February 2018 - Wine-Devel - list.winehq.org

[PATCH 9/9] secur32: Remove Kerberos SSPI stubs.
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/Makefile.in | 1 - dlls/secur32/kerberos.c | 323 -------------------------------------------- dlls/secur32/secur32.c | 3 +- dlls/secur32/secur32_priv.h | 2 +- 4 files changed, 3 insertions(+), 326 deletions(-) delete mode 100644 dlls/secur32/kerberos.c diff --git a/dlls/secur32/Makefile.in b/dlls/secur32/Makefile.in index 6548521f53..c9acdee457 100644 --- a/dlls/secur32/Makefile.in +++ b/dlls/secur32/Makefile.in @@ -9,7 +9,6 @@ C_SRCS = \ base64_codec.c \ dispatcher.c \ hmac_md5.c \ - kerberos.c \ lsa.c \ negotiate.c \ ntlm.c \ diff --git a/dlls/secur32/kerberos.c b/dlls/secur32/kerberos.c deleted file mode 100644 index 753e9748d2..0000000000 --- a/dlls/secur32/kerberos.c +++ /dev/null @@ -1,323 +0,0 @@ -/* - * Copyright 2005, 2006 Kai Blin - * Copyright 2016 Jacek Caban for CodeWeavers - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA - */ - -#include <assert.h> -#include <stdarg.h> -#include <stdio.h> - -#include "windef.h" -#include "winbase.h" -#include "rpc.h" -#include "sspi.h" - -#include "secur32_priv.h" - -#include "wine/debug.h" - -WINE_DEFAULT_DEBUG_CHANNEL(secur32); - -#define KERBEROS_MAX_BUF 12000 - -/*********************************************************************** - * QueryCredentialsAttributesA - */ -static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(CredHandle *phCredential, ULONG ulAttribute, void *pBuffer) -{ - FIXME("(%p %d %p)\n", phCredential, ulAttribute, pBuffer); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * QueryCredentialsAttributesW - */ -static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(CredHandle *phCredential, ULONG ulAttribute, void *pBuffer) -{ - FIXME("(%p, %d, %p)\n", phCredential, ulAttribute, pBuffer); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * AcquireCredentialsHandleW - */ -static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(SEC_WCHAR *pszPrincipal, SEC_WCHAR *pszPackage, ULONG fCredentialUse, - LUID *pLogonID, void *pAuthData, SEC_GET_KEY_FN pGetKeyFn, void *pGetKeyArgument, CredHandle *phCredential, TimeStamp *ptsExpiry) -{ - FIXME("(%s %s 0x%08x %p %p %p %p %p %p)\n", debugstr_w(pszPrincipal), debugstr_w(pszPackage), fCredentialUse, - pLogonID, pAuthData, pGetKeyFn, pGetKeyArgument, phCredential, ptsExpiry); - return SEC_E_NO_CREDENTIALS; -} - -/*********************************************************************** - * AcquireCredentialsHandleA - */ -static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(SEC_CHAR *pszPrincipal, SEC_CHAR *pszPackage, ULONG fCredentialUse, - LUID *pLogonID, void *pAuthData, SEC_GET_KEY_FN pGetKeyFn, void *pGetKeyArgument, CredHandle *phCredential, TimeStamp *ptsExpiry) -{ - FIXME("(%s %s 0x%08x %p %p %p %p %p %p)\n", debugstr_a(pszPrincipal), debugstr_a(pszPackage), fCredentialUse, - pLogonID, pAuthData, pGetKeyFn, pGetKeyArgument, phCredential, ptsExpiry); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * InitializeSecurityContextW - */ -static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(CredHandle *phCredential, CtxtHandle *phContext, SEC_WCHAR *pszTargetName, - ULONG fContextReq, ULONG Reserved1, ULONG TargetDataRep, SecBufferDesc *pInput, ULONG Reserved2, CtxtHandle *phNewContext, - SecBufferDesc *pOutput, ULONG *pfContextAttr, TimeStamp *ptsExpiry) -{ - FIXME("(%p %p %s 0x%08x %d %d %p %d %p %p %p %p)\n", phCredential, phContext, debugstr_w(pszTargetName), - fContextReq, Reserved1, TargetDataRep, pInput, Reserved1, phNewContext, pOutput, pfContextAttr, ptsExpiry); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * InitializeSecurityContextA - */ -static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(CredHandle *phCredential, CtxtHandle *phContext, SEC_CHAR *pszTargetName, - ULONG fContextReq, ULONG Reserved1, ULONG TargetDataRep, SecBufferDesc *pInput, ULONG Reserved2, CtxtHandle *phNewContext, - SecBufferDesc *pOutput, ULONG *pfContextAttr, TimeStamp *ptsExpiry) -{ - FIXME("%p %p %s %d %d %d %p %d %p %p %p %p\n", phCredential, phContext, debugstr_a(pszTargetName), fContextReq, - Reserved1, TargetDataRep, pInput, Reserved1, phNewContext, pOutput, pfContextAttr, ptsExpiry); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * AcceptSecurityContext - */ -static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(CredHandle *phCredential, CtxtHandle *phContext, SecBufferDesc *pInput, - ULONG fContextReq, ULONG TargetDataRep, CtxtHandle *phNewContext, SecBufferDesc *pOutput, ULONG *pfContextAttr, TimeStamp *ptsExpiry) -{ - FIXME("(%p %p %p %d %d %p %p %p %p)\n", phCredential, phContext, pInput, fContextReq, TargetDataRep, phNewContext, pOutput, - pfContextAttr, ptsExpiry); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * CompleteAuthToken - */ -static SECURITY_STATUS SEC_ENTRY kerberos_CompleteAuthToken(CtxtHandle *phContext, SecBufferDesc *pToken) -{ - FIXME("(%p %p)\n", phContext, pToken); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * DeleteSecurityContext - */ -static SECURITY_STATUS SEC_ENTRY kerberos_DeleteSecurityContext(CtxtHandle *phContext) -{ - FIXME("(%p)\n", phContext); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * QueryContextAttributesW - */ -static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(CtxtHandle *phContext, ULONG ulAttribute, void *pBuffer) -{ - FIXME("(%p %d %p)\n", phContext, ulAttribute, pBuffer); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * QueryContextAttributesA - */ -static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(CtxtHandle *phContext, ULONG ulAttribute, void *pBuffer) -{ - FIXME("(%p %d %p)\n", phContext, ulAttribute, pBuffer); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * ImpersonateSecurityContext - */ -static SECURITY_STATUS SEC_ENTRY kerberos_ImpersonateSecurityContext(CtxtHandle *phContext) -{ - FIXME("(%p)\n", phContext); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * RevertSecurityContext - */ -static SECURITY_STATUS SEC_ENTRY kerberos_RevertSecurityContext(CtxtHandle *phContext) -{ - FIXME("(%p)\n", phContext); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * MakeSignature - */ -static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(CtxtHandle *phContext, ULONG fQOP, SecBufferDesc *pMessage, ULONG MessageSeqNo) -{ - FIXME("(%p %d %p %d)\n", phContext, fQOP, pMessage, MessageSeqNo); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * VerifySignature - */ -static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(CtxtHandle *phContext, SecBufferDesc *pMessage, ULONG MessageSeqNo, PULONG pfQOP) -{ - FIXME("(%p %p %d %p)\n", phContext, pMessage, MessageSeqNo, pfQOP); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * FreeCredentialsHandle - */ -static SECURITY_STATUS SEC_ENTRY kerberos_FreeCredentialsHandle(PCredHandle phCredential) -{ - FIXME("(%p)\n", phCredential); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * EncryptMessage - */ -static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(CtxtHandle *phContext, ULONG fQOP, SecBufferDesc *pMessage, ULONG MessageSeqNo) -{ - FIXME("(%p %d %p %d)\n", phContext, fQOP, pMessage, MessageSeqNo); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -/*********************************************************************** - * DecryptMessage - */ -static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(CtxtHandle *phContext, SecBufferDesc *pMessage, ULONG MessageSeqNo, PULONG pfQOP) -{ - FIXME("(%p %p %d %p)\n", phContext, pMessage, MessageSeqNo, pfQOP); - return SEC_E_UNSUPPORTED_FUNCTION; -} - -static const SecurityFunctionTableA kerberosTableA = { - 1, - NULL, /* EnumerateSecurityPackagesA */ - kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributesA */ - kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandleA */ - kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */ - NULL, /* Reserved2 */ - kerberos_InitializeSecurityContextA, /* InitializeSecurityContextA */ - kerberos_AcceptSecurityContext, /* AcceptSecurityContext */ - kerberos_CompleteAuthToken, /* CompleteAuthToken */ - kerberos_DeleteSecurityContext, /* DeleteSecurityContext */ - NULL, /* ApplyControlToken */ - kerberos_QueryContextAttributesA, /* QueryContextAttributesA */ - kerberos_ImpersonateSecurityContext, /* ImpersonateSecurityContext */ - kerberos_RevertSecurityContext, /* RevertSecurityContext */ - kerberos_MakeSignature, /* MakeSignature */ - kerberos_VerifySignature, /* VerifySignature */ - FreeContextBuffer, /* FreeContextBuffer */ - NULL, /* QuerySecurityPackageInfoA */ - NULL, /* Reserved3 */ - NULL, /* Reserved4 */ - NULL, /* ExportSecurityContext */ - NULL, /* ImportSecurityContextA */ - NULL, /* AddCredentialsA */ - NULL, /* Reserved8 */ - NULL, /* QuerySecurityContextToken */ - kerberos_EncryptMessage, /* EncryptMessage */ - kerberos_DecryptMessage, /* DecryptMessage */ - NULL, /* SetContextAttributesA */ -}; - -static const SecurityFunctionTableW kerberosTableW = { - 1, - NULL, /* EnumerateSecurityPackagesW */ - kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributesW */ - kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandleW */ - kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */ - NULL, /* Reserved2 */ - kerberos_InitializeSecurityContextW, /* InitializeSecurityContextW */ - kerberos_AcceptSecurityContext, /* AcceptSecurityContext */ - kerberos_CompleteAuthToken, /* CompleteAuthToken */ - kerberos_DeleteSecurityContext, /* DeleteSecurityContext */ - NULL, /* ApplyControlToken */ - kerberos_QueryContextAttributesW, /* QueryContextAttributesW */ - kerberos_ImpersonateSecurityContext, /* ImpersonateSecurityContext */ - kerberos_RevertSecurityContext, /* RevertSecurityContext */ - kerberos_MakeSignature, /* MakeSignature */ - kerberos_VerifySignature, /* VerifySignature */ - FreeContextBuffer, /* FreeContextBuffer */ - NULL, /* QuerySecurityPackageInfoW */ - NULL, /* Reserved3 */ - NULL, /* Reserved4 */ - NULL, /* ExportSecurityContext */ - NULL, /* ImportSecurityContextW */ - NULL, /* AddCredentialsW */ - NULL, /* Reserved8 */ - NULL, /* QuerySecurityContextToken */ - kerberos_EncryptMessage, /* EncryptMessage */ - kerberos_DecryptMessage, /* DecryptMessage */ - NULL, /* SetContextAttributesW */ -}; - -#define KERBEROS_COMMENT \ - {'M','i','c','r','o','s','o','f','t',' ','K','e','r','b','e','r','o','s',' ','V','1','.','0',0} -static CHAR kerberos_comment_A[] = KERBEROS_COMMENT; -static WCHAR kerberos_comment_W[] = KERBEROS_COMMENT; - -#define KERBEROS_NAME {'K','e','r','b','e','r','o','s',0} -static char kerberos_name_A[] = KERBEROS_NAME; -static WCHAR kerberos_name_W[] = KERBEROS_NAME; - -#define CAPS \ - ( SECPKG_FLAG_INTEGRITY \ - | SECPKG_FLAG_PRIVACY \ - | SECPKG_FLAG_TOKEN_ONLY \ - | SECPKG_FLAG_DATAGRAM \ - | SECPKG_FLAG_CONNECTION \ - | SECPKG_FLAG_MULTI_REQUIRED \ - | SECPKG_FLAG_EXTENDED_ERROR \ - | SECPKG_FLAG_IMPERSONATION \ - | SECPKG_FLAG_ACCEPT_WIN32_NAME \ - | SECPKG_FLAG_NEGOTIABLE \ - | SECPKG_FLAG_GSS_COMPATIBLE \ - | SECPKG_FLAG_LOGON \ - | SECPKG_FLAG_MUTUAL_AUTH \ - | SECPKG_FLAG_DELEGATION \ - | SECPKG_FLAG_READONLY_WITH_CHECKSUM \ - | SECPKG_FLAG_RESTRICTED_TOKENS \ - | SECPKG_FLAG_APPCONTAINER_CHECKS) - -static const SecPkgInfoW infoW = { - CAPS, - 1, - RPC_C_AUTHN_GSS_KERBEROS, - KERBEROS_MAX_BUF, - kerberos_name_W, - kerberos_comment_W -}; - -static const SecPkgInfoA infoA = { - CAPS, - 1, - RPC_C_AUTHN_GSS_KERBEROS, - KERBEROS_MAX_BUF, - kerberos_name_A, - kerberos_comment_A -}; - -void SECUR32_initKerberosSP(void) -{ - SecureProvider *provider = SECUR32_addProvider(&kerberosTableA, &kerberosTableW, NULL); - SECUR32_addPackages(provider, 1, &infoA, &infoW); -} diff --git a/dlls/secur32/secur32.c b/dlls/secur32/secur32.c index 1e12f3c543..f7b1ec2d98 100644 --- a/dlls/secur32/secur32.c +++ b/dlls/secur32/secur32.c @@ -564,7 +564,8 @@ static void SECUR32_initializeProviders(void) /* First load built-in providers */ SECUR32_initSchannelSP(); SECUR32_initNTLMSP(); - SECUR32_initKerberosSP(); + /* Load SSP/AP packages (Kerberos and others) */ + load_auth_packages(); /* Load the Negotiate provider last so apps stumble over the working NTLM * provider first. Attempting to fix bug #16905 while keeping the * application reported on wine-users on 2006-09-12 working. */ diff --git a/dlls/secur32/secur32_priv.h b/dlls/secur32/secur32_priv.h index 9a60d65788..973b75c699 100644 --- a/dlls/secur32/secur32_priv.h +++ b/dlls/secur32/secur32_priv.h @@ -136,7 +136,7 @@ PSTR SECUR32_AllocMultiByteFromWide(PCWSTR str) DECLSPEC_HIDDEN; void SECUR32_initSchannelSP(void) DECLSPEC_HIDDEN; void SECUR32_initNegotiateSP(void) DECLSPEC_HIDDEN; void SECUR32_initNTLMSP(void) DECLSPEC_HIDDEN; -void SECUR32_initKerberosSP(void) DECLSPEC_HIDDEN; +void load_auth_packages(void) DECLSPEC_HIDDEN; /* Cleanup functions for built-in providers */ void SECUR32_deinitSchannelSP(void) DECLSPEC_HIDDEN; -- 2.15.1

2 1

[PATCH 8/9] secur32: Implement DecryptMessage in the SSP/AP wrapper.
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index b89052df01..35df4ce565 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -643,6 +643,27 @@ static SECURITY_STATUS WINAPI lsa_EncryptMessage(CtxtHandle *context, ULONG qual return lsa_package->user_api->SealMessage(lsa_context, quality_of_protection, message, message_seq_no); } +static SECURITY_STATUS WINAPI lsa_DecryptMessage(CtxtHandle *context, SecBufferDesc *message, + ULONG message_seq_no, ULONG *quality_of_protection) +{ + struct lsa_package *lsa_package; + LSA_SEC_HANDLE lsa_context; + + TRACE("%p %p %u %p)\n", context, message, message_seq_no, quality_of_protection); + + if (!context) return SEC_E_INVALID_HANDLE; + + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + + if (!lsa_package) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->user_api || !lsa_package->user_api->UnsealMessage) + return SEC_E_UNSUPPORTED_FUNCTION; + + return lsa_package->user_api->UnsealMessage(lsa_context, message, message_seq_no, quality_of_protection); +} + static const SecurityFunctionTableW lsa_sspi_tableW = { 1, @@ -671,7 +692,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = NULL, /* Reserved8 */ NULL, /* QuerySecurityContextToken */ lsa_EncryptMessage, - NULL, /* DecryptMessage */ + lsa_DecryptMessage, NULL, /* SetContextAttributesW */ }; @@ -703,7 +724,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = NULL, /* Reserved8 */ NULL, /* QuerySecurityContextToken */ lsa_EncryptMessage, - NULL, /* DecryptMessage */ + lsa_DecryptMessage, NULL, /* SetContextAttributesA */ }; -- 2.15.1

2 1

[PATCH 7/9] secur32: Implement EncryptMessage in the SSP/AP wrapper.
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index 8752ba1ad8..b89052df01 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -622,6 +622,27 @@ static SECURITY_STATUS WINAPI lsa_VerifySignature(CtxtHandle *context, SecBuffer return lsa_package->user_api->VerifySignature(lsa_context, message, message_seq_no, quality_of_protection); } +static SECURITY_STATUS WINAPI lsa_EncryptMessage(CtxtHandle *context, ULONG quality_of_protection, + SecBufferDesc *message, ULONG message_seq_no) +{ + struct lsa_package *lsa_package; + LSA_SEC_HANDLE lsa_context; + + TRACE("%p %#x %p %u)\n", context, quality_of_protection, message, message_seq_no); + + if (!context) return SEC_E_INVALID_HANDLE; + + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + + if (!lsa_package) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->user_api || !lsa_package->user_api->SealMessage) + return SEC_E_UNSUPPORTED_FUNCTION; + + return lsa_package->user_api->SealMessage(lsa_context, quality_of_protection, message, message_seq_no); +} + static const SecurityFunctionTableW lsa_sspi_tableW = { 1, @@ -649,7 +670,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = NULL, /* AddCredentialsW */ NULL, /* Reserved8 */ NULL, /* QuerySecurityContextToken */ - NULL, /* EncryptMessage */ + lsa_EncryptMessage, NULL, /* DecryptMessage */ NULL, /* SetContextAttributesW */ }; @@ -681,7 +702,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = NULL, /* AddCredentialsA */ NULL, /* Reserved8 */ NULL, /* QuerySecurityContextToken */ - NULL, /* EncryptMessage */ + lsa_EncryptMessage, NULL, /* DecryptMessage */ NULL, /* SetContextAttributesA */ }; -- 2.15.1

2 1

[PATCH 6/9] secur32: Implement VerifySignature in the SSP/AP wrapper.
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index 832303f7bb..8752ba1ad8 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -601,6 +601,27 @@ static SECURITY_STATUS WINAPI lsa_MakeSignature(CtxtHandle *context, ULONG quali return lsa_package->user_api->MakeSignature(lsa_context, quality_of_protection, message, message_seq_no); } +static SECURITY_STATUS WINAPI lsa_VerifySignature(CtxtHandle *context, SecBufferDesc *message, + ULONG message_seq_no, ULONG *quality_of_protection) +{ + struct lsa_package *lsa_package; + LSA_SEC_HANDLE lsa_context; + + TRACE("%p %p %u %p)\n", context, message, message_seq_no, quality_of_protection); + + if (!context) return SEC_E_INVALID_HANDLE; + + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + + if (!lsa_package) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->user_api || !lsa_package->user_api->VerifySignature) + return SEC_E_UNSUPPORTED_FUNCTION; + + return lsa_package->user_api->VerifySignature(lsa_context, message, message_seq_no, quality_of_protection); +} + static const SecurityFunctionTableW lsa_sspi_tableW = { 1, @@ -618,7 +639,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = NULL, /* ImpersonateSecurityContext */ NULL, /* RevertSecurityContext */ lsa_MakeSignature, - NULL, /* VerifySignature */ + lsa_VerifySignature, NULL, /* FreeContextBuffer */ NULL, /* QuerySecurityPackageInfoW */ NULL, /* Reserved3 */ @@ -650,7 +671,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = NULL, /* ImpersonateSecurityContext */ NULL, /* RevertSecurityContext */ lsa_MakeSignature, - NULL, /* VerifySignature */ + lsa_VerifySignature, NULL, /* FreeContextBuffer */ NULL, /* QuerySecurityPackageInfoA */ NULL, /* Reserved3 */ -- 2.15.1

2 1

[PATCH 5/9] secur32: Implement MakeSignature in the SSP/AP wrapper.
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index 479a2d233d..832303f7bb 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -580,6 +580,27 @@ static SECURITY_STATUS WINAPI lsa_QueryContextAttributesA(CtxtHandle *context, U return SEC_E_UNSUPPORTED_FUNCTION; } +static SECURITY_STATUS WINAPI lsa_MakeSignature(CtxtHandle *context, ULONG quality_of_protection, + SecBufferDesc *message, ULONG message_seq_no) +{ + struct lsa_package *lsa_package; + LSA_SEC_HANDLE lsa_context; + + TRACE("%p %#x %p %u)\n", context, quality_of_protection, message, message_seq_no); + + if (!context) return SEC_E_INVALID_HANDLE; + + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + + if (!lsa_package) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->user_api || !lsa_package->user_api->MakeSignature) + return SEC_E_UNSUPPORTED_FUNCTION; + + return lsa_package->user_api->MakeSignature(lsa_context, quality_of_protection, message, message_seq_no); +} + static const SecurityFunctionTableW lsa_sspi_tableW = { 1, @@ -596,7 +617,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = lsa_QueryContextAttributesW, NULL, /* ImpersonateSecurityContext */ NULL, /* RevertSecurityContext */ - NULL, /* MakeSignature */ + lsa_MakeSignature, NULL, /* VerifySignature */ NULL, /* FreeContextBuffer */ NULL, /* QuerySecurityPackageInfoW */ @@ -628,7 +649,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = lsa_QueryContextAttributesA, NULL, /* ImpersonateSecurityContext */ NULL, /* RevertSecurityContext */ - NULL, /* MakeSignature */ + lsa_MakeSignature, NULL, /* VerifySignature */ NULL, /* FreeContextBuffer */ NULL, /* QuerySecurityPackageInfoA */ -- 2.15.1

2 1

[PATCH 4/9] secur32: Implement QueryContextAttributes in the SSP/AP wrapper.
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 56 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index c4f408fcf4..479a2d233d 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -526,6 +526,60 @@ static SECURITY_STATUS WINAPI lsa_DeleteSecurityContext(CtxtHandle *context) return lsa_package->lsa_api->DeleteContext(lsa_context); } +static SECURITY_STATUS WINAPI lsa_QueryContextAttributesW(CtxtHandle *context, ULONG attribute, void *buffer) +{ + struct lsa_package *lsa_package; + LSA_SEC_HANDLE lsa_context; + + TRACE("%p %d %p\n", context, attribute, buffer); + + if (!context) return SEC_E_INVALID_HANDLE; + + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + + if (!lsa_package) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->lsa_api || !lsa_package->lsa_api->SpQueryContextAttributes) + return SEC_E_UNSUPPORTED_FUNCTION; + + return lsa_package->lsa_api->SpQueryContextAttributes(lsa_context, attribute, buffer); +} + +static SECURITY_STATUS WINAPI lsa_QueryContextAttributesA(CtxtHandle *context, ULONG attribute, void *buffer) +{ + TRACE("%p %d %p\n", context, attribute, buffer); + + if (!context) return SEC_E_INVALID_HANDLE; + + switch (attribute) + { + case SECPKG_ATTR_SIZES: + return lsa_QueryContextAttributesW( context, attribute, buffer ); + +#define X(x) case (x) : FIXME(#x" stub\n"); break + X(SECPKG_ATTR_ACCESS_TOKEN); + X(SECPKG_ATTR_AUTHORITY); + X(SECPKG_ATTR_DCE_INFO); + X(SECPKG_ATTR_KEY_INFO); + X(SECPKG_ATTR_LIFESPAN); + X(SECPKG_ATTR_NAMES); + X(SECPKG_ATTR_NATIVE_NAMES); + X(SECPKG_ATTR_PACKAGE_INFO); + X(SECPKG_ATTR_PASSWORD_EXPIRY); + X(SECPKG_ATTR_SESSION_KEY); + X(SECPKG_ATTR_STREAM_SIZES); + X(SECPKG_ATTR_TARGET_INFORMATION); + X(SECPKG_ATTR_NEGOTIATION_INFO); +#undef X + default: + FIXME( "unknown attribute %u\n", attribute ); + break; + } + + return SEC_E_UNSUPPORTED_FUNCTION; +} + static const SecurityFunctionTableW lsa_sspi_tableW = { 1, @@ -539,7 +593,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = NULL, /* CompleteAuthToken */ lsa_DeleteSecurityContext, NULL, /* ApplyControlToken */ - NULL, /* QueryContextAttributesW */ + lsa_QueryContextAttributesW, NULL, /* ImpersonateSecurityContext */ NULL, /* RevertSecurityContext */ NULL, /* MakeSignature */ @@ -571,7 +625,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = NULL, /* CompleteAuthToken */ lsa_DeleteSecurityContext, NULL, /* ApplyControlToken */ - NULL, /* QueryContextAttributesA */ + lsa_QueryContextAttributesA, NULL, /* ImpersonateSecurityContext */ NULL, /* RevertSecurityContext */ NULL, /* MakeSignature */ -- 2.15.1

2 1

[PATCH 3/9] secur32: Implement AcceptSecurityContext in the SSP/AP wrapper. (v4)
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 44 ++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 42 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index 43b69a5ad3..c4f408fcf4 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -466,6 +466,46 @@ static SECURITY_STATUS WINAPI lsa_InitializeSecurityContextA( return status; } +static SECURITY_STATUS WINAPI lsa_AcceptSecurityContext( + CredHandle *credential, CtxtHandle *context, SecBufferDesc *input, + ULONG context_req, ULONG target_data_rep, CtxtHandle *new_context, + SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry) +{ + SECURITY_STATUS status; + struct lsa_package *lsa_package = NULL; + LSA_SEC_HANDLE lsa_credential = 0, lsa_context = 0, new_lsa_context; + BOOLEAN mapped_context; + + TRACE("%p %p %p %#x %#x %p %p %p %p\n", credential, context, input, + context_req, target_data_rep, new_context, output, context_attr, ts_expiry); + + if (context) + { + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + } + else if (credential) + { + lsa_package = (struct lsa_package *)credential->dwUpper; + lsa_credential = (LSA_SEC_HANDLE)credential->dwLower; + } + + if (!lsa_package || !new_context) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->lsa_api || !lsa_package->lsa_api->AcceptLsaModeContext) + return SEC_E_UNSUPPORTED_FUNCTION; + + status = lsa_package->lsa_api->AcceptLsaModeContext(lsa_credential, lsa_context, + input, context_req, target_data_rep, &new_lsa_context, output, context_attr, + ts_expiry, &mapped_context, NULL /* FIXME */); + if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) + { + new_context->dwLower = (ULONG_PTR)new_lsa_context; + new_context->dwUpper = (ULONG_PTR)lsa_package; + } + return status; +} + static SECURITY_STATUS WINAPI lsa_DeleteSecurityContext(CtxtHandle *context) { struct lsa_package *lsa_package; @@ -495,7 +535,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = lsa_FreeCredentialsHandle, NULL, /* Reserved2 */ lsa_InitializeSecurityContextW, - NULL, /* AcceptSecurityContext */ + lsa_AcceptSecurityContext, NULL, /* CompleteAuthToken */ lsa_DeleteSecurityContext, NULL, /* ApplyControlToken */ @@ -527,7 +567,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = lsa_FreeCredentialsHandle, NULL, /* Reserved2 */ lsa_InitializeSecurityContextA, - NULL, /* AcceptSecurityContext */ + lsa_AcceptSecurityContext, NULL, /* CompleteAuthToken */ lsa_DeleteSecurityContext, NULL, /* ApplyControlToken */ -- 2.15.1

2 1

[PATCH 2/9] secur32: Implement DeleteSecurityContext in the SSP/AP wrapper.
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index 8da3a61cfd..43b69a5ad3 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -466,6 +466,26 @@ static SECURITY_STATUS WINAPI lsa_InitializeSecurityContextA( return status; } +static SECURITY_STATUS WINAPI lsa_DeleteSecurityContext(CtxtHandle *context) +{ + struct lsa_package *lsa_package; + LSA_SEC_HANDLE lsa_context; + + TRACE("%p\n", context); + + if (!context) return SEC_E_INVALID_HANDLE; + + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + + if (!lsa_package) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->lsa_api || !lsa_package->lsa_api->DeleteContext) + return SEC_E_UNSUPPORTED_FUNCTION; + + return lsa_package->lsa_api->DeleteContext(lsa_context); +} + static const SecurityFunctionTableW lsa_sspi_tableW = { 1, @@ -477,7 +497,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = lsa_InitializeSecurityContextW, NULL, /* AcceptSecurityContext */ NULL, /* CompleteAuthToken */ - NULL, /* DeleteSecurityContext */ + lsa_DeleteSecurityContext, NULL, /* ApplyControlToken */ NULL, /* QueryContextAttributesW */ NULL, /* ImpersonateSecurityContext */ @@ -509,7 +529,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = lsa_InitializeSecurityContextA, NULL, /* AcceptSecurityContext */ NULL, /* CompleteAuthToken */ - NULL, /* DeleteSecurityContext */ + lsa_DeleteSecurityContext, NULL, /* ApplyControlToken */ NULL, /* QueryContextAttributesA */ NULL, /* ImpersonateSecurityContext */ -- 2.15.1

2 1

[PATCH 1/9] secur32: Implement InitializeSecurityContext in the SSP/AP wrapper. (v4)
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Partially based on Hans Leidekker's work. Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 72 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index 1916aa4b3a..8da3a61cfd 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -396,6 +396,76 @@ static SECURITY_STATUS WINAPI lsa_FreeCredentialsHandle(CredHandle *credential) return lsa_package->lsa_api->FreeCredentialsHandle(lsa_credential); } +static SECURITY_STATUS WINAPI lsa_InitializeSecurityContextW( + CredHandle *credential, CtxtHandle *context, SEC_WCHAR *target_name, ULONG context_req, + ULONG reserved1, ULONG target_data_rep, SecBufferDesc *input, ULONG reserved2, + CtxtHandle *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry) +{ + SECURITY_STATUS status; + struct lsa_package *lsa_package = NULL; + LSA_SEC_HANDLE lsa_credential = 0, lsa_context = 0, new_lsa_context; + UNICODE_STRING target_name_us; + BOOLEAN mapped_context; + + TRACE("%p %p %s %#x %d %d %p %d %p %p %p %p\n", credential, context, + debugstr_w(target_name), context_req, reserved1, target_data_rep, input, + reserved2, new_context, output, context_attr, ts_expiry); + + if (context) + { + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + } + else if (credential) + { + lsa_package = (struct lsa_package *)credential->dwUpper; + lsa_credential = (LSA_SEC_HANDLE)credential->dwLower; + } + + if (!lsa_package || !new_context) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->lsa_api || !lsa_package->lsa_api->InitLsaModeContext) + return SEC_E_UNSUPPORTED_FUNCTION; + + if (target_name) + RtlInitUnicodeString(&target_name_us, target_name); + + status = lsa_package->lsa_api->InitLsaModeContext(lsa_credential, lsa_context, + target_name ? &target_name_us : NULL, context_req, target_data_rep, input, + &new_lsa_context, output, context_attr, ts_expiry, &mapped_context, NULL /* FIXME */); + if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) + { + new_context->dwLower = (ULONG_PTR)new_lsa_context; + new_context->dwUpper = (ULONG_PTR)lsa_package; + } + return status; +} + +static SECURITY_STATUS WINAPI lsa_InitializeSecurityContextA( + CredHandle *credential, CtxtHandle *context, SEC_CHAR *target_name, ULONG context_req, + ULONG reserved1, ULONG target_data_rep, SecBufferDesc *input, ULONG reserved2, + CtxtHandle *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry) +{ + SECURITY_STATUS status; + SEC_WCHAR *targetW = NULL; + + TRACE("%p %p %s %#x %d %d %p %d %p %p %p %p\n", credential, context, + debugstr_a(target_name), context_req, reserved1, target_data_rep, input, + reserved2, new_context, output, context_attr, ts_expiry); + + if (target_name) + { + int len = MultiByteToWideChar( CP_ACP, 0, target_name, -1, NULL, 0 ); + if (!(targetW = HeapAlloc( GetProcessHeap(), 0, len * sizeof(SEC_WCHAR) ))) return SEC_E_INSUFFICIENT_MEMORY; + MultiByteToWideChar( CP_ACP, 0, target_name, -1, targetW, len ); + } + + status = lsa_InitializeSecurityContextW( credential, context, targetW, context_req, reserved1, target_data_rep, + input, reserved2, new_context, output, context_attr, ts_expiry ); + HeapFree( GetProcessHeap(), 0, targetW ); + return status; +} + static const SecurityFunctionTableW lsa_sspi_tableW = { 1, @@ -404,7 +474,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = lsa_AcquireCredentialsHandleW, lsa_FreeCredentialsHandle, NULL, /* Reserved2 */ - NULL, /* InitializeSecurityContextW */ + lsa_InitializeSecurityContextW, NULL, /* AcceptSecurityContext */ NULL, /* CompleteAuthToken */ NULL, /* DeleteSecurityContext */ @@ -436,7 +506,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = lsa_AcquireCredentialsHandleA, lsa_FreeCredentialsHandle, NULL, /* Reserved2 */ - NULL, /* InitializeSecurityContextA */ + lsa_InitializeSecurityContextA, NULL, /* AcceptSecurityContext */ NULL, /* CompleteAuthToken */ NULL, /* DeleteSecurityContext */ -- 2.15.1

2 1

[PATCH 1/9] secur32: Implement InitializeSecurityContext in the SSP/AP wrapper. (v3)
by Dmitry Timoshkov Feb. 1, 2018

Feb. 1, 2018

Partially based on Hans Leidekker's work. v2: switch order of context vs. credentials initialization initialize context also in case of SEC_I_CONTINUE_NEEDED v3: actually switch order of context vs. credentials initialization Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/secur32/lsa.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 72 insertions(+), 2 deletions(-) diff --git a/dlls/secur32/lsa.c b/dlls/secur32/lsa.c index 1916aa4b3a..ce4fb62a9d 100644 --- a/dlls/secur32/lsa.c +++ b/dlls/secur32/lsa.c @@ -396,6 +396,76 @@ static SECURITY_STATUS WINAPI lsa_FreeCredentialsHandle(CredHandle *credential) return lsa_package->lsa_api->FreeCredentialsHandle(lsa_credential); } +static SECURITY_STATUS WINAPI lsa_InitializeSecurityContextW( + CredHandle *credential, CtxtHandle *context, SEC_WCHAR *target_name, ULONG context_req, + ULONG reserved1, ULONG target_data_rep, SecBufferDesc *input, ULONG reserved2, + CtxtHandle *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry) +{ + SECURITY_STATUS status; + struct lsa_package *lsa_package = NULL; + LSA_SEC_HANDLE lsa_credential = 0, lsa_context = 0, new_lsa_context; + UNICODE_STRING target_name_us; + BOOLEAN mapped_context; + + TRACE("%p %p %s %#x %d %d %p %d %p %p %p %p\n", credential, context, + debugstr_w(target_name), context_req, reserved1, target_data_rep, input, + reserved2, new_context, output, context_attr, ts_expiry); + + if (context) + { + lsa_package = (struct lsa_package *)credential->dwUpper; + lsa_context = (LSA_SEC_HANDLE)context->dwLower; + } + else if (credential) + { + lsa_package = (struct lsa_package *)context->dwUpper; + lsa_credential = (LSA_SEC_HANDLE)credential->dwLower; + } + + if (!lsa_package || !new_context) return SEC_E_INVALID_HANDLE; + + if (!lsa_package->lsa_api || !lsa_package->lsa_api->InitLsaModeContext) + return SEC_E_UNSUPPORTED_FUNCTION; + + if (target_name) + RtlInitUnicodeString(&target_name_us, target_name); + + status = lsa_package->lsa_api->InitLsaModeContext(lsa_credential, lsa_context, + target_name ? &target_name_us : NULL, context_req, target_data_rep, input, + &new_lsa_context, output, context_attr, ts_expiry, &mapped_context, NULL /* FIXME */); + if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) + { + new_context->dwLower = (ULONG_PTR)new_lsa_context; + new_context->dwUpper = (ULONG_PTR)lsa_package; + } + return status; +} + +static SECURITY_STATUS WINAPI lsa_InitializeSecurityContextA( + CredHandle *credential, CtxtHandle *context, SEC_CHAR *target_name, ULONG context_req, + ULONG reserved1, ULONG target_data_rep, SecBufferDesc *input, ULONG reserved2, + CtxtHandle *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry) +{ + SECURITY_STATUS status; + SEC_WCHAR *targetW = NULL; + + TRACE("%p %p %s %#x %d %d %p %d %p %p %p %p\n", credential, context, + debugstr_a(target_name), context_req, reserved1, target_data_rep, input, + reserved2, new_context, output, context_attr, ts_expiry); + + if (target_name) + { + int len = MultiByteToWideChar( CP_ACP, 0, target_name, -1, NULL, 0 ); + if (!(targetW = HeapAlloc( GetProcessHeap(), 0, len * sizeof(SEC_WCHAR) ))) return SEC_E_INSUFFICIENT_MEMORY; + MultiByteToWideChar( CP_ACP, 0, target_name, -1, targetW, len ); + } + + status = lsa_InitializeSecurityContextW( credential, context, targetW, context_req, reserved1, target_data_rep, + input, reserved2, new_context, output, context_attr, ts_expiry ); + HeapFree( GetProcessHeap(), 0, targetW ); + return status; +} + static const SecurityFunctionTableW lsa_sspi_tableW = { 1, @@ -404,7 +474,7 @@ static const SecurityFunctionTableW lsa_sspi_tableW = lsa_AcquireCredentialsHandleW, lsa_FreeCredentialsHandle, NULL, /* Reserved2 */ - NULL, /* InitializeSecurityContextW */ + lsa_InitializeSecurityContextW, NULL, /* AcceptSecurityContext */ NULL, /* CompleteAuthToken */ NULL, /* DeleteSecurityContext */ @@ -436,7 +506,7 @@ static const SecurityFunctionTableA lsa_sspi_tableA = lsa_AcquireCredentialsHandleA, lsa_FreeCredentialsHandle, NULL, /* Reserved2 */ - NULL, /* InitializeSecurityContextA */ + lsa_InitializeSecurityContextA, NULL, /* AcceptSecurityContext */ NULL, /* CompleteAuthToken */ NULL, /* DeleteSecurityContext */ -- 2.15.1

2 2