2 * WinTrust Cryptography functions
4 * Copyright 2006 James Hawkins
5 * Copyright 2000-2002 Stuart Caie
6 * Copyright 2002 Patrik Stridvall
7 * Copyright 2003 Greg Turner
8 * Copyright 2008 Juan Lang
10 * This library is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public
12 * License as published by the Free Software Foundation; either
13 * version 2.1 of the License, or (at your option) any later version.
15 * This library is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with this library; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
34 #include "wine/debug.h"
36 WINE_DEFAULT_DEBUG_CHANNEL(wintrust);
38 /***********************************************************************
39 * CryptCATAdminAcquireContext (WINTRUST.@)
41 * Get a catalog administrator context handle.
44 * catAdmin [O] Pointer to the context handle.
45 * sysSystem [I] Pointer to a GUID for the needed subsystem.
46 * dwFlags [I] Reserved.
49 * Success: TRUE. catAdmin contains the context handle.
53 BOOL WINAPI CryptCATAdminAcquireContext(HCATADMIN* catAdmin,
54 const GUID *sysSystem, DWORD dwFlags )
56 FIXME("%p %s %x\n", catAdmin, debugstr_guid(sysSystem), dwFlags);
60 SetLastError(ERROR_INVALID_PARAMETER);
64 *catAdmin = (HCATADMIN)0xdeadbeef;
69 /***********************************************************************
70 * CryptCATAdminAddCatalog (WINTRUST.@)
72 HCATINFO WINAPI CryptCATAdminAddCatalog(HCATADMIN catAdmin, PWSTR catalogFile,
73 PWSTR selectBaseName, DWORD flags)
75 FIXME("%p %s %s %d\n", catAdmin, debugstr_w(catalogFile),
76 debugstr_w(selectBaseName), flags);
77 return (HCATINFO) 0xdeeeaaadL;
80 /***********************************************************************
81 * CryptCATAdminCalcHashFromFileHandle (WINTRUST.@)
83 BOOL WINAPI CryptCATAdminCalcHashFromFileHandle(HANDLE hFile, DWORD* pcbHash,
84 BYTE* pbHash, DWORD dwFlags )
86 FIXME("%p %p %p %x\n", hFile, pcbHash, pbHash, dwFlags);
88 if (pbHash && pcbHash) memset(pbHash, 0, *pcbHash);
92 /***********************************************************************
93 * CryptCATAdminEnumCatalogFromHash (WINTRUST.@)
95 HCATINFO WINAPI CryptCATAdminEnumCatalogFromHash(HCATADMIN hCatAdmin,
99 HCATINFO* phPrevCatInfo )
101 FIXME("%p %p %d %d %p\n", hCatAdmin, pbHash, cbHash, dwFlags, phPrevCatInfo);
105 /***********************************************************************
106 * CryptCATAdminReleaseCatalogContext (WINTRUST.@)
108 * Release a catalog context handle.
111 * hCatAdmin [I] Context handle.
112 * hCatInfo [I] Catalog handle.
113 * dwFlags [I] Reserved.
120 BOOL WINAPI CryptCATAdminReleaseCatalogContext(HCATADMIN hCatAdmin,
124 FIXME("%p %p %x\n", hCatAdmin, hCatInfo, dwFlags);
128 /***********************************************************************
129 * CryptCATAdminReleaseContext (WINTRUST.@)
131 * Release a catalog administrator context handle.
134 * catAdmin [I] Context handle.
135 * dwFlags [I] Reserved.
142 BOOL WINAPI CryptCATAdminReleaseContext(HCATADMIN hCatAdmin, DWORD dwFlags )
144 FIXME("%p %x\n", hCatAdmin, dwFlags);
148 /***********************************************************************
149 * CryptCATAdminRemoveCatalog (WINTRUST.@)
151 * Remove a catalog file.
154 * catAdmin [I] Context handle.
155 * pwszCatalogFile [I] Catalog file.
156 * dwFlags [I] Reserved.
163 BOOL WINAPI CryptCATAdminRemoveCatalog(HCATADMIN hCatAdmin, LPCWSTR pwszCatalogFile, DWORD dwFlags)
165 FIXME("%p %s %x\n", hCatAdmin, debugstr_w(pwszCatalogFile), dwFlags);
166 return DeleteFileW(pwszCatalogFile);
169 /***********************************************************************
170 * CryptCATClose (WINTRUST.@)
172 BOOL WINAPI CryptCATClose(HANDLE hCatalog)
174 FIXME("(%p) stub\n", hCatalog);
178 /***********************************************************************
179 * CryptCATEnumerateMember (WINTRUST.@)
181 CRYPTCATMEMBER *WINAPI CryptCATEnumerateMember(HANDLE hCatalog, CRYPTCATMEMBER* pPrevMember)
183 FIXME("(%p, %p) stub\n", hCatalog, pPrevMember);
187 /***********************************************************************
188 * CryptCATOpen (WINTRUST.@)
190 HANDLE WINAPI CryptCATOpen(LPWSTR pwszFileName, DWORD fdwOpenFlags, HCRYPTPROV hProv,
191 DWORD dwPublicVersion, DWORD dwEncodingType)
193 FIXME("(%s, %d, %ld, %d, %d) stub\n", debugstr_w(pwszFileName), fdwOpenFlags,
194 hProv, dwPublicVersion, dwEncodingType);
198 /***********************************************************************
199 * CryptSIPCreateIndirectData (WINTRUST.@)
201 BOOL WINAPI CryptSIPCreateIndirectData(SIP_SUBJECTINFO* pSubjectInfo, DWORD* pcbIndirectData,
202 SIP_INDIRECT_DATA* pIndirectData)
204 FIXME("(%p %p %p) stub\n", pSubjectInfo, pcbIndirectData, pIndirectData);
209 static BOOL WINTRUST_GetSignedMsgFromPEFile(SIP_SUBJECTINFO *pSubjectInfo,
210 DWORD *pdwEncodingType, DWORD dwIndex, DWORD *pcbSignedDataMsg,
211 BYTE *pbSignedDataMsg)
214 WIN_CERTIFICATE *pCert = NULL;
216 TRACE("(%p %p %d %p %p)\n", pSubjectInfo, pdwEncodingType, dwIndex,
217 pcbSignedDataMsg, pbSignedDataMsg);
219 if (!pbSignedDataMsg)
221 WIN_CERTIFICATE cert;
223 /* app hasn't passed buffer, just get the length */
224 ret = ImageGetCertificateHeader(pSubjectInfo->hFile, dwIndex, &cert);
226 *pcbSignedDataMsg = cert.dwLength;
232 ret = ImageGetCertificateData(pSubjectInfo->hFile, dwIndex, NULL, &len);
233 if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
235 pCert = HeapAlloc(GetProcessHeap(), 0, len);
241 ret = ImageGetCertificateData(pSubjectInfo->hFile, dwIndex, pCert,
245 if (*pcbSignedDataMsg < pCert->dwLength)
247 *pcbSignedDataMsg = pCert->dwLength;
248 SetLastError(ERROR_INSUFFICIENT_BUFFER);
253 memcpy(pbSignedDataMsg, pCert->bCertificate, pCert->dwLength);
254 switch (pCert->wCertificateType)
256 case WIN_CERT_TYPE_X509:
257 *pdwEncodingType = X509_ASN_ENCODING;
259 case WIN_CERT_TYPE_PKCS_SIGNED_DATA:
260 *pdwEncodingType = X509_ASN_ENCODING | PKCS_7_ASN_ENCODING;
263 FIXME("don't know what to do for encoding type %d\n",
264 pCert->wCertificateType);
265 *pdwEncodingType = 0;
270 HeapFree(GetProcessHeap(), 0, pCert);
274 /* structure offsets */
275 #define cfhead_Signature (0x00)
276 #define cfhead_CabinetSize (0x08)
277 #define cfhead_MinorVersion (0x18)
278 #define cfhead_MajorVersion (0x19)
279 #define cfhead_Flags (0x1E)
280 #define cfhead_SIZEOF (0x24)
281 #define cfheadext_HeaderReserved (0x00)
282 #define cfheadext_SIZEOF (0x04)
283 #define cfsigninfo_CertOffset (0x04)
284 #define cfsigninfo_CertSize (0x08)
285 #define cfsigninfo_SIZEOF (0x0C)
288 #define cfheadRESERVE_PRESENT (0x0004)
290 /* endian-neutral reading of little-endian data */
291 #define EndGetI32(a) ((((a)[3])<<24)|(((a)[2])<<16)|(((a)[1])<<8)|((a)[0]))
292 #define EndGetI16(a) ((((a)[1])<<8)|((a)[0]))
294 /* For documentation purposes only: this is the structure in the reserved
295 * area of a signed cabinet file. The cert offset indicates where in the
296 * cabinet file the signature resides, and the count indicates its size.
298 typedef struct _CAB_SIGNINFO
300 WORD unk0; /* always 0? */
301 WORD unk1; /* always 0x0010? */
304 } CAB_SIGNINFO, *PCAB_SIGNINFO;
306 static BOOL WINTRUST_GetSignedMsgFromCabFile(SIP_SUBJECTINFO *pSubjectInfo,
307 DWORD *pdwEncodingType, DWORD dwIndex, DWORD *pcbSignedDataMsg,
308 BYTE *pbSignedDataMsg)
311 LONG base_offset, cabsize;
314 DWORD cert_offset, cert_size, dwRead;
316 TRACE("(%p %p %d %p %p)\n", pSubjectInfo, pdwEncodingType, dwIndex,
317 pcbSignedDataMsg, pbSignedDataMsg);
320 * FIXME: I just noticed that I am memorizing the initial file pointer
321 * offset and restoring it before reading in the rest of the header
322 * information in the cabinet. Perhaps that's correct -- that is, perhaps
323 * this API is supposed to support "streaming" cabinets which are embedded
324 * in other files, or cabinets which begin at file offsets other than zero.
325 * Otherwise, I should instead go to the absolute beginning of the file.
326 * (Either way, the semantics of wine's FDICopy require me to leave the
327 * file pointer where it is afterwards -- If Windows does not do so, we
328 * ought to duplicate the native behavior in the FDIIsCabinet API, not here.
330 * So, the answer lies in Windows; will native cabinet.dll recognize a
331 * cabinet "file" embedded in another file? Note that cabextract.c does
332 * support this, which implies that Microsoft's might. I haven't tried it
333 * yet so I don't know. ATM, most of wine's FDI cabinet routines (except
334 * this one) would not work in this way. To fix it, we could just make the
335 * various references to absolute file positions in the code relative to an
336 * initial "beginning" offset. Because the FDICopy API doesn't take a
337 * file-handle like this one, we would therein need to search through the
338 * file for the beginning of the cabinet (as we also do in cabextract.c).
339 * Note that this limits us to a maximum of one cabinet per. file: the first.
341 * So, in summary: either the code below is wrong, or the rest of fdi.c is
342 * wrong... I cannot imagine that both are correct ;) One of these flaws
343 * should be fixed after determining the behavior on Windows. We ought
344 * to check both FDIIsCabinet and FDICopy for the right behavior.
349 /* get basic offset & size info */
350 base_offset = SetFilePointer(pSubjectInfo->hFile, 0L, NULL, SEEK_CUR);
352 if (SetFilePointer(pSubjectInfo->hFile, 0, NULL, SEEK_END) == -1)
354 TRACE("seek error\n");
358 cabsize = SetFilePointer(pSubjectInfo->hFile, 0L, NULL, SEEK_CUR);
359 if ((cabsize == -1) || (base_offset == -1) ||
360 (SetFilePointer(pSubjectInfo->hFile, base_offset, NULL, SEEK_SET) == -1))
362 TRACE("seek error\n");
366 /* read in the CFHEADER */
367 if (!ReadFile(pSubjectInfo->hFile, buf, cfhead_SIZEOF, &dwRead, NULL) ||
368 dwRead != cfhead_SIZEOF)
370 TRACE("reading header failed\n");
374 /* check basic MSCF signature */
375 if (EndGetI32(buf+cfhead_Signature) != 0x4643534d)
377 WARN("cabinet signature not present\n");
381 /* Ignore the number of folders and files and the set and cabinet IDs */
383 /* check the header revision */
384 if ((buf[cfhead_MajorVersion] > 1) ||
385 (buf[cfhead_MajorVersion] == 1 && buf[cfhead_MinorVersion] > 3))
387 WARN("cabinet format version > 1.3\n");
391 /* pull the flags out */
392 flags = EndGetI16(buf+cfhead_Flags);
394 if (!(flags & cfheadRESERVE_PRESENT))
396 TRACE("no header present, not signed\n");
400 if (!ReadFile(pSubjectInfo->hFile, buf, cfheadext_SIZEOF, &dwRead, NULL) ||
401 dwRead != cfheadext_SIZEOF)
403 ERR("bunk reserve-sizes?\n");
407 header_resv = EndGetI16(buf+cfheadext_HeaderReserved);
410 TRACE("no header_resv, not signed\n");
413 else if (header_resv < cfsigninfo_SIZEOF)
415 TRACE("header_resv too small, not signed\n");
419 if (header_resv > 60000)
421 WARN("WARNING; header reserved space > 60000\n");
424 if (!ReadFile(pSubjectInfo->hFile, buf, cfsigninfo_SIZEOF, &dwRead, NULL) ||
425 dwRead != cfsigninfo_SIZEOF)
427 ERR("couldn't read reserve\n");
431 cert_offset = EndGetI32(buf+cfsigninfo_CertOffset);
432 TRACE("cert_offset: %d\n", cert_offset);
433 cert_size = EndGetI32(buf+cfsigninfo_CertSize);
434 TRACE("cert_size: %d\n", cert_size);
436 /* The redundant checks are to avoid wraparound */
437 if (cert_offset > cabsize || cert_size > cabsize ||
438 cert_offset + cert_size > cabsize)
440 WARN("offset beyond file, not attempting to read\n");
444 SetFilePointer(pSubjectInfo->hFile, base_offset, NULL, SEEK_SET);
445 if (!pbSignedDataMsg)
447 *pcbSignedDataMsg = cert_size;
450 if (*pcbSignedDataMsg < cert_size)
452 *pcbSignedDataMsg = cert_size;
453 SetLastError(ERROR_INSUFFICIENT_BUFFER);
456 if (SetFilePointer(pSubjectInfo->hFile, cert_offset, NULL, SEEK_SET) == -1)
458 ERR("couldn't seek to cert location\n");
461 if (!ReadFile(pSubjectInfo->hFile, pbSignedDataMsg, cert_size, &dwRead,
462 NULL) || dwRead != cert_size)
464 ERR("couldn't read cert\n");
467 /* The encoding of the files I've seen appears to be in ASN.1
468 * format, and there isn't a field indicating the type, so assume it
471 *pdwEncodingType = X509_ASN_ENCODING | PKCS_7_ASN_ENCODING;
475 static BOOL WINTRUST_GetSignedMsgFromCatFile(SIP_SUBJECTINFO *pSubjectInfo,
476 DWORD *pdwEncodingType, DWORD dwIndex, DWORD *pcbSignedDataMsg,
477 BYTE *pbSignedDataMsg)
481 TRACE("(%p %p %d %p %p)\n", pSubjectInfo, pdwEncodingType, dwIndex,
482 pcbSignedDataMsg, pbSignedDataMsg);
484 if (!pbSignedDataMsg)
486 *pcbSignedDataMsg = GetFileSize(pSubjectInfo->hFile, NULL);
491 DWORD len = GetFileSize(pSubjectInfo->hFile, NULL);
493 if (*pcbSignedDataMsg < len)
495 *pcbSignedDataMsg = len;
496 SetLastError(ERROR_INSUFFICIENT_BUFFER);
501 ret = ReadFile(pSubjectInfo->hFile, pbSignedDataMsg, len,
502 pcbSignedDataMsg, NULL);
504 *pdwEncodingType = X509_ASN_ENCODING | PKCS_7_ASN_ENCODING;
510 /***********************************************************************
511 * CryptSIPGetSignedDataMsg (WINTRUST.@)
513 BOOL WINAPI CryptSIPGetSignedDataMsg(SIP_SUBJECTINFO* pSubjectInfo, DWORD* pdwEncodingType,
514 DWORD dwIndex, DWORD* pcbSignedDataMsg, BYTE* pbSignedDataMsg)
516 static const GUID unknown = { 0xC689AAB8, 0x8E78, 0x11D0, { 0x8C,0x47,
517 0x00,0xC0,0x4F,0xC2,0x95,0xEE } };
518 static const GUID cabGUID = { 0xC689AABA, 0x8E78, 0x11D0, { 0x8C,0x47,
519 0x00,0xC0,0x4F,0xC2,0x95,0xEE } };
520 static const GUID catGUID = { 0xDE351A43, 0x8E59, 0x11D0, { 0x8C,0x47,
521 0x00,0xC0,0x4F,0xC2,0x95,0xEE }};
524 TRACE("(%p %p %d %p %p)\n", pSubjectInfo, pdwEncodingType, dwIndex,
525 pcbSignedDataMsg, pbSignedDataMsg);
527 if (!memcmp(pSubjectInfo->pgSubjectType, &unknown, sizeof(unknown)))
528 ret = WINTRUST_GetSignedMsgFromPEFile(pSubjectInfo, pdwEncodingType,
529 dwIndex, pcbSignedDataMsg, pbSignedDataMsg);
530 else if (!memcmp(pSubjectInfo->pgSubjectType, &cabGUID, sizeof(cabGUID)))
531 ret = WINTRUST_GetSignedMsgFromCabFile(pSubjectInfo, pdwEncodingType,
532 dwIndex, pcbSignedDataMsg, pbSignedDataMsg);
533 else if (!memcmp(pSubjectInfo->pgSubjectType, &catGUID, sizeof(catGUID)))
534 ret = WINTRUST_GetSignedMsgFromCatFile(pSubjectInfo, pdwEncodingType,
535 dwIndex, pcbSignedDataMsg, pbSignedDataMsg);
538 FIXME("unimplemented for subject type %s\n",
539 debugstr_guid(pSubjectInfo->pgSubjectType));
543 TRACE("returning %d\n", ret);
547 /***********************************************************************
548 * CryptSIPPutSignedDataMsg (WINTRUST.@)
550 BOOL WINAPI CryptSIPPutSignedDataMsg(SIP_SUBJECTINFO* pSubjectInfo, DWORD pdwEncodingType,
551 DWORD* pdwIndex, DWORD cbSignedDataMsg, BYTE* pbSignedDataMsg)
553 FIXME("(%p %d %p %d %p) stub\n", pSubjectInfo, pdwEncodingType, pdwIndex,
554 cbSignedDataMsg, pbSignedDataMsg);
559 /***********************************************************************
560 * CryptSIPRemoveSignedDataMsg (WINTRUST.@)
562 BOOL WINAPI CryptSIPRemoveSignedDataMsg(SIP_SUBJECTINFO* pSubjectInfo,
565 FIXME("(%p %d) stub\n", pSubjectInfo, dwIndex);
570 /***********************************************************************
571 * CryptSIPVerifyIndirectData (WINTRUST.@)
573 BOOL WINAPI CryptSIPVerifyIndirectData(SIP_SUBJECTINFO* pSubjectInfo,
574 SIP_INDIRECT_DATA* pIndirectData)
576 FIXME("(%p %p) stub\n", pSubjectInfo, pIndirectData);