gameux: Initialize registry path pointer to NULL in GAMEUX_getAppIdFromGDFPath.
[wine] / dlls / cryptnet / cryptnet_main.c
1 /*
2  * Copyright (C) 2006 Maarten Lankhorst
3  * Copyright 2007 Juan Lang
4  *
5  * This library is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Lesser General Public
7  * License as published by the Free Software Foundation; either
8  * version 2.1 of the License, or (at your option) any later version.
9  *
10  * This library is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13  * Lesser General Public License for more details.
14  *
15  * You should have received a copy of the GNU Lesser General Public
16  * License along with this library; if not, write to the Free Software
17  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
18  *
19  */
20
21 #include "config.h"
22 #include "wine/port.h"
23
24 #define NONAMELESSUNION
25 #define NONAMELESSSTRUCT
26 #define CERT_REVOCATION_PARA_HAS_EXTRA_FIELDS
27
28 #include <stdio.h>
29 #include <stdarg.h>
30
31 #include "windef.h"
32 #include "winbase.h"
33 #include "winnt.h"
34 #include "winnls.h"
35 #include "wininet.h"
36 #include "objbase.h"
37 #include "wincrypt.h"
38
39 #include "wine/debug.h"
40
41 WINE_DEFAULT_DEBUG_CHANNEL(cryptnet);
42
43 #define IS_INTOID(x)    (((ULONG_PTR)(x) >> 16) == 0)
44
45 BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
46 {
47    TRACE("(0x%p, %d, %p)\n", hinstDLL, fdwReason, lpvReserved);
48
49    switch (fdwReason) {
50       case DLL_PROCESS_ATTACH:
51          DisableThreadLibraryCalls(hinstDLL);
52          break;
53       case DLL_PROCESS_DETACH:
54          /* Do uninitialisation here */
55          break;
56       default: break;
57    }
58    return TRUE;
59 }
60
61 static const WCHAR cryptNet[] = { 'c','r','y','p','t','n','e','t','.',
62    'd','l','l',0 };
63 static const WCHAR ldapProvOpenStore[] = { 'L','d','a','p','P','r','o','v',
64    'O','p','e','S','t','o','r','e',0 };
65
66 /***********************************************************************
67  *    DllRegisterServer (CRYPTNET.@)
68  */
69 HRESULT WINAPI DllRegisterServer(void)
70 {
71    TRACE("\n");
72    CryptRegisterDefaultOIDFunction(X509_ASN_ENCODING,
73     CRYPT_OID_VERIFY_REVOCATION_FUNC, 0, cryptNet);
74    CryptRegisterOIDFunction(0, CRYPT_OID_OPEN_STORE_PROV_FUNC, "Ldap",
75     cryptNet, "LdapProvOpenStore");
76    CryptRegisterOIDFunction(0, CRYPT_OID_OPEN_STORE_PROV_FUNC,
77     CERT_STORE_PROV_LDAP_W, cryptNet, "LdapProvOpenStore");
78    return S_OK;
79 }
80
81 /***********************************************************************
82  *    DllUnregisterServer (CRYPTNET.@)
83  */
84 HRESULT WINAPI DllUnregisterServer(void)
85 {
86    TRACE("\n");
87    CryptUnregisterDefaultOIDFunction(X509_ASN_ENCODING,
88     CRYPT_OID_VERIFY_REVOCATION_FUNC, cryptNet);
89    CryptUnregisterOIDFunction(0, CRYPT_OID_OPEN_STORE_PROV_FUNC, "Ldap");
90    CryptUnregisterOIDFunction(0, CRYPT_OID_OPEN_STORE_PROV_FUNC,
91     CERT_STORE_PROV_LDAP_W);
92    return S_OK;
93 }
94
95 static const char *url_oid_to_str(LPCSTR oid)
96 {
97     if (IS_INTOID(oid))
98     {
99         static char buf[10];
100
101         switch (LOWORD(oid))
102         {
103 #define _x(oid) case LOWORD(oid): return #oid
104         _x(URL_OID_CERTIFICATE_ISSUER);
105         _x(URL_OID_CERTIFICATE_CRL_DIST_POINT);
106         _x(URL_OID_CTL_ISSUER);
107         _x(URL_OID_CTL_NEXT_UPDATE);
108         _x(URL_OID_CRL_ISSUER);
109         _x(URL_OID_CERTIFICATE_FRESHEST_CRL);
110         _x(URL_OID_CRL_FRESHEST_CRL);
111         _x(URL_OID_CROSS_CERT_DIST_POINT);
112 #undef _x
113         default:
114             snprintf(buf, sizeof(buf), "%d", LOWORD(oid));
115             return buf;
116         }
117     }
118     else
119         return oid;
120 }
121
122 typedef BOOL (WINAPI *UrlDllGetObjectUrlFunc)(LPCSTR, LPVOID, DWORD,
123  PCRYPT_URL_ARRAY, DWORD *, PCRYPT_URL_INFO, DWORD *, LPVOID);
124
125 static BOOL WINAPI CRYPT_GetUrlFromCertificateIssuer(LPCSTR pszUrlOid,
126  LPVOID pvPara, DWORD dwFlags, PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray,
127  PCRYPT_URL_INFO pUrlInfo, DWORD *pcbUrlInfo, LPVOID pvReserved)
128 {
129     PCCERT_CONTEXT cert = pvPara;
130     PCERT_EXTENSION ext;
131     BOOL ret = FALSE;
132
133     /* The only applicable flag is CRYPT_GET_URL_FROM_EXTENSION */
134     if (dwFlags && !(dwFlags & CRYPT_GET_URL_FROM_EXTENSION))
135     {
136         SetLastError(CRYPT_E_NOT_FOUND);
137         return FALSE;
138     }
139     if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS,
140      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
141     {
142         CERT_AUTHORITY_INFO_ACCESS *aia;
143         DWORD size;
144
145         ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_AUTHORITY_INFO_ACCESS,
146          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL,
147          &aia, &size);
148         if (ret)
149         {
150             DWORD i, cUrl, bytesNeeded = sizeof(CRYPT_URL_ARRAY);
151
152             for (i = 0, cUrl = 0; i < aia->cAccDescr; i++)
153                 if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
154                  szOID_PKIX_CA_ISSUERS))
155                 {
156                     if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice ==
157                      CERT_ALT_NAME_URL)
158                     {
159                         if (aia->rgAccDescr[i].AccessLocation.u.pwszURL)
160                         {
161                             cUrl++;
162                             bytesNeeded += sizeof(LPWSTR) +
163                              (lstrlenW(aia->rgAccDescr[i].AccessLocation.u.
164                              pwszURL) + 1) * sizeof(WCHAR);
165                         }
166                     }
167                     else
168                         FIXME("unsupported alt name type %d\n",
169                          aia->rgAccDescr[i].AccessLocation.dwAltNameChoice);
170                 }
171             if (!pcbUrlArray)
172             {
173                 SetLastError(E_INVALIDARG);
174                 ret = FALSE;
175             }
176             else if (!pUrlArray)
177                 *pcbUrlArray = bytesNeeded;
178             else if (*pcbUrlArray < bytesNeeded)
179             {
180                 SetLastError(ERROR_MORE_DATA);
181                 *pcbUrlArray = bytesNeeded;
182                 ret = FALSE;
183             }
184             else
185             {
186                 LPWSTR nextUrl;
187
188                 *pcbUrlArray = bytesNeeded;
189                 pUrlArray->cUrl = 0;
190                 pUrlArray->rgwszUrl =
191                  (LPWSTR *)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY));
192                 nextUrl = (LPWSTR)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY)
193                  + cUrl * sizeof(LPWSTR));
194                 for (i = 0; i < aia->cAccDescr; i++)
195                     if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
196                      szOID_PKIX_CA_ISSUERS))
197                     {
198                         if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice
199                          == CERT_ALT_NAME_URL)
200                         {
201                             if (aia->rgAccDescr[i].AccessLocation.u.pwszURL)
202                             {
203                                 lstrcpyW(nextUrl,
204                                  aia->rgAccDescr[i].AccessLocation.u.pwszURL);
205                                 pUrlArray->rgwszUrl[pUrlArray->cUrl++] =
206                                  nextUrl;
207                                 nextUrl += (lstrlenW(nextUrl) + 1);
208                             }
209                         }
210                     }
211             }
212             if (ret)
213             {
214                 if (pcbUrlInfo)
215                 {
216                     FIXME("url info: stub\n");
217                     if (!pUrlInfo)
218                         *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
219                     else if (*pcbUrlInfo < sizeof(CRYPT_URL_INFO))
220                     {
221                         *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
222                         SetLastError(ERROR_MORE_DATA);
223                         ret = FALSE;
224                     }
225                     else
226                     {
227                         *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
228                         memset(pUrlInfo, 0, sizeof(CRYPT_URL_INFO));
229                     }
230                 }
231             }
232             LocalFree(aia);
233         }
234     }
235     else
236         SetLastError(CRYPT_E_NOT_FOUND);
237     return ret;
238 }
239
240 static BOOL CRYPT_GetUrlFromCRLDistPointsExt(const CRYPT_DATA_BLOB *value,
241  PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray, PCRYPT_URL_INFO pUrlInfo,
242  DWORD *pcbUrlInfo)
243 {
244     BOOL ret;
245     CRL_DIST_POINTS_INFO *info;
246     DWORD size;
247
248     ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_CRL_DIST_POINTS,
249      value->pbData, value->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
250     if (ret)
251     {
252         DWORD i, cUrl, bytesNeeded = sizeof(CRYPT_URL_ARRAY);
253
254         for (i = 0, cUrl = 0; i < info->cDistPoint; i++)
255             if (info->rgDistPoint[i].DistPointName.dwDistPointNameChoice
256              == CRL_DIST_POINT_FULL_NAME)
257             {
258                 DWORD j;
259                 CERT_ALT_NAME_INFO *name =
260                  &info->rgDistPoint[i].DistPointName.u.FullName;
261
262                 for (j = 0; j < name->cAltEntry; j++)
263                     if (name->rgAltEntry[j].dwAltNameChoice ==
264                      CERT_ALT_NAME_URL)
265                     {
266                         if (name->rgAltEntry[j].u.pwszURL)
267                         {
268                             cUrl++;
269                             bytesNeeded += sizeof(LPWSTR) +
270                              (lstrlenW(name->rgAltEntry[j].u.pwszURL) + 1)
271                              * sizeof(WCHAR);
272                         }
273                     }
274             }
275         if (!pcbUrlArray)
276         {
277             SetLastError(E_INVALIDARG);
278             ret = FALSE;
279         }
280         else if (!pUrlArray)
281             *pcbUrlArray = bytesNeeded;
282         else if (*pcbUrlArray < bytesNeeded)
283         {
284             SetLastError(ERROR_MORE_DATA);
285             *pcbUrlArray = bytesNeeded;
286             ret = FALSE;
287         }
288         else
289         {
290             LPWSTR nextUrl;
291
292             *pcbUrlArray = bytesNeeded;
293             pUrlArray->cUrl = 0;
294             pUrlArray->rgwszUrl =
295              (LPWSTR *)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY));
296             nextUrl = (LPWSTR)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY)
297              + cUrl * sizeof(LPWSTR));
298             for (i = 0; i < info->cDistPoint; i++)
299                 if (info->rgDistPoint[i].DistPointName.dwDistPointNameChoice
300                  == CRL_DIST_POINT_FULL_NAME)
301                 {
302                     DWORD j;
303                     CERT_ALT_NAME_INFO *name =
304                      &info->rgDistPoint[i].DistPointName.u.FullName;
305
306                     for (j = 0; j < name->cAltEntry; j++)
307                         if (name->rgAltEntry[j].dwAltNameChoice ==
308                          CERT_ALT_NAME_URL)
309                         {
310                             if (name->rgAltEntry[j].u.pwszURL)
311                             {
312                                 lstrcpyW(nextUrl,
313                                  name->rgAltEntry[j].u.pwszURL);
314                                 pUrlArray->rgwszUrl[pUrlArray->cUrl++] =
315                                  nextUrl;
316                                 nextUrl +=
317                                  (lstrlenW(name->rgAltEntry[j].u.pwszURL) + 1);
318                             }
319                         }
320                 }
321         }
322         if (ret)
323         {
324             if (pcbUrlInfo)
325             {
326                 FIXME("url info: stub\n");
327                 if (!pUrlInfo)
328                     *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
329                 else if (*pcbUrlInfo < sizeof(CRYPT_URL_INFO))
330                 {
331                     *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
332                     SetLastError(ERROR_MORE_DATA);
333                     ret = FALSE;
334                 }
335                 else
336                 {
337                     *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
338                     memset(pUrlInfo, 0, sizeof(CRYPT_URL_INFO));
339                 }
340             }
341         }
342         LocalFree(info);
343     }
344     return ret;
345 }
346
347 static BOOL WINAPI CRYPT_GetUrlFromCertificateCRLDistPoint(LPCSTR pszUrlOid,
348  LPVOID pvPara, DWORD dwFlags, PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray,
349  PCRYPT_URL_INFO pUrlInfo, DWORD *pcbUrlInfo, LPVOID pvReserved)
350 {
351     PCCERT_CONTEXT cert = pvPara;
352     PCERT_EXTENSION ext;
353     BOOL ret = FALSE;
354
355     /* The only applicable flag is CRYPT_GET_URL_FROM_EXTENSION */
356     if (dwFlags && !(dwFlags & CRYPT_GET_URL_FROM_EXTENSION))
357     {
358         SetLastError(CRYPT_E_NOT_FOUND);
359         return FALSE;
360     }
361     if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
362      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
363         ret = CRYPT_GetUrlFromCRLDistPointsExt(&ext->Value, pUrlArray,
364          pcbUrlArray, pUrlInfo, pcbUrlInfo);
365     else
366         SetLastError(CRYPT_E_NOT_FOUND);
367     return ret;
368 }
369
370 /***********************************************************************
371  *    CryptGetObjectUrl (CRYPTNET.@)
372  */
373 BOOL WINAPI CryptGetObjectUrl(LPCSTR pszUrlOid, LPVOID pvPara, DWORD dwFlags,
374  PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray, PCRYPT_URL_INFO pUrlInfo,
375  DWORD *pcbUrlInfo, LPVOID pvReserved)
376 {
377     UrlDllGetObjectUrlFunc func = NULL;
378     HCRYPTOIDFUNCADDR hFunc = NULL;
379     BOOL ret = FALSE;
380
381     TRACE("(%s, %p, %08x, %p, %p, %p, %p, %p)\n", debugstr_a(pszUrlOid),
382      pvPara, dwFlags, pUrlArray, pcbUrlArray, pUrlInfo, pcbUrlInfo, pvReserved);
383
384     if (IS_INTOID(pszUrlOid))
385     {
386         switch (LOWORD(pszUrlOid))
387         {
388         case LOWORD(URL_OID_CERTIFICATE_ISSUER):
389             func = CRYPT_GetUrlFromCertificateIssuer;
390             break;
391         case LOWORD(URL_OID_CERTIFICATE_CRL_DIST_POINT):
392             func = CRYPT_GetUrlFromCertificateCRLDistPoint;
393             break;
394         default:
395             FIXME("unimplemented for %s\n", url_oid_to_str(pszUrlOid));
396             SetLastError(ERROR_FILE_NOT_FOUND);
397         }
398     }
399     else
400     {
401         static HCRYPTOIDFUNCSET set = NULL;
402
403         if (!set)
404             set = CryptInitOIDFunctionSet(URL_OID_GET_OBJECT_URL_FUNC, 0);
405         CryptGetOIDFunctionAddress(set, X509_ASN_ENCODING, pszUrlOid, 0,
406          (void **)&func, &hFunc);
407     }
408     if (func)
409         ret = func(pszUrlOid, pvPara, dwFlags, pUrlArray, pcbUrlArray,
410          pUrlInfo, pcbUrlInfo, pvReserved);
411     if (hFunc)
412         CryptFreeOIDFunctionAddress(hFunc, 0);
413     return ret;
414 }
415
416 /***********************************************************************
417  *    CryptRetrieveObjectByUrlA (CRYPTNET.@)
418  */
419 BOOL WINAPI CryptRetrieveObjectByUrlA(LPCSTR pszURL, LPCSTR pszObjectOid,
420  DWORD dwRetrievalFlags, DWORD dwTimeout, LPVOID *ppvObject,
421  HCRYPTASYNC hAsyncRetrieve, PCRYPT_CREDENTIALS pCredentials, LPVOID pvVerify,
422  PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
423 {
424     BOOL ret = FALSE;
425     int len;
426
427     TRACE("(%s, %s, %08x, %d, %p, %p, %p, %p, %p)\n", debugstr_a(pszURL),
428      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, ppvObject,
429      hAsyncRetrieve, pCredentials, pvVerify, pAuxInfo);
430
431     if (!pszURL)
432     {
433         SetLastError(ERROR_INVALID_PARAMETER);
434         return FALSE;
435     }
436     len = MultiByteToWideChar(CP_ACP, 0, pszURL, -1, NULL, 0);
437     if (len)
438     {
439         LPWSTR url = CryptMemAlloc(len * sizeof(WCHAR));
440
441         if (url)
442         {
443             MultiByteToWideChar(CP_ACP, 0, pszURL, -1, url, len);
444             ret = CryptRetrieveObjectByUrlW(url, pszObjectOid,
445              dwRetrievalFlags, dwTimeout, ppvObject, hAsyncRetrieve,
446              pCredentials, pvVerify, pAuxInfo);
447             CryptMemFree(url);
448         }
449         else
450             SetLastError(ERROR_OUTOFMEMORY);
451     }
452     return ret;
453 }
454
455 static void WINAPI CRYPT_FreeBlob(LPCSTR pszObjectOid,
456  PCRYPT_BLOB_ARRAY pObject, void *pvFreeContext)
457 {
458     DWORD i;
459
460     for (i = 0; i < pObject->cBlob; i++)
461         CryptMemFree(pObject->rgBlob[i].pbData);
462     CryptMemFree(pObject->rgBlob);
463 }
464
465 static BOOL CRYPT_GetObjectFromFile(HANDLE hFile, PCRYPT_BLOB_ARRAY pObject)
466 {
467     BOOL ret;
468     LARGE_INTEGER size;
469
470     if ((ret = GetFileSizeEx(hFile, &size)))
471     {
472         if (size.u.HighPart)
473         {
474             WARN("file too big\n");
475             SetLastError(ERROR_INVALID_DATA);
476             ret = FALSE;
477         }
478         else
479         {
480             CRYPT_DATA_BLOB blob;
481
482             blob.pbData = CryptMemAlloc(size.u.LowPart);
483             if (blob.pbData)
484             {
485                 blob.cbData = size.u.LowPart;
486                 ret = ReadFile(hFile, blob.pbData, size.u.LowPart, &blob.cbData,
487                  NULL);
488                 if (ret)
489                 {
490                     pObject->rgBlob = CryptMemAlloc(sizeof(CRYPT_DATA_BLOB));
491                     if (pObject->rgBlob)
492                     {
493                         pObject->cBlob = 1;
494                         memcpy(pObject->rgBlob, &blob, sizeof(CRYPT_DATA_BLOB));
495                     }
496                     else
497                     {
498                         SetLastError(ERROR_OUTOFMEMORY);
499                         ret = FALSE;
500                     }
501                 }
502                 if (!ret)
503                     CryptMemFree(blob.pbData);
504             }
505             else
506             {
507                 SetLastError(ERROR_OUTOFMEMORY);
508                 ret = FALSE;
509             }
510         }
511     }
512     return ret;
513 }
514
515 static BOOL CRYPT_GetObjectFromCache(LPCWSTR pszURL, PCRYPT_BLOB_ARRAY pObject,
516  PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
517 {
518     BOOL ret = FALSE;
519     INTERNET_CACHE_ENTRY_INFOW *pCacheInfo = NULL;
520     DWORD size = 0;
521
522     TRACE("(%s, %p, %p)\n", debugstr_w(pszURL), pObject, pAuxInfo);
523
524     ret = GetUrlCacheEntryInfoW(pszURL, NULL, &size);
525     if (!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
526     {
527         pCacheInfo = CryptMemAlloc(size);
528         if (pCacheInfo)
529             ret = TRUE;
530         else
531             SetLastError(ERROR_OUTOFMEMORY);
532     }
533     if (ret && (ret = GetUrlCacheEntryInfoW(pszURL, pCacheInfo, &size)))
534     {
535         FILETIME ft;
536
537         GetSystemTimeAsFileTime(&ft);
538         if (CompareFileTime(&pCacheInfo->ExpireTime, &ft) >= 0)
539         {
540             HANDLE hFile = CreateFileW(pCacheInfo->lpszLocalFileName,
541              GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
542
543             if (hFile != INVALID_HANDLE_VALUE)
544             {
545                 if ((ret = CRYPT_GetObjectFromFile(hFile, pObject)))
546                 {
547                     if (pAuxInfo && pAuxInfo->cbSize >=
548                      offsetof(CRYPT_RETRIEVE_AUX_INFO,
549                      pLastSyncTime) + sizeof(PFILETIME) &&
550                      pAuxInfo->pLastSyncTime)
551                         memcpy(pAuxInfo->pLastSyncTime,
552                          &pCacheInfo->LastSyncTime,
553                          sizeof(FILETIME));
554                 }
555                 CloseHandle(hFile);
556             }
557             else
558             {
559                 DeleteUrlCacheEntryW(pszURL);
560                 ret = FALSE;
561             }
562         }
563         else
564         {
565             DeleteUrlCacheEntryW(pszURL);
566             ret = FALSE;
567         }
568     }
569     CryptMemFree(pCacheInfo);
570     TRACE("returning %d\n", ret);
571     return ret;
572 }
573
574 /* Parses the URL, and sets components's lpszHostName and lpszUrlPath members
575  * to NULL-terminated copies of those portions of the URL (to be freed with
576  * CryptMemFree.)
577  */
578 static BOOL CRYPT_CrackUrl(LPCWSTR pszURL, URL_COMPONENTSW *components)
579 {
580     BOOL ret;
581
582     TRACE("(%s, %p)\n", debugstr_w(pszURL), components);
583
584     memset(components, 0, sizeof(*components));
585     components->dwStructSize = sizeof(*components);
586     components->lpszHostName = CryptMemAlloc(MAX_PATH * sizeof(WCHAR));
587     components->dwHostNameLength = MAX_PATH;
588     components->lpszUrlPath = CryptMemAlloc(MAX_PATH * 2 * sizeof(WCHAR));
589     components->dwUrlPathLength = 2 * MAX_PATH;
590     ret = InternetCrackUrlW(pszURL, 0, ICU_DECODE, components);
591     if (ret)
592     {
593         if ((components->dwUrlPathLength == 2 * MAX_PATH - 1) ||
594             (components->dwHostNameLength == MAX_PATH - 1))
595             FIXME("Buffers are too small\n");
596         switch (components->nScheme)
597         {
598         case INTERNET_SCHEME_FTP:
599             if (!components->nPort)
600                 components->nPort = INTERNET_DEFAULT_FTP_PORT;
601             break;
602         case INTERNET_SCHEME_HTTP:
603             if (!components->nPort)
604                 components->nPort = INTERNET_DEFAULT_HTTP_PORT;
605             break;
606         default:
607             ; /* do nothing */
608         }
609     }
610     TRACE("returning %d\n", ret);
611     return ret;
612 }
613
614 struct InetContext
615 {
616     HANDLE event;
617     DWORD  timeout;
618     DWORD  error;
619 };
620
621 static struct InetContext *CRYPT_MakeInetContext(DWORD dwTimeout)
622 {
623     struct InetContext *context = CryptMemAlloc(sizeof(struct InetContext));
624
625     if (context)
626     {
627         context->event = CreateEventW(NULL, FALSE, FALSE, NULL);
628         if (!context->event)
629         {
630             CryptMemFree(context);
631             context = NULL;
632         }
633         else
634         {
635             context->timeout = dwTimeout;
636             context->error = ERROR_SUCCESS;
637         }
638     }
639     return context;
640 }
641
642 static BOOL CRYPT_DownloadObject(DWORD dwRetrievalFlags, HINTERNET hHttp,
643  struct InetContext *context, PCRYPT_BLOB_ARRAY pObject,
644  PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
645 {
646     CRYPT_DATA_BLOB object = { 0, NULL };
647     DWORD bytesAvailable;
648     BOOL ret;
649
650     do {
651         if ((ret = InternetQueryDataAvailable(hHttp, &bytesAvailable, 0, 0)))
652         {
653             if (bytesAvailable)
654             {
655                 if (object.pbData)
656                     object.pbData = CryptMemRealloc(object.pbData,
657                      object.cbData + bytesAvailable);
658                 else
659                     object.pbData = CryptMemAlloc(bytesAvailable);
660                 if (object.pbData)
661                 {
662                     INTERNET_BUFFERSA buffer = { sizeof(buffer), 0 };
663
664                     buffer.dwBufferLength = bytesAvailable;
665                     buffer.lpvBuffer = object.pbData + object.cbData;
666                     if (!(ret = InternetReadFileExA(hHttp, &buffer, IRF_NO_WAIT,
667                      (DWORD_PTR)context)))
668                     {
669                         if (GetLastError() == ERROR_IO_PENDING)
670                         {
671                             if (WaitForSingleObject(context->event,
672                              context->timeout) == WAIT_TIMEOUT)
673                                 SetLastError(ERROR_TIMEOUT);
674                             else if (context->error)
675                                 SetLastError(context->error);
676                             else
677                                 ret = TRUE;
678                         }
679                     }
680                     if (ret)
681                         object.cbData += buffer.dwBufferLength;
682                 }
683                 else
684                 {
685                     SetLastError(ERROR_OUTOFMEMORY);
686                     ret = FALSE;
687                 }
688             }
689         }
690         else if (GetLastError() == ERROR_IO_PENDING)
691         {
692             if (WaitForSingleObject(context->event, context->timeout) ==
693              WAIT_TIMEOUT)
694                 SetLastError(ERROR_TIMEOUT);
695             else
696                 ret = TRUE;
697         }
698     } while (ret && bytesAvailable);
699     if (ret)
700     {
701         pObject->rgBlob = CryptMemAlloc(sizeof(CRYPT_DATA_BLOB));
702         if (!pObject->rgBlob)
703         {
704             CryptMemFree(object.pbData);
705             SetLastError(ERROR_OUTOFMEMORY);
706             ret = FALSE;
707         }
708         else
709         {
710             pObject->rgBlob[0].cbData = object.cbData;
711             pObject->rgBlob[0].pbData = object.pbData;
712             pObject->cBlob = 1;
713         }
714     }
715     TRACE("returning %d\n", ret);
716     return ret;
717 }
718
719 /* Finds the object specified by pszURL in the cache.  If it's not found,
720  * creates a new cache entry for the object and writes the object to it.
721  * Sets the expiration time of the cache entry to expires.
722  */
723 static void CRYPT_CacheURL(LPCWSTR pszURL, const CRYPT_BLOB_ARRAY *pObject,
724  DWORD dwRetrievalFlags, FILETIME expires)
725 {
726     WCHAR cacheFileName[MAX_PATH];
727     DWORD size = 0;
728     BOOL ret, create = FALSE;
729
730     GetUrlCacheEntryInfoW(pszURL, NULL, &size);
731     if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
732     {
733         INTERNET_CACHE_ENTRY_INFOW *info = CryptMemAlloc(size);
734
735         if (info)
736         {
737             FILETIME ft;
738
739             ret = GetUrlCacheEntryInfoW(pszURL, info, &size);
740             if (ret)
741                 lstrcpyW(cacheFileName, info->lpszLocalFileName);
742             /* Check if the existing cache entry is up to date.  If it isn't,
743              * overwite it with the new value.
744              */
745             GetSystemTimeAsFileTime(&ft);
746             if (CompareFileTime(&info->ExpireTime, &ft) < 0)
747                 create = TRUE;
748             CryptMemFree(info);
749         }
750         else
751             ret = FALSE;
752     }
753     else
754     {
755         ret = CreateUrlCacheEntryW(pszURL, pObject->rgBlob[0].cbData, NULL,
756          cacheFileName, 0);
757         create = TRUE;
758     }
759     if (ret)
760     {
761         DWORD entryType;
762         FILETIME ft = { 0 };
763
764         if (create)
765         {
766             HANDLE hCacheFile = CreateFileW(cacheFileName, GENERIC_WRITE, 0,
767              NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
768
769             if (hCacheFile != INVALID_HANDLE_VALUE)
770             {
771                 DWORD bytesWritten;
772
773                 WriteFile(hCacheFile, pObject->rgBlob[0].pbData,
774                  pObject->rgBlob[0].cbData, &bytesWritten, NULL);
775                 CloseHandle(hCacheFile);
776             }
777             else
778                 ret = FALSE;
779         }
780         if (ret)
781         {
782             if (!(dwRetrievalFlags & CRYPT_STICKY_CACHE_RETRIEVAL))
783                 entryType = NORMAL_CACHE_ENTRY;
784             else
785                 entryType = STICKY_CACHE_ENTRY;
786             CommitUrlCacheEntryW(pszURL, cacheFileName, expires, ft, entryType,
787              NULL, 0, NULL, NULL);
788         }
789     }
790 }
791
792 static void CALLBACK CRYPT_InetStatusCallback(HINTERNET hInt,
793  DWORD_PTR dwContext, DWORD status, void *statusInfo, DWORD statusInfoLen)
794 {
795     struct InetContext *context = (struct InetContext *)dwContext;
796     LPINTERNET_ASYNC_RESULT result;
797
798     switch (status)
799     {
800     case INTERNET_STATUS_REQUEST_COMPLETE:
801         result = statusInfo;
802         context->error = result->dwError;
803         SetEvent(context->event);
804     }
805 }
806
807 static BOOL CRYPT_Connect(const URL_COMPONENTSW *components,
808  struct InetContext *context, PCRYPT_CREDENTIALS pCredentials,
809  HINTERNET *phInt, HINTERNET *phHost)
810 {
811     BOOL ret;
812
813     TRACE("(%s:%d, %p, %p, %p, %p)\n", debugstr_w(components->lpszHostName),
814      components->nPort, context, pCredentials, phInt, phInt);
815
816     *phHost = NULL;
817     *phInt = InternetOpenW(NULL, INTERNET_OPEN_TYPE_DIRECT, NULL, NULL,
818      context ? INTERNET_FLAG_ASYNC : 0);
819     if (*phInt)
820     {
821         DWORD service;
822
823         if (context)
824             InternetSetStatusCallbackW(*phInt, CRYPT_InetStatusCallback);
825         switch (components->nScheme)
826         {
827         case INTERNET_SCHEME_FTP:
828             service = INTERNET_SERVICE_FTP;
829             break;
830         case INTERNET_SCHEME_HTTP:
831             service = INTERNET_SERVICE_HTTP;
832             break;
833         default:
834             service = 0;
835         }
836         /* FIXME: use pCredentials for username/password */
837         *phHost = InternetConnectW(*phInt, components->lpszHostName,
838          components->nPort, NULL, NULL, service, 0, (DWORD_PTR)context);
839         if (!*phHost)
840         {
841             InternetCloseHandle(*phInt);
842             *phInt = NULL;
843             ret = FALSE;
844         }
845         else
846             ret = TRUE;
847     }
848     else
849         ret = FALSE;
850     TRACE("returning %d\n", ret);
851     return ret;
852 }
853
854 static BOOL WINAPI FTP_RetrieveEncodedObjectW(LPCWSTR pszURL,
855  LPCSTR pszObjectOid, DWORD dwRetrievalFlags, DWORD dwTimeout,
856  PCRYPT_BLOB_ARRAY pObject, PFN_FREE_ENCODED_OBJECT_FUNC *ppfnFreeObject,
857  void **ppvFreeContext, HCRYPTASYNC hAsyncRetrieve,
858  PCRYPT_CREDENTIALS pCredentials, PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
859 {
860     FIXME("(%s, %s, %08x, %d, %p, %p, %p, %p, %p, %p)\n", debugstr_w(pszURL),
861      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, pObject,
862      ppfnFreeObject, ppvFreeContext, hAsyncRetrieve, pCredentials, pAuxInfo);
863
864     pObject->cBlob = 0;
865     pObject->rgBlob = NULL;
866     *ppfnFreeObject = CRYPT_FreeBlob;
867     *ppvFreeContext = NULL;
868     return FALSE;
869 }
870
871 static const WCHAR x509cacert[] = { 'a','p','p','l','i','c','a','t','i','o','n',
872  '/','x','-','x','5','0','9','-','c','a','-','c','e','r','t',0 };
873 static const WCHAR x509emailcert[] = { 'a','p','p','l','i','c','a','t','i','o',
874  'n','/','x','-','x','5','0','9','-','e','m','a','i','l','-','c','e','r','t',
875  0 };
876 static const WCHAR x509servercert[] = { 'a','p','p','l','i','c','a','t','i','o',
877  'n','/','x','-','x','5','0','9','-','s','e','r','v','e','r','-','c','e','r',
878  't',0 };
879 static const WCHAR x509usercert[] = { 'a','p','p','l','i','c','a','t','i','o',
880  'n','/','x','-','x','5','0','9','-','u','s','e','r','-','c','e','r','t',0 };
881 static const WCHAR pkcs7cert[] = { 'a','p','p','l','i','c','a','t','i','o','n',
882  '/','x','-','p','k','c','s','7','-','c','e','r','t','i','f','c','a','t','e',
883  's',0 };
884 static const WCHAR pkixCRL[] = { 'a','p','p','l','i','c','a','t','i','o','n',
885  '/','p','k','i','x','-','c','r','l',0 };
886 static const WCHAR pkcs7CRL[] = { 'a','p','p','l','i','c','a','t','i','o','n',
887  '/','x','-','p','k','c','s','7','-','c','r','l',0 };
888 static const WCHAR pkcs7sig[] = { 'a','p','p','l','i','c','a','t','i','o','n',
889  '/','x','-','p','k','c','s','7','-','s','i','g','n','a','t','u','r','e',0 };
890 static const WCHAR pkcs7mime[] = { 'a','p','p','l','i','c','a','t','i','o','n',
891  '/','x','-','p','k','c','s','7','-','m','i','m','e',0 };
892
893 static BOOL WINAPI HTTP_RetrieveEncodedObjectW(LPCWSTR pszURL,
894  LPCSTR pszObjectOid, DWORD dwRetrievalFlags, DWORD dwTimeout,
895  PCRYPT_BLOB_ARRAY pObject, PFN_FREE_ENCODED_OBJECT_FUNC *ppfnFreeObject,
896  void **ppvFreeContext, HCRYPTASYNC hAsyncRetrieve,
897  PCRYPT_CREDENTIALS pCredentials, PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
898 {
899     BOOL ret = FALSE;
900
901     TRACE("(%s, %s, %08x, %d, %p, %p, %p, %p, %p, %p)\n", debugstr_w(pszURL),
902      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, pObject,
903      ppfnFreeObject, ppvFreeContext, hAsyncRetrieve, pCredentials, pAuxInfo);
904
905     pObject->cBlob = 0;
906     pObject->rgBlob = NULL;
907     *ppfnFreeObject = CRYPT_FreeBlob;
908     *ppvFreeContext = NULL;
909
910     if (!(dwRetrievalFlags & CRYPT_WIRE_ONLY_RETRIEVAL))
911         ret = CRYPT_GetObjectFromCache(pszURL, pObject, pAuxInfo);
912     if (!ret && (!(dwRetrievalFlags & CRYPT_CACHE_ONLY_RETRIEVAL) ||
913      (dwRetrievalFlags & CRYPT_WIRE_ONLY_RETRIEVAL)))
914     {
915         URL_COMPONENTSW components;
916
917         if ((ret = CRYPT_CrackUrl(pszURL, &components)))
918         {
919             HINTERNET hInt, hHost;
920             struct InetContext *context = NULL;
921
922             if (dwTimeout)
923                 context = CRYPT_MakeInetContext(dwTimeout);
924             ret = CRYPT_Connect(&components, context, pCredentials, &hInt,
925              &hHost);
926             if (ret)
927             {
928                 static LPCWSTR types[] = { x509cacert, x509emailcert,
929                  x509servercert, x509usercert, pkcs7cert, pkixCRL, pkcs7CRL,
930                  pkcs7sig, pkcs7mime, NULL };
931                 HINTERNET hHttp = HttpOpenRequestW(hHost, NULL,
932                  components.lpszUrlPath, NULL, NULL, types,
933                  INTERNET_FLAG_NO_COOKIES | INTERNET_FLAG_NO_UI,
934                  (DWORD_PTR)context);
935
936                 if (hHttp)
937                 {
938                     if (dwTimeout)
939                     {
940                         InternetSetOptionW(hHttp,
941                          INTERNET_OPTION_RECEIVE_TIMEOUT, &dwTimeout,
942                          sizeof(dwTimeout));
943                         InternetSetOptionW(hHttp, INTERNET_OPTION_SEND_TIMEOUT,
944                          &dwTimeout, sizeof(dwTimeout));
945                     }
946                     ret = HttpSendRequestExW(hHttp, NULL, NULL, 0,
947                      (DWORD_PTR)context);
948                     if (!ret && GetLastError() == ERROR_IO_PENDING)
949                     {
950                         if (WaitForSingleObject(context->event,
951                          context->timeout) == WAIT_TIMEOUT)
952                             SetLastError(ERROR_TIMEOUT);
953                         else
954                             ret = TRUE;
955                     }
956                     /* We don't set ret to TRUE in this block to avoid masking
957                      * an error from HttpSendRequestExW.
958                      */
959                     if (!HttpEndRequestW(hHttp, NULL, 0, (DWORD_PTR)context) &&
960                      GetLastError() == ERROR_IO_PENDING)
961                     {
962                         if (WaitForSingleObject(context->event,
963                          context->timeout) == WAIT_TIMEOUT)
964                         {
965                             SetLastError(ERROR_TIMEOUT);
966                             ret = FALSE;
967                         }
968                     }
969                     if (ret)
970                         ret = CRYPT_DownloadObject(dwRetrievalFlags, hHttp,
971                          context, pObject, pAuxInfo);
972                     if (ret && !(dwRetrievalFlags & CRYPT_DONT_CACHE_RESULT))
973                     {
974                         SYSTEMTIME st;
975                         DWORD len = sizeof(st);
976
977                         if (HttpQueryInfoW(hHttp,
978                          HTTP_QUERY_EXPIRES | HTTP_QUERY_FLAG_SYSTEMTIME, &st,
979                          &len, NULL))
980                         {
981                             FILETIME ft;
982
983                             SystemTimeToFileTime(&st, &ft);
984                             CRYPT_CacheURL(pszURL, pObject, dwRetrievalFlags,
985                              ft);
986                         }
987                     }
988                     InternetCloseHandle(hHttp);
989                 }
990                 InternetCloseHandle(hHost);
991                 InternetCloseHandle(hInt);
992             }
993             if (context)
994             {
995                 CloseHandle(context->event);
996                 CryptMemFree(context);
997             }
998             CryptMemFree(components.lpszUrlPath);
999             CryptMemFree(components.lpszHostName);
1000         }
1001     }
1002     TRACE("returning %d\n", ret);
1003     return ret;
1004 }
1005
1006 static BOOL WINAPI File_RetrieveEncodedObjectW(LPCWSTR pszURL,
1007  LPCSTR pszObjectOid, DWORD dwRetrievalFlags, DWORD dwTimeout,
1008  PCRYPT_BLOB_ARRAY pObject, PFN_FREE_ENCODED_OBJECT_FUNC *ppfnFreeObject,
1009  void **ppvFreeContext, HCRYPTASYNC hAsyncRetrieve,
1010  PCRYPT_CREDENTIALS pCredentials, PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
1011 {
1012     URL_COMPONENTSW components = { sizeof(components), 0 };
1013     BOOL ret;
1014
1015     TRACE("(%s, %s, %08x, %d, %p, %p, %p, %p, %p, %p)\n", debugstr_w(pszURL),
1016      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, pObject,
1017      ppfnFreeObject, ppvFreeContext, hAsyncRetrieve, pCredentials, pAuxInfo);
1018
1019     pObject->cBlob = 0;
1020     pObject->rgBlob = NULL;
1021     *ppfnFreeObject = CRYPT_FreeBlob;
1022     *ppvFreeContext = NULL;
1023
1024     components.lpszUrlPath = CryptMemAlloc(MAX_PATH * 2 * sizeof(WCHAR));
1025     components.dwUrlPathLength = 2 * MAX_PATH;
1026     ret = InternetCrackUrlW(pszURL, 0, ICU_DECODE, &components);
1027     if (ret)
1028     {
1029         LPWSTR path;
1030
1031         if (components.dwUrlPathLength == 2 * MAX_PATH - 1)
1032             FIXME("Buffers are too small\n");
1033
1034         /* 3 == lstrlenW(L"c:") + 1 */
1035         path = CryptMemAlloc((components.dwUrlPathLength + 3) * sizeof(WCHAR));
1036         if (path)
1037         {
1038             HANDLE hFile;
1039
1040             /* Try to create the file directly - Wine handles / in pathnames */
1041             lstrcpynW(path, components.lpszUrlPath,
1042              components.dwUrlPathLength + 1);
1043             hFile = CreateFileW(path, GENERIC_READ, 0, NULL, OPEN_EXISTING,
1044              FILE_ATTRIBUTE_NORMAL, NULL);
1045             if (hFile == INVALID_HANDLE_VALUE)
1046             {
1047                 /* Try again on the current drive */
1048                 GetCurrentDirectoryW(components.dwUrlPathLength, path);
1049                 if (path[1] == ':')
1050                 {
1051                     lstrcpynW(path + 2, components.lpszUrlPath,
1052                      components.dwUrlPathLength + 1);
1053                     hFile = CreateFileW(path, GENERIC_READ, 0, NULL,
1054                      OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1055                 }
1056                 if (hFile == INVALID_HANDLE_VALUE)
1057                 {
1058                     /* Try again on the Windows drive */
1059                     GetWindowsDirectoryW(path, components.dwUrlPathLength);
1060                     if (path[1] == ':')
1061                     {
1062                         lstrcpynW(path + 2, components.lpszUrlPath,
1063                          components.dwUrlPathLength + 1);
1064                         hFile = CreateFileW(path, GENERIC_READ, 0, NULL,
1065                          OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1066                     }
1067                 }
1068             }
1069             if (hFile != INVALID_HANDLE_VALUE)
1070             {
1071                 if ((ret = CRYPT_GetObjectFromFile(hFile, pObject)))
1072                 {
1073                     if (pAuxInfo && pAuxInfo->cbSize >=
1074                      offsetof(CRYPT_RETRIEVE_AUX_INFO,
1075                      pLastSyncTime) + sizeof(PFILETIME) &&
1076                      pAuxInfo->pLastSyncTime)
1077                         GetFileTime(hFile, NULL, NULL,
1078                          pAuxInfo->pLastSyncTime);
1079                 }
1080                 CloseHandle(hFile);
1081             }
1082             else
1083                 ret = FALSE;
1084             CryptMemFree(path);
1085         }
1086     }
1087     CryptMemFree(components.lpszUrlPath);
1088     return ret;
1089 }
1090
1091 typedef BOOL (WINAPI *SchemeDllRetrieveEncodedObjectW)(LPCWSTR pwszUrl,
1092  LPCSTR pszObjectOid, DWORD dwRetrievalFlags, DWORD dwTimeout,
1093  PCRYPT_BLOB_ARRAY pObject, PFN_FREE_ENCODED_OBJECT_FUNC *ppfnFreeObject,
1094  void **ppvFreeContext, HCRYPTASYNC hAsyncRetrieve,
1095  PCRYPT_CREDENTIALS pCredentials, PCRYPT_RETRIEVE_AUX_INFO pAuxInfo);
1096
1097 static BOOL CRYPT_GetRetrieveFunction(LPCWSTR pszURL,
1098  SchemeDllRetrieveEncodedObjectW *pFunc, HCRYPTOIDFUNCADDR *phFunc)
1099 {
1100     URL_COMPONENTSW components = { sizeof(components), 0 };
1101     BOOL ret;
1102
1103     TRACE("(%s, %p, %p)\n", debugstr_w(pszURL), pFunc, phFunc);
1104
1105     *pFunc = NULL;
1106     *phFunc = 0;
1107     components.dwSchemeLength = 1;
1108     ret = InternetCrackUrlW(pszURL, 0, 0, &components);
1109     if (ret)
1110     {
1111         /* Microsoft always uses CryptInitOIDFunctionSet/
1112          * CryptGetOIDFunctionAddress, but there doesn't seem to be a pressing
1113          * reason to do so for builtin schemes.
1114          */
1115         switch (components.nScheme)
1116         {
1117         case INTERNET_SCHEME_FTP:
1118             *pFunc = FTP_RetrieveEncodedObjectW;
1119             break;
1120         case INTERNET_SCHEME_HTTP:
1121             *pFunc = HTTP_RetrieveEncodedObjectW;
1122             break;
1123         case INTERNET_SCHEME_FILE:
1124             *pFunc = File_RetrieveEncodedObjectW;
1125             break;
1126         default:
1127         {
1128             int len = WideCharToMultiByte(CP_ACP, 0, components.lpszScheme,
1129              components.dwSchemeLength, NULL, 0, NULL, NULL);
1130
1131             if (len)
1132             {
1133                 LPSTR scheme = CryptMemAlloc(len);
1134
1135                 if (scheme)
1136                 {
1137                     static HCRYPTOIDFUNCSET set = NULL;
1138
1139                     if (!set)
1140                         set = CryptInitOIDFunctionSet(
1141                          SCHEME_OID_RETRIEVE_ENCODED_OBJECTW_FUNC, 0);
1142                     WideCharToMultiByte(CP_ACP, 0, components.lpszScheme,
1143                      components.dwSchemeLength, scheme, len, NULL, NULL);
1144                     ret = CryptGetOIDFunctionAddress(set, X509_ASN_ENCODING,
1145                      scheme, 0, (void **)pFunc, phFunc);
1146                     CryptMemFree(scheme);
1147                 }
1148                 else
1149                 {
1150                     SetLastError(ERROR_OUTOFMEMORY);
1151                     ret = FALSE;
1152                 }
1153             }
1154             else
1155                 ret = FALSE;
1156         }
1157         }
1158     }
1159     TRACE("returning %d\n", ret);
1160     return ret;
1161 }
1162
1163 static BOOL WINAPI CRYPT_CreateBlob(LPCSTR pszObjectOid,
1164  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1165 {
1166     DWORD size, i;
1167     CRYPT_BLOB_ARRAY *context;
1168     BOOL ret = FALSE;
1169
1170     size = sizeof(CRYPT_BLOB_ARRAY) + pObject->cBlob * sizeof(CRYPT_DATA_BLOB);
1171     for (i = 0; i < pObject->cBlob; i++)
1172         size += pObject->rgBlob[i].cbData;
1173     context = CryptMemAlloc(size);
1174     if (context)
1175     {
1176         LPBYTE nextData;
1177
1178         context->cBlob = 0;
1179         context->rgBlob =
1180          (CRYPT_DATA_BLOB *)((LPBYTE)context + sizeof(CRYPT_BLOB_ARRAY));
1181         nextData =
1182          (LPBYTE)context->rgBlob + pObject->cBlob * sizeof(CRYPT_DATA_BLOB);
1183         for (i = 0; i < pObject->cBlob; i++)
1184         {
1185             memcpy(nextData, pObject->rgBlob[i].pbData,
1186              pObject->rgBlob[i].cbData);
1187             context->rgBlob[i].pbData = nextData;
1188             context->rgBlob[i].cbData = pObject->rgBlob[i].cbData;
1189             nextData += pObject->rgBlob[i].cbData;
1190             context->cBlob++;
1191         }
1192         *ppvContext = context;
1193         ret = TRUE;
1194     }
1195     return ret;
1196 }
1197
1198 typedef BOOL (WINAPI *AddContextToStore)(HCERTSTORE hCertStore,
1199  const void *pContext, DWORD dwAddDisposition, const void **ppStoreContext);
1200
1201 static BOOL CRYPT_CreateContext(const CRYPT_BLOB_ARRAY *pObject,
1202  DWORD dwExpectedContentTypeFlags, AddContextToStore addFunc, void **ppvContext)
1203 {
1204     BOOL ret = TRUE;
1205
1206     if (!pObject->cBlob)
1207     {
1208         SetLastError(ERROR_INVALID_DATA);
1209         *ppvContext = NULL;
1210         ret = FALSE;
1211     }
1212     else if (pObject->cBlob == 1)
1213     {
1214         if (!CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &pObject->rgBlob[0],
1215          dwExpectedContentTypeFlags, CERT_QUERY_FORMAT_FLAG_BINARY, 0, NULL,
1216          NULL, NULL, NULL, NULL, (const void **)ppvContext))
1217         {
1218             SetLastError(CRYPT_E_NO_MATCH);
1219             ret = FALSE;
1220         }
1221     }
1222     else
1223     {
1224         HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1225          CERT_STORE_CREATE_NEW_FLAG, NULL);
1226
1227         if (store)
1228         {
1229             DWORD i;
1230             const void *context;
1231
1232             for (i = 0; i < pObject->cBlob; i++)
1233             {
1234                 if (CryptQueryObject(CERT_QUERY_OBJECT_BLOB,
1235                  &pObject->rgBlob[i], dwExpectedContentTypeFlags,
1236                  CERT_QUERY_FORMAT_FLAG_BINARY, 0, NULL, NULL, NULL, NULL,
1237                  NULL, &context))
1238                 {
1239                     if (!addFunc(store, context, CERT_STORE_ADD_ALWAYS, NULL))
1240                         ret = FALSE;
1241                 }
1242                 else
1243                 {
1244                     SetLastError(CRYPT_E_NO_MATCH);
1245                     ret = FALSE;
1246                 }
1247             }
1248         }
1249         else
1250             ret = FALSE;
1251         *ppvContext = store;
1252     }
1253     return ret;
1254 }
1255
1256 static BOOL WINAPI CRYPT_CreateCert(LPCSTR pszObjectOid,
1257  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1258 {
1259     return CRYPT_CreateContext(pObject, CERT_QUERY_CONTENT_FLAG_CERT,
1260      (AddContextToStore)CertAddCertificateContextToStore, ppvContext);
1261 }
1262
1263 static BOOL WINAPI CRYPT_CreateCRL(LPCSTR pszObjectOid,
1264  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1265 {
1266     return CRYPT_CreateContext(pObject, CERT_QUERY_CONTENT_FLAG_CRL,
1267      (AddContextToStore)CertAddCRLContextToStore, ppvContext);
1268 }
1269
1270 static BOOL WINAPI CRYPT_CreateCTL(LPCSTR pszObjectOid,
1271  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1272 {
1273     return CRYPT_CreateContext(pObject, CERT_QUERY_CONTENT_FLAG_CTL,
1274      (AddContextToStore)CertAddCTLContextToStore, ppvContext);
1275 }
1276
1277 static BOOL WINAPI CRYPT_CreatePKCS7(LPCSTR pszObjectOid,
1278  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1279 {
1280     BOOL ret;
1281
1282     if (!pObject->cBlob)
1283     {
1284         SetLastError(ERROR_INVALID_DATA);
1285         *ppvContext = NULL;
1286         ret = FALSE;
1287     }
1288     else if (pObject->cBlob == 1)
1289         ret = CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &pObject->rgBlob[0],
1290          CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED |
1291          CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED, CERT_QUERY_FORMAT_FLAG_BINARY,
1292          0, NULL, NULL, NULL, ppvContext, NULL, NULL);
1293     else
1294     {
1295         FIXME("multiple messages unimplemented\n");
1296         ret = FALSE;
1297     }
1298     return ret;
1299 }
1300
1301 static BOOL WINAPI CRYPT_CreateAny(LPCSTR pszObjectOid,
1302  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext)
1303 {
1304     BOOL ret;
1305
1306     if (!pObject->cBlob)
1307     {
1308         SetLastError(ERROR_INVALID_DATA);
1309         *ppvContext = NULL;
1310         ret = FALSE;
1311     }
1312     else
1313     {
1314         HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
1315          CERT_STORE_CREATE_NEW_FLAG, NULL);
1316
1317         if (store)
1318         {
1319             HCERTSTORE memStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1320              CERT_STORE_CREATE_NEW_FLAG, NULL);
1321
1322             if (memStore)
1323             {
1324                 CertAddStoreToCollection(store, memStore,
1325                  CERT_PHYSICAL_STORE_ADD_ENABLE_FLAG, 0);
1326                 CertCloseStore(memStore, 0);
1327             }
1328             else
1329             {
1330                 CertCloseStore(store, 0);
1331                 store = NULL;
1332             }
1333         }
1334         if (store)
1335         {
1336             DWORD i;
1337
1338             ret = TRUE;
1339             for (i = 0; i < pObject->cBlob; i++)
1340             {
1341                 DWORD contentType, expectedContentTypes =
1342                  CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED |
1343                  CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED |
1344                  CERT_QUERY_CONTENT_FLAG_CERT |
1345                  CERT_QUERY_CONTENT_FLAG_CRL |
1346                  CERT_QUERY_CONTENT_FLAG_CTL;
1347                 HCERTSTORE contextStore;
1348                 const void *context;
1349
1350                 if (CryptQueryObject(CERT_QUERY_OBJECT_BLOB,
1351                  &pObject->rgBlob[i], expectedContentTypes,
1352                  CERT_QUERY_FORMAT_FLAG_BINARY, 0, NULL, &contentType, NULL,
1353                  &contextStore, NULL, &context))
1354                 {
1355                     switch (contentType)
1356                     {
1357                     case CERT_QUERY_CONTENT_CERT:
1358                         if (!CertAddCertificateContextToStore(store,
1359                          context, CERT_STORE_ADD_ALWAYS, NULL))
1360                             ret = FALSE;
1361                         CertFreeCertificateContext(context);
1362                         break;
1363                     case CERT_QUERY_CONTENT_CRL:
1364                         if (!CertAddCRLContextToStore(store,
1365                          context, CERT_STORE_ADD_ALWAYS, NULL))
1366                              ret = FALSE;
1367                         CertFreeCRLContext(context);
1368                         break;
1369                     case CERT_QUERY_CONTENT_CTL:
1370                         if (!CertAddCTLContextToStore(store,
1371                          context, CERT_STORE_ADD_ALWAYS, NULL))
1372                              ret = FALSE;
1373                         CertFreeCTLContext(context);
1374                         break;
1375                     default:
1376                         CertAddStoreToCollection(store, contextStore, 0, 0);
1377                     }
1378                     CertCloseStore(contextStore, 0);
1379                 }
1380                 else
1381                     ret = FALSE;
1382             }
1383         }
1384         else
1385             ret = FALSE;
1386         *ppvContext = store;
1387     }
1388     return ret;
1389 }
1390
1391 typedef BOOL (WINAPI *ContextDllCreateObjectContext)(LPCSTR pszObjectOid,
1392  DWORD dwRetrievalFlags, const CRYPT_BLOB_ARRAY *pObject, void **ppvContext);
1393
1394 static BOOL CRYPT_GetCreateFunction(LPCSTR pszObjectOid,
1395  ContextDllCreateObjectContext *pFunc, HCRYPTOIDFUNCADDR *phFunc)
1396 {
1397     BOOL ret = TRUE;
1398
1399     TRACE("(%s, %p, %p)\n", debugstr_a(pszObjectOid), pFunc, phFunc);
1400
1401     *pFunc = NULL;
1402     *phFunc = 0;
1403     if (IS_INTOID(pszObjectOid))
1404     {
1405         switch (LOWORD(pszObjectOid))
1406         {
1407         case 0:
1408             *pFunc = CRYPT_CreateBlob;
1409             break;
1410         case LOWORD(CONTEXT_OID_CERTIFICATE):
1411             *pFunc = CRYPT_CreateCert;
1412             break;
1413         case LOWORD(CONTEXT_OID_CRL):
1414             *pFunc = CRYPT_CreateCRL;
1415             break;
1416         case LOWORD(CONTEXT_OID_CTL):
1417             *pFunc = CRYPT_CreateCTL;
1418             break;
1419         case LOWORD(CONTEXT_OID_PKCS7):
1420             *pFunc = CRYPT_CreatePKCS7;
1421             break;
1422         case LOWORD(CONTEXT_OID_CAPI2_ANY):
1423             *pFunc = CRYPT_CreateAny;
1424             break;
1425         }
1426     }
1427     if (!*pFunc)
1428     {
1429         static HCRYPTOIDFUNCSET set = NULL;
1430
1431         if (!set)
1432             set = CryptInitOIDFunctionSet(
1433              CONTEXT_OID_CREATE_OBJECT_CONTEXT_FUNC, 0);
1434         ret = CryptGetOIDFunctionAddress(set, X509_ASN_ENCODING, pszObjectOid,
1435          0, (void **)pFunc, phFunc);
1436     }
1437     TRACE("returning %d\n", ret);
1438     return ret;
1439 }
1440
1441 typedef BOOL (*get_object_expiration_func)(const void *pvContext,
1442  FILETIME *expiration);
1443
1444 static BOOL CRYPT_GetExpirationFromCert(const void *pvObject, FILETIME *expiration)
1445 {
1446     PCCERT_CONTEXT cert = pvObject;
1447
1448     *expiration = cert->pCertInfo->NotAfter;
1449     return TRUE;
1450 }
1451
1452 static BOOL CRYPT_GetExpirationFromCRL(const void *pvObject, FILETIME *expiration)
1453 {
1454     PCCRL_CONTEXT cert = pvObject;
1455
1456     *expiration = cert->pCrlInfo->NextUpdate;
1457     return TRUE;
1458 }
1459
1460 static BOOL CRYPT_GetExpirationFromCTL(const void *pvObject, FILETIME *expiration)
1461 {
1462     PCCTL_CONTEXT cert = pvObject;
1463
1464     *expiration = cert->pCtlInfo->NextUpdate;
1465     return TRUE;
1466 }
1467
1468 static BOOL CRYPT_GetExpirationFunction(LPCSTR pszObjectOid,
1469  get_object_expiration_func *getExpiration)
1470 {
1471     BOOL ret;
1472
1473     if (IS_INTOID(pszObjectOid))
1474     {
1475         switch (LOWORD(pszObjectOid))
1476         {
1477         case LOWORD(CONTEXT_OID_CERTIFICATE):
1478             *getExpiration = CRYPT_GetExpirationFromCert;
1479             ret = TRUE;
1480             break;
1481         case LOWORD(CONTEXT_OID_CRL):
1482             *getExpiration = CRYPT_GetExpirationFromCRL;
1483             ret = TRUE;
1484             break;
1485         case LOWORD(CONTEXT_OID_CTL):
1486             *getExpiration = CRYPT_GetExpirationFromCTL;
1487             ret = TRUE;
1488             break;
1489         default:
1490             ret = FALSE;
1491         }
1492     }
1493     else
1494         ret = FALSE;
1495     return ret;
1496 }
1497
1498 /***********************************************************************
1499  *    CryptRetrieveObjectByUrlW (CRYPTNET.@)
1500  */
1501 BOOL WINAPI CryptRetrieveObjectByUrlW(LPCWSTR pszURL, LPCSTR pszObjectOid,
1502  DWORD dwRetrievalFlags, DWORD dwTimeout, LPVOID *ppvObject,
1503  HCRYPTASYNC hAsyncRetrieve, PCRYPT_CREDENTIALS pCredentials, LPVOID pvVerify,
1504  PCRYPT_RETRIEVE_AUX_INFO pAuxInfo)
1505 {
1506     BOOL ret;
1507     SchemeDllRetrieveEncodedObjectW retrieve;
1508     ContextDllCreateObjectContext create;
1509     HCRYPTOIDFUNCADDR hRetrieve = 0, hCreate = 0;
1510
1511     TRACE("(%s, %s, %08x, %d, %p, %p, %p, %p, %p)\n", debugstr_w(pszURL),
1512      debugstr_a(pszObjectOid), dwRetrievalFlags, dwTimeout, ppvObject,
1513      hAsyncRetrieve, pCredentials, pvVerify, pAuxInfo);
1514
1515     if (!pszURL)
1516     {
1517         SetLastError(ERROR_INVALID_PARAMETER);
1518         return FALSE;
1519     }
1520     ret = CRYPT_GetRetrieveFunction(pszURL, &retrieve, &hRetrieve);
1521     if (ret)
1522         ret = CRYPT_GetCreateFunction(pszObjectOid, &create, &hCreate);
1523     if (ret)
1524     {
1525         CRYPT_BLOB_ARRAY object = { 0, NULL };
1526         PFN_FREE_ENCODED_OBJECT_FUNC freeObject;
1527         void *freeContext;
1528
1529         ret = retrieve(pszURL, pszObjectOid, dwRetrievalFlags, dwTimeout,
1530          &object, &freeObject, &freeContext, hAsyncRetrieve, pCredentials,
1531          pAuxInfo);
1532         if (ret)
1533         {
1534             get_object_expiration_func getExpiration;
1535
1536             ret = create(pszObjectOid, dwRetrievalFlags, &object, ppvObject);
1537             if (ret && !(dwRetrievalFlags & CRYPT_DONT_CACHE_RESULT) &&
1538              CRYPT_GetExpirationFunction(pszObjectOid, &getExpiration))
1539             {
1540                 FILETIME expires;
1541
1542                 if (getExpiration(*ppvObject, &expires))
1543                     CRYPT_CacheURL(pszURL, &object, dwRetrievalFlags, expires);
1544             }
1545             freeObject(pszObjectOid, &object, freeContext);
1546         }
1547     }
1548     if (hCreate)
1549         CryptFreeOIDFunctionAddress(hCreate, 0);
1550     if (hRetrieve)
1551         CryptFreeOIDFunctionAddress(hRetrieve, 0);
1552     TRACE("returning %d\n", ret);
1553     return ret;
1554 }
1555
1556 static DWORD verify_cert_revocation_with_crl(PCCERT_CONTEXT cert,
1557  PCCRL_CONTEXT crl, DWORD index, FILETIME *pTime,
1558  PCERT_REVOCATION_STATUS pRevStatus)
1559 {
1560     DWORD error;
1561
1562     if (CertVerifyCRLTimeValidity(pTime, crl->pCrlInfo))
1563     {
1564         /* The CRL isn't time valid */
1565         error = CRYPT_E_NO_REVOCATION_CHECK;
1566     }
1567     else
1568     {
1569         PCRL_ENTRY entry = NULL;
1570
1571         CertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
1572         if (entry)
1573         {
1574             error = CRYPT_E_REVOKED;
1575             pRevStatus->dwIndex = index;
1576         }
1577         else
1578             error = ERROR_SUCCESS;
1579     }
1580     return error;
1581 }
1582
1583 static DWORD verify_cert_revocation_from_dist_points_ext(
1584  const CRYPT_DATA_BLOB *value, PCCERT_CONTEXT cert, DWORD index,
1585  FILETIME *pTime, DWORD dwFlags, const CERT_REVOCATION_PARA *pRevPara,
1586  PCERT_REVOCATION_STATUS pRevStatus)
1587 {
1588     DWORD error = ERROR_SUCCESS, cbUrlArray;
1589
1590     if (CRYPT_GetUrlFromCRLDistPointsExt(value, NULL, &cbUrlArray, NULL, NULL))
1591     {
1592         CRYPT_URL_ARRAY *urlArray = CryptMemAlloc(cbUrlArray);
1593
1594         if (urlArray)
1595         {
1596             DWORD j, retrievalFlags = 0, startTime, endTime, timeout;
1597             BOOL ret;
1598
1599             ret = CRYPT_GetUrlFromCRLDistPointsExt(value, urlArray,
1600              &cbUrlArray, NULL, NULL);
1601             if (dwFlags & CERT_VERIFY_CACHE_ONLY_BASED_REVOCATION)
1602                 retrievalFlags |= CRYPT_CACHE_ONLY_RETRIEVAL;
1603             if (dwFlags & CERT_VERIFY_REV_ACCUMULATIVE_TIMEOUT_FLAG &&
1604              pRevPara && pRevPara->cbSize >= offsetof(CERT_REVOCATION_PARA,
1605              dwUrlRetrievalTimeout) + sizeof(DWORD))
1606             {
1607                 startTime = GetTickCount();
1608                 endTime = startTime + pRevPara->dwUrlRetrievalTimeout;
1609                 timeout = pRevPara->dwUrlRetrievalTimeout;
1610             }
1611             else
1612                 endTime = timeout = 0;
1613             if (!ret)
1614                 error = GetLastError();
1615             for (j = 0; !error && j < urlArray->cUrl; j++)
1616             {
1617                 PCCRL_CONTEXT crl;
1618
1619                 ret = CryptRetrieveObjectByUrlW(urlArray->rgwszUrl[j],
1620                  CONTEXT_OID_CRL, retrievalFlags, timeout, (void **)&crl,
1621                  NULL, NULL, NULL, NULL);
1622                 if (ret)
1623                 {
1624                     error = verify_cert_revocation_with_crl(cert, crl, index,
1625                      pTime, pRevStatus);
1626                     if (!error && timeout)
1627                     {
1628                         DWORD time = GetTickCount();
1629
1630                         if ((int)(endTime - time) <= 0)
1631                         {
1632                             error = ERROR_TIMEOUT;
1633                             pRevStatus->dwIndex = index;
1634                         }
1635                         else
1636                             timeout = endTime - time;
1637                     }
1638                     CertFreeCRLContext(crl);
1639                 }
1640                 else
1641                     error = CRYPT_E_REVOCATION_OFFLINE;
1642             }
1643             CryptMemFree(urlArray);
1644         }
1645         else
1646         {
1647             error = ERROR_OUTOFMEMORY;
1648             pRevStatus->dwIndex = index;
1649         }
1650     }
1651     else
1652     {
1653         error = GetLastError();
1654         pRevStatus->dwIndex = index;
1655     }
1656     return error;
1657 }
1658
1659 static DWORD verify_cert_revocation_from_aia_ext(
1660  const CRYPT_DATA_BLOB *value, PCCERT_CONTEXT cert, DWORD index,
1661  FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara,
1662  PCERT_REVOCATION_STATUS pRevStatus)
1663 {
1664     BOOL ret;
1665     DWORD error, size;
1666     CERT_AUTHORITY_INFO_ACCESS *aia;
1667
1668     ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_AUTHORITY_INFO_ACCESS,
1669      value->pbData, value->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &aia, &size);
1670     if (ret)
1671     {
1672         DWORD i;
1673
1674         for (i = 0; i < aia->cAccDescr; i++)
1675             if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
1676              szOID_PKIX_OCSP))
1677             {
1678                 if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice ==
1679                  CERT_ALT_NAME_URL)
1680                     FIXME("OCSP URL = %s\n",
1681                      debugstr_w(aia->rgAccDescr[i].AccessLocation.u.pwszURL));
1682                 else
1683                     FIXME("unsupported AccessLocation type %d\n",
1684                      aia->rgAccDescr[i].AccessLocation.dwAltNameChoice);
1685             }
1686         LocalFree(aia);
1687         /* FIXME: lie and pretend OCSP validated the cert */
1688         error = ERROR_SUCCESS;
1689     }
1690     else
1691         error = GetLastError();
1692     return error;
1693 }
1694
1695 static DWORD verify_cert_revocation(PCCERT_CONTEXT cert, DWORD index,
1696  FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara,
1697  PCERT_REVOCATION_STATUS pRevStatus)
1698 {
1699     DWORD error = ERROR_SUCCESS;
1700     PCERT_EXTENSION ext;
1701
1702     if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
1703      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
1704         error = verify_cert_revocation_from_dist_points_ext(&ext->Value, cert,
1705          index, pTime, dwFlags, pRevPara, pRevStatus);
1706     else if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS,
1707      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
1708         error = verify_cert_revocation_from_aia_ext(&ext->Value, cert,
1709          index, pTime, dwFlags, pRevPara, pRevStatus);
1710     else
1711     {
1712         if (pRevPara && pRevPara->hCrlStore && pRevPara->pIssuerCert)
1713         {
1714             PCCRL_CONTEXT crl = NULL;
1715             BOOL canSignCRLs;
1716
1717             /* If the caller told us about the issuer, make sure the issuer
1718              * can sign CRLs before looking for one.
1719              */
1720             if ((ext = CertFindExtension(szOID_KEY_USAGE,
1721              pRevPara->pIssuerCert->pCertInfo->cExtension,
1722              pRevPara->pIssuerCert->pCertInfo->rgExtension)))
1723             {
1724                 CRYPT_BIT_BLOB usage;
1725                 DWORD size = sizeof(usage);
1726
1727                 if (!CryptDecodeObjectEx(cert->dwCertEncodingType, X509_BITS,
1728                  ext->Value.pbData, ext->Value.cbData,
1729                  CRYPT_DECODE_NOCOPY_FLAG, NULL, &usage, &size))
1730                     canSignCRLs = FALSE;
1731                 else if (usage.cbData > 2)
1732                 {
1733                     /* The key usage extension only defines 9 bits => no more
1734                      * than 2 bytes are needed to encode all known usages.
1735                      */
1736                     canSignCRLs = FALSE;
1737                 }
1738                 else
1739                 {
1740                     BYTE usageBits = usage.pbData[usage.cbData - 1];
1741
1742                     canSignCRLs = usageBits & CERT_CRL_SIGN_KEY_USAGE;
1743                 }
1744             }
1745             else
1746                 canSignCRLs = TRUE;
1747             if (canSignCRLs)
1748             {
1749                 /* If the caller was helpful enough to tell us where to find a
1750                  * CRL for the cert, look for one and check it.
1751                  */
1752                 crl = CertFindCRLInStore(pRevPara->hCrlStore,
1753                  cert->dwCertEncodingType,
1754                  CRL_FIND_ISSUED_BY_SIGNATURE_FLAG |
1755                  CRL_FIND_ISSUED_BY_AKI_FLAG,
1756                  CRL_FIND_ISSUED_BY, pRevPara->pIssuerCert, NULL);
1757             }
1758             if (crl)
1759             {
1760                 error = verify_cert_revocation_with_crl(cert, crl, index,
1761                  pTime, pRevStatus);
1762                 CertFreeCRLContext(crl);
1763             }
1764             else
1765             {
1766                 error = CRYPT_E_NO_REVOCATION_CHECK;
1767                 pRevStatus->dwIndex = index;
1768             }
1769         }
1770         else
1771         {
1772             error = CRYPT_E_NO_REVOCATION_CHECK;
1773             pRevStatus->dwIndex = index;
1774         }
1775     }
1776     return error;
1777 }
1778
1779 typedef struct _CERT_REVOCATION_PARA_NO_EXTRA_FIELDS {
1780     DWORD                     cbSize;
1781     PCCERT_CONTEXT            pIssuerCert;
1782     DWORD                     cCertStore;
1783     HCERTSTORE               *rgCertStore;
1784     HCERTSTORE                hCrlStore;
1785     LPFILETIME                pftTimeToUse;
1786 } CERT_REVOCATION_PARA_NO_EXTRA_FIELDS, *PCERT_REVOCATION_PARA_NO_EXTRA_FIELDS;
1787
1788 typedef struct _OLD_CERT_REVOCATION_STATUS {
1789     DWORD cbSize;
1790     DWORD dwIndex;
1791     DWORD dwError;
1792     DWORD dwReason;
1793 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1794
1795 /***********************************************************************
1796  *    CertDllVerifyRevocation (CRYPTNET.@)
1797  */
1798 BOOL WINAPI CertDllVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1799  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1800  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1801 {
1802     DWORD error = 0, i;
1803     FILETIME now;
1804     LPFILETIME pTime = NULL;
1805
1806     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1807      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1808
1809     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1810      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1811     {
1812         SetLastError(E_INVALIDARG);
1813         return FALSE;
1814     }
1815     if (!cContext)
1816     {
1817         SetLastError(E_INVALIDARG);
1818         return FALSE;
1819     }
1820     if (pRevPara && pRevPara->cbSize >=
1821      sizeof(CERT_REVOCATION_PARA_NO_EXTRA_FIELDS))
1822         pTime = pRevPara->pftTimeToUse;
1823     if (!pTime)
1824     {
1825         GetSystemTimeAsFileTime(&now);
1826         pTime = &now;
1827     }
1828     memset(&pRevStatus->dwIndex, 0, pRevStatus->cbSize - sizeof(DWORD));
1829     if (dwRevType != CERT_CONTEXT_REVOCATION_TYPE)
1830         error = CRYPT_E_NO_REVOCATION_CHECK;
1831     else
1832     {
1833         for (i = 0; !error && i < cContext; i++)
1834             error = verify_cert_revocation(rgpvContext[i], i, pTime, dwFlags,
1835              pRevPara, pRevStatus);
1836     }
1837     if (error)
1838     {
1839         SetLastError(error);
1840         pRevStatus->dwError = error;
1841     }
1842     TRACE("returning %d (%08x)\n", !error, error);
1843     return !error;
1844 }