FreeRDP
Loading...
Searching...
No Matches
ntlm_av_pairs.c
1
20#include <winpr/config.h>
21
22#include <winpr/assert.h>
23
24#include "ntlm.h"
25#include "../sspi.h"
26
27#include <winpr/crt.h>
28#include <winpr/print.h>
29#include <winpr/sysinfo.h>
30#include <winpr/tchar.h>
31#include <winpr/crypto.h>
32
33#include "ntlm_compute.h"
34
35#include "ntlm_av_pairs.h"
36
37#if defined(WITH_DEBUG_NTLM)
38#include "../../log.h"
39#define TAG WINPR_TAG("sspi.NTLM")
40#endif
41
42static BOOL ntlm_av_pair_get_next_offset(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pOffset);
43
44static BOOL ntlm_av_pair_check_data(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair, size_t size)
45{
46 size_t offset = 0;
47 if (!pAvPair || cbAvPair < sizeof(NTLM_AV_PAIR) + size)
48 return FALSE;
49 if (!ntlm_av_pair_get_next_offset(pAvPair, cbAvPair, &offset))
50 return FALSE;
51 return cbAvPair >= offset;
52}
53
54#ifdef WITH_DEBUG_NTLM
55static const char* get_av_pair_string(UINT16 pair)
56{
57 switch (pair)
58 {
59 case MsvAvEOL:
60 return "MsvAvEOL";
61 case MsvAvNbComputerName:
62 return "MsvAvNbComputerName";
63 case MsvAvNbDomainName:
64 return "MsvAvNbDomainName";
65 case MsvAvDnsComputerName:
66 return "MsvAvDnsComputerName";
67 case MsvAvDnsDomainName:
68 return "MsvAvDnsDomainName";
69 case MsvAvDnsTreeName:
70 return "MsvAvDnsTreeName";
71 case MsvAvFlags:
72 return "MsvAvFlags";
73 case MsvAvTimestamp:
74 return "MsvAvTimestamp";
75 case MsvAvSingleHost:
76 return "MsvAvSingleHost";
77 case MsvAvTargetName:
78 return "MsvAvTargetName";
79 case MsvAvChannelBindings:
80 return "MsvAvChannelBindings";
81 default:
82 return "UNKNOWN";
83 }
84}
85#endif
86
87static BOOL ntlm_av_pair_check(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair);
88static NTLM_AV_PAIR* ntlm_av_pair_next(NTLM_AV_PAIR* pAvPairList, size_t* pcbAvPairList);
89
90static INLINE void ntlm_av_pair_set_id(NTLM_AV_PAIR* pAvPair, UINT16 id)
91{
92 WINPR_ASSERT(pAvPair);
93 winpr_Data_Write_UINT16(&pAvPair->AvId, id);
94}
95
96static INLINE void ntlm_av_pair_set_len(NTLM_AV_PAIR* pAvPair, UINT16 len)
97{
98 WINPR_ASSERT(pAvPair);
99 winpr_Data_Write_UINT16(&pAvPair->AvLen, len);
100}
101
102static BOOL ntlm_av_pair_list_init(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
103{
104 NTLM_AV_PAIR* pAvPair = pAvPairList;
105
106 if (!pAvPair || (cbAvPairList < sizeof(NTLM_AV_PAIR)))
107 return FALSE;
108
109 ntlm_av_pair_set_id(pAvPair, MsvAvEOL);
110 ntlm_av_pair_set_len(pAvPair, 0);
111 return TRUE;
112}
113
114static INLINE BOOL ntlm_av_pair_get_id(const NTLM_AV_PAIR* pAvPair, size_t size, UINT16* pair)
115{
116 if (!pAvPair || !pair)
117 return FALSE;
118
119 if (size < sizeof(NTLM_AV_PAIR))
120 return FALSE;
121
122 const UINT16 AvId = winpr_Data_Get_UINT16(&pAvPair->AvId);
123
124 *pair = AvId;
125 return TRUE;
126}
127
128ULONG ntlm_av_pair_list_length(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
129{
130 size_t cbAvPair = 0;
131 NTLM_AV_PAIR* pAvPair = NULL;
132
133 pAvPair = ntlm_av_pair_get(pAvPairList, cbAvPairList, MsvAvEOL, &cbAvPair);
134 if (!pAvPair)
135 return 0;
136
137 if (pAvPair < pAvPairList)
138 return 0;
139
140 const size_t size = WINPR_ASSERTING_INT_CAST(size_t, ((PBYTE)pAvPair - (PBYTE)pAvPairList)) +
141 sizeof(NTLM_AV_PAIR);
142 WINPR_ASSERT(size <= UINT32_MAX);
143 WINPR_ASSERT(size >= 0);
144 return (ULONG)size;
145}
146
147static INLINE BOOL ntlm_av_pair_get_len(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pAvLen)
148{
149 if (!pAvPair)
150 return FALSE;
151
152 if (size < sizeof(NTLM_AV_PAIR))
153 return FALSE;
154
155 const UINT16 AvLen = winpr_Data_Get_UINT16(&pAvPair->AvLen);
156
157 *pAvLen = AvLen;
158 return TRUE;
159}
160
161#ifdef WITH_DEBUG_NTLM
162void ntlm_print_av_pair_list(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList)
163{
164 UINT16 pair = 0;
165 size_t cbAvPair = cbAvPairList;
166 NTLM_AV_PAIR* pAvPair = pAvPairList;
167
168 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
169 return;
170
171 WLog_VRB(TAG, "AV_PAIRs =");
172
173 while (pAvPair && ntlm_av_pair_get_id(pAvPair, cbAvPair, &pair) && (pair != MsvAvEOL))
174 {
175 size_t cbLen = 0;
176 ntlm_av_pair_get_len(pAvPair, cbAvPair, &cbLen);
177
178 WLog_VRB(TAG, "\t%s AvId: %" PRIu16 " AvLen: %" PRIu16 "", get_av_pair_string(pair), pair);
179 winpr_HexDump(TAG, WLOG_TRACE, ntlm_av_pair_get_value_pointer(pAvPair), cbLen);
180
181 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
182 }
183}
184#endif
185
186static size_t ntlm_av_pair_list_size(size_t AvPairsCount, size_t AvPairsValueLength)
187{
188 /* size of headers + value lengths + terminating MsvAvEOL AV_PAIR */
189 return ((AvPairsCount + 1) * 4ULL) + AvPairsValueLength;
190}
191
192PBYTE ntlm_av_pair_get_value_pointer(NTLM_AV_PAIR* pAvPair)
193{
194 WINPR_ASSERT(pAvPair);
195 return (PBYTE)pAvPair + sizeof(NTLM_AV_PAIR);
196}
197
198static BOOL ntlm_av_pair_get_next_offset(const NTLM_AV_PAIR* pAvPair, size_t size, size_t* pOffset)
199{
200 size_t avLen = 0;
201 if (!pOffset)
202 return FALSE;
203
204 if (!ntlm_av_pair_get_len(pAvPair, size, &avLen))
205 return FALSE;
206 *pOffset = avLen + sizeof(NTLM_AV_PAIR);
207 return TRUE;
208}
209
210static BOOL ntlm_av_pair_check(const NTLM_AV_PAIR* pAvPair, size_t cbAvPair)
211{
212 return ntlm_av_pair_check_data(pAvPair, cbAvPair, 0);
213}
214
215static NTLM_AV_PAIR* ntlm_av_pair_next(NTLM_AV_PAIR* pAvPair, size_t* pcbAvPair)
216{
217 size_t offset = 0;
218
219 if (!pcbAvPair)
220 return NULL;
221 if (!ntlm_av_pair_check(pAvPair, *pcbAvPair))
222 return NULL;
223
224 if (!ntlm_av_pair_get_next_offset(pAvPair, *pcbAvPair, &offset))
225 return NULL;
226
227 *pcbAvPair -= offset;
228 return (NTLM_AV_PAIR*)((PBYTE)pAvPair + offset);
229}
230
231NTLM_AV_PAIR* ntlm_av_pair_get(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList, NTLM_AV_ID AvId,
232 size_t* pcbAvPairListRemaining)
233{
234 UINT16 id = 0;
235 size_t cbAvPair = cbAvPairList;
236 NTLM_AV_PAIR* pAvPair = pAvPairList;
237
238 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
239 pAvPair = NULL;
240
241 while (pAvPair && ntlm_av_pair_get_id(pAvPair, cbAvPair, &id))
242 {
243 if (id == AvId)
244 break;
245 if (id == MsvAvEOL)
246 {
247 pAvPair = NULL;
248 break;
249 }
250
251 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
252 }
253
254 if (!pAvPair)
255 cbAvPair = 0;
256 if (pcbAvPairListRemaining)
257 *pcbAvPairListRemaining = cbAvPair;
258
259 return pAvPair;
260}
261
262static BOOL ntlm_av_pair_add(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList, NTLM_AV_ID AvId,
263 PBYTE Value, UINT16 AvLen)
264{
265 size_t cbAvPair = 0;
266 NTLM_AV_PAIR* pAvPair = NULL;
267
268 pAvPair = ntlm_av_pair_get(pAvPairList, cbAvPairList, MsvAvEOL, &cbAvPair);
269
270 /* size of header + value length + terminating MsvAvEOL AV_PAIR */
271 if (!pAvPair || cbAvPair < 2 * sizeof(NTLM_AV_PAIR) + AvLen)
272 return FALSE;
273
274 ntlm_av_pair_set_id(pAvPair, (UINT16)AvId);
275 ntlm_av_pair_set_len(pAvPair, AvLen);
276 if (AvLen)
277 {
278 WINPR_ASSERT(Value != NULL);
279 CopyMemory(ntlm_av_pair_get_value_pointer(pAvPair), Value, AvLen);
280 }
281
282 pAvPair = ntlm_av_pair_next(pAvPair, &cbAvPair);
283 return ntlm_av_pair_list_init(pAvPair, cbAvPair);
284}
285
286static BOOL ntlm_av_pair_add_copy(NTLM_AV_PAIR* pAvPairList, size_t cbAvPairList,
287 NTLM_AV_PAIR* pAvPair, size_t cbAvPair)
288{
289 UINT16 pair = 0;
290 size_t avLen = 0;
291
292 if (!ntlm_av_pair_check(pAvPair, cbAvPair))
293 return FALSE;
294
295 if (!ntlm_av_pair_get_id(pAvPair, cbAvPair, &pair))
296 return FALSE;
297
298 if (!ntlm_av_pair_get_len(pAvPair, cbAvPair, &avLen))
299 return FALSE;
300
301 WINPR_ASSERT(avLen <= UINT16_MAX);
302 return ntlm_av_pair_add(pAvPairList, cbAvPairList, pair,
303 ntlm_av_pair_get_value_pointer(pAvPair), (UINT16)avLen);
304}
305
306static char* get_name(COMPUTER_NAME_FORMAT type)
307{
308 DWORD nSize = 0;
309
310 if (GetComputerNameExA(type, NULL, &nSize))
311 return NULL;
312
313 if (GetLastError() != ERROR_MORE_DATA)
314 return NULL;
315
316 char* computerName = calloc(1, nSize);
317
318 if (!computerName)
319 return NULL;
320
321 if (!GetComputerNameExA(type, computerName, &nSize))
322 {
323 free(computerName);
324 return NULL;
325 }
326
327 return computerName;
328}
329
330static int ntlm_get_target_computer_name(PUNICODE_STRING pName,
331 WINPR_ATTR_UNUSED COMPUTER_NAME_FORMAT type)
332{
333 int status = -1;
334
335 WINPR_ASSERT(pName);
336
337 char* name = get_name(ComputerNameNetBIOS);
338 if (!name)
339 return -1;
340
341 CharUpperA(name);
342
343 size_t len = 0;
344 pName->Buffer = ConvertUtf8ToWCharAlloc(name, &len);
345 free(name);
346
347 if (!pName->Buffer || (len == 0) || (len > UINT16_MAX / sizeof(WCHAR)))
348 {
349 free(pName->Buffer);
350 pName->Buffer = NULL;
351 return status;
352 }
353
354 pName->Length = (USHORT)((len) * sizeof(WCHAR));
355 pName->MaximumLength = pName->Length;
356 return 1;
357}
358
359static void ntlm_free_unicode_string(PUNICODE_STRING string)
360{
361 if (string)
362 {
363 if (string->Length > 0)
364 {
365 free(string->Buffer);
366 string->Buffer = NULL;
367 string->Length = 0;
368 string->MaximumLength = 0;
369 }
370 }
371}
372
391/*
392typedef struct gss_channel_bindings_struct {
393 OM_uint32 initiator_addrtype;
394 gss_buffer_desc initiator_address;
395 OM_uint32 acceptor_addrtype;
396 gss_buffer_desc acceptor_address;
397 gss_buffer_desc application_data;
398} *gss_channel_bindings_t;
399 */
400
401static BOOL ntlm_md5_update_uint32_be(WINPR_DIGEST_CTX* md5, UINT32 num)
402{
403 BYTE be32[4];
404 be32[0] = (num >> 0) & 0xFF;
405 be32[1] = (num >> 8) & 0xFF;
406 be32[2] = (num >> 16) & 0xFF;
407 be32[3] = (num >> 24) & 0xFF;
408 return winpr_Digest_Update(md5, be32, 4);
409}
410
411static void ntlm_compute_channel_bindings(NTLM_CONTEXT* context)
412{
413 WINPR_DIGEST_CTX* md5 = NULL;
414 BYTE* ChannelBindingToken = NULL;
415 UINT32 ChannelBindingTokenLength = 0;
416 SEC_CHANNEL_BINDINGS* ChannelBindings = NULL;
417
418 WINPR_ASSERT(context);
419
420 ZeroMemory(context->ChannelBindingsHash, WINPR_MD5_DIGEST_LENGTH);
421 ChannelBindings = context->Bindings.Bindings;
422
423 if (!ChannelBindings)
424 return;
425
426 if (!(md5 = winpr_Digest_New()))
427 return;
428
429 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
430 goto out;
431
432 ChannelBindingTokenLength = context->Bindings.BindingsLength - sizeof(SEC_CHANNEL_BINDINGS);
433 ChannelBindingToken = &((BYTE*)ChannelBindings)[ChannelBindings->dwApplicationDataOffset];
434
435 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->dwInitiatorAddrType))
436 goto out;
437
438 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbInitiatorLength))
439 goto out;
440
441 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->dwAcceptorAddrType))
442 goto out;
443
444 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbAcceptorLength))
445 goto out;
446
447 if (!ntlm_md5_update_uint32_be(md5, ChannelBindings->cbApplicationDataLength))
448 goto out;
449
450 if (!winpr_Digest_Update(md5, (void*)ChannelBindingToken, ChannelBindingTokenLength))
451 goto out;
452
453 if (!winpr_Digest_Final(md5, context->ChannelBindingsHash, WINPR_MD5_DIGEST_LENGTH))
454 goto out;
455
456out:
457 winpr_Digest_Free(md5);
458}
459
460static void ntlm_compute_single_host_data(NTLM_CONTEXT* context)
461{
462 WINPR_ASSERT(context);
471 winpr_Data_Write_UINT32(&context->SingleHostData.Size, 48);
472 winpr_Data_Write_UINT32(&context->SingleHostData.Z4, 0);
473 winpr_Data_Write_UINT32(&context->SingleHostData.DataPresent, 1);
474 winpr_Data_Write_UINT32(&context->SingleHostData.CustomData, SECURITY_MANDATORY_MEDIUM_RID);
475 FillMemory(context->SingleHostData.MachineID, 32, 0xAA);
476}
477
478BOOL ntlm_construct_challenge_target_info(NTLM_CONTEXT* context)
479{
480 BOOL rc = FALSE;
481 ULONG AvPairsCount = 0;
482 ULONG AvPairsLength = 0;
483 NTLM_AV_PAIR* pAvPairList = NULL;
484 size_t cbAvPairList = 0;
485 UNICODE_STRING NbDomainName = { 0 };
486 UNICODE_STRING NbComputerName = { 0 };
487 UNICODE_STRING DnsDomainName = { 0 };
488 UNICODE_STRING DnsComputerName = { 0 };
489
490 WINPR_ASSERT(context);
491
492 if (ntlm_get_target_computer_name(&NbDomainName, ComputerNameNetBIOS) < 0)
493 goto fail;
494
495 NbComputerName.Buffer = NULL;
496
497 if (ntlm_get_target_computer_name(&NbComputerName, ComputerNameNetBIOS) < 0)
498 goto fail;
499
500 DnsDomainName.Buffer = NULL;
501
502 if (ntlm_get_target_computer_name(&DnsDomainName, ComputerNameDnsDomain) < 0)
503 goto fail;
504
505 DnsComputerName.Buffer = NULL;
506
507 if (ntlm_get_target_computer_name(&DnsComputerName, ComputerNameDnsHostname) < 0)
508 goto fail;
509
510 AvPairsCount = 5;
511 AvPairsLength = NbDomainName.Length + NbComputerName.Length + DnsDomainName.Length +
512 DnsComputerName.Length + 8;
513 const size_t length = ntlm_av_pair_list_size(AvPairsCount, AvPairsLength);
514
515 if (!sspi_SecBufferAlloc(&context->ChallengeTargetInfo,
516 WINPR_ASSERTING_INT_CAST(uint32_t, length)))
517 goto fail;
518
519 pAvPairList = (NTLM_AV_PAIR*)context->ChallengeTargetInfo.pvBuffer;
520 cbAvPairList = context->ChallengeTargetInfo.cbBuffer;
521
522 if (!ntlm_av_pair_list_init(pAvPairList, cbAvPairList))
523 goto fail;
524
525 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvNbDomainName, (PBYTE)NbDomainName.Buffer,
526 NbDomainName.Length))
527 goto fail;
528
529 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvNbComputerName,
530 (PBYTE)NbComputerName.Buffer, NbComputerName.Length))
531 goto fail;
532
533 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvDnsDomainName,
534 (PBYTE)DnsDomainName.Buffer, DnsDomainName.Length))
535 goto fail;
536
537 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvDnsComputerName,
538 (PBYTE)DnsComputerName.Buffer, DnsComputerName.Length))
539 goto fail;
540
541 if (!ntlm_av_pair_add(pAvPairList, cbAvPairList, MsvAvTimestamp, context->Timestamp,
542 sizeof(context->Timestamp)))
543 goto fail;
544
545 rc = TRUE;
546fail:
547 ntlm_free_unicode_string(&NbDomainName);
548 ntlm_free_unicode_string(&NbComputerName);
549 ntlm_free_unicode_string(&DnsDomainName);
550 ntlm_free_unicode_string(&DnsComputerName);
551 return rc;
552}
553
554BOOL ntlm_construct_authenticate_target_info(NTLM_CONTEXT* context)
555{
556 ULONG AvPairsCount = 0;
557 size_t AvPairsValueLength = 0;
558 NTLM_AV_PAIR* AvTimestamp = NULL;
559 NTLM_AV_PAIR* AvNbDomainName = NULL;
560 NTLM_AV_PAIR* AvNbComputerName = NULL;
561 NTLM_AV_PAIR* AvDnsDomainName = NULL;
562 NTLM_AV_PAIR* AvDnsComputerName = NULL;
563 NTLM_AV_PAIR* AvDnsTreeName = NULL;
564 NTLM_AV_PAIR* ChallengeTargetInfo = NULL;
565 NTLM_AV_PAIR* AuthenticateTargetInfo = NULL;
566 size_t cbAvTimestamp = 0;
567 size_t cbAvNbDomainName = 0;
568 size_t cbAvNbComputerName = 0;
569 size_t cbAvDnsDomainName = 0;
570 size_t cbAvDnsComputerName = 0;
571 size_t cbAvDnsTreeName = 0;
572 size_t cbChallengeTargetInfo = 0;
573 size_t cbAuthenticateTargetInfo = 0;
574
575 WINPR_ASSERT(context);
576
577 AvPairsCount = 1;
578 ChallengeTargetInfo = (NTLM_AV_PAIR*)context->ChallengeTargetInfo.pvBuffer;
579 cbChallengeTargetInfo = context->ChallengeTargetInfo.cbBuffer;
580 AvNbDomainName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvNbDomainName,
581 &cbAvNbDomainName);
582 AvNbComputerName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
583 MsvAvNbComputerName, &cbAvNbComputerName);
584 AvDnsDomainName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
585 MsvAvDnsDomainName, &cbAvDnsDomainName);
586 AvDnsComputerName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo,
587 MsvAvDnsComputerName, &cbAvDnsComputerName);
588 AvDnsTreeName = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvDnsTreeName,
589 &cbAvDnsTreeName);
590 AvTimestamp = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvTimestamp,
591 &cbAvTimestamp);
592
593 if (AvNbDomainName)
594 {
595 size_t avLen = 0;
596 if (!ntlm_av_pair_get_len(AvNbDomainName, cbAvNbDomainName, &avLen))
597 goto fail;
598 AvPairsCount++; /* MsvAvNbDomainName */
599 AvPairsValueLength += avLen;
600 }
601
602 if (AvNbComputerName)
603 {
604 size_t avLen = 0;
605 if (!ntlm_av_pair_get_len(AvNbComputerName, cbAvNbComputerName, &avLen))
606 goto fail;
607 AvPairsCount++; /* MsvAvNbComputerName */
608 AvPairsValueLength += avLen;
609 }
610
611 if (AvDnsDomainName)
612 {
613 size_t avLen = 0;
614 if (!ntlm_av_pair_get_len(AvDnsDomainName, cbAvDnsDomainName, &avLen))
615 goto fail;
616 AvPairsCount++; /* MsvAvDnsDomainName */
617 AvPairsValueLength += avLen;
618 }
619
620 if (AvDnsComputerName)
621 {
622 size_t avLen = 0;
623 if (!ntlm_av_pair_get_len(AvDnsComputerName, cbAvDnsComputerName, &avLen))
624 goto fail;
625 AvPairsCount++; /* MsvAvDnsComputerName */
626 AvPairsValueLength += avLen;
627 }
628
629 if (AvDnsTreeName)
630 {
631 size_t avLen = 0;
632 if (!ntlm_av_pair_get_len(AvDnsTreeName, cbAvDnsTreeName, &avLen))
633 goto fail;
634 AvPairsCount++; /* MsvAvDnsTreeName */
635 AvPairsValueLength += avLen;
636 }
637
638 AvPairsCount++; /* MsvAvTimestamp */
639 AvPairsValueLength += 8;
640
641 if (context->UseMIC)
642 {
643 AvPairsCount++; /* MsvAvFlags */
644 AvPairsValueLength += 4;
645 }
646
647 if (context->SendSingleHostData)
648 {
649 AvPairsCount++; /* MsvAvSingleHost */
650 ntlm_compute_single_host_data(context);
651 AvPairsValueLength += context->SingleHostData.Size;
652 }
653
659 if (!context->SuppressExtendedProtection)
660 {
665 AvPairsCount++; /* MsvAvChannelBindings */
666 AvPairsValueLength += 16;
667 ntlm_compute_channel_bindings(context);
668
669 if (context->ServicePrincipalName.Length > 0)
670 {
671 AvPairsCount++; /* MsvAvTargetName */
672 AvPairsValueLength += context->ServicePrincipalName.Length;
673 }
674 }
675
676 size_t size = ntlm_av_pair_list_size(AvPairsCount, AvPairsValueLength);
677
678 if (context->NTLMv2)
679 size += 8; /* unknown 8-byte padding */
680
681 if (!sspi_SecBufferAlloc(&context->AuthenticateTargetInfo,
682 WINPR_ASSERTING_INT_CAST(uint32_t, size)))
683 goto fail;
684
685 AuthenticateTargetInfo = (NTLM_AV_PAIR*)context->AuthenticateTargetInfo.pvBuffer;
686 cbAuthenticateTargetInfo = context->AuthenticateTargetInfo.cbBuffer;
687
688 if (!ntlm_av_pair_list_init(AuthenticateTargetInfo, cbAuthenticateTargetInfo))
689 goto fail;
690
691 if (AvNbDomainName)
692 {
693 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvNbDomainName,
694 cbAvNbDomainName))
695 goto fail;
696 }
697
698 if (AvNbComputerName)
699 {
700 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
701 AvNbComputerName, cbAvNbComputerName))
702 goto fail;
703 }
704
705 if (AvDnsDomainName)
706 {
707 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
708 AvDnsDomainName, cbAvDnsDomainName))
709 goto fail;
710 }
711
712 if (AvDnsComputerName)
713 {
714 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
715 AvDnsComputerName, cbAvDnsComputerName))
716 goto fail;
717 }
718
719 if (AvDnsTreeName)
720 {
721 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvDnsTreeName,
722 cbAvDnsTreeName))
723 goto fail;
724 }
725
726 if (AvTimestamp)
727 {
728 if (!ntlm_av_pair_add_copy(AuthenticateTargetInfo, cbAuthenticateTargetInfo, AvTimestamp,
729 cbAvTimestamp))
730 goto fail;
731 }
732
733 if (context->UseMIC)
734 {
735 UINT32 flags = 0;
736 winpr_Data_Write_UINT32(&flags, MSV_AV_FLAGS_MESSAGE_INTEGRITY_CHECK);
737
738 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvFlags,
739 (PBYTE)&flags, 4))
740 goto fail;
741 }
742
743 if (context->SendSingleHostData)
744 {
745 WINPR_ASSERT(context->SingleHostData.Size <= UINT16_MAX);
746 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvSingleHost,
747 (PBYTE)&context->SingleHostData,
748 (UINT16)context->SingleHostData.Size))
749 goto fail;
750 }
751
752 if (!context->SuppressExtendedProtection)
753 {
754 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo,
755 MsvAvChannelBindings, context->ChannelBindingsHash, 16))
756 goto fail;
757
758 if (context->ServicePrincipalName.Length > 0)
759 {
760 if (!ntlm_av_pair_add(AuthenticateTargetInfo, cbAuthenticateTargetInfo, MsvAvTargetName,
761 (PBYTE)context->ServicePrincipalName.Buffer,
762 context->ServicePrincipalName.Length))
763 goto fail;
764 }
765 }
766
767 if (context->NTLMv2)
768 {
769 NTLM_AV_PAIR* AvEOL = NULL;
770 AvEOL = ntlm_av_pair_get(ChallengeTargetInfo, cbChallengeTargetInfo, MsvAvEOL, NULL);
771
772 if (!AvEOL)
773 goto fail;
774
775 ZeroMemory(AvEOL, sizeof(NTLM_AV_PAIR));
776 }
777
778 return TRUE;
779fail:
780 sspi_SecBufferFree(&context->AuthenticateTargetInfo);
781 return FALSE;
782}
LSA_UNICODE_STRING
Definition nt.h:1415
NTLM_AV_PAIR
Definition libwinpr/sspi/NTLM/ntlm.h:113
NTLM_CONTEXT
Definition libwinpr/sspi/NTLM/ntlm.h:220
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:348