JehanneOS/newlib
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Cygwin: s4uauth: drop fallback to MsV1_0 if Kerberos fails

Browse Source 
This never really worked.  While at it, restructure code to
do common stuff only in one spot.  Improve debug output.

Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
This commit is contained in:
Corinna Vinschen 2019-03-01 16:04:51 +01:00
parent 379598dd67
commit f18a161cff
1 changed files with 77 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

168
winsup/cygwin/sec_auth.cc
View File

@ -1509,7 +1509,7 @@ s4uauth (bool logon, PCWSTR domain, PCWSTR user, NTSTATUS &ret_status)
HANDLE lsa_hdl = NULL; HANDLE lsa_hdl = NULL;
LSA_OPERATIONAL_MODE sec_mode; LSA_OPERATIONAL_MODE sec_mode;
NTSTATUS status, sub_status; NTSTATUS status, sub_status;
bool try_kerb_auth; bool kerberos_auth;
ULONG package_id, size; ULONG package_id, size;
struct { struct {
LSA_STRING str; LSA_STRING str;
@ -1530,11 +1530,16 @@ s4uauth (bool logon, PCWSTR domain, PCWSTR user, NTSTATUS &ret_status)
if (logon) if (logon)
{ {
/* Register as logon process. */ /* Register as logon process. */
debug_printf ("Impersonation requested");
RtlInitAnsiString (&name, "Cygwin"); RtlInitAnsiString (&name, "Cygwin");
status = LsaRegisterLogonProcess (&name, &lsa_hdl, &sec_mode); status = LsaRegisterLogonProcess (&name, &lsa_hdl, &sec_mode);
} }
else else
status = LsaConnectUntrusted (&lsa_hdl); {
/* Connect untrusted to just create a identification token */
debug_printf ("Identification requested");
status = LsaConnectUntrusted (&lsa_hdl);
}
if (status != STATUS_SUCCESS) if (status != STATUS_SUCCESS)
{ {
debug_printf ("%s: %y", logon ? "LsaRegisterLogonProcess" debug_printf ("%s: %y", logon ? "LsaRegisterLogonProcess"
@ -1543,14 +1548,34 @@ s4uauth (bool logon, PCWSTR domain, PCWSTR user, NTSTATUS &ret_status)
goto out; goto out;
} }
/* Check if this is a domain user. If so, try Kerberos first. */ /* Check if this is a domain user. If so, use Kerberos. */
try_kerb_auth = cygheap->dom.member_machine () kerberos_auth = cygheap->dom.member_machine ()
&& wcscasecmp (domain, cygheap->dom.account_flat_name ()); && wcscasecmp (domain, cygheap->dom.account_flat_name ());
debug_printf ("kerb %d, domain member %d, user domain <%W>, machine <%W>",
kerberos_auth, cygheap->dom.member_machine (), domain,
cygheap->dom.account_flat_name ());
/* Connect to authentication package. */
RtlInitAnsiString (&name, kerberos_auth ? MICROSOFT_KERBEROS_NAME_A
: MSV1_0_PACKAGE_NAME);
status = LsaLookupAuthenticationPackage (lsa_hdl, &name, &package_id);
if (status != STATUS_SUCCESS)
{
debug_printf ("LsaLookupAuthenticationPackage: %y", status);
__seterrno_from_nt_status (status);
goto out;
}
/* Create origin. */ /* Create origin. */
stpcpy (origin.buf, "Cygwin"); stpcpy (origin.buf, "Cygwin");
RtlInitAnsiString (&origin.str, origin.buf); RtlInitAnsiString (&origin.str, origin.buf);
if (try_kerb_auth) /* Create token source. */
memcpy (ts.SourceName, "Cygwin.1", 8);
ts.SourceIdentifier.HighPart = 0;
ts.SourceIdentifier.LowPart = kerberos_auth ? 0x0105 : 0x0106;
if (kerberos_auth)
{ {
PWCHAR sam_name = tp.w_get (); PWCHAR sam_name = tp.w_get ();
PWCHAR upn_name = tp.w_get (); PWCHAR upn_name = tp.w_get ();
@ -1558,14 +1583,6 @@ s4uauth (bool logon, PCWSTR domain, PCWSTR user, NTSTATUS &ret_status)
KERB_S4U_LOGON *s4u_logon; KERB_S4U_LOGON *s4u_logon;
USHORT name_len; USHORT name_len;
RtlInitAnsiString (&name, MICROSOFT_KERBEROS_NAME_A);
status = LsaLookupAuthenticationPackage (lsa_hdl, &name, &package_id);
if (status != STATUS_SUCCESS)
{
debug_printf ("LsaLookupAuthenticationPackage: %y", status);
__seterrno_from_nt_status (status);
goto out;
}
wcpcpy (wcpcpy (wcpcpy (sam_name, domain), L"\\"), user); wcpcpy (wcpcpy (wcpcpy (sam_name, domain), L"\\"), user);
if (TranslateNameW (sam_name, NameSamCompatible, NameUserPrincipal, if (TranslateNameW (sam_name, NameSamCompatible, NameUserPrincipal,
upn_name, &size) == 0) upn_name, &size) == 0)
@ -1579,8 +1596,7 @@ s4uauth (bool logon, PCWSTR domain, PCWSTR user, NTSTATUS &ret_status)
translated_name, &size) == 0) translated_name, &size) == 0)
{ {
debug_printf ("TranslateNameW(%W, NameCanonical) %E", sam_name); debug_printf ("TranslateNameW(%W, NameCanonical) %E", sam_name);
debug_printf ("Fallback to MsV1_0 auth"); goto out;
goto msv1_0_auth; /* Fall through to MSV1_0 authentication */
} }
p = wcschr (translated_name, L'/'); p = wcschr (translated_name, L'/');
if (p) if (p)
@ -1600,84 +1616,54 @@ s4uauth (bool logon, PCWSTR domain, PCWSTR user, NTSTATUS &ret_status)
(PWCHAR) (s4u_logon + 1), (PWCHAR) (s4u_logon + 1),
name_len); name_len);
RtlAppendUnicodeToString (&s4u_logon->ClientUpn, upn_name); RtlAppendUnicodeToString (&s4u_logon->ClientUpn, upn_name);
debug_printf ("ClientUpn: <%S>", &s4u_logon->ClientUpn); debug_printf ("KerbS4ULogon: ClientUpn: <%S>", &s4u_logon->ClientUpn);
/* Create token source. */ }
memcpy (ts.SourceName, "Cygwin.1", 8); else
ts.SourceIdentifier.HighPart = 0; {
ts.SourceIdentifier.LowPart = 0x0105; /* Per MSDN MsV1_0S4ULogon is not implemented on Vista, but surprisingly
status = LsaLogonUser (lsa_hdl, (PLSA_STRING) &origin, Network, it works. */
package_id, authinf, authinf_size, NULL, MSV1_0_S4U_LOGON *s4u_logon;
&ts, (PVOID *) &profile, &size, USHORT user_len, domain_len;
&luid, &token, &quota, &sub_status);
switch (status) user_len = wcslen (user) * sizeof (WCHAR);
{ domain_len = wcslen (domain) * sizeof (WCHAR); /* Local machine */
case STATUS_SUCCESS: authinf_size = sizeof (MSV1_0_S4U_LOGON) + user_len + domain_len;
goto out; if (!authinf)
/* These failures are fatal */ authinf = tp.c_get ();
case STATUS_QUOTA_EXCEEDED: RtlSecureZeroMemory (authinf, authinf_size);
case STATUS_LOGON_FAILURE: s4u_logon = (MSV1_0_S4U_LOGON *) authinf;
debug_printf ("Kerberos S4U LsaLogonUser failed: %y", status); s4u_logon->MessageType = MsV1_0S4ULogon;
goto out; s4u_logon->Flags = 0;
case STATUS_ACCOUNT_RESTRICTION: /* Append user and domain to login info */
debug_printf ("Kerberos S4U LsaLogonUser failed: %y (%s)", RtlInitEmptyUnicodeString (&s4u_logon->UserPrincipalName,
status, account_restriction (sub_status)); (PWCHAR) (s4u_logon + 1),
goto out; user_len);
default: RtlInitEmptyUnicodeString (&s4u_logon->DomainName,
break; (PWCHAR) ((PBYTE) (s4u_logon + 1) + user_len),
} domain_len);
debug_printf ("Kerberos S4U LsaLogonUser failed: %y, try MsV1_0", status); RtlAppendUnicodeToString (&s4u_logon->UserPrincipalName, user);
/* Fall through to MSV1_0 authentication */ RtlAppendUnicodeToString (&s4u_logon->DomainName, domain);
debug_printf ("MsV1_0S4ULogon: DomainName: <%S> UserPrincipalName: <%S>",
&s4u_logon->DomainName, &s4u_logon->UserPrincipalName);
} }
msv1_0_auth: /* Try to logon. */
MSV1_0_S4U_LOGON *s4u_logon; status = LsaLogonUser (lsa_hdl, (PLSA_STRING) &origin, Network, package_id,
USHORT user_len, domain_len; authinf, authinf_size, NULL, &ts, (PVOID *) &profile,
&size, &luid, &token, &quota, &sub_status);
/* Per MSDN MsV1_0S4ULogon is not implemented on Vista, but surprisingly switch (status)
it works. */
RtlInitAnsiString (&name, MSV1_0_PACKAGE_NAME);
status = LsaLookupAuthenticationPackage (lsa_hdl, &name, &package_id);
if (status != STATUS_SUCCESS)
{ {
debug_printf ("LsaLookupAuthenticationPackage: %y", status); case STATUS_SUCCESS:
__seterrno_from_nt_status (status); break;
goto out; case STATUS_ACCOUNT_RESTRICTION:
} debug_printf ("%s S4U LsaLogonUser failed: %y (%s)",
user_len = wcslen (user) * sizeof (WCHAR); kerberos_auth ? "Kerberos" : "MsV1_0", status,
domain_len = wcslen (domain) * sizeof (WCHAR); /* Local machine */ account_restriction (sub_status));
authinf_size = sizeof (MSV1_0_S4U_LOGON) + user_len + domain_len; break;
if (!authinf) default:
authinf = tp.c_get (); debug_printf ("%s S4U LsaLogonUser failed: %y",
RtlSecureZeroMemory (authinf, authinf_size); kerberos_auth ? "Kerberos" : "MsV1_0", status);
s4u_logon = (MSV1_0_S4U_LOGON *) authinf; break;
s4u_logon->MessageType = MsV1_0S4ULogon;
s4u_logon->Flags = 0;
/* Append user and domain to login info */
RtlInitEmptyUnicodeString (&s4u_logon->UserPrincipalName,
(PWCHAR) (s4u_logon + 1),
user_len);
RtlInitEmptyUnicodeString (&s4u_logon->DomainName,
(PWCHAR) ((PBYTE) (s4u_logon + 1) + user_len),
domain_len);
RtlAppendUnicodeToString (&s4u_logon->UserPrincipalName, user);
RtlAppendUnicodeToString (&s4u_logon->DomainName, domain);
debug_printf ("DomainName: <%S> UserPrincipalName: <%S>",
&s4u_logon->DomainName, &s4u_logon->UserPrincipalName);
/* Create token source. */
memcpy (ts.SourceName, "Cygwin.1", 8);
ts.SourceIdentifier.HighPart = 0;
ts.SourceIdentifier.LowPart = 0x0106;
if ((status = LsaLogonUser (lsa_hdl, (PLSA_STRING) &origin, Network,
package_id, authinf, authinf_size, NULL,
&ts, (PVOID *) &profile, &size,
&luid, &token, &quota, &sub_status))
!= STATUS_SUCCESS)
{
if (status == STATUS_ACCOUNT_RESTRICTION)
debug_printf ("MSV1_0 S4U LsaLogonUser failed: %y (%s)",
status, account_restriction (sub_status));
else
debug_printf ("MSV1_0 S4U LsaLogonUser failed: %y", status);
} }
out: out: