wine-commits September 2010

wine-commits@winehq.org

2 participants
852 discussions

Juan Lang : crypt32: Honor more SECURITY_FLAG_IGNORE flags when verifying the SSL policy.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: d74c4f7c15d5da99d223a49810d6ad7a8b60ae86 URL: http://source.winehq.org/git/wine.git/?a=commit;h=d74c4f7c15d5da99d223a4981… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Sep 29 13:42:27 2010 -0700 crypt32: Honor more SECURITY_FLAG_IGNORE flags when verifying the SSL policy. --- dlls/crypt32/chain.c | 17 ++++++++++++----- dlls/crypt32/tests/chain.c | 10 ++-------- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c index 36ed1f3..fe6093d 100644 --- a/dlls/crypt32/chain.c +++ b/dlls/crypt32/chain.c @@ -3285,6 +3285,13 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, PCCERT_CHAIN_CONTEXT pChainContext, PCERT_CHAIN_POLICY_PARA pPolicyPara, PCERT_CHAIN_POLICY_STATUS pPolicyStatus) { + HTTPSPolicyCallbackData *sslPara = NULL; + DWORD checks = 0; + + if (pPolicyPara) + sslPara = pPolicyPara->pvExtraPolicyPara; + if (sslPara && sslPara->u.cbSize >= sizeof(HTTPSPolicyCallbackData)) + checks = sslPara->fdwChecks; pPolicyStatus->lChainIndex = pPolicyStatus->lElementIndex = -1; if (pChainContext->TrustStatus.dwErrorStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID) @@ -3295,7 +3302,8 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, &pPolicyStatus->lElementIndex); } else if (pChainContext->TrustStatus.dwErrorStatus & - CERT_TRUST_IS_UNTRUSTED_ROOT) + CERT_TRUST_IS_UNTRUSTED_ROOT && + !(checks & SECURITY_FLAG_IGNORE_UNKNOWN_CA)) { pPolicyStatus->dwError = CERT_E_UNTRUSTEDROOT; find_element_with_error(pChainContext, @@ -3312,7 +3320,8 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, pPolicyStatus->lElementIndex = -1; } else if (pChainContext->TrustStatus.dwErrorStatus & - CERT_TRUST_IS_NOT_TIME_VALID) + CERT_TRUST_IS_NOT_TIME_VALID && + !(checks & SECURITY_FLAG_IGNORE_CERT_DATE_INVALID)) { pPolicyStatus->dwError = CERT_E_EXPIRED; find_element_with_error(pChainContext, @@ -3327,13 +3336,11 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID, if (!pPolicyStatus->dwError && pPolicyPara && pPolicyPara->cbSize >= sizeof(CERT_CHAIN_POLICY_PARA)) { - HTTPSPolicyCallbackData *sslPara = pPolicyPara->pvExtraPolicyPara; - if (sslPara && sslPara->u.cbSize >= sizeof(HTTPSPolicyCallbackData)) { if (sslPara->dwAuthType == AUTHTYPE_SERVER && sslPara->pwszServerName && - !(sslPara->fdwChecks & SECURITY_FLAG_IGNORE_CERT_CN_INVALID)) + !(checks & SECURITY_FLAG_IGNORE_CERT_CN_INVALID)) { PCCERT_CONTEXT cert; PCERT_EXTENSION altNameExt; diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 5d24ac7..b3fd1c4 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -3790,7 +3790,7 @@ static const ChainPolicyCheck sslPolicyCheck[] = { static const ChainPolicyCheck ignoredUnknownCAPolicyCheck = { { sizeof(chain0) / sizeof(chain0[0]), chain0 }, - { 0, CERT_E_EXPIRED, 0, 0, NULL }, NULL, TODO_ERROR + { 0, CERT_E_EXPIRED, 0, 0, NULL }, NULL, 0 }; static const ChainPolicyCheck googlePolicyCheckWithMatchingNameExpired = { @@ -3798,11 +3798,6 @@ static const ChainPolicyCheck googlePolicyCheckWithMatchingNameExpired = { { 0, CERT_E_EXPIRED, 0, 0, NULL}, NULL, 0 }; -static const ChainPolicyCheck googlePolicyCheckWithMatchingNameIgnoringExpired = { - { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, - { 0, 0, -1, -1, NULL}, NULL, TODO_ERROR -}; - static const ChainPolicyCheck googlePolicyCheckWithMatchingName = { { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, { 0, 0, -1, -1, NULL}, NULL, 0 @@ -4157,8 +4152,7 @@ static void check_ssl_policy(void) */ sslPolicyPara.fdwChecks = SECURITY_FLAG_IGNORE_CERT_DATE_INVALID; checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, - &googlePolicyCheckWithMatchingNameIgnoringExpired, 0, &oct2007, - &policyPara); + &googlePolicyCheckWithMatchingName, 0, &oct2007, &policyPara); sslPolicyPara.fdwChecks = 0; /* And again, but checking the Google chain at a good date */ sslPolicyPara.pwszServerName = google_dot_com;

1 0

Juan Lang : crypt32/tests: Test more SECURITY_FLAG_IGNORE flags for the SSL policy.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: 54429016eb68e81062e3cf20a23d348c9989d72b URL: http://source.winehq.org/git/wine.git/?a=commit;h=54429016eb68e81062e3cf20a… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Sep 29 13:39:34 2010 -0700 crypt32/tests: Test more SECURITY_FLAG_IGNORE flags for the SSL policy. --- dlls/crypt32/tests/chain.c | 25 +++++++++++++++++++++++++ 1 files changed, 25 insertions(+), 0 deletions(-) diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index 707d62e..5d24ac7 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -3788,11 +3788,21 @@ static const ChainPolicyCheck sslPolicyCheck[] = { { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 }, }; +static const ChainPolicyCheck ignoredUnknownCAPolicyCheck = { + { sizeof(chain0) / sizeof(chain0[0]), chain0 }, + { 0, CERT_E_EXPIRED, 0, 0, NULL }, NULL, TODO_ERROR +}; + static const ChainPolicyCheck googlePolicyCheckWithMatchingNameExpired = { { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, { 0, CERT_E_EXPIRED, 0, 0, NULL}, NULL, 0 }; +static const ChainPolicyCheck googlePolicyCheckWithMatchingNameIgnoringExpired = { + { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, + { 0, 0, -1, -1, NULL}, NULL, TODO_ERROR +}; + static const ChainPolicyCheck googlePolicyCheckWithMatchingName = { { sizeof(googleChain) / sizeof(googleChain[0]), googleChain }, { 0, 0, -1, -1, NULL}, NULL, 0 @@ -4131,10 +4141,25 @@ static void check_ssl_policy(void) */ checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, &iTunesPolicyCheckWithoutMatchingName, 0, &oct2007, &policyPara); + /* And again, specifying a chain with an untrusted root, but ignoring + * unknown CAs. + */ + sslPolicyPara.fdwChecks = SECURITY_FLAG_IGNORE_UNKNOWN_CA; + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, + &ignoredUnknownCAPolicyCheck, 0, &oct2007, &policyPara); + sslPolicyPara.fdwChecks = 0; /* And again, but checking the Google chain at a bad date */ sslPolicyPara.pwszServerName = google_dot_com; checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, &googlePolicyCheckWithMatchingNameExpired, 0, &oct2007, &policyPara); + /* Again checking the Google chain at a bad date, but ignoring date + * errors. + */ + sslPolicyPara.fdwChecks = SECURITY_FLAG_IGNORE_CERT_DATE_INVALID; + checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL, + &googlePolicyCheckWithMatchingNameIgnoringExpired, 0, &oct2007, + &policyPara); + sslPolicyPara.fdwChecks = 0; /* And again, but checking the Google chain at a good date */ sslPolicyPara.pwszServerName = google_dot_com; checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, NULL,

1 0

Stefan Leichter : setupapi: Added more tests for SetupDiGetINFClassA.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: 637fd3735ae7531468b5ee814fc61a32e3b4f313 URL: http://source.winehq.org/git/wine.git/?a=commit;h=637fd3735ae7531468b5ee814… Author: Stefan Leichter <Stefan.Leichter(a)camline.com> Date: Wed Sep 29 23:05:03 2010 +0200 setupapi: Added more tests for SetupDiGetINFClassA. --- dlls/setupapi/tests/devinst.c | 23 +++++++++++++++++++++++ 1 files changed, 23 insertions(+), 0 deletions(-) diff --git a/dlls/setupapi/tests/devinst.c b/dlls/setupapi/tests/devinst.c index 21fbb01..7005ef0 100644 --- a/dlls/setupapi/tests/devinst.c +++ b/dlls/setupapi/tests/devinst.c @@ -1443,11 +1443,32 @@ static void testSetupDiGetINFClassA(void) WritePrivateProfileStringA("Version", "Class", "WINE", filename); + count = 0xdeadbeef; retval = SetupDiGetINFClassA(filename, &guid, cn, MAX_PATH, &count); ok(retval, "expected SetupDiGetINFClassA to succeed! error %u\n", GetLastError()); + ok(count == 5, "expected count==5, got %u\n", count); + + count = 0xdeadbeef; + retval = SetupDiGetINFClassA(filename, &guid, cn, 5, &count); + ok(retval, "expected SetupDiGetINFClassA to succeed! error %u\n", GetLastError()); + ok(count == 5, "expected count==5, got %u\n", count); + + count = 0xdeadbeef; + SetLastError(0xdeadbeef); + retval = SetupDiGetINFClassA(filename, &guid, cn, 4, &count); + ok(!retval, "expected SetupDiGetINFClassA to fail!\n"); + ok(ERROR_INSUFFICIENT_BUFFER == GetLastError(), + "expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError()); + ok(count == 5, "expected count==5, got %u\n", count); /* invalid parameter */ SetLastError(0xdeadbeef); + retval = SetupDiGetINFClassA(NULL, &guid, cn, MAX_PATH, &count); + ok(!retval, "expected SetupDiGetINFClassA to fail!\n"); + ok(ERROR_INVALID_PARAMETER == GetLastError(), + "expected error ERROR_INVALID_PARAMETER, got %u\n", GetLastError()); + + SetLastError(0xdeadbeef); retval = SetupDiGetINFClassA(filename, NULL, cn, MAX_PATH, &count); ok(!retval, "expected SetupDiGetINFClassA to fail!\n"); ok(ERROR_INVALID_PARAMETER == GetLastError(), @@ -1485,8 +1506,10 @@ static void testSetupDiGetINFClassA(void) "{4d36e972-e325-11ce-bfc1-08002be10318}", filename); /* this test succeeds only if the guid is known to the system */ + count = 0xdeadbeef; retval = SetupDiGetINFClassA(filename, &guid, cn, MAX_PATH, &count); ok(retval, "expected SetupDiGetINFClassA to succeed! error %u\n", GetLastError()); + ok(count == 4, "expected count==4, got %u(%s)\n", count, cn); DeleteFileA(filename); }

1 0

Detlef Riekenberg : inetcpl: Remove a space from a button label.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: ddb033b7c022a475ce4ba26dfbb1babbdfae0dcd URL: http://source.winehq.org/git/wine.git/?a=commit;h=ddb033b7c022a475ce4ba26df… Author: Detlef Riekenberg <wine.dev(a)web.de> Date: Wed Sep 29 22:59:13 2010 +0200 inetcpl: Remove a space from a button label. --- dlls/inetcpl.cpl/cpl_De.rc | 2 +- dlls/inetcpl.cpl/cpl_En.rc | 2 +- dlls/inetcpl.cpl/cpl_It.rc | 2 +- dlls/inetcpl.cpl/cpl_Ko.rc | 2 +- dlls/inetcpl.cpl/cpl_Lt.rc | 2 +- dlls/inetcpl.cpl/cpl_Sv.rc | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dlls/inetcpl.cpl/cpl_De.rc b/dlls/inetcpl.cpl/cpl_De.rc index a5280a2..ecc2761 100644 --- a/dlls/inetcpl.cpl/cpl_De.rc +++ b/dlls/inetcpl.cpl/cpl_De.rc @@ -42,6 +42,6 @@ BEGIN LTEXT "Zertifikate werden benutzt, um sich persönlich, Zertifizierungsstellen und Herausgeber von Zertifikaten zu identifizieren.", IDC_STATIC, 58, 14, 252, 18 PUSHBUTTON "Zertifikate...", IDC_CERT, 146, 34, 80, 14 - PUSHBUTTON "Herausgeber... ", IDC_CERT_PUBLISHER, 230, 34, 80, 14 + PUSHBUTTON "Herausgeber...", IDC_CERT_PUBLISHER, 230, 34, 80, 14 END diff --git a/dlls/inetcpl.cpl/cpl_En.rc b/dlls/inetcpl.cpl/cpl_En.rc index 651755d..f463df7 100644 --- a/dlls/inetcpl.cpl/cpl_En.rc +++ b/dlls/inetcpl.cpl/cpl_En.rc @@ -40,6 +40,6 @@ BEGIN LTEXT "Certificates are used for your personal identification and to identify certificate authorities and publishers.", IDC_STATIC, 58, 14, 252, 18 PUSHBUTTON "Certificates...", IDC_CERT, 146, 34, 80, 14 - PUSHBUTTON "Publishers... ", IDC_CERT_PUBLISHER, 230, 34, 80, 14 + PUSHBUTTON "Publishers...", IDC_CERT_PUBLISHER, 230, 34, 80, 14 END diff --git a/dlls/inetcpl.cpl/cpl_It.rc b/dlls/inetcpl.cpl/cpl_It.rc index 629a1e3..6be9341 100644 --- a/dlls/inetcpl.cpl/cpl_It.rc +++ b/dlls/inetcpl.cpl/cpl_It.rc @@ -43,6 +43,6 @@ BEGIN LTEXT "I certificati sono usati per la tua identificazione personale e per identificare le autorità e gli editori dei certificati.", IDC_STATIC, 58, 14, 252, 18 PUSHBUTTON "Certificati...", IDC_CERT, 146, 34, 80, 14 - PUSHBUTTON "Editori... ", IDC_CERT_PUBLISHER, 230, 34, 80, 14 + PUSHBUTTON "Editori...", IDC_CERT_PUBLISHER, 230, 34, 80, 14 END diff --git a/dlls/inetcpl.cpl/cpl_Ko.rc b/dlls/inetcpl.cpl/cpl_Ko.rc index ffcceb0..6301701 100644 --- a/dlls/inetcpl.cpl/cpl_Ko.rc +++ b/dlls/inetcpl.cpl/cpl_Ko.rc @@ -43,6 +43,6 @@ BEGIN LTEXT " 인증서는 당신의 개인 식별과 인증기관과 게시자 식별에 사용됩니다.", IDC_STATIC, 58, 14, 252, 18 PUSHBUTTON "인증서...", IDC_CERT, 146, 34, 80, 14 - PUSHBUTTON "발행자... ", IDC_CERT_PUBLISHER, 230, 34, 80, 14 + PUSHBUTTON "발행자...", IDC_CERT_PUBLISHER, 230, 34, 80, 14 END diff --git a/dlls/inetcpl.cpl/cpl_Lt.rc b/dlls/inetcpl.cpl/cpl_Lt.rc index f180133..0eda833 100644 --- a/dlls/inetcpl.cpl/cpl_Lt.rc +++ b/dlls/inetcpl.cpl/cpl_Lt.rc @@ -43,6 +43,6 @@ BEGIN LTEXT "Liudijimai yra naudojami jūsų tapatumo nustatymui ir liudijimo įstaigų bei publikuotojų tapatumui nustatyti.", IDC_STATIC, 58, 14, 252, 18 PUSHBUTTON "Liudijimai...", IDC_CERT, 146, 34, 80, 14 - PUSHBUTTON "Publikuotojai... ", IDC_CERT_PUBLISHER, 230, 34, 80, 14 + PUSHBUTTON "Publikuotojai...", IDC_CERT_PUBLISHER, 230, 34, 80, 14 END diff --git a/dlls/inetcpl.cpl/cpl_Sv.rc b/dlls/inetcpl.cpl/cpl_Sv.rc index d825097..102f934 100644 --- a/dlls/inetcpl.cpl/cpl_Sv.rc +++ b/dlls/inetcpl.cpl/cpl_Sv.rc @@ -42,6 +42,6 @@ BEGIN LTEXT "Certifikat används för din personliga identifikation samt för att identifiera certifikats-auktoriteter och -utgivare.", IDC_STATIC, 58, 14, 252, 18 PUSHBUTTON "Certifikat...", IDC_CERT, 146, 34, 80, 14 - PUSHBUTTON "Utgivare... ", IDC_CERT_PUBLISHER, 230, 34, 80, 14 + PUSHBUTTON "Utgivare...", IDC_CERT_PUBLISHER, 230, 34, 80, 14 END

1 0

Frédéric Delanoy : inetcpl.cpl: Update French translation.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: 4bf30d130fbe2ad7e19ab0adcd3da713111702f4 URL: http://source.winehq.org/git/wine.git/?a=commit;h=4bf30d130fbe2ad7e19ab0adc… Author: Frédéric Delanoy <frederic.delanoy(a)gmail.com> Date: Wed Sep 29 22:35:34 2010 +0200 inetcpl.cpl: Update French translation. --- dlls/inetcpl.cpl/cpl_Fr.rc | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/dlls/inetcpl.cpl/cpl_Fr.rc b/dlls/inetcpl.cpl/cpl_Fr.rc index aeedb73..5772321 100644 --- a/dlls/inetcpl.cpl/cpl_Fr.rc +++ b/dlls/inetcpl.cpl/cpl_Fr.rc @@ -32,3 +32,18 @@ BEGIN IDS_CPL_NAME "Paramètres Internet" IDS_CPL_INFO "Configurer le navigateur internet de Wine et d'autres paramètres associés" END + +/* "Content" propsheet */ +IDD_CONTENT DIALOG 0, 0, 320, 220 +STYLE WS_CAPTION | WS_CHILD | WS_DISABLED +FONT 8, "MS Shell Dlg" +CAPTION "Content" +BEGIN + + GROUPBOX " Certificats ", IDC_STATIC, 4, 4, 312, 50 + LTEXT "Les certificats sont utilisés pour votre identification personnelle, celle d'autorités de certification ou d'éditeurs.", + IDC_STATIC, 58, 14, 252, 18 + PUSHBUTTON "Certificats...", IDC_CERT, 146, 34, 80, 14 + PUSHBUTTON "Éditeurs...", IDC_CERT_PUBLISHER, 230, 34, 80, 14 + +END

1 0

Juan Lang : wininet: More completely implement querying INTERNET_OPTION_SECURITY_FLAGS.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: 0e4e2a378abeee691c710d38920dcbac1f9dec9c URL: http://source.winehq.org/git/wine.git/?a=commit;h=0e4e2a378abeee691c710d389… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Sep 29 09:13:41 2010 -0700 wininet: More completely implement querying INTERNET_OPTION_SECURITY_FLAGS. --- dlls/wininet/http.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/dlls/wininet/http.c b/dlls/wininet/http.c index 5c278d3..2266fcd 100644 --- a/dlls/wininet/http.c +++ b/dlls/wininet/http.c @@ -1701,7 +1701,8 @@ static DWORD HTTPREQ_QueryOption(object_header_t *hdr, DWORD option, void *buffe *(DWORD*)buffer = SECURITY_FLAG_SECURE; else *(DWORD*)buffer = 0; - FIXME("Semi-STUB INTERNET_OPTION_SECURITY_FLAGS: %x\n",*(DWORD*)buffer); + *(DWORD *)buffer |= req->netConnection.security_flags; + /* FIXME: set connection cipher strength (SECURITY_FLAG_STRENGTH_*) */ return ERROR_SUCCESS; }

1 0

Juan Lang : wininet: Remove unneeded error message.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: 6808c1c684677a4664a9dd18d33235032965fde8 URL: http://source.winehq.org/git/wine.git/?a=commit;h=6808c1c684677a4664a9dd18d… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Sep 29 08:16:07 2010 -0700 wininet: Remove unneeded error message. --- dlls/wininet/netconnection.c | 12 +----------- 1 files changed, 1 insertions(+), 11 deletions(-) diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c index 7bb00dc..e06a253 100644 --- a/dlls/wininet/netconnection.c +++ b/dlls/wininet/netconnection.c @@ -145,7 +145,6 @@ MAKE_FUNCPTR(SSL_get_ex_new_index); MAKE_FUNCPTR(SSL_get_ex_data); MAKE_FUNCPTR(SSL_set_ex_data); MAKE_FUNCPTR(SSL_get_ex_data_X509_STORE_CTX_idx); -MAKE_FUNCPTR(SSL_get_verify_result); MAKE_FUNCPTR(SSL_get_peer_certificate); MAKE_FUNCPTR(SSL_CTX_get_timeout); MAKE_FUNCPTR(SSL_CTX_set_timeout); @@ -426,7 +425,6 @@ DWORD NETCON_init(WININET_NETCONNECTION *connection, BOOL useSSL) DYNSSL(SSL_get_ex_data); DYNSSL(SSL_set_ex_data); DYNSSL(SSL_get_ex_data_X509_STORE_CTX_idx); - DYNSSL(SSL_get_verify_result); DYNSSL(SSL_get_peer_certificate); DYNSSL(SSL_CTX_get_timeout); DYNSSL(SSL_CTX_set_timeout); @@ -670,9 +668,8 @@ DWORD NETCON_close(WININET_NETCONNECTION *connection) DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) { DWORD res = ERROR_NOT_SUPPORTED; -#ifdef SONAME_LIBSSL - long verify_res; +#ifdef SONAME_LIBSSL /* can't connect if we are already connected */ if (connection->useSSL) { @@ -719,13 +716,6 @@ DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) ERR("SSL_connect failed: %d\n", res); goto fail; } - verify_res = pSSL_get_verify_result(connection->ssl_s); - if (verify_res != X509_V_OK) - { - ERR("couldn't verify the security of the connection, %ld\n", verify_res); - /* FIXME: we should set an error and return, but we only warn at - * the moment */ - } connection->useSSL = TRUE; return ERROR_SUCCESS;

1 0

Juan Lang : wininet: Honor security flags when verifying certificates.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: 44112c367f6a08a7dd0d841b34d0ead3d6bcac63 URL: http://source.winehq.org/git/wine.git/?a=commit;h=44112c367f6a08a7dd0d841b3… Author: Juan Lang <juan.lang(a)gmail.com> Date: Wed Sep 29 07:53:53 2010 -0700 wininet: Honor security flags when verifying certificates. --- dlls/wininet/netconnection.c | 52 +++++++++++++++++++++++++++++++---------- 1 files changed, 39 insertions(+), 13 deletions(-) diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c index 9d52ae6..7bb00dc 100644 --- a/dlls/wininet/netconnection.c +++ b/dlls/wininet/netconnection.c @@ -220,7 +220,7 @@ static PCCERT_CONTEXT X509_to_cert_context(X509 *cert) } static DWORD netconn_verify_cert(PCCERT_CONTEXT cert, HCERTSTORE store, - WCHAR *server) + WCHAR *server, DWORD security_flags) { BOOL ret; CERT_CHAIN_PARA chainPara = { sizeof(chainPara), { 0 } }; @@ -237,30 +237,49 @@ static DWORD netconn_verify_cert(PCCERT_CONTEXT cert, HCERTSTORE store, { if (chain->TrustStatus.dwErrorStatus) { + static const DWORD supportedErrors = + CERT_TRUST_IS_NOT_TIME_VALID | + CERT_TRUST_IS_UNTRUSTED_ROOT | + CERT_TRUST_IS_OFFLINE_REVOCATION | + CERT_TRUST_REVOCATION_STATUS_UNKNOWN | + CERT_TRUST_IS_REVOKED | + CERT_TRUST_IS_NOT_VALID_FOR_USAGE; + if (chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_NOT_TIME_VALID) err = ERROR_INTERNET_SEC_CERT_DATE_INVALID; else if (chain->TrustStatus.dwErrorStatus & - CERT_TRUST_IS_UNTRUSTED_ROOT) + CERT_TRUST_IS_UNTRUSTED_ROOT && + !(security_flags & SECURITY_FLAG_IGNORE_UNKNOWN_CA)) err = ERROR_INTERNET_INVALID_CA; - else if ((chain->TrustStatus.dwErrorStatus & + else if (!(security_flags & SECURITY_FLAG_IGNORE_REVOCATION) && + ((chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_OFFLINE_REVOCATION) || - (chain->TrustStatus.dwErrorStatus & - CERT_TRUST_REVOCATION_STATUS_UNKNOWN)) + (chain->TrustStatus.dwErrorStatus & + CERT_TRUST_REVOCATION_STATUS_UNKNOWN))) err = ERROR_INTERNET_SEC_CERT_NO_REV; - else if (chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_REVOKED) + else if (!(security_flags & SECURITY_FLAG_IGNORE_REVOCATION) && + (chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_REVOKED)) err = ERROR_INTERNET_SEC_CERT_REVOKED; - else if (chain->TrustStatus.dwErrorStatus & - CERT_TRUST_IS_NOT_VALID_FOR_USAGE) + else if (!(security_flags & SECURITY_FLAG_IGNORE_WRONG_USAGE) && + (chain->TrustStatus.dwErrorStatus & + CERT_TRUST_IS_NOT_VALID_FOR_USAGE)) err = ERROR_INTERNET_SEC_INVALID_CERT; - else + else if (chain->TrustStatus.dwErrorStatus & ~supportedErrors) err = ERROR_INTERNET_SEC_INVALID_CERT; } - else + if (!err) { CERT_CHAIN_POLICY_PARA policyPara; SSL_EXTRA_CERT_CHAIN_POLICY_PARA sslExtraPolicyPara; CERT_CHAIN_POLICY_STATUS policyStatus; + CERT_CHAIN_CONTEXT chainCopy; + /* Clear chain->TrustStatus.dwErrorStatus so + * CertVerifyCertificateChainPolicy will verify additional checks + * rather than stopping with an existing, ignored error. + */ + memcpy(&chainCopy, chain, sizeof(chainCopy)); + chainCopy.TrustStatus.dwErrorStatus = 0; sslExtraPolicyPara.u.cbSize = sizeof(sslExtraPolicyPara); sslExtraPolicyPara.dwAuthType = AUTHTYPE_SERVER; sslExtraPolicyPara.pwszServerName = server; @@ -268,14 +287,18 @@ static DWORD netconn_verify_cert(PCCERT_CONTEXT cert, HCERTSTORE store, policyPara.dwFlags = 0; policyPara.pvExtraPolicyPara = &sslExtraPolicyPara; ret = CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_SSL, - chain, &policyPara, &policyStatus); + &chainCopy, &policyPara, &policyStatus); /* Any error in the policy status indicates that the * policy couldn't be verified. */ if (ret && policyStatus.dwError) { if (policyStatus.dwError == CERT_E_CN_NO_MATCH) - err = ERROR_INTERNET_SEC_CERT_CN_INVALID; + { + if (!(security_flags & + SECURITY_FLAG_IGNORE_CERT_CN_INVALID)) + err = ERROR_INTERNET_SEC_CERT_CN_INVALID; + } else err = ERROR_INTERNET_SEC_INVALID_CERT; } @@ -293,10 +316,12 @@ static int netconn_secure_verify(int preverify_ok, X509_STORE_CTX *ctx) BOOL ret = FALSE; HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, CERT_STORE_CREATE_NEW_FLAG, NULL); + WININET_NETCONNECTION *conn; ssl = pX509_STORE_CTX_get_ex_data(ctx, pSSL_get_ex_data_X509_STORE_CTX_idx()); server = pSSL_get_ex_data(ssl, hostname_idx); + conn = pSSL_get_ex_data(ssl, conn_idx); if (store) { X509 *cert; @@ -323,7 +348,8 @@ static int netconn_secure_verify(int preverify_ok, X509_STORE_CTX *ctx) if (!endCert) ret = FALSE; if (ret) { - DWORD_PTR err = netconn_verify_cert(endCert, store, server); + DWORD_PTR err = netconn_verify_cert(endCert, store, server, + conn->security_flags); if (err) {

1 0

Juan Lang : wininet: Don' t call SSL_connect until initialization is complete.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: 98dbdadcdafaa3708e36074708ade5782f892fe4 URL: http://source.winehq.org/git/wine.git/?a=commit;h=98dbdadcdafaa3708e3607470… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Sep 28 18:15:58 2010 -0700 wininet: Don't call SSL_connect until initialization is complete. --- dlls/wininet/netconnection.c | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c index d6bd567..9d52ae6 100644 --- a/dlls/wininet/netconnection.c +++ b/dlls/wininet/netconnection.c @@ -671,14 +671,6 @@ DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) goto fail; } - if (pSSL_connect(connection->ssl_s) <= 0) - { - res = (DWORD_PTR)pSSL_get_ex_data(connection->ssl_s, error_idx); - if (!res) - res = ERROR_INTERNET_SECURITY_CHANNEL_ERROR; - ERR("SSL_connect failed: %d\n", res); - goto fail; - } if (!pSSL_set_ex_data(connection->ssl_s, hostname_idx, hostname)) { ERR("SSL_set_ex_data failed: %s\n", @@ -693,6 +685,14 @@ DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) res = ERROR_INTERNET_SECURITY_CHANNEL_ERROR; goto fail; } + if (pSSL_connect(connection->ssl_s) <= 0) + { + res = (DWORD_PTR)pSSL_get_ex_data(connection->ssl_s, error_idx); + if (!res) + res = ERROR_INTERNET_SECURITY_CHANNEL_ERROR; + ERR("SSL_connect failed: %d\n", res); + goto fail; + } verify_res = pSSL_get_verify_result(connection->ssl_s); if (verify_res != X509_V_OK) {

1 0

Juan Lang : wininet: Don't retrieve a certificate that isn't used.
by Alexandre Julliard 30 Sep '10

30 Sep '10

Module: wine Branch: master Commit: 181a367a1f77ae3b88e0e36dcad7b0840b920de6 URL: http://source.winehq.org/git/wine.git/?a=commit;h=181a367a1f77ae3b88e0e36dc… Author: Juan Lang <juan.lang(a)gmail.com> Date: Tue Sep 28 18:10:40 2010 -0700 wininet: Don't retrieve a certificate that isn't used. --- dlls/wininet/netconnection.c | 9 --------- 1 files changed, 0 insertions(+), 9 deletions(-) diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c index 9717b92..d6bd567 100644 --- a/dlls/wininet/netconnection.c +++ b/dlls/wininet/netconnection.c @@ -646,7 +646,6 @@ DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) DWORD res = ERROR_NOT_SUPPORTED; #ifdef SONAME_LIBSSL long verify_res; - X509 *cert; /* can't connect if we are already connected */ if (connection->useSSL) @@ -694,14 +693,6 @@ DWORD NETCON_secure_connect(WININET_NETCONNECTION *connection, LPWSTR hostname) res = ERROR_INTERNET_SECURITY_CHANNEL_ERROR; goto fail; } - cert = pSSL_get_peer_certificate(connection->ssl_s); - if (!cert) - { - ERR("no certificate for server %s\n", debugstr_w(hostname)); - /* FIXME: is this the best error? */ - res = ERROR_INTERNET_INVALID_CA; - goto fail; - } verify_res = pSSL_get_verify_result(connection->ssl_s); if (verify_res != X509_V_OK) {

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

wine-commits September 2010