FreeRDP
Loading...
Searching...
No Matches
kerberos.c
1
22#include <winpr/config.h>
23#include <winpr/library.h>
24
25#include <stdio.h>
26#include <stdlib.h>
27#include <string.h>
28#include <errno.h>
29#include <fcntl.h>
30#include <ctype.h>
31
32#include <winpr/assert.h>
33#include <winpr/cast.h>
34#include <winpr/asn1.h>
35#include <winpr/crt.h>
36#include <winpr/interlocked.h>
37#include <winpr/sspi.h>
38#include <winpr/print.h>
39#include <winpr/tchar.h>
40#include <winpr/sysinfo.h>
41#include <winpr/registry.h>
42#include <winpr/endian.h>
43#include <winpr/crypto.h>
44#include <winpr/path.h>
45#include <winpr/wtypes.h>
46#include <winpr/winsock.h>
47#include <winpr/schannel.h>
48#include <winpr/secapi.h>
49
50#include "kerberos.h"
51
52#ifdef WITH_KRB5_MIT
53#include "krb5glue.h"
54#include <profile.h>
55#endif
56
57#ifdef WITH_KRB5_HEIMDAL
58#include "krb5glue.h"
59#include <krb5-protos.h>
60#endif
61
62#include "../sspi.h"
63#include "../../log.h"
64
65const SecPkgInfoA KERBEROS_SecPkgInfoA = {
66 0x000F3BBF, /* fCapabilities */
67 1, /* wVersion */
68 0x0010, /* wRPCID */
69 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
70 "Kerberos", /* Name */
71 "Kerberos Security Package" /* Comment */
72};
73
74static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = WINPR_C_ARRAY_INIT;
75static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = WINPR_C_ARRAY_INIT;
76
77const SecPkgInfoW KERBEROS_SecPkgInfoW = {
78 0x000F3BBF, /* fCapabilities */
79 1, /* wVersion */
80 0x0010, /* wRPCID */
81 0x0000BB80, /* cbMaxToken : 48k bytes maximum for Windows Server 2012 */
82 KERBEROS_SecPkgInfoW_NameBuffer, /* Name */
83 KERBEROS_SecPkgInfoW_CommentBuffer /* Comment */
84};
85
86#ifdef WITH_KRB5
87#define TAG WINPR_TAG("sspi.Kerberos")
88
89#define KRB_TGT_REQ 16
90#define KRB_TGT_REP 17
91
92enum KERBEROS_STATE
93{
94 KERBEROS_STATE_INITIAL,
95 KERBEROS_STATE_TGT_REQ,
96 KERBEROS_STATE_TGT_REP,
97 KERBEROS_STATE_AP_REQ,
98 KERBEROS_STATE_AP_REP,
99 KERBEROS_STATE_FINAL
100};
101
102typedef struct KRB_CREDENTIALS_st
103{
104 volatile LONG refCount;
105 krb5_context ctx;
106 char* kdc_url;
107 krb5_ccache ccache;
108 krb5_keytab keytab;
109 krb5_keytab client_keytab;
110 BOOL own_ccache;
111} KRB_CREDENTIALS;
112
113struct s_KRB_CONTEXT
114{
115 enum KERBEROS_STATE state;
116 KRB_CREDENTIALS* credentials;
117 krb5_auth_context auth_ctx;
118 BOOL acceptor;
119 uint32_t flags;
120 uint64_t local_seq;
121 uint64_t remote_seq;
122 struct krb5glue_keyset keyset;
123 BOOL u2u;
124 char* targetHost;
125};
126
127static const WinPrAsn1_OID kerberos_OID = { 9, (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
128static const WinPrAsn1_OID kerberos_u2u_OID = { 10,
129 (void*)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
130
131WINPR_ATTR_NODISCARD
132krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code, const char* what,
133 const char* file, const char* fkt, size_t line)
134{
135 switch (code)
136 {
137 case 0:
138 case KRB5_KT_END:
139 break;
140 default:
141 {
142 const DWORD level = WLOG_ERROR;
143
144 wLog* log = WLog_Get(TAG);
145 if (WLog_IsLevelActive(log, level))
146 {
147 const char* msg = krb5_get_error_message(ctx, code);
148 WLog_PrintTextMessage(log, level, line, file, fkt, "%s (%s [%d])", what, msg, code);
149 krb5_free_error_message(ctx, msg);
150 }
151 }
152 break;
153 }
154 return code;
155}
156
157void krb_log_context_encryption(krb5_context ctx, krb5_principal princ)
158{
159#if !defined(WITH_KRB5_HEIMDAL)
160 typedef krb5_error_code KRB5_CALLCONV (*krb5_get_etype_info_fn)(
161 krb5_context context, krb5_principal principal, krb5_get_init_creds_opt* opt,
162 krb5_enctype* enctype_out, krb5_data* salt_out, krb5_data* s2kparams_out);
163
164 krb5_get_etype_info_fn fn =
165 GetProcAddressAs(nullptr, "krb5_get_etype_info", krb5_get_etype_info_fn);
166
167 if (fn)
168 {
169 krb5_get_init_creds_opt opt = WINPR_C_ARRAY_INIT;
170 krb5_enctype enctype = 0;
171 krb5_data salt = WINPR_C_ARRAY_INIT;
172 krb5_data s2kparam = WINPR_C_ARRAY_INIT;
173 char buffer[128] = WINPR_C_ARRAY_INIT;
174 krb5_error_code rv = krb_log_exec(fn, ctx, princ, &opt, &enctype, &salt, &s2kparam);
175 krb5_enctype_to_string(enctype, buffer, sizeof(buffer));
176 const char* msg = krb5_get_error_message(ctx, rv);
177
178 char* saltdata = winpr_BinToHexString(salt.data, salt.length, TRUE);
179 WLog_DBG(TAG, "[%s] enctype=%s, salt[%u]=%s, s2kparam[%u]=%s", msg, buffer, salt.length,
180 saltdata, s2kparam.length, s2kparam.data);
181
182 krb5_free_data_contents(ctx, &salt);
183 krb5_free_data_contents(ctx, &s2kparam);
184 krb5_free_error_message(ctx, msg);
185 free(saltdata);
186 }
187 else
188#endif
189 {
190 WLog_WARN(TAG,
191 "kerberos implementation does not support 'krb5_get_etype_info', not displaying "
192 "encryption information");
193 }
194}
195
196static void credentials_unref(KRB_CREDENTIALS* credentials);
197
198static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
199{
200 if (!ctx)
201 return;
202
203 free(ctx->targetHost);
204 ctx->targetHost = nullptr;
205
206 if (ctx->credentials)
207 {
208 krb5_context krbctx = ctx->credentials->ctx;
209 if (krbctx)
210 {
211 if (ctx->auth_ctx)
212 krb5_auth_con_free(krbctx, ctx->auth_ctx);
213
214 krb5glue_keys_free(krbctx, &ctx->keyset);
215 }
216
217 credentials_unref(ctx->credentials);
218 }
219
220 if (allocated)
221 free(ctx);
222}
223
224WINPR_ATTR_MALLOC(kerberos_ContextFree, 1)
225static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
226{
227 KRB_CONTEXT* context = nullptr;
228
229 context = (KRB_CONTEXT*)calloc(1, sizeof(KRB_CONTEXT));
230 if (!context)
231 return nullptr;
232
233 context->credentials = credentials;
234 InterlockedIncrement(&credentials->refCount);
235 return context;
236}
237
238WINPR_ATTR_NODISCARD
239static krb5_error_code krb5_prompter(krb5_context context, void* data,
240 WINPR_ATTR_UNUSED const char* name,
241 WINPR_ATTR_UNUSED const char* banner, int num_prompts,
242 krb5_prompt prompts[])
243{
244 for (int i = 0; i < num_prompts; i++)
245 {
246 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
247 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
248 {
249 prompts[i].reply->data = _strdup((const char*)data);
250
251 const size_t len = strlen((const char*)data);
252 if (len > UINT32_MAX)
253 return KRB5KRB_ERR_GENERIC;
254 prompts[i].reply->length = (UINT32)len;
255 }
256 }
257 return 0;
258}
259
260WINPR_ATTR_NODISCARD
261static inline krb5glue_key get_key(struct krb5glue_keyset* keyset)
262{
263 return keyset->acceptor_key ? keyset->acceptor_key
264 : keyset->initiator_key ? keyset->initiator_key
265 : keyset->session_key;
266}
267
268WINPR_ATTR_NODISCARD
269static BOOL isValidIPv4(const char* ipAddress)
270{
271 struct sockaddr_in sa = WINPR_C_ARRAY_INIT;
272 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
273 return result != 0;
274}
275
276WINPR_ATTR_NODISCARD
277static BOOL isValidIPv6(const char* ipAddress)
278{
279 struct sockaddr_in6 sa = WINPR_C_ARRAY_INIT;
280 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
281 return result != 0;
282}
283
284WINPR_ATTR_NODISCARD
285static BOOL isValidIP(const char* ipAddress)
286{
287 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
288}
289
290#if defined(WITH_KRB5_MIT)
291WINPR_ATTR_MALLOC(free, 1)
292static char* get_realm_name(krb5_data realm, size_t* plen)
293{
294 WINPR_ASSERT(plen);
295 *plen = 0;
296 if ((realm.length <= 0) || (!realm.data))
297 return nullptr;
298
299 char* name = nullptr;
300 (void)winpr_asprintf(&name, plen, "krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
301 realm.data);
302 return name;
303}
304#elif defined(WITH_KRB5_HEIMDAL)
305WINPR_ATTR_MALLOC(free, 1)
306static char* get_realm_name(Realm realm, size_t* plen)
307{
308 WINPR_ASSERT(plen);
309 *plen = 0;
310 if (!realm)
311 return nullptr;
312
313 char* name = nullptr;
314 (void)winpr_asprintf(&name, plen, "krbtgt/%s@%s", realm, realm);
315 return name;
316}
317#endif
318
319WINPR_ATTR_NODISCARD
320static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
321{
322 /* "krbtgt/" + realm + "@" + realm */
323 size_t len = 0;
324 krb5_error_code rv = KRB5_CC_NOMEM;
325
326 char* name = get_realm_name(principal->realm, &len);
327 if (!name || (len == 0))
328 goto fail;
329
330 {
331 krb5_principal target = WINPR_C_ARRAY_INIT;
332 rv = krb5_parse_name(ctx, name, &target);
333 *ptarget = target;
334 }
335fail:
336 free(name);
337 return rv;
338}
339
340#endif /* WITH_KRB5 */
341
342WINPR_ATTR_NODISCARD
343static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
344 WINPR_ATTR_UNUSED SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage,
345 WINPR_ATTR_UNUSED ULONG fCredentialUse, WINPR_ATTR_UNUSED void* pvLogonID,
346 WINPR_ATTR_UNUSED void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
347 WINPR_ATTR_UNUSED void* pvGetKeyArgument, WINPR_ATTR_UNUSED PCredHandle phCredential,
348 WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
349{
350#ifdef WITH_KRB5
351#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
352 SEC_WINPR_KERBEROS_SETTINGS_V2 krb_settings_v1_buffer = WINPR_C_ARRAY_INIT;
353#endif
354
355 SEC_WINPR_KERBEROS_SETTINGS_V2* krb_settings = nullptr;
356 KRB_CREDENTIALS* credentials = nullptr;
357 krb5_context ctx = nullptr;
358 krb5_ccache ccache = nullptr;
359 krb5_keytab keytab = nullptr;
360 krb5_principal principal = nullptr;
361 char* domain = nullptr;
362 char* username = nullptr;
363 char* password = nullptr;
364 BOOL own_ccache = FALSE;
365 const char* const default_ccache_type = "MEMORY";
366
367 if (pAuthData)
368 {
369 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
370
371#if !defined(WITHOUT_WINPR_3x_DEPRECATED)
372 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
373 {
374 SEC_WINPR_KERBEROS_SETTINGS* krb_settingsV1 =
375 (((SEC_WINNT_AUTH_IDENTITY_WINPR*)pAuthData)->kerberosSettings);
376 if (krb_settingsV1)
377 {
378 krb_settings_v1_buffer.kdcUrl = krb_settingsV1->kdcUrl;
379 krb_settings_v1_buffer.keytab = krb_settingsV1->keytab;
380 krb_settings_v1_buffer.cache = krb_settingsV1->cache;
381 krb_settings_v1_buffer.armorCache = krb_settingsV1->armorCache;
382 krb_settings_v1_buffer.pkinitX509Anchors = krb_settingsV1->pkinitX509Anchors;
383 krb_settings_v1_buffer.pkinitX509Identity = krb_settingsV1->pkinitX509Identity;
384 krb_settings_v1_buffer.withPac = krb_settingsV1->withPac;
385 krb_settings_v1_buffer.startTime = krb_settingsV1->startTime;
386 krb_settings_v1_buffer.renewLifeTime = krb_settingsV1->renewLifeTime;
387 krb_settings_v1_buffer.lifeTime = krb_settingsV1->lifeTime;
388 memcpy(krb_settings_v1_buffer.certSha1, krb_settingsV1->certSha1,
389 sizeof(krb_settings_v1_buffer.certSha1));
390 krb_settings = &krb_settings_v1_buffer;
391 }
392 }
393#endif
394 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED_v2)
395 {
396 const SEC_WINNT_AUTH_IDENTITY_WINPR_V2* auth =
397 (const SEC_WINNT_AUTH_IDENTITY_WINPR_V2*)pAuthData;
398 WINPR_ASSERT(auth);
399 if (auth->version < SEC_WINNT_AUTH_IDENTITY_WINPR_V2_REVISION_1)
400 goto cleanup;
401 krb_settings = auth->kerberosSettingsV2;
402 }
403
404 if (!sspi_CopyAuthIdentityFieldsA((const SEC_WINNT_AUTH_IDENTITY_INFO*)pAuthData, &username,
405 &domain, &password))
406 {
407 WLog_ERR(TAG, "Failed to copy auth identity fields");
408 goto cleanup;
409 }
410
411 if (!pszPrincipal)
412 pszPrincipal = username;
413 }
414
415 if (krb_log_exec_ptr(krb5_init_context, &ctx))
416 goto cleanup;
417
418 BOOL enterprise = FALSE;
419 if (domain)
420 {
421 char* udomain = _strdup(domain);
422 if (!udomain)
423 goto cleanup;
424
425 CharUpperA(udomain);
426
427 /* A DNS-style domain that differs from the configured default realm is a UPN
428 * suffix, e.g. user@example.com for an account in realm CORP.EXAMPLE.NET, which is
429 * what /smartcard-logon takes from the certificate. AD rejects that as a realm
430 * ("Realm not local to KDC") and only accepts it as an enterprise principal in
431 * the account's realm, as Windows clients send it - so keep the configured realm. */
432 char* default_realm = nullptr;
433 if (strchr(udomain, '.') && (krb5_get_default_realm(ctx, &default_realm) == 0) &&
434 (strcmp(default_realm, udomain) != 0))
435 enterprise = TRUE;
436 krb5_free_default_realm(ctx, default_realm);
437
438 krb5_error_code rv = 0;
439 /* Will use domain if realm is not specified in username */
440 if (!enterprise)
441 rv = krb_log_exec(krb5_set_default_realm, ctx, udomain);
442 free(udomain);
443
444 if (rv)
445 goto cleanup;
446 }
447
448 if (pszPrincipal)
449 {
450 krb5_error_code rv = 0;
451 if (enterprise && !strchr(pszPrincipal, '@'))
452 {
453 char* upn = nullptr;
454 size_t upnlen = 0;
455 (void)winpr_asprintf(&upn, &upnlen, "%s@%s", pszPrincipal, domain);
456 if (!upn)
457 goto cleanup;
458
459 /* e.g. "user@example.com" becomes "user\@example.com@CORP.EXAMPLE.NET" */
460 rv = krb_log_exec(krb5_parse_name_flags, ctx, upn, KRB5_PRINCIPAL_PARSE_ENTERPRISE,
461 &principal);
462 free(upn);
463 }
464 else
465 {
466 char* cpszPrincipal = _strdup(pszPrincipal);
467 if (!cpszPrincipal)
468 goto cleanup;
469
470 /* Find realm component if included and convert to uppercase */
471 char* p = strchr(cpszPrincipal, '@');
472 if (p)
473 CharUpperA(p);
474
475 rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, &principal);
476 free(cpszPrincipal);
477 }
478
479 if (rv)
480 goto cleanup;
481 WINPR_ASSERT(principal);
482 }
483
484 if (krb_settings && krb_settings->cache)
485 {
486 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
487 goto cleanup;
488 }
489 else
490 own_ccache = TRUE;
491
492 if (principal)
493 {
494 /* Use the default cache if it's initialized with the right principal */
495 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
496 {
497 if (own_ccache)
498 {
499 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
500 goto cleanup;
501 }
502 else
503 {
504 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
505 goto cleanup;
506 }
507
508 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
509 goto cleanup;
510 }
511 else
512 {
513 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
514 goto cleanup;
515 own_ccache = FALSE;
516 }
517 WINPR_ASSERT(ccache);
518 }
519 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
520 {
521 /* Use the default cache with it's default principal */
522 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
523 goto cleanup;
524 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
525 goto cleanup;
526 WINPR_ASSERT(ccache);
527 own_ccache = FALSE;
528 }
529 else
530 {
531 if (own_ccache)
532 {
533 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, nullptr, &ccache))
534 goto cleanup;
535 }
536 else
537 {
538 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
539 goto cleanup;
540 }
541 WINPR_ASSERT(ccache);
542 }
543
544 if (krb_settings && krb_settings->keytab)
545 {
546 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
547 goto cleanup;
548 }
549 else
550 {
551 if (fCredentialUse & SECPKG_CRED_INBOUND)
552 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
553 goto cleanup;
554 }
555
556 /* Get initial credentials if required */
557 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
558 {
559 krb5_creds creds = WINPR_C_ARRAY_INIT;
560 krb5_creds matchCreds = WINPR_C_ARRAY_INIT;
561 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
562
563 krb5_timeofday(ctx, &matchCreds.times.endtime);
564 matchCreds.times.endtime += 60;
565 matchCreds.client = principal;
566
567 WINPR_ASSERT(principal);
568 WINPR_ASSERT(ctx);
569 WINPR_ASSERT(ccache);
570 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
571 goto cleanup;
572
573 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
574 krb5_free_principal(ctx, matchCreds.server);
575 krb5_free_cred_contents(ctx, &creds);
576 if (rv)
577 {
578 if (krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
579 password, krb_settings))
580 goto cleanup;
581 }
582 }
583
584 credentials = calloc(1, sizeof(KRB_CREDENTIALS));
585 if (!credentials)
586 goto cleanup;
587 credentials->refCount = 1;
588 credentials->ctx = ctx;
589 credentials->ccache = ccache;
590 credentials->keytab = keytab;
591 credentials->own_ccache = own_ccache;
592
593cleanup:
594
595 free(domain);
596 free(username);
597 free(password);
598
599 if (principal)
600 krb5_free_principal(ctx, principal);
601 if (ctx)
602 {
603 if (!credentials)
604 {
605 if (ccache)
606 {
607 if (own_ccache)
608 krb5_cc_destroy(ctx, ccache);
609 else
610 krb5_cc_close(ctx, ccache);
611 }
612 if (keytab)
613 krb5_kt_close(ctx, keytab);
614
615 krb5_free_context(ctx);
616 }
617 }
618
619 /* If we managed to get credentials set the output */
620 if (credentials)
621 {
622 sspi_SecureHandleSetLowerPointer(phCredential, (void*)credentials);
623 sspi_SecureHandleSetUpperPointer(phCredential, (void*)KERBEROS_SSP_NAME);
624 return SEC_E_OK;
625 }
626
627 return SEC_E_NO_CREDENTIALS;
628#else
629 return SEC_E_UNSUPPORTED_FUNCTION;
630#endif
631}
632
633WINPR_ATTR_NODISCARD
634static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
635 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse, void* pvLogonID,
636 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn, void* pvGetKeyArgument, PCredHandle phCredential,
637 PTimeStamp ptsExpiry)
638{
639 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
640 char* principal = nullptr;
641 char* package = nullptr;
642
643 if (pszPrincipal)
644 {
645 principal = ConvertWCharToUtf8Alloc(pszPrincipal, nullptr);
646 if (!principal)
647 goto fail;
648 }
649 if (pszPackage)
650 {
651 package = ConvertWCharToUtf8Alloc(pszPackage, nullptr);
652 if (!package)
653 goto fail;
654 }
655
656 status =
657 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
658 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
659
660fail:
661 free(principal);
662 free(package);
663
664 return status;
665}
666
667#ifdef WITH_KRB5
668static void credentials_unref(KRB_CREDENTIALS* credentials)
669{
670 WINPR_ASSERT(credentials);
671
672 if (InterlockedDecrement(&credentials->refCount))
673 return;
674
675 free(credentials->kdc_url);
676
677 if (credentials->ccache)
678 {
679 if (credentials->own_ccache)
680 krb5_cc_destroy(credentials->ctx, credentials->ccache);
681 else
682 krb5_cc_close(credentials->ctx, credentials->ccache);
683 }
684 if (credentials->keytab)
685 krb5_kt_close(credentials->ctx, credentials->keytab);
686
687 krb5_free_context(credentials->ctx);
688 free(credentials);
689}
690#endif
691
692WINPR_ATTR_NODISCARD
693static SECURITY_STATUS
694 SEC_ENTRY kerberos_FreeCredentialsHandle(WINPR_ATTR_UNUSED PCredHandle phCredential)
695{
696#ifdef WITH_KRB5
697 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
698 sspi_SecureHandleInvalidate(phCredential);
699 if (!credentials)
700 return SEC_E_INVALID_HANDLE;
701
702 credentials_unref(credentials);
703
704 return SEC_E_OK;
705#else
706 return SEC_E_UNSUPPORTED_FUNCTION;
707#endif
708}
709
710WINPR_ATTR_NODISCARD
711static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
712 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
713 WINPR_ATTR_UNUSED void* pBuffer)
714{
715#ifdef WITH_KRB5
716 switch (ulAttribute)
717 {
718 case SECPKG_CRED_ATTR_NAMES:
719 return SEC_E_OK;
720 default:
721 WLog_ERR(TAG, "TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
722 ulAttribute);
723 return SEC_E_UNSUPPORTED_FUNCTION;
724 }
725
726#else
727 return SEC_E_UNSUPPORTED_FUNCTION;
728#endif
729}
730
731WINPR_ATTR_NODISCARD
732static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(PCredHandle phCredential,
733 ULONG ulAttribute,
734 void* pBuffer)
735{
736 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
737}
738
739#ifdef WITH_KRB5
740WINPR_ATTR_NODISCARD
741static BOOL kerberos_mk_tgt_token(SecBuffer* buf, int msg_type, char* sname, char* host,
742 const krb5_data* ticket)
743{
744 WinPrAsn1Encoder* enc = nullptr;
745 WinPrAsn1_MemoryChunk data;
746 wStream s;
747 size_t len = 0;
748 sspi_gss_data token;
749 BOOL ret = FALSE;
750
751 WINPR_ASSERT(buf);
752
753 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
754 return FALSE;
755 if (msg_type == KRB_TGT_REP && !ticket)
756 return FALSE;
757
758 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
759 if (!enc)
760 return FALSE;
761
762 /* KERB-TGT-REQUEST (SEQUENCE) */
763 if (!WinPrAsn1EncSeqContainer(enc))
764 goto cleanup;
765
766 /* pvno [0] INTEGER */
767 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
768 goto cleanup;
769
770 /* msg-type [1] INTEGER */
771 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
772 goto cleanup;
773
774 if (msg_type == KRB_TGT_REQ && sname)
775 {
776 /* server-name [2] PrincipalName (SEQUENCE) */
777 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
778 goto cleanup;
779
780 /* name-type [0] INTEGER */
781 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
782 goto cleanup;
783
784 /* name-string [1] SEQUENCE OF GeneralString */
785 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
786 goto cleanup;
787
788 if (!WinPrAsn1EncGeneralString(enc, sname))
789 goto cleanup;
790
791 if (host && !WinPrAsn1EncGeneralString(enc, host))
792 goto cleanup;
793
794 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
795 goto cleanup;
796 }
797 else if (msg_type == KRB_TGT_REP)
798 {
799 /* ticket [2] Ticket */
800 data.data = (BYTE*)ticket->data;
801 data.len = ticket->length;
802 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
803 goto cleanup;
804 }
805
806 if (!WinPrAsn1EncEndContainer(enc))
807 goto cleanup;
808
809 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
810 goto cleanup;
811
812 Stream_StaticInit(&s, buf->pvBuffer, len);
813 if (!WinPrAsn1EncToStream(enc, &s))
814 goto cleanup;
815
816 token.data = buf->pvBuffer;
817 token.length = (UINT)len;
818 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
819 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
820 ret = TRUE;
821
822cleanup:
823 WinPrAsn1Encoder_Free(&enc);
824 return ret;
825}
826
827WINPR_ATTR_NODISCARD
828static BOOL append(char* dst, size_t dstSize, const char* src)
829{
830 const size_t dlen = strnlen(dst, dstSize);
831 const size_t slen = strlen(src);
832 if (dlen + slen >= dstSize)
833 return FALSE;
834 if (!strncat(dst, src, dstSize - dlen))
835 return FALSE;
836 return TRUE;
837}
838
839WINPR_ATTR_NODISCARD
840static BOOL kerberos_rd_tgt_req_tag2(WinPrAsn1Decoder* dec, char* buf, size_t len)
841{
842 BOOL rc = FALSE;
843 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
844
845 /* server-name [2] PrincipalName (SEQUENCE) */
846 if (!WinPrAsn1DecReadSequence(dec, &seq))
847 goto end;
848
849 /* name-type [0] INTEGER */
850 {
851 BOOL error = FALSE;
852 {
853 WinPrAsn1_INTEGER val = 0;
854 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
855 goto end;
856 }
857
858 /* name-string [1] SEQUENCE OF GeneralString */
859 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
860 goto end;
861 }
862
863 {
864 WinPrAsn1_tag tag = 0;
865 BOOL first = TRUE;
866 while (WinPrAsn1DecPeekTag(dec, &tag))
867 {
868 BOOL success = FALSE;
869 char* lstr = nullptr;
870 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
871 goto fail;
872
873 if (!first)
874 {
875 if (!append(buf, len, "/"))
876 goto fail;
877 }
878 first = FALSE;
879
880 if (!append(buf, len, lstr))
881 goto fail;
882
883 success = TRUE;
884 fail:
885 free(lstr);
886 if (!success)
887 goto end;
888 }
889 }
890
891 rc = TRUE;
892end:
893 return rc;
894}
895
896WINPR_ATTR_NODISCARD
897static BOOL kerberos_rd_tgt_req_tag3(WinPrAsn1Decoder* dec, char* buf, size_t len)
898{
899 /* realm [3] Realm */
900 BOOL rc = FALSE;
901 WinPrAsn1_STRING str = nullptr;
902 if (!WinPrAsn1DecReadGeneralString(dec, &str))
903 goto end;
904
905 if (!append(buf, len, "@"))
906 goto end;
907 if (!append(buf, len, str))
908 goto end;
909
910 rc = TRUE;
911end:
912 free(str);
913 return rc;
914}
915
916WINPR_ATTR_NODISCARD
917static BOOL kerberos_rd_tgt_req(WinPrAsn1Decoder* dec, char** target)
918{
919 BOOL rc = FALSE;
920
921 if (!target)
922 return FALSE;
923 *target = nullptr;
924
925 wStream s = WinPrAsn1DecGetStream(dec);
926 const size_t len = Stream_Length(&s);
927 if (len == 0)
928 return TRUE;
929
930 WinPrAsn1Decoder dec2 = WinPrAsn1Decoder_init();
931 WinPrAsn1_tagId tag = 0;
932 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
933 return FALSE;
934
935 char* buf = calloc(len + 1, sizeof(char));
936 if (!buf)
937 return FALSE;
938
939 /* We expect ASN1 context tag values 2 or 3.
940 *
941 * In case we got value 2 an (optional) context tag value 3 might follow.
942 */
943 BOOL checkForTag3 = TRUE;
944 if (tag == 2)
945 {
946 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
947 if (rc)
948 {
949 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
950 if (res == 0)
951 checkForTag3 = FALSE;
952 }
953 }
954
955 if (checkForTag3)
956 {
957 if (tag == 3)
958 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
959 else
960 rc = FALSE;
961 }
962
963 if (rc)
964 *target = buf;
965 else
966 free(buf);
967 return rc;
968}
969
970WINPR_ATTR_NODISCARD
971static BOOL kerberos_rd_tgt_rep(WinPrAsn1Decoder* dec, krb5_data* ticket)
972{
973 if (!ticket)
974 return FALSE;
975
976 /* ticket [2] Ticket */
977 WinPrAsn1Decoder asnTicket = WinPrAsn1Decoder_init();
978 WinPrAsn1_tagId tag = 0;
979 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
980 return FALSE;
981
982 if (tag != 2)
983 return FALSE;
984
985 wStream s = WinPrAsn1DecGetStream(&asnTicket);
986 ticket->data = Stream_BufferAs(&s, char);
987
988 const size_t len = Stream_Length(&s);
989 if (len > UINT32_MAX)
990 return FALSE;
991 ticket->length = (UINT32)len;
992 return TRUE;
993}
994
995WINPR_ATTR_NODISCARD
996static BOOL kerberos_rd_tgt_token(const sspi_gss_data* token, char** target, krb5_data* ticket)
997{
998 BOOL error = 0;
999 WinPrAsn1_INTEGER val = 0;
1000
1001 WINPR_ASSERT(token);
1002
1003 if (target)
1004 *target = nullptr;
1005
1006 WinPrAsn1Decoder der = WinPrAsn1Decoder_init();
1007 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
1008
1009 /* KERB-TGT-REQUEST (SEQUENCE) */
1010 WinPrAsn1Decoder seq = WinPrAsn1Decoder_init();
1011 if (!WinPrAsn1DecReadSequence(&der, &seq))
1012 return FALSE;
1013
1014 /* pvno [0] INTEGER */
1015 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
1016 return FALSE;
1017
1018 /* msg-type [1] INTEGER */
1019 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
1020 return FALSE;
1021
1022 switch (val)
1023 {
1024 case KRB_TGT_REQ:
1025 return kerberos_rd_tgt_req(&seq, target);
1026 case KRB_TGT_REP:
1027 return kerberos_rd_tgt_rep(&seq, ticket);
1028 default:
1029 break;
1030 }
1031 return FALSE;
1032}
1033
1034WINPR_ATTR_NODISCARD
1035static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5, SEC_CHANNEL_BINDINGS* bindings)
1036{
1037 BYTE buf[4];
1038
1039 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
1040 if (!winpr_Digest_Update(md5, buf, 4))
1041 return FALSE;
1042
1043 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
1044 if (!winpr_Digest_Update(md5, buf, 4))
1045 return FALSE;
1046
1047 if (bindings->cbInitiatorLength &&
1048 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
1049 bindings->cbInitiatorLength))
1050 return FALSE;
1051
1052 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
1053 if (!winpr_Digest_Update(md5, buf, 4))
1054 return FALSE;
1055
1056 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
1057 if (!winpr_Digest_Update(md5, buf, 4))
1058 return FALSE;
1059
1060 if (bindings->cbAcceptorLength &&
1061 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
1062 bindings->cbAcceptorLength))
1063 return FALSE;
1064
1065 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
1066 if (!winpr_Digest_Update(md5, buf, 4))
1067 return FALSE;
1068
1069 if (bindings->cbApplicationDataLength &&
1070 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
1071 bindings->cbApplicationDataLength))
1072 return FALSE;
1073
1074 return TRUE;
1075}
1076
1077#endif /* WITH_KRB5 */
1078
1079WINPR_ATTR_NODISCARD
1080static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
1081 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1082 WINPR_ATTR_UNUSED SEC_CHAR* pszTargetName, WINPR_ATTR_UNUSED ULONG fContextReq,
1083 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1084 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG Reserved2,
1085 WINPR_ATTR_UNUSED PCtxtHandle phNewContext, WINPR_ATTR_UNUSED PSecBufferDesc pOutput,
1086 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED PTimeStamp ptsExpiry)
1087{
1088#ifdef WITH_KRB5
1089 PSecBuffer input_buffer = nullptr;
1090 PSecBuffer output_buffer = nullptr;
1091 PSecBuffer bindings_buffer = nullptr;
1092 WINPR_DIGEST_CTX* md5 = nullptr;
1093 char* target = nullptr;
1094 char* sname = nullptr;
1095 char* host = nullptr;
1096 krb5_data input_token = WINPR_C_ARRAY_INIT;
1097 krb5_data output_token = WINPR_C_ARRAY_INIT;
1098 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1099 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1100 uint16_t tok_id = 0;
1101 krb5_ap_rep_enc_part* reply = nullptr;
1102 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
1103 char cksum_contents[24] = WINPR_C_ARRAY_INIT;
1104 krb5_data cksum = WINPR_C_ARRAY_INIT;
1105 krb5_creds in_creds = WINPR_C_ARRAY_INIT;
1106 krb5_creds* creds = nullptr;
1107 BOOL isNewContext = FALSE;
1108 KRB_CONTEXT* context = nullptr;
1109 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1110
1111 /* behave like windows SSPIs that don't want empty context */
1112 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1113 return SEC_E_INVALID_HANDLE;
1114
1115 context = sspi_SecureHandleGetLowerPointer(phContext);
1116
1117 if (!credentials)
1118 return SEC_E_NO_CREDENTIALS;
1119
1120 if (pInput)
1121 {
1122 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1123 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
1124 }
1125 if (pOutput)
1126 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1127
1128 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
1129 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
1130
1131 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1132 ap_flags |= AP_OPTS_USE_SESSION_KEY;
1133
1134 /* Split target name into service/hostname components */
1135 if (pszTargetName)
1136 {
1137 target = _strdup(pszTargetName);
1138 if (!target)
1139 {
1140 status = SEC_E_INSUFFICIENT_MEMORY;
1141 goto cleanup;
1142 }
1143 host = strchr(target, '/');
1144 if (host)
1145 {
1146 *host++ = 0;
1147 sname = target;
1148 }
1149 else
1150 host = target;
1151 if (isValidIP(host))
1152 {
1153 status = SEC_E_NO_CREDENTIALS;
1154 goto cleanup;
1155 }
1156 }
1157
1158 if (!context)
1159 {
1160 context = kerberos_ContextNew(credentials);
1161 if (!context)
1162 {
1163 status = SEC_E_INSUFFICIENT_MEMORY;
1164 goto cleanup;
1165 }
1166
1167 isNewContext = TRUE;
1168
1169 if (host)
1170 context->targetHost = _strdup(host);
1171 if (!context->targetHost)
1172 {
1173 status = SEC_E_INSUFFICIENT_MEMORY;
1174 goto cleanup;
1175 }
1176
1177 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1178 {
1179 context->state = KERBEROS_STATE_TGT_REQ;
1180 context->u2u = TRUE;
1181 }
1182 else
1183 context->state = KERBEROS_STATE_AP_REQ;
1184 }
1185 else
1186 {
1187 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1188 goto bad_token;
1189 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1190 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1191 goto bad_token;
1192 }
1193
1194 /* SSPI flags are compatible with GSS flags except INTEG_FLAG */
1195 context->flags |= (fContextReq & 0x1F);
1196 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1197 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1198
1199 switch (context->state)
1200 {
1201 case KERBEROS_STATE_TGT_REQ:
1202
1203 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, nullptr))
1204 goto cleanup;
1205
1206 context->state = KERBEROS_STATE_TGT_REP;
1207 status = SEC_I_CONTINUE_NEEDED;
1208 break;
1209
1210 case KERBEROS_STATE_TGT_REP:
1211
1212 if (tok_id != TOK_ID_TGT_REP)
1213 goto bad_token;
1214
1215 if (!kerberos_rd_tgt_token(&input_token, nullptr, &in_creds.second_ticket))
1216 goto bad_token;
1217
1218 /* Continue to AP-REQ */
1219 /* fallthrough */
1220 WINPR_FALLTHROUGH
1221
1222 case KERBEROS_STATE_AP_REQ:
1223
1224 /* Set auth_context options */
1225 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1226 goto cleanup;
1227 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1228 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1229 goto cleanup;
1230 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1231 GSS_CHECKSUM_TYPE))
1232 goto cleanup;
1233
1234 /* Get a service ticket */
1235 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1236 KRB5_NT_SRV_HST, &in_creds.server))
1237 goto cleanup;
1238
1239 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1240 &in_creds.client))
1241 {
1242 status = SEC_E_WRONG_PRINCIPAL;
1243 goto cleanup;
1244 }
1245
1246 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1247 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1248 &creds))
1249 {
1250 status = SEC_E_NO_CREDENTIALS;
1251 goto cleanup;
1252 }
1253
1254 /* Write the checksum (delegation not implemented) */
1255 cksum.data = cksum_contents;
1256 cksum.length = sizeof(cksum_contents);
1257 winpr_Data_Write_UINT32(cksum_contents, 16);
1258 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1259
1260 if (bindings_buffer)
1261 {
1262 SEC_CHANNEL_BINDINGS* bindings = bindings_buffer->pvBuffer;
1263
1264 /* Sanity checks */
1265 if (bindings_buffer->cbBuffer < sizeof(SEC_CHANNEL_BINDINGS) ||
1266 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1267 bindings_buffer->cbBuffer ||
1268 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1269 bindings_buffer->cbBuffer ||
1270 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1271 bindings_buffer->cbBuffer)
1272 {
1273 status = SEC_E_BAD_BINDINGS;
1274 goto cleanup;
1275 }
1276
1277 md5 = winpr_Digest_New();
1278 if (!md5)
1279 goto cleanup;
1280
1281 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1282 goto cleanup;
1283
1284 if (!kerberos_hash_channel_bindings(md5, bindings))
1285 goto cleanup;
1286
1287 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1288 goto cleanup;
1289 }
1290
1291 /* Make the AP_REQ message */
1292 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1293 &cksum, creds, &output_token))
1294 goto cleanup;
1295
1296 if (!sspi_gss_wrap_token(output_buffer,
1297 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1298 TOK_ID_AP_REQ, &output_token))
1299 goto cleanup;
1300
1301 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1302 {
1303 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1304 context->auth_ctx, (INT32*)&context->local_seq))
1305 goto cleanup;
1306 context->remote_seq ^= context->local_seq;
1307 }
1308
1309 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1310 &context->keyset))
1311 goto cleanup;
1312
1313 context->state = KERBEROS_STATE_AP_REP;
1314
1315 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1316 status = SEC_I_CONTINUE_NEEDED;
1317 else
1318 status = SEC_E_OK;
1319 break;
1320
1321 case KERBEROS_STATE_AP_REP:
1322
1323 if (tok_id == TOK_ID_AP_REP)
1324 {
1325 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1326 &reply))
1327 goto cleanup;
1328 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1329 }
1330 else if (tok_id == TOK_ID_ERROR)
1331 {
1332 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1333 goto cleanup;
1334 }
1335 else
1336 goto bad_token;
1337
1338 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1339 {
1340 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1341 context->auth_ctx, (INT32*)&context->remote_seq))
1342 goto cleanup;
1343 }
1344
1345 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1346 &context->keyset))
1347 goto cleanup;
1348
1349 context->state = KERBEROS_STATE_FINAL;
1350
1351 if (output_buffer)
1352 output_buffer->cbBuffer = 0;
1353 status = SEC_E_OK;
1354 break;
1355
1356 case KERBEROS_STATE_FINAL:
1357 default:
1358 WLog_ERR(TAG, "Kerberos in invalid state!");
1359 goto cleanup;
1360 }
1361
1362cleanup:
1363{
1364 /* second_ticket is not allocated */
1365 krb5_data edata = WINPR_C_ARRAY_INIT;
1366 in_creds.second_ticket = edata;
1367 krb5_free_cred_contents(credentials->ctx, &in_creds);
1368}
1369
1370 krb5_free_creds(credentials->ctx, creds);
1371 if (output_token.data)
1372 krb5glue_free_data_contents(credentials->ctx, &output_token);
1373
1374 winpr_Digest_Free(md5);
1375
1376 free(target);
1377
1378 if (isNewContext)
1379 {
1380 switch (status)
1381 {
1382 case SEC_E_OK:
1383 case SEC_I_CONTINUE_NEEDED:
1384 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1385 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1386 break;
1387 default:
1388 kerberos_ContextFree(context, TRUE);
1389 sspi_SecureHandleInvalidate(phNewContext);
1390 break;
1391 }
1392 }
1393
1394 return status;
1395
1396bad_token:
1397 status = SEC_E_INVALID_TOKEN;
1398 goto cleanup;
1399#else
1400 return SEC_E_UNSUPPORTED_FUNCTION;
1401#endif /* WITH_KRB5 */
1402}
1403
1404WINPR_ATTR_NODISCARD
1405static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1406 PCredHandle phCredential, PCtxtHandle phContext, SEC_WCHAR* pszTargetName, ULONG fContextReq,
1407 ULONG Reserved1, ULONG TargetDataRep, PSecBufferDesc pInput, ULONG Reserved2,
1408 PCtxtHandle phNewContext, PSecBufferDesc pOutput, ULONG* pfContextAttr, PTimeStamp ptsExpiry)
1409{
1410 SECURITY_STATUS status = 0;
1411 char* target_name = nullptr;
1412
1413 if (pszTargetName)
1414 {
1415 target_name = ConvertWCharToUtf8Alloc(pszTargetName, nullptr);
1416 if (!target_name)
1417 return SEC_E_INSUFFICIENT_MEMORY;
1418 }
1419
1420 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1421 Reserved1, TargetDataRep, pInput, Reserved2,
1422 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1423
1424 if (target_name)
1425 free(target_name);
1426
1427 return status;
1428}
1429
1430#ifdef WITH_KRB5
1431WINPR_ATTR_NODISCARD
1432static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1433 krb5_creds* creds)
1434{
1435 BOOL ret = FALSE;
1436 krb5_kt_cursor cur = WINPR_C_ARRAY_INIT;
1437 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1438 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1439 goto cleanup;
1440
1441 do
1442 {
1443 krb5_error_code rv =
1444 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1445 if (rv == KRB5_KT_END)
1446 break;
1447 if (rv != 0)
1448 goto cleanup;
1449
1450 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1451 break;
1452 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1453 memset(&entry, 0, sizeof(entry));
1454 if (rv)
1455 goto cleanup;
1456 } while (1);
1457
1458 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1459 goto cleanup;
1460
1461 if (!entry.principal)
1462 goto cleanup;
1463
1464 /* Get the TGT */
1465 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1466 credentials->keytab, 0, nullptr, nullptr))
1467 goto cleanup;
1468
1469 ret = TRUE;
1470
1471cleanup:
1472 return ret;
1473}
1474
1475WINPR_ATTR_NODISCARD
1476static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials, const char* target, krb5_creds* creds)
1477{
1478 BOOL ret = TRUE;
1479 krb5_principal target_princ = WINPR_C_ARRAY_INIT;
1480 char* default_realm = nullptr;
1481
1482 krb5_error_code rv =
1483 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1484 if (rv)
1485 return FALSE;
1486
1487#if defined(WITH_KRB5_HEIMDAL)
1488 if (!target_princ->realm)
1489 {
1490 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1491 if (rv)
1492 goto out;
1493
1494 target_princ->realm = default_realm;
1495 }
1496#else
1497 if (!target_princ->realm.length)
1498 {
1499 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1500 if (rv)
1501 goto out;
1502
1503 const size_t len = strnlen(default_realm, MAX_KEYTAB_NAME_LEN + 1);
1504 if ((len == 0) || !default_realm)
1505 goto out;
1506 target_princ->realm.data = strndup(default_realm, len);
1507 if (!target_princ->realm.data)
1508 goto out;
1509 target_princ->realm.length = (unsigned int)len;
1510 }
1511#endif
1512
1513 /*
1514 * First try with the account service. We were requested with something like
1515 * TERMSRV/<host>@<realm>, let's see if we have that in our keytab and if we're able
1516 * to retrieve a TGT with that entry
1517 *
1518 */
1519 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1520 goto out;
1521
1522 ret = FALSE;
1523
1524#if defined(WITH_KRB5_MIT)
1525 /*
1526 * if it's not working let's try with <host>$@<REALM> (note the dollar)
1527 */
1528 {
1529 char hostDollar[300] = WINPR_C_ARRAY_INIT;
1530 if (target_princ->length < 2)
1531 goto out;
1532
1533 (void)snprintf(hostDollar, sizeof(hostDollar) - 1, "%s$@%s", target_princ->data[1].data,
1534 target_princ->realm.data);
1535 krb5_free_principal(credentials->ctx, target_princ);
1536
1537 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1538 if (rv)
1539 return FALSE;
1540 }
1541 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1542#endif
1543
1544out:
1545 if (default_realm)
1546 krb5_free_default_realm(credentials->ctx, default_realm);
1547
1548 krb5_free_principal(credentials->ctx, target_princ);
1549 return ret;
1550}
1551#endif
1552
1553WINPR_ATTR_NODISCARD
1554static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1555 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED PCtxtHandle phContext,
1556 WINPR_ATTR_UNUSED PSecBufferDesc pInput, WINPR_ATTR_UNUSED ULONG fContextReq,
1557 WINPR_ATTR_UNUSED ULONG TargetDataRep, WINPR_ATTR_UNUSED PCtxtHandle phNewContext,
1558 WINPR_ATTR_UNUSED PSecBufferDesc pOutput, WINPR_ATTR_UNUSED ULONG* pfContextAttr,
1559 WINPR_ATTR_UNUSED PTimeStamp ptsExpity)
1560{
1561#ifdef WITH_KRB5
1562 BOOL isNewContext = FALSE;
1563 PSecBuffer input_buffer = nullptr;
1564 PSecBuffer output_buffer = nullptr;
1565 WinPrAsn1_OID oid = WINPR_C_ARRAY_INIT;
1566 uint16_t tok_id = 0;
1567 krb5_data input_token = WINPR_C_ARRAY_INIT;
1568 krb5_data output_token = WINPR_C_ARRAY_INIT;
1569 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1570 krb5_flags ap_flags = 0;
1571 krb5glue_authenticator authenticator = nullptr;
1572 char* target = nullptr;
1573 krb5_keytab_entry entry = WINPR_C_ARRAY_INIT;
1574 krb5_creds creds = WINPR_C_ARRAY_INIT;
1575
1576 /* behave like windows SSPIs that don't want empty context */
1577 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1578 return SEC_E_INVALID_HANDLE;
1579
1580 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1581 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1582
1583 if (pInput)
1584 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1585 if (pOutput)
1586 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1587
1588 if (!input_buffer)
1589 return SEC_E_INVALID_TOKEN;
1590
1591 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1592 return SEC_E_INVALID_TOKEN;
1593
1594 if (!context)
1595 {
1596 isNewContext = TRUE;
1597 context = kerberos_ContextNew(credentials);
1598 context->acceptor = TRUE;
1599
1600 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1601 {
1602 context->u2u = TRUE;
1603 context->state = KERBEROS_STATE_TGT_REQ;
1604 }
1605 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1606 context->state = KERBEROS_STATE_AP_REQ;
1607 else
1608 goto bad_token;
1609 }
1610 else
1611 {
1612 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1613 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1614 goto bad_token;
1615 }
1616
1617 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1618 {
1619 if (!kerberos_rd_tgt_token(&input_token, &target, nullptr))
1620 goto bad_token;
1621
1622 if (!retrieveSomeTgt(credentials, target, &creds))
1623 goto cleanup;
1624
1625 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, nullptr, nullptr, &creds.ticket))
1626 goto cleanup;
1627
1628 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1629 goto cleanup;
1630
1631 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1632 &krb5glue_creds_getkey(creds)))
1633 goto cleanup;
1634
1635 context->state = KERBEROS_STATE_AP_REQ;
1636 }
1637 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1638 {
1639 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, nullptr,
1640 credentials->keytab, &ap_flags, nullptr))
1641 goto cleanup;
1642
1643 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1644 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1645 goto cleanup;
1646
1647 /* Retrieve and validate the checksum */
1648 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1649 &authenticator))
1650 goto cleanup;
1651 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1652 &context->flags))
1653 goto bad_token;
1654
1655 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1656 {
1657 if (!output_buffer)
1658 goto bad_token;
1659 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1660 goto cleanup;
1661 if (!sspi_gss_wrap_token(output_buffer,
1662 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1663 TOK_ID_AP_REP, &output_token))
1664 goto cleanup;
1665 }
1666 else
1667 {
1668 if (output_buffer)
1669 output_buffer->cbBuffer = 0;
1670 }
1671
1672 *pfContextAttr = (context->flags & 0x1F);
1673 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1674 *pfContextAttr |= ASC_RET_INTEGRITY;
1675
1676 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1677 {
1678 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1679 (INT32*)&context->local_seq))
1680 goto cleanup;
1681 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1682 (INT32*)&context->remote_seq))
1683 goto cleanup;
1684 }
1685
1686 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1687 &context->keyset))
1688 goto cleanup;
1689
1690 context->state = KERBEROS_STATE_FINAL;
1691 }
1692 else
1693 goto bad_token;
1694
1695 /* On first call allocate new context */
1696 if (context->state == KERBEROS_STATE_FINAL)
1697 status = SEC_E_OK;
1698 else
1699 status = SEC_I_CONTINUE_NEEDED;
1700
1701cleanup:
1702 free(target);
1703 if (output_token.data)
1704 krb5glue_free_data_contents(credentials->ctx, &output_token);
1705 if (entry.principal)
1706 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1707
1708 if (isNewContext)
1709 {
1710 switch (status)
1711 {
1712 case SEC_E_OK:
1713 case SEC_I_CONTINUE_NEEDED:
1714 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1715 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1716 break;
1717 default:
1718 kerberos_ContextFree(context, TRUE);
1719 sspi_SecureHandleInvalidate(phNewContext);
1720 break;
1721 }
1722 }
1723
1724 return status;
1725
1726bad_token:
1727 status = SEC_E_INVALID_TOKEN;
1728 goto cleanup;
1729#else
1730 return SEC_E_UNSUPPORTED_FUNCTION;
1731#endif /* WITH_KRB5 */
1732}
1733
1734#ifdef WITH_KRB5
1735WINPR_ATTR_NODISCARD
1736static KRB_CONTEXT* get_context(PCtxtHandle phContext)
1737{
1738 if (!phContext)
1739 return nullptr;
1740
1741 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1742 if (!name)
1743 return nullptr;
1744
1745 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1746 return nullptr;
1747 return sspi_SecureHandleGetLowerPointer(phContext);
1748}
1749
1750WINPR_ATTR_NODISCARD
1751static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1752{
1753 WINPR_ASSERT(data);
1754 WINPR_ASSERT(ptr);
1755 WINPR_ASSERT(psize);
1756
1757 *ptr = (PUCHAR)malloc(data->length);
1758 if (!*ptr)
1759 return FALSE;
1760
1761 *psize = data->length;
1762 memcpy(*ptr, data->data, data->length);
1763 return TRUE;
1764}
1765#endif
1766
1767WINPR_ATTR_NODISCARD
1768static SECURITY_STATUS
1769 SEC_ENTRY kerberos_DeleteSecurityContext(WINPR_ATTR_UNUSED PCtxtHandle phContext)
1770{
1771#ifdef WITH_KRB5
1772 KRB_CONTEXT* context = get_context(phContext);
1773 sspi_SecureHandleInvalidate(phContext);
1774 if (!context)
1775 return SEC_E_INVALID_HANDLE;
1776
1777 kerberos_ContextFree(context, TRUE);
1778
1779 return SEC_E_OK;
1780#else
1781 return SEC_E_UNSUPPORTED_FUNCTION;
1782#endif
1783}
1784
1785#ifdef WITH_KRB5
1786
1787WINPR_ATTR_NODISCARD
1788static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1789{
1790 switch (code)
1791 {
1792 case 0:
1793 return SEC_E_OK;
1794 default:
1795 return SEC_E_INTERNAL_ERROR;
1796 }
1797}
1798
1799WINPR_ATTR_NODISCARD
1800static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1801 SecPkgContext_Sizes* ContextSizes)
1802{
1803 UINT header = 0;
1804 UINT pad = 0;
1805 UINT trailer = 0;
1806 krb5glue_key key = nullptr;
1807
1808 WINPR_ASSERT(context);
1809 WINPR_ASSERT(context->auth_ctx);
1810
1811 /* The MaxTokenSize by default is 12,000 bytes. This has been the default value
1812 * since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2.
1813 * For Windows Server 2012, the default value of the MaxTokenSize registry
1814 * entry is 48,000 bytes.*/
1815 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1816 ContextSizes->cbMaxSignature = 0;
1817 ContextSizes->cbBlockSize = 1;
1818 ContextSizes->cbSecurityTrailer = 0;
1819
1820 key = get_key(&context->keyset);
1821
1822 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1823 {
1824 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1825 KRB5_CRYPTO_TYPE_HEADER, &header);
1826 if (rv)
1827 return krb5_error_to_SECURITY_STATUS(rv);
1828
1829 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1830 &pad);
1831 if (rv)
1832 return krb5_error_to_SECURITY_STATUS(rv);
1833
1834 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1835 &trailer);
1836 if (rv)
1837 return krb5_error_to_SECURITY_STATUS(rv);
1838
1839 /* GSS header (= 16 bytes) + encrypted header = 32 bytes */
1840 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1841 }
1842
1843 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1844 {
1845 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1846 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1847 if (rv)
1848 return krb5_error_to_SECURITY_STATUS(rv);
1849
1850 ContextSizes->cbMaxSignature += 16;
1851 }
1852
1853 return SEC_E_OK;
1854}
1855
1856WINPR_ATTR_NODISCARD
1857static SECURITY_STATUS kerberos_ATTR_AUTH_IDENTITY(KRB_CONTEXT* context,
1858 KRB_CREDENTIALS* credentials,
1859 SecPkgContext_AuthIdentity* AuthIdentity)
1860{
1861 const SecPkgContext_AuthIdentity empty = WINPR_C_ARRAY_INIT;
1862
1863 WINPR_ASSERT(context);
1864 WINPR_ASSERT(context->auth_ctx);
1865 WINPR_ASSERT(credentials);
1866
1867 WINPR_ASSERT(AuthIdentity);
1868 *AuthIdentity = empty;
1869
1870 krb5glue_authenticator authenticator = nullptr;
1871 krb5_error_code rv = krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx,
1872 context->auth_ctx, &authenticator);
1873 if (rv)
1874 goto fail;
1875
1876 {
1877 rv = -1;
1878
1879#if defined(WITH_KRB5_HEIMDAL)
1880 const Realm data = authenticator->crealm;
1881 if (!data)
1882 goto fail;
1883 const size_t data_len = length_Realm(&data);
1884#else
1885 krb5_data* realm_data = krb5_princ_realm(credentials->ctx, authenticator->client);
1886 if (!realm_data)
1887 goto fail;
1888 const char* data = realm_data->data;
1889 if (!data)
1890 goto fail;
1891 const size_t data_len = realm_data->length;
1892#endif
1893
1894 if (data_len > (sizeof(AuthIdentity->Domain) - 1))
1895 goto fail;
1896 strncpy(AuthIdentity->Domain, data, data_len);
1897 }
1898
1899 {
1900#if defined(WITH_KRB5_HEIMDAL)
1901 const PrincipalName* principal = &authenticator->cname;
1902 const size_t name_length = length_PrincipalName(principal);
1903 if (!principal->name_string.val)
1904 goto fail;
1905 const char* name = *principal->name_string.val;
1906#else
1907 char* name = nullptr;
1908 rv = krb_log_exec(krb5_unparse_name_flags, credentials->ctx, authenticator->client,
1909 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
1910 if (rv)
1911 goto fail;
1912
1913 const size_t name_length = strlen(name);
1914#endif
1915
1916 const bool ok = (name_length <= (sizeof(AuthIdentity->User) - 1));
1917 if (ok)
1918 strncpy(AuthIdentity->User, name, name_length);
1919
1920 rv = ok ? 0 : -1;
1921
1922#if !defined(WITH_KRB5_HEIMDAL)
1923 krb5_free_unparsed_name(credentials->ctx, name);
1924#endif
1925 }
1926
1927fail:
1928 krb5glue_free_authenticator(credentials->ctx, authenticator);
1929 return krb5_error_to_SECURITY_STATUS(rv);
1930}
1931
1932WINPR_ATTR_NODISCARD
1933static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_A(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1934 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1935 SecPkgContext_PackageInfoA* PackageInfo)
1936{
1937 size_t size = sizeof(SecPkgInfoA);
1938 SecPkgInfoA* pPackageInfo =
1939 (SecPkgInfoA*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1940
1941 if (!pPackageInfo)
1942 return SEC_E_INSUFFICIENT_MEMORY;
1943
1944 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoA.fCapabilities;
1945 pPackageInfo->wVersion = KERBEROS_SecPkgInfoA.wVersion;
1946 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoA.wRPCID;
1947 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1948 pPackageInfo->Name = _strdup(KERBEROS_SecPkgInfoA.Name);
1949 pPackageInfo->Comment = _strdup(KERBEROS_SecPkgInfoA.Comment);
1950
1951 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1952 {
1953 sspi_ContextBufferFree(pPackageInfo);
1954 return SEC_E_INSUFFICIENT_MEMORY;
1955 }
1956 PackageInfo->PackageInfo = pPackageInfo;
1957 return SEC_E_OK;
1958}
1959
1960WINPR_ATTR_NODISCARD
1961static SECURITY_STATUS kerberos_ATTR_PACKAGE_INFO_W(WINPR_ATTR_UNUSED KRB_CONTEXT* context,
1962 WINPR_ATTR_UNUSED KRB_CREDENTIALS* credentials,
1963 SecPkgContext_PackageInfoW* PackageInfo)
1964{
1965 size_t size = sizeof(SecPkgInfoW);
1966 SecPkgInfoW* pPackageInfo =
1967 (SecPkgInfoW*)sspi_ContextBufferAlloc(QuerySecurityPackageInfoIndex, size);
1968
1969 if (!pPackageInfo)
1970 return SEC_E_INSUFFICIENT_MEMORY;
1971
1972 pPackageInfo->fCapabilities = KERBEROS_SecPkgInfoW.fCapabilities;
1973 pPackageInfo->wVersion = KERBEROS_SecPkgInfoW.wVersion;
1974 pPackageInfo->wRPCID = KERBEROS_SecPkgInfoW.wRPCID;
1975 pPackageInfo->cbMaxToken = KERBEROS_SecPkgInfoW.cbMaxToken;
1976 pPackageInfo->Name = _wcsdup(KERBEROS_SecPkgInfoW.Name);
1977 pPackageInfo->Comment = _wcsdup(KERBEROS_SecPkgInfoW.Comment);
1978
1979 if (!pPackageInfo->Name || !pPackageInfo->Comment)
1980 {
1981 sspi_ContextBufferFree(pPackageInfo);
1982 return SEC_E_INSUFFICIENT_MEMORY;
1983 }
1984 PackageInfo->PackageInfo = pPackageInfo;
1985 return SEC_E_OK;
1986}
1987
1988WINPR_ATTR_NODISCARD
1989static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
1990 KRB_CREDENTIALS* credentials,
1991 KERB_TICKET_LOGON* ticketLogon)
1992{
1993 krb5_creds matchCred = WINPR_C_ARRAY_INIT;
1994 krb5_auth_context authContext = nullptr;
1995 krb5_flags getCredsFlags = KRB5_GC_CACHED;
1996 BOOL firstRun = TRUE;
1997 krb5_creds* hostCred = nullptr;
1998 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
1999 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost, "HOST",
2000 KRB5_NT_SRV_HST, &matchCred.server);
2001 if (rv)
2002 goto out;
2003
2004 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
2005 &matchCred.client);
2006 if (rv)
2007 goto out;
2008
2009 /* try from the cache first, and then do a new request */
2010again:
2011 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
2012 &matchCred, &hostCred);
2013 switch (rv)
2014 {
2015 case 0:
2016 break;
2017 case KRB5_CC_NOTFOUND:
2018 getCredsFlags = 0;
2019 if (firstRun)
2020 {
2021 firstRun = FALSE;
2022 goto again;
2023 }
2024 WINPR_FALLTHROUGH
2025 default:
2026 WLog_ERR(TAG, "krb5_get_credentials(hostCreds), rv=%d", rv);
2027 goto out;
2028 }
2029
2030 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
2031 goto out;
2032
2033 {
2034 krb5_data derOut = WINPR_C_ARRAY_INIT;
2035 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
2036 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
2037 {
2038 ret = SEC_E_LOGON_DENIED;
2039 goto out;
2040 }
2041
2042 ticketLogon->MessageType = KerbTicketLogon;
2043 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
2044
2045 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
2046 &ticketLogon->ServiceTicketLength))
2047 {
2048 krb5_free_data(credentials->ctx, &derOut);
2049 goto out;
2050 }
2051
2052 ticketLogon->TicketGrantingTicketLength = derOut.length;
2053 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
2054 }
2055
2056 ret = SEC_E_OK;
2057out:
2058 krb5_auth_con_free(credentials->ctx, authContext);
2059 krb5_free_creds(credentials->ctx, hostCred);
2060 krb5_free_cred_contents(credentials->ctx, &matchCred);
2061 return ret;
2062}
2063
2064#endif /* WITH_KRB5 */
2065
2066WINPR_ATTR_NODISCARD
2067static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesCommon(
2068 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2069{
2070 if (!phContext)
2071 return SEC_E_INVALID_HANDLE;
2072
2073 if (!pBuffer)
2074 return SEC_E_INVALID_PARAMETER;
2075
2076#ifdef WITH_KRB5
2077 KRB_CONTEXT* context = get_context(phContext);
2078 if (!context)
2079 return SEC_E_INVALID_PARAMETER;
2080
2081 KRB_CREDENTIALS* credentials = context->credentials;
2082
2083 switch (ulAttribute)
2084 {
2085 case SECPKG_ATTR_SIZES:
2086 return kerberos_ATTR_SIZES(context, credentials, (SecPkgContext_Sizes*)pBuffer);
2087
2088 case SECPKG_ATTR_AUTH_IDENTITY:
2089 return kerberos_ATTR_AUTH_IDENTITY(context, credentials,
2090 (SecPkgContext_AuthIdentity*)pBuffer);
2091
2092 case SECPKG_CRED_ATTR_TICKET_LOGON:
2093 return kerberos_ATTR_TICKET_LOGON(context, credentials, (KERB_TICKET_LOGON*)pBuffer);
2094
2095 default:
2096 WLog_ERR(TAG, "TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
2097 ulAttribute);
2098 return SEC_E_UNSUPPORTED_FUNCTION;
2099 }
2100#else
2101 return SEC_E_UNSUPPORTED_FUNCTION;
2102#endif
2103}
2104
2105WINPR_ATTR_NODISCARD
2106static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(
2107 PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute, void* pBuffer)
2108{
2109 if (!phContext)
2110 return SEC_E_INVALID_HANDLE;
2111
2112 if (!pBuffer)
2113 return SEC_E_INVALID_PARAMETER;
2114
2115#ifdef WITH_KRB5
2116 KRB_CONTEXT* context = get_context(phContext);
2117 if (!context)
2118 return SEC_E_INVALID_PARAMETER;
2119
2120 KRB_CREDENTIALS* credentials = context->credentials;
2121
2122 switch (ulAttribute)
2123 {
2124 case SECPKG_ATTR_PACKAGE_INFO:
2125 return kerberos_ATTR_PACKAGE_INFO_A(context, credentials,
2126 (SecPkgContext_PackageInfoA*)pBuffer);
2127 default:
2128 break;
2129 }
2130#endif
2131 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2132}
2133
2134WINPR_ATTR_NODISCARD
2135static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(PCtxtHandle phContext,
2136 ULONG ulAttribute, void* pBuffer)
2137{
2138 if (!phContext)
2139 return SEC_E_INVALID_HANDLE;
2140
2141 if (!pBuffer)
2142 return SEC_E_INVALID_PARAMETER;
2143
2144#ifdef WITH_KRB5
2145 KRB_CONTEXT* context = get_context(phContext);
2146 if (!context)
2147 return SEC_E_INVALID_PARAMETER;
2148
2149 KRB_CREDENTIALS* credentials = context->credentials;
2150
2151 switch (ulAttribute)
2152 {
2153 case SECPKG_ATTR_PACKAGE_INFO:
2154 return kerberos_ATTR_PACKAGE_INFO_W(context, credentials,
2155 (SecPkgContext_PackageInfoW*)pBuffer);
2156 default:
2157 break;
2158 }
2159#endif
2160 return kerberos_QueryContextAttributesCommon(phContext, ulAttribute, pBuffer);
2161}
2162
2163WINPR_ATTR_NODISCARD
2164static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
2165 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2166 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2167{
2168 return SEC_E_UNSUPPORTED_FUNCTION;
2169}
2170
2171WINPR_ATTR_NODISCARD
2172static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
2173 WINPR_ATTR_UNUSED PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
2174 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
2175{
2176 return SEC_E_UNSUPPORTED_FUNCTION;
2177}
2178
2179WINPR_ATTR_NODISCARD
2180static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(
2181 WINPR_ATTR_UNUSED PCredHandle phCredential, WINPR_ATTR_UNUSED ULONG ulAttribute,
2182 WINPR_ATTR_UNUSED void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer,
2183 WINPR_ATTR_UNUSED BOOL unicode)
2184{
2185#ifdef WITH_KRB5
2186 KRB_CREDENTIALS* credentials = nullptr;
2187
2188 if (!phCredential)
2189 return SEC_E_INVALID_HANDLE;
2190
2191 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
2192
2193 if (!credentials)
2194 return SEC_E_INVALID_HANDLE;
2195
2196 if (!pBuffer)
2197 return SEC_E_INSUFFICIENT_MEMORY;
2198
2199 switch (ulAttribute)
2200 {
2201 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
2202 {
2203 SecPkgCredentials_KdcProxySettingsW* kdc_settings = pBuffer;
2204
2205 /* Sanity checks */
2206 if (cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2207 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
2208 kdc_settings->ProxyServerOffset < sizeof(SecPkgCredentials_KdcProxySettingsW) ||
2209 cbBuffer < sizeof(SecPkgCredentials_KdcProxySettingsW) +
2210 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
2211 return SEC_E_INVALID_TOKEN;
2212
2213 if (credentials->kdc_url)
2214 {
2215 free(credentials->kdc_url);
2216 credentials->kdc_url = nullptr;
2217 }
2218
2219 if (kdc_settings->ProxyServerLength > 0)
2220 {
2221 WCHAR* proxy = WINPR_PACKED_ALIGN_CAST(
2222 WCHAR*, ((BYTE*)pBuffer + kdc_settings->ProxyServerOffset));
2223
2224 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
2225 proxy, kdc_settings->ProxyServerLength / sizeof(WCHAR), nullptr);
2226 if (!credentials->kdc_url)
2227 return SEC_E_INSUFFICIENT_MEMORY;
2228 }
2229
2230 return SEC_E_OK;
2231 }
2232 case SECPKG_CRED_ATTR_NAMES:
2233 case SECPKG_ATTR_SUPPORTED_ALGS:
2234 default:
2235 WLog_ERR(TAG, "TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
2236 ulAttribute);
2237 return SEC_E_UNSUPPORTED_FUNCTION;
2238 }
2239
2240#else
2241 return SEC_E_UNSUPPORTED_FUNCTION;
2242#endif
2243}
2244
2245WINPR_ATTR_NODISCARD
2246static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(PCredHandle phCredential,
2247 ULONG ulAttribute,
2248 void* pBuffer, ULONG cbBuffer)
2249{
2250 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
2251}
2252
2253WINPR_ATTR_NODISCARD
2254static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(PCredHandle phCredential,
2255 ULONG ulAttribute,
2256 void* pBuffer, ULONG cbBuffer)
2257{
2258 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
2259}
2260
2261WINPR_ATTR_NODISCARD
2262static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2263 WINPR_ATTR_UNUSED ULONG fQOP,
2264 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2265 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2266{
2267#ifdef WITH_KRB5
2268 KRB_CONTEXT* context = get_context(phContext);
2269 PSecBuffer sig_buffer = nullptr;
2270 PSecBuffer data_buffer = nullptr;
2271 char* header = nullptr;
2272 BYTE flags = 0;
2273 krb5glue_key key = nullptr;
2274 krb5_keyusage usage = 0;
2275 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2276 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2277 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2278 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2279 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2280
2281 if (!context)
2282 return SEC_E_INVALID_HANDLE;
2283
2284 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2285 return SEC_E_UNSUPPORTED_FUNCTION;
2286
2287 KRB_CREDENTIALS* creds = context->credentials;
2288
2289 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2290 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2291
2292 if (!sig_buffer || !data_buffer)
2293 return SEC_E_INVALID_TOKEN;
2294
2295 if (fQOP)
2296 return SEC_E_QOP_NOT_SUPPORTED;
2297
2298 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2299 flags |= FLAG_WRAP_CONFIDENTIAL;
2300
2301 key = get_key(&context->keyset);
2302 if (!key)
2303 return SEC_E_INTERNAL_ERROR;
2304
2305 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2306
2307 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
2308
2309 /* Set the lengths of the data (plaintext + header) */
2310 encrypt_iov[1].data.length = data_buffer->cbBuffer;
2311 encrypt_iov[2].data.length = 16;
2312
2313 /* Get the lengths of the header, trailer, and padding and ensure sig_buffer is large enough */
2314 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
2315 ARRAYSIZE(encrypt_iov)))
2316 return SEC_E_INTERNAL_ERROR;
2317 if (sig_buffer->cbBuffer <
2318 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
2319 return SEC_E_INSUFFICIENT_MEMORY;
2320
2321 /* Set up the iov array in sig_buffer */
2322 header = sig_buffer->pvBuffer;
2323 encrypt_iov[2].data.data = header + 16;
2324 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
2325 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
2326 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
2327 encrypt_iov[1].data.data = data_buffer->pvBuffer;
2328
2329 /* Write the GSS header with 0 in RRC */
2330 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
2331 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2332 header[3] = (char)0xFF;
2333 winpr_Data_Write_UINT32(header + 4, 0);
2334 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2335
2336 /* Copy header to be encrypted */
2337 CopyMemory(encrypt_iov[2].data.data, header, 16);
2338
2339 /* Set the correct RRC */
2340 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
2341 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
2342
2343 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
2344 ARRAYSIZE(encrypt_iov)))
2345 return SEC_E_INTERNAL_ERROR;
2346
2347 return SEC_E_OK;
2348#else
2349 return SEC_E_UNSUPPORTED_FUNCTION;
2350#endif
2351}
2352
2353WINPR_ATTR_NODISCARD
2354static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2355 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2356 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2357 WINPR_ATTR_UNUSED ULONG* pfQOP)
2358{
2359#ifdef WITH_KRB5
2360 KRB_CONTEXT* context = get_context(phContext);
2361 if (!context)
2362 return SEC_E_INVALID_HANDLE;
2363
2364 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2365 return SEC_E_UNSUPPORTED_FUNCTION;
2366
2367 KRB_CREDENTIALS* creds = context->credentials;
2368
2369 const PSecBuffer sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2370 PSecBuffer data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2371
2372 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2373 return SEC_E_INVALID_TOKEN;
2374
2375 /* Read in header information */
2376 const BYTE* header = sig_buffer->pvBuffer;
2377 const uint16_t tok_id = winpr_Data_Get_UINT16_BE(header);
2378 const BYTE flags = header[2];
2379 const uint16_t ec = winpr_Data_Get_UINT16_BE(&header[4]);
2380 const uint16_t rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2381 const uint64_t seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2382
2383 /* Check that the header is valid */
2384 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2385 return SEC_E_INVALID_TOKEN;
2386
2387 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2388 return SEC_E_INVALID_TOKEN;
2389
2390 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2391 (seq_no != context->remote_seq + MessageSeqNo))
2392 return SEC_E_OUT_OF_SEQUENCE;
2393
2394 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2395 return SEC_E_INVALID_TOKEN;
2396
2397 /* We don't expect a trailer buffer; the encrypted header must be rotated */
2398 if (rrc < 16)
2399 return SEC_E_INVALID_TOKEN;
2400
2401 /* Find the proper key and key usage */
2402 krb5glue_key key = get_key(&context->keyset);
2403 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2404 return SEC_E_INTERNAL_ERROR;
2405 krb5_keyusage usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2406
2407 /* Fill in the lengths of the iov array */
2408 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
2409 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2410 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2411 { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
2412 { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
2413 iov[1].data.length = data_buffer->cbBuffer;
2414 iov[2].data.length = 16;
2415 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2416 return SEC_E_INTERNAL_ERROR;
2417
2418 /* We don't expect a trailer buffer; everything must be in sig_buffer */
2419 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2420 return SEC_E_INVALID_TOKEN;
2421 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2422 return SEC_E_INVALID_TOKEN;
2423
2424 /* Locate the parts of the message */
2425 const size_t iov0Offset = 16ull + rrc + ec;
2426 if (iov0Offset + iov[0].data.length > sig_buffer->cbBuffer)
2427 return SEC_E_INVALID_TOKEN;
2428
2429 const size_t iov2Offset = 16ull + ec;
2430 if (iov2Offset + iov[2].data.length > sig_buffer->cbBuffer)
2431 return SEC_E_INVALID_TOKEN;
2432
2433 iov[0].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov0Offset], char*);
2434 iov[1].data.data = data_buffer->pvBuffer;
2435 iov[2].data.data = WINPR_CAST_CONST_PTR_AWAY(&header[iov2Offset], char*);
2436 char* data2 = iov[2].data.data;
2437 iov[3].data.data = &data2[iov[2].data.length];
2438
2439 char* data3 = iov[3].data.data;
2440 iov[4].data.data = &data3[iov[3].data.length];
2441
2442 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2443 return SEC_E_INTERNAL_ERROR;
2444
2445 /* Validate the encrypted header */
2446 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2447 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2448 if (memcmp(iov[2].data.data, header, 16) != 0)
2449 return SEC_E_MESSAGE_ALTERED;
2450
2451 *pfQOP = 0;
2452
2453 return SEC_E_OK;
2454#else
2455 return SEC_E_UNSUPPORTED_FUNCTION;
2456#endif
2457}
2458
2459WINPR_ATTR_NODISCARD
2460static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2461 WINPR_ATTR_UNUSED ULONG fQOP,
2462 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2463 WINPR_ATTR_UNUSED ULONG MessageSeqNo)
2464{
2465#ifdef WITH_KRB5
2466 KRB_CONTEXT* context = get_context(phContext);
2467 PSecBuffer sig_buffer = nullptr;
2468 PSecBuffer data_buffer = nullptr;
2469 krb5glue_key key = nullptr;
2470 krb5_keyusage usage = 0;
2471 BYTE flags = 0;
2472 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2473 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2474 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2475
2476 if (!context)
2477 return SEC_E_INVALID_HANDLE;
2478
2479 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2480 return SEC_E_UNSUPPORTED_FUNCTION;
2481
2482 KRB_CREDENTIALS* creds = context->credentials;
2483
2484 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2485 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2486
2487 if (!sig_buffer || !data_buffer)
2488 return SEC_E_INVALID_TOKEN;
2489
2490 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2491
2492 key = get_key(&context->keyset);
2493 if (!key)
2494 return SEC_E_INTERNAL_ERROR;
2495 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2496
2497 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2498
2499 /* Fill in the lengths of the iov array */
2500 iov[0].data.length = data_buffer->cbBuffer;
2501 iov[1].data.length = 16;
2502 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2503 return SEC_E_INTERNAL_ERROR;
2504
2505 /* Ensure the buffer is big enough */
2506 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2507 return SEC_E_INSUFFICIENT_MEMORY;
2508
2509 /* Write the header */
2510 char* header = sig_buffer->pvBuffer;
2511 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2512 header[2] = WINPR_ASSERTING_INT_CAST(char, flags);
2513 memset(header + 3, 0xFF, 5);
2514 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2515
2516 /* Set up the iov array */
2517 iov[0].data.data = data_buffer->pvBuffer;
2518 iov[1].data.data = header;
2519 iov[2].data.data = header + 16;
2520
2521 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2522 return SEC_E_INTERNAL_ERROR;
2523
2524 sig_buffer->cbBuffer = iov[2].data.length + 16;
2525
2526 return SEC_E_OK;
2527#else
2528 return SEC_E_UNSUPPORTED_FUNCTION;
2529#endif
2530}
2531
2532WINPR_ATTR_NODISCARD
2533static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(WINPR_ATTR_UNUSED PCtxtHandle phContext,
2534 WINPR_ATTR_UNUSED PSecBufferDesc pMessage,
2535 WINPR_ATTR_UNUSED ULONG MessageSeqNo,
2536 WINPR_ATTR_UNUSED ULONG* pfQOP)
2537{
2538#ifdef WITH_KRB5
2539 PSecBuffer sig_buffer = nullptr;
2540 PSecBuffer data_buffer = nullptr;
2541 krb5glue_key key = nullptr;
2542 krb5_keyusage usage = 0;
2543 BYTE flags = 0;
2544 uint16_t tok_id = 0;
2545 uint64_t seq_no = 0;
2546 krb5_boolean is_valid = 0;
2547 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2548 { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
2549 { KRB5_CRYPTO_TYPE_CHECKSUM, WINPR_C_ARRAY_INIT } };
2550 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2551
2552 KRB_CONTEXT* context = get_context(phContext);
2553 if (!context)
2554 return SEC_E_INVALID_HANDLE;
2555
2556 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2557 return SEC_E_UNSUPPORTED_FUNCTION;
2558
2559 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2560 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2561
2562 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2563 return SEC_E_INVALID_TOKEN;
2564
2565 /* Read in header info */
2566 BYTE* header = sig_buffer->pvBuffer;
2567 tok_id = winpr_Data_Get_UINT16_BE(header);
2568 flags = header[2];
2569 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2570
2571 /* Validate header */
2572 if (tok_id != TOK_ID_MIC)
2573 return SEC_E_INVALID_TOKEN;
2574
2575 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2576 return SEC_E_INVALID_TOKEN;
2577
2578 if (memcmp(header + 3, cmp_filler, sizeof(cmp_filler)) != 0)
2579 return SEC_E_INVALID_TOKEN;
2580
2581 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2582 return SEC_E_OUT_OF_SEQUENCE;
2583
2584 /* Find the proper key and usage */
2585 key = get_key(&context->keyset);
2586 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2587 return SEC_E_INTERNAL_ERROR;
2588 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2589
2590 /* Fill in the iov array lengths */
2591 KRB_CREDENTIALS* creds = context->credentials;
2592 iov[0].data.length = data_buffer->cbBuffer;
2593 iov[1].data.length = 16;
2594 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2595 return SEC_E_INTERNAL_ERROR;
2596
2597 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2598 return SEC_E_INTERNAL_ERROR;
2599
2600 /* Set up the iov array */
2601 iov[0].data.data = data_buffer->pvBuffer;
2602 iov[1].data.data = (char*)header;
2603 iov[2].data.data = (char*)&header[16];
2604
2605 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2606 &is_valid))
2607 return SEC_E_INTERNAL_ERROR;
2608
2609 if (!is_valid)
2610 return SEC_E_MESSAGE_ALTERED;
2611
2612 return SEC_E_OK;
2613#else
2614 return SEC_E_UNSUPPORTED_FUNCTION;
2615#endif
2616}
2617
2618const SecurityFunctionTableA KERBEROS_SecurityFunctionTableA = {
2619 3, /* dwVersion */
2620 nullptr, /* EnumerateSecurityPackages */
2621 kerberos_QueryCredentialsAttributesA, /* QueryCredentialsAttributes */
2622 kerberos_AcquireCredentialsHandleA, /* AcquireCredentialsHandle */
2623 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2624 nullptr, /* Reserved2 */
2625 kerberos_InitializeSecurityContextA, /* InitializeSecurityContext */
2626 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2627 nullptr, /* CompleteAuthToken */
2628 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2629 nullptr, /* ApplyControlToken */
2630 kerberos_QueryContextAttributesA, /* QueryContextAttributes */
2631 nullptr, /* ImpersonateSecurityContext */
2632 nullptr, /* RevertSecurityContext */
2633 kerberos_MakeSignature, /* MakeSignature */
2634 kerberos_VerifySignature, /* VerifySignature */
2635 nullptr, /* FreeContextBuffer */
2636 nullptr, /* QuerySecurityPackageInfo */
2637 nullptr, /* Reserved3 */
2638 nullptr, /* Reserved4 */
2639 nullptr, /* ExportSecurityContext */
2640 nullptr, /* ImportSecurityContext */
2641 nullptr, /* AddCredentials */
2642 nullptr, /* Reserved8 */
2643 nullptr, /* QuerySecurityContextToken */
2644 kerberos_EncryptMessage, /* EncryptMessage */
2645 kerberos_DecryptMessage, /* DecryptMessage */
2646 kerberos_SetContextAttributesA, /* SetContextAttributes */
2647 kerberos_SetCredentialsAttributesA, /* SetCredentialsAttributes */
2648};
2649
2650const SecurityFunctionTableW KERBEROS_SecurityFunctionTableW = {
2651 3, /* dwVersion */
2652 nullptr, /* EnumerateSecurityPackages */
2653 kerberos_QueryCredentialsAttributesW, /* QueryCredentialsAttributes */
2654 kerberos_AcquireCredentialsHandleW, /* AcquireCredentialsHandle */
2655 kerberos_FreeCredentialsHandle, /* FreeCredentialsHandle */
2656 nullptr, /* Reserved2 */
2657 kerberos_InitializeSecurityContextW, /* InitializeSecurityContext */
2658 kerberos_AcceptSecurityContext, /* AcceptSecurityContext */
2659 nullptr, /* CompleteAuthToken */
2660 kerberos_DeleteSecurityContext, /* DeleteSecurityContext */
2661 nullptr, /* ApplyControlToken */
2662 kerberos_QueryContextAttributesW, /* QueryContextAttributes */
2663 nullptr, /* ImpersonateSecurityContext */
2664 nullptr, /* RevertSecurityContext */
2665 kerberos_MakeSignature, /* MakeSignature */
2666 kerberos_VerifySignature, /* VerifySignature */
2667 nullptr, /* FreeContextBuffer */
2668 nullptr, /* QuerySecurityPackageInfo */
2669 nullptr, /* Reserved3 */
2670 nullptr, /* Reserved4 */
2671 nullptr, /* ExportSecurityContext */
2672 nullptr, /* ImportSecurityContext */
2673 nullptr, /* AddCredentials */
2674 nullptr, /* Reserved8 */
2675 nullptr, /* QuerySecurityContextToken */
2676 kerberos_EncryptMessage, /* EncryptMessage */
2677 kerberos_DecryptMessage, /* DecryptMessage */
2678 kerberos_SetContextAttributesW, /* SetContextAttributes */
2679 kerberos_SetCredentialsAttributesW, /* SetCredentialsAttributes */
2680};
2681
2682BOOL KERBEROS_init(void)
2683{
2684 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2685 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2686 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2687 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));
2688 return TRUE;
2689}
KERB_TICKET_LOGON
Definition secapi.h:51
SECURITY_INTEGER
Definition include/winpr/sspi.h:51
SEC_CHANNEL_BINDINGS
Definition include/winpr/sspi.h:349
SecPkgContext_AuthIdentity
Definition include/winpr/sspi.h:1505
SecPkgContext_PackageInfoA
Definition include/winpr/sspi.h:416
SecPkgContext_PackageInfoW
Definition include/winpr/sspi.h:421
SecPkgContext_Sizes
Definition include/winpr/sspi.h:450
SecPkgCredentials_KdcProxySettingsW
Definition include/winpr/sspi.h:548
WinPrAsn1_MemoryChunk
Definition asn1.h:92
krb5glue_keyset
Definition krb5glue.h:92
sspi_gss_data
Definition sspi_gss.h:36
SEC_WINNT_AUTH_IDENTITY_INFO
Definition include/winpr/sspi.h:816