2 * Copyright 2006 Juan Lang
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
22 #define NONAMELESSUNION
26 #include "wine/debug.h"
27 #include "wine/unicode.h"
28 #include "crypt32_private.h"
30 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
32 PCCRL_CONTEXT WINAPI CertCreateCRLContext(DWORD dwCertEncodingType,
33 const BYTE* pbCrlEncoded, DWORD cbCrlEncoded)
35 PCRL_CONTEXT crl = NULL;
37 PCRL_INFO crlInfo = NULL;
40 TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCrlEncoded,
43 if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
45 SetLastError(E_INVALIDARG);
48 ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_CRL_TO_BE_SIGNED,
49 pbCrlEncoded, cbCrlEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
55 crl = Context_CreateDataContext(sizeof(CRL_CONTEXT));
58 data = CryptMemAlloc(cbCrlEncoded);
61 CertFreeCRLContext(crl);
65 memcpy(data, pbCrlEncoded, cbCrlEncoded);
66 crl->dwCertEncodingType = dwCertEncodingType;
67 crl->pbCrlEncoded = data;
68 crl->cbCrlEncoded = cbCrlEncoded;
69 crl->pCrlInfo = crlInfo;
77 BOOL WINAPI CertAddEncodedCRLToStore(HCERTSTORE hCertStore,
78 DWORD dwCertEncodingType, const BYTE *pbCrlEncoded, DWORD cbCrlEncoded,
79 DWORD dwAddDisposition, PCCRL_CONTEXT *ppCrlContext)
81 PCCRL_CONTEXT crl = CertCreateCRLContext(dwCertEncodingType,
82 pbCrlEncoded, cbCrlEncoded);
85 TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
86 pbCrlEncoded, cbCrlEncoded, dwAddDisposition, ppCrlContext);
90 ret = CertAddCRLContextToStore(hCertStore, crl, dwAddDisposition,
92 CertFreeCRLContext(crl);
99 typedef BOOL (*CrlCompareFunc)(PCCRL_CONTEXT pCrlContext, DWORD dwType,
100 DWORD dwFlags, const void *pvPara);
102 static BOOL compare_crl_any(PCCRL_CONTEXT pCrlContext, DWORD dwType,
103 DWORD dwFlags, const void *pvPara)
108 static BOOL compare_crl_issued_by(PCCRL_CONTEXT pCrlContext, DWORD dwType,
109 DWORD dwFlags, const void *pvPara)
115 PCCERT_CONTEXT issuer = pvPara;
117 ret = CertCompareCertificateName(issuer->dwCertEncodingType,
118 &issuer->pCertInfo->Subject, &pCrlContext->pCrlInfo->Issuer);
119 if (ret && (dwFlags & CRL_FIND_ISSUED_BY_SIGNATURE_FLAG))
120 ret = CryptVerifyCertificateSignatureEx(0,
121 issuer->dwCertEncodingType,
122 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL, (void *)pCrlContext,
123 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)issuer, 0, NULL);
124 if (ret && (dwFlags & CRL_FIND_ISSUED_BY_AKI_FLAG))
126 PCERT_EXTENSION ext = CertFindExtension(
127 szOID_AUTHORITY_KEY_IDENTIFIER2, pCrlContext->pCrlInfo->cExtension,
128 pCrlContext->pCrlInfo->rgExtension);
132 CERT_AUTHORITY_KEY_ID2_INFO *info;
135 if ((ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
136 X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
137 CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size)))
139 if (info->AuthorityCertIssuer.cAltEntry &&
140 info->AuthorityCertSerialNumber.cbData)
142 PCERT_ALT_NAME_ENTRY directoryName = NULL;
145 for (i = 0; !directoryName &&
146 i < info->AuthorityCertIssuer.cAltEntry; i++)
147 if (info->AuthorityCertIssuer.rgAltEntry[i].
148 dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME)
150 &info->AuthorityCertIssuer.rgAltEntry[i];
153 ret = CertCompareCertificateName(
154 issuer->dwCertEncodingType,
155 &issuer->pCertInfo->Subject,
156 &directoryName->u.DirectoryName);
158 ret = CertCompareIntegerBlob(
159 &issuer->pCertInfo->SerialNumber,
160 &info->AuthorityCertSerialNumber);
164 FIXME("no supported name type in authority key id2\n");
168 else if (info->KeyId.cbData)
172 ret = CertGetCertificateContextProperty(issuer,
173 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
174 if (ret && size == info->KeyId.cbData)
176 LPBYTE buf = CryptMemAlloc(size);
180 CertGetCertificateContextProperty(issuer,
181 CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
182 ret = !memcmp(buf, info->KeyId.pbData, size);
193 FIXME("unsupported value for AKI extension\n");
199 /* else: a CRL without an AKI matches any cert */
207 static BOOL compare_crl_existing(PCCRL_CONTEXT pCrlContext, DWORD dwType,
208 DWORD dwFlags, const void *pvPara)
214 PCCRL_CONTEXT crl = pvPara;
216 ret = CertCompareCertificateName(pCrlContext->dwCertEncodingType,
217 &pCrlContext->pCrlInfo->Issuer, &crl->pCrlInfo->Issuer);
224 static BOOL compare_crl_issued_for(PCCRL_CONTEXT pCrlContext, DWORD dwType,
225 DWORD dwFlags, const void *pvPara)
227 const CRL_FIND_ISSUED_FOR_PARA *para = pvPara;
230 ret = CertCompareCertificateName(para->pIssuerCert->dwCertEncodingType,
231 ¶->pIssuerCert->pCertInfo->Issuer, &pCrlContext->pCrlInfo->Issuer);
235 PCCRL_CONTEXT WINAPI CertFindCRLInStore(HCERTSTORE hCertStore,
236 DWORD dwCertEncodingType, DWORD dwFindFlags, DWORD dwFindType,
237 const void *pvFindPara, PCCRL_CONTEXT pPrevCrlContext)
240 CrlCompareFunc compare;
242 TRACE("(%p, %d, %d, %d, %p, %p)\n", hCertStore, dwCertEncodingType,
243 dwFindFlags, dwFindType, pvFindPara, pPrevCrlContext);
248 compare = compare_crl_any;
250 case CRL_FIND_ISSUED_BY:
251 compare = compare_crl_issued_by;
253 case CRL_FIND_EXISTING:
254 compare = compare_crl_existing;
256 case CRL_FIND_ISSUED_FOR:
257 compare = compare_crl_issued_for;
260 FIXME("find type %08x unimplemented\n", dwFindType);
266 BOOL matches = FALSE;
268 ret = pPrevCrlContext;
270 ret = CertEnumCRLsInStore(hCertStore, ret);
272 matches = compare(ret, dwFindType, dwFindFlags, pvFindPara);
273 } while (ret != NULL && !matches);
275 SetLastError(CRYPT_E_NOT_FOUND);
279 SetLastError(CRYPT_E_NOT_FOUND);
285 PCCRL_CONTEXT WINAPI CertGetCRLFromStore(HCERTSTORE hCertStore,
286 PCCERT_CONTEXT pIssuerContext, PCCRL_CONTEXT pPrevCrlContext, DWORD *pdwFlags)
288 static const DWORD supportedFlags = CERT_STORE_SIGNATURE_FLAG |
289 CERT_STORE_TIME_VALIDITY_FLAG | CERT_STORE_BASE_CRL_FLAG |
290 CERT_STORE_DELTA_CRL_FLAG;
293 TRACE("(%p, %p, %p, %08x)\n", hCertStore, pIssuerContext, pPrevCrlContext,
296 if (*pdwFlags & ~supportedFlags)
298 SetLastError(E_INVALIDARG);
302 ret = CertFindCRLInStore(hCertStore, pIssuerContext->dwCertEncodingType,
303 0, CRL_FIND_ISSUED_BY, pIssuerContext, pPrevCrlContext);
305 ret = CertFindCRLInStore(hCertStore, 0, 0, CRL_FIND_ANY, NULL,
309 if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
311 if (0 == CertVerifyCRLTimeValidity(NULL, ret->pCrlInfo))
312 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
314 if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
316 if (CryptVerifyCertificateSignatureEx(0, ret->dwCertEncodingType,
317 CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL, (void *)ret,
318 CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuerContext, 0,
320 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
326 PCCRL_CONTEXT WINAPI CertDuplicateCRLContext(PCCRL_CONTEXT pCrlContext)
328 TRACE("(%p)\n", pCrlContext);
330 Context_AddRef((void *)pCrlContext, sizeof(CRL_CONTEXT));
334 static void CrlDataContext_Free(void *context)
336 PCRL_CONTEXT crlContext = context;
338 CryptMemFree(crlContext->pbCrlEncoded);
339 LocalFree(crlContext->pCrlInfo);
342 BOOL WINAPI CertFreeCRLContext( PCCRL_CONTEXT pCrlContext)
346 TRACE("(%p)\n", pCrlContext);
349 ret = Context_Release((void *)pCrlContext, sizeof(CRL_CONTEXT),
350 CrlDataContext_Free);
354 DWORD WINAPI CertEnumCRLContextProperties(PCCRL_CONTEXT pCRLContext,
357 PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
358 pCRLContext, sizeof(CRL_CONTEXT));
361 TRACE("(%p, %d)\n", pCRLContext, dwPropId);
364 ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
370 static BOOL CRLContext_SetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
371 DWORD dwFlags, const void *pvData);
373 static BOOL CRLContext_GetHashProp(PCCRL_CONTEXT context, DWORD dwPropId,
374 ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
377 BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
381 CRYPT_DATA_BLOB blob = { *pcbData, pvData };
383 ret = CRLContext_SetProperty(context, dwPropId, 0, &blob);
388 static BOOL CRLContext_GetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
389 void *pvData, DWORD *pcbData)
391 PCONTEXT_PROPERTY_LIST properties =
392 Context_GetProperties(context, sizeof(CRL_CONTEXT));
394 CRYPT_DATA_BLOB blob;
396 TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
399 ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
405 *pcbData = blob.cbData;
406 else if (*pcbData < blob.cbData)
408 SetLastError(ERROR_MORE_DATA);
409 *pcbData = blob.cbData;
414 memcpy(pvData, blob.pbData, blob.cbData);
415 *pcbData = blob.cbData;
420 /* Implicit properties */
423 case CERT_SHA1_HASH_PROP_ID:
424 ret = CRLContext_GetHashProp(context, dwPropId, CALG_SHA1,
425 context->pbCrlEncoded, context->cbCrlEncoded, pvData,
428 case CERT_MD5_HASH_PROP_ID:
429 ret = CRLContext_GetHashProp(context, dwPropId, CALG_MD5,
430 context->pbCrlEncoded, context->cbCrlEncoded, pvData,
434 SetLastError(CRYPT_E_NOT_FOUND);
437 TRACE("returning %d\n", ret);
441 BOOL WINAPI CertGetCRLContextProperty(PCCRL_CONTEXT pCRLContext,
442 DWORD dwPropId, void *pvData, DWORD *pcbData)
446 TRACE("(%p, %d, %p, %p)\n", pCRLContext, dwPropId, pvData, pcbData);
451 case CERT_CERT_PROP_ID:
452 case CERT_CRL_PROP_ID:
453 case CERT_CTL_PROP_ID:
454 SetLastError(E_INVALIDARG);
457 case CERT_ACCESS_STATE_PROP_ID:
460 *pcbData = sizeof(DWORD);
463 else if (*pcbData < sizeof(DWORD))
465 SetLastError(ERROR_MORE_DATA);
466 *pcbData = sizeof(DWORD);
471 if (pCRLContext->hCertStore)
472 ret = CertGetStoreProperty(pCRLContext->hCertStore, dwPropId,
476 *(DWORD *)pvData = 0;
482 ret = CRLContext_GetProperty(pCRLContext, dwPropId, pvData,
488 static BOOL CRLContext_SetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
489 DWORD dwFlags, const void *pvData)
491 PCONTEXT_PROPERTY_LIST properties =
492 Context_GetProperties(context, sizeof(CRL_CONTEXT));
495 TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
501 ContextPropertyList_RemoveProperty(properties, dwPropId);
508 case CERT_AUTO_ENROLL_PROP_ID:
509 case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
510 case CERT_DESCRIPTION_PROP_ID:
511 case CERT_FRIENDLY_NAME_PROP_ID:
512 case CERT_HASH_PROP_ID:
513 case CERT_KEY_IDENTIFIER_PROP_ID:
514 case CERT_MD5_HASH_PROP_ID:
515 case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
516 case CERT_PUBKEY_ALG_PARA_PROP_ID:
517 case CERT_PVK_FILE_PROP_ID:
518 case CERT_SIGNATURE_HASH_PROP_ID:
519 case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
520 case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
521 case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
522 case CERT_ENROLLMENT_PROP_ID:
523 case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
524 case CERT_RENEWAL_PROP_ID:
526 PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvData;
528 ret = ContextPropertyList_SetProperty(properties, dwPropId,
529 blob->pbData, blob->cbData);
532 case CERT_DATE_STAMP_PROP_ID:
533 ret = ContextPropertyList_SetProperty(properties, dwPropId,
534 pvData, sizeof(FILETIME));
537 FIXME("%d: stub\n", dwPropId);
541 TRACE("returning %d\n", ret);
545 BOOL WINAPI CertSetCRLContextProperty(PCCRL_CONTEXT pCRLContext,
546 DWORD dwPropId, DWORD dwFlags, const void *pvData)
550 TRACE("(%p, %d, %08x, %p)\n", pCRLContext, dwPropId, dwFlags, pvData);
552 /* Handle special cases for "read-only"/invalid prop IDs. Windows just
553 * crashes on most of these, I'll be safer.
558 case CERT_ACCESS_STATE_PROP_ID:
559 case CERT_CERT_PROP_ID:
560 case CERT_CRL_PROP_ID:
561 case CERT_CTL_PROP_ID:
562 SetLastError(E_INVALIDARG);
565 ret = CRLContext_SetProperty(pCRLContext, dwPropId, dwFlags, pvData);
566 TRACE("returning %d\n", ret);
570 static BOOL compare_dist_point_name(const CRL_DIST_POINT_NAME *name1,
571 const CRL_DIST_POINT_NAME *name2)
575 if (name1->dwDistPointNameChoice == name2->dwDistPointNameChoice)
578 if (name1->dwDistPointNameChoice == CRL_DIST_POINT_FULL_NAME)
580 if (name1->u.FullName.cAltEntry == name2->u.FullName.cAltEntry)
584 for (i = 0; match && i < name1->u.FullName.cAltEntry; i++)
586 const CERT_ALT_NAME_ENTRY *entry1 =
587 &name1->u.FullName.rgAltEntry[i];
588 const CERT_ALT_NAME_ENTRY *entry2 =
589 &name2->u.FullName.rgAltEntry[i];
591 if (entry1->dwAltNameChoice == entry2->dwAltNameChoice)
593 switch (entry1->dwAltNameChoice)
595 case CERT_ALT_NAME_URL:
596 match = !strcmpiW(entry1->u.pwszURL,
599 case CERT_ALT_NAME_DIRECTORY_NAME:
600 match = (entry1->u.DirectoryName.cbData ==
601 entry2->u.DirectoryName.cbData) &&
602 !memcmp(entry1->u.DirectoryName.pbData,
603 entry2->u.DirectoryName.pbData,
604 entry1->u.DirectoryName.cbData);
607 FIXME("unimplemented for type %d\n",
608 entry1->dwAltNameChoice);
625 static BOOL match_dist_point_with_issuing_dist_point(
626 const CRL_DIST_POINT *distPoint, const CRL_ISSUING_DIST_POINT *idp)
630 /* While RFC 5280, section 4.2.1.13 recommends against segmenting
631 * CRL distribution points by reasons, it doesn't preclude doing so.
632 * "This profile RECOMMENDS against segmenting CRLs by reason code."
633 * If the issuing distribution point for this CRL is only valid for
634 * some reasons, only match if the reasons covered also match the
635 * reasons in the CRL distribution point.
637 if (idp->OnlySomeReasonFlags.cbData)
639 if (idp->OnlySomeReasonFlags.cbData == distPoint->ReasonFlags.cbData)
644 for (i = 0; match && i < distPoint->ReasonFlags.cbData; i++)
645 if (idp->OnlySomeReasonFlags.pbData[i] !=
646 distPoint->ReasonFlags.pbData[i])
655 match = compare_dist_point_name(&idp->DistPointName,
656 &distPoint->DistPointName);
660 BOOL WINAPI CertIsValidCRLForCertificate(PCCERT_CONTEXT pCert,
661 PCCRL_CONTEXT pCrl, DWORD dwFlags, void *pvReserved)
666 TRACE("(%p, %p, %08x, %p)\n", pCert, pCrl, dwFlags, pvReserved);
671 if ((ext = CertFindExtension(szOID_ISSUING_DIST_POINT,
672 pCrl->pCrlInfo->cExtension, pCrl->pCrlInfo->rgExtension)))
674 CRL_ISSUING_DIST_POINT *idp;
677 if ((ret = CryptDecodeObjectEx(pCrl->dwCertEncodingType,
678 X509_ISSUING_DIST_POINT, ext->Value.pbData, ext->Value.cbData,
679 CRYPT_DECODE_ALLOC_FLAG, NULL, &idp, &size)))
681 if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
682 pCert->pCertInfo->cExtension, pCert->pCertInfo->rgExtension)))
684 CRL_DIST_POINTS_INFO *distPoints;
686 if ((ret = CryptDecodeObjectEx(pCert->dwCertEncodingType,
687 X509_CRL_DIST_POINTS, ext->Value.pbData, ext->Value.cbData,
688 CRYPT_DECODE_ALLOC_FLAG, NULL, &distPoints, &size)))
693 for (i = 0; !ret && i < distPoints->cDistPoint; i++)
694 ret = match_dist_point_with_issuing_dist_point(
695 &distPoints->rgDistPoint[i], idp);
697 SetLastError(CRYPT_E_NO_MATCH);
698 LocalFree(distPoints);
703 /* no CRL dist points extension in cert, can't match the CRL
704 * (which has an issuing dist point extension)
707 SetLastError(CRYPT_E_NO_MATCH);
717 static PCRL_ENTRY CRYPT_FindCertificateInCRL(PCERT_INFO cert, const CRL_INFO *crl)
720 PCRL_ENTRY entry = NULL;
722 for (i = 0; !entry && i < crl->cCRLEntry; i++)
723 if (CertCompareIntegerBlob(&crl->rgCRLEntry[i].SerialNumber,
724 &cert->SerialNumber))
725 entry = &crl->rgCRLEntry[i];
729 BOOL WINAPI CertFindCertificateInCRL(PCCERT_CONTEXT pCert,
730 PCCRL_CONTEXT pCrlContext, DWORD dwFlags, void *pvReserved,
731 PCRL_ENTRY *ppCrlEntry)
733 TRACE("(%p, %p, %08x, %p, %p)\n", pCert, pCrlContext, dwFlags, pvReserved,
736 *ppCrlEntry = CRYPT_FindCertificateInCRL(pCert->pCertInfo,
737 pCrlContext->pCrlInfo);
741 BOOL WINAPI CertVerifyCRLRevocation(DWORD dwCertEncodingType,
742 PCERT_INFO pCertId, DWORD cCrlInfo, PCRL_INFO rgpCrlInfo[])
745 PCRL_ENTRY entry = NULL;
747 TRACE("(%08x, %p, %d, %p)\n", dwCertEncodingType, pCertId, cCrlInfo,
750 for (i = 0; !entry && i < cCrlInfo; i++)
751 entry = CRYPT_FindCertificateInCRL(pCertId, rgpCrlInfo[i]);
752 return entry == NULL;
755 LONG WINAPI CertVerifyCRLTimeValidity(LPFILETIME pTimeToVerify,
763 GetSystemTimeAsFileTime(&fileTime);
764 pTimeToVerify = &fileTime;
766 if ((ret = CompareFileTime(pTimeToVerify, &pCrlInfo->ThisUpdate)) >= 0)
768 ret = CompareFileTime(pTimeToVerify, &pCrlInfo->NextUpdate);