March 2018 - Wine-Devel - list.winehq.org

[PATCH 3/6] bcrypt: Implement BCryptVerifySignature for ecdsa signatures.
by Alistair Leslie-Hughes March 26, 2018

March 26, 2018

From: Michael Müller <michael(a)fds-team.de> Signed-off-by: Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> --- dlls/bcrypt/bcrypt_main.c | 343 +++++++++++++++++++++++++++++++++++++++++++-- dlls/bcrypt/tests/bcrypt.c | 4 +- 2 files changed, 337 insertions(+), 10 deletions(-) diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c index afa8f2a..ee6c211 100644 --- a/dlls/bcrypt/bcrypt_main.c +++ b/dlls/bcrypt/bcrypt_main.c @@ -27,6 +27,7 @@ #elif defined(HAVE_GNUTLS_CIPHER_INIT) #include <gnutls/gnutls.h> #include <gnutls/crypto.h> +#include <gnutls/abstract.h> #endif #include "ntstatus.h" @@ -50,9 +51,31 @@ static HINSTANCE instance; #if defined(HAVE_GNUTLS_CIPHER_INIT) && !defined(HAVE_COMMONCRYPTO_COMMONCRYPTOR_H) WINE_DECLARE_DEBUG_CHANNEL(winediag); +#if GNUTLS_VERSION_MAJOR < 3 +#define GNUTLS_CIPHER_AES_192_CBC 92 +#define GNUTLS_CIPHER_AES_128_GCM 93 +#define GNUTLS_CIPHER_AES_256_GCM 94 +#define GNUTLS_PK_ECC 4 + +typedef enum +{ + GNUTLS_ECC_CURVE_INVALID = 0, + GNUTLS_ECC_CURVE_SECP224R1, + GNUTLS_ECC_CURVE_SECP256R1, + GNUTLS_ECC_CURVE_SECP384R1, + GNUTLS_ECC_CURVE_SECP521R1, +} gnutls_ecc_curve_t; +#endif + /* Not present in gnutls version < 3.0 */ static int (*pgnutls_cipher_tag)(gnutls_cipher_hd_t handle, void * tag, size_t tag_size); static int (*pgnutls_cipher_add_auth)(gnutls_cipher_hd_t handle, const void *ptext, size_t ptext_size); +static int (*pgnutls_pubkey_import_ecc_raw)(gnutls_pubkey_t key, gnutls_ecc_curve_t curve, + const gnutls_datum_t *x, const gnutls_datum_t *y); +static gnutls_sign_algorithm_t (*pgnutls_pk_to_sign)(gnutls_pk_algorithm_t pk, gnutls_digest_algorithm_t hash); +static int (*pgnutls_pubkey_verify_hash2)(gnutls_pubkey_t key, gnutls_sign_algorithm_t algo, + unsigned int flags, const gnutls_datum_t *hash, + const gnutls_datum_t *signature); static void *libgnutls_handle; #define MAKE_FUNCPTR(f) static typeof(f) * p##f @@ -65,14 +88,10 @@ MAKE_FUNCPTR(gnutls_global_init); MAKE_FUNCPTR(gnutls_global_set_log_function); MAKE_FUNCPTR(gnutls_global_set_log_level); MAKE_FUNCPTR(gnutls_perror); +MAKE_FUNCPTR(gnutls_pubkey_init); +MAKE_FUNCPTR(gnutls_pubkey_deinit); #undef MAKE_FUNCPTR -#if GNUTLS_VERSION_MAJOR < 3 -#define GNUTLS_CIPHER_AES_192_CBC 92 -#define GNUTLS_CIPHER_AES_128_GCM 93 -#define GNUTLS_CIPHER_AES_256_GCM 94 -#endif - static int compat_gnutls_cipher_tag(gnutls_cipher_hd_t handle, void *tag, size_t tag_size) { return GNUTLS_E_UNKNOWN_CIPHER_TYPE; @@ -83,6 +102,24 @@ static int compat_gnutls_cipher_add_auth(gnutls_cipher_hd_t handle, const void * return GNUTLS_E_UNKNOWN_CIPHER_TYPE; } +static int compat_gnutls_pubkey_import_ecc_raw(gnutls_pubkey_t key, gnutls_ecc_curve_t curve, + const gnutls_datum_t *x, const gnutls_datum_t *y) +{ + return GNUTLS_E_UNKNOWN_CIPHER_TYPE; +} + +static gnutls_sign_algorithm_t compat_gnutls_pk_to_sign(gnutls_pk_algorithm_t pk, gnutls_digest_algorithm_t hash) +{ + return GNUTLS_SIGN_UNKNOWN; +} + +static int compat_gnutls_pubkey_verify_hash2(gnutls_pubkey_t key, gnutls_sign_algorithm_t algo, + unsigned int flags, const gnutls_datum_t *hash, + const gnutls_datum_t *signature) +{ + return GNUTLS_E_UNKNOWN_CIPHER_TYPE; +} + static void gnutls_log( int level, const char *msg ) { TRACE( "<%d> %s", level, msg ); @@ -114,6 +151,8 @@ static BOOL gnutls_initialize(void) LOAD_FUNCPTR(gnutls_global_set_log_function) LOAD_FUNCPTR(gnutls_global_set_log_level) LOAD_FUNCPTR(gnutls_perror) + LOAD_FUNCPTR(gnutls_pubkey_init); + LOAD_FUNCPTR(gnutls_pubkey_deinit); #undef LOAD_FUNCPTR if (!(pgnutls_cipher_tag = wine_dlsym( libgnutls_handle, "gnutls_cipher_tag", NULL, 0 ))) @@ -132,6 +171,21 @@ static BOOL gnutls_initialize(void) pgnutls_perror( ret ); goto fail; } + if (!(pgnutls_pubkey_import_ecc_raw = wine_dlsym( libgnutls_handle, "gnutls_pubkey_import_ecc_raw", NULL, 0 ))) + { + WARN("gnutls_pubkey_import_ecc_raw not found\n"); + pgnutls_pubkey_import_ecc_raw = compat_gnutls_pubkey_import_ecc_raw; + } + if (!(pgnutls_pk_to_sign = wine_dlsym( libgnutls_handle, "gnutls_pk_to_sign", NULL, 0 ))) + { + WARN("gnutls_pk_to_sign not found\n"); + pgnutls_pk_to_sign = compat_gnutls_pk_to_sign; + } + if (!(pgnutls_pubkey_verify_hash2 = wine_dlsym( libgnutls_handle, "gnutls_pubkey_verify_hash2", NULL, 0 ))) + { + WARN("gnutls_pubkey_verify_hash2 not found\n"); + pgnutls_pubkey_verify_hash2 = compat_gnutls_pubkey_verify_hash2; + } if (TRACE_ON( bcrypt )) { @@ -1219,6 +1273,264 @@ static NTSTATUS key_get_tag( struct key *key, UCHAR *tag, ULONG len ) return STATUS_SUCCESS; } +struct buffer +{ + BYTE *buffer; + DWORD length; + DWORD pos; + BOOL error; +}; + +static void buffer_init( struct buffer *buffer ) +{ + buffer->buffer = NULL; + buffer->length = 0; + buffer->pos = 0; + buffer->error = FALSE; +} + +static void buffer_free( struct buffer *buffer ) +{ + heap_free( buffer->buffer ); +} + +static void buffer_append( struct buffer *buffer, BYTE *data, DWORD len ) +{ + if (!len) return; + + if (buffer->pos + len > buffer->length) + { + DWORD new_length = max( max( buffer->pos + len, buffer->length * 2 ), 64 ); + BYTE *new_buffer; + + if (buffer->buffer) + new_buffer = heap_realloc( buffer->buffer, new_length ); + else + new_buffer = heap_alloc( new_length ); + + if (!new_buffer) + { + ERR( "out of memory\n" ); + buffer->error = TRUE; + return; + } + + buffer->buffer = new_buffer; + buffer->length = new_length; + } + + memcpy( &buffer->buffer[buffer->pos], data, len ); + buffer->pos += len; +} + +static void buffer_append_byte( struct buffer *buffer, BYTE value ) +{ + buffer_append( buffer, &value, sizeof(value) ); +} + +static void buffer_append_asn1_length( struct buffer *buffer, DWORD length ) +{ + DWORD num_bytes; + + if (length < 128) + { + buffer_append_byte( buffer, length ); + return; + } + + if (length <= 0xff) num_bytes = 1; + else if (length <= 0xffff) num_bytes = 2; + else if (length <= 0xffffff) num_bytes = 3; + else num_bytes = 4; + + buffer_append_byte( buffer, 0x80 | num_bytes ); + while (num_bytes--) + buffer_append_byte( buffer, length >> (num_bytes * 8) ); +} + +static void buffer_append_asn1_integer( struct buffer *buffer, BYTE *data, DWORD len ) +{ + DWORD leading_zero = (*data & 0x80) != 0; + + buffer_append_byte( buffer, 0x02 ); /* tag */ + buffer_append_asn1_length( buffer, len + leading_zero ); + if (leading_zero) buffer_append_byte( buffer, 0 ); + buffer_append( buffer, data, len ); +} + +static void buffer_append_asn1_sequence( struct buffer *buffer, struct buffer *content ) +{ + if (content->error) + { + buffer->error = TRUE; + return; + } + + buffer_append_byte( buffer, 0x30 ); /* tag */ + buffer_append_asn1_length( buffer, content->pos ); + buffer_append( buffer, content->buffer, content->pos ); +} + +static void buffer_append_asn1_r_s( struct buffer *buffer, BYTE *r, DWORD r_len, BYTE *s, DWORD s_len ) +{ + struct buffer value; + + buffer_init( &value ); + buffer_append_asn1_integer( &value, r, r_len ); + buffer_append_asn1_integer( &value, s, s_len ); + buffer_append_asn1_sequence( buffer, &value ); + buffer_free( &value ); +} + +static NTSTATUS import_gnutls_pubkey_ecc( struct key *key, gnutls_pubkey_t *gnutls_key ) +{ + gnutls_ecc_curve_t curve; + gnutls_datum_t x, y; + int ret; + + switch (key->alg_id) + { + case ALG_ID_ECDSA_P256: curve = GNUTLS_ECC_CURVE_SECP256R1; break; + case ALG_ID_ECDSA_P384: curve = GNUTLS_ECC_CURVE_SECP384R1; break; + + default: + FIXME( "Algorithm %d not yet supported\n", key->alg_id ); + return STATUS_NOT_IMPLEMENTED; + } + + if ((ret = pgnutls_pubkey_init( gnutls_key ))) + { + pgnutls_perror( ret ); + return STATUS_INTERNAL_ERROR; + } + + x.data = key->u.a.pubkey; + x.size = key->u.a.pubkey_len / 2; + y.data = key->u.a.pubkey + x.size; + y.size = x.size; + + if ((ret = pgnutls_pubkey_import_ecc_raw( *gnutls_key, curve, &x, &y ))) + { + pgnutls_perror( ret ); + pgnutls_pubkey_deinit( *gnutls_key ); + return STATUS_INTERNAL_ERROR; + } + + return STATUS_SUCCESS; +} + +static NTSTATUS import_gnutls_pubkey( struct key *key, gnutls_pubkey_t *gnutls_key) +{ + switch (key->alg_id) + { + case ALG_ID_ECDSA_P256: + case ALG_ID_ECDSA_P384: + return import_gnutls_pubkey_ecc( key, gnutls_key ); + + default: + FIXME("Algorithm %d not yet supported\n", key->alg_id); + return STATUS_NOT_IMPLEMENTED; + } +} + +static NTSTATUS prepare_gnutls_signature_ecc( struct key *key, UCHAR *signature, ULONG signature_len, + gnutls_datum_t *gnutls_signature ) +{ + struct buffer buffer; + DWORD r_len = signature_len / 2; + DWORD s_len = r_len; + BYTE *r = signature; + BYTE *s = signature + r_len; + + buffer_init( &buffer ); + buffer_append_asn1_r_s( &buffer, r, r_len, s, s_len ); + if (buffer.error) + { + buffer_free( &buffer ); + return STATUS_NO_MEMORY; + } + + gnutls_signature->data = buffer.buffer; + gnutls_signature->size = buffer.pos; + return STATUS_SUCCESS; +} + +static NTSTATUS prepare_gnutls_signature( struct key *key, UCHAR *signature, ULONG signature_len, + gnutls_datum_t *gnutls_signature ) +{ + switch (key->alg_id) + { + case ALG_ID_ECDSA_P256: + case ALG_ID_ECDSA_P384: + return prepare_gnutls_signature_ecc( key, signature, signature_len, gnutls_signature ); + + default: + FIXME( "Algorithm %d not yet supported\n", key->alg_id ); + return STATUS_NOT_IMPLEMENTED; + } +} + +static NTSTATUS key_asymmetric_verify( struct key *key, void *padding, UCHAR *hash, ULONG hash_len, + UCHAR *signature, ULONG signature_len, DWORD flags ) +{ + gnutls_digest_algorithm_t hash_algo; + gnutls_sign_algorithm_t sign_algo; + gnutls_datum_t gnutls_hash, gnutls_signature; + gnutls_pk_algorithm_t pk_algo; + gnutls_pubkey_t gnutls_key; + NTSTATUS status; + int ret; + + if (flags) + FIXME( "Flags %08x not supported\n", flags ); + + /* only the hash size must match, not the actual hash function */ + switch (hash_len) + { + case 32: hash_algo = GNUTLS_DIG_SHA256; break; + case 48: hash_algo = GNUTLS_DIG_SHA384; break; + + default: + FIXME( "Hash size %u not yet supported\n", hash_len ); + return STATUS_INVALID_SIGNATURE; + } + + switch (key->alg_id) + { + case ALG_ID_ECDSA_P256: + case ALG_ID_ECDSA_P384: + pk_algo = GNUTLS_PK_ECC; + break; + + default: + FIXME( "Algorithm %d not yet supported\n", key->alg_id ); + return STATUS_NOT_IMPLEMENTED; + } + + if ((sign_algo = pgnutls_pk_to_sign( pk_algo, hash_algo )) == GNUTLS_SIGN_UNKNOWN) + { + FIXME("Gnutls does not support algorithm %d with hash len %u\n", key->alg_id, hash_len); + return STATUS_NOT_IMPLEMENTED; + } + + if ((status = import_gnutls_pubkey( key, &gnutls_key ))) + return status; + + if ((status = prepare_gnutls_signature( key, signature, signature_len, &gnutls_signature ))) + { + pgnutls_pubkey_deinit( gnutls_key ); + return status; + } + + gnutls_hash.data = hash; + gnutls_hash.size = hash_len; + ret = pgnutls_pubkey_verify_hash2( gnutls_key, sign_algo, 0, &gnutls_hash, &gnutls_signature ); + + heap_free( gnutls_signature.data ); + pgnutls_pubkey_deinit( gnutls_key ); + return (ret < 0) ? STATUS_INVALID_SIGNATURE : STATUS_SUCCESS; +} + static NTSTATUS key_destroy( struct key *key ) { if(key_is_symmetric(key)) @@ -1382,6 +1694,13 @@ static NTSTATUS key_get_tag( struct key *key, UCHAR *tag, ULONG len ) return STATUS_NOT_IMPLEMENTED; } +static NTSTATUS key_asymmetric_verify( struct key *key, void *padding, UCHAR *hash, ULONG hash_len, + UCHAR *signature, ULONG signature_len, DWORD flags ) +{ + FIXME( "not implemented on Mac\n" ); + return STATUS_NOT_IMPLEMENTED; +} + static NTSTATUS key_destroy( struct key *key ) { if (key->u.s.ref_encrypt) CCCryptorRelease( key->u.s.ref_encrypt ); @@ -1447,6 +1766,13 @@ static NTSTATUS key_get_tag( struct key *key, UCHAR *tag, ULONG len ) return STATUS_NOT_IMPLEMENTED; } +static NTSTATUS key_asymmetric_verify( struct key *key, void *padding, UCHAR *hash, ULONG hash_len, + UCHAR *signature, ULONG signature_len, DWORD flags ) +{ + ERR( "support for keys not available at build time\n" ); + return STATUS_NOT_IMPLEMENTED; +} + static NTSTATUS key_destroy( struct key *key ) { ERR( "support for keys not available at build time\n" ); @@ -1670,13 +1996,14 @@ NTSTATUS WINAPI BCryptVerifySignature( BCRYPT_KEY_HANDLE handle, void *padding, { struct key *key = handle; - FIXME( "%p, %p, %p, %u, %p, %u, %08x: stub!\n", handle, padding, hash, + TRACE( "%p, %p, %p, %u, %p, %u, %08x\n", handle, padding, hash, hash_len, signature, signature_len, flags ); if (!key || key->hdr.magic != MAGIC_KEY) return STATUS_INVALID_HANDLE; + if (!hash || !hash_len || !signature || !signature_len) return STATUS_INVALID_PARAMETER; if (!key_is_asymmetric(key)) return STATUS_NOT_SUPPORTED; - return STATUS_NOT_IMPLEMENTED; + return key_asymmetric_verify( key, padding, hash, hash_len, signature, signature_len, flags ); } NTSTATUS WINAPI BCryptDestroyKey( BCRYPT_KEY_HANDLE handle ) diff --git a/dlls/bcrypt/tests/bcrypt.c b/dlls/bcrypt/tests/bcrypt.c index fa244d1..57d0488 100644 --- a/dlls/bcrypt/tests/bcrypt.c +++ b/dlls/bcrypt/tests/bcrypt.c @@ -1486,10 +1486,10 @@ static void test_ECDSA(void) ok(!status, "BCryptImportKeyPair failed: %08x\n", status); status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash) - 1, certSignature, sizeof(certSignature), 0); - todo_wine ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status); + ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status); status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash), certSignature, sizeof(certSignature), 0); - todo_wine ok(!status, "BCryptVerifySignature failed: %08x\n", status); + ok(!status, "BCryptVerifySignature failed: %08x\n", status); pBCryptDestroyKey(key); pBCryptCloseAlgorithmProvider(alg, 0); -- 1.9.1

1 0

[PATCH 2/6] bcrypt: Implement importing of ecdsa keys.
by Alistair Leslie-Hughes March 26, 2018

March 26, 2018

From: Michael Müller <michael(a)fds-team.de> Signed-off-by: Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> --- dlls/bcrypt/bcrypt.spec | 4 +- dlls/bcrypt/bcrypt_main.c | 160 +++++++++++++++++++++++++++++++++++++++++++-- dlls/bcrypt/tests/bcrypt.c | 4 +- include/bcrypt.h | 2 + 4 files changed, 161 insertions(+), 9 deletions(-) diff --git a/dlls/bcrypt/bcrypt.spec b/dlls/bcrypt/bcrypt.spec index 28c2394..78824d7 100644 --- a/dlls/bcrypt/bcrypt.spec +++ b/dlls/bcrypt/bcrypt.spec @@ -32,7 +32,7 @@ @ stdcall BCryptHash(ptr ptr long ptr long ptr long) @ stdcall BCryptHashData(ptr ptr long long) @ stdcall BCryptImportKey(ptr ptr wstr ptr ptr long ptr long long) -@ stub BCryptImportKeyPair +@ stdcall BCryptImportKeyPair(ptr ptr wstr ptr ptr long long) @ stdcall BCryptOpenAlgorithmProvider(ptr wstr wstr long) @ stub BCryptQueryContextConfiguration @ stub BCryptQueryContextFunctionConfiguration @@ -50,7 +50,7 @@ @ stub BCryptSignHash @ stub BCryptUnregisterConfigChangeNotify @ stdcall BCryptUnregisterProvider(wstr) -@ stub BCryptVerifySignature +@ stdcall BCryptVerifySignature(ptr ptr ptr long ptr long long) @ stub GetAsymmetricEncryptionInterface @ stub GetCipherInterface @ stub GetHashInterface diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c index 3d31e76..afa8f2a 100644 --- a/dlls/bcrypt/bcrypt_main.c +++ b/dlls/bcrypt/bcrypt_main.c @@ -220,7 +220,9 @@ enum alg_id ALG_ID_SHA1, ALG_ID_SHA256, ALG_ID_SHA384, - ALG_ID_SHA512 + ALG_ID_SHA512, + ALG_ID_ECDSA_P256, + ALG_ID_ECDSA_P384, }; enum mode_id @@ -248,7 +250,9 @@ static const struct { /* ALG_ID_SHA1 */ { 278, 20, 512, BCRYPT_SHA1_ALGORITHM, FALSE }, /* ALG_ID_SHA256 */ { 286, 32, 512, BCRYPT_SHA256_ALGORITHM, FALSE }, /* ALG_ID_SHA384 */ { 382, 48, 1024, BCRYPT_SHA384_ALGORITHM, FALSE }, - /* ALG_ID_SHA512 */ { 382, 64, 1024, BCRYPT_SHA512_ALGORITHM, FALSE } + /* ALG_ID_SHA512 */ { 382, 64, 1024, BCRYPT_SHA512_ALGORITHM, FALSE }, + /* ALG_ID_ECDSA_P256 */ { 0, 0, 0, BCRYPT_ECDSA_P256_ALGORITHM, FALSE }, + /* ALG_ID_ECDSA_P384 */ { 0, 0, 0, BCRYPT_ECDSA_P384_ALGORITHM, FALSE }, }; struct algorithm @@ -324,6 +328,8 @@ NTSTATUS WINAPI BCryptOpenAlgorithmProvider( BCRYPT_ALG_HANDLE *handle, LPCWSTR else if (!strcmpW( id, BCRYPT_SHA256_ALGORITHM )) alg_id = ALG_ID_SHA256; else if (!strcmpW( id, BCRYPT_SHA384_ALGORITHM )) alg_id = ALG_ID_SHA384; else if (!strcmpW( id, BCRYPT_SHA512_ALGORITHM )) alg_id = ALG_ID_SHA512; + else if (!strcmpW( id, BCRYPT_ECDSA_P256_ALGORITHM )) alg_id = ALG_ID_ECDSA_P256; + else if (!strcmpW( id, BCRYPT_ECDSA_P384_ALGORITHM )) alg_id = ALG_ID_ECDSA_P384; else { FIXME( "algorithm %s not supported\n", debugstr_w(id) ); @@ -866,6 +872,12 @@ struct key_symmetric ULONG secret_len; }; +struct key_asymmetric +{ + UCHAR *pubkey; + ULONG pubkey_len; +}; + struct key { struct object hdr; @@ -873,6 +885,7 @@ struct key union { struct key_symmetric s; + struct key_asymmetric a; } u; }; @@ -887,6 +900,12 @@ struct key_symmetric ULONG secret_len; }; +struct key_asymmetric +{ + UCHAR *pubkey; + ULONG pubkey_len; +}; + struct key { struct object hdr; @@ -894,6 +913,7 @@ struct key union { struct key_symmetric s; + struct key_asymmetric a; } u; }; #else @@ -986,11 +1006,42 @@ static NTSTATUS key_duplicate( struct key *key_orig, struct key *key_copy ) } else { - return STATUS_NOT_IMPLEMENTED; + if (!(buffer = heap_alloc( key_orig->u.a.pubkey_len ))) return STATUS_NO_MEMORY; + memcpy( buffer, key_orig->u.a.pubkey, key_orig->u.a.pubkey_len ); + + key_copy->u.a.pubkey = buffer; + key_copy->u.a.pubkey_len = key_orig->u.a.pubkey_len; } return STATUS_SUCCESS; } + +static NTSTATUS key_asymmetric_init( struct key *key, struct algorithm *alg, const UCHAR *pubkey, ULONG pubkey_len ) +{ + UCHAR *buffer; + + if (!libgnutls_handle) return STATUS_INTERNAL_ERROR; + + switch (alg->id) + { + case ALG_ID_ECDSA_P256: + case ALG_ID_ECDSA_P384: + break; + + default: + FIXME( "algorithm %u not supported\n", alg->id ); + return STATUS_NOT_SUPPORTED; + } + + if (!(buffer = heap_alloc( pubkey_len ))) return STATUS_NO_MEMORY; + memcpy( buffer, pubkey, pubkey_len ); + + key->alg_id = alg->id; + key->u.a.pubkey = buffer; + key->u.a.pubkey_len = pubkey_len; + + return STATUS_SUCCESS; +} #endif #if defined(HAVE_GNUTLS_CIPHER_INIT) && !defined(HAVE_COMMONCRYPTO_COMMONCRYPTOR_H) @@ -1170,8 +1221,13 @@ static NTSTATUS key_get_tag( struct key *key, UCHAR *tag, ULONG len ) static NTSTATUS key_destroy( struct key *key ) { - if (key->u.s.handle) pgnutls_cipher_deinit( key->u.s.handle ); - heap_free( key->u.s.secret ); + if(key_is_symmetric(key)) + { + if (key->u.s.handle) pgnutls_cipher_deinit( key->u.s.handle ); + heap_free( key->u.s.secret ); + } + else + heap_free( key->u.a.pubkey ); heap_free( key ); return STATUS_SUCCESS; } @@ -1341,6 +1397,12 @@ static NTSTATUS key_symmetric_init( struct key *key, struct algorithm *alg, cons return STATUS_NOT_IMPLEMENTED; } +static NTSTATUS key_asymmetric_init( struct key *key, struct algorithm *alg, const UCHAR *pubkey, ULONG pubkey_len ) +{ + FIXME( "not implemented on Mac\n" ); + return STATUS_NOT_IMPLEMENTED; +} + static NTSTATUS set_key_property( struct key *key, const WCHAR *prop, UCHAR *value, ULONG size, ULONG flags ) { ERR( "support for keys not available at build time\n" ); @@ -1403,6 +1465,12 @@ static inline BOOL key_is_symmetric( struct key *key ) return FALSE; } +static inline BOOL key_is_asymmetric( struct key *key ) +{ + ERR( "support for keys not available at build time\n" ); + return FALSE; +} + static NTSTATUS key_symmetric_get_mode( struct key *key, enum mode_id *mode ) { *mode = key->u.s.mode; @@ -1529,6 +1597,88 @@ NTSTATUS WINAPI BCryptDuplicateKey( BCRYPT_KEY_HANDLE handle, BCRYPT_KEY_HANDLE return STATUS_SUCCESS; } +NTSTATUS WINAPI BCryptImportKeyPair( BCRYPT_ALG_HANDLE algorithm, BCRYPT_KEY_HANDLE decrypt_key, const WCHAR *type, + BCRYPT_KEY_HANDLE *ret_key, UCHAR *input, ULONG input_len, ULONG flags ) +{ + struct algorithm *alg = algorithm; + NTSTATUS status; + struct key *key; + + TRACE( "%p, %p, %s, %p, %p, %u, %u\n", algorithm, decrypt_key, debugstr_w(type), ret_key, input, input_len, flags ); + + if (!alg || alg->hdr.magic != MAGIC_ALG) return STATUS_INVALID_HANDLE; + if (!ret_key || !type || !input) return STATUS_INVALID_PARAMETER; + + *ret_key = NULL; + + if (decrypt_key) + { + FIXME( "decrypting of key not yet supported\n" ); + return STATUS_NOT_IMPLEMENTED; + } + + if (!strcmpW( type, BCRYPT_ECCPUBLIC_BLOB )) + { + BCRYPT_ECCKEY_BLOB *ecc_blob = (BCRYPT_ECCKEY_BLOB *)input; + DWORD key_size, magic; + + if (input_len < sizeof(*ecc_blob)) + return STATUS_INVALID_PARAMETER; + + switch (alg->id) + { + case ALG_ID_ECDSA_P256: + key_size = 32; + magic = BCRYPT_ECDSA_PUBLIC_P256_MAGIC; + break; + case ALG_ID_ECDSA_P384: + key_size = 48; + magic = BCRYPT_ECDSA_PUBLIC_P384_MAGIC; + break; + + default: + FIXME("Algorithm %d does not yet support importing blob of type: %s\n", alg->id, debugstr_w(type)); + return STATUS_NOT_SUPPORTED; + } + + if (ecc_blob->dwMagic != magic) + return STATUS_NOT_SUPPORTED; + + if (ecc_blob->cbKey != key_size) + return STATUS_INVALID_PARAMETER; + + if (!(key = heap_alloc( sizeof(*key) ))) + return STATUS_NO_MEMORY; + + key->hdr.magic = MAGIC_KEY; + if ((status = key_asymmetric_init( key, alg, (BYTE *)(ecc_blob + 1), ecc_blob->cbKey * 2 ))) + { + heap_free( key ); + return status; + } + + *ret_key = key; + return STATUS_SUCCESS; + } + + FIXME( "unsupported key type %s\n", debugstr_w(type) ); + return STATUS_NOT_SUPPORTED; +} + +NTSTATUS WINAPI BCryptVerifySignature( BCRYPT_KEY_HANDLE handle, void *padding, UCHAR *hash, ULONG hash_len, + UCHAR *signature, ULONG signature_len, ULONG flags ) +{ + struct key *key = handle; + + FIXME( "%p, %p, %p, %u, %p, %u, %08x: stub!\n", handle, padding, hash, + hash_len, signature, signature_len, flags ); + + if (!key || key->hdr.magic != MAGIC_KEY) return STATUS_INVALID_HANDLE; + if (!key_is_asymmetric(key)) return STATUS_NOT_SUPPORTED; + + return STATUS_NOT_IMPLEMENTED; +} + NTSTATUS WINAPI BCryptDestroyKey( BCRYPT_KEY_HANDLE handle ) { struct key *key = handle; diff --git a/dlls/bcrypt/tests/bcrypt.c b/dlls/bcrypt/tests/bcrypt.c index 57d0488..fa244d1 100644 --- a/dlls/bcrypt/tests/bcrypt.c +++ b/dlls/bcrypt/tests/bcrypt.c @@ -1486,10 +1486,10 @@ static void test_ECDSA(void) ok(!status, "BCryptImportKeyPair failed: %08x\n", status); status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash) - 1, certSignature, sizeof(certSignature), 0); - ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status); + todo_wine ok(status == STATUS_INVALID_SIGNATURE, "Expected STATUS_INVALID_SIGNATURE, got %08x\n", status); status = pBCryptVerifySignature(key, NULL, certHash, sizeof(certHash), certSignature, sizeof(certSignature), 0); - ok(!status, "BCryptVerifySignature failed: %08x\n", status); + todo_wine ok(!status, "BCryptVerifySignature failed: %08x\n", status); pBCryptDestroyKey(key); pBCryptCloseAlgorithmProvider(alg, 0); diff --git a/include/bcrypt.h b/include/bcrypt.h index 717d77c..f28b0d3 100644 --- a/include/bcrypt.h +++ b/include/bcrypt.h @@ -211,8 +211,10 @@ NTSTATUS WINAPI BCryptGetFipsAlgorithmMode(BOOLEAN *); NTSTATUS WINAPI BCryptGetProperty(BCRYPT_HANDLE, LPCWSTR, PUCHAR, ULONG, ULONG *, ULONG); NTSTATUS WINAPI BCryptHash(BCRYPT_ALG_HANDLE, PUCHAR, ULONG, PUCHAR, ULONG, PUCHAR, ULONG); NTSTATUS WINAPI BCryptHashData(BCRYPT_HASH_HANDLE, PUCHAR, ULONG, ULONG); +NTSTATUS WINAPI BCryptImportKeyPair(BCRYPT_ALG_HANDLE, BCRYPT_KEY_HANDLE, LPCWSTR, BCRYPT_KEY_HANDLE *, UCHAR *, ULONG, ULONG); NTSTATUS WINAPI BCryptOpenAlgorithmProvider(BCRYPT_ALG_HANDLE *, LPCWSTR, LPCWSTR, ULONG); NTSTATUS WINAPI BCryptSetProperty(BCRYPT_HANDLE, LPCWSTR, PUCHAR, ULONG, ULONG); NTSTATUS WINAPI BCryptDuplicateHash(BCRYPT_HASH_HANDLE, BCRYPT_HASH_HANDLE *, UCHAR *, ULONG, ULONG); +NTSTATUS WINAPI BCryptVerifySignature(BCRYPT_KEY_HANDLE, void *, UCHAR *, ULONG, UCHAR *, ULONG, ULONG); #endif /* __WINE_BCRYPT_H */ -- 1.9.1

1 0

[PATCH 1/6] bcrypt: Preparation for asymmetric keys.
by Alistair Leslie-Hughes March 26, 2018

March 26, 2018

From: Michael Müller <michael(a)fds-team.de> Signed-off-by: Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> --- dlls/bcrypt/bcrypt_main.c | 346 +++++++++++++++++++++++++++++----------------- 1 file changed, 217 insertions(+), 129 deletions(-) diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c index 69d5129..3d31e76 100644 --- a/dlls/bcrypt/bcrypt_main.c +++ b/dlls/bcrypt/bcrypt_main.c @@ -238,16 +238,17 @@ static const struct { ULONG hash_length; ULONG block_bits; const WCHAR *alg_name; + BOOL symmetric; } alg_props[] = { - /* ALG_ID_AES */ { 654, 0, 0, BCRYPT_AES_ALGORITHM }, - /* ALG_ID_MD2 */ { 270, 16, 128, BCRYPT_MD2_ALGORITHM }, - /* ALG_ID_MD4 */ { 270, 16, 512, BCRYPT_MD4_ALGORITHM }, - /* ALG_ID_MD5 */ { 274, 16, 512, BCRYPT_MD5_ALGORITHM }, - /* ALG_ID_RNG */ { 0, 0, 0, BCRYPT_RNG_ALGORITHM }, - /* ALG_ID_SHA1 */ { 278, 20, 512, BCRYPT_SHA1_ALGORITHM }, - /* ALG_ID_SHA256 */ { 286, 32, 512, BCRYPT_SHA256_ALGORITHM }, - /* ALG_ID_SHA384 */ { 382, 48, 1024, BCRYPT_SHA384_ALGORITHM }, - /* ALG_ID_SHA512 */ { 382, 64, 1024, BCRYPT_SHA512_ALGORITHM } + /* ALG_ID_AES */ { 654, 0, 0, BCRYPT_AES_ALGORITHM, TRUE }, + /* ALG_ID_MD2 */ { 270, 16, 128, BCRYPT_MD2_ALGORITHM, FALSE }, + /* ALG_ID_MD4 */ { 270, 16, 512, BCRYPT_MD4_ALGORITHM, FALSE }, + /* ALG_ID_MD5 */ { 274, 16, 512, BCRYPT_MD5_ALGORITHM, FALSE }, + /* ALG_ID_RNG */ { 0, 0, 0, BCRYPT_RNG_ALGORITHM, FALSE }, + /* ALG_ID_SHA1 */ { 278, 20, 512, BCRYPT_SHA1_ALGORITHM, FALSE }, + /* ALG_ID_SHA256 */ { 286, 32, 512, BCRYPT_SHA256_ALGORITHM, FALSE }, + /* ALG_ID_SHA384 */ { 382, 48, 1024, BCRYPT_SHA384_ALGORITHM, FALSE }, + /* ALG_ID_SHA512 */ { 382, 64, 1024, BCRYPT_SHA512_ALGORITHM, FALSE } }; struct algorithm @@ -856,21 +857,28 @@ NTSTATUS WINAPI BCryptHash( BCRYPT_ALG_HANDLE algorithm, UCHAR *secret, ULONG se } #if defined(HAVE_GNUTLS_CIPHER_INIT) && !defined(HAVE_COMMONCRYPTO_COMMONCRYPTOR_H) -struct key +struct key_symmetric { - struct object hdr; - enum alg_id alg_id; enum mode_id mode; ULONG block_size; gnutls_cipher_hd_t handle; UCHAR *secret; ULONG secret_len; }; -#elif defined(HAVE_COMMONCRYPTO_COMMONCRYPTOR_H) && MAC_OS_X_VERSION_MAX_ALLOWED >= 1080 + struct key { - struct object hdr; - enum alg_id alg_id; + struct object hdr; + enum alg_id alg_id; + union + { + struct key_symmetric s; + } u; +}; + +#elif defined(HAVE_COMMONCRYPTO_COMMONCRYPTOR_H) && MAC_OS_X_VERSION_MAX_ALLOWED >= 1080 +struct key_symmetric +{ enum mode_id mode; ULONG block_size; CCCryptorRef ref_encrypt; @@ -878,16 +886,56 @@ struct key UCHAR *secret; ULONG secret_len; }; -#else + struct key { - struct object hdr; + struct object hdr; + enum alg_id alg_id; + union + { + struct key_symmetric s; + } u; +}; +#else +struct key_symmetric +{ enum mode_id mode; ULONG block_size; }; + +struct key +{ + struct object hdr; + union + { + struct key_symmetric s; + } u; +}; #endif #if defined(HAVE_GNUTLS_CIPHER_INIT) || defined(HAVE_COMMONCRYPTO_COMMONCRYPTOR_H) && MAC_OS_X_VERSION_MAX_ALLOWED >= 1080 +static inline BOOL key_is_symmetric( struct key *key ) +{ + return alg_props[key->alg_id].symmetric; +} + +static inline BOOL key_is_asymmetric( struct key *key ) +{ + return !alg_props[key->alg_id].symmetric; +} + +static NTSTATUS key_symmetric_get_mode( struct key *key, enum mode_id *mode ) +{ + *mode = key->u.s.mode; + return STATUS_SUCCESS; +} + +static NTSTATUS key_symmetric_get_blocksize( struct key *key, ULONG *size ) +{ + *size = key->u.s.block_size; + return STATUS_SUCCESS; +} + static ULONG get_block_size( struct algorithm *alg ) { ULONG ret = 0, size = sizeof(ret); @@ -900,15 +948,15 @@ static NTSTATUS key_export( struct key *key, const WCHAR *type, UCHAR *output, U if (!strcmpW( type, BCRYPT_KEY_DATA_BLOB )) { BCRYPT_KEY_DATA_BLOB_HEADER *header = (BCRYPT_KEY_DATA_BLOB_HEADER *)output; - ULONG req_size = sizeof(BCRYPT_KEY_DATA_BLOB_HEADER) + key->secret_len; + ULONG req_size = sizeof(BCRYPT_KEY_DATA_BLOB_HEADER) + key->u.s.secret_len; *size = req_size; if (output_len < req_size) return STATUS_BUFFER_TOO_SMALL; header->dwMagic = BCRYPT_KEY_DATA_BLOB_MAGIC; header->dwVersion = BCRYPT_KEY_DATA_BLOB_VERSION1; - header->cbKeyData = key->secret_len; - memcpy( &header[1], key->secret, key->secret_len ); + header->cbKeyData = key->u.s.secret_len; + memcpy( &header[1], key->u.s.secret, key->u.s.secret_len ); return STATUS_SUCCESS; } @@ -920,23 +968,33 @@ static NTSTATUS key_duplicate( struct key *key_orig, struct key *key_copy ) { UCHAR *buffer; - if (!(buffer = heap_alloc( key_orig->secret_len ))) return STATUS_NO_MEMORY; - memcpy( buffer, key_orig->secret, key_orig->secret_len ); + key_copy->hdr = key_orig->hdr; + key_copy->alg_id = key_orig->alg_id; - memset( key_copy, 0, sizeof(*key_copy) ); - key_copy->hdr = key_orig->hdr; - key_copy->alg_id = key_orig->alg_id; - key_copy->mode = key_orig->mode; - key_copy->block_size = key_orig->block_size; - key_copy->secret = buffer; - key_copy->secret_len = key_orig->secret_len; + if (key_is_symmetric(key_orig)) + { + if (!(buffer = heap_alloc( key_orig->u.s.secret_len ))) return STATUS_NO_MEMORY; + memcpy( buffer, key_orig->u.s.secret, key_orig->u.s.secret_len ); + + memset( key_copy, 0, sizeof(*key_copy) ); + key_copy->hdr = key_orig->hdr; + key_copy->alg_id = key_orig->alg_id; + key_copy->u.s.mode = key_orig->u.s.mode; + key_copy->u.s.block_size = key_orig->u.s.block_size; + key_copy->u.s.secret = buffer; + key_copy->u.s.secret_len = key_orig->u.s.secret_len; + } + else + { + return STATUS_NOT_IMPLEMENTED; + } return STATUS_SUCCESS; } #endif #if defined(HAVE_GNUTLS_CIPHER_INIT) && !defined(HAVE_COMMONCRYPTO_COMMONCRYPTOR_H) -static NTSTATUS key_init( struct key *key, struct algorithm *alg, const UCHAR *secret, ULONG secret_len ) +static NTSTATUS key_symmetric_init( struct key *key, struct algorithm *alg, const UCHAR *secret, ULONG secret_len ) { UCHAR *buffer; @@ -952,15 +1010,15 @@ static NTSTATUS key_init( struct key *key, struct algorithm *alg, const UCHAR *s return STATUS_NOT_SUPPORTED; } - if (!(key->block_size = get_block_size( alg ))) return STATUS_INVALID_PARAMETER; + if (!(key->u.s.block_size = get_block_size( alg ))) return STATUS_INVALID_PARAMETER; if (!(buffer = heap_alloc( secret_len ))) return STATUS_NO_MEMORY; memcpy( buffer, secret, secret_len ); - key->alg_id = alg->id; - key->mode = alg->mode; - key->handle = 0; /* initialized on first use */ - key->secret = buffer; - key->secret_len = secret_len; + key->alg_id = alg->id; + key->u.s.mode = alg->mode; + key->u.s.handle = 0; /* initialized on first use */ + key->u.s.secret = buffer; + key->u.s.secret_len = secret_len; return STATUS_SUCCESS; } @@ -971,17 +1029,17 @@ static NTSTATUS set_key_property( struct key *key, const WCHAR *prop, UCHAR *val { if (!strncmpW( (WCHAR *)value, BCRYPT_CHAIN_MODE_ECB, size )) { - key->mode = MODE_ID_ECB; + key->u.s.mode = MODE_ID_ECB; return STATUS_SUCCESS; } else if (!strncmpW( (WCHAR *)value, BCRYPT_CHAIN_MODE_CBC, size )) { - key->mode = MODE_ID_CBC; + key->u.s.mode = MODE_ID_CBC; return STATUS_SUCCESS; } else if (!strncmpW( (WCHAR *)value, BCRYPT_CHAIN_MODE_GCM, size )) { - key->mode = MODE_ID_GCM; + key->u.s.mode = MODE_ID_GCM; return STATUS_SUCCESS; } else @@ -1001,22 +1059,22 @@ static gnutls_cipher_algorithm_t get_gnutls_cipher( const struct key *key ) { case ALG_ID_AES: WARN( "handle block size\n" ); - switch (key->mode) + switch (key->u.s.mode) { case MODE_ID_GCM: - if (key->secret_len == 16) return GNUTLS_CIPHER_AES_128_GCM; - if (key->secret_len == 32) return GNUTLS_CIPHER_AES_256_GCM; + if (key->u.s.secret_len == 16) return GNUTLS_CIPHER_AES_128_GCM; + if (key->u.s.secret_len == 32) return GNUTLS_CIPHER_AES_256_GCM; break; case MODE_ID_ECB: /* can be emulated with CBC + empty IV */ case MODE_ID_CBC: - if (key->secret_len == 16) return GNUTLS_CIPHER_AES_128_CBC; - if (key->secret_len == 24) return GNUTLS_CIPHER_AES_192_CBC; - if (key->secret_len == 32) return GNUTLS_CIPHER_AES_256_CBC; + if (key->u.s.secret_len == 16) return GNUTLS_CIPHER_AES_128_CBC; + if (key->u.s.secret_len == 24) return GNUTLS_CIPHER_AES_192_CBC; + if (key->u.s.secret_len == 32) return GNUTLS_CIPHER_AES_256_CBC; break; default: break; } - FIXME( "aes mode %u with key length %u not supported\n", key->mode, key->secret_len ); + FIXME( "aes mode %u with key length %u not supported\n", key->u.s.mode, key->u.s.secret_len ); return GNUTLS_CIPHER_UNKNOWN; default: FIXME( "algorithm %u not supported\n", key->alg_id ); @@ -1024,30 +1082,30 @@ static gnutls_cipher_algorithm_t get_gnutls_cipher( const struct key *key ) } } -static NTSTATUS key_set_params( struct key *key, UCHAR *iv, ULONG iv_len ) +static NTSTATUS key_symmetric_set_params( struct key *key, UCHAR *iv, ULONG iv_len ) { gnutls_cipher_algorithm_t cipher; gnutls_datum_t secret, vector; int ret; - if (key->handle) + if (key->u.s.handle) { - pgnutls_cipher_deinit( key->handle ); - key->handle = NULL; + pgnutls_cipher_deinit( key->u.s.handle ); + key->u.s.handle = NULL; } if ((cipher = get_gnutls_cipher( key )) == GNUTLS_CIPHER_UNKNOWN) return STATUS_NOT_SUPPORTED; - secret.data = key->secret; - secret.size = key->secret_len; + secret.data = key->u.s.secret; + secret.size = key->u.s.secret_len; if (iv) { vector.data = iv; vector.size = iv_len; } - if ((ret = pgnutls_cipher_init( &key->handle, cipher, &secret, iv ? &vector : NULL ))) + if ((ret = pgnutls_cipher_init( &key->u.s.handle, cipher, &secret, &vector ))) { pgnutls_perror( ret ); return STATUS_INTERNAL_ERROR; @@ -1056,11 +1114,11 @@ static NTSTATUS key_set_params( struct key *key, UCHAR *iv, ULONG iv_len ) return STATUS_SUCCESS; } -static NTSTATUS key_set_auth_data( struct key *key, UCHAR *auth_data, ULONG len ) +static NTSTATUS key_symmetric_set_auth_data( struct key *key, UCHAR *auth_data, ULONG len ) { int ret; - if ((ret = pgnutls_cipher_add_auth( key->handle, auth_data, len ))) + if ((ret = pgnutls_cipher_add_auth( key->u.s.handle, auth_data, len ))) { pgnutls_perror( ret ); return STATUS_INTERNAL_ERROR; @@ -1069,12 +1127,12 @@ static NTSTATUS key_set_auth_data( struct key *key, UCHAR *auth_data, ULONG len return STATUS_SUCCESS; } -static NTSTATUS key_encrypt( struct key *key, const UCHAR *input, ULONG input_len, UCHAR *output, +static NTSTATUS key_symmetric_encrypt( struct key *key, const UCHAR *input, ULONG input_len, UCHAR *output, ULONG output_len ) { int ret; - if ((ret = pgnutls_cipher_encrypt2( key->handle, input, input_len, output, output_len ))) + if ((ret = pgnutls_cipher_encrypt2( key->u.s.handle, input, input_len, output, output_len ))) { pgnutls_perror( ret ); return STATUS_INTERNAL_ERROR; @@ -1088,7 +1146,7 @@ static NTSTATUS key_decrypt( struct key *key, const UCHAR *input, ULONG input_le { int ret; - if ((ret = pgnutls_cipher_decrypt2( key->handle, input, input_len, output, output_len ))) + if ((ret = pgnutls_cipher_decrypt2( key->u.s.handle, input, input_len, output, output_len ))) { pgnutls_perror( ret ); return STATUS_INTERNAL_ERROR; @@ -1101,7 +1159,7 @@ static NTSTATUS key_get_tag( struct key *key, UCHAR *tag, ULONG len ) { int ret; - if ((ret = pgnutls_cipher_tag( key->handle, tag, len ))) + if ((ret = pgnutls_cipher_tag( key->u.s.handle, tag, len ))) { pgnutls_perror( ret ); return STATUS_INTERNAL_ERROR; @@ -1112,13 +1170,13 @@ static NTSTATUS key_get_tag( struct key *key, UCHAR *tag, ULONG len ) static NTSTATUS key_destroy( struct key *key ) { - if (key->handle) pgnutls_cipher_deinit( key->handle ); - heap_free( key->secret ); + if (key->u.s.handle) pgnutls_cipher_deinit( key->u.s.handle ); + heap_free( key->u.s.secret ); heap_free( key ); return STATUS_SUCCESS; } #elif defined(HAVE_COMMONCRYPTO_COMMONCRYPTOR_H) && MAC_OS_X_VERSION_MAX_ALLOWED >= 1080 -static NTSTATUS key_init( struct key *key, struct algorithm *alg, const UCHAR *secret, ULONG secret_len ) +static NTSTATUS key_symmetric_init( struct key *key, struct algorithm *alg, const UCHAR *secret, ULONG secret_len ) { UCHAR *buffer; @@ -1141,16 +1199,16 @@ static NTSTATUS key_init( struct key *key, struct algorithm *alg, const UCHAR *s return STATUS_NOT_SUPPORTED; } - if (!(key->block_size = get_block_size( alg ))) return STATUS_INVALID_PARAMETER; + if (!(key->u.s.block_size = get_block_size( alg ))) return STATUS_INVALID_PARAMETER; if (!(buffer = heap_alloc( secret_len ))) return STATUS_NO_MEMORY; memcpy( buffer, secret, secret_len ); - key->alg_id = alg->id; - key->mode = alg->mode; - key->ref_encrypt = NULL; /* initialized on first use */ - key->ref_decrypt = NULL; - key->secret = buffer; - key->secret_len = secret_len; + key->alg_id = alg->id; + key->u.s.mode = alg->mode; + key->u.s.ref_encrypt = NULL; /* initialized on first use */ + key->u.s.ref_decrypt = NULL; + key->u.s.secret = buffer; + key->u.s.secret_len = secret_len; return STATUS_SUCCESS; } @@ -1192,54 +1250,54 @@ static CCMode get_cryptor_mode( struct key *key ) } } -static NTSTATUS key_set_params( struct key *key, UCHAR *iv, ULONG iv_len ) +static NTSTATUS key_symmetric_set_params( struct key *key, UCHAR *iv, ULONG iv_len ) { CCCryptorStatus status; CCMode mode; if (!(mode = get_cryptor_mode( key ))) return STATUS_NOT_SUPPORTED; - if (key->ref_encrypt) + if (key->u.s.ref_encrypt) { - CCCryptorRelease( key->ref_encrypt ); - key->ref_encrypt = NULL; + CCCryptorRelease( key->u.s.ref_encrypt ); + key->u.s.ref_encrypt = NULL; } - if (key->ref_decrypt) + if (key->u.s.ref_decrypt) { - CCCryptorRelease( key->ref_decrypt ); - key->ref_decrypt = NULL; + CCCryptorRelease( key->u.s.ref_decrypt ); + key->u.s.ref_decrypt = NULL; } if ((status = CCCryptorCreateWithMode( kCCEncrypt, mode, kCCAlgorithmAES128, ccNoPadding, iv, key->secret, - key->secret_len, NULL, 0, 0, 0, &key->ref_encrypt )) != kCCSuccess) + key->u.s.secret, key->u.s.secret_len, NULL, 0, 0, 0, &key->u.s.ref_encrypt )) != kCCSuccess) { WARN( "CCCryptorCreateWithMode failed %d\n", status ); return STATUS_INTERNAL_ERROR; } if ((status = CCCryptorCreateWithMode( kCCDecrypt, mode, kCCAlgorithmAES128, ccNoPadding, iv, key->secret, - key->secret_len, NULL, 0, 0, 0, &key->ref_decrypt )) != kCCSuccess) + key->u.s.secret, key->u.s.secret_len, NULL, 0, 0, 0, &key->u.s.ref_decrypt )) != kCCSuccess) { WARN( "CCCryptorCreateWithMode failed %d\n", status ); - CCCryptorRelease( key->ref_encrypt ); - key->ref_encrypt = NULL; + CCCryptorRelease( key->u.s.ref_encrypt ); + key->u.s.ref_encrypt = NULL; return STATUS_INTERNAL_ERROR; } return STATUS_SUCCESS; } -static NTSTATUS key_set_auth_data( struct key *key, UCHAR *auth_data, ULONG len ) +static NTSTATUS key_symmetric_set_auth_data( struct key *key, UCHAR *auth_data, ULONG len ) { FIXME( "not implemented on Mac\n" ); return STATUS_NOT_IMPLEMENTED; } -static NTSTATUS key_encrypt( struct key *key, const UCHAR *input, ULONG input_len, UCHAR *output, +static NTSTATUS key_symmetric_encrypt( struct key *key, const UCHAR *input, ULONG input_len, UCHAR *output, ULONG output_len ) { CCCryptorStatus status; - if ((status = CCCryptorUpdate( key->ref_encrypt, input, input_len, output, output_len, NULL )) != kCCSuccess) + if ((status = CCCryptorUpdate( key->u.s.ref_encrypt, input, input_len, output, output_len, NULL )) != kCCSuccess) { WARN( "CCCryptorUpdate failed %d\n", status ); return STATUS_INTERNAL_ERROR; @@ -1253,7 +1311,7 @@ static NTSTATUS key_decrypt( struct key *key, const UCHAR *input, ULONG input_le { CCCryptorStatus status; - if ((status = CCCryptorUpdate( key->ref_decrypt, input, input_len, output, output_len, NULL )) != kCCSuccess) + if ((status = CCCryptorUpdate( key->u.s.ref_decrypt, input, input_len, output, output_len, NULL )) != kCCSuccess) { WARN( "CCCryptorUpdate failed %d\n", status ); return STATUS_INTERNAL_ERROR; @@ -1270,14 +1328,14 @@ static NTSTATUS key_get_tag( struct key *key, UCHAR *tag, ULONG len ) static NTSTATUS key_destroy( struct key *key ) { - if (key->ref_encrypt) CCCryptorRelease( key->ref_encrypt ); - if (key->ref_decrypt) CCCryptorRelease( key->ref_decrypt ); - heap_free( key->secret ); + if (key->u.s.ref_encrypt) CCCryptorRelease( key->u.s.ref_encrypt ); + if (key->u.s.ref_decrypt) CCCryptorRelease( key->u.s.ref_decrypt ); + heap_free( key->u.s.secret ); heap_free( key ); return STATUS_SUCCESS; } #else -static NTSTATUS key_init( struct key *key, struct algorithm *alg, const UCHAR *secret, ULONG secret_len ) +static NTSTATUS key_symmetric_init( struct key *key, struct algorithm *alg, const UCHAR *secret, ULONG secret_len ) { ERR( "support for keys not available at build time\n" ); return STATUS_NOT_IMPLEMENTED; @@ -1295,19 +1353,19 @@ static NTSTATUS key_duplicate( struct key *key_orig, struct key *key_copy ) return STATUS_NOT_IMPLEMENTED; } -static NTSTATUS key_set_params( struct key *key, UCHAR *iv, ULONG iv_len ) +static NTSTATUS key_symmetric_set_params( struct key *key, UCHAR *iv, ULONG iv_len ) { ERR( "support for keys not available at build time\n" ); return STATUS_NOT_IMPLEMENTED; } -static NTSTATUS key_set_auth_data( struct key *key, UCHAR *auth_data, ULONG len ) +static NTSTATUS key_symmetric_set_auth_data( struct key *key, UCHAR *auth_data, ULONG len ) { ERR( "support for keys not available at build time\n" ); return STATUS_NOT_IMPLEMENTED; } -static NTSTATUS key_encrypt( struct key *key, const UCHAR *input, ULONG input_len, UCHAR *output, +static NTSTATUS key_symmetric_encrypt( struct key *key, const UCHAR *input, ULONG input_len, UCHAR *output, ULONG output_len ) { ERR( "support for keys not available at build time\n" ); @@ -1338,6 +1396,24 @@ static NTSTATUS key_export( struct key *key, const WCHAR *type, UCHAR *output, U ERR( "support for keys not available at build time\n" ); return STATUS_NOT_IMPLEMENTED; } + +static inline BOOL key_is_symmetric( struct key *key ) +{ + ERR( "support for keys not available at build time\n" ); + return FALSE; +} + +static NTSTATUS key_symmetric_get_mode( struct key *key, enum mode_id *mode ) +{ + *mode = key->u.s.mode; + return STATUS_SUCCESS; +} + +static NTSTATUS key_symmetric_get_blocksize( struct key *key, ULONG *size ) +{ + ERR( "support for keys not available at build time\n" ); + return STATUS_NOT_IMPLEMENTED; +} #endif NTSTATUS WINAPI BCryptGenerateSymmetricKey( BCRYPT_ALG_HANDLE algorithm, BCRYPT_KEY_HANDLE *handle, @@ -1356,7 +1432,7 @@ NTSTATUS WINAPI BCryptGenerateSymmetricKey( BCRYPT_ALG_HANDLE algorithm, BCRYPT_ if (!(key = heap_alloc( sizeof(*key) ))) return STATUS_NO_MEMORY; key->hdr.magic = MAGIC_KEY; - if ((status = key_init( key, alg, secret, secret_len ))) + if ((status = key_symmetric_init( key, alg, secret, secret_len ))) { heap_free( key ); return status; @@ -1470,19 +1546,30 @@ NTSTATUS WINAPI BCryptEncrypt( BCRYPT_KEY_HANDLE handle, UCHAR *input, ULONG inp struct key *key = handle; ULONG bytes_left = input_len; UCHAR *buf, *src, *dst; + enum mode_id mode; + ULONG block_size; NTSTATUS status; TRACE( "%p, %p, %u, %p, %p, %u, %p, %u, %p, %08x\n", handle, input, input_len, padding, iv, iv_len, output, output_len, ret_len, flags ); if (!key || key->hdr.magic != MAGIC_KEY) return STATUS_INVALID_HANDLE; + + if (!key_is_symmetric(key)) + { + FIXME( "encryption with asymmetric keys not yet supported\n"); + return STATUS_NOT_IMPLEMENTED; + } + if (flags & ~BCRYPT_BLOCK_PADDING) { FIXME( "flags %08x not implemented\n", flags ); return STATUS_NOT_IMPLEMENTED; } - if (key->mode == MODE_ID_GCM) + if ((status = key_symmetric_get_mode( key, &mode ))) return status; + + if (mode == MODE_ID_GCM) { BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO *auth_info = padding; @@ -1493,7 +1580,7 @@ NTSTATUS WINAPI BCryptEncrypt( BCRYPT_KEY_HANDLE handle, UCHAR *input, ULONG inp if (auth_info->dwFlags & BCRYPT_AUTH_MODE_CHAIN_CALLS_FLAG) FIXME( "call chaining not implemented\n" ); - if ((status = key_set_params( key, auth_info->pbNonce, auth_info->cbNonce ))) + if ((status = key_symmetric_set_params( key, auth_info->pbNonce, auth_info->cbNonce ))) return status; *ret_len = input_len; @@ -1501,44 +1588,45 @@ NTSTATUS WINAPI BCryptEncrypt( BCRYPT_KEY_HANDLE handle, UCHAR *input, ULONG inp if (input && !output) return STATUS_SUCCESS; if (output_len < *ret_len) return STATUS_BUFFER_TOO_SMALL; - if (auth_info->pbAuthData && (status = key_set_auth_data( key, auth_info->pbAuthData, auth_info->cbAuthData ))) + if (auth_info->pbAuthData && (status = key_symmetric_set_auth_data( key, auth_info->pbAuthData, auth_info->cbAuthData ))) return status; - if ((status = key_encrypt( key, input, input_len, output, output_len ))) + if ((status = key_symmetric_encrypt( key, input, input_len, output, output_len ))) return status; return key_get_tag( key, auth_info->pbTag, auth_info->cbTag ); } - if ((status = key_set_params( key, iv, iv_len ))) return status; + if ((status = key_symmetric_set_params( key, iv, iv_len ))) return status; + if ((status = key_symmetric_get_blocksize( key, &block_size ))) return status; *ret_len = input_len; if (flags & BCRYPT_BLOCK_PADDING) - *ret_len = (input_len + key->block_size) & ~(key->block_size - 1); - else if (input_len & (key->block_size - 1)) + *ret_len = (input_len + block_size) & ~(block_size - 1); + else if (input_len & (block_size - 1)) return STATUS_INVALID_BUFFER_SIZE; if (!output) return STATUS_SUCCESS; if (output_len < *ret_len) return STATUS_BUFFER_TOO_SMALL; - if (key->mode == MODE_ID_ECB && iv) return STATUS_INVALID_PARAMETER; + if (mode == MODE_ID_ECB && iv) return STATUS_INVALID_PARAMETER; src = input; dst = output; - while (bytes_left >= key->block_size) + while (bytes_left >= block_size) { - if ((status = key_encrypt( key, src, key->block_size, dst, key->block_size ))) return status; - if (key->mode == MODE_ID_ECB && (status = key_set_params( key, NULL, 0 ))) return status; - bytes_left -= key->block_size; - src += key->block_size; - dst += key->block_size; + if ((status = key_symmetric_encrypt( key, src, block_size, dst, block_size ))) return status; + if (mode == MODE_ID_ECB && (status = key_symmetric_set_params( key, iv, iv_len ))) return status; + bytes_left -= block_size; + src += block_size; + dst += block_size; } if (flags & BCRYPT_BLOCK_PADDING) { - if (!(buf = heap_alloc( key->block_size ))) return STATUS_NO_MEMORY; + if (!(buf = heap_alloc( block_size ))) return STATUS_NO_MEMORY; memcpy( buf, src, bytes_left ); - memset( buf + bytes_left, key->block_size - bytes_left, key->block_size - bytes_left ); - status = key_encrypt( key, buf, key->block_size, dst, key->block_size ); + memset( buf + bytes_left, block_size - bytes_left, block_size - bytes_left ); + status = key_symmetric_encrypt( key, buf, block_size, dst, block_size ); heap_free( buf ); } @@ -1564,7 +1652,7 @@ NTSTATUS WINAPI BCryptDecrypt( BCRYPT_KEY_HANDLE handle, UCHAR *input, ULONG inp return STATUS_NOT_IMPLEMENTED; } - if (key->mode == MODE_ID_GCM) + if (key->u.s.mode == MODE_ID_GCM) { BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO *auth_info = padding; UCHAR tag[16]; @@ -1574,7 +1662,7 @@ NTSTATUS WINAPI BCryptDecrypt( BCRYPT_KEY_HANDLE handle, UCHAR *input, ULONG inp if (!auth_info->pbTag) return STATUS_INVALID_PARAMETER; if (auth_info->cbTag < 12 || auth_info->cbTag > 16) return STATUS_INVALID_PARAMETER; - if ((status = key_set_params( key, auth_info->pbNonce, auth_info->cbNonce ))) + if ((status = key_symmetric_set_params( key, auth_info->pbNonce, auth_info->cbNonce ))) return status; *ret_len = input_len; @@ -1582,7 +1670,7 @@ NTSTATUS WINAPI BCryptDecrypt( BCRYPT_KEY_HANDLE handle, UCHAR *input, ULONG inp if (!output) return STATUS_SUCCESS; if (output_len < *ret_len) return STATUS_BUFFER_TOO_SMALL; - if (auth_info->pbAuthData && (status = key_set_auth_data( key, auth_info->pbAuthData, auth_info->cbAuthData ))) + if (auth_info->pbAuthData && (status = key_symmetric_set_auth_data( key, auth_info->pbAuthData, auth_info->cbAuthData ))) return status; if ((status = key_decrypt( key, input, input_len, output, output_len ))) return status; @@ -1595,42 +1683,42 @@ NTSTATUS WINAPI BCryptDecrypt( BCRYPT_KEY_HANDLE handle, UCHAR *input, ULONG inp return STATUS_SUCCESS; } - if ((status = key_set_params( key, iv, iv_len ))) return status; + if ((status = key_symmetric_set_params( key, iv, iv_len ))) return status; *ret_len = input_len; - if (input_len & (key->block_size - 1)) return STATUS_INVALID_BUFFER_SIZE; + if (input_len & (key->u.s.block_size - 1)) return STATUS_INVALID_BUFFER_SIZE; if (!output) return STATUS_SUCCESS; if (flags & BCRYPT_BLOCK_PADDING) { - if (output_len + key->block_size < *ret_len) return STATUS_BUFFER_TOO_SMALL; - if (input_len < key->block_size) return STATUS_BUFFER_TOO_SMALL; - bytes_left -= key->block_size; + if (output_len + key->u.s.block_size < *ret_len) return STATUS_BUFFER_TOO_SMALL; + if (input_len < key->u.s.block_size) return STATUS_BUFFER_TOO_SMALL; + bytes_left -= key->u.s.block_size; } else if (output_len < *ret_len) return STATUS_BUFFER_TOO_SMALL; - if (key->mode == MODE_ID_ECB && iv) return STATUS_INVALID_PARAMETER; + if (key->u.s.mode == MODE_ID_ECB && iv) return STATUS_INVALID_PARAMETER; src = input; dst = output; - while (bytes_left >= key->block_size) + while (bytes_left >= key->u.s.block_size) { - if ((status = key_decrypt( key, src, key->block_size, dst, key->block_size ))) return status; - if (key->mode == MODE_ID_ECB && (status = key_set_params( key, NULL, 0 ))) return status; - bytes_left -= key->block_size; - src += key->block_size; - dst += key->block_size; + if ((status = key_decrypt( key, src, key->u.s.block_size, dst, key->u.s.block_size ))) return status; + if (key->u.s.mode == MODE_ID_ECB && (status = key_symmetric_set_params( key, iv, iv_len ))) return status; + bytes_left -= key->u.s.block_size; + src += key->u.s.block_size; + dst += key->u.s.block_size; } if (flags & BCRYPT_BLOCK_PADDING) { - if (!(buf = heap_alloc( key->block_size ))) return STATUS_NO_MEMORY; - status = key_decrypt( key, src, key->block_size, buf, key->block_size ); - if (!status && buf[ key->block_size - 1 ] <= key->block_size) + if (!(buf = heap_alloc( key->u.s.block_size ))) return STATUS_NO_MEMORY; + status = key_decrypt( key, src, key->u.s.block_size, buf, key->u.s.block_size ); + if (!status && buf[ key->u.s.block_size - 1 ] <= key->u.s.block_size) { - *ret_len -= buf[ key->block_size - 1 ]; + *ret_len -= buf[ key->u.s.block_size - 1 ]; if (output_len < *ret_len) status = STATUS_BUFFER_TOO_SMALL; - else memcpy( dst, buf, key->block_size - buf[ key->block_size - 1 ] ); + else memcpy( dst, buf, key->u.s.block_size - buf[ key->u.s.block_size - 1 ] ); } else status = STATUS_UNSUCCESSFUL; /* FIXME: invalid padding */ -- 1.9.1

1 0

[PATCH] winemac: Reenable window autodisplay when the frame is set and redisplayed.
by Ken Thomases March 26, 2018

March 26, 2018

Cocoa will draw the window frame immediately but if autodisplay of its content view is disabled, that may leave the content area black briefly. This change avoids that flicker. Signed-off-by: Ken Thomases <ken(a)codeweavers.com> --- dlls/winemac.drv/cocoa_window.m | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/dlls/winemac.drv/cocoa_window.m b/dlls/winemac.drv/cocoa_window.m index 991db57..b94b774 100644 --- a/dlls/winemac.drv/cocoa_window.m +++ b/dlls/winemac.drv/cocoa_window.m @@ -2456,6 +2456,20 @@ - (void) displayIfNeeded [self setAutodisplay:NO]; } + - (void) setFrame:(NSRect)frameRect display:(BOOL)flag + { + if (flag) + [self setAutodisplay:YES]; + [super setFrame:frameRect display:flag]; + } + + - (void) setFrame:(NSRect)frameRect display:(BOOL)displayFlag animate:(BOOL)animateFlag + { + if (displayFlag) + [self setAutodisplay:YES]; + [super setFrame:frameRect display:displayFlag animate:animateFlag]; + } + - (void) windowDidDrawContent { if (!drawnSinceShown) -- 2.10.2

1 0

[PATCH 0/7] Wine Vulkan and Direct3D 12
by Józef Kucia March 25, 2018

March 25, 2018

The following patch series was written mainly for Direct3D 12 integration. Our Direct3D 12 is going to use host Vulkan, but we want to share platform-specific WSI code with Wine Vulkan. The series makes sense on its own as well, as it lets us to use autogenerated thunks for more Vulkan functions. We add additional requirement for Wine Vulkan drivers: vkGetInstanceProcAddr() and vkGetDeviceProcAddr() must return function pointers to overridden Vulkan functions. This requirement allow us to treat Wine Vulkan driver as host Vulkan implementation extended with VK_KHR_win32_surface. The plan is to make our D3D12 implementation another client of Wine Vulkan driver, i.e. D3D12 is going to call __wine_get_vulkan_driver(). Thanks to this series, we'll be able to pass vkGetInstanceProcAddr() to libvkd3d and tell libvkd3d enable VK_KHR_win32_surface. We could take this idea further and minimize Wine Vulkan driver interface to a single function: vkGetInstanceProcAddr(). The only requirement would be that Wine Vulkan driver has to provide an implementation of VK_KHR_win32_surface. On the other hand, the vulkan_funcs structure makes it more explicit what is expected to be implemented by Wine Vulkan driver. CC: Roderick Colenbrander <thunderbird2k(a)gmail.com> Józef Kucia (7): winevulkan: Get rid of unnecessary forward declarations. winex11: Return Wine Vulkan driver functions from vkGetInstanceProcAddr(). winex11: Return Wine Vulkan driver functions from vkGetDeviceProcAddr(). winevulkan: Generate conversions only for autogenerated thunks. winevulkan: Put all required functions into function tables. winevulkan: Mark explicitly if driver function is needed in dispatch tables. winevulkan: Autogenerate thunks for functions overridden by Wine Vulkan driver. dlls/winevulkan/make_vulkan | 49 +++--- dlls/winevulkan/vulkan.c | 341 +++++++++++----------------------------- dlls/winevulkan/vulkan_thunks.c | 118 ++++++++++++-- dlls/winevulkan/vulkan_thunks.h | 42 +++-- dlls/winex11.drv/vulkan.c | 94 ++++++++++- 5 files changed, 338 insertions(+), 306 deletions(-) -- 2.16.1

2 15

Re: [1/3] msvcrt: Implement _atol_l.
by Stefan Dösinger March 25, 2018

March 25, 2018

Hello, On 25/03/18 18:03, Hua Meng wrote: > + __int64 ret = MSVCRT_strtoi64_l(str, NULL, 10, locale); > + > + if(ret > LONG_MAX) { > + ret = LONG_MAX; > + *MSVCRT__errno() = MSVCRT_ERANGE; > + } else if(ret < LONG_MIN) { > + ret = LONG_MIN; > + *MSVCRT__errno() = MSVCRT_ERANGE; > + } This looks reasonable. Can you provide a simple test to verify that the function indeed behaves as specified in MSDN?

1 0

[PATCH]calc:Add a simple implementation.
by 孟华 March 25, 2018

March 25, 2018

For bug 15555: https://bugs.winehq.org/show_bug.cgi?id=15555

3 2

[3/3] msvcrt: Return correct value when out of range in _atoldbl.
by Hua Meng March 25, 2018

March 25, 2018

Signed-off-by: Hua Meng <161220092(a)smail.nju.edu.cn> --- dlls/msvcrt/string.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)

1 0

[2/3] msvcrt: Implement _atoi64_l.
by Hua Meng March 25, 2018

March 25, 2018

1 0

[1/3] msvcrt: Implement _atol_l.
by Hua Meng March 25, 2018

March 25, 2018

1 0