?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
kerberos: Slightly simplify name_sspi_to_gss.
[wine.git] / dlls / kerberos / krb5_ap.c
blob99673b05c50937405dd1ab52bd9358d1420f34de
1 /*
2 * Copyright 2017 Dmitry Timoshkov
3 * Copyright 2017 George Popoff
4 * Copyright 2008 Robert Shearman for CodeWeavers
5 * Copyright 2017 Hans Leidekker for CodeWeavers
6 *
7 * Kerberos5 Authentication Package
8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
22 */
23
24 #include "config.h"
25 #include "wine/port.h"
26
27 #include <stdarg.h>
28 #ifdef HAVE_KRB5_KRB5_H
29 #include <krb5/krb5.h>
30 #endif
31 #ifdef SONAME_LIBGSSAPI_KRB5
32 # include <gssapi/gssapi.h>
33 # include <gssapi/gssapi_ext.h>
34 #endif
35
36 #include "ntstatus.h"
37 #define WIN32_NO_STATUS
38 #include "windef.h"
39 #include "winbase.h"
40 #include "winnls.h"
41 #include "rpc.h"
42 #include "sspi.h"
43 #include "ntsecapi.h"
44 #include "ntsecpkg.h"
45 #include "winternl.h"
46 #include "wine/heap.h"
47 #include "wine/library.h"
48 #include "wine/debug.h"
49
50 WINE_DEFAULT_DEBUG_CHANNEL(kerberos);
51
52 #define KERBEROS_MAX_BUF 12000
53
54 #define KERBEROS_CAPS \
55 ( SECPKG_FLAG_INTEGRITY \
56 | SECPKG_FLAG_PRIVACY \
57 | SECPKG_FLAG_TOKEN_ONLY \
58 | SECPKG_FLAG_DATAGRAM \
59 | SECPKG_FLAG_CONNECTION \
60 | SECPKG_FLAG_MULTI_REQUIRED \
61 | SECPKG_FLAG_EXTENDED_ERROR \
62 | SECPKG_FLAG_IMPERSONATION \
63 | SECPKG_FLAG_ACCEPT_WIN32_NAME \
64 | SECPKG_FLAG_NEGOTIABLE \
65 | SECPKG_FLAG_GSS_COMPATIBLE \
66 | SECPKG_FLAG_LOGON \
67 | SECPKG_FLAG_MUTUAL_AUTH \
68 | SECPKG_FLAG_DELEGATION \
69 | SECPKG_FLAG_READONLY_WITH_CHECKSUM \
70 | SECPKG_FLAG_RESTRICTED_TOKENS \
71 | SECPKG_FLAG_APPCONTAINER_CHECKS)
72
73 static WCHAR kerberos_name_W[] = {'K','e','r','b','e','r','o','s',0};
74 static WCHAR kerberos_comment_W[] = {'M','i','c','r','o','s','o','f','t',' ','K','e','r','b','e','r','o','s',' ','V','1','.','0',0};
75 static const SecPkgInfoW infoW =
76 {
77 KERBEROS_CAPS,
78 1,
79 RPC_C_AUTHN_GSS_KERBEROS,
80 KERBEROS_MAX_BUF,
81 kerberos_name_W,
82 kerberos_comment_W
83 };
84
85 static ULONG kerberos_package_id;
86 static LSA_DISPATCH_TABLE lsa_dispatch;
87
88 #ifdef SONAME_LIBKRB5
89
90 static void *libkrb5_handle;
91
92 #define MAKE_FUNCPTR(f) static typeof(f) * p_##f
93 MAKE_FUNCPTR(krb5_init_context);
94 MAKE_FUNCPTR(krb5_free_context);
95 MAKE_FUNCPTR(krb5_free_ticket);
96 MAKE_FUNCPTR(krb5_cccol_cursor_new);
97 MAKE_FUNCPTR(krb5_cccol_cursor_next);
98 MAKE_FUNCPTR(krb5_cccol_cursor_free);
99 MAKE_FUNCPTR(krb5_cc_close);
100 MAKE_FUNCPTR(krb5_cc_start_seq_get);
101 MAKE_FUNCPTR(krb5_cc_end_seq_get);
102 MAKE_FUNCPTR(krb5_cc_next_cred);
103 MAKE_FUNCPTR(krb5_is_config_principal);
104 MAKE_FUNCPTR(krb5_decode_ticket);
105 MAKE_FUNCPTR(krb5_unparse_name_flags);
106 MAKE_FUNCPTR(krb5_free_unparsed_name);
107 MAKE_FUNCPTR(krb5_free_cred_contents);
108 #undef MAKE_FUNCPTR
109
110 static void load_krb5(void)
111 {
112 if (!(libkrb5_handle = wine_dlopen(SONAME_LIBKRB5, RTLD_NOW, NULL, 0)))
113 {
114 WARN("Failed to load %s, Kerberos support will be disabled\n", SONAME_LIBKRB5);
115 return;
116 }
117
118 #define LOAD_FUNCPTR(f) \
119 if (!(p_##f = wine_dlsym(libkrb5_handle, #f, NULL, 0))) \
120 { \
121 ERR("Failed to load %s\n", #f); \
122 goto fail; \
123 }
124
125 LOAD_FUNCPTR(krb5_init_context)
126 LOAD_FUNCPTR(krb5_free_context)
127 LOAD_FUNCPTR(krb5_free_ticket)
128 LOAD_FUNCPTR(krb5_cccol_cursor_new)
129 LOAD_FUNCPTR(krb5_cccol_cursor_next)
130 LOAD_FUNCPTR(krb5_cccol_cursor_free)
131 LOAD_FUNCPTR(krb5_cc_close)
132 LOAD_FUNCPTR(krb5_cc_start_seq_get)
133 LOAD_FUNCPTR(krb5_cc_end_seq_get)
134 LOAD_FUNCPTR(krb5_cc_next_cred)
135 LOAD_FUNCPTR(krb5_is_config_principal)
136 LOAD_FUNCPTR(krb5_decode_ticket)
137 LOAD_FUNCPTR(krb5_unparse_name_flags)
138 LOAD_FUNCPTR(krb5_free_unparsed_name)
139 LOAD_FUNCPTR(krb5_free_cred_contents)
140 #undef LOAD_FUNCPTR
141
142 return;
143
144 fail:
145 wine_dlclose(libkrb5_handle, NULL, 0);
146 libkrb5_handle = NULL;
147 }
148
149 #else /* SONAME_LIBKRB5 */
150
151 static void load_krb5(void)
152 {
153 WARN("Kerberos support was not provided at compile time\n");
154 }
155
156 #endif /* SONAME_LIBKRB5 */
157
158 static const char *debugstr_us( const UNICODE_STRING *us )
159 {
160 if (!us) return "<null>";
161 return debugstr_wn( us->Buffer, us->Length / sizeof(WCHAR) );
162 }
163
164 static NTSTATUS NTAPI kerberos_LsaApInitializePackage(ULONG package_id, PLSA_DISPATCH_TABLE dispatch,
165 PLSA_STRING database, PLSA_STRING confidentiality, PLSA_STRING *package_name)
166 {
167 char *kerberos_name;
168
169 load_krb5();
170
171 kerberos_package_id = package_id;
172 lsa_dispatch = *dispatch;
173
174 kerberos_name = lsa_dispatch.AllocateLsaHeap(sizeof(MICROSOFT_KERBEROS_NAME_A));
175 if (!kerberos_name) return STATUS_NO_MEMORY;
176
177 memcpy(kerberos_name, MICROSOFT_KERBEROS_NAME_A, sizeof(MICROSOFT_KERBEROS_NAME_A));
178
179 *package_name = lsa_dispatch.AllocateLsaHeap(sizeof(**package_name));
180 if (!*package_name)
181 {
182 lsa_dispatch.FreeLsaHeap(kerberos_name);
183 return STATUS_NO_MEMORY;
184 }
185
186 RtlInitString(*package_name, kerberos_name);
187
188 return STATUS_SUCCESS;
189 }
190
191 #ifdef SONAME_LIBKRB5
192
193 struct ticket_info
194 {
195 ULONG count, allocated;
196 KERB_TICKET_CACHE_INFO *info;
197 };
198
199 static NTSTATUS krb5_error_to_status(krb5_error_code error)
200 {
201 switch (error)
202 {
203 case 0: return STATUS_SUCCESS;
204 default:
205 /* FIXME */
206 return STATUS_UNSUCCESSFUL;
207 }
208 }
209
210 static void free_ticket_info(struct ticket_info *info)
211 {
212 ULONG i;
213
214 for (i = 0; i < info->count; i++)
215 {
216 heap_free(info->info[i].RealmName.Buffer);
217 heap_free(info->info[i].ServerName.Buffer);
218 }
219
220 heap_free(info->info);
221 }
222
223 static WCHAR *utf8_to_wstr(const char *utf8)
224 {
225 int len;
226 WCHAR *wstr;
227
228 len = MultiByteToWideChar(CP_UTF8, 0, utf8, -1, NULL, 0);
229 wstr = heap_alloc(len * sizeof(WCHAR));
230 if (wstr)
231 MultiByteToWideChar(CP_UTF8, 0, utf8, -1, wstr, len);
232
233 return wstr;
234 }
235
236 static NTSTATUS copy_tickets_from_cache(krb5_context context, krb5_ccache cache, struct ticket_info *info)
237 {
238 NTSTATUS status;
239 krb5_cc_cursor cursor;
240 krb5_error_code error;
241 krb5_creds credentials;
242 krb5_ticket *ticket;
243 char *name_with_realm, *name_without_realm, *realm_name;
244 WCHAR *realm_nameW, *name_without_realmW;
245
246 error = p_krb5_cc_start_seq_get(context, cache, &cursor);
247 if (error) return krb5_error_to_status(error);
248
249 for (;;)
250 {
251 error = p_krb5_cc_next_cred(context, cache, &cursor, &credentials);
252 if (error)
253 {
254 if (error == KRB5_CC_END)
255 status = STATUS_SUCCESS;
256 else
257 status = krb5_error_to_status(error);
258 break;
259 }
260
261 if (p_krb5_is_config_principal(context, credentials.server))
262 {
263 p_krb5_free_cred_contents(context, &credentials);
264 continue;
265 }
266
267 if (info->count == info->allocated)
268 {
269 KERB_TICKET_CACHE_INFO *new_info;
270 ULONG new_allocated;
271
272 if (info->allocated)
273 {
274 new_allocated = info->allocated * 2;
275 new_info = heap_realloc(info->info, sizeof(*new_info) * new_allocated);
276 }
277 else
278 {
279 new_allocated = 16;
280 new_info = heap_alloc(sizeof(*new_info) * new_allocated);
281 }
282 if (!new_info)
283 {
284 p_krb5_free_cred_contents(context, &credentials);
285 status = STATUS_NO_MEMORY;
286 break;
287 }
288
289 info->info = new_info;
290 info->allocated = new_allocated;
291 }
292
293 error = p_krb5_unparse_name_flags(context, credentials.server, 0, &name_with_realm);
294 if (error)
295 {
296 p_krb5_free_cred_contents(context, &credentials);
297 status = krb5_error_to_status(error);
298 break;
299 }
300
301 TRACE("name_with_realm: %s\n", debugstr_a(name_with_realm));
302
303 error = p_krb5_unparse_name_flags(context, credentials.server,
304 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name_without_realm);
305 if (error)
306 {
307 p_krb5_free_unparsed_name(context, name_with_realm);
308 p_krb5_free_cred_contents(context, &credentials);
309 status = krb5_error_to_status(error);
310 break;
311 }
312
313 TRACE("name_without_realm: %s\n", debugstr_a(name_without_realm));
314
315 name_without_realmW = utf8_to_wstr(name_without_realm);
316 RtlInitUnicodeString(&info->info[info->count].ServerName, name_without_realmW);
317
318 realm_name = strchr(name_with_realm, '@');
319 if (!realm_name)
320 {
321 ERR("wrong name with realm %s\n", debugstr_a(name_with_realm));
322 realm_name = name_with_realm;
323 }
324 else
325 realm_name++;
326
327 /* realm_name - now contains only realm! */
328
329 realm_nameW = utf8_to_wstr(realm_name);
330 RtlInitUnicodeString(&info->info[info->count].RealmName, realm_nameW);
331
332 if (!credentials.times.starttime)
333 credentials.times.starttime = credentials.times.authtime;
334
335 /* TODO: if krb5_is_config_principal = true */
336 RtlSecondsSince1970ToTime(credentials.times.starttime, &info->info[info->count].StartTime);
337 RtlSecondsSince1970ToTime(credentials.times.endtime, &info->info[info->count].EndTime);
338 RtlSecondsSince1970ToTime(credentials.times.renew_till, &info->info[info->count].RenewTime);
339
340 info->info[info->count].TicketFlags = credentials.ticket_flags;
341
342 error = p_krb5_decode_ticket(&credentials.ticket, &ticket);
343
344 p_krb5_free_unparsed_name(context, name_with_realm);
345 p_krb5_free_unparsed_name(context, name_without_realm);
346 p_krb5_free_cred_contents(context, &credentials);
347
348 if (error)
349 {
350 status = krb5_error_to_status(error);
351 break;
352 }
353
354 info->info[info->count].EncryptionType = ticket->enc_part.enctype;
355
356 p_krb5_free_ticket(context, ticket);
357
358 info->count++;
359 }
360
361 p_krb5_cc_end_seq_get(context, cache, &cursor);
362
363 return status;
364 }
365
366 static inline void init_client_us(UNICODE_STRING *dst, void *client_ws, const UNICODE_STRING *src)
367 {
368 dst->Buffer = client_ws;
369 dst->Length = src->Length;
370 dst->MaximumLength = src->MaximumLength;
371 }
372
373 static NTSTATUS copy_to_client(PLSA_CLIENT_REQUEST lsa_req, struct ticket_info *info, void **out, ULONG *out_size)
374 {
375 NTSTATUS status;
376 ULONG i;
377 SIZE_T size, client_str_off;
378 char *client_resp, *client_ticket, *client_str;
379 KERB_QUERY_TKT_CACHE_RESPONSE resp;
380
381 size = sizeof(KERB_QUERY_TKT_CACHE_RESPONSE);
382 if (info->count != 0)
383 size += (info->count - 1) * sizeof(KERB_TICKET_CACHE_INFO);
384
385 client_str_off = size;
386
387 for (i = 0; i < info->count; i++)
388 {
389 size += info->info[i].RealmName.MaximumLength;
390 size += info->info[i].ServerName.MaximumLength;
391 }
392
393 status = lsa_dispatch.AllocateClientBuffer(lsa_req, size, (void **)&client_resp);
394 if (status != STATUS_SUCCESS) return status;
395
396 resp.MessageType = KerbQueryTicketCacheMessage;
397 resp.CountOfTickets = info->count;
398 size = FIELD_OFFSET(KERB_QUERY_TKT_CACHE_RESPONSE, Tickets);
399 status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_resp, &resp);
400 if (status != STATUS_SUCCESS) goto fail;
401
402 if (!info->count)
403 {
404 *out = client_resp;
405 *out_size = sizeof(resp);
406 return STATUS_SUCCESS;
407 }
408
409 *out_size = size;
410
411 client_ticket = client_resp + size;
412 client_str = client_resp + client_str_off;
413
414 for (i = 0; i < info->count; i++)
415 {
416 KERB_TICKET_CACHE_INFO ticket;
417
418 ticket = info->info[i];
419
420 init_client_us(&ticket.RealmName, client_str, &info->info[i].RealmName);
421
422 size = info->info[i].RealmName.MaximumLength;
423 status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, info->info[i].RealmName.Buffer);
424 if (status != STATUS_SUCCESS) goto fail;
425 client_str += size;
426 *out_size += size;
427
428 init_client_us(&ticket.ServerName, client_str, &info->info[i].ServerName);
429
430 size = info->info[i].ServerName.MaximumLength;
431 status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, info->info[i].ServerName.Buffer);
432 if (status != STATUS_SUCCESS) goto fail;
433 client_str += size;
434 *out_size += size;
435
436 status = lsa_dispatch.CopyToClientBuffer(lsa_req, sizeof(ticket), client_ticket, &ticket);
437 if (status != STATUS_SUCCESS) goto fail;
438
439 client_ticket += sizeof(ticket);
440 *out_size += sizeof(ticket);
441 }
442
443 *out = client_resp;
444 return STATUS_SUCCESS;
445
446 fail:
447 lsa_dispatch.FreeClientBuffer(lsa_req, client_resp);
448 return status;
449 }
450
451 static NTSTATUS query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req, void *in, ULONG in_len, void **out, ULONG *out_len)
452 {
453 NTSTATUS status;
454 KERB_QUERY_TKT_CACHE_REQUEST *query;
455 struct ticket_info info;
456 krb5_error_code error;
457 krb5_context context = NULL;
458 krb5_cccol_cursor cursor = NULL;
459 krb5_ccache cache;
460
461 if (!in || in_len != sizeof(KERB_QUERY_TKT_CACHE_REQUEST) || !out || !out_len)
462 return STATUS_INVALID_PARAMETER;
463
464 query = (KERB_QUERY_TKT_CACHE_REQUEST *)in;
465
466 if (query->LogonId.HighPart != 0 || query->LogonId.LowPart != 0)
467 return STATUS_ACCESS_DENIED;
468
469 info.count = 0;
470 info.allocated = 0;
471 info.info = NULL;
472
473 error = p_krb5_init_context(&context);
474 if (error)
475 {
476 status = krb5_error_to_status(error);
477 goto done;
478 }
479
480 error = p_krb5_cccol_cursor_new(context, &cursor);
481 if (error)
482 {
483 status = krb5_error_to_status(error);
484 goto done;
485 }
486
487 for (;;)
488 {
489 error = p_krb5_cccol_cursor_next(context, cursor, &cache);
490 if (error)
491 {
492 status = krb5_error_to_status(error);
493 goto done;
494 }
495 if (!cache) break;
496
497 status = copy_tickets_from_cache(context, cache, &info);
498
499 p_krb5_cc_close(context, cache);
500
501 if (status != STATUS_SUCCESS)
502 goto done;
503 }
504
505 status = copy_to_client(lsa_req, &info, out, out_len);
506
507 done:
508 if (cursor)
509 p_krb5_cccol_cursor_free(context, &cursor);
510
511 if (context)
512 p_krb5_free_context(context);
513
514 free_ticket_info(&info);
515
516 return status;
517 }
518
519 #else /* SONAME_LIBKRB5 */
520
521 static NTSTATUS query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req, void *in, ULONG in_len, void **out, ULONG *out_len)
522 {
523 FIXME("%p,%p,%u,%p,%p: stub\n", lsa_req, in, in_len, out, out_len);
524 return STATUS_NOT_IMPLEMENTED;
525 }
526
527 #endif /* SONAME_LIBKRB5 */
528
529 static NTSTATUS NTAPI kerberos_LsaApCallPackageUntrusted(PLSA_CLIENT_REQUEST request,
530 PVOID in_buffer, PVOID client_buffer_base, ULONG in_buffer_length,
531 PVOID *out_buffer, PULONG out_buffer_length, PNTSTATUS status)
532 {
533 KERB_PROTOCOL_MESSAGE_TYPE msg;
534
535 TRACE("%p,%p,%p,%u,%p,%p,%p\n", request, in_buffer, client_buffer_base,
536 in_buffer_length, out_buffer, out_buffer_length, status);
537
538 if (!in_buffer || in_buffer_length < sizeof(msg))
539 return STATUS_INVALID_PARAMETER;
540
541 msg = *(KERB_PROTOCOL_MESSAGE_TYPE *)in_buffer;
542
543 switch (msg)
544 {
545 case KerbQueryTicketCacheMessage:
546 *status = query_ticket_cache(request, in_buffer, in_buffer_length, out_buffer, out_buffer_length);
547 break;
548
549 case KerbRetrieveTicketMessage:
550 FIXME("KerbRetrieveTicketMessage stub\n");
551 *status = STATUS_NOT_IMPLEMENTED;
552 break;
553
554 case KerbPurgeTicketCacheMessage:
555 FIXME("KerbPurgeTicketCacheMessage stub\n");
556 *status = STATUS_NOT_IMPLEMENTED;
557 break;
558
559 default: /* All other requests should call LsaApCallPackage */
560 WARN("%u => access denied\n", msg);
561 *status = STATUS_ACCESS_DENIED;
562 break;
563 }
564
565 return *status;
566 }
567
568 static NTSTATUS NTAPI kerberos_SpGetInfo(SecPkgInfoW *info)
569 {
570 TRACE("%p\n", info);
571
572 /* LSA will make a copy before forwarding the structure, so
573 * it's safe to put pointers to dynamic or constant data there.
574 */
575 *info = infoW;
576
577 return STATUS_SUCCESS;
578 }
579
580 #ifdef SONAME_LIBGSSAPI_KRB5
581
582 WINE_DECLARE_DEBUG_CHANNEL(winediag);
583 static void *libgssapi_krb5_handle;
584
585 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
586 MAKE_FUNCPTR(gss_accept_sec_context);
587 MAKE_FUNCPTR(gss_acquire_cred);
588 MAKE_FUNCPTR(gss_delete_sec_context);
589 MAKE_FUNCPTR(gss_display_status);
590 MAKE_FUNCPTR(gss_get_mic);
591 MAKE_FUNCPTR(gss_import_name);
592 MAKE_FUNCPTR(gss_init_sec_context);
593 MAKE_FUNCPTR(gss_inquire_context);
594 MAKE_FUNCPTR(gss_release_buffer);
595 MAKE_FUNCPTR(gss_release_cred);
596 MAKE_FUNCPTR(gss_release_iov_buffer);
597 MAKE_FUNCPTR(gss_release_name);
598 MAKE_FUNCPTR(gss_unwrap);
599 MAKE_FUNCPTR(gss_unwrap_iov);
600 MAKE_FUNCPTR(gss_verify_mic);
601 MAKE_FUNCPTR(gss_wrap);
602 MAKE_FUNCPTR(gss_wrap_iov);
603 #undef MAKE_FUNCPTR
604
605 static BOOL load_gssapi_krb5(void)
606 {
607 if (!(libgssapi_krb5_handle = wine_dlopen( SONAME_LIBGSSAPI_KRB5, RTLD_NOW, NULL, 0 )))
608 {
609 ERR_(winediag)( "Failed to load libgssapi_krb5, Kerberos SSP support will not be available.\n" );
610 return FALSE;
611 }
612
613 #define LOAD_FUNCPTR(f) \
614 if (!(p##f = wine_dlsym( libgssapi_krb5_handle, #f, NULL, 0 ))) \
615 { \
616 ERR( "Failed to load %s\n", #f ); \
617 goto fail; \
618 }
619
620 LOAD_FUNCPTR(gss_accept_sec_context)
621 LOAD_FUNCPTR(gss_acquire_cred)
622 LOAD_FUNCPTR(gss_delete_sec_context)
623 LOAD_FUNCPTR(gss_display_status)
624 LOAD_FUNCPTR(gss_get_mic)
625 LOAD_FUNCPTR(gss_import_name)
626 LOAD_FUNCPTR(gss_init_sec_context)
627 LOAD_FUNCPTR(gss_inquire_context)
628 LOAD_FUNCPTR(gss_release_buffer)
629 LOAD_FUNCPTR(gss_release_cred)
630 LOAD_FUNCPTR(gss_release_iov_buffer)
631 LOAD_FUNCPTR(gss_release_name)
632 LOAD_FUNCPTR(gss_unwrap)
633 LOAD_FUNCPTR(gss_unwrap_iov)
634 LOAD_FUNCPTR(gss_verify_mic)
635 LOAD_FUNCPTR(gss_wrap)
636 LOAD_FUNCPTR(gss_wrap_iov)
637 #undef LOAD_FUNCPTR
638
639 return TRUE;
640
641 fail:
642 wine_dlclose( libgssapi_krb5_handle, NULL, 0 );
643 libgssapi_krb5_handle = NULL;
644 return FALSE;
645 }
646
647 static void unload_gssapi_krb5(void)
648 {
649 wine_dlclose( libgssapi_krb5_handle, NULL, 0 );
650 libgssapi_krb5_handle = NULL;
651 }
652
653 static inline gss_cred_id_t credhandle_sspi_to_gss( LSA_SEC_HANDLE cred )
654 {
655 if (!cred) return GSS_C_NO_CREDENTIAL;
656 return (gss_cred_id_t)cred;
657 }
658
659 static inline void credhandle_gss_to_sspi( gss_cred_id_t handle, LSA_SEC_HANDLE *cred )
660 {
661 *cred = (LSA_SEC_HANDLE)handle;
662 }
663
664 static inline gss_ctx_id_t ctxthandle_sspi_to_gss( LSA_SEC_HANDLE ctxt )
665 {
666 if (!ctxt) return GSS_C_NO_CONTEXT;
667 return (gss_ctx_id_t)ctxt;
668 }
669
670 static inline void ctxthandle_gss_to_sspi( gss_ctx_id_t handle, LSA_SEC_HANDLE *ctxt )
671 {
672 *ctxt = (LSA_SEC_HANDLE)handle;
673 }
674
675 static SECURITY_STATUS status_gss_to_sspi( OM_uint32 status )
676 {
677 switch (status)
678 {
679 case GSS_S_COMPLETE: return SEC_E_OK;
680 case GSS_S_BAD_MECH: return SEC_E_SECPKG_NOT_FOUND;
681 case GSS_S_BAD_SIG: return SEC_E_MESSAGE_ALTERED;
682 case GSS_S_NO_CRED: return SEC_E_NO_CREDENTIALS;
683 case GSS_S_NO_CONTEXT: return SEC_E_INVALID_HANDLE;
684 case GSS_S_DEFECTIVE_TOKEN: return SEC_E_INVALID_TOKEN;
685 case GSS_S_DEFECTIVE_CREDENTIAL: return SEC_E_NO_CREDENTIALS;
686 case GSS_S_CREDENTIALS_EXPIRED: return SEC_E_CONTEXT_EXPIRED;
687 case GSS_S_CONTEXT_EXPIRED: return SEC_E_CONTEXT_EXPIRED;
688 case GSS_S_BAD_QOP: return SEC_E_QOP_NOT_SUPPORTED;
689 case GSS_S_CONTINUE_NEEDED: return SEC_I_CONTINUE_NEEDED;
690 case GSS_S_DUPLICATE_TOKEN: return SEC_E_INVALID_TOKEN;
691 case GSS_S_OLD_TOKEN: return SEC_E_INVALID_TOKEN;
692 case GSS_S_UNSEQ_TOKEN: return SEC_E_OUT_OF_SEQUENCE;
693 case GSS_S_GAP_TOKEN: return SEC_E_OUT_OF_SEQUENCE;
694
695 default:
696 FIXME( "couldn't convert status 0x%08x to SECURITY_STATUS\n", status );
697 return SEC_E_INTERNAL_ERROR;
698 }
699 }
700
701 static void trace_gss_status_ex( OM_uint32 code, int type )
702 {
703 OM_uint32 ret, minor_status;
704 gss_buffer_desc buf;
705 OM_uint32 message_context = 0;
706
707 for (;;)
708 {
709 ret = pgss_display_status( &minor_status, code, type, GSS_C_NULL_OID, &message_context, &buf );
710 if (GSS_ERROR(ret))
711 {
712 TRACE( "gss_display_status(0x%08x,%d) returned %08x minor status %08x\n",
713 code, type, ret, minor_status );
714 return;
715 }
716 TRACE( "GSS-API error: 0x%08x: %s\n", code, debugstr_an(buf.value, buf.length) );
717 pgss_release_buffer( &minor_status, &buf );
718
719 if (!message_context) return;
720 }
721 }
722
723 static void trace_gss_status( OM_uint32 major_status, OM_uint32 minor_status )
724 {
725 if (TRACE_ON(kerberos))
726 {
727 trace_gss_status_ex( major_status, GSS_C_GSS_CODE );
728 trace_gss_status_ex( minor_status, GSS_C_MECH_CODE );
729 }
730 }
731
732 static void expirytime_gss_to_sspi( OM_uint32 expirytime, TimeStamp *timestamp )
733 {
734 SYSTEMTIME time;
735 FILETIME filetime;
736 ULARGE_INTEGER tmp;
737
738 GetLocalTime( &time );
739 SystemTimeToFileTime( &time, &filetime );
740 tmp.QuadPart = ((ULONGLONG)filetime.dwLowDateTime | (ULONGLONG)filetime.dwHighDateTime << 32) + expirytime;
741 timestamp->LowPart = tmp.QuadPart;
742 timestamp->HighPart = tmp.QuadPart >> 32;
743 }
744
745 static SECURITY_STATUS name_sspi_to_gss( const UNICODE_STRING *name_str, gss_name_t *name )
746 {
747 OM_uint32 ret, minor_status;
748 gss_OID type = GSS_C_NO_OID; /* FIXME: detect the appropriate value for this ourselves? */
749 gss_buffer_desc buf;
750
751 buf.length = WideCharToMultiByte( CP_UNIXCP, 0, name_str->Buffer, name_str->Length / sizeof(WCHAR), NULL, 0, NULL, NULL );
752 if (!(buf.value = heap_alloc( buf.length ))) return SEC_E_INSUFFICIENT_MEMORY;
753 WideCharToMultiByte( CP_UNIXCP, 0, name_str->Buffer, name_str->Length / sizeof(WCHAR), buf.value, buf.length, NULL, NULL );
754
755 ret = pgss_import_name( &minor_status, &buf, type, name );
756 TRACE( "gss_import_name returned %08x minor status %08x\n", ret, minor_status );
757 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
758
759 heap_free( buf.value );
760 return status_gss_to_sspi( ret );
761 }
762
763 static ULONG flags_isc_req_to_gss( ULONG flags )
764 {
765 ULONG ret = 0;
766 if (flags & ISC_REQ_DELEGATE) ret |= GSS_C_DELEG_FLAG;
767 if (flags & ISC_REQ_MUTUAL_AUTH) ret |= GSS_C_MUTUAL_FLAG;
768 if (flags & ISC_REQ_REPLAY_DETECT) ret |= GSS_C_REPLAY_FLAG;
769 if (flags & ISC_REQ_SEQUENCE_DETECT) ret |= GSS_C_SEQUENCE_FLAG;
770 if (flags & ISC_REQ_CONFIDENTIALITY) ret |= GSS_C_CONF_FLAG;
771 if (flags & ISC_REQ_INTEGRITY) ret |= GSS_C_INTEG_FLAG;
772 if (flags & ISC_REQ_NULL_SESSION) ret |= GSS_C_ANON_FLAG;
773 if (flags & ISC_REQ_USE_DCE_STYLE) ret |= GSS_C_DCE_STYLE;
774 return ret;
775 }
776
777 static ULONG flags_gss_to_isc_ret( ULONG flags )
778 {
779 ULONG ret = 0;
780 if (flags & GSS_C_DELEG_FLAG) ret |= ISC_RET_DELEGATE;
781 if (flags & GSS_C_MUTUAL_FLAG) ret |= ISC_RET_MUTUAL_AUTH;
782 if (flags & GSS_C_REPLAY_FLAG) ret |= ISC_RET_REPLAY_DETECT;
783 if (flags & GSS_C_SEQUENCE_FLAG) ret |= ISC_RET_SEQUENCE_DETECT;
784 if (flags & GSS_C_CONF_FLAG) ret |= ISC_RET_CONFIDENTIALITY;
785 if (flags & GSS_C_INTEG_FLAG) ret |= ISC_RET_INTEGRITY;
786 if (flags & GSS_C_ANON_FLAG) ret |= ISC_RET_NULL_SESSION;
787 return ret;
788 }
789
790 static ULONG flags_gss_to_asc_ret( ULONG flags )
791 {
792 ULONG ret = 0;
793 if (flags & GSS_C_DELEG_FLAG) ret |= ASC_RET_DELEGATE;
794 if (flags & GSS_C_MUTUAL_FLAG) ret |= ASC_RET_MUTUAL_AUTH;
795 if (flags & GSS_C_REPLAY_FLAG) ret |= ASC_RET_REPLAY_DETECT;
796 if (flags & GSS_C_SEQUENCE_FLAG) ret |= ASC_RET_SEQUENCE_DETECT;
797 if (flags & GSS_C_CONF_FLAG) ret |= ASC_RET_CONFIDENTIALITY;
798 if (flags & GSS_C_INTEG_FLAG) ret |= ASC_RET_INTEGRITY;
799 if (flags & GSS_C_ANON_FLAG) ret |= ASC_RET_NULL_SESSION;
800 return ret;
801 }
802
803 static BOOL is_dce_style_context( gss_ctx_id_t ctxt_handle )
804 {
805 OM_uint32 ret, minor_status, flags;
806 ret = pgss_inquire_context( &minor_status, ctxt_handle, NULL, NULL, NULL, NULL, &flags, NULL, NULL );
807 return (ret == GSS_S_COMPLETE && (flags & GSS_C_DCE_STYLE));
808 }
809
810 static int get_buffer_index( SecBufferDesc *desc, DWORD type )
811 {
812 UINT i;
813 if (!desc) return -1;
814 for (i = 0; i < desc->cBuffers; i++)
815 {
816 if (desc->pBuffers[i].BufferType == type) return i;
817 }
818 return -1;
819 }
820 #endif /* SONAME_LIBGSSAPI_KRB5 */
821
822 static NTSTATUS NTAPI kerberos_SpAcquireCredentialsHandle(
823 UNICODE_STRING *principal_us, ULONG credential_use, LUID *logon_id, void *auth_data,
824 void *get_key_fn, void *get_key_arg, LSA_SEC_HANDLE *credential, TimeStamp *ts_expiry )
825 {
826 #ifdef SONAME_LIBGSSAPI_KRB5
827 OM_uint32 ret, minor_status, expiry_time;
828 gss_name_t principal = GSS_C_NO_NAME;
829 gss_cred_usage_t cred_usage;
830 gss_cred_id_t cred_handle;
831
832 TRACE( "(%s 0x%08x %p %p %p %p %p %p)\n", debugstr_us(principal_us), credential_use,
833 logon_id, auth_data, get_key_fn, get_key_arg, credential, ts_expiry );
834
835 if (auth_data)
836 {
837 FIXME( "specific credentials not supported\n" );
838 return SEC_E_UNKNOWN_CREDENTIALS;
839 }
840
841 switch (credential_use)
842 {
843 case SECPKG_CRED_INBOUND:
844 cred_usage = GSS_C_ACCEPT;
845 break;
846 case SECPKG_CRED_OUTBOUND:
847 cred_usage = GSS_C_INITIATE;
848 break;
849 case SECPKG_CRED_BOTH:
850 cred_usage = GSS_C_BOTH;
851 break;
852 default:
853 return SEC_E_UNKNOWN_CREDENTIALS;
854 }
855
856 if (principal_us && ((ret = name_sspi_to_gss( principal_us, &principal )) != SEC_E_OK)) return ret;
857
858 ret = pgss_acquire_cred( &minor_status, principal, GSS_C_INDEFINITE, GSS_C_NULL_OID_SET, cred_usage,
859 &cred_handle, NULL, &expiry_time );
860 TRACE( "gss_acquire_cred returned %08x minor status %08x\n", ret, minor_status );
861 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
862 if (ret == GSS_S_COMPLETE)
863 {
864 credhandle_gss_to_sspi( cred_handle, credential );
865 expirytime_gss_to_sspi( expiry_time, ts_expiry );
866 }
867
868 if (principal != GSS_C_NO_NAME) pgss_release_name( &minor_status, &principal );
869
870 return status_gss_to_sspi( ret );
871 #else
872 FIXME( "(%s 0x%08x %p %p %p %p %p %p)\n", debugstr_us(principal_us), credential_use,
873 logon_id, auth_data, get_key_fn, get_key_arg, credential, ts_expiry );
874 FIXME( "Wine was built without Kerberos support.\n" );
875 return SEC_E_UNSUPPORTED_FUNCTION;
876 #endif
877 }
878
879 static NTSTATUS NTAPI kerberos_SpFreeCredentialsHandle( LSA_SEC_HANDLE credential )
880 {
881 #ifdef SONAME_LIBGSSAPI_KRB5
882 OM_uint32 ret, minor_status;
883 gss_cred_id_t cred_handle;
884
885 TRACE( "(%lx)\n", credential );
886
887 if (!credential) return SEC_E_INVALID_HANDLE;
888 if (!(cred_handle = credhandle_sspi_to_gss( credential ))) return SEC_E_OK;
889
890 ret = pgss_release_cred( &minor_status, &cred_handle );
891 TRACE( "gss_release_cred returned %08x minor status %08x\n", ret, minor_status );
892 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
893
894 return status_gss_to_sspi( ret );
895 #else
896 FIXME( "(%lx)\n", credential );
897 return SEC_E_UNSUPPORTED_FUNCTION;
898 #endif
899 }
900
901 static NTSTATUS NTAPI kerberos_SpInitLsaModeContext( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context,
902 UNICODE_STRING *target_name, ULONG context_req, ULONG target_data_rep, SecBufferDesc *input,
903 LSA_SEC_HANDLE *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry,
904 BOOLEAN *mapped_context, SecBuffer *context_data )
905 {
906 #ifdef SONAME_LIBGSSAPI_KRB5
907 static const ULONG supported = ISC_REQ_CONFIDENTIALITY | ISC_REQ_INTEGRITY | ISC_REQ_SEQUENCE_DETECT |
908 ISC_REQ_REPLAY_DETECT | ISC_REQ_MUTUAL_AUTH;
909 OM_uint32 ret, minor_status, ret_flags, expiry_time, req_flags = flags_isc_req_to_gss( context_req );
910 gss_cred_id_t cred_handle;
911 gss_ctx_id_t ctxt_handle;
912 gss_buffer_desc input_token, output_token;
913 gss_name_t target = GSS_C_NO_NAME;
914 int idx;
915
916 TRACE( "(%lx %lx %s 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, debugstr_us(target_name),
917 context_req, target_data_rep, input, new_context, output, context_attr, ts_expiry,
918 mapped_context, context_data );
919 if (context_req & ~supported)
920 FIXME( "flags 0x%08x not supported\n", context_req & ~supported );
921
922 if (!context && !input && !credential) return SEC_E_INVALID_HANDLE;
923 cred_handle = credhandle_sspi_to_gss( credential );
924 ctxt_handle = ctxthandle_sspi_to_gss( context );
925
926 if (!input) input_token.length = 0;
927 else
928 {
929 if ((idx = get_buffer_index( input, SECBUFFER_TOKEN )) == -1)
930 input_token.length = 0;
931 else
932 {
933 input_token.length = input->pBuffers[idx].cbBuffer;
934 input_token.value = input->pBuffers[idx].pvBuffer;
935 }
936 }
937
938 if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
939 output_token.length = 0;
940 output_token.value = NULL;
941
942 if (target_name && ((ret = name_sspi_to_gss( target_name, &target )) != SEC_E_OK)) return ret;
943
944 ret = pgss_init_sec_context( &minor_status, cred_handle, &ctxt_handle, target, GSS_C_NO_OID, req_flags, 0,
945 GSS_C_NO_CHANNEL_BINDINGS, &input_token, NULL, &output_token, &ret_flags,
946 &expiry_time );
947 TRACE( "gss_init_sec_context returned %08x minor status %08x ret_flags %08x\n", ret, minor_status, ret_flags );
948 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
949 if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED)
950 {
951 if (output_token.length > output->pBuffers[idx].cbBuffer) /* FIXME: check if larger buffer exists */
952 {
953 TRACE( "buffer too small %lu > %u\n", (SIZE_T)output_token.length, output->pBuffers[idx].cbBuffer );
954 pgss_release_buffer( &minor_status, &output_token );
955 pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER );
956 return SEC_E_INCOMPLETE_MESSAGE;
957 }
958 output->pBuffers[idx].cbBuffer = output_token.length;
959 memcpy( output->pBuffers[idx].pvBuffer, output_token.value, output_token.length );
960 pgss_release_buffer( &minor_status, &output_token );
961
962 ctxthandle_gss_to_sspi( ctxt_handle, new_context );
963 if (context_attr) *context_attr = flags_gss_to_isc_ret( ret_flags );
964 expirytime_gss_to_sspi( expiry_time, ts_expiry );
965 }
966
967 if (target != GSS_C_NO_NAME) pgss_release_name( &minor_status, &target );
968
969 /* we do support user mode SSP/AP functions */
970 *mapped_context = TRUE;
971 /* FIXME: initialize context_data */
972
973 return status_gss_to_sspi( ret );
974 #else
975 FIXME( "(%lx %lx %s 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, debugstr_us(target_name),
976 context_req, target_data_rep, input, new_context, output, context_attr, ts_expiry,
977 mapped_context, context_data );
978 return SEC_E_UNSUPPORTED_FUNCTION;
979 #endif
980 }
981
982 static NTSTATUS NTAPI kerberos_SpAcceptLsaModeContext( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context,
983 SecBufferDesc *input, ULONG context_req, ULONG target_data_rep, LSA_SEC_HANDLE *new_context,
984 SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry, BOOLEAN *mapped_context, SecBuffer *context_data )
985 {
986 #ifdef SONAME_LIBGSSAPI_KRB5
987 OM_uint32 ret, minor_status, ret_flags, expiry_time;
988 gss_cred_id_t cred_handle;
989 gss_ctx_id_t ctxt_handle;
990 gss_buffer_desc input_token, output_token;
991 gss_name_t target = GSS_C_NO_NAME;
992 int idx;
993
994 TRACE( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, context_req,
995 target_data_rep, input, new_context, output, context_attr, ts_expiry,
996 mapped_context, context_data );
997 if (context_req) FIXME( "ignoring flags 0x%08x\n", context_req );
998
999 if (!context && !input && !credential) return SEC_E_INVALID_HANDLE;
1000 cred_handle = credhandle_sspi_to_gss( credential );
1001 ctxt_handle = ctxthandle_sspi_to_gss( context );
1002
1003 if (!input) input_token.length = 0;
1004 else
1005 {
1006 if ((idx = get_buffer_index( input, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1007 input_token.length = input->pBuffers[idx].cbBuffer;
1008 input_token.value = input->pBuffers[idx].pvBuffer;
1009 }
1010
1011 if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1012 output_token.length = 0;
1013 output_token.value = NULL;
1014
1015 ret = pgss_accept_sec_context( &minor_status, &ctxt_handle, cred_handle, &input_token, GSS_C_NO_CHANNEL_BINDINGS,
1016 &target, NULL, &output_token, &ret_flags, &expiry_time, NULL );
1017 TRACE( "gss_accept_sec_context returned %08x minor status %08x ctxt_handle %p\n", ret, minor_status, ctxt_handle );
1018 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1019 if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED)
1020 {
1021 if (output_token.length > output->pBuffers[idx].cbBuffer) /* FIXME: check if larger buffer exists */
1022 {
1023 TRACE( "buffer too small %lu > %u\n", (SIZE_T)output_token.length, output->pBuffers[idx].cbBuffer );
1024 pgss_release_buffer( &minor_status, &output_token );
1025 pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER );
1026 return SEC_E_BUFFER_TOO_SMALL;
1027 }
1028 output->pBuffers[idx].cbBuffer = output_token.length;
1029 memcpy( output->pBuffers[idx].pvBuffer, output_token.value, output_token.length );
1030 pgss_release_buffer( &minor_status, &output_token );
1031
1032 ctxthandle_gss_to_sspi( ctxt_handle, new_context );
1033 if (context_attr) *context_attr = flags_gss_to_asc_ret( ret_flags );
1034 expirytime_gss_to_sspi( expiry_time, ts_expiry );
1035 }
1036
1037 /* we do support user mode SSP/AP functions */
1038 *mapped_context = TRUE;
1039 /* FIXME: initialize context_data */
1040
1041 return status_gss_to_sspi( ret );
1042 #else
1043 FIXME( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, context_req,
1044 target_data_rep, input, new_context, output, context_attr, ts_expiry,
1045 mapped_context, context_data );
1046 return SEC_E_UNSUPPORTED_FUNCTION;
1047 #endif
1048 }
1049
1050 static NTSTATUS NTAPI kerberos_SpDeleteContext( LSA_SEC_HANDLE context )
1051 {
1052 #ifdef SONAME_LIBGSSAPI_KRB5
1053 OM_uint32 ret, minor_status;
1054 gss_ctx_id_t ctxt_handle;
1055
1056 TRACE( "(%lx)\n", context );
1057 if (!context) return SEC_E_INVALID_HANDLE;
1058 if (!(ctxt_handle = ctxthandle_sspi_to_gss( context ))) return SEC_E_OK;
1059
1060 ret = pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER );
1061 TRACE( "gss_delete_sec_context returned %08x minor status %08x\n", ret, minor_status );
1062 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1063
1064 return status_gss_to_sspi( ret );
1065 #else
1066 FIXME( "(%lx)\n", context );
1067 return SEC_E_UNSUPPORTED_FUNCTION;
1068 #endif
1069 }
1070
1071 static NTSTATUS NTAPI kerberos_SpQueryContextAttributes( LSA_SEC_HANDLE context, ULONG attribute, void *buffer )
1072 {
1073 TRACE( "(%lx %u %p)\n", context, attribute, buffer );
1074
1075 if (!context) return SEC_E_INVALID_HANDLE;
1076
1077 switch (attribute)
1078 {
1079 #define X(x) case (x) : FIXME(#x" stub\n"); break
1080 X(SECPKG_ATTR_ACCESS_TOKEN);
1081 X(SECPKG_ATTR_AUTHORITY);
1082 X(SECPKG_ATTR_DCE_INFO);
1083 X(SECPKG_ATTR_KEY_INFO);
1084 X(SECPKG_ATTR_LIFESPAN);
1085 X(SECPKG_ATTR_NAMES);
1086 X(SECPKG_ATTR_NATIVE_NAMES);
1087 X(SECPKG_ATTR_PACKAGE_INFO);
1088 X(SECPKG_ATTR_PASSWORD_EXPIRY);
1089 X(SECPKG_ATTR_SESSION_KEY);
1090 X(SECPKG_ATTR_STREAM_SIZES);
1091 X(SECPKG_ATTR_TARGET_INFORMATION);
1092 case SECPKG_ATTR_SIZES:
1093 {
1094 SecPkgContext_Sizes *sizes = (SecPkgContext_Sizes *)buffer;
1095 ULONG size_max_signature = 37, size_security_trailer = 49;
1096 #ifdef SONAME_LIBGSSAPI_KRB5
1097 gss_ctx_id_t ctxt_handle;
1098
1099 if (!(ctxt_handle = ctxthandle_sspi_to_gss( context ))) return SEC_E_INVALID_HANDLE;
1100 if (is_dce_style_context( ctxt_handle ))
1101 {
1102 size_max_signature = 28;
1103 size_security_trailer = 76;
1104 }
1105 #endif
1106 sizes->cbMaxToken = KERBEROS_MAX_BUF;
1107 sizes->cbMaxSignature = size_max_signature;
1108 sizes->cbBlockSize = 1;
1109 sizes->cbSecurityTrailer = size_security_trailer;
1110 return SEC_E_OK;
1111 }
1112 case SECPKG_ATTR_NEGOTIATION_INFO:
1113 {
1114 SecPkgContext_NegotiationInfoW *info = (SecPkgContext_NegotiationInfoW *)buffer;
1115 info->PackageInfo = (SecPkgInfoW *)&infoW;
1116 info->NegotiationState = SECPKG_NEGOTIATION_COMPLETE;
1117 return SEC_E_OK;
1118 }
1119 #undef X
1120 default:
1121 FIXME( "unknown attribute %u\n", attribute );
1122 break;
1123 }
1124
1125 return SEC_E_UNSUPPORTED_FUNCTION;
1126 }
1127
1128 static NTSTATUS NTAPI kerberos_SpInitialize(ULONG_PTR package_id, SECPKG_PARAMETERS *params,
1129 LSA_SECPKG_FUNCTION_TABLE *lsa_function_table)
1130 {
1131 TRACE("%lu,%p,%p\n", package_id, params, lsa_function_table);
1132
1133 #ifdef SONAME_LIBGSSAPI_KRB5
1134 if (load_gssapi_krb5()) return STATUS_SUCCESS;
1135 #endif
1136
1137 return STATUS_UNSUCCESSFUL;
1138 }
1139
1140 static NTSTATUS NTAPI kerberos_SpShutdown(void)
1141 {
1142 TRACE("\n");
1143
1144 #ifdef SONAME_LIBGSSAPI_KRB5
1145 unload_gssapi_krb5();
1146 #endif
1147
1148 return STATUS_SUCCESS;
1149 }
1150
1151 static SECPKG_FUNCTION_TABLE kerberos_table =
1152 {
1153 kerberos_LsaApInitializePackage, /* InitializePackage */
1154 NULL, /* LsaLogonUser */
1155 NULL, /* CallPackage */
1156 NULL, /* LogonTerminated */
1157 kerberos_LsaApCallPackageUntrusted, /* CallPackageUntrusted */
1158 NULL, /* CallPackagePassthrough */
1159 NULL, /* LogonUserEx */
1160 NULL, /* LogonUserEx2 */
1161 kerberos_SpInitialize,
1162 kerberos_SpShutdown,
1163 kerberos_SpGetInfo,
1164 NULL, /* AcceptCredentials */
1165 kerberos_SpAcquireCredentialsHandle,
1166 NULL, /* SpQueryCredentialsAttributes */
1167 kerberos_SpFreeCredentialsHandle,
1168 NULL, /* SaveCredentials */
1169 NULL, /* GetCredentials */
1170 NULL, /* DeleteCredentials */
1171 kerberos_SpInitLsaModeContext,
1172 kerberos_SpAcceptLsaModeContext,
1173 kerberos_SpDeleteContext,
1174 NULL, /* ApplyControlToken */
1175 NULL, /* GetUserInfo */
1176 NULL, /* GetExtendedInformation */
1177 kerberos_SpQueryContextAttributes,
1178 NULL, /* SpAddCredentials */
1179 NULL, /* SetExtendedInformation */
1180 NULL, /* SetContextAttributes */
1181 NULL, /* SetCredentialsAttributes */
1182 NULL, /* ChangeAccountPassword */
1183 NULL, /* QueryMetaData */
1184 NULL, /* ExchangeMetaData */
1185 NULL, /* GetCredUIContext */
1186 NULL, /* UpdateCredentials */
1187 NULL, /* ValidateTargetInfo */
1188 NULL, /* PostLogonUser */
1189 };
1190
1191 NTSTATUS NTAPI SpLsaModeInitialize(ULONG lsa_version, PULONG package_version,
1192 PSECPKG_FUNCTION_TABLE *table, PULONG table_count)
1193 {
1194 TRACE("%#x,%p,%p,%p\n", lsa_version, package_version, table, table_count);
1195
1196 *package_version = SECPKG_INTERFACE_VERSION;
1197 *table = &kerberos_table;
1198 *table_count = 1;
1199
1200 return STATUS_SUCCESS;
1201 }
1202
1203 static NTSTATUS NTAPI kerberos_SpInstanceInit(ULONG version, SECPKG_DLL_FUNCTIONS *dll_function_table, void **user_functions)
1204 {
1205 FIXME("%u,%p,%p: stub\n", version, dll_function_table, user_functions);
1206
1207 return STATUS_SUCCESS;
1208 }
1209
1210 static NTSTATUS SEC_ENTRY kerberos_SpMakeSignature( LSA_SEC_HANDLE context, ULONG quality_of_protection,
1211 SecBufferDesc *message, ULONG message_seq_no )
1212 {
1213 #ifdef SONAME_LIBGSSAPI_KRB5
1214 OM_uint32 ret, minor_status;
1215 gss_buffer_desc data_buffer, token_buffer;
1216 gss_ctx_id_t ctxt_handle;
1217 int data_idx, token_idx;
1218
1219 TRACE( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no );
1220 if (quality_of_protection) FIXME( "ignoring quality_of_protection 0x%08x\n", quality_of_protection );
1221 if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no );
1222
1223 if (!context) return SEC_E_INVALID_HANDLE;
1224 ctxt_handle = ctxthandle_sspi_to_gss( context );
1225
1226 /* FIXME: multiple data buffers, read-only buffers */
1227 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1228 data_buffer.length = message->pBuffers[data_idx].cbBuffer;
1229 data_buffer.value = message->pBuffers[data_idx].pvBuffer;
1230
1231 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1232 token_buffer.length = 0;
1233 token_buffer.value = NULL;
1234
1235 ret = pgss_get_mic( &minor_status, ctxt_handle, GSS_C_QOP_DEFAULT, &data_buffer, &token_buffer );
1236 TRACE( "gss_get_mic returned %08x minor status %08x\n", ret, minor_status );
1237 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1238 if (ret == GSS_S_COMPLETE)
1239 {
1240 memcpy( message->pBuffers[token_idx].pvBuffer, token_buffer.value, token_buffer.length );
1241 message->pBuffers[token_idx].cbBuffer = token_buffer.length;
1242 pgss_release_buffer( &minor_status, &token_buffer );
1243 }
1244
1245 return status_gss_to_sspi( ret );
1246 #else
1247 FIXME( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no );
1248 return SEC_E_UNSUPPORTED_FUNCTION;
1249 #endif
1250 }
1251
1252 static SECURITY_STATUS SEC_ENTRY kerberos_SpVerifySignature( LSA_SEC_HANDLE context, SecBufferDesc *message,
1253 ULONG message_seq_no, ULONG *quality_of_protection )
1254 {
1255 #ifdef SONAME_LIBGSSAPI_KRB5
1256 OM_uint32 ret, minor_status;
1257 gss_buffer_desc data_buffer, token_buffer;
1258 gss_ctx_id_t ctxt_handle;
1259 int data_idx, token_idx;
1260
1261 TRACE( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection );
1262 if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no );
1263
1264 if (!context) return SEC_E_INVALID_HANDLE;
1265 ctxt_handle = ctxthandle_sspi_to_gss( context );
1266
1267 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1268 data_buffer.length = message->pBuffers[data_idx].cbBuffer;
1269 data_buffer.value = message->pBuffers[data_idx].pvBuffer;
1270
1271 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1272 token_buffer.length = message->pBuffers[token_idx].cbBuffer;
1273 token_buffer.value = message->pBuffers[token_idx].pvBuffer;
1274
1275 ret = pgss_verify_mic( &minor_status, ctxt_handle, &data_buffer, &token_buffer, NULL );
1276 TRACE( "gss_verify_mic returned %08x minor status %08x\n", ret, minor_status );
1277 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1278 if (ret == GSS_S_COMPLETE && quality_of_protection) *quality_of_protection = 0;
1279
1280 return status_gss_to_sspi( ret );
1281 #else
1282 FIXME( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection );
1283 return SEC_E_UNSUPPORTED_FUNCTION;
1284 #endif
1285 }
1286
1287 #ifdef SONAME_LIBGSSAPI_KRB5
1288 static NTSTATUS seal_message_iov( gss_ctx_id_t ctxt_handle, SecBufferDesc *message )
1289 {
1290 gss_iov_buffer_desc iov[4];
1291 OM_uint32 ret, minor_status;
1292 int token_idx, data_idx, conf_state;
1293
1294 /* FIXME: multiple data buffers, read-only buffers */
1295 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1296 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1297
1298 iov[0].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY | GSS_IOV_BUFFER_FLAG_ALLOCATE;
1299 iov[0].buffer.length = 0;
1300 iov[0].buffer.value = NULL;
1301
1302 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
1303 iov[1].buffer.length = message->pBuffers[data_idx].cbBuffer;
1304 iov[1].buffer.value = message->pBuffers[data_idx].pvBuffer;
1305
1306 iov[2].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY | GSS_IOV_BUFFER_FLAG_ALLOCATE;
1307 iov[2].buffer.length = 0;
1308 iov[2].buffer.value = NULL;
1309
1310 iov[3].type = GSS_IOV_BUFFER_TYPE_HEADER | GSS_IOV_BUFFER_FLAG_ALLOCATE;
1311 iov[3].buffer.length = 0;
1312 iov[3].buffer.value = NULL;
1313
1314 ret = pgss_wrap_iov( &minor_status, ctxt_handle, 1, GSS_C_QOP_DEFAULT, &conf_state, iov, 4 );
1315 TRACE( "gss_wrap_iov returned %08x minor status %08x\n", ret, minor_status );
1316 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1317 if (ret == GSS_S_COMPLETE)
1318 {
1319 memcpy( message->pBuffers[token_idx].pvBuffer, iov[3].buffer.value, iov[3].buffer.length );
1320 message->pBuffers[token_idx].cbBuffer = iov[3].buffer.length;
1321 pgss_release_iov_buffer( &minor_status, iov, 4 );
1322 }
1323
1324 return status_gss_to_sspi( ret );
1325 }
1326
1327 static NTSTATUS seal_message( gss_ctx_id_t ctxt_handle, SecBufferDesc *message )
1328 {
1329 gss_buffer_desc input, output;
1330 OM_uint32 ret, minor_status;
1331 int token_idx, data_idx, conf_state;
1332
1333 /* FIXME: multiple data buffers, read-only buffers */
1334 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1335 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1336
1337 input.length = message->pBuffers[data_idx].cbBuffer;
1338 input.value = message->pBuffers[data_idx].pvBuffer;
1339
1340 ret = pgss_wrap( &minor_status, ctxt_handle, 1, GSS_C_QOP_DEFAULT, &input, &conf_state, &output );
1341 TRACE( "gss_wrap returned %08x minor status %08x\n", ret, minor_status );
1342 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1343 if (ret == GSS_S_COMPLETE)
1344 {
1345 DWORD len_data = message->pBuffers[data_idx].cbBuffer, len_token = message->pBuffers[token_idx].cbBuffer;
1346 if (len_token < output.length - len_data)
1347 {
1348 TRACE( "buffer too small %lu > %u\n", (SIZE_T)output.length - len_data, len_token );
1349 pgss_release_buffer( &minor_status, &output );
1350 return SEC_E_BUFFER_TOO_SMALL;
1351 }
1352 memcpy( message->pBuffers[data_idx].pvBuffer, output.value, len_data );
1353 memcpy( message->pBuffers[token_idx].pvBuffer, (char *)output.value + len_data, output.length - len_data );
1354 message->pBuffers[token_idx].cbBuffer = output.length - len_data;
1355 pgss_release_buffer( &minor_status, &output );
1356 }
1357
1358 return status_gss_to_sspi( ret );
1359 }
1360 #endif
1361
1362 static NTSTATUS NTAPI kerberos_SpSealMessage( LSA_SEC_HANDLE context, ULONG quality_of_protection,
1363 SecBufferDesc *message, ULONG message_seq_no )
1364 {
1365 #ifdef SONAME_LIBGSSAPI_KRB5
1366 gss_ctx_id_t ctxt_handle;
1367
1368 TRACE( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no );
1369 if (quality_of_protection)
1370 {
1371 FIXME( "flags %08x not supported\n", quality_of_protection );
1372 return SEC_E_UNSUPPORTED_FUNCTION;
1373 }
1374 if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no );
1375
1376 if (!context) return SEC_E_INVALID_HANDLE;
1377 ctxt_handle = ctxthandle_sspi_to_gss( context );
1378
1379 if (is_dce_style_context( ctxt_handle )) return seal_message_iov( ctxt_handle, message );
1380 return seal_message( ctxt_handle, message );
1381 #else
1382 FIXME( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no );
1383 return SEC_E_UNSUPPORTED_FUNCTION;
1384 #endif
1385 }
1386
1387 #ifdef SONAME_LIBGSSAPI_KRB5
1388 static NTSTATUS unseal_message_iov( gss_ctx_id_t ctxt_handle, SecBufferDesc *message, ULONG *quality_of_protection )
1389 {
1390 gss_iov_buffer_desc iov[4];
1391 OM_uint32 ret, minor_status;
1392 int token_idx, data_idx, conf_state;
1393
1394 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1395 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1396
1397 iov[0].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
1398 iov[0].buffer.length = 0;
1399 iov[0].buffer.value = NULL;
1400
1401 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
1402 iov[1].buffer.length = message->pBuffers[data_idx].cbBuffer;
1403 iov[1].buffer.value = message->pBuffers[data_idx].pvBuffer;
1404
1405 iov[2].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
1406 iov[2].buffer.length = 0;
1407 iov[2].buffer.value = NULL;
1408
1409 iov[3].type = GSS_IOV_BUFFER_TYPE_HEADER;
1410 iov[3].buffer.length = message->pBuffers[token_idx].cbBuffer;
1411 iov[3].buffer.value = message->pBuffers[token_idx].pvBuffer;
1412
1413 ret = pgss_unwrap_iov( &minor_status, ctxt_handle, &conf_state, NULL, iov, 4 );
1414 TRACE( "gss_unwrap_iov returned %08x minor status %08x\n", ret, minor_status );
1415 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1416 if (ret == GSS_S_COMPLETE && quality_of_protection)
1417 {
1418 *quality_of_protection = (conf_state ? 0 : SECQOP_WRAP_NO_ENCRYPT);
1419 }
1420 return status_gss_to_sspi( ret );
1421 }
1422
1423 static NTSTATUS unseal_message( gss_ctx_id_t ctxt_handle, SecBufferDesc *message, ULONG *quality_of_protection )
1424 {
1425 gss_buffer_desc input, output;
1426 OM_uint32 ret, minor_status;
1427 int token_idx, data_idx, conf_state;
1428 DWORD len_data, len_token;
1429
1430 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1431 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1432
1433 len_data = message->pBuffers[data_idx].cbBuffer;
1434 len_token = message->pBuffers[token_idx].cbBuffer;
1435
1436 input.length = len_data + len_token;
1437 if (!(input.value = heap_alloc( input.length ))) return SEC_E_INSUFFICIENT_MEMORY;
1438 memcpy( input.value, message->pBuffers[data_idx].pvBuffer, len_data );
1439 memcpy( (char *)input.value + len_data, message->pBuffers[token_idx].pvBuffer, len_token );
1440
1441 ret = pgss_unwrap( &minor_status, ctxt_handle, &input, &output, &conf_state, NULL );
1442 heap_free( input.value );
1443 TRACE( "gss_unwrap returned %08x minor status %08x\n", ret, minor_status );
1444 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1445 if (ret == GSS_S_COMPLETE)
1446 {
1447 if (quality_of_protection) *quality_of_protection = (conf_state ? 0 : SECQOP_WRAP_NO_ENCRYPT);
1448 memcpy( message->pBuffers[data_idx].pvBuffer, output.value, len_data );
1449 pgss_release_buffer( &minor_status, &output );
1450 }
1451
1452 return status_gss_to_sspi( ret );
1453 }
1454 #endif
1455
1456 static NTSTATUS NTAPI kerberos_SpUnsealMessage( LSA_SEC_HANDLE context, SecBufferDesc *message,
1457 ULONG message_seq_no, ULONG *quality_of_protection )
1458 {
1459 #ifdef SONAME_LIBGSSAPI_KRB5
1460 gss_ctx_id_t ctxt_handle;
1461
1462 TRACE( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection );
1463 if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no );
1464
1465 if (!context) return SEC_E_INVALID_HANDLE;
1466 ctxt_handle = ctxthandle_sspi_to_gss( context );
1467
1468 if (is_dce_style_context( ctxt_handle )) return unseal_message_iov( ctxt_handle, message, quality_of_protection );
1469 return unseal_message( ctxt_handle, message, quality_of_protection );
1470 #else
1471 FIXME( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection );
1472 return SEC_E_UNSUPPORTED_FUNCTION;
1473 #endif
1474 }
1475
1476 static SECPKG_USER_FUNCTION_TABLE kerberos_user_table =
1477 {
1478 kerberos_SpInstanceInit,
1479 NULL, /* SpInitUserModeContext */
1480 kerberos_SpMakeSignature,
1481 kerberos_SpVerifySignature,
1482 kerberos_SpSealMessage,
1483 kerberos_SpUnsealMessage,
1484 NULL, /* SpGetContextToken */
1485 NULL, /* SpQueryContextAttributes */
1486 NULL, /* SpCompleteAuthToken */
1487 NULL, /* SpDeleteContext */
1488 NULL, /* SpFormatCredentialsFn */
1489 NULL, /* SpMarshallSupplementalCreds */
1490 NULL, /* SpExportSecurityContext */
1491 NULL /* SpImportSecurityContext */
1492 };
1493
1494 NTSTATUS NTAPI SpUserModeInitialize(ULONG lsa_version, PULONG package_version,
1495 PSECPKG_USER_FUNCTION_TABLE *table, PULONG table_count)
1496 {
1497 TRACE("%#x,%p,%p,%p\n", lsa_version, package_version, table, table_count);
1498
1499 *package_version = SECPKG_INTERFACE_VERSION;
1500 *table = &kerberos_user_table;
1501 *table_count = 1;
1502
1503 return STATUS_SUCCESS;
1504 }
Windows API implementation