git.oblomov.eu Git - wine/blob - dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #define NONAMELESSUNION
  24 #include "windef.h"
  25 #include "winbase.h"
  26 #include "wincrypt.h"
  27 #include "winnls.h"
  28 #include "rpc.h"
  29 #include "wine/debug.h"
  30 #include "wine/unicode.h"
  31 #include "crypt32_private.h"
  32
  33 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  34
  35 /* Internal version of CertGetCertificateContextProperty that gets properties
  36  * directly from the context (or the context it's linked to, depending on its
  37  * type.) Doesn't handle special-case properties, since they are handled by
  38  * CertGetCertificateContextProperty, and are particular to the store in which
  39  * the property exists (which is separate from the context.)
  40  */
  41 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
  42  void *pvData, DWORD *pcbData);
  43
  44 /* Internal version of CertSetCertificateContextProperty that sets properties
  45  * directly on the context (or the context it's linked to, depending on its
  46  * type.) Doesn't handle special cases, since they're handled by
  47  * CertSetCertificateContextProperty anyway.
  48  */
  49 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
  50  DWORD dwFlags, const void *pvData);
  51
  52 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  53  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  54  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  55 {
  56     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  57      pbCertEncoded, cbCertEncoded);
  58     BOOL ret;
  59
  60     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  61      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  62
  63     if (cert)
  64     {
  65         ret = CertAddCertificateContextToStore(hCertStore, cert,
  66          dwAddDisposition, ppCertContext);
  67         CertFreeCertificateContext(cert);
  68     }
  69     else
  70         ret = FALSE;
  71     return ret;
  72 }
  73
  74 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
  75  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  76 {
  77     HCERTSTORE store;
  78     BOOL ret = FALSE;
  79
  80     TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
  81      cbCertEncoded);
  82
  83     store = CertOpenSystemStoreA(0, pszCertStoreName);
  84     if (store)
  85     {
  86         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  87          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  88         CertCloseStore(store, 0);
  89     }
  90     return ret;
  91 }
  92
  93 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
  94  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  95 {
  96     HCERTSTORE store;
  97     BOOL ret = FALSE;
  98
  99     TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
 100      cbCertEncoded);
 101
 102     store = CertOpenSystemStoreW(0, pszCertStoreName);
 103     if (store)
 104     {
 105         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 106          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
 107         CertCloseStore(store, 0);
 108     }
 109     return ret;
 110 }
 111
 112 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
 113  PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
 114  PCCERT_CONTEXT *ppCertContext)
 115 {
 116     FIXME("(%p, %p, %08x, %p)\n", hCertStore, pCertContext, dwAddDisposition,
 117      ppCertContext);
 118     return FALSE;
 119 }
 120
 121 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
 122  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 123 {
 124     PCERT_CONTEXT cert = NULL;
 125     BOOL ret;
 126     PCERT_INFO certInfo = NULL;
 127     DWORD size = 0;
 128
 129     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
 130      cbCertEncoded);
 131
 132     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 133      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 134      &certInfo, &size);
 135     if (ret)
 136     {
 137         BYTE *data = NULL;
 138
 139         cert = Context_CreateDataContext(sizeof(CERT_CONTEXT));
 140         if (!cert)
 141             goto end;
 142         data = CryptMemAlloc(cbCertEncoded);
 143         if (!data)
 144         {
 145             CryptMemFree(cert);
 146             cert = NULL;
 147             goto end;
 148         }
 149         memcpy(data, pbCertEncoded, cbCertEncoded);
 150         cert->dwCertEncodingType = dwCertEncodingType;
 151         cert->pbCertEncoded      = data;
 152         cert->cbCertEncoded      = cbCertEncoded;
 153         cert->pCertInfo          = certInfo;
 154         cert->hCertStore         = 0;
 155     }
 156
 157 end:
 158     return cert;
 159 }
 160
 161 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
 162  PCCERT_CONTEXT pCertContext)
 163 {
 164     TRACE("(%p)\n", pCertContext);
 165
 166     if (!pCertContext)
 167         return NULL;
 168
 169     Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
 170     return pCertContext;
 171 }
 172
 173 static void CertDataContext_Free(void *context)
 174 {
 175     PCERT_CONTEXT certContext = context;
 176
 177     CryptMemFree(certContext->pbCertEncoded);
 178     LocalFree(certContext->pCertInfo);
 179 }
 180
 181 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 182 {
 183     BOOL ret = TRUE;
 184
 185     TRACE("(%p)\n", pCertContext);
 186
 187     if (pCertContext)
 188         ret = Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
 189          CertDataContext_Free);
 190     return ret;
 191 }
 192
 193 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 194  DWORD dwPropId)
 195 {
 196     PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
 197      pCertContext, sizeof(CERT_CONTEXT));
 198     DWORD ret;
 199
 200     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 201
 202     if (properties)
 203         ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
 204     else
 205         ret = 0;
 206     return ret;
 207 }
 208
 209 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
 210  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 211  DWORD *pcbData)
 212 {
 213     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 214      pcbData);
 215     if (ret && pvData)
 216     {
 217         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 218
 219         ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
 220     }
 221     return ret;
 222 }
 223
 224 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 225  DWORD cb)
 226 {
 227     BOOL ret = TRUE;
 228
 229     if (!pvData)
 230         *pcbData = cb;
 231     else if (*pcbData < cb)
 232     {
 233         SetLastError(ERROR_MORE_DATA);
 234         *pcbData = cb;
 235         ret = FALSE;
 236     }
 237     else
 238     {
 239         memcpy(pvData, pb, cb);
 240         *pcbData = cb;
 241     }
 242     return ret;
 243 }
 244
 245 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
 246  void *pvData, DWORD *pcbData)
 247 {
 248     PCCERT_CONTEXT pCertContext = context;
 249     PCONTEXT_PROPERTY_LIST properties =
 250      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 251     BOOL ret;
 252     CRYPT_DATA_BLOB blob;
 253
 254     TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
 255
 256     if (properties)
 257         ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
 258     else
 259         ret = FALSE;
 260     if (ret)
 261         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 262     else
 263     {
 264         /* Implicit properties */
 265         switch (dwPropId)
 266         {
 267         case CERT_SHA1_HASH_PROP_ID:
 268             ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
 269              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 270              pcbData);
 271             break;
 272         case CERT_MD5_HASH_PROP_ID:
 273             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 274              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 275              pcbData);
 276             break;
 277         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 278             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 279              pCertContext->pCertInfo->Subject.pbData,
 280              pCertContext->pCertInfo->Subject.cbData,
 281              pvData, pcbData);
 282             break;
 283         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 284             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 285              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 286              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 287              pvData, pcbData);
 288             break;
 289         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 290             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 291              pCertContext->pCertInfo->SerialNumber.pbData,
 292              pCertContext->pCertInfo->SerialNumber.cbData,
 293              pvData, pcbData);
 294             break;
 295         case CERT_SIGNATURE_HASH_PROP_ID:
 296             ret = CryptHashToBeSigned(0, pCertContext->dwCertEncodingType,
 297              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 298              pcbData);
 299             if (ret && pvData)
 300             {
 301                 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 302
 303                 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
 304             }
 305             break;
 306         case CERT_KEY_IDENTIFIER_PROP_ID:
 307         {
 308             PCERT_EXTENSION ext = CertFindExtension(
 309              szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
 310              pCertContext->pCertInfo->rgExtension);
 311
 312             if (ext)
 313             {
 314                 CRYPT_DATA_BLOB value;
 315                 DWORD size = sizeof(value);
 316
 317                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 318                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 319                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 320                  &size);
 321                 if (ret)
 322                 {
 323                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 324                      value.cbData);
 325                     CertContext_SetProperty(context, dwPropId, 0, &value);
 326                 }
 327             }
 328             else
 329                 SetLastError(ERROR_INVALID_DATA);
 330             break;
 331         }
 332         default:
 333             SetLastError(CRYPT_E_NOT_FOUND);
 334         }
 335     }
 336     TRACE("returning %d\n", ret);
 337     return ret;
 338 }
 339
 340 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
 341 {
 342     DWORD i, containerLen, provNameLen;
 343     LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
 344
 345     info->pwszContainerName = (LPWSTR)data;
 346     containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 347     data += containerLen;
 348
 349     info->pwszProvName = (LPWSTR)data;
 350     provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 351     data += provNameLen;
 352
 353     info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
 354     data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 355
 356     for (i = 0; i < info->cProvParam; i++)
 357     {
 358         info->rgProvParam[i].pbData = data;
 359         data += info->rgProvParam[i].cbData;
 360     }
 361 }
 362
 363 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 364  DWORD dwPropId, void *pvData, DWORD *pcbData)
 365 {
 366     BOOL ret;
 367
 368     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 369
 370     switch (dwPropId)
 371     {
 372     case 0:
 373     case CERT_CERT_PROP_ID:
 374     case CERT_CRL_PROP_ID:
 375     case CERT_CTL_PROP_ID:
 376         SetLastError(E_INVALIDARG);
 377         ret = FALSE;
 378         break;
 379     case CERT_ACCESS_STATE_PROP_ID:
 380         if (pCertContext->hCertStore)
 381             ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
 382              pvData, pcbData);
 383         else
 384         {
 385             DWORD state = 0;
 386
 387             ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
 388         }
 389         break;
 390     case CERT_KEY_PROV_HANDLE_PROP_ID:
 391     {
 392         CERT_KEY_CONTEXT keyContext;
 393         DWORD size = sizeof(keyContext);
 394
 395         ret = CertContext_GetProperty((void *)pCertContext,
 396          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 397         if (ret)
 398             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 399              sizeof(keyContext.hCryptProv));
 400         break;
 401     }
 402     case CERT_KEY_PROV_INFO_PROP_ID:
 403         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 404          pcbData);
 405         if (ret && pvData)
 406             CRYPT_FixKeyProvInfoPointers(pvData);
 407         break;
 408     default:
 409         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 410          pcbData);
 411     }
 412
 413     TRACE("returning %d\n", ret);
 414     return ret;
 415 }
 416
 417 /* Copies key provider info from from into to, where to is assumed to be a
 418  * contiguous buffer of memory large enough for from and all its associated
 419  * data, but whose pointers are uninitialized.
 420  * Upon return, to contains a contiguous copy of from, packed in the following
 421  * order:
 422  * - CRYPT_KEY_PROV_INFO
 423  * - pwszContainerName
 424  * - pwszProvName
 425  * - rgProvParam[0]...
 426  */
 427 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
 428  const CRYPT_KEY_PROV_INFO *from)
 429 {
 430     DWORD i;
 431     LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
 432
 433     if (from->pwszContainerName)
 434     {
 435         to->pwszContainerName = (LPWSTR)nextData;
 436         lstrcpyW(to->pwszContainerName, from->pwszContainerName);
 437         nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 438     }
 439     else
 440         to->pwszContainerName = NULL;
 441     if (from->pwszProvName)
 442     {
 443         to->pwszProvName = (LPWSTR)nextData;
 444         lstrcpyW(to->pwszProvName, from->pwszProvName);
 445         nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 446     }
 447     else
 448         to->pwszProvName = NULL;
 449     to->dwProvType = from->dwProvType;
 450     to->dwFlags = from->dwFlags;
 451     to->cProvParam = from->cProvParam;
 452     to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
 453     nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 454     to->dwKeySpec = from->dwKeySpec;
 455     for (i = 0; i < to->cProvParam; i++)
 456     {
 457         memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
 458          sizeof(CRYPT_KEY_PROV_PARAM));
 459         to->rgProvParam[i].pbData = nextData;
 460         memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
 461          from->rgProvParam[i].cbData);
 462         nextData += from->rgProvParam[i].cbData;
 463     }
 464 }
 465
 466 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
 467  const CRYPT_KEY_PROV_INFO *info)
 468 {
 469     BOOL ret;
 470     LPBYTE buf = NULL;
 471     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
 472
 473     if (info->pwszContainerName)
 474         containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 475     else
 476         containerSize = 0;
 477     if (info->pwszProvName)
 478         provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 479     else
 480         provNameSize = 0;
 481     size += containerSize + provNameSize;
 482     for (i = 0; i < info->cProvParam; i++)
 483         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 484     buf = CryptMemAlloc(size);
 485     if (buf)
 486     {
 487         CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
 488         ret = ContextPropertyList_SetProperty(properties,
 489          CERT_KEY_PROV_INFO_PROP_ID, buf, size);
 490         CryptMemFree(buf);
 491     }
 492     else
 493         ret = FALSE;
 494     return ret;
 495 }
 496
 497 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
 498  DWORD dwFlags, const void *pvData)
 499 {
 500     PCONTEXT_PROPERTY_LIST properties =
 501      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 502     BOOL ret;
 503
 504     TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
 505
 506     if (!properties)
 507         ret = FALSE;
 508     else
 509     {
 510         switch (dwPropId)
 511         {
 512         case CERT_AUTO_ENROLL_PROP_ID:
 513         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 514         case CERT_DESCRIPTION_PROP_ID:
 515         case CERT_FRIENDLY_NAME_PROP_ID:
 516         case CERT_HASH_PROP_ID:
 517         case CERT_KEY_IDENTIFIER_PROP_ID:
 518         case CERT_MD5_HASH_PROP_ID:
 519         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 520         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 521         case CERT_PVK_FILE_PROP_ID:
 522         case CERT_SIGNATURE_HASH_PROP_ID:
 523         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 524         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 525         case CERT_EXTENDED_ERROR_INFO_PROP_ID:
 526         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 527         case CERT_ENROLLMENT_PROP_ID:
 528         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 529         case CERT_RENEWAL_PROP_ID:
 530         {
 531             if (pvData)
 532             {
 533                 const CRYPT_DATA_BLOB *blob = pvData;
 534
 535                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 536                  blob->pbData, blob->cbData);
 537             }
 538             else
 539             {
 540                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 541                 ret = TRUE;
 542             }
 543             break;
 544         }
 545         case CERT_DATE_STAMP_PROP_ID:
 546             if (pvData)
 547                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 548                  pvData, sizeof(FILETIME));
 549             else
 550             {
 551                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 552                 ret = TRUE;
 553             }
 554             break;
 555         case CERT_KEY_CONTEXT_PROP_ID:
 556         {
 557             if (pvData)
 558             {
 559                 const CERT_KEY_CONTEXT *keyContext = pvData;
 560
 561                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 562                 {
 563                     SetLastError(E_INVALIDARG);
 564                     ret = FALSE;
 565                 }
 566                 else
 567                     ret = ContextPropertyList_SetProperty(properties, dwPropId,
 568                      (const BYTE *)keyContext, keyContext->cbSize);
 569             }
 570             else
 571             {
 572                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 573                 ret = TRUE;
 574             }
 575             break;
 576         }
 577         case CERT_KEY_PROV_INFO_PROP_ID:
 578             if (pvData)
 579                 ret = CertContext_SetKeyProvInfoProperty(properties, pvData);
 580             else
 581             {
 582                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 583                 ret = TRUE;
 584             }
 585             break;
 586         case CERT_KEY_PROV_HANDLE_PROP_ID:
 587         {
 588             CERT_KEY_CONTEXT keyContext;
 589             DWORD size = sizeof(keyContext);
 590
 591             ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 592              &keyContext, &size);
 593             if (ret)
 594             {
 595                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 596                     CryptReleaseContext(keyContext.hCryptProv, 0);
 597             }
 598             keyContext.cbSize = sizeof(keyContext);
 599             if (pvData)
 600                 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 601             else
 602             {
 603                 keyContext.hCryptProv = 0;
 604                 keyContext.dwKeySpec = AT_SIGNATURE;
 605             }
 606             ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 607              0, &keyContext);
 608             break;
 609         }
 610         default:
 611             FIXME("%d: stub\n", dwPropId);
 612             ret = FALSE;
 613         }
 614     }
 615     TRACE("returning %d\n", ret);
 616     return ret;
 617 }
 618
 619 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 620  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 621 {
 622     BOOL ret;
 623
 624     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 625
 626     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 627      * crashes on most of these, I'll be safer.
 628      */
 629     switch (dwPropId)
 630     {
 631     case 0:
 632     case CERT_ACCESS_STATE_PROP_ID:
 633     case CERT_CERT_PROP_ID:
 634     case CERT_CRL_PROP_ID:
 635     case CERT_CTL_PROP_ID:
 636         SetLastError(E_INVALIDARG);
 637         return FALSE;
 638     }
 639     ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
 640      pvData);
 641     TRACE("returning %d\n", ret);
 642     return ret;
 643 }
 644
 645 /* Acquires the private key using the key provider info, retrieving info from
 646  * the certificate if info is NULL.  The acquired provider is returned in
 647  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 648  */
 649 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
 650  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 651 {
 652     DWORD size = 0;
 653     BOOL allocated = FALSE, ret = TRUE;
 654
 655     if (!info)
 656     {
 657         ret = CertGetCertificateContextProperty(pCert,
 658          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 659         if (ret)
 660         {
 661             info = HeapAlloc(GetProcessHeap(), 0, size);
 662             if (info)
 663             {
 664                 ret = CertGetCertificateContextProperty(pCert,
 665                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 666                 allocated = TRUE;
 667             }
 668             else
 669             {
 670                 SetLastError(ERROR_OUTOFMEMORY);
 671                 ret = FALSE;
 672             }
 673         }
 674         else
 675             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 676     }
 677     if (ret)
 678     {
 679         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 680          info->pwszProvName, info->dwProvType, 0);
 681         if (ret)
 682         {
 683             DWORD i;
 684
 685             for (i = 0; i < info->cProvParam; i++)
 686             {
 687                 CryptSetProvParam(*phCryptProv,
 688                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 689                  info->rgProvParam[i].dwFlags);
 690             }
 691             *pdwKeySpec = info->dwKeySpec;
 692         }
 693         else
 694             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 695     }
 696     if (allocated)
 697         HeapFree(GetProcessHeap(), 0, info);
 698     return ret;
 699 }
 700
 701 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 702  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 703  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 704 {
 705     BOOL ret = FALSE, cache = FALSE;
 706     PCRYPT_KEY_PROV_INFO info = NULL;
 707     CERT_KEY_CONTEXT keyContext;
 708     DWORD size;
 709
 710     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 711      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 712
 713     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 714     {
 715         DWORD size = 0;
 716
 717         ret = CertGetCertificateContextProperty(pCert,
 718          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 719         if (ret)
 720         {
 721             info = HeapAlloc(GetProcessHeap(), 0, size);
 722             ret = CertGetCertificateContextProperty(pCert,
 723              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 724             if (ret)
 725                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 726         }
 727     }
 728     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 729         cache = TRUE;
 730     *phCryptProv = 0;
 731     if (cache)
 732     {
 733         size = sizeof(keyContext);
 734         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 735          &keyContext, &size);
 736         if (ret)
 737         {
 738             *phCryptProv = keyContext.hCryptProv;
 739             if (pdwKeySpec)
 740                 *pdwKeySpec = keyContext.dwKeySpec;
 741             if (pfCallerFreeProv)
 742                 *pfCallerFreeProv = !cache;
 743         }
 744     }
 745     if (!*phCryptProv)
 746     {
 747         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
 748          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 749         if (ret)
 750         {
 751             *phCryptProv = keyContext.hCryptProv;
 752             if (pdwKeySpec)
 753                 *pdwKeySpec = keyContext.dwKeySpec;
 754             if (cache)
 755             {
 756                 keyContext.cbSize = sizeof(keyContext);
 757                 if (CertSetCertificateContextProperty(pCert,
 758                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 759                 {
 760                     if (pfCallerFreeProv)
 761                         *pfCallerFreeProv = FALSE;
 762                 }
 763             }
 764             else
 765             {
 766                 if (pfCallerFreeProv)
 767                     *pfCallerFreeProv = TRUE;
 768             }
 769         }
 770     }
 771     HeapFree(GetProcessHeap(), 0, info);
 772     return ret;
 773 }
 774
 775 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
 776  const CRYPT_KEY_PROV_INFO *keyProvInfo)
 777 {
 778     HCRYPTPROV csp;
 779     BOOL matches = FALSE;
 780
 781     if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
 782      keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
 783     {
 784         DWORD size;
 785
 786         /* Need to sign something to verify the sig.  What to sign?  Why not
 787          * the certificate itself?
 788          */
 789         if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
 790          pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
 791          &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
 792         {
 793             BYTE *certEncoded = CryptMemAlloc(size);
 794
 795             if (certEncoded)
 796             {
 797                 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
 798                  pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 799                  pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
 800                  NULL, certEncoded, &size))
 801                 {
 802                     if (size == pCert->cbCertEncoded &&
 803                      !memcmp(certEncoded, pCert->pbCertEncoded, size))
 804                         matches = TRUE;
 805                 }
 806                 CryptMemFree(certEncoded);
 807             }
 808         }
 809         CryptReleaseContext(csp, 0);
 810     }
 811     return matches;
 812 }
 813
 814 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
 815  CRYPT_KEY_PROV_INFO *keyProvInfo)
 816 {
 817     CRYPT_KEY_PROV_INFO copy;
 818     WCHAR containerW[MAX_PATH];
 819     BOOL matches = FALSE;
 820
 821     MultiByteToWideChar(CP_ACP, 0, container, -1,
 822      containerW, sizeof(containerW) / sizeof(containerW[0]));
 823     /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
 824      * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
 825      * name.
 826      */
 827     memcpy(&copy, keyProvInfo, sizeof(copy));
 828     copy.pwszContainerName = containerW;
 829     matches = key_prov_info_matches_cert(pCert, &copy);
 830     if (matches)
 831     {
 832         keyProvInfo->pwszContainerName =
 833          CryptMemAlloc((strlenW(containerW) + 1) * sizeof(WCHAR));
 834         if (keyProvInfo->pwszContainerName)
 835         {
 836             strcpyW(keyProvInfo->pwszContainerName, containerW);
 837             keyProvInfo->dwKeySpec = AT_SIGNATURE;
 838         }
 839         else
 840             matches = FALSE;
 841     }
 842     return matches;
 843 }
 844
 845 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
 846  * private key matches pCert's public key.  Upon success, updates keyProvInfo
 847  * with the matching container's info (free keyProvInfo.pwszContainerName upon
 848  * success.)
 849  * Returns TRUE if found, FALSE if not.
 850  */
 851 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
 852  CRYPT_KEY_PROV_INFO *keyProvInfo)
 853 {
 854     HCRYPTPROV defProvider;
 855     BOOL ret, found = FALSE;
 856     char containerA[MAX_PATH];
 857
 858     assert(keyProvInfo->pwszContainerName == NULL);
 859     if ((ret = CryptAcquireContextW(&defProvider, NULL,
 860      keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
 861      keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
 862     {
 863         DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
 864
 865         while (ret && !found)
 866         {
 867             DWORD size = sizeof(containerA);
 868
 869             ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
 870              (BYTE *)containerA, &size, enumFlags);
 871             if (ret)
 872                 found = container_matches_cert(pCert, containerA, keyProvInfo);
 873             if (enumFlags & CRYPT_FIRST)
 874             {
 875                 enumFlags &= ~CRYPT_FIRST;
 876                 enumFlags |= CRYPT_NEXT;
 877             }
 878         }
 879         CryptReleaseContext(defProvider, 0);
 880     }
 881     return found;
 882 }
 883
 884 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
 885 {
 886     BOOL found = FALSE, ret = TRUE;
 887     DWORD index = 0, cbProvName = 0;
 888     CRYPT_KEY_PROV_INFO keyProvInfo;
 889
 890     TRACE("(%p, %08x)\n", pCert, dwFlags);
 891
 892     memset(&keyProvInfo, 0, sizeof(keyProvInfo));
 893     while (ret && !found)
 894     {
 895         DWORD size = 0;
 896
 897         ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
 898          NULL, &size);
 899         if (ret)
 900         {
 901             if (size <= cbProvName)
 902                 ret = CryptEnumProvidersW(index, NULL, 0,
 903                  &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
 904             else
 905             {
 906                 CryptMemFree(keyProvInfo.pwszProvName);
 907                 keyProvInfo.pwszProvName = CryptMemAlloc(size);
 908                 if (keyProvInfo.pwszProvName)
 909                 {
 910                     cbProvName = size;
 911                     ret = CryptEnumProvidersW(index, NULL, 0,
 912                      &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
 913                     if (ret)
 914                     {
 915                         if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
 916                             keyProvInfo.dwFlags |= CRYPT_SILENT;
 917                         if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
 918                          !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
 919                          CRYPT_FIND_MACHINE_KEYSET_FLAG)))
 920                         {
 921                             keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
 922                             found = find_key_prov_info_in_provider(pCert,
 923                              &keyProvInfo);
 924                         }
 925                         if (!found)
 926                         {
 927                             if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
 928                              !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
 929                              CRYPT_FIND_MACHINE_KEYSET_FLAG)))
 930                             {
 931                                 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
 932                                 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
 933                                 found = find_key_prov_info_in_provider(pCert,
 934                                  &keyProvInfo);
 935                             }
 936                         }
 937                     }
 938                 }
 939                 else
 940                     ret = FALSE;
 941             }
 942             index++;
 943         }
 944     }
 945     if (found)
 946         CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
 947          0, &keyProvInfo);
 948     CryptMemFree(keyProvInfo.pwszProvName);
 949     CryptMemFree(keyProvInfo.pwszContainerName);
 950     return found;
 951 }
 952
 953 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
 954 {
 955     BOOL matches = FALSE;
 956     DWORD size;
 957
 958     if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
 959      NULL, &size))
 960     {
 961         CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
 962
 963         if (keyProvInfo)
 964         {
 965             if (CertGetCertificateContextProperty(pCert,
 966              CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
 967                 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
 968             CryptMemFree(keyProvInfo);
 969         }
 970     }
 971     return matches;
 972 }
 973
 974 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
 975  DWORD dwFlags, void *pvReserved)
 976 {
 977     BOOL matches = FALSE;
 978
 979     TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
 980
 981     matches = cert_prov_info_matches_cert(pCert);
 982     if (!matches)
 983         matches = find_matching_provider(pCert, dwFlags);
 984     return matches;
 985 }
 986
 987 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
 988  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
 989 {
 990     BOOL ret;
 991
 992     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
 993
 994     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
 995      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
 996      &pCertId2->SerialNumber);
 997     TRACE("returning %d\n", ret);
 998     return ret;
 999 }
1000
1001 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1002  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1003 {
1004     BOOL ret;
1005
1006     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1007
1008     if (pCertName1->cbData == pCertName2->cbData)
1009     {
1010         if (pCertName1->cbData)
1011             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1012              pCertName1->cbData);
1013         else
1014             ret = TRUE;
1015     }
1016     else
1017         ret = FALSE;
1018     TRACE("returning %d\n", ret);
1019     return ret;
1020 }
1021
1022 /* Returns the number of significant bytes in pInt, where a byte is
1023  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1024  * for negative numbers.  pInt is assumed to be little-endian.
1025  */
1026 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1027 {
1028     DWORD ret = pInt->cbData;
1029
1030     while (ret > 1)
1031     {
1032         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1033             ret--;
1034         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1035             ret--;
1036         else
1037             break;
1038     }
1039     return ret;
1040 }
1041
1042 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1043  PCRYPT_INTEGER_BLOB pInt2)
1044 {
1045     BOOL ret;
1046     DWORD cb1, cb2;
1047
1048     TRACE("(%p, %p)\n", pInt1, pInt2);
1049
1050     cb1 = CRYPT_significantBytes(pInt1);
1051     cb2 = CRYPT_significantBytes(pInt2);
1052     if (cb1 == cb2)
1053     {
1054         if (cb1)
1055             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1056         else
1057             ret = TRUE;
1058     }
1059     else
1060         ret = FALSE;
1061     TRACE("returning %d\n", ret);
1062     return ret;
1063 }
1064
1065 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1066  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1067 {
1068     BOOL ret;
1069
1070     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1071
1072     switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1073     {
1074     case 0:     /* Seems to mean "raw binary bits" */
1075         if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1076          pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1077         {
1078           if (pPublicKey2->PublicKey.cbData)
1079               ret = !memcmp(pPublicKey1->PublicKey.pbData,
1080                pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1081           else
1082               ret = TRUE;
1083         }
1084         else
1085             ret = FALSE;
1086         break;
1087     default:
1088         WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1089         /* FALLTHROUGH */
1090     case X509_ASN_ENCODING:
1091     {
1092         BLOBHEADER *pblob1, *pblob2;
1093         DWORD length;
1094         ret = FALSE;
1095         if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1096                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1097                     0, NULL, &length))
1098         {
1099             pblob1 = CryptMemAlloc(length);
1100             if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1101                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1102                     0, pblob1, &length))
1103             {
1104                 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1105                             pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1106                             0, NULL, &length))
1107                 {
1108                     pblob2 = CryptMemAlloc(length);
1109                     if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1110                             pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1111                             0, pblob2, &length))
1112                     {
1113                         /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1114                         RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1115                                   *pk2 = (LPVOID)(pblob2 + 1);
1116                         ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1117                                  && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1118                     }
1119                     CryptMemFree(pblob2);
1120                 }
1121             }
1122             CryptMemFree(pblob1);
1123         }
1124
1125         break;
1126     }
1127     }
1128     return ret;
1129 }
1130
1131 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1132  PCERT_PUBLIC_KEY_INFO pPublicKey)
1133 {
1134     DWORD len = 0;
1135
1136     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1137
1138     if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1139     {
1140         SetLastError(ERROR_FILE_NOT_FOUND);
1141         return 0;
1142     }
1143     if (pPublicKey->Algorithm.pszObjId &&
1144      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1145     {
1146         FIXME("unimplemented for DH public keys\n");
1147         SetLastError(CRYPT_E_ASN1_BADTAG);
1148     }
1149     else
1150     {
1151         DWORD size;
1152         PBYTE buf;
1153         BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
1154          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1155          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1156          &size);
1157
1158         if (ret)
1159         {
1160             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1161
1162             len = rsaPubKey->bitlen;
1163             LocalFree(buf);
1164         }
1165     }
1166     return len;
1167 }
1168
1169 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1170  DWORD dwFlags, const void *pvPara);
1171
1172 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1173  DWORD dwFlags, const void *pvPara)
1174 {
1175     BOOL ret;
1176     BYTE hash[16];
1177     DWORD size = sizeof(hash);
1178
1179     ret = CertGetCertificateContextProperty(pCertContext,
1180      CERT_MD5_HASH_PROP_ID, hash, &size);
1181     if (ret)
1182     {
1183         const CRYPT_HASH_BLOB *pHash = pvPara;
1184
1185         if (size == pHash->cbData)
1186             ret = !memcmp(pHash->pbData, hash, size);
1187         else
1188             ret = FALSE;
1189     }
1190     return ret;
1191 }
1192
1193 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1194  DWORD dwFlags, const void *pvPara)
1195 {
1196     BOOL ret;
1197     BYTE hash[20];
1198     DWORD size = sizeof(hash);
1199
1200     ret = CertGetCertificateContextProperty(pCertContext,
1201      CERT_SHA1_HASH_PROP_ID, hash, &size);
1202     if (ret)
1203     {
1204         const CRYPT_HASH_BLOB *pHash = pvPara;
1205
1206         if (size == pHash->cbData)
1207             ret = !memcmp(pHash->pbData, hash, size);
1208         else
1209             ret = FALSE;
1210     }
1211     return ret;
1212 }
1213
1214 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1215  DWORD dwFlags, const void *pvPara)
1216 {
1217     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1218     BOOL ret;
1219
1220     if (dwType & CERT_INFO_SUBJECT_FLAG)
1221         toCompare = &pCertContext->pCertInfo->Subject;
1222     else
1223         toCompare = &pCertContext->pCertInfo->Issuer;
1224     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1225      toCompare, blob);
1226     return ret;
1227 }
1228
1229 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1230  DWORD dwType, DWORD dwFlags, const void *pvPara)
1231 {
1232     CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1233     BOOL ret;
1234
1235     ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1236      &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1237     return ret;
1238 }
1239
1240 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1241  DWORD dwType, DWORD dwFlags, const void *pvPara)
1242 {
1243     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1244     BOOL ret;
1245
1246     /* Matching serial number and subject match.. */
1247     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1248      &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1249     if (ret)
1250         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1251          &pCertInfo->SerialNumber);
1252     else
1253     {
1254         /* failing that, if the serial number and issuer match, we match */
1255         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1256          &pCertInfo->SerialNumber);
1257         if (ret)
1258             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1259              &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1260     }
1261     TRACE("returning %d\n", ret);
1262     return ret;
1263 }
1264
1265 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1266  DWORD dwFlags, const void *pvPara)
1267 {
1268     CERT_ID *id = (CERT_ID *)pvPara;
1269     BOOL ret;
1270
1271     switch (id->dwIdChoice)
1272     {
1273     case CERT_ID_ISSUER_SERIAL_NUMBER:
1274         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1275          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1276         if (ret)
1277             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1278              &id->u.IssuerSerialNumber.SerialNumber);
1279         break;
1280     case CERT_ID_SHA1_HASH:
1281         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1282          &id->u.HashId);
1283         break;
1284     case CERT_ID_KEY_IDENTIFIER:
1285     {
1286         DWORD size = 0;
1287
1288         ret = CertGetCertificateContextProperty(pCertContext,
1289          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1290         if (ret && size == id->u.KeyId.cbData)
1291         {
1292             LPBYTE buf = CryptMemAlloc(size);
1293
1294             if (buf)
1295             {
1296                 CertGetCertificateContextProperty(pCertContext,
1297                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1298                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1299                 CryptMemFree(buf);
1300             }
1301         }
1302         else
1303             ret = FALSE;
1304         break;
1305     }
1306     default:
1307         ret = FALSE;
1308         break;
1309     }
1310     return ret;
1311 }
1312
1313 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1314  DWORD dwFlags, const void *pvPara)
1315 {
1316     PCCERT_CONTEXT toCompare = pvPara;
1317     return CertCompareCertificate(pCertContext->dwCertEncodingType,
1318      pCertContext->pCertInfo, toCompare->pCertInfo);
1319 }
1320
1321 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1322  DWORD dwFlags, const void *pvPara)
1323 {
1324     const CRYPT_HASH_BLOB *hash = pvPara;
1325     DWORD size = 0;
1326     BOOL ret;
1327
1328     ret = CertGetCertificateContextProperty(pCertContext,
1329      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1330     if (ret && size == hash->cbData)
1331     {
1332         LPBYTE buf = CryptMemAlloc(size);
1333
1334         if (buf)
1335         {
1336             CertGetCertificateContextProperty(pCertContext,
1337              CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1338             ret = !memcmp(buf, hash->pbData, size);
1339             CryptMemFree(buf);
1340         }
1341     }
1342     else
1343         ret = FALSE;
1344     return ret;
1345 }
1346
1347 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1348  PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1349  const void *pvPara)
1350 {
1351     BOOL matches = FALSE;
1352     PCCERT_CONTEXT ret;
1353
1354     ret = prev;
1355     do {
1356         ret = CertEnumCertificatesInStore(store, ret);
1357         if (ret)
1358             matches = compare(ret, dwType, dwFlags, pvPara);
1359     } while (ret != NULL && !matches);
1360     return ret;
1361 }
1362
1363 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1364  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1365
1366 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1367  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1368 {
1369     return CertEnumCertificatesInStore(store, prev);
1370 }
1371
1372 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1373  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1374 {
1375     BOOL ret;
1376     PCCERT_CONTEXT found = NULL, subject = pvPara;
1377     PCERT_EXTENSION ext;
1378     DWORD size;
1379
1380     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1381      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1382     {
1383         CERT_AUTHORITY_KEY_ID_INFO *info;
1384
1385         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1386          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1387          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1388          &info, &size);
1389         if (ret)
1390         {
1391             CERT_ID id;
1392
1393             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1394             {
1395                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1396                 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1397                  sizeof(CERT_NAME_BLOB));
1398                 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1399                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1400             }
1401             else if (info->KeyId.cbData)
1402             {
1403                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1404                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1405             }
1406             else
1407                 ret = FALSE;
1408             if (ret)
1409                 found = cert_compare_certs_in_store(store, prev,
1410                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1411             LocalFree(info);
1412         }
1413     }
1414     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1415      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1416     {
1417         CERT_AUTHORITY_KEY_ID2_INFO *info;
1418
1419         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1420          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1421          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1422          &info, &size);
1423         if (ret)
1424         {
1425             CERT_ID id;
1426
1427             if (info->AuthorityCertIssuer.cAltEntry &&
1428              info->AuthorityCertSerialNumber.cbData)
1429             {
1430                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1431                 DWORD i;
1432
1433                 for (i = 0; !directoryName &&
1434                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1435                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1436                      == CERT_ALT_NAME_DIRECTORY_NAME)
1437                         directoryName =
1438                          &info->AuthorityCertIssuer.rgAltEntry[i];
1439                 if (directoryName)
1440                 {
1441                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1442                     memcpy(&id.u.IssuerSerialNumber.Issuer,
1443                      &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1444                     memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1445                      &info->AuthorityCertSerialNumber,
1446                      sizeof(CRYPT_INTEGER_BLOB));
1447                 }
1448                 else
1449                 {
1450                     FIXME("no supported name type in authority key id2\n");
1451                     ret = FALSE;
1452                 }
1453             }
1454             else if (info->KeyId.cbData)
1455             {
1456                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1457                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1458             }
1459             else
1460                 ret = FALSE;
1461             if (ret)
1462                 found = cert_compare_certs_in_store(store, prev,
1463                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1464             LocalFree(info);
1465         }
1466     }
1467     else
1468        found = cert_compare_certs_in_store(store, prev,
1469         compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1470         dwFlags, &subject->pCertInfo->Issuer);
1471     return found;
1472 }
1473
1474 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1475  DWORD dwType, DWORD dwFlags, const void *pvPara)
1476 {
1477     PCERT_NAME_BLOB name;
1478     DWORD len;
1479     BOOL ret = FALSE;
1480
1481     if (dwType & CERT_INFO_SUBJECT_FLAG)
1482         name = &pCertContext->pCertInfo->Subject;
1483     else
1484         name = &pCertContext->pCertInfo->Issuer;
1485     len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1486      CERT_SIMPLE_NAME_STR, NULL, 0);
1487     if (len)
1488     {
1489         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1490
1491         if (str)
1492         {
1493             LPWSTR ptr;
1494
1495             CertNameToStrW(pCertContext->dwCertEncodingType, name,
1496              CERT_SIMPLE_NAME_STR, str, len);
1497             for (ptr = str; *ptr; ptr++)
1498                 *ptr = tolowerW(*ptr);
1499             if (strstrW(str, pvPara))
1500                 ret = TRUE;
1501             CryptMemFree(str);
1502         }
1503     }
1504     return ret;
1505 }
1506
1507 static PCCERT_CONTEXT find_cert_by_name_str(HCERTSTORE store, DWORD dwType,
1508  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1509 {
1510     PCCERT_CONTEXT found = NULL;
1511
1512     TRACE("%s\n", debugstr_w(pvPara));
1513
1514     if (pvPara)
1515     {
1516         DWORD len = strlenW(pvPara);
1517         LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1518
1519         if (str)
1520         {
1521             LPCWSTR src;
1522             LPWSTR dst;
1523
1524             for (src = pvPara, dst = str; *src; src++, dst++)
1525                 *dst = tolowerW(*src);
1526             *dst = 0;
1527            found = cert_compare_certs_in_store(store, prev,
1528             compare_cert_by_name_str, dwType, dwFlags, str);
1529            CryptMemFree(str);
1530         }
1531     }
1532     else
1533         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1534     return found;
1535 }
1536
1537 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1538  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1539  PCCERT_CONTEXT pPrevCertContext)
1540 {
1541     PCCERT_CONTEXT ret;
1542     CertFindFunc find = NULL;
1543     CertCompareFunc compare = NULL;
1544
1545     TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1546          dwFlags, dwType, pvPara, pPrevCertContext);
1547
1548     switch (dwType >> CERT_COMPARE_SHIFT)
1549     {
1550     case CERT_COMPARE_ANY:
1551         find = find_cert_any;
1552         break;
1553     case CERT_COMPARE_MD5_HASH:
1554         compare = compare_cert_by_md5_hash;
1555         break;
1556     case CERT_COMPARE_SHA1_HASH:
1557         compare = compare_cert_by_sha1_hash;
1558         break;
1559     case CERT_COMPARE_NAME:
1560         compare = compare_cert_by_name;
1561         break;
1562     case CERT_COMPARE_PUBLIC_KEY:
1563         compare = compare_cert_by_public_key;
1564         break;
1565     case CERT_COMPARE_NAME_STR_W:
1566         find = find_cert_by_name_str;
1567         break;
1568     case CERT_COMPARE_SUBJECT_CERT:
1569         compare = compare_cert_by_subject_cert;
1570         break;
1571     case CERT_COMPARE_CERT_ID:
1572         compare = compare_cert_by_cert_id;
1573         break;
1574     case CERT_COMPARE_ISSUER_OF:
1575         find = find_cert_by_issuer;
1576         break;
1577     case CERT_COMPARE_EXISTING:
1578         compare = compare_existing_cert;
1579         break;
1580     case CERT_COMPARE_SIGNATURE_HASH:
1581         compare = compare_cert_by_signature_hash;
1582         break;
1583     default:
1584         FIXME("find type %08x unimplemented\n", dwType);
1585     }
1586
1587     if (find)
1588         ret = find(hCertStore, dwFlags, dwType, pvPara, pPrevCertContext);
1589     else if (compare)
1590         ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1591          compare, dwType, dwFlags, pvPara);
1592     else
1593         ret = NULL;
1594     if (!ret)
1595         SetLastError(CRYPT_E_NOT_FOUND);
1596     TRACE("returning %p\n", ret);
1597     return ret;
1598 }
1599
1600 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1601  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1602 {
1603     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1604
1605     if (!pCertId)
1606     {
1607         SetLastError(E_INVALIDARG);
1608         return NULL;
1609     }
1610     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1611      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1612 }
1613
1614 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1615  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1616 {
1617     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1618      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1619
1620     if (*pdwFlags & ~supportedFlags)
1621     {
1622         SetLastError(E_INVALIDARG);
1623         return FALSE;
1624     }
1625     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1626     {
1627         DWORD flags = 0;
1628         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1629          NULL, &flags);
1630
1631         /* FIXME: what if the CRL has expired? */
1632         if (crl)
1633         {
1634             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1635              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1636                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1637         }
1638         else
1639             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1640     }
1641     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1642     {
1643         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1644             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1645     }
1646     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1647     {
1648         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1649          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1650          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1651             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1652     }
1653     return TRUE;
1654 }
1655
1656 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1657  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1658  DWORD *pdwFlags)
1659 {
1660     PCCERT_CONTEXT ret;
1661
1662     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1663      pPrevIssuerContext, *pdwFlags);
1664
1665     if (!pSubjectContext)
1666     {
1667         SetLastError(E_INVALIDARG);
1668         return NULL;
1669     }
1670
1671     ret = CertFindCertificateInStore(hCertStore,
1672      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1673      pSubjectContext, pPrevIssuerContext);
1674     if (ret)
1675     {
1676         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1677          pdwFlags))
1678         {
1679             CertFreeCertificateContext(ret);
1680             ret = NULL;
1681         }
1682     }
1683     TRACE("returning %p\n", ret);
1684     return ret;
1685 }
1686
1687 typedef struct _OLD_CERT_REVOCATION_STATUS {
1688     DWORD cbSize;
1689     DWORD dwIndex;
1690     DWORD dwError;
1691     DWORD dwReason;
1692 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1693
1694 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1695  void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1696
1697 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1698  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1699  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1700 {
1701     BOOL ret;
1702
1703     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1704      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1705
1706     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1707      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1708     {
1709         SetLastError(E_INVALIDARG);
1710         return FALSE;
1711     }
1712     if (cContext)
1713     {
1714         static HCRYPTOIDFUNCSET set = NULL;
1715         DWORD size;
1716
1717         if (!set)
1718             set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1719         ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1720         if (ret)
1721         {
1722             if (size == 1)
1723             {
1724                 /* empty list */
1725                 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1726                 ret = FALSE;
1727             }
1728             else
1729             {
1730                 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1731
1732                 if (dllList)
1733                 {
1734                     ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1735                      dllList, &size);
1736                     if (ret)
1737                     {
1738                         for (ptr = dllList; ret && *ptr;
1739                          ptr += lstrlenW(ptr) + 1)
1740                         {
1741                             CertVerifyRevocationFunc func;
1742                             HCRYPTOIDFUNCADDR hFunc;
1743
1744                             ret = CryptGetDefaultOIDFunctionAddress(set,
1745                              dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1746                             if (ret)
1747                             {
1748                                 ret = func(dwEncodingType, dwRevType, cContext,
1749                                  rgpvContext, dwFlags, pRevPara, pRevStatus);
1750                                 CryptFreeOIDFunctionAddress(hFunc, 0);
1751                             }
1752                         }
1753                     }
1754                     CryptMemFree(dllList);
1755                 }
1756                 else
1757                 {
1758                     SetLastError(ERROR_OUTOFMEMORY);
1759                     ret = FALSE;
1760                 }
1761             }
1762         }
1763     }
1764     else
1765         ret = TRUE;
1766     return ret;
1767 }
1768
1769 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1770  CRYPT_ATTRIBUTE rgAttr[])
1771 {
1772     PCRYPT_ATTRIBUTE ret = NULL;
1773     DWORD i;
1774
1775     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1776
1777     if (!cAttr)
1778         return NULL;
1779     if (!pszObjId)
1780     {
1781         SetLastError(ERROR_INVALID_PARAMETER);
1782         return NULL;
1783     }
1784
1785     for (i = 0; !ret && i < cAttr; i++)
1786         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1787             ret = &rgAttr[i];
1788     return ret;
1789 }
1790
1791 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1792  CERT_EXTENSION rgExtensions[])
1793 {
1794     PCERT_EXTENSION ret = NULL;
1795     DWORD i;
1796
1797     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1798
1799     if (!cExtensions)
1800         return NULL;
1801     if (!pszObjId)
1802     {
1803         SetLastError(ERROR_INVALID_PARAMETER);
1804         return NULL;
1805     }
1806
1807     for (i = 0; !ret && i < cExtensions; i++)
1808         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1809          rgExtensions[i].pszObjId))
1810             ret = &rgExtensions[i];
1811     return ret;
1812 }
1813
1814 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1815 {
1816     PCERT_RDN_ATTR ret = NULL;
1817     DWORD i, j;
1818
1819     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1820
1821     if (!pszObjId)
1822     {
1823         SetLastError(ERROR_INVALID_PARAMETER);
1824         return NULL;
1825     }
1826
1827     for (i = 0; !ret && i < pName->cRDN; i++)
1828         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1829             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1830              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1831                 ret = &pName->rgRDN[i].rgRDNAttr[j];
1832     return ret;
1833 }
1834
1835 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
1836  const CERT_RDN_ATTR *attr)
1837 {
1838     DWORD i, j;
1839     BOOL match = FALSE;
1840
1841     for (i = 0; !match && i < name->cRDN; i++)
1842     {
1843         for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
1844         {
1845             if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
1846              attr->pszObjId) &&
1847              name->rgRDN[i].rgRDNAttr[j].dwValueType ==
1848              attr->dwValueType)
1849             {
1850                 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
1851                 {
1852                     LPCWSTR nameStr =
1853                      (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
1854                     LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
1855
1856                     if (attr->Value.cbData !=
1857                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
1858                         match = FALSE;
1859                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
1860                         match = !strncmpiW(nameStr, attrStr,
1861                          attr->Value.cbData / sizeof(WCHAR));
1862                     else
1863                         match = !strncmpW(nameStr, attrStr,
1864                          attr->Value.cbData / sizeof(WCHAR));
1865                     TRACE("%s : %s => %d\n",
1866                      debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
1867                      debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
1868                      match);
1869                 }
1870                 else
1871                 {
1872                     LPCSTR nameStr =
1873                      (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
1874                     LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
1875
1876                     if (attr->Value.cbData !=
1877                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
1878                         match = FALSE;
1879                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
1880                         match = !strncasecmp(nameStr, attrStr,
1881                          attr->Value.cbData);
1882                     else
1883                         match = !strncmp(nameStr, attrStr, attr->Value.cbData);
1884                     TRACE("%s : %s => %d\n",
1885                      debugstr_an(nameStr, attr->Value.cbData),
1886                      debugstr_an(attrStr, attr->Value.cbData), match);
1887                 }
1888             }
1889         }
1890     }
1891     return match;
1892 }
1893
1894 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
1895  DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
1896 {
1897     CERT_NAME_INFO *name;
1898     LPCSTR type;
1899     DWORD size;
1900     BOOL ret;
1901
1902     TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
1903      pRDN);
1904
1905     type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
1906      X509_NAME;
1907     if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
1908      pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
1909     {
1910         DWORD i;
1911
1912         for (i = 0; ret && i < pRDN->cRDNAttr; i++)
1913             ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
1914         if (!ret)
1915             SetLastError(CRYPT_E_NO_MATCH);
1916         LocalFree(name);
1917     }
1918     return ret;
1919 }
1920
1921 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1922  PCERT_INFO pCertInfo)
1923 {
1924     FILETIME fileTime;
1925     LONG ret;
1926
1927     if (!pTimeToVerify)
1928     {
1929         GetSystemTimeAsFileTime(&fileTime);
1930         pTimeToVerify = &fileTime;
1931     }
1932     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1933     {
1934         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1935         if (ret < 0)
1936             ret = 0;
1937     }
1938     return ret;
1939 }
1940
1941 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1942  PCERT_INFO pIssuerInfo)
1943 {
1944     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1945
1946     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1947      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1948 }
1949
1950 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1951  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1952  DWORD *pcbComputedHash)
1953 {
1954     BOOL ret = TRUE;
1955     HCRYPTHASH hHash = 0;
1956
1957     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1958      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1959
1960     if (!hCryptProv)
1961         hCryptProv = CRYPT_GetDefaultProvider();
1962     if (!Algid)
1963         Algid = CALG_SHA1;
1964     if (ret)
1965     {
1966         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1967         if (ret)
1968         {
1969             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1970             if (ret)
1971                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1972                  pcbComputedHash, 0);
1973             CryptDestroyHash(hHash);
1974         }
1975     }
1976     return ret;
1977 }
1978
1979 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1980  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1981  BYTE *pbComputedHash, DWORD *pcbComputedHash)
1982 {
1983     BOOL ret = TRUE;
1984     HCRYPTHASH hHash = 0;
1985
1986     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1987      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1988
1989     if (!hCryptProv)
1990         hCryptProv = CRYPT_GetDefaultProvider();
1991     if (!Algid)
1992         Algid = CALG_MD5;
1993     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
1994     {
1995         SetLastError(ERROR_FILE_NOT_FOUND);
1996         return FALSE;
1997     }
1998     if (ret)
1999     {
2000         BYTE *buf;
2001         DWORD size = 0;
2002
2003         ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2004          X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2005          (LPBYTE)&buf, &size);
2006         if (ret)
2007         {
2008             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2009             if (ret)
2010             {
2011                 ret = CryptHashData(hHash, buf, size, 0);
2012                 if (ret)
2013                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2014                      pcbComputedHash, 0);
2015                 CryptDestroyHash(hHash);
2016             }
2017             LocalFree(buf);
2018         }
2019     }
2020     return ret;
2021 }
2022
2023 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2024  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2025  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2026 {
2027     BOOL ret;
2028     CERT_SIGNED_CONTENT_INFO *info;
2029     DWORD size;
2030
2031     TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2032      pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2033
2034     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2035      pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2036     if (ret)
2037     {
2038         PCCRYPT_OID_INFO oidInfo;
2039         HCRYPTHASH hHash;
2040
2041         if (!hCryptProv)
2042             hCryptProv = CRYPT_GetDefaultProvider();
2043         oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2044          info->SignatureAlgorithm.pszObjId, 0);
2045         if (!oidInfo)
2046         {
2047             SetLastError(NTE_BAD_ALGID);
2048             ret = FALSE;
2049         }
2050         else
2051         {
2052             ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2053             if (ret)
2054             {
2055                 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2056                  info->ToBeSigned.cbData, 0);
2057                 if (ret)
2058                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2059                      pcbComputedHash, 0);
2060                 CryptDestroyHash(hHash);
2061             }
2062         }
2063         LocalFree(info);
2064     }
2065     return ret;
2066 }
2067
2068 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2069  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2070  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2071  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2072 {
2073     BOOL ret;
2074     PCCRYPT_OID_INFO info;
2075     HCRYPTHASH hHash;
2076
2077     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2078      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2079      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2080
2081     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2082      pSignatureAlgorithm->pszObjId, 0);
2083     if (!info)
2084     {
2085         SetLastError(NTE_BAD_ALGID);
2086         return FALSE;
2087     }
2088     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2089     {
2090         if (!hCryptProv)
2091             hCryptProv = CRYPT_GetDefaultProvider();
2092         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2093         if (ret)
2094         {
2095             ret = CryptHashData(hHash, pbEncodedToBeSigned,
2096              cbEncodedToBeSigned, 0);
2097             if (ret)
2098                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2099                  pcbSignature, 0);
2100             CryptDestroyHash(hHash);
2101         }
2102     }
2103     else
2104     {
2105         if (!hCryptProv)
2106         {
2107             SetLastError(ERROR_INVALID_PARAMETER);
2108             ret = FALSE;
2109         }
2110         else
2111         {
2112             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2113             if (ret)
2114             {
2115                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2116                  cbEncodedToBeSigned, 0);
2117                 if (ret)
2118                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2119                      pcbSignature);
2120                 CryptDestroyHash(hHash);
2121             }
2122         }
2123     }
2124     return ret;
2125 }
2126
2127 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2128  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2129  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2130  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2131 {
2132     BOOL ret;
2133     DWORD encodedSize, hashSize;
2134
2135     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2136      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2137      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2138
2139     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2140      NULL, &encodedSize);
2141     if (ret)
2142     {
2143         PBYTE encoded = CryptMemAlloc(encodedSize);
2144
2145         if (encoded)
2146         {
2147             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2148              pvStructInfo, encoded, &encodedSize);
2149             if (ret)
2150             {
2151                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2152                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2153                  pvHashAuxInfo, NULL, &hashSize);
2154                 if (ret)
2155                 {
2156                     PBYTE hash = CryptMemAlloc(hashSize);
2157
2158                     if (hash)
2159                     {
2160                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2161                          dwCertEncodingType, encoded, encodedSize,
2162                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2163                         if (ret)
2164                         {
2165                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2166
2167                             info.ToBeSigned.cbData = encodedSize;
2168                             info.ToBeSigned.pbData = encoded;
2169                             memcpy(&info.SignatureAlgorithm,
2170                              pSignatureAlgorithm,
2171                              sizeof(info.SignatureAlgorithm));
2172                             info.Signature.cbData = hashSize;
2173                             info.Signature.pbData = hash;
2174                             info.Signature.cUnusedBits = 0;
2175                             ret = CryptEncodeObject(dwCertEncodingType,
2176                              X509_CERT, &info, pbEncoded, pcbEncoded);
2177                         }
2178                         CryptMemFree(hash);
2179                     }
2180                 }
2181             }
2182             CryptMemFree(encoded);
2183         }
2184     }
2185     return ret;
2186 }
2187
2188 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2189  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2190  PCERT_PUBLIC_KEY_INFO pPublicKey)
2191 {
2192     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2193      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
2194      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2195 }
2196
2197 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
2198  DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
2199  const CERT_SIGNED_CONTENT_INFO *signedCert)
2200 {
2201     BOOL ret;
2202     HCRYPTKEY key;
2203     PCCRYPT_OID_INFO info;
2204     ALG_ID pubKeyID, hashID;
2205
2206     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2207      signedCert->SignatureAlgorithm.pszObjId, 0);
2208     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2209     {
2210         SetLastError(NTE_BAD_ALGID);
2211         return FALSE;
2212     }
2213     hashID = info->u.Algid;
2214     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2215         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2216     else
2217         pubKeyID = hashID;
2218     /* Load the default provider if necessary */
2219     if (!hCryptProv)
2220         hCryptProv = CRYPT_GetDefaultProvider();
2221     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2222      pubKeyInfo, pubKeyID, 0, NULL, &key);
2223     if (ret)
2224     {
2225         HCRYPTHASH hash;
2226
2227         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2228         if (ret)
2229         {
2230             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2231              signedCert->ToBeSigned.cbData, 0);
2232             if (ret)
2233                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2234                  signedCert->Signature.cbData, key, NULL, 0);
2235             CryptDestroyHash(hash);
2236         }
2237         CryptDestroyKey(key);
2238     }
2239     return ret;
2240 }
2241
2242 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2243  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2244  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2245 {
2246     BOOL ret = TRUE;
2247     CRYPT_DATA_BLOB subjectBlob;
2248
2249     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2250      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2251      dwFlags, pvReserved);
2252
2253     switch (dwSubjectType)
2254     {
2255     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2256     {
2257         PCRYPT_DATA_BLOB blob = pvSubject;
2258
2259         subjectBlob.pbData = blob->pbData;
2260         subjectBlob.cbData = blob->cbData;
2261         break;
2262     }
2263     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2264     {
2265         PCERT_CONTEXT context = pvSubject;
2266
2267         subjectBlob.pbData = context->pbCertEncoded;
2268         subjectBlob.cbData = context->cbCertEncoded;
2269         break;
2270     }
2271     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2272     {
2273         PCRL_CONTEXT context = pvSubject;
2274
2275         subjectBlob.pbData = context->pbCrlEncoded;
2276         subjectBlob.cbData = context->cbCrlEncoded;
2277         break;
2278     }
2279     default:
2280         SetLastError(E_INVALIDARG);
2281         ret = FALSE;
2282     }
2283
2284     if (ret)
2285     {
2286         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2287         DWORD size = 0;
2288
2289         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2290          subjectBlob.pbData, subjectBlob.cbData,
2291          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2292          &signedCert, &size);
2293         if (ret)
2294         {
2295             switch (dwIssuerType)
2296             {
2297             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2298                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2299                  dwCertEncodingType, pvIssuer,
2300                  signedCert);
2301                 break;
2302             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2303                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2304                  dwCertEncodingType,
2305                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2306                  signedCert);
2307                 break;
2308             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2309                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2310                 ret = FALSE;
2311                 break;
2312             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2313                 if (pvIssuer)
2314                 {
2315                     SetLastError(E_INVALIDARG);
2316                     ret = FALSE;
2317                 }
2318                 else
2319                 {
2320                     FIXME("unimplemented for NULL signer\n");
2321                     SetLastError(E_INVALIDARG);
2322                     ret = FALSE;
2323                 }
2324                 break;
2325             default:
2326                 SetLastError(E_INVALIDARG);
2327                 ret = FALSE;
2328             }
2329             LocalFree(signedCert);
2330         }
2331     }
2332     return ret;
2333 }
2334
2335 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2336  PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2337 {
2338     PCERT_EXTENSION ext;
2339     BOOL ret = FALSE;
2340
2341     TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2342      cbKeyUsage);
2343
2344     ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2345      pCertInfo->rgExtension);
2346     if (ext)
2347     {
2348         CRYPT_BIT_BLOB usage;
2349         DWORD size = sizeof(usage);
2350
2351         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2352          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2353          &usage, &size);
2354         if (ret)
2355         {
2356             if (cbKeyUsage < usage.cbData)
2357                 ret = FALSE;
2358             else
2359             {
2360                 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2361                 if (cbKeyUsage > usage.cbData)
2362                     memset(pbKeyUsage + usage.cbData, 0,
2363                      cbKeyUsage - usage.cbData);
2364             }
2365         }
2366     }
2367     else
2368         SetLastError(0);
2369     return ret;
2370 }
2371
2372 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2373  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2374 {
2375     PCERT_ENHKEY_USAGE usage = NULL;
2376     DWORD bytesNeeded;
2377     BOOL ret = TRUE;
2378
2379     if (!pCertContext || !pcbUsage)
2380     {
2381         SetLastError(ERROR_INVALID_PARAMETER);
2382         return FALSE;
2383     }
2384
2385     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2386
2387     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2388     {
2389         DWORD propSize = 0;
2390
2391         if (CertGetCertificateContextProperty(pCertContext,
2392          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2393         {
2394             LPBYTE buf = CryptMemAlloc(propSize);
2395
2396             if (buf)
2397             {
2398                 if (CertGetCertificateContextProperty(pCertContext,
2399                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2400                 {
2401                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2402                      X509_ENHANCED_KEY_USAGE, buf, propSize,
2403                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2404                 }
2405                 CryptMemFree(buf);
2406             }
2407         }
2408     }
2409     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2410     {
2411         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2412          pCertContext->pCertInfo->cExtension,
2413          pCertContext->pCertInfo->rgExtension);
2414
2415         if (ext)
2416         {
2417             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2418              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
2419              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2420         }
2421     }
2422     if (!usage)
2423     {
2424         /* If a particular location is specified, this should fail.  Otherwise
2425          * it should succeed with an empty usage.  (This is true on Win2k and
2426          * later, which we emulate.)
2427          */
2428         if (dwFlags)
2429         {
2430             SetLastError(CRYPT_E_NOT_FOUND);
2431             ret = FALSE;
2432         }
2433         else
2434             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
2435     }
2436
2437     if (ret)
2438     {
2439         if (!pUsage)
2440             *pcbUsage = bytesNeeded;
2441         else if (*pcbUsage < bytesNeeded)
2442         {
2443             SetLastError(ERROR_MORE_DATA);
2444             *pcbUsage = bytesNeeded;
2445             ret = FALSE;
2446         }
2447         else
2448         {
2449             *pcbUsage = bytesNeeded;
2450             if (usage)
2451             {
2452                 DWORD i;
2453                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
2454                  sizeof(CERT_ENHKEY_USAGE) +
2455                  usage->cUsageIdentifier * sizeof(LPSTR));
2456
2457                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
2458                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
2459                  sizeof(CERT_ENHKEY_USAGE));
2460                 for (i = 0; i < usage->cUsageIdentifier; i++)
2461                 {
2462                     pUsage->rgpszUsageIdentifier[i] = nextOID;
2463                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2464                     nextOID += strlen(nextOID) + 1;
2465                 }
2466             }
2467             else
2468                 pUsage->cUsageIdentifier = 0;
2469         }
2470     }
2471     if (usage)
2472         LocalFree(usage);
2473     TRACE("returning %d\n", ret);
2474     return ret;
2475 }
2476
2477 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
2478  PCERT_ENHKEY_USAGE pUsage)
2479 {
2480     BOOL ret;
2481
2482     TRACE("(%p, %p)\n", pCertContext, pUsage);
2483
2484     if (pUsage)
2485     {
2486         CRYPT_DATA_BLOB blob = { 0, NULL };
2487
2488         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2489          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2490         if (ret)
2491         {
2492             ret = CertSetCertificateContextProperty(pCertContext,
2493              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2494             LocalFree(blob.pbData);
2495         }
2496     }
2497     else
2498         ret = CertSetCertificateContextProperty(pCertContext,
2499          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2500     return ret;
2501 }
2502
2503 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2504  LPCSTR pszUsageIdentifier)
2505 {
2506     BOOL ret;
2507     DWORD size;
2508
2509     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2510
2511     if (CertGetEnhancedKeyUsage(pCertContext,
2512      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2513     {
2514         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2515
2516         if (usage)
2517         {
2518             ret = CertGetEnhancedKeyUsage(pCertContext,
2519              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2520             if (ret)
2521             {
2522                 DWORD i;
2523                 BOOL exists = FALSE;
2524
2525                 /* Make sure usage doesn't already exist */
2526                 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2527                 {
2528                     if (!strcmp(usage->rgpszUsageIdentifier[i],
2529                      pszUsageIdentifier))
2530                         exists = TRUE;
2531                 }
2532                 if (!exists)
2533                 {
2534                     PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2535                      sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2536
2537                     if (newUsage)
2538                     {
2539                         LPSTR nextOID;
2540
2541                         newUsage->rgpszUsageIdentifier = (LPSTR *)
2542                          ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2543                         nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2544                           + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2545                         for (i = 0; i < usage->cUsageIdentifier; i++)
2546                         {
2547                             newUsage->rgpszUsageIdentifier[i] = nextOID;
2548                             strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2549                             nextOID += strlen(nextOID) + 1;
2550                         }
2551                         newUsage->rgpszUsageIdentifier[i] = nextOID;
2552                         strcpy(nextOID, pszUsageIdentifier);
2553                         newUsage->cUsageIdentifier = i + 1;
2554                         ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2555                         CryptMemFree(newUsage);
2556                     }
2557                     else
2558                         ret = FALSE;
2559                 }
2560             }
2561             CryptMemFree(usage);
2562         }
2563         else
2564             ret = FALSE;
2565     }
2566     else
2567     {
2568         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2569          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2570
2571         if (usage)
2572         {
2573             usage->rgpszUsageIdentifier =
2574              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2575             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2576              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2577             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2578             usage->cUsageIdentifier = 1;
2579             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2580             CryptMemFree(usage);
2581         }
2582         else
2583             ret = FALSE;
2584     }
2585     return ret;
2586 }
2587
2588 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2589  LPCSTR pszUsageIdentifier)
2590 {
2591     BOOL ret;
2592     DWORD size;
2593     CERT_ENHKEY_USAGE usage;
2594
2595     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2596
2597     size = sizeof(usage);
2598     ret = CertGetEnhancedKeyUsage(pCertContext,
2599      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2600     if (!ret && GetLastError() == ERROR_MORE_DATA)
2601     {
2602         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2603
2604         if (pUsage)
2605         {
2606             ret = CertGetEnhancedKeyUsage(pCertContext,
2607              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2608             if (ret)
2609             {
2610                 if (pUsage->cUsageIdentifier)
2611                 {
2612                     DWORD i;
2613                     BOOL found = FALSE;
2614
2615                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
2616                     {
2617                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2618                          pszUsageIdentifier))
2619                             found = TRUE;
2620                         if (found && i < pUsage->cUsageIdentifier - 1)
2621                             pUsage->rgpszUsageIdentifier[i] =
2622                              pUsage->rgpszUsageIdentifier[i + 1];
2623                     }
2624                     pUsage->cUsageIdentifier--;
2625                     /* Remove the usage if it's empty */
2626                     if (pUsage->cUsageIdentifier)
2627                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2628                     else
2629                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2630                 }
2631             }
2632             CryptMemFree(pUsage);
2633         }
2634         else
2635             ret = FALSE;
2636     }
2637     else
2638     {
2639         /* it fit in an empty usage, therefore there's nothing to remove */
2640         ret = TRUE;
2641     }
2642     return ret;
2643 }
2644
2645 struct BitField
2646 {
2647     DWORD  cIndexes;
2648     DWORD *indexes;
2649 };
2650
2651 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2652
2653 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2654 {
2655     DWORD indexIndex = bit / BITS_PER_DWORD;
2656
2657     if (indexIndex + 1 > field->cIndexes)
2658     {
2659         if (field->cIndexes)
2660             field->indexes = CryptMemRealloc(field->indexes,
2661              (indexIndex + 1) * sizeof(DWORD));
2662         else
2663             field->indexes = CryptMemAlloc(sizeof(DWORD));
2664         if (field->indexes)
2665         {
2666             field->indexes[indexIndex] = 0;
2667             field->cIndexes = indexIndex + 1;
2668         }
2669     }
2670     if (field->indexes)
2671         field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2672 }
2673
2674 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
2675 {
2676     BOOL set = FALSE;
2677     DWORD indexIndex = bit / BITS_PER_DWORD;
2678
2679     assert(field->cIndexes);
2680     set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2681     return set;
2682 }
2683
2684 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2685  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2686 {
2687     BOOL ret = TRUE;
2688     DWORD i, cbOIDs = 0;
2689     BOOL allUsagesValid = TRUE;
2690     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2691
2692     TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2693      rghOIDs, *pcbOIDs);
2694
2695     for (i = 0; i < cCerts; i++)
2696     {
2697         CERT_ENHKEY_USAGE usage;
2698         DWORD size = sizeof(usage);
2699
2700         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2701         /* Success is deliberately ignored: it implies all usages are valid */
2702         if (!ret && GetLastError() == ERROR_MORE_DATA)
2703         {
2704             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2705
2706             allUsagesValid = FALSE;
2707             if (pUsage)
2708             {
2709                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2710                 if (ret)
2711                 {
2712                     if (!validUsages.cUsageIdentifier)
2713                     {
2714                         DWORD j;
2715
2716                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2717                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2718                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2719                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2720                              + 1;
2721                         validUsages.rgpszUsageIdentifier =
2722                          CryptMemAlloc(cbOIDs);
2723                         if (validUsages.rgpszUsageIdentifier)
2724                         {
2725                             LPSTR nextOID = (LPSTR)
2726                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
2727                              validUsages.cUsageIdentifier * sizeof(LPSTR));
2728
2729                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
2730                             {
2731                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
2732                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2733                                  pUsage->rgpszUsageIdentifier[j]);
2734                                 nextOID += lstrlenA(nextOID) + 1;
2735                             }
2736                         }
2737                     }
2738                     else
2739                     {
2740                         struct BitField validIndexes = { 0, NULL };
2741                         DWORD j, k, numRemoved = 0;
2742
2743                         /* Merge: build a bitmap of all the indexes of
2744                          * validUsages.rgpszUsageIdentifier that are in pUsage.
2745                          */
2746                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
2747                         {
2748                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
2749                             {
2750                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2751                                  validUsages.rgpszUsageIdentifier[k]))
2752                                 {
2753                                     CRYPT_SetBitInField(&validIndexes, k);
2754                                     break;
2755                                 }
2756                             }
2757                         }
2758                         /* Merge by removing from validUsages those that are
2759                          * not in the bitmap.
2760                          */
2761                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2762                         {
2763                             if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2764                             {
2765                                 if (j < validUsages.cUsageIdentifier - 1)
2766                                 {
2767                                     memmove(&validUsages.rgpszUsageIdentifier[j],
2768                                      &validUsages.rgpszUsageIdentifier[j +
2769                                      numRemoved + 1],
2770                                      (validUsages.cUsageIdentifier - numRemoved
2771                                      - j - 1) * sizeof(LPSTR));
2772                                     cbOIDs -= lstrlenA(
2773                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
2774                                      sizeof(LPSTR);
2775                                     validUsages.cUsageIdentifier--;
2776                                     numRemoved++;
2777                                 }
2778                                 else
2779                                     validUsages.cUsageIdentifier--;
2780                             }
2781                         }
2782                         CryptMemFree(validIndexes.indexes);
2783                     }
2784                 }
2785                 CryptMemFree(pUsage);
2786             }
2787         }
2788     }
2789     ret = TRUE;
2790     if (allUsagesValid)
2791     {
2792         *cNumOIDs = -1;
2793         *pcbOIDs = 0;
2794     }
2795     else
2796     {
2797         *cNumOIDs = validUsages.cUsageIdentifier;
2798         if (!rghOIDs)
2799             *pcbOIDs = cbOIDs;
2800         else if (*pcbOIDs < cbOIDs)
2801         {
2802             *pcbOIDs = cbOIDs;
2803             SetLastError(ERROR_MORE_DATA);
2804             ret = FALSE;
2805         }
2806         else
2807         {
2808             LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2809              validUsages.cUsageIdentifier * sizeof(LPSTR));
2810
2811             *pcbOIDs = cbOIDs;
2812             for (i = 0; i < validUsages.cUsageIdentifier; i++)
2813             {
2814                 rghOIDs[i] = nextOID;
2815                 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2816                 nextOID += lstrlenA(nextOID) + 1;
2817             }
2818         }
2819     }
2820     CryptMemFree(validUsages.rgpszUsageIdentifier);
2821     TRACE("cNumOIDs: %d\n", *cNumOIDs);
2822     TRACE("returning %d\n", ret);
2823     return ret;
2824 }
2825
2826 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2827  * pInfo is NULL, from the attributes of hProv.
2828  */
2829 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2830  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2831 {
2832     CRYPT_KEY_PROV_INFO info = { 0 };
2833     BOOL ret;
2834
2835     if (!pInfo)
2836     {
2837         DWORD size;
2838         int len;
2839
2840         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2841         if (ret)
2842         {
2843             LPSTR szContainer = CryptMemAlloc(size);
2844
2845             if (szContainer)
2846             {
2847                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2848                  (BYTE *)szContainer, &size, 0);
2849                 if (ret)
2850                 {
2851                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2852                      NULL, 0);
2853                     if (len)
2854                     {
2855                         info.pwszContainerName = CryptMemAlloc(len *
2856                          sizeof(WCHAR));
2857                         MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2858                          info.pwszContainerName, len);
2859                     }
2860                 }
2861                 CryptMemFree(szContainer);
2862             }
2863         }
2864         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2865         if (ret)
2866         {
2867             LPSTR szProvider = CryptMemAlloc(size);
2868
2869             if (szProvider)
2870             {
2871                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2872                  &size, 0);
2873                 if (ret)
2874                 {
2875                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2876                      NULL, 0);
2877                     if (len)
2878                     {
2879                         info.pwszProvName = CryptMemAlloc(len *
2880                          sizeof(WCHAR));
2881                         MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2882                          info.pwszProvName, len);
2883                     }
2884                 }
2885                 CryptMemFree(szProvider);
2886             }
2887         }
2888         size = sizeof(info.dwKeySpec);
2889         /* in case no CRYPT_KEY_PROV_INFO given,
2890          *  we always use AT_SIGNATURE key spec
2891          */
2892         info.dwKeySpec = AT_SIGNATURE;
2893         size = sizeof(info.dwProvType);
2894         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2895          &size, 0);
2896         if (!ret)
2897             info.dwProvType = PROV_RSA_FULL;
2898         pInfo = &info;
2899     }
2900
2901     CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2902      0, pInfo);
2903
2904     if (pInfo == &info)
2905     {
2906         CryptMemFree(info.pwszContainerName);
2907         CryptMemFree(info.pwszProvName);
2908     }
2909 }
2910
2911 /* Creates a signed certificate context from the unsigned, encoded certificate
2912  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2913  */
2914 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2915  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2916 {
2917     PCCERT_CONTEXT context = NULL;
2918     BOOL ret;
2919     DWORD sigSize = 0;
2920
2921     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2922      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2923     if (ret)
2924     {
2925         LPBYTE sig = CryptMemAlloc(sigSize);
2926
2927         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2928          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2929         if (ret)
2930         {
2931             CERT_SIGNED_CONTENT_INFO signedInfo;
2932             BYTE *encodedSignedCert = NULL;
2933             DWORD encodedSignedCertSize = 0;
2934
2935             signedInfo.ToBeSigned.cbData = blob->cbData;
2936             signedInfo.ToBeSigned.pbData = blob->pbData;
2937             memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2938              sizeof(signedInfo.SignatureAlgorithm));
2939             signedInfo.Signature.cbData = sigSize;
2940             signedInfo.Signature.pbData = sig;
2941             signedInfo.Signature.cUnusedBits = 0;
2942             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2943              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2944              &encodedSignedCert, &encodedSignedCertSize);
2945             if (ret)
2946             {
2947                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2948                  encodedSignedCert, encodedSignedCertSize);
2949                 LocalFree(encodedSignedCert);
2950             }
2951         }
2952         CryptMemFree(sig);
2953     }
2954     return context;
2955 }
2956
2957 /* Copies data from the parameters into info, where:
2958  * pSerialNumber: The serial number.  Must not be NULL.
2959  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2960  *                     Must not be NULL
2961  * pSignatureAlgorithm: Optional.
2962  * pStartTime: The starting time of the certificate.  If NULL, the current
2963  *             system time is used.
2964  * pEndTime: The ending time of the certificate.  If NULL, one year past the
2965  *           starting time is used.
2966  * pubKey: The public key of the certificate.  Must not be NULL.
2967  * pExtensions: Extensions to be included with the certificate.  Optional.
2968  */
2969 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2970  const CERT_NAME_BLOB *pSubjectIssuerBlob,
2971  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2972  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2973  const CERT_EXTENSIONS *pExtensions)
2974 {
2975     static CHAR oid[] = szOID_RSA_SHA1RSA;
2976
2977     assert(info);
2978     assert(pSerialNumber);
2979     assert(pSubjectIssuerBlob);
2980     assert(pubKey);
2981
2982     if (pExtensions && pExtensions->cExtension)
2983         info->dwVersion = CERT_V3;
2984     else
2985         info->dwVersion = CERT_V1;
2986     info->SerialNumber.cbData = pSerialNumber->cbData;
2987     info->SerialNumber.pbData = pSerialNumber->pbData;
2988     if (pSignatureAlgorithm)
2989         memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2990          sizeof(info->SignatureAlgorithm));
2991     else
2992     {
2993         info->SignatureAlgorithm.pszObjId = oid;
2994         info->SignatureAlgorithm.Parameters.cbData = 0;
2995         info->SignatureAlgorithm.Parameters.pbData = NULL;
2996     }
2997     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2998     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2999     if (pStartTime)
3000         SystemTimeToFileTime(pStartTime, &info->NotBefore);
3001     else
3002         GetSystemTimeAsFileTime(&info->NotBefore);
3003     if (pEndTime)
3004         SystemTimeToFileTime(pEndTime, &info->NotAfter);
3005     else
3006     {
3007         SYSTEMTIME endTime;
3008
3009         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3010         {
3011             endTime.wYear++;
3012             SystemTimeToFileTime(&endTime, &info->NotAfter);
3013         }
3014     }
3015     info->Subject.cbData = pSubjectIssuerBlob->cbData;
3016     info->Subject.pbData = pSubjectIssuerBlob->pbData;
3017     memcpy(&info->SubjectPublicKeyInfo, pubKey,
3018      sizeof(info->SubjectPublicKeyInfo));
3019     if (pExtensions)
3020     {
3021         info->cExtension = pExtensions->cExtension;
3022         info->rgExtension = pExtensions->rgExtension;
3023     }
3024     else
3025     {
3026         info->cExtension = 0;
3027         info->rgExtension = NULL;
3028     }
3029 }
3030
3031 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3032 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3033 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3034
3035 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3036 {
3037     HCRYPTPROV hProv = 0;
3038     HMODULE rpcrt = LoadLibraryA("rpcrt4");
3039
3040     if (rpcrt)
3041     {
3042         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3043          "UuidCreate");
3044         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3045          "UuidToStringA");
3046         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3047          rpcrt, "RpcStringFreeA");
3048
3049         if (uuidCreate && uuidToString && rpcStringFree)
3050         {
3051             UUID uuid;
3052             RPC_STATUS status = uuidCreate(&uuid);
3053
3054             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3055             {
3056                 unsigned char *uuidStr;
3057
3058                 status = uuidToString(&uuid, &uuidStr);
3059                 if (status == RPC_S_OK)
3060                 {
3061                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3062                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3063
3064                     if (ret)
3065                     {
3066                         HCRYPTKEY key;
3067
3068                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3069                         if (ret)
3070                             CryptDestroyKey(key);
3071                     }
3072                     rpcStringFree(&uuidStr);
3073                 }
3074             }
3075         }
3076         FreeLibrary(rpcrt);
3077     }
3078     return hProv;
3079 }
3080
3081 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3082  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3083  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3084  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3085  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3086 {
3087     PCCERT_CONTEXT context = NULL;
3088     BOOL ret, releaseContext = FALSE;
3089     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3090     DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
3091
3092     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3093      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3094      pExtensions, pExtensions);
3095
3096     if(!pSubjectIssuerBlob)
3097     {
3098         SetLastError(ERROR_INVALID_PARAMETER);
3099         return NULL;
3100     }
3101
3102     if (!hProv)
3103     {
3104         if (!pKeyProvInfo)
3105         {
3106             hProv = CRYPT_CreateKeyProv();
3107             releaseContext = TRUE;
3108         }
3109         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3110         {
3111             SetLastError(NTE_BAD_FLAGS);
3112             return NULL;
3113         }
3114         else
3115         {
3116             HCRYPTKEY hKey = 0;
3117             /* acquire the context using the given information*/
3118             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3119                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3120                     pKeyProvInfo->dwFlags);
3121             if (!ret)
3122             {
3123                 if(GetLastError() != NTE_BAD_KEYSET)
3124                     return NULL;
3125                 /* create the key set */
3126                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3127                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3128                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3129                 if (!ret)
3130                     return NULL;
3131             }
3132             dwKeySpec = pKeyProvInfo->dwKeySpec;
3133             /* check if the key is here */
3134             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3135             if(!ret)
3136             {
3137                 if (NTE_NO_KEY == GetLastError())
3138                 { /* generate the key */
3139                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3140                 }
3141                 if (!ret)
3142                 {
3143                     CryptReleaseContext(hProv,0);
3144                     SetLastError(NTE_BAD_KEYSET);
3145                     return NULL;
3146                 }
3147             }
3148             CryptDestroyKey(hKey);
3149             releaseContext = TRUE;
3150         }
3151     }
3152     else if (pKeyProvInfo)
3153     {
3154         SetLastError(ERROR_INVALID_PARAMETER);
3155         return NULL;
3156     }
3157
3158     CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3159      &pubKeySize);
3160     pubKey = CryptMemAlloc(pubKeySize);
3161     if (pubKey)
3162     {
3163         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3164          pubKey, &pubKeySize);
3165         if (ret)
3166         {
3167             CERT_INFO info = { 0 };
3168             CRYPT_DER_BLOB blob = { 0, NULL };
3169             BYTE serial[16];
3170             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3171
3172             CryptGenRandom(hProv, sizeof(serial), serial);
3173             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3174              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3175             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3176              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3177              &blob.cbData);
3178             if (ret)
3179             {
3180                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3181                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3182                      &info.SignatureAlgorithm);
3183                 else
3184                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
3185                      blob.pbData, blob.cbData);
3186                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3187                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3188                 LocalFree(blob.pbData);
3189             }
3190         }
3191         CryptMemFree(pubKey);
3192     }
3193     if (releaseContext)
3194         CryptReleaseContext(hProv, 0);
3195     return context;
3196 }
3197
3198 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3199                                void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3200                                PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3201                                PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3202 {
3203     FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3204           dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3205           pVerifyUsageStatus);
3206     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3207     return FALSE;
3208 }
3209
3210 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3211                                       const BYTE *pbEncoded, DWORD cbEncoded,
3212                                       DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3213 {
3214     TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3215           pbEncoded, cbEncoded, dwFlags, pCreatePara);
3216
3217     if (dwFlags)
3218     {
3219         FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3220         return NULL;
3221     }
3222     if (pCreatePara)
3223     {
3224         FIXME("pCreatePara not handled\n");
3225         return NULL;
3226     }
3227
3228     switch (dwContextType)
3229     {
3230     case CERT_STORE_CERTIFICATE_CONTEXT:
3231         return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3232     case CERT_STORE_CRL_CONTEXT:
3233         return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3234     case CERT_STORE_CTL_CONTEXT:
3235         return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3236     default:
3237         WARN("unknown context type: 0x%x\n", dwContextType);
3238         return NULL;
3239     }
3240 }