You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
358 lines
9.6 KiB
358 lines
9.6 KiB
//+-----------------------------------------------------------------------
|
|
//
|
|
// Microsoft Windows
|
|
//
|
|
// Copyright (c) Microsoft Corporation 1992 - 1999
|
|
//
|
|
// File: tktlogon.cxx
|
|
//
|
|
// Contents: Code for proxy logon for the Kerberos package
|
|
//
|
|
//
|
|
// History: 15-March Created MikeSw
|
|
//
|
|
//------------------------------------------------------------------------
|
|
#include <kerb.hxx>
|
|
#include <kerbp.h>
|
|
|
|
#ifdef RETAIL_LOG_SUPPORT
|
|
static TCHAR THIS_FILE[]=TEXT(__FILE__);
|
|
#endif
|
|
|
|
//+-------------------------------------------------------------------------
|
|
//
|
|
// Function: KerbCreateTicketLogonSession
|
|
//
|
|
// Synopsis: Does all the work for a ticket logon, removing it from
|
|
// LsaApLogonUserEx2
|
|
//
|
|
// Effects:
|
|
//
|
|
// Arguments: WorkstationTicket - ticket to workstation. The ticket
|
|
// cache entry is pretty much empty except for
|
|
// the ticket, and is not linked
|
|
// ForwardedTgt - receives pointers into the Protocol
|
|
// SubmitBuffer to the forwarded TGT.
|
|
//
|
|
// Requires:
|
|
//
|
|
// Returns:
|
|
//
|
|
// Notes:
|
|
//
|
|
//
|
|
//--------------------------------------------------------------------------
|
|
|
|
NTSTATUS
|
|
KerbCreateTicketLogonSession(
|
|
IN PVOID ProtocolSubmitBuffer,
|
|
IN PVOID ClientBufferBase,
|
|
IN ULONG SubmitBufferSize,
|
|
IN SECURITY_LOGON_TYPE LogonType,
|
|
OUT PKERB_LOGON_SESSION * NewLogonSession,
|
|
OUT PLUID LogonId,
|
|
OUT PKERB_TICKET_CACHE_ENTRY * WorkstationTicket,
|
|
OUT PKERB_MESSAGE_BUFFER ForwardedTgt
|
|
)
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
PKERB_TICKET_LOGON LogonInfo = NULL;
|
|
PKERB_LOGON_SESSION LogonSession = NULL;
|
|
KERB_KDC_REPLY KdcReply = {0};
|
|
ULONG_PTR Offset;
|
|
UNICODE_STRING EmptyString = {0};
|
|
PKERB_TICKET Ticket = NULL;
|
|
KERBERR KerbErr;
|
|
|
|
|
|
|
|
*WorkstationTicket = NULL;
|
|
ForwardedTgt->Buffer = NULL;
|
|
ForwardedTgt->BufferSize = 0;
|
|
|
|
//
|
|
// Pull the interesting information out of the submit buffer
|
|
//
|
|
|
|
if (SubmitBufferSize < sizeof(KERB_TICKET_LOGON))
|
|
{
|
|
DebugLog((DEB_ERROR,"Submit buffer to logon too small: %d. %ws, line %d\n",SubmitBufferSize, THIS_FILE, __LINE__));
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
goto Cleanup;
|
|
}
|
|
|
|
LogonInfo = (PKERB_TICKET_LOGON) ProtocolSubmitBuffer;
|
|
|
|
DsysAssert((LogonInfo->MessageType == KerbTicketLogon) || (LogonInfo->MessageType == KerbTicketUnlockLogon));
|
|
|
|
|
|
|
|
|
|
//
|
|
// Relocate any pointers to be relative to 'LogonInfo'
|
|
//
|
|
|
|
|
|
Offset = ((PUCHAR) LogonInfo->ServiceTicket) - ((PUCHAR)ClientBufferBase);
|
|
if ( (Offset >= SubmitBufferSize) ||
|
|
(Offset + LogonInfo->ServiceTicketLength > SubmitBufferSize))
|
|
{
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
goto Cleanup;
|
|
}
|
|
LogonInfo->ServiceTicket = (PUCHAR) ProtocolSubmitBuffer + Offset;
|
|
|
|
if (LogonInfo->TicketGrantingTicketLength != 0)
|
|
{
|
|
if (LogonInfo->TicketGrantingTicket == NULL)
|
|
{
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
goto Cleanup;
|
|
}
|
|
|
|
Offset = ((PUCHAR) LogonInfo->TicketGrantingTicket) - ((PUCHAR)ClientBufferBase);
|
|
if ( (Offset >= SubmitBufferSize) ||
|
|
(Offset + LogonInfo->TicketGrantingTicketLength > SubmitBufferSize))
|
|
{
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
goto Cleanup;
|
|
}
|
|
LogonInfo->TicketGrantingTicket = (PUCHAR) ProtocolSubmitBuffer + Offset;
|
|
ForwardedTgt->BufferSize = LogonInfo->TicketGrantingTicketLength;
|
|
ForwardedTgt->Buffer = LogonInfo->TicketGrantingTicket;
|
|
}
|
|
|
|
|
|
//
|
|
// Allocate a locally unique ID for this logon session. We will
|
|
// create it in the LSA just before returning.
|
|
//
|
|
|
|
Status = NtAllocateLocallyUniqueId( LogonId );
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DebugLog((DEB_ERROR,"Failed to allocate locally unique ID: 0x%x. %ws, line %d\n",Status, THIS_FILE, __LINE__));
|
|
goto Cleanup;
|
|
}
|
|
|
|
|
|
//
|
|
// Build a logon session to hold all this information
|
|
//
|
|
|
|
Status = KerbCreateLogonSession(
|
|
LogonId,
|
|
&EmptyString,
|
|
&EmptyString,
|
|
NULL, // no password
|
|
NULL, // no old password
|
|
0, // no password options
|
|
0,
|
|
FALSE, // no dups - this is a primary logon
|
|
&LogonSession
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
goto Cleanup;
|
|
}
|
|
|
|
//
|
|
// Unpack the supplied service ticket
|
|
//
|
|
|
|
|
|
KerbErr = KerbUnpackData(
|
|
LogonInfo->ServiceTicket,
|
|
LogonInfo->ServiceTicketLength,
|
|
KERB_TICKET_PDU,
|
|
(PVOID *) &Ticket
|
|
);
|
|
if (!KERB_SUCCESS(KerbErr))
|
|
{
|
|
DebugLog((DEB_ERROR,"Failed to unpack service ticket in ticket logon\n"));
|
|
Status = KerbMapKerbError(KerbErr);
|
|
goto Cleanup;
|
|
}
|
|
|
|
//
|
|
// Build a ticket structure from the service ticket.
|
|
//
|
|
|
|
KdcReply.ticket = *Ticket;
|
|
|
|
Status = KerbCreateTicketCacheEntry(
|
|
&KdcReply,
|
|
NULL, // no kdc reply
|
|
NULL, // no target name
|
|
NULL, // no target realm
|
|
0, // no flags
|
|
NULL, // no ticket cache
|
|
NULL, // no credential key
|
|
WorkstationTicket
|
|
);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
goto Cleanup;
|
|
}
|
|
|
|
//
|
|
// Return the new logon session.
|
|
//
|
|
|
|
*NewLogonSession = LogonSession;
|
|
LogonSession = NULL;
|
|
|
|
Cleanup:
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
if (LogonSession != NULL)
|
|
{
|
|
KerbReferenceLogonSessionByPointer(LogonSession, TRUE);
|
|
KerbDereferenceLogonSession(LogonSession);
|
|
}
|
|
}
|
|
|
|
if (Ticket != NULL)
|
|
{
|
|
KerbFreeData(KERB_TICKET_PDU, Ticket);
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
|
|
|
|
//+-------------------------------------------------------------------------
|
|
//
|
|
// Function: KerbExtractForwardedTgt
|
|
//
|
|
// Synopsis: Extracts a forwarded TGT from its encoded representation
|
|
// and sticks it in the logon session ticket cache. This
|
|
// also updates the user name & domain name in the
|
|
// logon session, if they aren't present.
|
|
//
|
|
// Effects:
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Requires:
|
|
//
|
|
// Returns:
|
|
//
|
|
// Notes:
|
|
//
|
|
//
|
|
//--------------------------------------------------------------------------
|
|
|
|
NTSTATUS
|
|
KerbExtractForwardedTgt(
|
|
IN PKERB_LOGON_SESSION LogonSession,
|
|
IN PKERB_MESSAGE_BUFFER ForwardedTgt,
|
|
IN PKERB_ENCRYPTED_TICKET WorkstationTicket
|
|
)
|
|
{
|
|
PKERB_CRED KerbCred = NULL;
|
|
PKERB_ENCRYPTED_CRED EncryptedCred = NULL;
|
|
KERBERR KerbErr;
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
|
|
D_DebugLog((DEB_TRACE, "Extracting a forwarded TGT\n"));
|
|
|
|
KerbErr = KerbUnpackKerbCred(
|
|
ForwardedTgt->Buffer,
|
|
ForwardedTgt->BufferSize,
|
|
&KerbCred
|
|
);
|
|
if (!KERB_SUCCESS(KerbErr))
|
|
{
|
|
DebugLog((DEB_WARN, "Failed to unpack kerb cred for forwaded tgt\n"));
|
|
Status = KerbMapKerbError(KerbErr);
|
|
goto Cleanup;
|
|
|
|
}
|
|
|
|
//
|
|
// Now decrypt the encrypted part of the KerbCred.
|
|
//
|
|
|
|
KerbErr = KerbDecryptDataEx(
|
|
&KerbCred->encrypted_part,
|
|
&WorkstationTicket->key,
|
|
KERB_CRED_SALT,
|
|
(PULONG) &KerbCred->encrypted_part.cipher_text.length,
|
|
KerbCred->encrypted_part.cipher_text.value
|
|
);
|
|
|
|
|
|
if (!KERB_SUCCESS(KerbErr))
|
|
{
|
|
DebugLog((DEB_ERROR,"Failed to decrypt KERB_CRED: 0x%x. %ws, line %d\n",KerbErr, THIS_FILE, __LINE__));
|
|
if (KerbErr == KRB_ERR_GENERIC)
|
|
{
|
|
Status = KerbMapKerbError(KerbErr);
|
|
goto Cleanup;
|
|
}
|
|
else
|
|
{
|
|
Status = STATUS_LOGON_FAILURE;
|
|
|
|
//
|
|
// MIT clients don't encrypt the encrypted part, so drop through
|
|
//
|
|
|
|
}
|
|
}
|
|
|
|
//
|
|
// Now unpack the encrypted part.
|
|
//
|
|
|
|
KerbErr = KerbUnpackEncryptedCred(
|
|
KerbCred->encrypted_part.cipher_text.value,
|
|
KerbCred->encrypted_part.cipher_text.length,
|
|
&EncryptedCred
|
|
);
|
|
if (!KERB_SUCCESS(KerbErr))
|
|
{
|
|
//
|
|
// Use the old status if it is available.
|
|
//
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = KerbMapKerbError(KerbErr);
|
|
}
|
|
DebugLog((DEB_WARN, "Failed to unpack encrypted cred\n"));
|
|
goto Cleanup;
|
|
}
|
|
|
|
//
|
|
// Now build a logon session.
|
|
//
|
|
|
|
Status = KerbCreateLogonSessionFromKerbCred(
|
|
NULL,
|
|
WorkstationTicket,
|
|
KerbCred,
|
|
EncryptedCred,
|
|
&LogonSession
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DebugLog((DEB_ERROR,"Failed to create logon session from kerb cred: 0x%x. %ws, line %d\n",Status, THIS_FILE, __LINE__));
|
|
goto Cleanup;
|
|
}
|
|
|
|
Cleanup:
|
|
if (EncryptedCred != NULL)
|
|
{
|
|
KerbFreeEncryptedCred(EncryptedCred);
|
|
}
|
|
if (KerbCred != NULL)
|
|
{
|
|
KerbFreeKerbCred(KerbCred);
|
|
}
|
|
return(Status);
|
|
|
|
}
|