//+---------------------------------------------------------------------------
//
//  Microsoft Windows NT Security
//  Copyright (C) Microsoft Corporation, 1997 - 1999
//
//  File:       ssctl.cpp
//
//  Contents:   Self Signed Certificate Trust List Subsystem used by the
//              Certificate Chaining Infrastructure for building complex
//              chains
//
//  History:    11-Feb-98    kirtd    Created
//
//----------------------------------------------------------------------------
#include <global.hxx>
#include <dbgdef.h>

//+-------------------------------------------------------------------------
//  Attempt to get and allocate the CTL NextUpdate location Url array.
//--------------------------------------------------------------------------
BOOL
WINAPI
SSCtlGetNextUpdateUrl(
    IN PCCTL_CONTEXT pCtl,
    OUT PCRYPT_URL_ARRAY *ppUrlArray
    )
{
    BOOL fResult;
    PCRYPT_URL_ARRAY pUrlArray = NULL;
    DWORD cbUrlArray = 0;
    LPVOID apv[2];

    apv[0] = (LPVOID) pCtl;
    apv[1] = (LPVOID)(UINT_PTR)(0);     // Signer Index

    if (!ChainGetObjectUrl(
            URL_OID_CTL_NEXT_UPDATE,
            apv,
            0,              // dwFlags
            NULL,           // pUrlArray
            &cbUrlArray,
            NULL,           // pUrlInfo
            NULL,           // cbUrlInfo,
            NULL            // pvReserved
            ))
        goto GetObjectUrlError;

    pUrlArray = (PCRYPT_URL_ARRAY) new BYTE [cbUrlArray];
    if (NULL == pUrlArray)
        goto OutOfMemory;

    if (!ChainGetObjectUrl(
            URL_OID_CTL_NEXT_UPDATE,
            apv,
            0,              // dwFlags
            pUrlArray,
            &cbUrlArray,
            NULL,           // pUrlInfo
            NULL,           // cbUrlInfo,
            NULL            // pvReserved
            ))
        goto GetObjectUrlError;

    if (0 == pUrlArray->cUrl)
        goto NoNextUpdateUrls;

    fResult = TRUE;
CommonReturn:
    *ppUrlArray = pUrlArray;
    return fResult;

ErrorReturn:
    if (pUrlArray) {
        delete (LPBYTE) pUrlArray;
        pUrlArray = NULL;
    }
    fResult = FALSE;
    goto CommonReturn;

TRACE_ERROR(GetObjectUrlError)
SET_ERROR(OutOfMemory, E_OUTOFMEMORY)
SET_ERROR(NoNextUpdateUrls, CRYPT_E_NOT_FOUND)
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObject::CSSCtlObject, public
//
//  Synopsis:   Constructor
//
//----------------------------------------------------------------------------
CSSCtlObject::CSSCtlObject (
                    IN PCCERTCHAINENGINE pChainEngine,
                    IN PCCTL_CONTEXT pCtlContext,
                    IN BOOL fAdditionalStore,
                    OUT BOOL& rfResult
                    )
{
    DWORD           cbData;
    CRYPT_DATA_BLOB DataBlob;

    rfResult = TRUE;

    m_cRefs = 1;
    m_pCtlContext = CertDuplicateCTLContext( pCtlContext );
    m_fHasSignatureBeenVerified = FALSE;
    m_fSignatureValid = FALSE;
    m_hMessageStore = NULL;
    m_hHashEntry = NULL;
    m_pChainEngine = pChainEngine;

    m_pNextUpdateUrlArray = NULL;
    m_dwOfflineCnt = 0;
    I_CryptZeroFileTime(&m_OfflineUpdateTime);

    memset( &m_SignerInfo, 0, sizeof( m_SignerInfo ) );

    cbData = CHAINHASHLEN;
    rfResult = CertGetCTLContextProperty(
                   pCtlContext,
                   CERT_MD5_HASH_PROP_ID,
                   m_rgbCtlHash,
                   &cbData 
                   );

    if ( rfResult && CHAINHASHLEN != cbData)
    {
        rfResult = FALSE;
        SetLastError( (DWORD) E_UNEXPECTED);
    }

    if (!fAdditionalStore)
    {
        if ( rfResult == TRUE )
        {
            DataBlob.cbData = CHAINHASHLEN;
            DataBlob.pbData = m_rgbCtlHash;

            rfResult = I_CryptCreateLruEntry(
                              pChainEngine->SSCtlObjectCache()->HashIndex(),
                              &DataBlob,
                              this,
                              &m_hHashEntry
                              );
        }

        if ( rfResult == TRUE )
        {
            m_hMessageStore = CertOpenStore(
                                  CERT_STORE_PROV_MSG,
                                  X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
                                  NULL,
                                  0,
                                  pCtlContext->hCryptMsg
                                  );

            if ( m_hMessageStore == NULL )
            {
                rfResult = FALSE;
            }
        }
    }

    if ( rfResult == TRUE )
    {
        rfResult = SSCtlGetSignerInfo( pCtlContext, &m_SignerInfo );
    }

    if (!fAdditionalStore)
    {
        if ( rfResult == TRUE )
        {
            if (!I_CryptIsZeroFileTime(&m_pCtlContext->pCtlInfo->NextUpdate))
            {
                // Ignore any errors
                SSCtlGetNextUpdateUrl(m_pCtlContext, &m_pNextUpdateUrlArray);
            }
        }
    }

    assert( m_pChainEngine != NULL );
    assert( m_pCtlContext != NULL );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObject::~CSSCtlObject, public
//
//  Synopsis:   Destructor
//
//----------------------------------------------------------------------------
CSSCtlObject::~CSSCtlObject ()
{
    SSCtlFreeSignerInfo( &m_SignerInfo );

    if ( m_hMessageStore != NULL )
    {
        CertCloseStore( m_hMessageStore, 0 );
    }

    if ( m_pNextUpdateUrlArray != NULL )
    {
        delete (LPBYTE) m_pNextUpdateUrlArray;
    }

    if ( m_hHashEntry != NULL )
    {
        I_CryptReleaseLruEntry( m_hHashEntry );
    }

    CertFreeCTLContext( m_pCtlContext );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObject::GetSigner, public
//
//  Synopsis:   get the certificate object of the signer
//
//----------------------------------------------------------------------------
BOOL
CSSCtlObject::GetSigner (
                 IN PCCHAINPATHOBJECT pSubject,
                 IN PCCHAINCALLCONTEXT pCallContext,
                 IN HCERTSTORE hAdditionalStore,
                 OUT PCCHAINPATHOBJECT* ppSigner,
                 OUT BOOL* pfCtlSignatureValid
                 )
{
    BOOL              fResult;
    PCCHAINPATHOBJECT pSigner = NULL;
    BOOL fNewSigner = TRUE;

    fResult = SSCtlGetSignerChainPathObject(
                   pSubject,
                   pCallContext,
                   &m_SignerInfo,
                   hAdditionalStore,
                   &pSigner,
                   &fNewSigner
                   );

    if (fResult)
    {
        if ( !m_fHasSignatureBeenVerified || fNewSigner )
        {
            CMSG_CTRL_VERIFY_SIGNATURE_EX_PARA CtrlPara;

            memset(&CtrlPara, 0, sizeof(CtrlPara));
            CtrlPara.cbSize = sizeof(CtrlPara);
            // CtrlPara.hCryptProv =

            // This needs to be updated when chain building
            // supports CTLs with more than one signer.
            CtrlPara.dwSignerIndex = 0;
            CtrlPara.dwSignerType = CMSG_VERIFY_SIGNER_CERT;
            CtrlPara.pvSigner = (void *) pSigner->CertObject()->CertContext();


            m_fSignatureValid = CryptMsgControl(
                                     m_pCtlContext->hCryptMsg,
                                     0,
                                     CMSG_CTRL_VERIFY_SIGNATURE_EX,
                                     &CtrlPara
                                     );

            m_fHasSignatureBeenVerified = TRUE;

            CertPerfIncrementChainVerifyCtlSignatureCount();
        }
        else
        {
            CertPerfIncrementChainBeenVerifiedCtlSignatureCount();
        }

        *ppSigner = pSigner;
    }
    *pfCtlSignatureValid = m_fSignatureValid;


    return fResult;
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObject::GetTrustListInfo, public
//
//  Synopsis:   get the trust list information relative to a particular cert
//              object
//
//----------------------------------------------------------------------------
BOOL
CSSCtlObject::GetTrustListInfo (
                 IN PCCERT_CONTEXT pCertContext,
                 OUT PCERT_TRUST_LIST_INFO* ppTrustListInfo
                 )
{
    PCTL_ENTRY            pCtlEntry;
    PCERT_TRUST_LIST_INFO pTrustListInfo;

    pCtlEntry = CertFindSubjectInCTL(
                    X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
                    CTL_CERT_SUBJECT_TYPE,
                    (LPVOID)pCertContext,
                    m_pCtlContext,
                    0
                    );

    if ( pCtlEntry == NULL )
    {
        SetLastError( (DWORD) CRYPT_E_NOT_FOUND );
        return( FALSE );
    }

    pTrustListInfo = new CERT_TRUST_LIST_INFO;
    if ( pTrustListInfo == NULL )
    {
        SetLastError( (DWORD) E_OUTOFMEMORY );
        return( FALSE );
    }

    pTrustListInfo->cbSize = sizeof( CERT_TRUST_LIST_INFO );
    pTrustListInfo->pCtlEntry = pCtlEntry;
    pTrustListInfo->pCtlContext = CertDuplicateCTLContext( m_pCtlContext );

    *ppTrustListInfo = pTrustListInfo;

    return( TRUE );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObject::CalculateStatus, public
//
//  Synopsis:   calculate the status
//
//----------------------------------------------------------------------------
VOID
CSSCtlObject::CalculateStatus (
                       IN LPFILETIME pTime,
                       IN PCERT_USAGE_MATCH pRequestedUsage,
                       IN OUT PCERT_TRUST_STATUS pStatus
                       )
{
    assert( m_fHasSignatureBeenVerified == TRUE );

    SSCtlGetCtlTrustStatus(
         m_pCtlContext,
         m_fSignatureValid,
         pTime,
         pRequestedUsage,
         pStatus
         );
}


//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObject::HasNextUpdateUrl, public
//
//  Synopsis:   returns TRUE if the Ctl has a NextUpdate time and location Url
//
//----------------------------------------------------------------------------
BOOL CSSCtlObject::HasNextUpdateUrl (
                OUT LPFILETIME pUpdateTime
                )
{
    if ( m_pNextUpdateUrlArray != NULL )
    {
        assert(!I_CryptIsZeroFileTime(&m_pCtlContext->pCtlInfo->NextUpdate));
        if (0 != m_dwOfflineCnt) {
            assert(!I_CryptIsZeroFileTime(&m_OfflineUpdateTime));
            *pUpdateTime = m_OfflineUpdateTime;
        } else
            *pUpdateTime = m_pCtlContext->pCtlInfo->NextUpdate;
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObject::SetOffline, public
//
//  Synopsis:   called when offline
//
//----------------------------------------------------------------------------
void CSSCtlObject::SetOffline (
                IN LPFILETIME pCurrentTime,
                OUT LPFILETIME pUpdateTime
                )
{
    m_dwOfflineCnt++;

    I_CryptIncrementFileTimeBySeconds(
            pCurrentTime,
            ChainGetOfflineUrlDeltaSeconds(m_dwOfflineCnt),
            &m_OfflineUpdateTime
            );

    *pUpdateTime = m_OfflineUpdateTime;
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::CSSCtlObjectCache, public
//
//  Synopsis:   Constructor
//
//----------------------------------------------------------------------------
CSSCtlObjectCache::CSSCtlObjectCache (
                         OUT BOOL& rfResult
                         )
{
    LRU_CACHE_CONFIG Config;

    memset( &Config, 0, sizeof( Config ) );

    Config.dwFlags = LRU_CACHE_NO_SERIALIZE | LRU_CACHE_NO_COPY_IDENTIFIER;
    Config.pfnHash = CertObjectCacheHashMd5Identifier;
    Config.cBuckets = DEFAULT_CERT_OBJECT_CACHE_BUCKETS;
    Config.pfnOnRemoval = SSCtlOnRemovalFromCache;

    m_hHashIndex = NULL;

    rfResult = I_CryptCreateLruCache( &Config, &m_hHashIndex );

    I_CryptZeroFileTime(&m_UpdateTime);
    m_fFirstUpdate = FALSE;
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::~CSSCtlObjectCache, public
//
//  Synopsis:   Destructor
//
//----------------------------------------------------------------------------
CSSCtlObjectCache::~CSSCtlObjectCache ()
{
    I_CryptFreeLruCache( m_hHashIndex, 0, NULL );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::PopulateCache, public
//
//  Synopsis:   populate the cache
//
//----------------------------------------------------------------------------
BOOL
CSSCtlObjectCache::PopulateCache (
                           IN PCCERTCHAINENGINE pChainEngine
                           )
{
    assert( pChainEngine->SSCtlObjectCache() == this );

    return( SSCtlPopulateCacheFromCertStore( pChainEngine, NULL ) );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::AddObject, public
//
//  Synopsis:   add an object to the cache
//
//----------------------------------------------------------------------------
BOOL
CSSCtlObjectCache::AddObject (
                      IN PCSSCTLOBJECT pSSCtlObject,
                      IN BOOL fCheckForDuplicate
                      )
{
    FILETIME UpdateTime;

    if ( fCheckForDuplicate == TRUE )
    {
        PCSSCTLOBJECT   pDuplicate;

        pDuplicate = FindObjectByHash( pSSCtlObject->CtlHash() );
        if ( pDuplicate != NULL )
        {
            pDuplicate->Release();
            SetLastError( (DWORD) CRYPT_E_EXISTS );
            return( FALSE );
        }
    }

    pSSCtlObject->AddRef();

    if (pSSCtlObject->HasNextUpdateUrl(&UpdateTime))
    {
        // Set earliest update time
        if (I_CryptIsZeroFileTime(&m_UpdateTime) ||
                0 > CompareFileTime(&UpdateTime, &m_UpdateTime))
        {
            m_UpdateTime = UpdateTime;
        }

        m_fFirstUpdate = TRUE;

    }

    I_CryptInsertLruEntry( pSSCtlObject->HashIndexEntry(), NULL );

    if (pSSCtlObject->MessageStore() )
    {
        CertAddStoreToCollection(
            pSSCtlObject->ChainEngine()->OtherStore(),
            pSSCtlObject->MessageStore(),
            0,
            0
            );
    }

    CertPerfIncrementChainCtlCacheCount();

    return( TRUE );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::RemoveObject, public
//
//  Synopsis:   remove object from cache
//
//----------------------------------------------------------------------------
VOID
CSSCtlObjectCache::RemoveObject (
                         IN PCSSCTLOBJECT pSSCtlObject
                         )
{
    I_CryptRemoveLruEntry( pSSCtlObject->HashIndexEntry(), 0, NULL );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::FindObjectByHash, public
//
//  Synopsis:   find object with given hash
//
//----------------------------------------------------------------------------
PCSSCTLOBJECT
CSSCtlObjectCache::FindObjectByHash (
                       IN BYTE rgbHash [ CHAINHASHLEN ]
                       )
{
    HLRUENTRY       hFound;
    PCSSCTLOBJECT   pFound = NULL;
    CRYPT_HASH_BLOB HashBlob;

    HashBlob.cbData = CHAINHASHLEN;
    HashBlob.pbData = rgbHash;

    hFound = I_CryptFindLruEntry( m_hHashIndex, &HashBlob );
    if ( hFound != NULL )
    {
        pFound = (PCSSCTLOBJECT)I_CryptGetLruEntryData( hFound );
        pFound->AddRef();

        I_CryptReleaseLruEntry( hFound );
    }

    return( pFound );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::EnumObjects, public
//
//  Synopsis:   enumerate objects
//
//----------------------------------------------------------------------------
VOID
CSSCtlObjectCache::EnumObjects (
                       IN PFN_ENUM_SSCTLOBJECTS pfnEnum,
                       IN LPVOID pvParameter
                       )
{
    SSCTL_ENUM_OBJECTS_DATA EnumData;

    EnumData.pfnEnumObjects = pfnEnum;
    EnumData.pvEnumParameter = pvParameter;

    I_CryptWalkAllLruCacheEntries(
           m_hHashIndex,
           SSCtlEnumObjectsWalkFn,
           &EnumData
           );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::Resync, public
//
//  Synopsis:   resync the cache
//
//----------------------------------------------------------------------------
BOOL
CSSCtlObjectCache::Resync (IN PCCERTCHAINENGINE pChainEngine)
{
    I_CryptFlushLruCache( m_hHashIndex, 0, NULL );

    I_CryptZeroFileTime(&m_UpdateTime);
    m_fFirstUpdate = FALSE;

    return( PopulateCache( pChainEngine ) );
}

//+---------------------------------------------------------------------------
//
//  Member:     CSSCtlObjectCache::UpdateCache, public
//
//  Synopsis:   update the cache
//
//              Leaves the engine's critical section to do the URL
//              fetching. If the engine was touched by another thread,
//              it fails with LastError set to ERROR_CAN_NOT_COMPLETE.
//
//              If the CTL is updated, increments the engine's touch count
//              and flushes issuer and end cert object caches.
//
//  Assumption: Chain engine is locked once in the calling thread.
//
//----------------------------------------------------------------------------
BOOL
CSSCtlObjectCache::UpdateCache (
    IN PCCERTCHAINENGINE pChainEngine,
    IN PCCHAINCALLCONTEXT pCallContext
    )
{
    FILETIME CurrentTime;
    SSCTL_UPDATE_CTL_OBJ_PARA Para;
    
    assert( pChainEngine->SSCtlObjectCache() == this );

    // Check if we have any CTLs needing to be updated
    if (I_CryptIsZeroFileTime(&m_UpdateTime))
        return TRUE;
    pCallContext->CurrentTime(&CurrentTime);
    if (0 < CompareFileTime(&m_UpdateTime, &CurrentTime))
        return TRUE;

    if (!m_fFirstUpdate && !pCallContext->IsOnline())
        return TRUE;

    memset(&Para, 0, sizeof(Para));
    Para.pChainEngine = pChainEngine;
    Para.pCallContext = pCallContext;

    EnumObjects(SSCtlUpdateCtlObjectEnumFn, &Para);
    if (pCallContext->IsTouchedEngine()) {
        PSSCTL_UPDATE_CTL_OBJ_ENTRY pEntry;

        pEntry = Para.pEntry;
        while (pEntry) {
            PSSCTL_UPDATE_CTL_OBJ_ENTRY pDeleteEntry;

            pEntry->pSSCtlObjectAdd->Release();

            pDeleteEntry = pEntry;
            pEntry = pEntry->pNext;
            delete pDeleteEntry;
        }

        return FALSE;
    }


    m_UpdateTime = Para.UpdateTime;
    m_fFirstUpdate = FALSE;

    if (Para.pEntry) {
        HCERTSTORE hTrustStore;
        PSSCTL_UPDATE_CTL_OBJ_ENTRY pEntry;

        hTrustStore = pChainEngine->OpenTrustStore();

        pChainEngine->CertObjectCache()->FlushObjects( pCallContext );
        pCallContext->TouchEngine();

        pEntry = Para.pEntry;
        while (pEntry) {
            PSSCTL_UPDATE_CTL_OBJ_ENTRY pDeleteEntry;

            RemoveObject(pEntry->pSSCtlObjectRemove);
            if (AddObject(pEntry->pSSCtlObjectAdd, TRUE)) {
                if (hTrustStore) {
                    // Persist the newer CTL to the trust store
                    CertAddCTLContextToStore(
                        hTrustStore,
                        pEntry->pSSCtlObjectAdd->CtlContext(),
                        CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES,
                        NULL
                        );
                }
            }

            pEntry->pSSCtlObjectAdd->Release();

            pDeleteEntry = pEntry;
            pEntry = pEntry->pNext;
            delete pDeleteEntry;
        }

        if (hTrustStore)
            CertCloseStore(hTrustStore, 0);
    }


    return TRUE;
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlOnRemovalFromCache
//
//  Synopsis:   SS CTL removal notification used when the cache is destroyed
//              or an object is explicitly removed.  Note that this cache
//              does not LRU remove objects
//
//----------------------------------------------------------------------------
VOID WINAPI
SSCtlOnRemovalFromCache (
     IN LPVOID pv,
     IN OPTIONAL LPVOID pvRemovalContext
     )
{
    PCSSCTLOBJECT pSSCtlObject = (PCSSCTLOBJECT) pv;
    CertPerfDecrementChainCtlCacheCount();

    assert( pvRemovalContext == NULL );

    if (pSSCtlObject->MessageStore() )
    {
        CertRemoveStoreFromCollection(
            pSSCtlObject->ChainEngine()->OtherStore(),
            pSSCtlObject->MessageStore()
            );
    }

    pSSCtlObject->Release();
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlGetSignerInfo
//
//  Synopsis:   get the signer info
//
//----------------------------------------------------------------------------
BOOL WINAPI
SSCtlGetSignerInfo (
     IN PCCTL_CONTEXT pCtlContext,
     OUT PSSCTL_SIGNER_INFO pSignerInfo
     )
{
    BOOL              fResult;
    PCERT_INFO        pMessageSignerCertInfo = NULL;
    DWORD             cbData = 0;

    fResult = CryptMsgGetParam(
                   pCtlContext->hCryptMsg,
                   CMSG_SIGNER_CERT_INFO_PARAM,
                   0,
                   NULL,
                   &cbData
                   );

    if ( fResult == TRUE )
    {
        pMessageSignerCertInfo = (PCERT_INFO)new BYTE [ cbData ];
        if ( pMessageSignerCertInfo != NULL )
        {
            fResult = CryptMsgGetParam(
                           pCtlContext->hCryptMsg,
                           CMSG_SIGNER_CERT_INFO_PARAM,
                           0,
                           pMessageSignerCertInfo,
                           &cbData
                           );
        }
        else
        {
            SetLastError( (DWORD) E_OUTOFMEMORY );
            fResult = FALSE;
        }
    }

    if ( fResult == TRUE )
    {
        pSignerInfo->pMessageSignerCertInfo = pMessageSignerCertInfo;
        pSignerInfo->fSignerHashAvailable = FALSE;
    }
    else
    {
        delete pMessageSignerCertInfo;
    }

    return( fResult );
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlFreeSignerInfo
//
//  Synopsis:   free the data in the signer info
//
//----------------------------------------------------------------------------
VOID WINAPI
SSCtlFreeSignerInfo (
     IN PSSCTL_SIGNER_INFO pSignerInfo
     )
{
    delete (LPBYTE)pSignerInfo->pMessageSignerCertInfo;
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlGetSignerChainPathObject
//
//  Synopsis:   get the signer chain path object
//
//----------------------------------------------------------------------------
BOOL WINAPI
SSCtlGetSignerChainPathObject (
     IN PCCHAINPATHOBJECT pSubject,
     IN PCCHAINCALLCONTEXT pCallContext,
     IN PSSCTL_SIGNER_INFO pSignerInfo,
     IN HCERTSTORE hAdditionalStore,
     OUT PCCHAINPATHOBJECT* ppSigner,
     OUT BOOL *pfNewSigner
     )
{
    BOOL              fResult = TRUE;
    PCCERTCHAINENGINE pChainEngine = pSubject->CertObject()->ChainEngine();
    PCCERTOBJECTCACHE pCertObjectCache = pChainEngine->CertObjectCache();
    PCCERTOBJECT      pCertObject = NULL;
    PCCERT_CONTEXT    pCertContext = NULL;
    PCCHAINPATHOBJECT pSigner = NULL;
    BOOL              fAdditionalStoreUsed = FALSE;
    BYTE              rgbCertHash[ CHAINHASHLEN ];


    *pfNewSigner = FALSE;

    if ( pSignerInfo->fSignerHashAvailable == TRUE )
    {
        pCertObject = pCertObjectCache->FindIssuerObjectByHash(
            pSignerInfo->rgbSignerCertHash );
    }

    if ( pCertObject == NULL )
    {
        if ( pSignerInfo->fSignerHashAvailable == TRUE )
        {
            pCertContext = SSCtlFindCertificateInStoreByHash(
                                pChainEngine->OtherStore(),
                                pSignerInfo->rgbSignerCertHash
                                );

            if ( ( pCertContext == NULL ) && ( hAdditionalStore != NULL ) )
            {
                fAdditionalStoreUsed = TRUE;

                pCertContext = SSCtlFindCertificateInStoreByHash(
                                    hAdditionalStore,
                                    pSignerInfo->rgbSignerCertHash
                                    );
            }
        }

        if ( pCertContext == NULL )
        {
            *pfNewSigner = TRUE;
            fAdditionalStoreUsed = FALSE;

            pCertContext = CertGetSubjectCertificateFromStore(
                                pChainEngine->OtherStore(),
                                X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
                                pSignerInfo->pMessageSignerCertInfo
                                );
        }

        if ( ( pCertContext == NULL ) && ( hAdditionalStore != NULL ) )
        {
            fAdditionalStoreUsed = TRUE;

            pCertContext = CertGetSubjectCertificateFromStore(
                                hAdditionalStore,
                                X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
                                pSignerInfo->pMessageSignerCertInfo
                                );
        }

        if ( pCertContext != NULL )
        {
            DWORD cbData = CHAINHASHLEN;
            fResult = CertGetCertificateContextProperty(
                          pCertContext,
                          CERT_MD5_HASH_PROP_ID,
                          rgbCertHash,
                          &cbData
                          );

            if ( fResult && CHAINHASHLEN != cbData)
            {
                fResult = FALSE;
                SetLastError( (DWORD) E_UNEXPECTED);
            }

            if ( fResult == TRUE )
            {
                fResult = ChainCreateCertObject (
                    fAdditionalStoreUsed ?
                        CERT_EXTERNAL_ISSUER_OBJECT_TYPE :
                        CERT_CACHED_ISSUER_OBJECT_TYPE,
                    pCallContext,
                    pCertContext,
                    rgbCertHash,
                    &pCertObject
                    );
            }

            CertFreeCertificateContext( pCertContext );
        }
        else
        {
            fResult = FALSE;
            SetLastError((DWORD) CRYPT_E_NOT_FOUND);
        }
    }

    if ( fResult )
    {
        assert(pCertObject);
        fResult = ChainCreatePathObject(
            pCallContext,
            pCertObject,
            hAdditionalStore,
            &pSigner
            );
    }

    if ( fResult )
    {
        assert(pSigner);

        if ( !pSignerInfo->fSignerHashAvailable || *pfNewSigner )
        {
            memcpy(
               pSignerInfo->rgbSignerCertHash,
               rgbCertHash,
               CHAINHASHLEN
               );

            pSignerInfo->fSignerHashAvailable = TRUE;
        }

    }

    if ( pCertObject != NULL )
    {
        pCertObject->Release();
    }

    *ppSigner = pSigner;

    return( fResult );
}


//+---------------------------------------------------------------------------
//
//  Function:   SSCtlFindCertificateInStoreByHash
//
//  Synopsis:   find certificate in store by hash
//
//----------------------------------------------------------------------------
PCCERT_CONTEXT WINAPI
SSCtlFindCertificateInStoreByHash (
     IN HCERTSTORE hStore,
     IN BYTE rgbHash [ CHAINHASHLEN]
     )
{
    CRYPT_HASH_BLOB HashBlob;

    HashBlob.cbData = CHAINHASHLEN;
    HashBlob.pbData = rgbHash;

    return( CertFindCertificateInStore(
                hStore,
                X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
                0,
                CERT_FIND_MD5_HASH,
                &HashBlob,
                NULL
                ) );
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlGetCtlTrustStatus
//
//  Synopsis:   get the trust status for the CTL
//
//----------------------------------------------------------------------------
VOID WINAPI
SSCtlGetCtlTrustStatus (
     IN PCCTL_CONTEXT pCtlContext,
     IN BOOL fSignatureValid,
     IN LPFILETIME pTime,
     IN PCERT_USAGE_MATCH pRequestedUsage,
     IN OUT PCERT_TRUST_STATUS pStatus
     )
{
    FILETIME          NoTime;
    CERT_TRUST_STATUS UsageStatus;

    memset( &NoTime, 0, sizeof( NoTime ) );

    if ( fSignatureValid == FALSE )
    {
        pStatus->dwErrorStatus |= CERT_TRUST_CTL_IS_NOT_SIGNATURE_VALID;
    }

    if ( ( CompareFileTime(
                  pTime,
                  &pCtlContext->pCtlInfo->ThisUpdate
                  ) < 0 ) ||
         ( ( ( CompareFileTime(
                      &NoTime,
                      &pCtlContext->pCtlInfo->NextUpdate
                      ) != 0 ) &&
             ( CompareFileTime(
                      pTime,
                      &pCtlContext->pCtlInfo->NextUpdate
                      ) > 0 ) ) ) )
    {
        pStatus->dwErrorStatus |= CERT_TRUST_CTL_IS_NOT_TIME_VALID;
    }

    memset( &UsageStatus, 0, sizeof( UsageStatus ) );
    ChainGetUsageStatus(
         (PCERT_ENHKEY_USAGE)&pRequestedUsage->Usage,
         (PCERT_ENHKEY_USAGE)&pCtlContext->pCtlInfo->SubjectUsage,
         pRequestedUsage->dwType,
         &UsageStatus
         );

    if ( UsageStatus.dwErrorStatus & CERT_TRUST_IS_NOT_VALID_FOR_USAGE )
    {
        pStatus->dwErrorStatus |= CERT_TRUST_CTL_IS_NOT_VALID_FOR_USAGE;
    }
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlPopulateCacheFromCertStore
//
//  Synopsis:   populate the SS CTL object cache from certificate store CTLs
//
//----------------------------------------------------------------------------
BOOL WINAPI
SSCtlPopulateCacheFromCertStore (
     IN PCCERTCHAINENGINE pChainEngine,
     IN OPTIONAL HCERTSTORE hStore
     )
{
    BOOL               fResult;
    BOOL               fAdditionalStore = TRUE;
    PCCTL_CONTEXT      pCtlContext = NULL;
    BYTE               rgbCtlHash[ CHAINHASHLEN ];
    PCSSCTLOBJECT      pSSCtlObject;
    PCSSCTLOBJECTCACHE pSSCtlObjectCache;

    pSSCtlObjectCache = pChainEngine->SSCtlObjectCache();

    if ( hStore == NULL )
    {
        hStore = pChainEngine->TrustStore();
        fAdditionalStore = FALSE;
    }

    while ( ( pCtlContext = CertEnumCTLsInStore(
                                hStore,
                                pCtlContext
                                ) ) != NULL )
    {
        DWORD cbData = CHAINHASHLEN;
        fResult = CertGetCTLContextProperty(
                      pCtlContext,
                      CERT_MD5_HASH_PROP_ID,
                      rgbCtlHash,
                      &cbData
                      );
        if ( fResult && CHAINHASHLEN != cbData)
        {
            fResult = FALSE;
            SetLastError( (DWORD) E_UNEXPECTED);
        }

        if ( fResult == TRUE )
        {
            pSSCtlObject = pSSCtlObjectCache->FindObjectByHash( rgbCtlHash );
            if ( pSSCtlObject == NULL )
            {
                fResult = SSCtlCreateCtlObject(
                               pChainEngine,
                               pCtlContext,
                               FALSE,               // fAdditionalStore
                               &pSSCtlObject
                               );
            }
            else
            {
                pSSCtlObject->Release();
                fResult = FALSE;
            }

            if ( fResult == TRUE )
            {
                fResult = pSSCtlObjectCache->AddObject( pSSCtlObject, FALSE );

                // NOTE: Since fDuplicate == FALSE this should never fail
                assert( fResult == TRUE );

                pSSCtlObject->Release();
            }
        }
    }

    return( TRUE );
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlCreateCtlObject
//
//  Synopsis:   create an SS CTL Object
//
//----------------------------------------------------------------------------
BOOL WINAPI
SSCtlCreateCtlObject (
     IN PCCERTCHAINENGINE pChainEngine,
     IN PCCTL_CONTEXT pCtlContext,
     IN BOOL fAdditionalStore,
     OUT PCSSCTLOBJECT* ppSSCtlObject
     )
{
    BOOL          fResult = TRUE;
    PCSSCTLOBJECT pSSCtlObject;

    pSSCtlObject = new CSSCtlObject( 
        pChainEngine, pCtlContext, fAdditionalStore, fResult );
    if ( pSSCtlObject == NULL )
    {
        SetLastError( (DWORD) E_OUTOFMEMORY );
        fResult = FALSE;
    }
    else if ( fResult == TRUE )
    {
        *ppSSCtlObject = pSSCtlObject;
    }
    else
    {
        delete pSSCtlObject;
    }

    return( fResult );
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlEnumObjectsWalkFn
//
//  Synopsis:   object enumerator walk function
//
//----------------------------------------------------------------------------
BOOL WINAPI
SSCtlEnumObjectsWalkFn (
     IN LPVOID pvParameter,
     IN HLRUENTRY hEntry
     )
{
    PSSCTL_ENUM_OBJECTS_DATA pEnumData = (PSSCTL_ENUM_OBJECTS_DATA)pvParameter;

    return( ( *pEnumData->pfnEnumObjects )(
                             pEnumData->pvEnumParameter,
                             (PCSSCTLOBJECT)I_CryptGetLruEntryData( hEntry )
                             ) );
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlCreateObjectCache
//
//  Synopsis:   create the SS CTL object cache
//
//----------------------------------------------------------------------------
BOOL WINAPI
SSCtlCreateObjectCache (
     OUT PCSSCTLOBJECTCACHE* ppSSCtlObjectCache
     )
{
    BOOL               fResult = TRUE;
    PCSSCTLOBJECTCACHE pSSCtlObjectCache;

    pSSCtlObjectCache = new CSSCtlObjectCache( fResult );

    if ( pSSCtlObjectCache == NULL )
    {
        SetLastError( (DWORD) E_OUTOFMEMORY );
        fResult = FALSE;
    }
    else if ( fResult == TRUE )
    {
        *ppSSCtlObjectCache = pSSCtlObjectCache;
    }
    else
    {
        delete pSSCtlObjectCache;
    }

    return( fResult );
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlFreeObjectCache
//
//  Synopsis:   free the object cache
//
//----------------------------------------------------------------------------
VOID WINAPI
SSCtlFreeObjectCache (
     IN PCSSCTLOBJECTCACHE pSSCtlObjectCache
     )
{
    delete pSSCtlObjectCache;
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlFreeTrustListInfo
//
//  Synopsis:   free the trust list info
//
//----------------------------------------------------------------------------
VOID WINAPI
SSCtlFreeTrustListInfo (
     IN PCERT_TRUST_LIST_INFO pTrustListInfo
     )
{
    CertFreeCTLContext( pTrustListInfo->pCtlContext );

    delete pTrustListInfo;
}

//+---------------------------------------------------------------------------
//
//  Function:   SSCtlAllocAndCopyTrustListInfo
//
//  Synopsis:   allocate and copy the trust list info
//
//----------------------------------------------------------------------------
BOOL WINAPI
SSCtlAllocAndCopyTrustListInfo (
     IN PCERT_TRUST_LIST_INFO pTrustListInfo,
     OUT PCERT_TRUST_LIST_INFO* ppTrustListInfo
     )
{
    PCERT_TRUST_LIST_INFO pCopyTrustListInfo;

    pCopyTrustListInfo = new CERT_TRUST_LIST_INFO;
    if ( pCopyTrustListInfo == NULL )
    {
        SetLastError( (DWORD) E_OUTOFMEMORY );
        return( FALSE );
    }

    pCopyTrustListInfo->cbSize = sizeof( CERT_TRUST_LIST_INFO );

    pCopyTrustListInfo->pCtlContext = CertDuplicateCTLContext(
                                          pTrustListInfo->pCtlContext
                                          );

    pCopyTrustListInfo->pCtlEntry = pTrustListInfo->pCtlEntry;

    *ppTrustListInfo = pCopyTrustListInfo;

    return( TRUE );
}

//+-------------------------------------------------------------------------
//  Retrieve a newer and time valid CTL at one of the NextUpdate Urls
//
//  Leaves the engine's critical section to do the URL
//  fetching. If the engine was touched by another thread,
//  it fails with LastError set to ERROR_CAN_NOT_COMPLETE.
//
//  Assumption: Chain engine is locked once in the calling thread.
//--------------------------------------------------------------------------
BOOL
WINAPI
SSCtlRetrieveCtlUrl(
    IN PCCERTCHAINENGINE pChainEngine,
    IN PCCHAINCALLCONTEXT pCallContext,
    IN OUT PCRYPT_URL_ARRAY pNextUpdateUrlArray,
    IN DWORD dwRetrievalFlags,
    IN OUT PCCTL_CONTEXT *ppCtl,
    IN OUT BOOL *pfNewerCtl,
    IN OUT BOOL *pfTimeValid
    )
{
    BOOL fResult;
    DWORD i;

    // Loop through Urls and try to retrieve a newer and time valid CTL
    for (i = 0; i < pNextUpdateUrlArray->cUrl; i++) {
        PCCTL_CONTEXT pNewCtl = NULL;
        LPWSTR pwszUrl = NULL;
        DWORD cbUrl;


        // Do URL fetching outside of the engine's critical section

        // Need to make a copy of the Url string. pNextUpdateUrlArray
        // can be modified by another thread outside of the critical section.
        cbUrl = (wcslen(pNextUpdateUrlArray->rgwszUrl[i]) + 1) * sizeof(WCHAR);
        pwszUrl = (LPWSTR) PkiNonzeroAlloc(cbUrl);
        if (NULL == pwszUrl)
            goto OutOfMemory;
        memcpy(pwszUrl, pNextUpdateUrlArray->rgwszUrl[i], cbUrl);

        pCallContext->ChainEngine()->UnlockEngine();
        fResult = ChainRetrieveObjectByUrlW(
                pwszUrl,
                CONTEXT_OID_CTL,
                dwRetrievalFlags |
                    CRYPT_LDAP_SCOPE_BASE_ONLY_RETRIEVAL |
                    CRYPT_STICKY_CACHE_RETRIEVAL,
                pCallContext->ChainPara()->dwUrlRetrievalTimeout,
                (LPVOID *) &pNewCtl,
                NULL,                               // hAsyncRetrieve
                NULL,                               // pCredentials
                NULL,                               // pvVerify
                NULL                                // pAuxInfo
                );
        pCallContext->ChainEngine()->LockEngine();

        PkiFree(pwszUrl);

        if (pCallContext->IsTouchedEngine()) {
            if (pNewCtl)
                CertFreeCTLContext(pNewCtl);
            goto TouchedDuringUrlRetrieval;
        }

        if (fResult) {
            PCCTL_CONTEXT pOldCtl;

            assert(pNewCtl);

            pOldCtl = *ppCtl;
            if (0 < CompareFileTime(&pNewCtl->pCtlInfo->ThisUpdate,
                        &pOldCtl->pCtlInfo->ThisUpdate)) {
                FILETIME CurrentTime;

                // Move us to the head of the Url list
                DWORD j;
                LPWSTR pwszUrl = pNextUpdateUrlArray->rgwszUrl[i];

                for (j = i; 0 < j; j--) {
                    pNextUpdateUrlArray->rgwszUrl[j] =
                        pNextUpdateUrlArray->rgwszUrl[j - 1];
                }
                pNextUpdateUrlArray->rgwszUrl[0] = pwszUrl;

                *pfNewerCtl = TRUE;
                CertFreeCTLContext(pOldCtl);
                *ppCtl = pNewCtl;

                pCallContext->CurrentTime(&CurrentTime);
                if (I_CryptIsZeroFileTime(&pNewCtl->pCtlInfo->NextUpdate) ||
                        0 < CompareFileTime(&pNewCtl->pCtlInfo->NextUpdate,
                                &CurrentTime)) {
                    *pfTimeValid = TRUE;
                    break;
                }
            } else
                CertFreeCTLContext(pNewCtl);
        }
    }


    fResult = TRUE;
CommonReturn:
    return fResult;

ErrorReturn:
    fResult = FALSE;
    goto CommonReturn;

SET_ERROR(TouchedDuringUrlRetrieval, ERROR_CAN_NOT_COMPLETE)
TRACE_ERROR(OutOfMemory)
}


//+-------------------------------------------------------------------------
//  Update Ctl Object Enum Function
//
//  Leaves the engine's critical section to do the URL
//  fetching. If the engine was touched by another thread,
//  it fails with LastError set to ERROR_CAN_NOT_COMPLETE.
//
//  Assumption: Chain engine is locked once in the calling thread.
//--------------------------------------------------------------------------
BOOL
WINAPI
SSCtlUpdateCtlObjectEnumFn(
    IN LPVOID pvPara,
    IN PCSSCTLOBJECT pSSCtlObject
    )
{
    BOOL fTouchResult = TRUE;

    PSSCTL_UPDATE_CTL_OBJ_PARA pPara = (PSSCTL_UPDATE_CTL_OBJ_PARA) pvPara;
    FILETIME CurrentTime;
    FILETIME UpdateTime;
    PCCTL_CONTEXT pRetrieveCtl = NULL;
    BOOL fTimeValid = FALSE;
    BOOL fNewerCtl = FALSE;
    PCRYPT_URL_ARRAY pNextUpdateUrlArray;

    if (!pSSCtlObject->HasNextUpdateUrl(&UpdateTime))
        return TRUE;

    pPara->pCallContext->CurrentTime(&CurrentTime);

    if (0 < CompareFileTime(&UpdateTime, &CurrentTime))
        goto CommonReturn;

    pRetrieveCtl = CertDuplicateCTLContext(pSSCtlObject->CtlContext());
    pNextUpdateUrlArray = pSSCtlObject->NextUpdateUrlArray();

    SSCtlRetrieveCtlUrl(
        pPara->pChainEngine,
        pPara->pCallContext,
        pNextUpdateUrlArray,
        CRYPT_CACHE_ONLY_RETRIEVAL,
        &pRetrieveCtl,
        &fNewerCtl,
        &fTimeValid
        );
    if (pPara->pCallContext->IsTouchedEngine()) {
        fTouchResult = FALSE;
        goto TouchedDuringUrlRetrieval;
    }

    if (!fTimeValid && pPara->pCallContext->IsOnline()) {
        SSCtlRetrieveCtlUrl(
            pPara->pChainEngine,
            pPara->pCallContext,
            pNextUpdateUrlArray,
            CRYPT_WIRE_ONLY_RETRIEVAL,
            &pRetrieveCtl,
            &fNewerCtl,
            &fTimeValid
            );
        if (pPara->pCallContext->IsTouchedEngine()) {
            fTouchResult = FALSE;
            goto TouchedDuringUrlRetrieval;
        }

        if (!fNewerCtl)
            pSSCtlObject->SetOffline(&CurrentTime, &UpdateTime);
    }

    if (fNewerCtl) {
        PSSCTL_UPDATE_CTL_OBJ_ENTRY pEntry;

        pSSCtlObject->SetOnline();

        pEntry = new SSCTL_UPDATE_CTL_OBJ_ENTRY;
        if (NULL == pEntry)
            goto OutOfMemory;

        if (!SSCtlCreateCtlObject(
                pPara->pChainEngine,
                pRetrieveCtl,
                FALSE,                      // fAdditionalStore
                &pEntry->pSSCtlObjectAdd
                )) {
            delete pEntry;
            goto CreateCtlObjectError;
        }

        pEntry->pSSCtlObjectRemove = pSSCtlObject;
        pEntry->pNext = pPara->pEntry;
        pPara->pEntry = pEntry;

    }

CommonReturn:
    if (!fNewerCtl) {
        if (I_CryptIsZeroFileTime(&pPara->UpdateTime) ||
                0 > CompareFileTime(&UpdateTime, &pPara->UpdateTime))
            pPara->UpdateTime = UpdateTime;
    }

    if (pRetrieveCtl)
        CertFreeCTLContext(pRetrieveCtl);

    return fTouchResult;

ErrorReturn:
    fNewerCtl = FALSE;
    goto CommonReturn;

SET_ERROR(OutOfMemory, E_OUTOFMEMORY)
TRACE_ERROR(CreateCtlObjectError)
SET_ERROR(TouchedDuringUrlRetrieval, ERROR_CAN_NOT_COMPLETE)
}