Skip to content

W
wine-cw
Commit 18e46df9 authored by Zebediah Figura's avatar Zebediah Figura Committed by Alexandre Julliard
Browse files
Options

cryptnet: Set dwIndex in CertDllVerifyRevocation().

Signed-off-by: 's avatarZebediah Figura <zfigura@codeweavers.com> Signed-off-by: 's avatarAlexandre Julliard <julliard@winehq.org>
parent 0429df4a
Show whitespace changes
Inline Side-by-side
Showing with 38 additions and 68 deletions
dlls/cryptnet/cryptnet_main.c
View file @ 18e46df9
...@@ -1514,33 +1514,22 @@ BOOL WINAPI CryptRetrieveObjectByUrlW(LPCWSTR pszURL, LPCSTR pszObjectOid, ...@@ -1514,33 +1514,22 @@ BOOL WINAPI CryptRetrieveObjectByUrlW(LPCWSTR pszURL, LPCSTR pszObjectOid,
return ret; return ret;
} }
static DWORD verify_cert_revocation_with_crl_online(PCCERT_CONTEXT cert, static DWORD verify_cert_revocation_with_crl_online(const CERT_CONTEXT *cert,
PCCRL_CONTEXT crl, DWORD index, FILETIME *pTime, const CRL_CONTEXT *crl, FILETIME *pTime, CERT_REVOCATION_STATUS *pRevStatus)
PCERT_REVOCATION_STATUS pRevStatus)
{ {
DWORD error;
PCRL_ENTRY entry = NULL; PCRL_ENTRY entry = NULL;
CertFindCertificateInCRL(cert, crl, 0, NULL, &entry); CertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
if (entry) if (entry)
{ return CRYPT_E_REVOKED;
error = CRYPT_E_REVOKED;
pRevStatus->dwIndex = index;
}
else
{
/* Since the CRL was retrieved for the cert being checked, then it's /* Since the CRL was retrieved for the cert being checked, then it's
* guaranteed to be fresh, and the cert is not revoked. * guaranteed to be fresh, and the cert is not revoked. */
*/ return ERROR_SUCCESS;
error = ERROR_SUCCESS;
}
return error;
} }
static DWORD verify_cert_revocation_from_dist_points_ext( static DWORD verify_cert_revocation_from_dist_points_ext(const CRYPT_DATA_BLOB *value, const CERT_CONTEXT *cert,
const CRYPT_DATA_BLOB *value, PCCERT_CONTEXT cert, DWORD index, FILETIME *pTime, DWORD dwFlags, const CERT_REVOCATION_PARA *pRevPara, CERT_REVOCATION_STATUS *pRevStatus)
FILETIME *pTime, DWORD dwFlags, const CERT_REVOCATION_PARA *pRevPara,
PCERT_REVOCATION_STATUS pRevStatus)
{ {
DWORD error = ERROR_SUCCESS, cbUrlArray; DWORD error = ERROR_SUCCESS, cbUrlArray;
...@@ -1578,17 +1567,13 @@ static DWORD verify_cert_revocation_from_dist_points_ext( ...@@ -1578,17 +1567,13 @@ static DWORD verify_cert_revocation_from_dist_points_ext(
NULL, NULL, NULL, NULL); NULL, NULL, NULL, NULL);
if (ret) if (ret)
{ {
error = verify_cert_revocation_with_crl_online(cert, crl, error = verify_cert_revocation_with_crl_online(cert, crl, pTime, pRevStatus);
index, pTime, pRevStatus);
if (!error && timeout) if (!error && timeout)
{ {
DWORD time = GetTickCount(); DWORD time = GetTickCount();
if ((int)(endTime - time) <= 0) if ((int)(endTime - time) <= 0)
{
error = ERROR_TIMEOUT; error = ERROR_TIMEOUT;
pRevStatus->dwIndex = index;
}
else else
timeout = endTime - time; timeout = endTime - time;
} }
...@@ -1600,23 +1585,15 @@ static DWORD verify_cert_revocation_from_dist_points_ext( ...@@ -1600,23 +1585,15 @@ static DWORD verify_cert_revocation_from_dist_points_ext(
CryptMemFree(urlArray); CryptMemFree(urlArray);
} }
else else
{
error = ERROR_OUTOFMEMORY; error = ERROR_OUTOFMEMORY;
pRevStatus->dwIndex = index;
}
} }
else else
{
error = GetLastError(); error = GetLastError();
pRevStatus->dwIndex = index;
}
return error; return error;
} }
static DWORD verify_cert_revocation_from_aia_ext( static DWORD verify_cert_revocation_from_aia_ext(const CRYPT_DATA_BLOB *value, const CERT_CONTEXT *cert,
const CRYPT_DATA_BLOB *value, PCCERT_CONTEXT cert, DWORD index, FILETIME *pTime, DWORD dwFlags, CERT_REVOCATION_PARA *pRevPara, CERT_REVOCATION_STATUS *pRevStatus)
FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara,
PCERT_REVOCATION_STATUS pRevStatus)
{ {
BOOL ret; BOOL ret;
DWORD error, size; DWORD error, size;
...@@ -1650,10 +1627,9 @@ static DWORD verify_cert_revocation_from_aia_ext( ...@@ -1650,10 +1627,9 @@ static DWORD verify_cert_revocation_from_aia_ext(
} }
static DWORD verify_cert_revocation_with_crl_offline(PCCERT_CONTEXT cert, static DWORD verify_cert_revocation_with_crl_offline(PCCERT_CONTEXT cert,
PCCRL_CONTEXT crl, DWORD index, FILETIME *pTime, const CRL_CONTEXT *crl, FILETIME *pTime, CERT_REVOCATION_STATUS *pRevStatus)
PCERT_REVOCATION_STATUS pRevStatus)
{ {
DWORD error; PCRL_ENTRY entry = NULL;
LONG valid; LONG valid;
valid = CompareFileTime(pTime, &crl->pCrlInfo->ThisUpdate); valid = CompareFileTime(pTime, &crl->pCrlInfo->ThisUpdate);
...@@ -1663,46 +1639,38 @@ static DWORD verify_cert_revocation_with_crl_offline(PCCERT_CONTEXT cert, ...@@ -1663,46 +1639,38 @@ static DWORD verify_cert_revocation_with_crl_offline(PCCERT_CONTEXT cert,
* way to know whether the certificate was revoked. * way to know whether the certificate was revoked.
*/ */
TRACE("CRL not old enough\n"); TRACE("CRL not old enough\n");
error = CRYPT_E_REVOCATION_OFFLINE; return CRYPT_E_REVOCATION_OFFLINE;
} }
else
{
PCRL_ENTRY entry = NULL;
CertFindCertificateInCRL(cert, crl, 0, NULL, &entry); CertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
if (entry) if (entry)
{ return CRYPT_E_REVOKED;
error = CRYPT_E_REVOKED;
pRevStatus->dwIndex = index; /* Since the CRL was not retrieved for the cert being checked, there's no
} * guarantee it's fresh, so the cert *might* be okay, but it's safer not to
else * guess. */
{
/* Since the CRL was not retrieved for the cert being checked,
* there's no guarantee it's fresh, so the cert *might* be okay,
* but it's safer not to guess.
*/
TRACE("certificate not found\n"); TRACE("certificate not found\n");
error = CRYPT_E_REVOCATION_OFFLINE; return CRYPT_E_REVOCATION_OFFLINE;
}
}
return error;
} }
static DWORD verify_cert_revocation(PCCERT_CONTEXT cert, DWORD index, static DWORD verify_cert_revocation(const CERT_CONTEXT *cert, FILETIME *pTime,
FILETIME *pTime, DWORD dwFlags, PCERT_REVOCATION_PARA pRevPara, DWORD dwFlags, CERT_REVOCATION_PARA *pRevPara, CERT_REVOCATION_STATUS *pRevStatus)
PCERT_REVOCATION_STATUS pRevStatus)
{ {
DWORD error = ERROR_SUCCESS; DWORD error = ERROR_SUCCESS;
PCERT_EXTENSION ext; PCERT_EXTENSION ext;
if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS, if ((ext = CertFindExtension(szOID_CRL_DIST_POINTS,
cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension))) cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
{
error = verify_cert_revocation_from_dist_points_ext(&ext->Value, cert, error = verify_cert_revocation_from_dist_points_ext(&ext->Value, cert,
index, pTime, dwFlags, pRevPara, pRevStatus); pTime, dwFlags, pRevPara, pRevStatus);
}
else if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS, else if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS,
cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension))) cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
error = verify_cert_revocation_from_aia_ext(&ext->Value, cert, {
index, pTime, dwFlags, pRevPara, pRevStatus); error = verify_cert_revocation_from_aia_ext(&ext->Value, cert, pTime,
dwFlags, pRevPara, pRevStatus);
}
else else
{ {
if (pRevPara && pRevPara->hCrlStore && pRevPara->pIssuerCert) if (pRevPara && pRevPara->hCrlStore && pRevPara->pIssuerCert)
...@@ -1753,15 +1721,13 @@ static DWORD verify_cert_revocation(PCCERT_CONTEXT cert, DWORD index, ...@@ -1753,15 +1721,13 @@ static DWORD verify_cert_revocation(PCCERT_CONTEXT cert, DWORD index,
} }
if (crl) if (crl)
{ {
error = verify_cert_revocation_with_crl_offline(cert, crl, error = verify_cert_revocation_with_crl_offline(cert, crl, pTime, pRevStatus);
index, pTime, pRevStatus);
CertFreeCRLContext(crl); CertFreeCRLContext(crl);
} }
else else
{ {
TRACE("no CRL found\n"); TRACE("no CRL found\n");
error = CRYPT_E_NO_REVOCATION_CHECK; error = CRYPT_E_NO_REVOCATION_CHECK;
pRevStatus->dwIndex = index;
} }
} }
else else
...@@ -1773,7 +1739,6 @@ static DWORD verify_cert_revocation(PCCERT_CONTEXT cert, DWORD index, ...@@ -1773,7 +1739,6 @@ static DWORD verify_cert_revocation(PCCERT_CONTEXT cert, DWORD index,
else if (!pRevPara->pIssuerCert) else if (!pRevPara->pIssuerCert)
WARN("no dist points/aia extension and no issuer\n"); WARN("no dist points/aia extension and no issuer\n");
error = CRYPT_E_NO_REVOCATION_CHECK; error = CRYPT_E_NO_REVOCATION_CHECK;
pRevStatus->dwIndex = index;
} }
} }
return error; return error;
...@@ -1833,9 +1798,14 @@ BOOL WINAPI CertDllVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType, ...@@ -1833,9 +1798,14 @@ BOOL WINAPI CertDllVerifyRevocation(DWORD dwEncodingType, DWORD dwRevType,
error = CRYPT_E_NO_REVOCATION_CHECK; error = CRYPT_E_NO_REVOCATION_CHECK;
else else
{ {
for (i = 0; !error && i < cContext; i++) for (i = 0; i < cContext; i++)
error = verify_cert_revocation(rgpvContext[i], i, pTime, dwFlags, {
pRevPara, pRevStatus); if ((error = verify_cert_revocation(rgpvContext[i], pTime, dwFlags, pRevPara, pRevStatus)))
{
pRevStatus->dwIndex = i;
break;
}
}
} }
if (error) if (error)
{ {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment