git.oblomov.eu Git - wine/blob - dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #define NONAMELESSUNION
  24 #include "windef.h"
  25 #include "winbase.h"
  26 #include "wincrypt.h"
  27 #include "winnls.h"
  28 #include "rpc.h"
  29 #include "wine/debug.h"
  30 #include "wine/unicode.h"
  31 #include "crypt32_private.h"
  32
  33 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  34
  35 /* Internal version of CertGetCertificateContextProperty that gets properties
  36  * directly from the context (or the context it's linked to, depending on its
  37  * type.) Doesn't handle special-case properties, since they are handled by
  38  * CertGetCertificateContextProperty, and are particular to the store in which
  39  * the property exists (which is separate from the context.)
  40  */
  41 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
  42  void *pvData, DWORD *pcbData);
  43
  44 /* Internal version of CertSetCertificateContextProperty that sets properties
  45  * directly on the context (or the context it's linked to, depending on its
  46  * type.) Doesn't handle special cases, since they're handled by
  47  * CertSetCertificateContextProperty anyway.
  48  */
  49 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
  50  DWORD dwFlags, const void *pvData);
  51
  52 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  53  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  54  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  55 {
  56     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  57      pbCertEncoded, cbCertEncoded);
  58     BOOL ret;
  59
  60     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  61      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  62
  63     if (cert)
  64     {
  65         ret = CertAddCertificateContextToStore(hCertStore, cert,
  66          dwAddDisposition, ppCertContext);
  67         CertFreeCertificateContext(cert);
  68     }
  69     else
  70         ret = FALSE;
  71     return ret;
  72 }
  73
  74 BOOL WINAPI CertAddEncodedCertificateToSystemStoreA(LPCSTR pszCertStoreName,
  75  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  76 {
  77     HCERTSTORE store;
  78     BOOL ret = FALSE;
  79
  80     TRACE("(%s, %p, %d)\n", debugstr_a(pszCertStoreName), pbCertEncoded,
  81      cbCertEncoded);
  82
  83     store = CertOpenSystemStoreA(0, pszCertStoreName);
  84     if (store)
  85     {
  86         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
  87          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
  88         CertCloseStore(store, 0);
  89     }
  90     return ret;
  91 }
  92
  93 BOOL WINAPI CertAddEncodedCertificateToSystemStoreW(LPCWSTR pszCertStoreName,
  94  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  95 {
  96     HCERTSTORE store;
  97     BOOL ret = FALSE;
  98
  99     TRACE("(%s, %p, %d)\n", debugstr_w(pszCertStoreName), pbCertEncoded,
 100      cbCertEncoded);
 101
 102     store = CertOpenSystemStoreW(0, pszCertStoreName);
 103     if (store)
 104     {
 105         ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
 106          pbCertEncoded, cbCertEncoded, CERT_STORE_ADD_USE_EXISTING, NULL);
 107         CertCloseStore(store, 0);
 108     }
 109     return ret;
 110 }
 111
 112 BOOL WINAPI CertAddCertificateLinkToStore(HCERTSTORE hCertStore,
 113  PCCERT_CONTEXT pCertContext, DWORD dwAddDisposition,
 114  PCCERT_CONTEXT *ppCertContext)
 115 {
 116     static int calls;
 117     PWINECRYPT_CERTSTORE store = (PWINECRYPT_CERTSTORE)hCertStore;
 118
 119     if (!(calls++))
 120         FIXME("(%p, %p, %08x, %p): semi-stub\n", hCertStore, pCertContext,
 121          dwAddDisposition, ppCertContext);
 122     if (store->dwMagic != WINE_CRYPTCERTSTORE_MAGIC)
 123         return FALSE;
 124     if (store->type == StoreTypeCollection)
 125     {
 126         SetLastError(E_INVALIDARG);
 127         return FALSE;
 128     }
 129     return CertAddCertificateContextToStore(hCertStore, pCertContext,
 130      dwAddDisposition, ppCertContext);
 131 }
 132
 133 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
 134  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
 135 {
 136     PCERT_CONTEXT cert = NULL;
 137     BOOL ret;
 138     PCERT_INFO certInfo = NULL;
 139     DWORD size = 0;
 140
 141     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
 142      cbCertEncoded);
 143
 144     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 145      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
 146      &certInfo, &size);
 147     if (ret)
 148     {
 149         BYTE *data = NULL;
 150
 151         cert = Context_CreateDataContext(sizeof(CERT_CONTEXT));
 152         if (!cert)
 153             goto end;
 154         data = CryptMemAlloc(cbCertEncoded);
 155         if (!data)
 156         {
 157             CryptMemFree(cert);
 158             cert = NULL;
 159             goto end;
 160         }
 161         memcpy(data, pbCertEncoded, cbCertEncoded);
 162         cert->dwCertEncodingType = dwCertEncodingType;
 163         cert->pbCertEncoded      = data;
 164         cert->cbCertEncoded      = cbCertEncoded;
 165         cert->pCertInfo          = certInfo;
 166         cert->hCertStore         = 0;
 167     }
 168
 169 end:
 170     return cert;
 171 }
 172
 173 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
 174  PCCERT_CONTEXT pCertContext)
 175 {
 176     TRACE("(%p)\n", pCertContext);
 177
 178     if (!pCertContext)
 179         return NULL;
 180
 181     Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
 182     return pCertContext;
 183 }
 184
 185 static void CertDataContext_Free(void *context)
 186 {
 187     PCERT_CONTEXT certContext = context;
 188
 189     CryptMemFree(certContext->pbCertEncoded);
 190     LocalFree(certContext->pCertInfo);
 191 }
 192
 193 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 194 {
 195     BOOL ret = TRUE;
 196
 197     TRACE("(%p)\n", pCertContext);
 198
 199     if (pCertContext)
 200         ret = Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
 201          CertDataContext_Free);
 202     return ret;
 203 }
 204
 205 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 206  DWORD dwPropId)
 207 {
 208     PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
 209      pCertContext, sizeof(CERT_CONTEXT));
 210     DWORD ret;
 211
 212     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 213
 214     if (properties)
 215         ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
 216     else
 217         ret = 0;
 218     return ret;
 219 }
 220
 221 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
 222  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 223  DWORD *pcbData)
 224 {
 225     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 226      pcbData);
 227     if (ret && pvData)
 228     {
 229         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 230
 231         ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
 232     }
 233     return ret;
 234 }
 235
 236 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 237  DWORD cb)
 238 {
 239     BOOL ret = TRUE;
 240
 241     if (!pvData)
 242         *pcbData = cb;
 243     else if (*pcbData < cb)
 244     {
 245         SetLastError(ERROR_MORE_DATA);
 246         *pcbData = cb;
 247         ret = FALSE;
 248     }
 249     else
 250     {
 251         memcpy(pvData, pb, cb);
 252         *pcbData = cb;
 253     }
 254     return ret;
 255 }
 256
 257 static BOOL CertContext_GetProperty(void *context, DWORD dwPropId,
 258  void *pvData, DWORD *pcbData)
 259 {
 260     PCCERT_CONTEXT pCertContext = context;
 261     PCONTEXT_PROPERTY_LIST properties =
 262      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 263     BOOL ret;
 264     CRYPT_DATA_BLOB blob;
 265
 266     TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
 267
 268     if (properties)
 269         ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
 270     else
 271         ret = FALSE;
 272     if (ret)
 273         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 274     else
 275     {
 276         /* Implicit properties */
 277         switch (dwPropId)
 278         {
 279         case CERT_SHA1_HASH_PROP_ID:
 280             ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
 281              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 282              pcbData);
 283             break;
 284         case CERT_MD5_HASH_PROP_ID:
 285             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 286              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 287              pcbData);
 288             break;
 289         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 290             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 291              pCertContext->pCertInfo->Subject.pbData,
 292              pCertContext->pCertInfo->Subject.cbData,
 293              pvData, pcbData);
 294             break;
 295         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 296             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 297              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 298              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 299              pvData, pcbData);
 300             break;
 301         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 302             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 303              pCertContext->pCertInfo->SerialNumber.pbData,
 304              pCertContext->pCertInfo->SerialNumber.cbData,
 305              pvData, pcbData);
 306             break;
 307         case CERT_SIGNATURE_HASH_PROP_ID:
 308             ret = CryptHashToBeSigned(0, pCertContext->dwCertEncodingType,
 309              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 310              pcbData);
 311             if (ret && pvData)
 312             {
 313                 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 314
 315                 ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
 316             }
 317             break;
 318         case CERT_KEY_IDENTIFIER_PROP_ID:
 319         {
 320             PCERT_EXTENSION ext = CertFindExtension(
 321              szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
 322              pCertContext->pCertInfo->rgExtension);
 323
 324             if (ext)
 325             {
 326                 CRYPT_DATA_BLOB value;
 327                 DWORD size = sizeof(value);
 328
 329                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 330                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 331                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 332                  &size);
 333                 if (ret)
 334                 {
 335                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 336                      value.cbData);
 337                     CertContext_SetProperty(context, dwPropId, 0, &value);
 338                 }
 339             }
 340             else
 341                 SetLastError(ERROR_INVALID_DATA);
 342             break;
 343         }
 344         default:
 345             SetLastError(CRYPT_E_NOT_FOUND);
 346         }
 347     }
 348     TRACE("returning %d\n", ret);
 349     return ret;
 350 }
 351
 352 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
 353 {
 354     DWORD i, containerLen, provNameLen;
 355     LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
 356
 357     info->pwszContainerName = (LPWSTR)data;
 358     containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 359     data += containerLen;
 360
 361     info->pwszProvName = (LPWSTR)data;
 362     provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 363     data += provNameLen;
 364
 365     info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
 366     data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 367
 368     for (i = 0; i < info->cProvParam; i++)
 369     {
 370         info->rgProvParam[i].pbData = data;
 371         data += info->rgProvParam[i].cbData;
 372     }
 373 }
 374
 375 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 376  DWORD dwPropId, void *pvData, DWORD *pcbData)
 377 {
 378     BOOL ret;
 379
 380     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 381
 382     switch (dwPropId)
 383     {
 384     case 0:
 385     case CERT_CERT_PROP_ID:
 386     case CERT_CRL_PROP_ID:
 387     case CERT_CTL_PROP_ID:
 388         SetLastError(E_INVALIDARG);
 389         ret = FALSE;
 390         break;
 391     case CERT_ACCESS_STATE_PROP_ID:
 392         if (pCertContext->hCertStore)
 393             ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
 394              pvData, pcbData);
 395         else
 396         {
 397             DWORD state = 0;
 398
 399             ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
 400         }
 401         break;
 402     case CERT_KEY_PROV_HANDLE_PROP_ID:
 403     {
 404         CERT_KEY_CONTEXT keyContext;
 405         DWORD size = sizeof(keyContext);
 406
 407         ret = CertContext_GetProperty((void *)pCertContext,
 408          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 409         if (ret)
 410             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 411              sizeof(keyContext.hCryptProv));
 412         break;
 413     }
 414     case CERT_KEY_PROV_INFO_PROP_ID:
 415         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 416          pcbData);
 417         if (ret && pvData)
 418             CRYPT_FixKeyProvInfoPointers(pvData);
 419         break;
 420     default:
 421         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 422          pcbData);
 423     }
 424
 425     TRACE("returning %d\n", ret);
 426     return ret;
 427 }
 428
 429 /* Copies key provider info from from into to, where to is assumed to be a
 430  * contiguous buffer of memory large enough for from and all its associated
 431  * data, but whose pointers are uninitialized.
 432  * Upon return, to contains a contiguous copy of from, packed in the following
 433  * order:
 434  * - CRYPT_KEY_PROV_INFO
 435  * - pwszContainerName
 436  * - pwszProvName
 437  * - rgProvParam[0]...
 438  */
 439 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
 440  const CRYPT_KEY_PROV_INFO *from)
 441 {
 442     DWORD i;
 443     LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
 444
 445     if (from->pwszContainerName)
 446     {
 447         to->pwszContainerName = (LPWSTR)nextData;
 448         lstrcpyW(to->pwszContainerName, from->pwszContainerName);
 449         nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 450     }
 451     else
 452         to->pwszContainerName = NULL;
 453     if (from->pwszProvName)
 454     {
 455         to->pwszProvName = (LPWSTR)nextData;
 456         lstrcpyW(to->pwszProvName, from->pwszProvName);
 457         nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 458     }
 459     else
 460         to->pwszProvName = NULL;
 461     to->dwProvType = from->dwProvType;
 462     to->dwFlags = from->dwFlags;
 463     to->cProvParam = from->cProvParam;
 464     to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
 465     nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 466     to->dwKeySpec = from->dwKeySpec;
 467     for (i = 0; i < to->cProvParam; i++)
 468     {
 469         memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
 470          sizeof(CRYPT_KEY_PROV_PARAM));
 471         to->rgProvParam[i].pbData = nextData;
 472         memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
 473          from->rgProvParam[i].cbData);
 474         nextData += from->rgProvParam[i].cbData;
 475     }
 476 }
 477
 478 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
 479  const CRYPT_KEY_PROV_INFO *info)
 480 {
 481     BOOL ret;
 482     LPBYTE buf = NULL;
 483     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
 484
 485     if (info->pwszContainerName)
 486         containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 487     else
 488         containerSize = 0;
 489     if (info->pwszProvName)
 490         provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 491     else
 492         provNameSize = 0;
 493     size += containerSize + provNameSize;
 494     for (i = 0; i < info->cProvParam; i++)
 495         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 496     buf = CryptMemAlloc(size);
 497     if (buf)
 498     {
 499         CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
 500         ret = ContextPropertyList_SetProperty(properties,
 501          CERT_KEY_PROV_INFO_PROP_ID, buf, size);
 502         CryptMemFree(buf);
 503     }
 504     else
 505         ret = FALSE;
 506     return ret;
 507 }
 508
 509 static BOOL CertContext_SetProperty(void *context, DWORD dwPropId,
 510  DWORD dwFlags, const void *pvData)
 511 {
 512     PCONTEXT_PROPERTY_LIST properties =
 513      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 514     BOOL ret;
 515
 516     TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
 517
 518     if (!properties)
 519         ret = FALSE;
 520     else
 521     {
 522         switch (dwPropId)
 523         {
 524         case CERT_AUTO_ENROLL_PROP_ID:
 525         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 526         case CERT_DESCRIPTION_PROP_ID:
 527         case CERT_FRIENDLY_NAME_PROP_ID:
 528         case CERT_HASH_PROP_ID:
 529         case CERT_KEY_IDENTIFIER_PROP_ID:
 530         case CERT_MD5_HASH_PROP_ID:
 531         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 532         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 533         case CERT_PVK_FILE_PROP_ID:
 534         case CERT_SIGNATURE_HASH_PROP_ID:
 535         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 536         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 537         case CERT_EXTENDED_ERROR_INFO_PROP_ID:
 538         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 539         case CERT_ENROLLMENT_PROP_ID:
 540         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 541         case CERT_RENEWAL_PROP_ID:
 542         {
 543             if (pvData)
 544             {
 545                 const CRYPT_DATA_BLOB *blob = pvData;
 546
 547                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 548                  blob->pbData, blob->cbData);
 549             }
 550             else
 551             {
 552                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 553                 ret = TRUE;
 554             }
 555             break;
 556         }
 557         case CERT_DATE_STAMP_PROP_ID:
 558             if (pvData)
 559                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 560                  pvData, sizeof(FILETIME));
 561             else
 562             {
 563                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 564                 ret = TRUE;
 565             }
 566             break;
 567         case CERT_KEY_CONTEXT_PROP_ID:
 568         {
 569             if (pvData)
 570             {
 571                 const CERT_KEY_CONTEXT *keyContext = pvData;
 572
 573                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 574                 {
 575                     SetLastError(E_INVALIDARG);
 576                     ret = FALSE;
 577                 }
 578                 else
 579                     ret = ContextPropertyList_SetProperty(properties, dwPropId,
 580                      (const BYTE *)keyContext, keyContext->cbSize);
 581             }
 582             else
 583             {
 584                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 585                 ret = TRUE;
 586             }
 587             break;
 588         }
 589         case CERT_KEY_PROV_INFO_PROP_ID:
 590             if (pvData)
 591                 ret = CertContext_SetKeyProvInfoProperty(properties, pvData);
 592             else
 593             {
 594                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 595                 ret = TRUE;
 596             }
 597             break;
 598         case CERT_KEY_PROV_HANDLE_PROP_ID:
 599         {
 600             CERT_KEY_CONTEXT keyContext;
 601             DWORD size = sizeof(keyContext);
 602
 603             ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 604              &keyContext, &size);
 605             if (ret)
 606             {
 607                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 608                     CryptReleaseContext(keyContext.hCryptProv, 0);
 609             }
 610             keyContext.cbSize = sizeof(keyContext);
 611             if (pvData)
 612                 keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 613             else
 614             {
 615                 keyContext.hCryptProv = 0;
 616                 keyContext.dwKeySpec = AT_SIGNATURE;
 617             }
 618             ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 619              0, &keyContext);
 620             break;
 621         }
 622         default:
 623             FIXME("%d: stub\n", dwPropId);
 624             ret = FALSE;
 625         }
 626     }
 627     TRACE("returning %d\n", ret);
 628     return ret;
 629 }
 630
 631 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 632  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 633 {
 634     BOOL ret;
 635
 636     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 637
 638     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 639      * crashes on most of these, I'll be safer.
 640      */
 641     switch (dwPropId)
 642     {
 643     case 0:
 644     case CERT_ACCESS_STATE_PROP_ID:
 645     case CERT_CERT_PROP_ID:
 646     case CERT_CRL_PROP_ID:
 647     case CERT_CTL_PROP_ID:
 648         SetLastError(E_INVALIDARG);
 649         return FALSE;
 650     }
 651     ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
 652      pvData);
 653     TRACE("returning %d\n", ret);
 654     return ret;
 655 }
 656
 657 /* Acquires the private key using the key provider info, retrieving info from
 658  * the certificate if info is NULL.  The acquired provider is returned in
 659  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 660  */
 661 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
 662  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 663 {
 664     DWORD size = 0;
 665     BOOL allocated = FALSE, ret = TRUE;
 666
 667     if (!info)
 668     {
 669         ret = CertGetCertificateContextProperty(pCert,
 670          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 671         if (ret)
 672         {
 673             info = HeapAlloc(GetProcessHeap(), 0, size);
 674             if (info)
 675             {
 676                 ret = CertGetCertificateContextProperty(pCert,
 677                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 678                 allocated = TRUE;
 679             }
 680             else
 681             {
 682                 SetLastError(ERROR_OUTOFMEMORY);
 683                 ret = FALSE;
 684             }
 685         }
 686         else
 687             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 688     }
 689     if (ret)
 690     {
 691         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 692          info->pwszProvName, info->dwProvType, 0);
 693         if (ret)
 694         {
 695             DWORD i;
 696
 697             for (i = 0; i < info->cProvParam; i++)
 698             {
 699                 CryptSetProvParam(*phCryptProv,
 700                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 701                  info->rgProvParam[i].dwFlags);
 702             }
 703             *pdwKeySpec = info->dwKeySpec;
 704         }
 705         else
 706             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 707     }
 708     if (allocated)
 709         HeapFree(GetProcessHeap(), 0, info);
 710     return ret;
 711 }
 712
 713 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 714  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 715  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 716 {
 717     BOOL ret = FALSE, cache = FALSE;
 718     PCRYPT_KEY_PROV_INFO info = NULL;
 719     CERT_KEY_CONTEXT keyContext;
 720     DWORD size;
 721
 722     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 723      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 724
 725     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 726     {
 727         DWORD size = 0;
 728
 729         ret = CertGetCertificateContextProperty(pCert,
 730          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 731         if (ret)
 732         {
 733             info = HeapAlloc(GetProcessHeap(), 0, size);
 734             ret = CertGetCertificateContextProperty(pCert,
 735              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 736             if (ret)
 737                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 738         }
 739     }
 740     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 741         cache = TRUE;
 742     *phCryptProv = 0;
 743     if (cache)
 744     {
 745         size = sizeof(keyContext);
 746         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 747          &keyContext, &size);
 748         if (ret)
 749         {
 750             *phCryptProv = keyContext.hCryptProv;
 751             if (pdwKeySpec)
 752                 *pdwKeySpec = keyContext.dwKeySpec;
 753             if (pfCallerFreeProv)
 754                 *pfCallerFreeProv = !cache;
 755         }
 756     }
 757     if (!*phCryptProv)
 758     {
 759         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
 760          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 761         if (ret)
 762         {
 763             *phCryptProv = keyContext.hCryptProv;
 764             if (pdwKeySpec)
 765                 *pdwKeySpec = keyContext.dwKeySpec;
 766             if (cache)
 767             {
 768                 keyContext.cbSize = sizeof(keyContext);
 769                 if (CertSetCertificateContextProperty(pCert,
 770                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 771                 {
 772                     if (pfCallerFreeProv)
 773                         *pfCallerFreeProv = FALSE;
 774                 }
 775             }
 776             else
 777             {
 778                 if (pfCallerFreeProv)
 779                     *pfCallerFreeProv = TRUE;
 780             }
 781         }
 782     }
 783     HeapFree(GetProcessHeap(), 0, info);
 784     return ret;
 785 }
 786
 787 static BOOL key_prov_info_matches_cert(PCCERT_CONTEXT pCert,
 788  const CRYPT_KEY_PROV_INFO *keyProvInfo)
 789 {
 790     HCRYPTPROV csp;
 791     BOOL matches = FALSE;
 792
 793     if (CryptAcquireContextW(&csp, keyProvInfo->pwszContainerName,
 794      keyProvInfo->pwszProvName, keyProvInfo->dwProvType, keyProvInfo->dwFlags))
 795     {
 796         DWORD size;
 797
 798         /* Need to sign something to verify the sig.  What to sign?  Why not
 799          * the certificate itself?
 800          */
 801         if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
 802          pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED, pCert->pCertInfo,
 803          &pCert->pCertInfo->SignatureAlgorithm, NULL, NULL, &size))
 804         {
 805             BYTE *certEncoded = CryptMemAlloc(size);
 806
 807             if (certEncoded)
 808             {
 809                 if (CryptSignAndEncodeCertificate(csp, AT_SIGNATURE,
 810                  pCert->dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
 811                  pCert->pCertInfo, &pCert->pCertInfo->SignatureAlgorithm,
 812                  NULL, certEncoded, &size))
 813                 {
 814                     if (size == pCert->cbCertEncoded &&
 815                      !memcmp(certEncoded, pCert->pbCertEncoded, size))
 816                         matches = TRUE;
 817                 }
 818                 CryptMemFree(certEncoded);
 819             }
 820         }
 821         CryptReleaseContext(csp, 0);
 822     }
 823     return matches;
 824 }
 825
 826 static BOOL container_matches_cert(PCCERT_CONTEXT pCert, LPCSTR container,
 827  CRYPT_KEY_PROV_INFO *keyProvInfo)
 828 {
 829     CRYPT_KEY_PROV_INFO copy;
 830     WCHAR containerW[MAX_PATH];
 831     BOOL matches = FALSE;
 832
 833     MultiByteToWideChar(CP_ACP, 0, container, -1,
 834      containerW, sizeof(containerW) / sizeof(containerW[0]));
 835     /* We make a copy of the CRYPT_KEY_PROV_INFO because the caller expects
 836      * keyProvInfo->pwszContainerName to be NULL or a heap-allocated container
 837      * name.
 838      */
 839     memcpy(&copy, keyProvInfo, sizeof(copy));
 840     copy.pwszContainerName = containerW;
 841     matches = key_prov_info_matches_cert(pCert, &copy);
 842     if (matches)
 843     {
 844         keyProvInfo->pwszContainerName =
 845          CryptMemAlloc((strlenW(containerW) + 1) * sizeof(WCHAR));
 846         if (keyProvInfo->pwszContainerName)
 847         {
 848             strcpyW(keyProvInfo->pwszContainerName, containerW);
 849             keyProvInfo->dwKeySpec = AT_SIGNATURE;
 850         }
 851         else
 852             matches = FALSE;
 853     }
 854     return matches;
 855 }
 856
 857 /* Searches the provider named keyProvInfo.pwszProvName for a container whose
 858  * private key matches pCert's public key.  Upon success, updates keyProvInfo
 859  * with the matching container's info (free keyProvInfo.pwszContainerName upon
 860  * success.)
 861  * Returns TRUE if found, FALSE if not.
 862  */
 863 static BOOL find_key_prov_info_in_provider(PCCERT_CONTEXT pCert,
 864  CRYPT_KEY_PROV_INFO *keyProvInfo)
 865 {
 866     HCRYPTPROV defProvider;
 867     BOOL ret, found = FALSE;
 868     char containerA[MAX_PATH];
 869
 870     assert(keyProvInfo->pwszContainerName == NULL);
 871     if ((ret = CryptAcquireContextW(&defProvider, NULL,
 872      keyProvInfo->pwszProvName, keyProvInfo->dwProvType,
 873      keyProvInfo->dwFlags | CRYPT_VERIFYCONTEXT)))
 874     {
 875         DWORD enumFlags = keyProvInfo->dwFlags | CRYPT_FIRST;
 876
 877         while (ret && !found)
 878         {
 879             DWORD size = sizeof(containerA);
 880
 881             ret = CryptGetProvParam(defProvider, PP_ENUMCONTAINERS,
 882              (BYTE *)containerA, &size, enumFlags);
 883             if (ret)
 884                 found = container_matches_cert(pCert, containerA, keyProvInfo);
 885             if (enumFlags & CRYPT_FIRST)
 886             {
 887                 enumFlags &= ~CRYPT_FIRST;
 888                 enumFlags |= CRYPT_NEXT;
 889             }
 890         }
 891         CryptReleaseContext(defProvider, 0);
 892     }
 893     return found;
 894 }
 895
 896 static BOOL find_matching_provider(PCCERT_CONTEXT pCert, DWORD dwFlags)
 897 {
 898     BOOL found = FALSE, ret = TRUE;
 899     DWORD index = 0, cbProvName = 0;
 900     CRYPT_KEY_PROV_INFO keyProvInfo;
 901
 902     TRACE("(%p, %08x)\n", pCert, dwFlags);
 903
 904     memset(&keyProvInfo, 0, sizeof(keyProvInfo));
 905     while (ret && !found)
 906     {
 907         DWORD size = 0;
 908
 909         ret = CryptEnumProvidersW(index, NULL, 0, &keyProvInfo.dwProvType,
 910          NULL, &size);
 911         if (ret)
 912         {
 913             if (size <= cbProvName)
 914                 ret = CryptEnumProvidersW(index, NULL, 0,
 915                  &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
 916             else
 917             {
 918                 CryptMemFree(keyProvInfo.pwszProvName);
 919                 keyProvInfo.pwszProvName = CryptMemAlloc(size);
 920                 if (keyProvInfo.pwszProvName)
 921                 {
 922                     cbProvName = size;
 923                     ret = CryptEnumProvidersW(index, NULL, 0,
 924                      &keyProvInfo.dwProvType, keyProvInfo.pwszProvName, &size);
 925                     if (ret)
 926                     {
 927                         if (dwFlags & CRYPT_FIND_SILENT_KEYSET_FLAG)
 928                             keyProvInfo.dwFlags |= CRYPT_SILENT;
 929                         if (dwFlags & CRYPT_FIND_USER_KEYSET_FLAG ||
 930                          !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
 931                          CRYPT_FIND_MACHINE_KEYSET_FLAG)))
 932                         {
 933                             keyProvInfo.dwFlags |= CRYPT_USER_KEYSET;
 934                             found = find_key_prov_info_in_provider(pCert,
 935                              &keyProvInfo);
 936                         }
 937                         if (!found)
 938                         {
 939                             if (dwFlags & CRYPT_FIND_MACHINE_KEYSET_FLAG ||
 940                              !(dwFlags & (CRYPT_FIND_USER_KEYSET_FLAG |
 941                              CRYPT_FIND_MACHINE_KEYSET_FLAG)))
 942                             {
 943                                 keyProvInfo.dwFlags &= ~CRYPT_USER_KEYSET;
 944                                 keyProvInfo.dwFlags |= CRYPT_MACHINE_KEYSET;
 945                                 found = find_key_prov_info_in_provider(pCert,
 946                                  &keyProvInfo);
 947                             }
 948                         }
 949                     }
 950                 }
 951                 else
 952                     ret = FALSE;
 953             }
 954             index++;
 955         }
 956     }
 957     if (found)
 958         CertSetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
 959          0, &keyProvInfo);
 960     CryptMemFree(keyProvInfo.pwszProvName);
 961     CryptMemFree(keyProvInfo.pwszContainerName);
 962     return found;
 963 }
 964
 965 static BOOL cert_prov_info_matches_cert(PCCERT_CONTEXT pCert)
 966 {
 967     BOOL matches = FALSE;
 968     DWORD size;
 969
 970     if (CertGetCertificateContextProperty(pCert, CERT_KEY_PROV_INFO_PROP_ID,
 971      NULL, &size))
 972     {
 973         CRYPT_KEY_PROV_INFO *keyProvInfo = CryptMemAlloc(size);
 974
 975         if (keyProvInfo)
 976         {
 977             if (CertGetCertificateContextProperty(pCert,
 978              CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size))
 979                 matches = key_prov_info_matches_cert(pCert, keyProvInfo);
 980             CryptMemFree(keyProvInfo);
 981         }
 982     }
 983     return matches;
 984 }
 985
 986 BOOL WINAPI CryptFindCertificateKeyProvInfo(PCCERT_CONTEXT pCert,
 987  DWORD dwFlags, void *pvReserved)
 988 {
 989     BOOL matches = FALSE;
 990
 991     TRACE("(%p, %08x, %p)\n", pCert, dwFlags, pvReserved);
 992
 993     matches = cert_prov_info_matches_cert(pCert);
 994     if (!matches)
 995         matches = find_matching_provider(pCert, dwFlags);
 996     return matches;
 997 }
 998
 999 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
1000  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
1001 {
1002     BOOL ret;
1003
1004     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
1005
1006     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
1007      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
1008      &pCertId2->SerialNumber);
1009     TRACE("returning %d\n", ret);
1010     return ret;
1011 }
1012
1013 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
1014  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
1015 {
1016     BOOL ret;
1017
1018     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
1019
1020     if (pCertName1->cbData == pCertName2->cbData)
1021     {
1022         if (pCertName1->cbData)
1023             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
1024              pCertName1->cbData);
1025         else
1026             ret = TRUE;
1027     }
1028     else
1029         ret = FALSE;
1030     TRACE("returning %d\n", ret);
1031     return ret;
1032 }
1033
1034 /* Returns the number of significant bytes in pInt, where a byte is
1035  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
1036  * for negative numbers.  pInt is assumed to be little-endian.
1037  */
1038 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
1039 {
1040     DWORD ret = pInt->cbData;
1041
1042     while (ret > 1)
1043     {
1044         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
1045             ret--;
1046         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
1047             ret--;
1048         else
1049             break;
1050     }
1051     return ret;
1052 }
1053
1054 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
1055  PCRYPT_INTEGER_BLOB pInt2)
1056 {
1057     BOOL ret;
1058     DWORD cb1, cb2;
1059
1060     TRACE("(%p, %p)\n", pInt1, pInt2);
1061
1062     cb1 = CRYPT_significantBytes(pInt1);
1063     cb2 = CRYPT_significantBytes(pInt2);
1064     if (cb1 == cb2)
1065     {
1066         if (cb1)
1067             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
1068         else
1069             ret = TRUE;
1070     }
1071     else
1072         ret = FALSE;
1073     TRACE("returning %d\n", ret);
1074     return ret;
1075 }
1076
1077 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
1078  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
1079 {
1080     BOOL ret;
1081
1082     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
1083
1084     switch (GET_CERT_ENCODING_TYPE(dwCertEncodingType))
1085     {
1086     case 0:     /* Seems to mean "raw binary bits" */
1087         if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
1088          pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
1089         {
1090           if (pPublicKey2->PublicKey.cbData)
1091               ret = !memcmp(pPublicKey1->PublicKey.pbData,
1092                pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
1093           else
1094               ret = TRUE;
1095         }
1096         else
1097             ret = FALSE;
1098         break;
1099     default:
1100         WARN("Unknown encoding type %08x\n", dwCertEncodingType);
1101         /* FALLTHROUGH */
1102     case X509_ASN_ENCODING:
1103     {
1104         BLOBHEADER *pblob1, *pblob2;
1105         DWORD length;
1106         ret = FALSE;
1107         if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1108                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1109                     0, NULL, &length))
1110         {
1111             pblob1 = CryptMemAlloc(length);
1112             if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1113                     pPublicKey1->PublicKey.pbData, pPublicKey1->PublicKey.cbData,
1114                     0, pblob1, &length))
1115             {
1116                 if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1117                             pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1118                             0, NULL, &length))
1119                 {
1120                     pblob2 = CryptMemAlloc(length);
1121                     if (CryptDecodeObject(dwCertEncodingType, RSA_CSP_PUBLICKEYBLOB,
1122                             pPublicKey2->PublicKey.pbData, pPublicKey2->PublicKey.cbData,
1123                             0, pblob2, &length))
1124                     {
1125                         /* The RSAPUBKEY structure directly follows the BLOBHEADER */
1126                         RSAPUBKEY *pk1 = (LPVOID)(pblob1 + 1),
1127                                   *pk2 = (LPVOID)(pblob2 + 1);
1128                         ret = (pk1->bitlen == pk2->bitlen) && (pk1->pubexp == pk2->pubexp)
1129                                  && !memcmp(pk1 + 1, pk2 + 1, pk1->bitlen/8);
1130                     }
1131                     CryptMemFree(pblob2);
1132                 }
1133             }
1134             CryptMemFree(pblob1);
1135         }
1136
1137         break;
1138     }
1139     }
1140     return ret;
1141 }
1142
1143 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
1144  PCERT_PUBLIC_KEY_INFO pPublicKey)
1145 {
1146     DWORD len = 0;
1147
1148     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
1149
1150     if (GET_CERT_ENCODING_TYPE(dwCertEncodingType) != X509_ASN_ENCODING)
1151     {
1152         SetLastError(ERROR_FILE_NOT_FOUND);
1153         return 0;
1154     }
1155     if (pPublicKey->Algorithm.pszObjId &&
1156      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
1157     {
1158         FIXME("unimplemented for DH public keys\n");
1159         SetLastError(CRYPT_E_ASN1_BADTAG);
1160     }
1161     else
1162     {
1163         DWORD size;
1164         PBYTE buf;
1165         BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
1166          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
1167          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
1168          &size);
1169
1170         if (ret)
1171         {
1172             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
1173
1174             len = rsaPubKey->bitlen;
1175             LocalFree(buf);
1176         }
1177     }
1178     return len;
1179 }
1180
1181 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
1182  DWORD dwFlags, const void *pvPara);
1183
1184 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1185  DWORD dwFlags, const void *pvPara)
1186 {
1187     BOOL ret;
1188     BYTE hash[16];
1189     DWORD size = sizeof(hash);
1190
1191     ret = CertGetCertificateContextProperty(pCertContext,
1192      CERT_MD5_HASH_PROP_ID, hash, &size);
1193     if (ret)
1194     {
1195         const CRYPT_HASH_BLOB *pHash = pvPara;
1196
1197         if (size == pHash->cbData)
1198             ret = !memcmp(pHash->pbData, hash, size);
1199         else
1200             ret = FALSE;
1201     }
1202     return ret;
1203 }
1204
1205 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1206  DWORD dwFlags, const void *pvPara)
1207 {
1208     BOOL ret;
1209     BYTE hash[20];
1210     DWORD size = sizeof(hash);
1211
1212     ret = CertGetCertificateContextProperty(pCertContext,
1213      CERT_SHA1_HASH_PROP_ID, hash, &size);
1214     if (ret)
1215     {
1216         const CRYPT_HASH_BLOB *pHash = pvPara;
1217
1218         if (size == pHash->cbData)
1219             ret = !memcmp(pHash->pbData, hash, size);
1220         else
1221             ret = FALSE;
1222     }
1223     return ret;
1224 }
1225
1226 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
1227  DWORD dwFlags, const void *pvPara)
1228 {
1229     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
1230     BOOL ret;
1231
1232     if (dwType & CERT_INFO_SUBJECT_FLAG)
1233         toCompare = &pCertContext->pCertInfo->Subject;
1234     else
1235         toCompare = &pCertContext->pCertInfo->Issuer;
1236     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1237      toCompare, blob);
1238     return ret;
1239 }
1240
1241 static BOOL compare_cert_by_public_key(PCCERT_CONTEXT pCertContext,
1242  DWORD dwType, DWORD dwFlags, const void *pvPara)
1243 {
1244     CERT_PUBLIC_KEY_INFO *publicKey = (CERT_PUBLIC_KEY_INFO *)pvPara;
1245     BOOL ret;
1246
1247     ret = CertComparePublicKeyInfo(pCertContext->dwCertEncodingType,
1248      &pCertContext->pCertInfo->SubjectPublicKeyInfo, publicKey);
1249     return ret;
1250 }
1251
1252 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
1253  DWORD dwType, DWORD dwFlags, const void *pvPara)
1254 {
1255     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
1256     BOOL ret;
1257
1258     /* Matching serial number and subject match.. */
1259     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1260      &pCertContext->pCertInfo->Subject, &pCertInfo->Issuer);
1261     if (ret)
1262         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1263          &pCertInfo->SerialNumber);
1264     else
1265     {
1266         /* failing that, if the serial number and issuer match, we match */
1267         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1268          &pCertInfo->SerialNumber);
1269         if (ret)
1270             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1271              &pCertContext->pCertInfo->Issuer, &pCertInfo->Issuer);
1272     }
1273     TRACE("returning %d\n", ret);
1274     return ret;
1275 }
1276
1277 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
1278  DWORD dwFlags, const void *pvPara)
1279 {
1280     CERT_ID *id = (CERT_ID *)pvPara;
1281     BOOL ret;
1282
1283     switch (id->dwIdChoice)
1284     {
1285     case CERT_ID_ISSUER_SERIAL_NUMBER:
1286         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
1287          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
1288         if (ret)
1289             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
1290              &id->u.IssuerSerialNumber.SerialNumber);
1291         break;
1292     case CERT_ID_SHA1_HASH:
1293         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
1294          &id->u.HashId);
1295         break;
1296     case CERT_ID_KEY_IDENTIFIER:
1297     {
1298         DWORD size = 0;
1299
1300         ret = CertGetCertificateContextProperty(pCertContext,
1301          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
1302         if (ret && size == id->u.KeyId.cbData)
1303         {
1304             LPBYTE buf = CryptMemAlloc(size);
1305
1306             if (buf)
1307             {
1308                 CertGetCertificateContextProperty(pCertContext,
1309                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
1310                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
1311                 CryptMemFree(buf);
1312             }
1313         }
1314         else
1315             ret = FALSE;
1316         break;
1317     }
1318     default:
1319         ret = FALSE;
1320         break;
1321     }
1322     return ret;
1323 }
1324
1325 static BOOL compare_existing_cert(PCCERT_CONTEXT pCertContext, DWORD dwType,
1326  DWORD dwFlags, const void *pvPara)
1327 {
1328     PCCERT_CONTEXT toCompare = pvPara;
1329     return CertCompareCertificate(pCertContext->dwCertEncodingType,
1330      pCertContext->pCertInfo, toCompare->pCertInfo);
1331 }
1332
1333 static BOOL compare_cert_by_signature_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
1334  DWORD dwFlags, const void *pvPara)
1335 {
1336     const CRYPT_HASH_BLOB *hash = pvPara;
1337     DWORD size = 0;
1338     BOOL ret;
1339
1340     ret = CertGetCertificateContextProperty(pCertContext,
1341      CERT_SIGNATURE_HASH_PROP_ID, NULL, &size);
1342     if (ret && size == hash->cbData)
1343     {
1344         LPBYTE buf = CryptMemAlloc(size);
1345
1346         if (buf)
1347         {
1348             CertGetCertificateContextProperty(pCertContext,
1349              CERT_SIGNATURE_HASH_PROP_ID, buf, &size);
1350             ret = !memcmp(buf, hash->pbData, size);
1351             CryptMemFree(buf);
1352         }
1353     }
1354     else
1355         ret = FALSE;
1356     return ret;
1357 }
1358
1359 static inline PCCERT_CONTEXT cert_compare_certs_in_store(HCERTSTORE store,
1360  PCCERT_CONTEXT prev, CertCompareFunc compare, DWORD dwType, DWORD dwFlags,
1361  const void *pvPara)
1362 {
1363     BOOL matches = FALSE;
1364     PCCERT_CONTEXT ret;
1365
1366     ret = prev;
1367     do {
1368         ret = CertEnumCertificatesInStore(store, ret);
1369         if (ret)
1370             matches = compare(ret, dwType, dwFlags, pvPara);
1371     } while (ret != NULL && !matches);
1372     return ret;
1373 }
1374
1375 typedef PCCERT_CONTEXT (*CertFindFunc)(HCERTSTORE store, DWORD dwType,
1376  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev);
1377
1378 static PCCERT_CONTEXT find_cert_any(HCERTSTORE store, DWORD dwType,
1379  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1380 {
1381     return CertEnumCertificatesInStore(store, prev);
1382 }
1383
1384 static PCCERT_CONTEXT find_cert_by_issuer(HCERTSTORE store, DWORD dwType,
1385  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1386 {
1387     BOOL ret;
1388     PCCERT_CONTEXT found = NULL, subject = pvPara;
1389     PCERT_EXTENSION ext;
1390     DWORD size;
1391
1392     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
1393      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1394     {
1395         CERT_AUTHORITY_KEY_ID_INFO *info;
1396
1397         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1398          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
1399          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1400          &info, &size);
1401         if (ret)
1402         {
1403             CERT_ID id;
1404
1405             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1406             {
1407                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1408                 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1409                  sizeof(CERT_NAME_BLOB));
1410                 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1411                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1412             }
1413             else if (info->KeyId.cbData)
1414             {
1415                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1416                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1417             }
1418             else
1419                 ret = FALSE;
1420             if (ret)
1421                 found = cert_compare_certs_in_store(store, prev,
1422                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1423             LocalFree(info);
1424         }
1425     }
1426     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1427      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1428     {
1429         CERT_AUTHORITY_KEY_ID2_INFO *info;
1430
1431         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1432          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1433          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1434          &info, &size);
1435         if (ret)
1436         {
1437             CERT_ID id;
1438
1439             if (info->AuthorityCertIssuer.cAltEntry &&
1440              info->AuthorityCertSerialNumber.cbData)
1441             {
1442                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1443                 DWORD i;
1444
1445                 for (i = 0; !directoryName &&
1446                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1447                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1448                      == CERT_ALT_NAME_DIRECTORY_NAME)
1449                         directoryName =
1450                          &info->AuthorityCertIssuer.rgAltEntry[i];
1451                 if (directoryName)
1452                 {
1453                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1454                     memcpy(&id.u.IssuerSerialNumber.Issuer,
1455                      &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1456                     memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1457                      &info->AuthorityCertSerialNumber,
1458                      sizeof(CRYPT_INTEGER_BLOB));
1459                 }
1460                 else
1461                 {
1462                     FIXME("no supported name type in authority key id2\n");
1463                     ret = FALSE;
1464                 }
1465             }
1466             else if (info->KeyId.cbData)
1467             {
1468                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1469                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1470             }
1471             else
1472                 ret = FALSE;
1473             if (ret)
1474                 found = cert_compare_certs_in_store(store, prev,
1475                  compare_cert_by_cert_id, dwType, dwFlags, &id);
1476             LocalFree(info);
1477         }
1478     }
1479     else
1480        found = cert_compare_certs_in_store(store, prev,
1481         compare_cert_by_name, CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT,
1482         dwFlags, &subject->pCertInfo->Issuer);
1483     return found;
1484 }
1485
1486 static BOOL compare_cert_by_name_str(PCCERT_CONTEXT pCertContext,
1487  DWORD dwType, DWORD dwFlags, const void *pvPara)
1488 {
1489     PCERT_NAME_BLOB name;
1490     DWORD len;
1491     BOOL ret = FALSE;
1492
1493     if (dwType & CERT_INFO_SUBJECT_FLAG)
1494         name = &pCertContext->pCertInfo->Subject;
1495     else
1496         name = &pCertContext->pCertInfo->Issuer;
1497     len = CertNameToStrW(pCertContext->dwCertEncodingType, name,
1498      CERT_SIMPLE_NAME_STR, NULL, 0);
1499     if (len)
1500     {
1501         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1502
1503         if (str)
1504         {
1505             LPWSTR ptr;
1506
1507             CertNameToStrW(pCertContext->dwCertEncodingType, name,
1508              CERT_SIMPLE_NAME_STR, str, len);
1509             for (ptr = str; *ptr; ptr++)
1510                 *ptr = tolowerW(*ptr);
1511             if (strstrW(str, pvPara))
1512                 ret = TRUE;
1513             CryptMemFree(str);
1514         }
1515     }
1516     return ret;
1517 }
1518
1519 static PCCERT_CONTEXT find_cert_by_name_str_a(HCERTSTORE store, DWORD dwType,
1520  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1521 {
1522     PCCERT_CONTEXT found = NULL;
1523
1524     TRACE("%s\n", debugstr_a(pvPara));
1525
1526     if (pvPara)
1527     {
1528         int len = MultiByteToWideChar(CP_ACP, 0, pvPara, -1, NULL, 0);
1529         LPWSTR str = CryptMemAlloc(len * sizeof(WCHAR));
1530
1531         if (str)
1532         {
1533             LPWSTR ptr;
1534
1535             MultiByteToWideChar(CP_ACP, 0, pvPara, -1, str, len);
1536             for (ptr = str; *ptr; ptr++)
1537                 *ptr = tolowerW(*ptr);
1538             found = cert_compare_certs_in_store(store, prev,
1539              compare_cert_by_name_str, dwType, dwFlags, str);
1540             CryptMemFree(str);
1541         }
1542     }
1543     else
1544         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1545     return found;
1546 }
1547
1548 static PCCERT_CONTEXT find_cert_by_name_str_w(HCERTSTORE store, DWORD dwType,
1549  DWORD dwFlags, const void *pvPara, PCCERT_CONTEXT prev)
1550 {
1551     PCCERT_CONTEXT found = NULL;
1552
1553     TRACE("%s\n", debugstr_w(pvPara));
1554
1555     if (pvPara)
1556     {
1557         DWORD len = strlenW(pvPara);
1558         LPWSTR str = CryptMemAlloc((len + 1) * sizeof(WCHAR));
1559
1560         if (str)
1561         {
1562             LPCWSTR src;
1563             LPWSTR dst;
1564
1565             for (src = pvPara, dst = str; *src; src++, dst++)
1566                 *dst = tolowerW(*src);
1567             *dst = 0;
1568            found = cert_compare_certs_in_store(store, prev,
1569             compare_cert_by_name_str, dwType, dwFlags, str);
1570            CryptMemFree(str);
1571         }
1572     }
1573     else
1574         found = find_cert_any(store, dwType, dwFlags, NULL, prev);
1575     return found;
1576 }
1577
1578 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1579  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1580  PCCERT_CONTEXT pPrevCertContext)
1581 {
1582     PCCERT_CONTEXT ret;
1583     CertFindFunc find = NULL;
1584     CertCompareFunc compare = NULL;
1585
1586     TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1587          dwFlags, dwType, pvPara, pPrevCertContext);
1588
1589     switch (dwType >> CERT_COMPARE_SHIFT)
1590     {
1591     case CERT_COMPARE_ANY:
1592         find = find_cert_any;
1593         break;
1594     case CERT_COMPARE_MD5_HASH:
1595         compare = compare_cert_by_md5_hash;
1596         break;
1597     case CERT_COMPARE_SHA1_HASH:
1598         compare = compare_cert_by_sha1_hash;
1599         break;
1600     case CERT_COMPARE_NAME:
1601         compare = compare_cert_by_name;
1602         break;
1603     case CERT_COMPARE_PUBLIC_KEY:
1604         compare = compare_cert_by_public_key;
1605         break;
1606     case CERT_COMPARE_NAME_STR_A:
1607         find = find_cert_by_name_str_a;
1608         break;
1609     case CERT_COMPARE_NAME_STR_W:
1610         find = find_cert_by_name_str_w;
1611         break;
1612     case CERT_COMPARE_SUBJECT_CERT:
1613         compare = compare_cert_by_subject_cert;
1614         break;
1615     case CERT_COMPARE_CERT_ID:
1616         compare = compare_cert_by_cert_id;
1617         break;
1618     case CERT_COMPARE_ISSUER_OF:
1619         find = find_cert_by_issuer;
1620         break;
1621     case CERT_COMPARE_EXISTING:
1622         compare = compare_existing_cert;
1623         break;
1624     case CERT_COMPARE_SIGNATURE_HASH:
1625         compare = compare_cert_by_signature_hash;
1626         break;
1627     default:
1628         FIXME("find type %08x unimplemented\n", dwType);
1629     }
1630
1631     if (find)
1632         ret = find(hCertStore, dwFlags, dwType, pvPara, pPrevCertContext);
1633     else if (compare)
1634         ret = cert_compare_certs_in_store(hCertStore, pPrevCertContext,
1635          compare, dwType, dwFlags, pvPara);
1636     else
1637         ret = NULL;
1638     if (!ret)
1639         SetLastError(CRYPT_E_NOT_FOUND);
1640     TRACE("returning %p\n", ret);
1641     return ret;
1642 }
1643
1644 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1645  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1646 {
1647     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1648
1649     if (!pCertId)
1650     {
1651         SetLastError(E_INVALIDARG);
1652         return NULL;
1653     }
1654     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1655      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1656 }
1657
1658 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1659  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1660 {
1661     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1662      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1663
1664     if (*pdwFlags & ~supportedFlags)
1665     {
1666         SetLastError(E_INVALIDARG);
1667         return FALSE;
1668     }
1669     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1670     {
1671         DWORD flags = 0;
1672         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1673          NULL, &flags);
1674
1675         /* FIXME: what if the CRL has expired? */
1676         if (crl)
1677         {
1678             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1679              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1680                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1681         }
1682         else
1683             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1684     }
1685     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1686     {
1687         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1688             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1689     }
1690     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1691     {
1692         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1693          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1694          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1695             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1696     }
1697     return TRUE;
1698 }
1699
1700 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1701  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1702  DWORD *pdwFlags)
1703 {
1704     PCCERT_CONTEXT ret;
1705
1706     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1707      pPrevIssuerContext, *pdwFlags);
1708
1709     if (!pSubjectContext)
1710     {
1711         SetLastError(E_INVALIDARG);
1712         return NULL;
1713     }
1714
1715     ret = CertFindCertificateInStore(hCertStore,
1716      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1717      pSubjectContext, pPrevIssuerContext);
1718     if (ret)
1719     {
1720         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1721          pdwFlags))
1722         {
1723             CertFreeCertificateContext(ret);
1724             ret = NULL;
1725         }
1726     }
1727     TRACE("returning %p\n", ret);
1728     return ret;
1729 }
1730
1731 typedef struct _OLD_CERT_REVOCATION_STATUS {
1732     DWORD cbSize;
1733     DWORD dwIndex;
1734     DWORD dwError;
1735     DWORD dwReason;
1736 } OLD_CERT_REVOCATION_STATUS, *POLD_CERT_REVOCATION_STATUS;
1737
1738 typedef BOOL (WINAPI *CertVerifyRevocationFunc)(DWORD, DWORD, DWORD,
1739  void **, DWORD, PCERT_REVOCATION_PARA, PCERT_REVOCATION_STATUS);
1740
1741 BOOL WINAPI CertVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
1742  DWORD cContext, PVOID rgpvContext[], DWORD dwFlags,
1743  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
1744 {
1745     BOOL ret;
1746
1747     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
1748      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
1749
1750     if (pRevStatus->cbSize != sizeof(OLD_CERT_REVOCATION_STATUS) &&
1751      pRevStatus->cbSize != sizeof(CERT_REVOCATION_STATUS))
1752     {
1753         SetLastError(E_INVALIDARG);
1754         return FALSE;
1755     }
1756     if (cContext)
1757     {
1758         static HCRYPTOIDFUNCSET set = NULL;
1759         DWORD size;
1760
1761         if (!set)
1762             set = CryptInitOIDFunctionSet(CRYPT_OID_VERIFY_REVOCATION_FUNC, 0);
1763         ret = CryptGetDefaultOIDDllList(set, dwEncodingType, NULL, &size);
1764         if (ret)
1765         {
1766             if (size == 1)
1767             {
1768                 /* empty list */
1769                 SetLastError(CRYPT_E_NO_REVOCATION_DLL);
1770                 ret = FALSE;
1771             }
1772             else
1773             {
1774                 LPWSTR dllList = CryptMemAlloc(size * sizeof(WCHAR)), ptr;
1775
1776                 if (dllList)
1777                 {
1778                     ret = CryptGetDefaultOIDDllList(set, dwEncodingType,
1779                      dllList, &size);
1780                     if (ret)
1781                     {
1782                         for (ptr = dllList; ret && *ptr;
1783                          ptr += lstrlenW(ptr) + 1)
1784                         {
1785                             CertVerifyRevocationFunc func;
1786                             HCRYPTOIDFUNCADDR hFunc;
1787
1788                             ret = CryptGetDefaultOIDFunctionAddress(set,
1789                              dwEncodingType, ptr, 0, (void **)&func, &hFunc);
1790                             if (ret)
1791                             {
1792                                 ret = func(dwEncodingType, dwRevType, cContext,
1793                                  rgpvContext, dwFlags, pRevPara, pRevStatus);
1794                                 CryptFreeOIDFunctionAddress(hFunc, 0);
1795                             }
1796                         }
1797                     }
1798                     CryptMemFree(dllList);
1799                 }
1800                 else
1801                 {
1802                     SetLastError(ERROR_OUTOFMEMORY);
1803                     ret = FALSE;
1804                 }
1805             }
1806         }
1807     }
1808     else
1809         ret = TRUE;
1810     return ret;
1811 }
1812
1813 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1814  CRYPT_ATTRIBUTE rgAttr[])
1815 {
1816     PCRYPT_ATTRIBUTE ret = NULL;
1817     DWORD i;
1818
1819     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1820
1821     if (!cAttr)
1822         return NULL;
1823     if (!pszObjId)
1824     {
1825         SetLastError(ERROR_INVALID_PARAMETER);
1826         return NULL;
1827     }
1828
1829     for (i = 0; !ret && i < cAttr; i++)
1830         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1831             ret = &rgAttr[i];
1832     return ret;
1833 }
1834
1835 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1836  CERT_EXTENSION rgExtensions[])
1837 {
1838     PCERT_EXTENSION ret = NULL;
1839     DWORD i;
1840
1841     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1842
1843     if (!cExtensions)
1844         return NULL;
1845     if (!pszObjId)
1846     {
1847         SetLastError(ERROR_INVALID_PARAMETER);
1848         return NULL;
1849     }
1850
1851     for (i = 0; !ret && i < cExtensions; i++)
1852         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1853          rgExtensions[i].pszObjId))
1854             ret = &rgExtensions[i];
1855     return ret;
1856 }
1857
1858 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1859 {
1860     PCERT_RDN_ATTR ret = NULL;
1861     DWORD i, j;
1862
1863     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1864
1865     if (!pszObjId)
1866     {
1867         SetLastError(ERROR_INVALID_PARAMETER);
1868         return NULL;
1869     }
1870
1871     for (i = 0; !ret && i < pName->cRDN; i++)
1872         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1873             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1874              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1875                 ret = &pName->rgRDN[i].rgRDNAttr[j];
1876     return ret;
1877 }
1878
1879 static BOOL find_matching_rdn_attr(DWORD dwFlags, const CERT_NAME_INFO *name,
1880  const CERT_RDN_ATTR *attr)
1881 {
1882     DWORD i, j;
1883     BOOL match = FALSE;
1884
1885     for (i = 0; !match && i < name->cRDN; i++)
1886     {
1887         for (j = 0; j < name->rgRDN[i].cRDNAttr; j++)
1888         {
1889             if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId,
1890              attr->pszObjId) &&
1891              name->rgRDN[i].rgRDNAttr[j].dwValueType ==
1892              attr->dwValueType)
1893             {
1894                 if (dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG)
1895                 {
1896                     LPCWSTR nameStr =
1897                      (LPCWSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
1898                     LPCWSTR attrStr = (LPCWSTR)attr->Value.pbData;
1899
1900                     if (attr->Value.cbData !=
1901                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
1902                         match = FALSE;
1903                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
1904                         match = !strncmpiW(nameStr, attrStr,
1905                          attr->Value.cbData / sizeof(WCHAR));
1906                     else
1907                         match = !strncmpW(nameStr, attrStr,
1908                          attr->Value.cbData / sizeof(WCHAR));
1909                     TRACE("%s : %s => %d\n",
1910                      debugstr_wn(nameStr, attr->Value.cbData / sizeof(WCHAR)),
1911                      debugstr_wn(attrStr, attr->Value.cbData / sizeof(WCHAR)),
1912                      match);
1913                 }
1914                 else
1915                 {
1916                     LPCSTR nameStr =
1917                      (LPCSTR)name->rgRDN[i].rgRDNAttr[j].Value.pbData;
1918                     LPCSTR attrStr = (LPCSTR)attr->Value.pbData;
1919
1920                     if (attr->Value.cbData !=
1921                      name->rgRDN[i].rgRDNAttr[j].Value.cbData)
1922                         match = FALSE;
1923                     else if (dwFlags & CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG)
1924                         match = !strncasecmp(nameStr, attrStr,
1925                          attr->Value.cbData);
1926                     else
1927                         match = !strncmp(nameStr, attrStr, attr->Value.cbData);
1928                     TRACE("%s : %s => %d\n",
1929                      debugstr_an(nameStr, attr->Value.cbData),
1930                      debugstr_an(attrStr, attr->Value.cbData), match);
1931                 }
1932             }
1933         }
1934     }
1935     return match;
1936 }
1937
1938 BOOL WINAPI CertIsRDNAttrsInCertificateName(DWORD dwCertEncodingType,
1939  DWORD dwFlags, PCERT_NAME_BLOB pCertName, PCERT_RDN pRDN)
1940 {
1941     CERT_NAME_INFO *name;
1942     LPCSTR type;
1943     DWORD size;
1944     BOOL ret;
1945
1946     TRACE("(%08x, %08x, %p, %p)\n", dwCertEncodingType, dwFlags, pCertName,
1947      pRDN);
1948
1949     type = dwFlags & CERT_UNICODE_IS_RDN_ATTRS_FLAG ? X509_UNICODE_NAME :
1950      X509_NAME;
1951     if ((ret = CryptDecodeObjectEx(dwCertEncodingType, type, pCertName->pbData,
1952      pCertName->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &name, &size)))
1953     {
1954         DWORD i;
1955
1956         for (i = 0; ret && i < pRDN->cRDNAttr; i++)
1957             ret = find_matching_rdn_attr(dwFlags, name, &pRDN->rgRDNAttr[i]);
1958         if (!ret)
1959             SetLastError(CRYPT_E_NO_MATCH);
1960         LocalFree(name);
1961     }
1962     return ret;
1963 }
1964
1965 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1966  PCERT_INFO pCertInfo)
1967 {
1968     FILETIME fileTime;
1969     LONG ret;
1970
1971     if (!pTimeToVerify)
1972     {
1973         GetSystemTimeAsFileTime(&fileTime);
1974         pTimeToVerify = &fileTime;
1975     }
1976     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1977     {
1978         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1979         if (ret < 0)
1980             ret = 0;
1981     }
1982     return ret;
1983 }
1984
1985 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1986  PCERT_INFO pIssuerInfo)
1987 {
1988     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1989
1990     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1991      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1992 }
1993
1994 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1995  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1996  DWORD *pcbComputedHash)
1997 {
1998     BOOL ret = TRUE;
1999     HCRYPTHASH hHash = 0;
2000
2001     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
2002      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
2003
2004     if (!hCryptProv)
2005         hCryptProv = CRYPT_GetDefaultProvider();
2006     if (!Algid)
2007         Algid = CALG_SHA1;
2008     if (ret)
2009     {
2010         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2011         if (ret)
2012         {
2013             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
2014             if (ret)
2015                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2016                  pcbComputedHash, 0);
2017             CryptDestroyHash(hHash);
2018         }
2019     }
2020     return ret;
2021 }
2022
2023 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
2024  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
2025  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2026 {
2027     BOOL ret = TRUE;
2028     HCRYPTHASH hHash = 0;
2029
2030     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
2031      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
2032
2033     if (!hCryptProv)
2034         hCryptProv = CRYPT_GetDefaultProvider();
2035     if (!Algid)
2036         Algid = CALG_MD5;
2037     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
2038     {
2039         SetLastError(ERROR_FILE_NOT_FOUND);
2040         return FALSE;
2041     }
2042     if (ret)
2043     {
2044         BYTE *buf;
2045         DWORD size = 0;
2046
2047         ret = CRYPT_AsnEncodePubKeyInfoNoNull(dwCertEncodingType,
2048          X509_PUBLIC_KEY_INFO, pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2049          (LPBYTE)&buf, &size);
2050         if (ret)
2051         {
2052             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
2053             if (ret)
2054             {
2055                 ret = CryptHashData(hHash, buf, size, 0);
2056                 if (ret)
2057                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2058                      pcbComputedHash, 0);
2059                 CryptDestroyHash(hHash);
2060             }
2061             LocalFree(buf);
2062         }
2063     }
2064     return ret;
2065 }
2066
2067 BOOL WINAPI CryptHashToBeSigned(HCRYPTPROV_LEGACY hCryptProv,
2068  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2069  BYTE *pbComputedHash, DWORD *pcbComputedHash)
2070 {
2071     BOOL ret;
2072     CERT_SIGNED_CONTENT_INFO *info;
2073     DWORD size;
2074
2075     TRACE("(%08lx, %08x, %p, %d, %p, %d)\n", hCryptProv, dwCertEncodingType,
2076      pbEncoded, cbEncoded, pbComputedHash, *pcbComputedHash);
2077
2078     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2079      pbEncoded, cbEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size);
2080     if (ret)
2081     {
2082         PCCRYPT_OID_INFO oidInfo;
2083         HCRYPTHASH hHash;
2084
2085         if (!hCryptProv)
2086             hCryptProv = CRYPT_GetDefaultProvider();
2087         oidInfo = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2088          info->SignatureAlgorithm.pszObjId, 0);
2089         if (!oidInfo)
2090         {
2091             SetLastError(NTE_BAD_ALGID);
2092             ret = FALSE;
2093         }
2094         else
2095         {
2096             ret = CryptCreateHash(hCryptProv, oidInfo->u.Algid, 0, 0, &hHash);
2097             if (ret)
2098             {
2099                 ret = CryptHashData(hHash, info->ToBeSigned.pbData,
2100                  info->ToBeSigned.cbData, 0);
2101                 if (ret)
2102                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
2103                      pcbComputedHash, 0);
2104                 CryptDestroyHash(hHash);
2105             }
2106         }
2107         LocalFree(info);
2108     }
2109     return ret;
2110 }
2111
2112 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2113  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
2114  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2115  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
2116 {
2117     BOOL ret;
2118     PCCRYPT_OID_INFO info;
2119     HCRYPTHASH hHash;
2120
2121     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
2122      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
2123      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
2124
2125     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2126      pSignatureAlgorithm->pszObjId, 0);
2127     if (!info)
2128     {
2129         SetLastError(NTE_BAD_ALGID);
2130         return FALSE;
2131     }
2132     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
2133     {
2134         if (!hCryptProv)
2135             hCryptProv = CRYPT_GetDefaultProvider();
2136         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2137         if (ret)
2138         {
2139             ret = CryptHashData(hHash, pbEncodedToBeSigned,
2140              cbEncodedToBeSigned, 0);
2141             if (ret)
2142                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
2143                  pcbSignature, 0);
2144             CryptDestroyHash(hHash);
2145         }
2146     }
2147     else
2148     {
2149         if (!hCryptProv)
2150         {
2151             SetLastError(ERROR_INVALID_PARAMETER);
2152             ret = FALSE;
2153         }
2154         else
2155         {
2156             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
2157             if (ret)
2158             {
2159                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
2160                  cbEncodedToBeSigned, 0);
2161                 if (ret)
2162                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
2163                      pcbSignature);
2164                 CryptDestroyHash(hHash);
2165             }
2166         }
2167     }
2168     return ret;
2169 }
2170
2171 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
2172  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
2173  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
2174  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
2175 {
2176     BOOL ret;
2177     DWORD encodedSize, hashSize;
2178
2179     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
2180      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
2181      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
2182
2183     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
2184      NULL, &encodedSize);
2185     if (ret)
2186     {
2187         PBYTE encoded = CryptMemAlloc(encodedSize);
2188
2189         if (encoded)
2190         {
2191             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
2192              pvStructInfo, encoded, &encodedSize);
2193             if (ret)
2194             {
2195                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2196                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
2197                  pvHashAuxInfo, NULL, &hashSize);
2198                 if (ret)
2199                 {
2200                     PBYTE hash = CryptMemAlloc(hashSize);
2201
2202                     if (hash)
2203                     {
2204                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
2205                          dwCertEncodingType, encoded, encodedSize,
2206                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
2207                         if (ret)
2208                         {
2209                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
2210
2211                             info.ToBeSigned.cbData = encodedSize;
2212                             info.ToBeSigned.pbData = encoded;
2213                             memcpy(&info.SignatureAlgorithm,
2214                              pSignatureAlgorithm,
2215                              sizeof(info.SignatureAlgorithm));
2216                             info.Signature.cbData = hashSize;
2217                             info.Signature.pbData = hash;
2218                             info.Signature.cUnusedBits = 0;
2219                             ret = CryptEncodeObject(dwCertEncodingType,
2220                              X509_CERT, &info, pbEncoded, pcbEncoded);
2221                         }
2222                         CryptMemFree(hash);
2223                     }
2224                 }
2225             }
2226             CryptMemFree(encoded);
2227         }
2228     }
2229     return ret;
2230 }
2231
2232 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
2233  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
2234  PCERT_PUBLIC_KEY_INFO pPublicKey)
2235 {
2236     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
2237      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
2238      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
2239 }
2240
2241 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
2242  DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
2243  const CERT_SIGNED_CONTENT_INFO *signedCert)
2244 {
2245     BOOL ret;
2246     HCRYPTKEY key;
2247     PCCRYPT_OID_INFO info;
2248     ALG_ID pubKeyID, hashID;
2249
2250     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
2251      signedCert->SignatureAlgorithm.pszObjId, 0);
2252     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
2253     {
2254         SetLastError(NTE_BAD_ALGID);
2255         return FALSE;
2256     }
2257     hashID = info->u.Algid;
2258     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
2259         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
2260     else
2261         pubKeyID = hashID;
2262     /* Load the default provider if necessary */
2263     if (!hCryptProv)
2264         hCryptProv = CRYPT_GetDefaultProvider();
2265     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
2266      pubKeyInfo, pubKeyID, 0, NULL, &key);
2267     if (ret)
2268     {
2269         HCRYPTHASH hash;
2270
2271         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
2272         if (ret)
2273         {
2274             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
2275              signedCert->ToBeSigned.cbData, 0);
2276             if (ret)
2277                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
2278                  signedCert->Signature.cbData, key, NULL, 0);
2279             CryptDestroyHash(hash);
2280         }
2281         CryptDestroyKey(key);
2282     }
2283     return ret;
2284 }
2285
2286 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
2287  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
2288  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
2289 {
2290     BOOL ret = TRUE;
2291     CRYPT_DATA_BLOB subjectBlob;
2292
2293     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
2294      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
2295      dwFlags, pvReserved);
2296
2297     switch (dwSubjectType)
2298     {
2299     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
2300     {
2301         PCRYPT_DATA_BLOB blob = pvSubject;
2302
2303         subjectBlob.pbData = blob->pbData;
2304         subjectBlob.cbData = blob->cbData;
2305         break;
2306     }
2307     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
2308     {
2309         PCERT_CONTEXT context = pvSubject;
2310
2311         subjectBlob.pbData = context->pbCertEncoded;
2312         subjectBlob.cbData = context->cbCertEncoded;
2313         break;
2314     }
2315     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
2316     {
2317         PCRL_CONTEXT context = pvSubject;
2318
2319         subjectBlob.pbData = context->pbCrlEncoded;
2320         subjectBlob.cbData = context->cbCrlEncoded;
2321         break;
2322     }
2323     default:
2324         SetLastError(E_INVALIDARG);
2325         ret = FALSE;
2326     }
2327
2328     if (ret)
2329     {
2330         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
2331         DWORD size = 0;
2332
2333         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
2334          subjectBlob.pbData, subjectBlob.cbData,
2335          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
2336          &signedCert, &size);
2337         if (ret)
2338         {
2339             switch (dwIssuerType)
2340             {
2341             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
2342                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2343                  dwCertEncodingType, pvIssuer,
2344                  signedCert);
2345                 break;
2346             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
2347                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
2348                  dwCertEncodingType,
2349                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
2350                  signedCert);
2351                 break;
2352             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
2353                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
2354                 ret = FALSE;
2355                 break;
2356             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
2357                 if (pvIssuer)
2358                 {
2359                     SetLastError(E_INVALIDARG);
2360                     ret = FALSE;
2361                 }
2362                 else
2363                 {
2364                     FIXME("unimplemented for NULL signer\n");
2365                     SetLastError(E_INVALIDARG);
2366                     ret = FALSE;
2367                 }
2368                 break;
2369             default:
2370                 SetLastError(E_INVALIDARG);
2371                 ret = FALSE;
2372             }
2373             LocalFree(signedCert);
2374         }
2375     }
2376     return ret;
2377 }
2378
2379 BOOL WINAPI CertGetIntendedKeyUsage(DWORD dwCertEncodingType,
2380  PCERT_INFO pCertInfo, BYTE *pbKeyUsage, DWORD cbKeyUsage)
2381 {
2382     PCERT_EXTENSION ext;
2383     BOOL ret = FALSE;
2384
2385     TRACE("(%08x, %p, %p, %d)\n", dwCertEncodingType, pCertInfo, pbKeyUsage,
2386      cbKeyUsage);
2387
2388     ext = CertFindExtension(szOID_KEY_USAGE, pCertInfo->cExtension,
2389      pCertInfo->rgExtension);
2390     if (ext)
2391     {
2392         CRYPT_BIT_BLOB usage;
2393         DWORD size = sizeof(usage);
2394
2395         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_BITS,
2396          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL,
2397          &usage, &size);
2398         if (ret)
2399         {
2400             if (cbKeyUsage < usage.cbData)
2401                 ret = FALSE;
2402             else
2403             {
2404                 memcpy(pbKeyUsage, usage.pbData, usage.cbData);
2405                 if (cbKeyUsage > usage.cbData)
2406                     memset(pbKeyUsage + usage.cbData, 0,
2407                      cbKeyUsage - usage.cbData);
2408             }
2409         }
2410     }
2411     else
2412         SetLastError(0);
2413     return ret;
2414 }
2415
2416 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
2417  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
2418 {
2419     PCERT_ENHKEY_USAGE usage = NULL;
2420     DWORD bytesNeeded;
2421     BOOL ret = TRUE;
2422
2423     if (!pCertContext || !pcbUsage)
2424     {
2425         SetLastError(ERROR_INVALID_PARAMETER);
2426         return FALSE;
2427     }
2428
2429     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
2430
2431     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
2432     {
2433         DWORD propSize = 0;
2434
2435         if (CertGetCertificateContextProperty(pCertContext,
2436          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
2437         {
2438             LPBYTE buf = CryptMemAlloc(propSize);
2439
2440             if (buf)
2441             {
2442                 if (CertGetCertificateContextProperty(pCertContext,
2443                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
2444                 {
2445                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2446                      X509_ENHANCED_KEY_USAGE, buf, propSize,
2447                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2448                 }
2449                 CryptMemFree(buf);
2450             }
2451         }
2452     }
2453     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
2454     {
2455         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
2456          pCertContext->pCertInfo->cExtension,
2457          pCertContext->pCertInfo->rgExtension);
2458
2459         if (ext)
2460         {
2461             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
2462              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
2463              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
2464         }
2465     }
2466     if (!usage)
2467     {
2468         /* If a particular location is specified, this should fail.  Otherwise
2469          * it should succeed with an empty usage.  (This is true on Win2k and
2470          * later, which we emulate.)
2471          */
2472         if (dwFlags)
2473         {
2474             SetLastError(CRYPT_E_NOT_FOUND);
2475             ret = FALSE;
2476         }
2477         else
2478             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
2479     }
2480
2481     if (ret)
2482     {
2483         if (!pUsage)
2484             *pcbUsage = bytesNeeded;
2485         else if (*pcbUsage < bytesNeeded)
2486         {
2487             SetLastError(ERROR_MORE_DATA);
2488             *pcbUsage = bytesNeeded;
2489             ret = FALSE;
2490         }
2491         else
2492         {
2493             *pcbUsage = bytesNeeded;
2494             if (usage)
2495             {
2496                 DWORD i;
2497                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
2498                  sizeof(CERT_ENHKEY_USAGE) +
2499                  usage->cUsageIdentifier * sizeof(LPSTR));
2500
2501                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
2502                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
2503                  sizeof(CERT_ENHKEY_USAGE));
2504                 for (i = 0; i < usage->cUsageIdentifier; i++)
2505                 {
2506                     pUsage->rgpszUsageIdentifier[i] = nextOID;
2507                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2508                     nextOID += strlen(nextOID) + 1;
2509                 }
2510             }
2511             else
2512                 pUsage->cUsageIdentifier = 0;
2513         }
2514     }
2515     if (usage)
2516         LocalFree(usage);
2517     TRACE("returning %d\n", ret);
2518     return ret;
2519 }
2520
2521 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
2522  PCERT_ENHKEY_USAGE pUsage)
2523 {
2524     BOOL ret;
2525
2526     TRACE("(%p, %p)\n", pCertContext, pUsage);
2527
2528     if (pUsage)
2529     {
2530         CRYPT_DATA_BLOB blob = { 0, NULL };
2531
2532         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
2533          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
2534         if (ret)
2535         {
2536             ret = CertSetCertificateContextProperty(pCertContext,
2537              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
2538             LocalFree(blob.pbData);
2539         }
2540     }
2541     else
2542         ret = CertSetCertificateContextProperty(pCertContext,
2543          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
2544     return ret;
2545 }
2546
2547 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2548  LPCSTR pszUsageIdentifier)
2549 {
2550     BOOL ret;
2551     DWORD size;
2552
2553     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2554
2555     if (CertGetEnhancedKeyUsage(pCertContext,
2556      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
2557     {
2558         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
2559
2560         if (usage)
2561         {
2562             ret = CertGetEnhancedKeyUsage(pCertContext,
2563              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
2564             if (ret)
2565             {
2566                 DWORD i;
2567                 BOOL exists = FALSE;
2568
2569                 /* Make sure usage doesn't already exist */
2570                 for (i = 0; !exists && i < usage->cUsageIdentifier; i++)
2571                 {
2572                     if (!strcmp(usage->rgpszUsageIdentifier[i],
2573                      pszUsageIdentifier))
2574                         exists = TRUE;
2575                 }
2576                 if (!exists)
2577                 {
2578                     PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
2579                      sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2580
2581                     if (newUsage)
2582                     {
2583                         LPSTR nextOID;
2584
2585                         newUsage->rgpszUsageIdentifier = (LPSTR *)
2586                          ((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
2587                         nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier
2588                           + (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
2589                         for (i = 0; i < usage->cUsageIdentifier; i++)
2590                         {
2591                             newUsage->rgpszUsageIdentifier[i] = nextOID;
2592                             strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
2593                             nextOID += strlen(nextOID) + 1;
2594                         }
2595                         newUsage->rgpszUsageIdentifier[i] = nextOID;
2596                         strcpy(nextOID, pszUsageIdentifier);
2597                         newUsage->cUsageIdentifier = i + 1;
2598                         ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
2599                         CryptMemFree(newUsage);
2600                     }
2601                     else
2602                         ret = FALSE;
2603                 }
2604             }
2605             CryptMemFree(usage);
2606         }
2607         else
2608             ret = FALSE;
2609     }
2610     else
2611     {
2612         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
2613          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
2614
2615         if (usage)
2616         {
2617             usage->rgpszUsageIdentifier =
2618              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
2619             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
2620              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
2621             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
2622             usage->cUsageIdentifier = 1;
2623             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
2624             CryptMemFree(usage);
2625         }
2626         else
2627             ret = FALSE;
2628     }
2629     return ret;
2630 }
2631
2632 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
2633  LPCSTR pszUsageIdentifier)
2634 {
2635     BOOL ret;
2636     DWORD size;
2637     CERT_ENHKEY_USAGE usage;
2638
2639     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
2640
2641     size = sizeof(usage);
2642     ret = CertGetEnhancedKeyUsage(pCertContext,
2643      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
2644     if (!ret && GetLastError() == ERROR_MORE_DATA)
2645     {
2646         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2647
2648         if (pUsage)
2649         {
2650             ret = CertGetEnhancedKeyUsage(pCertContext,
2651              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
2652             if (ret)
2653             {
2654                 if (pUsage->cUsageIdentifier)
2655                 {
2656                     DWORD i;
2657                     BOOL found = FALSE;
2658
2659                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
2660                     {
2661                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
2662                          pszUsageIdentifier))
2663                             found = TRUE;
2664                         if (found && i < pUsage->cUsageIdentifier - 1)
2665                             pUsage->rgpszUsageIdentifier[i] =
2666                              pUsage->rgpszUsageIdentifier[i + 1];
2667                     }
2668                     pUsage->cUsageIdentifier--;
2669                     /* Remove the usage if it's empty */
2670                     if (pUsage->cUsageIdentifier)
2671                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
2672                     else
2673                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
2674                 }
2675             }
2676             CryptMemFree(pUsage);
2677         }
2678         else
2679             ret = FALSE;
2680     }
2681     else
2682     {
2683         /* it fit in an empty usage, therefore there's nothing to remove */
2684         ret = TRUE;
2685     }
2686     return ret;
2687 }
2688
2689 struct BitField
2690 {
2691     DWORD  cIndexes;
2692     DWORD *indexes;
2693 };
2694
2695 #define BITS_PER_DWORD (sizeof(DWORD) * 8)
2696
2697 static void CRYPT_SetBitInField(struct BitField *field, DWORD bit)
2698 {
2699     DWORD indexIndex = bit / BITS_PER_DWORD;
2700
2701     if (indexIndex + 1 > field->cIndexes)
2702     {
2703         if (field->cIndexes)
2704             field->indexes = CryptMemRealloc(field->indexes,
2705              (indexIndex + 1) * sizeof(DWORD));
2706         else
2707             field->indexes = CryptMemAlloc(sizeof(DWORD));
2708         if (field->indexes)
2709         {
2710             field->indexes[indexIndex] = 0;
2711             field->cIndexes = indexIndex + 1;
2712         }
2713     }
2714     if (field->indexes)
2715         field->indexes[indexIndex] |= 1 << (bit % BITS_PER_DWORD);
2716 }
2717
2718 static BOOL CRYPT_IsBitInFieldSet(const struct BitField *field, DWORD bit)
2719 {
2720     BOOL set = FALSE;
2721     DWORD indexIndex = bit / BITS_PER_DWORD;
2722
2723     assert(field->cIndexes);
2724     set = field->indexes[indexIndex] & (1 << (bit % BITS_PER_DWORD));
2725     return set;
2726 }
2727
2728 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
2729  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
2730 {
2731     BOOL ret = TRUE;
2732     DWORD i, cbOIDs = 0;
2733     BOOL allUsagesValid = TRUE;
2734     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
2735
2736     TRACE("(%d, %p, %d, %p, %d)\n", cCerts, rghCerts, *cNumOIDs,
2737      rghOIDs, *pcbOIDs);
2738
2739     for (i = 0; i < cCerts; i++)
2740     {
2741         CERT_ENHKEY_USAGE usage;
2742         DWORD size = sizeof(usage);
2743
2744         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
2745         /* Success is deliberately ignored: it implies all usages are valid */
2746         if (!ret && GetLastError() == ERROR_MORE_DATA)
2747         {
2748             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
2749
2750             allUsagesValid = FALSE;
2751             if (pUsage)
2752             {
2753                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
2754                 if (ret)
2755                 {
2756                     if (!validUsages.cUsageIdentifier)
2757                     {
2758                         DWORD j;
2759
2760                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
2761                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
2762                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2763                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
2764                              + 1;
2765                         validUsages.rgpszUsageIdentifier =
2766                          CryptMemAlloc(cbOIDs);
2767                         if (validUsages.rgpszUsageIdentifier)
2768                         {
2769                             LPSTR nextOID = (LPSTR)
2770                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
2771                              validUsages.cUsageIdentifier * sizeof(LPSTR));
2772
2773                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
2774                             {
2775                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
2776                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
2777                                  pUsage->rgpszUsageIdentifier[j]);
2778                                 nextOID += lstrlenA(nextOID) + 1;
2779                             }
2780                         }
2781                     }
2782                     else
2783                     {
2784                         struct BitField validIndexes = { 0, NULL };
2785                         DWORD j, k, numRemoved = 0;
2786
2787                         /* Merge: build a bitmap of all the indexes of
2788                          * validUsages.rgpszUsageIdentifier that are in pUsage.
2789                          */
2790                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
2791                         {
2792                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
2793                             {
2794                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
2795                                  validUsages.rgpszUsageIdentifier[k]))
2796                                 {
2797                                     CRYPT_SetBitInField(&validIndexes, k);
2798                                     break;
2799                                 }
2800                             }
2801                         }
2802                         /* Merge by removing from validUsages those that are
2803                          * not in the bitmap.
2804                          */
2805                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2806                         {
2807                             if (!CRYPT_IsBitInFieldSet(&validIndexes, j))
2808                             {
2809                                 if (j < validUsages.cUsageIdentifier - 1)
2810                                 {
2811                                     memmove(&validUsages.rgpszUsageIdentifier[j],
2812                                      &validUsages.rgpszUsageIdentifier[j +
2813                                      numRemoved + 1],
2814                                      (validUsages.cUsageIdentifier - numRemoved
2815                                      - j - 1) * sizeof(LPSTR));
2816                                     cbOIDs -= lstrlenA(
2817                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
2818                                      sizeof(LPSTR);
2819                                     validUsages.cUsageIdentifier--;
2820                                     numRemoved++;
2821                                 }
2822                                 else
2823                                     validUsages.cUsageIdentifier--;
2824                             }
2825                         }
2826                         CryptMemFree(validIndexes.indexes);
2827                     }
2828                 }
2829                 CryptMemFree(pUsage);
2830             }
2831         }
2832     }
2833     ret = TRUE;
2834     if (allUsagesValid)
2835     {
2836         *cNumOIDs = -1;
2837         *pcbOIDs = 0;
2838     }
2839     else
2840     {
2841         *cNumOIDs = validUsages.cUsageIdentifier;
2842         if (!rghOIDs)
2843             *pcbOIDs = cbOIDs;
2844         else if (*pcbOIDs < cbOIDs)
2845         {
2846             *pcbOIDs = cbOIDs;
2847             SetLastError(ERROR_MORE_DATA);
2848             ret = FALSE;
2849         }
2850         else
2851         {
2852             LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2853              validUsages.cUsageIdentifier * sizeof(LPSTR));
2854
2855             *pcbOIDs = cbOIDs;
2856             for (i = 0; i < validUsages.cUsageIdentifier; i++)
2857             {
2858                 rghOIDs[i] = nextOID;
2859                 lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2860                 nextOID += lstrlenA(nextOID) + 1;
2861             }
2862         }
2863     }
2864     CryptMemFree(validUsages.rgpszUsageIdentifier);
2865     TRACE("cNumOIDs: %d\n", *cNumOIDs);
2866     TRACE("returning %d\n", ret);
2867     return ret;
2868 }
2869
2870 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2871  * pInfo is NULL, from the attributes of hProv.
2872  */
2873 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2874  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2875 {
2876     CRYPT_KEY_PROV_INFO info = { 0 };
2877     BOOL ret;
2878
2879     if (!pInfo)
2880     {
2881         DWORD size;
2882         int len;
2883
2884         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2885         if (ret)
2886         {
2887             LPSTR szContainer = CryptMemAlloc(size);
2888
2889             if (szContainer)
2890             {
2891                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2892                  (BYTE *)szContainer, &size, 0);
2893                 if (ret)
2894                 {
2895                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2896                      NULL, 0);
2897                     if (len)
2898                     {
2899                         info.pwszContainerName = CryptMemAlloc(len *
2900                          sizeof(WCHAR));
2901                         MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2902                          info.pwszContainerName, len);
2903                     }
2904                 }
2905                 CryptMemFree(szContainer);
2906             }
2907         }
2908         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2909         if (ret)
2910         {
2911             LPSTR szProvider = CryptMemAlloc(size);
2912
2913             if (szProvider)
2914             {
2915                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2916                  &size, 0);
2917                 if (ret)
2918                 {
2919                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2920                      NULL, 0);
2921                     if (len)
2922                     {
2923                         info.pwszProvName = CryptMemAlloc(len *
2924                          sizeof(WCHAR));
2925                         MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2926                          info.pwszProvName, len);
2927                     }
2928                 }
2929                 CryptMemFree(szProvider);
2930             }
2931         }
2932         size = sizeof(info.dwKeySpec);
2933         /* in case no CRYPT_KEY_PROV_INFO given,
2934          *  we always use AT_SIGNATURE key spec
2935          */
2936         info.dwKeySpec = AT_SIGNATURE;
2937         size = sizeof(info.dwProvType);
2938         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2939          &size, 0);
2940         if (!ret)
2941             info.dwProvType = PROV_RSA_FULL;
2942         pInfo = &info;
2943     }
2944
2945     CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2946      0, pInfo);
2947
2948     if (pInfo == &info)
2949     {
2950         CryptMemFree(info.pwszContainerName);
2951         CryptMemFree(info.pwszProvName);
2952     }
2953 }
2954
2955 /* Creates a signed certificate context from the unsigned, encoded certificate
2956  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2957  */
2958 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2959  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2960 {
2961     PCCERT_CONTEXT context = NULL;
2962     BOOL ret;
2963     DWORD sigSize = 0;
2964
2965     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2966      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2967     if (ret)
2968     {
2969         LPBYTE sig = CryptMemAlloc(sigSize);
2970
2971         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2972          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2973         if (ret)
2974         {
2975             CERT_SIGNED_CONTENT_INFO signedInfo;
2976             BYTE *encodedSignedCert = NULL;
2977             DWORD encodedSignedCertSize = 0;
2978
2979             signedInfo.ToBeSigned.cbData = blob->cbData;
2980             signedInfo.ToBeSigned.pbData = blob->pbData;
2981             memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2982              sizeof(signedInfo.SignatureAlgorithm));
2983             signedInfo.Signature.cbData = sigSize;
2984             signedInfo.Signature.pbData = sig;
2985             signedInfo.Signature.cUnusedBits = 0;
2986             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2987              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2988              &encodedSignedCert, &encodedSignedCertSize);
2989             if (ret)
2990             {
2991                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2992                  encodedSignedCert, encodedSignedCertSize);
2993                 LocalFree(encodedSignedCert);
2994             }
2995         }
2996         CryptMemFree(sig);
2997     }
2998     return context;
2999 }
3000
3001 /* Copies data from the parameters into info, where:
3002  * pSerialNumber: The serial number.  Must not be NULL.
3003  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
3004  *                     Must not be NULL
3005  * pSignatureAlgorithm: Optional.
3006  * pStartTime: The starting time of the certificate.  If NULL, the current
3007  *             system time is used.
3008  * pEndTime: The ending time of the certificate.  If NULL, one year past the
3009  *           starting time is used.
3010  * pubKey: The public key of the certificate.  Must not be NULL.
3011  * pExtensions: Extensions to be included with the certificate.  Optional.
3012  */
3013 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
3014  const CERT_NAME_BLOB *pSubjectIssuerBlob,
3015  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
3016  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
3017  const CERT_EXTENSIONS *pExtensions)
3018 {
3019     static CHAR oid[] = szOID_RSA_SHA1RSA;
3020
3021     assert(info);
3022     assert(pSerialNumber);
3023     assert(pSubjectIssuerBlob);
3024     assert(pubKey);
3025
3026     if (pExtensions && pExtensions->cExtension)
3027         info->dwVersion = CERT_V3;
3028     else
3029         info->dwVersion = CERT_V1;
3030     info->SerialNumber.cbData = pSerialNumber->cbData;
3031     info->SerialNumber.pbData = pSerialNumber->pbData;
3032     if (pSignatureAlgorithm)
3033         memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
3034          sizeof(info->SignatureAlgorithm));
3035     else
3036     {
3037         info->SignatureAlgorithm.pszObjId = oid;
3038         info->SignatureAlgorithm.Parameters.cbData = 0;
3039         info->SignatureAlgorithm.Parameters.pbData = NULL;
3040     }
3041     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
3042     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
3043     if (pStartTime)
3044         SystemTimeToFileTime(pStartTime, &info->NotBefore);
3045     else
3046         GetSystemTimeAsFileTime(&info->NotBefore);
3047     if (pEndTime)
3048         SystemTimeToFileTime(pEndTime, &info->NotAfter);
3049     else
3050     {
3051         SYSTEMTIME endTime;
3052
3053         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
3054         {
3055             endTime.wYear++;
3056             SystemTimeToFileTime(&endTime, &info->NotAfter);
3057         }
3058     }
3059     info->Subject.cbData = pSubjectIssuerBlob->cbData;
3060     info->Subject.pbData = pSubjectIssuerBlob->pbData;
3061     memcpy(&info->SubjectPublicKeyInfo, pubKey,
3062      sizeof(info->SubjectPublicKeyInfo));
3063     if (pExtensions)
3064     {
3065         info->cExtension = pExtensions->cExtension;
3066         info->rgExtension = pExtensions->rgExtension;
3067     }
3068     else
3069     {
3070         info->cExtension = 0;
3071         info->rgExtension = NULL;
3072     }
3073 }
3074
3075 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
3076 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
3077 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
3078
3079 static HCRYPTPROV CRYPT_CreateKeyProv(void)
3080 {
3081     HCRYPTPROV hProv = 0;
3082     HMODULE rpcrt = LoadLibraryA("rpcrt4");
3083
3084     if (rpcrt)
3085     {
3086         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
3087          "UuidCreate");
3088         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
3089          "UuidToStringA");
3090         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
3091          rpcrt, "RpcStringFreeA");
3092
3093         if (uuidCreate && uuidToString && rpcStringFree)
3094         {
3095             UUID uuid;
3096             RPC_STATUS status = uuidCreate(&uuid);
3097
3098             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
3099             {
3100                 unsigned char *uuidStr;
3101
3102                 status = uuidToString(&uuid, &uuidStr);
3103                 if (status == RPC_S_OK)
3104                 {
3105                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
3106                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
3107
3108                     if (ret)
3109                     {
3110                         HCRYPTKEY key;
3111
3112                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
3113                         if (ret)
3114                             CryptDestroyKey(key);
3115                     }
3116                     rpcStringFree(&uuidStr);
3117                 }
3118             }
3119         }
3120         FreeLibrary(rpcrt);
3121     }
3122     return hProv;
3123 }
3124
3125 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
3126  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
3127  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
3128  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
3129  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
3130 {
3131     PCCERT_CONTEXT context = NULL;
3132     BOOL ret, releaseContext = FALSE;
3133     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
3134     DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
3135
3136     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
3137      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
3138      pExtensions, pExtensions);
3139
3140     if(!pSubjectIssuerBlob)
3141     {
3142         SetLastError(ERROR_INVALID_PARAMETER);
3143         return NULL;
3144     }
3145
3146     if (!hProv)
3147     {
3148         if (!pKeyProvInfo)
3149         {
3150             hProv = CRYPT_CreateKeyProv();
3151             releaseContext = TRUE;
3152         }
3153         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
3154         {
3155             SetLastError(NTE_BAD_FLAGS);
3156             return NULL;
3157         }
3158         else
3159         {
3160             HCRYPTKEY hKey = 0;
3161             /* acquire the context using the given information*/
3162             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3163                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3164                     pKeyProvInfo->dwFlags);
3165             if (!ret)
3166             {
3167                 if(GetLastError() != NTE_BAD_KEYSET)
3168                     return NULL;
3169                 /* create the key set */
3170                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
3171                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
3172                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
3173                 if (!ret)
3174                     return NULL;
3175             }
3176             dwKeySpec = pKeyProvInfo->dwKeySpec;
3177             /* check if the key is here */
3178             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
3179             if(!ret)
3180             {
3181                 if (NTE_NO_KEY == GetLastError())
3182                 { /* generate the key */
3183                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
3184                 }
3185                 if (!ret)
3186                 {
3187                     CryptReleaseContext(hProv,0);
3188                     SetLastError(NTE_BAD_KEYSET);
3189                     return NULL;
3190                 }
3191             }
3192             CryptDestroyKey(hKey);
3193             releaseContext = TRUE;
3194         }
3195     }
3196     else if (pKeyProvInfo)
3197     {
3198         SetLastError(ERROR_INVALID_PARAMETER);
3199         return NULL;
3200     }
3201
3202     CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
3203      &pubKeySize);
3204     pubKey = CryptMemAlloc(pubKeySize);
3205     if (pubKey)
3206     {
3207         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
3208          pubKey, &pubKeySize);
3209         if (ret)
3210         {
3211             CERT_INFO info = { 0 };
3212             CRYPT_DER_BLOB blob = { 0, NULL };
3213             BYTE serial[16];
3214             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
3215
3216             CryptGenRandom(hProv, sizeof(serial), serial);
3217             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
3218              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
3219             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
3220              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData,
3221              &blob.cbData);
3222             if (ret)
3223             {
3224                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
3225                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
3226                      &info.SignatureAlgorithm);
3227                 else
3228                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
3229                      blob.pbData, blob.cbData);
3230                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
3231                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
3232                 LocalFree(blob.pbData);
3233             }
3234         }
3235         CryptMemFree(pubKey);
3236     }
3237     if (releaseContext)
3238         CryptReleaseContext(hProv, 0);
3239     return context;
3240 }
3241
3242 BOOL WINAPI CertVerifyCTLUsage(DWORD dwEncodingType, DWORD dwSubjectType,
3243                                void *pvSubject, PCTL_USAGE pSubjectUsage, DWORD dwFlags,
3244                                PCTL_VERIFY_USAGE_PARA pVerifyUsagePara,
3245                                PCTL_VERIFY_USAGE_STATUS pVerifyUsageStatus)
3246 {
3247     FIXME("(0x%x, %d, %p, %p, 0x%x, %p, %p): stub\n", dwEncodingType,
3248           dwSubjectType, pvSubject, pSubjectUsage, dwFlags, pVerifyUsagePara,
3249           pVerifyUsageStatus);
3250     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
3251     return FALSE;
3252 }
3253
3254 const void * WINAPI CertCreateContext(DWORD dwContextType, DWORD dwEncodingType,
3255                                       const BYTE *pbEncoded, DWORD cbEncoded,
3256                                       DWORD dwFlags, PCERT_CREATE_CONTEXT_PARA pCreatePara)
3257 {
3258     TRACE("(0x%x, 0x%x, %p, %d, 0x%08x, %p)\n", dwContextType, dwEncodingType,
3259           pbEncoded, cbEncoded, dwFlags, pCreatePara);
3260
3261     if (dwFlags)
3262     {
3263         FIXME("dwFlags 0x%08x not handled\n", dwFlags);
3264         return NULL;
3265     }
3266     if (pCreatePara)
3267     {
3268         FIXME("pCreatePara not handled\n");
3269         return NULL;
3270     }
3271
3272     switch (dwContextType)
3273     {
3274     case CERT_STORE_CERTIFICATE_CONTEXT:
3275         return CertCreateCertificateContext(dwEncodingType, pbEncoded, cbEncoded);
3276     case CERT_STORE_CRL_CONTEXT:
3277         return CertCreateCRLContext(dwEncodingType, pbEncoded, cbEncoded);
3278     case CERT_STORE_CTL_CONTEXT:
3279         return CertCreateCTLContext(dwEncodingType, pbEncoded, cbEncoded);
3280     default:
3281         WARN("unknown context type: 0x%x\n", dwContextType);
3282         return NULL;
3283     }
3284 }