September 2008 - Wine-Commits

Juan Lang : cryptdlg: Implement CertTrustFinalPolicy.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: e893a2c8637d3c3fb522cd01349498ec029fe901 URL: http://source.winehq.org/git/wine.git/?a=commit;h=e893a2c8637d3c3fb522cd013… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 13:09:56 2008 -0700 cryptdlg: Implement CertTrustFinalPolicy. --- dlls/cryptdlg/Makefile.in | 2 +- dlls/cryptdlg/main.c | 259 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 257 insertions(+), 4 deletions(-) diff --git a/dlls/cryptdlg/Makefile.in b/dlls/cryptdlg/Makefile.in index a883c27..0271fa3 100644 --- a/dlls/cryptdlg/Makefile.in +++ b/dlls/cryptdlg/Makefile.in @@ -3,7 +3,7 @@ TOPOBJDIR = ../.. SRCDIR = @srcdir@ VPATH = @srcdir@ MODULE = cryptdlg.dll -IMPORTS = cryptui crypt32 wintrust kernel32 +IMPORTS = cryptui crypt32 wintrust advapi32 kernel32 C_SRCS = \ main.c diff --git a/dlls/cryptdlg/main.c b/dlls/cryptdlg/main.c index ba79d4f..d87d480 100644 --- a/dlls/cryptdlg/main.c +++ b/dlls/cryptdlg/main.c @@ -23,6 +23,7 @@ #include "windef.h" #include "winbase.h" #include "winnls.h" +#include "winreg.h" #include "wincrypt.h" #include "wintrust.h" #include "winuser.h" @@ -105,13 +106,265 @@ HRESULT WINAPI CertTrustCleanup(CRYPT_PROVIDER_DATA *pProvData) return E_NOTIMPL; } +static BOOL CRYPTDLG_CheckOnlineCRL(void) +{ + static const WCHAR policyFlagsKey[] = { 'S','o','f','t','w','a','r','e', + '\\','M','i','c','r','o','s','o','f','t','\\','C','r','y','p','t','o','g', + 'r','a','p','h','y','\\','{','7','8','0','1','e','b','d','0','-','c','f', + '4','b','-','1','1','d','0','-','8','5','1','f','-','0','0','6','0','9', + '7','9','3','8','7','e','a','}',0 }; + static const WCHAR policyFlags[] = { 'P','o','l','i','c','y','F','l','a', + 'g','s',0 }; + HKEY key; + BOOL ret = FALSE; + + if (!RegOpenKeyExW(HKEY_LOCAL_MACHINE, policyFlagsKey, 0, KEY_READ, &key)) + { + DWORD type, flags, size = sizeof(flags); + + if (!RegQueryValueExW(key, policyFlags, NULL, &type, (BYTE *)&flags, + &size) && type == REG_DWORD) + { + /* The flag values aren't defined in any header I'm aware of, but + * this value is well documented on the net. + */ + if (flags & 0x00010000) + ret = TRUE; + } + RegCloseKey(key); + } + return ret; +} + +/* Returns TRUE if pCert is not in the Disallowed system store, or FALSE if it + * is. + */ +static BOOL CRYPTDLG_IsCertAllowed(PCCERT_CONTEXT pCert) +{ + BOOL ret; + BYTE hash[20]; + DWORD size = sizeof(hash); + + if ((ret = CertGetCertificateContextProperty(pCert, + CERT_SIGNATURE_HASH_PROP_ID, hash, &size))) + { + static const WCHAR disallowedW[] = + { 'D','i','s','a','l','l','o','w','e','d',0 }; + HCERTSTORE disallowed = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, + X509_ASN_ENCODING, 0, CERT_SYSTEM_STORE_CURRENT_USER, disallowedW); + + if (disallowed) + { + PCCERT_CONTEXT found = CertFindCertificateInStore(disallowed, + X509_ASN_ENCODING, 0, CERT_FIND_SIGNATURE_HASH, hash, NULL); + + if (found) + { + ret = FALSE; + CertFreeCertificateContext(found); + } + CertCloseStore(disallowed, 0); + } + } + return ret; +} + +static DWORD CRYPTDLG_TrustStatusToConfidence(DWORD errorStatus) +{ + DWORD confidence = 0; + + confidence = 0; + if (!(errorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID)) + confidence |= CERT_CONFIDENCE_SIG; + if (!(errorStatus & CERT_TRUST_IS_NOT_TIME_VALID)) + confidence |= CERT_CONFIDENCE_TIME; + if (!(errorStatus & CERT_TRUST_IS_NOT_TIME_NESTED)) + confidence |= CERT_CONFIDENCE_TIMENEST; + return confidence; +} + +static BOOL CRYPTDLG_CopyChain(CRYPT_PROVIDER_DATA *data, + PCCERT_CHAIN_CONTEXT chain) +{ + BOOL ret; + CRYPT_PROVIDER_SGNR signer; + PCERT_SIMPLE_CHAIN simpleChain = chain->rgpChain[0]; + DWORD i; + + memset(&signer, 0, sizeof(signer)); + signer.cbStruct = sizeof(signer); + ret = data->psPfns->pfnAddSgnr2Chain(data, FALSE, 0, &signer); + if (ret) + { + CRYPT_PROVIDER_SGNR *sgnr = WTHelperGetProvSignerFromChain(data, 0, + FALSE, 0); + + if (sgnr) + { + sgnr->dwError = simpleChain->TrustStatus.dwErrorStatus; + sgnr->pChainContext = CertDuplicateCertificateChain(chain); + } + else + ret = FALSE; + for (i = 0; ret && i < simpleChain->cElement; i++) + { + ret = data->psPfns->pfnAddCert2Chain(data, 0, FALSE, 0, + simpleChain->rgpElement[i]->pCertContext); + if (ret) + { + CRYPT_PROVIDER_CERT *cert; + + if ((cert = WTHelperGetProvCertFromChain(sgnr, i))) + { + CERT_CHAIN_ELEMENT *element = simpleChain->rgpElement[i]; + + cert->dwConfidence = CRYPTDLG_TrustStatusToConfidence( + element->TrustStatus.dwErrorStatus); + cert->dwError = element->TrustStatus.dwErrorStatus; + cert->pChainElement = element; + } + else + ret = FALSE; + } + } + } + return ret; +} + +static CERT_VERIFY_CERTIFICATE_TRUST *CRYPTDLG_GetVerifyData( + CRYPT_PROVIDER_DATA *data) +{ + CERT_VERIFY_CERTIFICATE_TRUST *pCert = NULL; + + /* This should always be true, but just in case the calling function is + * called directly: + */ + if (data->pWintrustData->dwUnionChoice == WTD_CHOICE_BLOB && + data->pWintrustData->pBlob && data->pWintrustData->pBlob->cbMemObject == + sizeof(CERT_VERIFY_CERTIFICATE_TRUST) && + data->pWintrustData->pBlob->pbMemObject) + pCert = (CERT_VERIFY_CERTIFICATE_TRUST *) + data->pWintrustData->pBlob->pbMemObject; + return pCert; +} + +static HCERTCHAINENGINE CRYPTDLG_MakeEngine(CERT_VERIFY_CERTIFICATE_TRUST *cert) +{ + HCERTCHAINENGINE engine = NULL; + HCERTSTORE root = NULL, trust = NULL; + DWORD i; + + if (cert->cRootStores) + { + root = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0, + CERT_STORE_CREATE_NEW_FLAG, NULL); + if (root) + { + for (i = 0; i < cert->cRootStores; i++) + CertAddStoreToCollection(root, cert->rghstoreRoots[i], 0, 0); + } + } + if (cert->cTrustStores) + { + trust = CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, 0, + CERT_STORE_CREATE_NEW_FLAG, NULL); + if (root) + { + for (i = 0; i < cert->cTrustStores; i++) + CertAddStoreToCollection(trust, cert->rghstoreTrust[i], 0, 0); + } + } + if (cert->cRootStores || cert->cStores || cert->cTrustStores) + { + CERT_CHAIN_ENGINE_CONFIG config; + + memset(&config, 0, sizeof(config)); + config.cbSize = sizeof(config); + config.hRestrictedRoot = root; + config.hRestrictedTrust = trust; + config.cAdditionalStore = cert->cStores; + config.rghAdditionalStore = cert->rghstoreCAs; + config.hRestrictedRoot = root; + CertCreateCertificateChainEngine(&config, &engine); + CertCloseStore(root, 0); + CertCloseStore(trust, 0); + } + return engine; +} + /*********************************************************************** * CertTrustFinalPolicy (CRYPTDLG.@) */ -HRESULT WINAPI CertTrustFinalPolicy(CRYPT_PROVIDER_DATA *pProvData) +HRESULT WINAPI CertTrustFinalPolicy(CRYPT_PROVIDER_DATA *data) { - FIXME("(%p)\n", pProvData); - return E_NOTIMPL; + BOOL ret; + DWORD err = S_OK; + CERT_VERIFY_CERTIFICATE_TRUST *pCert = CRYPTDLG_GetVerifyData(data); + + TRACE("(%p)\n", data); + + if (data->pWintrustData->dwUIChoice != WTD_UI_NONE) + FIXME("unimplemented for UI choice %d\n", + data->pWintrustData->dwUIChoice); + if (pCert) + { + DWORD flags = 0; + CERT_CHAIN_PARA chainPara; + HCERTCHAINENGINE engine; + + memset(&chainPara, 0, sizeof(chainPara)); + chainPara.cbSize = sizeof(chainPara); + if (CRYPTDLG_CheckOnlineCRL()) + flags |= CERT_CHAIN_REVOCATION_CHECK_END_CERT; + engine = CRYPTDLG_MakeEngine(pCert); + GetSystemTimeAsFileTime(&data->sftSystemTime); + ret = CRYPTDLG_IsCertAllowed(pCert->pccert); + if (ret) + { + PCCERT_CHAIN_CONTEXT chain; + + ret = CertGetCertificateChain(engine, pCert->pccert, + &data->sftSystemTime, NULL, &chainPara, flags, NULL, &chain); + if (ret) + { + if (chain->cChain != 1) + { + FIXME("unimplemented for more than 1 simple chain\n"); + err = TRUST_E_SUBJECT_FORM_UNKNOWN; + ret = FALSE; + } + else if ((ret = CRYPTDLG_CopyChain(data, chain))) + { + if (CertVerifyTimeValidity(&data->sftSystemTime, + pCert->pccert->pCertInfo)) + { + ret = FALSE; + err = CERT_E_EXPIRED; + } + } + else + err = TRUST_E_SYSTEM_ERROR; + CertFreeCertificateChain(chain); + } + else + err = TRUST_E_SUBJECT_NOT_TRUSTED; + } + CertFreeCertificateChainEngine(engine); + } + else + { + ret = FALSE; + err = TRUST_E_NOSIGNATURE; + } + /* Oddly, native doesn't set the error in the trust step error location, + * probably because this action is more advisory than anything else. + * Instead it stores it as the final error, but the function "succeeds" in + * any case. + */ + if (!ret) + data->dwFinalError = err; + TRACE("returning %d (%08x)\n", S_OK, data->dwFinalError); + return S_OK; } /***********************************************************************

1 0

Juan Lang : cryptdlg: Implement CertTrustInit.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: c84df40665a532684c0eed3d116e8039b80d84cb URL: http://source.winehq.org/git/wine.git/?a=commit;h=c84df40665a532684c0eed3d1… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 13:08:08 2008 -0700 cryptdlg: Implement CertTrustInit. --- dlls/cryptdlg/main.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-) diff --git a/dlls/cryptdlg/main.c b/dlls/cryptdlg/main.c index 36f2a1b..ba79d4f 100644 --- a/dlls/cryptdlg/main.c +++ b/dlls/cryptdlg/main.c @@ -76,8 +76,15 @@ DWORD WINAPI GetFriendlyNameOfCertW(PCCERT_CONTEXT pccert, LPWSTR pchBuffer, */ HRESULT WINAPI CertTrustInit(CRYPT_PROVIDER_DATA *pProvData) { - FIXME("(%p)\n", pProvData); - return E_NOTIMPL; + HRESULT ret = S_FALSE; + + TRACE("(%p)\n", pProvData); + + if (pProvData->padwTrustStepErrors && + !pProvData->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_WVTINIT]) + ret = S_OK; + TRACE("returning %08x\n", ret); + return ret; } /***********************************************************************

1 0

Juan Lang : cryptdlg: Implement CertViewPropertiesW on top of CryptUIDlgViewCertificateW.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: 0ff7bf13f68a3506c1b4c23ecbca327501b0a88c URL: http://source.winehq.org/git/wine.git/?a=commit;h=0ff7bf13f68a3506c1b4c23ec… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 13:07:38 2008 -0700 cryptdlg: Implement CertViewPropertiesW on top of CryptUIDlgViewCertificateW. --- dlls/cryptdlg/Makefile.in | 2 +- dlls/cryptdlg/main.c | 58 +++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 57 insertions(+), 3 deletions(-) diff --git a/dlls/cryptdlg/Makefile.in b/dlls/cryptdlg/Makefile.in index bb06a0b..a883c27 100644 --- a/dlls/cryptdlg/Makefile.in +++ b/dlls/cryptdlg/Makefile.in @@ -3,7 +3,7 @@ TOPOBJDIR = ../.. SRCDIR = @srcdir@ VPATH = @srcdir@ MODULE = cryptdlg.dll -IMPORTS = crypt32 wintrust kernel32 +IMPORTS = cryptui crypt32 wintrust kernel32 C_SRCS = \ main.c diff --git a/dlls/cryptdlg/main.c b/dlls/cryptdlg/main.c index 943794a..36f2a1b 100644 --- a/dlls/cryptdlg/main.c +++ b/dlls/cryptdlg/main.c @@ -27,6 +27,7 @@ #include "wintrust.h" #include "winuser.h" #include "cryptdlg.h" +#include "cryptuiapi.h" #include "wine/debug.h" WINE_DEFAULT_DEBUG_CHANNEL(cryptdlg); @@ -145,8 +146,61 @@ error: */ BOOL WINAPI CertViewPropertiesW(CERT_VIEWPROPERTIES_STRUCT_W *info) { - FIXME("(%p): stub\n", info); - return FALSE; + static GUID cert_action_verify = CERT_CERTIFICATE_ACTION_VERIFY; + CERT_VERIFY_CERTIFICATE_TRUST trust; + WINTRUST_BLOB_INFO blob; + WINTRUST_DATA wtd; + LONG err; + BOOL ret; + + TRACE("(%p)\n", info); + + memset(&trust, 0, sizeof(trust)); + trust.cbSize = sizeof(trust); + trust.pccert = info->pCertContext; + trust.cRootStores = info->cRootStores; + trust.rghstoreRoots = info->rghstoreRoots; + trust.cStores = info->cStores; + trust.rghstoreCAs = info->rghstoreCAs; + trust.cTrustStores = info->cTrustStores; + trust.rghstoreTrust = info->rghstoreTrust; + memset(&blob, 0, sizeof(blob)); + blob.cbStruct = sizeof(blob); + blob.cbMemObject = sizeof(trust); + blob.pbMemObject = (BYTE *)&trust; + memset(&wtd, 0, sizeof(wtd)); + wtd.cbStruct = sizeof(wtd); + wtd.dwUIChoice = WTD_UI_NONE; + wtd.dwUnionChoice = WTD_CHOICE_BLOB; + wtd.pBlob = &blob; + wtd.dwStateAction = WTD_STATEACTION_VERIFY; + err = WinVerifyTrust(NULL, &cert_action_verify, &wtd); + if (err == ERROR_SUCCESS) + { + CRYPTUI_VIEWCERTIFICATE_STRUCTW uiInfo; + BOOL propsChanged = FALSE; + + memset(&uiInfo, 0, sizeof(uiInfo)); + uiInfo.dwSize = sizeof(uiInfo); + uiInfo.hwndParent = info->hwndParent; + uiInfo.dwFlags = + CRYPTUI_DISABLE_ADDTOSTORE | CRYPTUI_ENABLE_EDITPROPERTIES; + uiInfo.szTitle = info->szTitle; + uiInfo.pCertContext = info->pCertContext; + uiInfo.cPurposes = info->cArrayPurposes; + uiInfo.rgszPurposes = (LPCSTR *)info->arrayPurposes; + uiInfo.hWVTStateData = wtd.hWVTStateData; + uiInfo.fpCryptProviderDataTrustedUsage = TRUE; + uiInfo.cPropSheetPages = info->cArrayPropSheetPages; + uiInfo.rgPropSheetPages = info->arrayPropSheetPages; + uiInfo.nStartPage = info->nStartPage; + ret = CryptUIDlgViewCertificateW(&uiInfo, &propsChanged); + wtd.dwStateAction = WTD_STATEACTION_CLOSE; + WinVerifyTrust(NULL, &cert_action_verify, &wtd); + } + else + ret = FALSE; + return ret; } /***********************************************************************

1 0

Juan Lang : wintrust: Support the CERT_CERTIFICATE_ACTION_VERIFY action.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: d99b23819d34b9627745ec4474b5edbf93d86b00 URL: http://source.winehq.org/git/wine.git/?a=commit;h=d99b23819d34b9627745ec447… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 13:20:35 2008 -0700 wintrust: Support the CERT_CERTIFICATE_ACTION_VERIFY action. --- dlls/wintrust/wintrust_main.c | 182 +++++++++++++++++++++++++++++++++++++++++ 1 files changed, 182 insertions(+), 0 deletions(-) diff --git a/dlls/wintrust/wintrust_main.c b/dlls/wintrust/wintrust_main.c index a1893d3..2218ca0 100644 --- a/dlls/wintrust/wintrust_main.c +++ b/dlls/wintrust/wintrust_main.c @@ -33,6 +33,7 @@ #include "mscat.h" #include "objbase.h" #include "winuser.h" +#include "cryptdlg.h" #include "wintrust_priv.h" #include "wine/debug.h" @@ -267,6 +268,184 @@ static LONG WINTRUST_PublishedSoftware(HWND hwnd, GUID *actionID, return WINTRUST_DefaultVerifyAndClose(hwnd, actionID, &wintrust_data); } +/* Sadly, the function to load the cert for the CERT_CERTIFICATE_ACTION_VERIFY + * action is not stored in the registry and is located in wintrust, not in + * cryptdlg along with the rest of the implementation (verified by running the + * action with a native wintrust.dll.) + */ +static HRESULT WINAPI WINTRUST_CertVerifyObjTrust(CRYPT_PROVIDER_DATA *data) +{ + BOOL ret; + + TRACE("(%p)\n", data); + + if (!data->padwTrustStepErrors) + return S_FALSE; + + switch (data->pWintrustData->dwUnionChoice) + { + case WTD_CHOICE_BLOB: + if (data->pWintrustData->u.pBlob && + data->pWintrustData->u.pBlob->cbStruct == sizeof(WINTRUST_BLOB_INFO) && + data->pWintrustData->u.pBlob->cbMemObject == + sizeof(CERT_VERIFY_CERTIFICATE_TRUST) && + data->pWintrustData->u.pBlob->pbMemObject) + { + CERT_VERIFY_CERTIFICATE_TRUST *pCert = + (CERT_VERIFY_CERTIFICATE_TRUST *) + data->pWintrustData->u.pBlob->pbMemObject; + + if (pCert->cbSize == sizeof(CERT_VERIFY_CERTIFICATE_TRUST) && + pCert->pccert) + { + CRYPT_PROVIDER_SGNR signer = { sizeof(signer), { 0 } }; + DWORD i; + SYSTEMTIME sysTime; + + /* Add a signer with nothing but the time to verify, so we can + * add a cert to it + */ + GetSystemTime(&sysTime); + SystemTimeToFileTime(&sysTime, &signer.sftVerifyAsOf); + ret = data->psPfns->pfnAddSgnr2Chain(data, FALSE, 0, &signer); + if (!ret) + goto error; + ret = data->psPfns->pfnAddCert2Chain(data, 0, FALSE, 0, + pCert->pccert); + if (!ret) + goto error; + for (i = 0; ret && i < pCert->cRootStores; i++) + ret = data->psPfns->pfnAddStore2Chain(data, + pCert->rghstoreRoots[i]); + for (i = 0; ret && i < pCert->cStores; i++) + ret = data->psPfns->pfnAddStore2Chain(data, + pCert->rghstoreCAs[i]); + for (i = 0; ret && i < pCert->cTrustStores; i++) + ret = data->psPfns->pfnAddStore2Chain(data, + pCert->rghstoreTrust[i]); + } + else + { + SetLastError(ERROR_INVALID_PARAMETER); + ret = FALSE; + } + } + else + { + SetLastError(ERROR_INVALID_PARAMETER); + ret = FALSE; + } + break; + default: + FIXME("unimplemented for %d\n", data->pWintrustData->dwUnionChoice); + SetLastError(ERROR_INVALID_PARAMETER); + ret = FALSE; + } + +error: + if (!ret) + data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_OBJPROV] = + GetLastError(); + TRACE("returning %d (%08x)\n", ret ? S_OK : S_FALSE, + data->padwTrustStepErrors[TRUSTERROR_STEP_FINAL_OBJPROV]); + return ret ? S_OK : S_FALSE; +} + +static LONG WINTRUST_CertVerify(HWND hwnd, GUID *actionID, + WINTRUST_DATA *data) +{ + DWORD err = ERROR_SUCCESS, numSteps = 0; + CRYPT_PROVIDER_DATA *provData; + BOOL ret; + struct wintrust_step verifySteps[5]; + + TRACE("(%p, %s, %p)\n", hwnd, debugstr_guid(actionID), data); + + provData = WINTRUST_AllocateProviderData(); + if (!provData) + return ERROR_OUTOFMEMORY; + + ret = WintrustLoadFunctionPointers(actionID, provData->psPfns); + if (!ret) + { + err = GetLastError(); + goto error; + } + if (!provData->psPfns->pfnObjectTrust) + provData->psPfns->pfnObjectTrust = WINTRUST_CertVerifyObjTrust; + /* Not sure why, but native skips the policy check */ + provData->psPfns->pfnCertCheckPolicy = NULL; + + data->hWVTStateData = (HANDLE)provData; + provData->pWintrustData = data; + if (hwnd == INVALID_HANDLE_VALUE) + provData->hWndParent = GetDesktopWindow(); + else + provData->hWndParent = hwnd; + provData->pgActionID = actionID; + WintrustGetRegPolicyFlags(&provData->dwRegPolicySettings); + + numSteps = WINTRUST_AddTrustStepsFromFunctions(verifySteps, + provData->psPfns); + err = WINTRUST_ExecuteSteps(verifySteps, numSteps, provData); + goto done; + +error: + if (provData) + { + WINTRUST_Free(provData->padwTrustStepErrors); + WINTRUST_Free(provData->u.pPDSip); + WINTRUST_Free(provData->psPfns); + WINTRUST_Free(provData); + } +done: + TRACE("returning %08x\n", err); + return err; +} + +static LONG WINTRUST_CertVerifyAndClose(HWND hwnd, GUID *actionID, + WINTRUST_DATA *data) +{ + LONG err; + + TRACE("(%p, %s, %p)\n", hwnd, debugstr_guid(actionID), data); + + err = WINTRUST_CertVerify(hwnd, actionID, data); + WINTRUST_DefaultClose(hwnd, actionID, data); + TRACE("returning %08x\n", err); + return err; +} + +static LONG WINTRUST_CertActionVerify(HWND hwnd, GUID *actionID, + WINTRUST_DATA *data) +{ + DWORD stateAction; + LONG err = ERROR_SUCCESS; + + if (WVT_ISINSTRUCT(WINTRUST_DATA, data->cbStruct, dwStateAction)) + stateAction = data->dwStateAction; + else + { + TRACE("no dwStateAction, assuming WTD_STATEACTION_IGNORE\n"); + stateAction = WTD_STATEACTION_IGNORE; + } + switch (stateAction) + { + case WTD_STATEACTION_IGNORE: + err = WINTRUST_CertVerifyAndClose(hwnd, actionID, data); + break; + case WTD_STATEACTION_VERIFY: + err = WINTRUST_CertVerify(hwnd, actionID, data); + break; + case WTD_STATEACTION_CLOSE: + err = WINTRUST_DefaultClose(hwnd, actionID, data); + break; + default: + FIXME("unimplemented for %d\n", data->dwStateAction); + } + return err; +} + static void dump_file_info(WINTRUST_FILE_INFO *pFile) { TRACE("%p\n", pFile); @@ -402,6 +581,7 @@ LONG WINAPI WinVerifyTrust( HWND hwnd, GUID *ActionID, LPVOID ActionData ) static const GUID generic_verify_v2 = WINTRUST_ACTION_GENERIC_VERIFY_V2; static const GUID generic_cert_verify = WINTRUST_ACTION_GENERIC_CERT_VERIFY; static const GUID generic_chain_verify = WINTRUST_ACTION_GENERIC_CHAIN_VERIFY; + static const GUID cert_action_verify = CERT_CERTIFICATE_ACTION_VERIFY; LONG err = ERROR_SUCCESS; WINTRUST_DATA *actionData = (WINTRUST_DATA *)ActionData; @@ -411,6 +591,8 @@ LONG WINAPI WinVerifyTrust( HWND hwnd, GUID *ActionID, LPVOID ActionData ) /* Support for known old-style callers: */ if (IsEqualGUID(ActionID, &published_software)) err = WINTRUST_PublishedSoftware(hwnd, ActionID, ActionData); + else if (IsEqualGUID(ActionID, &cert_action_verify)) + err = WINTRUST_CertActionVerify(hwnd, ActionID, ActionData); else { DWORD stateAction;

1 0

Juan Lang : cryptdlg: Implement CertViewPropertiesA on top of CertViewPropertiesW.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: f422fa83d22635a3ae13a8f34ae62b2581dfcc93 URL: http://source.winehq.org/git/wine.git/?a=commit;h=f422fa83d22635a3ae13a8f34… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 11:06:58 2008 -0700 cryptdlg: Implement CertViewPropertiesA on top of CertViewPropertiesW. --- dlls/cryptdlg/main.c | 30 ++++++++++++++++++++++++++++-- 1 files changed, 28 insertions(+), 2 deletions(-) diff --git a/dlls/cryptdlg/main.c b/dlls/cryptdlg/main.c index 2447c38..943794a 100644 --- a/dlls/cryptdlg/main.c +++ b/dlls/cryptdlg/main.c @@ -22,6 +22,7 @@ #include "windef.h" #include "winbase.h" +#include "winnls.h" #include "wincrypt.h" #include "wintrust.h" #include "winuser.h" @@ -110,8 +111,33 @@ HRESULT WINAPI CertTrustFinalPolicy(CRYPT_PROVIDER_DATA *pProvData) */ BOOL WINAPI CertViewPropertiesA(CERT_VIEWPROPERTIES_STRUCT_A *info) { - FIXME("(%p): stub\n", info); - return FALSE; + CERT_VIEWPROPERTIES_STRUCT_W infoW; + LPWSTR title = NULL; + BOOL ret; + + TRACE("(%p)\n", info); + + memcpy(&infoW, info, sizeof(infoW)); + if (info->szTitle) + { + int len = MultiByteToWideChar(CP_ACP, 0, info->szTitle, -1, NULL, 0); + + title = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR)); + if (title) + { + MultiByteToWideChar(CP_ACP, 0, info->szTitle, -1, title, len); + infoW.szTitle = title; + } + else + { + ret = FALSE; + goto error; + } + } + ret = CertViewPropertiesW(&infoW); + HeapFree(GetProcessHeap(), 0, title); +error: + return ret; } /***********************************************************************

1 0

Juan Lang : wintrust: Check that the end certificate in the chain isn' t disallowed to match native behavior.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: 036128842a2945e2e1b048abbbfe470efed47303 URL: http://source.winehq.org/git/wine.git/?a=commit;h=036128842a2945e2e1b048abb… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 13:19:59 2008 -0700 wintrust: Check that the end certificate in the chain isn't disallowed to match native behavior. --- dlls/wintrust/softpub.c | 75 +++++++++++++++++++++++++++++++++------------- 1 files changed, 54 insertions(+), 21 deletions(-) diff --git a/dlls/wintrust/softpub.c b/dlls/wintrust/softpub.c index 06238b2..52df73d 100644 --- a/dlls/wintrust/softpub.c +++ b/dlls/wintrust/softpub.c @@ -784,27 +784,60 @@ HRESULT WINAPI SoftpubAuthenticode(CRYPT_PROVIDER_DATA *data) ret = TRUE; for (i = 0; ret && i < data->csSigners; i++) { - CERT_CHAIN_POLICY_PARA policyPara = { sizeof(policyPara), 0 }; - - if (data->dwRegPolicySettings & WTPF_TRUSTTEST) - policyPara.dwFlags |= CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG; - if (data->dwRegPolicySettings & WTPF_TESTCANBEVALID) - policyPara.dwFlags |= CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG; - if (data->dwRegPolicySettings & WTPF_IGNOREEXPIRATION) - policyPara.dwFlags |= - CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG | - CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG | - CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG; - if (data->dwRegPolicySettings & WTPF_IGNOREREVOKATION) - policyPara.dwFlags |= - CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG | - CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG | - CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG | - CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG; - CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_AUTHENTICODE, - data->pasSigners[i].pChainContext, &policyPara, &policyStatus); - if (policyStatus.dwError != NO_ERROR) - ret = FALSE; + BYTE hash[20]; + DWORD size = sizeof(hash); + + /* First make sure cert isn't disallowed */ + if ((ret = CertGetCertificateContextProperty( + data->pasSigners[i].pasCertChain[0].pCert, + CERT_SIGNATURE_HASH_PROP_ID, hash, &size))) + { + static const WCHAR disallowedW[] = + { 'D','i','s','a','l','l','o','w','e','d',0 }; + HCERTSTORE disallowed = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, + X509_ASN_ENCODING, 0, CERT_SYSTEM_STORE_CURRENT_USER, + disallowedW); + + if (disallowed) + { + PCCERT_CONTEXT found = CertFindCertificateInStore( + disallowed, X509_ASN_ENCODING, 0, CERT_FIND_SIGNATURE_HASH, + hash, NULL); + + if (found) + { + /* Disallowed! Can't verify it. */ + policyStatus.dwError = TRUST_E_SUBJECT_NOT_TRUSTED; + ret = FALSE; + CertFreeCertificateContext(found); + } + CertCloseStore(disallowed, 0); + } + } + if (ret) + { + CERT_CHAIN_POLICY_PARA policyPara = { sizeof(policyPara), 0 }; + + if (data->dwRegPolicySettings & WTPF_TRUSTTEST) + policyPara.dwFlags |= CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG; + if (data->dwRegPolicySettings & WTPF_TESTCANBEVALID) + policyPara.dwFlags |= CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG; + if (data->dwRegPolicySettings & WTPF_IGNOREEXPIRATION) + policyPara.dwFlags |= + CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG | + CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG | + CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG; + if (data->dwRegPolicySettings & WTPF_IGNOREREVOKATION) + policyPara.dwFlags |= + CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG | + CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG | + CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG | + CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG; + CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_AUTHENTICODE, + data->pasSigners[i].pChainContext, &policyPara, &policyStatus); + if (policyStatus.dwError != NO_ERROR) + ret = FALSE; + } } } if (!ret)

1 0

Juan Lang : wintrust: Only do policy check if pointer is set.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: 2844cb5a65d2b045a2f53e5dee4971c3a42d95b6 URL: http://source.winehq.org/git/wine.git/?a=commit;h=2844cb5a65d2b045a2f53e5de… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 13:19:24 2008 -0700 wintrust: Only do policy check if pointer is set. --- dlls/wintrust/softpub.c | 9 +++++++-- 1 files changed, 7 insertions(+), 2 deletions(-) diff --git a/dlls/wintrust/softpub.c b/dlls/wintrust/softpub.c index 19a468c..06238b2 100644 --- a/dlls/wintrust/softpub.c +++ b/dlls/wintrust/softpub.c @@ -665,8 +665,13 @@ static BOOL WINTRUST_CreateChainForSigner(CRYPT_PROVIDER_DATA *data, else { if ((ret = WINTRUST_CopyChain(data, signer))) - ret = data->psPfns->pfnCertCheckPolicy(data, signer, FALSE, - 0); + { + if (data->psPfns->pfnCertCheckPolicy) + ret = data->psPfns->pfnCertCheckPolicy(data, signer, + FALSE, 0); + else + TRACE("no cert check policy, skipping policy check\n"); + } } } }

1 0

Juan Lang : wintrust: Use helper function to add the trust steps to execute .
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: f3ba89f94864c15c75bda7ea104062e20ca2e4c5 URL: http://source.winehq.org/git/wine.git/?a=commit;h=f3ba89f94864c15c75bda7ea1… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 13:18:57 2008 -0700 wintrust: Use helper function to add the trust steps to execute. --- dlls/wintrust/wintrust_main.c | 63 ++++++++++++++++++++++++---------------- 1 files changed, 38 insertions(+), 25 deletions(-) diff --git a/dlls/wintrust/wintrust_main.c b/dlls/wintrust/wintrust_main.c index 9da584c..a1893d3 100644 --- a/dlls/wintrust/wintrust_main.c +++ b/dlls/wintrust/wintrust_main.c @@ -125,6 +125,42 @@ oom: return NULL; } +/* Adds trust steps for each function in psPfns. Assumes steps has at least + * 5 entries. Returns the number of steps added. + */ +static DWORD WINTRUST_AddTrustStepsFromFunctions(struct wintrust_step *steps, + const CRYPT_PROVIDER_FUNCTIONS *psPfns) +{ + DWORD numSteps = 0; + + if (psPfns->pfnInitialize) + { + steps[numSteps].func = psPfns->pfnInitialize; + steps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_WVTINIT; + } + if (psPfns->pfnObjectTrust) + { + steps[numSteps].func = psPfns->pfnObjectTrust; + steps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_OBJPROV; + } + if (psPfns->pfnSignatureTrust) + { + steps[numSteps].func = psPfns->pfnSignatureTrust; + steps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_SIGPROV; + } + if (psPfns->pfnCertificateTrust) + { + steps[numSteps].func = psPfns->pfnCertificateTrust; + steps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_CERTPROV; + } + if (psPfns->pfnFinalPolicy) + { + steps[numSteps].func = psPfns->pfnFinalPolicy; + steps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_POLICYPROV; + } + return numSteps; +} + static LONG WINTRUST_DefaultVerify(HWND hwnd, GUID *actionID, WINTRUST_DATA *data) { @@ -155,31 +191,8 @@ static LONG WINTRUST_DefaultVerify(HWND hwnd, GUID *actionID, provData->pgActionID = actionID; WintrustGetRegPolicyFlags(&provData->dwRegPolicySettings); - if (provData->psPfns->pfnInitialize) - { - verifySteps[numSteps].func = provData->psPfns->pfnInitialize; - verifySteps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_WVTINIT; - } - if (provData->psPfns->pfnObjectTrust) - { - verifySteps[numSteps].func = provData->psPfns->pfnObjectTrust; - verifySteps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_OBJPROV; - } - if (provData->psPfns->pfnSignatureTrust) - { - verifySteps[numSteps].func = provData->psPfns->pfnSignatureTrust; - verifySteps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_SIGPROV; - } - if (provData->psPfns->pfnCertificateTrust) - { - verifySteps[numSteps].func = provData->psPfns->pfnCertificateTrust; - verifySteps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_CERTPROV; - } - if (provData->psPfns->pfnFinalPolicy) - { - verifySteps[numSteps].func = provData->psPfns->pfnFinalPolicy; - verifySteps[numSteps++].error_index = TRUSTERROR_STEP_FINAL_POLICYPROV; - } + numSteps = WINTRUST_AddTrustStepsFromFunctions(verifySteps, + provData->psPfns); err = WINTRUST_ExecuteSteps(verifySteps, numSteps, provData); goto done;

1 0

Juan Lang : wintrust: Use helper function to allocate CRYPT_PROVIDER_DATA.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: a74aab75166d57b6be7f54d157bedcf3ba8df2d0 URL: http://source.winehq.org/git/wine.git/?a=commit;h=a74aab75166d57b6be7f54d15… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 13:18:16 2008 -0700 wintrust: Use helper function to allocate CRYPT_PROVIDER_DATA. --- dlls/wintrust/wintrust_main.c | 37 ++++++++++++++++++++++++++++--------- 1 files changed, 28 insertions(+), 9 deletions(-) diff --git a/dlls/wintrust/wintrust_main.c b/dlls/wintrust/wintrust_main.c index 84bd2aa..9da584c 100644 --- a/dlls/wintrust/wintrust_main.c +++ b/dlls/wintrust/wintrust_main.c @@ -88,15 +88,9 @@ static DWORD WINTRUST_ExecuteSteps(const struct wintrust_step *steps, return err; } -static LONG WINTRUST_DefaultVerify(HWND hwnd, GUID *actionID, - WINTRUST_DATA *data) +static CRYPT_PROVIDER_DATA *WINTRUST_AllocateProviderData(void) { - DWORD err = ERROR_SUCCESS, numSteps = 0; CRYPT_PROVIDER_DATA *provData; - BOOL ret; - struct wintrust_step verifySteps[5]; - - TRACE("(%p, %s, %p)\n", hwnd, debugstr_guid(actionID), data); provData = WINTRUST_Alloc(sizeof(CRYPT_PROVIDER_DATA)); if (!provData) @@ -118,6 +112,33 @@ static LONG WINTRUST_DefaultVerify(HWND hwnd, GUID *actionID, if (!provData->psPfns) goto oom; provData->psPfns->cbStruct = sizeof(CRYPT_PROVIDER_FUNCTIONS); + return provData; + +oom: + if (provData) + { + WINTRUST_Free(provData->padwTrustStepErrors); + WINTRUST_Free(provData->u.pPDSip); + WINTRUST_Free(provData->psPfns); + WINTRUST_Free(provData); + } + return NULL; +} + +static LONG WINTRUST_DefaultVerify(HWND hwnd, GUID *actionID, + WINTRUST_DATA *data) +{ + DWORD err = ERROR_SUCCESS, numSteps = 0; + CRYPT_PROVIDER_DATA *provData; + BOOL ret; + struct wintrust_step verifySteps[5]; + + TRACE("(%p, %s, %p)\n", hwnd, debugstr_guid(actionID), data); + + provData = WINTRUST_AllocateProviderData(); + if (!provData) + return ERROR_OUTOFMEMORY; + ret = WintrustLoadFunctionPointers(actionID, provData->psPfns); if (!ret) { @@ -162,8 +183,6 @@ static LONG WINTRUST_DefaultVerify(HWND hwnd, GUID *actionID, err = WINTRUST_ExecuteSteps(verifySteps, numSteps, provData); goto done; -oom: - err = ERROR_OUTOFMEMORY; error: if (provData) {

1 0

Juan Lang : wintrust: Always initialize CERT_CHAIN_PARA's RequestedUsage.
by Alexandre Julliard Sept. 23, 2008

Sept. 23, 2008

Module: wine Branch: master Commit: 30547a45e23367a1be06dc98c1ace1ed3e2621b0 URL: http://source.winehq.org/git/wine.git/?a=commit;h=30547a45e23367a1be06dc98c… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Sep 22 11:42:59 2008 -0700 wintrust: Always initialize CERT_CHAIN_PARA's RequestedUsage. --- dlls/wintrust/softpub.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/dlls/wintrust/softpub.c b/dlls/wintrust/softpub.c index 4b7eadc..19a468c 100644 --- a/dlls/wintrust/softpub.c +++ b/dlls/wintrust/softpub.c @@ -606,6 +606,11 @@ static void WINTRUST_CreateChainPolicyCreateInfo( chainPara->cbSize = sizeof(CERT_CHAIN_PARA); if (data->pRequestUsage) chainPara->RequestedUsage = *data->pRequestUsage; + else + { + chainPara->RequestedUsage.dwType = 0; + chainPara->RequestedUsage.Usage.cUsageIdentifier = 0; + } info->u.cbSize = sizeof(WTD_GENERIC_CHAIN_POLICY_CREATE_INFO); info->hChainEngine = NULL; info->pChainPara = chainPara;

1 0