October 2009 - Wine-commits

Vincent Povirk : ole32: Don' t call internal functions from OLECONVERT_GetOLE20FromOLE10.
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: 6a360257136d7505a8f11c9a009537c001a61efa URL: http://source.winehq.org/git/wine.git/?a=commit;h=6a360257136d7505a8f11c9a0… Author: Vincent Povirk <vincent(a)codeweavers.com> Date: Wed Oct 28 14:37:37 2009 -0500 ole32: Don't call internal functions from OLECONVERT_GetOLE20FromOLE10. --- dlls/ole32/storage32.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/ole32/storage32.c b/dlls/ole32/storage32.c index b0e0ada..468ef44 100644 --- a/dlls/ole32/storage32.c +++ b/dlls/ole32/storage32.c @@ -6652,8 +6652,8 @@ static void OLECONVERT_GetOLE20FromOLE10(LPSTORAGE pDestStorage, const BYTE *pBu hRes = StgOpenStorage(wstrTempFile, NULL, STGM_READ, NULL, 0, &pTempStorage); if(hRes == S_OK) { - hRes = StorageImpl_CopyTo(pTempStorage, 0, NULL, NULL, pDestStorage); - StorageBaseImpl_Release(pTempStorage); + hRes = IStorage_CopyTo(pTempStorage, 0, NULL, NULL, pDestStorage); + IStorage_Release(pTempStorage); } DeleteFileW(wstrTempFile); }

1 0

Vincent Povirk : ole32: Don' t call internal functions from OLECONVERT_WriteOLE20ToBuffer.
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: 39e35cd7b45233b943c91e35f6433342fbc05e7e URL: http://source.winehq.org/git/wine.git/?a=commit;h=39e35cd7b45233b943c91e35f… Author: Vincent Povirk <vincent(a)codeweavers.com> Date: Wed Oct 28 14:39:05 2009 -0500 ole32: Don't call internal functions from OLECONVERT_WriteOLE20ToBuffer. --- dlls/ole32/storage32.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/ole32/storage32.c b/dlls/ole32/storage32.c index 468ef44..23b3049 100644 --- a/dlls/ole32/storage32.c +++ b/dlls/ole32/storage32.c @@ -6697,8 +6697,8 @@ static DWORD OLECONVERT_WriteOLE20ToBuffer(LPSTORAGE pStorage, BYTE **pData) if(hRes == S_OK) { /* Copy Src Storage to the Temp Storage */ - StorageImpl_CopyTo(pStorage, 0, NULL, NULL, pTempStorage); - StorageBaseImpl_Release(pTempStorage); + IStorage_CopyTo(pStorage, 0, NULL, NULL, pTempStorage); + IStorage_Release(pTempStorage); /* Open Temp Storage as a file and copy to memory */ hFile = CreateFileW(wstrTempFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);

1 0

Vincent Povirk : ole32: Rename StorageImpl_CopyTo to StorageBaseImpl_CopyTo .
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: a5f87a4731ea33c2bcf39fbdd527101a505dfcbf URL: http://source.winehq.org/git/wine.git/?a=commit;h=a5f87a4731ea33c2bcf39fbdd… Author: Vincent Povirk <vincent(a)codeweavers.com> Date: Wed Oct 28 14:48:39 2009 -0500 ole32: Rename StorageImpl_CopyTo to StorageBaseImpl_CopyTo. --- dlls/ole32/storage32.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dlls/ole32/storage32.c b/dlls/ole32/storage32.c index 23b3049..1a4a315 100644 --- a/dlls/ole32/storage32.c +++ b/dlls/ole32/storage32.c @@ -1498,7 +1498,7 @@ static HRESULT findTreeParent(StorageImpl *storage, ULONG storageEntry, /************************************************************************* * CopyTo (IStorage) */ -static HRESULT WINAPI StorageImpl_CopyTo( +static HRESULT WINAPI StorageBaseImpl_CopyTo( IStorage* iface, DWORD ciidExclude, /* [in] */ const IID* rgiidExclude, /* [size_is][unique][in] */ @@ -2141,7 +2141,7 @@ static const IStorageVtbl Storage32Impl_Vtbl = StorageBaseImpl_OpenStream, StorageBaseImpl_CreateStorage, StorageBaseImpl_OpenStorage, - StorageImpl_CopyTo, + StorageBaseImpl_CopyTo, StorageImpl_MoveElementTo, StorageImpl_Commit, StorageImpl_Revert, @@ -3949,7 +3949,7 @@ static const IStorageVtbl Storage32InternalImpl_Vtbl = StorageBaseImpl_OpenStream, StorageBaseImpl_CreateStorage, StorageBaseImpl_OpenStorage, - StorageImpl_CopyTo, + StorageBaseImpl_CopyTo, StorageImpl_MoveElementTo, StorageInternalImpl_Commit, StorageInternalImpl_Revert,

1 0

Henri Verbeet : wined3d: It's not an error to request multisampling.
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: fbae08672b060b7ea3550cca9b87e37c08239d0e URL: http://source.winehq.org/git/wine.git/?a=commit;h=fbae08672b060b7ea3550cca9… Author: Henri Verbeet <hverbeet(a)codeweavers.com> Date: Thu Oct 29 18:56:20 2009 +0100 wined3d: It's not an error to request multisampling. --- dlls/wined3d/context.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/dlls/wined3d/context.c b/dlls/wined3d/context.c index 8190a0a..f15d9cb 100644 --- a/dlls/wined3d/context.c +++ b/dlls/wined3d/context.c @@ -1258,7 +1258,7 @@ struct wined3d_context *context_create(IWineD3DDeviceImpl *This, IWineD3DSurface ERR("The program is requesting multisampling without support!\n"); else { - ERR("Requesting MultiSampleType=%d\n", pPresentParms->MultiSampleType); + TRACE("Requesting multisample type %#x.\n", pPresentParms->MultiSampleType); numSamples = pPresentParms->MultiSampleType; } }

1 0

Juan Lang : crypt32: Remove redundant if clause.
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: c310637f4ff12e4b3782fb5c4a06312135557adc URL: http://source.winehq.org/git/wine.git/?a=commit;h=c310637f4ff12e4b3782fb5c4… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Oct 28 16:50:10 2009 -0700 crypt32: Remove redundant if clause. --- dlls/crypt32/chain.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 8972463..3b618fa 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -1725,7 +1725,6 @@ static DWORD CRYPT_ChainQuality(const CertificateChain *chain) quality &= ~CHAIN_QUALITY_TRUSTED_ROOT; if (IS_TRUST_ERROR_SET(&chain->context.TrustStatus, CERT_TRUST_IS_PARTIAL_CHAIN)) - if (chain->context.TrustStatus.dwErrorStatus & CERT_TRUST_IS_PARTIAL_CHAIN) quality &= ~CHAIN_QUALITY_COMPLETE_CHAIN; if (IS_TRUST_ERROR_SET(&chain->context.TrustStatus, CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_NOT_TIME_NESTED))

1 0

Juan Lang : crypt32: Add basic constraints to chain quality selection algorithm.
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: 552fec4002ad1760c4c4738e0d133e6268928739 URL: http://source.winehq.org/git/wine.git/?a=commit;h=552fec4002ad1760c4c4738e0… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Oct 28 16:50:33 2009 -0700 crypt32: Add basic constraints to chain quality selection algorithm. --- dlls/crypt32/chain.c | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 3b618fa..7bb72fa 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -1704,14 +1704,16 @@ static PCertificateChain CRYPT_BuildAlternateContextFromChain( return alternate; } -#define CHAIN_QUALITY_SIGNATURE_VALID 8 -#define CHAIN_QUALITY_TIME_VALID 4 -#define CHAIN_QUALITY_COMPLETE_CHAIN 2 -#define CHAIN_QUALITY_TRUSTED_ROOT 1 +#define CHAIN_QUALITY_SIGNATURE_VALID 0x16 +#define CHAIN_QUALITY_TIME_VALID 8 +#define CHAIN_QUALITY_COMPLETE_CHAIN 4 +#define CHAIN_QUALITY_BASIC_CONSTRAINTS 2 +#define CHAIN_QUALITY_TRUSTED_ROOT 1 #define CHAIN_QUALITY_HIGHEST \ CHAIN_QUALITY_SIGNATURE_VALID | CHAIN_QUALITY_TIME_VALID | \ - CHAIN_QUALITY_COMPLETE_CHAIN | CHAIN_QUALITY_TRUSTED_ROOT + CHAIN_QUALITY_COMPLETE_CHAIN | CHAIN_QUALITY_BASIC_CONSTRAINTS | \ + CHAIN_QUALITY_TRUSTED_ROOT #define IS_TRUST_ERROR_SET(TrustStatus, bits) \ (TrustStatus)->dwErrorStatus & (bits) @@ -1724,6 +1726,9 @@ static DWORD CRYPT_ChainQuality(const CertificateChain *chain) CERT_TRUST_IS_UNTRUSTED_ROOT)) quality &= ~CHAIN_QUALITY_TRUSTED_ROOT; if (IS_TRUST_ERROR_SET(&chain->context.TrustStatus, + CERT_TRUST_INVALID_BASIC_CONSTRAINTS)) + quality &= ~CHAIN_QUALITY_BASIC_CONSTRAINTS; + if (IS_TRUST_ERROR_SET(&chain->context.TrustStatus, CERT_TRUST_IS_PARTIAL_CHAIN)) quality &= ~CHAIN_QUALITY_COMPLETE_CHAIN; if (IS_TRUST_ERROR_SET(&chain->context.TrustStatus,

1 0

Juan Lang : crypt32: Only permit v1 or v2 CA certificates without a basic constraints extension if they 're installed locally.
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: 33a62350537e677d977d6a35e394ba138714382a URL: http://source.winehq.org/git/wine.git/?a=commit;h=33a62350537e677d977d6a35e… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Oct 28 17:28:46 2009 -0700 crypt32: Only permit v1 or v2 CA certificates without a basic constraints extension if they're installed locally. --- dlls/crypt32/chain.c | 52 ++++++++++++++++++++++++++++++++++++++----------- 1 files changed, 40 insertions(+), 12 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 7bb72fa..2c1d598 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -418,11 +418,18 @@ static BOOL CRYPT_DecodeBasicConstraints(PCCERT_CONTEXT cert, } /* Checks element's basic constraints to see if it can act as a CA, with - * remainingCAs CAs left in this chain. A root certificate is assumed to be - * allowed to be a CA whether or not the basic constraints extension is present, - * whereas an intermediate CA cert is not. This matches the expected usage in - * RFC 3280: a conforming intermediate CA MUST contain the basic constraints - * extension. It also appears to match Microsoft's implementation. + * remainingCAs CAs left in this chain. In general, a cert must include the + * basic constraints extension, with the CA flag asserted, in order to be + * allowed to be a CA. A V1 or V2 cert, which has no extensions, is also + * allowed to be a CA if it's installed locally (in the engine's world store.) + * This matches the expected usage in RFC 5280, section 4.2.1.9: a conforming + * CA MUST include the basic constraints extension in all certificates that are + * used to validate digital signatures on certificates. It also matches + * section 6.1.4(k): "If a certificate is a v1 or v2 certificate, then the + * application MUST either verify that the certificate is a CA certificate + * through out-of-band means or reject the certificate." Rejecting the + * certificate prohibits a large number of commonly used certificates, so + * accepting locally installed ones is a compromise. * Updates chainConstraints with the element's constraints, if: * 1. chainConstraints doesn't have a path length constraint, or * 2. element's path length constraint is smaller than chainConstraints's @@ -431,15 +438,36 @@ static BOOL CRYPT_DecodeBasicConstraints(PCCERT_CONTEXT cert, * Returns TRUE if the element can be a CA, and the length of the remaining * chain is valid. */ -static BOOL CRYPT_CheckBasicConstraintsForCA(PCCERT_CONTEXT cert, - CERT_BASIC_CONSTRAINTS2_INFO *chainConstraints, DWORD remainingCAs, - BOOL isRoot, BOOL *pathLengthConstraintViolated) +static BOOL CRYPT_CheckBasicConstraintsForCA(PCertificateChainEngine engine, + PCCERT_CONTEXT cert, CERT_BASIC_CONSTRAINTS2_INFO *chainConstraints, + DWORD remainingCAs, BOOL *pathLengthConstraintViolated) { - BOOL validBasicConstraints; + BOOL validBasicConstraints, implicitCA = FALSE; CERT_BASIC_CONSTRAINTS2_INFO constraints; + if (cert->pCertInfo->dwVersion == CERT_V1 || + cert->pCertInfo->dwVersion == CERT_V2) + { + BYTE hash[20]; + DWORD size = sizeof(hash); + + if (CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID, + hash, &size)) + { + CRYPT_HASH_BLOB blob = { sizeof(hash), hash }; + PCCERT_CONTEXT localCert = CertFindCertificateInStore( + engine->hWorld, cert->dwCertEncodingType, 0, CERT_FIND_SHA1_HASH, + &blob, NULL); + + if (localCert) + { + CertFreeCertificateContext(localCert); + implicitCA = TRUE; + } + } + } if ((validBasicConstraints = CRYPT_DecodeBasicConstraints(cert, - &constraints, isRoot))) + &constraints, implicitCA))) { chainConstraints->fCA = constraints.fCA; if (!constraints.fCA) @@ -1210,9 +1238,9 @@ static void CRYPT_CheckSimpleChain(PCertificateChainEngine engine, if (pathLengthConstraintViolated) chain->rgpElement[i]->TrustStatus.dwErrorStatus |= CERT_TRUST_INVALID_BASIC_CONSTRAINTS; - else if (!CRYPT_CheckBasicConstraintsForCA( + else if (!CRYPT_CheckBasicConstraintsForCA(engine, chain->rgpElement[i]->pCertContext, &constraints, i - 1, - isRoot, &pathLengthConstraintViolated)) + &pathLengthConstraintViolated)) chain->rgpElement[i]->TrustStatus.dwErrorStatus |= CERT_TRUST_INVALID_BASIC_CONSTRAINTS; else if (constraints.fPathLenConstraint &&

1 0

Juan Lang : crypt32: Add key usage extension to chain4_0.
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: 77472187c9f6677a5e5d8b21ed9d9b07ab49495d URL: http://source.winehq.org/git/wine.git/?a=commit;h=77472187c9f6677a5e5d8b21e… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Oct 28 16:59:19 2009 -0700 crypt32: Add key usage extension to chain4_0. --- dlls/crypt32/tests/chain.c | 43 ++++++++++++++++++++++--------------------- 1 files changed, 22 insertions(+), 21 deletions(-) diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 4dd31aa..7f3aa81 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -612,15 +612,15 @@ static const BYTE chain3_0[] = { * A chain whose path length constraint is violated. */ static const BYTE chain4_0[] = { -0x30,0x82,0x01,0xb3,0x30,0x82,0x01,0x20,0xa0,0x03,0x02,0x01,0x02,0x02,0x10, -0xcb,0xdc,0x8d,0xca,0xc1,0x0e,0x9c,0x9d,0x4f,0x0a,0xc1,0x09,0x31,0x32,0x94, -0xf9,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31, -0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31, -0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30, -0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35, -0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05, -0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48, -0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89, +0x30,0x82,0x01,0xc5,0x30,0x82,0x01,0x30,0xa0,0x03,0x02,0x01,0x02,0x02,0x10, +0x01,0xcd,0x67,0x9e,0xec,0xae,0x1e,0x69,0x16,0x3f,0x92,0x8a,0xed,0x6d,0x57, +0xac,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30, +0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72, +0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30, +0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35, +0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03, +0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a, +0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89, 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82, 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34, 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7, @@ -630,18 +630,19 @@ static const BYTE chain4_0[] = { 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c, 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35, 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01, -0x00,0x01,0xa3,0x16,0x30,0x14,0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01, -0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x00,0x30,0x09,0x06,0x05, -0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,0x81,0x00,0x93,0xe8,0x98,0xbe, -0x7b,0x5c,0x4c,0x58,0xbd,0xee,0x31,0x55,0xa8,0xb5,0x86,0xfc,0x23,0x55,0x48, -0xda,0x95,0x60,0x0f,0x53,0x64,0x66,0x50,0x78,0xdc,0x1c,0xf3,0xec,0x38,0x7d, -0x07,0x58,0x19,0xcf,0x83,0xfc,0x92,0xc4,0x3e,0x48,0x5b,0x45,0x54,0xf7,0x15, -0x6f,0xb0,0x5e,0x8c,0xbf,0x03,0x62,0x17,0x27,0x28,0x59,0x49,0xde,0x52,0x2d, -0x4b,0xb3,0x1e,0x4d,0x4f,0x2c,0xa8,0x1e,0x70,0xd1,0xdb,0xe7,0x98,0x6c,0x6f, -0xaa,0x94,0xea,0x5d,0x7f,0xc5,0x1d,0x2a,0x4d,0xb7,0x4c,0xac,0xa6,0xbf,0x79, -0x9a,0xf6,0x1e,0x98,0x64,0x14,0x2e,0xbd,0x8a,0xaf,0xac,0x52,0xd2,0x2c,0xdd, -0xcd,0x1b,0x3d,0x28,0x43,0xea,0x25,0x91,0x15,0xb8,0x54,0x72,0x33,0xca,0xd8, -0x5f,0x06,0x4c,0x97 }; +0x00,0x01,0xa3,0x26,0x30,0x24,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01, +0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01, +0x01,0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x00,0x30,0x0b,0x06, +0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x70, +0x60,0x8d,0x5f,0x29,0x8e,0x6b,0x48,0x79,0xaa,0xd1,0x7a,0xbb,0x6c,0x7c,0x54, +0x11,0x55,0x08,0xb9,0x2e,0x5e,0x53,0xd6,0x9b,0xb9,0xe4,0xc8,0x0e,0x48,0xe7, +0x20,0x9e,0xbd,0x7c,0x55,0xb8,0xf1,0x69,0x0c,0x08,0xd6,0x32,0x32,0xd9,0x05, +0x81,0x8a,0x33,0x4c,0x57,0x20,0xae,0xe8,0xde,0x61,0x63,0x85,0xc8,0xe1,0x1d, +0xef,0x4b,0xa4,0x42,0x4e,0x0a,0x25,0x48,0x2b,0xc2,0x06,0x79,0x90,0x45,0x90, +0x94,0x3d,0xb0,0x36,0xe6,0x60,0xe6,0xd2,0x1a,0x11,0x01,0x4b,0xaf,0x23,0x4d, +0x62,0x6b,0xdc,0x3a,0xae,0x61,0x93,0xce,0x7b,0xae,0x21,0xfe,0x42,0xd8,0x86, +0x36,0x19,0x00,0x18,0x13,0x4d,0xf9,0xd1,0x94,0xa2,0xb7,0xbd,0xb0,0x5c,0x9b, +0x5c,0x03,0xf5,0x86,0x85,0x07,0x1c }; static const BYTE chain4_1[] = { 0x30,0x82,0x01,0xb3,0x30,0x82,0x01,0x1e,0xa0,0x03,0x02,0x01,0x02,0x02,0x01, 0x01,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,

1 0

Juan Lang : crypt32: Use a helper function to find an existing cert by hash .
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: 7b0297769d7c56398721a38da1225ee39169b05b URL: http://source.winehq.org/git/wine.git/?a=commit;h=7b0297769d7c56398721a38da… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Oct 28 17:30:50 2009 -0700 crypt32: Use a helper function to find an existing cert by hash. --- dlls/crypt32/chain.c | 53 +++++++++++++++++++++++-------------------------- 1 files changed, 25 insertions(+), 28 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 2c1d598..5802773 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -69,6 +69,24 @@ static inline void CRYPT_CloseStores(DWORD cStores, HCERTSTORE *stores) static const WCHAR rootW[] = { 'R','o','o','t',0 }; +/* Finds cert in store by comparing the cert's hashes. */ +static PCCERT_CONTEXT CRYPT_FindCertInStore(HCERTSTORE store, + PCCERT_CONTEXT cert) +{ + PCCERT_CONTEXT matching = NULL; + BYTE hash[20]; + DWORD size = sizeof(hash); + + if (CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID, hash, &size)) + { + CRYPT_HASH_BLOB blob = { sizeof(hash), hash }; + + matching = CertFindCertificateInStore(store, cert->dwCertEncodingType, + 0, CERT_FIND_SHA1_HASH, &blob, NULL); + } + return matching; +} + static BOOL CRYPT_CheckRestrictedRoot(HCERTSTORE store) { BOOL ret = TRUE; @@ -77,29 +95,15 @@ static BOOL CRYPT_CheckRestrictedRoot(HCERTSTORE store) { HCERTSTORE rootStore = CertOpenSystemStoreW(0, rootW); PCCERT_CONTEXT cert = NULL, check; - BYTE hash[20]; - DWORD size; do { cert = CertEnumCertificatesInStore(store, cert); if (cert) { - size = sizeof(hash); - - ret = CertGetCertificateContextProperty(cert, CERT_HASH_PROP_ID, - hash, &size); - if (ret) - { - CRYPT_HASH_BLOB blob = { sizeof(hash), hash }; - - check = CertFindCertificateInStore(rootStore, - cert->dwCertEncodingType, 0, CERT_FIND_SHA1_HASH, &blob, - NULL); - if (!check) - ret = FALSE; - else - CertFreeCertificateContext(check); - } + if (!(check = CRYPT_FindCertInStore(rootStore, cert))) + ret = FALSE; + else + CertFreeCertificateContext(check); } } while (ret && cert); if (cert) @@ -336,16 +340,9 @@ static void CRYPT_FreeSimpleChain(PCERT_SIMPLE_CHAIN chain) static void CRYPT_CheckTrustedStatus(HCERTSTORE hRoot, PCERT_CHAIN_ELEMENT rootElement) { - BYTE hash[20]; - DWORD size = sizeof(hash); - CRYPT_HASH_BLOB blob = { sizeof(hash), hash }; - PCCERT_CONTEXT trustedRoot; - - CertGetCertificateContextProperty(rootElement->pCertContext, - CERT_HASH_PROP_ID, hash, &size); - trustedRoot = CertFindCertificateInStore(hRoot, - rootElement->pCertContext->dwCertEncodingType, 0, CERT_FIND_SHA1_HASH, - &blob, NULL); + PCCERT_CONTEXT trustedRoot = CRYPT_FindCertInStore(hRoot, + rootElement->pCertContext); + if (!trustedRoot) rootElement->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_UNTRUSTED_ROOT;

1 0

Juan Lang : crypt32: Only permit v1 or v2 CA certificates without a key usage extension if they 're installed locally.
by Alexandre Julliard 30 Oct '09

30 Oct '09

Module: wine Branch: master Commit: 60770fb011b0a60d7862e7fe9c7a6d24d68ac0ad URL: http://source.winehq.org/git/wine.git/?a=commit;h=60770fb011b0a60d7862e7fe9… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Oct 28 17:32:39 2009 -0700 crypt32: Only permit v1 or v2 CA certificates without a key usage extension if they're installed locally. --- dlls/crypt32/chain.c | 44 +++++++++++++++++++++++++------------------- 1 files changed, 25 insertions(+), 19 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 5802773..0637646 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -1082,8 +1082,8 @@ static void dump_element(PCCERT_CONTEXT cert) dump_extension(&cert->pCertInfo->rgExtension[i]); } -static BOOL CRYPT_KeyUsageValid(PCCERT_CONTEXT cert, BOOL isRoot, BOOL isCA, - DWORD index) +static BOOL CRYPT_KeyUsageValid(PCertificateChainEngine engine, + PCCERT_CONTEXT cert, BOOL isCA, DWORD index) { PCERT_EXTENSION ext; BOOL ret; @@ -1121,20 +1121,33 @@ static BOOL CRYPT_KeyUsageValid(PCCERT_CONTEXT cert, BOOL isRoot, BOOL isCA, { if (!ext) { - /* MS appears to violate RFC 3280, section 4.2.1.3 (Key Usage) + /* MS appears to violate RFC 5280, section 4.2.1.3 (Key Usage) * here. Quoting the RFC: * "This [key usage] extension MUST appear in certificates that * contain public keys that are used to validate digital signatures * on other public key certificates or CRLs." - * Most of the test chains' certs do not contain key usage - * extensions, yet are allowed to be CA certs. This appears to - * be common usage too: the root CA in a chain often does not have - * the key usage extension. We are a little more restrictive: - * root certs, which commonly do not have any extensions, are - * allowed to sign certificates without the key usage extension. + * MS appears to accept certs that do not contain key usage + * extensions as CA certs. V1 and V2 certificates did not have + * extensions, and many root certificates are V1 certificates, so + * perhaps this is prudent. On the other hand, MS also accepts V3 + * certs without key usage extensions. We are more restrictive: + * we accept locally installed V1 or V2 certs as CA certs. */ - WARN_(chain)("no key usage extension on a CA cert\n"); - ret = isRoot; + ret = FALSE; + if (cert->pCertInfo->dwVersion == CERT_V1 || + cert->pCertInfo->dwVersion == CERT_V2) + { + PCCERT_CONTEXT localCert = CRYPT_FindCertInStore( + engine->hWorld, cert); + + if (localCert) + { + CertFreeCertificateContext(localCert); + ret = TRUE; + } + } + if (!ret) + WARN_(chain)("no key usage extension on a CA cert\n"); } else { @@ -1206,19 +1219,12 @@ static void CRYPT_CheckSimpleChain(PCertificateChainEngine engine, chain->cElement, debugstr_w(filetime_to_str(time))); for (i = chain->cElement - 1; i >= 0; i--) { - BOOL isRoot; - if (TRACE_ON(chain)) dump_element(chain->rgpElement[i]->pCertContext); if (CertVerifyTimeValidity(time, chain->rgpElement[i]->pCertContext->pCertInfo) != 0) chain->rgpElement[i]->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_NOT_TIME_VALID; - if (i == chain->cElement - 1) - isRoot = CRYPT_IsCertificateSelfSigned( - chain->rgpElement[i]->pCertContext); - else - isRoot = FALSE; if (i != 0) { /* Check the signature of the cert this issued */ @@ -1255,7 +1261,7 @@ static void CRYPT_CheckSimpleChain(PCertificateChainEngine engine, chain->rgpElement[i]->TrustStatus.dwErrorStatus |= CERT_TRUST_INVALID_BASIC_CONSTRAINTS; } - if (!CRYPT_KeyUsageValid(chain->rgpElement[i]->pCertContext, isRoot, + if (!CRYPT_KeyUsageValid(engine, chain->rgpElement[i]->pCertContext, constraints.fCA, i)) chain->rgpElement[i]->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_NOT_VALID_FOR_USAGE;

1 0