September 2020 - Wine-commits

Biswapriyo Nath : include/ddraw.h: Add missing DDSCAPS2.dwCaps2 flags.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: f4c382f980b2971929e0b5a7681ecfb0bf1356de URL: https://source.winehq.org/git/wine.git/?a=commit;h=f4c382f980b2971929e0b5a7… Author: Biswapriyo Nath <nathbappai(a)gmail.com> Date: Tue Sep 22 10:04:41 2020 +0530 include/ddraw.h: Add missing DDSCAPS2.dwCaps2 flags. Signed-off-by: Biswapriyo Nath <nathbappai(a)gmail.com> Signed-off-by: Henri Verbeet <hverbeet(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- include/ddraw.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/ddraw.h b/include/ddraw.h index 6f7cc0ec27..881b92dde1 100644 --- a/include/ddraw.h +++ b/include/ddraw.h @@ -366,6 +366,15 @@ typedef struct _DDSCAPS { /* indicates surface is part of a stereo flipping chain */ #define DDSCAPS2_STEREOSURFACELEFT 0x00080000 #define DDSCAPS2_VOLUME 0x00200000 +#define DDSCAPS2_NOTUSERLOCKABLE 0x00400000 +#define DDSCAPS2_POINTS 0x00800000 +#define DDSCAPS2_RTPATCHES 0x01000000 +#define DDSCAPS2_NPATCHES 0x02000000 +#define DDSCAPS2_RESERVED3 0x04000000 +#define DDSCAPS2_DISCARDBACKBUFFER 0x10000000 +#define DDSCAPS2_ENABLEALPHACHANNEL 0x20000000 +#define DDSCAPS2_EXTENDEDFORMATPRIMARY 0x40000000 +#define DDSCAPS2_ADDITIONALPRIMARY 0x80000000 typedef struct _DDSCAPS2 { DWORD dwCaps; /* capabilities of surface wanted */

1 0

Biswapriyo Nath : include/ddraw.h: Add DDSCAPS2.dwCaps3 flags.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 67a86980077f68ba0a54d3444a4fa595eb2c1aa3 URL: https://source.winehq.org/git/wine.git/?a=commit;h=67a86980077f68ba0a54d344… Author: Biswapriyo Nath <nathbappai(a)gmail.com> Date: Tue Sep 22 10:04:41 2020 +0530 include/ddraw.h: Add DDSCAPS2.dwCaps3 flags. Signed-off-by: Biswapriyo Nath <nathbappai(a)gmail.com> Signed-off-by: Henri Verbeet <hverbeet(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- include/ddraw.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/include/ddraw.h b/include/ddraw.h index 881b92dde1..a3fd90dd37 100644 --- a/include/ddraw.h +++ b/include/ddraw.h @@ -376,6 +376,21 @@ typedef struct _DDSCAPS { #define DDSCAPS2_EXTENDEDFORMATPRIMARY 0x40000000 #define DDSCAPS2_ADDITIONALPRIMARY 0x80000000 +/* DDSCAPS2.dwCaps3 */ +#define DDSCAPS3_MULTISAMPLE_MASK 0x0000001f +#define DDSCAPS3_MULTISAMPLE_QUALITY_MASK 0x000000e0 +#define DDSCAPS3_MULTISAMPLE_QUALITY_SHIFT 5 +#define DDSCAPS3_RESERVED1 0x00000100 +#define DDSCAPS3_RESERVED2 0x00000200 +#define DDSCAPS3_LIGHTWEIGHTMIPMAP 0x00000400 +#define DDSCAPS3_AUTOGENMIPMAP 0x00000800 +#define DDSCAPS3_DMAP 0x00001000 +#ifndef D3D_DISABLE_9EX +#define DDSCAPS3_CREATESHAREDRESOURCE 0x00002000 +#define DDSCAPS3_READONLYRESOURCE 0x00004000 +#define DDSCAPS3_OPENSHAREDRESOURCE 0x00008000 +#endif /* !D3D_DISABLE_9EX */ + typedef struct _DDSCAPS2 { DWORD dwCaps; /* capabilities of surface wanted */ DWORD dwCaps2; /* additional capabilities */

1 0

Georg Lehmann : winevulkan: Add is_alias for VkFunctionPointer.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 51b3191cd38704f8d7e8ae5662105a73df715145 URL: https://source.winehq.org/git/wine.git/?a=commit;h=51b3191cd38704f8d7e8ae56… Author: Georg Lehmann <dadschoorse(a)gmail.com> Date: Tue Sep 22 16:31:48 2020 +0200 winevulkan: Add is_alias for VkFunctionPointer. Signed-off-by: Georg Lehmann <dadschoorse(a)gmail.com> Signed-off-by: Liam Middlebrook <lmiddlebrook(a)nvidia.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/winevulkan/make_vulkan | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dlls/winevulkan/make_vulkan b/dlls/winevulkan/make_vulkan index 1f9bdc156c..070d112e6e 100755 --- a/dlls/winevulkan/make_vulkan +++ b/dlls/winevulkan/make_vulkan @@ -865,6 +865,8 @@ class VkFunctionPointer(object): text += ");\n" return text + def is_alias(self): + return False class VkHandle(object): def __init__(self, name, _type, parent, alias=None):

1 0

Georg Lehmann : winevulkan: Forward declare required structs for function pointer.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: d4b162509f7d1408f933eabde3956fc8df3f86cd URL: https://source.winehq.org/git/wine.git/?a=commit;h=d4b162509f7d1408f933eabd… Author: Georg Lehmann <dadschoorse(a)gmail.com> Date: Tue Sep 22 16:31:49 2020 +0200 winevulkan: Forward declare required structs for function pointer. Signed-off-by: Georg Lehmann <dadschoorse(a)gmail.com> Signed-off-by: Liam Middlebrook <lmiddlebrook(a)nvidia.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/winevulkan/make_vulkan | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/dlls/winevulkan/make_vulkan b/dlls/winevulkan/make_vulkan index 070d112e6e..2cddb161d6 100755 --- a/dlls/winevulkan/make_vulkan +++ b/dlls/winevulkan/make_vulkan @@ -805,11 +805,12 @@ class VkFunction(object): class VkFunctionPointer(object): - def __init__(self, _type, name, members): + def __init__(self, _type, name, members, forward_decls): self.name = name self.members = members self.type = _type self.required = False + self.forward_decls = forward_decls @staticmethod def from_xml(funcpointer): @@ -846,10 +847,19 @@ class VkFunctionPointer(object): _type = funcpointer.text name = funcpointer.find("name").text - return VkFunctionPointer(_type, name, members) + if "requires" in funcpointer.attrib: + forward_decls = funcpointer.attrib.get("requires").split(",") + else: + forward_decls = [] + return VkFunctionPointer(_type, name, members, forward_decls) def definition(self): - text = "{0} {1})(\n".format(self.type, self.name) + text = "" + # forward declare required structs + for decl in self.forward_decls: + text += "typedef struct {0} {0};\n".format(decl) + + text += "{0} {1})(\n".format(self.type, self.name) first = True if len(self.members) > 0:

1 0

Haidong Yu : conhost: Input should be restored and input_thread handle should be closed before return.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: d22e82196496cb6d7f26b984b95409678a76c602 URL: https://source.winehq.org/git/wine.git/?a=commit;h=d22e82196496cb6d7f26b984… Author: Haidong Yu <yuhaidong(a)uniontech.com> Date: Wed Sep 23 09:31:43 2020 +0800 conhost: Input should be restored and input_thread handle should be closed before return. Signed-off-by: Haidong Yu <yuhaidong(a)uniontech.com> Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- programs/conhost/conhost.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/programs/conhost/conhost.c b/programs/conhost/conhost.c index a775e74961..79cbb8e83a 100644 --- a/programs/conhost/conhost.c +++ b/programs/conhost/conhost.c @@ -1652,7 +1652,7 @@ static DWORD WINAPI tty_input( void *param ) { case 3: /* end of text */ LeaveCriticalSection( &console_section ); - return 0; + goto done; case '\n': key_press( console, '\n', VK_RETURN, LEFT_CTRL_PRESSED ); break; @@ -1681,6 +1681,7 @@ static DWORD WINAPI tty_input( void *param ) TRACE( "NtReadFile failed: %#x\n", status ); +done: EnterCriticalSection( &console_section ); if (console->read_ioctl) read_complete( console, status, NULL, 0, FALSE ); if (console->is_unix)

1 0

Pengpeng Dong : conhost: Validate width param in write_output.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: b9f1ec8c44ebe62b4005d4ea2cfd63f700ea8a17 URL: https://source.winehq.org/git/wine.git/?a=commit;h=b9f1ec8c44ebe62b4005d4ea… Author: Pengpeng Dong <dongpengpeng(a)uniontech.com> Date: Wed Sep 23 15:04:39 2020 +0200 conhost: Validate width param in write_output. Signed-off-by: Pengpeng Dong <dongpengpeng(a)uniontech.com> Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- programs/conhost/conhost.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/programs/conhost/conhost.c b/programs/conhost/conhost.c index 79cbb8e83a..ed52838528 100644 --- a/programs/conhost/conhost.c +++ b/programs/conhost/conhost.c @@ -1984,6 +1984,8 @@ static NTSTATUS write_output( struct screen_buffer *screen_buffer, const struct char_info_t *dest; char *src; + if (*out_size == sizeof(SMALL_RECT) && !params->width) return STATUS_INVALID_PARAMETER; + entry_size = params->mode == CHAR_INFO_MODE_TEXTATTR ? sizeof(char_info_t) : sizeof(WCHAR); entry_cnt = (in_size - sizeof(*params)) / entry_size;

1 0

Hans Leidekker : crypt32: Add support for CRYPT_MACHINE_KEYSET in PFXImportCertStore.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 547508e374b7e347488f8ce7a8fa40b333a79684 URL: https://source.winehq.org/git/wine.git/?a=commit;h=547508e374b7e347488f8ce7… Author: Hans Leidekker <hans(a)codeweavers.com> Date: Wed Sep 23 12:07:57 2020 +0200 crypt32: Add support for CRYPT_MACHINE_KEYSET in PFXImportCertStore. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=49857 Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/crypt32/pfx.c | 15 +++++++++------ dlls/crypt32/tests/store.c | 10 ++++++++++ 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/dlls/crypt32/pfx.c b/dlls/crypt32/pfx.c index 3f38ae5056..80e6a3d017 100644 --- a/dlls/crypt32/pfx.c +++ b/dlls/crypt32/pfx.c @@ -138,7 +138,7 @@ static HCRYPTPROV import_key( gnutls_x509_privkey_t key, DWORD flags ) HCRYPTPROV prov = 0; HCRYPTKEY cryptkey; BYTE *buf, *src, *dst; - DWORD size; + DWORD size, acquire_flags; if ((ret = pgnutls_x509_privkey_get_pk_algorithm2( key, &bitlen )) < 0) { @@ -208,17 +208,20 @@ static HCRYPTPROV import_key( gnutls_x509_privkey_t key, DWORD flags ) else src = d.data; for (i = bitlen / 8 - 1; i >= 0; i--) *dst++ = src[i]; - if (!CryptAcquireContextW( &prov, NULL, MS_ENHANCED_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET )) + acquire_flags = (flags & CRYPT_MACHINE_KEYSET) | CRYPT_NEWKEYSET; + if (!CryptAcquireContextW( &prov, NULL, MS_ENHANCED_PROV_W, PROV_RSA_FULL, acquire_flags )) { if (GetLastError() != NTE_EXISTS) goto done; - if (!CryptAcquireContextW( &prov, NULL, MS_ENHANCED_PROV_W, PROV_RSA_FULL, 0 )) + + acquire_flags &= ~CRYPT_NEWKEYSET; + if (!CryptAcquireContextW( &prov, NULL, MS_ENHANCED_PROV_W, PROV_RSA_FULL, acquire_flags )) { WARN( "CryptAcquireContextW failed %08x\n", GetLastError() ); goto done; } } - if (!CryptImportKey( prov, buf, size, 0, flags, &cryptkey )) + if (!CryptImportKey( prov, buf, size, 0, flags & CRYPT_EXPORTABLE, &cryptkey )) { WARN( "CryptImportKey failed %08x\n", GetLastError() ); CryptReleaseContext( prov, 0 ); @@ -346,7 +349,7 @@ HCERTSTORE WINAPI PFXImportCertStore( CRYPT_DATA_BLOB *pfx, const WCHAR *passwor SetLastError( ERROR_INVALID_PARAMETER ); return NULL; } - if (flags & ~(CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|PKCS12_NO_PERSIST_KEY)) + if (flags & ~(CRYPT_EXPORTABLE|CRYPT_USER_KEYSET|CRYPT_MACHINE_KEYSET|PKCS12_NO_PERSIST_KEY)) { FIXME( "flags %08x not supported\n", flags ); return NULL; @@ -373,7 +376,7 @@ HCERTSTORE WINAPI PFXImportCertStore( CRYPT_DATA_BLOB *pfx, const WCHAR *passwor goto error; } - if (!(prov = import_key( key, flags & CRYPT_EXPORTABLE ))) goto error; + if (!(prov = import_key( key, flags ))) goto error; if (!(store = CertOpenStore( CERT_STORE_PROV_MEMORY, 0, 0, 0, NULL ))) { WARN( "CertOpenStore failed %08x\n", GetLastError() ); diff --git a/dlls/crypt32/tests/store.c b/dlls/crypt32/tests/store.c index b2d5c7cb7e..46c9102686 100644 --- a/dlls/crypt32/tests/store.c +++ b/dlls/crypt32/tests/store.c @@ -3348,6 +3348,16 @@ static void test_PFXImportCertStore(void) ok(ret, "got %u\n", GetLastError()); CertFreeCertificateContext( cert ); CertCloseStore( store, 0 ); + + /* CRYPT_MACHINE_KEYSET */ + store = PFXImportCertStore( &pfx, NULL, CRYPT_MACHINE_KEYSET ); + ok( store != NULL, "got %u\n", GetLastError() ); + + cert = CertFindCertificateInStore( store, X509_ASN_ENCODING, 0, CERT_FIND_ANY, NULL, NULL ); + ok( cert != NULL, "got %08x\n", GetLastError() ); + + CertFreeCertificateContext( cert ); + CertCloseStore( store, 0 ); } static void test_CryptQueryObject(void)

1 0

Zebediah Figura : advapi32/tests: Test which tokens DuplicateHandle() validates access against.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 965ebac6c19c72c511d61cc44958a3b944d5ddbf URL: https://source.winehq.org/git/wine.git/?a=commit;h=965ebac6c19c72c511d61cc4… Author: Zebediah Figura <z.figura12(a)gmail.com> Date: Tue Sep 22 17:31:13 2020 -0500 advapi32/tests: Test which tokens DuplicateHandle() validates access against. Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/advapi32/tests/security.c | 195 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 194 insertions(+), 1 deletion(-) diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index 825f845190..ae5531db80 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -7529,6 +7529,196 @@ static void test_EqualDomainSid(void) FreeSid(domainsid); } +static DWORD WINAPI duplicate_handle_access_thread(void *arg) +{ + HANDLE event = arg, event2; + BOOL ret; + + event2 = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + ret = DuplicateHandle(GetCurrentProcess(), event, GetCurrentProcess(), + &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(event2); + + return 0; +} + +static void test_duplicate_handle_access(void) +{ + char acl_buffer[200], everyone_sid_buffer[100], local_sid_buffer[100], cmdline[300]; + HANDLE token, restricted, impersonation, all_event, sync_event, event2, thread; + SECURITY_ATTRIBUTES sa = {.nLength = sizeof(sa)}; + SID *everyone_sid = (SID *)everyone_sid_buffer; + SID *local_sid = (SID *)local_sid_buffer; + ACL *acl = (ACL *)acl_buffer; + SID_AND_ATTRIBUTES sid_attr; + SECURITY_DESCRIPTOR sd; + PROCESS_INFORMATION pi; + STARTUPINFOA si = {0}; + DWORD size; + BOOL ret; + + /* DuplicateHandle() validates access against the calling thread's token and + * the target process's token. It does *not* validate access against the + * calling process's token, even if the calling thread is not impersonating. + */ + + ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY, &token); + ok(ret, "got error %u\n", GetLastError()); + + size = sizeof(everyone_sid_buffer); + ret = CreateWellKnownSid(WinWorldSid, NULL, everyone_sid, &size); + ok(ret, "got error %u\n", GetLastError()); + size = sizeof(local_sid_buffer); + ret = CreateWellKnownSid(WinLocalSid, NULL, local_sid, &size); + ok(ret, "got error %u\n", GetLastError()); + + InitializeAcl(acl, sizeof(acl_buffer), ACL_REVISION); + ret = AddAccessAllowedAce(acl, ACL_REVISION, SYNCHRONIZE, everyone_sid); + ok(ret, "got error %u\n", GetLastError()); + InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION); + ret = AddAccessAllowedAce(acl, ACL_REVISION, EVENT_MODIFY_STATE, local_sid); + ok(ret, "got error %u\n", GetLastError()); + InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION); + ret = SetSecurityDescriptorDacl(&sd, TRUE, acl, FALSE); + ok(ret, "got error %u\n", GetLastError()); + sa.lpSecurityDescriptor = &sd; + + sid_attr.Sid = local_sid; + sid_attr.Attributes = 0; + ret = CreateRestrictedToken(token, 0, 1, &sid_attr, 0, NULL, 0, NULL, &restricted); + ok(ret, "got error %u\n", GetLastError()); + ret = DuplicateTokenEx(restricted, TOKEN_IMPERSONATE, NULL, + SecurityImpersonation, TokenImpersonation, &impersonation); + ok(ret, "got error %u\n", GetLastError()); + + all_event = CreateEventA(&sa, TRUE, TRUE, "test_dup"); + ok(!!all_event, "got error %u\n", GetLastError()); + sync_event = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!sync_event, "got error %u\n", GetLastError()); + + event2 = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + ret = DuplicateHandle(GetCurrentProcess(), all_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(event2); + + ret = DuplicateHandle(GetCurrentProcess(), sync_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(event2); + + ret = SetThreadToken(NULL, impersonation); + ok(ret, "got error %u\n", GetLastError()); + + thread = CreateThread(NULL, 0, duplicate_handle_access_thread, sync_event, 0, NULL); + ret = WaitForSingleObject(thread, 1000); + ok(!ret, "wait failed\n"); + + event2 = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + SetLastError(0xdeadbeef); + event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); + todo_wine ok(!event2, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = DuplicateHandle(GetCurrentProcess(), all_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(event2); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(GetCurrentProcess(), sync_event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = RevertToSelf(); + ok(ret, "got error %u\n", GetLastError()); + + sprintf(cmdline, "%s security duplicate %Iu %u %Iu", myARGV[0], + (ULONG_PTR)sync_event, GetCurrentProcessId(), (ULONG_PTR)impersonation ); + ret = CreateProcessAsUserA(restricted, NULL, cmdline, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi); + ok(ret, "got error %u\n", GetLastError()); + + ret = DuplicateHandle(GetCurrentProcess(), all_event, pi.hProcess, &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(GetCurrentProcess(), sync_event, pi.hProcess, &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = WaitForSingleObject(pi.hProcess, 1000); + ok(!ret, "wait failed\n"); + + CloseHandle(impersonation); + CloseHandle(restricted); + CloseHandle(token); + CloseHandle(sync_event); + CloseHandle(all_event); +} + +static void test_duplicate_handle_access_child(void) +{ + HANDLE event, event2, process, token; + BOOL ret; + + event = (HANDLE)(ULONG_PTR)_atoi64(myARGV[3]); + process = OpenProcess(PROCESS_DUP_HANDLE, FALSE, atoi(myARGV[4])); + ok(!!process, "failed to open process, error %u\n", GetLastError()); + + event2 = OpenEventA(SYNCHRONIZE, FALSE, "test_dup"); + ok(!!event2, "got error %u\n", GetLastError()); + CloseHandle(event2); + + SetLastError(0xdeadbeef); + event2 = OpenEventA(EVENT_MODIFY_STATE, FALSE, "test_dup"); + todo_wine ok(!event2, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = DuplicateHandle(process, event, process, &event2, EVENT_MODIFY_STATE, FALSE, 0); + ok(ret, "got error %u\n", GetLastError()); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(process, event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = DuplicateHandle(process, (HANDLE)(ULONG_PTR)_atoi64(myARGV[5]), + GetCurrentProcess(), &token, 0, FALSE, DUPLICATE_SAME_ACCESS); + ok(ret, "failed to retrieve token, error %u\n", GetLastError()); + ret = SetThreadToken(NULL, token); + ok(ret, "failed to set thread token, error %u\n", GetLastError()); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(process, event, process, &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + SetLastError(0xdeadbeef); + ret = DuplicateHandle(process, event, GetCurrentProcess(), &event2, EVENT_MODIFY_STATE, FALSE, 0); + todo_wine ok(!ret, "expected failure\n"); + todo_wine ok(GetLastError() == ERROR_ACCESS_DENIED, "got error %u\n", GetLastError()); + + ret = RevertToSelf(); + ok(ret, "failed to revert, error %u\n", GetLastError()); + CloseHandle(token); + CloseHandle(process); +} + START_TEST(security) { init(); @@ -7538,8 +7728,10 @@ START_TEST(security) { if (!strcmp(myARGV[2], "test_token_sd")) test_child_token_sd(); - else + else if (!strcmp(myARGV[2], "test")) test_process_security_child(); + else if (!strcmp(myARGV[2], "duplicate")) + test_duplicate_handle_access_child(); return; } test_kernel_objects_security(); @@ -7585,6 +7777,7 @@ START_TEST(security) test_token_label(); test_GetExplicitEntriesFromAclW(); test_BuildSecurityDescriptorW(); + test_duplicate_handle_access(); /* Must be the last test, modifies process token */ test_token_security_descriptor();

1 0

Zebediah Figura : advapi32/tests: Add more tests for CreateRestrictedToken().
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 67f7d6872b4e970e212f1ac4a51f21a3b8d00548 URL: https://source.winehq.org/git/wine.git/?a=commit;h=67f7d6872b4e970e212f1ac4… Author: Zebediah Figura <z.figura12(a)gmail.com> Date: Tue Sep 22 17:31:14 2020 -0500 advapi32/tests: Add more tests for CreateRestrictedToken(). Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/advapi32/tests/security.c | 150 +++++++++++++++++++++++++++-------------- 1 file changed, 98 insertions(+), 52 deletions(-) diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index ae5531db80..957ebc3036 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -104,8 +104,6 @@ static DWORD (WINAPI *pSetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMA PSID, PSID, PACL, PACL); static NTSTATUS (WINAPI *pNtAccessCheck)(PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK, PGENERIC_MAPPING, PPRIVILEGE_SET, PULONG, PULONG, NTSTATUS*); -static BOOL (WINAPI *pCreateRestrictedToken)(HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD, - PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE); static NTSTATUS (WINAPI *pNtSetSecurityObject)(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR); static NTSTATUS (WINAPI *pNtCreateFile)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG); static BOOL (WINAPI *pRtlDosPathNameToNtPathName_U)(LPCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*); @@ -175,7 +173,6 @@ static void init(void) pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW"); pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl"); pSetSecurityInfo = (void *)GetProcAddress(hmod, "SetSecurityInfo"); - pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken"); pGetWindowsAccountDomainSid = (void *)GetProcAddress(hmod, "GetWindowsAccountDomainSid"); pEqualDomainSid = (void *)GetProcAddress(hmod, "EqualDomainSid"); pGetSidIdentifierAuthority = (void *)GetProcAddress(hmod, "GetSidIdentifierAuthority"); @@ -5188,19 +5185,19 @@ static void test_CreateRestrictedToken(void) { HANDLE process_token, token, r_token; PTOKEN_GROUPS token_groups, groups2; + LUID_AND_ATTRIBUTES lattr; SID_AND_ATTRIBUTES sattr; SECURITY_IMPERSONATION_LEVEL level; + SID *removed_sid = NULL; + char privs_buffer[1000]; + TOKEN_PRIVILEGES *privs = (TOKEN_PRIVILEGES *)privs_buffer; + PRIVILEGE_SET priv_set; TOKEN_TYPE type; BOOL is_member; DWORD size; + LUID luid; BOOL ret; - DWORD i, j; - - if (!pCreateRestrictedToken) - { - win_skip("CreateRestrictedToken is not available\n"); - return; - } + DWORD i; ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token); ok(ret, "got error %d\n", GetLastError()); @@ -5209,7 +5206,6 @@ static void test_CreateRestrictedToken(void) NULL, SecurityImpersonation, TokenImpersonation, &token); ok(ret, "got error %d\n", GetLastError()); - /* groups */ ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", ret, GetLastError()); @@ -5220,70 +5216,120 @@ static void test_CreateRestrictedToken(void) for (i = 0; i < token_groups->GroupCount; i++) { if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED) + { + removed_sid = token_groups->Groups[i].Sid; break; + } } - - if (i == token_groups->GroupCount) - { - HeapFree(GetProcessHeap(), 0, token_groups); - CloseHandle(token); - skip("User not a member of any group\n"); - return; - } + ok(!!removed_sid, "user is not a member of any group\n"); is_member = FALSE; - ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member); + ret = pCheckTokenMembership(token, removed_sid, &is_member); ok(ret, "got error %d\n", GetLastError()); ok(is_member, "not a member\n"); - /* disable a SID in new token */ - sattr.Sid = token_groups->Groups[i].Sid; + sattr.Sid = removed_sid; sattr.Attributes = 0; r_token = NULL; - ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token); + ret = CreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token); ok(ret, "got error %d\n", GetLastError()); - if (ret) + is_member = TRUE; + ret = pCheckTokenMembership(r_token, removed_sid, &is_member); + ok(ret, "got error %d\n", GetLastError()); + todo_wine ok(!is_member, "not a member\n"); + + ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", + ret, GetLastError()); + groups2 = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetTokenInformation(r_token, TokenGroups, groups2, size, &size); + ok(ret, "got error %d\n", GetLastError()); + + for (i = 0; i < groups2->GroupCount; i++) { - /* check if a SID is enabled */ - is_member = TRUE; - ret = pCheckTokenMembership(r_token, token_groups->Groups[i].Sid, &is_member); - ok(ret, "got error %d\n", GetLastError()); - todo_wine ok(!is_member, "not a member\n"); + if (EqualSid(groups2->Groups[i].Sid, removed_sid)) + { + DWORD attr = groups2->Groups[i].Attributes; + todo_wine ok(attr & SE_GROUP_USE_FOR_DENY_ONLY, "got wrong attributes %#x\n", attr); + todo_wine ok(!(attr & SE_GROUP_ENABLED), "got wrong attributes %#x\n", attr); + break; + } + } + + HeapFree(GetProcessHeap(), 0, groups2); - ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size); - ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", - ret, GetLastError()); - groups2 = HeapAlloc(GetProcessHeap(), 0, size); - ret = GetTokenInformation(r_token, TokenGroups, groups2, size, &size); - ok(ret, "got error %d\n", GetLastError()); + size = sizeof(type); + ret = GetTokenInformation(r_token, TokenType, &type, size, &size); + ok(ret, "got error %d\n", GetLastError()); + ok(type == TokenImpersonation, "got type %u\n", type); - for (j = 0; j < groups2->GroupCount; j++) + size = sizeof(level); + ret = GetTokenInformation(r_token, TokenImpersonationLevel, &level, size, &size); + ok(ret, "got error %d\n", GetLastError()); + ok(level == SecurityImpersonation, "got level %u\n", type); + + CloseHandle(r_token); + + r_token = NULL; + ret = CreateRestrictedToken(process_token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token); + ok(ret, "got error %u\n", GetLastError()); + + size = sizeof(type); + ret = GetTokenInformation(r_token, TokenType, &type, size, &size); + ok(ret, "got error %u\n", GetLastError()); + ok(type == TokenPrimary, "got type %u\n", type); + + CloseHandle(r_token); + + ret = GetTokenInformation(token, TokenPrivileges, privs, sizeof(privs_buffer), &size); + ok(ret, "got error %u\n", GetLastError()); + + for (i = 0; i < privs->PrivilegeCount; i++) + { + if (privs->Privileges[i].Attributes & SE_PRIVILEGE_ENABLED) { - if (EqualSid(groups2->Groups[j].Sid, token_groups->Groups[i].Sid)) - break; + luid = privs->Privileges[i].Luid; + break; } + } + ok(i < privs->PrivilegeCount, "user has no privileges\n"); - todo_wine ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY, - "got wrong attributes\n"); - todo_wine ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0, - "got wrong attributes\n"); + lattr.Luid = luid; + lattr.Attributes = 0; + r_token = NULL; + ret = CreateRestrictedToken(token, 0, 0, NULL, 1, &lattr, 0, NULL, &r_token); + ok(ret, "got error %u\n", GetLastError()); - HeapFree(GetProcessHeap(), 0, groups2); + priv_set.PrivilegeCount = 1; + priv_set.Control = 0; + priv_set.Privilege[0].Luid = luid; + priv_set.Privilege[0].Attributes = 0; + ret = PrivilegeCheck(r_token, &priv_set, &is_member); + ok(ret, "got error %u\n", GetLastError()); + todo_wine ok(!is_member, "privilege should not be enabled\n"); - size = sizeof(type); - ret = GetTokenInformation(r_token, TokenType, &type, size, &size); - ok(ret, "got error %d\n", GetLastError()); - ok(type == TokenImpersonation, "got type %u\n", type); + ret = GetTokenInformation(r_token, TokenPrivileges, privs, sizeof(privs_buffer), &size); + ok(ret, "got error %u\n", GetLastError()); - size = sizeof(level); - ret = GetTokenInformation(r_token, TokenImpersonationLevel, &level, size, &size); - ok(ret, "got error %d\n", GetLastError()); - ok(level == SecurityImpersonation, "got level %u\n", type); + is_member = FALSE; + for (i = 0; i < privs->PrivilegeCount; i++) + { + if (!memcmp(&privs->Privileges[i].Luid, &luid, sizeof(luid))) + is_member = TRUE; } + todo_wine ok(!is_member, "disabled privilege should not be present\n"); - HeapFree(GetProcessHeap(), 0, token_groups); CloseHandle(r_token); + + removed_sid->SubAuthority[0] = 0xdeadbeef; + lattr.Luid.LowPart = 0xdeadbeef; + r_token = NULL; + ret = CreateRestrictedToken(token, 0, 1, &sattr, 1, &lattr, 0, NULL, &r_token); + ok(ret, "got error %u\n", GetLastError()); + CloseHandle(r_token); + + HeapFree(GetProcessHeap(), 0, token_groups); CloseHandle(token); CloseHandle(process_token); }

1 0

Michael Müller : ntdll: Implement NtFilterToken.
by Alexandre Julliard 23 Sep '20

23 Sep '20

Module: wine Branch: master Commit: 8c5638aa5e7cfcd5b2844853e744702331a85a17 URL: https://source.winehq.org/git/wine.git/?a=commit;h=8c5638aa5e7cfcd5b2844853… Author: Michael Müller <michael(a)fds-team.de> Date: Tue Sep 22 17:31:15 2020 -0500 ntdll: Implement NtFilterToken. Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> --- dlls/ntdll/ntdll.spec | 2 +- dlls/ntdll/unix/security.c | 63 ++++++++++++++++++++++++++++++++ include/wine/server_protocol.h | 21 ++++++++++- include/winnt.h | 5 +++ include/winternl.h | 1 + server/named_pipe.c | 2 +- server/process.c | 2 +- server/protocol.def | 10 ++++++ server/request.h | 8 +++++ server/security.h | 4 ++- server/token.c | 82 ++++++++++++++++++++++++++++++++++++++++-- server/trace.c | 17 +++++++++ 12 files changed, 210 insertions(+), 7 deletions(-) Diff: https://source.winehq.org/git/wine.git/?a=commitdiff;h=8c5638aa5e7cfcd5b284…

1 0