FreeRDP
Loading...
Searching...
No Matches
sspi_winpr.c
1
21#include <winpr/config.h>
22#include <winpr/assert.h>
23#include <winpr/windows.h>
24
25#include <winpr/crt.h>
26#include <winpr/sspi.h>
27#include <winpr/ssl.h>
28#include <winpr/print.h>
29
30#include "sspi.h"
31
32#include "sspi_winpr.h"
33
34#include "../utils.h"
35#include "../log.h"
36#define TAG WINPR_TAG("sspi")
37
38/* Authentication Functions: http://msdn.microsoft.com/en-us/library/windows/desktop/aa374731/ */
39
40#include "NTLM/ntlm.h"
41#include "NTLM/ntlm_export.h"
42#include "CredSSP/credssp.h"
43#include "Kerberos/kerberos.h"
44#include "Negotiate/negotiate.h"
45#include "Schannel/schannel.h"
46
47static const SecPkgInfoA* SecPkgInfoA_LIST[] = { &NTLM_SecPkgInfoA, &KERBEROS_SecPkgInfoA,
48 &NEGOTIATE_SecPkgInfoA, &CREDSSP_SecPkgInfoA,
49 &SCHANNEL_SecPkgInfoA };
50
51static const SecPkgInfoW* SecPkgInfoW_LIST[] = { &NTLM_SecPkgInfoW, &KERBEROS_SecPkgInfoW,
52 &NEGOTIATE_SecPkgInfoW, &CREDSSP_SecPkgInfoW,
53 &SCHANNEL_SecPkgInfoW };
54
55typedef struct
56{
57 const SEC_CHAR* Name;
58 const SecurityFunctionTableA* SecurityFunctionTable;
59} SecurityFunctionTableA_NAME;
60
61typedef struct
62{
63 const SEC_WCHAR* Name;
64 const SecurityFunctionTableW* SecurityFunctionTable;
65} SecurityFunctionTableW_NAME;
66
67static const SecurityFunctionTableA_NAME SecurityFunctionTableA_NAME_LIST[] = {
68 { "NTLM", &NTLM_SecurityFunctionTableA },
69 { "Kerberos", &KERBEROS_SecurityFunctionTableA },
70 { "Negotiate", &NEGOTIATE_SecurityFunctionTableA },
71 { "CREDSSP", &CREDSSP_SecurityFunctionTableA },
72 { "Schannel", &SCHANNEL_SecurityFunctionTableA }
73};
74
75static WCHAR BUFFER_NAME_LIST_W[5][32] = WINPR_C_ARRAY_INIT;
76
77static const SecurityFunctionTableW_NAME SecurityFunctionTableW_NAME_LIST[] = {
78 { BUFFER_NAME_LIST_W[0], &NTLM_SecurityFunctionTableW },
79 { BUFFER_NAME_LIST_W[1], &KERBEROS_SecurityFunctionTableW },
80 { BUFFER_NAME_LIST_W[2], &NEGOTIATE_SecurityFunctionTableW },
81 { BUFFER_NAME_LIST_W[3], &CREDSSP_SecurityFunctionTableW },
82 { BUFFER_NAME_LIST_W[4], &SCHANNEL_SecurityFunctionTableW }
83};
84
85typedef struct
86{
87 void* contextBuffer;
88 UINT32 allocatorIndex;
89} CONTEXT_BUFFER_ALLOC_ENTRY;
90
91typedef struct
92{
93 UINT32 cEntries;
94 UINT32 cMaxEntries;
95 CONTEXT_BUFFER_ALLOC_ENTRY* entries;
96} CONTEXT_BUFFER_ALLOC_TABLE;
97
98static CONTEXT_BUFFER_ALLOC_TABLE ContextBufferAllocTable = WINPR_C_ARRAY_INIT;
99
100static int sspi_ContextBufferAllocTableNew(void)
101{
102 size_t size = 0;
103 ContextBufferAllocTable.entries = nullptr;
104 ContextBufferAllocTable.cEntries = 0;
105 ContextBufferAllocTable.cMaxEntries = 4;
106 size = sizeof(CONTEXT_BUFFER_ALLOC_ENTRY) * ContextBufferAllocTable.cMaxEntries;
107 ContextBufferAllocTable.entries = (CONTEXT_BUFFER_ALLOC_ENTRY*)calloc(1, size);
108
109 if (!ContextBufferAllocTable.entries)
110 return -1;
111
112 return 1;
113}
114
115static int sspi_ContextBufferAllocTableGrow(void)
116{
117 size_t size = 0;
118 CONTEXT_BUFFER_ALLOC_ENTRY* entries = nullptr;
119 ContextBufferAllocTable.cEntries = 0;
120 ContextBufferAllocTable.cMaxEntries *= 2;
121 size = sizeof(CONTEXT_BUFFER_ALLOC_ENTRY) * ContextBufferAllocTable.cMaxEntries;
122
123 if (!size)
124 return -1;
125
126 entries = (CONTEXT_BUFFER_ALLOC_ENTRY*)realloc(ContextBufferAllocTable.entries, size);
127
128 if (!entries)
129 {
130 free(ContextBufferAllocTable.entries);
131 return -1;
132 }
133
134 ContextBufferAllocTable.entries = entries;
135 ZeroMemory((void*)&ContextBufferAllocTable.entries[ContextBufferAllocTable.cMaxEntries / 2],
136 size / 2);
137 return 1;
138}
139
140static void sspi_ContextBufferAllocTableFree(void)
141{
142 if (ContextBufferAllocTable.cEntries != 0)
143 WLog_ERR(TAG, "ContextBufferAllocTable.entries == %" PRIu32,
144 ContextBufferAllocTable.cEntries);
145
146 ContextBufferAllocTable.cEntries = ContextBufferAllocTable.cMaxEntries = 0;
147 free(ContextBufferAllocTable.entries);
148 ContextBufferAllocTable.entries = nullptr;
149}
150
151void* sspi_ContextBufferAlloc(UINT32 allocatorIndex, size_t size)
152{
153 void* contextBuffer = nullptr;
154
155 for (UINT32 index = 0; index < ContextBufferAllocTable.cMaxEntries; index++)
156 {
157 if (!ContextBufferAllocTable.entries[index].contextBuffer)
158 {
159 contextBuffer = calloc(1, size);
160
161 if (!contextBuffer)
162 return nullptr;
163
164 ContextBufferAllocTable.cEntries++;
165 ContextBufferAllocTable.entries[index].contextBuffer = contextBuffer;
166 ContextBufferAllocTable.entries[index].allocatorIndex = allocatorIndex;
167 return ContextBufferAllocTable.entries[index].contextBuffer;
168 }
169 }
170
171 /* no available entry was found, the table needs to be grown */
172
173 if (sspi_ContextBufferAllocTableGrow() < 0)
174 return nullptr;
175
176 /* the next call to sspi_ContextBufferAlloc() should now succeed */
177 return sspi_ContextBufferAlloc(allocatorIndex, size);
178}
179
180SSPI_CREDENTIALS* sspi_CredentialsNew(void)
181{
182 SSPI_CREDENTIALS* credentials = (SSPI_CREDENTIALS*)calloc(1, sizeof(SSPI_CREDENTIALS));
183 if (!credentials)
184 return nullptr;
185
186 credentials->ntlmSettingsV2 = sspi_AllocSecNtlmSettings();
187 if (!credentials->ntlmSettingsV2)
188 {
189 sspi_CredentialsFree(credentials);
190 return nullptr;
191 }
192
193 return credentials;
194}
195
196void sspi_CredentialsFree(SSPI_CREDENTIALS* credentials)
197{
198 if (!credentials)
199 return;
200
201 size_t userLength = credentials->identity.UserLength;
202 size_t domainLength = credentials->identity.DomainLength;
203 size_t passwordLength = credentials->identity.PasswordLength;
204
205 if (credentials->identity.Flags & SEC_WINNT_AUTH_IDENTITY_UNICODE)
206 {
207 userLength *= 2;
208 domainLength *= 2;
209 passwordLength *= 2;
210 }
211
212 if (credentials->identity.User)
213 memset(credentials->identity.User, 0, userLength);
214 if (credentials->identity.Domain)
215 memset(credentials->identity.Domain, 0, domainLength);
216 if (credentials->identity.Password)
217 memset(credentials->identity.Password, 0, passwordLength);
218 free(credentials->identity.User);
219 free(credentials->identity.Domain);
220 free(credentials->identity.Password);
221 sspi_FreeSecNtlmSettings(credentials->ntlmSettingsV2);
222
223 free(credentials);
224}
225
226void* sspi_SecBufferAlloc(PSecBuffer SecBuffer, ULONG size)
227{
228 if (!SecBuffer)
229 return nullptr;
230
231 SecBuffer->pvBuffer = calloc(1, size);
232
233 if (!SecBuffer->pvBuffer)
234 return nullptr;
235
236 SecBuffer->cbBuffer = size;
237 return SecBuffer->pvBuffer;
238}
239
240void sspi_SecBufferFree(PSecBuffer SecBuffer)
241{
242 if (!SecBuffer)
243 return;
244
245 if (SecBuffer->pvBuffer)
246 memset(SecBuffer->pvBuffer, 0, SecBuffer->cbBuffer);
247
248 free(SecBuffer->pvBuffer);
249 SecBuffer->pvBuffer = nullptr;
250 SecBuffer->cbBuffer = 0;
251}
252
253SecHandle* sspi_SecureHandleAlloc(void)
254{
255 SecHandle* handle = (SecHandle*)calloc(1, sizeof(SecHandle));
256
257 if (!handle)
258 return nullptr;
259
260 SecInvalidateHandle(handle);
261 return handle;
262}
263
264void* sspi_SecureHandleGetLowerPointer(SecHandle* handle)
265{
266 void* pointer = nullptr;
267
268 if (!handle || !SecIsValidHandle(handle) || !handle->dwLower)
269 return nullptr;
270
271 pointer = (void*)~((size_t)handle->dwLower);
272 return pointer;
273}
274
275void sspi_SecureHandleInvalidate(SecHandle* handle)
276{
277 if (!handle)
278 return;
279
280 handle->dwLower = 0;
281 handle->dwUpper = 0;
282}
283
284void sspi_SecureHandleSetLowerPointer(SecHandle* handle, void* pointer)
285{
286 if (!handle)
287 return;
288
289 handle->dwLower = (ULONG_PTR)(~((size_t)pointer));
290}
291
292void* sspi_SecureHandleGetUpperPointer(SecHandle* handle)
293{
294 void* pointer = nullptr;
295
296 if (!handle || !SecIsValidHandle(handle) || !handle->dwUpper)
297 return nullptr;
298
299 pointer = (void*)~((size_t)handle->dwUpper);
300 return pointer;
301}
302
303void sspi_SecureHandleSetUpperPointer(SecHandle* handle, void* pointer)
304{
305 if (!handle)
306 return;
307
308 handle->dwUpper = (ULONG_PTR)(~((size_t)pointer));
309}
310
311SSPI_PACKAGE_ID sspi_SecureHandleGetPackageId(SecHandle* handle)
312{
313 if (!handle || !SecIsValidHandle(handle) || !handle->dwUpper)
314 return SSPI_PACKAGE_NONE;
315
316 return (SSPI_PACKAGE_ID)(~((size_t)handle->dwUpper));
317}
318
319void sspi_SecureHandleSetPackageId(SecHandle* handle, SSPI_PACKAGE_ID id)
320{
321 if (!handle)
322 return;
323
324 handle->dwUpper = (ULONG_PTR)(~((size_t)id));
325}
326
327void sspi_SecureHandleFree(SecHandle* handle)
328{
329 free(handle);
330}
331
332int sspi_SetAuthIdentityW(SEC_WINNT_AUTH_IDENTITY* identity, const WCHAR* user, const WCHAR* domain,
333 const WCHAR* password)
334{
335 return sspi_SetAuthIdentityWithLengthW(identity, user, user ? _wcslen(user) : 0, domain,
336 domain ? _wcslen(domain) : 0, password,
337 password ? _wcslen(password) : 0);
338}
339
340static BOOL copy(WCHAR** dst, ULONG* dstLen, const WCHAR* what, size_t len)
341{
342 WINPR_ASSERT(dst);
343 WINPR_ASSERT(dstLen);
344
345 *dst = nullptr;
346 *dstLen = 0;
347
348 if (len > UINT32_MAX)
349 return FALSE;
350
351 /* Case what="" and len=0 should allocate an empty string */
352 if (!what && (len != 0))
353 return FALSE;
354 if (!what && (len == 0))
355 return TRUE;
356
357 *dst = calloc(sizeof(WCHAR), len + 1);
358 if (!*dst)
359 return FALSE;
360
361 memcpy(*dst, what, len * sizeof(WCHAR));
362 *dstLen = WINPR_ASSERTING_INT_CAST(UINT32, len);
363 return TRUE;
364}
365
366int sspi_SetAuthIdentityWithLengthW(SEC_WINNT_AUTH_IDENTITY* identity, const WCHAR* user,
367 size_t userLen, const WCHAR* domain, size_t domainLen,
368 const WCHAR* password, size_t passwordLen)
369{
370 WINPR_ASSERT(identity);
371 sspi_FreeAuthIdentity(identity);
372 identity->Flags &= (uint32_t)~SEC_WINNT_AUTH_IDENTITY_ANSI;
373 identity->Flags |= SEC_WINNT_AUTH_IDENTITY_UNICODE;
374
375 if (!copy(&identity->User, &identity->UserLength, user, userLen))
376 return -1;
377
378 if (!copy(&identity->Domain, &identity->DomainLength, domain, domainLen))
379 return -1;
380
381 if (!copy(&identity->Password, &identity->PasswordLength, password, passwordLen))
382 return -1;
383
384 return 1;
385}
386
387static void zfree(WCHAR* str, size_t len)
388{
389 if (str)
390 memset(str, 0, len * sizeof(WCHAR));
391 free(str);
392}
393
394int sspi_SetAuthIdentityA(SEC_WINNT_AUTH_IDENTITY* identity, const char* user, const char* domain,
395 const char* password)
396{
397 int rc = 0;
398 size_t unicodeUserLenW = 0;
399 size_t unicodeDomainLenW = 0;
400 size_t unicodePasswordLenW = 0;
401 LPWSTR unicodeUser = nullptr;
402 LPWSTR unicodeDomain = nullptr;
403 LPWSTR unicodePassword = nullptr;
404
405 if (user)
406 unicodeUser = ConvertUtf8ToWCharAlloc(user, &unicodeUserLenW);
407
408 if (domain)
409 unicodeDomain = ConvertUtf8ToWCharAlloc(domain, &unicodeDomainLenW);
410
411 if (password)
412 unicodePassword = ConvertUtf8ToWCharAlloc(password, &unicodePasswordLenW);
413
414 rc = sspi_SetAuthIdentityWithLengthW(identity, unicodeUser, unicodeUserLenW, unicodeDomain,
415 unicodeDomainLenW, unicodePassword, unicodePasswordLenW);
416
417 zfree(unicodeUser, unicodeUserLenW);
418 zfree(unicodeDomain, unicodeDomainLenW);
419 zfree(unicodePassword, unicodePasswordLenW);
420 return rc;
421}
422
423UINT32 sspi_GetAuthIdentityVersion(const void* identity)
424{
425 UINT32 version = 0;
426
427 if (!identity)
428 return 0;
429
430 version = *((const UINT32*)identity);
431
432 if ((version == SEC_WINNT_AUTH_IDENTITY_VERSION) ||
433 (version == SEC_WINNT_AUTH_IDENTITY_VERSION_2))
434 {
435 return version;
436 }
437
438 return 0; // SEC_WINNT_AUTH_IDENTITY (no version)
439}
440
441UINT32 sspi_GetAuthIdentityFlags(const void* identity)
442{
443 UINT32 version = 0;
444 UINT32 flags = 0;
445
446 if (!identity)
447 return 0;
448
449 version = sspi_GetAuthIdentityVersion(identity);
450
451 if (version == SEC_WINNT_AUTH_IDENTITY_VERSION)
452 {
453 flags = ((const SEC_WINNT_AUTH_IDENTITY_EX*)identity)->Flags;
454 }
455 else if (version == SEC_WINNT_AUTH_IDENTITY_VERSION_2)
456 {
457 flags = ((const SEC_WINNT_AUTH_IDENTITY_EX2*)identity)->Flags;
458 }
459 else // SEC_WINNT_AUTH_IDENTITY
460 {
461 flags = ((const SEC_WINNT_AUTH_IDENTITY*)identity)->Flags;
462 }
463
464 return flags;
465}
466
467BOOL sspi_GetAuthIdentityUserDomainW(const void* identity, const WCHAR** pUser, UINT32* pUserLength,
468 const WCHAR** pDomain, UINT32* pDomainLength)
469{
470 UINT32 version = 0;
471
472 if (!identity)
473 return FALSE;
474
475 version = sspi_GetAuthIdentityVersion(identity);
476
477 if (version == SEC_WINNT_AUTH_IDENTITY_VERSION)
478 {
479 const SEC_WINNT_AUTH_IDENTITY_EXW* id = (const SEC_WINNT_AUTH_IDENTITY_EXW*)identity;
480 *pUser = (const WCHAR*)id->User;
481 *pUserLength = id->UserLength;
482 *pDomain = (const WCHAR*)id->Domain;
483 *pDomainLength = id->DomainLength;
484 }
485 else if (version == SEC_WINNT_AUTH_IDENTITY_VERSION_2)
486 {
487 const SEC_WINNT_AUTH_IDENTITY_EX2* id = (const SEC_WINNT_AUTH_IDENTITY_EX2*)identity;
488 UINT32 UserOffset = id->UserOffset;
489 UINT32 DomainOffset = id->DomainOffset;
490 *pUser = (const WCHAR*)&((const uint8_t*)identity)[UserOffset];
491 *pUserLength = id->UserLength / 2;
492 *pDomain = (const WCHAR*)&((const uint8_t*)identity)[DomainOffset];
493 *pDomainLength = id->DomainLength / 2;
494 }
495 else // SEC_WINNT_AUTH_IDENTITY
496 {
497 const SEC_WINNT_AUTH_IDENTITY_W* id = (const SEC_WINNT_AUTH_IDENTITY_W*)identity;
498 *pUser = (const WCHAR*)id->User;
499 *pUserLength = id->UserLength;
500 *pDomain = (const WCHAR*)id->Domain;
501 *pDomainLength = id->DomainLength;
502 }
503
504 return TRUE;
505}
506
507BOOL sspi_GetAuthIdentityUserDomainA(const void* identity, const char** pUser, UINT32* pUserLength,
508 const char** pDomain, UINT32* pDomainLength)
509{
510 UINT32 version = 0;
511
512 if (!identity)
513 return FALSE;
514
515 version = sspi_GetAuthIdentityVersion(identity);
516
517 if (version == SEC_WINNT_AUTH_IDENTITY_VERSION)
518 {
519 const SEC_WINNT_AUTH_IDENTITY_EXA* id = (const SEC_WINNT_AUTH_IDENTITY_EXA*)identity;
520 *pUser = (const char*)id->User;
521 *pUserLength = id->UserLength;
522 *pDomain = (const char*)id->Domain;
523 *pDomainLength = id->DomainLength;
524 }
525 else if (version == SEC_WINNT_AUTH_IDENTITY_VERSION_2)
526 {
527 const SEC_WINNT_AUTH_IDENTITY_EX2* id = (const SEC_WINNT_AUTH_IDENTITY_EX2*)identity;
528 UINT32 UserOffset = id->UserOffset;
529 UINT32 DomainOffset = id->DomainOffset;
530 *pUser = (const char*)&((const uint8_t*)identity)[UserOffset];
531 *pUserLength = id->UserLength;
532 *pDomain = (const char*)&((const uint8_t*)identity)[DomainOffset];
533 *pDomainLength = id->DomainLength;
534 }
535 else // SEC_WINNT_AUTH_IDENTITY
536 {
537 const SEC_WINNT_AUTH_IDENTITY_A* id = (const SEC_WINNT_AUTH_IDENTITY_A*)identity;
538 *pUser = (const char*)id->User;
539 *pUserLength = id->UserLength;
540 *pDomain = (const char*)id->Domain;
541 *pDomainLength = id->DomainLength;
542 }
543
544 return TRUE;
545}
546
547BOOL sspi_GetAuthIdentityPasswordW(const void* identity, const WCHAR** pPassword,
548 UINT32* pPasswordLength)
549{
550 UINT32 version = 0;
551
552 if (!identity)
553 return FALSE;
554
555 version = sspi_GetAuthIdentityVersion(identity);
556
557 if (version == SEC_WINNT_AUTH_IDENTITY_VERSION)
558 {
559 const SEC_WINNT_AUTH_IDENTITY_EXW* id = (const SEC_WINNT_AUTH_IDENTITY_EXW*)identity;
560 *pPassword = (const WCHAR*)id->Password;
561 *pPasswordLength = id->PasswordLength;
562 }
563 else if (version == SEC_WINNT_AUTH_IDENTITY_VERSION_2)
564 {
565 return FALSE; // TODO: packed credentials
566 }
567 else // SEC_WINNT_AUTH_IDENTITY
568 {
569 const SEC_WINNT_AUTH_IDENTITY_W* id = (const SEC_WINNT_AUTH_IDENTITY_W*)identity;
570 *pPassword = (const WCHAR*)id->Password;
571 *pPasswordLength = id->PasswordLength;
572 }
573
574 return TRUE;
575}
576
577BOOL sspi_GetAuthIdentityPasswordA(const void* identity, const char** pPassword,
578 UINT32* pPasswordLength)
579{
580 UINT32 version = 0;
581
582 if (!identity)
583 return FALSE;
584
585 version = sspi_GetAuthIdentityVersion(identity);
586
587 if (version == SEC_WINNT_AUTH_IDENTITY_VERSION)
588 {
589 const SEC_WINNT_AUTH_IDENTITY_EXA* id = (const SEC_WINNT_AUTH_IDENTITY_EXA*)identity;
590 *pPassword = (const char*)id->Password;
591 *pPasswordLength = id->PasswordLength;
592 }
593 else if (version == SEC_WINNT_AUTH_IDENTITY_VERSION_2)
594 {
595 return FALSE; // TODO: packed credentials
596 }
597 else // SEC_WINNT_AUTH_IDENTITY
598 {
599 const SEC_WINNT_AUTH_IDENTITY_A* id = (const SEC_WINNT_AUTH_IDENTITY_A*)identity;
600 *pPassword = (const char*)id->Password;
601 *pPasswordLength = id->PasswordLength;
602 }
603
604 return TRUE;
605}
606
607BOOL sspi_CopyAuthIdentityFieldsA(const SEC_WINNT_AUTH_IDENTITY_INFO* identity, char** pUser,
608 char** pDomain, char** pPassword)
609{
610 BOOL success = FALSE;
611 const char* UserA = nullptr;
612 const char* DomainA = nullptr;
613 const char* PasswordA = nullptr;
614 const WCHAR* UserW = nullptr;
615 const WCHAR* DomainW = nullptr;
616 const WCHAR* PasswordW = nullptr;
617 UINT32 UserLength = 0;
618 UINT32 DomainLength = 0;
619 UINT32 PasswordLength = 0;
620
621 if (!identity || !pUser || !pDomain || !pPassword)
622 return FALSE;
623
624 *pUser = *pDomain = *pPassword = nullptr;
625
626 UINT32 identityFlags = sspi_GetAuthIdentityFlags(identity);
627
628 if ((identityFlags & SEC_WINNT_AUTH_IDENTITY_ANSI) != 0)
629 {
630 if (!sspi_GetAuthIdentityUserDomainA(identity, &UserA, &UserLength, &DomainA,
631 &DomainLength))
632 goto cleanup;
633
634 if (!sspi_GetAuthIdentityPasswordA(identity, &PasswordA, &PasswordLength))
635 goto cleanup;
636
637 if (UserA && UserLength)
638 {
639 *pUser = _strdup(UserA);
640
641 if (!(*pUser))
642 goto cleanup;
643 }
644
645 if (DomainA && DomainLength)
646 {
647 *pDomain = _strdup(DomainA);
648
649 if (!(*pDomain))
650 goto cleanup;
651 }
652
653 if (PasswordA && PasswordLength)
654 {
655 *pPassword = _strdup(PasswordA);
656
657 if (!(*pPassword))
658 goto cleanup;
659 }
660
661 success = TRUE;
662 }
663 else if ((identityFlags & SEC_WINNT_AUTH_IDENTITY_UNICODE) != 0)
664 {
665 if (!sspi_GetAuthIdentityUserDomainW(identity, &UserW, &UserLength, &DomainW,
666 &DomainLength))
667 goto cleanup;
668
669 if (!sspi_GetAuthIdentityPasswordW(identity, &PasswordW, &PasswordLength))
670 goto cleanup;
671
672 if (UserW && (UserLength > 0))
673 {
674 *pUser = ConvertWCharNToUtf8Alloc(UserW, UserLength, nullptr);
675 if (!(*pUser))
676 goto cleanup;
677 }
678
679 if (DomainW && (DomainLength > 0))
680 {
681 *pDomain = ConvertWCharNToUtf8Alloc(DomainW, DomainLength, nullptr);
682 if (!(*pDomain))
683 goto cleanup;
684 }
685
686 if (PasswordW && (PasswordLength > 0))
687 {
688 *pPassword = ConvertWCharNToUtf8Alloc(PasswordW, PasswordLength, nullptr);
689 if (!(*pPassword))
690 goto cleanup;
691 }
692
693 success = TRUE;
694 }
695
696cleanup:
697 return success;
698}
699
700BOOL sspi_CopyAuthIdentityFieldsW(const SEC_WINNT_AUTH_IDENTITY_INFO* identity, WCHAR** pUser,
701 WCHAR** pDomain, WCHAR** pPassword)
702{
703 BOOL success = FALSE;
704 const char* UserA = nullptr;
705 const char* DomainA = nullptr;
706 const char* PasswordA = nullptr;
707 const WCHAR* UserW = nullptr;
708 const WCHAR* DomainW = nullptr;
709 const WCHAR* PasswordW = nullptr;
710 UINT32 UserLength = 0;
711 UINT32 DomainLength = 0;
712 UINT32 PasswordLength = 0;
713
714 if (!identity || !pUser || !pDomain || !pPassword)
715 return FALSE;
716
717 *pUser = *pDomain = *pPassword = nullptr;
718
719 UINT32 identityFlags = sspi_GetAuthIdentityFlags(identity);
720
721 if ((identityFlags & SEC_WINNT_AUTH_IDENTITY_ANSI) != 0)
722 {
723 if (!sspi_GetAuthIdentityUserDomainA(identity, &UserA, &UserLength, &DomainA,
724 &DomainLength))
725 goto cleanup;
726
727 if (!sspi_GetAuthIdentityPasswordA(identity, &PasswordA, &PasswordLength))
728 goto cleanup;
729
730 if (UserA && (UserLength > 0))
731 {
732 WCHAR* ptr = ConvertUtf8NToWCharAlloc(UserA, UserLength, nullptr);
733 *pUser = ptr;
734
735 if (!ptr)
736 goto cleanup;
737 }
738
739 if (DomainA && (DomainLength > 0))
740 {
741 WCHAR* ptr = ConvertUtf8NToWCharAlloc(DomainA, DomainLength, nullptr);
742 *pDomain = ptr;
743 if (!ptr)
744 goto cleanup;
745 }
746
747 if (PasswordA && (PasswordLength > 0))
748 {
749 WCHAR* ptr = ConvertUtf8NToWCharAlloc(PasswordA, PasswordLength, nullptr);
750
751 *pPassword = ptr;
752 if (!ptr)
753 goto cleanup;
754 }
755
756 success = TRUE;
757 }
758 else if ((identityFlags & SEC_WINNT_AUTH_IDENTITY_UNICODE) != 0)
759 {
760 if (!sspi_GetAuthIdentityUserDomainW(identity, &UserW, &UserLength, &DomainW,
761 &DomainLength))
762 goto cleanup;
763
764 if (!sspi_GetAuthIdentityPasswordW(identity, &PasswordW, &PasswordLength))
765 goto cleanup;
766
767 if (UserW && UserLength)
768 {
769 *pUser = winpr_wcsndup(UserW, UserLength / sizeof(WCHAR));
770
771 if (!(*pUser))
772 goto cleanup;
773 }
774
775 if (DomainW && DomainLength)
776 {
777 *pDomain = winpr_wcsndup(DomainW, DomainLength / sizeof(WCHAR));
778
779 if (!(*pDomain))
780 goto cleanup;
781 }
782
783 if (PasswordW && PasswordLength)
784 {
785 *pPassword = winpr_wcsndup(PasswordW, PasswordLength / sizeof(WCHAR));
786
787 if (!(*pPassword))
788 goto cleanup;
789 }
790
791 success = TRUE;
792 }
793
794cleanup:
795 return success;
796}
797
798BOOL sspi_CopyAuthPackageListA(const SEC_WINNT_AUTH_IDENTITY_INFO* identity, char** pPackageList)
799{
800 UINT32 version = 0;
801 UINT32 identityFlags = 0;
802 char* PackageList = nullptr;
803 const char* PackageListA = nullptr;
804 const WCHAR* PackageListW = nullptr;
805 UINT32 PackageListLength = 0;
806 UINT32 PackageListOffset = 0;
807 const void* pAuthData = (const void*)identity;
808
809 if (!pAuthData)
810 return FALSE;
811
812 version = sspi_GetAuthIdentityVersion(pAuthData);
813 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
814
815 if ((identityFlags & SEC_WINNT_AUTH_IDENTITY_ANSI) != 0)
816 {
817 if (version == SEC_WINNT_AUTH_IDENTITY_VERSION)
818 {
819 const SEC_WINNT_AUTH_IDENTITY_EXA* ad = (const SEC_WINNT_AUTH_IDENTITY_EXA*)pAuthData;
820 PackageListA = (const char*)ad->PackageList;
821 PackageListLength = ad->PackageListLength;
822 }
823
824 if (PackageListA && PackageListLength)
825 {
826 PackageList = _strdup(PackageListA);
827 }
828 }
829 else if ((identityFlags & SEC_WINNT_AUTH_IDENTITY_UNICODE) != 0)
830 {
831 if (version == SEC_WINNT_AUTH_IDENTITY_VERSION)
832 {
833 const SEC_WINNT_AUTH_IDENTITY_EXW* ad = (const SEC_WINNT_AUTH_IDENTITY_EXW*)pAuthData;
834 PackageListW = (const WCHAR*)ad->PackageList;
835 PackageListLength = ad->PackageListLength;
836 }
837 else if (version == SEC_WINNT_AUTH_IDENTITY_VERSION_2)
838 {
839 const SEC_WINNT_AUTH_IDENTITY_EX2* ad = (const SEC_WINNT_AUTH_IDENTITY_EX2*)pAuthData;
840 PackageListOffset = ad->PackageListOffset;
841 PackageListW = (const WCHAR*)&((const uint8_t*)pAuthData)[PackageListOffset];
842 PackageListLength = ad->PackageListLength / 2;
843 }
844
845 if (PackageListW && (PackageListLength > 0))
846 PackageList = ConvertWCharNToUtf8Alloc(PackageListW, PackageListLength, nullptr);
847 }
848
849 if (PackageList)
850 {
851 *pPackageList = PackageList;
852 return TRUE;
853 }
854
855 return FALSE;
856}
857
858int sspi_CopyAuthIdentity(SEC_WINNT_AUTH_IDENTITY* identity,
859 const SEC_WINNT_AUTH_IDENTITY_INFO* srcIdentity)
860{
861 int status = 0;
862 UINT32 identityFlags = 0;
863 const char* UserA = nullptr;
864 const char* DomainA = nullptr;
865 const char* PasswordA = nullptr;
866 const WCHAR* UserW = nullptr;
867 const WCHAR* DomainW = nullptr;
868 const WCHAR* PasswordW = nullptr;
869 UINT32 UserLength = 0;
870 UINT32 DomainLength = 0;
871 UINT32 PasswordLength = 0;
872
873 sspi_FreeAuthIdentity(identity);
874
875 identityFlags = sspi_GetAuthIdentityFlags(srcIdentity);
876
877 identity->Flags = identityFlags;
878
879 if ((identityFlags & SEC_WINNT_AUTH_IDENTITY_ANSI) != 0)
880 {
881 if (!sspi_GetAuthIdentityUserDomainA(srcIdentity, &UserA, &UserLength, &DomainA,
882 &DomainLength))
883 {
884 return -1;
885 }
886
887 if (!sspi_GetAuthIdentityPasswordA(srcIdentity, &PasswordA, &PasswordLength))
888 {
889 return -1;
890 }
891
892 status = sspi_SetAuthIdentity(identity, UserA, DomainA, PasswordA);
893
894 if (status <= 0)
895 return -1;
896
897 identity->Flags &= (uint32_t)~SEC_WINNT_AUTH_IDENTITY_ANSI;
898 identity->Flags |= SEC_WINNT_AUTH_IDENTITY_UNICODE;
899 return 1;
900 }
901
902 identity->Flags |= SEC_WINNT_AUTH_IDENTITY_UNICODE;
903
904 if (!sspi_GetAuthIdentityUserDomainW(srcIdentity, &UserW, &UserLength, &DomainW, &DomainLength))
905 {
906 return -1;
907 }
908
909 if (!sspi_GetAuthIdentityPasswordW(srcIdentity, &PasswordW, &PasswordLength))
910 {
911 return -1;
912 }
913
914 /* login/password authentication */
915 identity->UserLength = UserLength;
916
917 if (identity->UserLength > 0)
918 {
919 identity->User = (UINT16*)calloc((identity->UserLength + 1), sizeof(WCHAR));
920
921 if (!identity->User)
922 return -1;
923
924 CopyMemory(identity->User, UserW, identity->UserLength * sizeof(WCHAR));
925 identity->User[identity->UserLength] = 0;
926 }
927
928 identity->DomainLength = DomainLength;
929
930 if (identity->DomainLength > 0)
931 {
932 identity->Domain = (UINT16*)calloc((identity->DomainLength + 1), sizeof(WCHAR));
933
934 if (!identity->Domain)
935 return -1;
936
937 CopyMemory(identity->Domain, DomainW, identity->DomainLength * sizeof(WCHAR));
938 identity->Domain[identity->DomainLength] = 0;
939 }
940
941 identity->PasswordLength = PasswordLength;
942
943 if (PasswordW)
944 {
945 identity->Password = (UINT16*)calloc((identity->PasswordLength + 1), sizeof(WCHAR));
946
947 if (!identity->Password)
948 return -1;
949
950 CopyMemory(identity->Password, PasswordW, identity->PasswordLength * sizeof(WCHAR));
951 identity->Password[identity->PasswordLength] = 0;
952 }
953
954 /* End of login/password authentication */
955 return 1;
956}
957
958PSecBuffer sspi_FindSecBuffer(PSecBufferDesc pMessage, ULONG BufferType)
959{
960 PSecBuffer pSecBuffer = nullptr;
961
962 for (UINT32 index = 0; index < pMessage->cBuffers; index++)
963 {
964 if (pMessage->pBuffers[index].BufferType == BufferType)
965 {
966 pSecBuffer = &pMessage->pBuffers[index];
967 break;
968 }
969 }
970
971 return pSecBuffer;
972}
973
974static BOOL WINPR_init(void)
975{
976
977 for (size_t x = 0; x < ARRAYSIZE(SecurityFunctionTableA_NAME_LIST); x++)
978 {
979 const SecurityFunctionTableA_NAME* cur = &SecurityFunctionTableA_NAME_LIST[x];
980 InitializeConstWCharFromUtf8(cur->Name, BUFFER_NAME_LIST_W[x],
981 ARRAYSIZE(BUFFER_NAME_LIST_W[x]));
982 }
983 return TRUE;
984}
985
986static BOOL CALLBACK sspi_init(WINPR_ATTR_UNUSED PINIT_ONCE InitOnce,
987 WINPR_ATTR_UNUSED PVOID Parameter, WINPR_ATTR_UNUSED PVOID* Context)
988{
989 if (!winpr_InitializeSSL(WINPR_SSL_INIT_DEFAULT))
990 return FALSE;
991 sspi_ContextBufferAllocTableNew();
992 if (!SCHANNEL_init())
993 return FALSE;
994 if (!KERBEROS_init())
995 return FALSE;
996 if (!NTLM_init())
997 return FALSE;
998 if (!CREDSSP_init())
999 return FALSE;
1000 if (!NEGOTIATE_init())
1001 return FALSE;
1002 return WINPR_init();
1003}
1004
1005void sspi_GlobalInit(void)
1006{
1007 static INIT_ONCE once = INIT_ONCE_STATIC_INIT;
1008 DWORD flags = 0;
1009
1010 /* Dispatch indexes these lists with SSPI_PACKAGE_ID - 1, so every one of them must have
1011 * exactly one entry per package, in the order the enum declares. Adding a package to the
1012 * enum without extending all four lists (and the W name buffers) would otherwise read past
1013 * the end or dispatch to the wrong package, silently. */
1014 WINPR_STATIC_ASSERT(ARRAYSIZE(SecPkgInfoA_LIST) == SSPI_PACKAGE_COUNT - 1);
1015 WINPR_STATIC_ASSERT(ARRAYSIZE(SecPkgInfoW_LIST) == SSPI_PACKAGE_COUNT - 1);
1016 WINPR_STATIC_ASSERT(ARRAYSIZE(SecurityFunctionTableA_NAME_LIST) == SSPI_PACKAGE_COUNT - 1);
1017 WINPR_STATIC_ASSERT(ARRAYSIZE(SecurityFunctionTableW_NAME_LIST) == SSPI_PACKAGE_COUNT - 1);
1018 WINPR_STATIC_ASSERT(ARRAYSIZE(BUFFER_NAME_LIST_W) == SSPI_PACKAGE_COUNT - 1);
1019
1020 if (!InitOnceExecuteOnce(&once, sspi_init, &flags, nullptr))
1021 WLog_ERR(TAG, "InitOnceExecuteOnce failed");
1022}
1023
1024void sspi_GlobalFinish(void)
1025{
1026 sspi_ContextBufferAllocTableFree();
1027}
1028
1029static const SecurityFunctionTableA* sspi_GetSecurityFunctionTableAByNameA(const SEC_CHAR* Name)
1030{
1031 size_t cPackages = ARRAYSIZE(SecPkgInfoA_LIST);
1032
1033 for (size_t index = 0; index < cPackages; index++)
1034 {
1035 if (strcmp(Name, SecurityFunctionTableA_NAME_LIST[index].Name) == 0)
1036 {
1037 return SecurityFunctionTableA_NAME_LIST[index].SecurityFunctionTable;
1038 }
1039 }
1040
1041 return nullptr;
1042}
1043
1044static const SecurityFunctionTableW* sspi_GetSecurityFunctionTableWByNameW(const SEC_WCHAR* Name)
1045{
1046 size_t cPackages = ARRAYSIZE(SecPkgInfoW_LIST);
1047
1048 for (size_t index = 0; index < cPackages; index++)
1049 {
1050 if (_wcscmp(Name, SecurityFunctionTableW_NAME_LIST[index].Name) == 0)
1051 {
1052 return SecurityFunctionTableW_NAME_LIST[index].SecurityFunctionTable;
1053 }
1054 }
1055
1056 return nullptr;
1057}
1058
1059/* Table lookup for the context/credential dispatch wrappers, which identify their package
1060 * by the handle itself. Takes the handle rather than an index so the identifier is read in
1061 * one place instead of at every call site. */
1062WINPR_ATTR_NODISCARD static const SecurityFunctionTableA*
1063sspi_GetSecurityFunctionTableAByHandle(SecHandle* handle)
1064{
1065 const SSPI_PACKAGE_ID id = sspi_SecureHandleGetPackageId(handle);
1066
1067 if ((id < SSPI_PACKAGE_NTLM) || (id > ARRAYSIZE(SecurityFunctionTableA_NAME_LIST)))
1068 return nullptr;
1069
1070 return SecurityFunctionTableA_NAME_LIST[id - 1].SecurityFunctionTable;
1071}
1072
1073WINPR_ATTR_NODISCARD static const SecurityFunctionTableW*
1074sspi_GetSecurityFunctionTableWByHandle(SecHandle* handle)
1075{
1076 const SSPI_PACKAGE_ID id = sspi_SecureHandleGetPackageId(handle);
1077
1078 if ((id < SSPI_PACKAGE_NTLM) || (id > ARRAYSIZE(SecurityFunctionTableW_NAME_LIST)))
1079 return nullptr;
1080
1081 return SecurityFunctionTableW_NAME_LIST[id - 1].SecurityFunctionTable;
1082}
1083
1084static void FreeContextBuffer_EnumerateSecurityPackages(void* contextBuffer);
1085static void FreeContextBuffer_QuerySecurityPackageInfo(void* contextBuffer);
1086
1087void sspi_ContextBufferFree(void* contextBuffer)
1088{
1089 UINT32 allocatorIndex = 0;
1090
1091 for (size_t index = 0; index < ContextBufferAllocTable.cMaxEntries; index++)
1092 {
1093 if (contextBuffer == ContextBufferAllocTable.entries[index].contextBuffer)
1094 {
1095 contextBuffer = ContextBufferAllocTable.entries[index].contextBuffer;
1096 allocatorIndex = ContextBufferAllocTable.entries[index].allocatorIndex;
1097 ContextBufferAllocTable.cEntries--;
1098 ContextBufferAllocTable.entries[index].allocatorIndex = 0;
1099 ContextBufferAllocTable.entries[index].contextBuffer = nullptr;
1100
1101 switch (allocatorIndex)
1102 {
1103 case EnumerateSecurityPackagesIndex:
1104 FreeContextBuffer_EnumerateSecurityPackages(contextBuffer);
1105 break;
1106
1107 case QuerySecurityPackageInfoIndex:
1108 FreeContextBuffer_QuerySecurityPackageInfo(contextBuffer);
1109 break;
1110 default:
1111 break;
1112 }
1113 }
1114 }
1115}
1116
1121/* Package Management */
1122
1123static SECURITY_STATUS SEC_ENTRY winpr_EnumerateSecurityPackagesW(ULONG* pcPackages,
1124 PSecPkgInfoW* ppPackageInfo)
1125{
1126 const size_t cPackages = ARRAYSIZE(SecPkgInfoW_LIST);
1127 const size_t size = sizeof(SecPkgInfoW) * cPackages;
1128 SecPkgInfoW* pPackageInfo =
1129 (SecPkgInfoW*)sspi_ContextBufferAlloc(EnumerateSecurityPackagesIndex, size);
1130
1131 WINPR_ASSERT(cPackages <= UINT32_MAX);
1132
1133 if (!pPackageInfo)
1134 return SEC_E_INSUFFICIENT_MEMORY;
1135
1136 for (size_t index = 0; index < cPackages; index++)
1137 {
1138 pPackageInfo[index].fCapabilities = SecPkgInfoW_LIST[index]->fCapabilities;
1139 pPackageInfo[index].wVersion = SecPkgInfoW_LIST[index]->wVersion;
1140 pPackageInfo[index].wRPCID = SecPkgInfoW_LIST[index]->wRPCID;
1141 pPackageInfo[index].cbMaxToken = SecPkgInfoW_LIST[index]->cbMaxToken;
1142 pPackageInfo[index].Name = _wcsdup(SecPkgInfoW_LIST[index]->Name);
1143 pPackageInfo[index].Comment = _wcsdup(SecPkgInfoW_LIST[index]->Comment);
1144 }
1145
1146 *(pcPackages) = (UINT32)cPackages;
1147 *(ppPackageInfo) = pPackageInfo;
1148 return SEC_E_OK;
1149}
1150
1151static SECURITY_STATUS SEC_ENTRY winpr_EnumerateSecurityPackagesA(ULONG* pcPackages,
1152 PSecPkgInfoA* ppPackageInfo)
1153{
1154 const size_t cPackages = ARRAYSIZE(SecPkgInfoA_LIST);
1155 const size_t size = sizeof(SecPkgInfoA) * cPackages;
1156 SecPkgInfoA* pPackageInfo =
1157 (SecPkgInfoA*)sspi_ContextBufferAlloc(EnumerateSecurityPackagesIndex, size);
1158
1159 WINPR_ASSERT(cPackages <= UINT32_MAX);
1160
1161 if (!pPackageInfo)
1162 return SEC_E_INSUFFICIENT_MEMORY;
1163
1164 for (size_t index = 0; index < cPackages; index++)
1165 {
1166 pPackageInfo[index].fCapabilities = SecPkgInfoA_LIST[index]->fCapabilities;
1167 pPackageInfo[index].wVersion = SecPkgInfoA_LIST[index]->wVersion;
1168 pPackageInfo[index].wRPCID = SecPkgInfoA_LIST[index]->wRPCID;
1169 pPackageInfo[index].cbMaxToken = SecPkgInfoA_LIST[index]->cbMaxToken;
1170 pPackageInfo[index].Name = _strdup(SecPkgInfoA_LIST[index]->Name);
1171 pPackageInfo[index].Comment = _strdup(SecPkgInfoA_LIST[index]->Comment);
1172
1173 if (!pPackageInfo[index].Name || !pPackageInfo[index].Comment)
1174 {
1175 sspi_ContextBufferFree(pPackageInfo);
1176 return SEC_E_INSUFFICIENT_MEMORY;
1177 }
1178 }
1179
1180 *(pcPackages) = (UINT32)cPackages;
1181 *(ppPackageInfo) = pPackageInfo;
1182 return SEC_E_OK;
1183}
1184
1185static void FreeContextBuffer_EnumerateSecurityPackages(void* contextBuffer)
1186{
1187 SecPkgInfoA* pPackageInfo = (SecPkgInfoA*)contextBuffer;
1188 size_t cPackages = ARRAYSIZE(SecPkgInfoA_LIST);
1189
1190 if (!pPackageInfo)
1191 return;
1192
1193 for (size_t index = 0; index < cPackages; index++)
1194 {
1195 free(pPackageInfo[index].Name);
1196 free(pPackageInfo[index].Comment);
1197 }
1198
1199 free(pPackageInfo);
1200}
1201
1202static SECURITY_STATUS SEC_ENTRY winpr_QuerySecurityPackageInfoW(SEC_WCHAR* pszPackageName,
1203 PSecPkgInfoW* ppPackageInfo)
1204{
1205 size_t cPackages = ARRAYSIZE(SecPkgInfoW_LIST);
1206
1207 for (size_t index = 0; index < cPackages; index++)
1208 {
1209 if (_wcscmp(pszPackageName, SecPkgInfoW_LIST[index]->Name) == 0)
1210 {
1211 size_t size = sizeof(SecPkgInfoW);
1212 SecPkgInfoW* pPackageInfo =
1213 (SecPkgInfoW*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1214
1215 if (!pPackageInfo)
1216 return SEC_E_INSUFFICIENT_MEMORY;
1217
1218 pPackageInfo->fCapabilities = SecPkgInfoW_LIST[index]->fCapabilities;
1219 pPackageInfo->wVersion = SecPkgInfoW_LIST[index]->wVersion;
1220 pPackageInfo->wRPCID = SecPkgInfoW_LIST[index]->wRPCID;
1221 pPackageInfo->cbMaxToken = SecPkgInfoW_LIST[index]->cbMaxToken;
1222 pPackageInfo->Name = _wcsdup(SecPkgInfoW_LIST[index]->Name);
1223 pPackageInfo->Comment = _wcsdup(SecPkgInfoW_LIST[index]->Comment);
1224 *(ppPackageInfo) = pPackageInfo;
1225 return SEC_E_OK;
1226 }
1227 }
1228
1229 *(ppPackageInfo) = nullptr;
1230 return SEC_E_SECPKG_NOT_FOUND;
1231}
1232
1233static SECURITY_STATUS SEC_ENTRY winpr_QuerySecurityPackageInfoA(SEC_CHAR* pszPackageName,
1234 PSecPkgInfoA* ppPackageInfo)
1235{
1236 size_t cPackages = ARRAYSIZE(SecPkgInfoA_LIST);
1237
1238 for (size_t index = 0; index < cPackages; index++)
1239 {
1240 if (strcmp(pszPackageName, SecPkgInfoA_LIST[index]->Name) == 0)
1241 {
1242 size_t size = sizeof(SecPkgInfoA);
1243 SecPkgInfoA* pPackageInfo =
1244 (SecPkgInfoA*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1245
1246 if (!pPackageInfo)
1247 return SEC_E_INSUFFICIENT_MEMORY;
1248
1249 pPackageInfo->fCapabilities = SecPkgInfoA_LIST[index]->fCapabilities;
1250 pPackageInfo->wVersion = SecPkgInfoA_LIST[index]->wVersion;
1251 pPackageInfo->wRPCID = SecPkgInfoA_LIST[index]->wRPCID;
1252 pPackageInfo->cbMaxToken = SecPkgInfoA_LIST[index]->cbMaxToken;
1253 pPackageInfo->Name = _strdup(SecPkgInfoA_LIST[index]->Name);
1254 pPackageInfo->Comment = _strdup(SecPkgInfoA_LIST[index]->Comment);
1255
1256 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1257 {
1258 sspi_ContextBufferFree(pPackageInfo);
1259 return SEC_E_INSUFFICIENT_MEMORY;
1260 }
1261
1262 *(ppPackageInfo) = pPackageInfo;
1263 return SEC_E_OK;
1264 }
1265 }
1266
1267 *(ppPackageInfo) = nullptr;
1268 return SEC_E_SECPKG_NOT_FOUND;
1269}
1270
1271void FreeContextBuffer_QuerySecurityPackageInfo(void* contextBuffer)
1272{
1273 SecPkgInfo* pPackageInfo = (SecPkgInfo*)contextBuffer;
1274
1275 if (!pPackageInfo)
1276 return;
1277
1278 free(pPackageInfo->Name);
1279 free(pPackageInfo->Comment);
1280 free(pPackageInfo);
1281}
1282
1283#define log_status(what, status) log_status_((what), (status), __FILE__, __func__, __LINE__)
1284static SECURITY_STATUS log_status_(const char* what, SECURITY_STATUS status, const char* file,
1285 const char* fkt, size_t line)
1286{
1287 if (IsSecurityStatusError(status))
1288 {
1289 const DWORD level = WLOG_WARN;
1290 static wLog* log = nullptr;
1291 if (!log)
1292 log = WLog_Get(TAG);
1293
1294 if (WLog_IsLevelActive(log, level))
1295 {
1296 WLog_PrintTextMessage(log, level, line, file, fkt, "%s status %s [0x%08" PRIx32 "]",
1297 what, GetSecurityStatusString(status),
1298 WINPR_CXX_COMPAT_CAST(uint32_t, status));
1299 }
1300 }
1301 return status;
1302}
1303
1304/* Credential Management */
1305
1306static SECURITY_STATUS SEC_ENTRY winpr_AcquireCredentialsHandleW(
1307 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
1308 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
1309 PTimeStamp ptsExpiry)
1310{
1311 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByNameW(pszPackage);
1312
1313 if (!table)
1314 return SEC_E_SECPKG_NOT_FOUND;
1315
1316 if (!table->AcquireCredentialsHandleW)
1317 {
1318 WLog_WARN(TAG, "Security module does not provide an implementation");
1319 return SEC_E_UNSUPPORTED_FUNCTION;
1320 }
1321
1322 SECURITY_STATUS status = table->AcquireCredentialsHandleW(
1323 pszPrincipal, pszPackage, fCredentialUse, pvLogonID, pAuthData, pGetKeyFn, pvGetKeyArgument,
1324 phCredential, ptsExpiry);
1325 return log_status("AcquireCredentialsHandleW", status);
1326}
1327
1328static SECURITY_STATUS SEC_ENTRY winpr_AcquireCredentialsHandleA(
1329 SEC_CHAR* pszPrincipal, SEC_CHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
1330 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
1331 PTimeStamp ptsExpiry)
1332{
1333 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByNameA(pszPackage);
1334
1335 if (!table)
1336 return SEC_E_SECPKG_NOT_FOUND;
1337
1338 if (!table->AcquireCredentialsHandleA)
1339 {
1340 WLog_WARN(TAG, "Security module does not provide an implementation");
1341 return SEC_E_UNSUPPORTED_FUNCTION;
1342 }
1343
1344 SECURITY_STATUS status = table->AcquireCredentialsHandleA(
1345 pszPrincipal, pszPackage, fCredentialUse, pvLogonID, pAuthData, pGetKeyFn, pvGetKeyArgument,
1346 phCredential, ptsExpiry);
1347 return log_status("AcquireCredentialsHandleA", status);
1348}
1349
1350static SECURITY_STATUS SEC_ENTRY winpr_ExportSecurityContext(PCtxtHandle phContext, ULONG fFlags,
1351 PSecBuffer pPackedContext,
1352 HANDLE* pToken)
1353{
1354 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phContext);
1355
1356 if (!table)
1357 return SEC_E_SECPKG_NOT_FOUND;
1358
1359 if (!table->ExportSecurityContext)
1360 {
1361 WLog_WARN(TAG, "Security module does not provide an implementation");
1362 return SEC_E_UNSUPPORTED_FUNCTION;
1363 }
1364
1365 SECURITY_STATUS status =
1366 table->ExportSecurityContext(phContext, fFlags, pPackedContext, pToken);
1367 return log_status("ExportSecurityContext", status);
1368}
1369
1370static SECURITY_STATUS SEC_ENTRY winpr_FreeCredentialsHandle(PCredHandle phCredential)
1371{
1372 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phCredential);
1373
1374 if (!table)
1375 return SEC_E_SECPKG_NOT_FOUND;
1376
1377 if (!table->FreeCredentialsHandle)
1378 {
1379 WLog_WARN(TAG, "Security module does not provide an implementation");
1380 return SEC_E_UNSUPPORTED_FUNCTION;
1381 }
1382
1383 SECURITY_STATUS status = table->FreeCredentialsHandle(phCredential);
1384 return log_status("FreeCredentialsHandle", status);
1385}
1386
1387static SECURITY_STATUS SEC_ENTRY winpr_ImportSecurityContextW(SEC_WCHAR* pszPackage,
1388 PSecBuffer pPackedContext,
1389 HANDLE pToken, PCtxtHandle phContext)
1390{
1391 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phContext);
1392
1393 if (!table)
1394 return SEC_E_SECPKG_NOT_FOUND;
1395
1396 if (!table->ImportSecurityContextW)
1397 {
1398 WLog_WARN(TAG, "Security module does not provide an implementation");
1399 return SEC_E_UNSUPPORTED_FUNCTION;
1400 }
1401
1402 SECURITY_STATUS status =
1403 table->ImportSecurityContextW(pszPackage, pPackedContext, pToken, phContext);
1404 return log_status("ImportSecurityContextW", status);
1405}
1406
1407static SECURITY_STATUS SEC_ENTRY winpr_ImportSecurityContextA(SEC_CHAR* pszPackage,
1408 PSecBuffer pPackedContext,
1409 HANDLE pToken, PCtxtHandle phContext)
1410{
1411 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1412
1413 if (!table)
1414 return SEC_E_SECPKG_NOT_FOUND;
1415
1416 if (!table->ImportSecurityContextA)
1417 {
1418 WLog_WARN(TAG, "Security module does not provide an implementation");
1419 return SEC_E_UNSUPPORTED_FUNCTION;
1420 }
1421
1422 SECURITY_STATUS status =
1423 table->ImportSecurityContextA(pszPackage, pPackedContext, pToken, phContext);
1424 return log_status("ImportSecurityContextA", status);
1425}
1426
1427static SECURITY_STATUS SEC_ENTRY winpr_QueryCredentialsAttributesW(PCredHandle phCredential,
1428 ULONG ulAttribute, void* pBuffer)
1429{
1430 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phCredential);
1431
1432 if (!table)
1433 return SEC_E_SECPKG_NOT_FOUND;
1434
1435 if (!table->QueryCredentialsAttributesW)
1436 {
1437 WLog_WARN(TAG, "Security module does not provide an implementation");
1438 return SEC_E_UNSUPPORTED_FUNCTION;
1439 }
1440
1441 SECURITY_STATUS status = table->QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
1442 return log_status("QueryCredentialsAttributesW", status);
1443}
1444
1445static SECURITY_STATUS SEC_ENTRY winpr_QueryCredentialsAttributesA(PCredHandle phCredential,
1446 ULONG ulAttribute, void* pBuffer)
1447{
1448 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phCredential);
1449
1450 if (!table)
1451 return SEC_E_SECPKG_NOT_FOUND;
1452
1453 if (!table->QueryCredentialsAttributesA)
1454 {
1455 WLog_WARN(TAG, "Security module does not provide an implementation");
1456 return SEC_E_UNSUPPORTED_FUNCTION;
1457 }
1458
1459 SECURITY_STATUS status = table->QueryCredentialsAttributesA(phCredential, ulAttribute, pBuffer);
1460 return log_status("QueryCredentialsAttributesA", status);
1461}
1462
1463static SECURITY_STATUS SEC_ENTRY winpr_SetCredentialsAttributesW(PCredHandle phCredential,
1464 ULONG ulAttribute, void* pBuffer,
1465 ULONG cbBuffer)
1466{
1467 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phCredential);
1468
1469 if (!table)
1470 return SEC_E_SECPKG_NOT_FOUND;
1471
1472 if (!table->SetCredentialsAttributesW)
1473 {
1474 WLog_WARN(TAG, "Security module does not provide an implementation");
1475 return SEC_E_UNSUPPORTED_FUNCTION;
1476 }
1477
1478 SECURITY_STATUS status =
1479 table->SetCredentialsAttributesW(phCredential, ulAttribute, pBuffer, cbBuffer);
1480 return log_status("SetCredentialsAttributesW", status);
1481}
1482
1483static SECURITY_STATUS SEC_ENTRY winpr_SetCredentialsAttributesA(PCredHandle phCredential,
1484 ULONG ulAttribute, void* pBuffer,
1485 ULONG cbBuffer)
1486{
1487 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phCredential);
1488
1489 if (!table)
1490 return SEC_E_SECPKG_NOT_FOUND;
1491
1492 if (!table->SetCredentialsAttributesA)
1493 {
1494 WLog_WARN(TAG, "Security module does not provide an implementation");
1495 return SEC_E_UNSUPPORTED_FUNCTION;
1496 }
1497
1498 SECURITY_STATUS status =
1499 table->SetCredentialsAttributesA(phCredential, ulAttribute, pBuffer, cbBuffer);
1500 return log_status("SetCredentialsAttributesA", status);
1501}
1502
1503/* Context Management */
1504
1505static SECURITY_STATUS SEC_ENTRY
1506winpr_AcceptSecurityContext(PCredHandle phCredential, PCtxtHandle phContext, PSecBufferDesc pInput,
1507 ULONG fContextReq, ULONG TargetDataRep, PCtxtHandle phNewContext,
1508 PSecBufferDesc pOutput, PULONG pfContextAttr, PTimeStamp ptsTimeStamp)
1509{
1510 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phCredential);
1511
1512 if (!table)
1513 return SEC_E_SECPKG_NOT_FOUND;
1514
1515 if (!table->AcceptSecurityContext)
1516 {
1517 WLog_WARN(TAG, "Security module does not provide an implementation");
1518 return SEC_E_UNSUPPORTED_FUNCTION;
1519 }
1520
1521 SECURITY_STATUS status =
1522 table->AcceptSecurityContext(phCredential, phContext, pInput, fContextReq, TargetDataRep,
1523 phNewContext, pOutput, pfContextAttr, ptsTimeStamp);
1524 return log_status("AcceptSecurityContext", status);
1525}
1526
1527static SECURITY_STATUS SEC_ENTRY winpr_ApplyControlToken(PCtxtHandle phContext,
1528 PSecBufferDesc pInput)
1529{
1530 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1531
1532 if (!table)
1533 return SEC_E_SECPKG_NOT_FOUND;
1534
1535 if (!table->ApplyControlToken)
1536 {
1537 WLog_WARN(TAG, "Security module does not provide an implementation");
1538 return SEC_E_UNSUPPORTED_FUNCTION;
1539 }
1540
1541 SECURITY_STATUS status = table->ApplyControlToken(phContext, pInput);
1542 return log_status("ApplyControlToken", status);
1543}
1544
1545static SECURITY_STATUS SEC_ENTRY winpr_CompleteAuthToken(PCtxtHandle phContext,
1546 PSecBufferDesc pToken)
1547{
1548 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1549
1550 if (!table)
1551 return SEC_E_SECPKG_NOT_FOUND;
1552
1553 if (!table->CompleteAuthToken)
1554 {
1555 WLog_WARN(TAG, "Security module does not provide an implementation");
1556 return SEC_E_UNSUPPORTED_FUNCTION;
1557 }
1558
1559 SECURITY_STATUS status = table->CompleteAuthToken(phContext, pToken);
1560 return log_status("CompleteAuthToken", status);
1561}
1562
1563static SECURITY_STATUS SEC_ENTRY winpr_DeleteSecurityContext(PCtxtHandle phContext)
1564{
1565 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1566
1567 if (!table)
1568 return SEC_E_SECPKG_NOT_FOUND;
1569
1570 if (!table->DeleteSecurityContext)
1571 {
1572 WLog_WARN(TAG, "Security module does not provide an implementation");
1573 return SEC_E_UNSUPPORTED_FUNCTION;
1574 }
1575
1576 const SECURITY_STATUS status = table->DeleteSecurityContext(phContext);
1577 return log_status("DeleteSecurityContext", status);
1578}
1579
1580static SECURITY_STATUS SEC_ENTRY winpr_FreeContextBuffer(void* pvContextBuffer)
1581{
1582 if (!pvContextBuffer)
1583 return SEC_E_INVALID_HANDLE;
1584
1585 sspi_ContextBufferFree(pvContextBuffer);
1586 return SEC_E_OK;
1587}
1588
1589static SECURITY_STATUS SEC_ENTRY winpr_ImpersonateSecurityContext(PCtxtHandle phContext)
1590{
1591 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phContext);
1592
1593 if (!table)
1594 return SEC_E_SECPKG_NOT_FOUND;
1595
1596 if (!table->ImpersonateSecurityContext)
1597 {
1598 WLog_WARN(TAG, "Security module does not provide an implementation");
1599 return SEC_E_UNSUPPORTED_FUNCTION;
1600 }
1601
1602 SECURITY_STATUS status = table->ImpersonateSecurityContext(phContext);
1603 return log_status("ImpersonateSecurityContext", status);
1604}
1605
1606static SECURITY_STATUS SEC_ENTRY winpr_InitializeSecurityContextW(
1607 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1608 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1609 PCtxtHandle phNewContext, PSecBufferDesc pOutput, PULONG pfContextAttr, PTimeStamp ptsExpiry)
1610{
1611 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phCredential);
1612
1613 if (!table)
1614 return SEC_E_SECPKG_NOT_FOUND;
1615
1616 if (!table->InitializeSecurityContextW)
1617 {
1618 WLog_WARN(TAG, "Security module does not provide an implementation");
1619 return SEC_E_UNSUPPORTED_FUNCTION;
1620 }
1621
1622 const SECURITY_STATUS status = table->InitializeSecurityContextW(
1623 phCredential, phContext, pszTargetName, fContextReq, Reserved1, TargetDataRep, pInput,
1624 Reserved2, phNewContext, pOutput, pfContextAttr, ptsExpiry);
1625 return log_status("InitializeSecurityContextW", status);
1626}
1627
1628static SECURITY_STATUS SEC_ENTRY winpr_InitializeSecurityContextA(
1629 PCredHandle phCredential, PCtxtHandle phContext, SEC_CHAR* pszTargetName, ULONG fContextReq,
1630 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1631 PCtxtHandle phNewContext, PSecBufferDesc pOutput, PULONG pfContextAttr, PTimeStamp ptsExpiry)
1632{
1633 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phCredential);
1634
1635 if (!table)
1636 return SEC_E_SECPKG_NOT_FOUND;
1637
1638 if (!table->InitializeSecurityContextA)
1639 {
1640 WLog_WARN(TAG, "Security module does not provide an implementation");
1641 return SEC_E_UNSUPPORTED_FUNCTION;
1642 }
1643
1644 SECURITY_STATUS status = table->InitializeSecurityContextA(
1645 phCredential, phContext, pszTargetName, fContextReq, Reserved1, TargetDataRep, pInput,
1646 Reserved2, phNewContext, pOutput, pfContextAttr, ptsExpiry);
1647
1648 return log_status("InitializeSecurityContextA", status);
1649}
1650
1651static SECURITY_STATUS SEC_ENTRY winpr_QueryContextAttributesW(PCtxtHandle phContext,
1652 ULONG ulAttribute, void* pBuffer)
1653{
1654 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phContext);
1655
1656 if (!table)
1657 return SEC_E_SECPKG_NOT_FOUND;
1658
1659 if (!table->QueryContextAttributesW)
1660 {
1661 WLog_WARN(TAG, "Security module does not provide an implementation");
1662 return SEC_E_UNSUPPORTED_FUNCTION;
1663 }
1664
1665 SECURITY_STATUS status = table->QueryContextAttributesW(phContext, ulAttribute, pBuffer);
1666 return log_status("QueryContextAttributesW", status);
1667}
1668
1669static SECURITY_STATUS SEC_ENTRY winpr_QueryContextAttributesA(PCtxtHandle phContext,
1670 ULONG ulAttribute, void* pBuffer)
1671{
1672 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1673
1674 if (!table)
1675 return SEC_E_SECPKG_NOT_FOUND;
1676
1677 if (!table->QueryContextAttributesA)
1678 {
1679 WLog_WARN(TAG, "Security module does not provide an implementation");
1680 return SEC_E_UNSUPPORTED_FUNCTION;
1681 }
1682
1683 SECURITY_STATUS status = table->QueryContextAttributesA(phContext, ulAttribute, pBuffer);
1684 return log_status("QueryContextAttributesA", status);
1685}
1686
1687static SECURITY_STATUS SEC_ENTRY winpr_QuerySecurityContextToken(PCtxtHandle phContext,
1688 HANDLE* phToken)
1689{
1690 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phContext);
1691
1692 if (!table)
1693 return SEC_E_SECPKG_NOT_FOUND;
1694
1695 if (!table->QuerySecurityContextToken)
1696 {
1697 WLog_WARN(TAG, "Security module does not provide an implementation");
1698 return SEC_E_UNSUPPORTED_FUNCTION;
1699 }
1700
1701 SECURITY_STATUS status = table->QuerySecurityContextToken(phContext, phToken);
1702 return log_status("QuerySecurityContextToken", status);
1703}
1704
1705static SECURITY_STATUS SEC_ENTRY winpr_SetContextAttributesW(PCtxtHandle phContext,
1706 ULONG ulAttribute, void* pBuffer,
1707 ULONG cbBuffer)
1708{
1709 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phContext);
1710
1711 if (!table)
1712 return SEC_E_SECPKG_NOT_FOUND;
1713
1714 if (!table->SetContextAttributesW)
1715 {
1716 WLog_WARN(TAG, "Security module does not provide an implementation");
1717 return SEC_E_UNSUPPORTED_FUNCTION;
1718 }
1719
1720 SECURITY_STATUS status =
1721 table->SetContextAttributesW(phContext, ulAttribute, pBuffer, cbBuffer);
1722 return log_status("SetContextAttributesW", status);
1723}
1724
1725static SECURITY_STATUS SEC_ENTRY winpr_SetContextAttributesA(PCtxtHandle phContext,
1726 ULONG ulAttribute, void* pBuffer,
1727 ULONG cbBuffer)
1728{
1729 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1730
1731 if (!table)
1732 return SEC_E_SECPKG_NOT_FOUND;
1733
1734 if (!table->SetContextAttributesA)
1735 {
1736 WLog_WARN(TAG, "Security module does not provide an implementation");
1737 return SEC_E_UNSUPPORTED_FUNCTION;
1738 }
1739
1740 SECURITY_STATUS status =
1741 table->SetContextAttributesA(phContext, ulAttribute, pBuffer, cbBuffer);
1742 return log_status("SetContextAttributesA", status);
1743}
1744
1745static SECURITY_STATUS SEC_ENTRY winpr_RevertSecurityContext(PCtxtHandle phContext)
1746{
1747 const SecurityFunctionTableW* table = sspi_GetSecurityFunctionTableWByHandle(phContext);
1748
1749 if (!table)
1750 return SEC_E_SECPKG_NOT_FOUND;
1751
1752 if (!table->RevertSecurityContext)
1753 {
1754 WLog_WARN(TAG, "Security module does not provide an implementation");
1755 return SEC_E_UNSUPPORTED_FUNCTION;
1756 }
1757
1758 SECURITY_STATUS status = table->RevertSecurityContext(phContext);
1759
1760 return log_status("RevertSecurityContext", status);
1761}
1762
1763/* Message Support */
1764
1765static SECURITY_STATUS SEC_ENTRY winpr_DecryptMessage(PCtxtHandle phContext,
1766 PSecBufferDesc pMessage, ULONG MessageSeqNo,
1767 PULONG pfQOP)
1768{
1769 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1770
1771 if (!table)
1772 return SEC_E_SECPKG_NOT_FOUND;
1773
1774 if (!table->DecryptMessage)
1775 {
1776 WLog_WARN(TAG, "Security module does not provide an implementation");
1777 return SEC_E_UNSUPPORTED_FUNCTION;
1778 }
1779
1780 const SECURITY_STATUS status = table->DecryptMessage(phContext, pMessage, MessageSeqNo, pfQOP);
1781
1782 return log_status("DecryptMessage", status);
1783}
1784
1785static SECURITY_STATUS SEC_ENTRY winpr_EncryptMessage(PCtxtHandle phContext, ULONG fQOP,
1786 PSecBufferDesc pMessage, ULONG MessageSeqNo)
1787{
1788 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1789
1790 if (!table)
1791 return SEC_E_SECPKG_NOT_FOUND;
1792
1793 if (!table->EncryptMessage)
1794 {
1795 WLog_WARN(TAG, "Security module does not provide an implementation");
1796 return SEC_E_UNSUPPORTED_FUNCTION;
1797 }
1798
1799 const SECURITY_STATUS status = table->EncryptMessage(phContext, fQOP, pMessage, MessageSeqNo);
1800 return log_status("EncryptMessage", status);
1801}
1802
1803static SECURITY_STATUS SEC_ENTRY winpr_MakeSignature(PCtxtHandle phContext, ULONG fQOP,
1804 PSecBufferDesc pMessage, ULONG MessageSeqNo)
1805{
1806 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1807
1808 if (!table)
1809 return SEC_E_SECPKG_NOT_FOUND;
1810
1811 if (!table->MakeSignature)
1812 {
1813 WLog_WARN(TAG, "Security module does not provide an implementation");
1814 return SEC_E_UNSUPPORTED_FUNCTION;
1815 }
1816
1817 const SECURITY_STATUS status = table->MakeSignature(phContext, fQOP, pMessage, MessageSeqNo);
1818 return log_status("MakeSignature", status);
1819}
1820
1821static SECURITY_STATUS SEC_ENTRY winpr_VerifySignature(PCtxtHandle phContext,
1822 PSecBufferDesc pMessage, ULONG MessageSeqNo,
1823 PULONG pfQOP)
1824{
1825 const SecurityFunctionTableA* table = sspi_GetSecurityFunctionTableAByHandle(phContext);
1826
1827 if (!table)
1828 return SEC_E_SECPKG_NOT_FOUND;
1829
1830 if (!table->VerifySignature)
1831 {
1832 WLog_WARN(TAG, "Security module does not provide an implementation");
1833 return SEC_E_UNSUPPORTED_FUNCTION;
1834 }
1835
1836 SECURITY_STATUS status = table->VerifySignature(phContext, pMessage, MessageSeqNo, pfQOP);
1837
1838 return log_status("VerifySignature", status);
1839}
1840
1841static SecurityFunctionTableA winpr_SecurityFunctionTableA = {
1842 3, /* dwVersion */
1843 winpr_EnumerateSecurityPackagesA, /* EnumerateSecurityPackages */
1844 winpr_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
1845 winpr_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
1846 winpr_FreeCredentialsHandle, /* FreeCredentialsHandle */
1847 nullptr, /* Reserved2 */
1848 winpr_InitializeSecurityContextA, /* InitializeSecurityContext */
1849 winpr_AcceptSecurityContext, /* AcceptSecurityContext */
1850 winpr_CompleteAuthToken, /* CompleteAuthToken */
1851 winpr_DeleteSecurityContext, /* DeleteSecurityContext */
1852 winpr_ApplyControlToken, /* ApplyControlToken */
1853 winpr_QueryContextAttributesA, /* QueryContextAttributes */
1854 winpr_ImpersonateSecurityContext, /* ImpersonateSecurityContext */
1855 winpr_RevertSecurityContext, /* RevertSecurityContext */
1856 winpr_MakeSignature, /* MakeSignature */
1857 winpr_VerifySignature, /* VerifySignature */
1858 winpr_FreeContextBuffer, /* FreeContextBuffer */
1859 winpr_QuerySecurityPackageInfoA, /* QuerySecurityPackageInfo */
1860 nullptr, /* Reserved3 */
1861 nullptr, /* Reserved4 */
1862 winpr_ExportSecurityContext, /* ExportSecurityContext */
1863 winpr_ImportSecurityContextA, /* ImportSecurityContext */
1864 nullptr, /* AddCredentials */
1865 nullptr, /* Reserved8 */
1866 winpr_QuerySecurityContextToken, /* QuerySecurityContextToken */
1867 winpr_EncryptMessage, /* EncryptMessage */
1868 winpr_DecryptMessage, /* DecryptMessage */
1869 winpr_SetContextAttributesA, /* SetContextAttributes */
1870 winpr_SetCredentialsAttributesA, /* SetCredentialsAttributes */
1871};
1872
1873static SecurityFunctionTableW winpr_SecurityFunctionTableW = {
1874 3, /* dwVersion */
1875 winpr_EnumerateSecurityPackagesW, /* EnumerateSecurityPackages */
1876 winpr_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
1877 winpr_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
1878 winpr_FreeCredentialsHandle, /* FreeCredentialsHandle */
1879 nullptr, /* Reserved2 */
1880 winpr_InitializeSecurityContextW, /* InitializeSecurityContext */
1881 winpr_AcceptSecurityContext, /* AcceptSecurityContext */
1882 winpr_CompleteAuthToken, /* CompleteAuthToken */
1883 winpr_DeleteSecurityContext, /* DeleteSecurityContext */
1884 winpr_ApplyControlToken, /* ApplyControlToken */
1885 winpr_QueryContextAttributesW, /* QueryContextAttributes */
1886 winpr_ImpersonateSecurityContext, /* ImpersonateSecurityContext */
1887 winpr_RevertSecurityContext, /* RevertSecurityContext */
1888 winpr_MakeSignature, /* MakeSignature */
1889 winpr_VerifySignature, /* VerifySignature */
1890 winpr_FreeContextBuffer, /* FreeContextBuffer */
1891 winpr_QuerySecurityPackageInfoW, /* QuerySecurityPackageInfo */
1892 nullptr, /* Reserved3 */
1893 nullptr, /* Reserved4 */
1894 winpr_ExportSecurityContext, /* ExportSecurityContext */
1895 winpr_ImportSecurityContextW, /* ImportSecurityContext */
1896 nullptr, /* AddCredentials */
1897 nullptr, /* Reserved8 */
1898 winpr_QuerySecurityContextToken, /* QuerySecurityContextToken */
1899 winpr_EncryptMessage, /* EncryptMessage */
1900 winpr_DecryptMessage, /* DecryptMessage */
1901 winpr_SetContextAttributesW, /* SetContextAttributes */
1902 winpr_SetCredentialsAttributesW, /* SetCredentialsAttributes */
1903};
1904
1905SecurityFunctionTableW* SEC_ENTRY winpr_InitSecurityInterfaceW(void)
1906{
1907 return &winpr_SecurityFunctionTableW;
1908}
1909
1910SecurityFunctionTableA* SEC_ENTRY winpr_InitSecurityInterfaceA(void)
1911{
1912 return &winpr_SecurityFunctionTableA;
1913}
1914
1915SEC_WINPR_NTLM_SETTINGS_V2* sspi_CloneSecNtlmSettings(const SEC_WINPR_NTLM_SETTINGS_V2* other)
1916{
1917 if (!other)
1918 return nullptr;
1919
1920 const size_t size = sizeof(SEC_WINPR_NTLM_SETTINGS_V2);
1921 if (other->size < size)
1922 {
1923 WLog_ERR(TAG,
1924 "Invalid SEC_WINPR_NTLM_SETTINGS_V2 parameter passed, must be of size >= "
1925 "%" PRIuz,
1926 size);
1927 return nullptr;
1928 }
1929
1930 SEC_WINPR_NTLM_SETTINGS_V2* clone = sspi_AllocSecNtlmSettings();
1931 if (!clone)
1932 return nullptr;
1933
1934 if (other->samFile)
1935 {
1936 if (!sspi_CloneSecSettingsString(&clone->samFile, other->samFile))
1937 goto fail;
1938 }
1939 clone->hashCallback = other->hashCallback;
1940 clone->hashCallbackArg = other->hashCallbackArg;
1941 if (other->targetName)
1942 {
1943 if (!sspi_CloneSecSettingsString(&clone->targetName, other->targetName))
1944 goto fail;
1945 }
1946 if (other->netBiosComputerName)
1947 {
1948 if (!sspi_CloneSecSettingsString(&clone->netBiosComputerName, other->netBiosComputerName))
1949 goto fail;
1950 }
1951 if (other->netBiosDomainName)
1952 {
1953 if (!sspi_CloneSecSettingsString(&clone->netBiosDomainName, other->netBiosDomainName))
1954 goto fail;
1955 }
1956 if (other->dnsComputerName)
1957 {
1958 if (!sspi_CloneSecSettingsString(&clone->dnsComputerName, other->dnsComputerName))
1959 goto fail;
1960 }
1961 if (other->dnsDomainName)
1962 {
1963 if (!sspi_CloneSecSettingsString(&clone->dnsDomainName, other->dnsDomainName))
1964 goto fail;
1965 }
1966
1967 return clone;
1968
1969fail:
1970 sspi_FreeSecNtlmSettings(clone);
1971 return nullptr;
1972}
RTL_RUN_ONCE
Definition include/winpr/synch.h:388
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_WINNT_AUTH_IDENTITY_A
Definition include/winpr/sspi.h:723
SEC_WINNT_AUTH_IDENTITY_EX2
Definition include/winpr/sspi.h:792
SEC_WINNT_AUTH_IDENTITY_EXA
Definition include/winpr/sspi.h:764
SEC_WINNT_AUTH_IDENTITY_EXW
Definition include/winpr/sspi.h:749
SEC_WINNT_AUTH_IDENTITY_W
Definition include/winpr/sspi.h:712
SSPI_CREDENTIALS
Definition libwinpr/sspi/sspi.h:35
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:816