?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Release 0.9.39.
[wine/gsoc-2012-control.git] / dlls / crypt32 / tests / cert.c
blob25008be0cf375e07aaa9b96c66027972ce84b33f
1 /*
2 * crypt32 cert functions tests
3 *
4 * Copyright 2005-2006 Juan Lang
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
19 */
20
21 #include <assert.h>
22 #include <stdio.h>
23 #include <stdarg.h>
24 #include <windef.h>
25 #include <winbase.h>
26 #include <winreg.h>
27 #include <winerror.h>
28 #include <wincrypt.h>
29
30 #include "wine/test.h"
31
32 static BOOL (WINAPI * pCryptVerifyCertificateSignatureEx)
33 (HCRYPTPROV, DWORD, DWORD, void *, DWORD, void *, DWORD, void *);
34
35 #define CRYPT_GET_PROC(func) \
36 p ## func = (void *)GetProcAddress(hCrypt32, #func); \
37 if(!p ## func) \
38 trace("GetProcAddress(hCrypt32, \"%s\") failed\n", #func); \
39
40 static void init_function_pointers(void)
41 {
42 HMODULE hCrypt32;
43
44 pCryptVerifyCertificateSignatureEx = NULL;
45
46 hCrypt32 = GetModuleHandleA("crypt32.dll");
47 assert(hCrypt32);
48
49 CRYPT_GET_PROC(CryptVerifyCertificateSignatureEx);
50 }
51
52 static BYTE subjectName[] = { 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06,
53 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61,
54 0x6e, 0x67, 0x00 };
55 static BYTE serialNum[] = { 1 };
56 static const BYTE bigCert[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
57 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
58 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
59 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
60 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
61 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
62 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20,
63 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
64 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
65 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
66 static BYTE bigCertHash[] = { 0x6e, 0x30, 0x90, 0x71, 0x5f, 0xd9, 0x23,
67 0x56, 0xeb, 0xae, 0x25, 0x40, 0xe6, 0x22, 0xda, 0x19, 0x26, 0x02, 0xa6, 0x08 };
68
69 static const BYTE bigCertWithDifferentSubject[] = { 0x30, 0x7a, 0x02, 0x01, 0x02,
70 0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
71 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67,
72 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31,
73 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31,
74 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15,
75 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c,
76 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06,
77 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55,
78 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02,
79 0x01, 0x01 };
80 static const BYTE bigCertWithDifferentIssuer[] = { 0x30, 0x7a, 0x02, 0x01,
81 0x01, 0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
82 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e,
83 0x67, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
84 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30,
85 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30,
86 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a,
87 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02,
88 0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03,
89 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff,
90 0x02, 0x01, 0x01 };
91
92 static BYTE subjectName2[] = { 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06,
93 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61,
94 0x6e, 0x67, 0x00 };
95 static const BYTE bigCert2[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
96 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
97 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
98 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
99 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
100 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
101 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20,
102 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
103 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
104 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
105 static const BYTE bigCert2WithDifferentSerial[] = { 0x30, 0x7a, 0x02, 0x01,
106 0x02, 0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
107 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e,
108 0x67, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
109 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30,
110 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30,
111 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41,
112 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02,
113 0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03,
114 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff,
115 0x02, 0x01, 0x01 };
116 static BYTE bigCert2Hash[] = { 0x4a, 0x7f, 0x32, 0x1f, 0xcf, 0x3b, 0xc0,
117 0x87, 0x48, 0x2b, 0xa1, 0x86, 0x54, 0x18, 0xe4, 0x3a, 0x0e, 0x53, 0x7e, 0x2b };
118
119 static const BYTE certWithUsage[] = { 0x30, 0x81, 0x93, 0x02, 0x01, 0x01, 0x30,
120 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
121 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00,
122 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30,
123 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30,
124 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31,
125 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61,
126 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00,
127 0x03, 0x01, 0x00, 0xa3, 0x2f, 0x30, 0x2d, 0x30, 0x2b, 0x06, 0x03, 0x55, 0x1d,
128 0x25, 0x01, 0x01, 0xff, 0x04, 0x21, 0x30, 0x1f, 0x06, 0x08, 0x2b, 0x06, 0x01,
129 0x05, 0x05, 0x07, 0x03, 0x03, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
130 0x03, 0x02, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 };
131
132 static void testAddCert(void)
133 {
134 HCERTSTORE store;
135 HCERTSTORE collection;
136 PCCERT_CONTEXT context;
137 PCCERT_CONTEXT copyContext;
138 BOOL ret;
139
140 store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
141 CERT_STORE_CREATE_NEW_FLAG, NULL);
142 ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
143 if (!store)
144 return;
145
146 /* Weird--bad add disposition leads to an access violation in Windows.
147 */
148 ret = CertAddEncodedCertificateToStore(0, X509_ASN_ENCODING, bigCert,
149 sizeof(bigCert), 0, NULL);
150 ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
151 "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
152 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
153 bigCert, sizeof(bigCert), 0, NULL);
154 ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
155 "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
156
157 /* Weird--can add a cert to the NULL store (does this have special
158 * meaning?)
159 */
160 context = NULL;
161 ret = CertAddEncodedCertificateToStore(0, X509_ASN_ENCODING, bigCert,
162 sizeof(bigCert), CERT_STORE_ADD_ALWAYS, &context);
163 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
164 GetLastError());
165 if (context)
166 CertFreeCertificateContext(context);
167
168 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
169 bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, NULL);
170 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
171 GetLastError());
172 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
173 bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, NULL);
174 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
175 GetLastError());
176 /* This has the same name as bigCert, so finding isn't done by name */
177 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
178 certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, &context);
179 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
180 GetLastError());
181 ok(context != NULL, "Expected a context\n");
182 if (context)
183 {
184 CRYPT_DATA_BLOB hash = { sizeof(bigCert2Hash), bigCert2Hash };
185
186 /* Duplicate (AddRef) the context so we can still use it after
187 * deleting it from the store.
188 */
189 CertDuplicateCertificateContext(context);
190 CertDeleteCertificateFromStore(context);
191 /* Set the same hash as bigCert2, and try to readd it */
192 ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID,
193 0, &hash);
194 ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
195 GetLastError());
196 ret = CertAddCertificateContextToStore(store, context,
197 CERT_STORE_ADD_NEW, NULL);
198 /* The failure is a bit odd (CRYPT_E_ASN1_BADTAG), so just check
199 * that it fails.
200 */
201 ok(!ret, "Expected failure\n");
202 CertFreeCertificateContext(context);
203 }
204 context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert2,
205 sizeof(bigCert2));
206 ok(context != NULL, "Expected a context\n");
207 if (context)
208 {
209 /* Try to readd bigCert2 to the store */
210 ret = CertAddCertificateContextToStore(store, context,
211 CERT_STORE_ADD_NEW, NULL);
212 ok(!ret && GetLastError() == CRYPT_E_EXISTS,
213 "Expected CRYPT_E_EXISTS, got %08x\n", GetLastError());
214 CertFreeCertificateContext(context);
215 }
216
217 /* Adding a cert with the same issuer name and serial number (but
218 * different subject) as an existing cert succeeds.
219 */
220 context = NULL;
221 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
222 bigCert2WithDifferentSerial, sizeof(bigCert2WithDifferentSerial),
223 CERT_STORE_ADD_NEW, &context);
224 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
225 GetLastError());
226 if (context)
227 CertDeleteCertificateFromStore(context);
228
229 /* Adding a cert with the same subject name and serial number (but
230 * different issuer) as an existing cert succeeds.
231 */
232 context = NULL;
233 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
234 bigCertWithDifferentSubject, sizeof(bigCertWithDifferentSubject),
235 CERT_STORE_ADD_NEW, &context);
236 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
237 GetLastError());
238 if (context)
239 CertDeleteCertificateFromStore(context);
240
241 /* Adding a cert with the same issuer name and serial number (but
242 * different otherwise) as an existing cert succeeds.
243 */
244 context = NULL;
245 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
246 bigCertWithDifferentIssuer, sizeof(bigCertWithDifferentIssuer),
247 CERT_STORE_ADD_NEW, &context);
248 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
249 GetLastError());
250 if (context)
251 CertDeleteCertificateFromStore(context);
252
253 collection = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0,
254 CERT_STORE_CREATE_NEW_FLAG, NULL);
255 ok(collection != NULL, "CertOpenStore failed: %08x\n", GetLastError());
256 if (collection)
257 {
258 /* Add store to the collection, but disable updates */
259 CertAddStoreToCollection(collection, store, 0, 0);
260
261 context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert2,
262 sizeof(bigCert2));
263 ok(context != NULL, "Expected a context\n");
264 if (context)
265 {
266 /* Try to readd bigCert2 to the collection */
267 ret = CertAddCertificateContextToStore(collection, context,
268 CERT_STORE_ADD_NEW, NULL);
269 ok(!ret && GetLastError() == CRYPT_E_EXISTS,
270 "Expected CRYPT_E_EXISTS, got %08x\n", GetLastError());
271 /* Replacing an existing certificate context is allowed, even
272 * though updates to the collection aren't..
273 */
274 ret = CertAddCertificateContextToStore(collection, context,
275 CERT_STORE_ADD_REPLACE_EXISTING, NULL);
276 ok(ret, "CertAddCertificateContextToStore failed: %08x\n",
277 GetLastError());
278 /* use the existing certificate and ask for a copy of the context*/
279 copyContext = NULL;
280 ret = CertAddCertificateContextToStore(collection, context,
281 CERT_STORE_ADD_USE_EXISTING, &copyContext);
282 ok(ret, "CertAddCertificateContextToStore failed: %08x\n",
283 GetLastError());
284 ok(copyContext != NULL, "Expected on output a non NULL copyContext\n");
285 if (copyContext)
286 CertFreeCertificateContext(copyContext);
287 /* but adding a new certificate isn't allowed. */
288 ret = CertAddCertificateContextToStore(collection, context,
289 CERT_STORE_ADD_ALWAYS, NULL);
290 ok(!ret && GetLastError() == E_ACCESSDENIED,
291 "Expected E_ACCESSDENIED, got %08x\n", GetLastError());
292 CertFreeCertificateContext(context);
293 }
294
295 CertCloseStore(collection, 0);
296 }
297
298 CertCloseStore(store, 0);
299 }
300
301 static void checkHash(const BYTE *data, DWORD dataLen, ALG_ID algID,
302 PCCERT_CONTEXT context, DWORD propID)
303 {
304 BYTE hash[20] = { 0 }, hashProperty[20];
305 BOOL ret;
306 DWORD size;
307 DWORD dwSizeWithNull;
308
309 memset(hash, 0, sizeof(hash));
310 memset(hashProperty, 0, sizeof(hashProperty));
311 size = sizeof(hash);
312 ret = CryptHashCertificate(0, algID, 0, data, dataLen, hash, &size);
313 ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
314 ret = CertGetCertificateContextProperty(context, propID, NULL,
315 &dwSizeWithNull);
316 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
317 GetLastError());
318 ret = CertGetCertificateContextProperty(context, propID, hashProperty,
319 &size);
320 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
321 GetLastError());
322 ok(!memcmp(hash, hashProperty, size), "Unexpected hash for property %d\n",
323 propID);
324 ok(size == dwSizeWithNull, "Unexpected length of hash for property: received %d instead of %d\n",
325 dwSizeWithNull,size);
326 }
327
328 static WCHAR cspNameW[] = { 'W','i','n','e','C','r','y','p','t','T','e','m','p',0 };
329
330 static void testCertProperties(void)
331 {
332 PCCERT_CONTEXT context = CertCreateCertificateContext(X509_ASN_ENCODING,
333 bigCert, sizeof(bigCert));
334 DWORD propID, numProps, access, size;
335 BOOL ret;
336 BYTE hash[20] = { 0 }, hashProperty[20];
337 CRYPT_DATA_BLOB blob;
338 CERT_KEY_CONTEXT keyContext;
339 HCRYPTPROV csp;
340
341 ok(context != NULL, "CertCreateCertificateContext failed: %08x\n",
342 GetLastError());
343 if (!context)
344 return;
345
346 /* This crashes
347 propID = CertEnumCertificateContextProperties(NULL, 0);
348 */
349
350 propID = 0;
351 numProps = 0;
352 do {
353 propID = CertEnumCertificateContextProperties(context, propID);
354 if (propID)
355 numProps++;
356 } while (propID != 0);
357 ok(numProps == 0, "Expected 0 properties, got %d\n", numProps);
358
359 /* Tests with a NULL cert context. Prop ID 0 fails.. */
360 ret = CertSetCertificateContextProperty(NULL, 0, 0, NULL);
361 ok(!ret && GetLastError() == E_INVALIDARG,
362 "Expected E_INVALIDARG, got %08x\n", GetLastError());
363 /* while this just crashes.
364 ret = CertSetCertificateContextProperty(NULL,
365 CERT_KEY_PROV_HANDLE_PROP_ID, 0, NULL);
366 */
367
368 ret = CertSetCertificateContextProperty(context, 0, 0, NULL);
369 ok(!ret && GetLastError() == E_INVALIDARG,
370 "Expected E_INVALIDARG, got %08x\n", GetLastError());
371 /* Can't set the cert property directly, this crashes.
372 ret = CertSetCertificateContextProperty(context,
373 CERT_CERT_PROP_ID, 0, bigCert2);
374 */
375
376 /* These all crash.
377 ret = CertGetCertificateContextProperty(context,
378 CERT_ACCESS_STATE_PROP_ID, 0, NULL);
379 ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
380 NULL, NULL);
381 ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
382 hashProperty, NULL);
383 */
384 /* A missing prop */
385 size = 0;
386 ret = CertGetCertificateContextProperty(context,
387 CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
388 ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
389 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
390 /* And, an implicit property */
391 size = sizeof(access);
392 ret = CertGetCertificateContextProperty(context,
393 CERT_ACCESS_STATE_PROP_ID, &access, &size);
394 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
395 GetLastError());
396 ok(!(access & CERT_ACCESS_STATE_WRITE_PERSIST_FLAG),
397 "Didn't expect a persisted cert\n");
398 /* Trying to set this "read only" property crashes.
399 access |= CERT_ACCESS_STATE_WRITE_PERSIST_FLAG;
400 ret = CertSetCertificateContextProperty(context,
401 CERT_ACCESS_STATE_PROP_ID, 0, &access);
402 */
403
404 /* Can I set the hash to an invalid hash? */
405 blob.pbData = hash;
406 blob.cbData = sizeof(hash);
407 ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID, 0,
408 &blob);
409 ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
410 GetLastError());
411 size = sizeof(hashProperty);
412 ret = CertGetCertificateContextProperty(context, CERT_HASH_PROP_ID,
413 hashProperty, &size);
414 ok(!memcmp(hashProperty, hash, sizeof(hash)), "Unexpected hash\n");
415 /* Delete the (bogus) hash, and get the real one */
416 ret = CertSetCertificateContextProperty(context, CERT_HASH_PROP_ID, 0,
417 NULL);
418 ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
419 GetLastError());
420 checkHash(bigCert, sizeof(bigCert), CALG_SHA1, context,
421 CERT_HASH_PROP_ID);
422
423 /* Now that the hash property is set, we should get one property when
424 * enumerating.
425 */
426 propID = 0;
427 numProps = 0;
428 do {
429 propID = CertEnumCertificateContextProperties(context, propID);
430 if (propID)
431 numProps++;
432 } while (propID != 0);
433 ok(numProps == 1, "Expected 1 properties, got %d\n", numProps);
434
435 /* Check a few other implicit properties */
436 checkHash(bigCert, sizeof(bigCert), CALG_MD5, context,
437 CERT_MD5_HASH_PROP_ID);
438 checkHash(
439 context->pCertInfo->Subject.pbData,
440 context->pCertInfo->Subject.cbData,
441 CALG_MD5, context, CERT_SUBJECT_NAME_MD5_HASH_PROP_ID);
442 checkHash(
443 context->pCertInfo->SubjectPublicKeyInfo.PublicKey.pbData,
444 context->pCertInfo->SubjectPublicKeyInfo.PublicKey.cbData,
445 CALG_MD5, context, CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID);
446
447 /* Test key identifiers and handles and such */
448 size = 0;
449 ret = CertGetCertificateContextProperty(context,
450 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
451 ok(!ret && GetLastError() == ERROR_INVALID_DATA,
452 "Expected ERROR_INVALID_DATA, got %08x\n", GetLastError());
453 size = sizeof(CERT_KEY_CONTEXT);
454 ret = CertGetCertificateContextProperty(context,
455 CERT_KEY_IDENTIFIER_PROP_ID, NULL, &size);
456 ok(!ret && GetLastError() == ERROR_INVALID_DATA,
457 "Expected ERROR_INVALID_DATA, got %08x\n", GetLastError());
458 ret = CertGetCertificateContextProperty(context,
459 CERT_KEY_IDENTIFIER_PROP_ID, &keyContext, &size);
460 ok(!ret && GetLastError() == ERROR_INVALID_DATA,
461 "Expected ERROR_INVALID_DATA, got %08x\n", GetLastError());
462 /* Key context with an invalid size */
463 keyContext.cbSize = 0;
464 ret = CertSetCertificateContextProperty(context,
465 CERT_KEY_IDENTIFIER_PROP_ID, 0, &keyContext);
466 ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
467 GetLastError());
468 size = sizeof(keyContext);
469 ret = CertGetCertificateContextProperty(context,
470 CERT_KEY_IDENTIFIER_PROP_ID, &keyContext, &size);
471 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
472 GetLastError());
473 keyContext.cbSize = sizeof(keyContext);
474 keyContext.hCryptProv = 0;
475 keyContext.dwKeySpec = AT_SIGNATURE;
476 /* Crash
477 ret = CertSetCertificateContextProperty(context,
478 CERT_KEY_IDENTIFIER_PROP_ID, 0, &keyContext);
479 ret = CertSetCertificateContextProperty(context,
480 CERT_KEY_IDENTIFIER_PROP_ID, CERT_STORE_NO_CRYPT_RELEASE_FLAG,
481 &keyContext);
482 */
483 ret = CryptAcquireContextW(&csp, cspNameW,
484 MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET);
485 ok(ret, "CryptAcquireContextW failed: %08x\n", GetLastError());
486 keyContext.hCryptProv = csp;
487 ret = CertSetCertificateContextProperty(context,
488 CERT_KEY_CONTEXT_PROP_ID, 0, &keyContext);
489 ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
490 GetLastError());
491 /* Now that that's set, the key prov handle property is also gettable.
492 */
493 size = sizeof(DWORD);
494 ret = CertGetCertificateContextProperty(context,
495 CERT_KEY_PROV_HANDLE_PROP_ID, &keyContext.hCryptProv, &size);
496 ok(ret, "Expected to get the CERT_KEY_PROV_HANDLE_PROP_ID, got %08x\n",
497 GetLastError());
498 /* Remove the key prov handle property.. */
499 ret = CertSetCertificateContextProperty(context,
500 CERT_KEY_PROV_HANDLE_PROP_ID, 0, NULL);
501 ok(ret, "CertSetCertificateContextProperty failed: %08x\n",
502 GetLastError());
503 /* and the key context's CSP is set to NULL. */
504 size = sizeof(keyContext);
505 ret = CertGetCertificateContextProperty(context,
506 CERT_KEY_CONTEXT_PROP_ID, &keyContext, &size);
507 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
508 GetLastError());
509 ok(keyContext.hCryptProv == 0, "Expected no hCryptProv\n");
510
511 CryptReleaseContext(csp, 0);
512
513 CertFreeCertificateContext(context);
514 }
515
516 static void testDupCert(void)
517 {
518 HCERTSTORE store;
519 PCCERT_CONTEXT context, dupContext;
520 BOOL ret;
521
522 store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
523 CERT_STORE_CREATE_NEW_FLAG, NULL);
524 ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
525 if (!store)
526 return;
527
528 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
529 bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, &context);
530 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
531 GetLastError());
532 ok(context != NULL, "Expected a valid cert context\n");
533 if (context)
534 {
535 ok(context->cbCertEncoded == sizeof(bigCert),
536 "Wrong cert size %d\n", context->cbCertEncoded);
537 ok(!memcmp(context->pbCertEncoded, bigCert, sizeof(bigCert)),
538 "Unexpected encoded cert in context\n");
539 ok(context->hCertStore == store, "Unexpected store\n");
540
541 dupContext = CertDuplicateCertificateContext(context);
542 ok(dupContext != NULL, "Expected valid duplicate\n");
543 /* Not only is it a duplicate, it's identical: the address is the
544 * same.
545 */
546 ok(dupContext == context, "Expected identical context addresses\n");
547 CertFreeCertificateContext(dupContext);
548 CertFreeCertificateContext(context);
549 }
550 CertCloseStore(store, 0);
551 }
552
553 static void testFindCert(void)
554 {
555 HCERTSTORE store;
556 PCCERT_CONTEXT context = NULL;
557 BOOL ret;
558 CERT_INFO certInfo = { 0 };
559 CRYPT_HASH_BLOB blob;
560
561 store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
562 CERT_STORE_CREATE_NEW_FLAG, NULL);
563 ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
564 if (!store)
565 return;
566
567 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
568 bigCert, sizeof(bigCert), CERT_STORE_ADD_NEW, NULL);
569 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
570 GetLastError());
571 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
572 bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, NULL);
573 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
574 GetLastError());
575 /* This has the same name as bigCert */
576 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
577 certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, NULL);
578 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
579 GetLastError());
580
581 /* Crashes
582 context = CertFindCertificateInStore(NULL, 0, 0, 0, NULL, NULL);
583 */
584
585 /* Check first cert's there, by issuer */
586 certInfo.Subject.pbData = subjectName;
587 certInfo.Subject.cbData = sizeof(subjectName);
588 certInfo.SerialNumber.pbData = serialNum;
589 certInfo.SerialNumber.cbData = sizeof(serialNum);
590 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
591 CERT_FIND_ISSUER_NAME, &certInfo.Subject, NULL);
592 ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
593 GetLastError());
594 if (context)
595 {
596 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
597 CERT_FIND_ISSUER_NAME, &certInfo.Subject, context);
598 ok(context != NULL, "Expected more than one cert\n");
599 if (context)
600 {
601 context = CertFindCertificateInStore(store, X509_ASN_ENCODING,
602 0, CERT_FIND_ISSUER_NAME, &certInfo.Subject, context);
603 ok(context == NULL, "Expected precisely two certs\n");
604 }
605 }
606
607 /* Check second cert's there as well, by subject name */
608 certInfo.Subject.pbData = subjectName2;
609 certInfo.Subject.cbData = sizeof(subjectName2);
610 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
611 CERT_FIND_SUBJECT_NAME, &certInfo.Subject, NULL);
612 ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
613 GetLastError());
614 if (context)
615 {
616 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
617 CERT_FIND_SUBJECT_NAME, &certInfo.Subject, context);
618 ok(context == NULL, "Expected one cert only\n");
619 }
620
621 /* Strange but true: searching for the subject cert requires you to set
622 * the issuer, not the subject
623 */
624 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
625 CERT_FIND_SUBJECT_CERT, &certInfo.Subject, NULL);
626 ok(context == NULL, "Expected no certificate\n");
627 certInfo.Subject.pbData = NULL;
628 certInfo.Subject.cbData = 0;
629 certInfo.Issuer.pbData = subjectName2;
630 certInfo.Issuer.cbData = sizeof(subjectName2);
631 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
632 CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
633 ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
634 GetLastError());
635 if (context)
636 {
637 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
638 CERT_FIND_SUBJECT_CERT, &certInfo.Subject, context);
639 ok(context == NULL, "Expected one cert only\n");
640 }
641
642 /* The nice thing about hashes, they're unique */
643 blob.pbData = bigCertHash;
644 blob.cbData = sizeof(bigCertHash);
645 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
646 CERT_FIND_SHA1_HASH, &blob, NULL);
647 ok(context != NULL, "CertFindCertificateInStore failed: %08x\n",
648 GetLastError());
649 if (context)
650 {
651 context = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0,
652 CERT_FIND_SHA1_HASH, &certInfo.Subject, context);
653 ok(context == NULL, "Expected one cert only\n");
654 }
655
656 CertCloseStore(store, 0);
657 }
658
659 static void testGetSubjectCert(void)
660 {
661 HCERTSTORE store;
662 PCCERT_CONTEXT context1, context2;
663 CERT_INFO info = { 0 };
664 BOOL ret;
665
666 store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
667 CERT_STORE_CREATE_NEW_FLAG, NULL);
668 ok(store != NULL, "CertOpenStore failed: %d\n", GetLastError());
669 if (!store)
670 return;
671
672 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
673 bigCert, sizeof(bigCert), CERT_STORE_ADD_ALWAYS, NULL);
674 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
675 GetLastError());
676 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
677 bigCert2, sizeof(bigCert2), CERT_STORE_ADD_NEW, &context1);
678 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
679 GetLastError());
680 ok(context1 != NULL, "Expected a context\n");
681 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
682 certWithUsage, sizeof(certWithUsage), CERT_STORE_ADD_NEW, NULL);
683 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
684 GetLastError());
685
686 context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
687 NULL);
688 ok(!context2 && GetLastError() == E_INVALIDARG,
689 "Expected E_INVALIDARG, got %08x\n", GetLastError());
690 context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
691 &info);
692 ok(!context2 && GetLastError() == CRYPT_E_NOT_FOUND,
693 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
694 info.SerialNumber.cbData = sizeof(serialNum);
695 info.SerialNumber.pbData = serialNum;
696 context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
697 &info);
698 ok(!context2 && GetLastError() == CRYPT_E_NOT_FOUND,
699 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
700 info.Issuer.cbData = sizeof(subjectName2);
701 info.Issuer.pbData = subjectName2;
702 context2 = CertGetSubjectCertificateFromStore(store, X509_ASN_ENCODING,
703 &info);
704 ok(context2 != NULL,
705 "CertGetSubjectCertificateFromStore failed: %08x\n", GetLastError());
706 /* Not only should this find a context, but it should be the same
707 * (same address) as context1.
708 */
709 ok(context1 == context2, "Expected identical context addresses\n");
710 CertFreeCertificateContext(context2);
711
712 CertFreeCertificateContext(context1);
713 CertCloseStore(store, 0);
714 }
715
716 /* This expires in 1970 or so */
717 static const BYTE expiredCert[] = { 0x30, 0x82, 0x01, 0x33, 0x30, 0x81, 0xe2,
718 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0xc4, 0xd7, 0x7f, 0x0e, 0x6f, 0xa6,
719 0x8c, 0xaa, 0x47, 0x47, 0x40, 0xe7, 0xb7, 0x0b, 0x4a, 0x7f, 0x30, 0x09, 0x06,
720 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d, 0x05, 0x00, 0x30, 0x1f, 0x31, 0x1d, 0x30,
721 0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63, 0x40,
722 0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x63,
723 0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x36, 0x39, 0x30, 0x31, 0x30, 0x31, 0x30,
724 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x37, 0x30, 0x30, 0x31, 0x30,
725 0x31, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x1f, 0x31, 0x1d, 0x30,
726 0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63, 0x40,
727 0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x63,
728 0x6f, 0x6d, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
729 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41,
730 0x00, 0xa1, 0xaf, 0x4a, 0xea, 0xa7, 0x83, 0x57, 0xc0, 0x37, 0x33, 0x7e, 0x29,
731 0x5e, 0x0d, 0xfc, 0x44, 0x74, 0x3a, 0x1d, 0xc3, 0x1b, 0x1d, 0x96, 0xed, 0x4e,
732 0xf4, 0x1b, 0x98, 0xec, 0x69, 0x1b, 0x04, 0xea, 0x25, 0xcf, 0xb3, 0x2a, 0xf5,
733 0xd9, 0x22, 0xd9, 0x8d, 0x08, 0x39, 0x81, 0xc6, 0xe0, 0x4f, 0x12, 0x37, 0x2a,
734 0x3f, 0x80, 0xa6, 0x6c, 0x67, 0x43, 0x3a, 0xdd, 0x95, 0x0c, 0xbb, 0x2f, 0x6b,
735 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
736 0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x8f, 0xa2, 0x5b, 0xd6, 0xdf, 0x34, 0xd0,
737 0xa2, 0xa7, 0x47, 0xf1, 0x13, 0x79, 0xd3, 0xf3, 0x39, 0xbd, 0x4e, 0x2b, 0xa3,
738 0xf4, 0x63, 0x37, 0xac, 0x5a, 0x0c, 0x5e, 0x4d, 0x0d, 0x54, 0x87, 0x4f, 0x31,
739 0xfb, 0xa0, 0xce, 0x8f, 0x9a, 0x2f, 0x4d, 0x48, 0xc6, 0x84, 0x8d, 0xf5, 0x70,
740 0x74, 0x17, 0xa5, 0xf3, 0x66, 0x47, 0x06, 0xd6, 0x64, 0x45, 0xbc, 0x52, 0xef,
741 0x49, 0xe5, 0xf9, 0x65, 0xf3 };
742
743 /* This expires in 2036 or so */
744 static const BYTE childOfExpired[] = { 0x30, 0x81, 0xcc, 0x30, 0x78, 0xa0,
745 0x03, 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
746 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x1f, 0x31, 0x1d,
747 0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x61, 0x72, 0x69, 0x63,
748 0x40, 0x63, 0x6f, 0x64, 0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e,
749 0x63, 0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x35, 0x30, 0x35,
750 0x31, 0x37, 0x31, 0x32, 0x34, 0x39, 0x5a, 0x17, 0x0d, 0x33, 0x36, 0x30, 0x35,
751 0x30, 0x35, 0x31, 0x37, 0x31, 0x32, 0x34, 0x39, 0x5a, 0x30, 0x15, 0x31, 0x13,
752 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e,
753 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03,
754 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
755 0x01, 0x05, 0x05, 0x00, 0x03, 0x41, 0x00, 0x20, 0x3b, 0xdb, 0x4d, 0x67, 0x50,
756 0xec, 0x73, 0x9d, 0xf9, 0x85, 0x5d, 0x18, 0xe9, 0xb4, 0x98, 0xe3, 0x31, 0xb7,
757 0x03, 0x0b, 0xc0, 0x39, 0x93, 0x56, 0x81, 0x0a, 0xfc, 0x78, 0xa8, 0x29, 0x42,
758 0x5f, 0x69, 0xfb, 0xbc, 0x5b, 0xf2, 0xa6, 0x2a, 0xbe, 0x91, 0x2c, 0xfc, 0x89,
759 0x69, 0x15, 0x18, 0x58, 0xe5, 0x02, 0x75, 0xf7, 0x2a, 0xb6, 0xa9, 0xfb, 0x47,
760 0x6a, 0x6e, 0x0a, 0x9b, 0xe9, 0xdc };
761
762 static void testGetIssuerCert(void)
763 {
764 BOOL ret;
765 PCCERT_CONTEXT parent, child;
766 DWORD flags = 0xffffffff;
767 HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
768 CERT_STORE_CREATE_NEW_FLAG, NULL);
769
770 ok(store != NULL, "CertOpenStore failed: %08x\n", GetLastError());
771
772 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
773 expiredCert, sizeof(expiredCert), CERT_STORE_ADD_ALWAYS, NULL);
774 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
775 GetLastError());
776
777 ret = CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING,
778 childOfExpired, sizeof(childOfExpired), CERT_STORE_ADD_ALWAYS, &child);
779 ok(ret, "CertAddEncodedCertificateToStore failed: %08x\n",
780 GetLastError());
781
782 /* These crash:
783 parent = CertGetIssuerCertificateFromStore(NULL, NULL, NULL, NULL);
784 parent = CertGetIssuerCertificateFromStore(store, NULL, NULL, NULL);
785 */
786 parent = CertGetIssuerCertificateFromStore(NULL, NULL, NULL, &flags);
787 ok(!parent && GetLastError() == E_INVALIDARG,
788 "Expected E_INVALIDARG, got %08x\n", GetLastError());
789 parent = CertGetIssuerCertificateFromStore(store, NULL, NULL, &flags);
790 ok(!parent && GetLastError() == E_INVALIDARG,
791 "Expected E_INVALIDARG, got %08x\n", GetLastError());
792 parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
793 ok(!parent && GetLastError() == E_INVALIDARG,
794 "Expected E_INVALIDARG, got %08x\n", GetLastError());
795 /* Confusing: the caller cannot set either of the
796 * CERT_STORE_NO_*_FLAGs, as these are not checks,
797 * they're results:
798 */
799 flags = CERT_STORE_NO_CRL_FLAG | CERT_STORE_NO_ISSUER_FLAG;
800 parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
801 ok(!parent && GetLastError() == E_INVALIDARG,
802 "Expected E_INVALIDARG, got %08x\n", GetLastError());
803 /* Perform no checks */
804 flags = 0;
805 parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
806 ok(parent != NULL, "CertGetIssuerCertificateFromStore failed: %08x\n",
807 GetLastError());
808 if (parent)
809 CertFreeCertificateContext(parent);
810 /* Check revocation and signature only */
811 flags = CERT_STORE_REVOCATION_FLAG | CERT_STORE_SIGNATURE_FLAG;
812 parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
813 ok(parent != NULL, "CertGetIssuerCertificateFromStore failed: %08x\n",
814 GetLastError());
815 /* Confusing: CERT_STORE_REVOCATION_FLAG succeeds when there is no CRL by
816 * setting CERT_STORE_NO_CRL_FLAG.
817 */
818 ok(flags == (CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG),
819 "Expected CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG, got %08x\n",
820 flags);
821 if (parent)
822 CertFreeCertificateContext(parent);
823 /* Now check just the time */
824 flags = CERT_STORE_TIME_VALIDITY_FLAG;
825 parent = CertGetIssuerCertificateFromStore(store, child, NULL, &flags);
826 ok(parent != NULL, "CertGetIssuerCertificateFromStore failed: %08x\n",
827 GetLastError());
828 /* Oops: the child is not expired, so the time validity check actually
829 * succeeds, even though the signing cert is expired.
830 */
831 ok(!flags, "Expected check to succeed, got %08x\n", flags);
832 if (parent)
833 CertFreeCertificateContext(parent);
834
835 CertFreeCertificateContext(child);
836 CertCloseStore(store, 0);
837 }
838
839 static void testCryptHashCert(void)
840 {
841 static const BYTE emptyHash[] = { 0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b,
842 0x0d, 0x32, 0x55, 0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07,
843 0x09 };
844 static const BYTE knownHash[] = { 0xae, 0x9d, 0xbf, 0x6d, 0xf5, 0x46, 0xee,
845 0x8b, 0xc5, 0x7a, 0x13, 0xba, 0xc2, 0xb1, 0x04, 0xf2, 0xbf, 0x52, 0xa8,
846 0xa2 };
847 static const BYTE toHash[] = "abcdefghijklmnopqrstuvwxyz0123456789.,;!?:";
848 BOOL ret;
849 BYTE hash[20];
850 DWORD hashLen = sizeof(hash);
851
852 /* NULL buffer and nonzero length crashes
853 ret = CryptHashCertificate(0, 0, 0, NULL, size, hash, &hashLen);
854 empty hash length also crashes
855 ret = CryptHashCertificate(0, 0, 0, buf, size, hash, NULL);
856 */
857 /* Test empty hash */
858 ret = CryptHashCertificate(0, 0, 0, toHash, sizeof(toHash), NULL,
859 &hashLen);
860 ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
861 ok(hashLen == sizeof(hash), "Got unexpected size of hash %d\n", hashLen);
862 /* Test with empty buffer */
863 ret = CryptHashCertificate(0, 0, 0, NULL, 0, hash, &hashLen);
864 ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
865 ok(!memcmp(hash, emptyHash, sizeof(emptyHash)),
866 "Unexpected hash of nothing\n");
867 /* Test a known value */
868 ret = CryptHashCertificate(0, 0, 0, toHash, sizeof(toHash), hash,
869 &hashLen);
870 ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
871 ok(!memcmp(hash, knownHash, sizeof(knownHash)), "Unexpected hash\n");
872 }
873
874 static void verifySig(HCRYPTPROV csp, const BYTE *toSign, size_t toSignLen,
875 const BYTE *sig, unsigned int sigLen)
876 {
877 HCRYPTHASH hash;
878 BOOL ret = CryptCreateHash(csp, CALG_SHA1, 0, 0, &hash);
879
880 ok(ret, "CryptCreateHash failed: %08x\n", GetLastError());
881 if (ret)
882 {
883 BYTE mySig[64];
884 DWORD mySigSize = sizeof(mySig);
885
886 ret = CryptHashData(hash, toSign, toSignLen, 0);
887 ok(ret, "CryptHashData failed: %08x\n", GetLastError());
888 /* use the A variant so the test can run on Win9x */
889 ret = CryptSignHashA(hash, AT_SIGNATURE, NULL, 0, mySig, &mySigSize);
890 ok(ret, "CryptSignHash failed: %08x\n", GetLastError());
891 if (ret)
892 {
893 ok(mySigSize == sigLen, "Expected sig length %d, got %d\n",
894 sigLen, mySigSize);
895 ok(!memcmp(mySig, sig, sigLen), "Unexpected signature\n");
896 }
897 CryptDestroyHash(hash);
898 }
899 }
900
901 /* Tests signing the certificate described by toBeSigned with the CSP passed in,
902 * using the algorithm with OID sigOID. The CSP is assumed to be empty, and a
903 * keyset named AT_SIGNATURE will be added to it. The signing key will be
904 * stored in *key, and the signature will be stored in sig. sigLen should be
905 * at least 64 bytes.
906 */
907 static void testSignCert(HCRYPTPROV csp, const CRYPT_DATA_BLOB *toBeSigned,
908 LPCSTR sigOID, HCRYPTKEY *key, BYTE *sig, DWORD *sigLen)
909 {
910 BOOL ret;
911 DWORD size = 0;
912 CRYPT_ALGORITHM_IDENTIFIER algoID = { NULL, { 0, NULL } };
913
914 /* These all crash
915 ret = CryptSignCertificate(0, 0, 0, NULL, 0, NULL, NULL, NULL, NULL);
916 ret = CryptSignCertificate(0, 0, 0, NULL, 0, NULL, NULL, NULL, &size);
917 ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
918 NULL, NULL, NULL, &size);
919 */
920 ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
921 &algoID, NULL, NULL, &size);
922 ok(!ret && GetLastError() == NTE_BAD_ALGID,
923 "Expected NTE_BAD_ALGID, got %08x\n", GetLastError());
924 algoID.pszObjId = (LPSTR)sigOID;
925 ret = CryptSignCertificate(0, 0, 0, toBeSigned->pbData, toBeSigned->cbData,
926 &algoID, NULL, NULL, &size);
927 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
928 "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
929 ret = CryptSignCertificate(0, AT_SIGNATURE, 0, toBeSigned->pbData,
930 toBeSigned->cbData, &algoID, NULL, NULL, &size);
931 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
932 "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
933
934 /* No keys exist in the new CSP yet.. */
935 ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
936 toBeSigned->cbData, &algoID, NULL, NULL, &size);
937 ok(!ret && (GetLastError() == NTE_BAD_KEYSET || GetLastError() ==
938 NTE_NO_KEY), "Expected NTE_BAD_KEYSET or NTE_NO_KEY, got %08x\n",
939 GetLastError());
940 ret = CryptGenKey(csp, AT_SIGNATURE, 0, key);
941 ok(ret, "CryptGenKey failed: %08x\n", GetLastError());
942 if (ret)
943 {
944 ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
945 toBeSigned->cbData, &algoID, NULL, NULL, &size);
946 ok(ret, "CryptSignCertificate failed: %08x\n", GetLastError());
947 ok(size <= *sigLen, "Expected size <= %d, got %d\n", *sigLen, size);
948 if (ret)
949 {
950 ret = CryptSignCertificate(csp, AT_SIGNATURE, 0, toBeSigned->pbData,
951 toBeSigned->cbData, &algoID, NULL, sig, &size);
952 ok(ret, "CryptSignCertificate failed: %08x\n", GetLastError());
953 if (ret)
954 {
955 *sigLen = size;
956 verifySig(csp, toBeSigned->pbData, toBeSigned->cbData, sig,
957 size);
958 }
959 }
960 }
961 }
962
963 static void testVerifyCertSig(HCRYPTPROV csp, const CRYPT_DATA_BLOB *toBeSigned,
964 LPCSTR sigOID, const BYTE *sig, DWORD sigLen)
965 {
966 CERT_SIGNED_CONTENT_INFO info;
967 LPBYTE cert = NULL;
968 DWORD size = 0;
969 BOOL ret;
970
971 if(pCryptVerifyCertificateSignatureEx) {
972 ret = pCryptVerifyCertificateSignatureEx(0, 0, 0, NULL, 0, NULL, 0, NULL);
973 ok(!ret && GetLastError() == E_INVALIDARG,
974 "Expected E_INVALIDARG, got %08x\n", GetLastError());
975 ret = pCryptVerifyCertificateSignatureEx(csp, 0, 0, NULL, 0, NULL, 0, NULL);
976 ok(!ret && GetLastError() == E_INVALIDARG,
977 "Expected E_INVALIDARG, got %08x\n", GetLastError());
978 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING, 0, NULL, 0,
979 NULL, 0, NULL);
980 ok(!ret && GetLastError() == E_INVALIDARG,
981 "Expected E_INVALIDARG, got %08x\n", GetLastError());
982 /* This crashes
983 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
984 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, NULL, 0, NULL, 0, NULL);
985 */
986 }
987 info.ToBeSigned.cbData = toBeSigned->cbData;
988 info.ToBeSigned.pbData = toBeSigned->pbData;
989 info.SignatureAlgorithm.pszObjId = (LPSTR)sigOID;
990 info.SignatureAlgorithm.Parameters.cbData = 0;
991 info.Signature.cbData = sigLen;
992 info.Signature.pbData = (BYTE *)sig;
993 info.Signature.cUnusedBits = 0;
994 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT, &info,
995 CRYPT_ENCODE_ALLOC_FLAG, NULL, (BYTE *)&cert, &size);
996 ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
997 if (cert)
998 {
999 CRYPT_DATA_BLOB certBlob = { 0, NULL };
1000 PCERT_PUBLIC_KEY_INFO pubKeyInfo = NULL;
1001
1002 if(pCryptVerifyCertificateSignatureEx) {
1003 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1004 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1005 ok(!ret && GetLastError() == CRYPT_E_ASN1_EOD,
1006 "Expected CRYPT_E_ASN1_EOD, got %08x\n", GetLastError());
1007 certBlob.cbData = 1;
1008 certBlob.pbData = (void *)0xdeadbeef;
1009 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1010 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1011 ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
1012 "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
1013 certBlob.cbData = size;
1014 certBlob.pbData = cert;
1015 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1016 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob, 0, NULL, 0, NULL);
1017 ok(!ret && GetLastError() == E_INVALIDARG,
1018 "Expected E_INVALIDARG, got %08x\n", GetLastError());
1019 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1020 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1021 CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL, NULL, 0, NULL);
1022 ok(!ret && GetLastError() == E_INVALIDARG,
1023 "Expected E_INVALIDARG, got %08x\n", GetLastError());
1024 /* This crashes
1025 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1026 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1027 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, NULL, 0, NULL);
1028 */
1029 }
1030 CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
1031 (LPSTR)sigOID, 0, NULL, NULL, &size);
1032 pubKeyInfo = HeapAlloc(GetProcessHeap(), 0, size);
1033 if (pubKeyInfo)
1034 {
1035 ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE,
1036 X509_ASN_ENCODING, (LPSTR)sigOID, 0, NULL, pubKeyInfo, &size);
1037 ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
1038 if (ret && pCryptVerifyCertificateSignatureEx)
1039 {
1040 ret = pCryptVerifyCertificateSignatureEx(csp, X509_ASN_ENCODING,
1041 CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB, &certBlob,
1042 CRYPT_VERIFY_CERT_SIGN_ISSUER_PUBKEY, pubKeyInfo, 0, NULL);
1043 ok(ret, "CryptVerifyCertificateSignatureEx failed: %08x\n",
1044 GetLastError());
1045 }
1046 HeapFree(GetProcessHeap(), 0, pubKeyInfo);
1047 }
1048 LocalFree(cert);
1049 }
1050 }
1051
1052 static BYTE emptyCert[] = { 0x30, 0x00 };
1053
1054 static void testCertSigs(void)
1055 {
1056 HCRYPTPROV csp;
1057 CRYPT_DATA_BLOB toBeSigned = { sizeof(emptyCert), emptyCert };
1058 BOOL ret;
1059 HCRYPTKEY key;
1060 BYTE sig[64];
1061 DWORD sigSize = sizeof(sig);
1062
1063 /* Just in case a previous run failed, delete this thing */
1064 CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1065 CRYPT_DELETEKEYSET);
1066 ret = CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1067 CRYPT_NEWKEYSET);
1068 ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
1069
1070 testSignCert(csp, &toBeSigned, szOID_RSA_SHA1RSA, &key, sig, &sigSize);
1071 testVerifyCertSig(csp, &toBeSigned, szOID_RSA_SHA1RSA, sig, sigSize);
1072
1073 CryptDestroyKey(key);
1074 CryptReleaseContext(csp, 0);
1075 ret = CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1076 CRYPT_DELETEKEYSET);
1077 }
1078
1079 static const BYTE md5SignedEmptyCert[] = {
1080 0x30,0x56,0x30,0x33,0x02,0x00,0x30,0x02,0x06,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,
1081 0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,
1082 0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x07,
1083 0x30,0x02,0x06,0x00,0x03,0x01,0x00,0x30,0x0c,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,
1084 0x0d,0x02,0x05,0x05,0x00,0x03,0x11,0x00,0xfb,0x0f,0x66,0x82,0x66,0xd9,0xe5,0xf8,
1085 0xd8,0xa2,0x55,0x2b,0xe1,0xa5,0xd9,0x04 };
1086 static const BYTE md5SignedEmptyCertNoNull[] = {
1087 0x30,0x54,0x30,0x33,0x02,0x00,0x30,0x02,0x06,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,
1088 0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,
1089 0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x07,
1090 0x30,0x02,0x06,0x00,0x03,0x01,0x00,0x30,0x0a,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,
1091 0x0d,0x02,0x05,0x03,0x11,0x00,0x04,0xd9,0xa5,0xe1,0x2b,0x55,0xa2,0xd8,0xf8,0xe5,
1092 0xd9,0x66,0x82,0x66,0x0f,0xfb };
1093
1094 static void testSignAndEncodeCert(void)
1095 {
1096 static char oid_rsa_md5rsa[] = szOID_RSA_MD5RSA;
1097 static char oid_rsa_md5[] = szOID_RSA_MD5;
1098 BOOL ret;
1099 DWORD size;
1100 CRYPT_ALGORITHM_IDENTIFIER algID = { 0 };
1101 CERT_INFO info = { 0 };
1102
1103 /* Crash
1104 ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, NULL, NULL, NULL,
1105 NULL);
1106 ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, NULL, NULL, NULL,
1107 &size);
1108 */
1109 ret = CryptSignAndEncodeCertificate(0, 0, 0, NULL, NULL, &algID, NULL, NULL,
1110 &size);
1111 ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1112 "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1113 ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING, NULL, NULL,
1114 &algID, NULL, NULL, &size);
1115 ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1116 "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1117 ret = CryptSignAndEncodeCertificate(0, 0, 0, X509_CERT_TO_BE_SIGNED, NULL,
1118 &algID, NULL, NULL, &size);
1119 ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1120 "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1121 ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1122 X509_CERT_TO_BE_SIGNED, NULL, &algID, NULL, NULL, &size);
1123 ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
1124 "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
1125 /* Crashes
1126 ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1127 X509_CERT_TO_BE_SIGNED, &info, NULL, NULL, NULL, &size);
1128 */
1129 ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1130 X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
1131 ok(!ret && GetLastError() == NTE_BAD_ALGID,
1132 "Expected NTE_BAD_ALGID, got %08x\n", GetLastError());
1133 algID.pszObjId = oid_rsa_md5rsa;
1134 ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1135 X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
1136 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1137 "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1138 algID.pszObjId = oid_rsa_md5;
1139 ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1140 X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, NULL, &size);
1141 ok(ret, "CryptSignAndEncodeCertificate failed: %08x\n", GetLastError());
1142 if (ret)
1143 {
1144 LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, size);
1145
1146 if (buf)
1147 {
1148 ret = CryptSignAndEncodeCertificate(0, 0, X509_ASN_ENCODING,
1149 X509_CERT_TO_BE_SIGNED, &info, &algID, NULL, buf, &size);
1150 ok(ret, "CryptSignAndEncodeCertificate failed: %08x\n",
1151 GetLastError());
1152 /* Tricky: because the NULL parameters may either be omitted or
1153 * included as an asn.1-encoded NULL (0x05,0x00), two different
1154 * values are allowed.
1155 */
1156 ok(size == sizeof(md5SignedEmptyCert) ||
1157 size == sizeof(md5SignedEmptyCertNoNull), "Unexpected size %d\n",
1158 size);
1159 if (size == sizeof(md5SignedEmptyCert))
1160 ok(!memcmp(buf, md5SignedEmptyCert, size),
1161 "Unexpected value\n");
1162 else if (size == sizeof(md5SignedEmptyCertNoNull))
1163 ok(!memcmp(buf, md5SignedEmptyCertNoNull, size),
1164 "Unexpected value\n");
1165 HeapFree(GetProcessHeap(), 0, buf);
1166 }
1167 }
1168 }
1169
1170 static void testCreateSelfSignCert(void)
1171 {
1172 PCCERT_CONTEXT context;
1173 CERT_NAME_BLOB name = { sizeof(subjectName), subjectName };
1174 HCRYPTPROV csp;
1175 BOOL ret;
1176 HCRYPTKEY key;
1177 CRYPT_KEY_PROV_INFO info;
1178
1179 /* This crashes:
1180 context = CertCreateSelfSignCertificate(0, NULL, 0, NULL, NULL, NULL, NULL,
1181 NULL);
1182 * Calling this with no first parameter creates a new key container, which
1183 * lasts beyond the test, so I don't test that. Nb: the generated key
1184 * name is a GUID.
1185 context = CertCreateSelfSignCertificate(0, &name, 0, NULL, NULL, NULL, NULL,
1186 NULL);
1187 */
1188
1189 /* Acquire a CSP */
1190 CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1191 CRYPT_DELETEKEYSET);
1192 ret = CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1193 CRYPT_NEWKEYSET);
1194 ok(ret, "CryptAcquireContext failed: %08x\n", GetLastError());
1195
1196 context = CertCreateSelfSignCertificate(csp, &name, 0, NULL, NULL, NULL,
1197 NULL, NULL);
1198 ok(!context && GetLastError() == NTE_NO_KEY,
1199 "Expected NTE_NO_KEY, got %08x\n", GetLastError());
1200 ret = CryptGenKey(csp, AT_SIGNATURE, 0, &key);
1201 ok(ret, "CryptGenKey failed: %08x\n", GetLastError());
1202 if (ret)
1203 {
1204 context = CertCreateSelfSignCertificate(csp, &name, 0, NULL, NULL, NULL,
1205 NULL, NULL);
1206 ok(context != NULL, "CertCreateSelfSignCertificate failed: %08x\n",
1207 GetLastError());
1208 if (context)
1209 {
1210 DWORD size = 0;
1211 PCRYPT_KEY_PROV_INFO info;
1212
1213 /* The context must have a key provider info property */
1214 ret = CertGetCertificateContextProperty(context,
1215 CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
1216 ok(ret && size, "Expected non-zero key provider info\n");
1217 if (size)
1218 {
1219 info = HeapAlloc(GetProcessHeap(), 0, size);
1220 if (info)
1221 {
1222 ret = CertGetCertificateContextProperty(context,
1223 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
1224 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
1225 GetLastError());
1226 if (ret)
1227 {
1228 /* Sanity-check the key provider */
1229 ok(!lstrcmpW(info->pwszContainerName, cspNameW),
1230 "Unexpected key container\n");
1231 ok(!lstrcmpW(info->pwszProvName, MS_DEF_PROV_W),
1232 "Unexpected provider\n");
1233 ok(info->dwKeySpec == AT_SIGNATURE,
1234 "Expected AT_SIGNATURE, got %d\n", info->dwKeySpec);
1235 }
1236 HeapFree(GetProcessHeap(), 0, info);
1237 }
1238 }
1239
1240 CertFreeCertificateContext(context);
1241 }
1242
1243 CryptDestroyKey(key);
1244 }
1245
1246 CryptReleaseContext(csp, 0);
1247 ret = CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1248 CRYPT_DELETEKEYSET);
1249
1250 /* do the same test with AT_KEYEXCHANGE and key info*/
1251 memset(&info,0,sizeof(info));
1252 info.dwProvType = PROV_RSA_FULL;
1253 info.dwKeySpec = AT_KEYEXCHANGE;
1254 info.pwszProvName = (LPWSTR) MS_DEF_PROV_W;
1255 info.pwszContainerName = cspNameW;
1256 context = CertCreateSelfSignCertificate(0, &name, 0, &info, NULL, NULL,
1257 NULL, NULL);
1258 ok(context != NULL, "CertCreateSelfSignCertificate failed: %08x\n",
1259 GetLastError());
1260 if (context)
1261 {
1262 DWORD size = 0;
1263 PCRYPT_KEY_PROV_INFO info;
1264
1265 /* The context must have a key provider info property */
1266 ret = CertGetCertificateContextProperty(context,
1267 CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
1268 ok(ret && size, "Expected non-zero key provider info\n");
1269 if (size)
1270 {
1271 info = HeapAlloc(GetProcessHeap(), 0, size);
1272 if (info)
1273 {
1274 ret = CertGetCertificateContextProperty(context,
1275 CERT_KEY_PROV_INFO_PROP_ID, info, &size);
1276 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
1277 GetLastError());
1278 if (ret)
1279 {
1280 /* Sanity-check the key provider */
1281 ok(!lstrcmpW(info->pwszContainerName, cspNameW),
1282 "Unexpected key container\n");
1283 ok(!lstrcmpW(info->pwszProvName, MS_DEF_PROV_W),
1284 "Unexpected provider\n");
1285 ok(info->dwKeySpec == AT_KEYEXCHANGE,
1286 "Expected AT_KEYEXCHANGE, got %d\n", info->dwKeySpec);
1287 }
1288 HeapFree(GetProcessHeap(), 0, info);
1289 }
1290 }
1291
1292 CertFreeCertificateContext(context);
1293 }
1294
1295 CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1296 CRYPT_DELETEKEYSET);
1297 }
1298
1299 static const LPCSTR keyUsages[] = { szOID_PKIX_KP_CODE_SIGNING,
1300 szOID_PKIX_KP_CLIENT_AUTH, szOID_RSA_RSA };
1301
1302 static void testKeyUsage(void)
1303 {
1304 BOOL ret;
1305 PCCERT_CONTEXT context;
1306 DWORD size;
1307
1308 /* Test base cases */
1309 ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, NULL);
1310 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1311 "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1312 size = 1;
1313 ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, &size);
1314 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1315 "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1316 size = 0;
1317 ret = CertGetEnhancedKeyUsage(NULL, 0, NULL, &size);
1318 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1319 "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1320 /* These crash
1321 ret = CertSetEnhancedKeyUsage(NULL, NULL);
1322 usage.cUsageIdentifier = 0;
1323 ret = CertSetEnhancedKeyUsage(NULL, &usage);
1324 */
1325 /* Test with a cert with no enhanced key usage extension */
1326 context = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
1327 sizeof(bigCert));
1328 ok(context != NULL, "CertCreateCertificateContext failed: %08x\n",
1329 GetLastError());
1330 if (context)
1331 {
1332 static const char oid[] = "1.2.3.4";
1333 BYTE buf[sizeof(CERT_ENHKEY_USAGE) + 2 * (sizeof(LPSTR) + sizeof(oid))];
1334 PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
1335
1336 ret = CertGetEnhancedKeyUsage(context, 0, NULL, NULL);
1337 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1338 "Expected ERROR_INVALID_PARAMETER, got %08x\n", GetLastError());
1339 size = 1;
1340 ret = CertGetEnhancedKeyUsage(context, 0, NULL, &size);
1341 if (ret)
1342 {
1343 /* Windows 2000, ME, or later: even though it succeeded, we expect
1344 * CRYPT_E_NOT_FOUND, which indicates there is no enhanced key
1345 * usage set for this cert (which implies it's valid for all uses.)
1346 */
1347 ok(GetLastError() == CRYPT_E_NOT_FOUND,
1348 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1349 ok(size == sizeof(CERT_ENHKEY_USAGE), "Wrong size %d\n", size);
1350 ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1351 ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1352 ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
1353 pUsage->cUsageIdentifier);
1354 }
1355 else
1356 {
1357 /* Windows NT, 95, or 98: it fails, and the last error is
1358 * CRYPT_E_NOT_FOUND.
1359 */
1360 ok(GetLastError() == CRYPT_E_NOT_FOUND,
1361 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1362 }
1363 /* I can add a usage identifier when no key usage has been set */
1364 ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
1365 ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
1366 GetLastError());
1367 size = sizeof(buf);
1368 ret = CertGetEnhancedKeyUsage(context,
1369 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1370 ok(ret && GetLastError() == 0,
1371 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1372 ok(pUsage->cUsageIdentifier == 1, "Expected 1 usage, got %d\n",
1373 pUsage->cUsageIdentifier);
1374 if (pUsage->cUsageIdentifier)
1375 ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
1376 "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
1377 /* Now set an empty key usage */
1378 pUsage->cUsageIdentifier = 0;
1379 ret = CertSetEnhancedKeyUsage(context, pUsage);
1380 ok(ret, "CertSetEnhancedKeyUsage failed: %08x\n", GetLastError());
1381 /* Shouldn't find it in the cert */
1382 size = sizeof(buf);
1383 ret = CertGetEnhancedKeyUsage(context,
1384 CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1385 ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
1386 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1387 /* Should find it as an extended property */
1388 ret = CertGetEnhancedKeyUsage(context,
1389 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1390 ok(ret && GetLastError() == 0,
1391 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1392 ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
1393 pUsage->cUsageIdentifier);
1394 /* Should find it as either */
1395 ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1396 ok(ret && GetLastError() == 0,
1397 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1398 ok(pUsage->cUsageIdentifier == 0, "Expected 0 usages, got %d\n",
1399 pUsage->cUsageIdentifier);
1400 /* Add a usage identifier */
1401 ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
1402 ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
1403 GetLastError());
1404 size = sizeof(buf);
1405 ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1406 ok(ret && GetLastError() == 0,
1407 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1408 ok(pUsage->cUsageIdentifier == 1, "Expected 1 identifier, got %d\n",
1409 pUsage->cUsageIdentifier);
1410 if (pUsage->cUsageIdentifier)
1411 ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
1412 "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
1413 /* Yep, I can re-add the same usage identifier */
1414 ret = CertAddEnhancedKeyUsageIdentifier(context, oid);
1415 ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
1416 GetLastError());
1417 size = sizeof(buf);
1418 ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1419 ok(ret && GetLastError() == 0,
1420 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1421 ok(pUsage->cUsageIdentifier == 2, "Expected 2 identifiers, got %d\n",
1422 pUsage->cUsageIdentifier);
1423 if (pUsage->cUsageIdentifier)
1424 ok(!strcmp(pUsage->rgpszUsageIdentifier[0], oid),
1425 "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[0]);
1426 if (pUsage->cUsageIdentifier >= 2)
1427 ok(!strcmp(pUsage->rgpszUsageIdentifier[1], oid),
1428 "Expected %s, got %s\n", oid, pUsage->rgpszUsageIdentifier[1]);
1429 /* Now set a NULL extended property--this deletes the property. */
1430 ret = CertSetEnhancedKeyUsage(context, NULL);
1431 ok(ret, "CertSetEnhancedKeyUsage failed: %08x\n", GetLastError());
1432 SetLastError(0xbaadcafe);
1433 size = sizeof(buf);
1434 ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1435 ok(GetLastError() == CRYPT_E_NOT_FOUND,
1436 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1437
1438 CertFreeCertificateContext(context);
1439 }
1440 /* Now test with a cert with an enhanced key usage extension */
1441 context = CertCreateCertificateContext(X509_ASN_ENCODING, certWithUsage,
1442 sizeof(certWithUsage));
1443 ok(context != NULL, "CertCreateCertificateContext failed: %08x\n",
1444 GetLastError());
1445 if (context)
1446 {
1447 LPBYTE buf = NULL;
1448 DWORD bufSize = 0, i;
1449
1450 /* The size may depend on what flags are used to query it, so I
1451 * realloc the buffer for each test.
1452 */
1453 ret = CertGetEnhancedKeyUsage(context,
1454 CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, NULL, &bufSize);
1455 ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1456 buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
1457 if (buf)
1458 {
1459 PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
1460
1461 /* Should find it in the cert */
1462 size = bufSize;
1463 ret = CertGetEnhancedKeyUsage(context,
1464 CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1465 ok(ret && GetLastError() == 0,
1466 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1467 ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
1468 pUsage->cUsageIdentifier);
1469 for (i = 0; i < pUsage->cUsageIdentifier; i++)
1470 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
1471 "Expected %s, got %s\n", keyUsages[i],
1472 pUsage->rgpszUsageIdentifier[i]);
1473 HeapFree(GetProcessHeap(), 0, buf);
1474 }
1475 ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
1476 ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1477 buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
1478 if (buf)
1479 {
1480 PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
1481
1482 /* Should find it as either */
1483 size = bufSize;
1484 ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1485 /* In Windows, GetLastError returns CRYPT_E_NOT_FOUND not found
1486 * here, even though the return is successful and the usage id
1487 * count is positive. I don't enforce that here.
1488 */
1489 ok(ret,
1490 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1491 ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
1492 pUsage->cUsageIdentifier);
1493 for (i = 0; i < pUsage->cUsageIdentifier; i++)
1494 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
1495 "Expected %s, got %s\n", keyUsages[i],
1496 pUsage->rgpszUsageIdentifier[i]);
1497 HeapFree(GetProcessHeap(), 0, buf);
1498 }
1499 /* Shouldn't find it as an extended property */
1500 ret = CertGetEnhancedKeyUsage(context,
1501 CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG, NULL, &size);
1502 ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
1503 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
1504 /* Adding a usage identifier overrides the cert's usage!? */
1505 ret = CertAddEnhancedKeyUsageIdentifier(context, szOID_RSA_RSA);
1506 ok(ret, "CertAddEnhancedKeyUsageIdentifier failed: %08x\n",
1507 GetLastError());
1508 ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
1509 ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1510 buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
1511 if (buf)
1512 {
1513 PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
1514
1515 /* Should find it as either */
1516 size = bufSize;
1517 ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1518 ok(ret,
1519 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1520 ok(pUsage->cUsageIdentifier == 1, "Expected 1 usage, got %d\n",
1521 pUsage->cUsageIdentifier);
1522 ok(!strcmp(pUsage->rgpszUsageIdentifier[0], szOID_RSA_RSA),
1523 "Expected %s, got %s\n", szOID_RSA_RSA,
1524 pUsage->rgpszUsageIdentifier[0]);
1525 HeapFree(GetProcessHeap(), 0, buf);
1526 }
1527 /* But querying the cert directly returns its usage */
1528 ret = CertGetEnhancedKeyUsage(context,
1529 CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, NULL, &bufSize);
1530 ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1531 buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
1532 if (buf)
1533 {
1534 PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
1535
1536 size = bufSize;
1537 ret = CertGetEnhancedKeyUsage(context,
1538 CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG, pUsage, &size);
1539 ok(ret,
1540 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1541 ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
1542 pUsage->cUsageIdentifier);
1543 for (i = 0; i < pUsage->cUsageIdentifier; i++)
1544 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
1545 "Expected %s, got %s\n", keyUsages[i],
1546 pUsage->rgpszUsageIdentifier[i]);
1547 HeapFree(GetProcessHeap(), 0, buf);
1548 }
1549 /* And removing the only usage identifier in the extended property
1550 * results in the cert's key usage being found.
1551 */
1552 ret = CertRemoveEnhancedKeyUsageIdentifier(context, szOID_RSA_RSA);
1553 ok(ret, "CertRemoveEnhancedKeyUsage failed: %08x\n", GetLastError());
1554 ret = CertGetEnhancedKeyUsage(context, 0, NULL, &bufSize);
1555 ok(ret, "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1556 buf = HeapAlloc(GetProcessHeap(), 0, bufSize);
1557 if (buf)
1558 {
1559 PCERT_ENHKEY_USAGE pUsage = (PCERT_ENHKEY_USAGE)buf;
1560
1561 /* Should find it as either */
1562 size = bufSize;
1563 ret = CertGetEnhancedKeyUsage(context, 0, pUsage, &size);
1564 ok(ret,
1565 "CertGetEnhancedKeyUsage failed: %08x\n", GetLastError());
1566 ok(pUsage->cUsageIdentifier == 3, "Expected 3 usages, got %d\n",
1567 pUsage->cUsageIdentifier);
1568 for (i = 0; i < pUsage->cUsageIdentifier; i++)
1569 ok(!strcmp(pUsage->rgpszUsageIdentifier[i], keyUsages[i]),
1570 "Expected %s, got %s\n", keyUsages[i],
1571 pUsage->rgpszUsageIdentifier[i]);
1572 HeapFree(GetProcessHeap(), 0, buf);
1573 }
1574
1575 CertFreeCertificateContext(context);
1576 }
1577 }
1578
1579 static void testCompareCertName(void)
1580 {
1581 static BYTE bogus[] = { 1, 2, 3, 4 };
1582 static BYTE bogusPrime[] = { 0, 1, 2, 3, 4 };
1583 static BYTE emptyPrime[] = { 0x30, 0x00, 0x01 };
1584 BOOL ret;
1585 CERT_NAME_BLOB blob1, blob2;
1586
1587 /* crashes
1588 ret = CertCompareCertificateName(0, NULL, NULL);
1589 */
1590 /* An empty name checks against itself.. */
1591 blob1.pbData = emptyCert;
1592 blob1.cbData = sizeof(emptyCert);
1593 ret = CertCompareCertificateName(0, &blob1, &blob1);
1594 ok(ret, "CertCompareCertificateName failed: %08x\n", GetLastError());
1595 /* It doesn't have to be a valid encoded name.. */
1596 blob1.pbData = bogus;
1597 blob1.cbData = sizeof(bogus);
1598 ret = CertCompareCertificateName(0, &blob1, &blob1);
1599 ok(ret, "CertCompareCertificateName failed: %08x\n", GetLastError());
1600 /* Leading zeroes matter.. */
1601 blob2.pbData = bogusPrime;
1602 blob2.cbData = sizeof(bogusPrime);
1603 ret = CertCompareCertificateName(0, &blob1, &blob2);
1604 ok(!ret, "Expected failure\n");
1605 /* As do trailing extra bytes. */
1606 blob2.pbData = emptyPrime;
1607 blob2.cbData = sizeof(emptyPrime);
1608 ret = CertCompareCertificateName(0, &blob1, &blob2);
1609 ok(!ret, "Expected failure\n");
1610 }
1611
1612 static BYTE int1[] = { 0x88, 0xff, 0xff, 0xff };
1613 static BYTE int2[] = { 0x88, 0xff };
1614 static BYTE int3[] = { 0x23, 0xff };
1615 static BYTE int4[] = { 0x7f, 0x00 };
1616 static BYTE int5[] = { 0x7f };
1617 static BYTE int6[] = { 0x80, 0x00, 0x00, 0x00 };
1618 static BYTE int7[] = { 0x80, 0x00 };
1619
1620 static struct IntBlobTest
1621 {
1622 CRYPT_INTEGER_BLOB blob1;
1623 CRYPT_INTEGER_BLOB blob2;
1624 BOOL areEqual;
1625 } intBlobs[] = {
1626 { { sizeof(int1), int1 }, { sizeof(int2), int2 }, TRUE },
1627 { { sizeof(int3), int3 }, { sizeof(int3), int3 }, TRUE },
1628 { { sizeof(int4), int4 }, { sizeof(int5), int5 }, TRUE },
1629 { { sizeof(int6), int6 }, { sizeof(int7), int7 }, TRUE },
1630 { { sizeof(int1), int1 }, { sizeof(int7), int7 }, FALSE },
1631 };
1632
1633 static void testCompareIntegerBlob(void)
1634 {
1635 DWORD i;
1636 BOOL ret;
1637
1638 for (i = 0; i < sizeof(intBlobs) / sizeof(intBlobs[0]); i++)
1639 {
1640 ret = CertCompareIntegerBlob(&intBlobs[i].blob1, &intBlobs[i].blob2);
1641 ok(ret == intBlobs[i].areEqual,
1642 "%d: expected blobs %s compare\n", i, intBlobs[i].areEqual ?
1643 "to" : "not to");
1644 }
1645 }
1646
1647 static void testComparePublicKeyInfo(void)
1648 {
1649 BOOL ret;
1650 CERT_PUBLIC_KEY_INFO info1 = { { 0 } }, info2 = { { 0 } };
1651 static CHAR oid_rsa_rsa[] = szOID_RSA_RSA;
1652 static CHAR oid_rsa_sha1rsa[] = szOID_RSA_SHA1RSA;
1653 static CHAR oid_x957_dsa[] = szOID_X957_DSA;
1654 static BYTE bits1[] = { 1, 0 };
1655 static BYTE bits2[] = { 0 };
1656 static BYTE bits3[] = { 1 };
1657
1658 /* crashes
1659 ret = CertComparePublicKeyInfo(0, NULL, NULL);
1660 */
1661 /* Empty public keys compare */
1662 ret = CertComparePublicKeyInfo(0, &info1, &info2);
1663 ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
1664 /* Different OIDs appear to compare */
1665 info1.Algorithm.pszObjId = oid_rsa_rsa;
1666 info2.Algorithm.pszObjId = oid_rsa_sha1rsa;
1667 ret = CertComparePublicKeyInfo(0, &info1, &info2);
1668 ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
1669 info2.Algorithm.pszObjId = oid_x957_dsa;
1670 ret = CertComparePublicKeyInfo(0, &info1, &info2);
1671 ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
1672 info1.PublicKey.cbData = sizeof(bits1);
1673 info1.PublicKey.pbData = bits1;
1674 info1.PublicKey.cUnusedBits = 0;
1675 info2.PublicKey.cbData = sizeof(bits1);
1676 info2.PublicKey.pbData = bits1;
1677 info2.PublicKey.cUnusedBits = 0;
1678 ret = CertComparePublicKeyInfo(0, &info1, &info2);
1679 ok(ret, "CertComparePublicKeyInfo failed: %08x\n", GetLastError());
1680 /* Even though they compare in their used bits, these do not compare */
1681 info1.PublicKey.cbData = sizeof(bits2);
1682 info1.PublicKey.pbData = bits2;
1683 info1.PublicKey.cUnusedBits = 0;
1684 info2.PublicKey.cbData = sizeof(bits3);
1685 info2.PublicKey.pbData = bits3;
1686 info2.PublicKey.cUnusedBits = 1;
1687 ret = CertComparePublicKeyInfo(0, &info1, &info2);
1688 /* Simple (non-comparing) case */
1689 ok(!ret, "Expected keys not to compare\n");
1690 info2.PublicKey.cbData = sizeof(bits1);
1691 info2.PublicKey.pbData = bits1;
1692 info2.PublicKey.cUnusedBits = 0;
1693 ret = CertComparePublicKeyInfo(0, &info1, &info2);
1694 ok(!ret, "Expected keys not to compare\n");
1695 }
1696
1697 static void testHashPublicKeyInfo(void)
1698 {
1699 BOOL ret;
1700 CERT_PUBLIC_KEY_INFO info = { { 0 } };
1701 DWORD len;
1702
1703 /* Crash
1704 ret = CryptHashPublicKeyInfo(0, 0, 0, 0, NULL, NULL, NULL);
1705 ret = CryptHashPublicKeyInfo(0, 0, 0, 0, &info, NULL, NULL);
1706 */
1707 ret = CryptHashPublicKeyInfo(0, 0, 0, 0, NULL, NULL, &len);
1708 ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1709 "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1710 ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, NULL, NULL, &len);
1711 ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
1712 "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
1713 ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, &info, NULL, &len);
1714 ok(ret, "CryptHashPublicKeyInfo failed: %08x\n", GetLastError());
1715 ok(len == 16, "Expected hash size 16, got %d\n", len);
1716 if (len == 16)
1717 {
1718 static const BYTE emptyHash[] = { 0xb8,0x51,0x3a,0x31,0x0e,0x9f,0x40,
1719 0x36,0x9c,0x92,0x45,0x1b,0x9d,0xc8,0xf9,0xf6 };
1720 BYTE buf[16];
1721
1722 ret = CryptHashPublicKeyInfo(0, 0, 0, X509_ASN_ENCODING, &info, buf,
1723 &len);
1724 ok(ret, "CryptHashPublicKeyInfo failed: %08x\n", GetLastError());
1725 ok(!memcmp(buf, emptyHash, len), "Unexpected hash\n");
1726 }
1727 }
1728
1729 static void testCompareCert(void)
1730 {
1731 CERT_INFO info1 = { 0 }, info2 = { 0 };
1732 BOOL ret;
1733
1734 /* Crashes
1735 ret = CertCompareCertificate(X509_ASN_ENCODING, NULL, NULL);
1736 */
1737
1738 /* Certs with the same issuer and serial number are equal, even if they
1739 * differ in other respects (like subject).
1740 */
1741 info1.SerialNumber.pbData = serialNum;
1742 info1.SerialNumber.cbData = sizeof(serialNum);
1743 info1.Issuer.pbData = subjectName;
1744 info1.Issuer.cbData = sizeof(subjectName);
1745 info1.Subject.pbData = subjectName2;
1746 info1.Subject.cbData = sizeof(subjectName2);
1747 info2.SerialNumber.pbData = serialNum;
1748 info2.SerialNumber.cbData = sizeof(serialNum);
1749 info2.Issuer.pbData = subjectName;
1750 info2.Issuer.cbData = sizeof(subjectName);
1751 info2.Subject.pbData = subjectName;
1752 info2.Subject.cbData = sizeof(subjectName);
1753 ret = CertCompareCertificate(X509_ASN_ENCODING, &info1, &info2);
1754 ok(ret, "Expected certs to be equal\n");
1755
1756 info2.Issuer.pbData = subjectName2;
1757 info2.Issuer.cbData = sizeof(subjectName2);
1758 ret = CertCompareCertificate(X509_ASN_ENCODING, &info1, &info2);
1759 ok(!ret, "Expected certs not to be equal\n");
1760 }
1761
1762 static void testVerifySubjectCert(void)
1763 {
1764 BOOL ret;
1765 DWORD flags;
1766 PCCERT_CONTEXT context1, context2;
1767
1768 /* Crashes
1769 ret = CertVerifySubjectCertificateContext(NULL, NULL, NULL);
1770 */
1771 flags = 0;
1772 ret = CertVerifySubjectCertificateContext(NULL, NULL, &flags);
1773 ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
1774 GetLastError());
1775 flags = CERT_STORE_NO_CRL_FLAG;
1776 ret = CertVerifySubjectCertificateContext(NULL, NULL, &flags);
1777 ok(!ret && GetLastError() == E_INVALIDARG,
1778 "Expected E_INVALIDARG, got %08x\n", GetLastError());
1779
1780 flags = 0;
1781 context1 = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
1782 sizeof(bigCert));
1783 ret = CertVerifySubjectCertificateContext(NULL, context1, &flags);
1784 ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
1785 GetLastError());
1786 ret = CertVerifySubjectCertificateContext(context1, NULL, &flags);
1787 ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
1788 GetLastError());
1789 ret = CertVerifySubjectCertificateContext(context1, context1, &flags);
1790 ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
1791 GetLastError());
1792
1793 context2 = CertCreateCertificateContext(X509_ASN_ENCODING,
1794 bigCertWithDifferentSubject, sizeof(bigCertWithDifferentSubject));
1795 SetLastError(0xdeadbeef);
1796 ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
1797 ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
1798 GetLastError());
1799 flags = CERT_STORE_REVOCATION_FLAG;
1800 ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
1801 ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
1802 GetLastError());
1803 ok(flags == (CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG),
1804 "Expected CERT_STORE_REVOCATION_FLAG | CERT_STORE_NO_CRL_FLAG, got %08x\n",
1805 flags);
1806 flags = CERT_STORE_SIGNATURE_FLAG;
1807 ret = CertVerifySubjectCertificateContext(context1, context2, &flags);
1808 ok(ret, "CertVerifySubjectCertificateContext failed; %08x\n",
1809 GetLastError());
1810 ok(flags == CERT_STORE_SIGNATURE_FLAG,
1811 "Expected CERT_STORE_SIGNATURE_FLAG, got %08x\n", flags);
1812 CertFreeCertificateContext(context2);
1813
1814 CertFreeCertificateContext(context1);
1815 }
1816
1817 static BYTE privKey[] = {
1818 0x07, 0x02, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x52, 0x53, 0x41, 0x32, 0x00,
1819 0x02, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x79, 0x10, 0x1c, 0xd0, 0x6b, 0x10,
1820 0x18, 0x30, 0x94, 0x61, 0xdc, 0x0e, 0xcb, 0x96, 0x4e, 0x21, 0x3f, 0x79, 0xcd,
1821 0xa9, 0x17, 0x62, 0xbc, 0xbb, 0x61, 0x4c, 0xe0, 0x75, 0x38, 0x6c, 0xf3, 0xde,
1822 0x60, 0x86, 0x03, 0x97, 0x65, 0xeb, 0x1e, 0x6b, 0xdb, 0x53, 0x85, 0xad, 0x68,
1823 0x21, 0xf1, 0x5d, 0xe7, 0x1f, 0xe6, 0x53, 0xb4, 0xbb, 0x59, 0x3e, 0x14, 0x27,
1824 0xb1, 0x83, 0xa7, 0x3a, 0x54, 0xe2, 0x8f, 0x65, 0x8e, 0x6a, 0x4a, 0xcf, 0x3b,
1825 0x1f, 0x65, 0xff, 0xfe, 0xf1, 0x31, 0x3a, 0x37, 0x7a, 0x8b, 0xcb, 0xc6, 0xd4,
1826 0x98, 0x50, 0x36, 0x67, 0xe4, 0xa1, 0xe8, 0x7e, 0x8a, 0xc5, 0x23, 0xf2, 0x77,
1827 0xf5, 0x37, 0x61, 0x49, 0x72, 0x59, 0xe8, 0x3d, 0xf7, 0x60, 0xb2, 0x77, 0xca,
1828 0x78, 0x54, 0x6d, 0x65, 0x9e, 0x03, 0x97, 0x1b, 0x61, 0xbd, 0x0c, 0xd8, 0x06,
1829 0x63, 0xe2, 0xc5, 0x48, 0xef, 0xb3, 0xe2, 0x6e, 0x98, 0x7d, 0xbd, 0x4e, 0x72,
1830 0x91, 0xdb, 0x31, 0x57, 0xe3, 0x65, 0x3a, 0x49, 0xca, 0xec, 0xd2, 0x02, 0x4e,
1831 0x22, 0x7e, 0x72, 0x8e, 0xf9, 0x79, 0x84, 0x82, 0xdf, 0x7b, 0x92, 0x2d, 0xaf,
1832 0xc9, 0xe4, 0x33, 0xef, 0x89, 0x5c, 0x66, 0x99, 0xd8, 0x80, 0x81, 0x47, 0x2b,
1833 0xb1, 0x66, 0x02, 0x84, 0x59, 0x7b, 0xc3, 0xbe, 0x98, 0x45, 0x4a, 0x3d, 0xdd,
1834 0xea, 0x2b, 0xdf, 0x4e, 0xb4, 0x24, 0x6b, 0xec, 0xe7, 0xd9, 0x0c, 0x45, 0xb8,
1835 0xbe, 0xca, 0x69, 0x37, 0x92, 0x4c, 0x38, 0x6b, 0x96, 0x6d, 0xcd, 0x86, 0x67,
1836 0x5c, 0xea, 0x54, 0x94, 0xa4, 0xca, 0xa4, 0x02, 0xa5, 0x21, 0x4d, 0xae, 0x40,
1837 0x8f, 0x9d, 0x51, 0x83, 0xf2, 0x3f, 0x33, 0xc1, 0x72, 0xb4, 0x1d, 0x94, 0x6e,
1838 0x7d, 0xe4, 0x27, 0x3f, 0xea, 0xff, 0xe5, 0x9b, 0xa7, 0x5e, 0x55, 0x8e, 0x0d,
1839 0x69, 0x1c, 0x7a, 0xff, 0x81, 0x9d, 0x53, 0x52, 0x97, 0x9a, 0x76, 0x79, 0xda,
1840 0x93, 0x32, 0x16, 0xec, 0x69, 0x51, 0x1a, 0x4e, 0xc3, 0xf1, 0x72, 0x80, 0x78,
1841 0x5e, 0x66, 0x4a, 0x8d, 0x85, 0x2f, 0x3f, 0xb2, 0xa7 };
1842
1843 static const BYTE selfSignedCert[] = {
1844 0x30, 0x82, 0x01, 0x1f, 0x30, 0x81, 0xce, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02,
1845 0x10, 0xeb, 0x0d, 0x57, 0x2a, 0x9c, 0x09, 0xba, 0xa4, 0x4a, 0xb7, 0x25, 0x49,
1846 0xd9, 0x3e, 0xb5, 0x73, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d,
1847 0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03,
1848 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30,
1849 0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, 0x32, 0x39, 0x30, 0x35, 0x30, 0x30,
1850 0x34, 0x36, 0x5a, 0x17, 0x0d, 0x30, 0x37, 0x30, 0x36, 0x32, 0x39, 0x31, 0x31,
1851 0x30, 0x30, 0x34, 0x36, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
1852 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e,
1853 0x67, 0x00, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
1854 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41,
1855 0x00, 0xe2, 0x54, 0x3a, 0xa7, 0x83, 0xb1, 0x27, 0x14, 0x3e, 0x59, 0xbb, 0xb4,
1856 0x53, 0xe6, 0x1f, 0xe7, 0x5d, 0xf1, 0x21, 0x68, 0xad, 0x85, 0x53, 0xdb, 0x6b,
1857 0x1e, 0xeb, 0x65, 0x97, 0x03, 0x86, 0x60, 0xde, 0xf3, 0x6c, 0x38, 0x75, 0xe0,
1858 0x4c, 0x61, 0xbb, 0xbc, 0x62, 0x17, 0xa9, 0xcd, 0x79, 0x3f, 0x21, 0x4e, 0x96,
1859 0xcb, 0x0e, 0xdc, 0x61, 0x94, 0x30, 0x18, 0x10, 0x6b, 0xd0, 0x1c, 0x10, 0x79,
1860 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
1861 0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x25, 0x90, 0x53, 0x34, 0xd9, 0x56, 0x41,
1862 0x5e, 0xdb, 0x7e, 0x01, 0x36, 0xec, 0x27, 0x61, 0x5e, 0xb7, 0x4d, 0x90, 0x66,
1863 0xa2, 0xe1, 0x9d, 0x58, 0x76, 0xd4, 0x9c, 0xba, 0x2c, 0x84, 0xc6, 0x83, 0x7a,
1864 0x22, 0x0d, 0x03, 0x69, 0x32, 0x1a, 0x6d, 0xcb, 0x0c, 0x15, 0xb3, 0x6b, 0xc7,
1865 0x0a, 0x8c, 0xb4, 0x5c, 0x34, 0x78, 0xe0, 0x3c, 0x9c, 0xe9, 0xf3, 0x30, 0x9f,
1866 0xa8, 0x76, 0x57, 0x92, 0x36 };
1867
1868 static const BYTE exportedPublicKeyBlob[] = {
1869 0x06,0x02,0x00,0x00,0x00,0xa4,0x00,0x00,0x52,0x53,0x41,0x31,0x00,0x02,0x00,0x00,
1870 0x01,0x00,0x01,0x00,0x79,0x10,0x1c,0xd0,0x6b,0x10,0x18,0x30,0x94,0x61,0xdc,0x0e,
1871 0xcb,0x96,0x4e,0x21,0x3f,0x79,0xcd,0xa9,0x17,0x62,0xbc,0xbb,0x61,0x4c,0xe0,0x75,
1872 0x38,0x6c,0xf3,0xde,0x60,0x86,0x03,0x97,0x65,0xeb,0x1e,0x6b,0xdb,0x53,0x85,0xad,
1873 0x68,0x21,0xf1,0x5d,0xe7,0x1f,0xe6,0x53,0xb4,0xbb,0x59,0x3e,0x14,0x27,0xb1,0x83,
1874 0xa7,0x3a,0x54,0xe2 };
1875
1876 static const BYTE asnEncodedPublicKey[] = {
1877 0x30,0x48,0x02,0x41,0x00,0xe2,0x54,0x3a,0xa7,0x83,0xb1,0x27,0x14,0x3e,0x59,0xbb,
1878 0xb4,0x53,0xe6,0x1f,0xe7,0x5d,0xf1,0x21,0x68,0xad,0x85,0x53,0xdb,0x6b,0x1e,0xeb,
1879 0x65,0x97,0x03,0x86,0x60,0xde,0xf3,0x6c,0x38,0x75,0xe0,0x4c,0x61,0xbb,0xbc,0x62,
1880 0x17,0xa9,0xcd,0x79,0x3f,0x21,0x4e,0x96,0xcb,0x0e,0xdc,0x61,0x94,0x30,0x18,0x10,
1881 0x6b,0xd0,0x1c,0x10,0x79,0x02,0x03,0x01,0x00,0x01 };
1882
1883 static void testAcquireCertPrivateKey(void)
1884 {
1885 BOOL ret;
1886 PCCERT_CONTEXT cert;
1887 HCRYPTPROV csp;
1888 DWORD size, keySpec;
1889 BOOL callerFree;
1890 CRYPT_KEY_PROV_INFO keyProvInfo;
1891 HCRYPTKEY key;
1892 WCHAR ms_def_prov_w[MAX_PATH];
1893
1894 lstrcpyW(ms_def_prov_w, MS_DEF_PROV_W);
1895
1896 keyProvInfo.pwszContainerName = cspNameW;
1897 keyProvInfo.pwszProvName = ms_def_prov_w;
1898 keyProvInfo.dwProvType = PROV_RSA_FULL;
1899 keyProvInfo.dwFlags = 0;
1900 keyProvInfo.cProvParam = 0;
1901 keyProvInfo.rgProvParam = NULL;
1902 keyProvInfo.dwKeySpec = AT_SIGNATURE;
1903
1904 CryptAcquireContextW(NULL, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1905 CRYPT_DELETEKEYSET);
1906
1907 cert = CertCreateCertificateContext(X509_ASN_ENCODING, selfSignedCert,
1908 sizeof(selfSignedCert));
1909
1910 /* Crash
1911 ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, NULL, NULL);
1912 ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, NULL,
1913 &callerFree);
1914 ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, NULL, &keySpec,
1915 NULL);
1916 ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, &csp, NULL, NULL);
1917 ret = CryptAcquireCertificatePrivateKey(NULL, 0, NULL, &csp, &keySpec,
1918 &callerFree);
1919 ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, NULL, NULL, NULL);
1920 */
1921
1922 /* Missing private key */
1923 ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, NULL, NULL);
1924 ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY,
1925 "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
1926 ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, &keySpec,
1927 &callerFree);
1928 ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY,
1929 "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
1930 CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0,
1931 &keyProvInfo);
1932 ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &csp, &keySpec,
1933 &callerFree);
1934 ok(!ret && GetLastError() == CRYPT_E_NO_KEY_PROPERTY,
1935 "Expected CRYPT_E_NO_KEY_PROPERTY, got %08x\n", GetLastError());
1936
1937 CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
1938 CRYPT_NEWKEYSET);
1939 ret = CryptImportKey(csp, privKey, sizeof(privKey), 0, 0, &key);
1940 ok(ret, "CryptImportKey failed: %08x\n", GetLastError());
1941 if (ret)
1942 {
1943 HCRYPTPROV certCSP;
1944 DWORD size;
1945 CERT_KEY_CONTEXT keyContext;
1946
1947 /* Don't cache provider */
1948 ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &certCSP,
1949 &keySpec, &callerFree);
1950 ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
1951 GetLastError());
1952 ok(callerFree, "Expected callerFree to be TRUE\n");
1953 CryptReleaseContext(certCSP, 0);
1954 ret = CryptAcquireCertificatePrivateKey(cert, 0, NULL, &certCSP,
1955 NULL, NULL);
1956 ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
1957 GetLastError());
1958 CryptReleaseContext(certCSP, 0);
1959
1960 /* Use the key prov info's caching (there shouldn't be any) */
1961 ret = CryptAcquireCertificatePrivateKey(cert,
1962 CRYPT_ACQUIRE_USE_PROV_INFO_FLAG, NULL, &certCSP, &keySpec,
1963 &callerFree);
1964 ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
1965 GetLastError());
1966 ok(callerFree, "Expected callerFree to be TRUE\n");
1967 CryptReleaseContext(certCSP, 0);
1968
1969 /* Cache it (and check that it's cached) */
1970 ret = CryptAcquireCertificatePrivateKey(cert,
1971 CRYPT_ACQUIRE_CACHE_FLAG, NULL, &certCSP, &keySpec, &callerFree);
1972 ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
1973 GetLastError());
1974 ok(!callerFree, "Expected callerFree to be FALSE\n");
1975 size = sizeof(keyContext);
1976 ret = CertGetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
1977 &keyContext, &size);
1978 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
1979 GetLastError());
1980
1981 /* Remove the cached provider */
1982 CryptReleaseContext(keyContext.hCryptProv, 0);
1983 CertSetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID, 0,
1984 NULL);
1985 /* Allow caching via the key prov info */
1986 keyProvInfo.dwFlags = CERT_SET_KEY_CONTEXT_PROP_ID;
1987 CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0,
1988 &keyProvInfo);
1989 /* Now use the key prov info's caching */
1990 ret = CryptAcquireCertificatePrivateKey(cert,
1991 CRYPT_ACQUIRE_USE_PROV_INFO_FLAG, NULL, &certCSP, &keySpec,
1992 &callerFree);
1993 ok(ret, "CryptAcquireCertificatePrivateKey failed: %08x\n",
1994 GetLastError());
1995 ok(!callerFree, "Expected callerFree to be FALSE\n");
1996 size = sizeof(keyContext);
1997 ret = CertGetCertificateContextProperty(cert, CERT_KEY_CONTEXT_PROP_ID,
1998 &keyContext, &size);
1999 ok(ret, "CertGetCertificateContextProperty failed: %08x\n",
2000 GetLastError());
2001
2002 CryptDestroyKey(key);
2003 }
2004
2005 /* Some sanity-checking on public key exporting */
2006 ret = CryptImportPublicKeyInfo(csp, X509_ASN_ENCODING,
2007 &cert->pCertInfo->SubjectPublicKeyInfo, &key);
2008 ok(ret, "CryptImportPublicKeyInfo failed: %08x\n", GetLastError());
2009 if (ret)
2010 {
2011 ret = CryptExportKey(key, 0, PUBLICKEYBLOB, 0, NULL, &size);
2012 ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
2013 if (ret)
2014 {
2015 LPBYTE buf = HeapAlloc(GetProcessHeap(), 0, size), encodedKey;
2016
2017 ret = CryptExportKey(key, 0, PUBLICKEYBLOB, 0, buf, &size);
2018 ok(ret, "CryptExportKey failed: %08x\n", GetLastError());
2019 ok(size == sizeof(exportedPublicKeyBlob), "Unexpected size %d\n",
2020 size);
2021 ok(!memcmp(buf, exportedPublicKeyBlob, size), "Unexpected value\n");
2022 ret = CryptEncodeObjectEx(X509_ASN_ENCODING, RSA_CSP_PUBLICKEYBLOB,
2023 buf, CRYPT_ENCODE_ALLOC_FLAG, NULL, &encodedKey, &size);
2024 ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
2025 if (ret)
2026 {
2027 ok(size == sizeof(asnEncodedPublicKey), "Unexpected size %d\n",
2028 size);
2029 ok(!memcmp(encodedKey, asnEncodedPublicKey, size),
2030 "Unexpected value\n");
2031 LocalFree(encodedKey);
2032 }
2033 HeapFree(GetProcessHeap(), 0, buf);
2034 }
2035 CryptDestroyKey(key);
2036 }
2037 ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
2038 NULL, 0, NULL, NULL, &size);
2039 ok(ret, "CryptExportPublicKeyInfoEx failed: %08x\n", GetLastError());
2040 if (ret)
2041 {
2042 PCERT_PUBLIC_KEY_INFO info = HeapAlloc(GetProcessHeap(), 0, size);
2043
2044 ret = CryptExportPublicKeyInfoEx(csp, AT_SIGNATURE, X509_ASN_ENCODING,
2045 NULL, 0, NULL, info, &size);
2046 ok(ret, "CryptExportPublicKeyInfoEx failed: %08x\n", GetLastError());
2047 if (ret)
2048 {
2049 ok(info->PublicKey.cbData == sizeof(asnEncodedPublicKey),
2050 "Unexpected size %d\n", info->PublicKey.cbData);
2051 ok(!memcmp(info->PublicKey.pbData, asnEncodedPublicKey,
2052 info->PublicKey.cbData), "Unexpected value\n");
2053 }
2054 HeapFree(GetProcessHeap(), 0, info);
2055 }
2056
2057 CryptReleaseContext(csp, 0);
2058 CryptAcquireContextW(&csp, cspNameW, MS_DEF_PROV_W, PROV_RSA_FULL,
2059 CRYPT_DELETEKEYSET);
2060
2061 CertFreeCertificateContext(cert);
2062 }
2063
2064 static void testGetPublicKeyLength(void)
2065 {
2066 static char oid_rsa_rsa[] = szOID_RSA_RSA;
2067 static char oid_rsa_dh[] = szOID_RSA_DH;
2068 static char bogusOID[] = "1.2.3";
2069 DWORD ret;
2070 CERT_PUBLIC_KEY_INFO info = { { 0 } };
2071 BYTE bogusKey[] = { 1, 2, 3, 4, 5, 6, 7, 8 };
2072 BYTE key[] = { 0x30,0x0f,0x02,0x08,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
2073 0x02,0x03,0x01,0x00,0x01 };
2074
2075 /* Crashes
2076 ret = CertGetPublicKeyLength(0, NULL);
2077 */
2078 /* With an empty public key info */
2079 SetLastError(0xdeadbeef);
2080 ret = CertGetPublicKeyLength(0, &info);
2081 ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
2082 "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
2083 ret, GetLastError());
2084 SetLastError(0xdeadbeef);
2085 ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2086 ok(ret == 0 && GetLastError() == CRYPT_E_ASN1_EOD,
2087 "Expected length 0 and CRYPT_E_ASN1_EOD, got length %d, %08x\n",
2088 ret, GetLastError());
2089 /* With a nearly-empty public key info */
2090 info.Algorithm.pszObjId = oid_rsa_rsa;
2091 SetLastError(0xdeadbeef);
2092 ret = CertGetPublicKeyLength(0, &info);
2093 ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
2094 "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
2095 ret, GetLastError());
2096 SetLastError(0xdeadbeef);
2097 ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2098 ok(ret == 0 && GetLastError() == CRYPT_E_ASN1_EOD,
2099 "Expected length 0 and CRYPT_E_ASN1_EOD, got length %d, %08x\n",
2100 ret, GetLastError());
2101 /* With a bogus key */
2102 info.PublicKey.cbData = sizeof(bogusKey);
2103 info.PublicKey.pbData = bogusKey;
2104 SetLastError(0xdeadbeef);
2105 ret = CertGetPublicKeyLength(0, &info);
2106 ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
2107 "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
2108 ret, GetLastError());
2109 SetLastError(0xdeadbeef);
2110 ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2111 ok(ret == 0 && GetLastError() == CRYPT_E_ASN1_BADTAG,
2112 "Expected length 0 and CRYPT_E_ASN1_BADTAGTAG, got length %d, %08x\n",
2113 ret, GetLastError());
2114 /* With a believable RSA key but a bogus OID */
2115 info.Algorithm.pszObjId = bogusOID;
2116 info.PublicKey.cbData = sizeof(key);
2117 info.PublicKey.pbData = key;
2118 SetLastError(0xdeadbeef);
2119 ret = CertGetPublicKeyLength(0, &info);
2120 ok(ret == 0 && GetLastError() == ERROR_FILE_NOT_FOUND,
2121 "Expected length 0 and ERROR_FILE_NOT_FOUND, got length %d, %08x\n",
2122 ret, GetLastError());
2123 SetLastError(0xdeadbeef);
2124 ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2125 ok(ret == 56, "Expected length 56, got %d\n", ret);
2126 /* An RSA key with the DH OID */
2127 info.Algorithm.pszObjId = oid_rsa_dh;
2128 SetLastError(0xdeadbeef);
2129 ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2130 ok(ret == 0 && GetLastError() == CRYPT_E_ASN1_BADTAG,
2131 "Expected length 0 and CRYPT_E_ASN1_BADTAG, got length %d, %08x\n",
2132 ret, GetLastError());
2133 /* With the RSA OID */
2134 info.Algorithm.pszObjId = oid_rsa_rsa;
2135 SetLastError(0xdeadbeef);
2136 ret = CertGetPublicKeyLength(X509_ASN_ENCODING, &info);
2137 ok(ret == 56, "Expected length 56, got %d\n", ret);
2138 }
2139
2140 START_TEST(cert)
2141 {
2142 init_function_pointers();
2143
2144 testAddCert();
2145 testCertProperties();
2146 testDupCert();
2147 testFindCert();
2148 testGetSubjectCert();
2149 testGetIssuerCert();
2150
2151 testCryptHashCert();
2152 testCertSigs();
2153 testSignAndEncodeCert();
2154 testCreateSelfSignCert();
2155 testKeyUsage();
2156 testCompareCertName();
2157 testCompareIntegerBlob();
2158 testComparePublicKeyInfo();
2159 testHashPublicKeyInfo();
2160 testCompareCert();
2161 testVerifySubjectCert();
2162 testAcquireCertPrivateKey();
2163 testGetPublicKeyLength();
2164 }
GSOC 2012 project to enhance the control panel