FreeRDP
Loading...
Searching...
No Matches
kerberos.c
1
22#include <winpr/config.h>
23
24#include <stdio.h>
25#include <stdlib.h>
26#include <string.h>
27#include <errno.h>
28#include <fcntl.h>
29#include <ctype.h>
30
31#include <winpr/assert.h>
32#include <winpr/cast.h>
33#include <winpr/asn1.h>
34#include <winpr/crt.h>
35#include <winpr/interlocked.h>
36#include <winpr/sspi.h>
37#include <winpr/print.h>
38#include <winpr/tchar.h>
39#include <winpr/sysinfo.h>
40#include <winpr/registry.h>
41#include <winpr/endian.h>
42#include <winpr/crypto.h>
43#include <winpr/path.h>
44#include <winpr/wtypes.h>
45#include <winpr/winsock.h>
46#include <winpr/schannel.h>
47#include <winpr/secapi.h>
48
49#include "kerberos.h"
50
51#ifdef WITH_KRB5_MIT
52#include "krb5glue.h"
53#include <profile.h>
54#endif
55
56#ifdef WITH_KRB5_HEIMDAL
57#include "krb5glue.h"
58#include <krb5-protos.h>
59#endif
60
61#include "../sspi.h"
62#include "../../log.h"
63#define TAG WINPR_TAG("sspi.Kerberos")
64
65#define KRB_TGT_REQ 16
66#define KRB_TGT_REP 17
67
68const SecPkgInfoA KERBEROS_SecPkgInfoA = {
69 0x000F3BBF, /* fCapabilities */
70 1, /* wVersion */
71 0x0010, /* wRPCID */
72 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
73 "Kerberos", /* Name */
74 "Kerberos Security Package" /* Comment */
75};
76
77static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = { 0 };
78static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = { 0 };
79
80const SecPkgInfoW KERBEROS_SecPkgInfoW = {
81 0x000F3BBF, /* fCapabilities */
82 1, /* wVersion */
83 0x0010, /* wRPCID */
84 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
85 KERBEROS_SecPkgInfoW_NameBuffer, /* Name */
86 KERBEROS_SecPkgInfoW_CommentBuffer /* Comment */
87};
88
89#ifdef WITH_KRB5
90
91enum KERBEROS_STATE
92{
93 KERBEROS_STATE_INITIAL,
94 KERBEROS_STATE_TGT_REQ,
95 KERBEROS_STATE_TGT_REP,
96 KERBEROS_STATE_AP_REQ,
97 KERBEROS_STATE_AP_REP,
98 KERBEROS_STATE_FINAL
99};
100
101typedef struct KRB_CREDENTIALS_st
102{
103 volatile LONG refCount;
104 krb5_context ctx;
105 char* kdc_url;
106 krb5_ccache ccache;
107 krb5_keytab keytab;
108 krb5_keytab client_keytab;
109 BOOL own_ccache;
110} KRB_CREDENTIALS;
111
112struct s_KRB_CONTEXT
113{
114 enum KERBEROS_STATE state;
115 KRB_CREDENTIALS* credentials;
116 krb5_auth_context auth_ctx;
117 BOOL acceptor;
118 uint32_t flags;
119 uint64_t local_seq;
120 uint64_t remote_seq;
121 struct krb5glue_keyset keyset;
122 BOOL u2u;
123 char* targetHost;
124};
125
126static const WinPrAsn1_OID kerberos_OID = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
127static const WinPrAsn1_OID kerberos_u2u_OID = { 10,
128 (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
129
130#define krb_log_exec(fkt, ctx, ...) \
131 kerberos_log_msg(ctx, fkt(ctx, ##__VA_ARGS__), #fkt, __FILE__, __func__, __LINE__)
132#define krb_log_exec_ptr(fkt, ctx, ...) \
133 kerberos_log_msg(*ctx, fkt(ctx, ##__VA_ARGS__), #fkt, __FILE__, __func__, __LINE__)
134static krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code, const char* what,
135 const char* file, const char* fkt, size_t line)
136{
137 switch (code)
138 {
139 case 0:
140 case KRB5_KT_END:
141 break;
142 default:
143 {
144 const DWORD level = WLOG_ERROR;
145
146 wLog* log = WLog_Get(TAG);
147 if (WLog_IsLevelActive(log, level))
148 {
149 const char* msg = krb5_get_error_message(ctx, code);
150 WLog_PrintMessage(log, WLOG_MESSAGE_TEXT, level, line, file, fkt, "%s (%s [%d])",
151 what, msg, code);
152 krb5_free_error_message(ctx, msg);
153 }
154 }
155 break;
156 }
157 return code;
158}
159
160static void credentials_unref(KRB_CREDENTIALS* credentials);
161
162static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
163{
164 if (!ctx)
165 return;
166
167 free(ctx->targetHost);
168 ctx->targetHost = NULL;
169
170 if (ctx->credentials)
171 {
172 krb5_context krbctx = ctx->credentials->ctx;
173 if (krbctx)
174 {
175 if (ctx->auth_ctx)
176 krb5_auth_con_free(krbctx, ctx->auth_ctx);
177
178 krb5glue_keys_free(krbctx, &ctx->keyset);
179 }
180
181 credentials_unref(ctx->credentials);
182 }
183
184 if (allocated)
185 free(ctx);
186}
187
188static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
189{
190 KRB_CONTEXT* context = NULL;
191
192 context = (KRB_CONTEXT*)calloc(1, sizeof(KRB_CONTEXT));
193 if (!context)
194 return NULL;
195
196 context->credentials = credentials;
197 InterlockedIncrement(&credentials->refCount);
198 return context;
199}
200
201static krb5_error_code krb5_prompter(krb5_context context, void* data,
202 WINPR_ATTR_UNUSED const char* name,
203 WINPR_ATTR_UNUSED const char* banner, int num_prompts,
204 krb5_prompt prompts[])
205{
206 for (int i = 0; i < num_prompts; i++)
207 {
208 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
209 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
210 {
211 prompts[i].reply->data = _strdup((const char*)data);
212
213 const size_t len = strlen((const char*)data);
214 if (len > UINT32_MAX)
215 return KRB5KRB_ERR_GENERIC;
216 prompts[i].reply->length = (UINT32)len;
217 }
218 }
219 return 0;
220}
221
222static INLINE krb5glue_key get_key(struct krb5glue_keyset* keyset)
223{
224 return keyset->acceptor_key ? keyset->acceptor_key
225 : keyset->initiator_key ? keyset->initiator_key
226 : keyset->session_key;
227}
228
229static BOOL isValidIPv4(const char* ipAddress)
230{
231 struct sockaddr_in sa = { 0 };
232 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
233 return result != 0;
234}
235
236static BOOL isValidIPv6(const char* ipAddress)
237{
238 struct sockaddr_in6 sa = { 0 };
239 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
240 return result != 0;
241}
242
243static BOOL isValidIP(const char* ipAddress)
244{
245 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
246}
247
248#if defined(WITH_KRB5_MIT)
249WINPR_ATTR_MALLOC(free, 1)
250static char* get_realm_name(krb5_data realm, size_t* plen)
251{
252 WINPR_ASSERT(plen);
253 *plen = 0;
254 if ((realm.length <= 0) || (!realm.data))
255 return NULL;
256
257 char* name = NULL;
258 (void)winpr_asprintf(&name, plen, "krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
259 realm.data);
260 return name;
261}
262#elif defined(WITH_KRB5_HEIMDAL)
263WINPR_ATTR_MALLOC(free, 1)
264static char* get_realm_name(Realm realm, size_t* plen)
265{
266 WINPR_ASSERT(plen);
267 *plen = 0;
268 if (!realm)
269 return NULL;
270
271 char* name = NULL;
272 (void)winpr_asprintf(&name, plen, "krbtgt/%s@%s", realm, realm);
273 return name;
274}
275#endif
276
277static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
278{
279 /* "krbtgt/" + realm + "@" + realm */
280 size_t len = 0;
281 krb5_error_code rv = KRB5_CC_NOMEM;
282
283 char* name = get_realm_name(principal->realm, &len);
284 if (!name || (len == 0))
285 goto fail;
286
287 krb5_principal target = { 0 };
288 rv = krb5_parse_name(ctx, name, &target);
289 *ptarget = target;
290fail:
291 free(name);
292 return rv;
293}
294
295#endif /* WITH_KRB5 */
296
297static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
298 SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage, ULONG fCredentialUse,
299 WINPR_ATTR_UNUSED void* pvLogonID, void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
300 WINPR_ATTR_UNUSED void* pvGetKeyArgument, PCredHandle phCredential,
301 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
302{
303#ifdef WITH_KRB5
304 SEC_WINPR_KERBEROS_SETTINGS* krb_settings = NULL;
305 KRB_CREDENTIALS* credentials = NULL;
306 krb5_context ctx = NULL;
307 krb5_ccache ccache = NULL;
308 krb5_keytab keytab = NULL;
309 krb5_principal principal = NULL;
310 char* domain = NULL;
311 char* username = NULL;
312 char* password = NULL;
313 BOOL own_ccache = FALSE;
314 const char* const default_ccache_type = "MEMORY";
315
316 if (pAuthData)
317 {
318 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
319
320 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
321 krb_settings = (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->kerberosSettings);
322
323 if (!sspi_CopyAuthIdentityFieldsA((const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData, &username,
324 &domain, &password))
325 {
326 WLog_ERR(TAG, "Failed to copy auth identity fields");
327 goto cleanup;
328 }
329
330 if (!pszPrincipal)
331 pszPrincipal = username;
332 }
333
334 if (krb_log_exec_ptr(krb5_init_context, &ctx))
335 goto cleanup;
336
337 if (domain)
338 {
339 char* udomain = _strdup(domain);
340 if (!udomain)
341 goto cleanup;
342
343 CharUpperA(udomain);
344 /* Will use domain if realm is not specified in username */
345 krb5_error_code rv = krb_log_exec(krb5_set_default_realm, ctx, udomain);
346 free(udomain);
347
348 if (rv)
349 goto cleanup;
350 }
351
352 if (pszPrincipal)
353 {
354 char* cpszPrincipal = _strdup(pszPrincipal);
355 if (!cpszPrincipal)
356 goto cleanup;
357
358 /* Find realm component if included and convert to uppercase */
359 char* p = strchr(cpszPrincipal, '@');
360 if (p)
361 CharUpperA(p);
362
363 krb5_error_code rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, &principal);
364 free(cpszPrincipal);
365
366 if (rv)
367 goto cleanup;
368 WINPR_ASSERT(principal);
369 }
370
371 if (krb_settings && krb_settings->cache)
372 {
373 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
374 goto cleanup;
375 }
376 else
377 own_ccache = TRUE;
378
379 if (principal)
380 {
381 /* Use the default cache if it's initialized with the right principal */
382 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
383 {
384 if (own_ccache)
385 {
386 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, 0, &ccache))
387 goto cleanup;
388 }
389 else
390 {
391 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
392 goto cleanup;
393 }
394
395 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
396 goto cleanup;
397 }
398 else
399 own_ccache = FALSE;
400 }
401 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
402 {
403 /* Use the default cache with it's default principal */
404 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
405 goto cleanup;
406 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
407 goto cleanup;
408 own_ccache = FALSE;
409 }
410 else
411 {
412 if (own_ccache)
413 {
414 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, 0, &ccache))
415 goto cleanup;
416 }
417 else
418 {
419 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
420 goto cleanup;
421 }
422 }
423
424 if (krb_settings && krb_settings->keytab)
425 {
426 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
427 goto cleanup;
428 }
429 else
430 {
431 if (fCredentialUse & SECPKG_CRED_INBOUND)
432 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
433 goto cleanup;
434 }
435
436 /* Get initial credentials if required */
437 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
438 {
439 krb5_creds creds = { 0 };
440 krb5_creds matchCreds = { 0 };
441 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
442
443 krb5_timeofday(ctx, &matchCreds.times.endtime);
444 matchCreds.times.endtime += 60;
445 matchCreds.client = principal;
446
447 WINPR_ASSERT(principal);
448 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
449 goto cleanup;
450
451 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
452 krb5_free_principal(ctx, matchCreds.server);
453 krb5_free_cred_contents(ctx, &creds);
454 if (rv)
455 {
456 if (krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
457 password, krb_settings))
458 goto cleanup;
459 }
460 }
461
462 credentials = calloc(1, sizeof(KRB_CREDENTIALS));
463 if (!credentials)
464 goto cleanup;
465 credentials->refCount = 1;
466 credentials->ctx = ctx;
467 credentials->ccache = ccache;
468 credentials->keytab = keytab;
469 credentials->own_ccache = own_ccache;
470
471cleanup:
472
473 free(domain);
474 free(username);
475 free(password);
476
477 if (principal)
478 krb5_free_principal(ctx, principal);
479 if (ctx)
480 {
481 if (!credentials)
482 {
483 if (ccache)
484 {
485 if (own_ccache)
486 krb5_cc_destroy(ctx, ccache);
487 else
488 krb5_cc_close(ctx, ccache);
489 }
490 if (keytab)
491 krb5_kt_close(ctx, keytab);
492
493 krb5_free_context(ctx);
494 }
495 }
496
497 /* If we managed to get credentials set the output */
498 if (credentials)
499 {
500 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
501 sspi_SecureHandleSetUpperPointer(phCredential, (void*)KERBEROS_SSP_NAME);
502 return SEC_E_OK;
503 }
504
505 return SEC_E_NO_CREDENTIALS;
506#else
507 return SEC_E_UNSUPPORTED_FUNCTION;
508#endif
509}
510
511static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
512 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
513 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
514 PTimeStamp ptsExpiry)
515{
516 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
517 char* principal = NULL;
518 char* package = NULL;
519
520 if (pszPrincipal)
521 {
522 principal = ConvertWCharToUtf8Alloc(pszPrincipal, NULL);
523 if (!principal)
524 goto fail;
525 }
526 if (pszPackage)
527 {
528 package = ConvertWCharToUtf8Alloc(pszPackage, NULL);
529 if (!package)
530 goto fail;
531 }
532
533 status =
534 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
535 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
536
537fail:
538 free(principal);
539 free(package);
540
541 return status;
542}
543
544#ifdef WITH_KRB5
545static void credentials_unref(KRB_CREDENTIALS* credentials)
546{
547 WINPR_ASSERT(credentials);
548
549 if (InterlockedDecrement(&credentials->refCount))
550 return;
551
552 free(credentials->kdc_url);
553
554 if (credentials->ccache)
555 {
556 if (credentials->own_ccache)
557 krb5_cc_destroy(credentials->ctx, credentials->ccache);
558 else
559 krb5_cc_close(credentials->ctx, credentials->ccache);
560 }
561 if (credentials->keytab)
562 krb5_kt_close(credentials->ctx, credentials->keytab);
563
564 krb5_free_context(credentials->ctx);
565 free(credentials);
566}
567#endif
568
569static SECURITY_STATUS SEC_ENTRY kerberos_FreeCredentialsHandle(PCredHandle phCredential)
570{
571#ifdef WITH_KRB5
572 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
573 if (!credentials)
574 return SEC_E_INVALID_HANDLE;
575
576 credentials_unref(credentials);
577
578 sspi_SecureHandleInvalidate(phCredential);
579 return SEC_E_OK;
580#else
581 return SEC_E_UNSUPPORTED_FUNCTION;
582#endif
583}
584
585static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
586 WINPR_ATTR_UNUSED PCredHandle phCredential, ULONG ulAttribute, WINPR_ATTR_UNUSED void* pBuffer)
587{
588#ifdef WITH_KRB5
589 switch (ulAttribute)
590 {
591 case SECPKG_CRED_ATTR_NAMES:
592 return SEC_E_OK;
593 default:
594 WLog_ERR(TAG, "TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
595 ulAttribute);
596 return SEC_E_UNSUPPORTED_FUNCTION;
597 }
598
599#else
600 return SEC_E_UNSUPPORTED_FUNCTION;
601#endif
602}
603
604static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(PCredHandle phCredential,
605 ULONG ulAttribute,
606 void* pBuffer)
607{
608 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
609}
610
611#ifdef WITH_KRB5
612
613static BOOL kerberos_mk_tgt_token(SecBuffer* buf, int msg_type, char* sname, char* host,
614 const krb5_data* ticket)
615{
616 WinPrAsn1Encoder* enc = NULL;
617 WinPrAsn1_MemoryChunk data;
618 wStream s;
619 size_t len = 0;
620 sspi_gss_data token;
621 BOOL ret = FALSE;
622
623 WINPR_ASSERT(buf);
624
625 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
626 return FALSE;
627 if (msg_type == KRB_TGT_REP && !ticket)
628 return FALSE;
629
630 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
631 if (!enc)
632 return FALSE;
633
634 /* KERB-TGT-REQUEST (SEQUENCE) */
635 if (!WinPrAsn1EncSeqContainer(enc))
636 goto cleanup;
637
638 /* pvno [0] INTEGER */
639 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
640 goto cleanup;
641
642 /* msg-type [1] INTEGER */
643 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
644 goto cleanup;
645
646 if (msg_type == KRB_TGT_REQ && sname)
647 {
648 /* server-name [2] PrincipalName (SEQUENCE) */
649 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
650 goto cleanup;
651
652 /* name-type [0] INTEGER */
653 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
654 goto cleanup;
655
656 /* name-string [1] SEQUENCE OF GeneralString */
657 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
658 goto cleanup;
659
660 if (!WinPrAsn1EncGeneralString(enc, sname))
661 goto cleanup;
662
663 if (host && !WinPrAsn1EncGeneralString(enc, host))
664 goto cleanup;
665
666 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
667 goto cleanup;
668 }
669 else if (msg_type == KRB_TGT_REP)
670 {
671 /* ticket [2] Ticket */
672 data.data = (BYTE*)ticket->data;
673 data.len = ticket->length;
674 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
675 goto cleanup;
676 }
677
678 if (!WinPrAsn1EncEndContainer(enc))
679 goto cleanup;
680
681 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
682 goto cleanup;
683
684 Stream_StaticInit(&s, buf->pvBuffer, len);
685 if (!WinPrAsn1EncToStream(enc, &s))
686 goto cleanup;
687
688 token.data = buf->pvBuffer;
689 token.length = (UINT)len;
690 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
691 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
692 ret = TRUE;
693
694cleanup:
695 WinPrAsn1Encoder_Free(&enc);
696 return ret;
697}
698
699static BOOL append(char* dst, size_t dstSize, const char* src)
700{
701 const size_t dlen = strnlen(dst, dstSize);
702 const size_t slen = strlen(src);
703 if (dlen + slen >= dstSize)
704 return FALSE;
705 if (!strncat(dst, src, dstSize - dlen))
706 return FALSE;
707 return TRUE;
708}
709
710static BOOL kerberos_rd_tgt_req_tag2(WinPrAsn1Decoder* dec, char* buf, size_t len)
711{
712 BOOL rc = FALSE;
713 WinPrAsn1Decoder seq = { 0 };
714
715 /* server-name [2] PrincipalName (SEQUENCE) */
716 if (!WinPrAsn1DecReadSequence(dec, &seq))
717 goto end;
718
719 /* name-type [0] INTEGER */
720 BOOL error = FALSE;
721 WinPrAsn1_INTEGER val = 0;
722 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
723 goto end;
724
725 /* name-string [1] SEQUENCE OF GeneralString */
726 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
727 goto end;
728
729 WinPrAsn1_tag tag = 0;
730 BOOL first = TRUE;
731 while (WinPrAsn1DecPeekTag(dec, &tag))
732 {
733 BOOL success = FALSE;
734 char* lstr = NULL;
735 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
736 goto fail;
737
738 if (!first)
739 {
740 if (!append(buf, len, "/"))
741 goto fail;
742 }
743 first = FALSE;
744
745 if (!append(buf, len, lstr))
746 goto fail;
747
748 success = TRUE;
749 fail:
750 free(lstr);
751 if (!success)
752 goto end;
753 }
754
755 rc = TRUE;
756end:
757 return rc;
758}
759
760static BOOL kerberos_rd_tgt_req_tag3(WinPrAsn1Decoder* dec, char* buf, size_t len)
761{
762 /* realm [3] Realm */
763 BOOL rc = FALSE;
764 WinPrAsn1_STRING str = NULL;
765 if (!WinPrAsn1DecReadGeneralString(dec, &str))
766 goto end;
767
768 if (!append(buf, len, "@"))
769 goto end;
770 if (!append(buf, len, str))
771 goto end;
772
773 rc = TRUE;
774end:
775 free(str);
776 return rc;
777}
778
779static BOOL kerberos_rd_tgt_req(WinPrAsn1Decoder* dec, char** target)
780{
781 BOOL rc = FALSE;
782
783 if (!target)
784 return FALSE;
785 *target = NULL;
786
787 wStream s = WinPrAsn1DecGetStream(dec);
788 const size_t len = Stream_Length(&s);
789 if (len == 0)
790 return TRUE;
791
792 WinPrAsn1Decoder dec2 = { 0 };
793 WinPrAsn1_tagId tag = 0;
794 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
795 return FALSE;
796
797 char* buf = calloc(len + 1, sizeof(char));
798 if (!buf)
799 return FALSE;
800
801 /* We expect ASN1 context tag values 2 or 3.
802 *
803 * In case we got value 2 an (optional) context tag value 3 might follow.
804 */
805 BOOL checkForTag3 = TRUE;
806 if (tag == 2)
807 {
808 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
809 if (rc)
810 {
811 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
812 if (res == 0)
813 checkForTag3 = FALSE;
814 }
815 }
816
817 if (checkForTag3)
818 {
819 if (tag == 3)
820 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
821 else
822 rc = FALSE;
823 }
824
825 if (rc)
826 *target = buf;
827 else
828 free(buf);
829 return rc;
830}
831
832static BOOL kerberos_rd_tgt_rep(WinPrAsn1Decoder* dec, krb5_data* ticket)
833{
834 if (!ticket)
835 return FALSE;
836
837 /* ticket [2] Ticket */
838 WinPrAsn1Decoder asnTicket = { 0 };
839 WinPrAsn1_tagId tag = 0;
840 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
841 return FALSE;
842
843 if (tag != 2)
844 return FALSE;
845
846 wStream s = WinPrAsn1DecGetStream(&asnTicket);
847 ticket->data = Stream_BufferAs(&s, char);
848
849 const size_t len = Stream_Length(&s);
850 if (len > UINT32_MAX)
851 return FALSE;
852 ticket->length = (UINT32)len;
853 return TRUE;
854}
855
856static BOOL kerberos_rd_tgt_token(const sspi_gss_data* token, char** target, krb5_data* ticket)
857{
858 BOOL error = 0;
859 WinPrAsn1_INTEGER val = 0;
860
861 WINPR_ASSERT(token);
862
863 if (target)
864 *target = NULL;
865
866 WinPrAsn1Decoder der = { 0 };
867 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
868
869 /* KERB-TGT-REQUEST (SEQUENCE) */
870 WinPrAsn1Decoder seq = { 0 };
871 if (!WinPrAsn1DecReadSequence(&der, &seq))
872 return FALSE;
873
874 /* pvno [0] INTEGER */
875 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
876 return FALSE;
877
878 /* msg-type [1] INTEGER */
879 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
880 return FALSE;
881
882 switch (val)
883 {
884 case KRB_TGT_REQ:
885 return kerberos_rd_tgt_req(&seq, target);
886 case KRB_TGT_REP:
887 return kerberos_rd_tgt_rep(&seq, ticket);
888 default:
889 break;
890 }
891 return FALSE;
892}
893
894#endif /* WITH_KRB5 */
895
896static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5, SEC_CHANNEL_BINDINGS* bindings)
897{
898 BYTE buf[4];
899
900 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
901 if (!winpr_Digest_Update(md5, buf, 4))
902 return FALSE;
903
904 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
905 if (!winpr_Digest_Update(md5, buf, 4))
906 return FALSE;
907
908 if (bindings->cbInitiatorLength &&
909 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
910 bindings->cbInitiatorLength))
911 return FALSE;
912
913 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
914 if (!winpr_Digest_Update(md5, buf, 4))
915 return FALSE;
916
917 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
918 if (!winpr_Digest_Update(md5, buf, 4))
919 return FALSE;
920
921 if (bindings->cbAcceptorLength &&
922 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
923 bindings->cbAcceptorLength))
924 return FALSE;
925
926 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
927 if (!winpr_Digest_Update(md5, buf, 4))
928 return FALSE;
929
930 if (bindings->cbApplicationDataLength &&
931 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
932 bindings->cbApplicationDataLength))
933 return FALSE;
934
935 return TRUE;
936}
937
938static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
939 PCredHandle phCredential, PCtxtHandle phContext, SEC_CHAR* pszTargetName, ULONG fContextReq,
940 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep, PSecBufferDesc pInput,
941 WINPR_ATTR_UNUSED ULONG Reserved2, PCtxtHandle phNewContext, PSecBufferDesc pOutput,
942 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
943{
944#ifdef WITH_KRB5
945 PSecBuffer input_buffer = NULL;
946 PSecBuffer output_buffer = NULL;
947 PSecBuffer bindings_buffer = NULL;
948 WINPR_DIGEST_CTX* md5 = NULL;
949 char* target = NULL;
950 char* sname = NULL;
951 char* host = NULL;
952 krb5_data input_token = { 0 };
953 krb5_data output_token = { 0 };
954 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
955 WinPrAsn1_OID oid = { 0 };
956 uint16_t tok_id = 0;
957 krb5_ap_rep_enc_part* reply = NULL;
958 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
959 char cksum_contents[24] = { 0 };
960 krb5_data cksum = { 0 };
961 krb5_creds in_creds = { 0 };
962 krb5_creds* creds = NULL;
963 BOOL isNewContext = FALSE;
964 KRB_CONTEXT* context = NULL;
965 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
966
967 /* behave like windows SSPIs that don't want empty context */
968 if (phContext && !phContext->dwLower && !phContext->dwUpper)
969 return SEC_E_INVALID_HANDLE;
970
971 context = sspi_SecureHandleGetLowerPointer(phContext);
972
973 if (!credentials)
974 return SEC_E_NO_CREDENTIALS;
975
976 if (pInput)
977 {
978 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
979 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
980 }
981 if (pOutput)
982 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
983
984 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
985 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
986
987 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
988 ap_flags |= AP_OPTS_USE_SESSION_KEY;
989
990 /* Split target name into service/hostname components */
991 if (pszTargetName)
992 {
993 target = _strdup(pszTargetName);
994 if (!target)
995 {
996 status = SEC_E_INSUFFICIENT_MEMORY;
997 goto cleanup;
998 }
999 host = strchr(target, '/');
1000 if (host)
1001 {
1002 *host++ = 0;
1003 sname = target;
1004 }
1005 else
1006 host = target;
1007 if (isValidIP(host))
1008 {
1009 status = SEC_E_NO_CREDENTIALS;
1010 goto cleanup;
1011 }
1012 }
1013
1014 if (!context)
1015 {
1016 context = kerberos_ContextNew(credentials);
1017 if (!context)
1018 {
1019 status = SEC_E_INSUFFICIENT_MEMORY;
1020 goto cleanup;
1021 }
1022
1023 isNewContext = TRUE;
1024
1025 if (host)
1026 context->targetHost = _strdup(host);
1027 if (!context->targetHost)
1028 {
1029 status = SEC_E_INSUFFICIENT_MEMORY;
1030 goto cleanup;
1031 }
1032
1033 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1034 {
1035 context->state = KERBEROS_STATE_TGT_REQ;
1036 context->u2u = TRUE;
1037 }
1038 else
1039 context->state = KERBEROS_STATE_AP_REQ;
1040 }
1041 else
1042 {
1043 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1044 goto bad_token;
1045 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1046 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1047 goto bad_token;
1048 }
1049
1050 /* SSPI flags are compatible with GSS flags except INTEG_FLAG */
1051 context->flags |= (fContextReq & 0x1F);
1052 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1053 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1054
1055 switch (context->state)
1056 {
1057 case KERBEROS_STATE_TGT_REQ:
1058
1059 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, NULL))
1060 goto cleanup;
1061
1062 context->state = KERBEROS_STATE_TGT_REP;
1063 status = SEC_I_CONTINUE_NEEDED;
1064 break;
1065
1066 case KERBEROS_STATE_TGT_REP:
1067
1068 if (tok_id != TOK_ID_TGT_REP)
1069 goto bad_token;
1070
1071 if (!kerberos_rd_tgt_token(&input_token, NULL, &in_creds.second_ticket))
1072 goto bad_token;
1073
1074 /* Continue to AP-REQ */
1075 /* fallthrough */
1076 WINPR_FALLTHROUGH
1077
1078 case KERBEROS_STATE_AP_REQ:
1079
1080 /* Set auth_context options */
1081 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1082 goto cleanup;
1083 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1084 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1085 goto cleanup;
1086 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1087 GSS_CHECKSUM_TYPE))
1088 goto cleanup;
1089
1090 /* Get a service ticket */
1091 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1092 KRB5_NT_SRV_HST, &in_creds.server))
1093 goto cleanup;
1094
1095 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1096 &in_creds.client))
1097 {
1098 status = SEC_E_WRONG_PRINCIPAL;
1099 goto cleanup;
1100 }
1101
1102 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1103 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1104 &creds))
1105 {
1106 status = SEC_E_NO_CREDENTIALS;
1107 goto cleanup;
1108 }
1109
1110 /* Write the checksum (delegation not implemented) */
1111 cksum.data = cksum_contents;
1112 cksum.length = sizeof(cksum_contents);
1113 winpr_Data_Write_UINT32(cksum_contents, 16);
1114 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1115
1116 if (bindings_buffer)
1117 {
1118 SEC_CHANNEL_BINDINGS* bindings = bindings_buffer->pvBuffer;
1119
1120 /* Sanity checks */
1121 if (bindings_buffer->cbBuffer < sizeof(SEC_CHANNEL_BINDINGS) ||
1122 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1123 bindings_buffer->cbBuffer ||
1124 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1125 bindings_buffer->cbBuffer ||
1126 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1127 bindings_buffer->cbBuffer)
1128 {
1129 status = SEC_E_BAD_BINDINGS;
1130 goto cleanup;
1131 }
1132
1133 md5 = winpr_Digest_New();
1134 if (!md5)
1135 goto cleanup;
1136
1137 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1138 goto cleanup;
1139
1140 if (!kerberos_hash_channel_bindings(md5, bindings))
1141 goto cleanup;
1142
1143 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1144 goto cleanup;
1145 }
1146
1147 /* Make the AP_REQ message */
1148 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1149 &cksum, creds, &output_token))
1150 goto cleanup;
1151
1152 if (!sspi_gss_wrap_token(output_buffer,
1153 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1154 TOK_ID_AP_REQ, &output_token))
1155 goto cleanup;
1156
1157 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1158 {
1159 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1160 context->auth_ctx, (INT32*)&context->local_seq))
1161 goto cleanup;
1162 context->remote_seq ^= context->local_seq;
1163 }
1164
1165 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1166 &context->keyset))
1167 goto cleanup;
1168
1169 context->state = KERBEROS_STATE_AP_REP;
1170
1171 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1172 status = SEC_I_CONTINUE_NEEDED;
1173 else
1174 status = SEC_E_OK;
1175 break;
1176
1177 case KERBEROS_STATE_AP_REP:
1178
1179 if (tok_id == TOK_ID_AP_REP)
1180 {
1181 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1182 &reply))
1183 goto cleanup;
1184 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1185 }
1186 else if (tok_id == TOK_ID_ERROR)
1187 {
1188 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1189 goto cleanup;
1190 }
1191 else
1192 goto bad_token;
1193
1194 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1195 {
1196 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1197 context->auth_ctx, (INT32*)&context->remote_seq))
1198 goto cleanup;
1199 }
1200
1201 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1202 &context->keyset))
1203 goto cleanup;
1204
1205 context->state = KERBEROS_STATE_FINAL;
1206
1207 if (output_buffer)
1208 output_buffer->cbBuffer = 0;
1209 status = SEC_E_OK;
1210 break;
1211
1212 case KERBEROS_STATE_FINAL:
1213 default:
1214 WLog_ERR(TAG, "Kerberos in invalid state!");
1215 goto cleanup;
1216 }
1217
1218cleanup:
1219{
1220 /* second_ticket is not allocated */
1221 krb5_data edata = { 0 };
1222 in_creds.second_ticket = edata;
1223 krb5_free_cred_contents(credentials->ctx, &in_creds);
1224}
1225
1226 krb5_free_creds(credentials->ctx, creds);
1227 if (output_token.data)
1228 krb5glue_free_data_contents(credentials->ctx, &output_token);
1229
1230 winpr_Digest_Free(md5);
1231
1232 free(target);
1233
1234 if (isNewContext)
1235 {
1236 switch (status)
1237 {
1238 case SEC_E_OK:
1239 case SEC_I_CONTINUE_NEEDED:
1240 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1241 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1242 break;
1243 default:
1244 kerberos_ContextFree(context, TRUE);
1245 break;
1246 }
1247 }
1248
1249 return status;
1250
1251bad_token:
1252 status = SEC_E_INVALID_TOKEN;
1253 goto cleanup;
1254#else
1255 return SEC_E_UNSUPPORTED_FUNCTION;
1256#endif /* WITH_KRB5 */
1257}
1258
1259static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1260 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1261 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1262 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr, PTimeStamp ptsExpiry)
1263{
1264 SECURITY_STATUS status = 0;
1265 char* target_name = NULL;
1266
1267 if (pszTargetName)
1268 {
1269 target_name = ConvertWCharToUtf8Alloc(pszTargetName, NULL);
1270 if (!target_name)
1271 return SEC_E_INSUFFICIENT_MEMORY;
1272 }
1273
1274 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1275 Reserved1, TargetDataRep, pInput, Reserved2,
1276 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1277
1278 if (target_name)
1279 free(target_name);
1280
1281 return status;
1282}
1283
1284#ifdef WITH_KRB5
1285static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1286 krb5_creds* creds)
1287{
1288 BOOL ret = FALSE;
1289 krb5_kt_cursor cur = { 0 };
1290 krb5_keytab_entry entry = { 0 };
1291 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1292 goto cleanup;
1293
1294 do
1295 {
1296 krb5_error_code rv =
1297 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1298 if (rv == KRB5_KT_END)
1299 break;
1300 if (rv != 0)
1301 goto cleanup;
1302
1303 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1304 break;
1305 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1306 memset(&entry, 0, sizeof(entry));
1307 if (rv)
1308 goto cleanup;
1309 } while (1);
1310
1311 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1312 goto cleanup;
1313
1314 if (!entry.principal)
1315 goto cleanup;
1316
1317 /* Get the TGT */
1318 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1319 credentials->keytab, 0, NULL, NULL))
1320 goto cleanup;
1321
1322 ret = TRUE;
1323
1324cleanup:
1325 return ret;
1326}
1327
1328static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials, const char* target, krb5_creds* creds)
1329{
1330 BOOL ret = TRUE;
1331 krb5_principal target_princ = { 0 };
1332 char* default_realm = NULL;
1333
1334 krb5_error_code rv =
1335 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1336 if (rv)
1337 return FALSE;
1338
1339 if (!target_princ->realm.length)
1340 {
1341 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1342 if (rv)
1343 goto out;
1344
1345 target_princ->realm.data = default_realm;
1346 target_princ->realm.length = (unsigned int)strlen(default_realm);
1347 }
1348
1349 /*
1350 * First try with the account service. We were requested with something like
1351 * TERMSRV/<host>@<realm>, let's see if we have that in our keytab and if we're able
1352 * to retrieve a TGT with that entry
1353 *
1354 */
1355 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1356 goto out;
1357
1358 ret = FALSE;
1359
1360 /*
1361 * if it's not working let's try with <host>$@<REALM> (note the dollar)
1362 */
1363 char hostDollar[300] = { 0 };
1364 if (target_princ->length < 2)
1365 goto out;
1366
1367 (void)snprintf(hostDollar, sizeof(hostDollar) - 1, "%s$@%s", target_princ->data[1].data,
1368 target_princ->realm.data);
1369 krb5_free_principal(credentials->ctx, target_princ);
1370
1371 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1372 if (rv)
1373 return FALSE;
1374
1375 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1376
1377out:
1378 if (default_realm)
1379 krb5_free_default_realm(credentials->ctx, default_realm);
1380
1381 krb5_free_principal(credentials->ctx, target_princ);
1382 return ret;
1383}
1384#endif
1385
1386static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1387 PCredHandle phCredential, PCtxtHandle phContext, PSecBufferDesc pInput,
1388 WINPR_ATTR_UNUSED ULONG fContextReq, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1389 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr,
1390 WINPR_ATTR_UNUSED PTimeStamp ptsExpity)
1391{
1392#ifdef WITH_KRB5
1393 BOOL isNewContext = FALSE;
1394 PSecBuffer input_buffer = NULL;
1395 PSecBuffer output_buffer = NULL;
1396 WinPrAsn1_OID oid = { 0 };
1397 uint16_t tok_id = 0;
1398 krb5_data input_token = { 0 };
1399 krb5_data output_token = { 0 };
1400 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1401 krb5_flags ap_flags = 0;
1402 krb5glue_authenticator authenticator = NULL;
1403 char* target = NULL;
1404 krb5_keytab_entry entry = { 0 };
1405 krb5_creds creds = { 0 };
1406
1407 /* behave like windows SSPIs that don't want empty context */
1408 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1409 return SEC_E_INVALID_HANDLE;
1410
1411 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1412 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1413
1414 if (pInput)
1415 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1416 if (pOutput)
1417 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1418
1419 if (!input_buffer)
1420 return SEC_E_INVALID_TOKEN;
1421
1422 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1423 return SEC_E_INVALID_TOKEN;
1424
1425 if (!context)
1426 {
1427 isNewContext = TRUE;
1428 context = kerberos_ContextNew(credentials);
1429 context->acceptor = TRUE;
1430
1431 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1432 {
1433 context->u2u = TRUE;
1434 context->state = KERBEROS_STATE_TGT_REQ;
1435 }
1436 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1437 context->state = KERBEROS_STATE_AP_REQ;
1438 else
1439 goto bad_token;
1440 }
1441 else
1442 {
1443 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1444 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1445 goto bad_token;
1446 }
1447
1448 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1449 {
1450 if (!kerberos_rd_tgt_token(&input_token, &target, NULL))
1451 goto bad_token;
1452
1453 if (!retrieveSomeTgt(credentials, target, &creds))
1454 goto cleanup;
1455
1456 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, NULL, NULL, &creds.ticket))
1457 goto cleanup;
1458
1459 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1460 goto cleanup;
1461
1462 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1463 &krb5glue_creds_getkey(creds)))
1464 goto cleanup;
1465
1466 context->state = KERBEROS_STATE_AP_REQ;
1467 }
1468 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1469 {
1470 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, NULL,
1471 credentials->keytab, &ap_flags, NULL))
1472 goto cleanup;
1473
1474 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1475 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1476 goto cleanup;
1477
1478 /* Retrieve and validate the checksum */
1479 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1480 &authenticator))
1481 goto cleanup;
1482 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1483 &context->flags))
1484 goto bad_token;
1485
1486 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1487 {
1488 if (!output_buffer)
1489 goto bad_token;
1490 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1491 goto cleanup;
1492 if (!sspi_gss_wrap_token(output_buffer,
1493 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1494 TOK_ID_AP_REP, &output_token))
1495 goto cleanup;
1496 }
1497 else
1498 {
1499 if (output_buffer)
1500 output_buffer->cbBuffer = 0;
1501 }
1502
1503 *pfContextAttr = (context->flags & 0x1F);
1504 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1505 *pfContextAttr |= ASC_RET_INTEGRITY;
1506
1507 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1508 {
1509 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1510 (INT32*)&context->local_seq))
1511 goto cleanup;
1512 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1513 (INT32*)&context->remote_seq))
1514 goto cleanup;
1515 }
1516
1517 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1518 &context->keyset))
1519 goto cleanup;
1520
1521 context->state = KERBEROS_STATE_FINAL;
1522 }
1523 else
1524 goto bad_token;
1525
1526 /* On first call allocate new context */
1527 if (context->state == KERBEROS_STATE_FINAL)
1528 status = SEC_E_OK;
1529 else
1530 status = SEC_I_CONTINUE_NEEDED;
1531
1532cleanup:
1533 free(target);
1534 if (output_token.data)
1535 krb5glue_free_data_contents(credentials->ctx, &output_token);
1536 if (entry.principal)
1537 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1538
1539 if (isNewContext)
1540 {
1541 switch (status)
1542 {
1543 case SEC_E_OK:
1544 case SEC_I_CONTINUE_NEEDED:
1545 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1546 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1547 break;
1548 default:
1549 kerberos_ContextFree(context, TRUE);
1550 break;
1551 }
1552 }
1553
1554 return status;
1555
1556bad_token:
1557 status = SEC_E_INVALID_TOKEN;
1558 goto cleanup;
1559#else
1560 return SEC_E_UNSUPPORTED_FUNCTION;
1561#endif /* WITH_KRB5 */
1562}
1563
1564#ifdef WITH_KRB5
1565static KRB_CONTEXT* get_context(PCtxtHandle phContext)
1566{
1567 if (!phContext)
1568 return NULL;
1569
1570 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1571 if (!name)
1572 return NULL;
1573
1574 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1575 return NULL;
1576 return sspi_SecureHandleGetLowerPointer(phContext);
1577}
1578
1579static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1580{
1581 WINPR_ASSERT(data);
1582 WINPR_ASSERT(ptr);
1583 WINPR_ASSERT(psize);
1584
1585 *ptr = (PUCHAR)malloc(data->length);
1586 if (!*ptr)
1587 return FALSE;
1588
1589 *psize = data->length;
1590 memcpy(*ptr, data->data, data->length);
1591 return TRUE;
1592}
1593#endif
1594
1595static SECURITY_STATUS SEC_ENTRY kerberos_DeleteSecurityContext(PCtxtHandle phContext)
1596{
1597#ifdef WITH_KRB5
1598 KRB_CONTEXT* context = get_context(phContext);
1599 if (!context)
1600 return SEC_E_INVALID_HANDLE;
1601
1602 kerberos_ContextFree(context, TRUE);
1603
1604 return SEC_E_OK;
1605#else
1606 return SEC_E_UNSUPPORTED_FUNCTION;
1607#endif
1608}
1609
1610#ifdef WITH_KRB5
1611
1612static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1613{
1614 switch (code)
1615 {
1616 case 0:
1617 return SEC_E_OK;
1618 default:
1619 return SEC_E_INTERNAL_ERROR;
1620 }
1621}
1622
1623static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1624 SecPkgContext_Sizes* ContextSizes)
1625{
1626 UINT header = 0;
1627 UINT pad = 0;
1628 UINT trailer = 0;
1629 krb5glue_key key = NULL;
1630
1631 WINPR_ASSERT(context);
1632 WINPR_ASSERT(context->auth_ctx);
1633
1634 /* The MaxTokenSize by default is 12,000 bytes. This has been the default value
1635 * since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2.
1636 * For Windows Server 2012, the default value of the MaxTokenSize registry
1637 * entry is 48,000 bytes.*/
1638 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1639 ContextSizes->cbMaxSignature = 0;
1640 ContextSizes->cbBlockSize = 1;
1641 ContextSizes->cbSecurityTrailer = 0;
1642
1643 key = get_key(&context->keyset);
1644
1645 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1646 {
1647 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1648 KRB5_CRYPTO_TYPE_HEADER, &header);
1649 if (rv)
1650 return krb5_error_to_SECURITY_STATUS(rv);
1651
1652 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1653 &pad);
1654 if (rv)
1655 return krb5_error_to_SECURITY_STATUS(rv);
1656
1657 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1658 &trailer);
1659 if (rv)
1660 return krb5_error_to_SECURITY_STATUS(rv);
1661
1662 /* GSS header (= 16 bytes) + encrypted header = 32 bytes */
1663 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1664 }
1665
1666 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1667 {
1668 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1669 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1670 if (rv)
1671 return krb5_error_to_SECURITY_STATUS(rv);
1672
1673 ContextSizes->cbMaxSignature += 16;
1674 }
1675
1676 return SEC_E_OK;
1677}
1678
1679static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
1680 KRB_CREDENTIALS* credentials,
1681 KERB_TICKET_LOGON* ticketLogon)
1682{
1683 krb5_creds matchCred = { 0 };
1684 krb5_auth_context authContext = NULL;
1685 krb5_flags getCredsFlags = KRB5_GC_CACHED;
1686 BOOL firstRun = TRUE;
1687 krb5_creds* hostCred = NULL;
1688 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
1689 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost, "HOST",
1690 KRB5_NT_SRV_HST, &matchCred.server);
1691 if (rv)
1692 goto out;
1693
1694 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1695 &matchCred.client);
1696 if (rv)
1697 goto out;
1698
1699 /* try from the cache first, and then do a new request */
1700again:
1701 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
1702 &matchCred, &hostCred);
1703 switch (rv)
1704 {
1705 case 0:
1706 break;
1707 case KRB5_CC_NOTFOUND:
1708 getCredsFlags = 0;
1709 if (firstRun)
1710 {
1711 firstRun = FALSE;
1712 goto again;
1713 }
1714 WINPR_FALLTHROUGH
1715 default:
1716 WLog_ERR(TAG, "krb5_get_credentials(hostCreds), rv=%d", rv);
1717 goto out;
1718 }
1719
1720 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
1721 goto out;
1722
1723 krb5_data derOut = { 0 };
1724 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
1725 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
1726 {
1727 ret = SEC_E_LOGON_DENIED;
1728 goto out;
1729 }
1730
1731 ticketLogon->MessageType = KerbTicketLogon;
1732 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
1733
1734 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
1735 &ticketLogon->ServiceTicketLength))
1736 {
1737 krb5_free_data(credentials->ctx, &derOut);
1738 goto out;
1739 }
1740
1741 ticketLogon->TicketGrantingTicketLength = derOut.length;
1742 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
1743
1744 ret = SEC_E_OK;
1745out:
1746 krb5_auth_con_free(credentials->ctx, authContext);
1747 krb5_free_creds(credentials->ctx, hostCred);
1748 krb5_free_cred_contents(credentials->ctx, &matchCred);
1749 return ret;
1750}
1751
1752#endif /* WITH_KRB5 */
1753
1754static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(PCtxtHandle phContext,
1755 ULONG ulAttribute, void* pBuffer)
1756{
1757 if (!phContext)
1758 return SEC_E_INVALID_HANDLE;
1759
1760 if (!pBuffer)
1761 return SEC_E_INVALID_PARAMETER;
1762
1763#ifdef WITH_KRB5
1764 KRB_CONTEXT* context = get_context(phContext);
1765 if (!context)
1766 return SEC_E_INVALID_PARAMETER;
1767
1768 KRB_CREDENTIALS* credentials = context->credentials;
1769
1770 switch (ulAttribute)
1771 {
1772 case SECPKG_ATTR_SIZES:
1773 return kerberos_ATTR_SIZES(context, credentials, (SecPkgContext_Sizes*)pBuffer);
1774
1775 case SECPKG_CRED_ATTR_TICKET_LOGON:
1776 return kerberos_ATTR_TICKET_LOGON(context, credentials, (KERB_TICKET_LOGON*)pBuffer);
1777
1778 default:
1779 WLog_ERR(TAG, "TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
1780 ulAttribute);
1781 return SEC_E_UNSUPPORTED_FUNCTION;
1782 }
1783#else
1784 return SEC_E_UNSUPPORTED_FUNCTION;
1785#endif
1786}
1787
1788static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(PCtxtHandle phContext,
1789 ULONG ulAttribute, void* pBuffer)
1790{
1791 return kerberos_QueryContextAttributesA(phContext, ulAttribute, pBuffer);
1792}
1793
1794static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
1795 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
1796 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
1797{
1798 return SEC_E_UNSUPPORTED_FUNCTION;
1799}
1800
1801static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
1802 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
1803 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
1804{
1805 return SEC_E_UNSUPPORTED_FUNCTION;
1806}
1807
1808static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(PCredHandle phCredential,
1809 ULONG ulAttribute,
1810 void* pBuffer, ULONG cbBuffer,
1811 WINPR_ATTR_UNUSED BOOL unicode)
1812{
1813#ifdef WITH_KRB5
1814 KRB_CREDENTIALS* credentials = NULL;
1815
1816 if (!phCredential)
1817 return SEC_E_INVALID_HANDLE;
1818
1819 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1820
1821 if (!credentials)
1822 return SEC_E_INVALID_HANDLE;
1823
1824 if (!pBuffer)
1825 return SEC_E_INSUFFICIENT_MEMORY;
1826
1827 switch (ulAttribute)
1828 {
1829 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
1830 {
1831 SecPkgCredentials_KdcProxySettingsW* kdc_settings = pBuffer;
1832
1833 /* Sanity checks */
1834 if (cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
1835 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
1836 kdc_settings->ProxyServerOffset < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
1837 cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) +
1838 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
1839 return SEC_E_INVALID_TOKEN;
1840
1841 if (credentials->kdc_url)
1842 {
1843 free(credentials->kdc_url);
1844 credentials->kdc_url = NULL;
1845 }
1846
1847 if (kdc_settings->ProxyServerLength > 0)
1848 {
1849 WCHAR* proxy = (WCHAR*)((BYTE*)pBuffer + kdc_settings->ProxyServerOffset);
1850
1851 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
1852 proxy, kdc_settings->ProxyServerLength / sizeof(WCHAR), NULL);
1853 if (!credentials->kdc_url)
1854 return SEC_E_INSUFFICIENT_MEMORY;
1855 }
1856
1857 return SEC_E_OK;
1858 }
1859 case SECPKG_CRED_ATTR_NAMES:
1860 case SECPKG_ATTR_SUPPORTED_ALGS:
1861 default:
1862 WLog_ERR(TAG, "TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
1863 ulAttribute);
1864 return SEC_E_UNSUPPORTED_FUNCTION;
1865 }
1866
1867#else
1868 return SEC_E_UNSUPPORTED_FUNCTION;
1869#endif
1870}
1871
1872static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(PCredHandle phCredential,
1873 ULONG ulAttribute,
1874 void* pBuffer, ULONG cbBuffer)
1875{
1876 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
1877}
1878
1879static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(PCredHandle phCredential,
1880 ULONG ulAttribute,
1881 void* pBuffer, ULONG cbBuffer)
1882{
1883 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
1884}
1885
1886static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(PCtxtHandle phContext, ULONG fQOP,
1887 PSecBufferDesc pMessage,
1888 ULONG MessageSeqNo)
1889{
1890#ifdef WITH_KRB5
1891 KRB_CONTEXT* context = get_context(phContext);
1892 PSecBuffer sig_buffer = NULL;
1893 PSecBuffer data_buffer = NULL;
1894 char* header = NULL;
1895 BYTE flags = 0;
1896 krb5glue_key key = NULL;
1897 krb5_keyusage usage = 0;
1898 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, { 0 } },
1899 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1900 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1901 { KRB5_CRYPTO_TYPE_PADDING, { 0 } },
1902 { KRB5_CRYPTO_TYPE_TRAILER, { 0 } } };
1903
1904 if (!context)
1905 return SEC_E_INVALID_HANDLE;
1906
1907 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
1908 return SEC_E_UNSUPPORTED_FUNCTION;
1909
1910 KRB_CREDENTIALS* creds = context->credentials;
1911
1912 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
1913 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
1914
1915 if (!sig_buffer || !data_buffer)
1916 return SEC_E_INVALID_TOKEN;
1917
1918 if (fQOP)
1919 return SEC_E_QOP_NOT_SUPPORTED;
1920
1921 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
1922 flags |= FLAG_WRAP_CONFIDENTIAL;
1923
1924 key = get_key(&context->keyset);
1925 if (!key)
1926 return SEC_E_INTERNAL_ERROR;
1927
1928 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
1929
1930 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
1931
1932 /* Set the lengths of the data (plaintext + header) */
1933 encrypt_iov[1].data.length = data_buffer->cbBuffer;
1934 encrypt_iov[2].data.length = 16;
1935
1936 /* Get the lengths of the header, trailer, and padding and ensure sig_buffer is large enough */
1937 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
1938 ARRAYSIZE(encrypt_iov)))
1939 return SEC_E_INTERNAL_ERROR;
1940 if (sig_buffer->cbBuffer <
1941 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
1942 return SEC_E_INSUFFICIENT_MEMORY;
1943
1944 /* Set up the iov array in sig_buffer */
1945 header = sig_buffer->pvBuffer;
1946 encrypt_iov[2].data.data = header + 16;
1947 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
1948 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
1949 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
1950 encrypt_iov[1].data.data = data_buffer->pvBuffer;
1951
1952 /* Write the GSS header with 0 in RRC */
1953 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
1954 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
1955 header[3] = (char)0xFF;
1956 winpr_Data_Write_UINT32(header + 4, 0);
1957 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
1958
1959 /* Copy header to be encrypted */
1960 CopyMemory(encrypt_iov[2].data.data, header, 16);
1961
1962 /* Set the correct RRC */
1963 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
1964 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
1965
1966 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
1967 ARRAYSIZE(encrypt_iov)))
1968 return SEC_E_INTERNAL_ERROR;
1969
1970 return SEC_E_OK;
1971#else
1972 return SEC_E_UNSUPPORTED_FUNCTION;
1973#endif
1974}
1975
1976static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(PCtxtHandle phContext,
1977 PSecBufferDesc pMessage,
1978 ULONG MessageSeqNo, ULONG* pfQOP)
1979{
1980#ifdef WITH_KRB5
1981 KRB_CONTEXT* context = get_context(phContext);
1982 PSecBuffer sig_buffer = NULL;
1983 PSecBuffer data_buffer = NULL;
1984 krb5glue_key key = NULL;
1985 krb5_keyusage usage = 0;
1986 uint16_t tok_id = 0;
1987 BYTE flags = 0;
1988 uint16_t ec = 0;
1989 uint16_t rrc = 0;
1990 uint64_t seq_no = 0;
1991 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, { 0 } },
1992 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1993 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1994 { KRB5_CRYPTO_TYPE_PADDING, { 0 } },
1995 { KRB5_CRYPTO_TYPE_TRAILER, { 0 } } };
1996
1997 if (!context)
1998 return SEC_E_INVALID_HANDLE;
1999
2000 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2001 return SEC_E_UNSUPPORTED_FUNCTION;
2002
2003 KRB_CREDENTIALS* creds = context->credentials;
2004
2005 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2006 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2007
2008 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2009 return SEC_E_INVALID_TOKEN;
2010
2011 /* Read in header information */
2012 BYTE* header = sig_buffer->pvBuffer;
2013 tok_id = winpr_Data_Get_UINT16_BE(header);
2014 flags = header[2];
2015 ec = winpr_Data_Get_UINT16_BE(&header[4]);
2016 rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2017 seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2018
2019 /* Check that the header is valid */
2020 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2021 return SEC_E_INVALID_TOKEN;
2022
2023 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2024 return SEC_E_INVALID_TOKEN;
2025
2026 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2027 (seq_no != context->remote_seq + MessageSeqNo))
2028 return SEC_E_OUT_OF_SEQUENCE;
2029
2030 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2031 return SEC_E_INVALID_TOKEN;
2032
2033 /* We don't expect a trailer buffer; the encrypted header must be rotated */
2034 if (rrc < 16)
2035 return SEC_E_INVALID_TOKEN;
2036
2037 /* Find the proper key and key usage */
2038 key = get_key(&context->keyset);
2039 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2040 return SEC_E_INTERNAL_ERROR;
2041 usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2042
2043 /* Fill in the lengths of the iov array */
2044 iov[1].data.length = data_buffer->cbBuffer;
2045 iov[2].data.length = 16;
2046 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2047 return SEC_E_INTERNAL_ERROR;
2048
2049 /* We don't expect a trailer buffer; everything must be in sig_buffer */
2050 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2051 return SEC_E_INVALID_TOKEN;
2052 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2053 return SEC_E_INVALID_TOKEN;
2054
2055 /* Locate the parts of the message */
2056 iov[0].data.data = (char*)&header[16 + rrc + ec];
2057 iov[1].data.data = data_buffer->pvBuffer;
2058 iov[2].data.data = (char*)&header[16 + ec];
2059 char* data2 = iov[2].data.data;
2060 iov[3].data.data = &data2[iov[2].data.length];
2061
2062 char* data3 = iov[3].data.data;
2063 iov[4].data.data = &data3[iov[3].data.length];
2064
2065 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2066 return SEC_E_INTERNAL_ERROR;
2067
2068 /* Validate the encrypted header */
2069 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2070 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2071 if (memcmp(iov[2].data.data, header, 16) != 0)
2072 return SEC_E_MESSAGE_ALTERED;
2073
2074 *pfQOP = 0;
2075
2076 return SEC_E_OK;
2077#else
2078 return SEC_E_UNSUPPORTED_FUNCTION;
2079#endif
2080}
2081
2082static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(PCtxtHandle phContext,
2083 WINPR_ATTR_UNUSED ULONG fQOP,
2084 PSecBufferDesc pMessage, ULONG MessageSeqNo)
2085{
2086#ifdef WITH_KRB5
2087 KRB_CONTEXT* context = get_context(phContext);
2088 PSecBuffer sig_buffer = NULL;
2089 PSecBuffer data_buffer = NULL;
2090 krb5glue_key key = NULL;
2091 krb5_keyusage usage = 0;
2092 BYTE flags = 0;
2093 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2094 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2095 { KRB5_CRYPTO_TYPE_CHECKSUM, { 0 } } };
2096
2097 if (!context)
2098 return SEC_E_INVALID_HANDLE;
2099
2100 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2101 return SEC_E_UNSUPPORTED_FUNCTION;
2102
2103 KRB_CREDENTIALS* creds = context->credentials;
2104
2105 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2106 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2107
2108 if (!sig_buffer || !data_buffer)
2109 return SEC_E_INVALID_TOKEN;
2110
2111 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2112
2113 key = get_key(&context->keyset);
2114 if (!key)
2115 return SEC_E_INTERNAL_ERROR;
2116 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2117
2118 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2119
2120 /* Fill in the lengths of the iov array */
2121 iov[0].data.length = data_buffer->cbBuffer;
2122 iov[1].data.length = 16;
2123 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2124 return SEC_E_INTERNAL_ERROR;
2125
2126 /* Ensure the buffer is big enough */
2127 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2128 return SEC_E_INSUFFICIENT_MEMORY;
2129
2130 /* Write the header */
2131 char* header = sig_buffer->pvBuffer;
2132 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2133 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2134 memset(header + 3, 0xFF, 5);
2135 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2136
2137 /* Set up the iov array */
2138 iov[0].data.data = data_buffer->pvBuffer;
2139 iov[1].data.data = header;
2140 iov[2].data.data = header + 16;
2141
2142 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2143 return SEC_E_INTERNAL_ERROR;
2144
2145 sig_buffer->cbBuffer = iov[2].data.length + 16;
2146
2147 return SEC_E_OK;
2148#else
2149 return SEC_E_UNSUPPORTED_FUNCTION;
2150#endif
2151}
2152
2153static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(PCtxtHandle phContext,
2154 PSecBufferDesc pMessage,
2155 ULONG MessageSeqNo,
2156 WINPR_ATTR_UNUSED ULONG* pfQOP)
2157{
2158#ifdef WITH_KRB5
2159 PSecBuffer sig_buffer = NULL;
2160 PSecBuffer data_buffer = NULL;
2161 krb5glue_key key = NULL;
2162 krb5_keyusage usage = 0;
2163 BYTE flags = 0;
2164 uint16_t tok_id = 0;
2165 uint64_t seq_no = 0;
2166 krb5_boolean is_valid = 0;
2167 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2168 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2169 { KRB5_CRYPTO_TYPE_CHECKSUM, { 0 } } };
2170 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2171
2172 KRB_CONTEXT* context = get_context(phContext);
2173 if (!context)
2174 return SEC_E_INVALID_HANDLE;
2175
2176 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2177 return SEC_E_UNSUPPORTED_FUNCTION;
2178
2179 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2180 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2181
2182 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2183 return SEC_E_INVALID_TOKEN;
2184
2185 /* Read in header info */
2186 BYTE* header = sig_buffer->pvBuffer;
2187 tok_id = winpr_Data_Get_UINT16_BE(header);
2188 flags = header[2];
2189 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2190
2191 /* Validate header */
2192 if (tok_id != TOK_ID_MIC)
2193 return SEC_E_INVALID_TOKEN;
2194
2195 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2196 return SEC_E_INVALID_TOKEN;
2197
2198 if (memcmp(header + 3, cmp_filler, sizeof(cmp_filler)) != 0)
2199 return SEC_E_INVALID_TOKEN;
2200
2201 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2202 return SEC_E_OUT_OF_SEQUENCE;
2203
2204 /* Find the proper key and usage */
2205 key = get_key(&context->keyset);
2206 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2207 return SEC_E_INTERNAL_ERROR;
2208 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2209
2210 /* Fill in the iov array lengths */
2211 KRB_CREDENTIALS* creds = context->credentials;
2212 iov[0].data.length = data_buffer->cbBuffer;
2213 iov[1].data.length = 16;
2214 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2215 return SEC_E_INTERNAL_ERROR;
2216
2217 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2218 return SEC_E_INTERNAL_ERROR;
2219
2220 /* Set up the iov array */
2221 iov[0].data.data = data_buffer->pvBuffer;
2222 iov[1].data.data = (char*)header;
2223 iov[2].data.data = (char*)&header[16];
2224
2225 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2226 &is_valid))
2227 return SEC_E_INTERNAL_ERROR;
2228
2229 if (!is_valid)
2230 return SEC_E_MESSAGE_ALTERED;
2231
2232 return SEC_E_OK;
2233#else
2234 return SEC_E_UNSUPPORTED_FUNCTION;
2235#endif
2236}
2237
2238const SecurityFunctionTableA KERBEROS_SecurityFunctionTableA = {
2239 3, /* dwVersion */
2240 NULL, /* EnumerateSecurityPackages */
2241 kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
2242 kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
2243 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2244 NULL, /* Reserved2 */
2245 kerberos_InitializeSecurityContextA, /* InitializeSecurityContext */
2246 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2247 NULL, /* CompleteAuthToken */
2248 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2249 NULL, /* ApplyControlToken */
2250 kerberos_QueryContextAttributesA, /* QueryContextAttributes */
2251 NULL, /* ImpersonateSecurityContext */
2252 NULL, /* RevertSecurityContext */
2253 kerberos_MakeSignature, /* MakeSignature */
2254 kerberos_VerifySignature, /* VerifySignature */
2255 NULL, /* FreeContextBuffer */
2256 NULL, /* QuerySecurityPackageInfo */
2257 NULL, /* Reserved3 */
2258 NULL, /* Reserved4 */
2259 NULL, /* ExportSecurityContext */
2260 NULL, /* ImportSecurityContext */
2261 NULL, /* AddCredentials */
2262 NULL, /* Reserved8 */
2263 NULL, /* QuerySecurityContextToken */
2264 kerberos_EncryptMessage, /* EncryptMessage */
2265 kerberos_DecryptMessage, /* DecryptMessage */
2266 kerberos_SetContextAttributesA, /* SetContextAttributes */
2267 kerberos_SetCredentialsAttributesA, /* SetCredentialsAttributes */
2268};
2269
2270const SecurityFunctionTableW KERBEROS_SecurityFunctionTableW = {
2271 3, /* dwVersion */
2272 NULL, /* EnumerateSecurityPackages */
2273 kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
2274 kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
2275 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2276 NULL, /* Reserved2 */
2277 kerberos_InitializeSecurityContextW, /* InitializeSecurityContext */
2278 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2279 NULL, /* CompleteAuthToken */
2280 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2281 NULL, /* ApplyControlToken */
2282 kerberos_QueryContextAttributesW, /* QueryContextAttributes */
2283 NULL, /* ImpersonateSecurityContext */
2284 NULL, /* RevertSecurityContext */
2285 kerberos_MakeSignature, /* MakeSignature */
2286 kerberos_VerifySignature, /* VerifySignature */
2287 NULL, /* FreeContextBuffer */
2288 NULL, /* QuerySecurityPackageInfo */
2289 NULL, /* Reserved3 */
2290 NULL, /* Reserved4 */
2291 NULL, /* ExportSecurityContext */
2292 NULL, /* ImportSecurityContext */
2293 NULL, /* AddCredentials */
2294 NULL, /* Reserved8 */
2295 NULL, /* QuerySecurityContextToken */
2296 kerberos_EncryptMessage, /* EncryptMessage */
2297 kerberos_DecryptMessage, /* DecryptMessage */
2298 kerberos_SetContextAttributesW, /* SetContextAttributes */
2299 kerberos_SetCredentialsAttributesW, /* SetCredentialsAttributes */
2300};
2301
2302BOOL KERBEROS_init(void)
2303{
2304 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2305 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2306 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2307 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));
2308 return TRUE;
2309}
KERB_TICKET_LOGON
Definition secapi.h:50
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:348
SEC_WINNT_AUTH_IDENTITY_WINPR
Definition include/winpr/sspi.h:882
SEC_WINPR_KERBEROS_SETTINGS
Definition include/winpr/sspi.h:867
SecPkgContext_Sizes
Definition include/winpr/sspi.h:426
SecPkgCredentials_KdcProxySettingsW
Definition include/winpr/sspi.h:524
WinPrAsn1_MemoryChunk
Definition asn1.h:79
krb5glue_keyset
Definition krb5glue.h:88
sspi_gss_data
Definition sspi_gss.h:36
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:780