 259     if(inherit_props)
 260         Context_CopyProperties(context_ptr(new_context), existing);
 261
 262     if(ret_context)
 263         *ret_context = context_ptr(new_context);
 264     else if(new_context)
 265         Context_Release(new_context);
 266
 267     TRACE("returning %d\n", ret);
 268     return ret;
 269 }
 270
 271 BOOL WINAPI CertAddCertificateContextToStore(HCERTSTORE hCertStore, PCCERT_CONTEXT pCertContext,
 272  DWORD dwAddDisposition, PCCERT_CONTEXT *ppStoreContext)
 273 {
 274     WINECRYPT_CERTSTORE *store = hCertStore;
 275
 276     TRACE("(%p, %p, %08x, %p)\n", hCertStore, pCertContext, dwAddDisposition, ppStoreContext);
 277
 278     return add_cert_to_store(store, pCertContext, dwAddDisposition, FALSE, ppStoreContext);
 279 }
 280
 281 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
 282  PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
 283  PCCERT_CONTEXT *ppCertContext)
 284 {
 285     static int calls;
 286     WINECRYPT_CERTSTORE *store = (WINECRYPT_CERTSTORE*)hCertStore;
 287
 288     if (!(calls++))
 289         FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore, pCertContext,
 290          dwAddDisposition, ppCertContext);
 291     if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
 292         return FALSE;
 293     if (store->type == StoreTypeCollection)
 294     {
 295         SetLastError(E_INVALIDARG);
 296         return FALSE;
 297     }
 298     return add_cert_to_store(hCertStore, pCertContext, dwAddDisposition, TRUE, ppCertContext);
 299 }
 300
 301 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
 302  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 303 {
 304     cert_t *cert = NULL;
 305     BYTE *data = NULL;
 306     BOOL ret;
 307     PCERT_INFO certInfo = NULL;
 308     DWORD size = 0;
 309
 310     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
 311      cbCertEncoded);
 312
 313     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
 314     {
 315         SetLastError(E_INVALIDARG);
 316         return NULL;
 317     }
 318
 319     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 320      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 321      &certInfo, &size);
 322     if (!ret)
 323         return NULL;
 324
 325     cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, &empty_store);
 326     if (!cert)
 327         return NULL;
 328     data = CryptMemAlloc(cbCertEncoded);
 329     if (!data)
 330     {
 331         Context_Release(&cert->base);
 332         return NULL;
 333     }
 334
 335     memcpy(data, pbCertEncoded, cbCertEncoded);
 336     cert->ctx.dwCertEncodingType = dwCertEncodingType;
 337     cert->ctx.pbCertEncoded      = data;
 338     cert->ctx.cbCertEncoded      = cbCertEncoded;
 339     cert->ctx.pCertInfo          = certInfo;
 340     cert->ctx.hCertStore         = &empty_store;
 341
 342     return &cert->ctx;
 343 }
 344
 345 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(PCCERT_CONTEXT pCertContext)
 346 {
 347     TRACE("(%p)\n", pCertContext);
 348
 349     if (!pCertContext)
 350         return NULL;
 351
 352     Context_AddRef(&cert_from_ptr(pCertContext)->base);
 353     return pCertContext;
 354 }
 355
 356 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 357 {
 358     TRACE("(%p)\n", pCertContext);
 359
 360     if (pCertContext)
 361         Context_Release(&cert_from_ptr(pCertContext)->base);
 362     return TRUE;
 363 }
 364
 365 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 366  DWORD dwPropId)
 367 {
 368     cert_t *cert = cert_from_ptr(pCertContext);
 369     DWORD ret;
 370
 371     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 372
 373     if (cert->base.properties)
 374         ret = ContextPropertyList_EnumPropIDs(cert->base.properties, dwPropId);
 375     else
 376         ret = 0;
 377     return ret;
 378 }
 379
 380 static BOOL CertContext_GetHashProp(cert_t *cert, DWORD dwPropId,
 381  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 382  DWORD *pcbData)
 383 {
 384     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 385      pcbData);
 386     if (ret && pvData)
 387     {
 388         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 389
 390         ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 391     }
 392     return ret;
 393 }
 394
 395 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 396  DWORD cb)
 397 {
 398     BOOL ret = TRUE;
 399
 400     if (!pvData)
 401         *pcbData = cb;
 402     else if (*pcbData < cb)
 403     {
 404         SetLastError(ERROR_MORE_DATA);
 405         *pcbData = cb;
 406         ret = FALSE;
 407     }
 408     else
 409     {
 410         memcpy(pvData, pb, cb);
 411         *pcbData = cb;
 412     }
 413     return ret;
 414 }
 415
 416 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
 417  void *pvData, DWORD *pcbData)
 418 {
 419     BOOL ret;
 420     CRYPT_DATA_BLOB blob;
 421
 422     TRACE("(%p, %d, %p, %p)\n", cert, dwPropId, pvData, pcbData);
 423
 424     if (cert->base.properties)
 425         ret = ContextPropertyList_FindProperty(cert->base.properties, dwPropId, &blob);
 426     else
 427         ret = FALSE;
 428     if (ret)
 429         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 430     else
 431     {
 432         /* Implicit properties */
 433         switch (dwPropId)
 434         {
 435         case CERT_SHA1_HASH_PROP_ID:
 436             ret = CertContext_GetHashProp(cert, dwPropId, CALG_SHA1,
 437              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 438              pcbData);
 439             break;
 440         case CERT_MD5_HASH_PROP_ID:
 441             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 442              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 443              pcbData);
 444             break;
 445         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 446             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 447              cert->ctx.pCertInfo->Subject.pbData,
 448              cert->ctx.pCertInfo->Subject.cbData,
 449              pvData, pcbData);
 450             break;
 451         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 452             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 453              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 454              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 455              pvData, pcbData);
 456             break;
 457         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 458             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 459              cert->ctx.pCertInfo->SerialNumber.pbData,
 460              cert->ctx.pCertInfo->SerialNumber.cbData,
 461              pvData, pcbData);
 462             break;
 463         case CERT_SIGNATURE_HASH_PROP_ID:
 464             ret = CryptHashToBeSigned(0, cert->ctx.dwCertEncodingType,
 465              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 466              pcbData);
 467             if (ret && pvData)
 468             {
 469                 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 470
 471                 ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 472             }
 473             break;
 474         case CERT_KEY_IDENTIFIER_PROP_ID:
 475         {
 476             PCERT_EXTENSION ext = CertFindExtension(
 477              szOID_SUBJECT_KEY_IDENTIFIER, cert->ctx.pCertInfo->cExtension,
 478              cert->ctx.pCertInfo->rgExtension);
 479
 480             if (ext)
 481             {
 482                 CRYPT_DATA_BLOB value;
 483                 DWORD size = sizeof(value);
 484
 485                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 486                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 487                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 488                  &size);
 489                 if (ret)
 490                 {
 491                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 492                      value.cbData);
 493                     CertContext_SetProperty(cert, dwPropId, 0, &value);
 494                 }
 495             }
 496             else
 497                 SetLastError(ERROR_INVALID_DATA);
 498             break;
 499         }
 500         default:
 501             SetLastError(CRYPT_E_NOT_FOUND);
 502         }
 503     }
 504     TRACE("returning %d\n", ret);
 505     return ret;
 506 }
 507
 508 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
 509 {
 510     DWORD i, containerLen, provNameLen;
 511     LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
 512
 513     info->pwszContainerName = (LPWSTR)data;
 514     containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 515     data += containerLen;
 516
 517     info->pwszProvName = (LPWSTR)data;
 518     provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 519     data += provNameLen;
 520
 521     info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
 522     data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 523
 524     for (i = 0; i < info->cProvParam; i++)
 525     {
 526         info->rgProvParam[i].pbData = data;
 527         data += info->rgProvParam[i].cbData;
 528     }
 529 }
 530
 531 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 532  DWORD dwPropId, void *pvData, DWORD *pcbData)
 533 {
 534     cert_t *cert = cert_from_ptr(pCertContext);
 535     BOOL ret;
 536
 537     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 538
 539     switch (dwPropId)
 540     {
 541     case 0:
 542     case CERT_CERT_PROP_ID:
 543     case CERT_CRL_PROP_ID:
 544     case CERT_CTL_PROP_ID:
 545         SetLastError(E_INVALIDARG);
 546         ret = FALSE;
 547         break;
 548     case CERT_ACCESS_STATE_PROP_ID:
 549         ret = CertGetStoreProperty(cert->ctx.hCertStore, dwPropId, pvData, pcbData);
 550         break;
 551     case CERT_KEY_PROV_HANDLE_PROP_ID:
 552     {
 553         CERT_KEY_CONTEXT keyContext;
 554         DWORD size = sizeof(keyContext);
 555
 556         ret = CertContext_GetProperty(cert,
 557          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 558         if (ret)
 559             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 560              sizeof(keyContext.hCryptProv));
 561         break;
 562     }
 563     case CERT_KEY_PROV_INFO_PROP_ID:
 564         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 565          pcbData);
 566         if (ret && pvData)
 567             CRYPT_FixKeyProvInfoPointers(pvData);
 568         break;
 569     default:
 570         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 571          pcbData);
 572     }
 573
 574     TRACE("returning %d\n", ret);
 575     return ret;
 576 }
 577
 578 /* Copies key provider info from from into to, where to is assumed to be a
 579  * contiguous buffer of memory large enough for from and all its associated
 580  * data, but whose pointers are uninitialized.
 581  * Upon return, to contains a contiguous copy of from, packed in the following
 582  * order:
 583  * - CRYPT_KEY_PROV_INFO
 584  * - pwszContainerName
 585  * - pwszProvName
 586  * - rgProvParam[0]...
 587  */
 588 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
 589  const CRYPT_KEY_PROV_INFO *from)
 590 {
 591     DWORD i;
 592     LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
 593
 594     if (from->pwszContainerName)
 595     {
 596         to->pwszContainerName = (LPWSTR)nextData;
 597         lstrcpyW(to->pwszContainerName, from->pwszContainerName);
 598         nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 599     }
 600     else
 601         to->pwszContainerName = NULL;
 602     if (from->pwszProvName)
 603     {
 604         to->pwszProvName = (LPWSTR)nextData;
 605         lstrcpyW(to->pwszProvName, from->pwszProvName);
 606         nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 607     }
 608     else
 609         to->pwszProvName = NULL;
 610     to->dwProvType = from->dwProvType;
 611     to->dwFlags = from->dwFlags;
 612     to->cProvParam = from->cProvParam;
 613     to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
 614     nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 615     to->dwKeySpec = from->dwKeySpec;
 616     for (i = 0; i < to->cProvParam; i++)
 617     {
 618         memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
 619          sizeof(CRYPT_KEY_PROV_PARAM));
 620         to->rgProvParam[i].pbData = nextData;
 621         memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
 622          from->rgProvParam[i].cbData);
 623         nextData += from->rgProvParam[i].cbData;
 624     }
 625 }
 626
 627 static BOOL CertContext_SetKeyProvInfoProperty(CONTEXT_PROPERTY_LIST *properties,
 628  const CRYPT_KEY_PROV_INFO *info)
 629 {
 630     BOOL ret;
 631     LPBYTE buf = NULL;
 632     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
 633
 634     if (info->pwszContainerName)
 635         containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 636     else
 637         containerSize = 0;
 638     if (info->pwszProvName)
 639         provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 640     else
 641         provNameSize = 0;
 642     size += containerSize + provNameSize;
 643     for (i = 0; i < info->cProvParam; i++)
 644         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 645     buf = CryptMemAlloc(size);
 646     if (buf)
 647     {
 648         CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
 649         ret = ContextPropertyList_SetProperty(properties,
 650          CERT_KEY_PROV_INFO_PROP_ID, buf, size);
 651         CryptMemFree(buf);
 652     }
 653     else
 654         ret = FALSE;
 655     return ret;
 656 }
 657
 658 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
 659  DWORD dwFlags, const void *pvData)
 660 {
 661     BOOL ret;
 662
 663     TRACE("(%p, %d, %08x, %p)\n", cert, dwPropId, dwFlags, pvData);
 664
 665     if (!cert->base.properties)
 666         ret = FALSE;
 667     else
 668     {
 669         switch (dwPropId)
 670         {
 671         case CERT_AUTO_ENROLL_PROP_ID:
 672         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 673         case CERT_DESCRIPTION_PROP_ID:
 674         case CERT_FRIENDLY_NAME_PROP_ID:
 675         case CERT_HASH_PROP_ID:
 676         case CERT_KEY_IDENTIFIER_PROP_ID:
 677         case CERT_MD5_HASH_PROP_ID:
 678         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 679         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 680         case CERT_PVK_FILE_PROP_ID:
 681         case CERT_SIGNATURE_HASH_PROP_ID:
 682         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 683         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 684         case CERT_EXTENDED_ERROR_INFO_PROP_ID:
 685         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 686         case CERT_ENROLLMENT_PROP_ID:
 687         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 688         case CERT_RENEWAL_PROP_ID:
 689         {
 690             if (pvData)
 691             {
 692                 const CRYPT_DATA_BLOB *blob = pvData;
 693
 694                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 695                  blob->pbData, blob->cbData);
 696             }
 697             else
 698             {
 699                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 700                 ret = TRUE;
 701             }
 702             break;
 703         }
 704         case CERT_DATE_STAMP_PROP_ID:
 705             if (pvData)
 706                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 707                  pvData, sizeof(FILETIME));
 708             else
 709             {
 710                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 711                 ret = TRUE;
 712             }
 713             break;
 714         case CERT_KEY_CONTEXT_PROP_ID:
 715         {
 716             if (pvData)
 717             {
 718                 const CERT_KEY_CONTEXT *keyContext = pvData;
 719
 720                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 721                 {
 722                     SetLastError(E_INVALIDARG);
 723                     ret = FALSE;
 724                 }
 725                 else
 726                     ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 727                      (const BYTE *)keyContext, keyContext->cbSize);
 728             }
 729             else
 730             {
 731                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 732                 ret = TRUE;
 733             }
 734             break;
 735         }
 736         case CERT_KEY_PROV_INFO_PROP_ID:
 737             if (pvData)
 738                 ret = CertContext_SetKeyProvInfoProperty(cert->base.properties, pvData);
 739             else
 740             {
 741                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 742                 ret = TRUE;
 743             }
 744             break;
 745         case CERT_KEY_PROV_HANDLE_PROP_ID:
 746         {
 747             CERT_KEY_CONTEXT keyContext;
 748             DWORD size = sizeof(keyContext);
 749
 750             ret = CertContext_GetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 751              &keyContext, &size);
 752             if (ret)
 753             {
 754                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 755                     CryptReleaseContext(keyContext.hCryptProv, 0);
 756             }
 757             keyContext.cbSize = sizeof(keyContext);
 758             if (pvData)
 759                 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 760             else
 761             {
 762                 keyContext.hCryptProv = 0;
 763                 keyContext.dwKeySpec = AT_SIGNATURE;
 764             }
 765             ret = CertContext_SetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 766              0, &keyContext);
 767             break;
 768         }
 769         default:
 770             FIXME("%d: stub\n", dwPropId);
 771             ret = FALSE;
 772         }
 773     }
 774     TRACE("returning %d\n", ret);
 775     return ret;
 776 }
 777
 778 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 779  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 780 {
 781     BOOL ret;
 782
 783     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 784
 785     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 786      * crashes on most of these, I'll be safer.
 787      */
 788     switch (dwPropId)
 789     {
 790     case 0:
 791     case CERT_ACCESS_STATE_PROP_ID:
 792     case CERT_CERT_PROP_ID:
 793     case CERT_CRL_PROP_ID:
 794     case CERT_CTL_PROP_ID:
 795         SetLastError(E_INVALIDARG);
 796         return FALSE;
 797     }
 798     ret = CertContext_SetProperty(cert_from_ptr(pCertContext), dwPropId, dwFlags,
 799      pvData);
 800     TRACE("returning %d\n", ret);
 801     return ret;
 802 }
 803
 804 /* Acquires the private key using the key provider info, retrieving info from
 805  * the certificate if info is NULL.  The acquired provider is returned in
 806  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 807  */
 808 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
 809  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 810 {
 811     DWORD size = 0;
 812     BOOL allocated = FALSE, ret = TRUE;
 813
 814     if (!info)
 815     {
 816         ret = CertGetCertificateContextProperty(pCert,
 817          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 818         if (ret)
 819         {
 820             info = HeapAlloc(GetProcessHeap(), 0, size);
 821             if (info)
 822             {
 823                 ret = CertGetCertificateContextProperty(pCert,
 824                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 825                 allocated = TRUE;
 826             }
 827             else
 828             {
 829                 SetLastError(ERROR_OUTOFMEMORY);
 830                 ret = FALSE;
 831             }
 832         }
 833         else
 834             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 835     }
 836     if (ret)
 837     {
 838         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 839          info->pwszProvName, info->dwProvType, 0);
 840         if (ret)
 841         {
 842             DWORD i;
 843
 844             for (i = 0; i < info->cProvParam; i++)
 845             {
 846                 CryptSetProvParam(*phCryptProv,
 847                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 848                  info->rgProvParam[i].dwFlags);
 849             }
 850             *pdwKeySpec = info->dwKeySpec;
 851         }
 852         else
 853             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 854     }
 855     if (allocated)
 856         HeapFree(GetProcessHeap(), 0, info);
 857     return ret;
 858 }
 859
 860 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 861  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 862  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 863 {
 864     BOOL ret = FALSE, cache = FALSE;
 865     PCRYPT_KEY_PROV_INFO info = NULL;
 866     CERT_KEY_CONTEXT keyContext;
 867     DWORD size;
 868
 869     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 870      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 871
 872     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 873     {
 874         DWORD size = 0;
 875
 876         ret = CertGetCertificateContextProperty(pCert,
 877          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 878         if (ret)
 879         {
 880             info = HeapAlloc(GetProcessHeap(), 0, size);
 881             ret = CertGetCertificateContextProperty(pCert,
 882              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 883             if (ret)
 884                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 885         }
 886     }
 887     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 888         cache = TRUE;
 889     *phCryptProv = 0;
 890     if (cache)
 891     {
 892         size = sizeof(keyContext);
 893         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 894          &keyContext, &size);
 895         if (ret)
 896         {
 897             *phCryptProv = keyContext.hCryptProv;
 898             if (pdwKeySpec)
 899                 *pdwKeySpec = keyContext.dwKeySpec;
 900             if (pfCallerFreeProv)
 901                 *pfCallerFreeProv = !cache;
 902         }
 903     }
 904     if (!*phCryptProv)
 905     {
 906         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
 907          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 908         if (ret)
 909         {
 910             *phCryptProv = keyContext.hCryptProv;
 911             if (pdwKeySpec)
 912                 *pdwKeySpec = keyContext.dwKeySpec;
 913             if (cache)
 914             {
 915                 keyContext.cbSize = sizeof(keyContext);
 916                 if (CertSetCertificateContextProperty(pCert,
 917                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 918                 {
 919                     if (pfCallerFreeProv)
 920                         *pfCallerFreeProv = FALSE;
 921                 }
 922             }
 923             else
 924             {
 925                 if (pfCallerFreeProv)
 926                     *pfCallerFreeProv = TRUE;
 927             }
 928         }
 929     }
 930     HeapFree(GetProcessHeap(), 0, info);
 931     return ret;
 932 }
 933
 934 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
 935  const CRYPT_KEY_PROV_INFO *keyProvInfo)
 936 {
 937     HCRYPTPROV csp;
 938     BOOL matches = FALSE;
 939
 940     if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
 941      keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
 942     {
 943         DWORD size;
 944
 945         /* Need to sign something to verify the sig.  What to sign?  Why not
 946          * the certificate itself?
 947          */
 948         if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
 949          pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
 950          &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
 951         {
 952             BYTE *certEncoded = CryptMemAlloc(size);
 953
 954             if (certEncoded)
 955             {
 956                 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
 957                  pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 958                  pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
 959                  NULL, certEncoded, &size))
 960                 {
 961                     if (size == pCert->cbCertEncoded &&
 962                      !memcmp(certEncoded, pCert->pbCertEncoded, size))
 963                         matches = TRUE;
 964                 }
 965                 CryptMemFree(certEncoded);
 966             }
 967         }
 968         CryptReleaseContext(csp, 0);
 969     }
 970     return matches;
 971 }
 972
 973 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
 974  CRYPT_KEY_PROV_INFO *keyProvInfo)
 975 {
 976     CRYPT_KEY_PROV_INFO copy;
 977     WCHAR containerW[MAX_PATH];
 978     BOOL matches = FALSE;
 979
 980     MultiByteToWideChar(CP_ACP, 0, container, -1,
 981      containerW, sizeof(containerW) / sizeof(containerW[0]));
 982     /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
 983      * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
 984      * name.
 985      */
 986     copy = *keyProvInfo;
 987     copy.pwszContainerName = containerW;
 988     matches = key_prov_info_matches_cert(pCert, &copy);
 989     if (matches)
 990     {
 991         keyProvInfo->pwszContainerName =
 992          CryptMemAlloc((strlenW(containerW) + 1) * sizeof(WCHAR));
 993         if (keyProvInfo->pwszContainerName)
 994         {
 995             strcpyW(keyProvInfo->pwszContainerName, containerW);
 996             keyProvInfo->dwKeySpec = AT_SIGNATURE;
 997         }
 998         else
 999             matches = FALSE;
1000     }
1001     return matches;
1002 }
1003
1004 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
1005  * private key matches pCert's public key.  Upon success, updates keyProvInfo
1006  * with the matching container's info (free keyProvInfo.pwszContainerName upon
1007  * success.)
1008  * Returns TRUE if found, FALSE if not.
1009  */
1010 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
1011  CRYPT_KEY_PROV_INFO *keyProvInfo)
1012 {
1013     HCRYPTPROV defProvider;
1014     BOOL ret, found = FALSE;
1015     char containerA[MAX_PATH];
1016
1017     assert(keyProvInfo->pwszContainerName == NULL);
1018     if ((ret = CryptAcquireContextW(&defProvider, NULL,
1019      keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
1020      keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
1021     {
1022         DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
1023
1024         while (ret && !found)
1025         {
1026             DWORD size = sizeof(containerA);
1027
1028             ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
1029              (BYTE *)containerA, &size, enumFlags);
1030             if (ret)
1031                 found = container_matches_cert(pCert, containerA, keyProvInfo);
1032             if (enumFlags & CRYPT_FIRST)
1033             {
1034                 enumFlags &= ~CRYPT_FIRST;
1035                 enumFlags |= CRYPT_NEXT;
1036             }
1037         }
1038         CryptReleaseContext(defProvider, 0);
1039     }
1040     return found;
1041 }
1042
1043 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
1044 {
1045     BOOL found = FALSE, ret = TRUE;
1046     DWORD index = 0, cbProvName = 0;
1047     CRYPT_KEY_PROV_INFO keyProvInfo;
1048
1049     TRACE("(%p, %08x)\n", pCert, dwFlags);
1050
1051     memset(&keyProvInfo, 0, sizeof(keyProvInfo));
1052     while (ret && !found)
1053     {
1054         DWORD size = 0;
1055
1056         ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
1057          NULL, &size);
1058         if (ret)
1059         {
1060             if (size <= cbProvName)
1061                 ret = CryptEnumProvidersW(index, NULL, 0,
1062                  &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1063             else
1064             {
1065                 CryptMemFree(keyProvInfo.pwszProvName);
1066                 keyProvInfo.pwszProvName = CryptMemAlloc(size);
1067                 if (keyProvInfo.pwszProvName)
1068                 {
1069                     cbProvName = size;
1070                     ret = CryptEnumProvidersW(index, NULL, 0,
1071                      &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1072                     if (ret)
1073                     {
1074                         if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
1075                             keyProvInfo.dwFlags |= CRYPT_SILENT;
1076                         if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
1077                          !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1078                          CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1079                         {
1080                             keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
1081                             found = find_key_prov_info_in_provider(pCert,
1082                              &keyProvInfo);
1083                         }
1084                         if (!found)
1085                         {
1086                             if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
1087                              !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1088                              CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1089                             {
1090                                 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
1091                                 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
1092                                 found = find_key_prov_info_in_provider(pCert,
1093                                  &keyProvInfo);
1094                             }
1095                         }
1096                     }
1097                 }
1098                 else
1099                     ret = FALSE;
1100             }
1101             index++;
1102         }
1103     }
1104     if (found)
1105         CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1106          0, &keyProvInfo);
1107     CryptMemFree(keyProvInfo.pwszProvName);
1108     CryptMemFree(keyProvInfo.pwszContainerName);
1109     return found;
1110 }
1111
1112 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
1113 {
1114     BOOL matches = FALSE;
1115     DWORD size;
1116
1117     if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1118      NULL, &size))
1119     {
1120         CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
1121
1122         if (keyProvInfo)
1123         {
1124             if (CertGetCertificateContextProperty(pCert,
1125              CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
1126                 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
1127             CryptMemFree(keyProvInfo);
1128         }
1129     }
1130     return matches;
1131 }
1132
1133 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
1134  DWORD dwFlags, void *pvReserved)
1135 {
1136     BOOL matches = FALSE;
1137
1138     TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
1139
1140     matches = cert_prov_info_matches_cert(pCert);
1141     if (!matches)
1142         matches = find_matching_provider(pCert, dwFlags);
1143     return matches;
1144 }
1145
1146 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1147  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1148 {
1149     BOOL ret;
1150
1151     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1152
1153     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1154      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1155      &pCertId2->SerialNumber);
1156     TRACE("returning %d\n", ret);
1157     return ret;
1158 }
1159
1160 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1161  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1162 {
1163     BOOL ret;
1164
1165     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1166
1167     if (pCertName1->cbData == pCertName2->cbData)
1168     {
1169         if (pCertName1->cbData)
1170             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1171              pCertName1->cbData);
1172         else
1173             ret = TRUE;
1174     }
1175     else
1176         ret = FALSE;
1177     TRACE("returning %d\n", ret);
1178     return ret;
1179 }
1180
1181 /* Returns the number of significant bytes in pInt, where a byte is
1182  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1183  * for negative numbers.  pInt is assumed to be little-endian.
1184  */
1185 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1186 {
1187     DWORD ret = pInt->cbData;
1188
1189     while (ret > 1)
1190     {
1191         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1192             ret--;
1193         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1194             ret--;
1195         else
1196             break;
1197     }
1198     return ret;
1199 }
1200
1201 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1202  PCRYPT_INTEGER_BLOB pInt2)
1203 {
1204     BOOL ret;
1205     DWORD cb1, cb2;
1206
1207     TRACE("(%p, %p)\n", pInt1, pInt2);
1208
1209     cb1 = CRYPT_significantBytes(pInt1);
1210     cb2 = CRYPT_significantBytes(pInt2);
1211     if (cb1 == cb2)
1212     {
1213         if (cb1)
1214             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1215         else
1216             ret = TRUE;
1217     }
1218     else
1219         ret = FALSE;
1220     TRACE("returning %d\n", ret);
1221     return ret;
1222 }
1223
1224 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1225  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1226 {
1227     BOOL ret;
1228
1229     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1230
1231     switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1232     {
1233     case 0:     /* Seems to mean "raw binary bits" */
1234         if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1235          pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1236         {
1237           if (pPublicKey2->PublicKey.cbData)
1238               ret = !memcmp(pPublicKey1->PublicKey.pbData,
1239                pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1240           else
1241               ret = TRUE;
1242         }
1243         else
1244             ret = FALSE;
1245         break;
1246     default:
1247         WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1248         /* FALLTHROUGH */
1249     case X509_ASN_ENCODING:
1250     {
1251         BLOBHEADER *pblob1, *pblob2;
1252         DWORD length;
1253         ret = FALSE;
1254         if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1255                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1256                     0, NULL, &length))
1257         {
1258             pblob1 = CryptMemAlloc(length);
1259             if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1260                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1261                     0, pblob1, &length))
1262             {
1263                 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1264                             pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1265                             0, NULL, &length))
1266                 {
1267                     pblob2 = CryptMemAlloc(length);
1268                     if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1269                             pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1270                             0, pblob2, &length))
1271                     {
1272                         /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1273                         RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1274                                   *pk2 = (LPVOID)(pblob2 + 1);
1275                         ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1276                                  && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1277                     }
1278                     CryptMemFree(pblob2);
1279                 }
1280             }
1281             CryptMemFree(pblob1);
1282         }
1283
1284         break;
1285     }
1286     }
1287     return ret;
1288 }
1289
1290 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1291  PCERT_PUBLIC_KEY_INFO pPublicKey)
1292 {
1293     DWORD len = 0;
1294
1295     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1296
1297     if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1298     {
1299         SetLastError(ERROR_FILE_NOT_FOUND);
1300         return 0;
1301     }
1302     if (pPublicKey->Algorithm.pszObjId &&
1303      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1304     {
1305         FIXME("unimplemented for DH public keys\n");
1306         SetLastError(CRYPT_E_ASN1_BADTAG);
1307     }
1308     else
1309     {
1310         DWORD size;
1311         PBYTE buf;
1312         BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
1313          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1314          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1315          &size);
1316
1317         if (ret)
1318         {
1319             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1320
1321             len = rsaPubKey->bitlen;
1322             LocalFree(buf);
1323         }
1324     }
1325     return len;
1326 }
1327
1328 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1329  DWORD dwFlags, const void *pvPara);
1330
1331 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1332  DWORD dwFlags, const void *pvPara)
1333 {
1334     BOOL ret;
1335     BYTE hash[16];
1336     DWORD size = sizeof(hash);
1337
1338     ret = CertGetCertificateContextProperty(pCertContext,
1339      CERT_MD5_HASH_PROP_ID, hash, &size);
1340     if (ret)
1341     {
1342         const CRYPT_HASH_BLOB *pHash = pvPara;
1343
1344         if (size == pHash->cbData)
1345             ret = !memcmp(pHash->pbData, hash, size);
1346         else
1347             ret = FALSE;
1348     }
1349     return ret;
1350 }
1351
1352 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1353  DWORD dwFlags, const void *pvPara)
1354 {
1355     BOOL ret;
1356     BYTE hash[20];
1357     DWORD size = sizeof(hash);
1358
1359     ret = CertGetCertificateContextProperty(pCertContext,
1360      CERT_SHA1_HASH_PROP_ID, hash, &size);
1361     if (ret)
1362     {
1363         const CRYPT_HASH_BLOB *pHash = pvPara;
1364
1365         if (size == pHash->cbData)
1366             ret = !memcmp(pHash->pbData, hash, size);
1367         else
1368             ret = FALSE;
1369     }
1370     return ret;
1371 }
1372
1373 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1374  DWORD dwFlags, const void *pvPara)
1375 {
1376     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1377     BOOL ret;
1378
1379     if (dwType & CERT_INFO_SUBJECT_FLAG)
1380         toCompare = &pCertContext->pCertInfo->Subject;
1381     else
1382         toCompare = &pCertContext->pCertInfo->Issuer;
1383     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1384      toCompare, blob);
1385     return ret;
1386 }
1387
1388 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1389  DWORD dwType, DWORD dwFlags, const void *pvPara)
1390 {
1391     CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1392     BOOL ret;
1393
1394     ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1395      &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1396     return ret;
1397 }
1398
1399 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1400  DWORD dwType, DWORD dwFlags, const void *pvPara)
1401 {
1402     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1403     BOOL ret;
1404
1405     /* Matching serial number and subject match.. */
1406     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1407      &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1408     if (ret)
1409         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1410          &pCertInfo->SerialNumber);
1411     else
1412     {
1413         /* failing that, if the serial number and issuer match, we match */
1414         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1415          &pCertInfo->SerialNumber);
1416         if (ret)
1417             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1418              &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1419     }
1420     TRACE("returning %d\n", ret);
1421     return ret;
1422 }
1423
1424 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1425  DWORD dwFlags, const void *pvPara)
1426 {
1427     CERT_ID *id = (CERT_ID *)pvPara;
1428     BOOL ret;
1429
1430     switch (id->dwIdChoice)
1431     {
1432     case CERT_ID_ISSUER_SERIAL_NUMBER:
1433         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1434          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1435         if (ret)
1436             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1437              &id->u.IssuerSerialNumber.SerialNumber);
1438         break;
1439     case CERT_ID_SHA1_HASH:
1440         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1441          &id->u.HashId);
1442         break;
1443     case CERT_ID_KEY_IDENTIFIER:
1444     {
1445         DWORD size = 0;
1446
1447         ret = CertGetCertificateContextProperty(pCertContext,
1448          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1449         if (ret && size == id->u.KeyId.cbData)
1450         {
1451             LPBYTE buf = CryptMemAlloc(size);
1452
1453             if (buf)
1454             {
1455                 CertGetCertificateContextProperty(pCertContext,
1456                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1457                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1458                 CryptMemFree(buf);
1459             }
1460             else
1461                 ret = FALSE;
1462         }
1463         else
1464             ret = FALSE;
1465         break;
1466     }
1467     default:
1468         ret = FALSE;
1469         break;
1470     }
1471     return ret;
1472 }
1473
1474 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1475  DWORD dwFlags, const void *pvPara)
1476 {
1477     PCCERT_CONTEXT toCompare = pvPara;
1478     return CertCompareCertificate(pCertContext->dwCertEncodingType,
1479      pCertContext->pCertInfo, toCompare->pCertInfo);
1480 }
1481
1482 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1483  DWORD dwFlags, const void *pvPara)
1484 {
1485     const CRYPT_HASH_BLOB *hash = pvPara;
1486     DWORD size = 0;
1487     BOOL ret;
1488
1489     ret = CertGetCertificateContextProperty(pCertContext,
1490      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1491     if (ret && size == hash->cbData)
1492     {
1493         LPBYTE buf = CryptMemAlloc(size);
1494
1495         if (buf)
1496         {
1497             CertGetCertificateContextProperty(pCertContext,
1498              CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1499             ret = !memcmp(buf, hash->pbData, size);
1500             CryptMemFree(buf);
1501         }
1502         else
1503             ret = FALSE;
1504     }
1505     else
1506         ret = FALSE;
1507     return ret;
1508 }
1509
1510 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1511  PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1512  const void *pvPara)
1513 {
1514     BOOL matches = FALSE;
1515     PCCERT_CONTEXT ret;
1516
1517     ret = prev;
1518     do {
1519         ret = CertEnumCertificatesInStore(store, ret);
1520         if (ret)
1521             matches = compare(ret, dwType, dwFlags, pvPara);
1522     } while (ret != NULL && !matches);
1523     return ret;
1524 }
1525
1526 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1527  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1528
1529 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1530  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1531 {
1532     return CertEnumCertificatesInStore(store, prev);
1533 }
1534
1535 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1536  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1537 {
1538     BOOL ret;
1539     PCCERT_CONTEXT found = NULL, subject = pvPara;
1540     PCERT_EXTENSION ext;
1541     DWORD size;
1542
1543     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1544      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1545     {
1546         CERT_AUTHORITY_KEY_ID_INFO *info;
1547
1548         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1549          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1550          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1551          &info, &size);
1552         if (ret)
1553         {
1554             CERT_ID id;
1555
1556             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1557             {
1558                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1559                 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1560                  sizeof(CERT_NAME_BLOB));
1561                 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1562                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1563             }
1564             else if (info->KeyId.cbData)
1565             {
1566                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1567                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1568             }
1569             else
1570                 ret = FALSE;
1571             if (ret)
1572                 found = cert_compare_certs_in_store(store, prev,
1573                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1574             LocalFree(info);
1575         }
1576     }
1577     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1578      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1579     {
1580         CERT_AUTHORITY_KEY_ID2_INFO *info;
1581
1582         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1583          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1584          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1585          &info, &size);
1586         if (ret)
1587         {
1588             CERT_ID id;
1589
1590             if (info->AuthorityCertIssuer.cAltEntry &&
1591              info->AuthorityCertSerialNumber.cbData)
1592             {
1593                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1594                 DWORD i;
1595
1596                 for (i = 0; !directoryName &&
1597                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1598                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1599                      == CERT_ALT_NAME_DIRECTORY_NAME)
1600                         directoryName =
1601                          &info->AuthorityCertIssuer.rgAltEntry[i];
1602                 if (directoryName)
1603                 {
1604                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1605                     memcpy(&id.u.IssuerSerialNumber.Issuer,
1606                      &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1607                     memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1608                      &info->AuthorityCertSerialNumber,
1609                      sizeof(CRYPT_INTEGER_BLOB));
1610                 }
1611                 else
1612                 {
1613                     FIXME("no supported name type in authority key id2\n");
1614                     ret = FALSE;
1615                 }
1616             }
1617             else if (info->KeyId.cbData)
1618             {
1619                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1620                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1621             }
1622             else
1623                 ret = FALSE;
1624             if (ret)
1625                 found = cert_compare_certs_in_store(store, prev,
1626                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1627             LocalFree(info);
1628         }
1629     }
1630     else
1631        found = cert_compare_certs_in_store(store, prev,
1632         compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1633         dwFlags, &subject->pCertInfo->Issuer);
1634     return found;
1635 }
1636
1637 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1638  DWORD dwType, DWORD dwFlags, const void *pvPara)
1639 {
1640     PCERT_NAME_BLOB name;
1641     DWORD len;
1642     BOOL ret = FALSE;
1643
1644     if (dwType & CERT_INFO_SUBJECT_FLAG)
1645         name = &pCertContext->pCertInfo->Subject;
1646     else
1647         name = &pCertContext->pCertInfo->Issuer;
1648     len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1649      CERT_SIMPLE_NAME_STR, NULL, 0);
1650     if (len)
1651     {
1652         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1653
1654         if (str)
1655         {
1656             LPWSTR ptr;
1657
1658             CertNameToStrW(pCertContext->dwCertEncodingType, name,
1659              CERT_SIMPLE_NAME_STR, str, len);
1660             for (ptr = str; *ptr; ptr++)
1661                 *ptr = tolowerW(*ptr);
1662             if (strstrW(str, pvPara))
1663                 ret = TRUE;
1664             CryptMemFree(str);
1665         }
1666     }
1667     return ret;
1668 }
1669
1670 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1671  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1672 {
1673     PCCERT_CONTEXT found = NULL;
1674
1675     TRACE("%s\n", debugstr_a(pvPara));
1676
1677     if (pvPara)
1678     {
1679         int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1680         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1681
1682         if (str)
1683         {
1684             LPWSTR ptr;
1685
1686             MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1687             for (ptr = str; *ptr; ptr++)
1688                 *ptr = tolowerW(*ptr);
1689             found = cert_compare_certs_in_store(store, prev,
1690              compare_cert_by_name_str, dwType, dwFlags, str);
1691             CryptMemFree(str);
1692         }
1693     }
1694     else
1695         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1696     return found;
1697 }
1698
1699 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1700  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1701 {
1702     PCCERT_CONTEXT found = NULL;
1703
1704     TRACE("%s\n", debugstr_w(pvPara));
1705
1706     if (pvPara)
1707     {
1708         DWORD len = strlenW(pvPara);
1709         LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1710
1711         if (str)
1712         {
1713             LPCWSTR src;
1714             LPWSTR dst;
1715
1716             for (src = pvPara, dst = str; *src; src++, dst++)
1717                 *dst = tolowerW(*src);
1718             *dst = 0;
1719            found = cert_compare_certs_in_store(store, prev,
1720             compare_cert_by_name_str, dwType, dwFlags, str);
1721            CryptMemFree(str);
1722         }
1723     }
1724     else
1725         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1726     return found;
1727 }
1728
1729 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1730  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1731  PCCERT_CONTEXT pPrevCertContext)
1732 {
1733     PCCERT_CONTEXT ret;
1734     CertFindFunc find = NULL;
1735     CertCompareFunc compare = NULL;
1736
1737     TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1738          dwFlags, dwType, pvPara, pPrevCertContext);
1739
1740     switch (dwType >> CERT_COMPARE_SHIFT)
1741     {
1742     case CERT_COMPARE_ANY:
1743         find = find_cert_any;
1744         break;
1745     case CERT_COMPARE_MD5_HASH:
1746         compare = compare_cert_by_md5_hash;
1747         break;
1748     case CERT_COMPARE_SHA1_HASH:
1749         compare = compare_cert_by_sha1_hash;
1750         break;
1751     case CERT_COMPARE_NAME:
1752         compare = compare_cert_by_name;
1753         break;
1754     case CERT_COMPARE_PUBLIC_KEY:
1755         compare = compare_cert_by_public_key;
1756         break;
1757     case CERT_COMPARE_NAME_STR_A:
1758         find = find_cert_by_name_str_a;
1759         break;
1760     case CERT_COMPARE_NAME_STR_W:
1761         find = find_cert_by_name_str_w;
1762         break;
1763     case CERT_COMPARE_SUBJECT_CERT:
1764         compare = compare_cert_by_subject_cert;
1765         break;
1766     case CERT_COMPARE_CERT_ID:
1767         compare = compare_cert_by_cert_id;
1768         break;
1769     case CERT_COMPARE_ISSUER_OF:
1770         find = find_cert_by_issuer;
1771         break;
1772     case CERT_COMPARE_EXISTING:
1773         compare = compare_existing_cert;
1774         break;
1775     case CERT_COMPARE_SIGNATURE_HASH:
1776         compare = compare_cert_by_signature_hash;
1777         break;
1778     default:
1779         FIXME("find type %08x unimplemented\n", dwType);
1780     }
1781
1782     if (find)
1783         ret = find(hCertStore, dwFlags, dwType, pvPara, pPrevCertContext);
1784     else if (compare)
1785         ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1786          compare, dwType, dwFlags, pvPara);
1787     else
1788         ret = NULL;
1789     if (!ret)
1790         SetLastError(CRYPT_E_NOT_FOUND);
1791     TRACE("returning %p\n", ret);
1792     return ret;
1793 }
1794
1795 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1796  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1797 {
1798     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1799
1800     if (!pCertId)
1801     {
1802         SetLastError(E_INVALIDARG);
1803         return NULL;
1804     }
1805     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1806      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1807 }
1808
1809 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1810  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1811 {
1812     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1813      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1814
1815     if (*pdwFlags & ~supportedFlags)
1816     {
1817         SetLastError(E_INVALIDARG);
1818         return FALSE;
1819     }
1820     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1821     {
1822         DWORD flags = 0;
1823         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1824          NULL, &flags);
1825
1826         /* FIXME: what if the CRL has expired? */
1827         if (crl)
1828         {
1829             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1830              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1831                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1832         }
1833         else
1834             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1835     }
1836     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1837     {
1838         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1839             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1840     }
1841     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1842     {
1843         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1844          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1845          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1846             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1847     }
1848     return TRUE;
1849 }
1850
1851 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1852  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1853  DWORD *pdwFlags)
1854 {
1855     PCCERT_CONTEXT ret;
1856
1857     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1858      pPrevIssuerContext, *pdwFlags);
1859
1860     if (!pSubjectContext)
1861     {
1862         SetLastError(E_INVALIDARG);
1863         return NULL;
1864     }
1865
1866     ret = CertFindCertificateInStore(hCertStore,
1867      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1868      pSubjectContext, pPrevIssuerContext);
1869     if (ret)
1870     {
1871         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1872          pdwFlags))
1873         {
1874             CertFreeCertificateContext(ret);
1875             ret = NULL;
1876         }
1877         if (CRYPT_IsCertificateSelfSigned(pSubjectContext))
1878         {
1879             CertFreeCertificateContext(ret);
1880             ret = NULL;
1881             SetLastError(CRYPT_E_SELF_SIGNED);
1882         }
1883     }
1884     TRACE("returning %p\n", ret);
1885     return ret;
1886 }
1887
1888 typedef struct _OLD_CERT_REVOCATION_STATUS {
1889     DWORD cbSize;
1890     DWORD dwIndex;
1891     DWORD dwError;
1892     DWORD dwReason;
1893 } OLD_CERT_REVOCATION_STATUS;
1894
1895 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1896  void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1897
1898 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1899  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1900  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1901 {
1902     BOOL ret;
1903
1904     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1905      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1906
1907     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1908      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1909     {
1910         SetLastError(E_INVALIDARG);
1911         return FALSE;
1912     }
1913     if (cContext)
1914     {
1915         static HCRYPTOIDFUNCSET set = NULL;
1916         DWORD size;
1917
1918         if (!set)
1919             set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1920         ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1921         if (ret)
1922         {
1923             if (size == 1)
1924             {
1925                 /* empty list */
1926                 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1927                 ret = FALSE;
1928             }
1929             else
1930             {
1931                 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1932
1933                 if (dllList)
1934                 {
1935                     ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1936                      dllList, &size);
1937                     if (ret)
1938                     {
1939                         for (ptr = dllList; ret && *ptr;
1940                          ptr += lstrlenW(ptr) + 1)
1941                         {
1942                             CertVerifyRevocationFunc func;
1943                             HCRYPTOIDFUNCADDR hFunc;
1944
1945                             ret = CryptGetDefaultOIDFunctionAddress(set,
1946                              dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1947                             if (ret)
1948                             {
1949                                 ret = func(dwEncodingType, dwRevType, cContext,
1950                                  rgpvContext, dwFlags, pRevPara, pRevStatus);
1951                                 CryptFreeOIDFunctionAddress(hFunc, 0);
1952                             }
1953                         }
1954                     }
1955                     CryptMemFree(dllList);
1956                 }
1957                 else
1958                 {
1959                     SetLastError(ERROR_OUTOFMEMORY);
1960                     ret = FALSE;
1961                 }
1962             }
1963         }
1964     }
1965     else
1966         ret = TRUE;
1967     return ret;
1968 }
1969
1970 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1971  CRYPT_ATTRIBUTE rgAttr[])
1972 {
1973     PCRYPT_ATTRIBUTE ret = NULL;
1974     DWORD i;
1975
1976     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1977
1978     if (!cAttr)
1979         return NULL;
1980     if (!pszObjId)
1981     {
1982         SetLastError(ERROR_INVALID_PARAMETER);
1983         return NULL;
1984     }
1985
1986     for (i = 0; !ret && i < cAttr; i++)
1987         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1988             ret = &rgAttr[i];
1989     return ret;
1990 }
1991
1992 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1993  CERT_EXTENSION rgExtensions[])
1994 {
1995     PCERT_EXTENSION ret = NULL;
1996     DWORD i;
1997
1998     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1999
2000     if (!cExtensions)
2001         return NULL;
2002     if (!pszObjId)
2003     {
2004         SetLastError(ERROR_INVALID_PARAMETER);
2005         return NULL;
2006     }
2007
2008     for (i = 0; !ret && i < cExtensions; i++)
2009         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
2010          rgExtensions[i].pszObjId))
2011             ret = &rgExtensions[i];
2012     return ret;
2013 }
2014
2015 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
2016 {
2017     PCERT_RDN_ATTR ret = NULL;
2018     DWORD i, j;
2019
2020     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
2021
2022     if (!pszObjId)
2023     {
2024         SetLastError(ERROR_INVALID_PARAMETER);
2025         return NULL;
2026     }
2027
2028     for (i = 0; !ret && i < pName->cRDN; i++)
2029         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
2030             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
2031              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
2032                 ret = &pName->rgRDN[i].rgRDNAttr[j];
2033     return ret;
2034 }
2035
2036 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
2037  const CERT_RDN_ATTR *attr)
2038 {
2039     DWORD i, j;
2040     BOOL match = FALSE;
2041
2042     for (i = 0; !match && i < name->cRDN; i++)
2043     {
2044         for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
2045         {
2046             if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
2047              attr->pszObjId) &&
2048              name->rgRDN[i].rgRDNAttr[j].dwValueType ==
2049              attr->dwValueType)
2050             {
2051                 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
2052                 {
2053                     LPCWSTR nameStr =
2054                      (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2055                     LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
2056
2057                     if (attr->Value.cbData !=
2058                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2059                         match = FALSE;
2060                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2061                         match = !strncmpiW(nameStr, attrStr,
2062                          attr->Value.cbData / sizeof(WCHAR));
2063                     else
2064                         match = !strncmpW(nameStr, attrStr,
2065                          attr->Value.cbData / sizeof(WCHAR));
2066                     TRACE("%s : %s => %d\n",
2067                      debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
2068                      debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
2069                      match);
2070                 }
2071                 else
2072                 {
2073                     LPCSTR nameStr =
2074                      (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2075                     LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
2076
2077                     if (attr->Value.cbData !=
2078                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2079                         match = FALSE;
2080                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2081                         match = !strncasecmp(nameStr, attrStr,
2082                          attr->Value.cbData);
2083                     else
2084                         match = !strncmp(nameStr, attrStr, attr->Value.cbData);
2085                     TRACE("%s : %s => %d\n",
2086                      debugstr_an(nameStr, attr->Value.cbData),
2087                      debugstr_an(attrStr, attr->Value.cbData), match);
2088                 }
2089             }
2090         }
2091     }
2092     return match;
2093 }
2094
2095 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
2096  DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
2097 {
2098     CERT_NAME_INFO *name;
2099     LPCSTR type;
2100     DWORD size;
2101     BOOL ret;
2102
2103     TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
2104      pRDN);
2105
2106     type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
2107      X509_NAME;
2108     if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
2109      pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
2110     {
2111         DWORD i;
2112
2113         for (i = 0; ret && i < pRDN->cRDNAttr; i++)
2114             ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
2115         if (!ret)
2116             SetLastError(CRYPT_E_NO_MATCH);
2117         LocalFree(name);
2118     }
2119     return ret;
2120 }
2121
2122 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
2123  PCERT_INFO pCertInfo)
2124 {
2125     FILETIME fileTime;
2126     LONG ret;
2127
2128     if (!pTimeToVerify)
2129     {
2130         GetSystemTimeAsFileTime(&fileTime);
2131         pTimeToVerify = &fileTime;
2132     }
2133     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
2134     {
2135         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
2136         if (ret < 0)
2137             ret = 0;
2138     }
2139     return ret;
2140 }
2141
2142 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
2143  PCERT_INFO pIssuerInfo)
2144 {
2145     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
2146
2147     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
2148      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
2149 }
2150
2151 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2152  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2153  DWORD *pcbComputedHash)
2154 {
2155     BOOL ret = TRUE;
2156     HCRYPTHASH hHash = 0;
2157
2158     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
2159      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2160
2161     if (!hCryptProv)
2162         hCryptProv = CRYPT_GetDefaultProvider();
2163     if (!Algid)
2164         Algid = CALG_SHA1;
2165     if (ret)
2166     {
2167         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2168         if (ret)
2169         {
2170             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2171             if (ret)
2172                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2173                  pcbComputedHash, 0);
2174             CryptDestroyHash(hHash);
2175         }
2176     }
2177     return ret;
2178 }
2179
2180 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2181  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2182  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2183 {
2184     BOOL ret = TRUE;
2185     HCRYPTHASH hHash = 0;
2186
2187     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2188      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2189
2190     if (!hCryptProv)
2191         hCryptProv = CRYPT_GetDefaultProvider();
2192     if (!Algid)
2193         Algid = CALG_MD5;
2194     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2195     {
2196         SetLastError(ERROR_FILE_NOT_FOUND);
2197         return FALSE;
2198     }
2199     if (ret)
2200     {
2201         BYTE *buf;
2202         DWORD size = 0;
2203
2204         ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2205          X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2206          (LPBYTE)&buf, &size);
2207         if (ret)
2208         {
2209             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2210             if (ret)
2211             {
2212                 ret = CryptHashData(hHash, buf, size, 0);
2213                 if (ret)
2214                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2215                      pcbComputedHash, 0);
2216                 CryptDestroyHash(hHash);
2217             }
2218             LocalFree(buf);
2219         }
2220     }
2221     return ret;
2222 }
2223
2224 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2225  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2226  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2227 {
2228     BOOL ret;
2229     CERT_SIGNED_CONTENT_INFO *info;
2230     DWORD size;
2231
2232     TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2233      pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2234
2235     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2236      pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2237     if (ret)
2238     {
2239         PCCRYPT_OID_INFO oidInfo;
2240         HCRYPTHASH hHash;
2241
2242         if (!hCryptProv)
2243             hCryptProv = CRYPT_GetDefaultProvider();
2244         oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2245          info->SignatureAlgorithm.pszObjId, 0);
2246         if (!oidInfo)
2247         {
2248             SetLastError(NTE_BAD_ALGID);
2249             ret = FALSE;
2250         }
2251         else
2252         {
2253             ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2254             if (ret)
2255             {
2256                 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2257                  info->ToBeSigned.cbData, 0);
2258                 if (ret)
2259                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2260                      pcbComputedHash, 0);
2261                 CryptDestroyHash(hHash);
2262             }
2263         }
2264         LocalFree(info);
2265     }
2266     return ret;
2267 }
2268
2269 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2270  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2271  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2272  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2273 {
2274     BOOL ret;
2275     PCCRYPT_OID_INFO info;
2276     HCRYPTHASH hHash;
2277
2278     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2279      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2280      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2281
2282     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2283      pSignatureAlgorithm->pszObjId, 0);
2284     if (!info)
2285     {
2286         SetLastError(NTE_BAD_ALGID);
2287         return FALSE;
2288     }
2289     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2290     {
2291         if (!hCryptProv)
2292             hCryptProv = CRYPT_GetDefaultProvider();
2293         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2294         if (ret)
2295         {
2296             ret = CryptHashData(hHash, pbEncodedToBeSigned,
2297              cbEncodedToBeSigned, 0);
2298             if (ret)
2299                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2300                  pcbSignature, 0);
2301             CryptDestroyHash(hHash);
2302         }
2303     }
2304     else
2305     {
2306         if (!hCryptProv)
2307         {
2308             SetLastError(ERROR_INVALID_PARAMETER);
2309             ret = FALSE;
2310         }
2311         else
2312         {
2313             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2314             if (ret)
2315             {
2316                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2317                  cbEncodedToBeSigned, 0);
2318                 if (ret)
2319                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2320                      pcbSignature);
2321                 CryptDestroyHash(hHash);
2322             }
2323         }
2324     }
2325     return ret;
2326 }
2327
2328 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2329  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2330  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2331  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2332 {
2333     BOOL ret;
2334     DWORD encodedSize, hashSize;
2335
2336     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2337      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2338      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2339
2340     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2341      NULL, &encodedSize);
2342     if (ret)
2343     {
2344         PBYTE encoded = CryptMemAlloc(encodedSize);
2345
2346         if (encoded)
2347         {
2348             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2349              pvStructInfo, encoded, &encodedSize);
2350             if (ret)
2351             {
2352                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2353                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2354                  pvHashAuxInfo, NULL, &hashSize);
2355                 if (ret)
2356                 {
2357                     PBYTE hash = CryptMemAlloc(hashSize);
2358
2359                     if (hash)
2360                     {
2361                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2362                          dwCertEncodingType, encoded, encodedSize,
2363                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2364                         if (ret)
2365                         {
2366                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2367
2368                             info.ToBeSigned.cbData = encodedSize;
2369                             info.ToBeSigned.pbData = encoded;
2370                             info.SignatureAlgorithm = *pSignatureAlgorithm;
2371                             info.Signature.cbData = hashSize;
2372                             info.Signature.pbData = hash;
2373                             info.Signature.cUnusedBits = 0;
2374                             ret = CryptEncodeObject(dwCertEncodingType,
2375                              X509_CERT, &info, pbEncoded, pcbEncoded);
2376                         }
2377                         CryptMemFree(hash);
2378                     }
2379                     else
2380                         ret = FALSE;
2381                 }
2382             }
2383             CryptMemFree(encoded);
2384         }
2385         else
2386             ret = FALSE;
2387     }
2388     return ret;
2389 }
2390
2391 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2392  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2393  PCERT_PUBLIC_KEY_INFO pPublicKey)
2394 {
2395     CRYPT_DATA_BLOB blob = { cbEncoded, (BYTE *)pbEncoded };
2396
2397     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2398      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &blob,
2399      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2400 }
2401
2402 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
2403  DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
2404  const CERT_SIGNED_CONTENT_INFO *signedCert)
2405 {
2406     BOOL ret;
2407     HCRYPTKEY key;
2408     PCCRYPT_OID_INFO info;
2409     ALG_ID pubKeyID, hashID;
2410
2411     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2412      signedCert->SignatureAlgorithm.pszObjId, 0);
2413     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2414     {
2415         SetLastError(NTE_BAD_ALGID);
2416         return FALSE;
2417     }
2418     hashID = info->u.Algid;
2419     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2420         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2421     else
2422         pubKeyID = hashID;
2423     /* Load the default provider if necessary */
2424     if (!hCryptProv)
2425         hCryptProv = CRYPT_GetDefaultProvider();
2426     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2427      pubKeyInfo, pubKeyID, 0, NULL, &key);
2428     if (ret)
2429     {
2430         HCRYPTHASH hash;
2431
2432         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2433         if (ret)
2434         {
2435             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2436              signedCert->ToBeSigned.cbData, 0);
2437             if (ret)
2438                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2439                  signedCert->Signature.cbData, key, NULL, 0);
2440             CryptDestroyHash(hash);
2441         }
2442         CryptDestroyKey(key);
2443     }
2444     return ret;
2445 }
2446
2447 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2448  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2449  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2450 {
2451     BOOL ret = TRUE;
2452     CRYPT_DATA_BLOB subjectBlob;
2453
2454     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2455      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2456      dwFlags, pvReserved);
2457
2458     switch (dwSubjectType)
2459     {
2460     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2461     {
2462         PCRYPT_DATA_BLOB blob = pvSubject;
2463
2464         subjectBlob.pbData = blob->pbData;
2465         subjectBlob.cbData = blob->cbData;
2466         break;
2467     }
2468     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2469     {
2470         PCERT_CONTEXT context = pvSubject;
2471
2472         subjectBlob.pbData = context->pbCertEncoded;
2473         subjectBlob.cbData = context->cbCertEncoded;
2474         break;
2475     }
2476     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2477     {
2478         PCRL_CONTEXT context = pvSubject;
2479
2480         subjectBlob.pbData = context->pbCrlEncoded;
2481         subjectBlob.cbData = context->cbCrlEncoded;
2482         break;
2483     }
2484     default:
2485         SetLastError(E_INVALIDARG);
2486         ret = FALSE;
2487     }
2488
2489     if (ret)
2490     {
2491         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2492         DWORD size = 0;
2493
2494         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2495          subjectBlob.pbData, subjectBlob.cbData,
2496          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2497          &signedCert, &size);
2498         if (ret)
2499         {
2500             switch (dwIssuerType)
2501             {
2502             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2503                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2504                  dwCertEncodingType, pvIssuer,
2505                  signedCert);
2506                 break;
2507             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2508                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2509                  dwCertEncodingType,
2510                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2511                  signedCert);
2512                 break;
2513             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2514                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2515                 ret = FALSE;
2516                 break;
2517             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2518                 if (pvIssuer)
2519                 {
2520                     SetLastError(E_INVALIDARG);
2521                     ret = FALSE;
2522                 }
2523                 else
2524                 {
2525                     FIXME("unimplemented for NULL signer\n");
2526                     SetLastError(E_INVALIDARG);
2527                     ret = FALSE;
2528                 }
2529                 break;
2530             default:
2531                 SetLastError(E_INVALIDARG);
2532                 ret = FALSE;
2533             }
2534             LocalFree(signedCert);
2535         }
2536     }
2537     return ret;
2538 }
2539
2540 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2541  PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2542 {
2543     PCERT_EXTENSION ext;
2544     BOOL ret = FALSE;
2545
2546     TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2547      cbKeyUsage);
2548
2549     ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2550      pCertInfo->rgExtension);
2551     if (ext)
2552     {
2553         CRYPT_BIT_BLOB usage;
2554         DWORD size = sizeof(usage);
2555
2556         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2557          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2558          &usage, &size);
2559         if (ret)
2560         {
2561             if (cbKeyUsage < usage.cbData)
2562                 ret = FALSE;
2563             else
2564             {
2565                 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2566                 if (cbKeyUsage > usage.cbData)
2567                     memset(pbKeyUsage + usage.cbData, 0,
2568                      cbKeyUsage - usage.cbData);
2569             }
2570         }
2571     }
2572     else
2573         SetLastError(0);
2574     return ret;
2575 }
2576
2577 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2578  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2579 {
2580     PCERT_ENHKEY_USAGE usage = NULL;
2581     DWORD bytesNeeded;
2582     BOOL ret = TRUE;
2583
2584     if (!pCertContext || !pcbUsage)
2585     {
2586         SetLastError(ERROR_INVALID_PARAMETER);
2587         return FALSE;
2588     }
2589
2590     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2591
2592     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2593     {
2594         DWORD propSize = 0;
2595
2596         if (CertGetCertificateContextProperty(pCertContext,
2597          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2598         {
2599             LPBYTE buf = CryptMemAlloc(propSize);
2600
2601             if (buf)
2602             {
2603                 if (CertGetCertificateContextProperty(pCertContext,
2604                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2605                 {
2606                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2607                      X509_ENHANCED_KEY_USAGE, buf, propSize,
2608                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2609                 }
2610                 CryptMemFree(buf);
2611             }
2612         }
2613     }
2614     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2615     {
2616         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2617          pCertContext->pCertInfo->cExtension,
2618          pCertContext->pCertInfo->rgExtension);
2619
2620         if (ext)
2621         {
2622             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2623              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
2624              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2625         }
2626     }
2627     if (!usage)
2628     {
2629         /* If a particular location is specified, this should fail.  Otherwise
2630          * it should succeed with an empty usage.  (This is true on Win2k and
2631          * later, which we emulate.)
2632          */
2633         if (dwFlags)
2634         {
2635             SetLastError(CRYPT_E_NOT_FOUND);
2636             ret = FALSE;
2637         }
2638         else
2639             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
2640     }
2641
2642     if (ret)
2643     {
2644         if (!pUsage)
2645             *pcbUsage = bytesNeeded;
2646         else if (*pcbUsage < bytesNeeded)
2647         {
2648             SetLastError(ERROR_MORE_DATA);
2649             *pcbUsage = bytesNeeded;
2650             ret = FALSE;
2651         }
2652         else
2653         {
2654             *pcbUsage = bytesNeeded;
2655             if (usage)
2656             {
2657                 DWORD i;
2658                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
2659                  sizeof(CERT_ENHKEY_USAGE) +
2660                  usage->cUsageIdentifier * sizeof(LPSTR));
2661
2662                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
2663                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
2664                  sizeof(CERT_ENHKEY_USAGE));
2665                 for (i = 0; i < usage->cUsageIdentifier; i++)
2666                 {
2667                     pUsage->rgpszUsageIdentifier[i] = nextOID;
2668                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2669                     nextOID += strlen(nextOID) + 1;
2670                 }
2671             }
2672             else
2673                 pUsage->cUsageIdentifier = 0;
2674         }
2675     }
2676     if (usage)
2677         LocalFree(usage);
2678     TRACE("returning %d\n", ret);
2679     return ret;
2680 }
2681
2682 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
2683  PCERT_ENHKEY_USAGE pUsage)
2684 {
2685     BOOL ret;
2686
2687     TRACE("(%p, %p)\n", pCertContext, pUsage);
2688
2689     if (pUsage)
2690     {
2691         CRYPT_DATA_BLOB blob = { 0, NULL };
2692
2693         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2694          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2695         if (ret)
2696         {
2697             ret = CertSetCertificateContextProperty(pCertContext,
2698              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2699             LocalFree(blob.pbData);
2700         }
2701     }
2702     else
2703         ret = CertSetCertificateContextProperty(pCertContext,
2704          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2705     return ret;
2706 }
2707
2708 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2709  LPCSTR pszUsageIdentifier)
2710 {
2711     BOOL ret;
2712     DWORD size;
2713
2714     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2715
2716     if (CertGetEnhancedKeyUsage(pCertContext,
2717      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2718     {
2719         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2720
2721         if (usage)
2722         {
2723             ret = CertGetEnhancedKeyUsage(pCertContext,
2724              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2725             if (ret)
2726             {
2727                 DWORD i;
2728                 BOOL exists = FALSE;
2729
2730                 /* Make sure usage doesn't already exist */
2731                 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2732                 {
2733                     if (!strcmp(usage->rgpszUsageIdentifier[i],
2734                      pszUsageIdentifier))
2735                         exists = TRUE;
2736                 }
2737                 if (!exists)
2738                 {
2739                     PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2740                      sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2741
2742                     if (newUsage)
2743                     {
2744                         LPSTR nextOID;
2745
2746                         newUsage->rgpszUsageIdentifier = (LPSTR *)
2747                          ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2748                         nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2749                           + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2750                         for (i = 0; i < usage->cUsageIdentifier; i++)
2751                         {
2752                             newUsage->rgpszUsageIdentifier[i] = nextOID;
2753                             strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2754                             nextOID += strlen(nextOID) + 1;
2755                         }
2756                         newUsage->rgpszUsageIdentifier[i] = nextOID;
2757                         strcpy(nextOID, pszUsageIdentifier);
2758                         newUsage->cUsageIdentifier = i + 1;
2759                         ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2760                         CryptMemFree(newUsage);
2761                     }
2762                     else
2763                         ret = FALSE;
2764                 }
2765             }
2766             CryptMemFree(usage);
2767         }
2768         else
2769             ret = FALSE;
2770     }
2771     else
2772     {
2773         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2774          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2775
2776         if (usage)
2777         {
2778             usage->rgpszUsageIdentifier =
2779              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2780             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2781              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2782             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2783             usage->cUsageIdentifier = 1;
2784             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2785             CryptMemFree(usage);
2786         }
2787         else
2788             ret = FALSE;
2789     }
2790     return ret;
2791 }
2792
2793 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2794  LPCSTR pszUsageIdentifier)
2795 {
2796     BOOL ret;
2797     DWORD size;
2798     CERT_ENHKEY_USAGE usage;
2799
2800     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2801
2802     size = sizeof(usage);
2803     ret = CertGetEnhancedKeyUsage(pCertContext,
2804      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2805     if (!ret && GetLastError() == ERROR_MORE_DATA)
2806     {
2807         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2808
2809         if (pUsage)
2810         {
2811             ret = CertGetEnhancedKeyUsage(pCertContext,
2812              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2813             if (ret)
2814             {
2815                 if (pUsage->cUsageIdentifier)
2816                 {
2817                     DWORD i;
2818                     BOOL found = FALSE;
2819
2820                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
2821                     {
2822                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2823                          pszUsageIdentifier))
2824                             found = TRUE;
2825                         if (found && i < pUsage->cUsageIdentifier - 1)
2826                             pUsage->rgpszUsageIdentifier[i] =
2827                              pUsage->rgpszUsageIdentifier[i + 1];
2828                     }
2829                     pUsage->cUsageIdentifier--;
2830                     /* Remove the usage if it's empty */
2831                     if (pUsage->cUsageIdentifier)
2832                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2833                     else
2834                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2835                 }
2836             }
2837             CryptMemFree(pUsage);
2838         }
2839         else
2840             ret = FALSE;
2841     }
2842     else
2843     {
2844         /* it fit in an empty usage, therefore there's nothing to remove */
2845         ret = TRUE;
2846     }
2847     return ret;
2848 }
2849
2850 struct BitField
2851 {
2852     DWORD  cIndexes;
2853     DWORD *indexes;
2854 };
2855
2856 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2857
2858 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2859 {
2860     DWORD indexIndex = bit / BITS_PER_DWORD;
2861
2862     if (indexIndex + 1 > field->cIndexes)
2863     {
2864         if (field->cIndexes)
2865             field->indexes = CryptMemRealloc(field->indexes,
2866              (indexIndex + 1) * sizeof(DWORD));
2867         else
2868             field->indexes = CryptMemAlloc(sizeof(DWORD));
2869         if (field->indexes)
2870         {
2871             field->indexes[indexIndex] = 0;
2872             field->cIndexes = indexIndex + 1;
2873         }
2874     }
2875     if (field->indexes)
2876         field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2877 }
2878
2879 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
2880 {
2881     BOOL set = FALSE;
2882     DWORD indexIndex = bit / BITS_PER_DWORD;
2883
2884     assert(field->cIndexes);
2885     set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2886     return set;
2887 }
2888
2889 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2890  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2891 {
2892     BOOL ret = TRUE;
2893     DWORD i, cbOIDs = 0;
2894     BOOL allUsagesValid = TRUE;
2895     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2896
2897     TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2898      rghOIDs, *pcbOIDs);
2899
2900     for (i = 0; i < cCerts; i++)
2901     {
2902         CERT_ENHKEY_USAGE usage;
2903         DWORD size = sizeof(usage);
2904
2905         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2906         /* Success is deliberately ignored: it implies all usages are valid */
2907         if (!ret && GetLastError() == ERROR_MORE_DATA)
2908         {
2909             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2910
2911             allUsagesValid = FALSE;
2912             if (pUsage)
2913             {
2914                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2915                 if (ret)
2916                 {
2917                     if (!validUsages.cUsageIdentifier)
2918                     {
2919                         DWORD j;
2920
2921                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2922                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2923                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2924                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2925                              + 1;
2926                         validUsages.rgpszUsageIdentifier =
2927                          CryptMemAlloc(cbOIDs);
2928                         if (validUsages.rgpszUsageIdentifier)
2929                         {
2930                             LPSTR nextOID = (LPSTR)
2931                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
2932                              validUsages.cUsageIdentifier * sizeof(LPSTR));
2933
2934                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
2935                             {
2936                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
2937                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2938                                  pUsage->rgpszUsageIdentifier[j]);
2939                                 nextOID += lstrlenA(nextOID) + 1;
2940                             }
2941                         }
2942                     }
2943                     else
2944                     {
2945                         struct BitField validIndexes = { 0, NULL };
2946                         DWORD j, k, numRemoved = 0;
2947
2948                         /* Merge: build a bitmap of all the indexes of
2949                          * validUsages.rgpszUsageIdentifier that are in pUsage.
2950                          */
2951                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
2952                         {
2953                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
2954                             {
2955                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2956                                  validUsages.rgpszUsageIdentifier[k]))
2957                                 {
2958                                     CRYPT_SetBitInField(&validIndexes, k);
2959                                     break;
2960                                 }
2961                             }
2962                         }
2963                         /* Merge by removing from validUsages those that are
2964                          * not in the bitmap.
2965                          */
2966                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2967                         {
2968                             if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2969                             {
2970                                 if (j < validUsages.cUsageIdentifier - 1)
2971                                 {
2972                                     memmove(&validUsages.rgpszUsageIdentifier[j],
2973                                      &validUsages.rgpszUsageIdentifier[j +
2974                                      numRemoved + 1],
2975                                      (validUsages.cUsageIdentifier - numRemoved
2976                                      - j - 1) * sizeof(LPSTR));
2977                                     cbOIDs -= lstrlenA(
2978                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
2979                                      sizeof(LPSTR);
2980                                     validUsages.cUsageIdentifier--;
2981                                     numRemoved++;
2982                                 }
2983                                 else
2984                                     validUsages.cUsageIdentifier--;
2985                             }
2986                         }
2987                         CryptMemFree(validIndexes.indexes);
2988                     }
2989                 }
2990                 CryptMemFree(pUsage);
2991             }
2992         }
2993     }
2994     ret = TRUE;
2995     if (allUsagesValid)
2996     {
2997         *cNumOIDs = -1;
2998         *pcbOIDs = 0;
2999     }
3000     else
3001     {
3002         *cNumOIDs = validUsages.cUsageIdentifier;
3003         if (!rghOIDs)
3004             *pcbOIDs = cbOIDs;
3005         else if (*pcbOIDs < cbOIDs)
3006         {
3007             *pcbOIDs = cbOIDs;
3008             SetLastError(ERROR_MORE_DATA);
3009             ret = FALSE;
3010         }
3011         else
3012         {
3013             LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
3014              validUsages.cUsageIdentifier * sizeof(LPSTR));
3015
3016             *pcbOIDs = cbOIDs;
3017             for (i = 0; i < validUsages.cUsageIdentifier; i++)
3018             {
3019                 rghOIDs[i] = nextOID;
3020                 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
3021                 nextOID += lstrlenA(nextOID) + 1;
3022             }
3023         }
3024     }
3025     CryptMemFree(validUsages.rgpszUsageIdentifier);
3026     TRACE("cNumOIDs: %d\n", *cNumOIDs);
3027     TRACE("returning %d\n", ret);
3028     return ret;
3029 }
3030
3031 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
3032  * pInfo is NULL, from the attributes of hProv.
3033  */
3034 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
3035  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
3036 {
3037     CRYPT_KEY_PROV_INFO info = { 0 };
3038     BOOL ret;
3039
3040     if (!pInfo)
3041     {
3042         DWORD size;
3043         int len;
3044
3045         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
3046         if (ret)
3047         {
3048             LPSTR szContainer = CryptMemAlloc(size);
3049
3050             if (szContainer)
3051             {
3052                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
3053                  (BYTE *)szContainer, &size, 0);
3054                 if (ret)
3055                 {
3056                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3057                      NULL, 0);
3058                     if (len)
3059                     {
3060                         info.pwszContainerName = CryptMemAlloc(len *
3061                          sizeof(WCHAR));
3062                         MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3063                          info.pwszContainerName, len);
3064                     }
3065                 }
3066                 CryptMemFree(szContainer);
3067             }
3068         }
3069         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
3070         if (ret)
3071         {
3072             LPSTR szProvider = CryptMemAlloc(size);
3073
3074             if (szProvider)
3075             {
3076                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
3077                  &size, 0);
3078                 if (ret)
3079                 {
3080                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3081                      NULL, 0);
3082                     if (len)
3083                     {
3084                         info.pwszProvName = CryptMemAlloc(len *
3085                          sizeof(WCHAR));
3086                         MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3087                          info.pwszProvName, len);
3088                     }
3089                 }
3090                 CryptMemFree(szProvider);
3091             }
3092         }
3093         size = sizeof(info.dwKeySpec);
3094         /* in case no CRYPT_KEY_PROV_INFO given,
3095          *  we always use AT_SIGNATURE key spec
3096          */
3097         info.dwKeySpec = AT_SIGNATURE;
3098         size = sizeof(info.dwProvType);
3099         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
3100          &size, 0);
3101         if (!ret)
3102             info.dwProvType = PROV_RSA_FULL;
3103         pInfo = &info;
3104     }
3105
3106     CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
3107      0, pInfo);
3108
3109     if (pInfo == &info)
3110     {
3111         CryptMemFree(info.pwszContainerName);
3112         CryptMemFree(info.pwszProvName);
3113     }
3114 }
3115
3116 /* Creates a signed certificate context from the unsigned, encoded certificate
3117  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
3118  */
3119 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
3120  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
3121 {
3122     PCCERT_CONTEXT context = NULL;
3123     BOOL ret;
3124     DWORD sigSize = 0;
3125
3126     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3127      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
3128     if (ret)
3129     {
3130         LPBYTE sig = CryptMemAlloc(sigSize);
3131
3132         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3133          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
3134         if (ret)
3135         {
3136             CERT_SIGNED_CONTENT_INFO signedInfo;
3137             BYTE *encodedSignedCert = NULL;
3138             DWORD encodedSignedCertSize = 0;
3139
3140             signedInfo.ToBeSigned.cbData = blob->cbData;
3141             signedInfo.ToBeSigned.pbData = blob->pbData;
3142             signedInfo.SignatureAlgorithm = *sigAlgo;
3143             signedInfo.Signature.cbData = sigSize;
3144             signedInfo.Signature.pbData = sig;
3145             signedInfo.Signature.cUnusedBits = 0;
3146             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
3147              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
3148              &encodedSignedCert, &encodedSignedCertSize);
3149             if (ret)
3150             {
3151                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3152                  encodedSignedCert, encodedSignedCertSize);
3153                 LocalFree(encodedSignedCert);
3154             }
3155         }
3156         CryptMemFree(sig);
3157     }
3158     return context;
3159 }
3160
3161 /* Copies data from the parameters into info, where:
3162  * pSerialNumber: The serial number.  Must not be NULL.
3163  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3164  *                     Must not be NULL
3165  * pSignatureAlgorithm: Optional.
3166  * pStartTime: The starting time of the certificate.  If NULL, the current
3167  *             system time is used.
3168  * pEndTime: The ending time of the certificate.  If NULL, one year past the
3169  *           starting time is used.
3170  * pubKey: The public key of the certificate.  Must not be NULL.
3171  * pExtensions: Extensions to be included with the certificate.  Optional.
3172  */
3173 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3174  const CERT_NAME_BLOB *pSubjectIssuerBlob,
3175  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3176  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3177  const CERT_EXTENSIONS *pExtensions)
3178 {
3179     static CHAR oid[] = szOID_RSA_SHA1RSA;
3180
3181     assert(info);
3182     assert(pSerialNumber);
3183     assert(pSubjectIssuerBlob);
3184     assert(pubKey);
3185
3186     if (pExtensions && pExtensions->cExtension)
3187         info->dwVersion = CERT_V3;
3188     else
3189         info->dwVersion = CERT_V1;
3190     info->SerialNumber.cbData = pSerialNumber->cbData;
3191     info->SerialNumber.pbData = pSerialNumber->pbData;
3192     if (pSignatureAlgorithm)
3193         info->SignatureAlgorithm = *pSignatureAlgorithm;
3194     else
3195     {
3196         info->SignatureAlgorithm.pszObjId = oid;
3197         info->SignatureAlgorithm.Parameters.cbData = 0;
3198         info->SignatureAlgorithm.Parameters.pbData = NULL;
3199     }
3200     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3201     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3202     if (pStartTime)
3203         SystemTimeToFileTime(pStartTime, &info->NotBefore);
3204     else
3205         GetSystemTimeAsFileTime(&info->NotBefore);
3206     if (pEndTime)
3207         SystemTimeToFileTime(pEndTime, &info->NotAfter);
3208     else
3209     {
3210         SYSTEMTIME endTime;
3211
3212         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3213         {
3214             endTime.wYear++;
3215             SystemTimeToFileTime(&endTime, &info->NotAfter);
3216         }
3217     }
3218     info->Subject.cbData = pSubjectIssuerBlob->cbData;
3219     info->Subject.pbData = pSubjectIssuerBlob->pbData;
3220     info->SubjectPublicKeyInfo = *pubKey;
3221     if (pExtensions)
3222     {
3223         info->cExtension = pExtensions->cExtension;
3224         info->rgExtension = pExtensions->rgExtension;
3225     }
3226     else
3227     {
3228         info->cExtension = 0;
3229         info->rgExtension = NULL;
3230     }
3231 }
3232
3233 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3234 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3235 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3236
3237 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3238 {
3239     HCRYPTPROV hProv = 0;
3240     HMODULE rpcrt = LoadLibraryA("rpcrt4");
3241
3242     if (rpcrt)
3243     {
3244         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3245          "UuidCreate");
3246         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3247          "UuidToStringA");
3248         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3249          rpcrt, "RpcStringFreeA");
3250
3251         if (uuidCreate && uuidToString && rpcStringFree)
3252         {
3253             UUID uuid;
3254             RPC_STATUS status = uuidCreate(&uuid);
3255
3256             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3257             {
3258                 unsigned char *uuidStr;
3259
3260                 status = uuidToString(&uuid, &uuidStr);
3261                 if (status == RPC_S_OK)
3262                 {
3263                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3264                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3265
3266                     if (ret)
3267                     {
3268                         HCRYPTKEY key;
3269
3270                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3271                         if (ret)
3272                             CryptDestroyKey(key);
3273                     }
3274                     rpcStringFree(&uuidStr);
3275                 }
3276             }
3277         }
3278         FreeLibrary(rpcrt);
3279     }
3280     return hProv;
3281 }
3282
3283 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3284  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3285  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3286  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3287  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3288 {
3289     PCCERT_CONTEXT context = NULL;
3290     BOOL ret, releaseContext = FALSE;
3291     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3292     DWORD pubKeySize = 0, dwKeySpec;
3293
3294     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3295      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3296      pExtensions, pExtensions);
3297
3298     if(!pSubjectIssuerBlob)
3299     {
3300         SetLastError(ERROR_INVALID_PARAMETER);
3301         return NULL;
3302     }
3303
3304     dwKeySpec = pKeyProvInfo ? pKeyProvInfo->dwKeySpec : AT_SIGNATURE;
3305     if (!hProv)
3306     {
3307         if (!pKeyProvInfo)
3308         {
3309             hProv = CRYPT_CreateKeyProv();
3310             releaseContext = TRUE;
3311         }
3312         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3313         {
3314             SetLastError(NTE_BAD_FLAGS);
3315             return NULL;
3316         }
3317         else
3318         {
3319             HCRYPTKEY hKey = 0;
3320             /* acquire the context using the given information*/
3321             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3322                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3323                     pKeyProvInfo->dwFlags);
3324             if (!ret)
3325             {
3326                 if(GetLastError() != NTE_BAD_KEYSET)
3327                     return NULL;
3328                 /* create the key set */
3329                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3330                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3331                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3332                 if (!ret)
3333                     return NULL;
3334             }
3335             /* check if the key is here */
3336             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3337             if(!ret)
3338             {
3339                 if (NTE_NO_KEY == GetLastError())
3340                 { /* generate the key */
3341                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3342                 }
3343                 if (!ret)
3344                 {
3345                     CryptReleaseContext(hProv,0);
3346                     SetLastError(NTE_BAD_KEYSET);
3347                     return NULL;
3348                 }
3349             }
3350             CryptDestroyKey(hKey);
3351             releaseContext = TRUE;
3352         }
3353     }
3354
3355     ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3356      &pubKeySize);
3357     if (!ret)
3358         goto end;
3359     pubKey = CryptMemAlloc(pubKeySize);
3360     if (pubKey)
3361     {
3362         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3363          pubKey, &pubKeySize);
3364         if (ret)
3365         {
3366             CERT_INFO info = { 0 };
3367             CRYPT_DER_BLOB blob = { 0, NULL };
3368             BYTE serial[16];
3369             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3370
3371             CryptGenRandom(hProv, sizeof(serial), serial);
3372             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3373              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3374             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3375              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3376              &blob.cbData);
3377             if (ret)
3378             {
3379                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3380                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3381                      &info.SignatureAlgorithm);
3382                 else
3383                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
3384                      blob.pbData, blob.cbData);
3385                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3386                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3387                 LocalFree(blob.pbData);
3388             }
3389         }
3390         CryptMemFree(pubKey);
3391     }
3392 end:
3393     if (releaseContext)
3394         CryptReleaseContext(hProv, 0);
3395     return context;
3396 }
3397
3398 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3399                                void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3400                                PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3401                                PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3402 {
3403     FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3404           dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3405           pVerifyUsageStatus);
3406     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3407     return FALSE;
3408 }
3409
3410 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3411                                       const BYTE *pbEncoded, DWORD cbEncoded,
3412                                       DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3413 {
3414     TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3415           pbEncoded, cbEncoded, dwFlags, pCreatePara);
3416
3417     if (dwFlags)
3418     {
3419         FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3420         return NULL;
3421     }
3422     if (pCreatePara)
3423     {
3424         FIXME("pCreatePara not handled\n");
3425         return NULL;
3426     }
3427
3428     switch (dwContextType)
3429     {
3430     case CERT_STORE_CERTIFICATE_CONTEXT:
3431         return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3432     case CERT_STORE_CRL_CONTEXT:
3433         return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3434     case CERT_STORE_CTL_CONTEXT:
3435         return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3436     default:
3437         WARN("unknown context type: 0x%x\n", dwContextType);
3438         return NULL;
3439     }
3440 }