On Thu, 2018-01-18 at 23:54 +0800, Dmitry Timoshkov wrote:
+static SECURITY_STATUS WINAPI lsa_InitializeSecurityContextW( + CredHandle *credential, CtxtHandle *context, SEC_WCHAR *target_name, ULONG context_req, + ULONG reserved1, ULONG target_data_rep, SecBufferDesc *input, ULONG reserved2, + CtxtHandle *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry) +{ + SECURITY_STATUS status; + struct lsa_package *lsa_package = NULL; + LSA_SEC_HANDLE lsa_credential = 0, lsa_context = 0, new_lsa_context; + UNICODE_STRING target_name_us; + BOOLEAN mapped_context; + + TRACE("%p %p %s %#x %d %d %p %d %p %p %p %p\n", credential, context, + debugstr_w(target_name), context_req, reserved1, target_data_rep, input, + reserved2, new_context, output, context_attr, ts_expiry); + + if (credential) + { + lsa_package = (struct lsa_package *)credential->dwUpper; + lsa_credential = (LSA_SEC_HANDLE)credential->dwLower; + } + else if (context) + { + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + }
It's not an error to pass a credential parameter in the second call, so you should switch the order here.
+ if (!lsa_package || !new_context) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->lsa_api || !lsa_package->lsa_api->InitLsaModeContext) + return SEC_E_UNSUPPORTED_FUNCTION; + + if (target_name) + RtlInitUnicodeString(&target_name_us, target_name); + + status = lsa_package->lsa_api->InitLsaModeContext(lsa_credential, lsa_context, + target_name ? &target_name_us : NULL, context_req, target_data_rep, input, + &new_lsa_context, output, context_attr, ts_expiry, &mapped_context, NULL /* FIXME */); + if (status == SEC_E_OK) + { + new_context->dwLower = (ULONG_PTR)new_lsa_context; + new_context->dwUpper = (ULONG_PTR)lsa_package; + }
You should also accept SEC_I_CONTINUE_NEEDED here, otherwise the caller won't see the new context in a three-leg authentication.