November 2009 - Wine-Commits

Juan Lang : crypt32: Reject certificates whose fields don' t match their versions.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: 216df7a714967a02e6eded40f0de8782e1e5da2b URL: http://source.winehq.org/git/wine.git/?a=commit;h=216df7a714967a02e6eded40f… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 6 14:38:40 2009 -0800 crypt32: Reject certificates whose fields don't match their versions. --- dlls/crypt32/chain.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 47 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 76052b2..26627e2 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -1311,6 +1311,45 @@ static BOOL CRYPT_CriticalExtensionsSupported(PCCERT_CONTEXT cert) return ret; } +static BOOL CRYPT_IsCertVersionValid(PCCERT_CONTEXT cert) +{ + BOOL ret = TRUE; + + /* Checks whether the contents of the cert match the cert's version. */ + switch (cert->pCertInfo->dwVersion) + { + case CERT_V1: + /* A V1 cert may not contain unique identifiers. See RFC 5280, + * section 4.1.2.8: + * "These fields MUST only appear if the version is 2 or 3 (Section + * 4.1.2.1). These fields MUST NOT appear if the version is 1." + */ + if (cert->pCertInfo->IssuerUniqueId.cbData || + cert->pCertInfo->SubjectUniqueId.cbData) + ret = FALSE; + /* A V1 cert may not contain extensions. See RFC 5280, section 4.1.2.9: + * "This field MUST only appear if the version is 3 (Section 4.1.2.1)." + */ + if (cert->pCertInfo->cExtension) + ret = FALSE; + break; + case CERT_V2: + /* A V2 cert may not contain extensions. See RFC 5280, section 4.1.2.9: + * "This field MUST only appear if the version is 3 (Section 4.1.2.1)." + */ + if (cert->pCertInfo->cExtension) + ret = FALSE; + break; + case CERT_V3: + /* Do nothing, all fields are allowed for V3 certs */ + break; + default: + WARN_(chain)("invalid cert version %d\n", cert->pCertInfo->dwVersion); + ret = FALSE; + } + return ret; +} + static void CRYPT_CheckSimpleChain(PCertificateChainEngine engine, PCERT_SIMPLE_CHAIN chain, LPFILETIME time) { @@ -1332,6 +1371,14 @@ static void CRYPT_CheckSimpleChain(PCertificateChainEngine engine, chain->rgpElement[i]->pCertContext); else isRoot = FALSE; + if (!CRYPT_IsCertVersionValid(chain->rgpElement[i]->pCertContext)) + { + /* MS appears to accept certs whose versions don't match their + * contents, so there isn't an appropriate error code. + */ + chain->rgpElement[i]->TrustStatus.dwErrorStatus |= + CERT_TRUST_INVALID_EXTENSION; + } if (CertVerifyTimeValidity(time, chain->rgpElement[i]->pCertContext->pCertInfo) != 0) chain->rgpElement[i]->TrustStatus.dwErrorStatus |=

1 0

Juan Lang : crypt32: Test encoding and decoding name values with embedded NULLs.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: 6a3901f04b40b757985606a89893d643a0d5bf06 URL: http://source.winehq.org/git/wine.git/?a=commit;h=6a3901f04b40b757985606a89… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Nov 9 15:57:37 2009 -0800 crypt32: Test encoding and decoding name values with embedded NULLs. --- dlls/crypt32/tests/encode.c | 37 +++++++++++++++++++++++++++++++++++++ 1 files changed, 37 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/tests/encode.c b/dlls/crypt32/tests/encode.c index 6e6c6f3..47a7b9b 100644 --- a/dlls/crypt32/tests/encode.c +++ b/dlls/crypt32/tests/encode.c @@ -1264,6 +1264,9 @@ static BYTE bmpCommonNameValue[] = { 0x61,0x00,0x6e,0x00,0x67,0x00,0x00 }; static BYTE utf8CommonNameValue[] = { 0x0c,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 }; +static char embedded_null[] = "foo\0com"; +static BYTE ia5EmbeddedNull[] = { + 0x16,0x07,0x66,0x6f,0x6f,0x00,0x63,0x6f,0x6d }; static struct EncodedNameValue nameValues[] = { { { CERT_RDN_OCTET_STRING, { sizeof(commonName), (BYTE *)commonName } }, @@ -1299,6 +1302,12 @@ static struct EncodedNameValue nameValues[] = { { { CERT_RDN_NUMERIC_STRING, { sizeof(bogusNumeric), (BYTE *)bogusNumeric } }, bin44, sizeof(bin44) }, }; +/* This is kept separate, because the decoding doesn't return to the original + * value. + */ +static struct EncodedNameValue embeddedNullNameValue = { + { CERT_RDN_IA5_STRING, { sizeof(embedded_null) - 1, (BYTE *)embedded_null } }, + ia5EmbeddedNull, sizeof(ia5EmbeddedNull) }; static void test_encodeNameValue(DWORD dwEncoding) { @@ -1337,6 +1346,19 @@ static void test_encodeNameValue(DWORD dwEncoding) LocalFree(buf); } } + ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME_VALUE, + &embeddedNullNameValue.value, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size); + ok(ret || broken(GetLastError() == OSS_PDU_MISMATCH) /* NT4/Win9x */, + "Type %d: CryptEncodeObjectEx failed: %08x\n", + embeddedNullNameValue.value.dwValueType, GetLastError()); + if (ret) + { + ok(size == embeddedNullNameValue.encodedSize, + "Expected size %d, got %d\n", embeddedNullNameValue.encodedSize, size); + ok(!memcmp(buf, embeddedNullNameValue.encoded, size), + "Got unexpected encoding\n"); + LocalFree(buf); + } } static void test_decodeNameValue(DWORD dwEncoding) @@ -1361,6 +1383,21 @@ static void test_decodeNameValue(DWORD dwEncoding) LocalFree(buf); } } + ret = pCryptDecodeObjectEx(dwEncoding, X509_NAME_VALUE, + embeddedNullNameValue.encoded, embeddedNullNameValue.encodedSize, + CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL, + &buf, &bufSize); + ok(ret, "Value type %d: CryptDecodeObjectEx failed: %08x\n", + embeddedNullNameValue.value.dwValueType, GetLastError()); + if (ret) + { + CERT_NAME_VALUE value = { CERT_RDN_ENCODED_BLOB, + { sizeof(ia5EmbeddedNull), ia5EmbeddedNull } }; + + todo_wine + compareNameValues(&value, (const CERT_NAME_VALUE *)buf); + LocalFree(buf); + } } static const BYTE emptyURL[] = { 0x30, 0x02, 0x86, 0x00 };

1 0

Juan Lang : crypt32: Test decoding alternate names with embedded NULLs.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: ddf78bdb3875ba58b996acb2888d8d630d94a93e URL: http://source.winehq.org/git/wine.git/?a=commit;h=ddf78bdb3875ba58b996acb28… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Nov 9 15:58:58 2009 -0800 crypt32: Test decoding alternate names with embedded NULLs. --- dlls/crypt32/tests/encode.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 files changed, 38 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/tests/encode.c b/dlls/crypt32/tests/encode.c index 47a7b9b..09402de 100644 --- a/dlls/crypt32/tests/encode.c +++ b/dlls/crypt32/tests/encode.c @@ -1541,6 +1541,12 @@ static void test_decodeAltName(DWORD dwEncoding) 0x00, 0x00, 0x01 }; static const BYTE bogusType[] = { 0x30, 0x06, 0x89, 0x04, 0x7f, 0x00, 0x00, 0x01 }; + static const BYTE dns_embedded_null[] = { 0x30,0x10,0x82,0x0e,0x66,0x6f, + 0x6f,0x2e,0x63,0x6f,0x6d,0x00,0x62,0x61,0x64,0x64,0x69,0x65 }; + static const BYTE dns_embedded_bell[] = { 0x30,0x10,0x82,0x0e,0x66,0x6f, + 0x6f,0x2e,0x63,0x6f,0x6d,0x07,0x62,0x61,0x64,0x64,0x69,0x65 }; + static const BYTE url_embedded_null[] = { 0x30,0x10,0x86,0x0e,0x66,0x6f, + 0x6f,0x2e,0x63,0x6f,0x6d,0x00,0x62,0x61,0x64,0x64,0x69,0x65 }; BOOL ret; BYTE *buf = NULL; DWORD bufSize = 0; @@ -1679,6 +1685,38 @@ static void test_decodeAltName(DWORD dwEncoding) "Unexpected directory name value\n"); LocalFree(buf); } + ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, + dns_embedded_null, sizeof(dns_embedded_null), CRYPT_DECODE_ALLOC_FLAG, + NULL, &buf, &bufSize); + /* Fails on WinXP with CRYPT_E_ASN1_RULE. I'm not too concerned about the + * particular failure, just that it doesn't decode. + */ + todo_wine + ok(!ret, "expected failure\n"); + /* An embedded bell character is allowed, however. */ + ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, + dns_embedded_bell, sizeof(dns_embedded_bell), CRYPT_DECODE_ALLOC_FLAG, + NULL, &buf, &bufSize); + ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError()); + if (ret) + { + info = (CERT_ALT_NAME_INFO *)buf; + + ok(info->cAltEntry == 1, "Expected 1 entries, got %d\n", + info->cAltEntry); + ok(info->rgAltEntry[0].dwAltNameChoice == CERT_ALT_NAME_DNS_NAME, + "Expected CERT_ALT_NAME_DNS_NAME, got %d\n", + info->rgAltEntry[0].dwAltNameChoice); + LocalFree(buf); + } + ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, + url_embedded_null, sizeof(dns_embedded_null), CRYPT_DECODE_ALLOC_FLAG, + NULL, &buf, &bufSize); + /* Again, fails on WinXP with CRYPT_E_ASN1_RULE. I'm not too concerned + * about the particular failure, just that it doesn't decode. + */ + todo_wine + ok(!ret, "expected failure\n"); } struct UnicodeExpectedError

1 0

Juan Lang : crypt32: Fix decoding names when CRYPT_DECODE_ALLOC_FLAG is not specified.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: e7404ba24fb12ed5216b7e201fad20e9aa7478e6 URL: http://source.winehq.org/git/wine.git/?a=commit;h=e7404ba24fb12ed5216b7e201… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 6 17:59:09 2009 -0800 crypt32: Fix decoding names when CRYPT_DECODE_ALLOC_FLAG is not specified. --- dlls/crypt32/decode.c | 23 ++++++++++++++++++++++- 1 files changed, 22 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/decode.c b/dlls/crypt32/decode.c index 190aa27..090ab59 100644 --- a/dlls/crypt32/decode.c +++ b/dlls/crypt32/decode.c @@ -1906,9 +1906,30 @@ static BOOL WINAPI CRYPT_AsnDecodeName(DWORD dwCertEncodingType, sizeof(CERT_NAME_INFO), CRYPT_AsnDecodeRdn, sizeof(CERT_RDN), TRUE, offsetof(CERT_RDN, rgRDNAttr) }; + DWORD bytesNeeded; ret = CRYPT_AsnDecodeArray(&arrayDesc, pbEncoded, cbEncoded, - dwFlags, pDecodePara, pvStructInfo, pcbStructInfo, NULL); + dwFlags & ~CRYPT_DECODE_ALLOC_FLAG, NULL, NULL, &bytesNeeded, + NULL); + if (ret) + { + if (!pvStructInfo) + *pcbStructInfo = bytesNeeded; + else if ((ret = CRYPT_DecodeEnsureSpace(dwFlags, pDecodePara, + pvStructInfo, pcbStructInfo, bytesNeeded))) + { + CERT_NAME_INFO *info; + + if (dwFlags & CRYPT_DECODE_ALLOC_FLAG) + pvStructInfo = *(BYTE **)pvStructInfo; + info = pvStructInfo; + info->rgRDN = (CERT_RDN *)((BYTE *)pvStructInfo + + sizeof(CERT_NAME_INFO)); + ret = CRYPT_AsnDecodeArray(&arrayDesc, pbEncoded, cbEncoded, + dwFlags & ~CRYPT_DECODE_ALLOC_FLAG, NULL, pvStructInfo, + &bytesNeeded, NULL); + } + } } __EXCEPT_PAGE_FAULT {

1 0

Juan Lang : crypt32: Add more tests of name constraints.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: ef6ce9a5904b7c0a57077f83019188a380c9cdf5 URL: http://source.winehq.org/git/wine.git/?a=commit;h=ef6ce9a5904b7c0a57077f830… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Nov 9 16:15:20 2009 -0800 crypt32: Add more tests of name constraints. --- dlls/crypt32/tests/chain.c | 852 ++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 852 insertions(+), 0 deletions(-) Diff: http://source.winehq.org/git/wine.git/?a=commitdiff;h=ef6ce9a5904b7c0a57077…

1 0

Juan Lang : crypt32: Forbid minimum or maximum fields in name constraints.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: 9fe6be454f85d9770e79ee4b3111863cdd56487c URL: http://source.winehq.org/git/wine.git/?a=commit;h=9fe6be454f85d9770e79ee4b3… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 6 13:56:09 2009 -0800 crypt32: Forbid minimum or maximum fields in name constraints. --- dlls/crypt32/chain.c | 66 ++++++++++++++++++++++++++++++++++++++++---------- 1 files changed, 53 insertions(+), 13 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 5323ac4..76052b2 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -728,6 +728,40 @@ static CERT_NAME_CONSTRAINTS_INFO *CRYPT_GetNameConstraints(CERT_INFO *cert) return info; } +static BOOL CRYPT_IsValidNameConstraint(const CERT_NAME_CONSTRAINTS_INFO *info) +{ + DWORD i; + BOOL ret = TRUE; + + /* Check that none of the constraints specifies a minimum or a maximum. + * See RFC 5280, section 4.2.1.10: + * "Within this profile, the minimum and maximum fields are not used with + * any name forms, thus, the minimum MUST be zero, and maximum MUST be + * absent. However, if an application encounters a critical name + * constraints extension that specifies other values for minimum or + * maximum for a name form that appears in a subsequent certificate, the + * application MUST either process these fields or reject the + * certificate." + * Since it gives no guidance as to how to process these fields, we + * reject any name constraint that contains them. + */ + for (i = 0; ret && i < info->cPermittedSubtree; i++) + if (info->rgPermittedSubtree[i].dwMinimum || + info->rgPermittedSubtree[i].fMaximum) + { + TRACE_(chain)("found a minimum or maximum in permitted subtrees\n"); + ret = FALSE; + } + for (i = 0; ret && i < info->cExcludedSubtree; i++) + if (info->rgExcludedSubtree[i].dwMinimum || + info->rgExcludedSubtree[i].fMaximum) + { + TRACE_(chain)("found a minimum or maximum in excluded subtrees\n"); + ret = FALSE; + } + return ret; +} + static void CRYPT_CheckChainNameConstraints(PCERT_SIMPLE_CHAIN chain) { int i, j; @@ -751,21 +785,27 @@ static void CRYPT_CheckChainNameConstraints(PCERT_SIMPLE_CHAIN chain) if ((nameConstraints = CRYPT_GetNameConstraints( chain->rgpElement[i]->pCertContext->pCertInfo))) { - for (j = i - 1; j >= 0; j--) + if (!CRYPT_IsValidNameConstraint(nameConstraints)) + chain->rgpElement[i]->TrustStatus.dwErrorStatus |= + CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT; + else { - DWORD errorStatus = 0; - - /* According to RFC 3280, self-signed certs don't have name - * constraints checked unless they're the end cert. - */ - if (j == 0 || !CRYPT_IsCertificateSelfSigned( - chain->rgpElement[j]->pCertContext)) + for (j = i - 1; j >= 0; j--) { - CRYPT_CheckNameConstraints(nameConstraints, - chain->rgpElement[i]->pCertContext->pCertInfo, - &errorStatus); - chain->rgpElement[i]->TrustStatus.dwErrorStatus |= - errorStatus; + DWORD errorStatus = 0; + + /* According to RFC 3280, self-signed certs don't have name + * constraints checked unless they're the end cert. + */ + if (j == 0 || !CRYPT_IsCertificateSelfSigned( + chain->rgpElement[j]->pCertContext)) + { + CRYPT_CheckNameConstraints(nameConstraints, + chain->rgpElement[i]->pCertContext->pCertInfo, + &errorStatus); + chain->rgpElement[i]->TrustStatus.dwErrorStatus |= + errorStatus; + } } } LocalFree(nameConstraints);

1 0

Juan Lang : crypt32: Test more chains against different policies.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: a5361e45de953123271748c861926da962d37a9d URL: http://source.winehq.org/git/wine.git/?a=commit;h=a5361e45de953123271748c86… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Nov 9 16:11:58 2009 -0800 crypt32: Test more chains against different policies. --- dlls/crypt32/tests/chain.c | 48 ++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 48 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 581219a..73c161c 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -2156,6 +2156,18 @@ static const ChainPolicyCheck basePolicyCheck[] = { { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, { { sizeof(chain12) / sizeof(chain12[0]), chain12 }, { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain13) / sizeof(chain13[0]), chain13 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain14) / sizeof(chain14[0]), chain14 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain15) / sizeof(chain15[0]), chain15 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain16) / sizeof(chain16[0]), chain16 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain17) / sizeof(chain17[0]), chain17 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 }, + { { sizeof(chain18) / sizeof(chain18[0]), chain18 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 }, { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain }, { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 }, }; @@ -2187,6 +2199,18 @@ static const ChainPolicyCheck sslPolicyCheck[] = { { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, { { sizeof(chain12) / sizeof(chain12[0]), chain12 }, { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain13) / sizeof(chain13[0]), chain13 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain14) / sizeof(chain14[0]), chain14 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain15) / sizeof(chain15[0]), chain15 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain16) / sizeof(chain16[0]), chain16 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain17) / sizeof(chain17[0]), chain17 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 }, + { { sizeof(chain18) / sizeof(chain18[0]), chain18 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 }, { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain }, { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 }, }; @@ -2237,6 +2261,18 @@ static const ChainPolicyCheck authenticodePolicyCheck[] = { { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, { { sizeof(chain12) / sizeof(chain12[0]), chain12 }, { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain13) / sizeof(chain13[0]), chain13 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain14) / sizeof(chain14[0]), chain14 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain15) / sizeof(chain15[0]), chain15 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain16) / sizeof(chain16[0]), chain16 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 }, + { { sizeof(chain17) / sizeof(chain17[0]), chain17 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 }, + { { sizeof(chain18) / sizeof(chain18[0]), chain18 }, + { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 }, { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain }, { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 }, }; @@ -2275,6 +2311,18 @@ static const ChainPolicyCheck basicConstraintsPolicyCheck[] = { { 0, 0, -1, -1, NULL }, NULL, 0 }, { { sizeof(chain12) / sizeof(chain12[0]), chain12 }, { 0, 0, -1, -1, NULL }, NULL, 0 }, + { { sizeof(chain13) / sizeof(chain13[0]), chain13 }, + { 0, 0, -1, -1, NULL }, NULL, 0 }, + { { sizeof(chain14) / sizeof(chain14[0]), chain14 }, + { 0, 0, -1, -1, NULL }, NULL, 0 }, + { { sizeof(chain15) / sizeof(chain15[0]), chain15 }, + { 0, 0, -1, -1, NULL }, NULL, 0 }, + { { sizeof(chain16) / sizeof(chain16[0]), chain16 }, + { 0, 0, -1, -1, NULL }, NULL, 0 }, + { { sizeof(chain17) / sizeof(chain17[0]), chain17 }, + { 0, 0, -1, -1, NULL }, NULL, 0 }, + { { sizeof(chain18) / sizeof(chain18[0]), chain18 }, + { 0, 0, -1, -1, NULL }, NULL, 0 }, { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain }, { 0, 0, -1, -1, NULL }, NULL, 0 }, };

1 0

Juan Lang : crypt32: Disallow embedded NULLs in alternate names.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: 25e8f27817b18ecfd276bcdbba3313cc35e844ff URL: http://source.winehq.org/git/wine.git/?a=commit;h=25e8f27817b18ecfd276bcdbb… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Nov 9 16:06:02 2009 -0800 crypt32: Disallow embedded NULLs in alternate names. --- dlls/crypt32/decode.c | 8 +++++++- dlls/crypt32/tests/encode.c | 2 -- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/dlls/crypt32/decode.c b/dlls/crypt32/decode.c index 090ab59..a16d89f 100644 --- a/dlls/crypt32/decode.c +++ b/dlls/crypt32/decode.c @@ -2990,7 +2990,13 @@ static BOOL CRYPT_AsnDecodeAltNameEntry(const BYTE *pbEncoded, DWORD cbEncoded, case 1: /* rfc822Name */ case 2: /* dNSName */ case 6: /* uniformResourceIdentifier */ - bytesNeeded += (dataLen + 1) * sizeof(WCHAR); + if (memchr(pbEncoded + 1 + lenBytes, 0, dataLen)) + { + SetLastError(CRYPT_E_ASN1_RULE); + ret = FALSE; + } + else + bytesNeeded += (dataLen + 1) * sizeof(WCHAR); break; case 4: /* directoryName */ case 7: /* iPAddress */ diff --git a/dlls/crypt32/tests/encode.c b/dlls/crypt32/tests/encode.c index 09402de..a46022b 100644 --- a/dlls/crypt32/tests/encode.c +++ b/dlls/crypt32/tests/encode.c @@ -1691,7 +1691,6 @@ static void test_decodeAltName(DWORD dwEncoding) /* Fails on WinXP with CRYPT_E_ASN1_RULE. I'm not too concerned about the * particular failure, just that it doesn't decode. */ - todo_wine ok(!ret, "expected failure\n"); /* An embedded bell character is allowed, however. */ ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, @@ -1715,7 +1714,6 @@ static void test_decodeAltName(DWORD dwEncoding) /* Again, fails on WinXP with CRYPT_E_ASN1_RULE. I'm not too concerned * about the particular failure, just that it doesn't decode. */ - todo_wine ok(!ret, "expected failure\n"); }

1 0

Juan Lang : wincrypt.h: Define szOID_INHIBIT_ANY_POLICY.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: 9495aa22bfe163c92a3dc7bcefdeab8903e8b046 URL: http://source.winehq.org/git/wine.git/?a=commit;h=9495aa22bfe163c92a3dc7bce… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 6 14:11:36 2009 -0800 wincrypt.h: Define szOID_INHIBIT_ANY_POLICY. --- include/wincrypt.h | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/include/wincrypt.h b/include/wincrypt.h index 4e2f60b..cbde406 100644 --- a/include/wincrypt.h +++ b/include/wincrypt.h @@ -2947,6 +2947,7 @@ typedef struct _CTL_FIND_SUBJECT_PARA #define szOID_POLICY_CONSTRAINTS "2.5.29.36" #define szOID_ENHANCED_KEY_USAGE "2.5.29.37" #define szOID_FRESHEST_CRL "2.5.29.46" +#define szOID_INHIBIT_ANY_POLICY "2.5.29.54" #define szOID_DOMAIN_COMPONENT "0.9.2342.19200300.100.1.25" #define szOID_PKCS_12_FRIENDLY_NAME_ATTR "1.2.840.113549.1.9.20" #define szOID_PKCS_12_LOCAL_KEY_ID "1.2.840.113549.1.9.21"

1 0

Juan Lang : crypt32: Fix decoding unicode names when CRYPT_DECODE_ALLOC_FLAG is not specified.
by Alexandre Julliard Nov. 10, 2009

Nov. 10, 2009

Module: wine Branch: master Commit: 6cefdef5018684e7154fd9832e44fa3698fedb23 URL: http://source.winehq.org/git/wine.git/?a=commit;h=6cefdef5018684e7154fd9832… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 6 17:57:40 2009 -0800 crypt32: Fix decoding unicode names when CRYPT_DECODE_ALLOC_FLAG is not specified. --- dlls/crypt32/decode.c | 23 ++++++++++++++++++++++- 1 files changed, 22 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/decode.c b/dlls/crypt32/decode.c index d6288b6..190aa27 100644 --- a/dlls/crypt32/decode.c +++ b/dlls/crypt32/decode.c @@ -1980,9 +1980,30 @@ static BOOL WINAPI CRYPT_AsnDecodeUnicodeName(DWORD dwCertEncodingType, sizeof(CERT_NAME_INFO), CRYPT_AsnDecodeUnicodeRdn, sizeof(CERT_RDN), TRUE, offsetof(CERT_RDN, rgRDNAttr) }; + DWORD bytesNeeded; ret = CRYPT_AsnDecodeArray(&arrayDesc, pbEncoded, cbEncoded, - dwFlags, pDecodePara, pvStructInfo, pcbStructInfo, NULL); + dwFlags & ~CRYPT_DECODE_ALLOC_FLAG, NULL, NULL, &bytesNeeded, + NULL); + if (ret) + { + if (!pvStructInfo) + *pcbStructInfo = bytesNeeded; + else if ((ret = CRYPT_DecodeEnsureSpace(dwFlags, pDecodePara, + pvStructInfo, pcbStructInfo, bytesNeeded))) + { + CERT_NAME_INFO *info; + + if (dwFlags & CRYPT_DECODE_ALLOC_FLAG) + pvStructInfo = *(BYTE **)pvStructInfo; + info = pvStructInfo; + info->rgRDN = (CERT_RDN *)((BYTE *)pvStructInfo + + sizeof(CERT_NAME_INFO)); + ret = CRYPT_AsnDecodeArray(&arrayDesc, pbEncoded, cbEncoded, + dwFlags & ~CRYPT_DECODE_ALLOC_FLAG, NULL, pvStructInfo, + &bytesNeeded, NULL); + } + } } __EXCEPT_PAGE_FAULT {

1 0