ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

crypt32: Trace reasons for name constraint failure.

This commit is contained in:
Juan Lang 2009-11-17 14:06:44 -08:00 committed by Alexandre Julliard
parent 1db8a6abda
commit d6958d7660
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
dlls/crypt32/chain.c
View File

@ -849,14 +849,22 @@ static void compare_alt_name_with_constraints(const CERT_EXTENSION *altNameExt,
if (alt_name_matches_excluded_name( if (alt_name_matches_excluded_name(
&subjectAltName->rgAltEntry[i], nameConstraints, &subjectAltName->rgAltEntry[i], nameConstraints,
trustErrorStatus)) trustErrorStatus))
{
TRACE_(chain)("subject alternate name form %d excluded\n",
subjectAltName->rgAltEntry[i].dwAltNameChoice);
*trustErrorStatus |= *trustErrorStatus |=
CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT;
}
nameFormPresent = FALSE; nameFormPresent = FALSE;
if (!alt_name_matches_permitted_name( if (!alt_name_matches_permitted_name(
&subjectAltName->rgAltEntry[i], nameConstraints, &subjectAltName->rgAltEntry[i], nameConstraints,
trustErrorStatus, &nameFormPresent) && nameFormPresent) trustErrorStatus, &nameFormPresent) && nameFormPresent)
{
TRACE_(chain)("subject alternate name form %d not permitted\n",
subjectAltName->rgAltEntry[i].dwAltNameChoice);
*trustErrorStatus |= *trustErrorStatus |=
CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT;
}
} }
LocalFree(subjectAltName); LocalFree(subjectAltName);
} }
@ -934,14 +942,22 @@ static void compare_subject_with_email_constraints(
if (rfc822_attr_matches_excluded_name( if (rfc822_attr_matches_excluded_name(
&name->rgRDN[i].rgRDNAttr[j], nameConstraints, &name->rgRDN[i].rgRDNAttr[j], nameConstraints,
trustErrorStatus)) trustErrorStatus))
{
TRACE_(chain)(
"email address in subject name is excluded\n");
*trustErrorStatus |= *trustErrorStatus |=
CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT;
}
nameFormPresent = FALSE; nameFormPresent = FALSE;
if (!rfc822_attr_matches_permitted_name( if (!rfc822_attr_matches_permitted_name(
&name->rgRDN[i].rgRDNAttr[j], nameConstraints, &name->rgRDN[i].rgRDNAttr[j], nameConstraints,
trustErrorStatus, &nameFormPresent) && nameFormPresent) trustErrorStatus, &nameFormPresent) && nameFormPresent)
{
TRACE_(chain)(
"email address in subject name is not permitted\n");
*trustErrorStatus |= *trustErrorStatus |=
CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT;
}
} }
LocalFree(name); LocalFree(name);
} }
@ -1000,8 +1016,11 @@ static void compare_subject_with_constraints(const CERT_NAME_BLOB *subjectName,
if (constraint->dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME && if (constraint->dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME &&
directory_name_matches(&constraint->u.DirectoryName, subjectName)) directory_name_matches(&constraint->u.DirectoryName, subjectName))
{
TRACE_(chain)("subject name is excluded\n");
*trustErrorStatus |= *trustErrorStatus |=
CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT; CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT;
}
} }
/* RFC 5280, section 4.2.1.10: /* RFC 5280, section 4.2.1.10:
* "Restrictions apply only when the specified name form is present. * "Restrictions apply only when the specified name form is present.
@ -1026,7 +1045,10 @@ static void compare_subject_with_constraints(const CERT_NAME_BLOB *subjectName,
} }
} }
if (hasDirectoryConstraint && !match) if (hasDirectoryConstraint && !match)
{
TRACE_(chain)("subject name is not permitted\n");
*trustErrorStatus |= CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT; *trustErrorStatus |= CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT;
}
} }
} }