[PATCH 0/1] MR10357: Implement WINHTTP_OPTION_SERVER_CERT_CHAIN_CONTEXT

[Michael Green (＠m-green39)]

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10357

[PATCH 1/1] Implement WINHTTP_OPTION_SERVER_CERT_CHAIN_CONTEXT

[Michael Green]

From: Michael Green <[e-mail]>

---
 dlls/winhttp/session.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/dlls/winhttp/session.c b/dlls/winhttp/session.c
index a3c8bb91010..de34e7c862c 100644
--- a/dlls/winhttp/session.c
+++ b/dlls/winhttp/session.c
@@ -832,6 +832,29 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void
         *buflen = sizeof(cert);
         return TRUE;
     }
+    case WINHTTP_OPTION_SERVER_CERT_CHAIN_CONTEXT:
+    {
+        const CERT_CONTEXT *cert;
+        const CERT_CHAIN_CONTEXT *cert_chain;
+
+        char oid_server_auth[] = szOID_PKIX_KP_SERVER_AUTH;
+        char *server_auth[] = { oid_server_auth };
+
+        CERT_CHAIN_PARA chainPara = { sizeof(chainPara), { 0 } };
+
+        chainPara.RequestedUsage.Usage.cUsageIdentifier = 1;
+        chainPara.RequestedUsage.Usage.rgpszUsageIdentifier = server_auth;
+
+        if (!validate_buffer( buffer, buflen, sizeof(cert) )) return FALSE;
+        if (!(cert = CertDuplicateCertificateContext( request -> server_cert ))) return FALSE;
+
+        if (!CertGetCertificateChain(NULL, cert, NULL, NULL, &chainPara, 0, NULL, &cert_chain)) return FALSE;
+
+        *(CERT_CHAIN_CONTEXT **)buffer = (CERT_CHAIN_CONTEXT *)cert_chain;
+        *buflen = sizeof(cert_chain);
+
+        return TRUE;
+    }
     case WINHTTP_OPTION_SECURITY_CERTIFICATE_STRUCT:
     {
         const CERT_CONTEXT *cert = request->server_cert;
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/10357

[PATCH 0/1] MR10357: winhttp: Implement WINHTTP_OPTION_SERVER_CERT_CHAIN_CONTEXT

[Hans Leidekker (＠hans)]

Hans Leidekker (@hans) commented about dlls/winhttp/session.c:
> +        char *server_auth[] = { oid_server_auth };
> +
> +        CERT_CHAIN_PARA chainPara = { sizeof(chainPara), { 0 } };
> +
> +        chainPara.RequestedUsage.Usage.cUsageIdentifier = 1;
> +        chainPara.RequestedUsage.Usage.rgpszUsageIdentifier = server_auth;
> +
> +        if (!validate_buffer( buffer, buflen, sizeof(cert) )) return FALSE;
> +        if (!(cert = CertDuplicateCertificateContext( request -> server_cert ))) return FALSE;
> +
> +        if (!CertGetCertificateChain(NULL, cert, NULL, NULL, &chainPara, 0, NULL, &cert_chain)) return FALSE;
> +
> +        *(CERT_CHAIN_CONTEXT **)buffer = (CERT_CHAIN_CONTEXT *)cert_chain;
> +        *buflen = sizeof(cert_chain);
> +
> +        return TRUE;
> 'cert' should be freed before returning but you don't actually need a copy. This should work:

```
if (!CertGetCertificateChain( NULL, request->server_cert, NULL, NULL, &chainPara, 0, NULL, &cert_chain ))
    return FALSE;
```

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10357#note_132600

[PATCH 0/1] MR10357: winhttp: Implement WINHTTP_OPTION_SERVER_CERT_CHAIN_CONTEXT

[Hans Leidekker (＠hans)]

Thanks for the MR. Please address my comment and change the commit subject to:

winhttp: Implement WINHTTP_OPTION_SERVER_CERT_CHAIN_CONTEXT.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10357#note_132601