able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/ds/security/protocols/digest/lsaap.cxx

623 lines
18 KiB
C++
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
//+--------------------------------------------------------------------
//
// Microsoft Windows
//
// Copyright (c) Microsoft Corporation 2000
//
// File: lsaap.cxx
//
// Contents: Authentication package dispatch routines
// LsaApInitializePackage (Not needed done in SpInitialize)
// LsaApLogonUser2
// LsaApCallPackage
// LsaApCallPackagePassthrough
// LsaApLogonTerminated
//
// Helper functions:
//
// History: KDamour 10Mar00 Stolen from msv_sspi\msv1_0.c
//
//---------------------------------------------------------------------
#include "global.h"
#include <samisrv.h>
#define SAM_CLEARTEXT_CREDENTIAL_NAME L"CLEARTEXT"
#define SAM_WDIGEST_CREDENTIAL_NAME WDIGEST_SP_NAME // Name of the Supplemental (primary) cred blob for MD5 hashes
/*++
Routine Description:
This routine is the dispatch routine for
LsaCallAuthenticationPackage().
--*/
NTSTATUS
LsaApCallPackage (
IN PLSA_CLIENT_REQUEST ClientRequest,
IN PVOID ProtocolSubmitBuffer,
IN PVOID ClientBufferBase,
IN ULONG SubmitBufferLength,
OUT PVOID *ProtocolReturnBuffer,
OUT PULONG ReturnBufferLength,
OUT PNTSTATUS ProtocolStatus
)
{
ULONG MessageType;
DebugLog((DEB_TRACE_FUNC, "LsaApCallPackage: Entering/Leaving \n"));
return(SEC_E_UNSUPPORTED_FUNCTION);
}
/*++
Routine Description:
This routine is the dispatch routine for
LsaCallAuthenticationPackage() for untrusted clients.
--*/
NTSTATUS
LsaApCallPackageUntrusted (
IN PLSA_CLIENT_REQUEST ClientRequest,
IN PVOID ProtocolSubmitBuffer,
IN PVOID ClientBufferBase,
IN ULONG SubmitBufferLength,
OUT PVOID *ProtocolReturnBuffer,
OUT PULONG ReturnBufferLength,
OUT PNTSTATUS ProtocolStatus
)
{
ULONG MessageType;
DebugLog((DEB_TRACE_FUNC, "LsaApCallPackageUntrusted: Entering/Leaving \n"));
return(SEC_E_UNSUPPORTED_FUNCTION);
}
/*++
Routine Description:
This routine is the dispatch routine for
LsaCallAuthenticationPackage() for passthrough logon requests.
When the passthrough is called (from AcceptSecurityCOntext)
a databuffer is sent to the DC and this function is called.
Arguments:
ClientRequest - Is a pointer to an opaque data structure
representing the client's request.
ProtocolSubmitBuffer - Supplies a protocol message specific to
the authentication package.
ClientBufferBase - Provides the address within the client
process at which the protocol message was resident.
This may be necessary to fix-up any pointers within the
protocol message buffer.
SubmitBufferLength - Indicates the length of the submitted
protocol message buffer.
ProtocolReturnBuffer - Is used to return the address of the
protocol buffer in the client process. The authentication
package is responsible for allocating and returning the
protocol buffer within the client process. This buffer is
expected to have been allocated with the
AllocateClientBuffer() service.
The format and semantics of this buffer are specific to the
authentication package.
ReturnBufferLength - Receives the length (in bytes) of the
returned protocol buffer.
ProtocolStatus - Assuming the services completion is
STATUS_SUCCESS, this parameter will receive completion status
returned by the specified authentication package. The list
of status values that may be returned are authentication
package specific.
Return Status:
STATUS_SUCCESS - The call was made to the authentication package.
The ProtocolStatus parameter must be checked to see what the
completion status from the authentication package is.
STATUS_QUOTA_EXCEEDED - This error indicates that the return
buffer could not could not be allocated because the client
does not have sufficient quota.
--*/
NTSTATUS
LsaApCallPackagePassthrough (
IN PLSA_CLIENT_REQUEST ClientRequest,
IN PVOID ProtocolSubmitBuffer,
IN PVOID ClientBufferBase,
IN ULONG SubmitBufferLength,
OUT PVOID *ProtocolReturnBuffer,
OUT PULONG ReturnBufferLength,
OUT PNTSTATUS ProtocolStatus
)
{
NTSTATUS Status = STATUS_SUCCESS;
NTSTATUS StatusProtocol = STATUS_SUCCESS;
PDIGEST_BLOB_REQUEST pDigestBlob = NULL;
ULONG MessageType = 0;
USHORT i = 0;
ULONG ulReturnBuffer = 0;
BYTE *pReturnBuffer = NULL;
DebugLog((DEB_TRACE_FUNC, "LsaApCallPackagePassthrough: Entering \n"));
//
// Get the messsage type from the protocol submit buffer.
//
if ( SubmitBufferLength < sizeof(ULONG) ) {
DebugLog((DEB_ERROR, "FAILED message size to contain MessageType\n"));
return STATUS_INVALID_PARAMETER;
}
memcpy((char *)&MessageType, (char *)ProtocolSubmitBuffer, sizeof(MessageType));
if ( MessageType != VERIFY_DIGEST_MESSAGE)
{
DebugLog((DEB_ERROR, "FAILED to have correct message type\n"));
return STATUS_ACCESS_DENIED;
}
//
// Allow the DigestCalc routine to only set the return buffer information
// on success conditions.
//
DebugLog((DEB_TRACE, "LsaApCallPackagePassthrough: setting return buffers to NULL\n"));
*ProtocolReturnBuffer = NULL;
*ReturnBufferLength = 0;
// We will need to free any memory allocated in the Returnbuffer
StatusProtocol = DigestPackagePassthrough((USHORT)SubmitBufferLength, (BYTE *)ProtocolSubmitBuffer,
&ulReturnBuffer, &pReturnBuffer);
if (!NT_SUCCESS(StatusProtocol))
{
DebugLog((DEB_ERROR,"LsaApCallPackagePassthrough: DigestPackagePassthrough failed 0x%x\n",Status));
ulReturnBuffer = 0;
goto CleanUp;
}
// DebugLog((DEB_TRACE, "LsaApCallPackagePassthrough: setting return auth status to STATUS_SUCCEED\n"));
// DebugLog((DEB_TRACE, "LsaApCallPackagePassthrough: Total Return Buffer size %ld bytes\n", ulReturnBuffer));
// Now place the data back to the client (the server calling this)
Status = g_LsaFunctions->AllocateClientBuffer(
NULL,
ulReturnBuffer,
ProtocolReturnBuffer
);
if (!NT_SUCCESS(Status))
{
goto CleanUp;
}
Status = g_LsaFunctions->CopyToClientBuffer(
NULL,
ulReturnBuffer,
*ProtocolReturnBuffer,
pReturnBuffer
);
if (!NT_SUCCESS(Status))
{ // Failed to copy over the data to the client
g_LsaFunctions->FreeClientBuffer(
NULL,
*ProtocolReturnBuffer
);
*ProtocolReturnBuffer = NULL;
}
else
{
*ReturnBufferLength = ulReturnBuffer;
}
CleanUp:
*ProtocolStatus = StatusProtocol;
if (pReturnBuffer)
{
DigestFreeMemory(pReturnBuffer);
pReturnBuffer = NULL;
ulReturnBuffer = 0;
}
DebugLog((DEB_TRACE_FUNC, "LsaApCallPackagePassthrough: Leaving Status 0x%x\n", Status));
return(Status);
}
/*++
Routine Description:
This routine is used to authenticate a user logon attempt. This is
the user's initial logon. A new LSA logon session will be established
for the user and validation information for the user will be returned.
--*/
NTSTATUS
LsaApLogonUserEx2 (
IN PLSA_CLIENT_REQUEST ClientRequest,
IN SECURITY_LOGON_TYPE LogonType,
IN PVOID ProtocolSubmitBuffer,
IN PVOID ClientBufferBase,
IN ULONG SubmitBufferSize,
OUT PVOID *ProfileBuffer,
OUT PULONG ProfileBufferSize,
OUT PLUID LogonId,
OUT PNTSTATUS SubStatus,
OUT PLSA_TOKEN_INFORMATION_TYPE TokenInformationType,
OUT PVOID *TokenInformation,
OUT PUNICODE_STRING *AccountName,
OUT PUNICODE_STRING *AuthenticatingAuthority,
OUT PUNICODE_STRING *MachineName,
OUT PSECPKG_PRIMARY_CRED PrimaryCredentials,
OUT PSECPKG_SUPPLEMENTAL_CRED_ARRAY * SupplementalCredentials
)
{
NTSTATUS Status = STATUS_SUCCESS;
DebugLog((DEB_TRACE_FUNC, "LsaApLogonUserEx2: Entering/Leaving \n"));
//
// Return status to the caller
//
return (SEC_E_UNSUPPORTED_FUNCTION);
}
/*++
Routine Description:
This routine is used to notify each authentication package when a logon
session terminates. A logon session terminates when the last token
referencing the logon session is deleted.
Arguments:
LogonId - Is the logon ID that just logged off.
Return Status:
None.
--*/
VOID
LsaApLogonTerminated (
IN PLUID pLogonId
)
{
NTSTATUS Status = STATUS_SUCCESS;
PDIGEST_LOGONSESSION pLogonSession = NULL;
LONG lReferences = 0;
DebugLog((DEB_TRACE_FUNC, "LsaApLogonTerminated: Entering LogonID (%x:%lx) \n",
pLogonId->HighPart, pLogonId->LowPart));
//
// Find the entry, dereference, and de-link it from the active logon table.
//
Status = LogSessHandlerLogonIdToPtr(pLogonId, TRUE, &pLogonSession);
if (!NT_SUCCESS(Status))
{
goto CleanUp; // No LongonID found in Active list - simply exit quietly
}
DebugLog((DEB_TRACE, "LsaApLogonTerminated: Found LogonID (%x:%lx) \n",
pLogonId->HighPart, pLogonId->LowPart));
// This relies on the LSA terminating all of the credentials before killing off
// the LogonSession.
lReferences = InterlockedDecrement(&pLogonSession->lReferences);
DebugLog((DEB_TRACE, "LsaApLogonTerminated: Refcount %ld \n", lReferences));
ASSERT( lReferences >= 0 );
if (lReferences)
{
DebugLog((DEB_WARN, "LsaApLogonTerminated: WARNING Terminate LogonID (%x:%lx) non-zero RefCount!\n",
pLogonId->HighPart, pLogonId->LowPart));
}
else
{
DebugLog((DEB_TRACE, "LsaApLogonTerminated: Removed LogonID (%x:%lx) from Active List! \n",
pLogonId->HighPart, pLogonId->LowPart));
LogonSessionFree(pLogonSession);
}
CleanUp:
DebugLog((DEB_TRACE_FUNC, "LsaApLogonTerminated: Exiting LogonID (%x:%lx) \n",
pLogonId->HighPart, pLogonId->LowPart));
return;
}
// Routine to acquire the plaintext password for a given user
// If supplemental credentials exist that contain the Digest Hash values
// then return them also.
// This routine runs on the domain controller
// Must provide STRING strPasswd
// If ppucUserAuthData pointer is NULL - do not retrieve UserAuthData
NTSTATUS
DigestGetPasswd(
IN PUSER_CREDENTIALS pUserCreds,
OUT PUCHAR * ppucUserAuthData,
OUT PULONG pulAuthDataSize
)
{
NTSTATUS Status = STATUS_SUCCESS;
SAMPR_HANDLE UserHandle = NULL;
UNICODE_STRING ustrcPackageName;
UNICODE_STRING ustrcTemp;
STRING strcTemp;
PVOID pvPlainPwd = NULL;
PVOID pvHashCred = NULL;
ULONG ulLenPassword = 0;
ULONG ulLenHash = 0;
ULONG ulVersion = 0;
BOOL bOpenedSAM = FALSE;
DebugLog((DEB_TRACE_FUNC,"DigestGetPasswd: Entering\n"));
RtlZeroMemory(&ustrcTemp, sizeof(ustrcTemp));
RtlZeroMemory(&strcTemp, sizeof(strcTemp));
RtlZeroMemory(&ustrcPackageName, sizeof(ustrcPackageName));
pUserCreds->fIsValidDigestHash = FALSE;
pUserCreds->fIsValidPasswd = FALSE;
*pulAuthDataSize = 0L;
*ppucUserAuthData = NULL;
DebugLog((DEB_TRACE,"DigestGetPasswd: looking for username (unicode) %wZ\n", &(pUserCreds->ustrUsername)));
if (!g_fDomainController)
{
DebugLog((DEB_ERROR,"DigestGetPasswd: Not on a domaincontroller - can not get credentials\n"));
Status = STATUS_INVALID_SERVER_STATE;
goto CleanUp;
}
// Call LsaOpenSamUser()
Status = g_LsaFunctions->OpenSamUser(&(pUserCreds->ustrUsername), SecNameSamCompatible,
NULL, FALSE, 0, &UserHandle);
if ( !NT_SUCCESS( Status ) )
{
DebugLog((DEB_ERROR, "DigestGetPasswd: Failed to open SAM for user %wZ, Status = 0x%x\n",
&(pUserCreds->ustrUsername), Status));
goto CleanUp;
}
bOpenedSAM = TRUE;
DebugLog((DEB_TRACE,"DigestGetPasswd: Have a valid UserHandle\n"));
//
// Retrieve the MD5 hashed pre-calculated values if they exist for this user
//
// NOTE : On NT 5, this API only works on Domain Controllers !!
//
RtlInitUnicodeString(&ustrcPackageName, SAM_WDIGEST_CREDENTIAL_NAME);
Status = SamIRetrievePrimaryCredentials( (SAMPR_HANDLE) UserHandle,
&ustrcPackageName,
&pvHashCred,
&ulLenHash);
if (!NT_SUCCESS( Status ))
{
pvHashCred = NULL;
DebugLog((DEB_TRACE,"DigestGetPasswd: NO Pre-calc Hashes were found for user\n"));
}
else
{
strcTemp.Buffer = (PCHAR) pvHashCred;
strcTemp.Length = strcTemp.MaximumLength = (USHORT) ulLenHash;
Status = StringDuplicate(&(pUserCreds->strDigestHash), &strcTemp);
if (!NT_SUCCESS( Status ))
{
DebugLog((DEB_ERROR, "DigestGetPasswd: Failed to copy plaintext password, error 0x%x\n", Status));
goto CleanUp;
}
// DebugLog((DEB_TRACE,"DigestGetPasswd: Have the PASSWORD %wZ\n", &(pUserCreds->ustrPasswd)));
Status = RtlCharToInteger(pUserCreds->strDigestHash.Buffer, TENBASE, &ulVersion);
if (!NT_SUCCESS(Status))
{
Status = STATUS_INVALID_PARAMETER;
DebugLog((DEB_ERROR, "DigestGetPasswd: Badly formatted pre-calc version\n"));
goto CleanUp;
}
// Check version and size of credentials
if ((ulVersion != SUPPCREDS_VERSION) || (ulLenHash < (TOTALPRECALC_HEADERS * MD5_HASH_BYTESIZE)))
{
DebugLog((DEB_ERROR, "DigestGetPasswd: Invalid precalc version or size\n"));
pUserCreds->fIsValidDigestHash = FALSE;
}
else
{
pUserCreds->fIsValidDigestHash = TRUE;
// setup the hashes to utilize - get format from the notify.cxx hash calcs
switch (pUserCreds->typeName)
{
case NAMEFORMAT_ACCOUNTNAME:
pUserCreds->sHashTags[NAME_ACCT] = 1;
pUserCreds->sHashTags[NAME_ACCT_DOWNCASE] = 1;
pUserCreds->sHashTags[NAME_ACCT_UPCASE] = 1;
break;
case NAMEFORMAT_UPN:
pUserCreds->sHashTags[NAME_UPN] = 1;
pUserCreds->sHashTags[NAME_UPN_DOWNCASE] = 1;
pUserCreds->sHashTags[NAME_UPN_UPCASE] = 1;
break;
case NAMEFORMAT_NETBIOS:
pUserCreds->sHashTags[NAME_NT4] = 1;
pUserCreds->sHashTags[NAME_NT4_DOWNCASE] = 1;
pUserCreds->sHashTags[NAME_NT4_UPCASE] = 1;
break;
default:
break;
}
}
DebugLog((DEB_TRACE,"DigestGetPasswd: Read in Pre-calc Hashes size = %lu\n", ulLenHash));
}
//
// Retrieve the plaintext password
//
// NOTE : On NT 5, this API only works on Domain Controllers !!
//
RtlInitUnicodeString(&ustrcPackageName, SAM_CLEARTEXT_CREDENTIAL_NAME);
// Note: Would be nice to have this as a LSAFunction
Status = SamIRetrievePrimaryCredentials( (SAMPR_HANDLE) UserHandle,
&ustrcPackageName,
&pvPlainPwd,
&ulLenPassword);
if (!NT_SUCCESS( Status ))
{
DebugLog((DEB_ERROR, "DigestGetPasswd: Failed to retrieve plaintext password, error 0x%x\n", Status));
if (pUserCreds->fIsValidDigestHash == FALSE)
{
// We have no pre-computed MD5 hashes and also no cleartext password
// we can not perform any Digest Auth operations
//
// Explicitly set the status to be "wrong password" instead of whatever
// is returned by SamIRetrievePrimaryCredentials
//
Status = STATUS_WRONG_PASSWORD;
DebugLog((DEB_ERROR,"DigestGetPasswd: Can not obtain cleartext or Hashed Creds\n"));
goto CleanUp;
}
}
else
{
ustrcTemp.Buffer = (PUSHORT) pvPlainPwd;
ustrcTemp.Length = ustrcTemp.MaximumLength = (USHORT) ulLenPassword;
Status = UnicodeStringDuplicate(&(pUserCreds->ustrPasswd), &ustrcTemp);
if (!NT_SUCCESS( Status ))
{
DebugLog((DEB_ERROR, "DigestGetPasswd: Failed to copy plaintext password, error 0x%x\n", Status));
goto CleanUp;
}
// DebugLog((DEB_TRACE,"DigestGetPasswd: Have the PASSWORD %wZ\n", &(pUserCreds->ustrPasswd)));
pUserCreds->fIsValidPasswd = TRUE;
DebugLog((DEB_TRACE,"DigestGetPasswd: Password retrieved\n"));
}
// We have some form of credentials based on password (either cleartext or pre-computed)
if (ppucUserAuthData)
{ // Go fetch the AuthData to marshall back to the server for Token creation
*ppucUserAuthData = NULL;
*pulAuthDataSize = 0;
// Calling LsaGetUserAuthData()
Status = g_LsaFunctions->GetUserAuthData(UserHandle, ppucUserAuthData, pulAuthDataSize);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR,"DigestGetPasswd: failed acquire UseAuthData 0x%x\n", Status));
goto CleanUp;
}
}
CleanUp:
// Release any memory from SamI* calls Would be nice to have this as a LSAFunction
if (pvPlainPwd)
{
if (ulLenPassword > 0)
{
ZeroMemory(pvPlainPwd, ulLenPassword);
}
LocalFree(pvPlainPwd);
pvPlainPwd = NULL;
}
if (pvHashCred)
{
LocalFree(pvHashCred);
pvHashCred = NULL;
}
if (bOpenedSAM == TRUE)
{
// LsaCloseSamUser()
Status = g_LsaFunctions->CloseSamUser(UserHandle);
if (!NT_SUCCESS(Status))
{
DebugLog((DEB_ERROR,"DigestGetPasswd: failed LsaCloseSamUser 0x%x\n", Status));
}
bOpenedSAM = FALSE;
}
if (!NT_SUCCESS(Status))
{ // Cleanup functions since there was a failure
if (*ppucUserAuthData)
{
g_LsaFunctions->FreeLsaHeap(*ppucUserAuthData);
*ppucUserAuthData = NULL;
*pulAuthDataSize = 0L;
}
}
DebugLog((DEB_TRACE_FUNC,"DigestGetPasswd: Leaving\n"));
return(Status);
}
Reference in a new issue Copy permalink