[PATCH 0/1] MR8894: crypt32: Accept PKCS12_ALWAYS_CNG_KSP flag and fall back to standard import.

[Christian Tinauer (＠christiantinauer)]

Some applications (including .NET Core) specify the PKCS12_ALWAYS_CNG_KSP flag when calling PFXImportCertStore. According to Microsoft's documentation, this flag indicates that the CNG key storage provider should always be used, but if it is not available the import will not fail.

Wine does not implement a CNG KSP, so instead of failing we simply ignore the flag and continue with the existing import path.  A WARN trace is printed for visibility.

Notably, .NET Core automatically adds PKCS12_ALWAYS_CNG_KSP when the ephemeral key storage flag (X509KeyStorageFlags.EphemeralKeySet) is used. Without support for this flag, certificate import fails in ASP.NET Core applications using Kestrel with ephemeral server certificates.

This improves compatibility with .NET and other applications expecting this flag to be accepted without error.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8894

[PATCH 1/1] crypt32: Accept PKCS12_ALWAYS_CNG_KSP flag and fall back to standard import.

[Christian Tinauer]

From: Christian Tinauer <christian.tinauer(a)gmail.com>

Some applications (including .NET Core) specify the PKCS12_ALWAYS_CNG_KSP flag when calling PFXImportCertStore. According to Microsoft's documentation, this flag indicates that the CNG key storage provider should always be used, but if it is not available the import will not fail.

Wine does not implement a CNG KSP, so instead of failing we simply ignore the flag and continue with the existing import path.  A WARN trace is printed for visibility.

Notably, .NET Core automatically adds PKCS12_ALWAYS_CNG_KSP when the ephemeral key storage flag (X509KeyStorageFlags.EphemeralKeySet) is used. Without support for this flag, certificate import fails in ASP.NET Core applications using Kestrel with ephemeral server certificates.

This improves compatibility with .NET and other applications expecting this flag to be accepted without error.
---
 dlls/crypt32/pfx.c            | 6 +++++-
 dlls/crypt32/tests/store.c    | 2 +-
 dlls/secur32/tests/schannel.c | 2 +-
 dlls/winhttp/tests/winhttp.c  | 2 +-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/dlls/crypt32/pfx.c b/dlls/crypt32/pfx.c
index 54eb7f25e1b..4d6cc7d5160 100644
--- a/dlls/crypt32/pfx.c
+++ b/dlls/crypt32/pfx.c
@@ -152,11 +152,15 @@ HCERTSTORE WINAPI PFXImportCertStore( CRYPT_DATA_BLOB *pfx, const WCHAR *passwor
         SetLastError( ERROR_INVALID_PARAMETER );
         return NULL;
     }
-    if (flags & ~(CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|CRYPT_MACHINE_KEYSET|PKCS12_NO_PERSIST_KEY))
+    if (flags & ~(CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|CRYPT_MACHINE_KEYSET|PKCS12_NO_PERSIST_KEY|PKCS12_ALWAYS_CNG_KSP))
     {
         FIXME( "flags %08lx not supported\n", flags );
         return NULL;
     }
+    if (flags & PKCS12_ALWAYS_CNG_KSP)
+    {
+        WARN( "flag PKCS12_ALWAYS_CNG_KSP ignored\n" );
+    }
     if (CRYPT32_CALL( open_cert_store, &open_params )) return NULL;
 
     prov = import_key( data, flags );
diff --git a/dlls/crypt32/tests/store.c b/dlls/crypt32/tests/store.c
index 3c0b6a166e1..7a3bdf3df0f 100644
--- a/dlls/crypt32/tests/store.c
+++ b/dlls/crypt32/tests/store.c
@@ -3312,7 +3312,7 @@ static void test_PFXImportCertStore(void)
 
     pfx.pbData = (BYTE *)pfxdata;
     pfx.cbData = sizeof(pfxdata);
-    store = PFXImportCertStore( &pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY );
+    store = PFXImportCertStore( &pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY|PKCS12_ALWAYS_CNG_KSP );
     ok( store != NULL, "got %lu\n", GetLastError() );
     count = countCertsInStore( store );
     ok( count == 1, "got %lu\n", count );
diff --git a/dlls/secur32/tests/schannel.c b/dlls/secur32/tests/schannel.c
index 2f693c6f871..f68db49da98 100644
--- a/dlls/secur32/tests/schannel.c
+++ b/dlls/secur32/tests/schannel.c
@@ -1395,7 +1395,7 @@ static void test_communication(void)
 
     pfx.pbData = (BYTE *)pfxdata;
     pfx.cbData = sizeof(pfxdata);
-    store = PFXImportCertStore(&pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY);
+    store = PFXImportCertStore(&pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY|PKCS12_ALWAYS_CNG_KSP);
     ok(store != NULL, "got %lu\n", GetLastError());
 
     cert = CertFindCertificateInStore(store, X509_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, NULL);
diff --git a/dlls/winhttp/tests/winhttp.c b/dlls/winhttp/tests/winhttp.c
index 77b75fb55d6..082295e9081 100644
--- a/dlls/winhttp/tests/winhttp.c
+++ b/dlls/winhttp/tests/winhttp.c
@@ -6190,7 +6190,7 @@ static void test_client_cert_authentication(void)
 
     pfx.pbData = (BYTE *)pfxdata;
     pfx.cbData = sizeof(pfxdata);
-    store = PFXImportCertStore( &pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY );
+    store = PFXImportCertStore( &pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY|PKCS12_ALWAYS_CNG_KSP );
     ok( store != NULL, "got %lu\n", GetLastError() );
 
     cert = CertFindCertificateInStore( store, X509_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, NULL );
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/8894

[Hans Leidekker (＠hans)]

Hans Leidekker (@hans) commented about dlls/crypt32/pfx.c:
> SetLastError( ERROR_INVALID_PARAMETER );
>          return NULL;
>      }
> -    if (flags & ~(CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|CRYPT_MACHINE_KEYSET|PKCS12_NO_PERSIST_KEY))
> +    if (flags & ~(CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|CRYPT_MACHINE_KEYSET|PKCS12_NO_PERSIST_KEY|PKCS12_ALWAYS_CNG_KSP))
>      {
>          FIXME( "flags %08lx not supported\n", flags );
>          return NULL;
>      }
> +    if (flags & PKCS12_ALWAYS_CNG_KSP)
> +    {
> +        WARN( "flag PKCS12_ALWAYS_CNG_KSP ignored\n" );
> +    }

That should be a FIXME.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8894#note_114745

[Hans Leidekker (＠hans)]

Hans Leidekker (@hans) commented about dlls/crypt32/tests/store.c:
> pfx.pbData = (BYTE *)pfxdata;
>      pfx.cbData = sizeof(pfxdata);
> -    store = PFXImportCertStore( &pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY );
> +    store = PFXImportCertStore( &pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY|PKCS12_ALWAYS_CNG_KSP );

Please add a test with these flags instead of modifying an existing test.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8894#note_114746

[Hans Leidekker (＠hans)]

Hans Leidekker (@hans) commented about dlls/winhttp/tests/winhttp.c:
> pfx.pbData = (BYTE *)pfxdata;
>      pfx.cbData = sizeof(pfxdata);
> -    store = PFXImportCertStore( &pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY );
> +    store = PFXImportCertStore( &pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY|PKCS12_ALWAYS_CNG_KSP );

Or here.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8894#note_114748

[Hans Leidekker (＠hans)]

Hans Leidekker (@hans) commented about dlls/secur32/tests/schannel.c:
> pfx.pbData = (BYTE *)pfxdata;
>      pfx.cbData = sizeof(pfxdata);
> -    store = PFXImportCertStore(&pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY);
> +    store = PFXImportCertStore(&pfx, NULL, CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY|PKCS12_ALWAYS_CNG_KSP);

There's no need to add the flag in this test.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8894#note_114747

[Hans Leidekker (＠hans)]

Thanks for the patch. I have a few comments.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8894#note_114749