613 lines
17 KiB
C++
613 lines
17 KiB
C++
/*++
|
||
|
||
|
||
Copyright (c) 1995 Microsoft Corporation
|
||
|
||
Module Name:
|
||
tssec.hxx
|
||
|
||
Abstract:
|
||
This file declares security related classes and functions
|
||
|
||
Author:
|
||
|
||
Murali R. Krishnan ( MuraliK ) 11-Oct-1995
|
||
|
||
Environment:
|
||
|
||
Win32 User Mode
|
||
|
||
Project:
|
||
|
||
Internet Services Common DLL
|
||
|
||
Revision History:
|
||
|
||
--*/
|
||
|
||
# ifndef _TSSEC_HXX_
|
||
# define _TSSEC_HXX_
|
||
|
||
/************************************************************
|
||
* Include Headers
|
||
************************************************************/
|
||
|
||
# define SECURITY_WIN32
|
||
#include <sspi.h> // Security Support Provider APIs
|
||
|
||
#include <schnlsp.h>
|
||
|
||
#include <pudebug.h>
|
||
|
||
// forward declaration
|
||
class IIS_SERVER_INSTANCE;
|
||
class IIS_SSL_INFO;
|
||
|
||
/************************************************************
|
||
* Type Definitions
|
||
************************************************************/
|
||
|
||
typedef BOOL (WINAPI *SECURITY_CONTEXT_DELETE_FUNCTION)( CtxtHandle*, PVOID );
|
||
|
||
//
|
||
// Globals
|
||
//
|
||
|
||
extern HANDLE g_hProcessImpersonationToken;
|
||
extern HANDLE g_hProcessPrimaryToken;
|
||
extern BOOL g_fUseSingleToken;
|
||
|
||
//
|
||
// The TCP_AUTHENT_INFO structure is used as a shorthand to convey
|
||
// a bunch of authentication related information to a few routines that
|
||
// need it.
|
||
//
|
||
class TCP_AUTHENT_INFO
|
||
{
|
||
public:
|
||
TCP_AUTHENT_INFO( VOID )
|
||
: fDontUseAnonSubAuth( FALSE ),
|
||
dwLogonMethod ( LOGON32_LOGON_INTERACTIVE ),
|
||
cbAnonAcctDesc ( 0 )
|
||
{
|
||
}
|
||
|
||
STR strAnonUserName;
|
||
STR strAnonUserPassword;
|
||
STR strDefaultLogonDomain;
|
||
DWORD dwLogonMethod;
|
||
BOOL fDontUseAnonSubAuth;
|
||
|
||
//
|
||
// Stores the anonymous account descriptor
|
||
//
|
||
|
||
BUFFER bAnonAcctDesc;
|
||
DWORD cbAnonAcctDesc;
|
||
};
|
||
|
||
typedef TCP_AUTHENT_INFO * PTCP_AUTHENT_INFO;
|
||
|
||
|
||
//
|
||
// Security functions.
|
||
//
|
||
|
||
#define IIS_DNLEN 256
|
||
#define MAX_ACCT_DESC_LEN (UNLEN+1+IIS_DNLEN+1+PWLEN+1)
|
||
|
||
class CACHED_CREDENTIAL
|
||
{
|
||
public:
|
||
CACHED_CREDENTIAL()
|
||
{
|
||
_ListEntry.Flink = NULL;
|
||
_fHaveCredHandle = FALSE;
|
||
}
|
||
~CACHED_CREDENTIAL();
|
||
BOOL
|
||
static CACHED_CREDENTIAL::GetCredential(
|
||
LPSTR pszPackage,
|
||
PIIS_SERVER_INSTANCE psi,
|
||
PTCP_AUTHENT_INFO pTAI,
|
||
CredHandle* prcred,
|
||
ULONG* pcbMaxToken
|
||
);
|
||
LIST_ENTRY _ListEntry;
|
||
|
||
private:
|
||
STR _PackageName;
|
||
STR _DefaultDomain;
|
||
CredHandle _hcred;
|
||
BOOL _fHaveCredHandle;
|
||
ULONG _cbMaxToken; // Used for SSP, max message token size
|
||
} ;
|
||
|
||
class CACHED_TOKEN
|
||
{
|
||
public:
|
||
CACHED_TOKEN( VOID )
|
||
: _hToken( NULL ),
|
||
_cRef ( 1 ),
|
||
_TTL ( 2 ),
|
||
m_hImpersonationToken( NULL ),
|
||
m_fGuest ( FALSE ),
|
||
m_dwLogonMethod ( 0 )
|
||
{
|
||
_ListEntry.Flink = NULL;
|
||
_liExpiry.HighPart = 0x7fffffff;
|
||
_liExpiry.LowPart = 0xffffffff;
|
||
}
|
||
|
||
~CACHED_TOKEN( VOID )
|
||
{
|
||
if ( !g_fUseSingleToken )
|
||
{
|
||
DBG_ASSERT( _ListEntry.Flink == NULL );
|
||
|
||
if ( m_hImpersonationToken) {
|
||
|
||
DBG_REQUIRE( CloseHandle( m_hImpersonationToken ));
|
||
m_hImpersonationToken = NULL;
|
||
}
|
||
|
||
if ( _hToken )
|
||
{
|
||
DBG_REQUIRE( CloseHandle( _hToken ) );
|
||
_hToken = NULL;
|
||
}
|
||
}
|
||
}
|
||
|
||
static VOID Reference( CACHED_TOKEN * pct )
|
||
{
|
||
DBG_ASSERT( pct->_cRef > 0 );
|
||
InterlockedIncrement( &pct->_cRef );
|
||
}
|
||
|
||
static VOID Dereference( CACHED_TOKEN * pct )
|
||
{
|
||
DBG_ASSERT( pct->_cRef > 0 );
|
||
|
||
if ( !InterlockedDecrement( &pct->_cRef ) )
|
||
{
|
||
delete pct;
|
||
}
|
||
}
|
||
|
||
HANDLE QueryImpersonationToken(VOID) const
|
||
{ return g_fUseSingleToken ? g_hProcessImpersonationToken : m_hImpersonationToken; }
|
||
|
||
HANDLE QueryPrimaryToken(VOID) const
|
||
{ return g_fUseSingleToken ? g_hProcessImpersonationToken : m_hImpersonationToken; }
|
||
|
||
VOID SetImpersonationToken(IN HANDLE hImpersonation)
|
||
{
|
||
DBG_ASSERT( m_hImpersonationToken == NULL);
|
||
if ( g_fUseSingleToken )
|
||
{
|
||
DBG_ASSERT( FALSE );
|
||
}
|
||
else
|
||
{
|
||
m_hImpersonationToken = hImpersonation;
|
||
}
|
||
}
|
||
|
||
VOID SetExpiry( LARGE_INTEGER* pE )
|
||
{
|
||
if ( g_fUseSingleToken )
|
||
{
|
||
DBG_ASSERT( FALSE );
|
||
}
|
||
|
||
if ( NULL != pE )
|
||
{
|
||
memcpy( &_liExpiry, pE, sizeof(LARGE_INTEGER) );
|
||
}
|
||
else
|
||
{
|
||
_liExpiry.HighPart = 0x7fffffff;
|
||
_liExpiry.LowPart = 0xffffffff;
|
||
}
|
||
}
|
||
|
||
LARGE_INTEGER* QueryExpiry() { return &_liExpiry; }
|
||
|
||
BOOL IsGuest(VOID) const { return (m_fGuest); }
|
||
VOID SetGuest(IN BOOL fGuest) { m_fGuest = fGuest; }
|
||
|
||
HANDLE _hToken; // Must be first data member
|
||
LIST_ENTRY _ListEntry;
|
||
LONG _cRef;
|
||
DWORD _TTL; // Gets decremented on each timeout, when zero,
|
||
// remove this item from the cache
|
||
BOOL m_fGuest; // Is this token a guest user?
|
||
HANDLE m_hImpersonationToken;
|
||
|
||
CHAR _achAcctDesc[MAX_ACCT_DESC_LEN];
|
||
DWORD m_dwAcctDescLen;
|
||
LARGE_INTEGER _liExpiry;
|
||
|
||
DWORD m_dwLogonMethod;
|
||
CHAR m_achUserName[ UNLEN ];
|
||
CHAR m_achDomainName[ IIS_DNLEN ];
|
||
};
|
||
|
||
typedef CACHED_TOKEN* TS_TOKEN; // Choose an incompatible type so warnings
|
||
// are produced
|
||
|
||
///////////////////////////////////////////////////////////////////////
|
||
//
|
||
// NT Authentication support
|
||
//
|
||
//////////////////////////////////////////////////////////////////////
|
||
|
||
//
|
||
// TCP Authenticator flags passed to init
|
||
//
|
||
|
||
#define TCPAUTH_SERVER 0x00000001 // This is the server side
|
||
#define TCPAUTH_CLIENT 0x00000002 // This is the client side
|
||
#define TCPAUTH_UUENCODE 0x00000004 // Input buffers are uudecoded,
|
||
// output buffers are uuencoded
|
||
#define TCPAUTH_BASE64 0x00000008 // uses base64 for uuenc/dec
|
||
|
||
#define CRED_STATUS_INVALID_TIME 0x00001000
|
||
#define CRED_STATUS_REVOKED 0x00002000
|
||
|
||
class TCP_AUTHENT
|
||
{
|
||
public:
|
||
|
||
dllexp TCP_AUTHENT( DWORD AuthFlags );
|
||
dllexp ~TCP_AUTHENT();
|
||
|
||
//
|
||
// Server side only: For clients that pass clear text, the server should
|
||
// authenticate with this method
|
||
//
|
||
|
||
dllexp BOOL ClearTextLogon( CHAR * pszUser,
|
||
CHAR * pszPassword,
|
||
BOOL * pfAsGuest,
|
||
BOOL * pfAsAnonymous,
|
||
IIS_SERVER_INSTANCE * pInstance,
|
||
PTCP_AUTHENT_INFO pTAI,
|
||
CHAR * pszWorkstation = NULL
|
||
);
|
||
|
||
#if 0
|
||
//
|
||
// Server side only : Digest logon
|
||
//
|
||
|
||
dllexp BOOL LogonDigestUser(
|
||
PSTR pszUserName,
|
||
PSTR pszRealm,
|
||
PSTR pszUri,
|
||
PSTR pszMethod,
|
||
PSTR pszNonce,
|
||
PSTR pszServerNonce,
|
||
PSTR pszDigest,
|
||
DWORD dwAlgo,
|
||
LPTSVC_INFO psi
|
||
);
|
||
#endif
|
||
|
||
//
|
||
// Server side only: For filters that set access tokens
|
||
//
|
||
|
||
dllexp BOOL SetAccessToken( HANDLE hPrimaryToken,
|
||
HANDLE hImpersonationToken
|
||
);
|
||
|
||
//
|
||
// Client calls this first to get the negotiation message which
|
||
// it then sends to the server. The server calls this with the
|
||
// client result and sends back the result. The conversation
|
||
// continues until *pcbBuffOut is zero and *pfNeedMoreData is FALSE.
|
||
//
|
||
// On the first call, pszPackage must point to the zero terminated
|
||
// authentication package name to be used and pszUser and pszPassword
|
||
// should point to the user name and password to authenticated with
|
||
// on the client side (server side will always be NULL).
|
||
//
|
||
|
||
dllexp BOOL Converse( VOID * pBuffIn,
|
||
DWORD cbBuffIn,
|
||
BUFFER * pbuffOut,
|
||
DWORD * pcbBuffOut,
|
||
BOOL * pfNeedMoreData,
|
||
PTCP_AUTHENT_INFO pTAI,
|
||
CHAR * pszPackage = NULL,
|
||
CHAR * pszUser = NULL,
|
||
CHAR * pszPassword = NULL,
|
||
PIIS_SERVER_INSTANCE psi = NULL );
|
||
|
||
dllexp BOOL TCP_AUTHENT::ConverseEx(
|
||
SecBufferDesc* pInSecBufDesc, // passed in by caller
|
||
BUFFER * pDecodedBuffer, // passed in by caller
|
||
BUFFER * pbuffOut,
|
||
DWORD * pcbBuffOut,
|
||
BOOL * pfNeedMoreData,
|
||
PTCP_AUTHENT_INFO pTAI,
|
||
CHAR * pszPackage,
|
||
CHAR * pszUser,
|
||
CHAR * pszPassword,
|
||
PIIS_SERVER_INSTANCE psi
|
||
);
|
||
|
||
//
|
||
// Server side only. Impersonates client after successful authentication
|
||
//
|
||
|
||
dllexp BOOL Impersonate( VOID );
|
||
dllexp BOOL RevertToSelf( VOID );
|
||
dllexp BOOL IsForwardable( VOID ) const;
|
||
|
||
dllexp BOOL StartProcessAsUser( LPCSTR lpApplicationName,
|
||
LPSTR lpCommandLine,
|
||
BOOL bInheritHandles,
|
||
DWORD dwCreationFlags,
|
||
LPVOID lpEnvironment,
|
||
LPCSTR lpCurrentDirectory,
|
||
LPSTARTUPINFOA lpStartupInfo,
|
||
LPPROCESS_INFORMATION lpProcessInformation
|
||
);
|
||
|
||
//
|
||
// Gives the name of all authentication packages in a double null
|
||
// terminated list. i.e.:
|
||
//
|
||
// NTLM\0
|
||
// MSKerberos\0
|
||
// \0
|
||
//
|
||
|
||
dllexp BOOL EnumAuthPackages( BUFFER * pBuff );
|
||
|
||
//
|
||
// Returns the user name associated with this context, not supported for
|
||
// clear text
|
||
//
|
||
|
||
dllexp BOOL QueryUserName( STR * pBuff, BOOL fImpersonated = FALSE );
|
||
dllexp BOOL QueryExpiry( PTimeStamp pExpiry );
|
||
|
||
dllexp TS_TOKEN GetToken( VOID ) const
|
||
{ return _hToken; }
|
||
|
||
//
|
||
// Gets actual impersonation token handle
|
||
//
|
||
|
||
dllexp HANDLE QueryPrimaryToken( VOID );
|
||
dllexp HANDLE QueryImpersonationToken( VOID );
|
||
|
||
dllexp HANDLE GetUserHandle( VOID )
|
||
{ return QueryPrimaryToken(); }
|
||
|
||
dllexp BOOL QueryFullyQualifiedUserName(
|
||
LPSTR pszUser,
|
||
STR * strU,
|
||
IIS_SERVER_INSTANCE * psi,
|
||
PTCP_AUTHENT_INFO pTAI
|
||
);
|
||
|
||
dllexp BOOL IsGuest( BOOL );
|
||
|
||
dllexp BOOL Reset( BOOL fSessionReset = TRUE );
|
||
|
||
dllexp CredHandle * QueryCredHandle( VOID )
|
||
{ return (_fHaveCredHandle ? &_hcred : NULL); }
|
||
|
||
dllexp CtxtHandle * QueryCtxtHandle( VOID )
|
||
{ return (_fHaveCtxtHandle ? &_hctxt : NULL); }
|
||
|
||
dllexp CtxtHandle * QuerySslCtxtHandle( VOID )
|
||
{ return _phSslCtxt; }
|
||
|
||
dllexp BOOL SetSecurityContextToken( CtxtHandle* pCtxt,
|
||
HANDLE hImpersonationToken,
|
||
SECURITY_CONTEXT_DELETE_FUNCTION pFn,
|
||
PVOID pArg,
|
||
IIS_SSL_INFO *pSslInfo );
|
||
|
||
dllexp BOOL IsSslCertPresent();
|
||
|
||
dllexp BOOL DeleteCachedTokenOnReset( VOID );
|
||
|
||
dllexp BOOL QueryCertificateIssuer( LPSTR ppIssuer, DWORD, LPBOOL );
|
||
dllexp BOOL QueryCertificateSubject( LPSTR ppSubject, DWORD, LPBOOL );
|
||
dllexp BOOL QueryCertificateFlags( LPDWORD pdwFlags, LPBOOL );
|
||
dllexp BOOL QueryCertificateSerialNumber( LPBYTE* pSerialNumber, LPDWORD pdwLen, LPBOOL );
|
||
|
||
dllexp BOOL QueryServerCertificateIssuer( LPSTR* ppIssuer, LPBOOL );
|
||
dllexp BOOL QueryServerCertificateSubject( LPSTR* ppSubject, LPBOOL );
|
||
dllexp BOOL QueryEncryptionKeySize( LPDWORD, LPBOOL );
|
||
dllexp BOOL QueryEncryptionServerPrivateKeySize( LPDWORD, LPBOOL );
|
||
|
||
dllexp BOOL
|
||
GetClientCertBlob(
|
||
IN DWORD cbAllocated,
|
||
OUT DWORD * pdwCertEncodingType,
|
||
OUT unsigned char * pbCertEncoded,
|
||
OUT DWORD * pcbCertEncoded,
|
||
OUT DWORD * pfCertificateVerified);
|
||
|
||
dllexp BOOL UpdateClientCertFlags( DWORD dwFlags, LPBOOL pfCert, LPBYTE pbCa, DWORD dwCa );
|
||
|
||
dllexp BOOL PackageSupportsEncoding( LPSTR pszPackage );
|
||
|
||
dllexp BOOL SetTargetName( LPSTR pszTarget );
|
||
|
||
private:
|
||
BOOL QueryCertificateInfo( LPBOOL );
|
||
BOOL QueryServerCertificateInfo( LPBOOL );
|
||
|
||
protected:
|
||
DWORD _fClient:1; // TRUE if client side, FALSE if SERVER side
|
||
DWORD _fNewConversation:1; // Forces initialization params for client side
|
||
DWORD _fUUEncodeData:1; // uuencode/decode input and output buffers
|
||
DWORD _fClearText:1; // Use the Gina APIs rather then the SSP APIs
|
||
DWORD _fHaveCredHandle:1; // _hcred contains a credential handle
|
||
DWORD _fHaveCtxtHandle:1; // _hctxt contains a context handle
|
||
DWORD _fBase64:1; // uses base64 for uuenc/dec
|
||
DWORD _fKnownToBeGuest:1; // TRUE if SSPI flag access token as "Guest"
|
||
DWORD _fHaveAccessTokens:1;// TRUE if access token set by caller
|
||
DWORD _fHaveExpiry:1; // TRUE if clear text logon has pwd expiry time
|
||
DWORD _fDelegate:1; // TRUE if security context forwardable
|
||
DWORD _fCertCheckForRevocation:1; // TRUE if we should revocation check
|
||
DWORD _fCertCheckCacheOnly:1; // TRUE if we should not go on wire
|
||
TS_TOKEN _hToken; // Used for clear text
|
||
CredHandle _hcred; // Used for SSP
|
||
ULONG _cbMaxToken; // Used for SSP, max message token size
|
||
HANDLE _hSSPToken; // Used for SSP, caches real token
|
||
HANDLE _hSSPPrimaryToken;// Used for SSP, caches duplicated token
|
||
CtxtHandle _hctxt; // Used for SSP
|
||
|
||
SECURITY_CONTEXT_DELETE_FUNCTION _pDeleteFunction;
|
||
PVOID _pDeleteArg;
|
||
LARGE_INTEGER _liPwdExpiry;
|
||
|
||
PCERT_CONTEXT _pClientCertContext;
|
||
DWORD _dwX509Flags;
|
||
IIS_SSL_INFO * _pSslInfo;
|
||
PX509Certificate _pServerX509Certificate;
|
||
DWORD _dwServerX509Flags;
|
||
DWORD _dwServerBitsInKey;
|
||
CtxtHandle * _phSslCtxt; // ptr to SSL sec context
|
||
STR _strTarget;
|
||
};
|
||
|
||
|
||
|
||
DWORD
|
||
InitializeSecurity(
|
||
HINSTANCE hDll
|
||
);
|
||
|
||
VOID
|
||
TerminateSecurity(
|
||
VOID
|
||
);
|
||
|
||
|
||
dllexp
|
||
BOOL
|
||
TsImpersonateUser(
|
||
TS_TOKEN hToken
|
||
);
|
||
|
||
dllexp
|
||
HANDLE
|
||
TsTokenToHandle(
|
||
TS_TOKEN hToken
|
||
);
|
||
|
||
dllexp
|
||
HANDLE
|
||
TsTokenToImpHandle(
|
||
TS_TOKEN hToken
|
||
);
|
||
|
||
dllexp
|
||
DWORD
|
||
TsApiAccessCheck(
|
||
ACCESS_MASK maskDesiredAccess
|
||
);
|
||
|
||
|
||
dllexp
|
||
BOOL
|
||
TsDeleteUserToken(
|
||
TS_TOKEN hToken
|
||
);
|
||
|
||
dllexp
|
||
TS_TOKEN
|
||
TsLogonUser(
|
||
CHAR * pszUser,
|
||
CHAR * pszPassword,
|
||
BOOL * pfAsGuest,
|
||
BOOL * pfAsAnonymous,
|
||
IIS_SERVER_INSTANCE * pInstance,
|
||
PTCP_AUTHENT_INFO pTAI,
|
||
CHAR * pszWorkstation = NULL,
|
||
LARGE_INTEGER * pExpiry = NULL,
|
||
BOOL * pfExpiry = NULL
|
||
);
|
||
|
||
dllexp
|
||
BOOL
|
||
TsGetSecretW(
|
||
WCHAR * pszSecretName,
|
||
BUFFER * pbufSecret
|
||
);
|
||
|
||
dllexp
|
||
DWORD
|
||
TsSetSecretW(
|
||
IN LPWSTR SecretName,
|
||
IN LPWSTR pSecret,
|
||
IN DWORD cbSecret
|
||
);
|
||
|
||
#ifdef CHICAGO
|
||
dllexp
|
||
BOOL
|
||
TsIsUserLevelPresent(VOID);
|
||
#endif
|
||
|
||
|
||
dllexp
|
||
BOOL
|
||
uudecode(
|
||
char * bufcoded,
|
||
BUFFER * pbuffdecoded,
|
||
DWORD * pcbDecoded = NULL,
|
||
BOOL fBase64 = FALSE
|
||
);
|
||
|
||
dllexp
|
||
BOOL
|
||
uuencode(
|
||
BYTE * pchData,
|
||
DWORD cbData,
|
||
BUFFER * pbuffEncoded,
|
||
BOOL fBase64 = FALSE
|
||
);
|
||
|
||
dllexp
|
||
BOOL
|
||
BuildAnonymousAcctDesc(
|
||
PTCP_AUTHENT_INFO pTAI
|
||
);
|
||
|
||
dllexp
|
||
QuerySingleAccessToken(
|
||
VOID
|
||
);
|
||
|
||
extern TS_TOKEN g_pctProcessToken;
|
||
|
||
#include <tslogon.hxx>
|
||
|
||
#include <wintrust.h>
|
||
typedef
|
||
LONG (WINAPI *PFN_WinVerifyTrust)(IN OPTIONAL HWND hwnd,
|
||
IN GUID *pgActionID,
|
||
IN LPVOID pWintrustData);
|
||
|
||
extern HINSTANCE g_hWinTrust;
|
||
extern PFN_WinVerifyTrust g_pfnWinVerifyTrust;
|
||
|
||
|
||
#endif
|
||
|
||
/************************ End of File ***********************/
|
||
|
||
|