August 2007 - Wine-Commits - list.winehq.org

Juan Lang : crypt32: Free lower quality chain contexts.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 0dc82780cab6583935abcc811ef912cd215b1767 URL: http://source.winehq.org/git/wine.git/?a=commit;h=0dc82780cab6583935abcc811… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:52:30 2007 -0700 crypt32: Free lower quality chain contexts. --- dlls/crypt32/chain.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index b87eee1..24bb197 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -473,9 +473,9 @@ static void CRYPT_FreeChainContext(PCertificateChain chain) { DWORD i; - /* Note the chain's rgpLowerQualityChainContext isn't freed, but - * it's never set, either. - */ + for (i = 0; i < chain->context.cLowerQualityChainContext; i++) + CertFreeCertificateChain(chain->context.rgpLowerQualityChainContext[i]); + CryptMemFree(chain->context.rgpLowerQualityChainContext); for (i = 0; i < chain->context.cChain; i++) CRYPT_FreeSimpleChain(chain->context.rgpChain[i]); CryptMemFree(chain->context.rgpChain);

1 0

Juan Lang : crypt32: Don't fail chain creation if signature doesn't match.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: c39696eb14c9a61ecf5fe14a394f0b89dd96b104 URL: http://source.winehq.org/git/wine.git/?a=commit;h=c39696eb14c9a61ecf5fe14a3… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:56:45 2007 -0700 crypt32: Don't fail chain creation if signature doesn't match. --- dlls/crypt32/chain.c | 18 ++++-------------- dlls/crypt32/tests/chain.c | 2 +- 2 files changed, 5 insertions(+), 15 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 658b7c7..e6a0df8 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -252,24 +252,14 @@ static inline BOOL CRYPT_IsSimpleChainCyclic(PCERT_SIMPLE_CHAIN chain) } /* Gets cert's issuer from store, and returns the validity flags associated - * with it. Returns NULL if no issuer whose public key matches cert's - * signature could be found. + * with it. Returns NULL if no issuer signature could be found. */ static PCCERT_CONTEXT CRYPT_GetIssuerFromStore(HCERTSTORE store, PCCERT_CONTEXT cert, PDWORD pdwFlags) { - PCCERT_CONTEXT issuer = NULL; - - /* There might be more than issuer with the same name, so keep looking until - * one produces the correct signature for this cert. - */ - do { - *pdwFlags = CERT_STORE_REVOCATION_FLAG | CERT_STORE_SIGNATURE_FLAG | - CERT_STORE_TIME_VALIDITY_FLAG; - issuer = CertGetIssuerCertificateFromStore(store, cert, issuer, - pdwFlags); - } while (issuer && (*pdwFlags & CERT_STORE_SIGNATURE_FLAG)); - return issuer; + *pdwFlags = CERT_STORE_REVOCATION_FLAG | CERT_STORE_SIGNATURE_FLAG | + CERT_STORE_TIME_VALIDITY_FLAG; + return CertGetIssuerCertificateFromStore(store, cert, NULL, pdwFlags); } static BOOL CRYPT_AddCertToSimpleChain(PCertificateChainEngine engine, diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 3ec4dba..565cf50 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1491,7 +1491,7 @@ static ChainCheck chainCheck[] = { { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_SIGNATURE_VALID | CERT_TRUST_IS_NOT_TIME_VALID, 0 }, 1, simpleStatus1 }, - TODO_CHAIN | TODO_ERROR | TODO_INFO }, + TODO_ERROR | TODO_INFO }, { { sizeof(chain2) / sizeof(chain2[0]), chain2 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 },

1 0

Juan Lang : crypt32: Correct combining trust status of a chain' s elements into the chain's trust status.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 03d76d97ecc427d534069c5e0194ca0eadacfcca URL: http://source.winehq.org/git/wine.git/?a=commit;h=03d76d97ecc427d534069c5e0… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:57:15 2007 -0700 crypt32: Correct combining trust status of a chain's elements into the chain's trust status. --- dlls/crypt32/chain.c | 23 +++++++++++++++-------- 1 files changed, 15 insertions(+), 8 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index e6a0df8..f0f3e56 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -262,6 +262,17 @@ static PCCERT_CONTEXT CRYPT_GetIssuerFromStore(HCERTSTORE store, return CertGetIssuerCertificateFromStore(store, cert, NULL, pdwFlags); } +static inline void CRYPT_CombineTrustStatus(CERT_TRUST_STATUS *chainStatus, + CERT_TRUST_STATUS *elementStatus) +{ + /* Any error that applies to an element also applies to a chain.. */ + chainStatus->dwErrorStatus |= elementStatus->dwErrorStatus; + /* but the bottom nibble of an element's info status doesn't apply to the + * chain. + */ + chainStatus->dwInfoStatus |= (elementStatus->dwInfoStatus & 0xfffffff0); +} + static BOOL CRYPT_AddCertToSimpleChain(PCertificateChainEngine engine, PCERT_SIMPLE_CHAIN chain, PCCERT_CONTEXT cert, DWORD dwFlags) { @@ -307,10 +318,8 @@ static BOOL CRYPT_AddCertToSimpleChain(PCertificateChainEngine engine, chain->rgpElement[chain->cElement++] = element; if (chain->cElement % engine->CycleDetectionModulus) CRYPT_CheckSimpleChainForCycles(chain); - chain->TrustStatus.dwErrorStatus |= - element->TrustStatus.dwErrorStatus; - chain->TrustStatus.dwInfoStatus |= - element->TrustStatus.dwInfoStatus; + CRYPT_CombineTrustStatus(&chain->TrustStatus, + &element->TrustStatus); ret = TRUE; } else @@ -412,10 +421,8 @@ static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, } CRYPT_CheckTrustedStatus(engine->hRoot, rootElement); } - chain->TrustStatus.dwErrorStatus |= - rootElement->TrustStatus.dwErrorStatus; - chain->TrustStatus.dwInfoStatus |= - rootElement->TrustStatus.dwInfoStatus & ~CERT_TRUST_IS_SELF_SIGNED; + CRYPT_CombineTrustStatus(&chain->TrustStatus, + &rootElement->TrustStatus); } if (!ret) {

1 0

Juan Lang : crypt32: Don't fail chain creation if root isn't self-signed.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 1540f24e9247a7418449b43aa45068afca1f76ed URL: http://source.winehq.org/git/wine.git/?a=commit;h=1540f24e9247a7418449b43aa… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:55:43 2007 -0700 crypt32: Don't fail chain creation if root isn't self-signed. --- dlls/crypt32/chain.c | 42 ++++++++++++++++++++++-------------------- dlls/crypt32/tests/chain.c | 3 +-- 2 files changed, 23 insertions(+), 22 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 1372ad8..658b7c7 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -339,6 +339,26 @@ static void CRYPT_FreeSimpleChain(PCERT_SIMPLE_CHAIN chain) CryptMemFree(chain); } +static void CRYPT_CheckTrustedStatus(HCERTSTORE hRoot, + PCERT_CHAIN_ELEMENT rootElement) +{ + BYTE hash[20]; + DWORD size = sizeof(hash); + CRYPT_HASH_BLOB blob = { sizeof(hash), hash }; + PCCERT_CONTEXT trustedRoot; + + CertGetCertificateContextProperty(rootElement->pCertContext, + CERT_HASH_PROP_ID, hash, &size); + trustedRoot = CertFindCertificateInStore(hRoot, + rootElement->pCertContext->dwCertEncodingType, 0, CERT_FIND_SHA1_HASH, + &blob, NULL); + if (!trustedRoot) + rootElement->TrustStatus.dwErrorStatus |= + CERT_TRUST_IS_UNTRUSTED_ROOT; + else + CertFreeCertificateContext(trustedRoot); +} + static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, PCCERT_CONTEXT cert, LPFILETIME pTime, HCERTSTORE hAdditionalStore, PCERT_SIMPLE_CHAIN *ppChain) @@ -387,9 +407,7 @@ static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, chain->rgpElement[chain->cElement - 1]; PCCERT_CONTEXT root = rootElement->pCertContext; - if (!(ret = CRYPT_IsCertificateSelfSigned(root))) - TRACE("Last certificate is not self-signed\n"); - else + if (CRYPT_IsCertificateSelfSigned(root)) { rootElement->TrustStatus.dwInfoStatus |= CERT_TRUST_IS_SELF_SIGNED; @@ -402,23 +420,7 @@ static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, rootElement->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_NOT_SIGNATURE_VALID; } - } - if (CRYPT_IsCertificateSelfSigned(root)) - { - BYTE hash[20]; - DWORD size = sizeof(hash); - CRYPT_HASH_BLOB blob = { sizeof(hash), hash }; - PCCERT_CONTEXT trustedRoot; - - CertGetCertificateContextProperty(root, CERT_HASH_PROP_ID, hash, - &size); - trustedRoot = CertFindCertificateInStore(engine->hRoot, - root->dwCertEncodingType, 0, CERT_FIND_SHA1_HASH, &blob, NULL); - if (!trustedRoot) - rootElement->TrustStatus.dwErrorStatus |= - CERT_TRUST_IS_UNTRUSTED_ROOT; - else - CertFreeCertificateContext(trustedRoot); + CRYPT_CheckTrustedStatus(engine->hRoot, rootElement); } chain->TrustStatus.dwErrorStatus |= rootElement->TrustStatus.dwErrorStatus; diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 2d42ccb..3ec4dba 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1529,13 +1529,12 @@ static ChainCheck chainCheck[] = { CERT_TRUST_IS_NOT_TIME_VALID, 0 }, 1, simpleStatus8 }, TODO_ERROR | TODO_INFO }, - /* This (cyclic) chain fails in Wine */ { { sizeof(chain9) / sizeof(chain9[0]), chain9 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT | CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_CYCLIC, 0 }, 1, simpleStatus9 }, - TODO_CHAIN | TODO_ERROR | TODO_INFO }, + TODO_ERROR | TODO_INFO }, { { sizeof(chain10) / sizeof(chain10[0]), chain10 }, { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus10 },

1 0

Juan Lang : crypt32: Check chain root' s trusted status regardless of whether its signature is valid.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: a4e88cb64402e602ab1a61f859bc8eaafdc5c139 URL: http://source.winehq.org/git/wine.git/?a=commit;h=a4e88cb64402e602ab1a61f85… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:51:45 2007 -0700 crypt32: Check chain root's trusted status regardless of whether its signature is valid. --- dlls/crypt32/chain.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 6584085..b87eee1 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -367,7 +367,7 @@ static BOOL CRYPT_BuildSimpleChain(HCERTCHAINENGINE hChainEngine, CERT_TRUST_IS_NOT_SIGNATURE_VALID; } } - if (ret) + if (CRYPT_IsCertificateSelfSigned(root)) { BYTE hash[20]; DWORD size = sizeof(hash);

1 0

Juan Lang : crypt32: The preferred issuer flag appears to be a bug in XP, so don't set it.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: cf2047fd726d643638d8191cc9836cbd24c3e163 URL: http://source.winehq.org/git/wine.git/?a=commit;h=cf2047fd726d643638d8191cc… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:49:27 2007 -0700 crypt32: The preferred issuer flag appears to be a bug in XP, so don't set it. --- dlls/crypt32/chain.c | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 2b00ff0..cfe05b3 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -255,10 +255,6 @@ static BOOL CRYPT_AddCertToSimpleChain(PCERT_SIMPLE_CHAIN chain, if (dwFlags & CERT_STORE_TIME_VALIDITY_FLAG) element->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_NOT_TIME_VALID; - /* It appears, from every example certificate chain I've found, - * that this flag is always set: - */ - element->TrustStatus.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER; if (chain->cElement) { PCERT_CHAIN_ELEMENT prevElement =

1 0

Alexandre Julliard : gdi32: New DC locking mechanism that doesn' t require holding the global GDI lock.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: d88ff791ef6429c8557c5e782cd47fa516474ad7 URL: http://source.winehq.org/git/wine.git/?a=commit;h=d88ff791ef6429c8557c5e782… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Fri Aug 31 15:58:38 2007 +0200 gdi32: New DC locking mechanism that doesn't require holding the global GDI lock. --- dlls/gdi32/bitmap.c | 2 +- dlls/gdi32/clipping.c | 5 +- dlls/gdi32/dc.c | 146 +++++++++++++++++++++++++++++++++++--------- dlls/gdi32/enhmfdrv/init.c | 6 ++ dlls/gdi32/gdi_private.h | 7 ++- dlls/gdi32/mfdrv/init.c | 6 ++ 6 files changed, 138 insertions(+), 34 deletions(-) Diff: http://source.winehq.org/git/wine.git/?a=commitdiff;h=d88ff791ef6429c8557c5…

1 0

Juan Lang : crypt32: Greatly expand certificate chain tests.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 6a8a7362cc1dae3237b7e92ea4db2a8b44df79d4 URL: http://source.winehq.org/git/wine.git/?a=commit;h=6a8a7362cc1dae3237b7e92ea… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Aug 31 08:51:11 2007 -0700 crypt32: Greatly expand certificate chain tests. --- dlls/crypt32/tests/chain.c | 1252 +++++++++++++++++++++++++++++++++++++++----- 1 files changed, 1111 insertions(+), 141 deletions(-) Diff: http://source.winehq.org/git/wine.git/?a=commitdiff;h=6a8a7362cc1dae3237b7e…

1 0

Juan Lang : crypt32: Add a default cycle detection modulus.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 45eef63a35f27a522e4c3e24f2511593bffb987c URL: http://source.winehq.org/git/wine.git/?a=commit;h=45eef63a35f27a522e4c3e24f… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:49:52 2007 -0700 crypt32: Add a default cycle detection modulus. --- dlls/crypt32/chain.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index cfe05b3..f1711ac 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -25,6 +25,8 @@ WINE_DEFAULT_DEBUG_CHANNEL(crypt); +#define DEFAULT_CYCLE_MODULUS 7 + static HCERTCHAINENGINE CRYPT_defaultChainEngine; /* This represents a subset of a certificate chain engine: it doesn't include @@ -149,7 +151,10 @@ BOOL WINAPI CertCreateCertificateChainEngine(PCERT_CHAIN_ENGINE_CONFIG pConfig, engine->dwUrlRetrievalTimeout = pConfig->dwUrlRetrievalTimeout; engine->MaximumCachedCertificates = pConfig->MaximumCachedCertificates; - engine->CycleDetectionModulus = pConfig->CycleDetectionModulus; + if (pConfig->CycleDetectionModulus) + engine->CycleDetectionModulus = pConfig->CycleDetectionModulus; + else + engine->CycleDetectionModulus = DEFAULT_CYCLE_MODULUS; *phChainEngine = (HCERTCHAINENGINE)engine; ret = TRUE; }

1 0

Juan Lang : crypt32: Properly reference count certificate contexts referenced by a chain.
by Alexandre Julliard Aug. 31, 2007

Aug. 31, 2007

Module: wine Branch: master Commit: 8cd7abf1be287af002e742cf2a06a0d83364baa4 URL: http://source.winehq.org/git/wine.git/?a=commit;h=8cd7abf1be287af002e742cf2… Author: Juan Lang <juan.lang(a)gmail.com> Date: Thu Aug 30 17:50:23 2007 -0700 crypt32: Properly reference count certificate contexts referenced by a chain. --- dlls/crypt32/chain.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index f1711ac..6584085 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -250,7 +250,7 @@ static BOOL CRYPT_AddCertToSimpleChain(PCERT_SIMPLE_CHAIN chain, { memset(element, 0, sizeof(CERT_CHAIN_ELEMENT)); element->cbSize = sizeof(CERT_CHAIN_ELEMENT); - element->pCertContext = cert; + element->pCertContext = CertDuplicateCertificateContext(cert); if (dwFlags & CERT_STORE_REVOCATION_FLAG && !(dwFlags & CERT_STORE_NO_CRL_FLAG)) element->TrustStatus.dwErrorStatus |= CERT_TRUST_IS_REVOKED; @@ -288,12 +288,18 @@ static BOOL CRYPT_AddCertToSimpleChain(PCERT_SIMPLE_CHAIN chain, return ret; } +static void CRYPT_FreeChainElement(PCERT_CHAIN_ELEMENT element) +{ + CertFreeCertificateContext(element->pCertContext); + CryptMemFree(element); +} + static void CRYPT_FreeSimpleChain(PCERT_SIMPLE_CHAIN chain) { DWORD i; for (i = 0; i < chain->cElement; i++) - CryptMemFree(chain->rgpElement[i]); + CRYPT_FreeChainElement(chain->rgpElement[i]); CryptMemFree(chain->rgpElement); CryptMemFree(chain); }

1 0