[PATCH v2 3/6] crypt32: Check CERT_TRUST_REVOCATION_STATUS_UNKNOWN instead of CERT_TRUST_IS_OFFLINE_REVOCATION in verify_ssl_policy().

[Paul Gofman]

From: Paul Gofman

---
 dlls/crypt32/chain.c       |  8 +++-----
 dlls/crypt32/tests/chain.c | 14 +++++++-------
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c
index b7072a2f8b4..fb2f391ff6e 100644
--- a/dlls/crypt32/chain.c
+++ b/dlls/crypt32/chain.c
@@ -2707,6 +2707,7 @@ static void CRYPT_VerifyChainRevocation(PCERT_CHAIN_CONTEXT chain,

switch (revocationStatus.dwError)
                     {
+                    case CRYPT_E_REVOCATION_OFFLINE:
                     case CRYPT_E_NO_REVOCATION_CHECK:
                     case CRYPT_E_NO_REVOCATION_DLL:
                     case CRYPT_E_NOT_IN_REVOCATION_DATABASE:
@@ -2716,9 +2717,6 @@ static void CRYPT_VerifyChainRevocation(PCERT_CHAIN_CONTEXT chain,
                         error = CERT_TRUST_REVOCATION_STATUS_UNKNOWN |
                          CERT_TRUST_IS_OFFLINE_REVOCATION;
                         break;
-                    case CRYPT_E_REVOCATION_OFFLINE:
-                        error = CERT_TRUST_IS_OFFLINE_REVOCATION;
-                        break;
                     case CRYPT_E_REVOKED:
                         error = CERT_TRUST_IS_REVOKED;
                         break;
@@ -3519,12 +3517,12 @@ static BOOL WINAPI verify_ssl_policy(LPCSTR szPolicyOID,
          &pPolicyStatus->lElementIndex);
     }
     else if (pChainContext->TrustStatus.dwErrorStatus &
-     CERT_TRUST_IS_OFFLINE_REVOCATION &&
+     CERT_TRUST_REVOCATION_STATUS_UNKNOWN &&
      !(checks & SECURITY_FLAG_IGNORE_REVOCATION))
     {
         pPolicyStatus->dwError = CRYPT_E_REVOCATION_OFFLINE;
         find_element_with_error(pChainContext,
-         CERT_TRUST_IS_OFFLINE_REVOCATION, &pPolicyStatus->lChainIndex,
+         CERT_TRUST_REVOCATION_STATUS_UNKNOWN, &pPolicyStatus->lChainIndex,
          &pPolicyStatus->lElementIndex);
     }
     else if (pChainContext->TrustStatus.dwErrorStatus &
diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c
index 528ba1060c0..3b3d870a278 100644
--- a/dlls/crypt32/tests/chain.c
+++ b/dlls/crypt32/tests/chain.c
@@ -5398,14 +5398,14 @@ static void test_VerifyCertChainPolicy_flags(void)
         { CERT_TRUST_REVOCATION_STATUS_UNKNOWN | CERT_TRUST_IS_OFFLINE_REVOCATION, 0, CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG, 0, CRYPT_E_REVOCATION_OFFLINE },
         { CERT_TRUST_REVOCATION_STATUS_UNKNOWN | CERT_TRUST_IS_OFFLINE_REVOCATION, 0, CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG, 0, CRYPT_E_REVOCATION_OFFLINE },
         /* CERT_TRUST_IS_OFFLINE_REVOCATION is ignored. */
-        { CERT_TRUST_IS_OFFLINE_REVOCATION, 0, 0, 0, ERROR_SUCCESS, TRUE },
-        { CERT_TRUST_IS_OFFLINE_REVOCATION, 1, 0, 0, ERROR_SUCCESS, TRUE },
-        { CERT_TRUST_IS_OFFLINE_REVOCATION, 2, 0, 0, ERROR_SUCCESS, TRUE },
-        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, 0, 0, 0, CRYPT_E_REVOCATION_OFFLINE, TRUE },
+        { CERT_TRUST_IS_OFFLINE_REVOCATION, 0, 0, 0, ERROR_SUCCESS },
+        { CERT_TRUST_IS_OFFLINE_REVOCATION, 1, 0, 0, ERROR_SUCCESS },
+        { CERT_TRUST_IS_OFFLINE_REVOCATION, 2, 0, 0, ERROR_SUCCESS },
+        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, 0, 0, 0, CRYPT_E_REVOCATION_OFFLINE },
         /* CERT_TRUST_REVOCATION_STATUS_UNKNOWN is only cheked on the end certificate. */
-        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, 1, 0, 0, ERROR_SUCCESS },
-        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, 2, 0, 0, ERROR_SUCCESS },
-        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, 0, CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG, 0, 0 },
+        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, 1, 0, 0, ERROR_SUCCESS, TRUE },
+        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, 2, 0, 0, ERROR_SUCCESS, TRUE },
+        { CERT_TRUST_REVOCATION_STATUS_UNKNOWN, 0, CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG, 0, 0, TRUE },

{ CERT_TRUST_IS_REVOKED, 0, 0, 0, CRYPT_E_REVOKED },
         { CERT_TRUST_IS_REVOKED, 1, 0, 0, CRYPT_E_REVOKED },