FreeRDP
Loading...
Searching...
No Matches
kerberos.c
1
22#include <winpr/config.h>
23#include <winpr/library.h>
24
25#include <stdio.h>
26#include <stdlib.h>
27#include <string.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <ctype.h>
31
32#include <winpr/assert.h>
33#include <winpr/cast.h>
34#include <winpr/asn1.h>
35#include <winpr/crt.h>
36#include <winpr/interlocked.h>
37#include <winpr/sspi.h>
38#include <winpr/print.h>
39#include <winpr/tchar.h>
40#include <winpr/sysinfo.h>
41#include <winpr/endian.h>
42#include <winpr/crypto.h>
43#include <winpr/path.h>
44#include <winpr/wtypes.h>
45#include <winpr/winsock.h>
46#include <winpr/schannel.h>
47#include <winpr/secapi.h>
48
49#include "kerberos.h"
50
51#ifdef WITH_KRB5_MIT
52#include "krb5glue.h"
53#include <profile.h>
54#endif
55
56#ifdef WITH_KRB5_HEIMDAL
57#include "krb5glue.h"
58#include <krb5-protos.h>
59#endif
60
61#include "../sspi.h"
62#include "../../log.h"
63
64const SecPkgInfoA KERBEROS_SecPkgInfoA = {
65 0x000F3BBF, /* fCapabilities */
66 1, /* wVersion */
67 0x0010, /* wRPCID */
68 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
69 "Kerberos", /* Name */
70 "Kerberos Security Package" /* Comment */
71};
72
73static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = WINPR_C_ARRAY_INIT;
74static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = WINPR_C_ARRAY_INIT;
75
76const SecPkgInfoW KERBEROS_SecPkgInfoW = {
77 0x000F3BBF, /* fCapabilities */
78 1, /* wVersion */
79 0x0010, /* wRPCID */
80 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
81 KERBEROS_SecPkgInfoW_NameBuffer, /* Name */
82 KERBEROS_SecPkgInfoW_CommentBuffer /* Comment */
83};
84
85#ifdef WITH_KRB5
86#define TAG WINPR_TAG("sspi.Kerberos")
87
88#define KRB_TGT_REQ 16
89#define KRB_TGT_REP 17
90
91enum KERBEROS_STATE
92{
93 KERBEROS_STATE_INITIAL,
94 KERBEROS_STATE_TGT_REQ,
95 KERBEROS_STATE_TGT_REP,
96 KERBEROS_STATE_AP_REQ,
97 KERBEROS_STATE_AP_REP,
98 KERBEROS_STATE_FINAL
99};
100
101typedef struct KRB_CREDENTIALS_st
102{
103 volatile LONG refCount;
104 krb5_context ctx;
105 char* kdc_url;
106 krb5_ccache ccache;
107 krb5_keytab keytab;
108 krb5_keytab client_keytab;
109 BOOL own_ccache;
110} KRB_CREDENTIALS;
111
112struct s_KRB_CONTEXT
113{
114 enum KERBEROS_STATE state;
115 KRB_CREDENTIALS* credentials;
116 krb5_auth_context auth_ctx;
117 BOOL acceptor;
118 uint32_t flags;
119 uint64_t local_seq;
120 uint64_t remote_seq;
121 struct krb5glue_keyset keyset;
122 BOOL u2u;
123 char* targetHost;
124};
125
126static const WinPrAsn1_OID kerberos_OID = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
127static const WinPrAsn1_OID kerberos_u2u_OID = { 10,
128 (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
129
130WINPR_ATTR_NODISCARD
131krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code, const char* what,
132 const char* file, const char* fkt, size_t line)
133{
134 switch (code)
135 {
136 case 0:
137 case KRB5_KT_END:
138 break;
139 default:
140 {
141 const DWORD level = WLOG_ERROR;
142
143 wLog* log = WLog_Get(TAG);
144 if (WLog_IsLevelActive(log, level))
145 {
146 const char* msg = krb5_get_error_message(ctx, code);
147 WLog_PrintTextMessage(log, level, line, file, fkt, "%s (%s [%d])", what, msg, code);
148 krb5_free_error_message(ctx, msg);
149 }
150 }
151 break;
152 }
153 return code;
154}
155
156void krb_log_context_encryption(krb5_context ctx, krb5_principal princ)
157{
158#if !defined(WITH_KRB5_HEIMDAL)
159 typedef krb5_error_code KRB5_CALLCONV (*krb5_get_etype_info_fn)(
160 krb5_context context, krb5_principal principal, krb5_get_init_creds_opt* opt,
161 krb5_enctype* enctype_out, krb5_data* salt_out, krb5_data* s2kparams_out);
162
163 krb5_get_etype_info_fn fn =
164 GetProcAddressAs(nullptr, "krb5_get_etype_info", krb5_get_etype_info_fn);
165
166 if (fn)
167 {
168 krb5_get_init_creds_opt opt = WINPR_C_ARRAY_INIT;
169 krb5_enctype enctype = 0;
170 krb5_data salt = WINPR_C_ARRAY_INIT;
171 krb5_data s2kparam = WINPR_C_ARRAY_INIT;
172 char buffer[128] = WINPR_C_ARRAY_INIT;
173 krb5_error_code rv = krb_log_exec(fn, ctx, princ, &opt, &enctype, &salt, &s2kparam);
174 krb5_enctype_to_string(enctype, buffer, sizeof(buffer));
175 const char* msg = krb5_get_error_message(ctx, rv);
176
177 char* saltdata = winpr_BinToHexString(salt.data, salt.length, TRUE);
178 WLog_DBG(TAG, "[%s] enctype=%s, salt[%u]=%s, s2kparam[%u]=%s", msg, buffer, salt.length,
179 saltdata, s2kparam.length, s2kparam.data);
180
181 krb5_free_data_contents(ctx, &salt);
182 krb5_free_data_contents(ctx, &s2kparam);
183 krb5_free_error_message(ctx, msg);
184 free(saltdata);
185 }
186 else
187#endif
188 {
189 WLog_WARN(TAG,
190 "kerberos implementation does not support 'krb5_get_etype_info', not displaying "
191 "encryption information");
192 }
193}
194
195static void credentials_unref(KRB_CREDENTIALS* credentials);
196
197static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
198{
199 if (!ctx)
200 return;
201
202 free(ctx->targetHost);
203 ctx->targetHost = nullptr;
204
205 if (ctx->credentials)
206 {
207 krb5_context krbctx = ctx->credentials->ctx;
208 if (krbctx)
209 {
210 if (ctx->auth_ctx)
211 krb5_auth_con_free(krbctx, ctx->auth_ctx);
212
213 krb5glue_keys_free(krbctx, &ctx->keyset);
214 }
215
216 credentials_unref(ctx->credentials);
217 }
218
219 if (allocated)
220 free(ctx);
221}
222
223WINPR_ATTR_MALLOC(kerberos_ContextFree, 1)
224static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
225{
226 KRB_CONTEXT* context = nullptr;
227
228 context = (KRB_CONTEXT*)calloc(1, sizeof(KRB_CONTEXT));
229 if (!context)
230 return nullptr;
231
232 context->credentials = credentials;
233 InterlockedIncrement(&credentials->refCount);
234 return context;
235}
236
237WINPR_ATTR_NODISCARD
238static krb5_error_code krb5_prompter(krb5_context context, void* data,
239 WINPR_ATTR_UNUSED const char* name,
240 WINPR_ATTR_UNUSED const char* banner, int num_prompts,
241 krb5_prompt prompts[])
242{
243 for (int i = 0; i < num_prompts; i++)
244 {
245 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
246 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
247 {
248 /* the reply buffer is allocated by the library, it holds reply->length bytes */
249 krb5_data* reply = prompts[i].reply;
250 const size_t len = strlen((const char*)data);
251 if (!reply->data || (len > reply->length))
252 return KRB5KRB_ERR_GENERIC;
253
254 memcpy(reply->data, data, len);
255 if (len < reply->length)
256 reply->data[len] = '\0';
257 reply->length = (UINT32)len;
258 }
259 }
260 return 0;
261}
262
263WINPR_ATTR_NODISCARD
264static inline krb5glue_key get_key(struct krb5glue_keyset* keyset)
265{
266 return keyset->acceptor_key ? keyset->acceptor_key
267 : keyset->initiator_key ? keyset->initiator_key
268 : keyset->session_key;
269}
270
271WINPR_ATTR_NODISCARD
272static BOOL isValidIPv4(const char* ipAddress)
273{
274 struct sockaddr_in sa = WINPR_C_ARRAY_INIT;
275 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
276 return result != 0;
277}
278
279WINPR_ATTR_NODISCARD
280static BOOL isValidIPv6(const char* ipAddress)
281{
282 struct sockaddr_in6 sa = WINPR_C_ARRAY_INIT;
283 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
284 return result != 0;
285}
286
287WINPR_ATTR_NODISCARD
288static BOOL isValidIP(const char* ipAddress)
289{
290 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
291}
292
293#if defined(WITH_KRB5_MIT)
294WINPR_ATTR_MALLOC(free, 1)
295static char* get_realm_name(krb5_data realm, size_t* plen)
296{
297 WINPR_ASSERT(plen);
298 *plen = 0;
299 if ((realm.length <= 0) || (!realm.data))
300 return nullptr;
301
302 char* name = nullptr;
303 (void)winpr_asprintf(&name, plen, "krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
304 realm.data);
305 return name;
306}
307#elif defined(WITH_KRB5_HEIMDAL)
308WINPR_ATTR_MALLOC(free, 1)
309static char* get_realm_name(Realm realm, size_t* plen)
310{
311 WINPR_ASSERT(plen);
312 *plen = 0;
313 if (!realm)
314 return nullptr;
315
316 char* name = nullptr;
317 (void)winpr_asprintf(&name, plen, "krbtgt/%s@%s", realm, realm);
318 return name;
319}
320#endif
321
322WINPR_ATTR_NODISCARD
323static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
324{
325 /* "krbtgt/" + realm + "@" + realm */
326 size_t len = 0;
327 krb5_error_code rv = KRB5_CC_NOMEM;
328
329 char* name = get_realm_name(principal->realm, &len);
330 if (!name || (len == 0))
331 goto fail;
332
333 {
334 krb5_principal target = WINPR_C_ARRAY_INIT;
335 rv = krb5_parse_name(ctx, name, &target);
336 *ptarget = target;
337 }
338fail:
339 free(name);
340 return rv;
341}
342
343#endif /* WITH_KRB5 */
344
345#ifdef WITH_KRB5
346/* parses the client principal name, as an RFC 6806 enterprise principal (name@domain in
347 * the default realm) if requested and the name has no realm of its own */
348WINPR_ATTR_NODISCARD
349static krb5_error_code kerberos_parse_principal(krb5_context ctx, const char* name,
350 const char* domain, BOOL enterprise,
351 krb5_principal* principal)
352{
353 krb5_error_code rv = 0;
354
355 WINPR_ASSERT(name);
356 WINPR_ASSERT(principal);
357
358 if (enterprise && domain && !strchr(name, '@'))
359 {
360 char* upn = nullptr;
361 size_t upnlen = 0;
362 (void)winpr_asprintf(&upn, &upnlen, "%s@%s", name, domain);
363 if (!upn)
364 return ENOMEM;
365
366 /* e.g. "user@example.com" becomes "user\@example.com@CORP.EXAMPLE.NET" */
367 rv = krb_log_exec(krb5_parse_name_flags, ctx, upn, KRB5_PRINCIPAL_PARSE_ENTERPRISE,
368 principal);
369 free(upn);
370 }
371 else
372 {
373 char* cpszPrincipal = _strdup(name);
374 if (!cpszPrincipal)
375 return ENOMEM;
376
377 /* Find realm component if included and convert to uppercase */
378 char* p = strchr(cpszPrincipal, '@');
379 if (p)
380 CharUpperA(p);
381
382 rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, principal);
383 free(cpszPrincipal);
384 }
385 return rv;
386}
387
389static BOOL kerberos_is_realm_error(krb5_error_code rv)
390{
391 switch (rv)
392 {
393 case KRB5_REALM_UNKNOWN:
394 case KRB5_KDC_UNREACH:
395 case KRB5KDC_ERR_WRONG_REALM:
396 return TRUE;
397 default:
398 return FALSE;
399 }
400}
401#endif
402
403WINPR_ATTR_NODISCARD
404static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
405 WINPR_ATTR_UNUSED SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage,
406 WINPR_ATTR_UNUSED ULONG fCredentialUse, WINPR_ATTR_UNUSED void* pvLogonID,
407 WINPR_ATTR_UNUSED void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
408 WINPR_ATTR_UNUSED void* pvGetKeyArgument, WINPR_ATTR_UNUSED PCredHandle phCredential,
409 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
410{
411#ifdef WITH_KRB5
412#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
413 SEC_WINPR_KERBEROS_SETTINGS_V2 krb_settings_v1_buffer = WINPR_C_ARRAY_INIT;
414#endif
415
416 SEC_WINPR_KERBEROS_SETTINGS_V2* krb_settings = nullptr;
417 KRB_CREDENTIALS* credentials = nullptr;
418 krb5_context ctx = nullptr;
419 krb5_ccache ccache = nullptr;
420 krb5_keytab keytab = nullptr;
421 krb5_principal principal = nullptr;
422 char* domain = nullptr;
423 char* username = nullptr;
424 char* password = nullptr;
425 BOOL own_ccache = FALSE;
426 BOOL ccache_initialized = FALSE;
427 char* upn_realm = nullptr;
428 const char* const default_ccache_type = "MEMORY";
429
430 if (pAuthData)
431 {
432 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
433
434#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
435 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
436 {
437 SEC_WINPR_KERBEROS_SETTINGS* krb_settingsV1 =
438 (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->kerberosSettings);
439 if (krb_settingsV1)
440 {
441 krb_settings_v1_buffer.kdcUrl = krb_settingsV1->kdcUrl;
442 krb_settings_v1_buffer.keytab = krb_settingsV1->keytab;
443 krb_settings_v1_buffer.cache = krb_settingsV1->cache;
444 krb_settings_v1_buffer.armorCache = krb_settingsV1->armorCache;
445 krb_settings_v1_buffer.pkinitX509Anchors = krb_settingsV1->pkinitX509Anchors;
446 krb_settings_v1_buffer.pkinitX509Identity = krb_settingsV1->pkinitX509Identity;
447 krb_settings_v1_buffer.withPac = krb_settingsV1->withPac;
448 krb_settings_v1_buffer.startTime = krb_settingsV1->startTime;
449 krb_settings_v1_buffer.renewLifeTime = krb_settingsV1->renewLifeTime;
450 krb_settings_v1_buffer.lifeTime = krb_settingsV1->lifeTime;
451 memcpy(krb_settings_v1_buffer.certSha1, krb_settingsV1->certSha1,
452 sizeof(krb_settings_v1_buffer.certSha1));
453 krb_settings = &krb_settings_v1_buffer;
454 }
455 }
456#endif
457 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED_v2)
458 {
459 const SEC_WINNT_AUTH_IDENTITY_WINPR_V2* auth =
460 (const SEC_WINNT_AUTH_IDENTITY_WINPR_V2*)pAuthData;
461 WINPR_ASSERT(auth);
462 if (auth->version < SEC_WINNT_AUTH_IDENTITY_WINPR_V2_REVISION_1)
463 goto cleanup;
464 krb_settings = auth->kerberosSettingsV2;
465 }
466
467 if (!sspi_CopyAuthIdentityFieldsA((const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData, &username,
468 &domain, &password))
469 {
470 WLog_ERR(TAG, "Failed to copy auth identity fields");
471 goto cleanup;
472 }
473
474 if (!pszPrincipal)
475 pszPrincipal = username;
476 }
477
478 if (krb_log_exec_ptr(krb5_init_context, &ctx))
479 goto cleanup;
480
481 if (domain)
482 {
483 char* udomain = _strdup(domain);
484 if (!udomain)
485 goto cleanup;
486
487 CharUpperA(udomain);
488
489 /* the realm of a DNS-style domain, from the domain_realm mapping of krb5.conf */
490 const char* realm = udomain;
491 char** host_realms = nullptr;
492 if (strchr(udomain, '.') && (krb5_get_host_realm(ctx, domain, &host_realms) == 0) &&
493 host_realms && host_realms[0] && (strnlen(host_realms[0], 1) > 0))
494 realm = host_realms[0];
495 else
496 {
497 /* A DNS-style domain that maps to no realm and differs from the configured
498 * default realm is either a realm missing from krb5.conf (found via DNS) or a UPN
499 * suffix, e.g. user@example.com for an account in realm CORP.EXAMPLE.NET, which
500 * is what /smartcard-logon takes from the certificate. AD rejects a UPN suffix as
501 * a realm ("Realm not local to KDC") and only accepts it as an enterprise
502 * principal in the account's realm, as Windows clients send it. Try the domain as
503 * the realm first and keep the configured realm for that fallback. */
504 char* default_realm = nullptr;
505 if (strchr(udomain, '.') && (krb5_get_default_realm(ctx, &default_realm) == 0) &&
506 default_realm && (strcmp(default_realm, udomain) != 0))
507 {
508 upn_realm = _strdup(default_realm);
509 if (!upn_realm)
510 {
511 krb5_free_default_realm(ctx, default_realm);
512 free(udomain);
513 goto cleanup;
514 }
515 }
516 krb5_free_default_realm(ctx, default_realm);
517 }
518
519 /* Will use domain if realm is not specified in username */
520 const krb5_error_code rv = krb_log_exec(krb5_set_default_realm, ctx, realm);
521 if (host_realms)
522 krb5_free_host_realm(ctx, host_realms);
523 free(udomain);
524
525 if (rv)
526 goto cleanup;
527 }
528
529 if (pszPrincipal)
530 {
531 if (kerberos_parse_principal(ctx, pszPrincipal, domain, FALSE, &principal))
532 goto cleanup;
533 WINPR_ASSERT(principal);
534 }
535
536 if (krb_settings && krb_settings->cache)
537 {
538 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
539 goto cleanup;
540 }
541 else
542 own_ccache = TRUE;
543
544 if (principal)
545 {
546 /* Use the default cache if it's initialized with the right principal */
547 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
548 {
549 if (own_ccache)
550 {
551 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
552 goto cleanup;
553 }
554 else
555 {
556 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
557 goto cleanup;
558 }
559
560 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
561 goto cleanup;
562 ccache_initialized = TRUE;
563 }
564 else
565 {
566 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
567 goto cleanup;
568 own_ccache = FALSE;
569 }
570 WINPR_ASSERT(ccache);
571 }
572 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
573 {
574 /* Use the default cache with it's default principal */
575 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
576 goto cleanup;
577 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
578 goto cleanup;
579 WINPR_ASSERT(ccache);
580 own_ccache = FALSE;
581 }
582 else
583 {
584 if (own_ccache)
585 {
586 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
587 goto cleanup;
588 }
589 else
590 {
591 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
592 goto cleanup;
593 }
594 WINPR_ASSERT(ccache);
595 }
596
597 if (krb_settings && krb_settings->keytab)
598 {
599 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
600 goto cleanup;
601 }
602 else
603 {
604 if (fCredentialUse & SECPKG_CRED_INBOUND)
605 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
606 goto cleanup;
607 }
608
609 /* Get initial credentials if required */
610 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
611 {
612 krb5_creds creds = WINPR_C_ARRAY_INIT;
613 krb5_creds matchCreds = WINPR_C_ARRAY_INIT;
614 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
615
616 krb5_timeofday(ctx, &matchCreds.times.endtime);
617 matchCreds.times.endtime += 60;
618 matchCreds.client = principal;
619
620 WINPR_ASSERT(principal);
621 WINPR_ASSERT(ctx);
622 WINPR_ASSERT(ccache);
623 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
624 goto cleanup;
625
626 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
627 krb5_free_principal(ctx, matchCreds.server);
628 krb5_free_cred_contents(ctx, &creds);
629 if (rv)
630 {
631 krb5_error_code ret = krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache,
632 krb5_prompter, password, krb_settings);
633
634 /* The domain is no realm we can reach: retry it as a UPN suffix, see above. Only
635 * with a ccache this call initialized, a cache found by principal is not ours to
636 * reset. */
637 if (ret && upn_realm && pszPrincipal && ccache_initialized &&
638 kerberos_is_realm_error(ret))
639 {
640 WLog_INFO(TAG,
641 "domain %s is not a reachable Kerberos realm, retrying as an "
642 "enterprise principal in realm %s",
643 domain, upn_realm);
644
645 krb5_free_principal(ctx, principal);
646 principal = nullptr;
647 if (krb_log_exec(krb5_set_default_realm, ctx, upn_realm))
648 goto cleanup;
649 if (kerberos_parse_principal(ctx, pszPrincipal, domain, TRUE, &principal))
650 goto cleanup;
651 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
652 goto cleanup;
653 ret = krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
654 password, krb_settings);
655 }
656
657 if (ret)
658 goto cleanup;
659 }
660 }
661
662 credentials = calloc(1, sizeof(KRB_CREDENTIALS));
663 if (!credentials)
664 goto cleanup;
665 credentials->refCount = 1;
666 credentials->ctx = ctx;
667 credentials->ccache = ccache;
668 credentials->keytab = keytab;
669 credentials->own_ccache = own_ccache;
670
671cleanup:
672
673 free(upn_realm);
674 free(domain);
675 free(username);
676 free(password);
677
678 if (principal)
679 krb5_free_principal(ctx, principal);
680 if (ctx)
681 {
682 if (!credentials)
683 {
684 if (ccache)
685 {
686 if (own_ccache)
687 krb5_cc_destroy(ctx, ccache);
688 else
689 krb5_cc_close(ctx, ccache);
690 }
691 if (keytab)
692 krb5_kt_close(ctx, keytab);
693
694 krb5_free_context(ctx);
695 }
696 }
697
698 /* If we managed to get credentials set the output */
699 if (credentials)
700 {
701 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
702 sspi_SecureHandleSetUpperPointer(phCredential, (void*)KERBEROS_SSP_NAME);
703 return SEC_E_OK;
704 }
705
706 return SEC_E_NO_CREDENTIALS;
707#else
708 return SEC_E_UNSUPPORTED_FUNCTION;
709#endif
710}
711
712WINPR_ATTR_NODISCARD
713static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
714 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
715 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
716 PTimeStamp ptsExpiry)
717{
718 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
719 char* principal = nullptr;
720 char* package = nullptr;
721
722 if (pszPrincipal)
723 {
724 principal = ConvertWCharToUtf8Alloc(pszPrincipal, nullptr);
725 if (!principal)
726 goto fail;
727 }
728 if (pszPackage)
729 {
730 package = ConvertWCharToUtf8Alloc(pszPackage, nullptr);
731 if (!package)
732 goto fail;
733 }
734
735 status =
736 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
737 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
738
739fail:
740 free(principal);
741 free(package);
742
743 return status;
744}
745
746#ifdef WITH_KRB5
747static void credentials_unref(KRB_CREDENTIALS* credentials)
748{
749 WINPR_ASSERT(credentials);
750
751 if (InterlockedDecrement(&credentials->refCount))
752 return;
753
754 free(credentials->kdc_url);
755
756 if (credentials->ccache)
757 {
758 if (credentials->own_ccache)
759 krb5_cc_destroy(credentials->ctx, credentials->ccache);
760 else
761 krb5_cc_close(credentials->ctx, credentials->ccache);
762 }
763 if (credentials->keytab)
764 krb5_kt_close(credentials->ctx, credentials->keytab);
765
766 krb5_free_context(credentials->ctx);
767 free(credentials);
768}
769#endif
770
771WINPR_ATTR_NODISCARD
772static SECURITY_STATUS
773 SEC_ENTRY kerberos_FreeCredentialsHandle(WINPR_ATTR_UNUSED PCredHandle phCredential)
774{
775#ifdef WITH_KRB5
776 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
777 sspi_SecureHandleInvalidate(phCredential);
778 if (!credentials)
779 return SEC_E_INVALID_HANDLE;
780
781 credentials_unref(credentials);
782
783 return SEC_E_OK;
784#else
785 return SEC_E_UNSUPPORTED_FUNCTION;
786#endif
787}
788
789WINPR_ATTR_NODISCARD
790static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
791 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
792 WINPR_ATTR_UNUSED void* pBuffer)
793{
794#ifdef WITH_KRB5
795 switch (ulAttribute)
796 {
797 case SECPKG_CRED_ATTR_NAMES:
798 return SEC_E_OK;
799 default:
800 WLog_ERR(TAG, "TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
801 ulAttribute);
802 return SEC_E_UNSUPPORTED_FUNCTION;
803 }
804
805#else
806 return SEC_E_UNSUPPORTED_FUNCTION;
807#endif
808}
809
810WINPR_ATTR_NODISCARD
811static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(PCredHandle phCredential,
812 ULONG ulAttribute,
813 void* pBuffer)
814{
815 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
816}
817
818#ifdef WITH_KRB5
819WINPR_ATTR_NODISCARD
820static BOOL kerberos_mk_tgt_token(SecBuffer* buf, int msg_type, char* sname, char* host,
821 const krb5_data* ticket)
822{
823 WinPrAsn1Encoder* enc = nullptr;
824 WinPrAsn1_MemoryChunk data;
825 wStream s;
826 size_t len = 0;
827 sspi_gss_data token;
828 BOOL ret = FALSE;
829
830 WINPR_ASSERT(buf);
831
832 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
833 return FALSE;
834 if (msg_type == KRB_TGT_REP && !ticket)
835 return FALSE;
836
837 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
838 if (!enc)
839 return FALSE;
840
841 /* KERB-TGT-REQUEST (SEQUENCE) */
842 if (!WinPrAsn1EncSeqContainer(enc))
843 goto cleanup;
844
845 /* pvno [0] INTEGER */
846 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
847 goto cleanup;
848
849 /* msg-type [1] INTEGER */
850 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
851 goto cleanup;
852
853 if (msg_type == KRB_TGT_REQ && sname)
854 {
855 /* server-name [2] PrincipalName (SEQUENCE) */
856 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
857 goto cleanup;
858
859 /* name-type [0] INTEGER */
860 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
861 goto cleanup;
862
863 /* name-string [1] SEQUENCE OF GeneralString */
864 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
865 goto cleanup;
866
867 if (!WinPrAsn1EncGeneralString(enc, sname))
868 goto cleanup;
869
870 if (host && !WinPrAsn1EncGeneralString(enc, host))
871 goto cleanup;
872
873 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
874 goto cleanup;
875 }
876 else if (msg_type == KRB_TGT_REP)
877 {
878 /* ticket [2] Ticket */
879 data.data = (BYTE*)ticket->data;
880 data.len = ticket->length;
881 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
882 goto cleanup;
883 }
884
885 if (!WinPrAsn1EncEndContainer(enc))
886 goto cleanup;
887
888 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
889 goto cleanup;
890
891 Stream_StaticInit(&s, buf->pvBuffer, len);
892 if (!WinPrAsn1EncToStream(enc, &s))
893 goto cleanup;
894
895 token.data = buf->pvBuffer;
896 token.length = (UINT)len;
897 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
898 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
899 ret = TRUE;
900
901cleanup:
902 WinPrAsn1Encoder_Free(&enc);
903 return ret;
904}
905
906WINPR_ATTR_NODISCARD
907static BOOL append(char* dst, size_t dstSize, const char* src)
908{
909 const size_t dlen = strnlen(dst, dstSize);
910 const size_t slen = strlen(src);
911 if (dlen + slen >= dstSize)
912 return FALSE;
913 if (!strncat(dst, src, dstSize - dlen))
914 return FALSE;
915 return TRUE;
916}
917
918WINPR_ATTR_NODISCARD
919static BOOL kerberos_rd_tgt_req_tag2(WinPrAsn1Decoder* dec, char* buf, size_t len)
920{
921 BOOL rc = FALSE;
922 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
923
924 /* server-name [2] PrincipalName (SEQUENCE) */
925 if (!WinPrAsn1DecReadSequence(dec, &seq))
926 goto end;
927
928 /* name-type [0] INTEGER */
929 {
930 BOOL error = FALSE;
931 {
932 WinPrAsn1_INTEGER val = 0;
933 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
934 goto end;
935 }
936
937 /* name-string [1] SEQUENCE OF GeneralString */
938 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
939 goto end;
940 }
941
942 {
943 WinPrAsn1_tag tag = 0;
944 BOOL first = TRUE;
945 while (WinPrAsn1DecPeekTag(dec, &tag))
946 {
947 BOOL success = FALSE;
948 char* lstr = nullptr;
949 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
950 goto fail;
951
952 if (!first)
953 {
954 if (!append(buf, len, "/"))
955 goto fail;
956 }
957 first = FALSE;
958
959 if (!append(buf, len, lstr))
960 goto fail;
961
962 success = TRUE;
963 fail:
964 free(lstr);
965 if (!success)
966 goto end;
967 }
968 }
969
970 rc = TRUE;
971end:
972 return rc;
973}
974
975WINPR_ATTR_NODISCARD
976static BOOL kerberos_rd_tgt_req_tag3(WinPrAsn1Decoder* dec, char* buf, size_t len)
977{
978 /* realm [3] Realm */
979 BOOL rc = FALSE;
980 WinPrAsn1_STRING str = nullptr;
981 if (!WinPrAsn1DecReadGeneralString(dec, &str))
982 goto end;
983
984 if (!append(buf, len, "@"))
985 goto end;
986 if (!append(buf, len, str))
987 goto end;
988
989 rc = TRUE;
990end:
991 free(str);
992 return rc;
993}
994
995WINPR_ATTR_NODISCARD
996static BOOL kerberos_rd_tgt_req(WinPrAsn1Decoder* dec, char** target)
997{
998 BOOL rc = FALSE;
999
1000 if (!target)
1001 return FALSE;
1002 *target = nullptr;
1003
1004 wStream s = WinPrAsn1DecGetStream(dec);
1005 const size_t len = Stream_Length(&s);
1006 if (len == 0)
1007 return TRUE;
1008
1009 WinPrAsn1Decoder dec2 = WinPrAsn1Decoder_init();
1010 WinPrAsn1_tagId tag = 0;
1011 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
1012 return FALSE;
1013
1014 char* buf = calloc(len + 1, sizeof(char));
1015 if (!buf)
1016 return FALSE;
1017
1018 /* We expect ASN1 context tag values 2 or 3.
1019 *
1020 * In case we got value 2 an (optional) context tag value 3 might follow.
1021 */
1022 BOOL checkForTag3 = TRUE;
1023 if (tag == 2)
1024 {
1025 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
1026 if (rc)
1027 {
1028 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
1029 if (res == 0)
1030 checkForTag3 = FALSE;
1031 }
1032 }
1033
1034 if (checkForTag3)
1035 {
1036 if (tag == 3)
1037 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
1038 else
1039 rc = FALSE;
1040 }
1041
1042 if (rc)
1043 *target = buf;
1044 else
1045 free(buf);
1046 return rc;
1047}
1048
1049WINPR_ATTR_NODISCARD
1050static BOOL kerberos_rd_tgt_rep(WinPrAsn1Decoder* dec, krb5_data* ticket)
1051{
1052 if (!ticket)
1053 return FALSE;
1054
1055 /* ticket [2] Ticket */
1056 WinPrAsn1Decoder asnTicket = WinPrAsn1Decoder_init();
1057 WinPrAsn1_tagId tag = 0;
1058 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
1059 return FALSE;
1060
1061 if (tag != 2)
1062 return FALSE;
1063
1064 wStream s = WinPrAsn1DecGetStream(&asnTicket);
1065 ticket->data = Stream_BufferAs(&s, char);
1066
1067 const size_t len = Stream_Length(&s);
1068 if (len > UINT32_MAX)
1069 return FALSE;
1070 ticket->length = (UINT32)len;
1071 return TRUE;
1072}
1073
1074WINPR_ATTR_NODISCARD
1075static BOOL kerberos_rd_tgt_token(const sspi_gss_data* token, char** target, krb5_data* ticket)
1076{
1077 BOOL error = 0;
1078 WinPrAsn1_INTEGER val = 0;
1079
1080 WINPR_ASSERT(token);
1081
1082 if (target)
1083 *target = nullptr;
1084
1085 WinPrAsn1Decoder der = WinPrAsn1Decoder_init();
1086 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
1087
1088 /* KERB-TGT-REQUEST (SEQUENCE) */
1089 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
1090 if (!WinPrAsn1DecReadSequence(&der, &seq))
1091 return FALSE;
1092
1093 /* pvno [0] INTEGER */
1094 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
1095 return FALSE;
1096
1097 /* msg-type [1] INTEGER */
1098 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
1099 return FALSE;
1100
1101 switch (val)
1102 {
1103 case KRB_TGT_REQ:
1104 return kerberos_rd_tgt_req(&seq, target);
1105 case KRB_TGT_REP:
1106 return kerberos_rd_tgt_rep(&seq, ticket);
1107 default:
1108 break;
1109 }
1110 return FALSE;
1111}
1112
1113WINPR_ATTR_NODISCARD
1114static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5, SEC_CHANNEL_BINDINGS* bindings)
1115{
1116 BYTE buf[4];
1117
1118 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
1119 if (!winpr_Digest_Update(md5, buf, 4))
1120 return FALSE;
1121
1122 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
1123 if (!winpr_Digest_Update(md5, buf, 4))
1124 return FALSE;
1125
1126 if (bindings->cbInitiatorLength &&
1127 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
1128 bindings->cbInitiatorLength))
1129 return FALSE;
1130
1131 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
1132 if (!winpr_Digest_Update(md5, buf, 4))
1133 return FALSE;
1134
1135 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
1136 if (!winpr_Digest_Update(md5, buf, 4))
1137 return FALSE;
1138
1139 if (bindings->cbAcceptorLength &&
1140 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
1141 bindings->cbAcceptorLength))
1142 return FALSE;
1143
1144 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
1145 if (!winpr_Digest_Update(md5, buf, 4))
1146 return FALSE;
1147
1148 if (bindings->cbApplicationDataLength &&
1149 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
1150 bindings->cbApplicationDataLength))
1151 return FALSE;
1152
1153 return TRUE;
1154}
1155
1156#endif /* WITH_KRB5 */
1157
1158WINPR_ATTR_NODISCARD
1159static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
1160 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1161 WINPR_ATTR_UNUSED SEC_CHAR* pszTargetName, WINPR_ATTR_UNUSED ULONG fContextReq,
1162 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1163 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG Reserved2,
1164 WINPR_ATTR_UNUSED PCtxtHandle phNewContext, WINPR_ATTR_UNUSED PSecBufferDesc pOutput,
1165 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
1166{
1167#ifdef WITH_KRB5
1168 PSecBuffer input_buffer = nullptr;
1169 PSecBuffer output_buffer = nullptr;
1170 PSecBuffer bindings_buffer = nullptr;
1171 WINPR_DIGEST_CTX* md5 = nullptr;
1172 char* target = nullptr;
1173 char* sname = nullptr;
1174 char* host = nullptr;
1175 krb5_data input_token = WINPR_C_ARRAY_INIT;
1176 krb5_data output_token = WINPR_C_ARRAY_INIT;
1177 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1178 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1179 uint16_t tok_id = 0;
1180 krb5_ap_rep_enc_part* reply = nullptr;
1181 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
1182 char cksum_contents[24] = WINPR_C_ARRAY_INIT;
1183 krb5_data cksum = WINPR_C_ARRAY_INIT;
1184 krb5_creds in_creds = WINPR_C_ARRAY_INIT;
1185 krb5_creds* creds = nullptr;
1186 BOOL isNewContext = FALSE;
1187 KRB_CONTEXT* context = nullptr;
1188 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1189
1190 /* behave like windows SSPIs that don't want empty context */
1191 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1192 return SEC_E_INVALID_HANDLE;
1193
1194 context = sspi_SecureHandleGetLowerPointer(phContext);
1195
1196 if (!credentials)
1197 return SEC_E_NO_CREDENTIALS;
1198
1199 if (pInput)
1200 {
1201 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1202 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
1203 }
1204 if (pOutput)
1205 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1206
1207 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
1208 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
1209
1210 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1211 ap_flags |= AP_OPTS_USE_SESSION_KEY;
1212
1213 /* Split target name into service/hostname components */
1214 if (pszTargetName)
1215 {
1216 target = _strdup(pszTargetName);
1217 if (!target)
1218 {
1219 status = SEC_E_INSUFFICIENT_MEMORY;
1220 goto cleanup;
1221 }
1222 host = strchr(target, '/');
1223 if (host)
1224 {
1225 *host++ = 0;
1226 sname = target;
1227 }
1228 else
1229 host = target;
1230 if (isValidIP(host))
1231 {
1232 status = SEC_E_NO_CREDENTIALS;
1233 goto cleanup;
1234 }
1235 }
1236
1237 if (!context)
1238 {
1239 context = kerberos_ContextNew(credentials);
1240 if (!context)
1241 {
1242 status = SEC_E_INSUFFICIENT_MEMORY;
1243 goto cleanup;
1244 }
1245
1246 isNewContext = TRUE;
1247
1248 if (host)
1249 context->targetHost = _strdup(host);
1250 if (!context->targetHost)
1251 {
1252 status = SEC_E_INSUFFICIENT_MEMORY;
1253 goto cleanup;
1254 }
1255
1256 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1257 {
1258 context->state = KERBEROS_STATE_TGT_REQ;
1259 context->u2u = TRUE;
1260 }
1261 else
1262 context->state = KERBEROS_STATE_AP_REQ;
1263 }
1264 else
1265 {
1266 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1267 goto bad_token;
1268 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1269 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1270 goto bad_token;
1271 }
1272
1273 /* SSPI flags are compatible with GSS flags except INTEG_FLAG */
1274 context->flags |= (fContextReq & 0x1F);
1275 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1276 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1277
1278 switch (context->state)
1279 {
1280 case KERBEROS_STATE_TGT_REQ:
1281
1282 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, nullptr))
1283 goto cleanup;
1284
1285 context->state = KERBEROS_STATE_TGT_REP;
1286 status = SEC_I_CONTINUE_NEEDED;
1287 break;
1288
1289 case KERBEROS_STATE_TGT_REP:
1290
1291 if (tok_id != TOK_ID_TGT_REP)
1292 goto bad_token;
1293
1294 if (!kerberos_rd_tgt_token(&input_token, nullptr, &in_creds.second_ticket))
1295 goto bad_token;
1296
1297 /* Continue to AP-REQ */
1298 /* fallthrough */
1299 WINPR_FALLTHROUGH
1300
1301 case KERBEROS_STATE_AP_REQ:
1302
1303 /* Set auth_context options */
1304 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1305 goto cleanup;
1306 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1307 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1308 goto cleanup;
1309 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1310 GSS_CHECKSUM_TYPE))
1311 goto cleanup;
1312
1313 /* Get a service ticket */
1314 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1315 KRB5_NT_SRV_HST, &in_creds.server))
1316 goto cleanup;
1317
1318 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1319 &in_creds.client))
1320 {
1321 status = SEC_E_WRONG_PRINCIPAL;
1322 goto cleanup;
1323 }
1324
1325 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1326 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1327 &creds))
1328 {
1329 status = SEC_E_NO_CREDENTIALS;
1330 goto cleanup;
1331 }
1332
1333 /* Write the checksum (delegation not implemented) */
1334 cksum.data = cksum_contents;
1335 cksum.length = sizeof(cksum_contents);
1336 winpr_Data_Write_UINT32(cksum_contents, 16);
1337 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1338
1339 if (bindings_buffer)
1340 {
1341 SEC_CHANNEL_BINDINGS* bindings = bindings_buffer->pvBuffer;
1342
1343 /* Sanity checks */
1344 if (bindings_buffer->cbBuffer < sizeof(SEC_CHANNEL_BINDINGS) ||
1345 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1346 bindings_buffer->cbBuffer ||
1347 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1348 bindings_buffer->cbBuffer ||
1349 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1350 bindings_buffer->cbBuffer)
1351 {
1352 status = SEC_E_BAD_BINDINGS;
1353 goto cleanup;
1354 }
1355
1356 md5 = winpr_Digest_New();
1357 if (!md5)
1358 goto cleanup;
1359
1360 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1361 goto cleanup;
1362
1363 if (!kerberos_hash_channel_bindings(md5, bindings))
1364 goto cleanup;
1365
1366 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1367 goto cleanup;
1368 }
1369
1370 /* Make the AP_REQ message */
1371 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1372 &cksum, creds, &output_token))
1373 goto cleanup;
1374
1375 if (!sspi_gss_wrap_token(output_buffer,
1376 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1377 TOK_ID_AP_REQ, &output_token))
1378 goto cleanup;
1379
1380 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1381 {
1382 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1383 context->auth_ctx, (INT32*)&context->local_seq))
1384 goto cleanup;
1385 context->remote_seq ^= context->local_seq;
1386 }
1387
1388 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1389 &context->keyset))
1390 goto cleanup;
1391
1392 context->state = KERBEROS_STATE_AP_REP;
1393
1394 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1395 status = SEC_I_CONTINUE_NEEDED;
1396 else
1397 status = SEC_E_OK;
1398 break;
1399
1400 case KERBEROS_STATE_AP_REP:
1401
1402 if (tok_id == TOK_ID_AP_REP)
1403 {
1404 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1405 &reply))
1406 goto cleanup;
1407 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1408 }
1409 else if (tok_id == TOK_ID_ERROR)
1410 {
1411 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1412 goto cleanup;
1413 }
1414 else
1415 goto bad_token;
1416
1417 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1418 {
1419 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1420 context->auth_ctx, (INT32*)&context->remote_seq))
1421 goto cleanup;
1422 }
1423
1424 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1425 &context->keyset))
1426 goto cleanup;
1427
1428 context->state = KERBEROS_STATE_FINAL;
1429
1430 if (output_buffer)
1431 output_buffer->cbBuffer = 0;
1432 status = SEC_E_OK;
1433 break;
1434
1435 case KERBEROS_STATE_FINAL:
1436 default:
1437 WLog_ERR(TAG, "Kerberos in invalid state!");
1438 goto cleanup;
1439 }
1440
1441cleanup:
1442{
1443 /* second_ticket is not allocated */
1444 krb5_data edata = WINPR_C_ARRAY_INIT;
1445 in_creds.second_ticket = edata;
1446 krb5_free_cred_contents(credentials->ctx, &in_creds);
1447}
1448
1449 krb5_free_creds(credentials->ctx, creds);
1450 if (output_token.data)
1451 krb5glue_free_data_contents(credentials->ctx, &output_token);
1452
1453 winpr_Digest_Free(md5);
1454
1455 free(target);
1456
1457 if (isNewContext)
1458 {
1459 switch (status)
1460 {
1461 case SEC_E_OK:
1462 case SEC_I_CONTINUE_NEEDED:
1463 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1464 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1465 break;
1466 default:
1467 kerberos_ContextFree(context, TRUE);
1468 sspi_SecureHandleInvalidate(phNewContext);
1469 break;
1470 }
1471 }
1472
1473 return status;
1474
1475bad_token:
1476 status = SEC_E_INVALID_TOKEN;
1477 goto cleanup;
1478#else
1479 return SEC_E_UNSUPPORTED_FUNCTION;
1480#endif /* WITH_KRB5 */
1481}
1482
1483WINPR_ATTR_NODISCARD
1484static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1485 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1486 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1487 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr, PTimeStamp ptsExpiry)
1488{
1489 SECURITY_STATUS status = 0;
1490 char* target_name = nullptr;
1491
1492 if (pszTargetName)
1493 {
1494 target_name = ConvertWCharToUtf8Alloc(pszTargetName, nullptr);
1495 if (!target_name)
1496 return SEC_E_INSUFFICIENT_MEMORY;
1497 }
1498
1499 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1500 Reserved1, TargetDataRep, pInput, Reserved2,
1501 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1502
1503 if (target_name)
1504 free(target_name);
1505
1506 return status;
1507}
1508
1509#ifdef WITH_KRB5
1510WINPR_ATTR_NODISCARD
1511static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1512 krb5_creds* creds)
1513{
1514 BOOL ret = FALSE;
1515 krb5_kt_cursor cur = WINPR_C_ARRAY_INIT;
1516 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1517 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1518 goto cleanup;
1519
1520 do
1521 {
1522 krb5_error_code rv =
1523 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1524 if (rv == KRB5_KT_END)
1525 break;
1526 if (rv != 0)
1527 goto cleanup;
1528
1529 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1530 break;
1531 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1532 memset(&entry, 0, sizeof(entry));
1533 if (rv)
1534 goto cleanup;
1535 } while (1);
1536
1537 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1538 goto cleanup;
1539
1540 if (!entry.principal)
1541 goto cleanup;
1542
1543 /* Get the TGT */
1544 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1545 credentials->keytab, 0, nullptr, nullptr))
1546 goto cleanup;
1547
1548 ret = TRUE;
1549
1550cleanup:
1551 return ret;
1552}
1553
1554WINPR_ATTR_NODISCARD
1555static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials, const char* target, krb5_creds* creds)
1556{
1557 BOOL ret = TRUE;
1558 krb5_principal target_princ = WINPR_C_ARRAY_INIT;
1559 char* default_realm = nullptr;
1560
1561 /* server-name is optional in a KERB-TGT-REQUEST, without one there is no principal to look
1562 * up a TGT for */
1563 if (!target)
1564 return FALSE;
1565
1566 krb5_error_code rv =
1567 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1568 if (rv)
1569 return FALSE;
1570
1571#if defined(WITH_KRB5_HEIMDAL)
1572 if (!target_princ->realm)
1573 {
1574 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1575 if (rv)
1576 goto out;
1577
1578 target_princ->realm = default_realm;
1579 }
1580#else
1581 if (!target_princ->realm.length)
1582 {
1583 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1584 if (rv)
1585 goto out;
1586
1587 const size_t len = strnlen(default_realm, MAX_KEYTAB_NAME_LEN + 1);
1588 if ((len == 0) || !default_realm)
1589 goto out;
1590 target_princ->realm.data = strndup(default_realm, len);
1591 if (!target_princ->realm.data)
1592 goto out;
1593 target_princ->realm.length = (unsigned int)len;
1594 }
1595#endif
1596
1597 /*
1598 * First try with the account service. We were requested with something like
1599 * TERMSRV/<host>@<realm>, let's see if we have that in our keytab and if we're able
1600 * to retrieve a TGT with that entry
1601 *
1602 */
1603 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1604 goto out;
1605
1606 ret = FALSE;
1607
1608#if defined(WITH_KRB5_MIT)
1609 /*
1610 * if it's not working let's try with <host>$@<REALM> (note the dollar)
1611 */
1612 {
1613 char hostDollar[300] = WINPR_C_ARRAY_INIT;
1614 if (target_princ->length < 2)
1615 goto out;
1616
1617 (void)snprintf(hostDollar, sizeof(hostDollar) - 1, "%s$@%s", target_princ->data[1].data,
1618 target_princ->realm.data);
1619 krb5_free_principal(credentials->ctx, target_princ);
1620
1621 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1622 if (rv)
1623 return FALSE;
1624 }
1625 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1626#endif
1627
1628out:
1629 if (default_realm)
1630 krb5_free_default_realm(credentials->ctx, default_realm);
1631
1632 krb5_free_principal(credentials->ctx, target_princ);
1633 return ret;
1634}
1635#endif
1636
1637WINPR_ATTR_NODISCARD
1638static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1639 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1640 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG fContextReq,
1641 WINPR_ATTR_UNUSED ULONG TargetDataRep, WINPR_ATTR_UNUSED PCtxtHandle phNewContext,
1642 WINPR_ATTR_UNUSED PSecBufferDesc pOutput, WINPR_ATTR_UNUSED ULONG* pfContextAttr,
1643 WINPR_ATTR_UNUSED PTimeStamp ptsExpity)
1644{
1645#ifdef WITH_KRB5
1646 BOOL isNewContext = FALSE;
1647 PSecBuffer input_buffer = nullptr;
1648 PSecBuffer output_buffer = nullptr;
1649 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1650 uint16_t tok_id = 0;
1651 krb5_data input_token = WINPR_C_ARRAY_INIT;
1652 krb5_data output_token = WINPR_C_ARRAY_INIT;
1653 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1654 krb5_flags ap_flags = 0;
1655 krb5glue_authenticator authenticator = nullptr;
1656 char* target = nullptr;
1657 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1658 krb5_creds creds = WINPR_C_ARRAY_INIT;
1659
1660 /* behave like windows SSPIs that don't want empty context */
1661 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1662 return SEC_E_INVALID_HANDLE;
1663
1664 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1665 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1666
1667 if (pInput)
1668 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1669 if (pOutput)
1670 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1671
1672 if (!input_buffer)
1673 return SEC_E_INVALID_TOKEN;
1674
1675 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1676 return SEC_E_INVALID_TOKEN;
1677
1678 if (!context)
1679 {
1680 isNewContext = TRUE;
1681 context = kerberos_ContextNew(credentials);
1682 context->acceptor = TRUE;
1683
1684 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1685 {
1686 context->u2u = TRUE;
1687 context->state = KERBEROS_STATE_TGT_REQ;
1688 }
1689 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1690 context->state = KERBEROS_STATE_AP_REQ;
1691 else
1692 goto bad_token;
1693 }
1694 else
1695 {
1696 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1697 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1698 goto bad_token;
1699 }
1700
1701 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1702 {
1703 if (!kerberos_rd_tgt_token(&input_token, &target, nullptr))
1704 goto bad_token;
1705
1706 if (!retrieveSomeTgt(credentials, target, &creds))
1707 goto cleanup;
1708
1709 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, nullptr, nullptr, &creds.ticket))
1710 goto cleanup;
1711
1712 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1713 goto cleanup;
1714
1715 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1716 &krb5glue_creds_getkey(creds)))
1717 goto cleanup;
1718
1719 context->state = KERBEROS_STATE_AP_REQ;
1720 }
1721 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1722 {
1723 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, nullptr,
1724 credentials->keytab, &ap_flags, nullptr))
1725 goto cleanup;
1726
1727 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1728 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1729 goto cleanup;
1730
1731 /* Retrieve and validate the checksum */
1732 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1733 &authenticator))
1734 goto cleanup;
1735 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1736 &context->flags))
1737 goto bad_token;
1738
1739 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1740 {
1741 if (!output_buffer)
1742 goto bad_token;
1743 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1744 goto cleanup;
1745 if (!sspi_gss_wrap_token(output_buffer,
1746 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1747 TOK_ID_AP_REP, &output_token))
1748 goto cleanup;
1749 }
1750 else
1751 {
1752 if (output_buffer)
1753 output_buffer->cbBuffer = 0;
1754 }
1755
1756 *pfContextAttr = (context->flags & 0x1F);
1757 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1758 *pfContextAttr |= ASC_RET_INTEGRITY;
1759
1760 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1761 {
1762 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1763 (INT32*)&context->local_seq))
1764 goto cleanup;
1765 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1766 (INT32*)&context->remote_seq))
1767 goto cleanup;
1768 }
1769
1770 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1771 &context->keyset))
1772 goto cleanup;
1773
1774 context->state = KERBEROS_STATE_FINAL;
1775 }
1776 else
1777 goto bad_token;
1778
1779 /* On first call allocate new context */
1780 if (context->state == KERBEROS_STATE_FINAL)
1781 status = SEC_E_OK;
1782 else
1783 status = SEC_I_CONTINUE_NEEDED;
1784
1785cleanup:
1786 free(target);
1787 if (output_token.data)
1788 krb5glue_free_data_contents(credentials->ctx, &output_token);
1789 if (entry.principal)
1790 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1791
1792 if (isNewContext)
1793 {
1794 switch (status)
1795 {
1796 case SEC_E_OK:
1797 case SEC_I_CONTINUE_NEEDED:
1798 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1799 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1800 break;
1801 default:
1802 kerberos_ContextFree(context, TRUE);
1803 sspi_SecureHandleInvalidate(phNewContext);
1804 break;
1805 }
1806 }
1807
1808 return status;
1809
1810bad_token:
1811 status = SEC_E_INVALID_TOKEN;
1812 goto cleanup;
1813#else
1814 return SEC_E_UNSUPPORTED_FUNCTION;
1815#endif /* WITH_KRB5 */
1816}
1817
1818#ifdef WITH_KRB5
1819WINPR_ATTR_NODISCARD
1820static KRB_CONTEXT* get_context(PCtxtHandle phContext)
1821{
1822 if (!phContext)
1823 return nullptr;
1824
1825 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1826 if (!name)
1827 return nullptr;
1828
1829 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1830 return nullptr;
1831 return sspi_SecureHandleGetLowerPointer(phContext);
1832}
1833
1834WINPR_ATTR_NODISCARD
1835static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1836{
1837 WINPR_ASSERT(data);
1838 WINPR_ASSERT(ptr);
1839 WINPR_ASSERT(psize);
1840
1841 *ptr = (PUCHAR)malloc(data->length);
1842 if (!*ptr)
1843 return FALSE;
1844
1845 *psize = data->length;
1846 memcpy(*ptr, data->data, data->length);
1847 return TRUE;
1848}
1849#endif
1850
1851WINPR_ATTR_NODISCARD
1852static SECURITY_STATUS
1853 SEC_ENTRY kerberos_DeleteSecurityContext(WINPR_ATTR_UNUSED PCtxtHandle phContext)
1854{
1855#ifdef WITH_KRB5
1856 KRB_CONTEXT* context = get_context(phContext);
1857 sspi_SecureHandleInvalidate(phContext);
1858 if (!context)
1859 return SEC_E_INVALID_HANDLE;
1860
1861 kerberos_ContextFree(context, TRUE);
1862
1863 return SEC_E_OK;
1864#else
1865 return SEC_E_UNSUPPORTED_FUNCTION;
1866#endif
1867}
1868
1869#ifdef WITH_KRB5
1870
1871WINPR_ATTR_NODISCARD
1872static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1873{
1874 switch (code)
1875 {
1876 case 0:
1877 return SEC_E_OK;
1878 default:
1879 return SEC_E_INTERNAL_ERROR;
1880 }
1881}
1882
1883WINPR_ATTR_NODISCARD
1884static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1885 SecPkgContext_Sizes* ContextSizes)
1886{
1887 UINT header = 0;
1888 UINT pad = 0;
1889 UINT trailer = 0;
1890 krb5glue_key key = nullptr;
1891
1892 WINPR_ASSERT(context);
1893 WINPR_ASSERT(context->auth_ctx);
1894
1895 /* The MaxTokenSize by default is 12,000 bytes. This has been the default value
1896 * since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2.
1897 * For Windows Server 2012, the default value of the MaxTokenSize registry
1898 * entry is 48,000 bytes.*/
1899 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1900 ContextSizes->cbMaxSignature = 0;
1901 ContextSizes->cbBlockSize = 1;
1902 ContextSizes->cbSecurityTrailer = 0;
1903
1904 key = get_key(&context->keyset);
1905
1906 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1907 {
1908 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1909 KRB5_CRYPTO_TYPE_HEADER, &header);
1910 if (rv)
1911 return krb5_error_to_SECURITY_STATUS(rv);
1912
1913 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1914 &pad);
1915 if (rv)
1916 return krb5_error_to_SECURITY_STATUS(rv);
1917
1918 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1919 &trailer);
1920 if (rv)
1921 return krb5_error_to_SECURITY_STATUS(rv);
1922
1923 /* GSS header (= 16 bytes) + encrypted header = 32 bytes */
1924 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1925 }
1926
1927 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1928 {
1929 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1930 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1931 if (rv)
1932 return krb5_error_to_SECURITY_STATUS(rv);
1933
1934 ContextSizes->cbMaxSignature += 16;
1935 }
1936
1937 return SEC_E_OK;
1938}
1939
1940WINPR_ATTR_NODISCARD
1941static SECURITY_STATUS kerberos_ATTR_AUTH_IDENTITY(KRB_CONTEXT* context,
1942 KRB_CREDENTIALS* credentials,
1943 SecPkgContext_AuthIdentity* AuthIdentity)
1944{
1945 const SecPkgContext_AuthIdentity empty = WINPR_C_ARRAY_INIT;
1946
1947 WINPR_ASSERT(context);
1948 WINPR_ASSERT(context->auth_ctx);
1949 WINPR_ASSERT(credentials);
1950
1951 WINPR_ASSERT(AuthIdentity);
1952 *AuthIdentity = empty;
1953
1954 krb5glue_authenticator authenticator = nullptr;
1955 krb5_error_code rv = krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx,
1956 context->auth_ctx, &authenticator);
1957 if (rv)
1958 goto fail;
1959
1960 {
1961 rv = -1;
1962
1963#if defined(WITH_KRB5_HEIMDAL)
1964 const Realm data = authenticator->crealm;
1965 if (!data)
1966 goto fail;
1967 const size_t data_len = length_Realm(&data);
1968#else
1969 krb5_data* realm_data = krb5_princ_realm(credentials->ctx, authenticator->client);
1970 if (!realm_data)
1971 goto fail;
1972 const char* data = realm_data->data;
1973 if (!data)
1974 goto fail;
1975 const size_t data_len = realm_data->length;
1976#endif
1977
1978 if (data_len > (sizeof(AuthIdentity->Domain) - 1))
1979 goto fail;
1980 strncpy(AuthIdentity->Domain, data, data_len);
1981 }
1982
1983 {
1984#if defined(WITH_KRB5_HEIMDAL)
1985 const PrincipalName* principal = &authenticator->cname;
1986 const size_t name_length = length_PrincipalName(principal);
1987 if (!principal->name_string.val)
1988 goto fail;
1989 const char* name = *principal->name_string.val;
1990#else
1991 char* name = nullptr;
1992 rv = krb_log_exec(krb5_unparse_name_flags, credentials->ctx, authenticator->client,
1993 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
1994 if (rv)
1995 goto fail;
1996
1997 const size_t name_length = strlen(name);
1998#endif
1999
2000 const bool ok = (name_length <= (sizeof(AuthIdentity->User) - 1));
2001 if (ok)
2002 strncpy(AuthIdentity->User, name, name_length);
2003
2004 rv = ok ? 0 : -1;
2005
2006#if !defined(WITH_KRB5_HEIMDAL)
2007 krb5_free_unparsed_name(credentials->ctx, name);
2008#endif
2009 }
2010
2011fail:
2012 krb5glue_free_authenticator(credentials->ctx, authenticator);
2013 return krb5_error_to_SECURITY_STATUS(rv);
2014}
2015
2016WINPR_ATTR_NODISCARD
2017static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_A(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
2018 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
2019 SecPkgContext_PackageInfoA* PackageInfo)
2020{
2021 size_t size = sizeof(SecPkgInfoA);
2022 SecPkgInfoA* pPackageInfo =
2023 (SecPkgInfoA*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
2024
2025 if (!pPackageInfo)
2026 return SEC_E_INSUFFICIENT_MEMORY;
2027
2028 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoA.fCapabilities;
2029 pPackageInfo->wVersion = KERBEROS_SecPkgInfoA.wVersion;
2030 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoA.wRPCID;
2031 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
2032 pPackageInfo->Name = _strdup(KERBEROS_SecPkgInfoA.Name);
2033 pPackageInfo->Comment = _strdup(KERBEROS_SecPkgInfoA.Comment);
2034
2035 if (!pPackageInfo->Name || !pPackageInfo->Comment)
2036 {
2037 sspi_ContextBufferFree(pPackageInfo);
2038 return SEC_E_INSUFFICIENT_MEMORY;
2039 }
2040 PackageInfo->PackageInfo = pPackageInfo;
2041 return SEC_E_OK;
2042}
2043
2044WINPR_ATTR_NODISCARD
2045static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_W(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
2046 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
2047 SecPkgContext_PackageInfoW* PackageInfo)
2048{
2049 size_t size = sizeof(SecPkgInfoW);
2050 SecPkgInfoW* pPackageInfo =
2051 (SecPkgInfoW*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
2052
2053 if (!pPackageInfo)
2054 return SEC_E_INSUFFICIENT_MEMORY;
2055
2056 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoW.fCapabilities;
2057 pPackageInfo->wVersion = KERBEROS_SecPkgInfoW.wVersion;
2058 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoW.wRPCID;
2059 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoW.cbMaxToken;
2060 pPackageInfo->Name = _wcsdup(KERBEROS_SecPkgInfoW.Name);
2061 pPackageInfo->Comment = _wcsdup(KERBEROS_SecPkgInfoW.Comment);
2062
2063 if (!pPackageInfo->Name || !pPackageInfo->Comment)
2064 {
2065 sspi_ContextBufferFree(pPackageInfo);
2066 return SEC_E_INSUFFICIENT_MEMORY;
2067 }
2068 PackageInfo->PackageInfo = pPackageInfo;
2069 return SEC_E_OK;
2070}
2071
2072WINPR_ATTR_NODISCARD
2073static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
2074 KRB_CREDENTIALS* credentials,
2075 KERB_TICKET_LOGON* ticketLogon)
2076{
2077 krb5_creds matchCred = WINPR_C_ARRAY_INIT;
2078 krb5_auth_context authContext = nullptr;
2079 krb5_flags getCredsFlags = KRB5_GC_CACHED;
2080 BOOL firstRun = TRUE;
2081 krb5_creds* hostCred = nullptr;
2082 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
2083 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost, "HOST",
2084 KRB5_NT_SRV_HST, &matchCred.server);
2085 if (rv)
2086 goto out;
2087
2088 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
2089 &matchCred.client);
2090 if (rv)
2091 goto out;
2092
2093 /* try from the cache first, and then do a new request */
2094again:
2095 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
2096 &matchCred, &hostCred);
2097 switch (rv)
2098 {
2099 case 0:
2100 break;
2101 case KRB5_CC_NOTFOUND:
2102 getCredsFlags = 0;
2103 if (firstRun)
2104 {
2105 firstRun = FALSE;
2106 goto again;
2107 }
2108 WINPR_FALLTHROUGH
2109 default:
2110 WLog_ERR(TAG, "krb5_get_credentials(hostCreds), rv=%d", rv);
2111 goto out;
2112 }
2113
2114 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
2115 goto out;
2116
2117 {
2118 krb5_data derOut = WINPR_C_ARRAY_INIT;
2119 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
2120 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
2121 {
2122 ret = SEC_E_LOGON_DENIED;
2123 goto out;
2124 }
2125
2126 ticketLogon->MessageType = KerbTicketLogon;
2127 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
2128
2129 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
2130 &ticketLogon->ServiceTicketLength))
2131 {
2132 krb5_free_data(credentials->ctx, &derOut);
2133 goto out;
2134 }
2135
2136 ticketLogon->TicketGrantingTicketLength = derOut.length;
2137 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
2138 }
2139
2140 ret = SEC_E_OK;
2141out:
2142 krb5_auth_con_free(credentials->ctx, authContext);
2143 krb5_free_creds(credentials->ctx, hostCred);
2144 krb5_free_cred_contents(credentials->ctx, &matchCred);
2145 return ret;
2146}
2147
2148#endif /* WITH_KRB5 */
2149
2150WINPR_ATTR_NODISCARD
2151static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesCommon(
2152 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2153{
2154 if (!phContext)
2155 return SEC_E_INVALID_HANDLE;
2156
2157 if (!pBuffer)
2158 return SEC_E_INVALID_PARAMETER;
2159
2160#ifdef WITH_KRB5
2161 KRB_CONTEXT* context = get_context(phContext);
2162 if (!context)
2163 return SEC_E_INVALID_PARAMETER;
2164
2165 KRB_CREDENTIALS* credentials = context->credentials;
2166
2167 switch (ulAttribute)
2168 {
2169 case SECPKG_ATTR_SIZES:
2170 return kerberos_ATTR_SIZES(context, credentials, (SecPkgContext_Sizes*)pBuffer);
2171
2172 case SECPKG_ATTR_AUTH_IDENTITY:
2173 return kerberos_ATTR_AUTH_IDENTITY(context, credentials,
2174 (SecPkgContext_AuthIdentity*)pBuffer);
2175
2176 case SECPKG_CRED_ATTR_TICKET_LOGON:
2177 return kerberos_ATTR_TICKET_LOGON(context, credentials, (KERB_TICKET_LOGON*)pBuffer);
2178
2179 default:
2180 WLog_ERR(TAG, "TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
2181 ulAttribute);
2182 return SEC_E_UNSUPPORTED_FUNCTION;
2183 }
2184#else
2185 return SEC_E_UNSUPPORTED_FUNCTION;
2186#endif
2187}
2188
2189WINPR_ATTR_NODISCARD
2190static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(
2191 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2192{
2193 if (!phContext)
2194 return SEC_E_INVALID_HANDLE;
2195
2196 if (!pBuffer)
2197 return SEC_E_INVALID_PARAMETER;
2198
2199#ifdef WITH_KRB5
2200 KRB_CONTEXT* context = get_context(phContext);
2201 if (!context)
2202 return SEC_E_INVALID_PARAMETER;
2203
2204 KRB_CREDENTIALS* credentials = context->credentials;
2205
2206 switch (ulAttribute)
2207 {
2208 case SECPKG_ATTR_PACKAGE_INFO:
2209 return kerberos_ATTR_PACKAGE_INFO_A(context, credentials,
2210 (SecPkgContext_PackageInfoA*)pBuffer);
2211 default:
2212 break;
2213 }
2214#endif
2215 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2216}
2217
2218WINPR_ATTR_NODISCARD
2219static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(PCtxtHandle phContext,
2220 ULONG ulAttribute, void* pBuffer)
2221{
2222 if (!phContext)
2223 return SEC_E_INVALID_HANDLE;
2224
2225 if (!pBuffer)
2226 return SEC_E_INVALID_PARAMETER;
2227
2228#ifdef WITH_KRB5
2229 KRB_CONTEXT* context = get_context(phContext);
2230 if (!context)
2231 return SEC_E_INVALID_PARAMETER;
2232
2233 KRB_CREDENTIALS* credentials = context->credentials;
2234
2235 switch (ulAttribute)
2236 {
2237 case SECPKG_ATTR_PACKAGE_INFO:
2238 return kerberos_ATTR_PACKAGE_INFO_W(context, credentials,
2239 (SecPkgContext_PackageInfoW*)pBuffer);
2240 default:
2241 break;
2242 }
2243#endif
2244 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2245}
2246
2247WINPR_ATTR_NODISCARD
2248static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
2249 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2250 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2251{
2252 return SEC_E_UNSUPPORTED_FUNCTION;
2253}
2254
2255WINPR_ATTR_NODISCARD
2256static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
2257 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2258 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2259{
2260 return SEC_E_UNSUPPORTED_FUNCTION;
2261}
2262
2263WINPR_ATTR_NODISCARD
2264static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(
2265 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
2266 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer,
2267 WINPR_ATTR_UNUSED BOOL unicode)
2268{
2269#ifdef WITH_KRB5
2270 KRB_CREDENTIALS* credentials = nullptr;
2271
2272 if (!phCredential)
2273 return SEC_E_INVALID_HANDLE;
2274
2275 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
2276
2277 if (!credentials)
2278 return SEC_E_INVALID_HANDLE;
2279
2280 if (!pBuffer)
2281 return SEC_E_INSUFFICIENT_MEMORY;
2282
2283 switch (ulAttribute)
2284 {
2285 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
2286 {
2287 SecPkgCredentials_KdcProxySettingsW* kdc_settings = pBuffer;
2288
2289 /* Sanity checks */
2290 if (cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2291 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
2292 kdc_settings->ProxyServerOffset < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2293 cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) +
2294 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
2295 return SEC_E_INVALID_TOKEN;
2296
2297 if (credentials->kdc_url)
2298 {
2299 free(credentials->kdc_url);
2300 credentials->kdc_url = nullptr;
2301 }
2302
2303 if (kdc_settings->ProxyServerLength > 0)
2304 {
2305 WCHAR* proxy = WINPR_PACKED_ALIGN_CAST(
2306 WCHAR*, ((BYTE*)pBuffer + kdc_settings->ProxyServerOffset));
2307
2308 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
2309 proxy, kdc_settings->ProxyServerLength / sizeof(WCHAR), nullptr);
2310 if (!credentials->kdc_url)
2311 return SEC_E_INSUFFICIENT_MEMORY;
2312 }
2313
2314 return SEC_E_OK;
2315 }
2316 case SECPKG_CRED_ATTR_NAMES:
2317 case SECPKG_ATTR_SUPPORTED_ALGS:
2318 default:
2319 WLog_ERR(TAG, "TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
2320 ulAttribute);
2321 return SEC_E_UNSUPPORTED_FUNCTION;
2322 }
2323
2324#else
2325 return SEC_E_UNSUPPORTED_FUNCTION;
2326#endif
2327}
2328
2329WINPR_ATTR_NODISCARD
2330static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(PCredHandle phCredential,
2331 ULONG ulAttribute,
2332 void* pBuffer, ULONG cbBuffer)
2333{
2334 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
2335}
2336
2337WINPR_ATTR_NODISCARD
2338static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(PCredHandle phCredential,
2339 ULONG ulAttribute,
2340 void* pBuffer, ULONG cbBuffer)
2341{
2342 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
2343}
2344
2345WINPR_ATTR_NODISCARD
2346static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2347 WINPR_ATTR_UNUSED ULONG fQOP,
2348 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2349 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2350{
2351#ifdef WITH_KRB5
2352 KRB_CONTEXT* context = get_context(phContext);
2353 PSecBuffer sig_buffer = nullptr;
2354 PSecBuffer data_buffer = nullptr;
2355 char* header = nullptr;
2356 BYTE flags = 0;
2357 krb5glue_key key = nullptr;
2358 krb5_keyusage usage = 0;
2359 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2360 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2361 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2362 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2363 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2364
2365 if (!context)
2366 return SEC_E_INVALID_HANDLE;
2367
2368 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2369 return SEC_E_UNSUPPORTED_FUNCTION;
2370
2371 KRB_CREDENTIALS* creds = context->credentials;
2372
2373 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2374 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2375
2376 if (!sig_buffer || !data_buffer)
2377 return SEC_E_INVALID_TOKEN;
2378
2379 if (fQOP)
2380 return SEC_E_QOP_NOT_SUPPORTED;
2381
2382 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2383 flags |= FLAG_WRAP_CONFIDENTIAL;
2384
2385 key = get_key(&context->keyset);
2386 if (!key)
2387 return SEC_E_INTERNAL_ERROR;
2388
2389 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2390
2391 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
2392
2393 /* Set the lengths of the data (plaintext + header) */
2394 encrypt_iov[1].data.length = data_buffer->cbBuffer;
2395 encrypt_iov[2].data.length = 16;
2396
2397 /* Get the lengths of the header, trailer, and padding and ensure sig_buffer is large enough */
2398 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
2399 ARRAYSIZE(encrypt_iov)))
2400 return SEC_E_INTERNAL_ERROR;
2401 if (sig_buffer->cbBuffer <
2402 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
2403 return SEC_E_INSUFFICIENT_MEMORY;
2404
2405 /* Set up the iov array in sig_buffer */
2406 header = sig_buffer->pvBuffer;
2407 encrypt_iov[2].data.data = header + 16;
2408 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
2409 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
2410 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
2411 encrypt_iov[1].data.data = data_buffer->pvBuffer;
2412
2413 /* Write the GSS header with 0 in RRC */
2414 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
2415 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2416 header[3] = (char)0xFF;
2417 winpr_Data_Write_UINT32(header + 4, 0);
2418 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2419
2420 /* Copy header to be encrypted */
2421 CopyMemory(encrypt_iov[2].data.data, header, 16);
2422
2423 /* Set the correct RRC */
2424 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
2425 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
2426
2427 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
2428 ARRAYSIZE(encrypt_iov)))
2429 return SEC_E_INTERNAL_ERROR;
2430
2431 return SEC_E_OK;
2432#else
2433 return SEC_E_UNSUPPORTED_FUNCTION;
2434#endif
2435}
2436
2437WINPR_ATTR_NODISCARD
2438static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2439 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2440 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2441 WINPR_ATTR_UNUSED ULONG* pfQOP)
2442{
2443#ifdef WITH_KRB5
2444 KRB_CONTEXT* context = get_context(phContext);
2445 if (!context)
2446 return SEC_E_INVALID_HANDLE;
2447
2448 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2449 return SEC_E_UNSUPPORTED_FUNCTION;
2450
2451 KRB_CREDENTIALS* creds = context->credentials;
2452
2453 const PSecBuffer sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2454 PSecBuffer data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2455
2456 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2457 return SEC_E_INVALID_TOKEN;
2458
2459 /* Read in header information */
2460 const BYTE* header = sig_buffer->pvBuffer;
2461 const uint16_t tok_id = winpr_Data_Get_UINT16_BE(header);
2462 const BYTE flags = header[2];
2463 const uint16_t ec = winpr_Data_Get_UINT16_BE(&header[4]);
2464 const uint16_t rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2465 const uint64_t seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2466
2467 /* Check that the header is valid */
2468 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2469 return SEC_E_INVALID_TOKEN;
2470
2471 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2472 return SEC_E_INVALID_TOKEN;
2473
2474 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2475 (seq_no != context->remote_seq + MessageSeqNo))
2476 return SEC_E_OUT_OF_SEQUENCE;
2477
2478 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2479 return SEC_E_INVALID_TOKEN;
2480
2481 /* We don't expect a trailer buffer; the encrypted header must be rotated */
2482 if (rrc < 16)
2483 return SEC_E_INVALID_TOKEN;
2484
2485 /* Find the proper key and key usage */
2486 krb5glue_key key = get_key(&context->keyset);
2487 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2488 return SEC_E_INTERNAL_ERROR;
2489 krb5_keyusage usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2490
2491 /* Fill in the lengths of the iov array */
2492 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2493 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2494 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2495 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2496 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2497 iov[1].data.length = data_buffer->cbBuffer;
2498 iov[2].data.length = 16;
2499 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2500 return SEC_E_INTERNAL_ERROR;
2501
2502 /* We don't expect a trailer buffer; everything must be in sig_buffer */
2503 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2504 return SEC_E_INVALID_TOKEN;
2505 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2506 return SEC_E_INVALID_TOKEN;
2507
2508 /* Locate the parts of the message */
2509 const size_t iov0Offset = 16ull + rrc + ec;
2510 if (iov0Offset + iov[0].data.length > sig_buffer->cbBuffer)
2511 return SEC_E_INVALID_TOKEN;
2512
2513 const size_t iov2Offset = 16ull + ec;
2514 if (iov2Offset + iov[2].data.length > sig_buffer->cbBuffer)
2515 return SEC_E_INVALID_TOKEN;
2516
2517 iov[0].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov0Offset], char*);
2518 iov[1].data.data = data_buffer->pvBuffer;
2519 iov[2].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov2Offset], char*);
2520 char* data2 = iov[2].data.data;
2521 iov[3].data.data = &data2[iov[2].data.length];
2522
2523 char* data3 = iov[3].data.data;
2524 iov[4].data.data = &data3[iov[3].data.length];
2525
2526 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2527 return SEC_E_INTERNAL_ERROR;
2528
2529 /* Validate the encrypted header */
2530 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2531 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2532 if (memcmp(iov[2].data.data, header, 16) != 0)
2533 return SEC_E_MESSAGE_ALTERED;
2534
2535 *pfQOP = 0;
2536
2537 return SEC_E_OK;
2538#else
2539 return SEC_E_UNSUPPORTED_FUNCTION;
2540#endif
2541}
2542
2543WINPR_ATTR_NODISCARD
2544static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2545 WINPR_ATTR_UNUSED ULONG fQOP,
2546 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2547 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2548{
2549#ifdef WITH_KRB5
2550 KRB_CONTEXT* context = get_context(phContext);
2551 PSecBuffer sig_buffer = nullptr;
2552 PSecBuffer data_buffer = nullptr;
2553 krb5glue_key key = nullptr;
2554 krb5_keyusage usage = 0;
2555 BYTE flags = 0;
2556 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2557 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2558 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2559
2560 if (!context)
2561 return SEC_E_INVALID_HANDLE;
2562
2563 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2564 return SEC_E_UNSUPPORTED_FUNCTION;
2565
2566 KRB_CREDENTIALS* creds = context->credentials;
2567
2568 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2569 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2570
2571 if (!sig_buffer || !data_buffer)
2572 return SEC_E_INVALID_TOKEN;
2573
2574 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2575
2576 key = get_key(&context->keyset);
2577 if (!key)
2578 return SEC_E_INTERNAL_ERROR;
2579 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2580
2581 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2582
2583 /* Fill in the lengths of the iov array */
2584 iov[0].data.length = data_buffer->cbBuffer;
2585 iov[1].data.length = 16;
2586 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2587 return SEC_E_INTERNAL_ERROR;
2588
2589 /* Ensure the buffer is big enough */
2590 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2591 return SEC_E_INSUFFICIENT_MEMORY;
2592
2593 /* Write the header */
2594 char* header = sig_buffer->pvBuffer;
2595 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2596 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2597 memset(header + 3, 0xFF, 5);
2598 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2599
2600 /* Set up the iov array */
2601 iov[0].data.data = data_buffer->pvBuffer;
2602 iov[1].data.data = header;
2603 iov[2].data.data = header + 16;
2604
2605 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2606 return SEC_E_INTERNAL_ERROR;
2607
2608 sig_buffer->cbBuffer = iov[2].data.length + 16;
2609
2610 return SEC_E_OK;
2611#else
2612 return SEC_E_UNSUPPORTED_FUNCTION;
2613#endif
2614}
2615
2616WINPR_ATTR_NODISCARD
2617static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2618 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2619 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2620 WINPR_ATTR_UNUSED ULONG* pfQOP)
2621{
2622#ifdef WITH_KRB5
2623 PSecBuffer sig_buffer = nullptr;
2624 PSecBuffer data_buffer = nullptr;
2625 krb5glue_key key = nullptr;
2626 krb5_keyusage usage = 0;
2627 BYTE flags = 0;
2628 uint16_t tok_id = 0;
2629 uint64_t seq_no = 0;
2630 krb5_boolean is_valid = 0;
2631 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2632 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2633 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2634 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2635
2636 KRB_CONTEXT* context = get_context(phContext);
2637 if (!context)
2638 return SEC_E_INVALID_HANDLE;
2639
2640 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2641 return SEC_E_UNSUPPORTED_FUNCTION;
2642
2643 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2644 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2645
2646 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2647 return SEC_E_INVALID_TOKEN;
2648
2649 /* Read in header info */
2650 BYTE* header = sig_buffer->pvBuffer;
2651 tok_id = winpr_Data_Get_UINT16_BE(header);
2652 flags = header[2];
2653 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2654
2655 /* Validate header */
2656 if (tok_id != TOK_ID_MIC)
2657 return SEC_E_INVALID_TOKEN;
2658
2659 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2660 return SEC_E_INVALID_TOKEN;
2661
2662 if (memcmp(header + 3, cmp_filler, sizeof(cmp_filler)) != 0)
2663 return SEC_E_INVALID_TOKEN;
2664
2665 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2666 return SEC_E_OUT_OF_SEQUENCE;
2667
2668 /* Find the proper key and usage */
2669 key = get_key(&context->keyset);
2670 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2671 return SEC_E_INTERNAL_ERROR;
2672 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2673
2674 /* Fill in the iov array lengths */
2675 KRB_CREDENTIALS* creds = context->credentials;
2676 iov[0].data.length = data_buffer->cbBuffer;
2677 iov[1].data.length = 16;
2678 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2679 return SEC_E_INTERNAL_ERROR;
2680
2681 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2682 return SEC_E_INTERNAL_ERROR;
2683
2684 /* Set up the iov array */
2685 iov[0].data.data = data_buffer->pvBuffer;
2686 iov[1].data.data = (char*)header;
2687 iov[2].data.data = (char*)&header[16];
2688
2689 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2690 &is_valid))
2691 return SEC_E_INTERNAL_ERROR;
2692
2693 if (!is_valid)
2694 return SEC_E_MESSAGE_ALTERED;
2695
2696 return SEC_E_OK;
2697#else
2698 return SEC_E_UNSUPPORTED_FUNCTION;
2699#endif
2700}
2701
2702const SecurityFunctionTableA KERBEROS_SecurityFunctionTableA = {
2703 3, /* dwVersion */
2704 nullptr, /* EnumerateSecurityPackages */
2705 kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
2706 kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
2707 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2708 nullptr, /* Reserved2 */
2709 kerberos_InitializeSecurityContextA, /* InitializeSecurityContext */
2710 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2711 nullptr, /* CompleteAuthToken */
2712 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2713 nullptr, /* ApplyControlToken */
2714 kerberos_QueryContextAttributesA, /* QueryContextAttributes */
2715 nullptr, /* ImpersonateSecurityContext */
2716 nullptr, /* RevertSecurityContext */
2717 kerberos_MakeSignature, /* MakeSignature */
2718 kerberos_VerifySignature, /* VerifySignature */
2719 nullptr, /* FreeContextBuffer */
2720 nullptr, /* QuerySecurityPackageInfo */
2721 nullptr, /* Reserved3 */
2722 nullptr, /* Reserved4 */
2723 nullptr, /* ExportSecurityContext */
2724 nullptr, /* ImportSecurityContext */
2725 nullptr, /* AddCredentials */
2726 nullptr, /* Reserved8 */
2727 nullptr, /* QuerySecurityContextToken */
2728 kerberos_EncryptMessage, /* EncryptMessage */
2729 kerberos_DecryptMessage, /* DecryptMessage */
2730 kerberos_SetContextAttributesA, /* SetContextAttributes */
2731 kerberos_SetCredentialsAttributesA, /* SetCredentialsAttributes */
2732};
2733
2734const SecurityFunctionTableW KERBEROS_SecurityFunctionTableW = {
2735 3, /* dwVersion */
2736 nullptr, /* EnumerateSecurityPackages */
2737 kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
2738 kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
2739 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2740 nullptr, /* Reserved2 */
2741 kerberos_InitializeSecurityContextW, /* InitializeSecurityContext */
2742 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2743 nullptr, /* CompleteAuthToken */
2744 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2745 nullptr, /* ApplyControlToken */
2746 kerberos_QueryContextAttributesW, /* QueryContextAttributes */
2747 nullptr, /* ImpersonateSecurityContext */
2748 nullptr, /* RevertSecurityContext */
2749 kerberos_MakeSignature, /* MakeSignature */
2750 kerberos_VerifySignature, /* VerifySignature */
2751 nullptr, /* FreeContextBuffer */
2752 nullptr, /* QuerySecurityPackageInfo */
2753 nullptr, /* Reserved3 */
2754 nullptr, /* Reserved4 */
2755 nullptr, /* ExportSecurityContext */
2756 nullptr, /* ImportSecurityContext */
2757 nullptr, /* AddCredentials */
2758 nullptr, /* Reserved8 */
2759 nullptr, /* QuerySecurityContextToken */
2760 kerberos_EncryptMessage, /* EncryptMessage */
2761 kerberos_DecryptMessage, /* DecryptMessage */
2762 kerberos_SetContextAttributesW, /* SetContextAttributes */
2763 kerberos_SetCredentialsAttributesW, /* SetCredentialsAttributes */
2764};
2765
2766BOOL KERBEROS_init(void)
2767{
2768 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2769 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2770 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2771 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));
2772 return TRUE;
2773}
KERB_TICKET_LOGON
Definition secapi.h:51
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349
SEC_WINNT_AUTH_IDENTITY_WINPR
Definition include/winpr/sspi.h:944
SEC_WINPR_KERBEROS_SETTINGS
Definition include/winpr/sspi.h:927
SecPkgContext_AuthIdentity
Definition include/winpr/sspi.h:1511
SecPkgContext_PackageInfoA
Definition include/winpr/sspi.h:416
SecPkgContext_PackageInfoW
Definition include/winpr/sspi.h:421
SecPkgContext_Sizes
Definition include/winpr/sspi.h:450
SecPkgCredentials_KdcProxySettingsW
Definition include/winpr/sspi.h:548
WinPrAsn1_MemoryChunk
Definition asn1.h:92
krb5glue_keyset
Definition krb5glue.h:92
sspi_gss_data
Definition sspi_gss.h:36
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:816