From 273b76570e001fae231f6fbc4a926dfcb4d59a3d Mon Sep 17 00:00:00 2001 From: Juan Lang Date: Tue, 11 Jul 2006 06:01:48 -0700 Subject: [PATCH] crypt32: Implement CryptAcquireCertificatePrivateKey. --- dlls/crypt32/cert.c | 128 ++++++++++++++++++++++++++- dlls/crypt32/crypt32.spec | 1 + dlls/crypt32/tests/cert.c | 178 ++++++++++++++++++++++++++++++++++++++ include/wincrypt.h | 10 +++ 4 files changed, 316 insertions(+), 1 deletion(-) diff --git a/dlls/crypt32/cert.c b/dlls/crypt32/cert.c index 3af7fa1128f..851c8c5d2d3 100644 --- a/dlls/crypt32/cert.c +++ b/dlls/crypt32/cert.c @@ -558,6 +558,132 @@ BOOL WINAPI CertSetCertificateContextProperty(PCCERT_CONTEXT pCertContext, return ret; } +/* Acquires the private key using the key provider info, retrieving info from + * the certificate if info is NULL. The acquired provider is returned in + * *phCryptProv, and the key spec for the provider is returned in *pdwKeySpec. + */ +static BOOL CRYPT_AcquirePrivateKeyFromProvInfo(PCCERT_CONTEXT pCert, + PCRYPT_KEY_PROV_INFO info, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec) +{ + DWORD size = 0; + BOOL allocated = FALSE, ret = TRUE; + + if (!info) + { + ret = CertGetCertificateContextProperty(pCert, + CERT_KEY_PROV_INFO_PROP_ID, 0, &size); + if (ret) + { + info = (PCRYPT_KEY_PROV_INFO)HeapAlloc(GetProcessHeap(), 0, size); + if (info) + { + ret = CertGetCertificateContextProperty(pCert, + CERT_KEY_PROV_INFO_PROP_ID, info, &size); + allocated = TRUE; + } + } + else + SetLastError(CRYPT_E_NO_KEY_PROPERTY); + } + if (ret) + { + ret = CryptAcquireContextW(phCryptProv, info->pwszContainerName, + info->pwszProvName, info->dwProvType, 0); + if (ret) + { + DWORD i; + + for (i = 0; i < info->cProvParam; i++) + { + CryptSetProvParam(*phCryptProv, + info->rgProvParam[i].dwParam, info->rgProvParam[i].pbData, + info->rgProvParam[i].dwFlags); + } + *pdwKeySpec = info->dwKeySpec; + } + else + SetLastError(CRYPT_E_NO_KEY_PROPERTY); + } + if (allocated) + HeapFree(GetProcessHeap(), 0, info); + return ret; +} + +BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert, + DWORD dwFlags, void *pvReserved, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec, + BOOL *pfCallerFreeProv) +{ + BOOL ret = FALSE, cache = FALSE; + PCRYPT_KEY_PROV_INFO info = NULL; + CERT_KEY_CONTEXT keyContext; + DWORD size; + + TRACE("(%p, %08lx, %p, %p, %p, %p)\n", pCert, dwFlags, pvReserved, + phCryptProv, pdwKeySpec, pfCallerFreeProv); + + if (dwFlags & CRYPT_ACQUIRE_USE_PROV_INFO_FLAG) + { + DWORD size = 0; + + ret = CertGetCertificateContextProperty(pCert, + CERT_KEY_PROV_INFO_PROP_ID, 0, &size); + if (ret) + { + info = (PCRYPT_KEY_PROV_INFO)HeapAlloc( + GetProcessHeap(), 0, size); + ret = CertGetCertificateContextProperty(pCert, + CERT_KEY_PROV_INFO_PROP_ID, info, &size); + if (ret) + cache = info->dwFlags & CERT_SET_KEY_CONTEXT_PROP_ID; + } + } + else if (dwFlags & CRYPT_ACQUIRE_CACHE_FLAG) + cache = TRUE; + *phCryptProv = 0; + if (cache) + { + size = sizeof(keyContext); + ret = CertGetCertificateContextProperty(pCert, CERT_KEY_CONTEXT_PROP_ID, + &keyContext, &size); + if (ret) + { + *phCryptProv = keyContext.hCryptProv; + if (pdwKeySpec) + *pdwKeySpec = keyContext.dwKeySpec; + if (pfCallerFreeProv) + *pfCallerFreeProv = !cache; + } + } + if (!*phCryptProv) + { + ret = CRYPT_AcquirePrivateKeyFromProvInfo(pCert, info, + &keyContext.hCryptProv, &keyContext.dwKeySpec); + if (ret) + { + *phCryptProv = keyContext.hCryptProv; + if (pdwKeySpec) + *pdwKeySpec = keyContext.dwKeySpec; + if (cache) + { + keyContext.cbSize = sizeof(keyContext); + if (CertSetCertificateContextProperty(pCert, + CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext)) + { + if (pfCallerFreeProv) + *pfCallerFreeProv = FALSE; + } + } + else + { + if (pfCallerFreeProv) + *pfCallerFreeProv = TRUE; + } + } + } + HeapFree(GetProcessHeap(), 0, info); + return ret; +} + BOOL WINAPI CertCompareCertificate(DWORD dwCertEncodingType, PCERT_INFO pCertId1, PCERT_INFO pCertId2) { @@ -1743,7 +1869,7 @@ static void CRYPT_MakeCertInfo(PCERT_INFO info, else GetSystemTimeAsFileTime(&info->NotBefore); if (pEndTime) - SystemTimeToFileTime(pStartTime, &info->NotAfter); + SystemTimeToFileTime(pEndTime, &info->NotAfter); else { SYSTEMTIME endTime; diff --git a/dlls/crypt32/crypt32.spec b/dlls/crypt32/crypt32.spec index 120061b782e..41ec54f4bb6 100644 --- a/dlls/crypt32/crypt32.spec +++ b/dlls/crypt32/crypt32.spec @@ -95,6 +95,7 @@ @ stdcall CryptStringToBinaryA(str long long ptr ptr ptr ptr) @ stub CryptStringToBinaryW # (wstr long long ptr ptr ptr ptr) @ stub CryptAcquireContextU +@ stdcall CryptAcquireCertificatePrivateKey(ptr long ptr ptr ptr ptr) @ stub CryptCloseAsyncHandle @ stub CryptCreateAsyncHandle @ stub CryptDecodeMessage diff --git a/dlls/crypt32/tests/cert.c b/dlls/crypt32/tests/cert.c index b03d61e1cae..49692e22eb9 100644 --- a/dlls/crypt32/tests/cert.c +++ b/dlls/crypt32/tests/cert.c @@ -1632,6 +1632,183 @@ static void testVerifySubjectCert(void) CertFreeCertificateContext(context1); } +static const BYTE privKey[] = { + 0x07, 0x02, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x52, 0x53, 0x41, 0x32, 0x00, + 0x02, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x79, 0x10, 0x1c, 0xd0, 0x6b, 0x10, + 0x18, 0x30, 0x94, 0x61, 0xdc, 0x0e, 0xcb, 0x96, 0x4e, 0x21, 0x3f, 0x79, 0xcd, + 0xa9, 0x17, 0x62, 0xbc, 0xbb, 0x61, 0x4c, 0xe0, 0x75, 0x38, 0x6c, 0xf3, 0xde, + 0x60, 0x86, 0x03, 0x97, 0x65, 0xeb, 0x1e, 0x6b, 0xdb, 0x53, 0x85, 0xad, 0x68, + 0x21, 0xf1, 0x5d, 0xe7, 0x1f, 0xe6, 0x53, 0xb4, 0xbb, 0x59, 0x3e, 0x14, 0x27, + 0xb1, 0x83, 0xa7, 0x3a, 0x54, 0xe2, 0x8f, 0x65, 0x8e, 0x6a, 0x4a, 0xcf, 0x3b, + 0x1f, 0x65, 0xff, 0xfe, 0xf1, 0x31, 0x3a, 0x37, 0x7a, 0x8b, 0xcb, 0xc6, 0xd4, + 0x98, 0x50, 0x36, 0x67, 0xe4, 0xa1, 0xe8, 0x7e, 0x8a, 0xc5, 0x23, 0xf2, 0x77, + 0xf5, 0x37, 0x61, 0x49, 0x72, 0x59, 0xe8, 0x3d, 0xf7, 0x60, 0xb2, 0x77, 0xca, + 0x78, 0x54, 0x6d, 0x65, 0x9e, 0x03, 0x97, 0x1b, 0x61, 0xbd, 0x0c, 0xd8, 0x06, + 0x63, 0xe2, 0xc5, 0x48, 0xef, 0xb3, 0xe2, 0x6e, 0x98, 0x7d, 0xbd, 0x4e, 0x72, + 0x91, 0xdb, 0x31, 0x57, 0xe3, 0x65, 0x3a, 0x49, 0xca, 0xec, 0xd2, 0x02, 0x4e, + 0x22, 0x7e, 0x72, 0x8e, 0xf9, 0x79, 0x84, 0x82, 0xdf, 0x7b, 0x92, 0x2d, 0xaf, + 0xc9, 0xe4, 0x33, 0xef, 0x89, 0x5c, 0x66, 0x99, 0xd8, 0x80, 0x81, 0x47, 0x2b, + 0xb1, 0x66, 0x02, 0x84, 0x59, 0x7b, 0xc3, 0xbe, 0x98, 0x45, 0x4a, 0x3d, 0xdd, + 0xea, 0x2b, 0xdf, 0x4e, 0xb4, 0x24, 0x6b, 0xec, 0xe7, 0xd9, 0x0c, 0x45, 0xb8, + 0xbe, 0xca, 0x69, 0x37, 0x92, 0x4c, 0x38, 0x6b, 0x96, 0x6d, 0xcd, 0x86, 0x67, + 0x5c, 0xea, 0x54, 0x94, 0xa4, 0xca, 0xa4, 0x02, 0xa5, 0x21, 0x4d, 0xae, 0x40, + 0x8f, 0x9d, 0x51, 0x83, 0xf2, 0x3f, 0x33, 0xc1, 0x72, 0xb4, 0x1d, 0x94, 0x6e, + 0x7d, 0xe4, 0x27, 0x3f, 0xea, 0xff, 0xe5, 0x9b, 0xa7, 0x5e, 0x55, 0x8e, 0x0d, + 0x69, 0x1c, 0x7a, 0xff, 0x81, 0x9d, 0x53, 0x52, 0x97, 0x9a, 0x76, 0x79, 0xda, + 0x93, 0x32, 0x16, 0xec, 0x69, 0x51, 0x1a, 0x4e, 0xc3, 0xf1, 0x72, 0x80, 0x78, + 0x5e, 0x66, 0x4a, 0x8d, 0x85, 0x2f, 0x3f, 0xb2, 0xa7 }; + +static const BYTE selfSignedCert[] = { + 0x30, 0x82, 0x01, 0x1f, 0x30, 0x81, 0xce, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, + 0x10, 0xeb, 0x0d, 0x57, 0x2a, 0x9c, 0x09, 0xba, 0xa4, 0x4a, 0xb7, 0x25, 0x49, + 0xd9, 0x3e, 0xb5, 0x73, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d, + 0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, + 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, + 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, 0x32, 0x39, 0x30, 0x35, 0x30, 0x30, + 0x34, 0x36, 0x5a, 0x17, 0x0d, 0x30, 0x37, 0x30, 0x36, 0x32, 0x39, 0x31, 0x31, + 0x30, 0x30, 0x34, 0x36, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, + 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, + 0x67, 0x00, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, + 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41, + 0x00, 0xe2, 0x54, 0x3a, 0xa7, 0x83, 0xb1, 0x27, 0x14, 0x3e, 0x59, 0xbb, 0xb4, + 0x53, 0xe6, 0x1f, 0xe7, 0x5d, 0xf1, 0x21, 0x68, 0xad, 0x85, 0x53, 0xdb, 0x6b, + 0x1e, 0xeb, 0x65, 0x97, 0x03, 0x86, 0x60, 0xde, 0xf3, 0x6c, 0x38, 0x75, 0xe0, + 0x4c, 0x61, 0xbb, 0xbc, 0x62, 0x17, 0xa9, 0xcd, 0x79, 0x3f, 0x21, 0x4e, 0x96, + 0xcb, 0x0e, 0xdc, 0x61, 0x94, 0x30, 0x18, 0x10, 0x6b, 0xd0, 0x1c, 0x10, 0x79, + 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, + 0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x25, 0x90, 0x53, 0x34, 0xd9, 0x56, 0x41, + 0x5e, 0xdb, 0x7e, 0x01, 0x36, 0xec, 0x27, 0x61, 0x5e, 0xb7, 0x4d, 0x90, 0x66, + 0xa2, 0xe1, 0x9d, 0x58, 0x76, 0xd4, 0x9c, 0xba, 0x2c, 0x84, 0xc6, 0x83, 0x7a, + 0x22, 0x0d, 0x03, 0x69, 0x32, 0x1a, 0x6d, 0xcb, 0x0c, 0x15, 0xb3, 0x6b, 0xc7, + 0x0a, 0x8c, 0xb4, 0x5c, 0x34, 0x78, 0xe0, 0x3c, 0x9c, 0xe9, 0xf3, 0x30, 0x9f, + 0xa8, 0x76, 0x57, 0x92, 0x36 }; + +static void testAcquireCertPrivateKey(void) +{ + BOOL ret; + PCCERT_CONTEXT cert; + HCRYPTPROV csp; + DWORD keySpec; + BOOL callerFree; + CRYPT_KEY_PROV_INFO keyProvInfo; + HCRYPTKEY key; + + keyProvInfo.pwszContainerName = (LPWSTR)cspNameW; + keyProvInfo.pwszProvName = (LPWSTR)MS_DEF_PROV_W; + keyProvInfo.dwProvType = PROV_RSA_FULL; + keyProvInfo.dwFlags = 0; + keyProvInfo.cProvParam = 0; + keyProvInfo.rgProvParam = NULL; + keyProvInfo.dwKeySpec = AT_SIGNATURE; + + CryptAcquireContextW(NULL, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL, + CRYPT_DELETEKEYSET); + + cert = CertCreateCertificateContext(X509_ASN_ENCODING, selfSignedCert, + sizeof(selfSignedCert)); + + /* Crash + ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, NULL, NULL); + ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, NULL, + &callerFree); + ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, &keySpec, + NULL); + ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, &csp, NULL, NULL); + ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, &csp, &keySpec, + &callerFree); + ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, NULL, NULL, NULL); + */ + + /* Missing private key */ + ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, NULL, NULL); + ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY, + "Expected CRYPT_E_NO_KEY_PROPERTY, got %08lx\n", GetLastError()); + ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, &keySpec, + &callerFree); + ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY, + "Expected CRYPT_E_NO_KEY_PROPERTY, got %08lx\n", GetLastError()); + CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, + &keyProvInfo); + ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, &keySpec, + &callerFree); + ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY, + "Expected CRYPT_E_NO_KEY_PROPERTY, got %08lx\n", GetLastError()); + + CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL, + CRYPT_NEWKEYSET); + ret = CryptImportKey(csp, (LPBYTE)privKey, sizeof(privKey), 0, 0, &key); + ok(ret, "CryptImportKey failed: %08lx\n", GetLastError()); + if (ret) + { + HCRYPTPROV certCSP; + DWORD size; + CERT_KEY_CONTEXT keyContext; + + /* Don't cache provider */ + ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &certCSP, + &keySpec, &callerFree); + ok(ret, "CryptAcquireCertificatePrivateKey failed: %08lx\n", + GetLastError()); + ok(callerFree, "Expected callerFree to be TRUE\n"); + CryptReleaseContext(certCSP, 0); + ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &certCSP, + NULL, NULL); + ok(ret, "CryptAcquireCertificatePrivateKey failed: %08lx\n", + GetLastError()); + CryptReleaseContext(certCSP, 0); + + /* Use the key prov info's caching (there shouldn't be any) */ + ret = CryptAcquireCertificatePrivateKey(cert, + CRYPT_ACQUIRE_USE_PROV_INFO_FLAG, NULL, &certCSP, &keySpec, + &callerFree); + ok(ret, "CryptAcquireCertificatePrivateKey failed: %08lx\n", + GetLastError()); + ok(callerFree, "Expected callerFree to be TRUE\n"); + CryptReleaseContext(certCSP, 0); + + /* Cache it (and check that it's cached) */ + ret = CryptAcquireCertificatePrivateKey(cert, + CRYPT_ACQUIRE_CACHE_FLAG, NULL, &certCSP, &keySpec, &callerFree); + ok(ret, "CryptAcquireCertificatePrivateKey failed: %08lx\n", + GetLastError()); + ok(!callerFree, "Expected callerFree to be FALSE\n"); + size = sizeof(keyContext); + ret = CertGetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID, + &keyContext, &size); + ok(ret, "CertGetCertificateContextProperty failed: %08lx\n", + GetLastError()); + + /* Remove the cached provider */ + CryptReleaseContext(keyContext.hCryptProv, 0); + CertSetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID, 0, + NULL); + /* Allow caching via the key prov info */ + keyProvInfo.dwFlags = CERT_SET_KEY_CONTEXT_PROP_ID; + CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, + &keyProvInfo); + /* Now use the key prov info's caching */ + ret = CryptAcquireCertificatePrivateKey(cert, + CRYPT_ACQUIRE_USE_PROV_INFO_FLAG, NULL, &certCSP, &keySpec, + &callerFree); + ok(ret, "CryptAcquireCertificatePrivateKey failed: %08lx\n", + GetLastError()); + ok(!callerFree, "Expected callerFree to be FALSE\n"); + size = sizeof(keyContext); + ret = CertGetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID, + &keyContext, &size); + ok(ret, "CertGetCertificateContextProperty failed: %08lx\n", + GetLastError()); + + CryptDestroyKey(key); + } + + CryptReleaseContext(csp, 0); + CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL, + CRYPT_DELETEKEYSET); + + CertFreeCertificateContext(cert); +} + START_TEST(cert) { init_function_pointers(); @@ -1652,4 +1829,5 @@ START_TEST(cert) testComparePublicKeyInfo(); testCompareCert(); testVerifySubjectCert(); + testAcquireCertPrivateKey(); } diff --git a/include/wincrypt.h b/include/wincrypt.h index 9a16154e885..b34ebfb3ddc 100644 --- a/include/wincrypt.h +++ b/include/wincrypt.h @@ -2560,6 +2560,12 @@ typedef struct _CRL_FIND_ISSUED_FOR_PARA #define CERT_CREATE_SELFSIGN_NO_SIGN 1 #define CERT_CREATE_SELFSIGN_NO_KEY_INFO 2 +/* flags for CryptAcquireCertificatePrivateKey */ +#define CRYPT_ACQUIRE_CACHE_FLAG 0x00000001 +#define CRYPT_ACQUIRE_USE_PROV_INFO_FLAG 0x00000002 +#define CRYPT_ACQUIRE_COMPARE_KEY_FLAG 0x00000004 +#define CRYPT_ACQUIRE_SILENT_FLAG 0x00000040 + /* function declarations */ /* advapi32.dll */ BOOL WINAPI CryptAcquireContextA(HCRYPTPROV *phProv, LPCSTR pszContainer, @@ -2982,6 +2988,10 @@ BOOL WINAPI CryptImportPublicKeyInfoEx(HCRYPTPROV hCryptProv, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo, ALG_ID aiKeyAlg, DWORD dwFlags, void *pvAuxInfo, HCRYPTKEY *phKey); +BOOL WINAPI CryptAcquireCertificatePrivateKey(PCCERT_CONTEXT pCert, + DWORD dwFlags, void *pvReserved, HCRYPTPROV *phCryptProv, DWORD *pdwKeySpec, + BOOL *pfCallerFreeProv); + BOOL WINAPI CryptProtectData( DATA_BLOB* pDataIn, LPCWSTR szDataDescr, DATA_BLOB* pOptionalEntropy, PVOID pvReserved, CRYPTPROTECT_PROMPTSTRUCT* pPromptStruct, DWORD dwFlags, DATA_BLOB* pDataOut );