[ros-diffs] [cwittich] 45804: [CRYPTNET] sync cryptnet to wine 1.1.39

Author: cwittich
Date: Wed Mar  3 21:55:41 2010
New Revision: 45804

URL: http://svn.reactos.org/svn/reactos?rev=45804&view=rev
Log:
[CRYPTNET]
sync cryptnet to wine 1.1.39

Modified:
    trunk/reactos/dll/win32/cryptnet/cryptnet_main.c

Modified: trunk/reactos/dll/win32/cryptnet/cryptnet_main.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/cryptnet/cryptne…
==============================================================================
--- trunk/reactos/dll/win32/cryptnet/cryptnet_main.c [iso-8859-1] (original)
+++ trunk/reactos/dll/win32/cryptnet/cryptnet_main.c [iso-8859-1] Wed Mar  3 21:55:41
2010
@@ -40,6 +40,8 @@
 
 WINE_DEFAULT_DEBUG_CHANNEL(cryptnet);
 
+#define IS_INTOID(x)    (((ULONG_PTR)(x) >> 16) == 0)
+
 BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
 {
    TRACE("(0x%p, %d, %p)\n", hinstDLL, fdwReason, lpvReserved);
@@ -92,9 +94,7 @@
 
 static const char *url_oid_to_str(LPCSTR oid)
 {
-    if (HIWORD(oid))
-        return oid;
-    else
+    if (IS_INTOID(oid))
     {
         static char buf[10];
 
@@ -115,6 +115,8 @@
             return buf;
         }
     }
+    else
+        return oid;
 }
 
 typedef BOOL (WINAPI *UrlDllGetObjectUrlFunc)(LPCSTR, LPVOID, DWORD,
@@ -124,18 +126,6 @@
  LPVOID pvPara, DWORD dwFlags, PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray,
  PCRYPT_URL_INFO pUrlInfo, DWORD *pcbUrlInfo, LPVOID pvReserved)
 {
-    /* FIXME: This depends on the AIA (authority info access) extension being
-     * supported in crypt32.
-     */
-    FIXME("\n");
-    SetLastError(CRYPT_E_NOT_FOUND);
-    return FALSE;
-}
-
-static BOOL WINAPI CRYPT_GetUrlFromCertificateCRLDistPoint(LPCSTR pszUrlOid,
- LPVOID pvPara, DWORD dwFlags, PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray,
- PCRYPT_URL_INFO pUrlInfo, DWORD *pcbUrlInfo, LPVOID pvReserved)
-{
     PCCERT_CONTEXT cert = pvPara;
     PCERT_EXTENSION ext;
     BOOL ret = FALSE;
@@ -146,39 +136,37 @@
         SetLastError(CRYPT_E_NOT_FOUND);
         return FALSE;
     }
-    if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
+    if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS,
      cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
     {
-        CRL_DIST_POINTS_INFO *info;
+        CERT_AUTHORITY_INFO_ACCESS *aia;
         DWORD size;
 
-        ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_CRL_DIST_POINTS,
+        ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_AUTHORITY_INFO_ACCESS,
          ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_ALLOC_FLAG, NULL,
-         &info, &size);
+         &aia, &size);
         if (ret)
         {
             DWORD i, cUrl, bytesNeeded = sizeof(CRYPT_URL_ARRAY);
 
-            for (i = 0, cUrl = 0; i < info->cDistPoint; i++)
-                if (info->rgDistPoint[i].DistPointName.dwDistPointNameChoice
-                 == CRL_DIST_POINT_FULL_NAME)
-                {
-                    DWORD j;
-                    CERT_ALT_NAME_INFO *name =
-                     &info->rgDistPoint[i].DistPointName.u.FullName;
-
-                    for (j = 0; j < name->cAltEntry; j++)
-                        if (name->rgAltEntry[j].dwAltNameChoice ==
-                         CERT_ALT_NAME_URL)
+            for (i = 0, cUrl = 0; i < aia->cAccDescr; i++)
+                if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
+                 szOID_PKIX_CA_ISSUERS))
+                {
+                    if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice ==
+                     CERT_ALT_NAME_URL)
+                    {
+                        if (aia->rgAccDescr[i].AccessLocation.u.pwszURL)
                         {
-                            if (name->rgAltEntry[j].u.pwszURL)
-                            {
-                                cUrl++;
-                                bytesNeeded += sizeof(LPWSTR) +
-                                 (lstrlenW(name->rgAltEntry[j].u.pwszURL) + 1)
-                                 * sizeof(WCHAR);
-                            }
+                            cUrl++;
+                            bytesNeeded += sizeof(LPWSTR) +
+                             (lstrlenW(aia->rgAccDescr[i].AccessLocation.u.
+                             pwszURL) + 1) * sizeof(WCHAR);
                         }
+                    }
+                    else
+                        FIXME("unsupported alt name type %d\n",
+                         aia->rgAccDescr[i].AccessLocation.dwAltNameChoice);
                 }
             if (!pcbUrlArray)
             {
@@ -203,28 +191,22 @@
                  (LPWSTR *)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY));
                 nextUrl = (LPWSTR)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY)
                  + cUrl * sizeof(LPWSTR));
-                for (i = 0; i < info->cDistPoint; i++)
-                    if (info->rgDistPoint[i].DistPointName.dwDistPointNameChoice
-                     == CRL_DIST_POINT_FULL_NAME)
+                for (i = 0; i < aia->cAccDescr; i++)
+                    if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
+                     szOID_PKIX_CA_ISSUERS))
                     {
-                        DWORD j;
-                        CERT_ALT_NAME_INFO *name =
-                         &info->rgDistPoint[i].DistPointName.u.FullName;
-
-                        for (j = 0; j < name->cAltEntry; j++)
-                            if (name->rgAltEntry[j].dwAltNameChoice ==
-                             CERT_ALT_NAME_URL)
+                        if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice
+                         == CERT_ALT_NAME_URL)
+                        {
+                            if (aia->rgAccDescr[i].AccessLocation.u.pwszURL)
                             {
-                                if (name->rgAltEntry[j].u.pwszURL)
-                                {
-                                    lstrcpyW(nextUrl,
-                                     name->rgAltEntry[j].u.pwszURL);
-                                    pUrlArray->rgwszUrl[pUrlArray->cUrl++] =
-                                     nextUrl;
-                                    nextUrl +=
-                                     (lstrlenW(name->rgAltEntry[j].u.pwszURL) + 1);
-                                }
+                                lstrcpyW(nextUrl,
+                                 aia->rgAccDescr[i].AccessLocation.u.pwszURL);
+                                pUrlArray->rgwszUrl[pUrlArray->cUrl++] =
+                                 nextUrl;
+                                nextUrl += (lstrlenW(nextUrl) + 1);
                             }
+                        }
                     }
             }
             if (ret)
@@ -247,9 +229,139 @@
                     }
                 }
             }
-            LocalFree(info);
-        }
-    }
+            LocalFree(aia);
+        }
+    }
+    else
+        SetLastError(CRYPT_E_NOT_FOUND);
+    return ret;
+}
+
+static BOOL CRYPT_GetUrlFromCRLDistPointsExt(const CRYPT_DATA_BLOB *value,
+ PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray, PCRYPT_URL_INFO pUrlInfo,
+ DWORD *pcbUrlInfo)
+{
+    BOOL ret;
+    CRL_DIST_POINTS_INFO *info;
+    DWORD size;
+
+    ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_CRL_DIST_POINTS,
+     value->pbData, value->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &info,
&size);
+    if (ret)
+    {
+        DWORD i, cUrl, bytesNeeded = sizeof(CRYPT_URL_ARRAY);
+
+        for (i = 0, cUrl = 0; i < info->cDistPoint; i++)
+            if (info->rgDistPoint[i].DistPointName.dwDistPointNameChoice
+             == CRL_DIST_POINT_FULL_NAME)
+            {
+                DWORD j;
+                CERT_ALT_NAME_INFO *name =
+                 &info->rgDistPoint[i].DistPointName.u.FullName;
+
+                for (j = 0; j < name->cAltEntry; j++)
+                    if (name->rgAltEntry[j].dwAltNameChoice ==
+                     CERT_ALT_NAME_URL)
+                    {
+                        if (name->rgAltEntry[j].u.pwszURL)
+                        {
+                            cUrl++;
+                            bytesNeeded += sizeof(LPWSTR) +
+                             (lstrlenW(name->rgAltEntry[j].u.pwszURL) + 1)
+                             * sizeof(WCHAR);
+                        }
+                    }
+            }
+        if (!pcbUrlArray)
+        {
+            SetLastError(E_INVALIDARG);
+            ret = FALSE;
+        }
+        else if (!pUrlArray)
+            *pcbUrlArray = bytesNeeded;
+        else if (*pcbUrlArray < bytesNeeded)
+        {
+            SetLastError(ERROR_MORE_DATA);
+            *pcbUrlArray = bytesNeeded;
+            ret = FALSE;
+        }
+        else
+        {
+            LPWSTR nextUrl;
+
+            *pcbUrlArray = bytesNeeded;
+            pUrlArray->cUrl = 0;
+            pUrlArray->rgwszUrl =
+             (LPWSTR *)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY));
+            nextUrl = (LPWSTR)((BYTE *)pUrlArray + sizeof(CRYPT_URL_ARRAY)
+             + cUrl * sizeof(LPWSTR));
+            for (i = 0; i < info->cDistPoint; i++)
+                if (info->rgDistPoint[i].DistPointName.dwDistPointNameChoice
+                 == CRL_DIST_POINT_FULL_NAME)
+                {
+                    DWORD j;
+                    CERT_ALT_NAME_INFO *name =
+                     &info->rgDistPoint[i].DistPointName.u.FullName;
+
+                    for (j = 0; j < name->cAltEntry; j++)
+                        if (name->rgAltEntry[j].dwAltNameChoice ==
+                         CERT_ALT_NAME_URL)
+                        {
+                            if (name->rgAltEntry[j].u.pwszURL)
+                            {
+                                lstrcpyW(nextUrl,
+                                 name->rgAltEntry[j].u.pwszURL);
+                                pUrlArray->rgwszUrl[pUrlArray->cUrl++] =
+                                 nextUrl;
+                                nextUrl +=
+                                 (lstrlenW(name->rgAltEntry[j].u.pwszURL) + 1);
+                            }
+                        }
+                }
+        }
+        if (ret)
+        {
+            if (pcbUrlInfo)
+            {
+                FIXME("url info: stub\n");
+                if (!pUrlInfo)
+                    *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
+                else if (*pcbUrlInfo < sizeof(CRYPT_URL_INFO))
+                {
+                    *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
+                    SetLastError(ERROR_MORE_DATA);
+                    ret = FALSE;
+                }
+                else
+                {
+                    *pcbUrlInfo = sizeof(CRYPT_URL_INFO);
+                    memset(pUrlInfo, 0, sizeof(CRYPT_URL_INFO));
+                }
+            }
+        }
+        LocalFree(info);
+    }
+    return ret;
+}
+
+static BOOL WINAPI CRYPT_GetUrlFromCertificateCRLDistPoint(LPCSTR pszUrlOid,
+ LPVOID pvPara, DWORD dwFlags, PCRYPT_URL_ARRAY pUrlArray, DWORD *pcbUrlArray,
+ PCRYPT_URL_INFO pUrlInfo, DWORD *pcbUrlInfo, LPVOID pvReserved)
+{
+    PCCERT_CONTEXT cert = pvPara;
+    PCERT_EXTENSION ext;
+    BOOL ret = FALSE;
+
+    /* The only applicable flag is CRYPT_GET_URL_FROM_EXTENSION */
+    if (dwFlags && !(dwFlags & CRYPT_GET_URL_FROM_EXTENSION))
+    {
+        SetLastError(CRYPT_E_NOT_FOUND);
+        return FALSE;
+    }
+    if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
+     cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
+        ret = CRYPT_GetUrlFromCRLDistPointsExt(&ext->Value, pUrlArray,
+         pcbUrlArray, pUrlInfo, pcbUrlInfo);
     else
         SetLastError(CRYPT_E_NOT_FOUND);
     return ret;
@@ -269,7 +381,7 @@
     TRACE("(%s, %p, %08x, %p, %p, %p, %p, %p)\n", debugstr_a(pszUrlOid),
      pvPara, dwFlags, pUrlArray, pcbUrlArray, pUrlInfo, pcbUrlInfo, pvReserved);
 
-    if (!HIWORD(pszUrlOid))
+    if (IS_INTOID(pszUrlOid))
     {
         switch (LOWORD(pszUrlOid))
         {
@@ -566,7 +678,7 @@
                         }
                     }
                     if (ret)
-                        object.cbData += bytesAvailable;
+                        object.cbData += buffer.dwBufferLength;
                 }
                 else
                 {
@@ -1246,20 +1358,24 @@
                         if (!CertAddCertificateContextToStore(store,
                          context, CERT_STORE_ADD_ALWAYS, NULL))
                             ret = FALSE;
+                        CertFreeCertificateContext(context);
                         break;
                     case CERT_QUERY_CONTENT_CRL:
                         if (!CertAddCRLContextToStore(store,
                          context, CERT_STORE_ADD_ALWAYS, NULL))
                              ret = FALSE;
+                        CertFreeCRLContext(context);
                         break;
                     case CERT_QUERY_CONTENT_CTL:
                         if (!CertAddCTLContextToStore(store,
                          context, CERT_STORE_ADD_ALWAYS, NULL))
                              ret = FALSE;
+                        CertFreeCTLContext(context);
                         break;
                     default:
                         CertAddStoreToCollection(store, contextStore, 0, 0);
                     }
+                    CertCloseStore(contextStore, 0);
                 }
                 else
                     ret = FALSE;
@@ -1284,7 +1400,7 @@
 
     *pFunc = NULL;
     *phFunc = 0;
-    if (!HIWORD(pszObjectOid))
+    if (IS_INTOID(pszObjectOid))
     {
         switch (LOWORD(pszObjectOid))
         {
@@ -1354,7 +1470,7 @@
 {
     BOOL ret;
 
-    if (!HIWORD(pszObjectOid))
+    if (IS_INTOID(pszObjectOid))
     {
         switch (LOWORD(pszObjectOid))
         {
@@ -1437,6 +1553,238 @@
     return ret;
 }
 
+static DWORD verify_cert_revocation_with_crl(PCCERT_CONTEXT cert,
+ PCCRL_CONTEXT crl, DWORD index, FILETIME *pTime,
+ PCERT_REVOCATION_STATUS pRevStatus)
+{
+    DWORD error;
+
+    if (CertVerifyCRLTimeValidity(pTime, crl->pCrlInfo))
+    {
+        /* The CRL isn't time valid */
+        error = CRYPT_E_NO_REVOCATION_CHECK;
+    }
+    else
+    {
+        PCRL_ENTRY entry = NULL;
+
+        CertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
+        if (entry)
+        {
+            error = CRYPT_E_REVOKED;
+            pRevStatus->dwIndex = index;
+        }
+        else
+            error = ERROR_SUCCESS;
+    }
+    return error;
+}
+
+static DWORD verify_cert_revocation_from_dist_points_ext(
+ const CRYPT_DATA_BLOB *value, PCCERT_CONTEXT cert, DWORD index,
+ FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara,
+ PCERT_REVOCATION_STATUS pRevStatus)
+{
+    DWORD error = ERROR_SUCCESS, cbUrlArray;
+
+    if (CRYPT_GetUrlFromCRLDistPointsExt(value, NULL, &cbUrlArray, NULL, NULL))
+    {
+        CRYPT_URL_ARRAY *urlArray = CryptMemAlloc(cbUrlArray);
+
+        if (urlArray)
+        {
+            DWORD j, retrievalFlags = 0, startTime, endTime, timeout;
+            BOOL ret;
+
+            ret = CRYPT_GetUrlFromCRLDistPointsExt(value, urlArray,
+             &cbUrlArray, NULL, NULL);
+            if (dwFlags & CERT_VERIFY_CACHE_ONLY_BASED_REVOCATION)
+                retrievalFlags |= CRYPT_CACHE_ONLY_RETRIEVAL;
+            if (dwFlags & CERT_VERIFY_REV_ACCUMULATIVE_TIMEOUT_FLAG &&
+             pRevPara && pRevPara->cbSize >=
offsetof(CERT_REVOCATION_PARA,
+             dwUrlRetrievalTimeout) + sizeof(DWORD))
+            {
+                startTime = GetTickCount();
+                endTime = startTime + pRevPara->dwUrlRetrievalTimeout;
+                timeout = pRevPara->dwUrlRetrievalTimeout;
+            }
+            else
+                endTime = timeout = 0;
+            if (!ret)
+                error = GetLastError();
+            for (j = 0; !error && j < urlArray->cUrl; j++)
+            {
+                PCCRL_CONTEXT crl;
+
+                ret = CryptRetrieveObjectByUrlW(urlArray->rgwszUrl[j],
+                 CONTEXT_OID_CRL, retrievalFlags, timeout, (void **)&crl,
+                 NULL, NULL, NULL, NULL);
+                if (ret)
+                {
+                    error = verify_cert_revocation_with_crl(cert, crl, index,
+                     pTime, pRevStatus);
+                    if (!error && timeout)
+                    {
+                        DWORD time = GetTickCount();
+
+                        if ((int)(endTime - time) <= 0)
+                        {
+                            error = ERROR_TIMEOUT;
+                            pRevStatus->dwIndex = index;
+                        }
+                        else
+                            timeout = endTime - time;
+                    }
+                    CertFreeCRLContext(crl);
+                }
+                else
+                    error = CRYPT_E_REVOCATION_OFFLINE;
+            }
+            CryptMemFree(urlArray);
+        }
+        else
+        {
+            error = ERROR_OUTOFMEMORY;
+            pRevStatus->dwIndex = index;
+        }
+    }
+    else
+    {
+        error = GetLastError();
+        pRevStatus->dwIndex = index;
+    }
+    return error;
+}
+
+static DWORD verify_cert_revocation_from_aia_ext(
+ const CRYPT_DATA_BLOB *value, PCCERT_CONTEXT cert, DWORD index,
+ FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara,
+ PCERT_REVOCATION_STATUS pRevStatus)
+{
+    BOOL ret;
+    DWORD error, size;
+    CERT_AUTHORITY_INFO_ACCESS *aia;
+
+    ret = CryptDecodeObjectEx(X509_ASN_ENCODING, X509_AUTHORITY_INFO_ACCESS,
+     value->pbData, value->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &aia,
&size);
+    if (ret)
+    {
+        DWORD i;
+
+        for (i = 0; i < aia->cAccDescr; i++)
+            if (!strcmp(aia->rgAccDescr[i].pszAccessMethod,
+             szOID_PKIX_OCSP))
+            {
+                if (aia->rgAccDescr[i].AccessLocation.dwAltNameChoice ==
+                 CERT_ALT_NAME_URL)
+                    FIXME("OCSP URL = %s\n",
+                     debugstr_w(aia->rgAccDescr[i].AccessLocation.u.pwszURL));
+                else
+                    FIXME("unsupported AccessLocation type %d\n",
+                     aia->rgAccDescr[i].AccessLocation.dwAltNameChoice);
+            }
+        LocalFree(aia);
+        /* FIXME: lie and pretend OCSP validated the cert */
+        error = ERROR_SUCCESS;
+    }
+    else
+        error = GetLastError();
+    return error;
+}
+
+static DWORD verify_cert_revocation(PCCERT_CONTEXT cert, DWORD index,
+ FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara,
+ PCERT_REVOCATION_STATUS pRevStatus)
+{
+    DWORD error = ERROR_SUCCESS;
+    PCERT_EXTENSION ext;
+
+    if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
+     cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
+        error = verify_cert_revocation_from_dist_points_ext(&ext->Value, cert,
+         index, pTime, dwFlags, pRevPara, pRevStatus);
+    else if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS,
+     cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
+        error = verify_cert_revocation_from_aia_ext(&ext->Value, cert,
+         index, pTime, dwFlags, pRevPara, pRevStatus);
+    else
+    {
+        if (pRevPara && pRevPara->hCrlStore &&
pRevPara->pIssuerCert)
+        {
+            PCCRL_CONTEXT crl = NULL;
+            BOOL canSignCRLs;
+
+            /* If the caller told us about the issuer, make sure the issuer
+             * can sign CRLs before looking for one.
+             */
+            if ((ext = CertFindExtension(szOID_KEY_USAGE,
+             pRevPara->pIssuerCert->pCertInfo->cExtension,
+             pRevPara->pIssuerCert->pCertInfo->rgExtension)))
+            {
+                CRYPT_BIT_BLOB usage;
+                DWORD size = sizeof(usage);
+
+                if (!CryptDecodeObjectEx(cert->dwCertEncodingType, X509_BITS,
+                 ext->Value.pbData, ext->Value.cbData,
+                 CRYPT_DECODE_NOCOPY_FLAG, NULL, &usage, &size))
+                    canSignCRLs = FALSE;
+                else if (usage.cbData > 2)
+                {
+                    /* The key usage extension only defines 9 bits => no more
+                     * than 2 bytes are needed to encode all known usages.
+                     */
+                    canSignCRLs = FALSE;
+                }
+                else
+                {
+                    BYTE usageBits = usage.pbData[usage.cbData - 1];
+
+                    canSignCRLs = usageBits & CERT_CRL_SIGN_KEY_USAGE;
+                }
+            }
+            else
+                canSignCRLs = TRUE;
+            if (canSignCRLs)
+            {
+                /* If the caller was helpful enough to tell us where to find a
+                 * CRL for the cert, look for one and check it.
+                 */
+                crl = CertFindCRLInStore(pRevPara->hCrlStore,
+                 cert->dwCertEncodingType,
+                 CRL_FIND_ISSUED_BY_SIGNATURE_FLAG |
+                 CRL_FIND_ISSUED_BY_AKI_FLAG,
+                 CRL_FIND_ISSUED_BY, pRevPara->pIssuerCert, NULL);
+            }
+            if (crl)
+            {
+                error = verify_cert_revocation_with_crl(cert, crl, index,
+                 pTime, pRevStatus);
+                CertFreeCRLContext(crl);
+            }
+            else
+            {
+                error = CRYPT_E_NO_REVOCATION_CHECK;
+                pRevStatus->dwIndex = index;
+            }
+        }
+        else
+        {
+            error = CRYPT_E_NO_REVOCATION_CHECK;
+            pRevStatus->dwIndex = index;
+        }
+    }
+    return error;
+}
+
+typedef struct _CERT_REVOCATION_PARA_NO_EXTRA_FIELDS {
+    DWORD                     cbSize;
+    PCCERT_CONTEXT            pIssuerCert;
+    DWORD                     cCertStore;
+    HCERTSTORE               *rgCertStore;
+    HCERTSTORE                hCrlStore;
+    LPFILETIME                pftTimeToUse;
+} CERT_REVOCATION_PARA_NO_EXTRA_FIELDS, *PCERT_REVOCATION_PARA_NO_EXTRA_FIELDS;
+
 typedef struct _OLD_CERT_REVOCATION_STATUS {
     DWORD cbSize;
     DWORD dwIndex;
@@ -1452,7 +1800,8 @@
  PCERT_REVOCATION_PARA pRevPara, PCERT_REVOCATION_STATUS pRevStatus)
 {
     DWORD error = 0, i;
-    BOOL ret;
+    FILETIME now;
+    LPFILETIME pTime = NULL;
 
     TRACE("(%08x, %d, %d, %p, %08x, %p, %p)\n", dwEncodingType, dwRevType,
      cContext, rgpvContext, dwFlags, pRevPara, pRevStatus);
@@ -1463,106 +1812,33 @@
         SetLastError(E_INVALIDARG);
         return FALSE;
     }
+    if (!cContext)
+    {
+        SetLastError(E_INVALIDARG);
+        return FALSE;
+    }
+    if (pRevPara && pRevPara->cbSize >=
+     sizeof(CERT_REVOCATION_PARA_NO_EXTRA_FIELDS))
+        pTime = pRevPara->pftTimeToUse;
+    if (!pTime)
+    {
+        GetSystemTimeAsFileTime(&now);
+        pTime = &now;
+    }
     memset(&pRevStatus->dwIndex, 0, pRevStatus->cbSize - sizeof(DWORD));
     if (dwRevType != CERT_CONTEXT_REVOCATION_TYPE)
-    {
         error = CRYPT_E_NO_REVOCATION_CHECK;
-        ret = FALSE;
-    }
     else
     {
-        ret = TRUE;
-        for (i = 0; ret && i < cContext; i++)
-        {
-            DWORD cbUrlArray;
-
-            ret = CryptGetObjectUrl(URL_OID_CERTIFICATE_CRL_DIST_POINT,
-             rgpvContext[i], 0, NULL, &cbUrlArray, NULL, NULL, NULL);
-            if (!ret && GetLastError() == CRYPT_E_NOT_FOUND)
-            {
-                error = CRYPT_E_NO_REVOCATION_CHECK;
-                pRevStatus->dwIndex = i;
-            }
-            else if (ret)
-            {
-                CRYPT_URL_ARRAY *urlArray = CryptMemAlloc(cbUrlArray);
-
-                if (urlArray)
-                {
-                    DWORD j, retrievalFlags = 0, startTime, endTime, timeout;
-
-                    ret = CryptGetObjectUrl(URL_OID_CERTIFICATE_CRL_DIST_POINT,
-                     rgpvContext[i], 0, urlArray, &cbUrlArray, NULL, NULL,
-                     NULL);
-                    if (dwFlags & CERT_VERIFY_CACHE_ONLY_BASED_REVOCATION)
-                        retrievalFlags |= CRYPT_CACHE_ONLY_RETRIEVAL;
-                    if (dwFlags & CERT_VERIFY_REV_ACCUMULATIVE_TIMEOUT_FLAG
&&
-                     pRevPara->cbSize >= offsetof(CERT_REVOCATION_PARA,
-                     dwUrlRetrievalTimeout) + sizeof(DWORD))
-                    {
-                        startTime = GetTickCount();
-                        endTime = startTime + pRevPara->dwUrlRetrievalTimeout;
-                        timeout = pRevPara->dwUrlRetrievalTimeout;
-                    }
-                    else
-                        endTime = timeout = 0;
-                    for (j = 0; ret && j < urlArray->cUrl; j++)
-                    {
-                        PCCRL_CONTEXT crl;
-
-                        ret = CryptRetrieveObjectByUrlW(urlArray->rgwszUrl[j],
-                         CONTEXT_OID_CRL, retrievalFlags, timeout,
-                         (void **)&crl, NULL, NULL, NULL, NULL);
-                        if (ret)
-                        {
-                            PCRL_ENTRY entry = NULL;
-
-                            CertFindCertificateInCRL(
-                             rgpvContext[i], crl, 0, NULL,
-                             &entry);
-                            if (entry)
-                            {
-                                error = CRYPT_E_REVOKED;
-                                pRevStatus->dwIndex = i;
-                                ret = FALSE;
-                            }
-                            else if (timeout)
-                            {
-                                DWORD time = GetTickCount();
-
-                                if ((int)(endTime - time) <= 0)
-                                {
-                                    error = ERROR_TIMEOUT;
-                                    pRevStatus->dwIndex = i;
-                                    ret = FALSE;
-                                }
-                                else
-                                    timeout = endTime - time;
-                            }
-                            CertFreeCRLContext(crl);
-                        }
-                        else
-                            error = CRYPT_E_REVOCATION_OFFLINE;
-                    }
-                    CryptMemFree(urlArray);
-                }
-                else
-                {
-                    error = ERROR_OUTOFMEMORY;
-                    pRevStatus->dwIndex = i;
-                    ret = FALSE;
-                }
-            }
-            else
-                pRevStatus->dwIndex = i;
-        }
-    }
-
-    if (!ret)
+        for (i = 0; !error && i < cContext; i++)
+            error = verify_cert_revocation(rgpvContext[i], i, pTime, dwFlags,
+             pRevPara, pRevStatus);
+    }
+    if (error)
     {
         SetLastError(error);
         pRevStatus->dwError = error;
     }
-    TRACE("returning %d (%08x)\n", ret, error);
-    return ret;
-}
+    TRACE("returning %d (%08x)\n", !error, error);
+    return !error;
+}