?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
kerberos: Translate GSS_C_DCE_STYLE to appropriate ISC_RET and ASC_RET flags.
[wine.git] / dlls / kerberos / krb5_ap.c
blob60042e6f83d1eac9f3669ba60251828ea04834b4
1 /*
2 * Copyright 2017 Dmitry Timoshkov
3 * Copyright 2017 George Popoff
4 * Copyright 2008 Robert Shearman for CodeWeavers
5 * Copyright 2017 Hans Leidekker for CodeWeavers
6 *
7 * Kerberos5 Authentication Package
8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
22 */
23
24 #include "config.h"
25 #include "wine/port.h"
26
27 #include <stdarg.h>
28 #ifdef HAVE_KRB5_KRB5_H
29 #include <krb5/krb5.h>
30 #endif
31 #ifdef SONAME_LIBGSSAPI_KRB5
32 # include <gssapi/gssapi.h>
33 # include <gssapi/gssapi_ext.h>
34 #endif
35
36 #include "ntstatus.h"
37 #define WIN32_NO_STATUS
38 #include "windef.h"
39 #include "winbase.h"
40 #include "winnls.h"
41 #include "rpc.h"
42 #include "sspi.h"
43 #include "ntsecapi.h"
44 #include "ntsecpkg.h"
45 #include "winternl.h"
46 #include "wine/heap.h"
47 #include "wine/library.h"
48 #include "wine/debug.h"
49 #include "wine/unicode.h"
50
51 WINE_DEFAULT_DEBUG_CHANNEL(kerberos);
52
53 #define KERBEROS_MAX_BUF 12000
54
55 #define KERBEROS_CAPS \
56 ( SECPKG_FLAG_INTEGRITY \
57 | SECPKG_FLAG_PRIVACY \
58 | SECPKG_FLAG_TOKEN_ONLY \
59 | SECPKG_FLAG_DATAGRAM \
60 | SECPKG_FLAG_CONNECTION \
61 | SECPKG_FLAG_MULTI_REQUIRED \
62 | SECPKG_FLAG_EXTENDED_ERROR \
63 | SECPKG_FLAG_IMPERSONATION \
64 | SECPKG_FLAG_ACCEPT_WIN32_NAME \
65 | SECPKG_FLAG_NEGOTIABLE \
66 | SECPKG_FLAG_GSS_COMPATIBLE \
67 | SECPKG_FLAG_LOGON \
68 | SECPKG_FLAG_MUTUAL_AUTH \
69 | SECPKG_FLAG_DELEGATION \
70 | SECPKG_FLAG_READONLY_WITH_CHECKSUM \
71 | SECPKG_FLAG_RESTRICTED_TOKENS \
72 | SECPKG_FLAG_APPCONTAINER_CHECKS)
73
74 static WCHAR kerberos_name_W[] = {'K','e','r','b','e','r','o','s',0};
75 static WCHAR kerberos_comment_W[] = {'M','i','c','r','o','s','o','f','t',' ','K','e','r','b','e','r','o','s',' ','V','1','.','0',0};
76 static const SecPkgInfoW infoW =
77 {
78 KERBEROS_CAPS,
79 1,
80 RPC_C_AUTHN_GSS_KERBEROS,
81 KERBEROS_MAX_BUF,
82 kerberos_name_W,
83 kerberos_comment_W
84 };
85
86 static ULONG kerberos_package_id;
87 static LSA_DISPATCH_TABLE lsa_dispatch;
88
89 #ifdef SONAME_LIBKRB5
90
91 static void *libkrb5_handle;
92
93 #define MAKE_FUNCPTR(f) static typeof(f) * p_##f
94 MAKE_FUNCPTR(krb5_cc_close);
95 MAKE_FUNCPTR(krb5_cc_default);
96 MAKE_FUNCPTR(krb5_cc_end_seq_get);
97 MAKE_FUNCPTR(krb5_cc_initialize);
98 MAKE_FUNCPTR(krb5_cc_next_cred);
99 MAKE_FUNCPTR(krb5_cc_start_seq_get);
100 MAKE_FUNCPTR(krb5_cc_store_cred);
101 MAKE_FUNCPTR(krb5_cccol_cursor_free);
102 MAKE_FUNCPTR(krb5_cccol_cursor_new);
103 MAKE_FUNCPTR(krb5_cccol_cursor_next);
104 MAKE_FUNCPTR(krb5_decode_ticket);
105 MAKE_FUNCPTR(krb5_free_context);
106 MAKE_FUNCPTR(krb5_free_cred_contents);
107 MAKE_FUNCPTR(krb5_free_principal);
108 MAKE_FUNCPTR(krb5_free_ticket);
109 MAKE_FUNCPTR(krb5_free_unparsed_name);
110 MAKE_FUNCPTR(krb5_get_init_creds_opt_alloc);
111 MAKE_FUNCPTR(krb5_get_init_creds_opt_free);
112 MAKE_FUNCPTR(krb5_get_init_creds_opt_set_out_ccache);
113 MAKE_FUNCPTR(krb5_get_init_creds_password);
114 MAKE_FUNCPTR(krb5_init_context);
115 MAKE_FUNCPTR(krb5_is_config_principal);
116 MAKE_FUNCPTR(krb5_parse_name_flags);
117 MAKE_FUNCPTR(krb5_unparse_name_flags);
118 #undef MAKE_FUNCPTR
119
120 static void load_krb5(void)
121 {
122 if (!(libkrb5_handle = wine_dlopen(SONAME_LIBKRB5, RTLD_NOW, NULL, 0)))
123 {
124 WARN("Failed to load %s, Kerberos support will be disabled\n", SONAME_LIBKRB5);
125 return;
126 }
127
128 #define LOAD_FUNCPTR(f) \
129 if (!(p_##f = wine_dlsym(libkrb5_handle, #f, NULL, 0))) \
130 { \
131 ERR("Failed to load %s\n", #f); \
132 goto fail; \
133 }
134
135 LOAD_FUNCPTR(krb5_cc_close)
136 LOAD_FUNCPTR(krb5_cc_default)
137 LOAD_FUNCPTR(krb5_cc_end_seq_get)
138 LOAD_FUNCPTR(krb5_cc_initialize)
139 LOAD_FUNCPTR(krb5_cc_next_cred)
140 LOAD_FUNCPTR(krb5_cc_start_seq_get)
141 LOAD_FUNCPTR(krb5_cc_store_cred)
142 LOAD_FUNCPTR(krb5_cccol_cursor_free)
143 LOAD_FUNCPTR(krb5_cccol_cursor_new)
144 LOAD_FUNCPTR(krb5_cccol_cursor_next)
145 LOAD_FUNCPTR(krb5_decode_ticket)
146 LOAD_FUNCPTR(krb5_free_context)
147 LOAD_FUNCPTR(krb5_free_cred_contents)
148 LOAD_FUNCPTR(krb5_free_principal)
149 LOAD_FUNCPTR(krb5_free_ticket)
150 LOAD_FUNCPTR(krb5_free_unparsed_name)
151 LOAD_FUNCPTR(krb5_get_init_creds_opt_alloc)
152 LOAD_FUNCPTR(krb5_get_init_creds_opt_free)
153 LOAD_FUNCPTR(krb5_get_init_creds_opt_set_out_ccache)
154 LOAD_FUNCPTR(krb5_get_init_creds_password)
155 LOAD_FUNCPTR(krb5_init_context)
156 LOAD_FUNCPTR(krb5_is_config_principal)
157 LOAD_FUNCPTR(krb5_parse_name_flags)
158 LOAD_FUNCPTR(krb5_unparse_name_flags)
159 #undef LOAD_FUNCPTR
160
161 return;
162
163 fail:
164 wine_dlclose(libkrb5_handle, NULL, 0);
165 libkrb5_handle = NULL;
166 }
167
168 #else /* SONAME_LIBKRB5 */
169
170 static void load_krb5(void)
171 {
172 WARN("Kerberos support was not provided at compile time\n");
173 }
174
175 #endif /* SONAME_LIBKRB5 */
176
177 static const char *debugstr_us( const UNICODE_STRING *us )
178 {
179 if (!us) return "<null>";
180 return debugstr_wn( us->Buffer, us->Length / sizeof(WCHAR) );
181 }
182
183 static NTSTATUS NTAPI kerberos_LsaApInitializePackage(ULONG package_id, PLSA_DISPATCH_TABLE dispatch,
184 PLSA_STRING database, PLSA_STRING confidentiality, PLSA_STRING *package_name)
185 {
186 char *kerberos_name;
187
188 load_krb5();
189
190 kerberos_package_id = package_id;
191 lsa_dispatch = *dispatch;
192
193 kerberos_name = lsa_dispatch.AllocateLsaHeap(sizeof(MICROSOFT_KERBEROS_NAME_A));
194 if (!kerberos_name) return STATUS_NO_MEMORY;
195
196 memcpy(kerberos_name, MICROSOFT_KERBEROS_NAME_A, sizeof(MICROSOFT_KERBEROS_NAME_A));
197
198 *package_name = lsa_dispatch.AllocateLsaHeap(sizeof(**package_name));
199 if (!*package_name)
200 {
201 lsa_dispatch.FreeLsaHeap(kerberos_name);
202 return STATUS_NO_MEMORY;
203 }
204
205 RtlInitString(*package_name, kerberos_name);
206
207 return STATUS_SUCCESS;
208 }
209
210 #ifdef SONAME_LIBKRB5
211
212 struct ticket_info
213 {
214 ULONG count, allocated;
215 KERB_TICKET_CACHE_INFO *info;
216 };
217
218 static NTSTATUS krb5_error_to_status(krb5_error_code error)
219 {
220 switch (error)
221 {
222 case 0: return STATUS_SUCCESS;
223 default:
224 /* FIXME */
225 return STATUS_UNSUCCESSFUL;
226 }
227 }
228
229 static void free_ticket_info(struct ticket_info *info)
230 {
231 ULONG i;
232
233 for (i = 0; i < info->count; i++)
234 {
235 heap_free(info->info[i].RealmName.Buffer);
236 heap_free(info->info[i].ServerName.Buffer);
237 }
238
239 heap_free(info->info);
240 }
241
242 static WCHAR *utf8_to_wstr(const char *utf8)
243 {
244 int len;
245 WCHAR *wstr;
246
247 len = MultiByteToWideChar(CP_UTF8, 0, utf8, -1, NULL, 0);
248 wstr = heap_alloc(len * sizeof(WCHAR));
249 if (wstr)
250 MultiByteToWideChar(CP_UTF8, 0, utf8, -1, wstr, len);
251
252 return wstr;
253 }
254
255 static NTSTATUS copy_tickets_from_cache(krb5_context context, krb5_ccache cache, struct ticket_info *info)
256 {
257 NTSTATUS status;
258 krb5_cc_cursor cursor;
259 krb5_error_code error;
260 krb5_creds credentials;
261 krb5_ticket *ticket;
262 char *name_with_realm, *name_without_realm, *realm_name;
263 WCHAR *realm_nameW, *name_without_realmW;
264
265 error = p_krb5_cc_start_seq_get(context, cache, &cursor);
266 if (error) return krb5_error_to_status(error);
267
268 for (;;)
269 {
270 error = p_krb5_cc_next_cred(context, cache, &cursor, &credentials);
271 if (error)
272 {
273 if (error == KRB5_CC_END)
274 status = STATUS_SUCCESS;
275 else
276 status = krb5_error_to_status(error);
277 break;
278 }
279
280 if (p_krb5_is_config_principal(context, credentials.server))
281 {
282 p_krb5_free_cred_contents(context, &credentials);
283 continue;
284 }
285
286 if (info->count == info->allocated)
287 {
288 KERB_TICKET_CACHE_INFO *new_info;
289 ULONG new_allocated;
290
291 if (info->allocated)
292 {
293 new_allocated = info->allocated * 2;
294 new_info = heap_realloc(info->info, sizeof(*new_info) * new_allocated);
295 }
296 else
297 {
298 new_allocated = 16;
299 new_info = heap_alloc(sizeof(*new_info) * new_allocated);
300 }
301 if (!new_info)
302 {
303 p_krb5_free_cred_contents(context, &credentials);
304 status = STATUS_NO_MEMORY;
305 break;
306 }
307
308 info->info = new_info;
309 info->allocated = new_allocated;
310 }
311
312 error = p_krb5_unparse_name_flags(context, credentials.server, 0, &name_with_realm);
313 if (error)
314 {
315 p_krb5_free_cred_contents(context, &credentials);
316 status = krb5_error_to_status(error);
317 break;
318 }
319
320 TRACE("name_with_realm: %s\n", debugstr_a(name_with_realm));
321
322 error = p_krb5_unparse_name_flags(context, credentials.server,
323 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name_without_realm);
324 if (error)
325 {
326 p_krb5_free_unparsed_name(context, name_with_realm);
327 p_krb5_free_cred_contents(context, &credentials);
328 status = krb5_error_to_status(error);
329 break;
330 }
331
332 TRACE("name_without_realm: %s\n", debugstr_a(name_without_realm));
333
334 name_without_realmW = utf8_to_wstr(name_without_realm);
335 RtlInitUnicodeString(&info->info[info->count].ServerName, name_without_realmW);
336
337 realm_name = strchr(name_with_realm, '@');
338 if (!realm_name)
339 {
340 ERR("wrong name with realm %s\n", debugstr_a(name_with_realm));
341 realm_name = name_with_realm;
342 }
343 else
344 realm_name++;
345
346 /* realm_name - now contains only realm! */
347
348 realm_nameW = utf8_to_wstr(realm_name);
349 RtlInitUnicodeString(&info->info[info->count].RealmName, realm_nameW);
350
351 if (!credentials.times.starttime)
352 credentials.times.starttime = credentials.times.authtime;
353
354 /* TODO: if krb5_is_config_principal = true */
355 RtlSecondsSince1970ToTime(credentials.times.starttime, &info->info[info->count].StartTime);
356 RtlSecondsSince1970ToTime(credentials.times.endtime, &info->info[info->count].EndTime);
357 RtlSecondsSince1970ToTime(credentials.times.renew_till, &info->info[info->count].RenewTime);
358
359 info->info[info->count].TicketFlags = credentials.ticket_flags;
360
361 error = p_krb5_decode_ticket(&credentials.ticket, &ticket);
362
363 p_krb5_free_unparsed_name(context, name_with_realm);
364 p_krb5_free_unparsed_name(context, name_without_realm);
365 p_krb5_free_cred_contents(context, &credentials);
366
367 if (error)
368 {
369 status = krb5_error_to_status(error);
370 break;
371 }
372
373 info->info[info->count].EncryptionType = ticket->enc_part.enctype;
374
375 p_krb5_free_ticket(context, ticket);
376
377 info->count++;
378 }
379
380 p_krb5_cc_end_seq_get(context, cache, &cursor);
381
382 return status;
383 }
384
385 static inline void init_client_us(UNICODE_STRING *dst, void *client_ws, const UNICODE_STRING *src)
386 {
387 dst->Buffer = client_ws;
388 dst->Length = src->Length;
389 dst->MaximumLength = src->MaximumLength;
390 }
391
392 static NTSTATUS copy_to_client(PLSA_CLIENT_REQUEST lsa_req, struct ticket_info *info, void **out, ULONG *out_size)
393 {
394 NTSTATUS status;
395 ULONG i;
396 SIZE_T size, client_str_off;
397 char *client_resp, *client_ticket, *client_str;
398 KERB_QUERY_TKT_CACHE_RESPONSE resp;
399
400 size = sizeof(KERB_QUERY_TKT_CACHE_RESPONSE);
401 if (info->count != 0)
402 size += (info->count - 1) * sizeof(KERB_TICKET_CACHE_INFO);
403
404 client_str_off = size;
405
406 for (i = 0; i < info->count; i++)
407 {
408 size += info->info[i].RealmName.MaximumLength;
409 size += info->info[i].ServerName.MaximumLength;
410 }
411
412 status = lsa_dispatch.AllocateClientBuffer(lsa_req, size, (void **)&client_resp);
413 if (status != STATUS_SUCCESS) return status;
414
415 resp.MessageType = KerbQueryTicketCacheMessage;
416 resp.CountOfTickets = info->count;
417 size = FIELD_OFFSET(KERB_QUERY_TKT_CACHE_RESPONSE, Tickets);
418 status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_resp, &resp);
419 if (status != STATUS_SUCCESS) goto fail;
420
421 if (!info->count)
422 {
423 *out = client_resp;
424 *out_size = sizeof(resp);
425 return STATUS_SUCCESS;
426 }
427
428 *out_size = size;
429
430 client_ticket = client_resp + size;
431 client_str = client_resp + client_str_off;
432
433 for (i = 0; i < info->count; i++)
434 {
435 KERB_TICKET_CACHE_INFO ticket;
436
437 ticket = info->info[i];
438
439 init_client_us(&ticket.RealmName, client_str, &info->info[i].RealmName);
440
441 size = info->info[i].RealmName.MaximumLength;
442 status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, info->info[i].RealmName.Buffer);
443 if (status != STATUS_SUCCESS) goto fail;
444 client_str += size;
445 *out_size += size;
446
447 init_client_us(&ticket.ServerName, client_str, &info->info[i].ServerName);
448
449 size = info->info[i].ServerName.MaximumLength;
450 status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, info->info[i].ServerName.Buffer);
451 if (status != STATUS_SUCCESS) goto fail;
452 client_str += size;
453 *out_size += size;
454
455 status = lsa_dispatch.CopyToClientBuffer(lsa_req, sizeof(ticket), client_ticket, &ticket);
456 if (status != STATUS_SUCCESS) goto fail;
457
458 client_ticket += sizeof(ticket);
459 *out_size += sizeof(ticket);
460 }
461
462 *out = client_resp;
463 return STATUS_SUCCESS;
464
465 fail:
466 lsa_dispatch.FreeClientBuffer(lsa_req, client_resp);
467 return status;
468 }
469
470 static NTSTATUS query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req, void *in, ULONG in_len, void **out, ULONG *out_len)
471 {
472 NTSTATUS status;
473 KERB_QUERY_TKT_CACHE_REQUEST *query;
474 struct ticket_info info;
475 krb5_error_code error;
476 krb5_context context = NULL;
477 krb5_cccol_cursor cursor = NULL;
478 krb5_ccache cache;
479
480 if (!in || in_len != sizeof(KERB_QUERY_TKT_CACHE_REQUEST) || !out || !out_len)
481 return STATUS_INVALID_PARAMETER;
482
483 query = (KERB_QUERY_TKT_CACHE_REQUEST *)in;
484
485 if (query->LogonId.HighPart != 0 || query->LogonId.LowPart != 0)
486 return STATUS_ACCESS_DENIED;
487
488 info.count = 0;
489 info.allocated = 0;
490 info.info = NULL;
491
492 error = p_krb5_init_context(&context);
493 if (error)
494 {
495 status = krb5_error_to_status(error);
496 goto done;
497 }
498
499 error = p_krb5_cccol_cursor_new(context, &cursor);
500 if (error)
501 {
502 status = krb5_error_to_status(error);
503 goto done;
504 }
505
506 for (;;)
507 {
508 error = p_krb5_cccol_cursor_next(context, cursor, &cache);
509 if (error)
510 {
511 status = krb5_error_to_status(error);
512 goto done;
513 }
514 if (!cache) break;
515
516 status = copy_tickets_from_cache(context, cache, &info);
517
518 p_krb5_cc_close(context, cache);
519
520 if (status != STATUS_SUCCESS)
521 goto done;
522 }
523
524 status = copy_to_client(lsa_req, &info, out, out_len);
525
526 done:
527 if (cursor)
528 p_krb5_cccol_cursor_free(context, &cursor);
529
530 if (context)
531 p_krb5_free_context(context);
532
533 free_ticket_info(&info);
534
535 return status;
536 }
537
538 #else /* SONAME_LIBKRB5 */
539
540 static NTSTATUS query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req, void *in, ULONG in_len, void **out, ULONG *out_len)
541 {
542 FIXME("%p,%p,%u,%p,%p: stub\n", lsa_req, in, in_len, out, out_len);
543 return STATUS_NOT_IMPLEMENTED;
544 }
545
546 #endif /* SONAME_LIBKRB5 */
547
548 static NTSTATUS NTAPI kerberos_LsaApCallPackageUntrusted(PLSA_CLIENT_REQUEST request,
549 PVOID in_buffer, PVOID client_buffer_base, ULONG in_buffer_length,
550 PVOID *out_buffer, PULONG out_buffer_length, PNTSTATUS status)
551 {
552 KERB_PROTOCOL_MESSAGE_TYPE msg;
553
554 TRACE("%p,%p,%p,%u,%p,%p,%p\n", request, in_buffer, client_buffer_base,
555 in_buffer_length, out_buffer, out_buffer_length, status);
556
557 if (!in_buffer || in_buffer_length < sizeof(msg))
558 return STATUS_INVALID_PARAMETER;
559
560 msg = *(KERB_PROTOCOL_MESSAGE_TYPE *)in_buffer;
561
562 switch (msg)
563 {
564 case KerbQueryTicketCacheMessage:
565 *status = query_ticket_cache(request, in_buffer, in_buffer_length, out_buffer, out_buffer_length);
566 break;
567
568 case KerbRetrieveTicketMessage:
569 FIXME("KerbRetrieveTicketMessage stub\n");
570 *status = STATUS_NOT_IMPLEMENTED;
571 break;
572
573 case KerbPurgeTicketCacheMessage:
574 FIXME("KerbPurgeTicketCacheMessage stub\n");
575 *status = STATUS_NOT_IMPLEMENTED;
576 break;
577
578 default: /* All other requests should call LsaApCallPackage */
579 WARN("%u => access denied\n", msg);
580 *status = STATUS_ACCESS_DENIED;
581 break;
582 }
583
584 return *status;
585 }
586
587 static NTSTATUS NTAPI kerberos_SpGetInfo(SecPkgInfoW *info)
588 {
589 TRACE("%p\n", info);
590
591 /* LSA will make a copy before forwarding the structure, so
592 * it's safe to put pointers to dynamic or constant data there.
593 */
594 *info = infoW;
595
596 return STATUS_SUCCESS;
597 }
598
599 #ifdef SONAME_LIBGSSAPI_KRB5
600
601 WINE_DECLARE_DEBUG_CHANNEL(winediag);
602 static void *libgssapi_krb5_handle;
603
604 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
605 MAKE_FUNCPTR(gss_accept_sec_context);
606 MAKE_FUNCPTR(gss_acquire_cred);
607 MAKE_FUNCPTR(gss_delete_sec_context);
608 MAKE_FUNCPTR(gss_display_status);
609 MAKE_FUNCPTR(gss_get_mic);
610 MAKE_FUNCPTR(gss_import_name);
611 MAKE_FUNCPTR(gss_init_sec_context);
612 MAKE_FUNCPTR(gss_inquire_context);
613 MAKE_FUNCPTR(gss_release_buffer);
614 MAKE_FUNCPTR(gss_release_cred);
615 MAKE_FUNCPTR(gss_release_iov_buffer);
616 MAKE_FUNCPTR(gss_release_name);
617 MAKE_FUNCPTR(gss_unwrap);
618 MAKE_FUNCPTR(gss_unwrap_iov);
619 MAKE_FUNCPTR(gss_verify_mic);
620 MAKE_FUNCPTR(gss_wrap);
621 MAKE_FUNCPTR(gss_wrap_iov);
622 #undef MAKE_FUNCPTR
623
624 static BOOL load_gssapi_krb5(void)
625 {
626 if (!(libgssapi_krb5_handle = wine_dlopen( SONAME_LIBGSSAPI_KRB5, RTLD_NOW, NULL, 0 )))
627 {
628 ERR_(winediag)( "Failed to load libgssapi_krb5, Kerberos SSP support will not be available.\n" );
629 return FALSE;
630 }
631
632 #define LOAD_FUNCPTR(f) \
633 if (!(p##f = wine_dlsym( libgssapi_krb5_handle, #f, NULL, 0 ))) \
634 { \
635 ERR( "Failed to load %s\n", #f ); \
636 goto fail; \
637 }
638
639 LOAD_FUNCPTR(gss_accept_sec_context)
640 LOAD_FUNCPTR(gss_acquire_cred)
641 LOAD_FUNCPTR(gss_delete_sec_context)
642 LOAD_FUNCPTR(gss_display_status)
643 LOAD_FUNCPTR(gss_get_mic)
644 LOAD_FUNCPTR(gss_import_name)
645 LOAD_FUNCPTR(gss_init_sec_context)
646 LOAD_FUNCPTR(gss_inquire_context)
647 LOAD_FUNCPTR(gss_release_buffer)
648 LOAD_FUNCPTR(gss_release_cred)
649 LOAD_FUNCPTR(gss_release_iov_buffer)
650 LOAD_FUNCPTR(gss_release_name)
651 LOAD_FUNCPTR(gss_unwrap)
652 LOAD_FUNCPTR(gss_unwrap_iov)
653 LOAD_FUNCPTR(gss_verify_mic)
654 LOAD_FUNCPTR(gss_wrap)
655 LOAD_FUNCPTR(gss_wrap_iov)
656 #undef LOAD_FUNCPTR
657
658 return TRUE;
659
660 fail:
661 wine_dlclose( libgssapi_krb5_handle, NULL, 0 );
662 libgssapi_krb5_handle = NULL;
663 return FALSE;
664 }
665
666 static void unload_gssapi_krb5(void)
667 {
668 wine_dlclose( libgssapi_krb5_handle, NULL, 0 );
669 libgssapi_krb5_handle = NULL;
670 }
671
672 static inline gss_cred_id_t credhandle_sspi_to_gss( LSA_SEC_HANDLE cred )
673 {
674 if (!cred) return GSS_C_NO_CREDENTIAL;
675 return (gss_cred_id_t)cred;
676 }
677
678 static inline void credhandle_gss_to_sspi( gss_cred_id_t handle, LSA_SEC_HANDLE *cred )
679 {
680 *cred = (LSA_SEC_HANDLE)handle;
681 }
682
683 static inline gss_ctx_id_t ctxthandle_sspi_to_gss( LSA_SEC_HANDLE ctxt )
684 {
685 if (!ctxt) return GSS_C_NO_CONTEXT;
686 return (gss_ctx_id_t)ctxt;
687 }
688
689 static inline void ctxthandle_gss_to_sspi( gss_ctx_id_t handle, LSA_SEC_HANDLE *ctxt )
690 {
691 *ctxt = (LSA_SEC_HANDLE)handle;
692 }
693
694 static NTSTATUS status_gss_to_sspi( OM_uint32 status )
695 {
696 switch (status)
697 {
698 case GSS_S_COMPLETE: return SEC_E_OK;
699 case GSS_S_BAD_MECH: return SEC_E_SECPKG_NOT_FOUND;
700 case GSS_S_BAD_SIG: return SEC_E_MESSAGE_ALTERED;
701 case GSS_S_NO_CRED: return SEC_E_NO_CREDENTIALS;
702 case GSS_S_NO_CONTEXT: return SEC_E_INVALID_HANDLE;
703 case GSS_S_DEFECTIVE_TOKEN: return SEC_E_INVALID_TOKEN;
704 case GSS_S_DEFECTIVE_CREDENTIAL: return SEC_E_NO_CREDENTIALS;
705 case GSS_S_CREDENTIALS_EXPIRED: return SEC_E_CONTEXT_EXPIRED;
706 case GSS_S_CONTEXT_EXPIRED: return SEC_E_CONTEXT_EXPIRED;
707 case GSS_S_BAD_QOP: return SEC_E_QOP_NOT_SUPPORTED;
708 case GSS_S_CONTINUE_NEEDED: return SEC_I_CONTINUE_NEEDED;
709 case GSS_S_DUPLICATE_TOKEN: return SEC_E_INVALID_TOKEN;
710 case GSS_S_OLD_TOKEN: return SEC_E_INVALID_TOKEN;
711 case GSS_S_UNSEQ_TOKEN: return SEC_E_OUT_OF_SEQUENCE;
712 case GSS_S_GAP_TOKEN: return SEC_E_OUT_OF_SEQUENCE;
713 case GSS_S_FAILURE: return SEC_E_INTERNAL_ERROR;
714
715 default:
716 FIXME( "couldn't convert status 0x%08x to NTSTATUS\n", status );
717 return SEC_E_INTERNAL_ERROR;
718 }
719 }
720
721 static void trace_gss_status_ex( OM_uint32 code, int type )
722 {
723 OM_uint32 ret, minor_status;
724 gss_buffer_desc buf;
725 OM_uint32 message_context = 0;
726
727 for (;;)
728 {
729 ret = pgss_display_status( &minor_status, code, type, GSS_C_NULL_OID, &message_context, &buf );
730 if (GSS_ERROR(ret))
731 {
732 TRACE( "gss_display_status(0x%08x,%d) returned %08x minor status %08x\n",
733 code, type, ret, minor_status );
734 return;
735 }
736 TRACE( "GSS-API error: 0x%08x: %s\n", code, debugstr_an(buf.value, buf.length) );
737 pgss_release_buffer( &minor_status, &buf );
738
739 if (!message_context) return;
740 }
741 }
742
743 static void trace_gss_status( OM_uint32 major_status, OM_uint32 minor_status )
744 {
745 if (TRACE_ON(kerberos))
746 {
747 trace_gss_status_ex( major_status, GSS_C_GSS_CODE );
748 trace_gss_status_ex( minor_status, GSS_C_MECH_CODE );
749 }
750 }
751
752 static void expirytime_gss_to_sspi( OM_uint32 expirytime, TimeStamp *timestamp )
753 {
754 SYSTEMTIME time;
755 FILETIME filetime;
756 ULARGE_INTEGER tmp;
757
758 GetLocalTime( &time );
759 SystemTimeToFileTime( &time, &filetime );
760 tmp.QuadPart = ((ULONGLONG)filetime.dwLowDateTime | (ULONGLONG)filetime.dwHighDateTime << 32) + expirytime;
761 timestamp->LowPart = tmp.QuadPart;
762 timestamp->HighPart = tmp.QuadPart >> 32;
763 }
764
765 static NTSTATUS name_sspi_to_gss( const UNICODE_STRING *name_str, gss_name_t *name )
766 {
767 OM_uint32 ret, minor_status;
768 gss_OID type = GSS_C_NO_OID; /* FIXME: detect the appropriate value for this ourselves? */
769 gss_buffer_desc buf;
770
771 buf.length = WideCharToMultiByte( CP_UNIXCP, 0, name_str->Buffer, name_str->Length / sizeof(WCHAR), NULL, 0, NULL, NULL );
772 if (!(buf.value = heap_alloc( buf.length ))) return SEC_E_INSUFFICIENT_MEMORY;
773 WideCharToMultiByte( CP_UNIXCP, 0, name_str->Buffer, name_str->Length / sizeof(WCHAR), buf.value, buf.length, NULL, NULL );
774
775 ret = pgss_import_name( &minor_status, &buf, type, name );
776 TRACE( "gss_import_name returned %08x minor status %08x\n", ret, minor_status );
777 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
778
779 heap_free( buf.value );
780 return status_gss_to_sspi( ret );
781 }
782
783 static ULONG flags_isc_req_to_gss( ULONG flags )
784 {
785 ULONG ret = 0;
786 if (flags & ISC_REQ_DELEGATE) ret |= GSS_C_DELEG_FLAG;
787 if (flags & ISC_REQ_MUTUAL_AUTH) ret |= GSS_C_MUTUAL_FLAG;
788 if (flags & ISC_REQ_REPLAY_DETECT) ret |= GSS_C_REPLAY_FLAG;
789 if (flags & ISC_REQ_SEQUENCE_DETECT) ret |= GSS_C_SEQUENCE_FLAG;
790 if (flags & ISC_REQ_CONFIDENTIALITY) ret |= GSS_C_CONF_FLAG;
791 if (flags & ISC_REQ_INTEGRITY) ret |= GSS_C_INTEG_FLAG;
792 if (flags & ISC_REQ_NULL_SESSION) ret |= GSS_C_ANON_FLAG;
793 if (flags & ISC_REQ_USE_DCE_STYLE) ret |= GSS_C_DCE_STYLE;
794 if (flags & ISC_REQ_IDENTIFY) ret |= GSS_C_IDENTIFY_FLAG;
795 return ret;
796 }
797
798 static ULONG flags_gss_to_isc_ret( ULONG flags )
799 {
800 ULONG ret = 0;
801 if (flags & GSS_C_DELEG_FLAG) ret |= ISC_RET_DELEGATE;
802 if (flags & GSS_C_MUTUAL_FLAG) ret |= ISC_RET_MUTUAL_AUTH;
803 if (flags & GSS_C_REPLAY_FLAG) ret |= ISC_RET_REPLAY_DETECT;
804 if (flags & GSS_C_SEQUENCE_FLAG) ret |= ISC_RET_SEQUENCE_DETECT;
805 if (flags & GSS_C_CONF_FLAG) ret |= ISC_RET_CONFIDENTIALITY;
806 if (flags & GSS_C_INTEG_FLAG) ret |= ISC_RET_INTEGRITY;
807 if (flags & GSS_C_ANON_FLAG) ret |= ISC_RET_NULL_SESSION;
808 if (flags & GSS_C_DCE_STYLE) ret |= ISC_RET_USED_DCE_STYLE;
809 if (flags & GSS_C_IDENTIFY_FLAG) ret |= ISC_RET_IDENTIFY;
810 return ret;
811 }
812
813 static ULONG flags_gss_to_asc_ret( ULONG flags )
814 {
815 ULONG ret = 0;
816 if (flags & GSS_C_DELEG_FLAG) ret |= ASC_RET_DELEGATE;
817 if (flags & GSS_C_MUTUAL_FLAG) ret |= ASC_RET_MUTUAL_AUTH;
818 if (flags & GSS_C_REPLAY_FLAG) ret |= ASC_RET_REPLAY_DETECT;
819 if (flags & GSS_C_SEQUENCE_FLAG) ret |= ASC_RET_SEQUENCE_DETECT;
820 if (flags & GSS_C_CONF_FLAG) ret |= ASC_RET_CONFIDENTIALITY;
821 if (flags & GSS_C_INTEG_FLAG) ret |= ASC_RET_INTEGRITY;
822 if (flags & GSS_C_ANON_FLAG) ret |= ASC_RET_NULL_SESSION;
823 if (flags & GSS_C_DCE_STYLE) ret |= ASC_RET_USED_DCE_STYLE;
824 if (flags & GSS_C_IDENTIFY_FLAG) ret |= ASC_RET_IDENTIFY;
825 return ret;
826 }
827
828 static BOOL is_dce_style_context( gss_ctx_id_t ctxt_handle )
829 {
830 OM_uint32 ret, minor_status, flags;
831 ret = pgss_inquire_context( &minor_status, ctxt_handle, NULL, NULL, NULL, NULL, &flags, NULL, NULL );
832 return (ret == GSS_S_COMPLETE && (flags & GSS_C_DCE_STYLE));
833 }
834
835 static int get_buffer_index( SecBufferDesc *desc, DWORD type )
836 {
837 UINT i;
838 if (!desc) return -1;
839 for (i = 0; i < desc->cBuffers; i++)
840 {
841 if (desc->pBuffers[i].BufferType == type) return i;
842 }
843 return -1;
844 }
845
846 static char *get_user_at_domain( const WCHAR *user, ULONG user_len, const WCHAR *domain, ULONG domain_len )
847 {
848 int len_user, len_domain;
849 char *ret;
850
851 len_user = WideCharToMultiByte( CP_UNIXCP, 0, user, user_len, NULL, 0, NULL, NULL );
852 len_domain = WideCharToMultiByte( CP_UNIXCP, 0, domain, domain_len, NULL, 0, NULL, NULL );
853 if (!(ret = heap_alloc( len_user + len_domain + 2 ))) return NULL;
854
855 WideCharToMultiByte( CP_UNIXCP, 0, user, user_len, ret, len_user, NULL, NULL );
856 ret[len_user] = '@';
857 WideCharToMultiByte( CP_UNIXCP, 0, domain, domain_len, ret + len_user + 1, len_domain, NULL, NULL );
858 ret[len_user + len_domain + 1] = 0;
859 return ret;
860 }
861
862 static char *get_password( const WCHAR *passwd, ULONG passwd_len )
863 {
864 int len;
865 char *ret;
866
867 len = WideCharToMultiByte( CP_UNIXCP, WC_NO_BEST_FIT_CHARS, passwd, passwd_len, NULL, 0, NULL, NULL );
868 if (!(ret = heap_alloc( len + 1 ))) return NULL;
869 WideCharToMultiByte( CP_UNIXCP, 0, passwd, passwd_len, ret, len, NULL, NULL );
870 ret[len] = 0;
871 return ret;
872 }
873
874 static NTSTATUS init_creds( const SEC_WINNT_AUTH_IDENTITY_W *id )
875 {
876 char *user_at_domain, *password;
877 krb5_context ctx;
878 krb5_principal principal = NULL;
879 krb5_get_init_creds_opt *options = NULL;
880 krb5_ccache cache = NULL;
881 krb5_creds creds;
882 krb5_error_code err;
883
884 if (!id) return STATUS_SUCCESS;
885 if (id->Flags & SEC_WINNT_AUTH_IDENTITY_ANSI)
886 {
887 FIXME( "ANSI identity not supported\n" );
888 return SEC_E_UNSUPPORTED_FUNCTION;
889 }
890 if (!(user_at_domain = get_user_at_domain( id->User, id->UserLength, id->Domain, id->DomainLength )))
891 {
892 return SEC_E_INSUFFICIENT_MEMORY;
893 }
894 if (!(password = get_password( id->Password, id->PasswordLength )))
895 {
896 heap_free( user_at_domain );
897 return SEC_E_INSUFFICIENT_MEMORY;
898 }
899
900 if ((err = p_krb5_init_context( &ctx )))
901 {
902 heap_free( password );
903 heap_free( user_at_domain );
904 return krb5_error_to_status( err );
905 }
906 if ((err = p_krb5_parse_name_flags( ctx, user_at_domain, 0, &principal ))) goto done;
907 if ((err = p_krb5_cc_default( ctx, &cache ))) goto done;
908 if ((err = p_krb5_get_init_creds_opt_alloc( ctx, &options ))) goto done;
909 if ((err = p_krb5_get_init_creds_opt_set_out_ccache( ctx, options, cache ))) goto done;
910 if ((err = p_krb5_get_init_creds_password( ctx, &creds, principal, password, 0, NULL, 0, NULL, 0 ))) goto done;
911 if ((err = p_krb5_cc_initialize( ctx, cache, principal ))) goto done;
912 if ((err = p_krb5_cc_store_cred( ctx, cache, &creds ))) goto done;
913
914 TRACE( "success\n" );
915 p_krb5_free_cred_contents( ctx, &creds );
916
917 done:
918 if (cache) p_krb5_cc_close( ctx, cache );
919 if (principal) p_krb5_free_principal( ctx, principal );
920 if (options) p_krb5_get_init_creds_opt_free( ctx, options );
921 p_krb5_free_context( ctx );
922 heap_free( user_at_domain );
923 heap_free( password );
924
925 return krb5_error_to_status( err );
926 }
927
928 static NTSTATUS acquire_credentials_handle( UNICODE_STRING *principal_us, gss_cred_usage_t cred_usage,
929 LSA_SEC_HANDLE *credential, TimeStamp *ts_expiry )
930 {
931 OM_uint32 ret, minor_status, expiry_time;
932 gss_name_t principal = GSS_C_NO_NAME;
933 gss_cred_id_t cred_handle;
934 NTSTATUS status;
935
936 if (principal_us && ((status = name_sspi_to_gss( principal_us, &principal )) != SEC_E_OK)) return status;
937
938 ret = pgss_acquire_cred( &minor_status, principal, GSS_C_INDEFINITE, GSS_C_NULL_OID_SET, cred_usage,
939 &cred_handle, NULL, &expiry_time );
940 TRACE( "gss_acquire_cred returned %08x minor status %08x\n", ret, minor_status );
941 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
942 if (ret == GSS_S_COMPLETE)
943 {
944 credhandle_gss_to_sspi( cred_handle, credential );
945 expirytime_gss_to_sspi( expiry_time, ts_expiry );
946 }
947
948 if (principal != GSS_C_NO_NAME) pgss_release_name( &minor_status, &principal );
949
950 return status_gss_to_sspi( ret );
951 }
952 #endif /* SONAME_LIBGSSAPI_KRB5 */
953
954 static NTSTATUS NTAPI kerberos_SpAcquireCredentialsHandle(
955 UNICODE_STRING *principal_us, ULONG credential_use, LUID *logon_id, void *auth_data,
956 void *get_key_fn, void *get_key_arg, LSA_SEC_HANDLE *credential, TimeStamp *ts_expiry )
957 {
958 #ifdef SONAME_LIBGSSAPI_KRB5
959 gss_cred_usage_t cred_usage;
960 NTSTATUS status;
961
962 TRACE( "(%s 0x%08x %p %p %p %p %p %p)\n", debugstr_us(principal_us), credential_use,
963 logon_id, auth_data, get_key_fn, get_key_arg, credential, ts_expiry );
964
965 switch (credential_use)
966 {
967 case SECPKG_CRED_INBOUND:
968 cred_usage = GSS_C_ACCEPT;
969 break;
970
971 case SECPKG_CRED_OUTBOUND:
972 if ((status = init_creds( auth_data )) != STATUS_SUCCESS) return status;
973 cred_usage = GSS_C_INITIATE;
974 break;
975
976 case SECPKG_CRED_BOTH:
977 cred_usage = GSS_C_BOTH;
978 break;
979
980 default:
981 return SEC_E_UNKNOWN_CREDENTIALS;
982 }
983
984 return acquire_credentials_handle( principal_us, cred_usage, credential, ts_expiry );
985 #else
986 FIXME( "(%s 0x%08x %p %p %p %p %p %p)\n", debugstr_us(principal_us), credential_use,
987 logon_id, auth_data, get_key_fn, get_key_arg, credential, ts_expiry );
988 FIXME( "Wine was built without Kerberos support.\n" );
989 return SEC_E_UNSUPPORTED_FUNCTION;
990 #endif
991 }
992
993 static NTSTATUS NTAPI kerberos_SpFreeCredentialsHandle( LSA_SEC_HANDLE credential )
994 {
995 #ifdef SONAME_LIBGSSAPI_KRB5
996 OM_uint32 ret, minor_status;
997 gss_cred_id_t cred_handle;
998
999 TRACE( "(%lx)\n", credential );
1000
1001 if (!credential) return SEC_E_INVALID_HANDLE;
1002 if (!(cred_handle = credhandle_sspi_to_gss( credential ))) return SEC_E_OK;
1003
1004 ret = pgss_release_cred( &minor_status, &cred_handle );
1005 TRACE( "gss_release_cred returned %08x minor status %08x\n", ret, minor_status );
1006 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1007
1008 return status_gss_to_sspi( ret );
1009 #else
1010 FIXME( "(%lx)\n", credential );
1011 return SEC_E_UNSUPPORTED_FUNCTION;
1012 #endif
1013 }
1014
1015 static NTSTATUS NTAPI kerberos_SpInitLsaModeContext( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context,
1016 UNICODE_STRING *target_name, ULONG context_req, ULONG target_data_rep, SecBufferDesc *input,
1017 LSA_SEC_HANDLE *new_context, SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry,
1018 BOOLEAN *mapped_context, SecBuffer *context_data )
1019 {
1020 #ifdef SONAME_LIBGSSAPI_KRB5
1021 static const ULONG supported = ISC_REQ_CONFIDENTIALITY | ISC_REQ_INTEGRITY | ISC_REQ_SEQUENCE_DETECT |
1022 ISC_REQ_REPLAY_DETECT | ISC_REQ_MUTUAL_AUTH | ISC_REQ_USE_DCE_STYLE |
1023 ISC_REQ_IDENTIFY;
1024 OM_uint32 ret, minor_status, ret_flags = 0, expiry_time, req_flags = flags_isc_req_to_gss( context_req );
1025 gss_cred_id_t cred_handle;
1026 gss_ctx_id_t ctxt_handle;
1027 gss_buffer_desc input_token, output_token;
1028 gss_name_t target = GSS_C_NO_NAME;
1029 NTSTATUS status;
1030 int idx;
1031
1032 TRACE( "(%lx %lx %s 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, debugstr_us(target_name),
1033 context_req, target_data_rep, input, new_context, output, context_attr, ts_expiry,
1034 mapped_context, context_data );
1035 if (context_req & ~supported)
1036 FIXME( "flags 0x%08x not supported\n", context_req & ~supported );
1037
1038 if (!context && !input && !credential) return SEC_E_INVALID_HANDLE;
1039 cred_handle = credhandle_sspi_to_gss( credential );
1040 ctxt_handle = ctxthandle_sspi_to_gss( context );
1041
1042 if ((idx = get_buffer_index( input, SECBUFFER_TOKEN )) == -1) input_token.length = 0;
1043 else
1044 {
1045 input_token.length = input->pBuffers[idx].cbBuffer;
1046 input_token.value = input->pBuffers[idx].pvBuffer;
1047 }
1048
1049 if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1050 output_token.length = 0;
1051 output_token.value = NULL;
1052
1053 if (target_name && ((status = name_sspi_to_gss( target_name, &target )) != SEC_E_OK)) return status;
1054
1055 ret = pgss_init_sec_context( &minor_status, cred_handle, &ctxt_handle, target, GSS_C_NO_OID, req_flags, 0,
1056 GSS_C_NO_CHANNEL_BINDINGS, &input_token, NULL, &output_token, &ret_flags,
1057 &expiry_time );
1058 TRACE( "gss_init_sec_context returned %08x minor status %08x ret_flags %08x\n", ret, minor_status, ret_flags );
1059 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1060 if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED)
1061 {
1062 if (output_token.length > output->pBuffers[idx].cbBuffer) /* FIXME: check if larger buffer exists */
1063 {
1064 TRACE( "buffer too small %lu > %u\n", (SIZE_T)output_token.length, output->pBuffers[idx].cbBuffer );
1065 pgss_release_buffer( &minor_status, &output_token );
1066 pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER );
1067 return SEC_E_INCOMPLETE_MESSAGE;
1068 }
1069 output->pBuffers[idx].cbBuffer = output_token.length;
1070 memcpy( output->pBuffers[idx].pvBuffer, output_token.value, output_token.length );
1071 pgss_release_buffer( &minor_status, &output_token );
1072
1073 ctxthandle_gss_to_sspi( ctxt_handle, new_context );
1074 if (context_attr) *context_attr = flags_gss_to_isc_ret( ret_flags );
1075 expirytime_gss_to_sspi( expiry_time, ts_expiry );
1076 }
1077
1078 if (target != GSS_C_NO_NAME) pgss_release_name( &minor_status, &target );
1079
1080 /* we do support user mode SSP/AP functions */
1081 *mapped_context = TRUE;
1082 /* FIXME: initialize context_data */
1083
1084 return status_gss_to_sspi( ret );
1085 #else
1086 FIXME( "(%lx %lx %s 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, debugstr_us(target_name),
1087 context_req, target_data_rep, input, new_context, output, context_attr, ts_expiry,
1088 mapped_context, context_data );
1089 return SEC_E_UNSUPPORTED_FUNCTION;
1090 #endif
1091 }
1092
1093 static NTSTATUS NTAPI kerberos_SpAcceptLsaModeContext( LSA_SEC_HANDLE credential, LSA_SEC_HANDLE context,
1094 SecBufferDesc *input, ULONG context_req, ULONG target_data_rep, LSA_SEC_HANDLE *new_context,
1095 SecBufferDesc *output, ULONG *context_attr, TimeStamp *ts_expiry, BOOLEAN *mapped_context, SecBuffer *context_data )
1096 {
1097 #ifdef SONAME_LIBGSSAPI_KRB5
1098 OM_uint32 ret, minor_status, ret_flags = 0, expiry_time;
1099 gss_cred_id_t cred_handle;
1100 gss_ctx_id_t ctxt_handle;
1101 gss_buffer_desc input_token, output_token;
1102 gss_name_t target = GSS_C_NO_NAME;
1103 int idx;
1104
1105 TRACE( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, context_req,
1106 target_data_rep, input, new_context, output, context_attr, ts_expiry,
1107 mapped_context, context_data );
1108 if (context_req) FIXME( "ignoring flags 0x%08x\n", context_req );
1109
1110 if (!context && !input && !credential) return SEC_E_INVALID_HANDLE;
1111 cred_handle = credhandle_sspi_to_gss( credential );
1112 ctxt_handle = ctxthandle_sspi_to_gss( context );
1113
1114 if (!input) input_token.length = 0;
1115 else
1116 {
1117 if ((idx = get_buffer_index( input, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1118 input_token.length = input->pBuffers[idx].cbBuffer;
1119 input_token.value = input->pBuffers[idx].pvBuffer;
1120 }
1121
1122 if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1123 output_token.length = 0;
1124 output_token.value = NULL;
1125
1126 ret = pgss_accept_sec_context( &minor_status, &ctxt_handle, cred_handle, &input_token, GSS_C_NO_CHANNEL_BINDINGS,
1127 &target, NULL, &output_token, &ret_flags, &expiry_time, NULL );
1128 TRACE( "gss_accept_sec_context returned %08x minor status %08x ret_flags %08x\n", ret, minor_status, ret_flags );
1129 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1130 if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED)
1131 {
1132 if (output_token.length > output->pBuffers[idx].cbBuffer) /* FIXME: check if larger buffer exists */
1133 {
1134 TRACE( "buffer too small %lu > %u\n", (SIZE_T)output_token.length, output->pBuffers[idx].cbBuffer );
1135 pgss_release_buffer( &minor_status, &output_token );
1136 pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER );
1137 return SEC_E_BUFFER_TOO_SMALL;
1138 }
1139 output->pBuffers[idx].cbBuffer = output_token.length;
1140 memcpy( output->pBuffers[idx].pvBuffer, output_token.value, output_token.length );
1141 pgss_release_buffer( &minor_status, &output_token );
1142
1143 ctxthandle_gss_to_sspi( ctxt_handle, new_context );
1144 if (context_attr) *context_attr = flags_gss_to_asc_ret( ret_flags );
1145 expirytime_gss_to_sspi( expiry_time, ts_expiry );
1146 }
1147
1148 /* we do support user mode SSP/AP functions */
1149 *mapped_context = TRUE;
1150 /* FIXME: initialize context_data */
1151
1152 return status_gss_to_sspi( ret );
1153 #else
1154 FIXME( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential, context, context_req,
1155 target_data_rep, input, new_context, output, context_attr, ts_expiry,
1156 mapped_context, context_data );
1157 return SEC_E_UNSUPPORTED_FUNCTION;
1158 #endif
1159 }
1160
1161 static NTSTATUS NTAPI kerberos_SpDeleteContext( LSA_SEC_HANDLE context )
1162 {
1163 #ifdef SONAME_LIBGSSAPI_KRB5
1164 OM_uint32 ret, minor_status;
1165 gss_ctx_id_t ctxt_handle;
1166
1167 TRACE( "(%lx)\n", context );
1168 if (!context) return SEC_E_INVALID_HANDLE;
1169 if (!(ctxt_handle = ctxthandle_sspi_to_gss( context ))) return SEC_E_OK;
1170
1171 ret = pgss_delete_sec_context( &minor_status, &ctxt_handle, GSS_C_NO_BUFFER );
1172 TRACE( "gss_delete_sec_context returned %08x minor status %08x\n", ret, minor_status );
1173 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1174
1175 return status_gss_to_sspi( ret );
1176 #else
1177 FIXME( "(%lx)\n", context );
1178 return SEC_E_UNSUPPORTED_FUNCTION;
1179 #endif
1180 }
1181
1182 static SecPkgInfoW *build_package_info( const SecPkgInfoW *info )
1183 {
1184 SecPkgInfoW *ret;
1185 DWORD size_name = (strlenW(info->Name) + 1) * sizeof(WCHAR);
1186 DWORD size_comment = (strlenW(info->Comment) + 1) * sizeof(WCHAR);
1187
1188 if (!(ret = heap_alloc( sizeof(*ret) + size_name + size_comment ))) return NULL;
1189 ret->fCapabilities = info->fCapabilities;
1190 ret->wVersion = info->wVersion;
1191 ret->wRPCID = info->wRPCID;
1192 ret->cbMaxToken = info->cbMaxToken;
1193 ret->Name = (SEC_WCHAR *)(ret + 1);
1194 memcpy( ret->Name, info->Name, size_name );
1195 ret->Comment = (SEC_WCHAR *)((char *)ret->Name + size_name);
1196 memcpy( ret->Comment, info->Comment, size_comment );
1197 return ret;
1198 }
1199
1200 static NTSTATUS NTAPI kerberos_SpQueryContextAttributes( LSA_SEC_HANDLE context, ULONG attribute, void *buffer )
1201 {
1202 TRACE( "(%lx %u %p)\n", context, attribute, buffer );
1203
1204 if (!context) return SEC_E_INVALID_HANDLE;
1205
1206 switch (attribute)
1207 {
1208 #define X(x) case (x) : FIXME(#x" stub\n"); break
1209 X(SECPKG_ATTR_ACCESS_TOKEN);
1210 X(SECPKG_ATTR_AUTHORITY);
1211 X(SECPKG_ATTR_DCE_INFO);
1212 X(SECPKG_ATTR_KEY_INFO);
1213 X(SECPKG_ATTR_LIFESPAN);
1214 X(SECPKG_ATTR_NAMES);
1215 X(SECPKG_ATTR_NATIVE_NAMES);
1216 X(SECPKG_ATTR_PACKAGE_INFO);
1217 X(SECPKG_ATTR_PASSWORD_EXPIRY);
1218 X(SECPKG_ATTR_SESSION_KEY);
1219 X(SECPKG_ATTR_STREAM_SIZES);
1220 X(SECPKG_ATTR_TARGET_INFORMATION);
1221 case SECPKG_ATTR_SIZES:
1222 {
1223 SecPkgContext_Sizes *sizes = (SecPkgContext_Sizes *)buffer;
1224 ULONG size_max_signature = 37, size_security_trailer = 49;
1225 #ifdef SONAME_LIBGSSAPI_KRB5
1226 gss_ctx_id_t ctxt_handle;
1227
1228 if (!(ctxt_handle = ctxthandle_sspi_to_gss( context ))) return SEC_E_INVALID_HANDLE;
1229 if (is_dce_style_context( ctxt_handle ))
1230 {
1231 size_max_signature = 28;
1232 size_security_trailer = 76;
1233 }
1234 #endif
1235 sizes->cbMaxToken = KERBEROS_MAX_BUF;
1236 sizes->cbMaxSignature = size_max_signature;
1237 sizes->cbBlockSize = 1;
1238 sizes->cbSecurityTrailer = size_security_trailer;
1239 return SEC_E_OK;
1240 }
1241 case SECPKG_ATTR_NEGOTIATION_INFO:
1242 {
1243 SecPkgContext_NegotiationInfoW *info = (SecPkgContext_NegotiationInfoW *)buffer;
1244 if (!(info->PackageInfo = build_package_info( &infoW ))) return SEC_E_INSUFFICIENT_MEMORY;
1245 info->NegotiationState = SECPKG_NEGOTIATION_COMPLETE;
1246 return SEC_E_OK;
1247 }
1248 #undef X
1249 default:
1250 FIXME( "unknown attribute %u\n", attribute );
1251 break;
1252 }
1253
1254 return SEC_E_UNSUPPORTED_FUNCTION;
1255 }
1256
1257 static NTSTATUS NTAPI kerberos_SpInitialize(ULONG_PTR package_id, SECPKG_PARAMETERS *params,
1258 LSA_SECPKG_FUNCTION_TABLE *lsa_function_table)
1259 {
1260 TRACE("%lu,%p,%p\n", package_id, params, lsa_function_table);
1261
1262 #ifdef SONAME_LIBGSSAPI_KRB5
1263 if (load_gssapi_krb5()) return STATUS_SUCCESS;
1264 #endif
1265
1266 return STATUS_UNSUCCESSFUL;
1267 }
1268
1269 static NTSTATUS NTAPI kerberos_SpShutdown(void)
1270 {
1271 TRACE("\n");
1272
1273 #ifdef SONAME_LIBGSSAPI_KRB5
1274 unload_gssapi_krb5();
1275 #endif
1276
1277 return STATUS_SUCCESS;
1278 }
1279
1280 static SECPKG_FUNCTION_TABLE kerberos_table =
1281 {
1282 kerberos_LsaApInitializePackage, /* InitializePackage */
1283 NULL, /* LsaLogonUser */
1284 NULL, /* CallPackage */
1285 NULL, /* LogonTerminated */
1286 kerberos_LsaApCallPackageUntrusted, /* CallPackageUntrusted */
1287 NULL, /* CallPackagePassthrough */
1288 NULL, /* LogonUserEx */
1289 NULL, /* LogonUserEx2 */
1290 kerberos_SpInitialize,
1291 kerberos_SpShutdown,
1292 kerberos_SpGetInfo,
1293 NULL, /* AcceptCredentials */
1294 kerberos_SpAcquireCredentialsHandle,
1295 NULL, /* SpQueryCredentialsAttributes */
1296 kerberos_SpFreeCredentialsHandle,
1297 NULL, /* SaveCredentials */
1298 NULL, /* GetCredentials */
1299 NULL, /* DeleteCredentials */
1300 kerberos_SpInitLsaModeContext,
1301 kerberos_SpAcceptLsaModeContext,
1302 kerberos_SpDeleteContext,
1303 NULL, /* ApplyControlToken */
1304 NULL, /* GetUserInfo */
1305 NULL, /* GetExtendedInformation */
1306 kerberos_SpQueryContextAttributes,
1307 NULL, /* SpAddCredentials */
1308 NULL, /* SetExtendedInformation */
1309 NULL, /* SetContextAttributes */
1310 NULL, /* SetCredentialsAttributes */
1311 NULL, /* ChangeAccountPassword */
1312 NULL, /* QueryMetaData */
1313 NULL, /* ExchangeMetaData */
1314 NULL, /* GetCredUIContext */
1315 NULL, /* UpdateCredentials */
1316 NULL, /* ValidateTargetInfo */
1317 NULL, /* PostLogonUser */
1318 };
1319
1320 NTSTATUS NTAPI SpLsaModeInitialize(ULONG lsa_version, PULONG package_version,
1321 PSECPKG_FUNCTION_TABLE *table, PULONG table_count)
1322 {
1323 TRACE("%#x,%p,%p,%p\n", lsa_version, package_version, table, table_count);
1324
1325 *package_version = SECPKG_INTERFACE_VERSION;
1326 *table = &kerberos_table;
1327 *table_count = 1;
1328
1329 return STATUS_SUCCESS;
1330 }
1331
1332 static NTSTATUS NTAPI kerberos_SpInstanceInit(ULONG version, SECPKG_DLL_FUNCTIONS *dll_function_table, void **user_functions)
1333 {
1334 FIXME("%u,%p,%p: stub\n", version, dll_function_table, user_functions);
1335
1336 return STATUS_SUCCESS;
1337 }
1338
1339 static NTSTATUS SEC_ENTRY kerberos_SpMakeSignature( LSA_SEC_HANDLE context, ULONG quality_of_protection,
1340 SecBufferDesc *message, ULONG message_seq_no )
1341 {
1342 #ifdef SONAME_LIBGSSAPI_KRB5
1343 OM_uint32 ret, minor_status;
1344 gss_buffer_desc data_buffer, token_buffer;
1345 gss_ctx_id_t ctxt_handle;
1346 int data_idx, token_idx;
1347
1348 TRACE( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no );
1349 if (quality_of_protection) FIXME( "ignoring quality_of_protection 0x%08x\n", quality_of_protection );
1350 if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no );
1351
1352 if (!context) return SEC_E_INVALID_HANDLE;
1353 ctxt_handle = ctxthandle_sspi_to_gss( context );
1354
1355 /* FIXME: multiple data buffers, read-only buffers */
1356 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1357 data_buffer.length = message->pBuffers[data_idx].cbBuffer;
1358 data_buffer.value = message->pBuffers[data_idx].pvBuffer;
1359
1360 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1361 token_buffer.length = 0;
1362 token_buffer.value = NULL;
1363
1364 ret = pgss_get_mic( &minor_status, ctxt_handle, GSS_C_QOP_DEFAULT, &data_buffer, &token_buffer );
1365 TRACE( "gss_get_mic returned %08x minor status %08x\n", ret, minor_status );
1366 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1367 if (ret == GSS_S_COMPLETE)
1368 {
1369 memcpy( message->pBuffers[token_idx].pvBuffer, token_buffer.value, token_buffer.length );
1370 message->pBuffers[token_idx].cbBuffer = token_buffer.length;
1371 pgss_release_buffer( &minor_status, &token_buffer );
1372 }
1373
1374 return status_gss_to_sspi( ret );
1375 #else
1376 FIXME( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no );
1377 return SEC_E_UNSUPPORTED_FUNCTION;
1378 #endif
1379 }
1380
1381 static NTSTATUS NTAPI kerberos_SpVerifySignature( LSA_SEC_HANDLE context, SecBufferDesc *message,
1382 ULONG message_seq_no, ULONG *quality_of_protection )
1383 {
1384 #ifdef SONAME_LIBGSSAPI_KRB5
1385 OM_uint32 ret, minor_status;
1386 gss_buffer_desc data_buffer, token_buffer;
1387 gss_ctx_id_t ctxt_handle;
1388 int data_idx, token_idx;
1389
1390 TRACE( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection );
1391 if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no );
1392
1393 if (!context) return SEC_E_INVALID_HANDLE;
1394 ctxt_handle = ctxthandle_sspi_to_gss( context );
1395
1396 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1397 data_buffer.length = message->pBuffers[data_idx].cbBuffer;
1398 data_buffer.value = message->pBuffers[data_idx].pvBuffer;
1399
1400 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1401 token_buffer.length = message->pBuffers[token_idx].cbBuffer;
1402 token_buffer.value = message->pBuffers[token_idx].pvBuffer;
1403
1404 ret = pgss_verify_mic( &minor_status, ctxt_handle, &data_buffer, &token_buffer, NULL );
1405 TRACE( "gss_verify_mic returned %08x minor status %08x\n", ret, minor_status );
1406 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1407 if (ret == GSS_S_COMPLETE && quality_of_protection) *quality_of_protection = 0;
1408
1409 return status_gss_to_sspi( ret );
1410 #else
1411 FIXME( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection );
1412 return SEC_E_UNSUPPORTED_FUNCTION;
1413 #endif
1414 }
1415
1416 #ifdef SONAME_LIBGSSAPI_KRB5
1417 static NTSTATUS seal_message_iov( gss_ctx_id_t ctxt_handle, SecBufferDesc *message )
1418 {
1419 gss_iov_buffer_desc iov[4];
1420 OM_uint32 ret, minor_status;
1421 int token_idx, data_idx, conf_state;
1422
1423 /* FIXME: multiple data buffers, read-only buffers */
1424 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1425 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1426
1427 iov[0].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY | GSS_IOV_BUFFER_FLAG_ALLOCATE;
1428 iov[0].buffer.length = 0;
1429 iov[0].buffer.value = NULL;
1430
1431 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
1432 iov[1].buffer.length = message->pBuffers[data_idx].cbBuffer;
1433 iov[1].buffer.value = message->pBuffers[data_idx].pvBuffer;
1434
1435 iov[2].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY | GSS_IOV_BUFFER_FLAG_ALLOCATE;
1436 iov[2].buffer.length = 0;
1437 iov[2].buffer.value = NULL;
1438
1439 iov[3].type = GSS_IOV_BUFFER_TYPE_HEADER | GSS_IOV_BUFFER_FLAG_ALLOCATE;
1440 iov[3].buffer.length = 0;
1441 iov[3].buffer.value = NULL;
1442
1443 ret = pgss_wrap_iov( &minor_status, ctxt_handle, 1, GSS_C_QOP_DEFAULT, &conf_state, iov, 4 );
1444 TRACE( "gss_wrap_iov returned %08x minor status %08x\n", ret, minor_status );
1445 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1446 if (ret == GSS_S_COMPLETE)
1447 {
1448 memcpy( message->pBuffers[token_idx].pvBuffer, iov[3].buffer.value, iov[3].buffer.length );
1449 message->pBuffers[token_idx].cbBuffer = iov[3].buffer.length;
1450 pgss_release_iov_buffer( &minor_status, iov, 4 );
1451 }
1452
1453 return status_gss_to_sspi( ret );
1454 }
1455
1456 static NTSTATUS seal_message( gss_ctx_id_t ctxt_handle, SecBufferDesc *message )
1457 {
1458 gss_buffer_desc input, output;
1459 OM_uint32 ret, minor_status;
1460 int token_idx, data_idx, conf_state;
1461
1462 /* FIXME: multiple data buffers, read-only buffers */
1463 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1464 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1465
1466 input.length = message->pBuffers[data_idx].cbBuffer;
1467 input.value = message->pBuffers[data_idx].pvBuffer;
1468
1469 ret = pgss_wrap( &minor_status, ctxt_handle, 1, GSS_C_QOP_DEFAULT, &input, &conf_state, &output );
1470 TRACE( "gss_wrap returned %08x minor status %08x\n", ret, minor_status );
1471 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1472 if (ret == GSS_S_COMPLETE)
1473 {
1474 DWORD len_data = message->pBuffers[data_idx].cbBuffer, len_token = message->pBuffers[token_idx].cbBuffer;
1475 if (len_token < output.length - len_data)
1476 {
1477 TRACE( "buffer too small %lu > %u\n", (SIZE_T)output.length - len_data, len_token );
1478 pgss_release_buffer( &minor_status, &output );
1479 return SEC_E_BUFFER_TOO_SMALL;
1480 }
1481 memcpy( message->pBuffers[data_idx].pvBuffer, output.value, len_data );
1482 memcpy( message->pBuffers[token_idx].pvBuffer, (char *)output.value + len_data, output.length - len_data );
1483 message->pBuffers[token_idx].cbBuffer = output.length - len_data;
1484 pgss_release_buffer( &minor_status, &output );
1485 }
1486
1487 return status_gss_to_sspi( ret );
1488 }
1489 #endif
1490
1491 static NTSTATUS NTAPI kerberos_SpSealMessage( LSA_SEC_HANDLE context, ULONG quality_of_protection,
1492 SecBufferDesc *message, ULONG message_seq_no )
1493 {
1494 #ifdef SONAME_LIBGSSAPI_KRB5
1495 gss_ctx_id_t ctxt_handle;
1496
1497 TRACE( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no );
1498 if (quality_of_protection)
1499 {
1500 FIXME( "flags %08x not supported\n", quality_of_protection );
1501 return SEC_E_UNSUPPORTED_FUNCTION;
1502 }
1503 if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no );
1504
1505 if (!context) return SEC_E_INVALID_HANDLE;
1506 ctxt_handle = ctxthandle_sspi_to_gss( context );
1507
1508 if (is_dce_style_context( ctxt_handle )) return seal_message_iov( ctxt_handle, message );
1509 return seal_message( ctxt_handle, message );
1510 #else
1511 FIXME( "(%lx 0x%08x %p %u)\n", context, quality_of_protection, message, message_seq_no );
1512 return SEC_E_UNSUPPORTED_FUNCTION;
1513 #endif
1514 }
1515
1516 #ifdef SONAME_LIBGSSAPI_KRB5
1517 static NTSTATUS unseal_message_iov( gss_ctx_id_t ctxt_handle, SecBufferDesc *message, ULONG *quality_of_protection )
1518 {
1519 gss_iov_buffer_desc iov[4];
1520 OM_uint32 ret, minor_status;
1521 int token_idx, data_idx, conf_state;
1522
1523 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1524 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1525
1526 iov[0].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
1527 iov[0].buffer.length = 0;
1528 iov[0].buffer.value = NULL;
1529
1530 iov[1].type = GSS_IOV_BUFFER_TYPE_DATA;
1531 iov[1].buffer.length = message->pBuffers[data_idx].cbBuffer;
1532 iov[1].buffer.value = message->pBuffers[data_idx].pvBuffer;
1533
1534 iov[2].type = GSS_IOV_BUFFER_TYPE_SIGN_ONLY;
1535 iov[2].buffer.length = 0;
1536 iov[2].buffer.value = NULL;
1537
1538 iov[3].type = GSS_IOV_BUFFER_TYPE_HEADER;
1539 iov[3].buffer.length = message->pBuffers[token_idx].cbBuffer;
1540 iov[3].buffer.value = message->pBuffers[token_idx].pvBuffer;
1541
1542 ret = pgss_unwrap_iov( &minor_status, ctxt_handle, &conf_state, NULL, iov, 4 );
1543 TRACE( "gss_unwrap_iov returned %08x minor status %08x\n", ret, minor_status );
1544 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1545 if (ret == GSS_S_COMPLETE && quality_of_protection)
1546 {
1547 *quality_of_protection = (conf_state ? 0 : SECQOP_WRAP_NO_ENCRYPT);
1548 }
1549 return status_gss_to_sspi( ret );
1550 }
1551
1552 static NTSTATUS unseal_message( gss_ctx_id_t ctxt_handle, SecBufferDesc *message, ULONG *quality_of_protection )
1553 {
1554 gss_buffer_desc input, output;
1555 OM_uint32 ret, minor_status;
1556 int token_idx, data_idx, conf_state;
1557 DWORD len_data, len_token;
1558
1559 if ((data_idx = get_buffer_index( message, SECBUFFER_DATA )) == -1) return SEC_E_INVALID_TOKEN;
1560 if ((token_idx = get_buffer_index( message, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
1561
1562 len_data = message->pBuffers[data_idx].cbBuffer;
1563 len_token = message->pBuffers[token_idx].cbBuffer;
1564
1565 input.length = len_data + len_token;
1566 if (!(input.value = heap_alloc( input.length ))) return SEC_E_INSUFFICIENT_MEMORY;
1567 memcpy( input.value, message->pBuffers[data_idx].pvBuffer, len_data );
1568 memcpy( (char *)input.value + len_data, message->pBuffers[token_idx].pvBuffer, len_token );
1569
1570 ret = pgss_unwrap( &minor_status, ctxt_handle, &input, &output, &conf_state, NULL );
1571 heap_free( input.value );
1572 TRACE( "gss_unwrap returned %08x minor status %08x\n", ret, minor_status );
1573 if (GSS_ERROR(ret)) trace_gss_status( ret, minor_status );
1574 if (ret == GSS_S_COMPLETE)
1575 {
1576 if (quality_of_protection) *quality_of_protection = (conf_state ? 0 : SECQOP_WRAP_NO_ENCRYPT);
1577 memcpy( message->pBuffers[data_idx].pvBuffer, output.value, len_data );
1578 pgss_release_buffer( &minor_status, &output );
1579 }
1580
1581 return status_gss_to_sspi( ret );
1582 }
1583 #endif
1584
1585 static NTSTATUS NTAPI kerberos_SpUnsealMessage( LSA_SEC_HANDLE context, SecBufferDesc *message,
1586 ULONG message_seq_no, ULONG *quality_of_protection )
1587 {
1588 #ifdef SONAME_LIBGSSAPI_KRB5
1589 gss_ctx_id_t ctxt_handle;
1590
1591 TRACE( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection );
1592 if (message_seq_no) FIXME( "ignoring message_seq_no %u\n", message_seq_no );
1593
1594 if (!context) return SEC_E_INVALID_HANDLE;
1595 ctxt_handle = ctxthandle_sspi_to_gss( context );
1596
1597 if (is_dce_style_context( ctxt_handle )) return unseal_message_iov( ctxt_handle, message, quality_of_protection );
1598 return unseal_message( ctxt_handle, message, quality_of_protection );
1599 #else
1600 FIXME( "(%lx %p %u %p)\n", context, message, message_seq_no, quality_of_protection );
1601 return SEC_E_UNSUPPORTED_FUNCTION;
1602 #endif
1603 }
1604
1605 static SECPKG_USER_FUNCTION_TABLE kerberos_user_table =
1606 {
1607 kerberos_SpInstanceInit,
1608 NULL, /* SpInitUserModeContext */
1609 kerberos_SpMakeSignature,
1610 kerberos_SpVerifySignature,
1611 kerberos_SpSealMessage,
1612 kerberos_SpUnsealMessage,
1613 NULL, /* SpGetContextToken */
1614 NULL, /* SpQueryContextAttributes */
1615 NULL, /* SpCompleteAuthToken */
1616 NULL, /* SpDeleteContext */
1617 NULL, /* SpFormatCredentialsFn */
1618 NULL, /* SpMarshallSupplementalCreds */
1619 NULL, /* SpExportSecurityContext */
1620 NULL /* SpImportSecurityContext */
1621 };
1622
1623 NTSTATUS NTAPI SpUserModeInitialize(ULONG lsa_version, PULONG package_version,
1624 PSECPKG_USER_FUNCTION_TABLE *table, PULONG table_count)
1625 {
1626 TRACE("%#x,%p,%p,%p\n", lsa_version, package_version, table, table_count);
1627
1628 *package_version = SECPKG_INTERFACE_VERSION;
1629 *table = &kerberos_user_table;
1630 *table_count = 1;
1631
1632 return STATUS_SUCCESS;
1633 }
Windows API implementation