[PATCH 3/3] kerberos: Add support for KerbQueryTicketCacheMessage. (v2)

26 Jan 2018

Based on the code written by George Popoff.

v2: Copy full ticket info (including Realm/Server name) to flat buffer.

Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru>
---
 dlls/kerberos/krb5_ap.c | 405 +++++++++++++++++++++++++++++++++++++++++++++++-
 include/ntsecapi.h      | 105 +++++++++++++
 2 files changed, 507 insertions(+), 3 deletions(-)

diff --git a/dlls/kerberos/krb5_ap.c b/dlls/kerberos/krb5_ap.c
index b4a37f754f..dc97b1cc04 100644
--- a/dlls/kerberos/krb5_ap.c
+++ b/dlls/kerberos/krb5_ap.c
@@ -1,5 +1,6 @@
 /*
  * Copyright 2017 Dmitry Timoshkov
+ * Copyright 2017 George Popoff
  * Copyright 2008 Robert Shearman for CodeWeavers
  * Copyright 2017 Hans Leidekker for CodeWeavers
  *
@@ -36,6 +37,7 @@
 #define WIN32_NO_STATUS
 #include "windef.h"
 #include "winbase.h"
+#include "winnls.h"
 #include "rpc.h"
 #include "sspi.h"
 #include "ntsecapi.h"
@@ -88,8 +90,43 @@ static void *libkrb5_handle;
 
 #define MAKE_FUNCPTR(f) static typeof(f) * p_##f
 MAKE_FUNCPTR(krb5_init_context);
+MAKE_FUNCPTR(krb5_free_context);
+MAKE_FUNCPTR(krb5_free_ticket);
+MAKE_FUNCPTR(krb5_cccol_cursor_new);
+MAKE_FUNCPTR(krb5_cccol_cursor_next);
+MAKE_FUNCPTR(krb5_cccol_cursor_free);
+MAKE_FUNCPTR(krb5_cc_close);
+MAKE_FUNCPTR(krb5_cc_start_seq_get);
+MAKE_FUNCPTR(krb5_cc_end_seq_get);
+MAKE_FUNCPTR(krb5_cc_next_cred);
+MAKE_FUNCPTR(krb5_is_config_principal);
+MAKE_FUNCPTR(krb5_decode_ticket);
+MAKE_FUNCPTR(krb5_unparse_name_flags);
+MAKE_FUNCPTR(krb5_free_unparsed_name);
+MAKE_FUNCPTR(krb5_free_cred_contents);
 #undef MAKE_FUNCPTR
 
+static void *heap_alloc(SIZE_T size)
+{
+    return HeapAlloc(GetProcessHeap(), 0, size);
+}
+
+static void *heap_realloc(void *p, SIZE_T size)
+{
+    return HeapReAlloc(GetProcessHeap(), 0, p, size);
+}
+
+static void heap_free(void *p)
+{
+    HeapFree(GetProcessHeap(), 0, p);
+}
+
+struct ticket_info
+{
+    ULONG count, allocated;
+    KERB_TICKET_CACHE_INFO *info;
+};
+
 static void load_krb5(void)
 {
     if (!(libkrb5_handle = wine_dlopen(SONAME_LIBKRB5, RTLD_NOW, NULL, 0)))
@@ -106,6 +143,20 @@ static void load_krb5(void)
     }
 
     LOAD_FUNCPTR(krb5_init_context)
+    LOAD_FUNCPTR(krb5_free_context)
+    LOAD_FUNCPTR(krb5_free_ticket)
+    LOAD_FUNCPTR(krb5_cccol_cursor_new)
+    LOAD_FUNCPTR(krb5_cccol_cursor_next)
+    LOAD_FUNCPTR(krb5_cccol_cursor_free)
+    LOAD_FUNCPTR(krb5_cc_close)
+    LOAD_FUNCPTR(krb5_cc_start_seq_get)
+    LOAD_FUNCPTR(krb5_cc_end_seq_get)
+    LOAD_FUNCPTR(krb5_cc_next_cred)
+    LOAD_FUNCPTR(krb5_is_config_principal)
+    LOAD_FUNCPTR(krb5_decode_ticket)
+    LOAD_FUNCPTR(krb5_unparse_name_flags)
+    LOAD_FUNCPTR(krb5_free_unparsed_name)
+    LOAD_FUNCPTR(krb5_free_cred_contents)
 #undef LOAD_FUNCPTR
 
     return;
@@ -157,15 +208,363 @@ static NTSTATUS NTAPI kerberos_LsaApInitializePackage(ULONG package_id, PLSA_DIS
     return STATUS_SUCCESS;
 }
 
+static NTSTATUS krb5_error_to_status(krb5_error_code error)
+{
+    switch (error)
+    {
+    case 0: return STATUS_SUCCESS;
+    default:
+        /* FIXME */
+        return STATUS_UNSUCCESSFUL;
+    }
+}
+
+static void free_ticket_info(struct ticket_info *info)
+{
+    ULONG i;
+
+    for (i = 0; i < info->count; i++)
+    {
+        heap_free(info->info[i].RealmName.Buffer);
+        heap_free(info->info[i].ServerName.Buffer);
+    }
+
+    heap_free(info->info);
+}
+
+static WCHAR *utf8_to_wstr(const char *utf8)
+{
+    int len;
+    WCHAR *wstr;
+
+    len = MultiByteToWideChar(CP_UTF8, 0, utf8, -1, NULL, 0);
+    wstr = heap_alloc(len * sizeof(WCHAR));
+    if (wstr)
+        MultiByteToWideChar(CP_UTF8, 0, utf8, -1, wstr, len);
+
+    return wstr;
+}
+
+static NTSTATUS copy_tickets_from_cache(krb5_context context, krb5_ccache cache, struct ticket_info *info)
+{
+    NTSTATUS status;
+    krb5_cc_cursor cursor;
+    krb5_error_code error;
+    krb5_creds credentials;
+    krb5_ticket *ticket;
+    char *name_with_realm, *name_without_realm, *realm_name;
+    WCHAR *realm_nameW, *name_without_realmW;
+
+    error = p_krb5_cc_start_seq_get(context, cache, &cursor);
+    if (error) return krb5_error_to_status(error);
+
+    for (;;)
+    {
+        error = p_krb5_cc_next_cred(context, cache, &cursor, &credentials);
+        if (error)
+        {
+            if (error == KRB5_CC_END)
+                status = STATUS_SUCCESS;
+            else
+                status = krb5_error_to_status(error);
+            break;
+        }
+
+        if (p_krb5_is_config_principal(context, credentials.server))
+        {
+            p_krb5_free_cred_contents(context, &credentials);
+            continue;
+        }
+
+        if (info->count == info->allocated)
+        {
+            KERB_TICKET_CACHE_INFO *new_info;
+            ULONG new_allocated;
+
+            if (info->allocated)
+            {
+                new_allocated = info->allocated * 2;
+                new_info = heap_realloc(info->info, sizeof(*new_info) * new_allocated);
+            }
+            else
+            {
+                new_allocated = 16;
+                new_info = heap_alloc(sizeof(*new_info) * new_allocated);
+            }
+            if (!new_info)
+            {
+                p_krb5_free_cred_contents(context, &credentials);
+                status = STATUS_NO_MEMORY;
+                break;
+            }
+
+            info->info = new_info;
+            info->allocated = new_allocated;
+        }
+
+        error = p_krb5_unparse_name_flags(context, credentials.server, 0, &name_with_realm);
+        if (error)
+        {
+            p_krb5_free_cred_contents(context, &credentials);
+            status = krb5_error_to_status(error);
+            break;
+        }
+
+        TRACE("name_with_realm: %s\n", debugstr_a(name_with_realm));
+
+        error = p_krb5_unparse_name_flags(context, credentials.server,
+            KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name_without_realm);
+        if (error)
+        {
+            p_krb5_free_unparsed_name(context, name_with_realm);
+            p_krb5_free_cred_contents(context, &credentials);
+            status = krb5_error_to_status(error);
+            break;
+        }
+
+        TRACE("name_without_realm: %s\n", debugstr_a(name_without_realm));
+
+        name_without_realmW = utf8_to_wstr(name_without_realm);
+        RtlInitUnicodeString(&info->info[info->count].ServerName, name_without_realmW);
+
+        realm_name = strchr(name_with_realm, '@');
+        if (!realm_name)
+        {
+            ERR("wrong name with realm %s\n", debugstr_a(name_with_realm));
+            realm_name = name_with_realm;
+        }
+        else
+            realm_name++;
+
+        /* realm_name - now contains only realm! */
+
+        realm_nameW = utf8_to_wstr(realm_name);
+        RtlInitUnicodeString(&info->info[info->count].RealmName, realm_nameW);
+
+        if (!credentials.times.starttime)
+            credentials.times.starttime = credentials.times.authtime;
+
+        /* TODO: if krb5_is_config_principal = true */
+        RtlSecondsSince1970ToTime(credentials.times.starttime, &info->info[info->count].StartTime);
+        RtlSecondsSince1970ToTime(credentials.times.endtime, &info->info[info->count].EndTime);
+        RtlSecondsSince1970ToTime(credentials.times.renew_till, &info->info[info->count].RenewTime);
+
+        info->info[info->count].TicketFlags = credentials.ticket_flags;
+
+        error = p_krb5_decode_ticket(&credentials.ticket, &ticket);
+
+        p_krb5_free_unparsed_name(context, name_with_realm);
+        p_krb5_free_unparsed_name(context, name_without_realm);
+        p_krb5_free_cred_contents(context, &credentials);
+
+        if (error)
+        {
+            status = krb5_error_to_status(error);
+            break;
+        }
+
+        info->info[info->count].EncryptionType = ticket->enc_part.enctype;
+
+        p_krb5_free_ticket(context, ticket);
+
+        info->count++;
+    }
+
+    p_krb5_cc_end_seq_get(context, cache, &cursor);
+
+    return status;
+}
+
+static inline void init_client_us(UNICODE_STRING *dst, void *client_ws, const UNICODE_STRING *src)
+{
+    dst->Buffer = client_ws;
+    dst->Length = src->Length;
+    dst->MaximumLength = src->MaximumLength;
+}
+
+static NTSTATUS copy_to_client(PLSA_CLIENT_REQUEST lsa_req, struct ticket_info *info, void **out, ULONG *out_size)
+{
+    NTSTATUS status;
+    ULONG i;
+    SIZE_T size, client_str_off;
+    char *client_resp, *client_ticket, *client_str;
+    KERB_QUERY_TKT_CACHE_RESPONSE resp;
+
+    size = sizeof(KERB_QUERY_TKT_CACHE_RESPONSE);
+    if (info->count != 0)
+        size += (info->count - 1) * sizeof(KERB_TICKET_CACHE_INFO);
+
+    client_str_off = size;
+
+    for (i = 0; i < info->count; i++)
+    {
+        size += info->info[i].RealmName.MaximumLength;
+        size += info->info[i].ServerName.MaximumLength;
+    }
+
+    status = lsa_dispatch.AllocateClientBuffer(lsa_req, size, (void **)&client_resp);
+    if (status != STATUS_SUCCESS) return status;
+
+    resp.MessageType = KerbQueryTicketCacheMessage;
+    resp.CountOfTickets = info->count;
+    size = FIELD_OFFSET(KERB_QUERY_TKT_CACHE_RESPONSE, Tickets);
+    status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_resp, &resp);
+    if (status != STATUS_SUCCESS) goto fail;
+
+    if (!info->count)
+    {
+        *out = client_resp;
+        *out_size = sizeof(resp);
+        return STATUS_SUCCESS;
+    }
+
+    *out_size = size;
+
+    client_ticket = client_resp + size;
+    client_str = client_resp + client_str_off;
+
+    for (i = 0; i < info->count; i++)
+    {
+        KERB_TICKET_CACHE_INFO ticket;
+
+        ticket = info->info[i];
+
+        init_client_us(&ticket.RealmName, client_str, &info->info[i].RealmName);
+
+        size = info->info[i].RealmName.MaximumLength;
+        status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, info->info[i].RealmName.Buffer);
+        if (status != STATUS_SUCCESS) goto fail;
+        client_str += size;
+        *out_size += size;
+
+        init_client_us(&ticket.ServerName, client_str, &info->info[i].ServerName);
+
+        size = info->info[i].ServerName.MaximumLength;
+        status = lsa_dispatch.CopyToClientBuffer(lsa_req, size, client_str, info->info[i].ServerName.Buffer);
+        if (status != STATUS_SUCCESS) goto fail;
+        client_str += size;
+        *out_size += size;
+
+        status = lsa_dispatch.CopyToClientBuffer(lsa_req, sizeof(ticket), client_ticket, &ticket);
+        if (status != STATUS_SUCCESS) goto fail;
+
+        client_ticket += sizeof(ticket);
+        *out_size += sizeof(ticket);
+    }
+
+    *out = client_resp;
+    return STATUS_SUCCESS;
+
+fail:
+    lsa_dispatch.FreeClientBuffer(lsa_req, client_resp);
+    return status;
+}
+
+static NTSTATUS query_ticket_cache(PLSA_CLIENT_REQUEST lsa_req, void *in, ULONG in_len, void **out, ULONG *out_len)
+{
+    NTSTATUS status;
+    KERB_QUERY_TKT_CACHE_REQUEST *query;
+    struct ticket_info info;
+    krb5_error_code error;
+    krb5_context context = NULL;
+    krb5_cccol_cursor cursor = NULL;
+    krb5_ccache cache;
+
+    if (!in || in_len != sizeof(KERB_QUERY_TKT_CACHE_REQUEST) || !out || !out_len)
+        return STATUS_INVALID_PARAMETER;
+
+    query = (KERB_QUERY_TKT_CACHE_REQUEST *)in;
+
+    if (query->LogonId.HighPart != 0 || query->LogonId.LowPart != 0)
+        return STATUS_ACCESS_DENIED;
+
+    info.count = 0;
+    info.allocated = 0;
+    info.info = NULL;
+
+    error = p_krb5_init_context(&context);
+    if (error)
+    {
+        status = krb5_error_to_status(error);
+        goto done;
+    }
+
+    error = p_krb5_cccol_cursor_new(context, &cursor);
+    if (error)
+    {
+        status = krb5_error_to_status(error);
+        goto done;
+    }
+
+    for (;;)
+    {
+        error = p_krb5_cccol_cursor_next(context, cursor, &cache);
+        if (error)
+        {
+            status = krb5_error_to_status(error);
+            goto done;
+        }
+        if (!cache) break;
+
+        status = copy_tickets_from_cache(context, cache, &info);
+
+        p_krb5_cc_close(context, cache);
+
+        if (status != STATUS_SUCCESS)
+            goto done;
+    }
+
+    status = copy_to_client(lsa_req, &info, out, out_len);
+
+done:
+    if (cursor)
+        p_krb5_cccol_cursor_free(context, &cursor);
+
+    if (context)
+        p_krb5_free_context(context);
+
+    free_ticket_info(&info);
+
+    return status;
+}
+
 static NTSTATUS NTAPI kerberos_LsaApCallPackageUntrusted(PLSA_CLIENT_REQUEST request,
     PVOID in_buffer, PVOID client_buffer_base, ULONG in_buffer_length,
     PVOID *out_buffer, PULONG out_buffer_length, PNTSTATUS status)
 {
-    FIXME("%p,%p,%p,%u,%p,%p,%p: stub\n", request, in_buffer, client_buffer_base,
+    KERB_PROTOCOL_MESSAGE_TYPE msg;
+
+    TRACE("%p,%p,%p,%u,%p,%p,%p\n", request, in_buffer, client_buffer_base,
         in_buffer_length, out_buffer, out_buffer_length, status);
 
-    *status = STATUS_NOT_IMPLEMENTED;
-    return STATUS_NOT_IMPLEMENTED;
+    if (!in_buffer || in_buffer_length < sizeof(msg))
+        return STATUS_INVALID_PARAMETER;
+
+    msg = *(KERB_PROTOCOL_MESSAGE_TYPE *)in_buffer;
+
+    switch (msg)
+    {
+    case KerbQueryTicketCacheMessage:
+        *status = query_ticket_cache(request, in_buffer, in_buffer_length, out_buffer, out_buffer_length);
+        break;
+
+    case KerbRetrieveTicketMessage:
+        FIXME("KerbRetrieveTicketMessage stub\n");
+        *status = STATUS_NOT_IMPLEMENTED;
+        break;
+
+    case KerbPurgeTicketCacheMessage:
+        FIXME("KerbPurgeTicketCacheMessage stub\n");
+        *status = STATUS_NOT_IMPLEMENTED;
+        break;
+
+    default: /* All other requests should call LsaApCallPackage */
+        WARN("%u => access denied\n", msg);
+        *status = STATUS_ACCESS_DENIED;
+        break;
+    }
+
+    return *status;
 }
 
 static NTSTATUS NTAPI kerberos_SpGetInfo(SecPkgInfoW *info)
diff --git a/include/ntsecapi.h b/include/ntsecapi.h
index d0339a97ef..6d5e01d675 100644
--- a/include/ntsecapi.h
+++ b/include/ntsecapi.h
@@ -169,6 +169,15 @@ typedef struct _OBJECT_ATTRIBUTES {
 } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
 #endif
 
+#ifndef __SECHANDLE_DEFINED__
+#define __SECHANDLE_DEFINED__
+typedef struct _SecHandle
+{
+    ULONG_PTR dwLower;
+    ULONG_PTR dwUpper;
+} SecHandle, *PSecHandle;
+#endif
+
 typedef UNICODE_STRING LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
 typedef STRING LSA_STRING, *PLSA_STRING;
 typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES;
@@ -349,6 +358,102 @@ typedef enum _POLICY_NOTIFICATION_INFORMATION_CLASS
 static const WCHAR MICROSOFT_KERBEROS_NAME_W[] = { 'K','e','r','b','e','r','o','s',0 };
 #endif
 
+#define KERB_TICKET_FLAGS_reserved          0x80000000
+#define KERB_TICKET_FLAGS_forwardable       0x40000000
+#define KERB_TICKET_FLAGS_forwarded         0x20000000
+#define KERB_TICKET_FLAGS_proxiable         0x10000000
+#define KERB_TICKET_FLAGS_proxy             0x08000000
+#define KERB_TICKET_FLAGS_may_postdate      0x04000000
+#define KERB_TICKET_FLAGS_postdated         0x02000000
+#define KERB_TICKET_FLAGS_invalid           0x01000000
+#define KERB_TICKET_FLAGS_renewable         0x00800000
+#define KERB_TICKET_FLAGS_initial           0x00400000
+#define KERB_TICKET_FLAGS_pre_authent       0x00200000
+#define KERB_TICKET_FLAGS_hw_authent        0x00100000
+#define KERB_TICKET_FLAGS_ok_as_delegate    0x00040000
+#define KERB_TICKET_FLAGS_name_canonicalize 0x00010000
+#define KERB_TICKET_FLAGS_cname_in_pa_data  0x00040000
+#define KERB_TICKET_FLAGS_reserved1         0x00000001
+
+typedef enum _KERB_PROTOCOL_MESSAGE_TYPE
+{
+    KerbDebugRequestMessage = 0,
+    KerbQueryTicketCacheMessage,
+    KerbChangeMachinePasswordMessage,
+    KerbVerifyPacMessage,
+    KerbRetrieveTicketMessage,
+    KerbUpdateAddressesMessage,
+    KerbPurgeTicketCacheMessage,
+    KerbChangePasswordMessage,
+    KerbRetrieveEncodedTicketMessage,
+    KerbDecryptDataMessage,
+    KerbAddBindingCacheEntryMessage,
+    KerbSetPasswordMessage,
+    KerbSetPasswordExMessage,
+    KerbVerifyCredentialsMessage,
+    KerbQueryTicketCacheExMessage,
+    KerbPurgeTicketCacheExMessage,
+    KerbRefreshSmartcardCredentialsMessage,
+    KerbAddExtraCredentialsMessage,
+    KerbQuerySupplementalCredentialsMessage,
+    KerbTransferCredentialsMessage,
+    KerbQueryTicketCacheEx2Message,
+    KerbSubmitTicketMessage,
+    KerbAddExtraCredentialsExMessage,
+    KerbQueryKdcProxyCacheMessage,
+    KerbPurgeKdcProxyCacheMessage,
+    KerbQueryTicketCacheEx3Message,
+    KerbCleanupMachinePkinitCredsMessage,
+    KerbAddBindingCacheEntryExMessage,
+    KerbQueryBindingCacheMessage,
+    KerbPurgeBindingCacheMessage,
+    KerbQueryDomainExtendedPoliciesMessage,
+    KerbQueryS4U2ProxyCacheMessage
+} KERB_PROTOCOL_MESSAGE_TYPE, *PKERB_PROTOCOL_MESSAGE_TYPE;
+
+typedef struct _KERB_TICKET_CACHE_INFO
+{
+    UNICODE_STRING ServerName;
+    UNICODE_STRING RealmName;
+    LARGE_INTEGER StartTime;
+    LARGE_INTEGER EndTime;
+    LARGE_INTEGER RenewTime;
+    LONG EncryptionType;
+    ULONG TicketFlags;
+} KERB_TICKET_CACHE_INFO, *PKERB_TICKET_CACHE_INFO;
+
+typedef struct _KERB_QUERY_TKT_CACHE_REQUEST
+{
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    LUID LogonId;
+} KERB_QUERY_TKT_CACHE_REQUEST, *PKERB_QUERY_TKT_CACHE_REQUEST;
+
+typedef struct _KERB_QUERY_TKT_CACHE_RESPONSE
+{
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    ULONG CountOfTickets;
+    KERB_TICKET_CACHE_INFO Tickets[ANYSIZE_ARRAY];
+} KERB_QUERY_TKT_CACHE_RESPONSE, *PKERB_QUERY_TKT_CACHE_RESPONSE;
+
+typedef struct _KERB_RETRIEVE_TKT_REQUEST
+{
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    LUID LogonId;
+    UNICODE_STRING TargetName;
+    ULONG TicketFlags;
+    ULONG CacheOptions;
+    LONG EncryptionType;
+    SecHandle CredentialsHandle;
+} KERB_RETRIEVE_TKT_REQUEST, *PKERB_RETRIEVE_TKT_REQUEST;
+
+typedef struct _KERB_PURGE_TKT_CACHE_REQUEST
+{
+    KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    LUID LogonId;
+    UNICODE_STRING ServerName;
+    UNICODE_STRING RealmName;
+} KERB_PURGE_TKT_CACHE_REQUEST, *PKERB_PURGE_TKT_CACHE_REQUEST;
+
 #define RtlGenRandom                    SystemFunction036
 #define RtlEncryptMemory                SystemFunction040
 #define RtlDecryptMemory                SystemFunction041
-- 
2.15.1

    

Dmitry Timoshkov

Dmitry Timoshkov

Hans Leidekker

Alexandre Julliard

tags

participants (3)