// File: certui.cpp

#include "precomp.h"
#include "resource.h"
#include "nmmkcert.h"
#include "certui.h"
#include <tsecctrl.h>
#include "SDKInternal.h"
#include "ConfUtil.h"

#define SZ_CRYPTDLGDLL "CRYPTDLG"

extern INmSysInfo2 * g_pNmSysInfo;

//
// While the credentials underlying the certificate we are using
// are in use, we need to keep the certificate context around
// and the store open. So we hold the currently open cert store
// and cert context in these globals:

static PCCERT_CONTEXT g_pCertContext;
static HCERTSTORE g_hCertStore;

TCHAR * FormatCert ( PBYTE pbEncodedCert, DWORD cbEncodedCert )
{
    DWORD sc;
    PCCERT_CONTEXT pCert = NULL, pIssuerCert = NULL, pCACert = NULL;
    DWORD cbRet = 0;
    CHAR * pSubject = NULL;
    CHAR * pIssuer = NULL;
    DWORD cbSubject = 0;
    DWORD cbIssuer = 0;
    DWORD dwFlags;
    DWORD cbTotalRequired;
    CHAR szLoadStringBuf[512];
    HCERTSTORE hRootStore = NULL;
    HCERTSTORE hCAStore = NULL;
    BOOL fSelfIssued = FALSE;
    TCHAR * pInfo = NULL;
    TCHAR szNotBefore[64];
    TCHAR szNotAfter[64];

    ASSERT(pbEncodedCert);
    ASSERT(cbEncodedCert);

    //
    // Get the certificate from the encoded blob
    //

    pCert = CertCreateCertificateContext ( X509_ASN_ENCODING,
                                            pbEncodedCert,
                                            cbEncodedCert );


    if ( NULL == pCert )
    {
        // Creating the cert context failed
        ERROR_OUT(("Error creating cert context from %x (%d bytes): %x",
            pbEncodedCert, cbEncodedCert, GetLastError()));
        goto cleanup;
    }

    //
    // Get the subject information
    //

    cbSubject = CertNameToStr (
                        pCert->dwCertEncodingType,
                        &pCert->pCertInfo->Subject,
                        CERT_FORMAT_FLAGS,
                        NULL, 0);

    if ( 0 == cbSubject )
    {
        ERROR_OUT(("GetUserInfo: no subject string"));
        goto cleanup;
    }

    pSubject = new CHAR[cbSubject + 1];

    if ( NULL == pSubject )
    {
        ERROR_OUT(("GetUserInfo: error allocating subject name"));
        goto cleanup;
    }

    if ( 0 >= CertNameToStr (
                        pCert->dwCertEncodingType,
                        &pCert->pCertInfo->Subject,
                        CERT_FORMAT_FLAGS,
                        pSubject, cbSubject+1))
    {
        ERROR_OUT(("GetUserInfo: error getting subject string"));
        goto cleanup;
    }

    //
    // Get the issuer information
    //

    cbIssuer = CertNameToStr (
                        pCert->dwCertEncodingType,
                        &pCert->pCertInfo->Issuer,
                        CERT_FORMAT_FLAGS,
                        NULL, 0);

    if ( 0 == cbIssuer )
    {
        ERROR_OUT(("GetUserInfo: no issuer string"));
        goto cleanup;
    }

    pIssuer = new CHAR[cbIssuer + 1];

    if ( NULL == pIssuer )
    {
        ERROR_OUT(("GetUserInfo: error allocating issuer name"));
    }

    if ( 0 >= CertNameToStr (
                        pCert->dwCertEncodingType,
                        &pCert->pCertInfo->Issuer,
                        CERT_FORMAT_FLAGS,
                        pIssuer, cbIssuer+1))
    {
        ERROR_OUT(("GetUserInfo: error getting issuer string"));
        goto cleanup;
    }

    //
    // Format the file time from the cert
    //

    SYSTEMTIME stNotBefore;
    SYSTEMTIME stNotAfter;

    FileTimeToSystemTime(&(pCert->pCertInfo->NotBefore), &stNotBefore);
    FileTimeToSystemTime(&(pCert->pCertInfo->NotAfter), &stNotAfter);

    FmtDateTime(&stNotBefore, szNotBefore, CCHMAX(szNotBefore));
    FmtDateTime(&stNotAfter, szNotAfter, CCHMAX(szNotAfter));

    //
    // Open the root store for certificate verification
    //

    hRootStore = CertOpenSystemStore(0, "Root");

    if( NULL == hRootStore )
    {
        ERROR_OUT(("Couldn't open root certificate store"));
        goto cleanup;
    }

    //
    // Get the issuer certificate from the root store and check for problems
    //

    dwFlags =   CERT_STORE_REVOCATION_FLAG |
                CERT_STORE_SIGNATURE_FLAG |
                CERT_STORE_TIME_VALIDITY_FLAG;

    // Get the issuer of this cert

    pIssuerCert = CertGetIssuerCertificateFromStore(
                        hRootStore,
                        pCert,
                        NULL,
                        &dwFlags );

    // If the issuer of the certificate cannot be found in the root store,
    // check the CA store iteratively until we work our way back to a root
    // certificate

    pCACert = pCert;

    while ( NULL == pIssuerCert )
    {
        PCCERT_CONTEXT pTmpCert;

        if ( NULL == hCAStore )
        {
            hCAStore = CertOpenSystemStore(0, "CA");

            if ( NULL == hCAStore )
            {
                ERROR_OUT(("Couldn't open CA certificate store"));
                goto cleanup;
            }
        }

        dwFlags =   CERT_STORE_REVOCATION_FLAG |
                    CERT_STORE_SIGNATURE_FLAG |
                    CERT_STORE_TIME_VALIDITY_FLAG;

        pTmpCert = CertGetIssuerCertificateFromStore(
                        hCAStore,
                        pCACert,
                        NULL,
                        &dwFlags );

        if ( NULL == pTmpCert )
        {
            TRACE_OUT(("Issuer not found in CA store either"));
            break;
        }

        if ( pCACert != pCert )
            CertFreeCertificateContext(pCACert);
        pCACert = pTmpCert;

        if ((( CERT_STORE_REVOCATION_FLAG & dwFlags ) &&
             !( CERT_STORE_NO_CRL_FLAG & dwFlags )) ||
             ( CERT_STORE_SIGNATURE_FLAG & dwFlags ) ||
             ( CERT_STORE_TIME_VALIDITY_FLAG & dwFlags ))
        {
            TRACE_OUT(("Problem with issuer in CA store: %x", dwFlags));
            break;
        }

        dwFlags =   CERT_STORE_REVOCATION_FLAG |
                    CERT_STORE_SIGNATURE_FLAG |
                    CERT_STORE_TIME_VALIDITY_FLAG;

        pIssuerCert = CertGetIssuerCertificateFromStore(
                        hRootStore,
                        pCACert,
                        NULL,
                        &dwFlags );

    }

    if ( pCACert != pCert )
        CertFreeCertificateContext ( pCACert );

    //
    // Total up the return buffer required
    //
    // BUGBUG this overestimates the requirements slightly because
    // this formatting buffer contains specifiers which will be
    // replaced during wsprintf
    cbTotalRequired =   cbSubject +
                        cbIssuer +
                        lstrlen(szNotBefore) +
                        lstrlen(szNotAfter) +
                        FLoadString2( IDS_FMTBUFFER, szLoadStringBuf,
                                    sizeof(szLoadStringBuf)) + 1;

    //
    // If there are problems, account for the extra info:
    //

    if ( NULL == pIssuerCert )
    {
        // If after all we couldn't find the issuer check if this is
        // a NetMeeting self-issued certificate and generate an appropriate
        // message if so:

        DWORD dwMagic;
        DWORD cbMagic;

        cbMagic = sizeof(dwMagic);

        // BUGBUG: why is user prop not available for remote context?
        //if (pSecurityInterface->pfn_CertGetCertificateContextProperty(pCert,
        //   CERT_FIRST_USER_PROP_ID, &dwMagic, &cbMagic) &&
        //  cbMagic == sizeof(dwMagic) && dwMagic == NMMKCERT_MAGIC )

        if ( !lstrcmp( pIssuer, SZ_NMROOTNAME ))
        {
            // We're just going to return some generic text about the
            // NetMeeting default certificate


            cbTotalRequired = FLoadString2( IDS_GENERIC_NMDC_TEXT,
                                szLoadStringBuf, sizeof(szLoadStringBuf)) + 1;
            fSelfIssued = TRUE;
        }
        else
        {
            cbTotalRequired += FLoadString2( IDS_CERTERR_NOISSUER,
                                szLoadStringBuf, sizeof(szLoadStringBuf)) + 1;
        }
    }
    else
    {
        if ( dwFlags & CERT_STORE_SIGNATURE_FLAG )
        {
            WARNING_OUT(("Verify: Signature invalid"));
            cbTotalRequired += FLoadString2( IDS_CERTERR_SIG,
                            szLoadStringBuf, sizeof(szLoadStringBuf)) + 1;
        }
        if ( dwFlags & CERT_STORE_TIME_VALIDITY_FLAG )
        {
            WARNING_OUT(("Verify: Cert expired"));
            cbTotalRequired += FLoadString2( IDS_CERTERR_EXPIRED,
                            szLoadStringBuf, sizeof(szLoadStringBuf)) + 1;
        }
        if ( (dwFlags & CERT_STORE_REVOCATION_FLAG) &&
            !(dwFlags & CERT_STORE_NO_CRL_FLAG ) )
        {
            WARNING_OUT(("Verify: Cert revoked"));
            cbTotalRequired += FLoadString2( IDS_CERTERR_REVOKED,
                            szLoadStringBuf, sizeof(szLoadStringBuf)) + 1;
        }
        if ( 0 == (dwFlags & ~CERT_STORE_NO_CRL_FLAG) )
        {
            // Everything is OK:
            cbTotalRequired += FLoadString2( IDS_CERT_VERIFIED,
                                szLoadStringBuf, sizeof(szLoadStringBuf));
        }
    }


    //
    // Allocate the required buffer
    //

    pInfo = new TCHAR[cbTotalRequired];

    if ( NULL == pInfo )
    {
        ERROR_OUT(("Error allocating FormatCert return buffer"));
        goto cleanup;
    }

    //
    // If we're reporting on a NetMeeting issued certificate, just load
    // the generic text and return.
    //

    if ( fSelfIssued )
    {
        FLoadString( IDS_GENERIC_NMDC_TEXT, pInfo, cbTotalRequired );
        goto cleanup;
    }

    //
    // If we are here we can go ahead and format the data into the buffer
    //

    FLoadString( IDS_FMTBUFFER, szLoadStringBuf,
                sizeof(szLoadStringBuf));

    //
    // Do the formatting
    //

    wsprintf( pInfo, szLoadStringBuf, pSubject, pIssuer,
                            szNotBefore, szNotAfter );

    if ( NULL == pIssuerCert )
    {
        FLoadString( IDS_CERTERR_NOISSUER,
                szLoadStringBuf, sizeof(szLoadStringBuf));
        lstrcat( pInfo, szLoadStringBuf );
    }
    else
    {
        if ( dwFlags & CERT_STORE_SIGNATURE_FLAG )
        {
            FLoadString( IDS_CERTERR_SIG,
                            szLoadStringBuf, sizeof(szLoadStringBuf));
            lstrcat( pInfo, szLoadStringBuf );
        }
        if ( dwFlags & CERT_STORE_TIME_VALIDITY_FLAG )
        {
            FLoadString( IDS_CERTERR_EXPIRED,
                            szLoadStringBuf, sizeof(szLoadStringBuf));
            lstrcat( pInfo, szLoadStringBuf );
        }
        if ( (dwFlags & CERT_STORE_REVOCATION_FLAG) &&
            !(dwFlags & CERT_STORE_NO_CRL_FLAG ) )
        {
            FLoadString( IDS_CERTERR_REVOKED,
                            szLoadStringBuf, sizeof(szLoadStringBuf));
            lstrcat( pInfo, szLoadStringBuf );
        }

        if ( 0 == (dwFlags & ~CERT_STORE_NO_CRL_FLAG) )
        {
            // Everything is OK:
            FLoadString( IDS_CERT_VERIFIED,
                                szLoadStringBuf, sizeof(szLoadStringBuf));
            lstrcat( pInfo, szLoadStringBuf );
        }
    }

    ASSERT( cbRet < 1000 ); // Reasonableness check

cleanup:

    if ( NULL != pSubject )
        delete pSubject;

    if ( NULL != pIssuer )
        delete pIssuer;

    if ( NULL != pCert )
    {
        CertFreeCertificateContext ( pCert );
    }

    if ( NULL != pIssuerCert )
    {
        CertFreeCertificateContext ( pIssuerCert );
    }

    if ( NULL != hRootStore )
    {
        if ( !CertCloseStore(hRootStore, CERT_CLOSE_STORE_CHECK_FLAG))
        {
            WARNING_OUT(("FormatCert: error closing root store"));
        }
    }

    if ( NULL != hCAStore )
    {
        if ( !CertCloseStore(hCAStore, CERT_CLOSE_STORE_CHECK_FLAG))
        {
            WARNING_OUT(("FormatCert: error closing CA store"));
        }
    }

    return pInfo;
}

BOOL RefreshSelfIssuedCert (VOID)
{
    BOOL bRet = FALSE;
    DWORD dwResult;
    RegEntry reCONF(CONFERENCING_KEY, HKEY_CURRENT_USER);

    if (reCONF.GetNumber(REGVAL_SECURITY_AUTHENTICATION,
                                    DEFAULT_SECURITY_AUTHENTICATION))
    {
        return TRUE;
    }

    //
    // If there's no sys info interface, that's probably OK, we're just
    // being called in the setup wizard.
    //

    if (!g_pNmSysInfo)
        return FALSE;

    //
    // Clear old cert out of transport
    //
    g_pNmSysInfo->ProcessSecurityData(
                            TPRTCTRL_SETX509CREDENTIALS,
                            0, 0,
                            &dwResult);

    if ( g_pCertContext )
    {
        CertFreeCertificateContext ( g_pCertContext );
        g_pCertContext = NULL;
    }

    if ( g_hCertStore )
    {
        if ( !CertCloseStore ( g_hCertStore, CERT_CLOSE_STORE_CHECK_FLAG ))
        {
            WARNING_OUT(("SetSelfIssuedCert: closing store failed"));
        }
        g_hCertStore = NULL;
    }

    g_hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM,
                                    X509_ASN_ENCODING,
                                    0,
                                    CERT_SYSTEM_STORE_CURRENT_USER,
                                    WSZNMSTORE );
    if ( g_hCertStore )
    {
        //
        // We only expect one cert in here, get it
        //

        g_pCertContext = CertFindCertificateInStore(
                                              g_hCertStore,
                                              X509_ASN_ENCODING,
                                              0,
                                              CERT_FIND_ANY,
                                              NULL,
                                              NULL);
        if ( g_pCertContext )
        {
            dwResult = -1;

            g_pNmSysInfo->ProcessSecurityData(
                                    TPRTCTRL_SETX509CREDENTIALS,
                                    (DWORD_PTR)g_pCertContext, 0,
                                    &dwResult);
            //
            // g_hCertStore and g_pCertContext now in use
            //

            if ( !dwResult )
            {
                bRet = TRUE;
            }
            else
            {
                ERROR_OUT(("RefreshSelfIssuedCert - failed in T.120"));
            }
        }
        else
        {
            ERROR_OUT(("RefreshPrivacyCert: no cert in %s?", SZNMSTORE));
        }
    }
    else
    {
        WARNING_OUT(("RefreshSelfIssuedCert: error opening %s store %x",
            SZNMSTORE, GetLastError()));
    }
    return bRet;
}

DWORD NumUserCerts(VOID)
{
    DWORD cCerts = 0;
    HCERTSTORE hStore;
    PCCERT_CONTEXT pCert = NULL;

    if ( hStore = CertOpenSystemStore(0, "MY"))
    {
        while ( pCert = CertEnumCertificatesInStore(
                                    hStore, (PCERT_CONTEXT)pCert ))
            cCerts++;
        if ( !CertCloseStore( hStore, CERT_CLOSE_STORE_CHECK_FLAG ))
        {
            WARNING_OUT(("NumUserCerts: error closing store"));
        }
    }
    return cCerts;
}

#include "cryptdlg.h"

typedef BOOL (WINAPI *PFN_CERT_SELECT_CERTIFICATE)(PCERT_SELECT_STRUCT_A);

BOOL ChangeCertDlg ( HWND hwndParent, HINSTANCE hInstance,
    PBYTE * ppEncodedCert, DWORD * pcbEncodedCert )
{
    HINSTANCE hCryptDlg = LoadLibrary ( SZ_CRYPTDLGDLL );
    PFN_CERT_SELECT_CERTIFICATE pfn_CertSelectCertificate;
    RegEntry reCONF(CONFERENCING_KEY, HKEY_CURRENT_USER);
    PCCERT_CONTEXT pOldCert = NULL;
    BOOL bRet = FALSE;

    //
    // First, make sure we can get the CRYPTDLG entry point we need
    //

    if ( NULL == hCryptDlg )
    {
        ERROR_OUT(("Error loading CRYPTDLG"));
        return bRet;
    }

    pfn_CertSelectCertificate =
        (PFN_CERT_SELECT_CERTIFICATE)GetProcAddress ( hCryptDlg,
                                "CertSelectCertificateA" );

    if ( NULL == pfn_CertSelectCertificate )
    {
        ERROR_OUT(("Error getting CertSelectCertificate entry point"));
        goto cleanup;
    }

    //
    // Prepare to bring up the choose dialog
    //

    CERT_SELECT_STRUCT_A css;

    ZeroMemory ( &css, sizeof(css) );

    css.dwSize = sizeof(css);
    css.hwndParent = hwndParent;
    css.hInstance = hInstance;

    css.cCertStore = 1;

    HCERTSTORE aCertStore[1];
    aCertStore[0] = CertOpenSystemStore(0, "MY" );

    if ( NULL == aCertStore[0] )
    {
        ERROR_OUT(("Error opening 'my' store"));
        goto cleanup;
    }
    css.arrayCertStore = aCertStore;

    css.szPurposeOid = szOID_PKIX_KP_CLIENT_AUTH; // BUGBUG add server auth?

    PCCERT_CONTEXT pcc;
    pcc = NULL;

    //
    // Now, get access to the current NetMeeting certificate, if any
    //

    LPBYTE pCertID;
    DWORD cbCertID;

    if ( cbCertID = reCONF.GetBinary ( REGVAL_CERT_ID, (void**)&pCertID ))
    {

        while ( pOldCert = CertEnumCertificatesInStore(
                                    aCertStore[0], (PCERT_CONTEXT)pOldCert ))
        {
            if (cbCertID == pOldCert->pCertInfo->SerialNumber.cbData &&
                !memcmp(pCertID, pOldCert->pCertInfo->SerialNumber.pbData,
                                pOldCert->pCertInfo->SerialNumber.cbData))
            {
                // pOldCert must now be freed via CertFreeCertificateContext
                pcc = pOldCert;
                break;
            }
        }
    }

    css.cCertContext = 0;
    css.arrayCertContext = &pcc;

    if (pfn_CertSelectCertificate ( &css ))
    {
        ASSERT(1 == css.cCertContext);

        //
        // It worked, return the new cert
        //

        CoTaskMemFree ( *ppEncodedCert );

        if ( *ppEncodedCert = (PBYTE)CoTaskMemAlloc ( pcc->cbCertEncoded ))
        {
            memcpy ( *ppEncodedCert, pcc->pbCertEncoded, pcc->cbCertEncoded );
            *pcbEncodedCert = pcc->cbCertEncoded;
            bRet = TRUE;
        }
    }

cleanup:

    if ( aCertStore[0] )
        if (!CertCloseStore ( aCertStore[0], 0 ))
        {
            WARNING_OUT(("ChangeCertDlg: error closing store"));
        }

    if ( pOldCert )
    {
        CertFreeCertificateContext(pOldCert);
    }
    if ( hCryptDlg )
        FreeLibrary ( hCryptDlg );

    return bRet;
}

typedef BOOL (WINAPI *PFN_CERT_VIEW_PROPERTIES)(PCERT_VIEWPROPERTIES_STRUCT);

VOID ViewCertDlg ( HWND hwndParent, PCCERT_CONTEXT pCert )
{
    HINSTANCE hCryptDlg = LoadLibrary ( SZ_CRYPTDLGDLL );
    PFN_CERT_VIEW_PROPERTIES pfn_CertViewProperties;

    //
    // First, make sure we can get the CRYPTDLG entry point we need
    //

    if ( NULL == hCryptDlg )
    {
        ERROR_OUT(("Error loading CRYPTDLG"));
        return;
    }

    pfn_CertViewProperties =
        (PFN_CERT_VIEW_PROPERTIES)GetProcAddress ( hCryptDlg,
                                "CertViewPropertiesA" );

    if ( NULL == pfn_CertViewProperties )
    {
        ERROR_OUT(("Error getting CertViewProperties entry point"));
        goto cleanup;
    }

    CERT_VIEWPROPERTIES_STRUCT    cvp;
    ZeroMemory(&cvp, sizeof(cvp));

    cvp.dwSize = sizeof(cvp);
    cvp.pCertContext = pCert;
    cvp.hwndParent = hwndParent;

    pfn_CertViewProperties ( &cvp );

cleanup:

    if ( hCryptDlg )
        FreeLibrary ( hCryptDlg );

    return;
}

VOID FreeT120EncodedCert ( PBYTE pbEncodedCert )
{
    CoTaskMemFree(pbEncodedCert);
}

BOOL GetT120ActiveCert ( PBYTE * ppbEncodedCert, DWORD * pcbEncodedCert )
{
    if ( !g_pNmSysInfo )
    {
        ERROR_OUT(("GetT120ActiveCert: g_pNmSysInfo NULL"));
        return FALSE;
    }

    DWORD dwResult = -1;

    g_pNmSysInfo->ProcessSecurityData(TPRTCTRL_GETX509CREDENTIALS,
                                (DWORD_PTR)ppbEncodedCert,
                                (DWORD_PTR)pcbEncodedCert,
                                &dwResult);
    return ( dwResult == 0 );
}

BOOL SetT120CertInRegistry ( PBYTE pbEncodedCert, DWORD cbEncodedCert )
{
    PCCERT_CONTEXT pCert = CertCreateCertificateContext ( X509_ASN_ENCODING,
                                                        pbEncodedCert,
                                                        cbEncodedCert );

    if ( pCert )
    {
        RegEntry reCONF(CONFERENCING_KEY, HKEY_CURRENT_USER);

        //
        // Set the new value
        //

        reCONF.SetValue ( REGVAL_CERT_ID,
                    pCert->pCertInfo->SerialNumber.pbData,
                    pCert->pCertInfo->SerialNumber.cbData );

        CertFreeCertificateContext(pCert);
        return TRUE;
    }
    return FALSE;
}

BOOL SetT120ActiveCert ( BOOL fSelfIssued,
                PBYTE pbEncodedCert, DWORD cbEncodedCert )
{
    BOOL bRet = FALSE;
    DWORD dwResult = -1;

    if ( !g_pNmSysInfo )
    {
        ERROR_OUT(("SetT120ActiveCert: g_pNmSysInfo NULL"));
        return FALSE;
    }

    //
    // Clear old cert out of transport
    //
    g_pNmSysInfo->ProcessSecurityData(
                            TPRTCTRL_SETX509CREDENTIALS,
                            0, 0,
                            &dwResult);

    if (!g_pNmSysInfo)
        return FALSE;

    if ( g_pCertContext )
    {
        CertFreeCertificateContext ( g_pCertContext );
        g_pCertContext = NULL;
    }

    if ( g_hCertStore )
    {
        if ( !CertCloseStore ( g_hCertStore, CERT_CLOSE_STORE_CHECK_FLAG ))
        {
            WARNING_OUT(("SetT120ActiveCert: closing store failed"));
        }
        g_hCertStore = NULL;
    }

    if ( fSelfIssued )
    {
        g_hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM,
                                        X509_ASN_ENCODING,
                                        0,
                                        CERT_SYSTEM_STORE_CURRENT_USER,
                                        WSZNMSTORE );
        if ( g_hCertStore )
        {
            //
            // We only expect one cert in here, get it
            //

            g_pCertContext = CertFindCertificateInStore(
                                                  g_hCertStore,
                                                  X509_ASN_ENCODING,
                                                  0,
                                                  CERT_FIND_ANY,
                                                  NULL,
                                                  NULL);
            if ( g_pCertContext )
            {
                dwResult = -1;

                g_pNmSysInfo->ProcessSecurityData(
                                        TPRTCTRL_SETX509CREDENTIALS,
                                        (DWORD_PTR)g_pCertContext, 0,
                                        &dwResult);
                bRet = ( dwResult == 0 ); // BUGBUG TPRTSEC_NOERROR
            }
            else
            {
                WARNING_OUT(("SetT120ActiveCert: no cert in %s?", SZNMSTORE));
            }
        }
        else
        {
            WARNING_OUT(("SetT120ActiveCert: error opening %s store %x",
                SZNMSTORE, GetLastError()));
        }
    }
    else // !fSelfIssued
    {
        PCCERT_CONTEXT pCert = NULL;
        PCCERT_CONTEXT pCertMatch = CertCreateCertificateContext (
                                                            X509_ASN_ENCODING,
                                                            pbEncodedCert,
                                                            cbEncodedCert );

        if ( pCertMatch )
        {
            //
            // Open the user's store
            //

            if ( g_hCertStore = CertOpenSystemStore(0, "MY"))
            {

                while ( pCert = CertEnumCertificatesInStore(
                                        g_hCertStore, (PCERT_CONTEXT)pCert ))
                {
                    //
                    // Is this the same cert?
                    //

                    if ( ( pCert->pCertInfo->SerialNumber.cbData ==
                        pCertMatch->pCertInfo->SerialNumber.cbData ) &&

                        (!memcmp(pCert->pCertInfo->SerialNumber.pbData,
                            pCertMatch->pCertInfo->SerialNumber.pbData,
                                pCert->pCertInfo->SerialNumber.cbData)))
                    {
                        DWORD dwResult = -1;

                        g_pNmSysInfo->ProcessSecurityData(
                                            TPRTCTRL_SETX509CREDENTIALS,
                                            (DWORD_PTR)pCert, 0, &dwResult);

                        bRet = ( dwResult == 0 ); // BUGBUG TPRTSEC_NOERROR
                        break;
                    }
                }
                if ( pCert )
                {
                    // Found it.
                    g_pCertContext = pCert;
                }
                else
                {
                    WARNING_OUT(("SetT120ActiveCert: matching cert not found"));
                }
            }
            else
            {
                ERROR_OUT(("SetT120ActiveCert: can't open my store"));
            }
            CertFreeCertificateContext ( pCertMatch );
        }
    }
    return bRet;
}

static PCCERT_CONTEXT IGetDefaultCert ( BOOL fSystemOnly,
                                HCERTSTORE * phCertStore )
{
    RegEntry reCONF(CONFERENCING_KEY, HKEY_CURRENT_USER);
    HCERTSTORE hStore = NULL;
    PCCERT_CONTEXT  pCertContext = NULL;
    BOOL fNmDefaultCert = TRUE;
    LPBYTE pCertID;

    if ( fSystemOnly )
        fNmDefaultCert = FALSE;
    else
        fNmDefaultCert = !reCONF.GetNumber(REGVAL_SECURITY_AUTHENTICATION,
                                        DEFAULT_SECURITY_AUTHENTICATION);

    hStore = CertOpenSystemStore(0, fNmDefaultCert ?
                                    SZNMSTORE : "MY");

    if ( NULL != hStore )
    {
        PCCERT_CONTEXT pCert = NULL;
        DWORD cbCertID;

        if (!fNmDefaultCert && ( cbCertID = reCONF.GetBinary (
                        REGVAL_CERT_ID, (void**)&pCertID )))
        {
            while ( pCert = CertEnumCertificatesInStore(
                                        hStore, (PCERT_CONTEXT)pCert ))
            {
                if ( cbCertID == pCert->pCertInfo->SerialNumber.cbData &&
                    !memcmp(pCertID, pCert->pCertInfo->SerialNumber.pbData,
                                    pCert->pCertInfo->SerialNumber.cbData))
                {
                    // pCert must now be freed via CertFreeCertificateContext
                    pCertContext = pCert;
                    break;
                }
            }
        }

        if ( NULL == pCertContext )
        {
            // Delete the (stale) reg entry... the cert might have
            // been deleted by other UI.

            if ( !fNmDefaultCert )
                reCONF.DeleteValue( REGVAL_CERT_ID );

            // Find any old client certificate - if fNmDefaultCert this will be
            // the only one in the store.
            pCertContext = CertFindCertificateInStore(hStore,
                                                      X509_ASN_ENCODING,
                                                      0,
                                                      CERT_FIND_ANY,
                                                      NULL,
                                                      NULL);
        }
    }
    else
    {
        WARNING_OUT(("User store %s not opened!", fNmDefaultCert ? SZNMSTORE : "MY"));
        *phCertStore = NULL;
    }

    // Caller to free cert context
    *phCertStore = hStore;
    return pCertContext;
}

BOOL GetDefaultSystemCert ( PBYTE * ppEncodedCert, DWORD * pcbEncodedCert )
{
    HCERTSTORE hStore;
    PCCERT_CONTEXT pCertContext = IGetDefaultCert(TRUE, &hStore);
    BOOL bRet = FALSE;

    if ( pCertContext )
    {
        DWORD cb;
        PBYTE pb;

        if ( pb = (PBYTE)CoTaskMemAlloc ( pCertContext->cbCertEncoded ))
        {
            memcpy ( pb, pCertContext->pbCertEncoded,
                    pCertContext->cbCertEncoded );
            *ppEncodedCert = pb;
            *pcbEncodedCert = pCertContext->cbCertEncoded;
            bRet = TRUE;
        }
        CertFreeCertificateContext(pCertContext);
    }
    if ( hStore )
    {
        if ( !CertCloseStore ( hStore, CERT_CLOSE_STORE_CHECK_FLAG ))
        {
            WARNING_OUT(("GetDefaultSystemCert: error closing store"));
        }
    }
    return bRet;;
}

BOOL InitT120SecurityFromRegistry(VOID)
{
    BOOL bRet = FALSE;

    if ( !g_pNmSysInfo )
    {
        ERROR_OUT(("InitT120SecurityFromRegistry: g_pNmSysInfo NULL"));
        return FALSE;
    }

    //
    // Expect this to be called only once on startup
    //
    ASSERT( NULL == g_pCertContext );
    ASSERT( NULL == g_hCertStore );

    g_pCertContext = IGetDefaultCert(FALSE, &g_hCertStore);

    if ( NULL == g_pCertContext )
    {
        WARNING_OUT(("No user certificate found!"));

        // BUGBUG
        // This means the transport will not be ready for secure
        // calls... we return false but what does the caller do?
        //
    }
    else
    {
        DWORD dwResult = -1;

        g_pNmSysInfo->ProcessSecurityData(TPRTCTRL_SETX509CREDENTIALS,
                                (DWORD_PTR)g_pCertContext, 0, &dwResult);
        if ( !dwResult )
            bRet = TRUE;
        else
        {
            ERROR_OUT(("InitT120SecurityFromRegistry: picked up bad cert"));
        }
    }

    return bRet;
}


HRESULT SetCertFromCertInfo ( PCERT_INFO pCertInfo )
{
    HRESULT hRet = S_FALSE;

    ASSERT( pCertInfo );

    if (!g_pNmSysInfo)
        return hRet;

    //
    // Clear old cert out of transport
    //
    DWORD dwResult = -1;

    g_pNmSysInfo->ProcessSecurityData(
                            TPRTCTRL_SETX509CREDENTIALS,
                            0, 0,
                            &dwResult);

    if ( g_pCertContext )
    {
        CertFreeCertificateContext ( g_pCertContext );
        g_pCertContext = NULL;
    }

    if ( g_hCertStore )
    {
        if ( !CertCloseStore ( g_hCertStore, CERT_CLOSE_STORE_CHECK_FLAG ))
        {
            WARNING_OUT(("SetCertFromCertInfo: closing store failed"));
        }
        g_hCertStore = NULL;
    }

    if ( g_hCertStore = CertOpenSystemStore(0, "MY"))
    {
        //
        // Fix up relative pointers inside pCertInfo: Note that only
        // the pointers relevant to CertGetSubjectCertificateFromStore
        // are fixed up.
        //

        pCertInfo->SerialNumber.pbData += (DWORD_PTR)pCertInfo;
        pCertInfo->Issuer.pbData += (DWORD_PTR)pCertInfo;

        PCCERT_CONTEXT pCert = CertGetSubjectCertificateFromStore(
                                g_hCertStore, X509_ASN_ENCODING, pCertInfo );

        if ( pCert )
        {
            g_pNmSysInfo->ProcessSecurityData(
                                TPRTCTRL_SETX509CREDENTIALS,
                                (DWORD_PTR)pCert, 0, &dwResult);

            if ( 0 == dwResult ) // TPRTSEC_NO_ERROR
            {
                hRet = S_OK;
                g_pCertContext = pCert;
            }
        }
        else
        {
            WARNING_OUT(("SetCertFromCertInfo: matching cert not found"));
        }
    }
    else
    {
        ERROR_OUT(("SetCertFromCertInfo: can't open my store"));
    }
    return hRet;
}