engines/e_capi.c

   1 /* engines/e_capi.c */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  */
  53
  54
  55 #include <stdio.h>
  56 #include <string.h>
  57 #include <openssl/crypto.h>
  58 #include <openssl/buffer.h>
  59 #include <openssl/rsa.h>
  60 #include <openssl/bn.h>
  61
  62 #ifdef OPENSSL_SYS_WIN32
  63 #ifndef OPENSSL_NO_CAPIENG
  64
  65 #if _WIN32_WINNT < 0x0500
  66 #define _WIN32_WINNT 0x0500
  67 #endif
  68
  69 #include <windows.h>
  70 #include <wincrypt.h>
  71
  72 #undef X509_EXTENSIONS
  73 #undef X509_CERT_PAIR
  74
  75 #include <openssl/engine.h>
  76 #include <openssl/pem.h>
  77
  78 #include "e_capi_err.h"
  79 #include "e_capi_err.c"
  80
  81
  82 static const char *engine_capi_id = "capi";
  83 static const char *engine_capi_name = "CryptoAPI ENGINE";
  84
  85 typedef struct CAPI_CTX_st CAPI_CTX;
  86 typedef struct CAPI_KEY_st CAPI_KEY;
  87
  88 static void capi_addlasterror(void);
  89 static void capi_adderror(DWORD err);
  90
  91 static void CAPI_trace(CAPI_CTX *ctx, char *format, ...);
  92
  93 static int capi_list_providers(CAPI_CTX *ctx, BIO *out);
  94 static int capi_list_containers(CAPI_CTX *ctx, BIO *out);
  95 int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename);
  96 void capi_free_key(CAPI_KEY *key);
  97 static int client_cert_select(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
  98
  99 static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore);
 100
 101 CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id);
 102
 103 static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
 104         UI_METHOD *ui_method, void *callback_data);
 105 static int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
 106              unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
 107 static int capi_rsa_priv_enc(int flen, const unsigned char *from,
 108                 unsigned char *to, RSA *rsa, int padding);
 109 static int capi_rsa_priv_dec(int flen, const unsigned char *from,
 110                 unsigned char *to, RSA *rsa, int padding);
 111 static int capi_rsa_free(RSA *rsa);
 112
 113 static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
 114                                                         DSA *dsa);
 115 static int capi_dsa_free(DSA *dsa);
 116
 117 static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
 118         STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
 119         STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);
 120
 121 /* This structure contains CAPI ENGINE specific data:
 122  * it contains various global options and affects how
 123  * other functions behave.
 124  */
 125
 126 #define CAPI_DBG_TRACE  2
 127 #define CAPI_DBG_ERROR  1
 128
 129 struct CAPI_CTX_st {
 130         int debug_level;
 131         char *debug_file;
 132         /* Parameters to use for container lookup */
 133         DWORD keytype;
 134         LPTSTR cspname;
 135         DWORD csptype;
 136         /* Certificate store name to use */
 137         LPTSTR storename;
 138         LPTSTR ssl_client_store;
 139
 140 /* Lookup string meanings in load_private_key */
 141 /* Substring of subject: uses "storename" */
 142 #define CAPI_LU_SUBSTR          0
 143 /* Friendly name: uses storename */
 144 #define CAPI_LU_FNAME           1
 145 /* Container name: uses cspname, keytype */
 146 #define CAPI_LU_CONTNAME        2
 147         int lookup_method;
 148 /* Info to dump with dumpcerts option */
 149 /* Issuer and serial name strings */
 150 #define CAPI_DMP_SUMMARY        0x1
 151 /* Friendly name */
 152 #define CAPI_DMP_FNAME          0x2
 153 /* Full X509_print dump */
 154 #define CAPI_DMP_FULL           0x4
 155 /* Dump PEM format certificate */
 156 #define CAPI_DMP_PEM            0x8
 157 /* Dump pseudo key (if possible) */
 158 #define CAPI_DMP_PSKEY          0x10
 159 /* Dump key info (if possible) */
 160 #define CAPI_DMP_PKEYINFO       0x20
 161
 162         DWORD dump_flags;
 163 };
 164
 165
 166 static CAPI_CTX *capi_ctx_new();
 167 static void capi_ctx_free(CAPI_CTX *ctx);
 168 static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check);
 169 static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx);
 170
 171 #define CAPI_CMD_LIST_CERTS             ENGINE_CMD_BASE
 172 #define CAPI_CMD_LOOKUP_CERT            (ENGINE_CMD_BASE + 1)
 173 #define CAPI_CMD_DEBUG_LEVEL            (ENGINE_CMD_BASE + 2)
 174 #define CAPI_CMD_DEBUG_FILE             (ENGINE_CMD_BASE + 3)
 175 #define CAPI_CMD_KEYTYPE                (ENGINE_CMD_BASE + 4)
 176 #define CAPI_CMD_LIST_CSPS              (ENGINE_CMD_BASE + 5)
 177 #define CAPI_CMD_SET_CSP_IDX            (ENGINE_CMD_BASE + 6)
 178 #define CAPI_CMD_SET_CSP_NAME           (ENGINE_CMD_BASE + 7)
 179 #define CAPI_CMD_SET_CSP_TYPE           (ENGINE_CMD_BASE + 8)
 180 #define CAPI_CMD_LIST_CONTAINERS        (ENGINE_CMD_BASE + 9)
 181 #define CAPI_CMD_LIST_OPTIONS           (ENGINE_CMD_BASE + 10)
 182 #define CAPI_CMD_LOOKUP_METHOD          (ENGINE_CMD_BASE + 11)
 183 #define CAPI_CMD_STORE_NAME             (ENGINE_CMD_BASE + 12)
 184
 185 static const ENGINE_CMD_DEFN capi_cmd_defns[] = {
 186         {CAPI_CMD_LIST_CERTS,
 187                 "list_certs",
 188                 "List all certificates in store",
 189                 ENGINE_CMD_FLAG_NO_INPUT},
 190         {CAPI_CMD_LOOKUP_CERT,
 191                 "lookup_cert",
 192                 "Lookup and output certificates",
 193                 ENGINE_CMD_FLAG_STRING},
 194         {CAPI_CMD_DEBUG_LEVEL,
 195                 "debug_level",
 196                 "debug level (1=errors, 2=trace)",
 197                 ENGINE_CMD_FLAG_NUMERIC},
 198         {CAPI_CMD_DEBUG_FILE,
 199                 "debug_file",
 200                 "debugging filename)",
 201                 ENGINE_CMD_FLAG_STRING},
 202         {CAPI_CMD_KEYTYPE,
 203                 "key_type",
 204                 "Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE",
 205                 ENGINE_CMD_FLAG_NUMERIC},
 206         {CAPI_CMD_LIST_CSPS,
 207                 "list_csps",
 208                 "List all CSPs",
 209                 ENGINE_CMD_FLAG_NO_INPUT},
 210         {CAPI_CMD_SET_CSP_IDX,
 211                 "csp_idx",
 212                 "Set CSP by index",
 213                 ENGINE_CMD_FLAG_NUMERIC},
 214         {CAPI_CMD_SET_CSP_NAME,
 215                 "csp_name",
 216                 "Set CSP name, (default CSP used if not specified)",
 217                 ENGINE_CMD_FLAG_STRING},
 218         {CAPI_CMD_SET_CSP_TYPE,
 219                 "csp_type",
 220                 "Set CSP type, (default RSA_PROV_FULL)",
 221                 ENGINE_CMD_FLAG_NUMERIC},
 222         {CAPI_CMD_LIST_CONTAINERS,
 223                 "list_containers",
 224                 "list container names",
 225                 ENGINE_CMD_FLAG_NO_INPUT},
 226         {CAPI_CMD_LIST_OPTIONS,
 227                 "list_options",
 228                 "Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, "
 229                 "32=private key info)",
 230                 ENGINE_CMD_FLAG_NUMERIC},
 231         {CAPI_CMD_LOOKUP_METHOD,
 232                 "lookup_method",
 233                 "Set key lookup method (1=substring, 2=friendlyname, 3=container name)",
 234                 ENGINE_CMD_FLAG_NUMERIC},
 235         {CAPI_CMD_STORE_NAME,
 236                 "store_name",
 237                 "certificate store name, default \"MY\"",
 238                 ENGINE_CMD_FLAG_STRING},
 239
 240         {0, NULL, NULL, 0}
 241         };
 242
 243 static int capi_idx = -1;
 244 static int rsa_capi_idx = -1;
 245 static int dsa_capi_idx = -1;
 246 static int cert_capi_idx = -1;
 247
 248 static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
 249         {
 250         int ret = 1;
 251         CAPI_CTX *ctx;
 252         BIO *out;
 253         if (capi_idx == -1)
 254                 {
 255                 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED);
 256                 return 0;
 257                 }
 258         ctx = ENGINE_get_ex_data(e, capi_idx);
 259         out = BIO_new_fp(stdout, BIO_NOCLOSE);
 260         switch (cmd)
 261                 {
 262                 case CAPI_CMD_LIST_CSPS:
 263                 ret = capi_list_providers(ctx, out);
 264                 break;
 265
 266                 case CAPI_CMD_LIST_CERTS:
 267                 ret = capi_list_certs(ctx, out, NULL);
 268                 break;
 269
 270                 case CAPI_CMD_LOOKUP_CERT:
 271                 ret = capi_list_certs(ctx, out, p);
 272                 break;
 273
 274                 case CAPI_CMD_LIST_CONTAINERS:
 275                 ret = capi_list_containers(ctx, out);
 276                 break;
 277
 278                 case CAPI_CMD_STORE_NAME:
 279                 if (ctx->storename)
 280                         OPENSSL_free(ctx->storename);
 281                 ctx->storename = BUF_strdup(p);
 282                 CAPI_trace(ctx, "Setting store name to %s\n", p);
 283                 break;
 284
 285                 case CAPI_CMD_DEBUG_LEVEL:
 286                 ctx->debug_level = (int)i;
 287                 CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level);
 288                 break;
 289
 290                 case CAPI_CMD_DEBUG_FILE:
 291                 ctx->debug_file = BUF_strdup(p);
 292                 CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file);
 293                 break;
 294
 295                 case CAPI_CMD_KEYTYPE:
 296                 ctx->keytype = i;
 297                 CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype);
 298                 break;
 299
 300                 case CAPI_CMD_SET_CSP_IDX:
 301                 ret = capi_ctx_set_provname_idx(ctx, i);
 302                 break;
 303
 304                 case CAPI_CMD_LIST_OPTIONS:
 305                 ctx->dump_flags = i;
 306                 break;
 307
 308                 case CAPI_CMD_LOOKUP_METHOD:
 309                 if (i < 1 || i > 3)
 310                         {
 311                         CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD);
 312                         return 0;
 313                         }
 314                 ctx->lookup_method = i;
 315                 break;
 316
 317                 case CAPI_CMD_SET_CSP_NAME:
 318                 ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1);
 319                 break;
 320
 321                 case CAPI_CMD_SET_CSP_TYPE:
 322                 ctx->csptype = i;
 323                 break;
 324
 325                 default:
 326                 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND);
 327                 ret = 0;
 328         }
 329
 330         BIO_free(out);
 331         return ret;
 332
 333         }
 334
 335 static RSA_METHOD capi_rsa_method =
 336         {
 337         "CryptoAPI RSA method",
 338         0,                              /* pub_enc */
 339         0,                              /* pub_dec */
 340         capi_rsa_priv_enc,              /* priv_enc */
 341         capi_rsa_priv_dec,              /* priv_dec */
 342         0,                              /* rsa_mod_exp */
 343         0,                              /* bn_mod_exp */
 344         0,                              /* init */
 345         capi_rsa_free,                  /* finish */
 346         RSA_FLAG_SIGN_VER,              /* flags */
 347         NULL,                           /* app_data */
 348         capi_rsa_sign,                  /* rsa_sign */
 349         0                               /* rsa_verify */
 350         };
 351
 352 static DSA_METHOD capi_dsa_method =
 353         {
 354         "CryptoAPI DSA method",
 355         capi_dsa_do_sign,               /* dsa_do_sign */
 356         0,                              /* dsa_sign_setup */
 357         0,                              /* dsa_do_verify */
 358         0,                              /* dsa_mod_exp */
 359         0,                              /* bn_mod_exp */
 360         0,                              /* init */
 361         capi_dsa_free,                  /* finish */
 362         0,                              /* flags */
 363         NULL,                           /* app_data */
 364         0,                              /* dsa_paramgen */
 365         0                               /* dsa_keygen */
 366         };
 367
 368 static int capi_init(ENGINE *e)
 369         {
 370         CAPI_CTX *ctx;
 371         const RSA_METHOD *ossl_rsa_meth;
 372         const DSA_METHOD *ossl_dsa_meth;
 373         capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0);
 374         cert_capi_idx = X509_get_ex_new_index(0, NULL, NULL, NULL, 0);
 375
 376         ctx = capi_ctx_new();
 377         if (!ctx || (capi_idx < 0))
 378                 goto memerr;
 379
 380         ENGINE_set_ex_data(e, capi_idx, ctx);
 381         /* Setup RSA_METHOD */
 382         rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
 383         ossl_rsa_meth = RSA_PKCS1_SSLeay();
 384         capi_rsa_method.rsa_pub_enc = ossl_rsa_meth->rsa_pub_enc;
 385         capi_rsa_method.rsa_pub_dec = ossl_rsa_meth->rsa_pub_dec;
 386         capi_rsa_method.rsa_mod_exp = ossl_rsa_meth->rsa_mod_exp;
 387         capi_rsa_method.bn_mod_exp = ossl_rsa_meth->bn_mod_exp;
 388
 389         /* Setup DSA Method */
 390         dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
 391         ossl_dsa_meth = DSA_OpenSSL();
 392         capi_dsa_method.dsa_do_verify = ossl_dsa_meth->dsa_do_verify;
 393         capi_dsa_method.dsa_mod_exp = ossl_dsa_meth->dsa_mod_exp;
 394         capi_dsa_method.bn_mod_exp = ossl_dsa_meth->bn_mod_exp;
 395
 396         return 1;
 397
 398         memerr:
 399         CAPIerr(CAPI_F_CAPI_INIT, ERR_R_MALLOC_FAILURE);
 400         return 0;
 401
 402         return 1;
 403         }
 404
 405 static int capi_destroy(ENGINE *e)
 406         {
 407         ERR_unload_CAPI_strings();
 408         return 1;
 409         }
 410
 411 static int capi_finish(ENGINE *e)
 412         {
 413         CAPI_CTX *ctx;
 414         ctx = ENGINE_get_ex_data(e, capi_idx);
 415         capi_ctx_free(ctx);
 416         ENGINE_set_ex_data(e, capi_idx, NULL);
 417         return 1;
 418         }
 419
 420
 421 /* CryptoAPI key application data. This contains
 422  * a handle to the private key container (for sign operations)
 423  * and a handle to the key (for decrypt operations).
 424  */
 425
 426 struct CAPI_KEY_st
 427         {
 428         /* Associated certificate context (if any) */
 429         PCCERT_CONTEXT pcert;
 430         HCRYPTPROV hprov;
 431         HCRYPTKEY key;
 432         DWORD keyspec;
 433         };
 434
 435 static int bind_capi(ENGINE *e)
 436         {
 437         if (!ENGINE_set_id(e, engine_capi_id)
 438                 || !ENGINE_set_name(e, engine_capi_name)
 439                 || !ENGINE_set_init_function(e, capi_init)
 440                 || !ENGINE_set_finish_function(e, capi_finish)
 441                 || !ENGINE_set_destroy_function(e, capi_destroy)
 442                 || !ENGINE_set_RSA(e, &capi_rsa_method)
 443                 || !ENGINE_set_DSA(e, &capi_dsa_method)
 444                 || !ENGINE_set_load_privkey_function(e, capi_load_privkey)
 445                 || !ENGINE_set_load_ssl_client_cert_function(e,
 446                                                 capi_load_ssl_client_cert)
 447                 || !ENGINE_set_cmd_defns(e, capi_cmd_defns)
 448                 || !ENGINE_set_ctrl_function(e, capi_ctrl))
 449                         return 0;
 450         ERR_load_CAPI_strings();
 451
 452         return 1;
 453
 454         }
 455
 456 #ifndef OPENSSL_NO_DYNAMIC_ENGINE
 457 static int bind_helper(ENGINE *e, const char *id)
 458         {
 459         if(id && (strcmp(id, engine_capi_id) != 0))
 460                 return 0;
 461         if(!bind_capi(e))
 462                 return 0;
 463         return 1;
 464         }
 465 IMPLEMENT_DYNAMIC_CHECK_FN()
 466 IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
 467 #else
 468 static ENGINE *engine_capi(void)
 469         {
 470         ENGINE *ret = ENGINE_new();
 471         if(!ret)
 472                 return NULL;
 473         if(!bind_capi(ret))
 474                 {
 475                 ENGINE_free(ret);
 476                 return NULL;
 477                 }
 478         return ret;
 479         }
 480
 481 void ENGINE_load_capi(void)
 482         {
 483         /* Copied from eng_[openssl|dyn].c */
 484         ENGINE *toadd = engine_capi();
 485         if(!toadd) return;
 486         ENGINE_add(toadd);
 487         ENGINE_free(toadd);
 488         ERR_clear_error();
 489         }
 490 #endif
 491
 492
 493 static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen)
 494         {
 495         int i;
 496         /* Reverse buffer in place: since this is a keyblob structure
 497          * that will be freed up after conversion anyway it doesn't
 498          * matter if we change it.
 499          */
 500         for(i = 0; i < binlen / 2; i++)
 501                 {
 502                 unsigned char c;
 503                 c = bin[i];
 504                 bin[i] = bin[binlen - i - 1];
 505                 bin[binlen - i - 1] = c;
 506                 }
 507
 508         if (!BN_bin2bn(bin, binlen, bn))
 509                 return 0;
 510         return 1;
 511         }
 512
 513 /* Given a CAPI_KEY get an EVP_PKEY structure */
 514
 515 static EVP_PKEY *capi_get_pkey(ENGINE *eng, CAPI_KEY *key)
 516         {
 517         unsigned char *pubkey = NULL;
 518         DWORD len;
 519         BLOBHEADER *bh;
 520         RSA *rkey = NULL;
 521         DSA *dkey = NULL;
 522         EVP_PKEY *ret = NULL;
 523         if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len))
 524                 {
 525                 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR);
 526                 capi_addlasterror();
 527                 return NULL;
 528                 }
 529
 530         pubkey = OPENSSL_malloc(len);
 531
 532         if (!pubkey)
 533                 goto memerr;
 534
 535         if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len))
 536                 {
 537                 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_ERROR);
 538                 capi_addlasterror();
 539                 goto err;
 540                 }
 541
 542         bh = (BLOBHEADER *)pubkey;
 543         if (bh->bType != PUBLICKEYBLOB)
 544                 {
 545                 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB);
 546                 goto err;
 547                 }
 548         if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX)
 549                 {
 550                 RSAPUBKEY *rp;
 551                 DWORD rsa_modlen;
 552                 unsigned char *rsa_modulus;
 553                 rp = (RSAPUBKEY *)(bh + 1);
 554                 if (rp->magic != 0x31415352)
 555                         {
 556                         char magstr[10];
 557                         BIO_snprintf(magstr, 10, "%lx", rp->magic);
 558                         CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
 559                         ERR_add_error_data(2, "magic=0x", magstr);
 560                         goto err;
 561                         }
 562                 rsa_modulus = (unsigned char *)(rp + 1);
 563                 rkey = RSA_new_method(eng);
 564                 if (!rkey)
 565                         goto memerr;
 566
 567                 rkey->e = BN_new();
 568                 rkey->n = BN_new();
 569
 570                 if (!rkey->e || !rkey->n)
 571                         goto memerr;
 572
 573                 if (!BN_set_word(rkey->e, rp->pubexp))
 574                         goto memerr;
 575
 576                 rsa_modlen = rp->bitlen / 8;
 577                 if (!lend_tobn(rkey->n, rsa_modulus, rsa_modlen))
 578                         goto memerr;
 579
 580                 RSA_set_ex_data(rkey, rsa_capi_idx, key);
 581
 582                 if (!(ret = EVP_PKEY_new()))
 583                         goto memerr;
 584
 585                 EVP_PKEY_assign_RSA(ret, rkey);
 586                 rkey = NULL;
 587
 588                 }
 589         else if (bh->aiKeyAlg == CALG_DSS_SIGN)
 590                 {
 591                 DSSPUBKEY *dp;
 592                 DWORD dsa_plen;
 593                 unsigned char *btmp;
 594                 dp = (DSSPUBKEY *)(bh + 1);
 595                 if (dp->magic != 0x31535344)
 596                         {
 597                         char magstr[10];
 598                         BIO_snprintf(magstr, 10, "%lx", dp->magic);
 599                         CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
 600                         ERR_add_error_data(2, "magic=0x", magstr);
 601                         goto err;
 602                         }
 603                 dsa_plen = dp->bitlen / 8;
 604                 btmp = (unsigned char *)(dp + 1);
 605                 dkey = DSA_new_method(eng);
 606                 if (!dkey)
 607                         goto memerr;
 608                 dkey->p = BN_new();
 609                 dkey->q = BN_new();
 610                 dkey->g = BN_new();
 611                 dkey->pub_key = BN_new();
 612                 if (!dkey->p || !dkey->q || !dkey->g || !dkey->pub_key)
 613                         goto memerr;
 614                 if (!lend_tobn(dkey->p, btmp, dsa_plen))
 615                         goto memerr;
 616                 btmp += dsa_plen;
 617                 if (!lend_tobn(dkey->q, btmp, 20))
 618                         goto memerr;
 619                 btmp += 20;
 620                 if (!lend_tobn(dkey->g, btmp, dsa_plen))
 621                         goto memerr;
 622                 btmp += dsa_plen;
 623                 if (!lend_tobn(dkey->pub_key, btmp, dsa_plen))
 624                         goto memerr;
 625                 btmp += dsa_plen;
 626
 627                 DSA_set_ex_data(dkey, dsa_capi_idx, key);
 628
 629                 if (!(ret = EVP_PKEY_new()))
 630                         goto memerr;
 631
 632                 EVP_PKEY_assign_DSA(ret, dkey);
 633                 dkey = NULL;
 634                 }
 635         else
 636                 {
 637                 char algstr[10];
 638                 BIO_snprintf(algstr, 10, "%lx", bh->aiKeyAlg);
 639                 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM);
 640                 ERR_add_error_data(2, "aiKeyAlg=0x", algstr);
 641                 goto err;
 642                 }
 643
 644
 645         err:
 646         if (pubkey)
 647                 OPENSSL_free(pubkey);
 648         if (!ret)
 649                 {
 650                 if (rkey)
 651                         RSA_free(rkey);
 652                 if (dkey)
 653                         DSA_free(dkey);
 654                 }
 655
 656         return ret;
 657
 658 memerr:
 659         CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, ERR_R_MALLOC_FAILURE);
 660         goto err;
 661
 662         }
 663
 664 static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
 665         UI_METHOD *ui_method, void *callback_data)
 666         {
 667         CAPI_CTX *ctx;
 668         CAPI_KEY *key;
 669         EVP_PKEY *ret;
 670         ctx = ENGINE_get_ex_data(eng, capi_idx);
 671
 672         if (!ctx)
 673                 {
 674                 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT);
 675                 return NULL;
 676                 }
 677
 678         key = capi_find_key(ctx, key_id);
 679
 680         if (!key)
 681                 return NULL;
 682
 683         ret = capi_get_pkey(eng, key);
 684
 685         if (!ret)
 686                 capi_free_key(key);
 687         return ret;
 688
 689         }
 690
 691 /* CryptoAPI RSA operations */
 692
 693 int capi_rsa_priv_enc(int flen, const unsigned char *from,
 694                 unsigned char *to, RSA *rsa, int padding)
 695         {
 696         CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED);
 697         return -1;
 698         }
 699
 700 int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
 701              unsigned char *sigret, unsigned int *siglen, const RSA *rsa)
 702         {
 703         ALG_ID alg;
 704         HCRYPTHASH hash;
 705         DWORD slen;
 706         unsigned int i;
 707         int ret = -1;
 708         CAPI_KEY *capi_key;
 709         CAPI_CTX *ctx;
 710
 711         ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
 712
 713         CAPI_trace(ctx, "Called CAPI_rsa_sign()\n");
 714
 715         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 716         if (!capi_key)
 717                 {
 718                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY);
 719                 return -1;
 720                 }
 721 /* Convert the signature type to a CryptoAPI algorithm ID */
 722         switch(dtype)
 723                 {
 724         case NID_sha1:
 725                 alg = CALG_SHA1;
 726                 break;
 727
 728         case NID_md5:
 729                 alg = CALG_MD5;
 730                 break;
 731
 732         case NID_md5_sha1:
 733                 alg = CALG_SSL3_SHAMD5;
 734                 break;
 735         default:
 736                 {
 737                 char algstr[10];
 738                 BIO_snprintf(algstr, 10, "%lx", dtype);
 739                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID);
 740                 ERR_add_error_data(2, "NID=0x", algstr);
 741                 return -1;
 742                 }
 743         }
 744
 745
 746
 747 /* Create the hash object */
 748         if(!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash))
 749                 {
 750                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
 751                 capi_addlasterror();
 752                 return -1;
 753                 }
 754 /* Set the hash value to the value passed */
 755
 756         if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0))
 757                 {
 758                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
 759                 capi_addlasterror();
 760                 goto err;
 761                 }
 762
 763
 764 /* Finally sign it */
 765         slen = RSA_size(rsa);
 766         if(!CryptSignHash(hash, capi_key->keyspec, NULL, 0, sigret, &slen))
 767                 {
 768                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH);
 769                 capi_addlasterror();
 770                 goto err;
 771                 }
 772         else
 773                 {
 774                 ret = 1;
 775                 /* Inplace byte reversal of signature */
 776                 for(i = 0; i < slen / 2; i++)
 777                         {
 778                         unsigned char c;
 779                         c = sigret[i];
 780                         sigret[i] = sigret[slen - i - 1];
 781                         sigret[slen - i - 1] = c;
 782                         }
 783                 *siglen = slen;
 784                 }
 785
 786         /* Now cleanup */
 787
 788 err:
 789         CryptDestroyHash(hash);
 790
 791         return ret;
 792         }
 793
 794 int capi_rsa_priv_dec(int flen, const unsigned char *from,
 795                 unsigned char *to, RSA *rsa, int padding)
 796         {
 797         int i;
 798         unsigned char *tmpbuf;
 799         CAPI_KEY *capi_key;
 800         CAPI_CTX *ctx;
 801         ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
 802
 803         CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n");
 804
 805
 806         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 807         if (!capi_key)
 808                 {
 809                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY);
 810                 return -1;
 811                 }
 812
 813         if(padding != RSA_PKCS1_PADDING)
 814                 {
 815                 char errstr[10];
 816                 BIO_snprintf(errstr, 10, "%d", padding);
 817                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING);
 818                 ERR_add_error_data(2, "padding=", errstr);
 819                 return -1;
 820                 }
 821
 822         /* Create temp reverse order version of input */
 823         if(!(tmpbuf = OPENSSL_malloc(flen)) )
 824                 {
 825                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, ERR_R_MALLOC_FAILURE);
 826                 return -1;
 827                 }
 828         for(i = 0; i < flen; i++)
 829                 tmpbuf[flen - i - 1] = from[i];
 830
 831         /* Finally decrypt it */
 832         if(!CryptDecrypt(capi_key->key, 0, TRUE, 0, tmpbuf, &flen))
 833                 {
 834                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR);
 835                 capi_addlasterror();
 836                 OPENSSL_free(tmpbuf);
 837                 return -1;
 838                 }
 839         else memcpy(to, tmpbuf, flen);
 840
 841         OPENSSL_free(tmpbuf);
 842
 843         return flen;
 844         }
 845
 846 static int capi_rsa_free(RSA *rsa)
 847         {
 848         CAPI_KEY *capi_key;
 849         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 850         capi_free_key(capi_key);
 851         RSA_set_ex_data(rsa, rsa_capi_idx, 0);
 852         return 1;
 853         }
 854
 855 /* CryptoAPI DSA operations */
 856
 857 static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
 858                                                                 DSA *dsa)
 859         {
 860         HCRYPTHASH hash;
 861         DWORD slen;
 862         DSA_SIG *ret = NULL;
 863         CAPI_KEY *capi_key;
 864         CAPI_CTX *ctx;
 865         unsigned char csigbuf[40];
 866
 867         ctx = ENGINE_get_ex_data(dsa->engine, capi_idx);
 868
 869         CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n");
 870
 871         capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
 872
 873         if (!capi_key)
 874                 {
 875                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY);
 876                 return NULL;
 877                 }
 878
 879         if (dlen != 20)
 880                 {
 881                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH);
 882                 return NULL;
 883                 }
 884
 885         /* Create the hash object */
 886         if(!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash))
 887                 {
 888                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
 889                 capi_addlasterror();
 890                 return NULL;
 891                 }
 892
 893         /* Set the hash value to the value passed */
 894         if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0))
 895                 {
 896                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
 897                 capi_addlasterror();
 898                 goto err;
 899                 }
 900
 901
 902         /* Finally sign it */
 903         slen = sizeof(csigbuf);
 904         if(!CryptSignHash(hash, capi_key->keyspec, NULL, 0, csigbuf, &slen))
 905                 {
 906                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH);
 907                 capi_addlasterror();
 908                 goto err;
 909                 }
 910         else
 911                 {
 912                 ret = DSA_SIG_new();
 913                 if (!ret)
 914                         goto err;
 915                 ret->r = BN_new();
 916                 ret->s = BN_new();
 917                 if (!ret->r || !ret->s)
 918                         goto err;
 919                 if (!lend_tobn(ret->r, csigbuf, 20)
 920                         || !lend_tobn(ret->s, csigbuf + 20, 20))
 921                         {
 922                         DSA_SIG_free(ret);
 923                         ret = NULL;
 924                         goto err;
 925                         }
 926                 }
 927
 928         /* Now cleanup */
 929
 930 err:
 931         OPENSSL_cleanse(csigbuf, 40);
 932         CryptDestroyHash(hash);
 933         return ret;
 934         }
 935
 936 static int capi_dsa_free(DSA *dsa)
 937         {
 938         CAPI_KEY *capi_key;
 939         capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
 940         capi_free_key(capi_key);
 941         DSA_set_ex_data(dsa, dsa_capi_idx, 0);
 942         return 1;
 943         }
 944
 945 static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, va_list argptr)
 946         {
 947         BIO *out;
 948
 949         if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file))
 950                 return;
 951         out = BIO_new_file(ctx->debug_file, "a+");
 952         BIO_vprintf(out, format, argptr);
 953         BIO_free(out);
 954         }
 955
 956 static void CAPI_trace(CAPI_CTX *ctx, char *format, ...)
 957         {
 958         va_list args;
 959         va_start(args, format);
 960         capi_vtrace(ctx, CAPI_DBG_TRACE, format, args);
 961         va_end(args);
 962         }
 963
 964 static void capi_addlasterror(void)
 965         {
 966         capi_adderror(GetLastError());
 967         }
 968
 969 static void capi_adderror(DWORD err)
 970         {
 971         char errstr[10];
 972         BIO_snprintf(errstr, 10, "%lX", err);
 973         ERR_add_error_data(2, "Error code= 0x", errstr);
 974         }
 975
 976 static char *wide_to_asc(LPWSTR wstr)
 977         {
 978         char *str;
 979         if (!wstr)
 980                 return NULL;
 981         str = OPENSSL_malloc(wcslen(wstr) + 1);
 982         if (!str)
 983                 {
 984                 CAPIerr(CAPI_F_WIDE_TO_ASC, ERR_R_MALLOC_FAILURE);
 985                 return NULL;
 986                 }
 987         sprintf(str, "%S", wstr);
 988         return str;
 989         }
 990
 991 static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, DWORD idx)
 992         {
 993         LPSTR name;
 994         DWORD len, err;
 995         CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx);
 996         if (!CryptEnumProviders(idx, NULL, 0, ptype, NULL, &len))
 997                 {
 998                 err = GetLastError();
 999                 if (err == ERROR_NO_MORE_ITEMS)
1000                         return 2;
1001                 CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
1002                 capi_adderror(err);
1003                 return 0;
1004                 }
1005         name = OPENSSL_malloc(len);
1006                 if (!CryptEnumProviders(idx, NULL, 0, ptype, name, &len))
1007                 {
1008                 err = GetLastError();
1009                 if (err == ERROR_NO_MORE_ITEMS)
1010                         return 2;
1011                 CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
1012                 capi_adderror(err);
1013                 return 0;
1014                 }
1015         *pname = name;
1016         CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", name, *ptype);
1017
1018         return 1;
1019         }
1020
1021 static int capi_list_providers(CAPI_CTX *ctx, BIO *out)
1022         {
1023         DWORD idx, ptype;
1024         int ret;
1025         LPTSTR provname = NULL;
1026         CAPI_trace(ctx, "capi_list_providers\n");
1027         BIO_printf(out, "Available CSPs:\n");
1028         for(idx = 0; ; idx++)
1029                 {
1030                 ret = capi_get_provname(ctx, &provname, &ptype, idx);
1031                 if (ret == 2)
1032                         break;
1033                 if (ret == 0)
1034                         break;
1035                 BIO_printf(out, "%d. %s, type %d\n", idx, provname, ptype);
1036                 OPENSSL_free(provname);
1037                 }
1038         return 1;
1039         }
1040
1041 static int capi_list_containers(CAPI_CTX *ctx, BIO *out)
1042         {
1043         int ret = 1;
1044         HCRYPTPROV hprov;
1045         DWORD err, idx, flags, buflen = 0, clen;
1046         LPSTR cname;
1047         CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, ctx->csptype);
1048         if (!CryptAcquireContext(&hprov, NULL, ctx->cspname, ctx->csptype, CRYPT_VERIFYCONTEXT))
1049                 {
1050                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1051                 capi_addlasterror();
1052                 return 0;
1053                 }
1054         if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, CRYPT_FIRST))
1055                 {
1056                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
1057                 capi_addlasterror();
1058                 return 0;
1059                 }
1060         CAPI_trace(ctx, "Got max container len %d\n", buflen);
1061         if (buflen == 0)
1062                 buflen = 1024;
1063         cname = OPENSSL_malloc(buflen);
1064         if (!cname)
1065                 {
1066                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE);
1067                 goto err;
1068                 }
1069
1070         for (idx = 0;;idx++)
1071                 {
1072                 clen = buflen;
1073                 cname[0] = 0;
1074
1075                 if (idx == 0)
1076                         flags = CRYPT_FIRST;
1077                 else
1078                         flags = 0;
1079                 if(!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, cname, &clen, flags))
1080                         {
1081                         err = GetLastError();
1082                         if (err == ERROR_NO_MORE_ITEMS)
1083                                 goto done;
1084                         CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
1085                         capi_adderror(err);
1086                         goto err;
1087                         }
1088                 CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", cname, clen, idx, flags);
1089                 if (!cname[0] && (clen == buflen))
1090                         {
1091                         CAPI_trace(ctx, "Enumerate bug: using workaround\n");
1092                         goto done;
1093                         }
1094                 BIO_printf(out, "%d. %s\n", idx, cname);
1095                 }
1096         err:
1097
1098         ret = 0;
1099
1100         done:
1101         if (cname)
1102                 OPENSSL_free(cname);
1103         CryptReleaseContext(hprov, 0);
1104
1105         return ret;
1106         }
1107
1108 CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1109         {
1110         DWORD len;
1111         CRYPT_KEY_PROV_INFO *pinfo;
1112
1113         if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &len))
1114                 return NULL;
1115         pinfo = OPENSSL_malloc(len);
1116         if (!pinfo)
1117                 {
1118                 CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, ERR_R_MALLOC_FAILURE);
1119                 return NULL;
1120                 }
1121         if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, pinfo, &len))
1122                 {
1123                 CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO);
1124                 capi_addlasterror();
1125                 OPENSSL_free(pinfo);
1126                 return NULL;
1127                 }
1128         return pinfo;
1129         }
1130
1131 static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, CRYPT_KEY_PROV_INFO *pinfo)
1132         {
1133         char *provname = NULL, *contname = NULL;
1134         if (!pinfo)
1135                 {
1136                 BIO_printf(out, "  No Private Key\n");
1137                 return;
1138                 }
1139         provname = wide_to_asc(pinfo->pwszProvName);
1140         contname = wide_to_asc(pinfo->pwszContainerName);
1141         if (!provname || !contname)
1142                 goto err;
1143
1144         BIO_printf(out, "  Private Key Info:\n");
1145         BIO_printf(out, "    Provider Name:  %s, Provider Type %d\n", provname, pinfo->dwProvType);
1146         BIO_printf(out, "    Container Name: %s, Key Type %d\n", contname, pinfo->dwKeySpec);
1147         err:
1148         if (provname)
1149                 OPENSSL_free(provname);
1150         if (contname)
1151                 OPENSSL_free(contname);
1152         }
1153
1154 char * capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1155         {
1156         LPWSTR wfname;
1157         DWORD dlen;
1158
1159         CAPI_trace(ctx, "capi_cert_get_fname\n");
1160         if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &dlen))
1161                 return NULL;
1162         wfname = OPENSSL_malloc(dlen);
1163         if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, wfname, &dlen))
1164                 {
1165                 char *fname = wide_to_asc(wfname);
1166                 OPENSSL_free(wfname);
1167                 return fname;
1168                 }
1169         CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME);
1170         capi_addlasterror();
1171
1172         OPENSSL_free(wfname);
1173         return NULL;
1174         }
1175
1176
1177 void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert)
1178         {
1179         X509 *x;
1180         unsigned char *p;
1181         unsigned long flags = ctx->dump_flags;
1182         if (flags & CAPI_DMP_FNAME)
1183                 {
1184                 char *fname;
1185                 fname = capi_cert_get_fname(ctx, cert);
1186                 if (fname)
1187                         {
1188                         BIO_printf(out, "  Friendly Name \"%s\"\n", fname);
1189                         OPENSSL_free(fname);
1190                         }
1191                 else
1192                         BIO_printf(out, "  <No Friendly Name>\n");
1193                 }
1194
1195         p = cert->pbCertEncoded;
1196         x = d2i_X509(NULL, &p, cert->cbCertEncoded);
1197         if (!x)
1198                 BIO_printf(out, "  <Can't parse certificate>\n");
1199         if (flags & CAPI_DMP_SUMMARY)
1200                 {
1201                 BIO_printf(out, "  Subject: ");
1202                 X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);
1203                 BIO_printf(out, "\n  Issuer: ");
1204                 X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);
1205                 BIO_printf(out, "\n");
1206                 }
1207         if (flags & CAPI_DMP_FULL)
1208                 X509_print_ex(out, x, XN_FLAG_ONELINE,0);
1209
1210         if (flags & CAPI_DMP_PKEYINFO)
1211                 {
1212                 CRYPT_KEY_PROV_INFO *pinfo;
1213                 pinfo = capi_get_prov_info(ctx, cert);
1214                 capi_dump_prov_info(ctx, out, pinfo);
1215                 if (pinfo)
1216                         OPENSSL_free(pinfo);
1217                 }
1218
1219         if (flags & CAPI_DMP_PEM)
1220                 PEM_write_bio_X509(out, x);
1221         X509_free(x);
1222         }
1223
1224 HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename)
1225         {
1226         HCERTSTORE hstore;
1227
1228         if (!storename)
1229                 storename = ctx->storename;
1230         if (!storename)
1231                 storename = "MY";
1232         CAPI_trace(ctx, "Opening certificate store %s\n", storename);
1233
1234         hstore = CertOpenSystemStore(0, storename);
1235         if (!hstore)
1236                 {
1237                 CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE);
1238                 capi_addlasterror();
1239                 }
1240         return hstore;
1241         }
1242
1243 int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id)
1244         {
1245         char *storename;
1246         int idx;
1247         int ret = 1;
1248         HCERTSTORE hstore;
1249         PCCERT_CONTEXT cert = NULL;
1250
1251         storename = ctx->storename;
1252         if (!storename)
1253                 storename = "MY";
1254         CAPI_trace(ctx, "Listing certs for store %s\n", storename);
1255
1256         hstore = capi_open_store(ctx, storename);
1257         if (!hstore)
1258                 return 0;
1259         if (id)
1260                 {
1261                 cert = capi_find_cert(ctx, id, hstore);
1262                 if (!cert)
1263                         {
1264                         ret = 0;
1265                         goto err;
1266                         }
1267                 capi_dump_cert(ctx, out, cert);
1268                 CertFreeCertificateContext(cert);
1269                 }
1270         else
1271                 {
1272                 for(idx = 0;;idx++)
1273                         {
1274                         LPWSTR fname = NULL;
1275                         cert = CertEnumCertificatesInStore(hstore, cert);
1276                         if (!cert)
1277                                 break;
1278                         BIO_printf(out, "Certificate %d\n", idx);
1279                         capi_dump_cert(ctx, out, cert);
1280                         }
1281                 }
1282         err:
1283         CertCloseStore(hstore, 0);
1284         return ret;
1285         }
1286
1287 static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)
1288         {
1289         PCCERT_CONTEXT cert = NULL;
1290         char *fname = NULL;
1291         int match;
1292         switch(ctx->lookup_method)
1293                 {
1294                 case CAPI_LU_SUBSTR:
1295                         return CertFindCertificateInStore(hstore,
1296                                         X509_ASN_ENCODING, 0,
1297                                         CERT_FIND_SUBJECT_STR_A, id, NULL);
1298                 case CAPI_LU_FNAME:
1299                         for(;;)
1300                                 {
1301                                 cert = CertEnumCertificatesInStore(hstore, cert);
1302                                 if (!cert)
1303                                         return NULL;
1304                                 fname = capi_cert_get_fname(ctx, cert);
1305                                 if (fname)
1306                                         {
1307                                         if (strcmp(fname, id))
1308                                                 match = 0;
1309                                         else
1310                                                 match = 1;
1311                                         OPENSSL_free(fname);
1312                                         if (match)
1313                                                 return cert;
1314                                         }
1315                                 }
1316                 default:
1317                         return NULL;
1318                 }
1319         }
1320
1321 static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const char *contname, char *provname, DWORD ptype, DWORD keyspec)
1322         {
1323         CAPI_KEY *key;
1324         key = OPENSSL_malloc(sizeof(CAPI_KEY));
1325         CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n",
1326                                                 contname, provname, ptype);
1327         if (!CryptAcquireContext(&key->hprov, contname, provname, ptype, 0))
1328                 {
1329                 CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1330                 capi_addlasterror();
1331                 goto err;
1332                 }
1333         if (!CryptGetUserKey(key->hprov, keyspec, &key->key))
1334                 {
1335                 CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR);
1336                 capi_addlasterror();
1337                 CryptReleaseContext(key->hprov, 0);
1338                 goto err;
1339                 }
1340         key->keyspec = keyspec;
1341         key->pcert = NULL;
1342         return key;
1343
1344         err:
1345         OPENSSL_free(key);
1346         return NULL;
1347         }
1348
1349 static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1350         {
1351         CAPI_KEY *key;
1352         CRYPT_KEY_PROV_INFO *pinfo = NULL;
1353         char *provname = NULL, *contname = NULL;
1354         pinfo = capi_get_prov_info(ctx, cert);
1355         if (!pinfo)
1356                 goto err;
1357         provname = wide_to_asc(pinfo->pwszProvName);
1358         contname = wide_to_asc(pinfo->pwszContainerName);
1359         if (!provname || !contname)
1360                 return 0;
1361
1362         key = capi_get_key(ctx, contname, provname,
1363                                 pinfo->dwProvType, pinfo->dwKeySpec);
1364
1365         err:
1366         if (pinfo)
1367                 OPENSSL_free(pinfo);
1368         if (provname)
1369                 OPENSSL_free(provname);
1370         if (contname)
1371                 OPENSSL_free(contname);
1372         return key;
1373         }
1374
1375 CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id)
1376         {
1377         PCCERT_CONTEXT cert;
1378         HCERTSTORE hstore;
1379         CAPI_KEY *key = NULL;
1380         switch (ctx->lookup_method)
1381                 {
1382                 case CAPI_LU_SUBSTR:
1383                 case CAPI_LU_FNAME:
1384                 hstore = capi_open_store(ctx, NULL);
1385                 if (!hstore)
1386                         return NULL;
1387                 cert = capi_find_cert(ctx, id, hstore);
1388                 if (cert)
1389                         {
1390                         key = capi_get_cert_key(ctx, cert);
1391                         CertFreeCertificateContext(cert);
1392                         }
1393                 CertCloseStore(hstore, 0);
1394                 break;
1395
1396                 case CAPI_LU_CONTNAME:
1397                 key = capi_get_key(ctx, id, ctx->cspname, ctx->csptype,
1398                                                         ctx->keytype);
1399                 break;
1400                 }
1401
1402         return key;
1403         }
1404
1405 void capi_free_key(CAPI_KEY *key)
1406         {
1407         if (!key)
1408                 return;
1409         CryptDestroyKey(key->key);
1410         CryptReleaseContext(key->hprov, 0);
1411         if (key->pcert)
1412                 CertFreeCertificateContext(key->pcert);
1413         OPENSSL_free(key);
1414         }
1415
1416
1417 /* Initialize a CAPI_CTX structure */
1418
1419 static CAPI_CTX *capi_ctx_new()
1420         {
1421         CAPI_CTX *ctx;
1422         ctx = OPENSSL_malloc(sizeof(CAPI_CTX));
1423         if (!ctx)
1424                 {
1425                 CAPIerr(CAPI_F_CAPI_CTX_NEW, ERR_R_MALLOC_FAILURE);
1426                 return NULL;
1427                 }
1428         ctx->cspname = NULL;
1429         ctx->csptype = PROV_RSA_FULL;
1430         ctx->dump_flags = CAPI_DMP_SUMMARY|CAPI_DMP_FNAME;
1431         ctx->keytype = AT_KEYEXCHANGE;
1432         ctx->storename = NULL;
1433         ctx->ssl_client_store = NULL;
1434         ctx->lookup_method = CAPI_LU_SUBSTR;
1435         ctx->debug_level = 0;
1436         ctx->debug_file = NULL;
1437         return ctx;
1438         }
1439
1440 static void capi_ctx_free(CAPI_CTX *ctx)
1441         {
1442         CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx);
1443         if (!ctx)
1444                 return;
1445         if (ctx->cspname)
1446                 OPENSSL_free(ctx->cspname);
1447         if (ctx->debug_file)
1448                 OPENSSL_free(ctx->debug_file);
1449         if (ctx->storename)
1450                 OPENSSL_free(ctx->storename);
1451         if (ctx->ssl_client_store)
1452                 OPENSSL_free(ctx->ssl_client_store);
1453         OPENSSL_free(ctx);
1454         }
1455
1456 static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check)
1457         {
1458         CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type);
1459         if (check)
1460                 {
1461                 HCRYPTPROV hprov;
1462                 if (!CryptAcquireContext(&hprov, NULL, pname, type,
1463                                                 CRYPT_VERIFYCONTEXT))
1464                         {
1465                         CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1466                         capi_addlasterror();
1467                         return 0;
1468                         }
1469                 CryptReleaseContext(hprov, 0);
1470                 }
1471         ctx->cspname = BUF_strdup(pname);
1472         ctx->csptype = type;
1473         return 1;
1474         }
1475
1476 static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx)
1477         {
1478         LPSTR pname;
1479         DWORD type;
1480         if (capi_get_provname(ctx, &pname, &type, idx) != 1)
1481                 return 0;
1482         return capi_ctx_set_provname(ctx, pname, type, 0);
1483         }
1484
1485 static int cert_issuer_match(STACK_OF(X509_NAME) *ca_dn, X509 *x)
1486         {
1487         int i;
1488         X509_NAME *nm;
1489         /* Special case: empty list: match anything */
1490         if (sk_X509_NAME_num(ca_dn) <= 0)
1491                 return 1;
1492         for (i = 0; i < sk_X509_NAME_num(ca_dn); i++)
1493                 {
1494                 nm = sk_X509_NAME_value(ca_dn, i);
1495                 if (!X509_NAME_cmp(nm, X509_get_issuer_name(x)))
1496                                 return 1;
1497                 }
1498         return 0;
1499         }
1500
1501
1502
1503 static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
1504         STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
1505         STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)
1506         {
1507         STACK_OF(X509) *certs = NULL;
1508         X509 *x;
1509         char *storename;
1510         const char *p;
1511         int i, client_cert_idx;
1512         HCERTSTORE hstore;
1513         PCCERT_CONTEXT cert = NULL, excert = NULL;
1514         CAPI_CTX *ctx;
1515         CAPI_KEY *key;
1516         ctx = ENGINE_get_ex_data(e, capi_idx);
1517
1518         *pcert = NULL;
1519         *pkey = NULL;
1520
1521         storename = ctx->ssl_client_store;
1522         if (!storename)
1523                 storename = "MY";
1524
1525         hstore = capi_open_store(ctx, storename);
1526         if (!hstore)
1527                 return 0;
1528         /* Enumerate all certificates collect any matches */
1529         for(i = 0;;i++)
1530                 {
1531                 cert = CertEnumCertificatesInStore(hstore, cert);
1532                 if (!cert)
1533                         break;
1534                 p = cert->pbCertEncoded;
1535                 x = d2i_X509(NULL, &p, cert->cbCertEncoded);
1536                 if (!x)
1537                         {
1538                         CAPI_trace(ctx, "Can't Parse Certificate %d\n", i);
1539                         continue;
1540                         }
1541                 if (cert_issuer_match(ca_dn, x))
1542                         {
1543                         key = capi_get_cert_key(ctx, cert);
1544                         if (!key)
1545                                 continue;
1546                         /* Match found: attach extra data to it so
1547                          * we can retrieve the key later.
1548                          */
1549                         excert = CertDuplicateCertificateContext(cert);
1550                         key->pcert = excert;
1551                         X509_set_ex_data(x, cert_capi_idx, key);
1552
1553                         if (!certs)
1554                                 certs = sk_X509_new_null();
1555
1556                         sk_X509_push(certs, x);
1557                         }
1558                 else
1559                         X509_free(x);
1560
1561                 }
1562
1563         if (cert)
1564                 CertFreeCertificateContext(cert);
1565         if (hstore)
1566                 CertCloseStore(hstore, 0);
1567
1568         if (!certs)
1569                 return 0;
1570
1571
1572         /* Select the appropriate certificate */
1573
1574         client_cert_idx = client_cert_select(e, ssl, certs);
1575
1576         /* Set the selected certificate and free the rest */
1577
1578         for(i = 0; i < sk_X509_num(certs); i++)
1579                 {
1580                 x = sk_X509_value(certs, i);
1581                 if (i == client_cert_idx)
1582                         *pcert = x;
1583                 else
1584                         {
1585                         key = X509_get_ex_data(x, cert_capi_idx);
1586                         capi_free_key(key);
1587                         X509_free(x);
1588                         }
1589                 }
1590
1591         sk_X509_free(certs);
1592
1593         if (!*pcert)
1594                 return 0;
1595
1596         /* Setup key for selected certificate */
1597
1598         key = X509_get_ex_data(*pcert, cert_capi_idx);
1599         *pkey = capi_get_pkey(e, key);
1600         X509_set_ex_data(*pcert, cert_capi_idx, NULL);
1601
1602         return 1;
1603
1604         }
1605
1606 #ifndef OPENSSL_CAPIENG_DIALOG
1607
1608 /* Simple client cert selection function: always select first */
1609
1610 static int client_cert_select(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
1611         {
1612         return 0;
1613         }
1614
1615 #else
1616
1617 /* More complex cert selection function, using standard function
1618  * CryptUIDlgSelectCertificateFromStore() to produce a dialog box.
1619  */
1620
1621 #include <PrSht.h>
1622 #include <cryptuiapi.h>
1623
1624 #define dlg_title L"OpenSSL Application SSL Client Certificate Selection"
1625 #define dlg_prompt L"Select a certificate to use for authentication"
1626 #define dlg_columns      CRYPTUI_SELECT_LOCATION_COLUMN \
1627                         |CRYPTUI_SELECT_INTENDEDUSE_COLUMN
1628
1629 static int client_cert_select(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
1630         {
1631         X509 *x;
1632         HCERTSTORE dstore;
1633         PCCERT_CONTEXT cert;
1634         CAPI_CTX *ctx;
1635         CAPI_KEY *key;
1636         HWND hwnd;
1637         int i, idx = -1;
1638         if (sk_X509_num(certs) == 1)
1639                 return 0;
1640         ctx = ENGINE_get_ex_data(e, capi_idx);
1641         /* Create an in memory store of certificates */
1642         dstore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1643                                         CERT_STORE_CREATE_NEW_FLAG, NULL);
1644         if (!dstore)
1645                 {
1646                 CAPIerr(CAPI_F_CLIENT_CERT_SELECT, CAPI_R_ERROR_CREATING_STORE);
1647                 capi_addlasterror();
1648                 goto err;
1649                 }
1650         /* Add all certificates to store */
1651         for(i = 0; i < sk_X509_num(certs); i++)
1652                 {
1653                 x = sk_X509_value(certs, i);
1654                 key = X509_get_ex_data(x, cert_capi_idx);
1655
1656                 if (!CertAddCertificateContextToStore(dstore, key->pcert,
1657                                                 CERT_STORE_ADD_NEW, NULL))
1658                         {
1659                         CAPIerr(CAPI_F_CLIENT_CERT_SELECT, CAPI_R_ERROR_ADDING_CERT);
1660                         capi_addlasterror();
1661                         goto err;
1662                         }
1663
1664                 }
1665         hwnd = GetActiveWindow();
1666         if (!hwnd)
1667                 hwnd = GetConsoleWindow();
1668         /* Call dialog to select one */
1669         cert = CryptUIDlgSelectCertificateFromStore(dstore, hwnd,
1670                                                         dlg_title, dlg_prompt,
1671                                                         dlg_columns, 0, NULL);
1672
1673         /* Find matching cert from list */
1674         if (cert)
1675                 {
1676                 for(i = 0; i < sk_X509_num(certs); i++)
1677                         {
1678                         x = sk_X509_value(certs, i);
1679                         key = X509_get_ex_data(x, cert_capi_idx);
1680                         if (CertCompareCertificate(
1681                                 X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
1682                                         cert->pCertInfo,
1683                                         key->pcert->pCertInfo))
1684                                 {
1685                                 idx = i;
1686                                 break;
1687                                 }
1688                         }
1689                 }
1690
1691         err:
1692         if (dstore)
1693                 CertCloseStore(dstore, 0);
1694         return idx;
1695
1696         }
1697 #endif
1698
1699 #endif
1700 #endif