April 2021 - Wine-Devel - list.winehq.org

[PATCH 01/12] msvcrt: Import rint implementation from musl.
by Piotr Caban April 30, 2021

April 30, 2021

Signed-off-by: Piotr Caban <piotr(a)codeweavers.com> --- configure.ac | 1 - dlls/msvcrt/math.c | 21 ++++++++++++++++++--- dlls/msvcrt/unixlib.c | 13 ------------- dlls/msvcrt/unixlib.h | 1 - 4 files changed, 18 insertions(+), 18 deletions(-)

1 0

[PATCH 1/3] winegstreamer: Fix integer overflow in scale_uint64.
by Anton Baskanov April 30, 2021

April 30, 2021

Signed-off-by: Anton Baskanov <baskanov(a)gmail.com> --- dlls/winegstreamer/quartz_parser.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/winegstreamer/quartz_parser.c b/dlls/winegstreamer/quartz_parser.c index 243dc9f80ba..fbc9fd32628 100644 --- a/dlls/winegstreamer/quartz_parser.c +++ b/dlls/winegstreamer/quartz_parser.c @@ -597,8 +597,8 @@ static uint64_t scale_uint64(uint64_t value, uint32_t numerator, uint32_t denomi return 0; i.QuadPart = value; - low.QuadPart = i.u.LowPart * numerator; - high.QuadPart = i.u.HighPart * numerator + low.u.HighPart; + low.QuadPart = (ULONGLONG)i.u.LowPart * numerator; + high.QuadPart = (ULONGLONG)i.u.HighPart * numerator + low.u.HighPart; low.u.HighPart = 0; if (high.u.HighPart >= denominator) -- 2.25.1

4 11

[PATCH] msado15: Use Recordset_Open in Connection_Execute
by Alistair Leslie-Hughes April 30, 2021

April 30, 2021

Signed-off-by: Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> --- dlls/msado15/connection.c | 36 +++++++++++++++++------------------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/dlls/msado15/connection.c b/dlls/msado15/connection.c index a3c9a450be6..2d43aff787f 100644 --- a/dlls/msado15/connection.c +++ b/dlls/msado15/connection.c @@ -339,51 +339,49 @@ static HRESULT WINAPI connection_Execute( _Connection *iface, BSTR command, VARI { struct connection *connection = impl_from_Connection( iface ); HRESULT hr; - ICommandText *command_text; - DBROWCOUNT affected; - IUnknown *rowset; _Recordset *recordset; - ADORecordsetConstruction *construct; + VARIANT source, active; + IDispatch *dispatch; FIXME( "%p, %s, %p, 0x%08x, %p Semi-stub\n", iface, debugstr_w(command), records_affected, options, record_set ); if (connection->state == adStateClosed) return MAKE_ADO_HRESULT( adErrObjectClosed ); - hr = create_command_text(connection->session, command, &command_text); + hr = Recordset_create( (void**)&recordset); if (FAILED(hr)) + { return hr; + } - hr = ICommandText_Execute(command_text, NULL, &IID_IUnknown, NULL, &affected, &rowset); - ICommandText_Release(command_text); - if (FAILED(hr)) - return hr; + _Recordset_put_CursorLocation(recordset, connection->location); - hr = Recordset_create( (void**)&recordset); + V_VT(&source) = VT_BSTR; + V_BSTR(&source) = command; + + hr = _Connection_QueryInterface(&connection->Connection_iface, &IID_IDispatch, (void**)&dispatch); if (FAILED(hr)) { - IUnknown_Release(rowset); + _Recordset_Release(recordset); return hr; } - hr = _Recordset_QueryInterface(recordset, &IID_ADORecordsetConstruction, (void**)&construct); + V_VT(&active) = VT_DISPATCH; + V_DISPATCH(&active) = dispatch; + + hr = _Recordset_Open(recordset, source, active, adOpenDynamic, adLockPessimistic, 0); + VariantClear(&active); if (FAILED(hr)) { - IUnknown_Release(rowset); _Recordset_Release(recordset); return hr; } - ADORecordsetConstruction_put_Rowset(construct, rowset); - ADORecordsetConstruction_Release(construct); - IUnknown_Release(rowset); - if (records_affected) { V_VT(records_affected) = VT_I4; - V_I4(records_affected) = affected; + _Recordset_get_RecordCount(recordset, &V_I4(records_affected)); } - _Recordset_put_CursorLocation(recordset, connection->location); *record_set = recordset; return hr; -- 2.30.2

3 2

[PATCH 1/5] user32: Add a default MapVirtualKeyEx implementation.
by Rémi Bernon April 30, 2021

April 30, 2021

Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- dlls/user32/driver.c | 2 +- dlls/user32/input.c | 154 ++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 152 insertions(+), 4 deletions(-) diff --git a/dlls/user32/driver.c b/dlls/user32/driver.c index e5855e1c51b..aedc0366615 100644 --- a/dlls/user32/driver.c +++ b/dlls/user32/driver.c @@ -275,7 +275,7 @@ static HKL CDECL nulldrv_LoadKeyboardLayout( LPCWSTR name, UINT flags ) static UINT CDECL nulldrv_MapVirtualKeyEx( UINT code, UINT type, HKL layout ) { - return 0; + return -1; /* use default implementation */ } static BOOL CDECL nulldrv_RegisterHotKey( HWND hwnd, UINT modifiers, UINT vk ) diff --git a/dlls/user32/input.c b/dlls/user32/input.c index b21ec73696d..4eaac54343e 100644 --- a/dlls/user32/input.c +++ b/dlls/user32/input.c @@ -777,14 +777,162 @@ UINT WINAPI MapVirtualKeyExA(UINT code, UINT maptype, HKL hkl) return ret; } + +/* English keyboard layout (0x0409) */ +static const UINT kbd_en_vsc2vk[] = +{ + 0x00, 0x1b, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0xbd, 0xbb, 0x08, 0x09, + 0x51, 0x57, 0x45, 0x52, 0x54, 0x59, 0x55, 0x49, 0x4f, 0x50, 0xdb, 0xdd, 0x0d, 0xa2, 0x41, 0x53, + 0x44, 0x46, 0x47, 0x48, 0x4a, 0x4b, 0x4c, 0xba, 0xde, 0xc0, 0xa0, 0xdc, 0x5a, 0x58, 0x43, 0x56, + 0x42, 0x4e, 0x4d, 0xbc, 0xbe, 0xbf, 0xa1, 0x6a, 0xa4, 0x20, 0x14, 0x70, 0x71, 0x72, 0x73, 0x74, + 0x75, 0x76, 0x77, 0x78, 0x79, 0x90, 0x91, 0x24, 0x26, 0x21, 0x6d, 0x25, 0x0c, 0x27, 0x6b, 0x23, + 0x28, 0x22, 0x2d, 0x2e, 0x2c, 0x00, 0xe2, 0x7a, 0x7b, 0x0c, 0xee, 0xf1, 0xea, 0xf9, 0xf5, 0xf3, + 0x00, 0x00, 0xfb, 0x2f, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0xed, + 0x00, 0xe9, 0x00, 0xc1, 0x00, 0x00, 0x87, 0x00, 0x00, 0x00, 0x00, 0xeb, 0x09, 0x00, 0xc2, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + /* 0xe000 */ + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xb1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb0, 0x00, 0x00, 0x0d, 0xa3, 0x00, 0x00, + 0xad, 0xb7, 0xb3, 0x00, 0xb2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xae, 0x00, + 0xaf, 0x00, 0xac, 0x00, 0x00, 0x6f, 0x00, 0x2c, 0xa5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x24, 0x26, 0x21, 0x00, 0x25, 0x00, 0x27, 0x00, 0x23, + 0x28, 0x22, 0x2d, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x5c, 0x5d, 0x00, 0x5f, + 0x00, 0x00, 0x00, 0x00, 0x00, 0xaa, 0xab, 0xa8, 0xa9, 0xa7, 0xa6, 0xb6, 0xb4, 0xb5, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + /* 0xe100 */ + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +}; + +static const UINT kbd_en_vk2char[] = +{ + 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x08, 0x09, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1b, 0x00, 0x00, 0x00, 0x00, + ' ', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', + 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 0x00, 0x00, 0x00, 0x00, 0x00, + '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '*', '+', 0x00, '-', '.', '/', + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, ';', '=', ',', '-', '.', '/', + '`', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, '[', '\\', ']', '\'', 0x00, + 0x00, 0x00, '\\', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +}; + + /****************************************************************************** * MapVirtualKeyExW (USER32.@) */ -UINT WINAPI MapVirtualKeyExW(UINT code, UINT maptype, HKL hkl) +UINT WINAPI MapVirtualKeyExW( UINT code, UINT type, HKL layout ) { - TRACE_(keyboard)("(%X, %d, %p)\n", code, maptype, hkl); + const UINT *vsc2vk, *vk2char; + UINT vsc2vk_size, vk2char_size; + UINT ret; + + TRACE_(keyboard)( "code %u, type %u, layout %p.\n", code, type, layout ); - return USER_Driver->pMapVirtualKeyEx(code, maptype, hkl); + if ((ret = USER_Driver->pMapVirtualKeyEx( code, type, layout )) != -1) return ret; + + /* FIXME: English keyboard layout specific */ + + vsc2vk = kbd_en_vsc2vk; + vsc2vk_size = ARRAYSIZE(kbd_en_vsc2vk); + vk2char = kbd_en_vk2char; + vk2char_size = ARRAYSIZE(kbd_en_vk2char); + + switch (type) + { + case MAPVK_VK_TO_VSC_EX: + case MAPVK_VK_TO_VSC: + switch (code) + { + case VK_SHIFT: code = VK_LSHIFT; break; + case VK_CONTROL: code = VK_LCONTROL; break; + case VK_MENU: code = VK_LMENU; break; + case VK_NUMPAD0: code = VK_INSERT; break; + case VK_NUMPAD1: code = VK_END; break; + case VK_NUMPAD2: code = VK_DOWN; break; + case VK_NUMPAD3: code = VK_NEXT; break; + case VK_NUMPAD4: code = VK_LEFT; break; + case VK_NUMPAD5: code = VK_CLEAR; break; + case VK_NUMPAD6: code = VK_RIGHT; break; + case VK_NUMPAD7: code = VK_HOME; break; + case VK_NUMPAD8: code = VK_UP; break; + case VK_NUMPAD9: code = VK_PRIOR; break; + case VK_DECIMAL: code = VK_DELETE; break; + } + + for (ret = 0; ret < vsc2vk_size; ++ret) if (vsc2vk[ret] == code) break; + if (ret >= vsc2vk_size) ret = 0; + + if (type == MAPVK_VK_TO_VSC) + { + if (ret >= 0x200) ret = 0; + else ret &= 0xff; + } + else if (ret >= 0x100) ret += 0xdf00; + break; + case MAPVK_VSC_TO_VK: + case MAPVK_VSC_TO_VK_EX: + if (code & 0xe000) code -= 0xdf00; + if (code >= vsc2vk_size) ret = 0; + else ret = vsc2vk[code]; + + if (type == MAPVK_VSC_TO_VK) + { + switch (ret) + { + case VK_LSHIFT: case VK_RSHIFT: ret = VK_SHIFT; break; + case VK_LCONTROL: case VK_RCONTROL: ret = VK_CONTROL; break; + case VK_LMENU: case VK_RMENU: ret = VK_MENU; break; + } + } + break; + case MAPVK_VK_TO_CHAR: + if (code >= vk2char_size) ret = 0; + else ret = vk2char[code]; + break; + default: + FIXME_(keyboard)( "unknown type %d\n", type ); + return 0; + } + + TRACE_(keyboard)( "returning 0x%04x\n", ret ); + return ret; } /**************************************************************************** -- 2.31.0

2 7

[PATCH 6/6] msv1_0: Implement SpSealMessage and SpUnsealMessage.
by Hans Leidekker April 30, 2021

April 30, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/msv1_0/main.c | 75 ++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 73 insertions(+), 2 deletions(-) diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c index 5e6372b138c..f61e3c90efe 100644 --- a/dlls/msv1_0/main.c +++ b/dlls/msv1_0/main.c @@ -1430,14 +1430,85 @@ static NTSTATUS NTAPI ntlm_SpVerifySignature( LSA_SEC_HANDLE handle, SecBufferDe return verify_signature( ctx, ctx->flags, msg, idx ); } +static NTSTATUS NTAPI ntlm_SpSealMessage( LSA_SEC_HANDLE handle, ULONG qop, SecBufferDesc *msg, ULONG msg_seq_no ) +{ + int token_idx, data_idx; + struct ntlm_ctx *ctx; + + TRACE( "%lx, %08x, %p %u\n", handle, qop, msg, msg_seq_no ); + if (qop) FIXME( "ignoring quality of protection %08x\n", qop ); + if (msg_seq_no) FIXME( "ignoring message sequence number %u\n", msg_seq_no ); + + if (!handle) return SEC_E_INVALID_HANDLE; + + if (!msg || !msg->pBuffers || msg->cBuffers < 2 || + (token_idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1 || + (data_idx = get_buffer_index( msg, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; + + if (msg->pBuffers[token_idx].cbBuffer < 16) return SEC_E_BUFFER_TOO_SMALL; + + ctx = (struct ntlm_ctx *)handle; + if (ctx->flags & FLAG_NEGOTIATE_NTLM2 && ctx->flags & FLAG_NEGOTIATE_SEAL) + { + create_signature( ctx, ctx->flags, msg, token_idx, SIGN_SEND, FALSE ); + + arc4_process( &ctx->crypt.ntlm2.send_arc4info, msg->pBuffers[data_idx].pvBuffer, + msg->pBuffers[data_idx].cbBuffer ); + if (ctx->flags & FLAG_NEGOTIATE_KEY_EXCHANGE) + arc4_process( &ctx->crypt.ntlm2.send_arc4info, (char *)msg->pBuffers[token_idx].pvBuffer + 4, 8 ); + } + else + { + char *sig = msg->pBuffers[token_idx].pvBuffer; + + create_signature( ctx, ctx->flags | FLAG_NEGOTIATE_SIGN, msg, token_idx, SIGN_SEND, FALSE ); + + arc4_process( &ctx->crypt.ntlm.arc4info, msg->pBuffers[data_idx].pvBuffer, msg->pBuffers[data_idx].cbBuffer ); + arc4_process( &ctx->crypt.ntlm.arc4info, sig + 4, 12 ); + + if (ctx->flags & FLAG_NEGOTIATE_ALWAYS_SIGN || !ctx->flags) memset( sig + 4, 0, 4 ); + } + + return SEC_E_OK; +} + +static NTSTATUS NTAPI ntlm_SpUnsealMessage( LSA_SEC_HANDLE handle, SecBufferDesc *msg, ULONG msg_seq_no, ULONG *qop ) +{ + int token_idx, data_idx; + struct ntlm_ctx *ctx; + + TRACE( "%lx, %p, %u, %p\n", handle, msg, msg_seq_no, qop ); + if (msg_seq_no) FIXME( "ignoring message sequence number %u\n", msg_seq_no ); + + if (!handle) return SEC_E_INVALID_HANDLE; + + if (!msg || !msg->pBuffers || msg->cBuffers < 2 || + (token_idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1 || + (data_idx = get_buffer_index( msg, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN; + + if (msg->pBuffers[token_idx].cbBuffer < 16) return SEC_E_BUFFER_TOO_SMALL; + + ctx = (struct ntlm_ctx *)handle; + if (ctx->flags & FLAG_NEGOTIATE_NTLM2 && ctx->flags & FLAG_NEGOTIATE_SEAL) + arc4_process( &ctx->crypt.ntlm2.recv_arc4info, msg->pBuffers[data_idx].pvBuffer, + msg->pBuffers[data_idx].cbBuffer ); + else + arc4_process( &ctx->crypt.ntlm.arc4info, msg->pBuffers[data_idx].pvBuffer, + msg->pBuffers[data_idx].cbBuffer); + + /* make sure we use a session key for the signature check, SealMessage always does that, + even in the dummy case */ + return verify_signature( ctx, ctx->flags | FLAG_NEGOTIATE_SIGN, msg, token_idx ); +} + static SECPKG_USER_FUNCTION_TABLE ntlm_user_table = { ntlm_SpInstanceInit, NULL, /* SpInitUserModeContext */ ntlm_SpMakeSignature, ntlm_SpVerifySignature, - NULL, /* SpSealMessage */ - NULL, /* SpUnsealMessage */ + ntlm_SpSealMessage, + ntlm_SpUnsealMessage, NULL, /* SpGetContextToken */ NULL, /* SpQueryContextAttributes */ NULL, /* SpCompleteAuthToken */ -- 2.30.2

1 0

[PATCH 5/6] msv1_0: Implement SpVerifySignature.
by Hans Leidekker April 30, 2021

April 30, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/msv1_0/main.c | 57 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 56 insertions(+), 1 deletion(-) diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c index d9b9d16fa64..5e6372b138c 100644 --- a/dlls/msv1_0/main.c +++ b/dlls/msv1_0/main.c @@ -1375,12 +1375,67 @@ static NTSTATUS NTAPI ntlm_SpMakeSignature( LSA_SEC_HANDLE handle, ULONG qop, Se return create_signature( ctx, ctx->flags, msg, idx, SIGN_SEND, TRUE ); } +static NTSTATUS verify_signature( struct ntlm_ctx *ctx, unsigned int flags, SecBufferDesc *msg, int idx ) +{ + NTSTATUS status; + unsigned int i; + SecBufferDesc desc; + SecBuffer *buf; + char sig[16]; + + if (!(buf = malloc( msg->cBuffers * sizeof(*buf) ))) return SEC_E_INSUFFICIENT_MEMORY; + desc.ulVersion = SECBUFFER_VERSION; + desc.cBuffers = msg->cBuffers; + desc.pBuffers = buf; + + for (i = 0; i < msg->cBuffers; i++) + { + if (msg->pBuffers[i].BufferType == SECBUFFER_TOKEN) + { + buf[i].BufferType = SECBUFFER_TOKEN; + buf[i].cbBuffer = 16; + buf[i].pvBuffer = sig; + } + else + { + buf[i].BufferType = msg->pBuffers[i].BufferType; + buf[i].cbBuffer = msg->pBuffers[i].cbBuffer; + buf[i].pvBuffer = msg->pBuffers[i].pvBuffer; + } + } + + if ((status = create_signature( ctx, flags, &desc, idx, SIGN_RECV, TRUE )) == SEC_E_OK) + { + if (memcmp( (char *)buf[idx].pvBuffer + 8, (char *)msg->pBuffers[idx].pvBuffer + 8, 8 )) + status = SEC_E_MESSAGE_ALTERED; + } + + free( buf ); + return status; +} + +static NTSTATUS NTAPI ntlm_SpVerifySignature( LSA_SEC_HANDLE handle, SecBufferDesc *msg, ULONG msg_seq_no, ULONG *qop ) +{ + struct ntlm_ctx *ctx = (struct ntlm_ctx *)handle; + int idx; + + TRACE( "%lx, %p, %u, %p\n", handle, msg, msg_seq_no, qop ); + if (msg_seq_no) FIXME( "ignoring message sequence number %u\n", msg_seq_no ); + + if (!handle) return SEC_E_INVALID_HANDLE; + if (!msg || !msg->pBuffers || msg->cBuffers < 2 || (idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1) + return SEC_E_INVALID_TOKEN; + if (msg->pBuffers[idx].cbBuffer < 16) return SEC_E_BUFFER_TOO_SMALL; + + return verify_signature( ctx, ctx->flags, msg, idx ); +} + static SECPKG_USER_FUNCTION_TABLE ntlm_user_table = { ntlm_SpInstanceInit, NULL, /* SpInitUserModeContext */ ntlm_SpMakeSignature, - NULL, /* SpVerifySignature */ + ntlm_SpVerifySignature, NULL, /* SpSealMessage */ NULL, /* SpUnsealMessage */ NULL, /* SpGetContextToken */ -- 2.30.2

1 0

[PATCH 4/6] msv1_0: Implement SpMakeSignature.
by Hans Leidekker April 30, 2021

April 30, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/msv1_0/main.c | 199 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 198 insertions(+), 1 deletion(-) diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c index e039b68c920..d9b9d16fa64 100644 --- a/dlls/msv1_0/main.c +++ b/dlls/msv1_0/main.c @@ -523,6 +523,26 @@ static void arc4_init( struct arc4_info *info, const char *key, unsigned int len } } +static void arc4_process( struct arc4_info *info, char *buf, unsigned int len ) +{ + char *state = info->state; + unsigned int x = info->x, y = info->y, a, b; + + while (len--) + { + x = (x + 1) & 0xff; + a = state[x]; + y = (y + a) & 0xff; + b = state[y]; + state[x] = b; + state[y] = a; + *buf++ ^= state[(a + b) & 0xff]; + } + + info->x = x; + info->y = y; +} + static int get_buffer_index( SecBufferDesc *desc, ULONG type ) { int idx; @@ -1178,11 +1198,188 @@ static NTSTATUS NTAPI ntlm_SpInstanceInit( ULONG version, SECPKG_DLL_FUNCTIONS * return STATUS_SUCCESS; } +struct hmac_md5_ctx +{ + struct md5_ctx ctx; + char outer_padding[64]; +}; + +static void hmac_md5_init( struct hmac_md5_ctx *ctx, const char *key, unsigned int key_len ) +{ + char inner_padding[64], tmp_key[16]; + unsigned int i; + + if (key_len > 64) + { + struct md5_ctx tmp_ctx; + + MD5Init( &tmp_ctx ); + MD5Update( &tmp_ctx, key, key_len ); + MD5Final( &tmp_ctx ); + memcpy( tmp_key, tmp_ctx.digest, 16 ); + + key = tmp_key; + key_len = 16; + } + + memset( inner_padding, 0, 64 ); + memset( ctx->outer_padding, 0, 64 ); + memcpy( inner_padding, key, key_len ); + memcpy( ctx->outer_padding, key, key_len ); + + for (i = 0; i < 64; i++) + { + inner_padding[i] ^= 0x36; + ctx->outer_padding[i] ^= 0x5c; + } + + MD5Init( &ctx->ctx ); + MD5Update( &ctx->ctx, inner_padding, 64 ); +} + +static void hmac_md5_update( struct hmac_md5_ctx *ctx, const char *buf, unsigned int len ) +{ + MD5Update( &ctx->ctx, buf, len ); +} + +static void hmac_md5_final( struct hmac_md5_ctx *ctx, char *digest ) +{ + struct md5_ctx outer_ctx; + char inner_digest[16]; + + MD5Final( &ctx->ctx ); + memcpy( inner_digest, ctx->ctx.digest, 16 ); + + MD5Init( &outer_ctx ); + MD5Update( &outer_ctx, ctx->outer_padding, 64 ); + MD5Update( &outer_ctx, inner_digest, 16 ); + MD5Final( &outer_ctx ); + + memcpy( digest, outer_ctx.digest, 16 ); +} + +static SECURITY_STATUS create_signature( struct ntlm_ctx *ctx, unsigned int flags, SecBufferDesc *msg, int idx, + enum sign_direction dir, BOOL encrypt ) +{ + unsigned int i, sign_version = 1; + char *sig = msg->pBuffers[idx].pvBuffer; + + if (flags & FLAG_NEGOTIATE_NTLM2 && flags & FLAG_NEGOTIATE_SIGN) + { + char digest[16], seq_no[4]; + struct hmac_md5_ctx hmac_md5; + + if (dir == SIGN_SEND) + { + seq_no[0] = (ctx->crypt.ntlm2.send_seq_no >> 0) & 0xff; + seq_no[1] = (ctx->crypt.ntlm2.send_seq_no >> 8) & 0xff; + seq_no[2] = (ctx->crypt.ntlm2.send_seq_no >> 16) & 0xff; + seq_no[3] = (ctx->crypt.ntlm2.send_seq_no >> 24) & 0xff; + ctx->crypt.ntlm2.send_seq_no++; + + hmac_md5_init( &hmac_md5, ctx->crypt.ntlm2.send_sign_key, 16 ); + } + else + { + seq_no[0] = (ctx->crypt.ntlm2.recv_seq_no >> 0) & 0xff; + seq_no[1] = (ctx->crypt.ntlm2.recv_seq_no >> 8) & 0xff; + seq_no[2] = (ctx->crypt.ntlm2.recv_seq_no >> 16) & 0xff; + seq_no[3] = (ctx->crypt.ntlm2.recv_seq_no >> 24) & 0xff; + ctx->crypt.ntlm2.recv_seq_no++; + + hmac_md5_init( &hmac_md5, ctx->crypt.ntlm2.recv_sign_key, 16 ); + } + + hmac_md5_update( &hmac_md5, seq_no, 4 ); + for (i = 0; i < msg->cBuffers; ++i) + { + if (msg->pBuffers[i].BufferType & SECBUFFER_DATA) + hmac_md5_update( &hmac_md5, msg->pBuffers[i].pvBuffer, msg->pBuffers[i].cbBuffer ); + } + hmac_md5_final( &hmac_md5, digest ); + + if (encrypt && flags & FLAG_NEGOTIATE_KEY_EXCHANGE) + { + if (dir == SIGN_SEND) + arc4_process( &ctx->crypt.ntlm2.send_arc4info, digest, 8 ); + else + arc4_process( &ctx->crypt.ntlm2.recv_arc4info, digest, 8 ); + } + + sig[0] = (sign_version >> 0) & 0xff; + sig[1] = (sign_version >> 8) & 0xff; + sig[2] = (sign_version >> 16) & 0xff; + sig[3] = (sign_version >> 24) & 0xff; + memcpy( sig + 4, digest, 8 ); + memcpy( sig + 12, seq_no, 4 ); + + msg->pBuffers[idx].cbBuffer = 16; + return SEC_E_OK; + } + + if (flags & FLAG_NEGOTIATE_SIGN) + { + unsigned int crc = 0; + + for (i = 0; i < msg->cBuffers; ++i) + { + if (msg->pBuffers[i].BufferType & SECBUFFER_DATA) + crc = RtlComputeCrc32( crc, msg->pBuffers[i].pvBuffer, msg->pBuffers[i].cbBuffer ); + } + + sig[0] = (sign_version >> 0) & 0xff; + sig[1] = (sign_version >> 8) & 0xff; + sig[2] = (sign_version >> 16) & 0xff; + sig[3] = (sign_version >> 24) & 0xff; + memset( sig + 4, 0, 4 ); + sig[8] = (crc >> 0) & 0xff; + sig[9] = (crc >> 8) & 0xff; + sig[10] = (crc >> 16) & 0xff; + sig[11] = (crc >> 24) & 0xff; + sig[12] = (ctx->crypt.ntlm.seq_no >> 0) & 0xff; + sig[13] = (ctx->crypt.ntlm.seq_no >> 8) & 0xff; + sig[14] = (ctx->crypt.ntlm.seq_no >> 16) & 0xff; + sig[15] = (ctx->crypt.ntlm.seq_no >> 24) & 0xff; + ctx->crypt.ntlm.seq_no++; + + if (encrypt) arc4_process( &ctx->crypt.ntlm.arc4info, sig + 4, 12 ); + return SEC_E_OK; + } + + if (flags & FLAG_NEGOTIATE_ALWAYS_SIGN || !flags) + { + /* create dummy signature */ + memset( msg->pBuffers[idx].pvBuffer, 0, 16 ); + memset( msg->pBuffers[idx].pvBuffer, 1, 1 ); + msg->pBuffers[idx].cbBuffer = 16; + return SEC_E_OK; + } + + return SEC_E_UNSUPPORTED_FUNCTION; +} + +static NTSTATUS NTAPI ntlm_SpMakeSignature( LSA_SEC_HANDLE handle, ULONG qop, SecBufferDesc *msg, ULONG msg_seq_no ) +{ + struct ntlm_ctx *ctx = (struct ntlm_ctx *)handle; + int idx; + + TRACE( "%lx, 0x%08x, %p, %u\n", handle, qop, msg, msg_seq_no ); + if (qop) FIXME( "ignoring quality of protection %08x\n", qop ); + if (msg_seq_no) FIXME( "ignoring message sequence number %u\n", msg_seq_no ); + + if (!handle) return SEC_E_INVALID_HANDLE; + if (!msg || !msg->pBuffers || msg->cBuffers < 2 || (idx = get_buffer_index( msg, SECBUFFER_TOKEN )) == -1) + return SEC_E_INVALID_TOKEN; + if (msg->pBuffers[idx].cbBuffer < 16) return SEC_E_BUFFER_TOO_SMALL; + + return create_signature( ctx, ctx->flags, msg, idx, SIGN_SEND, TRUE ); +} + static SECPKG_USER_FUNCTION_TABLE ntlm_user_table = { ntlm_SpInstanceInit, NULL, /* SpInitUserModeContext */ - NULL, /* SpMakeSignature */ + ntlm_SpMakeSignature, NULL, /* SpVerifySignature */ NULL, /* SpSealMessage */ NULL, /* SpUnsealMessage */ -- 2.30.2

1 0

[PATCH 3/6] msv1_0: Implement SpQueryContextAttributes.
by Hans Leidekker April 30, 2021

April 30, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/msv1_0/main.c | 76 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 75 insertions(+), 1 deletion(-) diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c index 28cad0cb14c..e039b68c920 100644 --- a/dlls/msv1_0/main.c +++ b/dlls/msv1_0/main.c @@ -1047,6 +1047,80 @@ static NTSTATUS NTAPI ntlm_SpDeleteContext( LSA_SEC_HANDLE handle ) return SEC_E_OK; } +static SecPkgInfoW *build_package_info( const SecPkgInfoW *info ) +{ + SecPkgInfoW *ret; + DWORD size_name = (wcslen(info->Name) + 1) * sizeof(WCHAR); + DWORD size_comment = (wcslen(info->Comment) + 1) * sizeof(WCHAR); + + if (!(ret = RtlAllocateHeap( GetProcessHeap(), 0, sizeof(*ret) + size_name + size_comment ))) return NULL; + ret->fCapabilities = info->fCapabilities; + ret->wVersion = info->wVersion; + ret->wRPCID = info->wRPCID; + ret->cbMaxToken = info->cbMaxToken; + ret->Name = (SEC_WCHAR *)(ret + 1); + memcpy( ret->Name, info->Name, size_name ); + ret->Comment = (SEC_WCHAR *)((char *)ret->Name + size_name); + memcpy( ret->Comment, info->Comment, size_comment ); + return ret; +} + +static NTSTATUS NTAPI ntlm_SpQueryContextAttributes( LSA_SEC_HANDLE handle, ULONG attr, void *buf ) +{ + TRACE( "%lx, %u, %p\n", handle, attr, buf ); + + if (!handle) return SEC_E_INVALID_HANDLE; + + switch (attr) + { +#define X(x) case (x) : FIXME(#x" stub\n"); break + X(SECPKG_ATTR_ACCESS_TOKEN); + X(SECPKG_ATTR_AUTHORITY); + X(SECPKG_ATTR_DCE_INFO); + X(SECPKG_ATTR_KEY_INFO); + X(SECPKG_ATTR_LIFESPAN); + X(SECPKG_ATTR_NAMES); + X(SECPKG_ATTR_NATIVE_NAMES); + X(SECPKG_ATTR_PACKAGE_INFO); + X(SECPKG_ATTR_PASSWORD_EXPIRY); + X(SECPKG_ATTR_SESSION_KEY); + X(SECPKG_ATTR_STREAM_SIZES); + X(SECPKG_ATTR_TARGET_INFORMATION); + case SECPKG_ATTR_FLAGS: + { + SecPkgContext_Flags *flags = (SecPkgContext_Flags *)buf; + struct ntlm_ctx *ctx = (struct ntlm_ctx *)handle; + + flags->Flags = 0; + if (ctx->flags & FLAG_NEGOTIATE_SIGN) flags->Flags |= ISC_RET_INTEGRITY; + if (ctx->flags & FLAG_NEGOTIATE_SEAL) flags->Flags |= ISC_RET_CONFIDENTIALITY; + return SEC_E_OK; + } + case SECPKG_ATTR_SIZES: + { + SecPkgContext_Sizes *sizes = (SecPkgContext_Sizes *)buf; + sizes->cbMaxToken = NTLM_MAX_BUF; + sizes->cbMaxSignature = 16; + sizes->cbBlockSize = 0; + sizes->cbSecurityTrailer = 16; + return SEC_E_OK; + } + case SECPKG_ATTR_NEGOTIATION_INFO: + { + SecPkgContext_NegotiationInfoW *info = (SecPkgContext_NegotiationInfoW *)buf; + if (!(info->PackageInfo = build_package_info( &ntlm_package_info ))) return SEC_E_INSUFFICIENT_MEMORY; + info->NegotiationState = SECPKG_NEGOTIATION_COMPLETE; + return SEC_E_OK; + } +#undef X + default: + FIXME( "unknown attribute %u\n", attr ); + break; + } + + return SEC_E_UNSUPPORTED_FUNCTION; +} + static SECPKG_FUNCTION_TABLE ntlm_table = { ntlm_LsaApInitializePackage, @@ -1073,7 +1147,7 @@ static SECPKG_FUNCTION_TABLE ntlm_table = NULL, /* ApplyControlToken */ NULL, /* GetUserInfo */ NULL, /* GetExtendedInformation */ - NULL, /* SpQueryContextAttributes */ + ntlm_SpQueryContextAttributes, NULL, /* SpAddCredentials */ NULL, /* SetExtendedInformation */ NULL, /* SetContextAttributes */ -- 2.30.2

1 0

[PATCH 2/6] msv1_0: Implement SpAcceptLsaModeContext.
by Hans Leidekker April 30, 2021

April 30, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/msv1_0/main.c | 209 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 208 insertions(+), 1 deletion(-) diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c index 4b0a636bd77..28cad0cb14c 100644 --- a/dlls/msv1_0/main.c +++ b/dlls/msv1_0/main.c @@ -829,6 +829,213 @@ done: return status; } +static NTSTATUS NTAPI ntlm_SpAcceptLsaModeContext( LSA_SEC_HANDLE cred_handle, LSA_SEC_HANDLE ctx_handle, + SecBufferDesc *input, ULONG ctx_req, ULONG data_rep, + LSA_SEC_HANDLE *new_ctx_handle, SecBufferDesc *output, + ULONG *ctx_attr, TimeStamp *expiry, BOOLEAN *mapped_ctx, + SecBuffer *ctx_data ) +{ + NTSTATUS status = SEC_E_INSUFFICIENT_MEMORY; + struct ntlm_ctx *ctx = NULL; + char *buf, *bin, *want_flags = NULL; + unsigned int len, bin_len; + + TRACE( "%lx, %lx, %08x, %u, %p, %p, %p, %p, %p, %p, %p\n", cred_handle, ctx_handle, ctx_req, data_rep, input, + new_ctx_handle, output, ctx_attr, expiry, mapped_ctx, ctx_data ); + if (ctx_req) FIXME( "ignoring flags %08x\n", ctx_req ); + + if (!(buf = malloc( NTLM_MAX_BUF ))) return SEC_E_INSUFFICIENT_MEMORY; + if (!(bin = malloc( NTLM_MAX_BUF ))) goto done; + + if (!ctx_handle) + { + struct ntlm_cred *cred = (struct ntlm_cred *)cred_handle; + char *argv[3]; + + if (!cred || cred->mode != MODE_SERVER) + { + status = SEC_E_INVALID_HANDLE; + goto done; + } + + if (!input || input->cBuffers < 1) + { + status = SEC_E_INCOMPLETE_MESSAGE; + goto done; + } + + if (input->pBuffers[0].cbBuffer > NTLM_MAX_BUF) + { + status = SEC_E_INVALID_TOKEN; + goto done; + } + else bin_len = input->pBuffers[0].cbBuffer; + + argv[0] = (char *)"ntlm_auth"; + argv[1] = (char *)"--helper-protocol=squid-2.5-ntlmssp"; + argv[2] = NULL; + if ((status = ntlm_funcs->fork( argv, &ctx )) != SEC_E_OK) goto done; + ctx->mode = MODE_SERVER; + + if (!(want_flags = malloc( 73 ))) + { + status = SEC_E_INSUFFICIENT_MEMORY; + goto done; + } + strcpy( want_flags, "SF" ); + if (ctx_req & ASC_REQ_CONFIDENTIALITY) strcat( want_flags, " NTLMSSP_FEATURE_SEAL" ); + if (ctx_req & ASC_REQ_CONNECTION) + { + strcat( want_flags, " NTLMSSP_FEATURE_SESSION_KEY" ); + ctx->attrs |= ASC_RET_CONNECTION; + } + if (ctx_req & ASC_REQ_INTEGRITY) strcat( want_flags, " NTLMSSP_FEATURE_SIGN" ); + if (ctx_req & ASC_REQ_ALLOCATE_MEMORY) FIXME( "ASC_REQ_ALLOCATE_MEMORY\n" ); + if (ctx_req & ASC_REQ_EXTENDED_ERROR) FIXME( "ASC_REQ_EXTENDED_ERROR\n" ); + if (ctx_req & ASC_REQ_MUTUAL_AUTH) FIXME( "ASC_REQ_MUTUAL_AUTH\n" ); + if (ctx_req & ASC_REQ_REPLAY_DETECT) FIXME( "ASC_REQ_REPLAY_DETECT\n" ); + if (ctx_req & ASC_REQ_SEQUENCE_DETECT) FIXME( "ASC_REQ_SEQUENCE_DETECT\n" ); + if (ctx_req & ASC_REQ_STREAM) FIXME( "ASC_REQ_STREAM\n" ); + + if (strlen( want_flags ) > 3) + { + TRACE( "want flags are %s\n", debugstr_a(want_flags) ); + strcpy( buf, want_flags ); + if ((status = ntlm_funcs->chat( ctx, buf, NTLM_MAX_BUF, &len )) != SEC_E_OK) goto done; + if (!strncmp( buf, "BH", 2 )) ERR( "ntlm_auth doesn't understand new command set\n" ); + } + + memcpy( bin, input->pBuffers[0].pvBuffer, bin_len ); + strcpy( buf, "YR " ); + encode_base64( bin, bin_len, buf + 3 ); + + if ((status = ntlm_funcs->chat( ctx, buf, NTLM_MAX_BUF, &len )) != SEC_E_OK) goto done; + TRACE( "ntlm_auth returned %s\n", buf ); + if (strncmp( buf, "TT ", 3)) + { + status = SEC_E_INTERNAL_ERROR; + goto done; + } + bin_len = decode_base64( buf + 3, len - 3, bin ); + + if (!output || output->cBuffers < 1) + { + status = SEC_E_INSUFFICIENT_MEMORY; + goto done; + } + output->pBuffers[0].cbBuffer = bin_len; + output->pBuffers[0].BufferType = SECBUFFER_DATA; + memcpy( output->pBuffers[0].pvBuffer, bin, bin_len ); + + *new_ctx_handle = (LSA_SEC_HANDLE)ctx; + status = SEC_I_CONTINUE_NEEDED; + } + else + { + if (!input || input->cBuffers < 1) + { + status = SEC_E_INCOMPLETE_MESSAGE; + goto done; + } + + ctx = (struct ntlm_ctx *)ctx_handle; + if (!ctx || ctx->mode != MODE_SERVER) + { + status = SEC_E_INVALID_HANDLE; + goto done; + } + + if (input->pBuffers[0].cbBuffer > NTLM_MAX_BUF) + { + status = SEC_E_INVALID_TOKEN; + goto done; + } + else bin_len = input->pBuffers[0].cbBuffer; + memcpy( bin, input->pBuffers[0].pvBuffer, bin_len ); + + strcpy( buf, "KK " ); + encode_base64( bin, bin_len, buf + 3 ); + + TRACE( "client sent %s\n", debugstr_a(buf) ); + if ((status = ntlm_funcs->chat( ctx, buf, NTLM_MAX_BUF, &len )) != SEC_E_OK) goto done; + TRACE( "ntlm_auth returned %s\n", debugstr_a(buf) ); + + /* At this point, we get a NA if the user didn't authenticate, but a BH if ntlm_auth could not + * connect to winbindd. Apart from running Wine as root, there is no way to fix this for now, + * so just handle this as a failed login. */ + if (strncmp( buf, "AF ", 3 )) + { + if (!strncmp( buf, "NA ", 3 )) + { + status = SEC_E_LOGON_DENIED; + goto done; + } + else + { + const char err_v3[] = "BH NT_STATUS_ACCESS_DENIED"; + const char err_v4[] = "BH NT_STATUS_UNSUCCESSFUL"; + + if ((len >= strlen(err_v3) && !strncmp( buf, err_v3, strlen(err_v3) )) || + (len >= strlen(err_v4) && !strncmp( buf, err_v4, strlen(err_v4) ))) + { + TRACE( "connection to winbindd failed\n" ); + status = SEC_E_LOGON_DENIED; + } + else status = SEC_E_INTERNAL_ERROR; + goto done; + } + } + output->pBuffers[0].cbBuffer = 0; + + strcpy( buf, "GF" ); + if ((status = ntlm_funcs->chat( ctx, buf, NTLM_MAX_BUF, &len )) != SEC_E_OK) goto done; + if (len < 3) ctx->flags = 0; + else sscanf( buf + 3, "%x", &ctx->flags ); + + strcpy( buf, "GK" ); + if ((status = ntlm_funcs->chat( ctx, buf, NTLM_MAX_BUF, &len )) != SEC_E_OK) goto done; + + if (!strncmp( buf, "BH", 2 )) TRACE( "no key negotiated\n" ); + else if (!strncmp( buf, "GK ", 3 )) + { + bin_len = decode_base64( buf + 3, len - 3, bin ); + TRACE( "session key is %s\n", debugstr_a(buf + 3) ); + memcpy( ctx->session_key, bin, bin_len ); + } + + if (len < 3) memset( ctx->session_key, 0 , 16 ); + else + { + if (!strncmp( buf, "BH ", 3 )) + { + TRACE( "helper sent %s\n", debugstr_a(buf + 3) ); + /*FIXME: generate dummy session key = MD4(MD4(password))*/ + memset( ctx->session_key, 0 , 16 ); + } + else if (!strncmp( buf, "GK ", 3 )) + { + bin_len = decode_base64( buf + 3, len - 3, bin ); + TRACE( "session key is %s\n", debugstr_a(buf + 3) ); + memcpy( ctx->session_key, bin, 16 ); + } + } + arc4_init( &ctx->crypt.ntlm.arc4info, ctx->session_key, 16 ); + ctx->crypt.ntlm.seq_no = 0; + + *new_ctx_handle = (LSA_SEC_HANDLE)ctx; + status = SEC_E_OK; + } + +done: + if (status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) ntlm_funcs->cleanup( ctx ); + free( buf ); + free( bin ); + free( want_flags ); + + TRACE( "returning %08x\n", status ); + return status; +} + static NTSTATUS NTAPI ntlm_SpDeleteContext( LSA_SEC_HANDLE handle ) { struct ntlm_ctx *ctx = (struct ntlm_ctx *)handle; @@ -861,7 +1068,7 @@ static SECPKG_FUNCTION_TABLE ntlm_table = NULL, /* GetCredentials */ NULL, /* DeleteCredentials */ ntlm_SpInitLsaModeContext, - NULL, /* SpAcceptLsaModeContext */ + ntlm_SpAcceptLsaModeContext, ntlm_SpDeleteContext, NULL, /* ApplyControlToken */ NULL, /* GetUserInfo */ -- 2.30.2

1 0

[PATCH 1/6] msv1_0: Use RtlAllocateHeap to allocate output buffers.
by Hans Leidekker April 30, 2021

April 30, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/msv1_0/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c index e07dcf6f352..4b0a636bd77 100644 --- a/dlls/msv1_0/main.c +++ b/dlls/msv1_0/main.c @@ -765,7 +765,8 @@ static NTSTATUS NTAPI ntlm_SpInitLsaModeContext( LSA_SEC_HANDLE cred_handle, LSA if (ctx_req & ISC_REQ_ALLOCATE_MEMORY) { - if (!(output->pBuffers[idx].pvBuffer = malloc( bin_len ))) + /* freed with secur32.FreeContextBuffer */ + if (!(output->pBuffers[idx].pvBuffer = RtlAllocateHeap( GetProcessHeap(), 0, bin_len ))) { status = SEC_E_INSUFFICIENT_MEMORY; goto done; -- 2.30.2

1 0