2 * Copyright 2001 Rein Klazes
3 * Copyright 2007 Juan Lang
5 * This library is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU Lesser General Public
7 * License as published by the Free Software Foundation; either
8 * version 2.1 of the License, or (at your option) any later version.
10 * This library is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * Lesser General Public License for more details.
15 * You should have received a copy of the GNU Lesser General Public
16 * License along with this library; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
20 #include "wintrust_priv.h"
23 #include <cryptuiapi.h>
25 WINE_DEFAULT_DEBUG_CHANNEL(wintrust
);
28 /* Utility functions */
29 void * WINAPI
WINTRUST_Alloc(DWORD cb
)
31 return HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY
, cb
);
34 static void* WINTRUST_ReAlloc(void *ptr
, DWORD cb
) __WINE_ALLOC_SIZE(2);
35 static void* WINTRUST_ReAlloc(void *ptr
, DWORD cb
)
37 return HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY
, ptr
, cb
);
40 void WINAPI
WINTRUST_Free(void *p
)
42 HeapFree(GetProcessHeap(), 0, p
);
45 /***********************************************************************
46 * DllMain (WINTRUST.@)
48 BOOL WINAPI
DllMain( HINSTANCE inst
, DWORD reason
, LPVOID reserved
)
52 case DLL_PROCESS_ATTACH
:
53 DisableThreadLibraryCalls( inst
);
59 /***********************************************************************
60 * TrustIsCertificateSelfSigned (WINTRUST.@)
62 BOOL WINAPI
TrustIsCertificateSelfSigned( PCCERT_CONTEXT cert
)
69 if ((ext
= CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2
,
70 cert
->pCertInfo
->cExtension
, cert
->pCertInfo
->rgExtension
)))
72 CERT_AUTHORITY_KEY_ID2_INFO
*info
;
74 ret
= CryptDecodeObjectEx(cert
->dwCertEncodingType
,
75 X509_AUTHORITY_KEY_ID2
, ext
->Value
.pbData
, ext
->Value
.cbData
,
76 CRYPT_DECODE_ALLOC_FLAG
| CRYPT_DECODE_NOCOPY_FLAG
, NULL
,
80 if (info
->AuthorityCertIssuer
.cAltEntry
&&
81 info
->AuthorityCertSerialNumber
.cbData
)
83 PCERT_ALT_NAME_ENTRY directoryName
= NULL
;
86 for (i
= 0; !directoryName
&&
87 i
< info
->AuthorityCertIssuer
.cAltEntry
; i
++)
88 if (info
->AuthorityCertIssuer
.rgAltEntry
[i
].dwAltNameChoice
89 == CERT_ALT_NAME_DIRECTORY_NAME
)
91 &info
->AuthorityCertIssuer
.rgAltEntry
[i
];
94 ret
= CertCompareCertificateName(cert
->dwCertEncodingType
,
95 &directoryName
->u
.DirectoryName
, &cert
->pCertInfo
->Issuer
)
96 && CertCompareIntegerBlob(&info
->AuthorityCertSerialNumber
,
97 &cert
->pCertInfo
->SerialNumber
);
101 FIXME("no supported name type in authority key id2\n");
105 else if (info
->KeyId
.cbData
)
107 ret
= CertGetCertificateContextProperty(cert
,
108 CERT_KEY_IDENTIFIER_PROP_ID
, NULL
, &size
);
109 if (ret
&& size
== info
->KeyId
.cbData
)
111 LPBYTE buf
= CryptMemAlloc(size
);
115 CertGetCertificateContextProperty(cert
,
116 CERT_KEY_IDENTIFIER_PROP_ID
, buf
, &size
);
117 ret
= !memcmp(buf
, info
->KeyId
.pbData
, size
);
129 else if ((ext
= CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER
,
130 cert
->pCertInfo
->cExtension
, cert
->pCertInfo
->rgExtension
)))
132 CERT_AUTHORITY_KEY_ID_INFO
*info
;
134 ret
= CryptDecodeObjectEx(cert
->dwCertEncodingType
,
135 X509_AUTHORITY_KEY_ID
, ext
->Value
.pbData
, ext
->Value
.cbData
,
136 CRYPT_DECODE_ALLOC_FLAG
| CRYPT_DECODE_NOCOPY_FLAG
, NULL
,
140 if (info
->CertIssuer
.cbData
&& info
->CertSerialNumber
.cbData
)
142 ret
= CertCompareCertificateName(cert
->dwCertEncodingType
,
143 &info
->CertIssuer
, &cert
->pCertInfo
->Issuer
) &&
144 CertCompareIntegerBlob(&info
->CertSerialNumber
,
145 &cert
->pCertInfo
->SerialNumber
);
147 else if (info
->KeyId
.cbData
)
149 ret
= CertGetCertificateContextProperty(cert
,
150 CERT_KEY_IDENTIFIER_PROP_ID
, NULL
, &size
);
151 if (ret
&& size
== info
->KeyId
.cbData
)
153 LPBYTE buf
= CryptMemAlloc(size
);
157 CertGetCertificateContextProperty(cert
,
158 CERT_KEY_IDENTIFIER_PROP_ID
, buf
, &size
);
159 ret
= !memcmp(buf
, info
->KeyId
.pbData
, size
);
174 ret
= CertCompareCertificateName(cert
->dwCertEncodingType
,
175 &cert
->pCertInfo
->Subject
, &cert
->pCertInfo
->Issuer
);
179 typedef HRESULT (WINAPI
*wintrust_step_func
)(CRYPT_PROVIDER_DATA
*data
);
183 wintrust_step_func func
;
187 static DWORD
WINTRUST_ExecuteSteps(const struct wintrust_step
*steps
,
188 DWORD numSteps
, CRYPT_PROVIDER_DATA
*provData
)
190 DWORD i
, err
= ERROR_SUCCESS
;
192 for (i
= 0; !err
&& i
< numSteps
; i
++)
194 err
= steps
[i
].func(provData
);
196 err
= provData
->padwTrustStepErrors
[steps
[i
].error_index
];
201 static CRYPT_PROVIDER_DATA
*WINTRUST_AllocateProviderData(void)
203 CRYPT_PROVIDER_DATA
*provData
;
205 provData
= WINTRUST_Alloc(sizeof(CRYPT_PROVIDER_DATA
));
208 provData
->cbStruct
= sizeof(CRYPT_PROVIDER_DATA
);
210 provData
->padwTrustStepErrors
=
211 WINTRUST_Alloc(TRUSTERROR_MAX_STEPS
* sizeof(DWORD
));
212 if (!provData
->padwTrustStepErrors
)
214 provData
->cdwTrustStepErrors
= TRUSTERROR_MAX_STEPS
;
216 provData
->u
.pPDSip
= WINTRUST_Alloc(sizeof(PROVDATA_SIP
));
217 if (!provData
->u
.pPDSip
)
219 provData
->u
.pPDSip
->cbStruct
= sizeof(PROVDATA_SIP
);
221 provData
->psPfns
= WINTRUST_Alloc(sizeof(CRYPT_PROVIDER_FUNCTIONS
));
222 if (!provData
->psPfns
)
224 provData
->psPfns
->cbStruct
= sizeof(CRYPT_PROVIDER_FUNCTIONS
);
230 WINTRUST_Free(provData
->padwTrustStepErrors
);
231 WINTRUST_Free(provData
->u
.pPDSip
);
232 WINTRUST_Free(provData
->psPfns
);
233 WINTRUST_Free(provData
);
238 /* Adds trust steps for each function in psPfns. Assumes steps has at least
239 * 5 entries. Returns the number of steps added.
241 static DWORD
WINTRUST_AddTrustStepsFromFunctions(struct wintrust_step
*steps
,
242 const CRYPT_PROVIDER_FUNCTIONS
*psPfns
)
246 if (psPfns
->pfnInitialize
)
248 steps
[numSteps
].func
= psPfns
->pfnInitialize
;
249 steps
[numSteps
++].error_index
= TRUSTERROR_STEP_FINAL_WVTINIT
;
251 if (psPfns
->pfnObjectTrust
)
253 steps
[numSteps
].func
= psPfns
->pfnObjectTrust
;
254 steps
[numSteps
++].error_index
= TRUSTERROR_STEP_FINAL_OBJPROV
;
256 if (psPfns
->pfnSignatureTrust
)
258 steps
[numSteps
].func
= psPfns
->pfnSignatureTrust
;
259 steps
[numSteps
++].error_index
= TRUSTERROR_STEP_FINAL_SIGPROV
;
261 if (psPfns
->pfnCertificateTrust
)
263 steps
[numSteps
].func
= psPfns
->pfnCertificateTrust
;
264 steps
[numSteps
++].error_index
= TRUSTERROR_STEP_FINAL_CERTPROV
;
266 if (psPfns
->pfnFinalPolicy
)
268 steps
[numSteps
].func
= psPfns
->pfnFinalPolicy
;
269 steps
[numSteps
++].error_index
= TRUSTERROR_STEP_FINAL_POLICYPROV
;
274 static LONG
WINTRUST_DefaultVerify(HWND hwnd
, GUID
*actionID
,
277 DWORD err
= ERROR_SUCCESS
, numSteps
= 0;
278 CRYPT_PROVIDER_DATA
*provData
;
280 struct wintrust_step verifySteps
[5];
282 TRACE("(%p, %s, %p)\n", hwnd
, debugstr_guid(actionID
), data
);
284 provData
= WINTRUST_AllocateProviderData();
286 return ERROR_OUTOFMEMORY
;
288 ret
= WintrustLoadFunctionPointers(actionID
, provData
->psPfns
);
291 err
= GetLastError();
295 data
->hWVTStateData
= provData
;
296 provData
->pWintrustData
= data
;
297 if (hwnd
== INVALID_HANDLE_VALUE
)
298 provData
->hWndParent
= GetDesktopWindow();
300 provData
->hWndParent
= hwnd
;
301 provData
->pgActionID
= actionID
;
302 WintrustGetRegPolicyFlags(&provData
->dwRegPolicySettings
);
304 numSteps
= WINTRUST_AddTrustStepsFromFunctions(verifySteps
,
306 err
= WINTRUST_ExecuteSteps(verifySteps
, numSteps
, provData
);
312 WINTRUST_Free(provData
->padwTrustStepErrors
);
313 WINTRUST_Free(provData
->u
.pPDSip
);
314 WINTRUST_Free(provData
->psPfns
);
315 WINTRUST_Free(provData
);
318 TRACE("returning %08x\n", err
);
322 static LONG
WINTRUST_DefaultClose(HWND hwnd
, GUID
*actionID
,
325 DWORD err
= ERROR_SUCCESS
;
326 CRYPT_PROVIDER_DATA
*provData
= data
->hWVTStateData
;
328 TRACE("(%p, %s, %p)\n", hwnd
, debugstr_guid(actionID
), data
);
332 if (provData
->psPfns
->pfnCleanupPolicy
)
333 err
= provData
->psPfns
->pfnCleanupPolicy(provData
);
335 WINTRUST_Free(provData
->padwTrustStepErrors
);
336 WINTRUST_Free(provData
->u
.pPDSip
);
337 WINTRUST_Free(provData
->psPfns
);
338 WINTRUST_Free(provData
);
339 data
->hWVTStateData
= NULL
;
341 TRACE("returning %08x\n", err
);
345 static LONG
WINTRUST_DefaultVerifyAndClose(HWND hwnd
, GUID
*actionID
,
350 TRACE("(%p, %s, %p)\n", hwnd
, debugstr_guid(actionID
), data
);
352 err
= WINTRUST_DefaultVerify(hwnd
, actionID
, data
);
353 WINTRUST_DefaultClose(hwnd
, actionID
, data
);
354 TRACE("returning %08x\n", err
);
358 static LONG
WINTRUST_PublishedSoftware(HWND hwnd
, GUID
*actionID
,
361 WINTRUST_DATA wintrust_data
= { sizeof(wintrust_data
), 0 };
362 /* Undocumented: the published software action is passed a path,
363 * and pSIPClientData points to a WIN_TRUST_SUBJECT_FILE.
365 LPWIN_TRUST_SUBJECT_FILE subjectFile
= data
->pSIPClientData
;
366 WINTRUST_FILE_INFO fileInfo
= { sizeof(fileInfo
), 0 };
368 TRACE("subjectFile->hFile: %p\n", subjectFile
->hFile
);
369 TRACE("subjectFile->lpPath: %s\n", debugstr_w(subjectFile
->lpPath
));
370 fileInfo
.pcwszFilePath
= subjectFile
->lpPath
;
371 fileInfo
.hFile
= subjectFile
->hFile
;
372 wintrust_data
.u
.pFile
= &fileInfo
;
373 wintrust_data
.dwUnionChoice
= WTD_CHOICE_FILE
;
374 wintrust_data
.dwUIChoice
= WTD_UI_NONE
;
376 return WINTRUST_DefaultVerifyAndClose(hwnd
, actionID
, &wintrust_data
);
379 /* Sadly, the function to load the cert for the CERT_CERTIFICATE_ACTION_VERIFY
380 * action is not stored in the registry and is located in wintrust, not in
381 * cryptdlg along with the rest of the implementation (verified by running the
382 * action with a native wintrust.dll.)
384 static HRESULT WINAPI
WINTRUST_CertVerifyObjTrust(CRYPT_PROVIDER_DATA
*data
)
388 TRACE("(%p)\n", data
);
390 if (!data
->padwTrustStepErrors
)
393 switch (data
->pWintrustData
->dwUnionChoice
)
395 case WTD_CHOICE_BLOB
:
396 if (data
->pWintrustData
->u
.pBlob
&&
397 WVT_IS_CBSTRUCT_GT_MEMBEROFFSET(WINTRUST_BLOB_INFO
,
398 data
->pWintrustData
->u
.pBlob
->cbStruct
, pbMemObject
) &&
399 data
->pWintrustData
->u
.pBlob
->cbMemObject
==
400 sizeof(CERT_VERIFY_CERTIFICATE_TRUST
) &&
401 data
->pWintrustData
->u
.pBlob
->pbMemObject
)
403 CERT_VERIFY_CERTIFICATE_TRUST
*pCert
=
404 (CERT_VERIFY_CERTIFICATE_TRUST
*)
405 data
->pWintrustData
->u
.pBlob
->pbMemObject
;
407 if (pCert
->cbSize
== sizeof(CERT_VERIFY_CERTIFICATE_TRUST
) &&
410 CRYPT_PROVIDER_SGNR signer
= { sizeof(signer
), { 0 } };
414 /* Add a signer with nothing but the time to verify, so we can
417 GetSystemTime(&sysTime
);
418 SystemTimeToFileTime(&sysTime
, &signer
.sftVerifyAsOf
);
419 ret
= data
->psPfns
->pfnAddSgnr2Chain(data
, FALSE
, 0, &signer
);
422 ret
= data
->psPfns
->pfnAddCert2Chain(data
, 0, FALSE
, 0,
426 for (i
= 0; ret
&& i
< pCert
->cRootStores
; i
++)
427 ret
= data
->psPfns
->pfnAddStore2Chain(data
,
428 pCert
->rghstoreRoots
[i
]);
429 for (i
= 0; ret
&& i
< pCert
->cStores
; i
++)
430 ret
= data
->psPfns
->pfnAddStore2Chain(data
,
431 pCert
->rghstoreCAs
[i
]);
432 for (i
= 0; ret
&& i
< pCert
->cTrustStores
; i
++)
433 ret
= data
->psPfns
->pfnAddStore2Chain(data
,
434 pCert
->rghstoreTrust
[i
]);
438 SetLastError(ERROR_INVALID_PARAMETER
);
444 SetLastError(ERROR_INVALID_PARAMETER
);
449 FIXME("unimplemented for %d\n", data
->pWintrustData
->dwUnionChoice
);
450 SetLastError(ERROR_INVALID_PARAMETER
);
456 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_OBJPROV
] =
458 TRACE("returning %d (%08x)\n", ret
? S_OK
: S_FALSE
,
459 data
->padwTrustStepErrors
[TRUSTERROR_STEP_FINAL_OBJPROV
]);
460 return ret
? S_OK
: S_FALSE
;
463 static LONG
WINTRUST_CertVerify(HWND hwnd
, GUID
*actionID
,
466 DWORD err
= ERROR_SUCCESS
, numSteps
= 0;
467 CRYPT_PROVIDER_DATA
*provData
;
469 struct wintrust_step verifySteps
[5];
471 TRACE("(%p, %s, %p)\n", hwnd
, debugstr_guid(actionID
), data
);
473 provData
= WINTRUST_AllocateProviderData();
475 return ERROR_OUTOFMEMORY
;
477 ret
= WintrustLoadFunctionPointers(actionID
, provData
->psPfns
);
480 err
= GetLastError();
483 if (!provData
->psPfns
->pfnObjectTrust
)
484 provData
->psPfns
->pfnObjectTrust
= WINTRUST_CertVerifyObjTrust
;
485 /* Not sure why, but native skips the policy check */
486 provData
->psPfns
->pfnCertCheckPolicy
= NULL
;
488 data
->hWVTStateData
= provData
;
489 provData
->pWintrustData
= data
;
490 if (hwnd
== INVALID_HANDLE_VALUE
)
491 provData
->hWndParent
= GetDesktopWindow();
493 provData
->hWndParent
= hwnd
;
494 provData
->pgActionID
= actionID
;
495 WintrustGetRegPolicyFlags(&provData
->dwRegPolicySettings
);
497 numSteps
= WINTRUST_AddTrustStepsFromFunctions(verifySteps
,
499 err
= WINTRUST_ExecuteSteps(verifySteps
, numSteps
, provData
);
505 WINTRUST_Free(provData
->padwTrustStepErrors
);
506 WINTRUST_Free(provData
->u
.pPDSip
);
507 WINTRUST_Free(provData
->psPfns
);
508 WINTRUST_Free(provData
);
511 TRACE("returning %08x\n", err
);
515 static LONG
WINTRUST_CertVerifyAndClose(HWND hwnd
, GUID
*actionID
,
520 TRACE("(%p, %s, %p)\n", hwnd
, debugstr_guid(actionID
), data
);
522 err
= WINTRUST_CertVerify(hwnd
, actionID
, data
);
523 WINTRUST_DefaultClose(hwnd
, actionID
, data
);
524 TRACE("returning %08x\n", err
);
528 static LONG
WINTRUST_CertActionVerify(HWND hwnd
, GUID
*actionID
,
532 LONG err
= ERROR_SUCCESS
;
534 if (WVT_ISINSTRUCT(WINTRUST_DATA
, data
->cbStruct
, dwStateAction
))
535 stateAction
= data
->dwStateAction
;
538 TRACE("no dwStateAction, assuming WTD_STATEACTION_IGNORE\n");
539 stateAction
= WTD_STATEACTION_IGNORE
;
543 case WTD_STATEACTION_IGNORE
:
544 err
= WINTRUST_CertVerifyAndClose(hwnd
, actionID
, data
);
546 case WTD_STATEACTION_VERIFY
:
547 err
= WINTRUST_CertVerify(hwnd
, actionID
, data
);
549 case WTD_STATEACTION_CLOSE
:
550 err
= WINTRUST_DefaultClose(hwnd
, actionID
, data
);
553 FIXME("unimplemented for %d\n", data
->dwStateAction
);
558 static void dump_file_info(WINTRUST_FILE_INFO
*pFile
)
560 TRACE("%p\n", pFile
);
563 TRACE("cbStruct: %d\n", pFile
->cbStruct
);
564 TRACE("pcwszFilePath: %s\n", debugstr_w(pFile
->pcwszFilePath
));
565 TRACE("hFile: %p\n", pFile
->hFile
);
566 TRACE("pgKnownSubject: %s\n", debugstr_guid(pFile
->pgKnownSubject
));
570 static void dump_catalog_info(WINTRUST_CATALOG_INFO
*catalog
)
572 TRACE("%p\n", catalog
);
575 TRACE("cbStruct: %d\n", catalog
->cbStruct
);
576 TRACE("dwCatalogVersion: %d\n", catalog
->dwCatalogVersion
);
577 TRACE("pcwszCatalogFilePath: %s\n",
578 debugstr_w(catalog
->pcwszCatalogFilePath
));
579 TRACE("pcwszMemberTag: %s\n", debugstr_w(catalog
->pcwszMemberTag
));
580 TRACE("pcwszMemberFilePath: %s\n",
581 debugstr_w(catalog
->pcwszMemberFilePath
));
582 TRACE("hMemberFile: %p\n", catalog
->hMemberFile
);
583 TRACE("pbCalculatedFileHash: %p\n", catalog
->pbCalculatedFileHash
);
584 TRACE("cbCalculatedFileHash: %d\n", catalog
->cbCalculatedFileHash
);
585 TRACE("pcCatalogContext: %p\n", catalog
->pcCatalogContext
);
589 static void dump_blob_info(WINTRUST_BLOB_INFO
*blob
)
594 TRACE("cbStruct: %d\n", blob
->cbStruct
);
595 TRACE("gSubject: %s\n", debugstr_guid(&blob
->gSubject
));
596 TRACE("pcwszDisplayName: %s\n", debugstr_w(blob
->pcwszDisplayName
));
597 TRACE("cbMemObject: %d\n", blob
->cbMemObject
);
598 TRACE("pbMemObject: %p\n", blob
->pbMemObject
);
599 TRACE("cbMemSignedMsg: %d\n", blob
->cbMemSignedMsg
);
600 TRACE("pbMemSignedMsg: %p\n", blob
->pbMemSignedMsg
);
604 static void dump_sgnr_info(WINTRUST_SGNR_INFO
*sgnr
)
609 TRACE("cbStruct: %d\n", sgnr
->cbStruct
);
610 TRACE("pcwszDisplayName: %s\n", debugstr_w(sgnr
->pcwszDisplayName
));
611 TRACE("psSignerInfo: %p\n", sgnr
->psSignerInfo
);
612 TRACE("chStores: %d\n", sgnr
->chStores
);
616 static void dump_cert_info(WINTRUST_CERT_INFO
*cert
)
621 TRACE("cbStruct: %d\n", cert
->cbStruct
);
622 TRACE("pcwszDisplayName: %s\n", debugstr_w(cert
->pcwszDisplayName
));
623 TRACE("psCertContext: %p\n", cert
->psCertContext
);
624 TRACE("chStores: %d\n", cert
->chStores
);
625 TRACE("dwFlags: %08x\n", cert
->dwFlags
);
626 TRACE("psftVerifyAsOf: %p\n", cert
->psftVerifyAsOf
);
630 static void dump_wintrust_data(WINTRUST_DATA
*data
)
635 TRACE("cbStruct: %d\n", data
->cbStruct
);
636 TRACE("pPolicyCallbackData: %p\n", data
->pPolicyCallbackData
);
637 TRACE("pSIPClientData: %p\n", data
->pSIPClientData
);
638 TRACE("dwUIChoice: %d\n", data
->dwUIChoice
);
639 TRACE("fdwRevocationChecks: %08x\n", data
->fdwRevocationChecks
);
640 TRACE("dwUnionChoice: %d\n", data
->dwUnionChoice
);
641 switch (data
->dwUnionChoice
)
643 case WTD_CHOICE_FILE
:
644 dump_file_info(data
->u
.pFile
);
646 case WTD_CHOICE_CATALOG
:
647 dump_catalog_info(data
->u
.pCatalog
);
649 case WTD_CHOICE_BLOB
:
650 dump_blob_info(data
->u
.pBlob
);
652 case WTD_CHOICE_SIGNER
:
653 dump_sgnr_info(data
->u
.pSgnr
);
655 case WTD_CHOICE_CERT
:
656 dump_cert_info(data
->u
.pCert
);
659 TRACE("dwStateAction: %d\n", data
->dwStateAction
);
660 TRACE("hWVTStateData: %p\n", data
->hWVTStateData
);
661 TRACE("pwszURLReference: %s\n", debugstr_w(data
->pwszURLReference
));
662 TRACE("dwProvFlags: %08x\n", data
->dwProvFlags
);
663 TRACE("dwUIContext: %d\n", data
->dwUIContext
);
667 /***********************************************************************
668 * WinVerifyTrust (WINTRUST.@)
670 * Verifies an object by calling the specified trust provider.
673 * hwnd [I] Handle to a caller window.
674 * ActionID [I] Pointer to a GUID that identifies the action to perform.
675 * ActionData [I] Information used by the trust provider to verify the object.
679 * Failure: A TRUST_E_* error code.
682 * Trust providers can be found at:
683 * HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\
685 LONG WINAPI
WinVerifyTrust( HWND hwnd
, GUID
*ActionID
, LPVOID ActionData
)
687 static const GUID unknown
= { 0xC689AAB8, 0x8E78, 0x11D0, { 0x8C,0x47,
688 0x00,0xC0,0x4F,0xC2,0x95,0xEE } };
689 static const GUID published_software
= WIN_SPUB_ACTION_PUBLISHED_SOFTWARE
;
690 static const GUID generic_verify_v2
= WINTRUST_ACTION_GENERIC_VERIFY_V2
;
691 static const GUID generic_cert_verify
= WINTRUST_ACTION_GENERIC_CERT_VERIFY
;
692 static const GUID generic_chain_verify
= WINTRUST_ACTION_GENERIC_CHAIN_VERIFY
;
693 static const GUID cert_action_verify
= CERT_CERTIFICATE_ACTION_VERIFY
;
694 LONG err
= ERROR_SUCCESS
;
695 WINTRUST_DATA
*actionData
= ActionData
;
697 TRACE("(%p, %s, %p)\n", hwnd
, debugstr_guid(ActionID
), ActionData
);
698 dump_wintrust_data(ActionData
);
700 /* Support for known old-style callers: */
701 if (IsEqualGUID(ActionID
, &published_software
))
702 err
= WINTRUST_PublishedSoftware(hwnd
, ActionID
, ActionData
);
703 else if (IsEqualGUID(ActionID
, &cert_action_verify
))
704 err
= WINTRUST_CertActionVerify(hwnd
, ActionID
, ActionData
);
709 /* Check known actions to warn of possible problems */
710 if (!IsEqualGUID(ActionID
, &unknown
) &&
711 !IsEqualGUID(ActionID
, &generic_verify_v2
) &&
712 !IsEqualGUID(ActionID
, &generic_cert_verify
) &&
713 !IsEqualGUID(ActionID
, &generic_chain_verify
))
714 WARN("unknown action %s, default behavior may not be right\n",
715 debugstr_guid(ActionID
));
716 if (WVT_ISINSTRUCT(WINTRUST_DATA
, actionData
->cbStruct
, dwStateAction
))
717 stateAction
= actionData
->dwStateAction
;
720 TRACE("no dwStateAction, assuming WTD_STATEACTION_IGNORE\n");
721 stateAction
= WTD_STATEACTION_IGNORE
;
725 case WTD_STATEACTION_IGNORE
:
726 err
= WINTRUST_DefaultVerifyAndClose(hwnd
, ActionID
, ActionData
);
728 case WTD_STATEACTION_VERIFY
:
729 err
= WINTRUST_DefaultVerify(hwnd
, ActionID
, ActionData
);
731 case WTD_STATEACTION_CLOSE
:
732 err
= WINTRUST_DefaultClose(hwnd
, ActionID
, ActionData
);
735 FIXME("unimplemented for %d\n", actionData
->dwStateAction
);
739 TRACE("returning %08x\n", err
);
743 /***********************************************************************
744 * WinVerifyTrustEx (WINTRUST.@)
746 HRESULT WINAPI
WinVerifyTrustEx( HWND hwnd
, GUID
*ActionID
,
747 WINTRUST_DATA
* ActionData
)
749 return WinVerifyTrust(hwnd
, ActionID
, ActionData
);
752 /***********************************************************************
753 * WTHelperGetProvSignerFromChain (WINTRUST.@)
755 CRYPT_PROVIDER_SGNR
* WINAPI
WTHelperGetProvSignerFromChain(
756 CRYPT_PROVIDER_DATA
*pProvData
, DWORD idxSigner
, BOOL fCounterSigner
,
757 DWORD idxCounterSigner
)
759 CRYPT_PROVIDER_SGNR
*sgnr
;
761 TRACE("(%p %d %d %d)\n", pProvData
, idxSigner
, fCounterSigner
,
764 if (idxSigner
>= pProvData
->csSigners
|| !pProvData
->pasSigners
)
766 sgnr
= &pProvData
->pasSigners
[idxSigner
];
769 if (idxCounterSigner
>= sgnr
->csCounterSigners
||
770 !sgnr
->pasCounterSigners
)
772 sgnr
= &sgnr
->pasCounterSigners
[idxCounterSigner
];
774 TRACE("returning %p\n", sgnr
);
778 /***********************************************************************
779 * WTHelperGetProvCertFromChain (WINTRUST.@)
781 CRYPT_PROVIDER_CERT
* WINAPI
WTHelperGetProvCertFromChain(
782 CRYPT_PROVIDER_SGNR
*pSgnr
, DWORD idxCert
)
784 CRYPT_PROVIDER_CERT
*cert
;
786 TRACE("(%p %d)\n", pSgnr
, idxCert
);
788 if (idxCert
>= pSgnr
->csCertChain
|| !pSgnr
->pasCertChain
)
790 cert
= &pSgnr
->pasCertChain
[idxCert
];
791 TRACE("returning %p\n", cert
);
795 CRYPT_PROVIDER_PRIVDATA
*WINAPI
WTHelperGetProvPrivateDataFromChain(
796 CRYPT_PROVIDER_DATA
* pProvData
,
799 CRYPT_PROVIDER_PRIVDATA
*privdata
= NULL
;
802 TRACE("(%p, %s)\n", pProvData
, debugstr_guid(pgProviderID
));
804 for (i
= 0; i
< pProvData
->csProvPrivData
; i
++)
805 if (IsEqualGUID(pgProviderID
, &pProvData
->pasProvPrivData
[i
].gProviderID
))
807 privdata
= &pProvData
->pasProvPrivData
[i
];
814 /***********************************************************************
815 * WTHelperProvDataFromStateData (WINTRUST.@)
817 CRYPT_PROVIDER_DATA
* WINAPI
WTHelperProvDataFromStateData(HANDLE hStateData
)
819 TRACE("%p\n", hStateData
);
823 /***********************************************************************
824 * WTHelperGetFileName(WINTRUST.@)
826 LPCWSTR WINAPI
WTHelperGetFileName(WINTRUST_DATA
*data
)
829 if (data
->dwUnionChoice
== WTD_CHOICE_FILE
)
830 return data
->u
.pFile
->pcwszFilePath
;
835 /***********************************************************************
836 * WTHelperGetFileHandle(WINTRUST.@)
838 HANDLE WINAPI
WTHelperGetFileHandle(WINTRUST_DATA
*data
)
841 if (data
->dwUnionChoice
== WTD_CHOICE_FILE
)
842 return data
->u
.pFile
->hFile
;
844 return INVALID_HANDLE_VALUE
;
847 static BOOL WINAPI
WINTRUST_enumUsages(PCCRYPT_OID_INFO pInfo
, void *pvArg
)
849 PCCRYPT_OID_INFO
**usages
= pvArg
;
856 *usages
= WINTRUST_Alloc(2 * sizeof(PCCRYPT_OID_INFO
));
860 PCCRYPT_OID_INFO
*ptr
;
862 /* Count the existing usages.
863 * FIXME: make sure the new usage doesn't duplicate any in the list?
865 for (cUsages
= 0, ptr
= *usages
; *ptr
; ptr
++, cUsages
++)
867 *usages
= WINTRUST_ReAlloc(*usages
,
868 (cUsages
+ 2) * sizeof(PCCRYPT_OID_INFO
));
872 (*usages
)[cUsages
] = pInfo
;
873 (*usages
)[cUsages
+ 1] = NULL
;
878 SetLastError(ERROR_OUTOFMEMORY
);
884 /***********************************************************************
885 * WTHelperGetKnownUsages(WINTRUST.@)
887 * Enumerates the known enhanced key usages as an array of PCCRYPT_OID_INFOs.
890 * action [In] 1 => allocate and return known usages, 2 => free previously
892 * usages [In/Out] If action == 1, *usages is set to an array of
893 * PCCRYPT_OID_INFO *. The array is terminated with a NULL
895 * If action == 2, *usages is freed.
898 * TRUE on success, FALSE on failure.
900 BOOL WINAPI
WTHelperGetKnownUsages(DWORD action
, PCCRYPT_OID_INFO
**usages
)
904 TRACE("(%d, %p)\n", action
, usages
);
908 SetLastError(ERROR_INVALID_PARAMETER
);
915 ret
= CryptEnumOIDInfo(CRYPT_ENHKEY_USAGE_OID_GROUP_ID
, 0, usages
,
916 WINTRUST_enumUsages
);
918 else if (action
== 2)
920 WINTRUST_Free(*usages
);
926 WARN("unknown action %d\n", action
);
927 SetLastError(ERROR_INVALID_PARAMETER
);
933 static const WCHAR Software_Publishing
[] = {
934 'S','o','f','t','w','a','r','e','\\',
935 'M','i','c','r','o','s','o','f','t','\\',
936 'W','i','n','d','o','w','s','\\',
937 'C','u','r','r','e','n','t','V','e','r','s','i','o','n','\\',
938 'W','i','n','t','r','u','s','t','\\',
939 'T','r','u','s','t',' ','P','r','o','v','i','d','e','r','s','\\',
940 'S','o','f','t','w','a','r','e',' ',
941 'P','u','b','l','i','s','h','i','n','g',0 };
942 static const WCHAR State
[] = { 'S','t','a','t','e',0 };
944 /***********************************************************************
945 * WintrustGetRegPolicyFlags (WINTRUST.@)
947 void WINAPI
WintrustGetRegPolicyFlags( DWORD
* pdwPolicyFlags
)
952 TRACE("%p\n", pdwPolicyFlags
);
955 r
= RegCreateKeyExW(HKEY_CURRENT_USER
, Software_Publishing
, 0, NULL
, 0,
956 KEY_READ
, NULL
, &key
, NULL
);
959 DWORD size
= sizeof(DWORD
);
961 r
= RegQueryValueExW(key
, State
, NULL
, NULL
, (LPBYTE
)pdwPolicyFlags
,
966 /* Failed to query, create and return default value */
967 *pdwPolicyFlags
= WTPF_IGNOREREVOCATIONONTS
|
968 WTPF_OFFLINEOKNBU_COM
|
969 WTPF_OFFLINEOKNBU_IND
|
972 WintrustSetRegPolicyFlags(*pdwPolicyFlags
);
977 /***********************************************************************
978 * WintrustSetRegPolicyFlags (WINTRUST.@)
980 BOOL WINAPI
WintrustSetRegPolicyFlags( DWORD dwPolicyFlags
)
985 TRACE("%x\n", dwPolicyFlags
);
987 r
= RegCreateKeyExW(HKEY_CURRENT_USER
, Software_Publishing
, 0,
988 NULL
, 0, KEY_WRITE
, NULL
, &key
, NULL
);
991 r
= RegSetValueExW(key
, State
, 0, REG_DWORD
, (LPBYTE
)&dwPolicyFlags
,
995 if (r
) SetLastError(r
);
996 return r
== ERROR_SUCCESS
;
999 /* Utility functions */
1001 BOOL WINAPI
WINTRUST_AddStore(CRYPT_PROVIDER_DATA
*data
, HCERTSTORE store
)
1005 TRACE("(%p, %p)\n", data
, store
);
1008 data
->pahStores
= WINTRUST_ReAlloc(data
->pahStores
,
1009 (data
->chStores
+ 1) * sizeof(HCERTSTORE
));
1012 data
->pahStores
= WINTRUST_Alloc(sizeof(HCERTSTORE
));
1015 if (data
->pahStores
)
1017 data
->pahStores
[data
->chStores
++] = CertDuplicateStore(store
);
1021 SetLastError(ERROR_OUTOFMEMORY
);
1025 BOOL WINAPI
WINTRUST_AddSgnr(CRYPT_PROVIDER_DATA
*data
,
1026 BOOL fCounterSigner
, DWORD idxSigner
, CRYPT_PROVIDER_SGNR
*sgnr
)
1030 TRACE("(%p, %d, %d, %p)\n", data
, fCounterSigner
, idxSigner
, sgnr
);
1032 if (sgnr
->cbStruct
> sizeof(CRYPT_PROVIDER_SGNR
))
1034 SetLastError(ERROR_INVALID_PARAMETER
);
1039 FIXME("unimplemented for counter signers\n");
1040 SetLastError(ERROR_INVALID_PARAMETER
);
1043 if (data
->csSigners
)
1044 data
->pasSigners
= WINTRUST_ReAlloc(data
->pasSigners
,
1045 (data
->csSigners
+ 1) * sizeof(CRYPT_PROVIDER_SGNR
));
1048 data
->pasSigners
= WINTRUST_Alloc(sizeof(CRYPT_PROVIDER_SGNR
));
1049 data
->csSigners
= 0;
1051 if (data
->pasSigners
)
1053 if (idxSigner
< data
->csSigners
)
1054 memmove(&data
->pasSigners
[idxSigner
],
1055 &data
->pasSigners
[idxSigner
+ 1],
1056 (data
->csSigners
- idxSigner
) * sizeof(CRYPT_PROVIDER_SGNR
));
1058 if (sgnr
->cbStruct
== sizeof(CRYPT_PROVIDER_SGNR
))
1060 /* The PSDK says psSigner should be allocated using pfnAlloc, but
1061 * it doesn't say anything about ownership. Since callers are
1062 * internal, assume ownership is passed, and just store the
1065 memcpy(&data
->pasSigners
[idxSigner
], sgnr
,
1066 sizeof(CRYPT_PROVIDER_SGNR
));
1069 memset(&data
->pasSigners
[idxSigner
], 0,
1070 sizeof(CRYPT_PROVIDER_SGNR
));
1074 SetLastError(ERROR_OUTOFMEMORY
);
1078 BOOL WINAPI
WINTRUST_AddCert(CRYPT_PROVIDER_DATA
*data
, DWORD idxSigner
,
1079 BOOL fCounterSigner
, DWORD idxCounterSigner
, PCCERT_CONTEXT pCert2Add
)
1083 TRACE("(%p, %d, %d, %d, %p)\n", data
, idxSigner
, fCounterSigner
,
1084 idxSigner
, pCert2Add
);
1088 FIXME("unimplemented for counter signers\n");
1089 SetLastError(ERROR_INVALID_PARAMETER
);
1092 if (data
->pasSigners
[idxSigner
].csCertChain
)
1093 data
->pasSigners
[idxSigner
].pasCertChain
=
1094 WINTRUST_ReAlloc(data
->pasSigners
[idxSigner
].pasCertChain
,
1095 (data
->pasSigners
[idxSigner
].csCertChain
+ 1) *
1096 sizeof(CRYPT_PROVIDER_CERT
));
1099 data
->pasSigners
[idxSigner
].pasCertChain
=
1100 WINTRUST_Alloc(sizeof(CRYPT_PROVIDER_CERT
));
1101 data
->pasSigners
[idxSigner
].csCertChain
= 0;
1103 if (data
->pasSigners
[idxSigner
].pasCertChain
)
1105 CRYPT_PROVIDER_CERT
*cert
= &data
->pasSigners
[idxSigner
].pasCertChain
[
1106 data
->pasSigners
[idxSigner
].csCertChain
];
1108 cert
->cbStruct
= sizeof(CRYPT_PROVIDER_CERT
);
1109 cert
->pCert
= CertDuplicateCertificateContext(pCert2Add
);
1110 data
->pasSigners
[idxSigner
].csCertChain
++;
1114 SetLastError(ERROR_OUTOFMEMORY
);
1118 BOOL WINAPI
WINTRUST_AddPrivData(CRYPT_PROVIDER_DATA
*data
,
1119 CRYPT_PROVIDER_PRIVDATA
*pPrivData2Add
)
1123 TRACE("(%p, %p)\n", data
, pPrivData2Add
);
1125 if (pPrivData2Add
->cbStruct
> sizeof(CRYPT_PROVIDER_PRIVDATA
))
1127 SetLastError(ERROR_INVALID_PARAMETER
);
1128 WARN("invalid struct size\n");
1131 if (data
->csProvPrivData
)
1132 data
->pasProvPrivData
= WINTRUST_ReAlloc(data
->pasProvPrivData
,
1133 (data
->csProvPrivData
+ 1) * sizeof(CRYPT_PROVIDER_SGNR
));
1136 data
->pasProvPrivData
= WINTRUST_Alloc(sizeof(CRYPT_PROVIDER_SGNR
));
1137 data
->csProvPrivData
= 0;
1139 if (data
->pasProvPrivData
)
1143 for (i
= 0; i
< data
->csProvPrivData
; i
++)
1144 if (IsEqualGUID(&pPrivData2Add
->gProviderID
, &data
->pasProvPrivData
[i
]))
1147 data
->pasProvPrivData
[i
] = *pPrivData2Add
;
1148 if (i
== data
->csProvPrivData
)
1149 data
->csProvPrivData
++;
1152 SetLastError(ERROR_OUTOFMEMORY
);
1156 /***********************************************************************
1157 * OpenPersonalTrustDBDialog (WINTRUST.@)
1159 * Opens the certificate manager dialog, showing only the stores that
1160 * contain trusted software publishers.
1163 * hwnd [I] handle of parent window
1166 * TRUE if the dialog could be opened, FALSE if not.
1168 BOOL WINAPI
OpenPersonalTrustDBDialog(HWND hwnd
)
1170 CRYPTUI_CERT_MGR_STRUCT uiCertMgr
;
1172 uiCertMgr
.dwSize
= sizeof(uiCertMgr
);
1173 uiCertMgr
.hwndParent
= hwnd
;
1174 uiCertMgr
.dwFlags
= CRYPTUI_CERT_MGR_PUBLISHER_TAB
;
1175 uiCertMgr
.pwszTitle
= NULL
;
1176 uiCertMgr
.pszInitUsageOID
= NULL
;
1177 return CryptUIDlgCertMgr(&uiCertMgr
);
1180 /***********************************************************************
1181 * WTHelperCertCheckValidSignature
1183 HRESULT WINAPI
WTHelperCertCheckValidSignature(CRYPT_PROVIDER_DATA
*pProvData
)
1189 /***********************************************************************
1192 BOOL WINAPI
IsCatalogFile(HANDLE hFile
, WCHAR
*pwszFileName
)
1194 static const GUID catGUID
= { 0xDE351A43, 0x8E59, 0x11D0, { 0x8C,0x47,0x00,0xC0,0x4F,0xC2,0x95,0xEE }};
1197 TRACE("(%p, %s)\n", hFile
, debugstr_w(pwszFileName
));
1199 if (!CryptSIPRetrieveSubjectGuid(pwszFileName
, hFile
, &guid
))
1201 return IsEqualGUID(&guid
, &catGUID
);
1204 /***********************************************************************
1207 HRESULT WINAPI
FindCertsByIssuer(PCERT_CHAIN pCertChains
, DWORD
*pcbCertChains
,
1208 DWORD
*pcCertChains
, BYTE
* pbEncodedIssuerName
, DWORD cbEncodedIssuerName
,
1209 LPCWSTR pwszPurpose
, DWORD dwKeySpec
)
1211 FIXME("(%p, %p, %p, %p, %d, %s, %d): stub\n", pCertChains
, pcbCertChains
,
1212 pcCertChains
, pbEncodedIssuerName
, cbEncodedIssuerName
,
1213 debugstr_w(pwszPurpose
), dwKeySpec
);