[Bug 60433] New: crypt32: SSL chain policy rejects certificates with an iPAddress subject alternative name
http://bugs.winehq.org/show_bug.cgi?id=60433 Bug ID: 60433 Summary: crypt32: SSL chain policy rejects certificates with an iPAddress subject alternative name Product: Wine Version: 11.0 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: crypt32 Assignee: wine-bugs@list.winehq.org Reporter: dhane1000@yahoo.com Target Milestone: --- Distribution: --- CertVerifyCertificateChainPolicy with CERT_CHAIN_POLICY_SSL fails with CERT_E_CN_NO_MATCH when the server name is an IP address and the certificate lists that address as an iPAddress subject alternative name. Windows accepts these certificates. Public CAs now issue such certificates, for example Let's Encrypt IP address certificates, and public services use them (https://1.1.1.1/). Steps to reproduce: 1. In a .NET Framework 4.8 program, make an HTTPS request to https://1.1.1.1/ (HttpWebRequest, with a ServerCertificateValidationCallback that prints the SslPolicyErrors). 2. Run it in Wine. Result in Wine: SslPolicyErrors = RemoteCertificateNameMismatch Result on Windows: SslPolicyErrors = None The chain itself is valid. A certificate for a DNS name, such as https://letsencrypt.org/, works in the same program. Cause: match_dns_to_subject_alt_name() in dlls/crypt32/chain.c only compares CERT_ALT_NAME_DNS_NAME entries. It skips CERT_ALT_NAME_IP_ADDRESS entries, so an IP address server name never matches. The subject DN fallback does not help, because these certificates have an empty subject. The code is the same in current master (wine-11.19). Expected behaviour: If the server name parses as an IPv4 or IPv6 address, compare its binary form with the iPAddress entries (4 or 16 bytes). Tested with: - wine-11.0 (Staging), Fedora 44 - Proton-CachyOS 11.0, GE-Proton 11, DW-Proton All fail the same way. Real application affected: the RO3 Asia game client logs in to a server by IP address with a Let's Encrypt IP certificate, and the login fails in Wine. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 --- Comment #1 from Dhaniele Joseph Demontano <dhane1000@yahoo.com> --- Additional information: adding iPAddress matching to match_dns_to_subject_alt_name() fixes the issue in a local test. Expired and wrong-host certificates are still rejected. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 --- Comment #2 from Ken Sharp <imwellcushtymelike@gmail.com> --- Please upgrade Wine and try again. https://gitlab.winehq.org/wine/wine/-/wikis/Download Can RO3 be downloaded without registration? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 --- Comment #3 from Dhaniele Joseph Demontano <dhane1000@yahoo.com> --- I tested again with wine-11.19. The bug is still there. What I did: I got the certificate from https://1.1.1.1/ and checked it with CertVerifyCertificateChainPolicy (CERT_CHAIN_POLICY_SSL, server name "1.1.1.1"). Results on wine-11.19: 1.1.1.1 fails with CERT_E_CN_NO_MATCH (0x800b010f) letsencrypt.org works wrong.host.badssl.com fails with CERT_E_CN_NO_MATCH (correct) Windows accepts 1.1.1.1, because the certificate lists that IP address. The game needs an account and a 23 GB download, so it is hard to test. https://1.1.1.1/ shows the same bug without the game. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 --- Comment #4 from Ken Sharp <imwellcushtymelike@gmail.com> --- Is that when you use iexplore? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 Ken Sharp <imwellcushtymelike@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEW Ever confirmed|0 |1 --- Comment #5 from Ken Sharp <imwellcushtymelike@gmail.com> --- Never mind, I forgot I could test that! Confirming. iexplore reports that there is a problem with the certificate. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 Vishnunithyasoundhar S <svishnunithyasoundhar@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |svishnunithyasoundhar@gmail | |.com --- Comment #6 from Vishnunithyasoundhar S <svishnunithyasoundhar@gmail.com> --- Added a patch https://bugs.winehq.org/show_bug.cgi?id=60433 Tested with a self-contained crypt32 repro (IP SAN 1.1.1.1): matching IP verifies, wrong IP still rejected, DNS unaffected. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 --- Comment #7 from Vishnunithyasoundhar S <svishnunithyasoundhar@gmail.com> --- (In reply to Vishnunithyasoundhar S from comment #6)
Added a patch https://bugs.winehq.org/show_bug.cgi?id=60433
Tested with a self-contained crypt32 repro (IP SAN 1.1.1.1): matching IP verifies, wrong IP still rejected, DNS unaffected.
ok I realized i pasted the bug link instead of the MR. https://gitlab.winehq.org/wine/wine/-/merge_requests/12263 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 --- Comment #8 from Vishnunithyasoundhar S <svishnunithyasoundhar@gmail.com> --- (In reply to Dhaniele Joseph Demontano from comment #0)
Real application affected: the RO3 Asia game client logs in to a server by IP address with a Let's Encrypt IP certificate, and the login fails in Wine.
Hi Dhaniele Joseph Demontano Would you mind testing the patch with the mentioned app and see if it works? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 Dhaniele Joseph Demontano <dhane1000@yahoo.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #9 from Dhaniele Joseph Demontano <dhane1000@yahoo.com> --- Thanks, the patch works. I tested it with https://1.1.1.1/, which uses the same kind of certificate as the RO3 RR server. Bad certificates are still rejected. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 --- Comment #10 from Vishnunithyasoundhar S <svishnunithyasoundhar@gmail.com> --- (In reply to Dhaniele Joseph Demontano from comment #9)
Thanks, the patch works. I tested it with https://1.1.1.1/, which uses the same kind of certificate as the RO3 RR server. Bad certificates are still rejected.
Thanks for confirming :) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 --- Comment #11 from Vishnunithyasoundhar S <svishnunithyasoundhar@gmail.com> --- I don't think `RESOLVED FIXED` is the right status for this bug page. The MR https://gitlab.winehq.org/wine/wine/-/merge_requests/12263 is still in review. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 Nikolay Sivov <bunglehead@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- --- Comment #12 from Nikolay Sivov <bunglehead@gmail.com> --- (In reply to Vishnunithyasoundhar S from comment #11)
I don't think `RESOLVED FIXED` is the right status for this bug page. The MR https://gitlab.winehq.org/wine/wine/-/merge_requests/12263 is still in review.
Reopening. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60433 Hans Leidekker <hans@meelstraat.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|REOPENED |RESOLVED Fixed by SHA1| |563aa5f6fe225972fc92b79f764 | |15a674193dec5 --- Comment #13 from Hans Leidekker <hans@meelstraat.net> --- Fixed with 563aa5f6fe225972fc92b79f76415a674193dec5. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla