dll/win32/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include "crypt32_private.h"
  21
  22 #include <rpc.h>
  23
  24 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  25
  26 /* Internal version of CertGetCertificateContextProperty that gets properties
  27  * directly from the context (or the context it's linked to, depending on its
  28  * type.) Doesn't handle special-case properties, since they are handled by
  29  * CertGetCertificateContextProperty, and are particular to the store in which
  30  * the property exists (which is separate from the context.)
  31  */
  32 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
  33  void *pvData, DWORD *pcbData);
  34
  35 /* Internal version of CertSetCertificateContextProperty that sets properties
  36  * directly on the context (or the context it's linked to, depending on its
  37  * type.) Doesn't handle special cases, since they're handled by
  38  * CertSetCertificateContextProperty anyway.
  39  */
  40 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
  41  DWORD dwFlags, const void *pvData);
  42
  43 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  44  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  45  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  46 {
  47     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  48      pbCertEncoded, cbCertEncoded);
  49     BOOL ret;
  50
  51     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  52      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  53
  54     if (cert)
  55     {
  56         ret = CertAddCertificateContextToStore(hCertStore, cert,
  57          dwAddDisposition, ppCertContext);
  58         CertFreeCertificateContext(cert);
  59     }
  60     else
  61         ret = FALSE;
  62     return ret;
  63 }
  64
  65 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
  66  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  67 {
  68     HCERTSTORE store;
  69     BOOL ret = FALSE;
  70
  71     TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
  72      cbCertEncoded);
  73
  74     store = CertOpenSystemStoreA(0, pszCertStoreName);
  75     if (store)
  76     {
  77         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  78          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  79         CertCloseStore(store, 0);
  80     }
  81     return ret;
  82 }
  83
  84 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
  85  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  86 {
  87     HCERTSTORE store;
  88     BOOL ret = FALSE;
  89
  90     TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
  91      cbCertEncoded);
  92
  93     store = CertOpenSystemStoreW(0, pszCertStoreName);
  94     if (store)
  95     {
  96         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  97          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  98         CertCloseStore(store, 0);
  99     }
 100     return ret;
 101 }
 102
 103 static const context_vtbl_t cert_vtbl;
 104
 105 static void Cert_free(context_t *context)
 106 {
 107     cert_t *cert = (cert_t*)context;
 108
 109     CryptMemFree(cert->ctx.pbCertEncoded);
 110     LocalFree(cert->ctx.pCertInfo);
 111 }
 112
 113 static context_t *Cert_clone(context_t *context, WINECRYPT_CERTSTORE *store, BOOL use_link)
 114 {
 115     cert_t *cert;
 116
 117     if(use_link) {
 118         cert = (cert_t*)Context_CreateLinkContext(sizeof(CERT_CONTEXT), context, store);
 119         if(!cert)
 120             return NULL;
 121     }else {
 122         const cert_t *cloned = (const cert_t*)context;
 123         DWORD size = 0;
 124         BOOL res;
 125
 126         cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, store);
 127         if(!cert)
 128             return NULL;
 129
 130         Context_CopyProperties(&cert->ctx, &cloned->ctx);
 131
 132         cert->ctx.dwCertEncodingType = cloned->ctx.dwCertEncodingType;
 133         cert->ctx.pbCertEncoded = CryptMemAlloc(cloned->ctx.cbCertEncoded);
 134         memcpy(cert->ctx.pbCertEncoded, cloned->ctx.pbCertEncoded, cloned->ctx.cbCertEncoded);
 135         cert->ctx.cbCertEncoded = cloned->ctx.cbCertEncoded;
 136
 137         /* FIXME: We don't need to decode the object here, we could just clone cert info. */
 138         res = CryptDecodeObjectEx(cert->ctx.dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 139          cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 140          &cert->ctx.pCertInfo, &size);
 141         if(!res) {
 142             CertFreeCertificateContext(&cert->ctx);
 143             return NULL;
 144         }
 145     }
 146
 147     cert->ctx.hCertStore = store;
 148     return &cert->base;
 149 }
 150
 151 static const context_vtbl_t cert_vtbl = {
 152     Cert_free,
 153     Cert_clone
 154 };
 155
 156 static BOOL add_cert_to_store(WINECRYPT_CERTSTORE *store, const CERT_CONTEXT *cert,
 157  DWORD add_disposition, BOOL use_link, PCCERT_CONTEXT *ret_context)
 158 {
 159     const CERT_CONTEXT *existing = NULL;
 160     BOOL ret = TRUE, inherit_props = FALSE;
 161     context_t *new_context = NULL;
 162
 163     switch (add_disposition)
 164     {
 165     case CERT_STORE_ADD_ALWAYS:
 166         break;
 167     case CERT_STORE_ADD_NEW:
 168     case CERT_STORE_ADD_REPLACE_EXISTING:
 169     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 170     case CERT_STORE_ADD_USE_EXISTING:
 171     case CERT_STORE_ADD_NEWER:
 172     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 173     {
 174         BYTE hashToAdd[20];
 175         DWORD size = sizeof(hashToAdd);
 176
 177         ret = CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID,
 178          hashToAdd, &size);
 179         if (ret)
 180         {
 181             CRYPT_HASH_BLOB blob = { sizeof(hashToAdd), hashToAdd };
 182
 183             existing = CertFindCertificateInStore(store, cert->dwCertEncodingType, 0,
 184              CERT_FIND_SHA1_HASH, &blob, NULL);
 185         }
 186         break;
 187     }
 188     default:
 189         FIXME("Unimplemented add disposition %d\n", add_disposition);
 190         SetLastError(E_INVALIDARG);
 191         return FALSE;
 192     }
 193
 194     switch (add_disposition)
 195     {
 196     case CERT_STORE_ADD_ALWAYS:
 197         break;
 198     case CERT_STORE_ADD_NEW:
 199         if (existing)
 200         {
 201             TRACE("found matching certificate, not adding\n");
 202             SetLastError(CRYPT_E_EXISTS);
 203             return FALSE;
 204         }
 205         break;
 206     case CERT_STORE_ADD_REPLACE_EXISTING:
 207         break;
 208     case CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES:
 209         if (use_link)
 210             FIXME("CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES: semi-stub for links\n");
 211         if (existing)
 212             inherit_props = TRUE;
 213         break;
 214     case CERT_STORE_ADD_USE_EXISTING:
 215         if(use_link)
 216             FIXME("CERT_STORE_ADD_USE_EXISTING: semi-stub for links\n");
 217         if (existing)
 218         {
 219             Context_CopyProperties(existing, cert);
 220             if (ret_context)
 221                 *ret_context = CertDuplicateCertificateContext(existing);
 222             return TRUE;
 223         }
 224         break;
 225     case CERT_STORE_ADD_NEWER:
 226         if (existing && CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 227         {
 228             TRACE("existing certificate is newer, not adding\n");
 229             SetLastError(CRYPT_E_EXISTS);
 230             return FALSE;
 231         }
 232         break;
 233     case CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES:
 234         if (existing)
 235         {
 236             if (CompareFileTime(&existing->pCertInfo->NotBefore, &cert->pCertInfo->NotBefore) >= 0)
 237             {
 238                 TRACE("existing certificate is newer, not adding\n");
 239                 SetLastError(CRYPT_E_EXISTS);
 240                 return FALSE;
 241             }
 242             inherit_props = TRUE;
 243         }
 244         break;
 245     }
 246
 247     /* FIXME: We have tests that this works, but what should we really do in this case? */
 248     if(!store) {
 249         if(ret_context)
 250             *ret_context = CertDuplicateCertificateContext(cert);
 251         return TRUE;
 252     }
 253
 254     ret = store->vtbl->certs.addContext(store, context_from_ptr(cert), existing ? context_from_ptr(existing) : NULL,
 255      (ret_context || inherit_props) ? &new_context : NULL, use_link);
 256     if(!ret)
 257         return FALSE;
 258
 259     if(inherit_props)
 260         Context_CopyProperties(context_ptr(new_context), existing);
 261
 262     if(ret_context)
 263         *ret_context = context_ptr(new_context);
 264     else if(new_context)
 265         Context_Release(new_context);
 266
 267     TRACE("returning %d\n", ret);
 268     return ret;
 269 }
 270
 271 BOOL WINAPI CertAddCertificateContextToStore(HCERTSTORE hCertStore, PCCERT_CONTEXT pCertContext,
 272  DWORD dwAddDisposition, PCCERT_CONTEXT *ppStoreContext)
 273 {
 274     WINECRYPT_CERTSTORE *store = hCertStore;
 275
 276     TRACE("(%p, %p, %08x, %p)\n", hCertStore, pCertContext, dwAddDisposition, ppStoreContext);
 277
 278     return add_cert_to_store(store, pCertContext, dwAddDisposition, FALSE, ppStoreContext);
 279 }
 280
 281 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
 282  PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
 283  PCCERT_CONTEXT *ppCertContext)
 284 {
 285     static int calls;
 286     WINECRYPT_CERTSTORE *store = (WINECRYPT_CERTSTORE*)hCertStore;
 287
 288     if (!(calls++))
 289         FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore, pCertContext,
 290          dwAddDisposition, ppCertContext);
 291     if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
 292         return FALSE;
 293     if (store->type == StoreTypeCollection)
 294     {
 295         SetLastError(E_INVALIDARG);
 296         return FALSE;
 297     }
 298     return add_cert_to_store(hCertStore, pCertContext, dwAddDisposition, TRUE, ppCertContext);
 299 }
 300
 301 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
 302  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 303 {
 304     cert_t *cert = NULL;
 305     BYTE *data = NULL;
 306     BOOL ret;
 307     PCERT_INFO certInfo = NULL;
 308     DWORD size = 0;
 309
 310     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
 311      cbCertEncoded);
 312
 313     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
 314     {
 315         SetLastError(E_INVALIDARG);
 316         return NULL;
 317     }
 318
 319     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 320      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 321      &certInfo, &size);
 322     if (!ret)
 323         return NULL;
 324
 325     cert = (cert_t*)Context_CreateDataContext(sizeof(CERT_CONTEXT), &cert_vtbl, &empty_store);
 326     if (!cert)
 327         return NULL;
 328     data = CryptMemAlloc(cbCertEncoded);
 329     if (!data)
 330     {
 331         Context_Release(&cert->base);
 332         return NULL;
 333     }
 334
 335     memcpy(data, pbCertEncoded, cbCertEncoded);
 336     cert->ctx.dwCertEncodingType = dwCertEncodingType;
 337     cert->ctx.pbCertEncoded      = data;
 338     cert->ctx.cbCertEncoded      = cbCertEncoded;
 339     cert->ctx.pCertInfo          = certInfo;
 340     cert->ctx.hCertStore         = &empty_store;
 341
 342     return &cert->ctx;
 343 }
 344
 345 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(PCCERT_CONTEXT pCertContext)
 346 {
 347     TRACE("(%p)\n", pCertContext);
 348
 349     if (!pCertContext)
 350         return NULL;
 351
 352     Context_AddRef(&cert_from_ptr(pCertContext)->base);
 353     return pCertContext;
 354 }
 355
 356 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 357 {
 358     TRACE("(%p)\n", pCertContext);
 359
 360     if (pCertContext)
 361         Context_Release(&cert_from_ptr(pCertContext)->base);
 362     return TRUE;
 363 }
 364
 365 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 366  DWORD dwPropId)
 367 {
 368     cert_t *cert = cert_from_ptr(pCertContext);
 369     DWORD ret;
 370
 371     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 372
 373     if (cert->base.properties)
 374         ret = ContextPropertyList_EnumPropIDs(cert->base.properties, dwPropId);
 375     else
 376         ret = 0;
 377     return ret;
 378 }
 379
 380 static BOOL CertContext_GetHashProp(cert_t *cert, DWORD dwPropId,
 381  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 382  DWORD *pcbData)
 383 {
 384     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 385      pcbData);
 386     if (ret && pvData)
 387     {
 388         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 389
 390         ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 391     }
 392     return ret;
 393 }
 394
 395 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 396  DWORD cb)
 397 {
 398     BOOL ret = TRUE;
 399
 400     if (!pvData)
 401         *pcbData = cb;
 402     else if (*pcbData < cb)
 403     {
 404         SetLastError(ERROR_MORE_DATA);
 405         *pcbData = cb;
 406         ret = FALSE;
 407     }
 408     else
 409     {
 410         memcpy(pvData, pb, cb);
 411         *pcbData = cb;
 412     }
 413     return ret;
 414 }
 415
 416 static BOOL CertContext_GetProperty(cert_t *cert, DWORD dwPropId,
 417  void *pvData, DWORD *pcbData)
 418 {
 419     BOOL ret;
 420     CRYPT_DATA_BLOB blob;
 421
 422     TRACE("(%p, %d, %p, %p)\n", cert, dwPropId, pvData, pcbData);
 423
 424     if (cert->base.properties)
 425         ret = ContextPropertyList_FindProperty(cert->base.properties, dwPropId, &blob);
 426     else
 427         ret = FALSE;
 428     if (ret)
 429         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 430     else
 431     {
 432         /* Implicit properties */
 433         switch (dwPropId)
 434         {
 435         case CERT_SHA1_HASH_PROP_ID:
 436             ret = CertContext_GetHashProp(cert, dwPropId, CALG_SHA1,
 437              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 438              pcbData);
 439             break;
 440         case CERT_MD5_HASH_PROP_ID:
 441             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 442              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 443              pcbData);
 444             break;
 445         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 446             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 447              cert->ctx.pCertInfo->Subject.pbData,
 448              cert->ctx.pCertInfo->Subject.cbData,
 449              pvData, pcbData);
 450             break;
 451         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 452             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 453              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 454              cert->ctx.pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 455              pvData, pcbData);
 456             break;
 457         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 458             ret = CertContext_GetHashProp(cert, dwPropId, CALG_MD5,
 459              cert->ctx.pCertInfo->SerialNumber.pbData,
 460              cert->ctx.pCertInfo->SerialNumber.cbData,
 461              pvData, pcbData);
 462             break;
 463         case CERT_SIGNATURE_HASH_PROP_ID:
 464             ret = CryptHashToBeSigned(0, cert->ctx.dwCertEncodingType,
 465              cert->ctx.pbCertEncoded, cert->ctx.cbCertEncoded, pvData,
 466              pcbData);
 467             if (ret && pvData)
 468             {
 469                 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 470
 471                 ret = CertContext_SetProperty(cert, dwPropId, 0, &blob);
 472             }
 473             break;
 474         case CERT_KEY_IDENTIFIER_PROP_ID:
 475         {
 476             PCERT_EXTENSION ext = CertFindExtension(
 477              szOID_SUBJECT_KEY_IDENTIFIER, cert->ctx.pCertInfo->cExtension,
 478              cert->ctx.pCertInfo->rgExtension);
 479
 480             if (ext)
 481             {
 482                 CRYPT_DATA_BLOB value;
 483                 DWORD size = sizeof(value);
 484
 485                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 486                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 487                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 488                  &size);
 489                 if (ret)
 490                 {
 491                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 492                      value.cbData);
 493                     CertContext_SetProperty(cert, dwPropId, 0, &value);
 494                 }
 495             }
 496             else
 497                 SetLastError(ERROR_INVALID_DATA);
 498             break;
 499         }
 500         default:
 501             SetLastError(CRYPT_E_NOT_FOUND);
 502         }
 503     }
 504     TRACE("returning %d\n", ret);
 505     return ret;
 506 }
 507
 508 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
 509 {
 510     DWORD i, containerLen, provNameLen;
 511     LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
 512
 513     info->pwszContainerName = (LPWSTR)data;
 514     containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 515     data += containerLen;
 516
 517     info->pwszProvName = (LPWSTR)data;
 518     provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 519     data += provNameLen;
 520
 521     info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
 522     data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 523
 524     for (i = 0; i < info->cProvParam; i++)
 525     {
 526         info->rgProvParam[i].pbData = data;
 527         data += info->rgProvParam[i].cbData;
 528     }
 529 }
 530
 531 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 532  DWORD dwPropId, void *pvData, DWORD *pcbData)
 533 {
 534     cert_t *cert = cert_from_ptr(pCertContext);
 535     BOOL ret;
 536
 537     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 538
 539     switch (dwPropId)
 540     {
 541     case 0:
 542     case CERT_CERT_PROP_ID:
 543     case CERT_CRL_PROP_ID:
 544     case CERT_CTL_PROP_ID:
 545         SetLastError(E_INVALIDARG);
 546         ret = FALSE;
 547         break;
 548     case CERT_ACCESS_STATE_PROP_ID:
 549         ret = CertGetStoreProperty(cert->ctx.hCertStore, dwPropId, pvData, pcbData);
 550         break;
 551     case CERT_KEY_PROV_HANDLE_PROP_ID:
 552     {
 553         CERT_KEY_CONTEXT keyContext;
 554         DWORD size = sizeof(keyContext);
 555
 556         ret = CertContext_GetProperty(cert,
 557          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 558         if (ret)
 559             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 560              sizeof(keyContext.hCryptProv));
 561         break;
 562     }
 563     case CERT_KEY_PROV_INFO_PROP_ID:
 564         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 565          pcbData);
 566         if (ret && pvData)
 567             CRYPT_FixKeyProvInfoPointers(pvData);
 568         break;
 569     default:
 570         ret = CertContext_GetProperty(cert, dwPropId, pvData,
 571          pcbData);
 572     }
 573
 574     TRACE("returning %d\n", ret);
 575     return ret;
 576 }
 577
 578 /* Copies key provider info from from into to, where to is assumed to be a
 579  * contiguous buffer of memory large enough for from and all its associated
 580  * data, but whose pointers are uninitialized.
 581  * Upon return, to contains a contiguous copy of from, packed in the following
 582  * order:
 583  * - CRYPT_KEY_PROV_INFO
 584  * - pwszContainerName
 585  * - pwszProvName
 586  * - rgProvParam[0]...
 587  */
 588 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
 589  const CRYPT_KEY_PROV_INFO *from)
 590 {
 591     DWORD i;
 592     LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
 593
 594     if (from->pwszContainerName)
 595     {
 596         to->pwszContainerName = (LPWSTR)nextData;
 597         lstrcpyW(to->pwszContainerName, from->pwszContainerName);
 598         nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 599     }
 600     else
 601         to->pwszContainerName = NULL;
 602     if (from->pwszProvName)
 603     {
 604         to->pwszProvName = (LPWSTR)nextData;
 605         lstrcpyW(to->pwszProvName, from->pwszProvName);
 606         nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 607     }
 608     else
 609         to->pwszProvName = NULL;
 610     to->dwProvType = from->dwProvType;
 611     to->dwFlags = from->dwFlags;
 612     to->cProvParam = from->cProvParam;
 613     to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
 614     nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 615     to->dwKeySpec = from->dwKeySpec;
 616     for (i = 0; i < to->cProvParam; i++)
 617     {
 618         memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
 619          sizeof(CRYPT_KEY_PROV_PARAM));
 620         to->rgProvParam[i].pbData = nextData;
 621         memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
 622          from->rgProvParam[i].cbData);
 623         nextData += from->rgProvParam[i].cbData;
 624     }
 625 }
 626
 627 static BOOL CertContext_SetKeyProvInfoProperty(CONTEXT_PROPERTY_LIST *properties,
 628  const CRYPT_KEY_PROV_INFO *info)
 629 {
 630     BOOL ret;
 631     LPBYTE buf = NULL;
 632     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
 633
 634     if (info->pwszContainerName)
 635         containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 636     else
 637         containerSize = 0;
 638     if (info->pwszProvName)
 639         provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 640     else
 641         provNameSize = 0;
 642     size += containerSize + provNameSize;
 643     for (i = 0; i < info->cProvParam; i++)
 644         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 645     buf = CryptMemAlloc(size);
 646     if (buf)
 647     {
 648         CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
 649         ret = ContextPropertyList_SetProperty(properties,
 650          CERT_KEY_PROV_INFO_PROP_ID, buf, size);
 651         CryptMemFree(buf);
 652     }
 653     else
 654         ret = FALSE;
 655     return ret;
 656 }
 657
 658 static BOOL CertContext_SetProperty(cert_t *cert, DWORD dwPropId,
 659  DWORD dwFlags, const void *pvData)
 660 {
 661     BOOL ret;
 662
 663     TRACE("(%p, %d, %08x, %p)\n", cert, dwPropId, dwFlags, pvData);
 664
 665     if (!cert->base.properties)
 666         ret = FALSE;
 667     else
 668     {
 669         switch (dwPropId)
 670         {
 671         case CERT_AUTO_ENROLL_PROP_ID:
 672         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 673         case CERT_DESCRIPTION_PROP_ID:
 674         case CERT_FRIENDLY_NAME_PROP_ID:
 675         case CERT_HASH_PROP_ID:
 676         case CERT_KEY_IDENTIFIER_PROP_ID:
 677         case CERT_MD5_HASH_PROP_ID:
 678         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 679         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 680         case CERT_PVK_FILE_PROP_ID:
 681         case CERT_SIGNATURE_HASH_PROP_ID:
 682         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 683         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 684         case CERT_EXTENDED_ERROR_INFO_PROP_ID:
 685         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 686         case CERT_ENROLLMENT_PROP_ID:
 687         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 688         case CERT_RENEWAL_PROP_ID:
 689         {
 690             if (pvData)
 691             {
 692                 const CRYPT_DATA_BLOB *blob = pvData;
 693
 694                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 695                  blob->pbData, blob->cbData);
 696             }
 697             else
 698             {
 699                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 700                 ret = TRUE;
 701             }
 702             break;
 703         }
 704         case CERT_DATE_STAMP_PROP_ID:
 705             if (pvData)
 706                 ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 707                  pvData, sizeof(FILETIME));
 708             else
 709             {
 710                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 711                 ret = TRUE;
 712             }
 713             break;
 714         case CERT_KEY_CONTEXT_PROP_ID:
 715         {
 716             if (pvData)
 717             {
 718                 const CERT_KEY_CONTEXT *keyContext = pvData;
 719
 720                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 721                 {
 722                     SetLastError(E_INVALIDARG);
 723                     ret = FALSE;
 724                 }
 725                 else
 726                     ret = ContextPropertyList_SetProperty(cert->base.properties, dwPropId,
 727                      (const BYTE *)keyContext, keyContext->cbSize);
 728             }
 729             else
 730             {
 731                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 732                 ret = TRUE;
 733             }
 734             break;
 735         }
 736         case CERT_KEY_PROV_INFO_PROP_ID:
 737             if (pvData)
 738                 ret = CertContext_SetKeyProvInfoProperty(cert->base.properties, pvData);
 739             else
 740             {
 741                 ContextPropertyList_RemoveProperty(cert->base.properties, dwPropId);
 742                 ret = TRUE;
 743             }
 744             break;
 745         case CERT_KEY_PROV_HANDLE_PROP_ID:
 746         {
 747             CERT_KEY_CONTEXT keyContext;
 748             DWORD size = sizeof(keyContext);
 749
 750             ret = CertContext_GetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 751              &keyContext, &size);
 752             if (ret)
 753             {
 754                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 755                     CryptReleaseContext(keyContext.hCryptProv, 0);
 756             }
 757             keyContext.cbSize = sizeof(keyContext);
 758             if (pvData)
 759                 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 760             else
 761             {
 762                 keyContext.hCryptProv = 0;
 763                 keyContext.dwKeySpec = AT_SIGNATURE;
 764             }
 765             ret = CertContext_SetProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
 766              0, &keyContext);
 767             break;
 768         }
 769         default:
 770             FIXME("%d: stub\n", dwPropId);
 771             ret = FALSE;
 772         }
 773     }
 774     TRACE("returning %d\n", ret);
 775     return ret;
 776 }
 777
 778 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 779  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 780 {
 781     BOOL ret;
 782
 783     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 784
 785     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 786      * crashes on most of these, I'll be safer.
 787      */
 788     switch (dwPropId)
 789     {
 790     case 0:
 791     case CERT_ACCESS_STATE_PROP_ID:
 792     case CERT_CERT_PROP_ID:
 793     case CERT_CRL_PROP_ID:
 794     case CERT_CTL_PROP_ID:
 795         SetLastError(E_INVALIDARG);
 796         return FALSE;
 797     }
 798     ret = CertContext_SetProperty(cert_from_ptr(pCertContext), dwPropId, dwFlags,
 799      pvData);
 800     TRACE("returning %d\n", ret);
 801     return ret;
 802 }
 803
 804 /* Acquires the private key using the key provider info, retrieving info from
 805  * the certificate if info is NULL.  The acquired provider is returned in
 806  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 807  */
 808 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
 809  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 810 {
 811     DWORD size = 0;
 812     BOOL allocated = FALSE, ret = TRUE;
 813
 814     if (!info)
 815     {
 816         ret = CertGetCertificateContextProperty(pCert,
 817          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 818         if (ret)
 819         {
 820             info = HeapAlloc(GetProcessHeap(), 0, size);
 821             if (info)
 822             {
 823                 ret = CertGetCertificateContextProperty(pCert,
 824                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 825                 allocated = TRUE;
 826             }
 827             else
 828             {
 829                 SetLastError(ERROR_OUTOFMEMORY);
 830                 ret = FALSE;
 831             }
 832         }
 833         else
 834             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 835     }
 836     if (ret)
 837     {
 838         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 839          info->pwszProvName, info->dwProvType, 0);
 840         if (ret)
 841         {
 842             DWORD i;
 843
 844             for (i = 0; i < info->cProvParam; i++)
 845             {
 846                 CryptSetProvParam(*phCryptProv,
 847                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 848                  info->rgProvParam[i].dwFlags);
 849             }
 850             *pdwKeySpec = info->dwKeySpec;
 851         }
 852         else
 853             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 854     }
 855     if (allocated)
 856         HeapFree(GetProcessHeap(), 0, info);
 857     return ret;
 858 }
 859
 860 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 861  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 862  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 863 {
 864     BOOL ret = FALSE, cache = FALSE;
 865     PCRYPT_KEY_PROV_INFO info = NULL;
 866     CERT_KEY_CONTEXT keyContext;
 867     DWORD size;
 868
 869     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 870      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 871
 872     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 873     {
 874         DWORD size = 0;
 875
 876         ret = CertGetCertificateContextProperty(pCert,
 877          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 878         if (ret)
 879         {
 880             info = HeapAlloc(GetProcessHeap(), 0, size);
 881             ret = CertGetCertificateContextProperty(pCert,
 882              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 883             if (ret)
 884                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 885         }
 886     }
 887     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 888         cache = TRUE;
 889     *phCryptProv = 0;
 890     if (cache)
 891     {
 892         size = sizeof(keyContext);
 893         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 894          &keyContext, &size);
 895         if (ret)
 896         {
 897             *phCryptProv = keyContext.hCryptProv;
 898             if (pdwKeySpec)
 899                 *pdwKeySpec = keyContext.dwKeySpec;
 900             if (pfCallerFreeProv)
 901                 *pfCallerFreeProv = !cache;
 902         }
 903     }
 904     if (!*phCryptProv)
 905     {
 906         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
 907          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 908         if (ret)
 909         {
 910             *phCryptProv = keyContext.hCryptProv;
 911             if (pdwKeySpec)
 912                 *pdwKeySpec = keyContext.dwKeySpec;
 913             if (cache)
 914             {
 915                 keyContext.cbSize = sizeof(keyContext);
 916                 if (CertSetCertificateContextProperty(pCert,
 917                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 918                 {
 919                     if (pfCallerFreeProv)
 920                         *pfCallerFreeProv = FALSE;
 921                 }
 922             }
 923             else
 924             {
 925                 if (pfCallerFreeProv)
 926                     *pfCallerFreeProv = TRUE;
 927             }
 928         }
 929     }
 930     HeapFree(GetProcessHeap(), 0, info);
 931     return ret;
 932 }
 933
 934 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
 935  const CRYPT_KEY_PROV_INFO *keyProvInfo)
 936 {
 937     HCRYPTPROV csp;
 938     BOOL matches = FALSE;
 939
 940     if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
 941      keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
 942     {
 943         DWORD size;
 944
 945         /* Need to sign something to verify the sig.  What to sign?  Why not
 946          * the certificate itself?
 947          */
 948         if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
 949          pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
 950          &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
 951         {
 952             BYTE *certEncoded = CryptMemAlloc(size);
 953
 954             if (certEncoded)
 955             {
 956                 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
 957                  pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 958                  pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
 959                  NULL, certEncoded, &size))
 960                 {
 961                     if (size == pCert->cbCertEncoded &&
 962                      !memcmp(certEncoded, pCert->pbCertEncoded, size))
 963                         matches = TRUE;
 964                 }
 965                 CryptMemFree(certEncoded);
 966             }
 967         }
 968         CryptReleaseContext(csp, 0);
 969     }
 970     return matches;
 971 }
 972
 973 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
 974  CRYPT_KEY_PROV_INFO *keyProvInfo)
 975 {
 976     CRYPT_KEY_PROV_INFO copy;
 977     WCHAR containerW[MAX_PATH];
 978     BOOL matches = FALSE;
 979
 980     MultiByteToWideChar(CP_ACP, 0, container, -1,
 981      containerW, sizeof(containerW) / sizeof(containerW[0]));
 982     /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
 983      * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
 984      * name.
 985      */
 986     copy = *keyProvInfo;
 987     copy.pwszContainerName = containerW;
 988     matches = key_prov_info_matches_cert(pCert, &copy);
 989     if (matches)
 990     {
 991         keyProvInfo->pwszContainerName =
 992          CryptMemAlloc((strlenW(containerW) + 1) * sizeof(WCHAR));
 993         if (keyProvInfo->pwszContainerName)
 994         {
 995             strcpyW(keyProvInfo->pwszContainerName, containerW);
 996             keyProvInfo->dwKeySpec = AT_SIGNATURE;
 997         }
 998         else
 999             matches = FALSE;
1000     }
1001     return matches;
1002 }
1003
1004 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
1005  * private key matches pCert's public key.  Upon success, updates keyProvInfo
1006  * with the matching container's info (free keyProvInfo.pwszContainerName upon
1007  * success.)
1008  * Returns TRUE if found, FALSE if not.
1009  */
1010 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
1011  CRYPT_KEY_PROV_INFO *keyProvInfo)
1012 {
1013     HCRYPTPROV defProvider;
1014     BOOL ret, found = FALSE;
1015     char containerA[MAX_PATH];
1016
1017     assert(keyProvInfo->pwszContainerName == NULL);
1018     if ((ret = CryptAcquireContextW(&defProvider, NULL,
1019      keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
1020      keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
1021     {
1022         DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
1023
1024         while (ret && !found)
1025         {
1026             DWORD size = sizeof(containerA);
1027
1028             ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
1029              (BYTE *)containerA, &size, enumFlags);
1030             if (ret)
1031                 found = container_matches_cert(pCert, containerA, keyProvInfo);
1032             if (enumFlags & CRYPT_FIRST)
1033             {
1034                 enumFlags &= ~CRYPT_FIRST;
1035                 enumFlags |= CRYPT_NEXT;
1036             }
1037         }
1038         CryptReleaseContext(defProvider, 0);
1039     }
1040     return found;
1041 }
1042
1043 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
1044 {
1045     BOOL found = FALSE, ret = TRUE;
1046     DWORD index = 0, cbProvName = 0;
1047     CRYPT_KEY_PROV_INFO keyProvInfo;
1048
1049     TRACE("(%p, %08x)\n", pCert, dwFlags);
1050
1051     memset(&keyProvInfo, 0, sizeof(keyProvInfo));
1052     while (ret && !found)
1053     {
1054         DWORD size = 0;
1055
1056         ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
1057          NULL, &size);
1058         if (ret)
1059         {
1060             if (size <= cbProvName)
1061                 ret = CryptEnumProvidersW(index, NULL, 0,
1062                  &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1063             else
1064             {
1065                 CryptMemFree(keyProvInfo.pwszProvName);
1066                 keyProvInfo.pwszProvName = CryptMemAlloc(size);
1067                 if (keyProvInfo.pwszProvName)
1068                 {
1069                     cbProvName = size;
1070                     ret = CryptEnumProvidersW(index, NULL, 0,
1071                      &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
1072                     if (ret)
1073                     {
1074                         if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
1075                             keyProvInfo.dwFlags |= CRYPT_SILENT;
1076                         if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
1077                          !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1078                          CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1079                         {
1080                             keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
1081                             found = find_key_prov_info_in_provider(pCert,
1082                              &keyProvInfo);
1083                         }
1084                         if (!found)
1085                         {
1086                             if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
1087                              !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
1088                              CRYPT_FIND_MACHINE_KEYSET_FLAG)))
1089                             {
1090                                 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
1091                                 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
1092                                 found = find_key_prov_info_in_provider(pCert,
1093                                  &keyProvInfo);
1094                             }
1095                         }
1096                     }
1097                 }
1098                 else
1099                     ret = FALSE;
1100             }
1101             index++;
1102         }
1103     }
1104     if (found)
1105         CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1106          0, &keyProvInfo);
1107     CryptMemFree(keyProvInfo.pwszProvName);
1108     CryptMemFree(keyProvInfo.pwszContainerName);
1109     return found;
1110 }
1111
1112 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
1113 {
1114     BOOL matches = FALSE;
1115     DWORD size;
1116
1117     if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
1118      NULL, &size))
1119     {
1120         CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
1121
1122         if (keyProvInfo)
1123         {
1124             if (CertGetCertificateContextProperty(pCert,
1125              CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
1126                 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
1127             CryptMemFree(keyProvInfo);
1128         }
1129     }
1130     return matches;
1131 }
1132
1133 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
1134  DWORD dwFlags, void *pvReserved)
1135 {
1136     BOOL matches = FALSE;
1137
1138     TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
1139
1140     matches = cert_prov_info_matches_cert(pCert);
1141     if (!matches)
1142         matches = find_matching_provider(pCert, dwFlags);
1143     return matches;
1144 }
1145
1146 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1147  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1148 {
1149     BOOL ret;
1150
1151     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1152
1153     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1154      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1155      &pCertId2->SerialNumber);
1156     TRACE("returning %d\n", ret);
1157     return ret;
1158 }
1159
1160 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1161  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1162 {
1163     BOOL ret;
1164
1165     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1166
1167     if (pCertName1->cbData == pCertName2->cbData)
1168     {
1169         if (pCertName1->cbData)
1170             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1171              pCertName1->cbData);
1172         else
1173             ret = TRUE;
1174     }
1175     else
1176         ret = FALSE;
1177     TRACE("returning %d\n", ret);
1178     return ret;
1179 }
1180
1181 /* Returns the number of significant bytes in pInt, where a byte is
1182  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1183  * for negative numbers.  pInt is assumed to be little-endian.
1184  */
1185 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1186 {
1187     DWORD ret = pInt->cbData;
1188
1189     while (ret > 1)
1190     {
1191         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1192             ret--;
1193         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1194             ret--;
1195         else
1196             break;
1197     }
1198     return ret;
1199 }
1200
1201 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1202  PCRYPT_INTEGER_BLOB pInt2)
1203 {
1204     BOOL ret;
1205     DWORD cb1, cb2;
1206
1207     TRACE("(%p, %p)\n", pInt1, pInt2);
1208
1209     cb1 = CRYPT_significantBytes(pInt1);
1210     cb2 = CRYPT_significantBytes(pInt2);
1211     if (cb1 == cb2)
1212     {
1213         if (cb1)
1214             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1215         else
1216             ret = TRUE;
1217     }
1218     else
1219         ret = FALSE;
1220     TRACE("returning %d\n", ret);
1221     return ret;
1222 }
1223
1224 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1225  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1226 {
1227     BOOL ret;
1228
1229     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1230
1231     switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1232     {
1233     case 0:     /* Seems to mean "raw binary bits" */
1234         if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1235          pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1236         {
1237           if (pPublicKey2->PublicKey.cbData)
1238               ret = !memcmp(pPublicKey1->PublicKey.pbData,
1239                pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1240           else
1241               ret = TRUE;
1242         }
1243         else
1244             ret = FALSE;
1245         break;
1246     default:
1247         WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1248         /* FALLTHROUGH */
1249     case X509_ASN_ENCODING:
1250     {
1251         BLOBHEADER *pblob1, *pblob2;
1252         DWORD length;
1253         ret = FALSE;
1254         if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1255                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1256                     0, NULL, &length))
1257         {
1258             pblob1 = CryptMemAlloc(length);
1259             if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1260                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1261                     0, pblob1, &length))
1262             {
1263                 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1264                             pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1265                             0, NULL, &length))
1266                 {
1267                     pblob2 = CryptMemAlloc(length);
1268                     if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1269                             pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1270                             0, pblob2, &length))
1271                     {
1272                         /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1273                         RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1274                                   *pk2 = (LPVOID)(pblob2 + 1);
1275                         ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1276                                  && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1277                     }
1278                     CryptMemFree(pblob2);
1279                 }
1280             }
1281             CryptMemFree(pblob1);
1282         }
1283
1284         break;
1285     }
1286     }
1287     return ret;
1288 }
1289
1290 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1291  PCERT_PUBLIC_KEY_INFO pPublicKey)
1292 {
1293     DWORD len = 0;
1294
1295     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1296
1297     if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1298     {
1299         SetLastError(ERROR_FILE_NOT_FOUND);
1300         return 0;
1301     }
1302     if (pPublicKey->Algorithm.pszObjId &&
1303      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1304     {
1305         FIXME("unimplemented for DH public keys\n");
1306         SetLastError(CRYPT_E_ASN1_BADTAG);
1307     }
1308     else
1309     {
1310         DWORD size;
1311         PBYTE buf;
1312         BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
1313          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1314          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1315          &size);
1316
1317         if (ret)
1318         {
1319             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1320
1321             len = rsaPubKey->bitlen;
1322             LocalFree(buf);
1323         }
1324     }
1325     return len;
1326 }
1327
1328 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1329  DWORD dwFlags, const void *pvPara);
1330
1331 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1332  DWORD dwFlags, const void *pvPara)
1333 {
1334     BOOL ret;
1335     BYTE hash[16];
1336     DWORD size = sizeof(hash);
1337
1338     ret = CertGetCertificateContextProperty(pCertContext,
1339      CERT_MD5_HASH_PROP_ID, hash, &size);
1340     if (ret)
1341     {
1342         const CRYPT_HASH_BLOB *pHash = pvPara;
1343
1344         if (size == pHash->cbData)
1345             ret = !memcmp(pHash->pbData, hash, size);
1346         else
1347             ret = FALSE;
1348     }
1349     return ret;
1350 }
1351
1352 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1353  DWORD dwFlags, const void *pvPara)
1354 {
1355     BOOL ret;
1356     BYTE hash[20];
1357     DWORD size = sizeof(hash);
1358
1359     ret = CertGetCertificateContextProperty(pCertContext,
1360      CERT_SHA1_HASH_PROP_ID, hash, &size);
1361     if (ret)
1362     {
1363         const CRYPT_HASH_BLOB *pHash = pvPara;
1364
1365         if (size == pHash->cbData)
1366             ret = !memcmp(pHash->pbData, hash, size);
1367         else
1368             ret = FALSE;
1369     }
1370     return ret;
1371 }
1372
1373 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1374  DWORD dwFlags, const void *pvPara)
1375 {
1376     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1377     BOOL ret;
1378
1379     if (dwType & CERT_INFO_SUBJECT_FLAG)
1380         toCompare = &pCertContext->pCertInfo->Subject;
1381     else
1382         toCompare = &pCertContext->pCertInfo->Issuer;
1383     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1384      toCompare, blob);
1385     return ret;
1386 }
1387
1388 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1389  DWORD dwType, DWORD dwFlags, const void *pvPara)
1390 {
1391     CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1392     BOOL ret;
1393
1394     ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1395      &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1396     return ret;
1397 }
1398
1399 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1400  DWORD dwType, DWORD dwFlags, const void *pvPara)
1401 {
1402     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1403     BOOL ret;
1404
1405     /* Matching serial number and subject match.. */
1406     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1407      &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1408     if (ret)
1409         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1410          &pCertInfo->SerialNumber);
1411     else
1412     {
1413         /* failing that, if the serial number and issuer match, we match */
1414         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1415          &pCertInfo->SerialNumber);
1416         if (ret)
1417             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1418              &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1419     }
1420     TRACE("returning %d\n", ret);
1421     return ret;
1422 }
1423
1424 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1425  DWORD dwFlags, const void *pvPara)
1426 {
1427     CERT_ID *id = (CERT_ID *)pvPara;
1428     BOOL ret;
1429
1430     switch (id->dwIdChoice)
1431     {
1432     case CERT_ID_ISSUER_SERIAL_NUMBER:
1433         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1434          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1435         if (ret)
1436             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1437              &id->u.IssuerSerialNumber.SerialNumber);
1438         break;
1439     case CERT_ID_SHA1_HASH:
1440         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1441          &id->u.HashId);
1442         break;
1443     case CERT_ID_KEY_IDENTIFIER:
1444     {
1445         DWORD size = 0;
1446
1447         ret = CertGetCertificateContextProperty(pCertContext,
1448          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1449         if (ret && size == id->u.KeyId.cbData)
1450         {
1451             LPBYTE buf = CryptMemAlloc(size);
1452
1453             if (buf)
1454             {
1455                 CertGetCertificateContextProperty(pCertContext,
1456                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1457                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1458                 CryptMemFree(buf);
1459             }
1460             else
1461                 ret = FALSE;
1462         }
1463         else
1464             ret = FALSE;
1465         break;
1466     }
1467     default:
1468         ret = FALSE;
1469         break;
1470     }
1471     return ret;
1472 }
1473
1474 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1475  DWORD dwFlags, const void *pvPara)
1476 {
1477     PCCERT_CONTEXT toCompare = pvPara;
1478     return CertCompareCertificate(pCertContext->dwCertEncodingType,
1479      pCertContext->pCertInfo, toCompare->pCertInfo);
1480 }
1481
1482 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1483  DWORD dwFlags, const void *pvPara)
1484 {
1485     const CRYPT_HASH_BLOB *hash = pvPara;
1486     DWORD size = 0;
1487     BOOL ret;
1488
1489     ret = CertGetCertificateContextProperty(pCertContext,
1490      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1491     if (ret && size == hash->cbData)
1492     {
1493         LPBYTE buf = CryptMemAlloc(size);
1494
1495         if (buf)
1496         {
1497             CertGetCertificateContextProperty(pCertContext,
1498              CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1499             ret = !memcmp(buf, hash->pbData, size);
1500             CryptMemFree(buf);
1501         }
1502         else
1503             ret = FALSE;
1504     }
1505     else
1506         ret = FALSE;
1507     return ret;
1508 }
1509
1510 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1511  PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1512  const void *pvPara)
1513 {
1514     BOOL matches = FALSE;
1515     PCCERT_CONTEXT ret;
1516
1517     ret = prev;
1518     do {
1519         ret = CertEnumCertificatesInStore(store, ret);
1520         if (ret)
1521             matches = compare(ret, dwType, dwFlags, pvPara);
1522     } while (ret != NULL && !matches);
1523     return ret;
1524 }
1525
1526 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1527  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1528
1529 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1530  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1531 {
1532     return CertEnumCertificatesInStore(store, prev);
1533 }
1534
1535 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1536  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1537 {
1538     BOOL ret;
1539     PCCERT_CONTEXT found = NULL, subject = pvPara;
1540     PCERT_EXTENSION ext;
1541     DWORD size;
1542
1543     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1544      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1545     {
1546         CERT_AUTHORITY_KEY_ID_INFO *info;
1547
1548         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1549          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1550          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1551          &info, &size);
1552         if (ret)
1553         {
1554             CERT_ID id;
1555
1556             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1557             {
1558                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1559                 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1560                  sizeof(CERT_NAME_BLOB));
1561                 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1562                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1563             }
1564             else if (info->KeyId.cbData)
1565             {
1566                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1567                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1568             }
1569             else
1570                 ret = FALSE;
1571             if (ret)
1572                 found = cert_compare_certs_in_store(store, prev,
1573                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1574             LocalFree(info);
1575         }
1576     }
1577     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1578      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1579     {
1580         CERT_AUTHORITY_KEY_ID2_INFO *info;
1581
1582         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1583          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1584          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1585          &info, &size);
1586         if (ret)
1587         {
1588             CERT_ID id;
1589
1590             if (info->AuthorityCertIssuer.cAltEntry &&
1591              info->AuthorityCertSerialNumber.cbData)
1592             {
1593                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1594                 DWORD i;
1595
1596                 for (i = 0; !directoryName &&
1597                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1598                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1599                      == CERT_ALT_NAME_DIRECTORY_NAME)
1600                         directoryName =
1601                          &info->AuthorityCertIssuer.rgAltEntry[i];
1602                 if (directoryName)
1603                 {
1604                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1605                     memcpy(&id.u.IssuerSerialNumber.Issuer,
1606                      &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1607                     memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1608                      &info->AuthorityCertSerialNumber,
1609                      sizeof(CRYPT_INTEGER_BLOB));
1610                 }
1611                 else
1612                 {
1613                     FIXME("no supported name type in authority key id2\n");
1614                     ret = FALSE;
1615                 }
1616             }
1617             else if (info->KeyId.cbData)
1618             {
1619                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1620                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1621             }
1622             else
1623                 ret = FALSE;
1624             if (ret)
1625                 found = cert_compare_certs_in_store(store, prev,
1626                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1627             LocalFree(info);
1628         }
1629     }
1630     else
1631        found = cert_compare_certs_in_store(store, prev,
1632         compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1633         dwFlags, &subject->pCertInfo->Issuer);
1634     return found;
1635 }
1636
1637 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1638  DWORD dwType, DWORD dwFlags, const void *pvPara)
1639 {
1640     PCERT_NAME_BLOB name;
1641     DWORD len;
1642     BOOL ret = FALSE;
1643
1644     if (dwType & CERT_INFO_SUBJECT_FLAG)
1645         name = &pCertContext->pCertInfo->Subject;
1646     else
1647         name = &pCertContext->pCertInfo->Issuer;
1648     len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1649      CERT_SIMPLE_NAME_STR, NULL, 0);
1650     if (len)
1651     {
1652         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1653
1654         if (str)
1655         {
1656             LPWSTR ptr;
1657
1658             CertNameToStrW(pCertContext->dwCertEncodingType, name,
1659              CERT_SIMPLE_NAME_STR, str, len);
1660             for (ptr = str; *ptr; ptr++)
1661                 *ptr = tolowerW(*ptr);
1662             if (strstrW(str, pvPara))
1663                 ret = TRUE;
1664             CryptMemFree(str);
1665         }
1666     }
1667     return ret;
1668 }
1669
1670 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1671  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1672 {
1673     PCCERT_CONTEXT found = NULL;
1674
1675     TRACE("%s\n", debugstr_a(pvPara));
1676
1677     if (pvPara)
1678     {
1679         int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1680         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1681
1682         if (str)
1683         {
1684             LPWSTR ptr;
1685
1686             MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1687             for (ptr = str; *ptr; ptr++)
1688                 *ptr = tolowerW(*ptr);
1689             found = cert_compare_certs_in_store(store, prev,
1690              compare_cert_by_name_str, dwType, dwFlags, str);
1691             CryptMemFree(str);
1692         }
1693     }
1694     else
1695         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1696     return found;
1697 }
1698
1699 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1700  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1701 {
1702     PCCERT_CONTEXT found = NULL;
1703
1704     TRACE("%s\n", debugstr_w(pvPara));
1705
1706     if (pvPara)
1707     {
1708         DWORD len = strlenW(pvPara);
1709         LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1710
1711         if (str)
1712         {
1713             LPCWSTR src;
1714             LPWSTR dst;
1715
1716             for (src = pvPara, dst = str; *src; src++, dst++)
1717                 *dst = tolowerW(*src);
1718             *dst = 0;
1719            found = cert_compare_certs_in_store(store, prev,
1720             compare_cert_by_name_str, dwType, dwFlags, str);
1721            CryptMemFree(str);
1722         }
1723     }
1724     else
1725         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1726     return found;
1727 }
1728
1729 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1730  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1731  PCCERT_CONTEXT pPrevCertContext)
1732 {
1733     PCCERT_CONTEXT ret;
1734     CertFindFunc find = NULL;
1735     CertCompareFunc compare = NULL;
1736
1737     TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1738          dwFlags, dwType, pvPara, pPrevCertContext);
1739
1740     switch (dwType >> CERT_COMPARE_SHIFT)
1741     {
1742     case CERT_COMPARE_ANY:
1743         find = find_cert_any;
1744         break;
1745     case CERT_COMPARE_MD5_HASH:
1746         compare = compare_cert_by_md5_hash;
1747         break;
1748     case CERT_COMPARE_SHA1_HASH:
1749         compare = compare_cert_by_sha1_hash;
1750         break;
1751     case CERT_COMPARE_NAME:
1752         compare = compare_cert_by_name;
1753         break;
1754     case CERT_COMPARE_PUBLIC_KEY:
1755         compare = compare_cert_by_public_key;
1756         break;
1757     case CERT_COMPARE_NAME_STR_A:
1758         find = find_cert_by_name_str_a;
1759         break;
1760     case CERT_COMPARE_NAME_STR_W:
1761         find = find_cert_by_name_str_w;
1762         break;
1763     case CERT_COMPARE_SUBJECT_CERT:
1764         compare = compare_cert_by_subject_cert;
1765         break;
1766     case CERT_COMPARE_CERT_ID:
1767         compare = compare_cert_by_cert_id;
1768         break;
1769     case CERT_COMPARE_ISSUER_OF:
1770         find = find_cert_by_issuer;
1771         break;
1772     case CERT_COMPARE_EXISTING:
1773         compare = compare_existing_cert;
1774         break;
1775     case CERT_COMPARE_SIGNATURE_HASH:
1776         compare = compare_cert_by_signature_hash;
1777         break;
1778     default:
1779         FIXME("find type %08x unimplemented\n", dwType);
1780     }
1781
1782     if (find)
1783         ret = find(hCertStore, dwFlags, dwType, pvPara, pPrevCertContext);
1784     else if (compare)
1785         ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1786          compare, dwType, dwFlags, pvPara);
1787     else
1788         ret = NULL;
1789     if (!ret)
1790         SetLastError(CRYPT_E_NOT_FOUND);
1791     TRACE("returning %p\n", ret);
1792     return ret;
1793 }
1794
1795 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1796  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1797 {
1798     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1799
1800     if (!pCertId)
1801     {
1802         SetLastError(E_INVALIDARG);
1803         return NULL;
1804     }
1805     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1806      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1807 }
1808
1809 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1810  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1811 {
1812     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1813      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1814
1815     if (*pdwFlags & ~supportedFlags)
1816     {
1817         SetLastError(E_INVALIDARG);
1818         return FALSE;
1819     }
1820     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1821     {
1822         DWORD flags = 0;
1823         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1824          NULL, &flags);
1825
1826         /* FIXME: what if the CRL has expired? */
1827         if (crl)
1828         {
1829             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1830              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1831                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1832         }
1833         else
1834             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1835     }
1836     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1837     {
1838         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1839             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1840     }
1841     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1842     {
1843         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1844          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1845          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1846             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1847     }
1848     return TRUE;
1849 }
1850
1851 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1852  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1853  DWORD *pdwFlags)
1854 {
1855     PCCERT_CONTEXT ret;
1856
1857     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1858      pPrevIssuerContext, *pdwFlags);
1859
1860     if (!pSubjectContext)
1861     {
1862         SetLastError(E_INVALIDARG);
1863         return NULL;
1864     }
1865
1866     ret = CertFindCertificateInStore(hCertStore,
1867      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1868      pSubjectContext, pPrevIssuerContext);
1869     if (ret)
1870     {
1871         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1872          pdwFlags))
1873         {
1874             CertFreeCertificateContext(ret);
1875             ret = NULL;
1876         }
1877     }
1878     TRACE("returning %p\n", ret);
1879     return ret;
1880 }
1881
1882 typedef struct _OLD_CERT_REVOCATION_STATUS {
1883     DWORD cbSize;
1884     DWORD dwIndex;
1885     DWORD dwError;
1886     DWORD dwReason;
1887 } OLD_CERT_REVOCATION_STATUS;
1888
1889 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1890  void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1891
1892 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1893  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1894  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1895 {
1896     BOOL ret;
1897
1898     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1899      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1900
1901     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1902      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1903     {
1904         SetLastError(E_INVALIDARG);
1905         return FALSE;
1906     }
1907     if (cContext)
1908     {
1909         static HCRYPTOIDFUNCSET set = NULL;
1910         DWORD size;
1911
1912         if (!set)
1913             set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1914         ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1915         if (ret)
1916         {
1917             if (size == 1)
1918             {
1919                 /* empty list */
1920                 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1921                 ret = FALSE;
1922             }
1923             else
1924             {
1925                 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1926
1927                 if (dllList)
1928                 {
1929                     ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1930                      dllList, &size);
1931                     if (ret)
1932                     {
1933                         for (ptr = dllList; ret && *ptr;
1934                          ptr += lstrlenW(ptr) + 1)
1935                         {
1936                             CertVerifyRevocationFunc func;
1937                             HCRYPTOIDFUNCADDR hFunc;
1938
1939                             ret = CryptGetDefaultOIDFunctionAddress(set,
1940                              dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1941                             if (ret)
1942                             {
1943                                 ret = func(dwEncodingType, dwRevType, cContext,
1944                                  rgpvContext, dwFlags, pRevPara, pRevStatus);
1945                                 CryptFreeOIDFunctionAddress(hFunc, 0);
1946                             }
1947                         }
1948                     }
1949                     CryptMemFree(dllList);
1950                 }
1951                 else
1952                 {
1953                     SetLastError(ERROR_OUTOFMEMORY);
1954                     ret = FALSE;
1955                 }
1956             }
1957         }
1958     }
1959     else
1960         ret = TRUE;
1961     return ret;
1962 }
1963
1964 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1965  CRYPT_ATTRIBUTE rgAttr[])
1966 {
1967     PCRYPT_ATTRIBUTE ret = NULL;
1968     DWORD i;
1969
1970     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1971
1972     if (!cAttr)
1973         return NULL;
1974     if (!pszObjId)
1975     {
1976         SetLastError(ERROR_INVALID_PARAMETER);
1977         return NULL;
1978     }
1979
1980     for (i = 0; !ret && i < cAttr; i++)
1981         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1982             ret = &rgAttr[i];
1983     return ret;
1984 }
1985
1986 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1987  CERT_EXTENSION rgExtensions[])
1988 {
1989     PCERT_EXTENSION ret = NULL;
1990     DWORD i;
1991
1992     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1993
1994     if (!cExtensions)
1995         return NULL;
1996     if (!pszObjId)
1997     {
1998         SetLastError(ERROR_INVALID_PARAMETER);
1999         return NULL;
2000     }
2001
2002     for (i = 0; !ret && i < cExtensions; i++)
2003         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
2004          rgExtensions[i].pszObjId))
2005             ret = &rgExtensions[i];
2006     return ret;
2007 }
2008
2009 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
2010 {
2011     PCERT_RDN_ATTR ret = NULL;
2012     DWORD i, j;
2013
2014     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
2015
2016     if (!pszObjId)
2017     {
2018         SetLastError(ERROR_INVALID_PARAMETER);
2019         return NULL;
2020     }
2021
2022     for (i = 0; !ret && i < pName->cRDN; i++)
2023         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
2024             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
2025              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
2026                 ret = &pName->rgRDN[i].rgRDNAttr[j];
2027     return ret;
2028 }
2029
2030 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
2031  const CERT_RDN_ATTR *attr)
2032 {
2033     DWORD i, j;
2034     BOOL match = FALSE;
2035
2036     for (i = 0; !match && i < name->cRDN; i++)
2037     {
2038         for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
2039         {
2040             if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
2041              attr->pszObjId) &&
2042              name->rgRDN[i].rgRDNAttr[j].dwValueType ==
2043              attr->dwValueType)
2044             {
2045                 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
2046                 {
2047                     LPCWSTR nameStr =
2048                      (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2049                     LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
2050
2051                     if (attr->Value.cbData !=
2052                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2053                         match = FALSE;
2054                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2055                         match = !strncmpiW(nameStr, attrStr,
2056                          attr->Value.cbData / sizeof(WCHAR));
2057                     else
2058                         match = !strncmpW(nameStr, attrStr,
2059                          attr->Value.cbData / sizeof(WCHAR));
2060                     TRACE("%s : %s => %d\n",
2061                      debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
2062                      debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
2063                      match);
2064                 }
2065                 else
2066                 {
2067                     LPCSTR nameStr =
2068                      (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
2069                     LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
2070
2071                     if (attr->Value.cbData !=
2072                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
2073                         match = FALSE;
2074                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
2075                         match = !strncasecmp(nameStr, attrStr,
2076                          attr->Value.cbData);
2077                     else
2078                         match = !strncmp(nameStr, attrStr, attr->Value.cbData);
2079                     TRACE("%s : %s => %d\n",
2080                      debugstr_an(nameStr, attr->Value.cbData),
2081                      debugstr_an(attrStr, attr->Value.cbData), match);
2082                 }
2083             }
2084         }
2085     }
2086     return match;
2087 }
2088
2089 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
2090  DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
2091 {
2092     CERT_NAME_INFO *name;
2093     LPCSTR type;
2094     DWORD size;
2095     BOOL ret;
2096
2097     TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
2098      pRDN);
2099
2100     type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
2101      X509_NAME;
2102     if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
2103      pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
2104     {
2105         DWORD i;
2106
2107         for (i = 0; ret && i < pRDN->cRDNAttr; i++)
2108             ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
2109         if (!ret)
2110             SetLastError(CRYPT_E_NO_MATCH);
2111         LocalFree(name);
2112     }
2113     return ret;
2114 }
2115
2116 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
2117  PCERT_INFO pCertInfo)
2118 {
2119     FILETIME fileTime;
2120     LONG ret;
2121
2122     if (!pTimeToVerify)
2123     {
2124         GetSystemTimeAsFileTime(&fileTime);
2125         pTimeToVerify = &fileTime;
2126     }
2127     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
2128     {
2129         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
2130         if (ret < 0)
2131             ret = 0;
2132     }
2133     return ret;
2134 }
2135
2136 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
2137  PCERT_INFO pIssuerInfo)
2138 {
2139     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
2140
2141     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
2142      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
2143 }
2144
2145 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2146  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
2147  DWORD *pcbComputedHash)
2148 {
2149     BOOL ret = TRUE;
2150     HCRYPTHASH hHash = 0;
2151
2152     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
2153      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2154
2155     if (!hCryptProv)
2156         hCryptProv = CRYPT_GetDefaultProvider();
2157     if (!Algid)
2158         Algid = CALG_SHA1;
2159     if (ret)
2160     {
2161         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2162         if (ret)
2163         {
2164             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2165             if (ret)
2166                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2167                  pcbComputedHash, 0);
2168             CryptDestroyHash(hHash);
2169         }
2170     }
2171     return ret;
2172 }
2173
2174 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2175  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2176  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2177 {
2178     BOOL ret = TRUE;
2179     HCRYPTHASH hHash = 0;
2180
2181     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2182      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2183
2184     if (!hCryptProv)
2185         hCryptProv = CRYPT_GetDefaultProvider();
2186     if (!Algid)
2187         Algid = CALG_MD5;
2188     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2189     {
2190         SetLastError(ERROR_FILE_NOT_FOUND);
2191         return FALSE;
2192     }
2193     if (ret)
2194     {
2195         BYTE *buf;
2196         DWORD size = 0;
2197
2198         ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2199          X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2200          (LPBYTE)&buf, &size);
2201         if (ret)
2202         {
2203             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2204             if (ret)
2205             {
2206                 ret = CryptHashData(hHash, buf, size, 0);
2207                 if (ret)
2208                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2209                      pcbComputedHash, 0);
2210                 CryptDestroyHash(hHash);
2211             }
2212             LocalFree(buf);
2213         }
2214     }
2215     return ret;
2216 }
2217
2218 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2219  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2220  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2221 {
2222     BOOL ret;
2223     CERT_SIGNED_CONTENT_INFO *info;
2224     DWORD size;
2225
2226     TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2227      pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2228
2229     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2230      pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2231     if (ret)
2232     {
2233         PCCRYPT_OID_INFO oidInfo;
2234         HCRYPTHASH hHash;
2235
2236         if (!hCryptProv)
2237             hCryptProv = CRYPT_GetDefaultProvider();
2238         oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2239          info->SignatureAlgorithm.pszObjId, 0);
2240         if (!oidInfo)
2241         {
2242             SetLastError(NTE_BAD_ALGID);
2243             ret = FALSE;
2244         }
2245         else
2246         {
2247             ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2248             if (ret)
2249             {
2250                 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2251                  info->ToBeSigned.cbData, 0);
2252                 if (ret)
2253                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2254                      pcbComputedHash, 0);
2255                 CryptDestroyHash(hHash);
2256             }
2257         }
2258         LocalFree(info);
2259     }
2260     return ret;
2261 }
2262
2263 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2264  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2265  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2266  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2267 {
2268     BOOL ret;
2269     PCCRYPT_OID_INFO info;
2270     HCRYPTHASH hHash;
2271
2272     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2273      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2274      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2275
2276     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2277      pSignatureAlgorithm->pszObjId, 0);
2278     if (!info)
2279     {
2280         SetLastError(NTE_BAD_ALGID);
2281         return FALSE;
2282     }
2283     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2284     {
2285         if (!hCryptProv)
2286             hCryptProv = CRYPT_GetDefaultProvider();
2287         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2288         if (ret)
2289         {
2290             ret = CryptHashData(hHash, pbEncodedToBeSigned,
2291              cbEncodedToBeSigned, 0);
2292             if (ret)
2293                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2294                  pcbSignature, 0);
2295             CryptDestroyHash(hHash);
2296         }
2297     }
2298     else
2299     {
2300         if (!hCryptProv)
2301         {
2302             SetLastError(ERROR_INVALID_PARAMETER);
2303             ret = FALSE;
2304         }
2305         else
2306         {
2307             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2308             if (ret)
2309             {
2310                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2311                  cbEncodedToBeSigned, 0);
2312                 if (ret)
2313                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2314                      pcbSignature);
2315                 CryptDestroyHash(hHash);
2316             }
2317         }
2318     }
2319     return ret;
2320 }
2321
2322 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2323  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2324  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2325  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2326 {
2327     BOOL ret;
2328     DWORD encodedSize, hashSize;
2329
2330     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2331      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2332      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2333
2334     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2335      NULL, &encodedSize);
2336     if (ret)
2337     {
2338         PBYTE encoded = CryptMemAlloc(encodedSize);
2339
2340         if (encoded)
2341         {
2342             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2343              pvStructInfo, encoded, &encodedSize);
2344             if (ret)
2345             {
2346                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2347                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2348                  pvHashAuxInfo, NULL, &hashSize);
2349                 if (ret)
2350                 {
2351                     PBYTE hash = CryptMemAlloc(hashSize);
2352
2353                     if (hash)
2354                     {
2355                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2356                          dwCertEncodingType, encoded, encodedSize,
2357                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2358                         if (ret)
2359                         {
2360                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2361
2362                             info.ToBeSigned.cbData = encodedSize;
2363                             info.ToBeSigned.pbData = encoded;
2364                             info.SignatureAlgorithm = *pSignatureAlgorithm;
2365                             info.Signature.cbData = hashSize;
2366                             info.Signature.pbData = hash;
2367                             info.Signature.cUnusedBits = 0;
2368                             ret = CryptEncodeObject(dwCertEncodingType,
2369                              X509_CERT, &info, pbEncoded, pcbEncoded);
2370                         }
2371                         CryptMemFree(hash);
2372                     }
2373                     else
2374                         ret = FALSE;
2375                 }
2376             }
2377             CryptMemFree(encoded);
2378         }
2379         else
2380             ret = FALSE;
2381     }
2382     return ret;
2383 }
2384
2385 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2386  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2387  PCERT_PUBLIC_KEY_INFO pPublicKey)
2388 {
2389     CRYPT_DATA_BLOB blob = { cbEncoded, (BYTE *)pbEncoded };
2390
2391     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2392      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &blob,
2393      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2394 }
2395
2396 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
2397  DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
2398  const CERT_SIGNED_CONTENT_INFO *signedCert)
2399 {
2400     BOOL ret;
2401     HCRYPTKEY key;
2402     PCCRYPT_OID_INFO info;
2403     ALG_ID pubKeyID, hashID;
2404
2405     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2406      signedCert->SignatureAlgorithm.pszObjId, 0);
2407     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2408     {
2409         SetLastError(NTE_BAD_ALGID);
2410         return FALSE;
2411     }
2412     hashID = info->u.Algid;
2413     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2414         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2415     else
2416         pubKeyID = hashID;
2417     /* Load the default provider if necessary */
2418     if (!hCryptProv)
2419         hCryptProv = CRYPT_GetDefaultProvider();
2420     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2421      pubKeyInfo, pubKeyID, 0, NULL, &key);
2422     if (ret)
2423     {
2424         HCRYPTHASH hash;
2425
2426         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2427         if (ret)
2428         {
2429             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2430              signedCert->ToBeSigned.cbData, 0);
2431             if (ret)
2432                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2433                  signedCert->Signature.cbData, key, NULL, 0);
2434             CryptDestroyHash(hash);
2435         }
2436         CryptDestroyKey(key);
2437     }
2438     return ret;
2439 }
2440
2441 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2442  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2443  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2444 {
2445     BOOL ret = TRUE;
2446     CRYPT_DATA_BLOB subjectBlob;
2447
2448     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2449      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2450      dwFlags, pvReserved);
2451
2452     switch (dwSubjectType)
2453     {
2454     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2455     {
2456         PCRYPT_DATA_BLOB blob = pvSubject;
2457
2458         subjectBlob.pbData = blob->pbData;
2459         subjectBlob.cbData = blob->cbData;
2460         break;
2461     }
2462     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2463     {
2464         PCERT_CONTEXT context = pvSubject;
2465
2466         subjectBlob.pbData = context->pbCertEncoded;
2467         subjectBlob.cbData = context->cbCertEncoded;
2468         break;
2469     }
2470     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2471     {
2472         PCRL_CONTEXT context = pvSubject;
2473
2474         subjectBlob.pbData = context->pbCrlEncoded;
2475         subjectBlob.cbData = context->cbCrlEncoded;
2476         break;
2477     }
2478     default:
2479         SetLastError(E_INVALIDARG);
2480         ret = FALSE;
2481     }
2482
2483     if (ret)
2484     {
2485         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2486         DWORD size = 0;
2487
2488         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2489          subjectBlob.pbData, subjectBlob.cbData,
2490          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2491          &signedCert, &size);
2492         if (ret)
2493         {
2494             switch (dwIssuerType)
2495             {
2496             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2497                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2498                  dwCertEncodingType, pvIssuer,
2499                  signedCert);
2500                 break;
2501             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2502                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2503                  dwCertEncodingType,
2504                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2505                  signedCert);
2506                 break;
2507             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2508                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2509                 ret = FALSE;
2510                 break;
2511             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2512                 if (pvIssuer)
2513                 {
2514                     SetLastError(E_INVALIDARG);
2515                     ret = FALSE;
2516                 }
2517                 else
2518                 {
2519                     FIXME("unimplemented for NULL signer\n");
2520                     SetLastError(E_INVALIDARG);
2521                     ret = FALSE;
2522                 }
2523                 break;
2524             default:
2525                 SetLastError(E_INVALIDARG);
2526                 ret = FALSE;
2527             }
2528             LocalFree(signedCert);
2529         }
2530     }
2531     return ret;
2532 }
2533
2534 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2535  PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2536 {
2537     PCERT_EXTENSION ext;
2538     BOOL ret = FALSE;
2539
2540     TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2541      cbKeyUsage);
2542
2543     ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2544      pCertInfo->rgExtension);
2545     if (ext)
2546     {
2547         CRYPT_BIT_BLOB usage;
2548         DWORD size = sizeof(usage);
2549
2550         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2551          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2552          &usage, &size);
2553         if (ret)
2554         {
2555             if (cbKeyUsage < usage.cbData)
2556                 ret = FALSE;
2557             else
2558             {
2559                 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2560                 if (cbKeyUsage > usage.cbData)
2561                     memset(pbKeyUsage + usage.cbData, 0,
2562                      cbKeyUsage - usage.cbData);
2563             }
2564         }
2565     }
2566     else
2567         SetLastError(0);
2568     return ret;
2569 }
2570
2571 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2572  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2573 {
2574     PCERT_ENHKEY_USAGE usage = NULL;
2575     DWORD bytesNeeded;
2576     BOOL ret = TRUE;
2577
2578     if (!pCertContext || !pcbUsage)
2579     {
2580         SetLastError(ERROR_INVALID_PARAMETER);
2581         return FALSE;
2582     }
2583
2584     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2585
2586     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2587     {
2588         DWORD propSize = 0;
2589
2590         if (CertGetCertificateContextProperty(pCertContext,
2591          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2592         {
2593             LPBYTE buf = CryptMemAlloc(propSize);
2594
2595             if (buf)
2596             {
2597                 if (CertGetCertificateContextProperty(pCertContext,
2598                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2599                 {
2600                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2601                      X509_ENHANCED_KEY_USAGE, buf, propSize,
2602                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2603                 }
2604                 CryptMemFree(buf);
2605             }
2606         }
2607     }
2608     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2609     {
2610         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2611          pCertContext->pCertInfo->cExtension,
2612          pCertContext->pCertInfo->rgExtension);
2613
2614         if (ext)
2615         {
2616             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2617              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
2618              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2619         }
2620     }
2621     if (!usage)
2622     {
2623         /* If a particular location is specified, this should fail.  Otherwise
2624          * it should succeed with an empty usage.  (This is true on Win2k and
2625          * later, which we emulate.)
2626          */
2627         if (dwFlags)
2628         {
2629             SetLastError(CRYPT_E_NOT_FOUND);
2630             ret = FALSE;
2631         }
2632         else
2633             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
2634     }
2635
2636     if (ret)
2637     {
2638         if (!pUsage)
2639             *pcbUsage = bytesNeeded;
2640         else if (*pcbUsage < bytesNeeded)
2641         {
2642             SetLastError(ERROR_MORE_DATA);
2643             *pcbUsage = bytesNeeded;
2644             ret = FALSE;
2645         }
2646         else
2647         {
2648             *pcbUsage = bytesNeeded;
2649             if (usage)
2650             {
2651                 DWORD i;
2652                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
2653                  sizeof(CERT_ENHKEY_USAGE) +
2654                  usage->cUsageIdentifier * sizeof(LPSTR));
2655
2656                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
2657                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
2658                  sizeof(CERT_ENHKEY_USAGE));
2659                 for (i = 0; i < usage->cUsageIdentifier; i++)
2660                 {
2661                     pUsage->rgpszUsageIdentifier[i] = nextOID;
2662                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2663                     nextOID += strlen(nextOID) + 1;
2664                 }
2665             }
2666             else
2667                 pUsage->cUsageIdentifier = 0;
2668         }
2669     }
2670     if (usage)
2671         LocalFree(usage);
2672     TRACE("returning %d\n", ret);
2673     return ret;
2674 }
2675
2676 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
2677  PCERT_ENHKEY_USAGE pUsage)
2678 {
2679     BOOL ret;
2680
2681     TRACE("(%p, %p)\n", pCertContext, pUsage);
2682
2683     if (pUsage)
2684     {
2685         CRYPT_DATA_BLOB blob = { 0, NULL };
2686
2687         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2688          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2689         if (ret)
2690         {
2691             ret = CertSetCertificateContextProperty(pCertContext,
2692              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2693             LocalFree(blob.pbData);
2694         }
2695     }
2696     else
2697         ret = CertSetCertificateContextProperty(pCertContext,
2698          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2699     return ret;
2700 }
2701
2702 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2703  LPCSTR pszUsageIdentifier)
2704 {
2705     BOOL ret;
2706     DWORD size;
2707
2708     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2709
2710     if (CertGetEnhancedKeyUsage(pCertContext,
2711      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2712     {
2713         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2714
2715         if (usage)
2716         {
2717             ret = CertGetEnhancedKeyUsage(pCertContext,
2718              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2719             if (ret)
2720             {
2721                 DWORD i;
2722                 BOOL exists = FALSE;
2723
2724                 /* Make sure usage doesn't already exist */
2725                 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2726                 {
2727                     if (!strcmp(usage->rgpszUsageIdentifier[i],
2728                      pszUsageIdentifier))
2729                         exists = TRUE;
2730                 }
2731                 if (!exists)
2732                 {
2733                     PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2734                      sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2735
2736                     if (newUsage)
2737                     {
2738                         LPSTR nextOID;
2739
2740                         newUsage->rgpszUsageIdentifier = (LPSTR *)
2741                          ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2742                         nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2743                           + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2744                         for (i = 0; i < usage->cUsageIdentifier; i++)
2745                         {
2746                             newUsage->rgpszUsageIdentifier[i] = nextOID;
2747                             strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2748                             nextOID += strlen(nextOID) + 1;
2749                         }
2750                         newUsage->rgpszUsageIdentifier[i] = nextOID;
2751                         strcpy(nextOID, pszUsageIdentifier);
2752                         newUsage->cUsageIdentifier = i + 1;
2753                         ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2754                         CryptMemFree(newUsage);
2755                     }
2756                     else
2757                         ret = FALSE;
2758                 }
2759             }
2760             CryptMemFree(usage);
2761         }
2762         else
2763             ret = FALSE;
2764     }
2765     else
2766     {
2767         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2768          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2769
2770         if (usage)
2771         {
2772             usage->rgpszUsageIdentifier =
2773              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2774             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2775              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2776             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2777             usage->cUsageIdentifier = 1;
2778             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2779             CryptMemFree(usage);
2780         }
2781         else
2782             ret = FALSE;
2783     }
2784     return ret;
2785 }
2786
2787 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2788  LPCSTR pszUsageIdentifier)
2789 {
2790     BOOL ret;
2791     DWORD size;
2792     CERT_ENHKEY_USAGE usage;
2793
2794     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2795
2796     size = sizeof(usage);
2797     ret = CertGetEnhancedKeyUsage(pCertContext,
2798      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2799     if (!ret && GetLastError() == ERROR_MORE_DATA)
2800     {
2801         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2802
2803         if (pUsage)
2804         {
2805             ret = CertGetEnhancedKeyUsage(pCertContext,
2806              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2807             if (ret)
2808             {
2809                 if (pUsage->cUsageIdentifier)
2810                 {
2811                     DWORD i;
2812                     BOOL found = FALSE;
2813
2814                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
2815                     {
2816                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2817                          pszUsageIdentifier))
2818                             found = TRUE;
2819                         if (found && i < pUsage->cUsageIdentifier - 1)
2820                             pUsage->rgpszUsageIdentifier[i] =
2821                              pUsage->rgpszUsageIdentifier[i + 1];
2822                     }
2823                     pUsage->cUsageIdentifier--;
2824                     /* Remove the usage if it's empty */
2825                     if (pUsage->cUsageIdentifier)
2826                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2827                     else
2828                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2829                 }
2830             }
2831             CryptMemFree(pUsage);
2832         }
2833         else
2834             ret = FALSE;
2835     }
2836     else
2837     {
2838         /* it fit in an empty usage, therefore there's nothing to remove */
2839         ret = TRUE;
2840     }
2841     return ret;
2842 }
2843
2844 struct BitField
2845 {
2846     DWORD  cIndexes;
2847     DWORD *indexes;
2848 };
2849
2850 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2851
2852 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2853 {
2854     DWORD indexIndex = bit / BITS_PER_DWORD;
2855
2856     if (indexIndex + 1 > field->cIndexes)
2857     {
2858         if (field->cIndexes)
2859             field->indexes = CryptMemRealloc(field->indexes,
2860              (indexIndex + 1) * sizeof(DWORD));
2861         else
2862             field->indexes = CryptMemAlloc(sizeof(DWORD));
2863         if (field->indexes)
2864         {
2865             field->indexes[indexIndex] = 0;
2866             field->cIndexes = indexIndex + 1;
2867         }
2868     }
2869     if (field->indexes)
2870         field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2871 }
2872
2873 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
2874 {
2875     BOOL set = FALSE;
2876     DWORD indexIndex = bit / BITS_PER_DWORD;
2877
2878     assert(field->cIndexes);
2879     set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2880     return set;
2881 }
2882
2883 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2884  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2885 {
2886     BOOL ret = TRUE;
2887     DWORD i, cbOIDs = 0;
2888     BOOL allUsagesValid = TRUE;
2889     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2890
2891     TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2892      rghOIDs, *pcbOIDs);
2893
2894     for (i = 0; i < cCerts; i++)
2895     {
2896         CERT_ENHKEY_USAGE usage;
2897         DWORD size = sizeof(usage);
2898
2899         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2900         /* Success is deliberately ignored: it implies all usages are valid */
2901         if (!ret && GetLastError() == ERROR_MORE_DATA)
2902         {
2903             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2904
2905             allUsagesValid = FALSE;
2906             if (pUsage)
2907             {
2908                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2909                 if (ret)
2910                 {
2911                     if (!validUsages.cUsageIdentifier)
2912                     {
2913                         DWORD j;
2914
2915                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2916                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2917                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2918                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2919                              + 1;
2920                         validUsages.rgpszUsageIdentifier =
2921                          CryptMemAlloc(cbOIDs);
2922                         if (validUsages.rgpszUsageIdentifier)
2923                         {
2924                             LPSTR nextOID = (LPSTR)
2925                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
2926                              validUsages.cUsageIdentifier * sizeof(LPSTR));
2927
2928                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
2929                             {
2930                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
2931                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2932                                  pUsage->rgpszUsageIdentifier[j]);
2933                                 nextOID += lstrlenA(nextOID) + 1;
2934                             }
2935                         }
2936                     }
2937                     else
2938                     {
2939                         struct BitField validIndexes = { 0, NULL };
2940                         DWORD j, k, numRemoved = 0;
2941
2942                         /* Merge: build a bitmap of all the indexes of
2943                          * validUsages.rgpszUsageIdentifier that are in pUsage.
2944                          */
2945                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
2946                         {
2947                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
2948                             {
2949                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2950                                  validUsages.rgpszUsageIdentifier[k]))
2951                                 {
2952                                     CRYPT_SetBitInField(&validIndexes, k);
2953                                     break;
2954                                 }
2955                             }
2956                         }
2957                         /* Merge by removing from validUsages those that are
2958                          * not in the bitmap.
2959                          */
2960                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2961                         {
2962                             if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2963                             {
2964                                 if (j < validUsages.cUsageIdentifier - 1)
2965                                 {
2966                                     memmove(&validUsages.rgpszUsageIdentifier[j],
2967                                      &validUsages.rgpszUsageIdentifier[j +
2968                                      numRemoved + 1],
2969                                      (validUsages.cUsageIdentifier - numRemoved
2970                                      - j - 1) * sizeof(LPSTR));
2971                                     cbOIDs -= lstrlenA(
2972                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
2973                                      sizeof(LPSTR);
2974                                     validUsages.cUsageIdentifier--;
2975                                     numRemoved++;
2976                                 }
2977                                 else
2978                                     validUsages.cUsageIdentifier--;
2979                             }
2980                         }
2981                         CryptMemFree(validIndexes.indexes);
2982                     }
2983                 }
2984                 CryptMemFree(pUsage);
2985             }
2986         }
2987     }
2988     ret = TRUE;
2989     if (allUsagesValid)
2990     {
2991         *cNumOIDs = -1;
2992         *pcbOIDs = 0;
2993     }
2994     else
2995     {
2996         *cNumOIDs = validUsages.cUsageIdentifier;
2997         if (!rghOIDs)
2998             *pcbOIDs = cbOIDs;
2999         else if (*pcbOIDs < cbOIDs)
3000         {
3001             *pcbOIDs = cbOIDs;
3002             SetLastError(ERROR_MORE_DATA);
3003             ret = FALSE;
3004         }
3005         else
3006         {
3007             LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
3008              validUsages.cUsageIdentifier * sizeof(LPSTR));
3009
3010             *pcbOIDs = cbOIDs;
3011             for (i = 0; i < validUsages.cUsageIdentifier; i++)
3012             {
3013                 rghOIDs[i] = nextOID;
3014                 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
3015                 nextOID += lstrlenA(nextOID) + 1;
3016             }
3017         }
3018     }
3019     CryptMemFree(validUsages.rgpszUsageIdentifier);
3020     TRACE("cNumOIDs: %d\n", *cNumOIDs);
3021     TRACE("returning %d\n", ret);
3022     return ret;
3023 }
3024
3025 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
3026  * pInfo is NULL, from the attributes of hProv.
3027  */
3028 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
3029  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
3030 {
3031     CRYPT_KEY_PROV_INFO info = { 0 };
3032     BOOL ret;
3033
3034     if (!pInfo)
3035     {
3036         DWORD size;
3037         int len;
3038
3039         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
3040         if (ret)
3041         {
3042             LPSTR szContainer = CryptMemAlloc(size);
3043
3044             if (szContainer)
3045             {
3046                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
3047                  (BYTE *)szContainer, &size, 0);
3048                 if (ret)
3049                 {
3050                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3051                      NULL, 0);
3052                     if (len)
3053                     {
3054                         info.pwszContainerName = CryptMemAlloc(len *
3055                          sizeof(WCHAR));
3056                         MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
3057                          info.pwszContainerName, len);
3058                     }
3059                 }
3060                 CryptMemFree(szContainer);
3061             }
3062         }
3063         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
3064         if (ret)
3065         {
3066             LPSTR szProvider = CryptMemAlloc(size);
3067
3068             if (szProvider)
3069             {
3070                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
3071                  &size, 0);
3072                 if (ret)
3073                 {
3074                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3075                      NULL, 0);
3076                     if (len)
3077                     {
3078                         info.pwszProvName = CryptMemAlloc(len *
3079                          sizeof(WCHAR));
3080                         MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
3081                          info.pwszProvName, len);
3082                     }
3083                 }
3084                 CryptMemFree(szProvider);
3085             }
3086         }
3087         size = sizeof(info.dwKeySpec);
3088         /* in case no CRYPT_KEY_PROV_INFO given,
3089          *  we always use AT_SIGNATURE key spec
3090          */
3091         info.dwKeySpec = AT_SIGNATURE;
3092         size = sizeof(info.dwProvType);
3093         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
3094          &size, 0);
3095         if (!ret)
3096             info.dwProvType = PROV_RSA_FULL;
3097         pInfo = &info;
3098     }
3099
3100     CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
3101      0, pInfo);
3102
3103     if (pInfo == &info)
3104     {
3105         CryptMemFree(info.pwszContainerName);
3106         CryptMemFree(info.pwszProvName);
3107     }
3108 }
3109
3110 /* Creates a signed certificate context from the unsigned, encoded certificate
3111  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
3112  */
3113 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
3114  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
3115 {
3116     PCCERT_CONTEXT context = NULL;
3117     BOOL ret;
3118     DWORD sigSize = 0;
3119
3120     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3121      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
3122     if (ret)
3123     {
3124         LPBYTE sig = CryptMemAlloc(sigSize);
3125
3126         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
3127          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
3128         if (ret)
3129         {
3130             CERT_SIGNED_CONTENT_INFO signedInfo;
3131             BYTE *encodedSignedCert = NULL;
3132             DWORD encodedSignedCertSize = 0;
3133
3134             signedInfo.ToBeSigned.cbData = blob->cbData;
3135             signedInfo.ToBeSigned.pbData = blob->pbData;
3136             signedInfo.SignatureAlgorithm = *sigAlgo;
3137             signedInfo.Signature.cbData = sigSize;
3138             signedInfo.Signature.pbData = sig;
3139             signedInfo.Signature.cUnusedBits = 0;
3140             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
3141              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
3142              &encodedSignedCert, &encodedSignedCertSize);
3143             if (ret)
3144             {
3145                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
3146                  encodedSignedCert, encodedSignedCertSize);
3147                 LocalFree(encodedSignedCert);
3148             }
3149         }
3150         CryptMemFree(sig);
3151     }
3152     return context;
3153 }
3154
3155 /* Copies data from the parameters into info, where:
3156  * pSerialNumber: The serial number.  Must not be NULL.
3157  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3158  *                     Must not be NULL
3159  * pSignatureAlgorithm: Optional.
3160  * pStartTime: The starting time of the certificate.  If NULL, the current
3161  *             system time is used.
3162  * pEndTime: The ending time of the certificate.  If NULL, one year past the
3163  *           starting time is used.
3164  * pubKey: The public key of the certificate.  Must not be NULL.
3165  * pExtensions: Extensions to be included with the certificate.  Optional.
3166  */
3167 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3168  const CERT_NAME_BLOB *pSubjectIssuerBlob,
3169  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3170  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3171  const CERT_EXTENSIONS *pExtensions)
3172 {
3173     static CHAR oid[] = szOID_RSA_SHA1RSA;
3174
3175     assert(info);
3176     assert(pSerialNumber);
3177     assert(pSubjectIssuerBlob);
3178     assert(pubKey);
3179
3180     if (pExtensions && pExtensions->cExtension)
3181         info->dwVersion = CERT_V3;
3182     else
3183         info->dwVersion = CERT_V1;
3184     info->SerialNumber.cbData = pSerialNumber->cbData;
3185     info->SerialNumber.pbData = pSerialNumber->pbData;
3186     if (pSignatureAlgorithm)
3187         info->SignatureAlgorithm = *pSignatureAlgorithm;
3188     else
3189     {
3190         info->SignatureAlgorithm.pszObjId = oid;
3191         info->SignatureAlgorithm.Parameters.cbData = 0;
3192         info->SignatureAlgorithm.Parameters.pbData = NULL;
3193     }
3194     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3195     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3196     if (pStartTime)
3197         SystemTimeToFileTime(pStartTime, &info->NotBefore);
3198     else
3199         GetSystemTimeAsFileTime(&info->NotBefore);
3200     if (pEndTime)
3201         SystemTimeToFileTime(pEndTime, &info->NotAfter);
3202     else
3203     {
3204         SYSTEMTIME endTime;
3205
3206         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3207         {
3208             endTime.wYear++;
3209             SystemTimeToFileTime(&endTime, &info->NotAfter);
3210         }
3211     }
3212     info->Subject.cbData = pSubjectIssuerBlob->cbData;
3213     info->Subject.pbData = pSubjectIssuerBlob->pbData;
3214     info->SubjectPublicKeyInfo = *pubKey;
3215     if (pExtensions)
3216     {
3217         info->cExtension = pExtensions->cExtension;
3218         info->rgExtension = pExtensions->rgExtension;
3219     }
3220     else
3221     {
3222         info->cExtension = 0;
3223         info->rgExtension = NULL;
3224     }
3225 }
3226
3227 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3228 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3229 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3230
3231 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3232 {
3233     HCRYPTPROV hProv = 0;
3234     HMODULE rpcrt = LoadLibraryA("rpcrt4");
3235
3236     if (rpcrt)
3237     {
3238         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3239          "UuidCreate");
3240         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3241          "UuidToStringA");
3242         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3243          rpcrt, "RpcStringFreeA");
3244
3245         if (uuidCreate && uuidToString && rpcStringFree)
3246         {
3247             UUID uuid;
3248             RPC_STATUS status = uuidCreate(&uuid);
3249
3250             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3251             {
3252                 unsigned char *uuidStr;
3253
3254                 status = uuidToString(&uuid, &uuidStr);
3255                 if (status == RPC_S_OK)
3256                 {
3257                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3258                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3259
3260                     if (ret)
3261                     {
3262                         HCRYPTKEY key;
3263
3264                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3265                         if (ret)
3266                             CryptDestroyKey(key);
3267                     }
3268                     rpcStringFree(&uuidStr);
3269                 }
3270             }
3271         }
3272         FreeLibrary(rpcrt);
3273     }
3274     return hProv;
3275 }
3276
3277 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3278  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3279  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3280  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3281  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3282 {
3283     PCCERT_CONTEXT context = NULL;
3284     BOOL ret, releaseContext = FALSE;
3285     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3286     DWORD pubKeySize = 0, dwKeySpec;
3287
3288     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3289      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3290      pExtensions, pExtensions);
3291
3292     if(!pSubjectIssuerBlob)
3293     {
3294         SetLastError(ERROR_INVALID_PARAMETER);
3295         return NULL;
3296     }
3297
3298     dwKeySpec = pKeyProvInfo ? pKeyProvInfo->dwKeySpec : AT_SIGNATURE;
3299     if (!hProv)
3300     {
3301         if (!pKeyProvInfo)
3302         {
3303             hProv = CRYPT_CreateKeyProv();
3304             releaseContext = TRUE;
3305         }
3306         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3307         {
3308             SetLastError(NTE_BAD_FLAGS);
3309             return NULL;
3310         }
3311         else
3312         {
3313             HCRYPTKEY hKey = 0;
3314             /* acquire the context using the given information*/
3315             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3316                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3317                     pKeyProvInfo->dwFlags);
3318             if (!ret)
3319             {
3320                 if(GetLastError() != NTE_BAD_KEYSET)
3321                     return NULL;
3322                 /* create the key set */
3323                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3324                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3325                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3326                 if (!ret)
3327                     return NULL;
3328             }
3329             /* check if the key is here */
3330             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3331             if(!ret)
3332             {
3333                 if (NTE_NO_KEY == GetLastError())
3334                 { /* generate the key */
3335                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3336                 }
3337                 if (!ret)
3338                 {
3339                     CryptReleaseContext(hProv,0);
3340                     SetLastError(NTE_BAD_KEYSET);
3341                     return NULL;
3342                 }
3343             }
3344             CryptDestroyKey(hKey);
3345             releaseContext = TRUE;
3346         }
3347     }
3348
3349     ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3350      &pubKeySize);
3351     if (!ret)
3352         goto end;
3353     pubKey = CryptMemAlloc(pubKeySize);
3354     if (pubKey)
3355     {
3356         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3357          pubKey, &pubKeySize);
3358         if (ret)
3359         {
3360             CERT_INFO info = { 0 };
3361             CRYPT_DER_BLOB blob = { 0, NULL };
3362             BYTE serial[16];
3363             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3364
3365             CryptGenRandom(hProv, sizeof(serial), serial);
3366             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3367              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3368             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3369              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3370              &blob.cbData);
3371             if (ret)
3372             {
3373                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3374                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3375                      &info.SignatureAlgorithm);
3376                 else
3377                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
3378                      blob.pbData, blob.cbData);
3379                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3380                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3381                 LocalFree(blob.pbData);
3382             }
3383         }
3384         CryptMemFree(pubKey);
3385     }
3386 end:
3387     if (releaseContext)
3388         CryptReleaseContext(hProv, 0);
3389     return context;
3390 }
3391
3392 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3393                                void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3394                                PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3395                                PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3396 {
3397     FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3398           dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3399           pVerifyUsageStatus);
3400     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3401     return FALSE;
3402 }
3403
3404 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3405                                       const BYTE *pbEncoded, DWORD cbEncoded,
3406                                       DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3407 {
3408     TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3409           pbEncoded, cbEncoded, dwFlags, pCreatePara);
3410
3411     if (dwFlags)
3412     {
3413         FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3414         return NULL;
3415     }
3416     if (pCreatePara)
3417     {
3418         FIXME("pCreatePara not handled\n");
3419         return NULL;
3420     }
3421
3422     switch (dwContextType)
3423     {
3424     case CERT_STORE_CERTIFICATE_CONTEXT:
3425         return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3426     case CERT_STORE_CRL_CONTEXT:
3427         return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3428     case CERT_STORE_CTL_CONTEXT:
3429         return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3430     default:
3431         WARN("unknown context type: 0x%x\n", dwContextType);
3432         return NULL;
3433     }
3434 }