//+-----------------------------------------------------------------------
//
// Microsoft Windows
//
// Copyright (c) Microsoft Corporation 2000
//
// File: ctxtapi.cxx
//
// Contents: Context APIs for the Digest security package
// Main entry points into this dll:
// SpDeleteContext
// SpInitLsaModeContext
// SpApplyControlToken
// SpAcceptLsaModeContext
//
// History: KDamour 16Mar00 Based from NTLM ctxtapi.cxx
//
//------------------------------------------------------------------------
extern "C"
{
#include <stdio.h>
}
#include "global.h"
extern "C"
{
#include <ntdsapi.h> // DS_USER_PRINCIPAL_NAME
#include <ntdsa.h> // CrackSingleName
}
#define MAXBUFNUMLEN 9 // VERY BIG number of digits in maxbuf
//+-------------------------------------------------------------------------
//
// Function: SpDeleteContext
//
// Synopsis: Deletes an NtDigest context
//
// Deletes the local data structures associated with the specified
// security context in the LSA.
//
// This API terminates a context on the local machine.
//
// Effects:
//
// Arguments: ContextHandle - The context to delete
//
// Requires:
//
// Returns: STATUS_SUCCESS or STATUS_INVALID_HANDLE
//
// Notes:
//
//
//--------------------------------------------------------------------------
NTSTATUS NTAPI
SpDeleteContext(
IN ULONG_PTR ContextHandle
)
{
DebugLog((DEB_TRACE_FUNC, "SpDeleteContext: Entering ContextHandle 0x%lx\n", ContextHandle ));
PDIGEST_CONTEXT pContext = NULL;
NTSTATUS Status = STATUS_SUCCESS;
//
// Find the currently existing user context and delink it
// so that another context cannot Reference it before we
// Dereference this one.
//
Status = CtxtHandlerHandleToContext(ContextHandle, TRUE, &pContext);
if (!NT_SUCCESS(Status))
{
Status = STATUS_SUCCESS;
DebugLog((DEB_TRACE, "SpDeleteContext: CtxtHandlerHandleToContext not found 0x%x\n", Status ));
goto CleanUp;
}
// Now deference - there may be other references from pointer references (from Handles)
// inside the LSA but will be released
if (pContext)
{
Status = CtxtHandlerRelease(pContext);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpDeleteContext: DereferenceUserContext error Status 0x%x\n", Status ));
}
}
CleanUp:
DebugLog((DEB_TRACE_FUNC, "SpDeleteContext: Leaving ContextHandle 0x%lx status 0x%x\n",
ContextHandle, Status ));
return(Status);
}
//+-------------------------------------------------------------------------
//
// Function: SpInitLsaModeContext
//
// Synopsis: Digest implementation of InitializeSecurityContext
// while in Lsa mode. If we return TRUE in *MappedContext,
// secur32 will call SpInitUserModeContext with
// the returned context handle and ContextData
// as input. Fill in whatever info needed for
// the user mode APIs
//
// Effects:
//
// Arguments:
//
// Requires:
//
// Returns:
//
// Notes:
//
//--------------------------------------------------------------------------
NTSTATUS NTAPI
SpInitLsaModeContext(
IN OPTIONAL ULONG_PTR CredentialHandle,
IN OPTIONAL ULONG_PTR OldContextHandle,
IN OPTIONAL PUNICODE_STRING pustrTargetName,
IN ULONG fContextReqFlags,
IN ULONG TargetDataRep,
IN PSecBufferDesc InputBuffers,
OUT PULONG_PTR NewContextHandle,
IN OUT PSecBufferDesc OutputBuffers,
OUT PULONG fContextAttributes,
OUT PTimeStamp pExpirationTime,
OUT PBOOLEAN MappedContext,
OUT PSecBuffer ContextData
)
{
NTSTATUS Status = STATUS_SUCCESS;
NTSTATUS SubStatus = STATUS_SUCCESS;
DebugLog((DEB_TRACE_FUNC, "SpInitLsaModeContext: Entering ContextHandle 0x%x\n", OldContextHandle));
SecBuffer TempTokens[6];
PSecBuffer pChalInputToken;
PSecBuffer pMethodInputToken;
PSecBuffer pHEntityInputToken;
PSecBuffer pOutputToken;
DIGEST_PARAMETER Digest;
PDIGEST_CONTEXT pNewContext = NULL; // keep pointer to release new context on error
PDIGEST_CONTEXT pContext = NULL; // used to update the context
BOOL bLockedContext = FALSE; // if we obtained a refcount on a Context
BOOL fDefChars = FALSE; // were default chars utilized in Unicode encoding
int iTemp = 0;
SecBuffer ReplyBuffer; // Output is generated in this buffer
char *cptr = NULL;
ULONG fContextAttr = ISC_REQ_REPLAY_DETECT; // Flags on the Attributes of the context
DIGEST_TYPE typeDigest = NO_DIGEST_SPECIFIED;
QOP_TYPE typeQOP = NO_QOP_SPECIFIED;
ALGORITHM_TYPE typeAlgorithm = NO_ALGORITHM_SPECIFIED;
CHARSET_TYPE typeCharset = ISO_8859_1;
DIGESTMODE_TYPE typeDigestMode = DIGESTMODE_UNDEFINED; // are we in SASL or HTTP mode
PDIGEST_CREDENTIAL pCredential = NULL;
STRING strcSASLMethod;
STRING strcSASLHEntity;
STRING strcNC;
STRING strTargetName;
// Verify Args
if (!fContextAttributes || !NewContextHandle || !OutputBuffers)
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Invalid arg (possible NULL pointer)\n"));
return STATUS_INVALID_PARAMETER;
}
*fContextAttributes = 0;
*NewContextHandle = NULL;
if (pExpirationTime)
{
*pExpirationTime = g_TimeForever;
}
*MappedContext = FALSE;
ContextData->pvBuffer = NULL;
ContextData->cbBuffer = 0;
// Create pointers to tokens for processing
pChalInputToken = &TempTokens[0];
pMethodInputToken = &TempTokens[1];
pHEntityInputToken = &TempTokens[3];
pOutputToken = &TempTokens[4];
DigestInit(&Digest);
ZeroMemory(TempTokens,sizeof(TempTokens));
ZeroMemory(&strTargetName, sizeof(strTargetName));
ZeroMemory(&ReplyBuffer, sizeof(ReplyBuffer));
// Must have a Credential Handle to perform processing - will ref count
Status = CredHandlerHandleToPtr(CredentialHandle, FALSE, &pCredential);
if (!NT_SUCCESS(Status))
{
Status = SEC_E_UNKNOWN_CREDENTIALS;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Could not locate the Credential\n"));
goto CleanUp;
}
// Verify that credential is marked OUTBOUND for ASC call
if (!(pCredential->CredentialUseFlags & DIGEST_CRED_OUTBOUND))
{
Status = SEC_E_NOT_SUPPORTED;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Credential not marked for Outbound connections\n"));
goto CleanUp;
}
// Retrieve the information from the SecBuffers & check proper formattting
// Check for NULL input for InputBuffers - as is done for 1st call to ISC
if (InputBuffers && (InputBuffers->cBuffers))
{
if ( !SspGetTokenBufferByIndex( InputBuffers,
0, // get the first SECBUFFER_TOKEN
&pChalInputToken,
TRUE ) ||
!ContextIsTokenOK(pChalInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: SspGetTokenBufferByIndex (ChalRspInputToken) status 0x%x\n", Status));
goto CleanUp;
}
}
// Process the output buffer
if ( !SspGetTokenBufferByIndex( OutputBuffers,
0, // get the first SECBUFFER_TOKEN
&pOutputToken,
FALSE ) ||
!ContextIsTokenOK(pOutputToken, 0))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: SspGetTokenBufferByIndex (OutputToken) status 0x%x\n", Status));
goto CleanUp;
}
if (fContextReqFlags & ISC_REQ_ALLOCATE_MEMORY)
{
pOutputToken->pvBuffer = NULL;
pOutputToken->cbBuffer = 0;
}
// To support SASL's call to ISC BEFORE any calls to ASC just return SEC_I_CONTINUE_NEEDED
if (pChalInputToken->cbBuffer <= 1)
{
// Need to create a context for this connection - destroy if unsuccessful auth
pNewContext = (PDIGEST_CONTEXT)DigestAllocateMemory(sizeof(DIGEST_CONTEXT));
if (!pNewContext)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: ISC empty context - Out of memory on challenge context\n"));
goto CleanUp;
}
CredPrint(pCredential);
// Initialize new context
Status = ContextInit(pNewContext, pCredential);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: ISC empty context - ContextInit error status 0x%x\n", Status));
goto CleanUp;
}
Status = SEC_I_CONTINUE_NEEDED; // Have no input for processing
pOutputToken->cbBuffer = 0; // No output buffer
DebugLog((DEB_TRACE, "SpInitLsaModeContext: ISC empty context - Called with no Input Buffer Status 0x%x\n", Status));
// Add the Newly created Context into the list of Contexts
pNewContext->lReferences = 1; // pass reference back to ISC caller
CtxtHandlerInsertCred(pNewContext);
// pContext = pNewContext; // set to have dereferenced
*NewContextHandle = (ULONG_PTR)pNewContext; // Just report back with the updated context
*fContextAttributes = fContextAttr; // Return the ISC Attributes set on Context
// bLockedContext = TRUE; // Release memory to CtxtHandler
pNewContext = NULL; // We no longer own this memory - turned over to CtxtHandler
goto CleanUp;
}
// Verify SecBuffer inputs - both SASL and HTTP require atleast 1 buffer
if (!InputBuffers || !InputBuffers->cBuffers)
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Invalid SecBufferDesc\n"));
return STATUS_INVALID_PARAMETER;
}
// We have input in the SECBUFFER 0th location - parse it
Status = DigestParser2(pChalInputToken, MD5_AUTH_NAMES, MD5_AUTH_LAST, &Digest);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: DigestParser error status 0x%x\n", Status));
goto CleanUp;
}
// Check to see if we have an old context passed in or need to create a new one
if (OldContextHandle)
{
// Old Context passed in - locate the security context and use that
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Passed in OldContextHandle 0x%lx - lookup in list\n", OldContextHandle));
Status = CtxtHandlerHandleToContext(OldContextHandle, FALSE, &pContext);
if (!NT_SUCCESS (Status))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: CtxtHandlerHandleToContext error 0x%x\n", Status));
goto CleanUp;
}
bLockedContext = TRUE;
}
else
{
// Need to create a context for this connection - destroy if unsuccessful auth
DebugLog((DEB_TRACE, "SpInitLsaModeContext: No OldContextHandle - create new Context\n"));
pNewContext = (PDIGEST_CONTEXT)DigestAllocateMemory(sizeof(DIGEST_CONTEXT));
if (!pNewContext)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: out of memory on challenge context\n"));
goto CleanUp;
}
CredPrint(pCredential);
// Initialize new context
Status = ContextInit(pNewContext, pCredential);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: ContextInit error status 0x%x\n", Status));
goto CleanUp;
}
pContext = pNewContext; // for filling in the context information
DebugLog((DEB_TRACE, "SpInitLsaModeContext: New Context Created 0x%x\n", pContext));
}
if (pContext && pContext->strResponseAuth.Length)
{
// We have already generated session key from challenge response
// now checking response auth from server
if (Digest.refstrParam[MD5_AUTH_RSPAUTH].Length != MD5_HASH_HEX_SIZE)
{
Status = STATUS_MUTUAL_AUTHENTICATION_FAILED;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: RspAuth incorrect size\n"));
goto CleanUp;
}
// Now compare the response auth strings
if (!RtlEqualString(&(pContext->strResponseAuth),
&(Digest.refstrParam[MD5_AUTH_RSPAUTH]),
FALSE))
{
Status = STATUS_MUTUAL_AUTHENTICATION_FAILED;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: RspAuth is incorrect\n"));
goto CleanUp;
}
DebugLog((DEB_TRACE, "SpInitLsaModeContext: RspAuth matches!\n"));
// ResponseAuth is verified - generate mapped context
*fContextAttributes = pContext->ContextReq; // Return the ISC Attributes set on Context
*NewContextHandle = (ULONG_PTR)pContext; // Just report back with the updated context
pOutputToken->cbBuffer = 0; // No output buffer
if (pExpirationTime)
{
*pExpirationTime = pContext->PasswordExpires;
}
Status = SspMapDigestContext(pContext, NULL , ContextData);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext, SspMapContext Status 0x%x\n", Status));
goto CleanUp;
}
// this is final call, indicate to map the context
*MappedContext = TRUE;
goto CleanUp;
}
// Determine if we are in HTTP or SASL mode
// SASL mode has 1 or less buffers provided, HTTP has 3
if (InputBuffers->cBuffers > 1)
{
typeDigestMode = DIGESTMODE_HTTP;
}
else
{
typeDigestMode = DIGESTMODE_SASL;
}
// HTTP has special Buffer needs in that it must pass in the METHOD, HEntity
if (typeDigestMode == DIGESTMODE_HTTP)
{
if ( !SspGetTokenBufferByIndex( InputBuffers,
1, // get the second SECBUFFER_TOKEN
&pMethodInputToken,
TRUE ) ||
!ContextIsTokenOK(pMethodInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE))
{ // Check to make sure that string is present
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: SspGetTokenBufferByIndex (MethodInputToken) status 0x%x\n", Status));
goto CleanUp;
}
if ( !SspGetTokenBufferByIndex( InputBuffers,
2, // get the third SECBUFFER_TOKEN
&pHEntityInputToken,
TRUE ) ||
!ContextIsTokenOK(pHEntityInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: SspGetTokenBufferByIndex (HEntityInputToken) status 0x%x\n", Status));
goto CleanUp;
}
// Verify that there is a valid Method provided
if (!pMethodInputToken->pvBuffer || !pMethodInputToken->cbBuffer ||
(PBUFFERTYPE(pMethodInputToken) != SECBUFFER_PKG_PARAMS))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Method SecBuffer must have valid method string status 0x%x\n", Status));
goto CleanUp;
}
iTemp = strlencounted((char *)pMethodInputToken->pvBuffer, pMethodInputToken->cbBuffer);
if (!iTemp)
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Method SecBuffer must have valid method string status 0x%x\n", Status));
goto CleanUp;
}
Digest.refstrParam[MD5_AUTH_METHOD].Length = (USHORT)iTemp;
Digest.refstrParam[MD5_AUTH_METHOD].MaximumLength = (unsigned short)(pMethodInputToken->cbBuffer);
Digest.refstrParam[MD5_AUTH_METHOD].Buffer = (char *)pMethodInputToken->pvBuffer; // refernce memory - no alloc!!!!
// Check to see if we have H(Entity) data to utilize
if (pHEntityInputToken->cbBuffer)
{
// Verify that there is a valid Method provided
if (!pHEntityInputToken->pvBuffer || (PBUFFERTYPE(pMethodInputToken) != SECBUFFER_PKG_PARAMS))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: HEntity SecBuffer must have valid string status 0x%x\n", Status));
goto CleanUp;
}
iTemp = strlencounted((char *)pHEntityInputToken->pvBuffer, pHEntityInputToken->cbBuffer);
if ((iTemp != 0) && (iTemp != (MD5_HASH_BYTESIZE * 2)))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: HEntity SecBuffer must have valid MD5 Hash data 0x%x\n", Status));
goto CleanUp;
}
if (iTemp)
{
Digest.refstrParam[MD5_AUTH_HENTITY].Length = (USHORT)iTemp;
Digest.refstrParam[MD5_AUTH_HENTITY].MaximumLength = (unsigned short)(pHEntityInputToken->cbBuffer);
Digest.refstrParam[MD5_AUTH_HENTITY].Buffer = (char *)pHEntityInputToken->pvBuffer; // refernce memory - no alloc!!!!
}
}
typeDigest = DIGEST_CLIENT;
// Determine which Algorithm to support under HTTP
Status = CheckItemInList(MD5_SESSSTR, &(Digest.refstrParam[MD5_AUTH_ALGORITHM]), FALSE);
if (!NT_SUCCESS(Status))
{
// Check if MD5 specified (or none specified so MD5 defaults)
Status = CheckItemInList(MD5STR, &(Digest.refstrParam[MD5_AUTH_ALGORITHM]), FALSE);
if (NT_SUCCESS(Status) || (Digest.refstrParam[MD5_AUTH_ALGORITHM].Length == 0))
{
typeAlgorithm = MD5;
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server allows MD5 (or defaulted); selected as algorithm\n"));
}
else
{
Status = SEC_E_QOP_NOT_SUPPORTED;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Unknown Server algorithms provided\n"));
goto CleanUp;
}
}
else
{
typeAlgorithm = MD5_SESS;
fContextAttr |= (ISC_RET_REPLAY_DETECT | ISC_RET_SEQUENCE_DETECT);
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server allows MD5-sess; selected as algorithm\n"));
}
}
else
{
// All others follow the SASL Interface so there are default values
typeDigest = SASL_CLIENT;
fContextAttr |= ISC_RET_MUTUAL_AUTH; // require response auth from server
// SASL supports only MD5-Sess verify that server offered this
Status = CheckItemInList(MD5_SESSSTR, &(Digest.refstrParam[MD5_AUTH_ALGORITHM]), FALSE);
if (!NT_SUCCESS(Status))
{
Status = SEC_E_QOP_NOT_SUPPORTED;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Unknown Server algorithm provided\n"));
goto CleanUp;
}
else
{
typeAlgorithm = MD5_SESS;
fContextAttr |= (ISC_RET_REPLAY_DETECT | ISC_RET_SEQUENCE_DETECT);
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server allows MD5-sess; selected as algorithm\n"));
}
// Set Method to Authenticate
RtlInitString(&strcSASLMethod, AUTHENTICATESTR);
StringReference(&(Digest.refstrParam[MD5_AUTH_METHOD]), &strcSASLMethod); // refernce memory - no alloc!!!!
RtlInitString(&strcSASLHEntity, ZERO32STR);
StringReference(&(Digest.refstrParam[MD5_AUTH_HENTITY]), &strcSASLHEntity); // refernce memory - no alloc!!!!
}
// Determine if we can process the QOP specified - check return in client if consistent
if (fContextReqFlags & ISC_REQ_CONFIDENTIALITY)
{
// make sure that server presented the auth-conf option
Status = CheckItemInList(AUTHCONFSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), FALSE);
if (!NT_SUCCESS(Status))
{
// Failed to provide necessary QOP
Status = SEC_E_QOP_NOT_SUPPORTED;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Server failed to provide QOP=AUTH-CONF\n"));
goto CleanUp;
}
// OK agreed to QOP
fContextAttr |= (ISC_RET_CONFIDENTIALITY | ISC_RET_INTEGRITY);
typeQOP = AUTH_CONF;
}
else if (fContextReqFlags & ISC_REQ_INTEGRITY)
{
// make sure that server presented the auth-int option
Status = CheckItemInList(AUTHINTSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), FALSE);
if (!NT_SUCCESS(Status))
{
// Failed to provide necessary QOP
Status = SEC_E_QOP_NOT_SUPPORTED;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Server failed to provide QOP=AUTH-INT\n"));
goto CleanUp;
}
// OK agreed to QOP
fContextAttr |= ISC_RET_INTEGRITY;
typeQOP = AUTH_INT;
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Client selected QOP=AUTH-INT\n"));
}
else
{
// no client specified QOP so use auth if allowed (backwards compat may have no QOP presented from server)
Status = CheckItemInList(AUTHSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), FALSE);
if (!NT_SUCCESS(Status))
{
// either QOP is not specified or all options are unknown
if (Digest.refstrParam[MD5_AUTH_QOP].Length == 0)
{
// Backwards compatibility with RFC 2069
typeQOP = NO_QOP_SPECIFIED;
DebugLog((DEB_TRACE, "SpInitLsaModeContext: No QOP specified - back compat with RFC 2069\n"));
}
else
{
Status = SEC_E_QOP_NOT_SUPPORTED;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Server failed to provide QOP=AUTH\n"));
goto CleanUp;
}
}
else
{
// defaulting to AUTH
typeQOP = AUTH;
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Client selected QOP=AUTH by default\n"));
}
}
// Check to see if the Server has provided character set for encoding - only UTF-8 accepted
Status = CheckItemInList(MD5_UTF8STR, &(Digest.refstrParam[MD5_AUTH_CHARSET]), TRUE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server allows UTF-8 encoding\n"));
// Determine which character set to utilize
if (((typeDigest == SASL_CLIENT) && (g_fParameter_UTF8SASL == TRUE)) ||
((typeDigest == DIGEST_CLIENT) && (g_fParameter_UTF8HTTP == TRUE)))
{
typeCharset = UTF_8;
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selected UTF-8 encoding\n"));
}
else
{
typeCharset = ISO_8859_1;
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selected ISO 8859-1 encoding\n"));
}
}
// Pull in the URI provided in TargetName - replace any value in challenge string - link ONLY no allocate
if (!pustrTargetName)
{
Status = SEC_E_TARGET_UNKNOWN;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: URI TargetName must have valid UnicodeString\n"));
goto CleanUp;
}
Status = EncodeUnicodeString(pustrTargetName, CP_8859_1, &strTargetName, &fDefChars);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_WARN, "SpInitLsaModeContext: Error in encoding target URI in ISO-8859-1\n"));
goto CleanUp;
}
if (fDefChars == TRUE)
{
// We could not encode the provided target URI within ISO 8859-1 characters
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Target URI can not be encoded in ISO 8859-1\n"));
Status = STATUS_UNMAPPABLE_CHARACTER;
goto CleanUp;
}
StringReference(&(Digest.refstrParam[MD5_AUTH_URI]), &strTargetName); // refernce memory - no alloc!!!!
// Create the CNonce
Status = OpaqueCreate(&(pContext->strCNonce));
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: OpaqueCreate for CNonce status 0x%x\n", Status));
goto CleanUp;
}
// Establish the Client Nonce
StringReference(&(Digest.refstrParam[MD5_AUTH_CNONCE]), &(pContext->strCNonce)); // refernce memory - no alloc!!!!
// Keep a copy of the Nonce and Cnonce for future Delegation requests (actually not used in client ISC)
Status = StringDuplicate(&pContext->strNonce, &Digest.refstrParam[MD5_AUTH_NONCE]);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: StringDuplicate CNonce failed status 0x%x\n", Status));
goto CleanUp;
}
// check to make sure that there was an initial Realm provided
if ((typeDigestMode == DIGESTMODE_HTTP) && (!Digest.refstrParam[MD5_AUTH_REALM].Length))
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Server failed to provide a Realm in Challenge status 0x%x\n", Status));
goto CleanUp;
}
RtlInitString(&strcNC, NCFIRST);
StringReference(&(Digest.refstrParam[MD5_AUTH_NC]), &strcNC); // refernce memory - no alloc!!!!
// Set the type of Digest Parameters we are to process
pContext->typeDigest = typeDigest;
pContext->typeAlgorithm = typeAlgorithm;
pContext->typeQOP = typeQOP;
pContext->typeCipher = CIPHER_UNDEFINED;
pContext->typeCharset = typeCharset; // Digest parameter will be set in DigestGenerateParameters call
if (pContext->typeQOP == AUTH_CONF)
{
// Check if server offered RC4 Most cases this will be the cipher selected
Status = CheckItemInList(STR_CIPHER_RC4, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting RC4 for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_RC4;
}
else
{
Status = CheckItemInList(STR_CIPHER_3DES, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting Triple DES for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_3DES;
}
else
{
Status = CheckItemInList(STR_CIPHER_RC4_56, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting RC4-56 for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_RC4_56;
}
else
{
Status = CheckItemInList(STR_CIPHER_RC4_40, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting RC4-40 for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_RC4_40;
}
else
{
Status = CheckItemInList(STR_CIPHER_DES, &(Digest.refstrParam[MD5_AUTH_CIPHER]), FALSE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Selecting DES for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_DES;
}
else
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: Failed to find known ciper in list\n"));
Status = STATUS_CRYPTO_SYSTEM_INVALID;
goto CleanUp;
}
}
}
}
}
}
// Check if server specified a MaxBuffer
if (Digest.refstrParam[MD5_AUTH_MAXBUF].Length && Digest.refstrParam[MD5_AUTH_MAXBUF].Buffer)
{
if (Digest.refstrParam[MD5_AUTH_MAXBUF].Length < MAXBUFNUMLEN)
{
ULONG ulMaxBuf = 0;
CHAR czMaxBuf[MAXBUFNUMLEN + 1];
ZeroMemory(czMaxBuf, (MAXBUFNUMLEN + 1));
memcpy(czMaxBuf, Digest.refstrParam[MD5_AUTH_MAXBUF].Buffer, Digest.refstrParam[MD5_AUTH_MAXBUF].Length);
Status = RtlCharToInteger(czMaxBuf, TENBASE, &ulMaxBuf);
if (!NT_SUCCESS(Status))
{
Status = SEC_E_ILLEGAL_MESSAGE;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: MaxBuf directive value malformed 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Server MaxBuf set to %lu\n", ulMaxBuf));
pContext->ulSendMaxBuf = ulMaxBuf;
}
else
{
Status = SEC_E_ILLEGAL_MESSAGE;
DebugLog((DEB_ERROR, "SpInitLsaModeContext: MaxBuf directive value too large 0x%x\n", Status));
goto CleanUp;
}
}
// We now have completed setup for the digest fields - time to process the data
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Digest inputs processing completed\n"));
ContextPrint(pContext);
Status = DigestGenerateParameters(pContext, &Digest, &ReplyBuffer);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext: DigestGenerateParameters error status 0x%x\n", Status));
goto CleanUp;
}
// Now transfer the Challenge buffer to the ouput secbuffer
if ((fContextReqFlags & ISC_REQ_ALLOCATE_MEMORY) == 0)
{
if (pOutputToken->cbBuffer < ReplyBuffer.cbBuffer)
{
DebugLog((DEB_ERROR,"SpInitLsaModeContext: Output token is too small - sent in %d, needed %d\n",
pOutputToken->cbBuffer, ReplyBuffer.cbBuffer));
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
Status = STATUS_BUFFER_TOO_SMALL;
goto CleanUp;
}
RtlCopyMemory(pOutputToken->pvBuffer, ReplyBuffer.pvBuffer, ReplyBuffer.cbBuffer);
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
}
else
{
pOutputToken->pvBuffer = ReplyBuffer.pvBuffer;
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
ReplyBuffer.pvBuffer = NULL;
ReplyBuffer.cbBuffer = 0;
fContextAttr |= ISC_RET_ALLOCATED_MEMORY;
}
pContext->ContextReq = fContextAttr;
pContext->PasswordExpires = g_TimeForever; // never expire
*fContextAttributes = pContext->ContextReq; // Return the ISC Attributes set on Context
*NewContextHandle = (ULONG_PTR)pContext; // Just report back with the updated context
if (pExpirationTime)
{
*pExpirationTime = pContext->PasswordExpires;
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Context Expiration TimeStamp high/low 0x%x/0x%x\n",
pExpirationTime->HighPart, pExpirationTime->LowPart));
}
// Check if need to check server's response auth
if (pContext->ContextReq & ISC_RET_MUTUAL_AUTH)
{
// Calculate the expected response auth from the server
Status = DigestCalculateResponseAuth(&Digest, &(pContext->strResponseAuth));
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext, DigestCalculateResponseAuth Status 0x%x\n",
Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Pre-calculated RspAuth %Z\n",
&(pContext->strResponseAuth)));
// Keep copy of digest values for context map on last ISC call
for (iTemp = 0; iTemp < MD5_AUTH_LAST; iTemp++)
{
StringDuplicate(&pContext->strDirective[iTemp], &(Digest.refstrParam[iTemp]));
}
// Need to verify the output from final ASC call to verify server has session key
Status = SEC_I_CONTINUE_NEEDED;
}
else
{
Status = SspMapDigestContext(pContext, &Digest, ContextData);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpInitLsaModeContext, SspMapContext Status 0x%x\n", Status));
goto CleanUp;
}
// this is last call, indicate to map the context
*MappedContext = TRUE;
}
// Add the Newly created Context into the list of Contexts unless it was there before
if (pNewContext)
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Added context 0x%x\n", pNewContext));
pNewContext->lReferences = 1;
CtxtHandlerInsertCred(pNewContext);
// bLockedContext = TRUE; // Release memory to CtxtHandler
pNewContext = NULL; // We no longer own this memory - turned over to CtxtHandler
}
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Will create UserContext on exit\n"));
CleanUp:
// Failed to complete operations if non-NULL so clean up
if (pNewContext)
{
ContextFree(pNewContext);
pNewContext = NULL;
}
// DeReference - pCredential
if (pCredential)
{
SubStatus = CredHandlerRelease(pCredential);
if (!NT_SUCCESS(SubStatus))
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: CredHandlerRelease error Status 0x%x\n", SubStatus));
if (NT_SUCCESS(Status))
{
Status = SubStatus; // Indicate release error
}
}
pCredential = NULL;
}
if (bLockedContext && pContext)
{ // happened only if ref counted a SecurityContext
SubStatus = CtxtHandlerRelease(pContext);
if (!NT_SUCCESS(SubStatus))
{
DebugLog((DEB_TRACE, "SpInitLsaModeContext: CtxtHandlerRelease error Status 0x%x\n", SubStatus));
if (NT_SUCCESS(Status))
{
Status = SubStatus; // Indicate release error
}
}
pContext = NULL;
}
// Free up any allocated memory from the ouput reply buffer
if (ReplyBuffer.pvBuffer)
{
DigestFreeMemory(ReplyBuffer.pvBuffer);
ReplyBuffer.pvBuffer = NULL;
ReplyBuffer.cbBuffer = 0;
}
// Clean up local memory used by Digest
DigestFree(&Digest);
StringFree(&strTargetName);
DebugLog((DEB_TRACE, "SpInitLsaModeContext: Mapped context %d Flags IN:0x%lx OUT:0x%lx\n",
*MappedContext, fContextReqFlags,*fContextAttributes));
DebugLog((DEB_TRACE_FUNC, "SpInitLsaModeContext: Leaving Context 0x%x Status 0x%x\n", *NewContextHandle, Status));
return(Status);
}
NTSTATUS NTAPI
SpApplyControlToken(
IN ULONG_PTR ContextHandle,
IN PSecBufferDesc ControlToken
)
{
DebugLog((DEB_TRACE_FUNC, "SpApplyControlToken: Entering/Leaving \n"));
UNREFERENCED_PARAMETER(ContextHandle);
UNREFERENCED_PARAMETER(ControlToken);
return(SEC_E_UNSUPPORTED_FUNCTION);
}
//+-------------------------------------------------------------------------
//
// Function: SpAcceptLsaModeContext
//
// Synopsis: Digest implementation of AcceptSecurityContext call.
//
// Effects:
//
// Arguments:
// CredentialHandle - Handle to the credentials to be used to
// create the context.
//
// OldContextHandle - Handle to the partially formed context, if this is
// a second call (see above) or NULL if this is the first call.
//
// InputToken - Pointer to the input token. In the first call this
// token can either be NULL or may contain security package specific
// information.
//
// ContextReqFlags - Requirements of the context, package specific.
//
// #define ASC_REQ_REPLAY_DETECT 0x00000004
// #define ASC_REQ_SEQUENCE_DETECT 0x00000008
// #define ASC_REQ_CONFIDENTIALITY 0x00000010
// #define ASC_REQ_ALLOCATE_MEMORY 0x00000100
//
// TargetDataRep - Long indicating the data representation (byte ordering, etc)
// on the target. The constant SECURITY_NATIVE_DREP may be supplied
// by the transport indicating that the native format is in use.
//
// NewContextHandle - New context handle. If this is a second call, this
// can be the same as OldContextHandle.
//
// OutputToken - Buffer to receive the output token.
//
// ContextAttributes -Attributes of the context established.
//
// #define ASC_RET_REPLAY_DETECT 0x00000004
// #define ASC_RET_SEQUENCE_DETECT 0x00000008
// #define ASC_RET_CONFIDENTIALITY 0x00000010
// #define ASC_RET_ALLOCATED_BUFFERS 0x00000100
//
// ExpirationTime - Expiration time of the context.
//
//
// Requires:
//
// Returns:
// STATUS_SUCCESS - Message handled
// SEC_I_CONTINUE_NEEDED -- Caller should call again later
//
// SEC_E_NO_SPM -- Security Support Provider is not running
// SEC_E_INVALID_TOKEN -- Token improperly formatted
// SEC_E_INVALID_HANDLE -- Credential/Context Handle is invalid
// SEC_E_BUFFER_TOO_SMALL -- Buffer for output token isn't big enough
// SEC_E_LOGON_DENIED -- User is no allowed to logon to this server
// SEC_E_INSUFFICIENT_MEMORY -- Not enough memory
//
// Notes:
//
//--------------------------------------------------------------------------
NTSTATUS NTAPI
SpAcceptLsaModeContext(
IN OPTIONAL ULONG_PTR CredentialHandle,
IN OPTIONAL ULONG_PTR OldContextHandle,
IN PSecBufferDesc InputBuffers,
IN ULONG fContextReqFlags,
IN ULONG TargetDataRep,
OUT PULONG_PTR NewContextHandle,
OUT PSecBufferDesc OutputBuffers,
OUT PULONG fContextAttributes,
OUT PTimeStamp pExpirationTime,
OUT PBOOLEAN MappedContext,
OUT PSecBuffer ContextData
)
{
NTSTATUS Status = STATUS_SUCCESS;
NTSTATUS SubStatus = STATUS_SUCCESS;
NTSTATUS AuditLogStatus = STATUS_SUCCESS;
DebugLog((DEB_TRACE_FUNC, "SpAcceptLsaModeContext: Entering \n"));
SecBuffer TempTokens[6];
PSecBuffer pChalRspInputToken;
PSecBuffer pMethodInputToken;
PSecBuffer pURIInputToken;
PSecBuffer pHEntityInputToken;
PSecBuffer pOutputToken;
PSecBuffer pRealmInputToken;
DIGEST_PARAMETER Digest;
PDIGEST_CONTEXT pNewContext = NULL; // keep pointer to release new context on error
BOOL bLockedCredential = FALSE;
BOOL bLockedContext = FALSE;
BOOL fLogonSessionCreated = FALSE;
SecBuffer ReplyBuffer; // Output is generated in this buffer
int iTemp = 0;
char *cptr = NULL;
ULONG fContextAttr = ASC_REQ_REPLAY_DETECT; // Flags on the Attributes of the context
DIGEST_TYPE typeDigest = NO_DIGEST_SPECIFIED;
QOP_TYPE typeQOP = NO_QOP_SPECIFIED;
ALGORITHM_TYPE typeAlgorithm = NO_ALGORITHM_SPECIFIED;
CHARSET_TYPE typeCharset = ISO_8859_1;
DIGESTMODE_TYPE typeDigestMode = DIGESTMODE_UNDEFINED; // Are we in SASL or HTTP mode
LARGE_INTEGER liContextTime = { 0xFFFFFFFF, 0x7FFFFFFF }; // initial set to forever
PDIGEST_CREDENTIAL pCredential = NULL;
PDIGEST_CONTEXT pContext = NULL;
STRING strcMethod;
STRING strcHEntity;
STRING strRealm;
UNICODE_STRING refustrRealm;
BOOL fDefChars = FALSE;
// Create pointers to tokens for processing
pChalRspInputToken = &TempTokens[0];
pMethodInputToken = &TempTokens[1];
pURIInputToken = &TempTokens[2];
pHEntityInputToken = &TempTokens[3];
pRealmInputToken = &TempTokens[4];
pOutputToken = &TempTokens[5];
DigestInit(&Digest);
ZeroMemory(TempTokens,sizeof(TempTokens));
ZeroMemory(&strcMethod, sizeof(strcMethod));
ZeroMemory(&strcHEntity, sizeof(strcHEntity));
ZeroMemory(&strRealm, sizeof(strRealm));
ZeroMemory(&refustrRealm, sizeof(refustrRealm));
ZeroMemory(&ReplyBuffer, sizeof(ReplyBuffer));
// Initialize the output values
if (!fContextAttributes || !NewContextHandle || !InputBuffers || !OutputBuffers)
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Invalid arg (possible NULL pointer)\n"));
return STATUS_INVALID_PARAMETER;
}
*NewContextHandle = (ULONG_PTR)NULL;
*MappedContext = FALSE;
*fContextAttributes = 0;
if (pExpirationTime)
{
*pExpirationTime = g_TimeForever;
}
ContextData->pvBuffer = NULL;
ContextData->cbBuffer = 0;
// Determine if we are in HTTP or SASL mode
// SASL mode has 1 or less buffers provided, HTTP has 5
if (InputBuffers->cBuffers > 1)
{
typeDigestMode = DIGESTMODE_HTTP;
}
else
{
typeDigestMode = DIGESTMODE_SASL;
}
// Must have a Credential Handle to perform processing
Status = CredHandlerHandleToPtr(CredentialHandle, FALSE, &pCredential);
if (!NT_SUCCESS(Status))
{
Status = SEC_E_UNKNOWN_CREDENTIALS;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: No Credential Handle passed\n"));
goto CleanUp;
}
bLockedCredential = TRUE;
// Verify that credential is marked INBOUND for ASC call
if (!(pCredential->CredentialUseFlags & DIGEST_CRED_INBOUND))
{
Status = SEC_E_NOT_SUPPORTED;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Credential not marked for Inbound connections\n"));
goto CleanUp;
}
// Retrieve the information from the SecBuffers & check proper formattting
// First check to make sure that that the proper number of buffers were passed
if (typeDigestMode == DIGESTMODE_HTTP)
{
// HTTP has 5 buffers in Input: ChallengeResponse, Method, URI, HEntity, Realm
if ((InputBuffers->cBuffers < ASC_HTTP_NUM_INPUT_BUFFERS) ||
(OutputBuffers->cBuffers < ASC_HTTP_NUM_OUTPUT_BUFFERS))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Incorrect number of Input/Output HTTP Sec Buffers\n"));
goto CleanUp;
}
}
else
{
// SASL has 1 buffer in Input: ChallengeResponse
if ((InputBuffers->cBuffers < ASC_SASL_NUM_INPUT_BUFFERS) ||
(OutputBuffers->cBuffers < ASC_SASL_NUM_OUTPUT_BUFFERS))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Incorrect number of Input/Ouput SASL Sec Buffers\n"));
goto CleanUp;
}
fContextAttr |= ASC_RET_MUTUAL_AUTH; // SASL requires response auth from server
}
if ( !SspGetTokenBufferByIndex( InputBuffers,
0, // get the first SECBUFFER_TOKEN
&pChalRspInputToken,
TRUE ) ||
!ContextIsTokenOK(pChalRspInputToken,NTDIGEST_SP_MAX_TOKEN_SIZE))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (ChalRspInputToken) returns 0x%x\n", Status));
goto CleanUp;
}
if ( !SspGetTokenBufferByIndex( OutputBuffers,
0, // get the first SECBUFFER_TOKEN
&pOutputToken,
FALSE ) ||
!ContextIsTokenOK(pOutputToken, 0))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext, SspGetTokenBufferByIndex (OutputToken) returns 0x%x\n", Status));
goto CleanUp;
}
if (fContextReqFlags & ASC_REQ_ALLOCATE_MEMORY)
{
pOutputToken->pvBuffer = NULL;
pOutputToken->cbBuffer = 0;
}
// Reset output buffer if provided
if ((pOutputToken->pvBuffer) && (pOutputToken->cbBuffer >= 1))
{
cptr = (char *)pOutputToken->pvBuffer;
*cptr = '\0';
}
//
// If no ChallengeResponse data provided (only NULL in buffer), then this is the first call
// Determine a nonce, open up a null context, and return it. Return SEC_E_INCOMPLETE_MESSAGE to
// indicate that a challenge-response is expected
//
if ((!pChalRspInputToken->pvBuffer) || (pChalRspInputToken->cbBuffer <= 1))
{
pNewContext = (PDIGEST_CONTEXT)DigestAllocateMemory(sizeof(DIGEST_CONTEXT));
if (!pNewContext)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: out of memory on challenge context\n"));
goto CleanUp;
}
Status = ContextInit(pNewContext, pCredential);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: ContextInit error 0x%x\n", Status));
goto CleanUp;
}
if (typeDigestMode == DIGESTMODE_HTTP)
{
typeDigest = DIGEST_SERVER;
}
else
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: SASL Requested\n"));
typeDigest = SASL_SERVER;
}
pNewContext->typeDigest = typeDigest;
// Determine which character set to utilize
if (((typeDigest == SASL_SERVER) && (g_fParameter_UTF8SASL == TRUE)) ||
((typeDigest == DIGEST_SERVER) && (g_fParameter_UTF8HTTP == TRUE)))
{
typeCharset = UTF_8;
}
else
{
typeCharset = ISO_8859_1;
}
pNewContext->typeCharset = typeCharset;
// We will use the Opaque as the CNonce
Status = OpaqueCreate(&(pNewContext->strOpaque));
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: OpaqueCreate error 0x%x\n", Status));
goto CleanUp;
}
Status = NonceCreate(&(pNewContext->strNonce));
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: NonceCreate error 0x%x\n", Status));
goto CleanUp;
}
if (pNewContext->typeDigest == DIGEST_SERVER)
{
// Now see if a Realm was passed in to use for this challenge - the value could be single byte or Unicode
// Order is if realm passed to ASC use that, else just use the current domain name
if ( !SspGetTokenBufferByIndex( InputBuffers,
4, // get the fifth SECBUFFER_TOKEN
&pRealmInputToken,
TRUE ) ||
!ContextIsTokenOK(pRealmInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (RealmInputToken) returns 0x%x\n", Status));
goto CleanUp;
}
iTemp = 0;
if (pRealmInputToken->cbBuffer)
{
if (!pRealmInputToken->pvBuffer)
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: No input buffer (RealmInputToken) error 0x%x\n", Status));
goto CleanUp;
}
if (PBUFFERTYPE(pRealmInputToken) == SECBUFFER_PKG_PARAMS)
{
iTemp = ustrlencounted((const short *)pRealmInputToken->pvBuffer, pRealmInputToken->cbBuffer);
if (iTemp > 0)
{
refustrRealm.Length = (USHORT)(iTemp * sizeof(WCHAR));
refustrRealm.MaximumLength = (unsigned short)(pRealmInputToken->cbBuffer);
refustrRealm.Buffer = (PWSTR)pRealmInputToken->pvBuffer; // refernce memory - no alloc!!!!
// Check if OK to use UTF-8 encoding
if (pNewContext->typeCharset == UTF_8)
{
Status = EncodeUnicodeString(&refustrRealm, CP_UTF8, &strRealm, NULL);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Input Realm UTF-8 encoding error\n"));
goto CleanUp;
}
}
else
{
Status = EncodeUnicodeString(&refustrRealm, CP_8859_1, &strRealm, &fDefChars);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Input Realm ISO 8859-1 encoding error\n"));
goto CleanUp;
}
if (fDefChars == TRUE)
{
// We could not encode the provided Realm within ISO 8859-1 characters
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Input Realm can not be encoded in ISO 8859-1\n"));
Status = STATUS_UNMAPPABLE_CHARACTER;
goto CleanUp;
}
}
}
}
else
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Realm buffer type invalid error 0x%x\n", Status));
goto CleanUp;
}
}
}
typeAlgorithm = MD5_SESS;
pNewContext->typeAlgorithm = typeAlgorithm;
// Determine if we can process the QOP specified
if (fContextReqFlags & ASC_REQ_CONFIDENTIALITY)
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: AUTH-CONF requested\n"));
fContextAttr |= (ASC_RET_CONFIDENTIALITY | ASC_REQ_INTEGRITY);
typeQOP = AUTH_CONF; // Offer AUTH-CONF, AUTH_INT, and AUTH
}
else if (fContextReqFlags & ASC_REQ_INTEGRITY)
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: AUTH-INT requested\n"));
fContextAttr |= ASC_RET_INTEGRITY;
typeQOP = AUTH_INT; // Offer AUTH-INT and AUTH
}
else
typeQOP = AUTH; // Offer AUTH
// Stale directive will be set if VerifyMessage indicates that context expired.
// Application indicates if the challenge should indicate Stale
if (fContextReqFlags & ASC_REQ_STALE)
{
fContextAttr |= ASC_RET_STALE;
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Requested stale flag be indicated\n"));
}
pNewContext->typeQOP = typeQOP;
// Establish the attribute flags for this security context
pNewContext->ContextReq = fContextAttr;
Status = ContextCreateChal(pNewContext, &strRealm, &ReplyBuffer);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Failed to create Challenge status 0x%x\n", Status));
goto CleanUp;
}
// Now transfer the Challenge buffer to the ouput secbuffer
if ((fContextReqFlags & ASC_REQ_ALLOCATE_MEMORY) == 0)
{
if (pOutputToken->cbBuffer < ReplyBuffer.cbBuffer)
{
DebugLog((DEB_ERROR,"SpAcceptLsaModeContext:Output token is too small - sent in %d, needed %d\n",
pOutputToken->cbBuffer, ReplyBuffer.cbBuffer));
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
Status = STATUS_BUFFER_TOO_SMALL;
goto CleanUp;
}
RtlCopyMemory(pOutputToken->pvBuffer, ReplyBuffer.pvBuffer, ReplyBuffer.cbBuffer);
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
}
else
{
pOutputToken->pvBuffer = ReplyBuffer.pvBuffer;
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
ReplyBuffer.pvBuffer = NULL;
ReplyBuffer.cbBuffer = 0;
fContextAttr |= ASC_RET_ALLOCATED_MEMORY;
}
// Update any new attributes
pNewContext->ContextReq = fContextAttr;
// Set the time expiration for this context
// This time is in 100 Nanoseconds since 1604
Status = NtQuerySystemTime (&liContextTime);
if (!NT_SUCCESS(Status))
{
Status = STATUS_INTERNAL_ERROR;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Failed to get current time\n"));
goto CleanUp;
}
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Current TimeStamp high/low 0x%x/0x%x\n",
liContextTime.HighPart, liContextTime.LowPart));
PrintTimeString(liContextTime, TRUE);
// g_dwParameter_Lifetime is in number of seconds - convert to number of 100 nanoseconds
liContextTime.QuadPart += ((LONGLONG)g_dwParameter_Lifetime * (LONGLONG)SECONDS_TO_100NANO);
if (pExpirationTime)
{
*pExpirationTime = liContextTime;
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Context Expiration TimeStamp high/low 0x%x/0x%x\n",
pExpirationTime->HighPart, pExpirationTime->LowPart));
PrintTimeString(liContextTime, TRUE);
}
pNewContext->PasswordExpires = liContextTime;
pNewContext->lReferences = 1;
// Add it into the list of Contexts
CtxtHandlerInsertCred(pNewContext);
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Context added to list Opaque = %s\n", (pNewContext->strOpaque).Buffer));
// pContext = pNewContext; // set to have dereferenced
*NewContextHandle = (ULONG_PTR)pNewContext;
*fContextAttributes = fContextAttr; // Return the ASC Attributes set on Context
// bLockedContext = TRUE; // Release memory to CtxtHandler
// bLockedCredential = FALSE; // Do not Dereference the credential until context is unlinked and freed
pNewContext = NULL; // We no longer own this memory - turned over to CtxtHandler
Status = SEC_I_CONTINUE_NEEDED;
goto CleanUp;
}
// Processing ChallengeResponse (challenge was handled right before this
// We have input in the SECBUFFER 0th location - parse it
Status = DigestParser2(pChalRspInputToken, MD5_AUTH_NAMES, MD5_AUTH_LAST, &Digest);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: DigestParser error 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: DigestParser Returned OK\n"));
// Do not allow AuthzID processing at this time
if (Digest.refstrParam[MD5_AUTH_AUTHZID].Length)
{
Status = SEC_E_WRONG_PRINCIPAL;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Can not process AuthzID directives 0x%x\n", Status));
goto CleanUp;
}
// HTTP has special Buffer needs in that it must pass in the METHOD, HEntity
if (typeDigestMode == DIGESTMODE_HTTP)
{
if ( !SspGetTokenBufferByIndex( InputBuffers,
1, // get the second SECBUFFER_TOKEN
&pMethodInputToken,
TRUE ) ||
!ContextIsTokenOK(pMethodInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE))
{ // Check to make sure that string is present
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (MethodInputToken) returns 0x%x\n", Status));
goto CleanUp;
}
/* // Not used in this version, may be used in the future
if ( !SspGetTokenBufferByIndex( InputBuffers,
2, // get the third SECBUFFER_TOKEN
&pURIInputToken,
TRUE ) ||
!ContextIsTokenOK(pURIInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (URIInputToken) returns %d\n", Status));
goto CleanUp;
}
*/
if ( !SspGetTokenBufferByIndex( InputBuffers,
3, // get the forth SECBUFFER_TOKEN
&pHEntityInputToken,
TRUE ) ||
!ContextIsTokenOK(pHEntityInputToken, NTDIGEST_SP_MAX_TOKEN_SIZE))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: SspGetTokenBufferByIndex (HEntityInputToken) returns 0x%x\n", Status));
goto CleanUp;
}
// Verify that there is a valid Method provided
if (!pMethodInputToken->pvBuffer || !pMethodInputToken->cbBuffer ||
(PBUFFERTYPE(pMethodInputToken) != SECBUFFER_PKG_PARAMS))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Method SecBuffer must have valid method string status 0x%x\n", Status));
goto CleanUp;
}
iTemp = strlencounted((char *)pMethodInputToken->pvBuffer, pMethodInputToken->cbBuffer);
if (!iTemp)
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Method SecBuffer must have valid method string status 0x%x\n", Status));
goto CleanUp;
}
Digest.refstrParam[MD5_AUTH_METHOD].Length = (USHORT)iTemp;
Digest.refstrParam[MD5_AUTH_METHOD].MaximumLength = (unsigned short)(pMethodInputToken->cbBuffer);
Digest.refstrParam[MD5_AUTH_METHOD].Buffer = (char *)pMethodInputToken->pvBuffer; // refernce memory - no alloc!!!!
// Check to see if we have H(Entity) data to utilize
if (pHEntityInputToken->cbBuffer)
{
// Verify that there is a valid Method provided
if (!pHEntityInputToken->pvBuffer || (PBUFFERTYPE(pMethodInputToken) != SECBUFFER_PKG_PARAMS))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: HEntity SecBuffer must have valid string status 0x%x\n", Status));
goto CleanUp;
}
iTemp = strlencounted((char *)pHEntityInputToken->pvBuffer, pHEntityInputToken->cbBuffer);
if ((iTemp != 0) && (iTemp != (MD5_HASH_BYTESIZE * 2)))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: HEntity SecBuffer must have valid MD5 Hash data 0x%x\n", Status));
goto CleanUp;
}
if (iTemp)
{
Digest.refstrParam[MD5_AUTH_HENTITY].Length = (USHORT)iTemp;
Digest.refstrParam[MD5_AUTH_HENTITY].MaximumLength = (unsigned short)(pHEntityInputToken->cbBuffer);
Digest.refstrParam[MD5_AUTH_HENTITY].Buffer = (char *)pHEntityInputToken->pvBuffer; // refernce memory - no alloc!!!!
}
}
typeDigest = DIGEST_SERVER;
}
else
{
// All others follow the SASL Interface so there are default values
typeDigest = SASL_SERVER;
// Set Method to Authenticate
RtlInitString(&strcMethod, AUTHENTICATESTR);
StringReference(&(Digest.refstrParam[MD5_AUTH_METHOD]), &strcMethod); // refernce memory - no alloc!!!!
RtlInitString(&strcHEntity, ZERO32STR);
StringReference(&(Digest.refstrParam[MD5_AUTH_HENTITY]), &strcHEntity); // refernce memory - no alloc!!!!
}
// Since we requested only MD5_SESS in the challenge, the response had better be MD5_SESS too!
typeAlgorithm = MD5_SESS;
fContextAttr |= (ASC_RET_REPLAY_DETECT | ASC_RET_SEQUENCE_DETECT);
if (NT_SUCCESS(CheckItemInList(AUTHCONFSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), TRUE)))
{
// client requested AUTH-CONF since privacy requested
fContextAttr |= (ASC_RET_CONFIDENTIALITY | ASC_RET_INTEGRITY);
typeQOP = AUTH_CONF;
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client selected QOP=AUTH-CONF\n"));
}
else if (NT_SUCCESS(CheckItemInList(AUTHINTSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), TRUE)))
{
// client requested AUTH-INT since privacy requested
fContextAttr |= ASC_RET_INTEGRITY;
typeQOP = AUTH_INT;
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client selected QOP=AUTH-INT\n"));
}
else if (NT_SUCCESS(CheckItemInList(AUTHSTR, &(Digest.refstrParam[MD5_AUTH_QOP]), TRUE)))
{
// check to see if client specified auth only
typeQOP = AUTH;
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client selected QOP=AUTH\n"));
}
else
{ // Client did not specify any QOP
if (!Digest.refstrParam[MD5_AUTH_QOP].Length)
{
if (typeDigestMode == DIGESTMODE_HTTP)
{
typeQOP = NO_QOP_SPECIFIED; // This is OK - acts like AUTH but response different
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client did not specify QOP (HTTP only)\n"));
}
else
{
typeQOP = AUTH; // This is OK - SASL defaults to AUTH
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client did not specify QOP, default to AUTH\n"));
}
}
else
{
// Failed to provide recognized QOP
Status = SEC_E_QOP_NOT_SUPPORTED;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Client failed to provide recognized QOP\n"));
goto CleanUp;
}
}
// If there is no OldContextToken passed in, then check for SecurityContext handle (in opaque) else return error
if ( !ARGUMENT_PRESENT( OldContextHandle ))
{
// Search for Reference to SecurityContextHandle
Status = CtxtHandlerOpaqueToPtr(&(Digest.refstrParam[MD5_AUTH_OPAQUE]), &pContext);
if (!NT_SUCCESS (Status))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: CtxtHandlerOpaqueToPtr error 0x%x\n", Status));
goto CleanUp;
}
}
else
{
// We have a SecurityContextHandle to use - see if it is in the ContextList and valid
Status = CtxtHandlerHandleToContext(OldContextHandle, FALSE, &pContext);
if (!NT_SUCCESS (Status))
{
Status = SEC_E_INVALID_TOKEN;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: CtxtHandlerHandleToContext error 0x%x\n", Status));
goto CleanUp;
}
}
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Acquired Context ptr for 0x%x\n", pContext));
bLockedContext = TRUE;
// Can only call AcceptSecurityContect Once after ChallengeResponse
// For non-persistent connections (no OldContextHandle passed in), just return SCH and return
if (pContext->strSessionKey.Length)
{
if (ARGUMENT_PRESENT( OldContextHandle ))
{
Status = STATUS_LOGON_FAILURE;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Multiple call to completed ASC\n"));
goto CleanUp;
}
else
{
Status = SEC_I_COMPLETE_NEEDED;
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Opaque located CtxtHandle, return handle, Complete needed\n"));
*NewContextHandle = (ULONG_PTR)pContext; // Just report back with the updated context
pContext = NULL;
goto CleanUp;
}
}
// Check to see if the Server has provided character set for encoding - only UTF-8 accepted
Status = CheckItemInList(MD5_UTF8STR, &(Digest.refstrParam[MD5_AUTH_CHARSET]), TRUE);
if (NT_SUCCESS(Status))
{
// The ChallengeResponse requested UTF-8 encoding, check to see that server allowed this
if (((typeDigest == SASL_SERVER) && (g_fParameter_UTF8SASL == TRUE)) ||
((typeDigest == DIGEST_SERVER) && (g_fParameter_UTF8HTTP == TRUE)))
{
typeCharset = UTF_8;
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Server allows UTF-8 encoding\n"));
}
else
{
// We did not authorize this type of encoding - fail the request
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Client requested UTF-8 server did not offer\n"));
Status = SEC_E_ILLEGAL_MESSAGE;
goto CleanUp;
}
}
// We now have a pointer to the Security Context to use, finish up setting up the digestparamter fields
// Set the type of Digest Parameters we are to process
pContext->typeDigest = typeDigest;
pContext->typeAlgorithm = typeAlgorithm;
pContext->typeQOP = typeQOP;
pContext->typeCharset = typeCharset;
if (pContext->typeQOP == AUTH_CONF)
{
Status = CheckItemInList(STR_CIPHER_RC4, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting RC4 for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_RC4;
}
else
{
Status = CheckItemInList(STR_CIPHER_3DES, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting Triple DES for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_3DES;
}
else
{
Status = CheckItemInList(STR_CIPHER_RC4_56, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting RC4-56 for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_RC4_56;
}
else
{
Status = CheckItemInList(STR_CIPHER_RC4_40, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting RC4-40 for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_RC4_40;
}
else
{
Status = CheckItemInList(STR_CIPHER_DES, &(Digest.refstrParam[MD5_AUTH_CIPHER]), TRUE);
if (NT_SUCCESS(Status))
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Selecting DES for auth-conf cipher\n"));
pContext->typeCipher = CIPHER_DES;
}
else
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: Failed to find known ciper selected by client\n"));
Status = STATUS_CRYPTO_SYSTEM_INVALID;
goto CleanUp;
}
}
}
}
}
}
// Check if client specified a MaxBuffer
if (Digest.refstrParam[MD5_AUTH_MAXBUF].Length && Digest.refstrParam[MD5_AUTH_MAXBUF].Buffer)
{
if (Digest.refstrParam[MD5_AUTH_MAXBUF].Length < MAXBUFNUMLEN)
{
ULONG ulMaxBuf = 0;
CHAR czMaxBuf[MAXBUFNUMLEN + 1];
ZeroMemory(czMaxBuf, (MAXBUFNUMLEN + 1));
memcpy(czMaxBuf, Digest.refstrParam[MD5_AUTH_MAXBUF].Buffer, Digest.refstrParam[MD5_AUTH_MAXBUF].Length);
Status = RtlCharToInteger(czMaxBuf, TENBASE, &ulMaxBuf);
if (!NT_SUCCESS(Status))
{
Status = SEC_E_ILLEGAL_MESSAGE;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: MaxBuf directive value malformed 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Client MaxBuf set to %lu\n", ulMaxBuf));
pContext->ulSendMaxBuf = ulMaxBuf;
}
else
{
Status = SEC_E_ILLEGAL_MESSAGE;
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: MaxBuf directive value too large 0x%x\n", Status));
goto CleanUp;
}
}
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Digest inputs processing completed\n"));
// ReplyBuffer will contain the ResponseAuth if generated
Status = DigestProcessParameters(pContext, &Digest, &ReplyBuffer, &AuditLogStatus);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: DigestProcessParameters error 0x%x\n", Status));
goto CleanUp;
}
fLogonSessionCreated = TRUE; // We have successfully authed the request & created LogonID & Token
if ((fContextReqFlags & ASC_REQ_ALLOCATE_MEMORY) == 0)
{
if (pOutputToken->cbBuffer < ReplyBuffer.cbBuffer)
{
DebugLog((DEB_ERROR,"SpAcceptLsaModeContext:Output token is too small - sent in %d, needed %d\n",
pOutputToken->cbBuffer, ReplyBuffer.cbBuffer));
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
Status = STATUS_BUFFER_TOO_SMALL;
goto CleanUp;
}
RtlCopyMemory(pOutputToken->pvBuffer, ReplyBuffer.pvBuffer, ReplyBuffer.cbBuffer);
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
}
else
{
pOutputToken->pvBuffer = ReplyBuffer.pvBuffer;
pOutputToken->cbBuffer = ReplyBuffer.cbBuffer;
ReplyBuffer.pvBuffer = NULL;
ReplyBuffer.cbBuffer = 0;
fContextAttr |= ASC_RET_ALLOCATED_MEMORY;
}
// Establish the attribute flags for this security context
pContext->ContextReq = fContextAttr;
// Keep a copy of the Cnonce for future Delegation requests
Status = StringDuplicate(&pContext->strCNonce, &Digest.refstrParam[MD5_AUTH_CNONCE]);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: StringDuplicate CNonce failed status 0x%x\n", Status));
goto CleanUp;
}
// Now create a LogonSession for the completed LogonToken contained SecurityContext
// This can be utilized in delegated digest client's ACH
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: Adding a LogonSession for successful ASC\n"));
Status = CtxtCreateLogSess(pContext);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: CtxtCreateLogSess failed status 0x%x\n", Status));
goto CleanUp;
}
Status = SspMapDigestContext(pContext, &Digest, ContextData);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext, SspMapContext returns %d\n", Status));
goto CleanUp;
}
*MappedContext = TRUE;
pContext->ulNC++; // Everything verified so increment to next nonce count
*NewContextHandle = (ULONG_PTR)pContext; // Just report back with the updated context
*fContextAttributes = fContextAttr; // Return the ASC Attributes set on Context
if (pExpirationTime)
{
*pExpirationTime = pContext->PasswordExpires;
}
Status = STATUS_SUCCESS;
CleanUp:
// Now perform auditlogon Raid #329545
if (Status == STATUS_SUCCESS) { // Check to see if completed a logon
if (pContext)
{
g_LsaFunctions->AuditLogon(
STATUS_SUCCESS,
STATUS_SUCCESS,
&(pContext->ustrAccountName),
&(pContext->ustrDomain),
&g_ustrWorkstationName,
NULL,
Network,
&g_DigestSource,
&(pContext->LoginID)
);
}
}
else {
if (pContext)
{
g_LsaFunctions->AuditLogon(
Status,
AuditLogStatus,
&(pContext->ustrAccountName),
&(pContext->ustrDomain),
&g_ustrWorkstationName,
NULL,
Network,
&g_DigestSource,
&(pContext->LoginID)
);
}
}
if (!NT_SUCCESS(Status))
{ // Failed to complete operations so clean up
if (fLogonSessionCreated == TRUE)
{
// Notify LSA that LogonID is not valid
SubStatus = g_LsaFunctions->DeleteLogonSession(&(pContext->LoginID));
if (!NT_SUCCESS(SubStatus))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: cleanup DeleteLogonSession failed\n"));
}
fLogonSessionCreated = FALSE;
// If we created a token then we need to close it
if (pContext->TokenHandle)
{
SubStatus = NtClose(pContext->TokenHandle);
pContext->TokenHandle = NULL;
}
}
if (pNewContext)
{
ContextFree(pNewContext);
}
pNewContext = NULL;
*NewContextHandle = NULL;
}
// DeReference - pCredential, pOldContext
if (bLockedCredential && pCredential)
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: CredHandlerRelease to be called for 0x%x\n", pCredential));
SubStatus = CredHandlerRelease(pCredential);
if (!NT_SUCCESS(SubStatus))
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: CredHandlerRelease error 0x%x\n", SubStatus));
if (NT_SUCCESS(Status))
{
Status = SubStatus; // Indicate release error
}
}
}
if (bLockedContext && pContext)
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: CtxtHandlerRelease to be called for 0x%x\n", pContext));
SubStatus = CtxtHandlerRelease(pContext);
if (!NT_SUCCESS(SubStatus))
{
DebugLog((DEB_TRACE, "SpAcceptLsaModeContext: CtxtHandlerRelease error 0x%x\n", SubStatus));
if (NT_SUCCESS(Status))
{
Status = SubStatus; // Indicate release error
}
}
}
// Free up any allocated memory from the ouput reply buffer
if (ReplyBuffer.pvBuffer)
{
DigestFreeMemory(ReplyBuffer.pvBuffer);
ReplyBuffer.pvBuffer = NULL;
ReplyBuffer.cbBuffer = 0;
}
// Clean up local memory used by Digest
DigestFree(&Digest);
StringFree(&strRealm);
DebugLog((DEB_TRACE_FUNC, "SpAcceptLsaModeContext: Leaving Context 0x%x Status 0x%x\n", *NewContextHandle, Status));
return(Status);
}
// Creates a logon session for the logontoken contained in the SecurityContext
// The Token was created for the authenticated digest by ConvertAuthDataToToken
NTSTATUS
CtxtCreateLogSess(
IN PDIGEST_CONTEXT pContext)
{
NTSTATUS Status = STATUS_SUCCESS;
PDIGEST_LOGONSESSION pNewLogonSession = NULL;
DebugLog((DEB_TRACE_FUNC, "CtxtCreateLogSess: Entering\n"));
// Create a new entry into LogonSession listing
pNewLogonSession = (PDIGEST_LOGONSESSION)DigestAllocateMemory(sizeof(DIGEST_LOGONSESSION));
if (!pNewLogonSession)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR, "CtxtCreateLogSess: Could not allocate memory for logonsession, error 0x%x\n", Status));
goto CleanUp;
}
LogonSessionInit(pNewLogonSession);
pNewLogonSession->LogonType = Network;
pNewLogonSession->LogonId = pContext->LoginID;
UnicodeStringDuplicate(&(pNewLogonSession->ustrAccountName), &(pContext->ustrAccountName));
UnicodeStringDuplicate(&(pNewLogonSession->ustrDomainName), &(pContext->ustrDomain));
DebugLog((DEB_TRACE, "CtxtCreateLogSess: Added new logonsession into list, handle 0x%x\n", pNewLogonSession));
LogSessHandlerInsert(pNewLogonSession);
pNewLogonSession = NULL; // Turned over memory to LogSessHandler
CleanUp:
if (pNewLogonSession)
{
DigestFreeMemory(pNewLogonSession);
pNewLogonSession = NULL;
}
DebugLog((DEB_TRACE_FUNC, "CtxtCreateLogSess: Leaving Status 0x%x\n", Status));
return(Status);
}
// Some quick checks to make sure SecurityToken buffers are OK
//
//
// Args
// ulMaxSize - if non-zero then buffer must not be larger than this value, if zero no check is done
BOOL
ContextIsTokenOK(
IN PSecBuffer pTempToken,
IN ULONG ulMaxSize)
{
BOOL bStatus = TRUE;
if (!pTempToken)
{
DebugLog((DEB_ERROR, "ContextIsTokenOK: Error Bad input\n"));
return FALSE;
}
// If Buffer pointer is NULL then cbBuffer length must be zero
if ((!pTempToken->pvBuffer) && (pTempToken->cbBuffer))
{
DebugLog((DEB_ERROR, "ContextIsTokenOK: Error Buffer NULL, length non-zero\n"));
return FALSE;
}
// Verify that the input authentication string length is not too large
if (ulMaxSize && (pTempToken->cbBuffer > ulMaxSize))
{
DebugLog((DEB_ERROR, "ContextIsTokenOK: Error Buffer size too big (Max %lu Buffer %lu)\n",
ulMaxSize, pTempToken->cbBuffer));
return FALSE;
}
return TRUE;
}
// Creats the Challenge in the server to send back to the client
//
// Args: pContext - secruity context to utilize for Challenge Creation
// pstrRealm - allows for override of the Realm directive by this string
// OutBuffer - secbuffer to store the output challenge in
NTSTATUS NTAPI
ContextCreateChal(
IN PDIGEST_CONTEXT pContext,
IN PSTRING pstrRealm,
OUT PSecBuffer OutBuffer
)
{
NTSTATUS Status = STATUS_SUCCESS;
USHORT cbChallenge = 0;
ULONG cbLenNeeded = 0;
BOOL fSASLMode = FALSE;
STRING strTempRealm;
PCHAR pczTemp = NULL;
PCHAR pczTemp2 = NULL;
DebugLog((DEB_TRACE_FUNC, "ContextCreateChal: Entering\n"));
ZeroMemory(&strTempRealm, sizeof(strTempRealm));
// allocate the buffers for output - in the future can optimze to allocate exact amount needed
pczTemp = (PCHAR)DigestAllocateMemory((3 * NTDIGEST_SP_MAX_TOKEN_SIZE) + 1);
if (!pczTemp)
{
DebugLog((DEB_ERROR, "ContextCreateChal: No memory for output buffers\n"));
goto CleanUp;
}
pczTemp2 = (PCHAR)DigestAllocateMemory(NTDIGEST_SP_MAX_TOKEN_SIZE + 1);
if (!pczTemp2)
{
DebugLog((DEB_ERROR, "ContextCreateChal: No memory for output buffers\n"));
goto CleanUp;
}
pczTemp[0] = '\0';
pczTemp2[0] = '\0';
// Check to make sure we have minimal input and outputs
if ((!pContext) || (!OutBuffer) || (!pstrRealm))
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "ContextCreateChal: Invalid args\n"));
goto CleanUp;
}
// calculate the MAX possible size for the respose - will be smaller than this value
cbLenNeeded = CB_CHAL; // MAX byte count for directives and symbols
cbLenNeeded += pContext->strNonce.Length;
cbLenNeeded += pContext->strOpaque.Length;
cbLenNeeded += pstrRealm->Length;
cbLenNeeded += g_strNtDigestUTF8ServerRealm.Length;
cbLenNeeded += g_strNTDigestISO8859ServerRealm.Length; // Really only need one of these but make simple math
if (cbLenNeeded > NTDIGEST_SP_MAX_TOKEN_SIZE)
{
Status = STATUS_BUFFER_TOO_SMALL;
DebugLog((DEB_ERROR, "ContextCreateChal: output exceed max size or buffer too small len is %d\n", cbLenNeeded));
goto CleanUp;
}
if (pContext->typeDigest == SASL_SERVER)
{
fSASLMode = TRUE;
}
if (pContext->typeQOP == AUTH_CONF)
{
sprintf(pczTemp, "qop=\"auth,auth-int,auth-conf\",cipher=\"3des,des,rc4-40,rc4,rc4-56\",algorithm=%s,nonce=\"%Z\"",
((fSASLMode == TRUE) ? MD5_SESS_SASLSTR: MD5_SESSSTR), &pContext->strNonce);
}
else if (pContext->typeQOP == AUTH_INT)
{
sprintf(pczTemp, "qop=\"auth,auth-int\",algorithm=%s,nonce=\"%Z\"",
((fSASLMode == TRUE) ? MD5_SESS_SASLSTR: MD5_SESSSTR), &pContext->strNonce);
}
else
{
sprintf(pczTemp, "qop=\"auth\",algorithm=%s,nonce=\"%Z\"",
((fSASLMode == TRUE) ? MD5_SESS_SASLSTR: MD5_SESSSTR), &pContext->strNonce);
}
// Attach opaque data (but not on SASL_SERVER)
if ((pContext->strOpaque.Length) && (pContext->typeDigest != SASL_SERVER))
{
sprintf(pczTemp2, ",opaque=\"%Z\"", &pContext->strOpaque);
strcat(pczTemp, pczTemp2);
}
// Attach charset to allow UTF-8 character encoding
if (pContext->typeCharset == UTF_8)
{
strcat(pczTemp, ",charset=utf-8");
}
// Attach realm - allow the strRealm to override the system DnsDomainName
if (pstrRealm->Length)
{
Status = BackslashEncodeString(pstrRealm, &strTempRealm);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "ContextCreateChal: BackslashEncode failed status 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "ContextCreateChal: Realm provided (%Z) backslash encoded (%Z)\n", pstrRealm, &strTempRealm));
sprintf(pczTemp2, ",realm=\"%Z\"", &strTempRealm);
strcat(pczTemp, pczTemp2);
}
else
{
// determine the realm to present based on charset requested
if (pContext->typeCharset == UTF_8)
{
if (g_strNtDigestUTF8ServerRealm.Length)
{
Status = BackslashEncodeString(&g_strNtDigestUTF8ServerRealm, &strTempRealm);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "ContextCreateChal: BackslashEncode failed status 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "ContextCreateChal: UTF-8 default Realm (%Z) backslash encoded (%Z)\n",
&g_strNtDigestUTF8ServerRealm, &strTempRealm));
sprintf(pczTemp2, ",realm=\"%Z\"", &strTempRealm);
strcat(pczTemp, pczTemp2);
}
}
else
{
if (g_strNTDigestISO8859ServerRealm.Length)
{
Status = BackslashEncodeString(&g_strNTDigestISO8859ServerRealm, &strTempRealm);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "ContextCreateChal: BackslashEncode failed status 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "ContextCreateChal: ISO 8859-1 default Realm (%Z) backslash encoded (%Z)\n",
&g_strNTDigestISO8859ServerRealm, &strTempRealm));
sprintf(pczTemp2, ",realm=\"%Z\"", &strTempRealm);
strcat(pczTemp, pczTemp2);
}
}
}
// Attach stale directive if indicated
if (pContext->ContextReq & ASC_RET_STALE)
{
sprintf(pczTemp2, ",stale=true");
strcat(pczTemp, pczTemp2);
}
// total buffer for Challenge (NULL is not included in output buffer - ref:Bug 310201)
// cbLenNeeded = strlen(pczTemp) + sizeof(CHAR);
cbLenNeeded = strlen(pczTemp);
// Check on allocating output buffer
if (!OutBuffer->cbBuffer)
{
OutBuffer->pvBuffer = DigestAllocateMemory(cbLenNeeded);
if (!OutBuffer->pvBuffer)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR, "ContextCreateChal: out of memory on challenge output\n"));
goto CleanUp;
}
OutBuffer->cbBuffer = cbLenNeeded;
OutBuffer->BufferType = SECBUFFER_DATA;
}
if (cbLenNeeded > OutBuffer->cbBuffer)
{
Status = STATUS_BUFFER_TOO_SMALL;
DebugLog((DEB_ERROR, "ContextCreateChal: output buffer too small need %d len is %d\n",
cbLenNeeded, OutBuffer->cbBuffer));
goto CleanUp;
}
memcpy(OutBuffer->pvBuffer, pczTemp, cbLenNeeded);
// Now indicate number of bytes utilized in output buffer
OutBuffer->cbBuffer = cbLenNeeded;
CleanUp:
if (pczTemp)
{
DigestFreeMemory(pczTemp);
pczTemp = NULL;
}
if (pczTemp2)
{
DigestFreeMemory(pczTemp2);
pczTemp2 = NULL;
}
StringFree(&strTempRealm);
DebugLog((DEB_TRACE_FUNC, "ContextCreateChal: Leaving Status 0x%x\n", Status));
return(Status);
}
// Generate the output buffer from a given Digest
NTSTATUS NTAPI
DigestCreateChalResp(
IN PDIGEST_PARAMETER pDigest,
IN PUSER_CREDENTIALS pUserCreds,
OUT PSecBuffer OutBuffer
)
{
NTSTATUS Status = STATUS_SUCCESS;
USHORT cbChallenge = 0;
ULONG cbLenNeeded = 0;
char *pczQOP = NULL;
STRING strcQOP; // string pointing to a constant value
STRING strcAlgorithm;
BOOL fSASLMode = FALSE;
UINT uCodePage = CP_8859_1;
STRING strTempRealm; // Backslash encoded forms
STRING strTempUsername;
STRING strTempUri;
STRING strRealm;
STRING strUsername;
PSTRING pstrUsername = NULL;
PSTRING pstrRealm = NULL;
PCHAR pczTemp = NULL;
PCHAR pczTemp2 = NULL;
DebugLog((DEB_TRACE_FUNC, "DigestCreateChalResp: Entering\n"));
ZeroMemory(&strTempRealm, sizeof(strTempRealm));
ZeroMemory(&strTempUsername, sizeof(strTempUsername));
ZeroMemory(&strTempUri, sizeof(strTempUri));
ZeroMemory(&strRealm, sizeof(strRealm));
ZeroMemory(&strUsername, sizeof(strUsername));
// allocate the buffers for output - in the future can optimze to allocate exact amount needed
pczTemp = (PCHAR)DigestAllocateMemory((3 * NTDIGEST_SP_MAX_TOKEN_SIZE) + 1);
if (!pczTemp)
{
DebugLog((DEB_ERROR, "DigestCreateChalResp: No memory for output buffers\n"));
goto CleanUp;
}
pczTemp2 = (PCHAR)DigestAllocateMemory(NTDIGEST_SP_MAX_TOKEN_SIZE + 1);
if (!pczTemp2)
{
DebugLog((DEB_ERROR, "DigestCreateChalResp: No memory for output buffers\n"));
goto CleanUp;
}
pczTemp[0] = '\0';
pczTemp2[0] = '\0';
RtlInitString(&strcQOP, NULL);
RtlInitString(&strcAlgorithm, NULL);
if ((pDigest->typeDigest == SASL_SERVER) || (pDigest->typeDigest == SASL_CLIENT))
{
fSASLMode = TRUE;
}
// Establish which QOP utilized
if (pDigest->typeQOP == AUTH_CONF)
{
RtlInitString(&strcQOP, AUTHCONFSTR);
}
else if (pDigest->typeQOP == AUTH_INT)
{
RtlInitString(&strcQOP, AUTHINTSTR);
}
else if (pDigest->typeQOP == AUTH)
{
RtlInitString(&strcQOP, AUTHSTR);
}
// Determine which code page to utilize
if (pDigest->typeCharset == UTF_8)
{
uCodePage = CP_UTF8;
}
else
{
uCodePage = CP_8859_1;
}
// if provided with UserCred then use them, otherwise use Digest directive values
if (pUserCreds)
{
DebugLog((DEB_TRACE, "DigestCreateChalResp: UserCredentials presented - encode and output\n"));
Status = EncodeUnicodeString(&pUserCreds->ustrUsername, uCodePage, &strUsername, NULL);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_WARN, "DigestCreateChalResp: Error in encoding username\n"));
goto CleanUp;
}
Status = EncodeUnicodeString(&pUserCreds->ustrDomain, uCodePage, &strRealm, NULL);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_WARN, "DigestCreateChalResp: Error in encoding realm\n"));
goto CleanUp;
}
// Now encode the user directed fields (username, URI, realm)
Status = BackslashEncodeString(&strUsername, &strTempUsername);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestCreateChalResp: BackslashEncode failed status 0x%x\n", Status));
goto CleanUp;
}
Status = BackslashEncodeString(&strRealm, &strTempRealm);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestCreateChalResp: BackslashEncode failed status 0x%x\n", Status));
goto CleanUp;
}
// Utilize these strings in the output
pstrUsername = &strTempUsername;
pstrRealm = &strTempRealm;
// Make copy of the directive values for LSA to Usermode context
Status = StringDuplicate(&(pDigest->strUsernameEncoded), pstrUsername);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestCreateChalResp: Failed to copy over UsernameEncoded\n"));
goto CleanUp;
}
Status = StringDuplicate(&(pDigest->strRealmEncoded), pstrRealm);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestCreateChalResp: Failed to copy over RealmEncoded\n"));
goto CleanUp;
}
// refernce memory - no alloc!!!!
StringReference(&(pDigest->refstrParam[MD5_AUTH_USERNAME]), &(pDigest->strUsernameEncoded));
StringReference(&(pDigest->refstrParam[MD5_AUTH_REALM]), &(pDigest->strRealmEncoded));
}
else
{
// No usercreds passed in so just use the current digest directive values
DebugLog((DEB_WARN, "DigestCreateChalResp: No UserCredentials - use provided digest\n"));
pstrUsername = &(pDigest->refstrParam[MD5_AUTH_USERNAME]);
pstrRealm = &(pDigest->refstrParam[MD5_AUTH_REALM]);
}
Status = BackslashEncodeString(&pDigest->refstrParam[MD5_AUTH_URI], &strTempUri);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestCreateChalResp: BackslashEncode failed status 0x%x\n", Status));
goto CleanUp;
}
// Precalc the amount of space needed for output
cbLenNeeded = CB_CHALRESP; // MAX byte count for directives and symbols
cbLenNeeded += pstrUsername->Length;
cbLenNeeded += pstrRealm->Length;
cbLenNeeded += pDigest->refstrParam[MD5_AUTH_NONCE].Length;
cbLenNeeded += strTempUri.Length;
cbLenNeeded += pDigest->strResponse.Length;
cbLenNeeded += strcAlgorithm.Length;
cbLenNeeded += pDigest->refstrParam[MD5_AUTH_CNONCE].Length;
cbLenNeeded += pDigest->refstrParam[MD5_AUTH_OPAQUE].Length;
cbLenNeeded += MAX_AUTH_LENGTH;
cbLenNeeded += pDigest->refstrParam[MD5_AUTH_NC].Length;
cbLenNeeded += strcQOP.Length;
if (cbLenNeeded > NTDIGEST_SP_MAX_TOKEN_SIZE)
{
Status = STATUS_BUFFER_TOO_SMALL;
DebugLog((DEB_ERROR, "DigestCreateChalResp: output exceed max size or buffer too small len is %d\n", cbLenNeeded));
goto CleanUp;
}
// In digest calc - already checked username,realm,nonce,method,uri
// Make sure there are values for the rest needed
if ((!pDigest->strResponse.Length) ||
(!pDigest->refstrParam[MD5_AUTH_NC].Length) ||
(!pDigest->refstrParam[MD5_AUTH_CNONCE].Length))
{
// Failed on a require field-value
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "DigestCreateChalResp: Response, NC, or Cnonce is zero length\n"));
goto CleanUp;
}
if (pstrRealm->Length)
{
sprintf(pczTemp,
"username=\"%Z\",realm=\"%Z\",nonce=\"%Z\",%s=\"%Z\",cnonce=\"%Z\",nc=%Z",
pstrUsername,
pstrRealm,
&pDigest->refstrParam[MD5_AUTH_NONCE],
((fSASLMode == TRUE) ? DIGESTURI_STR: URI_STR),
&strTempUri,
&pDigest->refstrParam[MD5_AUTH_CNONCE],
&pDigest->refstrParam[MD5_AUTH_NC]);
}
else
{
sprintf(pczTemp,
"username=\"%Z\",realm=\"\",nonce=\"%Z\",%s=\"%Z\",cnonce=\"%Z\",nc=%Z",
pstrUsername,
&pDigest->refstrParam[MD5_AUTH_NONCE],
((fSASLMode == TRUE) ? DIGESTURI_STR: URI_STR),
&strTempUri,
&pDigest->refstrParam[MD5_AUTH_CNONCE],
&pDigest->refstrParam[MD5_AUTH_NC]);
}
if (fSASLMode == TRUE)
{
// Do not output algorithm - must be md5-sess and that is assumed
sprintf(pczTemp2, ",response=%Z", &pDigest->strResponse);
strcat(pczTemp, pczTemp2);
}
else
{
if (pDigest->typeAlgorithm == MD5_SESS)
{
sprintf(pczTemp2, ",algorithm=MD5-sess,response=\"%Z\"", &pDigest->strResponse);
strcat(pczTemp, pczTemp2);
}
else
{
sprintf(pczTemp2, ",response=\"%Z\"", &pDigest->strResponse);
strcat(pczTemp, pczTemp2);
}
}
// Attach QOP if specified - support older format for no QOP
if (strcQOP.Length)
{
if (fSASLMode == TRUE)
{
sprintf(pczTemp2, ",qop=%Z", &strcQOP);
strcat(pczTemp, pczTemp2);
}
else
{
sprintf(pczTemp2, ",qop=\"%Z\"", &strcQOP);
strcat(pczTemp, pczTemp2);
}
}
// Attach Cipher selected if required
if (pDigest->typeQOP == AUTH_CONF)
{
// FIX optimize these into a list for efficiency
if (pDigest->typeCipher == CIPHER_RC4)
{
sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_RC4);
strcat(pczTemp, pczTemp2);
}
else if (pDigest->typeCipher == CIPHER_RC4_56)
{
sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_RC4_56);
strcat(pczTemp, pczTemp2);
}
else if (pDigest->typeCipher == CIPHER_RC4_40)
{
sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_RC4_40);
strcat(pczTemp, pczTemp2);
}
else if (pDigest->typeCipher == CIPHER_3DES)
{
sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_3DES);
strcat(pczTemp, pczTemp2);
}
else if (pDigest->typeCipher == CIPHER_DES)
{
sprintf(pczTemp2, ",cipher=%s", STR_CIPHER_DES);
strcat(pczTemp, pczTemp2);
}
}
// Attach opaque data (but not on SASL)
if ((fSASLMode == FALSE) && pDigest->refstrParam[MD5_AUTH_OPAQUE].Length)
{
sprintf(pczTemp2, ",opaque=\"%Z\"", &pDigest->refstrParam[MD5_AUTH_OPAQUE]);
strcat(pczTemp, pczTemp2);
}
// Attach charset to indicate that UTF-8 character encoding is utilized
if (pDigest->typeCharset == UTF_8)
{
strcat(pczTemp, ",charset=utf-8");
}
// total buffer for Challenge (NULL is not included in output buffer - ref:Bug 310201)
// cbLenNeeded = strlen(pczTemp) + sizeof(CHAR);
cbLenNeeded = strlen(pczTemp);
// Check on allocating output buffer
if (!OutBuffer->cbBuffer)
{
OutBuffer->pvBuffer = DigestAllocateMemory(cbLenNeeded);
if (!OutBuffer->pvBuffer)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR, "DigestCreateChalResp: out of memory on challenge output\n"));
goto CleanUp;
}
OutBuffer->cbBuffer = cbLenNeeded;
}
if (cbLenNeeded > OutBuffer->cbBuffer)
{
Status = STATUS_BUFFER_TOO_SMALL;
DebugLog((DEB_ERROR, "DigestCreateChalResp: output buffer too small need %d len is %d\n",
cbLenNeeded, OutBuffer->cbBuffer));
goto CleanUp;
}
memcpy(OutBuffer->pvBuffer, pczTemp, cbLenNeeded);
OutBuffer->cbBuffer = cbLenNeeded;
OutBuffer->BufferType = SECBUFFER_TOKEN;
CleanUp:
if (pczTemp)
{
DigestFreeMemory(pczTemp);
pczTemp = NULL;
}
if (pczTemp2)
{
DigestFreeMemory(pczTemp2);
pczTemp2 = NULL;
}
StringFree(&strTempRealm);
StringFree(&strTempUsername);
StringFree(&strTempUri);
StringFree(&strRealm);
StringFree(&strUsername);
DebugLog((DEB_TRACE_FUNC, "DigestCreateChalResp: Leaving status 0x%x\n", Status));
return(Status);
}
// This is the main section to process a Context with an incoming Digest message to authenticate the
// message on the DC, generate a session key, and get the user Token. On subsequent calls, the session key
// can be utilized directly and if the Digest is authenticated, the Token can be utilized.
// AuditLogStatus can be used to provide SubStatus in AuditLogging on server
NTSTATUS NTAPI
DigestProcessParameters(
IN OUT PDIGEST_CONTEXT pContext,
IN PDIGEST_PARAMETER pDigest,
OUT PSecBuffer pOutputToken,
OUT PNTSTATUS pAuditLogStatus)
{
NTSTATUS Status = STATUS_SUCCESS;
NTSTATUS SubStatus = STATUS_SUCCESS;
ULONG ulNonceCount = 0;
USHORT cbDigestParamEncoded = 0; // Contains the number of bytes in Request to send out
BYTE *pMessageResponse = NULL;
ULONG ulMessageResponse = 0;
BOOL fLogonSessionCreated = FALSE; // indicate if the LSA was notified about logon
// Encoded Digest Parameters to send over Generic Passthrough
BYTE *pDigestParamEncoded = NULL;
// Response buffer from Generic Passthough (extracted from MessageResposne)
PDIGEST_BLOB_RESPONSE pDigestResponse = NULL;
UCHAR *pucResponseBuffer = NULL; // Used for alignment to long word boundaries
BOOL fKnownFormat = FALSE; // is the response blob format known
// Generic Passthrough variables - used to send data to DC for digest verification
UNICODE_STRING MsvPackageName = CONSTANT_UNICODE_STRING(TEXT(MSV1_0_PACKAGE_NAME));
UNICODE_STRING ustrDC; // Location for generic passthrough
PMSV1_0_PASSTHROUGH_REQUEST PassthroughRequest = NULL;
PMSV1_0_PASSTHROUGH_RESPONSE PassthroughResponse = NULL;
ULONG RequestSize = 0;
ULONG ResponseSize = 0;
PUCHAR Where = NULL;
// AuthData to Logon Token Variables
SECURITY_LOGON_TYPE LogonType = Network;
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel = SecurityImpersonation;
UNICODE_STRING ustrAccountName;
PUCHAR puctr = NULL;
ULONG ulSumTotal = 0;
ULONG i = 0;
DebugLog((DEB_TRACE_FUNC, "DigestProcessParameters: Entering\n"));
ZeroMemory(&ustrAccountName, sizeof(ustrAccountName));
ZeroMemory(&ustrDC, sizeof(ustrDC));
// Copy over the context types into the digest structure
pDigest->typeAlgorithm = pContext->typeAlgorithm;
pDigest->typeDigest = pContext->typeDigest;
pDigest->typeQOP = pContext->typeQOP;
pDigest->typeCharset = pContext->typeCharset;
// Check to make sure that the nonce sent back originated from this machine and is valid
Status = NonceIsValid(&(pDigest->refstrParam[MD5_AUTH_NONCE]));
if (!NT_SUCCESS(Status))
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "DigestProcessParameters: Nonce is not valid\n"));
goto CleanUp;
}
// Make sure that the nonces are the same
if (RtlCompareString(&(pContext->strNonce), &(pDigest->refstrParam[MD5_AUTH_NONCE]), FALSE))
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "DigestProcessParameters: nonce does not mach Context nonce!\n"));
goto CleanUp;
}
// We must have a noncecount specified since we specified a qop in the Challenge
// If we decide to support no noncecount modes then we need to make sure that qop is not specified
if (pDigest->refstrParam[MD5_AUTH_NC].Length)
{
Status = RtlCharToInteger(pDigest->refstrParam[MD5_AUTH_NC].Buffer, HEXBASE, &ulNonceCount);
if (!NT_SUCCESS(Status))
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "DigestProcessParameters: Nonce Count badly formatted\n"));
goto CleanUp;
}
}
else
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "DigestProcessParameters: Nonce Count not specified\n"));
goto CleanUp;
}
// Check nonceCount is incremented to preclude replay
if (ulNonceCount < (pContext->ulNC + 1))
{
// We failed to verify next noncecount
Status = SEC_E_OUT_OF_SEQUENCE;
DebugLog((DEB_ERROR, "DigestProcessParameters: NonceCount failed to increment!\n"));
goto CleanUp;
}
// Verify that this context matches the content in the Digest Parameters
// We have already gone to the DC and authenticated the first message
if (pContext->strSessionKey.Length)
{
DebugLog((DEB_TRACE, "DigestProcessParameters: We have a previous session key - use key for auth\n"));
// Copy the SessionKey from the Context into the Digest Structure to verify against
// This will have Digest Auth routines use the SessionKey rather than recompute H(A1)
StringFree(&(pDigest->strSessionKey));
Status = StringDuplicate(&(pDigest->strSessionKey), &(pContext->strSessionKey));
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to copy over SessionKey\n"));
goto CleanUp;
}
// No check locally that Digest is authentic
Status = DigestCalculation(pDigest, NULL);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: Oh no we FAILED Authentication!!!!\n"));
goto CleanUp;
}
// We have an authenticated the request
// Can utilize logonID
pContext->ulNC = ulNonceCount; // Indicate that we have processed up to this NC
}
else
{
DebugLog((DEB_TRACE, "DigestProcessParameters: No session key - call DC for auth\n"));
Status = DigestDecodeDirectiveStrings(pDigest);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "SpAcceptLsaModeContext: DigestDecodeDirectiveStrings error 0x%x\n", Status));
goto CleanUp;
}
// Identify the domain to send generic passthough to
Status = DigestDecodeUserAccount(pDigest, &ustrDC);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: DigestDecodeUserAccount failed 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "DigestProcessParameters: GenericPassthrough to domain [%wZ]\n", &ustrDC));
// Serialize the Digest Parameters (if need to send off box)
cbDigestParamEncoded = 0; // Will be allocated by BlobEncodeRequest
Status = BlobEncodeRequest(pDigest, &pDigestParamEncoded, &cbDigestParamEncoded);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: BlobEncodeRequest failed 0x%x\n", Status));
goto CleanUp;
}
// Send the Serialized Digest to the DC for verification & return of validity & session key
// If paramters match, perform authentication locally and utilize previous token
//
// We have to pass off to the DC so build the request.
//
RequestSize = sizeof(MSV1_0_PASSTHROUGH_REQUEST) +
ustrDC.Length +
g_ustrNtDigestPackageName.Length +
cbDigestParamEncoded;
PassthroughRequest = (PMSV1_0_PASSTHROUGH_REQUEST) DigestAllocateMemory(RequestSize);
if (PassthroughRequest == NULL)
{
Status = STATUS_INSUFFICIENT_RESOURCES;
goto CleanUp;
}
Where = (PUCHAR) (PassthroughRequest + 1); // Points to byte AFTER passthrough header
PassthroughRequest->MessageType = MsV1_0GenericPassthrough;
PassthroughRequest->DomainName.Length = ustrDC.Length;
PassthroughRequest->DomainName.MaximumLength = ustrDC.Length;
PassthroughRequest->DomainName.Buffer = (LPWSTR) Where; // this is NOT NULL TERMINATED
RtlCopyMemory(
Where,
ustrDC.Buffer,
ustrDC.Length
);
Where += ustrDC.Length;
PassthroughRequest->PackageName.Length = g_ustrNtDigestPackageName.Length;
PassthroughRequest->PackageName.MaximumLength = g_ustrNtDigestPackageName.Length;
PassthroughRequest->PackageName.Buffer = (LPWSTR) Where; // Not NULL terminated - relative reference
RtlCopyMemory(
Where,
g_ustrNtDigestPackageName.Buffer,
g_ustrNtDigestPackageName.Length
);
Where += g_ustrNtDigestPackageName.Length;
PassthroughRequest->LogonData = Where;
PassthroughRequest->DataLength = (ULONG)cbDigestParamEncoded;
RtlCopyMemory(
Where,
pDigestParamEncoded,
cbDigestParamEncoded
);
//
// We've build the buffer, now call NTLM to pass it through.
//
Status = g_LsaFunctions->CallPackage(
&MsvPackageName,
PassthroughRequest,
RequestSize, // How many bytes to send in Request
(PVOID *) &PassthroughResponse, // Place the buffers here
&ResponseSize, // Passed back the size of the buffer
&SubStatus // Return code from Digest Auth on the DC
);
DebugLog((DEB_TRACE, "DigestProcessParameters: Returned from Server's passthrough call Response buffer size %ld\n",
ResponseSize));
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR,"DigestProcessParameters: Failed to call MSV package to verify Digest: 0x%x\n",Status));
if (Status == STATUS_INVALID_INFO_CLASS)
{
Status = STATUS_LOGON_FAILURE;
}
goto CleanUp;
}
if (!NT_SUCCESS(SubStatus))
{
Status = SubStatus;
DebugLog((DEB_ERROR,"DigestProcessParameters: DC failed to verify Digest Response: 0x%x\n",Status));
goto CleanUp;
}
// Now pull out info from the Passthrough Response structure
if (PassthroughResponse->DataLength < sizeof(DIGEST_BLOB_RESPONSE))
{
// The returned data is not the expected size
Status = STATUS_INTERNAL_ERROR;
DebugLog((DEB_ERROR,"DigestProcessParameters: DC Response wrong data size: 0x%x\n",Status));
goto CleanUp;
}
// Copy it to a structure - can do direct map once we know this works OK
// Copy to Allocated memory forces aligment of fields
pDigestResponse = (PDIGEST_BLOB_RESPONSE)DigestAllocateMemory(PassthroughResponse->DataLength);
if (!pDigestResponse)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR,"DigestProcessParameters: Out of memory for response buffer alloc\n"));
goto CleanUp;
}
Where = (PUCHAR) (PassthroughResponse + 1); // start copy after header
RtlCopyMemory(
pDigestResponse,
Where,
PassthroughResponse->DataLength
);
// We should now have all the data we need for sessionkeys and if verified auth
// Check the MessageType and Versions if supported
if ((pDigestResponse->MessageType == VERIFY_DIGEST_MESSAGE_RESPONSE) && (pDigestResponse->version == DIGEST_BLOB_VERSION))
{
fKnownFormat = TRUE; // We know how to process this blob from the DC
DebugLog((DEB_TRACE,"DigestProcessParameters: DC Response known type and version\n"));
}
if (!fKnownFormat)
{
// The returned data not of a known type or version
Status = STATUS_INTERNAL_ERROR;
DebugLog((DEB_ERROR,"DigestProcessParameters: DC Response unknown type or version\n"));
goto CleanUp;
}
DebugLog((DEB_TRACE,"DigestProcessParameters: Processing DC Response\n"));
// If authenticated then, create a logon token with the DC returns (unless previous token exists)
// Now create the logon token with the AuthData buffer
// LsaConvertAuthDataToToken()
// Set the AuthorityName to the DC's Domainname
// g_DigestSource established at SpInitialize time in the LSA
if (!pDigestResponse->ulAuthDataSize)
{
// We do not have any AuthData
Status = STATUS_LOGON_FAILURE;
DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to determine AuthData\n"));
goto CleanUp;
}
// Copy over data to place on correct boundary (alloc should force long word boundary)
puctr = (PUCHAR)DigestAllocateMemory(pDigestResponse->ulAuthDataSize);
if (!puctr)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR, "DigestProcessParameters: out of memory on response PAC buffer\n"));
goto CleanUp;
}
memcpy(puctr,&(pDigestResponse->cAuthData),pDigestResponse->ulAuthDataSize);
ulSumTotal = 0;
for (i=0; i < (pDigestResponse->ulAuthDataSize); i++)
{
ulSumTotal += (ULONG)*(puctr + i);
}
// DebugLog((DEB_TRACE, "DigestProcessParameters: AuthData SumTotal is %ld\n", ulSumTotal));
Status = g_LsaFunctions->ConvertAuthDataToToken(puctr, pDigestResponse->ulAuthDataSize,
ImpersonationLevel, &g_DigestSource, LogonType, &pDigest->ustrCrackedDomain,
&(pContext->TokenHandle), &(pContext->LoginID), &ustrAccountName, &SubStatus);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to form token from AuthData 0x%x subStatus 0x%x\n",
Status, SubStatus));
pContext->TokenHandle = NULL; // no valid handle returned
goto CleanUp;
}
fLogonSessionCreated = TRUE; // LSA notified about LogonID
DebugLog((DEB_TRACE, "DigestProcessParameters: Token Created Handle 0x%x, LogonID (%x:%lx) \n",
pContext->TokenHandle, pContext->LoginID.HighPart, pContext->LoginID.LowPart));
DebugLog((DEB_TRACE, "DigestProcessParameters: AccountName %wZ \n", &ustrAccountName));
DebugLog((DEB_TRACE, "DigestProcessParameters: Domain %wZ \n", &pDigest->ustrCrackedDomain));
DebugLog((DEB_TRACE, "DigestProcessParameters: Passthrough UserName %wZ \n", &pDigest->ustrUsername));
pContext->ulNC = ulNonceCount; // Indicate that we have processed up to this NC
// Since all authenticated, initialize the known Context states
(void)UnicodeStringFree(&(pContext->ustrAccountName));
Status = UnicodeStringDuplicate(&(pContext->ustrAccountName), &ustrAccountName);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to copy UserName into Context\n"));
goto CleanUp;
}
(void)UnicodeStringFree(&(pContext->ustrDomain));
Status = UnicodeStringDuplicate(&(pContext->ustrDomain), &pDigest->ustrCrackedDomain);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to copy UserName into Context\n"));
goto CleanUp;
}
StringFree(&(pContext->strSessionKey));
Status = StringAllocate(&(pContext->strSessionKey), pDigestResponse->SessionKeyMaxLength);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to alloc Sessionkey memory\n"));
goto CleanUp;
}
memcpy(pContext->strSessionKey.Buffer, pDigestResponse->SessionKey, pDigestResponse->SessionKeyMaxLength);
pContext->strSessionKey.Length = (USHORT)strlencounted(pContext->strSessionKey.Buffer, pDigestResponse->SessionKeyMaxLength);
DebugLog((DEB_TRACE, "DigestProcessParameters: Response Data from passthrough call\n"));
DebugLog((DEB_TRACE, " Session Key: %Z\n", &(pContext->strSessionKey)));
if (pContext->typeDigest == SASL_SERVER)
{
// Form the ResponseAuth according to RFC2831 Sect 2.1.3
StringFree(&pDigest->strSessionKey);
StringDuplicate(&pDigest->strSessionKey, &pContext->strSessionKey);
Status = DigestSASLResponseAuth(pDigest, pOutputToken);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: Failed to generate ResponseAuth\n"));
goto CleanUp;
}
}
}
// Token created - Logon OK
*pAuditLogStatus = STATUS_SUCCESS;
CleanUp:
BlobFreeRequest(pDigestParamEncoded);
DigestFreeMemory(pMessageResponse);
pMessageResponse = NULL;
ulMessageResponse = 0;
if (!NT_SUCCESS(Status))
{
// If we failed - do extra cleanup
if (fLogonSessionCreated == TRUE)
{
// Notify LSA that LogonID is not valid
SubStatus = g_LsaFunctions->DeleteLogonSession(&(pContext->LoginID));
if (!NT_SUCCESS(SubStatus))
{
DebugLog((DEB_ERROR, "DigestProcessParameters: cleanup DeleteLogonSession failed\n"));
}
fLogonSessionCreated = FALSE;
}
// If we created a token then we need to close it
if (pContext->TokenHandle)
{
SubStatus = NtClose(pContext->TokenHandle);
pContext->TokenHandle = NULL;
}
}
if (pDigestResponse)
{
DigestFreeMemory(pDigestResponse);
}
if (PassthroughRequest != NULL)
{
DigestFreeMemory(PassthroughRequest);
}
if (PassthroughResponse != NULL)
{
g_LsaFunctions->FreeReturnBuffer(PassthroughResponse);
}
if (ustrAccountName.Buffer)
{ // Need to free up memory from token creation
g_LsaFunctions->FreeLsaHeap(ustrAccountName.Buffer);
ustrAccountName.Buffer = NULL;
ustrAccountName.Length = ustrAccountName.MaximumLength = 0;
}
DigestFreeMemory(puctr);
UnicodeStringFree(&ustrDC);
DebugLog((DEB_TRACE_FUNC, "DigestProcessParameters: Leaving\n"));
return(Status);
}
// This call is utilized by Initialize Securitycontext - it is used to create the sessionkey
// form the response hash. This function is called only as a client process
NTSTATUS NTAPI
DigestGenerateParameters(
IN OUT PDIGEST_CONTEXT pContext,
IN PDIGEST_PARAMETER pDigest,
OUT PSecBuffer pOutputToken)
{
NTSTATUS Status = STATUS_SUCCESS;
NTSTATUS SubStatus = STATUS_SUCCESS;
UNICODE_STRING ustrTempPasswd;
USER_CREDENTIALS UserCreds;
ZeroMemory(&UserCreds, sizeof(USER_CREDENTIALS));
ZeroMemory(&ustrTempPasswd, sizeof(ustrTempPasswd));
DebugLog((DEB_TRACE_FUNC, "DigestGenerateParameters: Entering\n"));
pDigest->typeDigest = pContext->typeDigest;
pDigest->typeAlgorithm = pContext->typeAlgorithm;
pDigest->typeQOP = pContext->typeQOP;
pDigest->typeCipher = pContext->typeCipher;
pDigest->typeCharset = pContext->typeCharset;
// We must have specified the username and password
Status = UnicodeStringDuplicate(&(UserCreds.ustrDomain), &(pContext->ustrDomain));
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestGenerateParameters: Duplicate Domain string status 0x%x\n", Status));
goto CleanUp;
}
Status = UnicodeStringDuplicate(&(UserCreds.ustrUsername), &(pContext->ustrAccountName));
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestGenerateParameters: Duplicate Username string status 0x%x\n", Status));
goto CleanUp;
}
Status = UnicodeStringDuplicatePassword(&(UserCreds.ustrPasswd), &(pContext->ustrPassword));
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestGenerateParameters: Duplicate Password string status 0x%x\n", Status));
goto CleanUp;
}
UserCreds.fIsValidPasswd = TRUE;
UserCreds.fIsEncryptedPasswd = TRUE;
DebugLog((DEB_TRACE, "DigestGenerateParameters: Before DigestCalculation\n"));
(void)DigestPrint(pDigest);
// No check locally that Digest is authentic
Status = DigestCalculation(pDigest, &UserCreds);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestGenerateParameters: Oh no we FAILED Authentication!!!!\n"));
goto CleanUp;
}
// DigestCalculation determined the sessionkey - copy into this context
StringFree(&(pContext->strSessionKey));
Status = StringDuplicate( &(pContext->strSessionKey), &(pDigest->strSessionKey));
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestGenerateParameters: Failed to copy over SessionKey\n"));
goto CleanUp;
}
// We have an authenticated the request
// Can utilize logonID
Status = DigestCreateChalResp(pDigest, &UserCreds, pOutputToken);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestGenerateParameters: Failed to create Output String status 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "DigestGenerateParameters: After DigestCalculation & copy struct\n"));
(void)DigestPrint(pDigest);
CleanUp:
UserCredentialsFree(&UserCreds);
UnicodeStringFree(&ustrTempPasswd);
DebugLog((DEB_TRACE_FUNC, "DigestGenerateParameters: Leaving\n"));
return(Status);
}
// Called by digest (inside LSA) with a buffer routed from a server to the DC running this code
// We need to strip out the header and extract the DIGEST_BLOB_REQUEST
//
// pcbMessageRequest will return the number of bytes allocated for response
// ppMessageResponse will contain the pointer to the allocated buffer
// calling routine must free the buffer (DigestFreeMemory) after it is done with it
NTSTATUS NTAPI
DigestPackagePassthrough(IN USHORT cbMessageRequest,
IN BYTE *pMessageRequest,
IN OUT ULONG *pulMessageResponse,
OUT PBYTE *ppMessageResponse)
{
NTSTATUS Status = STATUS_SUCCESS;
DebugLog((DEB_TRACE_FUNC, "DigestPackagePassthrough: Entering\n"));
if (!pMessageRequest || !ppMessageResponse || !pulMessageResponse ||
(cbMessageRequest < sizeof(DIGEST_BLOB_REQUEST)))
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "DigestPackagePassthrough: Bad input Paramters\n"));
goto CleanUp;
}
// Function will allocate space for Response - we need to free it after use
Status = DigestResponseBru(pMessageRequest, pulMessageResponse, ppMessageResponse);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestPackagePassthrough: Error with DigestVerifyResponseBru\n"));
goto CleanUp;
}
CleanUp:
DebugLog((DEB_TRACE_FUNC, "DigestPackagePassthrough: Leaving\n"));
return(Status);
}
// Routine receives the DigestBlob to process by extracting the password
// and verifying the response-value. If authenticated, the SessionKey can be returned
// to the server for future authentication
//
// This routine runs under LSA on the DC. It will do the actual Digest auth and return session keys
//
// pcbResponse is a pointer to a USHORT which holds amount of bytes in PResponse
// it also returns the number of bytes actually used
// The buffer will be allocated in this routine by DigestAllocateMemory and must be freed by DigestFreeMemory by
// calling routine
NTSTATUS NTAPI
DigestResponseBru(
IN BYTE *pDigestParamEncoded,
IN OUT ULONG *pulResponse,
OUT PBYTE *ppResponse)
{
NTSTATUS Status = STATUS_SUCCESS;
NTSTATUS StatusSub = STATUS_LOGON_FAILURE;
DIGEST_PARAMETER Digest;
PDIGEST_BLOB_RESPONSE pBlobResponse = NULL;
USER_CREDENTIALS UserCreds;
PUCHAR pucAuthData = NULL;
ULONG ulAuthDataSize = 0;
ULONG ulBuffer = 0;
BOOL fDigestValid = FALSE;
USHORT indx = 0;
DebugLog((DEB_TRACE_FUNC, "DigestResponseBru: Entering\n"));
ZeroMemory(&UserCreds, sizeof(USER_CREDENTIALS));
Status = DigestInit(&Digest);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestResponseBru: Failed to initialize digest struct\n"));
goto CleanUp;
}
Status = BlobDecodeRequest(pDigestParamEncoded, &Digest);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestResponseBru: Failed to copy over SessionKey 0x%x\n", Status));
goto CleanUp;
}
// Pull out the username and domain to process
Status = UserCredentialsExtract(&Digest, &UserCreds);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestResponseBru: Failed UserCredentialsExtract 0x%x\n", Status));
goto CleanUp;
}
// Extract Passwords (Cleartext and hash if available)
Status = DigestGetPasswd(&UserCreds, &pucAuthData, &ulAuthDataSize);
if (Status == STATUS_INVALID_SERVER_STATE)
{
DebugLog((DEB_WARN, "DigestResponseBru: Unable to get credentials - not on Domain Controller 0x%x\n"));
StatusSub = STATUS_LOGON_FAILURE;
}
else if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestResponseBru: Failed to find password for %wZ\n", &(UserCreds.ustrUsername)));
goto CleanUp;
}
DebugLog((DEB_TRACE, "DigestResponseBru: Got password for user %wZ, is valid %d; AuthData size %ld\n",
&(UserCreds.ustrUsername), UserCreds.fIsValidPasswd, ulAuthDataSize ));
DebugLog((DEB_TRACE, "DigestResponseBru: HashCred size is %d\n", UserCreds.strDigestHash.Length ));
// We now have passwd - either/both pre-computed hash or passwd
// Also, an authData blob to marshal back to server
// Now validate the Digest ChallengeResponse
// Check precalculated hashes first
fDigestValid = FALSE;
if (UserCreds.fIsValidDigestHash == TRUE)
{
// Need to cycle over the possible matching hashes based on username format
indx = 1; // skip the first hash this is the header
while ((fDigestValid == FALSE) && (indx < TOTALPRECALC_HEADERS))
{
if (UserCreds.sHashTags[indx])
{
DebugLog((DEB_TRACE, "DigestResponseBru: Checking Precalc hash 0x%x\n", indx));
UserCreds.wHashSelected = indx;
}
else
{
indx++; // skip to the next hash since incorrect format
continue;
}
StringFree(&Digest.strSessionKey); // clear out any previous session key info
StatusSub = DigestCalculation(&Digest, &UserCreds);
if (NT_SUCCESS(StatusSub))
{ // Precalculated hash matched!
DebugLog((DEB_TRACE, "DigestResponseBru: Digest valid with precalc hash 0x%x\n", indx));
fDigestValid = TRUE;
}
else if ((StatusSub == STATUS_WRONG_PASSWORD) || (StatusSub == SEC_E_NO_CREDENTIALS))
{ // Really we know only that the Hash did not compare - could be anything incorrect
// We do not provide information that the password was incorrect
DebugLog((DEB_TRACE, "DigestResponseBru: Digest did not match precalc hash 0x%x\n", indx));
indx++;
}
else
{
Status = StatusSub;
DebugLog((DEB_ERROR, "DigestResponseBru: Digest Verify Failed 0x%x\n", Status));
goto CleanUp;
}
}
if (fDigestValid == FALSE)
{
UserCreds.fIsValidDigestHash = FALSE; // no need to try to use any of these hashes again
}
}
// If ClearText passwd available, then try to validate the Digest ChallengeResponse
if ((fDigestValid == FALSE) && (UserCreds.fIsValidPasswd == TRUE))
{
StringFree(&Digest.strSessionKey); // clear out any previous session key info
StatusSub = DigestCalculation(&Digest, &UserCreds);
if (NT_SUCCESS(StatusSub))
{ // Really we know only that the Hash did not compare - could be anything incorrect
// We do not provide information that the password was incorrect
DebugLog((DEB_TRACE, "DigestResponseBru: Digest valid with cleartext password\n"));
fDigestValid = TRUE;
}
else if (StatusSub == STATUS_WRONG_PASSWORD)
{ // Really we know only that the Hash did not compare - could be anything incorrect
// We do not provide information that the password was incorrect
DebugLog((DEB_ERROR, "DigestResponseBru: Digest did not match cleartext passsword\n"));
}
else
{
Status = StatusSub;
DebugLog((DEB_ERROR, "DigestResponseBru: Digest Verify Failed 0x%x\n", Status));
goto CleanUp;
}
}
// We completed the Auth (it might have failed though)
// Make sure enough room in output buffer
ulBuffer = sizeof(DIGEST_BLOB_RESPONSE);
if (fDigestValid == TRUE)
{
// We succeeded in auth so send back AuthData for tokens
ulBuffer += ulAuthDataSize;
}
else
{
ulAuthDataSize = 0; // Do not send back Auth data unless Digest Calc Succeeded
}
DebugLog((DEB_TRACE, "DigestResponseBru: Total size for return buffer is %ld bytes\n", ulBuffer));
pBlobResponse = (PDIGEST_BLOB_RESPONSE)DigestAllocateMemory(ulBuffer);
if (!pBlobResponse)
{
Status = SEC_E_INSUFFICIENT_MEMORY;
DebugLog((DEB_ERROR, "DigestResponseBru: Can not allocate memory for Output Response Buffer\n"));
goto CleanUp;
}
pBlobResponse->MessageType = VERIFY_DIGEST_MESSAGE_RESPONSE;
pBlobResponse->version = DIGEST_BLOB_VERSION;
if (!NT_SUCCESS(StatusSub))
{
StatusSub = STATUS_LOGON_FAILURE; // Returns either Sucess or LogonFailure
}
pBlobResponse->Status = StatusSub; // Should be STATUS_SUCCESS or STATUS_LOGON_FAILURE
pBlobResponse->ulAuthDataSize = ulAuthDataSize;
// Could be an assert too
if (Digest.strSessionKey.Length != MD5_HASH_HEX_SIZE)
{
DebugLog((DEB_ERROR, "DigestResponseBru: Failed SessionKey generation\n"));
Status = STATUS_INTERNAL_ERROR; // Program flow failure
goto CleanUp;
}
pBlobResponse->SessionKeyMaxLength = MD5_HASH_HEX_SIZE + 1; // MD5 hash + NULL
memcpy(pBlobResponse->SessionKey, Digest.strSessionKey.Buffer, MD5_HASH_HEX_SIZE);
if (ulAuthDataSize)
{ // Copy over the AuthData only if DigestCalc succeeded (i.e. ulAuthDataSize != 0)
memcpy(&(pBlobResponse->cAuthData), pucAuthData, ulAuthDataSize);
}
// OK we are done filling in output Response buffer - we can leave now!
*pulResponse = ulBuffer; // Set the size of the response blob
*ppResponse = (PBYTE)pBlobResponse; // set the buffer allocated
CleanUp:
DigestFree(&Digest);
UserCredentialsFree(&UserCreds);
// Cleanup any allocated heap from GetUserAuthData
if (pucAuthData)
{
g_LsaFunctions->FreeLsaHeap(pucAuthData);
pucAuthData = NULL;
ulAuthDataSize = 0;
}
if (!NT_SUCCESS(Status))
{
// We had an error - free allocated memory
*pulResponse = 0;
if (pBlobResponse)
{
DigestFreeMemory(pBlobResponse);
pBlobResponse = NULL;
*ppResponse = NULL; // No output buffer provided
}
}
DebugLog((DEB_TRACE_FUNC, "DigestResponseBru: Leaving\n"));
return(Status);
}
NTSTATUS
DigestPrint(PDIGEST_PARAMETER pDigest)
{
NTSTATUS Status = STATUS_SUCCESS;
int i = 0;
if (!pDigest)
{
return (STATUS_INVALID_PARAMETER);
}
if (pDigest->typeDigest == DIGEST_UNDEFINED)
{
DebugLog((DEB_TRACE, "Digest: DIGEST_UNDEFINED\n"));
}
if (pDigest->typeDigest == NO_DIGEST_SPECIFIED)
{
DebugLog((DEB_ERROR, "Digest: NO_DIGEST_SPECIFIED\n"));
}
if (pDigest->typeDigest == DIGEST_CLIENT)
{
DebugLog((DEB_TRACE, "Digest: DIGEST_CLIENT\n"));
}
if (pDigest->typeDigest == DIGEST_SERVER)
{
DebugLog((DEB_TRACE, "Digest: DIGEST_SERVER\n"));
}
if (pDigest->typeDigest == SASL_SERVER)
{
DebugLog((DEB_TRACE, "Digest: SASL_SERVER\n"));
}
if (pDigest->typeDigest == SASL_CLIENT)
{
DebugLog((DEB_TRACE, "Digest: SASL_CLIENT\n"));
}
if (pDigest->typeQOP == QOP_UNDEFINED)
{
DebugLog((DEB_ERROR, "Digest: QOP: Not QOP_UNDEFINED\n"));
}
if (pDigest->typeQOP == NO_QOP_SPECIFIED)
{
DebugLog((DEB_TRACE, "Digest: QOP: Not Specified\n"));
}
if (pDigest->typeQOP == AUTH)
{
DebugLog((DEB_TRACE, "Digest: QOP: AUTH\n"));
}
if (pDigest->typeQOP == AUTH_INT)
{
DebugLog((DEB_TRACE, "Digest: QOP: AUTH_INT\n"));
}
if (pDigest->typeQOP == AUTH_CONF)
{
DebugLog((DEB_TRACE, "Digest: QOP: AUTH_CONF\n"));
}
if (pDigest->typeAlgorithm == ALGORITHM_UNDEFINED)
{
DebugLog((DEB_ERROR, "Digest: Algorithm: ALGORITHM_UNDEFINED\n"));
}
if (pDigest->typeAlgorithm == NO_ALGORITHM_SPECIFIED)
{
DebugLog((DEB_TRACE, "Digest: Algorithm: NO_ALGORITHM_SPECIFIED\n"));
}
if (pDigest->typeAlgorithm == MD5)
{
DebugLog((DEB_TRACE, "Digest: Algorithm: MD5\n"));
}
if (pDigest->typeAlgorithm == MD5_SESS)
{
DebugLog((DEB_TRACE, "Digest: Algorithm: MD5_SESS\n"));
}
if (pDigest->typeCharset == ISO_8859_1)
{
DebugLog((DEB_TRACE, "Digest: CharSet: ISO-8859-1\n"));
}
if (pDigest->typeCharset == UTF_8)
{
DebugLog((DEB_TRACE, "Digest: CharSet: UTF-8\n"));
}
for (i=0; i < MD5_AUTH_LAST;i++)
{
if (pDigest->refstrParam[i].Buffer &&
pDigest->refstrParam[i].Length)
{
DebugLog((DEB_TRACE, "Digest: Digest[%d] = \"%Z\"\n", i, &pDigest->refstrParam[i]));
}
}
DebugLog((DEB_TRACE, "Digest: SessionKey %Z\n", &(pDigest->strSessionKey)));
DebugLog((DEB_TRACE, "Digest: Response %Z\n", &(pDigest->strResponse)));
DebugLog((DEB_TRACE, "Digest: Username %wZ\n", &(pDigest->ustrUsername)));
DebugLog((DEB_TRACE, "Digest: Realm %wZ\n", &(pDigest->ustrRealm)));
DebugLog((DEB_TRACE, "Digest: URI %wZ\n", &(pDigest->ustrUri)));
DebugLog((DEB_TRACE, "Digest: CrackedAccountName %wZ\n", &(pDigest->ustrCrackedAccountName)));
DebugLog((DEB_TRACE, "Digest: CrackedDomain %wZ\n", &(pDigest->ustrCrackedDomain)));
return(Status);
}
NTSTATUS
ContextPrint(PDIGEST_CONTEXT pContext)
{
NTSTATUS Status = STATUS_SUCCESS;
int i = 0;
if (!pContext)
{
return (STATUS_INVALID_PARAMETER);
}
if (pContext->typeDigest == DIGEST_UNDEFINED)
{
DebugLog((DEB_TRACE, "Context: DIGEST_UNDEFINED\n"));
}
if (pContext->typeDigest == NO_DIGEST_SPECIFIED)
{
DebugLog((DEB_ERROR, "Context: NO_DIGEST_SPECIFIED\n"));
}
if (pContext->typeDigest == DIGEST_CLIENT)
{
DebugLog((DEB_TRACE, "Context: DIGEST_CLIENT\n"));
}
if (pContext->typeDigest == DIGEST_SERVER)
{
DebugLog((DEB_TRACE, "Context: DIGEST_SERVER\n"));
}
if (pContext->typeDigest == SASL_SERVER)
{
DebugLog((DEB_TRACE, "Context: SASL_SERVER\n"));
}
if (pContext->typeDigest == SASL_CLIENT)
{
DebugLog((DEB_TRACE, "Context: SASL_CLIENT\n"));
}
if (pContext->typeQOP == QOP_UNDEFINED)
{
DebugLog((DEB_ERROR, "Context: QOP: QOP_UNDEFINED\n"));
}
if (pContext->typeQOP == NO_QOP_SPECIFIED)
{
DebugLog((DEB_TRACE, "Context: QOP: NO_QOP_SPECIFIED\n"));
}
if (pContext->typeQOP == AUTH)
{
DebugLog((DEB_TRACE, "Context: QOP: AUTH\n"));
}
if (pContext->typeQOP == AUTH_INT)
{
DebugLog((DEB_TRACE, "Context: QOP: AUTH_INT\n"));
}
if (pContext->typeQOP == AUTH_CONF)
{
DebugLog((DEB_TRACE, "Context: QOP: AUTH_CONF\n"));
}
if (pContext->typeAlgorithm == ALGORITHM_UNDEFINED)
{
DebugLog((DEB_ERROR, "Context: Algorithm: ALGORITHM_UNDEFINED\n"));
}
if (pContext->typeAlgorithm == NO_ALGORITHM_SPECIFIED)
{
DebugLog((DEB_TRACE, "Context: Algorithm: NO_ALGORITHM_SPECIFIED\n"));
}
if (pContext->typeAlgorithm == MD5)
{
DebugLog((DEB_TRACE, "Context: Algorithm: MD5\n"));
}
if (pContext->typeAlgorithm == MD5_SESS)
{
DebugLog((DEB_TRACE, "Context: Algorithm: MD5_SESS\n"));
}
if (pContext->typeCipher == CIPHER_RC4)
{
DebugLog((DEB_TRACE, "Context: Cipher: RC4\n"));
}
if (pContext->typeCipher == CIPHER_RC4_40)
{
DebugLog((DEB_TRACE, "Context: Cipher: RC4_40\n"));
}
if (pContext->typeCipher == CIPHER_RC4_56)
{
DebugLog((DEB_TRACE, "Context: Cipher: RC4_56\n"));
}
if (pContext->typeCipher == CIPHER_3DES)
{
DebugLog((DEB_TRACE, "Context: Cipher: 3DES\n"));
}
if (pContext->typeCipher == CIPHER_DES)
{
DebugLog((DEB_TRACE, "Context: Cipher: DES\n"));
}
if (pContext->typeCharset == ISO_8859_1)
{
DebugLog((DEB_TRACE, "Context: Charset: ISO-8859-1\n"));
}
if (pContext->typeCharset == UTF_8)
{
DebugLog((DEB_TRACE, "Context: Charset: UTF-8\n"));
}
DebugLog((DEB_TRACE, "Context: NC %d\n", pContext->ulNC));
DebugLog((DEB_TRACE, "Context: LogonId (%x:%lx)\n", pContext->LoginID.HighPart, pContext->LoginID.LowPart ));
DebugLog((DEB_TRACE, "Context: strNonce %Z\n", &(pContext->strNonce)));
DebugLog((DEB_TRACE, "Context: strCNonce %Z\n", &(pContext->strCNonce)));
DebugLog((DEB_TRACE, "Context: strOpaque %Z\n", &(pContext->strOpaque)));
DebugLog((DEB_TRACE, "Context: strSessionKey %Z\n", &(pContext->strSessionKey)));
DebugLog((DEB_TRACE, "Context: ustrDomain %wZ\n", &(pContext->ustrDomain)));
DebugLog((DEB_TRACE, "Context: ustrAccountName %wZ\n", &(pContext->ustrAccountName)));
DebugLog((DEB_TRACE, "Context: SendMaxBuf %lu\n", &(pContext->ulSendMaxBuf)));
return(Status);
}
// Extracts the username and domain from the digest directives
// Need to process the character set to properly decode the directive values
// The major character sets are UTF-8 and ISO-8859-1
// The forms that may be present in the directive values are:
// Username Realm
// 1. username domain
// 2. domain/username domainForestName
// 3. UPN domainForestName
NTSTATUS UserCredentialsExtract(PDIGEST_PARAMETER pDigest,
PUSER_CREDENTIALS pUserCreds)
{
NTSTATUS Status = STATUS_SUCCESS;
int iRC = 0;
DebugLog((DEB_TRACE_FUNC, "UserCredentialsExtract: Entering\n"));
if (!pDigest || !(pDigest->refstrParam[MD5_AUTH_USERNAME].Length))
{
Status = STATUS_NO_SUCH_USER;
DebugLog((DEB_ERROR, "UserCredentialsExtract: Invalid Username or realm\n"));
goto CleanUp;
}
Status = DigestDecodeDirectiveStrings(pDigest);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "UserCredentialsExtract: DigestDecodeDirectiveStrings error 0x%x\n", Status));
goto CleanUp;
}
// parse out the username & domain
pUserCreds->typeName = pDigest->typeName; // Indicate which type of name format utilized
Status = UnicodeStringDuplicate(&(pUserCreds->ustrUsername), &(pDigest->ustrCrackedAccountName));
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "UserCredentialsExtract: UnicodeStringDuplicate Username error 0x%x\n", Status));
goto CleanUp;
}
Status = UnicodeStringDuplicate(&(pUserCreds->ustrDomain), &(pDigest->ustrCrackedDomain));
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "UserCredentialsExtract: UnicodeStringDuplicate Domain error 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "UserCredentialsExtract: Hash index %d Account %wZ Domain %wZ\n",
pUserCreds->wHashSelected,
&(pUserCreds->ustrUsername),
&(pUserCreds->ustrDomain)));
DebugLog((DEB_TRACE_FUNC, "UserCredentialsExtract: Leaving Status 0x%x\n", Status));
CleanUp:
return(Status);
}
// Release memory allocated into UserCredentials
NTSTATUS UserCredentialsFree(PUSER_CREDENTIALS pUserCreds)
{
NTSTATUS Status = STATUS_SUCCESS;
UnicodeStringFree(&(pUserCreds->ustrUsername));
if (pUserCreds->ustrPasswd.MaximumLength)
{
ZeroMemory(pUserCreds->ustrPasswd.Buffer, pUserCreds->ustrPasswd.MaximumLength);
}
UnicodeStringFree(&(pUserCreds->ustrPasswd));
UnicodeStringFree(&(pUserCreds->ustrDomain));
if (pUserCreds->strDigestHash.MaximumLength)
{
ZeroMemory(pUserCreds->strDigestHash.Buffer, pUserCreds->strDigestHash.MaximumLength);
}
StringFree(&(pUserCreds->strDigestHash));
return(Status);
}
//+--------------------------------------------------------------------
//
// Function: DigestSASLResponseAuth
//
// Synopsis: Generate the ResponseAuth from the server
//
// Arguments: pDigest - pointer to Digest parameter struct
// pCoutputToken - location to send output string to
//
// Returns: NTSTATUS
//
// Notes:
//
//---------------------------------------------------------------------
NTSTATUS DigestSASLResponseAuth(
IN PDIGEST_PARAMETER pDigest,
OUT PSecBuffer pOutputToken)
{
NTSTATUS Status = STATUS_SUCCESS;
ULONG cbLenNeeded = 0;
STRING strReqAuth;
PCHAR pczTemp = NULL;
ZeroMemory(&strReqAuth, sizeof(strReqAuth));
ASSERT(pDigest);
DebugLog((DEB_TRACE_FUNC, "DigestSASLResponseAuth: Entering\n"));
Status = DigestCalculateResponseAuth(pDigest, &strReqAuth);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestSASLResponseAuth: Request Auth failed : 0x%x\n", Status));
goto CleanUp;
}
cbLenNeeded = sizeof(RSPAUTH_STR);
cbLenNeeded += strReqAuth.Length;
// allocate the buffers for output - in the future can optimze to allocate exact amount needed
pczTemp = (PCHAR)DigestAllocateMemory(cbLenNeeded + 1);
if (!pczTemp)
{
DebugLog((DEB_ERROR, "ContextCreateChal: No memory for output buffers\n"));
goto CleanUp;
}
sprintf(pczTemp, RSPAUTH_STR, &strReqAuth);
pOutputToken->cbBuffer = strlen(pczTemp);
pOutputToken->pvBuffer = pczTemp;
CleanUp:
DebugLog((DEB_TRACE_FUNC, "DigestSASLResponseAuth: Leaving 0x%x\n", Status));
StringFree(&strReqAuth);
return Status;
}
//+--------------------------------------------------------------------
//
// Function: DigestCalculateResponseAuth
//
// Synopsis: Calculate the ResponseAuth Hash value
//
// Arguments: pDigest - pointer to Digest parameter struct
// pCoutputToken - location to send output string to
//
// Returns: NTSTATUS
//
// Notes:
//
//---------------------------------------------------------------------
NTSTATUS DigestCalculateResponseAuth(
IN PDIGEST_PARAMETER pDigest,
OUT PSTRING pstrHash)
{
NTSTATUS Status = STATUS_SUCCESS;
ULONG cbLenNeeded = 0;
STRING strHA2;
STRING strcQOP;
PCHAR pczTemp = NULL;
ZeroMemory(&strHA2, sizeof(strHA2));
ASSERT(pDigest);
ASSERT(pstrHash);
DebugLog((DEB_TRACE_FUNC, "DigestCalculateResponseAuth: Entering\n"));
DigestPrint(pDigest);
StringFree(pstrHash);
// Establish which QOP utilized
if (pDigest->typeQOP == AUTH_CONF)
{
RtlInitString(&strcQOP, AUTHCONFSTR);
}
else if (pDigest->typeQOP == AUTH_INT)
{
RtlInitString(&strcQOP, AUTHINTSTR);
}
else if (pDigest->typeQOP == AUTH)
{
RtlInitString(&strcQOP, AUTHSTR);
}
else
{
RtlInitString(&strcQOP, NULL);
}
// Calculate H(A2)
// For QOP unspecified or "auth" H(A2) = H( : URI)
// For QOP Auth-int or Auth-conf H(A2) = H( : URI: H(entity-body))
if ((pDigest->typeQOP == AUTH) || (pDigest->typeQOP == NO_QOP_SPECIFIED))
{
// Unspecified or Auth
DebugLog((DEB_TRACE, "DigestCalculateResponseAuth: H(A2) using AUTH/Unspecified\n"));
Status = DigestHash7(NULL,
&(pDigest->refstrParam[MD5_AUTH_URI]),
NULL, NULL, NULL, NULL, NULL,
TRUE, &strHA2);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestCalculateResponseAuthDigestCalculateResponseAuth: H(A2) failed : 0x%x\n", Status));
goto CleanUp;
}
}
else
{
// Auth-int or Auth-conf
DebugLog((DEB_TRACE, "DigestCalculateResponseAuth: H(A2) using AUTH-INT/CONF\n"));
Status = DigestHash7(NULL,
&(pDigest->refstrParam[MD5_AUTH_URI]),
&(pDigest->refstrParam[MD5_AUTH_HENTITY]),
NULL, NULL, NULL, NULL,
TRUE, &strHA2);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestCalculateResponseAuth H(A2) auth-int failed : 0x%x\n", Status));
goto CleanUp;
}
}
// We now have calculated H(A2)
// Calculate Request-Digest
// For QOP of Auth, Auth-int, Auth-conf Req-Digest = H( H(A1): nonce: nc: cnonce: qop: H(A2))
Status = DigestHash7(&(pDigest->strSessionKey),
&(pDigest->refstrParam[MD5_AUTH_NONCE]),
&(pDigest->refstrParam[MD5_AUTH_NC]),
&(pDigest->refstrParam[MD5_AUTH_CNONCE]),
&strcQOP,
&strHA2, NULL,
TRUE, pstrHash);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR, "DigestCalculateResponseAuth: Request Auth failed : 0x%x\n", Status));
goto CleanUp;
}
DebugLog((DEB_TRACE, "DigestCalculateResponseAuth: ResponseAuth is %Z\n", pstrHash));
CleanUp:
DebugLog((DEB_TRACE_FUNC, "DigestCalculateResponseAuth: Leaving 0x%x\n", Status));
StringFree(&strHA2);
return Status;
}
//+--------------------------------------------------------------------
//
// Function: DigestDecodeUserAccount
//
// Synopsis: Process the Digest to extract Account Username, Account Domain
// generic passthrough domain controller, and index for precalculated digest hash
//
// Arguments: pDigest - pointer to Digest parameter struct
// pustrUsername - username extracted from digest
// pusrtUserDomain - domain indicated for account
// pustrDC - domain to pass generic passthrough to
// pPreCalcIndx - index to use for precalculated index
//
// Returns: NTSTATUS
//
// Notes:
//
//---------------------------------------------------------------------
NTSTATUS DigestDecodeUserAccount(
IN PDIGEST_PARAMETER pDigest,
OUT PUNICODE_STRING pustrDC)
{
NTSTATUS Status = STATUS_SUCCESS;
NAMEFORMAT_TYPE Indx = NAMEFORMAT_UNKNOWN;
USHORT usTemp = 0;
DWORD DsStatus = 0;
HANDLE hDS = NULL;
WCHAR wczName[UNLEN+1];
PWCHAR pwczAcct = NULL;
WCHAR wczCrackedDnsDomain[DNS_MAX_NAME_LENGTH + 1 + 1]; // ensured a NULL terminator
DWORD dwCrackedDnsDomainCnt = (DNS_MAX_NAME_LENGTH+1) * sizeof(WCHAR);
WCHAR wczCrackedName[UNLEN+DNS_MAX_NAME_LENGTH + 2 + 1];
DWORD dwCrackedNameCnt = ((UNLEN+DNS_MAX_NAME_LENGTH + 2) * sizeof(WCHAR));
DWORD dwCrackError = 0;
DebugLog((DEB_TRACE_FUNC, "DigestDecodeUserAccount: Entering\n"));
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: Checking format on username %wZ\n", &pDigest->ustrUsername));
if (pDigest->ustrUsername.Length / sizeof(WCHAR) > UNLEN)
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: Username too long 0x%x\n", Status));
goto CleanUp;
}
// Now copy string and NULL terminate
ZeroMemory(wczName, sizeof(wczName));
ZeroMemory(wczCrackedDnsDomain, sizeof(wczCrackedDnsDomain));
ZeroMemory(wczCrackedName, sizeof(wczCrackedName));
memcpy(wczName, pDigest->ustrUsername.Buffer, pDigest->ustrUsername.Length);
// 1. If provided username and realm (assumed to be domain) use that
if ((pDigest->ustrRealm.Length) && (pDigest->ustrUsername.Length))
{
Indx = NAMEFORMAT_ACCOUNTNAME;
if (pustrDC)
{
UnicodeStringFree(pustrDC);
UnicodeStringDuplicate(pustrDC, &(pDigest->ustrRealm));
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: GenericPassthrough DC %wZ\n",
pustrDC));
}
Status = UnicodeStringDuplicate(&(pDigest->ustrCrackedAccountName), &pDigest->ustrUsername);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Username error 0x%x\n", Status));
goto CleanUp;
}
Status = UnicodeStringDuplicate(&(pDigest->ustrCrackedDomain), &(pDigest->ustrRealm));
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Domain error 0x%x\n", Status));
goto CleanUp;
}
pDigest->typeName = Indx;
Status = STATUS_SUCCESS;
goto CleanUp;
}
/*
// 2. Check for UPN
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: Checking with CrackSingleName\n"));
Status = CrackSingleName(DS_USER_PRINCIPAL_NAME,
DS_NAME_NO_FLAGS,
wczName,
DS_NT4_ACCOUNT_NAME,
&dwCrackedDnsDomainCnt,
wczCrackedDnsDomain,
&dwCrackedNameCnt,
wczCrackedName,
&dwCrackError);
if (NT_SUCCESS(Status) && (DS_NAME_NO_ERROR == dwCrackError))
{
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName DS_USER_PRINCIPAL_NAME Succeeded\n"));
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName dwErr 0x%x CrackName %S CrackDomain %S\n",
dwCrackError,
wczCrackedName,
wczCrackedDnsDomain));
Indx = NAMEFORMAT_UPN;
// Output name format always will be domain+'\'+account+'\0'
// Need account location
pwczAcct = wcschr(wczCrackedName, L'\\');
if (!pwczAcct)
{
Status = STATUS_INVALID_ADDRESS;
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: Can not locate Account name 0x%x\n", Status));
goto CleanUp;
}
Status = UnicodeStringWCharDuplicate(&(pDigest->ustrCrackedAccountName), pwczAcct+1);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Username error 0x%x\n", Status));
goto CleanUp;
}
Status = UnicodeStringWCharDuplicate(&(pDigest->ustrCrackedDomain), wczCrackedDnsDomain);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Domain error 0x%x\n", Status));
goto CleanUp;
}
if (pustrDC)
{
UnicodeStringFree(pustrDC);
UnicodeStringDuplicate(pustrDC, &(pDigest->ustrCrackedDomain));
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: GenericPassthrough DC %wZ\n",
pustrDC));
}
pDigest->typeName = Indx;
Status = STATUS_SUCCESS;
goto CleanUp;
}
else
{
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName DS_USER_PRINCIPAL_NAME Failed 0x%x CrackErr 0x%x\n",
Status,
dwCrackError));
}
// 2. Check for NetBIOS
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: Checking with CrackSingleName\n"));
Status = CrackSingleName(DS_NT4_ACCOUNT_NAME,
DS_NAME_NO_FLAGS,
wczName,
DS_NT4_ACCOUNT_NAME,
&dwCrackedDnsDomainCnt,
wczCrackedDnsDomain,
&dwCrackedNameCnt,
wczCrackedName,
&dwCrackError);
if (NT_SUCCESS(Status) && (DS_NAME_NO_ERROR == dwCrackError))
{
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName DS_NT4_ACCOUNT_NAME Succeeded\n"));
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName dwErr 0x%x CrackName %S CrackDomain %S\n",
dwCrackError,
wczCrackedName,
wczCrackedDnsDomain));
Indx = NAMEFORMAT_NETBIOS;
// Output name format always will be domain+'\'+account+'\0'
// Need account location
pwczAcct = wcschr(wczCrackedName, L'\\');
if (!pwczAcct)
{
Status = STATUS_INVALID_ADDRESS;
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: Can not locate Account name 0x%x\n", Status));
goto CleanUp;
}
Status = UnicodeStringWCharDuplicate(&(pDigest->ustrCrackedAccountName), pwczAcct+1);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Username error 0x%x\n", Status));
goto CleanUp;
}
Status = UnicodeStringWCharDuplicate(&(pDigest->ustrCrackedDomain), wczCrackedDnsDomain);
if (!NT_SUCCESS (Status))
{
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: UnicodeStringDuplicate Domain error 0x%x\n", Status));
goto CleanUp;
}
if (pustrDC)
{
UnicodeStringFree(pustrDC);
UnicodeStringDuplicate(pustrDC, &(pDigest->ustrCrackedDomain));
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: GenericPassthrough DC %wZ\n",
pustrDC));
}
pDigest->typeName = Indx;
goto CleanUp;
}
else
{
DebugLog((DEB_TRACE, "DigestDecodeUserAccount: CrackSingleName DS_USER_PRINCIPAL_NAME Failed 0x%x\n", Status));
}
*/
// default to username
if (Indx == NAMEFORMAT_UNKNOWN)
{
Status = STATUS_INVALID_ADDRESS;
DebugLog((DEB_ERROR, "DigestDecodeUserAccount: Invalid format for username and realm\n", Status));
}
CleanUp:
DebugLog((DEB_TRACE_FUNC, "DigestDecodeUserAccount: Leaving 0x%x\n", Status));
return Status;
}