engines/e_capi.c

   1 /* engines/e_capi.c */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  */
  53
  54
  55 #include <stdio.h>
  56 #include <string.h>
  57 #include <openssl/crypto.h>
  58 #include <openssl/buffer.h>
  59 #include <openssl/bn.h>
  60
  61 #ifdef OPENSSL_SYS_WIN32
  62 #ifndef OPENSSL_NO_CAPIENG
  63
  64 #include <openssl/rsa.h>
  65
  66 #include <windows.h>
  67
  68 #ifndef _WIN32_WINNT
  69 #define _WIN32_WINNT 0x0400
  70 #endif
  71
  72 #include <wincrypt.h>
  73
  74 #undef X509_EXTENSIONS
  75 #undef X509_CERT_PAIR
  76
  77 /* Definitions which may be missing from earlier version of headers */
  78 #ifndef CERT_STORE_OPEN_EXISTING_FLAG
  79 #define CERT_STORE_OPEN_EXISTING_FLAG                   0x00004000
  80 #endif
  81
  82 #ifndef CERT_STORE_CREATE_NEW_FLAG
  83 #define CERT_STORE_CREATE_NEW_FLAG                      0x00002000
  84 #endif
  85
  86 #include <openssl/engine.h>
  87 #include <openssl/pem.h>
  88 #include <openssl/x509v3.h>
  89
  90 #include "e_capi_err.h"
  91 #include "e_capi_err.c"
  92
  93
  94 static const char *engine_capi_id = "capi";
  95 static const char *engine_capi_name = "CryptoAPI ENGINE";
  96
  97 typedef struct CAPI_CTX_st CAPI_CTX;
  98 typedef struct CAPI_KEY_st CAPI_KEY;
  99
 100 static void capi_addlasterror(void);
 101 static void capi_adderror(DWORD err);
 102
 103 static void CAPI_trace(CAPI_CTX *ctx, char *format, ...);
 104
 105 static int capi_list_providers(CAPI_CTX *ctx, BIO *out);
 106 static int capi_list_containers(CAPI_CTX *ctx, BIO *out);
 107 int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename);
 108 void capi_free_key(CAPI_KEY *key);
 109
 110 static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore);
 111
 112 CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id);
 113
 114 static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
 115         UI_METHOD *ui_method, void *callback_data);
 116 static int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
 117              unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
 118 static int capi_rsa_priv_enc(int flen, const unsigned char *from,
 119                 unsigned char *to, RSA *rsa, int padding);
 120 static int capi_rsa_priv_dec(int flen, const unsigned char *from,
 121                 unsigned char *to, RSA *rsa, int padding);
 122 static int capi_rsa_free(RSA *rsa);
 123
 124 static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
 125                                                         DSA *dsa);
 126 static int capi_dsa_free(DSA *dsa);
 127
 128 static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
 129         STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
 130         STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);
 131
 132 static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
 133 #ifdef OPENSSL_CAPIENG_DIALOG
 134 static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
 135 #endif
 136
 137 typedef PCCERT_CONTEXT (WINAPI *CERTDLG)(HCERTSTORE, HWND, LPCWSTR,
 138                                                 LPCWSTR, DWORD, DWORD,
 139                                                 void *);
 140 typedef HWND (WINAPI *GETCONSWIN)(void);
 141
 142 /* This structure contains CAPI ENGINE specific data:
 143  * it contains various global options and affects how
 144  * other functions behave.
 145  */
 146
 147 #define CAPI_DBG_TRACE  2
 148 #define CAPI_DBG_ERROR  1
 149
 150 struct CAPI_CTX_st {
 151         int debug_level;
 152         char *debug_file;
 153         /* Parameters to use for container lookup */
 154         DWORD keytype;
 155         LPSTR cspname;
 156         DWORD csptype;
 157         /* Certificate store name to use */
 158         LPSTR storename;
 159         LPSTR ssl_client_store;
 160         /* System store flags */
 161         DWORD store_flags;
 162
 163 /* Lookup string meanings in load_private_key */
 164 /* Substring of subject: uses "storename" */
 165 #define CAPI_LU_SUBSTR          0
 166 /* Friendly name: uses storename */
 167 #define CAPI_LU_FNAME           1
 168 /* Container name: uses cspname, keytype */
 169 #define CAPI_LU_CONTNAME        2
 170         int lookup_method;
 171 /* Info to dump with dumpcerts option */
 172 /* Issuer and serial name strings */
 173 #define CAPI_DMP_SUMMARY        0x1
 174 /* Friendly name */
 175 #define CAPI_DMP_FNAME          0x2
 176 /* Full X509_print dump */
 177 #define CAPI_DMP_FULL           0x4
 178 /* Dump PEM format certificate */
 179 #define CAPI_DMP_PEM            0x8
 180 /* Dump pseudo key (if possible) */
 181 #define CAPI_DMP_PSKEY          0x10
 182 /* Dump key info (if possible) */
 183 #define CAPI_DMP_PKEYINFO       0x20
 184
 185         DWORD dump_flags;
 186         int (*client_cert_select)(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
 187
 188         CERTDLG certselectdlg;
 189         GETCONSWIN getconswindow;
 190 };
 191
 192
 193 static CAPI_CTX *capi_ctx_new();
 194 static void capi_ctx_free(CAPI_CTX *ctx);
 195 static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check);
 196 static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx);
 197
 198 #define CAPI_CMD_LIST_CERTS             ENGINE_CMD_BASE
 199 #define CAPI_CMD_LOOKUP_CERT            (ENGINE_CMD_BASE + 1)
 200 #define CAPI_CMD_DEBUG_LEVEL            (ENGINE_CMD_BASE + 2)
 201 #define CAPI_CMD_DEBUG_FILE             (ENGINE_CMD_BASE + 3)
 202 #define CAPI_CMD_KEYTYPE                (ENGINE_CMD_BASE + 4)
 203 #define CAPI_CMD_LIST_CSPS              (ENGINE_CMD_BASE + 5)
 204 #define CAPI_CMD_SET_CSP_IDX            (ENGINE_CMD_BASE + 6)
 205 #define CAPI_CMD_SET_CSP_NAME           (ENGINE_CMD_BASE + 7)
 206 #define CAPI_CMD_SET_CSP_TYPE           (ENGINE_CMD_BASE + 8)
 207 #define CAPI_CMD_LIST_CONTAINERS        (ENGINE_CMD_BASE + 9)
 208 #define CAPI_CMD_LIST_OPTIONS           (ENGINE_CMD_BASE + 10)
 209 #define CAPI_CMD_LOOKUP_METHOD          (ENGINE_CMD_BASE + 11)
 210 #define CAPI_CMD_STORE_NAME             (ENGINE_CMD_BASE + 12)
 211 #define CAPI_CMD_STORE_FLAGS            (ENGINE_CMD_BASE + 13)
 212
 213 static const ENGINE_CMD_DEFN capi_cmd_defns[] = {
 214         {CAPI_CMD_LIST_CERTS,
 215                 "list_certs",
 216                 "List all certificates in store",
 217                 ENGINE_CMD_FLAG_NO_INPUT},
 218         {CAPI_CMD_LOOKUP_CERT,
 219                 "lookup_cert",
 220                 "Lookup and output certificates",
 221                 ENGINE_CMD_FLAG_STRING},
 222         {CAPI_CMD_DEBUG_LEVEL,
 223                 "debug_level",
 224                 "debug level (1=errors, 2=trace)",
 225                 ENGINE_CMD_FLAG_NUMERIC},
 226         {CAPI_CMD_DEBUG_FILE,
 227                 "debug_file",
 228                 "debugging filename)",
 229                 ENGINE_CMD_FLAG_STRING},
 230         {CAPI_CMD_KEYTYPE,
 231                 "key_type",
 232                 "Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE",
 233                 ENGINE_CMD_FLAG_NUMERIC},
 234         {CAPI_CMD_LIST_CSPS,
 235                 "list_csps",
 236                 "List all CSPs",
 237                 ENGINE_CMD_FLAG_NO_INPUT},
 238         {CAPI_CMD_SET_CSP_IDX,
 239                 "csp_idx",
 240                 "Set CSP by index",
 241                 ENGINE_CMD_FLAG_NUMERIC},
 242         {CAPI_CMD_SET_CSP_NAME,
 243                 "csp_name",
 244                 "Set CSP name, (default CSP used if not specified)",
 245                 ENGINE_CMD_FLAG_STRING},
 246         {CAPI_CMD_SET_CSP_TYPE,
 247                 "csp_type",
 248                 "Set CSP type, (default RSA_PROV_FULL)",
 249                 ENGINE_CMD_FLAG_NUMERIC},
 250         {CAPI_CMD_LIST_CONTAINERS,
 251                 "list_containers",
 252                 "list container names",
 253                 ENGINE_CMD_FLAG_NO_INPUT},
 254         {CAPI_CMD_LIST_OPTIONS,
 255                 "list_options",
 256                 "Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, "
 257                 "32=private key info)",
 258                 ENGINE_CMD_FLAG_NUMERIC},
 259         {CAPI_CMD_LOOKUP_METHOD,
 260                 "lookup_method",
 261                 "Set key lookup method (1=substring, 2=friendlyname, 3=container name)",
 262                 ENGINE_CMD_FLAG_NUMERIC},
 263         {CAPI_CMD_STORE_NAME,
 264                 "store_name",
 265                 "certificate store name, default \"MY\"",
 266                 ENGINE_CMD_FLAG_STRING},
 267         {CAPI_CMD_STORE_FLAGS,
 268                 "store_flags",
 269                 "Certificate store flags: 1 = system store",
 270                 ENGINE_CMD_FLAG_NUMERIC},
 271
 272         {0, NULL, NULL, 0}
 273         };
 274
 275 static int capi_idx = -1;
 276 static int rsa_capi_idx = -1;
 277 static int dsa_capi_idx = -1;
 278 static int cert_capi_idx = -1;
 279
 280 static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
 281         {
 282         int ret = 1;
 283         CAPI_CTX *ctx;
 284         BIO *out;
 285         if (capi_idx == -1)
 286                 {
 287                 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED);
 288                 return 0;
 289                 }
 290         ctx = ENGINE_get_ex_data(e, capi_idx);
 291         out = BIO_new_fp(stdout, BIO_NOCLOSE);
 292         switch (cmd)
 293                 {
 294                 case CAPI_CMD_LIST_CSPS:
 295                 ret = capi_list_providers(ctx, out);
 296                 break;
 297
 298                 case CAPI_CMD_LIST_CERTS:
 299                 ret = capi_list_certs(ctx, out, NULL);
 300                 break;
 301
 302                 case CAPI_CMD_LOOKUP_CERT:
 303                 ret = capi_list_certs(ctx, out, p);
 304                 break;
 305
 306                 case CAPI_CMD_LIST_CONTAINERS:
 307                 ret = capi_list_containers(ctx, out);
 308                 break;
 309
 310                 case CAPI_CMD_STORE_NAME:
 311                 if (ctx->storename)
 312                         OPENSSL_free(ctx->storename);
 313                 ctx->storename = BUF_strdup(p);
 314                 CAPI_trace(ctx, "Setting store name to %s\n", p);
 315                 break;
 316
 317                 case CAPI_CMD_STORE_FLAGS:
 318                 if (i & 1)
 319                         {
 320                         ctx->store_flags |= CERT_SYSTEM_STORE_LOCAL_MACHINE;
 321                         ctx->store_flags &= ~CERT_SYSTEM_STORE_CURRENT_USER;
 322                         }
 323                 else
 324                         {
 325                         ctx->store_flags |= CERT_SYSTEM_STORE_CURRENT_USER;
 326                         ctx->store_flags &= ~CERT_SYSTEM_STORE_LOCAL_MACHINE;
 327                         }
 328                 CAPI_trace(ctx, "Setting flags to %d\n", i);
 329                 break;
 330
 331                 case CAPI_CMD_DEBUG_LEVEL:
 332                 ctx->debug_level = (int)i;
 333                 CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level);
 334                 break;
 335
 336                 case CAPI_CMD_DEBUG_FILE:
 337                 ctx->debug_file = BUF_strdup(p);
 338                 CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file);
 339                 break;
 340
 341                 case CAPI_CMD_KEYTYPE:
 342                 ctx->keytype = i;
 343                 CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype);
 344                 break;
 345
 346                 case CAPI_CMD_SET_CSP_IDX:
 347                 ret = capi_ctx_set_provname_idx(ctx, i);
 348                 break;
 349
 350                 case CAPI_CMD_LIST_OPTIONS:
 351                 ctx->dump_flags = i;
 352                 break;
 353
 354                 case CAPI_CMD_LOOKUP_METHOD:
 355                 if (i < 1 || i > 3)
 356                         {
 357                         CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD);
 358                         return 0;
 359                         }
 360                 ctx->lookup_method = i;
 361                 break;
 362
 363                 case CAPI_CMD_SET_CSP_NAME:
 364                 ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1);
 365                 break;
 366
 367                 case CAPI_CMD_SET_CSP_TYPE:
 368                 ctx->csptype = i;
 369                 break;
 370
 371                 default:
 372                 CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND);
 373                 ret = 0;
 374         }
 375
 376         BIO_free(out);
 377         return ret;
 378
 379         }
 380
 381 static RSA_METHOD capi_rsa_method =
 382         {
 383         "CryptoAPI RSA method",
 384         0,                              /* pub_enc */
 385         0,                              /* pub_dec */
 386         capi_rsa_priv_enc,              /* priv_enc */
 387         capi_rsa_priv_dec,              /* priv_dec */
 388         0,                              /* rsa_mod_exp */
 389         0,                              /* bn_mod_exp */
 390         0,                              /* init */
 391         capi_rsa_free,                  /* finish */
 392         RSA_FLAG_SIGN_VER,              /* flags */
 393         NULL,                           /* app_data */
 394         capi_rsa_sign,                  /* rsa_sign */
 395         0                               /* rsa_verify */
 396         };
 397
 398 static DSA_METHOD capi_dsa_method =
 399         {
 400         "CryptoAPI DSA method",
 401         capi_dsa_do_sign,               /* dsa_do_sign */
 402         0,                              /* dsa_sign_setup */
 403         0,                              /* dsa_do_verify */
 404         0,                              /* dsa_mod_exp */
 405         0,                              /* bn_mod_exp */
 406         0,                              /* init */
 407         capi_dsa_free,                  /* finish */
 408         0,                              /* flags */
 409         NULL,                           /* app_data */
 410         0,                              /* dsa_paramgen */
 411         0                               /* dsa_keygen */
 412         };
 413
 414 static int capi_init(ENGINE *e)
 415         {
 416         CAPI_CTX *ctx;
 417         const RSA_METHOD *ossl_rsa_meth;
 418         const DSA_METHOD *ossl_dsa_meth;
 419         capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0);
 420         cert_capi_idx = X509_get_ex_new_index(0, NULL, NULL, NULL, 0);
 421
 422         ctx = capi_ctx_new();
 423         if (!ctx || (capi_idx < 0))
 424                 goto memerr;
 425
 426         ENGINE_set_ex_data(e, capi_idx, ctx);
 427         /* Setup RSA_METHOD */
 428         rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
 429         ossl_rsa_meth = RSA_PKCS1_SSLeay();
 430         capi_rsa_method.rsa_pub_enc = ossl_rsa_meth->rsa_pub_enc;
 431         capi_rsa_method.rsa_pub_dec = ossl_rsa_meth->rsa_pub_dec;
 432         capi_rsa_method.rsa_mod_exp = ossl_rsa_meth->rsa_mod_exp;
 433         capi_rsa_method.bn_mod_exp = ossl_rsa_meth->bn_mod_exp;
 434
 435         /* Setup DSA Method */
 436         dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
 437         ossl_dsa_meth = DSA_OpenSSL();
 438         capi_dsa_method.dsa_do_verify = ossl_dsa_meth->dsa_do_verify;
 439         capi_dsa_method.dsa_mod_exp = ossl_dsa_meth->dsa_mod_exp;
 440         capi_dsa_method.bn_mod_exp = ossl_dsa_meth->bn_mod_exp;
 441
 442 #ifdef OPENSSL_CAPIENG_DIALOG
 443         {
 444         HMODULE cryptui = LoadLibrary(TEXT("CRYPTUI.DLL"));
 445         HMODULE kernel = GetModuleHandle(TEXT("KERNEL32.DLL"));
 446         if (cryptui)
 447                 ctx->certselectdlg = (CERTDLG)GetProcAddress(cryptui, "CryptUIDlgSelectCertificateFromStore");
 448         if (kernel)
 449                 ctx->getconswindow = (GETCONSWIN)GetProcAddress(kernel, "GetConsoleWindow");
 450         if (cryptui && !OPENSSL_isservice())
 451                 ctx->client_cert_select = cert_select_dialog;
 452         }
 453 #endif
 454
 455
 456         return 1;
 457
 458         memerr:
 459         CAPIerr(CAPI_F_CAPI_INIT, ERR_R_MALLOC_FAILURE);
 460         return 0;
 461
 462         return 1;
 463         }
 464
 465 static int capi_destroy(ENGINE *e)
 466         {
 467         ERR_unload_CAPI_strings();
 468         return 1;
 469         }
 470
 471 static int capi_finish(ENGINE *e)
 472         {
 473         CAPI_CTX *ctx;
 474         ctx = ENGINE_get_ex_data(e, capi_idx);
 475         capi_ctx_free(ctx);
 476         ENGINE_set_ex_data(e, capi_idx, NULL);
 477         return 1;
 478         }
 479
 480
 481 /* CryptoAPI key application data. This contains
 482  * a handle to the private key container (for sign operations)
 483  * and a handle to the key (for decrypt operations).
 484  */
 485
 486 struct CAPI_KEY_st
 487         {
 488         /* Associated certificate context (if any) */
 489         PCCERT_CONTEXT pcert;
 490         HCRYPTPROV hprov;
 491         HCRYPTKEY key;
 492         DWORD keyspec;
 493         };
 494
 495 static int bind_capi(ENGINE *e)
 496         {
 497         if (!ENGINE_set_id(e, engine_capi_id)
 498                 || !ENGINE_set_name(e, engine_capi_name)
 499                 || !ENGINE_set_init_function(e, capi_init)
 500                 || !ENGINE_set_finish_function(e, capi_finish)
 501                 || !ENGINE_set_destroy_function(e, capi_destroy)
 502                 || !ENGINE_set_RSA(e, &capi_rsa_method)
 503                 || !ENGINE_set_DSA(e, &capi_dsa_method)
 504                 || !ENGINE_set_load_privkey_function(e, capi_load_privkey)
 505                 || !ENGINE_set_load_ssl_client_cert_function(e,
 506                                                 capi_load_ssl_client_cert)
 507                 || !ENGINE_set_cmd_defns(e, capi_cmd_defns)
 508                 || !ENGINE_set_ctrl_function(e, capi_ctrl))
 509                         return 0;
 510         ERR_load_CAPI_strings();
 511
 512         return 1;
 513
 514         }
 515
 516 #ifndef OPENSSL_NO_DYNAMIC_ENGINE
 517 static int bind_helper(ENGINE *e, const char *id)
 518         {
 519         if(id && (strcmp(id, engine_capi_id) != 0))
 520                 return 0;
 521         if(!bind_capi(e))
 522                 return 0;
 523         return 1;
 524         }
 525 IMPLEMENT_DYNAMIC_CHECK_FN()
 526 IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
 527 #else
 528 static ENGINE *engine_capi(void)
 529         {
 530         ENGINE *ret = ENGINE_new();
 531         if(!ret)
 532                 return NULL;
 533         if(!bind_capi(ret))
 534                 {
 535                 ENGINE_free(ret);
 536                 return NULL;
 537                 }
 538         return ret;
 539         }
 540
 541 void ENGINE_load_capi(void)
 542         {
 543         /* Copied from eng_[openssl|dyn].c */
 544         ENGINE *toadd = engine_capi();
 545         if(!toadd) return;
 546         ENGINE_add(toadd);
 547         ENGINE_free(toadd);
 548         ERR_clear_error();
 549         }
 550 #endif
 551
 552
 553 static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen)
 554         {
 555         int i;
 556         /* Reverse buffer in place: since this is a keyblob structure
 557          * that will be freed up after conversion anyway it doesn't
 558          * matter if we change it.
 559          */
 560         for(i = 0; i < binlen / 2; i++)
 561                 {
 562                 unsigned char c;
 563                 c = bin[i];
 564                 bin[i] = bin[binlen - i - 1];
 565                 bin[binlen - i - 1] = c;
 566                 }
 567
 568         if (!BN_bin2bn(bin, binlen, bn))
 569                 return 0;
 570         return 1;
 571         }
 572
 573 /* Given a CAPI_KEY get an EVP_PKEY structure */
 574
 575 static EVP_PKEY *capi_get_pkey(ENGINE *eng, CAPI_KEY *key)
 576         {
 577         unsigned char *pubkey = NULL;
 578         DWORD len;
 579         BLOBHEADER *bh;
 580         RSA *rkey = NULL;
 581         DSA *dkey = NULL;
 582         EVP_PKEY *ret = NULL;
 583         if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len))
 584                 {
 585                 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR);
 586                 capi_addlasterror();
 587                 return NULL;
 588                 }
 589
 590         pubkey = OPENSSL_malloc(len);
 591
 592         if (!pubkey)
 593                 goto memerr;
 594
 595         if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len))
 596                 {
 597                 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_ERROR);
 598                 capi_addlasterror();
 599                 goto err;
 600                 }
 601
 602         bh = (BLOBHEADER *)pubkey;
 603         if (bh->bType != PUBLICKEYBLOB)
 604                 {
 605                 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB);
 606                 goto err;
 607                 }
 608         if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX)
 609                 {
 610                 RSAPUBKEY *rp;
 611                 DWORD rsa_modlen;
 612                 unsigned char *rsa_modulus;
 613                 rp = (RSAPUBKEY *)(bh + 1);
 614                 if (rp->magic != 0x31415352)
 615                         {
 616                         char magstr[10];
 617                         BIO_snprintf(magstr, 10, "%lx", rp->magic);
 618                         CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
 619                         ERR_add_error_data(2, "magic=0x", magstr);
 620                         goto err;
 621                         }
 622                 rsa_modulus = (unsigned char *)(rp + 1);
 623                 rkey = RSA_new_method(eng);
 624                 if (!rkey)
 625                         goto memerr;
 626
 627                 rkey->e = BN_new();
 628                 rkey->n = BN_new();
 629
 630                 if (!rkey->e || !rkey->n)
 631                         goto memerr;
 632
 633                 if (!BN_set_word(rkey->e, rp->pubexp))
 634                         goto memerr;
 635
 636                 rsa_modlen = rp->bitlen / 8;
 637                 if (!lend_tobn(rkey->n, rsa_modulus, rsa_modlen))
 638                         goto memerr;
 639
 640                 RSA_set_ex_data(rkey, rsa_capi_idx, key);
 641
 642                 if (!(ret = EVP_PKEY_new()))
 643                         goto memerr;
 644
 645                 EVP_PKEY_assign_RSA(ret, rkey);
 646                 rkey = NULL;
 647
 648                 }
 649         else if (bh->aiKeyAlg == CALG_DSS_SIGN)
 650                 {
 651                 DSSPUBKEY *dp;
 652                 DWORD dsa_plen;
 653                 unsigned char *btmp;
 654                 dp = (DSSPUBKEY *)(bh + 1);
 655                 if (dp->magic != 0x31535344)
 656                         {
 657                         char magstr[10];
 658                         BIO_snprintf(magstr, 10, "%lx", dp->magic);
 659                         CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
 660                         ERR_add_error_data(2, "magic=0x", magstr);
 661                         goto err;
 662                         }
 663                 dsa_plen = dp->bitlen / 8;
 664                 btmp = (unsigned char *)(dp + 1);
 665                 dkey = DSA_new_method(eng);
 666                 if (!dkey)
 667                         goto memerr;
 668                 dkey->p = BN_new();
 669                 dkey->q = BN_new();
 670                 dkey->g = BN_new();
 671                 dkey->pub_key = BN_new();
 672                 if (!dkey->p || !dkey->q || !dkey->g || !dkey->pub_key)
 673                         goto memerr;
 674                 if (!lend_tobn(dkey->p, btmp, dsa_plen))
 675                         goto memerr;
 676                 btmp += dsa_plen;
 677                 if (!lend_tobn(dkey->q, btmp, 20))
 678                         goto memerr;
 679                 btmp += 20;
 680                 if (!lend_tobn(dkey->g, btmp, dsa_plen))
 681                         goto memerr;
 682                 btmp += dsa_plen;
 683                 if (!lend_tobn(dkey->pub_key, btmp, dsa_plen))
 684                         goto memerr;
 685                 btmp += dsa_plen;
 686
 687                 DSA_set_ex_data(dkey, dsa_capi_idx, key);
 688
 689                 if (!(ret = EVP_PKEY_new()))
 690                         goto memerr;
 691
 692                 EVP_PKEY_assign_DSA(ret, dkey);
 693                 dkey = NULL;
 694                 }
 695         else
 696                 {
 697                 char algstr[10];
 698                 BIO_snprintf(algstr, 10, "%lx", bh->aiKeyAlg);
 699                 CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM);
 700                 ERR_add_error_data(2, "aiKeyAlg=0x", algstr);
 701                 goto err;
 702                 }
 703
 704
 705         err:
 706         if (pubkey)
 707                 OPENSSL_free(pubkey);
 708         if (!ret)
 709                 {
 710                 if (rkey)
 711                         RSA_free(rkey);
 712                 if (dkey)
 713                         DSA_free(dkey);
 714                 }
 715
 716         return ret;
 717
 718 memerr:
 719         CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_MALLOC_FAILURE);
 720         goto err;
 721
 722         }
 723
 724 static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
 725         UI_METHOD *ui_method, void *callback_data)
 726         {
 727         CAPI_CTX *ctx;
 728         CAPI_KEY *key;
 729         EVP_PKEY *ret;
 730         ctx = ENGINE_get_ex_data(eng, capi_idx);
 731
 732         if (!ctx)
 733                 {
 734                 CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT);
 735                 return NULL;
 736                 }
 737
 738         key = capi_find_key(ctx, key_id);
 739
 740         if (!key)
 741                 return NULL;
 742
 743         ret = capi_get_pkey(eng, key);
 744
 745         if (!ret)
 746                 capi_free_key(key);
 747         return ret;
 748
 749         }
 750
 751 /* CryptoAPI RSA operations */
 752
 753 int capi_rsa_priv_enc(int flen, const unsigned char *from,
 754                 unsigned char *to, RSA *rsa, int padding)
 755         {
 756         CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED);
 757         return -1;
 758         }
 759
 760 int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
 761              unsigned char *sigret, unsigned int *siglen, const RSA *rsa)
 762         {
 763         ALG_ID alg;
 764         HCRYPTHASH hash;
 765         DWORD slen;
 766         unsigned int i;
 767         int ret = -1;
 768         CAPI_KEY *capi_key;
 769         CAPI_CTX *ctx;
 770
 771         ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
 772
 773         CAPI_trace(ctx, "Called CAPI_rsa_sign()\n");
 774
 775         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 776         if (!capi_key)
 777                 {
 778                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY);
 779                 return -1;
 780                 }
 781 /* Convert the signature type to a CryptoAPI algorithm ID */
 782         switch(dtype)
 783                 {
 784         case NID_sha1:
 785                 alg = CALG_SHA1;
 786                 break;
 787
 788         case NID_md5:
 789                 alg = CALG_MD5;
 790                 break;
 791
 792         case NID_md5_sha1:
 793                 alg = CALG_SSL3_SHAMD5;
 794                 break;
 795         default:
 796                 {
 797                 char algstr[10];
 798                 BIO_snprintf(algstr, 10, "%lx", dtype);
 799                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID);
 800                 ERR_add_error_data(2, "NID=0x", algstr);
 801                 return -1;
 802                 }
 803         }
 804
 805
 806
 807 /* Create the hash object */
 808         if(!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash))
 809                 {
 810                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
 811                 capi_addlasterror();
 812                 return -1;
 813                 }
 814 /* Set the hash value to the value passed */
 815
 816         if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0))
 817                 {
 818                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
 819                 capi_addlasterror();
 820                 goto err;
 821                 }
 822
 823
 824 /* Finally sign it */
 825         slen = RSA_size(rsa);
 826         if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, sigret, &slen))
 827                 {
 828                 CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH);
 829                 capi_addlasterror();
 830                 goto err;
 831                 }
 832         else
 833                 {
 834                 ret = 1;
 835                 /* Inplace byte reversal of signature */
 836                 for(i = 0; i < slen / 2; i++)
 837                         {
 838                         unsigned char c;
 839                         c = sigret[i];
 840                         sigret[i] = sigret[slen - i - 1];
 841                         sigret[slen - i - 1] = c;
 842                         }
 843                 *siglen = slen;
 844                 }
 845
 846         /* Now cleanup */
 847
 848 err:
 849         CryptDestroyHash(hash);
 850
 851         return ret;
 852         }
 853
 854 int capi_rsa_priv_dec(int flen, const unsigned char *from,
 855                 unsigned char *to, RSA *rsa, int padding)
 856         {
 857         int i;
 858         unsigned char *tmpbuf;
 859         CAPI_KEY *capi_key;
 860         CAPI_CTX *ctx;
 861         ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
 862
 863         CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n");
 864
 865
 866         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 867         if (!capi_key)
 868                 {
 869                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY);
 870                 return -1;
 871                 }
 872
 873         if(padding != RSA_PKCS1_PADDING)
 874                 {
 875                 char errstr[10];
 876                 BIO_snprintf(errstr, 10, "%d", padding);
 877                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING);
 878                 ERR_add_error_data(2, "padding=", errstr);
 879                 return -1;
 880                 }
 881
 882         /* Create temp reverse order version of input */
 883         if(!(tmpbuf = OPENSSL_malloc(flen)) )
 884                 {
 885                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, ERR_R_MALLOC_FAILURE);
 886                 return -1;
 887                 }
 888         for(i = 0; i < flen; i++)
 889                 tmpbuf[flen - i - 1] = from[i];
 890
 891         /* Finally decrypt it */
 892         if(!CryptDecrypt(capi_key->key, 0, TRUE, 0, tmpbuf, &flen))
 893                 {
 894                 CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR);
 895                 capi_addlasterror();
 896                 OPENSSL_free(tmpbuf);
 897                 return -1;
 898                 }
 899         else memcpy(to, tmpbuf, flen);
 900
 901         OPENSSL_free(tmpbuf);
 902
 903         return flen;
 904         }
 905
 906 static int capi_rsa_free(RSA *rsa)
 907         {
 908         CAPI_KEY *capi_key;
 909         capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
 910         capi_free_key(capi_key);
 911         RSA_set_ex_data(rsa, rsa_capi_idx, 0);
 912         return 1;
 913         }
 914
 915 /* CryptoAPI DSA operations */
 916
 917 static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
 918                                                                 DSA *dsa)
 919         {
 920         HCRYPTHASH hash;
 921         DWORD slen;
 922         DSA_SIG *ret = NULL;
 923         CAPI_KEY *capi_key;
 924         CAPI_CTX *ctx;
 925         unsigned char csigbuf[40];
 926
 927         ctx = ENGINE_get_ex_data(dsa->engine, capi_idx);
 928
 929         CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n");
 930
 931         capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
 932
 933         if (!capi_key)
 934                 {
 935                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY);
 936                 return NULL;
 937                 }
 938
 939         if (dlen != 20)
 940                 {
 941                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH);
 942                 return NULL;
 943                 }
 944
 945         /* Create the hash object */
 946         if(!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash))
 947                 {
 948                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
 949                 capi_addlasterror();
 950                 return NULL;
 951                 }
 952
 953         /* Set the hash value to the value passed */
 954         if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0))
 955                 {
 956                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
 957                 capi_addlasterror();
 958                 goto err;
 959                 }
 960
 961
 962         /* Finally sign it */
 963         slen = sizeof(csigbuf);
 964         if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, csigbuf, &slen))
 965                 {
 966                 CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH);
 967                 capi_addlasterror();
 968                 goto err;
 969                 }
 970         else
 971                 {
 972                 ret = DSA_SIG_new();
 973                 if (!ret)
 974                         goto err;
 975                 ret->r = BN_new();
 976                 ret->s = BN_new();
 977                 if (!ret->r || !ret->s)
 978                         goto err;
 979                 if (!lend_tobn(ret->r, csigbuf, 20)
 980                         || !lend_tobn(ret->s, csigbuf + 20, 20))
 981                         {
 982                         DSA_SIG_free(ret);
 983                         ret = NULL;
 984                         goto err;
 985                         }
 986                 }
 987
 988         /* Now cleanup */
 989
 990 err:
 991         OPENSSL_cleanse(csigbuf, 40);
 992         CryptDestroyHash(hash);
 993         return ret;
 994         }
 995
 996 static int capi_dsa_free(DSA *dsa)
 997         {
 998         CAPI_KEY *capi_key;
 999         capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
1000         capi_free_key(capi_key);
1001         DSA_set_ex_data(dsa, dsa_capi_idx, 0);
1002         return 1;
1003         }
1004
1005 static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, va_list argptr)
1006         {
1007         BIO *out;
1008
1009         if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file))
1010                 return;
1011         out = BIO_new_file(ctx->debug_file, "a+");
1012         BIO_vprintf(out, format, argptr);
1013         BIO_free(out);
1014         }
1015
1016 static void CAPI_trace(CAPI_CTX *ctx, char *format, ...)
1017         {
1018         va_list args;
1019         va_start(args, format);
1020         capi_vtrace(ctx, CAPI_DBG_TRACE, format, args);
1021         va_end(args);
1022         }
1023
1024 static void capi_addlasterror(void)
1025         {
1026         capi_adderror(GetLastError());
1027         }
1028
1029 static void capi_adderror(DWORD err)
1030         {
1031         char errstr[10];
1032         BIO_snprintf(errstr, 10, "%lX", err);
1033         ERR_add_error_data(2, "Error code= 0x", errstr);
1034         }
1035
1036 static char *wide_to_asc(LPWSTR wstr)
1037         {
1038         char *str;
1039         int len_0,sz;
1040
1041         if (!wstr)
1042                 return NULL;
1043         len_0 = (int)wcslen(wstr)+1;    /* WideCharToMultiByte expects int */
1044         sz = WideCharToMultiByte(CP_ACP,0,wstr,len_0,NULL,0,NULL,NULL);
1045         if (!sz)
1046                 {
1047                 CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);
1048                 return NULL;
1049                 }
1050         str = OPENSSL_malloc(sz);
1051         if (!str)
1052                 {
1053                 CAPIerr(CAPI_F_WIDE_TO_ASC, ERR_R_MALLOC_FAILURE);
1054                 return NULL;
1055                 }
1056         if (!WideCharToMultiByte(CP_ACP,0,wstr,len_0,str,sz,NULL,NULL))
1057                 {
1058                 OPENSSL_free(str);
1059                 CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);
1060                 return NULL;
1061                 }
1062         return str;
1063         }
1064
1065 static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, DWORD idx)
1066         {
1067         LPSTR name;
1068         DWORD len, err;
1069         CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx);
1070         if (!CryptEnumProvidersA(idx, NULL, 0, ptype, NULL, &len))
1071                 {
1072                 err = GetLastError();
1073                 if (err == ERROR_NO_MORE_ITEMS)
1074                         return 2;
1075                 CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
1076                 capi_adderror(err);
1077                 return 0;
1078                 }
1079         name = OPENSSL_malloc(len);
1080         if (!CryptEnumProvidersA(idx, NULL, 0, ptype, name, &len))
1081                 {
1082                 err = GetLastError();
1083                 if (err == ERROR_NO_MORE_ITEMS)
1084                         return 2;
1085                 CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
1086                 capi_adderror(err);
1087                 return 0;
1088                 }
1089         *pname = name;
1090         CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", name, *ptype);
1091
1092         return 1;
1093         }
1094
1095 static int capi_list_providers(CAPI_CTX *ctx, BIO *out)
1096         {
1097         DWORD idx, ptype;
1098         int ret;
1099         LPSTR provname = NULL;
1100         CAPI_trace(ctx, "capi_list_providers\n");
1101         BIO_printf(out, "Available CSPs:\n");
1102         for(idx = 0; ; idx++)
1103                 {
1104                 ret = capi_get_provname(ctx, &provname, &ptype, idx);
1105                 if (ret == 2)
1106                         break;
1107                 if (ret == 0)
1108                         break;
1109                 BIO_printf(out, "%d. %s, type %d\n", idx, provname, ptype);
1110                 OPENSSL_free(provname);
1111                 }
1112         return 1;
1113         }
1114
1115 static int capi_list_containers(CAPI_CTX *ctx, BIO *out)
1116         {
1117         int ret = 1;
1118         HCRYPTPROV hprov;
1119         DWORD err, idx, flags, buflen = 0, clen;
1120         LPSTR cname;
1121         CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, ctx->csptype);
1122         if (!CryptAcquireContextA(&hprov, NULL, ctx->cspname, ctx->csptype, CRYPT_VERIFYCONTEXT))
1123                 {
1124                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1125                 capi_addlasterror();
1126                 return 0;
1127                 }
1128         if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, CRYPT_FIRST))
1129                 {
1130                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
1131                 capi_addlasterror();
1132                 return 0;
1133                 }
1134         CAPI_trace(ctx, "Got max container len %d\n", buflen);
1135         if (buflen == 0)
1136                 buflen = 1024;
1137         cname = OPENSSL_malloc(buflen);
1138         if (!cname)
1139                 {
1140                 CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE);
1141                 goto err;
1142                 }
1143
1144         for (idx = 0;;idx++)
1145                 {
1146                 clen = buflen;
1147                 cname[0] = 0;
1148
1149                 if (idx == 0)
1150                         flags = CRYPT_FIRST;
1151                 else
1152                         flags = 0;
1153                 if(!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, cname, &clen, flags))
1154                         {
1155                         err = GetLastError();
1156                         if (err == ERROR_NO_MORE_ITEMS)
1157                                 goto done;
1158                         CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
1159                         capi_adderror(err);
1160                         goto err;
1161                         }
1162                 CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", cname, clen, idx, flags);
1163                 if (!cname[0] && (clen == buflen))
1164                         {
1165                         CAPI_trace(ctx, "Enumerate bug: using workaround\n");
1166                         goto done;
1167                         }
1168                 BIO_printf(out, "%d. %s\n", idx, cname);
1169                 }
1170         err:
1171
1172         ret = 0;
1173
1174         done:
1175         if (cname)
1176                 OPENSSL_free(cname);
1177         CryptReleaseContext(hprov, 0);
1178
1179         return ret;
1180         }
1181
1182 CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1183         {
1184         DWORD len;
1185         CRYPT_KEY_PROV_INFO *pinfo;
1186
1187         if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &len))
1188                 return NULL;
1189         pinfo = OPENSSL_malloc(len);
1190         if (!pinfo)
1191                 {
1192                 CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, ERR_R_MALLOC_FAILURE);
1193                 return NULL;
1194                 }
1195         if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, pinfo, &len))
1196                 {
1197                 CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO);
1198                 capi_addlasterror();
1199                 OPENSSL_free(pinfo);
1200                 return NULL;
1201                 }
1202         return pinfo;
1203         }
1204
1205 static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, CRYPT_KEY_PROV_INFO *pinfo)
1206         {
1207         char *provname = NULL, *contname = NULL;
1208         if (!pinfo)
1209                 {
1210                 BIO_printf(out, "  No Private Key\n");
1211                 return;
1212                 }
1213         provname = wide_to_asc(pinfo->pwszProvName);
1214         contname = wide_to_asc(pinfo->pwszContainerName);
1215         if (!provname || !contname)
1216                 goto err;
1217
1218         BIO_printf(out, "  Private Key Info:\n");
1219         BIO_printf(out, "    Provider Name:  %s, Provider Type %d\n", provname, pinfo->dwProvType);
1220         BIO_printf(out, "    Container Name: %s, Key Type %d\n", contname, pinfo->dwKeySpec);
1221         err:
1222         if (provname)
1223                 OPENSSL_free(provname);
1224         if (contname)
1225                 OPENSSL_free(contname);
1226         }
1227
1228 char * capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1229         {
1230         LPWSTR wfname;
1231         DWORD dlen;
1232
1233         CAPI_trace(ctx, "capi_cert_get_fname\n");
1234         if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &dlen))
1235                 return NULL;
1236         wfname = OPENSSL_malloc(dlen);
1237         if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, wfname, &dlen))
1238                 {
1239                 char *fname = wide_to_asc(wfname);
1240                 OPENSSL_free(wfname);
1241                 return fname;
1242                 }
1243         CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME);
1244         capi_addlasterror();
1245
1246         OPENSSL_free(wfname);
1247         return NULL;
1248         }
1249
1250
1251 void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert)
1252         {
1253         X509 *x;
1254         unsigned char *p;
1255         unsigned long flags = ctx->dump_flags;
1256         if (flags & CAPI_DMP_FNAME)
1257                 {
1258                 char *fname;
1259                 fname = capi_cert_get_fname(ctx, cert);
1260                 if (fname)
1261                         {
1262                         BIO_printf(out, "  Friendly Name \"%s\"\n", fname);
1263                         OPENSSL_free(fname);
1264                         }
1265                 else
1266                         BIO_printf(out, "  <No Friendly Name>\n");
1267                 }
1268
1269         p = cert->pbCertEncoded;
1270         x = d2i_X509(NULL, &p, cert->cbCertEncoded);
1271         if (!x)
1272                 BIO_printf(out, "  <Can't parse certificate>\n");
1273         if (flags & CAPI_DMP_SUMMARY)
1274                 {
1275                 BIO_printf(out, "  Subject: ");
1276                 X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);
1277                 BIO_printf(out, "\n  Issuer: ");
1278                 X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);
1279                 BIO_printf(out, "\n");
1280                 }
1281         if (flags & CAPI_DMP_FULL)
1282                 X509_print_ex(out, x, XN_FLAG_ONELINE,0);
1283
1284         if (flags & CAPI_DMP_PKEYINFO)
1285                 {
1286                 CRYPT_KEY_PROV_INFO *pinfo;
1287                 pinfo = capi_get_prov_info(ctx, cert);
1288                 capi_dump_prov_info(ctx, out, pinfo);
1289                 if (pinfo)
1290                         OPENSSL_free(pinfo);
1291                 }
1292
1293         if (flags & CAPI_DMP_PEM)
1294                 PEM_write_bio_X509(out, x);
1295         X509_free(x);
1296         }
1297
1298 HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename)
1299         {
1300         HCERTSTORE hstore;
1301
1302         if (!storename)
1303                 storename = ctx->storename;
1304         if (!storename)
1305                 storename = "MY";
1306         CAPI_trace(ctx, "Opening certificate store %s\n", storename);
1307
1308         hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_A, 0, 0,
1309                                 ctx->store_flags, storename);
1310         if (!hstore)
1311                 {
1312                 CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE);
1313                 capi_addlasterror();
1314                 }
1315         return hstore;
1316         }
1317
1318 int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id)
1319         {
1320         char *storename;
1321         int idx;
1322         int ret = 1;
1323         HCERTSTORE hstore;
1324         PCCERT_CONTEXT cert = NULL;
1325
1326         storename = ctx->storename;
1327         if (!storename)
1328                 storename = "MY";
1329         CAPI_trace(ctx, "Listing certs for store %s\n", storename);
1330
1331         hstore = capi_open_store(ctx, storename);
1332         if (!hstore)
1333                 return 0;
1334         if (id)
1335                 {
1336                 cert = capi_find_cert(ctx, id, hstore);
1337                 if (!cert)
1338                         {
1339                         ret = 0;
1340                         goto err;
1341                         }
1342                 capi_dump_cert(ctx, out, cert);
1343                 CertFreeCertificateContext(cert);
1344                 }
1345         else
1346                 {
1347                 for(idx = 0;;idx++)
1348                         {
1349                         LPWSTR fname = NULL;
1350                         cert = CertEnumCertificatesInStore(hstore, cert);
1351                         if (!cert)
1352                                 break;
1353                         BIO_printf(out, "Certificate %d\n", idx);
1354                         capi_dump_cert(ctx, out, cert);
1355                         }
1356                 }
1357         err:
1358         CertCloseStore(hstore, 0);
1359         return ret;
1360         }
1361
1362 static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)
1363         {
1364         PCCERT_CONTEXT cert = NULL;
1365         char *fname = NULL;
1366         int match;
1367         switch(ctx->lookup_method)
1368                 {
1369                 case CAPI_LU_SUBSTR:
1370                         return CertFindCertificateInStore(hstore,
1371                                         X509_ASN_ENCODING, 0,
1372                                         CERT_FIND_SUBJECT_STR_A, id, NULL);
1373                 case CAPI_LU_FNAME:
1374                         for(;;)
1375                                 {
1376                                 cert = CertEnumCertificatesInStore(hstore, cert);
1377                                 if (!cert)
1378                                         return NULL;
1379                                 fname = capi_cert_get_fname(ctx, cert);
1380                                 if (fname)
1381                                         {
1382                                         if (strcmp(fname, id))
1383                                                 match = 0;
1384                                         else
1385                                                 match = 1;
1386                                         OPENSSL_free(fname);
1387                                         if (match)
1388                                                 return cert;
1389                                         }
1390                                 }
1391                 default:
1392                         return NULL;
1393                 }
1394         }
1395
1396 static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const char *contname, char *provname, DWORD ptype, DWORD keyspec)
1397         {
1398         CAPI_KEY *key;
1399         key = OPENSSL_malloc(sizeof(CAPI_KEY));
1400         CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n",
1401                                                 contname, provname, ptype);
1402         if (!CryptAcquireContextA(&key->hprov, contname, provname, ptype, 0))
1403                 {
1404                 CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1405                 capi_addlasterror();
1406                 goto err;
1407                 }
1408         if (!CryptGetUserKey(key->hprov, keyspec, &key->key))
1409                 {
1410                 CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR);
1411                 capi_addlasterror();
1412                 CryptReleaseContext(key->hprov, 0);
1413                 goto err;
1414                 }
1415         key->keyspec = keyspec;
1416         key->pcert = NULL;
1417         return key;
1418
1419         err:
1420         OPENSSL_free(key);
1421         return NULL;
1422         }
1423
1424 static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
1425         {
1426         CAPI_KEY *key = NULL;
1427         CRYPT_KEY_PROV_INFO *pinfo = NULL;
1428         char *provname = NULL, *contname = NULL;
1429         pinfo = capi_get_prov_info(ctx, cert);
1430         if (!pinfo)
1431                 goto err;
1432         provname = wide_to_asc(pinfo->pwszProvName);
1433         contname = wide_to_asc(pinfo->pwszContainerName);
1434         if (!provname || !contname)
1435                 goto err;
1436         key = capi_get_key(ctx, contname, provname,
1437                                 pinfo->dwProvType, pinfo->dwKeySpec);
1438
1439         err:
1440         if (pinfo)
1441                 OPENSSL_free(pinfo);
1442         if (provname)
1443                 OPENSSL_free(provname);
1444         if (contname)
1445                 OPENSSL_free(contname);
1446         return key;
1447         }
1448
1449 CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id)
1450         {
1451         PCCERT_CONTEXT cert;
1452         HCERTSTORE hstore;
1453         CAPI_KEY *key = NULL;
1454         switch (ctx->lookup_method)
1455                 {
1456                 case CAPI_LU_SUBSTR:
1457                 case CAPI_LU_FNAME:
1458                 hstore = capi_open_store(ctx, NULL);
1459                 if (!hstore)
1460                         return NULL;
1461                 cert = capi_find_cert(ctx, id, hstore);
1462                 if (cert)
1463                         {
1464                         key = capi_get_cert_key(ctx, cert);
1465                         CertFreeCertificateContext(cert);
1466                         }
1467                 CertCloseStore(hstore, 0);
1468                 break;
1469
1470                 case CAPI_LU_CONTNAME:
1471                 key = capi_get_key(ctx, id, ctx->cspname, ctx->csptype,
1472                                                         ctx->keytype);
1473                 break;
1474                 }
1475
1476         return key;
1477         }
1478
1479 void capi_free_key(CAPI_KEY *key)
1480         {
1481         if (!key)
1482                 return;
1483         CryptDestroyKey(key->key);
1484         CryptReleaseContext(key->hprov, 0);
1485         if (key->pcert)
1486                 CertFreeCertificateContext(key->pcert);
1487         OPENSSL_free(key);
1488         }
1489
1490
1491 /* Initialize a CAPI_CTX structure */
1492
1493 static CAPI_CTX *capi_ctx_new()
1494         {
1495         CAPI_CTX *ctx;
1496         ctx = OPENSSL_malloc(sizeof(CAPI_CTX));
1497         if (!ctx)
1498                 {
1499                 CAPIerr(CAPI_F_CAPI_CTX_NEW, ERR_R_MALLOC_FAILURE);
1500                 return NULL;
1501                 }
1502         ctx->cspname = NULL;
1503         ctx->csptype = PROV_RSA_FULL;
1504         ctx->dump_flags = CAPI_DMP_SUMMARY|CAPI_DMP_FNAME;
1505         ctx->keytype = AT_KEYEXCHANGE;
1506         ctx->storename = NULL;
1507         ctx->ssl_client_store = NULL;
1508         ctx->store_flags = CERT_STORE_OPEN_EXISTING_FLAG |
1509                                 CERT_STORE_READONLY_FLAG |
1510                                 CERT_SYSTEM_STORE_CURRENT_USER;
1511         ctx->lookup_method = CAPI_LU_SUBSTR;
1512         ctx->debug_level = 0;
1513         ctx->debug_file = NULL;
1514         ctx->client_cert_select = cert_select_simple;
1515         return ctx;
1516         }
1517
1518 static void capi_ctx_free(CAPI_CTX *ctx)
1519         {
1520         CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx);
1521         if (!ctx)
1522                 return;
1523         if (ctx->cspname)
1524                 OPENSSL_free(ctx->cspname);
1525         if (ctx->debug_file)
1526                 OPENSSL_free(ctx->debug_file);
1527         if (ctx->storename)
1528                 OPENSSL_free(ctx->storename);
1529         if (ctx->ssl_client_store)
1530                 OPENSSL_free(ctx->ssl_client_store);
1531         OPENSSL_free(ctx);
1532         }
1533
1534 static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check)
1535         {
1536         CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type);
1537         if (check)
1538                 {
1539                 HCRYPTPROV hprov;
1540                 if (!CryptAcquireContextA(&hprov, NULL, pname, type,
1541                                                 CRYPT_VERIFYCONTEXT))
1542                         {
1543                         CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
1544                         capi_addlasterror();
1545                         return 0;
1546                         }
1547                 CryptReleaseContext(hprov, 0);
1548                 }
1549         ctx->cspname = BUF_strdup(pname);
1550         ctx->csptype = type;
1551         return 1;
1552         }
1553
1554 static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx)
1555         {
1556         LPSTR pname;
1557         DWORD type;
1558         if (capi_get_provname(ctx, &pname, &type, idx) != 1)
1559                 return 0;
1560         return capi_ctx_set_provname(ctx, pname, type, 0);
1561         }
1562
1563 static int cert_issuer_match(STACK_OF(X509_NAME) *ca_dn, X509 *x)
1564         {
1565         int i;
1566         X509_NAME *nm;
1567         /* Special case: empty list: match anything */
1568         if (sk_X509_NAME_num(ca_dn) <= 0)
1569                 return 1;
1570         for (i = 0; i < sk_X509_NAME_num(ca_dn); i++)
1571                 {
1572                 nm = sk_X509_NAME_value(ca_dn, i);
1573                 if (!X509_NAME_cmp(nm, X509_get_issuer_name(x)))
1574                                 return 1;
1575                 }
1576         return 0;
1577         }
1578
1579
1580
1581 static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
1582         STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
1583         STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)
1584         {
1585         STACK_OF(X509) *certs = NULL;
1586         X509 *x;
1587         char *storename;
1588         const char *p;
1589         int i, client_cert_idx;
1590         HCERTSTORE hstore;
1591         PCCERT_CONTEXT cert = NULL, excert = NULL;
1592         CAPI_CTX *ctx;
1593         CAPI_KEY *key;
1594         ctx = ENGINE_get_ex_data(e, capi_idx);
1595
1596         *pcert = NULL;
1597         *pkey = NULL;
1598
1599         storename = ctx->ssl_client_store;
1600         if (!storename)
1601                 storename = "MY";
1602
1603         hstore = capi_open_store(ctx, storename);
1604         if (!hstore)
1605                 return 0;
1606         /* Enumerate all certificates collect any matches */
1607         for(i = 0;;i++)
1608                 {
1609                 cert = CertEnumCertificatesInStore(hstore, cert);
1610                 if (!cert)
1611                         break;
1612                 p = cert->pbCertEncoded;
1613                 x = d2i_X509(NULL, &p, cert->cbCertEncoded);
1614                 if (!x)
1615                         {
1616                         CAPI_trace(ctx, "Can't Parse Certificate %d\n", i);
1617                         continue;
1618                         }
1619                 if (cert_issuer_match(ca_dn, x)
1620                         && X509_check_purpose(x, X509_PURPOSE_SSL_CLIENT, 0))
1621                         {
1622                         key = capi_get_cert_key(ctx, cert);
1623                         if (!key)
1624                                 {
1625                                 X509_free(x);
1626                                 continue;
1627                                 }
1628                         /* Match found: attach extra data to it so
1629                          * we can retrieve the key later.
1630                          */
1631                         excert = CertDuplicateCertificateContext(cert);
1632                         key->pcert = excert;
1633                         X509_set_ex_data(x, cert_capi_idx, key);
1634
1635                         if (!certs)
1636                                 certs = sk_X509_new_null();
1637
1638                         sk_X509_push(certs, x);
1639                         }
1640                 else
1641                         X509_free(x);
1642
1643                 }
1644
1645         if (cert)
1646                 CertFreeCertificateContext(cert);
1647         if (hstore)
1648                 CertCloseStore(hstore, 0);
1649
1650         if (!certs)
1651                 return 0;
1652
1653
1654         /* Select the appropriate certificate */
1655
1656         client_cert_idx = ctx->client_cert_select(e, ssl, certs);
1657
1658         /* Set the selected certificate and free the rest */
1659
1660         for(i = 0; i < sk_X509_num(certs); i++)
1661                 {
1662                 x = sk_X509_value(certs, i);
1663                 if (i == client_cert_idx)
1664                         *pcert = x;
1665                 else
1666                         {
1667                         key = X509_get_ex_data(x, cert_capi_idx);
1668                         capi_free_key(key);
1669                         X509_free(x);
1670                         }
1671                 }
1672
1673         sk_X509_free(certs);
1674
1675         if (!*pcert)
1676                 return 0;
1677
1678         /* Setup key for selected certificate */
1679
1680         key = X509_get_ex_data(*pcert, cert_capi_idx);
1681         *pkey = capi_get_pkey(e, key);
1682         X509_set_ex_data(*pcert, cert_capi_idx, NULL);
1683
1684         return 1;
1685
1686         }
1687
1688
1689 /* Simple client cert selection function: always select first */
1690
1691 static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
1692         {
1693         return 0;
1694         }
1695
1696 #ifdef OPENSSL_CAPIENG_DIALOG
1697
1698 /* More complex cert selection function, using standard function
1699  * CryptUIDlgSelectCertificateFromStore() to produce a dialog box.
1700  */
1701
1702 /* Definitions which are in cryptuiapi.h but this is not present in older
1703  * versions of headers.
1704  */
1705
1706 #ifndef CRYPTUI_SELECT_LOCATION_COLUMN
1707 #define CRYPTUI_SELECT_LOCATION_COLUMN                   0x000000010
1708 #define CRYPTUI_SELECT_INTENDEDUSE_COLUMN                0x000000004
1709 #endif
1710
1711 #define dlg_title L"OpenSSL Application SSL Client Certificate Selection"
1712 #define dlg_prompt L"Select a certificate to use for authentication"
1713 #define dlg_columns      CRYPTUI_SELECT_LOCATION_COLUMN \
1714                         |CRYPTUI_SELECT_INTENDEDUSE_COLUMN
1715
1716 static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
1717         {
1718         X509 *x;
1719         HCERTSTORE dstore;
1720         PCCERT_CONTEXT cert;
1721         CAPI_CTX *ctx;
1722         CAPI_KEY *key;
1723         HWND hwnd;
1724         int i, idx = -1;
1725         if (sk_X509_num(certs) == 1)
1726                 return 0;
1727         ctx = ENGINE_get_ex_data(e, capi_idx);
1728         /* Create an in memory store of certificates */
1729         dstore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1730                                         CERT_STORE_CREATE_NEW_FLAG, NULL);
1731         if (!dstore)
1732                 {
1733                 CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_CREATING_STORE);
1734                 capi_addlasterror();
1735                 goto err;
1736                 }
1737         /* Add all certificates to store */
1738         for(i = 0; i < sk_X509_num(certs); i++)
1739                 {
1740                 x = sk_X509_value(certs, i);
1741                 key = X509_get_ex_data(x, cert_capi_idx);
1742
1743                 if (!CertAddCertificateContextToStore(dstore, key->pcert,
1744                                                 CERT_STORE_ADD_NEW, NULL))
1745                         {
1746                         CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_ADDING_CERT);
1747                         capi_addlasterror();
1748                         goto err;
1749                         }
1750
1751                 }
1752         hwnd = GetForegroundWindow();
1753         if (!hwnd)
1754                 hwnd = GetActiveWindow();
1755         if (!hwnd && ctx->getconswindow)
1756                 hwnd = ctx->getconswindow();
1757         /* Call dialog to select one */
1758         cert = ctx->certselectdlg(dstore, hwnd, dlg_title, dlg_prompt,
1759                                                 dlg_columns, 0, NULL);
1760
1761         /* Find matching cert from list */
1762         if (cert)
1763                 {
1764                 for(i = 0; i < sk_X509_num(certs); i++)
1765                         {
1766                         x = sk_X509_value(certs, i);
1767                         key = X509_get_ex_data(x, cert_capi_idx);
1768                         if (CertCompareCertificate(
1769                                 X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
1770                                         cert->pCertInfo,
1771                                         key->pcert->pCertInfo))
1772                                 {
1773                                 idx = i;
1774                                 break;
1775                                 }
1776                         }
1777                 }
1778
1779         err:
1780         if (dstore)
1781                 CertCloseStore(dstore, 0);
1782         return idx;
1783
1784         }
1785 #endif
1786
1787 #endif
1788 #else /* !WIN32 */
1789 #include <openssl/engine.h>
1790 #ifndef OPENSSL_NO_DYNAMIC_ENGINE
1791 OPENSSL_EXPORT
1792 int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
1793 IMPLEMENT_DYNAMIC_CHECK_FN()
1794 #endif
1795 #endif