gdiplus: Avoid not necessary memory allocation for BITMAPINFO.
[wine] / dlls / crypt32 / crl.c
1 /*
2  * Copyright 2006 Juan Lang
3  *
4  * This library is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * This library is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with this library; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
17  *
18  */
19
20 #include <assert.h>
21 #include <stdarg.h>
22 #define NONAMELESSUNION
23 #include "windef.h"
24 #include "winbase.h"
25 #include "wincrypt.h"
26 #include "wine/debug.h"
27 #include "wine/unicode.h"
28 #include "crypt32_private.h"
29
30 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
31
32 PCCRL_CONTEXT WINAPI CertCreateCRLContext(DWORD dwCertEncodingType,
33  const BYTE* pbCrlEncoded, DWORD cbCrlEncoded)
34 {
35     PCRL_CONTEXT crl = NULL;
36     BOOL ret;
37     PCRL_INFO crlInfo = NULL;
38     DWORD size = 0;
39
40     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCrlEncoded,
41      cbCrlEncoded);
42
43     if ((dwCertEncodingType & CERT_ENCODING_TYPE_MASK) != X509_ASN_ENCODING)
44     {
45         SetLastError(E_INVALIDARG);
46         return NULL;
47     }
48     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_CRL_TO_BE_SIGNED,
49      pbCrlEncoded, cbCrlEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
50      &crlInfo, &size);
51     if (ret)
52     {
53         BYTE *data = NULL;
54
55         crl = Context_CreateDataContext(sizeof(CRL_CONTEXT));
56         if (!crl)
57             goto end;
58         data = CryptMemAlloc(cbCrlEncoded);
59         if (!data)
60         {
61             CertFreeCRLContext(crl);
62             crl = NULL;
63             goto end;
64         }
65         memcpy(data, pbCrlEncoded, cbCrlEncoded);
66         crl->dwCertEncodingType = dwCertEncodingType;
67         crl->pbCrlEncoded       = data;
68         crl->cbCrlEncoded       = cbCrlEncoded;
69         crl->pCrlInfo           = crlInfo;
70         crl->hCertStore         = 0;
71     }
72
73 end:
74     return crl;
75 }
76
77 BOOL WINAPI CertAddEncodedCRLToStore(HCERTSTORE hCertStore,
78  DWORD dwCertEncodingType, const BYTE *pbCrlEncoded, DWORD cbCrlEncoded,
79  DWORD dwAddDisposition, PCCRL_CONTEXT *ppCrlContext)
80 {
81     PCCRL_CONTEXT crl = CertCreateCRLContext(dwCertEncodingType,
82      pbCrlEncoded, cbCrlEncoded);
83     BOOL ret;
84
85     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
86      pbCrlEncoded, cbCrlEncoded, dwAddDisposition, ppCrlContext);
87
88     if (crl)
89     {
90         ret = CertAddCRLContextToStore(hCertStore, crl, dwAddDisposition,
91          ppCrlContext);
92         CertFreeCRLContext(crl);
93     }
94     else
95         ret = FALSE;
96     return ret;
97 }
98
99 typedef BOOL (*CrlCompareFunc)(PCCRL_CONTEXT pCrlContext, DWORD dwType,
100  DWORD dwFlags, const void *pvPara);
101
102 static BOOL compare_crl_any(PCCRL_CONTEXT pCrlContext, DWORD dwType,
103  DWORD dwFlags, const void *pvPara)
104 {
105     return TRUE;
106 }
107
108 static BOOL compare_crl_issued_by(PCCRL_CONTEXT pCrlContext, DWORD dwType,
109  DWORD dwFlags, const void *pvPara)
110 {
111     BOOL ret;
112
113     if (pvPara)
114     {
115         PCCERT_CONTEXT issuer = pvPara;
116
117         ret = CertCompareCertificateName(issuer->dwCertEncodingType,
118          &issuer->pCertInfo->Subject, &pCrlContext->pCrlInfo->Issuer);
119         if (ret && (dwFlags & CRL_FIND_ISSUED_BY_SIGNATURE_FLAG))
120             ret = CryptVerifyCertificateSignatureEx(0,
121              issuer->dwCertEncodingType,
122              CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL, (void *)pCrlContext,
123              CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)issuer, 0, NULL);
124         if (ret && (dwFlags & CRL_FIND_ISSUED_BY_AKI_FLAG))
125         {
126             PCERT_EXTENSION ext = CertFindExtension(
127              szOID_AUTHORITY_KEY_IDENTIFIER2, pCrlContext->pCrlInfo->cExtension,
128              pCrlContext->pCrlInfo->rgExtension);
129
130             if (ext)
131             {
132                 CERT_AUTHORITY_KEY_ID2_INFO *info;
133                 DWORD size;
134
135                 if ((ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
136                  X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
137                  CRYPT_DECODE_ALLOC_FLAG, NULL, &info, &size)))
138                 {
139                     if (info->AuthorityCertIssuer.cAltEntry &&
140                      info->AuthorityCertSerialNumber.cbData)
141                     {
142                         PCERT_ALT_NAME_ENTRY directoryName = NULL;
143                         DWORD i;
144
145                         for (i = 0; !directoryName &&
146                          i < info->AuthorityCertIssuer.cAltEntry; i++)
147                             if (info->AuthorityCertIssuer.rgAltEntry[i].
148                              dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME)
149                                 directoryName =
150                                  &info->AuthorityCertIssuer.rgAltEntry[i];
151                         if (directoryName)
152                         {
153                             ret = CertCompareCertificateName(
154                              issuer->dwCertEncodingType,
155                              &issuer->pCertInfo->Subject,
156                              &directoryName->u.DirectoryName);
157                             if (ret)
158                                 ret = CertCompareIntegerBlob(
159                                  &issuer->pCertInfo->SerialNumber,
160                                  &info->AuthorityCertSerialNumber);
161                         }
162                         else
163                         {
164                             FIXME("no supported name type in authority key id2\n");
165                             ret = FALSE;
166                         }
167                     }
168                     else if (info->KeyId.cbData)
169                     {
170                         DWORD size;
171
172                         ret = CertGetCertificateContextProperty(issuer,
173                          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
174                         if (ret && size == info->KeyId.cbData)
175                         {
176                             LPBYTE buf = CryptMemAlloc(size);
177
178                             if (buf)
179                             {
180                                 CertGetCertificateContextProperty(issuer,
181                                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
182                                 ret = !memcmp(buf, info->KeyId.pbData, size);
183                                 CryptMemFree(buf);
184                             }
185                             else
186                                 ret = FALSE;
187                         }
188                         else
189                             ret = FALSE;
190                     }
191                     else
192                     {
193                         FIXME("unsupported value for AKI extension\n");
194                         ret = FALSE;
195                     }
196                     LocalFree(info);
197                 }
198             }
199             /* else: a CRL without an AKI matches any cert */
200         }
201     }
202     else
203         ret = TRUE;
204     return ret;
205 }
206
207 static BOOL compare_crl_existing(PCCRL_CONTEXT pCrlContext, DWORD dwType,
208  DWORD dwFlags, const void *pvPara)
209 {
210     BOOL ret;
211
212     if (pvPara)
213     {
214         PCCRL_CONTEXT crl = pvPara;
215
216         ret = CertCompareCertificateName(pCrlContext->dwCertEncodingType,
217          &pCrlContext->pCrlInfo->Issuer, &crl->pCrlInfo->Issuer);
218     }
219     else
220         ret = TRUE;
221     return ret;
222 }
223
224 static BOOL compare_crl_issued_for(PCCRL_CONTEXT pCrlContext, DWORD dwType,
225  DWORD dwFlags, const void *pvPara)
226 {
227     const CRL_FIND_ISSUED_FOR_PARA *para = pvPara;
228     BOOL ret;
229
230     ret = CertCompareCertificateName(para->pIssuerCert->dwCertEncodingType,
231      &para->pIssuerCert->pCertInfo->Issuer, &pCrlContext->pCrlInfo->Issuer);
232     return ret;
233 }
234
235 PCCRL_CONTEXT WINAPI CertFindCRLInStore(HCERTSTORE hCertStore,
236  DWORD dwCertEncodingType, DWORD dwFindFlags, DWORD dwFindType,
237  const void *pvFindPara, PCCRL_CONTEXT pPrevCrlContext)
238 {
239     PCCRL_CONTEXT ret;
240     CrlCompareFunc compare;
241
242     TRACE("(%p, %d, %d, %d, %p, %p)\n", hCertStore, dwCertEncodingType,
243          dwFindFlags, dwFindType, pvFindPara, pPrevCrlContext);
244
245     switch (dwFindType)
246     {
247     case CRL_FIND_ANY:
248         compare = compare_crl_any;
249         break;
250     case CRL_FIND_ISSUED_BY:
251         compare = compare_crl_issued_by;
252         break;
253     case CRL_FIND_EXISTING:
254         compare = compare_crl_existing;
255         break;
256     case CRL_FIND_ISSUED_FOR:
257         compare = compare_crl_issued_for;
258         break;
259     default:
260         FIXME("find type %08x unimplemented\n", dwFindType);
261         compare = NULL;
262     }
263
264     if (compare)
265     {
266         BOOL matches = FALSE;
267
268         ret = pPrevCrlContext;
269         do {
270             ret = CertEnumCRLsInStore(hCertStore, ret);
271             if (ret)
272                 matches = compare(ret, dwFindType, dwFindFlags, pvFindPara);
273         } while (ret != NULL && !matches);
274         if (!ret)
275             SetLastError(CRYPT_E_NOT_FOUND);
276     }
277     else
278     {
279         SetLastError(CRYPT_E_NOT_FOUND);
280         ret = NULL;
281     }
282     return ret;
283 }
284
285 PCCRL_CONTEXT WINAPI CertGetCRLFromStore(HCERTSTORE hCertStore,
286  PCCERT_CONTEXT pIssuerContext, PCCRL_CONTEXT pPrevCrlContext, DWORD *pdwFlags)
287 {
288     static const DWORD supportedFlags = CERT_STORE_SIGNATURE_FLAG |
289      CERT_STORE_TIME_VALIDITY_FLAG | CERT_STORE_BASE_CRL_FLAG |
290      CERT_STORE_DELTA_CRL_FLAG;
291     PCCRL_CONTEXT ret;
292
293     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pIssuerContext, pPrevCrlContext,
294      *pdwFlags);
295
296     if (*pdwFlags & ~supportedFlags)
297     {
298         SetLastError(E_INVALIDARG);
299         return NULL;
300     }
301     if (pIssuerContext)
302         ret = CertFindCRLInStore(hCertStore, pIssuerContext->dwCertEncodingType,
303          0, CRL_FIND_ISSUED_BY, pIssuerContext, pPrevCrlContext);
304     else
305         ret = CertFindCRLInStore(hCertStore, 0, 0, CRL_FIND_ANY, NULL,
306          pPrevCrlContext);
307     if (ret)
308     {
309         if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
310         {
311             if (0 == CertVerifyCRLTimeValidity(NULL, ret->pCrlInfo))
312                 *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
313         }
314         if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
315         {
316             if (CryptVerifyCertificateSignatureEx(0, ret->dwCertEncodingType,
317              CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL, (void *)ret,
318              CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuerContext, 0,
319              NULL))
320                 *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
321         }
322     }
323     return ret;
324 }
325
326 PCCRL_CONTEXT WINAPI CertDuplicateCRLContext(PCCRL_CONTEXT pCrlContext)
327 {
328     TRACE("(%p)\n", pCrlContext);
329     if (pCrlContext)
330         Context_AddRef((void *)pCrlContext, sizeof(CRL_CONTEXT));
331     return pCrlContext;
332 }
333
334 static void CrlDataContext_Free(void *context)
335 {
336     PCRL_CONTEXT crlContext = context;
337
338     CryptMemFree(crlContext->pbCrlEncoded);
339     LocalFree(crlContext->pCrlInfo);
340 }
341
342 BOOL WINAPI CertFreeCRLContext( PCCRL_CONTEXT pCrlContext)
343 {
344     BOOL ret = TRUE;
345
346     TRACE("(%p)\n", pCrlContext);
347
348     if (pCrlContext)
349         ret = Context_Release((void *)pCrlContext, sizeof(CRL_CONTEXT),
350          CrlDataContext_Free);
351     return ret;
352 }
353
354 DWORD WINAPI CertEnumCRLContextProperties(PCCRL_CONTEXT pCRLContext,
355  DWORD dwPropId)
356 {
357     PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
358      pCRLContext, sizeof(CRL_CONTEXT));
359     DWORD ret;
360
361     TRACE("(%p, %d)\n", pCRLContext, dwPropId);
362
363     if (properties)
364         ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
365     else
366         ret = 0;
367     return ret;
368 }
369
370 static BOOL CRLContext_SetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
371                                    DWORD dwFlags, const void *pvData);
372
373 static BOOL CRLContext_GetHashProp(PCCRL_CONTEXT context, DWORD dwPropId,
374  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
375  DWORD *pcbData)
376 {
377     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
378      pcbData);
379     if (ret && pvData)
380     {
381         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
382
383         ret = CRLContext_SetProperty(context, dwPropId, 0, &blob);
384     }
385     return ret;
386 }
387
388 static BOOL CRLContext_GetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
389                                    void *pvData, DWORD *pcbData)
390 {
391     PCONTEXT_PROPERTY_LIST properties =
392      Context_GetProperties(context, sizeof(CRL_CONTEXT));
393     BOOL ret;
394     CRYPT_DATA_BLOB blob;
395
396     TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
397
398     if (properties)
399         ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
400     else
401         ret = FALSE;
402     if (ret)
403     {
404         if (!pvData)
405             *pcbData = blob.cbData;
406         else if (*pcbData < blob.cbData)
407         {
408             SetLastError(ERROR_MORE_DATA);
409             *pcbData = blob.cbData;
410             ret = FALSE;
411         }
412         else
413         {
414             memcpy(pvData, blob.pbData, blob.cbData);
415             *pcbData = blob.cbData;
416         }
417     }
418     else
419     {
420         /* Implicit properties */
421         switch (dwPropId)
422         {
423         case CERT_SHA1_HASH_PROP_ID:
424             ret = CRLContext_GetHashProp(context, dwPropId, CALG_SHA1,
425                                          context->pbCrlEncoded, context->cbCrlEncoded, pvData,
426              pcbData);
427             break;
428         case CERT_MD5_HASH_PROP_ID:
429             ret = CRLContext_GetHashProp(context, dwPropId, CALG_MD5,
430                                          context->pbCrlEncoded, context->cbCrlEncoded, pvData,
431              pcbData);
432             break;
433         default:
434             SetLastError(CRYPT_E_NOT_FOUND);
435         }
436     }
437     TRACE("returning %d\n", ret);
438     return ret;
439 }
440
441 BOOL WINAPI CertGetCRLContextProperty(PCCRL_CONTEXT pCRLContext,
442  DWORD dwPropId, void *pvData, DWORD *pcbData)
443 {
444     BOOL ret;
445
446     TRACE("(%p, %d, %p, %p)\n", pCRLContext, dwPropId, pvData, pcbData);
447
448     switch (dwPropId)
449     {
450     case 0:
451     case CERT_CERT_PROP_ID:
452     case CERT_CRL_PROP_ID:
453     case CERT_CTL_PROP_ID:
454         SetLastError(E_INVALIDARG);
455         ret = FALSE;
456         break;
457     case CERT_ACCESS_STATE_PROP_ID:
458         if (!pvData)
459         {
460             *pcbData = sizeof(DWORD);
461             ret = TRUE;
462         }
463         else if (*pcbData < sizeof(DWORD))
464         {
465             SetLastError(ERROR_MORE_DATA);
466             *pcbData = sizeof(DWORD);
467             ret = FALSE;
468         }
469         else
470         {
471             if (pCRLContext->hCertStore)
472                 ret = CertGetStoreProperty(pCRLContext->hCertStore, dwPropId,
473                  pvData, pcbData);
474             else
475             {
476                 *(DWORD *)pvData = 0;
477                 ret = TRUE;
478             }
479         }
480         break;
481     default:
482         ret = CRLContext_GetProperty(pCRLContext, dwPropId, pvData,
483          pcbData);
484     }
485     return ret;
486 }
487
488 static BOOL CRLContext_SetProperty(PCCRL_CONTEXT context, DWORD dwPropId,
489  DWORD dwFlags, const void *pvData)
490 {
491     PCONTEXT_PROPERTY_LIST properties =
492      Context_GetProperties(context, sizeof(CRL_CONTEXT));
493     BOOL ret;
494
495     TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
496
497     if (!properties)
498         ret = FALSE;
499     else if (!pvData)
500     {
501         ContextPropertyList_RemoveProperty(properties, dwPropId);
502         ret = TRUE;
503     }
504     else
505     {
506         switch (dwPropId)
507         {
508         case CERT_AUTO_ENROLL_PROP_ID:
509         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
510         case CERT_DESCRIPTION_PROP_ID:
511         case CERT_FRIENDLY_NAME_PROP_ID:
512         case CERT_HASH_PROP_ID:
513         case CERT_KEY_IDENTIFIER_PROP_ID:
514         case CERT_MD5_HASH_PROP_ID:
515         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
516         case CERT_PUBKEY_ALG_PARA_PROP_ID:
517         case CERT_PVK_FILE_PROP_ID:
518         case CERT_SIGNATURE_HASH_PROP_ID:
519         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
520         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
521         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
522         case CERT_ENROLLMENT_PROP_ID:
523         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
524         case CERT_RENEWAL_PROP_ID:
525         {
526             PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvData;
527
528             ret = ContextPropertyList_SetProperty(properties, dwPropId,
529              blob->pbData, blob->cbData);
530             break;
531         }
532         case CERT_DATE_STAMP_PROP_ID:
533             ret = ContextPropertyList_SetProperty(properties, dwPropId,
534              pvData, sizeof(FILETIME));
535             break;
536         default:
537             FIXME("%d: stub\n", dwPropId);
538             ret = FALSE;
539         }
540     }
541     TRACE("returning %d\n", ret);
542     return ret;
543 }
544
545 BOOL WINAPI CertSetCRLContextProperty(PCCRL_CONTEXT pCRLContext,
546  DWORD dwPropId, DWORD dwFlags, const void *pvData)
547 {
548     BOOL ret;
549
550     TRACE("(%p, %d, %08x, %p)\n", pCRLContext, dwPropId, dwFlags, pvData);
551
552     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
553      * crashes on most of these, I'll be safer.
554      */
555     switch (dwPropId)
556     {
557     case 0:
558     case CERT_ACCESS_STATE_PROP_ID:
559     case CERT_CERT_PROP_ID:
560     case CERT_CRL_PROP_ID:
561     case CERT_CTL_PROP_ID:
562         SetLastError(E_INVALIDARG);
563         return FALSE;
564     }
565     ret = CRLContext_SetProperty(pCRLContext, dwPropId, dwFlags, pvData);
566     TRACE("returning %d\n", ret);
567     return ret;
568 }
569
570 static BOOL compare_dist_point_name(const CRL_DIST_POINT_NAME *name1,
571  const CRL_DIST_POINT_NAME *name2)
572 {
573     BOOL match;
574
575     if (name1->dwDistPointNameChoice == name2->dwDistPointNameChoice)
576     {
577         match = TRUE;
578         if (name1->dwDistPointNameChoice == CRL_DIST_POINT_FULL_NAME)
579         {
580             if (name1->u.FullName.cAltEntry == name2->u.FullName.cAltEntry)
581             {
582                 DWORD i;
583
584                 for (i = 0; match && i < name1->u.FullName.cAltEntry; i++)
585                 {
586                     const CERT_ALT_NAME_ENTRY *entry1 =
587                      &name1->u.FullName.rgAltEntry[i];
588                     const CERT_ALT_NAME_ENTRY *entry2 =
589                      &name2->u.FullName.rgAltEntry[i];
590
591                     if (entry1->dwAltNameChoice == entry2->dwAltNameChoice)
592                     {
593                         switch (entry1->dwAltNameChoice)
594                         {
595                         case CERT_ALT_NAME_URL:
596                             match = !strcmpiW(entry1->u.pwszURL,
597                              entry2->u.pwszURL);
598                             break;
599                         case CERT_ALT_NAME_DIRECTORY_NAME:
600                             match = (entry1->u.DirectoryName.cbData ==
601                              entry2->u.DirectoryName.cbData) &&
602                              !memcmp(entry1->u.DirectoryName.pbData,
603                              entry2->u.DirectoryName.pbData,
604                              entry1->u.DirectoryName.cbData);
605                             break;
606                         default:
607                             FIXME("unimplemented for type %d\n",
608                              entry1->dwAltNameChoice);
609                             match = FALSE;
610                         }
611                     }
612                     else
613                         match = FALSE;
614                 }
615             }
616             else
617                 match = FALSE;
618         }
619     }
620     else
621         match = FALSE;
622     return match;
623 }
624
625 static BOOL match_dist_point_with_issuing_dist_point(
626  const CRL_DIST_POINT *distPoint, const CRL_ISSUING_DIST_POINT *idp)
627 {
628     BOOL match;
629
630     /* While RFC 5280, section 4.2.1.13 recommends against segmenting
631      * CRL distribution points by reasons, it doesn't preclude doing so.
632      * "This profile RECOMMENDS against segmenting CRLs by reason code."
633      * If the issuing distribution point for this CRL is only valid for
634      * some reasons, only match if the reasons covered also match the
635      * reasons in the CRL distribution point.
636      */
637     if (idp->OnlySomeReasonFlags.cbData)
638     {
639         if (idp->OnlySomeReasonFlags.cbData == distPoint->ReasonFlags.cbData)
640         {
641             DWORD i;
642
643             match = TRUE;
644             for (i = 0; match && i < distPoint->ReasonFlags.cbData; i++)
645                 if (idp->OnlySomeReasonFlags.pbData[i] !=
646                  distPoint->ReasonFlags.pbData[i])
647                     match = FALSE;
648         }
649         else
650             match = FALSE;
651     }
652     else
653         match = TRUE;
654     if (match)
655         match = compare_dist_point_name(&idp->DistPointName,
656          &distPoint->DistPointName);
657     return match;
658 }
659
660 BOOL WINAPI CertIsValidCRLForCertificate(PCCERT_CONTEXT pCert,
661  PCCRL_CONTEXT pCrl, DWORD dwFlags, void *pvReserved)
662 {
663     PCERT_EXTENSION ext;
664     BOOL ret;
665
666     TRACE("(%p, %p, %08x, %p)\n", pCert, pCrl, dwFlags, pvReserved);
667
668     if (!pCert)
669         return TRUE;
670
671     if ((ext = CertFindExtension(szOID_ISSUING_DIST_POINT,
672      pCrl->pCrlInfo->cExtension, pCrl->pCrlInfo->rgExtension)))
673     {
674         CRL_ISSUING_DIST_POINT *idp;
675         DWORD size;
676
677         if ((ret = CryptDecodeObjectEx(pCrl->dwCertEncodingType,
678          X509_ISSUING_DIST_POINT, ext->Value.pbData, ext->Value.cbData,
679          CRYPT_DECODE_ALLOC_FLAG, NULL, &idp, &size)))
680         {
681             if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
682              pCert->pCertInfo->cExtension, pCert->pCertInfo->rgExtension)))
683             {
684                 CRL_DIST_POINTS_INFO *distPoints;
685
686                 if ((ret = CryptDecodeObjectEx(pCert->dwCertEncodingType,
687                  X509_CRL_DIST_POINTS, ext->Value.pbData, ext->Value.cbData,
688                  CRYPT_DECODE_ALLOC_FLAG, NULL, &distPoints, &size)))
689                 {
690                     DWORD i;
691
692                     ret = FALSE;
693                     for (i = 0; !ret && i < distPoints->cDistPoint; i++)
694                         ret = match_dist_point_with_issuing_dist_point(
695                          &distPoints->rgDistPoint[i], idp);
696                     if (!ret)
697                         SetLastError(CRYPT_E_NO_MATCH);
698                     LocalFree(distPoints);
699                 }
700             }
701             else
702             {
703                 /* no CRL dist points extension in cert, can't match the CRL
704                  * (which has an issuing dist point extension)
705                  */
706                 ret = FALSE;
707                 SetLastError(CRYPT_E_NO_MATCH);
708             }
709             LocalFree(idp);
710         }
711     }
712     else
713         ret = TRUE;
714     return ret;
715 }
716
717 static PCRL_ENTRY CRYPT_FindCertificateInCRL(PCERT_INFO cert, const CRL_INFO *crl)
718 {
719     DWORD i;
720     PCRL_ENTRY entry = NULL;
721
722     for (i = 0; !entry && i < crl->cCRLEntry; i++)
723         if (CertCompareIntegerBlob(&crl->rgCRLEntry[i].SerialNumber,
724          &cert->SerialNumber))
725             entry = &crl->rgCRLEntry[i];
726     return entry;
727 }
728
729 BOOL WINAPI CertFindCertificateInCRL(PCCERT_CONTEXT pCert,
730  PCCRL_CONTEXT pCrlContext, DWORD dwFlags, void *pvReserved,
731  PCRL_ENTRY *ppCrlEntry)
732 {
733     TRACE("(%p, %p, %08x, %p, %p)\n", pCert, pCrlContext, dwFlags, pvReserved,
734      ppCrlEntry);
735
736     *ppCrlEntry = CRYPT_FindCertificateInCRL(pCert->pCertInfo,
737      pCrlContext->pCrlInfo);
738     return TRUE;
739 }
740
741 BOOL WINAPI CertVerifyCRLRevocation(DWORD dwCertEncodingType,
742  PCERT_INFO pCertId, DWORD cCrlInfo, PCRL_INFO rgpCrlInfo[])
743 {
744     DWORD i;
745     PCRL_ENTRY entry = NULL;
746
747     TRACE("(%08x, %p, %d, %p)\n", dwCertEncodingType, pCertId, cCrlInfo,
748      rgpCrlInfo);
749
750     for (i = 0; !entry && i < cCrlInfo; i++)
751         entry = CRYPT_FindCertificateInCRL(pCertId, rgpCrlInfo[i]);
752     return entry == NULL;
753 }
754
755 LONG WINAPI CertVerifyCRLTimeValidity(LPFILETIME pTimeToVerify,
756  PCRL_INFO pCrlInfo)
757 {
758     FILETIME fileTime;
759     LONG ret;
760
761     if (!pTimeToVerify)
762     {
763         GetSystemTimeAsFileTime(&fileTime);
764         pTimeToVerify = &fileTime;
765     }
766     if ((ret = CompareFileTime(pTimeToVerify, &pCrlInfo->ThisUpdate)) >= 0)
767     {
768         ret = CompareFileTime(pTimeToVerify, &pCrlInfo->NextUpdate);
769         if (ret < 0)
770             ret = 0;
771     }
772     return ret;
773 }