2 * Unix interface for libkrb5/libgssapi_krb5
4 * Copyright 2017 Dmitry Timoshkov
5 * Copyright 2017 George Popoff
6 * Copyright 2008 Robert Shearman for CodeWeavers
7 * Copyright 2017,2021 Hans Leidekker for CodeWeavers
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
30 #if defined(SONAME_LIBKRB5) && defined(SONAME_LIBGSSAPI_KRB5)
33 #include <sys/types.h>
36 #ifdef HAVE_KRB5_KRB5_H
37 # include <krb5/krb5.h>
39 #ifdef HAVE_GSSAPI_GSSAPI_H
40 # include <gssapi/gssapi.h>
42 #ifdef HAVE_GSSAPI_GSSAPI_EXT_H
43 # include <gssapi/gssapi_ext.h>
47 #define WIN32_NO_STATUS
56 #include "wine/debug.h"
59 WINE_DEFAULT_DEBUG_CHANNEL(kerberos
);
60 WINE_DECLARE_DEBUG_CHANNEL(winediag
);
62 static void *libkrb5_handle
;
64 #define MAKE_FUNCPTR(f) static typeof(f) * p_##f
65 MAKE_FUNCPTR( krb5_cc_close
);
66 MAKE_FUNCPTR( krb5_cc_default
);
67 MAKE_FUNCPTR( krb5_cc_end_seq_get
);
68 MAKE_FUNCPTR( krb5_cc_initialize
);
69 MAKE_FUNCPTR( krb5_cc_next_cred
);
70 MAKE_FUNCPTR( krb5_cc_start_seq_get
);
71 MAKE_FUNCPTR( krb5_cc_store_cred
);
72 MAKE_FUNCPTR( krb5_cccol_cursor_free
);
73 MAKE_FUNCPTR( krb5_cccol_cursor_new
);
74 MAKE_FUNCPTR( krb5_cccol_cursor_next
);
75 MAKE_FUNCPTR( krb5_decode_ticket
);
76 MAKE_FUNCPTR( krb5_free_context
);
77 MAKE_FUNCPTR( krb5_free_cred_contents
);
78 MAKE_FUNCPTR( krb5_free_principal
);
79 MAKE_FUNCPTR( krb5_free_ticket
);
80 MAKE_FUNCPTR( krb5_free_unparsed_name
);
81 MAKE_FUNCPTR( krb5_get_init_creds_opt_alloc
);
82 MAKE_FUNCPTR( krb5_get_init_creds_opt_free
);
83 MAKE_FUNCPTR( krb5_get_init_creds_opt_set_out_ccache
);
84 MAKE_FUNCPTR( krb5_get_init_creds_password
);
85 MAKE_FUNCPTR( krb5_init_context
);
86 MAKE_FUNCPTR( krb5_is_config_principal
);
87 MAKE_FUNCPTR( krb5_parse_name_flags
);
88 MAKE_FUNCPTR( krb5_unparse_name_flags
);
91 static BOOL
load_krb5(void)
93 if (!(libkrb5_handle
= dlopen( SONAME_LIBKRB5
, RTLD_NOW
)))
95 WARN_(winediag
)( "failed to load %s, Kerberos support will be disabled\n", SONAME_LIBKRB5
);
99 #define LOAD_FUNCPTR(f) \
100 if (!(p_##f = dlsym( libkrb5_handle, #f ))) \
102 ERR( "failed to load %s\n", #f ); \
106 LOAD_FUNCPTR( krb5_cc_close
)
107 LOAD_FUNCPTR( krb5_cc_default
)
108 LOAD_FUNCPTR( krb5_cc_end_seq_get
)
109 LOAD_FUNCPTR( krb5_cc_initialize
)
110 LOAD_FUNCPTR( krb5_cc_next_cred
)
111 LOAD_FUNCPTR( krb5_cc_start_seq_get
)
112 LOAD_FUNCPTR( krb5_cc_store_cred
)
113 LOAD_FUNCPTR( krb5_cccol_cursor_free
)
114 LOAD_FUNCPTR( krb5_cccol_cursor_new
)
115 LOAD_FUNCPTR( krb5_cccol_cursor_next
)
116 LOAD_FUNCPTR( krb5_decode_ticket
)
117 LOAD_FUNCPTR( krb5_free_context
)
118 LOAD_FUNCPTR( krb5_free_cred_contents
)
119 LOAD_FUNCPTR( krb5_free_principal
)
120 LOAD_FUNCPTR( krb5_free_ticket
)
121 LOAD_FUNCPTR( krb5_free_unparsed_name
)
122 LOAD_FUNCPTR( krb5_get_init_creds_opt_alloc
)
123 LOAD_FUNCPTR( krb5_get_init_creds_opt_free
)
124 LOAD_FUNCPTR( krb5_get_init_creds_opt_set_out_ccache
)
125 LOAD_FUNCPTR( krb5_get_init_creds_password
)
126 LOAD_FUNCPTR( krb5_init_context
)
127 LOAD_FUNCPTR( krb5_is_config_principal
)
128 LOAD_FUNCPTR( krb5_parse_name_flags
)
129 LOAD_FUNCPTR( krb5_unparse_name_flags
)
134 dlclose( libkrb5_handle
);
135 libkrb5_handle
= NULL
;
139 static void unload_krb5(void)
141 dlclose( libkrb5_handle
);
142 libkrb5_handle
= NULL
;
145 static NTSTATUS
krb5_error_to_status( krb5_error_code err
)
149 case 0: return STATUS_SUCCESS
;
150 default: return STATUS_UNSUCCESSFUL
; /* FIXME */
158 KERB_TICKET_CACHE_INFO
*tickets
;
161 static void utf8_to_wstr( UNICODE_STRING
*strW
, const char *src
)
163 ULONG dstlen
, srclen
= strlen( src
) + 1;
165 strW
->Buffer
= malloc( srclen
* sizeof(WCHAR
) );
166 RtlUTF8ToUnicodeN( strW
->Buffer
, srclen
* sizeof(WCHAR
), &dstlen
, src
, srclen
);
167 strW
->MaximumLength
= dstlen
;
168 strW
->Length
= dstlen
- sizeof(WCHAR
);
171 static NTSTATUS
copy_tickets_from_cache( krb5_context ctx
, krb5_ccache cache
, struct ticket_list
*list
)
174 krb5_cc_cursor cursor
;
178 char *name_with_realm
, *name_without_realm
, *realm_name
;
180 if ((err
= p_krb5_cc_start_seq_get( ctx
, cache
, &cursor
))) return krb5_error_to_status( err
);
183 if ((err
= p_krb5_cc_next_cred( ctx
, cache
, &cursor
, &creds
)))
185 if (err
== KRB5_CC_END
)
186 status
= STATUS_SUCCESS
;
188 status
= krb5_error_to_status( err
);
192 if (p_krb5_is_config_principal( ctx
, creds
.server
))
194 p_krb5_free_cred_contents( ctx
, &creds
);
198 if (list
->count
== list
->allocated
)
200 ULONG new_allocated
= max( 16, list
->allocated
* 2 );
201 KERB_TICKET_CACHE_INFO
*new_tickets
= realloc( list
->tickets
, sizeof(*new_tickets
) * new_allocated
);
204 p_krb5_free_cred_contents( ctx
, &creds
);
205 status
= STATUS_NO_MEMORY
;
208 list
->tickets
= new_tickets
;
209 list
->allocated
= new_allocated
;
212 if ((err
= p_krb5_unparse_name_flags( ctx
, creds
.server
, 0, &name_with_realm
)))
214 p_krb5_free_cred_contents( ctx
, &creds
);
215 status
= krb5_error_to_status( err
);
218 TRACE( "name_with_realm: %s\n", debugstr_a(name_with_realm
) );
220 if ((err
= p_krb5_unparse_name_flags( ctx
, creds
.server
, KRB5_PRINCIPAL_UNPARSE_NO_REALM
,
221 &name_without_realm
)))
223 p_krb5_free_unparsed_name( ctx
, name_with_realm
);
224 p_krb5_free_cred_contents( ctx
, &creds
);
225 status
= krb5_error_to_status( err
);
228 TRACE( "name_without_realm: %s\n", debugstr_a(name_without_realm
) );
230 utf8_to_wstr( &list
->tickets
[list
->count
].ServerName
, name_without_realm
);
232 if (!(realm_name
= strchr( name_with_realm
, '@' )))
234 ERR( "wrong name with realm %s\n", debugstr_a(name_with_realm
) );
235 realm_name
= name_with_realm
;
239 /* realm_name - now contains only realm! */
240 utf8_to_wstr( &list
->tickets
[list
->count
].RealmName
, realm_name
);
242 if (!creds
.times
.starttime
) creds
.times
.starttime
= creds
.times
.authtime
;
244 /* TODO: if krb5_is_config_principal = true */
246 /* note: store times as seconds, they will be converted to NT timestamps on the PE side */
247 list
->tickets
[list
->count
].StartTime
.QuadPart
= creds
.times
.starttime
;
248 list
->tickets
[list
->count
].EndTime
.QuadPart
= creds
.times
.endtime
;
249 list
->tickets
[list
->count
].RenewTime
.QuadPart
= creds
.times
.renew_till
;
250 list
->tickets
[list
->count
].TicketFlags
= creds
.ticket_flags
;
252 err
= p_krb5_decode_ticket( &creds
.ticket
, &ticket
);
253 p_krb5_free_unparsed_name( ctx
, name_with_realm
);
254 p_krb5_free_unparsed_name( ctx
, name_without_realm
);
255 p_krb5_free_cred_contents( ctx
, &creds
);
258 status
= krb5_error_to_status( err
);
262 list
->tickets
[list
->count
].EncryptionType
= ticket
->enc_part
.enctype
;
263 p_krb5_free_ticket( ctx
, ticket
);
267 p_krb5_cc_end_seq_get( ctx
, cache
, &cursor
);
271 static NTSTATUS
copy_tickets_to_client( struct ticket_list
*list
, KERB_QUERY_TKT_CACHE_RESPONSE
*resp
,
275 ULONG i
, size
= offsetof( KERB_QUERY_TKT_CACHE_RESPONSE
, Tickets
[list
->count
] );
277 for (i
= 0; i
< list
->count
; i
++)
279 size
+= list
->tickets
[i
].RealmName
.MaximumLength
;
280 size
+= list
->tickets
[i
].ServerName
.MaximumLength
;
282 if (!resp
|| size
> *out_size
)
285 return STATUS_BUFFER_TOO_SMALL
;
289 resp
->MessageType
= KerbQueryTicketCacheMessage
;
290 resp
->CountOfTickets
= list
->count
;
291 memcpy( resp
->Tickets
, list
->tickets
, list
->count
* sizeof(list
->tickets
[0]) );
292 client_str
= (char *)&resp
->Tickets
[list
->count
];
294 for (i
= 0; i
< list
->count
; i
++)
296 resp
->Tickets
[i
].RealmName
.Buffer
= (WCHAR
*)client_str
;
297 memcpy( client_str
, list
->tickets
[i
].RealmName
.Buffer
, list
->tickets
[i
].RealmName
.MaximumLength
);
298 client_str
+= list
->tickets
[i
].RealmName
.MaximumLength
;
299 resp
->Tickets
[i
].ServerName
.Buffer
= (WCHAR
*)client_str
;
300 memcpy( client_str
, list
->tickets
[i
].ServerName
.Buffer
, list
->tickets
[i
].ServerName
.MaximumLength
);
301 client_str
+= list
->tickets
[i
].ServerName
.MaximumLength
;
303 return STATUS_SUCCESS
;
306 static NTSTATUS
query_ticket_cache( void *args
)
308 struct query_ticket_cache_params
*params
= args
;
312 krb5_cccol_cursor cursor
= NULL
;
315 struct ticket_list list
= { 0 };
317 if ((err
= p_krb5_init_context( &ctx
))) return krb5_error_to_status( err
);
318 if ((err
= p_krb5_cccol_cursor_new( ctx
, &cursor
)))
320 status
= krb5_error_to_status( err
);
326 if ((err
= p_krb5_cccol_cursor_next( ctx
, cursor
, &cache
)))
328 status
= krb5_error_to_status( err
);
333 status
= copy_tickets_from_cache( ctx
, cache
, &list
);
334 p_krb5_cc_close( ctx
, cache
);
335 if (status
!= STATUS_SUCCESS
) goto done
;
339 if (cursor
) p_krb5_cccol_cursor_free( ctx
, &cursor
);
340 if (ctx
) p_krb5_free_context( ctx
);
342 if (status
== STATUS_SUCCESS
) status
= copy_tickets_to_client( &list
, params
->resp
, params
->out_size
);
344 for (i
= 0; i
< list
.count
; i
++)
346 free( list
.tickets
[i
].RealmName
.Buffer
);
347 free( list
.tickets
[i
].ServerName
.Buffer
);
352 static void *libgssapi_krb5_handle
;
354 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
355 MAKE_FUNCPTR( gss_accept_sec_context
);
356 MAKE_FUNCPTR( gss_acquire_cred
);
357 MAKE_FUNCPTR( gss_delete_sec_context
);
358 MAKE_FUNCPTR( gss_display_status
);
359 MAKE_FUNCPTR( gss_get_mic
);
360 MAKE_FUNCPTR( gss_import_name
);
361 MAKE_FUNCPTR( gss_init_sec_context
);
362 MAKE_FUNCPTR( gss_inquire_context
);
363 MAKE_FUNCPTR( gss_release_buffer
);
364 MAKE_FUNCPTR( gss_release_cred
);
365 MAKE_FUNCPTR( gss_release_iov_buffer
);
366 MAKE_FUNCPTR( gss_release_name
);
367 MAKE_FUNCPTR( gss_unwrap
);
368 MAKE_FUNCPTR( gss_unwrap_iov
);
369 MAKE_FUNCPTR( gss_verify_mic
);
370 MAKE_FUNCPTR( gss_wrap
);
371 MAKE_FUNCPTR( gss_wrap_iov
);
374 static BOOL
load_gssapi_krb5(void)
376 if (!(libgssapi_krb5_handle
= dlopen( SONAME_LIBGSSAPI_KRB5
, RTLD_NOW
)))
378 WARN_(winediag
)( "failed to load %s, Kerberos support will be disabled\n", SONAME_LIBGSSAPI_KRB5
);
382 #define LOAD_FUNCPTR(f) \
383 if (!(p##f = dlsym( libgssapi_krb5_handle, #f ))) \
385 ERR( "failed to load %s\n", #f ); \
389 LOAD_FUNCPTR( gss_accept_sec_context
)
390 LOAD_FUNCPTR( gss_acquire_cred
)
391 LOAD_FUNCPTR( gss_delete_sec_context
)
392 LOAD_FUNCPTR( gss_display_status
)
393 LOAD_FUNCPTR( gss_get_mic
)
394 LOAD_FUNCPTR( gss_import_name
)
395 LOAD_FUNCPTR( gss_init_sec_context
)
396 LOAD_FUNCPTR( gss_inquire_context
)
397 LOAD_FUNCPTR( gss_release_buffer
)
398 LOAD_FUNCPTR( gss_release_cred
)
399 LOAD_FUNCPTR( gss_release_iov_buffer
)
400 LOAD_FUNCPTR( gss_release_name
)
401 LOAD_FUNCPTR( gss_unwrap
)
402 LOAD_FUNCPTR( gss_unwrap_iov
)
403 LOAD_FUNCPTR( gss_verify_mic
)
404 LOAD_FUNCPTR( gss_wrap
)
405 LOAD_FUNCPTR( gss_wrap_iov
)
410 dlclose( libgssapi_krb5_handle
);
411 libgssapi_krb5_handle
= NULL
;
415 static BOOL
is_dce_style_context( gss_ctx_id_t ctx
)
417 OM_uint32 ret
, minor_status
, flags
;
418 ret
= pgss_inquire_context( &minor_status
, ctx
, NULL
, NULL
, NULL
, NULL
, &flags
, NULL
, NULL
);
419 return (ret
== GSS_S_COMPLETE
&& (flags
& GSS_C_DCE_STYLE
));
422 static int get_buffer_index( SecBufferDesc
*desc
, DWORD type
)
425 if (!desc
) return -1;
426 for (i
= 0; i
< desc
->cBuffers
; i
++)
428 if (desc
->pBuffers
[i
].BufferType
== type
) return i
;
433 static NTSTATUS
status_gss_to_sspi( OM_uint32 status
)
437 case GSS_S_COMPLETE
: return SEC_E_OK
;
438 case GSS_S_BAD_MECH
: return SEC_E_SECPKG_NOT_FOUND
;
439 case GSS_S_BAD_SIG
: return SEC_E_MESSAGE_ALTERED
;
440 case GSS_S_NO_CRED
: return SEC_E_NO_CREDENTIALS
;
441 case GSS_S_NO_CONTEXT
: return SEC_E_INVALID_HANDLE
;
442 case GSS_S_DEFECTIVE_TOKEN
: return SEC_E_INVALID_TOKEN
;
443 case GSS_S_DEFECTIVE_CREDENTIAL
: return SEC_E_NO_CREDENTIALS
;
444 case GSS_S_CREDENTIALS_EXPIRED
: return SEC_E_CONTEXT_EXPIRED
;
445 case GSS_S_CONTEXT_EXPIRED
: return SEC_E_CONTEXT_EXPIRED
;
446 case GSS_S_BAD_QOP
: return SEC_E_QOP_NOT_SUPPORTED
;
447 case GSS_S_CONTINUE_NEEDED
: return SEC_I_CONTINUE_NEEDED
;
448 case GSS_S_DUPLICATE_TOKEN
: return SEC_E_INVALID_TOKEN
;
449 case GSS_S_OLD_TOKEN
: return SEC_E_INVALID_TOKEN
;
450 case GSS_S_UNSEQ_TOKEN
: return SEC_E_OUT_OF_SEQUENCE
;
451 case GSS_S_GAP_TOKEN
: return SEC_E_OUT_OF_SEQUENCE
;
452 case GSS_S_FAILURE
: return SEC_E_INTERNAL_ERROR
;
455 FIXME( "couldn't convert status 0x%08x to NTSTATUS\n", status
);
456 return SEC_E_INTERNAL_ERROR
;
460 static void trace_gss_status_ex( OM_uint32 code
, int type
)
462 OM_uint32 ret
, minor_status
;
464 OM_uint32 msg_ctx
= 0;
468 ret
= pgss_display_status( &minor_status
, code
, type
, GSS_C_NULL_OID
, &msg_ctx
, &buf
);
469 if (GSS_ERROR( ret
))
471 TRACE( "gss_display_status(0x%08x,%d) returned %08x minor status %08x\n", code
, type
, ret
, minor_status
);
474 TRACE( "GSS-API error: 0x%08x: %s\n", code
, debugstr_an(buf
.value
, buf
.length
) );
475 pgss_release_buffer( &minor_status
, &buf
);
476 if (!msg_ctx
) return;
480 static void trace_gss_status( OM_uint32 major_status
, OM_uint32 minor_status
)
482 if (TRACE_ON(kerberos
))
484 trace_gss_status_ex( major_status
, GSS_C_GSS_CODE
);
485 trace_gss_status_ex( minor_status
, GSS_C_MECH_CODE
);
489 static inline gss_ctx_id_t
ctxhandle_sspi_to_gss( LSA_SEC_HANDLE handle
)
491 return (gss_ctx_id_t
)handle
;
494 static inline gss_cred_id_t
credhandle_sspi_to_gss( LSA_SEC_HANDLE handle
)
496 return (gss_cred_id_t
)handle
;
499 static inline void ctxhandle_gss_to_sspi( gss_ctx_id_t handle
, LSA_SEC_HANDLE
*ctx
)
501 *ctx
= (LSA_SEC_HANDLE
)handle
;
504 static inline void credhandle_gss_to_sspi( gss_cred_id_t handle
, LSA_SEC_HANDLE
*cred
)
506 *cred
= (LSA_SEC_HANDLE
)handle
;
509 static ULONG
flags_gss_to_asc_ret( ULONG flags
)
512 if (flags
& GSS_C_DELEG_FLAG
) ret
|= ASC_RET_DELEGATE
;
513 if (flags
& GSS_C_MUTUAL_FLAG
) ret
|= ASC_RET_MUTUAL_AUTH
;
514 if (flags
& GSS_C_REPLAY_FLAG
) ret
|= ASC_RET_REPLAY_DETECT
;
515 if (flags
& GSS_C_SEQUENCE_FLAG
) ret
|= ASC_RET_SEQUENCE_DETECT
;
516 if (flags
& GSS_C_CONF_FLAG
) ret
|= ASC_RET_CONFIDENTIALITY
;
517 if (flags
& GSS_C_INTEG_FLAG
) ret
|= ASC_RET_INTEGRITY
;
518 if (flags
& GSS_C_ANON_FLAG
) ret
|= ASC_RET_NULL_SESSION
;
519 if (flags
& GSS_C_DCE_STYLE
) ret
|= ASC_RET_USED_DCE_STYLE
;
520 if (flags
& GSS_C_IDENTIFY_FLAG
) ret
|= ASC_RET_IDENTIFY
;
524 static NTSTATUS
accept_context( void *args
)
526 struct accept_context_params
*params
= args
;
527 OM_uint32 ret
, minor_status
, ret_flags
= 0, expiry_time
;
528 gss_cred_id_t cred_handle
= credhandle_sspi_to_gss( params
->credential
);
529 gss_ctx_id_t ctx_handle
= ctxhandle_sspi_to_gss( params
->context
);
530 gss_buffer_desc input_token
, output_token
;
533 if (!params
->input
) input_token
.length
= 0;
536 if ((idx
= get_buffer_index( params
->input
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
537 input_token
.length
= params
->input
->pBuffers
[idx
].cbBuffer
;
538 input_token
.value
= params
->input
->pBuffers
[idx
].pvBuffer
;
541 if ((idx
= get_buffer_index( params
->output
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
542 output_token
.length
= 0;
543 output_token
.value
= NULL
;
545 ret
= pgss_accept_sec_context( &minor_status
, &ctx_handle
, cred_handle
, &input_token
, GSS_C_NO_CHANNEL_BINDINGS
,
546 NULL
, NULL
, &output_token
, &ret_flags
, &expiry_time
, NULL
);
547 TRACE( "gss_accept_sec_context returned %08x minor status %08x ret_flags %08x\n", ret
, minor_status
, ret_flags
);
548 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
549 if (ret
== GSS_S_COMPLETE
|| ret
== GSS_S_CONTINUE_NEEDED
)
551 if (output_token
.length
> params
->output
->pBuffers
[idx
].cbBuffer
) /* FIXME: check if larger buffer exists */
553 TRACE( "buffer too small %lu > %u\n", (SIZE_T
)output_token
.length
, params
->output
->pBuffers
[idx
].cbBuffer
);
554 pgss_release_buffer( &minor_status
, &output_token
);
555 pgss_delete_sec_context( &minor_status
, &ctx_handle
, GSS_C_NO_BUFFER
);
556 return SEC_E_BUFFER_TOO_SMALL
;
558 params
->output
->pBuffers
[idx
].cbBuffer
= output_token
.length
;
559 memcpy( params
->output
->pBuffers
[idx
].pvBuffer
, output_token
.value
, output_token
.length
);
560 pgss_release_buffer( &minor_status
, &output_token
);
562 ctxhandle_gss_to_sspi( ctx_handle
, params
->new_context
);
563 if (params
->context_attr
) *params
->context_attr
= flags_gss_to_asc_ret( ret_flags
);
564 *params
->expiry
= expiry_time
;
567 return status_gss_to_sspi( ret
);
570 static NTSTATUS
init_creds( const char *user_at_domain
, const char *password
)
573 krb5_principal principal
= NULL
;
574 krb5_get_init_creds_opt
*options
= NULL
;
575 krb5_ccache cache
= NULL
;
579 if (!user_at_domain
) return STATUS_SUCCESS
;
580 if ((err
= p_krb5_init_context( &ctx
))) return krb5_error_to_status( err
);
581 if ((err
= p_krb5_parse_name_flags( ctx
, user_at_domain
, 0, &principal
))) goto done
;
582 if ((err
= p_krb5_cc_default( ctx
, &cache
))) goto done
;
583 if ((err
= p_krb5_get_init_creds_opt_alloc( ctx
, &options
))) goto done
;
584 if ((err
= p_krb5_get_init_creds_opt_set_out_ccache( ctx
, options
, cache
))) goto done
;
585 if ((err
= p_krb5_get_init_creds_password( ctx
, &creds
, principal
, password
, 0, NULL
, 0, NULL
, 0 ))) goto done
;
586 if ((err
= p_krb5_cc_initialize( ctx
, cache
, principal
))) goto done
;
587 if ((err
= p_krb5_cc_store_cred( ctx
, cache
, &creds
))) goto done
;
589 TRACE( "success\n" );
590 p_krb5_free_cred_contents( ctx
, &creds
);
593 if (cache
) p_krb5_cc_close( ctx
, cache
);
594 if (principal
) p_krb5_free_principal( ctx
, principal
);
595 if (options
) p_krb5_get_init_creds_opt_free( ctx
, options
);
596 p_krb5_free_context( ctx
);
597 return krb5_error_to_status( err
);
600 static NTSTATUS
import_name( const char *src
, gss_name_t
*dst
)
602 OM_uint32 ret
, minor_status
;
605 buf
.length
= strlen( src
);
606 buf
.value
= (void *)src
;
607 ret
= pgss_import_name( &minor_status
, &buf
, GSS_C_NO_OID
, dst
);
608 TRACE( "gss_import_name returned %08x minor status %08x\n", ret
, minor_status
);
609 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
610 return status_gss_to_sspi( ret
);
613 static NTSTATUS
acquire_credentials_handle( void *args
)
615 struct acquire_credentials_handle_params
*params
= args
;
616 OM_uint32 ret
, minor_status
, expiry_time
;
617 gss_name_t name
= GSS_C_NO_NAME
;
618 gss_cred_usage_t cred_usage
;
619 gss_cred_id_t cred_handle
;
622 switch (params
->credential_use
)
624 case SECPKG_CRED_INBOUND
:
625 cred_usage
= GSS_C_ACCEPT
;
628 case SECPKG_CRED_OUTBOUND
:
629 if ((status
= init_creds( params
->username
, params
->password
)) != STATUS_SUCCESS
) return status
;
630 cred_usage
= GSS_C_INITIATE
;
634 FIXME( "SECPKG_CRED_BOTH not supported\n" );
635 return SEC_E_UNKNOWN_CREDENTIALS
;
638 if (params
->principal
&& (status
= import_name( params
->principal
, &name
))) return status
;
640 ret
= pgss_acquire_cred( &minor_status
, name
, GSS_C_INDEFINITE
, GSS_C_NULL_OID_SET
, cred_usage
, &cred_handle
,
641 NULL
, &expiry_time
);
642 TRACE( "gss_acquire_cred returned %08x minor status %08x\n", ret
, minor_status
);
643 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
644 if (ret
== GSS_S_COMPLETE
)
646 credhandle_gss_to_sspi( cred_handle
, params
->credential
);
647 *params
->expiry
= expiry_time
;
650 if (name
!= GSS_C_NO_NAME
) pgss_release_name( &minor_status
, &name
);
651 return status_gss_to_sspi( ret
);
654 static NTSTATUS
delete_context( void *args
)
656 OM_uint32 ret
, minor_status
;
657 gss_ctx_id_t ctx_handle
= ctxhandle_sspi_to_gss( (LSA_SEC_HANDLE
)args
);
659 ret
= pgss_delete_sec_context( &minor_status
, &ctx_handle
, GSS_C_NO_BUFFER
);
660 TRACE( "gss_delete_sec_context returned %08x minor status %08x\n", ret
, minor_status
);
661 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
662 return status_gss_to_sspi( ret
);
665 static NTSTATUS
free_credentials_handle( void *args
)
667 OM_uint32 ret
, minor_status
;
668 gss_cred_id_t cred
= credhandle_sspi_to_gss( (LSA_SEC_HANDLE
)args
);
670 ret
= pgss_release_cred( &minor_status
, &cred
);
671 TRACE( "gss_release_cred returned %08x minor status %08x\n", ret
, minor_status
);
672 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
673 return status_gss_to_sspi( ret
);
676 static ULONG
flags_isc_req_to_gss( ULONG flags
)
679 if (flags
& ISC_REQ_DELEGATE
) ret
|= GSS_C_DELEG_FLAG
;
680 if (flags
& ISC_REQ_MUTUAL_AUTH
) ret
|= GSS_C_MUTUAL_FLAG
;
681 if (flags
& ISC_REQ_REPLAY_DETECT
) ret
|= GSS_C_REPLAY_FLAG
;
682 if (flags
& ISC_REQ_SEQUENCE_DETECT
) ret
|= GSS_C_SEQUENCE_FLAG
;
683 if (flags
& ISC_REQ_CONFIDENTIALITY
) ret
|= GSS_C_CONF_FLAG
;
684 if (flags
& ISC_REQ_INTEGRITY
) ret
|= GSS_C_INTEG_FLAG
;
685 if (flags
& ISC_REQ_NULL_SESSION
) ret
|= GSS_C_ANON_FLAG
;
686 if (flags
& ISC_REQ_USE_DCE_STYLE
) ret
|= GSS_C_DCE_STYLE
;
687 if (flags
& ISC_REQ_IDENTIFY
) ret
|= GSS_C_IDENTIFY_FLAG
;
691 static ULONG
flags_gss_to_isc_ret( ULONG flags
)
694 if (flags
& GSS_C_DELEG_FLAG
) ret
|= ISC_RET_DELEGATE
;
695 if (flags
& GSS_C_MUTUAL_FLAG
) ret
|= ISC_RET_MUTUAL_AUTH
;
696 if (flags
& GSS_C_REPLAY_FLAG
) ret
|= ISC_RET_REPLAY_DETECT
;
697 if (flags
& GSS_C_SEQUENCE_FLAG
) ret
|= ISC_RET_SEQUENCE_DETECT
;
698 if (flags
& GSS_C_CONF_FLAG
) ret
|= ISC_RET_CONFIDENTIALITY
;
699 if (flags
& GSS_C_INTEG_FLAG
) ret
|= ISC_RET_INTEGRITY
;
700 if (flags
& GSS_C_ANON_FLAG
) ret
|= ISC_RET_NULL_SESSION
;
701 if (flags
& GSS_C_DCE_STYLE
) ret
|= ISC_RET_USED_DCE_STYLE
;
702 if (flags
& GSS_C_IDENTIFY_FLAG
) ret
|= ISC_RET_IDENTIFY
;
706 static NTSTATUS
initialize_context( void *args
)
708 struct initialize_context_params
*params
= args
;
709 OM_uint32 ret
, minor_status
, ret_flags
= 0, expiry_time
, req_flags
= flags_isc_req_to_gss( params
->context_req
);
710 gss_cred_id_t cred_handle
= credhandle_sspi_to_gss( params
->credential
);
711 gss_ctx_id_t ctx_handle
= ctxhandle_sspi_to_gss( params
->context
);
712 gss_buffer_desc input_token
, output_token
;
713 gss_name_t target
= GSS_C_NO_NAME
;
717 if ((idx
= get_buffer_index( params
->input
, SECBUFFER_TOKEN
)) == -1) input_token
.length
= 0;
720 input_token
.length
= params
->input
->pBuffers
[idx
].cbBuffer
;
721 input_token
.value
= params
->input
->pBuffers
[idx
].pvBuffer
;
724 if ((idx
= get_buffer_index( params
->output
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
725 output_token
.length
= 0;
726 output_token
.value
= NULL
;
728 if (params
->target_name
&& (status
= import_name( params
->target_name
, &target
))) return status
;
730 ret
= pgss_init_sec_context( &minor_status
, cred_handle
, &ctx_handle
, target
, GSS_C_NO_OID
, req_flags
, 0,
731 GSS_C_NO_CHANNEL_BINDINGS
, &input_token
, NULL
, &output_token
, &ret_flags
,
733 TRACE( "gss_init_sec_context returned %08x minor status %08x ret_flags %08x\n", ret
, minor_status
, ret_flags
);
734 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
735 if (ret
== GSS_S_COMPLETE
|| ret
== GSS_S_CONTINUE_NEEDED
)
737 if (output_token
.length
> params
->output
->pBuffers
[idx
].cbBuffer
) /* FIXME: check if larger buffer exists */
739 TRACE( "buffer too small %lu > %u\n", (SIZE_T
)output_token
.length
, params
->output
->pBuffers
[idx
].cbBuffer
);
740 pgss_release_buffer( &minor_status
, &output_token
);
741 pgss_delete_sec_context( &minor_status
, &ctx_handle
, GSS_C_NO_BUFFER
);
742 return SEC_E_INCOMPLETE_MESSAGE
;
744 params
->output
->pBuffers
[idx
].cbBuffer
= output_token
.length
;
745 memcpy( params
->output
->pBuffers
[idx
].pvBuffer
, output_token
.value
, output_token
.length
);
746 pgss_release_buffer( &minor_status
, &output_token
);
748 ctxhandle_gss_to_sspi( ctx_handle
, params
->new_context
);
749 if (params
->context_attr
) *params
->context_attr
= flags_gss_to_isc_ret( ret_flags
);
750 *params
->expiry
= expiry_time
;
753 if (target
!= GSS_C_NO_NAME
) pgss_release_name( &minor_status
, &target
);
754 return status_gss_to_sspi( ret
);
757 static NTSTATUS
make_signature( void *args
)
759 struct make_signature_params
*params
= args
;
760 SecBufferDesc
*msg
= params
->msg
;
761 OM_uint32 ret
, minor_status
;
762 gss_buffer_desc data_buffer
, token_buffer
;
763 gss_ctx_id_t ctx_handle
= ctxhandle_sspi_to_gss( params
->context
);
764 int data_idx
, token_idx
;
766 /* FIXME: multiple data buffers, read-only buffers */
767 if ((data_idx
= get_buffer_index( msg
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
768 data_buffer
.length
= msg
->pBuffers
[data_idx
].cbBuffer
;
769 data_buffer
.value
= msg
->pBuffers
[data_idx
].pvBuffer
;
771 if ((token_idx
= get_buffer_index( msg
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
772 token_buffer
.length
= 0;
773 token_buffer
.value
= NULL
;
775 ret
= pgss_get_mic( &minor_status
, ctx_handle
, GSS_C_QOP_DEFAULT
, &data_buffer
, &token_buffer
);
776 TRACE( "gss_get_mic returned %08x minor status %08x\n", ret
, minor_status
);
777 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
778 if (ret
== GSS_S_COMPLETE
)
780 memcpy( msg
->pBuffers
[token_idx
].pvBuffer
, token_buffer
.value
, token_buffer
.length
);
781 msg
->pBuffers
[token_idx
].cbBuffer
= token_buffer
.length
;
782 pgss_release_buffer( &minor_status
, &token_buffer
);
785 return status_gss_to_sspi( ret
);
788 #define KERBEROS_MAX_SIGNATURE 37
789 #define KERBEROS_SECURITY_TRAILER 49
790 #define KERBEROS_MAX_SIGNATURE_DCE 28
791 #define KERBEROS_SECURITY_TRAILER_DCE 76
793 static NTSTATUS
query_context_attributes( void *args
)
795 struct query_context_attributes_params
*params
= args
;
796 switch (params
->attr
)
798 case SECPKG_ATTR_SIZES
:
800 SecPkgContext_Sizes
*sizes
= (SecPkgContext_Sizes
*)params
->buf
;
801 ULONG size_max_signature
, size_security_trailer
;
802 gss_ctx_id_t ctx
= ctxhandle_sspi_to_gss( params
->context
);
804 if (is_dce_style_context( ctx
))
806 size_max_signature
= KERBEROS_MAX_SIGNATURE_DCE
;
807 size_security_trailer
= KERBEROS_SECURITY_TRAILER_DCE
;
811 size_max_signature
= KERBEROS_MAX_SIGNATURE
;
812 size_security_trailer
= KERBEROS_SECURITY_TRAILER
;
814 sizes
->cbMaxToken
= KERBEROS_MAX_BUF
;
815 sizes
->cbMaxSignature
= size_max_signature
;
816 sizes
->cbBlockSize
= 1;
817 sizes
->cbSecurityTrailer
= size_security_trailer
;
821 FIXME( "unhandled attribute %u\n", params
->attr
);
825 return SEC_E_UNSUPPORTED_FUNCTION
;
828 static NTSTATUS
seal_message_vector( gss_ctx_id_t ctx
, SecBufferDesc
*msg
, ULONG qop
)
830 gss_iov_buffer_desc iov
[4];
831 OM_uint32 ret
, minor_status
;
832 int token_idx
, data_idx
, conf_flag
, conf_state
;
835 conf_flag
= 1; /* confidentiality + integrity */
836 else if (qop
== SECQOP_WRAP_NO_ENCRYPT
)
837 conf_flag
= 0; /* only integrity */
840 FIXME( "QOP %08x not supported\n", qop
);
841 return SEC_E_UNSUPPORTED_FUNCTION
;
844 /* FIXME: multiple data buffers, read-only buffers */
845 if ((data_idx
= get_buffer_index( msg
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
846 if ((token_idx
= get_buffer_index( msg
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
848 iov
[0].type
= GSS_IOV_BUFFER_TYPE_SIGN_ONLY
| GSS_IOV_BUFFER_FLAG_ALLOCATE
;
849 iov
[0].buffer
.length
= 0;
850 iov
[0].buffer
.value
= NULL
;
852 iov
[1].type
= GSS_IOV_BUFFER_TYPE_DATA
;
853 iov
[1].buffer
.length
= msg
->pBuffers
[data_idx
].cbBuffer
;
854 iov
[1].buffer
.value
= msg
->pBuffers
[data_idx
].pvBuffer
;
856 iov
[2].type
= GSS_IOV_BUFFER_TYPE_SIGN_ONLY
| GSS_IOV_BUFFER_FLAG_ALLOCATE
;
857 iov
[2].buffer
.length
= 0;
858 iov
[2].buffer
.value
= NULL
;
860 iov
[3].type
= GSS_IOV_BUFFER_TYPE_HEADER
| GSS_IOV_BUFFER_FLAG_ALLOCATE
;
861 iov
[3].buffer
.length
= 0;
862 iov
[3].buffer
.value
= NULL
;
864 ret
= pgss_wrap_iov( &minor_status
, ctx
, conf_flag
, GSS_C_QOP_DEFAULT
, &conf_state
, iov
, 4 );
865 TRACE( "gss_wrap_iov returned %08x minor status %08x\n", ret
, minor_status
);
866 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
867 if (ret
== GSS_S_COMPLETE
)
869 memcpy( msg
->pBuffers
[token_idx
].pvBuffer
, iov
[3].buffer
.value
, iov
[3].buffer
.length
);
870 msg
->pBuffers
[token_idx
].cbBuffer
= iov
[3].buffer
.length
;
871 pgss_release_iov_buffer( &minor_status
, iov
, 4 );
874 return status_gss_to_sspi( ret
);
877 static NTSTATUS
seal_message_no_vector( gss_ctx_id_t ctx
, SecBufferDesc
*msg
, ULONG qop
)
879 gss_buffer_desc input
, output
;
880 OM_uint32 ret
, minor_status
;
881 int token_idx
, data_idx
, conf_flag
, conf_state
;
884 conf_flag
= 1; /* confidentiality + integrity */
885 else if (qop
== SECQOP_WRAP_NO_ENCRYPT
)
886 conf_flag
= 0; /* only integrity */
889 FIXME( "QOP %08x not supported\n", qop
);
890 return SEC_E_UNSUPPORTED_FUNCTION
;
893 /* FIXME: multiple data buffers, read-only buffers */
894 if ((data_idx
= get_buffer_index( msg
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
895 if ((token_idx
= get_buffer_index( msg
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
897 input
.length
= msg
->pBuffers
[data_idx
].cbBuffer
;
898 input
.value
= msg
->pBuffers
[data_idx
].pvBuffer
;
900 ret
= pgss_wrap( &minor_status
, ctx
, conf_flag
, GSS_C_QOP_DEFAULT
, &input
, &conf_state
, &output
);
901 TRACE( "gss_wrap returned %08x minor status %08x\n", ret
, minor_status
);
902 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
903 if (ret
== GSS_S_COMPLETE
)
905 DWORD len_data
= msg
->pBuffers
[data_idx
].cbBuffer
, len_token
= msg
->pBuffers
[token_idx
].cbBuffer
;
906 if (len_token
< output
.length
- len_data
)
908 TRACE( "buffer too small %lu > %u\n", (SIZE_T
)output
.length
- len_data
, len_token
);
909 pgss_release_buffer( &minor_status
, &output
);
910 return SEC_E_BUFFER_TOO_SMALL
;
912 memcpy( msg
->pBuffers
[data_idx
].pvBuffer
, output
.value
, len_data
);
913 memcpy( msg
->pBuffers
[token_idx
].pvBuffer
, (char *)output
.value
+ len_data
, output
.length
- len_data
);
914 msg
->pBuffers
[token_idx
].cbBuffer
= output
.length
- len_data
;
915 pgss_release_buffer( &minor_status
, &output
);
918 return status_gss_to_sspi( ret
);
921 static NTSTATUS
seal_message( void *args
)
923 struct seal_message_params
*params
= args
;
924 gss_ctx_id_t ctx
= ctxhandle_sspi_to_gss( params
->context
);
926 if (is_dce_style_context( ctx
)) return seal_message_vector( ctx
, params
->msg
, params
->qop
);
927 return seal_message_no_vector( ctx
, params
->msg
, params
->qop
);
930 static NTSTATUS
unseal_message_vector( gss_ctx_id_t ctx
, SecBufferDesc
*msg
, ULONG
*qop
)
932 gss_iov_buffer_desc iov
[4];
933 OM_uint32 ret
, minor_status
;
934 int token_idx
, data_idx
, conf_state
;
936 if ((data_idx
= get_buffer_index( msg
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
937 if ((token_idx
= get_buffer_index( msg
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
939 iov
[0].type
= GSS_IOV_BUFFER_TYPE_SIGN_ONLY
;
940 iov
[0].buffer
.length
= 0;
941 iov
[0].buffer
.value
= NULL
;
943 iov
[1].type
= GSS_IOV_BUFFER_TYPE_DATA
;
944 iov
[1].buffer
.length
= msg
->pBuffers
[data_idx
].cbBuffer
;
945 iov
[1].buffer
.value
= msg
->pBuffers
[data_idx
].pvBuffer
;
947 iov
[2].type
= GSS_IOV_BUFFER_TYPE_SIGN_ONLY
;
948 iov
[2].buffer
.length
= 0;
949 iov
[2].buffer
.value
= NULL
;
951 iov
[3].type
= GSS_IOV_BUFFER_TYPE_HEADER
;
952 iov
[3].buffer
.length
= msg
->pBuffers
[token_idx
].cbBuffer
;
953 iov
[3].buffer
.value
= msg
->pBuffers
[token_idx
].pvBuffer
;
955 ret
= pgss_unwrap_iov( &minor_status
, ctx
, &conf_state
, NULL
, iov
, 4 );
956 TRACE( "gss_unwrap_iov returned %08x minor status %08x\n", ret
, minor_status
);
957 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
958 if (ret
== GSS_S_COMPLETE
&& qop
)
960 *qop
= (conf_state
? 0 : SECQOP_WRAP_NO_ENCRYPT
);
962 return status_gss_to_sspi( ret
);
965 static NTSTATUS
unseal_message_no_vector( gss_ctx_id_t ctx
, SecBufferDesc
*msg
, ULONG
*qop
)
967 gss_buffer_desc input
, output
;
968 OM_uint32 ret
, minor_status
;
969 int token_idx
, data_idx
, conf_state
;
970 DWORD len_data
, len_token
;
972 if ((data_idx
= get_buffer_index( msg
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
973 if ((token_idx
= get_buffer_index( msg
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
975 len_data
= msg
->pBuffers
[data_idx
].cbBuffer
;
976 len_token
= msg
->pBuffers
[token_idx
].cbBuffer
;
978 input
.length
= len_data
+ len_token
;
979 if (!(input
.value
= malloc( input
.length
))) return SEC_E_INSUFFICIENT_MEMORY
;
980 memcpy( input
.value
, msg
->pBuffers
[data_idx
].pvBuffer
, len_data
);
981 memcpy( (char *)input
.value
+ len_data
, msg
->pBuffers
[token_idx
].pvBuffer
, len_token
);
983 ret
= pgss_unwrap( &minor_status
, ctx
, &input
, &output
, &conf_state
, NULL
);
985 TRACE( "gss_unwrap returned %08x minor status %08x\n", ret
, minor_status
);
986 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
987 if (ret
== GSS_S_COMPLETE
)
989 if (qop
) *qop
= (conf_state
? 0 : SECQOP_WRAP_NO_ENCRYPT
);
990 memcpy( msg
->pBuffers
[data_idx
].pvBuffer
, output
.value
, len_data
);
991 pgss_release_buffer( &minor_status
, &output
);
994 return status_gss_to_sspi( ret
);
997 static NTSTATUS
unseal_message( void *args
)
999 struct unseal_message_params
*params
= args
;
1000 gss_ctx_id_t ctx
= ctxhandle_sspi_to_gss( params
->context
);
1002 if (is_dce_style_context( ctx
)) return unseal_message_vector( ctx
, params
->msg
, params
->qop
);
1003 return unseal_message_no_vector( ctx
, params
->msg
, params
->qop
);
1006 static NTSTATUS
verify_signature( void *args
)
1008 struct verify_signature_params
*params
= args
;
1009 SecBufferDesc
*msg
= params
->msg
;
1010 OM_uint32 ret
, minor_status
;
1011 gss_buffer_desc data_buffer
, token_buffer
;
1012 gss_ctx_id_t ctx_handle
= ctxhandle_sspi_to_gss( params
->context
);
1013 int data_idx
, token_idx
;
1015 if ((data_idx
= get_buffer_index( msg
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
1016 data_buffer
.length
= msg
->pBuffers
[data_idx
].cbBuffer
;
1017 data_buffer
.value
= msg
->pBuffers
[data_idx
].pvBuffer
;
1019 if ((token_idx
= get_buffer_index( msg
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1020 token_buffer
.length
= msg
->pBuffers
[token_idx
].cbBuffer
;
1021 token_buffer
.value
= msg
->pBuffers
[token_idx
].pvBuffer
;
1023 ret
= pgss_verify_mic( &minor_status
, ctx_handle
, &data_buffer
, &token_buffer
, NULL
);
1024 TRACE( "gss_verify_mic returned %08x minor status %08x\n", ret
, minor_status
);
1025 if (GSS_ERROR( ret
)) trace_gss_status( ret
, minor_status
);
1026 if (ret
== GSS_S_COMPLETE
&& params
->qop
) *params
->qop
= 0;
1028 return status_gss_to_sspi( ret
);
1031 static NTSTATUS
process_attach( void *args
)
1033 if (load_krb5() && load_gssapi_krb5()) return STATUS_SUCCESS
;
1034 if (libkrb5_handle
) unload_krb5();
1035 return STATUS_DLL_NOT_FOUND
;
1038 unixlib_entry_t __wine_unix_call_funcs
[] =
1042 acquire_credentials_handle
,
1044 free_credentials_handle
,
1047 query_context_attributes
,
1054 #endif /* defined(SONAME_LIBKRB5) && defined(SONAME_LIBGSSAPI_KRB5) */