August 2007 - Wine-Commits - list.winehq.org

Stefan Dösinger : wined3d: Supply texture coords even if no texture is bound and pshaders are used.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 282696b4f62b7d36d243692065f1db0a901ed829 URL: http://source.winehq.org/git/wine.git/?a=commit;h=282696b4f62b7d36d24369206… Author: Stefan Dösinger <stefan(a)codeweavers.com> Date: Wed Aug 29 21:59:49 2007 +0200 wined3d: Supply texture coords even if no texture is bound and pshaders are used. --- dlls/wined3d/drawprim.c | 11 ++++++++--- 1 files changed, 8 insertions(+), 3 deletions(-) diff --git a/dlls/wined3d/drawprim.c b/dlls/wined3d/drawprim.c index 679d9d9..dcfe20c 100644 --- a/dlls/wined3d/drawprim.c +++ b/dlls/wined3d/drawprim.c @@ -301,6 +301,7 @@ static void drawStridedSlow(IWineD3DDevice *iface, WineDirect3DVertexStridedData IWineD3DDeviceImpl *This = (IWineD3DDeviceImpl *)iface; UINT *streamOffset = This->stateBlock->streamOffset; long SkipnStrides = startVertex + This->stateBlock->loadBaseVertexIndex; + BOOL pixelShader = use_ps(This); BYTE *texCoords[WINED3DDP_MAXTEXCOORD]; BYTE *diffuse = NULL, *specular = NULL, *normal = NULL, *position = NULL; @@ -397,9 +398,10 @@ static void drawStridedSlow(IWineD3DDevice *iface, WineDirect3DVertexStridedData } /* Query tex coords */ - if (This->stateBlock->textures[textureNo] != NULL) { + if (This->stateBlock->textures[textureNo] != NULL || pixelShader) { int coordIdx = This->stateBlock->textureState[textureNo][WINED3DTSS_TEXCOORDINDEX]; + int texture_idx = This->texUnitMap[textureNo]; float *ptrToCoords = NULL; float s = 0.0, t = 0.0, r = 0.0, q = 0.0; @@ -414,10 +416,13 @@ static void drawStridedSlow(IWineD3DDevice *iface, WineDirect3DVertexStridedData ptrToCoords = (float *)(texCoords[coordIdx] + (SkipnStrides * sd->u.s.texCoords[coordIdx].dwStride)); if (texCoords[coordIdx] == NULL) { TRACE("tex: %d - Skipping tex coords, as no data supplied\n", textureNo); - glTexCoord4f(0, 0, 0, 1); + if (GL_SUPPORT(ARB_MULTITEXTURE)) { + GL_EXTCALL(glMultiTexCoord4fARB(GL_TEXTURE0_ARB + texture_idx, 0, 0, 0, 1)); + } else { + glTexCoord4f(0, 0, 0, 1); + } continue; } else { - int texture_idx = This->texUnitMap[textureNo]; int coordsToUse = sd->u.s.texCoords[coordIdx].dwType + 1; /* 0 == WINED3DDECLTYPE_FLOAT1 etc */ if (texture_idx == -1) continue;

1 0

Rob Shearman : shell32: Don' t use the working directory passed into ShellExecute* functions if it isn' t valid.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 94074ad31eed9c5d8bcbc5155bea124d39f85f2f URL: http://source.winehq.org/git/wine.git/?a=commit;h=94074ad31eed9c5d8bcbc5155… Author: Rob Shearman <rob(a)codeweavers.com> Date: Fri Aug 31 15:41:36 2007 +0100 shell32: Don't use the working directory passed into ShellExecute* functions if it isn't valid. --- dlls/shell32/shlexec.c | 20 +++++++++++++++----- 1 files changed, 15 insertions(+), 5 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index 3e2f623..69608df 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -306,14 +306,25 @@ static UINT_PTR SHELL_ExecuteW(const WCHAR *lpCmd, WCHAR *env, BOOL shWait, UINT gcdret = 0; WCHAR curdir[MAX_PATH]; DWORD dwCreationFlags; + const WCHAR *lpDirectory = NULL; TRACE("Execute %s from directory %s\n", debugstr_w(lpCmd), debugstr_w(psei->lpDirectory)); + + /* make sure we don't fail the CreateProcess if the calling app passes in + * a bad working directory */ + if (psei->lpDirectory && psei->lpDirectory[0]) + { + DWORD attr = GetFileAttributesW(psei->lpDirectory); + if (attr != INVALID_FILE_ATTRIBUTES && attr & FILE_ATTRIBUTE_DIRECTORY) + lpDirectory = psei->lpDirectory; + } + /* ShellExecute specifies the command from psei->lpDirectory * if present. Not from the current dir as CreateProcess does */ - if( psei->lpDirectory && psei->lpDirectory[0] ) + if( lpDirectory ) if( ( gcdret = GetCurrentDirectoryW( MAX_PATH, curdir))) - if( !SetCurrentDirectoryW( psei->lpDirectory)) - ERR("cannot set directory %s\n", debugstr_w(psei->lpDirectory)); + if( !SetCurrentDirectoryW( lpDirectory)) + ERR("cannot set directory %s\n", debugstr_w(lpDirectory)); ZeroMemory(&startup,sizeof(STARTUPINFOW)); startup.cb = sizeof(STARTUPINFOW); startup.dwFlags = STARTF_USESHOWWINDOW; @@ -322,8 +333,7 @@ static UINT_PTR SHELL_ExecuteW(const WCHAR *lpCmd, WCHAR *env, BOOL shWait, if (psei->fMask & SEE_MASK_NO_CONSOLE) dwCreationFlags |= CREATE_NEW_CONSOLE; if (CreateProcessW(NULL, (LPWSTR)lpCmd, NULL, NULL, FALSE, dwCreationFlags, env, - psei->lpDirectory && *psei->lpDirectory ? psei->lpDirectory : NULL, - &startup, &info)) + lpDirectory, &startup, &info)) { /* Give 30 seconds to the app to come up, if desired. Probably only needed when starting app immediately before making a DDE connection. */

1 0

Juan Lang : crypt32: Check path length constraint on a chain.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 6c9b788fb89e4b4b41b357981e169397b8216266 URL: http://source.winehq.org/git/wine.git/?a=commit;h=6c9b788fb89e4b4b41b357981… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 18:00:19 2007 -0700 crypt32: Check path length constraint on a chain. --- dlls/crypt32/chain.c | 106 ++++++++++++++++++++++++++++++++++++-------- dlls/crypt32/tests/chain.c | 2 +- 2 files changed, 88 insertions(+), 20 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index d15f551..7efe0c7 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -366,12 +366,20 @@ static BOOL CRYPT_CheckRootCert(HCERTCHAINENGINE hRoot, return ret; } -static BOOL CRYPT_CanCertBeCA(PCCERT_CONTEXT cert, BOOL defaultIfNotSpecified) +/* Decodes a cert's basic constraints extension (either szOID_BASIC_CONSTRAINTS + * or szOID_BASIC_CONSTRAINTS2, whichever is present) into a + * CERT_BASIC_CONSTRAINTS2_INFO. If it neither extension is present, sets + * constraints->fCA to defaultIfNotSpecified. + * Returns FALSE if the extension is present but couldn't be decoded. + */ +static BOOL CRYPT_DecodeBasicConstraints(PCCERT_CONTEXT cert, + CERT_BASIC_CONSTRAINTS2_INFO *constraints, BOOL defaultIfNotSpecified) { - BOOL ret; + BOOL ret = TRUE; PCERT_EXTENSION ext = CertFindExtension(szOID_BASIC_CONSTRAINTS, cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension); + constraints->fPathLenConstraint = FALSE; if (ext) { CERT_BASIC_CONSTRAINTS_INFO *info; @@ -383,7 +391,8 @@ static BOOL CRYPT_CanCertBeCA(PCCERT_CONTEXT cert, BOOL defaultIfNotSpecified) if (ret) { if (info->SubjectType.cbData == 1) - ret = info->SubjectType.pbData[0] & CERT_CA_SUBJECT_FLAG; + constraints->fCA = + info->SubjectType.pbData[0] & CERT_CA_SUBJECT_FLAG; LocalFree(info); } } @@ -393,32 +402,80 @@ static BOOL CRYPT_CanCertBeCA(PCCERT_CONTEXT cert, BOOL defaultIfNotSpecified) cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension); if (ext) { - CERT_BASIC_CONSTRAINTS2_INFO *info; - DWORD size = 0; + DWORD size = sizeof(CERT_BASIC_CONSTRAINTS2_INFO); ret = CryptDecodeObjectEx(X509_ASN_ENCODING, szOID_BASIC_CONSTRAINTS2, ext->Value.pbData, ext->Value.cbData, - CRYPT_DECODE_ALLOC_FLAG, NULL, (LPBYTE)&info, &size); - if (ret) - { - ret = info->fCA; - LocalFree(info); - } + 0, NULL, constraints, &size); } else - ret = defaultIfNotSpecified; + constraints->fCA = defaultIfNotSpecified; } return ret; } +/* Checks element's basic constraints to see if it can act as a CA, with + * remainingCAs CAs left in this chain. Updates chainConstraints with the + * element's constraints, if: + * 1. chainConstraints doesn't have a path length constraint, or + * 2. element's path length constraint is smaller than chainConstraints's + * Sets *pathLengthConstraintViolated to TRUE if a path length violation + * occurs. + * Returns TRUE if the element can be a CA, and the length of the remaining + * chain is valid. + */ +static BOOL CRYPT_CheckBasicConstraintsForCA(PCCERT_CONTEXT cert, + CERT_BASIC_CONSTRAINTS2_INFO *chainConstraints, DWORD remainingCAs, + BOOL *pathLengthConstraintViolated) +{ + BOOL validBasicConstraints; + CERT_BASIC_CONSTRAINTS2_INFO constraints; + + if ((validBasicConstraints = CRYPT_DecodeBasicConstraints(cert, + &constraints, TRUE))) + { + if (!constraints.fCA) + { + TRACE("chain element %d can't be a CA\n", remainingCAs + 1); + validBasicConstraints = FALSE; + } + else if (constraints.fPathLenConstraint) + { + /* If the element has path length constraints, they apply to the + * entire remaining chain. + */ + if (!chainConstraints->fPathLenConstraint || + constraints.dwPathLenConstraint < + chainConstraints->dwPathLenConstraint) + { + TRACE("setting path length constraint to %d\n", + chainConstraints->dwPathLenConstraint); + chainConstraints->fPathLenConstraint = TRUE; + chainConstraints->dwPathLenConstraint = + constraints.dwPathLenConstraint; + } + } + } + if (chainConstraints->fPathLenConstraint && + remainingCAs > chainConstraints->dwPathLenConstraint) + { + TRACE("remaining CAs %d exceed max path length %d\n", remainingCAs, + chainConstraints->dwPathLenConstraint); + validBasicConstraints = FALSE; + *pathLengthConstraintViolated = TRUE; + } + return validBasicConstraints; +} + static BOOL CRYPT_CheckSimpleChain(PCertificateChainEngine engine, PCERT_SIMPLE_CHAIN chain, LPFILETIME time) { PCERT_CHAIN_ELEMENT rootElement = chain->rgpElement[chain->cElement - 1]; - DWORD i; - BOOL ret = TRUE; + int i; + BOOL ret = TRUE, pathLengthConstraintViolated = FALSE; + CERT_BASIC_CONSTRAINTS2_INFO constraints = { TRUE, FALSE, 0 }; - for (i = 0; i < chain->cElement; i++) + for (i = chain->cElement - 1; i >= 0; i--) { if (CertVerifyTimeValidity(time, chain->rgpElement[i]->pCertContext->pCertInfo) != 0) @@ -426,12 +483,23 @@ static BOOL CRYPT_CheckSimpleChain(PCertificateChainEngine engine, CERT_TRUST_IS_NOT_TIME_VALID; if (i != 0) { - BOOL ca; - - ca = CRYPT_CanCertBeCA(chain->rgpElement[i]->pCertContext, TRUE); - if (!ca) + /* Once a path length constraint has been violated, every remaining + * CA cert's basic constraints is considered invalid. + */ + if (pathLengthConstraintViolated) chain->rgpElement[i]->TrustStatus.dwErrorStatus |= CERT_TRUST_INVALID_BASIC_CONSTRAINTS; + else if (!CRYPT_CheckBasicConstraintsForCA( + chain->rgpElement[i]->pCertContext, &constraints, i - 1, + &pathLengthConstraintViolated)) + chain->rgpElement[i]->TrustStatus.dwErrorStatus |= + CERT_TRUST_INVALID_BASIC_CONSTRAINTS; + else if (constraints.fPathLenConstraint && + constraints.dwPathLenConstraint) + { + /* This one's valid - decrement max length */ + constraints.dwPathLenConstraint--; + } } /* FIXME: check valid usages and name constraints */ CRYPT_CombineTrustStatus(&chain->TrustStatus, diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 849310e..818491f 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1508,7 +1508,7 @@ static ChainCheck chainCheck[] = { { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 }, 1, simpleStatus4 }, - TODO_ERROR | TODO_INFO }, + TODO_INFO }, { { sizeof(chain5) / sizeof(chain5[0]), chain5 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT |

1 0

Juan Lang : crypt32: Set error status on issued certificate, not on issuer.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 14b0df1fef5258ab6bb84acde166389cdc7947e5 URL: http://source.winehq.org/git/wine.git/?a=commit;h=14b0df1fef5258ab6bb84acde… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:59:43 2007 -0700 crypt32: Set error status on issued certificate, not on issuer. --- dlls/crypt32/chain.c | 22 +++++++++++++++------- dlls/crypt32/tests/chain.c | 2 +- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 5a2b8ef..d15f551 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -287,17 +287,25 @@ static BOOL CRYPT_AddCertToSimpleChain(PCertificateChainEngine engine, (chain->cElement + 1) * sizeof(PCERT_CHAIN_ELEMENT)); if (chain->rgpElement) { + chain->rgpElement[chain->cElement++] = element; memset(element, 0, sizeof(CERT_CHAIN_ELEMENT)); element->cbSize = sizeof(CERT_CHAIN_ELEMENT); element->pCertContext = CertDuplicateCertificateContext(cert); - if (dwFlags & CERT_STORE_REVOCATION_FLAG && - !(dwFlags & CERT_STORE_NO_CRL_FLAG)) - element->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_REVOKED; - if (dwFlags & CERT_STORE_SIGNATURE_FLAG) - element->TrustStatus.dwErrorStatus |= - CERT_TRUST_IS_NOT_SIGNATURE_VALID; + /* Flags, if set, refer to the element this cert issued, so set + * the preceding element's error accordingly + */ + if (chain->cElement > 1) + { + if (dwFlags & CERT_STORE_REVOCATION_FLAG && + !(dwFlags & CERT_STORE_NO_CRL_FLAG)) + chain->rgpElement[chain->cElement - 2]->TrustStatus. + dwErrorStatus |= CERT_TRUST_IS_REVOKED; + if (dwFlags & CERT_STORE_SIGNATURE_FLAG) + chain->rgpElement[chain->cElement - 2]->TrustStatus. + dwErrorStatus |= + CERT_TRUST_IS_NOT_SIGNATURE_VALID; + } /* FIXME: initialize the rest of element */ - chain->rgpElement[chain->cElement++] = element; if (chain->cElement % engine->CycleDetectionModulus) CRYPT_CheckSimpleChainForCycles(chain); CRYPT_CombineTrustStatus(&chain->TrustStatus, diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index a7e1928..849310e 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1491,7 +1491,7 @@ static ChainCheck chainCheck[] = { { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_SIGNATURE_VALID | CERT_TRUST_IS_NOT_TIME_VALID, 0 }, 1, simpleStatus1 }, - TODO_ERROR | TODO_INFO }, + TODO_INFO }, { { sizeof(chain2) / sizeof(chain2[0]), chain2 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 },

1 0

Juan Lang : crypt32: Check whether each signing certificate can be a CA.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 1ce46d5e4a38b9be67b442747ab6952a0bf44a88 URL: http://source.winehq.org/git/wine.git/?a=commit;h=1ce46d5e4a38b9be67b442747… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:59:13 2007 -0700 crypt32: Check whether each signing certificate can be a CA. --- dlls/crypt32/chain.c | 54 ++++++++++++++++++++++++++++++++++++++++++++ dlls/crypt32/tests/chain.c | 2 +- 2 files changed, 55 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 4372a8d..5a2b8ef 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -358,6 +358,51 @@ static BOOL CRYPT_CheckRootCert(HCERTCHAINENGINE hRoot, return ret; } +static BOOL CRYPT_CanCertBeCA(PCCERT_CONTEXT cert, BOOL defaultIfNotSpecified) +{ + BOOL ret; + PCERT_EXTENSION ext = CertFindExtension(szOID_BASIC_CONSTRAINTS, + cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension); + + if (ext) + { + CERT_BASIC_CONSTRAINTS_INFO *info; + DWORD size = 0; + + ret = CryptDecodeObjectEx(X509_ASN_ENCODING, szOID_BASIC_CONSTRAINTS, + ext->Value.pbData, ext->Value.cbData, CRYPT_DECODE_ALLOC_FLAG, + NULL, (LPBYTE)&info, &size); + if (ret) + { + if (info->SubjectType.cbData == 1) + ret = info->SubjectType.pbData[0] & CERT_CA_SUBJECT_FLAG; + LocalFree(info); + } + } + else + { + ext = CertFindExtension(szOID_BASIC_CONSTRAINTS2, + cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension); + if (ext) + { + CERT_BASIC_CONSTRAINTS2_INFO *info; + DWORD size = 0; + + ret = CryptDecodeObjectEx(X509_ASN_ENCODING, + szOID_BASIC_CONSTRAINTS2, ext->Value.pbData, ext->Value.cbData, + CRYPT_DECODE_ALLOC_FLAG, NULL, (LPBYTE)&info, &size); + if (ret) + { + ret = info->fCA; + LocalFree(info); + } + } + else + ret = defaultIfNotSpecified; + } + return ret; +} + static BOOL CRYPT_CheckSimpleChain(PCertificateChainEngine engine, PCERT_SIMPLE_CHAIN chain, LPFILETIME time) { @@ -371,6 +416,15 @@ static BOOL CRYPT_CheckSimpleChain(PCertificateChainEngine engine, chain->rgpElement[i]->pCertContext->pCertInfo) != 0) chain->rgpElement[i]->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_NOT_TIME_VALID; + if (i != 0) + { + BOOL ca; + + ca = CRYPT_CanCertBeCA(chain->rgpElement[i]->pCertContext, TRUE); + if (!ca) + chain->rgpElement[i]->TrustStatus.dwErrorStatus |= + CERT_TRUST_INVALID_BASIC_CONSTRAINTS; + } /* FIXME: check valid usages and name constraints */ CRYPT_CombineTrustStatus(&chain->TrustStatus, &chain->rgpElement[i]->TrustStatus); diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 507ab24..a7e1928 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1502,7 +1502,7 @@ static ChainCheck chainCheck[] = { { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 }, 1, simpleStatus3 }, - TODO_ERROR | TODO_INFO }, + TODO_INFO }, { { sizeof(chain4) / sizeof(chain4[0]), chain4 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT |

1 0

Juan Lang : crypt32: Check time of each element in chain against requested time.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 51948b0c980e6f7a9e2725958c16f8c712bfcc69 URL: http://source.winehq.org/git/wine.git/?a=commit;h=51948b0c980e6f7a9e2725958… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:58:36 2007 -0700 crypt32: Check time of each element in chain against requested time. --- dlls/crypt32/chain.c | 69 ++++++++++++++++++++++++++++--------------- dlls/crypt32/tests/chain.c | 10 +++--- 2 files changed, 50 insertions(+), 29 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 58f3806..4372a8d 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -296,7 +296,6 @@ static BOOL CRYPT_AddCertToSimpleChain(PCertificateChainEngine engine, if (dwFlags & CERT_STORE_SIGNATURE_FLAG) element->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_NOT_SIGNATURE_VALID; - /* FIXME: check valid usages and name constraints */ /* FIXME: initialize the rest of element */ chain->rgpElement[chain->cElement++] = element; if (chain->cElement % engine->CycleDetectionModulus) @@ -341,6 +340,50 @@ static void CRYPT_CheckTrustedStatus(HCERTSTORE hRoot, CertFreeCertificateContext(trustedRoot); } +static BOOL CRYPT_CheckRootCert(HCERTCHAINENGINE hRoot, + PCERT_CHAIN_ELEMENT rootElement) +{ + PCCERT_CONTEXT root = rootElement->pCertContext; + BOOL ret; + + if (!(ret = CryptVerifyCertificateSignatureEx(0, root->dwCertEncodingType, + CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, (void *)root, + CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)root, 0, NULL))) + { + TRACE("Last certificate's signature is invalid\n"); + rootElement->TrustStatus.dwErrorStatus |= + CERT_TRUST_IS_NOT_SIGNATURE_VALID; + } + CRYPT_CheckTrustedStatus(hRoot, rootElement); + return ret; +} + +static BOOL CRYPT_CheckSimpleChain(PCertificateChainEngine engine, + PCERT_SIMPLE_CHAIN chain, LPFILETIME time) +{ + PCERT_CHAIN_ELEMENT rootElement = chain->rgpElement[chain->cElement - 1]; + DWORD i; + BOOL ret = TRUE; + + for (i = 0; i < chain->cElement; i++) + { + if (CertVerifyTimeValidity(time, + chain->rgpElement[i]->pCertContext->pCertInfo) != 0) + chain->rgpElement[i]->TrustStatus.dwErrorStatus |= + CERT_TRUST_IS_NOT_TIME_VALID; + /* FIXME: check valid usages and name constraints */ + CRYPT_CombineTrustStatus(&chain->TrustStatus, + &chain->rgpElement[i]->TrustStatus); + } + if (CRYPT_IsCertificateSelfSigned(rootElement->pCertContext)) + { + rootElement->TrustStatus.dwInfoStatus |= CERT_TRUST_IS_SELF_SIGNED; + ret = CRYPT_CheckRootCert(engine->hRoot, rootElement); + } + CRYPT_CombineTrustStatus(&chain->TrustStatus, &rootElement->TrustStatus); + return ret; +} + static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, PCCERT_CONTEXT cert, LPFILETIME pTime, HCERTSTORE hAdditionalStore, PCERT_SIMPLE_CHAIN *ppChain) @@ -384,29 +427,7 @@ static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, } } if (ret) - { - PCERT_CHAIN_ELEMENT rootElement = - chain->rgpElement[chain->cElement - 1]; - PCCERT_CONTEXT root = rootElement->pCertContext; - - if (CRYPT_IsCertificateSelfSigned(root)) - { - rootElement->TrustStatus.dwInfoStatus |= - CERT_TRUST_IS_SELF_SIGNED; - if (!(ret = CryptVerifyCertificateSignatureEx(0, - root->dwCertEncodingType, CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT, - (void *)root, CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT, (void *)root, - 0, NULL))) - { - TRACE("Last certificate's signature is invalid\n"); - rootElement->TrustStatus.dwErrorStatus |= - CERT_TRUST_IS_NOT_SIGNATURE_VALID; - } - CRYPT_CheckTrustedStatus(engine->hRoot, rootElement); - } - CRYPT_CombineTrustStatus(&chain->TrustStatus, - &rootElement->TrustStatus); - } + ret = CRYPT_CheckSimpleChain(engine, chain, pTime); if (!ret) { CRYPT_FreeSimpleChain(chain); diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 565cf50..507ab24 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1485,7 +1485,7 @@ static ChainCheck chainCheck[] = { { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 }, 1, simpleStatus0 }, - TODO_ERROR | TODO_INFO }, + TODO_INFO }, { { sizeof(chain1) / sizeof(chain1[0]), chain1 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_SIGNATURE_VALID | @@ -1496,7 +1496,7 @@ static ChainCheck chainCheck[] = { { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 }, 1, simpleStatus2 }, - TODO_ERROR | TODO_INFO }, + TODO_INFO }, { { sizeof(chain3) / sizeof(chain3[0]), chain3 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT | @@ -1518,11 +1518,11 @@ static ChainCheck chainCheck[] = { { { sizeof(chain6) / sizeof(chain6[0]), chain6 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus6 }, - TODO_ERROR | TODO_INFO }, + TODO_INFO }, { { sizeof(chain7) / sizeof(chain7[0]), chain7 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus7 }, - TODO_ERROR | TODO_INFO }, + TODO_INFO }, { { sizeof(chain8) / sizeof(chain8[0]), chain8 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT | @@ -1547,7 +1547,7 @@ static ChainCheck chainCheck[] = { { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, selfSignedSimpleStatus }, - TODO_ERROR | TODO_INFO }, + TODO_INFO }, /* The iTunes chain may or may not have its root trusted, so ignore the * error */

1 0

Juan Lang : crypt32: Time validity nesting doesn't appear to be checked, so don't check it.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: d06a24517f63caab722a180bedf920d1602cff29 URL: http://source.winehq.org/git/wine.git/?a=commit;h=d06a24517f63caab722a180be… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:57:48 2007 -0700 crypt32: Time validity nesting doesn't appear to be checked, so don't check it. --- dlls/crypt32/chain.c | 19 +------------------ 1 files changed, 1 insertions(+), 18 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index f0f3e56..58f3806 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -257,8 +257,7 @@ static inline BOOL CRYPT_IsSimpleChainCyclic(PCERT_SIMPLE_CHAIN chain) static PCCERT_CONTEXT CRYPT_GetIssuerFromStore(HCERTSTORE store, PCCERT_CONTEXT cert, PDWORD pdwFlags) { - *pdwFlags = CERT_STORE_REVOCATION_FLAG | CERT_STORE_SIGNATURE_FLAG | - CERT_STORE_TIME_VALIDITY_FLAG; + *pdwFlags = CERT_STORE_REVOCATION_FLAG | CERT_STORE_SIGNATURE_FLAG; return CertGetIssuerCertificateFromStore(store, cert, NULL, pdwFlags); } @@ -297,22 +296,6 @@ static BOOL CRYPT_AddCertToSimpleChain(PCertificateChainEngine engine, if (dwFlags & CERT_STORE_SIGNATURE_FLAG) element->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_NOT_SIGNATURE_VALID; - if (dwFlags & CERT_STORE_TIME_VALIDITY_FLAG) - element->TrustStatus.dwErrorStatus |= - CERT_TRUST_IS_NOT_TIME_VALID; - if (chain->cElement) - { - PCERT_CHAIN_ELEMENT prevElement = - chain->rgpElement[chain->cElement - 1]; - - /* This cert is the issuer of the previous one in the chain, so - * retroactively check the previous one's time validity nesting. - */ - if (!CertVerifyValidityNesting( - prevElement->pCertContext->pCertInfo, cert->pCertInfo)) - prevElement->TrustStatus.dwErrorStatus |= - CERT_TRUST_IS_NOT_TIME_NESTED; - } /* FIXME: check valid usages and name constraints */ /* FIXME: initialize the rest of element */ chain->rgpElement[chain->cElement++] = element;

1 0

Juan Lang : crypt32: Halt chain creation when a cycle is detected.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: b8b787a81039c4a62c04540d2529593cf3f5fa87 URL: http://source.winehq.org/git/wine.git/?a=commit;h=b8b787a81039c4a62c04540d2… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:54:58 2007 -0700 crypt32: Halt chain creation when a cycle is detected. --- dlls/crypt32/chain.c | 62 ++++++++++++++++++++++++++++++++++--------- dlls/crypt32/tests/chain.c | 5 +-- 2 files changed, 51 insertions(+), 16 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index b8ce476..1372ad8 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -212,6 +212,45 @@ static inline BOOL CRYPT_IsCertificateSelfSigned(PCCERT_CONTEXT cert) &cert->pCertInfo->Subject, &cert->pCertInfo->Issuer); } +static void CRYPT_FreeChainElement(PCERT_CHAIN_ELEMENT element) +{ + CertFreeCertificateContext(element->pCertContext); + CryptMemFree(element); +} + +static void CRYPT_CheckSimpleChainForCycles(PCERT_SIMPLE_CHAIN chain) +{ + DWORD i, j, cyclicCertIndex = 0; + + /* O(n^2) - I don't think there's a faster way */ + for (i = 0; !cyclicCertIndex && i < chain->cElement; i++) + for (j = i + 1; !cyclicCertIndex && j < chain->cElement; j++) + if (CertCompareCertificate(X509_ASN_ENCODING, + chain->rgpElement[i]->pCertContext->pCertInfo, + chain->rgpElement[j]->pCertContext->pCertInfo)) + cyclicCertIndex = j; + if (cyclicCertIndex) + { + chain->rgpElement[cyclicCertIndex]->TrustStatus.dwErrorStatus + |= CERT_TRUST_IS_CYCLIC; + /* Release remaining certs */ + for (i = cyclicCertIndex + 1; i < chain->cElement; i++) + CRYPT_FreeChainElement(chain->rgpElement[i]); + /* Truncate chain */ + chain->cElement = cyclicCertIndex + 1; + } +} + +/* Checks whether the chain is cyclic by examining the last element's status */ +static inline BOOL CRYPT_IsSimpleChainCyclic(PCERT_SIMPLE_CHAIN chain) +{ + if (chain->cElement) + return chain->rgpElement[chain->cElement - 1]->TrustStatus.dwErrorStatus + & CERT_TRUST_IS_CYCLIC; + else + return FALSE; +} + /* Gets cert's issuer from store, and returns the validity flags associated * with it. Returns NULL if no issuer whose public key matches cert's * signature could be found. @@ -233,8 +272,8 @@ static PCCERT_CONTEXT CRYPT_GetIssuerFromStore(HCERTSTORE store, return issuer; } -static BOOL CRYPT_AddCertToSimpleChain(PCERT_SIMPLE_CHAIN chain, - PCCERT_CONTEXT cert, DWORD dwFlags) +static BOOL CRYPT_AddCertToSimpleChain(PCertificateChainEngine engine, + PCERT_SIMPLE_CHAIN chain, PCCERT_CONTEXT cert, DWORD dwFlags) { BOOL ret = FALSE; PCERT_CHAIN_ELEMENT element = CryptMemAlloc(sizeof(CERT_CHAIN_ELEMENT)); @@ -273,13 +312,15 @@ static BOOL CRYPT_AddCertToSimpleChain(PCERT_SIMPLE_CHAIN chain, prevElement->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_NOT_TIME_NESTED; } - /* FIXME: check valid usages, name constraints, and for cycles */ + /* FIXME: check valid usages and name constraints */ /* FIXME: initialize the rest of element */ + chain->rgpElement[chain->cElement++] = element; + if (chain->cElement % engine->CycleDetectionModulus) + CRYPT_CheckSimpleChainForCycles(chain); chain->TrustStatus.dwErrorStatus |= element->TrustStatus.dwErrorStatus; chain->TrustStatus.dwInfoStatus |= element->TrustStatus.dwInfoStatus; - chain->rgpElement[chain->cElement++] = element; ret = TRUE; } else @@ -288,12 +329,6 @@ static BOOL CRYPT_AddCertToSimpleChain(PCERT_SIMPLE_CHAIN chain, return ret; } -static void CRYPT_FreeChainElement(PCERT_CHAIN_ELEMENT element) -{ - CertFreeCertificateContext(element->pCertContext); - CryptMemFree(element); -} - static void CRYPT_FreeSimpleChain(PCERT_SIMPLE_CHAIN chain) { DWORD i; @@ -327,8 +362,9 @@ static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, { memset(chain, 0, sizeof(CERT_SIMPLE_CHAIN)); chain->cbSize = sizeof(CERT_SIMPLE_CHAIN); - ret = CRYPT_AddCertToSimpleChain(chain, cert, 0); - while (ret && !CRYPT_IsCertificateSelfSigned(cert)) + ret = CRYPT_AddCertToSimpleChain(engine, chain, cert, 0); + while (ret && !CRYPT_IsSimpleChainCyclic(chain) && + !CRYPT_IsCertificateSelfSigned(cert)) { DWORD flags; PCCERT_CONTEXT issuer = CRYPT_GetIssuerFromStore(world, cert, @@ -336,7 +372,7 @@ static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, if (issuer) { - ret = CRYPT_AddCertToSimpleChain(chain, issuer, flags); + ret = CRYPT_AddCertToSimpleChain(engine, chain, issuer, flags); cert = issuer; } else diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 4cafd0e..2d42ccb 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1529,14 +1529,13 @@ static ChainCheck chainCheck[] = { CERT_TRUST_IS_NOT_TIME_VALID, 0 }, 1, simpleStatus8 }, TODO_ERROR | TODO_INFO }, - /* This (cyclic) chain never completes in Wine, so don't test it yet + /* This (cyclic) chain fails in Wine */ { { sizeof(chain9) / sizeof(chain9[0]), chain9 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT | CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_CYCLIC, 0 }, 1, simpleStatus9 }, - TODO_ERROR | TODO_INFO }, - */ + TODO_CHAIN | TODO_ERROR | TODO_INFO }, { { sizeof(chain10) / sizeof(chain10[0]), chain10 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus10 },

1 0

Juan Lang : crypt32: Implement CertDuplicateCertificateChain.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 51a9d208eebf1f0e61f5035e30c0bf50f843bd35 URL: http://source.winehq.org/git/wine.git/?a=commit;h=51a9d208eebf1f0e61f5035e3… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:53:19 2007 -0700 crypt32: Implement CertDuplicateCertificateChain. --- dlls/crypt32/chain.c | 12 ++++++++++++ dlls/crypt32/crypt32.spec | 1 + 2 files changed, 13 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 81dd6c4..b8ce476 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -482,6 +482,18 @@ static void CRYPT_FreeChainContext(PCertificateChain chain) CryptMemFree(chain); } +PCCERT_CHAIN_CONTEXT WINAPI CertDuplicateCertificateChain( + PCCERT_CHAIN_CONTEXT pChainContext) +{ + PCertificateChain chain = (PCertificateChain)pChainContext; + + TRACE("(%p)\n", pChainContext); + + if (chain) + InterlockedIncrement(&chain->ref); + return pChainContext; +} + void WINAPI CertFreeCertificateChain(PCCERT_CHAIN_CONTEXT pChainContext) { PCertificateChain chain = (PCertificateChain)pChainContext; diff --git a/dlls/crypt32/crypt32.spec b/dlls/crypt32/crypt32.spec index 7403ca2..e16b3ae 100644 --- a/dlls/crypt32/crypt32.spec +++ b/dlls/crypt32/crypt32.spec @@ -26,6 +26,7 @@ @ stdcall CertDeleteCertificateFromStore(ptr) @ stdcall CertDuplicateCRLContext(ptr) @ stdcall CertDuplicateCTLContext(ptr) +@ stdcall CertDuplicateCertificateChain(ptr) @ stdcall CertDuplicateCertificateContext(ptr) @ stdcall CertDuplicateStore(ptr) @ stdcall CertEnumCRLContextProperties(ptr long)

1 0

Juan Lang : crypt32: Remove unneeded WINAPI from internal function.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 3ef4c7e1ccbbd331c5283e8ecd92cc51edc6333d URL: http://source.winehq.org/git/wine.git/?a=commit;h=3ef4c7e1ccbbd331c5283e8ec… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:52:50 2007 -0700 crypt32: Remove unneeded WINAPI from internal function. --- dlls/crypt32/chain.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 24bb197..81dd6c4 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -206,7 +206,7 @@ typedef struct _CertificateChain LONG ref; } CertificateChain, *PCertificateChain; -static inline BOOL WINAPI CRYPT_IsCertificateSelfSigned(PCCERT_CONTEXT cert) +static inline BOOL CRYPT_IsCertificateSelfSigned(PCCERT_CONTEXT cert) { return CertCompareCertificateName(cert->dwCertEncodingType, &cert->pCertInfo->Subject, &cert->pCertInfo->Issuer);

1 0