April 2021 - Wine-Devel - list.winehq.org

[PATCH 6/7] kerberos: Use wide character string literals.
by Hans Leidekker April 21, 2021

April 21, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index 6e3135a9f02..239d6a1bded 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -61,8 +61,8 @@ const struct krb5_funcs *krb5_funcs = NULL; | SECPKG_FLAG_RESTRICTED_TOKENS \ | SECPKG_FLAG_APPCONTAINER_CHECKS) -static WCHAR kerberos_name_W[] = {'K','e','r','b','e','r','o','s',0}; -static WCHAR kerberos_comment_W[] = {'M','i','c','r','o','s','o','f','t',' ','K','e','r','b','e','r','o','s',' ','V','1','.','0',0}; +static WCHAR kerberos_name_W[] = L"Kerberos"; +static WCHAR kerberos_comment_W[] = L"Microsoft Kerberos V1.0"; static const SecPkgInfoW infoW = { KERBEROS_CAPS, -- 2.30.2

1 0

[PATCH 5/7] kerberos: Build with msvcrt.
by Hans Leidekker April 21, 2021

April 21, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/Makefile.in | 2 ++ dlls/kerberos/krb5_ap.c | 5 ++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/dlls/kerberos/Makefile.in b/dlls/kerberos/Makefile.in index ab5e6b59976..acfd9030955 100644 --- a/dlls/kerberos/Makefile.in +++ b/dlls/kerberos/Makefile.in @@ -1,6 +1,8 @@ MODULE = kerberos.dll EXTRAINCL = $(KRB5_CFLAGS) $(GSSAPI_CFLAGS) +EXTRADLLFLAGS = -mno-cygwin + C_SRCS = \ krb5_ap.c \ unixlib.c diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index 792ee974983..6e3135a9f02 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -34,7 +34,6 @@ #include "winternl.h" #include "wine/heap.h" #include "wine/debug.h" -#include "wine/unicode.h" #include "unixlib.h" WINE_DEFAULT_DEBUG_CHANNEL(kerberos); @@ -397,8 +396,8 @@ static NTSTATUS NTAPI kerberos_SpDeleteContext( LSA_SEC_HANDLE context ) static SecPkgInfoW *build_package_info( const SecPkgInfoW *info ) { SecPkgInfoW *ret; - DWORD size_name = (strlenW(info->Name) + 1) * sizeof(WCHAR); - DWORD size_comment = (strlenW(info->Comment) + 1) * sizeof(WCHAR); + DWORD size_name = (wcslen(info->Name) + 1) * sizeof(WCHAR); + DWORD size_comment = (wcslen(info->Comment) + 1) * sizeof(WCHAR); if (!(ret = heap_alloc( sizeof(*ret) + size_name + size_comment ))) return NULL; ret->fCapabilities = info->fCapabilities; -- 2.30.2

1 0

[PATCH 4/7] kerberos: Move support for KerbQueryTicketCacheMessage to the Unix library.
by Hans Leidekker April 21, 2021

April 21, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 428 +++++----------------------------------- dlls/kerberos/unixlib.c | 164 +++++++++++++++ dlls/kerberos/unixlib.h | 8 + 3 files changed, 219 insertions(+), 381 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index 8ed4ffd13cf..792ee974983 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -21,18 +21,7 @@ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA */ -#include "config.h" -#include "wine/port.h" - #include <stdarg.h> -#ifdef HAVE_KRB5_KRB5_H -#include <krb5/krb5.h> -#endif -#ifdef SONAME_LIBGSSAPI_KRB5 -# include <gssapi/gssapi.h> -# include <gssapi/gssapi_ext.h> -#endif - #include "ntstatus.h" #define WIN32_NO_STATUS #include "windef.h" @@ -88,94 +77,6 @@ static const SecPkgInfoW infoW = static ULONG kerberos_package_id; static LSA_DISPATCH_TABLE lsa_dispatch; -#ifdef SONAME_LIBKRB5 - -static void *libkrb5_handle; - -#define MAKE_FUNCPTR(f) static typeof(f) * p_##f -MAKE_FUNCPTR(krb5_cc_close); -MAKE_FUNCPTR(krb5_cc_default); -MAKE_FUNCPTR(krb5_cc_end_seq_get); -MAKE_FUNCPTR(krb5_cc_initialize); -MAKE_FUNCPTR(krb5_cc_next_cred); -MAKE_FUNCPTR(krb5_cc_start_seq_get); -MAKE_FUNCPTR(krb5_cc_store_cred); -MAKE_FUNCPTR(krb5_cccol_cursor_free); -MAKE_FUNCPTR(krb5_cccol_cursor_new); -MAKE_FUNCPTR(krb5_cccol_cursor_next); -MAKE_FUNCPTR(krb5_decode_ticket); -MAKE_FUNCPTR(krb5_free_context); -MAKE_FUNCPTR(krb5_free_cred_contents); -MAKE_FUNCPTR(krb5_free_principal); -MAKE_FUNCPTR(krb5_free_ticket); -MAKE_FUNCPTR(krb5_free_unparsed_name); -MAKE_FUNCPTR(krb5_get_init_creds_opt_alloc); -MAKE_FUNCPTR(krb5_get_init_creds_opt_free); -MAKE_FUNCPTR(krb5_get_init_creds_opt_set_out_ccache); -MAKE_FUNCPTR(krb5_get_init_creds_password); -MAKE_FUNCPTR(krb5_init_context); -MAKE_FUNCPTR(krb5_is_config_principal); -MAKE_FUNCPTR(krb5_parse_name_flags); -MAKE_FUNCPTR(krb5_unparse_name_flags); -#undef MAKE_FUNCPTR - -static void load_krb5(void) -{ - if (!(libkrb5_handle = dlopen(SONAME_LIBKRB5, RTLD_NOW))) - { - WARN("Failed to load %s, Kerberos support will be disabled\n", SONAME_LIBKRB5); - return; - } - -#define LOAD_FUNCPTR(f) \ - if (!(p_##f = dlsym(libkrb5_handle, #f))) \ - { \ - ERR("Failed to load %s\n", #f); \ - goto fail; \ - } - - LOAD_FUNCPTR(krb5_cc_close) - LOAD_FUNCPTR(krb5_cc_default) - LOAD_FUNCPTR(krb5_cc_end_seq_get) - LOAD_FUNCPTR(krb5_cc_initialize) - LOAD_FUNCPTR(krb5_cc_next_cred) - LOAD_FUNCPTR(krb5_cc_start_seq_get) - LOAD_FUNCPTR(krb5_cc_store_cred) - LOAD_FUNCPTR(krb5_cccol_cursor_free) - LOAD_FUNCPTR(krb5_cccol_cursor_new) - LOAD_FUNCPTR(krb5_cccol_cursor_next) - LOAD_FUNCPTR(krb5_decode_ticket) - LOAD_FUNCPTR(krb5_free_context) - LOAD_FUNCPTR(krb5_free_cred_contents) - LOAD_FUNCPTR(krb5_free_principal) - LOAD_FUNCPTR(krb5_free_ticket) - LOAD_FUNCPTR(krb5_free_unparsed_name) - LOAD_FUNCPTR(krb5_get_init_creds_opt_alloc) - LOAD_FUNCPTR(krb5_get_init_creds_opt_free) - LOAD_FUNCPTR(krb5_get_init_creds_opt_set_out_ccache) - LOAD_FUNCPTR(krb5_get_init_creds_password) - LOAD_FUNCPTR(krb5_init_context) - LOAD_FUNCPTR(krb5_is_config_principal) - LOAD_FUNCPTR(krb5_parse_name_flags) - LOAD_FUNCPTR(krb5_unparse_name_flags) -#undef LOAD_FUNCPTR - - return; - -fail: - dlclose(libkrb5_handle); - libkrb5_handle = NULL; -} - -#else /* SONAME_LIBKRB5 */ - -static void load_krb5(void) -{ - WARN("Kerberos support was not provided at compile time\n"); -} - -#endif /* SONAME_LIBKRB5 */ - static const char *debugstr_us( const UNICODE_STRING *us ) { if (!us) return "<null>"; @@ -187,7 +88,8 @@ static NTSTATUS NTAPI kerberos_LsaApInitializePackage(ULONG package_id, PLSA_DIS { char *kerberos_name; - load_krb5(); + if (!krb5_funcs && __wine_init_unix_lib( instance, DLL_PROCESS_ATTACH, NULL, &krb5_funcs )) + ERR( "no Kerberos support, expect problems\n" ); kerberos_package_id = package_id; lsa_dispatch = *dispatch; @@ -209,179 +111,15 @@ static NTSTATUS NTAPI kerberos_LsaApInitializePackage(ULONG package_id, PLSA_DIS return STATUS_SUCCESS; } -#ifdef SONAME_LIBKRB5 - -struct ticket_info -{ - ULONG count, allocated; - KERB_TICKET_CACHE_INFO *info; -}; - -static NTSTATUS krb5_error_to_status(krb5_error_code error) -{ - switch (error) - { - case 0: return STATUS_SUCCESS; - default: - /* FIXME */ - return STATUS_UNSUCCESSFUL; - } -} - -static void free_ticket_info(struct ticket_info *info) +static void free_ticket_list( struct ticket_list *list ) { ULONG i; - - for (i = 0; i < info->count; i++) + for (i = 0; i < list->count; i++) { - heap_free(info->info[i].RealmName.Buffer); - heap_free(info->info[i].ServerName.Buffer); + RtlFreeHeap( GetProcessHeap(), 0, list->tickets[i].RealmName.Buffer ); + RtlFreeHeap( GetProcessHeap(), 0, list->tickets[i].ServerName.Buffer ); } - - heap_free(info->info); -} - -static WCHAR *utf8_to_wstr(const char *utf8) -{ - int len; - WCHAR *wstr; - - len = MultiByteToWideChar(CP_UTF8, 0, utf8, -1, NULL, 0); - wstr = heap_alloc(len * sizeof(WCHAR)); - if (wstr) - MultiByteToWideChar(CP_UTF8, 0, utf8, -1, wstr, len); - - return wstr; -} - -static NTSTATUS copy_tickets_from_cache(krb5_context context, krb5_ccache cache, struct ticket_info *info) -{ - NTSTATUS status; - krb5_cc_cursor cursor; - krb5_error_code error; - krb5_creds credentials; - krb5_ticket *ticket; - char *name_with_realm, *name_without_realm, *realm_name; - WCHAR *realm_nameW, *name_without_realmW; - - error = p_krb5_cc_start_seq_get(context, cache, &cursor); - if (error) return krb5_error_to_status(error); - - for (;;) - { - error = p_krb5_cc_next_cred(context, cache, &cursor, &credentials); - if (error) - { - if (error == KRB5_CC_END) - status = STATUS_SUCCESS; - else - status = krb5_error_to_status(error); - break; - } - - if (p_krb5_is_config_principal(context, credentials.server)) - { - p_krb5_free_cred_contents(context, &credentials); - continue; - } - - if (info->count == info->allocated) - { - KERB_TICKET_CACHE_INFO *new_info; - ULONG new_allocated; - - if (info->allocated) - { - new_allocated = info->allocated * 2; - new_info = heap_realloc(info->info, sizeof(*new_info) * new_allocated); - } - else - { - new_allocated = 16; - new_info = heap_alloc(sizeof(*new_info) * new_allocated); - } - if (!new_info) - { - p_krb5_free_cred_contents(context, &credentials); - status = STATUS_NO_MEMORY; - break; - } - - info->info = new_info; - info->allocated = new_allocated; - } - - error = p_krb5_unparse_name_flags(context, credentials.server, 0, &name_with_realm); - if (error) - { - p_krb5_free_cred_contents(context, &credentials); - status = krb5_error_to_status(error); - break; - } - - TRACE("name_with_realm: %s\n", debugstr_a(name_with_realm)); - - error = p_krb5_unparse_name_flags(context, credentials.server, - KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name_without_realm); - if (error) - { - p_krb5_free_unparsed_name(context, name_with_realm); - p_krb5_free_cred_contents(context, &credentials); - status = krb5_error_to_status(error); - break; - } - - TRACE("name_without_realm: %s\n", debugstr_a(name_without_realm)); - - name_without_realmW = utf8_to_wstr(name_without_realm); - RtlInitUnicodeString(&info->info[info->count].ServerName, name_without_realmW); - - realm_name = strchr(name_with_realm, '@'); - if (!realm_name) - { - ERR("wrong name with realm %s\n", debugstr_a(name_with_realm)); - realm_name = name_with_realm; - } - else - realm_name++; - - /* realm_name - now contains only realm! */ - - realm_nameW = utf8_to_wstr(realm_name); - RtlInitUnicodeString(&info->info[info->count].RealmName, realm_nameW); - - if (!credentials.times.starttime) - credentials.times.starttime = credentials.times.authtime; - - /* TODO: if krb5_is_config_principal = true */ - RtlSecondsSince1970ToTime(credentials.times.starttime, &info->info[info->count].StartTime); - RtlSecondsSince1970ToTime(credentials.times.endtime, &info->info[info->count].EndTime); - RtlSecondsSince1970ToTime(credentials.times.renew_till, &info->info[info->count].RenewTime); - - info->info[info->count].TicketFlags = credentials.ticket_flags; - - error = p_krb5_decode_ticket(&credentials.ticket, &ticket); - - p_krb5_free_unparsed_name(context, name_with_realm); - p_krb5_free_unparsed_name(context, name_without_realm); - p_krb5_free_cred_contents(context, &credentials); - - if (error) - { - status = krb5_error_to_status(error); - break; - } - - info->info[info->count].EncryptionType = ticket->enc_part.enctype; - - p_krb5_free_ticket(context, ticket); - - info->count++; - } - - p_krb5_cc_end_seq_get(context, cache, &cursor); - - return status; + RtlFreeHeap( GetProcessHeap(), 0, list->tickets ); } static inline void init_client_us(UNICODE_STRING *dst, void *client_ws, const UNICODE_STRING *src) @@ -391,7 +129,7 @@ static inline void init_client_us(UNICODE_STRING *dst, void *client_ws, const UN dst->MaximumLength = src->MaximumLength; } -static NTSTATUS copy_to_client(PLSA_CLIENT_REQUEST lsa_req, struct ticket_info *info, void **out, ULONG *out_size) +static NTSTATUS copy_to_client(PLSA_CLIENT_REQUEST lsa_req, struct ticket_list *list, void **out, ULONG *out_size) { NTSTATUS status; ULONG i; @@ -399,28 +137,26 @@ static NTSTATUS copy_to_client(PLSA_CLIENT_REQUEST lsa_req, struct ticket_info * char *client_resp, *client_ticket, *client_str; KERB_QUERY_TKT_CACHE_RESPONSE resp; - size = sizeof(KERB_QUERY_TKT_CACHE_RESPONSE); - if (info->count != 0) - size += (info->count - 1) * sizeof(KERB_TICKET_CACHE_INFO); - + size = sizeof(resp); + if (list->count) size += (list->count - 1) * sizeof(KERB_TICKET_CACHE_INFO); client_str_off = size; - for (i = 0; i < info->count; i++) + for (i = 0; i < list->count; i++) { - size += info->info[i].RealmName.MaximumLength; - size += info->info[i].ServerName.MaximumLength; + size += list->tickets[i].RealmName.MaximumLength; + size += list->tickets[i].ServerName.MaximumLength; } status = lsa_dispatch.AllocateClientBuffer(lsa_req, size, (void **)&client_resp); if (status != STATUS_SUCCESS) return status; resp.MessageType = KerbQueryTicketCacheMessage; - resp.CountOfTickets = info->count; + resp.CountOfTickets = list->count; size = FIELD_OFFSET(KERB_QUERY_TKT_CACHE_RESPONSE, Tickets); status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_resp, &resp); if (status != STATUS_SUCCESS) goto fail; - if (!info->count) + if (!list->count) { *out = client_resp; *out_size = sizeof(resp); @@ -432,24 +168,22 @@ static NTSTATUS copy_to_client(PLSA_CLIENT_REQUEST lsa_req, struct ticket_info * client_ticket = client_resp + size; client_str = client_resp + client_str_off; - for (i = 0; i < info->count; i++) + for (i = 0; i < list->count; i++) { - KERB_TICKET_CACHE_INFO ticket; - - ticket = info->info[i]; + KERB_TICKET_CACHE_INFO ticket = list->tickets[i]; - init_client_us(&ticket.RealmName, client_str, &info->info[i].RealmName); + init_client_us(&ticket.RealmName, client_str, &list->tickets[i].RealmName); - size = info->info[i].RealmName.MaximumLength; - status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, info->info[i].RealmName.Buffer); + size = ticket.RealmName.MaximumLength; + status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, list->tickets[i].RealmName.Buffer); if (status != STATUS_SUCCESS) goto fail; client_str += size; *out_size += size; - init_client_us(&ticket.ServerName, client_str, &info->info[i].ServerName); + init_client_us(&ticket.ServerName, client_str, &list->tickets[i].ServerName); - size = info->info[i].ServerName.MaximumLength; - status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, info->info[i].ServerName.Buffer); + size = ticket.ServerName.MaximumLength; + status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, list->tickets[i].ServerName.Buffer); if (status != STATUS_SUCCESS) goto fail; client_str += size; *out_size += size; @@ -469,121 +203,53 @@ fail: return status; } -static NTSTATUS query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req, void *in, ULONG in_len, void **out, ULONG *out_len) +static NTSTATUS NTAPI kerberos_LsaApCallPackageUntrusted(PLSA_CLIENT_REQUEST req, void *in_buf, + void *client_buf_base, ULONG in_buf_len, void **out_buf, ULONG *out_buf_len, NTSTATUS *ret_status) { - NTSTATUS status; - KERB_QUERY_TKT_CACHE_REQUEST *query; - struct ticket_info info; - krb5_error_code error; - krb5_context context = NULL; - krb5_cccol_cursor cursor = NULL; - krb5_ccache cache; - - if (!in || in_len != sizeof(KERB_QUERY_TKT_CACHE_REQUEST) || !out || !out_len) - return STATUS_INVALID_PARAMETER; - - query = (KERB_QUERY_TKT_CACHE_REQUEST *)in; + KERB_PROTOCOL_MESSAGE_TYPE msg; - if (query->LogonId.HighPart != 0 || query->LogonId.LowPart != 0) - return STATUS_ACCESS_DENIED; + TRACE("%p,%p,%p,%u,%p,%p,%p\n", req, in_buf, client_buf_base, in_buf_len, out_buf, out_buf_len, ret_status); - info.count = 0; - info.allocated = 0; - info.info = NULL; + if (!in_buf || in_buf_len < sizeof(msg)) return STATUS_INVALID_PARAMETER; - error = p_krb5_init_context(&context); - if (error) + msg = *(KERB_PROTOCOL_MESSAGE_TYPE *)in_buf; + switch (msg) { - status = krb5_error_to_status(error); - goto done; - } - - error = p_krb5_cccol_cursor_new(context, &cursor); - if (error) + case KerbQueryTicketCacheMessage: { - status = krb5_error_to_status(error); - goto done; - } + KERB_QUERY_TKT_CACHE_REQUEST *query = (KERB_QUERY_TKT_CACHE_REQUEST *)in_buf; + struct ticket_list list; + NTSTATUS status; - for (;;) - { - error = p_krb5_cccol_cursor_next(context, cursor, &cache); - if (error) + if (!in_buf || in_buf_len != sizeof(*query) || !out_buf || !out_buf_len) return STATUS_INVALID_PARAMETER; + if (query->LogonId.HighPart || query->LogonId.LowPart) return STATUS_ACCESS_DENIED; + + status = krb5_funcs->query_ticket_cache(&list); + if (!status) { - status = krb5_error_to_status(error); - goto done; + status = copy_to_client(req, &list, out_buf, out_buf_len); + free_ticket_list(&list); } - if (!cache) break; - - status = copy_tickets_from_cache(context, cache, &info); - - p_krb5_cc_close(context, cache); - - if (status != STATUS_SUCCESS) - goto done; - } - - status = copy_to_client(lsa_req, &info, out, out_len); - -done: - if (cursor) - p_krb5_cccol_cursor_free(context, &cursor); - - if (context) - p_krb5_free_context(context); - - free_ticket_info(&info); - - return status; -} - -#else /* SONAME_LIBKRB5 */ - -static NTSTATUS query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req, void *in, ULONG in_len, void **out, ULONG *out_len) -{ - FIXME("%p,%p,%u,%p,%p: stub\n", lsa_req, in, in_len, out, out_len); - return STATUS_NOT_IMPLEMENTED; -} - -#endif /* SONAME_LIBKRB5 */ - -static NTSTATUS NTAPI kerberos_LsaApCallPackageUntrusted(PLSA_CLIENT_REQUEST request, - PVOID in_buffer, PVOID client_buffer_base, ULONG in_buffer_length, - PVOID *out_buffer, PULONG out_buffer_length, PNTSTATUS status) -{ - KERB_PROTOCOL_MESSAGE_TYPE msg; - - TRACE("%p,%p,%p,%u,%p,%p,%p\n", request, in_buffer, client_buffer_base, - in_buffer_length, out_buffer, out_buffer_length, status); - - if (!in_buffer || in_buffer_length < sizeof(msg)) - return STATUS_INVALID_PARAMETER; - - msg = *(KERB_PROTOCOL_MESSAGE_TYPE *)in_buffer; - - switch (msg) - { - case KerbQueryTicketCacheMessage: - *status = query_ticket_cache(request, in_buffer, in_buffer_length, out_buffer, out_buffer_length); + *ret_status = status; break; - + } case KerbRetrieveTicketMessage: FIXME("KerbRetrieveTicketMessage stub\n"); - *status = STATUS_NOT_IMPLEMENTED; + *ret_status = STATUS_NOT_IMPLEMENTED; break; case KerbPurgeTicketCacheMessage: FIXME("KerbPurgeTicketCacheMessage stub\n"); - *status = STATUS_NOT_IMPLEMENTED; + *ret_status = STATUS_NOT_IMPLEMENTED; break; default: /* All other requests should call LsaApCallPackage */ WARN("%u => access denied\n", msg); - *status = STATUS_ACCESS_DENIED; + *ret_status = STATUS_ACCESS_DENIED; break; } - return *status; + return *ret_status; } static NTSTATUS NTAPI kerberos_SpGetInfo(SecPkgInfoW *info) diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c index 4e9b90eeccf..6f53609e2ed 100644 --- a/dlls/kerberos/unixlib.c +++ b/dlls/kerberos/unixlib.c @@ -148,6 +148,169 @@ static NTSTATUS krb5_error_to_status( krb5_error_code err ) } } +static WCHAR *utf8_to_wstr( const char *src ) +{ + ULONG dstlen, srclen = strlen( src ) + 1; + WCHAR *dst; + + RtlUTF8ToUnicodeN( NULL, 0, &dstlen, src, srclen ); + if ((dst = RtlAllocateHeap( GetProcessHeap(), 0, dstlen ))) + RtlUTF8ToUnicodeN( dst, dstlen, &dstlen, src, srclen ); + return dst; +} + +static NTSTATUS copy_tickets_from_cache( krb5_context ctx, krb5_ccache cache, struct ticket_list *list ) +{ + NTSTATUS status; + krb5_cc_cursor cursor; + krb5_error_code err; + krb5_creds creds; + krb5_ticket *ticket; + char *name_with_realm, *name_without_realm, *realm_name; + WCHAR *realm_nameW, *name_without_realmW; + + if ((err = p_krb5_cc_start_seq_get( ctx, cache, &cursor ))) return krb5_error_to_status( err ); + for (;;) + { + if ((err = p_krb5_cc_next_cred( ctx, cache, &cursor, &creds ))) + { + if (err == KRB5_CC_END) + status = STATUS_SUCCESS; + else + status = krb5_error_to_status( err ); + break; + } + + if (p_krb5_is_config_principal( ctx, creds.server )) + { + p_krb5_free_cred_contents( ctx, &creds ); + continue; + } + + if (list->count == list->allocated) + { + KERB_TICKET_CACHE_INFO *new_tickets; + ULONG new_allocated; + + if (list->allocated) + { + new_allocated = list->allocated * 2; + new_tickets = RtlReAllocateHeap( GetProcessHeap(), 0, list->tickets, sizeof(*new_tickets) * new_allocated ); + } + else + { + new_allocated = 16; + new_tickets = RtlAllocateHeap( GetProcessHeap(), 0, sizeof(*new_tickets) * new_allocated ); + } + if (!new_tickets) + { + p_krb5_free_cred_contents( ctx, &creds ); + status = STATUS_NO_MEMORY; + break; + } + list->tickets = new_tickets; + list->allocated = new_allocated; + } + + if ((err = p_krb5_unparse_name_flags( ctx, creds.server, 0, &name_with_realm ))) + { + p_krb5_free_cred_contents( ctx, &creds ); + status = krb5_error_to_status( err ); + break; + } + TRACE( "name_with_realm: %s\n", debugstr_a(name_with_realm) ); + + if ((err = p_krb5_unparse_name_flags( ctx, creds.server, KRB5_PRINCIPAL_UNPARSE_NO_REALM, + &name_without_realm ))) + { + p_krb5_free_unparsed_name( ctx, name_with_realm ); + p_krb5_free_cred_contents( ctx, &creds ); + status = krb5_error_to_status( err ); + break; + } + TRACE( "name_without_realm: %s\n", debugstr_a(name_without_realm) ); + + name_without_realmW = utf8_to_wstr( name_without_realm ); + RtlInitUnicodeString( &list->tickets[list->count].ServerName, name_without_realmW ); + + if (!(realm_name = strchr( name_with_realm, '@' ))) + { + ERR( "wrong name with realm %s\n", debugstr_a(name_with_realm) ); + realm_name = name_with_realm; + } + else realm_name++; + + /* realm_name - now contains only realm! */ + realm_nameW = utf8_to_wstr( realm_name ); + RtlInitUnicodeString( &list->tickets[list->count].RealmName, realm_nameW ); + + if (!creds.times.starttime) creds.times.starttime = creds.times.authtime; + + /* TODO: if krb5_is_config_principal = true */ + RtlSecondsSince1970ToTime( creds.times.starttime, &list->tickets[list->count].StartTime ); + RtlSecondsSince1970ToTime( creds.times.endtime, &list->tickets[list->count].EndTime ); + RtlSecondsSince1970ToTime( creds.times.renew_till, &list->tickets[list->count].RenewTime ); + + list->tickets[list->count].TicketFlags = creds.ticket_flags; + + err = p_krb5_decode_ticket( &creds.ticket, &ticket ); + p_krb5_free_unparsed_name( ctx, name_with_realm ); + p_krb5_free_unparsed_name( ctx, name_without_realm ); + p_krb5_free_cred_contents( ctx, &creds ); + if (err) + { + status = krb5_error_to_status( err ); + break; + } + + list->tickets[list->count].EncryptionType = ticket->enc_part.enctype; + p_krb5_free_ticket( ctx, ticket ); + list->count++; + } + + p_krb5_cc_end_seq_get( ctx, cache, &cursor ); + return status; +} + +static NTSTATUS CDECL query_ticket_cache( struct ticket_list *list ) +{ + NTSTATUS status; + krb5_error_code err; + krb5_context ctx; + krb5_cccol_cursor cursor = NULL; + krb5_ccache cache; + + list->count = 0; + list->allocated = 0; + list->tickets = NULL; + + if ((err = p_krb5_init_context( &ctx ))) return krb5_error_to_status( err ); + if ((err = p_krb5_cccol_cursor_new( ctx, &cursor ))) + { + status = krb5_error_to_status( err ); + goto done; + } + + for (;;) + { + if ((err = p_krb5_cccol_cursor_next( ctx, cursor, &cache ))) + { + status = krb5_error_to_status( err ); + goto done; + } + if (!cache) break; + + status = copy_tickets_from_cache( ctx, cache, list ); + p_krb5_cc_close( ctx, cache ); + if (status != STATUS_SUCCESS) goto done; + } + +done: + if (cursor) p_krb5_cccol_cursor_free( ctx, &cursor ); + if (ctx) p_krb5_free_context( ctx ); + return status; +} + static void *libgssapi_krb5_handle; #define MAKE_FUNCPTR(f) static typeof(f) * p##f @@ -841,6 +1004,7 @@ static const struct krb5_funcs funcs = initialize_context, make_signature, query_context_attributes, + query_ticket_cache, seal_message, unseal_message, verify_signature, diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h index 652a6e4f300..da36c59a680 100644 --- a/dlls/kerberos/unixlib.h +++ b/dlls/kerberos/unixlib.h @@ -21,6 +21,13 @@ #define KERBEROS_MAX_BUF 12000 +struct ticket_list +{ + ULONG count; + ULONG allocated; + KERB_TICKET_CACHE_INFO *tickets; +}; + struct krb5_funcs { NTSTATUS (CDECL *accept_context)(LSA_SEC_HANDLE, LSA_SEC_HANDLE, SecBufferDesc *, LSA_SEC_HANDLE *, @@ -33,6 +40,7 @@ struct krb5_funcs LSA_SEC_HANDLE *, SecBufferDesc *, ULONG *, TimeStamp *); NTSTATUS (CDECL *make_signature)(LSA_SEC_HANDLE, SecBufferDesc *); NTSTATUS (CDECL *query_context_attributes)(LSA_SEC_HANDLE, ULONG, void *); + NTSTATUS (CDECL *query_ticket_cache)(struct ticket_list *); NTSTATUS (CDECL *seal_message)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG); NTSTATUS (CDECL *unseal_message)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG *); NTSTATUS (CDECL *verify_signature)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG *); -- 2.30.2

1 0

[PATCH 3/7] kerberos: Move support for SpUnsealMessage to the Unix library.
by Hans Leidekker April 21, 2021

April 21, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 248 +--------------------------------------- dlls/kerberos/unixlib.c | 76 ++++++++++++ dlls/kerberos/unixlib.h | 1 + 3 files changed, 78 insertions(+), 247 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index d248c4e1951..8ed4ffd13cf 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -54,8 +54,6 @@ static HINSTANCE instance; const struct krb5_funcs *krb5_funcs = NULL; -#define KERBEROS_MAX_BUF 12000 - #define KERBEROS_CAPS \ ( SECPKG_FLAG_INTEGRITY \ | SECPKG_FLAG_PRIVACY \ @@ -600,162 +598,6 @@ static NTSTATUS NTAPI kerberos_SpGetInfo(SecPkgInfoW *info) return STATUS_SUCCESS; } -#ifdef SONAME_LIBGSSAPI_KRB5 - -WINE_DECLARE_DEBUG_CHANNEL(winediag); -static void *libgssapi_krb5_handle; - -#define MAKE_FUNCPTR(f) static typeof(f) * p##f -MAKE_FUNCPTR(gss_accept_sec_context); -MAKE_FUNCPTR(gss_acquire_cred); -MAKE_FUNCPTR(gss_delete_sec_context); -MAKE_FUNCPTR(gss_display_status); -MAKE_FUNCPTR(gss_get_mic); -MAKE_FUNCPTR(gss_import_name); -MAKE_FUNCPTR(gss_init_sec_context); -MAKE_FUNCPTR(gss_inquire_context); -MAKE_FUNCPTR(gss_release_buffer); -MAKE_FUNCPTR(gss_release_cred); -MAKE_FUNCPTR(gss_release_iov_buffer); -MAKE_FUNCPTR(gss_release_name); -MAKE_FUNCPTR(gss_unwrap); -MAKE_FUNCPTR(gss_unwrap_iov); -MAKE_FUNCPTR(gss_verify_mic); -MAKE_FUNCPTR(gss_wrap); -MAKE_FUNCPTR(gss_wrap_iov); -#undef MAKE_FUNCPTR - -static BOOL load_gssapi_krb5(void) -{ - if (!(libgssapi_krb5_handle = dlopen( SONAME_LIBGSSAPI_KRB5, RTLD_NOW ))) - { - ERR_(winediag)( "Failed to load libgssapi_krb5, Kerberos SSP support will not be available.\n" ); - return FALSE; - } - -#define LOAD_FUNCPTR(f) \ - if (!(p##f = dlsym( libgssapi_krb5_handle, #f ))) \ - { \ - ERR( "Failed to load %s\n", #f ); \ - goto fail; \ - } - - LOAD_FUNCPTR(gss_accept_sec_context) - LOAD_FUNCPTR(gss_acquire_cred) - LOAD_FUNCPTR(gss_delete_sec_context) - LOAD_FUNCPTR(gss_display_status) - LOAD_FUNCPTR(gss_get_mic) - LOAD_FUNCPTR(gss_import_name) - LOAD_FUNCPTR(gss_init_sec_context) - LOAD_FUNCPTR(gss_inquire_context) - LOAD_FUNCPTR(gss_release_buffer) - LOAD_FUNCPTR(gss_release_cred) - LOAD_FUNCPTR(gss_release_iov_buffer) - LOAD_FUNCPTR(gss_release_name) - LOAD_FUNCPTR(gss_unwrap) - LOAD_FUNCPTR(gss_unwrap_iov) - LOAD_FUNCPTR(gss_verify_mic) - LOAD_FUNCPTR(gss_wrap) - LOAD_FUNCPTR(gss_wrap_iov) -#undef LOAD_FUNCPTR - - return TRUE; - -fail: - dlclose( libgssapi_krb5_handle ); - libgssapi_krb5_handle = NULL; - return FALSE; -} - -static void unload_gssapi_krb5(void) -{ - dlclose( libgssapi_krb5_handle ); - libgssapi_krb5_handle = NULL; -} - -static inline gss_ctx_id_t ctxthandle_sspi_to_gss( LSA_SEC_HANDLE ctxt ) -{ - if (!ctxt) return GSS_C_NO_CONTEXT; - return (gss_ctx_id_t)ctxt; -} - -static NTSTATUS status_gss_to_sspi( OM_uint32 status ) -{ - switch (status) - { - case GSS_S_COMPLETE: return SEC_E_OK; - case GSS_S_BAD_MECH: return SEC_E_SECPKG_NOT_FOUND; - case GSS_S_BAD_SIG: return SEC_E_MESSAGE_ALTERED; - case GSS_S_NO_CRED: return SEC_E_NO_CREDENTIALS; - case GSS_S_NO_CONTEXT: return SEC_E_INVALID_HANDLE; - case GSS_S_DEFECTIVE_TOKEN: return SEC_E_INVALID_TOKEN; - case GSS_S_DEFECTIVE_CREDENTIAL: return SEC_E_NO_CREDENTIALS; - case GSS_S_CREDENTIALS_EXPIRED: return SEC_E_CONTEXT_EXPIRED; - case GSS_S_CONTEXT_EXPIRED: return SEC_E_CONTEXT_EXPIRED; - case GSS_S_BAD_QOP: return SEC_E_QOP_NOT_SUPPORTED; - case GSS_S_CONTINUE_NEEDED: return SEC_I_CONTINUE_NEEDED; - case GSS_S_DUPLICATE_TOKEN: return SEC_E_INVALID_TOKEN; - case GSS_S_OLD_TOKEN: return SEC_E_INVALID_TOKEN; - case GSS_S_UNSEQ_TOKEN: return SEC_E_OUT_OF_SEQUENCE; - case GSS_S_GAP_TOKEN: return SEC_E_OUT_OF_SEQUENCE; - case GSS_S_FAILURE: return SEC_E_INTERNAL_ERROR; - - default: - FIXME( "couldn't convert status 0x%08x to NTSTATUS\n", status ); - return SEC_E_INTERNAL_ERROR; - } -} - -static void trace_gss_status_ex( OM_uint32 code, int type ) -{ - OM_uint32 ret, minor_status; - gss_buffer_desc buf; - OM_uint32 message_context = 0; - - for (;;) - { - ret = pgss_display_status( &minor_status, code, type, GSS_C_NULL_OID, &message_context, &buf ); - if (GSS_ERROR(ret)) - { - TRACE( "gss_display_status(0x%08x,%d) returned %08x minor status %08x\n", - code, type, ret, minor_status ); - return; - } - TRACE( "GSS-API error: 0x%08x: %s\n", code, debugstr_an(buf.value, buf.length) ); - pgss_release_buffer( &minor_status, &buf ); - - if (!message_context) return; - } -} - -static void trace_gss_status( OM_uint32 major_status, OM_uint32 minor_status ) -{ - if (TRACE_ON(kerberos)) - { - trace_gss_status_ex( major_status, GSS_C_GSS_CODE ); - trace_gss_status_ex( minor_status, GSS_C_MECH_CODE ); - } -} - -static BOOL is_dce_style_context( gss_ctx_id_t ctxt_handle ) -{ - OM_uint32 ret, minor_status, flags; - ret = pgss_inquire_context( &minor_status, ctxt_handle, NULL, NULL, NULL, NULL, &flags, NULL, NULL ); - return (ret == GSS_S_COMPLETE && (flags & GSS_C_DCE_STYLE)); -} - -static int get_buffer_index( SecBufferDesc *desc, DWORD type ) -{ - UINT i; - if (!desc) return -1; - for (i = 0; i < desc->cBuffers; i++) - { - if (desc->pBuffers[i].BufferType == type) return i; - } - return -1; -} -#endif /* SONAME_LIBGSSAPI_KRB5 */ - static char *get_str_unixcp( const UNICODE_STRING *str ) { char *ret; @@ -955,20 +797,12 @@ static NTSTATUS NTAPI kerberos_SpInitialize(ULONG_PTR package_id, SECPKG_PARAMET WARN( "no Kerberos support\n" ); return STATUS_UNSUCCESSFUL; } -#ifdef SONAME_LIBGSSAPI_KRB5 - if (load_gssapi_krb5()) return STATUS_SUCCESS; -#endif return STATUS_SUCCESS; } static NTSTATUS NTAPI kerberos_SpShutdown(void) { TRACE("\n"); - -#ifdef SONAME_LIBGSSAPI_KRB5 - unload_gssapi_krb5(); -#endif - return STATUS_SUCCESS; } @@ -1060,93 +894,14 @@ static NTSTATUS NTAPI kerberos_SpSealMessage( LSA_SEC_HANDLE context, ULONG qual return krb5_funcs->seal_message( context, message, quality_of_protection ); } -#ifdef SONAME_LIBGSSAPI_KRB5 -static NTSTATUS unseal_message_iov( gss_ctx_id_t ctxt_handle, SecBufferDesc *message, ULONG *quality_of_protection ) -{ - gss_iov_buffer_desc iov[4]; - OM_uint32 ret, minor_status; - int token_idx, data_idx, conf_state; - - if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; - if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - - iov[0].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY; - iov[0].buffer.length = 0; - iov[0].buffer.value = NULL; - - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.length = message->pBuffers[data_idx].cbBuffer; - iov[1].buffer.value = message->pBuffers[data_idx].pvBuffer; - - iov[2].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY; - iov[2].buffer.length = 0; - iov[2].buffer.value = NULL; - - iov[3].type = GSS_IOV_BUFFER_TYPE_HEADER; - iov[3].buffer.length = message->pBuffers[token_idx].cbBuffer; - iov[3].buffer.value = message->pBuffers[token_idx].pvBuffer; - - ret = pgss_unwrap_iov( &minor_status, ctxt_handle, &conf_state, NULL, iov, 4 ); - TRACE( "gss_unwrap_iov returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE && quality_of_protection) - { - *quality_of_protection = (conf_state ? 0 : SECQOP_WRAP_NO_ENCRYPT); - } - return status_gss_to_sspi( ret ); -} - -static NTSTATUS unseal_message( gss_ctx_id_t ctxt_handle, SecBufferDesc *message, ULONG *quality_of_protection ) -{ - gss_buffer_desc input, output; - OM_uint32 ret, minor_status; - int token_idx, data_idx, conf_state; - DWORD len_data, len_token; - - if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; - if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - - len_data = message->pBuffers[data_idx].cbBuffer; - len_token = message->pBuffers[token_idx].cbBuffer; - - input.length = len_data + len_token; - if (!(input.value = heap_alloc( input.length ))) return SEC_E_INSUFFICIENT_MEMORY; - memcpy( input.value, message->pBuffers[data_idx].pvBuffer, len_data ); - memcpy( (char *)input.value + len_data, message->pBuffers[token_idx].pvBuffer, len_token ); - - ret = pgss_unwrap( &minor_status, ctxt_handle, &input, &output, &conf_state, NULL ); - heap_free( input.value ); - TRACE( "gss_unwrap returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE) - { - if (quality_of_protection) *quality_of_protection = (conf_state ? 0 : SECQOP_WRAP_NO_ENCRYPT); - memcpy( message->pBuffers[data_idx].pvBuffer, output.value, len_data ); - pgss_release_buffer( &minor_status, &output ); - } - - return status_gss_to_sspi( ret ); -} -#endif - static NTSTATUS NTAPI kerberos_SpUnsealMessage( LSA_SEC_HANDLE context, SecBufferDesc *message, ULONG message_seq_no, ULONG *quality_of_protection ) { -#ifdef SONAME_LIBGSSAPI_KRB5 - gss_ctx_id_t ctxt_handle; - TRACE( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection ); if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no ); if (!context) return SEC_E_INVALID_HANDLE; - ctxt_handle = ctxthandle_sspi_to_gss( context ); - - if (is_dce_style_context( ctxt_handle )) return unseal_message_iov( ctxt_handle, message, quality_of_protection ); - return unseal_message( ctxt_handle, message, quality_of_protection ); -#else - FIXME( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + return krb5_funcs->unseal_message( context, message, quality_of_protection ); } static SECPKG_USER_FUNCTION_TABLE kerberos_user_table = @@ -1175,7 +930,6 @@ NTSTATUS NTAPI SpUserModeInitialize(ULONG lsa_version, PULONG package_version, *package_version = SECPKG_INTERFACE_VERSION; *table = &kerberos_user_table; *table_count = 1; - return STATUS_SUCCESS; } diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c index 6ac9c294352..4e9b90eeccf 100644 --- a/dlls/kerberos/unixlib.c +++ b/dlls/kerberos/unixlib.c @@ -734,6 +734,81 @@ static NTSTATUS CDECL seal_message( LSA_SEC_HANDLE context, SecBufferDesc *msg, return seal_message_no_vector( ctx, msg, qop ); } +static NTSTATUS unseal_message_vector( gss_ctx_id_t ctx, SecBufferDesc *msg, ULONG *qop ) +{ + gss_iov_buffer_desc iov[4]; + OM_uint32 ret, minor_status; + int token_idx, data_idx, conf_state; + + if ((data_idx = get_buffer_index( msg, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; + if ((token_idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + + iov[0].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY; + iov[0].buffer.length = 0; + iov[0].buffer.value = NULL; + + iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; + iov[1].buffer.length = msg->pBuffers[data_idx].cbBuffer; + iov[1].buffer.value = msg->pBuffers[data_idx].pvBuffer; + + iov[2].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY; + iov[2].buffer.length = 0; + iov[2].buffer.value = NULL; + + iov[3].type = GSS_IOV_BUFFER_TYPE_HEADER; + iov[3].buffer.length = msg->pBuffers[token_idx].cbBuffer; + iov[3].buffer.value = msg->pBuffers[token_idx].pvBuffer; + + ret = pgss_unwrap_iov( &minor_status, ctx, &conf_state, NULL, iov, 4 ); + TRACE( "gss_unwrap_iov returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE && qop) + { + *qop = (conf_state ? 0 : SECQOP_WRAP_NO_ENCRYPT); + } + return status_gss_to_sspi( ret ); +} + +static NTSTATUS unseal_message_no_vector( gss_ctx_id_t ctx, SecBufferDesc *msg, ULONG *qop ) +{ + gss_buffer_desc input, output; + OM_uint32 ret, minor_status; + int token_idx, data_idx, conf_state; + DWORD len_data, len_token; + + if ((data_idx = get_buffer_index( msg, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; + if ((token_idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + + len_data = msg->pBuffers[data_idx].cbBuffer; + len_token = msg->pBuffers[token_idx].cbBuffer; + + input.length = len_data + len_token; + if (!(input.value = RtlAllocateHeap( GetProcessHeap(), 0, input.length ))) return SEC_E_INSUFFICIENT_MEMORY; + memcpy( input.value, msg->pBuffers[data_idx].pvBuffer, len_data ); + memcpy( (char *)input.value + len_data, msg->pBuffers[token_idx].pvBuffer, len_token ); + + ret = pgss_unwrap( &minor_status, ctx, &input, &output, &conf_state, NULL ); + RtlFreeHeap( GetProcessHeap(), 0, input.value ); + TRACE( "gss_unwrap returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE) + { + if (qop) *qop = (conf_state ? 0 : SECQOP_WRAP_NO_ENCRYPT); + memcpy( msg->pBuffers[data_idx].pvBuffer, output.value, len_data ); + pgss_release_buffer( &minor_status, &output ); + } + + return status_gss_to_sspi( ret ); +} + +static NTSTATUS CDECL unseal_message( LSA_SEC_HANDLE context, SecBufferDesc *msg, ULONG *qop ) +{ + gss_ctx_id_t ctx = ctxhandle_sspi_to_gss( context ); + + if (is_dce_style_context( ctx )) return unseal_message_vector( ctx, msg, qop ); + return unseal_message_no_vector( ctx, msg, qop ); +} + static NTSTATUS CDECL verify_signature( LSA_SEC_HANDLE context, SecBufferDesc *msg, ULONG *qop ) { OM_uint32 ret, minor_status; @@ -767,6 +842,7 @@ static const struct krb5_funcs funcs = make_signature, query_context_attributes, seal_message, + unseal_message, verify_signature, }; diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h index ec783d342e5..652a6e4f300 100644 --- a/dlls/kerberos/unixlib.h +++ b/dlls/kerberos/unixlib.h @@ -34,6 +34,7 @@ struct krb5_funcs NTSTATUS (CDECL *make_signature)(LSA_SEC_HANDLE, SecBufferDesc *); NTSTATUS (CDECL *query_context_attributes)(LSA_SEC_HANDLE, ULONG, void *); NTSTATUS (CDECL *seal_message)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG); + NTSTATUS (CDECL *unseal_message)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG *); NTSTATUS (CDECL *verify_signature)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG *); }; -- 2.30.2

1 0

[PATCH 2/7] kerberos: Move support for SpSealMessage to the Unix library.
by Hans Leidekker April 21, 2021

April 21, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 107 +--------------------------------------- dlls/kerberos/unixlib.c | 102 ++++++++++++++++++++++++++++++++++++++ dlls/kerberos/unixlib.h | 1 + 3 files changed, 104 insertions(+), 106 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index 61833b4e040..d248c4e1951 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -1050,119 +1050,14 @@ static NTSTATUS NTAPI kerberos_SpVerifySignature( LSA_SEC_HANDLE context, SecBuf return krb5_funcs->verify_signature( context, message, quality_of_protection ); } -#ifdef SONAME_LIBGSSAPI_KRB5 -static NTSTATUS seal_message_iov( gss_ctx_id_t ctxt_handle, SecBufferDesc *message, ULONG quality_of_protection ) -{ - gss_iov_buffer_desc iov[4]; - OM_uint32 ret, minor_status; - int token_idx, data_idx, conf_flag, conf_state; - - if (!quality_of_protection) - conf_flag = 1; /* confidentiality + integrity */ - else if (quality_of_protection == SECQOP_WRAP_NO_ENCRYPT) - conf_flag = 0; /* only integrity */ - else - { - FIXME( "QOP %08x not supported\n", quality_of_protection ); - return SEC_E_UNSUPPORTED_FUNCTION; - } - - /* FIXME: multiple data buffers, read-only buffers */ - if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; - if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - - iov[0].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY | GSS_IOV_BUFFER_FLAG_ALLOCATE; - iov[0].buffer.length = 0; - iov[0].buffer.value = NULL; - - iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[1].buffer.length = message->pBuffers[data_idx].cbBuffer; - iov[1].buffer.value = message->pBuffers[data_idx].pvBuffer; - - iov[2].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY | GSS_IOV_BUFFER_FLAG_ALLOCATE; - iov[2].buffer.length = 0; - iov[2].buffer.value = NULL; - - iov[3].type = GSS_IOV_BUFFER_TYPE_HEADER | GSS_IOV_BUFFER_FLAG_ALLOCATE; - iov[3].buffer.length = 0; - iov[3].buffer.value = NULL; - - ret = pgss_wrap_iov( &minor_status, ctxt_handle, conf_flag, GSS_C_QOP_DEFAULT, &conf_state, iov, 4 ); - TRACE( "gss_wrap_iov returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE) - { - memcpy( message->pBuffers[token_idx].pvBuffer, iov[3].buffer.value, iov[3].buffer.length ); - message->pBuffers[token_idx].cbBuffer = iov[3].buffer.length; - pgss_release_iov_buffer( &minor_status, iov, 4 ); - } - - return status_gss_to_sspi( ret ); -} - -static NTSTATUS seal_message( gss_ctx_id_t ctxt_handle, SecBufferDesc *message, ULONG quality_of_protection ) -{ - gss_buffer_desc input, output; - OM_uint32 ret, minor_status; - int token_idx, data_idx, conf_flag, conf_state; - - if (!quality_of_protection) - conf_flag = 1; /* confidentiality + integrity */ - else if (quality_of_protection == SECQOP_WRAP_NO_ENCRYPT) - conf_flag = 0; /* only integrity */ - else - { - FIXME( "QOP %08x not supported\n", quality_of_protection ); - return SEC_E_UNSUPPORTED_FUNCTION; - } - - /* FIXME: multiple data buffers, read-only buffers */ - if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; - if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - - input.length = message->pBuffers[data_idx].cbBuffer; - input.value = message->pBuffers[data_idx].pvBuffer; - - ret = pgss_wrap( &minor_status, ctxt_handle, conf_flag, GSS_C_QOP_DEFAULT, &input, &conf_state, &output ); - TRACE( "gss_wrap returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE) - { - DWORD len_data = message->pBuffers[data_idx].cbBuffer, len_token = message->pBuffers[token_idx].cbBuffer; - if (len_token < output.length - len_data) - { - TRACE( "buffer too small %lu > %u\n", (SIZE_T)output.length - len_data, len_token ); - pgss_release_buffer( &minor_status, &output ); - return SEC_E_BUFFER_TOO_SMALL; - } - memcpy( message->pBuffers[data_idx].pvBuffer, output.value, len_data ); - memcpy( message->pBuffers[token_idx].pvBuffer, (char *)output.value + len_data, output.length - len_data ); - message->pBuffers[token_idx].cbBuffer = output.length - len_data; - pgss_release_buffer( &minor_status, &output ); - } - - return status_gss_to_sspi( ret ); -} -#endif - static NTSTATUS NTAPI kerberos_SpSealMessage( LSA_SEC_HANDLE context, ULONG quality_of_protection, SecBufferDesc *message, ULONG message_seq_no ) { -#ifdef SONAME_LIBGSSAPI_KRB5 - gss_ctx_id_t ctxt_handle; - TRACE( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no ); if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no ); if (!context) return SEC_E_INVALID_HANDLE; - ctxt_handle = ctxthandle_sspi_to_gss( context ); - - if (is_dce_style_context( ctxt_handle )) return seal_message_iov( ctxt_handle, message, quality_of_protection ); - return seal_message( ctxt_handle, message, quality_of_protection ); -#else - FIXME( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + return krb5_funcs->seal_message( context, message, quality_of_protection ); } #ifdef SONAME_LIBGSSAPI_KRB5 diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c index 34da8460406..6ac9c294352 100644 --- a/dlls/kerberos/unixlib.c +++ b/dlls/kerberos/unixlib.c @@ -633,6 +633,107 @@ static NTSTATUS CDECL query_context_attributes( LSA_SEC_HANDLE context, ULONG at return SEC_E_UNSUPPORTED_FUNCTION; } +static NTSTATUS seal_message_vector( gss_ctx_id_t ctx, SecBufferDesc *msg, ULONG qop ) +{ + gss_iov_buffer_desc iov[4]; + OM_uint32 ret, minor_status; + int token_idx, data_idx, conf_flag, conf_state; + + if (!qop) + conf_flag = 1; /* confidentiality + integrity */ + else if (qop == SECQOP_WRAP_NO_ENCRYPT) + conf_flag = 0; /* only integrity */ + else + { + FIXME( "QOP %08x not supported\n", qop ); + return SEC_E_UNSUPPORTED_FUNCTION; + } + + /* FIXME: multiple data buffers, read-only buffers */ + if ((data_idx = get_buffer_index( msg, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; + if ((token_idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + + iov[0].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY | GSS_IOV_BUFFER_FLAG_ALLOCATE; + iov[0].buffer.length = 0; + iov[0].buffer.value = NULL; + + iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; + iov[1].buffer.length = msg->pBuffers[data_idx].cbBuffer; + iov[1].buffer.value = msg->pBuffers[data_idx].pvBuffer; + + iov[2].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY | GSS_IOV_BUFFER_FLAG_ALLOCATE; + iov[2].buffer.length = 0; + iov[2].buffer.value = NULL; + + iov[3].type = GSS_IOV_BUFFER_TYPE_HEADER | GSS_IOV_BUFFER_FLAG_ALLOCATE; + iov[3].buffer.length = 0; + iov[3].buffer.value = NULL; + + ret = pgss_wrap_iov( &minor_status, ctx, conf_flag, GSS_C_QOP_DEFAULT, &conf_state, iov, 4 ); + TRACE( "gss_wrap_iov returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE) + { + memcpy( msg->pBuffers[token_idx].pvBuffer, iov[3].buffer.value, iov[3].buffer.length ); + msg->pBuffers[token_idx].cbBuffer = iov[3].buffer.length; + pgss_release_iov_buffer( &minor_status, iov, 4 ); + } + + return status_gss_to_sspi( ret ); +} + +static NTSTATUS seal_message_no_vector( gss_ctx_id_t ctx, SecBufferDesc *msg, ULONG qop ) +{ + gss_buffer_desc input, output; + OM_uint32 ret, minor_status; + int token_idx, data_idx, conf_flag, conf_state; + + if (!qop) + conf_flag = 1; /* confidentiality + integrity */ + else if (qop == SECQOP_WRAP_NO_ENCRYPT) + conf_flag = 0; /* only integrity */ + else + { + FIXME( "QOP %08x not supported\n", qop ); + return SEC_E_UNSUPPORTED_FUNCTION; + } + + /* FIXME: multiple data buffers, read-only buffers */ + if ((data_idx = get_buffer_index( msg, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; + if ((token_idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + + input.length = msg->pBuffers[data_idx].cbBuffer; + input.value = msg->pBuffers[data_idx].pvBuffer; + + ret = pgss_wrap( &minor_status, ctx, conf_flag, GSS_C_QOP_DEFAULT, &input, &conf_state, &output ); + TRACE( "gss_wrap returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE) + { + DWORD len_data = msg->pBuffers[data_idx].cbBuffer, len_token = msg->pBuffers[token_idx].cbBuffer; + if (len_token < output.length - len_data) + { + TRACE( "buffer too small %lu > %u\n", (SIZE_T)output.length - len_data, len_token ); + pgss_release_buffer( &minor_status, &output ); + return SEC_E_BUFFER_TOO_SMALL; + } + memcpy( msg->pBuffers[data_idx].pvBuffer, output.value, len_data ); + memcpy( msg->pBuffers[token_idx].pvBuffer, (char *)output.value + len_data, output.length - len_data ); + msg->pBuffers[token_idx].cbBuffer = output.length - len_data; + pgss_release_buffer( &minor_status, &output ); + } + + return status_gss_to_sspi( ret ); +} + +static NTSTATUS CDECL seal_message( LSA_SEC_HANDLE context, SecBufferDesc *msg, ULONG qop ) +{ + gss_ctx_id_t ctx = ctxhandle_sspi_to_gss( context ); + + if (is_dce_style_context( ctx )) return seal_message_vector( ctx, msg, qop ); + return seal_message_no_vector( ctx, msg, qop ); +} + static NTSTATUS CDECL verify_signature( LSA_SEC_HANDLE context, SecBufferDesc *msg, ULONG *qop ) { OM_uint32 ret, minor_status; @@ -665,6 +766,7 @@ static const struct krb5_funcs funcs = initialize_context, make_signature, query_context_attributes, + seal_message, verify_signature, }; diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h index 8fd562a28d7..ec783d342e5 100644 --- a/dlls/kerberos/unixlib.h +++ b/dlls/kerberos/unixlib.h @@ -33,6 +33,7 @@ struct krb5_funcs LSA_SEC_HANDLE *, SecBufferDesc *, ULONG *, TimeStamp *); NTSTATUS (CDECL *make_signature)(LSA_SEC_HANDLE, SecBufferDesc *); NTSTATUS (CDECL *query_context_attributes)(LSA_SEC_HANDLE, ULONG, void *); + NTSTATUS (CDECL *seal_message)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG); NTSTATUS (CDECL *verify_signature)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG *); }; -- 2.30.2

1 0

[PATCH 1/7] kerberos: Move support for SpQueryContextAttributes to the Unix library.
by Hans Leidekker April 21, 2021

April 21, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 18 +--------------- dlls/kerberos/unixlib.c | 47 +++++++++++++++++++++++++++++++++++++++++ dlls/kerberos/unixlib.h | 3 +++ 3 files changed, 51 insertions(+), 17 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index f3cbf34ee81..61833b4e040 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -927,23 +927,7 @@ static NTSTATUS NTAPI kerberos_SpQueryContextAttributes( LSA_SEC_HANDLE context, X(SECPKG_ATTR_TARGET_INFORMATION); case SECPKG_ATTR_SIZES: { - SecPkgContext_Sizes *sizes = (SecPkgContext_Sizes *)buffer; - ULONG size_max_signature = 37, size_security_trailer = 49; -#ifdef SONAME_LIBGSSAPI_KRB5 - gss_ctx_id_t ctxt_handle; - - if (!(ctxt_handle = ctxthandle_sspi_to_gss( context ))) return SEC_E_INVALID_HANDLE; - if (is_dce_style_context( ctxt_handle )) - { - size_max_signature = 28; - size_security_trailer = 76; - } -#endif - sizes->cbMaxToken = KERBEROS_MAX_BUF; - sizes->cbMaxSignature = size_max_signature; - sizes->cbBlockSize = 1; - sizes->cbSecurityTrailer = size_security_trailer; - return SEC_E_OK; + return krb5_funcs->query_context_attributes( context, attribute, buffer ); } case SECPKG_ATTR_NEGOTIATION_INFO: { diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c index 06f0ffc8a04..34da8460406 100644 --- a/dlls/kerberos/unixlib.c +++ b/dlls/kerberos/unixlib.c @@ -211,6 +211,13 @@ fail: return FALSE; } +static BOOL is_dce_style_context( gss_ctx_id_t ctx ) +{ + OM_uint32 ret, minor_status, flags; + ret = pgss_inquire_context( &minor_status, ctx, NULL, NULL, NULL, NULL, &flags, NULL, NULL ); + return (ret == GSS_S_COMPLETE && (flags & GSS_C_DCE_STYLE)); +} + static int get_buffer_index( SecBufferDesc *desc, DWORD type ) { UINT i; @@ -587,6 +594,45 @@ static NTSTATUS CDECL make_signature( LSA_SEC_HANDLE context, SecBufferDesc *msg return status_gss_to_sspi( ret ); } +#define KERBEROS_MAX_SIGNATURE 37 +#define KERBEROS_SECURITY_TRAILER 49 +#define KERBEROS_MAX_SIGNATURE_DCE 28 +#define KERBEROS_SECURITY_TRAILER_DCE 76 + +static NTSTATUS CDECL query_context_attributes( LSA_SEC_HANDLE context, ULONG attr, void *buf ) +{ + switch (attr) + { + case SECPKG_ATTR_SIZES: + { + SecPkgContext_Sizes *sizes = (SecPkgContext_Sizes *)buf; + ULONG size_max_signature, size_security_trailer; + gss_ctx_id_t ctx = ctxhandle_sspi_to_gss( context ); + + if (is_dce_style_context( ctx )) + { + size_max_signature = KERBEROS_MAX_SIGNATURE_DCE; + size_security_trailer = KERBEROS_SECURITY_TRAILER_DCE; + } + else + { + size_max_signature = KERBEROS_MAX_SIGNATURE; + size_security_trailer = KERBEROS_SECURITY_TRAILER; + } + sizes->cbMaxToken = KERBEROS_MAX_BUF; + sizes->cbMaxSignature = size_max_signature; + sizes->cbBlockSize = 1; + sizes->cbSecurityTrailer = size_security_trailer; + return SEC_E_OK; + } + default: + FIXME( "unhandled attribute %u\n", attr ); + break; + } + + return SEC_E_UNSUPPORTED_FUNCTION; +} + static NTSTATUS CDECL verify_signature( LSA_SEC_HANDLE context, SecBufferDesc *msg, ULONG *qop ) { OM_uint32 ret, minor_status; @@ -618,6 +664,7 @@ static const struct krb5_funcs funcs = free_credentials_handle, initialize_context, make_signature, + query_context_attributes, verify_signature, }; diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h index 6a73444aae8..8fd562a28d7 100644 --- a/dlls/kerberos/unixlib.h +++ b/dlls/kerberos/unixlib.h @@ -19,6 +19,8 @@ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA */ +#define KERBEROS_MAX_BUF 12000 + struct krb5_funcs { NTSTATUS (CDECL *accept_context)(LSA_SEC_HANDLE, LSA_SEC_HANDLE, SecBufferDesc *, LSA_SEC_HANDLE *, @@ -30,6 +32,7 @@ struct krb5_funcs NTSTATUS (CDECL *initialize_context)(LSA_SEC_HANDLE, LSA_SEC_HANDLE, const char *, ULONG, SecBufferDesc *, LSA_SEC_HANDLE *, SecBufferDesc *, ULONG *, TimeStamp *); NTSTATUS (CDECL *make_signature)(LSA_SEC_HANDLE, SecBufferDesc *); + NTSTATUS (CDECL *query_context_attributes)(LSA_SEC_HANDLE, ULONG, void *); NTSTATUS (CDECL *verify_signature)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG *); }; -- 2.30.2

1 0

[PATCH] winetest: Trace skipped dlls when in exclude (-n) mode.
by Francois Gouget April 21, 2021

April 21, 2021

When the command line specifies the list of tests to run, tracing all the skipped dlls unnecessarily spams the test output. But when the command line contains the list of (at most 64) excluded dlls, tracing them ensures tools analysing the report know why the corresponding dlls were skipped. Signed-off-by: Francois Gouget <fgouget(a)codeweavers.com> --- The TestBot specifies the list of tests to run on the WineTest command line which is why a previous commit removed this trace (9b1431459d30). But it was unnecessarily broad. This version of the patch does not interfere with the TestBot and ensures test.winehq.org can report the right status for skipped dlls. --- programs/winetest/main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/programs/winetest/main.c b/programs/winetest/main.c index 107151c927f..cb2f23a161e 100644 --- a/programs/winetest/main.c +++ b/programs/winetest/main.c @@ -918,6 +918,7 @@ extract_test_proc (HMODULE hModule, LPCSTR lpszType, LPSTR lpszName, LONG_PTR lP if (test_filtered_out( lpszName, NULL )) { nr_of_skips++; + if (exclude_tests) xprintf (" %s=skipped\n", dllname); return TRUE; } extract_test (&wine_tests[nr_of_files], tempdir, lpszName); -- 2.20.1

1 0

[PATCH] po: Update Dutch translation
by Floris Renaud April 21, 2021

April 21, 2021

Signed-off-by: Floris Renaud <jkfloris(a)dds.nl> --- po/nl.po | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/po/nl.po b/po/nl.po index 51d7f73cb8f..5ee44aa2c56 100644 --- a/po/nl.po +++ b/po/nl.po @@ -5,7 +5,7 @@ msgstr "" "Project-Id-Version: Wine\n" "Report-Msgid-Bugs-To: https://bugs.winehq.org\n" "POT-Creation-Date: N/A\n" -"PO-Revision-Date: 2021-04-09 10:15+0200\n" +"PO-Revision-Date: 2021-04-21 09:20+0200\n" "Last-Translator: Floris Renaud <jkfloris(a)dds.nl>\n" "Language-Team: Dutch\n" "Language: nl\n" @@ -14761,10 +14761,8 @@ msgstr "" "\n" #: programs/reg/reg.rc:172 -#, fuzzy -#| msgid "reg: Invalid system key [%1]\n" msgid "reg: Invalid system key\n" -msgstr "reg: Foutieve systeemsleutel [%1]\n" +msgstr "reg: Foutieve systeemsleutel\n" #: programs/reg/reg.rc:173 msgid "The file '%1' already exists. Do you want to overwrite it?" -- 2.31.0

1 0

[PATCH] po: Update Lithuanian translation
by Aurimas Fišeras April 21, 2021

April 21, 2021

1 0

[PATCH 1/3] mfplat: Add support for AudioFormat_Float in MFCreateWaveFormatExFromMFMediaType.
by Connor McAdams April 21, 2021

April 21, 2021

Add support for the MFAudioFormat_Float subtype in MFCreateWaveFormatExFromMFMediaType. Signed-off-by: Connor McAdams <cmcadams(a)codeweavers.com> --- dlls/mfplat/mediatype.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/dlls/mfplat/mediatype.c b/dlls/mfplat/mediatype.c index c8028b2a46f..4904dbb566f 100644 --- a/dlls/mfplat/mediatype.c +++ b/dlls/mfplat/mediatype.c @@ -2884,7 +2884,7 @@ HRESULT WINAPI MFCreateWaveFormatExFromMFMediaType(IMFMediaType *mediatype, WAVE if (!IsEqualGUID(&major, &MFMediaType_Audio)) return E_INVALIDARG; - if (!IsEqualGUID(&subtype, &MFAudioFormat_PCM)) + if (!IsEqualGUID(&subtype, &MFAudioFormat_PCM) && !IsEqualGUID(&subtype, &MFAudioFormat_Float)) { FIXME("Unsupported audio format %s.\n", debugstr_guid(&subtype)); return E_NOTIMPL; @@ -2908,7 +2908,12 @@ HRESULT WINAPI MFCreateWaveFormatExFromMFMediaType(IMFMediaType *mediatype, WAVE memset(format, 0, *size); - format->wFormatTag = format_ext ? WAVE_FORMAT_EXTENSIBLE : WAVE_FORMAT_PCM; + if (format_ext) + format->wFormatTag = WAVE_FORMAT_EXTENSIBLE; + else if (IsEqualGUID(&subtype, &MFAudioFormat_Float)) + format->wFormatTag = WAVE_FORMAT_IEEE_FLOAT; + else + format->wFormatTag = WAVE_FORMAT_PCM; if (SUCCEEDED(IMFMediaType_GetUINT32(mediatype, &MF_MT_AUDIO_NUM_CHANNELS, &value))) format->nChannels = value; -- 2.25.1

2 3