From 5f8a9df1eea33c2d6fc267e5e3683449954c986b Mon Sep 17 00:00:00 2001 From: Selva Nair Date: Wed, 12 Feb 2020 10:06:07 -0500 Subject: [PATCH] Allow unicode search string in --cryptoapicert option Currently when the certificate is specified as "SUBJ:foo", the string foo is assumed to be ascii. Change that and interpret it as utf-8, convert to a wide string, and flag it as unicode in CertFindCertifcateInStore(). Signed-off-by: Selva Nair Acked-by: Lev Stipakov Message-Id: <1581519967-16950-2-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19405.html Signed-off-by: Gert Doering (cherry picked from commit aa6affe6df811db11577847366a569def0a3e314) --- src/openvpn/cryptoapi.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/openvpn/cryptoapi.c b/src/openvpn/cryptoapi.c index 011660aab..0f95d0046 100644 --- a/src/openvpn/cryptoapi.c +++ b/src/openvpn/cryptoapi.c @@ -50,6 +50,7 @@ #include "buffer.h" #include "openssl_compat.h" +#include "win32.h" /* MinGW w32api 3.17 is still incomplete when it comes to CryptoAPI while * MinGW32-w64 defines all macros used. This is a hack around that problem. @@ -536,12 +537,13 @@ find_certificate_in_store(const char *cert_prop, HCERTSTORE cert_store) const void *find_param; unsigned char hash[255]; CRYPT_HASH_BLOB blob = {.cbData = 0, .pbData = hash}; + struct gc_arena gc = gc_new(); if (!strncmp(cert_prop, "SUBJ:", 5)) { /* skip the tag */ - find_param = cert_prop + 5; - find_type = CERT_FIND_SUBJECT_STR_A; + find_param = wide_string(cert_prop + 5, &gc); + find_type = CERT_FIND_SUBJECT_STR_W; } else if (!strncmp(cert_prop, "THUMB:", 6)) { @@ -569,7 +571,7 @@ find_certificate_in_store(const char *cert_prop, HCERTSTORE cert_store) if (!*++p) /* unexpected end of string */ { msg(M_WARN, "WARNING: cryptoapicert: error parsing .", cert_prop); - return NULL; + goto out; } if (*p >= '0' && *p <= '9') { @@ -594,7 +596,7 @@ find_certificate_in_store(const char *cert_prop, HCERTSTORE cert_store) else { msg(M_WARN, "WARNING: cryptoapicert: unsupported certificate specification <%s>", cert_prop); - return NULL; + goto out; } while(true) @@ -615,6 +617,8 @@ find_certificate_in_store(const char *cert_prop, HCERTSTORE cert_store) validity < 0 ? "not yet valid" : "that has expired"); } +out: + gc_free(&gc); return rv; } -- 2.47.2