//+----------------------------------------------------------------------- // // Microsoft Windows // // Copyright (c) Microsoft Corporation 2000 // // File: ctxtapi.cxx // // Contents: Context APIs for the Digest security package // Main entry points into this dll: // SpDeleteContext // SpInitLsaModeContext // SpApplyControlToken // SpAcceptLsaModeContext // // History: KDamour 16Mar00 Based from NTLM ctxtapi.cxx // //------------------------------------------------------------------------ extern "C" { #include } #include "global.h" extern "C" { #include // DS_USER_PRINCIPAL_NAME #include // CrackSingleName } #define MAXBUFNUMLEN 9 // VERY BIG number of digits in maxbuf //+------------------------------------------------------------------------- // // Function: SpDeleteContext // // Synopsis: Deletes an NtDigest context // // Deletes the local data structures associated with the specified // security context in the LSA. // // This API terminates a context on the local machine. // // Effects: // // Arguments: ContextHandle - The context to delete // // Requires: // // Returns: STATUS_SUCCESS or STATUS_INVALID_HANDLE // // Notes: // // //-------------------------------------------------------------------------- NTSTATUS NTAPI SpDeleteContext( IN ULONG_PTR ContextHandle ) { DebugLog((DEB_TRACE_FUNC, "SpDeleteContext: Entering ContextHandle 0x%lx\n", ContextHandle )); PDIGEST_CONTEXT pContext = NULL; NTSTATUS Status = STATUS_SUCCESS; // // Find the currently existing user context and delink it // so that another context cannot Reference it before we // Dereference this one. // Status = CtxtHandlerHandleToContext(ContextHandle, TRUE, &pContext); if (!NT_SUCCESS(Status)) { Status = STATUS_SUCCESS; DebugLog((DEB_TRACE, "SpDeleteContext: CtxtHandlerHandleToContext not found 0x%x\n", Status )); goto CleanUp; } // Now deference - there may be other references from pointer references (from Handles) // inside the LSA but will be released if (pContext) { Status = CtxtHandlerRelease(pContext); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpDeleteContext: DereferenceUserContext error Status 0x%x\n", Status )); } } CleanUp: DebugLog((DEB_TRACE_FUNC, "SpDeleteContext: Leaving ContextHandle 0x%lx status 0x%x\n", ContextHandle, Status )); return(Status); } //+------------------------------------------------------------------------- // // Function: SpInitLsaModeContext // // Synopsis: Digest implementation of InitializeSecurityContext // while in Lsa mode. If we return TRUE in *MappedContext, // secur32 will call SpInitUserModeContext with // the returned context handle and ContextData // as input. Fill in whatever info needed for // the user mode APIs // // Effects: // // Arguments: // // Requires: // // Returns: // // Notes: // //-------------------------------------------------------------------------- NTSTATUS NTAPI SpInitLsaModeContext( IN OPTIONAL ULONG_PTR CredentialHandle, IN OPTIONAL ULONG_PTR OldContextHandle, IN OPTIONAL PUNICODE_STRING pustrTargetName, IN ULONG fContextReqFlags, IN ULONG TargetDataRep, IN PSecBufferDesc InputBuffers, OUT PULONG_PTR NewContextHandle, IN OUT PSecBufferDesc OutputBuffers, OUT PULONG fContextAttributes, OUT PTimeStamp pExpirationTime, OUT PBOOLEAN MappedContext, OUT PSecBuffer ContextData ) { NTSTATUS Status = STATUS_SUCCESS; NTSTATUS SubStatus = STATUS_SUCCESS; DebugLog((DEB_TRACE_FUNC, "SpInitLsaModeContext: Entering ContextHandle 0x%x\n", OldContextHandle)); SecBuffer TempTokens[6]; PSecBuffer pChalInputToken; PSecBuffer pMethodInputToken; PSecBuffer pHEntityInputToken; PSecBuffer pOutputToken; DIGEST_PARAMETER Digest; PDIGEST_CONTEXT pNewContext = NULL; // keep pointer to release new context on error PDIGEST_CONTEXT pContext = NULL; // used to update the context BOOL bLockedContext = FALSE; // if we obtained a refcount on a Context BOOL fDefChars = FALSE; // were default chars utilized in Unicode encoding int iTemp = 0; SecBuffer ReplyBuffer; // Output is generated in this buffer char *cptr = NULL; ULONG fContextAttr = ISC_REQ_REPLAY_DETECT; // Flags on the Attributes of the context DIGEST_TYPE typeDigest = NO_DIGEST_SPECIFIED; QOP_TYPE typeQOP = NO_QOP_SPECIFIED; ALGORITHM_TYPE typeAlgorithm = NO_ALGORITHM_SPECIFIED; CHARSET_TYPE typeCharset = ISO_8859_1; DIGESTMODE_TYPE typeDigestMode = DIGESTMODE_UNDEFINED; // are we in SASL or HTTP mode PDIGEST_CREDENTIAL pCredential = NULL; STRING strcSASLMethod; STRING strcSASLHEntity; STRING strcNC; STRING strTargetName; // Verify Args if (!fContextAttributes || !NewContextHandle || !OutputBuffers) { DebugLog((DEB_ERROR, "SpInitLsaModeContext: Invalid arg (possible NULL pointer)\n")); return STATUS_INVALID_PARAMETER; } *fContextAttributes = 0; *NewContextHandle = NULL; if (pExpirationTime) { *pExpirationTime = g_TimeForever; } *MappedContext = FALSE; ContextData->pvBuffer = NULL; ContextData->cbBuffer = 0; // Create pointers to tokens for processing pChalInputToken = &TempTokens[0]; pMethodInputToken = &TempTokens[1]; pHEntityInputToken = &TempTokens[3]; pOutputToken = &TempTokens[4]; DigestInit(&Digest); ZeroMemory(TempTokens,sizeof(TempTokens)); ZeroMemory(&strTargetName, sizeof(strTargetName)); ZeroMemory(&ReplyBuffer, sizeof(ReplyBuffer)); // Must have a Credential Handle to perform processing - will ref count Status = CredHandlerHandleToPtr(CredentialHandle, FALSE, &pCredential); if (!NT_SUCCESS(Status)) { Status = SEC_E_UNKNOWN_CREDENTIALS; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Could not locate the Credential\n")); goto CleanUp; } // Verify that credential is marked OUTBOUND for ASC call if (!(pCredential->CredentialUseFlags & DIGEST_CRED_OUTBOUND)) { Status = SEC_E_NOT_SUPPORTED; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Credential not marked for Outbound connections\n")); goto CleanUp; } // Retrieve the information from the SecBuffers & check proper formattting // Check for NULL input for InputBuffers - as is done for 1st call to ISC if (InputBuffers && (InputBuffers->cBuffers)) { if ( !SspGetTokenBufferByIndex( InputBuffers, 0, // get the first SECBUFFER_TOKEN &pChalInputToken, TRUE ) || !ContextIsTokenOK(pChalInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: SspGetTokenBufferByIndex (ChalRspInputToken) status 0x%x\n", Status)); goto CleanUp; } } // Process the output buffer if ( !SspGetTokenBufferByIndex( OutputBuffers, 0, // get the first SECBUFFER_TOKEN &pOutputToken, FALSE ) || !ContextIsTokenOK(pOutputToken, 0)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: SspGetTokenBufferByIndex (OutputToken) status 0x%x\n", Status)); goto CleanUp; } if (fContextReqFlags & ISC_REQ_ALLOCATE_MEMORY) { pOutputToken->pvBuffer = NULL; pOutputToken->cbBuffer = 0; } // To support SASL's call to ISC BEFORE any calls to ASC just return SEC_I_CONTINUE_NEEDED if (pChalInputToken->cbBuffer <= 1) { // Need to create a context for this connection - destroy if unsuccessful auth pNewContext = (PDIGEST_CONTEXT)DigestAllocateMemory(sizeof(DIGEST_CONTEXT)); if (!pNewContext) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR, "SpInitLsaModeContext: ISC empty context - Out of memory on challenge context\n")); goto CleanUp; } CredPrint(pCredential); // Initialize new context Status = ContextInit(pNewContext, pCredential); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext: ISC empty context - ContextInit error status 0x%x\n", Status)); goto CleanUp; } Status = SEC_I_CONTINUE_NEEDED; // Have no input for processing pOutputToken->cbBuffer = 0; // No output buffer DebugLog((DEB_TRACE, "SpInitLsaModeContext: ISC empty context - Called with no Input Buffer Status 0x%x\n", Status)); // Add the Newly created Context into the list of Contexts pNewContext->lReferences = 1; // pass reference back to ISC caller CtxtHandlerInsertCred(pNewContext); // pContext = pNewContext; // set to have dereferenced *NewContextHandle = (ULONG_PTR)pNewContext; // Just report back with the updated context *fContextAttributes = fContextAttr; // Return the ISC Attributes set on Context // bLockedContext = TRUE; // Release memory to CtxtHandler pNewContext = NULL; // We no longer own this memory - turned over to CtxtHandler goto CleanUp; } // Verify SecBuffer inputs - both SASL and HTTP require atleast 1 buffer if (!InputBuffers || !InputBuffers->cBuffers) { DebugLog((DEB_ERROR, "SpInitLsaModeContext: Invalid SecBufferDesc\n")); return STATUS_INVALID_PARAMETER; } // We have input in the SECBUFFER 0th location - parse it Status = DigestParser2(pChalInputToken, MD5_AUTH_NAMES, MD5_AUTH_LAST, &Digest); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext: DigestParser error status 0x%x\n", Status)); goto CleanUp; } // Check to see if we have an old context passed in or need to create a new one if (OldContextHandle) { // Old Context passed in - locate the security context and use that DebugLog((DEB_TRACE, "SpInitLsaModeContext: Passed in OldContextHandle 0x%lx - lookup in list\n", OldContextHandle)); Status = CtxtHandlerHandleToContext(OldContextHandle, FALSE, &pContext); if (!NT_SUCCESS (Status)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: CtxtHandlerHandleToContext error 0x%x\n", Status)); goto CleanUp; } bLockedContext = TRUE; } else { // Need to create a context for this connection - destroy if unsuccessful auth DebugLog((DEB_TRACE, "SpInitLsaModeContext: No OldContextHandle - create new Context\n")); pNewContext = (PDIGEST_CONTEXT)DigestAllocateMemory(sizeof(DIGEST_CONTEXT)); if (!pNewContext) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR, "SpInitLsaModeContext: out of memory on challenge context\n")); goto CleanUp; } CredPrint(pCredential); // Initialize new context Status = ContextInit(pNewContext, pCredential); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext: ContextInit error status 0x%x\n", Status)); goto CleanUp; } pContext = pNewContext; // for filling in the context information DebugLog((DEB_TRACE, "SpInitLsaModeContext: New Context Created 0x%x\n", pContext)); } if (pContext && pContext->strResponseAuth.Length) { // We have already generated session key from challenge response // now checking response auth from server if (Digest.refstrParam[MD5_AUTH_RSPAUTH].Length != MD5_HASH_HEX_SIZE) { Status = STATUS_MUTUAL_AUTHENTICATION_FAILED; DebugLog((DEB_ERROR, "SpInitLsaModeContext: RspAuth incorrect size\n")); goto CleanUp; } // Now compare the response auth strings if (!RtlEqualString(&(pContext->strResponseAuth), &(Digest.refstrParam[MD5_AUTH_RSPAUTH]), FALSE)) { Status = STATUS_MUTUAL_AUTHENTICATION_FAILED; DebugLog((DEB_ERROR, "SpInitLsaModeContext: RspAuth is incorrect\n")); goto CleanUp; } DebugLog((DEB_TRACE, "SpInitLsaModeContext: RspAuth matches!\n")); // ResponseAuth is verified - generate mapped context *fContextAttributes = pContext->ContextReq; // Return the ISC Attributes set on Context *NewContextHandle = (ULONG_PTR)pContext; // Just report back with the updated context pOutputToken->cbBuffer = 0; // No output buffer if (pExpirationTime) { *pExpirationTime = pContext->PasswordExpires; } Status = SspMapDigestContext(pContext, NULL , ContextData); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext, SspMapContext Status 0x%x\n", Status)); goto CleanUp; } // this is final call, indicate to map the context *MappedContext = TRUE; goto CleanUp; } // Determine if we are in HTTP or SASL mode // SASL mode has 1 or less buffers provided, HTTP has 3 if (InputBuffers->cBuffers > 1) { typeDigestMode = DIGESTMODE_HTTP; } else { typeDigestMode = DIGESTMODE_SASL; } // HTTP has special Buffer needs in that it must pass in the METHOD, HEntity if (typeDigestMode == DIGESTMODE_HTTP) { if ( !SspGetTokenBufferByIndex( InputBuffers, 1, // get the second SECBUFFER_TOKEN &pMethodInputToken, TRUE ) || !ContextIsTokenOK(pMethodInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE)) { // Check to make sure that string is present Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: SspGetTokenBufferByIndex (MethodInputToken) status 0x%x\n", Status)); goto CleanUp; } if ( !SspGetTokenBufferByIndex( InputBuffers, 2, // get the third SECBUFFER_TOKEN &pHEntityInputToken, TRUE ) || !ContextIsTokenOK(pHEntityInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: SspGetTokenBufferByIndex (HEntityInputToken) status 0x%x\n", Status)); goto CleanUp; } // Verify that there is a valid Method provided if (!pMethodInputToken->pvBuffer || !pMethodInputToken->cbBuffer || (PBUFFERTYPE(pMethodInputToken) != SECBUFFER_PKG_PARAMS)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Method SecBuffer must have valid method string status 0x%x\n", Status)); goto CleanUp; } iTemp = strlencounted((char *)pMethodInputToken->pvBuffer, pMethodInputToken->cbBuffer); if (!iTemp) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Method SecBuffer must have valid method string status 0x%x\n", Status)); goto CleanUp; } Digest.refstrParam[MD5_AUTH_METHOD].Length = (USHORT)iTemp; Digest.refstrParam[MD5_AUTH_METHOD].MaximumLength = (unsigned short)(pMethodInputToken->cbBuffer); Digest.refstrParam[MD5_AUTH_METHOD].Buffer = (char *)pMethodInputToken->pvBuffer; // refernce memory - no alloc!!!! // Check to see if we have H(Entity) data to utilize if (pHEntityInputToken->cbBuffer) { // Verify that there is a valid Method provided if (!pHEntityInputToken->pvBuffer || (PBUFFERTYPE(pMethodInputToken) != SECBUFFER_PKG_PARAMS)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: HEntity SecBuffer must have valid string status 0x%x\n", Status)); goto CleanUp; } iTemp = strlencounted((char *)pHEntityInputToken->pvBuffer, pHEntityInputToken->cbBuffer); if ((iTemp != 0) && (iTemp != (MD5_HASH_BYTESIZE * 2))) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: HEntity SecBuffer must have valid MD5 Hash data 0x%x\n", Status)); goto CleanUp; } if (iTemp) { Digest.refstrParam[MD5_AUTH_HENTITY].Length = (USHORT)iTemp; Digest.refstrParam[MD5_AUTH_HENTITY].MaximumLength = (unsigned short)(pHEntityInputToken->cbBuffer); Digest.refstrParam[MD5_AUTH_HENTITY].Buffer = (char *)pHEntityInputToken->pvBuffer; // refernce memory - no alloc!!!! } } typeDigest = DIGEST_CLIENT; // Determine which Algorithm to support under HTTP Status = CheckItemInList(MD5_SESSSTR, &(Digest.refstrParam[MD5_AUTH_ALGORITHM]), FALSE); if (!NT_SUCCESS(Status)) { // Check if MD5 specified (or none specified so MD5 defaults) Status = CheckItemInList(MD5STR, &(Digest.refstrParam[MD5_AUTH_ALGORITHM]), FALSE); if (NT_SUCCESS(Status) || (Digest.refstrParam[MD5_AUTH_ALGORITHM].Length == 0)) { typeAlgorithm = MD5; DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server allows MD5 (or defaulted); selected as algorithm\n")); } else { Status = SEC_E_QOP_NOT_SUPPORTED; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Unknown Server algorithms provided\n")); goto CleanUp; } } else { typeAlgorithm = MD5_SESS; fContextAttr |= (ISC_RET_REPLAY_DETECT | ISC_RET_SEQUENCE_DETECT); DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server allows MD5-sess; selected as algorithm\n")); } } else { // All others follow the SASL Interface so there are default values typeDigest = SASL_CLIENT; fContextAttr |= ISC_RET_MUTUAL_AUTH; // require response auth from server // SASL supports only MD5-Sess verify that server offered this Status = CheckItemInList(MD5_SESSSTR, &(Digest.refstrParam[MD5_AUTH_ALGORITHM]), FALSE); if (!NT_SUCCESS(Status)) { Status = SEC_E_QOP_NOT_SUPPORTED; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Unknown Server algorithm provided\n")); goto CleanUp; } else { typeAlgorithm = MD5_SESS; fContextAttr |= (ISC_RET_REPLAY_DETECT | ISC_RET_SEQUENCE_DETECT); DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server allows MD5-sess; selected as algorithm\n")); } // Set Method to Authenticate RtlInitString(&strcSASLMethod, AUTHENTICATESTR); StringReference(&(Digest.refstrParam[MD5_AUTH_METHOD]), &strcSASLMethod); // refernce memory - no alloc!!!! RtlInitString(&strcSASLHEntity, ZERO32STR); StringReference(&(Digest.refstrParam[MD5_AUTH_HENTITY]), &strcSASLHEntity); // refernce memory - no alloc!!!! } // Determine if we can process the QOP specified - check return in client if consistent if (fContextReqFlags & ISC_REQ_CONFIDENTIALITY) { // make sure that server presented the auth-conf option Status = CheckItemInList(AUTHCONFSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), FALSE); if (!NT_SUCCESS(Status)) { // Failed to provide necessary QOP Status = SEC_E_QOP_NOT_SUPPORTED; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Server failed to provide QOP=AUTH-CONF\n")); goto CleanUp; } // OK agreed to QOP fContextAttr |= (ISC_RET_CONFIDENTIALITY | ISC_RET_INTEGRITY); typeQOP = AUTH_CONF; } else if (fContextReqFlags & ISC_REQ_INTEGRITY) { // make sure that server presented the auth-int option Status = CheckItemInList(AUTHINTSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), FALSE); if (!NT_SUCCESS(Status)) { // Failed to provide necessary QOP Status = SEC_E_QOP_NOT_SUPPORTED; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Server failed to provide QOP=AUTH-INT\n")); goto CleanUp; } // OK agreed to QOP fContextAttr |= ISC_RET_INTEGRITY; typeQOP = AUTH_INT; DebugLog((DEB_TRACE, "SpInitLsaModeContext: Client selected QOP=AUTH-INT\n")); } else { // no client specified QOP so use auth if allowed (backwards compat may have no QOP presented from server) Status = CheckItemInList(AUTHSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), FALSE); if (!NT_SUCCESS(Status)) { // either QOP is not specified or all options are unknown if (Digest.refstrParam[MD5_AUTH_QOP].Length == 0) { // Backwards compatibility with RFC 2069 typeQOP = NO_QOP_SPECIFIED; DebugLog((DEB_TRACE, "SpInitLsaModeContext: No QOP specified - back compat with RFC 2069\n")); } else { Status = SEC_E_QOP_NOT_SUPPORTED; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Server failed to provide QOP=AUTH\n")); goto CleanUp; } } else { // defaulting to AUTH typeQOP = AUTH; DebugLog((DEB_TRACE, "SpInitLsaModeContext: Client selected QOP=AUTH by default\n")); } } // Check to see if the Server has provided character set for encoding - only UTF-8 accepted Status = CheckItemInList(MD5_UTF8STR, &(Digest.refstrParam[MD5_AUTH_CHARSET]), TRUE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server allows UTF-8 encoding\n")); // Determine which character set to utilize if (((typeDigest == SASL_CLIENT) && (g_fParameter_UTF8SASL == TRUE)) || ((typeDigest == DIGEST_CLIENT) && (g_fParameter_UTF8HTTP == TRUE))) { typeCharset = UTF_8; DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selected UTF-8 encoding\n")); } else { typeCharset = ISO_8859_1; DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selected ISO 8859-1 encoding\n")); } } // Pull in the URI provided in TargetName - replace any value in challenge string - link ONLY no allocate if (!pustrTargetName) { Status = SEC_E_TARGET_UNKNOWN; DebugLog((DEB_ERROR, "SpInitLsaModeContext: URI TargetName must have valid UnicodeString\n")); goto CleanUp; } Status = EncodeUnicodeString(pustrTargetName, CP_8859_1, &strTargetName, &fDefChars); if (!NT_SUCCESS(Status)) { DebugLog((DEB_WARN, "SpInitLsaModeContext: Error in encoding target URI in ISO-8859-1\n")); goto CleanUp; } if (fDefChars == TRUE) { // We could not encode the provided target URI within ISO 8859-1 characters DebugLog((DEB_ERROR, "SpInitLsaModeContext: Target URI can not be encoded in ISO 8859-1\n")); Status = STATUS_UNMAPPABLE_CHARACTER; goto CleanUp; } StringReference(&(Digest.refstrParam[MD5_AUTH_URI]), &strTargetName); // refernce memory - no alloc!!!! // Create the CNonce Status = OpaqueCreate(&(pContext->strCNonce)); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext: OpaqueCreate for CNonce status 0x%x\n", Status)); goto CleanUp; } // Establish the Client Nonce StringReference(&(Digest.refstrParam[MD5_AUTH_CNONCE]), &(pContext->strCNonce)); // refernce memory - no alloc!!!! // Keep a copy of the Nonce and Cnonce for future Delegation requests (actually not used in client ISC) Status = StringDuplicate(&pContext->strNonce, &Digest.refstrParam[MD5_AUTH_NONCE]); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext: StringDuplicate CNonce failed status 0x%x\n", Status)); goto CleanUp; } // check to make sure that there was an initial Realm provided if ((typeDigestMode == DIGESTMODE_HTTP) && (!Digest.refstrParam[MD5_AUTH_REALM].Length)) { Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "SpInitLsaModeContext: Server failed to provide a Realm in Challenge status 0x%x\n", Status)); goto CleanUp; } RtlInitString(&strcNC, NCFIRST); StringReference(&(Digest.refstrParam[MD5_AUTH_NC]), &strcNC); // refernce memory - no alloc!!!! // Set the type of Digest Parameters we are to process pContext->typeDigest = typeDigest; pContext->typeAlgorithm = typeAlgorithm; pContext->typeQOP = typeQOP; pContext->typeCipher = CIPHER_UNDEFINED; pContext->typeCharset = typeCharset; // Digest parameter will be set in DigestGenerateParameters call if (pContext->typeQOP == AUTH_CONF) { // Check if server offered RC4 Most cases this will be the cipher selected Status = CheckItemInList(STR_CIPHER_RC4, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting RC4 for auth-conf cipher\n")); pContext->typeCipher = CIPHER_RC4; } else { Status = CheckItemInList(STR_CIPHER_3DES, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting Triple DES for auth-conf cipher\n")); pContext->typeCipher = CIPHER_3DES; } else { Status = CheckItemInList(STR_CIPHER_RC4_56, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting RC4-56 for auth-conf cipher\n")); pContext->typeCipher = CIPHER_RC4_56; } else { Status = CheckItemInList(STR_CIPHER_RC4_40, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting RC4-40 for auth-conf cipher\n")); pContext->typeCipher = CIPHER_RC4_40; } else { Status = CheckItemInList(STR_CIPHER_DES, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting DES for auth-conf cipher\n")); pContext->typeCipher = CIPHER_DES; } else { DebugLog((DEB_ERROR, "SpInitLsaModeContext: Failed to find known ciper in list\n")); Status = STATUS_CRYPTO_SYSTEM_INVALID; goto CleanUp; } } } } } } // Check if server specified a MaxBuffer if (Digest.refstrParam[MD5_AUTH_MAXBUF].Length && Digest.refstrParam[MD5_AUTH_MAXBUF].Buffer) { if (Digest.refstrParam[MD5_AUTH_MAXBUF].Length < MAXBUFNUMLEN) { ULONG ulMaxBuf = 0; CHAR czMaxBuf[MAXBUFNUMLEN + 1]; ZeroMemory(czMaxBuf, (MAXBUFNUMLEN + 1)); memcpy(czMaxBuf, Digest.refstrParam[MD5_AUTH_MAXBUF].Buffer, Digest.refstrParam[MD5_AUTH_MAXBUF].Length); Status = RtlCharToInteger(czMaxBuf, TENBASE, &ulMaxBuf); if (!NT_SUCCESS(Status)) { Status = SEC_E_ILLEGAL_MESSAGE; DebugLog((DEB_ERROR, "SpInitLsaModeContext: MaxBuf directive value malformed 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server MaxBuf set to %lu\n", ulMaxBuf)); pContext->ulSendMaxBuf = ulMaxBuf; } else { Status = SEC_E_ILLEGAL_MESSAGE; DebugLog((DEB_ERROR, "SpInitLsaModeContext: MaxBuf directive value too large 0x%x\n", Status)); goto CleanUp; } } // We now have completed setup for the digest fields - time to process the data DebugLog((DEB_TRACE, "SpInitLsaModeContext: Digest inputs processing completed\n")); ContextPrint(pContext); Status = DigestGenerateParameters(pContext, &Digest, &ReplyBuffer); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext: DigestGenerateParameters error status 0x%x\n", Status)); goto CleanUp; } // Now transfer the Challenge buffer to the ouput secbuffer if ((fContextReqFlags & ISC_REQ_ALLOCATE_MEMORY) == 0) { if (pOutputToken->cbBuffer < ReplyBuffer.cbBuffer) { DebugLog((DEB_ERROR,"SpInitLsaModeContext: Output token is too small - sent in %d, needed %d\n", pOutputToken->cbBuffer, ReplyBuffer.cbBuffer)); pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; Status = STATUS_BUFFER_TOO_SMALL; goto CleanUp; } RtlCopyMemory(pOutputToken->pvBuffer, ReplyBuffer.pvBuffer, ReplyBuffer.cbBuffer); pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; } else { pOutputToken->pvBuffer = ReplyBuffer.pvBuffer; pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; ReplyBuffer.pvBuffer = NULL; ReplyBuffer.cbBuffer = 0; fContextAttr |= ISC_RET_ALLOCATED_MEMORY; } pContext->ContextReq = fContextAttr; pContext->PasswordExpires = g_TimeForever; // never expire *fContextAttributes = pContext->ContextReq; // Return the ISC Attributes set on Context *NewContextHandle = (ULONG_PTR)pContext; // Just report back with the updated context if (pExpirationTime) { *pExpirationTime = pContext->PasswordExpires; DebugLog((DEB_TRACE, "SpInitLsaModeContext: Context Expiration TimeStamp high/low 0x%x/0x%x\n", pExpirationTime->HighPart, pExpirationTime->LowPart)); } // Check if need to check server's response auth if (pContext->ContextReq & ISC_RET_MUTUAL_AUTH) { // Calculate the expected response auth from the server Status = DigestCalculateResponseAuth(&Digest, &(pContext->strResponseAuth)); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext, DigestCalculateResponseAuth Status 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "SpInitLsaModeContext: Pre-calculated RspAuth %Z\n", &(pContext->strResponseAuth))); // Keep copy of digest values for context map on last ISC call for (iTemp = 0; iTemp < MD5_AUTH_LAST; iTemp++) { StringDuplicate(&pContext->strDirective[iTemp], &(Digest.refstrParam[iTemp])); } // Need to verify the output from final ASC call to verify server has session key Status = SEC_I_CONTINUE_NEEDED; } else { Status = SspMapDigestContext(pContext, &Digest, ContextData); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpInitLsaModeContext, SspMapContext Status 0x%x\n", Status)); goto CleanUp; } // this is last call, indicate to map the context *MappedContext = TRUE; } // Add the Newly created Context into the list of Contexts unless it was there before if (pNewContext) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: Added context 0x%x\n", pNewContext)); pNewContext->lReferences = 1; CtxtHandlerInsertCred(pNewContext); // bLockedContext = TRUE; // Release memory to CtxtHandler pNewContext = NULL; // We no longer own this memory - turned over to CtxtHandler } DebugLog((DEB_TRACE, "SpInitLsaModeContext: Will create UserContext on exit\n")); CleanUp: // Failed to complete operations if non-NULL so clean up if (pNewContext) { ContextFree(pNewContext); pNewContext = NULL; } // DeReference - pCredential if (pCredential) { SubStatus = CredHandlerRelease(pCredential); if (!NT_SUCCESS(SubStatus)) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: CredHandlerRelease error Status 0x%x\n", SubStatus)); if (NT_SUCCESS(Status)) { Status = SubStatus; // Indicate release error } } pCredential = NULL; } if (bLockedContext && pContext) { // happened only if ref counted a SecurityContext SubStatus = CtxtHandlerRelease(pContext); if (!NT_SUCCESS(SubStatus)) { DebugLog((DEB_TRACE, "SpInitLsaModeContext: CtxtHandlerRelease error Status 0x%x\n", SubStatus)); if (NT_SUCCESS(Status)) { Status = SubStatus; // Indicate release error } } pContext = NULL; } // Free up any allocated memory from the ouput reply buffer if (ReplyBuffer.pvBuffer) { DigestFreeMemory(ReplyBuffer.pvBuffer); ReplyBuffer.pvBuffer = NULL; ReplyBuffer.cbBuffer = 0; } // Clean up local memory used by Digest DigestFree(&Digest); StringFree(&strTargetName); DebugLog((DEB_TRACE, "SpInitLsaModeContext: Mapped context %d Flags IN:0x%lx OUT:0x%lx\n", *MappedContext, fContextReqFlags,*fContextAttributes)); DebugLog((DEB_TRACE_FUNC, "SpInitLsaModeContext: Leaving Context 0x%x Status 0x%x\n", *NewContextHandle, Status)); return(Status); } NTSTATUS NTAPI SpApplyControlToken( IN ULONG_PTR ContextHandle, IN PSecBufferDesc ControlToken ) { DebugLog((DEB_TRACE_FUNC, "SpApplyControlToken: Entering/Leaving \n")); UNREFERENCED_PARAMETER(ContextHandle); UNREFERENCED_PARAMETER(ControlToken); return(SEC_E_UNSUPPORTED_FUNCTION); } //+------------------------------------------------------------------------- // // Function: SpAcceptLsaModeContext // // Synopsis: Digest implementation of AcceptSecurityContext call. // // Effects: // // Arguments: // CredentialHandle - Handle to the credentials to be used to // create the context. // // OldContextHandle - Handle to the partially formed context, if this is // a second call (see above) or NULL if this is the first call. // // InputToken - Pointer to the input token. In the first call this // token can either be NULL or may contain security package specific // information. // // ContextReqFlags - Requirements of the context, package specific. // // #define ASC_REQ_REPLAY_DETECT 0x00000004 // #define ASC_REQ_SEQUENCE_DETECT 0x00000008 // #define ASC_REQ_CONFIDENTIALITY 0x00000010 // #define ASC_REQ_ALLOCATE_MEMORY 0x00000100 // // TargetDataRep - Long indicating the data representation (byte ordering, etc) // on the target. The constant SECURITY_NATIVE_DREP may be supplied // by the transport indicating that the native format is in use. // // NewContextHandle - New context handle. If this is a second call, this // can be the same as OldContextHandle. // // OutputToken - Buffer to receive the output token. // // ContextAttributes -Attributes of the context established. // // #define ASC_RET_REPLAY_DETECT 0x00000004 // #define ASC_RET_SEQUENCE_DETECT 0x00000008 // #define ASC_RET_CONFIDENTIALITY 0x00000010 // #define ASC_RET_ALLOCATED_BUFFERS 0x00000100 // // ExpirationTime - Expiration time of the context. // // // Requires: // // Returns: // STATUS_SUCCESS - Message handled // SEC_I_CONTINUE_NEEDED -- Caller should call again later // // SEC_E_NO_SPM -- Security Support Provider is not running // SEC_E_INVALID_TOKEN -- Token improperly formatted // SEC_E_INVALID_HANDLE -- Credential/Context Handle is invalid // SEC_E_BUFFER_TOO_SMALL -- Buffer for output token isn't big enough // SEC_E_LOGON_DENIED -- User is no allowed to logon to this server // SEC_E_INSUFFICIENT_MEMORY -- Not enough memory // // Notes: // //-------------------------------------------------------------------------- NTSTATUS NTAPI SpAcceptLsaModeContext( IN OPTIONAL ULONG_PTR CredentialHandle, IN OPTIONAL ULONG_PTR OldContextHandle, IN PSecBufferDesc InputBuffers, IN ULONG fContextReqFlags, IN ULONG TargetDataRep, OUT PULONG_PTR NewContextHandle, OUT PSecBufferDesc OutputBuffers, OUT PULONG fContextAttributes, OUT PTimeStamp pExpirationTime, OUT PBOOLEAN MappedContext, OUT PSecBuffer ContextData ) { NTSTATUS Status = STATUS_SUCCESS; NTSTATUS SubStatus = STATUS_SUCCESS; NTSTATUS AuditLogStatus = STATUS_SUCCESS; DebugLog((DEB_TRACE_FUNC, "SpAcceptLsaModeContext: Entering \n")); SecBuffer TempTokens[6]; PSecBuffer pChalRspInputToken; PSecBuffer pMethodInputToken; PSecBuffer pURIInputToken; PSecBuffer pHEntityInputToken; PSecBuffer pOutputToken; PSecBuffer pRealmInputToken; DIGEST_PARAMETER Digest; PDIGEST_CONTEXT pNewContext = NULL; // keep pointer to release new context on error BOOL bLockedCredential = FALSE; BOOL bLockedContext = FALSE; BOOL fLogonSessionCreated = FALSE; SecBuffer ReplyBuffer; // Output is generated in this buffer int iTemp = 0; char *cptr = NULL; ULONG fContextAttr = ASC_REQ_REPLAY_DETECT; // Flags on the Attributes of the context DIGEST_TYPE typeDigest = NO_DIGEST_SPECIFIED; QOP_TYPE typeQOP = NO_QOP_SPECIFIED; ALGORITHM_TYPE typeAlgorithm = NO_ALGORITHM_SPECIFIED; CHARSET_TYPE typeCharset = ISO_8859_1; DIGESTMODE_TYPE typeDigestMode = DIGESTMODE_UNDEFINED; // Are we in SASL or HTTP mode LARGE_INTEGER liContextTime = { 0xFFFFFFFF, 0x7FFFFFFF }; // initial set to forever PDIGEST_CREDENTIAL pCredential = NULL; PDIGEST_CONTEXT pContext = NULL; STRING strcMethod; STRING strcHEntity; STRING strRealm; UNICODE_STRING refustrRealm; BOOL fDefChars = FALSE; // Create pointers to tokens for processing pChalRspInputToken = &TempTokens[0]; pMethodInputToken = &TempTokens[1]; pURIInputToken = &TempTokens[2]; pHEntityInputToken = &TempTokens[3]; pRealmInputToken = &TempTokens[4]; pOutputToken = &TempTokens[5]; DigestInit(&Digest); ZeroMemory(TempTokens,sizeof(TempTokens)); ZeroMemory(&strcMethod, sizeof(strcMethod)); ZeroMemory(&strcHEntity, sizeof(strcHEntity)); ZeroMemory(&strRealm, sizeof(strRealm)); ZeroMemory(&refustrRealm, sizeof(refustrRealm)); ZeroMemory(&ReplyBuffer, sizeof(ReplyBuffer)); // Initialize the output values if (!fContextAttributes || !NewContextHandle || !InputBuffers || !OutputBuffers) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Invalid arg (possible NULL pointer)\n")); return STATUS_INVALID_PARAMETER; } *NewContextHandle = (ULONG_PTR)NULL; *MappedContext = FALSE; *fContextAttributes = 0; if (pExpirationTime) { *pExpirationTime = g_TimeForever; } ContextData->pvBuffer = NULL; ContextData->cbBuffer = 0; // Determine if we are in HTTP or SASL mode // SASL mode has 1 or less buffers provided, HTTP has 5 if (InputBuffers->cBuffers > 1) { typeDigestMode = DIGESTMODE_HTTP; } else { typeDigestMode = DIGESTMODE_SASL; } // Must have a Credential Handle to perform processing Status = CredHandlerHandleToPtr(CredentialHandle, FALSE, &pCredential); if (!NT_SUCCESS(Status)) { Status = SEC_E_UNKNOWN_CREDENTIALS; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: No Credential Handle passed\n")); goto CleanUp; } bLockedCredential = TRUE; // Verify that credential is marked INBOUND for ASC call if (!(pCredential->CredentialUseFlags & DIGEST_CRED_INBOUND)) { Status = SEC_E_NOT_SUPPORTED; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Credential not marked for Inbound connections\n")); goto CleanUp; } // Retrieve the information from the SecBuffers & check proper formattting // First check to make sure that that the proper number of buffers were passed if (typeDigestMode == DIGESTMODE_HTTP) { // HTTP has 5 buffers in Input: ChallengeResponse, Method, URI, HEntity, Realm if ((InputBuffers->cBuffers < ASC_HTTP_NUM_INPUT_BUFFERS) || (OutputBuffers->cBuffers < ASC_HTTP_NUM_OUTPUT_BUFFERS)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Incorrect number of Input/Output HTTP Sec Buffers\n")); goto CleanUp; } } else { // SASL has 1 buffer in Input: ChallengeResponse if ((InputBuffers->cBuffers < ASC_SASL_NUM_INPUT_BUFFERS) || (OutputBuffers->cBuffers < ASC_SASL_NUM_OUTPUT_BUFFERS)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Incorrect number of Input/Ouput SASL Sec Buffers\n")); goto CleanUp; } fContextAttr |= ASC_RET_MUTUAL_AUTH; // SASL requires response auth from server } if ( !SspGetTokenBufferByIndex( InputBuffers, 0, // get the first SECBUFFER_TOKEN &pChalRspInputToken, TRUE ) || !ContextIsTokenOK(pChalRspInputToken,NTDIGEST_SP_MAX_TOKEN_SIZE)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (ChalRspInputToken) returns 0x%x\n", Status)); goto CleanUp; } if ( !SspGetTokenBufferByIndex( OutputBuffers, 0, // get the first SECBUFFER_TOKEN &pOutputToken, FALSE ) || !ContextIsTokenOK(pOutputToken, 0)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext, SspGetTokenBufferByIndex (OutputToken) returns 0x%x\n", Status)); goto CleanUp; } if (fContextReqFlags & ASC_REQ_ALLOCATE_MEMORY) { pOutputToken->pvBuffer = NULL; pOutputToken->cbBuffer = 0; } // Reset output buffer if provided if ((pOutputToken->pvBuffer) && (pOutputToken->cbBuffer >= 1)) { cptr = (char *)pOutputToken->pvBuffer; *cptr = '\0'; } // // If no ChallengeResponse data provided (only NULL in buffer), then this is the first call // Determine a nonce, open up a null context, and return it. Return SEC_E_INCOMPLETE_MESSAGE to // indicate that a challenge-response is expected // if ((!pChalRspInputToken->pvBuffer) || (pChalRspInputToken->cbBuffer <= 1)) { pNewContext = (PDIGEST_CONTEXT)DigestAllocateMemory(sizeof(DIGEST_CONTEXT)); if (!pNewContext) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: out of memory on challenge context\n")); goto CleanUp; } Status = ContextInit(pNewContext, pCredential); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: ContextInit error 0x%x\n", Status)); goto CleanUp; } if (typeDigestMode == DIGESTMODE_HTTP) { typeDigest = DIGEST_SERVER; } else { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: SASL Requested\n")); typeDigest = SASL_SERVER; } pNewContext->typeDigest = typeDigest; // Determine which character set to utilize if (((typeDigest == SASL_SERVER) && (g_fParameter_UTF8SASL == TRUE)) || ((typeDigest == DIGEST_SERVER) && (g_fParameter_UTF8HTTP == TRUE))) { typeCharset = UTF_8; } else { typeCharset = ISO_8859_1; } pNewContext->typeCharset = typeCharset; // We will use the Opaque as the CNonce Status = OpaqueCreate(&(pNewContext->strOpaque)); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: OpaqueCreate error 0x%x\n", Status)); goto CleanUp; } Status = NonceCreate(&(pNewContext->strNonce)); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: NonceCreate error 0x%x\n", Status)); goto CleanUp; } if (pNewContext->typeDigest == DIGEST_SERVER) { // Now see if a Realm was passed in to use for this challenge - the value could be single byte or Unicode // Order is if realm passed to ASC use that, else just use the current domain name if ( !SspGetTokenBufferByIndex( InputBuffers, 4, // get the fifth SECBUFFER_TOKEN &pRealmInputToken, TRUE ) || !ContextIsTokenOK(pRealmInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (RealmInputToken) returns 0x%x\n", Status)); goto CleanUp; } iTemp = 0; if (pRealmInputToken->cbBuffer) { if (!pRealmInputToken->pvBuffer) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: No input buffer (RealmInputToken) error 0x%x\n", Status)); goto CleanUp; } if (PBUFFERTYPE(pRealmInputToken) == SECBUFFER_PKG_PARAMS) { iTemp = ustrlencounted((const short *)pRealmInputToken->pvBuffer, pRealmInputToken->cbBuffer); if (iTemp > 0) { refustrRealm.Length = (USHORT)(iTemp * sizeof(WCHAR)); refustrRealm.MaximumLength = (unsigned short)(pRealmInputToken->cbBuffer); refustrRealm.Buffer = (PWSTR)pRealmInputToken->pvBuffer; // refernce memory - no alloc!!!! // Check if OK to use UTF-8 encoding if (pNewContext->typeCharset == UTF_8) { Status = EncodeUnicodeString(&refustrRealm, CP_UTF8, &strRealm, NULL); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Input Realm UTF-8 encoding error\n")); goto CleanUp; } } else { Status = EncodeUnicodeString(&refustrRealm, CP_8859_1, &strRealm, &fDefChars); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Input Realm ISO 8859-1 encoding error\n")); goto CleanUp; } if (fDefChars == TRUE) { // We could not encode the provided Realm within ISO 8859-1 characters DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Input Realm can not be encoded in ISO 8859-1\n")); Status = STATUS_UNMAPPABLE_CHARACTER; goto CleanUp; } } } } else { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Realm buffer type invalid error 0x%x\n", Status)); goto CleanUp; } } } typeAlgorithm = MD5_SESS; pNewContext->typeAlgorithm = typeAlgorithm; // Determine if we can process the QOP specified if (fContextReqFlags & ASC_REQ_CONFIDENTIALITY) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: AUTH-CONF requested\n")); fContextAttr |= (ASC_RET_CONFIDENTIALITY | ASC_REQ_INTEGRITY); typeQOP = AUTH_CONF; // Offer AUTH-CONF, AUTH_INT, and AUTH } else if (fContextReqFlags & ASC_REQ_INTEGRITY) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: AUTH-INT requested\n")); fContextAttr |= ASC_RET_INTEGRITY; typeQOP = AUTH_INT; // Offer AUTH-INT and AUTH } else typeQOP = AUTH; // Offer AUTH // Stale directive will be set if VerifyMessage indicates that context expired. // Application indicates if the challenge should indicate Stale if (fContextReqFlags & ASC_REQ_STALE) { fContextAttr |= ASC_RET_STALE; DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Requested stale flag be indicated\n")); } pNewContext->typeQOP = typeQOP; // Establish the attribute flags for this security context pNewContext->ContextReq = fContextAttr; Status = ContextCreateChal(pNewContext, &strRealm, &ReplyBuffer); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Failed to create Challenge status 0x%x\n", Status)); goto CleanUp; } // Now transfer the Challenge buffer to the ouput secbuffer if ((fContextReqFlags & ASC_REQ_ALLOCATE_MEMORY) == 0) { if (pOutputToken->cbBuffer < ReplyBuffer.cbBuffer) { DebugLog((DEB_ERROR,"SpAcceptLsaModeContext:Output token is too small - sent in %d, needed %d\n", pOutputToken->cbBuffer, ReplyBuffer.cbBuffer)); pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; Status = STATUS_BUFFER_TOO_SMALL; goto CleanUp; } RtlCopyMemory(pOutputToken->pvBuffer, ReplyBuffer.pvBuffer, ReplyBuffer.cbBuffer); pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; } else { pOutputToken->pvBuffer = ReplyBuffer.pvBuffer; pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; ReplyBuffer.pvBuffer = NULL; ReplyBuffer.cbBuffer = 0; fContextAttr |= ASC_RET_ALLOCATED_MEMORY; } // Update any new attributes pNewContext->ContextReq = fContextAttr; // Set the time expiration for this context // This time is in 100 Nanoseconds since 1604 Status = NtQuerySystemTime (&liContextTime); if (!NT_SUCCESS(Status)) { Status = STATUS_INTERNAL_ERROR; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Failed to get current time\n")); goto CleanUp; } DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Current TimeStamp high/low 0x%x/0x%x\n", liContextTime.HighPart, liContextTime.LowPart)); PrintTimeString(liContextTime, TRUE); // g_dwParameter_Lifetime is in number of seconds - convert to number of 100 nanoseconds liContextTime.QuadPart += ((LONGLONG)g_dwParameter_Lifetime * (LONGLONG)SECONDS_TO_100NANO); if (pExpirationTime) { *pExpirationTime = liContextTime; DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Context Expiration TimeStamp high/low 0x%x/0x%x\n", pExpirationTime->HighPart, pExpirationTime->LowPart)); PrintTimeString(liContextTime, TRUE); } pNewContext->PasswordExpires = liContextTime; pNewContext->lReferences = 1; // Add it into the list of Contexts CtxtHandlerInsertCred(pNewContext); DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Context added to list Opaque = %s\n", (pNewContext->strOpaque).Buffer)); // pContext = pNewContext; // set to have dereferenced *NewContextHandle = (ULONG_PTR)pNewContext; *fContextAttributes = fContextAttr; // Return the ASC Attributes set on Context // bLockedContext = TRUE; // Release memory to CtxtHandler // bLockedCredential = FALSE; // Do not Dereference the credential until context is unlinked and freed pNewContext = NULL; // We no longer own this memory - turned over to CtxtHandler Status = SEC_I_CONTINUE_NEEDED; goto CleanUp; } // Processing ChallengeResponse (challenge was handled right before this // We have input in the SECBUFFER 0th location - parse it Status = DigestParser2(pChalRspInputToken, MD5_AUTH_NAMES, MD5_AUTH_LAST, &Digest); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: DigestParser error 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: DigestParser Returned OK\n")); // Do not allow AuthzID processing at this time if (Digest.refstrParam[MD5_AUTH_AUTHZID].Length) { Status = SEC_E_WRONG_PRINCIPAL; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Can not process AuthzID directives 0x%x\n", Status)); goto CleanUp; } // HTTP has special Buffer needs in that it must pass in the METHOD, HEntity if (typeDigestMode == DIGESTMODE_HTTP) { if ( !SspGetTokenBufferByIndex( InputBuffers, 1, // get the second SECBUFFER_TOKEN &pMethodInputToken, TRUE ) || !ContextIsTokenOK(pMethodInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE)) { // Check to make sure that string is present Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (MethodInputToken) returns 0x%x\n", Status)); goto CleanUp; } /* // Not used in this version, may be used in the future if ( !SspGetTokenBufferByIndex( InputBuffers, 2, // get the third SECBUFFER_TOKEN &pURIInputToken, TRUE ) || !ContextIsTokenOK(pURIInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (URIInputToken) returns %d\n", Status)); goto CleanUp; } */ if ( !SspGetTokenBufferByIndex( InputBuffers, 3, // get the forth SECBUFFER_TOKEN &pHEntityInputToken, TRUE ) || !ContextIsTokenOK(pHEntityInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (HEntityInputToken) returns 0x%x\n", Status)); goto CleanUp; } // Verify that there is a valid Method provided if (!pMethodInputToken->pvBuffer || !pMethodInputToken->cbBuffer || (PBUFFERTYPE(pMethodInputToken) != SECBUFFER_PKG_PARAMS)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Method SecBuffer must have valid method string status 0x%x\n", Status)); goto CleanUp; } iTemp = strlencounted((char *)pMethodInputToken->pvBuffer, pMethodInputToken->cbBuffer); if (!iTemp) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Method SecBuffer must have valid method string status 0x%x\n", Status)); goto CleanUp; } Digest.refstrParam[MD5_AUTH_METHOD].Length = (USHORT)iTemp; Digest.refstrParam[MD5_AUTH_METHOD].MaximumLength = (unsigned short)(pMethodInputToken->cbBuffer); Digest.refstrParam[MD5_AUTH_METHOD].Buffer = (char *)pMethodInputToken->pvBuffer; // refernce memory - no alloc!!!! // Check to see if we have H(Entity) data to utilize if (pHEntityInputToken->cbBuffer) { // Verify that there is a valid Method provided if (!pHEntityInputToken->pvBuffer || (PBUFFERTYPE(pMethodInputToken) != SECBUFFER_PKG_PARAMS)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: HEntity SecBuffer must have valid string status 0x%x\n", Status)); goto CleanUp; } iTemp = strlencounted((char *)pHEntityInputToken->pvBuffer, pHEntityInputToken->cbBuffer); if ((iTemp != 0) && (iTemp != (MD5_HASH_BYTESIZE * 2))) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: HEntity SecBuffer must have valid MD5 Hash data 0x%x\n", Status)); goto CleanUp; } if (iTemp) { Digest.refstrParam[MD5_AUTH_HENTITY].Length = (USHORT)iTemp; Digest.refstrParam[MD5_AUTH_HENTITY].MaximumLength = (unsigned short)(pHEntityInputToken->cbBuffer); Digest.refstrParam[MD5_AUTH_HENTITY].Buffer = (char *)pHEntityInputToken->pvBuffer; // refernce memory - no alloc!!!! } } typeDigest = DIGEST_SERVER; } else { // All others follow the SASL Interface so there are default values typeDigest = SASL_SERVER; // Set Method to Authenticate RtlInitString(&strcMethod, AUTHENTICATESTR); StringReference(&(Digest.refstrParam[MD5_AUTH_METHOD]), &strcMethod); // refernce memory - no alloc!!!! RtlInitString(&strcHEntity, ZERO32STR); StringReference(&(Digest.refstrParam[MD5_AUTH_HENTITY]), &strcHEntity); // refernce memory - no alloc!!!! } // Since we requested only MD5_SESS in the challenge, the response had better be MD5_SESS too! typeAlgorithm = MD5_SESS; fContextAttr |= (ASC_RET_REPLAY_DETECT | ASC_RET_SEQUENCE_DETECT); if (NT_SUCCESS(CheckItemInList(AUTHCONFSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), TRUE))) { // client requested AUTH-CONF since privacy requested fContextAttr |= (ASC_RET_CONFIDENTIALITY | ASC_RET_INTEGRITY); typeQOP = AUTH_CONF; DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client selected QOP=AUTH-CONF\n")); } else if (NT_SUCCESS(CheckItemInList(AUTHINTSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), TRUE))) { // client requested AUTH-INT since privacy requested fContextAttr |= ASC_RET_INTEGRITY; typeQOP = AUTH_INT; DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client selected QOP=AUTH-INT\n")); } else if (NT_SUCCESS(CheckItemInList(AUTHSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), TRUE))) { // check to see if client specified auth only typeQOP = AUTH; DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client selected QOP=AUTH\n")); } else { // Client did not specify any QOP if (!Digest.refstrParam[MD5_AUTH_QOP].Length) { if (typeDigestMode == DIGESTMODE_HTTP) { typeQOP = NO_QOP_SPECIFIED; // This is OK - acts like AUTH but response different DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client did not specify QOP (HTTP only)\n")); } else { typeQOP = AUTH; // This is OK - SASL defaults to AUTH DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client did not specify QOP, default to AUTH\n")); } } else { // Failed to provide recognized QOP Status = SEC_E_QOP_NOT_SUPPORTED; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Client failed to provide recognized QOP\n")); goto CleanUp; } } // If there is no OldContextToken passed in, then check for SecurityContext handle (in opaque) else return error if ( !ARGUMENT_PRESENT( OldContextHandle )) { // Search for Reference to SecurityContextHandle Status = CtxtHandlerOpaqueToPtr(&(Digest.refstrParam[MD5_AUTH_OPAQUE]), &pContext); if (!NT_SUCCESS (Status)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: CtxtHandlerOpaqueToPtr error 0x%x\n", Status)); goto CleanUp; } } else { // We have a SecurityContextHandle to use - see if it is in the ContextList and valid Status = CtxtHandlerHandleToContext(OldContextHandle, FALSE, &pContext); if (!NT_SUCCESS (Status)) { Status = SEC_E_INVALID_TOKEN; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: CtxtHandlerHandleToContext error 0x%x\n", Status)); goto CleanUp; } } DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Acquired Context ptr for 0x%x\n", pContext)); bLockedContext = TRUE; // Can only call AcceptSecurityContect Once after ChallengeResponse // For non-persistent connections (no OldContextHandle passed in), just return SCH and return if (pContext->strSessionKey.Length) { if (ARGUMENT_PRESENT( OldContextHandle )) { Status = STATUS_LOGON_FAILURE; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Multiple call to completed ASC\n")); goto CleanUp; } else { Status = SEC_I_COMPLETE_NEEDED; DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Opaque located CtxtHandle, return handle, Complete needed\n")); *NewContextHandle = (ULONG_PTR)pContext; // Just report back with the updated context pContext = NULL; goto CleanUp; } } // Check to see if the Server has provided character set for encoding - only UTF-8 accepted Status = CheckItemInList(MD5_UTF8STR, &(Digest.refstrParam[MD5_AUTH_CHARSET]), TRUE); if (NT_SUCCESS(Status)) { // The ChallengeResponse requested UTF-8 encoding, check to see that server allowed this if (((typeDigest == SASL_SERVER) && (g_fParameter_UTF8SASL == TRUE)) || ((typeDigest == DIGEST_SERVER) && (g_fParameter_UTF8HTTP == TRUE))) { typeCharset = UTF_8; DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Server allows UTF-8 encoding\n")); } else { // We did not authorize this type of encoding - fail the request DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Client requested UTF-8 server did not offer\n")); Status = SEC_E_ILLEGAL_MESSAGE; goto CleanUp; } } // We now have a pointer to the Security Context to use, finish up setting up the digestparamter fields // Set the type of Digest Parameters we are to process pContext->typeDigest = typeDigest; pContext->typeAlgorithm = typeAlgorithm; pContext->typeQOP = typeQOP; pContext->typeCharset = typeCharset; if (pContext->typeQOP == AUTH_CONF) { Status = CheckItemInList(STR_CIPHER_RC4, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting RC4 for auth-conf cipher\n")); pContext->typeCipher = CIPHER_RC4; } else { Status = CheckItemInList(STR_CIPHER_3DES, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting Triple DES for auth-conf cipher\n")); pContext->typeCipher = CIPHER_3DES; } else { Status = CheckItemInList(STR_CIPHER_RC4_56, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting RC4-56 for auth-conf cipher\n")); pContext->typeCipher = CIPHER_RC4_56; } else { Status = CheckItemInList(STR_CIPHER_RC4_40, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting RC4-40 for auth-conf cipher\n")); pContext->typeCipher = CIPHER_RC4_40; } else { Status = CheckItemInList(STR_CIPHER_DES, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE); if (NT_SUCCESS(Status)) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting DES for auth-conf cipher\n")); pContext->typeCipher = CIPHER_DES; } else { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Failed to find known ciper selected by client\n")); Status = STATUS_CRYPTO_SYSTEM_INVALID; goto CleanUp; } } } } } } // Check if client specified a MaxBuffer if (Digest.refstrParam[MD5_AUTH_MAXBUF].Length && Digest.refstrParam[MD5_AUTH_MAXBUF].Buffer) { if (Digest.refstrParam[MD5_AUTH_MAXBUF].Length < MAXBUFNUMLEN) { ULONG ulMaxBuf = 0; CHAR czMaxBuf[MAXBUFNUMLEN + 1]; ZeroMemory(czMaxBuf, (MAXBUFNUMLEN + 1)); memcpy(czMaxBuf, Digest.refstrParam[MD5_AUTH_MAXBUF].Buffer, Digest.refstrParam[MD5_AUTH_MAXBUF].Length); Status = RtlCharToInteger(czMaxBuf, TENBASE, &ulMaxBuf); if (!NT_SUCCESS(Status)) { Status = SEC_E_ILLEGAL_MESSAGE; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: MaxBuf directive value malformed 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client MaxBuf set to %lu\n", ulMaxBuf)); pContext->ulSendMaxBuf = ulMaxBuf; } else { Status = SEC_E_ILLEGAL_MESSAGE; DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: MaxBuf directive value too large 0x%x\n", Status)); goto CleanUp; } } DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Digest inputs processing completed\n")); // ReplyBuffer will contain the ResponseAuth if generated Status = DigestProcessParameters(pContext, &Digest, &ReplyBuffer, &AuditLogStatus); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: DigestProcessParameters error 0x%x\n", Status)); goto CleanUp; } fLogonSessionCreated = TRUE; // We have successfully authed the request & created LogonID & Token if ((fContextReqFlags & ASC_REQ_ALLOCATE_MEMORY) == 0) { if (pOutputToken->cbBuffer < ReplyBuffer.cbBuffer) { DebugLog((DEB_ERROR,"SpAcceptLsaModeContext:Output token is too small - sent in %d, needed %d\n", pOutputToken->cbBuffer, ReplyBuffer.cbBuffer)); pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; Status = STATUS_BUFFER_TOO_SMALL; goto CleanUp; } RtlCopyMemory(pOutputToken->pvBuffer, ReplyBuffer.pvBuffer, ReplyBuffer.cbBuffer); pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; } else { pOutputToken->pvBuffer = ReplyBuffer.pvBuffer; pOutputToken->cbBuffer = ReplyBuffer.cbBuffer; ReplyBuffer.pvBuffer = NULL; ReplyBuffer.cbBuffer = 0; fContextAttr |= ASC_RET_ALLOCATED_MEMORY; } // Establish the attribute flags for this security context pContext->ContextReq = fContextAttr; // Keep a copy of the Cnonce for future Delegation requests Status = StringDuplicate(&pContext->strCNonce, &Digest.refstrParam[MD5_AUTH_CNONCE]); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: StringDuplicate CNonce failed status 0x%x\n", Status)); goto CleanUp; } // Now create a LogonSession for the completed LogonToken contained SecurityContext // This can be utilized in delegated digest client's ACH DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Adding a LogonSession for successful ASC\n")); Status = CtxtCreateLogSess(pContext); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: CtxtCreateLogSess failed status 0x%x\n", Status)); goto CleanUp; } Status = SspMapDigestContext(pContext, &Digest, ContextData); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext, SspMapContext returns %d\n", Status)); goto CleanUp; } *MappedContext = TRUE; pContext->ulNC++; // Everything verified so increment to next nonce count *NewContextHandle = (ULONG_PTR)pContext; // Just report back with the updated context *fContextAttributes = fContextAttr; // Return the ASC Attributes set on Context if (pExpirationTime) { *pExpirationTime = pContext->PasswordExpires; } Status = STATUS_SUCCESS; CleanUp: // Now perform auditlogon Raid #329545 if (Status == STATUS_SUCCESS) { // Check to see if completed a logon if (pContext) { g_LsaFunctions->AuditLogon( STATUS_SUCCESS, STATUS_SUCCESS, &(pContext->ustrAccountName), &(pContext->ustrDomain), &g_ustrWorkstationName, NULL, Network, &g_DigestSource, &(pContext->LoginID) ); } } else { if (pContext) { g_LsaFunctions->AuditLogon( Status, AuditLogStatus, &(pContext->ustrAccountName), &(pContext->ustrDomain), &g_ustrWorkstationName, NULL, Network, &g_DigestSource, &(pContext->LoginID) ); } } if (!NT_SUCCESS(Status)) { // Failed to complete operations so clean up if (fLogonSessionCreated == TRUE) { // Notify LSA that LogonID is not valid SubStatus = g_LsaFunctions->DeleteLogonSession(&(pContext->LoginID)); if (!NT_SUCCESS(SubStatus)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: cleanup DeleteLogonSession failed\n")); } fLogonSessionCreated = FALSE; // If we created a token then we need to close it if (pContext->TokenHandle) { SubStatus = NtClose(pContext->TokenHandle); pContext->TokenHandle = NULL; } } if (pNewContext) { ContextFree(pNewContext); } pNewContext = NULL; *NewContextHandle = NULL; } // DeReference - pCredential, pOldContext if (bLockedCredential && pCredential) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: CredHandlerRelease to be called for 0x%x\n", pCredential)); SubStatus = CredHandlerRelease(pCredential); if (!NT_SUCCESS(SubStatus)) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: CredHandlerRelease error 0x%x\n", SubStatus)); if (NT_SUCCESS(Status)) { Status = SubStatus; // Indicate release error } } } if (bLockedContext && pContext) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: CtxtHandlerRelease to be called for 0x%x\n", pContext)); SubStatus = CtxtHandlerRelease(pContext); if (!NT_SUCCESS(SubStatus)) { DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: CtxtHandlerRelease error 0x%x\n", SubStatus)); if (NT_SUCCESS(Status)) { Status = SubStatus; // Indicate release error } } } // Free up any allocated memory from the ouput reply buffer if (ReplyBuffer.pvBuffer) { DigestFreeMemory(ReplyBuffer.pvBuffer); ReplyBuffer.pvBuffer = NULL; ReplyBuffer.cbBuffer = 0; } // Clean up local memory used by Digest DigestFree(&Digest); StringFree(&strRealm); DebugLog((DEB_TRACE_FUNC, "SpAcceptLsaModeContext: Leaving Context 0x%x Status 0x%x\n", *NewContextHandle, Status)); return(Status); } // Creates a logon session for the logontoken contained in the SecurityContext // The Token was created for the authenticated digest by ConvertAuthDataToToken NTSTATUS CtxtCreateLogSess( IN PDIGEST_CONTEXT pContext) { NTSTATUS Status = STATUS_SUCCESS; PDIGEST_LOGONSESSION pNewLogonSession = NULL; DebugLog((DEB_TRACE_FUNC, "CtxtCreateLogSess: Entering\n")); // Create a new entry into LogonSession listing pNewLogonSession = (PDIGEST_LOGONSESSION)DigestAllocateMemory(sizeof(DIGEST_LOGONSESSION)); if (!pNewLogonSession) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR, "CtxtCreateLogSess: Could not allocate memory for logonsession, error 0x%x\n", Status)); goto CleanUp; } LogonSessionInit(pNewLogonSession); pNewLogonSession->LogonType = Network; pNewLogonSession->LogonId = pContext->LoginID; UnicodeStringDuplicate(&(pNewLogonSession->ustrAccountName), &(pContext->ustrAccountName)); UnicodeStringDuplicate(&(pNewLogonSession->ustrDomainName), &(pContext->ustrDomain)); DebugLog((DEB_TRACE, "CtxtCreateLogSess: Added new logonsession into list, handle 0x%x\n", pNewLogonSession)); LogSessHandlerInsert(pNewLogonSession); pNewLogonSession = NULL; // Turned over memory to LogSessHandler CleanUp: if (pNewLogonSession) { DigestFreeMemory(pNewLogonSession); pNewLogonSession = NULL; } DebugLog((DEB_TRACE_FUNC, "CtxtCreateLogSess: Leaving Status 0x%x\n", Status)); return(Status); } // Some quick checks to make sure SecurityToken buffers are OK // // // Args // ulMaxSize - if non-zero then buffer must not be larger than this value, if zero no check is done BOOL ContextIsTokenOK( IN PSecBuffer pTempToken, IN ULONG ulMaxSize) { BOOL bStatus = TRUE; if (!pTempToken) { DebugLog((DEB_ERROR, "ContextIsTokenOK: Error Bad input\n")); return FALSE; } // If Buffer pointer is NULL then cbBuffer length must be zero if ((!pTempToken->pvBuffer) && (pTempToken->cbBuffer)) { DebugLog((DEB_ERROR, "ContextIsTokenOK: Error Buffer NULL, length non-zero\n")); return FALSE; } // Verify that the input authentication string length is not too large if (ulMaxSize && (pTempToken->cbBuffer > ulMaxSize)) { DebugLog((DEB_ERROR, "ContextIsTokenOK: Error Buffer size too big (Max %lu Buffer %lu)\n", ulMaxSize, pTempToken->cbBuffer)); return FALSE; } return TRUE; } // Creats the Challenge in the server to send back to the client // // Args: pContext - secruity context to utilize for Challenge Creation // pstrRealm - allows for override of the Realm directive by this string // OutBuffer - secbuffer to store the output challenge in NTSTATUS NTAPI ContextCreateChal( IN PDIGEST_CONTEXT pContext, IN PSTRING pstrRealm, OUT PSecBuffer OutBuffer ) { NTSTATUS Status = STATUS_SUCCESS; USHORT cbChallenge = 0; ULONG cbLenNeeded = 0; BOOL fSASLMode = FALSE; STRING strTempRealm; PCHAR pczTemp = NULL; PCHAR pczTemp2 = NULL; DebugLog((DEB_TRACE_FUNC, "ContextCreateChal: Entering\n")); ZeroMemory(&strTempRealm, sizeof(strTempRealm)); // allocate the buffers for output - in the future can optimze to allocate exact amount needed pczTemp = (PCHAR)DigestAllocateMemory((3 * NTDIGEST_SP_MAX_TOKEN_SIZE) + 1); if (!pczTemp) { DebugLog((DEB_ERROR, "ContextCreateChal: No memory for output buffers\n")); goto CleanUp; } pczTemp2 = (PCHAR)DigestAllocateMemory(NTDIGEST_SP_MAX_TOKEN_SIZE + 1); if (!pczTemp2) { DebugLog((DEB_ERROR, "ContextCreateChal: No memory for output buffers\n")); goto CleanUp; } pczTemp[0] = '\0'; pczTemp2[0] = '\0'; // Check to make sure we have minimal input and outputs if ((!pContext) || (!OutBuffer) || (!pstrRealm)) { Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "ContextCreateChal: Invalid args\n")); goto CleanUp; } // calculate the MAX possible size for the respose - will be smaller than this value cbLenNeeded = CB_CHAL; // MAX byte count for directives and symbols cbLenNeeded += pContext->strNonce.Length; cbLenNeeded += pContext->strOpaque.Length; cbLenNeeded += pstrRealm->Length; cbLenNeeded += g_strNtDigestUTF8ServerRealm.Length; cbLenNeeded += g_strNTDigestISO8859ServerRealm.Length; // Really only need one of these but make simple math if (cbLenNeeded > NTDIGEST_SP_MAX_TOKEN_SIZE) { Status = STATUS_BUFFER_TOO_SMALL; DebugLog((DEB_ERROR, "ContextCreateChal: output exceed max size or buffer too small len is %d\n", cbLenNeeded)); goto CleanUp; } if (pContext->typeDigest == SASL_SERVER) { fSASLMode = TRUE; } if (pContext->typeQOP == AUTH_CONF) { sprintf(pczTemp, "qop=\"auth,auth-int,auth-conf\",cipher=\"3des,des,rc4-40,rc4,rc4-56\",algorithm=%s,nonce=\"%Z\"", ((fSASLMode == TRUE) ? MD5_SESS_SASLSTR: MD5_SESSSTR), &pContext->strNonce); } else if (pContext->typeQOP == AUTH_INT) { sprintf(pczTemp, "qop=\"auth,auth-int\",algorithm=%s,nonce=\"%Z\"", ((fSASLMode == TRUE) ? MD5_SESS_SASLSTR: MD5_SESSSTR), &pContext->strNonce); } else { sprintf(pczTemp, "qop=\"auth\",algorithm=%s,nonce=\"%Z\"", ((fSASLMode == TRUE) ? MD5_SESS_SASLSTR: MD5_SESSSTR), &pContext->strNonce); } // Attach opaque data (but not on SASL_SERVER) if ((pContext->strOpaque.Length) && (pContext->typeDigest != SASL_SERVER)) { sprintf(pczTemp2, ",opaque=\"%Z\"", &pContext->strOpaque); strcat(pczTemp, pczTemp2); } // Attach charset to allow UTF-8 character encoding if (pContext->typeCharset == UTF_8) { strcat(pczTemp, ",charset=utf-8"); } // Attach realm - allow the strRealm to override the system DnsDomainName if (pstrRealm->Length) { Status = BackslashEncodeString(pstrRealm, &strTempRealm); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "ContextCreateChal: BackslashEncode failed status 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "ContextCreateChal: Realm provided (%Z) backslash encoded (%Z)\n", pstrRealm, &strTempRealm)); sprintf(pczTemp2, ",realm=\"%Z\"", &strTempRealm); strcat(pczTemp, pczTemp2); } else { // determine the realm to present based on charset requested if (pContext->typeCharset == UTF_8) { if (g_strNtDigestUTF8ServerRealm.Length) { Status = BackslashEncodeString(&g_strNtDigestUTF8ServerRealm, &strTempRealm); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "ContextCreateChal: BackslashEncode failed status 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "ContextCreateChal: UTF-8 default Realm (%Z) backslash encoded (%Z)\n", &g_strNtDigestUTF8ServerRealm, &strTempRealm)); sprintf(pczTemp2, ",realm=\"%Z\"", &strTempRealm); strcat(pczTemp, pczTemp2); } } else { if (g_strNTDigestISO8859ServerRealm.Length) { Status = BackslashEncodeString(&g_strNTDigestISO8859ServerRealm, &strTempRealm); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "ContextCreateChal: BackslashEncode failed status 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "ContextCreateChal: ISO 8859-1 default Realm (%Z) backslash encoded (%Z)\n", &g_strNTDigestISO8859ServerRealm, &strTempRealm)); sprintf(pczTemp2, ",realm=\"%Z\"", &strTempRealm); strcat(pczTemp, pczTemp2); } } } // Attach stale directive if indicated if (pContext->ContextReq & ASC_RET_STALE) { sprintf(pczTemp2, ",stale=true"); strcat(pczTemp, pczTemp2); } // total buffer for Challenge (NULL is not included in output buffer - ref:Bug 310201) // cbLenNeeded = strlen(pczTemp) + sizeof(CHAR); cbLenNeeded = strlen(pczTemp); // Check on allocating output buffer if (!OutBuffer->cbBuffer) { OutBuffer->pvBuffer = DigestAllocateMemory(cbLenNeeded); if (!OutBuffer->pvBuffer) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR, "ContextCreateChal: out of memory on challenge output\n")); goto CleanUp; } OutBuffer->cbBuffer = cbLenNeeded; OutBuffer->BufferType = SECBUFFER_DATA; } if (cbLenNeeded > OutBuffer->cbBuffer) { Status = STATUS_BUFFER_TOO_SMALL; DebugLog((DEB_ERROR, "ContextCreateChal: output buffer too small need %d len is %d\n", cbLenNeeded, OutBuffer->cbBuffer)); goto CleanUp; } memcpy(OutBuffer->pvBuffer, pczTemp, cbLenNeeded); // Now indicate number of bytes utilized in output buffer OutBuffer->cbBuffer = cbLenNeeded; CleanUp: if (pczTemp) { DigestFreeMemory(pczTemp); pczTemp = NULL; } if (pczTemp2) { DigestFreeMemory(pczTemp2); pczTemp2 = NULL; } StringFree(&strTempRealm); DebugLog((DEB_TRACE_FUNC, "ContextCreateChal: Leaving Status 0x%x\n", Status)); return(Status); } // Generate the output buffer from a given Digest NTSTATUS NTAPI DigestCreateChalResp( IN PDIGEST_PARAMETER pDigest, IN PUSER_CREDENTIALS pUserCreds, OUT PSecBuffer OutBuffer ) { NTSTATUS Status = STATUS_SUCCESS; USHORT cbChallenge = 0; ULONG cbLenNeeded = 0; char *pczQOP = NULL; STRING strcQOP; // string pointing to a constant value STRING strcAlgorithm; BOOL fSASLMode = FALSE; UINT uCodePage = CP_8859_1; STRING strTempRealm; // Backslash encoded forms STRING strTempUsername; STRING strTempUri; STRING strRealm; STRING strUsername; PSTRING pstrUsername = NULL; PSTRING pstrRealm = NULL; PCHAR pczTemp = NULL; PCHAR pczTemp2 = NULL; DebugLog((DEB_TRACE_FUNC, "DigestCreateChalResp: Entering\n")); ZeroMemory(&strTempRealm, sizeof(strTempRealm)); ZeroMemory(&strTempUsername, sizeof(strTempUsername)); ZeroMemory(&strTempUri, sizeof(strTempUri)); ZeroMemory(&strRealm, sizeof(strRealm)); ZeroMemory(&strUsername, sizeof(strUsername)); // allocate the buffers for output - in the future can optimze to allocate exact amount needed pczTemp = (PCHAR)DigestAllocateMemory((3 * NTDIGEST_SP_MAX_TOKEN_SIZE) + 1); if (!pczTemp) { DebugLog((DEB_ERROR, "DigestCreateChalResp: No memory for output buffers\n")); goto CleanUp; } pczTemp2 = (PCHAR)DigestAllocateMemory(NTDIGEST_SP_MAX_TOKEN_SIZE + 1); if (!pczTemp2) { DebugLog((DEB_ERROR, "DigestCreateChalResp: No memory for output buffers\n")); goto CleanUp; } pczTemp[0] = '\0'; pczTemp2[0] = '\0'; RtlInitString(&strcQOP, NULL); RtlInitString(&strcAlgorithm, NULL); if ((pDigest->typeDigest == SASL_SERVER) || (pDigest->typeDigest == SASL_CLIENT)) { fSASLMode = TRUE; } // Establish which QOP utilized if (pDigest->typeQOP == AUTH_CONF) { RtlInitString(&strcQOP, AUTHCONFSTR); } else if (pDigest->typeQOP == AUTH_INT) { RtlInitString(&strcQOP, AUTHINTSTR); } else if (pDigest->typeQOP == AUTH) { RtlInitString(&strcQOP, AUTHSTR); } // Determine which code page to utilize if (pDigest->typeCharset == UTF_8) { uCodePage = CP_UTF8; } else { uCodePage = CP_8859_1; } // if provided with UserCred then use them, otherwise use Digest directive values if (pUserCreds) { DebugLog((DEB_TRACE, "DigestCreateChalResp: UserCredentials presented - encode and output\n")); Status = EncodeUnicodeString(&pUserCreds->ustrUsername, uCodePage, &strUsername, NULL); if (!NT_SUCCESS(Status)) { DebugLog((DEB_WARN, "DigestCreateChalResp: Error in encoding username\n")); goto CleanUp; } Status = EncodeUnicodeString(&pUserCreds->ustrDomain, uCodePage, &strRealm, NULL); if (!NT_SUCCESS(Status)) { DebugLog((DEB_WARN, "DigestCreateChalResp: Error in encoding realm\n")); goto CleanUp; } // Now encode the user directed fields (username, URI, realm) Status = BackslashEncodeString(&strUsername, &strTempUsername); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestCreateChalResp: BackslashEncode failed status 0x%x\n", Status)); goto CleanUp; } Status = BackslashEncodeString(&strRealm, &strTempRealm); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestCreateChalResp: BackslashEncode failed status 0x%x\n", Status)); goto CleanUp; } // Utilize these strings in the output pstrUsername = &strTempUsername; pstrRealm = &strTempRealm; // Make copy of the directive values for LSA to Usermode context Status = StringDuplicate(&(pDigest->strUsernameEncoded), pstrUsername); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestCreateChalResp: Failed to copy over UsernameEncoded\n")); goto CleanUp; } Status = StringDuplicate(&(pDigest->strRealmEncoded), pstrRealm); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestCreateChalResp: Failed to copy over RealmEncoded\n")); goto CleanUp; } // refernce memory - no alloc!!!! StringReference(&(pDigest->refstrParam[MD5_AUTH_USERNAME]), &(pDigest->strUsernameEncoded)); StringReference(&(pDigest->refstrParam[MD5_AUTH_REALM]), &(pDigest->strRealmEncoded)); } else { // No usercreds passed in so just use the current digest directive values DebugLog((DEB_WARN, "DigestCreateChalResp: No UserCredentials - use provided digest\n")); pstrUsername = &(pDigest->refstrParam[MD5_AUTH_USERNAME]); pstrRealm = &(pDigest->refstrParam[MD5_AUTH_REALM]); } Status = BackslashEncodeString(&pDigest->refstrParam[MD5_AUTH_URI], &strTempUri); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestCreateChalResp: BackslashEncode failed status 0x%x\n", Status)); goto CleanUp; } // Precalc the amount of space needed for output cbLenNeeded = CB_CHALRESP; // MAX byte count for directives and symbols cbLenNeeded += pstrUsername->Length; cbLenNeeded += pstrRealm->Length; cbLenNeeded += pDigest->refstrParam[MD5_AUTH_NONCE].Length; cbLenNeeded += strTempUri.Length; cbLenNeeded += pDigest->strResponse.Length; cbLenNeeded += strcAlgorithm.Length; cbLenNeeded += pDigest->refstrParam[MD5_AUTH_CNONCE].Length; cbLenNeeded += pDigest->refstrParam[MD5_AUTH_OPAQUE].Length; cbLenNeeded += MAX_AUTH_LENGTH; cbLenNeeded += pDigest->refstrParam[MD5_AUTH_NC].Length; cbLenNeeded += strcQOP.Length; if (cbLenNeeded > NTDIGEST_SP_MAX_TOKEN_SIZE) { Status = STATUS_BUFFER_TOO_SMALL; DebugLog((DEB_ERROR, "DigestCreateChalResp: output exceed max size or buffer too small len is %d\n", cbLenNeeded)); goto CleanUp; } // In digest calc - already checked username,realm,nonce,method,uri // Make sure there are values for the rest needed if ((!pDigest->strResponse.Length) || (!pDigest->refstrParam[MD5_AUTH_NC].Length) || (!pDigest->refstrParam[MD5_AUTH_CNONCE].Length)) { // Failed on a require field-value Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "DigestCreateChalResp: Response, NC, or Cnonce is zero length\n")); goto CleanUp; } if (pstrRealm->Length) { sprintf(pczTemp, "username=\"%Z\",realm=\"%Z\",nonce=\"%Z\",%s=\"%Z\",cnonce=\"%Z\",nc=%Z", pstrUsername, pstrRealm, &pDigest->refstrParam[MD5_AUTH_NONCE], ((fSASLMode == TRUE) ? DIGESTURI_STR: URI_STR), &strTempUri, &pDigest->refstrParam[MD5_AUTH_CNONCE], &pDigest->refstrParam[MD5_AUTH_NC]); } else { sprintf(pczTemp, "username=\"%Z\",realm=\"\",nonce=\"%Z\",%s=\"%Z\",cnonce=\"%Z\",nc=%Z", pstrUsername, &pDigest->refstrParam[MD5_AUTH_NONCE], ((fSASLMode == TRUE) ? DIGESTURI_STR: URI_STR), &strTempUri, &pDigest->refstrParam[MD5_AUTH_CNONCE], &pDigest->refstrParam[MD5_AUTH_NC]); } if (fSASLMode == TRUE) { // Do not output algorithm - must be md5-sess and that is assumed sprintf(pczTemp2, ",response=%Z", &pDigest->strResponse); strcat(pczTemp, pczTemp2); } else { if (pDigest->typeAlgorithm == MD5_SESS) { sprintf(pczTemp2, ",algorithm=MD5-sess,response=\"%Z\"", &pDigest->strResponse); strcat(pczTemp, pczTemp2); } else { sprintf(pczTemp2, ",response=\"%Z\"", &pDigest->strResponse); strcat(pczTemp, pczTemp2); } } // Attach QOP if specified - support older format for no QOP if (strcQOP.Length) { if (fSASLMode == TRUE) { sprintf(pczTemp2, ",qop=%Z", &strcQOP); strcat(pczTemp, pczTemp2); } else { sprintf(pczTemp2, ",qop=\"%Z\"", &strcQOP); strcat(pczTemp, pczTemp2); } } // Attach Cipher selected if required if (pDigest->typeQOP == AUTH_CONF) { // FIX optimize these into a list for efficiency if (pDigest->typeCipher == CIPHER_RC4) { sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_RC4); strcat(pczTemp, pczTemp2); } else if (pDigest->typeCipher == CIPHER_RC4_56) { sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_RC4_56); strcat(pczTemp, pczTemp2); } else if (pDigest->typeCipher == CIPHER_RC4_40) { sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_RC4_40); strcat(pczTemp, pczTemp2); } else if (pDigest->typeCipher == CIPHER_3DES) { sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_3DES); strcat(pczTemp, pczTemp2); } else if (pDigest->typeCipher == CIPHER_DES) { sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_DES); strcat(pczTemp, pczTemp2); } } // Attach opaque data (but not on SASL) if ((fSASLMode == FALSE) && pDigest->refstrParam[MD5_AUTH_OPAQUE].Length) { sprintf(pczTemp2, ",opaque=\"%Z\"", &pDigest->refstrParam[MD5_AUTH_OPAQUE]); strcat(pczTemp, pczTemp2); } // Attach charset to indicate that UTF-8 character encoding is utilized if (pDigest->typeCharset == UTF_8) { strcat(pczTemp, ",charset=utf-8"); } // total buffer for Challenge (NULL is not included in output buffer - ref:Bug 310201) // cbLenNeeded = strlen(pczTemp) + sizeof(CHAR); cbLenNeeded = strlen(pczTemp); // Check on allocating output buffer if (!OutBuffer->cbBuffer) { OutBuffer->pvBuffer = DigestAllocateMemory(cbLenNeeded); if (!OutBuffer->pvBuffer) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR, "DigestCreateChalResp: out of memory on challenge output\n")); goto CleanUp; } OutBuffer->cbBuffer = cbLenNeeded; } if (cbLenNeeded > OutBuffer->cbBuffer) { Status = STATUS_BUFFER_TOO_SMALL; DebugLog((DEB_ERROR, "DigestCreateChalResp: output buffer too small need %d len is %d\n", cbLenNeeded, OutBuffer->cbBuffer)); goto CleanUp; } memcpy(OutBuffer->pvBuffer, pczTemp, cbLenNeeded); OutBuffer->cbBuffer = cbLenNeeded; OutBuffer->BufferType = SECBUFFER_TOKEN; CleanUp: if (pczTemp) { DigestFreeMemory(pczTemp); pczTemp = NULL; } if (pczTemp2) { DigestFreeMemory(pczTemp2); pczTemp2 = NULL; } StringFree(&strTempRealm); StringFree(&strTempUsername); StringFree(&strTempUri); StringFree(&strRealm); StringFree(&strUsername); DebugLog((DEB_TRACE_FUNC, "DigestCreateChalResp: Leaving status 0x%x\n", Status)); return(Status); } // This is the main section to process a Context with an incoming Digest message to authenticate the // message on the DC, generate a session key, and get the user Token. On subsequent calls, the session key // can be utilized directly and if the Digest is authenticated, the Token can be utilized. // AuditLogStatus can be used to provide SubStatus in AuditLogging on server NTSTATUS NTAPI DigestProcessParameters( IN OUT PDIGEST_CONTEXT pContext, IN PDIGEST_PARAMETER pDigest, OUT PSecBuffer pOutputToken, OUT PNTSTATUS pAuditLogStatus) { NTSTATUS Status = STATUS_SUCCESS; NTSTATUS SubStatus = STATUS_SUCCESS; ULONG ulNonceCount = 0; USHORT cbDigestParamEncoded = 0; // Contains the number of bytes in Request to send out BYTE *pMessageResponse = NULL; ULONG ulMessageResponse = 0; BOOL fLogonSessionCreated = FALSE; // indicate if the LSA was notified about logon // Encoded Digest Parameters to send over Generic Passthrough BYTE *pDigestParamEncoded = NULL; // Response buffer from Generic Passthough (extracted from MessageResposne) PDIGEST_BLOB_RESPONSE pDigestResponse = NULL; UCHAR *pucResponseBuffer = NULL; // Used for alignment to long word boundaries BOOL fKnownFormat = FALSE; // is the response blob format known // Generic Passthrough variables - used to send data to DC for digest verification UNICODE_STRING MsvPackageName = CONSTANT_UNICODE_STRING(TEXT(MSV1_0_PACKAGE_NAME)); UNICODE_STRING ustrDC; // Location for generic passthrough PMSV1_0_PASSTHROUGH_REQUEST PassthroughRequest = NULL; PMSV1_0_PASSTHROUGH_RESPONSE PassthroughResponse = NULL; ULONG RequestSize = 0; ULONG ResponseSize = 0; PUCHAR Where = NULL; // AuthData to Logon Token Variables SECURITY_LOGON_TYPE LogonType = Network; SECURITY_IMPERSONATION_LEVEL ImpersonationLevel = SecurityImpersonation; UNICODE_STRING ustrAccountName; PUCHAR puctr = NULL; ULONG ulSumTotal = 0; ULONG i = 0; DebugLog((DEB_TRACE_FUNC, "DigestProcessParameters: Entering\n")); ZeroMemory(&ustrAccountName, sizeof(ustrAccountName)); ZeroMemory(&ustrDC, sizeof(ustrDC)); // Copy over the context types into the digest structure pDigest->typeAlgorithm = pContext->typeAlgorithm; pDigest->typeDigest = pContext->typeDigest; pDigest->typeQOP = pContext->typeQOP; pDigest->typeCharset = pContext->typeCharset; // Check to make sure that the nonce sent back originated from this machine and is valid Status = NonceIsValid(&(pDigest->refstrParam[MD5_AUTH_NONCE])); if (!NT_SUCCESS(Status)) { Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "DigestProcessParameters: Nonce is not valid\n")); goto CleanUp; } // Make sure that the nonces are the same if (RtlCompareString(&(pContext->strNonce), &(pDigest->refstrParam[MD5_AUTH_NONCE]), FALSE)) { Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "DigestProcessParameters: nonce does not mach Context nonce!\n")); goto CleanUp; } // We must have a noncecount specified since we specified a qop in the Challenge // If we decide to support no noncecount modes then we need to make sure that qop is not specified if (pDigest->refstrParam[MD5_AUTH_NC].Length) { Status = RtlCharToInteger(pDigest->refstrParam[MD5_AUTH_NC].Buffer, HEXBASE, &ulNonceCount); if (!NT_SUCCESS(Status)) { Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "DigestProcessParameters: Nonce Count badly formatted\n")); goto CleanUp; } } else { Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "DigestProcessParameters: Nonce Count not specified\n")); goto CleanUp; } // Check nonceCount is incremented to preclude replay if (ulNonceCount < (pContext->ulNC + 1)) { // We failed to verify next noncecount Status = SEC_E_OUT_OF_SEQUENCE; DebugLog((DEB_ERROR, "DigestProcessParameters: NonceCount failed to increment!\n")); goto CleanUp; } // Verify that this context matches the content in the Digest Parameters // We have already gone to the DC and authenticated the first message if (pContext->strSessionKey.Length) { DebugLog((DEB_TRACE, "DigestProcessParameters: We have a previous session key - use key for auth\n")); // Copy the SessionKey from the Context into the Digest Structure to verify against // This will have Digest Auth routines use the SessionKey rather than recompute H(A1) StringFree(&(pDigest->strSessionKey)); Status = StringDuplicate(&(pDigest->strSessionKey), &(pContext->strSessionKey)); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to copy over SessionKey\n")); goto CleanUp; } // No check locally that Digest is authentic Status = DigestCalculation(pDigest, NULL); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: Oh no we FAILED Authentication!!!!\n")); goto CleanUp; } // We have an authenticated the request // Can utilize logonID pContext->ulNC = ulNonceCount; // Indicate that we have processed up to this NC } else { DebugLog((DEB_TRACE, "DigestProcessParameters: No session key - call DC for auth\n")); Status = DigestDecodeDirectiveStrings(pDigest); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: DigestDecodeDirectiveStrings error 0x%x\n", Status)); goto CleanUp; } // Identify the domain to send generic passthough to Status = DigestDecodeUserAccount(pDigest, &ustrDC); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: DigestDecodeUserAccount failed 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "DigestProcessParameters: GenericPassthrough to domain [%wZ]\n", &ustrDC)); // Serialize the Digest Parameters (if need to send off box) cbDigestParamEncoded = 0; // Will be allocated by BlobEncodeRequest Status = BlobEncodeRequest(pDigest, &pDigestParamEncoded, &cbDigestParamEncoded); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: BlobEncodeRequest failed 0x%x\n", Status)); goto CleanUp; } // Send the Serialized Digest to the DC for verification & return of validity & session key // If paramters match, perform authentication locally and utilize previous token // // We have to pass off to the DC so build the request. // RequestSize = sizeof(MSV1_0_PASSTHROUGH_REQUEST) + ustrDC.Length + g_ustrNtDigestPackageName.Length + cbDigestParamEncoded; PassthroughRequest = (PMSV1_0_PASSTHROUGH_REQUEST) DigestAllocateMemory(RequestSize); if (PassthroughRequest == NULL) { Status = STATUS_INSUFFICIENT_RESOURCES; goto CleanUp; } Where = (PUCHAR) (PassthroughRequest + 1); // Points to byte AFTER passthrough header PassthroughRequest->MessageType = MsV1_0GenericPassthrough; PassthroughRequest->DomainName.Length = ustrDC.Length; PassthroughRequest->DomainName.MaximumLength = ustrDC.Length; PassthroughRequest->DomainName.Buffer = (LPWSTR) Where; // this is NOT NULL TERMINATED RtlCopyMemory( Where, ustrDC.Buffer, ustrDC.Length ); Where += ustrDC.Length; PassthroughRequest->PackageName.Length = g_ustrNtDigestPackageName.Length; PassthroughRequest->PackageName.MaximumLength = g_ustrNtDigestPackageName.Length; PassthroughRequest->PackageName.Buffer = (LPWSTR) Where; // Not NULL terminated - relative reference RtlCopyMemory( Where, g_ustrNtDigestPackageName.Buffer, g_ustrNtDigestPackageName.Length ); Where += g_ustrNtDigestPackageName.Length; PassthroughRequest->LogonData = Where; PassthroughRequest->DataLength = (ULONG)cbDigestParamEncoded; RtlCopyMemory( Where, pDigestParamEncoded, cbDigestParamEncoded ); // // We've build the buffer, now call NTLM to pass it through. // Status = g_LsaFunctions->CallPackage( &MsvPackageName, PassthroughRequest, RequestSize, // How many bytes to send in Request (PVOID *) &PassthroughResponse, // Place the buffers here &ResponseSize, // Passed back the size of the buffer &SubStatus // Return code from Digest Auth on the DC ); DebugLog((DEB_TRACE, "DigestProcessParameters: Returned from Server's passthrough call Response buffer size %ld\n", ResponseSize)); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR,"DigestProcessParameters: Failed to call MSV package to verify Digest: 0x%x\n",Status)); if (Status == STATUS_INVALID_INFO_CLASS) { Status = STATUS_LOGON_FAILURE; } goto CleanUp; } if (!NT_SUCCESS(SubStatus)) { Status = SubStatus; DebugLog((DEB_ERROR,"DigestProcessParameters: DC failed to verify Digest Response: 0x%x\n",Status)); goto CleanUp; } // Now pull out info from the Passthrough Response structure if (PassthroughResponse->DataLength < sizeof(DIGEST_BLOB_RESPONSE)) { // The returned data is not the expected size Status = STATUS_INTERNAL_ERROR; DebugLog((DEB_ERROR,"DigestProcessParameters: DC Response wrong data size: 0x%x\n",Status)); goto CleanUp; } // Copy it to a structure - can do direct map once we know this works OK // Copy to Allocated memory forces aligment of fields pDigestResponse = (PDIGEST_BLOB_RESPONSE)DigestAllocateMemory(PassthroughResponse->DataLength); if (!pDigestResponse) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR,"DigestProcessParameters: Out of memory for response buffer alloc\n")); goto CleanUp; } Where = (PUCHAR) (PassthroughResponse + 1); // start copy after header RtlCopyMemory( pDigestResponse, Where, PassthroughResponse->DataLength ); // We should now have all the data we need for sessionkeys and if verified auth // Check the MessageType and Versions if supported if ((pDigestResponse->MessageType == VERIFY_DIGEST_MESSAGE_RESPONSE) && (pDigestResponse->version == DIGEST_BLOB_VERSION)) { fKnownFormat = TRUE; // We know how to process this blob from the DC DebugLog((DEB_TRACE,"DigestProcessParameters: DC Response known type and version\n")); } if (!fKnownFormat) { // The returned data not of a known type or version Status = STATUS_INTERNAL_ERROR; DebugLog((DEB_ERROR,"DigestProcessParameters: DC Response unknown type or version\n")); goto CleanUp; } DebugLog((DEB_TRACE,"DigestProcessParameters: Processing DC Response\n")); // If authenticated then, create a logon token with the DC returns (unless previous token exists) // Now create the logon token with the AuthData buffer // LsaConvertAuthDataToToken() // Set the AuthorityName to the DC's Domainname // g_DigestSource established at SpInitialize time in the LSA if (!pDigestResponse->ulAuthDataSize) { // We do not have any AuthData Status = STATUS_LOGON_FAILURE; DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to determine AuthData\n")); goto CleanUp; } // Copy over data to place on correct boundary (alloc should force long word boundary) puctr = (PUCHAR)DigestAllocateMemory(pDigestResponse->ulAuthDataSize); if (!puctr) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR, "DigestProcessParameters: out of memory on response PAC buffer\n")); goto CleanUp; } memcpy(puctr,&(pDigestResponse->cAuthData),pDigestResponse->ulAuthDataSize); ulSumTotal = 0; for (i=0; i < (pDigestResponse->ulAuthDataSize); i++) { ulSumTotal += (ULONG)*(puctr + i); } // DebugLog((DEB_TRACE, "DigestProcessParameters: AuthData SumTotal is %ld\n", ulSumTotal)); Status = g_LsaFunctions->ConvertAuthDataToToken(puctr, pDigestResponse->ulAuthDataSize, ImpersonationLevel, &g_DigestSource, LogonType, &pDigest->ustrCrackedDomain, &(pContext->TokenHandle), &(pContext->LoginID), &ustrAccountName, &SubStatus); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to form token from AuthData 0x%x subStatus 0x%x\n", Status, SubStatus)); pContext->TokenHandle = NULL; // no valid handle returned goto CleanUp; } fLogonSessionCreated = TRUE; // LSA notified about LogonID DebugLog((DEB_TRACE, "DigestProcessParameters: Token Created Handle 0x%x, LogonID (%x:%lx) \n", pContext->TokenHandle, pContext->LoginID.HighPart, pContext->LoginID.LowPart)); DebugLog((DEB_TRACE, "DigestProcessParameters: AccountName %wZ \n", &ustrAccountName)); DebugLog((DEB_TRACE, "DigestProcessParameters: Domain %wZ \n", &pDigest->ustrCrackedDomain)); DebugLog((DEB_TRACE, "DigestProcessParameters: Passthrough UserName %wZ \n", &pDigest->ustrUsername)); pContext->ulNC = ulNonceCount; // Indicate that we have processed up to this NC // Since all authenticated, initialize the known Context states (void)UnicodeStringFree(&(pContext->ustrAccountName)); Status = UnicodeStringDuplicate(&(pContext->ustrAccountName), &ustrAccountName); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to copy UserName into Context\n")); goto CleanUp; } (void)UnicodeStringFree(&(pContext->ustrDomain)); Status = UnicodeStringDuplicate(&(pContext->ustrDomain), &pDigest->ustrCrackedDomain); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to copy UserName into Context\n")); goto CleanUp; } StringFree(&(pContext->strSessionKey)); Status = StringAllocate(&(pContext->strSessionKey), pDigestResponse->SessionKeyMaxLength); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to alloc Sessionkey memory\n")); goto CleanUp; } memcpy(pContext->strSessionKey.Buffer, pDigestResponse->SessionKey, pDigestResponse->SessionKeyMaxLength); pContext->strSessionKey.Length = (USHORT)strlencounted(pContext->strSessionKey.Buffer, pDigestResponse->SessionKeyMaxLength); DebugLog((DEB_TRACE, "DigestProcessParameters: Response Data from passthrough call\n")); DebugLog((DEB_TRACE, " Session Key: %Z\n", &(pContext->strSessionKey))); if (pContext->typeDigest == SASL_SERVER) { // Form the ResponseAuth according to RFC2831 Sect 2.1.3 StringFree(&pDigest->strSessionKey); StringDuplicate(&pDigest->strSessionKey, &pContext->strSessionKey); Status = DigestSASLResponseAuth(pDigest, pOutputToken); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to generate ResponseAuth\n")); goto CleanUp; } } } // Token created - Logon OK *pAuditLogStatus = STATUS_SUCCESS; CleanUp: BlobFreeRequest(pDigestParamEncoded); DigestFreeMemory(pMessageResponse); pMessageResponse = NULL; ulMessageResponse = 0; if (!NT_SUCCESS(Status)) { // If we failed - do extra cleanup if (fLogonSessionCreated == TRUE) { // Notify LSA that LogonID is not valid SubStatus = g_LsaFunctions->DeleteLogonSession(&(pContext->LoginID)); if (!NT_SUCCESS(SubStatus)) { DebugLog((DEB_ERROR, "DigestProcessParameters: cleanup DeleteLogonSession failed\n")); } fLogonSessionCreated = FALSE; } // If we created a token then we need to close it if (pContext->TokenHandle) { SubStatus = NtClose(pContext->TokenHandle); pContext->TokenHandle = NULL; } } if (pDigestResponse) { DigestFreeMemory(pDigestResponse); } if (PassthroughRequest != NULL) { DigestFreeMemory(PassthroughRequest); } if (PassthroughResponse != NULL) { g_LsaFunctions->FreeReturnBuffer(PassthroughResponse); } if (ustrAccountName.Buffer) { // Need to free up memory from token creation g_LsaFunctions->FreeLsaHeap(ustrAccountName.Buffer); ustrAccountName.Buffer = NULL; ustrAccountName.Length = ustrAccountName.MaximumLength = 0; } DigestFreeMemory(puctr); UnicodeStringFree(&ustrDC); DebugLog((DEB_TRACE_FUNC, "DigestProcessParameters: Leaving\n")); return(Status); } // This call is utilized by Initialize Securitycontext - it is used to create the sessionkey // form the response hash. This function is called only as a client process NTSTATUS NTAPI DigestGenerateParameters( IN OUT PDIGEST_CONTEXT pContext, IN PDIGEST_PARAMETER pDigest, OUT PSecBuffer pOutputToken) { NTSTATUS Status = STATUS_SUCCESS; NTSTATUS SubStatus = STATUS_SUCCESS; UNICODE_STRING ustrTempPasswd; USER_CREDENTIALS UserCreds; ZeroMemory(&UserCreds, sizeof(USER_CREDENTIALS)); ZeroMemory(&ustrTempPasswd, sizeof(ustrTempPasswd)); DebugLog((DEB_TRACE_FUNC, "DigestGenerateParameters: Entering\n")); pDigest->typeDigest = pContext->typeDigest; pDigest->typeAlgorithm = pContext->typeAlgorithm; pDigest->typeQOP = pContext->typeQOP; pDigest->typeCipher = pContext->typeCipher; pDigest->typeCharset = pContext->typeCharset; // We must have specified the username and password Status = UnicodeStringDuplicate(&(UserCreds.ustrDomain), &(pContext->ustrDomain)); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestGenerateParameters: Duplicate Domain string status 0x%x\n", Status)); goto CleanUp; } Status = UnicodeStringDuplicate(&(UserCreds.ustrUsername), &(pContext->ustrAccountName)); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestGenerateParameters: Duplicate Username string status 0x%x\n", Status)); goto CleanUp; } Status = UnicodeStringDuplicatePassword(&(UserCreds.ustrPasswd), &(pContext->ustrPassword)); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestGenerateParameters: Duplicate Password string status 0x%x\n", Status)); goto CleanUp; } UserCreds.fIsValidPasswd = TRUE; UserCreds.fIsEncryptedPasswd = TRUE; DebugLog((DEB_TRACE, "DigestGenerateParameters: Before DigestCalculation\n")); (void)DigestPrint(pDigest); // No check locally that Digest is authentic Status = DigestCalculation(pDigest, &UserCreds); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestGenerateParameters: Oh no we FAILED Authentication!!!!\n")); goto CleanUp; } // DigestCalculation determined the sessionkey - copy into this context StringFree(&(pContext->strSessionKey)); Status = StringDuplicate( &(pContext->strSessionKey), &(pDigest->strSessionKey)); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestGenerateParameters: Failed to copy over SessionKey\n")); goto CleanUp; } // We have an authenticated the request // Can utilize logonID Status = DigestCreateChalResp(pDigest, &UserCreds, pOutputToken); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestGenerateParameters: Failed to create Output String status 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "DigestGenerateParameters: After DigestCalculation & copy struct\n")); (void)DigestPrint(pDigest); CleanUp: UserCredentialsFree(&UserCreds); UnicodeStringFree(&ustrTempPasswd); DebugLog((DEB_TRACE_FUNC, "DigestGenerateParameters: Leaving\n")); return(Status); } // Called by digest (inside LSA) with a buffer routed from a server to the DC running this code // We need to strip out the header and extract the DIGEST_BLOB_REQUEST // // pcbMessageRequest will return the number of bytes allocated for response // ppMessageResponse will contain the pointer to the allocated buffer // calling routine must free the buffer (DigestFreeMemory) after it is done with it NTSTATUS NTAPI DigestPackagePassthrough(IN USHORT cbMessageRequest, IN BYTE *pMessageRequest, IN OUT ULONG *pulMessageResponse, OUT PBYTE *ppMessageResponse) { NTSTATUS Status = STATUS_SUCCESS; DebugLog((DEB_TRACE_FUNC, "DigestPackagePassthrough: Entering\n")); if (!pMessageRequest || !ppMessageResponse || !pulMessageResponse || (cbMessageRequest < sizeof(DIGEST_BLOB_REQUEST))) { Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "DigestPackagePassthrough: Bad input Paramters\n")); goto CleanUp; } // Function will allocate space for Response - we need to free it after use Status = DigestResponseBru(pMessageRequest, pulMessageResponse, ppMessageResponse); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestPackagePassthrough: Error with DigestVerifyResponseBru\n")); goto CleanUp; } CleanUp: DebugLog((DEB_TRACE_FUNC, "DigestPackagePassthrough: Leaving\n")); return(Status); } // Routine receives the DigestBlob to process by extracting the password // and verifying the response-value. If authenticated, the SessionKey can be returned // to the server for future authentication // // This routine runs under LSA on the DC. It will do the actual Digest auth and return session keys // // pcbResponse is a pointer to a USHORT which holds amount of bytes in PResponse // it also returns the number of bytes actually used // The buffer will be allocated in this routine by DigestAllocateMemory and must be freed by DigestFreeMemory by // calling routine NTSTATUS NTAPI DigestResponseBru( IN BYTE *pDigestParamEncoded, IN OUT ULONG *pulResponse, OUT PBYTE *ppResponse) { NTSTATUS Status = STATUS_SUCCESS; NTSTATUS StatusSub = STATUS_LOGON_FAILURE; DIGEST_PARAMETER Digest; PDIGEST_BLOB_RESPONSE pBlobResponse = NULL; USER_CREDENTIALS UserCreds; PUCHAR pucAuthData = NULL; ULONG ulAuthDataSize = 0; ULONG ulBuffer = 0; BOOL fDigestValid = FALSE; USHORT indx = 0; DebugLog((DEB_TRACE_FUNC, "DigestResponseBru: Entering\n")); ZeroMemory(&UserCreds, sizeof(USER_CREDENTIALS)); Status = DigestInit(&Digest); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestResponseBru: Failed to initialize digest struct\n")); goto CleanUp; } Status = BlobDecodeRequest(pDigestParamEncoded, &Digest); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestResponseBru: Failed to copy over SessionKey 0x%x\n", Status)); goto CleanUp; } // Pull out the username and domain to process Status = UserCredentialsExtract(&Digest, &UserCreds); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestResponseBru: Failed UserCredentialsExtract 0x%x\n", Status)); goto CleanUp; } // Extract Passwords (Cleartext and hash if available) Status = DigestGetPasswd(&UserCreds, &pucAuthData, &ulAuthDataSize); if (Status == STATUS_INVALID_SERVER_STATE) { DebugLog((DEB_WARN, "DigestResponseBru: Unable to get credentials - not on Domain Controller 0x%x\n")); StatusSub = STATUS_LOGON_FAILURE; } else if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestResponseBru: Failed to find password for %wZ\n", &(UserCreds.ustrUsername))); goto CleanUp; } DebugLog((DEB_TRACE, "DigestResponseBru: Got password for user %wZ, is valid %d; AuthData size %ld\n", &(UserCreds.ustrUsername), UserCreds.fIsValidPasswd, ulAuthDataSize )); DebugLog((DEB_TRACE, "DigestResponseBru: HashCred size is %d\n", UserCreds.strDigestHash.Length )); // We now have passwd - either/both pre-computed hash or passwd // Also, an authData blob to marshal back to server // Now validate the Digest ChallengeResponse // Check precalculated hashes first fDigestValid = FALSE; if (UserCreds.fIsValidDigestHash == TRUE) { // Need to cycle over the possible matching hashes based on username format indx = 1; // skip the first hash this is the header while ((fDigestValid == FALSE) && (indx < TOTALPRECALC_HEADERS)) { if (UserCreds.sHashTags[indx]) { DebugLog((DEB_TRACE, "DigestResponseBru: Checking Precalc hash 0x%x\n", indx)); UserCreds.wHashSelected = indx; } else { indx++; // skip to the next hash since incorrect format continue; } StringFree(&Digest.strSessionKey); // clear out any previous session key info StatusSub = DigestCalculation(&Digest, &UserCreds); if (NT_SUCCESS(StatusSub)) { // Precalculated hash matched! DebugLog((DEB_TRACE, "DigestResponseBru: Digest valid with precalc hash 0x%x\n", indx)); fDigestValid = TRUE; } else if ((StatusSub == STATUS_WRONG_PASSWORD) || (StatusSub == SEC_E_NO_CREDENTIALS)) { // Really we know only that the Hash did not compare - could be anything incorrect // We do not provide information that the password was incorrect DebugLog((DEB_TRACE, "DigestResponseBru: Digest did not match precalc hash 0x%x\n", indx)); indx++; } else { Status = StatusSub; DebugLog((DEB_ERROR, "DigestResponseBru: Digest Verify Failed 0x%x\n", Status)); goto CleanUp; } } if (fDigestValid == FALSE) { UserCreds.fIsValidDigestHash = FALSE; // no need to try to use any of these hashes again } } // If ClearText passwd available, then try to validate the Digest ChallengeResponse if ((fDigestValid == FALSE) && (UserCreds.fIsValidPasswd == TRUE)) { StringFree(&Digest.strSessionKey); // clear out any previous session key info StatusSub = DigestCalculation(&Digest, &UserCreds); if (NT_SUCCESS(StatusSub)) { // Really we know only that the Hash did not compare - could be anything incorrect // We do not provide information that the password was incorrect DebugLog((DEB_TRACE, "DigestResponseBru: Digest valid with cleartext password\n")); fDigestValid = TRUE; } else if (StatusSub == STATUS_WRONG_PASSWORD) { // Really we know only that the Hash did not compare - could be anything incorrect // We do not provide information that the password was incorrect DebugLog((DEB_ERROR, "DigestResponseBru: Digest did not match cleartext passsword\n")); } else { Status = StatusSub; DebugLog((DEB_ERROR, "DigestResponseBru: Digest Verify Failed 0x%x\n", Status)); goto CleanUp; } } // We completed the Auth (it might have failed though) // Make sure enough room in output buffer ulBuffer = sizeof(DIGEST_BLOB_RESPONSE); if (fDigestValid == TRUE) { // We succeeded in auth so send back AuthData for tokens ulBuffer += ulAuthDataSize; } else { ulAuthDataSize = 0; // Do not send back Auth data unless Digest Calc Succeeded } DebugLog((DEB_TRACE, "DigestResponseBru: Total size for return buffer is %ld bytes\n", ulBuffer)); pBlobResponse = (PDIGEST_BLOB_RESPONSE)DigestAllocateMemory(ulBuffer); if (!pBlobResponse) { Status = SEC_E_INSUFFICIENT_MEMORY; DebugLog((DEB_ERROR, "DigestResponseBru: Can not allocate memory for Output Response Buffer\n")); goto CleanUp; } pBlobResponse->MessageType = VERIFY_DIGEST_MESSAGE_RESPONSE; pBlobResponse->version = DIGEST_BLOB_VERSION; if (!NT_SUCCESS(StatusSub)) { StatusSub = STATUS_LOGON_FAILURE; // Returns either Sucess or LogonFailure } pBlobResponse->Status = StatusSub; // Should be STATUS_SUCCESS or STATUS_LOGON_FAILURE pBlobResponse->ulAuthDataSize = ulAuthDataSize; // Could be an assert too if (Digest.strSessionKey.Length != MD5_HASH_HEX_SIZE) { DebugLog((DEB_ERROR, "DigestResponseBru: Failed SessionKey generation\n")); Status = STATUS_INTERNAL_ERROR; // Program flow failure goto CleanUp; } pBlobResponse->SessionKeyMaxLength = MD5_HASH_HEX_SIZE + 1; // MD5 hash + NULL memcpy(pBlobResponse->SessionKey, Digest.strSessionKey.Buffer, MD5_HASH_HEX_SIZE); if (ulAuthDataSize) { // Copy over the AuthData only if DigestCalc succeeded (i.e. ulAuthDataSize != 0) memcpy(&(pBlobResponse->cAuthData), pucAuthData, ulAuthDataSize); } // OK we are done filling in output Response buffer - we can leave now! *pulResponse = ulBuffer; // Set the size of the response blob *ppResponse = (PBYTE)pBlobResponse; // set the buffer allocated CleanUp: DigestFree(&Digest); UserCredentialsFree(&UserCreds); // Cleanup any allocated heap from GetUserAuthData if (pucAuthData) { g_LsaFunctions->FreeLsaHeap(pucAuthData); pucAuthData = NULL; ulAuthDataSize = 0; } if (!NT_SUCCESS(Status)) { // We had an error - free allocated memory *pulResponse = 0; if (pBlobResponse) { DigestFreeMemory(pBlobResponse); pBlobResponse = NULL; *ppResponse = NULL; // No output buffer provided } } DebugLog((DEB_TRACE_FUNC, "DigestResponseBru: Leaving\n")); return(Status); } NTSTATUS DigestPrint(PDIGEST_PARAMETER pDigest) { NTSTATUS Status = STATUS_SUCCESS; int i = 0; if (!pDigest) { return (STATUS_INVALID_PARAMETER); } if (pDigest->typeDigest == DIGEST_UNDEFINED) { DebugLog((DEB_TRACE, "Digest: DIGEST_UNDEFINED\n")); } if (pDigest->typeDigest == NO_DIGEST_SPECIFIED) { DebugLog((DEB_ERROR, "Digest: NO_DIGEST_SPECIFIED\n")); } if (pDigest->typeDigest == DIGEST_CLIENT) { DebugLog((DEB_TRACE, "Digest: DIGEST_CLIENT\n")); } if (pDigest->typeDigest == DIGEST_SERVER) { DebugLog((DEB_TRACE, "Digest: DIGEST_SERVER\n")); } if (pDigest->typeDigest == SASL_SERVER) { DebugLog((DEB_TRACE, "Digest: SASL_SERVER\n")); } if (pDigest->typeDigest == SASL_CLIENT) { DebugLog((DEB_TRACE, "Digest: SASL_CLIENT\n")); } if (pDigest->typeQOP == QOP_UNDEFINED) { DebugLog((DEB_ERROR, "Digest: QOP: Not QOP_UNDEFINED\n")); } if (pDigest->typeQOP == NO_QOP_SPECIFIED) { DebugLog((DEB_TRACE, "Digest: QOP: Not Specified\n")); } if (pDigest->typeQOP == AUTH) { DebugLog((DEB_TRACE, "Digest: QOP: AUTH\n")); } if (pDigest->typeQOP == AUTH_INT) { DebugLog((DEB_TRACE, "Digest: QOP: AUTH_INT\n")); } if (pDigest->typeQOP == AUTH_CONF) { DebugLog((DEB_TRACE, "Digest: QOP: AUTH_CONF\n")); } if (pDigest->typeAlgorithm == ALGORITHM_UNDEFINED) { DebugLog((DEB_ERROR, "Digest: Algorithm: ALGORITHM_UNDEFINED\n")); } if (pDigest->typeAlgorithm == NO_ALGORITHM_SPECIFIED) { DebugLog((DEB_TRACE, "Digest: Algorithm: NO_ALGORITHM_SPECIFIED\n")); } if (pDigest->typeAlgorithm == MD5) { DebugLog((DEB_TRACE, "Digest: Algorithm: MD5\n")); } if (pDigest->typeAlgorithm == MD5_SESS) { DebugLog((DEB_TRACE, "Digest: Algorithm: MD5_SESS\n")); } if (pDigest->typeCharset == ISO_8859_1) { DebugLog((DEB_TRACE, "Digest: CharSet: ISO-8859-1\n")); } if (pDigest->typeCharset == UTF_8) { DebugLog((DEB_TRACE, "Digest: CharSet: UTF-8\n")); } for (i=0; i < MD5_AUTH_LAST;i++) { if (pDigest->refstrParam[i].Buffer && pDigest->refstrParam[i].Length) { DebugLog((DEB_TRACE, "Digest: Digest[%d] = \"%Z\"\n", i, &pDigest->refstrParam[i])); } } DebugLog((DEB_TRACE, "Digest: SessionKey %Z\n", &(pDigest->strSessionKey))); DebugLog((DEB_TRACE, "Digest: Response %Z\n", &(pDigest->strResponse))); DebugLog((DEB_TRACE, "Digest: Username %wZ\n", &(pDigest->ustrUsername))); DebugLog((DEB_TRACE, "Digest: Realm %wZ\n", &(pDigest->ustrRealm))); DebugLog((DEB_TRACE, "Digest: URI %wZ\n", &(pDigest->ustrUri))); DebugLog((DEB_TRACE, "Digest: CrackedAccountName %wZ\n", &(pDigest->ustrCrackedAccountName))); DebugLog((DEB_TRACE, "Digest: CrackedDomain %wZ\n", &(pDigest->ustrCrackedDomain))); return(Status); } NTSTATUS ContextPrint(PDIGEST_CONTEXT pContext) { NTSTATUS Status = STATUS_SUCCESS; int i = 0; if (!pContext) { return (STATUS_INVALID_PARAMETER); } if (pContext->typeDigest == DIGEST_UNDEFINED) { DebugLog((DEB_TRACE, "Context: DIGEST_UNDEFINED\n")); } if (pContext->typeDigest == NO_DIGEST_SPECIFIED) { DebugLog((DEB_ERROR, "Context: NO_DIGEST_SPECIFIED\n")); } if (pContext->typeDigest == DIGEST_CLIENT) { DebugLog((DEB_TRACE, "Context: DIGEST_CLIENT\n")); } if (pContext->typeDigest == DIGEST_SERVER) { DebugLog((DEB_TRACE, "Context: DIGEST_SERVER\n")); } if (pContext->typeDigest == SASL_SERVER) { DebugLog((DEB_TRACE, "Context: SASL_SERVER\n")); } if (pContext->typeDigest == SASL_CLIENT) { DebugLog((DEB_TRACE, "Context: SASL_CLIENT\n")); } if (pContext->typeQOP == QOP_UNDEFINED) { DebugLog((DEB_ERROR, "Context: QOP: QOP_UNDEFINED\n")); } if (pContext->typeQOP == NO_QOP_SPECIFIED) { DebugLog((DEB_TRACE, "Context: QOP: NO_QOP_SPECIFIED\n")); } if (pContext->typeQOP == AUTH) { DebugLog((DEB_TRACE, "Context: QOP: AUTH\n")); } if (pContext->typeQOP == AUTH_INT) { DebugLog((DEB_TRACE, "Context: QOP: AUTH_INT\n")); } if (pContext->typeQOP == AUTH_CONF) { DebugLog((DEB_TRACE, "Context: QOP: AUTH_CONF\n")); } if (pContext->typeAlgorithm == ALGORITHM_UNDEFINED) { DebugLog((DEB_ERROR, "Context: Algorithm: ALGORITHM_UNDEFINED\n")); } if (pContext->typeAlgorithm == NO_ALGORITHM_SPECIFIED) { DebugLog((DEB_TRACE, "Context: Algorithm: NO_ALGORITHM_SPECIFIED\n")); } if (pContext->typeAlgorithm == MD5) { DebugLog((DEB_TRACE, "Context: Algorithm: MD5\n")); } if (pContext->typeAlgorithm == MD5_SESS) { DebugLog((DEB_TRACE, "Context: Algorithm: MD5_SESS\n")); } if (pContext->typeCipher == CIPHER_RC4) { DebugLog((DEB_TRACE, "Context: Cipher: RC4\n")); } if (pContext->typeCipher == CIPHER_RC4_40) { DebugLog((DEB_TRACE, "Context: Cipher: RC4_40\n")); } if (pContext->typeCipher == CIPHER_RC4_56) { DebugLog((DEB_TRACE, "Context: Cipher: RC4_56\n")); } if (pContext->typeCipher == CIPHER_3DES) { DebugLog((DEB_TRACE, "Context: Cipher: 3DES\n")); } if (pContext->typeCipher == CIPHER_DES) { DebugLog((DEB_TRACE, "Context: Cipher: DES\n")); } if (pContext->typeCharset == ISO_8859_1) { DebugLog((DEB_TRACE, "Context: Charset: ISO-8859-1\n")); } if (pContext->typeCharset == UTF_8) { DebugLog((DEB_TRACE, "Context: Charset: UTF-8\n")); } DebugLog((DEB_TRACE, "Context: NC %d\n", pContext->ulNC)); DebugLog((DEB_TRACE, "Context: LogonId (%x:%lx)\n", pContext->LoginID.HighPart, pContext->LoginID.LowPart )); DebugLog((DEB_TRACE, "Context: strNonce %Z\n", &(pContext->strNonce))); DebugLog((DEB_TRACE, "Context: strCNonce %Z\n", &(pContext->strCNonce))); DebugLog((DEB_TRACE, "Context: strOpaque %Z\n", &(pContext->strOpaque))); DebugLog((DEB_TRACE, "Context: strSessionKey %Z\n", &(pContext->strSessionKey))); DebugLog((DEB_TRACE, "Context: ustrDomain %wZ\n", &(pContext->ustrDomain))); DebugLog((DEB_TRACE, "Context: ustrAccountName %wZ\n", &(pContext->ustrAccountName))); DebugLog((DEB_TRACE, "Context: SendMaxBuf %lu\n", &(pContext->ulSendMaxBuf))); return(Status); } // Extracts the username and domain from the digest directives // Need to process the character set to properly decode the directive values // The major character sets are UTF-8 and ISO-8859-1 // The forms that may be present in the directive values are: // Username Realm // 1. username domain // 2. domain/username domainForestName // 3. UPN domainForestName NTSTATUS UserCredentialsExtract(PDIGEST_PARAMETER pDigest, PUSER_CREDENTIALS pUserCreds) { NTSTATUS Status = STATUS_SUCCESS; int iRC = 0; DebugLog((DEB_TRACE_FUNC, "UserCredentialsExtract: Entering\n")); if (!pDigest || !(pDigest->refstrParam[MD5_AUTH_USERNAME].Length)) { Status = STATUS_NO_SUCH_USER; DebugLog((DEB_ERROR, "UserCredentialsExtract: Invalid Username or realm\n")); goto CleanUp; } Status = DigestDecodeDirectiveStrings(pDigest); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "UserCredentialsExtract: DigestDecodeDirectiveStrings error 0x%x\n", Status)); goto CleanUp; } // parse out the username & domain pUserCreds->typeName = pDigest->typeName; // Indicate which type of name format utilized Status = UnicodeStringDuplicate(&(pUserCreds->ustrUsername), &(pDigest->ustrCrackedAccountName)); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "UserCredentialsExtract: UnicodeStringDuplicate Username error 0x%x\n", Status)); goto CleanUp; } Status = UnicodeStringDuplicate(&(pUserCreds->ustrDomain), &(pDigest->ustrCrackedDomain)); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "UserCredentialsExtract: UnicodeStringDuplicate Domain error 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "UserCredentialsExtract: Hash index %d Account %wZ Domain %wZ\n", pUserCreds->wHashSelected, &(pUserCreds->ustrUsername), &(pUserCreds->ustrDomain))); DebugLog((DEB_TRACE_FUNC, "UserCredentialsExtract: Leaving Status 0x%x\n", Status)); CleanUp: return(Status); } // Release memory allocated into UserCredentials NTSTATUS UserCredentialsFree(PUSER_CREDENTIALS pUserCreds) { NTSTATUS Status = STATUS_SUCCESS; UnicodeStringFree(&(pUserCreds->ustrUsername)); if (pUserCreds->ustrPasswd.MaximumLength) { ZeroMemory(pUserCreds->ustrPasswd.Buffer, pUserCreds->ustrPasswd.MaximumLength); } UnicodeStringFree(&(pUserCreds->ustrPasswd)); UnicodeStringFree(&(pUserCreds->ustrDomain)); if (pUserCreds->strDigestHash.MaximumLength) { ZeroMemory(pUserCreds->strDigestHash.Buffer, pUserCreds->strDigestHash.MaximumLength); } StringFree(&(pUserCreds->strDigestHash)); return(Status); } //+-------------------------------------------------------------------- // // Function: DigestSASLResponseAuth // // Synopsis: Generate the ResponseAuth from the server // // Arguments: pDigest - pointer to Digest parameter struct // pCoutputToken - location to send output string to // // Returns: NTSTATUS // // Notes: // //--------------------------------------------------------------------- NTSTATUS DigestSASLResponseAuth( IN PDIGEST_PARAMETER pDigest, OUT PSecBuffer pOutputToken) { NTSTATUS Status = STATUS_SUCCESS; ULONG cbLenNeeded = 0; STRING strReqAuth; PCHAR pczTemp = NULL; ZeroMemory(&strReqAuth, sizeof(strReqAuth)); ASSERT(pDigest); DebugLog((DEB_TRACE_FUNC, "DigestSASLResponseAuth: Entering\n")); Status = DigestCalculateResponseAuth(pDigest, &strReqAuth); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestSASLResponseAuth: Request Auth failed : 0x%x\n", Status)); goto CleanUp; } cbLenNeeded = sizeof(RSPAUTH_STR); cbLenNeeded += strReqAuth.Length; // allocate the buffers for output - in the future can optimze to allocate exact amount needed pczTemp = (PCHAR)DigestAllocateMemory(cbLenNeeded + 1); if (!pczTemp) { DebugLog((DEB_ERROR, "ContextCreateChal: No memory for output buffers\n")); goto CleanUp; } sprintf(pczTemp, RSPAUTH_STR, &strReqAuth); pOutputToken->cbBuffer = strlen(pczTemp); pOutputToken->pvBuffer = pczTemp; CleanUp: DebugLog((DEB_TRACE_FUNC, "DigestSASLResponseAuth: Leaving 0x%x\n", Status)); StringFree(&strReqAuth); return Status; } //+-------------------------------------------------------------------- // // Function: DigestCalculateResponseAuth // // Synopsis: Calculate the ResponseAuth Hash value // // Arguments: pDigest - pointer to Digest parameter struct // pCoutputToken - location to send output string to // // Returns: NTSTATUS // // Notes: // //--------------------------------------------------------------------- NTSTATUS DigestCalculateResponseAuth( IN PDIGEST_PARAMETER pDigest, OUT PSTRING pstrHash) { NTSTATUS Status = STATUS_SUCCESS; ULONG cbLenNeeded = 0; STRING strHA2; STRING strcQOP; PCHAR pczTemp = NULL; ZeroMemory(&strHA2, sizeof(strHA2)); ASSERT(pDigest); ASSERT(pstrHash); DebugLog((DEB_TRACE_FUNC, "DigestCalculateResponseAuth: Entering\n")); DigestPrint(pDigest); StringFree(pstrHash); // Establish which QOP utilized if (pDigest->typeQOP == AUTH_CONF) { RtlInitString(&strcQOP, AUTHCONFSTR); } else if (pDigest->typeQOP == AUTH_INT) { RtlInitString(&strcQOP, AUTHINTSTR); } else if (pDigest->typeQOP == AUTH) { RtlInitString(&strcQOP, AUTHSTR); } else { RtlInitString(&strcQOP, NULL); } // Calculate H(A2) // For QOP unspecified or "auth" H(A2) = H( : URI) // For QOP Auth-int or Auth-conf H(A2) = H( : URI: H(entity-body)) if ((pDigest->typeQOP == AUTH) || (pDigest->typeQOP == NO_QOP_SPECIFIED)) { // Unspecified or Auth DebugLog((DEB_TRACE, "DigestCalculateResponseAuth: H(A2) using AUTH/Unspecified\n")); Status = DigestHash7(NULL, &(pDigest->refstrParam[MD5_AUTH_URI]), NULL, NULL, NULL, NULL, NULL, TRUE, &strHA2); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestCalculateResponseAuthDigestCalculateResponseAuth: H(A2) failed : 0x%x\n", Status)); goto CleanUp; } } else { // Auth-int or Auth-conf DebugLog((DEB_TRACE, "DigestCalculateResponseAuth: H(A2) using AUTH-INT/CONF\n")); Status = DigestHash7(NULL, &(pDigest->refstrParam[MD5_AUTH_URI]), &(pDigest->refstrParam[MD5_AUTH_HENTITY]), NULL, NULL, NULL, NULL, TRUE, &strHA2); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestCalculateResponseAuth H(A2) auth-int failed : 0x%x\n", Status)); goto CleanUp; } } // We now have calculated H(A2) // Calculate Request-Digest // For QOP of Auth, Auth-int, Auth-conf Req-Digest = H( H(A1): nonce: nc: cnonce: qop: H(A2)) Status = DigestHash7(&(pDigest->strSessionKey), &(pDigest->refstrParam[MD5_AUTH_NONCE]), &(pDigest->refstrParam[MD5_AUTH_NC]), &(pDigest->refstrParam[MD5_AUTH_CNONCE]), &strcQOP, &strHA2, NULL, TRUE, pstrHash); if (!NT_SUCCESS(Status)) { DebugLog((DEB_ERROR, "DigestCalculateResponseAuth: Request Auth failed : 0x%x\n", Status)); goto CleanUp; } DebugLog((DEB_TRACE, "DigestCalculateResponseAuth: ResponseAuth is %Z\n", pstrHash)); CleanUp: DebugLog((DEB_TRACE_FUNC, "DigestCalculateResponseAuth: Leaving 0x%x\n", Status)); StringFree(&strHA2); return Status; } //+-------------------------------------------------------------------- // // Function: DigestDecodeUserAccount // // Synopsis: Process the Digest to extract Account Username, Account Domain // generic passthrough domain controller, and index for precalculated digest hash // // Arguments: pDigest - pointer to Digest parameter struct // pustrUsername - username extracted from digest // pusrtUserDomain - domain indicated for account // pustrDC - domain to pass generic passthrough to // pPreCalcIndx - index to use for precalculated index // // Returns: NTSTATUS // // Notes: // //--------------------------------------------------------------------- NTSTATUS DigestDecodeUserAccount( IN PDIGEST_PARAMETER pDigest, OUT PUNICODE_STRING pustrDC) { NTSTATUS Status = STATUS_SUCCESS; NAMEFORMAT_TYPE Indx = NAMEFORMAT_UNKNOWN; USHORT usTemp = 0; DWORD DsStatus = 0; HANDLE hDS = NULL; WCHAR wczName[UNLEN+1]; PWCHAR pwczAcct = NULL; WCHAR wczCrackedDnsDomain[DNS_MAX_NAME_LENGTH + 1 + 1]; // ensured a NULL terminator DWORD dwCrackedDnsDomainCnt = (DNS_MAX_NAME_LENGTH+1) * sizeof(WCHAR); WCHAR wczCrackedName[UNLEN+DNS_MAX_NAME_LENGTH + 2 + 1]; DWORD dwCrackedNameCnt = ((UNLEN+DNS_MAX_NAME_LENGTH + 2) * sizeof(WCHAR)); DWORD dwCrackError = 0; DebugLog((DEB_TRACE_FUNC, "DigestDecodeUserAccount: Entering\n")); DebugLog((DEB_TRACE, "DigestDecodeUserAccount: Checking format on username %wZ\n", &pDigest->ustrUsername)); if (pDigest->ustrUsername.Length / sizeof(WCHAR) > UNLEN) { Status = STATUS_INVALID_PARAMETER; DebugLog((DEB_ERROR, "DigestDecodeUserAccount: Username too long 0x%x\n", Status)); goto CleanUp; } // Now copy string and NULL terminate ZeroMemory(wczName, sizeof(wczName)); ZeroMemory(wczCrackedDnsDomain, sizeof(wczCrackedDnsDomain)); ZeroMemory(wczCrackedName, sizeof(wczCrackedName)); memcpy(wczName, pDigest->ustrUsername.Buffer, pDigest->ustrUsername.Length); // 1. If provided username and realm (assumed to be domain) use that if ((pDigest->ustrRealm.Length) && (pDigest->ustrUsername.Length)) { Indx = NAMEFORMAT_ACCOUNTNAME; if (pustrDC) { UnicodeStringFree(pustrDC); UnicodeStringDuplicate(pustrDC, &(pDigest->ustrRealm)); DebugLog((DEB_TRACE, "DigestDecodeUserAccount: GenericPassthrough DC %wZ\n", pustrDC)); } Status = UnicodeStringDuplicate(&(pDigest->ustrCrackedAccountName), &pDigest->ustrUsername); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Username error 0x%x\n", Status)); goto CleanUp; } Status = UnicodeStringDuplicate(&(pDigest->ustrCrackedDomain), &(pDigest->ustrRealm)); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Domain error 0x%x\n", Status)); goto CleanUp; } pDigest->typeName = Indx; Status = STATUS_SUCCESS; goto CleanUp; } /* // 2. Check for UPN DebugLog((DEB_TRACE, "DigestDecodeUserAccount: Checking with CrackSingleName\n")); Status = CrackSingleName(DS_USER_PRINCIPAL_NAME, DS_NAME_NO_FLAGS, wczName, DS_NT4_ACCOUNT_NAME, &dwCrackedDnsDomainCnt, wczCrackedDnsDomain, &dwCrackedNameCnt, wczCrackedName, &dwCrackError); if (NT_SUCCESS(Status) && (DS_NAME_NO_ERROR == dwCrackError)) { DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName DS_USER_PRINCIPAL_NAME Succeeded\n")); DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName dwErr 0x%x CrackName %S CrackDomain %S\n", dwCrackError, wczCrackedName, wczCrackedDnsDomain)); Indx = NAMEFORMAT_UPN; // Output name format always will be domain+'\'+account+'\0' // Need account location pwczAcct = wcschr(wczCrackedName, L'\\'); if (!pwczAcct) { Status = STATUS_INVALID_ADDRESS; DebugLog((DEB_ERROR, "DigestDecodeUserAccount: Can not locate Account name 0x%x\n", Status)); goto CleanUp; } Status = UnicodeStringWCharDuplicate(&(pDigest->ustrCrackedAccountName), pwczAcct+1); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Username error 0x%x\n", Status)); goto CleanUp; } Status = UnicodeStringWCharDuplicate(&(pDigest->ustrCrackedDomain), wczCrackedDnsDomain); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Domain error 0x%x\n", Status)); goto CleanUp; } if (pustrDC) { UnicodeStringFree(pustrDC); UnicodeStringDuplicate(pustrDC, &(pDigest->ustrCrackedDomain)); DebugLog((DEB_TRACE, "DigestDecodeUserAccount: GenericPassthrough DC %wZ\n", pustrDC)); } pDigest->typeName = Indx; Status = STATUS_SUCCESS; goto CleanUp; } else { DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName DS_USER_PRINCIPAL_NAME Failed 0x%x CrackErr 0x%x\n", Status, dwCrackError)); } // 2. Check for NetBIOS DebugLog((DEB_TRACE, "DigestDecodeUserAccount: Checking with CrackSingleName\n")); Status = CrackSingleName(DS_NT4_ACCOUNT_NAME, DS_NAME_NO_FLAGS, wczName, DS_NT4_ACCOUNT_NAME, &dwCrackedDnsDomainCnt, wczCrackedDnsDomain, &dwCrackedNameCnt, wczCrackedName, &dwCrackError); if (NT_SUCCESS(Status) && (DS_NAME_NO_ERROR == dwCrackError)) { DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName DS_NT4_ACCOUNT_NAME Succeeded\n")); DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName dwErr 0x%x CrackName %S CrackDomain %S\n", dwCrackError, wczCrackedName, wczCrackedDnsDomain)); Indx = NAMEFORMAT_NETBIOS; // Output name format always will be domain+'\'+account+'\0' // Need account location pwczAcct = wcschr(wczCrackedName, L'\\'); if (!pwczAcct) { Status = STATUS_INVALID_ADDRESS; DebugLog((DEB_ERROR, "DigestDecodeUserAccount: Can not locate Account name 0x%x\n", Status)); goto CleanUp; } Status = UnicodeStringWCharDuplicate(&(pDigest->ustrCrackedAccountName), pwczAcct+1); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Username error 0x%x\n", Status)); goto CleanUp; } Status = UnicodeStringWCharDuplicate(&(pDigest->ustrCrackedDomain), wczCrackedDnsDomain); if (!NT_SUCCESS (Status)) { DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Domain error 0x%x\n", Status)); goto CleanUp; } if (pustrDC) { UnicodeStringFree(pustrDC); UnicodeStringDuplicate(pustrDC, &(pDigest->ustrCrackedDomain)); DebugLog((DEB_TRACE, "DigestDecodeUserAccount: GenericPassthrough DC %wZ\n", pustrDC)); } pDigest->typeName = Indx; goto CleanUp; } else { DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName DS_USER_PRINCIPAL_NAME Failed 0x%x\n", Status)); } */ // default to username if (Indx == NAMEFORMAT_UNKNOWN) { Status = STATUS_INVALID_ADDRESS; DebugLog((DEB_ERROR, "DigestDecodeUserAccount: Invalid format for username and realm\n", Status)); } CleanUp: DebugLog((DEB_TRACE_FUNC, "DigestDecodeUserAccount: Leaving 0x%x\n", Status)); return Status; }