22#include <winpr/config.h>
31#include <winpr/assert.h>
32#include <winpr/cast.h>
33#include <winpr/asn1.h>
35#include <winpr/interlocked.h>
36#include <winpr/sspi.h>
37#include <winpr/print.h>
38#include <winpr/tchar.h>
39#include <winpr/sysinfo.h>
40#include <winpr/registry.h>
41#include <winpr/endian.h>
42#include <winpr/crypto.h>
43#include <winpr/path.h>
44#include <winpr/wtypes.h>
45#include <winpr/winsock.h>
46#include <winpr/schannel.h>
47#include <winpr/secapi.h>
56#ifdef WITH_KRB5_HEIMDAL
58#include <krb5-protos.h>
63#define TAG WINPR_TAG("sspi.Kerberos")
74 "Kerberos Security Package"
77static WCHAR KERBEROS_SecPkgInfoW_NameBuffer[32] = { 0 };
78static WCHAR KERBEROS_SecPkgInfoW_CommentBuffer[32] = { 0 };
85 KERBEROS_SecPkgInfoW_NameBuffer,
86 KERBEROS_SecPkgInfoW_CommentBuffer
93 KERBEROS_STATE_INITIAL,
94 KERBEROS_STATE_TGT_REQ,
95 KERBEROS_STATE_TGT_REP,
96 KERBEROS_STATE_AP_REQ,
97 KERBEROS_STATE_AP_REP,
101typedef struct KRB_CREDENTIALS_st
103 volatile LONG refCount;
108 krb5_keytab client_keytab;
114 enum KERBEROS_STATE state;
115 KRB_CREDENTIALS* credentials;
116 krb5_auth_context auth_ctx;
126static const WinPrAsn1_OID kerberos_OID = { 9, (
void*)
"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
128 (
void*)
"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x03" };
130#define krb_log_exec(fkt, ctx, ...) \
131 kerberos_log_msg(ctx, fkt(ctx, ##__VA_ARGS__), #fkt, __FILE__, __func__, __LINE__)
132#define krb_log_exec_ptr(fkt, ctx, ...) \
133 kerberos_log_msg(*ctx, fkt(ctx, ##__VA_ARGS__), #fkt, __FILE__, __func__, __LINE__)
134static krb5_error_code kerberos_log_msg(krb5_context ctx, krb5_error_code code,
const char* what,
135 const char* file,
const char* fkt,
size_t line)
144 const DWORD level = WLOG_ERROR;
146 wLog* log = WLog_Get(TAG);
147 if (WLog_IsLevelActive(log, level))
149 const char* msg = krb5_get_error_message(ctx, code);
150 WLog_PrintTextMessage(log, level, line, file, fkt,
"%s (%s [%d])", what, msg, code);
151 krb5_free_error_message(ctx, msg);
159static void credentials_unref(KRB_CREDENTIALS* credentials);
161static void kerberos_ContextFree(KRB_CONTEXT* ctx, BOOL allocated)
166 free(ctx->targetHost);
167 ctx->targetHost = NULL;
169 if (ctx->credentials)
171 krb5_context krbctx = ctx->credentials->ctx;
175 krb5_auth_con_free(krbctx, ctx->auth_ctx);
177 krb5glue_keys_free(krbctx, &ctx->keyset);
180 credentials_unref(ctx->credentials);
187static KRB_CONTEXT* kerberos_ContextNew(KRB_CREDENTIALS* credentials)
189 KRB_CONTEXT* context = NULL;
191 context = (KRB_CONTEXT*)calloc(1,
sizeof(KRB_CONTEXT));
195 context->credentials = credentials;
196 InterlockedIncrement(&credentials->refCount);
200static krb5_error_code krb5_prompter(krb5_context context,
void* data,
201 WINPR_ATTR_UNUSED
const char* name,
202 WINPR_ATTR_UNUSED
const char* banner,
int num_prompts,
203 krb5_prompt prompts[])
205 for (
int i = 0; i < num_prompts; i++)
207 krb5_prompt_type type = krb5glue_get_prompt_type(context, prompts, i);
208 if (type && (type == KRB5_PROMPT_TYPE_PREAUTH || type == KRB5_PROMPT_TYPE_PASSWORD) && data)
210 prompts[i].reply->data = _strdup((
const char*)data);
212 const size_t len = strlen((
const char*)data);
213 if (len > UINT32_MAX)
214 return KRB5KRB_ERR_GENERIC;
215 prompts[i].reply->length = (UINT32)len;
223 return keyset->acceptor_key ? keyset->acceptor_key
224 : keyset->initiator_key ? keyset->initiator_key
225 : keyset->session_key;
228static BOOL isValidIPv4(
const char* ipAddress)
230 struct sockaddr_in sa = { 0 };
231 int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
235static BOOL isValidIPv6(
const char* ipAddress)
237 struct sockaddr_in6 sa = { 0 };
238 int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
242static BOOL isValidIP(
const char* ipAddress)
244 return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
247#if defined(WITH_KRB5_MIT)
248WINPR_ATTR_MALLOC(free, 1)
249static
char* get_realm_name(krb5_data realm,
size_t* plen)
253 if ((realm.length <= 0) || (!realm.data))
257 (void)winpr_asprintf(&name, plen,
"krbtgt/%*s@%*s", realm.length, realm.data, realm.length,
261#elif defined(WITH_KRB5_HEIMDAL)
262WINPR_ATTR_MALLOC(free, 1)
263static
char* get_realm_name(Realm realm,
size_t* plen)
271 (void)winpr_asprintf(&name, plen,
"krbtgt/%s@%s", realm, realm);
276static int build_krbtgt(krb5_context ctx, krb5_principal principal, krb5_principal* ptarget)
280 krb5_error_code rv = KRB5_CC_NOMEM;
282 char* name = get_realm_name(principal->realm, &len);
283 if (!name || (len == 0))
286 krb5_principal target = { 0 };
287 rv = krb5_parse_name(ctx, name, &target);
296static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
297 SEC_CHAR* pszPrincipal, WINPR_ATTR_UNUSED SEC_CHAR* pszPackage, ULONG fCredentialUse,
298 WINPR_ATTR_UNUSED
void* pvLogonID,
void* pAuthData, WINPR_ATTR_UNUSED SEC_GET_KEY_FN pGetKeyFn,
299 WINPR_ATTR_UNUSED
void* pvGetKeyArgument,
PCredHandle phCredential,
304 KRB_CREDENTIALS* credentials = NULL;
305 krb5_context ctx = NULL;
306 krb5_ccache ccache = NULL;
307 krb5_keytab keytab = NULL;
308 krb5_principal principal = NULL;
310 char* username = NULL;
311 char* password = NULL;
312 BOOL own_ccache = FALSE;
313 const char*
const default_ccache_type =
"MEMORY";
317 UINT32 identityFlags = sspi_GetAuthIdentityFlags(pAuthData);
319 if (identityFlags & SEC_WINNT_AUTH_IDENTITY_EXTENDED)
325 WLog_ERR(TAG,
"Failed to copy auth identity fields");
330 pszPrincipal = username;
333 if (krb_log_exec_ptr(krb5_init_context, &ctx))
338 char* udomain = _strdup(domain);
344 krb5_error_code rv = krb_log_exec(krb5_set_default_realm, ctx, udomain);
353 char* cpszPrincipal = _strdup(pszPrincipal);
358 char* p = strchr(cpszPrincipal,
'@');
362 krb5_error_code rv = krb_log_exec(krb5_parse_name, ctx, cpszPrincipal, &principal);
367 WINPR_ASSERT(principal);
370 if (krb_settings && krb_settings->cache)
372 if ((krb_log_exec(krb5_cc_set_default_name, ctx, krb_settings->cache)))
381 if (krb5_cc_cache_match(ctx, principal, &ccache) == KRB5_CC_NOTFOUND)
385 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, 0, &ccache))
390 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
394 if (krb_log_exec(krb5_cc_initialize, ctx, ccache, principal))
400 else if (fCredentialUse & SECPKG_CRED_OUTBOUND)
403 if (krb_log_exec(krb5_cc_default, ctx, &ccache))
405 if (krb_log_exec(krb5_cc_get_principal, ctx, ccache, &principal))
413 if (krb_log_exec(krb5_cc_new_unique, ctx, default_ccache_type, 0, &ccache))
418 if (krb_log_exec(krb5_cc_resolve, ctx, krb_settings->cache, &ccache))
423 if (krb_settings && krb_settings->keytab)
425 if (krb_log_exec(krb5_kt_resolve, ctx, krb_settings->keytab, &keytab))
430 if (fCredentialUse & SECPKG_CRED_INBOUND)
431 if (krb_log_exec(krb5_kt_default, ctx, &keytab))
436 if (fCredentialUse & SECPKG_CRED_OUTBOUND)
438 krb5_creds creds = { 0 };
439 krb5_creds matchCreds = { 0 };
440 krb5_flags matchFlags = KRB5_TC_MATCH_TIMES;
442 krb5_timeofday(ctx, &matchCreds.times.endtime);
443 matchCreds.times.endtime += 60;
444 matchCreds.client = principal;
446 WINPR_ASSERT(principal);
447 if (krb_log_exec(build_krbtgt, ctx, principal, &matchCreds.server))
450 int rv = krb5_cc_retrieve_cred(ctx, ccache, matchFlags, &matchCreds, &creds);
451 krb5_free_principal(ctx, matchCreds.server);
452 krb5_free_cred_contents(ctx, &creds);
455 if (krb_log_exec(krb5glue_get_init_creds, ctx, principal, ccache, krb5_prompter,
456 password, krb_settings))
461 credentials = calloc(1,
sizeof(KRB_CREDENTIALS));
464 credentials->refCount = 1;
465 credentials->ctx = ctx;
466 credentials->ccache = ccache;
467 credentials->keytab = keytab;
468 credentials->own_ccache = own_ccache;
477 krb5_free_principal(ctx, principal);
485 krb5_cc_destroy(ctx, ccache);
487 krb5_cc_close(ctx, ccache);
490 krb5_kt_close(ctx, keytab);
492 krb5_free_context(ctx);
499 sspi_SecureHandleSetLowerPointer(phCredential, (
void*)credentials);
500 sspi_SecureHandleSetUpperPointer(phCredential, (
void*)KERBEROS_SSP_NAME);
504 return SEC_E_NO_CREDENTIALS;
506 return SEC_E_UNSUPPORTED_FUNCTION;
510static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleW(
511 SEC_WCHAR* pszPrincipal, SEC_WCHAR* pszPackage, ULONG fCredentialUse,
void* pvLogonID,
512 void* pAuthData, SEC_GET_KEY_FN pGetKeyFn,
void* pvGetKeyArgument,
PCredHandle phCredential,
515 SECURITY_STATUS status = SEC_E_INSUFFICIENT_MEMORY;
516 char* principal = NULL;
517 char*
package = NULL;
521 principal = ConvertWCharToUtf8Alloc(pszPrincipal, NULL);
527 package = ConvertWCharToUtf8Alloc(pszPackage, NULL);
533 kerberos_AcquireCredentialsHandleA(principal, package, fCredentialUse, pvLogonID, pAuthData,
534 pGetKeyFn, pvGetKeyArgument, phCredential, ptsExpiry);
544static void credentials_unref(KRB_CREDENTIALS* credentials)
546 WINPR_ASSERT(credentials);
548 if (InterlockedDecrement(&credentials->refCount))
551 free(credentials->kdc_url);
553 if (credentials->ccache)
555 if (credentials->own_ccache)
556 krb5_cc_destroy(credentials->ctx, credentials->ccache);
558 krb5_cc_close(credentials->ctx, credentials->ccache);
560 if (credentials->keytab)
561 krb5_kt_close(credentials->ctx, credentials->keytab);
563 krb5_free_context(credentials->ctx);
568static SECURITY_STATUS SEC_ENTRY kerberos_FreeCredentialsHandle(
PCredHandle phCredential)
571 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
573 return SEC_E_INVALID_HANDLE;
575 credentials_unref(credentials);
577 sspi_SecureHandleInvalidate(phCredential);
580 return SEC_E_UNSUPPORTED_FUNCTION;
584static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesW(
585 WINPR_ATTR_UNUSED
PCredHandle phCredential, ULONG ulAttribute, WINPR_ATTR_UNUSED
void* pBuffer)
590 case SECPKG_CRED_ATTR_NAMES:
593 WLog_ERR(TAG,
"TODO: QueryCredentialsAttributesW, implement ulAttribute=%08" PRIx32,
595 return SEC_E_UNSUPPORTED_FUNCTION;
599 return SEC_E_UNSUPPORTED_FUNCTION;
603static SECURITY_STATUS SEC_ENTRY kerberos_QueryCredentialsAttributesA(
PCredHandle phCredential,
607 return kerberos_QueryCredentialsAttributesW(phCredential, ulAttribute, pBuffer);
612static BOOL kerberos_mk_tgt_token(
SecBuffer* buf,
int msg_type,
char* sname,
char* host,
613 const krb5_data* ticket)
615 WinPrAsn1Encoder* enc = NULL;
624 if (msg_type != KRB_TGT_REQ && msg_type != KRB_TGT_REP)
626 if (msg_type == KRB_TGT_REP && !ticket)
629 enc = WinPrAsn1Encoder_New(WINPR_ASN1_DER);
634 if (!WinPrAsn1EncSeqContainer(enc))
638 if (!WinPrAsn1EncContextualInteger(enc, 0, 5))
642 if (!WinPrAsn1EncContextualInteger(enc, 1, msg_type))
645 if (msg_type == KRB_TGT_REQ && sname)
648 if (!WinPrAsn1EncContextualSeqContainer(enc, 2))
652 if (!WinPrAsn1EncContextualInteger(enc, 0, KRB5_NT_SRV_HST))
656 if (!WinPrAsn1EncContextualSeqContainer(enc, 1))
659 if (!WinPrAsn1EncGeneralString(enc, sname))
662 if (host && !WinPrAsn1EncGeneralString(enc, host))
665 if (!WinPrAsn1EncEndContainer(enc) || !WinPrAsn1EncEndContainer(enc))
668 else if (msg_type == KRB_TGT_REP)
671 data.data = (BYTE*)ticket->data;
672 data.len = ticket->length;
673 if (!WinPrAsn1EncContextualRawContent(enc, 2, &data))
677 if (!WinPrAsn1EncEndContainer(enc))
680 if (!WinPrAsn1EncStreamSize(enc, &len) || len > buf->cbBuffer)
683 Stream_StaticInit(&s, buf->pvBuffer, len);
684 if (!WinPrAsn1EncToStream(enc, &s))
687 token.data = buf->pvBuffer;
688 token.length = (UINT)len;
689 if (sspi_gss_wrap_token(buf, &kerberos_u2u_OID,
690 msg_type == KRB_TGT_REQ ? TOK_ID_TGT_REQ : TOK_ID_TGT_REP, &token))
694 WinPrAsn1Encoder_Free(&enc);
698static BOOL append(
char* dst,
size_t dstSize,
const char* src)
700 const size_t dlen = strnlen(dst, dstSize);
701 const size_t slen = strlen(src);
702 if (dlen + slen >= dstSize)
704 if (!strncat(dst, src, dstSize - dlen))
709static BOOL kerberos_rd_tgt_req_tag2(
WinPrAsn1Decoder* dec,
char* buf,
size_t len)
715 if (!WinPrAsn1DecReadSequence(dec, &seq))
720 WinPrAsn1_INTEGER val = 0;
721 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val))
725 if (!WinPrAsn1DecReadContextualSequence(&seq, 1, &error, dec))
728 WinPrAsn1_tag tag = 0;
730 while (WinPrAsn1DecPeekTag(dec, &tag))
732 BOOL success = FALSE;
734 if (!WinPrAsn1DecReadGeneralString(dec, &lstr))
739 if (!append(buf, len,
"/"))
744 if (!append(buf, len, lstr))
759static BOOL kerberos_rd_tgt_req_tag3(
WinPrAsn1Decoder* dec,
char* buf,
size_t len)
763 WinPrAsn1_STRING str = NULL;
764 if (!WinPrAsn1DecReadGeneralString(dec, &str))
767 if (!append(buf, len,
"@"))
769 if (!append(buf, len, str))
786 wStream s = WinPrAsn1DecGetStream(dec);
787 const size_t len = Stream_Length(&s);
792 WinPrAsn1_tagId tag = 0;
793 if (WinPrAsn1DecReadContextualTag(dec, &tag, &dec2) == 0)
796 char* buf = calloc(len + 1,
sizeof(
char));
804 BOOL checkForTag3 = TRUE;
807 rc = kerberos_rd_tgt_req_tag2(&dec2, buf, len);
810 const size_t res = WinPrAsn1DecReadContextualTag(dec, &tag, dec);
812 checkForTag3 = FALSE;
819 rc = kerberos_rd_tgt_req_tag3(&dec2, buf, len);
838 WinPrAsn1_tagId tag = 0;
839 if (WinPrAsn1DecReadContextualTag(dec, &tag, &asnTicket) == 0)
845 wStream s = WinPrAsn1DecGetStream(&asnTicket);
846 ticket->data = Stream_BufferAs(&s,
char);
848 const size_t len = Stream_Length(&s);
849 if (len > UINT32_MAX)
851 ticket->length = (UINT32)len;
855static BOOL kerberos_rd_tgt_token(
const sspi_gss_data* token,
char** target, krb5_data* ticket)
858 WinPrAsn1_INTEGER val = 0;
866 WinPrAsn1Decoder_InitMem(&der, WINPR_ASN1_DER, (BYTE*)token->data, token->length);
870 if (!WinPrAsn1DecReadSequence(&der, &seq))
874 if (!WinPrAsn1DecReadContextualInteger(&seq, 0, &error, &val) || val != 5)
878 if (!WinPrAsn1DecReadContextualInteger(&seq, 1, &error, &val))
884 return kerberos_rd_tgt_req(&seq, target);
886 return kerberos_rd_tgt_rep(&seq, ticket);
895static BOOL kerberos_hash_channel_bindings(WINPR_DIGEST_CTX* md5,
SEC_CHANNEL_BINDINGS* bindings)
899 winpr_Data_Write_UINT32(buf, bindings->dwInitiatorAddrType);
900 if (!winpr_Digest_Update(md5, buf, 4))
903 winpr_Data_Write_UINT32(buf, bindings->cbInitiatorLength);
904 if (!winpr_Digest_Update(md5, buf, 4))
907 if (bindings->cbInitiatorLength &&
908 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwInitiatorOffset,
909 bindings->cbInitiatorLength))
912 winpr_Data_Write_UINT32(buf, bindings->dwAcceptorAddrType);
913 if (!winpr_Digest_Update(md5, buf, 4))
916 winpr_Data_Write_UINT32(buf, bindings->cbAcceptorLength);
917 if (!winpr_Digest_Update(md5, buf, 4))
920 if (bindings->cbAcceptorLength &&
921 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwAcceptorOffset,
922 bindings->cbAcceptorLength))
925 winpr_Data_Write_UINT32(buf, bindings->cbApplicationDataLength);
926 if (!winpr_Digest_Update(md5, buf, 4))
929 if (bindings->cbApplicationDataLength &&
930 !winpr_Digest_Update(md5, (BYTE*)bindings + bindings->dwApplicationDataOffset,
931 bindings->cbApplicationDataLength))
937static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextA(
939 WINPR_ATTR_UNUSED ULONG Reserved1, WINPR_ATTR_UNUSED ULONG TargetDataRep,
PSecBufferDesc pInput,
941 WINPR_ATTR_UNUSED ULONG* pfContextAttr, WINPR_ATTR_UNUSED
PTimeStamp ptsExpiry)
947 WINPR_DIGEST_CTX* md5 = NULL;
951 krb5_data input_token = { 0 };
952 krb5_data output_token = { 0 };
953 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
956 krb5_ap_rep_enc_part* reply = NULL;
957 krb5_flags ap_flags = AP_OPTS_USE_SUBKEY;
958 char cksum_contents[24] = { 0 };
959 krb5_data cksum = { 0 };
960 krb5_creds in_creds = { 0 };
961 krb5_creds* creds = NULL;
962 BOOL isNewContext = FALSE;
963 KRB_CONTEXT* context = NULL;
964 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
967 if (phContext && !phContext->dwLower && !phContext->dwUpper)
968 return SEC_E_INVALID_HANDLE;
970 context = sspi_SecureHandleGetLowerPointer(phContext);
973 return SEC_E_NO_CREDENTIALS;
977 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
978 bindings_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_CHANNEL_BINDINGS);
981 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
983 if (fContextReq & ISC_REQ_MUTUAL_AUTH)
984 ap_flags |= AP_OPTS_MUTUAL_REQUIRED;
986 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
987 ap_flags |= AP_OPTS_USE_SESSION_KEY;
992 target = _strdup(pszTargetName);
995 status = SEC_E_INSUFFICIENT_MEMORY;
998 host = strchr(target,
'/');
1006 if (isValidIP(host))
1008 status = SEC_E_NO_CREDENTIALS;
1015 context = kerberos_ContextNew(credentials);
1018 status = SEC_E_INSUFFICIENT_MEMORY;
1022 isNewContext = TRUE;
1025 context->targetHost = _strdup(host);
1026 if (!context->targetHost)
1028 status = SEC_E_INSUFFICIENT_MEMORY;
1032 if (fContextReq & ISC_REQ_USE_SESSION_KEY)
1034 context->state = KERBEROS_STATE_TGT_REQ;
1035 context->u2u = TRUE;
1038 context->state = KERBEROS_STATE_AP_REQ;
1042 if (!input_buffer || !sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1044 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1045 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1050 context->flags |= (fContextReq & 0x1F);
1051 if ((fContextReq & ISC_REQ_INTEGRITY) && !(fContextReq & ISC_REQ_NO_INTEGRITY))
1052 context->flags |= SSPI_GSS_C_INTEG_FLAG;
1054 switch (context->state)
1056 case KERBEROS_STATE_TGT_REQ:
1058 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REQ, sname, host, NULL))
1061 context->state = KERBEROS_STATE_TGT_REP;
1062 status = SEC_I_CONTINUE_NEEDED;
1065 case KERBEROS_STATE_TGT_REP:
1067 if (tok_id != TOK_ID_TGT_REP)
1070 if (!kerberos_rd_tgt_token(&input_token, NULL, &in_creds.second_ticket))
1077 case KERBEROS_STATE_AP_REQ:
1080 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1082 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1083 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1085 if (krb_log_exec(krb5glue_auth_con_set_cksumtype, credentials->ctx, context->auth_ctx,
1090 if (krb_log_exec(krb5_sname_to_principal, credentials->ctx, host, sname,
1091 KRB5_NT_SRV_HST, &in_creds.server))
1094 if (krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1097 status = SEC_E_WRONG_PRINCIPAL;
1101 if (krb_log_exec(krb5_get_credentials, credentials->ctx,
1102 context->u2u ? KRB5_GC_USER_USER : 0, credentials->ccache, &in_creds,
1105 status = SEC_E_NO_CREDENTIALS;
1110 cksum.data = cksum_contents;
1111 cksum.length =
sizeof(cksum_contents);
1112 winpr_Data_Write_UINT32(cksum_contents, 16);
1113 winpr_Data_Write_UINT32((cksum_contents + 20), context->flags);
1115 if (bindings_buffer)
1121 (bindings->cbInitiatorLength + bindings->dwInitiatorOffset) >
1122 bindings_buffer->cbBuffer ||
1123 (bindings->cbAcceptorLength + bindings->dwAcceptorOffset) >
1124 bindings_buffer->cbBuffer ||
1125 (bindings->cbApplicationDataLength + bindings->dwApplicationDataOffset) >
1126 bindings_buffer->cbBuffer)
1128 status = SEC_E_BAD_BINDINGS;
1132 md5 = winpr_Digest_New();
1136 if (!winpr_Digest_Init(md5, WINPR_MD_MD5))
1139 if (!kerberos_hash_channel_bindings(md5, bindings))
1142 if (!winpr_Digest_Final(md5, (BYTE*)cksum_contents + 4, 16))
1147 if (krb_log_exec(krb5_mk_req_extended, credentials->ctx, &context->auth_ctx, ap_flags,
1148 &cksum, creds, &output_token))
1151 if (!sspi_gss_wrap_token(output_buffer,
1152 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1153 TOK_ID_AP_REQ, &output_token))
1156 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1158 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx,
1159 context->auth_ctx, (INT32*)&context->local_seq))
1161 context->remote_seq ^= context->local_seq;
1164 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1168 context->state = KERBEROS_STATE_AP_REP;
1170 if (context->flags & SSPI_GSS_C_MUTUAL_FLAG)
1171 status = SEC_I_CONTINUE_NEEDED;
1176 case KERBEROS_STATE_AP_REP:
1178 if (tok_id == TOK_ID_AP_REP)
1180 if (krb_log_exec(krb5_rd_rep, credentials->ctx, context->auth_ctx, &input_token,
1183 krb5_free_ap_rep_enc_part(credentials->ctx, reply);
1185 else if (tok_id == TOK_ID_ERROR)
1187 krb5glue_log_error(credentials->ctx, &input_token, TAG);
1193 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1195 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx,
1196 context->auth_ctx, (INT32*)&context->remote_seq))
1200 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, FALSE,
1204 context->state = KERBEROS_STATE_FINAL;
1207 output_buffer->cbBuffer = 0;
1211 case KERBEROS_STATE_FINAL:
1213 WLog_ERR(TAG,
"Kerberos in invalid state!");
1220 krb5_data edata = { 0 };
1221 in_creds.second_ticket = edata;
1222 krb5_free_cred_contents(credentials->ctx, &in_creds);
1225 krb5_free_creds(credentials->ctx, creds);
1226 if (output_token.data)
1227 krb5glue_free_data_contents(credentials->ctx, &output_token);
1229 winpr_Digest_Free(md5);
1238 case SEC_I_CONTINUE_NEEDED:
1239 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1240 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1243 kerberos_ContextFree(context, TRUE);
1251 status = SEC_E_INVALID_TOKEN;
1254 return SEC_E_UNSUPPORTED_FUNCTION;
1258static SECURITY_STATUS SEC_ENTRY kerberos_InitializeSecurityContextW(
1260 ULONG Reserved1, ULONG TargetDataRep,
PSecBufferDesc pInput, ULONG Reserved2,
1263 SECURITY_STATUS status = 0;
1264 char* target_name = NULL;
1268 target_name = ConvertWCharToUtf8Alloc(pszTargetName, NULL);
1270 return SEC_E_INSUFFICIENT_MEMORY;
1273 status = kerberos_InitializeSecurityContextA(phCredential, phContext, target_name, fContextReq,
1274 Reserved1, TargetDataRep, pInput, Reserved2,
1275 phNewContext, pOutput, pfContextAttr, ptsExpiry);
1284static BOOL retrieveTgtForPrincipal(KRB_CREDENTIALS* credentials, krb5_principal principal,
1288 krb5_kt_cursor cur = { 0 };
1289 krb5_keytab_entry entry = { 0 };
1290 if (krb_log_exec(krb5_kt_start_seq_get, credentials->ctx, credentials->keytab, &cur))
1295 krb5_error_code rv =
1296 krb_log_exec(krb5_kt_next_entry, credentials->ctx, credentials->keytab, &entry, &cur);
1297 if (rv == KRB5_KT_END)
1302 if (krb5_principal_compare(credentials->ctx, principal, entry.principal))
1304 rv = krb_log_exec(krb5glue_free_keytab_entry_contents, credentials->ctx, &entry);
1305 memset(&entry, 0,
sizeof(entry));
1310 if (krb_log_exec(krb5_kt_end_seq_get, credentials->ctx, credentials->keytab, &cur))
1313 if (!entry.principal)
1317 if (krb_log_exec(krb5_get_init_creds_keytab, credentials->ctx, creds, entry.principal,
1318 credentials->keytab, 0, NULL, NULL))
1327static BOOL retrieveSomeTgt(KRB_CREDENTIALS* credentials,
const char* target, krb5_creds* creds)
1330 krb5_principal target_princ = { 0 };
1331 char* default_realm = NULL;
1333 krb5_error_code rv =
1334 krb_log_exec(krb5_parse_name_flags, credentials->ctx, target, 0, &target_princ);
1338#if defined(WITH_KRB5_HEIMDAL)
1339 if (!target_princ->realm)
1341 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1345 target_princ->realm = default_realm;
1348 if (!target_princ->realm.length)
1350 rv = krb_log_exec(krb5_get_default_realm, credentials->ctx, &default_realm);
1354 target_princ->realm.data = default_realm;
1355 target_princ->realm.length = (
unsigned int)strlen(default_realm);
1365 if (retrieveTgtForPrincipal(credentials, target_princ, creds))
1370#if defined(WITH_KRB5_MIT)
1374 char hostDollar[300] = { 0 };
1375 if (target_princ->length < 2)
1378 (void)snprintf(hostDollar,
sizeof(hostDollar) - 1,
"%s$@%s", target_princ->data[1].data,
1379 target_princ->realm.data);
1380 krb5_free_principal(credentials->ctx, target_princ);
1382 rv = krb_log_exec(krb5_parse_name_flags, credentials->ctx, hostDollar, 0, &target_princ);
1386 ret = retrieveTgtForPrincipal(credentials, target_princ, creds);
1391 krb5_free_default_realm(credentials->ctx, default_realm);
1393 krb5_free_principal(credentials->ctx, target_princ);
1398static SECURITY_STATUS SEC_ENTRY kerberos_AcceptSecurityContext(
1400 WINPR_ATTR_UNUSED ULONG fContextReq, WINPR_ATTR_UNUSED ULONG TargetDataRep,
1405 BOOL isNewContext = FALSE;
1409 uint16_t tok_id = 0;
1410 krb5_data input_token = { 0 };
1411 krb5_data output_token = { 0 };
1412 SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
1413 krb5_flags ap_flags = 0;
1414 krb5glue_authenticator authenticator = NULL;
1415 char* target = NULL;
1416 krb5_keytab_entry entry = { 0 };
1417 krb5_creds creds = { 0 };
1420 if (phContext && !phContext->dwLower && !phContext->dwUpper)
1421 return SEC_E_INVALID_HANDLE;
1423 KRB_CONTEXT* context = sspi_SecureHandleGetLowerPointer(phContext);
1424 KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1427 input_buffer = sspi_FindSecBuffer(pInput, SECBUFFER_TOKEN);
1429 output_buffer = sspi_FindSecBuffer(pOutput, SECBUFFER_TOKEN);
1432 return SEC_E_INVALID_TOKEN;
1434 if (!sspi_gss_unwrap_token(input_buffer, &oid, &tok_id, &input_token))
1435 return SEC_E_INVALID_TOKEN;
1439 isNewContext = TRUE;
1440 context = kerberos_ContextNew(credentials);
1441 context->acceptor = TRUE;
1443 if (sspi_gss_oid_compare(&oid, &kerberos_u2u_OID))
1445 context->u2u = TRUE;
1446 context->state = KERBEROS_STATE_TGT_REQ;
1448 else if (sspi_gss_oid_compare(&oid, &kerberos_OID))
1449 context->state = KERBEROS_STATE_AP_REQ;
1455 if ((context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_u2u_OID)) ||
1456 (!context->u2u && !sspi_gss_oid_compare(&oid, &kerberos_OID)))
1460 if (context->state == KERBEROS_STATE_TGT_REQ && tok_id == TOK_ID_TGT_REQ)
1462 if (!kerberos_rd_tgt_token(&input_token, &target, NULL))
1465 if (!retrieveSomeTgt(credentials, target, &creds))
1468 if (!kerberos_mk_tgt_token(output_buffer, KRB_TGT_REP, NULL, NULL, &creds.ticket))
1471 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &context->auth_ctx))
1474 if (krb_log_exec(krb5glue_auth_con_setuseruserkey, credentials->ctx, context->auth_ctx,
1475 &krb5glue_creds_getkey(creds)))
1478 context->state = KERBEROS_STATE_AP_REQ;
1480 else if (context->state == KERBEROS_STATE_AP_REQ && tok_id == TOK_ID_AP_REQ)
1482 if (krb_log_exec(krb5_rd_req, credentials->ctx, &context->auth_ctx, &input_token, NULL,
1483 credentials->keytab, &ap_flags, NULL))
1486 if (krb_log_exec(krb5_auth_con_setflags, credentials->ctx, context->auth_ctx,
1487 KRB5_AUTH_CONTEXT_DO_SEQUENCE | KRB5_AUTH_CONTEXT_USE_SUBKEY))
1491 if (krb_log_exec(krb5_auth_con_getauthenticator, credentials->ctx, context->auth_ctx,
1494 if (!krb5glue_authenticator_validate_chksum(authenticator, GSS_CHECKSUM_TYPE,
1498 if ((ap_flags & AP_OPTS_MUTUAL_REQUIRED) && (context->flags & SSPI_GSS_C_MUTUAL_FLAG))
1502 if (krb_log_exec(krb5_mk_rep, credentials->ctx, context->auth_ctx, &output_token))
1504 if (!sspi_gss_wrap_token(output_buffer,
1505 context->u2u ? &kerberos_u2u_OID : &kerberos_OID,
1506 TOK_ID_AP_REP, &output_token))
1512 output_buffer->cbBuffer = 0;
1515 *pfContextAttr = (context->flags & 0x1F);
1516 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1517 *pfContextAttr |= ASC_RET_INTEGRITY;
1519 if (context->flags & SSPI_GSS_C_SEQUENCE_FLAG)
1521 if (krb_log_exec(krb5_auth_con_getlocalseqnumber, credentials->ctx, context->auth_ctx,
1522 (INT32*)&context->local_seq))
1524 if (krb_log_exec(krb5_auth_con_getremoteseqnumber, credentials->ctx, context->auth_ctx,
1525 (INT32*)&context->remote_seq))
1529 if (krb_log_exec(krb5glue_update_keyset, credentials->ctx, context->auth_ctx, TRUE,
1533 context->state = KERBEROS_STATE_FINAL;
1539 if (context->state == KERBEROS_STATE_FINAL)
1542 status = SEC_I_CONTINUE_NEEDED;
1546 if (output_token.data)
1547 krb5glue_free_data_contents(credentials->ctx, &output_token);
1548 if (entry.principal)
1549 krb5glue_free_keytab_entry_contents(credentials->ctx, &entry);
1556 case SEC_I_CONTINUE_NEEDED:
1557 sspi_SecureHandleSetLowerPointer(phNewContext, context);
1558 sspi_SecureHandleSetUpperPointer(phNewContext, KERBEROS_SSP_NAME);
1561 kerberos_ContextFree(context, TRUE);
1569 status = SEC_E_INVALID_TOKEN;
1572 return SEC_E_UNSUPPORTED_FUNCTION;
1577static KRB_CONTEXT* get_context(
PCtxtHandle phContext)
1582 TCHAR* name = sspi_SecureHandleGetUpperPointer(phContext);
1586 if (_tcsncmp(KERBEROS_SSP_NAME, name, ARRAYSIZE(KERBEROS_SSP_NAME)) != 0)
1588 return sspi_SecureHandleGetLowerPointer(phContext);
1591static BOOL copy_krb5_data(krb5_data* data, PUCHAR* ptr, ULONG* psize)
1595 WINPR_ASSERT(psize);
1597 *ptr = (PUCHAR)malloc(data->length);
1601 *psize = data->length;
1602 memcpy(*ptr, data->data, data->length);
1607static SECURITY_STATUS SEC_ENTRY kerberos_DeleteSecurityContext(
PCtxtHandle phContext)
1610 KRB_CONTEXT* context = get_context(phContext);
1612 return SEC_E_INVALID_HANDLE;
1614 kerberos_ContextFree(context, TRUE);
1618 return SEC_E_UNSUPPORTED_FUNCTION;
1624static SECURITY_STATUS krb5_error_to_SECURITY_STATUS(krb5_error_code code)
1631 return SEC_E_INTERNAL_ERROR;
1635static SECURITY_STATUS kerberos_ATTR_SIZES(KRB_CONTEXT* context, KRB_CREDENTIALS* credentials,
1641 krb5glue_key key = NULL;
1643 WINPR_ASSERT(context);
1644 WINPR_ASSERT(context->auth_ctx);
1650 ContextSizes->cbMaxToken = KERBEROS_SecPkgInfoA.cbMaxToken;
1651 ContextSizes->cbMaxSignature = 0;
1652 ContextSizes->cbBlockSize = 1;
1653 ContextSizes->cbSecurityTrailer = 0;
1655 key = get_key(&context->keyset);
1657 if (context->flags & SSPI_GSS_C_CONF_FLAG)
1659 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1660 KRB5_CRYPTO_TYPE_HEADER, &header);
1662 return krb5_error_to_SECURITY_STATUS(rv);
1664 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_PADDING,
1667 return krb5_error_to_SECURITY_STATUS(rv);
1669 rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key, KRB5_CRYPTO_TYPE_TRAILER,
1672 return krb5_error_to_SECURITY_STATUS(rv);
1675 ContextSizes->cbSecurityTrailer = header + pad + trailer + 32;
1678 if (context->flags & SSPI_GSS_C_INTEG_FLAG)
1680 krb5_error_code rv = krb_log_exec(krb5glue_crypto_length, credentials->ctx, key,
1681 KRB5_CRYPTO_TYPE_CHECKSUM, &ContextSizes->cbMaxSignature);
1683 return krb5_error_to_SECURITY_STATUS(rv);
1685 ContextSizes->cbMaxSignature += 16;
1691static SECURITY_STATUS kerberos_ATTR_TICKET_LOGON(KRB_CONTEXT* context,
1692 KRB_CREDENTIALS* credentials,
1695 krb5_creds matchCred = { 0 };
1696 krb5_auth_context authContext = NULL;
1697 krb5_flags getCredsFlags = KRB5_GC_CACHED;
1698 BOOL firstRun = TRUE;
1699 krb5_creds* hostCred = NULL;
1700 SECURITY_STATUS ret = SEC_E_INSUFFICIENT_MEMORY;
1701 int rv = krb_log_exec(krb5_sname_to_principal, credentials->ctx, context->targetHost,
"HOST",
1702 KRB5_NT_SRV_HST, &matchCred.server);
1706 rv = krb_log_exec(krb5_cc_get_principal, credentials->ctx, credentials->ccache,
1713 rv = krb_log_exec(krb5_get_credentials, credentials->ctx, getCredsFlags, credentials->ccache,
1714 &matchCred, &hostCred);
1719 case KRB5_CC_NOTFOUND:
1728 WLog_ERR(TAG,
"krb5_get_credentials(hostCreds), rv=%d", rv);
1732 if (krb_log_exec(krb5_auth_con_init, credentials->ctx, &authContext))
1735 krb5_data derOut = { 0 };
1736 if (krb_log_exec(krb5_fwd_tgt_creds, credentials->ctx, authContext, context->targetHost,
1737 matchCred.client, matchCred.server, credentials->ccache, 1, &derOut))
1739 ret = SEC_E_LOGON_DENIED;
1743 ticketLogon->MessageType = KerbTicketLogon;
1744 ticketLogon->Flags = KERB_LOGON_FLAG_REDIRECTED;
1746 if (!copy_krb5_data(&hostCred->ticket, &ticketLogon->ServiceTicket,
1747 &ticketLogon->ServiceTicketLength))
1749 krb5_free_data(credentials->ctx, &derOut);
1753 ticketLogon->TicketGrantingTicketLength = derOut.length;
1754 ticketLogon->TicketGrantingTicket = (PUCHAR)derOut.data;
1758 krb5_auth_con_free(credentials->ctx, authContext);
1759 krb5_free_creds(credentials->ctx, hostCred);
1760 krb5_free_cred_contents(credentials->ctx, &matchCred);
1766static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesA(
PCtxtHandle phContext,
1767 ULONG ulAttribute,
void* pBuffer)
1770 return SEC_E_INVALID_HANDLE;
1773 return SEC_E_INVALID_PARAMETER;
1776 KRB_CONTEXT* context = get_context(phContext);
1778 return SEC_E_INVALID_PARAMETER;
1780 KRB_CREDENTIALS* credentials = context->credentials;
1782 switch (ulAttribute)
1784 case SECPKG_ATTR_SIZES:
1787 case SECPKG_CRED_ATTR_TICKET_LOGON:
1788 return kerberos_ATTR_TICKET_LOGON(context, credentials, (
KERB_TICKET_LOGON*)pBuffer);
1791 WLog_ERR(TAG,
"TODO: QueryContextAttributes implement ulAttribute=0x%08" PRIx32,
1793 return SEC_E_UNSUPPORTED_FUNCTION;
1796 return SEC_E_UNSUPPORTED_FUNCTION;
1800static SECURITY_STATUS SEC_ENTRY kerberos_QueryContextAttributesW(
PCtxtHandle phContext,
1801 ULONG ulAttribute,
void* pBuffer)
1803 return kerberos_QueryContextAttributesA(phContext, ulAttribute, pBuffer);
1806static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesW(
1807 WINPR_ATTR_UNUSED
PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
1808 WINPR_ATTR_UNUSED
void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
1810 return SEC_E_UNSUPPORTED_FUNCTION;
1813static SECURITY_STATUS SEC_ENTRY kerberos_SetContextAttributesA(
1814 WINPR_ATTR_UNUSED
PCtxtHandle phContext, WINPR_ATTR_UNUSED ULONG ulAttribute,
1815 WINPR_ATTR_UNUSED
void* pBuffer, WINPR_ATTR_UNUSED ULONG cbBuffer)
1817 return SEC_E_UNSUPPORTED_FUNCTION;
1820static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesX(
PCredHandle phCredential,
1822 void* pBuffer, ULONG cbBuffer,
1823 WINPR_ATTR_UNUSED BOOL unicode)
1826 KRB_CREDENTIALS* credentials = NULL;
1829 return SEC_E_INVALID_HANDLE;
1831 credentials = sspi_SecureHandleGetLowerPointer(phCredential);
1834 return SEC_E_INVALID_HANDLE;
1837 return SEC_E_INSUFFICIENT_MEMORY;
1839 switch (ulAttribute)
1841 case SECPKG_CRED_ATTR_KDC_PROXY_SETTINGS:
1847 kdc_settings->Version != KDC_PROXY_SETTINGS_V1 ||
1850 kdc_settings->ProxyServerOffset + kdc_settings->ProxyServerLength)
1851 return SEC_E_INVALID_TOKEN;
1853 if (credentials->kdc_url)
1855 free(credentials->kdc_url);
1856 credentials->kdc_url = NULL;
1859 if (kdc_settings->ProxyServerLength > 0)
1861 WCHAR* proxy = (WCHAR*)((BYTE*)pBuffer + kdc_settings->ProxyServerOffset);
1863 credentials->kdc_url = ConvertWCharNToUtf8Alloc(
1864 proxy, kdc_settings->ProxyServerLength /
sizeof(WCHAR), NULL);
1865 if (!credentials->kdc_url)
1866 return SEC_E_INSUFFICIENT_MEMORY;
1871 case SECPKG_CRED_ATTR_NAMES:
1872 case SECPKG_ATTR_SUPPORTED_ALGS:
1874 WLog_ERR(TAG,
"TODO: SetCredentialsAttributesX implement ulAttribute=0x%08" PRIx32,
1876 return SEC_E_UNSUPPORTED_FUNCTION;
1880 return SEC_E_UNSUPPORTED_FUNCTION;
1884static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesW(
PCredHandle phCredential,
1886 void* pBuffer, ULONG cbBuffer)
1888 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, TRUE);
1891static SECURITY_STATUS SEC_ENTRY kerberos_SetCredentialsAttributesA(
PCredHandle phCredential,
1893 void* pBuffer, ULONG cbBuffer)
1895 return kerberos_SetCredentialsAttributesX(phCredential, ulAttribute, pBuffer, cbBuffer, FALSE);
1898static SECURITY_STATUS SEC_ENTRY kerberos_EncryptMessage(
PCtxtHandle phContext, ULONG fQOP,
1903 KRB_CONTEXT* context = get_context(phContext);
1906 char* header = NULL;
1908 krb5glue_key key = NULL;
1909 krb5_keyusage usage = 0;
1910 krb5_crypto_iov encrypt_iov[] = { { KRB5_CRYPTO_TYPE_HEADER, { 0 } },
1911 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1912 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
1913 { KRB5_CRYPTO_TYPE_PADDING, { 0 } },
1914 { KRB5_CRYPTO_TYPE_TRAILER, { 0 } } };
1917 return SEC_E_INVALID_HANDLE;
1919 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
1920 return SEC_E_UNSUPPORTED_FUNCTION;
1922 KRB_CREDENTIALS* creds = context->credentials;
1924 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
1925 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
1927 if (!sig_buffer || !data_buffer)
1928 return SEC_E_INVALID_TOKEN;
1931 return SEC_E_QOP_NOT_SUPPORTED;
1933 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
1934 flags |= FLAG_WRAP_CONFIDENTIAL;
1936 key = get_key(&context->keyset);
1938 return SEC_E_INTERNAL_ERROR;
1940 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
1942 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SEAL : KG_USAGE_INITIATOR_SEAL;
1945 encrypt_iov[1].data.length = data_buffer->cbBuffer;
1946 encrypt_iov[2].data.length = 16;
1949 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, encrypt_iov,
1950 ARRAYSIZE(encrypt_iov)))
1951 return SEC_E_INTERNAL_ERROR;
1952 if (sig_buffer->cbBuffer <
1953 encrypt_iov[0].data.length + encrypt_iov[3].data.length + encrypt_iov[4].data.length + 32)
1954 return SEC_E_INSUFFICIENT_MEMORY;
1957 header = sig_buffer->pvBuffer;
1958 encrypt_iov[2].data.data = header + 16;
1959 encrypt_iov[3].data.data = encrypt_iov[2].data.data + encrypt_iov[2].data.length;
1960 encrypt_iov[4].data.data = encrypt_iov[3].data.data + encrypt_iov[3].data.length;
1961 encrypt_iov[0].data.data = encrypt_iov[4].data.data + encrypt_iov[4].data.length;
1962 encrypt_iov[1].data.data = data_buffer->pvBuffer;
1965 winpr_Data_Write_UINT16_BE(header, TOK_ID_WRAP);
1966 header[2] = WINPR_ASSERTING_INT_CAST(
char, flags);
1967 header[3] = (char)0xFF;
1968 winpr_Data_Write_UINT32(header + 4, 0);
1969 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
1972 CopyMemory(encrypt_iov[2].data.data, header, 16);
1975 const size_t len = 16 + encrypt_iov[3].data.length + encrypt_iov[4].data.length;
1976 winpr_Data_Write_UINT16_BE(header + 6, WINPR_ASSERTING_INT_CAST(UINT16, len));
1978 if (krb_log_exec(krb5glue_encrypt_iov, creds->ctx, key, usage, encrypt_iov,
1979 ARRAYSIZE(encrypt_iov)))
1980 return SEC_E_INTERNAL_ERROR;
1984 return SEC_E_UNSUPPORTED_FUNCTION;
1988static SECURITY_STATUS SEC_ENTRY kerberos_DecryptMessage(
PCtxtHandle phContext,
1990 ULONG MessageSeqNo, ULONG* pfQOP)
1993 KRB_CONTEXT* context = get_context(phContext);
1996 krb5glue_key key = NULL;
1997 krb5_keyusage usage = 0;
1998 uint16_t tok_id = 0;
2002 uint64_t seq_no = 0;
2003 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, { 0 } },
2004 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2005 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2006 { KRB5_CRYPTO_TYPE_PADDING, { 0 } },
2007 { KRB5_CRYPTO_TYPE_TRAILER, { 0 } } };
2010 return SEC_E_INVALID_HANDLE;
2012 if (!(context->flags & SSPI_GSS_C_CONF_FLAG))
2013 return SEC_E_UNSUPPORTED_FUNCTION;
2015 KRB_CREDENTIALS* creds = context->credentials;
2017 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2018 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2020 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2021 return SEC_E_INVALID_TOKEN;
2024 BYTE* header = sig_buffer->pvBuffer;
2025 tok_id = winpr_Data_Get_UINT16_BE(header);
2027 ec = winpr_Data_Get_UINT16_BE(&header[4]);
2028 rrc = winpr_Data_Get_UINT16_BE(&header[6]);
2029 seq_no = winpr_Data_Get_UINT64_BE(&header[8]);
2032 if ((tok_id != TOK_ID_WRAP) || (header[3] != 0xFF))
2033 return SEC_E_INVALID_TOKEN;
2035 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor)
2036 return SEC_E_INVALID_TOKEN;
2038 if ((context->flags & ISC_REQ_SEQUENCE_DETECT) &&
2039 (seq_no != context->remote_seq + MessageSeqNo))
2040 return SEC_E_OUT_OF_SEQUENCE;
2042 if (!(flags & FLAG_WRAP_CONFIDENTIAL))
2043 return SEC_E_INVALID_TOKEN;
2047 return SEC_E_INVALID_TOKEN;
2050 key = get_key(&context->keyset);
2051 if (!key || ((flags & FLAG_ACCEPTOR_SUBKEY) && (context->keyset.acceptor_key != key)))
2052 return SEC_E_INTERNAL_ERROR;
2053 usage = context->acceptor ? KG_USAGE_INITIATOR_SEAL : KG_USAGE_ACCEPTOR_SEAL;
2056 iov[1].data.length = data_buffer->cbBuffer;
2057 iov[2].data.length = 16;
2058 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2059 return SEC_E_INTERNAL_ERROR;
2062 if (rrc != 16 + iov[3].data.length + iov[4].data.length)
2063 return SEC_E_INVALID_TOKEN;
2064 if (sig_buffer->cbBuffer != 16 + rrc + iov[0].data.length)
2065 return SEC_E_INVALID_TOKEN;
2068 iov[0].data.data = (
char*)&header[16 + rrc + ec];
2069 iov[1].data.data = data_buffer->pvBuffer;
2070 iov[2].data.data = (
char*)&header[16 + ec];
2071 char* data2 = iov[2].data.data;
2072 iov[3].data.data = &data2[iov[2].data.length];
2074 char* data3 = iov[3].data.data;
2075 iov[4].data.data = &data3[iov[3].data.length];
2077 if (krb_log_exec(krb5glue_decrypt_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2078 return SEC_E_INTERNAL_ERROR;
2081 winpr_Data_Write_UINT16_BE(iov[2].data.data + 4, ec);
2082 winpr_Data_Write_UINT16_BE(iov[2].data.data + 6, rrc);
2083 if (memcmp(iov[2].data.data, header, 16) != 0)
2084 return SEC_E_MESSAGE_ALTERED;
2090 return SEC_E_UNSUPPORTED_FUNCTION;
2094static SECURITY_STATUS SEC_ENTRY kerberos_MakeSignature(
PCtxtHandle phContext,
2095 WINPR_ATTR_UNUSED ULONG fQOP,
2099 KRB_CONTEXT* context = get_context(phContext);
2102 krb5glue_key key = NULL;
2103 krb5_keyusage usage = 0;
2105 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2106 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2107 { KRB5_CRYPTO_TYPE_CHECKSUM, { 0 } } };
2110 return SEC_E_INVALID_HANDLE;
2112 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2113 return SEC_E_UNSUPPORTED_FUNCTION;
2115 KRB_CREDENTIALS* creds = context->credentials;
2117 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2118 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2120 if (!sig_buffer || !data_buffer)
2121 return SEC_E_INVALID_TOKEN;
2123 flags |= context->acceptor ? FLAG_SENDER_IS_ACCEPTOR : 0;
2125 key = get_key(&context->keyset);
2127 return SEC_E_INTERNAL_ERROR;
2128 usage = context->acceptor ? KG_USAGE_ACCEPTOR_SIGN : KG_USAGE_INITIATOR_SIGN;
2130 flags |= context->keyset.acceptor_key == key ? FLAG_ACCEPTOR_SUBKEY : 0;
2133 iov[0].data.length = data_buffer->cbBuffer;
2134 iov[1].data.length = 16;
2135 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2136 return SEC_E_INTERNAL_ERROR;
2139 if (sig_buffer->cbBuffer < iov[2].data.length + 16)
2140 return SEC_E_INSUFFICIENT_MEMORY;
2143 char* header = sig_buffer->pvBuffer;
2144 winpr_Data_Write_UINT16_BE(header, TOK_ID_MIC);
2145 header[2] = WINPR_ASSERTING_INT_CAST(
char, flags);
2146 memset(header + 3, 0xFF, 5);
2147 winpr_Data_Write_UINT64_BE(header + 8, (context->local_seq + MessageSeqNo));
2150 iov[0].data.data = data_buffer->pvBuffer;
2151 iov[1].data.data = header;
2152 iov[2].data.data = header + 16;
2154 if (krb_log_exec(krb5glue_make_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov)))
2155 return SEC_E_INTERNAL_ERROR;
2157 sig_buffer->cbBuffer = iov[2].data.length + 16;
2161 return SEC_E_UNSUPPORTED_FUNCTION;
2165static SECURITY_STATUS SEC_ENTRY kerberos_VerifySignature(
PCtxtHandle phContext,
2168 WINPR_ATTR_UNUSED ULONG* pfQOP)
2173 krb5glue_key key = NULL;
2174 krb5_keyusage usage = 0;
2176 uint16_t tok_id = 0;
2177 uint64_t seq_no = 0;
2178 krb5_boolean is_valid = 0;
2179 krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2180 { KRB5_CRYPTO_TYPE_DATA, { 0 } },
2181 { KRB5_CRYPTO_TYPE_CHECKSUM, { 0 } } };
2182 BYTE cmp_filler[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
2184 KRB_CONTEXT* context = get_context(phContext);
2186 return SEC_E_INVALID_HANDLE;
2188 if (!(context->flags & SSPI_GSS_C_INTEG_FLAG))
2189 return SEC_E_UNSUPPORTED_FUNCTION;
2191 sig_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_TOKEN);
2192 data_buffer = sspi_FindSecBuffer(pMessage, SECBUFFER_DATA);
2194 if (!sig_buffer || !data_buffer || sig_buffer->cbBuffer < 16)
2195 return SEC_E_INVALID_TOKEN;
2198 BYTE* header = sig_buffer->pvBuffer;
2199 tok_id = winpr_Data_Get_UINT16_BE(header);
2201 seq_no = winpr_Data_Get_UINT64_BE((header + 8));
2204 if (tok_id != TOK_ID_MIC)
2205 return SEC_E_INVALID_TOKEN;
2207 if ((flags & FLAG_SENDER_IS_ACCEPTOR) == context->acceptor || flags & FLAG_WRAP_CONFIDENTIAL)
2208 return SEC_E_INVALID_TOKEN;
2210 if (memcmp(header + 3, cmp_filler,
sizeof(cmp_filler)) != 0)
2211 return SEC_E_INVALID_TOKEN;
2213 if (context->flags & ISC_REQ_SEQUENCE_DETECT && seq_no != context->remote_seq + MessageSeqNo)
2214 return SEC_E_OUT_OF_SEQUENCE;
2217 key = get_key(&context->keyset);
2218 if (!key || (flags & FLAG_ACCEPTOR_SUBKEY && context->keyset.acceptor_key != key))
2219 return SEC_E_INTERNAL_ERROR;
2220 usage = context->acceptor ? KG_USAGE_INITIATOR_SIGN : KG_USAGE_ACCEPTOR_SIGN;
2223 KRB_CREDENTIALS* creds = context->credentials;
2224 iov[0].data.length = data_buffer->cbBuffer;
2225 iov[1].data.length = 16;
2226 if (krb_log_exec(krb5glue_crypto_length_iov, creds->ctx, key, iov, ARRAYSIZE(iov)))
2227 return SEC_E_INTERNAL_ERROR;
2229 if (sig_buffer->cbBuffer != iov[2].data.length + 16)
2230 return SEC_E_INTERNAL_ERROR;
2233 iov[0].data.data = data_buffer->pvBuffer;
2234 iov[1].data.data = (
char*)header;
2235 iov[2].data.data = (
char*)&header[16];
2237 if (krb_log_exec(krb5glue_verify_checksum_iov, creds->ctx, key, usage, iov, ARRAYSIZE(iov),
2239 return SEC_E_INTERNAL_ERROR;
2242 return SEC_E_MESSAGE_ALTERED;
2246 return SEC_E_UNSUPPORTED_FUNCTION;
2253 kerberos_QueryCredentialsAttributesA,
2254 kerberos_AcquireCredentialsHandleA,
2255 kerberos_FreeCredentialsHandle,
2257 kerberos_InitializeSecurityContextA,
2258 kerberos_AcceptSecurityContext,
2260 kerberos_DeleteSecurityContext,
2262 kerberos_QueryContextAttributesA,
2265 kerberos_MakeSignature,
2266 kerberos_VerifySignature,
2276 kerberos_EncryptMessage,
2277 kerberos_DecryptMessage,
2278 kerberos_SetContextAttributesA,
2279 kerberos_SetCredentialsAttributesA,
2285 kerberos_QueryCredentialsAttributesW,
2286 kerberos_AcquireCredentialsHandleW,
2287 kerberos_FreeCredentialsHandle,
2289 kerberos_InitializeSecurityContextW,
2290 kerberos_AcceptSecurityContext,
2292 kerberos_DeleteSecurityContext,
2294 kerberos_QueryContextAttributesW,
2297 kerberos_MakeSignature,
2298 kerberos_VerifySignature,
2308 kerberos_EncryptMessage,
2309 kerberos_DecryptMessage,
2310 kerberos_SetContextAttributesW,
2311 kerberos_SetCredentialsAttributesW,
2314BOOL KERBEROS_init(
void)
2316 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Name, KERBEROS_SecPkgInfoW_NameBuffer,
2317 ARRAYSIZE(KERBEROS_SecPkgInfoW_NameBuffer));
2318 InitializeConstWCharFromUtf8(KERBEROS_SecPkgInfoA.Comment, KERBEROS_SecPkgInfoW_CommentBuffer,
2319 ARRAYSIZE(KERBEROS_SecPkgInfoW_CommentBuffer));