FreeRDP
Loading...
Searching...
No Matches
kerberos.c
1
22#include <winpr/config.h>
23
24#include <stdio.h>
25#include <stdlib.h>
26#include <string.h>
27#include <errno.h>
28#include <fcntl.h>
29#include <ctype.h>
30
31#include <winpr/assert.h>
32#include <winpr/cast.h>
33#include <winpr/asn1.h>
34#include <winpr/crt.h>
35#include <winpr/interlocked.h>
36#include <winpr/sspi.h>
37#include <winpr/print.h>
38#include <winpr/tchar.h>
39#include <winpr/sysinfo.h>
40#include <winpr/registry.h>
41#include <winpr/endian.h>
42#include <winpr/crypto.h>
43#include <winpr/path.h>
44#include <winpr/wtypes.h>
45#include <winpr/winsock.h>
46#include <winpr/schannel.h>
47#include <winpr/secapi.h>
48
49#include "kerberos.h"
50
51#ifdef WITH_KRB5_MIT
52#include "krb5glue.h"
53#include <profile.h>
54#endif
55
56#ifdef WITH_KRB5_HEIMDAL
57#include "krb5glue.h"
58#include <krb5-protos.h>
59#endif
60
61#include "../sspi.h"
62#include "../../log.h"
63#define TAG WINPR_TAG("sspi.Kerberos")
64
65#define KRB_TGT_REQ 16
66#define KRB_TGT_REP 17
67
68const SecPkgInfoA KERBEROS_SecPkgInfoA = {
69 0x000F3BBF, /* fCapabilities */
70 1, /* wVersion */
71 0x0010, /* wRPCID */
72 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
73 "Kerberos", /* Name */
74 "Kerberos Security Package" /* Comment */
75};
76
77static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = { 0 };
78static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = { 0 };
79
80const SecPkgInfoW KERBEROS_SecPkgInfoW = {
81 0x000F3BBF, /* fCapabilities */
82 1, /* wVersion */
83 0x0010, /* wRPCID */
84 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
85 KERBEROS_SecPkgInfoW_NameBuffer, /* Name */
86 KERBEROS_SecPkgInfoW_CommentBuffer /* Comment */
87};
88
89#ifdef WITH_KRB5
90
91enum KERBEROS_STATE
92{
93 KERBEROS_STATE_INITIAL,
94 KERBEROS_STATE_TGT_REQ,
95 KERBEROS_STATE_TGT_REP,
96 KERBEROS_STATE_AP_REQ,
97 KERBEROS_STATE_AP_REP,
98 KERBEROS_STATE_FINAL
99};
100
101typedef struct KRB_CREDENTIALS_st
102{
103 volatile LONG refCount;
104 krb5_context ctx;
105 char* kdc_url;
106 krb5_ccache ccache;
107 krb5_keytab keytab;
108 krb5_keytab client_keytab;
109 BOOL own_ccache;
110} KRB_CREDENTIALS;
111
112struct s_KRB_CONTEXT
113{
114 enum KERBEROS_STATE state;
115 KRB_CREDENTIALS* credentials;
116 krb5_auth_context auth_ctx;
117 BOOL acceptor;
118 uint32_t flags;
119 uint64_t local_seq;
120 uint64_t remote_seq;
121 struct krb5glue_keyset keyset;
122 BOOL u2u;
123 char* targetHost;
124};
125
126static const WinPrAsn1_OID kerberos_OID = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
127static const WinPrAsn1_OID kerberos_u2u_OID = { 10,
128 (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
129
130#define krb_log_exec(fkt, ctx, ...) \
131 kerberos_log_msg(ctx, fkt(ctx, ##__VA_ARGS__), #fkt, __FILE__, __func__, __LINE__)
132#define krb_log_exec_ptr(fkt, ctx, ...) \
133 kerberos_log_msg(*ctx, fkt(ctx, ##__VA_ARGS__), #fkt, __FILE__, __func__, __LINE__)
134static krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code, const char* what,
135 const char* file, const char* fkt, size_t line)
136{
137 switch (code)
138 {
139 case 0:
140 case KRB5_KT_END:
141 break;
142 default:
143 {
144 const DWORD level = WLOG_ERROR;
145
146 wLog* log = WLog_Get(TAG);
147 if (WLog_IsLevelActive(log, level))
148 {
149 const char* msg = krb5_get_error_message(ctx, code);
150 WLog_PrintTextMessage(log, level, line, file, fkt, "%s (%s [%d])", what, msg, code);
151 krb5_free_error_message(ctx, msg);
152 }
153 }
154 break;
155 }
156 return code;
157}
158
159static void credentials_unref(KRB_CREDENTIALS* credentials);
160
161static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
162{
163 if (!ctx)
164 return;
165
166 free(ctx->targetHost);
167 ctx->targetHost = NULL;
168
169 if (ctx->credentials)
170 {
171 krb5_context krbctx = ctx->credentials->ctx;
172 if (krbctx)
173 {
174 if (ctx->auth_ctx)
175 krb5_auth_con_free(krbctx, ctx->auth_ctx);
176
177 krb5glue_keys_free(krbctx, &ctx->keyset);
178 }
179
180 credentials_unref(ctx->credentials);
181 }
182
183 if (allocated)
184 free(ctx);
185}
186
187static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
188{
189 KRB_CONTEXT* context = NULL;
190
191 context = (KRB_CONTEXT*)calloc(1, sizeof(KRB_CONTEXT));
192 if (!context)
193 return NULL;
194
195 context->credentials = credentials;
196 InterlockedIncrement(&credentials->refCount);
197 return context;
198}
199
200static krb5_error_code krb5_prompter(krb5_context context, void* data,
201 WINPR_ATTR_UNUSED const char* name,
202 WINPR_ATTR_UNUSED const char* banner, int num_prompts,
203 krb5_prompt prompts[])
204{
205 for (int i = 0; i < num_prompts; i++)
206 {
207 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
208 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
209 {
210 prompts[i].reply->data = _strdup((const char*)data);
211
212 const size_t len = strlen((const char*)data);
213 if (len > UINT32_MAX)
214 return KRB5KRB_ERR_GENERIC;
215 prompts[i].reply->length = (UINT32)len;
216 }
217 }
218 return 0;
219}
220
221static INLINE krb5glue_key get_key(struct krb5glue_keyset* keyset)
222{
223 return keyset->acceptor_key ? keyset->acceptor_key
224 : keyset->initiator_key ? keyset->initiator_key
225 : keyset->session_key;
226}
227
228static BOOL isValidIPv4(const char* ipAddress)
229{
230 struct sockaddr_in sa = { 0 };
231 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
232 return result != 0;
233}
234
235static BOOL isValidIPv6(const char* ipAddress)
236{
237 struct sockaddr_in6 sa = { 0 };
238 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
239 return result != 0;
240}
241
242static BOOL isValidIP(const char* ipAddress)
243{
244 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
245}
246
247#if defined(WITH_KRB5_MIT)
248WINPR_ATTR_MALLOC(free, 1)
249static char* get_realm_name(krb5_data realm, size_t* plen)
250{
251 WINPR_ASSERT(plen);
252 *plen = 0;
253 if ((realm.length <= 0) || (!realm.data))
254 return NULL;
255
256 char* name = NULL;
257 (void)winpr_asprintf(&name, plen, "krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
258 realm.data);
259 return name;
260}
261#elif defined(WITH_KRB5_HEIMDAL)
262WINPR_ATTR_MALLOC(free, 1)
263static char* get_realm_name(Realm realm, size_t* plen)
264{
265 WINPR_ASSERT(plen);
266 *plen = 0;
267 if (!realm)
268 return NULL;
269
270 char* name = NULL;
271 (void)winpr_asprintf(&name, plen, "krbtgt/%s@%s", realm, realm);
272 return name;
273}
274#endif
275
276static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
277{
278 /* "krbtgt/" + realm + "@" + realm */
279 size_t len = 0;
280 krb5_error_code rv = KRB5_CC_NOMEM;
281
282 char* name = get_realm_name(principal->realm, &len);
283 if (!name || (len == 0))
284 goto fail;
285
286 krb5_principal target = { 0 };
287 rv = krb5_parse_name(ctx, name, &target);
288 *ptarget = target;
289fail:
290 free(name);
291 return rv;
292}
293
294#endif /* WITH_KRB5 */
295
296static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
297 SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage, ULONG fCredentialUse,
298 WINPR_ATTR_UNUSED void* pvLogonID, void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
299 WINPR_ATTR_UNUSED void* pvGetKeyArgument, PCredHandle phCredential,
300 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
301{
302#ifdef WITH_KRB5
303 SEC_WINPR_KERBEROS_SETTINGS* krb_settings = NULL;
304 KRB_CREDENTIALS* credentials = NULL;
305 krb5_context ctx = NULL;
306 krb5_ccache ccache = NULL;
307 krb5_keytab keytab = NULL;
308 krb5_principal principal = NULL;
309 char* domain = NULL;
310 char* username = NULL;
311 char* password = NULL;
312 BOOL own_ccache = FALSE;
313 const char* const default_ccache_type = "MEMORY";
314
315 if (pAuthData)
316 {
317 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
318
319 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
320 krb_settings = (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->kerberosSettings);
321
322 if (!sspi_CopyAuthIdentityFieldsA((const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData, &username,
323 &domain, &password))
324 {
325 WLog_ERR(TAG, "Failed to copy auth identity fields");
326 goto cleanup;
327 }
328
329 if (!pszPrincipal)
330 pszPrincipal = username;
331 }
332
333 if (krb_log_exec_ptr(krb5_init_context, &ctx))
334 goto cleanup;
335
336 if (domain)
337 {
338 char* udomain = _strdup(domain);
339 if (!udomain)
340 goto cleanup;
341
342 CharUpperA(udomain);
343 /* Will use domain if realm is not specified in username */
344 krb5_error_code rv = krb_log_exec(krb5_set_default_realm, ctx, udomain);
345 free(udomain);
346
347 if (rv)
348 goto cleanup;
349 }
350
351 if (pszPrincipal)
352 {
353 char* cpszPrincipal = _strdup(pszPrincipal);
354 if (!cpszPrincipal)
355 goto cleanup;
356
357 /* Find realm component if included and convert to uppercase */
358 char* p = strchr(cpszPrincipal, '@');
359 if (p)
360 CharUpperA(p);
361
362 krb5_error_code rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, &principal);
363 free(cpszPrincipal);
364
365 if (rv)
366 goto cleanup;
367 WINPR_ASSERT(principal);
368 }
369
370 if (krb_settings && krb_settings->cache)
371 {
372 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
373 goto cleanup;
374 }
375 else
376 own_ccache = TRUE;
377
378 if (principal)
379 {
380 /* Use the default cache if it's initialized with the right principal */
381 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
382 {
383 if (own_ccache)
384 {
385 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, 0, &ccache))
386 goto cleanup;
387 }
388 else
389 {
390 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
391 goto cleanup;
392 }
393
394 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
395 goto cleanup;
396 }
397 else
398 own_ccache = FALSE;
399 }
400 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
401 {
402 /* Use the default cache with it's default principal */
403 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
404 goto cleanup;
405 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
406 goto cleanup;
407 own_ccache = FALSE;
408 }
409 else
410 {
411 if (own_ccache)
412 {
413 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, 0, &ccache))
414 goto cleanup;
415 }
416 else
417 {
418 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
419 goto cleanup;
420 }
421 }
422
423 if (krb_settings && krb_settings->keytab)
424 {
425 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
426 goto cleanup;
427 }
428 else
429 {
430 if (fCredentialUse & SECPKG_CRED_INBOUND)
431 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
432 goto cleanup;
433 }
434
435 /* Get initial credentials if required */
436 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
437 {
438 krb5_creds creds = { 0 };
439 krb5_creds matchCreds = { 0 };
440 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
441
442 krb5_timeofday(ctx, &matchCreds.times.endtime);
443 matchCreds.times.endtime += 60;
444 matchCreds.client = principal;
445
446 WINPR_ASSERT(principal);
447 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
448 goto cleanup;
449
450 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
451 krb5_free_principal(ctx, matchCreds.server);
452 krb5_free_cred_contents(ctx, &creds);
453 if (rv)
454 {
455 if (krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
456 password, krb_settings))
457 goto cleanup;
458 }
459 }
460
461 credentials = calloc(1, sizeof(KRB_CREDENTIALS));
462 if (!credentials)
463 goto cleanup;
464 credentials->refCount = 1;
465 credentials->ctx = ctx;
466 credentials->ccache = ccache;
467 credentials->keytab = keytab;
468 credentials->own_ccache = own_ccache;
469
470cleanup:
471
472 free(domain);
473 free(username);
474 free(password);
475
476 if (principal)
477 krb5_free_principal(ctx, principal);
478 if (ctx)
479 {
480 if (!credentials)
481 {
482 if (ccache)
483 {
484 if (own_ccache)
485 krb5_cc_destroy(ctx, ccache);
486 else
487 krb5_cc_close(ctx, ccache);
488 }
489 if (keytab)
490 krb5_kt_close(ctx, keytab);
491
492 krb5_free_context(ctx);
493 }
494 }
495
496 /* If we managed to get credentials set the output */
497 if (credentials)
498 {
499 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
500 sspi_SecureHandleSetUpperPointer(phCredential, (void*)KERBEROS_SSP_NAME);
501 return SEC_E_OK;
502 }
503
504 return SEC_E_NO_CREDENTIALS;
505#else
506 return SEC_E_UNSUPPORTED_FUNCTION;
507#endif
508}
509
510static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
511 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
512 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
513 PTimeStamp ptsExpiry)
514{
515 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
516 char* principal = NULL;
517 char* package = NULL;
518
519 if (pszPrincipal)
520 {
521 principal = ConvertWCharToUtf8Alloc(pszPrincipal, NULL);
522 if (!principal)
523 goto fail;
524 }
525 if (pszPackage)
526 {
527 package = ConvertWCharToUtf8Alloc(pszPackage, NULL);
528 if (!package)
529 goto fail;
530 }
531
532 status =
533 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
534 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
535
536fail:
537 free(principal);
538 free(package);
539
540 return status;
541}
542
543#ifdef WITH_KRB5
544static void credentials_unref(KRB_CREDENTIALS* credentials)
545{
546 WINPR_ASSERT(credentials);
547
548 if (InterlockedDecrement(&credentials->refCount))
549 return;
550
551 free(credentials->kdc_url);
552
553 if (credentials->ccache)
554 {
555 if (credentials->own_ccache)
556 krb5_cc_destroy(credentials->ctx, credentials->ccache);
557 else
558 krb5_cc_close(credentials->ctx, credentials->ccache);
559 }
560 if (credentials->keytab)
561 krb5_kt_close(credentials->ctx, credentials->keytab);
562
563 krb5_free_context(credentials->ctx);
564 free(credentials);
565}
566#endif
567
568static SECURITY_STATUS SEC_ENTRY kerberos_FreeCredentialsHandle(PCredHandle phCredential)
569{
570#ifdef WITH_KRB5
571 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
572 if (!credentials)
573 return SEC_E_INVALID_HANDLE;
574
575 credentials_unref(credentials);
576
577 sspi_SecureHandleInvalidate(phCredential);
578 return SEC_E_OK;
579#else
580 return SEC_E_UNSUPPORTED_FUNCTION;
581#endif
582}
583
584static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
585 WINPR_ATTR_UNUSED PCredHandle phCredential, ULONG ulAttribute, WINPR_ATTR_UNUSED void* pBuffer)
586{
587#ifdef WITH_KRB5
588 switch (ulAttribute)
589 {
590 case SECPKG_CRED_ATTR_NAMES:
591 return SEC_E_OK;
592 default:
593 WLog_ERR(TAG, "TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
594 ulAttribute);
595 return SEC_E_UNSUPPORTED_FUNCTION;
596 }
597
598#else
599 return SEC_E_UNSUPPORTED_FUNCTION;
600#endif
601}
602
603static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(PCredHandle phCredential,
604 ULONG ulAttribute,
605 void* pBuffer)
606{
607 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
608}
609
610#ifdef WITH_KRB5
611
612static BOOL kerberos_mk_tgt_token(SecBuffer* buf, int msg_type, char* sname, char* host,
613 const krb5_data* ticket)
614{
615 WinPrAsn1Encoder* enc = NULL;
616 WinPrAsn1_MemoryChunk data;
617 wStream s;
618 size_t len = 0;
619 sspi_gss_data token;
620 BOOL ret = FALSE;
621
622 WINPR_ASSERT(buf);
623
624 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
625 return FALSE;
626 if (msg_type == KRB_TGT_REP && !ticket)
627 return FALSE;
628
629 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
630 if (!enc)
631 return FALSE;
632
633 /* KERB-TGT-REQUEST (SEQUENCE) */
634 if (!WinPrAsn1EncSeqContainer(enc))
635 goto cleanup;
636
637 /* pvno [0] INTEGER */
638 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
639 goto cleanup;
640
641 /* msg-type [1] INTEGER */
642 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
643 goto cleanup;
644
645 if (msg_type == KRB_TGT_REQ && sname)
646 {
647 /* server-name [2] PrincipalName (SEQUENCE) */
648 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
649 goto cleanup;
650
651 /* name-type [0] INTEGER */
652 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
653 goto cleanup;
654
655 /* name-string [1] SEQUENCE OF GeneralString */
656 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
657 goto cleanup;
658
659 if (!WinPrAsn1EncGeneralString(enc, sname))
660 goto cleanup;
661
662 if (host && !WinPrAsn1EncGeneralString(enc, host))
663 goto cleanup;
664
665 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
666 goto cleanup;
667 }
668 else if (msg_type == KRB_TGT_REP)
669 {
670 /* ticket [2] Ticket */
671 data.data = (BYTE*)ticket->data;
672 data.len = ticket->length;
673 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
674 goto cleanup;
675 }
676
677 if (!WinPrAsn1EncEndContainer(enc))
678 goto cleanup;
679
680 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
681 goto cleanup;
682
683 Stream_StaticInit(&s, buf->pvBuffer, len);
684 if (!WinPrAsn1EncToStream(enc, &s))
685 goto cleanup;
686
687 token.data = buf->pvBuffer;
688 token.length = (UINT)len;
689 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
690 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
691 ret = TRUE;
692
693cleanup:
694 WinPrAsn1Encoder_Free(&enc);
695 return ret;
696}
697
698static BOOL append(char* dst, size_t dstSize, const char* src)
699{
700 const size_t dlen = strnlen(dst, dstSize);
701 const size_t slen = strlen(src);
702 if (dlen + slen >= dstSize)
703 return FALSE;
704 if (!strncat(dst, src, dstSize - dlen))
705 return FALSE;
706 return TRUE;
707}
708
709static BOOL kerberos_rd_tgt_req_tag2(WinPrAsn1Decoder* dec, char* buf, size_t len)
710{
711 BOOL rc = FALSE;
712 WinPrAsn1Decoder seq = { 0 };
713
714 /* server-name [2] PrincipalName (SEQUENCE) */
715 if (!WinPrAsn1DecReadSequence(dec, &seq))
716 goto end;
717
718 /* name-type [0] INTEGER */
719 BOOL error = FALSE;
720 WinPrAsn1_INTEGER val = 0;
721 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
722 goto end;
723
724 /* name-string [1] SEQUENCE OF GeneralString */
725 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
726 goto end;
727
728 WinPrAsn1_tag tag = 0;
729 BOOL first = TRUE;
730 while (WinPrAsn1DecPeekTag(dec, &tag))
731 {
732 BOOL success = FALSE;
733 char* lstr = NULL;
734 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
735 goto fail;
736
737 if (!first)
738 {
739 if (!append(buf, len, "/"))
740 goto fail;
741 }
742 first = FALSE;
743
744 if (!append(buf, len, lstr))
745 goto fail;
746
747 success = TRUE;
748 fail:
749 free(lstr);
750 if (!success)
751 goto end;
752 }
753
754 rc = TRUE;
755end:
756 return rc;
757}
758
759static BOOL kerberos_rd_tgt_req_tag3(WinPrAsn1Decoder* dec, char* buf, size_t len)
760{
761 /* realm [3] Realm */
762 BOOL rc = FALSE;
763 WinPrAsn1_STRING str = NULL;
764 if (!WinPrAsn1DecReadGeneralString(dec, &str))
765 goto end;
766
767 if (!append(buf, len, "@"))
768 goto end;
769 if (!append(buf, len, str))
770 goto end;
771
772 rc = TRUE;
773end:
774 free(str);
775 return rc;
776}
777
778static BOOL kerberos_rd_tgt_req(WinPrAsn1Decoder* dec, char** target)
779{
780 BOOL rc = FALSE;
781
782 if (!target)
783 return FALSE;
784 *target = NULL;
785
786 wStream s = WinPrAsn1DecGetStream(dec);
787 const size_t len = Stream_Length(&s);
788 if (len == 0)
789 return TRUE;
790
791 WinPrAsn1Decoder dec2 = { 0 };
792 WinPrAsn1_tagId tag = 0;
793 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
794 return FALSE;
795
796 char* buf = calloc(len + 1, sizeof(char));
797 if (!buf)
798 return FALSE;
799
800 /* We expect ASN1 context tag values 2 or 3.
801 *
802 * In case we got value 2 an (optional) context tag value 3 might follow.
803 */
804 BOOL checkForTag3 = TRUE;
805 if (tag == 2)
806 {
807 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
808 if (rc)
809 {
810 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
811 if (res == 0)
812 checkForTag3 = FALSE;
813 }
814 }
815
816 if (checkForTag3)
817 {
818 if (tag == 3)
819 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
820 else
821 rc = FALSE;
822 }
823
824 if (rc)
825 *target = buf;
826 else
827 free(buf);
828 return rc;
829}
830
831static BOOL kerberos_rd_tgt_rep(WinPrAsn1Decoder* dec, krb5_data* ticket)
832{
833 if (!ticket)
834 return FALSE;
835
836 /* ticket [2] Ticket */
837 WinPrAsn1Decoder asnTicket = { 0 };
838 WinPrAsn1_tagId tag = 0;
839 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
840 return FALSE;
841
842 if (tag != 2)
843 return FALSE;
844
845 wStream s = WinPrAsn1DecGetStream(&asnTicket);
846 ticket->data = Stream_BufferAs(&s, char);
847
848 const size_t len = Stream_Length(&s);
849 if (len > UINT32_MAX)
850 return FALSE;
851 ticket->length = (UINT32)len;
852 return TRUE;
853}
854
855static BOOL kerberos_rd_tgt_token(const sspi_gss_data* token, char** target, krb5_data* ticket)
856{
857 BOOL error = 0;
858 WinPrAsn1_INTEGER val = 0;
859
860 WINPR_ASSERT(token);
861
862 if (target)
863 *target = NULL;
864
865 WinPrAsn1Decoder der = { 0 };
866 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
867
868 /* KERB-TGT-REQUEST (SEQUENCE) */
869 WinPrAsn1Decoder seq = { 0 };
870 if (!WinPrAsn1DecReadSequence(&der, &seq))
871 return FALSE;
872
873 /* pvno [0] INTEGER */
874 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
875 return FALSE;
876
877 /* msg-type [1] INTEGER */
878 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
879 return FALSE;
880
881 switch (val)
882 {
883 case KRB_TGT_REQ:
884 return kerberos_rd_tgt_req(&seq, target);
885 case KRB_TGT_REP:
886 return kerberos_rd_tgt_rep(&seq, ticket);
887 default:
888 break;
889 }
890 return FALSE;
891}
892
893#endif /* WITH_KRB5 */
894
895static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5, SEC_CHANNEL_BINDINGS* bindings)
896{
897 BYTE buf[4];
898
899 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
900 if (!winpr_Digest_Update(md5, buf, 4))
901 return FALSE;
902
903 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
904 if (!winpr_Digest_Update(md5, buf, 4))
905 return FALSE;
906
907 if (bindings->cbInitiatorLength &&
908 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
909 bindings->cbInitiatorLength))
910 return FALSE;
911
912 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
913 if (!winpr_Digest_Update(md5, buf, 4))
914 return FALSE;
915
916 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
917 if (!winpr_Digest_Update(md5, buf, 4))
918 return FALSE;
919
920 if (bindings->cbAcceptorLength &&
921 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
922 bindings->cbAcceptorLength))
923 return FALSE;
924
925 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
926 if (!winpr_Digest_Update(md5, buf, 4))
927 return FALSE;
928
929 if (bindings->cbApplicationDataLength &&
930 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
931 bindings->cbApplicationDataLength))
932 return FALSE;
933
934 return TRUE;
935}
936
937static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
938 PCredHandle phCredential, PCtxtHandle phContext, SEC_CHAR* pszTargetName, ULONG fContextReq,
939 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep, PSecBufferDesc pInput,
940 WINPR_ATTR_UNUSED ULONG Reserved2, PCtxtHandle phNewContext, PSecBufferDesc pOutput,
941 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
942{
943#ifdef WITH_KRB5
944 PSecBuffer input_buffer = NULL;
945 PSecBuffer output_buffer = NULL;
946 PSecBuffer bindings_buffer = NULL;
947 WINPR_DIGEST_CTX* md5 = NULL;
948 char* target = NULL;
949 char* sname = NULL;
950 char* host = NULL;
951 krb5_data input_token = { 0 };
952 krb5_data output_token = { 0 };
953 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
954 WinPrAsn1_OID oid = { 0 };
955 uint16_t tok_id = 0;
956 krb5_ap_rep_enc_part* reply = NULL;
957 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
958 char cksum_contents[24] = { 0 };
959 krb5_data cksum = { 0 };
960 krb5_creds in_creds = { 0 };
961 krb5_creds* creds = NULL;
962 BOOL isNewContext = FALSE;
963 KRB_CONTEXT* context = NULL;
964 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
965
966 /* behave like windows SSPIs that don't want empty context */
967 if (phContext && !phContext->dwLower && !phContext->dwUpper)
968 return SEC_E_INVALID_HANDLE;
969
970 context = sspi_SecureHandleGetLowerPointer(phContext);
971
972 if (!credentials)
973 return SEC_E_NO_CREDENTIALS;
974
975 if (pInput)
976 {
977 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
978 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
979 }
980 if (pOutput)
981 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
982
983 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
984 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
985
986 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
987 ap_flags |= AP_OPTS_USE_SESSION_KEY;
988
989 /* Split target name into service/hostname components */
990 if (pszTargetName)
991 {
992 target = _strdup(pszTargetName);
993 if (!target)
994 {
995 status = SEC_E_INSUFFICIENT_MEMORY;
996 goto cleanup;
997 }
998 host = strchr(target, '/');
999 if (host)
1000 {
1001 *host++ = 0;
1002 sname = target;
1003 }
1004 else
1005 host = target;
1006 if (isValidIP(host))
1007 {
1008 status = SEC_E_NO_CREDENTIALS;
1009 goto cleanup;
1010 }
1011 }
1012
1013 if (!context)
1014 {
1015 context = kerberos_ContextNew(credentials);
1016 if (!context)
1017 {
1018 status = SEC_E_INSUFFICIENT_MEMORY;
1019 goto cleanup;
1020 }
1021
1022 isNewContext = TRUE;
1023
1024 if (host)
1025 context->targetHost = _strdup(host);
1026 if (!context->targetHost)
1027 {
1028 status = SEC_E_INSUFFICIENT_MEMORY;
1029 goto cleanup;
1030 }
1031
1032 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1033 {
1034 context->state = KERBEROS_STATE_TGT_REQ;
1035 context->u2u = TRUE;
1036 }
1037 else
1038 context->state = KERBEROS_STATE_AP_REQ;
1039 }
1040 else
1041 {
1042 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1043 goto bad_token;
1044 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1045 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1046 goto bad_token;
1047 }
1048
1049 /* SSPI flags are compatible with GSS flags except INTEG_FLAG */
1050 context->flags |= (fContextReq & 0x1F);
1051 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1052 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1053
1054 switch (context->state)
1055 {
1056 case KERBEROS_STATE_TGT_REQ:
1057
1058 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, NULL))
1059 goto cleanup;
1060
1061 context->state = KERBEROS_STATE_TGT_REP;
1062 status = SEC_I_CONTINUE_NEEDED;
1063 break;
1064
1065 case KERBEROS_STATE_TGT_REP:
1066
1067 if (tok_id != TOK_ID_TGT_REP)
1068 goto bad_token;
1069
1070 if (!kerberos_rd_tgt_token(&input_token, NULL, &in_creds.second_ticket))
1071 goto bad_token;
1072
1073 /* Continue to AP-REQ */
1074 /* fallthrough */
1075 WINPR_FALLTHROUGH
1076
1077 case KERBEROS_STATE_AP_REQ:
1078
1079 /* Set auth_context options */
1080 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1081 goto cleanup;
1082 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1083 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1084 goto cleanup;
1085 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1086 GSS_CHECKSUM_TYPE))
1087 goto cleanup;
1088
1089 /* Get a service ticket */
1090 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1091 KRB5_NT_SRV_HST, &in_creds.server))
1092 goto cleanup;
1093
1094 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1095 &in_creds.client))
1096 {
1097 status = SEC_E_WRONG_PRINCIPAL;
1098 goto cleanup;
1099 }
1100
1101 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1102 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1103 &creds))
1104 {
1105 status = SEC_E_NO_CREDENTIALS;
1106 goto cleanup;
1107 }
1108
1109 /* Write the checksum (delegation not implemented) */
1110 cksum.data = cksum_contents;
1111 cksum.length = sizeof(cksum_contents);
1112 winpr_Data_Write_UINT32(cksum_contents, 16);
1113 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1114
1115 if (bindings_buffer)
1116 {
1117 SEC_CHANNEL_BINDINGS* bindings = bindings_buffer->pvBuffer;
1118
1119 /* Sanity checks */
1120 if (bindings_buffer->cbBuffer < sizeof(SEC_CHANNEL_BINDINGS) ||
1121 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1122 bindings_buffer->cbBuffer ||
1123 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1124 bindings_buffer->cbBuffer ||
1125 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1126 bindings_buffer->cbBuffer)
1127 {
1128 status = SEC_E_BAD_BINDINGS;
1129 goto cleanup;
1130 }
1131
1132 md5 = winpr_Digest_New();
1133 if (!md5)
1134 goto cleanup;
1135
1136 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1137 goto cleanup;
1138
1139 if (!kerberos_hash_channel_bindings(md5, bindings))
1140 goto cleanup;
1141
1142 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1143 goto cleanup;
1144 }
1145
1146 /* Make the AP_REQ message */
1147 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1148 &cksum, creds, &output_token))
1149 goto cleanup;
1150
1151 if (!sspi_gss_wrap_token(output_buffer,
1152 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1153 TOK_ID_AP_REQ, &output_token))
1154 goto cleanup;
1155
1156 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1157 {
1158 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1159 context->auth_ctx, (INT32*)&context->local_seq))
1160 goto cleanup;
1161 context->remote_seq ^= context->local_seq;
1162 }
1163
1164 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1165 &context->keyset))
1166 goto cleanup;
1167
1168 context->state = KERBEROS_STATE_AP_REP;
1169
1170 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1171 status = SEC_I_CONTINUE_NEEDED;
1172 else
1173 status = SEC_E_OK;
1174 break;
1175
1176 case KERBEROS_STATE_AP_REP:
1177
1178 if (tok_id == TOK_ID_AP_REP)
1179 {
1180 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1181 &reply))
1182 goto cleanup;
1183 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1184 }
1185 else if (tok_id == TOK_ID_ERROR)
1186 {
1187 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1188 goto cleanup;
1189 }
1190 else
1191 goto bad_token;
1192
1193 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1194 {
1195 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1196 context->auth_ctx, (INT32*)&context->remote_seq))
1197 goto cleanup;
1198 }
1199
1200 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1201 &context->keyset))
1202 goto cleanup;
1203
1204 context->state = KERBEROS_STATE_FINAL;
1205
1206 if (output_buffer)
1207 output_buffer->cbBuffer = 0;
1208 status = SEC_E_OK;
1209 break;
1210
1211 case KERBEROS_STATE_FINAL:
1212 default:
1213 WLog_ERR(TAG, "Kerberos in invalid state!");
1214 goto cleanup;
1215 }
1216
1217cleanup:
1218{
1219 /* second_ticket is not allocated */
1220 krb5_data edata = { 0 };
1221 in_creds.second_ticket = edata;
1222 krb5_free_cred_contents(credentials->ctx, &in_creds);
1223}
1224
1225 krb5_free_creds(credentials->ctx, creds);
1226 if (output_token.data)
1227 krb5glue_free_data_contents(credentials->ctx, &output_token);
1228
1229 winpr_Digest_Free(md5);
1230
1231 free(target);
1232
1233 if (isNewContext)
1234 {
1235 switch (status)
1236 {
1237 case SEC_E_OK:
1238 case SEC_I_CONTINUE_NEEDED:
1239 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1240 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1241 break;
1242 default:
1243 kerberos_ContextFree(context, TRUE);
1244 break;
1245 }
1246 }
1247
1248 return status;
1249
1250bad_token:
1251 status = SEC_E_INVALID_TOKEN;
1252 goto cleanup;
1253#else
1254 return SEC_E_UNSUPPORTED_FUNCTION;
1255#endif /* WITH_KRB5 */
1256}
1257
1258static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1259 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1260 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1261 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr, PTimeStamp ptsExpiry)
1262{
1263 SECURITY_STATUS status = 0;
1264 char* target_name = NULL;
1265
1266 if (pszTargetName)
1267 {
1268 target_name = ConvertWCharToUtf8Alloc(pszTargetName, NULL);
1269 if (!target_name)
1270 return SEC_E_INSUFFICIENT_MEMORY;
1271 }
1272
1273 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1274 Reserved1, TargetDataRep, pInput, Reserved2,
1275 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1276
1277 if (target_name)
1278 free(target_name);
1279
1280 return status;
1281}
1282
1283#ifdef WITH_KRB5
1284static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1285 krb5_creds* creds)
1286{
1287 BOOL ret = FALSE;
1288 krb5_kt_cursor cur = { 0 };
1289 krb5_keytab_entry entry = { 0 };
1290 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1291 goto cleanup;
1292
1293 do
1294 {
1295 krb5_error_code rv =
1296 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1297 if (rv == KRB5_KT_END)
1298 break;
1299 if (rv != 0)
1300 goto cleanup;
1301
1302 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1303 break;
1304 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1305 memset(&entry, 0, sizeof(entry));
1306 if (rv)
1307 goto cleanup;
1308 } while (1);
1309
1310 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1311 goto cleanup;
1312
1313 if (!entry.principal)
1314 goto cleanup;
1315
1316 /* Get the TGT */
1317 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1318 credentials->keytab, 0, NULL, NULL))
1319 goto cleanup;
1320
1321 ret = TRUE;
1322
1323cleanup:
1324 return ret;
1325}
1326
1327static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials, const char* target, krb5_creds* creds)
1328{
1329 BOOL ret = TRUE;
1330 krb5_principal target_princ = { 0 };
1331 char* default_realm = NULL;
1332
1333 krb5_error_code rv =
1334 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1335 if (rv)
1336 return FALSE;
1337
1338 if (!target_princ->realm.length)
1339 {
1340 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1341 if (rv)
1342 goto out;
1343
1344 target_princ->realm.data = default_realm;
1345 target_princ->realm.length = (unsigned int)strlen(default_realm);
1346 }
1347
1348 /*
1349 * First try with the account service. We were requested with something like
1350 * TERMSRV/<host>@<realm>, let's see if we have that in our keytab and if we're able
1351 * to retrieve a TGT with that entry
1352 *
1353 */
1354 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1355 goto out;
1356
1357 ret = FALSE;
1358
1359 /*
1360 * if it's not working let's try with <host>$@<REALM> (note the dollar)
1361 */
1362 char hostDollar[300] = { 0 };
1363 if (target_princ->length < 2)
1364 goto out;
1365
1366 (void)snprintf(hostDollar, sizeof(hostDollar) - 1, "%s$@%s", target_princ->data[1].data,
1367 target_princ->realm.data);
1368 krb5_free_principal(credentials->ctx, target_princ);
1369
1370 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1371 if (rv)
1372 return FALSE;
1373
1374 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1375
1376out:
1377 if (default_realm)
1378 krb5_free_default_realm(credentials->ctx, default_realm);
1379
1380 krb5_free_principal(credentials->ctx, target_princ);
1381 return ret;
1382}
1383#endif
1384
1385static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1386 PCredHandle phCredential, PCtxtHandle phContext, PSecBufferDesc pInput,
1387 WINPR_ATTR_UNUSED ULONG fContextReq, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1388 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr,
1389 WINPR_ATTR_UNUSED PTimeStamp ptsExpity)
1390{
1391#ifdef WITH_KRB5
1392 BOOL isNewContext = FALSE;
1393 PSecBuffer input_buffer = NULL;
1394 PSecBuffer output_buffer = NULL;
1395 WinPrAsn1_OID oid = { 0 };
1396 uint16_t tok_id = 0;
1397 krb5_data input_token = { 0 };
1398 krb5_data output_token = { 0 };
1399 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1400 krb5_flags ap_flags = 0;
1401 krb5glue_authenticator authenticator = NULL;
1402 char* target = NULL;
1403 krb5_keytab_entry entry = { 0 };
1404 krb5_creds creds = { 0 };
1405
1406 /* behave like windows SSPIs that don't want empty context */
1407 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1408 return SEC_E_INVALID_HANDLE;
1409
1410 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1411 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1412
1413 if (pInput)
1414 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1415 if (pOutput)
1416 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1417
1418 if (!input_buffer)
1419 return SEC_E_INVALID_TOKEN;
1420
1421 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1422 return SEC_E_INVALID_TOKEN;
1423
1424 if (!context)
1425 {
1426 isNewContext = TRUE;
1427 context = kerberos_ContextNew(credentials);
1428 context->acceptor = TRUE;
1429
1430 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1431 {
1432 context->u2u = TRUE;
1433 context->state = KERBEROS_STATE_TGT_REQ;
1434 }
1435 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1436 context->state = KERBEROS_STATE_AP_REQ;
1437 else
1438 goto bad_token;
1439 }
1440 else
1441 {
1442 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1443 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1444 goto bad_token;
1445 }
1446
1447 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1448 {
1449 if (!kerberos_rd_tgt_token(&input_token, &target, NULL))
1450 goto bad_token;
1451
1452 if (!retrieveSomeTgt(credentials, target, &creds))
1453 goto cleanup;
1454
1455 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, NULL, NULL, &creds.ticket))
1456 goto cleanup;
1457
1458 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1459 goto cleanup;
1460
1461 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1462 &krb5glue_creds_getkey(creds)))
1463 goto cleanup;
1464
1465 context->state = KERBEROS_STATE_AP_REQ;
1466 }
1467 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1468 {
1469 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, NULL,
1470 credentials->keytab, &ap_flags, NULL))
1471 goto cleanup;
1472
1473 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1474 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1475 goto cleanup;
1476
1477 /* Retrieve and validate the checksum */
1478 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1479 &authenticator))
1480 goto cleanup;
1481 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1482 &context->flags))
1483 goto bad_token;
1484
1485 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1486 {
1487 if (!output_buffer)
1488 goto bad_token;
1489 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1490 goto cleanup;
1491 if (!sspi_gss_wrap_token(output_buffer,
1492 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1493 TOK_ID_AP_REP, &output_token))
1494 goto cleanup;
1495 }
1496 else
1497 {
1498 if (output_buffer)
1499 output_buffer->cbBuffer = 0;
1500 }
1501
1502 *pfContextAttr = (context->flags & 0x1F);
1503 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1504 *pfContextAttr |= ASC_RET_INTEGRITY;
1505
1506 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1507 {
1508 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1509 (INT32*)&context->local_seq))
1510 goto cleanup;
1511 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1512 (INT32*)&context->remote_seq))
1513 goto cleanup;
1514 }
1515
1516 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1517 &context->keyset))
1518 goto cleanup;
1519
1520 context->state = KERBEROS_STATE_FINAL;
1521 }
1522 else
1523 goto bad_token;
1524
1525 /* On first call allocate new context */
1526 if (context->state == KERBEROS_STATE_FINAL)
1527 status = SEC_E_OK;
1528 else
1529 status = SEC_I_CONTINUE_NEEDED;
1530
1531cleanup:
1532 free(target);
1533 if (output_token.data)
1534 krb5glue_free_data_contents(credentials->ctx, &output_token);
1535 if (entry.principal)
1536 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1537
1538 if (isNewContext)
1539 {
1540 switch (status)
1541 {
1542 case SEC_E_OK:
1543 case SEC_I_CONTINUE_NEEDED:
1544 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1545 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1546 break;
1547 default:
1548 kerberos_ContextFree(context, TRUE);
1549 break;
1550 }
1551 }
1552
1553 return status;
1554
1555bad_token:
1556 status = SEC_E_INVALID_TOKEN;
1557 goto cleanup;
1558#else
1559 return SEC_E_UNSUPPORTED_FUNCTION;
1560#endif /* WITH_KRB5 */
1561}
1562
1563#ifdef WITH_KRB5
1564static KRB_CONTEXT* get_context(PCtxtHandle phContext)
1565{
1566 if (!phContext)
1567 return NULL;
1568
1569 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1570 if (!name)
1571 return NULL;
1572
1573 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1574 return NULL;
1575 return sspi_SecureHandleGetLowerPointer(phContext);
1576}
1577
1578static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1579{
1580 WINPR_ASSERT(data);
1581 WINPR_ASSERT(ptr);
1582 WINPR_ASSERT(psize);
1583
1584 *ptr = (PUCHAR)malloc(data->length);
1585 if (!*ptr)
1586 return FALSE;
1587
1588 *psize = data->length;
1589 memcpy(*ptr, data->data, data->length);
1590 return TRUE;
1591}
1592#endif
1593
1594static SECURITY_STATUS SEC_ENTRY kerberos_DeleteSecurityContext(PCtxtHandle phContext)
1595{
1596#ifdef WITH_KRB5
1597 KRB_CONTEXT* context = get_context(phContext);
1598 if (!context)
1599 return SEC_E_INVALID_HANDLE;
1600
1601 kerberos_ContextFree(context, TRUE);
1602
1603 return SEC_E_OK;
1604#else
1605 return SEC_E_UNSUPPORTED_FUNCTION;
1606#endif
1607}
1608
1609#ifdef WITH_KRB5
1610
1611static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1612{
1613 switch (code)
1614 {
1615 case 0:
1616 return SEC_E_OK;
1617 default:
1618 return SEC_E_INTERNAL_ERROR;
1619 }
1620}
1621
1622static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1623 SecPkgContext_Sizes* ContextSizes)
1624{
1625 UINT header = 0;
1626 UINT pad = 0;
1627 UINT trailer = 0;
1628 krb5glue_key key = NULL;
1629
1630 WINPR_ASSERT(context);
1631 WINPR_ASSERT(context->auth_ctx);
1632
1633 /* The MaxTokenSize by default is 12,000 bytes. This has been the default value
1634 * since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2.
1635 * For Windows Server 2012, the default value of the MaxTokenSize registry
1636 * entry is 48,000 bytes.*/
1637 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1638 ContextSizes->cbMaxSignature = 0;
1639 ContextSizes->cbBlockSize = 1;
1640 ContextSizes->cbSecurityTrailer = 0;
1641
1642 key = get_key(&context->keyset);
1643
1644 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1645 {
1646 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1647 KRB5_CRYPTO_TYPE_HEADER, &header);
1648 if (rv)
1649 return krb5_error_to_SECURITY_STATUS(rv);
1650
1651 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1652 &pad);
1653 if (rv)
1654 return krb5_error_to_SECURITY_STATUS(rv);
1655
1656 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1657 &trailer);
1658 if (rv)
1659 return krb5_error_to_SECURITY_STATUS(rv);
1660
1661 /* GSS header (= 16 bytes) + encrypted header = 32 bytes */
1662 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1663 }
1664
1665 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1666 {
1667 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1668 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1669 if (rv)
1670 return krb5_error_to_SECURITY_STATUS(rv);
1671
1672 ContextSizes->cbMaxSignature += 16;
1673 }
1674
1675 return SEC_E_OK;
1676}
1677
1678static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
1679 KRB_CREDENTIALS* credentials,
1680 KERB_TICKET_LOGON* ticketLogon)
1681{
1682 krb5_creds matchCred = { 0 };
1683 krb5_auth_context authContext = NULL;
1684 krb5_flags getCredsFlags = KRB5_GC_CACHED;
1685 BOOL firstRun = TRUE;
1686 krb5_creds* hostCred = NULL;
1687 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
1688 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost, "HOST",
1689 KRB5_NT_SRV_HST, &matchCred.server);
1690 if (rv)
1691 goto out;
1692
1693 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1694 &matchCred.client);
1695 if (rv)
1696 goto out;
1697
1698 /* try from the cache first, and then do a new request */
1699again:
1700 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
1701 &matchCred, &hostCred);
1702 switch (rv)
1703 {
1704 case 0:
1705 break;
1706 case KRB5_CC_NOTFOUND:
1707 getCredsFlags = 0;
1708 if (firstRun)
1709 {
1710 firstRun = FALSE;
1711 goto again;
1712 }
1713 WINPR_FALLTHROUGH
1714 default:
1715 WLog_ERR(TAG, "krb5_get_credentials(hostCreds), rv=%d", rv);
1716 goto out;
1717 }
1718
1719 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
1720 goto out;
1721
1722 krb5_data derOut = { 0 };
1723 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
1724 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
1725 {
1726 ret = SEC_E_LOGON_DENIED;
1727 goto out;
1728 }
1729
1730 ticketLogon->MessageType = KerbTicketLogon;
1731 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
1732
1733 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
1734 &ticketLogon->ServiceTicketLength))
1735 {
1736 krb5_free_data(credentials->ctx, &derOut);
1737 goto out;
1738 }
1739
1740 ticketLogon->TicketGrantingTicketLength = derOut.length;
1741 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
1742
1743 ret = SEC_E_OK;
1744out:
1745 krb5_auth_con_free(credentials->ctx, authContext);
1746 krb5_free_creds(credentials->ctx, hostCred);
1747 krb5_free_cred_contents(credentials->ctx, &matchCred);
1748 return ret;
1749}
1750
1751#endif /* WITH_KRB5 */
1752
1753static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(PCtxtHandle phContext,
1754 ULONG ulAttribute, void* pBuffer)
1755{
1756 if (!phContext)
1757 return SEC_E_INVALID_HANDLE;
1758
1759 if (!pBuffer)
1760 return SEC_E_INVALID_PARAMETER;
1761
1762#ifdef WITH_KRB5
1763 KRB_CONTEXT* context = get_context(phContext);
1764 if (!context)
1765 return SEC_E_INVALID_PARAMETER;
1766
1767 KRB_CREDENTIALS* credentials = context->credentials;
1768
1769 switch (ulAttribute)
1770 {
1771 case SECPKG_ATTR_SIZES:
1772 return kerberos_ATTR_SIZES(context, credentials, (SecPkgContext_Sizes*)pBuffer);
1773
1774 case SECPKG_CRED_ATTR_TICKET_LOGON:
1775 return kerberos_ATTR_TICKET_LOGON(context, credentials, (KERB_TICKET_LOGON*)pBuffer);
1776
1777 default:
1778 WLog_ERR(TAG, "TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
1779 ulAttribute);
1780 return SEC_E_UNSUPPORTED_FUNCTION;
1781 }
1782#else
1783 return SEC_E_UNSUPPORTED_FUNCTION;
1784#endif
1785}
1786
1787static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(PCtxtHandle phContext,
1788 ULONG ulAttribute, void* pBuffer)
1789{
1790 return kerberos_QueryContextAttributesA(phContext, ulAttribute, pBuffer);
1791}
1792
1793static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
1794 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
1795 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
1796{
1797 return SEC_E_UNSUPPORTED_FUNCTION;
1798}
1799
1800static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
1801 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
1802 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
1803{
1804 return SEC_E_UNSUPPORTED_FUNCTION;
1805}
1806
1807static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(PCredHandle phCredential,
1808 ULONG ulAttribute,
1809 void* pBuffer, ULONG cbBuffer,
1810 WINPR_ATTR_UNUSED BOOL unicode)
1811{
1812#ifdef WITH_KRB5
1813 KRB_CREDENTIALS* credentials = NULL;
1814
1815 if (!phCredential)
1816 return SEC_E_INVALID_HANDLE;
1817
1818 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1819
1820 if (!credentials)
1821 return SEC_E_INVALID_HANDLE;
1822
1823 if (!pBuffer)
1824 return SEC_E_INSUFFICIENT_MEMORY;
1825
1826 switch (ulAttribute)
1827 {
1828 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
1829 {
1830 SecPkgCredentials_KdcProxySettingsW* kdc_settings = pBuffer;
1831
1832 /* Sanity checks */
1833 if (cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
1834 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
1835 kdc_settings->ProxyServerOffset < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
1836 cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) +
1837 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
1838 return SEC_E_INVALID_TOKEN;
1839
1840 if (credentials->kdc_url)
1841 {
1842 free(credentials->kdc_url);
1843 credentials->kdc_url = NULL;
1844 }
1845
1846 if (kdc_settings->ProxyServerLength > 0)
1847 {
1848 WCHAR* proxy = (WCHAR*)((BYTE*)pBuffer + kdc_settings->ProxyServerOffset);
1849
1850 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
1851 proxy, kdc_settings->ProxyServerLength / sizeof(WCHAR), NULL);
1852 if (!credentials->kdc_url)
1853 return SEC_E_INSUFFICIENT_MEMORY;
1854 }
1855
1856 return SEC_E_OK;
1857 }
1858 case SECPKG_CRED_ATTR_NAMES:
1859 case SECPKG_ATTR_SUPPORTED_ALGS:
1860 default:
1861 WLog_ERR(TAG, "TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
1862 ulAttribute);
1863 return SEC_E_UNSUPPORTED_FUNCTION;
1864 }
1865
1866#else
1867 return SEC_E_UNSUPPORTED_FUNCTION;
1868#endif
1869}
1870
1871static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(PCredHandle phCredential,
1872 ULONG ulAttribute,
1873 void* pBuffer, ULONG cbBuffer)
1874{
1875 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
1876}
1877
1878static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(PCredHandle phCredential,
1879 ULONG ulAttribute,
1880 void* pBuffer, ULONG cbBuffer)
1881{
1882 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
1883}
1884
1885static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(PCtxtHandle phContext, ULONG fQOP,
1886 PSecBufferDesc pMessage,
1887 ULONG MessageSeqNo)
1888{
1889#ifdef WITH_KRB5
1890 KRB_CONTEXT* context = get_context(phContext);
1891 PSecBuffer sig_buffer = NULL;
1892 PSecBuffer data_buffer = NULL;
1893 char* header = NULL;
1894 BYTE flags = 0;
1895 krb5glue_key key = NULL;
1896 krb5_keyusage usage = 0;
1897 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, { 0 } },
1898 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1899 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1900 { KRB5_CRYPTO_TYPE_PADDING, { 0 } },
1901 { KRB5_CRYPTO_TYPE_TRAILER, { 0 } } };
1902
1903 if (!context)
1904 return SEC_E_INVALID_HANDLE;
1905
1906 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
1907 return SEC_E_UNSUPPORTED_FUNCTION;
1908
1909 KRB_CREDENTIALS* creds = context->credentials;
1910
1911 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
1912 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
1913
1914 if (!sig_buffer || !data_buffer)
1915 return SEC_E_INVALID_TOKEN;
1916
1917 if (fQOP)
1918 return SEC_E_QOP_NOT_SUPPORTED;
1919
1920 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
1921 flags |= FLAG_WRAP_CONFIDENTIAL;
1922
1923 key = get_key(&context->keyset);
1924 if (!key)
1925 return SEC_E_INTERNAL_ERROR;
1926
1927 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
1928
1929 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
1930
1931 /* Set the lengths of the data (plaintext + header) */
1932 encrypt_iov[1].data.length = data_buffer->cbBuffer;
1933 encrypt_iov[2].data.length = 16;
1934
1935 /* Get the lengths of the header, trailer, and padding and ensure sig_buffer is large enough */
1936 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
1937 ARRAYSIZE(encrypt_iov)))
1938 return SEC_E_INTERNAL_ERROR;
1939 if (sig_buffer->cbBuffer <
1940 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
1941 return SEC_E_INSUFFICIENT_MEMORY;
1942
1943 /* Set up the iov array in sig_buffer */
1944 header = sig_buffer->pvBuffer;
1945 encrypt_iov[2].data.data = header + 16;
1946 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
1947 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
1948 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
1949 encrypt_iov[1].data.data = data_buffer->pvBuffer;
1950
1951 /* Write the GSS header with 0 in RRC */
1952 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
1953 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
1954 header[3] = (char)0xFF;
1955 winpr_Data_Write_UINT32(header + 4, 0);
1956 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
1957
1958 /* Copy header to be encrypted */
1959 CopyMemory(encrypt_iov[2].data.data, header, 16);
1960
1961 /* Set the correct RRC */
1962 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
1963 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
1964
1965 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
1966 ARRAYSIZE(encrypt_iov)))
1967 return SEC_E_INTERNAL_ERROR;
1968
1969 return SEC_E_OK;
1970#else
1971 return SEC_E_UNSUPPORTED_FUNCTION;
1972#endif
1973}
1974
1975static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(PCtxtHandle phContext,
1976 PSecBufferDesc pMessage,
1977 ULONG MessageSeqNo, ULONG* pfQOP)
1978{
1979#ifdef WITH_KRB5
1980 KRB_CONTEXT* context = get_context(phContext);
1981 PSecBuffer sig_buffer = NULL;
1982 PSecBuffer data_buffer = NULL;
1983 krb5glue_key key = NULL;
1984 krb5_keyusage usage = 0;
1985 uint16_t tok_id = 0;
1986 BYTE flags = 0;
1987 uint16_t ec = 0;
1988 uint16_t rrc = 0;
1989 uint64_t seq_no = 0;
1990 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, { 0 } },
1991 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1992 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1993 { KRB5_CRYPTO_TYPE_PADDING, { 0 } },
1994 { KRB5_CRYPTO_TYPE_TRAILER, { 0 } } };
1995
1996 if (!context)
1997 return SEC_E_INVALID_HANDLE;
1998
1999 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2000 return SEC_E_UNSUPPORTED_FUNCTION;
2001
2002 KRB_CREDENTIALS* creds = context->credentials;
2003
2004 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2005 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2006
2007 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2008 return SEC_E_INVALID_TOKEN;
2009
2010 /* Read in header information */
2011 BYTE* header = sig_buffer->pvBuffer;
2012 tok_id = winpr_Data_Get_UINT16_BE(header);
2013 flags = header[2];
2014 ec = winpr_Data_Get_UINT16_BE(&header[4]);
2015 rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2016 seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2017
2018 /* Check that the header is valid */
2019 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2020 return SEC_E_INVALID_TOKEN;
2021
2022 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2023 return SEC_E_INVALID_TOKEN;
2024
2025 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2026 (seq_no != context->remote_seq + MessageSeqNo))
2027 return SEC_E_OUT_OF_SEQUENCE;
2028
2029 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2030 return SEC_E_INVALID_TOKEN;
2031
2032 /* We don't expect a trailer buffer; the encrypted header must be rotated */
2033 if (rrc < 16)
2034 return SEC_E_INVALID_TOKEN;
2035
2036 /* Find the proper key and key usage */
2037 key = get_key(&context->keyset);
2038 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2039 return SEC_E_INTERNAL_ERROR;
2040 usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2041
2042 /* Fill in the lengths of the iov array */
2043 iov[1].data.length = data_buffer->cbBuffer;
2044 iov[2].data.length = 16;
2045 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2046 return SEC_E_INTERNAL_ERROR;
2047
2048 /* We don't expect a trailer buffer; everything must be in sig_buffer */
2049 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2050 return SEC_E_INVALID_TOKEN;
2051 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2052 return SEC_E_INVALID_TOKEN;
2053
2054 /* Locate the parts of the message */
2055 iov[0].data.data = (char*)&header[16 + rrc + ec];
2056 iov[1].data.data = data_buffer->pvBuffer;
2057 iov[2].data.data = (char*)&header[16 + ec];
2058 char* data2 = iov[2].data.data;
2059 iov[3].data.data = &data2[iov[2].data.length];
2060
2061 char* data3 = iov[3].data.data;
2062 iov[4].data.data = &data3[iov[3].data.length];
2063
2064 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2065 return SEC_E_INTERNAL_ERROR;
2066
2067 /* Validate the encrypted header */
2068 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2069 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2070 if (memcmp(iov[2].data.data, header, 16) != 0)
2071 return SEC_E_MESSAGE_ALTERED;
2072
2073 *pfQOP = 0;
2074
2075 return SEC_E_OK;
2076#else
2077 return SEC_E_UNSUPPORTED_FUNCTION;
2078#endif
2079}
2080
2081static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(PCtxtHandle phContext,
2082 WINPR_ATTR_UNUSED ULONG fQOP,
2083 PSecBufferDesc pMessage, ULONG MessageSeqNo)
2084{
2085#ifdef WITH_KRB5
2086 KRB_CONTEXT* context = get_context(phContext);
2087 PSecBuffer sig_buffer = NULL;
2088 PSecBuffer data_buffer = NULL;
2089 krb5glue_key key = NULL;
2090 krb5_keyusage usage = 0;
2091 BYTE flags = 0;
2092 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2093 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2094 { KRB5_CRYPTO_TYPE_CHECKSUM, { 0 } } };
2095
2096 if (!context)
2097 return SEC_E_INVALID_HANDLE;
2098
2099 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2100 return SEC_E_UNSUPPORTED_FUNCTION;
2101
2102 KRB_CREDENTIALS* creds = context->credentials;
2103
2104 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2105 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2106
2107 if (!sig_buffer || !data_buffer)
2108 return SEC_E_INVALID_TOKEN;
2109
2110 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2111
2112 key = get_key(&context->keyset);
2113 if (!key)
2114 return SEC_E_INTERNAL_ERROR;
2115 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2116
2117 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2118
2119 /* Fill in the lengths of the iov array */
2120 iov[0].data.length = data_buffer->cbBuffer;
2121 iov[1].data.length = 16;
2122 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2123 return SEC_E_INTERNAL_ERROR;
2124
2125 /* Ensure the buffer is big enough */
2126 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2127 return SEC_E_INSUFFICIENT_MEMORY;
2128
2129 /* Write the header */
2130 char* header = sig_buffer->pvBuffer;
2131 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2132 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2133 memset(header + 3, 0xFF, 5);
2134 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2135
2136 /* Set up the iov array */
2137 iov[0].data.data = data_buffer->pvBuffer;
2138 iov[1].data.data = header;
2139 iov[2].data.data = header + 16;
2140
2141 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2142 return SEC_E_INTERNAL_ERROR;
2143
2144 sig_buffer->cbBuffer = iov[2].data.length + 16;
2145
2146 return SEC_E_OK;
2147#else
2148 return SEC_E_UNSUPPORTED_FUNCTION;
2149#endif
2150}
2151
2152static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(PCtxtHandle phContext,
2153 PSecBufferDesc pMessage,
2154 ULONG MessageSeqNo,
2155 WINPR_ATTR_UNUSED ULONG* pfQOP)
2156{
2157#ifdef WITH_KRB5
2158 PSecBuffer sig_buffer = NULL;
2159 PSecBuffer data_buffer = NULL;
2160 krb5glue_key key = NULL;
2161 krb5_keyusage usage = 0;
2162 BYTE flags = 0;
2163 uint16_t tok_id = 0;
2164 uint64_t seq_no = 0;
2165 krb5_boolean is_valid = 0;
2166 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2167 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2168 { KRB5_CRYPTO_TYPE_CHECKSUM, { 0 } } };
2169 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2170
2171 KRB_CONTEXT* context = get_context(phContext);
2172 if (!context)
2173 return SEC_E_INVALID_HANDLE;
2174
2175 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2176 return SEC_E_UNSUPPORTED_FUNCTION;
2177
2178 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2179 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2180
2181 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2182 return SEC_E_INVALID_TOKEN;
2183
2184 /* Read in header info */
2185 BYTE* header = sig_buffer->pvBuffer;
2186 tok_id = winpr_Data_Get_UINT16_BE(header);
2187 flags = header[2];
2188 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2189
2190 /* Validate header */
2191 if (tok_id != TOK_ID_MIC)
2192 return SEC_E_INVALID_TOKEN;
2193
2194 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2195 return SEC_E_INVALID_TOKEN;
2196
2197 if (memcmp(header + 3, cmp_filler, sizeof(cmp_filler)) != 0)
2198 return SEC_E_INVALID_TOKEN;
2199
2200 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2201 return SEC_E_OUT_OF_SEQUENCE;
2202
2203 /* Find the proper key and usage */
2204 key = get_key(&context->keyset);
2205 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2206 return SEC_E_INTERNAL_ERROR;
2207 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2208
2209 /* Fill in the iov array lengths */
2210 KRB_CREDENTIALS* creds = context->credentials;
2211 iov[0].data.length = data_buffer->cbBuffer;
2212 iov[1].data.length = 16;
2213 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2214 return SEC_E_INTERNAL_ERROR;
2215
2216 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2217 return SEC_E_INTERNAL_ERROR;
2218
2219 /* Set up the iov array */
2220 iov[0].data.data = data_buffer->pvBuffer;
2221 iov[1].data.data = (char*)header;
2222 iov[2].data.data = (char*)&header[16];
2223
2224 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2225 &is_valid))
2226 return SEC_E_INTERNAL_ERROR;
2227
2228 if (!is_valid)
2229 return SEC_E_MESSAGE_ALTERED;
2230
2231 return SEC_E_OK;
2232#else
2233 return SEC_E_UNSUPPORTED_FUNCTION;
2234#endif
2235}
2236
2237const SecurityFunctionTableA KERBEROS_SecurityFunctionTableA = {
2238 3, /* dwVersion */
2239 NULL, /* EnumerateSecurityPackages */
2240 kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
2241 kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
2242 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2243 NULL, /* Reserved2 */
2244 kerberos_InitializeSecurityContextA, /* InitializeSecurityContext */
2245 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2246 NULL, /* CompleteAuthToken */
2247 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2248 NULL, /* ApplyControlToken */
2249 kerberos_QueryContextAttributesA, /* QueryContextAttributes */
2250 NULL, /* ImpersonateSecurityContext */
2251 NULL, /* RevertSecurityContext */
2252 kerberos_MakeSignature, /* MakeSignature */
2253 kerberos_VerifySignature, /* VerifySignature */
2254 NULL, /* FreeContextBuffer */
2255 NULL, /* QuerySecurityPackageInfo */
2256 NULL, /* Reserved3 */
2257 NULL, /* Reserved4 */
2258 NULL, /* ExportSecurityContext */
2259 NULL, /* ImportSecurityContext */
2260 NULL, /* AddCredentials */
2261 NULL, /* Reserved8 */
2262 NULL, /* QuerySecurityContextToken */
2263 kerberos_EncryptMessage, /* EncryptMessage */
2264 kerberos_DecryptMessage, /* DecryptMessage */
2265 kerberos_SetContextAttributesA, /* SetContextAttributes */
2266 kerberos_SetCredentialsAttributesA, /* SetCredentialsAttributes */
2267};
2268
2269const SecurityFunctionTableW KERBEROS_SecurityFunctionTableW = {
2270 3, /* dwVersion */
2271 NULL, /* EnumerateSecurityPackages */
2272 kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
2273 kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
2274 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2275 NULL, /* Reserved2 */
2276 kerberos_InitializeSecurityContextW, /* InitializeSecurityContext */
2277 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2278 NULL, /* CompleteAuthToken */
2279 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2280 NULL, /* ApplyControlToken */
2281 kerberos_QueryContextAttributesW, /* QueryContextAttributes */
2282 NULL, /* ImpersonateSecurityContext */
2283 NULL, /* RevertSecurityContext */
2284 kerberos_MakeSignature, /* MakeSignature */
2285 kerberos_VerifySignature, /* VerifySignature */
2286 NULL, /* FreeContextBuffer */
2287 NULL, /* QuerySecurityPackageInfo */
2288 NULL, /* Reserved3 */
2289 NULL, /* Reserved4 */
2290 NULL, /* ExportSecurityContext */
2291 NULL, /* ImportSecurityContext */
2292 NULL, /* AddCredentials */
2293 NULL, /* Reserved8 */
2294 NULL, /* QuerySecurityContextToken */
2295 kerberos_EncryptMessage, /* EncryptMessage */
2296 kerberos_DecryptMessage, /* DecryptMessage */
2297 kerberos_SetContextAttributesW, /* SetContextAttributes */
2298 kerberos_SetCredentialsAttributesW, /* SetCredentialsAttributes */
2299};
2300
2301BOOL KERBEROS_init(void)
2302{
2303 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2304 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2305 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2306 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));
2307 return TRUE;
2308}
KERB_TICKET_LOGON
Definition secapi.h:50
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349
SEC_WINNT_AUTH_IDENTITY_WINPR
Definition include/winpr/sspi.h:885
SEC_WINPR_KERBEROS_SETTINGS
Definition include/winpr/sspi.h:870
SecPkgContext_Sizes
Definition include/winpr/sspi.h:427
SecPkgCredentials_KdcProxySettingsW
Definition include/winpr/sspi.h:525
WinPrAsn1_MemoryChunk
Definition asn1.h:79
krb5glue_keyset
Definition krb5glue.h:88
sspi_gss_data
Definition sspi_gss.h:36
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:783