wine-commits November 2009

wine-commits@winehq.org

3 participants
910 discussions

Juan Lang : crypt32: Don' t apply directory name constraints to an empty subject name.
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: a63affe5e0127c3e21898fff23167d0d096e2585 URL: http://source.winehq.org/git/wine.git/?a=commit;h=a63affe5e0127c3e21898fff2… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Nov 17 13:57:52 2009 -0800 crypt32: Don't apply directory name constraints to an empty subject name. --- dlls/crypt32/chain.c | 24 +++++++++++++++++++++++- 1 files changed, 23 insertions(+), 1 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 72f5e24..df94523 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -950,6 +950,22 @@ static void compare_subject_with_email_constraints( CERT_TRUST_INVALID_EXTENSION | CERT_TRUST_INVALID_NAME_CONSTRAINTS; } +static BOOL CRYPT_IsEmptyName(const CERT_NAME_BLOB *name) +{ + BOOL empty; + + if (!name->cbData) + empty = TRUE; + else if (name->cbData == 2 && name->pbData[1] == 0) + { + /* An empty sequence is also empty */ + empty = TRUE; + } + else + empty = FALSE; + return empty; +} + static void compare_subject_with_constraints(const CERT_NAME_BLOB *subjectName, const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) { @@ -987,7 +1003,13 @@ static void compare_subject_with_constraints(const CERT_NAME_BLOB *subjectName, *trustErrorStatus |= CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; } - if (nameConstraints->cPermittedSubtree) + /* RFC 5280, section 4.2.1.10: + * "Restrictions apply only when the specified name form is present. + * If no name of the type is in the certificate, the certificate is + * acceptable." + * An empty name can't have the name form present, so don't check it. + */ + if (nameConstraints->cPermittedSubtree && !CRYPT_IsEmptyName(subjectName)) { BOOL match = FALSE;

1 0

Juan Lang : crypt32: Accept a certificate if its name matches any permitted subtree of a name constraint .
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: c464875a6d7465fddb14239f7b35bb4ca099019e URL: http://source.winehq.org/git/wine.git/?a=commit;h=c464875a6d7465fddb14239f7… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Nov 17 13:57:25 2009 -0800 crypt32: Accept a certificate if its name matches any permitted subtree of a name constraint. --- dlls/crypt32/chain.c | 19 +++++++++++-------- 1 files changed, 11 insertions(+), 8 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index a5b4141..72f5e24 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -987,18 +987,21 @@ static void compare_subject_with_constraints(const CERT_NAME_BLOB *subjectName, *trustErrorStatus |= CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; } - for (i = 0; i < nameConstraints->cPermittedSubtree; i++) + if (nameConstraints->cPermittedSubtree) { - CERT_ALT_NAME_ENTRY *constraint = - &nameConstraints->rgPermittedSubtree[i].Base; + BOOL match = FALSE; - if (constraint->dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME) + for (i = 0; !match && i < nameConstraints->cPermittedSubtree; i++) { - if (!directory_name_matches(&constraint->u.DirectoryName, - subjectName)) - *trustErrorStatus |= - CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; + CERT_ALT_NAME_ENTRY *constraint = + &nameConstraints->rgPermittedSubtree[i].Base; + + if (constraint->dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME) + match = directory_name_matches(&constraint->u.DirectoryName, + subjectName); } + if (!match) + *trustErrorStatus |= CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; } }

1 0

Juan Lang : crypt32: Check email address in subject name against rfc822 name constraints.
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: d6f7d06cad28ebd28a98ea07e4d51abb208f711a URL: http://source.winehq.org/git/wine.git/?a=commit;h=d6f7d06cad28ebd28a98ea07e… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Nov 17 13:34:00 2009 -0800 crypt32: Check email address in subject name against rfc822 name constraints. --- dlls/crypt32/chain.c | 107 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 107 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 0d9a66d..a5b4141 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -865,11 +865,118 @@ static void compare_alt_name_with_constraints(const CERT_EXTENSION *altNameExt, CERT_TRUST_INVALID_EXTENSION | CERT_TRUST_INVALID_NAME_CONSTRAINTS; } +static BOOL rfc822_attr_matches_excluded_name(const CERT_RDN_ATTR *attr, + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) +{ + DWORD i; + BOOL match = FALSE; + + for (i = 0; !match && i < nameConstraints->cExcludedSubtree; i++) + { + const CERT_ALT_NAME_ENTRY *constraint = + &nameConstraints->rgExcludedSubtree[i].Base; + + if (constraint->dwAltNameChoice == CERT_ALT_NAME_RFC822_NAME) + match = rfc822_name_matches(constraint->u.pwszRfc822Name, + (LPCWSTR)attr->Value.pbData, trustErrorStatus); + } + return match; +} + +static BOOL rfc822_attr_matches_permitted_name(const CERT_RDN_ATTR *attr, + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus, + BOOL *present) +{ + DWORD i; + BOOL match = FALSE; + + for (i = 0; !match && i < nameConstraints->cPermittedSubtree; i++) + { + const CERT_ALT_NAME_ENTRY *constraint = + &nameConstraints->rgPermittedSubtree[i].Base; + + if (constraint->dwAltNameChoice == CERT_ALT_NAME_RFC822_NAME) + { + *present = TRUE; + match = rfc822_name_matches(constraint->u.pwszRfc822Name, + (LPCWSTR)attr->Value.pbData, trustErrorStatus); + } + } + return match; +} + +static void compare_subject_with_email_constraints( + const CERT_NAME_BLOB *subjectName, + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) +{ + CERT_NAME_INFO *name; + DWORD size; + + if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_UNICODE_NAME, + subjectName->pbData, subjectName->cbData, + CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL, &name, &size)) + { + DWORD i, j; + + for (i = 0; i < name->cRDN; i++) + for (j = 0; j < name->rgRDN[i].cRDNAttr; j++) + if (!strcmp(name->rgRDN[i].rgRDNAttr[j].pszObjId, + szOID_RSA_emailAddr)) + { + BOOL nameFormPresent; + + /* A name constraint only applies if the name form is + * present. From RFC 5280, section 4.2.1.10: + * "Restrictions apply only when the specified name form is + * present. If no name of the type is in the certificate, + * the certificate is acceptable." + */ + if (rfc822_attr_matches_excluded_name( + &name->rgRDN[i].rgRDNAttr[j], nameConstraints, + trustErrorStatus)) + *trustErrorStatus |= + CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; + nameFormPresent = FALSE; + if (!rfc822_attr_matches_permitted_name( + &name->rgRDN[i].rgRDNAttr[j], nameConstraints, + trustErrorStatus, &nameFormPresent) && nameFormPresent) + *trustErrorStatus |= + CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; + } + LocalFree(name); + } + else + *trustErrorStatus |= + CERT_TRUST_INVALID_EXTENSION | CERT_TRUST_INVALID_NAME_CONSTRAINTS; +} + static void compare_subject_with_constraints(const CERT_NAME_BLOB *subjectName, const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) { + BOOL hasEmailConstraint = FALSE; DWORD i; + /* In general, a subject distinguished name only matches a directory name + * constraint. However, an exception exists for email addresses. + * From RFC 5280, section 4.2.1.6: + * "Legacy implementations exist where an electronic mail address is + * embedded in the subject distinguished name as an emailAddress + * attribute [RFC2985]." + * If an email address constraint exists, check that constraint separately. + */ + for (i = 0; !hasEmailConstraint && i < nameConstraints->cExcludedSubtree; + i++) + if (nameConstraints->rgExcludedSubtree[i].Base.dwAltNameChoice == + CERT_ALT_NAME_RFC822_NAME) + hasEmailConstraint = TRUE; + for (i = 0; !hasEmailConstraint && i < nameConstraints->cPermittedSubtree; + i++) + if (nameConstraints->rgPermittedSubtree[i].Base.dwAltNameChoice == + CERT_ALT_NAME_RFC822_NAME) + hasEmailConstraint = TRUE; + if (hasEmailConstraint) + compare_subject_with_email_constraints(subjectName, nameConstraints, + trustErrorStatus); for (i = 0; i < nameConstraints->cExcludedSubtree; i++) { CERT_ALT_NAME_ENTRY *constraint =

1 0

Juan Lang : crypt32: Apply name constraints to subject name.
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: e4c03521accd128a3f4d70519116879e00bde1e8 URL: http://source.winehq.org/git/wine.git/?a=commit;h=e4c03521accd128a3f4d70519… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Nov 17 13:33:35 2009 -0800 crypt32: Apply name constraints to subject name. --- dlls/crypt32/chain.c | 46 +++++++++++++++++++++++++++++++++++++--------- 1 files changed, 37 insertions(+), 9 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 14e716a..0d9a66d 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -865,6 +865,36 @@ static void compare_alt_name_with_constraints(const CERT_EXTENSION *altNameExt, CERT_TRUST_INVALID_EXTENSION | CERT_TRUST_INVALID_NAME_CONSTRAINTS; } +static void compare_subject_with_constraints(const CERT_NAME_BLOB *subjectName, + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) +{ + DWORD i; + + for (i = 0; i < nameConstraints->cExcludedSubtree; i++) + { + CERT_ALT_NAME_ENTRY *constraint = + &nameConstraints->rgExcludedSubtree[i].Base; + + if (constraint->dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME && + directory_name_matches(&constraint->u.DirectoryName, subjectName)) + *trustErrorStatus |= + CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; + } + for (i = 0; i < nameConstraints->cPermittedSubtree; i++) + { + CERT_ALT_NAME_ENTRY *constraint = + &nameConstraints->rgPermittedSubtree[i].Base; + + if (constraint->dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME) + { + if (!directory_name_matches(&constraint->u.DirectoryName, + subjectName)) + *trustErrorStatus |= + CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; + } + } +} + static void CRYPT_CheckNameConstraints( const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, const CERT_INFO *cert, DWORD *trustErrorStatus) @@ -874,15 +904,13 @@ static void CRYPT_CheckNameConstraints( if (ext) compare_alt_name_with_constraints(ext, nameConstraints, trustErrorStatus); - else - { - if (nameConstraints->cPermittedSubtree) - *trustErrorStatus |= - CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT | - CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; - if (nameConstraints->cExcludedSubtree) - *trustErrorStatus |= CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; - } + /* Name constraints apply to the subject alternative name as well as the + * subject name. From RFC 5280, section 4.2.1.10: + * "Restrictions apply to the subject distinguished name and apply to + * subject alternative names." + */ + compare_subject_with_constraints(&cert->Subject, nameConstraints, + trustErrorStatus); } /* Gets cert's name constraints, if any. Free with LocalFree. */

1 0

Juan Lang : crypt32: Use helper function to compare a subject alternate name with name constraints .
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: 6f35ae25b8043b0b6200b347847d05ee1b0d7c30 URL: http://source.winehq.org/git/wine.git/?a=commit;h=6f35ae25b8043b0b6200b3478… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Nov 17 12:19:46 2009 -0800 crypt32: Use helper function to compare a subject alternate name with name constraints. --- dlls/crypt32/chain.c | 83 ++++++++++++++++++++++++++----------------------- 1 files changed, 44 insertions(+), 39 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 8c7ad5b..14e716a 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -823,53 +823,58 @@ static inline PCERT_EXTENSION get_subject_alt_name_ext(const CERT_INFO *cert) return ext; } -static void CRYPT_CheckNameConstraints( - const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, const CERT_INFO *cert, - DWORD *trustErrorStatus) +static void compare_alt_name_with_constraints(const CERT_EXTENSION *altNameExt, + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) { - CERT_EXTENSION *ext = get_subject_alt_name_ext(cert); + CERT_ALT_NAME_INFO *subjectAltName; + DWORD size; - if (ext) + if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ALTERNATE_NAME, + altNameExt->Value.pbData, altNameExt->Value.cbData, + CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL, + &subjectAltName, &size)) { - CERT_ALT_NAME_INFO *subjectName; - DWORD size; + DWORD i; - if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ALTERNATE_NAME, - ext->Value.pbData, ext->Value.cbData, - CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL, - &subjectName, &size)) + for (i = 0; i < subjectAltName->cAltEntry; i++) { - DWORD i; - - for (i = 0; i < subjectName->cAltEntry; i++) - { - BOOL nameFormPresent; - - /* A name constraint only applies if the name form is present. - * From RFC 5280, section 4.2.1.10: - * "Restrictions apply only when the specified name form is - * present. If no name of the type is in the certificate, - * the certificate is acceptable." - */ - if (alt_name_matches_excluded_name( - &subjectName->rgAltEntry[i], nameConstraints, - trustErrorStatus)) - *trustErrorStatus |= - CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; - nameFormPresent = FALSE; - if (!alt_name_matches_permitted_name( - &subjectName->rgAltEntry[i], nameConstraints, - trustErrorStatus, &nameFormPresent) && nameFormPresent) - *trustErrorStatus |= - CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; - } - LocalFree(subjectName); + BOOL nameFormPresent; + + /* A name constraint only applies if the name form is present. + * From RFC 5280, section 4.2.1.10: + * "Restrictions apply only when the specified name form is + * present. If no name of the type is in the certificate, + * the certificate is acceptable." + */ + if (alt_name_matches_excluded_name( + &subjectAltName->rgAltEntry[i], nameConstraints, + trustErrorStatus)) + *trustErrorStatus |= + CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; + nameFormPresent = FALSE; + if (!alt_name_matches_permitted_name( + &subjectAltName->rgAltEntry[i], nameConstraints, + trustErrorStatus, &nameFormPresent) && nameFormPresent) + *trustErrorStatus |= + CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; } - else - *trustErrorStatus |= - CERT_TRUST_INVALID_EXTENSION | CERT_TRUST_INVALID_NAME_CONSTRAINTS; + LocalFree(subjectAltName); } else + *trustErrorStatus |= + CERT_TRUST_INVALID_EXTENSION | CERT_TRUST_INVALID_NAME_CONSTRAINTS; +} + +static void CRYPT_CheckNameConstraints( + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, const CERT_INFO *cert, + DWORD *trustErrorStatus) +{ + CERT_EXTENSION *ext = get_subject_alt_name_ext(cert); + + if (ext) + compare_alt_name_with_constraints(ext, nameConstraints, + trustErrorStatus); + else { if (nameConstraints->cPermittedSubtree) *trustErrorStatus |=

1 0

Juan Lang : crypt32: Only apply a name constraint if the name form is present.
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: a98dad4f93daf1bb8a10fbe7e776bd4c8b7b381d URL: http://source.winehq.org/git/wine.git/?a=commit;h=a98dad4f93daf1bb8a10fbe7e… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Nov 17 12:06:18 2009 -0800 crypt32: Only apply a name constraint if the name form is present. --- dlls/crypt32/chain.c | 25 ++++++++++++++++++++----- 1 files changed, 20 insertions(+), 5 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 704d974..8c7ad5b 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -743,12 +743,14 @@ static BOOL directory_name_matches(const CERT_NAME_BLOB *constraint, } static BOOL alt_name_matches(const CERT_ALT_NAME_ENTRY *name, - const CERT_ALT_NAME_ENTRY *constraint, DWORD *trustErrorStatus) + const CERT_ALT_NAME_ENTRY *constraint, DWORD *trustErrorStatus, BOOL *present) { BOOL match = FALSE; if (name->dwAltNameChoice == constraint->dwAltNameChoice) { + if (present) + *present = TRUE; switch (constraint->dwAltNameChoice) { case CERT_ALT_NAME_RFC822_NAME: @@ -778,6 +780,8 @@ static BOOL alt_name_matches(const CERT_ALT_NAME_ENTRY *name, CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT; } } + else if (present) + *present = FALSE; return match; } @@ -789,19 +793,21 @@ static BOOL alt_name_matches_excluded_name(const CERT_ALT_NAME_ENTRY *name, for (i = 0; !match && i < nameConstraints->cExcludedSubtree; i++) match = alt_name_matches(name, - &nameConstraints->rgExcludedSubtree[i].Base, trustErrorStatus); + &nameConstraints->rgExcludedSubtree[i].Base, trustErrorStatus, NULL); return match; } static BOOL alt_name_matches_permitted_name(const CERT_ALT_NAME_ENTRY *name, - const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus, + BOOL *present) { DWORD i; BOOL match = FALSE; for (i = 0; !match && i < nameConstraints->cPermittedSubtree; i++) match = alt_name_matches(name, - &nameConstraints->rgPermittedSubtree[i].Base, trustErrorStatus); + &nameConstraints->rgPermittedSubtree[i].Base, trustErrorStatus, + present); return match; } @@ -837,14 +843,23 @@ static void CRYPT_CheckNameConstraints( for (i = 0; i < subjectName->cAltEntry; i++) { + BOOL nameFormPresent; + + /* A name constraint only applies if the name form is present. + * From RFC 5280, section 4.2.1.10: + * "Restrictions apply only when the specified name form is + * present. If no name of the type is in the certificate, + * the certificate is acceptable." + */ if (alt_name_matches_excluded_name( &subjectName->rgAltEntry[i], nameConstraints, trustErrorStatus)) *trustErrorStatus |= CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; + nameFormPresent = FALSE; if (!alt_name_matches_permitted_name( &subjectName->rgAltEntry[i], nameConstraints, - trustErrorStatus)) + trustErrorStatus, &nameFormPresent) && nameFormPresent) *trustErrorStatus |= CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; }

1 0

Juan Lang : crypt32: Partially implement checking name constraints with directory names.
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: f6d3348b7c52cb00f1d21bdbe4241296eb0ba2a6 URL: http://source.winehq.org/git/wine.git/?a=commit;h=f6d3348b7c52cb00f1d21bdbe… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Nov 17 11:25:13 2009 -0800 crypt32: Partially implement checking name constraints with directory names. --- dlls/crypt32/chain.c | 25 +++++++++++++++++++++++++ 1 files changed, 25 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 2965a56..704d974 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -720,6 +720,28 @@ static BOOL ip_address_matches(const CRYPT_DATA_BLOB *constraint, return match; } +static BOOL directory_name_matches(const CERT_NAME_BLOB *constraint, + const CERT_NAME_BLOB *name) +{ + CERT_NAME_INFO *constraintName; + DWORD size; + BOOL match = FALSE; + + if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_NAME, constraint->pbData, + constraint->cbData, CRYPT_DECODE_ALLOC_FLAG, NULL, &constraintName, &size)) + { + DWORD i; + + match = TRUE; + for (i = 0; match && i < constraintName->cRDN; i++) + match = CertIsRDNAttrsInCertificateName(X509_ASN_ENCODING, + CERT_CASE_INSENSITIVE_IS_RDN_ATTRS_FLAG, + (CERT_NAME_BLOB *)name, &constraintName->rgRDN[i]); + LocalFree(constraintName); + } + return match; +} + static BOOL alt_name_matches(const CERT_ALT_NAME_ENTRY *name, const CERT_ALT_NAME_ENTRY *constraint, DWORD *trustErrorStatus) { @@ -746,6 +768,9 @@ static BOOL alt_name_matches(const CERT_ALT_NAME_ENTRY *name, &name->u.IPAddress, trustErrorStatus); break; case CERT_ALT_NAME_DIRECTORY_NAME: + match = directory_name_matches(&constraint->u.DirectoryName, + &name->u.DirectoryName); + break; default: ERR("name choice %d unsupported in this context\n", constraint->dwAltNameChoice);

1 0

Juan Lang : crypt32: Use helper functions to match excluded and permitted subtrees of name constraints .
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: 7c44544a6d36e89cf62f3e7a848468632e349abc URL: http://source.winehq.org/git/wine.git/?a=commit;h=7c44544a6d36e89cf62f3e7a8… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Nov 17 11:51:31 2009 -0800 crypt32: Use helper functions to match excluded and permitted subtrees of name constraints. --- dlls/crypt32/chain.c | 94 +++++++++++++++++++++++++++++--------------------- 1 files changed, 55 insertions(+), 39 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index f92b906..2965a56 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -720,47 +720,66 @@ static BOOL ip_address_matches(const CRYPT_DATA_BLOB *constraint, return match; } -static BOOL CRYPT_FindMatchingNameEntry(const CERT_ALT_NAME_ENTRY *constraint, - const CERT_ALT_NAME_INFO *subjectName, DWORD *trustErrorStatus) +static BOOL alt_name_matches(const CERT_ALT_NAME_ENTRY *name, + const CERT_ALT_NAME_ENTRY *constraint, DWORD *trustErrorStatus) { - DWORD i; BOOL match = FALSE; - for (i = 0; i < subjectName->cAltEntry; i++) + if (name->dwAltNameChoice == constraint->dwAltNameChoice) { - if (subjectName->rgAltEntry[i].dwAltNameChoice == - constraint->dwAltNameChoice) + switch (constraint->dwAltNameChoice) { - switch (constraint->dwAltNameChoice) - { - case CERT_ALT_NAME_RFC822_NAME: - match = rfc822_name_matches(constraint->u.pwszURL, - subjectName->rgAltEntry[i].u.pwszURL, trustErrorStatus); - break; - case CERT_ALT_NAME_DNS_NAME: - match = dns_name_matches(constraint->u.pwszURL, - subjectName->rgAltEntry[i].u.pwszURL, trustErrorStatus); - break; - case CERT_ALT_NAME_URL: - match = url_matches(constraint->u.pwszURL, - subjectName->rgAltEntry[i].u.pwszURL, trustErrorStatus); - break; - case CERT_ALT_NAME_IP_ADDRESS: - match = ip_address_matches(&constraint->u.IPAddress, - &subjectName->rgAltEntry[i].u.IPAddress, trustErrorStatus); - break; - case CERT_ALT_NAME_DIRECTORY_NAME: - default: - ERR("name choice %d unsupported in this context\n", - constraint->dwAltNameChoice); - *trustErrorStatus |= - CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT; - } + case CERT_ALT_NAME_RFC822_NAME: + match = rfc822_name_matches(constraint->u.pwszURL, + name->u.pwszURL, trustErrorStatus); + break; + case CERT_ALT_NAME_DNS_NAME: + match = dns_name_matches(constraint->u.pwszURL, + name->u.pwszURL, trustErrorStatus); + break; + case CERT_ALT_NAME_URL: + match = url_matches(constraint->u.pwszURL, + name->u.pwszURL, trustErrorStatus); + break; + case CERT_ALT_NAME_IP_ADDRESS: + match = ip_address_matches(&constraint->u.IPAddress, + &name->u.IPAddress, trustErrorStatus); + break; + case CERT_ALT_NAME_DIRECTORY_NAME: + default: + ERR("name choice %d unsupported in this context\n", + constraint->dwAltNameChoice); + *trustErrorStatus |= + CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT; } } return match; } +static BOOL alt_name_matches_excluded_name(const CERT_ALT_NAME_ENTRY *name, + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) +{ + DWORD i; + BOOL match = FALSE; + + for (i = 0; !match && i < nameConstraints->cExcludedSubtree; i++) + match = alt_name_matches(name, + &nameConstraints->rgExcludedSubtree[i].Base, trustErrorStatus); + return match; +} + +static BOOL alt_name_matches_permitted_name(const CERT_ALT_NAME_ENTRY *name, + const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, DWORD *trustErrorStatus) +{ + DWORD i; + BOOL match = FALSE; + + for (i = 0; !match && i < nameConstraints->cPermittedSubtree; i++) + match = alt_name_matches(name, + &nameConstraints->rgPermittedSubtree[i].Base, trustErrorStatus); + return match; +} + static inline PCERT_EXTENSION get_subject_alt_name_ext(const CERT_INFO *cert) { PCERT_EXTENSION ext; @@ -791,18 +810,15 @@ static void CRYPT_CheckNameConstraints( { DWORD i; - for (i = 0; i < nameConstraints->cExcludedSubtree; i++) + for (i = 0; i < subjectName->cAltEntry; i++) { - if (CRYPT_FindMatchingNameEntry( - &nameConstraints->rgExcludedSubtree[i].Base, subjectName, + if (alt_name_matches_excluded_name( + &subjectName->rgAltEntry[i], nameConstraints, trustErrorStatus)) *trustErrorStatus |= CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; - } - for (i = 0; i < nameConstraints->cPermittedSubtree; i++) - { - if (!CRYPT_FindMatchingNameEntry( - &nameConstraints->rgPermittedSubtree[i].Base, subjectName, + if (!alt_name_matches_permitted_name( + &subjectName->rgAltEntry[i], nameConstraints, trustErrorStatus)) *trustErrorStatus |= CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT;

1 0

Juan Lang : crypt32: Let caller set error codes when name constraints aren' t met.
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: 9a40de08dec33cf1cba0ed2b508300d8286060a3 URL: http://source.winehq.org/git/wine.git/?a=commit;h=9a40de08dec33cf1cba0ed2b5… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Nov 16 18:16:34 2009 -0800 crypt32: Let caller set error codes when name constraints aren't met. --- dlls/crypt32/chain.c | 24 +++++++++++++++--------- 1 files changed, 15 insertions(+), 9 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 89ce807..f92b906 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -720,9 +720,8 @@ static BOOL ip_address_matches(const CRYPT_DATA_BLOB *constraint, return match; } -static void CRYPT_FindMatchingNameEntry(const CERT_ALT_NAME_ENTRY *constraint, - const CERT_ALT_NAME_INFO *subjectName, DWORD *trustErrorStatus, - DWORD errorIfFound, DWORD errorIfNotFound) +static BOOL CRYPT_FindMatchingNameEntry(const CERT_ALT_NAME_ENTRY *constraint, + const CERT_ALT_NAME_INFO *subjectName, DWORD *trustErrorStatus) { DWORD i; BOOL match = FALSE; @@ -759,7 +758,7 @@ static void CRYPT_FindMatchingNameEntry(const CERT_ALT_NAME_ENTRY *constraint, } } } - *trustErrorStatus |= match ? errorIfFound : errorIfNotFound; + return match; } static inline PCERT_EXTENSION get_subject_alt_name_ext(const CERT_INFO *cert) @@ -793,14 +792,21 @@ static void CRYPT_CheckNameConstraints( DWORD i; for (i = 0; i < nameConstraints->cExcludedSubtree; i++) - CRYPT_FindMatchingNameEntry( + { + if (CRYPT_FindMatchingNameEntry( &nameConstraints->rgExcludedSubtree[i].Base, subjectName, - trustErrorStatus, CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT, 0); + trustErrorStatus)) + *trustErrorStatus |= + CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; + } for (i = 0; i < nameConstraints->cPermittedSubtree; i++) - CRYPT_FindMatchingNameEntry( + { + if (!CRYPT_FindMatchingNameEntry( &nameConstraints->rgPermittedSubtree[i].Base, subjectName, - trustErrorStatus, 0, - CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT); + trustErrorStatus)) + *trustErrorStatus |= + CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; + } LocalFree(subjectName); } else

1 0

Juan Lang : crypt32: Remove an unnecessary if.
by Alexandre Julliard 18 Nov '09

18 Nov '09

Module: wine Branch: master Commit: f8044948bad5507fecdd0a3bdd5e409f010e3fa9 URL: http://source.winehq.org/git/wine.git/?a=commit;h=f8044948bad5507fecdd0a3bd… Author: Juan Lang <juan.lang(a)gmail.com> Date: Mon Nov 16 18:12:16 2009 -0800 crypt32: Remove an unnecessary if. --- dlls/crypt32/chain.c | 71 ++++++++++++++++++++++--------------------------- 1 files changed, 32 insertions(+), 39 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 11010d5..89ce807 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -778,50 +778,43 @@ static void CRYPT_CheckNameConstraints( const CERT_NAME_CONSTRAINTS_INFO *nameConstraints, const CERT_INFO *cert, DWORD *trustErrorStatus) { - /* If there aren't any existing constraints, don't bother checking */ - if (nameConstraints->cPermittedSubtree || nameConstraints->cExcludedSubtree) + CERT_EXTENSION *ext = get_subject_alt_name_ext(cert); + + if (ext) { - CERT_EXTENSION *ext = get_subject_alt_name_ext(cert); + CERT_ALT_NAME_INFO *subjectName; + DWORD size; - if (ext) + if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ALTERNATE_NAME, + ext->Value.pbData, ext->Value.cbData, + CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL, + &subjectName, &size)) { - CERT_ALT_NAME_INFO *subjectName; - DWORD size; - - if (CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ALTERNATE_NAME, - ext->Value.pbData, ext->Value.cbData, - CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, NULL, - &subjectName, &size)) - { - DWORD i; + DWORD i; - for (i = 0; i < nameConstraints->cExcludedSubtree; i++) - CRYPT_FindMatchingNameEntry( - &nameConstraints->rgExcludedSubtree[i].Base, subjectName, - trustErrorStatus, - CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT, 0); - for (i = 0; i < nameConstraints->cPermittedSubtree; i++) - CRYPT_FindMatchingNameEntry( - &nameConstraints->rgPermittedSubtree[i].Base, subjectName, - trustErrorStatus, 0, - CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT); - LocalFree(subjectName); - } - else - *trustErrorStatus |= - CERT_TRUST_INVALID_EXTENSION | - CERT_TRUST_INVALID_NAME_CONSTRAINTS; + for (i = 0; i < nameConstraints->cExcludedSubtree; i++) + CRYPT_FindMatchingNameEntry( + &nameConstraints->rgExcludedSubtree[i].Base, subjectName, + trustErrorStatus, CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT, 0); + for (i = 0; i < nameConstraints->cPermittedSubtree; i++) + CRYPT_FindMatchingNameEntry( + &nameConstraints->rgPermittedSubtree[i].Base, subjectName, + trustErrorStatus, 0, + CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT); + LocalFree(subjectName); } else - { - if (nameConstraints->cPermittedSubtree) - *trustErrorStatus |= - CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT | - CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; - if (nameConstraints->cExcludedSubtree) - *trustErrorStatus |= - CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; - } + *trustErrorStatus |= + CERT_TRUST_INVALID_EXTENSION | CERT_TRUST_INVALID_NAME_CONSTRAINTS; + } + else + { + if (nameConstraints->cPermittedSubtree) + *trustErrorStatus |= + CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT | + CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; + if (nameConstraints->cExcludedSubtree) + *trustErrorStatus |= CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; } }

1 0

← Newer
1
...
31
32
33
34
35
36
37
...
91
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

wine-commits November 2009