September 2010 - Wine-Commits

Juan Lang : crypt32: Honor more SECURITY_FLAG_IGNORE flags when verifying the SSL policy.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: d74c4f7c15d5da99d223a49810d6ad7a8b60ae86 URL: http://source.winehq.org/git/wine.git/?a=commit;h=d74c4f7c15d5da99d223a4981… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Sep 29 13:42:27 2010 -0700 crypt32: Honor more SECURITY_FLAG_IGNORE flags when verifying the SSL policy. --- dlls/crypt32/chain.c | 17 ++++++++++++----- dlls/crypt32/tests/chain.c | 10 ++-------- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 36ed1f3..fe6093d 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -3285,6 +3285,13 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, PCCERT_CHAIN_CONTEXT pChainContext, PCERT_CHAIN_POLICY_PARA pPolicyPara, PCERT_CHAIN_POLICY_STATUS pPolicyStatus) { + HTTPSPolicyCallbackData *sslPara = NULL; + DWORD checks = 0; + + if (pPolicyPara) + sslPara = pPolicyPara->pvExtraPolicyPara; + if (sslPara && sslPara->u.cbSize >= sizeof(HTTPSPolicyCallbackData)) + checks = sslPara->fdwChecks; pPolicyStatus->lChainIndex = pPolicyStatus->lElementIndex = -1; if (pChainContext->TrustStatus.dwErrorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID) @@ -3295,7 +3302,8 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, &pPolicyStatus->lElementIndex); } else if (pChainContext->TrustStatus.dwErrorStatus & - CERT_TRUST_IS_UNTRUSTED_ROOT) + CERT_TRUST_IS_UNTRUSTED_ROOT && + !(checks & SECURITY_FLAG_IGNORE_UNKNOWN_CA)) { pPolicyStatus->dwError = CERT_E_UNTRUSTEDROOT; find_element_with_error(pChainContext, @@ -3312,7 +3320,8 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, pPolicyStatus->lElementIndex = -1; } else if (pChainContext->TrustStatus.dwErrorStatus & - CERT_TRUST_IS_NOT_TIME_VALID) + CERT_TRUST_IS_NOT_TIME_VALID && + !(checks & SECURITY_FLAG_IGNORE_CERT_DATE_INVALID)) { pPolicyStatus->dwError = CERT_E_EXPIRED; find_element_with_error(pChainContext, @@ -3327,13 +3336,11 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, if (!pPolicyStatus->dwError && pPolicyPara && pPolicyPara->cbSize >= sizeof(CERT_CHAIN_POLICY_PARA)) { - HTTPSPolicyCallbackData *sslPara = pPolicyPara->pvExtraPolicyPara; - if (sslPara && sslPara->u.cbSize >= sizeof(HTTPSPolicyCallbackData)) { if (sslPara->dwAuthType == AUTHTYPE_SERVER && sslPara->pwszServerName && - !(sslPara->fdwChecks & SECURITY_FLAG_IGNORE_CERT_CN_INVALID)) + !(checks & SECURITY_FLAG_IGNORE_CERT_CN_INVALID)) { PCCERT_CONTEXT cert; PCERT_EXTENSION altNameExt; diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 5d24ac7..b3fd1c4 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -3790,7 +3790,7 @@ static const ChainPolicyCheck sslPolicyCheck[] = { static const ChainPolicyCheck ignoredUnknownCAPolicyCheck = { { sizeof(chain0) / sizeof(chain0[0]), chain0 }, - { 0, CERT_E_EXPIRED, 0, 0, NULL }, NULL, TODO_ERROR + { 0, CERT_E_EXPIRED, 0, 0, NULL }, NULL, 0 }; static const ChainPolicyCheck googlePolicyCheckWithMatchingNameExpired = { @@ -3798,11 +3798,6 @@ static const ChainPolicyCheck googlePolicyCheckWithMatchingNameExpired = { { 0, CERT_E_EXPIRED, 0, 0, NULL}, NULL, 0 }; -static const ChainPolicyCheck googlePolicyCheckWithMatchingNameIgnoringExpired = { - { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, - { 0, 0, -1, -1, NULL}, NULL, TODO_ERROR -}; - static const ChainPolicyCheck googlePolicyCheckWithMatchingName = { { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, { 0, 0, -1, -1, NULL}, NULL, 0 @@ -4157,8 +4152,7 @@ static void check_ssl_policy(void) */ sslPolicyPara.fdwChecks = SECURITY_FLAG_IGNORE_CERT_DATE_INVALID; checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, - &googlePolicyCheckWithMatchingNameIgnoringExpired, 0, &oct2007, - &policyPara); + &googlePolicyCheckWithMatchingName, 0, &oct2007, &policyPara); sslPolicyPara.fdwChecks = 0; /* And again, but checking the Google chain at a good date */ sslPolicyPara.pwszServerName = google_dot_com;

1 0

Stefan Leichter : setupapi: Added more tests for SetupDiGetINFClassA.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: 637fd3735ae7531468b5ee814fc61a32e3b4f313 URL: http://source.winehq.org/git/wine.git/?a=commit;h=637fd3735ae7531468b5ee814… Author: Stefan Leichter <Stefan.Leichter(a)camline.com> Date: Wed Sep 29 23:05:03 2010 +0200 setupapi: Added more tests for SetupDiGetINFClassA. --- dlls/setupapi/tests/devinst.c | 23 +++++++++++++++++++++++ 1 files changed, 23 insertions(+), 0 deletions(-) diff --git a/dlls/setupapi/tests/devinst.c b/dlls/setupapi/tests/devinst.c index 21fbb01..7005ef0 100644 --- a/dlls/setupapi/tests/devinst.c +++ b/dlls/setupapi/tests/devinst.c @@ -1443,11 +1443,32 @@ static void testSetupDiGetINFClassA(void) WritePrivateProfileStringA("Version", "Class", "WINE", filename); + count = 0xdeadbeef; retval = SetupDiGetINFClassA(filename, &guid, cn, MAX_PATH, &count); ok(retval, "expected SetupDiGetINFClassA to succeed! error %u\n", GetLastError()); + ok(count == 5, "expected count==5, got %u\n", count); + + count = 0xdeadbeef; + retval = SetupDiGetINFClassA(filename, &guid, cn, 5, &count); + ok(retval, "expected SetupDiGetINFClassA to succeed! error %u\n", GetLastError()); + ok(count == 5, "expected count==5, got %u\n", count); + + count = 0xdeadbeef; + SetLastError(0xdeadbeef); + retval = SetupDiGetINFClassA(filename, &guid, cn, 4, &count); + ok(!retval, "expected SetupDiGetINFClassA to fail!\n"); + ok(ERROR_INSUFFICIENT_BUFFER == GetLastError(), + "expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError()); + ok(count == 5, "expected count==5, got %u\n", count); /* invalid parameter */ SetLastError(0xdeadbeef); + retval = SetupDiGetINFClassA(NULL, &guid, cn, MAX_PATH, &count); + ok(!retval, "expected SetupDiGetINFClassA to fail!\n"); + ok(ERROR_INVALID_PARAMETER == GetLastError(), + "expected error ERROR_INVALID_PARAMETER, got %u\n", GetLastError()); + + SetLastError(0xdeadbeef); retval = SetupDiGetINFClassA(filename, NULL, cn, MAX_PATH, &count); ok(!retval, "expected SetupDiGetINFClassA to fail!\n"); ok(ERROR_INVALID_PARAMETER == GetLastError(), @@ -1485,8 +1506,10 @@ static void testSetupDiGetINFClassA(void) "{4d36e972-e325-11ce-bfc1-08002be10318}", filename); /* this test succeeds only if the guid is known to the system */ + count = 0xdeadbeef; retval = SetupDiGetINFClassA(filename, &guid, cn, MAX_PATH, &count); ok(retval, "expected SetupDiGetINFClassA to succeed! error %u\n", GetLastError()); + ok(count == 4, "expected count==4, got %u(%s)\n", count, cn); DeleteFileA(filename); }

1 0

Frédéric Delanoy : inetcpl.cpl: Update French translation.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: 4bf30d130fbe2ad7e19ab0adcd3da713111702f4 URL: http://source.winehq.org/git/wine.git/?a=commit;h=4bf30d130fbe2ad7e19ab0adc… Author: Frédéric Delanoy <frederic.delanoy(a)gmail.com> Date: Wed Sep 29 22:35:34 2010 +0200 inetcpl.cpl: Update French translation. --- dlls/inetcpl.cpl/cpl_Fr.rc | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/dlls/inetcpl.cpl/cpl_Fr.rc b/dlls/inetcpl.cpl/cpl_Fr.rc index aeedb73..5772321 100644 --- a/dlls/inetcpl.cpl/cpl_Fr.rc +++ b/dlls/inetcpl.cpl/cpl_Fr.rc @@ -32,3 +32,18 @@ BEGIN IDS_CPL_NAME "Paramètres Internet" IDS_CPL_INFO "Configurer le navigateur internet de Wine et d'autres paramètres associés" END + +/* "Content" propsheet */ +IDD_CONTENT DIALOG 0, 0, 320, 220 +STYLE WS_CAPTION | WS_CHILD | WS_DISABLED +FONT 8, "MS Shell Dlg" +CAPTION "Content" +BEGIN + + GROUPBOX " Certificats ", IDC_STATIC, 4, 4, 312, 50 + LTEXT "Les certificats sont utilisés pour votre identification personnelle, celle d'autorités de certification ou d'éditeurs.", + IDC_STATIC, 58, 14, 252, 18 + PUSHBUTTON "Certificats...", IDC_CERT, 146, 34, 80, 14 + PUSHBUTTON "Éditeurs...", IDC_CERT_PUBLISHER, 230, 34, 80, 14 + +END

1 0

Juan Lang : crypt32/tests: Test more SECURITY_FLAG_IGNORE flags for the SSL policy.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: 54429016eb68e81062e3cf20a23d348c9989d72b URL: http://source.winehq.org/git/wine.git/?a=commit;h=54429016eb68e81062e3cf20a… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Sep 29 13:39:34 2010 -0700 crypt32/tests: Test more SECURITY_FLAG_IGNORE flags for the SSL policy. --- dlls/crypt32/tests/chain.c | 25 +++++++++++++++++++++++++ 1 files changed, 25 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 707d62e..5d24ac7 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -3788,11 +3788,21 @@ static const ChainPolicyCheck sslPolicyCheck[] = { { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 }, }; +static const ChainPolicyCheck ignoredUnknownCAPolicyCheck = { + { sizeof(chain0) / sizeof(chain0[0]), chain0 }, + { 0, CERT_E_EXPIRED, 0, 0, NULL }, NULL, TODO_ERROR +}; + static const ChainPolicyCheck googlePolicyCheckWithMatchingNameExpired = { { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, { 0, CERT_E_EXPIRED, 0, 0, NULL}, NULL, 0 }; +static const ChainPolicyCheck googlePolicyCheckWithMatchingNameIgnoringExpired = { + { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, + { 0, 0, -1, -1, NULL}, NULL, TODO_ERROR +}; + static const ChainPolicyCheck googlePolicyCheckWithMatchingName = { { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, { 0, 0, -1, -1, NULL}, NULL, 0 @@ -4131,10 +4141,25 @@ static void check_ssl_policy(void) */ checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, &iTunesPolicyCheckWithoutMatchingName, 0, &oct2007, &policyPara); + /* And again, specifying a chain with an untrusted root, but ignoring + * unknown CAs. + */ + sslPolicyPara.fdwChecks = SECURITY_FLAG_IGNORE_UNKNOWN_CA; + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, + &ignoredUnknownCAPolicyCheck, 0, &oct2007, &policyPara); + sslPolicyPara.fdwChecks = 0; /* And again, but checking the Google chain at a bad date */ sslPolicyPara.pwszServerName = google_dot_com; checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, &googlePolicyCheckWithMatchingNameExpired, 0, &oct2007, &policyPara); + /* Again checking the Google chain at a bad date, but ignoring date + * errors. + */ + sslPolicyPara.fdwChecks = SECURITY_FLAG_IGNORE_CERT_DATE_INVALID; + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, + &googlePolicyCheckWithMatchingNameIgnoringExpired, 0, &oct2007, + &policyPara); + sslPolicyPara.fdwChecks = 0; /* And again, but checking the Google chain at a good date */ sslPolicyPara.pwszServerName = google_dot_com; checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL,

1 0

Gerald Pfeifer : setupx.dll16: Remove some unused code from VCP_CheckPaths.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: 90021f6ea5cc63da67315436ec8d013b68d8131b URL: http://source.winehq.org/git/wine.git/?a=commit;h=90021f6ea5cc63da67315436e… Author: Gerald Pfeifer <gerald(a)pfeifer.com> Date: Wed Sep 29 22:16:47 2010 +0200 setupx.dll16: Remove some unused code from VCP_CheckPaths. --- dlls/setupx.dll16/virtcopy.c | 7 +++---- 1 files changed, 3 insertions(+), 4 deletions(-) diff --git a/dlls/setupx.dll16/virtcopy.c b/dlls/setupx.dll16/virtcopy.c index 299041f..5137548 100644 --- a/dlls/setupx.dll16/virtcopy.c +++ b/dlls/setupx.dll16/virtcopy.c @@ -419,17 +419,16 @@ static RETERR16 VCP_CheckPaths(void) { DWORD n; LPVIRTNODE lpvn; - RETERR16 cbres; - cbres = VCP_Callback(&vcp_status, VCPM_VSTATPATHCHECKSTART, 0, 0, VCP_MsgRef); + VCP_Callback(&vcp_status, VCPM_VSTATPATHCHECKSTART, 0, 0, VCP_MsgRef); for (n = 0; n < vn_num; n++) { lpvn = pvnlist[n]; if (!lpvn) continue; /* FIXME: check paths of all VIRTNODEs here ! */ - cbres = VCP_Callback(&lpvn->vfsDst, VCPM_CHECKPATH, 0, (DWORD)lpvn, VCP_MsgRef); + VCP_Callback(&lpvn->vfsDst, VCPM_CHECKPATH, 0, (DWORD)lpvn, VCP_MsgRef); } - cbres = VCP_Callback(&vcp_status, VCPM_VSTATPATHCHECKEND, 0, 0, VCP_MsgRef); + VCP_Callback(&vcp_status, VCPM_VSTATPATHCHECKEND, 0, 0, VCP_MsgRef); return OK; }

1 0

Juan Lang : wininet: Don't retrieve a certificate that isn't used.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: 181a367a1f77ae3b88e0e36dcad7b0840b920de6 URL: http://source.winehq.org/git/wine.git/?a=commit;h=181a367a1f77ae3b88e0e36dc… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Sep 28 18:10:40 2010 -0700 wininet: Don't retrieve a certificate that isn't used. --- dlls/wininet/netconnection.c | 9 --------- 1 files changed, 0 insertions(+), 9 deletions(-) diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c index 9717b92..d6bd567 100644 --- a/dlls/wininet/netconnection.c +++ b/dlls/wininet/netconnection.c @@ -646,7 +646,6 @@ DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) DWORD res = ERROR_NOT_SUPPORTED; #ifdef SONAME_LIBSSL long verify_res; - X509 *cert; /* can't connect if we are already connected */ if (connection->useSSL) @@ -694,14 +693,6 @@ DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) res = ERROR_INTERNET_SECURITY_CHANNEL_ERROR; goto fail; } - cert = pSSL_get_peer_certificate(connection->ssl_s); - if (!cert) - { - ERR("no certificate for server %s\n", debugstr_w(hostname)); - /* FIXME: is this the best error? */ - res = ERROR_INTERNET_INVALID_CA; - goto fail; - } verify_res = pSSL_get_verify_result(connection->ssl_s); if (verify_res != X509_V_OK) {

1 0

Juan Lang : wininet: Store WININET_NETCONNECTION * in SSL context.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: ce0164c3f784e1768b74296b7a19c92d030a8723 URL: http://source.winehq.org/git/wine.git/?a=commit;h=ce0164c3f784e1768b74296b7… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Sep 28 16:33:19 2010 -0700 wininet: Store WININET_NETCONNECTION * in SSL context. --- dlls/wininet/netconnection.c | 25 ++++++++++++++++++++++++- 1 files changed, 24 insertions(+), 1 deletions(-) diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c index 6edc9ea..9717b92 100644 --- a/dlls/wininet/netconnection.c +++ b/dlls/wininet/netconnection.c @@ -122,6 +122,7 @@ static SSL_METHOD *meth; static SSL_CTX *ctx; static int hostname_idx; static int error_idx; +static int conn_idx; #define MAKE_FUNCPTR(f) static typeof(f) * p##f @@ -459,6 +460,15 @@ DWORD NETCON_init(WININET_NETCONNECTION *connection, BOOL useSSL) LeaveCriticalSection(&init_ssl_cs); return ERROR_OUTOFMEMORY; } + conn_idx = pSSL_get_ex_new_index(0, (void *)"netconn index", + NULL, NULL, NULL); + if (conn_idx == -1) + { + ERR("SSL_get_ex_new_index failed; %s\n", + pERR_error_string(pERR_get_error(), 0)); + LeaveCriticalSection(&init_ssl_cs); + return ERROR_OUTOFMEMORY; + } pSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, netconn_secure_verify); pCRYPTO_set_id_callback(ssl_thread_id); @@ -670,7 +680,20 @@ DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) ERR("SSL_connect failed: %d\n", res); goto fail; } - pSSL_set_ex_data(connection->ssl_s, hostname_idx, hostname); + if (!pSSL_set_ex_data(connection->ssl_s, hostname_idx, hostname)) + { + ERR("SSL_set_ex_data failed: %s\n", + pERR_error_string(pERR_get_error(), 0)); + res = ERROR_INTERNET_SECURITY_CHANNEL_ERROR; + goto fail; + } + if (!pSSL_set_ex_data(connection->ssl_s, conn_idx, connection)) + { + ERR("SSL_set_ex_data failed: %s\n", + pERR_error_string(pERR_get_error(), 0)); + res = ERROR_INTERNET_SECURITY_CHANNEL_ERROR; + goto fail; + } cert = pSSL_get_peer_certificate(connection->ssl_s); if (!cert) {

1 0

Alexandre Julliard : makefiles: Pass target options to wrc.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: c685b99d9bbf8ba4f58a8f7c22770f019484d9f4 URL: http://source.winehq.org/git/wine.git/?a=commit;h=c685b99d9bbf8ba4f58a8f7c2… Author: Alexandre Julliard <julliard(a)winehq.org> Date: Wed Sep 29 20:13:44 2010 +0200 makefiles: Pass target options to wrc. --- Make.rules.in | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Make.rules.in b/Make.rules.in index 5415e8c..c5518c1 100644 --- a/Make.rules.in +++ b/Make.rules.in @@ -17,7 +17,7 @@ INCLUDES = -I$(srcdir) -I. -I$(top_srcdir)/include -I$(top_builddir)/include ALLCFLAGS = $(INCLUDES) $(DEFS) $(DLLFLAGS) $(EXTRACFLAGS) $(CPPFLAGS) $(CFLAGS) $(MODCFLAGS) ALLLINTFLAGS = $(INCLUDES) $(DEFS) $(LINTFLAGS) IDLFLAGS = $(INCLUDES) $(DEFS) $(EXTRAIDLFLAGS) -RCFLAGS = --nostdinc $(INCLUDES) $(DEFS) $(EXTRARCFLAGS) +RCFLAGS = --nostdinc $(TARGETFLAGS) $(INCLUDES) $(DEFS) $(EXTRARCFLAGS) IDL_GEN_C_SRCS = $(IDL_C_SRCS:.idl=_c.c) $(IDL_I_SRCS:.idl=_i.c) \ $(IDL_P_SRCS:.idl=_p.c) $(IDL_S_SRCS:.idl=_s.c) @@ -62,7 +62,7 @@ filter: dummy $(LDPATH) $(WMC) -i -U -H /dev/null -o $@ $< .rc.res: - $(LDPATH) $(WRC) $(RCFLAGS) -fo$@ $< + $(LDPATH) $(WRC) $(RCFLAGS) -o $@ $< .idl.h: $(WIDL) $(IDLFLAGS) -h -H $@ $<

1 0

Juan Lang : wininet: Store security flags in WININET_NETCONNECTION.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: 77c4ade08bbd6a76d59c2c6e45a4585470909539 URL: http://source.winehq.org/git/wine.git/?a=commit;h=77c4ade08bbd6a76d59c2c6e4… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Sep 28 16:46:41 2010 -0700 wininet: Store security flags in WININET_NETCONNECTION. --- dlls/wininet/http.c | 11 +++++++++++ dlls/wininet/internet.h | 1 + 2 files changed, 12 insertions(+), 0 deletions(-) diff --git a/dlls/wininet/http.c b/dlls/wininet/http.c index f5ae426..5c278d3 100644 --- a/dlls/wininet/http.c +++ b/dlls/wininet/http.c @@ -1887,6 +1887,17 @@ static DWORD HTTPREQ_SetOption(object_header_t *hdr, DWORD option, void *buffer, http_request_t *req = (http_request_t*)hdr; switch(option) { + case INTERNET_OPTION_SECURITY_FLAGS: + { + DWORD flags; + + if (!buffer || size != sizeof(DWORD)) + return ERROR_INVALID_PARAMETER; + flags = *(DWORD *)buffer; + TRACE("%08x\n", flags); + req->netConnection.security_flags = flags; + return ERROR_SUCCESS; + } case INTERNET_OPTION_SEND_TIMEOUT: case INTERNET_OPTION_RECEIVE_TIMEOUT: TRACE("INTERNET_OPTION_SEND/RECEIVE_TIMEOUT\n"); diff --git a/dlls/wininet/internet.h b/dlls/wininet/internet.h index 40de22f..109179f 100644 --- a/dlls/wininet/internet.h +++ b/dlls/wininet/internet.h @@ -53,6 +53,7 @@ typedef struct BOOL useSSL; int socketFD; void *ssl_s; + DWORD security_flags; } WININET_NETCONNECTION; static inline LPWSTR heap_strdupW(LPCWSTR str)

1 0

Juan Lang : wininet: Honor security flags when verifying certificates.
by Alexandre Julliard Sept. 30, 2010

Sept. 30, 2010

Module: wine Branch: master Commit: 44112c367f6a08a7dd0d841b34d0ead3d6bcac63 URL: http://source.winehq.org/git/wine.git/?a=commit;h=44112c367f6a08a7dd0d841b3… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Sep 29 07:53:53 2010 -0700 wininet: Honor security flags when verifying certificates. --- dlls/wininet/netconnection.c | 52 +++++++++++++++++++++++++++++++---------- 1 files changed, 39 insertions(+), 13 deletions(-) diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c index 9d52ae6..7bb00dc 100644 --- a/dlls/wininet/netconnection.c +++ b/dlls/wininet/netconnection.c @@ -220,7 +220,7 @@ static PCCERT_CONTEXT X509_to_cert_context(X509 *cert) } static DWORD netconn_verify_cert(PCCERT_CONTEXT cert, HCERTSTORE store, - WCHAR *server) + WCHAR *server, DWORD security_flags) { BOOL ret; CERT_CHAIN_PARA chainPara = { sizeof(chainPara), { 0 } }; @@ -237,30 +237,49 @@ static DWORD netconn_verify_cert(PCCERT_CONTEXT cert, HCERTSTORE store, { if (chain->TrustStatus.dwErrorStatus) { + static const DWORD supportedErrors = + CERT_TRUST_IS_NOT_TIME_VALID | + CERT_TRUST_IS_UNTRUSTED_ROOT | + CERT_TRUST_IS_OFFLINE_REVOCATION | + CERT_TRUST_REVOCATION_STATUS_UNKNOWN | + CERT_TRUST_IS_REVOKED | + CERT_TRUST_IS_NOT_VALID_FOR_USAGE; + if (chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_NOT_TIME_VALID) err = ERROR_INTERNET_SEC_CERT_DATE_INVALID; else if (chain->TrustStatus.dwErrorStatus & - CERT_TRUST_IS_UNTRUSTED_ROOT) + CERT_TRUST_IS_UNTRUSTED_ROOT && + !(security_flags & SECURITY_FLAG_IGNORE_UNKNOWN_CA)) err = ERROR_INTERNET_INVALID_CA; - else if ((chain->TrustStatus.dwErrorStatus & + else if (!(security_flags & SECURITY_FLAG_IGNORE_REVOCATION) && + ((chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_OFFLINE_REVOCATION) || - (chain->TrustStatus.dwErrorStatus & - CERT_TRUST_REVOCATION_STATUS_UNKNOWN)) + (chain->TrustStatus.dwErrorStatus & + CERT_TRUST_REVOCATION_STATUS_UNKNOWN))) err = ERROR_INTERNET_SEC_CERT_NO_REV; - else if (chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_REVOKED) + else if (!(security_flags & SECURITY_FLAG_IGNORE_REVOCATION) && + (chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_REVOKED)) err = ERROR_INTERNET_SEC_CERT_REVOKED; - else if (chain->TrustStatus.dwErrorStatus & - CERT_TRUST_IS_NOT_VALID_FOR_USAGE) + else if (!(security_flags & SECURITY_FLAG_IGNORE_WRONG_USAGE) && + (chain->TrustStatus.dwErrorStatus & + CERT_TRUST_IS_NOT_VALID_FOR_USAGE)) err = ERROR_INTERNET_SEC_INVALID_CERT; - else + else if (chain->TrustStatus.dwErrorStatus & ~supportedErrors) err = ERROR_INTERNET_SEC_INVALID_CERT; } - else + if (!err) { CERT_CHAIN_POLICY_PARA policyPara; SSL_EXTRA_CERT_CHAIN_POLICY_PARA sslExtraPolicyPara; CERT_CHAIN_POLICY_STATUS policyStatus; + CERT_CHAIN_CONTEXT chainCopy; + /* Clear chain->TrustStatus.dwErrorStatus so + * CertVerifyCertificateChainPolicy will verify additional checks + * rather than stopping with an existing, ignored error. + */ + memcpy(&chainCopy, chain, sizeof(chainCopy)); + chainCopy.TrustStatus.dwErrorStatus = 0; sslExtraPolicyPara.u.cbSize = sizeof(sslExtraPolicyPara); sslExtraPolicyPara.dwAuthType = AUTHTYPE_SERVER; sslExtraPolicyPara.pwszServerName = server; @@ -268,14 +287,18 @@ static DWORD netconn_verify_cert(PCCERT_CONTEXT cert, HCERTSTORE store, policyPara.dwFlags = 0; policyPara.pvExtraPolicyPara = &sslExtraPolicyPara; ret = CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_SSL, - chain, &policyPara, &policyStatus); + &chainCopy, &policyPara, &policyStatus); /* Any error in the policy status indicates that the * policy couldn't be verified. */ if (ret && policyStatus.dwError) { if (policyStatus.dwError == CERT_E_CN_NO_MATCH) - err = ERROR_INTERNET_SEC_CERT_CN_INVALID; + { + if (!(security_flags & + SECURITY_FLAG_IGNORE_CERT_CN_INVALID)) + err = ERROR_INTERNET_SEC_CERT_CN_INVALID; + } else err = ERROR_INTERNET_SEC_INVALID_CERT; } @@ -293,10 +316,12 @@ static int netconn_secure_verify(int preverify_ok, X509_STORE_CTX *ctx) BOOL ret = FALSE; HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, CERT_STORE_CREATE_NEW_FLAG, NULL); + WININET_NETCONNECTION *conn; ssl = pX509_STORE_CTX_get_ex_data(ctx, pSSL_get_ex_data_X509_STORE_CTX_idx()); server = pSSL_get_ex_data(ssl, hostname_idx); + conn = pSSL_get_ex_data(ssl, conn_idx); if (store) { X509 *cert; @@ -323,7 +348,8 @@ static int netconn_secure_verify(int preverify_ok, X509_STORE_CTX *ctx) if (!endCert) ret = FALSE; if (ret) { - DWORD_PTR err = netconn_verify_cert(endCert, store, server); + DWORD_PTR err = netconn_verify_cert(endCert, store, server, + conn->security_flags); if (err) {

1 0