FreeRDP
Loading...
Searching...
No Matches
kerberos.c
1
22#include <winpr/config.h>
23#include <winpr/library.h>
24
25#include <stdio.h>
26#include <stdlib.h>
27#include <string.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <ctype.h>
31
32#include <winpr/assert.h>
33#include <winpr/cast.h>
34#include <winpr/asn1.h>
35#include <winpr/crt.h>
36#include <winpr/interlocked.h>
37#include <winpr/sspi.h>
38#include <winpr/print.h>
39#include <winpr/tchar.h>
40#include <winpr/sysinfo.h>
41#include <winpr/registry.h>
42#include <winpr/endian.h>
43#include <winpr/crypto.h>
44#include <winpr/path.h>
45#include <winpr/wtypes.h>
46#include <winpr/winsock.h>
47#include <winpr/schannel.h>
48#include <winpr/secapi.h>
49
50#include "kerberos.h"
51
52#ifdef WITH_KRB5_MIT
53#include "krb5glue.h"
54#include <profile.h>
55#endif
56
57#ifdef WITH_KRB5_HEIMDAL
58#include "krb5glue.h"
59#include <krb5-protos.h>
60#endif
61
62#include "../sspi.h"
63#include "../../log.h"
64
65const SecPkgInfoA KERBEROS_SecPkgInfoA = {
66 0x000F3BBF, /* fCapabilities */
67 1, /* wVersion */
68 0x0010, /* wRPCID */
69 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
70 "Kerberos", /* Name */
71 "Kerberos Security Package" /* Comment */
72};
73
74static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = WINPR_C_ARRAY_INIT;
75static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = WINPR_C_ARRAY_INIT;
76
77const SecPkgInfoW KERBEROS_SecPkgInfoW = {
78 0x000F3BBF, /* fCapabilities */
79 1, /* wVersion */
80 0x0010, /* wRPCID */
81 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
82 KERBEROS_SecPkgInfoW_NameBuffer, /* Name */
83 KERBEROS_SecPkgInfoW_CommentBuffer /* Comment */
84};
85
86#ifdef WITH_KRB5
87#define TAG WINPR_TAG("sspi.Kerberos")
88
89#define KRB_TGT_REQ 16
90#define KRB_TGT_REP 17
91
92enum KERBEROS_STATE
93{
94 KERBEROS_STATE_INITIAL,
95 KERBEROS_STATE_TGT_REQ,
96 KERBEROS_STATE_TGT_REP,
97 KERBEROS_STATE_AP_REQ,
98 KERBEROS_STATE_AP_REP,
99 KERBEROS_STATE_FINAL
100};
101
102typedef struct KRB_CREDENTIALS_st
103{
104 volatile LONG refCount;
105 krb5_context ctx;
106 char* kdc_url;
107 krb5_ccache ccache;
108 krb5_keytab keytab;
109 krb5_keytab client_keytab;
110 BOOL own_ccache;
111} KRB_CREDENTIALS;
112
113struct s_KRB_CONTEXT
114{
115 enum KERBEROS_STATE state;
116 KRB_CREDENTIALS* credentials;
117 krb5_auth_context auth_ctx;
118 BOOL acceptor;
119 uint32_t flags;
120 uint64_t local_seq;
121 uint64_t remote_seq;
122 struct krb5glue_keyset keyset;
123 BOOL u2u;
124 char* targetHost;
125};
126
127static const WinPrAsn1_OID kerberos_OID = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
128static const WinPrAsn1_OID kerberos_u2u_OID = { 10,
129 (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
130
131WINPR_ATTR_NODISCARD
132krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code, const char* what,
133 const char* file, const char* fkt, size_t line)
134{
135 switch (code)
136 {
137 case 0:
138 case KRB5_KT_END:
139 break;
140 default:
141 {
142 const DWORD level = WLOG_ERROR;
143
144 wLog* log = WLog_Get(TAG);
145 if (WLog_IsLevelActive(log, level))
146 {
147 const char* msg = krb5_get_error_message(ctx, code);
148 WLog_PrintTextMessage(log, level, line, file, fkt, "%s (%s [%d])", what, msg, code);
149 krb5_free_error_message(ctx, msg);
150 }
151 }
152 break;
153 }
154 return code;
155}
156
157void krb_log_context_encryption(krb5_context ctx, krb5_principal princ)
158{
159#if !defined(WITH_KRB5_HEIMDAL)
160 typedef krb5_error_code KRB5_CALLCONV (*krb5_get_etype_info_fn)(
161 krb5_context context, krb5_principal principal, krb5_get_init_creds_opt* opt,
162 krb5_enctype* enctype_out, krb5_data* salt_out, krb5_data* s2kparams_out);
163
164 krb5_get_etype_info_fn fn =
165 GetProcAddressAs(nullptr, "krb5_get_etype_info", krb5_get_etype_info_fn);
166
167 if (fn)
168 {
169 krb5_get_init_creds_opt opt = WINPR_C_ARRAY_INIT;
170 krb5_enctype enctype = 0;
171 krb5_data salt = WINPR_C_ARRAY_INIT;
172 krb5_data s2kparam = WINPR_C_ARRAY_INIT;
173 char buffer[128] = WINPR_C_ARRAY_INIT;
174 krb5_error_code rv = krb_log_exec(fn, ctx, princ, &opt, &enctype, &salt, &s2kparam);
175 krb5_enctype_to_string(enctype, buffer, sizeof(buffer));
176 const char* msg = krb5_get_error_message(ctx, rv);
177
178 char* saltdata = winpr_BinToHexString(salt.data, salt.length, TRUE);
179 WLog_DBG(TAG, "[%s] enctype=%s, salt[%u]=%s, s2kparam[%u]=%s", msg, buffer, salt.length,
180 saltdata, s2kparam.length, s2kparam.data);
181
182 krb5_free_data_contents(ctx, &salt);
183 krb5_free_data_contents(ctx, &s2kparam);
184 krb5_free_error_message(ctx, msg);
185 free(saltdata);
186 }
187 else
188#endif
189 {
190 WLog_WARN(TAG,
191 "kerberos implementation does not support 'krb5_get_etype_info', not displaying "
192 "encryption information");
193 }
194}
195
196static void credentials_unref(KRB_CREDENTIALS* credentials);
197
198static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
199{
200 if (!ctx)
201 return;
202
203 free(ctx->targetHost);
204 ctx->targetHost = nullptr;
205
206 if (ctx->credentials)
207 {
208 krb5_context krbctx = ctx->credentials->ctx;
209 if (krbctx)
210 {
211 if (ctx->auth_ctx)
212 krb5_auth_con_free(krbctx, ctx->auth_ctx);
213
214 krb5glue_keys_free(krbctx, &ctx->keyset);
215 }
216
217 credentials_unref(ctx->credentials);
218 }
219
220 if (allocated)
221 free(ctx);
222}
223
224WINPR_ATTR_MALLOC(kerberos_ContextFree, 1)
225static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
226{
227 KRB_CONTEXT* context = nullptr;
228
229 context = (KRB_CONTEXT*)calloc(1, sizeof(KRB_CONTEXT));
230 if (!context)
231 return nullptr;
232
233 context->credentials = credentials;
234 InterlockedIncrement(&credentials->refCount);
235 return context;
236}
237
238WINPR_ATTR_NODISCARD
239static krb5_error_code krb5_prompter(krb5_context context, void* data,
240 WINPR_ATTR_UNUSED const char* name,
241 WINPR_ATTR_UNUSED const char* banner, int num_prompts,
242 krb5_prompt prompts[])
243{
244 for (int i = 0; i < num_prompts; i++)
245 {
246 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
247 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
248 {
249 prompts[i].reply->data = _strdup((const char*)data);
250
251 const size_t len = strlen((const char*)data);
252 if (len > UINT32_MAX)
253 return KRB5KRB_ERR_GENERIC;
254 prompts[i].reply->length = (UINT32)len;
255 }
256 }
257 return 0;
258}
259
260WINPR_ATTR_NODISCARD
261static inline krb5glue_key get_key(struct krb5glue_keyset* keyset)
262{
263 return keyset->acceptor_key ? keyset->acceptor_key
264 : keyset->initiator_key ? keyset->initiator_key
265 : keyset->session_key;
266}
267
268WINPR_ATTR_NODISCARD
269static BOOL isValidIPv4(const char* ipAddress)
270{
271 struct sockaddr_in sa = WINPR_C_ARRAY_INIT;
272 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
273 return result != 0;
274}
275
276WINPR_ATTR_NODISCARD
277static BOOL isValidIPv6(const char* ipAddress)
278{
279 struct sockaddr_in6 sa = WINPR_C_ARRAY_INIT;
280 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
281 return result != 0;
282}
283
284WINPR_ATTR_NODISCARD
285static BOOL isValidIP(const char* ipAddress)
286{
287 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
288}
289
290#if defined(WITH_KRB5_MIT)
291WINPR_ATTR_MALLOC(free, 1)
292static char* get_realm_name(krb5_data realm, size_t* plen)
293{
294 WINPR_ASSERT(plen);
295 *plen = 0;
296 if ((realm.length <= 0) || (!realm.data))
297 return nullptr;
298
299 char* name = nullptr;
300 (void)winpr_asprintf(&name, plen, "krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
301 realm.data);
302 return name;
303}
304#elif defined(WITH_KRB5_HEIMDAL)
305WINPR_ATTR_MALLOC(free, 1)
306static char* get_realm_name(Realm realm, size_t* plen)
307{
308 WINPR_ASSERT(plen);
309 *plen = 0;
310 if (!realm)
311 return nullptr;
312
313 char* name = nullptr;
314 (void)winpr_asprintf(&name, plen, "krbtgt/%s@%s", realm, realm);
315 return name;
316}
317#endif
318
319WINPR_ATTR_NODISCARD
320static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
321{
322 /* "krbtgt/" + realm + "@" + realm */
323 size_t len = 0;
324 krb5_error_code rv = KRB5_CC_NOMEM;
325
326 char* name = get_realm_name(principal->realm, &len);
327 if (!name || (len == 0))
328 goto fail;
329
330 {
331 krb5_principal target = WINPR_C_ARRAY_INIT;
332 rv = krb5_parse_name(ctx, name, &target);
333 *ptarget = target;
334 }
335fail:
336 free(name);
337 return rv;
338}
339
340#endif /* WITH_KRB5 */
341
342WINPR_ATTR_NODISCARD
343static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
344 WINPR_ATTR_UNUSED SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage,
345 WINPR_ATTR_UNUSED ULONG fCredentialUse, WINPR_ATTR_UNUSED void* pvLogonID,
346 WINPR_ATTR_UNUSED void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
347 WINPR_ATTR_UNUSED void* pvGetKeyArgument, WINPR_ATTR_UNUSED PCredHandle phCredential,
348 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
349{
350#ifdef WITH_KRB5
351#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
352 SEC_WINPR_KERBEROS_SETTINGS_V2 krb_settings_v1_buffer = WINPR_C_ARRAY_INIT;
353#endif
354
355 SEC_WINPR_KERBEROS_SETTINGS_V2* krb_settings = nullptr;
356 KRB_CREDENTIALS* credentials = nullptr;
357 krb5_context ctx = nullptr;
358 krb5_ccache ccache = nullptr;
359 krb5_keytab keytab = nullptr;
360 krb5_principal principal = nullptr;
361 char* domain = nullptr;
362 char* username = nullptr;
363 char* password = nullptr;
364 BOOL own_ccache = FALSE;
365 const char* const default_ccache_type = "MEMORY";
366
367 if (pAuthData)
368 {
369 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
370
371#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
372 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
373 {
374 SEC_WINPR_KERBEROS_SETTINGS* krb_settingsV1 =
375 (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->kerberosSettings);
376 if (krb_settingsV1)
377 {
378 krb_settings_v1_buffer.kdcUrl = krb_settingsV1->kdcUrl;
379 krb_settings_v1_buffer.keytab = krb_settingsV1->keytab;
380 krb_settings_v1_buffer.cache = krb_settingsV1->cache;
381 krb_settings_v1_buffer.armorCache = krb_settingsV1->armorCache;
382 krb_settings_v1_buffer.pkinitX509Anchors = krb_settingsV1->pkinitX509Anchors;
383 krb_settings_v1_buffer.pkinitX509Identity = krb_settingsV1->pkinitX509Identity;
384 krb_settings_v1_buffer.withPac = krb_settingsV1->withPac;
385 krb_settings_v1_buffer.startTime = krb_settingsV1->startTime;
386 krb_settings_v1_buffer.renewLifeTime = krb_settingsV1->renewLifeTime;
387 krb_settings_v1_buffer.lifeTime = krb_settingsV1->lifeTime;
388 memcpy(krb_settings_v1_buffer.certSha1, krb_settingsV1->certSha1,
389 sizeof(krb_settings_v1_buffer.certSha1));
390 krb_settings = &krb_settings_v1_buffer;
391 }
392 }
393#endif
394 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED_v2)
395 {
396 const SEC_WINNT_AUTH_IDENTITY_WINPR_V2* auth =
397 (const SEC_WINNT_AUTH_IDENTITY_WINPR_V2*)pAuthData;
398 WINPR_ASSERT(auth);
399 if (auth->version < SEC_WINNT_AUTH_IDENTITY_WINPR_V2_REVISION_1)
400 goto cleanup;
401 krb_settings = auth->kerberosSettingsV2;
402 }
403
404 if (!sspi_CopyAuthIdentityFieldsA((const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData, &username,
405 &domain, &password))
406 {
407 WLog_ERR(TAG, "Failed to copy auth identity fields");
408 goto cleanup;
409 }
410
411 if (!pszPrincipal)
412 pszPrincipal = username;
413 }
414
415 if (krb_log_exec_ptr(krb5_init_context, &ctx))
416 goto cleanup;
417
418 if (domain)
419 {
420 char* udomain = _strdup(domain);
421 if (!udomain)
422 goto cleanup;
423
424 CharUpperA(udomain);
425 /* Will use domain if realm is not specified in username */
426 krb5_error_code rv = krb_log_exec(krb5_set_default_realm, ctx, udomain);
427 free(udomain);
428
429 if (rv)
430 goto cleanup;
431 }
432
433 if (pszPrincipal)
434 {
435 char* cpszPrincipal = _strdup(pszPrincipal);
436 if (!cpszPrincipal)
437 goto cleanup;
438
439 /* Find realm component if included and convert to uppercase */
440 char* p = strchr(cpszPrincipal, '@');
441 if (p)
442 CharUpperA(p);
443
444 krb5_error_code rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, &principal);
445 free(cpszPrincipal);
446
447 if (rv)
448 goto cleanup;
449 WINPR_ASSERT(principal);
450 }
451
452 if (krb_settings && krb_settings->cache)
453 {
454 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
455 goto cleanup;
456 }
457 else
458 own_ccache = TRUE;
459
460 if (principal)
461 {
462 /* Use the default cache if it's initialized with the right principal */
463 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
464 {
465 if (own_ccache)
466 {
467 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
468 goto cleanup;
469 }
470 else
471 {
472 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
473 goto cleanup;
474 }
475
476 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
477 goto cleanup;
478 }
479 else
480 {
481 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
482 goto cleanup;
483 own_ccache = FALSE;
484 }
485 WINPR_ASSERT(ccache);
486 }
487 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
488 {
489 /* Use the default cache with it's default principal */
490 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
491 goto cleanup;
492 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
493 goto cleanup;
494 WINPR_ASSERT(ccache);
495 own_ccache = FALSE;
496 }
497 else
498 {
499 if (own_ccache)
500 {
501 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
502 goto cleanup;
503 }
504 else
505 {
506 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
507 goto cleanup;
508 }
509 WINPR_ASSERT(ccache);
510 }
511
512 if (krb_settings && krb_settings->keytab)
513 {
514 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
515 goto cleanup;
516 }
517 else
518 {
519 if (fCredentialUse & SECPKG_CRED_INBOUND)
520 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
521 goto cleanup;
522 }
523
524 /* Get initial credentials if required */
525 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
526 {
527 krb5_creds creds = WINPR_C_ARRAY_INIT;
528 krb5_creds matchCreds = WINPR_C_ARRAY_INIT;
529 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
530
531 krb5_timeofday(ctx, &matchCreds.times.endtime);
532 matchCreds.times.endtime += 60;
533 matchCreds.client = principal;
534
535 WINPR_ASSERT(principal);
536 WINPR_ASSERT(ctx);
537 WINPR_ASSERT(ccache);
538 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
539 goto cleanup;
540
541 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
542 krb5_free_principal(ctx, matchCreds.server);
543 krb5_free_cred_contents(ctx, &creds);
544 if (rv)
545 {
546 if (krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
547 password, krb_settings))
548 goto cleanup;
549 }
550 }
551
552 credentials = calloc(1, sizeof(KRB_CREDENTIALS));
553 if (!credentials)
554 goto cleanup;
555 credentials->refCount = 1;
556 credentials->ctx = ctx;
557 credentials->ccache = ccache;
558 credentials->keytab = keytab;
559 credentials->own_ccache = own_ccache;
560
561cleanup:
562
563 free(domain);
564 free(username);
565 free(password);
566
567 if (principal)
568 krb5_free_principal(ctx, principal);
569 if (ctx)
570 {
571 if (!credentials)
572 {
573 if (ccache)
574 {
575 if (own_ccache)
576 krb5_cc_destroy(ctx, ccache);
577 else
578 krb5_cc_close(ctx, ccache);
579 }
580 if (keytab)
581 krb5_kt_close(ctx, keytab);
582
583 krb5_free_context(ctx);
584 }
585 }
586
587 /* If we managed to get credentials set the output */
588 if (credentials)
589 {
590 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
591 sspi_SecureHandleSetUpperPointer(phCredential, (void*)KERBEROS_SSP_NAME);
592 return SEC_E_OK;
593 }
594
595 return SEC_E_NO_CREDENTIALS;
596#else
597 return SEC_E_UNSUPPORTED_FUNCTION;
598#endif
599}
600
601WINPR_ATTR_NODISCARD
602static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
603 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
604 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
605 PTimeStamp ptsExpiry)
606{
607 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
608 char* principal = nullptr;
609 char* package = nullptr;
610
611 if (pszPrincipal)
612 {
613 principal = ConvertWCharToUtf8Alloc(pszPrincipal, nullptr);
614 if (!principal)
615 goto fail;
616 }
617 if (pszPackage)
618 {
619 package = ConvertWCharToUtf8Alloc(pszPackage, nullptr);
620 if (!package)
621 goto fail;
622 }
623
624 status =
625 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
626 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
627
628fail:
629 free(principal);
630 free(package);
631
632 return status;
633}
634
635#ifdef WITH_KRB5
636static void credentials_unref(KRB_CREDENTIALS* credentials)
637{
638 WINPR_ASSERT(credentials);
639
640 if (InterlockedDecrement(&credentials->refCount))
641 return;
642
643 free(credentials->kdc_url);
644
645 if (credentials->ccache)
646 {
647 if (credentials->own_ccache)
648 krb5_cc_destroy(credentials->ctx, credentials->ccache);
649 else
650 krb5_cc_close(credentials->ctx, credentials->ccache);
651 }
652 if (credentials->keytab)
653 krb5_kt_close(credentials->ctx, credentials->keytab);
654
655 krb5_free_context(credentials->ctx);
656 free(credentials);
657}
658#endif
659
660WINPR_ATTR_NODISCARD
661static SECURITY_STATUS
662 SEC_ENTRY kerberos_FreeCredentialsHandle(WINPR_ATTR_UNUSED PCredHandle phCredential)
663{
664#ifdef WITH_KRB5
665 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
666 sspi_SecureHandleInvalidate(phCredential);
667 if (!credentials)
668 return SEC_E_INVALID_HANDLE;
669
670 credentials_unref(credentials);
671
672 return SEC_E_OK;
673#else
674 return SEC_E_UNSUPPORTED_FUNCTION;
675#endif
676}
677
678WINPR_ATTR_NODISCARD
679static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
680 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
681 WINPR_ATTR_UNUSED void* pBuffer)
682{
683#ifdef WITH_KRB5
684 switch (ulAttribute)
685 {
686 case SECPKG_CRED_ATTR_NAMES:
687 return SEC_E_OK;
688 default:
689 WLog_ERR(TAG, "TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
690 ulAttribute);
691 return SEC_E_UNSUPPORTED_FUNCTION;
692 }
693
694#else
695 return SEC_E_UNSUPPORTED_FUNCTION;
696#endif
697}
698
699WINPR_ATTR_NODISCARD
700static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(PCredHandle phCredential,
701 ULONG ulAttribute,
702 void* pBuffer)
703{
704 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
705}
706
707#ifdef WITH_KRB5
708WINPR_ATTR_NODISCARD
709static BOOL kerberos_mk_tgt_token(SecBuffer* buf, int msg_type, char* sname, char* host,
710 const krb5_data* ticket)
711{
712 WinPrAsn1Encoder* enc = nullptr;
713 WinPrAsn1_MemoryChunk data;
714 wStream s;
715 size_t len = 0;
716 sspi_gss_data token;
717 BOOL ret = FALSE;
718
719 WINPR_ASSERT(buf);
720
721 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
722 return FALSE;
723 if (msg_type == KRB_TGT_REP && !ticket)
724 return FALSE;
725
726 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
727 if (!enc)
728 return FALSE;
729
730 /* KERB-TGT-REQUEST (SEQUENCE) */
731 if (!WinPrAsn1EncSeqContainer(enc))
732 goto cleanup;
733
734 /* pvno [0] INTEGER */
735 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
736 goto cleanup;
737
738 /* msg-type [1] INTEGER */
739 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
740 goto cleanup;
741
742 if (msg_type == KRB_TGT_REQ && sname)
743 {
744 /* server-name [2] PrincipalName (SEQUENCE) */
745 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
746 goto cleanup;
747
748 /* name-type [0] INTEGER */
749 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
750 goto cleanup;
751
752 /* name-string [1] SEQUENCE OF GeneralString */
753 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
754 goto cleanup;
755
756 if (!WinPrAsn1EncGeneralString(enc, sname))
757 goto cleanup;
758
759 if (host && !WinPrAsn1EncGeneralString(enc, host))
760 goto cleanup;
761
762 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
763 goto cleanup;
764 }
765 else if (msg_type == KRB_TGT_REP)
766 {
767 /* ticket [2] Ticket */
768 data.data = (BYTE*)ticket->data;
769 data.len = ticket->length;
770 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
771 goto cleanup;
772 }
773
774 if (!WinPrAsn1EncEndContainer(enc))
775 goto cleanup;
776
777 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
778 goto cleanup;
779
780 Stream_StaticInit(&s, buf->pvBuffer, len);
781 if (!WinPrAsn1EncToStream(enc, &s))
782 goto cleanup;
783
784 token.data = buf->pvBuffer;
785 token.length = (UINT)len;
786 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
787 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
788 ret = TRUE;
789
790cleanup:
791 WinPrAsn1Encoder_Free(&enc);
792 return ret;
793}
794
795WINPR_ATTR_NODISCARD
796static BOOL append(char* dst, size_t dstSize, const char* src)
797{
798 const size_t dlen = strnlen(dst, dstSize);
799 const size_t slen = strlen(src);
800 if (dlen + slen >= dstSize)
801 return FALSE;
802 if (!strncat(dst, src, dstSize - dlen))
803 return FALSE;
804 return TRUE;
805}
806
807WINPR_ATTR_NODISCARD
808static BOOL kerberos_rd_tgt_req_tag2(WinPrAsn1Decoder* dec, char* buf, size_t len)
809{
810 BOOL rc = FALSE;
811 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
812
813 /* server-name [2] PrincipalName (SEQUENCE) */
814 if (!WinPrAsn1DecReadSequence(dec, &seq))
815 goto end;
816
817 /* name-type [0] INTEGER */
818 {
819 BOOL error = FALSE;
820 {
821 WinPrAsn1_INTEGER val = 0;
822 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
823 goto end;
824 }
825
826 /* name-string [1] SEQUENCE OF GeneralString */
827 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
828 goto end;
829 }
830
831 {
832 WinPrAsn1_tag tag = 0;
833 BOOL first = TRUE;
834 while (WinPrAsn1DecPeekTag(dec, &tag))
835 {
836 BOOL success = FALSE;
837 char* lstr = nullptr;
838 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
839 goto fail;
840
841 if (!first)
842 {
843 if (!append(buf, len, "/"))
844 goto fail;
845 }
846 first = FALSE;
847
848 if (!append(buf, len, lstr))
849 goto fail;
850
851 success = TRUE;
852 fail:
853 free(lstr);
854 if (!success)
855 goto end;
856 }
857 }
858
859 rc = TRUE;
860end:
861 return rc;
862}
863
864WINPR_ATTR_NODISCARD
865static BOOL kerberos_rd_tgt_req_tag3(WinPrAsn1Decoder* dec, char* buf, size_t len)
866{
867 /* realm [3] Realm */
868 BOOL rc = FALSE;
869 WinPrAsn1_STRING str = nullptr;
870 if (!WinPrAsn1DecReadGeneralString(dec, &str))
871 goto end;
872
873 if (!append(buf, len, "@"))
874 goto end;
875 if (!append(buf, len, str))
876 goto end;
877
878 rc = TRUE;
879end:
880 free(str);
881 return rc;
882}
883
884WINPR_ATTR_NODISCARD
885static BOOL kerberos_rd_tgt_req(WinPrAsn1Decoder* dec, char** target)
886{
887 BOOL rc = FALSE;
888
889 if (!target)
890 return FALSE;
891 *target = nullptr;
892
893 wStream s = WinPrAsn1DecGetStream(dec);
894 const size_t len = Stream_Length(&s);
895 if (len == 0)
896 return TRUE;
897
898 WinPrAsn1Decoder dec2 = WinPrAsn1Decoder_init();
899 WinPrAsn1_tagId tag = 0;
900 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
901 return FALSE;
902
903 char* buf = calloc(len + 1, sizeof(char));
904 if (!buf)
905 return FALSE;
906
907 /* We expect ASN1 context tag values 2 or 3.
908 *
909 * In case we got value 2 an (optional) context tag value 3 might follow.
910 */
911 BOOL checkForTag3 = TRUE;
912 if (tag == 2)
913 {
914 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
915 if (rc)
916 {
917 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
918 if (res == 0)
919 checkForTag3 = FALSE;
920 }
921 }
922
923 if (checkForTag3)
924 {
925 if (tag == 3)
926 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
927 else
928 rc = FALSE;
929 }
930
931 if (rc)
932 *target = buf;
933 else
934 free(buf);
935 return rc;
936}
937
938WINPR_ATTR_NODISCARD
939static BOOL kerberos_rd_tgt_rep(WinPrAsn1Decoder* dec, krb5_data* ticket)
940{
941 if (!ticket)
942 return FALSE;
943
944 /* ticket [2] Ticket */
945 WinPrAsn1Decoder asnTicket = WinPrAsn1Decoder_init();
946 WinPrAsn1_tagId tag = 0;
947 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
948 return FALSE;
949
950 if (tag != 2)
951 return FALSE;
952
953 wStream s = WinPrAsn1DecGetStream(&asnTicket);
954 ticket->data = Stream_BufferAs(&s, char);
955
956 const size_t len = Stream_Length(&s);
957 if (len > UINT32_MAX)
958 return FALSE;
959 ticket->length = (UINT32)len;
960 return TRUE;
961}
962
963WINPR_ATTR_NODISCARD
964static BOOL kerberos_rd_tgt_token(const sspi_gss_data* token, char** target, krb5_data* ticket)
965{
966 BOOL error = 0;
967 WinPrAsn1_INTEGER val = 0;
968
969 WINPR_ASSERT(token);
970
971 if (target)
972 *target = nullptr;
973
974 WinPrAsn1Decoder der = WinPrAsn1Decoder_init();
975 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
976
977 /* KERB-TGT-REQUEST (SEQUENCE) */
978 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
979 if (!WinPrAsn1DecReadSequence(&der, &seq))
980 return FALSE;
981
982 /* pvno [0] INTEGER */
983 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
984 return FALSE;
985
986 /* msg-type [1] INTEGER */
987 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
988 return FALSE;
989
990 switch (val)
991 {
992 case KRB_TGT_REQ:
993 return kerberos_rd_tgt_req(&seq, target);
994 case KRB_TGT_REP:
995 return kerberos_rd_tgt_rep(&seq, ticket);
996 default:
997 break;
998 }
999 return FALSE;
1000}
1001
1002WINPR_ATTR_NODISCARD
1003static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5, SEC_CHANNEL_BINDINGS* bindings)
1004{
1005 BYTE buf[4];
1006
1007 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
1008 if (!winpr_Digest_Update(md5, buf, 4))
1009 return FALSE;
1010
1011 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
1012 if (!winpr_Digest_Update(md5, buf, 4))
1013 return FALSE;
1014
1015 if (bindings->cbInitiatorLength &&
1016 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
1017 bindings->cbInitiatorLength))
1018 return FALSE;
1019
1020 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
1021 if (!winpr_Digest_Update(md5, buf, 4))
1022 return FALSE;
1023
1024 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
1025 if (!winpr_Digest_Update(md5, buf, 4))
1026 return FALSE;
1027
1028 if (bindings->cbAcceptorLength &&
1029 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
1030 bindings->cbAcceptorLength))
1031 return FALSE;
1032
1033 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
1034 if (!winpr_Digest_Update(md5, buf, 4))
1035 return FALSE;
1036
1037 if (bindings->cbApplicationDataLength &&
1038 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
1039 bindings->cbApplicationDataLength))
1040 return FALSE;
1041
1042 return TRUE;
1043}
1044
1045#endif /* WITH_KRB5 */
1046
1047WINPR_ATTR_NODISCARD
1048static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
1049 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1050 WINPR_ATTR_UNUSED SEC_CHAR* pszTargetName, WINPR_ATTR_UNUSED ULONG fContextReq,
1051 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1052 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG Reserved2,
1053 WINPR_ATTR_UNUSED PCtxtHandle phNewContext, WINPR_ATTR_UNUSED PSecBufferDesc pOutput,
1054 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
1055{
1056#ifdef WITH_KRB5
1057 PSecBuffer input_buffer = nullptr;
1058 PSecBuffer output_buffer = nullptr;
1059 PSecBuffer bindings_buffer = nullptr;
1060 WINPR_DIGEST_CTX* md5 = nullptr;
1061 char* target = nullptr;
1062 char* sname = nullptr;
1063 char* host = nullptr;
1064 krb5_data input_token = WINPR_C_ARRAY_INIT;
1065 krb5_data output_token = WINPR_C_ARRAY_INIT;
1066 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1067 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1068 uint16_t tok_id = 0;
1069 krb5_ap_rep_enc_part* reply = nullptr;
1070 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
1071 char cksum_contents[24] = WINPR_C_ARRAY_INIT;
1072 krb5_data cksum = WINPR_C_ARRAY_INIT;
1073 krb5_creds in_creds = WINPR_C_ARRAY_INIT;
1074 krb5_creds* creds = nullptr;
1075 BOOL isNewContext = FALSE;
1076 KRB_CONTEXT* context = nullptr;
1077 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1078
1079 /* behave like windows SSPIs that don't want empty context */
1080 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1081 return SEC_E_INVALID_HANDLE;
1082
1083 context = sspi_SecureHandleGetLowerPointer(phContext);
1084
1085 if (!credentials)
1086 return SEC_E_NO_CREDENTIALS;
1087
1088 if (pInput)
1089 {
1090 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1091 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
1092 }
1093 if (pOutput)
1094 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1095
1096 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
1097 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
1098
1099 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1100 ap_flags |= AP_OPTS_USE_SESSION_KEY;
1101
1102 /* Split target name into service/hostname components */
1103 if (pszTargetName)
1104 {
1105 target = _strdup(pszTargetName);
1106 if (!target)
1107 {
1108 status = SEC_E_INSUFFICIENT_MEMORY;
1109 goto cleanup;
1110 }
1111 host = strchr(target, '/');
1112 if (host)
1113 {
1114 *host++ = 0;
1115 sname = target;
1116 }
1117 else
1118 host = target;
1119 if (isValidIP(host))
1120 {
1121 status = SEC_E_NO_CREDENTIALS;
1122 goto cleanup;
1123 }
1124 }
1125
1126 if (!context)
1127 {
1128 context = kerberos_ContextNew(credentials);
1129 if (!context)
1130 {
1131 status = SEC_E_INSUFFICIENT_MEMORY;
1132 goto cleanup;
1133 }
1134
1135 isNewContext = TRUE;
1136
1137 if (host)
1138 context->targetHost = _strdup(host);
1139 if (!context->targetHost)
1140 {
1141 status = SEC_E_INSUFFICIENT_MEMORY;
1142 goto cleanup;
1143 }
1144
1145 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1146 {
1147 context->state = KERBEROS_STATE_TGT_REQ;
1148 context->u2u = TRUE;
1149 }
1150 else
1151 context->state = KERBEROS_STATE_AP_REQ;
1152 }
1153 else
1154 {
1155 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1156 goto bad_token;
1157 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1158 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1159 goto bad_token;
1160 }
1161
1162 /* SSPI flags are compatible with GSS flags except INTEG_FLAG */
1163 context->flags |= (fContextReq & 0x1F);
1164 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1165 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1166
1167 switch (context->state)
1168 {
1169 case KERBEROS_STATE_TGT_REQ:
1170
1171 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, nullptr))
1172 goto cleanup;
1173
1174 context->state = KERBEROS_STATE_TGT_REP;
1175 status = SEC_I_CONTINUE_NEEDED;
1176 break;
1177
1178 case KERBEROS_STATE_TGT_REP:
1179
1180 if (tok_id != TOK_ID_TGT_REP)
1181 goto bad_token;
1182
1183 if (!kerberos_rd_tgt_token(&input_token, nullptr, &in_creds.second_ticket))
1184 goto bad_token;
1185
1186 /* Continue to AP-REQ */
1187 /* fallthrough */
1188 WINPR_FALLTHROUGH
1189
1190 case KERBEROS_STATE_AP_REQ:
1191
1192 /* Set auth_context options */
1193 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1194 goto cleanup;
1195 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1196 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1197 goto cleanup;
1198 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1199 GSS_CHECKSUM_TYPE))
1200 goto cleanup;
1201
1202 /* Get a service ticket */
1203 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1204 KRB5_NT_SRV_HST, &in_creds.server))
1205 goto cleanup;
1206
1207 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1208 &in_creds.client))
1209 {
1210 status = SEC_E_WRONG_PRINCIPAL;
1211 goto cleanup;
1212 }
1213
1214 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1215 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1216 &creds))
1217 {
1218 status = SEC_E_NO_CREDENTIALS;
1219 goto cleanup;
1220 }
1221
1222 /* Write the checksum (delegation not implemented) */
1223 cksum.data = cksum_contents;
1224 cksum.length = sizeof(cksum_contents);
1225 winpr_Data_Write_UINT32(cksum_contents, 16);
1226 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1227
1228 if (bindings_buffer)
1229 {
1230 SEC_CHANNEL_BINDINGS* bindings = bindings_buffer->pvBuffer;
1231
1232 /* Sanity checks */
1233 if (bindings_buffer->cbBuffer < sizeof(SEC_CHANNEL_BINDINGS) ||
1234 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1235 bindings_buffer->cbBuffer ||
1236 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1237 bindings_buffer->cbBuffer ||
1238 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1239 bindings_buffer->cbBuffer)
1240 {
1241 status = SEC_E_BAD_BINDINGS;
1242 goto cleanup;
1243 }
1244
1245 md5 = winpr_Digest_New();
1246 if (!md5)
1247 goto cleanup;
1248
1249 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1250 goto cleanup;
1251
1252 if (!kerberos_hash_channel_bindings(md5, bindings))
1253 goto cleanup;
1254
1255 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1256 goto cleanup;
1257 }
1258
1259 /* Make the AP_REQ message */
1260 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1261 &cksum, creds, &output_token))
1262 goto cleanup;
1263
1264 if (!sspi_gss_wrap_token(output_buffer,
1265 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1266 TOK_ID_AP_REQ, &output_token))
1267 goto cleanup;
1268
1269 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1270 {
1271 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1272 context->auth_ctx, (INT32*)&context->local_seq))
1273 goto cleanup;
1274 context->remote_seq ^= context->local_seq;
1275 }
1276
1277 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1278 &context->keyset))
1279 goto cleanup;
1280
1281 context->state = KERBEROS_STATE_AP_REP;
1282
1283 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1284 status = SEC_I_CONTINUE_NEEDED;
1285 else
1286 status = SEC_E_OK;
1287 break;
1288
1289 case KERBEROS_STATE_AP_REP:
1290
1291 if (tok_id == TOK_ID_AP_REP)
1292 {
1293 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1294 &reply))
1295 goto cleanup;
1296 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1297 }
1298 else if (tok_id == TOK_ID_ERROR)
1299 {
1300 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1301 goto cleanup;
1302 }
1303 else
1304 goto bad_token;
1305
1306 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1307 {
1308 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1309 context->auth_ctx, (INT32*)&context->remote_seq))
1310 goto cleanup;
1311 }
1312
1313 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1314 &context->keyset))
1315 goto cleanup;
1316
1317 context->state = KERBEROS_STATE_FINAL;
1318
1319 if (output_buffer)
1320 output_buffer->cbBuffer = 0;
1321 status = SEC_E_OK;
1322 break;
1323
1324 case KERBEROS_STATE_FINAL:
1325 default:
1326 WLog_ERR(TAG, "Kerberos in invalid state!");
1327 goto cleanup;
1328 }
1329
1330cleanup:
1331{
1332 /* second_ticket is not allocated */
1333 krb5_data edata = WINPR_C_ARRAY_INIT;
1334 in_creds.second_ticket = edata;
1335 krb5_free_cred_contents(credentials->ctx, &in_creds);
1336}
1337
1338 krb5_free_creds(credentials->ctx, creds);
1339 if (output_token.data)
1340 krb5glue_free_data_contents(credentials->ctx, &output_token);
1341
1342 winpr_Digest_Free(md5);
1343
1344 free(target);
1345
1346 if (isNewContext)
1347 {
1348 switch (status)
1349 {
1350 case SEC_E_OK:
1351 case SEC_I_CONTINUE_NEEDED:
1352 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1353 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1354 break;
1355 default:
1356 kerberos_ContextFree(context, TRUE);
1357 sspi_SecureHandleInvalidate(phNewContext);
1358 break;
1359 }
1360 }
1361
1362 return status;
1363
1364bad_token:
1365 status = SEC_E_INVALID_TOKEN;
1366 goto cleanup;
1367#else
1368 return SEC_E_UNSUPPORTED_FUNCTION;
1369#endif /* WITH_KRB5 */
1370}
1371
1372WINPR_ATTR_NODISCARD
1373static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1374 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1375 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1376 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr, PTimeStamp ptsExpiry)
1377{
1378 SECURITY_STATUS status = 0;
1379 char* target_name = nullptr;
1380
1381 if (pszTargetName)
1382 {
1383 target_name = ConvertWCharToUtf8Alloc(pszTargetName, nullptr);
1384 if (!target_name)
1385 return SEC_E_INSUFFICIENT_MEMORY;
1386 }
1387
1388 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1389 Reserved1, TargetDataRep, pInput, Reserved2,
1390 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1391
1392 if (target_name)
1393 free(target_name);
1394
1395 return status;
1396}
1397
1398#ifdef WITH_KRB5
1399WINPR_ATTR_NODISCARD
1400static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1401 krb5_creds* creds)
1402{
1403 BOOL ret = FALSE;
1404 krb5_kt_cursor cur = WINPR_C_ARRAY_INIT;
1405 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1406 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1407 goto cleanup;
1408
1409 do
1410 {
1411 krb5_error_code rv =
1412 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1413 if (rv == KRB5_KT_END)
1414 break;
1415 if (rv != 0)
1416 goto cleanup;
1417
1418 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1419 break;
1420 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1421 memset(&entry, 0, sizeof(entry));
1422 if (rv)
1423 goto cleanup;
1424 } while (1);
1425
1426 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1427 goto cleanup;
1428
1429 if (!entry.principal)
1430 goto cleanup;
1431
1432 /* Get the TGT */
1433 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1434 credentials->keytab, 0, nullptr, nullptr))
1435 goto cleanup;
1436
1437 ret = TRUE;
1438
1439cleanup:
1440 return ret;
1441}
1442
1443WINPR_ATTR_NODISCARD
1444static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials, const char* target, krb5_creds* creds)
1445{
1446 BOOL ret = TRUE;
1447 krb5_principal target_princ = WINPR_C_ARRAY_INIT;
1448 char* default_realm = nullptr;
1449
1450 krb5_error_code rv =
1451 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1452 if (rv)
1453 return FALSE;
1454
1455#if defined(WITH_KRB5_HEIMDAL)
1456 if (!target_princ->realm)
1457 {
1458 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1459 if (rv)
1460 goto out;
1461
1462 target_princ->realm = default_realm;
1463 }
1464#else
1465 if (!target_princ->realm.length)
1466 {
1467 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1468 if (rv)
1469 goto out;
1470
1471 const size_t len = strnlen(default_realm, MAX_KEYTAB_NAME_LEN + 1);
1472 if ((len == 0) || !default_realm)
1473 goto out;
1474 target_princ->realm.data = strndup(default_realm, len);
1475 if (!target_princ->realm.data)
1476 goto out;
1477 target_princ->realm.length = (unsigned int)len;
1478 }
1479#endif
1480
1481 /*
1482 * First try with the account service. We were requested with something like
1483 * TERMSRV/<host>@<realm>, let's see if we have that in our keytab and if we're able
1484 * to retrieve a TGT with that entry
1485 *
1486 */
1487 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1488 goto out;
1489
1490 ret = FALSE;
1491
1492#if defined(WITH_KRB5_MIT)
1493 /*
1494 * if it's not working let's try with <host>$@<REALM> (note the dollar)
1495 */
1496 {
1497 char hostDollar[300] = WINPR_C_ARRAY_INIT;
1498 if (target_princ->length < 2)
1499 goto out;
1500
1501 (void)snprintf(hostDollar, sizeof(hostDollar) - 1, "%s$@%s", target_princ->data[1].data,
1502 target_princ->realm.data);
1503 krb5_free_principal(credentials->ctx, target_princ);
1504
1505 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1506 if (rv)
1507 return FALSE;
1508 }
1509 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1510#endif
1511
1512out:
1513 if (default_realm)
1514 krb5_free_default_realm(credentials->ctx, default_realm);
1515
1516 krb5_free_principal(credentials->ctx, target_princ);
1517 return ret;
1518}
1519#endif
1520
1521WINPR_ATTR_NODISCARD
1522static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1523 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1524 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG fContextReq,
1525 WINPR_ATTR_UNUSED ULONG TargetDataRep, WINPR_ATTR_UNUSED PCtxtHandle phNewContext,
1526 WINPR_ATTR_UNUSED PSecBufferDesc pOutput, WINPR_ATTR_UNUSED ULONG* pfContextAttr,
1527 WINPR_ATTR_UNUSED PTimeStamp ptsExpity)
1528{
1529#ifdef WITH_KRB5
1530 BOOL isNewContext = FALSE;
1531 PSecBuffer input_buffer = nullptr;
1532 PSecBuffer output_buffer = nullptr;
1533 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1534 uint16_t tok_id = 0;
1535 krb5_data input_token = WINPR_C_ARRAY_INIT;
1536 krb5_data output_token = WINPR_C_ARRAY_INIT;
1537 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1538 krb5_flags ap_flags = 0;
1539 krb5glue_authenticator authenticator = nullptr;
1540 char* target = nullptr;
1541 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1542 krb5_creds creds = WINPR_C_ARRAY_INIT;
1543
1544 /* behave like windows SSPIs that don't want empty context */
1545 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1546 return SEC_E_INVALID_HANDLE;
1547
1548 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1549 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1550
1551 if (pInput)
1552 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1553 if (pOutput)
1554 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1555
1556 if (!input_buffer)
1557 return SEC_E_INVALID_TOKEN;
1558
1559 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1560 return SEC_E_INVALID_TOKEN;
1561
1562 if (!context)
1563 {
1564 isNewContext = TRUE;
1565 context = kerberos_ContextNew(credentials);
1566 context->acceptor = TRUE;
1567
1568 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1569 {
1570 context->u2u = TRUE;
1571 context->state = KERBEROS_STATE_TGT_REQ;
1572 }
1573 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1574 context->state = KERBEROS_STATE_AP_REQ;
1575 else
1576 goto bad_token;
1577 }
1578 else
1579 {
1580 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1581 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1582 goto bad_token;
1583 }
1584
1585 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1586 {
1587 if (!kerberos_rd_tgt_token(&input_token, &target, nullptr))
1588 goto bad_token;
1589
1590 if (!retrieveSomeTgt(credentials, target, &creds))
1591 goto cleanup;
1592
1593 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, nullptr, nullptr, &creds.ticket))
1594 goto cleanup;
1595
1596 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1597 goto cleanup;
1598
1599 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1600 &krb5glue_creds_getkey(creds)))
1601 goto cleanup;
1602
1603 context->state = KERBEROS_STATE_AP_REQ;
1604 }
1605 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1606 {
1607 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, nullptr,
1608 credentials->keytab, &ap_flags, nullptr))
1609 goto cleanup;
1610
1611 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1612 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1613 goto cleanup;
1614
1615 /* Retrieve and validate the checksum */
1616 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1617 &authenticator))
1618 goto cleanup;
1619 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1620 &context->flags))
1621 goto bad_token;
1622
1623 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1624 {
1625 if (!output_buffer)
1626 goto bad_token;
1627 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1628 goto cleanup;
1629 if (!sspi_gss_wrap_token(output_buffer,
1630 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1631 TOK_ID_AP_REP, &output_token))
1632 goto cleanup;
1633 }
1634 else
1635 {
1636 if (output_buffer)
1637 output_buffer->cbBuffer = 0;
1638 }
1639
1640 *pfContextAttr = (context->flags & 0x1F);
1641 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1642 *pfContextAttr |= ASC_RET_INTEGRITY;
1643
1644 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1645 {
1646 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1647 (INT32*)&context->local_seq))
1648 goto cleanup;
1649 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1650 (INT32*)&context->remote_seq))
1651 goto cleanup;
1652 }
1653
1654 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1655 &context->keyset))
1656 goto cleanup;
1657
1658 context->state = KERBEROS_STATE_FINAL;
1659 }
1660 else
1661 goto bad_token;
1662
1663 /* On first call allocate new context */
1664 if (context->state == KERBEROS_STATE_FINAL)
1665 status = SEC_E_OK;
1666 else
1667 status = SEC_I_CONTINUE_NEEDED;
1668
1669cleanup:
1670 free(target);
1671 if (output_token.data)
1672 krb5glue_free_data_contents(credentials->ctx, &output_token);
1673 if (entry.principal)
1674 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1675
1676 if (isNewContext)
1677 {
1678 switch (status)
1679 {
1680 case SEC_E_OK:
1681 case SEC_I_CONTINUE_NEEDED:
1682 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1683 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1684 break;
1685 default:
1686 kerberos_ContextFree(context, TRUE);
1687 sspi_SecureHandleInvalidate(phNewContext);
1688 break;
1689 }
1690 }
1691
1692 return status;
1693
1694bad_token:
1695 status = SEC_E_INVALID_TOKEN;
1696 goto cleanup;
1697#else
1698 return SEC_E_UNSUPPORTED_FUNCTION;
1699#endif /* WITH_KRB5 */
1700}
1701
1702#ifdef WITH_KRB5
1703WINPR_ATTR_NODISCARD
1704static KRB_CONTEXT* get_context(PCtxtHandle phContext)
1705{
1706 if (!phContext)
1707 return nullptr;
1708
1709 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1710 if (!name)
1711 return nullptr;
1712
1713 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1714 return nullptr;
1715 return sspi_SecureHandleGetLowerPointer(phContext);
1716}
1717
1718WINPR_ATTR_NODISCARD
1719static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1720{
1721 WINPR_ASSERT(data);
1722 WINPR_ASSERT(ptr);
1723 WINPR_ASSERT(psize);
1724
1725 *ptr = (PUCHAR)malloc(data->length);
1726 if (!*ptr)
1727 return FALSE;
1728
1729 *psize = data->length;
1730 memcpy(*ptr, data->data, data->length);
1731 return TRUE;
1732}
1733#endif
1734
1735WINPR_ATTR_NODISCARD
1736static SECURITY_STATUS
1737 SEC_ENTRY kerberos_DeleteSecurityContext(WINPR_ATTR_UNUSED PCtxtHandle phContext)
1738{
1739#ifdef WITH_KRB5
1740 KRB_CONTEXT* context = get_context(phContext);
1741 sspi_SecureHandleInvalidate(phContext);
1742 if (!context)
1743 return SEC_E_INVALID_HANDLE;
1744
1745 kerberos_ContextFree(context, TRUE);
1746
1747 return SEC_E_OK;
1748#else
1749 return SEC_E_UNSUPPORTED_FUNCTION;
1750#endif
1751}
1752
1753#ifdef WITH_KRB5
1754
1755WINPR_ATTR_NODISCARD
1756static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1757{
1758 switch (code)
1759 {
1760 case 0:
1761 return SEC_E_OK;
1762 default:
1763 return SEC_E_INTERNAL_ERROR;
1764 }
1765}
1766
1767WINPR_ATTR_NODISCARD
1768static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1769 SecPkgContext_Sizes* ContextSizes)
1770{
1771 UINT header = 0;
1772 UINT pad = 0;
1773 UINT trailer = 0;
1774 krb5glue_key key = nullptr;
1775
1776 WINPR_ASSERT(context);
1777 WINPR_ASSERT(context->auth_ctx);
1778
1779 /* The MaxTokenSize by default is 12,000 bytes. This has been the default value
1780 * since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2.
1781 * For Windows Server 2012, the default value of the MaxTokenSize registry
1782 * entry is 48,000 bytes.*/
1783 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1784 ContextSizes->cbMaxSignature = 0;
1785 ContextSizes->cbBlockSize = 1;
1786 ContextSizes->cbSecurityTrailer = 0;
1787
1788 key = get_key(&context->keyset);
1789
1790 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1791 {
1792 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1793 KRB5_CRYPTO_TYPE_HEADER, &header);
1794 if (rv)
1795 return krb5_error_to_SECURITY_STATUS(rv);
1796
1797 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1798 &pad);
1799 if (rv)
1800 return krb5_error_to_SECURITY_STATUS(rv);
1801
1802 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1803 &trailer);
1804 if (rv)
1805 return krb5_error_to_SECURITY_STATUS(rv);
1806
1807 /* GSS header (= 16 bytes) + encrypted header = 32 bytes */
1808 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1809 }
1810
1811 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1812 {
1813 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1814 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1815 if (rv)
1816 return krb5_error_to_SECURITY_STATUS(rv);
1817
1818 ContextSizes->cbMaxSignature += 16;
1819 }
1820
1821 return SEC_E_OK;
1822}
1823
1824WINPR_ATTR_NODISCARD
1825static SECURITY_STATUS kerberos_ATTR_AUTH_IDENTITY(KRB_CONTEXT* context,
1826 KRB_CREDENTIALS* credentials,
1827 SecPkgContext_AuthIdentity* AuthIdentity)
1828{
1829 const SecPkgContext_AuthIdentity empty = WINPR_C_ARRAY_INIT;
1830
1831 WINPR_ASSERT(context);
1832 WINPR_ASSERT(context->auth_ctx);
1833 WINPR_ASSERT(credentials);
1834
1835 WINPR_ASSERT(AuthIdentity);
1836 *AuthIdentity = empty;
1837
1838 krb5glue_authenticator authenticator = nullptr;
1839 krb5_error_code rv = krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx,
1840 context->auth_ctx, &authenticator);
1841 if (rv)
1842 goto fail;
1843
1844 {
1845 rv = -1;
1846
1847#if defined(WITH_KRB5_HEIMDAL)
1848 const Realm data = authenticator->crealm;
1849 if (!data)
1850 goto fail;
1851 const size_t data_len = length_Realm(&data);
1852#else
1853 krb5_data* realm_data = krb5_princ_realm(credentials->ctx, authenticator->client);
1854 if (!realm_data)
1855 goto fail;
1856 const char* data = realm_data->data;
1857 if (!data)
1858 goto fail;
1859 const size_t data_len = realm_data->length;
1860#endif
1861
1862 if (data_len > (sizeof(AuthIdentity->Domain) - 1))
1863 goto fail;
1864 strncpy(AuthIdentity->Domain, data, data_len);
1865 }
1866
1867 {
1868#if defined(WITH_KRB5_HEIMDAL)
1869 const PrincipalName* principal = &authenticator->cname;
1870 const size_t name_length = length_PrincipalName(principal);
1871 if (!principal->name_string.val)
1872 goto fail;
1873 const char* name = *principal->name_string.val;
1874#else
1875 char* name = nullptr;
1876 rv = krb_log_exec(krb5_unparse_name_flags, credentials->ctx, authenticator->client,
1877 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
1878 if (rv)
1879 goto fail;
1880
1881 const size_t name_length = strlen(name);
1882#endif
1883
1884 const bool ok = (name_length <= (sizeof(AuthIdentity->User) - 1));
1885 if (ok)
1886 strncpy(AuthIdentity->User, name, name_length);
1887
1888 rv = ok ? 0 : -1;
1889
1890#if !defined(WITH_KRB5_HEIMDAL)
1891 krb5_free_unparsed_name(credentials->ctx, name);
1892#endif
1893 }
1894
1895fail:
1896 krb5glue_free_authenticator(credentials->ctx, authenticator);
1897 return krb5_error_to_SECURITY_STATUS(rv);
1898}
1899
1900WINPR_ATTR_NODISCARD
1901static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_A(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1902 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1903 SecPkgContext_PackageInfoA* PackageInfo)
1904{
1905 size_t size = sizeof(SecPkgInfoA);
1906 SecPkgInfoA* pPackageInfo =
1907 (SecPkgInfoA*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1908
1909 if (!pPackageInfo)
1910 return SEC_E_INSUFFICIENT_MEMORY;
1911
1912 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoA.fCapabilities;
1913 pPackageInfo->wVersion = KERBEROS_SecPkgInfoA.wVersion;
1914 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoA.wRPCID;
1915 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1916 pPackageInfo->Name = _strdup(KERBEROS_SecPkgInfoA.Name);
1917 pPackageInfo->Comment = _strdup(KERBEROS_SecPkgInfoA.Comment);
1918
1919 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1920 {
1921 sspi_ContextBufferFree(pPackageInfo);
1922 return SEC_E_INSUFFICIENT_MEMORY;
1923 }
1924 PackageInfo->PackageInfo = pPackageInfo;
1925 return SEC_E_OK;
1926}
1927
1928WINPR_ATTR_NODISCARD
1929static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_W(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1930 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1931 SecPkgContext_PackageInfoW* PackageInfo)
1932{
1933 size_t size = sizeof(SecPkgInfoW);
1934 SecPkgInfoW* pPackageInfo =
1935 (SecPkgInfoW*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1936
1937 if (!pPackageInfo)
1938 return SEC_E_INSUFFICIENT_MEMORY;
1939
1940 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoW.fCapabilities;
1941 pPackageInfo->wVersion = KERBEROS_SecPkgInfoW.wVersion;
1942 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoW.wRPCID;
1943 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoW.cbMaxToken;
1944 pPackageInfo->Name = _wcsdup(KERBEROS_SecPkgInfoW.Name);
1945 pPackageInfo->Comment = _wcsdup(KERBEROS_SecPkgInfoW.Comment);
1946
1947 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1948 {
1949 sspi_ContextBufferFree(pPackageInfo);
1950 return SEC_E_INSUFFICIENT_MEMORY;
1951 }
1952 PackageInfo->PackageInfo = pPackageInfo;
1953 return SEC_E_OK;
1954}
1955
1956WINPR_ATTR_NODISCARD
1957static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
1958 KRB_CREDENTIALS* credentials,
1959 KERB_TICKET_LOGON* ticketLogon)
1960{
1961 krb5_creds matchCred = WINPR_C_ARRAY_INIT;
1962 krb5_auth_context authContext = nullptr;
1963 krb5_flags getCredsFlags = KRB5_GC_CACHED;
1964 BOOL firstRun = TRUE;
1965 krb5_creds* hostCred = nullptr;
1966 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
1967 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost, "HOST",
1968 KRB5_NT_SRV_HST, &matchCred.server);
1969 if (rv)
1970 goto out;
1971
1972 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1973 &matchCred.client);
1974 if (rv)
1975 goto out;
1976
1977 /* try from the cache first, and then do a new request */
1978again:
1979 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
1980 &matchCred, &hostCred);
1981 switch (rv)
1982 {
1983 case 0:
1984 break;
1985 case KRB5_CC_NOTFOUND:
1986 getCredsFlags = 0;
1987 if (firstRun)
1988 {
1989 firstRun = FALSE;
1990 goto again;
1991 }
1992 WINPR_FALLTHROUGH
1993 default:
1994 WLog_ERR(TAG, "krb5_get_credentials(hostCreds), rv=%d", rv);
1995 goto out;
1996 }
1997
1998 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
1999 goto out;
2000
2001 {
2002 krb5_data derOut = WINPR_C_ARRAY_INIT;
2003 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
2004 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
2005 {
2006 ret = SEC_E_LOGON_DENIED;
2007 goto out;
2008 }
2009
2010 ticketLogon->MessageType = KerbTicketLogon;
2011 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
2012
2013 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
2014 &ticketLogon->ServiceTicketLength))
2015 {
2016 krb5_free_data(credentials->ctx, &derOut);
2017 goto out;
2018 }
2019
2020 ticketLogon->TicketGrantingTicketLength = derOut.length;
2021 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
2022 }
2023
2024 ret = SEC_E_OK;
2025out:
2026 krb5_auth_con_free(credentials->ctx, authContext);
2027 krb5_free_creds(credentials->ctx, hostCred);
2028 krb5_free_cred_contents(credentials->ctx, &matchCred);
2029 return ret;
2030}
2031
2032#endif /* WITH_KRB5 */
2033
2034WINPR_ATTR_NODISCARD
2035static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesCommon(
2036 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2037{
2038 if (!phContext)
2039 return SEC_E_INVALID_HANDLE;
2040
2041 if (!pBuffer)
2042 return SEC_E_INVALID_PARAMETER;
2043
2044#ifdef WITH_KRB5
2045 KRB_CONTEXT* context = get_context(phContext);
2046 if (!context)
2047 return SEC_E_INVALID_PARAMETER;
2048
2049 KRB_CREDENTIALS* credentials = context->credentials;
2050
2051 switch (ulAttribute)
2052 {
2053 case SECPKG_ATTR_SIZES:
2054 return kerberos_ATTR_SIZES(context, credentials, (SecPkgContext_Sizes*)pBuffer);
2055
2056 case SECPKG_ATTR_AUTH_IDENTITY:
2057 return kerberos_ATTR_AUTH_IDENTITY(context, credentials,
2058 (SecPkgContext_AuthIdentity*)pBuffer);
2059
2060 case SECPKG_CRED_ATTR_TICKET_LOGON:
2061 return kerberos_ATTR_TICKET_LOGON(context, credentials, (KERB_TICKET_LOGON*)pBuffer);
2062
2063 default:
2064 WLog_ERR(TAG, "TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
2065 ulAttribute);
2066 return SEC_E_UNSUPPORTED_FUNCTION;
2067 }
2068#else
2069 return SEC_E_UNSUPPORTED_FUNCTION;
2070#endif
2071}
2072
2073WINPR_ATTR_NODISCARD
2074static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(
2075 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2076{
2077 if (!phContext)
2078 return SEC_E_INVALID_HANDLE;
2079
2080 if (!pBuffer)
2081 return SEC_E_INVALID_PARAMETER;
2082
2083#ifdef WITH_KRB5
2084 KRB_CONTEXT* context = get_context(phContext);
2085 if (!context)
2086 return SEC_E_INVALID_PARAMETER;
2087
2088 KRB_CREDENTIALS* credentials = context->credentials;
2089
2090 switch (ulAttribute)
2091 {
2092 case SECPKG_ATTR_PACKAGE_INFO:
2093 return kerberos_ATTR_PACKAGE_INFO_A(context, credentials,
2094 (SecPkgContext_PackageInfoA*)pBuffer);
2095 default:
2096 break;
2097 }
2098#endif
2099 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2100}
2101
2102WINPR_ATTR_NODISCARD
2103static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(PCtxtHandle phContext,
2104 ULONG ulAttribute, void* pBuffer)
2105{
2106 if (!phContext)
2107 return SEC_E_INVALID_HANDLE;
2108
2109 if (!pBuffer)
2110 return SEC_E_INVALID_PARAMETER;
2111
2112#ifdef WITH_KRB5
2113 KRB_CONTEXT* context = get_context(phContext);
2114 if (!context)
2115 return SEC_E_INVALID_PARAMETER;
2116
2117 KRB_CREDENTIALS* credentials = context->credentials;
2118
2119 switch (ulAttribute)
2120 {
2121 case SECPKG_ATTR_PACKAGE_INFO:
2122 return kerberos_ATTR_PACKAGE_INFO_W(context, credentials,
2123 (SecPkgContext_PackageInfoW*)pBuffer);
2124 default:
2125 break;
2126 }
2127#endif
2128 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2129}
2130
2131WINPR_ATTR_NODISCARD
2132static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
2133 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2134 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2135{
2136 return SEC_E_UNSUPPORTED_FUNCTION;
2137}
2138
2139WINPR_ATTR_NODISCARD
2140static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
2141 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2142 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2143{
2144 return SEC_E_UNSUPPORTED_FUNCTION;
2145}
2146
2147WINPR_ATTR_NODISCARD
2148static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(
2149 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
2150 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer,
2151 WINPR_ATTR_UNUSED BOOL unicode)
2152{
2153#ifdef WITH_KRB5
2154 KRB_CREDENTIALS* credentials = nullptr;
2155
2156 if (!phCredential)
2157 return SEC_E_INVALID_HANDLE;
2158
2159 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
2160
2161 if (!credentials)
2162 return SEC_E_INVALID_HANDLE;
2163
2164 if (!pBuffer)
2165 return SEC_E_INSUFFICIENT_MEMORY;
2166
2167 switch (ulAttribute)
2168 {
2169 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
2170 {
2171 SecPkgCredentials_KdcProxySettingsW* kdc_settings = pBuffer;
2172
2173 /* Sanity checks */
2174 if (cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2175 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
2176 kdc_settings->ProxyServerOffset < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2177 cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) +
2178 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
2179 return SEC_E_INVALID_TOKEN;
2180
2181 if (credentials->kdc_url)
2182 {
2183 free(credentials->kdc_url);
2184 credentials->kdc_url = nullptr;
2185 }
2186
2187 if (kdc_settings->ProxyServerLength > 0)
2188 {
2189 WCHAR* proxy = WINPR_PACKED_ALIGN_CAST(
2190 WCHAR*, ((BYTE*)pBuffer + kdc_settings->ProxyServerOffset));
2191
2192 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
2193 proxy, kdc_settings->ProxyServerLength / sizeof(WCHAR), nullptr);
2194 if (!credentials->kdc_url)
2195 return SEC_E_INSUFFICIENT_MEMORY;
2196 }
2197
2198 return SEC_E_OK;
2199 }
2200 case SECPKG_CRED_ATTR_NAMES:
2201 case SECPKG_ATTR_SUPPORTED_ALGS:
2202 default:
2203 WLog_ERR(TAG, "TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
2204 ulAttribute);
2205 return SEC_E_UNSUPPORTED_FUNCTION;
2206 }
2207
2208#else
2209 return SEC_E_UNSUPPORTED_FUNCTION;
2210#endif
2211}
2212
2213WINPR_ATTR_NODISCARD
2214static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(PCredHandle phCredential,
2215 ULONG ulAttribute,
2216 void* pBuffer, ULONG cbBuffer)
2217{
2218 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
2219}
2220
2221WINPR_ATTR_NODISCARD
2222static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(PCredHandle phCredential,
2223 ULONG ulAttribute,
2224 void* pBuffer, ULONG cbBuffer)
2225{
2226 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
2227}
2228
2229WINPR_ATTR_NODISCARD
2230static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2231 WINPR_ATTR_UNUSED ULONG fQOP,
2232 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2233 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2234{
2235#ifdef WITH_KRB5
2236 KRB_CONTEXT* context = get_context(phContext);
2237 PSecBuffer sig_buffer = nullptr;
2238 PSecBuffer data_buffer = nullptr;
2239 char* header = nullptr;
2240 BYTE flags = 0;
2241 krb5glue_key key = nullptr;
2242 krb5_keyusage usage = 0;
2243 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2244 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2245 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2246 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2247 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2248
2249 if (!context)
2250 return SEC_E_INVALID_HANDLE;
2251
2252 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2253 return SEC_E_UNSUPPORTED_FUNCTION;
2254
2255 KRB_CREDENTIALS* creds = context->credentials;
2256
2257 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2258 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2259
2260 if (!sig_buffer || !data_buffer)
2261 return SEC_E_INVALID_TOKEN;
2262
2263 if (fQOP)
2264 return SEC_E_QOP_NOT_SUPPORTED;
2265
2266 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2267 flags |= FLAG_WRAP_CONFIDENTIAL;
2268
2269 key = get_key(&context->keyset);
2270 if (!key)
2271 return SEC_E_INTERNAL_ERROR;
2272
2273 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2274
2275 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
2276
2277 /* Set the lengths of the data (plaintext + header) */
2278 encrypt_iov[1].data.length = data_buffer->cbBuffer;
2279 encrypt_iov[2].data.length = 16;
2280
2281 /* Get the lengths of the header, trailer, and padding and ensure sig_buffer is large enough */
2282 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
2283 ARRAYSIZE(encrypt_iov)))
2284 return SEC_E_INTERNAL_ERROR;
2285 if (sig_buffer->cbBuffer <
2286 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
2287 return SEC_E_INSUFFICIENT_MEMORY;
2288
2289 /* Set up the iov array in sig_buffer */
2290 header = sig_buffer->pvBuffer;
2291 encrypt_iov[2].data.data = header + 16;
2292 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
2293 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
2294 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
2295 encrypt_iov[1].data.data = data_buffer->pvBuffer;
2296
2297 /* Write the GSS header with 0 in RRC */
2298 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
2299 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2300 header[3] = (char)0xFF;
2301 winpr_Data_Write_UINT32(header + 4, 0);
2302 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2303
2304 /* Copy header to be encrypted */
2305 CopyMemory(encrypt_iov[2].data.data, header, 16);
2306
2307 /* Set the correct RRC */
2308 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
2309 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
2310
2311 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
2312 ARRAYSIZE(encrypt_iov)))
2313 return SEC_E_INTERNAL_ERROR;
2314
2315 return SEC_E_OK;
2316#else
2317 return SEC_E_UNSUPPORTED_FUNCTION;
2318#endif
2319}
2320
2321WINPR_ATTR_NODISCARD
2322static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2323 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2324 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2325 WINPR_ATTR_UNUSED ULONG* pfQOP)
2326{
2327#ifdef WITH_KRB5
2328 KRB_CONTEXT* context = get_context(phContext);
2329 if (!context)
2330 return SEC_E_INVALID_HANDLE;
2331
2332 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2333 return SEC_E_UNSUPPORTED_FUNCTION;
2334
2335 KRB_CREDENTIALS* creds = context->credentials;
2336
2337 const PSecBuffer sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2338 PSecBuffer data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2339
2340 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2341 return SEC_E_INVALID_TOKEN;
2342
2343 /* Read in header information */
2344 const BYTE* header = sig_buffer->pvBuffer;
2345 const uint16_t tok_id = winpr_Data_Get_UINT16_BE(header);
2346 const BYTE flags = header[2];
2347 const uint16_t ec = winpr_Data_Get_UINT16_BE(&header[4]);
2348 const uint16_t rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2349 const uint64_t seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2350
2351 /* Check that the header is valid */
2352 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2353 return SEC_E_INVALID_TOKEN;
2354
2355 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2356 return SEC_E_INVALID_TOKEN;
2357
2358 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2359 (seq_no != context->remote_seq + MessageSeqNo))
2360 return SEC_E_OUT_OF_SEQUENCE;
2361
2362 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2363 return SEC_E_INVALID_TOKEN;
2364
2365 /* We don't expect a trailer buffer; the encrypted header must be rotated */
2366 if (rrc < 16)
2367 return SEC_E_INVALID_TOKEN;
2368
2369 /* Find the proper key and key usage */
2370 krb5glue_key key = get_key(&context->keyset);
2371 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2372 return SEC_E_INTERNAL_ERROR;
2373 krb5_keyusage usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2374
2375 /* Fill in the lengths of the iov array */
2376 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2377 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2378 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2379 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2380 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2381 iov[1].data.length = data_buffer->cbBuffer;
2382 iov[2].data.length = 16;
2383 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2384 return SEC_E_INTERNAL_ERROR;
2385
2386 /* We don't expect a trailer buffer; everything must be in sig_buffer */
2387 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2388 return SEC_E_INVALID_TOKEN;
2389 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2390 return SEC_E_INVALID_TOKEN;
2391
2392 /* Locate the parts of the message */
2393 const size_t iov0Offset = 16ull + rrc + ec;
2394 if (iov0Offset + iov[0].data.length > sig_buffer->cbBuffer)
2395 return SEC_E_INVALID_TOKEN;
2396
2397 const size_t iov2Offset = 16ull + ec;
2398 if (iov2Offset + iov[2].data.length > sig_buffer->cbBuffer)
2399 return SEC_E_INVALID_TOKEN;
2400
2401 iov[0].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov0Offset], char*);
2402 iov[1].data.data = data_buffer->pvBuffer;
2403 iov[2].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov2Offset], char*);
2404 char* data2 = iov[2].data.data;
2405 iov[3].data.data = &data2[iov[2].data.length];
2406
2407 char* data3 = iov[3].data.data;
2408 iov[4].data.data = &data3[iov[3].data.length];
2409
2410 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2411 return SEC_E_INTERNAL_ERROR;
2412
2413 /* Validate the encrypted header */
2414 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2415 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2416 if (memcmp(iov[2].data.data, header, 16) != 0)
2417 return SEC_E_MESSAGE_ALTERED;
2418
2419 *pfQOP = 0;
2420
2421 return SEC_E_OK;
2422#else
2423 return SEC_E_UNSUPPORTED_FUNCTION;
2424#endif
2425}
2426
2427WINPR_ATTR_NODISCARD
2428static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2429 WINPR_ATTR_UNUSED ULONG fQOP,
2430 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2431 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2432{
2433#ifdef WITH_KRB5
2434 KRB_CONTEXT* context = get_context(phContext);
2435 PSecBuffer sig_buffer = nullptr;
2436 PSecBuffer data_buffer = nullptr;
2437 krb5glue_key key = nullptr;
2438 krb5_keyusage usage = 0;
2439 BYTE flags = 0;
2440 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2441 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2442 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2443
2444 if (!context)
2445 return SEC_E_INVALID_HANDLE;
2446
2447 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2448 return SEC_E_UNSUPPORTED_FUNCTION;
2449
2450 KRB_CREDENTIALS* creds = context->credentials;
2451
2452 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2453 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2454
2455 if (!sig_buffer || !data_buffer)
2456 return SEC_E_INVALID_TOKEN;
2457
2458 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2459
2460 key = get_key(&context->keyset);
2461 if (!key)
2462 return SEC_E_INTERNAL_ERROR;
2463 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2464
2465 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2466
2467 /* Fill in the lengths of the iov array */
2468 iov[0].data.length = data_buffer->cbBuffer;
2469 iov[1].data.length = 16;
2470 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2471 return SEC_E_INTERNAL_ERROR;
2472
2473 /* Ensure the buffer is big enough */
2474 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2475 return SEC_E_INSUFFICIENT_MEMORY;
2476
2477 /* Write the header */
2478 char* header = sig_buffer->pvBuffer;
2479 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2480 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2481 memset(header + 3, 0xFF, 5);
2482 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2483
2484 /* Set up the iov array */
2485 iov[0].data.data = data_buffer->pvBuffer;
2486 iov[1].data.data = header;
2487 iov[2].data.data = header + 16;
2488
2489 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2490 return SEC_E_INTERNAL_ERROR;
2491
2492 sig_buffer->cbBuffer = iov[2].data.length + 16;
2493
2494 return SEC_E_OK;
2495#else
2496 return SEC_E_UNSUPPORTED_FUNCTION;
2497#endif
2498}
2499
2500WINPR_ATTR_NODISCARD
2501static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2502 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2503 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2504 WINPR_ATTR_UNUSED ULONG* pfQOP)
2505{
2506#ifdef WITH_KRB5
2507 PSecBuffer sig_buffer = nullptr;
2508 PSecBuffer data_buffer = nullptr;
2509 krb5glue_key key = nullptr;
2510 krb5_keyusage usage = 0;
2511 BYTE flags = 0;
2512 uint16_t tok_id = 0;
2513 uint64_t seq_no = 0;
2514 krb5_boolean is_valid = 0;
2515 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2516 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2517 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2518 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2519
2520 KRB_CONTEXT* context = get_context(phContext);
2521 if (!context)
2522 return SEC_E_INVALID_HANDLE;
2523
2524 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2525 return SEC_E_UNSUPPORTED_FUNCTION;
2526
2527 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2528 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2529
2530 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2531 return SEC_E_INVALID_TOKEN;
2532
2533 /* Read in header info */
2534 BYTE* header = sig_buffer->pvBuffer;
2535 tok_id = winpr_Data_Get_UINT16_BE(header);
2536 flags = header[2];
2537 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2538
2539 /* Validate header */
2540 if (tok_id != TOK_ID_MIC)
2541 return SEC_E_INVALID_TOKEN;
2542
2543 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2544 return SEC_E_INVALID_TOKEN;
2545
2546 if (memcmp(header + 3, cmp_filler, sizeof(cmp_filler)) != 0)
2547 return SEC_E_INVALID_TOKEN;
2548
2549 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2550 return SEC_E_OUT_OF_SEQUENCE;
2551
2552 /* Find the proper key and usage */
2553 key = get_key(&context->keyset);
2554 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2555 return SEC_E_INTERNAL_ERROR;
2556 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2557
2558 /* Fill in the iov array lengths */
2559 KRB_CREDENTIALS* creds = context->credentials;
2560 iov[0].data.length = data_buffer->cbBuffer;
2561 iov[1].data.length = 16;
2562 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2563 return SEC_E_INTERNAL_ERROR;
2564
2565 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2566 return SEC_E_INTERNAL_ERROR;
2567
2568 /* Set up the iov array */
2569 iov[0].data.data = data_buffer->pvBuffer;
2570 iov[1].data.data = (char*)header;
2571 iov[2].data.data = (char*)&header[16];
2572
2573 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2574 &is_valid))
2575 return SEC_E_INTERNAL_ERROR;
2576
2577 if (!is_valid)
2578 return SEC_E_MESSAGE_ALTERED;
2579
2580 return SEC_E_OK;
2581#else
2582 return SEC_E_UNSUPPORTED_FUNCTION;
2583#endif
2584}
2585
2586const SecurityFunctionTableA KERBEROS_SecurityFunctionTableA = {
2587 3, /* dwVersion */
2588 nullptr, /* EnumerateSecurityPackages */
2589 kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
2590 kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
2591 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2592 nullptr, /* Reserved2 */
2593 kerberos_InitializeSecurityContextA, /* InitializeSecurityContext */
2594 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2595 nullptr, /* CompleteAuthToken */
2596 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2597 nullptr, /* ApplyControlToken */
2598 kerberos_QueryContextAttributesA, /* QueryContextAttributes */
2599 nullptr, /* ImpersonateSecurityContext */
2600 nullptr, /* RevertSecurityContext */
2601 kerberos_MakeSignature, /* MakeSignature */
2602 kerberos_VerifySignature, /* VerifySignature */
2603 nullptr, /* FreeContextBuffer */
2604 nullptr, /* QuerySecurityPackageInfo */
2605 nullptr, /* Reserved3 */
2606 nullptr, /* Reserved4 */
2607 nullptr, /* ExportSecurityContext */
2608 nullptr, /* ImportSecurityContext */
2609 nullptr, /* AddCredentials */
2610 nullptr, /* Reserved8 */
2611 nullptr, /* QuerySecurityContextToken */
2612 kerberos_EncryptMessage, /* EncryptMessage */
2613 kerberos_DecryptMessage, /* DecryptMessage */
2614 kerberos_SetContextAttributesA, /* SetContextAttributes */
2615 kerberos_SetCredentialsAttributesA, /* SetCredentialsAttributes */
2616};
2617
2618const SecurityFunctionTableW KERBEROS_SecurityFunctionTableW = {
2619 3, /* dwVersion */
2620 nullptr, /* EnumerateSecurityPackages */
2621 kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
2622 kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
2623 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2624 nullptr, /* Reserved2 */
2625 kerberos_InitializeSecurityContextW, /* InitializeSecurityContext */
2626 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2627 nullptr, /* CompleteAuthToken */
2628 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2629 nullptr, /* ApplyControlToken */
2630 kerberos_QueryContextAttributesW, /* QueryContextAttributes */
2631 nullptr, /* ImpersonateSecurityContext */
2632 nullptr, /* RevertSecurityContext */
2633 kerberos_MakeSignature, /* MakeSignature */
2634 kerberos_VerifySignature, /* VerifySignature */
2635 nullptr, /* FreeContextBuffer */
2636 nullptr, /* QuerySecurityPackageInfo */
2637 nullptr, /* Reserved3 */
2638 nullptr, /* Reserved4 */
2639 nullptr, /* ExportSecurityContext */
2640 nullptr, /* ImportSecurityContext */
2641 nullptr, /* AddCredentials */
2642 nullptr, /* Reserved8 */
2643 nullptr, /* QuerySecurityContextToken */
2644 kerberos_EncryptMessage, /* EncryptMessage */
2645 kerberos_DecryptMessage, /* DecryptMessage */
2646 kerberos_SetContextAttributesW, /* SetContextAttributes */
2647 kerberos_SetCredentialsAttributesW, /* SetCredentialsAttributes */
2648};
2649
2650BOOL KERBEROS_init(void)
2651{
2652 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2653 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2654 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2655 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));
2656 return TRUE;
2657}
KERB_TICKET_LOGON
Definition secapi.h:51
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349
SecPkgContext_AuthIdentity
Definition include/winpr/sspi.h:1505
SecPkgContext_PackageInfoA
Definition include/winpr/sspi.h:416
SecPkgContext_PackageInfoW
Definition include/winpr/sspi.h:421
SecPkgContext_Sizes
Definition include/winpr/sspi.h:450
SecPkgCredentials_KdcProxySettingsW
Definition include/winpr/sspi.h:548
WinPrAsn1_MemoryChunk
Definition asn1.h:92
krb5glue_keyset
Definition krb5glue.h:92
sspi_gss_data
Definition sspi_gss.h:36
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:816