FreeRDP
Loading...
Searching...
No Matches
kerberos.c
1
22#include <winpr/config.h>
23#include <winpr/library.h>
24
25#include <stdio.h>
26#include <stdlib.h>
27#include <string.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <ctype.h>
31
32#include <winpr/assert.h>
33#include <winpr/cast.h>
34#include <winpr/asn1.h>
35#include <winpr/crt.h>
36#include <winpr/interlocked.h>
37#include <winpr/sspi.h>
38#include <winpr/print.h>
39#include <winpr/tchar.h>
40#include <winpr/sysinfo.h>
41#include <winpr/endian.h>
42#include <winpr/crypto.h>
43#include <winpr/path.h>
44#include <winpr/wtypes.h>
45#include <winpr/winsock.h>
46#include <winpr/schannel.h>
47#include <winpr/secapi.h>
48
49#include "kerberos.h"
50
51#ifdef WITH_KRB5_MIT
52#include "krb5glue.h"
53#include <profile.h>
54#endif
55
56#ifdef WITH_KRB5_HEIMDAL
57#include "krb5glue.h"
58#include <krb5-protos.h>
59#endif
60
61#include "../sspi.h"
62#include "../../log.h"
63
64const SecPkgInfoA KERBEROS_SecPkgInfoA = {
65 0x000F3BBF, /* fCapabilities */
66 1, /* wVersion */
67 0x0010, /* wRPCID */
68 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
69 "Kerberos", /* Name */
70 "Kerberos Security Package" /* Comment */
71};
72
73static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = WINPR_C_ARRAY_INIT;
74static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = WINPR_C_ARRAY_INIT;
75
76const SecPkgInfoW KERBEROS_SecPkgInfoW = {
77 0x000F3BBF, /* fCapabilities */
78 1, /* wVersion */
79 0x0010, /* wRPCID */
80 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
81 KERBEROS_SecPkgInfoW_NameBuffer, /* Name */
82 KERBEROS_SecPkgInfoW_CommentBuffer /* Comment */
83};
84
85#ifdef WITH_KRB5
86#define TAG WINPR_TAG("sspi.Kerberos")
87
88#define KRB_TGT_REQ 16
89#define KRB_TGT_REP 17
90
91enum KERBEROS_STATE
92{
93 KERBEROS_STATE_INITIAL,
94 KERBEROS_STATE_TGT_REQ,
95 KERBEROS_STATE_TGT_REP,
96 KERBEROS_STATE_AP_REQ,
97 KERBEROS_STATE_AP_REP,
98 KERBEROS_STATE_FINAL
99};
100
101typedef struct KRB_CREDENTIALS_st
102{
103 volatile LONG refCount;
104 krb5_context ctx;
105 char* kdc_url;
106 krb5_ccache ccache;
107 krb5_keytab keytab;
108 krb5_keytab client_keytab;
109 BOOL own_ccache;
110} KRB_CREDENTIALS;
111
112struct s_KRB_CONTEXT
113{
114 enum KERBEROS_STATE state;
115 KRB_CREDENTIALS* credentials;
116 krb5_auth_context auth_ctx;
117 BOOL acceptor;
118 uint32_t flags;
119 uint64_t local_seq;
120 uint64_t remote_seq;
121 struct krb5glue_keyset keyset;
122 BOOL u2u;
123 char* targetHost;
124};
125
126static const WinPrAsn1_OID kerberos_OID = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
127static const WinPrAsn1_OID kerberos_u2u_OID = { 10,
128 (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
129
130WINPR_ATTR_NODISCARD
131krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code, const char* what,
132 const char* file, const char* fkt, size_t line)
133{
134 switch (code)
135 {
136 case 0:
137 case KRB5_KT_END:
138 break;
139 default:
140 {
141 const DWORD level = WLOG_ERROR;
142
143 wLog* log = WLog_Get(TAG);
144 if (WLog_IsLevelActive(log, level))
145 {
146 const char* msg = krb5_get_error_message(ctx, code);
147 WLog_PrintTextMessage(log, level, line, file, fkt, "%s (%s [%d])", what, msg, code);
148 krb5_free_error_message(ctx, msg);
149 }
150 }
151 break;
152 }
153 return code;
154}
155
156void krb_log_context_encryption(krb5_context ctx, krb5_principal princ)
157{
158#if !defined(WITH_KRB5_HEIMDAL)
159 typedef krb5_error_code KRB5_CALLCONV (*krb5_get_etype_info_fn)(
160 krb5_context context, krb5_principal principal, krb5_get_init_creds_opt* opt,
161 krb5_enctype* enctype_out, krb5_data* salt_out, krb5_data* s2kparams_out);
162
163 krb5_get_etype_info_fn fn =
164 GetProcAddressAs(nullptr, "krb5_get_etype_info", krb5_get_etype_info_fn);
165
166 if (fn)
167 {
168 krb5_get_init_creds_opt opt = WINPR_C_ARRAY_INIT;
169 krb5_enctype enctype = 0;
170 krb5_data salt = WINPR_C_ARRAY_INIT;
171 krb5_data s2kparam = WINPR_C_ARRAY_INIT;
172 char buffer[128] = WINPR_C_ARRAY_INIT;
173 krb5_error_code rv = krb_log_exec(fn, ctx, princ, &opt, &enctype, &salt, &s2kparam);
174 krb5_enctype_to_string(enctype, buffer, sizeof(buffer));
175 const char* msg = krb5_get_error_message(ctx, rv);
176
177 char* saltdata = winpr_BinToHexString(salt.data, salt.length, TRUE);
178 WLog_DBG(TAG, "[%s] enctype=%s, salt[%u]=%s, s2kparam[%u]=%s", msg, buffer, salt.length,
179 saltdata, s2kparam.length, s2kparam.data);
180
181 krb5_free_data_contents(ctx, &salt);
182 krb5_free_data_contents(ctx, &s2kparam);
183 krb5_free_error_message(ctx, msg);
184 free(saltdata);
185 }
186 else
187#endif
188 {
189 WLog_WARN(TAG,
190 "kerberos implementation does not support 'krb5_get_etype_info', not displaying "
191 "encryption information");
192 }
193}
194
195static void credentials_unref(KRB_CREDENTIALS* credentials);
196
197static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
198{
199 if (!ctx)
200 return;
201
202 free(ctx->targetHost);
203 ctx->targetHost = nullptr;
204
205 if (ctx->credentials)
206 {
207 krb5_context krbctx = ctx->credentials->ctx;
208 if (krbctx)
209 {
210 if (ctx->auth_ctx)
211 krb5_auth_con_free(krbctx, ctx->auth_ctx);
212
213 krb5glue_keys_free(krbctx, &ctx->keyset);
214 }
215
216 credentials_unref(ctx->credentials);
217 }
218
219 if (allocated)
220 free(ctx);
221}
222
223WINPR_ATTR_MALLOC(kerberos_ContextFree, 1)
224static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
225{
226 KRB_CONTEXT* context = nullptr;
227
228 context = (KRB_CONTEXT*)calloc(1, sizeof(KRB_CONTEXT));
229 if (!context)
230 return nullptr;
231
232 context->credentials = credentials;
233 InterlockedIncrement(&credentials->refCount);
234 return context;
235}
236
237WINPR_ATTR_NODISCARD
238static krb5_error_code krb5_prompter(krb5_context context, void* data,
239 WINPR_ATTR_UNUSED const char* name,
240 WINPR_ATTR_UNUSED const char* banner, int num_prompts,
241 krb5_prompt prompts[])
242{
243 for (int i = 0; i < num_prompts; i++)
244 {
245 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
246 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
247 {
248 /* the reply buffer is allocated by the library, it holds reply->length bytes */
249 krb5_data* reply = prompts[i].reply;
250 const size_t len = strlen((const char*)data);
251 if (!reply->data || (len > reply->length))
252 return KRB5KRB_ERR_GENERIC;
253
254 memcpy(reply->data, data, len);
255 if (len < reply->length)
256 reply->data[len] = '\0';
257 reply->length = (UINT32)len;
258 }
259 }
260 return 0;
261}
262
263WINPR_ATTR_NODISCARD
264static inline krb5glue_key get_key(struct krb5glue_keyset* keyset)
265{
266 return keyset->acceptor_key ? keyset->acceptor_key
267 : keyset->initiator_key ? keyset->initiator_key
268 : keyset->session_key;
269}
270
271WINPR_ATTR_NODISCARD
272static BOOL isValidIPv4(const char* ipAddress)
273{
274 struct sockaddr_in sa = WINPR_C_ARRAY_INIT;
275 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
276 return result != 0;
277}
278
279WINPR_ATTR_NODISCARD
280static BOOL isValidIPv6(const char* ipAddress)
281{
282 struct sockaddr_in6 sa = WINPR_C_ARRAY_INIT;
283 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
284 return result != 0;
285}
286
287WINPR_ATTR_NODISCARD
288static BOOL isValidIP(const char* ipAddress)
289{
290 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
291}
292
293#if defined(WITH_KRB5_MIT)
294WINPR_ATTR_MALLOC(free, 1)
295static char* get_realm_name(krb5_data realm, size_t* plen)
296{
297 WINPR_ASSERT(plen);
298 *plen = 0;
299 if ((realm.length <= 0) || (!realm.data))
300 return nullptr;
301
302 char* name = nullptr;
303 (void)winpr_asprintf(&name, plen, "krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
304 realm.data);
305 return name;
306}
307#elif defined(WITH_KRB5_HEIMDAL)
308WINPR_ATTR_MALLOC(free, 1)
309static char* get_realm_name(Realm realm, size_t* plen)
310{
311 WINPR_ASSERT(plen);
312 *plen = 0;
313 if (!realm)
314 return nullptr;
315
316 char* name = nullptr;
317 (void)winpr_asprintf(&name, plen, "krbtgt/%s@%s", realm, realm);
318 return name;
319}
320#endif
321
322WINPR_ATTR_NODISCARD
323static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
324{
325 /* "krbtgt/" + realm + "@" + realm */
326 size_t len = 0;
327 krb5_error_code rv = KRB5_CC_NOMEM;
328
329 char* name = get_realm_name(principal->realm, &len);
330 if (!name || (len == 0))
331 goto fail;
332
333 {
334 krb5_principal target = WINPR_C_ARRAY_INIT;
335 rv = krb5_parse_name(ctx, name, &target);
336 *ptarget = target;
337 }
338fail:
339 free(name);
340 return rv;
341}
342
343#endif /* WITH_KRB5 */
344
345WINPR_ATTR_NODISCARD
346static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
347 WINPR_ATTR_UNUSED SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage,
348 WINPR_ATTR_UNUSED ULONG fCredentialUse, WINPR_ATTR_UNUSED void* pvLogonID,
349 WINPR_ATTR_UNUSED void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
350 WINPR_ATTR_UNUSED void* pvGetKeyArgument, WINPR_ATTR_UNUSED PCredHandle phCredential,
351 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
352{
353#ifdef WITH_KRB5
354#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
355 SEC_WINPR_KERBEROS_SETTINGS_V2 krb_settings_v1_buffer = WINPR_C_ARRAY_INIT;
356#endif
357
358 SEC_WINPR_KERBEROS_SETTINGS_V2* krb_settings = nullptr;
359 KRB_CREDENTIALS* credentials = nullptr;
360 krb5_context ctx = nullptr;
361 krb5_ccache ccache = nullptr;
362 krb5_keytab keytab = nullptr;
363 krb5_principal principal = nullptr;
364 char* domain = nullptr;
365 char* username = nullptr;
366 char* password = nullptr;
367 BOOL own_ccache = FALSE;
368 const char* const default_ccache_type = "MEMORY";
369
370 if (pAuthData)
371 {
372 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
373
374#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
375 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
376 {
377 SEC_WINPR_KERBEROS_SETTINGS* krb_settingsV1 =
378 (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->kerberosSettings);
379 if (krb_settingsV1)
380 {
381 krb_settings_v1_buffer.kdcUrl = krb_settingsV1->kdcUrl;
382 krb_settings_v1_buffer.keytab = krb_settingsV1->keytab;
383 krb_settings_v1_buffer.cache = krb_settingsV1->cache;
384 krb_settings_v1_buffer.armorCache = krb_settingsV1->armorCache;
385 krb_settings_v1_buffer.pkinitX509Anchors = krb_settingsV1->pkinitX509Anchors;
386 krb_settings_v1_buffer.pkinitX509Identity = krb_settingsV1->pkinitX509Identity;
387 krb_settings_v1_buffer.withPac = krb_settingsV1->withPac;
388 krb_settings_v1_buffer.startTime = krb_settingsV1->startTime;
389 krb_settings_v1_buffer.renewLifeTime = krb_settingsV1->renewLifeTime;
390 krb_settings_v1_buffer.lifeTime = krb_settingsV1->lifeTime;
391 memcpy(krb_settings_v1_buffer.certSha1, krb_settingsV1->certSha1,
392 sizeof(krb_settings_v1_buffer.certSha1));
393 krb_settings = &krb_settings_v1_buffer;
394 }
395 }
396#endif
397 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED_v2)
398 {
399 const SEC_WINNT_AUTH_IDENTITY_WINPR_V2* auth =
400 (const SEC_WINNT_AUTH_IDENTITY_WINPR_V2*)pAuthData;
401 WINPR_ASSERT(auth);
402 if (auth->version < SEC_WINNT_AUTH_IDENTITY_WINPR_V2_REVISION_1)
403 goto cleanup;
404 krb_settings = auth->kerberosSettingsV2;
405 }
406
407 if (!sspi_CopyAuthIdentityFieldsA((const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData, &username,
408 &domain, &password))
409 {
410 WLog_ERR(TAG, "Failed to copy auth identity fields");
411 goto cleanup;
412 }
413
414 if (!pszPrincipal)
415 pszPrincipal = username;
416 }
417
418 if (krb_log_exec_ptr(krb5_init_context, &ctx))
419 goto cleanup;
420
421 BOOL enterprise = FALSE;
422 if (domain)
423 {
424 char* udomain = _strdup(domain);
425 if (!udomain)
426 goto cleanup;
427
428 CharUpperA(udomain);
429
430 /* the realm of a DNS-style domain, from the domain_realm mapping of krb5.conf */
431 const char* realm = udomain;
432 char** host_realms = nullptr;
433 if (strchr(udomain, '.') && (krb5_get_host_realm(ctx, domain, &host_realms) == 0) &&
434 host_realms && host_realms[0] && (strnlen(host_realms[0], 1) > 0))
435 realm = host_realms[0];
436 else
437 {
438 /* A DNS-style domain that maps to no realm and differs from the configured
439 * default realm is a UPN suffix, e.g. user@example.com for an account in realm
440 * CORP.EXAMPLE.NET, which is what /smartcard-logon takes from the certificate. AD
441 * rejects that as a realm ("Realm not local to KDC") and only accepts it as an
442 * enterprise principal in the account's realm, as Windows clients send it - so
443 * keep the configured realm. */
444 char* default_realm = nullptr;
445 if (strchr(udomain, '.') && (krb5_get_default_realm(ctx, &default_realm) == 0) &&
446 (strcmp(default_realm, udomain) != 0))
447 enterprise = TRUE;
448 krb5_free_default_realm(ctx, default_realm);
449 }
450
451 krb5_error_code rv = 0;
452 /* Will use domain if realm is not specified in username */
453 if (!enterprise)
454 rv = krb_log_exec(krb5_set_default_realm, ctx, realm);
455 if (host_realms)
456 krb5_free_host_realm(ctx, host_realms);
457 free(udomain);
458
459 if (rv)
460 goto cleanup;
461 }
462
463 if (pszPrincipal)
464 {
465 krb5_error_code rv = 0;
466 if (enterprise && !strchr(pszPrincipal, '@'))
467 {
468 char* upn = nullptr;
469 size_t upnlen = 0;
470 (void)winpr_asprintf(&upn, &upnlen, "%s@%s", pszPrincipal, domain);
471 if (!upn)
472 goto cleanup;
473
474 /* e.g. "user@example.com" becomes "user\@example.com@CORP.EXAMPLE.NET" */
475 rv = krb_log_exec(krb5_parse_name_flags, ctx, upn, KRB5_PRINCIPAL_PARSE_ENTERPRISE,
476 &principal);
477 free(upn);
478 }
479 else
480 {
481 char* cpszPrincipal = _strdup(pszPrincipal);
482 if (!cpszPrincipal)
483 goto cleanup;
484
485 /* Find realm component if included and convert to uppercase */
486 char* p = strchr(cpszPrincipal, '@');
487 if (p)
488 CharUpperA(p);
489
490 rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, &principal);
491 free(cpszPrincipal);
492 }
493
494 if (rv)
495 goto cleanup;
496 WINPR_ASSERT(principal);
497 }
498
499 if (krb_settings && krb_settings->cache)
500 {
501 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
502 goto cleanup;
503 }
504 else
505 own_ccache = TRUE;
506
507 if (principal)
508 {
509 /* Use the default cache if it's initialized with the right principal */
510 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
511 {
512 if (own_ccache)
513 {
514 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
515 goto cleanup;
516 }
517 else
518 {
519 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
520 goto cleanup;
521 }
522
523 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
524 goto cleanup;
525 }
526 else
527 {
528 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
529 goto cleanup;
530 own_ccache = FALSE;
531 }
532 WINPR_ASSERT(ccache);
533 }
534 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
535 {
536 /* Use the default cache with it's default principal */
537 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
538 goto cleanup;
539 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
540 goto cleanup;
541 WINPR_ASSERT(ccache);
542 own_ccache = FALSE;
543 }
544 else
545 {
546 if (own_ccache)
547 {
548 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
549 goto cleanup;
550 }
551 else
552 {
553 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
554 goto cleanup;
555 }
556 WINPR_ASSERT(ccache);
557 }
558
559 if (krb_settings && krb_settings->keytab)
560 {
561 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
562 goto cleanup;
563 }
564 else
565 {
566 if (fCredentialUse & SECPKG_CRED_INBOUND)
567 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
568 goto cleanup;
569 }
570
571 /* Get initial credentials if required */
572 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
573 {
574 krb5_creds creds = WINPR_C_ARRAY_INIT;
575 krb5_creds matchCreds = WINPR_C_ARRAY_INIT;
576 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
577
578 krb5_timeofday(ctx, &matchCreds.times.endtime);
579 matchCreds.times.endtime += 60;
580 matchCreds.client = principal;
581
582 WINPR_ASSERT(principal);
583 WINPR_ASSERT(ctx);
584 WINPR_ASSERT(ccache);
585 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
586 goto cleanup;
587
588 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
589 krb5_free_principal(ctx, matchCreds.server);
590 krb5_free_cred_contents(ctx, &creds);
591 if (rv)
592 {
593 if (krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
594 password, krb_settings))
595 goto cleanup;
596 }
597 }
598
599 credentials = calloc(1, sizeof(KRB_CREDENTIALS));
600 if (!credentials)
601 goto cleanup;
602 credentials->refCount = 1;
603 credentials->ctx = ctx;
604 credentials->ccache = ccache;
605 credentials->keytab = keytab;
606 credentials->own_ccache = own_ccache;
607
608cleanup:
609
610 free(domain);
611 free(username);
612 free(password);
613
614 if (principal)
615 krb5_free_principal(ctx, principal);
616 if (ctx)
617 {
618 if (!credentials)
619 {
620 if (ccache)
621 {
622 if (own_ccache)
623 krb5_cc_destroy(ctx, ccache);
624 else
625 krb5_cc_close(ctx, ccache);
626 }
627 if (keytab)
628 krb5_kt_close(ctx, keytab);
629
630 krb5_free_context(ctx);
631 }
632 }
633
634 /* If we managed to get credentials set the output */
635 if (credentials)
636 {
637 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
638 sspi_SecureHandleSetUpperPointer(phCredential, (void*)KERBEROS_SSP_NAME);
639 return SEC_E_OK;
640 }
641
642 return SEC_E_NO_CREDENTIALS;
643#else
644 return SEC_E_UNSUPPORTED_FUNCTION;
645#endif
646}
647
648WINPR_ATTR_NODISCARD
649static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
650 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
651 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
652 PTimeStamp ptsExpiry)
653{
654 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
655 char* principal = nullptr;
656 char* package = nullptr;
657
658 if (pszPrincipal)
659 {
660 principal = ConvertWCharToUtf8Alloc(pszPrincipal, nullptr);
661 if (!principal)
662 goto fail;
663 }
664 if (pszPackage)
665 {
666 package = ConvertWCharToUtf8Alloc(pszPackage, nullptr);
667 if (!package)
668 goto fail;
669 }
670
671 status =
672 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
673 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
674
675fail:
676 free(principal);
677 free(package);
678
679 return status;
680}
681
682#ifdef WITH_KRB5
683static void credentials_unref(KRB_CREDENTIALS* credentials)
684{
685 WINPR_ASSERT(credentials);
686
687 if (InterlockedDecrement(&credentials->refCount))
688 return;
689
690 free(credentials->kdc_url);
691
692 if (credentials->ccache)
693 {
694 if (credentials->own_ccache)
695 krb5_cc_destroy(credentials->ctx, credentials->ccache);
696 else
697 krb5_cc_close(credentials->ctx, credentials->ccache);
698 }
699 if (credentials->keytab)
700 krb5_kt_close(credentials->ctx, credentials->keytab);
701
702 krb5_free_context(credentials->ctx);
703 free(credentials);
704}
705#endif
706
707WINPR_ATTR_NODISCARD
708static SECURITY_STATUS
709 SEC_ENTRY kerberos_FreeCredentialsHandle(WINPR_ATTR_UNUSED PCredHandle phCredential)
710{
711#ifdef WITH_KRB5
712 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
713 sspi_SecureHandleInvalidate(phCredential);
714 if (!credentials)
715 return SEC_E_INVALID_HANDLE;
716
717 credentials_unref(credentials);
718
719 return SEC_E_OK;
720#else
721 return SEC_E_UNSUPPORTED_FUNCTION;
722#endif
723}
724
725WINPR_ATTR_NODISCARD
726static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
727 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
728 WINPR_ATTR_UNUSED void* pBuffer)
729{
730#ifdef WITH_KRB5
731 switch (ulAttribute)
732 {
733 case SECPKG_CRED_ATTR_NAMES:
734 return SEC_E_OK;
735 default:
736 WLog_ERR(TAG, "TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
737 ulAttribute);
738 return SEC_E_UNSUPPORTED_FUNCTION;
739 }
740
741#else
742 return SEC_E_UNSUPPORTED_FUNCTION;
743#endif
744}
745
746WINPR_ATTR_NODISCARD
747static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(PCredHandle phCredential,
748 ULONG ulAttribute,
749 void* pBuffer)
750{
751 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
752}
753
754#ifdef WITH_KRB5
755WINPR_ATTR_NODISCARD
756static BOOL kerberos_mk_tgt_token(SecBuffer* buf, int msg_type, char* sname, char* host,
757 const krb5_data* ticket)
758{
759 WinPrAsn1Encoder* enc = nullptr;
760 WinPrAsn1_MemoryChunk data;
761 wStream s;
762 size_t len = 0;
763 sspi_gss_data token;
764 BOOL ret = FALSE;
765
766 WINPR_ASSERT(buf);
767
768 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
769 return FALSE;
770 if (msg_type == KRB_TGT_REP && !ticket)
771 return FALSE;
772
773 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
774 if (!enc)
775 return FALSE;
776
777 /* KERB-TGT-REQUEST (SEQUENCE) */
778 if (!WinPrAsn1EncSeqContainer(enc))
779 goto cleanup;
780
781 /* pvno [0] INTEGER */
782 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
783 goto cleanup;
784
785 /* msg-type [1] INTEGER */
786 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
787 goto cleanup;
788
789 if (msg_type == KRB_TGT_REQ && sname)
790 {
791 /* server-name [2] PrincipalName (SEQUENCE) */
792 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
793 goto cleanup;
794
795 /* name-type [0] INTEGER */
796 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
797 goto cleanup;
798
799 /* name-string [1] SEQUENCE OF GeneralString */
800 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
801 goto cleanup;
802
803 if (!WinPrAsn1EncGeneralString(enc, sname))
804 goto cleanup;
805
806 if (host && !WinPrAsn1EncGeneralString(enc, host))
807 goto cleanup;
808
809 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
810 goto cleanup;
811 }
812 else if (msg_type == KRB_TGT_REP)
813 {
814 /* ticket [2] Ticket */
815 data.data = (BYTE*)ticket->data;
816 data.len = ticket->length;
817 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
818 goto cleanup;
819 }
820
821 if (!WinPrAsn1EncEndContainer(enc))
822 goto cleanup;
823
824 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
825 goto cleanup;
826
827 Stream_StaticInit(&s, buf->pvBuffer, len);
828 if (!WinPrAsn1EncToStream(enc, &s))
829 goto cleanup;
830
831 token.data = buf->pvBuffer;
832 token.length = (UINT)len;
833 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
834 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
835 ret = TRUE;
836
837cleanup:
838 WinPrAsn1Encoder_Free(&enc);
839 return ret;
840}
841
842WINPR_ATTR_NODISCARD
843static BOOL append(char* dst, size_t dstSize, const char* src)
844{
845 const size_t dlen = strnlen(dst, dstSize);
846 const size_t slen = strlen(src);
847 if (dlen + slen >= dstSize)
848 return FALSE;
849 if (!strncat(dst, src, dstSize - dlen))
850 return FALSE;
851 return TRUE;
852}
853
854WINPR_ATTR_NODISCARD
855static BOOL kerberos_rd_tgt_req_tag2(WinPrAsn1Decoder* dec, char* buf, size_t len)
856{
857 BOOL rc = FALSE;
858 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
859
860 /* server-name [2] PrincipalName (SEQUENCE) */
861 if (!WinPrAsn1DecReadSequence(dec, &seq))
862 goto end;
863
864 /* name-type [0] INTEGER */
865 {
866 BOOL error = FALSE;
867 {
868 WinPrAsn1_INTEGER val = 0;
869 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
870 goto end;
871 }
872
873 /* name-string [1] SEQUENCE OF GeneralString */
874 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
875 goto end;
876 }
877
878 {
879 WinPrAsn1_tag tag = 0;
880 BOOL first = TRUE;
881 while (WinPrAsn1DecPeekTag(dec, &tag))
882 {
883 BOOL success = FALSE;
884 char* lstr = nullptr;
885 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
886 goto fail;
887
888 if (!first)
889 {
890 if (!append(buf, len, "/"))
891 goto fail;
892 }
893 first = FALSE;
894
895 if (!append(buf, len, lstr))
896 goto fail;
897
898 success = TRUE;
899 fail:
900 free(lstr);
901 if (!success)
902 goto end;
903 }
904 }
905
906 rc = TRUE;
907end:
908 return rc;
909}
910
911WINPR_ATTR_NODISCARD
912static BOOL kerberos_rd_tgt_req_tag3(WinPrAsn1Decoder* dec, char* buf, size_t len)
913{
914 /* realm [3] Realm */
915 BOOL rc = FALSE;
916 WinPrAsn1_STRING str = nullptr;
917 if (!WinPrAsn1DecReadGeneralString(dec, &str))
918 goto end;
919
920 if (!append(buf, len, "@"))
921 goto end;
922 if (!append(buf, len, str))
923 goto end;
924
925 rc = TRUE;
926end:
927 free(str);
928 return rc;
929}
930
931WINPR_ATTR_NODISCARD
932static BOOL kerberos_rd_tgt_req(WinPrAsn1Decoder* dec, char** target)
933{
934 BOOL rc = FALSE;
935
936 if (!target)
937 return FALSE;
938 *target = nullptr;
939
940 wStream s = WinPrAsn1DecGetStream(dec);
941 const size_t len = Stream_Length(&s);
942 if (len == 0)
943 return TRUE;
944
945 WinPrAsn1Decoder dec2 = WinPrAsn1Decoder_init();
946 WinPrAsn1_tagId tag = 0;
947 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
948 return FALSE;
949
950 char* buf = calloc(len + 1, sizeof(char));
951 if (!buf)
952 return FALSE;
953
954 /* We expect ASN1 context tag values 2 or 3.
955 *
956 * In case we got value 2 an (optional) context tag value 3 might follow.
957 */
958 BOOL checkForTag3 = TRUE;
959 if (tag == 2)
960 {
961 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
962 if (rc)
963 {
964 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
965 if (res == 0)
966 checkForTag3 = FALSE;
967 }
968 }
969
970 if (checkForTag3)
971 {
972 if (tag == 3)
973 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
974 else
975 rc = FALSE;
976 }
977
978 if (rc)
979 *target = buf;
980 else
981 free(buf);
982 return rc;
983}
984
985WINPR_ATTR_NODISCARD
986static BOOL kerberos_rd_tgt_rep(WinPrAsn1Decoder* dec, krb5_data* ticket)
987{
988 if (!ticket)
989 return FALSE;
990
991 /* ticket [2] Ticket */
992 WinPrAsn1Decoder asnTicket = WinPrAsn1Decoder_init();
993 WinPrAsn1_tagId tag = 0;
994 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
995 return FALSE;
996
997 if (tag != 2)
998 return FALSE;
999
1000 wStream s = WinPrAsn1DecGetStream(&asnTicket);
1001 ticket->data = Stream_BufferAs(&s, char);
1002
1003 const size_t len = Stream_Length(&s);
1004 if (len > UINT32_MAX)
1005 return FALSE;
1006 ticket->length = (UINT32)len;
1007 return TRUE;
1008}
1009
1010WINPR_ATTR_NODISCARD
1011static BOOL kerberos_rd_tgt_token(const sspi_gss_data* token, char** target, krb5_data* ticket)
1012{
1013 BOOL error = 0;
1014 WinPrAsn1_INTEGER val = 0;
1015
1016 WINPR_ASSERT(token);
1017
1018 if (target)
1019 *target = nullptr;
1020
1021 WinPrAsn1Decoder der = WinPrAsn1Decoder_init();
1022 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
1023
1024 /* KERB-TGT-REQUEST (SEQUENCE) */
1025 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
1026 if (!WinPrAsn1DecReadSequence(&der, &seq))
1027 return FALSE;
1028
1029 /* pvno [0] INTEGER */
1030 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
1031 return FALSE;
1032
1033 /* msg-type [1] INTEGER */
1034 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
1035 return FALSE;
1036
1037 switch (val)
1038 {
1039 case KRB_TGT_REQ:
1040 return kerberos_rd_tgt_req(&seq, target);
1041 case KRB_TGT_REP:
1042 return kerberos_rd_tgt_rep(&seq, ticket);
1043 default:
1044 break;
1045 }
1046 return FALSE;
1047}
1048
1049WINPR_ATTR_NODISCARD
1050static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5, SEC_CHANNEL_BINDINGS* bindings)
1051{
1052 BYTE buf[4];
1053
1054 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
1055 if (!winpr_Digest_Update(md5, buf, 4))
1056 return FALSE;
1057
1058 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
1059 if (!winpr_Digest_Update(md5, buf, 4))
1060 return FALSE;
1061
1062 if (bindings->cbInitiatorLength &&
1063 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
1064 bindings->cbInitiatorLength))
1065 return FALSE;
1066
1067 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
1068 if (!winpr_Digest_Update(md5, buf, 4))
1069 return FALSE;
1070
1071 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
1072 if (!winpr_Digest_Update(md5, buf, 4))
1073 return FALSE;
1074
1075 if (bindings->cbAcceptorLength &&
1076 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
1077 bindings->cbAcceptorLength))
1078 return FALSE;
1079
1080 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
1081 if (!winpr_Digest_Update(md5, buf, 4))
1082 return FALSE;
1083
1084 if (bindings->cbApplicationDataLength &&
1085 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
1086 bindings->cbApplicationDataLength))
1087 return FALSE;
1088
1089 return TRUE;
1090}
1091
1092#endif /* WITH_KRB5 */
1093
1094WINPR_ATTR_NODISCARD
1095static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
1096 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1097 WINPR_ATTR_UNUSED SEC_CHAR* pszTargetName, WINPR_ATTR_UNUSED ULONG fContextReq,
1098 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1099 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG Reserved2,
1100 WINPR_ATTR_UNUSED PCtxtHandle phNewContext, WINPR_ATTR_UNUSED PSecBufferDesc pOutput,
1101 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
1102{
1103#ifdef WITH_KRB5
1104 PSecBuffer input_buffer = nullptr;
1105 PSecBuffer output_buffer = nullptr;
1106 PSecBuffer bindings_buffer = nullptr;
1107 WINPR_DIGEST_CTX* md5 = nullptr;
1108 char* target = nullptr;
1109 char* sname = nullptr;
1110 char* host = nullptr;
1111 krb5_data input_token = WINPR_C_ARRAY_INIT;
1112 krb5_data output_token = WINPR_C_ARRAY_INIT;
1113 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1114 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1115 uint16_t tok_id = 0;
1116 krb5_ap_rep_enc_part* reply = nullptr;
1117 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
1118 char cksum_contents[24] = WINPR_C_ARRAY_INIT;
1119 krb5_data cksum = WINPR_C_ARRAY_INIT;
1120 krb5_creds in_creds = WINPR_C_ARRAY_INIT;
1121 krb5_creds* creds = nullptr;
1122 BOOL isNewContext = FALSE;
1123 KRB_CONTEXT* context = nullptr;
1124 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1125
1126 /* behave like windows SSPIs that don't want empty context */
1127 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1128 return SEC_E_INVALID_HANDLE;
1129
1130 context = sspi_SecureHandleGetLowerPointer(phContext);
1131
1132 if (!credentials)
1133 return SEC_E_NO_CREDENTIALS;
1134
1135 if (pInput)
1136 {
1137 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1138 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
1139 }
1140 if (pOutput)
1141 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1142
1143 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
1144 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
1145
1146 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1147 ap_flags |= AP_OPTS_USE_SESSION_KEY;
1148
1149 /* Split target name into service/hostname components */
1150 if (pszTargetName)
1151 {
1152 target = _strdup(pszTargetName);
1153 if (!target)
1154 {
1155 status = SEC_E_INSUFFICIENT_MEMORY;
1156 goto cleanup;
1157 }
1158 host = strchr(target, '/');
1159 if (host)
1160 {
1161 *host++ = 0;
1162 sname = target;
1163 }
1164 else
1165 host = target;
1166 if (isValidIP(host))
1167 {
1168 status = SEC_E_NO_CREDENTIALS;
1169 goto cleanup;
1170 }
1171 }
1172
1173 if (!context)
1174 {
1175 context = kerberos_ContextNew(credentials);
1176 if (!context)
1177 {
1178 status = SEC_E_INSUFFICIENT_MEMORY;
1179 goto cleanup;
1180 }
1181
1182 isNewContext = TRUE;
1183
1184 if (host)
1185 context->targetHost = _strdup(host);
1186 if (!context->targetHost)
1187 {
1188 status = SEC_E_INSUFFICIENT_MEMORY;
1189 goto cleanup;
1190 }
1191
1192 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1193 {
1194 context->state = KERBEROS_STATE_TGT_REQ;
1195 context->u2u = TRUE;
1196 }
1197 else
1198 context->state = KERBEROS_STATE_AP_REQ;
1199 }
1200 else
1201 {
1202 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1203 goto bad_token;
1204 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1205 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1206 goto bad_token;
1207 }
1208
1209 /* SSPI flags are compatible with GSS flags except INTEG_FLAG */
1210 context->flags |= (fContextReq & 0x1F);
1211 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1212 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1213
1214 switch (context->state)
1215 {
1216 case KERBEROS_STATE_TGT_REQ:
1217
1218 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, nullptr))
1219 goto cleanup;
1220
1221 context->state = KERBEROS_STATE_TGT_REP;
1222 status = SEC_I_CONTINUE_NEEDED;
1223 break;
1224
1225 case KERBEROS_STATE_TGT_REP:
1226
1227 if (tok_id != TOK_ID_TGT_REP)
1228 goto bad_token;
1229
1230 if (!kerberos_rd_tgt_token(&input_token, nullptr, &in_creds.second_ticket))
1231 goto bad_token;
1232
1233 /* Continue to AP-REQ */
1234 /* fallthrough */
1235 WINPR_FALLTHROUGH
1236
1237 case KERBEROS_STATE_AP_REQ:
1238
1239 /* Set auth_context options */
1240 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1241 goto cleanup;
1242 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1243 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1244 goto cleanup;
1245 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1246 GSS_CHECKSUM_TYPE))
1247 goto cleanup;
1248
1249 /* Get a service ticket */
1250 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1251 KRB5_NT_SRV_HST, &in_creds.server))
1252 goto cleanup;
1253
1254 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1255 &in_creds.client))
1256 {
1257 status = SEC_E_WRONG_PRINCIPAL;
1258 goto cleanup;
1259 }
1260
1261 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1262 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1263 &creds))
1264 {
1265 status = SEC_E_NO_CREDENTIALS;
1266 goto cleanup;
1267 }
1268
1269 /* Write the checksum (delegation not implemented) */
1270 cksum.data = cksum_contents;
1271 cksum.length = sizeof(cksum_contents);
1272 winpr_Data_Write_UINT32(cksum_contents, 16);
1273 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1274
1275 if (bindings_buffer)
1276 {
1277 SEC_CHANNEL_BINDINGS* bindings = bindings_buffer->pvBuffer;
1278
1279 /* Sanity checks */
1280 if (bindings_buffer->cbBuffer < sizeof(SEC_CHANNEL_BINDINGS) ||
1281 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1282 bindings_buffer->cbBuffer ||
1283 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1284 bindings_buffer->cbBuffer ||
1285 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1286 bindings_buffer->cbBuffer)
1287 {
1288 status = SEC_E_BAD_BINDINGS;
1289 goto cleanup;
1290 }
1291
1292 md5 = winpr_Digest_New();
1293 if (!md5)
1294 goto cleanup;
1295
1296 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1297 goto cleanup;
1298
1299 if (!kerberos_hash_channel_bindings(md5, bindings))
1300 goto cleanup;
1301
1302 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1303 goto cleanup;
1304 }
1305
1306 /* Make the AP_REQ message */
1307 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1308 &cksum, creds, &output_token))
1309 goto cleanup;
1310
1311 if (!sspi_gss_wrap_token(output_buffer,
1312 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1313 TOK_ID_AP_REQ, &output_token))
1314 goto cleanup;
1315
1316 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1317 {
1318 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1319 context->auth_ctx, (INT32*)&context->local_seq))
1320 goto cleanup;
1321 context->remote_seq ^= context->local_seq;
1322 }
1323
1324 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1325 &context->keyset))
1326 goto cleanup;
1327
1328 context->state = KERBEROS_STATE_AP_REP;
1329
1330 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1331 status = SEC_I_CONTINUE_NEEDED;
1332 else
1333 status = SEC_E_OK;
1334 break;
1335
1336 case KERBEROS_STATE_AP_REP:
1337
1338 if (tok_id == TOK_ID_AP_REP)
1339 {
1340 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1341 &reply))
1342 goto cleanup;
1343 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1344 }
1345 else if (tok_id == TOK_ID_ERROR)
1346 {
1347 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1348 goto cleanup;
1349 }
1350 else
1351 goto bad_token;
1352
1353 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1354 {
1355 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1356 context->auth_ctx, (INT32*)&context->remote_seq))
1357 goto cleanup;
1358 }
1359
1360 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1361 &context->keyset))
1362 goto cleanup;
1363
1364 context->state = KERBEROS_STATE_FINAL;
1365
1366 if (output_buffer)
1367 output_buffer->cbBuffer = 0;
1368 status = SEC_E_OK;
1369 break;
1370
1371 case KERBEROS_STATE_FINAL:
1372 default:
1373 WLog_ERR(TAG, "Kerberos in invalid state!");
1374 goto cleanup;
1375 }
1376
1377cleanup:
1378{
1379 /* second_ticket is not allocated */
1380 krb5_data edata = WINPR_C_ARRAY_INIT;
1381 in_creds.second_ticket = edata;
1382 krb5_free_cred_contents(credentials->ctx, &in_creds);
1383}
1384
1385 krb5_free_creds(credentials->ctx, creds);
1386 if (output_token.data)
1387 krb5glue_free_data_contents(credentials->ctx, &output_token);
1388
1389 winpr_Digest_Free(md5);
1390
1391 free(target);
1392
1393 if (isNewContext)
1394 {
1395 switch (status)
1396 {
1397 case SEC_E_OK:
1398 case SEC_I_CONTINUE_NEEDED:
1399 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1400 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1401 break;
1402 default:
1403 kerberos_ContextFree(context, TRUE);
1404 sspi_SecureHandleInvalidate(phNewContext);
1405 break;
1406 }
1407 }
1408
1409 return status;
1410
1411bad_token:
1412 status = SEC_E_INVALID_TOKEN;
1413 goto cleanup;
1414#else
1415 return SEC_E_UNSUPPORTED_FUNCTION;
1416#endif /* WITH_KRB5 */
1417}
1418
1419WINPR_ATTR_NODISCARD
1420static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1421 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1422 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1423 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr, PTimeStamp ptsExpiry)
1424{
1425 SECURITY_STATUS status = 0;
1426 char* target_name = nullptr;
1427
1428 if (pszTargetName)
1429 {
1430 target_name = ConvertWCharToUtf8Alloc(pszTargetName, nullptr);
1431 if (!target_name)
1432 return SEC_E_INSUFFICIENT_MEMORY;
1433 }
1434
1435 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1436 Reserved1, TargetDataRep, pInput, Reserved2,
1437 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1438
1439 if (target_name)
1440 free(target_name);
1441
1442 return status;
1443}
1444
1445#ifdef WITH_KRB5
1446WINPR_ATTR_NODISCARD
1447static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1448 krb5_creds* creds)
1449{
1450 BOOL ret = FALSE;
1451 krb5_kt_cursor cur = WINPR_C_ARRAY_INIT;
1452 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1453 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1454 goto cleanup;
1455
1456 do
1457 {
1458 krb5_error_code rv =
1459 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1460 if (rv == KRB5_KT_END)
1461 break;
1462 if (rv != 0)
1463 goto cleanup;
1464
1465 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1466 break;
1467 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1468 memset(&entry, 0, sizeof(entry));
1469 if (rv)
1470 goto cleanup;
1471 } while (1);
1472
1473 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1474 goto cleanup;
1475
1476 if (!entry.principal)
1477 goto cleanup;
1478
1479 /* Get the TGT */
1480 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1481 credentials->keytab, 0, nullptr, nullptr))
1482 goto cleanup;
1483
1484 ret = TRUE;
1485
1486cleanup:
1487 return ret;
1488}
1489
1490WINPR_ATTR_NODISCARD
1491static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials, const char* target, krb5_creds* creds)
1492{
1493 BOOL ret = TRUE;
1494 krb5_principal target_princ = WINPR_C_ARRAY_INIT;
1495 char* default_realm = nullptr;
1496
1497 krb5_error_code rv =
1498 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1499 if (rv)
1500 return FALSE;
1501
1502#if defined(WITH_KRB5_HEIMDAL)
1503 if (!target_princ->realm)
1504 {
1505 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1506 if (rv)
1507 goto out;
1508
1509 target_princ->realm = default_realm;
1510 }
1511#else
1512 if (!target_princ->realm.length)
1513 {
1514 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1515 if (rv)
1516 goto out;
1517
1518 const size_t len = strnlen(default_realm, MAX_KEYTAB_NAME_LEN + 1);
1519 if ((len == 0) || !default_realm)
1520 goto out;
1521 target_princ->realm.data = strndup(default_realm, len);
1522 if (!target_princ->realm.data)
1523 goto out;
1524 target_princ->realm.length = (unsigned int)len;
1525 }
1526#endif
1527
1528 /*
1529 * First try with the account service. We were requested with something like
1530 * TERMSRV/<host>@<realm>, let's see if we have that in our keytab and if we're able
1531 * to retrieve a TGT with that entry
1532 *
1533 */
1534 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1535 goto out;
1536
1537 ret = FALSE;
1538
1539#if defined(WITH_KRB5_MIT)
1540 /*
1541 * if it's not working let's try with <host>$@<REALM> (note the dollar)
1542 */
1543 {
1544 char hostDollar[300] = WINPR_C_ARRAY_INIT;
1545 if (target_princ->length < 2)
1546 goto out;
1547
1548 (void)snprintf(hostDollar, sizeof(hostDollar) - 1, "%s$@%s", target_princ->data[1].data,
1549 target_princ->realm.data);
1550 krb5_free_principal(credentials->ctx, target_princ);
1551
1552 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1553 if (rv)
1554 return FALSE;
1555 }
1556 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1557#endif
1558
1559out:
1560 if (default_realm)
1561 krb5_free_default_realm(credentials->ctx, default_realm);
1562
1563 krb5_free_principal(credentials->ctx, target_princ);
1564 return ret;
1565}
1566#endif
1567
1568WINPR_ATTR_NODISCARD
1569static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1570 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1571 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG fContextReq,
1572 WINPR_ATTR_UNUSED ULONG TargetDataRep, WINPR_ATTR_UNUSED PCtxtHandle phNewContext,
1573 WINPR_ATTR_UNUSED PSecBufferDesc pOutput, WINPR_ATTR_UNUSED ULONG* pfContextAttr,
1574 WINPR_ATTR_UNUSED PTimeStamp ptsExpity)
1575{
1576#ifdef WITH_KRB5
1577 BOOL isNewContext = FALSE;
1578 PSecBuffer input_buffer = nullptr;
1579 PSecBuffer output_buffer = nullptr;
1580 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1581 uint16_t tok_id = 0;
1582 krb5_data input_token = WINPR_C_ARRAY_INIT;
1583 krb5_data output_token = WINPR_C_ARRAY_INIT;
1584 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1585 krb5_flags ap_flags = 0;
1586 krb5glue_authenticator authenticator = nullptr;
1587 char* target = nullptr;
1588 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1589 krb5_creds creds = WINPR_C_ARRAY_INIT;
1590
1591 /* behave like windows SSPIs that don't want empty context */
1592 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1593 return SEC_E_INVALID_HANDLE;
1594
1595 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1596 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1597
1598 if (pInput)
1599 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1600 if (pOutput)
1601 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1602
1603 if (!input_buffer)
1604 return SEC_E_INVALID_TOKEN;
1605
1606 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1607 return SEC_E_INVALID_TOKEN;
1608
1609 if (!context)
1610 {
1611 isNewContext = TRUE;
1612 context = kerberos_ContextNew(credentials);
1613 context->acceptor = TRUE;
1614
1615 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1616 {
1617 context->u2u = TRUE;
1618 context->state = KERBEROS_STATE_TGT_REQ;
1619 }
1620 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1621 context->state = KERBEROS_STATE_AP_REQ;
1622 else
1623 goto bad_token;
1624 }
1625 else
1626 {
1627 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1628 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1629 goto bad_token;
1630 }
1631
1632 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1633 {
1634 if (!kerberos_rd_tgt_token(&input_token, &target, nullptr))
1635 goto bad_token;
1636
1637 if (!retrieveSomeTgt(credentials, target, &creds))
1638 goto cleanup;
1639
1640 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, nullptr, nullptr, &creds.ticket))
1641 goto cleanup;
1642
1643 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1644 goto cleanup;
1645
1646 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1647 &krb5glue_creds_getkey(creds)))
1648 goto cleanup;
1649
1650 context->state = KERBEROS_STATE_AP_REQ;
1651 }
1652 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1653 {
1654 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, nullptr,
1655 credentials->keytab, &ap_flags, nullptr))
1656 goto cleanup;
1657
1658 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1659 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1660 goto cleanup;
1661
1662 /* Retrieve and validate the checksum */
1663 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1664 &authenticator))
1665 goto cleanup;
1666 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1667 &context->flags))
1668 goto bad_token;
1669
1670 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1671 {
1672 if (!output_buffer)
1673 goto bad_token;
1674 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1675 goto cleanup;
1676 if (!sspi_gss_wrap_token(output_buffer,
1677 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1678 TOK_ID_AP_REP, &output_token))
1679 goto cleanup;
1680 }
1681 else
1682 {
1683 if (output_buffer)
1684 output_buffer->cbBuffer = 0;
1685 }
1686
1687 *pfContextAttr = (context->flags & 0x1F);
1688 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1689 *pfContextAttr |= ASC_RET_INTEGRITY;
1690
1691 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1692 {
1693 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1694 (INT32*)&context->local_seq))
1695 goto cleanup;
1696 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1697 (INT32*)&context->remote_seq))
1698 goto cleanup;
1699 }
1700
1701 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1702 &context->keyset))
1703 goto cleanup;
1704
1705 context->state = KERBEROS_STATE_FINAL;
1706 }
1707 else
1708 goto bad_token;
1709
1710 /* On first call allocate new context */
1711 if (context->state == KERBEROS_STATE_FINAL)
1712 status = SEC_E_OK;
1713 else
1714 status = SEC_I_CONTINUE_NEEDED;
1715
1716cleanup:
1717 free(target);
1718 if (output_token.data)
1719 krb5glue_free_data_contents(credentials->ctx, &output_token);
1720 if (entry.principal)
1721 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1722
1723 if (isNewContext)
1724 {
1725 switch (status)
1726 {
1727 case SEC_E_OK:
1728 case SEC_I_CONTINUE_NEEDED:
1729 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1730 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1731 break;
1732 default:
1733 kerberos_ContextFree(context, TRUE);
1734 sspi_SecureHandleInvalidate(phNewContext);
1735 break;
1736 }
1737 }
1738
1739 return status;
1740
1741bad_token:
1742 status = SEC_E_INVALID_TOKEN;
1743 goto cleanup;
1744#else
1745 return SEC_E_UNSUPPORTED_FUNCTION;
1746#endif /* WITH_KRB5 */
1747}
1748
1749#ifdef WITH_KRB5
1750WINPR_ATTR_NODISCARD
1751static KRB_CONTEXT* get_context(PCtxtHandle phContext)
1752{
1753 if (!phContext)
1754 return nullptr;
1755
1756 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1757 if (!name)
1758 return nullptr;
1759
1760 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1761 return nullptr;
1762 return sspi_SecureHandleGetLowerPointer(phContext);
1763}
1764
1765WINPR_ATTR_NODISCARD
1766static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1767{
1768 WINPR_ASSERT(data);
1769 WINPR_ASSERT(ptr);
1770 WINPR_ASSERT(psize);
1771
1772 *ptr = (PUCHAR)malloc(data->length);
1773 if (!*ptr)
1774 return FALSE;
1775
1776 *psize = data->length;
1777 memcpy(*ptr, data->data, data->length);
1778 return TRUE;
1779}
1780#endif
1781
1782WINPR_ATTR_NODISCARD
1783static SECURITY_STATUS
1784 SEC_ENTRY kerberos_DeleteSecurityContext(WINPR_ATTR_UNUSED PCtxtHandle phContext)
1785{
1786#ifdef WITH_KRB5
1787 KRB_CONTEXT* context = get_context(phContext);
1788 sspi_SecureHandleInvalidate(phContext);
1789 if (!context)
1790 return SEC_E_INVALID_HANDLE;
1791
1792 kerberos_ContextFree(context, TRUE);
1793
1794 return SEC_E_OK;
1795#else
1796 return SEC_E_UNSUPPORTED_FUNCTION;
1797#endif
1798}
1799
1800#ifdef WITH_KRB5
1801
1802WINPR_ATTR_NODISCARD
1803static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1804{
1805 switch (code)
1806 {
1807 case 0:
1808 return SEC_E_OK;
1809 default:
1810 return SEC_E_INTERNAL_ERROR;
1811 }
1812}
1813
1814WINPR_ATTR_NODISCARD
1815static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1816 SecPkgContext_Sizes* ContextSizes)
1817{
1818 UINT header = 0;
1819 UINT pad = 0;
1820 UINT trailer = 0;
1821 krb5glue_key key = nullptr;
1822
1823 WINPR_ASSERT(context);
1824 WINPR_ASSERT(context->auth_ctx);
1825
1826 /* The MaxTokenSize by default is 12,000 bytes. This has been the default value
1827 * since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2.
1828 * For Windows Server 2012, the default value of the MaxTokenSize registry
1829 * entry is 48,000 bytes.*/
1830 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1831 ContextSizes->cbMaxSignature = 0;
1832 ContextSizes->cbBlockSize = 1;
1833 ContextSizes->cbSecurityTrailer = 0;
1834
1835 key = get_key(&context->keyset);
1836
1837 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1838 {
1839 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1840 KRB5_CRYPTO_TYPE_HEADER, &header);
1841 if (rv)
1842 return krb5_error_to_SECURITY_STATUS(rv);
1843
1844 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1845 &pad);
1846 if (rv)
1847 return krb5_error_to_SECURITY_STATUS(rv);
1848
1849 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1850 &trailer);
1851 if (rv)
1852 return krb5_error_to_SECURITY_STATUS(rv);
1853
1854 /* GSS header (= 16 bytes) + encrypted header = 32 bytes */
1855 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1856 }
1857
1858 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1859 {
1860 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1861 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1862 if (rv)
1863 return krb5_error_to_SECURITY_STATUS(rv);
1864
1865 ContextSizes->cbMaxSignature += 16;
1866 }
1867
1868 return SEC_E_OK;
1869}
1870
1871WINPR_ATTR_NODISCARD
1872static SECURITY_STATUS kerberos_ATTR_AUTH_IDENTITY(KRB_CONTEXT* context,
1873 KRB_CREDENTIALS* credentials,
1874 SecPkgContext_AuthIdentity* AuthIdentity)
1875{
1876 const SecPkgContext_AuthIdentity empty = WINPR_C_ARRAY_INIT;
1877
1878 WINPR_ASSERT(context);
1879 WINPR_ASSERT(context->auth_ctx);
1880 WINPR_ASSERT(credentials);
1881
1882 WINPR_ASSERT(AuthIdentity);
1883 *AuthIdentity = empty;
1884
1885 krb5glue_authenticator authenticator = nullptr;
1886 krb5_error_code rv = krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx,
1887 context->auth_ctx, &authenticator);
1888 if (rv)
1889 goto fail;
1890
1891 {
1892 rv = -1;
1893
1894#if defined(WITH_KRB5_HEIMDAL)
1895 const Realm data = authenticator->crealm;
1896 if (!data)
1897 goto fail;
1898 const size_t data_len = length_Realm(&data);
1899#else
1900 krb5_data* realm_data = krb5_princ_realm(credentials->ctx, authenticator->client);
1901 if (!realm_data)
1902 goto fail;
1903 const char* data = realm_data->data;
1904 if (!data)
1905 goto fail;
1906 const size_t data_len = realm_data->length;
1907#endif
1908
1909 if (data_len > (sizeof(AuthIdentity->Domain) - 1))
1910 goto fail;
1911 strncpy(AuthIdentity->Domain, data, data_len);
1912 }
1913
1914 {
1915#if defined(WITH_KRB5_HEIMDAL)
1916 const PrincipalName* principal = &authenticator->cname;
1917 const size_t name_length = length_PrincipalName(principal);
1918 if (!principal->name_string.val)
1919 goto fail;
1920 const char* name = *principal->name_string.val;
1921#else
1922 char* name = nullptr;
1923 rv = krb_log_exec(krb5_unparse_name_flags, credentials->ctx, authenticator->client,
1924 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
1925 if (rv)
1926 goto fail;
1927
1928 const size_t name_length = strlen(name);
1929#endif
1930
1931 const bool ok = (name_length <= (sizeof(AuthIdentity->User) - 1));
1932 if (ok)
1933 strncpy(AuthIdentity->User, name, name_length);
1934
1935 rv = ok ? 0 : -1;
1936
1937#if !defined(WITH_KRB5_HEIMDAL)
1938 krb5_free_unparsed_name(credentials->ctx, name);
1939#endif
1940 }
1941
1942fail:
1943 krb5glue_free_authenticator(credentials->ctx, authenticator);
1944 return krb5_error_to_SECURITY_STATUS(rv);
1945}
1946
1947WINPR_ATTR_NODISCARD
1948static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_A(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1949 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1950 SecPkgContext_PackageInfoA* PackageInfo)
1951{
1952 size_t size = sizeof(SecPkgInfoA);
1953 SecPkgInfoA* pPackageInfo =
1954 (SecPkgInfoA*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1955
1956 if (!pPackageInfo)
1957 return SEC_E_INSUFFICIENT_MEMORY;
1958
1959 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoA.fCapabilities;
1960 pPackageInfo->wVersion = KERBEROS_SecPkgInfoA.wVersion;
1961 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoA.wRPCID;
1962 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1963 pPackageInfo->Name = _strdup(KERBEROS_SecPkgInfoA.Name);
1964 pPackageInfo->Comment = _strdup(KERBEROS_SecPkgInfoA.Comment);
1965
1966 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1967 {
1968 sspi_ContextBufferFree(pPackageInfo);
1969 return SEC_E_INSUFFICIENT_MEMORY;
1970 }
1971 PackageInfo->PackageInfo = pPackageInfo;
1972 return SEC_E_OK;
1973}
1974
1975WINPR_ATTR_NODISCARD
1976static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_W(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1977 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1978 SecPkgContext_PackageInfoW* PackageInfo)
1979{
1980 size_t size = sizeof(SecPkgInfoW);
1981 SecPkgInfoW* pPackageInfo =
1982 (SecPkgInfoW*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1983
1984 if (!pPackageInfo)
1985 return SEC_E_INSUFFICIENT_MEMORY;
1986
1987 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoW.fCapabilities;
1988 pPackageInfo->wVersion = KERBEROS_SecPkgInfoW.wVersion;
1989 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoW.wRPCID;
1990 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoW.cbMaxToken;
1991 pPackageInfo->Name = _wcsdup(KERBEROS_SecPkgInfoW.Name);
1992 pPackageInfo->Comment = _wcsdup(KERBEROS_SecPkgInfoW.Comment);
1993
1994 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1995 {
1996 sspi_ContextBufferFree(pPackageInfo);
1997 return SEC_E_INSUFFICIENT_MEMORY;
1998 }
1999 PackageInfo->PackageInfo = pPackageInfo;
2000 return SEC_E_OK;
2001}
2002
2003WINPR_ATTR_NODISCARD
2004static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
2005 KRB_CREDENTIALS* credentials,
2006 KERB_TICKET_LOGON* ticketLogon)
2007{
2008 krb5_creds matchCred = WINPR_C_ARRAY_INIT;
2009 krb5_auth_context authContext = nullptr;
2010 krb5_flags getCredsFlags = KRB5_GC_CACHED;
2011 BOOL firstRun = TRUE;
2012 krb5_creds* hostCred = nullptr;
2013 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
2014 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost, "HOST",
2015 KRB5_NT_SRV_HST, &matchCred.server);
2016 if (rv)
2017 goto out;
2018
2019 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
2020 &matchCred.client);
2021 if (rv)
2022 goto out;
2023
2024 /* try from the cache first, and then do a new request */
2025again:
2026 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
2027 &matchCred, &hostCred);
2028 switch (rv)
2029 {
2030 case 0:
2031 break;
2032 case KRB5_CC_NOTFOUND:
2033 getCredsFlags = 0;
2034 if (firstRun)
2035 {
2036 firstRun = FALSE;
2037 goto again;
2038 }
2039 WINPR_FALLTHROUGH
2040 default:
2041 WLog_ERR(TAG, "krb5_get_credentials(hostCreds), rv=%d", rv);
2042 goto out;
2043 }
2044
2045 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
2046 goto out;
2047
2048 {
2049 krb5_data derOut = WINPR_C_ARRAY_INIT;
2050 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
2051 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
2052 {
2053 ret = SEC_E_LOGON_DENIED;
2054 goto out;
2055 }
2056
2057 ticketLogon->MessageType = KerbTicketLogon;
2058 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
2059
2060 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
2061 &ticketLogon->ServiceTicketLength))
2062 {
2063 krb5_free_data(credentials->ctx, &derOut);
2064 goto out;
2065 }
2066
2067 ticketLogon->TicketGrantingTicketLength = derOut.length;
2068 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
2069 }
2070
2071 ret = SEC_E_OK;
2072out:
2073 krb5_auth_con_free(credentials->ctx, authContext);
2074 krb5_free_creds(credentials->ctx, hostCred);
2075 krb5_free_cred_contents(credentials->ctx, &matchCred);
2076 return ret;
2077}
2078
2079#endif /* WITH_KRB5 */
2080
2081WINPR_ATTR_NODISCARD
2082static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesCommon(
2083 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2084{
2085 if (!phContext)
2086 return SEC_E_INVALID_HANDLE;
2087
2088 if (!pBuffer)
2089 return SEC_E_INVALID_PARAMETER;
2090
2091#ifdef WITH_KRB5
2092 KRB_CONTEXT* context = get_context(phContext);
2093 if (!context)
2094 return SEC_E_INVALID_PARAMETER;
2095
2096 KRB_CREDENTIALS* credentials = context->credentials;
2097
2098 switch (ulAttribute)
2099 {
2100 case SECPKG_ATTR_SIZES:
2101 return kerberos_ATTR_SIZES(context, credentials, (SecPkgContext_Sizes*)pBuffer);
2102
2103 case SECPKG_ATTR_AUTH_IDENTITY:
2104 return kerberos_ATTR_AUTH_IDENTITY(context, credentials,
2105 (SecPkgContext_AuthIdentity*)pBuffer);
2106
2107 case SECPKG_CRED_ATTR_TICKET_LOGON:
2108 return kerberos_ATTR_TICKET_LOGON(context, credentials, (KERB_TICKET_LOGON*)pBuffer);
2109
2110 default:
2111 WLog_ERR(TAG, "TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
2112 ulAttribute);
2113 return SEC_E_UNSUPPORTED_FUNCTION;
2114 }
2115#else
2116 return SEC_E_UNSUPPORTED_FUNCTION;
2117#endif
2118}
2119
2120WINPR_ATTR_NODISCARD
2121static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(
2122 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2123{
2124 if (!phContext)
2125 return SEC_E_INVALID_HANDLE;
2126
2127 if (!pBuffer)
2128 return SEC_E_INVALID_PARAMETER;
2129
2130#ifdef WITH_KRB5
2131 KRB_CONTEXT* context = get_context(phContext);
2132 if (!context)
2133 return SEC_E_INVALID_PARAMETER;
2134
2135 KRB_CREDENTIALS* credentials = context->credentials;
2136
2137 switch (ulAttribute)
2138 {
2139 case SECPKG_ATTR_PACKAGE_INFO:
2140 return kerberos_ATTR_PACKAGE_INFO_A(context, credentials,
2141 (SecPkgContext_PackageInfoA*)pBuffer);
2142 default:
2143 break;
2144 }
2145#endif
2146 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2147}
2148
2149WINPR_ATTR_NODISCARD
2150static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(PCtxtHandle phContext,
2151 ULONG ulAttribute, void* pBuffer)
2152{
2153 if (!phContext)
2154 return SEC_E_INVALID_HANDLE;
2155
2156 if (!pBuffer)
2157 return SEC_E_INVALID_PARAMETER;
2158
2159#ifdef WITH_KRB5
2160 KRB_CONTEXT* context = get_context(phContext);
2161 if (!context)
2162 return SEC_E_INVALID_PARAMETER;
2163
2164 KRB_CREDENTIALS* credentials = context->credentials;
2165
2166 switch (ulAttribute)
2167 {
2168 case SECPKG_ATTR_PACKAGE_INFO:
2169 return kerberos_ATTR_PACKAGE_INFO_W(context, credentials,
2170 (SecPkgContext_PackageInfoW*)pBuffer);
2171 default:
2172 break;
2173 }
2174#endif
2175 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2176}
2177
2178WINPR_ATTR_NODISCARD
2179static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
2180 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2181 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2182{
2183 return SEC_E_UNSUPPORTED_FUNCTION;
2184}
2185
2186WINPR_ATTR_NODISCARD
2187static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
2188 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2189 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2190{
2191 return SEC_E_UNSUPPORTED_FUNCTION;
2192}
2193
2194WINPR_ATTR_NODISCARD
2195static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(
2196 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
2197 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer,
2198 WINPR_ATTR_UNUSED BOOL unicode)
2199{
2200#ifdef WITH_KRB5
2201 KRB_CREDENTIALS* credentials = nullptr;
2202
2203 if (!phCredential)
2204 return SEC_E_INVALID_HANDLE;
2205
2206 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
2207
2208 if (!credentials)
2209 return SEC_E_INVALID_HANDLE;
2210
2211 if (!pBuffer)
2212 return SEC_E_INSUFFICIENT_MEMORY;
2213
2214 switch (ulAttribute)
2215 {
2216 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
2217 {
2218 SecPkgCredentials_KdcProxySettingsW* kdc_settings = pBuffer;
2219
2220 /* Sanity checks */
2221 if (cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2222 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
2223 kdc_settings->ProxyServerOffset < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2224 cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) +
2225 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
2226 return SEC_E_INVALID_TOKEN;
2227
2228 if (credentials->kdc_url)
2229 {
2230 free(credentials->kdc_url);
2231 credentials->kdc_url = nullptr;
2232 }
2233
2234 if (kdc_settings->ProxyServerLength > 0)
2235 {
2236 WCHAR* proxy = WINPR_PACKED_ALIGN_CAST(
2237 WCHAR*, ((BYTE*)pBuffer + kdc_settings->ProxyServerOffset));
2238
2239 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
2240 proxy, kdc_settings->ProxyServerLength / sizeof(WCHAR), nullptr);
2241 if (!credentials->kdc_url)
2242 return SEC_E_INSUFFICIENT_MEMORY;
2243 }
2244
2245 return SEC_E_OK;
2246 }
2247 case SECPKG_CRED_ATTR_NAMES:
2248 case SECPKG_ATTR_SUPPORTED_ALGS:
2249 default:
2250 WLog_ERR(TAG, "TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
2251 ulAttribute);
2252 return SEC_E_UNSUPPORTED_FUNCTION;
2253 }
2254
2255#else
2256 return SEC_E_UNSUPPORTED_FUNCTION;
2257#endif
2258}
2259
2260WINPR_ATTR_NODISCARD
2261static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(PCredHandle phCredential,
2262 ULONG ulAttribute,
2263 void* pBuffer, ULONG cbBuffer)
2264{
2265 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
2266}
2267
2268WINPR_ATTR_NODISCARD
2269static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(PCredHandle phCredential,
2270 ULONG ulAttribute,
2271 void* pBuffer, ULONG cbBuffer)
2272{
2273 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
2274}
2275
2276WINPR_ATTR_NODISCARD
2277static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2278 WINPR_ATTR_UNUSED ULONG fQOP,
2279 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2280 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2281{
2282#ifdef WITH_KRB5
2283 KRB_CONTEXT* context = get_context(phContext);
2284 PSecBuffer sig_buffer = nullptr;
2285 PSecBuffer data_buffer = nullptr;
2286 char* header = nullptr;
2287 BYTE flags = 0;
2288 krb5glue_key key = nullptr;
2289 krb5_keyusage usage = 0;
2290 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2291 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2292 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2293 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2294 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2295
2296 if (!context)
2297 return SEC_E_INVALID_HANDLE;
2298
2299 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2300 return SEC_E_UNSUPPORTED_FUNCTION;
2301
2302 KRB_CREDENTIALS* creds = context->credentials;
2303
2304 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2305 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2306
2307 if (!sig_buffer || !data_buffer)
2308 return SEC_E_INVALID_TOKEN;
2309
2310 if (fQOP)
2311 return SEC_E_QOP_NOT_SUPPORTED;
2312
2313 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2314 flags |= FLAG_WRAP_CONFIDENTIAL;
2315
2316 key = get_key(&context->keyset);
2317 if (!key)
2318 return SEC_E_INTERNAL_ERROR;
2319
2320 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2321
2322 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
2323
2324 /* Set the lengths of the data (plaintext + header) */
2325 encrypt_iov[1].data.length = data_buffer->cbBuffer;
2326 encrypt_iov[2].data.length = 16;
2327
2328 /* Get the lengths of the header, trailer, and padding and ensure sig_buffer is large enough */
2329 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
2330 ARRAYSIZE(encrypt_iov)))
2331 return SEC_E_INTERNAL_ERROR;
2332 if (sig_buffer->cbBuffer <
2333 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
2334 return SEC_E_INSUFFICIENT_MEMORY;
2335
2336 /* Set up the iov array in sig_buffer */
2337 header = sig_buffer->pvBuffer;
2338 encrypt_iov[2].data.data = header + 16;
2339 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
2340 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
2341 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
2342 encrypt_iov[1].data.data = data_buffer->pvBuffer;
2343
2344 /* Write the GSS header with 0 in RRC */
2345 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
2346 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2347 header[3] = (char)0xFF;
2348 winpr_Data_Write_UINT32(header + 4, 0);
2349 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2350
2351 /* Copy header to be encrypted */
2352 CopyMemory(encrypt_iov[2].data.data, header, 16);
2353
2354 /* Set the correct RRC */
2355 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
2356 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
2357
2358 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
2359 ARRAYSIZE(encrypt_iov)))
2360 return SEC_E_INTERNAL_ERROR;
2361
2362 return SEC_E_OK;
2363#else
2364 return SEC_E_UNSUPPORTED_FUNCTION;
2365#endif
2366}
2367
2368WINPR_ATTR_NODISCARD
2369static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2370 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2371 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2372 WINPR_ATTR_UNUSED ULONG* pfQOP)
2373{
2374#ifdef WITH_KRB5
2375 KRB_CONTEXT* context = get_context(phContext);
2376 if (!context)
2377 return SEC_E_INVALID_HANDLE;
2378
2379 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2380 return SEC_E_UNSUPPORTED_FUNCTION;
2381
2382 KRB_CREDENTIALS* creds = context->credentials;
2383
2384 const PSecBuffer sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2385 PSecBuffer data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2386
2387 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2388 return SEC_E_INVALID_TOKEN;
2389
2390 /* Read in header information */
2391 const BYTE* header = sig_buffer->pvBuffer;
2392 const uint16_t tok_id = winpr_Data_Get_UINT16_BE(header);
2393 const BYTE flags = header[2];
2394 const uint16_t ec = winpr_Data_Get_UINT16_BE(&header[4]);
2395 const uint16_t rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2396 const uint64_t seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2397
2398 /* Check that the header is valid */
2399 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2400 return SEC_E_INVALID_TOKEN;
2401
2402 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2403 return SEC_E_INVALID_TOKEN;
2404
2405 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2406 (seq_no != context->remote_seq + MessageSeqNo))
2407 return SEC_E_OUT_OF_SEQUENCE;
2408
2409 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2410 return SEC_E_INVALID_TOKEN;
2411
2412 /* We don't expect a trailer buffer; the encrypted header must be rotated */
2413 if (rrc < 16)
2414 return SEC_E_INVALID_TOKEN;
2415
2416 /* Find the proper key and key usage */
2417 krb5glue_key key = get_key(&context->keyset);
2418 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2419 return SEC_E_INTERNAL_ERROR;
2420 krb5_keyusage usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2421
2422 /* Fill in the lengths of the iov array */
2423 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2424 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2425 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2426 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2427 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2428 iov[1].data.length = data_buffer->cbBuffer;
2429 iov[2].data.length = 16;
2430 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2431 return SEC_E_INTERNAL_ERROR;
2432
2433 /* We don't expect a trailer buffer; everything must be in sig_buffer */
2434 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2435 return SEC_E_INVALID_TOKEN;
2436 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2437 return SEC_E_INVALID_TOKEN;
2438
2439 /* Locate the parts of the message */
2440 const size_t iov0Offset = 16ull + rrc + ec;
2441 if (iov0Offset + iov[0].data.length > sig_buffer->cbBuffer)
2442 return SEC_E_INVALID_TOKEN;
2443
2444 const size_t iov2Offset = 16ull + ec;
2445 if (iov2Offset + iov[2].data.length > sig_buffer->cbBuffer)
2446 return SEC_E_INVALID_TOKEN;
2447
2448 iov[0].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov0Offset], char*);
2449 iov[1].data.data = data_buffer->pvBuffer;
2450 iov[2].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov2Offset], char*);
2451 char* data2 = iov[2].data.data;
2452 iov[3].data.data = &data2[iov[2].data.length];
2453
2454 char* data3 = iov[3].data.data;
2455 iov[4].data.data = &data3[iov[3].data.length];
2456
2457 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2458 return SEC_E_INTERNAL_ERROR;
2459
2460 /* Validate the encrypted header */
2461 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2462 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2463 if (memcmp(iov[2].data.data, header, 16) != 0)
2464 return SEC_E_MESSAGE_ALTERED;
2465
2466 *pfQOP = 0;
2467
2468 return SEC_E_OK;
2469#else
2470 return SEC_E_UNSUPPORTED_FUNCTION;
2471#endif
2472}
2473
2474WINPR_ATTR_NODISCARD
2475static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2476 WINPR_ATTR_UNUSED ULONG fQOP,
2477 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2478 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2479{
2480#ifdef WITH_KRB5
2481 KRB_CONTEXT* context = get_context(phContext);
2482 PSecBuffer sig_buffer = nullptr;
2483 PSecBuffer data_buffer = nullptr;
2484 krb5glue_key key = nullptr;
2485 krb5_keyusage usage = 0;
2486 BYTE flags = 0;
2487 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2488 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2489 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2490
2491 if (!context)
2492 return SEC_E_INVALID_HANDLE;
2493
2494 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2495 return SEC_E_UNSUPPORTED_FUNCTION;
2496
2497 KRB_CREDENTIALS* creds = context->credentials;
2498
2499 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2500 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2501
2502 if (!sig_buffer || !data_buffer)
2503 return SEC_E_INVALID_TOKEN;
2504
2505 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2506
2507 key = get_key(&context->keyset);
2508 if (!key)
2509 return SEC_E_INTERNAL_ERROR;
2510 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2511
2512 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2513
2514 /* Fill in the lengths of the iov array */
2515 iov[0].data.length = data_buffer->cbBuffer;
2516 iov[1].data.length = 16;
2517 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2518 return SEC_E_INTERNAL_ERROR;
2519
2520 /* Ensure the buffer is big enough */
2521 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2522 return SEC_E_INSUFFICIENT_MEMORY;
2523
2524 /* Write the header */
2525 char* header = sig_buffer->pvBuffer;
2526 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2527 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2528 memset(header + 3, 0xFF, 5);
2529 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2530
2531 /* Set up the iov array */
2532 iov[0].data.data = data_buffer->pvBuffer;
2533 iov[1].data.data = header;
2534 iov[2].data.data = header + 16;
2535
2536 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2537 return SEC_E_INTERNAL_ERROR;
2538
2539 sig_buffer->cbBuffer = iov[2].data.length + 16;
2540
2541 return SEC_E_OK;
2542#else
2543 return SEC_E_UNSUPPORTED_FUNCTION;
2544#endif
2545}
2546
2547WINPR_ATTR_NODISCARD
2548static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2549 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2550 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2551 WINPR_ATTR_UNUSED ULONG* pfQOP)
2552{
2553#ifdef WITH_KRB5
2554 PSecBuffer sig_buffer = nullptr;
2555 PSecBuffer data_buffer = nullptr;
2556 krb5glue_key key = nullptr;
2557 krb5_keyusage usage = 0;
2558 BYTE flags = 0;
2559 uint16_t tok_id = 0;
2560 uint64_t seq_no = 0;
2561 krb5_boolean is_valid = 0;
2562 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2563 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2564 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2565 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2566
2567 KRB_CONTEXT* context = get_context(phContext);
2568 if (!context)
2569 return SEC_E_INVALID_HANDLE;
2570
2571 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2572 return SEC_E_UNSUPPORTED_FUNCTION;
2573
2574 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2575 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2576
2577 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2578 return SEC_E_INVALID_TOKEN;
2579
2580 /* Read in header info */
2581 BYTE* header = sig_buffer->pvBuffer;
2582 tok_id = winpr_Data_Get_UINT16_BE(header);
2583 flags = header[2];
2584 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2585
2586 /* Validate header */
2587 if (tok_id != TOK_ID_MIC)
2588 return SEC_E_INVALID_TOKEN;
2589
2590 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2591 return SEC_E_INVALID_TOKEN;
2592
2593 if (memcmp(header + 3, cmp_filler, sizeof(cmp_filler)) != 0)
2594 return SEC_E_INVALID_TOKEN;
2595
2596 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2597 return SEC_E_OUT_OF_SEQUENCE;
2598
2599 /* Find the proper key and usage */
2600 key = get_key(&context->keyset);
2601 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2602 return SEC_E_INTERNAL_ERROR;
2603 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2604
2605 /* Fill in the iov array lengths */
2606 KRB_CREDENTIALS* creds = context->credentials;
2607 iov[0].data.length = data_buffer->cbBuffer;
2608 iov[1].data.length = 16;
2609 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2610 return SEC_E_INTERNAL_ERROR;
2611
2612 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2613 return SEC_E_INTERNAL_ERROR;
2614
2615 /* Set up the iov array */
2616 iov[0].data.data = data_buffer->pvBuffer;
2617 iov[1].data.data = (char*)header;
2618 iov[2].data.data = (char*)&header[16];
2619
2620 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2621 &is_valid))
2622 return SEC_E_INTERNAL_ERROR;
2623
2624 if (!is_valid)
2625 return SEC_E_MESSAGE_ALTERED;
2626
2627 return SEC_E_OK;
2628#else
2629 return SEC_E_UNSUPPORTED_FUNCTION;
2630#endif
2631}
2632
2633const SecurityFunctionTableA KERBEROS_SecurityFunctionTableA = {
2634 3, /* dwVersion */
2635 nullptr, /* EnumerateSecurityPackages */
2636 kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
2637 kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
2638 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2639 nullptr, /* Reserved2 */
2640 kerberos_InitializeSecurityContextA, /* InitializeSecurityContext */
2641 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2642 nullptr, /* CompleteAuthToken */
2643 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2644 nullptr, /* ApplyControlToken */
2645 kerberos_QueryContextAttributesA, /* QueryContextAttributes */
2646 nullptr, /* ImpersonateSecurityContext */
2647 nullptr, /* RevertSecurityContext */
2648 kerberos_MakeSignature, /* MakeSignature */
2649 kerberos_VerifySignature, /* VerifySignature */
2650 nullptr, /* FreeContextBuffer */
2651 nullptr, /* QuerySecurityPackageInfo */
2652 nullptr, /* Reserved3 */
2653 nullptr, /* Reserved4 */
2654 nullptr, /* ExportSecurityContext */
2655 nullptr, /* ImportSecurityContext */
2656 nullptr, /* AddCredentials */
2657 nullptr, /* Reserved8 */
2658 nullptr, /* QuerySecurityContextToken */
2659 kerberos_EncryptMessage, /* EncryptMessage */
2660 kerberos_DecryptMessage, /* DecryptMessage */
2661 kerberos_SetContextAttributesA, /* SetContextAttributes */
2662 kerberos_SetCredentialsAttributesA, /* SetCredentialsAttributes */
2663};
2664
2665const SecurityFunctionTableW KERBEROS_SecurityFunctionTableW = {
2666 3, /* dwVersion */
2667 nullptr, /* EnumerateSecurityPackages */
2668 kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
2669 kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
2670 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2671 nullptr, /* Reserved2 */
2672 kerberos_InitializeSecurityContextW, /* InitializeSecurityContext */
2673 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2674 nullptr, /* CompleteAuthToken */
2675 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2676 nullptr, /* ApplyControlToken */
2677 kerberos_QueryContextAttributesW, /* QueryContextAttributes */
2678 nullptr, /* ImpersonateSecurityContext */
2679 nullptr, /* RevertSecurityContext */
2680 kerberos_MakeSignature, /* MakeSignature */
2681 kerberos_VerifySignature, /* VerifySignature */
2682 nullptr, /* FreeContextBuffer */
2683 nullptr, /* QuerySecurityPackageInfo */
2684 nullptr, /* Reserved3 */
2685 nullptr, /* Reserved4 */
2686 nullptr, /* ExportSecurityContext */
2687 nullptr, /* ImportSecurityContext */
2688 nullptr, /* AddCredentials */
2689 nullptr, /* Reserved8 */
2690 nullptr, /* QuerySecurityContextToken */
2691 kerberos_EncryptMessage, /* EncryptMessage */
2692 kerberos_DecryptMessage, /* DecryptMessage */
2693 kerberos_SetContextAttributesW, /* SetContextAttributes */
2694 kerberos_SetCredentialsAttributesW, /* SetCredentialsAttributes */
2695};
2696
2697BOOL KERBEROS_init(void)
2698{
2699 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2700 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2701 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2702 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));
2703 return TRUE;
2704}
KERB_TICKET_LOGON
Definition secapi.h:51
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349
SEC_WINNT_AUTH_IDENTITY_WINPR
Definition include/winpr/sspi.h:944
SEC_WINPR_KERBEROS_SETTINGS
Definition include/winpr/sspi.h:927
SecPkgContext_AuthIdentity
Definition include/winpr/sspi.h:1511
SecPkgContext_PackageInfoA
Definition include/winpr/sspi.h:416
SecPkgContext_PackageInfoW
Definition include/winpr/sspi.h:421
SecPkgContext_Sizes
Definition include/winpr/sspi.h:450
SecPkgCredentials_KdcProxySettingsW
Definition include/winpr/sspi.h:548
WinPrAsn1_MemoryChunk
Definition asn1.h:92
krb5glue_keyset
Definition krb5glue.h:92
sspi_gss_data
Definition sspi_gss.h:36
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:816