Re: [PATCH] wininet: Dont fail on invalid Certificates when masking errors.

[Jacek Caban]

Hi Alistair,

On 04/04/16 11:48, Alistair Leslie-Hughes wrote:
> Signed-off-by: Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com>
> ---
>  dlls/wininet/netconnection.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c
> index 7305860..723705a 100644
> --- a/dlls/wininet/netconnection.c
> +++ b/dlls/wininet/netconnection.c
> @@ -200,7 +200,10 @@ static DWORD netconn_verify_cert(netconn_t *conn, PCCERT_CONTEXT cert, HCERTSTOR
>              conn->server->cert_chain = NULL;
>          }
>          if(conn->mask_errors)
> +        {
>              conn->server->security_flags |= conn->security_flags & _SECURITY_ERROR_FLAGS_MASK;
> +            err = ERROR_SUCCESS;
> +        }

I don't think we should do that. mask_errors means that we should
combine errors, not ignore them. I don't know what you're trying to fix,
but I'd suggest to concentrate on error source (maybe there shouldn't be
an error in the first place or it should be ignored due to
security_flags). If you think that the error is right, maybe we don't
handle failure correctly.

Cheers,
Jacek

[PATCH] wininet: Dont fail on invalid Certificates when masking errors.

[Alistair Leslie-Hughes]

Hi Jacek,

On 04/04/16 21:50, Jacek Caban wrote:
> I don't think we should do that. mask_errors means that we should
> combine errors, not ignore them. I don't know what you're trying to fix,

Should we rename the variable to make more sense then?
> but I'd suggest to concentrate on error source (maybe there shouldn't be
> an error in the first place or it should be ignored due to
> security_flags). If you think that the error is right, maybe we don't
> handle failure correctly.

The scenario:  I'm trying to connect to a server via https however this
server certificate isn't valid.  On Windows, I'm prompted once about the
certificate error(s), since the combined error flag is set, and after I
accept the certificate, it then connects.

However WINE is behaving a little differently. I'm don't remember being
prompted about the bad certificate (since errors are combined) and then
the connection fails. From memory, if errors aren't combined then
security prompts are displayed (one for each error).

Maybe there is more then one bug here.

Best Regards
 Alistair