Re: [PATCH 04/13] secur32: Implement InitializeSecurityContext in the SSP/AP wrapper.

[Hans Leidekker]

On Thu, 2018-01-18 at 23:54 +0800, Dmitry Timoshkov wrote:
> +static SECURITY_STATUS WINAPI lsa_InitializeSecurityContextW(
> - CredHandle *credential, CtxtHandle *context, SEC_WCHAR *target_name, ULONG context_req,
> - ULONG reserved1, ULONG target_data_rep, SecBufferDesc *input, ULONG reserved2,
> - CtxtHandle *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry)
>
> +{
> - SECURITY_STATUS status;
> - struct lsa_package *lsa_package = NULL;
> - LSA_SEC_HANDLE lsa_credential = 0, lsa_context = 0, new_lsa_context;
> - UNICODE_STRING target_name_us;
> - BOOLEAN mapped_context;
> -
> - TRACE("%p %p %s %#x %d %d %p %d %p %p %p %p\n", credential, context,
> -
>    debugstr_w(target_name), context_req, reserved1, target_data_rep, input,
> -
>    reserved2, new_context, output, context_attr, ts_expiry);
> -
> - if (credential)
> - {
> -
>    lsa_package = (struct lsa_package *)credential->dwUpper;
> -
>    lsa_credential = (LSA_SEC_HANDLE)credential->dwLower;
> - }
> - else if (context)
> - {
> -
>    lsa_package = (struct lsa_package *)context->dwUpper;
> -
>    lsa_context = (LSA_SEC_HANDLE)context->dwLower;
> - }

It's not an error to pass a credential parameter in the second call, so
you should switch the order here.
> - if (!lsa_package || !new_context) return SEC_E_INVALID_HANDLE;
> -
> - if (!lsa_package->lsa_api || !lsa_package->lsa_api->InitLsaModeContext)
> -
>    return SEC_E_UNSUPPORTED_FUNCTION;
> -
> - if (target_name)
> -
>    RtlInitUnicodeString(&target_name_us, target_name);
> -
> - status = lsa_package->lsa_api->InitLsaModeContext(lsa_credential, lsa_context,
> -
>    target_name ? &target_name_us : NULL, context_req, target_data_rep, input,
> -
>    &new_lsa_context, output, context_attr, ts_expiry, &mapped_context, NULL /* FIXME */);
> - if (status == SEC_E_OK)
> - {
> -
>    new_context->dwLower = (ULONG_PTR)new_lsa_context;
> -
>    new_context->dwUpper = (ULONG_PTR)lsa_package;
> - }

You should also accept SEC_I_CONTINUE_NEEDED here, otherwise the caller
won't see the new context in a three-leg authentication.