April 2021 - Wine-Devel - list.winehq.org

[PATCH] ntdll: Fix a MSVC amd64 C4334 warning
by Serge Gautherie April 20, 2021

April 20, 2021

Signed-off-by: Serge Gautherie <winehq-git_serge_180711(a)gautherie.fr> --- ReactOS: '...\sdk\lib\rtl\compress.c(62): warning C4334: '<<': result of 32-bit shift implicitly converted to 64 bits (was 64-bit shift intended?)' --- dlls/ntdll/rtl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/dlls/ntdll/rtl.c b/dlls/ntdll/rtl.c index cf21c98..df9dd8d 100644 --- a/dlls/ntdll/rtl.c +++ b/dlls/ntdll/rtl.c @@ -1877,7 +1877,10 @@ static UCHAR *lznt1_decompress_chunk(UCHAR *dst, ULONG dst_size, UCHAR *src, ULO /* find length / displacement bits */ for (displacement_bits = 12; displacement_bits > 4; displacement_bits--) - if ((1 << (displacement_bits - 1)) < dst_cur - dst) break; + { + if (((SIZE_T)1 << (displacement_bits - 1)) < dst_cur - dst) + break; + } length_bits = 16 - displacement_bits; code_length = (code & ((1 << length_bits) - 1)) + 3; -- 2.10.0.windows.1

2 2

[PATCH 1/5] kerberos: Move support for SpAcquireCredentialsHandle/SpFreeCredentialsHandle to a new Unix library.
by Hans Leidekker April 20, 2021

April 20, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/Makefile.in | 3 +- dlls/kerberos/krb5_ap.c | 189 ++++++------------ dlls/kerberos/unixlib.c | 399 ++++++++++++++++++++++++++++++++++++++ dlls/kerberos/unixlib.h | 26 +++ 4 files changed, 488 insertions(+), 129 deletions(-) create mode 100644 dlls/kerberos/unixlib.c create mode 100644 dlls/kerberos/unixlib.h diff --git a/dlls/kerberos/Makefile.in b/dlls/kerberos/Makefile.in index f67ba567fb0..ab5e6b59976 100644 --- a/dlls/kerberos/Makefile.in +++ b/dlls/kerberos/Makefile.in @@ -2,4 +2,5 @@ MODULE = kerberos.dll EXTRAINCL = $(KRB5_CFLAGS) $(GSSAPI_CFLAGS) C_SRCS = \ - krb5_ap.c + krb5_ap.c \ + unixlib.c diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index 44d6b86e019..08265beeceb 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -46,9 +46,14 @@ #include "wine/heap.h" #include "wine/debug.h" #include "wine/unicode.h" +#include "unixlib.h" WINE_DEFAULT_DEBUG_CHANNEL(kerberos); +static HINSTANCE instance; + +const struct krb5_funcs *krb5_funcs = NULL; + #define KERBEROS_MAX_BUF 12000 #define KERBEROS_CAPS \ @@ -840,8 +845,19 @@ static int get_buffer_index( SecBufferDesc *desc, DWORD type ) } return -1; } +#endif /* SONAME_LIBGSSAPI_KRB5 */ -static char *get_user_at_domain( const WCHAR *user, ULONG user_len, const WCHAR *domain, ULONG domain_len ) +static char *get_str_unixcp( const UNICODE_STRING *str ) +{ + char *ret; + int len = WideCharToMultiByte( CP_UNIXCP, 0, str->Buffer, str->Length / sizeof(WCHAR), NULL, 0, NULL, NULL ); + if (!(ret = heap_alloc( len + 1 ))) return NULL; + WideCharToMultiByte( CP_UNIXCP, 0, str->Buffer, str->Length / sizeof(WCHAR), ret, len, NULL, NULL ); + ret[len] = 0; + return ret; +} + +static char *get_username_unixcp( const WCHAR *user, ULONG user_len, const WCHAR *domain, ULONG domain_len ) { int len_user, len_domain; char *ret; @@ -857,7 +873,7 @@ static char *get_user_at_domain( const WCHAR *user, ULONG user_len, const WCHAR return ret; } -static char *get_password( const WCHAR *passwd, ULONG passwd_len ) +static char *get_password_unixcp( const WCHAR *passwd, ULONG passwd_len ) { int len; char *ret; @@ -869,145 +885,44 @@ static char *get_password( const WCHAR *passwd, ULONG passwd_len ) return ret; } -static NTSTATUS init_creds( const SEC_WINNT_AUTH_IDENTITY_W *id ) -{ - char *user_at_domain, *password; - krb5_context ctx; - krb5_principal principal = NULL; - krb5_get_init_creds_opt *options = NULL; - krb5_ccache cache = NULL; - krb5_creds creds; - krb5_error_code err; - - if (!id) return STATUS_SUCCESS; - if (id->Flags & SEC_WINNT_AUTH_IDENTITY_ANSI) - { - FIXME( "ANSI identity not supported\n" ); - return SEC_E_UNSUPPORTED_FUNCTION; - } - if (!(user_at_domain = get_user_at_domain( id->User, id->UserLength, id->Domain, id->DomainLength ))) - { - return SEC_E_INSUFFICIENT_MEMORY; - } - if (!(password = get_password( id->Password, id->PasswordLength ))) - { - heap_free( user_at_domain ); - return SEC_E_INSUFFICIENT_MEMORY; - } - - if ((err = p_krb5_init_context( &ctx ))) - { - heap_free( password ); - heap_free( user_at_domain ); - return krb5_error_to_status( err ); - } - if ((err = p_krb5_parse_name_flags( ctx, user_at_domain, 0, &principal ))) goto done; - if ((err = p_krb5_cc_default( ctx, &cache ))) goto done; - if ((err = p_krb5_get_init_creds_opt_alloc( ctx, &options ))) goto done; - if ((err = p_krb5_get_init_creds_opt_set_out_ccache( ctx, options, cache ))) goto done; - if ((err = p_krb5_get_init_creds_password( ctx, &creds, principal, password, 0, NULL, 0, NULL, 0 ))) goto done; - if ((err = p_krb5_cc_initialize( ctx, cache, principal ))) goto done; - if ((err = p_krb5_cc_store_cred( ctx, cache, &creds ))) goto done; - - TRACE( "success\n" ); - p_krb5_free_cred_contents( ctx, &creds ); - -done: - if (cache) p_krb5_cc_close( ctx, cache ); - if (principal) p_krb5_free_principal( ctx, principal ); - if (options) p_krb5_get_init_creds_opt_free( ctx, options ); - p_krb5_free_context( ctx ); - heap_free( user_at_domain ); - heap_free( password ); - - return krb5_error_to_status( err ); -} - -static NTSTATUS acquire_credentials_handle( UNICODE_STRING *principal_us, gss_cred_usage_t cred_usage, - LSA_SEC_HANDLE *credential, TimeStamp *ts_expiry ) -{ - OM_uint32 ret, minor_status, expiry_time; - gss_name_t principal = GSS_C_NO_NAME; - gss_cred_id_t cred_handle; - NTSTATUS status; - - if (principal_us && ((status = name_sspi_to_gss( principal_us, &principal )) != SEC_E_OK)) return status; - - ret = pgss_acquire_cred( &minor_status, principal, GSS_C_INDEFINITE, GSS_C_NULL_OID_SET, cred_usage, - &cred_handle, NULL, &expiry_time ); - TRACE( "gss_acquire_cred returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE) - { - credhandle_gss_to_sspi( cred_handle, credential ); - expirytime_gss_to_sspi( expiry_time, ts_expiry ); - } - - if (principal != GSS_C_NO_NAME) pgss_release_name( &minor_status, &principal ); - - return status_gss_to_sspi( ret ); -} -#endif /* SONAME_LIBGSSAPI_KRB5 */ - static NTSTATUS NTAPI kerberos_SpAcquireCredentialsHandle( UNICODE_STRING *principal_us, ULONG credential_use, LUID *logon_id, void *auth_data, - void *get_key_fn, void *get_key_arg, LSA_SEC_HANDLE *credential, TimeStamp *ts_expiry ) + void *get_key_fn, void *get_key_arg, LSA_SEC_HANDLE *credential, TimeStamp *expiry ) { -#ifdef SONAME_LIBGSSAPI_KRB5 - gss_cred_usage_t cred_usage; - NTSTATUS status; + char *principal = NULL, *username = NULL, *password = NULL; + SEC_WINNT_AUTH_IDENTITY_W *id = auth_data; + NTSTATUS status = SEC_E_INSUFFICIENT_MEMORY; TRACE( "(%s 0x%08x %p %p %p %p %p %p)\n", debugstr_us(principal_us), credential_use, - logon_id, auth_data, get_key_fn, get_key_arg, credential, ts_expiry ); + logon_id, auth_data, get_key_fn, get_key_arg, credential, expiry ); - switch (credential_use) + if (principal_us && !(principal = get_str_unixcp( principal_us ))) return SEC_E_INSUFFICIENT_MEMORY; + if (id) { - case SECPKG_CRED_INBOUND: - cred_usage = GSS_C_ACCEPT; - break; - - case SECPKG_CRED_OUTBOUND: - if ((status = init_creds( auth_data )) != STATUS_SUCCESS) return status; - cred_usage = GSS_C_INITIATE; - break; - - case SECPKG_CRED_BOTH: - cred_usage = GSS_C_BOTH; - break; - - default: - return SEC_E_UNKNOWN_CREDENTIALS; + if (id->Flags & SEC_WINNT_AUTH_IDENTITY_ANSI) + { + FIXME( "ANSI identity not supported\n" ); + status = SEC_E_UNSUPPORTED_FUNCTION; + goto done; + } + if (!(username = get_username_unixcp( id->User, id->UserLength, id->Domain, id->DomainLength ))) goto done; + if (!(password = get_password_unixcp( id->Password, id->PasswordLength ))) goto done; } - return acquire_credentials_handle( principal_us, cred_usage, credential, ts_expiry ); -#else - FIXME( "(%s 0x%08x %p %p %p %p %p %p)\n", debugstr_us(principal_us), credential_use, - logon_id, auth_data, get_key_fn, get_key_arg, credential, ts_expiry ); - FIXME( "Wine was built without Kerberos support.\n" ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + status = krb5_funcs->acquire_credentials_handle( principal, credential_use, username, password, credential, + expiry ); +done: + heap_free( principal ); + heap_free( username ); + heap_free( password ); + return status; } static NTSTATUS NTAPI kerberos_SpFreeCredentialsHandle( LSA_SEC_HANDLE credential ) { -#ifdef SONAME_LIBGSSAPI_KRB5 - OM_uint32 ret, minor_status; - gss_cred_id_t cred_handle; - TRACE( "(%lx)\n", credential ); - if (!credential) return SEC_E_INVALID_HANDLE; - if (!(cred_handle = credhandle_sspi_to_gss( credential ))) return SEC_E_OK; - - ret = pgss_release_cred( &minor_status, &cred_handle ); - TRACE( "gss_release_cred returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - - return status_gss_to_sspi( ret ); -#else - FIXME( "(%lx)\n", credential ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + return krb5_funcs->free_credentials_handle( credential ); } static NTSTATUS NTAPI kerberos_SpInitLsaModeContext( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context, @@ -1257,11 +1172,15 @@ static NTSTATUS NTAPI kerberos_SpInitialize(ULONG_PTR package_id, SECPKG_PARAMET { TRACE("%lu,%p,%p\n", package_id, params, lsa_function_table); + if (!krb5_funcs && __wine_init_unix_lib( instance, DLL_PROCESS_ATTACH, NULL, &krb5_funcs )) + { + WARN( "no Kerberos support\n" ); + return STATUS_UNSUCCESSFUL; + } #ifdef SONAME_LIBGSSAPI_KRB5 if (load_gssapi_krb5()) return STATUS_SUCCESS; #endif - - return STATUS_UNSUCCESSFUL; + return STATUS_SUCCESS; } static NTSTATUS NTAPI kerberos_SpShutdown(void) @@ -1644,3 +1563,17 @@ NTSTATUS NTAPI SpUserModeInitialize(ULONG lsa_version, PULONG package_version, return STATUS_SUCCESS; } + +BOOL WINAPI DllMain( HINSTANCE hinst, DWORD reason, void *reserved ) +{ + switch (reason) + { + case DLL_PROCESS_ATTACH: + instance = hinst; + DisableThreadLibraryCalls( hinst ); + break; + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c new file mode 100644 index 00000000000..ab7191432fe --- /dev/null +++ b/dlls/kerberos/unixlib.c @@ -0,0 +1,399 @@ +/* + * Unix interface for libkrb5/libgssapi_krb5 + * + * Copyright 2021 Hans Leidekker for CodeWeavers + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +#if 0 +#pragma makedep unix +#endif + +#include "config.h" +#if defined(SONAME_LIBKRB5) && defined(SONAME_LIBGSSAPI_KRB5) +#include "wine/port.h" + +#include <stdarg.h> +#ifdef HAVE_KRB5_KRB5_H +# include <krb5/krb5.h> +#endif +#ifdef HAVE_GSSAPI_GSSAPI_H +# include <gssapi/gssapi.h> +#endif +#ifdef HAVE_GSSAPI_GSSAPI_EXT_H +# include <gssapi/gssapi_ext.h> +#endif + +#include "ntstatus.h" +#define WIN32_NO_STATUS +#include "windef.h" +#include "winternl.h" +#include "winbase.h" +#include "rpc.h" +#include "sspi.h" +#include "ntsecapi.h" +#include "ntsecpkg.h" + +#include "wine/debug.h" +#include "unixlib.h" + +WINE_DEFAULT_DEBUG_CHANNEL(kerberos); +WINE_DECLARE_DEBUG_CHANNEL(winediag); + +static void *libkrb5_handle; + +#define MAKE_FUNCPTR(f) static typeof(f) * p_##f +MAKE_FUNCPTR( krb5_cc_close ); +MAKE_FUNCPTR( krb5_cc_default ); +MAKE_FUNCPTR( krb5_cc_end_seq_get ); +MAKE_FUNCPTR( krb5_cc_initialize ); +MAKE_FUNCPTR( krb5_cc_next_cred ); +MAKE_FUNCPTR( krb5_cc_start_seq_get ); +MAKE_FUNCPTR( krb5_cc_store_cred ); +MAKE_FUNCPTR( krb5_cccol_cursor_free ); +MAKE_FUNCPTR( krb5_cccol_cursor_new ); +MAKE_FUNCPTR( krb5_cccol_cursor_next ); +MAKE_FUNCPTR( krb5_decode_ticket ); +MAKE_FUNCPTR( krb5_free_context ); +MAKE_FUNCPTR( krb5_free_cred_contents ); +MAKE_FUNCPTR( krb5_free_principal ); +MAKE_FUNCPTR( krb5_free_ticket ); +MAKE_FUNCPTR( krb5_free_unparsed_name ); +MAKE_FUNCPTR( krb5_get_init_creds_opt_alloc ); +MAKE_FUNCPTR( krb5_get_init_creds_opt_free ); +MAKE_FUNCPTR( krb5_get_init_creds_opt_set_out_ccache ); +MAKE_FUNCPTR( krb5_get_init_creds_password ); +MAKE_FUNCPTR( krb5_init_context ); +MAKE_FUNCPTR( krb5_is_config_principal ); +MAKE_FUNCPTR( krb5_parse_name_flags ); +MAKE_FUNCPTR( krb5_unparse_name_flags ); +#undef MAKE_FUNCPTR + +static BOOL load_krb5(void) +{ + if (!(libkrb5_handle = dlopen( SONAME_LIBKRB5, RTLD_NOW ))) + { + WARN_(winediag)( "failed to load %s, Kerberos support will be disabled\n", SONAME_LIBKRB5 ); + return FALSE; + } + +#define LOAD_FUNCPTR(f) \ + if (!(p_##f = dlsym( libkrb5_handle, #f ))) \ + { \ + ERR( "failed to load %s\n", #f ); \ + goto fail; \ + } + + LOAD_FUNCPTR( krb5_cc_close ) + LOAD_FUNCPTR( krb5_cc_default ) + LOAD_FUNCPTR( krb5_cc_end_seq_get ) + LOAD_FUNCPTR( krb5_cc_initialize ) + LOAD_FUNCPTR( krb5_cc_next_cred ) + LOAD_FUNCPTR( krb5_cc_start_seq_get ) + LOAD_FUNCPTR( krb5_cc_store_cred ) + LOAD_FUNCPTR( krb5_cccol_cursor_free ) + LOAD_FUNCPTR( krb5_cccol_cursor_new ) + LOAD_FUNCPTR( krb5_cccol_cursor_next ) + LOAD_FUNCPTR( krb5_decode_ticket ) + LOAD_FUNCPTR( krb5_free_context ) + LOAD_FUNCPTR( krb5_free_cred_contents ) + LOAD_FUNCPTR( krb5_free_principal ) + LOAD_FUNCPTR( krb5_free_ticket ) + LOAD_FUNCPTR( krb5_free_unparsed_name ) + LOAD_FUNCPTR( krb5_get_init_creds_opt_alloc ) + LOAD_FUNCPTR( krb5_get_init_creds_opt_free ) + LOAD_FUNCPTR( krb5_get_init_creds_opt_set_out_ccache ) + LOAD_FUNCPTR( krb5_get_init_creds_password ) + LOAD_FUNCPTR( krb5_init_context ) + LOAD_FUNCPTR( krb5_is_config_principal ) + LOAD_FUNCPTR( krb5_parse_name_flags ) + LOAD_FUNCPTR( krb5_unparse_name_flags ) +#undef LOAD_FUNCPTR + return TRUE; + +fail: + dlclose( libkrb5_handle ); + libkrb5_handle = NULL; + return FALSE; +} + +static void unload_krb5(void) +{ + dlclose( libkrb5_handle ); + libkrb5_handle = NULL; +} + +static NTSTATUS krb5_error_to_status( krb5_error_code err ) +{ + switch (err) + { + case 0: return STATUS_SUCCESS; + default: return STATUS_UNSUCCESSFUL; /* FIXME */ + } +} + +static void *libgssapi_krb5_handle; + +#define MAKE_FUNCPTR(f) static typeof(f) * p##f +MAKE_FUNCPTR( gss_accept_sec_context ); +MAKE_FUNCPTR( gss_acquire_cred ); +MAKE_FUNCPTR( gss_delete_sec_context ); +MAKE_FUNCPTR( gss_display_status ); +MAKE_FUNCPTR( gss_get_mic ); +MAKE_FUNCPTR( gss_import_name ); +MAKE_FUNCPTR( gss_init_sec_context ); +MAKE_FUNCPTR( gss_inquire_context ); +MAKE_FUNCPTR( gss_release_buffer ); +MAKE_FUNCPTR( gss_release_cred ); +MAKE_FUNCPTR( gss_release_iov_buffer ); +MAKE_FUNCPTR( gss_release_name ); +MAKE_FUNCPTR( gss_unwrap ); +MAKE_FUNCPTR( gss_unwrap_iov ); +MAKE_FUNCPTR( gss_verify_mic ); +MAKE_FUNCPTR( gss_wrap ); +MAKE_FUNCPTR( gss_wrap_iov ); +#undef MAKE_FUNCPTR + +static BOOL load_gssapi_krb5(void) +{ + if (!(libgssapi_krb5_handle = dlopen( SONAME_LIBGSSAPI_KRB5, RTLD_NOW ))) + { + WARN_(winediag)( "failed to load %s, Kerberos support will be disabled\n", SONAME_LIBGSSAPI_KRB5 ); + return FALSE; + } + +#define LOAD_FUNCPTR(f) \ + if (!(p##f = dlsym( libgssapi_krb5_handle, #f ))) \ + { \ + ERR( "failed to load %s\n", #f ); \ + goto fail; \ + } + + LOAD_FUNCPTR( gss_accept_sec_context) + LOAD_FUNCPTR( gss_acquire_cred) + LOAD_FUNCPTR( gss_delete_sec_context) + LOAD_FUNCPTR( gss_display_status) + LOAD_FUNCPTR( gss_get_mic) + LOAD_FUNCPTR( gss_import_name) + LOAD_FUNCPTR( gss_init_sec_context) + LOAD_FUNCPTR( gss_inquire_context) + LOAD_FUNCPTR( gss_release_buffer) + LOAD_FUNCPTR( gss_release_cred) + LOAD_FUNCPTR( gss_release_iov_buffer) + LOAD_FUNCPTR( gss_release_name) + LOAD_FUNCPTR( gss_unwrap) + LOAD_FUNCPTR( gss_unwrap_iov) + LOAD_FUNCPTR( gss_verify_mic) + LOAD_FUNCPTR( gss_wrap ) + LOAD_FUNCPTR( gss_wrap_iov ) +#undef LOAD_FUNCPTR + return TRUE; + +fail: + dlclose( libgssapi_krb5_handle ); + libgssapi_krb5_handle = NULL; + return FALSE; +} + +static NTSTATUS status_gss_to_sspi( OM_uint32 status ) +{ + switch (status) + { + case GSS_S_COMPLETE: return SEC_E_OK; + case GSS_S_BAD_MECH: return SEC_E_SECPKG_NOT_FOUND; + case GSS_S_BAD_SIG: return SEC_E_MESSAGE_ALTERED; + case GSS_S_NO_CRED: return SEC_E_NO_CREDENTIALS; + case GSS_S_NO_CONTEXT: return SEC_E_INVALID_HANDLE; + case GSS_S_DEFECTIVE_TOKEN: return SEC_E_INVALID_TOKEN; + case GSS_S_DEFECTIVE_CREDENTIAL: return SEC_E_NO_CREDENTIALS; + case GSS_S_CREDENTIALS_EXPIRED: return SEC_E_CONTEXT_EXPIRED; + case GSS_S_CONTEXT_EXPIRED: return SEC_E_CONTEXT_EXPIRED; + case GSS_S_BAD_QOP: return SEC_E_QOP_NOT_SUPPORTED; + case GSS_S_CONTINUE_NEEDED: return SEC_I_CONTINUE_NEEDED; + case GSS_S_DUPLICATE_TOKEN: return SEC_E_INVALID_TOKEN; + case GSS_S_OLD_TOKEN: return SEC_E_INVALID_TOKEN; + case GSS_S_UNSEQ_TOKEN: return SEC_E_OUT_OF_SEQUENCE; + case GSS_S_GAP_TOKEN: return SEC_E_OUT_OF_SEQUENCE; + case GSS_S_FAILURE: return SEC_E_INTERNAL_ERROR; + + default: + FIXME( "couldn't convert status 0x%08x to NTSTATUS\n", status ); + return SEC_E_INTERNAL_ERROR; + } +} + +static void trace_gss_status_ex( OM_uint32 code, int type ) +{ + OM_uint32 ret, minor_status; + gss_buffer_desc buf; + OM_uint32 msg_ctx = 0; + + for (;;) + { + ret = pgss_display_status( &minor_status, code, type, GSS_C_NULL_OID, &msg_ctx, &buf ); + if (GSS_ERROR( ret )) + { + TRACE( "gss_display_status(0x%08x,%d) returned %08x minor status %08x\n", code, type, ret, minor_status ); + return; + } + TRACE( "GSS-API error: 0x%08x: %s\n", code, debugstr_an(buf.value, buf.length) ); + pgss_release_buffer( &minor_status, &buf ); + if (!msg_ctx) return; + } +} + +static void trace_gss_status( OM_uint32 major_status, OM_uint32 minor_status ) +{ + if (TRACE_ON(kerberos)) + { + trace_gss_status_ex( major_status, GSS_C_GSS_CODE ); + trace_gss_status_ex( minor_status, GSS_C_MECH_CODE ); + } +} + +static inline gss_cred_id_t credhandle_sspi_to_gss( LSA_SEC_HANDLE handle ) +{ + return (gss_cred_id_t)handle; +} + +static inline void credhandle_gss_to_sspi( gss_cred_id_t handle, LSA_SEC_HANDLE *cred ) +{ + *cred = (LSA_SEC_HANDLE)handle; +} + +static void expirytime_gss_to_sspi( OM_uint32 expirytime, TimeStamp *timestamp ) +{ + LARGE_INTEGER time; + + NtQuerySystemTime( &time ); + RtlSystemTimeToLocalTime( &time, &time ); + timestamp->LowPart = time.QuadPart; + timestamp->HighPart = time.QuadPart >> 32; +} + +static NTSTATUS init_creds( const char *user_at_domain, const char *password ) +{ + krb5_context ctx; + krb5_principal principal = NULL; + krb5_get_init_creds_opt *options = NULL; + krb5_ccache cache = NULL; + krb5_creds creds; + krb5_error_code err; + + if (!user_at_domain) return STATUS_SUCCESS; + if ((err = p_krb5_init_context( &ctx ))) return krb5_error_to_status( err ); + if ((err = p_krb5_parse_name_flags( ctx, user_at_domain, 0, &principal ))) goto done; + if ((err = p_krb5_cc_default( ctx, &cache ))) goto done; + if ((err = p_krb5_get_init_creds_opt_alloc( ctx, &options ))) goto done; + if ((err = p_krb5_get_init_creds_opt_set_out_ccache( ctx, options, cache ))) goto done; + if ((err = p_krb5_get_init_creds_password( ctx, &creds, principal, password, 0, NULL, 0, NULL, 0 ))) goto done; + if ((err = p_krb5_cc_initialize( ctx, cache, principal ))) goto done; + if ((err = p_krb5_cc_store_cred( ctx, cache, &creds ))) goto done; + + TRACE( "success\n" ); + p_krb5_free_cred_contents( ctx, &creds ); + +done: + if (cache) p_krb5_cc_close( ctx, cache ); + if (principal) p_krb5_free_principal( ctx, principal ); + if (options) p_krb5_get_init_creds_opt_free( ctx, options ); + p_krb5_free_context( ctx ); + return krb5_error_to_status( err ); +} + +static NTSTATUS import_name( const char *src, gss_name_t *dst ) +{ + OM_uint32 ret, minor_status; + gss_buffer_desc buf; + + buf.length = strlen( src ); + buf.value = (void *)src; + ret = pgss_import_name( &minor_status, &buf, GSS_C_NO_OID, dst ); + TRACE( "gss_import_name returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + return status_gss_to_sspi( ret ); +} + +static NTSTATUS CDECL acquire_credentials_handle( const char *principal, ULONG credential_use, const char *username, + const char *password, LSA_SEC_HANDLE *credential, TimeStamp *expiry ) +{ + OM_uint32 ret, minor_status, expiry_time; + gss_name_t name = GSS_C_NO_NAME; + gss_cred_usage_t cred_usage; + gss_cred_id_t cred_handle; + NTSTATUS status; + + switch (credential_use) + { + case SECPKG_CRED_INBOUND: + cred_usage = GSS_C_ACCEPT; + break; + + case SECPKG_CRED_OUTBOUND: + if ((status = init_creds( username, password )) != STATUS_SUCCESS) return status; + cred_usage = GSS_C_INITIATE; + break; + + default: + FIXME( "SECPKG_CRED_BOTH not supported\n" ); + return SEC_E_UNKNOWN_CREDENTIALS; + } + + if (principal && (status = import_name( principal, &name ))) return status; + + ret = pgss_acquire_cred( &minor_status, name, GSS_C_INDEFINITE, GSS_C_NULL_OID_SET, cred_usage, &cred_handle, + NULL, &expiry_time ); + TRACE( "gss_acquire_cred returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE) + { + credhandle_gss_to_sspi( cred_handle, credential ); + expirytime_gss_to_sspi( expiry_time, expiry ); + } + + if (name != GSS_C_NO_NAME) pgss_release_name( &minor_status, &name ); + return status_gss_to_sspi( ret ); +} + +static NTSTATUS CDECL free_credentials_handle( LSA_SEC_HANDLE handle ) +{ + OM_uint32 ret, minor_status; + gss_cred_id_t cred = credhandle_sspi_to_gss( handle ); + + ret = pgss_release_cred( &minor_status, &cred ); + TRACE( "gss_release_cred returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + return status_gss_to_sspi( ret ); +} + +static const struct krb5_funcs funcs = +{ + acquire_credentials_handle, + free_credentials_handle, +}; + +NTSTATUS CDECL __wine_init_unix_lib( HMODULE module, DWORD reason, const void *ptr_in, void *ptr_out ) +{ + if (reason != DLL_PROCESS_ATTACH) return STATUS_SUCCESS; + if (load_krb5() && load_gssapi_krb5()) + { + *(const struct krb5_funcs **)ptr_out = &funcs; + return STATUS_SUCCESS; + } + if (libkrb5_handle) unload_krb5(); + return STATUS_DLL_NOT_FOUND; +} +#endif /* defined(SONAME_LIBKRB5) && defined(SONAME_LIBGSSAPI_KRB5) */ diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h new file mode 100644 index 00000000000..ecf05b80aba --- /dev/null +++ b/dlls/kerberos/unixlib.h @@ -0,0 +1,26 @@ +/* + * Copyright 2021 Hans Leidekker for CodeWeavers + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +struct krb5_funcs +{ + NTSTATUS (CDECL *acquire_credentials_handle)(const char *, ULONG, const char *, const char *, LSA_SEC_HANDLE *, + TimeStamp *); + NTSTATUS (CDECL *free_credentials_handle)(LSA_SEC_HANDLE); +}; + +extern const struct krb5_funcs *krb5_funcs; -- 2.30.2

2 1

[PATCH 2/2] wldap32: Avoid a crash with tracing on.
by Hans Leidekker April 20, 2021

April 20, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/wldap32/option.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/dlls/wldap32/option.c b/dlls/wldap32/option.c index 1037b73174b..0f3d10e1204 100644 --- a/dlls/wldap32/option.c +++ b/dlls/wldap32/option.c @@ -368,9 +368,10 @@ static BOOL query_supported_server_ctrls( LDAP *ld ) { char *attrs[] = { (char *)"supportedControl", NULL }; void *res, *entry; + struct bervalU **ctrls = SERVER_CTRLS(ld); ULONG ret; - if (SERVER_CTRLS(ld)) return TRUE; + if (ctrls) return TRUE; ret = map_error( ldap_funcs->fn_ldap_search_ext_s( CTX(ld), (char *)"", LDAP_SCOPE_BASE, (char *)"(objectClass=*)", attrs, FALSE, NULL, NULL, NULL, 0, &res ) ); @@ -380,17 +381,14 @@ static BOOL query_supported_server_ctrls( LDAP *ld ) if (entry) { ULONG count, i; - struct bervalU **ctrls = SERVER_CTRLS(ld); - - *(struct bervalU ***)&SERVER_CTRLS(ld) = ldap_funcs->fn_ldap_get_values_len( CTX(ld), entry, attrs[0] ); - count = ldap_funcs->fn_ldap_count_values_len( SERVER_CTRLS(ld) ); - for (i = 0; i < count; i++) - TRACE("%u: %s\n", i, debugstr_an( ctrls[i]->bv_val, ctrls[i]->bv_len )); + ctrls = ldap_funcs->fn_ldap_get_values_len( CTX(ld), entry, attrs[0] ); + count = ldap_funcs->fn_ldap_count_values_len( ctrls ); + for (i = 0; i < count; i++) TRACE("%u: %s\n", i, debugstr_an( ctrls[i]->bv_val, ctrls[i]->bv_len )); + *(struct bervalU ***)&SERVER_CTRLS(ld) = ctrls; } ldap_funcs->fn_ldap_msgfree( res ); - - return SERVER_CTRLS(ld) != NULL; + return ctrls != NULL; } static BOOL is_supported_server_ctrls( LDAP *ld, LDAPControlU **ctrls ) -- 2.30.2

2 1

[PATCH 5/5] kerberos: Move support for SpVerifySignature to the Unix library.
by Hans Leidekker April 20, 2021

April 20, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 27 +-------------------------- dlls/kerberos/unixlib.c | 24 ++++++++++++++++++++++++ dlls/kerberos/unixlib.h | 1 + 3 files changed, 26 insertions(+), 26 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index 998a1cd7636..faeabfb07c9 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -1075,36 +1075,11 @@ static NTSTATUS SEC_ENTRY kerberos_SpMakeSignature( LSA_SEC_HANDLE context, ULON static NTSTATUS NTAPI kerberos_SpVerifySignature( LSA_SEC_HANDLE context, SecBufferDesc *message, ULONG message_seq_no, ULONG *quality_of_protection ) { -#ifdef SONAME_LIBGSSAPI_KRB5 - OM_uint32 ret, minor_status; - gss_buffer_desc data_buffer, token_buffer; - gss_ctx_id_t ctxt_handle; - int data_idx, token_idx; - TRACE( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection ); if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no ); if (!context) return SEC_E_INVALID_HANDLE; - ctxt_handle = ctxthandle_sspi_to_gss( context ); - - if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; - data_buffer.length = message->pBuffers[data_idx].cbBuffer; - data_buffer.value = message->pBuffers[data_idx].pvBuffer; - - if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - token_buffer.length = message->pBuffers[token_idx].cbBuffer; - token_buffer.value = message->pBuffers[token_idx].pvBuffer; - - ret = pgss_verify_mic( &minor_status, ctxt_handle, &data_buffer, &token_buffer, NULL ); - TRACE( "gss_verify_mic returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE && quality_of_protection) *quality_of_protection = 0; - - return status_gss_to_sspi( ret ); -#else - FIXME( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + return krb5_funcs->verify_signature( context, message, quality_of_protection ); } #ifdef SONAME_LIBGSSAPI_KRB5 diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c index a598ed76fe4..13d24d26263 100644 --- a/dlls/kerberos/unixlib.c +++ b/dlls/kerberos/unixlib.c @@ -584,6 +584,29 @@ static NTSTATUS CDECL make_signature( LSA_SEC_HANDLE context, SecBufferDesc *msg return status_gss_to_sspi( ret ); } +static NTSTATUS CDECL verify_signature( LSA_SEC_HANDLE context, SecBufferDesc *msg, ULONG *qop ) +{ + OM_uint32 ret, minor_status; + gss_buffer_desc data_buffer, token_buffer; + gss_ctx_id_t ctx_handle = ctxhandle_sspi_to_gss( context ); + int data_idx, token_idx; + + if ((data_idx = get_buffer_index( msg, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; + data_buffer.length = msg->pBuffers[data_idx].cbBuffer; + data_buffer.value = msg->pBuffers[data_idx].pvBuffer; + + if ((token_idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + token_buffer.length = msg->pBuffers[token_idx].cbBuffer; + token_buffer.value = msg->pBuffers[token_idx].pvBuffer; + + ret = pgss_verify_mic( &minor_status, ctx_handle, &data_buffer, &token_buffer, NULL ); + TRACE( "gss_verify_mic returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE && qop) *qop = 0; + + return status_gss_to_sspi( ret ); +} + static const struct krb5_funcs funcs = { accept_context, @@ -592,6 +615,7 @@ static const struct krb5_funcs funcs = free_credentials_handle, initialize_context, make_signature, + verify_signature, }; NTSTATUS CDECL __wine_init_unix_lib( HMODULE module, DWORD reason, const void *ptr_in, void *ptr_out ) diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h index cf30c0afbf1..969cc497ed1 100644 --- a/dlls/kerberos/unixlib.h +++ b/dlls/kerberos/unixlib.h @@ -27,6 +27,7 @@ struct krb5_funcs NTSTATUS (CDECL *initialize_context)(LSA_SEC_HANDLE, LSA_SEC_HANDLE, const char *, ULONG, SecBufferDesc *, LSA_SEC_HANDLE *, SecBufferDesc *, ULONG *, TimeStamp *); NTSTATUS (CDECL *make_signature)(LSA_SEC_HANDLE, SecBufferDesc *); + NTSTATUS (CDECL *verify_signature)(LSA_SEC_HANDLE, SecBufferDesc *, ULONG *); }; extern const struct krb5_funcs *krb5_funcs; -- 2.30.2

1 0

[PATCH 4/5] kerberos: Move support for SpMakeSignature to the Unix library.
by Hans Leidekker April 20, 2021

April 20, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 35 +---------------------------------- dlls/kerberos/unixlib.c | 30 ++++++++++++++++++++++++++++++ dlls/kerberos/unixlib.h | 1 + 3 files changed, 32 insertions(+), 34 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index 176546d9e1d..998a1cd7636 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -1052,57 +1052,24 @@ NTSTATUS NTAPI SpLsaModeInitialize(ULONG lsa_version, PULONG package_version, *package_version = SECPKG_INTERFACE_VERSION; *table = &kerberos_table; *table_count = 1; - return STATUS_SUCCESS; } static NTSTATUS NTAPI kerberos_SpInstanceInit(ULONG version, SECPKG_DLL_FUNCTIONS *dll_function_table, void **user_functions) { TRACE("%#x,%p,%p\n", version, dll_function_table, user_functions); - return STATUS_SUCCESS; } static NTSTATUS SEC_ENTRY kerberos_SpMakeSignature( LSA_SEC_HANDLE context, ULONG quality_of_protection, SecBufferDesc *message, ULONG message_seq_no ) { -#ifdef SONAME_LIBGSSAPI_KRB5 - OM_uint32 ret, minor_status; - gss_buffer_desc data_buffer, token_buffer; - gss_ctx_id_t ctxt_handle; - int data_idx, token_idx; - TRACE( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no ); if (quality_of_protection) FIXME( "ignoring quality_of_protection 0x%08x\n", quality_of_protection ); if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no ); if (!context) return SEC_E_INVALID_HANDLE; - ctxt_handle = ctxthandle_sspi_to_gss( context ); - - /* FIXME: multiple data buffers, read-only buffers */ - if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; - data_buffer.length = message->pBuffers[data_idx].cbBuffer; - data_buffer.value = message->pBuffers[data_idx].pvBuffer; - - if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - token_buffer.length = 0; - token_buffer.value = NULL; - - ret = pgss_get_mic( &minor_status, ctxt_handle, GSS_C_QOP_DEFAULT, &data_buffer, &token_buffer ); - TRACE( "gss_get_mic returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE) - { - memcpy( message->pBuffers[token_idx].pvBuffer, token_buffer.value, token_buffer.length ); - message->pBuffers[token_idx].cbBuffer = token_buffer.length; - pgss_release_buffer( &minor_status, &token_buffer ); - } - - return status_gss_to_sspi( ret ); -#else - FIXME( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + return krb5_funcs->make_signature( context, message ); } static NTSTATUS NTAPI kerberos_SpVerifySignature( LSA_SEC_HANDLE context, SecBufferDesc *message, diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c index 03241476d41..a598ed76fe4 100644 --- a/dlls/kerberos/unixlib.c +++ b/dlls/kerberos/unixlib.c @@ -555,6 +555,35 @@ static NTSTATUS CDECL initialize_context( LSA_SEC_HANDLE credential, LSA_SEC_HAN return status_gss_to_sspi( ret ); } +static NTSTATUS CDECL make_signature( LSA_SEC_HANDLE context, SecBufferDesc *msg ) +{ + OM_uint32 ret, minor_status; + gss_buffer_desc data_buffer, token_buffer; + gss_ctx_id_t ctx_handle = ctxhandle_sspi_to_gss( context ); + int data_idx, token_idx; + + /* FIXME: multiple data buffers, read-only buffers */ + if ((data_idx = get_buffer_index( msg, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; + data_buffer.length = msg->pBuffers[data_idx].cbBuffer; + data_buffer.value = msg->pBuffers[data_idx].pvBuffer; + + if ((token_idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + token_buffer.length = 0; + token_buffer.value = NULL; + + ret = pgss_get_mic( &minor_status, ctx_handle, GSS_C_QOP_DEFAULT, &data_buffer, &token_buffer ); + TRACE( "gss_get_mic returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE) + { + memcpy( msg->pBuffers[token_idx].pvBuffer, token_buffer.value, token_buffer.length ); + msg->pBuffers[token_idx].cbBuffer = token_buffer.length; + pgss_release_buffer( &minor_status, &token_buffer ); + } + + return status_gss_to_sspi( ret ); +} + static const struct krb5_funcs funcs = { accept_context, @@ -562,6 +591,7 @@ static const struct krb5_funcs funcs = delete_context, free_credentials_handle, initialize_context, + make_signature, }; NTSTATUS CDECL __wine_init_unix_lib( HMODULE module, DWORD reason, const void *ptr_in, void *ptr_out ) diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h index cf5cf6bd104..cf30c0afbf1 100644 --- a/dlls/kerberos/unixlib.h +++ b/dlls/kerberos/unixlib.h @@ -26,6 +26,7 @@ struct krb5_funcs NTSTATUS (CDECL *free_credentials_handle)(LSA_SEC_HANDLE); NTSTATUS (CDECL *initialize_context)(LSA_SEC_HANDLE, LSA_SEC_HANDLE, const char *, ULONG, SecBufferDesc *, LSA_SEC_HANDLE *, SecBufferDesc *, ULONG *, TimeStamp *); + NTSTATUS (CDECL *make_signature)(LSA_SEC_HANDLE, SecBufferDesc *); }; extern const struct krb5_funcs *krb5_funcs; -- 2.30.2

1 0

[PATCH 3/5] kerberos: Move support for SpAcceptLsaModeContext to the Unix library.
by Hans Leidekker April 20, 2021

April 20, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 91 ++++------------------------------------- dlls/kerberos/unixlib.c | 63 ++++++++++++++++++++++++++++ dlls/kerberos/unixlib.h | 2 + 3 files changed, 72 insertions(+), 84 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index b1fe036a071..176546d9e1d 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -753,33 +753,6 @@ static void trace_gss_status( OM_uint32 major_status, OM_uint32 minor_status ) } } -static void expirytime_gss_to_sspi( OM_uint32 expirytime, TimeStamp *timestamp ) -{ - FILETIME filetime; - ULARGE_INTEGER tmp; - - GetSystemTimeAsFileTime( &filetime ); - FileTimeToLocalFileTime( &filetime, &filetime ); - tmp.QuadPart = ((ULONGLONG)filetime.dwLowDateTime | (ULONGLONG)filetime.dwHighDateTime << 32) + expirytime; - timestamp->LowPart = tmp.QuadPart; - timestamp->HighPart = tmp.QuadPart >> 32; -} - -static ULONG flags_gss_to_asc_ret( ULONG flags ) -{ - ULONG ret = 0; - if (flags & GSS_C_DELEG_FLAG) ret |= ASC_RET_DELEGATE; - if (flags & GSS_C_MUTUAL_FLAG) ret |= ASC_RET_MUTUAL_AUTH; - if (flags & GSS_C_REPLAY_FLAG) ret |= ASC_RET_REPLAY_DETECT; - if (flags & GSS_C_SEQUENCE_FLAG) ret |= ASC_RET_SEQUENCE_DETECT; - if (flags & GSS_C_CONF_FLAG) ret |= ASC_RET_CONFIDENTIALITY; - if (flags & GSS_C_INTEG_FLAG) ret |= ASC_RET_INTEGRITY; - if (flags & GSS_C_ANON_FLAG) ret |= ASC_RET_NULL_SESSION; - if (flags & GSS_C_DCE_STYLE) ret |= ASC_RET_USED_DCE_STYLE; - if (flags & GSS_C_IDENTIFY_FLAG) ret |= ASC_RET_IDENTIFY; - return ret; -} - static BOOL is_dce_style_context( gss_ctx_id_t ctxt_handle ) { OM_uint32 ret, minor_status, flags; @@ -906,70 +879,20 @@ static NTSTATUS NTAPI kerberos_SpInitLsaModeContext( LSA_SEC_HANDLE credential, static NTSTATUS NTAPI kerberos_SpAcceptLsaModeContext( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context, SecBufferDesc *input, ULONG context_req, ULONG target_data_rep, LSA_SEC_HANDLE *new_context, - SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry, BOOLEAN *mapped_context, SecBuffer *context_data ) + SecBufferDesc *output, ULONG *context_attr, TimeStamp *expiry, BOOLEAN *mapped_context, SecBuffer *context_data ) { -#ifdef SONAME_LIBGSSAPI_KRB5 - OM_uint32 ret, minor_status, ret_flags = 0, expiry_time; - gss_cred_id_t cred_handle; - gss_ctx_id_t ctxt_handle; - gss_buffer_desc input_token, output_token; - gss_name_t target = GSS_C_NO_NAME; - int idx; + NTSTATUS status; - TRACE( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, context_req, - target_data_rep, input, new_context, output, context_attr, ts_expiry, - mapped_context, context_data ); + TRACE( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, context_req, target_data_rep, input, + new_context, output, context_attr, expiry, mapped_context, context_data ); if (context_req) FIXME( "ignoring flags 0x%08x\n", context_req ); if (!context && !input && !credential) return SEC_E_INVALID_HANDLE; - cred_handle = credhandle_sspi_to_gss( credential ); - ctxt_handle = ctxthandle_sspi_to_gss( context ); - - if (!input) input_token.length = 0; - else - { - if ((idx = get_buffer_index( input, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - input_token.length = input->pBuffers[idx].cbBuffer; - input_token.value = input->pBuffers[idx].pvBuffer; - } - - if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - output_token.length = 0; - output_token.value = NULL; - ret = pgss_accept_sec_context( &minor_status, &ctxt_handle, cred_handle, &input_token, GSS_C_NO_CHANNEL_BINDINGS, - &target, NULL, &output_token, &ret_flags, &expiry_time, NULL ); - TRACE( "gss_accept_sec_context returned %08x minor status %08x ret_flags %08x\n", ret, minor_status, ret_flags ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) - { - if (output_token.length > output->pBuffers[idx].cbBuffer) /* FIXME: check if larger buffer exists */ - { - TRACE( "buffer too small %lu > %u\n", (SIZE_T)output_token.length, output->pBuffers[idx].cbBuffer ); - pgss_release_buffer( &minor_status, &output_token ); - pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER ); - return SEC_E_BUFFER_TOO_SMALL; - } - output->pBuffers[idx].cbBuffer = output_token.length; - memcpy( output->pBuffers[idx].pvBuffer, output_token.value, output_token.length ); - pgss_release_buffer( &minor_status, &output_token ); - - ctxthandle_gss_to_sspi( ctxt_handle, new_context ); - if (context_attr) *context_attr = flags_gss_to_asc_ret( ret_flags ); - expirytime_gss_to_sspi( expiry_time, ts_expiry ); - } - - /* we do support user mode SSP/AP functions */ - *mapped_context = TRUE; + status = krb5_funcs->accept_context( credential, context, input, new_context, output, context_attr, expiry ); + if (!status) *mapped_context = TRUE; /* FIXME: initialize context_data */ - - return status_gss_to_sspi( ret ); -#else - FIXME( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, context_req, - target_data_rep, input, new_context, output, context_attr, ts_expiry, - mapped_context, context_data ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + return status; } static NTSTATUS NTAPI kerberos_SpDeleteContext( LSA_SEC_HANDLE context ) diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c index 4356cdbae2b..03241476d41 100644 --- a/dlls/kerberos/unixlib.c +++ b/dlls/kerberos/unixlib.c @@ -305,6 +305,68 @@ static void expirytime_gss_to_sspi( OM_uint32 expirytime, TimeStamp *timestamp ) timestamp->HighPart = time.QuadPart >> 32; } +static ULONG flags_gss_to_asc_ret( ULONG flags ) +{ + ULONG ret = 0; + if (flags & GSS_C_DELEG_FLAG) ret |= ASC_RET_DELEGATE; + if (flags & GSS_C_MUTUAL_FLAG) ret |= ASC_RET_MUTUAL_AUTH; + if (flags & GSS_C_REPLAY_FLAG) ret |= ASC_RET_REPLAY_DETECT; + if (flags & GSS_C_SEQUENCE_FLAG) ret |= ASC_RET_SEQUENCE_DETECT; + if (flags & GSS_C_CONF_FLAG) ret |= ASC_RET_CONFIDENTIALITY; + if (flags & GSS_C_INTEG_FLAG) ret |= ASC_RET_INTEGRITY; + if (flags & GSS_C_ANON_FLAG) ret |= ASC_RET_NULL_SESSION; + if (flags & GSS_C_DCE_STYLE) ret |= ASC_RET_USED_DCE_STYLE; + if (flags & GSS_C_IDENTIFY_FLAG) ret |= ASC_RET_IDENTIFY; + return ret; +} + +NTSTATUS CDECL accept_context( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context, SecBufferDesc *input, + LSA_SEC_HANDLE *new_context, SecBufferDesc *output, ULONG *context_attr, + TimeStamp *expiry ) +{ + OM_uint32 ret, minor_status, ret_flags = 0, expiry_time; + gss_cred_id_t cred_handle = credhandle_sspi_to_gss( credential ); + gss_ctx_id_t ctx_handle = ctxhandle_sspi_to_gss( context ); + gss_buffer_desc input_token, output_token; + int idx; + + if (!input) input_token.length = 0; + else + { + if ((idx = get_buffer_index( input, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + input_token.length = input->pBuffers[idx].cbBuffer; + input_token.value = input->pBuffers[idx].pvBuffer; + } + + if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + output_token.length = 0; + output_token.value = NULL; + + ret = pgss_accept_sec_context( &minor_status, &ctx_handle, cred_handle, &input_token, GSS_C_NO_CHANNEL_BINDINGS, + NULL, NULL, &output_token, &ret_flags, &expiry_time, NULL ); + TRACE( "gss_accept_sec_context returned %08x minor status %08x ret_flags %08x\n", ret, minor_status, ret_flags ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) + { + if (output_token.length > output->pBuffers[idx].cbBuffer) /* FIXME: check if larger buffer exists */ + { + TRACE( "buffer too small %lu > %u\n", (SIZE_T)output_token.length, output->pBuffers[idx].cbBuffer ); + pgss_release_buffer( &minor_status, &output_token ); + pgss_delete_sec_context( &minor_status, &ctx_handle, GSS_C_NO_BUFFER ); + return SEC_E_BUFFER_TOO_SMALL; + } + output->pBuffers[idx].cbBuffer = output_token.length; + memcpy( output->pBuffers[idx].pvBuffer, output_token.value, output_token.length ); + pgss_release_buffer( &minor_status, &output_token ); + + ctxhandle_gss_to_sspi( ctx_handle, new_context ); + if (context_attr) *context_attr = flags_gss_to_asc_ret( ret_flags ); + expirytime_gss_to_sspi( expiry_time, expiry ); + } + + return status_gss_to_sspi( ret ); +} + static NTSTATUS init_creds( const char *user_at_domain, const char *password ) { krb5_context ctx; @@ -495,6 +557,7 @@ static NTSTATUS CDECL initialize_context( LSA_SEC_HANDLE credential, LSA_SEC_HAN static const struct krb5_funcs funcs = { + accept_context, acquire_credentials_handle, delete_context, free_credentials_handle, diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h index dc7c3da6a35..cf5cf6bd104 100644 --- a/dlls/kerberos/unixlib.h +++ b/dlls/kerberos/unixlib.h @@ -18,6 +18,8 @@ struct krb5_funcs { + NTSTATUS (CDECL *accept_context)(LSA_SEC_HANDLE, LSA_SEC_HANDLE, SecBufferDesc *, LSA_SEC_HANDLE *, + SecBufferDesc *, ULONG *, TimeStamp *); NTSTATUS (CDECL *acquire_credentials_handle)(const char *, ULONG, const char *, const char *, LSA_SEC_HANDLE *, TimeStamp *); NTSTATUS (CDECL *delete_context)(LSA_SEC_HANDLE); -- 2.30.2

1 0

[PATCH 2/5] kerberos: Move support for SpInitLsaModeContext/SpDeleteContext to the Unix library.
by Hans Leidekker April 20, 2021

April 20, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/kerberos/krb5_ap.c | 135 ++++------------------------------------ dlls/kerberos/unixlib.c | 116 ++++++++++++++++++++++++++++++++++ dlls/kerberos/unixlib.h | 3 + 3 files changed, 130 insertions(+), 124 deletions(-) diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c index 08265beeceb..b1fe036a071 100644 --- a/dlls/kerberos/krb5_ap.c +++ b/dlls/kerberos/krb5_ap.c @@ -765,54 +765,6 @@ static void expirytime_gss_to_sspi( OM_uint32 expirytime, TimeStamp *timestamp ) timestamp->HighPart = tmp.QuadPart >> 32; } -static NTSTATUS name_sspi_to_gss( const UNICODE_STRING *name_str, gss_name_t *name ) -{ - OM_uint32 ret, minor_status; - gss_OID type = GSS_C_NO_OID; /* FIXME: detect the appropriate value for this ourselves? */ - gss_buffer_desc buf; - - buf.length = WideCharToMultiByte( CP_UNIXCP, 0, name_str->Buffer, name_str->Length / sizeof(WCHAR), NULL, 0, NULL, NULL ); - if (!(buf.value = heap_alloc( buf.length ))) return SEC_E_INSUFFICIENT_MEMORY; - WideCharToMultiByte( CP_UNIXCP, 0, name_str->Buffer, name_str->Length / sizeof(WCHAR), buf.value, buf.length, NULL, NULL ); - - ret = pgss_import_name( &minor_status, &buf, type, name ); - TRACE( "gss_import_name returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - - heap_free( buf.value ); - return status_gss_to_sspi( ret ); -} - -static ULONG flags_isc_req_to_gss( ULONG flags ) -{ - ULONG ret = 0; - if (flags & ISC_REQ_DELEGATE) ret |= GSS_C_DELEG_FLAG; - if (flags & ISC_REQ_MUTUAL_AUTH) ret |= GSS_C_MUTUAL_FLAG; - if (flags & ISC_REQ_REPLAY_DETECT) ret |= GSS_C_REPLAY_FLAG; - if (flags & ISC_REQ_SEQUENCE_DETECT) ret |= GSS_C_SEQUENCE_FLAG; - if (flags & ISC_REQ_CONFIDENTIALITY) ret |= GSS_C_CONF_FLAG; - if (flags & ISC_REQ_INTEGRITY) ret |= GSS_C_INTEG_FLAG; - if (flags & ISC_REQ_NULL_SESSION) ret |= GSS_C_ANON_FLAG; - if (flags & ISC_REQ_USE_DCE_STYLE) ret |= GSS_C_DCE_STYLE; - if (flags & ISC_REQ_IDENTIFY) ret |= GSS_C_IDENTIFY_FLAG; - return ret; -} - -static ULONG flags_gss_to_isc_ret( ULONG flags ) -{ - ULONG ret = 0; - if (flags & GSS_C_DELEG_FLAG) ret |= ISC_RET_DELEGATE; - if (flags & GSS_C_MUTUAL_FLAG) ret |= ISC_RET_MUTUAL_AUTH; - if (flags & GSS_C_REPLAY_FLAG) ret |= ISC_RET_REPLAY_DETECT; - if (flags & GSS_C_SEQUENCE_FLAG) ret |= ISC_RET_SEQUENCE_DETECT; - if (flags & GSS_C_CONF_FLAG) ret |= ISC_RET_CONFIDENTIALITY; - if (flags & GSS_C_INTEG_FLAG) ret |= ISC_RET_INTEGRITY; - if (flags & GSS_C_ANON_FLAG) ret |= ISC_RET_NULL_SESSION; - if (flags & GSS_C_DCE_STYLE) ret |= ISC_RET_USED_DCE_STYLE; - if (flags & GSS_C_IDENTIFY_FLAG) ret |= ISC_RET_IDENTIFY; - return ret; -} - static ULONG flags_gss_to_asc_ret( ULONG flags ) { ULONG ret = 0; @@ -927,80 +879,29 @@ static NTSTATUS NTAPI kerberos_SpFreeCredentialsHandle( LSA_SEC_HANDLE credentia static NTSTATUS NTAPI kerberos_SpInitLsaModeContext( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context, UNICODE_STRING *target_name, ULONG context_req, ULONG target_data_rep, SecBufferDesc *input, - LSA_SEC_HANDLE *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry, + LSA_SEC_HANDLE *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *expiry, BOOLEAN *mapped_context, SecBuffer *context_data ) { -#ifdef SONAME_LIBGSSAPI_KRB5 static const ULONG supported = ISC_REQ_CONFIDENTIALITY | ISC_REQ_INTEGRITY | ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT | ISC_REQ_MUTUAL_AUTH | ISC_REQ_USE_DCE_STYLE | ISC_REQ_IDENTIFY | ISC_REQ_CONNECTION; - OM_uint32 ret, minor_status, ret_flags = 0, expiry_time, req_flags = flags_isc_req_to_gss( context_req ); - gss_cred_id_t cred_handle; - gss_ctx_id_t ctxt_handle; - gss_buffer_desc input_token, output_token; - gss_name_t target = GSS_C_NO_NAME; + char *target = NULL; NTSTATUS status; - int idx; TRACE( "(%lx %lx %s 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, debugstr_us(target_name), - context_req, target_data_rep, input, new_context, output, context_attr, ts_expiry, + context_req, target_data_rep, input, new_context, output, context_attr, expiry, mapped_context, context_data ); - if (context_req & ~supported) - FIXME( "flags 0x%08x not supported\n", context_req & ~supported ); + if (context_req & ~supported) FIXME( "flags 0x%08x not supported\n", context_req & ~supported ); if (!context && !input && !credential) return SEC_E_INVALID_HANDLE; - cred_handle = credhandle_sspi_to_gss( credential ); - ctxt_handle = ctxthandle_sspi_to_gss( context ); - - if ((idx = get_buffer_index( input, SECBUFFER_TOKEN )) == -1) input_token.length = 0; - else - { - input_token.length = input->pBuffers[idx].cbBuffer; - input_token.value = input->pBuffers[idx].pvBuffer; - } - - if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; - output_token.length = 0; - output_token.value = NULL; - - if (target_name && ((status = name_sspi_to_gss( target_name, &target )) != SEC_E_OK)) return status; + if (target_name && !(target = get_str_unixcp( target_name ))) return SEC_E_INSUFFICIENT_MEMORY; - ret = pgss_init_sec_context( &minor_status, cred_handle, &ctxt_handle, target, GSS_C_NO_OID, req_flags, 0, - GSS_C_NO_CHANNEL_BINDINGS, &input_token, NULL, &output_token, &ret_flags, - &expiry_time ); - TRACE( "gss_init_sec_context returned %08x minor status %08x ret_flags %08x\n", ret, minor_status, ret_flags ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) - { - if (output_token.length > output->pBuffers[idx].cbBuffer) /* FIXME: check if larger buffer exists */ - { - TRACE( "buffer too small %lu > %u\n", (SIZE_T)output_token.length, output->pBuffers[idx].cbBuffer ); - pgss_release_buffer( &minor_status, &output_token ); - pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER ); - return SEC_E_INCOMPLETE_MESSAGE; - } - output->pBuffers[idx].cbBuffer = output_token.length; - memcpy( output->pBuffers[idx].pvBuffer, output_token.value, output_token.length ); - pgss_release_buffer( &minor_status, &output_token ); - - ctxthandle_gss_to_sspi( ctxt_handle, new_context ); - if (context_attr) *context_attr = flags_gss_to_isc_ret( ret_flags ); - expirytime_gss_to_sspi( expiry_time, ts_expiry ); - } - - if (target != GSS_C_NO_NAME) pgss_release_name( &minor_status, &target ); - - /* we do support user mode SSP/AP functions */ - *mapped_context = TRUE; + status = krb5_funcs->initialize_context( credential, context, target, context_req, input, new_context, output, + context_attr, expiry ); + if (!status) *mapped_context = TRUE; /* FIXME: initialize context_data */ - - return status_gss_to_sspi( ret ); -#else - FIXME( "(%lx %lx %s 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, debugstr_us(target_name), - context_req, target_data_rep, input, new_context, output, context_attr, ts_expiry, - mapped_context, context_data ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + heap_free( target ); + return status; } static NTSTATUS NTAPI kerberos_SpAcceptLsaModeContext( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context, @@ -1073,23 +974,9 @@ static NTSTATUS NTAPI kerberos_SpAcceptLsaModeContext( LSA_SEC_HANDLE credential static NTSTATUS NTAPI kerberos_SpDeleteContext( LSA_SEC_HANDLE context ) { -#ifdef SONAME_LIBGSSAPI_KRB5 - OM_uint32 ret, minor_status; - gss_ctx_id_t ctxt_handle; - TRACE( "(%lx)\n", context ); if (!context) return SEC_E_INVALID_HANDLE; - if (!(ctxt_handle = ctxthandle_sspi_to_gss( context ))) return SEC_E_OK; - - ret = pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER ); - TRACE( "gss_delete_sec_context returned %08x minor status %08x\n", ret, minor_status ); - if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status ); - - return status_gss_to_sspi( ret ); -#else - FIXME( "(%lx)\n", context ); - return SEC_E_UNSUPPORTED_FUNCTION; -#endif + return krb5_funcs->delete_context( context ); } static SecPkgInfoW *build_package_info( const SecPkgInfoW *info ) diff --git a/dlls/kerberos/unixlib.c b/dlls/kerberos/unixlib.c index ab7191432fe..4356cdbae2b 100644 --- a/dlls/kerberos/unixlib.c +++ b/dlls/kerberos/unixlib.c @@ -208,6 +208,17 @@ fail: return FALSE; } +static int get_buffer_index( SecBufferDesc *desc, DWORD type ) +{ + UINT i; + if (!desc) return -1; + for (i = 0; i < desc->cBuffers; i++) + { + if (desc->pBuffers[i].BufferType == type) return i; + } + return -1; +} + static NTSTATUS status_gss_to_sspi( OM_uint32 status ) { switch (status) @@ -264,11 +275,21 @@ static void trace_gss_status( OM_uint32 major_status, OM_uint32 minor_status ) } } +static inline gss_ctx_id_t ctxhandle_sspi_to_gss( LSA_SEC_HANDLE handle ) +{ + return (gss_ctx_id_t)handle; +} + static inline gss_cred_id_t credhandle_sspi_to_gss( LSA_SEC_HANDLE handle ) { return (gss_cred_id_t)handle; } +static inline void ctxhandle_gss_to_sspi( gss_ctx_id_t handle, LSA_SEC_HANDLE *ctx ) +{ + *ctx = (LSA_SEC_HANDLE)handle; +} + static inline void credhandle_gss_to_sspi( gss_cred_id_t handle, LSA_SEC_HANDLE *cred ) { *cred = (LSA_SEC_HANDLE)handle; @@ -368,6 +389,17 @@ static NTSTATUS CDECL acquire_credentials_handle( const char *principal, ULONG c return status_gss_to_sspi( ret ); } +static NTSTATUS CDECL delete_context( LSA_SEC_HANDLE context ) +{ + OM_uint32 ret, minor_status; + gss_ctx_id_t ctx_handle = ctxhandle_sspi_to_gss( context ); + + ret = pgss_delete_sec_context( &minor_status, &ctx_handle, GSS_C_NO_BUFFER ); + TRACE( "gss_delete_sec_context returned %08x minor status %08x\n", ret, minor_status ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + return status_gss_to_sspi( ret ); +} + static NTSTATUS CDECL free_credentials_handle( LSA_SEC_HANDLE handle ) { OM_uint32 ret, minor_status; @@ -379,10 +411,94 @@ static NTSTATUS CDECL free_credentials_handle( LSA_SEC_HANDLE handle ) return status_gss_to_sspi( ret ); } +static ULONG flags_isc_req_to_gss( ULONG flags ) +{ + ULONG ret = 0; + if (flags & ISC_REQ_DELEGATE) ret |= GSS_C_DELEG_FLAG; + if (flags & ISC_REQ_MUTUAL_AUTH) ret |= GSS_C_MUTUAL_FLAG; + if (flags & ISC_REQ_REPLAY_DETECT) ret |= GSS_C_REPLAY_FLAG; + if (flags & ISC_REQ_SEQUENCE_DETECT) ret |= GSS_C_SEQUENCE_FLAG; + if (flags & ISC_REQ_CONFIDENTIALITY) ret |= GSS_C_CONF_FLAG; + if (flags & ISC_REQ_INTEGRITY) ret |= GSS_C_INTEG_FLAG; + if (flags & ISC_REQ_NULL_SESSION) ret |= GSS_C_ANON_FLAG; + if (flags & ISC_REQ_USE_DCE_STYLE) ret |= GSS_C_DCE_STYLE; + if (flags & ISC_REQ_IDENTIFY) ret |= GSS_C_IDENTIFY_FLAG; + return ret; +} + +static ULONG flags_gss_to_isc_ret( ULONG flags ) +{ + ULONG ret = 0; + if (flags & GSS_C_DELEG_FLAG) ret |= ISC_RET_DELEGATE; + if (flags & GSS_C_MUTUAL_FLAG) ret |= ISC_RET_MUTUAL_AUTH; + if (flags & GSS_C_REPLAY_FLAG) ret |= ISC_RET_REPLAY_DETECT; + if (flags & GSS_C_SEQUENCE_FLAG) ret |= ISC_RET_SEQUENCE_DETECT; + if (flags & GSS_C_CONF_FLAG) ret |= ISC_RET_CONFIDENTIALITY; + if (flags & GSS_C_INTEG_FLAG) ret |= ISC_RET_INTEGRITY; + if (flags & GSS_C_ANON_FLAG) ret |= ISC_RET_NULL_SESSION; + if (flags & GSS_C_DCE_STYLE) ret |= ISC_RET_USED_DCE_STYLE; + if (flags & GSS_C_IDENTIFY_FLAG) ret |= ISC_RET_IDENTIFY; + return ret; +} + +static NTSTATUS CDECL initialize_context( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context, const char *target_name, + ULONG context_req, SecBufferDesc *input, LSA_SEC_HANDLE *new_context, + SecBufferDesc *output, ULONG *context_attr, TimeStamp *expiry ) +{ + OM_uint32 ret, minor_status, ret_flags = 0, expiry_time, req_flags = flags_isc_req_to_gss( context_req ); + gss_cred_id_t cred_handle = credhandle_sspi_to_gss( credential ); + gss_ctx_id_t ctx_handle = ctxhandle_sspi_to_gss( context ); + gss_buffer_desc input_token, output_token; + gss_name_t target = GSS_C_NO_NAME; + NTSTATUS status; + int idx; + + if ((idx = get_buffer_index( input, SECBUFFER_TOKEN )) == -1) input_token.length = 0; + else + { + input_token.length = input->pBuffers[idx].cbBuffer; + input_token.value = input->pBuffers[idx].pvBuffer; + } + + if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN; + output_token.length = 0; + output_token.value = NULL; + + if (target_name && (status = import_name( target_name, &target ))) return status; + + ret = pgss_init_sec_context( &minor_status, cred_handle, &ctx_handle, target, GSS_C_NO_OID, req_flags, 0, + GSS_C_NO_CHANNEL_BINDINGS, &input_token, NULL, &output_token, &ret_flags, + &expiry_time ); + TRACE( "gss_init_sec_context returned %08x minor status %08x ret_flags %08x\n", ret, minor_status, ret_flags ); + if (GSS_ERROR( ret )) trace_gss_status( ret, minor_status ); + if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) + { + if (output_token.length > output->pBuffers[idx].cbBuffer) /* FIXME: check if larger buffer exists */ + { + TRACE( "buffer too small %lu > %u\n", (SIZE_T)output_token.length, output->pBuffers[idx].cbBuffer ); + pgss_release_buffer( &minor_status, &output_token ); + pgss_delete_sec_context( &minor_status, &ctx_handle, GSS_C_NO_BUFFER ); + return SEC_E_INCOMPLETE_MESSAGE; + } + output->pBuffers[idx].cbBuffer = output_token.length; + memcpy( output->pBuffers[idx].pvBuffer, output_token.value, output_token.length ); + pgss_release_buffer( &minor_status, &output_token ); + + ctxhandle_gss_to_sspi( ctx_handle, new_context ); + if (context_attr) *context_attr = flags_gss_to_isc_ret( ret_flags ); + expirytime_gss_to_sspi( expiry_time, expiry ); + } + + if (target != GSS_C_NO_NAME) pgss_release_name( &minor_status, &target ); + return status_gss_to_sspi( ret ); +} + static const struct krb5_funcs funcs = { acquire_credentials_handle, + delete_context, free_credentials_handle, + initialize_context, }; NTSTATUS CDECL __wine_init_unix_lib( HMODULE module, DWORD reason, const void *ptr_in, void *ptr_out ) diff --git a/dlls/kerberos/unixlib.h b/dlls/kerberos/unixlib.h index ecf05b80aba..dc7c3da6a35 100644 --- a/dlls/kerberos/unixlib.h +++ b/dlls/kerberos/unixlib.h @@ -20,7 +20,10 @@ struct krb5_funcs { NTSTATUS (CDECL *acquire_credentials_handle)(const char *, ULONG, const char *, const char *, LSA_SEC_HANDLE *, TimeStamp *); + NTSTATUS (CDECL *delete_context)(LSA_SEC_HANDLE); NTSTATUS (CDECL *free_credentials_handle)(LSA_SEC_HANDLE); + NTSTATUS (CDECL *initialize_context)(LSA_SEC_HANDLE, LSA_SEC_HANDLE, const char *, ULONG, SecBufferDesc *, + LSA_SEC_HANDLE *, SecBufferDesc *, ULONG *, TimeStamp *); }; extern const struct krb5_funcs *krb5_funcs; -- 2.30.2

1 0

[PATCH 1/2] wldap32: Fix parsing page controls.
by Hans Leidekker April 20, 2021

April 20, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/wldap32/page.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/dlls/wldap32/page.c b/dlls/wldap32/page.c index 471108c636e..8b0ded40e35 100644 --- a/dlls/wldap32/page.c +++ b/dlls/wldap32/page.c @@ -20,6 +20,7 @@ #include <stdarg.h> #include <stdlib.h> +#include <limits.h> #include "windef.h" #include "winbase.h" #include "winnls.h" @@ -31,8 +32,6 @@ WINE_DEFAULT_DEBUG_CHANNEL(wldap32); -#define LDAP_MAXINT (2^31) - static struct berval null_cookieW = { 0, NULL }; /*********************************************************************** @@ -48,7 +47,7 @@ ULONG CDECL ldap_create_page_controlA( LDAP *ld, ULONG pagesize, struct berval * TRACE( "(%p, 0x%08x, %p, 0x%02x, %p)\n", ld, pagesize, cookie, critical, control ); - if (!ld || !control || pagesize > LDAP_MAXINT) return LDAP_PARAM_ERROR; + if (!ld || !control || pagesize > INT_MAX) return LDAP_PARAM_ERROR; ret = ldap_create_page_controlW( ld, pagesize, cookie, critical, &controlW ); if (ret == LDAP_SUCCESS) @@ -131,7 +130,7 @@ ULONG CDECL ldap_create_page_controlW( LDAP *ld, ULONG pagesize, struct berval * { TRACE( "(%p, 0x%08x, %p, 0x%02x, %p)\n", ld, pagesize, cookie, critical, control ); - if (!ld || !control || pagesize > LDAP_MAXINT) return LDAP_PARAM_ERROR; + if (!ld || !control || pagesize > INT_MAX) return LDAP_PARAM_ERROR; return create_page_control( pagesize, cookie, critical, control ); } @@ -230,18 +229,18 @@ ULONG CDECL ldap_parse_page_controlA( LDAP *ld, LDAPControlA **ctrls, ULONG *cou /*********************************************************************** * ldap_parse_page_controlW (WLDAP32.@) */ -ULONG CDECL ldap_parse_page_controlW( LDAP *ld, LDAPControlW **ctrls, ULONG *count, struct berval **cookie ) +ULONG CDECL ldap_parse_page_controlW( LDAP *ld, LDAPControlW **ctrls, ULONG *ret_count, struct berval **ret_cookie ) { - ULONG ret; + ULONG ret, count; LDAPControlW *control = NULL; BerElement *ber; - struct berval *vec[2]; + struct berval *cookie = NULL; int tag; ULONG i; - TRACE( "(%p, %p, %p, %p)\n", ld, ctrls, count, cookie ); + TRACE( "(%p, %p, %p, %p)\n", ld, ctrls, ret_count, ret_cookie ); - if (!ld || !ctrls || !count || !cookie) return LDAP_PARAM_ERROR; + if (!ld || !ctrls || !ret_count || !ret_cookie) return LDAP_PARAM_ERROR; for (i = 0; ctrls[i]; i++) { @@ -252,13 +251,14 @@ ULONG CDECL ldap_parse_page_controlW( LDAP *ld, LDAPControlW **ctrls, ULONG *cou if (!(ber = ber_init( &control->ldctl_value ))) return LDAP_NO_MEMORY; - vec[0] = *cookie; - vec[1] = 0; - tag = ber_scanf( ber, (char *)"{iV}", count, vec ); - if (tag == LBER_ERROR) - ret = LDAP_DECODING_ERROR; + tag = ber_scanf( ber, (char *)"{iO}", &count, &cookie ); + if (tag == LBER_ERROR) ret = LDAP_DECODING_ERROR; else + { + *ret_count = count; + *ret_cookie = cookie; ret = LDAP_SUCCESS; + } ber_free( ber, 1 ); return ret; -- 2.30.2

1 0

[PATCH 1/3] include: Add mfplay event macros.
by Nikolay Sivov April 20, 2021

April 20, 2021

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com> --- include/mfplay.idl | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/include/mfplay.idl b/include/mfplay.idl index f130ce12287..7d4345e69e7 100644 --- a/include/mfplay.idl +++ b/include/mfplay.idl @@ -22,13 +22,15 @@ import "evr.idl"; interface IMFNetCredential; +typedef UINT32 MFP_CREATION_OPTIONS; + typedef [v1_enum] enum _MFP_CREATION_OPTIONS { MFP_OPTION_NONE = 0, MFP_OPTION_FREE_THREADED_CALLBACK = 0x1, MFP_OPTION_NO_MMCSS = 0x2, MFP_OPTION_NO_REMOTE_DESKTOP_OPTIMIZATION = 0x4, -} MFP_CREATION_OPTIONS; +} _MFP_CREATION_OPTIONS; typedef [v1_enum] enum MFP_MEDIAPLAYER_STATE { @@ -180,6 +182,21 @@ typedef struct MFP_ACQUIRE_USER_CREDENTIAL_EVENT IMFNetCredential *pCredential; } MFP_ACQUIRE_USER_CREDENTIAL_EVENT; +cpp_quote("#define __MFP_CAST_EVENT(hdr, tag) (((hdr)->eEventType == MFP_EVENT_TYPE_##tag) ? (MFP_##Tag##_EVENT *)(hdr) : NULL)") +cpp_quote("#define MFP_GET_PLAY_EVENT(hdr) __MFP_CAST_EVENT(hdr, PLAY)") +cpp_quote("#define MFP_GET_PAUSE_EVENT(hdr) __MFP_CAST_EVENT(hdr, PAUSE)") +cpp_quote("#define MFP_GET_STOP_EVENT(hdr) __MFP_CAST_EVENT(hdr, STOP)") +cpp_quote("#define MFP_GET_POSITION_SET_EVENT(hdr) __MFP_CAST_EVENT(hdr, POSITION_SET)") +cpp_quote("#define MFP_GET_RATE_SET_EVENT(hdr) __MFP_CAST_EVENT(hdr, RATE_SET)") +cpp_quote("#define MFP_GET_MEDIAITEM_CREATED_EVENT(hdr) __MFP_CAST_EVENT(hdr, MEDIAITEM_CREATED)") +cpp_quote("#define MFP_GET_MEDIAITEM_SET_EVENT(hdr) __MFP_CAST_EVENT(hdr, MEDIAITEM_SET)") +cpp_quote("#define MFP_GET_FRAME_STEP_EVENT(hdr) __MFP_CAST_EVENT(hdr, FRAME_STEP)") +cpp_quote("#define MFP_GET_MEDIAITEM_CLEARED_EVENT(hdr) __MFP_CAST_EVENT(hdr, MEDIAITEM_CLEARED)") +cpp_quote("#define MFP_GET_MF_EVENT(hdr) __MFP_CAST_EVENT(hdr, MF)") +cpp_quote("#define MFP_GET_ERROR_EVENT(hdr) __MFP_CAST_EVENT(hdr, ERROR)") +cpp_quote("#define MFP_GET_PLAYBACK_ENDED_EVENT(hdr) __MFP_CAST_EVENT(hdr, PLAYBACK_ENDED)") +cpp_quote("#define MFP_GET_ACQUIRE_USER_CREDENTIAL_EVENT(hdr) __MFP_CAST_EVENT(hdr, ACQUIRE_USER_CREDENTIAL)") + [ object, uuid(766c8ffb-5fdb-4fea-a28d-b912996f51bd), -- 2.30.2

1 2

[PATCH] mf/tests: Add some tests for EVR sink services.
by Nikolay Sivov April 20, 2021

April 20, 2021

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com> --- dlls/mf/tests/mf.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/dlls/mf/tests/mf.c b/dlls/mf/tests/mf.c index bf482ae4c71..b990b4614da 100644 --- a/dlls/mf/tests/mf.c +++ b/dlls/mf/tests/mf.c @@ -44,6 +44,8 @@ DEFINE_GUID(MFVideoFormat_ABGR32, 0x00000020, 0x0000, 0x0010, 0x80, 0x00, 0x00, #include "mmdeviceapi.h" #include "audioclient.h" #include "evr.h" +#include "d3d9.h" +#include "evr9.h" #include "wine/test.h" @@ -4223,7 +4225,6 @@ static void test_evr(void) IMFActivate *activate; HWND window, window2; LONG sample_count; - IMFGetService *gs; IMFSample *sample; IUnknown *unk; UINT64 window3; @@ -4262,6 +4263,12 @@ static void test_evr(void) check_interface(sink, &IID_IMFClockStateSink, TRUE); check_interface(sink, &IID_IMFGetService, TRUE); check_interface(sink, &IID_IMFQualityAdvise, TRUE); + check_service_interface(sink, &MR_VIDEO_MIXER_SERVICE, &IID_IMFVideoProcessor, TRUE); + check_service_interface(sink, &MR_VIDEO_MIXER_SERVICE, &IID_IMFVideoMixerBitmap, TRUE); + check_service_interface(sink, &MR_VIDEO_MIXER_SERVICE, &IID_IMFVideoMixerControl, TRUE); + check_service_interface(sink, &MR_VIDEO_MIXER_SERVICE, &IID_IMFVideoMixerControl2, TRUE); + check_service_interface(sink, &MR_VIDEO_RENDER_SERVICE, &IID_IMFVideoDisplayControl, TRUE); + check_service_interface(sink, &MR_VIDEO_RENDER_SERVICE, &IID_IMFVideoPositionMapper, TRUE); hr = MFGetService((IUnknown *)sink, &MR_VIDEO_RENDER_SERVICE, &IID_IMFVideoDisplayControl, (void **)&display_control); @@ -4444,15 +4451,6 @@ static void test_evr(void) ok(hr == S_OK, "Unexpected hr %#x.\n", hr); ok(flags == (MEDIASINK_CAN_PREROLL | MEDIASINK_CLOCK_REQUIRED), "Unexpected flags %#x.\n", flags); - hr = IMFMediaSink_QueryInterface(sink, &IID_IMFGetService, (void **)&gs); - ok(hr == S_OK, "Unexpected hr %#x.\n", hr); - - hr = IMFGetService_GetService(gs, &MR_VIDEO_MIXER_SERVICE, &IID_IMFVideoMixerControl, (void **)&unk); - ok(hr == S_OK, "Unexpected hr %#x.\n", hr); - IUnknown_Release(unk); - - IMFGetService_Release(gs); - hr = IMFActivate_ShutdownObject(activate); ok(hr == S_OK, "Failed to shut down, hr %#x.\n", hr); -- 2.30.2

1 0