git.oblomov.eu Git - wine/blob - dlls/crypt32/cert.c

   1 /*
   2  * Copyright 2004-2006 Juan Lang
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  *
  18  */
  19
  20 #include <assert.h>
  21 #include <stdarg.h>
  22
  23 #define NONAMELESSUNION
  24 #include "windef.h"
  25 #include "winbase.h"
  26 #include "wincrypt.h"
  27 #include "winnls.h"
  28 #include "rpc.h"
  29 #include "wine/debug.h"
  30 #include "crypt32_private.h"
  31
  32 WINE_DEFAULT_DEBUG_CHANNEL(crypt);
  33
  34 /* Internal version of CertGetCertificateContextProperty that gets properties
  35  * directly from the context (or the context it's linked to, depending on its
  36  * type.) Doesn't handle special-case properties, since they are handled by
  37  * CertGetCertificateContextProperty, and are particular to the store in which
  38  * the property exists (which is separate from the context.)
  39  */
  40 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
  41  void *pvData, DWORD *pcbData);
  42
  43 /* Internal version of CertSetCertificateContextProperty that sets properties
  44  * directly on the context (or the context it's linked to, depending on its
  45  * type.) Doesn't handle special cases, since they're handled by
  46  * CertSetCertificateContextProperty anyway.
  47  */
  48 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
  49  DWORD dwFlags, const void *pvData);
  50
  51 BOOL WINAPI CertAddEncodedCertificateToStore(HCERTSTORE hCertStore,
  52  DWORD dwCertEncodingType, const BYTE *pbCertEncoded, DWORD cbCertEncoded,
  53  DWORD dwAddDisposition, PCCERT_CONTEXT *ppCertContext)
  54 {
  55     PCCERT_CONTEXT cert = CertCreateCertificateContext(dwCertEncodingType,
  56      pbCertEncoded, cbCertEncoded);
  57     BOOL ret;
  58
  59     TRACE("(%p, %08x, %p, %d, %08x, %p)\n", hCertStore, dwCertEncodingType,
  60      pbCertEncoded, cbCertEncoded, dwAddDisposition, ppCertContext);
  61
  62     if (cert)
  63     {
  64         ret = CertAddCertificateContextToStore(hCertStore, cert,
  65          dwAddDisposition, ppCertContext);
  66         CertFreeCertificateContext(cert);
  67     }
  68     else
  69         ret = FALSE;
  70     return ret;
  71 }
  72
  73 PCCERT_CONTEXT WINAPI CertCreateCertificateContext(DWORD dwCertEncodingType,
  74  const BYTE *pbCertEncoded, DWORD cbCertEncoded)
  75 {
  76     PCERT_CONTEXT cert = NULL;
  77     BOOL ret;
  78     PCERT_INFO certInfo = NULL;
  79     DWORD size = 0;
  80
  81     TRACE("(%08x, %p, %d)\n", dwCertEncodingType, pbCertEncoded,
  82      cbCertEncoded);
  83
  84     ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT_TO_BE_SIGNED,
  85      pbCertEncoded, cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, NULL,
  86      (BYTE *)&certInfo, &size);
  87     if (ret)
  88     {
  89         BYTE *data = NULL;
  90
  91         cert = (PCERT_CONTEXT)Context_CreateDataContext(sizeof(CERT_CONTEXT));
  92         if (!cert)
  93             goto end;
  94         data = CryptMemAlloc(cbCertEncoded);
  95         if (!data)
  96         {
  97             CryptMemFree(cert);
  98             cert = NULL;
  99             goto end;
 100         }
 101         memcpy(data, pbCertEncoded, cbCertEncoded);
 102         cert->dwCertEncodingType = dwCertEncodingType;
 103         cert->pbCertEncoded      = data;
 104         cert->cbCertEncoded      = cbCertEncoded;
 105         cert->pCertInfo          = certInfo;
 106         cert->hCertStore         = 0;
 107     }
 108
 109 end:
 110     return (PCCERT_CONTEXT)cert;
 111 }
 112
 113 PCCERT_CONTEXT WINAPI CertDuplicateCertificateContext(
 114  PCCERT_CONTEXT pCertContext)
 115 {
 116     TRACE("(%p)\n", pCertContext);
 117     Context_AddRef((void *)pCertContext, sizeof(CERT_CONTEXT));
 118     return pCertContext;
 119 }
 120
 121 static void CertDataContext_Free(void *context)
 122 {
 123     PCERT_CONTEXT certContext = (PCERT_CONTEXT)context;
 124
 125     CryptMemFree(certContext->pbCertEncoded);
 126     LocalFree(certContext->pCertInfo);
 127 }
 128
 129 BOOL WINAPI CertFreeCertificateContext(PCCERT_CONTEXT pCertContext)
 130 {
 131     TRACE("(%p)\n", pCertContext);
 132
 133     if (pCertContext)
 134         Context_Release((void *)pCertContext, sizeof(CERT_CONTEXT),
 135          CertDataContext_Free);
 136     return TRUE;
 137 }
 138
 139 DWORD WINAPI CertEnumCertificateContextProperties(PCCERT_CONTEXT pCertContext,
 140  DWORD dwPropId)
 141 {
 142     PCONTEXT_PROPERTY_LIST properties = Context_GetProperties(
 143      (void *)pCertContext, sizeof(CERT_CONTEXT));
 144     DWORD ret;
 145
 146     TRACE("(%p, %d)\n", pCertContext, dwPropId);
 147
 148     if (properties)
 149         ret = ContextPropertyList_EnumPropIDs(properties, dwPropId);
 150     else
 151         ret = 0;
 152     return ret;
 153 }
 154
 155 static BOOL CertContext_GetHashProp(void *context, DWORD dwPropId,
 156  ALG_ID algID, const BYTE *toHash, DWORD toHashLen, void *pvData,
 157  DWORD *pcbData)
 158 {
 159     BOOL ret = CryptHashCertificate(0, algID, 0, toHash, toHashLen, pvData,
 160      pcbData);
 161     if (ret && pvData)
 162     {
 163         CRYPT_DATA_BLOB blob = { *pcbData, pvData };
 164
 165         ret = CertContext_SetProperty(context, dwPropId, 0, &blob);
 166     }
 167     return ret;
 168 }
 169
 170 static BOOL CertContext_CopyParam(void *pvData, DWORD *pcbData, const void *pb,
 171  DWORD cb)
 172 {
 173     BOOL ret = TRUE;
 174
 175     if (!pvData)
 176         *pcbData = cb;
 177     else if (*pcbData < cb)
 178     {
 179         SetLastError(ERROR_MORE_DATA);
 180         *pcbData = cb;
 181         ret = FALSE;
 182     }
 183     else
 184     {
 185         memcpy(pvData, pb, cb);
 186         *pcbData = cb;
 187     }
 188     return ret;
 189 }
 190
 191 static BOOL WINAPI CertContext_GetProperty(void *context, DWORD dwPropId,
 192  void *pvData, DWORD *pcbData)
 193 {
 194     PCCERT_CONTEXT pCertContext = (PCCERT_CONTEXT)context;
 195     PCONTEXT_PROPERTY_LIST properties =
 196      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 197     BOOL ret;
 198     CRYPT_DATA_BLOB blob;
 199
 200     TRACE("(%p, %d, %p, %p)\n", context, dwPropId, pvData, pcbData);
 201
 202     if (properties)
 203         ret = ContextPropertyList_FindProperty(properties, dwPropId, &blob);
 204     else
 205         ret = FALSE;
 206     if (ret)
 207         ret = CertContext_CopyParam(pvData, pcbData, blob.pbData, blob.cbData);
 208     else
 209     {
 210         /* Implicit properties */
 211         switch (dwPropId)
 212         {
 213         case CERT_SHA1_HASH_PROP_ID:
 214             ret = CertContext_GetHashProp(context, dwPropId, CALG_SHA1,
 215              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 216              pcbData);
 217             break;
 218         case CERT_MD5_HASH_PROP_ID:
 219             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 220              pCertContext->pbCertEncoded, pCertContext->cbCertEncoded, pvData,
 221              pcbData);
 222             break;
 223         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 224             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 225              pCertContext->pCertInfo->Subject.pbData,
 226              pCertContext->pCertInfo->Subject.cbData,
 227              pvData, pcbData);
 228             break;
 229         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 230             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 231              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
 232              pCertContext->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
 233              pvData, pcbData);
 234             break;
 235         case CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID:
 236             ret = CertContext_GetHashProp(context, dwPropId, CALG_MD5,
 237              pCertContext->pCertInfo->SerialNumber.pbData,
 238              pCertContext->pCertInfo->SerialNumber.cbData,
 239              pvData, pcbData);
 240             break;
 241         case CERT_SIGNATURE_HASH_PROP_ID:
 242             FIXME("CERT_SIGNATURE_HASH_PROP_ID unimplemented\n");
 243             SetLastError(CRYPT_E_NOT_FOUND);
 244             break;
 245         case CERT_KEY_IDENTIFIER_PROP_ID:
 246         {
 247             PCERT_EXTENSION ext = CertFindExtension(
 248              szOID_SUBJECT_KEY_IDENTIFIER, pCertContext->pCertInfo->cExtension,
 249              pCertContext->pCertInfo->rgExtension);
 250
 251             if (ext)
 252             {
 253                 CRYPT_DATA_BLOB value;
 254                 DWORD size;
 255
 256                 ret = CryptDecodeObjectEx(X509_ASN_ENCODING,
 257                  szOID_SUBJECT_KEY_IDENTIFIER, ext->Value.pbData,
 258                  ext->Value.cbData, CRYPT_DECODE_NOCOPY_FLAG, NULL, &value,
 259                  &size);
 260                 if (ret)
 261                 {
 262                     ret = CertContext_CopyParam(pvData, pcbData, value.pbData,
 263                      value.cbData);
 264                     CertContext_SetProperty(context, dwPropId, 0, &value);
 265                 }
 266             }
 267             else
 268                 SetLastError(ERROR_INVALID_DATA);
 269             break;
 270         }
 271         default:
 272             SetLastError(CRYPT_E_NOT_FOUND);
 273         }
 274     }
 275     TRACE("returning %d\n", ret);
 276     return ret;
 277 }
 278
 279 void CRYPT_FixKeyProvInfoPointers(PCRYPT_KEY_PROV_INFO info)
 280 {
 281     DWORD i, containerLen, provNameLen;
 282     LPBYTE data = (LPBYTE)info + sizeof(CRYPT_KEY_PROV_INFO);
 283
 284     info->pwszContainerName = (LPWSTR)data;
 285     containerLen = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 286     data += containerLen;
 287
 288     info->pwszProvName = (LPWSTR)data;
 289     provNameLen = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 290     data += provNameLen;
 291
 292     info->rgProvParam = (PCRYPT_KEY_PROV_PARAM)data;
 293     data += info->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 294
 295     for (i = 0; i < info->cProvParam; i++)
 296     {
 297         info->rgProvParam[i].pbData = data;
 298         data += info->rgProvParam[i].cbData;
 299     }
 300 }
 301
 302 BOOL WINAPI CertGetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 303  DWORD dwPropId, void *pvData, DWORD *pcbData)
 304 {
 305     BOOL ret;
 306
 307     TRACE("(%p, %d, %p, %p)\n", pCertContext, dwPropId, pvData, pcbData);
 308
 309     switch (dwPropId)
 310     {
 311     case 0:
 312     case CERT_CERT_PROP_ID:
 313     case CERT_CRL_PROP_ID:
 314     case CERT_CTL_PROP_ID:
 315         SetLastError(E_INVALIDARG);
 316         ret = FALSE;
 317         break;
 318     case CERT_ACCESS_STATE_PROP_ID:
 319         if (pCertContext->hCertStore)
 320             ret = CertGetStoreProperty(pCertContext->hCertStore, dwPropId,
 321              pvData, pcbData);
 322         else
 323         {
 324             DWORD state = 0;
 325
 326             ret = CertContext_CopyParam(pvData, pcbData, &state, sizeof(state));
 327         }
 328         break;
 329     case CERT_KEY_PROV_HANDLE_PROP_ID:
 330     {
 331         CERT_KEY_CONTEXT keyContext;
 332         DWORD size = sizeof(keyContext);
 333
 334         ret = CertContext_GetProperty((void *)pCertContext,
 335          CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
 336         if (ret)
 337             ret = CertContext_CopyParam(pvData, pcbData, &keyContext.hCryptProv,
 338              sizeof(keyContext.hCryptProv));
 339         break;
 340     }
 341     case CERT_KEY_PROV_INFO_PROP_ID:
 342         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 343          pcbData);
 344         if (ret && pvData)
 345             CRYPT_FixKeyProvInfoPointers((PCRYPT_KEY_PROV_INFO)pvData);
 346         break;
 347     default:
 348         ret = CertContext_GetProperty((void *)pCertContext, dwPropId, pvData,
 349          pcbData);
 350     }
 351
 352     TRACE("returning %d\n", ret);
 353     return ret;
 354 }
 355
 356 /* Copies key provider info from from into to, where to is assumed to be a
 357  * contiguous buffer of memory large enough for from and all its associated
 358  * data, but whose pointers are uninitialized.
 359  * Upon return, to contains a contiguous copy of from, packed in the following
 360  * order:
 361  * - CRYPT_KEY_PROV_INFO
 362  * - pwszContainerName
 363  * - pwszProvName
 364  * - rgProvParam[0]...
 365  */
 366 static void CRYPT_CopyKeyProvInfo(PCRYPT_KEY_PROV_INFO to,
 367  const CRYPT_KEY_PROV_INFO *from)
 368 {
 369     DWORD i;
 370     LPBYTE nextData = (LPBYTE)to + sizeof(CRYPT_KEY_PROV_INFO);
 371
 372     if (from->pwszContainerName)
 373     {
 374         to->pwszContainerName = (LPWSTR)nextData;
 375         lstrcpyW(to->pwszContainerName, from->pwszContainerName);
 376         nextData += (lstrlenW(from->pwszContainerName) + 1) * sizeof(WCHAR);
 377     }
 378     else
 379         to->pwszContainerName = NULL;
 380     if (from->pwszProvName)
 381     {
 382         to->pwszProvName = (LPWSTR)nextData;
 383         lstrcpyW(to->pwszProvName, from->pwszProvName);
 384         nextData += (lstrlenW(from->pwszProvName) + 1) * sizeof(WCHAR);
 385     }
 386     else
 387         to->pwszProvName = NULL;
 388     to->dwProvType = from->dwProvType;
 389     to->dwFlags = from->dwFlags;
 390     to->cProvParam = from->cProvParam;
 391     to->rgProvParam = (PCRYPT_KEY_PROV_PARAM)nextData;
 392     nextData += to->cProvParam * sizeof(CRYPT_KEY_PROV_PARAM);
 393     to->dwKeySpec = from->dwKeySpec;
 394     for (i = 0; i < to->cProvParam; i++)
 395     {
 396         memcpy(&to->rgProvParam[i], &from->rgProvParam[i],
 397          sizeof(CRYPT_KEY_PROV_PARAM));
 398         to->rgProvParam[i].pbData = nextData;
 399         memcpy(to->rgProvParam[i].pbData, from->rgProvParam[i].pbData,
 400          from->rgProvParam[i].cbData);
 401         nextData += from->rgProvParam[i].cbData;
 402     }
 403 }
 404
 405 static BOOL CertContext_SetKeyProvInfoProperty(PCONTEXT_PROPERTY_LIST properties,
 406  const CRYPT_KEY_PROV_INFO *info)
 407 {
 408     BOOL ret;
 409     LPBYTE buf = NULL;
 410     DWORD size = sizeof(CRYPT_KEY_PROV_INFO), i, containerSize, provNameSize;
 411
 412     if (info->pwszContainerName)
 413         containerSize = (lstrlenW(info->pwszContainerName) + 1) * sizeof(WCHAR);
 414     else
 415         containerSize = 0;
 416     if (info->pwszProvName)
 417         provNameSize = (lstrlenW(info->pwszProvName) + 1) * sizeof(WCHAR);
 418     else
 419         provNameSize = 0;
 420     size += containerSize + provNameSize;
 421     for (i = 0; i < info->cProvParam; i++)
 422         size += sizeof(CRYPT_KEY_PROV_PARAM) + info->rgProvParam[i].cbData;
 423     buf = CryptMemAlloc(size);
 424     if (buf)
 425     {
 426         CRYPT_CopyKeyProvInfo((PCRYPT_KEY_PROV_INFO)buf, info);
 427         ret = ContextPropertyList_SetProperty(properties,
 428          CERT_KEY_PROV_INFO_PROP_ID, buf, size);
 429         CryptMemFree(buf);
 430     }
 431     else
 432         ret = FALSE;
 433     return ret;
 434 }
 435
 436 static BOOL WINAPI CertContext_SetProperty(void *context, DWORD dwPropId,
 437  DWORD dwFlags, const void *pvData)
 438 {
 439     PCONTEXT_PROPERTY_LIST properties =
 440      Context_GetProperties(context, sizeof(CERT_CONTEXT));
 441     BOOL ret;
 442
 443     TRACE("(%p, %d, %08x, %p)\n", context, dwPropId, dwFlags, pvData);
 444
 445     if (!properties)
 446         ret = FALSE;
 447     else
 448     {
 449         switch (dwPropId)
 450         {
 451         case CERT_AUTO_ENROLL_PROP_ID:
 452         case CERT_CTL_USAGE_PROP_ID: /* same as CERT_ENHKEY_USAGE_PROP_ID */
 453         case CERT_DESCRIPTION_PROP_ID:
 454         case CERT_FRIENDLY_NAME_PROP_ID:
 455         case CERT_HASH_PROP_ID:
 456         case CERT_KEY_IDENTIFIER_PROP_ID:
 457         case CERT_MD5_HASH_PROP_ID:
 458         case CERT_NEXT_UPDATE_LOCATION_PROP_ID:
 459         case CERT_PUBKEY_ALG_PARA_PROP_ID:
 460         case CERT_PVK_FILE_PROP_ID:
 461         case CERT_SIGNATURE_HASH_PROP_ID:
 462         case CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID:
 463         case CERT_SUBJECT_NAME_MD5_HASH_PROP_ID:
 464         case CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID:
 465         case CERT_ENROLLMENT_PROP_ID:
 466         case CERT_CROSS_CERT_DIST_POINTS_PROP_ID:
 467         case CERT_RENEWAL_PROP_ID:
 468         {
 469             if (pvData)
 470             {
 471                 const CRYPT_DATA_BLOB *blob = (const CRYPT_DATA_BLOB *)pvData;
 472
 473                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 474                  blob->pbData, blob->cbData);
 475             }
 476             else
 477             {
 478                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 479                 ret = TRUE;
 480             }
 481             break;
 482         }
 483         case CERT_DATE_STAMP_PROP_ID:
 484             if (pvData)
 485                 ret = ContextPropertyList_SetProperty(properties, dwPropId,
 486                  (const BYTE *)pvData, sizeof(FILETIME));
 487             else
 488             {
 489                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 490                 ret = TRUE;
 491             }
 492             break;
 493         case CERT_KEY_CONTEXT_PROP_ID:
 494         {
 495             if (pvData)
 496             {
 497                 const CERT_KEY_CONTEXT *keyContext = (const CERT_KEY_CONTEXT *)pvData;
 498
 499                 if (keyContext->cbSize != sizeof(CERT_KEY_CONTEXT))
 500                 {
 501                     SetLastError(E_INVALIDARG);
 502                     ret = FALSE;
 503                 }
 504                 else
 505                     ret = ContextPropertyList_SetProperty(properties, dwPropId,
 506                      (const BYTE *)keyContext, keyContext->cbSize);
 507             }
 508             else
 509             {
 510                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 511                 ret = TRUE;
 512             }
 513             break;
 514         }
 515         case CERT_KEY_PROV_INFO_PROP_ID:
 516             if (pvData)
 517                 ret = CertContext_SetKeyProvInfoProperty(properties,
 518                  (const CRYPT_KEY_PROV_INFO *)pvData);
 519             else
 520             {
 521                 ContextPropertyList_RemoveProperty(properties, dwPropId);
 522                 ret = TRUE;
 523             }
 524             break;
 525         case CERT_KEY_PROV_HANDLE_PROP_ID:
 526         {
 527             CERT_KEY_CONTEXT keyContext;
 528             DWORD size = sizeof(keyContext);
 529
 530             ret = CertContext_GetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 531              &keyContext, &size);
 532             if (ret)
 533             {
 534                 if (!(dwFlags & CERT_STORE_NO_CRYPT_RELEASE_FLAG))
 535                     CryptReleaseContext(keyContext.hCryptProv, 0);
 536                 if (pvData)
 537                     keyContext.hCryptProv = *(const HCRYPTPROV *)pvData;
 538                 else
 539                     keyContext.hCryptProv = 0;
 540                 ret = CertContext_SetProperty(context, CERT_KEY_CONTEXT_PROP_ID,
 541                  0, &keyContext);
 542             }
 543             break;
 544         }
 545         default:
 546             FIXME("%d: stub\n", dwPropId);
 547             ret = FALSE;
 548         }
 549     }
 550     TRACE("returning %d\n", ret);
 551     return ret;
 552 }
 553
 554 BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext,
 555  DWORD dwPropId, DWORD dwFlags, const void *pvData)
 556 {
 557     BOOL ret;
 558
 559     TRACE("(%p, %d, %08x, %p)\n", pCertContext, dwPropId, dwFlags, pvData);
 560
 561     /* Handle special cases for "read-only"/invalid prop IDs.  Windows just
 562      * crashes on most of these, I'll be safer.
 563      */
 564     switch (dwPropId)
 565     {
 566     case 0:
 567     case CERT_ACCESS_STATE_PROP_ID:
 568     case CERT_CERT_PROP_ID:
 569     case CERT_CRL_PROP_ID:
 570     case CERT_CTL_PROP_ID:
 571         SetLastError(E_INVALIDARG);
 572         return FALSE;
 573     }
 574     ret = CertContext_SetProperty((void *)pCertContext, dwPropId, dwFlags,
 575      pvData);
 576     TRACE("returning %d\n", ret);
 577     return ret;
 578 }
 579
 580 /* Acquires the private key using the key provider info, retrieving info from
 581  * the certificate if info is NULL.  The acquired provider is returned in
 582  * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec.
 583  */
 584 static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert,
 585  PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec)
 586 {
 587     DWORD size = 0;
 588     BOOL allocated = FALSE, ret = TRUE;
 589
 590     if (!info)
 591     {
 592         ret = CertGetCertificateContextProperty(pCert,
 593          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 594         if (ret)
 595         {
 596             info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(GetProcessHeap(), 0, size);
 597             if (info)
 598             {
 599                 ret = CertGetCertificateContextProperty(pCert,
 600                  CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 601                 allocated = TRUE;
 602             }
 603         }
 604         else
 605             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 606     }
 607     if (ret)
 608     {
 609         ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName,
 610          info->pwszProvName, info->dwProvType, 0);
 611         if (ret)
 612         {
 613             DWORD i;
 614
 615             for (i = 0; i < info->cProvParam; i++)
 616             {
 617                 CryptSetProvParam(*phCryptProv,
 618                  info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData,
 619                  info->rgProvParam[i].dwFlags);
 620             }
 621             *pdwKeySpec = info->dwKeySpec;
 622         }
 623         else
 624             SetLastError(CRYPT_E_NO_KEY_PROPERTY);
 625     }
 626     if (allocated)
 627         HeapFree(GetProcessHeap(), 0, info);
 628     return ret;
 629 }
 630
 631 BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert,
 632  DWORD dwFlags, void *pvReserved, HCRYPTPROV_OR_NCRYPT_KEY_HANDLE *phCryptProv,
 633  DWORD *pdwKeySpec, BOOL *pfCallerFreeProv)
 634 {
 635     BOOL ret = FALSE, cache = FALSE;
 636     PCRYPT_KEY_PROV_INFO info = NULL;
 637     CERT_KEY_CONTEXT keyContext;
 638     DWORD size;
 639
 640     TRACE("(%p, %08x, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved,
 641      phCryptProv, pdwKeySpec, pfCallerFreeProv);
 642
 643     if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG)
 644     {
 645         DWORD size = 0;
 646
 647         ret = CertGetCertificateContextProperty(pCert,
 648          CERT_KEY_PROV_INFO_PROP_ID, 0, &size);
 649         if (ret)
 650         {
 651             info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(
 652              GetProcessHeap(), 0, size);
 653             ret = CertGetCertificateContextProperty(pCert,
 654              CERT_KEY_PROV_INFO_PROP_ID, info, &size);
 655             if (ret)
 656                 cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID;
 657         }
 658     }
 659     else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG)
 660         cache = TRUE;
 661     *phCryptProv = 0;
 662     if (cache)
 663     {
 664         size = sizeof(keyContext);
 665         ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID,
 666          &keyContext, &size);
 667         if (ret)
 668         {
 669             *phCryptProv = keyContext.hCryptProv;
 670             if (pdwKeySpec)
 671                 *pdwKeySpec = keyContext.dwKeySpec;
 672             if (pfCallerFreeProv)
 673                 *pfCallerFreeProv = !cache;
 674         }
 675     }
 676     if (!*phCryptProv)
 677     {
 678         ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info,
 679          &keyContext.hCryptProv, &keyContext.dwKeySpec);
 680         if (ret)
 681         {
 682             *phCryptProv = keyContext.hCryptProv;
 683             if (pdwKeySpec)
 684                 *pdwKeySpec = keyContext.dwKeySpec;
 685             if (cache)
 686             {
 687                 keyContext.cbSize = sizeof(keyContext);
 688                 if (CertSetCertificateContextProperty(pCert,
 689                  CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext))
 690                 {
 691                     if (pfCallerFreeProv)
 692                         *pfCallerFreeProv = FALSE;
 693                 }
 694             }
 695             else
 696             {
 697                 if (pfCallerFreeProv)
 698                     *pfCallerFreeProv = TRUE;
 699             }
 700         }
 701     }
 702     HeapFree(GetProcessHeap(), 0, info);
 703     return ret;
 704 }
 705
 706 BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType,
 707  PCERT_INFO pCertId1, PCERT_INFO pCertId2)
 708 {
 709     BOOL ret;
 710
 711     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertId1, pCertId2);
 712
 713     ret = CertCompareCertificateName(dwCertEncodingType, &pCertId1->Issuer,
 714      &pCertId2->Issuer) && CertCompareIntegerBlob(&pCertId1->SerialNumber,
 715      &pCertId2->SerialNumber);
 716     TRACE("returning %d\n", ret);
 717     return ret;
 718 }
 719
 720 BOOL WINAPI CertCompareCertificateName(DWORD dwCertEncodingType,
 721  PCERT_NAME_BLOB pCertName1, PCERT_NAME_BLOB pCertName2)
 722 {
 723     BOOL ret;
 724
 725     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pCertName1, pCertName2);
 726
 727     if (pCertName1->cbData == pCertName2->cbData)
 728     {
 729         if (pCertName1->cbData)
 730             ret = !memcmp(pCertName1->pbData, pCertName2->pbData,
 731              pCertName1->cbData);
 732         else
 733             ret = TRUE;
 734     }
 735     else
 736         ret = FALSE;
 737     TRACE("returning %d\n", ret);
 738     return ret;
 739 }
 740
 741 /* Returns the number of significant bytes in pInt, where a byte is
 742  * insignificant if it's a leading 0 for positive numbers or a leading 0xff
 743  * for negative numbers.  pInt is assumed to be little-endian.
 744  */
 745 static DWORD CRYPT_significantBytes(const CRYPT_INTEGER_BLOB *pInt)
 746 {
 747     DWORD ret = pInt->cbData;
 748
 749     while (ret > 1)
 750     {
 751         if (pInt->pbData[ret - 2] <= 0x7f && pInt->pbData[ret - 1] == 0)
 752             ret--;
 753         else if (pInt->pbData[ret - 2] >= 0x80 && pInt->pbData[ret - 1] == 0xff)
 754             ret--;
 755         else
 756             break;
 757     }
 758     return ret;
 759 }
 760
 761 BOOL WINAPI CertCompareIntegerBlob(PCRYPT_INTEGER_BLOB pInt1,
 762  PCRYPT_INTEGER_BLOB pInt2)
 763 {
 764     BOOL ret;
 765     DWORD cb1, cb2;
 766
 767     TRACE("(%p, %p)\n", pInt1, pInt2);
 768
 769     cb1 = CRYPT_significantBytes(pInt1);
 770     cb2 = CRYPT_significantBytes(pInt2);
 771     if (cb1 == cb2)
 772     {
 773         if (cb1)
 774             ret = !memcmp(pInt1->pbData, pInt2->pbData, cb1);
 775         else
 776             ret = TRUE;
 777     }
 778     else
 779         ret = FALSE;
 780     TRACE("returning %d\n", ret);
 781     return ret;
 782 }
 783
 784 BOOL WINAPI CertComparePublicKeyInfo(DWORD dwCertEncodingType,
 785  PCERT_PUBLIC_KEY_INFO pPublicKey1, PCERT_PUBLIC_KEY_INFO pPublicKey2)
 786 {
 787     BOOL ret;
 788
 789     TRACE("(%08x, %p, %p)\n", dwCertEncodingType, pPublicKey1, pPublicKey2);
 790
 791     if (pPublicKey1->PublicKey.cbData == pPublicKey2->PublicKey.cbData &&
 792      pPublicKey1->PublicKey.cUnusedBits == pPublicKey2->PublicKey.cUnusedBits)
 793     {
 794         if (pPublicKey2->PublicKey.cbData)
 795             ret = !memcmp(pPublicKey1->PublicKey.pbData,
 796              pPublicKey2->PublicKey.pbData, pPublicKey1->PublicKey.cbData);
 797         else
 798             ret = TRUE;
 799     }
 800     else
 801         ret = FALSE;
 802     return ret;
 803 }
 804
 805 DWORD WINAPI CertGetPublicKeyLength(DWORD dwCertEncodingType,
 806  PCERT_PUBLIC_KEY_INFO pPublicKey)
 807 {
 808     DWORD len = 0;
 809
 810     TRACE("(%08x, %p)\n", dwCertEncodingType, pPublicKey);
 811
 812     if (dwCertEncodingType != X509_ASN_ENCODING)
 813     {
 814         SetLastError(ERROR_FILE_NOT_FOUND);
 815         return 0;
 816     }
 817     if (pPublicKey->Algorithm.pszObjId &&
 818      !strcmp(pPublicKey->Algorithm.pszObjId, szOID_RSA_DH))
 819     {
 820         FIXME("unimplemented for DH public keys\n");
 821         SetLastError(CRYPT_E_ASN1_BADTAG);
 822     }
 823     else
 824     {
 825         DWORD size;
 826         PBYTE buf;
 827         BOOL ret = CryptDecodeObjectEx(dwCertEncodingType,
 828          RSA_CSP_PUBLICKEYBLOB, pPublicKey->PublicKey.pbData,
 829          pPublicKey->PublicKey.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
 830          &size);
 831
 832         if (ret)
 833         {
 834             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)((LPBYTE)buf +
 835              sizeof(BLOBHEADER));
 836
 837             len = rsaPubKey->bitlen;
 838             LocalFree(buf);
 839         }
 840     }
 841     return len;
 842 }
 843
 844 typedef BOOL (*CertCompareFunc)(PCCERT_CONTEXT pCertContext, DWORD dwType,
 845  DWORD dwFlags, const void *pvPara);
 846
 847 static BOOL compare_cert_any(PCCERT_CONTEXT pCertContext, DWORD dwType,
 848  DWORD dwFlags, const void *pvPara)
 849 {
 850     return TRUE;
 851 }
 852
 853 static BOOL compare_cert_by_md5_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
 854  DWORD dwFlags, const void *pvPara)
 855 {
 856     BOOL ret;
 857     BYTE hash[16];
 858     DWORD size = sizeof(hash);
 859
 860     ret = CertGetCertificateContextProperty(pCertContext,
 861      CERT_MD5_HASH_PROP_ID, hash, &size);
 862     if (ret)
 863     {
 864         const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
 865
 866         if (size == pHash->cbData)
 867             ret = !memcmp(pHash->pbData, hash, size);
 868         else
 869             ret = FALSE;
 870     }
 871     return ret;
 872 }
 873
 874 static BOOL compare_cert_by_sha1_hash(PCCERT_CONTEXT pCertContext, DWORD dwType,
 875  DWORD dwFlags, const void *pvPara)
 876 {
 877     BOOL ret;
 878     BYTE hash[20];
 879     DWORD size = sizeof(hash);
 880
 881     ret = CertGetCertificateContextProperty(pCertContext,
 882      CERT_SHA1_HASH_PROP_ID, hash, &size);
 883     if (ret)
 884     {
 885         const CRYPT_HASH_BLOB *pHash = (const CRYPT_HASH_BLOB *)pvPara;
 886
 887         if (size == pHash->cbData)
 888             ret = !memcmp(pHash->pbData, hash, size);
 889         else
 890             ret = FALSE;
 891     }
 892     return ret;
 893 }
 894
 895 static BOOL compare_cert_by_name(PCCERT_CONTEXT pCertContext, DWORD dwType,
 896  DWORD dwFlags, const void *pvPara)
 897 {
 898     CERT_NAME_BLOB *blob = (CERT_NAME_BLOB *)pvPara, *toCompare;
 899     BOOL ret;
 900
 901     if (dwType & CERT_INFO_SUBJECT_FLAG)
 902         toCompare = &pCertContext->pCertInfo->Subject;
 903     else
 904         toCompare = &pCertContext->pCertInfo->Issuer;
 905     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
 906      toCompare, blob);
 907     return ret;
 908 }
 909
 910 static BOOL compare_cert_by_subject_cert(PCCERT_CONTEXT pCertContext,
 911  DWORD dwType, DWORD dwFlags, const void *pvPara)
 912 {
 913     CERT_INFO *pCertInfo = (CERT_INFO *)pvPara;
 914     BOOL ret;
 915
 916     /* Matching serial number and subject match.. */
 917     ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
 918      &pCertInfo->Issuer, &pCertContext->pCertInfo->Subject);
 919     if (ret)
 920         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
 921          &pCertInfo->SerialNumber);
 922     else
 923     {
 924         /* failing that, if the serial number and issuer match, we match */
 925         ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
 926          &pCertInfo->SerialNumber);
 927         if (ret)
 928             ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
 929              &pCertInfo->Issuer, &pCertContext->pCertInfo->Issuer);
 930     }
 931     TRACE("returning %d\n", ret);
 932     return ret;
 933 }
 934
 935 static BOOL compare_cert_by_cert_id(PCCERT_CONTEXT pCertContext, DWORD dwType,
 936  DWORD dwFlags, const void *pvPara)
 937 {
 938     CERT_ID *id = (CERT_ID *)pvPara;
 939     BOOL ret;
 940
 941     switch (id->dwIdChoice)
 942     {
 943     case CERT_ID_ISSUER_SERIAL_NUMBER:
 944         ret = CertCompareCertificateName(pCertContext->dwCertEncodingType,
 945          &pCertContext->pCertInfo->Issuer, &id->u.IssuerSerialNumber.Issuer);
 946         if (ret)
 947             ret = CertCompareIntegerBlob(&pCertContext->pCertInfo->SerialNumber,
 948              &id->u.IssuerSerialNumber.SerialNumber);
 949         break;
 950     case CERT_ID_SHA1_HASH:
 951         ret = compare_cert_by_sha1_hash(pCertContext, dwType, dwFlags,
 952          &id->u.HashId);
 953         break;
 954     case CERT_ID_KEY_IDENTIFIER:
 955     {
 956         DWORD size = 0;
 957
 958         ret = CertGetCertificateContextProperty(pCertContext,
 959          CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
 960         if (ret && size == id->u.KeyId.cbData)
 961         {
 962             LPBYTE buf = CryptMemAlloc(size);
 963
 964             if (buf)
 965             {
 966                 CertGetCertificateContextProperty(pCertContext,
 967                  CERT_KEY_IDENTIFIER_PROP_ID, buf, &size);
 968                 ret = !memcmp(buf, id->u.KeyId.pbData, size);
 969                 CryptMemFree(buf);
 970             }
 971         }
 972         else
 973             ret = FALSE;
 974         break;
 975     }
 976     default:
 977         ret = FALSE;
 978         break;
 979     }
 980     return ret;
 981 }
 982
 983 static BOOL compare_cert_by_issuer(PCCERT_CONTEXT pCertContext, DWORD dwType,
 984  DWORD dwFlags, const void *pvPara)
 985 {
 986     BOOL ret = FALSE;
 987     PCCERT_CONTEXT subject = (PCCERT_CONTEXT)pvPara;
 988     PCERT_EXTENSION ext;
 989     DWORD size;
 990
 991     if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER,
 992      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
 993     {
 994         CERT_AUTHORITY_KEY_ID_INFO *info;
 995
 996         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
 997          X509_AUTHORITY_KEY_ID, ext->Value.pbData, ext->Value.cbData,
 998          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
 999          &info, &size);
1000         if (ret)
1001         {
1002             CERT_ID id;
1003
1004             if (info->CertIssuer.cbData && info->CertSerialNumber.cbData)
1005             {
1006                 id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1007                 memcpy(&id.u.IssuerSerialNumber.Issuer, &info->CertIssuer,
1008                  sizeof(CERT_NAME_BLOB));
1009                 memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1010                  &info->CertSerialNumber, sizeof(CRYPT_INTEGER_BLOB));
1011                 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1012                  &id);
1013             }
1014             else if (info->KeyId.cbData)
1015             {
1016                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1017                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1018                 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1019                  &id);
1020             }
1021             else
1022                 ret = FALSE;
1023             LocalFree(info);
1024         }
1025     }
1026     else if ((ext = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2,
1027      subject->pCertInfo->cExtension, subject->pCertInfo->rgExtension)))
1028     {
1029         CERT_AUTHORITY_KEY_ID2_INFO *info;
1030
1031         ret = CryptDecodeObjectEx(subject->dwCertEncodingType,
1032          X509_AUTHORITY_KEY_ID2, ext->Value.pbData, ext->Value.cbData,
1033          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1034          &info, &size);
1035         if (ret)
1036         {
1037             CERT_ID id;
1038
1039             if (info->AuthorityCertIssuer.cAltEntry &&
1040              info->AuthorityCertSerialNumber.cbData)
1041             {
1042                 PCERT_ALT_NAME_ENTRY directoryName = NULL;
1043                 DWORD i;
1044
1045                 for (i = 0; !directoryName &&
1046                  i < info->AuthorityCertIssuer.cAltEntry; i++)
1047                     if (info->AuthorityCertIssuer.rgAltEntry[i].dwAltNameChoice
1048                      == CERT_ALT_NAME_DIRECTORY_NAME)
1049                         directoryName =
1050                          &info->AuthorityCertIssuer.rgAltEntry[i];
1051                 if (directoryName)
1052                 {
1053                     id.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
1054                     memcpy(&id.u.IssuerSerialNumber.Issuer,
1055                      &directoryName->u.DirectoryName, sizeof(CERT_NAME_BLOB));
1056                     memcpy(&id.u.IssuerSerialNumber.SerialNumber,
1057                      &info->AuthorityCertSerialNumber,
1058                      sizeof(CRYPT_INTEGER_BLOB));
1059                     ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1060                      &id);
1061                 }
1062                 else
1063                 {
1064                     FIXME("no supported name type in authority key id2\n");
1065                     ret = FALSE;
1066                 }
1067             }
1068             else if (info->KeyId.cbData)
1069             {
1070                 id.dwIdChoice = CERT_ID_KEY_IDENTIFIER;
1071                 memcpy(&id.u.KeyId, &info->KeyId, sizeof(CRYPT_HASH_BLOB));
1072                 ret = compare_cert_by_cert_id(pCertContext, dwType, dwFlags,
1073                  &id);
1074             }
1075             else
1076                 ret = FALSE;
1077             LocalFree(info);
1078         }
1079     }
1080     else
1081        ret = compare_cert_by_name(pCertContext,
1082         CERT_COMPARE_NAME | CERT_COMPARE_SUBJECT_CERT, dwFlags,
1083         &subject->pCertInfo->Issuer);
1084     return ret;
1085 }
1086
1087 PCCERT_CONTEXT WINAPI CertFindCertificateInStore(HCERTSTORE hCertStore,
1088  DWORD dwCertEncodingType, DWORD dwFlags, DWORD dwType, const void *pvPara,
1089  PCCERT_CONTEXT pPrevCertContext)
1090 {
1091     PCCERT_CONTEXT ret;
1092     CertCompareFunc compare;
1093
1094     TRACE("(%p, %08x, %08x, %08x, %p, %p)\n", hCertStore, dwCertEncodingType,
1095          dwFlags, dwType, pvPara, pPrevCertContext);
1096
1097     switch (dwType >> CERT_COMPARE_SHIFT)
1098     {
1099     case CERT_COMPARE_ANY:
1100         compare = compare_cert_any;
1101         break;
1102     case CERT_COMPARE_MD5_HASH:
1103         compare = compare_cert_by_md5_hash;
1104         break;
1105     case CERT_COMPARE_SHA1_HASH:
1106         compare = compare_cert_by_sha1_hash;
1107         break;
1108     case CERT_COMPARE_NAME:
1109         compare = compare_cert_by_name;
1110         break;
1111     case CERT_COMPARE_SUBJECT_CERT:
1112         compare = compare_cert_by_subject_cert;
1113         break;
1114     case CERT_COMPARE_CERT_ID:
1115         compare = compare_cert_by_cert_id;
1116         break;
1117     case CERT_COMPARE_ISSUER_OF:
1118         compare = compare_cert_by_issuer;
1119         break;
1120     default:
1121         FIXME("find type %08x unimplemented\n", dwType);
1122         compare = NULL;
1123     }
1124
1125     if (compare)
1126     {
1127         BOOL matches = FALSE;
1128
1129         ret = pPrevCertContext;
1130         do {
1131             ret = CertEnumCertificatesInStore(hCertStore, ret);
1132             if (ret)
1133                 matches = compare(ret, dwType, dwFlags, pvPara);
1134         } while (ret != NULL && !matches);
1135         if (!ret)
1136             SetLastError(CRYPT_E_NOT_FOUND);
1137     }
1138     else
1139     {
1140         SetLastError(CRYPT_E_NOT_FOUND);
1141         ret = NULL;
1142     }
1143     TRACE("returning %p\n", ret);
1144     return ret;
1145 }
1146
1147 PCCERT_CONTEXT WINAPI CertGetSubjectCertificateFromStore(HCERTSTORE hCertStore,
1148  DWORD dwCertEncodingType, PCERT_INFO pCertId)
1149 {
1150     TRACE("(%p, %08x, %p)\n", hCertStore, dwCertEncodingType, pCertId);
1151
1152     if (!pCertId)
1153     {
1154         SetLastError(E_INVALIDARG);
1155         return NULL;
1156     }
1157     return CertFindCertificateInStore(hCertStore, dwCertEncodingType, 0,
1158      CERT_FIND_SUBJECT_CERT, pCertId, NULL);
1159 }
1160
1161 BOOL WINAPI CertVerifySubjectCertificateContext(PCCERT_CONTEXT pSubject,
1162  PCCERT_CONTEXT pIssuer, DWORD *pdwFlags)
1163 {
1164     static const DWORD supportedFlags = CERT_STORE_REVOCATION_FLAG |
1165      CERT_STORE_SIGNATURE_FLAG | CERT_STORE_TIME_VALIDITY_FLAG;
1166
1167     if (*pdwFlags & ~supportedFlags)
1168     {
1169         SetLastError(E_INVALIDARG);
1170         return FALSE;
1171     }
1172     if (*pdwFlags & CERT_STORE_REVOCATION_FLAG)
1173     {
1174         DWORD flags = 0;
1175         PCCRL_CONTEXT crl = CertGetCRLFromStore(pSubject->hCertStore, pSubject,
1176          NULL, &flags);
1177
1178         /* FIXME: what if the CRL has expired? */
1179         if (crl)
1180         {
1181             if (CertVerifyCRLRevocation(pSubject->dwCertEncodingType,
1182              pSubject->pCertInfo, 1, (PCRL_INFO *)&crl->pCrlInfo))
1183                 *pdwFlags &= CERT_STORE_REVOCATION_FLAG;
1184         }
1185         else
1186             *pdwFlags |= CERT_STORE_NO_CRL_FLAG;
1187     }
1188     if (*pdwFlags & CERT_STORE_TIME_VALIDITY_FLAG)
1189     {
1190         if (0 == CertVerifyTimeValidity(NULL, pSubject->pCertInfo))
1191             *pdwFlags &= ~CERT_STORE_TIME_VALIDITY_FLAG;
1192     }
1193     if (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)
1194     {
1195         if (CryptVerifyCertificateSignatureEx(0, pSubject->dwCertEncodingType,
1196          CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)pSubject,
1197          CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)pIssuer, 0, NULL))
1198             *pdwFlags &= ~CERT_STORE_SIGNATURE_FLAG;
1199     }
1200     return TRUE;
1201 }
1202
1203 PCCERT_CONTEXT WINAPI CertGetIssuerCertificateFromStore(HCERTSTORE hCertStore,
1204  PCCERT_CONTEXT pSubjectContext, PCCERT_CONTEXT pPrevIssuerContext,
1205  DWORD *pdwFlags)
1206 {
1207     PCCERT_CONTEXT ret;
1208
1209     TRACE("(%p, %p, %p, %08x)\n", hCertStore, pSubjectContext,
1210      pPrevIssuerContext, *pdwFlags);
1211
1212     if (!pSubjectContext)
1213     {
1214         SetLastError(E_INVALIDARG);
1215         return NULL;
1216     }
1217
1218     ret = CertFindCertificateInStore(hCertStore,
1219      pSubjectContext->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF,
1220      pSubjectContext, pPrevIssuerContext);
1221     if (ret)
1222     {
1223         if (!CertVerifySubjectCertificateContext(pSubjectContext, ret,
1224          pdwFlags))
1225         {
1226             CertFreeCertificateContext(ret);
1227             ret = NULL;
1228         }
1229     }
1230     TRACE("returning %p\n", ret);
1231     return ret;
1232 }
1233
1234 PCRYPT_ATTRIBUTE WINAPI CertFindAttribute(LPCSTR pszObjId, DWORD cAttr,
1235  CRYPT_ATTRIBUTE rgAttr[])
1236 {
1237     PCRYPT_ATTRIBUTE ret = NULL;
1238     DWORD i;
1239
1240     TRACE("%s %d %p\n", debugstr_a(pszObjId), cAttr, rgAttr);
1241
1242     if (!cAttr)
1243         return NULL;
1244     if (!pszObjId)
1245     {
1246         SetLastError(ERROR_INVALID_PARAMETER);
1247         return NULL;
1248     }
1249
1250     for (i = 0; !ret && i < cAttr; i++)
1251         if (rgAttr[i].pszObjId && !strcmp(pszObjId, rgAttr[i].pszObjId))
1252             ret = &rgAttr[i];
1253     return ret;
1254 }
1255
1256 PCERT_EXTENSION WINAPI CertFindExtension(LPCSTR pszObjId, DWORD cExtensions,
1257  CERT_EXTENSION rgExtensions[])
1258 {
1259     PCERT_EXTENSION ret = NULL;
1260     DWORD i;
1261
1262     TRACE("%s %d %p\n", debugstr_a(pszObjId), cExtensions, rgExtensions);
1263
1264     if (!cExtensions)
1265         return NULL;
1266     if (!pszObjId)
1267     {
1268         SetLastError(ERROR_INVALID_PARAMETER);
1269         return NULL;
1270     }
1271
1272     for (i = 0; !ret && i < cExtensions; i++)
1273         if (rgExtensions[i].pszObjId && !strcmp(pszObjId,
1274          rgExtensions[i].pszObjId))
1275             ret = &rgExtensions[i];
1276     return ret;
1277 }
1278
1279 PCERT_RDN_ATTR WINAPI CertFindRDNAttr(LPCSTR pszObjId, PCERT_NAME_INFO pName)
1280 {
1281     PCERT_RDN_ATTR ret = NULL;
1282     DWORD i, j;
1283
1284     TRACE("%s %p\n", debugstr_a(pszObjId), pName);
1285
1286     if (!pszObjId)
1287     {
1288         SetLastError(ERROR_INVALID_PARAMETER);
1289         return NULL;
1290     }
1291
1292     for (i = 0; !ret && i < pName->cRDN; i++)
1293         for (j = 0; !ret && j < pName->rgRDN[i].cRDNAttr; j++)
1294             if (pName->rgRDN[i].rgRDNAttr[j].pszObjId && !strcmp(pszObjId,
1295              pName->rgRDN[i].rgRDNAttr[j].pszObjId))
1296                 ret = &pName->rgRDN[i].rgRDNAttr[j];
1297     return ret;
1298 }
1299
1300 LONG WINAPI CertVerifyTimeValidity(LPFILETIME pTimeToVerify,
1301  PCERT_INFO pCertInfo)
1302 {
1303     FILETIME fileTime;
1304     LONG ret;
1305
1306     if (!pTimeToVerify)
1307     {
1308         SYSTEMTIME sysTime;
1309
1310         GetSystemTime(&sysTime);
1311         SystemTimeToFileTime(&sysTime, &fileTime);
1312         pTimeToVerify = &fileTime;
1313     }
1314     if ((ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotBefore)) >= 0)
1315     {
1316         ret = CompareFileTime(pTimeToVerify, &pCertInfo->NotAfter);
1317         if (ret < 0)
1318             ret = 0;
1319     }
1320     return ret;
1321 }
1322
1323 BOOL WINAPI CertVerifyValidityNesting(PCERT_INFO pSubjectInfo,
1324  PCERT_INFO pIssuerInfo)
1325 {
1326     TRACE("(%p, %p)\n", pSubjectInfo, pIssuerInfo);
1327
1328     return CertVerifyTimeValidity(&pSubjectInfo->NotBefore, pIssuerInfo) == 0
1329      && CertVerifyTimeValidity(&pSubjectInfo->NotAfter, pIssuerInfo) == 0;
1330 }
1331
1332 BOOL WINAPI CryptHashCertificate(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1333  DWORD dwFlags, const BYTE *pbEncoded, DWORD cbEncoded, BYTE *pbComputedHash,
1334  DWORD *pcbComputedHash)
1335 {
1336     BOOL ret = TRUE;
1337     HCRYPTHASH hHash = 0;
1338
1339     TRACE("(%08lx, %d, %08x, %p, %d, %p, %p)\n", hCryptProv, Algid, dwFlags,
1340      pbEncoded, cbEncoded, pbComputedHash, pcbComputedHash);
1341
1342     if (!hCryptProv)
1343         hCryptProv = CRYPT_GetDefaultProvider();
1344     if (!Algid)
1345         Algid = CALG_SHA1;
1346     if (ret)
1347     {
1348         ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1349         if (ret)
1350         {
1351             ret = CryptHashData(hHash, pbEncoded, cbEncoded, 0);
1352             if (ret)
1353                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1354                  pcbComputedHash, 0);
1355             CryptDestroyHash(hHash);
1356         }
1357     }
1358     return ret;
1359 }
1360
1361 BOOL WINAPI CryptHashPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv, ALG_ID Algid,
1362  DWORD dwFlags, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo,
1363  BYTE *pbComputedHash, DWORD *pcbComputedHash)
1364 {
1365     BOOL ret = TRUE;
1366     HCRYPTHASH hHash = 0;
1367
1368     TRACE("(%08lx, %d, %08x, %d, %p, %p, %p)\n", hCryptProv, Algid, dwFlags,
1369      dwCertEncodingType, pInfo, pbComputedHash, pcbComputedHash);
1370
1371     if (!hCryptProv)
1372         hCryptProv = CRYPT_GetDefaultProvider();
1373     if (!Algid)
1374         Algid = CALG_MD5;
1375     if (ret)
1376     {
1377         BYTE *buf;
1378         DWORD size = 0;
1379
1380         ret = CryptEncodeObjectEx(dwCertEncodingType, X509_PUBLIC_KEY_INFO,
1381          pInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
1382         if (ret)
1383         {
1384             ret = CryptCreateHash(hCryptProv, Algid, 0, 0, &hHash);
1385             if (ret)
1386             {
1387                 ret = CryptHashData(hHash, buf, size, 0);
1388                 if (ret)
1389                     ret = CryptGetHashParam(hHash, HP_HASHVAL, pbComputedHash,
1390                      pcbComputedHash, 0);
1391                 CryptDestroyHash(hHash);
1392             }
1393             LocalFree(buf);
1394         }
1395     }
1396     return ret;
1397 }
1398
1399 BOOL WINAPI CryptSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1400  DWORD dwKeySpec, DWORD dwCertEncodingType, const BYTE *pbEncodedToBeSigned,
1401  DWORD cbEncodedToBeSigned, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1402  const void *pvHashAuxInfo, BYTE *pbSignature, DWORD *pcbSignature)
1403 {
1404     BOOL ret;
1405     PCCRYPT_OID_INFO info;
1406     HCRYPTHASH hHash;
1407
1408     TRACE("(%08lx, %d, %d, %p, %d, %p, %p, %p, %p)\n", hCryptProv,
1409      dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned,
1410      pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature);
1411
1412     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1413      pSignatureAlgorithm->pszObjId, 0);
1414     if (!info)
1415     {
1416         SetLastError(NTE_BAD_ALGID);
1417         return FALSE;
1418     }
1419     if (info->dwGroupId == CRYPT_HASH_ALG_OID_GROUP_ID)
1420     {
1421         if (!hCryptProv)
1422             hCryptProv = CRYPT_GetDefaultProvider();
1423         ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1424         if (ret)
1425         {
1426             ret = CryptHashData(hHash, pbEncodedToBeSigned,
1427              cbEncodedToBeSigned, 0);
1428             if (ret)
1429                 ret = CryptGetHashParam(hHash, HP_HASHVAL, pbSignature,
1430                  pcbSignature, 0);
1431             CryptDestroyHash(hHash);
1432         }
1433     }
1434     else
1435     {
1436         if (!hCryptProv)
1437         {
1438             SetLastError(ERROR_INVALID_PARAMETER);
1439             ret = FALSE;
1440         }
1441         else
1442         {
1443             ret = CryptCreateHash(hCryptProv, info->u.Algid, 0, 0, &hHash);
1444             if (ret)
1445             {
1446                 ret = CryptHashData(hHash, pbEncodedToBeSigned,
1447                  cbEncodedToBeSigned, 0);
1448                 if (ret)
1449                     ret = CryptSignHashW(hHash, dwKeySpec, NULL, 0, pbSignature,
1450                      pcbSignature);
1451                 CryptDestroyHash(hHash);
1452             }
1453         }
1454     }
1455     return ret;
1456 }
1457
1458 BOOL WINAPI CryptSignAndEncodeCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hCryptProv,
1459  DWORD dwKeySpec, DWORD dwCertEncodingType, LPCSTR lpszStructType,
1460  const void *pvStructInfo, PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
1461  const void *pvHashAuxInfo, BYTE *pbEncoded, DWORD *pcbEncoded)
1462 {
1463     BOOL ret;
1464     DWORD encodedSize, hashSize;
1465
1466     TRACE("(%08lx, %d, %d, %s, %p, %p, %p, %p, %p)\n", hCryptProv, dwKeySpec,
1467      dwCertEncodingType, debugstr_a(lpszStructType), pvStructInfo,
1468      pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded);
1469
1470     ret = CryptEncodeObject(dwCertEncodingType, lpszStructType, pvStructInfo,
1471      NULL, &encodedSize);
1472     if (ret)
1473     {
1474         PBYTE encoded = CryptMemAlloc(encodedSize);
1475
1476         if (encoded)
1477         {
1478             ret = CryptEncodeObject(dwCertEncodingType, lpszStructType,
1479              pvStructInfo, encoded, &encodedSize);
1480             if (ret)
1481             {
1482                 ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1483                  dwCertEncodingType, encoded, encodedSize, pSignatureAlgorithm,
1484                  pvHashAuxInfo, NULL, &hashSize);
1485                 if (ret)
1486                 {
1487                     PBYTE hash = CryptMemAlloc(hashSize);
1488
1489                     if (hash)
1490                     {
1491                         ret = CryptSignCertificate(hCryptProv, dwKeySpec,
1492                          dwCertEncodingType, encoded, encodedSize,
1493                          pSignatureAlgorithm, pvHashAuxInfo, hash, &hashSize);
1494                         if (ret)
1495                         {
1496                             CERT_SIGNED_CONTENT_INFO info = { { 0 } };
1497
1498                             info.ToBeSigned.cbData = encodedSize;
1499                             info.ToBeSigned.pbData = encoded;
1500                             memcpy(&info.SignatureAlgorithm,
1501                              pSignatureAlgorithm,
1502                              sizeof(info.SignatureAlgorithm));
1503                             info.Signature.cbData = hashSize;
1504                             info.Signature.pbData = hash;
1505                             info.Signature.cUnusedBits = 0;
1506                             ret = CryptEncodeObject(dwCertEncodingType,
1507                              X509_CERT, &info, pbEncoded, pcbEncoded);
1508                         }
1509                         CryptMemFree(hash);
1510                     }
1511                 }
1512             }
1513             CryptMemFree(encoded);
1514         }
1515     }
1516     return ret;
1517 }
1518
1519 BOOL WINAPI CryptVerifyCertificateSignature(HCRYPTPROV_LEGACY hCryptProv,
1520  DWORD dwCertEncodingType, const BYTE *pbEncoded, DWORD cbEncoded,
1521  PCERT_PUBLIC_KEY_INFO pPublicKey)
1522 {
1523     return CryptVerifyCertificateSignatureEx(hCryptProv, dwCertEncodingType,
1524      CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, (void *)pbEncoded,
1525      CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pPublicKey, 0, NULL);
1526 }
1527
1528 static BOOL CRYPT_VerifyCertSignatureFromPublicKeyInfo(HCRYPTPROV_LEGACY hCryptProv,
1529  DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pubKeyInfo,
1530  const CERT_SIGNED_CONTENT_INFO *signedCert)
1531 {
1532     BOOL ret;
1533     HCRYPTKEY key;
1534     PCCRYPT_OID_INFO info;
1535     ALG_ID pubKeyID, hashID;
1536
1537     info = CryptFindOIDInfo(CRYPT_OID_INFO_OID_KEY,
1538      signedCert->SignatureAlgorithm.pszObjId, 0);
1539     if (!info || info->dwGroupId != CRYPT_SIGN_ALG_OID_GROUP_ID)
1540     {
1541         SetLastError(NTE_BAD_ALGID);
1542         return FALSE;
1543     }
1544     hashID = info->u.Algid;
1545     if (info->ExtraInfo.cbData >= sizeof(ALG_ID))
1546         pubKeyID = *(ALG_ID *)info->ExtraInfo.pbData;
1547     else
1548         pubKeyID = hashID;
1549     /* Load the default provider if necessary */
1550     if (!hCryptProv)
1551         hCryptProv = CRYPT_GetDefaultProvider();
1552     ret = CryptImportPublicKeyInfoEx(hCryptProv, dwCertEncodingType,
1553      pubKeyInfo, pubKeyID, 0, NULL, &key);
1554     if (ret)
1555     {
1556         HCRYPTHASH hash;
1557
1558         ret = CryptCreateHash(hCryptProv, hashID, 0, 0, &hash);
1559         if (ret)
1560         {
1561             ret = CryptHashData(hash, signedCert->ToBeSigned.pbData,
1562              signedCert->ToBeSigned.cbData, 0);
1563             if (ret)
1564                 ret = CryptVerifySignatureW(hash, signedCert->Signature.pbData,
1565                  signedCert->Signature.cbData, key, NULL, 0);
1566             CryptDestroyHash(hash);
1567         }
1568         CryptDestroyKey(key);
1569     }
1570     return ret;
1571 }
1572
1573 BOOL WINAPI CryptVerifyCertificateSignatureEx(HCRYPTPROV_LEGACY hCryptProv,
1574  DWORD dwCertEncodingType, DWORD dwSubjectType, void *pvSubject,
1575  DWORD dwIssuerType, void *pvIssuer, DWORD dwFlags, void *pvReserved)
1576 {
1577     BOOL ret = TRUE;
1578     CRYPT_DATA_BLOB subjectBlob;
1579
1580     TRACE("(%08lx, %d, %d, %p, %d, %p, %08x, %p)\n", hCryptProv,
1581      dwCertEncodingType, dwSubjectType, pvSubject, dwIssuerType, pvIssuer,
1582      dwFlags, pvReserved);
1583
1584     switch (dwSubjectType)
1585     {
1586     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB:
1587     {
1588         PCRYPT_DATA_BLOB blob = (PCRYPT_DATA_BLOB)pvSubject;
1589
1590         subjectBlob.pbData = blob->pbData;
1591         subjectBlob.cbData = blob->cbData;
1592         break;
1593     }
1594     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT:
1595     {
1596         PCERT_CONTEXT context = (PCERT_CONTEXT)pvSubject;
1597
1598         subjectBlob.pbData = context->pbCertEncoded;
1599         subjectBlob.cbData = context->cbCertEncoded;
1600         break;
1601     }
1602     case CRYPT_VERIFY_CERT_SIGN_SUBJECT_CRL:
1603     {
1604         PCRL_CONTEXT context = (PCRL_CONTEXT)pvSubject;
1605
1606         subjectBlob.pbData = context->pbCrlEncoded;
1607         subjectBlob.cbData = context->cbCrlEncoded;
1608         break;
1609     }
1610     default:
1611         SetLastError(E_INVALIDARG);
1612         ret = FALSE;
1613     }
1614
1615     if (ret)
1616     {
1617         PCERT_SIGNED_CONTENT_INFO signedCert = NULL;
1618         DWORD size = 0;
1619
1620         ret = CryptDecodeObjectEx(dwCertEncodingType, X509_CERT,
1621          subjectBlob.pbData, subjectBlob.cbData,
1622          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL,
1623          (BYTE *)&signedCert, &size);
1624         if (ret)
1625         {
1626             switch (dwIssuerType)
1627             {
1628             case CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY:
1629                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1630                  dwCertEncodingType, (PCERT_PUBLIC_KEY_INFO)pvIssuer,
1631                  signedCert);
1632                 break;
1633             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT:
1634                 ret = CRYPT_VerifyCertSignatureFromPublicKeyInfo(hCryptProv,
1635                  dwCertEncodingType,
1636                  &((PCCERT_CONTEXT)pvIssuer)->pCertInfo->SubjectPublicKeyInfo,
1637                  signedCert);
1638                 break;
1639             case CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN:
1640                 FIXME("CRYPT_VERIFY_CERT_SIGN_ISSUER_CHAIN: stub\n");
1641                 ret = FALSE;
1642                 break;
1643             case CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL:
1644                 if (pvIssuer)
1645                 {
1646                     SetLastError(E_INVALIDARG);
1647                     ret = FALSE;
1648                 }
1649                 else
1650                 {
1651                     FIXME("unimplemented for NULL signer\n");
1652                     SetLastError(E_INVALIDARG);
1653                     ret = FALSE;
1654                 }
1655                 break;
1656             default:
1657                 SetLastError(E_INVALIDARG);
1658                 ret = FALSE;
1659             }
1660             LocalFree(signedCert);
1661         }
1662     }
1663     return ret;
1664 }
1665
1666 BOOL WINAPI CertGetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext, DWORD dwFlags,
1667  PCERT_ENHKEY_USAGE pUsage, DWORD *pcbUsage)
1668 {
1669     PCERT_ENHKEY_USAGE usage = NULL;
1670     DWORD bytesNeeded;
1671     BOOL ret = TRUE;
1672
1673     if (!pCertContext || !pcbUsage)
1674     {
1675         SetLastError(ERROR_INVALID_PARAMETER);
1676         return FALSE;
1677     }
1678
1679     TRACE("(%p, %08x, %p, %d)\n", pCertContext, dwFlags, pUsage, *pcbUsage);
1680
1681     if (!(dwFlags & CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG))
1682     {
1683         DWORD propSize = 0;
1684
1685         if (CertGetCertificateContextProperty(pCertContext,
1686          CERT_ENHKEY_USAGE_PROP_ID, NULL, &propSize))
1687         {
1688             LPBYTE buf = CryptMemAlloc(propSize);
1689
1690             if (buf)
1691             {
1692                 if (CertGetCertificateContextProperty(pCertContext,
1693                  CERT_ENHKEY_USAGE_PROP_ID, buf, &propSize))
1694                 {
1695                     ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1696                      X509_ENHANCED_KEY_USAGE, buf, propSize,
1697                      CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1698                 }
1699                 CryptMemFree(buf);
1700             }
1701         }
1702     }
1703     if (!usage && !(dwFlags & CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG))
1704     {
1705         PCERT_EXTENSION ext = CertFindExtension(szOID_ENHANCED_KEY_USAGE,
1706          pCertContext->pCertInfo->cExtension,
1707          pCertContext->pCertInfo->rgExtension);
1708
1709         if (ext)
1710         {
1711             ret = CryptDecodeObjectEx(pCertContext->dwCertEncodingType,
1712              X509_ENHANCED_KEY_USAGE, ext->Value.pbData, ext->Value.cbData,
1713              CRYPT_ENCODE_ALLOC_FLAG, NULL, &usage, &bytesNeeded);
1714         }
1715     }
1716     if (!usage)
1717     {
1718         /* If a particular location is specified, this should fail.  Otherwise
1719          * it should succeed with an empty usage.  (This is true on Win2k and
1720          * later, which we emulate.)
1721          */
1722         if (dwFlags)
1723         {
1724             SetLastError(CRYPT_E_NOT_FOUND);
1725             ret = FALSE;
1726         }
1727         else
1728             bytesNeeded = sizeof(CERT_ENHKEY_USAGE);
1729     }
1730
1731     if (ret)
1732     {
1733         if (!pUsage)
1734             *pcbUsage = bytesNeeded;
1735         else if (*pcbUsage < bytesNeeded)
1736         {
1737             SetLastError(ERROR_MORE_DATA);
1738             *pcbUsage = bytesNeeded;
1739             ret = FALSE;
1740         }
1741         else
1742         {
1743             *pcbUsage = bytesNeeded;
1744             if (usage)
1745             {
1746                 DWORD i;
1747                 LPSTR nextOID = (LPSTR)((LPBYTE)pUsage +
1748                  sizeof(CERT_ENHKEY_USAGE) +
1749                  usage->cUsageIdentifier * sizeof(LPSTR));
1750
1751                 pUsage->cUsageIdentifier = usage->cUsageIdentifier;
1752                 pUsage->rgpszUsageIdentifier = (LPSTR *)((LPBYTE)pUsage +
1753                  sizeof(CERT_ENHKEY_USAGE));
1754                 for (i = 0; i < usage->cUsageIdentifier; i++)
1755                 {
1756                     pUsage->rgpszUsageIdentifier[i] = nextOID;
1757                     strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1758                     nextOID += strlen(nextOID) + 1;
1759                 }
1760             }
1761             else
1762                 pUsage->cUsageIdentifier = 0;
1763         }
1764     }
1765     if (usage)
1766         LocalFree(usage);
1767     TRACE("returning %d\n", ret);
1768     return ret;
1769 }
1770
1771 BOOL WINAPI CertSetEnhancedKeyUsage(PCCERT_CONTEXT pCertContext,
1772  PCERT_ENHKEY_USAGE pUsage)
1773 {
1774     BOOL ret;
1775
1776     TRACE("(%p, %p)\n", pCertContext, pUsage);
1777
1778     if (pUsage)
1779     {
1780         CRYPT_DATA_BLOB blob = { 0, NULL };
1781
1782         ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_ENHANCED_KEY_USAGE,
1783          pUsage, CRYPT_ENCODE_ALLOC_FLAG, NULL, &blob.pbData, &blob.cbData);
1784         if (ret)
1785         {
1786             ret = CertSetCertificateContextProperty(pCertContext,
1787              CERT_ENHKEY_USAGE_PROP_ID, 0, &blob);
1788             LocalFree(blob.pbData);
1789         }
1790     }
1791     else
1792         ret = CertSetCertificateContextProperty(pCertContext,
1793          CERT_ENHKEY_USAGE_PROP_ID, 0, NULL);
1794     return ret;
1795 }
1796
1797 BOOL WINAPI CertAddEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1798  LPCSTR pszUsageIdentifier)
1799 {
1800     BOOL ret;
1801     DWORD size;
1802
1803     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1804
1805     if (CertGetEnhancedKeyUsage(pCertContext,
1806      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size))
1807     {
1808         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(size);
1809
1810         if (usage)
1811         {
1812             ret = CertGetEnhancedKeyUsage(pCertContext,
1813              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, usage, &size);
1814             if (ret)
1815             {
1816                 PCERT_ENHKEY_USAGE newUsage = CryptMemAlloc(size +
1817                  sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1818
1819                 if (newUsage)
1820                 {
1821                     LPSTR nextOID;
1822                     DWORD i;
1823
1824                     newUsage->rgpszUsageIdentifier =
1825                      (LPSTR *)((LPBYTE)newUsage + sizeof(CERT_ENHKEY_USAGE));
1826                     nextOID = (LPSTR)((LPBYTE)newUsage->rgpszUsageIdentifier +
1827                      (usage->cUsageIdentifier + 1) * sizeof(LPSTR));
1828                     for (i = 0; i < usage->cUsageIdentifier; i++)
1829                     {
1830                         newUsage->rgpszUsageIdentifier[i] = nextOID;
1831                         strcpy(nextOID, usage->rgpszUsageIdentifier[i]);
1832                         nextOID += strlen(nextOID) + 1;
1833                     }
1834                     newUsage->rgpszUsageIdentifier[i] = nextOID;
1835                     strcpy(nextOID, pszUsageIdentifier);
1836                     newUsage->cUsageIdentifier = i + 1;
1837                     ret = CertSetEnhancedKeyUsage(pCertContext, newUsage);
1838                     CryptMemFree(newUsage);
1839                 }
1840             }
1841             CryptMemFree(usage);
1842         }
1843         else
1844             ret = FALSE;
1845     }
1846     else
1847     {
1848         PCERT_ENHKEY_USAGE usage = CryptMemAlloc(sizeof(CERT_ENHKEY_USAGE) +
1849          sizeof(LPSTR) + strlen(pszUsageIdentifier) + 1);
1850
1851         if (usage)
1852         {
1853             usage->rgpszUsageIdentifier =
1854              (LPSTR *)((LPBYTE)usage + sizeof(CERT_ENHKEY_USAGE));
1855             usage->rgpszUsageIdentifier[0] = (LPSTR)((LPBYTE)usage +
1856              sizeof(CERT_ENHKEY_USAGE) + sizeof(LPSTR));
1857             strcpy(usage->rgpszUsageIdentifier[0], pszUsageIdentifier);
1858             usage->cUsageIdentifier = 1;
1859             ret = CertSetEnhancedKeyUsage(pCertContext, usage);
1860             CryptMemFree(usage);
1861         }
1862         else
1863             ret = FALSE;
1864     }
1865     return ret;
1866 }
1867
1868 BOOL WINAPI CertRemoveEnhancedKeyUsageIdentifier(PCCERT_CONTEXT pCertContext,
1869  LPCSTR pszUsageIdentifier)
1870 {
1871     BOOL ret;
1872     DWORD size;
1873     CERT_ENHKEY_USAGE usage;
1874
1875     TRACE("(%p, %s)\n", pCertContext, debugstr_a(pszUsageIdentifier));
1876
1877     size = sizeof(usage);
1878     ret = CertGetEnhancedKeyUsage(pCertContext,
1879      CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, &usage, &size);
1880     if (!ret && GetLastError() == ERROR_MORE_DATA)
1881     {
1882         PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
1883
1884         if (pUsage)
1885         {
1886             ret = CertGetEnhancedKeyUsage(pCertContext,
1887              CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1888             if (ret)
1889             {
1890                 if (pUsage->cUsageIdentifier)
1891                 {
1892                     DWORD i;
1893                     BOOL found = FALSE;
1894
1895                     for (i = 0; i < pUsage->cUsageIdentifier; i++)
1896                     {
1897                         if (!strcmp(pUsage->rgpszUsageIdentifier[i],
1898                          pszUsageIdentifier))
1899                             found = TRUE;
1900                         if (found && i < pUsage->cUsageIdentifier - 1)
1901                             pUsage->rgpszUsageIdentifier[i] =
1902                              pUsage->rgpszUsageIdentifier[i + 1];
1903                     }
1904                     pUsage->cUsageIdentifier--;
1905                     /* Remove the usage if it's empty */
1906                     if (pUsage->cUsageIdentifier)
1907                         ret = CertSetEnhancedKeyUsage(pCertContext, pUsage);
1908                     else
1909                         ret = CertSetEnhancedKeyUsage(pCertContext, NULL);
1910                 }
1911             }
1912             CryptMemFree(pUsage);
1913         }
1914         else
1915             ret = FALSE;
1916     }
1917     else
1918     {
1919         /* it fit in an empty usage, therefore there's nothing to remove */
1920         ret = TRUE;
1921     }
1922     return ret;
1923 }
1924
1925 BOOL WINAPI CertGetValidUsages(DWORD cCerts, PCCERT_CONTEXT *rghCerts,
1926  int *cNumOIDs, LPSTR *rghOIDs, DWORD *pcbOIDs)
1927 {
1928     BOOL ret = TRUE;
1929     DWORD i, cbOIDs = 0;
1930     BOOL allUsagesValid = TRUE;
1931     CERT_ENHKEY_USAGE validUsages = { 0, NULL };
1932
1933     TRACE("(%d, %p, %p, %p, %d)\n", cCerts, *rghCerts, cNumOIDs,
1934      rghOIDs, *pcbOIDs);
1935
1936     for (i = 0; ret && i < cCerts; i++)
1937     {
1938         CERT_ENHKEY_USAGE usage;
1939         DWORD size = sizeof(usage);
1940
1941         ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, &usage, &size);
1942         /* Success is deliberately ignored: it implies all usages are valid */
1943         if (!ret && GetLastError() == ERROR_MORE_DATA)
1944         {
1945             PCERT_ENHKEY_USAGE pUsage = CryptMemAlloc(size);
1946
1947             allUsagesValid = FALSE;
1948             if (pUsage)
1949             {
1950                 ret = CertGetEnhancedKeyUsage(rghCerts[i], 0, pUsage, &size);
1951                 if (ret)
1952                 {
1953                     if (!validUsages.cUsageIdentifier)
1954                     {
1955                         DWORD j;
1956
1957                         cbOIDs = pUsage->cUsageIdentifier * sizeof(LPSTR);
1958                         validUsages.cUsageIdentifier = pUsage->cUsageIdentifier;
1959                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
1960                             cbOIDs += lstrlenA(pUsage->rgpszUsageIdentifier[j])
1961                              + 1;
1962                         validUsages.rgpszUsageIdentifier =
1963                          CryptMemAlloc(cbOIDs);
1964                         if (validUsages.rgpszUsageIdentifier)
1965                         {
1966                             LPSTR nextOID = (LPSTR)
1967                              ((LPBYTE)validUsages.rgpszUsageIdentifier +
1968                              validUsages.cUsageIdentifier * sizeof(LPSTR));
1969
1970                             for (j = 0; j < validUsages.cUsageIdentifier; j++)
1971                             {
1972                                 validUsages.rgpszUsageIdentifier[j] = nextOID;
1973                                 lstrcpyA(validUsages.rgpszUsageIdentifier[j],
1974                                  pUsage->rgpszUsageIdentifier[j]);
1975                                 nextOID += lstrlenA(nextOID) + 1;
1976                             }
1977                         }
1978                         else
1979                             ret = FALSE;
1980                     }
1981                     else
1982                     {
1983                         DWORD j, k, validIndexes = 0, numRemoved = 0;
1984
1985                         /* Merge: build a bitmap of all the indexes of
1986                          * validUsages.rgpszUsageIdentifier that are in pUsage.
1987                          */
1988                         for (j = 0; j < pUsage->cUsageIdentifier; j++)
1989                         {
1990                             for (k = 0; k < validUsages.cUsageIdentifier; k++)
1991                             {
1992                                 if (!strcmp(pUsage->rgpszUsageIdentifier[j],
1993                                  validUsages.rgpszUsageIdentifier[k]))
1994                                 {
1995                                     validIndexes |= (1 << k);
1996                                     break;
1997                                 }
1998                             }
1999                         }
2000                         /* Merge by removing from validUsages those that are
2001                          * not in the bitmap.
2002                          */
2003                         for (j = 0; j < validUsages.cUsageIdentifier; j++)
2004                         {
2005                             if (!(validIndexes & (1 << j)))
2006                             {
2007                                 if (j < validUsages.cUsageIdentifier - 1)
2008                                 {
2009                                     memcpy(&validUsages.rgpszUsageIdentifier[j],
2010                                      &validUsages.rgpszUsageIdentifier[j +
2011                                      numRemoved + 1],
2012                                      (validUsages.cUsageIdentifier - numRemoved
2013                                      - j - 1) * sizeof(LPSTR));
2014                                     cbOIDs -= lstrlenA(
2015                                      validUsages.rgpszUsageIdentifier[j]) + 1 +
2016                                      sizeof(LPSTR);
2017                                     numRemoved++;
2018                                 }
2019                                 else
2020                                     validUsages.cUsageIdentifier--;
2021                             }
2022                         }
2023                     }
2024                 }
2025                 CryptMemFree(pUsage);
2026             }
2027             else
2028                 ret = FALSE;
2029         }
2030     }
2031     if (ret)
2032     {
2033         if (allUsagesValid)
2034         {
2035             *cNumOIDs = -1;
2036             *pcbOIDs = 0;
2037         }
2038         else
2039         {
2040             if (!rghOIDs || *pcbOIDs < cbOIDs)
2041             {
2042                 *pcbOIDs = cbOIDs;
2043                 SetLastError(ERROR_MORE_DATA);
2044                 ret = FALSE;
2045             }
2046             else
2047             {
2048                 LPSTR nextOID = (LPSTR)((LPBYTE)rghOIDs +
2049                  validUsages.cUsageIdentifier * sizeof(LPSTR));
2050
2051                 *pcbOIDs = cbOIDs;
2052                 *cNumOIDs = validUsages.cUsageIdentifier;
2053                 for (i = 0; i < validUsages.cUsageIdentifier; i++)
2054                 {
2055                     rghOIDs[i] = nextOID;
2056                     lstrcpyA(nextOID, validUsages.rgpszUsageIdentifier[i]);
2057                     nextOID += lstrlenA(nextOID) + 1;
2058                 }
2059             }
2060         }
2061     }
2062     CryptMemFree(validUsages.rgpszUsageIdentifier);
2063     return ret;
2064 }
2065
2066 /* Sets the CERT_KEY_PROV_INFO_PROP_ID property of context from pInfo, or, if
2067  * pInfo is NULL, from the attributes of hProv.
2068  */
2069 static void CertContext_SetKeyProvInfo(PCCERT_CONTEXT context,
2070  const CRYPT_KEY_PROV_INFO *pInfo, HCRYPTPROV hProv)
2071 {
2072     CRYPT_KEY_PROV_INFO info = { 0 };
2073     BOOL ret;
2074
2075     if (!pInfo)
2076     {
2077         DWORD size;
2078         int len;
2079
2080         ret = CryptGetProvParam(hProv, PP_CONTAINER, NULL, &size, 0);
2081         if (ret)
2082         {
2083             LPSTR szContainer = CryptMemAlloc(size);
2084
2085             if (szContainer)
2086             {
2087                 ret = CryptGetProvParam(hProv, PP_CONTAINER,
2088                  (BYTE *)szContainer, &size, 0);
2089                 if (ret)
2090                 {
2091                     len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2092                      NULL, 0);
2093                     if (len)
2094                     {
2095                         info.pwszContainerName = CryptMemAlloc(len *
2096                          sizeof(WCHAR));
2097                         len = MultiByteToWideChar(CP_ACP, 0, szContainer, -1,
2098                          info.pwszContainerName, len);
2099                     }
2100                 }
2101                 CryptMemFree(szContainer);
2102             }
2103         }
2104         ret = CryptGetProvParam(hProv, PP_NAME, NULL, &size, 0);
2105         if (ret)
2106         {
2107             LPSTR szProvider = CryptMemAlloc(size);
2108
2109             if (szProvider)
2110             {
2111                 ret = CryptGetProvParam(hProv, PP_NAME, (BYTE *)szProvider,
2112                  &size, 0);
2113                 if (ret)
2114                 {
2115                     len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2116                      NULL, 0);
2117                     if (len)
2118                     {
2119                         info.pwszProvName = CryptMemAlloc(len *
2120                          sizeof(WCHAR));
2121                         len = MultiByteToWideChar(CP_ACP, 0, szProvider, -1,
2122                          info.pwszProvName, len);
2123                     }
2124                 }
2125                 CryptMemFree(szProvider);
2126             }
2127         }
2128         size = sizeof(info.dwKeySpec);
2129         /* in case no CRYPT_KEY_PROV_INFO given,
2130          *  we always use AT_SIGNATURE key spec
2131          */
2132         info.dwKeySpec = AT_SIGNATURE;
2133         size = sizeof(info.dwProvType);
2134         ret = CryptGetProvParam(hProv, PP_PROVTYPE, (LPBYTE)&info.dwProvType,
2135          &size, 0);
2136         if (!ret)
2137             info.dwProvType = PROV_RSA_FULL;
2138         pInfo = &info;
2139     }
2140
2141     ret = CertSetCertificateContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
2142      0, pInfo);
2143
2144     if (pInfo == &info)
2145     {
2146         CryptMemFree(info.pwszContainerName);
2147         CryptMemFree(info.pwszProvName);
2148     }
2149 }
2150
2151 /* Creates a signed certificate context from the unsigned, encoded certificate
2152  * in blob, using the crypto provider hProv and the signature algorithm sigAlgo.
2153  */
2154 static PCCERT_CONTEXT CRYPT_CreateSignedCert(const CRYPT_DER_BLOB *blob,
2155  HCRYPTPROV hProv, DWORD dwKeySpec, PCRYPT_ALGORITHM_IDENTIFIER sigAlgo)
2156 {
2157     PCCERT_CONTEXT context = NULL;
2158     BOOL ret;
2159     DWORD sigSize = 0;
2160
2161     ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2162      blob->pbData, blob->cbData, sigAlgo, NULL, NULL, &sigSize);
2163     if (ret)
2164     {
2165         LPBYTE sig = CryptMemAlloc(sigSize);
2166
2167         ret = CryptSignCertificate(hProv, dwKeySpec, X509_ASN_ENCODING,
2168          blob->pbData, blob->cbData, sigAlgo, NULL, sig, &sigSize);
2169         if (ret)
2170         {
2171             CERT_SIGNED_CONTENT_INFO signedInfo;
2172             BYTE *encodedSignedCert = NULL;
2173             DWORD encodedSignedCertSize = 0;
2174
2175             signedInfo.ToBeSigned.cbData = blob->cbData;
2176             signedInfo.ToBeSigned.pbData = blob->pbData;
2177             memcpy(&signedInfo.SignatureAlgorithm, sigAlgo,
2178              sizeof(signedInfo.SignatureAlgorithm));
2179             signedInfo.Signature.cbData = sigSize;
2180             signedInfo.Signature.pbData = sig;
2181             signedInfo.Signature.cUnusedBits = 0;
2182             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT,
2183              &signedInfo, CRYPT_ENCODE_ALLOC_FLAG, NULL,
2184              (BYTE *)&encodedSignedCert, &encodedSignedCertSize);
2185             if (ret)
2186             {
2187                 context = CertCreateCertificateContext(X509_ASN_ENCODING,
2188                  encodedSignedCert, encodedSignedCertSize);
2189                 LocalFree(encodedSignedCert);
2190             }
2191         }
2192         CryptMemFree(sig);
2193     }
2194     return context;
2195 }
2196
2197 /* Copies data from the parameters into info, where:
2198  * pSerialNumber: The serial number.  Must not be NULL.
2199  * pSubjectIssuerBlob: Specifies both the subject and issuer for info.
2200  *                     Must not be NULL
2201  * pSignatureAlgorithm: Optional.
2202  * pStartTime: The starting time of the certificate.  If NULL, the current
2203  *             system time is used.
2204  * pEndTime: The ending time of the certificate.  If NULL, one year past the
2205  *           starting time is used.
2206  * pubKey: The public key of the certificate.  Must not be NULL.
2207  * pExtensions: Extensions to be included with the certificate.  Optional.
2208  */
2209 static void CRYPT_MakeCertInfo(PCERT_INFO info, const CRYPT_DATA_BLOB *pSerialNumber,
2210  const CERT_NAME_BLOB *pSubjectIssuerBlob,
2211  const CRYPT_ALGORITHM_IDENTIFIER *pSignatureAlgorithm, const SYSTEMTIME *pStartTime,
2212  const SYSTEMTIME *pEndTime, const CERT_PUBLIC_KEY_INFO *pubKey,
2213  const CERT_EXTENSIONS *pExtensions)
2214 {
2215     static CHAR oid[] = szOID_RSA_SHA1RSA;
2216
2217     assert(info);
2218     assert(pSerialNumber);
2219     assert(pSubjectIssuerBlob);
2220     assert(pubKey);
2221
2222     info->dwVersion = CERT_V3;
2223     info->SerialNumber.cbData = pSerialNumber->cbData;
2224     info->SerialNumber.pbData = pSerialNumber->pbData;
2225     if (pSignatureAlgorithm)
2226         memcpy(&info->SignatureAlgorithm, pSignatureAlgorithm,
2227          sizeof(info->SignatureAlgorithm));
2228     else
2229     {
2230         info->SignatureAlgorithm.pszObjId = oid;
2231         info->SignatureAlgorithm.Parameters.cbData = 0;
2232         info->SignatureAlgorithm.Parameters.pbData = NULL;
2233     }
2234     info->Issuer.cbData = pSubjectIssuerBlob->cbData;
2235     info->Issuer.pbData = pSubjectIssuerBlob->pbData;
2236     if (pStartTime)
2237         SystemTimeToFileTime(pStartTime, &info->NotBefore);
2238     else
2239         GetSystemTimeAsFileTime(&info->NotBefore);
2240     if (pEndTime)
2241         SystemTimeToFileTime(pEndTime, &info->NotAfter);
2242     else
2243     {
2244         SYSTEMTIME endTime;
2245
2246         if (FileTimeToSystemTime(&info->NotBefore, &endTime))
2247         {
2248             endTime.wYear++;
2249             SystemTimeToFileTime(&endTime, &info->NotAfter);
2250         }
2251     }
2252     info->Subject.cbData = pSubjectIssuerBlob->cbData;
2253     info->Subject.pbData = pSubjectIssuerBlob->pbData;
2254     memcpy(&info->SubjectPublicKeyInfo, pubKey,
2255      sizeof(info->SubjectPublicKeyInfo));
2256     if (pExtensions)
2257     {
2258         info->cExtension = pExtensions->cExtension;
2259         info->rgExtension = pExtensions->rgExtension;
2260     }
2261     else
2262     {
2263         info->cExtension = 0;
2264         info->rgExtension = NULL;
2265     }
2266 }
2267
2268 typedef RPC_STATUS (RPC_ENTRY *UuidCreateFunc)(UUID *);
2269 typedef RPC_STATUS (RPC_ENTRY *UuidToStringFunc)(UUID *, unsigned char **);
2270 typedef RPC_STATUS (RPC_ENTRY *RpcStringFreeFunc)(unsigned char **);
2271
2272 static HCRYPTPROV CRYPT_CreateKeyProv(void)
2273 {
2274     HCRYPTPROV hProv = 0;
2275     HMODULE rpcrt = LoadLibraryA("rpcrt4");
2276
2277     if (rpcrt)
2278     {
2279         UuidCreateFunc uuidCreate = (UuidCreateFunc)GetProcAddress(rpcrt,
2280          "UuidCreate");
2281         UuidToStringFunc uuidToString = (UuidToStringFunc)GetProcAddress(rpcrt,
2282          "UuidToStringA");
2283         RpcStringFreeFunc rpcStringFree = (RpcStringFreeFunc)GetProcAddress(
2284          rpcrt, "RpcStringFreeA");
2285
2286         if (uuidCreate && uuidToString && rpcStringFree)
2287         {
2288             UUID uuid;
2289             RPC_STATUS status = uuidCreate(&uuid);
2290
2291             if (status == RPC_S_OK || status == RPC_S_UUID_LOCAL_ONLY)
2292             {
2293                 unsigned char *uuidStr;
2294
2295                 status = uuidToString(&uuid, &uuidStr);
2296                 if (status == RPC_S_OK)
2297                 {
2298                     BOOL ret = CryptAcquireContextA(&hProv, (LPCSTR)uuidStr,
2299                      MS_DEF_PROV_A, PROV_RSA_FULL, CRYPT_NEWKEYSET);
2300
2301                     if (ret)
2302                     {
2303                         HCRYPTKEY key;
2304
2305                         ret = CryptGenKey(hProv, AT_SIGNATURE, 0, &key);
2306                         if (ret)
2307                             CryptDestroyKey(key);
2308                     }
2309                     rpcStringFree(&uuidStr);
2310                 }
2311             }
2312         }
2313         FreeLibrary(rpcrt);
2314     }
2315     return hProv;
2316 }
2317
2318 PCCERT_CONTEXT WINAPI CertCreateSelfSignCertificate(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE hProv,
2319  PCERT_NAME_BLOB pSubjectIssuerBlob, DWORD dwFlags,
2320  PCRYPT_KEY_PROV_INFO pKeyProvInfo,
2321  PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm, PSYSTEMTIME pStartTime,
2322  PSYSTEMTIME pEndTime, PCERT_EXTENSIONS pExtensions)
2323 {
2324     PCCERT_CONTEXT context = NULL;
2325     BOOL ret, releaseContext = FALSE;
2326     PCERT_PUBLIC_KEY_INFO pubKey = NULL;
2327     DWORD pubKeySize = 0,dwKeySpec = AT_SIGNATURE;
2328
2329     TRACE("(%08lx, %p, %08x, %p, %p, %p, %p, %p)\n", hProv,
2330      pSubjectIssuerBlob, dwFlags, pKeyProvInfo, pSignatureAlgorithm, pStartTime,
2331      pExtensions, pExtensions);
2332
2333     if(!pSubjectIssuerBlob)
2334     {
2335         SetLastError(ERROR_INVALID_PARAMETER);
2336         return NULL;
2337     }
2338
2339     if (!hProv)
2340     {
2341         if (!pKeyProvInfo)
2342         {
2343             hProv = CRYPT_CreateKeyProv();
2344             releaseContext = TRUE;
2345         }
2346         else if (pKeyProvInfo->dwFlags & CERT_SET_KEY_PROV_HANDLE_PROP_ID)
2347         {
2348             SetLastError(NTE_BAD_FLAGS);
2349             return NULL;
2350         }
2351         else
2352         {
2353             HCRYPTKEY hKey = 0;
2354             /* acquire the context using the given information*/
2355             ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2356                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2357                     pKeyProvInfo->dwFlags);
2358             if (!ret)
2359             {
2360                 if(GetLastError() != NTE_BAD_KEYSET)
2361                     return NULL;
2362                 /* create the key set */
2363                 ret = CryptAcquireContextW(&hProv,pKeyProvInfo->pwszContainerName,
2364                     pKeyProvInfo->pwszProvName,pKeyProvInfo->dwProvType,
2365                     pKeyProvInfo->dwFlags|CRYPT_NEWKEYSET);
2366                 if (!ret)
2367                     return NULL;
2368             }
2369             dwKeySpec = pKeyProvInfo->dwKeySpec;
2370             /* check if the key is here */
2371             ret = CryptGetUserKey(hProv,dwKeySpec,&hKey);
2372             if(!ret)
2373             {
2374                 if (NTE_NO_KEY == GetLastError())
2375                 { /* generate the key */
2376                     ret = CryptGenKey(hProv,dwKeySpec,0,&hKey);
2377                 }
2378                 if (!ret)
2379                 {
2380                     CryptReleaseContext(hProv,0);
2381                     SetLastError(NTE_BAD_KEYSET);
2382                     return NULL;
2383                 }
2384             }
2385             CryptDestroyKey(hKey);
2386             releaseContext = TRUE;
2387         }
2388     }
2389     else if (pKeyProvInfo)
2390     {
2391         SetLastError(ERROR_INVALID_PARAMETER);
2392         return NULL;
2393     }
2394
2395     CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING, NULL,
2396      &pubKeySize);
2397     pubKey = CryptMemAlloc(pubKeySize);
2398     if (pubKey)
2399     {
2400         ret = CryptExportPublicKeyInfo(hProv, dwKeySpec, X509_ASN_ENCODING,
2401          pubKey, &pubKeySize);
2402         if (ret)
2403         {
2404             CERT_INFO info = { 0 };
2405             CRYPT_DER_BLOB blob = { 0, NULL };
2406             BYTE serial[16];
2407             CRYPT_DATA_BLOB serialBlob = { sizeof(serial), serial };
2408
2409             CryptGenRandom(hProv, sizeof(serial), serial);
2410             CRYPT_MakeCertInfo(&info, &serialBlob, pSubjectIssuerBlob,
2411              pSignatureAlgorithm, pStartTime, pEndTime, pubKey, pExtensions);
2412             ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED,
2413              &info, CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&blob.pbData,
2414              &blob.cbData);
2415             if (ret)
2416             {
2417                 if (!(dwFlags & CERT_CREATE_SELFSIGN_NO_SIGN))
2418                     context = CRYPT_CreateSignedCert(&blob, hProv,dwKeySpec,
2419                      &info.SignatureAlgorithm);
2420                 else
2421                     context = CertCreateCertificateContext(X509_ASN_ENCODING,
2422                      blob.pbData, blob.cbData);
2423                 if (context && !(dwFlags & CERT_CREATE_SELFSIGN_NO_KEY_INFO))
2424                     CertContext_SetKeyProvInfo(context, pKeyProvInfo, hProv);
2425                 LocalFree(blob.pbData);
2426             }
2427         }
2428         CryptMemFree(pubKey);
2429     }
2430     if (releaseContext)
2431         CryptReleaseContext(hProv, 0);
2432     return context;
2433 }