1 /*
2 * crypt32 CRL functions tests
3 *
4 * Copyright 2005-2006 Juan Lang
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
19 */
20
21 #include <assert.h>
22 #include <stdio.h>
23 #include <stdarg.h>
24 #include <windef.h>
25 #include <winbase.h>
26 #include <winreg.h>
27 #include <winerror.h>
28 #include <wincrypt.h>
29
30 #include "wine/test.h"
31
32
33 static const BYTE bigCert[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
34 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
35 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
36 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
37 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
38 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
39 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20,
40 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
41 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
42 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
43 static const BYTE bigCert2[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
44 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
45 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
46 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
47 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
48 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
49 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20,
50 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
51 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
52 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
53 static const BYTE bigCertWithDifferentIssuer[] = { 0x30, 0x7a, 0x02, 0x01,
54 0x01, 0x30, 0x02, 0x06, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
55 0x55, 0x04, 0x03, 0x13, 0x0a, 0x41, 0x6c, 0x65, 0x78, 0x20, 0x4c, 0x61, 0x6e,
56 0x67, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
57 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30,
58 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30,
59 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a,
60 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02,
61 0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03,
62 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff,
63 0x02, 0x01, 0x01 };
64 static const BYTE CRL[] = { 0x30, 0x2c, 0x30, 0x02, 0x06, 0x00,
65 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a,
66 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x18, 0x0f, 0x31,
67 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30,
68 0x5a };
69 static const BYTE newerCRL[] = { 0x30, 0x2a, 0x30, 0x02, 0x06, 0x00, 0x30,
70 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a,
71 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x17, 0x0d, 0x30, 0x36,
72 0x30, 0x35, 0x31, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a };
73 static const BYTE signedCRL[] = { 0x30, 0x45, 0x30, 0x2c, 0x30, 0x02, 0x06,
74 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
75 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x18, 0x0f,
76 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30,
77 0x30, 0x5a, 0x30, 0x02, 0x06, 0x00, 0x03, 0x11, 0x00, 0x0f, 0x0e, 0x0d, 0x0c,
78 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00 };
79
80 static BOOL (WINAPI *pCertFindCertificateInCRL)(PCCERT_CONTEXT,PCCRL_CONTEXT,DWORD,void*,PCRL_ENTRY*);
81 static PCCRL_CONTEXT (WINAPI *pCertFindCRLInStore)(HCERTSTORE,DWORD,DWORD,DWORD,const void*,PCCRL_CONTEXT);
82 static BOOL (WINAPI *pCertIsValidCRLForCertificate)(PCCERT_CONTEXT, PCCRL_CONTEXT, DWORD, void*);
83
84 static void init_function_pointers(void)
85 {
86 HMODULE hdll = GetModuleHandleA("crypt32.dll");
87 pCertFindCertificateInCRL = (void*)GetProcAddress(hdll, "CertFindCertificateInCRL");
88 pCertFindCRLInStore = (void*)GetProcAddress(hdll, "CertFindCRLInStore");
89 pCertIsValidCRLForCertificate = (void*)GetProcAddress(hdll, "CertIsValidCRLForCertificate");
90 }
91
92 static void testCreateCRL(void)
93 {
94 PCCRL_CONTEXT context;
95 DWORD GLE;
96
97 context = CertCreateCRLContext(0, NULL, 0);
98 ok(!context && GetLastError() == E_INVALIDARG,
99 "Expected E_INVALIDARG, got %08x\n", GetLastError());
100 context = CertCreateCRLContext(X509_ASN_ENCODING, NULL, 0);
101 GLE = GetLastError();
102 ok(!context && (GLE == CRYPT_E_ASN1_EOD || GLE == OSS_MORE_INPUT),
103 "Expected CRYPT_E_ASN1_EOD or OSS_MORE_INPUT, got %08x\n", GLE);
104 context = CertCreateCRLContext(X509_ASN_ENCODING, bigCert, sizeof(bigCert));
105 GLE = GetLastError();
106 ok(!context, "Expected failure\n");
107 context = CertCreateCRLContext(X509_ASN_ENCODING, signedCRL,
108 sizeof(signedCRL) - 1);
109 ok(!context, "Expected failure\n");
110 context = CertCreateCRLContext(X509_ASN_ENCODING, signedCRL,
111 sizeof(signedCRL));
112 ok(context != NULL, "CertCreateCRLContext failed: %08x\n", GetLastError());
113 if (context)
114 CertFreeCRLContext(context);
115 context = CertCreateCRLContext(X509_ASN_ENCODING, CRL, sizeof(CRL));
116 ok(context != NULL, "CertCreateCRLContext failed: %08x\n", GetLastError());
117 if (context)
118 CertFreeCRLContext(context);
119 }
120
121 static void testAddCRL(void)
122 {
123 HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
124 CERT_STORE_CREATE_NEW_FLAG, NULL);
125 PCCRL_CONTEXT context;
126 BOOL ret;
127 DWORD GLE;
128
129 if (!store) return;
130
131 /* Bad CRL encoding type */
132 ret = CertAddEncodedCRLToStore(0, 0, NULL, 0, 0, NULL);
133 ok(!ret && GetLastError() == E_INVALIDARG,
134 "Expected E_INVALIDARG, got %08x\n", GetLastError());
135 ret = CertAddEncodedCRLToStore(store, 0, NULL, 0, 0, NULL);
136 ok(!ret && GetLastError() == E_INVALIDARG,
137 "Expected E_INVALIDARG, got %08x\n", GetLastError());
138 ret = CertAddEncodedCRLToStore(0, 0, signedCRL, sizeof(signedCRL), 0, NULL);
139 ok(!ret && GetLastError() == E_INVALIDARG,
140 "Expected E_INVALIDARG, got %08x\n", GetLastError());
141 ret = CertAddEncodedCRLToStore(store, 0, signedCRL, sizeof(signedCRL), 0,
142 NULL);
143 ok(!ret && GetLastError() == E_INVALIDARG,
144 "Expected E_INVALIDARG, got %08x\n", GetLastError());
145 ret = CertAddEncodedCRLToStore(0, 0, signedCRL, sizeof(signedCRL),
146 CERT_STORE_ADD_ALWAYS, NULL);
147 ok(!ret && GetLastError() == E_INVALIDARG,
148 "Expected E_INVALIDARG, got %08x\n", GetLastError());
149 ret = CertAddEncodedCRLToStore(store, 0, signedCRL, sizeof(signedCRL),
150 CERT_STORE_ADD_ALWAYS, NULL);
151 ok(!ret && GetLastError() == E_INVALIDARG,
152 "Expected E_INVALIDARG, got %08x\n", GetLastError());
153
154 /* No CRL */
155 ret = CertAddEncodedCRLToStore(0, X509_ASN_ENCODING, NULL, 0, 0, NULL);
156 GLE = GetLastError();
157 ok(!ret && (GLE == CRYPT_E_ASN1_EOD || GLE == OSS_MORE_INPUT),
158 "Expected CRYPT_E_ASN1_EOD or OSS_MORE_INPUT, got %08x\n", GLE);
159 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, NULL, 0, 0, NULL);
160 GLE = GetLastError();
161 ok(!ret && (GLE == CRYPT_E_ASN1_EOD || GLE == OSS_MORE_INPUT),
162 "Expected CRYPT_E_ASN1_EOD or OSS_MORE_INPUT, got %08x\n", GLE);
163
164 /* Weird--bad add disposition leads to an access violation in Windows. */
165 ret = CertAddEncodedCRLToStore(0, X509_ASN_ENCODING, signedCRL,
166 sizeof(signedCRL), 0, NULL);
167 ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
168 "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
169 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, signedCRL,
170 sizeof(signedCRL), 0, NULL);
171 ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
172 "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
173
174 /* Weird--can add a CRL to the NULL store (does this have special meaning?)
175 */
176 context = NULL;
177 ret = CertAddEncodedCRLToStore(0, X509_ASN_ENCODING, signedCRL,
178 sizeof(signedCRL), CERT_STORE_ADD_ALWAYS, &context);
179 ok(ret, "CertAddEncodedCRLToStore failed: %08x\n", GetLastError());
180 if (context)
181 CertFreeCRLContext(context);
182
183 /* Normal cases: a "signed" CRL is okay.. */
184 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, signedCRL,
185 sizeof(signedCRL), CERT_STORE_ADD_ALWAYS, NULL);
186 /* and an unsigned one is too. */
187 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, CRL, sizeof(CRL),
188 CERT_STORE_ADD_ALWAYS, NULL);
189 ok(ret, "CertAddEncodedCRLToStore failed: %08x\n", GetLastError());
190
191 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, newerCRL,
192 sizeof(newerCRL), CERT_STORE_ADD_NEW, NULL);
193 ok(!ret && GetLastError() == CRYPT_E_EXISTS,
194 "Expected CRYPT_E_EXISTS, got %08x\n", GetLastError());
195
196 /* This should replace (one of) the existing CRL(s). */
197 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, newerCRL,
198 sizeof(newerCRL), CERT_STORE_ADD_NEWER, NULL);
199 ok(ret, "CertAddEncodedCRLToStore failed: %08x\n", GetLastError());
200
201 CertCloseStore(store, 0);
202 }
203
204 static void testFindCRL(void)
205 {
206 HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
207 CERT_STORE_CREATE_NEW_FLAG, NULL);
208 PCCRL_CONTEXT context;
209 PCCERT_CONTEXT cert;
210 BOOL ret;
211
212 if (!store) return;
213 if (!pCertFindCRLInStore)
214 {
215 skip("CertFindCRLInStore() is not available\n");
216 return;
217 }
218
219 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, signedCRL,
220 sizeof(signedCRL), CERT_STORE_ADD_ALWAYS, NULL);
221 ok(ret, "CertAddEncodedCRLToStore failed: %08x\n", GetLastError());
222
223 /* Crashes
224 context = pCertFindCRLInStore(NULL, 0, 0, 0, NULL, NULL);
225 */
226
227 /* Find any context */
228 context = pCertFindCRLInStore(store, 0, 0, CRL_FIND_ANY, NULL, NULL);
229 ok(context != NULL, "Expected a context\n");
230 if (context)
231 CertFreeCRLContext(context);
232 /* Bogus flags are ignored */
233 context = pCertFindCRLInStore(store, 0, 1234, CRL_FIND_ANY, NULL, NULL);
234 ok(context != NULL, "Expected a context\n");
235 if (context)
236 CertFreeCRLContext(context);
237 /* CRL encoding type is ignored too */
238 context = pCertFindCRLInStore(store, 1234, 0, CRL_FIND_ANY, NULL, NULL);
239 ok(context != NULL, "Expected a context\n");
240 if (context)
241 CertFreeCRLContext(context);
242
243 /* This appears to match any cert */
244 context = pCertFindCRLInStore(store, 0, 0, CRL_FIND_ISSUED_BY, NULL, NULL);
245 ok(context != NULL, "Expected a context\n");
246 if (context)
247 CertFreeCRLContext(context);
248
249 /* Try to match an issuer that isn't in the store */
250 cert = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert2,
251 sizeof(bigCert2));
252 ok(cert != NULL, "CertCreateCertificateContext failed: %08x\n",
253 GetLastError());
254 context = pCertFindCRLInStore(store, 0, 0, CRL_FIND_ISSUED_BY, cert, NULL);
255 ok(context == NULL, "Expected no matching context\n");
256 CertFreeCertificateContext(cert);
257
258 /* Match an issuer that is in the store */
259 cert = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
260 sizeof(bigCert));
261 ok(cert != NULL, "CertCreateCertificateContext failed: %08x\n",
262 GetLastError());
263 context = pCertFindCRLInStore(store, 0, 0, CRL_FIND_ISSUED_BY, cert, NULL);
264 ok(context != NULL, "Expected a context\n");
265 if (context)
266 CertFreeCRLContext(context);
267 CertFreeCertificateContext(cert);
268
269 CertCloseStore(store, 0);
270 }
271
272 static void testGetCRLFromStore(void)
273 {
274 HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
275 CERT_STORE_CREATE_NEW_FLAG, NULL);
276 PCCRL_CONTEXT context;
277 PCCERT_CONTEXT cert;
278 DWORD flags;
279 BOOL ret;
280
281 if (!store) return;
282
283 /* Crash
284 context = CertGetCRLFromStore(NULL, NULL, NULL, NULL);
285 context = CertGetCRLFromStore(store, NULL, NULL, NULL);
286 */
287
288 /* Bogus flags */
289 flags = 0xffffffff;
290 context = CertGetCRLFromStore(store, NULL, NULL, &flags);
291 ok(!context && GetLastError() == E_INVALIDARG,
292 "Expected E_INVALIDARG, got %08x\n", GetLastError());
293
294 /* Test an empty store */
295 flags = 0;
296 context = CertGetCRLFromStore(store, NULL, NULL, &flags);
297 ok(context == NULL && GetLastError() == CRYPT_E_NOT_FOUND,
298 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
299
300 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, signedCRL,
301 sizeof(signedCRL), CERT_STORE_ADD_ALWAYS, NULL);
302 ok(ret, "CertAddEncodedCRLToStore failed: %08x\n", GetLastError());
303
304 /* NULL matches any CRL */
305 flags = 0;
306 context = CertGetCRLFromStore(store, NULL, NULL, &flags);
307 ok(context != NULL, "Expected a context\n");
308 CertFreeCRLContext(context);
309
310 /* This cert's issuer isn't in */
311 cert = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert2,
312 sizeof(bigCert2));
313 ok(cert != NULL, "CertCreateCertificateContext failed: %08x\n",
314 GetLastError());
315 context = CertGetCRLFromStore(store, cert, NULL, &flags);
316 ok(context == NULL && GetLastError() == CRYPT_E_NOT_FOUND,
317 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
318 CertFreeCertificateContext(cert);
319
320 /* But this one is */
321 cert = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
322 sizeof(bigCert));
323 ok(cert != NULL, "CertCreateCertificateContext failed: %08x\n",
324 GetLastError());
325 context = CertGetCRLFromStore(store, cert, NULL, &flags);
326 ok(context != NULL, "Expected a context\n");
327 CertFreeCRLContext(context);
328 CertFreeCertificateContext(cert);
329
330 CertCloseStore(store, 0);
331 }
332
333 static void checkCRLHash(const BYTE *data, DWORD dataLen, ALG_ID algID,
334 PCCRL_CONTEXT context, DWORD propID)
335 {
336 BYTE hash[20] = { 0 }, hashProperty[20];
337 BOOL ret;
338 DWORD size;
339
340 memset(hash, 0, sizeof(hash));
341 memset(hashProperty, 0, sizeof(hashProperty));
342 size = sizeof(hash);
343 ret = CryptHashCertificate(0, algID, 0, data, dataLen, hash, &size);
344 ok(ret, "CryptHashCertificate failed: %08x\n", GetLastError());
345 ret = CertGetCRLContextProperty(context, propID, hashProperty, &size);
346 ok(ret, "CertGetCRLContextProperty failed: %08x\n", GetLastError());
347 ok(!memcmp(hash, hashProperty, size), "Unexpected hash for property %d\n",
348 propID);
349 }
350
351 static void testCRLProperties(void)
352 {
353 PCCRL_CONTEXT context = CertCreateCRLContext(X509_ASN_ENCODING,
354 CRL, sizeof(CRL));
355
356 ok(context != NULL, "CertCreateCRLContext failed: %08x\n", GetLastError());
357 if (context)
358 {
359 DWORD propID, numProps, access, size;
360 BOOL ret;
361 BYTE hash[20] = { 0 }, hashProperty[20];
362 CRYPT_DATA_BLOB blob;
363
364 /* This crashes
365 propID = CertEnumCRLContextProperties(NULL, 0);
366 */
367
368 propID = 0;
369 numProps = 0;
370 do {
371 propID = CertEnumCRLContextProperties(context, propID);
372 if (propID)
373 numProps++;
374 } while (propID != 0);
375 ok(numProps == 0, "Expected 0 properties, got %d\n", numProps);
376
377 /* Tests with a NULL cert context. Prop ID 0 fails.. */
378 ret = CertSetCRLContextProperty(NULL, 0, 0, NULL);
379 ok(!ret && GetLastError() == E_INVALIDARG,
380 "Expected E_INVALIDARG, got %08x\n", GetLastError());
381 /* while this just crashes.
382 ret = CertSetCRLContextProperty(NULL, CERT_KEY_PROV_HANDLE_PROP_ID, 0,
383 NULL);
384 */
385
386 ret = CertSetCRLContextProperty(context, 0, 0, NULL);
387 ok(!ret && GetLastError() == E_INVALIDARG,
388 "Expected E_INVALIDARG, got %08x\n", GetLastError());
389 /* Can't set the cert property directly, this crashes.
390 ret = CertSetCRLContextProperty(context, CERT_CRL_PROP_ID, 0, CRL);
391 */
392
393 /* These all crash.
394 ret = CertGetCRLContextProperty(context, CERT_ACCESS_STATE_PROP_ID, 0,
395 NULL);
396 ret = CertGetCRLContextProperty(context, CERT_HASH_PROP_ID, NULL, NULL);
397 ret = CertGetCRLContextProperty(context, CERT_HASH_PROP_ID,
398 hashProperty, NULL);
399 */
400 /* A missing prop */
401 size = 0;
402 ret = CertGetCRLContextProperty(context, CERT_KEY_PROV_INFO_PROP_ID,
403 NULL, &size);
404 ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
405 "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
406 /* And, an implicit property */
407 ret = CertGetCRLContextProperty(context, CERT_ACCESS_STATE_PROP_ID,
408 NULL, &size);
409 ok(ret, "CertGetCRLContextProperty failed: %08x\n", GetLastError());
410 ret = CertGetCRLContextProperty(context, CERT_ACCESS_STATE_PROP_ID,
411 &access, &size);
412 ok(ret, "CertGetCRLContextProperty failed: %08x\n", GetLastError());
413 ok(!(access & CERT_ACCESS_STATE_WRITE_PERSIST_FLAG),
414 "Didn't expect a persisted crl\n");
415 /* Trying to set this "read only" property crashes.
416 access |= CERT_ACCESS_STATE_WRITE_PERSIST_FLAG;
417 ret = CertSetCRLContextProperty(context, CERT_ACCESS_STATE_PROP_ID, 0,
418 &access);
419 */
420
421 /* Can I set the hash to an invalid hash? */
422 blob.pbData = hash;
423 blob.cbData = sizeof(hash);
424 ret = CertSetCRLContextProperty(context, CERT_HASH_PROP_ID, 0, &blob);
425 ok(ret, "CertSetCRLContextProperty failed: %08x\n",
426 GetLastError());
427 size = sizeof(hashProperty);
428 ret = CertGetCRLContextProperty(context, CERT_HASH_PROP_ID,
429 hashProperty, &size);
430 ok(!memcmp(hashProperty, hash, sizeof(hash)), "Unexpected hash\n");
431 /* Delete the (bogus) hash, and get the real one */
432 ret = CertSetCRLContextProperty(context, CERT_HASH_PROP_ID, 0, NULL);
433 ok(ret, "CertSetCRLContextProperty failed: %08x\n", GetLastError());
434 checkCRLHash(CRL, sizeof(CRL), CALG_SHA1, context, CERT_HASH_PROP_ID);
435
436 /* Now that the hash property is set, we should get one property when
437 * enumerating.
438 */
439 propID = 0;
440 numProps = 0;
441 do {
442 propID = CertEnumCRLContextProperties(context, propID);
443 if (propID)
444 numProps++;
445 } while (propID != 0);
446 ok(numProps == 1, "Expected 1 properties, got %d\n", numProps);
447
448 /* Check a few other implicit properties */
449 checkCRLHash(CRL, sizeof(CRL), CALG_MD5, context,
450 CERT_MD5_HASH_PROP_ID);
451
452 CertFreeCRLContext(context);
453 }
454 }
455
456 static const BYTE v1CRLWithIssuerAndEntry[] = { 0x30, 0x44, 0x30, 0x02, 0x06,
457 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
458 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x18, 0x0f,
459 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30,
460 0x30, 0x5a, 0x30, 0x16, 0x30, 0x14, 0x02, 0x01, 0x01, 0x18, 0x0f, 0x31, 0x36,
461 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a };
462 static const BYTE v2CRLWithIssuingDistPoint[] = { 0x30,0x5c,0x02,0x01,0x01,
463 0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x03,
464 0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00,0x18,0x0f,0x31,
465 0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,
466 0x16,0x30,0x14,0x02,0x01,0x01,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,
467 0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0xa0,0x13,0x30,0x11,0x30,0x0f,0x06,
468 0x03,0x55,0x1d,0x13,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x01 };
469 static const BYTE verisignCRL[] = { 0x30, 0x82, 0x01, 0xb1, 0x30, 0x82, 0x01,
470 0x1a, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
471 0x0d, 0x01, 0x01, 0x02, 0x05, 0x00, 0x30, 0x61, 0x31, 0x11, 0x30, 0x0f, 0x06,
472 0x03, 0x55, 0x04, 0x07, 0x13, 0x08, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65,
473 0x74, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x56,
474 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e,
475 0x31, 0x33, 0x30, 0x31, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x2a, 0x56, 0x65,
476 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x20, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x72,
477 0x63, 0x69, 0x61, 0x6c, 0x20, 0x53, 0x6f, 0x66, 0x74, 0x77, 0x61, 0x72, 0x65,
478 0x20, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x72, 0x73, 0x20, 0x43,
479 0x41, 0x17, 0x0d, 0x30, 0x31, 0x30, 0x33, 0x32, 0x34, 0x30, 0x30, 0x30, 0x30,
480 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x30, 0x34, 0x30, 0x31, 0x30, 0x37, 0x32, 0x33,
481 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x69, 0x30, 0x21, 0x02, 0x10, 0x1b, 0x51,
482 0x90, 0xf7, 0x37, 0x24, 0x39, 0x9c, 0x92, 0x54, 0xcd, 0x42, 0x46, 0x37, 0x99,
483 0x6a, 0x17, 0x0d, 0x30, 0x31, 0x30, 0x31, 0x33, 0x30, 0x30, 0x30, 0x30, 0x31,
484 0x32, 0x34, 0x5a, 0x30, 0x21, 0x02, 0x10, 0x75, 0x0e, 0x40, 0xff, 0x97, 0xf0,
485 0x47, 0xed, 0xf5, 0x56, 0xc7, 0x08, 0x4e, 0xb1, 0xab, 0xfd, 0x17, 0x0d, 0x30,
486 0x31, 0x30, 0x31, 0x33, 0x31, 0x30, 0x30, 0x30, 0x30, 0x34, 0x39, 0x5a, 0x30,
487 0x21, 0x02, 0x10, 0x77, 0xe6, 0x5a, 0x43, 0x59, 0x93, 0x5d, 0x5f, 0x7a, 0x75,
488 0x80, 0x1a, 0xcd, 0xad, 0xc2, 0x22, 0x17, 0x0d, 0x30, 0x30, 0x30, 0x38, 0x33,
489 0x31, 0x30, 0x30, 0x30, 0x30, 0x35, 0x36, 0x5a, 0xa0, 0x1a, 0x30, 0x18, 0x30,
490 0x09, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x04, 0x02, 0x30, 0x00, 0x30, 0x0b, 0x06,
491 0x03, 0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, 0x05, 0xa0, 0x30, 0x0d, 0x06,
492 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x02, 0x05, 0x00, 0x03,
493 0x81, 0x81, 0x00, 0x18, 0x2c, 0xe8, 0xfc, 0x16, 0x6d, 0x91, 0x4a, 0x3d, 0x88,
494 0x54, 0x48, 0x5d, 0xb8, 0x11, 0xbf, 0x64, 0xbb, 0xf9, 0xda, 0x59, 0x19, 0xdd,
495 0x0e, 0x65, 0xab, 0xc0, 0x0c, 0xfa, 0x67, 0x7e, 0x21, 0x1e, 0x83, 0x0e, 0xcf,
496 0x9b, 0x89, 0x8a, 0xcf, 0x0c, 0x4b, 0xc1, 0x39, 0x9d, 0xe7, 0x6a, 0xac, 0x46,
497 0x74, 0x6a, 0x91, 0x62, 0x22, 0x0d, 0xc4, 0x08, 0xbd, 0xf5, 0x0a, 0x90, 0x7f,
498 0x06, 0x21, 0x3d, 0x7e, 0xa7, 0xaa, 0x5e, 0xcd, 0x22, 0x15, 0xe6, 0x0c, 0x75,
499 0x8e, 0x6e, 0xad, 0xf1, 0x84, 0xe4, 0x22, 0xb4, 0x30, 0x6f, 0xfb, 0x64, 0x8f,
500 0xd7, 0x80, 0x43, 0xf5, 0x19, 0x18, 0x66, 0x1d, 0x72, 0xa3, 0xe3, 0x94, 0x82,
501 0x28, 0x52, 0xa0, 0x06, 0x4e, 0xb1, 0xc8, 0x92, 0x0c, 0x97, 0xbe, 0x15, 0x07,
502 0xab, 0x7a, 0xc9, 0xea, 0x08, 0x67, 0x43, 0x4d, 0x51, 0x63, 0x3b, 0x9c, 0x9c,
503 0xcd };
504
505 static void testIsValidCRLForCert(void)
506 {
507 BOOL ret;
508 PCCERT_CONTEXT cert1, cert2;
509 PCCRL_CONTEXT crl;
510 HCERTSTORE store;
511
512 if(!pCertIsValidCRLForCertificate) return;
513
514 crl = CertCreateCRLContext(X509_ASN_ENCODING, v1CRLWithIssuerAndEntry,
515 sizeof(v1CRLWithIssuerAndEntry));
516 ok(crl != NULL, "CertCreateCRLContext failed: %08x\n", GetLastError());
517 cert1 = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
518 sizeof(bigCert));
519 ok(cert1 != NULL, "CertCreateCertificateContext failed: %08x\n",
520 GetLastError());
521
522 /* Crash
523 ret = CertIsValidCRLForCertificate(NULL, NULL, 0, NULL);
524 ret = CertIsValidCRLForCertificate(cert1, NULL, 0, NULL);
525 */
526
527 /* Curiously, any CRL is valid for the NULL certificate */
528 ret = pCertIsValidCRLForCertificate(NULL, crl, 0, NULL);
529 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
530
531 /* Same issuer for both cert and CRL, this CRL is valid for that cert */
532 ret = pCertIsValidCRLForCertificate(cert1, crl, 0, NULL);
533 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
534
535 cert2 = CertCreateCertificateContext(X509_ASN_ENCODING,
536 bigCertWithDifferentIssuer, sizeof(bigCertWithDifferentIssuer));
537 ok(cert2 != NULL, "CertCreateCertificateContext failed: %08x\n",
538 GetLastError());
539
540 /* Yet more curious: different issuers for these, yet the CRL is valid for
541 * that cert. According to MSDN, the relevant bit to check is whether the
542 * CRL has a CRL_ISSUING_DIST_POINT extension.
543 */
544 ret = pCertIsValidCRLForCertificate(cert2, crl, 0, NULL);
545 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
546
547 CertFreeCRLContext(crl);
548
549 /* Yet with a CRL_ISSUING_DIST_POINT in the CRL, I still can't get this
550 * to say the CRL is not valid for either cert.
551 */
552 crl = CertCreateCRLContext(X509_ASN_ENCODING, v2CRLWithIssuingDistPoint,
553 sizeof(v2CRLWithIssuingDistPoint));
554 ok(crl != NULL, "CertCreateCRLContext failed: %08x\n", GetLastError());
555
556 ret = pCertIsValidCRLForCertificate(cert1, crl, 0, NULL);
557 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
558 ret = pCertIsValidCRLForCertificate(cert2, crl, 0, NULL);
559 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
560
561 CertFreeCRLContext(crl);
562
563 /* And again, with a real CRL, the CRL is valid for both certs. */
564 crl = CertCreateCRLContext(X509_ASN_ENCODING, verisignCRL,
565 sizeof(verisignCRL));
566 ok(crl != NULL, "CertCreateCRLContext failed: %08x\n", GetLastError());
567
568 ret = pCertIsValidCRLForCertificate(cert1, crl, 0, NULL);
569 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
570 ret = pCertIsValidCRLForCertificate(cert2, crl, 0, NULL);
571 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
572
573 CertFreeCRLContext(crl);
574
575 /* One last test: a CRL in a different store than the cert is also valid
576 * for the cert, so CertIsValidCRLForCertificate must always return TRUE?
577 */
578 store = CertOpenStore(CERT_STORE_PROV_MEMORY, X509_ASN_ENCODING, 0,
579 CERT_STORE_CREATE_NEW_FLAG, NULL);
580 ok(store != NULL, "CertOpenStore failed: %08x\n", GetLastError());
581
582 ret = CertAddEncodedCRLToStore(store, X509_ASN_ENCODING, verisignCRL,
583 sizeof(verisignCRL), CERT_STORE_ADD_ALWAYS, &crl);
584 ok(ret, "CertAddEncodedCRLToStore failed: %08x\n", GetLastError());
585
586 ret = pCertIsValidCRLForCertificate(cert1, crl, 0, NULL);
587 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
588 ret = pCertIsValidCRLForCertificate(cert2, crl, 0, NULL);
589 ok(ret, "CertIsValidCRLForCertificate failed: %08x\n", GetLastError());
590
591 CertFreeCRLContext(crl);
592
593 CertCloseStore(store, 0);
594
595 CertFreeCertificateContext(cert2);
596 CertFreeCertificateContext(cert1);
597 }
598
599 static const BYTE crlWithDifferentIssuer[] = {
600 0x30,0x47,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,0x11,
601 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x41,0x6c,0x65,0x78,0x20,0x4c,0x61,0x6e,
602 0x67,0x00,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
603 0x30,0x30,0x30,0x5a,0x30,0x16,0x30,0x14,0x02,0x01,0x01,0x18,0x0f,0x31,0x36,
604 0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a };
605
606 static void testFindCertInCRL(void)
607 {
608 BOOL ret;
609 PCCERT_CONTEXT cert;
610 PCCRL_CONTEXT crl;
611 PCRL_ENTRY entry;
612
613 if (!pCertFindCertificateInCRL)
614 {
615 skip("CertFindCertificateInCRL() is not available\n");
616 return;
617 }
618
619 cert = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
620 sizeof(bigCert));
621 ok(cert != NULL, "CertCreateCertificateContext failed: %08x\n",
622 GetLastError());
623
624 /* Crash
625 ret = pCertFindCertificateInCRL(NULL, NULL, 0, NULL, NULL);
626 ret = pCertFindCertificateInCRL(NULL, crl, 0, NULL, NULL);
627 ret = pCertFindCertificateInCRL(cert, NULL, 0, NULL, NULL);
628 ret = pCertFindCertificateInCRL(cert, crl, 0, NULL, NULL);
629 ret = pCertFindCertificateInCRL(NULL, NULL, 0, NULL, &entry);
630 ret = pCertFindCertificateInCRL(NULL, crl, 0, NULL, &entry);
631 ret = pCertFindCertificateInCRL(cert, NULL, 0, NULL, &entry);
632 */
633
634 crl = CertCreateCRLContext(X509_ASN_ENCODING, verisignCRL,
635 sizeof(verisignCRL));
636 ret = pCertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
637 ok(ret, "CertFindCertificateInCRL failed: %08x\n", GetLastError());
638 ok(entry == NULL, "Expected not to find an entry in CRL\n");
639 CertFreeCRLContext(crl);
640
641 crl = CertCreateCRLContext(X509_ASN_ENCODING, v1CRLWithIssuerAndEntry,
642 sizeof(v1CRLWithIssuerAndEntry));
643 ret = pCertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
644 ok(ret, "CertFindCertificateInCRL failed: %08x\n", GetLastError());
645 ok(entry != NULL, "Expected to find an entry in CRL\n");
646 CertFreeCRLContext(crl);
647
648 /* Entry found even though CRL issuer doesn't match cert issuer */
649 crl = CertCreateCRLContext(X509_ASN_ENCODING, crlWithDifferentIssuer,
650 sizeof(crlWithDifferentIssuer));
651 ret = pCertFindCertificateInCRL(cert, crl, 0, NULL, &entry);
652 ok(ret, "CertFindCertificateInCRL failed: %08x\n", GetLastError());
653 ok(entry != NULL, "Expected to find an entry in CRL\n");
654 CertFreeCRLContext(crl);
655
656 CertFreeCertificateContext(cert);
657 }
658
659 static void testVerifyCRLRevocation(void)
660 {
661 BOOL ret;
662 PCCERT_CONTEXT cert;
663 PCCRL_CONTEXT crl;
664
665 ret = CertVerifyCRLRevocation(0, NULL, 0, NULL);
666 ok(ret, "CertVerifyCRLRevocation failed: %08x\n", GetLastError());
667 ret = CertVerifyCRLRevocation(X509_ASN_ENCODING, NULL, 0, NULL);
668 ok(ret, "CertVerifyCRLRevocation failed: %08x\n", GetLastError());
669
670 cert = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
671 sizeof(bigCert));
672
673 /* Check against no CRL */
674 ret = CertVerifyCRLRevocation(0, cert->pCertInfo, 0, NULL);
675 ok(ret, "CertVerifyCRLRevocation failed: %08x\n", GetLastError());
676 ret = CertVerifyCRLRevocation(X509_ASN_ENCODING, cert->pCertInfo, 0, NULL);
677 ok(ret, "CertVerifyCRLRevocation failed: %08x\n", GetLastError());
678
679 /* Check against CRL with entry for the cert */
680 crl = CertCreateCRLContext(X509_ASN_ENCODING, v1CRLWithIssuerAndEntry,
681 sizeof(v1CRLWithIssuerAndEntry));
682 ret = CertVerifyCRLRevocation(0, cert->pCertInfo, 1,
683 (PCRL_INFO *)&crl->pCrlInfo);
684 ok(!ret, "CertVerifyCRLRevocation should have been revoked\n");
685 ret = CertVerifyCRLRevocation(X509_ASN_ENCODING, cert->pCertInfo, 1,
686 (PCRL_INFO *)&crl->pCrlInfo);
687 ok(!ret, "CertVerifyCRLRevocation should have been revoked\n");
688 CertFreeCRLContext(crl);
689
690 /* Check against CRL with different issuer and entry for the cert */
691 crl = CertCreateCRLContext(X509_ASN_ENCODING, v1CRLWithIssuerAndEntry,
692 sizeof(v1CRLWithIssuerAndEntry));
693 ok(crl != NULL, "CertCreateCRLContext failed: %08x\n", GetLastError());
694 ret = CertVerifyCRLRevocation(X509_ASN_ENCODING, cert->pCertInfo, 1,
695 (PCRL_INFO *)&crl->pCrlInfo);
696 ok(!ret, "CertVerifyCRLRevocation should have been revoked\n");
697 CertFreeCRLContext(crl);
698
699 /* Check against CRL without entry for the cert */
700 crl = CertCreateCRLContext(X509_ASN_ENCODING, verisignCRL,
701 sizeof(verisignCRL));
702 ret = CertVerifyCRLRevocation(0, cert->pCertInfo, 1,
703 (PCRL_INFO *)&crl->pCrlInfo);
704 ok(ret, "CertVerifyCRLRevocation failed: %08x\n", GetLastError());
705 ret = CertVerifyCRLRevocation(X509_ASN_ENCODING, cert->pCertInfo, 1,
706 (PCRL_INFO *)&crl->pCrlInfo);
707 ok(ret, "CertVerifyCRLRevocation failed: %08x\n", GetLastError());
708 CertFreeCRLContext(crl);
709
710 CertFreeCertificateContext(cert);
711 }
712
713 START_TEST(crl)
714 {
715 init_function_pointers();
716
717 testCreateCRL();
718 testAddCRL();
719 testFindCRL();
720 testGetCRLFromStore();
721
722 testCRLProperties();
723
724 testIsValidCRLForCert();
725 testFindCertInCRL();
726 testVerifyCRLRevocation();
727 }
728
This page was automatically generated by the
LXR engine.
Visit the LXR main site for more
information.