FreeRDP
Loading...
Searching...
No Matches
sspi/NTLM/ntlm.c
1
20#include <winpr/config.h>
21
22#include <winpr/crt.h>
23#include <winpr/assert.h>
24#include <winpr/sspi.h>
25#include <winpr/print.h>
26#include <winpr/string.h>
27#include <winpr/tchar.h>
28#include <winpr/sysinfo.h>
29#include <winpr/registry.h>
30#include <winpr/endian.h>
31#include <winpr/build-config.h>
32
33#include "ntlm.h"
34#include "ntlm_export.h"
35#include "../sspi.h"
36
37#include "ntlm_message.h"
38
39#include "../../utils.h"
40
41#include "../../log.h"
42#define TAG WINPR_TAG("sspi.NTLM")
43
44#ifndef MIN
45#define MIN(a, b) ((a) < (b)) ? (a) : (b)
46#endif
47
48#define WINPR_KEY "Software\\%s\\WinPR\\NTLM"
49
50#define check_context(ctx) check_context_((ctx), __FILE__, __func__, __LINE__)
51
52WINPR_ATTR_NODISCARD
53static BOOL check_context_(NTLM_CONTEXT* context, const char* file, const char* fkt, size_t line)
54{
55 BOOL rc = TRUE;
56 wLog* log = WLog_Get(TAG);
57 const DWORD log_level = WLOG_ERROR;
58
59 if (!context)
60 {
61 if (WLog_IsLevelActive(log, log_level))
62 WLog_PrintTextMessage(log, log_level, line, file, fkt, "invalid context");
63
64 return FALSE;
65 }
66
67 if (!context->RecvRc4Seal)
68 {
69 if (WLog_IsLevelActive(log, log_level))
70 WLog_PrintTextMessage(log, log_level, line, file, fkt, "invalid context->RecvRc4Seal");
71 rc = FALSE;
72 }
73 if (!context->SendRc4Seal)
74 {
75 if (WLog_IsLevelActive(log, log_level))
76 WLog_PrintTextMessage(log, log_level, line, file, fkt, "invalid context->SendRc4Seal");
77 rc = FALSE;
78 }
79
80 if (!context->SendSigningKey)
81 {
82 if (WLog_IsLevelActive(log, log_level))
83 WLog_PrintTextMessage(log, log_level, line, file, fkt,
84 "invalid context->SendSigningKey");
85 rc = FALSE;
86 }
87 if (!context->RecvSigningKey)
88 {
89 if (WLog_IsLevelActive(log, log_level))
90 WLog_PrintTextMessage(log, log_level, line, file, fkt,
91 "invalid context->RecvSigningKey");
92 rc = FALSE;
93 }
94 if (!context->SendSealingKey)
95 {
96 if (WLog_IsLevelActive(log, log_level))
97 WLog_PrintTextMessage(log, log_level, line, file, fkt,
98 "invalid context->SendSealingKey");
99 rc = FALSE;
100 }
101 if (!context->RecvSealingKey)
102 {
103 if (WLog_IsLevelActive(log, log_level))
104 WLog_PrintTextMessage(log, log_level, line, file, fkt,
105 "invalid context->RecvSealingKey");
106 rc = FALSE;
107 }
108 return rc;
109}
110
111WINPR_ATTR_MALLOC(free, 1)
112static char* get_computer_name(COMPUTER_NAME_FORMAT type, size_t* pSize)
113{
114 DWORD nSize = 0;
115
116 if (pSize)
117 *pSize = 0;
118
119 if (GetComputerNameExA(type, nullptr, &nSize))
120 return nullptr;
121
122 if (GetLastError() != ERROR_MORE_DATA)
123 return nullptr;
124
125 char* computerName = calloc(1, nSize);
126
127 if (!computerName)
128 return nullptr;
129
130 if (!GetComputerNameExA(type, computerName, &nSize))
131 {
132 free(computerName);
133 return nullptr;
134 }
135
136 if (pSize)
137 *pSize = nSize;
138 return computerName;
139}
140
141WINPR_ATTR_NODISCARD
142SECURITY_STATUS ntlm_SetContextWorkstationX(NTLM_CONTEXT* context, BOOL unicode, const void* data,
143 size_t length)
144{
145 WINPR_ASSERT(context);
146 ntlm_free_unicode_string(&context->Workstation);
147
148 if (length == 0)
149 return SEC_E_OK;
150
151 WINPR_ASSERT(data);
152 if (unicode)
153 context->Workstation = ntlm_from_unicode_string_w(data, length / sizeof(WCHAR));
154 else
155 context->Workstation = ntlm_from_unicode_string_utf8(data, length);
156
157 if (ntlm_is_unicode_string_empty(&context->Workstation))
158 return SEC_E_INSUFFICIENT_MEMORY;
159
160 return SEC_E_OK;
161}
162
163WINPR_ATTR_NODISCARD
164static int ntlm_SetContextWorkstation(NTLM_CONTEXT* context, const char* Workstation)
165{
166 const char* ws = Workstation;
167 CHAR* computerName = nullptr;
168
169 if (!Workstation)
170 {
171 computerName = get_computer_name(ComputerNameNetBIOS, nullptr);
172 if (!computerName)
173 return -1;
174 ws = computerName;
175 }
176
177 const size_t len = strlen(ws);
178 const SECURITY_STATUS status = ntlm_SetContextWorkstationX(context, FALSE, ws, len);
179 free(computerName);
180
181 return (status == SEC_E_OK) ? 1 : -1;
182}
183
184WINPR_ATTR_NODISCARD
185static int ntlm_SetContextServicePrincipalNameW(NTLM_CONTEXT* context, LPWSTR ServicePrincipalName)
186{
187 WINPR_ASSERT(context);
188
189 ntlm_free_unicode_string(&context->ServicePrincipalName);
190 if (!ServicePrincipalName)
191 return 1;
192
193 const size_t len = _wcslen(ServicePrincipalName);
194 context->ServicePrincipalName = ntlm_from_unicode_string_w(ServicePrincipalName, len);
195 if (ntlm_is_unicode_string_empty(&context->ServicePrincipalName))
196 return -1;
197
198 return 1;
199}
200
201WINPR_ATTR_NODISCARD
202static int ntlm_SetContextTargetName(NTLM_CONTEXT* context, char* TargetName)
203{
204 char* name = TargetName;
205 WINPR_ASSERT(context);
206
207 if (!name)
208 {
209 size_t nSize = 0;
210 char* computerName = get_computer_name(ComputerNameNetBIOS, &nSize);
211
212 if (!computerName)
213 return -1;
214
215 if (nSize > MAX_COMPUTERNAME_LENGTH)
216 computerName[MAX_COMPUTERNAME_LENGTH] = '\0';
217
218 name = computerName;
219
220 if (!name)
221 return -1;
222
223 CharUpperA(name);
224 }
225
226 size_t len = 0;
227 sspi_SecBufferFree(&context->TargetName);
228 context->TargetName.pvBuffer = ConvertUtf8ToWCharAlloc(name, &len);
229
230 if (!context->TargetName.pvBuffer || (len > UINT16_MAX / sizeof(WCHAR)))
231 {
232 free(context->TargetName.pvBuffer);
233 context->TargetName.pvBuffer = nullptr;
234
235 if (!TargetName)
236 free(name);
237
238 return -1;
239 }
240
241 context->TargetName.cbBuffer = (USHORT)(len * sizeof(WCHAR));
242
243 if (!TargetName)
244 free(name);
245
246 return 1;
247}
248
249static void ntlm_ContextFree(NTLM_CONTEXT* context)
250{
251 if (!context)
252 return;
253
254 winpr_RC4_Free(context->SendRc4Seal);
255 winpr_RC4_Free(context->RecvRc4Seal);
256 sspi_SecBufferFree(&context->NegotiateMessage);
257 sspi_SecBufferFree(&context->ChallengeMessage);
258 sspi_SecBufferFree(&context->AuthenticateMessage);
259 sspi_SecBufferFree(&context->ChallengeTargetInfo);
260 sspi_SecBufferFree(&context->AuthenticateTargetInfo);
261 sspi_SecBufferFree(&context->TargetName);
262 sspi_SecBufferFree(&context->NtChallengeResponse);
263 sspi_SecBufferFree(&context->LmChallengeResponse);
264 ntlm_free_unicode_string(&context->ServicePrincipalName);
265 ntlm_free_unicode_string(&context->Workstation);
266 ntlm_free_unicode_string(&context->NbComputerName);
267 ntlm_free_unicode_string(&context->NbDomainName);
268 ntlm_free_unicode_string(&context->DnsComputerName);
269 ntlm_free_unicode_string(&context->DnsDomainName);
270
271 ntlm_free_messages(context);
272
273 /* Zero sensitive key material before freeing the context */
274 memset(context->NtlmHash, 0, sizeof(context->NtlmHash));
275 memset(context->NtlmV2Hash, 0, sizeof(context->NtlmV2Hash));
276 memset(context->SessionBaseKey, 0, sizeof(context->SessionBaseKey));
277 memset(context->KeyExchangeKey, 0, sizeof(context->KeyExchangeKey));
278 memset(context->RandomSessionKey, 0, sizeof(context->RandomSessionKey));
279 memset(context->ExportedSessionKey, 0, sizeof(context->ExportedSessionKey));
280 memset(context->EncryptedRandomSessionKey, 0, sizeof(context->EncryptedRandomSessionKey));
281 memset(context->NtProofString, 0, sizeof(context->NtProofString));
282 free(context);
283}
284
285WINPR_ATTR_NODISCARD
286static int ntlm_get_target_computer_name(PUNICODE_STRING pName,
287 WINPR_ATTR_UNUSED COMPUTER_NAME_FORMAT type)
288{
289 WINPR_ASSERT(pName);
290 ntlm_free_unicode_string(pName);
291
292 size_t len = 0;
293 char* name = get_computer_name(ComputerNameNetBIOS, &len);
294 if (!name)
295 return -1;
296
297 CharUpperA(name);
298
299 *pName = ntlm_from_unicode_string_utf8(name, len);
300 free(name);
301
302 return !ntlm_is_unicode_string_empty(pName);
303}
304
305WINPR_ATTR_NODISCARD
306static BOOL ntlm_ContextFillDefaultNames(NTLM_CONTEXT* context)
307{
308 WINPR_ASSERT(context);
309
310 if (ntlm_SetContextWorkstation(context, nullptr) < 0)
311 return FALSE;
312
313 if (ntlm_get_target_computer_name(&context->NbDomainName, ComputerNameNetBIOS) < 0)
314 return FALSE;
315
316 if (ntlm_get_target_computer_name(&context->NbComputerName, ComputerNameNetBIOS) < 0)
317 return FALSE;
318
319 if (ntlm_get_target_computer_name(&context->DnsDomainName, ComputerNameDnsDomain) < 0)
320 return FALSE;
321
322 if (ntlm_get_target_computer_name(&context->DnsComputerName, ComputerNameDnsHostname) < 0)
323 return FALSE;
324 return TRUE;
325}
326
327static BOOL ntlm_try_set_from_registry(HKEY hKey, const char* key, UNICODE_STRING* ustr)
328{
329 WINPR_ASSERT(hKey);
330 WINPR_ASSERT(key);
331
332 UNICODE_STRING str = WINPR_C_ARRAY_INIT;
333
334 WCHAR wkey[64] = WINPR_C_ARRAY_INIT;
335 const SSIZE_T res = ConvertUtf8ToWChar(key, wkey, ARRAYSIZE(wkey));
336 if (res < 0)
337 goto fail;
338 WINPR_ASSERT((size_t)res < ARRAYSIZE(wkey));
339
340 DWORD dwSize = 0;
341 DWORD dwType = 0;
342 if (RegQueryValueExW(hKey, wkey, nullptr, &dwType, nullptr, &dwSize) != ERROR_SUCCESS)
343 goto fail;
344
345 if ((dwSize > UINT16_MAX) || ((dwSize % 2) != 0))
346 goto fail;
347
348 str.Buffer = calloc(dwSize / sizeof(WCHAR) + 1, sizeof(WCHAR));
349 if (!str.Buffer)
350 goto fail;
351 str.Length = WINPR_ASSERTING_INT_CAST(UINT16, dwSize);
352 str.MaximumLength = WINPR_ASSERTING_INT_CAST(UINT16, dwSize);
353
354 const LONG rc = RegQueryValueExW(hKey, wkey, nullptr, &dwType, (BYTE*)str.Buffer, &dwSize);
355 if (rc != ERROR_SUCCESS)
356 goto fail;
357 ntlm_free_unicode_string(ustr);
358 *ustr = str;
359 return TRUE;
360
361fail:
362 ntlm_free_unicode_string(&str);
363 return FALSE;
364}
365
366WINPR_ATTR_NODISCARD
367static BOOL ntlm_ContextFromConfig(NTLM_CONTEXT* context)
368{
369 {
370 WINPR_ASSERT(context);
371
372 char* key = winpr_getApplicatonDetailsRegKey(WINPR_KEY);
373 if (key)
374 {
375 HKEY hKey = nullptr;
376
377 const LONG status =
378 RegOpenKeyExA(HKEY_LOCAL_MACHINE, key, 0, KEY_READ | KEY_WOW64_64KEY, &hKey);
379 free(key);
380
381 if (status == ERROR_SUCCESS)
382 {
383 DWORD dwValue = 0;
384 DWORD dwSize = 0;
385 DWORD dwType = 0;
386
387 if (RegQueryValueEx(hKey, _T("NTLMv2"), nullptr, &dwType, (BYTE*)&dwValue,
388 &dwSize) == ERROR_SUCCESS)
389 context->NTLMv2 = dwValue ? 1 : 0;
390
391 if (RegQueryValueEx(hKey, _T("UseMIC"), nullptr, &dwType, (BYTE*)&dwValue,
392 &dwSize) == ERROR_SUCCESS)
393 context->UseMIC = dwValue ? 1 : 0;
394
395 if (RegQueryValueEx(hKey, _T("SendVersionInfo"), nullptr, &dwType, (BYTE*)&dwValue,
396 &dwSize) == ERROR_SUCCESS)
397 context->SendVersionInfo = dwValue ? 1 : 0;
398
399 if (RegQueryValueEx(hKey, _T("SendSingleHostData"), nullptr, &dwType,
400 (BYTE*)&dwValue, &dwSize) == ERROR_SUCCESS)
401 context->SendSingleHostData = dwValue ? 1 : 0;
402
403 if (RegQueryValueEx(hKey, _T("SendWorkstationName"), nullptr, &dwType,
404 (BYTE*)&dwValue, &dwSize) == ERROR_SUCCESS)
405 context->SendWorkstationName = dwValue ? 1 : 0;
406
407 (void)ntlm_try_set_from_registry(hKey, "WorkstationName", &context->Workstation);
408 (void)ntlm_try_set_from_registry(hKey, "NbDomainName", &context->NbDomainName);
409 (void)ntlm_try_set_from_registry(hKey, "NbComputerName", &context->NbComputerName);
410 (void)ntlm_try_set_from_registry(hKey, "DnsDomainName", &context->DnsDomainName);
411 (void)ntlm_try_set_from_registry(hKey, "DnsComputerName",
412 &context->DnsComputerName);
413
414 RegCloseKey(hKey);
415 }
416 }
417 }
418
419 HKEY hKey = nullptr;
420 const LONG status =
421 RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("System\\CurrentControlSet\\Control\\LSA"), 0,
422 KEY_READ | KEY_WOW64_64KEY, &hKey);
423
424 if (status == ERROR_SUCCESS)
425 {
426 DWORD dwType = 0;
427 DWORD dwSize = 0;
428 DWORD dwValue = 0;
429 if (RegQueryValueEx(hKey, _T("SuppressExtendedProtection"), nullptr, &dwType,
430 (BYTE*)&dwValue, &dwSize) == ERROR_SUCCESS)
431 context->SuppressExtendedProtection = dwValue ? 1 : 0;
432
433 RegCloseKey(hKey);
434 }
435
436 /*
437 * Extended Protection is enabled by default in Windows 7,
438 * but enabling it in WinPR breaks TS Gateway at this point
439 */
440 context->SuppressExtendedProtection = FALSE;
441 return TRUE;
442}
443
444WINPR_ATTR_MALLOC(ntlm_ContextFree, 1)
445static NTLM_CONTEXT* ntlm_ContextNew(void)
446{
447 NTLM_CONTEXT* context = (NTLM_CONTEXT*)calloc(1, sizeof(NTLM_CONTEXT));
448
449 if (!context)
450 return nullptr;
451
452 context->NTLMv2 = TRUE;
453 context->UseMIC = FALSE;
454 context->SendVersionInfo = TRUE;
455 context->SendSingleHostData = FALSE;
456 context->SendWorkstationName = TRUE;
457 context->NegotiateKeyExchange = TRUE;
458 context->UseSamFileDatabase = TRUE;
459
460 context->NegotiateFlags = 0;
461 context->LmCompatibilityLevel = 3;
462 ntlm_change_state(context, NTLM_STATE_INITIAL);
463 FillMemory(context->MachineID, sizeof(context->MachineID), 0xAA);
464
465 if (context->NTLMv2)
466 context->UseMIC = TRUE;
467
468 if (!ntlm_ContextFillDefaultNames(context))
469 goto fail;
470 if (!ntlm_ContextFromConfig(context))
471 goto fail;
472
473 return context;
474
475fail:
476 ntlm_ContextFree(context);
477 return nullptr;
478}
479
480WINPR_ATTR_NODISCARD
481static SECURITY_STATUS SEC_ENTRY ntlm_AcquireCredentialsHandleW(
482 WINPR_ATTR_UNUSED SEC_WCHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_WCHAR* pszPackage,
483 ULONG fCredentialUse, WINPR_ATTR_UNUSED void* pvLogonID, void* pAuthData,
484 SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
485 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
486{
487 if ((fCredentialUse != SECPKG_CRED_OUTBOUND) && (fCredentialUse != SECPKG_CRED_INBOUND) &&
488 (fCredentialUse != SECPKG_CRED_BOTH))
489 {
490 return SEC_E_INVALID_PARAMETER;
491 }
492
493 SSPI_CREDENTIALS* credentials = sspi_CredentialsNew();
494
495 if (!credentials)
496 return SEC_E_INTERNAL_ERROR;
497
498 credentials->fCredentialUse = fCredentialUse;
499 credentials->pGetKeyFn = pGetKeyFn;
500 credentials->pvGetKeyArgument = pvGetKeyArgument;
501
502#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
503 SEC_WINPR_NTLM_SETTINGS* settingsV1 = nullptr;
504#endif
505 SEC_WINPR_NTLM_SETTINGS_V2* settingsV2 = nullptr;
506 if (pAuthData)
507 {
508 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
509
510 if (sspi_CopyAuthIdentity(&(credentials->identity),
511 (const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData) < 0)
512 {
513 sspi_CredentialsFree(credentials);
514 return SEC_E_INVALID_PARAMETER;
515 }
516
517#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
518 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
519 settingsV1 = (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->ntlmSettings);
520#endif
521
522 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED_v2)
523 {
524 const SEC_WINNT_AUTH_IDENTITY_WINPR_V2* auth =
525 (const SEC_WINNT_AUTH_IDENTITY_WINPR_V2*)pAuthData;
526 WINPR_ASSERT(auth);
527 if (auth->version < SEC_WINNT_AUTH_IDENTITY_WINPR_V2_REVISION_1)
528 return SEC_E_INVALID_PARAMETER;
529 settingsV2 = auth->ntlmSettingsV2;
530 }
531 }
532
533#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
534 if (settingsV1)
535 {
536 if (settingsV1->samFile)
537 {
538 if (!sspi_CloneSecSettingsString(&credentials->ntlmSettingsV2->samFile,
539 settingsV1->samFile))
540 {
541 sspi_CredentialsFree(credentials);
542 return SEC_E_INSUFFICIENT_MEMORY;
543 }
544 }
545 credentials->ntlmSettingsV2->hashCallback = settingsV1->hashCallback;
546 credentials->ntlmSettingsV2->hashCallbackArg = settingsV1->hashCallbackArg;
547 }
548#endif
549
550 if (settingsV2)
551 {
552 sspi_FreeSecNtlmSettings(credentials->ntlmSettingsV2);
553 credentials->ntlmSettingsV2 = sspi_CloneSecNtlmSettings(settingsV2);
554 if (!credentials->ntlmSettingsV2)
555 {
556 sspi_CredentialsFree(credentials);
557 return SEC_E_INVALID_PARAMETER;
558 }
559 }
560
561 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
562 sspi_SecureHandleSetPackageId(phCredential, SSPI_PACKAGE_NTLM);
563 return SEC_E_OK;
564}
565
566WINPR_ATTR_NODISCARD
567static SECURITY_STATUS SEC_ENTRY ntlm_AcquireCredentialsHandleA(
568 SEC_CHAR* pszPrincipal, SEC_CHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
569 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
570 PTimeStamp ptsExpiry)
571{
572 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
573 SEC_WCHAR* principal = nullptr;
574 SEC_WCHAR* package = nullptr;
575
576 if (pszPrincipal)
577 {
578 principal = ConvertUtf8ToWCharAlloc(pszPrincipal, nullptr);
579 if (!principal)
580 goto fail;
581 }
582 if (pszPackage)
583 {
584 package = ConvertUtf8ToWCharAlloc(pszPackage, nullptr);
585 if (!package)
586 goto fail;
587 }
588
589 status =
590 ntlm_AcquireCredentialsHandleW(principal, package, fCredentialUse, pvLogonID, pAuthData,
591 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
592
593fail:
594 free(principal);
595 free(package);
596
597 return status;
598}
599
600WINPR_ATTR_NODISCARD
601static SECURITY_STATUS SEC_ENTRY ntlm_FreeCredentialsHandle(PCredHandle phCredential)
602{
603 if (!phCredential)
604 return SEC_E_INVALID_HANDLE;
605
606 SSPI_CREDENTIALS* credentials =
607 (SSPI_CREDENTIALS*)sspi_SecureHandleGetLowerPointer(phCredential);
608 sspi_SecureHandleInvalidate(phCredential);
609 if (!credentials)
610 return SEC_E_INVALID_HANDLE;
611
612 sspi_CredentialsFree(credentials);
613 return SEC_E_OK;
614}
615
616WINPR_ATTR_NODISCARD
617static SECURITY_STATUS SEC_ENTRY ntlm_QueryCredentialsAttributesW(
618 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
619 WINPR_ATTR_UNUSED void* pBuffer)
620{
621 if (ulAttribute == SECPKG_CRED_ATTR_NAMES)
622 {
623 return SEC_E_OK;
624 }
625
626 WLog_ERR(TAG, "TODO: Implement");
627 return SEC_E_UNSUPPORTED_FUNCTION;
628}
629
630WINPR_ATTR_NODISCARD
631static SECURITY_STATUS SEC_ENTRY ntlm_QueryCredentialsAttributesA(PCredHandle phCredential,
632 ULONG ulAttribute, void* pBuffer)
633{
634 return ntlm_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
635}
636
637WINPR_ATTR_NODISCARD
638static SECURITY_STATUS ntml_setUnicodeStringA(UNICODE_STRING* str, const char* val, size_t charlen);
639
643WINPR_ATTR_NODISCARD
644static SECURITY_STATUS SEC_ENTRY ntlm_AcceptSecurityContext(
645 PCredHandle phCredential, PCtxtHandle phContext, PSecBufferDesc pInput, ULONG fContextReq,
646 WINPR_ATTR_UNUSED ULONG TargetDataRep, PCtxtHandle phNewContext, PSecBufferDesc pOutput,
647 WINPR_ATTR_UNUSED PULONG pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsTimeStamp)
648{
649 SECURITY_STATUS status = 0;
650 SSPI_CREDENTIALS* credentials = nullptr;
651 PSecBuffer input_buffer = nullptr;
652 PSecBuffer output_buffer = nullptr;
653
654 /* behave like windows SSPIs that don't want empty context */
655 if (phContext && !phContext->dwLower && !phContext->dwUpper)
656 return SEC_E_INVALID_HANDLE;
657
658 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
659
660 if (!context)
661 {
662 context = ntlm_ContextNew();
663
664 if (!context)
665 return SEC_E_INSUFFICIENT_MEMORY;
666
667 context->server = TRUE;
668
669 if (fContextReq & ASC_REQ_CONFIDENTIALITY)
670 context->confidentiality = TRUE;
671
672 credentials = (SSPI_CREDENTIALS*)sspi_SecureHandleGetLowerPointer(phCredential);
673 context->credentials = credentials;
674 context->SamFile = credentials->ntlmSettingsV2->samFile;
675 context->HashCallback = credentials->ntlmSettingsV2->hashCallback;
676 context->HashCallbackArg = credentials->ntlmSettingsV2->hashCallbackArg;
677
678 if (credentials->ntlmSettingsV2->dnsComputerName)
679 {
680 const SECURITY_STATUS rc = ntml_setUnicodeStringA(
681 &context->DnsComputerName, credentials->ntlmSettingsV2->dnsComputerName,
682 strlen(credentials->ntlmSettingsV2->dnsComputerName));
683 if (SEC_E_OK != rc)
684 return rc;
685 }
686
687 if (credentials->ntlmSettingsV2->dnsDomainName)
688 {
689 const SECURITY_STATUS rc = ntml_setUnicodeStringA(
690 &context->DnsDomainName, credentials->ntlmSettingsV2->dnsDomainName,
691 strlen(credentials->ntlmSettingsV2->dnsDomainName));
692 if (SEC_E_OK != rc)
693 return rc;
694 }
695
696 if (credentials->ntlmSettingsV2->netBiosComputerName)
697 {
698 const SECURITY_STATUS rc = ntml_setUnicodeStringA(
699 &context->NbComputerName, credentials->ntlmSettingsV2->netBiosComputerName,
700 strlen(credentials->ntlmSettingsV2->netBiosComputerName));
701 if (SEC_E_OK != rc)
702 return rc;
703 }
704
705 if (credentials->ntlmSettingsV2->netBiosDomainName)
706 {
707 const SECURITY_STATUS rc = ntml_setUnicodeStringA(
708 &context->NbDomainName, credentials->ntlmSettingsV2->netBiosDomainName,
709 strlen(credentials->ntlmSettingsV2->netBiosDomainName));
710 if (SEC_E_OK != rc)
711 return rc;
712 }
713
714 if (!ntlm_SetContextTargetName(context, credentials->ntlmSettingsV2->targetName))
715 return SEC_E_INVALID_HANDLE;
716 sspi_SecureHandleSetLowerPointer(phNewContext, context);
717 sspi_SecureHandleSetPackageId(phNewContext, SSPI_PACKAGE_NTLM);
718 }
719
720 switch (ntlm_get_state(context))
721 {
722 case NTLM_STATE_INITIAL:
723 {
724 ntlm_change_state(context, NTLM_STATE_NEGOTIATE);
725
726 if (!pInput)
727 return SEC_E_INVALID_TOKEN;
728
729 if (pInput->cBuffers < 1)
730 return SEC_E_INVALID_TOKEN;
731
732 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
733
734 if (!input_buffer)
735 return SEC_E_INVALID_TOKEN;
736
737 if (input_buffer->cbBuffer < 1)
738 return SEC_E_INVALID_TOKEN;
739
740 status = ntlm_read_NegotiateMessage(context, input_buffer);
741 if (status != SEC_I_CONTINUE_NEEDED)
742 return status;
743
744 if (ntlm_get_state(context) == NTLM_STATE_CHALLENGE)
745 {
746 if (!pOutput)
747 return SEC_E_INVALID_TOKEN;
748
749 if (pOutput->cBuffers < 1)
750 return SEC_E_INVALID_TOKEN;
751
752 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
753
754 if (!output_buffer->BufferType)
755 return SEC_E_INVALID_TOKEN;
756
757 if (output_buffer->cbBuffer < 1)
758 return SEC_E_INSUFFICIENT_MEMORY;
759
760 return ntlm_write_ChallengeMessage(context, output_buffer);
761 }
762
763 return SEC_E_OUT_OF_SEQUENCE;
764 }
765
766 case NTLM_STATE_AUTHENTICATE:
767 {
768 if (!pInput)
769 return SEC_E_INVALID_TOKEN;
770
771 if (pInput->cBuffers < 1)
772 return SEC_E_INVALID_TOKEN;
773
774 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
775
776 if (!input_buffer)
777 return SEC_E_INVALID_TOKEN;
778
779 if (input_buffer->cbBuffer < 1)
780 return SEC_E_INVALID_TOKEN;
781
782 status = ntlm_read_AuthenticateMessage(context, input_buffer);
783
784 if (pOutput)
785 {
786 for (ULONG i = 0; i < pOutput->cBuffers; i++)
787 {
788 pOutput->pBuffers[i].cbBuffer = 0;
789 pOutput->pBuffers[i].BufferType = SECBUFFER_TOKEN;
790 }
791 }
792
793 return status;
794 }
795
796 default:
797 return SEC_E_OUT_OF_SEQUENCE;
798 }
799}
800
801WINPR_ATTR_NODISCARD
802static SECURITY_STATUS SEC_ENTRY
803ntlm_ImpersonateSecurityContext(WINPR_ATTR_UNUSED PCtxtHandle phContext)
804{
805 return SEC_E_OK;
806}
807
808WINPR_ATTR_NODISCARD
809static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW(
810 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
811 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep, PSecBufferDesc pInput,
812 WINPR_ATTR_UNUSED ULONG Reserved2, PCtxtHandle phNewContext, PSecBufferDesc pOutput,
813 WINPR_ATTR_UNUSED PULONG pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
814{
815 SECURITY_STATUS status = 0;
816 SSPI_CREDENTIALS* credentials = nullptr;
817 PSecBuffer input_buffer = nullptr;
818 PSecBuffer output_buffer = nullptr;
819
820 /* behave like windows SSPIs that don't want empty context */
821 if (phContext && !phContext->dwLower && !phContext->dwUpper)
822 return SEC_E_INVALID_HANDLE;
823
824 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
825
826 if (pInput)
827 {
828 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
829 }
830
831 if (!context)
832 {
833 context = ntlm_ContextNew();
834
835 if (!context)
836 return SEC_E_INSUFFICIENT_MEMORY;
837
838 if (fContextReq & ISC_REQ_CONFIDENTIALITY)
839 context->confidentiality = TRUE;
840
841 credentials = (SSPI_CREDENTIALS*)sspi_SecureHandleGetLowerPointer(phCredential);
842 context->credentials = credentials;
843
844 if (ntlm_SetContextServicePrincipalNameW(context, pszTargetName) < 0)
845 {
846 ntlm_ContextFree(context);
847 return SEC_E_INTERNAL_ERROR;
848 }
849
850 sspi_SecureHandleSetLowerPointer(phNewContext, context);
851 sspi_SecureHandleSetPackageId(phNewContext, SSPI_PACKAGE_NTLM);
852 }
853
854 if ((!input_buffer) || (ntlm_get_state(context) == NTLM_STATE_AUTHENTICATE))
855 {
856 if (!pOutput)
857 return SEC_E_INVALID_TOKEN;
858
859 if (pOutput->cBuffers < 1)
860 return SEC_E_INVALID_TOKEN;
861
862 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
863
864 if (!output_buffer)
865 return SEC_E_INVALID_TOKEN;
866
867 if (output_buffer->cbBuffer < 1)
868 return SEC_E_INVALID_TOKEN;
869
870 if (ntlm_get_state(context) == NTLM_STATE_INITIAL)
871 ntlm_change_state(context, NTLM_STATE_NEGOTIATE);
872
873 if (ntlm_get_state(context) == NTLM_STATE_NEGOTIATE)
874 return ntlm_write_NegotiateMessage(context, output_buffer);
875
876 return SEC_E_OUT_OF_SEQUENCE;
877 }
878 else
879 {
880 if (!input_buffer)
881 return SEC_E_INVALID_TOKEN;
882
883 if (input_buffer->cbBuffer < 1)
884 return SEC_E_INVALID_TOKEN;
885
886 PSecBuffer channel_bindings = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
887
888 if (channel_bindings)
889 {
890 context->Bindings.BindingsLength = channel_bindings->cbBuffer;
891 context->Bindings.Bindings = (SEC_CHANNEL_BINDINGS*)channel_bindings->pvBuffer;
892 }
893
894 if (ntlm_get_state(context) == NTLM_STATE_CHALLENGE)
895 {
896 status = ntlm_read_ChallengeMessage(context, input_buffer);
897
898 if (status != SEC_I_CONTINUE_NEEDED)
899 return status;
900
901 if (!pOutput)
902 return SEC_E_INVALID_TOKEN;
903
904 if (pOutput->cBuffers < 1)
905 return SEC_E_INVALID_TOKEN;
906
907 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
908
909 if (!output_buffer)
910 return SEC_E_INVALID_TOKEN;
911
912 if (output_buffer->cbBuffer < 1)
913 return SEC_E_INSUFFICIENT_MEMORY;
914
915 if (ntlm_get_state(context) == NTLM_STATE_AUTHENTICATE)
916 return ntlm_write_AuthenticateMessage(context, output_buffer);
917 }
918
919 return SEC_E_OUT_OF_SEQUENCE;
920 }
921
922 return SEC_E_OUT_OF_SEQUENCE;
923}
924
928WINPR_ATTR_NODISCARD
929static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextA(
930 PCredHandle phCredential, PCtxtHandle phContext, SEC_CHAR* pszTargetName, ULONG fContextReq,
931 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
932 PCtxtHandle phNewContext, PSecBufferDesc pOutput, PULONG pfContextAttr, PTimeStamp ptsExpiry)
933{
934 SECURITY_STATUS status = 0;
935 SEC_WCHAR* pszTargetNameW = nullptr;
936
937 if (pszTargetName)
938 {
939 pszTargetNameW = ConvertUtf8ToWCharAlloc(pszTargetName, nullptr);
940 if (!pszTargetNameW)
941 return SEC_E_INTERNAL_ERROR;
942 }
943
944 status = ntlm_InitializeSecurityContextW(phCredential, phContext, pszTargetNameW, fContextReq,
945 Reserved1, TargetDataRep, pInput, Reserved2,
946 phNewContext, pOutput, pfContextAttr, ptsExpiry);
947 free(pszTargetNameW);
948 return status;
949}
950
951/* http://msdn.microsoft.com/en-us/library/windows/desktop/aa375354 */
952WINPR_ATTR_NODISCARD
953static SECURITY_STATUS SEC_ENTRY ntlm_DeleteSecurityContext(PCtxtHandle phContext)
954{
955 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
956 sspi_SecureHandleInvalidate(phContext);
957 ntlm_ContextFree(context);
958 return SEC_E_OK;
959}
960
961SECURITY_STATUS ntlm_computeProofValue(NTLM_CONTEXT* ntlm, SecBuffer* ntproof)
962{
963 BYTE* blob = nullptr;
964 SecBuffer* target = nullptr;
965
966 WINPR_ASSERT(ntlm);
967 WINPR_ASSERT(ntproof);
968
969 target = &ntlm->ChallengeTargetInfo;
970
971 if (!sspi_SecBufferAlloc(ntproof, 36 + target->cbBuffer))
972 return SEC_E_INSUFFICIENT_MEMORY;
973
974 blob = (BYTE*)ntproof->pvBuffer;
975 CopyMemory(blob, ntlm->ServerChallenge, 8); /* Server challenge. */
976 blob[8] = 1; /* Response version. */
977 blob[9] = 1; /* Highest response version understood by the client. */
978 /* Reserved 6B. */
979 CopyMemory(&blob[16], ntlm->Timestamp, 8); /* Time. */
980 CopyMemory(&blob[24], ntlm->ClientChallenge, 8); /* Client challenge. */
981 /* Reserved 4B. */
982 /* Server name. */
983 CopyMemory(&blob[36], target->pvBuffer, target->cbBuffer);
984 return SEC_E_OK;
985}
986
987SECURITY_STATUS ntlm_computeMicValue(NTLM_CONTEXT* ntlm, SecBuffer* micvalue)
988{
989 BYTE* blob = nullptr;
990 ULONG msgSize = 0;
991
992 WINPR_ASSERT(ntlm);
993 WINPR_ASSERT(micvalue);
994
995 msgSize = ntlm->NegotiateMessage.cbBuffer + ntlm->ChallengeMessage.cbBuffer +
996 ntlm->AuthenticateMessage.cbBuffer;
997
998 if (!sspi_SecBufferAlloc(micvalue, msgSize))
999 return SEC_E_INSUFFICIENT_MEMORY;
1000
1001 blob = (BYTE*)micvalue->pvBuffer;
1002 CopyMemory(blob, ntlm->NegotiateMessage.pvBuffer, ntlm->NegotiateMessage.cbBuffer);
1003 blob += ntlm->NegotiateMessage.cbBuffer;
1004 CopyMemory(blob, ntlm->ChallengeMessage.pvBuffer, ntlm->ChallengeMessage.cbBuffer);
1005 blob += ntlm->ChallengeMessage.cbBuffer;
1006 CopyMemory(blob, ntlm->AuthenticateMessage.pvBuffer, ntlm->AuthenticateMessage.cbBuffer);
1007 blob += ntlm->MessageIntegrityCheckOffset;
1008 ZeroMemory(blob, 16);
1009 return SEC_E_OK;
1010}
1011
1012WINPR_ATTR_NODISCARD
1013static bool identityToAuthIdentity(const SEC_WINNT_AUTH_IDENTITY* identity,
1014 SecPkgContext_AuthIdentity* pAuthIdentity)
1015{
1016 WINPR_ASSERT(identity);
1017
1018 if (!pAuthIdentity)
1019 return false;
1020
1021 const SecPkgContext_AuthIdentity empty = WINPR_C_ARRAY_INIT;
1022 *pAuthIdentity = empty;
1023
1024 if ((identity->Flags & SEC_WINNT_AUTH_IDENTITY_UNICODE) != 0)
1025 {
1026 if (identity->UserLength > 0)
1027 {
1028 if (ConvertWCharNToUtf8(identity->User, identity->UserLength, pAuthIdentity->User,
1029 ARRAYSIZE(pAuthIdentity->User)) <= 0)
1030 return false;
1031 }
1032
1033 if (identity->DomainLength > 0)
1034 {
1035 if (ConvertWCharNToUtf8(identity->Domain, identity->DomainLength, pAuthIdentity->Domain,
1036 ARRAYSIZE(pAuthIdentity->Domain)) <= 0)
1037 return false;
1038 }
1039 }
1040 else if ((identity->Flags & SEC_WINNT_AUTH_IDENTITY_ANSI) != 0)
1041 {
1042 if (identity->UserLength > 0)
1043 {
1044 const size_t len = MIN(ARRAYSIZE(pAuthIdentity->User) - 1, identity->UserLength);
1045 strncpy(pAuthIdentity->User, (char*)identity->User, len);
1046 pAuthIdentity->User[len] = '\0';
1047 }
1048
1049 if (identity->DomainLength > 0)
1050 {
1051 const size_t len = MIN(ARRAYSIZE(pAuthIdentity->Domain) - 1, identity->DomainLength);
1052 strncpy(pAuthIdentity->Domain, (char*)identity->Domain, len);
1053 pAuthIdentity->Domain[len] = '\0';
1054 }
1055 }
1056 else
1057 return false;
1058 return true;
1059}
1060
1061WINPR_ATTR_NODISCARD
1062static SECURITY_STATUS SEC_ENTRY ntlm_QueryContextAttributesCommon(PCtxtHandle phContext,
1063 ULONG ulAttribute, void* pBuffer)
1064{
1065 if (!phContext)
1066 return SEC_E_INVALID_HANDLE;
1067
1068 if (!pBuffer)
1069 return SEC_E_INSUFFICIENT_MEMORY;
1070
1071 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
1072 if (!check_context(context))
1073 return SEC_E_INVALID_HANDLE;
1074
1075 switch (ulAttribute)
1076 {
1077 case SECPKG_ATTR_AUTH_IDENTITY:
1078 {
1079 SecPkgContext_AuthIdentity* AuthIdentity = (SecPkgContext_AuthIdentity*)pBuffer;
1080 SSPI_CREDENTIALS* credentials = context->credentials;
1081 if (!credentials)
1082 return SEC_E_INTERNAL_ERROR;
1083 if (!identityToAuthIdentity(&credentials->identity, AuthIdentity))
1084 return SEC_E_INTERNAL_ERROR;
1085 context->UseSamFileDatabase = FALSE;
1086 return SEC_E_OK;
1087 }
1088 case SECPKG_ATTR_SIZES:
1089 {
1090 SecPkgContext_Sizes* ContextSizes = (SecPkgContext_Sizes*)pBuffer;
1091 ContextSizes->cbMaxToken = 2010;
1092 ContextSizes->cbMaxSignature = 16; /* the size of expected signature is 16 bytes */
1093 ContextSizes->cbBlockSize = 0; /* no padding */
1094 ContextSizes->cbSecurityTrailer = 16; /* no security trailer appended in NTLM
1095 contrary to Kerberos */
1096 return SEC_E_OK;
1097 }
1098 case SECPKG_ATTR_AUTH_NTLM_NTPROOF_VALUE:
1099 return ntlm_computeProofValue(context, (SecBuffer*)pBuffer);
1100
1101 case SECPKG_ATTR_AUTH_NTLM_RANDKEY:
1102 {
1103 SecBuffer* randkey = (SecBuffer*)pBuffer;
1104
1105 if (!sspi_SecBufferAlloc(randkey, 16))
1106 return (SEC_E_INSUFFICIENT_MEMORY);
1107
1108 CopyMemory(randkey->pvBuffer, context->EncryptedRandomSessionKey, 16);
1109 return (SEC_E_OK);
1110 }
1111
1112 case SECPKG_ATTR_AUTH_NTLM_MIC:
1113 {
1114 SecBuffer* mic = (SecBuffer*)pBuffer;
1115 NTLM_AUTHENTICATE_MESSAGE* message = &context->AUTHENTICATE_MESSAGE;
1116
1117 if (!sspi_SecBufferAlloc(mic, 16))
1118 return (SEC_E_INSUFFICIENT_MEMORY);
1119
1120 CopyMemory(mic->pvBuffer, message->MessageIntegrityCheck, 16);
1121 return (SEC_E_OK);
1122 }
1123
1124 case SECPKG_ATTR_AUTH_NTLM_MIC_VALUE:
1125 return ntlm_computeMicValue(context, (SecBuffer*)pBuffer);
1126
1127 default:
1128 WLog_ERR(TAG, "TODO: Implement ulAttribute=0x%08" PRIx32, ulAttribute);
1129 return SEC_E_UNSUPPORTED_FUNCTION;
1130 }
1131}
1132
1133/* http://msdn.microsoft.com/en-us/library/windows/desktop/aa379337/ */
1134WINPR_ATTR_NODISCARD
1135static SECURITY_STATUS SEC_ENTRY ntlm_QueryContextAttributesW(PCtxtHandle phContext,
1136 ULONG ulAttribute, void* pBuffer)
1137{
1138 if (!phContext)
1139 return SEC_E_INVALID_HANDLE;
1140
1141 if (!pBuffer)
1142 return SEC_E_INSUFFICIENT_MEMORY;
1143
1144 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
1145 if (!check_context(context))
1146 return SEC_E_INVALID_HANDLE;
1147
1148 switch (ulAttribute)
1149 {
1150 case SECPKG_ATTR_AUTH_NTLM_HOSTNAME:
1151 {
1152 memcpy(pBuffer, context->Workstation.Buffer, context->Workstation.Length);
1153 return SEC_E_OK;
1154 }
1155 case SECPKG_ATTR_AUTH_NTLM_NB_DOMAIN_NAME:
1156 {
1157 memcpy(pBuffer, context->NbDomainName.Buffer, context->NbDomainName.Length);
1158 return SEC_E_OK;
1159 }
1160 case SECPKG_ATTR_AUTH_NTLM_NB_COMPUTER_NAME:
1161 {
1162 memcpy(pBuffer, context->NbComputerName.Buffer, context->NbComputerName.Length);
1163 return SEC_E_OK;
1164 }
1165 case SECPKG_ATTR_AUTH_NTLM_DNS_DOMAIN_NAME:
1166 {
1167 memcpy(pBuffer, context->DnsDomainName.Buffer, context->DnsDomainName.Length);
1168 return SEC_E_OK;
1169 }
1170 case SECPKG_ATTR_AUTH_NTLM_DNS_COMPUTER_NAME:
1171 {
1172 memcpy(pBuffer, context->DnsComputerName.Buffer, context->DnsComputerName.Length);
1173 return SEC_E_OK;
1174 }
1175
1176 case SECPKG_ATTR_PACKAGE_INFO:
1177 {
1178 SecPkgContext_PackageInfoW* PackageInfo = (SecPkgContext_PackageInfoW*)pBuffer;
1179 size_t size = sizeof(SecPkgInfoW);
1180 SecPkgInfoW* pPackageInfo =
1181 (SecPkgInfoW*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1182
1183 if (!pPackageInfo)
1184 return SEC_E_INSUFFICIENT_MEMORY;
1185
1186 pPackageInfo->fCapabilities = NTLM_SecPkgInfoW.fCapabilities;
1187 pPackageInfo->wVersion = NTLM_SecPkgInfoW.wVersion;
1188 pPackageInfo->wRPCID = NTLM_SecPkgInfoW.wRPCID;
1189 pPackageInfo->cbMaxToken = NTLM_SecPkgInfoW.cbMaxToken;
1190 pPackageInfo->Name = _wcsdup(NTLM_SecPkgInfoW.Name);
1191 pPackageInfo->Comment = _wcsdup(NTLM_SecPkgInfoW.Comment);
1192
1193 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1194 {
1195 sspi_ContextBufferFree(pPackageInfo);
1196 return SEC_E_INSUFFICIENT_MEMORY;
1197 }
1198 PackageInfo->PackageInfo = pPackageInfo;
1199 return SEC_E_OK;
1200 }
1201 default:
1202 return ntlm_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
1203 }
1204}
1205
1206WINPR_ATTR_NODISCARD
1207static SECURITY_STATUS utf8len(const UNICODE_STRING* str, void* pBuffer)
1208{
1209 WINPR_ASSERT(str);
1210 WINPR_ASSERT(pBuffer);
1211 ULONG* val = (ULONG*)pBuffer;
1212 const SSIZE_T rc = ConvertWCharNToUtf8(str->Buffer, str->Length, nullptr, 0);
1213 if (rc < 0)
1214 return SEC_E_INVALID_PARAMETER;
1215 *val = WINPR_ASSERTING_INT_CAST(ULONG, rc);
1216 return SEC_E_OK;
1217}
1218
1219WINPR_ATTR_NODISCARD
1220static SECURITY_STATUS SEC_ENTRY ntlm_QueryContextAttributesA(PCtxtHandle phContext,
1221 ULONG ulAttribute, void* pBuffer)
1222{
1223 if (!phContext)
1224 return SEC_E_INVALID_HANDLE;
1225
1226 if (!pBuffer)
1227 return SEC_E_INSUFFICIENT_MEMORY;
1228
1229 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
1230
1231 switch (ulAttribute)
1232 {
1233 case SECPKG_ATTR_AUTH_NTLM_HOSTNAME_LEN:
1234 return utf8len(&context->Workstation, pBuffer);
1235 case SECPKG_ATTR_AUTH_NTLM_NB_DOMAIN_NAME_LEN:
1236 return utf8len(&context->NbDomainName, pBuffer);
1237 case SECPKG_ATTR_AUTH_NTLM_NB_COMPUTER_NAME_LEN:
1238 return utf8len(&context->NbComputerName, pBuffer);
1239 case SECPKG_ATTR_AUTH_NTLM_DNS_DOMAIN_NAME_LEN:
1240 return utf8len(&context->DnsDomainName, pBuffer);
1241 case SECPKG_ATTR_AUTH_NTLM_DNS_COMPUTER_NAME_LEN:
1242 return utf8len(&context->DnsComputerName, pBuffer);
1243 case SECPKG_ATTR_AUTH_NTLM_HOSTNAME:
1244 {
1245 ConvertWCharNToUtf8(context->Workstation.Buffer, context->Workstation.Length, pBuffer,
1246 context->Workstation.Length);
1247 return SEC_E_OK;
1248 }
1249 case SECPKG_ATTR_AUTH_NTLM_NB_DOMAIN_NAME:
1250 {
1251 ConvertWCharNToUtf8(context->NbDomainName.Buffer, context->NbDomainName.Length, pBuffer,
1252 context->NbDomainName.Length);
1253 return SEC_E_OK;
1254 }
1255 case SECPKG_ATTR_AUTH_NTLM_NB_COMPUTER_NAME:
1256 {
1257 ConvertWCharNToUtf8(context->NbComputerName.Buffer, context->NbComputerName.Length,
1258 pBuffer, context->NbComputerName.Length);
1259 return SEC_E_OK;
1260 }
1261 case SECPKG_ATTR_AUTH_NTLM_DNS_DOMAIN_NAME:
1262 {
1263 ConvertWCharNToUtf8(context->DnsDomainName.Buffer, context->DnsDomainName.Length,
1264 pBuffer, context->DnsDomainName.Length);
1265 return SEC_E_OK;
1266 }
1267 case SECPKG_ATTR_AUTH_NTLM_DNS_COMPUTER_NAME:
1268 {
1269 ConvertWCharNToUtf8(context->DnsComputerName.Buffer, context->DnsComputerName.Length,
1270 pBuffer, context->DnsComputerName.Length);
1271 return SEC_E_OK;
1272 }
1273 case SECPKG_ATTR_PACKAGE_INFO:
1274 {
1275 SecPkgContext_PackageInfoA* PackageInfo = (SecPkgContext_PackageInfoA*)pBuffer;
1276 size_t size = sizeof(SecPkgInfoA);
1277 SecPkgInfoA* pPackageInfo =
1278 (SecPkgInfoA*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1279
1280 if (!pPackageInfo)
1281 return SEC_E_INSUFFICIENT_MEMORY;
1282
1283 pPackageInfo->fCapabilities = NTLM_SecPkgInfoA.fCapabilities;
1284 pPackageInfo->wVersion = NTLM_SecPkgInfoA.wVersion;
1285 pPackageInfo->wRPCID = NTLM_SecPkgInfoA.wRPCID;
1286 pPackageInfo->cbMaxToken = NTLM_SecPkgInfoA.cbMaxToken;
1287 pPackageInfo->Name = _strdup(NTLM_SecPkgInfoA.Name);
1288 pPackageInfo->Comment = _strdup(NTLM_SecPkgInfoA.Comment);
1289
1290 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1291 {
1292 sspi_ContextBufferFree(pPackageInfo);
1293 return SEC_E_INSUFFICIENT_MEMORY;
1294 }
1295 PackageInfo->PackageInfo = pPackageInfo;
1296 return SEC_E_OK;
1297 }
1298
1299 default:
1300 return ntlm_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
1301 }
1302}
1303
1304WINPR_ATTR_NODISCARD
1305static SECURITY_STATUS SEC_ENTRY ntlm_SetContextAttributesCommon(PCtxtHandle phContext,
1306 ULONG ulAttribute, void* pBuffer,
1307 ULONG cbBuffer)
1308{
1309 if (!phContext)
1310 return SEC_E_INVALID_HANDLE;
1311
1312 if (!pBuffer)
1313 return SEC_E_INVALID_PARAMETER;
1314
1315 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
1316 if (!context)
1317 return SEC_E_INVALID_HANDLE;
1318
1319 switch (ulAttribute)
1320 {
1321 case SECPKG_ATTR_AUTH_NTLM_HASH:
1322 {
1323 SecPkgContext_AuthNtlmHash* AuthNtlmHash = (SecPkgContext_AuthNtlmHash*)pBuffer;
1324
1325 if (cbBuffer < sizeof(SecPkgContext_AuthNtlmHash))
1326 return SEC_E_INVALID_PARAMETER;
1327
1328 if (AuthNtlmHash->Version == 1)
1329 CopyMemory(context->NtlmHash, AuthNtlmHash->NtlmHash, 16);
1330 else if (AuthNtlmHash->Version == 2)
1331 CopyMemory(context->NtlmV2Hash, AuthNtlmHash->NtlmHash, 16);
1332
1333 return SEC_E_OK;
1334 }
1335
1336 case SECPKG_ATTR_AUTH_NTLM_MESSAGE:
1337 {
1338 SecPkgContext_AuthNtlmMessage* AuthNtlmMessage =
1339 (SecPkgContext_AuthNtlmMessage*)pBuffer;
1340
1341 if (cbBuffer < sizeof(SecPkgContext_AuthNtlmMessage))
1342 return SEC_E_INVALID_PARAMETER;
1343
1344 if (AuthNtlmMessage->type == 1)
1345 {
1346 if (!ntlm_SecBufferRealloc(&context->NegotiateMessage, AuthNtlmMessage->length))
1347 return SEC_E_INSUFFICIENT_MEMORY;
1348
1349 CopyMemory(context->NegotiateMessage.pvBuffer, AuthNtlmMessage->buffer,
1350 AuthNtlmMessage->length);
1351 }
1352 else if (AuthNtlmMessage->type == 2)
1353 {
1354 if (!ntlm_SecBufferRealloc(&context->ChallengeMessage, AuthNtlmMessage->length))
1355 return SEC_E_INSUFFICIENT_MEMORY;
1356
1357 CopyMemory(context->ChallengeMessage.pvBuffer, AuthNtlmMessage->buffer,
1358 AuthNtlmMessage->length);
1359 }
1360 else if (AuthNtlmMessage->type == 3)
1361 {
1362 if (!ntlm_SecBufferRealloc(&context->AuthenticateMessage, AuthNtlmMessage->length))
1363 return SEC_E_INSUFFICIENT_MEMORY;
1364
1365 CopyMemory(context->AuthenticateMessage.pvBuffer, AuthNtlmMessage->buffer,
1366 AuthNtlmMessage->length);
1367 }
1368
1369 return SEC_E_OK;
1370 }
1371
1372 case SECPKG_ATTR_AUTH_NTLM_TIMESTAMP:
1373 {
1374 SecPkgContext_AuthNtlmTimestamp* AuthNtlmTimestamp =
1375 (SecPkgContext_AuthNtlmTimestamp*)pBuffer;
1376
1377 if (cbBuffer < sizeof(SecPkgContext_AuthNtlmTimestamp))
1378 return SEC_E_INVALID_PARAMETER;
1379
1380 if (AuthNtlmTimestamp->ChallengeOrResponse)
1381 CopyMemory(context->ChallengeTimestamp, AuthNtlmTimestamp->Timestamp, 8);
1382 else
1383 CopyMemory(context->Timestamp, AuthNtlmTimestamp->Timestamp, 8);
1384
1385 return SEC_E_OK;
1386 }
1387
1388 case SECPKG_ATTR_AUTH_NTLM_CLIENT_CHALLENGE:
1389 {
1390 SecPkgContext_AuthNtlmClientChallenge* AuthNtlmClientChallenge =
1391 (SecPkgContext_AuthNtlmClientChallenge*)pBuffer;
1392
1393 if (cbBuffer < sizeof(SecPkgContext_AuthNtlmClientChallenge))
1394 return SEC_E_INVALID_PARAMETER;
1395
1396 CopyMemory(context->ClientChallenge, AuthNtlmClientChallenge->ClientChallenge, 8);
1397 return SEC_E_OK;
1398 }
1399
1400 case SECPKG_ATTR_AUTH_NTLM_SERVER_CHALLENGE:
1401 {
1402 SecPkgContext_AuthNtlmServerChallenge* AuthNtlmServerChallenge =
1403 (SecPkgContext_AuthNtlmServerChallenge*)pBuffer;
1404
1405 if (cbBuffer < sizeof(SecPkgContext_AuthNtlmServerChallenge))
1406 return SEC_E_INVALID_PARAMETER;
1407
1408 CopyMemory(context->ServerChallenge, AuthNtlmServerChallenge->ServerChallenge, 8);
1409 return SEC_E_OK;
1410 }
1411
1412 default:
1413 WLog_ERR(TAG, "TODO: Implement ulAttribute=%08" PRIx32, ulAttribute);
1414 return SEC_E_UNSUPPORTED_FUNCTION;
1415 }
1416}
1417
1418WINPR_ATTR_NODISCARD
1419static SECURITY_STATUS ntml_setUnicodeStringW(UNICODE_STRING* str, const WCHAR* val, size_t bytelen)
1420{
1421 WINPR_ASSERT(str);
1422 ntlm_free_unicode_string(str);
1423 *str = ntlm_from_unicode_string_w(val, bytelen / sizeof(WCHAR));
1424 if (ntlm_is_unicode_string_empty(str))
1425 return SEC_E_INVALID_PARAMETER;
1426 return SEC_E_OK;
1427}
1428
1429WINPR_ATTR_NODISCARD
1430static SECURITY_STATUS utf16len(const UNICODE_STRING* str, void* pBuffer)
1431{
1432 WINPR_ASSERT(str);
1433 WINPR_ASSERT(pBuffer);
1434 ULONG* val = (ULONG*)pBuffer;
1435 *val = str->Length;
1436 return SEC_E_OK;
1437}
1438
1439WINPR_ATTR_NODISCARD
1440static SECURITY_STATUS SEC_ENTRY ntlm_SetContextAttributesW(PCtxtHandle phContext,
1441 ULONG ulAttribute, void* pBuffer,
1442 ULONG cbBuffer)
1443{
1444 if (!phContext)
1445 return SEC_E_INVALID_HANDLE;
1446
1447 if (!pBuffer)
1448 return SEC_E_INVALID_PARAMETER;
1449
1450 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
1451 if (!context)
1452 return SEC_E_INVALID_HANDLE;
1453
1454 switch (ulAttribute)
1455 {
1456 case SECPKG_ATTR_AUTH_NTLM_HOSTNAME_LEN:
1457 return utf16len(&context->Workstation, pBuffer);
1458 case SECPKG_ATTR_AUTH_NTLM_NB_DOMAIN_NAME_LEN:
1459 return utf16len(&context->NbDomainName, pBuffer);
1460 case SECPKG_ATTR_AUTH_NTLM_NB_COMPUTER_NAME_LEN:
1461 return utf16len(&context->NbComputerName, pBuffer);
1462 case SECPKG_ATTR_AUTH_NTLM_DNS_DOMAIN_NAME_LEN:
1463 return utf16len(&context->DnsDomainName, pBuffer);
1464 case SECPKG_ATTR_AUTH_NTLM_DNS_COMPUTER_NAME_LEN:
1465 return utf16len(&context->DnsComputerName, pBuffer);
1466 case SECPKG_ATTR_AUTH_NTLM_HOSTNAME:
1467 return ntml_setUnicodeStringW(&context->Workstation, pBuffer, cbBuffer);
1468 case SECPKG_ATTR_AUTH_NTLM_NB_DOMAIN_NAME:
1469 return ntml_setUnicodeStringW(&context->NbDomainName, pBuffer, cbBuffer);
1470 case SECPKG_ATTR_AUTH_NTLM_NB_COMPUTER_NAME:
1471 return ntml_setUnicodeStringW(&context->NbComputerName, pBuffer, cbBuffer);
1472 case SECPKG_ATTR_AUTH_NTLM_DNS_DOMAIN_NAME:
1473 return ntml_setUnicodeStringW(&context->DnsDomainName, pBuffer, cbBuffer);
1474 case SECPKG_ATTR_AUTH_NTLM_DNS_COMPUTER_NAME:
1475 return ntml_setUnicodeStringW(&context->DnsComputerName, pBuffer, cbBuffer);
1476
1477 default:
1478 return ntlm_SetContextAttributesCommon(phContext, ulAttribute, pBuffer, cbBuffer);
1479 }
1480}
1481
1482SECURITY_STATUS ntml_setUnicodeStringA(UNICODE_STRING* str, const char* val, size_t charlen)
1483{
1484 WINPR_ASSERT(str);
1485 ntlm_free_unicode_string(str);
1486 *str = ntlm_from_unicode_string_utf8(val, charlen);
1487 if (ntlm_is_unicode_string_empty(str))
1488 return SEC_E_INVALID_PARAMETER;
1489 return SEC_E_OK;
1490}
1491
1492WINPR_ATTR_NODISCARD
1493static SECURITY_STATUS SEC_ENTRY ntlm_SetContextAttributesA(PCtxtHandle phContext,
1494 ULONG ulAttribute, void* pBuffer,
1495 ULONG cbBuffer)
1496{
1497 if (!phContext)
1498 return SEC_E_INVALID_HANDLE;
1499
1500 if (!pBuffer)
1501 return SEC_E_INVALID_PARAMETER;
1502
1503 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
1504 if (!context)
1505 return SEC_E_INVALID_HANDLE;
1506
1507 switch (ulAttribute)
1508 {
1509 case SECPKG_ATTR_AUTH_NTLM_HOSTNAME:
1510 return ntml_setUnicodeStringA(&context->Workstation, pBuffer, cbBuffer);
1511 case SECPKG_ATTR_AUTH_NTLM_NB_DOMAIN_NAME:
1512 return ntml_setUnicodeStringA(&context->NbDomainName, pBuffer, cbBuffer);
1513 case SECPKG_ATTR_AUTH_NTLM_NB_COMPUTER_NAME:
1514 return ntml_setUnicodeStringA(&context->NbComputerName, pBuffer, cbBuffer);
1515 case SECPKG_ATTR_AUTH_NTLM_DNS_DOMAIN_NAME:
1516 return ntml_setUnicodeStringA(&context->DnsDomainName, pBuffer, cbBuffer);
1517 case SECPKG_ATTR_AUTH_NTLM_DNS_COMPUTER_NAME:
1518 return ntml_setUnicodeStringA(&context->DnsComputerName, pBuffer, cbBuffer);
1519 default:
1520 return ntlm_SetContextAttributesCommon(phContext, ulAttribute, pBuffer, cbBuffer);
1521 }
1522}
1523
1524WINPR_ATTR_NODISCARD
1525static SECURITY_STATUS SEC_ENTRY ntlm_SetCredentialsAttributesW(
1526 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
1527 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
1528{
1529 return SEC_E_UNSUPPORTED_FUNCTION;
1530}
1531
1532WINPR_ATTR_NODISCARD
1533static SECURITY_STATUS SEC_ENTRY ntlm_SetCredentialsAttributesA(
1534 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
1535 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
1536{
1537 return SEC_E_UNSUPPORTED_FUNCTION;
1538}
1539
1540WINPR_ATTR_NODISCARD
1541static SECURITY_STATUS SEC_ENTRY ntlm_RevertSecurityContext(WINPR_ATTR_UNUSED PCtxtHandle phContext)
1542{
1543 return SEC_E_OK;
1544}
1545
1546WINPR_ATTR_NODISCARD
1547static SECURITY_STATUS SEC_ENTRY ntlm_EncryptMessage(PCtxtHandle phContext,
1548 WINPR_ATTR_UNUSED ULONG fQOP,
1549 PSecBufferDesc pMessage, ULONG MessageSeqNo)
1550{
1551 const UINT32 SeqNo = MessageSeqNo;
1552 UINT32 value = 0;
1553 BYTE digest[WINPR_MD5_DIGEST_LENGTH] = WINPR_C_ARRAY_INIT;
1554 BYTE checksum[8] = WINPR_C_ARRAY_INIT;
1555 ULONG version = 1;
1556 PSecBuffer data_buffer = nullptr;
1557 PSecBuffer signature_buffer = nullptr;
1558 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
1559 if (!check_context(context))
1560 return SEC_E_INVALID_HANDLE;
1561
1562 for (ULONG index = 0; index < pMessage->cBuffers; index++)
1563 {
1564 SecBuffer* cur = &pMessage->pBuffers[index];
1565
1566 if (cur->BufferType & SECBUFFER_DATA)
1567 data_buffer = cur;
1568 else if (cur->BufferType & SECBUFFER_TOKEN)
1569 signature_buffer = cur;
1570 }
1571
1572 if (!data_buffer)
1573 return SEC_E_INVALID_TOKEN;
1574
1575 if (!signature_buffer)
1576 return SEC_E_INVALID_TOKEN;
1577
1578 if (signature_buffer->cbBuffer < 16)
1579 return SEC_E_INSUFFICIENT_MEMORY;
1580
1581 /* Copy original data buffer */
1582 ULONG length = data_buffer->cbBuffer;
1583 void* data = malloc(length);
1584
1585 if (!data)
1586 return SEC_E_INSUFFICIENT_MEMORY;
1587
1588 CopyMemory(data, data_buffer->pvBuffer, length);
1589 /* Compute the HMAC-MD5 hash of ConcatenationOf(seq_num,data) using the client signing key */
1590 WINPR_HMAC_CTX* hmac = winpr_HMAC_New();
1591
1592 BOOL success = FALSE;
1593 {
1594 if (!hmac)
1595 goto hmac_fail;
1596 if (!winpr_HMAC_Init(hmac, WINPR_MD_MD5, context->SendSigningKey, WINPR_MD5_DIGEST_LENGTH))
1597 goto hmac_fail;
1598
1599 winpr_Data_Write_UINT32(&value, SeqNo);
1600
1601 if (!winpr_HMAC_Update(hmac, (void*)&value, 4))
1602 goto hmac_fail;
1603 if (!winpr_HMAC_Update(hmac, data, length))
1604 goto hmac_fail;
1605 if (!winpr_HMAC_Final(hmac, digest, WINPR_MD5_DIGEST_LENGTH))
1606 goto hmac_fail;
1607 }
1608
1609 success = TRUE;
1610
1611hmac_fail:
1612 winpr_HMAC_Free(hmac);
1613 if (!success)
1614 {
1615 free(data);
1616 return SEC_E_INSUFFICIENT_MEMORY;
1617 }
1618
1619 /* Encrypt message using with RC4, result overwrites original buffer */
1620 if ((data_buffer->BufferType & SECBUFFER_READONLY) == 0)
1621 {
1622 if (context->confidentiality)
1623 {
1624 if (!winpr_RC4_Update(context->SendRc4Seal, length, (BYTE*)data,
1625 (BYTE*)data_buffer->pvBuffer))
1626 {
1627 free(data);
1628 return SEC_E_INSUFFICIENT_MEMORY;
1629 }
1630 }
1631 else
1632 CopyMemory(data_buffer->pvBuffer, data, length);
1633 }
1634
1635#ifdef WITH_DEBUG_NTLM
1636 WLog_DBG(TAG, "Data Buffer (length = %" PRIu32 ")", length);
1637 winpr_HexDump(TAG, WLOG_DEBUG, data, length);
1638 WLog_DBG(TAG, "Encrypted Data Buffer (length = %" PRIu32 ")", data_buffer->cbBuffer);
1639 winpr_HexDump(TAG, WLOG_DEBUG, data_buffer->pvBuffer, data_buffer->cbBuffer);
1640#endif
1641 free(data);
1642 /* RC4-encrypt first 8 bytes of digest */
1643 if (!winpr_RC4_Update(context->SendRc4Seal, 8, digest, checksum))
1644 return SEC_E_INSUFFICIENT_MEMORY;
1645 if ((signature_buffer->BufferType & SECBUFFER_READONLY) == 0)
1646 {
1647 BYTE* signature = signature_buffer->pvBuffer;
1648 /* Concatenate version, ciphertext and sequence number to build signature */
1649 winpr_Data_Write_UINT32(signature, version);
1650 CopyMemory(&signature[4], (void*)checksum, 8);
1651 winpr_Data_Write_UINT32(&signature[12], SeqNo);
1652 }
1653 context->SendSeqNum++;
1654#ifdef WITH_DEBUG_NTLM
1655 WLog_DBG(TAG, "Signature (length = %" PRIu32 ")", signature_buffer->cbBuffer);
1656 winpr_HexDump(TAG, WLOG_DEBUG, signature_buffer->pvBuffer, signature_buffer->cbBuffer);
1657#endif
1658 return SEC_E_OK;
1659}
1660
1661static SECURITY_STATUS SEC_ENTRY ntlm_DecryptMessage(PCtxtHandle phContext, PSecBufferDesc pMessage,
1662 ULONG MessageSeqNo,
1663 WINPR_ATTR_UNUSED PULONG pfQOP)
1664{
1665 const UINT32 SeqNo = (UINT32)MessageSeqNo;
1666 UINT32 value = 0;
1667 BYTE digest[WINPR_MD5_DIGEST_LENGTH] = WINPR_C_ARRAY_INIT;
1668 BYTE checksum[8] = WINPR_C_ARRAY_INIT;
1669 UINT32 version = 1;
1670 BYTE expected_signature[WINPR_MD5_DIGEST_LENGTH] = WINPR_C_ARRAY_INIT;
1671 PSecBuffer data_buffer = nullptr;
1672 PSecBuffer signature_buffer = nullptr;
1673 NTLM_CONTEXT* context = (NTLM_CONTEXT*)sspi_SecureHandleGetLowerPointer(phContext);
1674 if (!check_context(context))
1675 return SEC_E_INVALID_HANDLE;
1676
1677 for (ULONG index = 0; index < pMessage->cBuffers; index++)
1678 {
1679 if (pMessage->pBuffers[index].BufferType == SECBUFFER_DATA)
1680 data_buffer = &pMessage->pBuffers[index];
1681 else if (pMessage->pBuffers[index].BufferType == SECBUFFER_TOKEN)
1682 signature_buffer = &pMessage->pBuffers[index];
1683 }
1684
1685 if (!data_buffer)
1686 return SEC_E_INVALID_TOKEN;
1687
1688 if (!signature_buffer)
1689 return SEC_E_INVALID_TOKEN;
1690
1691 if (signature_buffer->cbBuffer < 16)
1692 return SEC_E_INVALID_TOKEN;
1693
1694 /* Copy original data buffer */
1695 const ULONG length = data_buffer->cbBuffer;
1696 void* data = malloc(length);
1697
1698 if (!data)
1699 return SEC_E_INSUFFICIENT_MEMORY;
1700
1701 CopyMemory(data, data_buffer->pvBuffer, length);
1702
1703 /* Decrypt message using with RC4, result overwrites original buffer */
1704
1705 if (context->confidentiality)
1706 {
1707 if (!winpr_RC4_Update(context->RecvRc4Seal, length, (BYTE*)data,
1708 (BYTE*)data_buffer->pvBuffer))
1709 {
1710 free(data);
1711 return SEC_E_INSUFFICIENT_MEMORY;
1712 }
1713 }
1714 else
1715 CopyMemory(data_buffer->pvBuffer, data, length);
1716
1717 /* Compute the HMAC-MD5 hash of ConcatenationOf(seq_num,data) using the client signing key */
1718 WINPR_HMAC_CTX* hmac = winpr_HMAC_New();
1719
1720 BOOL success = FALSE;
1721 {
1722 if (!hmac)
1723 goto hmac_fail;
1724
1725 if (!winpr_HMAC_Init(hmac, WINPR_MD_MD5, context->RecvSigningKey, WINPR_MD5_DIGEST_LENGTH))
1726 goto hmac_fail;
1727
1728 winpr_Data_Write_UINT32(&value, SeqNo);
1729
1730 if (!winpr_HMAC_Update(hmac, (void*)&value, 4))
1731 goto hmac_fail;
1732 if (!winpr_HMAC_Update(hmac, data_buffer->pvBuffer, data_buffer->cbBuffer))
1733 goto hmac_fail;
1734 if (!winpr_HMAC_Final(hmac, digest, WINPR_MD5_DIGEST_LENGTH))
1735 goto hmac_fail;
1736
1737 success = TRUE;
1738 }
1739hmac_fail:
1740 winpr_HMAC_Free(hmac);
1741 if (!success)
1742 {
1743 free(data);
1744 return SEC_E_INSUFFICIENT_MEMORY;
1745 }
1746
1747#ifdef WITH_DEBUG_NTLM
1748 WLog_DBG(TAG, "Encrypted Data Buffer (length = %" PRIu32 ")", length);
1749 winpr_HexDump(TAG, WLOG_DEBUG, data, length);
1750 WLog_DBG(TAG, "Data Buffer (length = %" PRIu32 ")", data_buffer->cbBuffer);
1751 winpr_HexDump(TAG, WLOG_DEBUG, data_buffer->pvBuffer, data_buffer->cbBuffer);
1752#endif
1753 free(data);
1754 /* RC4-encrypt first 8 bytes of digest */
1755 if (!winpr_RC4_Update(context->RecvRc4Seal, 8, digest, checksum))
1756 return SEC_E_MESSAGE_ALTERED;
1757
1758 /* Concatenate version, ciphertext and sequence number to build signature */
1759 winpr_Data_Write_UINT32(expected_signature, version);
1760 CopyMemory(&expected_signature[4], (void*)checksum, 8);
1761 winpr_Data_Write_UINT32(&expected_signature[12], SeqNo);
1762 context->RecvSeqNum++;
1763
1764 if (memcmp(signature_buffer->pvBuffer, expected_signature, 16) != 0)
1765 {
1766 /* signature verification failed! */
1767 WLog_ERR(TAG, "signature verification failed, something nasty is going on!");
1768#ifdef WITH_DEBUG_NTLM
1769 WLog_ERR(TAG, "Expected Signature:");
1770 winpr_HexDump(TAG, WLOG_ERROR, expected_signature, 16);
1771 WLog_ERR(TAG, "Actual Signature:");
1772 winpr_HexDump(TAG, WLOG_ERROR, (BYTE*)signature_buffer->pvBuffer, 16);
1773#endif
1774 return SEC_E_MESSAGE_ALTERED;
1775 }
1776
1777 return SEC_E_OK;
1778}
1779
1780static SECURITY_STATUS SEC_ENTRY ntlm_MakeSignature(PCtxtHandle phContext,
1781 WINPR_ATTR_UNUSED ULONG fQOP,
1782 PSecBufferDesc pMessage, ULONG MessageSeqNo)
1783{
1784 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1785 PSecBuffer data_buffer = nullptr;
1786 PSecBuffer sig_buffer = nullptr;
1787 UINT32 seq_no = 0;
1788 BYTE digest[WINPR_MD5_DIGEST_LENGTH] = WINPR_C_ARRAY_INIT;
1789 BYTE checksum[8] = WINPR_C_ARRAY_INIT;
1790
1791 NTLM_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1792 if (!check_context(context))
1793 return SEC_E_INVALID_HANDLE;
1794
1795 for (ULONG i = 0; i < pMessage->cBuffers; i++)
1796 {
1797 if (pMessage->pBuffers[i].BufferType == SECBUFFER_DATA)
1798 data_buffer = &pMessage->pBuffers[i];
1799 else if (pMessage->pBuffers[i].BufferType == SECBUFFER_TOKEN)
1800 sig_buffer = &pMessage->pBuffers[i];
1801 }
1802
1803 if (!data_buffer || !sig_buffer)
1804 return SEC_E_INVALID_TOKEN;
1805
1806 if (sig_buffer->cbBuffer < 16)
1807 return SEC_E_INSUFFICIENT_MEMORY;
1808
1809 WINPR_HMAC_CTX* hmac = winpr_HMAC_New();
1810
1811 if (!winpr_HMAC_Init(hmac, WINPR_MD_MD5, context->SendSigningKey, WINPR_MD5_DIGEST_LENGTH))
1812 goto fail;
1813
1814 winpr_Data_Write_UINT32(&seq_no, MessageSeqNo);
1815 if (!winpr_HMAC_Update(hmac, (BYTE*)&seq_no, 4))
1816 goto fail;
1817 if (!winpr_HMAC_Update(hmac, data_buffer->pvBuffer, data_buffer->cbBuffer))
1818 goto fail;
1819 if (!winpr_HMAC_Final(hmac, digest, WINPR_MD5_DIGEST_LENGTH))
1820 goto fail;
1821
1822 if (!winpr_RC4_Update(context->SendRc4Seal, 8, digest, checksum))
1823 goto fail;
1824
1825 BYTE* signature = sig_buffer->pvBuffer;
1826 winpr_Data_Write_UINT32(signature, 1L);
1827 CopyMemory(&signature[4], checksum, 8);
1828 winpr_Data_Write_UINT32(&signature[12], seq_no);
1829 sig_buffer->cbBuffer = 16;
1830
1831 status = SEC_E_OK;
1832
1833fail:
1834 winpr_HMAC_Free(hmac);
1835 return status;
1836}
1837
1838WINPR_ATTR_NODISCARD
1839static SECURITY_STATUS SEC_ENTRY ntlm_VerifySignature(PCtxtHandle phContext,
1840 PSecBufferDesc pMessage, ULONG MessageSeqNo,
1841 WINPR_ATTR_UNUSED PULONG pfQOP)
1842{
1843 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1844 PSecBuffer data_buffer = nullptr;
1845 PSecBuffer sig_buffer = nullptr;
1846 UINT32 seq_no = 0;
1847 BYTE digest[WINPR_MD5_DIGEST_LENGTH] = WINPR_C_ARRAY_INIT;
1848 BYTE checksum[8] = WINPR_C_ARRAY_INIT;
1849 BYTE signature[16] = WINPR_C_ARRAY_INIT;
1850
1851 NTLM_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1852 if (!check_context(context))
1853 return SEC_E_INVALID_HANDLE;
1854
1855 for (ULONG i = 0; i < pMessage->cBuffers; i++)
1856 {
1857 if (pMessage->pBuffers[i].BufferType == SECBUFFER_DATA)
1858 data_buffer = &pMessage->pBuffers[i];
1859 else if (pMessage->pBuffers[i].BufferType == SECBUFFER_TOKEN)
1860 sig_buffer = &pMessage->pBuffers[i];
1861 }
1862
1863 if (!data_buffer || !sig_buffer || (sig_buffer->cbBuffer < 16))
1864 return SEC_E_INVALID_TOKEN;
1865
1866 WINPR_HMAC_CTX* hmac = winpr_HMAC_New();
1867
1868 if (!winpr_HMAC_Init(hmac, WINPR_MD_MD5, context->RecvSigningKey, WINPR_MD5_DIGEST_LENGTH))
1869 goto fail;
1870
1871 winpr_Data_Write_UINT32(&seq_no, MessageSeqNo);
1872 if (!winpr_HMAC_Update(hmac, (BYTE*)&seq_no, 4))
1873 goto fail;
1874 if (!winpr_HMAC_Update(hmac, data_buffer->pvBuffer, data_buffer->cbBuffer))
1875 goto fail;
1876 if (!winpr_HMAC_Final(hmac, digest, WINPR_MD5_DIGEST_LENGTH))
1877 goto fail;
1878
1879 if (!winpr_RC4_Update(context->RecvRc4Seal, 8, digest, checksum))
1880 goto fail;
1881
1882 winpr_Data_Write_UINT32(signature, 1L);
1883 CopyMemory(&signature[4], checksum, 8);
1884 winpr_Data_Write_UINT32(&signature[12], seq_no);
1885
1886 status = SEC_E_OK;
1887 if (memcmp(sig_buffer->pvBuffer, signature, 16) != 0)
1888 status = SEC_E_MESSAGE_ALTERED;
1889
1890fail:
1891 winpr_HMAC_Free(hmac);
1892 return status;
1893}
1894
1895const SecurityFunctionTableA NTLM_SecurityFunctionTableA = {
1896 3, /* dwVersion */
1897 nullptr, /* EnumerateSecurityPackages */
1898 ntlm_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
1899 ntlm_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
1900 ntlm_FreeCredentialsHandle, /* FreeCredentialsHandle */
1901 nullptr, /* Reserved2 */
1902 ntlm_InitializeSecurityContextA, /* InitializeSecurityContext */
1903 ntlm_AcceptSecurityContext, /* AcceptSecurityContext */
1904 nullptr, /* CompleteAuthToken */
1905 ntlm_DeleteSecurityContext, /* DeleteSecurityContext */
1906 nullptr, /* ApplyControlToken */
1907 ntlm_QueryContextAttributesA, /* QueryContextAttributes */
1908 ntlm_ImpersonateSecurityContext, /* ImpersonateSecurityContext */
1909 ntlm_RevertSecurityContext, /* RevertSecurityContext */
1910 ntlm_MakeSignature, /* MakeSignature */
1911 ntlm_VerifySignature, /* VerifySignature */
1912 nullptr, /* FreeContextBuffer */
1913 nullptr, /* QuerySecurityPackageInfo */
1914 nullptr, /* Reserved3 */
1915 nullptr, /* Reserved4 */
1916 nullptr, /* ExportSecurityContext */
1917 nullptr, /* ImportSecurityContext */
1918 nullptr, /* AddCredentials */
1919 nullptr, /* Reserved8 */
1920 nullptr, /* QuerySecurityContextToken */
1921 ntlm_EncryptMessage, /* EncryptMessage */
1922 ntlm_DecryptMessage, /* DecryptMessage */
1923 ntlm_SetContextAttributesA, /* SetContextAttributes */
1924 ntlm_SetCredentialsAttributesA, /* SetCredentialsAttributes */
1925};
1926
1927const SecurityFunctionTableW NTLM_SecurityFunctionTableW = {
1928 3, /* dwVersion */
1929 nullptr, /* EnumerateSecurityPackages */
1930 ntlm_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
1931 ntlm_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
1932 ntlm_FreeCredentialsHandle, /* FreeCredentialsHandle */
1933 nullptr, /* Reserved2 */
1934 ntlm_InitializeSecurityContextW, /* InitializeSecurityContext */
1935 ntlm_AcceptSecurityContext, /* AcceptSecurityContext */
1936 nullptr, /* CompleteAuthToken */
1937 ntlm_DeleteSecurityContext, /* DeleteSecurityContext */
1938 nullptr, /* ApplyControlToken */
1939 ntlm_QueryContextAttributesW, /* QueryContextAttributes */
1940 ntlm_ImpersonateSecurityContext, /* ImpersonateSecurityContext */
1941 ntlm_RevertSecurityContext, /* RevertSecurityContext */
1942 ntlm_MakeSignature, /* MakeSignature */
1943 ntlm_VerifySignature, /* VerifySignature */
1944 nullptr, /* FreeContextBuffer */
1945 nullptr, /* QuerySecurityPackageInfo */
1946 nullptr, /* Reserved3 */
1947 nullptr, /* Reserved4 */
1948 nullptr, /* ExportSecurityContext */
1949 nullptr, /* ImportSecurityContext */
1950 nullptr, /* AddCredentials */
1951 nullptr, /* Reserved8 */
1952 nullptr, /* QuerySecurityContextToken */
1953 ntlm_EncryptMessage, /* EncryptMessage */
1954 ntlm_DecryptMessage, /* DecryptMessage */
1955 ntlm_SetContextAttributesW, /* SetContextAttributes */
1956 ntlm_SetCredentialsAttributesW, /* SetCredentialsAttributes */
1957};
1958
1959const SecPkgInfoA NTLM_SecPkgInfoA = {
1960 0x00082B37, /* fCapabilities */
1961 1, /* wVersion */
1962 0x000A, /* wRPCID */
1963 0x00000B48, /* cbMaxToken */
1964 "NTLM", /* Name */
1965 "NTLM Security Package" /* Comment */
1966};
1967
1968static WCHAR NTLM_SecPkgInfoW_NameBuffer[32] = WINPR_C_ARRAY_INIT;
1969static WCHAR NTLM_SecPkgInfoW_CommentBuffer[32] = WINPR_C_ARRAY_INIT;
1970
1971const SecPkgInfoW NTLM_SecPkgInfoW = {
1972 0x00082B37, /* fCapabilities */
1973 1, /* wVersion */
1974 0x000A, /* wRPCID */
1975 0x00000B48, /* cbMaxToken */
1976 NTLM_SecPkgInfoW_NameBuffer, /* Name */
1977 NTLM_SecPkgInfoW_CommentBuffer /* Comment */
1978};
1979
1980char* ntlm_negotiate_flags_string(char* buffer, size_t size, UINT32 flags)
1981{
1982 if (!buffer || (size == 0))
1983 return buffer;
1984
1985 (void)_snprintf(buffer, size, "[0x%08" PRIx32 "] ", flags);
1986
1987 for (int x = 0; x < 31; x++)
1988 {
1989 const UINT32 mask = 1u << x;
1990 size_t len = strnlen(buffer, size);
1991 if (flags & mask)
1992 {
1993 const char* str = ntlm_get_negotiate_string(mask);
1994 const size_t flen = strlen(str);
1995
1996 if ((len > 0) && (buffer[len - 1] != ' '))
1997 {
1998 if (size - len < 1)
1999 break;
2000 winpr_str_append("|", buffer, size, nullptr);
2001 len++;
2002 }
2003
2004 if (size - len < flen)
2005 break;
2006 winpr_str_append(str, buffer, size, nullptr);
2007 }
2008 }
2009
2010 return buffer;
2011}
2012
2013const char* ntlm_message_type_string(UINT32 messageType)
2014{
2015 switch (messageType)
2016 {
2017 case MESSAGE_TYPE_NEGOTIATE:
2018 return "MESSAGE_TYPE_NEGOTIATE";
2019 case MESSAGE_TYPE_CHALLENGE:
2020 return "MESSAGE_TYPE_CHALLENGE";
2021 case MESSAGE_TYPE_AUTHENTICATE:
2022 return "MESSAGE_TYPE_AUTHENTICATE";
2023 default:
2024 return "MESSAGE_TYPE_UNKNOWN";
2025 }
2026}
2027
2028const char* ntlm_state_string(NTLM_STATE state)
2029{
2030 switch (state)
2031 {
2032 case NTLM_STATE_INITIAL:
2033 return "NTLM_STATE_INITIAL";
2034 case NTLM_STATE_NEGOTIATE:
2035 return "NTLM_STATE_NEGOTIATE";
2036 case NTLM_STATE_CHALLENGE:
2037 return "NTLM_STATE_CHALLENGE";
2038 case NTLM_STATE_AUTHENTICATE:
2039 return "NTLM_STATE_AUTHENTICATE";
2040 case NTLM_STATE_FINAL:
2041 return "NTLM_STATE_FINAL";
2042 default:
2043 return "NTLM_STATE_UNKNOWN";
2044 }
2045}
2046void ntlm_change_state(NTLM_CONTEXT* ntlm, NTLM_STATE state)
2047{
2048 WINPR_ASSERT(ntlm);
2049 WLog_DBG(TAG, "change state from %s to %s", ntlm_state_string(ntlm->state),
2050 ntlm_state_string(state));
2051 ntlm->state = state;
2052}
2053
2054NTLM_STATE ntlm_get_state(NTLM_CONTEXT* ntlm)
2055{
2056 WINPR_ASSERT(ntlm);
2057 return ntlm->state;
2058}
2059
2060BOOL ntlm_reset_cipher_state(PSecHandle phContext)
2061{
2062 NTLM_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
2063
2064 if (context)
2065 {
2066 if (!check_context(context))
2067 return FALSE;
2068
2069 winpr_RC4_Free(context->SendRc4Seal);
2070 winpr_RC4_Free(context->RecvRc4Seal);
2071 context->SendRc4Seal = winpr_RC4_New(context->RecvSealingKey, 16);
2072 context->RecvRc4Seal = winpr_RC4_New(context->SendSealingKey, 16);
2073
2074 if (!context->SendRc4Seal)
2075 {
2076 WLog_ERR(TAG, "Failed to allocate context->SendRc4Seal");
2077 return FALSE;
2078 }
2079 if (!context->RecvRc4Seal)
2080 {
2081 WLog_ERR(TAG, "Failed to allocate context->RecvRc4Seal");
2082 return FALSE;
2083 }
2084 }
2085
2086 return TRUE;
2087}
2088
2089BOOL NTLM_init(void)
2090{
2091 InitializeConstWCharFromUtf8(NTLM_SecPkgInfoA.Name, NTLM_SecPkgInfoW_NameBuffer,
2092 ARRAYSIZE(NTLM_SecPkgInfoW_NameBuffer));
2093 InitializeConstWCharFromUtf8(NTLM_SecPkgInfoA.Comment, NTLM_SecPkgInfoW_CommentBuffer,
2094 ARRAYSIZE(NTLM_SecPkgInfoW_CommentBuffer));
2095
2096 return TRUE;
2097}
2098
2099BOOL ntlm_SecBufferRealloc(SecBuffer* buffer, ULONG len)
2100{
2101 sspi_SecBufferFree(buffer);
2102 return sspi_SecBufferAlloc(buffer, len) != nullptr;
2103}
LSA_UNICODE_STRING
Definition nt.h:1416
NTLM_AUTHENTICATE_MESSAGE
Definition libwinpr/sspi/NTLM/ntlm.h:207
NTLM_CONTEXT
Definition libwinpr/sspi/NTLM/ntlm.h:221
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349
SSPI_CREDENTIALS
Definition libwinpr/sspi/sspi.h:35
SecPkgContext_AuthIdentity
Definition include/winpr/sspi.h:1505
SecPkgContext_AuthNtlmClientChallenge
Definition include/winpr/sspi.h:1528
SecPkgContext_AuthNtlmHash
Definition include/winpr/sspi.h:1516
SecPkgContext_AuthNtlmMessage
Definition include/winpr/sspi.h:1538
SecPkgContext_AuthNtlmServerChallenge
Definition include/winpr/sspi.h:1533
SecPkgContext_AuthNtlmTimestamp
Definition include/winpr/sspi.h:1522
SecPkgContext_PackageInfoA
Definition include/winpr/sspi.h:416
SecPkgContext_PackageInfoW
Definition include/winpr/sspi.h:421
SecPkgContext_Sizes
Definition include/winpr/sspi.h:450
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:816