FreeRDP
Loading...
Searching...
No Matches
kerberos.c
1
22#include <winpr/config.h>
23#include <winpr/library.h>
24
25#include <stdio.h>
26#include <stdlib.h>
27#include <string.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <ctype.h>
31
32#include <winpr/assert.h>
33#include <winpr/cast.h>
34#include <winpr/asn1.h>
35#include <winpr/crt.h>
36#include <winpr/interlocked.h>
37#include <winpr/sspi.h>
38#include <winpr/print.h>
39#include <winpr/tchar.h>
40#include <winpr/sysinfo.h>
41#include <winpr/registry.h>
42#include <winpr/endian.h>
43#include <winpr/crypto.h>
44#include <winpr/path.h>
45#include <winpr/wtypes.h>
46#include <winpr/winsock.h>
47#include <winpr/schannel.h>
48#include <winpr/secapi.h>
49
50#include "kerberos.h"
51
52#ifdef WITH_KRB5_MIT
53#include "krb5glue.h"
54#include <profile.h>
55#endif
56
57#ifdef WITH_KRB5_HEIMDAL
58#include "krb5glue.h"
59#include <krb5-protos.h>
60#endif
61
62#include "../sspi.h"
63#include "../../log.h"
64
65const SecPkgInfoA KERBEROS_SecPkgInfoA = {
66 0x000F3BBF, /* fCapabilities */
67 1, /* wVersion */
68 0x0010, /* wRPCID */
69 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
70 "Kerberos", /* Name */
71 "Kerberos Security Package" /* Comment */
72};
73
74static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = WINPR_C_ARRAY_INIT;
75static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = WINPR_C_ARRAY_INIT;
76
77const SecPkgInfoW KERBEROS_SecPkgInfoW = {
78 0x000F3BBF, /* fCapabilities */
79 1, /* wVersion */
80 0x0010, /* wRPCID */
81 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
82 KERBEROS_SecPkgInfoW_NameBuffer, /* Name */
83 KERBEROS_SecPkgInfoW_CommentBuffer /* Comment */
84};
85
86#ifdef WITH_KRB5
87#define TAG WINPR_TAG("sspi.Kerberos")
88
89#define KRB_TGT_REQ 16
90#define KRB_TGT_REP 17
91
92enum KERBEROS_STATE
93{
94 KERBEROS_STATE_INITIAL,
95 KERBEROS_STATE_TGT_REQ,
96 KERBEROS_STATE_TGT_REP,
97 KERBEROS_STATE_AP_REQ,
98 KERBEROS_STATE_AP_REP,
99 KERBEROS_STATE_FINAL
100};
101
102typedef struct KRB_CREDENTIALS_st
103{
104 volatile LONG refCount;
105 krb5_context ctx;
106 char* kdc_url;
107 krb5_ccache ccache;
108 krb5_keytab keytab;
109 krb5_keytab client_keytab;
110 BOOL own_ccache;
111} KRB_CREDENTIALS;
112
113struct s_KRB_CONTEXT
114{
115 enum KERBEROS_STATE state;
116 KRB_CREDENTIALS* credentials;
117 krb5_auth_context auth_ctx;
118 BOOL acceptor;
119 uint32_t flags;
120 uint64_t local_seq;
121 uint64_t remote_seq;
122 struct krb5glue_keyset keyset;
123 BOOL u2u;
124 char* targetHost;
125};
126
127static const WinPrAsn1_OID kerberos_OID = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
128static const WinPrAsn1_OID kerberos_u2u_OID = { 10,
129 (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
130krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code, const char* what,
131 const char* file, const char* fkt, size_t line)
132{
133 switch (code)
134 {
135 case 0:
136 case KRB5_KT_END:
137 break;
138 default:
139 {
140 const DWORD level = WLOG_ERROR;
141
142 wLog* log = WLog_Get(TAG);
143 if (WLog_IsLevelActive(log, level))
144 {
145 const char* msg = krb5_get_error_message(ctx, code);
146 WLog_PrintTextMessage(log, level, line, file, fkt, "%s (%s [%d])", what, msg, code);
147 krb5_free_error_message(ctx, msg);
148 }
149 }
150 break;
151 }
152 return code;
153}
154
155void krb_log_context_encryption(krb5_context ctx, krb5_principal princ)
156{
157#if !defined(WITH_KRB5_HEIMDAL)
158 typedef krb5_error_code KRB5_CALLCONV (*krb5_get_etype_info_fn)(
159 krb5_context context, krb5_principal principal, krb5_get_init_creds_opt* opt,
160 krb5_enctype* enctype_out, krb5_data* salt_out, krb5_data* s2kparams_out);
161
162 krb5_get_etype_info_fn fn =
163 GetProcAddressAs(nullptr, "krb5_get_etype_info", krb5_get_etype_info_fn);
164
165 if (fn)
166 {
167 krb5_get_init_creds_opt opt = WINPR_C_ARRAY_INIT;
168 krb5_enctype enctype = 0;
169 krb5_data salt = WINPR_C_ARRAY_INIT;
170 krb5_data s2kparam = WINPR_C_ARRAY_INIT;
171 char buffer[128] = WINPR_C_ARRAY_INIT;
172 krb5_error_code rv = krb_log_exec(fn, ctx, princ, &opt, &enctype, &salt, &s2kparam);
173 krb5_enctype_to_string(enctype, buffer, sizeof(buffer));
174 const char* msg = krb5_get_error_message(ctx, rv);
175
176 WLog_DBG(TAG, "[%s] enctype=%s, salt[%u]=%s, s2kparam[%u]=%s", msg, buffer, salt.length,
177 salt.data, s2kparam.length, s2kparam.data);
178
179 krb5_free_data_contents(ctx, &salt);
180 krb5_free_data_contents(ctx, &s2kparam);
181 krb5_free_error_message(ctx, msg);
182 }
183 else
184#endif
185 {
186 WLog_WARN(TAG,
187 "kerberos implementation does not support 'krb5_get_etype_info', not displaying "
188 "encryption information");
189 }
190}
191
192static void credentials_unref(KRB_CREDENTIALS* credentials);
193
194static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
195{
196 if (!ctx)
197 return;
198
199 free(ctx->targetHost);
200 ctx->targetHost = nullptr;
201
202 if (ctx->credentials)
203 {
204 krb5_context krbctx = ctx->credentials->ctx;
205 if (krbctx)
206 {
207 if (ctx->auth_ctx)
208 krb5_auth_con_free(krbctx, ctx->auth_ctx);
209
210 krb5glue_keys_free(krbctx, &ctx->keyset);
211 }
212
213 credentials_unref(ctx->credentials);
214 }
215
216 if (allocated)
217 free(ctx);
218}
219
220static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
221{
222 KRB_CONTEXT* context = nullptr;
223
224 context = (KRB_CONTEXT*)calloc(1, sizeof(KRB_CONTEXT));
225 if (!context)
226 return nullptr;
227
228 context->credentials = credentials;
229 InterlockedIncrement(&credentials->refCount);
230 return context;
231}
232
233static krb5_error_code krb5_prompter(krb5_context context, void* data,
234 WINPR_ATTR_UNUSED const char* name,
235 WINPR_ATTR_UNUSED const char* banner, int num_prompts,
236 krb5_prompt prompts[])
237{
238 for (int i = 0; i < num_prompts; i++)
239 {
240 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
241 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
242 {
243 prompts[i].reply->data = _strdup((const char*)data);
244
245 const size_t len = strlen((const char*)data);
246 if (len > UINT32_MAX)
247 return KRB5KRB_ERR_GENERIC;
248 prompts[i].reply->length = (UINT32)len;
249 }
250 }
251 return 0;
252}
253
254WINPR_ATTR_NODISCARD static inline krb5glue_key get_key(struct krb5glue_keyset* keyset)
255{
256 return keyset->acceptor_key ? keyset->acceptor_key
257 : keyset->initiator_key ? keyset->initiator_key
258 : keyset->session_key;
259}
260
261static BOOL isValidIPv4(const char* ipAddress)
262{
263 struct sockaddr_in sa = WINPR_C_ARRAY_INIT;
264 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
265 return result != 0;
266}
267
268static BOOL isValidIPv6(const char* ipAddress)
269{
270 struct sockaddr_in6 sa = WINPR_C_ARRAY_INIT;
271 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
272 return result != 0;
273}
274
275static BOOL isValidIP(const char* ipAddress)
276{
277 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
278}
279
280#if defined(WITH_KRB5_MIT)
281WINPR_ATTR_MALLOC(free, 1)
282WINPR_ATTR_NODISCARD
283static char* get_realm_name(krb5_data realm, size_t* plen)
284{
285 WINPR_ASSERT(plen);
286 *plen = 0;
287 if ((realm.length <= 0) || (!realm.data))
288 return nullptr;
289
290 char* name = nullptr;
291 (void)winpr_asprintf(&name, plen, "krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
292 realm.data);
293 return name;
294}
295#elif defined(WITH_KRB5_HEIMDAL)
296WINPR_ATTR_MALLOC(free, 1)
297WINPR_ATTR_NODISCARD
298static char* get_realm_name(Realm realm, size_t* plen)
299{
300 WINPR_ASSERT(plen);
301 *plen = 0;
302 if (!realm)
303 return nullptr;
304
305 char* name = nullptr;
306 (void)winpr_asprintf(&name, plen, "krbtgt/%s@%s", realm, realm);
307 return name;
308}
309#endif
310
311static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
312{
313 /* "krbtgt/" + realm + "@" + realm */
314 size_t len = 0;
315 krb5_error_code rv = KRB5_CC_NOMEM;
316
317 char* name = get_realm_name(principal->realm, &len);
318 if (!name || (len == 0))
319 goto fail;
320
321 {
322 krb5_principal target = WINPR_C_ARRAY_INIT;
323 rv = krb5_parse_name(ctx, name, &target);
324 *ptarget = target;
325 }
326fail:
327 free(name);
328 return rv;
329}
330
331#endif /* WITH_KRB5 */
332
333static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
334 WINPR_ATTR_UNUSED SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage,
335 WINPR_ATTR_UNUSED ULONG fCredentialUse, WINPR_ATTR_UNUSED void* pvLogonID,
336 WINPR_ATTR_UNUSED void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
337 WINPR_ATTR_UNUSED void* pvGetKeyArgument, WINPR_ATTR_UNUSED PCredHandle phCredential,
338 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
339{
340#ifdef WITH_KRB5
341#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
342 SEC_WINPR_KERBEROS_SETTINGS_V2 krb_settings_v1_buffer = WINPR_C_ARRAY_INIT;
343#endif
344
345 SEC_WINPR_KERBEROS_SETTINGS_V2* krb_settings = nullptr;
346 KRB_CREDENTIALS* credentials = nullptr;
347 krb5_context ctx = nullptr;
348 krb5_ccache ccache = nullptr;
349 krb5_keytab keytab = nullptr;
350 krb5_principal principal = nullptr;
351 char* domain = nullptr;
352 char* username = nullptr;
353 char* password = nullptr;
354 BOOL own_ccache = FALSE;
355 const char* const default_ccache_type = "MEMORY";
356
357 if (pAuthData)
358 {
359 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
360
361#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
362 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
363 {
364 SEC_WINPR_KERBEROS_SETTINGS* krb_settingsV1 =
365 (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->kerberosSettings);
366 if (krb_settingsV1)
367 {
368 krb_settings_v1_buffer.kdcUrl = krb_settingsV1->kdcUrl;
369 krb_settings_v1_buffer.keytab = krb_settingsV1->keytab;
370 krb_settings_v1_buffer.cache = krb_settingsV1->cache;
371 krb_settings_v1_buffer.armorCache = krb_settingsV1->armorCache;
372 krb_settings_v1_buffer.pkinitX509Anchors = krb_settingsV1->pkinitX509Anchors;
373 krb_settings_v1_buffer.pkinitX509Identity = krb_settingsV1->pkinitX509Identity;
374 krb_settings_v1_buffer.withPac = krb_settingsV1->withPac;
375 krb_settings_v1_buffer.startTime = krb_settingsV1->startTime;
376 krb_settings_v1_buffer.renewLifeTime = krb_settingsV1->renewLifeTime;
377 krb_settings_v1_buffer.lifeTime = krb_settingsV1->lifeTime;
378 memcpy(krb_settings_v1_buffer.certSha1, krb_settingsV1->certSha1,
379 sizeof(krb_settings_v1_buffer.certSha1));
380 krb_settings = &krb_settings_v1_buffer;
381 }
382 }
383#endif
384 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED_v2)
385 {
386 const SEC_WINNT_AUTH_IDENTITY_WINPR_V2* auth =
387 (const SEC_WINNT_AUTH_IDENTITY_WINPR_V2*)pAuthData;
388 WINPR_ASSERT(auth);
389 if (auth->version < SEC_WINNT_AUTH_IDENTITY_WINPR_V2_REVISION_1)
390 goto cleanup;
391 krb_settings = auth->kerberosSettingsV2;
392 }
393
394 if (!sspi_CopyAuthIdentityFieldsA((const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData, &username,
395 &domain, &password))
396 {
397 WLog_ERR(TAG, "Failed to copy auth identity fields");
398 goto cleanup;
399 }
400
401 if (!pszPrincipal)
402 pszPrincipal = username;
403 }
404
405 if (krb_log_exec_ptr(krb5_init_context, &ctx))
406 goto cleanup;
407
408 if (domain)
409 {
410 char* udomain = _strdup(domain);
411 if (!udomain)
412 goto cleanup;
413
414 CharUpperA(udomain);
415 /* Will use domain if realm is not specified in username */
416 krb5_error_code rv = krb_log_exec(krb5_set_default_realm, ctx, udomain);
417 free(udomain);
418
419 if (rv)
420 goto cleanup;
421 }
422
423 if (pszPrincipal)
424 {
425 char* cpszPrincipal = _strdup(pszPrincipal);
426 if (!cpszPrincipal)
427 goto cleanup;
428
429 /* Find realm component if included and convert to uppercase */
430 char* p = strchr(cpszPrincipal, '@');
431 if (p)
432 CharUpperA(p);
433
434 krb5_error_code rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, &principal);
435 free(cpszPrincipal);
436
437 if (rv)
438 goto cleanup;
439 WINPR_ASSERT(principal);
440 }
441
442 if (krb_settings && krb_settings->cache)
443 {
444 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
445 goto cleanup;
446 }
447 else
448 own_ccache = TRUE;
449
450 if (principal)
451 {
452 /* Use the default cache if it's initialized with the right principal */
453 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
454 {
455 if (own_ccache)
456 {
457 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
458 goto cleanup;
459 }
460 else
461 {
462 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
463 goto cleanup;
464 }
465
466 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
467 goto cleanup;
468 }
469 else
470 {
471 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
472 goto cleanup;
473 own_ccache = FALSE;
474 }
475 WINPR_ASSERT(ccache);
476 }
477 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
478 {
479 /* Use the default cache with it's default principal */
480 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
481 goto cleanup;
482 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
483 goto cleanup;
484 WINPR_ASSERT(ccache);
485 own_ccache = FALSE;
486 }
487 else
488 {
489 if (own_ccache)
490 {
491 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
492 goto cleanup;
493 }
494 else
495 {
496 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
497 goto cleanup;
498 }
499 WINPR_ASSERT(ccache);
500 }
501
502 if (krb_settings && krb_settings->keytab)
503 {
504 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
505 goto cleanup;
506 }
507 else
508 {
509 if (fCredentialUse & SECPKG_CRED_INBOUND)
510 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
511 goto cleanup;
512 }
513
514 /* Get initial credentials if required */
515 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
516 {
517 krb5_creds creds = WINPR_C_ARRAY_INIT;
518 krb5_creds matchCreds = WINPR_C_ARRAY_INIT;
519 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
520
521 krb5_timeofday(ctx, &matchCreds.times.endtime);
522 matchCreds.times.endtime += 60;
523 matchCreds.client = principal;
524
525 WINPR_ASSERT(principal);
526 WINPR_ASSERT(ctx);
527 WINPR_ASSERT(ccache);
528 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
529 goto cleanup;
530
531 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
532 krb5_free_principal(ctx, matchCreds.server);
533 krb5_free_cred_contents(ctx, &creds);
534 if (rv)
535 {
536 if (krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
537 password, krb_settings))
538 goto cleanup;
539 }
540 }
541
542 credentials = calloc(1, sizeof(KRB_CREDENTIALS));
543 if (!credentials)
544 goto cleanup;
545 credentials->refCount = 1;
546 credentials->ctx = ctx;
547 credentials->ccache = ccache;
548 credentials->keytab = keytab;
549 credentials->own_ccache = own_ccache;
550
551cleanup:
552
553 free(domain);
554 free(username);
555 free(password);
556
557 if (principal)
558 krb5_free_principal(ctx, principal);
559 if (ctx)
560 {
561 if (!credentials)
562 {
563 if (ccache)
564 {
565 if (own_ccache)
566 krb5_cc_destroy(ctx, ccache);
567 else
568 krb5_cc_close(ctx, ccache);
569 }
570 if (keytab)
571 krb5_kt_close(ctx, keytab);
572
573 krb5_free_context(ctx);
574 }
575 }
576
577 /* If we managed to get credentials set the output */
578 if (credentials)
579 {
580 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
581 sspi_SecureHandleSetUpperPointer(phCredential, (void*)KERBEROS_SSP_NAME);
582 return SEC_E_OK;
583 }
584
585 return SEC_E_NO_CREDENTIALS;
586#else
587 return SEC_E_UNSUPPORTED_FUNCTION;
588#endif
589}
590
591static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
592 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
593 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
594 PTimeStamp ptsExpiry)
595{
596 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
597 char* principal = nullptr;
598 char* package = nullptr;
599
600 if (pszPrincipal)
601 {
602 principal = ConvertWCharToUtf8Alloc(pszPrincipal, nullptr);
603 if (!principal)
604 goto fail;
605 }
606 if (pszPackage)
607 {
608 package = ConvertWCharToUtf8Alloc(pszPackage, nullptr);
609 if (!package)
610 goto fail;
611 }
612
613 status =
614 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
615 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
616
617fail:
618 free(principal);
619 free(package);
620
621 return status;
622}
623
624#ifdef WITH_KRB5
625static void credentials_unref(KRB_CREDENTIALS* credentials)
626{
627 WINPR_ASSERT(credentials);
628
629 if (InterlockedDecrement(&credentials->refCount))
630 return;
631
632 free(credentials->kdc_url);
633
634 if (credentials->ccache)
635 {
636 if (credentials->own_ccache)
637 krb5_cc_destroy(credentials->ctx, credentials->ccache);
638 else
639 krb5_cc_close(credentials->ctx, credentials->ccache);
640 }
641 if (credentials->keytab)
642 krb5_kt_close(credentials->ctx, credentials->keytab);
643
644 krb5_free_context(credentials->ctx);
645 free(credentials);
646}
647#endif
648
649static SECURITY_STATUS
650 SEC_ENTRY kerberos_FreeCredentialsHandle(WINPR_ATTR_UNUSED PCredHandle phCredential)
651{
652#ifdef WITH_KRB5
653 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
654 sspi_SecureHandleInvalidate(phCredential);
655 if (!credentials)
656 return SEC_E_INVALID_HANDLE;
657
658 credentials_unref(credentials);
659
660 return SEC_E_OK;
661#else
662 return SEC_E_UNSUPPORTED_FUNCTION;
663#endif
664}
665
666static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
667 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
668 WINPR_ATTR_UNUSED void* pBuffer)
669{
670#ifdef WITH_KRB5
671 switch (ulAttribute)
672 {
673 case SECPKG_CRED_ATTR_NAMES:
674 return SEC_E_OK;
675 default:
676 WLog_ERR(TAG, "TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
677 ulAttribute);
678 return SEC_E_UNSUPPORTED_FUNCTION;
679 }
680
681#else
682 return SEC_E_UNSUPPORTED_FUNCTION;
683#endif
684}
685
686static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(PCredHandle phCredential,
687 ULONG ulAttribute,
688 void* pBuffer)
689{
690 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
691}
692
693#ifdef WITH_KRB5
694
695static BOOL kerberos_mk_tgt_token(SecBuffer* buf, int msg_type, char* sname, char* host,
696 const krb5_data* ticket)
697{
698 WinPrAsn1Encoder* enc = nullptr;
699 WinPrAsn1_MemoryChunk data;
700 wStream s;
701 size_t len = 0;
702 sspi_gss_data token;
703 BOOL ret = FALSE;
704
705 WINPR_ASSERT(buf);
706
707 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
708 return FALSE;
709 if (msg_type == KRB_TGT_REP && !ticket)
710 return FALSE;
711
712 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
713 if (!enc)
714 return FALSE;
715
716 /* KERB-TGT-REQUEST (SEQUENCE) */
717 if (!WinPrAsn1EncSeqContainer(enc))
718 goto cleanup;
719
720 /* pvno [0] INTEGER */
721 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
722 goto cleanup;
723
724 /* msg-type [1] INTEGER */
725 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
726 goto cleanup;
727
728 if (msg_type == KRB_TGT_REQ && sname)
729 {
730 /* server-name [2] PrincipalName (SEQUENCE) */
731 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
732 goto cleanup;
733
734 /* name-type [0] INTEGER */
735 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
736 goto cleanup;
737
738 /* name-string [1] SEQUENCE OF GeneralString */
739 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
740 goto cleanup;
741
742 if (!WinPrAsn1EncGeneralString(enc, sname))
743 goto cleanup;
744
745 if (host && !WinPrAsn1EncGeneralString(enc, host))
746 goto cleanup;
747
748 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
749 goto cleanup;
750 }
751 else if (msg_type == KRB_TGT_REP)
752 {
753 /* ticket [2] Ticket */
754 data.data = (BYTE*)ticket->data;
755 data.len = ticket->length;
756 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
757 goto cleanup;
758 }
759
760 if (!WinPrAsn1EncEndContainer(enc))
761 goto cleanup;
762
763 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
764 goto cleanup;
765
766 Stream_StaticInit(&s, buf->pvBuffer, len);
767 if (!WinPrAsn1EncToStream(enc, &s))
768 goto cleanup;
769
770 token.data = buf->pvBuffer;
771 token.length = (UINT)len;
772 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
773 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
774 ret = TRUE;
775
776cleanup:
777 WinPrAsn1Encoder_Free(&enc);
778 return ret;
779}
780
781static BOOL append(char* dst, size_t dstSize, const char* src)
782{
783 const size_t dlen = strnlen(dst, dstSize);
784 const size_t slen = strlen(src);
785 if (dlen + slen >= dstSize)
786 return FALSE;
787 if (!strncat(dst, src, dstSize - dlen))
788 return FALSE;
789 return TRUE;
790}
791
792static BOOL kerberos_rd_tgt_req_tag2(WinPrAsn1Decoder* dec, char* buf, size_t len)
793{
794 BOOL rc = FALSE;
795 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
796
797 /* server-name [2] PrincipalName (SEQUENCE) */
798 if (!WinPrAsn1DecReadSequence(dec, &seq))
799 goto end;
800
801 /* name-type [0] INTEGER */
802 {
803 BOOL error = FALSE;
804 {
805 WinPrAsn1_INTEGER val = 0;
806 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
807 goto end;
808 }
809
810 /* name-string [1] SEQUENCE OF GeneralString */
811 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
812 goto end;
813 }
814
815 {
816 WinPrAsn1_tag tag = 0;
817 BOOL first = TRUE;
818 while (WinPrAsn1DecPeekTag(dec, &tag))
819 {
820 BOOL success = FALSE;
821 char* lstr = nullptr;
822 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
823 goto fail;
824
825 if (!first)
826 {
827 if (!append(buf, len, "/"))
828 goto fail;
829 }
830 first = FALSE;
831
832 if (!append(buf, len, lstr))
833 goto fail;
834
835 success = TRUE;
836 fail:
837 free(lstr);
838 if (!success)
839 goto end;
840 }
841 }
842
843 rc = TRUE;
844end:
845 return rc;
846}
847
848static BOOL kerberos_rd_tgt_req_tag3(WinPrAsn1Decoder* dec, char* buf, size_t len)
849{
850 /* realm [3] Realm */
851 BOOL rc = FALSE;
852 WinPrAsn1_STRING str = nullptr;
853 if (!WinPrAsn1DecReadGeneralString(dec, &str))
854 goto end;
855
856 if (!append(buf, len, "@"))
857 goto end;
858 if (!append(buf, len, str))
859 goto end;
860
861 rc = TRUE;
862end:
863 free(str);
864 return rc;
865}
866
867static BOOL kerberos_rd_tgt_req(WinPrAsn1Decoder* dec, char** target)
868{
869 BOOL rc = FALSE;
870
871 if (!target)
872 return FALSE;
873 *target = nullptr;
874
875 wStream s = WinPrAsn1DecGetStream(dec);
876 const size_t len = Stream_Length(&s);
877 if (len == 0)
878 return TRUE;
879
880 WinPrAsn1Decoder dec2 = WinPrAsn1Decoder_init();
881 WinPrAsn1_tagId tag = 0;
882 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
883 return FALSE;
884
885 char* buf = calloc(len + 1, sizeof(char));
886 if (!buf)
887 return FALSE;
888
889 /* We expect ASN1 context tag values 2 or 3.
890 *
891 * In case we got value 2 an (optional) context tag value 3 might follow.
892 */
893 BOOL checkForTag3 = TRUE;
894 if (tag == 2)
895 {
896 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
897 if (rc)
898 {
899 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
900 if (res == 0)
901 checkForTag3 = FALSE;
902 }
903 }
904
905 if (checkForTag3)
906 {
907 if (tag == 3)
908 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
909 else
910 rc = FALSE;
911 }
912
913 if (rc)
914 *target = buf;
915 else
916 free(buf);
917 return rc;
918}
919
920static BOOL kerberos_rd_tgt_rep(WinPrAsn1Decoder* dec, krb5_data* ticket)
921{
922 if (!ticket)
923 return FALSE;
924
925 /* ticket [2] Ticket */
926 WinPrAsn1Decoder asnTicket = WinPrAsn1Decoder_init();
927 WinPrAsn1_tagId tag = 0;
928 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
929 return FALSE;
930
931 if (tag != 2)
932 return FALSE;
933
934 wStream s = WinPrAsn1DecGetStream(&asnTicket);
935 ticket->data = Stream_BufferAs(&s, char);
936
937 const size_t len = Stream_Length(&s);
938 if (len > UINT32_MAX)
939 return FALSE;
940 ticket->length = (UINT32)len;
941 return TRUE;
942}
943
944static BOOL kerberos_rd_tgt_token(const sspi_gss_data* token, char** target, krb5_data* ticket)
945{
946 BOOL error = 0;
947 WinPrAsn1_INTEGER val = 0;
948
949 WINPR_ASSERT(token);
950
951 if (target)
952 *target = nullptr;
953
954 WinPrAsn1Decoder der = WinPrAsn1Decoder_init();
955 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
956
957 /* KERB-TGT-REQUEST (SEQUENCE) */
958 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
959 if (!WinPrAsn1DecReadSequence(&der, &seq))
960 return FALSE;
961
962 /* pvno [0] INTEGER */
963 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
964 return FALSE;
965
966 /* msg-type [1] INTEGER */
967 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
968 return FALSE;
969
970 switch (val)
971 {
972 case KRB_TGT_REQ:
973 return kerberos_rd_tgt_req(&seq, target);
974 case KRB_TGT_REP:
975 return kerberos_rd_tgt_rep(&seq, ticket);
976 default:
977 break;
978 }
979 return FALSE;
980}
981
982static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5, SEC_CHANNEL_BINDINGS* bindings)
983{
984 BYTE buf[4];
985
986 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
987 if (!winpr_Digest_Update(md5, buf, 4))
988 return FALSE;
989
990 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
991 if (!winpr_Digest_Update(md5, buf, 4))
992 return FALSE;
993
994 if (bindings->cbInitiatorLength &&
995 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
996 bindings->cbInitiatorLength))
997 return FALSE;
998
999 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
1000 if (!winpr_Digest_Update(md5, buf, 4))
1001 return FALSE;
1002
1003 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
1004 if (!winpr_Digest_Update(md5, buf, 4))
1005 return FALSE;
1006
1007 if (bindings->cbAcceptorLength &&
1008 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
1009 bindings->cbAcceptorLength))
1010 return FALSE;
1011
1012 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
1013 if (!winpr_Digest_Update(md5, buf, 4))
1014 return FALSE;
1015
1016 if (bindings->cbApplicationDataLength &&
1017 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
1018 bindings->cbApplicationDataLength))
1019 return FALSE;
1020
1021 return TRUE;
1022}
1023
1024#endif /* WITH_KRB5 */
1025
1026static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
1027 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1028 WINPR_ATTR_UNUSED SEC_CHAR* pszTargetName, WINPR_ATTR_UNUSED ULONG fContextReq,
1029 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1030 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG Reserved2,
1031 WINPR_ATTR_UNUSED PCtxtHandle phNewContext, WINPR_ATTR_UNUSED PSecBufferDesc pOutput,
1032 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
1033{
1034#ifdef WITH_KRB5
1035 PSecBuffer input_buffer = nullptr;
1036 PSecBuffer output_buffer = nullptr;
1037 PSecBuffer bindings_buffer = nullptr;
1038 WINPR_DIGEST_CTX* md5 = nullptr;
1039 char* target = nullptr;
1040 char* sname = nullptr;
1041 char* host = nullptr;
1042 krb5_data input_token = WINPR_C_ARRAY_INIT;
1043 krb5_data output_token = WINPR_C_ARRAY_INIT;
1044 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1045 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1046 uint16_t tok_id = 0;
1047 krb5_ap_rep_enc_part* reply = nullptr;
1048 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
1049 char cksum_contents[24] = WINPR_C_ARRAY_INIT;
1050 krb5_data cksum = WINPR_C_ARRAY_INIT;
1051 krb5_creds in_creds = WINPR_C_ARRAY_INIT;
1052 krb5_creds* creds = nullptr;
1053 BOOL isNewContext = FALSE;
1054 KRB_CONTEXT* context = nullptr;
1055 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1056
1057 /* behave like windows SSPIs that don't want empty context */
1058 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1059 return SEC_E_INVALID_HANDLE;
1060
1061 context = sspi_SecureHandleGetLowerPointer(phContext);
1062
1063 if (!credentials)
1064 return SEC_E_NO_CREDENTIALS;
1065
1066 if (pInput)
1067 {
1068 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1069 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
1070 }
1071 if (pOutput)
1072 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1073
1074 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
1075 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
1076
1077 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1078 ap_flags |= AP_OPTS_USE_SESSION_KEY;
1079
1080 /* Split target name into service/hostname components */
1081 if (pszTargetName)
1082 {
1083 target = _strdup(pszTargetName);
1084 if (!target)
1085 {
1086 status = SEC_E_INSUFFICIENT_MEMORY;
1087 goto cleanup;
1088 }
1089 host = strchr(target, '/');
1090 if (host)
1091 {
1092 *host++ = 0;
1093 sname = target;
1094 }
1095 else
1096 host = target;
1097 if (isValidIP(host))
1098 {
1099 status = SEC_E_NO_CREDENTIALS;
1100 goto cleanup;
1101 }
1102 }
1103
1104 if (!context)
1105 {
1106 context = kerberos_ContextNew(credentials);
1107 if (!context)
1108 {
1109 status = SEC_E_INSUFFICIENT_MEMORY;
1110 goto cleanup;
1111 }
1112
1113 isNewContext = TRUE;
1114
1115 if (host)
1116 context->targetHost = _strdup(host);
1117 if (!context->targetHost)
1118 {
1119 status = SEC_E_INSUFFICIENT_MEMORY;
1120 goto cleanup;
1121 }
1122
1123 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1124 {
1125 context->state = KERBEROS_STATE_TGT_REQ;
1126 context->u2u = TRUE;
1127 }
1128 else
1129 context->state = KERBEROS_STATE_AP_REQ;
1130 }
1131 else
1132 {
1133 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1134 goto bad_token;
1135 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1136 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1137 goto bad_token;
1138 }
1139
1140 /* SSPI flags are compatible with GSS flags except INTEG_FLAG */
1141 context->flags |= (fContextReq & 0x1F);
1142 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1143 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1144
1145 switch (context->state)
1146 {
1147 case KERBEROS_STATE_TGT_REQ:
1148
1149 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, nullptr))
1150 goto cleanup;
1151
1152 context->state = KERBEROS_STATE_TGT_REP;
1153 status = SEC_I_CONTINUE_NEEDED;
1154 break;
1155
1156 case KERBEROS_STATE_TGT_REP:
1157
1158 if (tok_id != TOK_ID_TGT_REP)
1159 goto bad_token;
1160
1161 if (!kerberos_rd_tgt_token(&input_token, nullptr, &in_creds.second_ticket))
1162 goto bad_token;
1163
1164 /* Continue to AP-REQ */
1165 /* fallthrough */
1166 WINPR_FALLTHROUGH
1167
1168 case KERBEROS_STATE_AP_REQ:
1169
1170 /* Set auth_context options */
1171 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1172 goto cleanup;
1173 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1174 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1175 goto cleanup;
1176 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1177 GSS_CHECKSUM_TYPE))
1178 goto cleanup;
1179
1180 /* Get a service ticket */
1181 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1182 KRB5_NT_SRV_HST, &in_creds.server))
1183 goto cleanup;
1184
1185 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1186 &in_creds.client))
1187 {
1188 status = SEC_E_WRONG_PRINCIPAL;
1189 goto cleanup;
1190 }
1191
1192 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1193 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1194 &creds))
1195 {
1196 status = SEC_E_NO_CREDENTIALS;
1197 goto cleanup;
1198 }
1199
1200 /* Write the checksum (delegation not implemented) */
1201 cksum.data = cksum_contents;
1202 cksum.length = sizeof(cksum_contents);
1203 winpr_Data_Write_UINT32(cksum_contents, 16);
1204 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1205
1206 if (bindings_buffer)
1207 {
1208 SEC_CHANNEL_BINDINGS* bindings = bindings_buffer->pvBuffer;
1209
1210 /* Sanity checks */
1211 if (bindings_buffer->cbBuffer < sizeof(SEC_CHANNEL_BINDINGS) ||
1212 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1213 bindings_buffer->cbBuffer ||
1214 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1215 bindings_buffer->cbBuffer ||
1216 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1217 bindings_buffer->cbBuffer)
1218 {
1219 status = SEC_E_BAD_BINDINGS;
1220 goto cleanup;
1221 }
1222
1223 md5 = winpr_Digest_New();
1224 if (!md5)
1225 goto cleanup;
1226
1227 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1228 goto cleanup;
1229
1230 if (!kerberos_hash_channel_bindings(md5, bindings))
1231 goto cleanup;
1232
1233 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1234 goto cleanup;
1235 }
1236
1237 /* Make the AP_REQ message */
1238 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1239 &cksum, creds, &output_token))
1240 goto cleanup;
1241
1242 if (!sspi_gss_wrap_token(output_buffer,
1243 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1244 TOK_ID_AP_REQ, &output_token))
1245 goto cleanup;
1246
1247 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1248 {
1249 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1250 context->auth_ctx, (INT32*)&context->local_seq))
1251 goto cleanup;
1252 context->remote_seq ^= context->local_seq;
1253 }
1254
1255 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1256 &context->keyset))
1257 goto cleanup;
1258
1259 context->state = KERBEROS_STATE_AP_REP;
1260
1261 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1262 status = SEC_I_CONTINUE_NEEDED;
1263 else
1264 status = SEC_E_OK;
1265 break;
1266
1267 case KERBEROS_STATE_AP_REP:
1268
1269 if (tok_id == TOK_ID_AP_REP)
1270 {
1271 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1272 &reply))
1273 goto cleanup;
1274 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1275 }
1276 else if (tok_id == TOK_ID_ERROR)
1277 {
1278 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1279 goto cleanup;
1280 }
1281 else
1282 goto bad_token;
1283
1284 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1285 {
1286 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1287 context->auth_ctx, (INT32*)&context->remote_seq))
1288 goto cleanup;
1289 }
1290
1291 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1292 &context->keyset))
1293 goto cleanup;
1294
1295 context->state = KERBEROS_STATE_FINAL;
1296
1297 if (output_buffer)
1298 output_buffer->cbBuffer = 0;
1299 status = SEC_E_OK;
1300 break;
1301
1302 case KERBEROS_STATE_FINAL:
1303 default:
1304 WLog_ERR(TAG, "Kerberos in invalid state!");
1305 goto cleanup;
1306 }
1307
1308cleanup:
1309{
1310 /* second_ticket is not allocated */
1311 krb5_data edata = WINPR_C_ARRAY_INIT;
1312 in_creds.second_ticket = edata;
1313 krb5_free_cred_contents(credentials->ctx, &in_creds);
1314}
1315
1316 krb5_free_creds(credentials->ctx, creds);
1317 if (output_token.data)
1318 krb5glue_free_data_contents(credentials->ctx, &output_token);
1319
1320 winpr_Digest_Free(md5);
1321
1322 free(target);
1323
1324 if (isNewContext)
1325 {
1326 switch (status)
1327 {
1328 case SEC_E_OK:
1329 case SEC_I_CONTINUE_NEEDED:
1330 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1331 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1332 break;
1333 default:
1334 kerberos_ContextFree(context, TRUE);
1335 sspi_SecureHandleInvalidate(phNewContext);
1336 break;
1337 }
1338 }
1339
1340 return status;
1341
1342bad_token:
1343 status = SEC_E_INVALID_TOKEN;
1344 goto cleanup;
1345#else
1346 return SEC_E_UNSUPPORTED_FUNCTION;
1347#endif /* WITH_KRB5 */
1348}
1349
1350static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1351 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1352 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1353 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr, PTimeStamp ptsExpiry)
1354{
1355 SECURITY_STATUS status = 0;
1356 char* target_name = nullptr;
1357
1358 if (pszTargetName)
1359 {
1360 target_name = ConvertWCharToUtf8Alloc(pszTargetName, nullptr);
1361 if (!target_name)
1362 return SEC_E_INSUFFICIENT_MEMORY;
1363 }
1364
1365 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1366 Reserved1, TargetDataRep, pInput, Reserved2,
1367 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1368
1369 if (target_name)
1370 free(target_name);
1371
1372 return status;
1373}
1374
1375#ifdef WITH_KRB5
1376static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1377 krb5_creds* creds)
1378{
1379 BOOL ret = FALSE;
1380 krb5_kt_cursor cur = WINPR_C_ARRAY_INIT;
1381 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1382 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1383 goto cleanup;
1384
1385 do
1386 {
1387 krb5_error_code rv =
1388 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1389 if (rv == KRB5_KT_END)
1390 break;
1391 if (rv != 0)
1392 goto cleanup;
1393
1394 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1395 break;
1396 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1397 memset(&entry, 0, sizeof(entry));
1398 if (rv)
1399 goto cleanup;
1400 } while (1);
1401
1402 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1403 goto cleanup;
1404
1405 if (!entry.principal)
1406 goto cleanup;
1407
1408 /* Get the TGT */
1409 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1410 credentials->keytab, 0, nullptr, nullptr))
1411 goto cleanup;
1412
1413 ret = TRUE;
1414
1415cleanup:
1416 return ret;
1417}
1418
1419static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials, const char* target, krb5_creds* creds)
1420{
1421 BOOL ret = TRUE;
1422 krb5_principal target_princ = WINPR_C_ARRAY_INIT;
1423 char* default_realm = nullptr;
1424
1425 krb5_error_code rv =
1426 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1427 if (rv)
1428 return FALSE;
1429
1430#if defined(WITH_KRB5_HEIMDAL)
1431 if (!target_princ->realm)
1432 {
1433 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1434 if (rv)
1435 goto out;
1436
1437 target_princ->realm = default_realm;
1438 }
1439#else
1440 if (!target_princ->realm.length)
1441 {
1442 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1443 if (rv)
1444 goto out;
1445
1446 target_princ->realm.data = default_realm;
1447 target_princ->realm.length = (unsigned int)strlen(default_realm);
1448 }
1449#endif
1450
1451 /*
1452 * First try with the account service. We were requested with something like
1453 * TERMSRV/<host>@<realm>, let's see if we have that in our keytab and if we're able
1454 * to retrieve a TGT with that entry
1455 *
1456 */
1457 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1458 goto out;
1459
1460 ret = FALSE;
1461
1462#if defined(WITH_KRB5_MIT)
1463 /*
1464 * if it's not working let's try with <host>$@<REALM> (note the dollar)
1465 */
1466 {
1467 char hostDollar[300] = WINPR_C_ARRAY_INIT;
1468 if (target_princ->length < 2)
1469 goto out;
1470
1471 (void)snprintf(hostDollar, sizeof(hostDollar) - 1, "%s$@%s", target_princ->data[1].data,
1472 target_princ->realm.data);
1473 krb5_free_principal(credentials->ctx, target_princ);
1474
1475 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1476 if (rv)
1477 return FALSE;
1478 }
1479 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1480#endif
1481
1482out:
1483 if (default_realm)
1484 krb5_free_default_realm(credentials->ctx, default_realm);
1485
1486 krb5_free_principal(credentials->ctx, target_princ);
1487 return ret;
1488}
1489#endif
1490
1491static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1492 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1493 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG fContextReq,
1494 WINPR_ATTR_UNUSED ULONG TargetDataRep, WINPR_ATTR_UNUSED PCtxtHandle phNewContext,
1495 WINPR_ATTR_UNUSED PSecBufferDesc pOutput, WINPR_ATTR_UNUSED ULONG* pfContextAttr,
1496 WINPR_ATTR_UNUSED PTimeStamp ptsExpity)
1497{
1498#ifdef WITH_KRB5
1499 BOOL isNewContext = FALSE;
1500 PSecBuffer input_buffer = nullptr;
1501 PSecBuffer output_buffer = nullptr;
1502 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1503 uint16_t tok_id = 0;
1504 krb5_data input_token = WINPR_C_ARRAY_INIT;
1505 krb5_data output_token = WINPR_C_ARRAY_INIT;
1506 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1507 krb5_flags ap_flags = 0;
1508 krb5glue_authenticator authenticator = nullptr;
1509 char* target = nullptr;
1510 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1511 krb5_creds creds = WINPR_C_ARRAY_INIT;
1512
1513 /* behave like windows SSPIs that don't want empty context */
1514 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1515 return SEC_E_INVALID_HANDLE;
1516
1517 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1518 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1519
1520 if (pInput)
1521 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1522 if (pOutput)
1523 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1524
1525 if (!input_buffer)
1526 return SEC_E_INVALID_TOKEN;
1527
1528 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1529 return SEC_E_INVALID_TOKEN;
1530
1531 if (!context)
1532 {
1533 isNewContext = TRUE;
1534 context = kerberos_ContextNew(credentials);
1535 context->acceptor = TRUE;
1536
1537 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1538 {
1539 context->u2u = TRUE;
1540 context->state = KERBEROS_STATE_TGT_REQ;
1541 }
1542 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1543 context->state = KERBEROS_STATE_AP_REQ;
1544 else
1545 goto bad_token;
1546 }
1547 else
1548 {
1549 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1550 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1551 goto bad_token;
1552 }
1553
1554 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1555 {
1556 if (!kerberos_rd_tgt_token(&input_token, &target, nullptr))
1557 goto bad_token;
1558
1559 if (!retrieveSomeTgt(credentials, target, &creds))
1560 goto cleanup;
1561
1562 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, nullptr, nullptr, &creds.ticket))
1563 goto cleanup;
1564
1565 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1566 goto cleanup;
1567
1568 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1569 &krb5glue_creds_getkey(creds)))
1570 goto cleanup;
1571
1572 context->state = KERBEROS_STATE_AP_REQ;
1573 }
1574 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1575 {
1576 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, nullptr,
1577 credentials->keytab, &ap_flags, nullptr))
1578 goto cleanup;
1579
1580 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1581 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1582 goto cleanup;
1583
1584 /* Retrieve and validate the checksum */
1585 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1586 &authenticator))
1587 goto cleanup;
1588 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1589 &context->flags))
1590 goto bad_token;
1591
1592 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1593 {
1594 if (!output_buffer)
1595 goto bad_token;
1596 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1597 goto cleanup;
1598 if (!sspi_gss_wrap_token(output_buffer,
1599 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1600 TOK_ID_AP_REP, &output_token))
1601 goto cleanup;
1602 }
1603 else
1604 {
1605 if (output_buffer)
1606 output_buffer->cbBuffer = 0;
1607 }
1608
1609 *pfContextAttr = (context->flags & 0x1F);
1610 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1611 *pfContextAttr |= ASC_RET_INTEGRITY;
1612
1613 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1614 {
1615 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1616 (INT32*)&context->local_seq))
1617 goto cleanup;
1618 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1619 (INT32*)&context->remote_seq))
1620 goto cleanup;
1621 }
1622
1623 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1624 &context->keyset))
1625 goto cleanup;
1626
1627 context->state = KERBEROS_STATE_FINAL;
1628 }
1629 else
1630 goto bad_token;
1631
1632 /* On first call allocate new context */
1633 if (context->state == KERBEROS_STATE_FINAL)
1634 status = SEC_E_OK;
1635 else
1636 status = SEC_I_CONTINUE_NEEDED;
1637
1638cleanup:
1639 free(target);
1640 if (output_token.data)
1641 krb5glue_free_data_contents(credentials->ctx, &output_token);
1642 if (entry.principal)
1643 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1644
1645 if (isNewContext)
1646 {
1647 switch (status)
1648 {
1649 case SEC_E_OK:
1650 case SEC_I_CONTINUE_NEEDED:
1651 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1652 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1653 break;
1654 default:
1655 kerberos_ContextFree(context, TRUE);
1656 sspi_SecureHandleInvalidate(phNewContext);
1657 break;
1658 }
1659 }
1660
1661 return status;
1662
1663bad_token:
1664 status = SEC_E_INVALID_TOKEN;
1665 goto cleanup;
1666#else
1667 return SEC_E_UNSUPPORTED_FUNCTION;
1668#endif /* WITH_KRB5 */
1669}
1670
1671#ifdef WITH_KRB5
1672static KRB_CONTEXT* get_context(PCtxtHandle phContext)
1673{
1674 if (!phContext)
1675 return nullptr;
1676
1677 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1678 if (!name)
1679 return nullptr;
1680
1681 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1682 return nullptr;
1683 return sspi_SecureHandleGetLowerPointer(phContext);
1684}
1685
1686static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1687{
1688 WINPR_ASSERT(data);
1689 WINPR_ASSERT(ptr);
1690 WINPR_ASSERT(psize);
1691
1692 *ptr = (PUCHAR)malloc(data->length);
1693 if (!*ptr)
1694 return FALSE;
1695
1696 *psize = data->length;
1697 memcpy(*ptr, data->data, data->length);
1698 return TRUE;
1699}
1700#endif
1701
1702static SECURITY_STATUS
1703 SEC_ENTRY kerberos_DeleteSecurityContext(WINPR_ATTR_UNUSED PCtxtHandle phContext)
1704{
1705#ifdef WITH_KRB5
1706 KRB_CONTEXT* context = get_context(phContext);
1707 sspi_SecureHandleInvalidate(phContext);
1708 if (!context)
1709 return SEC_E_INVALID_HANDLE;
1710
1711 kerberos_ContextFree(context, TRUE);
1712
1713 return SEC_E_OK;
1714#else
1715 return SEC_E_UNSUPPORTED_FUNCTION;
1716#endif
1717}
1718
1719#ifdef WITH_KRB5
1720
1721static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1722{
1723 switch (code)
1724 {
1725 case 0:
1726 return SEC_E_OK;
1727 default:
1728 return SEC_E_INTERNAL_ERROR;
1729 }
1730}
1731
1732static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1733 SecPkgContext_Sizes* ContextSizes)
1734{
1735 UINT header = 0;
1736 UINT pad = 0;
1737 UINT trailer = 0;
1738 krb5glue_key key = nullptr;
1739
1740 WINPR_ASSERT(context);
1741 WINPR_ASSERT(context->auth_ctx);
1742
1743 /* The MaxTokenSize by default is 12,000 bytes. This has been the default value
1744 * since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2.
1745 * For Windows Server 2012, the default value of the MaxTokenSize registry
1746 * entry is 48,000 bytes.*/
1747 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1748 ContextSizes->cbMaxSignature = 0;
1749 ContextSizes->cbBlockSize = 1;
1750 ContextSizes->cbSecurityTrailer = 0;
1751
1752 key = get_key(&context->keyset);
1753
1754 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1755 {
1756 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1757 KRB5_CRYPTO_TYPE_HEADER, &header);
1758 if (rv)
1759 return krb5_error_to_SECURITY_STATUS(rv);
1760
1761 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1762 &pad);
1763 if (rv)
1764 return krb5_error_to_SECURITY_STATUS(rv);
1765
1766 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1767 &trailer);
1768 if (rv)
1769 return krb5_error_to_SECURITY_STATUS(rv);
1770
1771 /* GSS header (= 16 bytes) + encrypted header = 32 bytes */
1772 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1773 }
1774
1775 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1776 {
1777 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1778 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1779 if (rv)
1780 return krb5_error_to_SECURITY_STATUS(rv);
1781
1782 ContextSizes->cbMaxSignature += 16;
1783 }
1784
1785 return SEC_E_OK;
1786}
1787
1788static SECURITY_STATUS kerberos_ATTR_AUTH_IDENTITY(KRB_CONTEXT* context,
1789 KRB_CREDENTIALS* credentials,
1790 SecPkgContext_AuthIdentity* AuthIdentity)
1791{
1792 const SecPkgContext_AuthIdentity empty = WINPR_C_ARRAY_INIT;
1793
1794 WINPR_ASSERT(context);
1795 WINPR_ASSERT(context->auth_ctx);
1796 WINPR_ASSERT(credentials);
1797
1798 WINPR_ASSERT(AuthIdentity);
1799 *AuthIdentity = empty;
1800
1801 krb5glue_authenticator authenticator = nullptr;
1802 krb5_error_code rv = krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx,
1803 context->auth_ctx, &authenticator);
1804 if (rv)
1805 goto fail;
1806
1807 {
1808 rv = -1;
1809
1810#if defined(WITH_KRB5_HEIMDAL)
1811 const Realm data = authenticator->crealm;
1812 if (!data)
1813 goto fail;
1814 const size_t data_len = length_Realm(&data);
1815#else
1816 krb5_data* realm_data = krb5_princ_realm(credentials->ctx, authenticator->client);
1817 if (!realm_data)
1818 goto fail;
1819 const char* data = realm_data->data;
1820 if (!data)
1821 goto fail;
1822 const size_t data_len = realm_data->length;
1823#endif
1824
1825 if (data_len > (sizeof(AuthIdentity->Domain) - 1))
1826 goto fail;
1827 strncpy(AuthIdentity->Domain, data, data_len);
1828 }
1829
1830 {
1831#if defined(WITH_KRB5_HEIMDAL)
1832 const PrincipalName* principal = &authenticator->cname;
1833 const size_t name_length = length_PrincipalName(principal);
1834 if (!principal->name_string.val)
1835 goto fail;
1836 const char* name = *principal->name_string.val;
1837#else
1838 char* name = nullptr;
1839 rv = krb_log_exec(krb5_unparse_name_flags, credentials->ctx, authenticator->client,
1840 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
1841 if (rv)
1842 goto fail;
1843
1844 const size_t name_length = strlen(name);
1845#endif
1846
1847 const bool ok = (name_length <= (sizeof(AuthIdentity->User) - 1));
1848 if (ok)
1849 strncpy(AuthIdentity->User, name, name_length);
1850
1851 rv = ok ? 0 : -1;
1852
1853#if !defined(WITH_KRB5_HEIMDAL)
1854 krb5_free_unparsed_name(credentials->ctx, name);
1855#endif
1856 }
1857
1858fail:
1859 krb5glue_free_authenticator(credentials->ctx, authenticator);
1860 return krb5_error_to_SECURITY_STATUS(rv);
1861}
1862
1863static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_A(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1864 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1865 SecPkgContext_PackageInfoA* PackageInfo)
1866{
1867 size_t size = sizeof(SecPkgInfoA);
1868 SecPkgInfoA* pPackageInfo =
1869 (SecPkgInfoA*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1870
1871 if (!pPackageInfo)
1872 return SEC_E_INSUFFICIENT_MEMORY;
1873
1874 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoA.fCapabilities;
1875 pPackageInfo->wVersion = KERBEROS_SecPkgInfoA.wVersion;
1876 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoA.wRPCID;
1877 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1878 pPackageInfo->Name = _strdup(KERBEROS_SecPkgInfoA.Name);
1879 pPackageInfo->Comment = _strdup(KERBEROS_SecPkgInfoA.Comment);
1880
1881 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1882 {
1883 sspi_ContextBufferFree(pPackageInfo);
1884 return SEC_E_INSUFFICIENT_MEMORY;
1885 }
1886 PackageInfo->PackageInfo = pPackageInfo;
1887 return SEC_E_OK;
1888}
1889
1890static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_W(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1891 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1892 SecPkgContext_PackageInfoW* PackageInfo)
1893{
1894 size_t size = sizeof(SecPkgInfoW);
1895 SecPkgInfoW* pPackageInfo =
1896 (SecPkgInfoW*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1897
1898 if (!pPackageInfo)
1899 return SEC_E_INSUFFICIENT_MEMORY;
1900
1901 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoW.fCapabilities;
1902 pPackageInfo->wVersion = KERBEROS_SecPkgInfoW.wVersion;
1903 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoW.wRPCID;
1904 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoW.cbMaxToken;
1905 pPackageInfo->Name = _wcsdup(KERBEROS_SecPkgInfoW.Name);
1906 pPackageInfo->Comment = _wcsdup(KERBEROS_SecPkgInfoW.Comment);
1907
1908 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1909 {
1910 sspi_ContextBufferFree(pPackageInfo);
1911 return SEC_E_INSUFFICIENT_MEMORY;
1912 }
1913 PackageInfo->PackageInfo = pPackageInfo;
1914 return SEC_E_OK;
1915}
1916
1917static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
1918 KRB_CREDENTIALS* credentials,
1919 KERB_TICKET_LOGON* ticketLogon)
1920{
1921 krb5_creds matchCred = WINPR_C_ARRAY_INIT;
1922 krb5_auth_context authContext = nullptr;
1923 krb5_flags getCredsFlags = KRB5_GC_CACHED;
1924 BOOL firstRun = TRUE;
1925 krb5_creds* hostCred = nullptr;
1926 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
1927 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost, "HOST",
1928 KRB5_NT_SRV_HST, &matchCred.server);
1929 if (rv)
1930 goto out;
1931
1932 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1933 &matchCred.client);
1934 if (rv)
1935 goto out;
1936
1937 /* try from the cache first, and then do a new request */
1938again:
1939 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
1940 &matchCred, &hostCred);
1941 switch (rv)
1942 {
1943 case 0:
1944 break;
1945 case KRB5_CC_NOTFOUND:
1946 getCredsFlags = 0;
1947 if (firstRun)
1948 {
1949 firstRun = FALSE;
1950 goto again;
1951 }
1952 WINPR_FALLTHROUGH
1953 default:
1954 WLog_ERR(TAG, "krb5_get_credentials(hostCreds), rv=%d", rv);
1955 goto out;
1956 }
1957
1958 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
1959 goto out;
1960
1961 {
1962 krb5_data derOut = WINPR_C_ARRAY_INIT;
1963 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
1964 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
1965 {
1966 ret = SEC_E_LOGON_DENIED;
1967 goto out;
1968 }
1969
1970 ticketLogon->MessageType = KerbTicketLogon;
1971 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
1972
1973 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
1974 &ticketLogon->ServiceTicketLength))
1975 {
1976 krb5_free_data(credentials->ctx, &derOut);
1977 goto out;
1978 }
1979
1980 ticketLogon->TicketGrantingTicketLength = derOut.length;
1981 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
1982 }
1983
1984 ret = SEC_E_OK;
1985out:
1986 krb5_auth_con_free(credentials->ctx, authContext);
1987 krb5_free_creds(credentials->ctx, hostCred);
1988 krb5_free_cred_contents(credentials->ctx, &matchCred);
1989 return ret;
1990}
1991
1992#endif /* WITH_KRB5 */
1993
1994WINPR_ATTR_NODISCARD
1995static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesCommon(
1996 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
1997{
1998 if (!phContext)
1999 return SEC_E_INVALID_HANDLE;
2000
2001 if (!pBuffer)
2002 return SEC_E_INVALID_PARAMETER;
2003
2004#ifdef WITH_KRB5
2005 KRB_CONTEXT* context = get_context(phContext);
2006 if (!context)
2007 return SEC_E_INVALID_PARAMETER;
2008
2009 KRB_CREDENTIALS* credentials = context->credentials;
2010
2011 switch (ulAttribute)
2012 {
2013 case SECPKG_ATTR_SIZES:
2014 return kerberos_ATTR_SIZES(context, credentials, (SecPkgContext_Sizes*)pBuffer);
2015
2016 case SECPKG_ATTR_AUTH_IDENTITY:
2017 return kerberos_ATTR_AUTH_IDENTITY(context, credentials,
2018 (SecPkgContext_AuthIdentity*)pBuffer);
2019
2020 case SECPKG_CRED_ATTR_TICKET_LOGON:
2021 return kerberos_ATTR_TICKET_LOGON(context, credentials, (KERB_TICKET_LOGON*)pBuffer);
2022
2023 default:
2024 WLog_ERR(TAG, "TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
2025 ulAttribute);
2026 return SEC_E_UNSUPPORTED_FUNCTION;
2027 }
2028#else
2029 return SEC_E_UNSUPPORTED_FUNCTION;
2030#endif
2031}
2032
2033static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(
2034 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2035{
2036 if (!phContext)
2037 return SEC_E_INVALID_HANDLE;
2038
2039 if (!pBuffer)
2040 return SEC_E_INVALID_PARAMETER;
2041
2042#ifdef WITH_KRB5
2043 KRB_CONTEXT* context = get_context(phContext);
2044 if (!context)
2045 return SEC_E_INVALID_PARAMETER;
2046
2047 KRB_CREDENTIALS* credentials = context->credentials;
2048
2049 switch (ulAttribute)
2050 {
2051 case SECPKG_ATTR_PACKAGE_INFO:
2052 return kerberos_ATTR_PACKAGE_INFO_A(context, credentials,
2053 (SecPkgContext_PackageInfoA*)pBuffer);
2054 default:
2055 break;
2056 }
2057#endif
2058 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2059}
2060
2061static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(PCtxtHandle phContext,
2062 ULONG ulAttribute, void* pBuffer)
2063{
2064 if (!phContext)
2065 return SEC_E_INVALID_HANDLE;
2066
2067 if (!pBuffer)
2068 return SEC_E_INVALID_PARAMETER;
2069
2070#ifdef WITH_KRB5
2071 KRB_CONTEXT* context = get_context(phContext);
2072 if (!context)
2073 return SEC_E_INVALID_PARAMETER;
2074
2075 KRB_CREDENTIALS* credentials = context->credentials;
2076
2077 switch (ulAttribute)
2078 {
2079 case SECPKG_ATTR_PACKAGE_INFO:
2080 return kerberos_ATTR_PACKAGE_INFO_W(context, credentials,
2081 (SecPkgContext_PackageInfoW*)pBuffer);
2082 default:
2083 break;
2084 }
2085#endif
2086 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2087}
2088
2089static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
2090 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2091 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2092{
2093 return SEC_E_UNSUPPORTED_FUNCTION;
2094}
2095
2096static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
2097 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2098 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2099{
2100 return SEC_E_UNSUPPORTED_FUNCTION;
2101}
2102
2103static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(
2104 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
2105 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer,
2106 WINPR_ATTR_UNUSED BOOL unicode)
2107{
2108#ifdef WITH_KRB5
2109 KRB_CREDENTIALS* credentials = nullptr;
2110
2111 if (!phCredential)
2112 return SEC_E_INVALID_HANDLE;
2113
2114 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
2115
2116 if (!credentials)
2117 return SEC_E_INVALID_HANDLE;
2118
2119 if (!pBuffer)
2120 return SEC_E_INSUFFICIENT_MEMORY;
2121
2122 switch (ulAttribute)
2123 {
2124 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
2125 {
2126 SecPkgCredentials_KdcProxySettingsW* kdc_settings = pBuffer;
2127
2128 /* Sanity checks */
2129 if (cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2130 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
2131 kdc_settings->ProxyServerOffset < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2132 cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) +
2133 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
2134 return SEC_E_INVALID_TOKEN;
2135
2136 if (credentials->kdc_url)
2137 {
2138 free(credentials->kdc_url);
2139 credentials->kdc_url = nullptr;
2140 }
2141
2142 if (kdc_settings->ProxyServerLength > 0)
2143 {
2144 WCHAR* proxy = (WCHAR*)((BYTE*)pBuffer + kdc_settings->ProxyServerOffset);
2145
2146 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
2147 proxy, kdc_settings->ProxyServerLength / sizeof(WCHAR), nullptr);
2148 if (!credentials->kdc_url)
2149 return SEC_E_INSUFFICIENT_MEMORY;
2150 }
2151
2152 return SEC_E_OK;
2153 }
2154 case SECPKG_CRED_ATTR_NAMES:
2155 case SECPKG_ATTR_SUPPORTED_ALGS:
2156 default:
2157 WLog_ERR(TAG, "TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
2158 ulAttribute);
2159 return SEC_E_UNSUPPORTED_FUNCTION;
2160 }
2161
2162#else
2163 return SEC_E_UNSUPPORTED_FUNCTION;
2164#endif
2165}
2166
2167static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(PCredHandle phCredential,
2168 ULONG ulAttribute,
2169 void* pBuffer, ULONG cbBuffer)
2170{
2171 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
2172}
2173
2174static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(PCredHandle phCredential,
2175 ULONG ulAttribute,
2176 void* pBuffer, ULONG cbBuffer)
2177{
2178 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
2179}
2180
2181static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2182 WINPR_ATTR_UNUSED ULONG fQOP,
2183 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2184 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2185{
2186#ifdef WITH_KRB5
2187 KRB_CONTEXT* context = get_context(phContext);
2188 PSecBuffer sig_buffer = nullptr;
2189 PSecBuffer data_buffer = nullptr;
2190 char* header = nullptr;
2191 BYTE flags = 0;
2192 krb5glue_key key = nullptr;
2193 krb5_keyusage usage = 0;
2194 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2195 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2196 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2197 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2198 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2199
2200 if (!context)
2201 return SEC_E_INVALID_HANDLE;
2202
2203 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2204 return SEC_E_UNSUPPORTED_FUNCTION;
2205
2206 KRB_CREDENTIALS* creds = context->credentials;
2207
2208 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2209 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2210
2211 if (!sig_buffer || !data_buffer)
2212 return SEC_E_INVALID_TOKEN;
2213
2214 if (fQOP)
2215 return SEC_E_QOP_NOT_SUPPORTED;
2216
2217 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2218 flags |= FLAG_WRAP_CONFIDENTIAL;
2219
2220 key = get_key(&context->keyset);
2221 if (!key)
2222 return SEC_E_INTERNAL_ERROR;
2223
2224 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2225
2226 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
2227
2228 /* Set the lengths of the data (plaintext + header) */
2229 encrypt_iov[1].data.length = data_buffer->cbBuffer;
2230 encrypt_iov[2].data.length = 16;
2231
2232 /* Get the lengths of the header, trailer, and padding and ensure sig_buffer is large enough */
2233 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
2234 ARRAYSIZE(encrypt_iov)))
2235 return SEC_E_INTERNAL_ERROR;
2236 if (sig_buffer->cbBuffer <
2237 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
2238 return SEC_E_INSUFFICIENT_MEMORY;
2239
2240 /* Set up the iov array in sig_buffer */
2241 header = sig_buffer->pvBuffer;
2242 encrypt_iov[2].data.data = header + 16;
2243 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
2244 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
2245 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
2246 encrypt_iov[1].data.data = data_buffer->pvBuffer;
2247
2248 /* Write the GSS header with 0 in RRC */
2249 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
2250 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2251 header[3] = (char)0xFF;
2252 winpr_Data_Write_UINT32(header + 4, 0);
2253 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2254
2255 /* Copy header to be encrypted */
2256 CopyMemory(encrypt_iov[2].data.data, header, 16);
2257
2258 /* Set the correct RRC */
2259 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
2260 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
2261
2262 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
2263 ARRAYSIZE(encrypt_iov)))
2264 return SEC_E_INTERNAL_ERROR;
2265
2266 return SEC_E_OK;
2267#else
2268 return SEC_E_UNSUPPORTED_FUNCTION;
2269#endif
2270}
2271
2272static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2273 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2274 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2275 WINPR_ATTR_UNUSED ULONG* pfQOP)
2276{
2277#ifdef WITH_KRB5
2278 KRB_CONTEXT* context = get_context(phContext);
2279 if (!context)
2280 return SEC_E_INVALID_HANDLE;
2281
2282 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2283 return SEC_E_UNSUPPORTED_FUNCTION;
2284
2285 KRB_CREDENTIALS* creds = context->credentials;
2286
2287 const PSecBuffer sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2288 PSecBuffer data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2289
2290 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2291 return SEC_E_INVALID_TOKEN;
2292
2293 /* Read in header information */
2294 const BYTE* header = sig_buffer->pvBuffer;
2295 const uint16_t tok_id = winpr_Data_Get_UINT16_BE(header);
2296 const BYTE flags = header[2];
2297 const uint16_t ec = winpr_Data_Get_UINT16_BE(&header[4]);
2298 const uint16_t rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2299 const uint64_t seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2300
2301 /* Check that the header is valid */
2302 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2303 return SEC_E_INVALID_TOKEN;
2304
2305 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2306 return SEC_E_INVALID_TOKEN;
2307
2308 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2309 (seq_no != context->remote_seq + MessageSeqNo))
2310 return SEC_E_OUT_OF_SEQUENCE;
2311
2312 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2313 return SEC_E_INVALID_TOKEN;
2314
2315 /* We don't expect a trailer buffer; the encrypted header must be rotated */
2316 if (rrc < 16)
2317 return SEC_E_INVALID_TOKEN;
2318
2319 /* Find the proper key and key usage */
2320 krb5glue_key key = get_key(&context->keyset);
2321 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2322 return SEC_E_INTERNAL_ERROR;
2323 krb5_keyusage usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2324
2325 /* Fill in the lengths of the iov array */
2326 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2327 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2328 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2329 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2330 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2331 iov[1].data.length = data_buffer->cbBuffer;
2332 iov[2].data.length = 16;
2333 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2334 return SEC_E_INTERNAL_ERROR;
2335
2336 /* We don't expect a trailer buffer; everything must be in sig_buffer */
2337 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2338 return SEC_E_INVALID_TOKEN;
2339 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2340 return SEC_E_INVALID_TOKEN;
2341
2342 /* Locate the parts of the message */
2343 const size_t iov0Offset = 16ull + rrc + ec;
2344 if (iov0Offset + iov[0].data.length > sig_buffer->cbBuffer)
2345 return SEC_E_INVALID_TOKEN;
2346
2347 const size_t iov2Offset = 16ull + ec;
2348 if (iov2Offset + iov[2].data.length > sig_buffer->cbBuffer)
2349 return SEC_E_INVALID_TOKEN;
2350
2351 iov[0].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov0Offset], char*);
2352 iov[1].data.data = data_buffer->pvBuffer;
2353 iov[2].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov2Offset], char*);
2354 char* data2 = iov[2].data.data;
2355 iov[3].data.data = &data2[iov[2].data.length];
2356
2357 char* data3 = iov[3].data.data;
2358 iov[4].data.data = &data3[iov[3].data.length];
2359
2360 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2361 return SEC_E_INTERNAL_ERROR;
2362
2363 /* Validate the encrypted header */
2364 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2365 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2366 if (memcmp(iov[2].data.data, header, 16) != 0)
2367 return SEC_E_MESSAGE_ALTERED;
2368
2369 *pfQOP = 0;
2370
2371 return SEC_E_OK;
2372#else
2373 return SEC_E_UNSUPPORTED_FUNCTION;
2374#endif
2375}
2376
2377static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2378 WINPR_ATTR_UNUSED ULONG fQOP,
2379 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2380 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2381{
2382#ifdef WITH_KRB5
2383 KRB_CONTEXT* context = get_context(phContext);
2384 PSecBuffer sig_buffer = nullptr;
2385 PSecBuffer data_buffer = nullptr;
2386 krb5glue_key key = nullptr;
2387 krb5_keyusage usage = 0;
2388 BYTE flags = 0;
2389 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2390 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2391 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2392
2393 if (!context)
2394 return SEC_E_INVALID_HANDLE;
2395
2396 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2397 return SEC_E_UNSUPPORTED_FUNCTION;
2398
2399 KRB_CREDENTIALS* creds = context->credentials;
2400
2401 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2402 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2403
2404 if (!sig_buffer || !data_buffer)
2405 return SEC_E_INVALID_TOKEN;
2406
2407 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2408
2409 key = get_key(&context->keyset);
2410 if (!key)
2411 return SEC_E_INTERNAL_ERROR;
2412 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2413
2414 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2415
2416 /* Fill in the lengths of the iov array */
2417 iov[0].data.length = data_buffer->cbBuffer;
2418 iov[1].data.length = 16;
2419 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2420 return SEC_E_INTERNAL_ERROR;
2421
2422 /* Ensure the buffer is big enough */
2423 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2424 return SEC_E_INSUFFICIENT_MEMORY;
2425
2426 /* Write the header */
2427 char* header = sig_buffer->pvBuffer;
2428 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2429 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2430 memset(header + 3, 0xFF, 5);
2431 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2432
2433 /* Set up the iov array */
2434 iov[0].data.data = data_buffer->pvBuffer;
2435 iov[1].data.data = header;
2436 iov[2].data.data = header + 16;
2437
2438 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2439 return SEC_E_INTERNAL_ERROR;
2440
2441 sig_buffer->cbBuffer = iov[2].data.length + 16;
2442
2443 return SEC_E_OK;
2444#else
2445 return SEC_E_UNSUPPORTED_FUNCTION;
2446#endif
2447}
2448
2449static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2450 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2451 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2452 WINPR_ATTR_UNUSED ULONG* pfQOP)
2453{
2454#ifdef WITH_KRB5
2455 PSecBuffer sig_buffer = nullptr;
2456 PSecBuffer data_buffer = nullptr;
2457 krb5glue_key key = nullptr;
2458 krb5_keyusage usage = 0;
2459 BYTE flags = 0;
2460 uint16_t tok_id = 0;
2461 uint64_t seq_no = 0;
2462 krb5_boolean is_valid = 0;
2463 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2464 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2465 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2466 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2467
2468 KRB_CONTEXT* context = get_context(phContext);
2469 if (!context)
2470 return SEC_E_INVALID_HANDLE;
2471
2472 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2473 return SEC_E_UNSUPPORTED_FUNCTION;
2474
2475 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2476 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2477
2478 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2479 return SEC_E_INVALID_TOKEN;
2480
2481 /* Read in header info */
2482 BYTE* header = sig_buffer->pvBuffer;
2483 tok_id = winpr_Data_Get_UINT16_BE(header);
2484 flags = header[2];
2485 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2486
2487 /* Validate header */
2488 if (tok_id != TOK_ID_MIC)
2489 return SEC_E_INVALID_TOKEN;
2490
2491 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2492 return SEC_E_INVALID_TOKEN;
2493
2494 if (memcmp(header + 3, cmp_filler, sizeof(cmp_filler)) != 0)
2495 return SEC_E_INVALID_TOKEN;
2496
2497 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2498 return SEC_E_OUT_OF_SEQUENCE;
2499
2500 /* Find the proper key and usage */
2501 key = get_key(&context->keyset);
2502 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2503 return SEC_E_INTERNAL_ERROR;
2504 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2505
2506 /* Fill in the iov array lengths */
2507 KRB_CREDENTIALS* creds = context->credentials;
2508 iov[0].data.length = data_buffer->cbBuffer;
2509 iov[1].data.length = 16;
2510 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2511 return SEC_E_INTERNAL_ERROR;
2512
2513 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2514 return SEC_E_INTERNAL_ERROR;
2515
2516 /* Set up the iov array */
2517 iov[0].data.data = data_buffer->pvBuffer;
2518 iov[1].data.data = (char*)header;
2519 iov[2].data.data = (char*)&header[16];
2520
2521 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2522 &is_valid))
2523 return SEC_E_INTERNAL_ERROR;
2524
2525 if (!is_valid)
2526 return SEC_E_MESSAGE_ALTERED;
2527
2528 return SEC_E_OK;
2529#else
2530 return SEC_E_UNSUPPORTED_FUNCTION;
2531#endif
2532}
2533
2534const SecurityFunctionTableA KERBEROS_SecurityFunctionTableA = {
2535 3, /* dwVersion */
2536 nullptr, /* EnumerateSecurityPackages */
2537 kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
2538 kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
2539 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2540 nullptr, /* Reserved2 */
2541 kerberos_InitializeSecurityContextA, /* InitializeSecurityContext */
2542 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2543 nullptr, /* CompleteAuthToken */
2544 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2545 nullptr, /* ApplyControlToken */
2546 kerberos_QueryContextAttributesA, /* QueryContextAttributes */
2547 nullptr, /* ImpersonateSecurityContext */
2548 nullptr, /* RevertSecurityContext */
2549 kerberos_MakeSignature, /* MakeSignature */
2550 kerberos_VerifySignature, /* VerifySignature */
2551 nullptr, /* FreeContextBuffer */
2552 nullptr, /* QuerySecurityPackageInfo */
2553 nullptr, /* Reserved3 */
2554 nullptr, /* Reserved4 */
2555 nullptr, /* ExportSecurityContext */
2556 nullptr, /* ImportSecurityContext */
2557 nullptr, /* AddCredentials */
2558 nullptr, /* Reserved8 */
2559 nullptr, /* QuerySecurityContextToken */
2560 kerberos_EncryptMessage, /* EncryptMessage */
2561 kerberos_DecryptMessage, /* DecryptMessage */
2562 kerberos_SetContextAttributesA, /* SetContextAttributes */
2563 kerberos_SetCredentialsAttributesA, /* SetCredentialsAttributes */
2564};
2565
2566const SecurityFunctionTableW KERBEROS_SecurityFunctionTableW = {
2567 3, /* dwVersion */
2568 nullptr, /* EnumerateSecurityPackages */
2569 kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
2570 kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
2571 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2572 nullptr, /* Reserved2 */
2573 kerberos_InitializeSecurityContextW, /* InitializeSecurityContext */
2574 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2575 nullptr, /* CompleteAuthToken */
2576 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2577 nullptr, /* ApplyControlToken */
2578 kerberos_QueryContextAttributesW, /* QueryContextAttributes */
2579 nullptr, /* ImpersonateSecurityContext */
2580 nullptr, /* RevertSecurityContext */
2581 kerberos_MakeSignature, /* MakeSignature */
2582 kerberos_VerifySignature, /* VerifySignature */
2583 nullptr, /* FreeContextBuffer */
2584 nullptr, /* QuerySecurityPackageInfo */
2585 nullptr, /* Reserved3 */
2586 nullptr, /* Reserved4 */
2587 nullptr, /* ExportSecurityContext */
2588 nullptr, /* ImportSecurityContext */
2589 nullptr, /* AddCredentials */
2590 nullptr, /* Reserved8 */
2591 nullptr, /* QuerySecurityContextToken */
2592 kerberos_EncryptMessage, /* EncryptMessage */
2593 kerberos_DecryptMessage, /* DecryptMessage */
2594 kerberos_SetContextAttributesW, /* SetContextAttributes */
2595 kerberos_SetCredentialsAttributesW, /* SetCredentialsAttributes */
2596};
2597
2598BOOL KERBEROS_init(void)
2599{
2600 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2601 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2602 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2603 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));
2604 return TRUE;
2605}
KERB_TICKET_LOGON
Definition secapi.h:51
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349
SecPkgContext_AuthIdentity
Definition include/winpr/sspi.h:1505
SecPkgContext_PackageInfoA
Definition include/winpr/sspi.h:416
SecPkgContext_PackageInfoW
Definition include/winpr/sspi.h:421
SecPkgContext_Sizes
Definition include/winpr/sspi.h:450
SecPkgCredentials_KdcProxySettingsW
Definition include/winpr/sspi.h:548
WinPrAsn1_MemoryChunk
Definition asn1.h:92
krb5glue_keyset
Definition krb5glue.h:92
sspi_gss_data
Definition sspi_gss.h:36
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:816