Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
W
wine-cw
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
wine
wine-cw
Commits
e4c03521
Commit
e4c03521
authored
Nov 17, 2009
by
Juan Lang
Committed by
Alexandre Julliard
Nov 18, 2009
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
crypt32: Apply name constraints to subject name.
parent
6f35ae25
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
37 additions
and
9 deletions
+37
-9
chain.c
dlls/crypt32/chain.c
+37
-9
No files found.
dlls/crypt32/chain.c
View file @
e4c03521
...
...
@@ -865,6 +865,36 @@ static void compare_alt_name_with_constraints(const CERT_EXTENSION *altNameExt,
CERT_TRUST_INVALID_EXTENSION
|
CERT_TRUST_INVALID_NAME_CONSTRAINTS
;
}
static
void
compare_subject_with_constraints
(
const
CERT_NAME_BLOB
*
subjectName
,
const
CERT_NAME_CONSTRAINTS_INFO
*
nameConstraints
,
DWORD
*
trustErrorStatus
)
{
DWORD
i
;
for
(
i
=
0
;
i
<
nameConstraints
->
cExcludedSubtree
;
i
++
)
{
CERT_ALT_NAME_ENTRY
*
constraint
=
&
nameConstraints
->
rgExcludedSubtree
[
i
].
Base
;
if
(
constraint
->
dwAltNameChoice
==
CERT_ALT_NAME_DIRECTORY_NAME
&&
directory_name_matches
(
&
constraint
->
u
.
DirectoryName
,
subjectName
))
*
trustErrorStatus
|=
CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT
;
}
for
(
i
=
0
;
i
<
nameConstraints
->
cPermittedSubtree
;
i
++
)
{
CERT_ALT_NAME_ENTRY
*
constraint
=
&
nameConstraints
->
rgPermittedSubtree
[
i
].
Base
;
if
(
constraint
->
dwAltNameChoice
==
CERT_ALT_NAME_DIRECTORY_NAME
)
{
if
(
!
directory_name_matches
(
&
constraint
->
u
.
DirectoryName
,
subjectName
))
*
trustErrorStatus
|=
CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT
;
}
}
}
static
void
CRYPT_CheckNameConstraints
(
const
CERT_NAME_CONSTRAINTS_INFO
*
nameConstraints
,
const
CERT_INFO
*
cert
,
DWORD
*
trustErrorStatus
)
...
...
@@ -874,15 +904,13 @@ static void CRYPT_CheckNameConstraints(
if
(
ext
)
compare_alt_name_with_constraints
(
ext
,
nameConstraints
,
trustErrorStatus
);
else
{
if
(
nameConstraints
->
cPermittedSubtree
)
*
trustErrorStatus
|=
CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT
|
CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT
;
if
(
nameConstraints
->
cExcludedSubtree
)
*
trustErrorStatus
|=
CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT
;
}
/* Name constraints apply to the subject alternative name as well as the
* subject name. From RFC 5280, section 4.2.1.10:
* "Restrictions apply to the subject distinguished name and apply to
* subject alternative names."
*/
compare_subject_with_constraints
(
&
cert
->
Subject
,
nameConstraints
,
trustErrorStatus
);
}
/* Gets cert's name constraints, if any. Free with LocalFree. */
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment