2 * Copyright 2017 Dmitry Timoshkov
3 * Copyright 2017 George Popoff
4 * Copyright 2008 Robert Shearman for CodeWeavers
5 * Copyright 2017 Hans Leidekker for CodeWeavers
7 * Kerberos5 Authentication Package
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 #include "wine/port.h"
28 #ifdef HAVE_KRB5_KRB5_H
29 #include <krb5/krb5.h>
31 #ifdef SONAME_LIBGSSAPI_KRB5
32 # include <gssapi/gssapi.h>
33 # include <gssapi/gssapi_ext.h>
37 #define WIN32_NO_STATUS
46 #include "wine/heap.h"
47 #include "wine/library.h"
48 #include "wine/debug.h"
49 #include "wine/unicode.h"
51 WINE_DEFAULT_DEBUG_CHANNEL(kerberos
);
53 #define KERBEROS_MAX_BUF 12000
55 #define KERBEROS_CAPS \
56 ( SECPKG_FLAG_INTEGRITY \
57 | SECPKG_FLAG_PRIVACY \
58 | SECPKG_FLAG_TOKEN_ONLY \
59 | SECPKG_FLAG_DATAGRAM \
60 | SECPKG_FLAG_CONNECTION \
61 | SECPKG_FLAG_MULTI_REQUIRED \
62 | SECPKG_FLAG_EXTENDED_ERROR \
63 | SECPKG_FLAG_IMPERSONATION \
64 | SECPKG_FLAG_ACCEPT_WIN32_NAME \
65 | SECPKG_FLAG_NEGOTIABLE \
66 | SECPKG_FLAG_GSS_COMPATIBLE \
68 | SECPKG_FLAG_MUTUAL_AUTH \
69 | SECPKG_FLAG_DELEGATION \
70 | SECPKG_FLAG_READONLY_WITH_CHECKSUM \
71 | SECPKG_FLAG_RESTRICTED_TOKENS \
72 | SECPKG_FLAG_APPCONTAINER_CHECKS)
74 static WCHAR kerberos_name_W
[] = {'K','e','r','b','e','r','o','s',0};
75 static WCHAR kerberos_comment_W
[] = {'M','i','c','r','o','s','o','f','t',' ','K','e','r','b','e','r','o','s',' ','V','1','.','0',0};
76 static const SecPkgInfoW infoW
=
80 RPC_C_AUTHN_GSS_KERBEROS
,
86 static ULONG kerberos_package_id
;
87 static LSA_DISPATCH_TABLE lsa_dispatch
;
91 static void *libkrb5_handle
;
93 #define MAKE_FUNCPTR(f) static typeof(f) * p_##f
94 MAKE_FUNCPTR(krb5_cc_close
);
95 MAKE_FUNCPTR(krb5_cc_default
);
96 MAKE_FUNCPTR(krb5_cc_end_seq_get
);
97 MAKE_FUNCPTR(krb5_cc_initialize
);
98 MAKE_FUNCPTR(krb5_cc_next_cred
);
99 MAKE_FUNCPTR(krb5_cc_start_seq_get
);
100 MAKE_FUNCPTR(krb5_cc_store_cred
);
101 MAKE_FUNCPTR(krb5_cccol_cursor_free
);
102 MAKE_FUNCPTR(krb5_cccol_cursor_new
);
103 MAKE_FUNCPTR(krb5_cccol_cursor_next
);
104 MAKE_FUNCPTR(krb5_decode_ticket
);
105 MAKE_FUNCPTR(krb5_free_context
);
106 MAKE_FUNCPTR(krb5_free_cred_contents
);
107 MAKE_FUNCPTR(krb5_free_principal
);
108 MAKE_FUNCPTR(krb5_free_ticket
);
109 MAKE_FUNCPTR(krb5_free_unparsed_name
);
110 MAKE_FUNCPTR(krb5_get_init_creds_opt_alloc
);
111 MAKE_FUNCPTR(krb5_get_init_creds_opt_free
);
112 MAKE_FUNCPTR(krb5_get_init_creds_opt_set_out_ccache
);
113 MAKE_FUNCPTR(krb5_get_init_creds_password
);
114 MAKE_FUNCPTR(krb5_init_context
);
115 MAKE_FUNCPTR(krb5_is_config_principal
);
116 MAKE_FUNCPTR(krb5_parse_name_flags
);
117 MAKE_FUNCPTR(krb5_unparse_name_flags
);
120 static void load_krb5(void)
122 if (!(libkrb5_handle
= wine_dlopen(SONAME_LIBKRB5
, RTLD_NOW
, NULL
, 0)))
124 WARN("Failed to load %s, Kerberos support will be disabled\n", SONAME_LIBKRB5
);
128 #define LOAD_FUNCPTR(f) \
129 if (!(p_##f = wine_dlsym(libkrb5_handle, #f, NULL, 0))) \
131 ERR("Failed to load %s\n", #f); \
135 LOAD_FUNCPTR(krb5_cc_close
)
136 LOAD_FUNCPTR(krb5_cc_default
)
137 LOAD_FUNCPTR(krb5_cc_end_seq_get
)
138 LOAD_FUNCPTR(krb5_cc_initialize
)
139 LOAD_FUNCPTR(krb5_cc_next_cred
)
140 LOAD_FUNCPTR(krb5_cc_start_seq_get
)
141 LOAD_FUNCPTR(krb5_cc_store_cred
)
142 LOAD_FUNCPTR(krb5_cccol_cursor_free
)
143 LOAD_FUNCPTR(krb5_cccol_cursor_new
)
144 LOAD_FUNCPTR(krb5_cccol_cursor_next
)
145 LOAD_FUNCPTR(krb5_decode_ticket
)
146 LOAD_FUNCPTR(krb5_free_context
)
147 LOAD_FUNCPTR(krb5_free_cred_contents
)
148 LOAD_FUNCPTR(krb5_free_principal
)
149 LOAD_FUNCPTR(krb5_free_ticket
)
150 LOAD_FUNCPTR(krb5_free_unparsed_name
)
151 LOAD_FUNCPTR(krb5_get_init_creds_opt_alloc
)
152 LOAD_FUNCPTR(krb5_get_init_creds_opt_free
)
153 LOAD_FUNCPTR(krb5_get_init_creds_opt_set_out_ccache
)
154 LOAD_FUNCPTR(krb5_get_init_creds_password
)
155 LOAD_FUNCPTR(krb5_init_context
)
156 LOAD_FUNCPTR(krb5_is_config_principal
)
157 LOAD_FUNCPTR(krb5_parse_name_flags
)
158 LOAD_FUNCPTR(krb5_unparse_name_flags
)
164 wine_dlclose(libkrb5_handle
, NULL
, 0);
165 libkrb5_handle
= NULL
;
168 #else /* SONAME_LIBKRB5 */
170 static void load_krb5(void)
172 WARN("Kerberos support was not provided at compile time\n");
175 #endif /* SONAME_LIBKRB5 */
177 static const char *debugstr_us( const UNICODE_STRING
*us
)
179 if (!us
) return "<null>";
180 return debugstr_wn( us
->Buffer
, us
->Length
/ sizeof(WCHAR
) );
183 static NTSTATUS NTAPI
kerberos_LsaApInitializePackage(ULONG package_id
, PLSA_DISPATCH_TABLE dispatch
,
184 PLSA_STRING database
, PLSA_STRING confidentiality
, PLSA_STRING
*package_name
)
190 kerberos_package_id
= package_id
;
191 lsa_dispatch
= *dispatch
;
193 kerberos_name
= lsa_dispatch
.AllocateLsaHeap(sizeof(MICROSOFT_KERBEROS_NAME_A
));
194 if (!kerberos_name
) return STATUS_NO_MEMORY
;
196 memcpy(kerberos_name
, MICROSOFT_KERBEROS_NAME_A
, sizeof(MICROSOFT_KERBEROS_NAME_A
));
198 *package_name
= lsa_dispatch
.AllocateLsaHeap(sizeof(**package_name
));
201 lsa_dispatch
.FreeLsaHeap(kerberos_name
);
202 return STATUS_NO_MEMORY
;
205 RtlInitString(*package_name
, kerberos_name
);
207 return STATUS_SUCCESS
;
210 #ifdef SONAME_LIBKRB5
214 ULONG count
, allocated
;
215 KERB_TICKET_CACHE_INFO
*info
;
218 static NTSTATUS
krb5_error_to_status(krb5_error_code error
)
222 case 0: return STATUS_SUCCESS
;
225 return STATUS_UNSUCCESSFUL
;
229 static void free_ticket_info(struct ticket_info
*info
)
233 for (i
= 0; i
< info
->count
; i
++)
235 heap_free(info
->info
[i
].RealmName
.Buffer
);
236 heap_free(info
->info
[i
].ServerName
.Buffer
);
239 heap_free(info
->info
);
242 static WCHAR
*utf8_to_wstr(const char *utf8
)
247 len
= MultiByteToWideChar(CP_UTF8
, 0, utf8
, -1, NULL
, 0);
248 wstr
= heap_alloc(len
* sizeof(WCHAR
));
250 MultiByteToWideChar(CP_UTF8
, 0, utf8
, -1, wstr
, len
);
255 static NTSTATUS
copy_tickets_from_cache(krb5_context context
, krb5_ccache cache
, struct ticket_info
*info
)
258 krb5_cc_cursor cursor
;
259 krb5_error_code error
;
260 krb5_creds credentials
;
262 char *name_with_realm
, *name_without_realm
, *realm_name
;
263 WCHAR
*realm_nameW
, *name_without_realmW
;
265 error
= p_krb5_cc_start_seq_get(context
, cache
, &cursor
);
266 if (error
) return krb5_error_to_status(error
);
270 error
= p_krb5_cc_next_cred(context
, cache
, &cursor
, &credentials
);
273 if (error
== KRB5_CC_END
)
274 status
= STATUS_SUCCESS
;
276 status
= krb5_error_to_status(error
);
280 if (p_krb5_is_config_principal(context
, credentials
.server
))
282 p_krb5_free_cred_contents(context
, &credentials
);
286 if (info
->count
== info
->allocated
)
288 KERB_TICKET_CACHE_INFO
*new_info
;
293 new_allocated
= info
->allocated
* 2;
294 new_info
= heap_realloc(info
->info
, sizeof(*new_info
) * new_allocated
);
299 new_info
= heap_alloc(sizeof(*new_info
) * new_allocated
);
303 p_krb5_free_cred_contents(context
, &credentials
);
304 status
= STATUS_NO_MEMORY
;
308 info
->info
= new_info
;
309 info
->allocated
= new_allocated
;
312 error
= p_krb5_unparse_name_flags(context
, credentials
.server
, 0, &name_with_realm
);
315 p_krb5_free_cred_contents(context
, &credentials
);
316 status
= krb5_error_to_status(error
);
320 TRACE("name_with_realm: %s\n", debugstr_a(name_with_realm
));
322 error
= p_krb5_unparse_name_flags(context
, credentials
.server
,
323 KRB5_PRINCIPAL_UNPARSE_NO_REALM
, &name_without_realm
);
326 p_krb5_free_unparsed_name(context
, name_with_realm
);
327 p_krb5_free_cred_contents(context
, &credentials
);
328 status
= krb5_error_to_status(error
);
332 TRACE("name_without_realm: %s\n", debugstr_a(name_without_realm
));
334 name_without_realmW
= utf8_to_wstr(name_without_realm
);
335 RtlInitUnicodeString(&info
->info
[info
->count
].ServerName
, name_without_realmW
);
337 realm_name
= strchr(name_with_realm
, '@');
340 ERR("wrong name with realm %s\n", debugstr_a(name_with_realm
));
341 realm_name
= name_with_realm
;
346 /* realm_name - now contains only realm! */
348 realm_nameW
= utf8_to_wstr(realm_name
);
349 RtlInitUnicodeString(&info
->info
[info
->count
].RealmName
, realm_nameW
);
351 if (!credentials
.times
.starttime
)
352 credentials
.times
.starttime
= credentials
.times
.authtime
;
354 /* TODO: if krb5_is_config_principal = true */
355 RtlSecondsSince1970ToTime(credentials
.times
.starttime
, &info
->info
[info
->count
].StartTime
);
356 RtlSecondsSince1970ToTime(credentials
.times
.endtime
, &info
->info
[info
->count
].EndTime
);
357 RtlSecondsSince1970ToTime(credentials
.times
.renew_till
, &info
->info
[info
->count
].RenewTime
);
359 info
->info
[info
->count
].TicketFlags
= credentials
.ticket_flags
;
361 error
= p_krb5_decode_ticket(&credentials
.ticket
, &ticket
);
363 p_krb5_free_unparsed_name(context
, name_with_realm
);
364 p_krb5_free_unparsed_name(context
, name_without_realm
);
365 p_krb5_free_cred_contents(context
, &credentials
);
369 status
= krb5_error_to_status(error
);
373 info
->info
[info
->count
].EncryptionType
= ticket
->enc_part
.enctype
;
375 p_krb5_free_ticket(context
, ticket
);
380 p_krb5_cc_end_seq_get(context
, cache
, &cursor
);
385 static inline void init_client_us(UNICODE_STRING
*dst
, void *client_ws
, const UNICODE_STRING
*src
)
387 dst
->Buffer
= client_ws
;
388 dst
->Length
= src
->Length
;
389 dst
->MaximumLength
= src
->MaximumLength
;
392 static NTSTATUS
copy_to_client(PLSA_CLIENT_REQUEST lsa_req
, struct ticket_info
*info
, void **out
, ULONG
*out_size
)
396 SIZE_T size
, client_str_off
;
397 char *client_resp
, *client_ticket
, *client_str
;
398 KERB_QUERY_TKT_CACHE_RESPONSE resp
;
400 size
= sizeof(KERB_QUERY_TKT_CACHE_RESPONSE
);
401 if (info
->count
!= 0)
402 size
+= (info
->count
- 1) * sizeof(KERB_TICKET_CACHE_INFO
);
404 client_str_off
= size
;
406 for (i
= 0; i
< info
->count
; i
++)
408 size
+= info
->info
[i
].RealmName
.MaximumLength
;
409 size
+= info
->info
[i
].ServerName
.MaximumLength
;
412 status
= lsa_dispatch
.AllocateClientBuffer(lsa_req
, size
, (void **)&client_resp
);
413 if (status
!= STATUS_SUCCESS
) return status
;
415 resp
.MessageType
= KerbQueryTicketCacheMessage
;
416 resp
.CountOfTickets
= info
->count
;
417 size
= FIELD_OFFSET(KERB_QUERY_TKT_CACHE_RESPONSE
, Tickets
);
418 status
= lsa_dispatch
.CopyToClientBuffer(lsa_req
, size
, client_resp
, &resp
);
419 if (status
!= STATUS_SUCCESS
) goto fail
;
424 *out_size
= sizeof(resp
);
425 return STATUS_SUCCESS
;
430 client_ticket
= client_resp
+ size
;
431 client_str
= client_resp
+ client_str_off
;
433 for (i
= 0; i
< info
->count
; i
++)
435 KERB_TICKET_CACHE_INFO ticket
;
437 ticket
= info
->info
[i
];
439 init_client_us(&ticket
.RealmName
, client_str
, &info
->info
[i
].RealmName
);
441 size
= info
->info
[i
].RealmName
.MaximumLength
;
442 status
= lsa_dispatch
.CopyToClientBuffer(lsa_req
, size
, client_str
, info
->info
[i
].RealmName
.Buffer
);
443 if (status
!= STATUS_SUCCESS
) goto fail
;
447 init_client_us(&ticket
.ServerName
, client_str
, &info
->info
[i
].ServerName
);
449 size
= info
->info
[i
].ServerName
.MaximumLength
;
450 status
= lsa_dispatch
.CopyToClientBuffer(lsa_req
, size
, client_str
, info
->info
[i
].ServerName
.Buffer
);
451 if (status
!= STATUS_SUCCESS
) goto fail
;
455 status
= lsa_dispatch
.CopyToClientBuffer(lsa_req
, sizeof(ticket
), client_ticket
, &ticket
);
456 if (status
!= STATUS_SUCCESS
) goto fail
;
458 client_ticket
+= sizeof(ticket
);
459 *out_size
+= sizeof(ticket
);
463 return STATUS_SUCCESS
;
466 lsa_dispatch
.FreeClientBuffer(lsa_req
, client_resp
);
470 static NTSTATUS
query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req
, void *in
, ULONG in_len
, void **out
, ULONG
*out_len
)
473 KERB_QUERY_TKT_CACHE_REQUEST
*query
;
474 struct ticket_info info
;
475 krb5_error_code error
;
476 krb5_context context
= NULL
;
477 krb5_cccol_cursor cursor
= NULL
;
480 if (!in
|| in_len
!= sizeof(KERB_QUERY_TKT_CACHE_REQUEST
) || !out
|| !out_len
)
481 return STATUS_INVALID_PARAMETER
;
483 query
= (KERB_QUERY_TKT_CACHE_REQUEST
*)in
;
485 if (query
->LogonId
.HighPart
!= 0 || query
->LogonId
.LowPart
!= 0)
486 return STATUS_ACCESS_DENIED
;
492 error
= p_krb5_init_context(&context
);
495 status
= krb5_error_to_status(error
);
499 error
= p_krb5_cccol_cursor_new(context
, &cursor
);
502 status
= krb5_error_to_status(error
);
508 error
= p_krb5_cccol_cursor_next(context
, cursor
, &cache
);
511 status
= krb5_error_to_status(error
);
516 status
= copy_tickets_from_cache(context
, cache
, &info
);
518 p_krb5_cc_close(context
, cache
);
520 if (status
!= STATUS_SUCCESS
)
524 status
= copy_to_client(lsa_req
, &info
, out
, out_len
);
528 p_krb5_cccol_cursor_free(context
, &cursor
);
531 p_krb5_free_context(context
);
533 free_ticket_info(&info
);
538 #else /* SONAME_LIBKRB5 */
540 static NTSTATUS
query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req
, void *in
, ULONG in_len
, void **out
, ULONG
*out_len
)
542 FIXME("%p,%p,%u,%p,%p: stub\n", lsa_req
, in
, in_len
, out
, out_len
);
543 return STATUS_NOT_IMPLEMENTED
;
546 #endif /* SONAME_LIBKRB5 */
548 static NTSTATUS NTAPI
kerberos_LsaApCallPackageUntrusted(PLSA_CLIENT_REQUEST request
,
549 PVOID in_buffer
, PVOID client_buffer_base
, ULONG in_buffer_length
,
550 PVOID
*out_buffer
, PULONG out_buffer_length
, PNTSTATUS status
)
552 KERB_PROTOCOL_MESSAGE_TYPE msg
;
554 TRACE("%p,%p,%p,%u,%p,%p,%p\n", request
, in_buffer
, client_buffer_base
,
555 in_buffer_length
, out_buffer
, out_buffer_length
, status
);
557 if (!in_buffer
|| in_buffer_length
< sizeof(msg
))
558 return STATUS_INVALID_PARAMETER
;
560 msg
= *(KERB_PROTOCOL_MESSAGE_TYPE
*)in_buffer
;
564 case KerbQueryTicketCacheMessage
:
565 *status
= query_ticket_cache(request
, in_buffer
, in_buffer_length
, out_buffer
, out_buffer_length
);
568 case KerbRetrieveTicketMessage
:
569 FIXME("KerbRetrieveTicketMessage stub\n");
570 *status
= STATUS_NOT_IMPLEMENTED
;
573 case KerbPurgeTicketCacheMessage
:
574 FIXME("KerbPurgeTicketCacheMessage stub\n");
575 *status
= STATUS_NOT_IMPLEMENTED
;
578 default: /* All other requests should call LsaApCallPackage */
579 WARN("%u => access denied\n", msg
);
580 *status
= STATUS_ACCESS_DENIED
;
587 static NTSTATUS NTAPI
kerberos_SpGetInfo(SecPkgInfoW
*info
)
591 /* LSA will make a copy before forwarding the structure, so
592 * it's safe to put pointers to dynamic or constant data there.
596 return STATUS_SUCCESS
;
599 #ifdef SONAME_LIBGSSAPI_KRB5
601 WINE_DECLARE_DEBUG_CHANNEL(winediag
);
602 static void *libgssapi_krb5_handle
;
604 #define MAKE_FUNCPTR(f) static typeof(f) * p##f
605 MAKE_FUNCPTR(gss_accept_sec_context
);
606 MAKE_FUNCPTR(gss_acquire_cred
);
607 MAKE_FUNCPTR(gss_delete_sec_context
);
608 MAKE_FUNCPTR(gss_display_status
);
609 MAKE_FUNCPTR(gss_get_mic
);
610 MAKE_FUNCPTR(gss_import_name
);
611 MAKE_FUNCPTR(gss_init_sec_context
);
612 MAKE_FUNCPTR(gss_inquire_context
);
613 MAKE_FUNCPTR(gss_release_buffer
);
614 MAKE_FUNCPTR(gss_release_cred
);
615 MAKE_FUNCPTR(gss_release_iov_buffer
);
616 MAKE_FUNCPTR(gss_release_name
);
617 MAKE_FUNCPTR(gss_unwrap
);
618 MAKE_FUNCPTR(gss_unwrap_iov
);
619 MAKE_FUNCPTR(gss_verify_mic
);
620 MAKE_FUNCPTR(gss_wrap
);
621 MAKE_FUNCPTR(gss_wrap_iov
);
624 static BOOL
load_gssapi_krb5(void)
626 if (!(libgssapi_krb5_handle
= wine_dlopen( SONAME_LIBGSSAPI_KRB5
, RTLD_NOW
, NULL
, 0 )))
628 ERR_(winediag
)( "Failed to load libgssapi_krb5, Kerberos SSP support will not be available.\n" );
632 #define LOAD_FUNCPTR(f) \
633 if (!(p##f = wine_dlsym( libgssapi_krb5_handle, #f, NULL, 0 ))) \
635 ERR( "Failed to load %s\n", #f ); \
639 LOAD_FUNCPTR(gss_accept_sec_context
)
640 LOAD_FUNCPTR(gss_acquire_cred
)
641 LOAD_FUNCPTR(gss_delete_sec_context
)
642 LOAD_FUNCPTR(gss_display_status
)
643 LOAD_FUNCPTR(gss_get_mic
)
644 LOAD_FUNCPTR(gss_import_name
)
645 LOAD_FUNCPTR(gss_init_sec_context
)
646 LOAD_FUNCPTR(gss_inquire_context
)
647 LOAD_FUNCPTR(gss_release_buffer
)
648 LOAD_FUNCPTR(gss_release_cred
)
649 LOAD_FUNCPTR(gss_release_iov_buffer
)
650 LOAD_FUNCPTR(gss_release_name
)
651 LOAD_FUNCPTR(gss_unwrap
)
652 LOAD_FUNCPTR(gss_unwrap_iov
)
653 LOAD_FUNCPTR(gss_verify_mic
)
654 LOAD_FUNCPTR(gss_wrap
)
655 LOAD_FUNCPTR(gss_wrap_iov
)
661 wine_dlclose( libgssapi_krb5_handle
, NULL
, 0 );
662 libgssapi_krb5_handle
= NULL
;
666 static void unload_gssapi_krb5(void)
668 wine_dlclose( libgssapi_krb5_handle
, NULL
, 0 );
669 libgssapi_krb5_handle
= NULL
;
672 static inline gss_cred_id_t
credhandle_sspi_to_gss( LSA_SEC_HANDLE cred
)
674 if (!cred
) return GSS_C_NO_CREDENTIAL
;
675 return (gss_cred_id_t
)cred
;
678 static inline void credhandle_gss_to_sspi( gss_cred_id_t handle
, LSA_SEC_HANDLE
*cred
)
680 *cred
= (LSA_SEC_HANDLE
)handle
;
683 static inline gss_ctx_id_t
ctxthandle_sspi_to_gss( LSA_SEC_HANDLE ctxt
)
685 if (!ctxt
) return GSS_C_NO_CONTEXT
;
686 return (gss_ctx_id_t
)ctxt
;
689 static inline void ctxthandle_gss_to_sspi( gss_ctx_id_t handle
, LSA_SEC_HANDLE
*ctxt
)
691 *ctxt
= (LSA_SEC_HANDLE
)handle
;
694 static SECURITY_STATUS
status_gss_to_sspi( OM_uint32 status
)
698 case GSS_S_COMPLETE
: return SEC_E_OK
;
699 case GSS_S_BAD_MECH
: return SEC_E_SECPKG_NOT_FOUND
;
700 case GSS_S_BAD_SIG
: return SEC_E_MESSAGE_ALTERED
;
701 case GSS_S_NO_CRED
: return SEC_E_NO_CREDENTIALS
;
702 case GSS_S_NO_CONTEXT
: return SEC_E_INVALID_HANDLE
;
703 case GSS_S_DEFECTIVE_TOKEN
: return SEC_E_INVALID_TOKEN
;
704 case GSS_S_DEFECTIVE_CREDENTIAL
: return SEC_E_NO_CREDENTIALS
;
705 case GSS_S_CREDENTIALS_EXPIRED
: return SEC_E_CONTEXT_EXPIRED
;
706 case GSS_S_CONTEXT_EXPIRED
: return SEC_E_CONTEXT_EXPIRED
;
707 case GSS_S_BAD_QOP
: return SEC_E_QOP_NOT_SUPPORTED
;
708 case GSS_S_CONTINUE_NEEDED
: return SEC_I_CONTINUE_NEEDED
;
709 case GSS_S_DUPLICATE_TOKEN
: return SEC_E_INVALID_TOKEN
;
710 case GSS_S_OLD_TOKEN
: return SEC_E_INVALID_TOKEN
;
711 case GSS_S_UNSEQ_TOKEN
: return SEC_E_OUT_OF_SEQUENCE
;
712 case GSS_S_GAP_TOKEN
: return SEC_E_OUT_OF_SEQUENCE
;
715 FIXME( "couldn't convert status 0x%08x to SECURITY_STATUS\n", status
);
716 return SEC_E_INTERNAL_ERROR
;
720 static void trace_gss_status_ex( OM_uint32 code
, int type
)
722 OM_uint32 ret
, minor_status
;
724 OM_uint32 message_context
= 0;
728 ret
= pgss_display_status( &minor_status
, code
, type
, GSS_C_NULL_OID
, &message_context
, &buf
);
731 TRACE( "gss_display_status(0x%08x,%d) returned %08x minor status %08x\n",
732 code
, type
, ret
, minor_status
);
735 TRACE( "GSS-API error: 0x%08x: %s\n", code
, debugstr_an(buf
.value
, buf
.length
) );
736 pgss_release_buffer( &minor_status
, &buf
);
738 if (!message_context
) return;
742 static void trace_gss_status( OM_uint32 major_status
, OM_uint32 minor_status
)
744 if (TRACE_ON(kerberos
))
746 trace_gss_status_ex( major_status
, GSS_C_GSS_CODE
);
747 trace_gss_status_ex( minor_status
, GSS_C_MECH_CODE
);
751 static void expirytime_gss_to_sspi( OM_uint32 expirytime
, TimeStamp
*timestamp
)
757 GetLocalTime( &time
);
758 SystemTimeToFileTime( &time
, &filetime
);
759 tmp
.QuadPart
= ((ULONGLONG
)filetime
.dwLowDateTime
| (ULONGLONG
)filetime
.dwHighDateTime
<< 32) + expirytime
;
760 timestamp
->LowPart
= tmp
.QuadPart
;
761 timestamp
->HighPart
= tmp
.QuadPart
>> 32;
764 static SECURITY_STATUS
name_sspi_to_gss( const UNICODE_STRING
*name_str
, gss_name_t
*name
)
766 OM_uint32 ret
, minor_status
;
767 gss_OID type
= GSS_C_NO_OID
; /* FIXME: detect the appropriate value for this ourselves? */
770 buf
.length
= WideCharToMultiByte( CP_UNIXCP
, 0, name_str
->Buffer
, name_str
->Length
/ sizeof(WCHAR
), NULL
, 0, NULL
, NULL
);
771 if (!(buf
.value
= heap_alloc( buf
.length
))) return SEC_E_INSUFFICIENT_MEMORY
;
772 WideCharToMultiByte( CP_UNIXCP
, 0, name_str
->Buffer
, name_str
->Length
/ sizeof(WCHAR
), buf
.value
, buf
.length
, NULL
, NULL
);
774 ret
= pgss_import_name( &minor_status
, &buf
, type
, name
);
775 TRACE( "gss_import_name returned %08x minor status %08x\n", ret
, minor_status
);
776 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
778 heap_free( buf
.value
);
779 return status_gss_to_sspi( ret
);
782 static ULONG
flags_isc_req_to_gss( ULONG flags
)
785 if (flags
& ISC_REQ_DELEGATE
) ret
|= GSS_C_DELEG_FLAG
;
786 if (flags
& ISC_REQ_MUTUAL_AUTH
) ret
|= GSS_C_MUTUAL_FLAG
;
787 if (flags
& ISC_REQ_REPLAY_DETECT
) ret
|= GSS_C_REPLAY_FLAG
;
788 if (flags
& ISC_REQ_SEQUENCE_DETECT
) ret
|= GSS_C_SEQUENCE_FLAG
;
789 if (flags
& ISC_REQ_CONFIDENTIALITY
) ret
|= GSS_C_CONF_FLAG
;
790 if (flags
& ISC_REQ_INTEGRITY
) ret
|= GSS_C_INTEG_FLAG
;
791 if (flags
& ISC_REQ_NULL_SESSION
) ret
|= GSS_C_ANON_FLAG
;
792 if (flags
& ISC_REQ_USE_DCE_STYLE
) ret
|= GSS_C_DCE_STYLE
;
796 static ULONG
flags_gss_to_isc_ret( ULONG flags
)
799 if (flags
& GSS_C_DELEG_FLAG
) ret
|= ISC_RET_DELEGATE
;
800 if (flags
& GSS_C_MUTUAL_FLAG
) ret
|= ISC_RET_MUTUAL_AUTH
;
801 if (flags
& GSS_C_REPLAY_FLAG
) ret
|= ISC_RET_REPLAY_DETECT
;
802 if (flags
& GSS_C_SEQUENCE_FLAG
) ret
|= ISC_RET_SEQUENCE_DETECT
;
803 if (flags
& GSS_C_CONF_FLAG
) ret
|= ISC_RET_CONFIDENTIALITY
;
804 if (flags
& GSS_C_INTEG_FLAG
) ret
|= ISC_RET_INTEGRITY
;
805 if (flags
& GSS_C_ANON_FLAG
) ret
|= ISC_RET_NULL_SESSION
;
809 static ULONG
flags_gss_to_asc_ret( ULONG flags
)
812 if (flags
& GSS_C_DELEG_FLAG
) ret
|= ASC_RET_DELEGATE
;
813 if (flags
& GSS_C_MUTUAL_FLAG
) ret
|= ASC_RET_MUTUAL_AUTH
;
814 if (flags
& GSS_C_REPLAY_FLAG
) ret
|= ASC_RET_REPLAY_DETECT
;
815 if (flags
& GSS_C_SEQUENCE_FLAG
) ret
|= ASC_RET_SEQUENCE_DETECT
;
816 if (flags
& GSS_C_CONF_FLAG
) ret
|= ASC_RET_CONFIDENTIALITY
;
817 if (flags
& GSS_C_INTEG_FLAG
) ret
|= ASC_RET_INTEGRITY
;
818 if (flags
& GSS_C_ANON_FLAG
) ret
|= ASC_RET_NULL_SESSION
;
822 static BOOL
is_dce_style_context( gss_ctx_id_t ctxt_handle
)
824 OM_uint32 ret
, minor_status
, flags
;
825 ret
= pgss_inquire_context( &minor_status
, ctxt_handle
, NULL
, NULL
, NULL
, NULL
, &flags
, NULL
, NULL
);
826 return (ret
== GSS_S_COMPLETE
&& (flags
& GSS_C_DCE_STYLE
));
829 static int get_buffer_index( SecBufferDesc
*desc
, DWORD type
)
832 if (!desc
) return -1;
833 for (i
= 0; i
< desc
->cBuffers
; i
++)
835 if (desc
->pBuffers
[i
].BufferType
== type
) return i
;
840 static char *get_user_at_domain( const WCHAR
*user
, ULONG user_len
, const WCHAR
*domain
, ULONG domain_len
)
842 int len_user
, len_domain
;
845 len_user
= WideCharToMultiByte( CP_UNIXCP
, 0, user
, user_len
, NULL
, 0, NULL
, NULL
);
846 len_domain
= WideCharToMultiByte( CP_UNIXCP
, 0, domain
, domain_len
, NULL
, 0, NULL
, NULL
);
847 if (!(ret
= heap_alloc( len_user
+ len_domain
+ 2 ))) return NULL
;
849 WideCharToMultiByte( CP_UNIXCP
, 0, user
, user_len
, ret
, len_user
, NULL
, NULL
);
851 WideCharToMultiByte( CP_UNIXCP
, 0, domain
, domain_len
, ret
+ len_user
+ 1, len_domain
, NULL
, NULL
);
852 ret
[len_user
+ len_domain
+ 1] = 0;
856 static char *get_password( const WCHAR
*passwd
, ULONG passwd_len
)
861 len
= WideCharToMultiByte( CP_UNIXCP
, WC_NO_BEST_FIT_CHARS
, passwd
, passwd_len
, NULL
, 0, NULL
, NULL
);
862 if (!(ret
= heap_alloc( len
+ 1 ))) return NULL
;
863 WideCharToMultiByte( CP_UNIXCP
, 0, passwd
, passwd_len
, ret
, len
, NULL
, NULL
);
868 static NTSTATUS
init_creds( const SEC_WINNT_AUTH_IDENTITY_W
*id
)
870 char *user_at_domain
, *password
;
872 krb5_principal principal
= NULL
;
873 krb5_get_init_creds_opt
*options
= NULL
;
874 krb5_ccache cache
= NULL
;
878 if (!id
) return STATUS_SUCCESS
;
879 if (id
->Flags
& SEC_WINNT_AUTH_IDENTITY_ANSI
)
881 FIXME( "ANSI identity not supported\n" );
882 return SEC_E_UNSUPPORTED_FUNCTION
;
884 if (!(user_at_domain
= get_user_at_domain( id
->User
, id
->UserLength
, id
->Domain
, id
->DomainLength
)))
886 return SEC_E_INSUFFICIENT_MEMORY
;
888 if (!(password
= get_password( id
->Password
, id
->PasswordLength
)))
890 heap_free( user_at_domain
);
891 return SEC_E_INSUFFICIENT_MEMORY
;
894 if ((err
= p_krb5_init_context( &ctx
)))
896 heap_free( password
);
897 heap_free( user_at_domain
);
898 return krb5_error_to_status( err
);
900 if ((err
= p_krb5_parse_name_flags( ctx
, user_at_domain
, 0, &principal
))) goto done
;
901 if ((err
= p_krb5_cc_default( ctx
, &cache
))) goto done
;
902 if ((err
= p_krb5_get_init_creds_opt_alloc( ctx
, &options
))) goto done
;
903 if ((err
= p_krb5_get_init_creds_opt_set_out_ccache( ctx
, options
, cache
))) goto done
;
904 if ((err
= p_krb5_get_init_creds_password( ctx
, &creds
, principal
, password
, 0, NULL
, 0, NULL
, 0 ))) goto done
;
905 if ((err
= p_krb5_cc_initialize( ctx
, cache
, principal
))) goto done
;
906 if ((err
= p_krb5_cc_store_cred( ctx
, cache
, &creds
))) goto done
;
908 TRACE( "success\n" );
909 p_krb5_free_cred_contents( ctx
, &creds
);
912 if (cache
) p_krb5_cc_close( ctx
, cache
);
913 if (principal
) p_krb5_free_principal( ctx
, principal
);
914 if (options
) p_krb5_get_init_creds_opt_free( ctx
, options
);
915 p_krb5_free_context( ctx
);
916 heap_free( user_at_domain
);
917 heap_free( password
);
919 return krb5_error_to_status( err
);
922 static NTSTATUS
acquire_credentials_handle( UNICODE_STRING
*principal_us
, gss_cred_usage_t cred_usage
,
923 LSA_SEC_HANDLE
*credential
, TimeStamp
*ts_expiry
)
925 OM_uint32 ret
, minor_status
, expiry_time
;
926 gss_name_t principal
= GSS_C_NO_NAME
;
927 gss_cred_id_t cred_handle
;
929 if (principal_us
&& ((ret
= name_sspi_to_gss( principal_us
, &principal
)) != SEC_E_OK
)) return ret
;
931 ret
= pgss_acquire_cred( &minor_status
, principal
, GSS_C_INDEFINITE
, GSS_C_NULL_OID_SET
, cred_usage
,
932 &cred_handle
, NULL
, &expiry_time
);
933 TRACE( "gss_acquire_cred returned %08x minor status %08x\n", ret
, minor_status
);
934 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
935 if (ret
== GSS_S_COMPLETE
)
937 credhandle_gss_to_sspi( cred_handle
, credential
);
938 expirytime_gss_to_sspi( expiry_time
, ts_expiry
);
941 if (principal
!= GSS_C_NO_NAME
) pgss_release_name( &minor_status
, &principal
);
943 return status_gss_to_sspi( ret
);
945 #endif /* SONAME_LIBGSSAPI_KRB5 */
947 static NTSTATUS NTAPI
kerberos_SpAcquireCredentialsHandle(
948 UNICODE_STRING
*principal_us
, ULONG credential_use
, LUID
*logon_id
, void *auth_data
,
949 void *get_key_fn
, void *get_key_arg
, LSA_SEC_HANDLE
*credential
, TimeStamp
*ts_expiry
)
951 #ifdef SONAME_LIBGSSAPI_KRB5
952 gss_cred_usage_t cred_usage
;
955 TRACE( "(%s 0x%08x %p %p %p %p %p %p)\n", debugstr_us(principal_us
), credential_use
,
956 logon_id
, auth_data
, get_key_fn
, get_key_arg
, credential
, ts_expiry
);
958 switch (credential_use
)
960 case SECPKG_CRED_INBOUND
:
961 cred_usage
= GSS_C_ACCEPT
;
964 case SECPKG_CRED_OUTBOUND
:
965 if ((status
= init_creds( auth_data
)) != STATUS_SUCCESS
) return status
;
966 cred_usage
= GSS_C_INITIATE
;
969 case SECPKG_CRED_BOTH
:
970 cred_usage
= GSS_C_BOTH
;
974 return SEC_E_UNKNOWN_CREDENTIALS
;
977 return acquire_credentials_handle( principal_us
, cred_usage
, credential
, ts_expiry
);
979 FIXME( "(%s 0x%08x %p %p %p %p %p %p)\n", debugstr_us(principal_us
), credential_use
,
980 logon_id
, auth_data
, get_key_fn
, get_key_arg
, credential
, ts_expiry
);
981 FIXME( "Wine was built without Kerberos support.\n" );
982 return SEC_E_UNSUPPORTED_FUNCTION
;
986 static NTSTATUS NTAPI
kerberos_SpFreeCredentialsHandle( LSA_SEC_HANDLE credential
)
988 #ifdef SONAME_LIBGSSAPI_KRB5
989 OM_uint32 ret
, minor_status
;
990 gss_cred_id_t cred_handle
;
992 TRACE( "(%lx)\n", credential
);
994 if (!credential
) return SEC_E_INVALID_HANDLE
;
995 if (!(cred_handle
= credhandle_sspi_to_gss( credential
))) return SEC_E_OK
;
997 ret
= pgss_release_cred( &minor_status
, &cred_handle
);
998 TRACE( "gss_release_cred returned %08x minor status %08x\n", ret
, minor_status
);
999 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1001 return status_gss_to_sspi( ret
);
1003 FIXME( "(%lx)\n", credential
);
1004 return SEC_E_UNSUPPORTED_FUNCTION
;
1008 static NTSTATUS NTAPI
kerberos_SpInitLsaModeContext( LSA_SEC_HANDLE credential
, LSA_SEC_HANDLE context
,
1009 UNICODE_STRING
*target_name
, ULONG context_req
, ULONG target_data_rep
, SecBufferDesc
*input
,
1010 LSA_SEC_HANDLE
*new_context
, SecBufferDesc
*output
, ULONG
*context_attr
, TimeStamp
*ts_expiry
,
1011 BOOLEAN
*mapped_context
, SecBuffer
*context_data
)
1013 #ifdef SONAME_LIBGSSAPI_KRB5
1014 static const ULONG supported
= ISC_REQ_CONFIDENTIALITY
| ISC_REQ_INTEGRITY
| ISC_REQ_SEQUENCE_DETECT
|
1015 ISC_REQ_REPLAY_DETECT
| ISC_REQ_MUTUAL_AUTH
| ISC_REQ_USE_DCE_STYLE
;
1016 OM_uint32 ret
, minor_status
, ret_flags
= 0, expiry_time
, req_flags
= flags_isc_req_to_gss( context_req
);
1017 gss_cred_id_t cred_handle
;
1018 gss_ctx_id_t ctxt_handle
;
1019 gss_buffer_desc input_token
, output_token
;
1020 gss_name_t target
= GSS_C_NO_NAME
;
1023 TRACE( "(%lx %lx %s 0x%08x %u %p %p %p %p %p %p %p)\n", credential
, context
, debugstr_us(target_name
),
1024 context_req
, target_data_rep
, input
, new_context
, output
, context_attr
, ts_expiry
,
1025 mapped_context
, context_data
);
1026 if (context_req
& ~supported
)
1027 FIXME( "flags 0x%08x not supported\n", context_req
& ~supported
);
1029 if (!context
&& !input
&& !credential
) return SEC_E_INVALID_HANDLE
;
1030 cred_handle
= credhandle_sspi_to_gss( credential
);
1031 ctxt_handle
= ctxthandle_sspi_to_gss( context
);
1033 if ((idx
= get_buffer_index( input
, SECBUFFER_TOKEN
)) == -1) input_token
.length
= 0;
1036 input_token
.length
= input
->pBuffers
[idx
].cbBuffer
;
1037 input_token
.value
= input
->pBuffers
[idx
].pvBuffer
;
1040 if ((idx
= get_buffer_index( output
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1041 output_token
.length
= 0;
1042 output_token
.value
= NULL
;
1044 if (target_name
&& ((ret
= name_sspi_to_gss( target_name
, &target
)) != SEC_E_OK
)) return ret
;
1046 ret
= pgss_init_sec_context( &minor_status
, cred_handle
, &ctxt_handle
, target
, GSS_C_NO_OID
, req_flags
, 0,
1047 GSS_C_NO_CHANNEL_BINDINGS
, &input_token
, NULL
, &output_token
, &ret_flags
,
1049 TRACE( "gss_init_sec_context returned %08x minor status %08x ret_flags %08x\n", ret
, minor_status
, ret_flags
);
1050 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1051 if (ret
== GSS_S_COMPLETE
|| ret
== GSS_S_CONTINUE_NEEDED
)
1053 if (output_token
.length
> output
->pBuffers
[idx
].cbBuffer
) /* FIXME: check if larger buffer exists */
1055 TRACE( "buffer too small %lu > %u\n", (SIZE_T
)output_token
.length
, output
->pBuffers
[idx
].cbBuffer
);
1056 pgss_release_buffer( &minor_status
, &output_token
);
1057 pgss_delete_sec_context( &minor_status
, &ctxt_handle
, GSS_C_NO_BUFFER
);
1058 return SEC_E_INCOMPLETE_MESSAGE
;
1060 output
->pBuffers
[idx
].cbBuffer
= output_token
.length
;
1061 memcpy( output
->pBuffers
[idx
].pvBuffer
, output_token
.value
, output_token
.length
);
1062 pgss_release_buffer( &minor_status
, &output_token
);
1064 ctxthandle_gss_to_sspi( ctxt_handle
, new_context
);
1065 if (context_attr
) *context_attr
= flags_gss_to_isc_ret( ret_flags
);
1066 expirytime_gss_to_sspi( expiry_time
, ts_expiry
);
1069 if (target
!= GSS_C_NO_NAME
) pgss_release_name( &minor_status
, &target
);
1071 /* we do support user mode SSP/AP functions */
1072 *mapped_context
= TRUE
;
1073 /* FIXME: initialize context_data */
1075 return status_gss_to_sspi( ret
);
1077 FIXME( "(%lx %lx %s 0x%08x %u %p %p %p %p %p %p %p)\n", credential
, context
, debugstr_us(target_name
),
1078 context_req
, target_data_rep
, input
, new_context
, output
, context_attr
, ts_expiry
,
1079 mapped_context
, context_data
);
1080 return SEC_E_UNSUPPORTED_FUNCTION
;
1084 static NTSTATUS NTAPI
kerberos_SpAcceptLsaModeContext( LSA_SEC_HANDLE credential
, LSA_SEC_HANDLE context
,
1085 SecBufferDesc
*input
, ULONG context_req
, ULONG target_data_rep
, LSA_SEC_HANDLE
*new_context
,
1086 SecBufferDesc
*output
, ULONG
*context_attr
, TimeStamp
*ts_expiry
, BOOLEAN
*mapped_context
, SecBuffer
*context_data
)
1088 #ifdef SONAME_LIBGSSAPI_KRB5
1089 OM_uint32 ret
, minor_status
, ret_flags
= 0, expiry_time
;
1090 gss_cred_id_t cred_handle
;
1091 gss_ctx_id_t ctxt_handle
;
1092 gss_buffer_desc input_token
, output_token
;
1093 gss_name_t target
= GSS_C_NO_NAME
;
1096 TRACE( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential
, context
, context_req
,
1097 target_data_rep
, input
, new_context
, output
, context_attr
, ts_expiry
,
1098 mapped_context
, context_data
);
1099 if (context_req
) FIXME( "ignoring flags 0x%08x\n", context_req
);
1101 if (!context
&& !input
&& !credential
) return SEC_E_INVALID_HANDLE
;
1102 cred_handle
= credhandle_sspi_to_gss( credential
);
1103 ctxt_handle
= ctxthandle_sspi_to_gss( context
);
1105 if (!input
) input_token
.length
= 0;
1108 if ((idx
= get_buffer_index( input
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1109 input_token
.length
= input
->pBuffers
[idx
].cbBuffer
;
1110 input_token
.value
= input
->pBuffers
[idx
].pvBuffer
;
1113 if ((idx
= get_buffer_index( output
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1114 output_token
.length
= 0;
1115 output_token
.value
= NULL
;
1117 ret
= pgss_accept_sec_context( &minor_status
, &ctxt_handle
, cred_handle
, &input_token
, GSS_C_NO_CHANNEL_BINDINGS
,
1118 &target
, NULL
, &output_token
, &ret_flags
, &expiry_time
, NULL
);
1119 TRACE( "gss_accept_sec_context returned %08x minor status %08x ret_flags %08x\n", ret
, minor_status
, ret_flags
);
1120 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1121 if (ret
== GSS_S_COMPLETE
|| ret
== GSS_S_CONTINUE_NEEDED
)
1123 if (output_token
.length
> output
->pBuffers
[idx
].cbBuffer
) /* FIXME: check if larger buffer exists */
1125 TRACE( "buffer too small %lu > %u\n", (SIZE_T
)output_token
.length
, output
->pBuffers
[idx
].cbBuffer
);
1126 pgss_release_buffer( &minor_status
, &output_token
);
1127 pgss_delete_sec_context( &minor_status
, &ctxt_handle
, GSS_C_NO_BUFFER
);
1128 return SEC_E_BUFFER_TOO_SMALL
;
1130 output
->pBuffers
[idx
].cbBuffer
= output_token
.length
;
1131 memcpy( output
->pBuffers
[idx
].pvBuffer
, output_token
.value
, output_token
.length
);
1132 pgss_release_buffer( &minor_status
, &output_token
);
1134 ctxthandle_gss_to_sspi( ctxt_handle
, new_context
);
1135 if (context_attr
) *context_attr
= flags_gss_to_asc_ret( ret_flags
);
1136 expirytime_gss_to_sspi( expiry_time
, ts_expiry
);
1139 /* we do support user mode SSP/AP functions */
1140 *mapped_context
= TRUE
;
1141 /* FIXME: initialize context_data */
1143 return status_gss_to_sspi( ret
);
1145 FIXME( "(%lx %lx 0x%08x %u %p %p %p %p %p %p %p)\n", credential
, context
, context_req
,
1146 target_data_rep
, input
, new_context
, output
, context_attr
, ts_expiry
,
1147 mapped_context
, context_data
);
1148 return SEC_E_UNSUPPORTED_FUNCTION
;
1152 static NTSTATUS NTAPI
kerberos_SpDeleteContext( LSA_SEC_HANDLE context
)
1154 #ifdef SONAME_LIBGSSAPI_KRB5
1155 OM_uint32 ret
, minor_status
;
1156 gss_ctx_id_t ctxt_handle
;
1158 TRACE( "(%lx)\n", context
);
1159 if (!context
) return SEC_E_INVALID_HANDLE
;
1160 if (!(ctxt_handle
= ctxthandle_sspi_to_gss( context
))) return SEC_E_OK
;
1162 ret
= pgss_delete_sec_context( &minor_status
, &ctxt_handle
, GSS_C_NO_BUFFER
);
1163 TRACE( "gss_delete_sec_context returned %08x minor status %08x\n", ret
, minor_status
);
1164 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1166 return status_gss_to_sspi( ret
);
1168 FIXME( "(%lx)\n", context
);
1169 return SEC_E_UNSUPPORTED_FUNCTION
;
1173 static SecPkgInfoW
*build_package_info( const SecPkgInfoW
*info
)
1176 DWORD size_name
= (strlenW(info
->Name
) + 1) * sizeof(WCHAR
);
1177 DWORD size_comment
= (strlenW(info
->Comment
) + 1) * sizeof(WCHAR
);
1179 if (!(ret
= heap_alloc( sizeof(*ret
) + size_name
+ size_comment
))) return NULL
;
1180 ret
->fCapabilities
= info
->fCapabilities
;
1181 ret
->wVersion
= info
->wVersion
;
1182 ret
->wRPCID
= info
->wRPCID
;
1183 ret
->cbMaxToken
= info
->cbMaxToken
;
1184 ret
->Name
= (SEC_WCHAR
*)(ret
+ 1);
1185 memcpy( ret
->Name
, info
->Name
, size_name
);
1186 ret
->Comment
= (SEC_WCHAR
*)((char *)ret
->Name
+ size_name
);
1187 memcpy( ret
->Comment
, info
->Comment
, size_comment
);
1191 static NTSTATUS NTAPI
kerberos_SpQueryContextAttributes( LSA_SEC_HANDLE context
, ULONG attribute
, void *buffer
)
1193 TRACE( "(%lx %u %p)\n", context
, attribute
, buffer
);
1195 if (!context
) return SEC_E_INVALID_HANDLE
;
1199 #define X(x) case (x) : FIXME(#x" stub\n"); break
1200 X(SECPKG_ATTR_ACCESS_TOKEN
);
1201 X(SECPKG_ATTR_AUTHORITY
);
1202 X(SECPKG_ATTR_DCE_INFO
);
1203 X(SECPKG_ATTR_KEY_INFO
);
1204 X(SECPKG_ATTR_LIFESPAN
);
1205 X(SECPKG_ATTR_NAMES
);
1206 X(SECPKG_ATTR_NATIVE_NAMES
);
1207 X(SECPKG_ATTR_PACKAGE_INFO
);
1208 X(SECPKG_ATTR_PASSWORD_EXPIRY
);
1209 X(SECPKG_ATTR_SESSION_KEY
);
1210 X(SECPKG_ATTR_STREAM_SIZES
);
1211 X(SECPKG_ATTR_TARGET_INFORMATION
);
1212 case SECPKG_ATTR_SIZES
:
1214 SecPkgContext_Sizes
*sizes
= (SecPkgContext_Sizes
*)buffer
;
1215 ULONG size_max_signature
= 37, size_security_trailer
= 49;
1216 #ifdef SONAME_LIBGSSAPI_KRB5
1217 gss_ctx_id_t ctxt_handle
;
1219 if (!(ctxt_handle
= ctxthandle_sspi_to_gss( context
))) return SEC_E_INVALID_HANDLE
;
1220 if (is_dce_style_context( ctxt_handle
))
1222 size_max_signature
= 28;
1223 size_security_trailer
= 76;
1226 sizes
->cbMaxToken
= KERBEROS_MAX_BUF
;
1227 sizes
->cbMaxSignature
= size_max_signature
;
1228 sizes
->cbBlockSize
= 1;
1229 sizes
->cbSecurityTrailer
= size_security_trailer
;
1232 case SECPKG_ATTR_NEGOTIATION_INFO
:
1234 SecPkgContext_NegotiationInfoW
*info
= (SecPkgContext_NegotiationInfoW
*)buffer
;
1235 if (!(info
->PackageInfo
= build_package_info( &infoW
))) return SEC_E_INSUFFICIENT_MEMORY
;
1236 info
->NegotiationState
= SECPKG_NEGOTIATION_COMPLETE
;
1241 FIXME( "unknown attribute %u\n", attribute
);
1245 return SEC_E_UNSUPPORTED_FUNCTION
;
1248 static NTSTATUS NTAPI
kerberos_SpInitialize(ULONG_PTR package_id
, SECPKG_PARAMETERS
*params
,
1249 LSA_SECPKG_FUNCTION_TABLE
*lsa_function_table
)
1251 TRACE("%lu,%p,%p\n", package_id
, params
, lsa_function_table
);
1253 #ifdef SONAME_LIBGSSAPI_KRB5
1254 if (load_gssapi_krb5()) return STATUS_SUCCESS
;
1257 return STATUS_UNSUCCESSFUL
;
1260 static NTSTATUS NTAPI
kerberos_SpShutdown(void)
1264 #ifdef SONAME_LIBGSSAPI_KRB5
1265 unload_gssapi_krb5();
1268 return STATUS_SUCCESS
;
1271 static SECPKG_FUNCTION_TABLE kerberos_table
=
1273 kerberos_LsaApInitializePackage
, /* InitializePackage */
1274 NULL
, /* LsaLogonUser */
1275 NULL
, /* CallPackage */
1276 NULL
, /* LogonTerminated */
1277 kerberos_LsaApCallPackageUntrusted
, /* CallPackageUntrusted */
1278 NULL
, /* CallPackagePassthrough */
1279 NULL
, /* LogonUserEx */
1280 NULL
, /* LogonUserEx2 */
1281 kerberos_SpInitialize
,
1282 kerberos_SpShutdown
,
1284 NULL
, /* AcceptCredentials */
1285 kerberos_SpAcquireCredentialsHandle
,
1286 NULL
, /* SpQueryCredentialsAttributes */
1287 kerberos_SpFreeCredentialsHandle
,
1288 NULL
, /* SaveCredentials */
1289 NULL
, /* GetCredentials */
1290 NULL
, /* DeleteCredentials */
1291 kerberos_SpInitLsaModeContext
,
1292 kerberos_SpAcceptLsaModeContext
,
1293 kerberos_SpDeleteContext
,
1294 NULL
, /* ApplyControlToken */
1295 NULL
, /* GetUserInfo */
1296 NULL
, /* GetExtendedInformation */
1297 kerberos_SpQueryContextAttributes
,
1298 NULL
, /* SpAddCredentials */
1299 NULL
, /* SetExtendedInformation */
1300 NULL
, /* SetContextAttributes */
1301 NULL
, /* SetCredentialsAttributes */
1302 NULL
, /* ChangeAccountPassword */
1303 NULL
, /* QueryMetaData */
1304 NULL
, /* ExchangeMetaData */
1305 NULL
, /* GetCredUIContext */
1306 NULL
, /* UpdateCredentials */
1307 NULL
, /* ValidateTargetInfo */
1308 NULL
, /* PostLogonUser */
1311 NTSTATUS NTAPI
SpLsaModeInitialize(ULONG lsa_version
, PULONG package_version
,
1312 PSECPKG_FUNCTION_TABLE
*table
, PULONG table_count
)
1314 TRACE("%#x,%p,%p,%p\n", lsa_version
, package_version
, table
, table_count
);
1316 *package_version
= SECPKG_INTERFACE_VERSION
;
1317 *table
= &kerberos_table
;
1320 return STATUS_SUCCESS
;
1323 static NTSTATUS NTAPI
kerberos_SpInstanceInit(ULONG version
, SECPKG_DLL_FUNCTIONS
*dll_function_table
, void **user_functions
)
1325 FIXME("%u,%p,%p: stub\n", version
, dll_function_table
, user_functions
);
1327 return STATUS_SUCCESS
;
1330 static NTSTATUS SEC_ENTRY
kerberos_SpMakeSignature( LSA_SEC_HANDLE context
, ULONG quality_of_protection
,
1331 SecBufferDesc
*message
, ULONG message_seq_no
)
1333 #ifdef SONAME_LIBGSSAPI_KRB5
1334 OM_uint32 ret
, minor_status
;
1335 gss_buffer_desc data_buffer
, token_buffer
;
1336 gss_ctx_id_t ctxt_handle
;
1337 int data_idx
, token_idx
;
1339 TRACE( "(%lx 0x%08x %p %u)\n", context
, quality_of_protection
, message
, message_seq_no
);
1340 if (quality_of_protection
) FIXME( "ignoring quality_of_protection 0x%08x\n", quality_of_protection
);
1341 if (message_seq_no
) FIXME( "ignoring message_seq_no %u\n", message_seq_no
);
1343 if (!context
) return SEC_E_INVALID_HANDLE
;
1344 ctxt_handle
= ctxthandle_sspi_to_gss( context
);
1346 /* FIXME: multiple data buffers, read-only buffers */
1347 if ((data_idx
= get_buffer_index( message
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
1348 data_buffer
.length
= message
->pBuffers
[data_idx
].cbBuffer
;
1349 data_buffer
.value
= message
->pBuffers
[data_idx
].pvBuffer
;
1351 if ((token_idx
= get_buffer_index( message
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1352 token_buffer
.length
= 0;
1353 token_buffer
.value
= NULL
;
1355 ret
= pgss_get_mic( &minor_status
, ctxt_handle
, GSS_C_QOP_DEFAULT
, &data_buffer
, &token_buffer
);
1356 TRACE( "gss_get_mic returned %08x minor status %08x\n", ret
, minor_status
);
1357 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1358 if (ret
== GSS_S_COMPLETE
)
1360 memcpy( message
->pBuffers
[token_idx
].pvBuffer
, token_buffer
.value
, token_buffer
.length
);
1361 message
->pBuffers
[token_idx
].cbBuffer
= token_buffer
.length
;
1362 pgss_release_buffer( &minor_status
, &token_buffer
);
1365 return status_gss_to_sspi( ret
);
1367 FIXME( "(%lx 0x%08x %p %u)\n", context
, quality_of_protection
, message
, message_seq_no
);
1368 return SEC_E_UNSUPPORTED_FUNCTION
;
1372 static SECURITY_STATUS SEC_ENTRY
kerberos_SpVerifySignature( LSA_SEC_HANDLE context
, SecBufferDesc
*message
,
1373 ULONG message_seq_no
, ULONG
*quality_of_protection
)
1375 #ifdef SONAME_LIBGSSAPI_KRB5
1376 OM_uint32 ret
, minor_status
;
1377 gss_buffer_desc data_buffer
, token_buffer
;
1378 gss_ctx_id_t ctxt_handle
;
1379 int data_idx
, token_idx
;
1381 TRACE( "(%lx %p %u %p)\n", context
, message
, message_seq_no
, quality_of_protection
);
1382 if (message_seq_no
) FIXME( "ignoring message_seq_no %u\n", message_seq_no
);
1384 if (!context
) return SEC_E_INVALID_HANDLE
;
1385 ctxt_handle
= ctxthandle_sspi_to_gss( context
);
1387 if ((data_idx
= get_buffer_index( message
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
1388 data_buffer
.length
= message
->pBuffers
[data_idx
].cbBuffer
;
1389 data_buffer
.value
= message
->pBuffers
[data_idx
].pvBuffer
;
1391 if ((token_idx
= get_buffer_index( message
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1392 token_buffer
.length
= message
->pBuffers
[token_idx
].cbBuffer
;
1393 token_buffer
.value
= message
->pBuffers
[token_idx
].pvBuffer
;
1395 ret
= pgss_verify_mic( &minor_status
, ctxt_handle
, &data_buffer
, &token_buffer
, NULL
);
1396 TRACE( "gss_verify_mic returned %08x minor status %08x\n", ret
, minor_status
);
1397 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1398 if (ret
== GSS_S_COMPLETE
&& quality_of_protection
) *quality_of_protection
= 0;
1400 return status_gss_to_sspi( ret
);
1402 FIXME( "(%lx %p %u %p)\n", context
, message
, message_seq_no
, quality_of_protection
);
1403 return SEC_E_UNSUPPORTED_FUNCTION
;
1407 #ifdef SONAME_LIBGSSAPI_KRB5
1408 static NTSTATUS
seal_message_iov( gss_ctx_id_t ctxt_handle
, SecBufferDesc
*message
)
1410 gss_iov_buffer_desc iov
[4];
1411 OM_uint32 ret
, minor_status
;
1412 int token_idx
, data_idx
, conf_state
;
1414 /* FIXME: multiple data buffers, read-only buffers */
1415 if ((data_idx
= get_buffer_index( message
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
1416 if ((token_idx
= get_buffer_index( message
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1418 iov
[0].type
= GSS_IOV_BUFFER_TYPE_SIGN_ONLY
| GSS_IOV_BUFFER_FLAG_ALLOCATE
;
1419 iov
[0].buffer
.length
= 0;
1420 iov
[0].buffer
.value
= NULL
;
1422 iov
[1].type
= GSS_IOV_BUFFER_TYPE_DATA
;
1423 iov
[1].buffer
.length
= message
->pBuffers
[data_idx
].cbBuffer
;
1424 iov
[1].buffer
.value
= message
->pBuffers
[data_idx
].pvBuffer
;
1426 iov
[2].type
= GSS_IOV_BUFFER_TYPE_SIGN_ONLY
| GSS_IOV_BUFFER_FLAG_ALLOCATE
;
1427 iov
[2].buffer
.length
= 0;
1428 iov
[2].buffer
.value
= NULL
;
1430 iov
[3].type
= GSS_IOV_BUFFER_TYPE_HEADER
| GSS_IOV_BUFFER_FLAG_ALLOCATE
;
1431 iov
[3].buffer
.length
= 0;
1432 iov
[3].buffer
.value
= NULL
;
1434 ret
= pgss_wrap_iov( &minor_status
, ctxt_handle
, 1, GSS_C_QOP_DEFAULT
, &conf_state
, iov
, 4 );
1435 TRACE( "gss_wrap_iov returned %08x minor status %08x\n", ret
, minor_status
);
1436 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1437 if (ret
== GSS_S_COMPLETE
)
1439 memcpy( message
->pBuffers
[token_idx
].pvBuffer
, iov
[3].buffer
.value
, iov
[3].buffer
.length
);
1440 message
->pBuffers
[token_idx
].cbBuffer
= iov
[3].buffer
.length
;
1441 pgss_release_iov_buffer( &minor_status
, iov
, 4 );
1444 return status_gss_to_sspi( ret
);
1447 static NTSTATUS
seal_message( gss_ctx_id_t ctxt_handle
, SecBufferDesc
*message
)
1449 gss_buffer_desc input
, output
;
1450 OM_uint32 ret
, minor_status
;
1451 int token_idx
, data_idx
, conf_state
;
1453 /* FIXME: multiple data buffers, read-only buffers */
1454 if ((data_idx
= get_buffer_index( message
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
1455 if ((token_idx
= get_buffer_index( message
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1457 input
.length
= message
->pBuffers
[data_idx
].cbBuffer
;
1458 input
.value
= message
->pBuffers
[data_idx
].pvBuffer
;
1460 ret
= pgss_wrap( &minor_status
, ctxt_handle
, 1, GSS_C_QOP_DEFAULT
, &input
, &conf_state
, &output
);
1461 TRACE( "gss_wrap returned %08x minor status %08x\n", ret
, minor_status
);
1462 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1463 if (ret
== GSS_S_COMPLETE
)
1465 DWORD len_data
= message
->pBuffers
[data_idx
].cbBuffer
, len_token
= message
->pBuffers
[token_idx
].cbBuffer
;
1466 if (len_token
< output
.length
- len_data
)
1468 TRACE( "buffer too small %lu > %u\n", (SIZE_T
)output
.length
- len_data
, len_token
);
1469 pgss_release_buffer( &minor_status
, &output
);
1470 return SEC_E_BUFFER_TOO_SMALL
;
1472 memcpy( message
->pBuffers
[data_idx
].pvBuffer
, output
.value
, len_data
);
1473 memcpy( message
->pBuffers
[token_idx
].pvBuffer
, (char *)output
.value
+ len_data
, output
.length
- len_data
);
1474 message
->pBuffers
[token_idx
].cbBuffer
= output
.length
- len_data
;
1475 pgss_release_buffer( &minor_status
, &output
);
1478 return status_gss_to_sspi( ret
);
1482 static NTSTATUS NTAPI
kerberos_SpSealMessage( LSA_SEC_HANDLE context
, ULONG quality_of_protection
,
1483 SecBufferDesc
*message
, ULONG message_seq_no
)
1485 #ifdef SONAME_LIBGSSAPI_KRB5
1486 gss_ctx_id_t ctxt_handle
;
1488 TRACE( "(%lx 0x%08x %p %u)\n", context
, quality_of_protection
, message
, message_seq_no
);
1489 if (quality_of_protection
)
1491 FIXME( "flags %08x not supported\n", quality_of_protection
);
1492 return SEC_E_UNSUPPORTED_FUNCTION
;
1494 if (message_seq_no
) FIXME( "ignoring message_seq_no %u\n", message_seq_no
);
1496 if (!context
) return SEC_E_INVALID_HANDLE
;
1497 ctxt_handle
= ctxthandle_sspi_to_gss( context
);
1499 if (is_dce_style_context( ctxt_handle
)) return seal_message_iov( ctxt_handle
, message
);
1500 return seal_message( ctxt_handle
, message
);
1502 FIXME( "(%lx 0x%08x %p %u)\n", context
, quality_of_protection
, message
, message_seq_no
);
1503 return SEC_E_UNSUPPORTED_FUNCTION
;
1507 #ifdef SONAME_LIBGSSAPI_KRB5
1508 static NTSTATUS
unseal_message_iov( gss_ctx_id_t ctxt_handle
, SecBufferDesc
*message
, ULONG
*quality_of_protection
)
1510 gss_iov_buffer_desc iov
[4];
1511 OM_uint32 ret
, minor_status
;
1512 int token_idx
, data_idx
, conf_state
;
1514 if ((data_idx
= get_buffer_index( message
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
1515 if ((token_idx
= get_buffer_index( message
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1517 iov
[0].type
= GSS_IOV_BUFFER_TYPE_SIGN_ONLY
;
1518 iov
[0].buffer
.length
= 0;
1519 iov
[0].buffer
.value
= NULL
;
1521 iov
[1].type
= GSS_IOV_BUFFER_TYPE_DATA
;
1522 iov
[1].buffer
.length
= message
->pBuffers
[data_idx
].cbBuffer
;
1523 iov
[1].buffer
.value
= message
->pBuffers
[data_idx
].pvBuffer
;
1525 iov
[2].type
= GSS_IOV_BUFFER_TYPE_SIGN_ONLY
;
1526 iov
[2].buffer
.length
= 0;
1527 iov
[2].buffer
.value
= NULL
;
1529 iov
[3].type
= GSS_IOV_BUFFER_TYPE_HEADER
;
1530 iov
[3].buffer
.length
= message
->pBuffers
[token_idx
].cbBuffer
;
1531 iov
[3].buffer
.value
= message
->pBuffers
[token_idx
].pvBuffer
;
1533 ret
= pgss_unwrap_iov( &minor_status
, ctxt_handle
, &conf_state
, NULL
, iov
, 4 );
1534 TRACE( "gss_unwrap_iov returned %08x minor status %08x\n", ret
, minor_status
);
1535 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1536 if (ret
== GSS_S_COMPLETE
&& quality_of_protection
)
1538 *quality_of_protection
= (conf_state
? 0 : SECQOP_WRAP_NO_ENCRYPT
);
1540 return status_gss_to_sspi( ret
);
1543 static NTSTATUS
unseal_message( gss_ctx_id_t ctxt_handle
, SecBufferDesc
*message
, ULONG
*quality_of_protection
)
1545 gss_buffer_desc input
, output
;
1546 OM_uint32 ret
, minor_status
;
1547 int token_idx
, data_idx
, conf_state
;
1548 DWORD len_data
, len_token
;
1550 if ((data_idx
= get_buffer_index( message
, SECBUFFER_DATA
)) == -1) return SEC_E_INVALID_TOKEN
;
1551 if ((token_idx
= get_buffer_index( message
, SECBUFFER_TOKEN
)) == -1) return SEC_E_INVALID_TOKEN
;
1553 len_data
= message
->pBuffers
[data_idx
].cbBuffer
;
1554 len_token
= message
->pBuffers
[token_idx
].cbBuffer
;
1556 input
.length
= len_data
+ len_token
;
1557 if (!(input
.value
= heap_alloc( input
.length
))) return SEC_E_INSUFFICIENT_MEMORY
;
1558 memcpy( input
.value
, message
->pBuffers
[data_idx
].pvBuffer
, len_data
);
1559 memcpy( (char *)input
.value
+ len_data
, message
->pBuffers
[token_idx
].pvBuffer
, len_token
);
1561 ret
= pgss_unwrap( &minor_status
, ctxt_handle
, &input
, &output
, &conf_state
, NULL
);
1562 heap_free( input
.value
);
1563 TRACE( "gss_unwrap returned %08x minor status %08x\n", ret
, minor_status
);
1564 if (GSS_ERROR(ret
)) trace_gss_status( ret
, minor_status
);
1565 if (ret
== GSS_S_COMPLETE
)
1567 if (quality_of_protection
) *quality_of_protection
= (conf_state
? 0 : SECQOP_WRAP_NO_ENCRYPT
);
1568 memcpy( message
->pBuffers
[data_idx
].pvBuffer
, output
.value
, len_data
);
1569 pgss_release_buffer( &minor_status
, &output
);
1572 return status_gss_to_sspi( ret
);
1576 static NTSTATUS NTAPI
kerberos_SpUnsealMessage( LSA_SEC_HANDLE context
, SecBufferDesc
*message
,
1577 ULONG message_seq_no
, ULONG
*quality_of_protection
)
1579 #ifdef SONAME_LIBGSSAPI_KRB5
1580 gss_ctx_id_t ctxt_handle
;
1582 TRACE( "(%lx %p %u %p)\n", context
, message
, message_seq_no
, quality_of_protection
);
1583 if (message_seq_no
) FIXME( "ignoring message_seq_no %u\n", message_seq_no
);
1585 if (!context
) return SEC_E_INVALID_HANDLE
;
1586 ctxt_handle
= ctxthandle_sspi_to_gss( context
);
1588 if (is_dce_style_context( ctxt_handle
)) return unseal_message_iov( ctxt_handle
, message
, quality_of_protection
);
1589 return unseal_message( ctxt_handle
, message
, quality_of_protection
);
1591 FIXME( "(%lx %p %u %p)\n", context
, message
, message_seq_no
, quality_of_protection
);
1592 return SEC_E_UNSUPPORTED_FUNCTION
;
1596 static SECPKG_USER_FUNCTION_TABLE kerberos_user_table
=
1598 kerberos_SpInstanceInit
,
1599 NULL
, /* SpInitUserModeContext */
1600 kerberos_SpMakeSignature
,
1601 kerberos_SpVerifySignature
,
1602 kerberos_SpSealMessage
,
1603 kerberos_SpUnsealMessage
,
1604 NULL
, /* SpGetContextToken */
1605 NULL
, /* SpQueryContextAttributes */
1606 NULL
, /* SpCompleteAuthToken */
1607 NULL
, /* SpDeleteContext */
1608 NULL
, /* SpFormatCredentialsFn */
1609 NULL
, /* SpMarshallSupplementalCreds */
1610 NULL
, /* SpExportSecurityContext */
1611 NULL
/* SpImportSecurityContext */
1614 NTSTATUS NTAPI
SpUserModeInitialize(ULONG lsa_version
, PULONG package_version
,
1615 PSECPKG_USER_FUNCTION_TABLE
*table
, PULONG table_count
)
1617 TRACE("%#x,%p,%p,%p\n", lsa_version
, package_version
, table
, table_count
);
1619 *package_version
= SECPKG_INTERFACE_VERSION
;
1620 *table
= &kerberos_user_table
;
1623 return STATUS_SUCCESS
;