FreeRDP
Loading...
Searching...
No Matches
ntlm_av_pairs.c
1
20#include <winpr/config.h>
21
22#include <winpr/assert.h>
23
24#include "ntlm.h"
25#include "../sspi.h"
26
27#include <winpr/crt.h>
28#include <winpr/print.h>
29#include <winpr/sysinfo.h>
30#include <winpr/tchar.h>
31#include <winpr/crypto.h>
32
33#include "ntlm_compute.h"
34
35#include "ntlm_av_pairs.h"
36
37#if defined(WITH_DEBUG_NTLM)
38#include "../../log.h"
39#define TAG WINPR_TAG("sspi.NTLM")
40#endif
41
42static BOOL ntlm_av_pair_get_next_offset(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pOffset);
43
44static BOOL ntlm_av_pair_check_data(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair, size_t size)
45{
46 size_t offset = 0;
47 if (!pAvPair || cbAvPair < sizeof(NTLM_AV_PAIR) + size)
48 return FALSE;
49 if (!ntlm_av_pair_get_next_offset(pAvPair, cbAvPair, &offset))
50 return FALSE;
51 return cbAvPair >= offset;
52}
53
54#ifdef WITH_DEBUG_NTLM
55static const char* get_av_pair_string(UINT16 pair)
56{
57 switch (pair)
58 {
59 case MsvAvEOL:
60 return "MsvAvEOL";
61 case MsvAvNbComputerName:
62 return "MsvAvNbComputerName";
63 case MsvAvNbDomainName:
64 return "MsvAvNbDomainName";
65 case MsvAvDnsComputerName:
66 return "MsvAvDnsComputerName";
67 case MsvAvDnsDomainName:
68 return "MsvAvDnsDomainName";
69 case MsvAvDnsTreeName:
70 return "MsvAvDnsTreeName";
71 case MsvAvFlags:
72 return "MsvAvFlags";
73 case MsvAvTimestamp:
74 return "MsvAvTimestamp";
75 case MsvAvSingleHost:
76 return "MsvAvSingleHost";
77 case MsvAvTargetName:
78 return "MsvAvTargetName";
79 case MsvAvChannelBindings:
80 return "MsvAvChannelBindings";
81 default:
82 return "UNKNOWN";
83 }
84}
85#endif
86
87static BOOL ntlm_av_pair_check(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair);
88static NTLM_AV_PAIR* ntlm_av_pair_next(NTLM_AV_PAIR* pAvPairList, size_t* pcbAvPairList);
89
90static inline void ntlm_av_pair_set_id(NTLM_AV_PAIR* pAvPair, UINT16 id)
91{
92 WINPR_ASSERT(pAvPair);
93 winpr_Data_Write_UINT16(&pAvPair->AvId, id);
94}
95
96static inline void ntlm_av_pair_set_len(NTLM_AV_PAIR* pAvPair, UINT16 len)
97{
98 WINPR_ASSERT(pAvPair);
99 winpr_Data_Write_UINT16(&pAvPair->AvLen, len);
100}
101
102static BOOL ntlm_av_pair_list_init(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
103{
104 NTLM_AV_PAIR* pAvPair = pAvPairList;
105
106 if (!pAvPair || (cbAvPairList < sizeof(NTLM_AV_PAIR)))
107 return FALSE;
108
109 ntlm_av_pair_set_id(pAvPair, MsvAvEOL);
110 ntlm_av_pair_set_len(pAvPair, 0);
111 return TRUE;
112}
113
114static inline BOOL ntlm_av_pair_get_id(const NTLM_AV_PAIR* pAvPair, size_t size, UINT16* pair)
115{
116 if (!pAvPair || !pair)
117 return FALSE;
118
119 if (size < sizeof(NTLM_AV_PAIR))
120 return FALSE;
121
122 const UINT16 AvId = winpr_Data_Get_UINT16(&pAvPair->AvId);
123
124 *pair = AvId;
125 return TRUE;
126}
127
128ULONG ntlm_av_pair_list_length(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
129{
130 size_t cbAvPair = 0;
131 NTLM_AV_PAIR* pAvPair = NULL;
132
133 pAvPair = ntlm_av_pair_get(pAvPairList, cbAvPairList, MsvAvEOL, &cbAvPair);
134 if (!pAvPair)
135 return 0;
136
137 if (pAvPair < pAvPairList)
138 return 0;
139
140 const size_t size = WINPR_ASSERTING_INT_CAST(size_t, ((PBYTE)pAvPair - (PBYTE)pAvPairList)) +
141 sizeof(NTLM_AV_PAIR);
142 WINPR_ASSERT(size <= UINT32_MAX);
143 WINPR_ASSERT(size >= 0);
144 return (ULONG)size;
145}
146
147static inline BOOL ntlm_av_pair_get_len(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pAvLen)
148{
149 if (!pAvPair)
150 return FALSE;
151
152 if (size < sizeof(NTLM_AV_PAIR))
153 return FALSE;
154
155 const UINT16 AvLen = winpr_Data_Get_UINT16(&pAvPair->AvLen);
156
157 *pAvLen = AvLen;
158 return TRUE;
159}
160
161#ifdef WITH_DEBUG_NTLM
162void ntlm_print_av_pair_list(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
163{
164 UINT16 pair = 0;
165 size_t cbAvPair = cbAvPairList;
166 NTLM_AV_PAIR* pAvPair = pAvPairList;
167
168 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
169 return;
170
171 WLog_VRB(TAG, "AV_PAIRs =");
172
173 while (pAvPair && ntlm_av_pair_get_id(pAvPair, cbAvPair, &pair) && (pair != MsvAvEOL))
174 {
175 size_t cbLen = 0;
176 ntlm_av_pair_get_len(pAvPair, cbAvPair, &cbLen);
177
178 WLog_VRB(TAG, "\t%s AvId: %" PRIu16 " AvLen: %" PRIu16 "", get_av_pair_string(pair), pair);
179 winpr_HexDump(TAG, WLOG_TRACE, ntlm_av_pair_get_value_pointer(pAvPair), cbLen);
180
181 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
182 }
183}
184#endif
185
186static size_t ntlm_av_pair_list_size(size_t AvPairsCount, size_t AvPairsValueLength)
187{
188 /* size of headers + value lengths + terminating MsvAvEOL AV_PAIR */
189 return ((AvPairsCount + 1) * 4ULL) + AvPairsValueLength;
190}
191
192PBYTE ntlm_av_pair_get_value_pointer(NTLM_AV_PAIR* pAvPair)
193{
194 WINPR_ASSERT(pAvPair);
195 return (PBYTE)pAvPair + sizeof(NTLM_AV_PAIR);
196}
197
198static BOOL ntlm_av_pair_get_next_offset(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pOffset)
199{
200 size_t avLen = 0;
201 if (!pOffset)
202 return FALSE;
203
204 if (!ntlm_av_pair_get_len(pAvPair, size, &avLen))
205 return FALSE;
206 *pOffset = avLen + sizeof(NTLM_AV_PAIR);
207 return TRUE;
208}
209
210static BOOL ntlm_av_pair_check(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair)
211{
212 return ntlm_av_pair_check_data(pAvPair, cbAvPair, 0);
213}
214
215static NTLM_AV_PAIR* ntlm_av_pair_next(NTLM_AV_PAIR* pAvPair, size_t* pcbAvPair)
216{
217 size_t offset = 0;
218
219 if (!pcbAvPair)
220 return NULL;
221 if (!ntlm_av_pair_check(pAvPair, *pcbAvPair))
222 return NULL;
223
224 if (!ntlm_av_pair_get_next_offset(pAvPair, *pcbAvPair, &offset))
225 return NULL;
226
227 *pcbAvPair -= offset;
228 return (NTLM_AV_PAIR*)((PBYTE)pAvPair + offset);
229}
230
231NTLM_AV_PAIR* ntlm_av_pair_get(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList, NTLM_AV_ID AvId,
232 size_t* pcbAvPairListRemaining)
233{
234 UINT16 id = 0;
235 size_t cbAvPair = cbAvPairList;
236 NTLM_AV_PAIR* pAvPair = pAvPairList;
237
238 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
239 pAvPair = NULL;
240
241 while (pAvPair && ntlm_av_pair_get_id(pAvPair, cbAvPair, &id))
242 {
243 if (id == AvId)
244 break;
245 if (id == MsvAvEOL)
246 {
247 pAvPair = NULL;
248 break;
249 }
250
251 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
252 }
253
254 if (!pAvPair)
255 cbAvPair = 0;
256 if (pcbAvPairListRemaining)
257 *pcbAvPairListRemaining = cbAvPair;
258
259 return pAvPair;
260}
261
262static BOOL ntlm_av_pair_add(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList, NTLM_AV_ID AvId,
263 PBYTE Value, UINT16 AvLen)
264{
265 size_t cbAvPair = 0;
266 NTLM_AV_PAIR* pAvPair = NULL;
267
268 pAvPair = ntlm_av_pair_get(pAvPairList, cbAvPairList, MsvAvEOL, &cbAvPair);
269
270 /* size of header + value length + terminating MsvAvEOL AV_PAIR */
271 if (!pAvPair || cbAvPair < 2 * sizeof(NTLM_AV_PAIR) + AvLen)
272 return FALSE;
273
274 ntlm_av_pair_set_id(pAvPair, (UINT16)AvId);
275 ntlm_av_pair_set_len(pAvPair, AvLen);
276 if (AvLen)
277 {
278 WINPR_ASSERT(Value != NULL);
279 CopyMemory(ntlm_av_pair_get_value_pointer(pAvPair), Value, AvLen);
280 }
281
282 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
283 return ntlm_av_pair_list_init(pAvPair, cbAvPair);
284}
285
286static BOOL ntlm_av_pair_add_copy(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList,
287 NTLM_AV_PAIR* pAvPair, size_t cbAvPair)
288{
289 UINT16 pair = 0;
290 size_t avLen = 0;
291
292 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
293 return FALSE;
294
295 if (!ntlm_av_pair_get_id(pAvPair, cbAvPair, &pair))
296 return FALSE;
297
298 if (!ntlm_av_pair_get_len(pAvPair, cbAvPair, &avLen))
299 return FALSE;
300
301 WINPR_ASSERT(avLen <= UINT16_MAX);
302 return ntlm_av_pair_add(pAvPairList, cbAvPairList, pair,
303 ntlm_av_pair_get_value_pointer(pAvPair), (UINT16)avLen);
304}
305
306static char* get_name(COMPUTER_NAME_FORMAT type)
307{
308 DWORD nSize = 0;
309
310 if (GetComputerNameExA(type, NULL, &nSize))
311 return NULL;
312
313 if (GetLastError() != ERROR_MORE_DATA)
314 return NULL;
315
316 char* computerName = calloc(1, nSize);
317
318 if (!computerName)
319 return NULL;
320
321 if (!GetComputerNameExA(type, computerName, &nSize))
322 {
323 free(computerName);
324 return NULL;
325 }
326
327 return computerName;
328}
329
330static int ntlm_get_target_computer_name(PUNICODE_STRING pName,
331 WINPR_ATTR_UNUSED COMPUTER_NAME_FORMAT type)
332{
333 int status = -1;
334
335 WINPR_ASSERT(pName);
336
337 char* name = get_name(ComputerNameNetBIOS);
338 if (!name)
339 return -1;
340
341 CharUpperA(name);
342
343 size_t len = 0;
344 pName->Buffer = ConvertUtf8ToWCharAlloc(name, &len);
345 free(name);
346
347 if (!pName->Buffer || (len == 0) || (len > UINT16_MAX / sizeof(WCHAR)))
348 {
349 free(pName->Buffer);
350 pName->Buffer = NULL;
351 return status;
352 }
353
354 pName->Length = (USHORT)((len) * sizeof(WCHAR));
355 pName->MaximumLength = pName->Length;
356 return 1;
357}
358
359static void ntlm_free_unicode_string(PUNICODE_STRING string)
360{
361 if (string)
362 {
363 if (string->Length > 0)
364 {
365 free(string->Buffer);
366 string->Buffer = NULL;
367 string->Length = 0;
368 string->MaximumLength = 0;
369 }
370 }
371}
372
391/*
392typedef struct gss_channel_bindings_struct {
393 OM_uint32 initiator_addrtype;
394 gss_buffer_desc initiator_address;
395 OM_uint32 acceptor_addrtype;
396 gss_buffer_desc acceptor_address;
397 gss_buffer_desc application_data;
398} *gss_channel_bindings_t;
399 */
400
401static BOOL ntlm_md5_update_uint32_be(WINPR_DIGEST_CTX* md5, UINT32 num)
402{
403 BYTE be32[4];
404 be32[0] = (num >> 0) & 0xFF;
405 be32[1] = (num >> 8) & 0xFF;
406 be32[2] = (num >> 16) & 0xFF;
407 be32[3] = (num >> 24) & 0xFF;
408 return winpr_Digest_Update(md5, be32, 4);
409}
410
411static void ntlm_compute_channel_bindings(NTLM_CONTEXT* context)
412{
413 WINPR_DIGEST_CTX* md5 = NULL;
414 BYTE* ChannelBindingToken = NULL;
415 UINT32 ChannelBindingTokenLength = 0;
416 SEC_CHANNEL_BINDINGS* ChannelBindings = NULL;
417
418 WINPR_ASSERT(context);
419
420 ZeroMemory(context->ChannelBindingsHash, WINPR_MD5_DIGEST_LENGTH);
421 ChannelBindings = context->Bindings.Bindings;
422
423 if (!ChannelBindings)
424 return;
425
426 if (!(md5 = winpr_Digest_New()))
427 return;
428
429 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
430 goto out;
431
432 ChannelBindingTokenLength = context->Bindings.BindingsLength - sizeof(SEC_CHANNEL_BINDINGS);
433 ChannelBindingToken = &((BYTE*)ChannelBindings)[ChannelBindings->dwApplicationDataOffset];
434
435 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->dwInitiatorAddrType))
436 goto out;
437
438 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbInitiatorLength))
439 goto out;
440
441 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->dwAcceptorAddrType))
442 goto out;
443
444 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbAcceptorLength))
445 goto out;
446
447 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbApplicationDataLength))
448 goto out;
449
450 if (!winpr_Digest_Update(md5, (void*)ChannelBindingToken, ChannelBindingTokenLength))
451 goto out;
452
453 if (!winpr_Digest_Final(md5, context->ChannelBindingsHash, WINPR_MD5_DIGEST_LENGTH))
454 goto out;
455
456out:
457 winpr_Digest_Free(md5);
458}
459
460static void ntlm_compute_single_host_data(NTLM_CONTEXT* context)
461{
462 WINPR_ASSERT(context);
471 winpr_Data_Write_UINT32(&context->SingleHostData.Size, 48);
472 winpr_Data_Write_UINT32(&context->SingleHostData.Z4, 0);
473 winpr_Data_Write_UINT32(&context->SingleHostData.DataPresent, 1);
474 winpr_Data_Write_UINT32(&context->SingleHostData.CustomData, SECURITY_MANDATORY_MEDIUM_RID);
475 FillMemory(context->SingleHostData.MachineID, 32, 0xAA);
476}
477
478BOOL ntlm_construct_challenge_target_info(NTLM_CONTEXT* context)
479{
480 BOOL rc = FALSE;
481 ULONG AvPairsCount = 0;
482 ULONG AvPairsLength = 0;
483 NTLM_AV_PAIR* pAvPairList = NULL;
484 size_t cbAvPairList = 0;
485 UNICODE_STRING NbDomainName = { 0 };
486 UNICODE_STRING NbComputerName = { 0 };
487 UNICODE_STRING DnsDomainName = { 0 };
488 UNICODE_STRING DnsComputerName = { 0 };
489
490 WINPR_ASSERT(context);
491
492 if (ntlm_get_target_computer_name(&NbDomainName, ComputerNameNetBIOS) < 0)
493 goto fail;
494
495 NbComputerName.Buffer = NULL;
496
497 if (ntlm_get_target_computer_name(&NbComputerName, ComputerNameNetBIOS) < 0)
498 goto fail;
499
500 DnsDomainName.Buffer = NULL;
501
502 if (ntlm_get_target_computer_name(&DnsDomainName, ComputerNameDnsDomain) < 0)
503 goto fail;
504
505 DnsComputerName.Buffer = NULL;
506
507 if (ntlm_get_target_computer_name(&DnsComputerName, ComputerNameDnsHostname) < 0)
508 goto fail;
509
510 AvPairsCount = 5;
511 AvPairsLength = NbDomainName.Length + NbComputerName.Length + DnsDomainName.Length +
512 DnsComputerName.Length + 8;
513 {
514 const size_t length = ntlm_av_pair_list_size(AvPairsCount, AvPairsLength);
515 if (!sspi_SecBufferAlloc(&context->ChallengeTargetInfo,
516 WINPR_ASSERTING_INT_CAST(uint32_t, length)))
517 goto fail;
518 }
519
520 pAvPairList = (NTLM_AV_PAIR*)context->ChallengeTargetInfo.pvBuffer;
521 cbAvPairList = context->ChallengeTargetInfo.cbBuffer;
522
523 if (!ntlm_av_pair_list_init(pAvPairList, cbAvPairList))
524 goto fail;
525
526 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvNbDomainName, (PBYTE)NbDomainName.Buffer,
527 NbDomainName.Length))
528 goto fail;
529
530 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvNbComputerName,
531 (PBYTE)NbComputerName.Buffer, NbComputerName.Length))
532 goto fail;
533
534 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvDnsDomainName,
535 (PBYTE)DnsDomainName.Buffer, DnsDomainName.Length))
536 goto fail;
537
538 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvDnsComputerName,
539 (PBYTE)DnsComputerName.Buffer, DnsComputerName.Length))
540 goto fail;
541
542 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvTimestamp, context->Timestamp,
543 sizeof(context->Timestamp)))
544 goto fail;
545
546 rc = TRUE;
547fail:
548 ntlm_free_unicode_string(&NbDomainName);
549 ntlm_free_unicode_string(&NbComputerName);
550 ntlm_free_unicode_string(&DnsDomainName);
551 ntlm_free_unicode_string(&DnsComputerName);
552 return rc;
553}
554
555BOOL ntlm_construct_authenticate_target_info(NTLM_CONTEXT* context)
556{
557 ULONG AvPairsCount = 0;
558 size_t AvPairsValueLength = 0;
559 NTLM_AV_PAIR* AvTimestamp = NULL;
560 NTLM_AV_PAIR* AvNbDomainName = NULL;
561 NTLM_AV_PAIR* AvNbComputerName = NULL;
562 NTLM_AV_PAIR* AvDnsDomainName = NULL;
563 NTLM_AV_PAIR* AvDnsComputerName = NULL;
564 NTLM_AV_PAIR* AvDnsTreeName = NULL;
565 NTLM_AV_PAIR* ChallengeTargetInfo = NULL;
566 NTLM_AV_PAIR* AuthenticateTargetInfo = NULL;
567 size_t cbAvTimestamp = 0;
568 size_t cbAvNbDomainName = 0;
569 size_t cbAvNbComputerName = 0;
570 size_t cbAvDnsDomainName = 0;
571 size_t cbAvDnsComputerName = 0;
572 size_t cbAvDnsTreeName = 0;
573 size_t cbChallengeTargetInfo = 0;
574 size_t cbAuthenticateTargetInfo = 0;
575
576 WINPR_ASSERT(context);
577
578 AvPairsCount = 1;
579 ChallengeTargetInfo = (NTLM_AV_PAIR*)context->ChallengeTargetInfo.pvBuffer;
580 cbChallengeTargetInfo = context->ChallengeTargetInfo.cbBuffer;
581 AvNbDomainName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvNbDomainName,
582 &cbAvNbDomainName);
583 AvNbComputerName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
584 MsvAvNbComputerName, &cbAvNbComputerName);
585 AvDnsDomainName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
586 MsvAvDnsDomainName, &cbAvDnsDomainName);
587 AvDnsComputerName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
588 MsvAvDnsComputerName, &cbAvDnsComputerName);
589 AvDnsTreeName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvDnsTreeName,
590 &cbAvDnsTreeName);
591 AvTimestamp = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvTimestamp,
592 &cbAvTimestamp);
593
594 if (AvNbDomainName)
595 {
596 size_t avLen = 0;
597 if (!ntlm_av_pair_get_len(AvNbDomainName, cbAvNbDomainName, &avLen))
598 goto fail;
599 AvPairsCount++; /* MsvAvNbDomainName */
600 AvPairsValueLength += avLen;
601 }
602
603 if (AvNbComputerName)
604 {
605 size_t avLen = 0;
606 if (!ntlm_av_pair_get_len(AvNbComputerName, cbAvNbComputerName, &avLen))
607 goto fail;
608 AvPairsCount++; /* MsvAvNbComputerName */
609 AvPairsValueLength += avLen;
610 }
611
612 if (AvDnsDomainName)
613 {
614 size_t avLen = 0;
615 if (!ntlm_av_pair_get_len(AvDnsDomainName, cbAvDnsDomainName, &avLen))
616 goto fail;
617 AvPairsCount++; /* MsvAvDnsDomainName */
618 AvPairsValueLength += avLen;
619 }
620
621 if (AvDnsComputerName)
622 {
623 size_t avLen = 0;
624 if (!ntlm_av_pair_get_len(AvDnsComputerName, cbAvDnsComputerName, &avLen))
625 goto fail;
626 AvPairsCount++; /* MsvAvDnsComputerName */
627 AvPairsValueLength += avLen;
628 }
629
630 if (AvDnsTreeName)
631 {
632 size_t avLen = 0;
633 if (!ntlm_av_pair_get_len(AvDnsTreeName, cbAvDnsTreeName, &avLen))
634 goto fail;
635 AvPairsCount++; /* MsvAvDnsTreeName */
636 AvPairsValueLength += avLen;
637 }
638
639 AvPairsCount++; /* MsvAvTimestamp */
640 AvPairsValueLength += 8;
641
642 if (context->UseMIC)
643 {
644 AvPairsCount++; /* MsvAvFlags */
645 AvPairsValueLength += 4;
646 }
647
648 if (context->SendSingleHostData)
649 {
650 AvPairsCount++; /* MsvAvSingleHost */
651 ntlm_compute_single_host_data(context);
652 AvPairsValueLength += context->SingleHostData.Size;
653 }
654
660 if (!context->SuppressExtendedProtection)
661 {
666 AvPairsCount++; /* MsvAvChannelBindings */
667 AvPairsValueLength += 16;
668 ntlm_compute_channel_bindings(context);
669
670 if (context->ServicePrincipalName.Length > 0)
671 {
672 AvPairsCount++; /* MsvAvTargetName */
673 AvPairsValueLength += context->ServicePrincipalName.Length;
674 }
675 }
676
677 {
678 size_t size = ntlm_av_pair_list_size(AvPairsCount, AvPairsValueLength);
679 if (context->NTLMv2)
680 size += 8; /* unknown 8-byte padding */
681
682 if (!sspi_SecBufferAlloc(&context->AuthenticateTargetInfo,
683 WINPR_ASSERTING_INT_CAST(uint32_t, size)))
684 goto fail;
685 }
686
687 AuthenticateTargetInfo = (NTLM_AV_PAIR*)context->AuthenticateTargetInfo.pvBuffer;
688 cbAuthenticateTargetInfo = context->AuthenticateTargetInfo.cbBuffer;
689
690 if (!ntlm_av_pair_list_init(AuthenticateTargetInfo, cbAuthenticateTargetInfo))
691 goto fail;
692
693 if (AvNbDomainName)
694 {
695 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvNbDomainName,
696 cbAvNbDomainName))
697 goto fail;
698 }
699
700 if (AvNbComputerName)
701 {
702 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
703 AvNbComputerName, cbAvNbComputerName))
704 goto fail;
705 }
706
707 if (AvDnsDomainName)
708 {
709 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
710 AvDnsDomainName, cbAvDnsDomainName))
711 goto fail;
712 }
713
714 if (AvDnsComputerName)
715 {
716 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
717 AvDnsComputerName, cbAvDnsComputerName))
718 goto fail;
719 }
720
721 if (AvDnsTreeName)
722 {
723 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvDnsTreeName,
724 cbAvDnsTreeName))
725 goto fail;
726 }
727
728 if (AvTimestamp)
729 {
730 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvTimestamp,
731 cbAvTimestamp))
732 goto fail;
733 }
734
735 if (context->UseMIC)
736 {
737 UINT32 flags = 0;
738 winpr_Data_Write_UINT32(&flags, MSV_AV_FLAGS_MESSAGE_INTEGRITY_CHECK);
739
740 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvFlags,
741 (PBYTE)&flags, 4))
742 goto fail;
743 }
744
745 if (context->SendSingleHostData)
746 {
747 WINPR_ASSERT(context->SingleHostData.Size <= UINT16_MAX);
748 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvSingleHost,
749 (PBYTE)&context->SingleHostData,
750 (UINT16)context->SingleHostData.Size))
751 goto fail;
752 }
753
754 if (!context->SuppressExtendedProtection)
755 {
756 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
757 MsvAvChannelBindings, context->ChannelBindingsHash, 16))
758 goto fail;
759
760 if (context->ServicePrincipalName.Length > 0)
761 {
762 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvTargetName,
763 (PBYTE)context->ServicePrincipalName.Buffer,
764 context->ServicePrincipalName.Length))
765 goto fail;
766 }
767 }
768
769 if (context->NTLMv2)
770 {
771 NTLM_AV_PAIR* AvEOL = NULL;
772 AvEOL = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvEOL, NULL);
773
774 if (!AvEOL)
775 goto fail;
776
777 ZeroMemory(AvEOL, sizeof(NTLM_AV_PAIR));
778 }
779
780 return TRUE;
781fail:
782 sspi_SecBufferFree(&context->AuthenticateTargetInfo);
783 return FALSE;
784}
LSA_UNICODE_STRING
Definition nt.h:1415
NTLM_AV_PAIR
Definition libwinpr/sspi/NTLM/ntlm.h:113
NTLM_CONTEXT
Definition libwinpr/sspi/NTLM/ntlm.h:220
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349