[PATCH v3 0/2] MR2533: wldap32: Implement setting LDAP_OPT_SERVER_CERTIFICATE and add tests.
ctxt_handle is moved to the top of struct tlsw_session so that it can be easily retrieved via LDAP_OPT_X_TLS_SSL_CTX. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=54727 -- v3: wldap32: Implement setting LDAP_OPT_SERVER_CERTIFICATE and add tests. wldap32: Implement ldap_connect. https://gitlab.winehq.org/wine/wine/-/merge_requests/2533
From: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/wldap32/init.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/dlls/wldap32/init.c b/dlls/wldap32/init.c index b8010a2da12..78891d9be61 100644 --- a/dlls/wldap32/init.c +++ b/dlls/wldap32/init.c @@ -251,7 +251,11 @@ ULONG CDECL WLDAP32_ldap_connect( LDAP *ld, struct l_timeval *timeout ) TRACE( "(%p, %p)\n", ld, timeout ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; - return WLDAP32_LDAP_SUCCESS; /* FIXME: do something, e.g. ping the host */ + + if (timeout && (timeout->tv_sec || timeout->tv_usec)) + FIXME( "ignoring timeout\n" ); + + return map_error( ldap_connect( CTX(ld) ) ); } /*********************************************************************** -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/2533
From: Alex Henrie <alexhenrie24(a)gmail.com> ctxt_handle is moved to the top of struct tlsw_session so that it can be easily retrieved via LDAP_OPT_X_TLS_SSL_CTX. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=54727 --- dlls/wldap32/Makefile.in | 2 +- dlls/wldap32/add.c | 2 ++ dlls/wldap32/bind.c | 7 +++++- dlls/wldap32/compare.c | 2 ++ dlls/wldap32/control.c | 1 + dlls/wldap32/delete.c | 2 ++ dlls/wldap32/extended.c | 2 ++ dlls/wldap32/init.c | 34 ++++++++++++++++++++++++++++- dlls/wldap32/modify.c | 2 ++ dlls/wldap32/modrdn.c | 2 ++ dlls/wldap32/option.c | 7 ++++-- dlls/wldap32/rename.c | 2 ++ dlls/wldap32/search.c | 9 ++++---- dlls/wldap32/tests/Makefile.in | 2 +- dlls/wldap32/tests/parse.c | 39 ++++++++++++++++++++++++++++++++++ dlls/wldap32/winldap_private.h | 17 +++++++++++++-- include/winldap.h | 2 ++ libs/ldap/libldap/tls_w.c | 2 +- 18 files changed, 122 insertions(+), 14 deletions(-) diff --git a/dlls/wldap32/Makefile.in b/dlls/wldap32/Makefile.in index ed8630e47af..903f6f67666 100644 --- a/dlls/wldap32/Makefile.in +++ b/dlls/wldap32/Makefile.in @@ -1,6 +1,6 @@ MODULE = wldap32.dll IMPORTLIB = wldap32 -IMPORTS = $(LDAP_PE_LIBS) secur32 ws2_32 user32 +IMPORTS = $(LDAP_PE_LIBS) crypt32 secur32 ws2_32 user32 EXTRAINCL = $(LDAP_PE_CFLAGS) C_SRCS = \ diff --git a/dlls/wldap32/add.c b/dlls/wldap32/add.c index 4509910abc5..9b9c48c1de2 100644 --- a/dlls/wldap32/add.c +++ b/dlls/wldap32/add.c @@ -110,6 +110,7 @@ ULONG CDECL ldap_add_extW( LDAP *ld, WCHAR *dn, LDAPModW **attrs, LDAPControlW * TRACE( "(%p, %s, %p, %p, %p, %p)\n", ld, debugstr_w(dn), attrs, serverctrls, clientctrls, message ); if (!ld || !message) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = dn ? strWtoU( dn ) : strdup( "" ))) goto exit; if (attrs && !(attrsU = modarrayWtoU( attrs ))) goto exit; @@ -172,6 +173,7 @@ ULONG CDECL ldap_add_ext_sW( LDAP *ld, WCHAR *dn, LDAPModW **attrs, LDAPControlW TRACE( "(%p, %s, %p, %p, %p)\n", ld, debugstr_w(dn), attrs, serverctrls, clientctrls ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = dn ? strWtoU( dn ) : strdup(""))) goto exit; if (attrs && !(attrsU = modarrayWtoU( attrs ))) goto exit; diff --git a/dlls/wldap32/bind.c b/dlls/wldap32/bind.c index 5441aeba6c7..8491cc8650d 100644 --- a/dlls/wldap32/bind.c +++ b/dlls/wldap32/bind.c @@ -67,6 +67,7 @@ ULONG CDECL ldap_bindW( LDAP *ld, WCHAR *dn, WCHAR *cred, ULONG method ) if (!ld) return ~0u; if (method != WLDAP32_LDAP_AUTH_SIMPLE) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (dn && !(dnU = strWtoU( dn ))) goto exit; if (cred) @@ -178,6 +179,7 @@ ULONG CDECL ldap_bind_sW( LDAP *ld, WCHAR *dn, WCHAR *cred, ULONG method ) TRACE( "(%p, %s, %p, %#lx)\n", ld, debugstr_w(dn), cred, method ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (method == WLDAP32_LDAP_AUTH_SIMPLE) { @@ -269,6 +271,7 @@ ULONG CDECL ldap_sasl_bindW( LDAP *ld, const PWCHAR dn, const PWCHAR mechanism, debugstr_w(mechanism), cred, serverctrls, clientctrls, message ); if (!ld || !dn || !mechanism || !cred || !message) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = strWtoU( dn ))) goto exit; if (!(mechanismU = strWtoU( mechanism ))) goto exit; @@ -334,6 +337,7 @@ ULONG CDECL ldap_sasl_bind_sW( LDAP *ld, const PWCHAR dn, const PWCHAR mechanism debugstr_w(mechanism), cred, serverctrls, clientctrls, serverdata ); if (!ld || !dn || !mechanism || !cred || !serverdata) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = strWtoU( dn ))) goto exit; if (!(mechanismU = strWtoU( mechanism ))) goto exit; @@ -395,7 +399,7 @@ ULONG CDECL ldap_simple_bindW( LDAP *ld, WCHAR *dn, WCHAR *passwd ) TRACE( "(%p, %s, %p)\n", ld, debugstr_w(dn), passwd ); - if (!ld) return ~0u; + if (!ld || WLDAP32_ldap_connect( ld, NULL ) != WLDAP32_LDAP_SUCCESS) return ~0u; if (dn && !(dnU = strWtoU( dn ))) goto exit; if (passwd) @@ -452,6 +456,7 @@ ULONG CDECL ldap_simple_bind_sW( LDAP *ld, WCHAR *dn, WCHAR *passwd ) TRACE( "(%p, %s, %p)\n", ld, debugstr_w(dn), passwd ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (dn && !(dnU = strWtoU( dn ))) goto exit; if (passwd) diff --git a/dlls/wldap32/compare.c b/dlls/wldap32/compare.c index cc51c64ebeb..eca97be30bc 100644 --- a/dlls/wldap32/compare.c +++ b/dlls/wldap32/compare.c @@ -116,6 +116,7 @@ ULONG CDECL ldap_compare_extW( LDAP *ld, WCHAR *dn, WCHAR *attr, WCHAR *value, s if (!ld || !message) return WLDAP32_LDAP_PARAM_ERROR; if (!attr) return WLDAP32_LDAP_NO_MEMORY; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = dn ? strWtoU( dn ) : strdup( "" ))) goto exit; if (!(attrU = strWtoU( attr ))) goto exit; @@ -197,6 +198,7 @@ ULONG CDECL ldap_compare_ext_sW( LDAP *ld, WCHAR *dn, WCHAR *attr, WCHAR *value, if (!ld) return WLDAP32_LDAP_PARAM_ERROR; if (!attr) return LDAP_UNDEFINED_TYPE; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = dn ? strWtoU( dn ) : strdup( "" ))) goto exit; if (!(attrU = strWtoU( attr ))) goto exit; diff --git a/dlls/wldap32/control.c b/dlls/wldap32/control.c index 131ea4dad64..64aa5ac3696 100644 --- a/dlls/wldap32/control.c +++ b/dlls/wldap32/control.c @@ -162,6 +162,7 @@ INT CDECL ldap_create_vlv_controlW( LDAP *ld, WLDAP32_LDAPVLVInfo *info, UCHAR c if (!ld || !control) return ~0u; if (info && !(infoU = vlvinfoWtoU( info ))) return WLDAP32_LDAP_NO_MEMORY; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; ret = map_error( ldap_create_vlv_control( CTX(ld), infoU, &controlU ) ); if (ret == WLDAP32_LDAP_SUCCESS) diff --git a/dlls/wldap32/delete.c b/dlls/wldap32/delete.c index 8539b7266eb..71887789934 100644 --- a/dlls/wldap32/delete.c +++ b/dlls/wldap32/delete.c @@ -100,6 +100,7 @@ ULONG CDECL ldap_delete_extW( LDAP *ld, WCHAR *dn, LDAPControlW **serverctrls, L TRACE( "(%p, %s, %p, %p, %p)\n", ld, debugstr_w(dn), serverctrls, clientctrls, message ); if (!ld || !message) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = dn ? strWtoU( dn ) : strdup( "" ))) goto exit; if (serverctrls && !(serverctrlsU = controlarrayWtoU( serverctrls ))) goto exit; @@ -154,6 +155,7 @@ ULONG CDECL ldap_delete_ext_sW( LDAP *ld, WCHAR *dn, LDAPControlW **serverctrls, TRACE( "(%p, %s, %p, %p)\n", ld, debugstr_w(dn), serverctrls, clientctrls ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = dn ? strWtoU( dn ) : strdup( "" ))) goto exit; if (serverctrls && !(serverctrlsU = controlarrayWtoU( serverctrls ))) goto exit; diff --git a/dlls/wldap32/extended.c b/dlls/wldap32/extended.c index b168615c0fc..89278567fa0 100644 --- a/dlls/wldap32/extended.c +++ b/dlls/wldap32/extended.c @@ -80,6 +80,7 @@ ULONG CDECL ldap_extended_operationW( LDAP *ld, WCHAR *oid, struct WLDAP32_berva TRACE( "(%p, %s, %p, %p, %p, %p)\n", ld, debugstr_w(oid), data, serverctrls, clientctrls, message ); if (!ld || !message) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (oid && !(oidU = strWtoU( oid ))) goto exit; if (data && !(dataU = bervalWtoU( data ))) goto exit; @@ -146,6 +147,7 @@ ULONG CDECL ldap_extended_operation_sW( LDAP *ld, WCHAR *oid, struct WLDAP32_ber TRACE( "(%p, %s, %p, %p, %p, %p, %p)\n", ld, debugstr_w(oid), data, serverctrls, clientctrls, retoid, retdata ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (oid && !(oidU = strWtoU( oid ))) goto exit; if (data && !(dataU = bervalWtoU( data ))) goto exit; diff --git a/dlls/wldap32/init.c b/dlls/wldap32/init.c index 78891d9be61..e68782add8d 100644 --- a/dlls/wldap32/init.c +++ b/dlls/wldap32/init.c @@ -24,6 +24,8 @@ #include "winbase.h" #include "winnls.h" #include "winternl.h" +#include "schannel.h" +#include "sspi.h" #include "wine/debug.h" #include "winldap_private.h" @@ -248,6 +250,9 @@ exit: */ ULONG CDECL WLDAP32_ldap_connect( LDAP *ld, struct l_timeval *timeout ) { + VERIFYSERVERCERT *cert_callback = CERT_CALLBACK(ld); + int ret; + TRACE( "(%p, %p)\n", ld, timeout ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; @@ -255,7 +260,32 @@ ULONG CDECL WLDAP32_ldap_connect( LDAP *ld, struct l_timeval *timeout ) if (timeout && (timeout->tv_sec || timeout->tv_usec)) FIXME( "ignoring timeout\n" ); - return map_error( ldap_connect( CTX(ld) ) ); + if ((ret = ldap_connect( CTX(ld) ))) + return map_error( ret ); + + if (cert_callback) + { + CtxtHandle *tls_context; + const CERT_CONTEXT *cert; + + if ((ret = ldap_get_option( CTX(ld), LDAP_OPT_X_TLS_SSL_CTX, &tls_context ))) + return map_error( ret ); + + if (QueryContextAttributesA( tls_context, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert ) != SEC_E_OK) + return WLDAP32_LDAP_SERVER_DOWN; + + if (cert_callback( ld, &cert )) + { + TRACE( "accepted\n" ); + } + else + { + WARN( "rejected\n" ); + return WLDAP32_LDAP_SERVER_DOWN; + } + } + + return WLDAP32_LDAP_SUCCESS; } /*********************************************************************** @@ -427,6 +457,8 @@ ULONG CDECL ldap_start_tls_sW( LDAP *ld, ULONG *retval, LDAPMessage **result, LD else { ret = map_error( ldap_start_tls_s( CTX(ld), serverctrlsU, clientctrlsU ) ); + if (!ret && WLDAP32_ldap_connect( ld, NULL ) != WLDAP32_LDAP_SUCCESS) + ret = WLDAP32_LDAP_LOCAL_ERROR; } exit: diff --git a/dlls/wldap32/modify.c b/dlls/wldap32/modify.c index 2dea3279151..16b1e4604f4 100644 --- a/dlls/wldap32/modify.c +++ b/dlls/wldap32/modify.c @@ -110,6 +110,7 @@ ULONG CDECL ldap_modify_extW( LDAP *ld, WCHAR *dn, LDAPModW **mods, LDAPControlW TRACE( "(%p, %s, %p, %p, %p, %p)\n", ld, debugstr_w(dn), mods, serverctrls, clientctrls, message ); if (!ld || !message) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = dn ? strWtoU( dn ) : strdup( "" ))) goto exit; if (mods && !(modsU = modarrayWtoU( mods ))) goto exit; @@ -172,6 +173,7 @@ ULONG CDECL ldap_modify_ext_sW( LDAP *ld, WCHAR *dn, LDAPModW **mods, LDAPContro TRACE( "(%p, %s, %p, %p, %p)\n", ld, debugstr_w(dn), mods, serverctrls, clientctrls ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (!(dnU = dn ? strWtoU( dn ) : strdup( "" ))) goto exit; if (mods && !(modsU = modarrayWtoU( mods ))) goto exit; diff --git a/dlls/wldap32/modrdn.c b/dlls/wldap32/modrdn.c index 4acf16eb5e4..4e91b619331 100644 --- a/dlls/wldap32/modrdn.c +++ b/dlls/wldap32/modrdn.c @@ -97,6 +97,7 @@ ULONG CDECL ldap_modrdn2W( LDAP *ld, WCHAR *dn, WCHAR *newdn, int delete ) if (!ld || !newdn) return ~0u; if (dn && !(dnU = strWtoU( dn ))) return WLDAP32_LDAP_NO_MEMORY; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if ((newdnU = strWtoU( newdn ))) { @@ -145,6 +146,7 @@ ULONG CDECL ldap_modrdn2_sW( LDAP *ld, WCHAR *dn, WCHAR *newdn, int delete ) TRACE( "(%p, %s, %p, 0x%02x)\n", ld, debugstr_w(dn), newdn, delete ); if (!ld || !newdn) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (dn && !(dnU = strWtoU( dn ))) return WLDAP32_LDAP_NO_MEMORY; diff --git a/dlls/wldap32/option.c b/dlls/wldap32/option.c index 2a2b7e9a517..38398c6d46c 100644 --- a/dlls/wldap32/option.c +++ b/dlls/wldap32/option.c @@ -291,6 +291,7 @@ ULONG CDECL ldap_set_optionA( LDAP *ld, int option, void *value ) case WLDAP32_LDAP_OPT_PROTOCOL_VERSION: case WLDAP32_LDAP_OPT_REFERRALS: case WLDAP32_LDAP_OPT_REFERRAL_HOP_LIMIT: + case WLDAP32_LDAP_OPT_SERVER_CERTIFICATE: case WLDAP32_LDAP_OPT_SIZELIMIT: case WLDAP32_LDAP_OPT_SSL: case WLDAP32_LDAP_OPT_TIMELIMIT: @@ -330,7 +331,6 @@ ULONG CDECL ldap_set_optionA( LDAP *ld, int option, void *value ) case WLDAP32_LDAP_OPT_SASL_METHOD: case WLDAP32_LDAP_OPT_SECURITY_CONTEXT: case WLDAP32_LDAP_OPT_SEND_TIMEOUT: - case WLDAP32_LDAP_OPT_SERVER_CERTIFICATE: case WLDAP32_LDAP_OPT_SERVER_ERROR: case WLDAP32_LDAP_OPT_SERVER_EXT_ERROR: case WLDAP32_LDAP_OPT_SIGN: @@ -443,6 +443,10 @@ ULONG CDECL ldap_set_optionW( LDAP *ld, int option, void *value ) FIXME( "ignoring referral hop limit\n" ); return WLDAP32_LDAP_SUCCESS; + case WLDAP32_LDAP_OPT_SERVER_CERTIFICATE: + CERT_CALLBACK(ld) = value; + return WLDAP32_LDAP_SUCCESS; + case WLDAP32_LDAP_OPT_DEREF: case WLDAP32_LDAP_OPT_DESC: case WLDAP32_LDAP_OPT_ERROR_NUMBER: @@ -515,7 +519,6 @@ ULONG CDECL ldap_set_optionW( LDAP *ld, int option, void *value ) case WLDAP32_LDAP_OPT_SASL_METHOD: case WLDAP32_LDAP_OPT_SECURITY_CONTEXT: case WLDAP32_LDAP_OPT_SEND_TIMEOUT: - case WLDAP32_LDAP_OPT_SERVER_CERTIFICATE: case WLDAP32_LDAP_OPT_SERVER_ERROR: case WLDAP32_LDAP_OPT_SERVER_EXT_ERROR: case WLDAP32_LDAP_OPT_SIGN: diff --git a/dlls/wldap32/rename.c b/dlls/wldap32/rename.c index f2b224b3d0f..39c3f401009 100644 --- a/dlls/wldap32/rename.c +++ b/dlls/wldap32/rename.c @@ -74,6 +74,7 @@ ULONG CDECL ldap_rename_extW( LDAP *ld, WCHAR *dn, WCHAR *newrdn, WCHAR *newpare delete, serverctrls, clientctrls, message ); if (!ld || !message) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (dn && !(dnU = strWtoU( dn ))) goto exit; if (newrdn && !(newrdnU = strWtoU( newrdn ))) goto exit; @@ -140,6 +141,7 @@ ULONG CDECL ldap_rename_ext_sW( LDAP *ld, WCHAR *dn, WCHAR *newrdn, WCHAR *newpa delete, serverctrls, clientctrls ); if (!ld) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret; if (dn && !(dnU = strWtoU( dn ))) goto exit; if (newrdn && !(newrdnU = strWtoU( newrdn ))) goto exit; diff --git a/dlls/wldap32/search.c b/dlls/wldap32/search.c index 18a079dd5bc..82743ee83da 100644 --- a/dlls/wldap32/search.c +++ b/dlls/wldap32/search.c @@ -112,12 +112,13 @@ ULONG CDECL ldap_search_extW( LDAP *ld, WCHAR *base, ULONG scope, WCHAR *filter, ULONG ret = WLDAP32_LDAP_NO_MEMORY; char *baseU = NULL, *filterU = NULL, **attrsU = NULL; LDAPControl **serverctrlsU = NULL, **clientctrlsU = NULL; - struct timeval timevalU; + struct l_timeval timevalW = { timelimit, 0 }; + struct timeval timevalU = { timelimit, 0 }; TRACE( "(%p, %s, %#lx, %s, %p, %#lx, %p, %p, %#lx, %#lx, %p)\n", ld, debugstr_w(base), scope, debugstr_w(filter), attrs, attrsonly, serverctrls, clientctrls, timelimit, sizelimit, message ); - if (!ld) return ~0u; + if (!ld || WLDAP32_ldap_connect( ld, &timevalW ) != WLDAP32_LDAP_SUCCESS) return ~0u; if (base && !(baseU = strWtoU( base ))) goto exit; if (filter && !(filterU = strWtoU( filter ))) goto exit; @@ -125,9 +126,6 @@ ULONG CDECL ldap_search_extW( LDAP *ld, WCHAR *base, ULONG scope, WCHAR *filter, if (serverctrls && !(serverctrlsU = controlarrayWtoU( serverctrls ))) goto exit; if (clientctrls && !(clientctrlsU = controlarrayWtoU( clientctrls ))) goto exit; - timevalU.tv_sec = timelimit; - timevalU.tv_usec = 0; - ret = map_error( ldap_search_ext( CTX(ld), baseU, scope, filterU, attrsU, attrsonly, serverctrlsU, clientctrlsU, timelimit ? &timevalU : NULL, sizelimit, (int *)message ) ); exit: @@ -190,6 +188,7 @@ ULONG CDECL ldap_search_ext_sW( LDAP *ld, WCHAR *base, ULONG scope, WCHAR *filte debugstr_w(filter), attrs, attrsonly, serverctrls, clientctrls, timeout, sizelimit, res ); if (!ld || !res) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, timeout ))) return ret; if (base && !(baseU = strWtoU( base ))) goto exit; if (filter && !(filterU = strWtoU( filter ))) goto exit; diff --git a/dlls/wldap32/tests/Makefile.in b/dlls/wldap32/tests/Makefile.in index 05fe5b9af6d..0911147a784 100644 --- a/dlls/wldap32/tests/Makefile.in +++ b/dlls/wldap32/tests/Makefile.in @@ -1,5 +1,5 @@ TESTDLL = wldap32.dll -IMPORTS = wldap32 +IMPORTS = crypt32 wldap32 C_SRCS = \ ber.c \ diff --git a/dlls/wldap32/tests/parse.c b/dlls/wldap32/tests/parse.c index 8cd313cd6ca..031b8bcb22a 100644 --- a/dlls/wldap32/tests/parse.c +++ b/dlls/wldap32/tests/parse.c @@ -544,6 +544,44 @@ static void test_opt_ssl(void) ldap_unbind( ld ); } +static BOOLEAN CDECL verify_certificate( LDAP *ld, const CERT_CONTEXT **cert ) +{ + CertFreeCertificateContext(*cert); + return FALSE; +} + +static void test_opt_server_certificate(void) +{ + LDAP *ld; + ULONG ret, version = LDAP_VERSION3; + + ld = ldap_initA( (char *)"db.debian.org", 636 ); + ok( ld != NULL, "ldap_init failed\n" ); + ret = ldap_set_optionA( ld, LDAP_OPT_PROTOCOL_VERSION, &version ); + ok( !ret, "ldap_set_optionA should succeed, got %#lx\n", ret ); + ret = ldap_set_optionA( ld, LDAP_OPT_SSL, LDAP_OPT_ON ); + ok( !ret, "ldap_set_optionA should succeed, got %#lx\n", ret ); + ret = ldap_set_optionA( ld, LDAP_OPT_SERVER_CERTIFICATE, &verify_certificate ); + ok( !ret, "ldap_set_optionA should succeed, got %#lx\n", ret ); + ret = ldap_connect( ld, NULL ); + ok( ret == LDAP_SERVER_DOWN, "ldap_connect should fail, got %#lx\n", ret ); + ret = ldap_simple_bindA( ld, NULL, NULL ); + ok( ret == (ULONG)-1, "ldap_simple_bindA should fail, got %#lx\n", ret ); + ret = ldap_simple_bind_sA( ld, NULL, NULL ); + ok( ret == LDAP_SERVER_DOWN, "ldap_simple_bind_sA should fail, got %#lx\n", ret ); + ldap_unbind( ld ); + + ld = ldap_initA( (char *)"db.debian.org", 389 ); + ok( ld != NULL, "ldap_init failed\n" ); + ret = ldap_set_optionA( ld, LDAP_OPT_PROTOCOL_VERSION, &version ); + ok( !ret, "ldap_set_optionA should succeed, got %#lx\n", ret ); + ret = ldap_set_optionA( ld, LDAP_OPT_SERVER_CERTIFICATE, &verify_certificate ); + ok( !ret, "ldap_set_optionA should succeed, got %#lx\n", ret ); + ret = ldap_start_tls_sA( ld, NULL, NULL, NULL, NULL ); + ok( ret == LDAP_LOCAL_ERROR, "ldap_start_tls_sA should fail, got %#lx\n", ret ); + ldap_unbind( ld ); +} + START_TEST (parse) { LDAP *ld; @@ -552,6 +590,7 @@ START_TEST (parse) test_ldap_server_control(); test_ldap_bind_sA(); test_opt_ssl(); + test_opt_server_certificate(); ld = ldap_initA( (char *)"db.debian.org", 389 ); ok( ld != NULL, "ldap_init failed\n" ); diff --git a/dlls/wldap32/winldap_private.h b/dlls/wldap32/winldap_private.h index 7adf77f151e..86b29bfd006 100644 --- a/dlls/wldap32/winldap_private.h +++ b/dlls/wldap32/winldap_private.h @@ -21,6 +21,7 @@ #include <assert.h> #include <stdlib.h> #include "winternl.h" +#include "wincrypt.h" #include "winnls.h" #define LDAP_NEEDS_PROTOTYPES @@ -362,8 +363,18 @@ typedef struct ldapsearch struct WLDAP32_berval *cookie; } LDAPSearch; -#define CTX(ld) (*(LDAP **)ld->Reserved3) -#define SERVER_CTRLS(ld) (*(struct berval ***)(ld->Reserved3 + sizeof(LDAP *))) +typedef BOOLEAN (CDECL VERIFYSERVERCERT)(LDAP*,const CERT_CONTEXT**); + +struct private_data +{ + LDAP *ctx; + struct berval **server_ctrls; + VERIFYSERVERCERT *cert_callback; +}; + +#define CTX(ld) (((struct private_data *)ld->Reserved3)->ctx) +#define SERVER_CTRLS(ld) (((struct private_data *)ld->Reserved3)->server_ctrls) +#define CERT_CALLBACK(ld) (((struct private_data *)ld->Reserved3)->cert_callback) #define MSG(entry) (entry->Request) #define BER(ber) ((BerElement *)((ber)->opaque)) @@ -423,6 +434,7 @@ ULONG CDECL ldap_compare_ext_sW( LDAP *, WCHAR *, WCHAR *, WCHAR *, struct WLDAP LDAPControlW ** ); ULONG CDECL ldap_compare_sA( LDAP *, char *, char *, char * ); ULONG CDECL ldap_compare_sW( LDAP *, WCHAR *, WCHAR *, WCHAR * ); +ULONG CDECL WLDAP32_ldap_connect( LDAP *, struct l_timeval * ); ULONG CDECL ldap_create_sort_controlA( LDAP *, LDAPSortKeyA **, UCHAR, LDAPControlA ** ); ULONG CDECL ldap_create_sort_controlW( LDAP *, LDAPSortKeyW **, UCHAR, LDAPControlW ** ); int CDECL ldap_create_vlv_controlA( LDAP *, WLDAP32_LDAPVLVInfo *, UCHAR, LDAPControlA ** ); @@ -540,6 +552,7 @@ struct WLDAP32_berval ** CDECL ldap_get_values_lenA( LDAP *, LDAPMessage *, struct WLDAP32_berval ** CDECL ldap_get_values_lenW( LDAP *, LDAPMessage *, WCHAR * ) __WINE_DEALLOC(WLDAP32_ldap_value_free_len); +BOOLEAN check_certificate( LDAP *ld ) DECLSPEC_HIDDEN; ULONG map_error( int ) DECLSPEC_HIDDEN; static inline char *strWtoU( const WCHAR *str ) diff --git a/include/winldap.h b/include/winldap.h index 825d3f63b1e..9e91d0e653a 100644 --- a/include/winldap.h +++ b/include/winldap.h @@ -391,6 +391,8 @@ typedef struct ldap_apifeature_infoW DECL_WINELIB_TYPE_AW(LDAPAPIFeatureInfo) +typedef BOOLEAN (CDECL VERIFYSERVERCERT)(LDAP*,const CERT_CONTEXT**); + #ifdef __cplusplus extern "C" { diff --git a/libs/ldap/libldap/tls_w.c b/libs/ldap/libldap/tls_w.c index bc64b9f62e5..c798d4249c0 100644 --- a/libs/ldap/libldap/tls_w.c +++ b/libs/ldap/libldap/tls_w.c @@ -46,8 +46,8 @@ typedef struct tlsw_ctx { } tlsw_ctx; typedef struct tlsw_session { + CtxtHandle ctxt_handle; /* ctxt_handle must be the first field */ CredHandle cred_handle; - CtxtHandle ctxt_handle; Sockbuf_IO_Desc *sbiod; struct berval peer_der_dn; } tlsw_session; -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/2533
Hans Leidekker (@hans) commented about dlls/wldap32/add.c:
TRACE( "(%p, %s, %p, %p, %p, %p)\n", ld, debugstr_w(dn), attrs, serverctrls, clientctrls, message );
if (!ld || !message) return WLDAP32_LDAP_PARAM_ERROR; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret;
'ret' is initialized at the top in order to return the right error on allocation failure. I would move it right before parameter conversion. Applies to many other functions as well. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/2533#note_28408
Hans Leidekker (@hans) commented about dlls/wldap32/control.c:
if (!ld || !control) return ~0u;
if (info && !(infoU = vlvinfoWtoU( info ))) return WLDAP32_LDAP_NO_MEMORY; + if ((ret = WLDAP32_ldap_connect( ld, NULL ))) return ret;
This can leak infoU on error. You can just move the call before the conversion. You missed ldap_create_sort_controlW() in this file. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/2533#note_28409
Hans Leidekker (@hans) commented about dlls/wldap32/winldap_private.h:
struct WLDAP32_berval ** CDECL ldap_get_values_lenW( LDAP *, LDAPMessage *, WCHAR * ) __WINE_DEALLOC(WLDAP32_ldap_value_free_len);
+BOOLEAN check_certificate( LDAP *ld ) DECLSPEC_HIDDEN; This is no longer needed.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/2533#note_28410
participants (3)
-
Alex Henrie -
Alex Henrie (＠alexhenrie)
-
Hans Leidekker (＠hans)