FreeRDP
Loading...
Searching...
No Matches
ntlm_av_pairs.c
1
20#include <winpr/config.h>
21
22#include <winpr/assert.h>
23
24#include "ntlm.h"
25#include "../sspi.h"
26
27#include <winpr/crt.h>
28#include <winpr/print.h>
29#include <winpr/sysinfo.h>
30#include <winpr/tchar.h>
31#include <winpr/crypto.h>
32
33#include "ntlm_compute.h"
34
35#include "ntlm_av_pairs.h"
36
37#if defined(WITH_DEBUG_NTLM)
38#include "../../log.h"
39#define TAG WINPR_TAG("sspi.NTLM")
40#endif
41
42static BOOL ntlm_av_pair_get_next_offset(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pOffset);
43
44static BOOL ntlm_av_pair_check_data(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair, size_t size)
45{
46 size_t offset = 0;
47 if (!pAvPair || cbAvPair < sizeof(NTLM_AV_PAIR) + size)
48 return FALSE;
49 if (!ntlm_av_pair_get_next_offset(pAvPair, cbAvPair, &offset))
50 return FALSE;
51 return cbAvPair >= offset;
52}
53
54#ifdef WITH_DEBUG_NTLM
55static const char* get_av_pair_string(UINT16 pair)
56{
57 switch (pair)
58 {
59 case MsvAvEOL:
60 return "MsvAvEOL";
61 case MsvAvNbComputerName:
62 return "MsvAvNbComputerName";
63 case MsvAvNbDomainName:
64 return "MsvAvNbDomainName";
65 case MsvAvDnsComputerName:
66 return "MsvAvDnsComputerName";
67 case MsvAvDnsDomainName:
68 return "MsvAvDnsDomainName";
69 case MsvAvDnsTreeName:
70 return "MsvAvDnsTreeName";
71 case MsvAvFlags:
72 return "MsvAvFlags";
73 case MsvAvTimestamp:
74 return "MsvAvTimestamp";
75 case MsvAvSingleHost:
76 return "MsvAvSingleHost";
77 case MsvAvTargetName:
78 return "MsvAvTargetName";
79 case MsvAvChannelBindings:
80 return "MsvAvChannelBindings";
81 default:
82 return "UNKNOWN";
83 }
84}
85#endif
86
87static BOOL ntlm_av_pair_check(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair);
88static NTLM_AV_PAIR* ntlm_av_pair_next(NTLM_AV_PAIR* pAvPairList, size_t* pcbAvPairList);
89
90static inline void ntlm_av_pair_set_id(NTLM_AV_PAIR* pAvPair, UINT16 id)
91{
92 WINPR_ASSERT(pAvPair);
93 winpr_Data_Write_UINT16(&pAvPair->AvId, id);
94}
95
96static inline void ntlm_av_pair_set_len(NTLM_AV_PAIR* pAvPair, UINT16 len)
97{
98 WINPR_ASSERT(pAvPair);
99 winpr_Data_Write_UINT16(&pAvPair->AvLen, len);
100}
101
102static BOOL ntlm_av_pair_list_init(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
103{
104 NTLM_AV_PAIR* pAvPair = pAvPairList;
105
106 if (!pAvPair || (cbAvPairList < sizeof(NTLM_AV_PAIR)))
107 return FALSE;
108
109 ntlm_av_pair_set_id(pAvPair, MsvAvEOL);
110 ntlm_av_pair_set_len(pAvPair, 0);
111 return TRUE;
112}
113
114WINPR_ATTR_NODISCARD static inline BOOL ntlm_av_pair_get_id(const NTLM_AV_PAIR* pAvPair,
115 size_t size, UINT16* pair)
116{
117 if (!pAvPair || !pair)
118 return FALSE;
119
120 if (size < sizeof(NTLM_AV_PAIR))
121 return FALSE;
122
123 const UINT16 AvId = winpr_Data_Get_UINT16(&pAvPair->AvId);
124
125 *pair = AvId;
126 return TRUE;
127}
128
129ULONG ntlm_av_pair_list_length(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
130{
131 size_t cbAvPair = 0;
132 NTLM_AV_PAIR* pAvPair = nullptr;
133
134 pAvPair = ntlm_av_pair_get(pAvPairList, cbAvPairList, MsvAvEOL, &cbAvPair);
135 if (!pAvPair)
136 return 0;
137
138 if (pAvPair < pAvPairList)
139 return 0;
140
141 const size_t size = WINPR_ASSERTING_INT_CAST(size_t, ((PBYTE)pAvPair - (PBYTE)pAvPairList)) +
142 sizeof(NTLM_AV_PAIR);
143 WINPR_ASSERT(size <= UINT32_MAX);
144 WINPR_ASSERT(size >= 0);
145 return (ULONG)size;
146}
147
148WINPR_ATTR_NODISCARD static inline BOOL ntlm_av_pair_get_len(const NTLM_AV_PAIR* pAvPair,
149 size_t size, size_t* pAvLen)
150{
151 if (!pAvPair)
152 return FALSE;
153
154 if (size < sizeof(NTLM_AV_PAIR))
155 return FALSE;
156
157 const UINT16 AvLen = winpr_Data_Get_UINT16(&pAvPair->AvLen);
158
159 *pAvLen = AvLen;
160 return TRUE;
161}
162
163#ifdef WITH_DEBUG_NTLM
164void ntlm_print_av_pair_list(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
165{
166 UINT16 pair = 0;
167 size_t cbAvPair = cbAvPairList;
168 NTLM_AV_PAIR* pAvPair = pAvPairList;
169
170 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
171 return;
172
173 WLog_VRB(TAG, "AV_PAIRs =");
174
175 while (pAvPair && ntlm_av_pair_get_id(pAvPair, cbAvPair, &pair) && (pair != MsvAvEOL))
176 {
177 size_t cbLen = 0;
178 ntlm_av_pair_get_len(pAvPair, cbAvPair, &cbLen);
179
180 WLog_VRB(TAG, "\t%s AvId: %" PRIu16 " AvLen: %" PRIuz "", get_av_pair_string(pair), pair,
181 cbLen);
182 winpr_HexDump(TAG, WLOG_TRACE, ntlm_av_pair_get_value_pointer(pAvPair, cbAvPair), cbLen);
183
184 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
185 }
186}
187#endif
188
189static size_t ntlm_av_pair_list_size(size_t AvPairsCount, size_t AvPairsValueLength)
190{
191 /* size of headers + value lengths + terminating MsvAvEOL AV_PAIR */
192 return ((AvPairsCount + 1) * 4ULL) + AvPairsValueLength;
193}
194
195PBYTE ntlm_av_pair_get_value_pointer(NTLM_AV_PAIR* pAvPair, size_t cbAvPair)
196{
197 WINPR_ASSERT(pAvPair);
198 if (cbAvPair < sizeof(NTLM_AV_PAIR))
199 return nullptr;
200 return (PBYTE)pAvPair + sizeof(NTLM_AV_PAIR);
201}
202
203static BOOL ntlm_av_pair_get_next_offset(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pOffset)
204{
205 size_t avLen = 0;
206 if (!pOffset)
207 return FALSE;
208
209 if (!ntlm_av_pair_get_len(pAvPair, size, &avLen))
210 return FALSE;
211 *pOffset = avLen + sizeof(NTLM_AV_PAIR);
212 return TRUE;
213}
214
215static BOOL ntlm_av_pair_check(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair)
216{
217 return ntlm_av_pair_check_data(pAvPair, cbAvPair, 0);
218}
219
220static NTLM_AV_PAIR* ntlm_av_pair_next(NTLM_AV_PAIR* pAvPair, size_t* pcbAvPair)
221{
222 size_t offset = 0;
223
224 if (!pcbAvPair)
225 return nullptr;
226 if (!ntlm_av_pair_check(pAvPair, *pcbAvPair))
227 return nullptr;
228
229 if (!ntlm_av_pair_get_next_offset(pAvPair, *pcbAvPair, &offset))
230 return nullptr;
231
232 *pcbAvPair -= offset;
233 NTLM_AV_PAIR* next = (NTLM_AV_PAIR*)((PBYTE)pAvPair + offset);
234 if (!ntlm_av_pair_check(next, *pcbAvPair))
235 return nullptr;
236 return next;
237}
238
239NTLM_AV_PAIR* ntlm_av_pair_get(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList, NTLM_AV_ID AvId,
240 size_t* pcbAvPairListRemaining)
241{
242 UINT16 id = 0;
243 size_t cbAvPair = cbAvPairList;
244 NTLM_AV_PAIR* pAvPair = pAvPairList;
245
246 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
247 pAvPair = nullptr;
248
249 while (pAvPair && ntlm_av_pair_get_id(pAvPair, cbAvPair, &id))
250 {
251 if (id == AvId)
252 break;
253 if (id == MsvAvEOL)
254 {
255 pAvPair = nullptr;
256 break;
257 }
258
259 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
260 }
261
262 if (!pAvPair)
263 cbAvPair = 0;
264 if (pcbAvPairListRemaining)
265 *pcbAvPairListRemaining = cbAvPair;
266
267 return pAvPair;
268}
269
270static BOOL ntlm_av_pair_add(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList, NTLM_AV_ID AvId,
271 PBYTE Value, UINT16 AvLen)
272{
273 size_t cbAvPair = 0;
274 NTLM_AV_PAIR* pAvPair = nullptr;
275
276 pAvPair = ntlm_av_pair_get(pAvPairList, cbAvPairList, MsvAvEOL, &cbAvPair);
277
278 /* size of header + value length + terminating MsvAvEOL AV_PAIR */
279 if (!pAvPair || cbAvPair < 2 * sizeof(NTLM_AV_PAIR) + AvLen)
280 return FALSE;
281
282 ntlm_av_pair_set_id(pAvPair, (UINT16)AvId);
283 ntlm_av_pair_set_len(pAvPair, AvLen);
284 if (AvLen)
285 {
286 WINPR_ASSERT(Value != nullptr);
287 CopyMemory(ntlm_av_pair_get_value_pointer(pAvPair, cbAvPair), Value, AvLen);
288 }
289
290 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
291 return ntlm_av_pair_list_init(pAvPair, cbAvPair);
292}
293
294static BOOL ntlm_av_pair_valid(UINT16 pair)
295{
296 switch (pair)
297 {
298 case MsvAvEOL:
299 case MsvAvNbComputerName:
300 case MsvAvNbDomainName:
301 case MsvAvDnsComputerName:
302 case MsvAvDnsDomainName:
303 case MsvAvDnsTreeName:
304 case MsvAvFlags:
305 case MsvAvTimestamp:
306 case MsvAvSingleHost:
307 case MsvAvTargetName:
308 case MsvAvChannelBindings:
309 return TRUE;
310 default:
311 return FALSE;
312 }
313}
314
315static BOOL ntlm_av_pair_add_copy(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList,
316 NTLM_AV_PAIR* pAvPair, size_t cbAvPair)
317{
318 UINT16 pair = 0;
319 size_t avLen = 0;
320
321 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
322 return FALSE;
323
324 if (!ntlm_av_pair_get_id(pAvPair, cbAvPair, &pair))
325 return FALSE;
326
327 if (!ntlm_av_pair_get_len(pAvPair, cbAvPair, &avLen))
328 return FALSE;
329
330 if (!ntlm_av_pair_valid(pair))
331 return FALSE;
332
333 WINPR_ASSERT(avLen <= UINT16_MAX);
334 return ntlm_av_pair_add(pAvPairList, cbAvPairList, WINPR_ASSERTING_INT_CAST(NTLM_AV_ID, pair),
335 ntlm_av_pair_get_value_pointer(pAvPair, cbAvPair), (UINT16)avLen);
336}
337
338void ntlm_free_unicode_string(UNICODE_STRING* string)
339{
340 if (!string)
341 return;
342
343 if (string->Length != 0)
344 free(string->Buffer);
345 string->Buffer = nullptr;
346 string->Length = 0;
347 string->MaximumLength = 0;
348}
349
350UNICODE_STRING ntlm_clone_unicode_string(const UNICODE_STRING* other)
351{
352 UNICODE_STRING clone = WINPR_C_ARRAY_INIT;
353 if (!other || (other->Length == 0) || (other->MaximumLength == 0))
354 return clone;
355 if (other->Length > other->MaximumLength)
356 return clone;
357
358 /* Ensure copy is always \0 terminated. */
359 clone.Buffer = calloc(other->MaximumLength / sizeof(WCHAR) + 1ull, sizeof(WCHAR));
360 if (!clone.Buffer)
361 return clone;
362 clone.Length = other->Length;
363 clone.MaximumLength = other->MaximumLength;
364 memcpy(clone.Buffer, other->Buffer, clone.Length);
365 return clone;
366}
367
368UNICODE_STRING ntlm_from_unicode_string_w(const WCHAR* str, size_t wcharlen)
369{
370 UNICODE_STRING clone = WINPR_C_ARRAY_INIT;
371 if (!str || (wcharlen == 0))
372 return clone;
373 if (wcharlen > USHRT_MAX / sizeof(WCHAR))
374 return clone;
375 clone.Buffer = wcsndup(str, wcharlen);
376 if (!clone.Buffer)
377 return clone;
378 clone.Length = WINPR_ASSERTING_INT_CAST(UINT16, wcharlen * sizeof(WCHAR));
379 clone.MaximumLength = WINPR_ASSERTING_INT_CAST(UINT16, wcharlen * sizeof(WCHAR));
380 return clone;
381}
382
383UNICODE_STRING ntlm_from_unicode_string_utf8(const char* str, size_t charlen)
384{
385 UNICODE_STRING clone = WINPR_C_ARRAY_INIT;
386 if (!str || (charlen == 0))
387 return clone;
388
389 size_t wlen = 0;
390 clone.Buffer = ConvertUtf8NToWCharAlloc(str, charlen, &wlen);
391 if (!clone.Buffer)
392 return clone;
393 if (wlen > USHRT_MAX / sizeof(WCHAR))
394 {
395 free(clone.Buffer);
396 clone.Buffer = nullptr;
397 return clone;
398 }
399 clone.Length = WINPR_ASSERTING_INT_CAST(UINT16, wlen * sizeof(WCHAR));
400 clone.MaximumLength = WINPR_ASSERTING_INT_CAST(UINT16, wlen * sizeof(WCHAR));
401 return clone;
402}
403
404BOOL ntlm_is_unicode_string_empty(const UNICODE_STRING* str)
405{
406 WINPR_ASSERT(str);
407 if (str->Length == 0)
408 return TRUE;
409 if (str->MaximumLength == 0)
410 return TRUE;
411 return str->Buffer == nullptr;
412}
413
432/*
433typedef struct gss_channel_bindings_struct {
434 OM_uint32 initiator_addrtype;
435 gss_buffer_desc initiator_address;
436 OM_uint32 acceptor_addrtype;
437 gss_buffer_desc acceptor_address;
438 gss_buffer_desc application_data;
439} *gss_channel_bindings_t;
440 */
441
442static BOOL ntlm_md5_update_uint32_be(WINPR_DIGEST_CTX* md5, UINT32 num)
443{
444 BYTE be32[4];
445 be32[0] = (num >> 0) & 0xFF;
446 be32[1] = (num >> 8) & 0xFF;
447 be32[2] = (num >> 16) & 0xFF;
448 be32[3] = (num >> 24) & 0xFF;
449 return winpr_Digest_Update(md5, be32, 4);
450}
451
452static void ntlm_compute_channel_bindings(NTLM_CONTEXT* context)
453{
454 WINPR_DIGEST_CTX* md5 = nullptr;
455 BYTE* ChannelBindingToken = nullptr;
456 UINT32 ChannelBindingTokenLength = 0;
457 SEC_CHANNEL_BINDINGS* ChannelBindings = nullptr;
458
459 WINPR_ASSERT(context);
460
461 ZeroMemory(context->ChannelBindingsHash, WINPR_MD5_DIGEST_LENGTH);
462 ChannelBindings = context->Bindings.Bindings;
463
464 if (!ChannelBindings)
465 return;
466
467 if (!(md5 = winpr_Digest_New()))
468 return;
469
470 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
471 goto out;
472
473 ChannelBindingTokenLength = context->Bindings.BindingsLength - sizeof(SEC_CHANNEL_BINDINGS);
474 ChannelBindingToken = &((BYTE*)ChannelBindings)[ChannelBindings->dwApplicationDataOffset];
475
476 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->dwInitiatorAddrType))
477 goto out;
478
479 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbInitiatorLength))
480 goto out;
481
482 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->dwAcceptorAddrType))
483 goto out;
484
485 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbAcceptorLength))
486 goto out;
487
488 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbApplicationDataLength))
489 goto out;
490
491 if (!winpr_Digest_Update(md5, (void*)ChannelBindingToken, ChannelBindingTokenLength))
492 goto out;
493
494 if (!winpr_Digest_Final(md5, context->ChannelBindingsHash, WINPR_MD5_DIGEST_LENGTH))
495 goto out;
496
497out:
498 winpr_Digest_Free(md5);
499}
500
501static void ntlm_compute_single_host_data(NTLM_CONTEXT* context)
502{
503 WINPR_ASSERT(context);
512 winpr_Data_Write_UINT32(&context->SingleHostData.Size, 48);
513 winpr_Data_Write_UINT32(&context->SingleHostData.Z4, 0);
514 winpr_Data_Write_UINT32(&context->SingleHostData.DataPresent, 1);
515 winpr_Data_Write_UINT32(&context->SingleHostData.CustomData, SECURITY_MANDATORY_MEDIUM_RID);
516 FillMemory(context->SingleHostData.MachineID, 32, 0xAA);
517}
518
519BOOL ntlm_construct_challenge_target_info(NTLM_CONTEXT* context)
520{
521 BOOL rc = FALSE;
522
523 WINPR_ASSERT(context);
524
525 const ULONG AvPairsCount = 5;
526 const ULONG AvPairsLength = context->NbDomainName.Length + context->NbComputerName.Length +
527 context->DnsDomainName.Length + context->DnsComputerName.Length + 8;
528 {
529 const size_t length = ntlm_av_pair_list_size(AvPairsCount, AvPairsLength);
530 if (!ntlm_SecBufferRealloc(&context->ChallengeTargetInfo,
531 WINPR_ASSERTING_INT_CAST(uint32_t, length)))
532 goto fail;
533 }
534
535 NTLM_AV_PAIR* pAvPairList = (NTLM_AV_PAIR*)context->ChallengeTargetInfo.pvBuffer;
536 const size_t cbAvPairList = context->ChallengeTargetInfo.cbBuffer;
537
538 if (!ntlm_av_pair_list_init(pAvPairList, cbAvPairList))
539 goto fail;
540
541 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvNbDomainName,
542 (PBYTE)context->NbDomainName.Buffer, context->NbDomainName.Length))
543 goto fail;
544
545 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvNbComputerName,
546 (PBYTE)context->NbComputerName.Buffer, context->NbComputerName.Length))
547 goto fail;
548
549 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvDnsDomainName,
550 (PBYTE)context->DnsDomainName.Buffer, context->DnsDomainName.Length))
551 goto fail;
552
553 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvDnsComputerName,
554 (PBYTE)context->DnsComputerName.Buffer, context->DnsComputerName.Length))
555 goto fail;
556
557 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvTimestamp, context->Timestamp,
558 sizeof(context->Timestamp)))
559 goto fail;
560
561 rc = TRUE;
562fail:
563 return rc;
564}
565
566BOOL ntlm_construct_authenticate_target_info(NTLM_CONTEXT* context)
567{
568 ULONG AvPairsCount = 0;
569 size_t AvPairsValueLength = 0;
570 NTLM_AV_PAIR* AvTimestamp = nullptr;
571 NTLM_AV_PAIR* AvNbDomainName = nullptr;
572 NTLM_AV_PAIR* AvNbComputerName = nullptr;
573 NTLM_AV_PAIR* AvDnsDomainName = nullptr;
574 NTLM_AV_PAIR* AvDnsComputerName = nullptr;
575 NTLM_AV_PAIR* AvDnsTreeName = nullptr;
576 NTLM_AV_PAIR* ChallengeTargetInfo = nullptr;
577 NTLM_AV_PAIR* AuthenticateTargetInfo = nullptr;
578 size_t cbAvTimestamp = 0;
579 size_t cbAvNbDomainName = 0;
580 size_t cbAvNbComputerName = 0;
581 size_t cbAvDnsDomainName = 0;
582 size_t cbAvDnsComputerName = 0;
583 size_t cbAvDnsTreeName = 0;
584 size_t cbChallengeTargetInfo = 0;
585 size_t cbAuthenticateTargetInfo = 0;
586
587 WINPR_ASSERT(context);
588
589 AvPairsCount = 1;
590 ChallengeTargetInfo = (NTLM_AV_PAIR*)context->ChallengeTargetInfo.pvBuffer;
591 cbChallengeTargetInfo = context->ChallengeTargetInfo.cbBuffer;
592 AvNbDomainName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvNbDomainName,
593 &cbAvNbDomainName);
594 AvNbComputerName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
595 MsvAvNbComputerName, &cbAvNbComputerName);
596 AvDnsDomainName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
597 MsvAvDnsDomainName, &cbAvDnsDomainName);
598 AvDnsComputerName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
599 MsvAvDnsComputerName, &cbAvDnsComputerName);
600 AvDnsTreeName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvDnsTreeName,
601 &cbAvDnsTreeName);
602 AvTimestamp = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvTimestamp,
603 &cbAvTimestamp);
604
605 if (AvNbDomainName)
606 {
607 size_t avLen = 0;
608 if (!ntlm_av_pair_get_len(AvNbDomainName, cbAvNbDomainName, &avLen))
609 goto fail;
610 AvPairsCount++; /* MsvAvNbDomainName */
611 AvPairsValueLength += avLen;
612 }
613
614 if (AvNbComputerName)
615 {
616 size_t avLen = 0;
617 if (!ntlm_av_pair_get_len(AvNbComputerName, cbAvNbComputerName, &avLen))
618 goto fail;
619 AvPairsCount++; /* MsvAvNbComputerName */
620 AvPairsValueLength += avLen;
621 }
622
623 if (AvDnsDomainName)
624 {
625 size_t avLen = 0;
626 if (!ntlm_av_pair_get_len(AvDnsDomainName, cbAvDnsDomainName, &avLen))
627 goto fail;
628 AvPairsCount++; /* MsvAvDnsDomainName */
629 AvPairsValueLength += avLen;
630 }
631
632 if (AvDnsComputerName)
633 {
634 size_t avLen = 0;
635 if (!ntlm_av_pair_get_len(AvDnsComputerName, cbAvDnsComputerName, &avLen))
636 goto fail;
637 AvPairsCount++; /* MsvAvDnsComputerName */
638 AvPairsValueLength += avLen;
639 }
640
641 if (AvDnsTreeName)
642 {
643 size_t avLen = 0;
644 if (!ntlm_av_pair_get_len(AvDnsTreeName, cbAvDnsTreeName, &avLen))
645 goto fail;
646 AvPairsCount++; /* MsvAvDnsTreeName */
647 AvPairsValueLength += avLen;
648 }
649
650 AvPairsCount++; /* MsvAvTimestamp */
651 AvPairsValueLength += 8;
652
653 if (context->UseMIC)
654 {
655 AvPairsCount++; /* MsvAvFlags */
656 AvPairsValueLength += 4;
657 }
658
659 if (context->SendSingleHostData)
660 {
661 AvPairsCount++; /* MsvAvSingleHost */
662 ntlm_compute_single_host_data(context);
663 AvPairsValueLength += context->SingleHostData.Size;
664 }
665
671 if (!context->SuppressExtendedProtection)
672 {
677 AvPairsCount++; /* MsvAvChannelBindings */
678 AvPairsValueLength += 16;
679 ntlm_compute_channel_bindings(context);
680
681 if (!ntlm_is_unicode_string_empty(&context->ServicePrincipalName))
682 {
683 AvPairsCount++; /* MsvAvTargetName */
684 AvPairsValueLength += context->ServicePrincipalName.Length;
685 }
686 }
687
688 {
689 size_t size = ntlm_av_pair_list_size(AvPairsCount, AvPairsValueLength);
690 if (context->NTLMv2)
691 size += 8; /* unknown 8-byte padding */
692
693 if (!ntlm_SecBufferRealloc(&context->AuthenticateTargetInfo,
694 WINPR_ASSERTING_INT_CAST(uint32_t, size)))
695 goto fail;
696 }
697
698 AuthenticateTargetInfo = (NTLM_AV_PAIR*)context->AuthenticateTargetInfo.pvBuffer;
699 cbAuthenticateTargetInfo = context->AuthenticateTargetInfo.cbBuffer;
700
701 if (!ntlm_av_pair_list_init(AuthenticateTargetInfo, cbAuthenticateTargetInfo))
702 goto fail;
703
704 if (AvNbDomainName)
705 {
706 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvNbDomainName,
707 cbAvNbDomainName))
708 goto fail;
709 }
710
711 if (AvNbComputerName)
712 {
713 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
714 AvNbComputerName, cbAvNbComputerName))
715 goto fail;
716 }
717
718 if (AvDnsDomainName)
719 {
720 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
721 AvDnsDomainName, cbAvDnsDomainName))
722 goto fail;
723 }
724
725 if (AvDnsComputerName)
726 {
727 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
728 AvDnsComputerName, cbAvDnsComputerName))
729 goto fail;
730 }
731
732 if (AvDnsTreeName)
733 {
734 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvDnsTreeName,
735 cbAvDnsTreeName))
736 goto fail;
737 }
738
739 if (AvTimestamp)
740 {
741 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvTimestamp,
742 cbAvTimestamp))
743 goto fail;
744 }
745
746 if (context->UseMIC)
747 {
748 UINT32 flags = 0;
749 winpr_Data_Write_UINT32(&flags, MSV_AV_FLAGS_MESSAGE_INTEGRITY_CHECK);
750
751 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvFlags,
752 (PBYTE)&flags, 4))
753 goto fail;
754 }
755
756 if (context->SendSingleHostData)
757 {
758 WINPR_ASSERT(context->SingleHostData.Size <= UINT16_MAX);
759 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvSingleHost,
760 (PBYTE)&context->SingleHostData,
761 (UINT16)context->SingleHostData.Size))
762 goto fail;
763 }
764
765 if (!context->SuppressExtendedProtection)
766 {
767 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
768 MsvAvChannelBindings, context->ChannelBindingsHash, 16))
769 goto fail;
770
771 if (!ntlm_is_unicode_string_empty(&context->ServicePrincipalName))
772 {
773 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvTargetName,
774 (PBYTE)context->ServicePrincipalName.Buffer,
775 context->ServicePrincipalName.Length))
776 goto fail;
777 }
778 }
779
780 if (context->NTLMv2)
781 {
782 size_t cbAvEOL = 0;
783 NTLM_AV_PAIR* AvEOL =
784 ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvEOL, &cbAvEOL);
785
786 size_t cbAvEntryLen = 0;
787 if (!ntlm_av_pair_get_len(AvEOL, cbAvEOL, &cbAvEntryLen))
788 goto fail;
789
790 ZeroMemory(AvEOL, sizeof(NTLM_AV_PAIR));
791 }
792
793 return TRUE;
794fail:
795 sspi_SecBufferFree(&context->AuthenticateTargetInfo);
796 return FALSE;
797}
LSA_UNICODE_STRING
Definition nt.h:1416
NTLM_AV_PAIR
Definition libwinpr/sspi/NTLM/ntlm.h:114
NTLM_CONTEXT
Definition libwinpr/sspi/NTLM/ntlm.h:221
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349