FreeRDP
Loading...
Searching...
No Matches
kerberos.c
1
22#include <winpr/config.h>
23#include <winpr/library.h>
24
25#include <stdio.h>
26#include <stdlib.h>
27#include <string.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <ctype.h>
31
32#include <winpr/assert.h>
33#include <winpr/cast.h>
34#include <winpr/asn1.h>
35#include <winpr/crt.h>
36#include <winpr/interlocked.h>
37#include <winpr/sspi.h>
38#include <winpr/print.h>
39#include <winpr/tchar.h>
40#include <winpr/sysinfo.h>
41#include <winpr/registry.h>
42#include <winpr/endian.h>
43#include <winpr/crypto.h>
44#include <winpr/path.h>
45#include <winpr/wtypes.h>
46#include <winpr/winsock.h>
47#include <winpr/schannel.h>
48#include <winpr/secapi.h>
49
50#include "kerberos.h"
51
52#ifdef WITH_KRB5_MIT
53#include "krb5glue.h"
54#include <profile.h>
55#endif
56
57#ifdef WITH_KRB5_HEIMDAL
58#include "krb5glue.h"
59#include <krb5-protos.h>
60#endif
61
62#include "../sspi.h"
63#include "../../log.h"
64
65const SecPkgInfoA KERBEROS_SecPkgInfoA = {
66 0x000F3BBF, /* fCapabilities */
67 1, /* wVersion */
68 0x0010, /* wRPCID */
69 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
70 "Kerberos", /* Name */
71 "Kerberos Security Package" /* Comment */
72};
73
74static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = WINPR_C_ARRAY_INIT;
75static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = WINPR_C_ARRAY_INIT;
76
77const SecPkgInfoW KERBEROS_SecPkgInfoW = {
78 0x000F3BBF, /* fCapabilities */
79 1, /* wVersion */
80 0x0010, /* wRPCID */
81 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
82 KERBEROS_SecPkgInfoW_NameBuffer, /* Name */
83 KERBEROS_SecPkgInfoW_CommentBuffer /* Comment */
84};
85
86#ifdef WITH_KRB5
87#define TAG WINPR_TAG("sspi.Kerberos")
88
89#define KRB_TGT_REQ 16
90#define KRB_TGT_REP 17
91
92enum KERBEROS_STATE
93{
94 KERBEROS_STATE_INITIAL,
95 KERBEROS_STATE_TGT_REQ,
96 KERBEROS_STATE_TGT_REP,
97 KERBEROS_STATE_AP_REQ,
98 KERBEROS_STATE_AP_REP,
99 KERBEROS_STATE_FINAL
100};
101
102typedef struct KRB_CREDENTIALS_st
103{
104 volatile LONG refCount;
105 krb5_context ctx;
106 char* kdc_url;
107 krb5_ccache ccache;
108 krb5_keytab keytab;
109 krb5_keytab client_keytab;
110 BOOL own_ccache;
111} KRB_CREDENTIALS;
112
113struct s_KRB_CONTEXT
114{
115 enum KERBEROS_STATE state;
116 KRB_CREDENTIALS* credentials;
117 krb5_auth_context auth_ctx;
118 BOOL acceptor;
119 uint32_t flags;
120 uint64_t local_seq;
121 uint64_t remote_seq;
122 struct krb5glue_keyset keyset;
123 BOOL u2u;
124 char* targetHost;
125};
126
127static const WinPrAsn1_OID kerberos_OID = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
128static const WinPrAsn1_OID kerberos_u2u_OID = { 10,
129 (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
130krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code, const char* what,
131 const char* file, const char* fkt, size_t line)
132{
133 switch (code)
134 {
135 case 0:
136 case KRB5_KT_END:
137 break;
138 default:
139 {
140 const DWORD level = WLOG_ERROR;
141
142 wLog* log = WLog_Get(TAG);
143 if (WLog_IsLevelActive(log, level))
144 {
145 const char* msg = krb5_get_error_message(ctx, code);
146 WLog_PrintTextMessage(log, level, line, file, fkt, "%s (%s [%d])", what, msg, code);
147 krb5_free_error_message(ctx, msg);
148 }
149 }
150 break;
151 }
152 return code;
153}
154
155void krb_log_context_encryption(krb5_context ctx, krb5_principal princ)
156{
157#if !defined(WITH_KRB5_HEIMDAL)
158 typedef krb5_error_code KRB5_CALLCONV (*krb5_get_etype_info_fn)(
159 krb5_context context, krb5_principal principal, krb5_get_init_creds_opt* opt,
160 krb5_enctype* enctype_out, krb5_data* salt_out, krb5_data* s2kparams_out);
161
162 krb5_get_etype_info_fn fn =
163 GetProcAddressAs(nullptr, "krb5_get_etype_info", krb5_get_etype_info_fn);
164
165 if (fn)
166 {
167 krb5_get_init_creds_opt opt = WINPR_C_ARRAY_INIT;
168 krb5_enctype enctype = 0;
169 krb5_data salt = WINPR_C_ARRAY_INIT;
170 krb5_data s2kparam = WINPR_C_ARRAY_INIT;
171 char buffer[128] = WINPR_C_ARRAY_INIT;
172 krb5_error_code rv = krb_log_exec(fn, ctx, princ, &opt, &enctype, &salt, &s2kparam);
173 krb5_enctype_to_string(enctype, buffer, sizeof(buffer));
174 const char* msg = krb5_get_error_message(ctx, rv);
175
176 char* saltdata = winpr_BinToHexString(salt.data, salt.length, TRUE);
177 WLog_DBG(TAG, "[%s] enctype=%s, salt[%u]=%s, s2kparam[%u]=%s", msg, buffer, salt.length,
178 saltdata, s2kparam.length, s2kparam.data);
179
180 krb5_free_data_contents(ctx, &salt);
181 krb5_free_data_contents(ctx, &s2kparam);
182 krb5_free_error_message(ctx, msg);
183 free(saltdata);
184 }
185 else
186#endif
187 {
188 WLog_WARN(TAG,
189 "kerberos implementation does not support 'krb5_get_etype_info', not displaying "
190 "encryption information");
191 }
192}
193
194static void credentials_unref(KRB_CREDENTIALS* credentials);
195
196static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
197{
198 if (!ctx)
199 return;
200
201 free(ctx->targetHost);
202 ctx->targetHost = nullptr;
203
204 if (ctx->credentials)
205 {
206 krb5_context krbctx = ctx->credentials->ctx;
207 if (krbctx)
208 {
209 if (ctx->auth_ctx)
210 krb5_auth_con_free(krbctx, ctx->auth_ctx);
211
212 krb5glue_keys_free(krbctx, &ctx->keyset);
213 }
214
215 credentials_unref(ctx->credentials);
216 }
217
218 if (allocated)
219 free(ctx);
220}
221
222static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
223{
224 KRB_CONTEXT* context = nullptr;
225
226 context = (KRB_CONTEXT*)calloc(1, sizeof(KRB_CONTEXT));
227 if (!context)
228 return nullptr;
229
230 context->credentials = credentials;
231 InterlockedIncrement(&credentials->refCount);
232 return context;
233}
234
235static krb5_error_code krb5_prompter(krb5_context context, void* data,
236 WINPR_ATTR_UNUSED const char* name,
237 WINPR_ATTR_UNUSED const char* banner, int num_prompts,
238 krb5_prompt prompts[])
239{
240 for (int i = 0; i < num_prompts; i++)
241 {
242 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
243 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
244 {
245 prompts[i].reply->data = _strdup((const char*)data);
246
247 const size_t len = strlen((const char*)data);
248 if (len > UINT32_MAX)
249 return KRB5KRB_ERR_GENERIC;
250 prompts[i].reply->length = (UINT32)len;
251 }
252 }
253 return 0;
254}
255
256WINPR_ATTR_NODISCARD static inline krb5glue_key get_key(struct krb5glue_keyset* keyset)
257{
258 return keyset->acceptor_key ? keyset->acceptor_key
259 : keyset->initiator_key ? keyset->initiator_key
260 : keyset->session_key;
261}
262
263static BOOL isValidIPv4(const char* ipAddress)
264{
265 struct sockaddr_in sa = WINPR_C_ARRAY_INIT;
266 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
267 return result != 0;
268}
269
270static BOOL isValidIPv6(const char* ipAddress)
271{
272 struct sockaddr_in6 sa = WINPR_C_ARRAY_INIT;
273 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
274 return result != 0;
275}
276
277static BOOL isValidIP(const char* ipAddress)
278{
279 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
280}
281
282#if defined(WITH_KRB5_MIT)
283WINPR_ATTR_MALLOC(free, 1)
284WINPR_ATTR_NODISCARD
285static char* get_realm_name(krb5_data realm, size_t* plen)
286{
287 WINPR_ASSERT(plen);
288 *plen = 0;
289 if ((realm.length <= 0) || (!realm.data))
290 return nullptr;
291
292 char* name = nullptr;
293 (void)winpr_asprintf(&name, plen, "krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
294 realm.data);
295 return name;
296}
297#elif defined(WITH_KRB5_HEIMDAL)
298WINPR_ATTR_MALLOC(free, 1)
299WINPR_ATTR_NODISCARD
300static char* get_realm_name(Realm realm, size_t* plen)
301{
302 WINPR_ASSERT(plen);
303 *plen = 0;
304 if (!realm)
305 return nullptr;
306
307 char* name = nullptr;
308 (void)winpr_asprintf(&name, plen, "krbtgt/%s@%s", realm, realm);
309 return name;
310}
311#endif
312
313static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
314{
315 /* "krbtgt/" + realm + "@" + realm */
316 size_t len = 0;
317 krb5_error_code rv = KRB5_CC_NOMEM;
318
319 char* name = get_realm_name(principal->realm, &len);
320 if (!name || (len == 0))
321 goto fail;
322
323 {
324 krb5_principal target = WINPR_C_ARRAY_INIT;
325 rv = krb5_parse_name(ctx, name, &target);
326 *ptarget = target;
327 }
328fail:
329 free(name);
330 return rv;
331}
332
333#endif /* WITH_KRB5 */
334
335static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
336 WINPR_ATTR_UNUSED SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage,
337 WINPR_ATTR_UNUSED ULONG fCredentialUse, WINPR_ATTR_UNUSED void* pvLogonID,
338 WINPR_ATTR_UNUSED void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
339 WINPR_ATTR_UNUSED void* pvGetKeyArgument, WINPR_ATTR_UNUSED PCredHandle phCredential,
340 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
341{
342#ifdef WITH_KRB5
343#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
344 SEC_WINPR_KERBEROS_SETTINGS_V2 krb_settings_v1_buffer = WINPR_C_ARRAY_INIT;
345#endif
346
347 SEC_WINPR_KERBEROS_SETTINGS_V2* krb_settings = nullptr;
348 KRB_CREDENTIALS* credentials = nullptr;
349 krb5_context ctx = nullptr;
350 krb5_ccache ccache = nullptr;
351 krb5_keytab keytab = nullptr;
352 krb5_principal principal = nullptr;
353 char* domain = nullptr;
354 char* username = nullptr;
355 char* password = nullptr;
356 BOOL own_ccache = FALSE;
357 const char* const default_ccache_type = "MEMORY";
358
359 if (pAuthData)
360 {
361 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
362
363#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
364 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
365 {
366 SEC_WINPR_KERBEROS_SETTINGS* krb_settingsV1 =
367 (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->kerberosSettings);
368 if (krb_settingsV1)
369 {
370 krb_settings_v1_buffer.kdcUrl = krb_settingsV1->kdcUrl;
371 krb_settings_v1_buffer.keytab = krb_settingsV1->keytab;
372 krb_settings_v1_buffer.cache = krb_settingsV1->cache;
373 krb_settings_v1_buffer.armorCache = krb_settingsV1->armorCache;
374 krb_settings_v1_buffer.pkinitX509Anchors = krb_settingsV1->pkinitX509Anchors;
375 krb_settings_v1_buffer.pkinitX509Identity = krb_settingsV1->pkinitX509Identity;
376 krb_settings_v1_buffer.withPac = krb_settingsV1->withPac;
377 krb_settings_v1_buffer.startTime = krb_settingsV1->startTime;
378 krb_settings_v1_buffer.renewLifeTime = krb_settingsV1->renewLifeTime;
379 krb_settings_v1_buffer.lifeTime = krb_settingsV1->lifeTime;
380 memcpy(krb_settings_v1_buffer.certSha1, krb_settingsV1->certSha1,
381 sizeof(krb_settings_v1_buffer.certSha1));
382 krb_settings = &krb_settings_v1_buffer;
383 }
384 }
385#endif
386 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED_v2)
387 {
388 const SEC_WINNT_AUTH_IDENTITY_WINPR_V2* auth =
389 (const SEC_WINNT_AUTH_IDENTITY_WINPR_V2*)pAuthData;
390 WINPR_ASSERT(auth);
391 if (auth->version < SEC_WINNT_AUTH_IDENTITY_WINPR_V2_REVISION_1)
392 goto cleanup;
393 krb_settings = auth->kerberosSettingsV2;
394 }
395
396 if (!sspi_CopyAuthIdentityFieldsA((const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData, &username,
397 &domain, &password))
398 {
399 WLog_ERR(TAG, "Failed to copy auth identity fields");
400 goto cleanup;
401 }
402
403 if (!pszPrincipal)
404 pszPrincipal = username;
405 }
406
407 if (krb_log_exec_ptr(krb5_init_context, &ctx))
408 goto cleanup;
409
410 if (domain)
411 {
412 char* udomain = _strdup(domain);
413 if (!udomain)
414 goto cleanup;
415
416 CharUpperA(udomain);
417 /* Will use domain if realm is not specified in username */
418 krb5_error_code rv = krb_log_exec(krb5_set_default_realm, ctx, udomain);
419 free(udomain);
420
421 if (rv)
422 goto cleanup;
423 }
424
425 if (pszPrincipal)
426 {
427 char* cpszPrincipal = _strdup(pszPrincipal);
428 if (!cpszPrincipal)
429 goto cleanup;
430
431 /* Find realm component if included and convert to uppercase */
432 char* p = strchr(cpszPrincipal, '@');
433 if (p)
434 CharUpperA(p);
435
436 krb5_error_code rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, &principal);
437 free(cpszPrincipal);
438
439 if (rv)
440 goto cleanup;
441 WINPR_ASSERT(principal);
442 }
443
444 if (krb_settings && krb_settings->cache)
445 {
446 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
447 goto cleanup;
448 }
449 else
450 own_ccache = TRUE;
451
452 if (principal)
453 {
454 /* Use the default cache if it's initialized with the right principal */
455 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
456 {
457 if (own_ccache)
458 {
459 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
460 goto cleanup;
461 }
462 else
463 {
464 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
465 goto cleanup;
466 }
467
468 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
469 goto cleanup;
470 }
471 else
472 {
473 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
474 goto cleanup;
475 own_ccache = FALSE;
476 }
477 WINPR_ASSERT(ccache);
478 }
479 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
480 {
481 /* Use the default cache with it's default principal */
482 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
483 goto cleanup;
484 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
485 goto cleanup;
486 WINPR_ASSERT(ccache);
487 own_ccache = FALSE;
488 }
489 else
490 {
491 if (own_ccache)
492 {
493 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
494 goto cleanup;
495 }
496 else
497 {
498 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
499 goto cleanup;
500 }
501 WINPR_ASSERT(ccache);
502 }
503
504 if (krb_settings && krb_settings->keytab)
505 {
506 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
507 goto cleanup;
508 }
509 else
510 {
511 if (fCredentialUse & SECPKG_CRED_INBOUND)
512 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
513 goto cleanup;
514 }
515
516 /* Get initial credentials if required */
517 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
518 {
519 krb5_creds creds = WINPR_C_ARRAY_INIT;
520 krb5_creds matchCreds = WINPR_C_ARRAY_INIT;
521 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
522
523 krb5_timeofday(ctx, &matchCreds.times.endtime);
524 matchCreds.times.endtime += 60;
525 matchCreds.client = principal;
526
527 WINPR_ASSERT(principal);
528 WINPR_ASSERT(ctx);
529 WINPR_ASSERT(ccache);
530 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
531 goto cleanup;
532
533 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
534 krb5_free_principal(ctx, matchCreds.server);
535 krb5_free_cred_contents(ctx, &creds);
536 if (rv)
537 {
538 if (krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
539 password, krb_settings))
540 goto cleanup;
541 }
542 }
543
544 credentials = calloc(1, sizeof(KRB_CREDENTIALS));
545 if (!credentials)
546 goto cleanup;
547 credentials->refCount = 1;
548 credentials->ctx = ctx;
549 credentials->ccache = ccache;
550 credentials->keytab = keytab;
551 credentials->own_ccache = own_ccache;
552
553cleanup:
554
555 free(domain);
556 free(username);
557 free(password);
558
559 if (principal)
560 krb5_free_principal(ctx, principal);
561 if (ctx)
562 {
563 if (!credentials)
564 {
565 if (ccache)
566 {
567 if (own_ccache)
568 krb5_cc_destroy(ctx, ccache);
569 else
570 krb5_cc_close(ctx, ccache);
571 }
572 if (keytab)
573 krb5_kt_close(ctx, keytab);
574
575 krb5_free_context(ctx);
576 }
577 }
578
579 /* If we managed to get credentials set the output */
580 if (credentials)
581 {
582 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
583 sspi_SecureHandleSetUpperPointer(phCredential, (void*)KERBEROS_SSP_NAME);
584 return SEC_E_OK;
585 }
586
587 return SEC_E_NO_CREDENTIALS;
588#else
589 return SEC_E_UNSUPPORTED_FUNCTION;
590#endif
591}
592
593static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
594 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
595 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
596 PTimeStamp ptsExpiry)
597{
598 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
599 char* principal = nullptr;
600 char* package = nullptr;
601
602 if (pszPrincipal)
603 {
604 principal = ConvertWCharToUtf8Alloc(pszPrincipal, nullptr);
605 if (!principal)
606 goto fail;
607 }
608 if (pszPackage)
609 {
610 package = ConvertWCharToUtf8Alloc(pszPackage, nullptr);
611 if (!package)
612 goto fail;
613 }
614
615 status =
616 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
617 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
618
619fail:
620 free(principal);
621 free(package);
622
623 return status;
624}
625
626#ifdef WITH_KRB5
627static void credentials_unref(KRB_CREDENTIALS* credentials)
628{
629 WINPR_ASSERT(credentials);
630
631 if (InterlockedDecrement(&credentials->refCount))
632 return;
633
634 free(credentials->kdc_url);
635
636 if (credentials->ccache)
637 {
638 if (credentials->own_ccache)
639 krb5_cc_destroy(credentials->ctx, credentials->ccache);
640 else
641 krb5_cc_close(credentials->ctx, credentials->ccache);
642 }
643 if (credentials->keytab)
644 krb5_kt_close(credentials->ctx, credentials->keytab);
645
646 krb5_free_context(credentials->ctx);
647 free(credentials);
648}
649#endif
650
651static SECURITY_STATUS
652 SEC_ENTRY kerberos_FreeCredentialsHandle(WINPR_ATTR_UNUSED PCredHandle phCredential)
653{
654#ifdef WITH_KRB5
655 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
656 sspi_SecureHandleInvalidate(phCredential);
657 if (!credentials)
658 return SEC_E_INVALID_HANDLE;
659
660 credentials_unref(credentials);
661
662 return SEC_E_OK;
663#else
664 return SEC_E_UNSUPPORTED_FUNCTION;
665#endif
666}
667
668static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
669 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
670 WINPR_ATTR_UNUSED void* pBuffer)
671{
672#ifdef WITH_KRB5
673 switch (ulAttribute)
674 {
675 case SECPKG_CRED_ATTR_NAMES:
676 return SEC_E_OK;
677 default:
678 WLog_ERR(TAG, "TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
679 ulAttribute);
680 return SEC_E_UNSUPPORTED_FUNCTION;
681 }
682
683#else
684 return SEC_E_UNSUPPORTED_FUNCTION;
685#endif
686}
687
688static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(PCredHandle phCredential,
689 ULONG ulAttribute,
690 void* pBuffer)
691{
692 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
693}
694
695#ifdef WITH_KRB5
696
697static BOOL kerberos_mk_tgt_token(SecBuffer* buf, int msg_type, char* sname, char* host,
698 const krb5_data* ticket)
699{
700 WinPrAsn1Encoder* enc = nullptr;
701 WinPrAsn1_MemoryChunk data;
702 wStream s;
703 size_t len = 0;
704 sspi_gss_data token;
705 BOOL ret = FALSE;
706
707 WINPR_ASSERT(buf);
708
709 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
710 return FALSE;
711 if (msg_type == KRB_TGT_REP && !ticket)
712 return FALSE;
713
714 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
715 if (!enc)
716 return FALSE;
717
718 /* KERB-TGT-REQUEST (SEQUENCE) */
719 if (!WinPrAsn1EncSeqContainer(enc))
720 goto cleanup;
721
722 /* pvno [0] INTEGER */
723 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
724 goto cleanup;
725
726 /* msg-type [1] INTEGER */
727 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
728 goto cleanup;
729
730 if (msg_type == KRB_TGT_REQ && sname)
731 {
732 /* server-name [2] PrincipalName (SEQUENCE) */
733 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
734 goto cleanup;
735
736 /* name-type [0] INTEGER */
737 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
738 goto cleanup;
739
740 /* name-string [1] SEQUENCE OF GeneralString */
741 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
742 goto cleanup;
743
744 if (!WinPrAsn1EncGeneralString(enc, sname))
745 goto cleanup;
746
747 if (host && !WinPrAsn1EncGeneralString(enc, host))
748 goto cleanup;
749
750 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
751 goto cleanup;
752 }
753 else if (msg_type == KRB_TGT_REP)
754 {
755 /* ticket [2] Ticket */
756 data.data = (BYTE*)ticket->data;
757 data.len = ticket->length;
758 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
759 goto cleanup;
760 }
761
762 if (!WinPrAsn1EncEndContainer(enc))
763 goto cleanup;
764
765 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
766 goto cleanup;
767
768 Stream_StaticInit(&s, buf->pvBuffer, len);
769 if (!WinPrAsn1EncToStream(enc, &s))
770 goto cleanup;
771
772 token.data = buf->pvBuffer;
773 token.length = (UINT)len;
774 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
775 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
776 ret = TRUE;
777
778cleanup:
779 WinPrAsn1Encoder_Free(&enc);
780 return ret;
781}
782
783static BOOL append(char* dst, size_t dstSize, const char* src)
784{
785 const size_t dlen = strnlen(dst, dstSize);
786 const size_t slen = strlen(src);
787 if (dlen + slen >= dstSize)
788 return FALSE;
789 if (!strncat(dst, src, dstSize - dlen))
790 return FALSE;
791 return TRUE;
792}
793
794static BOOL kerberos_rd_tgt_req_tag2(WinPrAsn1Decoder* dec, char* buf, size_t len)
795{
796 BOOL rc = FALSE;
797 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
798
799 /* server-name [2] PrincipalName (SEQUENCE) */
800 if (!WinPrAsn1DecReadSequence(dec, &seq))
801 goto end;
802
803 /* name-type [0] INTEGER */
804 {
805 BOOL error = FALSE;
806 {
807 WinPrAsn1_INTEGER val = 0;
808 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
809 goto end;
810 }
811
812 /* name-string [1] SEQUENCE OF GeneralString */
813 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
814 goto end;
815 }
816
817 {
818 WinPrAsn1_tag tag = 0;
819 BOOL first = TRUE;
820 while (WinPrAsn1DecPeekTag(dec, &tag))
821 {
822 BOOL success = FALSE;
823 char* lstr = nullptr;
824 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
825 goto fail;
826
827 if (!first)
828 {
829 if (!append(buf, len, "/"))
830 goto fail;
831 }
832 first = FALSE;
833
834 if (!append(buf, len, lstr))
835 goto fail;
836
837 success = TRUE;
838 fail:
839 free(lstr);
840 if (!success)
841 goto end;
842 }
843 }
844
845 rc = TRUE;
846end:
847 return rc;
848}
849
850static BOOL kerberos_rd_tgt_req_tag3(WinPrAsn1Decoder* dec, char* buf, size_t len)
851{
852 /* realm [3] Realm */
853 BOOL rc = FALSE;
854 WinPrAsn1_STRING str = nullptr;
855 if (!WinPrAsn1DecReadGeneralString(dec, &str))
856 goto end;
857
858 if (!append(buf, len, "@"))
859 goto end;
860 if (!append(buf, len, str))
861 goto end;
862
863 rc = TRUE;
864end:
865 free(str);
866 return rc;
867}
868
869static BOOL kerberos_rd_tgt_req(WinPrAsn1Decoder* dec, char** target)
870{
871 BOOL rc = FALSE;
872
873 if (!target)
874 return FALSE;
875 *target = nullptr;
876
877 wStream s = WinPrAsn1DecGetStream(dec);
878 const size_t len = Stream_Length(&s);
879 if (len == 0)
880 return TRUE;
881
882 WinPrAsn1Decoder dec2 = WinPrAsn1Decoder_init();
883 WinPrAsn1_tagId tag = 0;
884 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
885 return FALSE;
886
887 char* buf = calloc(len + 1, sizeof(char));
888 if (!buf)
889 return FALSE;
890
891 /* We expect ASN1 context tag values 2 or 3.
892 *
893 * In case we got value 2 an (optional) context tag value 3 might follow.
894 */
895 BOOL checkForTag3 = TRUE;
896 if (tag == 2)
897 {
898 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
899 if (rc)
900 {
901 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
902 if (res == 0)
903 checkForTag3 = FALSE;
904 }
905 }
906
907 if (checkForTag3)
908 {
909 if (tag == 3)
910 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
911 else
912 rc = FALSE;
913 }
914
915 if (rc)
916 *target = buf;
917 else
918 free(buf);
919 return rc;
920}
921
922static BOOL kerberos_rd_tgt_rep(WinPrAsn1Decoder* dec, krb5_data* ticket)
923{
924 if (!ticket)
925 return FALSE;
926
927 /* ticket [2] Ticket */
928 WinPrAsn1Decoder asnTicket = WinPrAsn1Decoder_init();
929 WinPrAsn1_tagId tag = 0;
930 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
931 return FALSE;
932
933 if (tag != 2)
934 return FALSE;
935
936 wStream s = WinPrAsn1DecGetStream(&asnTicket);
937 ticket->data = Stream_BufferAs(&s, char);
938
939 const size_t len = Stream_Length(&s);
940 if (len > UINT32_MAX)
941 return FALSE;
942 ticket->length = (UINT32)len;
943 return TRUE;
944}
945
946static BOOL kerberos_rd_tgt_token(const sspi_gss_data* token, char** target, krb5_data* ticket)
947{
948 BOOL error = 0;
949 WinPrAsn1_INTEGER val = 0;
950
951 WINPR_ASSERT(token);
952
953 if (target)
954 *target = nullptr;
955
956 WinPrAsn1Decoder der = WinPrAsn1Decoder_init();
957 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
958
959 /* KERB-TGT-REQUEST (SEQUENCE) */
960 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
961 if (!WinPrAsn1DecReadSequence(&der, &seq))
962 return FALSE;
963
964 /* pvno [0] INTEGER */
965 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
966 return FALSE;
967
968 /* msg-type [1] INTEGER */
969 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
970 return FALSE;
971
972 switch (val)
973 {
974 case KRB_TGT_REQ:
975 return kerberos_rd_tgt_req(&seq, target);
976 case KRB_TGT_REP:
977 return kerberos_rd_tgt_rep(&seq, ticket);
978 default:
979 break;
980 }
981 return FALSE;
982}
983
984static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5, SEC_CHANNEL_BINDINGS* bindings)
985{
986 BYTE buf[4];
987
988 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
989 if (!winpr_Digest_Update(md5, buf, 4))
990 return FALSE;
991
992 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
993 if (!winpr_Digest_Update(md5, buf, 4))
994 return FALSE;
995
996 if (bindings->cbInitiatorLength &&
997 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
998 bindings->cbInitiatorLength))
999 return FALSE;
1000
1001 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
1002 if (!winpr_Digest_Update(md5, buf, 4))
1003 return FALSE;
1004
1005 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
1006 if (!winpr_Digest_Update(md5, buf, 4))
1007 return FALSE;
1008
1009 if (bindings->cbAcceptorLength &&
1010 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
1011 bindings->cbAcceptorLength))
1012 return FALSE;
1013
1014 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
1015 if (!winpr_Digest_Update(md5, buf, 4))
1016 return FALSE;
1017
1018 if (bindings->cbApplicationDataLength &&
1019 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
1020 bindings->cbApplicationDataLength))
1021 return FALSE;
1022
1023 return TRUE;
1024}
1025
1026#endif /* WITH_KRB5 */
1027
1028static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
1029 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1030 WINPR_ATTR_UNUSED SEC_CHAR* pszTargetName, WINPR_ATTR_UNUSED ULONG fContextReq,
1031 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1032 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG Reserved2,
1033 WINPR_ATTR_UNUSED PCtxtHandle phNewContext, WINPR_ATTR_UNUSED PSecBufferDesc pOutput,
1034 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
1035{
1036#ifdef WITH_KRB5
1037 PSecBuffer input_buffer = nullptr;
1038 PSecBuffer output_buffer = nullptr;
1039 PSecBuffer bindings_buffer = nullptr;
1040 WINPR_DIGEST_CTX* md5 = nullptr;
1041 char* target = nullptr;
1042 char* sname = nullptr;
1043 char* host = nullptr;
1044 krb5_data input_token = WINPR_C_ARRAY_INIT;
1045 krb5_data output_token = WINPR_C_ARRAY_INIT;
1046 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1047 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1048 uint16_t tok_id = 0;
1049 krb5_ap_rep_enc_part* reply = nullptr;
1050 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
1051 char cksum_contents[24] = WINPR_C_ARRAY_INIT;
1052 krb5_data cksum = WINPR_C_ARRAY_INIT;
1053 krb5_creds in_creds = WINPR_C_ARRAY_INIT;
1054 krb5_creds* creds = nullptr;
1055 BOOL isNewContext = FALSE;
1056 KRB_CONTEXT* context = nullptr;
1057 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1058
1059 /* behave like windows SSPIs that don't want empty context */
1060 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1061 return SEC_E_INVALID_HANDLE;
1062
1063 context = sspi_SecureHandleGetLowerPointer(phContext);
1064
1065 if (!credentials)
1066 return SEC_E_NO_CREDENTIALS;
1067
1068 if (pInput)
1069 {
1070 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1071 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
1072 }
1073 if (pOutput)
1074 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1075
1076 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
1077 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
1078
1079 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1080 ap_flags |= AP_OPTS_USE_SESSION_KEY;
1081
1082 /* Split target name into service/hostname components */
1083 if (pszTargetName)
1084 {
1085 target = _strdup(pszTargetName);
1086 if (!target)
1087 {
1088 status = SEC_E_INSUFFICIENT_MEMORY;
1089 goto cleanup;
1090 }
1091 host = strchr(target, '/');
1092 if (host)
1093 {
1094 *host++ = 0;
1095 sname = target;
1096 }
1097 else
1098 host = target;
1099 if (isValidIP(host))
1100 {
1101 status = SEC_E_NO_CREDENTIALS;
1102 goto cleanup;
1103 }
1104 }
1105
1106 if (!context)
1107 {
1108 context = kerberos_ContextNew(credentials);
1109 if (!context)
1110 {
1111 status = SEC_E_INSUFFICIENT_MEMORY;
1112 goto cleanup;
1113 }
1114
1115 isNewContext = TRUE;
1116
1117 if (host)
1118 context->targetHost = _strdup(host);
1119 if (!context->targetHost)
1120 {
1121 status = SEC_E_INSUFFICIENT_MEMORY;
1122 goto cleanup;
1123 }
1124
1125 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1126 {
1127 context->state = KERBEROS_STATE_TGT_REQ;
1128 context->u2u = TRUE;
1129 }
1130 else
1131 context->state = KERBEROS_STATE_AP_REQ;
1132 }
1133 else
1134 {
1135 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1136 goto bad_token;
1137 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1138 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1139 goto bad_token;
1140 }
1141
1142 /* SSPI flags are compatible with GSS flags except INTEG_FLAG */
1143 context->flags |= (fContextReq & 0x1F);
1144 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1145 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1146
1147 switch (context->state)
1148 {
1149 case KERBEROS_STATE_TGT_REQ:
1150
1151 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, nullptr))
1152 goto cleanup;
1153
1154 context->state = KERBEROS_STATE_TGT_REP;
1155 status = SEC_I_CONTINUE_NEEDED;
1156 break;
1157
1158 case KERBEROS_STATE_TGT_REP:
1159
1160 if (tok_id != TOK_ID_TGT_REP)
1161 goto bad_token;
1162
1163 if (!kerberos_rd_tgt_token(&input_token, nullptr, &in_creds.second_ticket))
1164 goto bad_token;
1165
1166 /* Continue to AP-REQ */
1167 /* fallthrough */
1168 WINPR_FALLTHROUGH
1169
1170 case KERBEROS_STATE_AP_REQ:
1171
1172 /* Set auth_context options */
1173 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1174 goto cleanup;
1175 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1176 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1177 goto cleanup;
1178 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1179 GSS_CHECKSUM_TYPE))
1180 goto cleanup;
1181
1182 /* Get a service ticket */
1183 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1184 KRB5_NT_SRV_HST, &in_creds.server))
1185 goto cleanup;
1186
1187 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1188 &in_creds.client))
1189 {
1190 status = SEC_E_WRONG_PRINCIPAL;
1191 goto cleanup;
1192 }
1193
1194 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1195 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1196 &creds))
1197 {
1198 status = SEC_E_NO_CREDENTIALS;
1199 goto cleanup;
1200 }
1201
1202 /* Write the checksum (delegation not implemented) */
1203 cksum.data = cksum_contents;
1204 cksum.length = sizeof(cksum_contents);
1205 winpr_Data_Write_UINT32(cksum_contents, 16);
1206 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1207
1208 if (bindings_buffer)
1209 {
1210 SEC_CHANNEL_BINDINGS* bindings = bindings_buffer->pvBuffer;
1211
1212 /* Sanity checks */
1213 if (bindings_buffer->cbBuffer < sizeof(SEC_CHANNEL_BINDINGS) ||
1214 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1215 bindings_buffer->cbBuffer ||
1216 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1217 bindings_buffer->cbBuffer ||
1218 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1219 bindings_buffer->cbBuffer)
1220 {
1221 status = SEC_E_BAD_BINDINGS;
1222 goto cleanup;
1223 }
1224
1225 md5 = winpr_Digest_New();
1226 if (!md5)
1227 goto cleanup;
1228
1229 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1230 goto cleanup;
1231
1232 if (!kerberos_hash_channel_bindings(md5, bindings))
1233 goto cleanup;
1234
1235 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1236 goto cleanup;
1237 }
1238
1239 /* Make the AP_REQ message */
1240 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1241 &cksum, creds, &output_token))
1242 goto cleanup;
1243
1244 if (!sspi_gss_wrap_token(output_buffer,
1245 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1246 TOK_ID_AP_REQ, &output_token))
1247 goto cleanup;
1248
1249 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1250 {
1251 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1252 context->auth_ctx, (INT32*)&context->local_seq))
1253 goto cleanup;
1254 context->remote_seq ^= context->local_seq;
1255 }
1256
1257 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1258 &context->keyset))
1259 goto cleanup;
1260
1261 context->state = KERBEROS_STATE_AP_REP;
1262
1263 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1264 status = SEC_I_CONTINUE_NEEDED;
1265 else
1266 status = SEC_E_OK;
1267 break;
1268
1269 case KERBEROS_STATE_AP_REP:
1270
1271 if (tok_id == TOK_ID_AP_REP)
1272 {
1273 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1274 &reply))
1275 goto cleanup;
1276 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1277 }
1278 else if (tok_id == TOK_ID_ERROR)
1279 {
1280 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1281 goto cleanup;
1282 }
1283 else
1284 goto bad_token;
1285
1286 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1287 {
1288 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1289 context->auth_ctx, (INT32*)&context->remote_seq))
1290 goto cleanup;
1291 }
1292
1293 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1294 &context->keyset))
1295 goto cleanup;
1296
1297 context->state = KERBEROS_STATE_FINAL;
1298
1299 if (output_buffer)
1300 output_buffer->cbBuffer = 0;
1301 status = SEC_E_OK;
1302 break;
1303
1304 case KERBEROS_STATE_FINAL:
1305 default:
1306 WLog_ERR(TAG, "Kerberos in invalid state!");
1307 goto cleanup;
1308 }
1309
1310cleanup:
1311{
1312 /* second_ticket is not allocated */
1313 krb5_data edata = WINPR_C_ARRAY_INIT;
1314 in_creds.second_ticket = edata;
1315 krb5_free_cred_contents(credentials->ctx, &in_creds);
1316}
1317
1318 krb5_free_creds(credentials->ctx, creds);
1319 if (output_token.data)
1320 krb5glue_free_data_contents(credentials->ctx, &output_token);
1321
1322 winpr_Digest_Free(md5);
1323
1324 free(target);
1325
1326 if (isNewContext)
1327 {
1328 switch (status)
1329 {
1330 case SEC_E_OK:
1331 case SEC_I_CONTINUE_NEEDED:
1332 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1333 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1334 break;
1335 default:
1336 kerberos_ContextFree(context, TRUE);
1337 sspi_SecureHandleInvalidate(phNewContext);
1338 break;
1339 }
1340 }
1341
1342 return status;
1343
1344bad_token:
1345 status = SEC_E_INVALID_TOKEN;
1346 goto cleanup;
1347#else
1348 return SEC_E_UNSUPPORTED_FUNCTION;
1349#endif /* WITH_KRB5 */
1350}
1351
1352static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1353 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1354 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1355 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr, PTimeStamp ptsExpiry)
1356{
1357 SECURITY_STATUS status = 0;
1358 char* target_name = nullptr;
1359
1360 if (pszTargetName)
1361 {
1362 target_name = ConvertWCharToUtf8Alloc(pszTargetName, nullptr);
1363 if (!target_name)
1364 return SEC_E_INSUFFICIENT_MEMORY;
1365 }
1366
1367 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1368 Reserved1, TargetDataRep, pInput, Reserved2,
1369 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1370
1371 if (target_name)
1372 free(target_name);
1373
1374 return status;
1375}
1376
1377#ifdef WITH_KRB5
1378static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1379 krb5_creds* creds)
1380{
1381 BOOL ret = FALSE;
1382 krb5_kt_cursor cur = WINPR_C_ARRAY_INIT;
1383 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1384 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1385 goto cleanup;
1386
1387 do
1388 {
1389 krb5_error_code rv =
1390 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1391 if (rv == KRB5_KT_END)
1392 break;
1393 if (rv != 0)
1394 goto cleanup;
1395
1396 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1397 break;
1398 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1399 memset(&entry, 0, sizeof(entry));
1400 if (rv)
1401 goto cleanup;
1402 } while (1);
1403
1404 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1405 goto cleanup;
1406
1407 if (!entry.principal)
1408 goto cleanup;
1409
1410 /* Get the TGT */
1411 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1412 credentials->keytab, 0, nullptr, nullptr))
1413 goto cleanup;
1414
1415 ret = TRUE;
1416
1417cleanup:
1418 return ret;
1419}
1420
1421static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials, const char* target, krb5_creds* creds)
1422{
1423 BOOL ret = TRUE;
1424 krb5_principal target_princ = WINPR_C_ARRAY_INIT;
1425 char* default_realm = nullptr;
1426
1427 krb5_error_code rv =
1428 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1429 if (rv)
1430 return FALSE;
1431
1432#if defined(WITH_KRB5_HEIMDAL)
1433 if (!target_princ->realm)
1434 {
1435 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1436 if (rv)
1437 goto out;
1438
1439 target_princ->realm = default_realm;
1440 }
1441#else
1442 if (!target_princ->realm.length)
1443 {
1444 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1445 if (rv)
1446 goto out;
1447
1448 target_princ->realm.data = default_realm;
1449 target_princ->realm.length = (unsigned int)strlen(default_realm);
1450 }
1451#endif
1452
1453 /*
1454 * First try with the account service. We were requested with something like
1455 * TERMSRV/<host>@<realm>, let's see if we have that in our keytab and if we're able
1456 * to retrieve a TGT with that entry
1457 *
1458 */
1459 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1460 goto out;
1461
1462 ret = FALSE;
1463
1464#if defined(WITH_KRB5_MIT)
1465 /*
1466 * if it's not working let's try with <host>$@<REALM> (note the dollar)
1467 */
1468 {
1469 char hostDollar[300] = WINPR_C_ARRAY_INIT;
1470 if (target_princ->length < 2)
1471 goto out;
1472
1473 (void)snprintf(hostDollar, sizeof(hostDollar) - 1, "%s$@%s", target_princ->data[1].data,
1474 target_princ->realm.data);
1475 krb5_free_principal(credentials->ctx, target_princ);
1476
1477 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1478 if (rv)
1479 return FALSE;
1480 }
1481 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1482#endif
1483
1484out:
1485 if (default_realm)
1486 krb5_free_default_realm(credentials->ctx, default_realm);
1487
1488 krb5_free_principal(credentials->ctx, target_princ);
1489 return ret;
1490}
1491#endif
1492
1493static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1494 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1495 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG fContextReq,
1496 WINPR_ATTR_UNUSED ULONG TargetDataRep, WINPR_ATTR_UNUSED PCtxtHandle phNewContext,
1497 WINPR_ATTR_UNUSED PSecBufferDesc pOutput, WINPR_ATTR_UNUSED ULONG* pfContextAttr,
1498 WINPR_ATTR_UNUSED PTimeStamp ptsExpity)
1499{
1500#ifdef WITH_KRB5
1501 BOOL isNewContext = FALSE;
1502 PSecBuffer input_buffer = nullptr;
1503 PSecBuffer output_buffer = nullptr;
1504 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1505 uint16_t tok_id = 0;
1506 krb5_data input_token = WINPR_C_ARRAY_INIT;
1507 krb5_data output_token = WINPR_C_ARRAY_INIT;
1508 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1509 krb5_flags ap_flags = 0;
1510 krb5glue_authenticator authenticator = nullptr;
1511 char* target = nullptr;
1512 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1513 krb5_creds creds = WINPR_C_ARRAY_INIT;
1514
1515 /* behave like windows SSPIs that don't want empty context */
1516 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1517 return SEC_E_INVALID_HANDLE;
1518
1519 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1520 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1521
1522 if (pInput)
1523 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1524 if (pOutput)
1525 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1526
1527 if (!input_buffer)
1528 return SEC_E_INVALID_TOKEN;
1529
1530 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1531 return SEC_E_INVALID_TOKEN;
1532
1533 if (!context)
1534 {
1535 isNewContext = TRUE;
1536 context = kerberos_ContextNew(credentials);
1537 context->acceptor = TRUE;
1538
1539 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1540 {
1541 context->u2u = TRUE;
1542 context->state = KERBEROS_STATE_TGT_REQ;
1543 }
1544 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1545 context->state = KERBEROS_STATE_AP_REQ;
1546 else
1547 goto bad_token;
1548 }
1549 else
1550 {
1551 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1552 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1553 goto bad_token;
1554 }
1555
1556 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1557 {
1558 if (!kerberos_rd_tgt_token(&input_token, &target, nullptr))
1559 goto bad_token;
1560
1561 if (!retrieveSomeTgt(credentials, target, &creds))
1562 goto cleanup;
1563
1564 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, nullptr, nullptr, &creds.ticket))
1565 goto cleanup;
1566
1567 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1568 goto cleanup;
1569
1570 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1571 &krb5glue_creds_getkey(creds)))
1572 goto cleanup;
1573
1574 context->state = KERBEROS_STATE_AP_REQ;
1575 }
1576 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1577 {
1578 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, nullptr,
1579 credentials->keytab, &ap_flags, nullptr))
1580 goto cleanup;
1581
1582 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1583 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1584 goto cleanup;
1585
1586 /* Retrieve and validate the checksum */
1587 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1588 &authenticator))
1589 goto cleanup;
1590 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1591 &context->flags))
1592 goto bad_token;
1593
1594 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1595 {
1596 if (!output_buffer)
1597 goto bad_token;
1598 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1599 goto cleanup;
1600 if (!sspi_gss_wrap_token(output_buffer,
1601 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1602 TOK_ID_AP_REP, &output_token))
1603 goto cleanup;
1604 }
1605 else
1606 {
1607 if (output_buffer)
1608 output_buffer->cbBuffer = 0;
1609 }
1610
1611 *pfContextAttr = (context->flags & 0x1F);
1612 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1613 *pfContextAttr |= ASC_RET_INTEGRITY;
1614
1615 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1616 {
1617 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1618 (INT32*)&context->local_seq))
1619 goto cleanup;
1620 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1621 (INT32*)&context->remote_seq))
1622 goto cleanup;
1623 }
1624
1625 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1626 &context->keyset))
1627 goto cleanup;
1628
1629 context->state = KERBEROS_STATE_FINAL;
1630 }
1631 else
1632 goto bad_token;
1633
1634 /* On first call allocate new context */
1635 if (context->state == KERBEROS_STATE_FINAL)
1636 status = SEC_E_OK;
1637 else
1638 status = SEC_I_CONTINUE_NEEDED;
1639
1640cleanup:
1641 free(target);
1642 if (output_token.data)
1643 krb5glue_free_data_contents(credentials->ctx, &output_token);
1644 if (entry.principal)
1645 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1646
1647 if (isNewContext)
1648 {
1649 switch (status)
1650 {
1651 case SEC_E_OK:
1652 case SEC_I_CONTINUE_NEEDED:
1653 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1654 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1655 break;
1656 default:
1657 kerberos_ContextFree(context, TRUE);
1658 sspi_SecureHandleInvalidate(phNewContext);
1659 break;
1660 }
1661 }
1662
1663 return status;
1664
1665bad_token:
1666 status = SEC_E_INVALID_TOKEN;
1667 goto cleanup;
1668#else
1669 return SEC_E_UNSUPPORTED_FUNCTION;
1670#endif /* WITH_KRB5 */
1671}
1672
1673#ifdef WITH_KRB5
1674static KRB_CONTEXT* get_context(PCtxtHandle phContext)
1675{
1676 if (!phContext)
1677 return nullptr;
1678
1679 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1680 if (!name)
1681 return nullptr;
1682
1683 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1684 return nullptr;
1685 return sspi_SecureHandleGetLowerPointer(phContext);
1686}
1687
1688static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1689{
1690 WINPR_ASSERT(data);
1691 WINPR_ASSERT(ptr);
1692 WINPR_ASSERT(psize);
1693
1694 *ptr = (PUCHAR)malloc(data->length);
1695 if (!*ptr)
1696 return FALSE;
1697
1698 *psize = data->length;
1699 memcpy(*ptr, data->data, data->length);
1700 return TRUE;
1701}
1702#endif
1703
1704static SECURITY_STATUS
1705 SEC_ENTRY kerberos_DeleteSecurityContext(WINPR_ATTR_UNUSED PCtxtHandle phContext)
1706{
1707#ifdef WITH_KRB5
1708 KRB_CONTEXT* context = get_context(phContext);
1709 sspi_SecureHandleInvalidate(phContext);
1710 if (!context)
1711 return SEC_E_INVALID_HANDLE;
1712
1713 kerberos_ContextFree(context, TRUE);
1714
1715 return SEC_E_OK;
1716#else
1717 return SEC_E_UNSUPPORTED_FUNCTION;
1718#endif
1719}
1720
1721#ifdef WITH_KRB5
1722
1723static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1724{
1725 switch (code)
1726 {
1727 case 0:
1728 return SEC_E_OK;
1729 default:
1730 return SEC_E_INTERNAL_ERROR;
1731 }
1732}
1733
1734static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1735 SecPkgContext_Sizes* ContextSizes)
1736{
1737 UINT header = 0;
1738 UINT pad = 0;
1739 UINT trailer = 0;
1740 krb5glue_key key = nullptr;
1741
1742 WINPR_ASSERT(context);
1743 WINPR_ASSERT(context->auth_ctx);
1744
1745 /* The MaxTokenSize by default is 12,000 bytes. This has been the default value
1746 * since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2.
1747 * For Windows Server 2012, the default value of the MaxTokenSize registry
1748 * entry is 48,000 bytes.*/
1749 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1750 ContextSizes->cbMaxSignature = 0;
1751 ContextSizes->cbBlockSize = 1;
1752 ContextSizes->cbSecurityTrailer = 0;
1753
1754 key = get_key(&context->keyset);
1755
1756 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1757 {
1758 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1759 KRB5_CRYPTO_TYPE_HEADER, &header);
1760 if (rv)
1761 return krb5_error_to_SECURITY_STATUS(rv);
1762
1763 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1764 &pad);
1765 if (rv)
1766 return krb5_error_to_SECURITY_STATUS(rv);
1767
1768 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1769 &trailer);
1770 if (rv)
1771 return krb5_error_to_SECURITY_STATUS(rv);
1772
1773 /* GSS header (= 16 bytes) + encrypted header = 32 bytes */
1774 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1775 }
1776
1777 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1778 {
1779 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1780 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1781 if (rv)
1782 return krb5_error_to_SECURITY_STATUS(rv);
1783
1784 ContextSizes->cbMaxSignature += 16;
1785 }
1786
1787 return SEC_E_OK;
1788}
1789
1790static SECURITY_STATUS kerberos_ATTR_AUTH_IDENTITY(KRB_CONTEXT* context,
1791 KRB_CREDENTIALS* credentials,
1792 SecPkgContext_AuthIdentity* AuthIdentity)
1793{
1794 const SecPkgContext_AuthIdentity empty = WINPR_C_ARRAY_INIT;
1795
1796 WINPR_ASSERT(context);
1797 WINPR_ASSERT(context->auth_ctx);
1798 WINPR_ASSERT(credentials);
1799
1800 WINPR_ASSERT(AuthIdentity);
1801 *AuthIdentity = empty;
1802
1803 krb5glue_authenticator authenticator = nullptr;
1804 krb5_error_code rv = krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx,
1805 context->auth_ctx, &authenticator);
1806 if (rv)
1807 goto fail;
1808
1809 {
1810 rv = -1;
1811
1812#if defined(WITH_KRB5_HEIMDAL)
1813 const Realm data = authenticator->crealm;
1814 if (!data)
1815 goto fail;
1816 const size_t data_len = length_Realm(&data);
1817#else
1818 krb5_data* realm_data = krb5_princ_realm(credentials->ctx, authenticator->client);
1819 if (!realm_data)
1820 goto fail;
1821 const char* data = realm_data->data;
1822 if (!data)
1823 goto fail;
1824 const size_t data_len = realm_data->length;
1825#endif
1826
1827 if (data_len > (sizeof(AuthIdentity->Domain) - 1))
1828 goto fail;
1829 strncpy(AuthIdentity->Domain, data, data_len);
1830 }
1831
1832 {
1833#if defined(WITH_KRB5_HEIMDAL)
1834 const PrincipalName* principal = &authenticator->cname;
1835 const size_t name_length = length_PrincipalName(principal);
1836 if (!principal->name_string.val)
1837 goto fail;
1838 const char* name = *principal->name_string.val;
1839#else
1840 char* name = nullptr;
1841 rv = krb_log_exec(krb5_unparse_name_flags, credentials->ctx, authenticator->client,
1842 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
1843 if (rv)
1844 goto fail;
1845
1846 const size_t name_length = strlen(name);
1847#endif
1848
1849 const bool ok = (name_length <= (sizeof(AuthIdentity->User) - 1));
1850 if (ok)
1851 strncpy(AuthIdentity->User, name, name_length);
1852
1853 rv = ok ? 0 : -1;
1854
1855#if !defined(WITH_KRB5_HEIMDAL)
1856 krb5_free_unparsed_name(credentials->ctx, name);
1857#endif
1858 }
1859
1860fail:
1861 krb5glue_free_authenticator(credentials->ctx, authenticator);
1862 return krb5_error_to_SECURITY_STATUS(rv);
1863}
1864
1865static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_A(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1866 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1867 SecPkgContext_PackageInfoA* PackageInfo)
1868{
1869 size_t size = sizeof(SecPkgInfoA);
1870 SecPkgInfoA* pPackageInfo =
1871 (SecPkgInfoA*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1872
1873 if (!pPackageInfo)
1874 return SEC_E_INSUFFICIENT_MEMORY;
1875
1876 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoA.fCapabilities;
1877 pPackageInfo->wVersion = KERBEROS_SecPkgInfoA.wVersion;
1878 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoA.wRPCID;
1879 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1880 pPackageInfo->Name = _strdup(KERBEROS_SecPkgInfoA.Name);
1881 pPackageInfo->Comment = _strdup(KERBEROS_SecPkgInfoA.Comment);
1882
1883 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1884 {
1885 sspi_ContextBufferFree(pPackageInfo);
1886 return SEC_E_INSUFFICIENT_MEMORY;
1887 }
1888 PackageInfo->PackageInfo = pPackageInfo;
1889 return SEC_E_OK;
1890}
1891
1892static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_W(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1893 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1894 SecPkgContext_PackageInfoW* PackageInfo)
1895{
1896 size_t size = sizeof(SecPkgInfoW);
1897 SecPkgInfoW* pPackageInfo =
1898 (SecPkgInfoW*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1899
1900 if (!pPackageInfo)
1901 return SEC_E_INSUFFICIENT_MEMORY;
1902
1903 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoW.fCapabilities;
1904 pPackageInfo->wVersion = KERBEROS_SecPkgInfoW.wVersion;
1905 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoW.wRPCID;
1906 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoW.cbMaxToken;
1907 pPackageInfo->Name = _wcsdup(KERBEROS_SecPkgInfoW.Name);
1908 pPackageInfo->Comment = _wcsdup(KERBEROS_SecPkgInfoW.Comment);
1909
1910 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1911 {
1912 sspi_ContextBufferFree(pPackageInfo);
1913 return SEC_E_INSUFFICIENT_MEMORY;
1914 }
1915 PackageInfo->PackageInfo = pPackageInfo;
1916 return SEC_E_OK;
1917}
1918
1919static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
1920 KRB_CREDENTIALS* credentials,
1921 KERB_TICKET_LOGON* ticketLogon)
1922{
1923 krb5_creds matchCred = WINPR_C_ARRAY_INIT;
1924 krb5_auth_context authContext = nullptr;
1925 krb5_flags getCredsFlags = KRB5_GC_CACHED;
1926 BOOL firstRun = TRUE;
1927 krb5_creds* hostCred = nullptr;
1928 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
1929 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost, "HOST",
1930 KRB5_NT_SRV_HST, &matchCred.server);
1931 if (rv)
1932 goto out;
1933
1934 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1935 &matchCred.client);
1936 if (rv)
1937 goto out;
1938
1939 /* try from the cache first, and then do a new request */
1940again:
1941 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
1942 &matchCred, &hostCred);
1943 switch (rv)
1944 {
1945 case 0:
1946 break;
1947 case KRB5_CC_NOTFOUND:
1948 getCredsFlags = 0;
1949 if (firstRun)
1950 {
1951 firstRun = FALSE;
1952 goto again;
1953 }
1954 WINPR_FALLTHROUGH
1955 default:
1956 WLog_ERR(TAG, "krb5_get_credentials(hostCreds), rv=%d", rv);
1957 goto out;
1958 }
1959
1960 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
1961 goto out;
1962
1963 {
1964 krb5_data derOut = WINPR_C_ARRAY_INIT;
1965 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
1966 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
1967 {
1968 ret = SEC_E_LOGON_DENIED;
1969 goto out;
1970 }
1971
1972 ticketLogon->MessageType = KerbTicketLogon;
1973 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
1974
1975 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
1976 &ticketLogon->ServiceTicketLength))
1977 {
1978 krb5_free_data(credentials->ctx, &derOut);
1979 goto out;
1980 }
1981
1982 ticketLogon->TicketGrantingTicketLength = derOut.length;
1983 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
1984 }
1985
1986 ret = SEC_E_OK;
1987out:
1988 krb5_auth_con_free(credentials->ctx, authContext);
1989 krb5_free_creds(credentials->ctx, hostCred);
1990 krb5_free_cred_contents(credentials->ctx, &matchCred);
1991 return ret;
1992}
1993
1994#endif /* WITH_KRB5 */
1995
1996WINPR_ATTR_NODISCARD
1997static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesCommon(
1998 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
1999{
2000 if (!phContext)
2001 return SEC_E_INVALID_HANDLE;
2002
2003 if (!pBuffer)
2004 return SEC_E_INVALID_PARAMETER;
2005
2006#ifdef WITH_KRB5
2007 KRB_CONTEXT* context = get_context(phContext);
2008 if (!context)
2009 return SEC_E_INVALID_PARAMETER;
2010
2011 KRB_CREDENTIALS* credentials = context->credentials;
2012
2013 switch (ulAttribute)
2014 {
2015 case SECPKG_ATTR_SIZES:
2016 return kerberos_ATTR_SIZES(context, credentials, (SecPkgContext_Sizes*)pBuffer);
2017
2018 case SECPKG_ATTR_AUTH_IDENTITY:
2019 return kerberos_ATTR_AUTH_IDENTITY(context, credentials,
2020 (SecPkgContext_AuthIdentity*)pBuffer);
2021
2022 case SECPKG_CRED_ATTR_TICKET_LOGON:
2023 return kerberos_ATTR_TICKET_LOGON(context, credentials, (KERB_TICKET_LOGON*)pBuffer);
2024
2025 default:
2026 WLog_ERR(TAG, "TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
2027 ulAttribute);
2028 return SEC_E_UNSUPPORTED_FUNCTION;
2029 }
2030#else
2031 return SEC_E_UNSUPPORTED_FUNCTION;
2032#endif
2033}
2034
2035static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(
2036 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2037{
2038 if (!phContext)
2039 return SEC_E_INVALID_HANDLE;
2040
2041 if (!pBuffer)
2042 return SEC_E_INVALID_PARAMETER;
2043
2044#ifdef WITH_KRB5
2045 KRB_CONTEXT* context = get_context(phContext);
2046 if (!context)
2047 return SEC_E_INVALID_PARAMETER;
2048
2049 KRB_CREDENTIALS* credentials = context->credentials;
2050
2051 switch (ulAttribute)
2052 {
2053 case SECPKG_ATTR_PACKAGE_INFO:
2054 return kerberos_ATTR_PACKAGE_INFO_A(context, credentials,
2055 (SecPkgContext_PackageInfoA*)pBuffer);
2056 default:
2057 break;
2058 }
2059#endif
2060 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2061}
2062
2063static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(PCtxtHandle phContext,
2064 ULONG ulAttribute, void* pBuffer)
2065{
2066 if (!phContext)
2067 return SEC_E_INVALID_HANDLE;
2068
2069 if (!pBuffer)
2070 return SEC_E_INVALID_PARAMETER;
2071
2072#ifdef WITH_KRB5
2073 KRB_CONTEXT* context = get_context(phContext);
2074 if (!context)
2075 return SEC_E_INVALID_PARAMETER;
2076
2077 KRB_CREDENTIALS* credentials = context->credentials;
2078
2079 switch (ulAttribute)
2080 {
2081 case SECPKG_ATTR_PACKAGE_INFO:
2082 return kerberos_ATTR_PACKAGE_INFO_W(context, credentials,
2083 (SecPkgContext_PackageInfoW*)pBuffer);
2084 default:
2085 break;
2086 }
2087#endif
2088 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2089}
2090
2091static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
2092 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2093 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2094{
2095 return SEC_E_UNSUPPORTED_FUNCTION;
2096}
2097
2098static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
2099 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2100 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2101{
2102 return SEC_E_UNSUPPORTED_FUNCTION;
2103}
2104
2105static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(
2106 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
2107 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer,
2108 WINPR_ATTR_UNUSED BOOL unicode)
2109{
2110#ifdef WITH_KRB5
2111 KRB_CREDENTIALS* credentials = nullptr;
2112
2113 if (!phCredential)
2114 return SEC_E_INVALID_HANDLE;
2115
2116 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
2117
2118 if (!credentials)
2119 return SEC_E_INVALID_HANDLE;
2120
2121 if (!pBuffer)
2122 return SEC_E_INSUFFICIENT_MEMORY;
2123
2124 switch (ulAttribute)
2125 {
2126 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
2127 {
2128 SecPkgCredentials_KdcProxySettingsW* kdc_settings = pBuffer;
2129
2130 /* Sanity checks */
2131 if (cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2132 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
2133 kdc_settings->ProxyServerOffset < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2134 cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) +
2135 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
2136 return SEC_E_INVALID_TOKEN;
2137
2138 if (credentials->kdc_url)
2139 {
2140 free(credentials->kdc_url);
2141 credentials->kdc_url = nullptr;
2142 }
2143
2144 if (kdc_settings->ProxyServerLength > 0)
2145 {
2146 WCHAR* proxy = WINPR_PACKED_ALIGN_CAST(
2147 WCHAR*, ((BYTE*)pBuffer + kdc_settings->ProxyServerOffset));
2148
2149 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
2150 proxy, kdc_settings->ProxyServerLength / sizeof(WCHAR), nullptr);
2151 if (!credentials->kdc_url)
2152 return SEC_E_INSUFFICIENT_MEMORY;
2153 }
2154
2155 return SEC_E_OK;
2156 }
2157 case SECPKG_CRED_ATTR_NAMES:
2158 case SECPKG_ATTR_SUPPORTED_ALGS:
2159 default:
2160 WLog_ERR(TAG, "TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
2161 ulAttribute);
2162 return SEC_E_UNSUPPORTED_FUNCTION;
2163 }
2164
2165#else
2166 return SEC_E_UNSUPPORTED_FUNCTION;
2167#endif
2168}
2169
2170static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(PCredHandle phCredential,
2171 ULONG ulAttribute,
2172 void* pBuffer, ULONG cbBuffer)
2173{
2174 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
2175}
2176
2177static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(PCredHandle phCredential,
2178 ULONG ulAttribute,
2179 void* pBuffer, ULONG cbBuffer)
2180{
2181 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
2182}
2183
2184static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2185 WINPR_ATTR_UNUSED ULONG fQOP,
2186 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2187 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2188{
2189#ifdef WITH_KRB5
2190 KRB_CONTEXT* context = get_context(phContext);
2191 PSecBuffer sig_buffer = nullptr;
2192 PSecBuffer data_buffer = nullptr;
2193 char* header = nullptr;
2194 BYTE flags = 0;
2195 krb5glue_key key = nullptr;
2196 krb5_keyusage usage = 0;
2197 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2198 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2199 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2200 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2201 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2202
2203 if (!context)
2204 return SEC_E_INVALID_HANDLE;
2205
2206 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2207 return SEC_E_UNSUPPORTED_FUNCTION;
2208
2209 KRB_CREDENTIALS* creds = context->credentials;
2210
2211 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2212 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2213
2214 if (!sig_buffer || !data_buffer)
2215 return SEC_E_INVALID_TOKEN;
2216
2217 if (fQOP)
2218 return SEC_E_QOP_NOT_SUPPORTED;
2219
2220 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2221 flags |= FLAG_WRAP_CONFIDENTIAL;
2222
2223 key = get_key(&context->keyset);
2224 if (!key)
2225 return SEC_E_INTERNAL_ERROR;
2226
2227 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2228
2229 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
2230
2231 /* Set the lengths of the data (plaintext + header) */
2232 encrypt_iov[1].data.length = data_buffer->cbBuffer;
2233 encrypt_iov[2].data.length = 16;
2234
2235 /* Get the lengths of the header, trailer, and padding and ensure sig_buffer is large enough */
2236 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
2237 ARRAYSIZE(encrypt_iov)))
2238 return SEC_E_INTERNAL_ERROR;
2239 if (sig_buffer->cbBuffer <
2240 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
2241 return SEC_E_INSUFFICIENT_MEMORY;
2242
2243 /* Set up the iov array in sig_buffer */
2244 header = sig_buffer->pvBuffer;
2245 encrypt_iov[2].data.data = header + 16;
2246 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
2247 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
2248 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
2249 encrypt_iov[1].data.data = data_buffer->pvBuffer;
2250
2251 /* Write the GSS header with 0 in RRC */
2252 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
2253 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2254 header[3] = (char)0xFF;
2255 winpr_Data_Write_UINT32(header + 4, 0);
2256 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2257
2258 /* Copy header to be encrypted */
2259 CopyMemory(encrypt_iov[2].data.data, header, 16);
2260
2261 /* Set the correct RRC */
2262 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
2263 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
2264
2265 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
2266 ARRAYSIZE(encrypt_iov)))
2267 return SEC_E_INTERNAL_ERROR;
2268
2269 return SEC_E_OK;
2270#else
2271 return SEC_E_UNSUPPORTED_FUNCTION;
2272#endif
2273}
2274
2275static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2276 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2277 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2278 WINPR_ATTR_UNUSED ULONG* pfQOP)
2279{
2280#ifdef WITH_KRB5
2281 KRB_CONTEXT* context = get_context(phContext);
2282 if (!context)
2283 return SEC_E_INVALID_HANDLE;
2284
2285 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2286 return SEC_E_UNSUPPORTED_FUNCTION;
2287
2288 KRB_CREDENTIALS* creds = context->credentials;
2289
2290 const PSecBuffer sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2291 PSecBuffer data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2292
2293 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2294 return SEC_E_INVALID_TOKEN;
2295
2296 /* Read in header information */
2297 const BYTE* header = sig_buffer->pvBuffer;
2298 const uint16_t tok_id = winpr_Data_Get_UINT16_BE(header);
2299 const BYTE flags = header[2];
2300 const uint16_t ec = winpr_Data_Get_UINT16_BE(&header[4]);
2301 const uint16_t rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2302 const uint64_t seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2303
2304 /* Check that the header is valid */
2305 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2306 return SEC_E_INVALID_TOKEN;
2307
2308 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2309 return SEC_E_INVALID_TOKEN;
2310
2311 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2312 (seq_no != context->remote_seq + MessageSeqNo))
2313 return SEC_E_OUT_OF_SEQUENCE;
2314
2315 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2316 return SEC_E_INVALID_TOKEN;
2317
2318 /* We don't expect a trailer buffer; the encrypted header must be rotated */
2319 if (rrc < 16)
2320 return SEC_E_INVALID_TOKEN;
2321
2322 /* Find the proper key and key usage */
2323 krb5glue_key key = get_key(&context->keyset);
2324 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2325 return SEC_E_INTERNAL_ERROR;
2326 krb5_keyusage usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2327
2328 /* Fill in the lengths of the iov array */
2329 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2330 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2331 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2332 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2333 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2334 iov[1].data.length = data_buffer->cbBuffer;
2335 iov[2].data.length = 16;
2336 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2337 return SEC_E_INTERNAL_ERROR;
2338
2339 /* We don't expect a trailer buffer; everything must be in sig_buffer */
2340 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2341 return SEC_E_INVALID_TOKEN;
2342 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2343 return SEC_E_INVALID_TOKEN;
2344
2345 /* Locate the parts of the message */
2346 const size_t iov0Offset = 16ull + rrc + ec;
2347 if (iov0Offset + iov[0].data.length > sig_buffer->cbBuffer)
2348 return SEC_E_INVALID_TOKEN;
2349
2350 const size_t iov2Offset = 16ull + ec;
2351 if (iov2Offset + iov[2].data.length > sig_buffer->cbBuffer)
2352 return SEC_E_INVALID_TOKEN;
2353
2354 iov[0].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov0Offset], char*);
2355 iov[1].data.data = data_buffer->pvBuffer;
2356 iov[2].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov2Offset], char*);
2357 char* data2 = iov[2].data.data;
2358 iov[3].data.data = &data2[iov[2].data.length];
2359
2360 char* data3 = iov[3].data.data;
2361 iov[4].data.data = &data3[iov[3].data.length];
2362
2363 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2364 return SEC_E_INTERNAL_ERROR;
2365
2366 /* Validate the encrypted header */
2367 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2368 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2369 if (memcmp(iov[2].data.data, header, 16) != 0)
2370 return SEC_E_MESSAGE_ALTERED;
2371
2372 *pfQOP = 0;
2373
2374 return SEC_E_OK;
2375#else
2376 return SEC_E_UNSUPPORTED_FUNCTION;
2377#endif
2378}
2379
2380static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2381 WINPR_ATTR_UNUSED ULONG fQOP,
2382 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2383 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2384{
2385#ifdef WITH_KRB5
2386 KRB_CONTEXT* context = get_context(phContext);
2387 PSecBuffer sig_buffer = nullptr;
2388 PSecBuffer data_buffer = nullptr;
2389 krb5glue_key key = nullptr;
2390 krb5_keyusage usage = 0;
2391 BYTE flags = 0;
2392 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2393 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2394 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2395
2396 if (!context)
2397 return SEC_E_INVALID_HANDLE;
2398
2399 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2400 return SEC_E_UNSUPPORTED_FUNCTION;
2401
2402 KRB_CREDENTIALS* creds = context->credentials;
2403
2404 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2405 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2406
2407 if (!sig_buffer || !data_buffer)
2408 return SEC_E_INVALID_TOKEN;
2409
2410 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2411
2412 key = get_key(&context->keyset);
2413 if (!key)
2414 return SEC_E_INTERNAL_ERROR;
2415 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2416
2417 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2418
2419 /* Fill in the lengths of the iov array */
2420 iov[0].data.length = data_buffer->cbBuffer;
2421 iov[1].data.length = 16;
2422 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2423 return SEC_E_INTERNAL_ERROR;
2424
2425 /* Ensure the buffer is big enough */
2426 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2427 return SEC_E_INSUFFICIENT_MEMORY;
2428
2429 /* Write the header */
2430 char* header = sig_buffer->pvBuffer;
2431 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2432 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2433 memset(header + 3, 0xFF, 5);
2434 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2435
2436 /* Set up the iov array */
2437 iov[0].data.data = data_buffer->pvBuffer;
2438 iov[1].data.data = header;
2439 iov[2].data.data = header + 16;
2440
2441 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2442 return SEC_E_INTERNAL_ERROR;
2443
2444 sig_buffer->cbBuffer = iov[2].data.length + 16;
2445
2446 return SEC_E_OK;
2447#else
2448 return SEC_E_UNSUPPORTED_FUNCTION;
2449#endif
2450}
2451
2452static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2453 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2454 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2455 WINPR_ATTR_UNUSED ULONG* pfQOP)
2456{
2457#ifdef WITH_KRB5
2458 PSecBuffer sig_buffer = nullptr;
2459 PSecBuffer data_buffer = nullptr;
2460 krb5glue_key key = nullptr;
2461 krb5_keyusage usage = 0;
2462 BYTE flags = 0;
2463 uint16_t tok_id = 0;
2464 uint64_t seq_no = 0;
2465 krb5_boolean is_valid = 0;
2466 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2467 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2468 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2469 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2470
2471 KRB_CONTEXT* context = get_context(phContext);
2472 if (!context)
2473 return SEC_E_INVALID_HANDLE;
2474
2475 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2476 return SEC_E_UNSUPPORTED_FUNCTION;
2477
2478 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2479 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2480
2481 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2482 return SEC_E_INVALID_TOKEN;
2483
2484 /* Read in header info */
2485 BYTE* header = sig_buffer->pvBuffer;
2486 tok_id = winpr_Data_Get_UINT16_BE(header);
2487 flags = header[2];
2488 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2489
2490 /* Validate header */
2491 if (tok_id != TOK_ID_MIC)
2492 return SEC_E_INVALID_TOKEN;
2493
2494 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2495 return SEC_E_INVALID_TOKEN;
2496
2497 if (memcmp(header + 3, cmp_filler, sizeof(cmp_filler)) != 0)
2498 return SEC_E_INVALID_TOKEN;
2499
2500 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2501 return SEC_E_OUT_OF_SEQUENCE;
2502
2503 /* Find the proper key and usage */
2504 key = get_key(&context->keyset);
2505 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2506 return SEC_E_INTERNAL_ERROR;
2507 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2508
2509 /* Fill in the iov array lengths */
2510 KRB_CREDENTIALS* creds = context->credentials;
2511 iov[0].data.length = data_buffer->cbBuffer;
2512 iov[1].data.length = 16;
2513 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2514 return SEC_E_INTERNAL_ERROR;
2515
2516 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2517 return SEC_E_INTERNAL_ERROR;
2518
2519 /* Set up the iov array */
2520 iov[0].data.data = data_buffer->pvBuffer;
2521 iov[1].data.data = (char*)header;
2522 iov[2].data.data = (char*)&header[16];
2523
2524 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2525 &is_valid))
2526 return SEC_E_INTERNAL_ERROR;
2527
2528 if (!is_valid)
2529 return SEC_E_MESSAGE_ALTERED;
2530
2531 return SEC_E_OK;
2532#else
2533 return SEC_E_UNSUPPORTED_FUNCTION;
2534#endif
2535}
2536
2537const SecurityFunctionTableA KERBEROS_SecurityFunctionTableA = {
2538 3, /* dwVersion */
2539 nullptr, /* EnumerateSecurityPackages */
2540 kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
2541 kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
2542 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2543 nullptr, /* Reserved2 */
2544 kerberos_InitializeSecurityContextA, /* InitializeSecurityContext */
2545 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2546 nullptr, /* CompleteAuthToken */
2547 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2548 nullptr, /* ApplyControlToken */
2549 kerberos_QueryContextAttributesA, /* QueryContextAttributes */
2550 nullptr, /* ImpersonateSecurityContext */
2551 nullptr, /* RevertSecurityContext */
2552 kerberos_MakeSignature, /* MakeSignature */
2553 kerberos_VerifySignature, /* VerifySignature */
2554 nullptr, /* FreeContextBuffer */
2555 nullptr, /* QuerySecurityPackageInfo */
2556 nullptr, /* Reserved3 */
2557 nullptr, /* Reserved4 */
2558 nullptr, /* ExportSecurityContext */
2559 nullptr, /* ImportSecurityContext */
2560 nullptr, /* AddCredentials */
2561 nullptr, /* Reserved8 */
2562 nullptr, /* QuerySecurityContextToken */
2563 kerberos_EncryptMessage, /* EncryptMessage */
2564 kerberos_DecryptMessage, /* DecryptMessage */
2565 kerberos_SetContextAttributesA, /* SetContextAttributes */
2566 kerberos_SetCredentialsAttributesA, /* SetCredentialsAttributes */
2567};
2568
2569const SecurityFunctionTableW KERBEROS_SecurityFunctionTableW = {
2570 3, /* dwVersion */
2571 nullptr, /* EnumerateSecurityPackages */
2572 kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
2573 kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
2574 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2575 nullptr, /* Reserved2 */
2576 kerberos_InitializeSecurityContextW, /* InitializeSecurityContext */
2577 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2578 nullptr, /* CompleteAuthToken */
2579 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2580 nullptr, /* ApplyControlToken */
2581 kerberos_QueryContextAttributesW, /* QueryContextAttributes */
2582 nullptr, /* ImpersonateSecurityContext */
2583 nullptr, /* RevertSecurityContext */
2584 kerberos_MakeSignature, /* MakeSignature */
2585 kerberos_VerifySignature, /* VerifySignature */
2586 nullptr, /* FreeContextBuffer */
2587 nullptr, /* QuerySecurityPackageInfo */
2588 nullptr, /* Reserved3 */
2589 nullptr, /* Reserved4 */
2590 nullptr, /* ExportSecurityContext */
2591 nullptr, /* ImportSecurityContext */
2592 nullptr, /* AddCredentials */
2593 nullptr, /* Reserved8 */
2594 nullptr, /* QuerySecurityContextToken */
2595 kerberos_EncryptMessage, /* EncryptMessage */
2596 kerberos_DecryptMessage, /* DecryptMessage */
2597 kerberos_SetContextAttributesW, /* SetContextAttributes */
2598 kerberos_SetCredentialsAttributesW, /* SetCredentialsAttributes */
2599};
2600
2601BOOL KERBEROS_init(void)
2602{
2603 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2604 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2605 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2606 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));
2607 return TRUE;
2608}
KERB_TICKET_LOGON
Definition secapi.h:51
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349
SecPkgContext_AuthIdentity
Definition include/winpr/sspi.h:1505
SecPkgContext_PackageInfoA
Definition include/winpr/sspi.h:416
SecPkgContext_PackageInfoW
Definition include/winpr/sspi.h:421
SecPkgContext_Sizes
Definition include/winpr/sspi.h:450
SecPkgCredentials_KdcProxySettingsW
Definition include/winpr/sspi.h:548
WinPrAsn1_MemoryChunk
Definition asn1.h:92
krb5glue_keyset
Definition krb5glue.h:92
sspi_gss_data
Definition sspi_gss.h:36
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:816