dll/win32/crypt32/crl.c

   1 /*
   2  * Copyright 2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22 #define NONAMELESSUNION
  23 #include "windef.h"
  24 #include "winbase.h"
  25 #include "wincrypt.h"
  26 #include "wine/debug.h"
  27 #include "wine/unicode.h"
  28 #include "crypt32_private.h"
  29
  30 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  31
  32 PCCRL_CONTEXT WINAPI CertCreateCRLContext(DWORD dwCertEncodingType,
  33  const BYTE* pbCrlEncoded, DWORD cbCrlEncoded)
  34 {
  35     PCRL_CONTEXT crl = NULL;
  36     BOOL ret;
  37     PCRL_INFO crlInfo = NULL;
  38     DWORD size = 0;
  39
  40     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCrlEncoded,
  41      cbCrlEncoded);
  42
  43     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
  44     {
  45         SetLastError(E_INVALIDARG);
  46         return NULL;
  47     }
  48     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_CRL_TO_BE_SIGNED,
  49      pbCrlEncoded, cbCrlEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
  50      &crlInfo, &size);
  51     if (ret)
  52     {
  53         BYTE *data = NULL;
  54
  55         crl = Context_CreateDataContext(sizeof(CRL_CONTEXT));
  56         if (!crl)
  57             goto end;
  58         data = CryptMemAlloc(cbCrlEncoded);
  59         if (!data)
  60         {
  61             CryptMemFree(crl);
  62             crl = NULL;
  63             goto end;
  64         }
  65         memcpy(data, pbCrlEncoded, cbCrlEncoded);
  66         crl->dwCertEncodingType = dwCertEncodingType;
  67         crl->pbCrlEncoded       = data;
  68         crl->cbCrlEncoded       = cbCrlEncoded;
  69         crl->pCrlInfo           = crlInfo;
  70         crl->hCertStore         = 0;
  71     }
  72
  73 end:
  74     return crl;
  75 }
  76
  77 BOOL WINAPI CertAddEncodedCRLToStore(HCERTSTORE hCertStore,
  78  DWORD dwCertEncodingType, const BYTE *pbCrlEncoded, DWORD cbCrlEncoded,
  79  DWORD dwAddDisposition, PCCRL_CONTEXT *ppCrlContext)
  80 {
  81     PCCRL_CONTEXT crl = CertCreateCRLContext(dwCertEncodingType,
  82      pbCrlEncoded, cbCrlEncoded);
  83     BOOL ret;
  84
  85     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  86      pbCrlEncoded, cbCrlEncoded, dwAddDisposition, ppCrlContext);
  87
  88     if (crl)
  89     {
  90         ret = CertAddCRLContextToStore(hCertStore, crl, dwAddDisposition,
  91          ppCrlContext);
  92         CertFreeCRLContext(crl);
  93     }
  94     else
  95         ret = FALSE;
  96     return ret;
  97 }
  98
  99 typedef BOOL (*CrlCompareFunc)(PCCRL_CONTEXT pCrlContext, DWORD dwType,
 100  DWORD dwFlags, const void *pvPara);
 101
 102 static BOOL compare_crl_any(PCCRL_CONTEXT pCrlContext, DWORD dwType,
 103  DWORD dwFlags, const void *pvPara)
 104 {
 105     return TRUE;
 106 }
 107
 108 static BOOL compare_crl_issued_by(PCCRL_CONTEXT pCrlContext, DWORD dwType,
 109  DWORD dwFlags, const void *pvPara)
 110 {
 111     BOOL ret;
 112
 113     if (pvPara)
 114     {
 115         PCCERT_CONTEXT issuer = pvPara;
 116
 117         ret = CertCompareCertificateName(issuer->dwCertEncodingType,
 118          &issuer->pCertInfo->Subject, &pCrlContext->pCrlInfo->Issuer);
 119         if (ret && (dwFlags & CRL_FIND_ISSUED_BY_SIGNATURE_FLAG))
 120             ret = CryptVerifyCertificateSignatureEx(0,
 121              issuer->dwCertEncodingType,
 122              CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL, (void *)pCrlContext,
 123              CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)issuer, 0, NULL);
 124         if (ret && (dwFlags & CRL_FIND_ISSUED_BY_AKI_FLAG))
 125         {
 126             PCERT_EXTENSION ext = CertFindExtension(
 127              szOID_AUTHORITY_KEY_IDENTIFIER2, pCrlContext->pCrlInfo->cExtension,
 128              pCrlContext->pCrlInfo->rgExtension);
 129
 130             if (ext)
 131             {
 132                 CERT_AUTHORITY_KEY_ID2_INFO *info;
 133                 DWORD size;
 134
 135                 if ((ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 136                  X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
 137                  CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size)))
 138                 {
 139                     if (info->AuthorityCertIssuer.cAltEntry &&
 140                      info->AuthorityCertSerialNumber.cbData)
 141                     {
 142                         PCERT_ALT_NAME_ENTRY directoryName = NULL;
 143                         DWORD i;
 144
 145                         for (i = 0; !directoryName &&
 146                          i < info->AuthorityCertIssuer.cAltEntry; i++)
 147                             if (info->AuthorityCertIssuer.rgAltEntry[i].
 148                              dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME)
 149                                 directoryName =
 150                                  &info->AuthorityCertIssuer.rgAltEntry[i];
 151                         if (directoryName)
 152                         {
 153                             ret = CertCompareCertificateName(
 154                              issuer->dwCertEncodingType,
 155                              &issuer->pCertInfo->Subject,
 156                              &directoryName->u.DirectoryName);
 157                             if (ret)
 158                                 ret = CertCompareIntegerBlob(
 159                                  &issuer->pCertInfo->SerialNumber,
 160                                  &info->AuthorityCertSerialNumber);
 161                         }
 162                         else
 163                         {
 164                             FIXME("no supported name type in authority key id2\n");
 165                             ret = FALSE;
 166                         }
 167                     }
 168                     else if (info->KeyId.cbData)
 169                     {
 170                         DWORD size;
 171
 172                         ret = CertGetCertificateContextProperty(issuer,
 173                          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 174                         if (ret && size == info->KeyId.cbData)
 175                         {
 176                             LPBYTE buf = CryptMemAlloc(size);
 177
 178                             if (buf)
 179                             {
 180                                 CertGetCertificateContextProperty(issuer,
 181                                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
 182                                 ret = !memcmp(buf, info->KeyId.pbData, size);
 183                                 CryptMemFree(buf);
 184                             }
 185                             else
 186                                 ret = FALSE;
 187                         }
 188                         else
 189                             ret = FALSE;
 190                     }
 191                     else
 192                     {
 193                         FIXME("unsupported value for AKI extension\n");
 194                         ret = FALSE;
 195                     }
 196                     LocalFree(info);
 197                 }
 198             }
 199             /* else: a CRL without an AKI matches any cert */
 200         }
 201     }
 202     else
 203         ret = TRUE;
 204     return ret;
 205 }
 206
 207 static BOOL compare_crl_existing(PCCRL_CONTEXT pCrlContext, DWORD dwType,
 208  DWORD dwFlags, const void *pvPara)
 209 {
 210     BOOL ret;
 211
 212     if (pvPara)
 213     {
 214         PCCRL_CONTEXT crl = pvPara;
 215
 216         ret = CertCompareCertificateName(pCrlContext->dwCertEncodingType,
 217          &pCrlContext->pCrlInfo->Issuer, &crl->pCrlInfo->Issuer);
 218     }
 219     else
 220         ret = TRUE;
 221     return ret;
 222 }
 223
 224 static BOOL compare_crl_issued_for(PCCRL_CONTEXT pCrlContext, DWORD dwType,
 225  DWORD dwFlags, const void *pvPara)
 226 {
 227     const CRL_FIND_ISSUED_FOR_PARA *para = pvPara;
 228     BOOL ret;
 229
 230     ret = CertCompareCertificateName(para->pIssuerCert->dwCertEncodingType,
 231      &para->pIssuerCert->pCertInfo->Issuer, &pCrlContext->pCrlInfo->Issuer);
 232     return ret;
 233 }
 234
 235 PCCRL_CONTEXT WINAPI CertFindCRLInStore(HCERTSTORE hCertStore,
 236  DWORD dwCertEncodingType, DWORD dwFindFlags, DWORD dwFindType,
 237  const void *pvFindPara, PCCRL_CONTEXT pPrevCrlContext)
 238 {
 239     PCCRL_CONTEXT ret;
 240     CrlCompareFunc compare;
 241
 242     TRACE("(%p, %d, %d, %d, %p, %p)\n", hCertStore, dwCertEncodingType,
 243          dwFindFlags, dwFindType, pvFindPara, pPrevCrlContext);
 244
 245     switch (dwFindType)
 246     {
 247     case CRL_FIND_ANY:
 248         compare = compare_crl_any;
 249         break;
 250     case CRL_FIND_ISSUED_BY:
 251         compare = compare_crl_issued_by;
 252         break;
 253     case CRL_FIND_EXISTING:
 254         compare = compare_crl_existing;
 255         break;
 256     case CRL_FIND_ISSUED_FOR:
 257         compare = compare_crl_issued_for;
 258         break;
 259     default:
 260         FIXME("find type %08x unimplemented\n", dwFindType);
 261         compare = NULL;
 262     }
 263
 264     if (compare)
 265     {
 266         BOOL matches = FALSE;
 267
 268         ret = pPrevCrlContext;
 269         do {
 270             ret = CertEnumCRLsInStore(hCertStore, ret);
 271             if (ret)
 272                 matches = compare(ret, dwFindType, dwFindFlags, pvFindPara);
 273         } while (ret != NULL && !matches);
 274         if (!ret)
 275             SetLastError(CRYPT_E_NOT_FOUND);
 276     }
 277     else
 278     {
 279         SetLastError(CRYPT_E_NOT_FOUND);
 280         ret = NULL;
 281     }
 282     return ret;
 283 }
 284
 285 PCCRL_CONTEXT WINAPI CertGetCRLFromStore(HCERTSTORE hCertStore,
 286  PCCERT_CONTEXT pIssuerContext, PCCRL_CONTEXT pPrevCrlContext, DWORD *pdwFlags)
 287 {
 288     static const DWORD supportedFlags = CERT_STORE_SIGNATURE_FLAG |
 289      CERT_STORE_TIME_VALIDITY_FLAG | CERT_STORE_BASE_CRL_FLAG |
 290      CERT_STORE_DELTA_CRL_FLAG;
 291     PCCRL_CONTEXT ret;
 292
 293     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pIssuerContext, pPrevCrlContext,
 294      *pdwFlags);
 295
 296     if (*pdwFlags & ~supportedFlags)
 297     {
 298         SetLastError(E_INVALIDARG);
 299         return NULL;
 300     }
 301     if (pIssuerContext)
 302         ret = CertFindCRLInStore(hCertStore, pIssuerContext->dwCertEncodingType,
 303          0, CRL_FIND_ISSUED_BY, pIssuerContext, pPrevCrlContext);
 304     else
 305         ret = CertFindCRLInStore(hCertStore, 0, 0, CRL_FIND_ANY, NULL,
 306          pPrevCrlContext);
 307     if (ret)
 308     {
 309         if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
 310         {
 311             if (0 == CertVerifyCRLTimeValidity(NULL, ret->pCrlInfo))
 312                 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
 313         }
 314         if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
 315         {
 316             if (CryptVerifyCertificateSignatureEx(0, ret->dwCertEncodingType,
 317              CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL, (void *)ret,
 318              CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuerContext, 0,
 319              NULL))
 320                 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
 321         }
 322     }
 323     return ret;
 324 }
 325
 326 PCCRL_CONTEXT WINAPI CertDuplicateCRLContext(PCCRL_CONTEXT pCrlContext)
 327 {
 328     TRACE("(%p)\n", pCrlContext);
 329     if (pCrlContext)
 330         Context_AddRef((void *)pCrlContext, sizeof(CRL_CONTEXT));
 331     return pCrlContext;
 332 }
 333
 334 static void CrlDataContext_Free(void *context)
 335 {
 336     PCRL_CONTEXT crlContext = context;
 337
 338     CryptMemFree(crlContext->pbCrlEncoded);
 339     LocalFree(crlContext->pCrlInfo);
 340 }
 341
 342 BOOL WINAPI CertFreeCRLContext( PCCRL_CONTEXT pCrlContext)
 343 {
 344     BOOL ret = TRUE;
 345
 346     TRACE("(%p)\n", pCrlContext);
 347
 348     if (pCrlContext)
 349         ret = Context_Release((void *)pCrlContext, sizeof(CRL_CONTEXT),
 350          CrlDataContext_Free);
 351     return ret;
 352 }
 353
 354 DWORD WINAPI CertEnumCRLContextProperties(PCCRL_CONTEXT pCRLContext,
 355  DWORD dwPropId)
 356 {
 357     PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
 358      pCRLContext, sizeof(CRL_CONTEXT));
 359     DWORD ret;
 360
 361     TRACE("(%p, %d)\n", pCRLContext, dwPropId);
 362
 363     if (properties)
 364         ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
 365     else
 366         ret = 0;
 367     return ret;
 368 }
 369
 370 static BOOL CRLContext_SetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
 371                                    DWORD dwFlags, const void *pvData);
 372
 373 static BOOL CRLContext_GetHashProp(PCCRL_CONTEXT context, DWORD dwPropId,
 374  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 375  DWORD *pcbData)
 376 {
 377     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 378      pcbData);
 379     if (ret && pvData)
 380     {
 381         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 382
 383         ret = CRLContext_SetProperty(context, dwPropId, 0, &blob);
 384     }
 385     return ret;
 386 }
 387
 388 static BOOL CRLContext_GetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
 389                                    void *pvData, DWORD *pcbData)
 390 {
 391     PCONTEXT_PROPERTY_LIST properties =
 392      Context_GetProperties(context, sizeof(CRL_CONTEXT));
 393     BOOL ret;
 394     CRYPT_DATA_BLOB blob;
 395
 396     TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
 397
 398     if (properties)
 399         ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
 400     else
 401         ret = FALSE;
 402     if (ret)
 403     {
 404         if (!pvData)
 405             *pcbData = blob.cbData;
 406         else if (*pcbData < blob.cbData)
 407         {
 408             SetLastError(ERROR_MORE_DATA);
 409             *pcbData = blob.cbData;
 410             ret = FALSE;
 411         }
 412         else
 413         {
 414             memcpy(pvData, blob.pbData, blob.cbData);
 415             *pcbData = blob.cbData;
 416         }
 417     }
 418     else
 419     {
 420         /* Implicit properties */
 421         switch (dwPropId)
 422         {
 423         case CERT_SHA1_HASH_PROP_ID:
 424             ret = CRLContext_GetHashProp(context, dwPropId, CALG_SHA1,
 425                                          context->pbCrlEncoded, context->cbCrlEncoded, pvData,
 426              pcbData);
 427             break;
 428         case CERT_MD5_HASH_PROP_ID:
 429             ret = CRLContext_GetHashProp(context, dwPropId, CALG_MD5,
 430                                          context->pbCrlEncoded, context->cbCrlEncoded, pvData,
 431              pcbData);
 432             break;
 433         default:
 434             SetLastError(CRYPT_E_NOT_FOUND);
 435         }
 436     }
 437     TRACE("returning %d\n", ret);
 438     return ret;
 439 }
 440
 441 BOOL WINAPI CertGetCRLContextProperty(PCCRL_CONTEXT pCRLContext,
 442  DWORD dwPropId, void *pvData, DWORD *pcbData)
 443 {
 444     BOOL ret;
 445
 446     TRACE("(%p, %d, %p, %p)\n", pCRLContext, dwPropId, pvData, pcbData);
 447
 448     switch (dwPropId)
 449     {
 450     case 0:
 451     case CERT_CERT_PROP_ID:
 452     case CERT_CRL_PROP_ID:
 453     case CERT_CTL_PROP_ID:
 454         SetLastError(E_INVALIDARG);
 455         ret = FALSE;
 456         break;
 457     case CERT_ACCESS_STATE_PROP_ID:
 458         if (!pvData)
 459         {
 460             *pcbData = sizeof(DWORD);
 461             ret = TRUE;
 462         }
 463         else if (*pcbData < sizeof(DWORD))
 464         {
 465             SetLastError(ERROR_MORE_DATA);
 466             *pcbData = sizeof(DWORD);
 467             ret = FALSE;
 468         }
 469         else
 470         {
 471             if (pCRLContext->hCertStore)
 472                 ret = CertGetStoreProperty(pCRLContext->hCertStore, dwPropId,
 473                  pvData, pcbData);
 474             else
 475                 *(DWORD *)pvData = 0;
 476             ret = TRUE;
 477         }
 478         break;
 479     default:
 480         ret = CRLContext_GetProperty(pCRLContext, dwPropId, pvData,
 481          pcbData);
 482     }
 483     return ret;
 484 }
 485
 486 static BOOL CRLContext_SetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
 487  DWORD dwFlags, const void *pvData)
 488 {
 489     PCONTEXT_PROPERTY_LIST properties =
 490      Context_GetProperties(context, sizeof(CRL_CONTEXT));
 491     BOOL ret;
 492
 493     TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
 494
 495     if (!properties)
 496         ret = FALSE;
 497     else if (!pvData)
 498     {
 499         ContextPropertyList_RemoveProperty(properties, dwPropId);
 500         ret = TRUE;
 501     }
 502     else
 503     {
 504         switch (dwPropId)
 505         {
 506         case CERT_AUTO_ENROLL_PROP_ID:
 507         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 508         case CERT_DESCRIPTION_PROP_ID:
 509         case CERT_FRIENDLY_NAME_PROP_ID:
 510         case CERT_HASH_PROP_ID:
 511         case CERT_KEY_IDENTIFIER_PROP_ID:
 512         case CERT_MD5_HASH_PROP_ID:
 513         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 514         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 515         case CERT_PVK_FILE_PROP_ID:
 516         case CERT_SIGNATURE_HASH_PROP_ID:
 517         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 518         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 519         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 520         case CERT_ENROLLMENT_PROP_ID:
 521         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 522         case CERT_RENEWAL_PROP_ID:
 523         {
 524             PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvData;
 525
 526             ret = ContextPropertyList_SetProperty(properties, dwPropId,
 527              blob->pbData, blob->cbData);
 528             break;
 529         }
 530         case CERT_DATE_STAMP_PROP_ID:
 531             ret = ContextPropertyList_SetProperty(properties, dwPropId,
 532              pvData, sizeof(FILETIME));
 533             break;
 534         default:
 535             FIXME("%d: stub\n", dwPropId);
 536             ret = FALSE;
 537         }
 538     }
 539     TRACE("returning %d\n", ret);
 540     return ret;
 541 }
 542
 543 BOOL WINAPI CertSetCRLContextProperty(PCCRL_CONTEXT pCRLContext,
 544  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 545 {
 546     BOOL ret;
 547
 548     TRACE("(%p, %d, %08x, %p)\n", pCRLContext, dwPropId, dwFlags, pvData);
 549
 550     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 551      * crashes on most of these, I'll be safer.
 552      */
 553     switch (dwPropId)
 554     {
 555     case 0:
 556     case CERT_ACCESS_STATE_PROP_ID:
 557     case CERT_CERT_PROP_ID:
 558     case CERT_CRL_PROP_ID:
 559     case CERT_CTL_PROP_ID:
 560         SetLastError(E_INVALIDARG);
 561         return FALSE;
 562     }
 563     ret = CRLContext_SetProperty(pCRLContext, dwPropId, dwFlags, pvData);
 564     TRACE("returning %d\n", ret);
 565     return ret;
 566 }
 567
 568 static BOOL compare_dist_point_name(const CRL_DIST_POINT_NAME *name1,
 569  const CRL_DIST_POINT_NAME *name2)
 570 {
 571     BOOL match;
 572
 573     if (name1->dwDistPointNameChoice == name2->dwDistPointNameChoice)
 574     {
 575         match = TRUE;
 576         if (name1->dwDistPointNameChoice == CRL_DIST_POINT_FULL_NAME)
 577         {
 578             if (name1->u.FullName.cAltEntry == name2->u.FullName.cAltEntry)
 579             {
 580                 DWORD i;
 581
 582                 for (i = 0; match && i < name1->u.FullName.cAltEntry; i++)
 583                 {
 584                     const CERT_ALT_NAME_ENTRY *entry1 =
 585                      &name1->u.FullName.rgAltEntry[i];
 586                     const CERT_ALT_NAME_ENTRY *entry2 =
 587                      &name2->u.FullName.rgAltEntry[i];
 588
 589                     if (entry1->dwAltNameChoice == entry2->dwAltNameChoice)
 590                     {
 591                         switch (entry1->dwAltNameChoice)
 592                         {
 593                         case CERT_ALT_NAME_URL:
 594                             match = !strcmpiW(entry1->u.pwszURL,
 595                              entry2->u.pwszURL);
 596                             break;
 597                         case CERT_ALT_NAME_DIRECTORY_NAME:
 598                             match = (entry1->u.DirectoryName.cbData ==
 599                              entry2->u.DirectoryName.cbData) &&
 600                              !memcmp(entry1->u.DirectoryName.pbData,
 601                              entry2->u.DirectoryName.pbData,
 602                              entry1->u.DirectoryName.cbData);
 603                             break;
 604                         default:
 605                             FIXME("unimplemented for type %d\n",
 606                              entry1->dwAltNameChoice);
 607                             match = FALSE;
 608                         }
 609                     }
 610                     else
 611                         match = FALSE;
 612                 }
 613             }
 614             else
 615                 match = FALSE;
 616         }
 617     }
 618     else
 619         match = FALSE;
 620     return match;
 621 }
 622
 623 static BOOL match_dist_point_with_issuing_dist_point(
 624  const CRL_DIST_POINT *distPoint, const CRL_ISSUING_DIST_POINT *idp)
 625 {
 626     BOOL match;
 627
 628     /* While RFC 5280, section 4.2.1.13 recommends against segmenting
 629      * CRL distribution points by reasons, it doesn't preclude doing so.
 630      * "This profile RECOMMENDS against segmenting CRLs by reason code."
 631      * If the issuing distribution point for this CRL is only valid for
 632      * some reasons, only match if the reasons covered also match the
 633      * reasons in the CRL distribution point.
 634      */
 635     if (idp->OnlySomeReasonFlags.cbData)
 636     {
 637         if (idp->OnlySomeReasonFlags.cbData == distPoint->ReasonFlags.cbData)
 638         {
 639             DWORD i;
 640
 641             match = TRUE;
 642             for (i = 0; match && i < distPoint->ReasonFlags.cbData; i++)
 643                 if (idp->OnlySomeReasonFlags.pbData[i] !=
 644                  distPoint->ReasonFlags.pbData[i])
 645                     match = FALSE;
 646         }
 647         else
 648             match = FALSE;
 649     }
 650     else
 651         match = TRUE;
 652     if (match)
 653         match = compare_dist_point_name(&idp->DistPointName,
 654          &distPoint->DistPointName);
 655     return match;
 656 }
 657
 658 BOOL WINAPI CertIsValidCRLForCertificate(PCCERT_CONTEXT pCert,
 659  PCCRL_CONTEXT pCrl, DWORD dwFlags, void *pvReserved)
 660 {
 661     PCERT_EXTENSION ext;
 662     BOOL ret;
 663
 664     TRACE("(%p, %p, %08x, %p)\n", pCert, pCrl, dwFlags, pvReserved);
 665
 666     if (!pCert)
 667         return TRUE;
 668
 669     if ((ext = CertFindExtension(szOID_ISSUING_DIST_POINT,
 670      pCrl->pCrlInfo->cExtension, pCrl->pCrlInfo->rgExtension)))
 671     {
 672         CRL_ISSUING_DIST_POINT *idp;
 673         DWORD size;
 674
 675         if ((ret = CryptDecodeObjectEx(pCrl->dwCertEncodingType,
 676          X509_ISSUING_DIST_POINT, ext->Value.pbData, ext->Value.cbData,
 677          CRYPT_DECODE_ALLOC_FLAG, NULL, &idp, &size)))
 678         {
 679             if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
 680              pCert->pCertInfo->cExtension, pCert->pCertInfo->rgExtension)))
 681             {
 682                 CRL_DIST_POINTS_INFO *distPoints;
 683
 684                 if ((ret = CryptDecodeObjectEx(pCert->dwCertEncodingType,
 685                  X509_CRL_DIST_POINTS, ext->Value.pbData, ext->Value.cbData,
 686                  CRYPT_DECODE_ALLOC_FLAG, NULL, &distPoints, &size)))
 687                 {
 688                     DWORD i;
 689
 690                     ret = FALSE;
 691                     for (i = 0; !ret && i < distPoints->cDistPoint; i++)
 692                         ret = match_dist_point_with_issuing_dist_point(
 693                          &distPoints->rgDistPoint[i], idp);
 694                     if (!ret)
 695                         SetLastError(CRYPT_E_NO_MATCH);
 696                     LocalFree(distPoints);
 697                 }
 698             }
 699             else
 700             {
 701                 /* no CRL dist points extension in cert, can't match the CRL
 702                  * (which has an issuing dist point extension)
 703                  */
 704                 ret = FALSE;
 705                 SetLastError(CRYPT_E_NO_MATCH);
 706             }
 707             LocalFree(idp);
 708         }
 709     }
 710     else
 711         ret = TRUE;
 712     return ret;
 713 }
 714
 715 static PCRL_ENTRY CRYPT_FindCertificateInCRL(PCERT_INFO cert, const CRL_INFO *crl)
 716 {
 717     DWORD i;
 718     PCRL_ENTRY entry = NULL;
 719
 720     for (i = 0; !entry && i < crl->cCRLEntry; i++)
 721         if (CertCompareIntegerBlob(&crl->rgCRLEntry[i].SerialNumber,
 722          &cert->SerialNumber))
 723             entry = &crl->rgCRLEntry[i];
 724     return entry;
 725 }
 726
 727 BOOL WINAPI CertFindCertificateInCRL(PCCERT_CONTEXT pCert,
 728  PCCRL_CONTEXT pCrlContext, DWORD dwFlags, void *pvReserved,
 729  PCRL_ENTRY *ppCrlEntry)
 730 {
 731     TRACE("(%p, %p, %08x, %p, %p)\n", pCert, pCrlContext, dwFlags, pvReserved,
 732      ppCrlEntry);
 733
 734     *ppCrlEntry = CRYPT_FindCertificateInCRL(pCert->pCertInfo,
 735      pCrlContext->pCrlInfo);
 736     return TRUE;
 737 }
 738
 739 BOOL WINAPI CertVerifyCRLRevocation(DWORD dwCertEncodingType,
 740  PCERT_INFO pCertId, DWORD cCrlInfo, PCRL_INFO rgpCrlInfo[])
 741 {
 742     DWORD i;
 743     PCRL_ENTRY entry = NULL;
 744
 745     TRACE("(%08x, %p, %d, %p)\n", dwCertEncodingType, pCertId, cCrlInfo,
 746      rgpCrlInfo);
 747
 748     for (i = 0; !entry && i < cCrlInfo; i++)
 749         entry = CRYPT_FindCertificateInCRL(pCertId, rgpCrlInfo[i]);
 750     return entry == NULL;
 751 }
 752
 753 LONG WINAPI CertVerifyCRLTimeValidity(LPFILETIME pTimeToVerify,
 754  PCRL_INFO pCrlInfo)
 755 {
 756     FILETIME fileTime;
 757     LONG ret;
 758
 759     if (!pTimeToVerify)
 760     {
 761         GetSystemTimeAsFileTime(&fileTime);
 762         pTimeToVerify = &fileTime;
 763     }
 764     if ((ret = CompareFileTime(pTimeToVerify, &pCrlInfo->ThisUpdate)) >= 0)
 765     {
 766         ret = CompareFileTime(pTimeToVerify, &pCrlInfo->NextUpdate);
 767         if (ret < 0)
 768             ret = 0;
 769     }
 770     return ret;
 771 }