diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c index 4f8b6f96dc..f6a5d441a9 100644 --- a/lib/vtls/schannel.c +++ b/lib/vtls/schannel.c @@ -1656,7 +1656,8 @@ valid_cert_encoding(const CERT_CONTEXT *cert_context) (cert_context->cbCertEncoded > 0); } -typedef bool(*Read_crt_func)(const CERT_CONTEXT *ccert_context, void *arg); +typedef bool(*Read_crt_func)(const CERT_CONTEXT *ccert_context, + bool reverse_order, void *arg); static void traverse_cert_store(const CERT_CONTEXT *context, Read_crt_func func, @@ -1664,19 +1665,32 @@ traverse_cert_store(const CERT_CONTEXT *context, Read_crt_func func, { const CERT_CONTEXT *current_context = NULL; bool should_continue = true; + bool first = true; + bool reverse_order = false; while(should_continue && (current_context = CertEnumCertificatesInStore( context->hCertStore, - current_context)) != NULL) - should_continue = func(current_context, arg); + current_context)) != NULL) { + /* Windows 11 22H2 OS Build 22621.674 or higher enumerates certificates in + leaf-to-root order while all previous versions of Windows enumerate + certificates in root-to-leaf order. Determine the order of enumeration + by comparing SECPKG_ATTR_REMOTE_CERT_CONTEXT's pbCertContext with the + first certificate's pbCertContext. */ + if(first && context->pbCertEncoded != current_context->pbCertEncoded) + reverse_order = true; + should_continue = func(current_context, reverse_order, arg); + first = false; + } if(current_context) CertFreeCertificateContext(current_context); } static bool -cert_counter_callback(const CERT_CONTEXT *ccert_context, void *certs_count) +cert_counter_callback(const CERT_CONTEXT *ccert_context, bool reverse_order, + void *certs_count) { + (void)reverse_order; /* unused */ if(valid_cert_encoding(ccert_context)) (*(int *)certs_count)++; return true; @@ -1687,17 +1701,23 @@ struct Adder_args struct Curl_easy *data; CURLcode result; int idx; + int certs_count; }; static bool -add_cert_to_certinfo(const CERT_CONTEXT *ccert_context, void *raw_arg) +add_cert_to_certinfo(const CERT_CONTEXT *ccert_context, bool reverse_order, + void *raw_arg) { struct Adder_args *args = (struct Adder_args*)raw_arg; args->result = CURLE_OK; if(valid_cert_encoding(ccert_context)) { const char *beg = (const char *) ccert_context->pbCertEncoded; const char *end = beg + ccert_context->cbCertEncoded; - args->result = Curl_extract_certinfo(args->data, (args->idx)++, beg, end); + int insert_index = reverse_order ? (args->certs_count - 1) - args->idx : + args->idx; + args->result = Curl_extract_certinfo(args->data, insert_index, + beg, end); + args->idx++; } return args->result == CURLE_OK; } @@ -1831,6 +1851,7 @@ schannel_connect_step3(struct Curl_cfilter *cf, struct Curl_easy *data) struct Adder_args args; args.data = data; args.idx = 0; + args.certs_count = certs_count; traverse_cert_store(ccert_context, add_cert_to_certinfo, &args); result = args.result; } diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc index 49c678f844..2ec4936ec1 100644 --- a/tests/data/Makefile.inc +++ b/tests/data/Makefile.inc @@ -256,6 +256,6 @@ test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \ test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \ test3024 test3025 test3026 test3027 test3028 test3029 test3030 \ \ -test3100 test3101 \ +test3100 test3101 test3102 \ test3200 \ test3201 test3202 diff --git a/tests/data/test3102 b/tests/data/test3102 new file mode 100644 index 0000000000..5d9bcf3854 --- /dev/null +++ b/tests/data/test3102 @@ -0,0 +1,51 @@ + + + +HTTPS +HTTP GET + + + +# +# Server-side + + + + + +# +# Client-side + +# SSL with libraries supporting CURLOPT_CERTINFO + +SSL +!bearssl +!mbedtls +!rustls +!wolfssl + + +https + + +lib%TESTNUMBER + + +verify certificate chain order with simple HTTPS GET + + +https://%HOSTIP:%HTTPSPORT/%TESTNUMBER + + + +# +# Verify data after the test has been "shot" + + +GET /%TESTNUMBER HTTP/1.1 +Host: %HOSTIP:%HTTPSPORT +Accept: */* + + + + diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc index f13e017b07..df44f1be1b 100644 --- a/tests/libtest/Makefile.inc +++ b/tests/libtest/Makefile.inc @@ -75,7 +75,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \ lib2402 lib2404 \ lib2502 \ lib3010 lib3025 lib3026 lib3027 \ - lib3100 lib3101 + lib3100 lib3101 lib3102 chkhostname_SOURCES = chkhostname.c ../../lib/curl_gethostname.c chkhostname_LDADD = @CURL_NETWORK_LIBS@ @@ -686,3 +686,6 @@ lib3100_LDADD = $(TESTUTIL_LIBS) lib3101_SOURCES = lib3101.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) lib3101_LDADD = $(TESTUTIL_LIBS) + +lib3102_SOURCES = lib3102.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) +lib3102_LDADD = $(TESTUTIL_LIBS) diff --git a/tests/libtest/lib3102.c b/tests/libtest/lib3102.c new file mode 100644 index 0000000000..abc0a27eab --- /dev/null +++ b/tests/libtest/lib3102.c @@ -0,0 +1,141 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +#include "test.h" + +#include "memdebug.h" + +/* + * Verify correct order of certificates in the chain by comparing the + * subject and issuer attributes of each certificate. + */ +static bool is_chain_in_order(struct curl_certinfo *cert_info) +{ + char *last_issuer = NULL; + int cert; + + /* Chains with only a single certificate are always in order */ + if(cert_info->num_of_certs <= 1) + return 1; + + /* Enumerate each certificate in the chain */ + for(cert = 0; cert < cert_info->num_of_certs; cert++) { + struct curl_slist *slist = cert_info->certinfo[cert]; + char *issuer = NULL; + char *subject = NULL; + + /* Find the certificate issuer and subject by enumerating each field */ + for(; slist && (!issuer || !subject); slist = slist->next) { + const char issuer_prefix[] = "Issuer:"; + const char subject_prefix[] = "Subject:"; + + if(!strncmp(slist->data, issuer_prefix, sizeof(issuer_prefix)-1)) { + issuer = slist->data + sizeof(issuer_prefix)-1; + } + if(!strncmp(slist->data, subject_prefix, sizeof(subject_prefix)-1)) { + subject = slist->data + sizeof(subject_prefix)-1; + } + } + + if(subject && issuer) { + printf("cert %d\n", cert); + printf(" subject: %s\n", subject); + printf(" issuer: %s\n", issuer); + + if(last_issuer) { + /* If the last certificate's issuer matches the current certificate's + * subject, then the chain is in order */ + if(strcmp(last_issuer, subject) != 0) { + fprintf(stderr, "cert %d issuer does not match cert %d subject\n", + cert - 1, cert); + fprintf(stderr, "certificate chain is not in order\n"); + return false; + } + } + } + + last_issuer = issuer; + } + + printf("certificate chain is in order\n"); + return true; +} + +static size_t wrfu(void *ptr, size_t size, size_t nmemb, void *stream) +{ + (void)stream; + (void)ptr; + return size * nmemb; +} + +int test(char *URL) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { + fprintf(stderr, "curl_global_init() failed\n"); + return TEST_ERR_MAJOR_BAD; + } + + curl = curl_easy_init(); + if(!curl) { + fprintf(stderr, "curl_easy_init() failed\n"); + curl_global_cleanup(); + return TEST_ERR_MAJOR_BAD; + } + + /* Set the HTTPS url to retrieve. */ + test_setopt(curl, CURLOPT_URL, URL); + + /* Capture certificate information */ + test_setopt(curl, CURLOPT_CERTINFO, 1L); + + /* Ignore output */ + test_setopt(curl, CURLOPT_WRITEFUNCTION, wrfu); + + /* No peer verify */ + test_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); + test_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); + + /* Perform the request, res will get the return code */ + res = curl_easy_perform(curl); + if(!res || res == CURLE_GOT_NOTHING) { + struct curl_certinfo *cert_info = NULL; + /* Get the certificate information */ + res = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &cert_info); + if(!res) { + /* Check to see if the certificate chain is ordered correctly */ + if(!is_chain_in_order(cert_info)) + res = TEST_ERR_FAILURE; + } + } + +test_cleanup: + + /* always cleanup */ + curl_easy_cleanup(curl); + curl_global_cleanup(); + + return res; +}