engines/e_capi.c

   1 /* engines/e_capi.c */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  */
  53
  54
  55 #include <stdio.h>
  56 #include <string.h>
  57 #include <openssl/crypto.h>
  58 #include <openssl/buffer.h>
  59 #include <openssl/engine.h>
  60 #include <openssl/rsa.h>
  61 #include <openssl/bn.h>
  62 #include <openssl/pem.h>
  63
  64 #ifdef OPENSSL_SYS_WIN32
  65 #ifndef OPENSSL_NO_CAPIENG
  66
  67 #ifndef _WIN32_WINNT
  68 #define _WIN32_WINNT 0x400
  69 #endif
  70
  71 #include <windows.h>
  72 #include <wincrypt.h>
  73
  74 #include "e_capi_err.h"
  75 #include "e_capi_err.c"
  76
  77
  78 static const char *engine_capi_id = "capi";
  79 static const char *engine_capi_name = "CryptoAPI ENGINE";
  80
  81 typedef struct CAPI_CTX_st CAPI_CTX;
  82 typedef struct CAPI_KEY_st CAPI_KEY;
  83
  84 static void capi_addlasterror(void);
  85 static void capi_adderror(DWORD err);
  86
  87 static void CAPI_trace(CAPI_CTX *ctx, char *format, ...);
  88
  89 static int capi_list_providers(CAPI_CTX *ctx, BIO *out);
  90 static int capi_list_containers(CAPI_CTX *ctx, BIO *out);
  91 int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename);
  92 void capi_free_key(CAPI_KEY *key);
  93
  94 static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore);
  95
  96 CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id);
  97
  98 static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
  99         UI_METHOD *ui_method, void *callback_data);
 100 static int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
 101              unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
 102 static int capi_rsa_priv_enc(int flen, const unsigned char *from,
 103                 unsigned char *to, RSA *rsa, int padding);
 104 static int capi_rsa_priv_dec(int flen, const unsigned char *from,
 105                 unsigned char *to, RSA *rsa, int padding);
 106 static int capi_rsa_free(RSA *rsa);
 107
 108 static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
 109                                                         DSA *dsa);
 110 static int capi_dsa_free(DSA *dsa);
 111
 112 /* This structure contains CAPI ENGINE specific data:
 113  * it contains various global options and affects how
 114  * other functions behave.
 115  */
 116
 117 #define CAPI_DBG_TRACE  2
 118 #define CAPI_DBG_ERROR  1
 119
 120 struct CAPI_CTX_st {
 121         int debug_level;
 122         char *debug_file;
 123         /* Parameters to use for container lookup */
 124         DWORD keytype;
 125         LPTSTR cspname;
 126         DWORD csptype;
 127         /* Certificate store name to use */
 128         LPTSTR storename;
 129
 130 /* Lookup string meanings in load_private_key */
 131 /* Substring of subject: uses "storename" */
 132 #define CAPI_LU_SUBSTR          0
 133 /* Friendly name: uses storename */
 134 #define CAPI_LU_FNAME           1
 135 /* Container name: uses cspname, keytype */
 136 #define CAPI_LU_CONTNAME        2
 137         int lookup_method;
 138 /* Info to dump with dumpcerts option */
 139 /* Issuer and serial name strings */
 140 #define CAPI_DMP_SUMMARY        0x1
 141 /* Friendly name */
 142 #define CAPI_DMP_FNAME          0x2
 143 /* Full X509_print dump */
 144 #define CAPI_DMP_FULL           0x4
 145 /* Dump PEM format certificate */
 146 #define CAPI_DMP_PEM            0x8
 147 /* Dump pseudo key (if possible) */
 148 #define CAPI_DMP_PSKEY          0x10
 149 /* Dump key info (if possible) */
 150 #define CAPI_DMP_PKEYINFO       0x20
 151
 152         DWORD dump_flags;
 153 };
 154
 155
 156 static CAPI_CTX *capi_ctx_new();
 157 static void capi_ctx_free(CAPI_CTX *ctx);
 158 static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check);
 159 static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx);
 160
 161 #define CAPI_CMD_LIST_CERTS                     ENGINE_CMD_BASE
 162 #define CAPI_CMD_LOOKUP_CERT            (ENGINE_CMD_BASE + 1)
 163 #define CAPI_CMD_DEBUG_LEVEL            (ENGINE_CMD_BASE + 2)
 164 #define CAPI_CMD_DEBUG_FILE                     (ENGINE_CMD_BASE + 3)
 165 #define CAPI_CMD_KEYTYPE                        (ENGINE_CMD_BASE + 4)
 166 #define CAPI_CMD_LIST_CSPS                      (ENGINE_CMD_BASE + 5)
 167 #define CAPI_CMD_SET_CSP_IDX            (ENGINE_CMD_BASE + 6)
 168 #define CAPI_CMD_SET_CSP_NAME           (ENGINE_CMD_BASE + 7)
 169 #define CAPI_CMD_SET_CSP_TYPE           (ENGINE_CMD_BASE + 8)
 170 #define CAPI_CMD_LIST_CONTAINERS        (ENGINE_CMD_BASE + 9)
 171 #define CAPI_CMD_LIST_OPTIONS           (ENGINE_CMD_BASE + 10)
 172 #define CAPI_CMD_LOOKUP_METHOD          (ENGINE_CMD_BASE + 11)
 173
 174 static const ENGINE_CMD_DEFN capi_cmd_defns[] = {
 175         {CAPI_CMD_LIST_CERTS,
 176                 "list_certs",
 177                 "List all certificates in store",
 178                 ENGINE_CMD_FLAG_NO_INPUT},
 179         {CAPI_CMD_LOOKUP_CERT,
 180                 "lookup_cert",
 181                 "Lookup and output certificates",
 182                 ENGINE_CMD_FLAG_STRING},
 183         {CAPI_CMD_DEBUG_LEVEL,
 184                 "debug_level",
 185                 "debug level (1=errors, 2=trace)",
 186                 ENGINE_CMD_FLAG_NUMERIC},
 187         {CAPI_CMD_DEBUG_FILE,
 188                 "debug_file",
 189                 "debugging filename)",
 190                 ENGINE_CMD_FLAG_STRING},
 191         {CAPI_CMD_KEYTYPE,
 192                 "key_type",
 193                 "Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE",
 194                 ENGINE_CMD_FLAG_NUMERIC},
 195         {CAPI_CMD_LIST_CSPS,
 196                 "list_csps",
 197                 "List all CSPs",
 198                 ENGINE_CMD_FLAG_NO_INPUT},
 199         {CAPI_CMD_SET_CSP_IDX,
 200                 "csp_idx",
 201                 "Set CSP by index",
 202                 ENGINE_CMD_FLAG_NUMERIC},
 203         {CAPI_CMD_SET_CSP_NAME,
 204                 "csp_name",
 205                 "Set CSP name, (default CSP used if not specified)",
 206                 ENGINE_CMD_FLAG_STRING},
 207         {CAPI_CMD_SET_CSP_TYPE,
 208                 "csp_type",
 209                 "Set CSP type, (default RSA_PROV_FULL)",
 210                 ENGINE_CMD_FLAG_NUMERIC},
 211         {CAPI_CMD_LIST_CONTAINERS,
 212                 "list_containers",
 213                 "list container names",
 214                 ENGINE_CMD_FLAG_NO_INPUT},
 215         {CAPI_CMD_LIST_OPTIONS,
 216                 "list_options",
 217                 "Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, "
 218                 "32=private key info)",
 219                 ENGINE_CMD_FLAG_NUMERIC},
 220         {CAPI_CMD_LOOKUP_METHOD,
 221                 "lookup_method",
 222                 "Set key lookup method (1=substring, 2=friendlyname, 3=container name)",
 223                 ENGINE_CMD_FLAG_NUMERIC},
 224
 225         {0, NULL, NULL, 0}
 226         };
 227
 228 static int capi_idx = -1;
 229 static int rsa_capi_idx = -1;
 230 static int dsa_capi_idx = -1;
 231
 232 static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
 233 {
 234         int ret = 1;
 235         CAPI_CTX *ctx;
 236         BIO *out;
 237         if (capi_idx == -1)
 238                 {
 239                 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED);
 240                 return 0;
 241                 }
 242         ctx = ENGINE_get_ex_data(e, capi_idx);
 243         out = BIO_new_fp(stdout, BIO_NOCLOSE);
 244         switch (cmd)
 245                 {
 246                 case CAPI_CMD_LIST_CSPS:
 247                 ret = capi_list_providers(ctx, out);
 248                 break;
 249
 250                 case CAPI_CMD_LIST_CERTS:
 251                 ret = capi_list_certs(ctx, out, NULL);
 252                 break;
 253
 254                 case CAPI_CMD_LOOKUP_CERT:
 255                 ret = capi_list_certs(ctx, out, p);
 256                 break;
 257
 258                 case CAPI_CMD_LIST_CONTAINERS:
 259                 ret = capi_list_containers(ctx, out);
 260                 break;
 261
 262                 case CAPI_CMD_DEBUG_LEVEL:
 263                 ctx->debug_level = (int)i;
 264                 CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level);
 265                 break;
 266
 267                 case CAPI_CMD_DEBUG_FILE:
 268                 ctx->debug_file = BUF_strdup(p);
 269                 CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file);
 270                 break;
 271
 272                 case CAPI_CMD_KEYTYPE:
 273                 ctx->keytype = i;
 274                 CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype);
 275                 break;
 276
 277                 case CAPI_CMD_SET_CSP_IDX:
 278                 ret = capi_ctx_set_provname_idx(ctx, i);
 279                 break;
 280
 281                 case CAPI_CMD_LIST_OPTIONS:
 282                 ctx->dump_flags = i;
 283                 break;
 284
 285                 case CAPI_CMD_LOOKUP_METHOD:
 286                 if (i < 1 || i > 3)
 287                         {
 288                         CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD);
 289                         return 0;
 290                         }
 291                 ctx->lookup_method = i;
 292                 break;
 293
 294                 case CAPI_CMD_SET_CSP_NAME:
 295                 ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1);
 296                 break;
 297
 298                 case CAPI_CMD_SET_CSP_TYPE:
 299                 ctx->csptype = i;
 300                 break;
 301
 302                 default:
 303                 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND);
 304                 ret = 0;
 305         }
 306
 307         BIO_free(out);
 308         return ret;
 309
 310 }
 311
 312 static RSA_METHOD capi_rsa_method =
 313         {
 314         "CryptoAPI RSA method",
 315         0,                              /* pub_enc */
 316         0,                              /* pub_dec */
 317         capi_rsa_priv_enc,              /* priv_enc */
 318         capi_rsa_priv_dec,              /* priv_dec */
 319         0,                              /* rsa_mod_exp */
 320         0,                              /* bn_mod_exp */
 321         0,                              /* init */
 322         capi_rsa_free,                  /* finish */
 323         RSA_FLAG_SIGN_VER,              /* flags */
 324         NULL,                           /* app_data */
 325         capi_rsa_sign,                  /* rsa_sign */
 326         0                               /* rsa_verify */
 327         };
 328
 329 static DSA_METHOD capi_dsa_method =
 330         {
 331         "CryptoAPI DSA method",
 332         capi_dsa_do_sign,               /* dsa_do_sign */
 333         0,                              /* dsa_sign_setup */
 334         0,                              /* dsa_do_verify */
 335         0,                              /* dsa_mod_exp */
 336         0,                              /* bn_mod_exp */
 337         0,                              /* init */
 338         capi_dsa_free,                  /* finish */
 339         0,                              /* flags */
 340         NULL,                           /* app_data */
 341         0,                              /* dsa_paramgen */
 342         0                               /* dsa_keygen */
 343         };
 344
 345 static int capi_init(ENGINE *e)
 346         {
 347         CAPI_CTX *ctx;
 348         const RSA_METHOD *ossl_rsa_meth;
 349         const DSA_METHOD *ossl_dsa_meth;
 350         capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0);
 351
 352         ctx = capi_ctx_new();
 353         if (!ctx || (capi_idx < 0))
 354                 goto memerr;
 355
 356         ENGINE_set_ex_data(e, capi_idx, ctx);
 357         /* Setup RSA_METHOD */
 358         rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
 359         ossl_rsa_meth = RSA_PKCS1_SSLeay();
 360         capi_rsa_method.rsa_pub_enc = ossl_rsa_meth->rsa_pub_enc;
 361         capi_rsa_method.rsa_pub_dec = ossl_rsa_meth->rsa_pub_dec;
 362         capi_rsa_method.rsa_mod_exp = ossl_rsa_meth->rsa_mod_exp;
 363         capi_rsa_method.bn_mod_exp = ossl_rsa_meth->bn_mod_exp;
 364
 365         /* Setup DSA Method */
 366         dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
 367         ossl_dsa_meth = DSA_OpenSSL();
 368         capi_dsa_method.dsa_do_verify = ossl_dsa_meth->dsa_do_verify;
 369         capi_dsa_method.dsa_mod_exp = ossl_dsa_meth->dsa_mod_exp;
 370         capi_dsa_method.bn_mod_exp = ossl_dsa_meth->bn_mod_exp;
 371
 372         return 1;
 373
 374         memerr:
 375         CAPIerr(CAPI_F_CAPI_INIT, ERR_R_MALLOC_FAILURE);
 376         return 0;
 377
 378         return 1;
 379         }
 380
 381 static int capi_destroy(ENGINE *e)
 382         {
 383
 384         ERR_unload_CAPI_strings();
 385         return 1;
 386         }
 387
 388 static int capi_finish(ENGINE *e)
 389         {
 390         CAPI_CTX *ctx;
 391         ctx = ENGINE_get_ex_data(e, capi_idx);
 392         capi_ctx_free(ctx);
 393         ENGINE_set_ex_data(e, capi_idx, NULL);
 394         return 1;
 395         }
 396
 397
 398 /* CryptoAPI key application data. This contains
 399  * a handle to the private key container (for sign operations)
 400  * and a handle to the key (for decrypt operations).
 401  */
 402
 403 struct CAPI_KEY_st
 404         {
 405         HCRYPTPROV hprov;
 406         HCRYPTKEY key;
 407         DWORD keyspec;
 408         };
 409
 410 static int bind_capi(ENGINE *e)
 411         {
 412         if (!ENGINE_set_id(e, engine_capi_id)
 413                 || !ENGINE_set_name(e, engine_capi_name)
 414                 || !ENGINE_set_init_function(e, capi_init)
 415                 || !ENGINE_set_finish_function(e, capi_finish)
 416                 || !ENGINE_set_destroy_function(e, capi_destroy)
 417                 || !ENGINE_set_RSA(e, &capi_rsa_method)
 418                 || !ENGINE_set_DSA(e, &capi_dsa_method)
 419                 || !ENGINE_set_load_privkey_function(e, capi_load_privkey)
 420                 || !ENGINE_set_cmd_defns(e, capi_cmd_defns)
 421                 || !ENGINE_set_ctrl_function(e, capi_ctrl))
 422                         return 0;
 423         ERR_load_CAPI_strings();
 424
 425         return 1;
 426
 427         }
 428
 429 #ifndef OPENSSL_NO_DYNAMIC_ENGINE
 430 static int bind_helper(ENGINE *e, const char *id)
 431         {
 432         if(id && (strcmp(id, engine_capi_id) != 0))
 433                 return 0;
 434         if(!bind_capi(e))
 435                 return 0;
 436         return 1;
 437         }
 438 IMPLEMENT_DYNAMIC_CHECK_FN()
 439 IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
 440 #else
 441 static ENGINE *engine_capi(void)
 442         {
 443         ENGINE *ret = ENGINE_new();
 444         if(!ret)
 445                 return NULL;
 446         if(!bind_capi(ret))
 447                 {
 448                 ENGINE_free(ret);
 449                 return NULL;
 450                 }
 451         return ret;
 452         }
 453
 454 void ENGINE_load_capi(void)
 455         {
 456         /* Copied from eng_[openssl|dyn].c */
 457         ENGINE *toadd = engine_capi();
 458         if(!toadd) return;
 459         ENGINE_add(toadd);
 460         ENGINE_free(toadd);
 461         ERR_clear_error();
 462         }
 463 #endif
 464
 465
 466 static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen)
 467         {
 468         int i;
 469         /* Reverse buffer in place: since this is a keyblob structure
 470          * that will be freed up after conversion anyway it doesn't
 471          * matter if we change it.
 472          */
 473         for(i = 0; i < binlen / 2; i++)
 474                 {
 475                 unsigned char c;
 476                 c = bin[i];
 477                 bin[i] = bin[binlen - i - 1];
 478                 bin[binlen - i - 1] = c;
 479                 }
 480
 481         if (!BN_bin2bn(bin, binlen, bn))
 482                 return 0;
 483         return 1;
 484         }
 485
 486 static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
 487         UI_METHOD *ui_method, void *callback_data)
 488         {
 489         EVP_PKEY *ret = NULL;
 490         CAPI_CTX *ctx;
 491         CAPI_KEY *key;
 492         unsigned char *pubkey = NULL;
 493         DWORD len;
 494         BLOBHEADER *bh;
 495         RSA *rkey = NULL;
 496         DSA *dkey = NULL;
 497         ctx = ENGINE_get_ex_data(eng, capi_idx);
 498
 499         if (!ctx)
 500                 {
 501                 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT);
 502                 return NULL;
 503                 }
 504
 505         key = capi_find_key(ctx, key_id);
 506
 507         if (!key)
 508                 return NULL;
 509
 510         len = 0;
 511         if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len))
 512                 {
 513                 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR);
 514                 capi_addlasterror();
 515                 return NULL;
 516                 }
 517
 518         pubkey = OPENSSL_malloc(len);
 519
 520         if (!pubkey)
 521                 goto memerr;
 522
 523         if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len))
 524                 {
 525                 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_PUBKEY_EXPORT_ERROR);
 526                 capi_addlasterror();
 527                 goto err;
 528                 }
 529
 530         bh = (BLOBHEADER *)pubkey;
 531         if (bh->bType != PUBLICKEYBLOB)
 532                 {
 533                 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB);
 534                 goto err;
 535                 }
 536         if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX)
 537                 {
 538                 RSAPUBKEY *rp;
 539                 DWORD rsa_modlen;
 540                 unsigned char *rsa_modulus;
 541                 rp = (RSAPUBKEY *)(bh + 1);
 542                 if (rp->magic != 0x31415352)
 543                         {
 544                         char magstr[10];
 545                         BIO_snprintf(magstr, 10, "%lx", rp->magic);
 546                         CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
 547                         ERR_add_error_data(2, "magic=0x", magstr);
 548                         goto err;
 549                         }
 550                 rsa_modulus = (unsigned char *)(rp + 1);
 551                 rkey = RSA_new_method(eng);
 552                 if (!rkey)
 553                         goto memerr;
 554
 555                 rkey->e = BN_new();
 556                 rkey->n = BN_new();
 557
 558                 if (!rkey->e || !rkey->n)
 559                         goto memerr;
 560
 561                 if (!BN_set_word(rkey->e, rp->pubexp))
 562                         goto memerr;
 563
 564                 rsa_modlen = rp->bitlen / 8;
 565                 if (!lend_tobn(rkey->n, rsa_modulus, rsa_modlen))
 566                         goto memerr;
 567
 568                 RSA_set_ex_data(rkey, rsa_capi_idx, key);
 569
 570                 if (!(ret = EVP_PKEY_new()))
 571                         goto memerr;
 572
 573                 EVP_PKEY_assign_RSA(ret, rkey);
 574                 rkey = NULL;
 575
 576                 }
 577         else if (bh->aiKeyAlg == CALG_DSS_SIGN)
 578                 {
 579                 DSSPUBKEY *dp;
 580                 DWORD dsa_plen;
 581                 unsigned char *btmp;
 582                 dp = (DSSPUBKEY *)(bh + 1);
 583                 if (dp->magic != 0x31535344)
 584                         {
 585                         char magstr[10];
 586                         BIO_snprintf(magstr, 10, "%lx", dp->magic);
 587                         CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
 588                         ERR_add_error_data(2, "magic=0x", magstr);
 589                         goto err;
 590                         }
 591                 dsa_plen = dp->bitlen / 8;
 592                 btmp = (unsigned char *)(dp + 1);
 593                 dkey = DSA_new_method(eng);
 594                 if (!dkey)
 595                         goto memerr;
 596                 dkey->p = BN_new();
 597                 dkey->q = BN_new();
 598                 dkey->g = BN_new();
 599                 dkey->pub_key = BN_new();
 600                 if (!dkey->p || !dkey->q || !dkey->g || !dkey->pub_key)
 601                         goto memerr;
 602                 if (!lend_tobn(dkey->p, btmp, dsa_plen))
 603                         goto memerr;
 604                 btmp += dsa_plen;
 605                 if (!lend_tobn(dkey->q, btmp, 20))
 606                         goto memerr;
 607                 btmp += 20;
 608                 if (!lend_tobn(dkey->g, btmp, dsa_plen))
 609                         goto memerr;
 610                 btmp += dsa_plen;
 611                 if (!lend_tobn(dkey->pub_key, btmp, dsa_plen))
 612                         goto memerr;
 613                 btmp += dsa_plen;
 614
 615                 DSA_set_ex_data(dkey, dsa_capi_idx, key);
 616
 617                 if (!(ret = EVP_PKEY_new()))
 618                         goto memerr;
 619
 620                 EVP_PKEY_assign_DSA(ret, dkey);
 621                 dkey = NULL;
 622                 }
 623         else
 624                 {
 625                 char algstr[10];
 626                 BIO_snprintf(algstr, 10, "%lx", bh->aiKeyAlg);
 627                 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM);
 628                 ERR_add_error_data(2, "aiKeyAlg=0x", algstr);
 629                 goto err;
 630                 }
 631
 632         err:
 633         if (pubkey)
 634                 OPENSSL_free(pubkey);
 635         if (!ret)
 636                 {
 637                 if (rkey)
 638                         RSA_free(rkey);
 639                 if (dkey)
 640                         DSA_free(dkey);
 641                 if (key)
 642                         capi_free_key(key);
 643                 }
 644
 645         return ret;
 646
 647 memerr:
 648         CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, ERR_R_MALLOC_FAILURE);
 649         goto err;
 650
 651         }
 652
 653 /* CryptoAPI RSA operations */
 654
 655 int capi_rsa_priv_enc(int flen, const unsigned char *from,
 656                 unsigned char *to, RSA *rsa, int padding)
 657         {
 658         CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED);
 659         return -1;
 660         }
 661
 662 int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
 663              unsigned char *sigret, unsigned int *siglen, const RSA *rsa)
 664         {
 665         ALG_ID alg;
 666         HCRYPTHASH hash;
 667         DWORD slen;
 668         unsigned int i;
 669         int ret = -1;
 670         CAPI_KEY *capi_key;
 671         CAPI_CTX *ctx;
 672
 673         ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
 674
 675         CAPI_trace(ctx, "Called CAPI_rsa_sign()\n");
 676
 677         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 678         if (!capi_key)
 679                 {
 680                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY);
 681                 return -1;
 682                 }
 683 /* Convert the signature type to a CryptoAPI algorithm ID */
 684         switch(dtype) {
 685         case NID_sha1:
 686                 alg = CALG_SHA1;
 687                 break;
 688
 689         case NID_md5:
 690                 alg = CALG_MD5;
 691                 break;
 692
 693         case NID_md5_sha1:
 694                 alg = CALG_SSL3_SHAMD5;
 695                 break;
 696         default:
 697                 {
 698                 char algstr[10];
 699                 BIO_snprintf(algstr, 10, "%lx", dtype);
 700                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID);
 701                 ERR_add_error_data(2, "NID=0x", algstr);
 702                 return -1;
 703                 }
 704         }
 705
 706
 707
 708 /* Create the hash object */
 709         if(!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash)) {
 710                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
 711                 capi_addlasterror();
 712                 return -1;
 713         }
 714 /* Set the hash value to the value passed */
 715
 716         if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0)) {
 717                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
 718                 capi_addlasterror();
 719                 goto err;
 720         }
 721
 722
 723 /* Finally sign it */
 724         slen = RSA_size(rsa);
 725         if(!CryptSignHash(hash, capi_key->keyspec, NULL, 0, sigret, &slen)) {
 726                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH);
 727                 capi_addlasterror();
 728                 goto err;
 729         } else {
 730                 ret = 1;
 731                 /* Inplace byte reversal of signature */
 732                 for(i = 0; i < slen / 2; i++) {
 733                         unsigned char c;
 734                         c = sigret[i];
 735                         sigret[i] = sigret[slen - i - 1];
 736                         sigret[slen - i - 1] = c;
 737                 }
 738                 *siglen = slen;
 739         }
 740
 741
 742         /* Now cleanup */
 743
 744 err:
 745         CryptDestroyHash(hash);
 746
 747         return ret;
 748 }
 749
 750 int capi_rsa_priv_dec(int flen, const unsigned char *from,
 751                 unsigned char *to, RSA *rsa, int padding)
 752 {
 753         int i;
 754         unsigned char *tmpbuf;
 755         CAPI_KEY *capi_key;
 756         CAPI_CTX *ctx;
 757         ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
 758
 759         CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n");
 760
 761
 762         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 763         if (!capi_key)
 764                 {
 765                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY);
 766                 return -1;
 767                 }
 768
 769         if(padding != RSA_PKCS1_PADDING)
 770                 {
 771                 char errstr[10];
 772                 BIO_snprintf(errstr, 10, "%d", padding);
 773                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING);
 774                 ERR_add_error_data(2, "padding=", errstr);
 775                 return -1;
 776                 }
 777
 778         /* Create temp reverse order version of input */
 779         if(!(tmpbuf = OPENSSL_malloc(flen)) )
 780                 {
 781                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, ERR_R_MALLOC_FAILURE);
 782                 return -1;
 783                 }
 784         for(i = 0; i < flen; i++)
 785                 tmpbuf[flen - i - 1] = from[i];
 786
 787         /* Finally decrypt it */
 788         if(!CryptDecrypt(capi_key->key, 0, TRUE, 0, tmpbuf, &flen))
 789                 {
 790                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR);
 791                 capi_addlasterror();
 792                 OPENSSL_free(tmpbuf);
 793                 return -1;
 794                 }
 795         else memcpy(to, tmpbuf, flen);
 796
 797         OPENSSL_free(tmpbuf);
 798
 799         return flen;
 800 }
 801
 802 static int capi_rsa_free(RSA *rsa)
 803         {
 804         CAPI_KEY *capi_key;
 805         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 806         capi_free_key(capi_key);
 807         RSA_set_ex_data(rsa, rsa_capi_idx, 0);
 808         return 1;
 809         }
 810
 811 /* CryptoAPI DSA operations */
 812
 813 static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
 814                                                                 DSA *dsa)
 815         {
 816         HCRYPTHASH hash;
 817         DWORD slen;
 818         DSA_SIG *ret = NULL;
 819         CAPI_KEY *capi_key;
 820         CAPI_CTX *ctx;
 821         unsigned char csigbuf[40];
 822
 823         ctx = ENGINE_get_ex_data(dsa->engine, capi_idx);
 824
 825         CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n");
 826
 827         capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
 828
 829         if (!capi_key)
 830                 {
 831                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY);
 832                 return NULL;
 833                 }
 834
 835         if (dlen != 20)
 836                 {
 837                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH);
 838                 return NULL;
 839                 }
 840
 841         /* Create the hash object */
 842         if(!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash)) {
 843                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
 844                 capi_addlasterror();
 845                 return NULL;
 846         }
 847
 848         /* Set the hash value to the value passed */
 849         if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0)) {
 850                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
 851                 capi_addlasterror();
 852                 goto err;
 853         }
 854
 855
 856         /* Finally sign it */
 857         slen = sizeof(csigbuf);
 858         if(!CryptSignHash(hash, AT_SIGNATURE, NULL, 0, csigbuf, &slen))
 859                 {
 860                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH);
 861                 capi_addlasterror();
 862                 goto err;
 863                 }
 864         else
 865                 {
 866                 ret = DSA_SIG_new();
 867                 if (!ret)
 868                         goto err;
 869                 ret->r = BN_new();
 870                 ret->s = BN_new();
 871                 if (!ret->r || !ret->s)
 872                         goto err;
 873                 if (!lend_tobn(ret->r, csigbuf, 20)
 874                         || !lend_tobn(ret->s, csigbuf + 20, 20))
 875                         {
 876                         DSA_SIG_free(ret);
 877                         ret = NULL;
 878                         goto err;
 879                         }
 880                 }
 881
 882         /* Now cleanup */
 883
 884 err:
 885         OPENSSL_cleanse(csigbuf, 40);
 886         CryptDestroyHash(hash);
 887         return ret;
 888         }
 889
 890 static int capi_dsa_free(DSA *dsa)
 891         {
 892         CAPI_KEY *capi_key;
 893         capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
 894         capi_free_key(capi_key);
 895         DSA_set_ex_data(dsa, dsa_capi_idx, 0);
 896         return 1;
 897         }
 898
 899 static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, va_list argptr)
 900         {
 901         BIO *out;
 902
 903         if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file))
 904                 return;
 905         out = BIO_new_file(ctx->debug_file, "a+");
 906         BIO_vprintf(out, format, argptr);
 907         BIO_free(out);
 908         }
 909
 910 static void CAPI_trace(CAPI_CTX *ctx, char *format, ...)
 911         {
 912         va_list args;
 913         va_start(args, format);
 914         capi_vtrace(ctx, CAPI_DBG_TRACE, format, args);
 915         va_end(args);
 916         }
 917
 918 static void capi_addlasterror(void)
 919         {
 920         capi_adderror(GetLastError());
 921         }
 922
 923 static void capi_adderror(DWORD err)
 924         {
 925         char errstr[10];
 926         BIO_snprintf(errstr, 10, "%lX", err);
 927         ERR_add_error_data(2, "Error code= 0x", errstr);
 928         }
 929
 930 static char *wide_to_asc(LPWSTR wstr)
 931         {
 932         char *str;
 933         if (!wstr)
 934                 return NULL;
 935         str = OPENSSL_malloc(wcslen(wstr) + 1);
 936         if (!str)
 937                 {
 938                 CAPIerr(CAPI_F_WIDE_TO_ASC, ERR_R_MALLOC_FAILURE);
 939                 return NULL;
 940                 }
 941         sprintf(str, "%S", wstr);
 942         return str;
 943         }
 944
 945 static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, DWORD idx)
 946         {
 947         LPSTR name;
 948         DWORD len, err;
 949         CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx);
 950         if (!CryptEnumProviders(idx, NULL, 0, ptype, NULL, &len))
 951                 {
 952                 err = GetLastError();
 953                 if (err == ERROR_NO_MORE_ITEMS)
 954                         return 2;
 955                 CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
 956                 capi_adderror(err);
 957                 return 0;
 958                 }
 959         name = OPENSSL_malloc(len);
 960                 if (!CryptEnumProviders(idx, NULL, 0, ptype, name, &len))
 961                 {
 962                 err = GetLastError();
 963                 if (err == ERROR_NO_MORE_ITEMS)
 964                         return 2;
 965                 CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
 966                 capi_adderror(err);
 967                 return 0;
 968                 }
 969         *pname = name;
 970         CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", name, *ptype);
 971
 972         return 1;
 973         }
 974
 975 static int capi_list_providers(CAPI_CTX *ctx, BIO *out)
 976         {
 977         DWORD idx, ptype;
 978         int ret;
 979         LPTSTR provname = NULL;
 980         CAPI_trace(ctx, "capi_list_providers\n");
 981         BIO_printf(out, "Available CSPs:\n");
 982         for(idx = 0; ; idx++)
 983                 {
 984                 ret = capi_get_provname(ctx, &provname, &ptype, idx);
 985                 if (ret == 2)
 986                         break;
 987                 if (ret == 0)
 988                         break;
 989                 BIO_printf(out, "%d. %s, type %d\n", idx, provname, ptype);
 990                 OPENSSL_free(provname);
 991                 }
 992         return 1;
 993         }
 994
 995 static int capi_list_containers(CAPI_CTX *ctx, BIO *out)
 996         {
 997         int ret = 1;
 998         HCRYPTPROV hprov;
 999         DWORD err, idx, flags, buflen = 0, clen;
1000         LPSTR cname;
1001         CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, ctx->csptype);
1002         if (!CryptAcquireContext(&hprov, NULL, ctx->cspname, ctx->csptype, CRYPT_VERIFYCONTEXT))
1003                 {
1004                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1005                 capi_addlasterror();
1006                 return 0;
1007                 }
1008         if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, CRYPT_FIRST))
1009                 {
1010                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
1011                 capi_addlasterror();
1012                 return 0;
1013                 }
1014         CAPI_trace(ctx, "Got max container len %d\n", buflen);
1015         if (buflen == 0)
1016                 buflen = 1024;
1017         cname = OPENSSL_malloc(buflen);
1018         if (!cname)
1019                 {
1020                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE);
1021                 goto err;
1022                 }
1023
1024         for (idx = 0;;idx++)
1025                 {
1026                         clen = buflen;
1027                         cname[0] = 0;
1028
1029                         if (idx == 0)
1030                                 flags = CRYPT_FIRST;
1031                         else
1032                                 flags = 0;
1033                         if(!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, cname, &clen, flags))
1034                                 {
1035                                 err = GetLastError();
1036                                 if (err == ERROR_NO_MORE_ITEMS)
1037                                         goto done;
1038                                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
1039                                 capi_adderror(err);
1040                                 goto err;
1041                                 }
1042                         CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", cname, clen, idx, flags);
1043                         if (!cname[0] && (clen == buflen))
1044                                 {
1045                                 CAPI_trace(ctx, "Enumerate bug: using workaround\n");
1046                                 goto done;
1047                                 }
1048                         BIO_printf(out, "%d. %s\n", idx, cname);
1049                 }
1050         err:
1051
1052         ret = 0;
1053
1054         done:
1055         if (cname)
1056                 OPENSSL_free(cname);
1057         CryptReleaseContext(hprov, 0);
1058
1059         return ret;
1060         }
1061
1062 CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1063         {
1064         DWORD len;
1065         CRYPT_KEY_PROV_INFO *pinfo;
1066
1067         if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &len))
1068                 return NULL;
1069         pinfo = OPENSSL_malloc(len);
1070         if (!pinfo)
1071                 {
1072                 CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, ERR_R_MALLOC_FAILURE);
1073                 return NULL;
1074                 }
1075         if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, pinfo, &len))
1076                 {
1077                 CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO);
1078                 capi_addlasterror();
1079                 OPENSSL_free(pinfo);
1080                 return NULL;
1081                 }
1082         return pinfo;
1083         }
1084
1085 static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, CRYPT_KEY_PROV_INFO *pinfo)
1086         {
1087         char *provname = NULL, *contname = NULL;
1088         if (!pinfo)
1089                 {
1090                 BIO_printf(out, "  No Private Key\n");
1091                 return;
1092                 }
1093         provname = wide_to_asc(pinfo->pwszProvName);
1094         contname = wide_to_asc(pinfo->pwszContainerName);
1095         if (!provname || !contname)
1096                 goto err;
1097
1098         BIO_printf(out, "  Private Key Info:\n");
1099         BIO_printf(out, "    Provider Name:  %s, Provider Type %d\n", provname, pinfo->dwProvType);
1100         BIO_printf(out, "    Container Name: %s, Key Type %d\n", contname, pinfo->dwKeySpec);
1101         err:
1102         if (provname)
1103                 OPENSSL_free(provname);
1104         if (contname)
1105                 OPENSSL_free(contname);
1106         }
1107
1108 char * capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1109         {
1110         LPWSTR wfname;
1111         DWORD dlen;
1112
1113         CAPI_trace(ctx, "capi_cert_get_fname\n");
1114         if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &dlen))
1115                 return NULL;
1116         wfname = OPENSSL_malloc(dlen);
1117         if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, wfname, &dlen))
1118                 {
1119                 char *fname = wide_to_asc(wfname);
1120                 OPENSSL_free(wfname);
1121                 return fname;
1122                 }
1123         CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME);
1124         capi_addlasterror();
1125
1126         OPENSSL_free(wfname);
1127         return NULL;
1128         }
1129
1130
1131 void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert)
1132         {
1133         X509 *x;
1134         unsigned char *p;
1135         unsigned long flags = ctx->dump_flags;
1136         if (flags & CAPI_DMP_FNAME)
1137                 {
1138                 char *fname;
1139                 fname = capi_cert_get_fname(ctx, cert);
1140                 if (fname)
1141                         {
1142                         BIO_printf(out, "  Friendly Name \"%s\"\n", fname);
1143                         OPENSSL_free(fname);
1144                         }
1145                 else
1146                         BIO_printf(out, "  <No Friendly Name>\n");
1147                 }
1148
1149         p = cert->pbCertEncoded;
1150         x = d2i_X509(NULL, &p, cert->cbCertEncoded);
1151         if (!x)
1152                 BIO_printf(out, "  <Can't parse certificate>\n");
1153         if (flags & CAPI_DMP_SUMMARY)
1154                 {
1155                 BIO_printf(out, "  Subject: ");
1156                 X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);
1157                 BIO_printf(out, "\n  Issuer: ");
1158                 X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);
1159                 BIO_printf(out, "\n");
1160                 }
1161         if (flags & CAPI_DMP_FULL)
1162                 X509_print_ex(out, x, XN_FLAG_ONELINE,0);
1163
1164         if (flags & CAPI_DMP_PKEYINFO)
1165                 {
1166                 CRYPT_KEY_PROV_INFO *pinfo;
1167                 pinfo = capi_get_prov_info(ctx, cert);
1168                 capi_dump_prov_info(ctx, out, pinfo);
1169                 if (pinfo)
1170                         OPENSSL_free(pinfo);
1171                 }
1172
1173         if (flags & CAPI_DMP_PEM)
1174                 PEM_write_bio_X509(out, x);
1175         X509_free(x);
1176         }
1177
1178 HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename)
1179         {
1180         HCERTSTORE hstore;
1181
1182         if (!storename)
1183                 storename = ctx->storename;
1184         if (!storename)
1185                 storename = "MY";
1186         CAPI_trace(ctx, "Opening certificate store %s\n", storename);
1187
1188         hstore = CertOpenSystemStore(0, storename);
1189         if (!hstore)
1190                 {
1191                 CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE);
1192                 capi_addlasterror();
1193                 }
1194         return hstore;
1195         }
1196
1197 int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id)
1198         {
1199         char *storename;
1200         int idx;
1201         int ret = 1;
1202         HCERTSTORE hstore;
1203         PCCERT_CONTEXT cert = NULL;
1204
1205         storename = ctx->storename;
1206         if (!storename)
1207                 storename = "MY";
1208         CAPI_trace(ctx, "Listing certs for store %s\n", storename);
1209
1210         hstore = capi_open_store(ctx, storename);
1211         if (!hstore)
1212                 return 0;
1213         if (id)
1214                 {
1215                 cert = capi_find_cert(ctx, id, hstore);
1216                 if (!cert)
1217                         {
1218                         ret = 0;
1219                         goto err;
1220                         }
1221                 capi_dump_cert(ctx, out, cert);
1222                 CertFreeCertificateContext(cert);
1223                 }
1224         else
1225                 {
1226                 for(idx = 0;;idx++)
1227                         {
1228                         LPWSTR fname = NULL;
1229                         cert = CertEnumCertificatesInStore(hstore, cert);
1230                         if (!cert)
1231                                 break;
1232                         BIO_printf(out, "Certificate %d\n", idx);
1233                         capi_dump_cert(ctx, out, cert);
1234                         }
1235                 }
1236         err:
1237         CertCloseStore(hstore, 0);
1238         return ret;
1239         }
1240
1241 static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)
1242         {
1243         PCCERT_CONTEXT cert = NULL;
1244         char *fname = NULL;
1245         int match;
1246         switch(ctx->lookup_method)
1247                 {
1248                 case CAPI_LU_SUBSTR:
1249                         return CertFindCertificateInStore(hstore, X509_ASN_ENCODING, 0,
1250                                                                                         CERT_FIND_SUBJECT_STR_A, id, NULL);
1251                 case CAPI_LU_FNAME:
1252                         for(;;)
1253                                 {
1254                                 cert = CertEnumCertificatesInStore(hstore, cert);
1255                                 if (!cert)
1256                                         return NULL;
1257                                 fname = capi_cert_get_fname(ctx, cert);
1258                                 if (fname)
1259                                         {
1260                                         if (strcmp(fname, id))
1261                                                 match = 0;
1262                                         else
1263                                                 match = 1;
1264                                         OPENSSL_free(fname);
1265                                         if (match)
1266                                                 return cert;
1267                                         }
1268                                 }
1269                 default:
1270                         return NULL;
1271                 }
1272         }
1273
1274 static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const char *contname, char *provname, DWORD ptype, DWORD keyspec)
1275         {
1276         CAPI_KEY *key;
1277         key = OPENSSL_malloc(sizeof(CAPI_KEY));
1278         CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n",
1279                                                                                                                         contname, provname, ptype);
1280         if (!CryptAcquireContext(&key->hprov, contname, provname, ptype, 0))
1281                 {
1282                 CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1283                 capi_addlasterror();
1284                 goto err;
1285                 }
1286         if (!CryptGetUserKey(key->hprov, keyspec, &key->key))
1287                 {
1288                 CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR);
1289                 capi_addlasterror();
1290                 CryptReleaseContext(key->hprov, 0);
1291                 goto err;
1292                 }
1293         key->keyspec = keyspec;
1294         return key;
1295
1296         err:
1297         OPENSSL_free(key);
1298         return NULL;
1299         }
1300
1301 static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1302         {
1303         CAPI_KEY *key;
1304         CRYPT_KEY_PROV_INFO *pinfo = NULL;
1305         char *provname = NULL, *contname = NULL;
1306         pinfo = capi_get_prov_info(ctx, cert);
1307         if (!pinfo)
1308                 goto err;
1309         provname = wide_to_asc(pinfo->pwszProvName);
1310         contname = wide_to_asc(pinfo->pwszContainerName);
1311         if (!provname || !contname)
1312                 return 0;
1313
1314         key = capi_get_key(ctx, contname, provname, pinfo->dwProvType, pinfo->dwKeySpec);
1315
1316         err:
1317         if (pinfo)
1318                 OPENSSL_free(pinfo);
1319         if (provname)
1320                 OPENSSL_free(provname);
1321         if (contname)
1322                 OPENSSL_free(contname);
1323         return key;
1324         }
1325
1326 CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id)
1327         {
1328         PCCERT_CONTEXT cert;
1329         HCERTSTORE hstore;
1330         CAPI_KEY *key = NULL;
1331         switch (ctx->lookup_method)
1332                 {
1333                 case CAPI_LU_SUBSTR:
1334                 case CAPI_LU_FNAME:
1335                 hstore = capi_open_store(ctx, NULL);
1336                 if (!hstore)
1337                         return NULL;
1338                 cert = capi_find_cert(ctx, id, hstore);
1339                 if (cert)
1340                         {
1341                         key = capi_get_cert_key(ctx, cert);
1342                         CertFreeCertificateContext(cert);
1343                         }
1344                 CertCloseStore(hstore, 0);
1345                 break;
1346
1347                 case CAPI_LU_CONTNAME:
1348                 key = capi_get_key(ctx, id, ctx->cspname, ctx->csptype, ctx->keytype);
1349                 break;
1350                 }
1351
1352         return key;
1353         }
1354
1355 void capi_free_key(CAPI_KEY *key)
1356         {
1357         if (!key)
1358                 return;
1359         CryptDestroyKey(key->key);
1360         CryptReleaseContext(key->hprov, 0);
1361         OPENSSL_free(key);
1362         }
1363
1364
1365 /* Initialize a CAPI_CTX structure */
1366
1367 static CAPI_CTX *capi_ctx_new()
1368         {
1369         CAPI_CTX *ctx;
1370         ctx = OPENSSL_malloc(sizeof(CAPI_CTX));
1371         if (!ctx)
1372                 {
1373                 CAPIerr(CAPI_F_CAPI_CTX_NEW, ERR_R_MALLOC_FAILURE);
1374                 return NULL;
1375                 }
1376         ctx->cspname = NULL;
1377         ctx->csptype = PROV_RSA_FULL;
1378         ctx->dump_flags = CAPI_DMP_SUMMARY|CAPI_DMP_FNAME;
1379         ctx->keytype = AT_KEYEXCHANGE;
1380         ctx->storename = NULL;
1381         ctx->lookup_method = CAPI_LU_SUBSTR;
1382         ctx->debug_level = 0;
1383         ctx->debug_file = NULL;
1384         return ctx;
1385         }
1386
1387 static void capi_ctx_free(CAPI_CTX *ctx)
1388         {
1389         CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx);
1390         if (!ctx)
1391                 return;
1392         if (ctx->cspname)
1393                 OPENSSL_free(ctx->cspname);
1394         if (ctx->debug_file)
1395                 OPENSSL_free(ctx->debug_file);
1396         if (ctx->storename)
1397                 OPENSSL_free(ctx->storename);
1398         OPENSSL_free(ctx);
1399         }
1400
1401 static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check)
1402         {
1403         CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type);
1404         if (check)
1405                 {
1406                 HCRYPTPROV hprov;
1407                 if (!CryptAcquireContext(&hprov, NULL, pname, type, CRYPT_VERIFYCONTEXT))
1408                         {
1409                         CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1410                         capi_addlasterror();
1411                         return 0;
1412                         }
1413                 CryptReleaseContext(hprov, 0);
1414                 }
1415         ctx->cspname = BUF_strdup(pname);
1416         ctx->csptype = type;
1417         return 1;
1418         }
1419
1420 static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx)
1421         {
1422         LPSTR pname;
1423         DWORD type;
1424         if (capi_get_provname(ctx, &pname, &type, idx) != 1)
1425                 return 0;
1426         return capi_ctx_set_provname(ctx, pname, type, 0);
1427         }
1428
1429 #endif
1430 #endif