OS_Develop/Windows-Server-2003
OS_Develop/Windows-Server-2003
1
0
Fork 0
Code Pull Requests Activity
7507d3c0e1
Windows-Server-2003/inetsrv/iis/svcs/iissuba/subauth.c

2274 lines
63 KiB
C
Raw Blame History

/*++
Copyright (c) 1987-1996 Microsoft Corporation
Module Name:
subauth.c
Abstract:
Sample SubAuthentication Package.
Author:
Cliff Van Dyke (cliffv) 23-May-1994
Revisions:
Andy Herron (andyhe) 21-Jun-1994 Added code to read domain/user info
Philippe Choquier (phillich) 6-Jun-1996 Adapted for IIS
Environment:
User mode only.
Contains NT-specific code.
Requires ANSI C extensions: slash-slash comments, long external names.
--*/
#if ( _MSC_VER >= 800 )
#pragma warning ( 3 : 4100 ) // enable "Unreferenced formal parameter"
#pragma warning ( 3 : 4219 ) // enable "trailing ',' used for variable argument list"
#pragma warning ( disable : 4005 )
#endif
# include <nt.h>
# include <ntrtl.h>
# include <nturtl.h>
#define WIN32_NO_STATUS
#include <windef.h>
#undef WIN32_NO_STATUS
# include <windows.h>
#include <lmcons.h>
#include <lmaccess.h>
#include <lmapibuf.h>
#include <lsarpc.h>
#include <samrpc.h>
#include <crypt.h>
#include <sspi.h>
#include <secpkg.h>
#include <samisrv.h>
#include <debnot.h>
#include "subauth.h" // local copy :(
#include "md5.h"
UNICODE_STRING EmptyString = { 0, 0, NULL };
BOOLEAN
EqualComputerName(
IN PUNICODE_STRING String1,
IN PUNICODE_STRING String2
);
NTSTATUS
QuerySystemTime (
OUT PLARGE_INTEGER SystemTime
);
BOOL
GetPasswordExpired(
IN LARGE_INTEGER PasswordLastSet,
IN LARGE_INTEGER MaxPasswordAge
);
NTSTATUS
AccountRestrictions(
IN ULONG UserRid,
IN PUNICODE_STRING LogonWorkStation,
IN PUNICODE_STRING WorkStations,
IN PLOGON_HOURS LogonHours,
OUT PLARGE_INTEGER LogoffTime,
OUT PLARGE_INTEGER KickoffTime
);
LARGE_INTEGER
NetpSecondsToDeltaTime(
IN ULONG Seconds
);
VOID
InitUnicodeString(
OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString OPTIONAL
);
VOID
CopyUnicodeString(
OUT PUNICODE_STRING DestinationString,
IN PUNICODE_STRING SourceString OPTIONAL
);
BOOL
SubaAllocateString(
STRING *pS,
UINT cS
)
{
if ( pS->Buffer = (CHAR*)RtlAllocateHeap( RtlProcessHeap(),
HEAP_ZERO_MEMORY,
cS ) )
{
pS->MaximumLength = (USHORT)cS;
pS->Length = 0;
return TRUE;
}
pS->MaximumLength = 0;
pS->Length = 0;
return FALSE;
}
NTSTATUS
ToHex16(
LPBYTE pSrc,
PANSI_STRING pDst
)
{
char achH[16*2+1];
UINT x,y;
#define TOAHEX(a) ((a)>=10 ? 'a'+(a)-10 : '0'+(a))
for ( x = 0, y = 0 ; x < 16 ; ++x )
{
UINT v;
v = pSrc[x]>>4;
achH[y++] = TOAHEX( v );
v = pSrc[x]&0x0f;
achH[y++] = TOAHEX( v );
}
achH[y] = '\0';
return RtlAppendAsciizToString( (PSTRING)pDst, achH );
}
BOOL Extract(
CHAR **ppch,
LPSTR* ppszTok
)
{
CHAR *pch = *ppch;
if ( *pch )
{
*ppszTok = pch;
while ( *pch && *pch != '"' )
{
++pch;
}
if ( *pch == '"' )
{
*pch++ = '\0';
}
*ppch = pch;
return TRUE;
}
return FALSE;
}
BOOL
WINAPI
NetUserCookieW(
LPWSTR lpwszUserName,
UINT cNameLen,
DWORD dwSeed,
LPWSTR lpwszCookieBuff,
DWORD dwBuffSize
)
/*++
Routine Description:
Compute logon validator ( to be used as password )
for IISSuba
Arguments:
lpszUsername -- user name
dwSeed -- start value of cookie
Returns:
TRUE if success, FALSE if error
--*/
{
UINT x,y,v;
#define TOHEX(a) ((a)>=10 ? L'a'+(a)-10 : L'0'+(a))
if ( dwBuffSize < sizeof(dwSeed)*2*sizeof(WCHAR) + sizeof(WCHAR) )
{
SetLastError( ERROR_INSUFFICIENT_BUFFER );
return FALSE;
}
while ( cNameLen-- )
{
dwSeed = ((dwSeed << 5) | ( dwSeed >> 27 )) ^ ((*lpwszUserName++)&0xff);
}
for ( x = 0, y = 0 ; x < sizeof(dwSeed) ; ++x )
{
v = ((LPBYTE)&dwSeed)[x]>>4;
lpwszCookieBuff[y++] = TOHEX( v );
v = ((LPBYTE)&dwSeed)[x]&0x0f;
lpwszCookieBuff[y++] = TOHEX( v );
}
lpwszCookieBuff[y] = '\0';
return TRUE;
}
NTSTATUS
Msv1_0SubAuthenticationRoutineEx(
IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
IN PVOID LogonInformation,
IN ULONG Flags,
IN PUSER_ALL_INFORMATION UserAll,
IN SAM_HANDLE UserHandle,
IN OUT PMSV1_0_VALIDATION_INFO ValidationInfo,
OUT PULONG ActionsPerformed
)
/*++
Routine Description:
The subauthentication routine does client/server specific authentication
of a user. The credentials of the user are passed in addition to all the
information from SAM defining the user. This routine decides whether to
let the user log on.
Arguments:
LogonLevel -- Specifies the level of information given in
LogonInformation.
LogonInformation -- Specifies the description for the user
logging on. The LogonDomainName field should be ignored.
Flags - Flags describing the circumstances of the logon.
MSV1_0_PASSTHRU -- This is a PassThru authenication. (i.e., the
user isn't connecting to this machine.)
MSV1_0_GUEST_LOGON -- This is a retry of the logon using the GUEST
user account.
UserAll -- The description of the user as returned from SAM.
WhichFields -- Returns which fields from UserAllInfo are to be written
back to SAM. The fields will only be written if MSV returns success
to it's caller. Only the following bits are valid.
USER_ALL_PARAMETERS - Write UserAllInfo->Parameters back to SAM. If
the size of the buffer is changed, Msv1_0SubAuthenticationRoutine
must delete the old buffer using MIDL_user_free() and reallocate the
buffer using MIDL_user_allocate().
UserFlags -- Returns UserFlags to be returned from LsaLogonUser in the
LogonProfile. The following bits are currently defined:
LOGON_GUEST -- This was a guest logon
LOGON_NOENCRYPTION -- The caller didn't specify encrypted credentials
SubAuthentication packages should restrict themselves to returning
bits in the high order byte of UserFlags. However, this convention
isn't enforced giving the SubAuthentication package more flexibility.
Authoritative -- Returns whether the status returned is an
authoritative status which should be returned to the original
caller. If not, this logon request may be tried again on another
domain controller. This parameter is returned regardless of the
status code.
LogoffTime - Receives the time at which the user should log off the
system. This time is specified as a GMT relative NT system time.
KickoffTime - Receives the time at which the user should be kicked
off the system. This time is specified as a GMT relative system
time. Specify, a full scale positive number if the user isn't to
be kicked off.
Return Value:
STATUS_SUCCESS: if there was no error.
STATUS_NO_SUCH_USER: The specified user has no account.
STATUS_WRONG_PASSWORD: The password was invalid.
STATUS_INVALID_INFO_CLASS: LogonLevel is invalid.
STATUS_ACCOUNT_LOCKED_OUT: The account is locked out
STATUS_ACCOUNT_DISABLED: The account is disabled
STATUS_ACCOUNT_EXPIRED: The account has expired.
STATUS_PASSWORD_MUST_CHANGE: Account is marked as Password must change
on next logon.
STATUS_PASSWORD_EXPIRED: The Password is expired.
STATUS_INVALID_LOGON_HOURS - The user is not authorized to log on at
this time.
STATUS_INVALID_WORKSTATION - The user is not authorized to log on to
the specified workstation.
--*/
{
NTSTATUS Status;
ULONG UserAccountControl;
LARGE_INTEGER LogonTime;
LARGE_INTEGER PasswordDateSet;
UNICODE_STRING LocalWorkstation;
WCHAR achCookie[64];
ANSI_STRING strA1;
ANSI_STRING strA2;
ANSI_STRING strDigest;
ANSI_STRING AnsiPwd;
MD5_CTX md5;
CHAR *pch;
LPSTR pszRealm;
LPSTR pszUri;
LPSTR pszMethod;
LPSTR pszNonce;
LPSTR pszServerNonce;
LPSTR pszDigest;
LPSTR pszDigestUsername;
LPSTR pszQOP;
LPSTR pszCNonce;
LPSTR pszNC;
PNETLOGON_NETWORK_INFO LogonNetworkInfo;
UINT l;
PUNICODE_STRING pPwd = NULL;
UNICODE_STRING PackageName;
UNICODE_STRING UserPwd;
VOID *pvPlainPwd = NULL;
ULONG ulLength = 0;
BOOL fNTDigest = FALSE;
CHAR achAnsiPwdBuffer[MAX_PASSWD_LEN + 1];
strA1.Buffer = NULL;
strA2.Buffer = NULL;
strDigest.Buffer = NULL;
AnsiPwd.Buffer = achAnsiPwdBuffer;
AnsiPwd.Length = AnsiPwd.MaximumLength = MAX_PASSWD_LEN;
//
// Check whether the SubAuthentication package supports this type
// of logon.
//
(VOID) QuerySystemTime( &LogonTime );
switch ( LogonLevel ) {
case NetlogonInteractiveInformation:
case NetlogonServiceInformation:
//
// This SubAuthentication package only supports network logons.
//
return STATUS_INVALID_INFO_CLASS;
case NetlogonNetworkInformation:
//
// This SubAuthentication package doesn't support access via machine
// accounts.
//
UserAccountControl = USER_NORMAL_ACCOUNT;
//
// Local user (Temp Duplicate) accounts are only used on the machine
// being directly logged onto.
// (Nor are interactive or service logons allowed to them.)
//
if ( (Flags & MSV1_0_PASSTHRU) == 0 ) {
UserAccountControl |= USER_TEMP_DUPLICATE_ACCOUNT;
}
LogonNetworkInfo = (PNETLOGON_NETWORK_INFO) LogonInformation;
break;
default:
return STATUS_INVALID_INFO_CLASS;
}
//
// Check the password.
//
#define IIS_SUBAUTH_SEED 0x8467fd31
switch( ((WCHAR*)(LogonNetworkInfo->NtChallengeResponse.Buffer))[0] )
{
case L'0':
if ( !NetUserCookieW( LogonNetworkInfo->Identity.UserName.Buffer,
LogonNetworkInfo->Identity.UserName.Length/sizeof(WCHAR),
IIS_SUBAUTH_SEED,
achCookie,
sizeof(achCookie ))
|| memcmp( (LPBYTE)achCookie,
((WCHAR*)LogonNetworkInfo->NtChallengeResponse.Buffer)+2,
wcslen(achCookie)*sizeof(WCHAR)
) )
{
wrong_pwd:
Status = STATUS_WRONG_PASSWORD;
}
else
{
Status = STATUS_SUCCESS;
}
goto Cleanup;
break;
case L'1':
// NTLM digest authentication
fNTDigest = TRUE;
//fall through
case L'2':
//"Normal" digest authentication
// break fields
pch = LogonNetworkInfo->LmChallengeResponse.Buffer;
if ( !Extract( &pch, &pszRealm ) || // skip 1st field
!Extract( &pch, &pszRealm ) ||
!Extract( &pch, &pszUri ) ||
!Extract( &pch, &pszMethod ) ||
!Extract( &pch, &pszNonce ) ||
!Extract( &pch, &pszServerNonce ) ||
!Extract( &pch, &pszDigest ) ||
!Extract( &pch, &pszDigestUsername ) ||
!Extract( &pch, &pszQOP ) ||
!Extract( &pch, &pszCNonce ) ||
!Extract( &pch, &pszNC ) )
{
Status = STATUS_ACCESS_DENIED;
goto Cleanup;
}
//
// For NTLM Digest, use the NT hash of the password passed in
// For 'normal' Digest, use the cleartext
//
if ( fNTDigest )
{
if ( UserAll->NtPasswordPresent )
{
pPwd = &UserAll->NtPassword;
}
else if ( UserAll->LmPasswordPresent )
{
pPwd = &UserAll->LmPassword;
}
else
{
pPwd = &EmptyString;
}
}
else
{
//
// Retrieve the plaintext password
//
// NOTE : On NT 5, this API only works on Domain Controllers !!
//
PackageName.Buffer = SAM_CLEARTEXT_CREDENTIAL_NAME;
PackageName.Length = PackageName.MaximumLength = (USHORT)
wcslen( SAM_CLEARTEXT_CREDENTIAL_NAME ) * sizeof(WCHAR);
Status = SamIRetrievePrimaryCredentials( (SAMPR_HANDLE) UserHandle,
&PackageName,
&pvPlainPwd,
&ulLength );
if ( !NT_SUCCESS( Status ) )
{
#if DBG
CHAR achErrorString[256];
wsprintf(achErrorString, "Failed to retrieve plaintext password, error 0x%x\n",
Status);
OutputDebugString(achErrorString);
#endif //DBG
//
// Explicitly set the status to be "wrong password" instead of whatever
// is returned by SamIRetrievePrimaryCredentials
//
Status = STATUS_WRONG_PASSWORD;
goto Cleanup;
}
else
{
PSAMPR_USER_INFO_BUFFER pUserInfo = NULL;
//
// Need to differentiate between an empty password and
// a non-existant/unaccessible password
//
if ( ulLength == 0 )
{
Status = SamrQueryInformationUser( UserHandle,
UserAllInformation,
&pUserInfo );
if ( !NT_SUCCESS( Status ) )
{
Status = STATUS_ACCESS_DENIED;
goto Cleanup;
}
if ( pUserInfo->All.LmPasswordPresent ||
pUserInfo->All.NtPasswordPresent )
{
Status = STATUS_WRONG_PASSWORD;
SamIFree_SAMPR_USER_INFO_BUFFER( pUserInfo,
UserAllInformation );
goto Cleanup;
}
SamIFree_SAMPR_USER_INFO_BUFFER( pUserInfo,
UserAllInformation );
}
UserPwd.Buffer = (USHORT *) pvPlainPwd;
UserPwd.Length = UserPwd.MaximumLength = (USHORT) ulLength;
}
//
// The unicode password has to be converted to ANSI
//
if ( !NT_SUCCESS( Status = RtlUnicodeStringToAnsiString( &AnsiPwd,
&UserPwd,
FALSE ) ) )
{
goto Cleanup;
}
}
//
// A1 = username:realm:password
//
SubaAllocateString( &strA1, strlen( pszDigestUsername ) +
//wcslen(UserAll->UserName.Buffer) +
strlen(pszRealm) +
( fNTDigest ? 32 : AnsiPwd.Length ) +
+2 +1 +32 );
if ( !NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA1, pszDigestUsername ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA1, ":" ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA1, pszRealm ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA1, ":" )) ||
(fNTDigest ? !NT_SUCCESS( Status = ToHex16( (LPBYTE)(pPwd->Buffer), &strA1 ) ) :
!NT_SUCCESS( Status = RtlAppendAsciizToString( &strA1, AnsiPwd.Buffer ) ) ) )
{
goto Cleanup;
}
//
// A2 = Method:URI
//
if ( !SubaAllocateString( &strA2, strlen(pszMethod)+1+strlen(pszUri)+1+32 ) )
{
Status = STATUS_NO_MEMORY;
goto Cleanup;
}
if ( !NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA2, pszMethod ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA2, ":" ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA2, pszUri ) ) )
{
goto Cleanup;
}
if ( !SubaAllocateString( &strDigest, 32 + 1 + strlen(pszNonce) + 1 + 32 +1 +32 + strlen(pszCNonce) + 32) )
{
Status = STATUS_NO_MEMORY;
goto Cleanup;
}
//
// build response digest as per Digest Auth spec
// Response Digest = KD( H(A1), nonce : H(A2) )
// = H( H(A1) : nonce : H(A2) )
// In our case, the hash function is MD5
//
// H(A1)
MD5Init( &md5 );
MD5Update( &md5, (LPBYTE)strA1.Buffer, strA1.Length );
MD5Final( &md5 );
if ( !NT_SUCCESS( Status = ToHex16( md5.digest, &strDigest ) ) )
{
goto Cleanup;
}
// ":" nonce ":"
if ( !NT_SUCCESS( Status = RtlAppendAsciizToString ( &strDigest, ":" ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strDigest, pszNonce ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strDigest, ":" ) ) )
{
goto Cleanup;
}
if ( strcmp( pszQOP, "none" ) )
{
if ( strcmp( pszQOP, "auth" ) )
{
Status = STATUS_ACCESS_DENIED;
goto Cleanup;
}
if ( !NT_SUCCESS( Status = RtlAppendAsciizToString( &strDigest, pszNC ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString( &strDigest, ":" ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString( &strDigest, pszCNonce ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString( &strDigest, ":" ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString( &strDigest, pszQOP ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString( &strDigest, ":" ) ) )
{
goto Cleanup;
}
}
// H(A2)
MD5Init( &md5 );
MD5Update( &md5, (LPBYTE)strA2.Buffer, strA2.Length );
MD5Final( &md5 );
if ( !NT_SUCCESS( ToHex16( md5.digest, &strDigest ) ) )
{
goto Cleanup;
}
// H( H(A1) ":" nonce ":" H(A2) ) if QOP not set
// H( H(A1) ":" nonce ":" nc ":" cnonce ":" qop ":" H(A2) if set
MD5Init( &md5 );
MD5Update( &md5, (LPBYTE)strDigest.Buffer, strDigest.Length );
MD5Final( &md5 );
strDigest.Length = 0;
if ( !NT_SUCCESS( Status = ToHex16( md5.digest, &strDigest ) ) )
{
goto Cleanup;
}
if ( memcmp( strDigest.Buffer, pszDigest, strDigest.Length ) )
{
Status = STATUS_WRONG_PASSWORD;
goto Cleanup;
}
else
{
Status = STATUS_SUCCESS;
goto Cleanup;
}
// checking for stalled nonce must be made by caller
break;
default:
goto wrong_pwd;
}
//
// Cleanup up before returning.
//
Cleanup:
if ( strA1.Buffer )
{
RtlFreeHeap(RtlProcessHeap(), 0, strA1.Buffer );
}
if ( strA2.Buffer )
{
RtlFreeHeap(RtlProcessHeap(), 0, strA2.Buffer );
}
if ( strDigest.Buffer )
{
RtlFreeHeap(RtlProcessHeap(), 0, strDigest.Buffer );
}
if ( pvPlainPwd )
{
RtlFreeHeap(RtlProcessHeap(), 0, pvPlainPwd);
}
//
// the only thing we did was check the password
//
ValidationInfo;
UserHandle;
*ActionsPerformed = MSV1_0_SUBAUTH_PASSWORD;
return Status;
} // Msv1_0SubAuthenticationRoutineEx
BOOL
GetPasswordExpired (
IN LARGE_INTEGER PasswordLastSet,
IN LARGE_INTEGER MaxPasswordAge
)
/*++
Routine Description:
This routine returns true if the password is expired, false otherwise.
Arguments:
PasswordLastSet - Time when the password was last set for this user.
MaxPasswordAge - Maximum password age for any password in the domain.
Return Value:
Returns true if password is expired. False if not expired.
--*/
{
LARGE_INTEGER PasswordMustChange;
NTSTATUS Status;
BOOLEAN rc;
LARGE_INTEGER TimeNow;
//
// Compute the expiration time as the time the password was
// last set plus the maximum age.
//
if ( PasswordLastSet.QuadPart < 0 || MaxPasswordAge.QuadPart > 0 ) {
rc = TRUE; // default for invalid times is that it is expired.
} else {
__try {
PasswordMustChange.QuadPart =
PasswordLastSet.QuadPart - MaxPasswordAge.QuadPart;
//
// Limit the resultant time to the maximum valid absolute time
//
if ( PasswordMustChange.QuadPart < 0 ) {
rc = FALSE;
} else {
Status = QuerySystemTime( &TimeNow );
if (NT_SUCCESS(Status)) {
if ( TimeNow.QuadPart >= PasswordMustChange.QuadPart ) {
rc = TRUE;
} else {
rc = FALSE;
}
} else {
rc = FALSE; // won't fail if QuerySystemTime failed.
}
}
} __except(EXCEPTION_EXECUTE_HANDLER) {
rc = TRUE;
}
}
return rc;
} // GetPasswordExpired
NTSTATUS
QuerySystemTime (
OUT PLARGE_INTEGER SystemTime
)
/*++
Routine Description:
This function returns the absolute system time. The time is in units of
100nsec ticks since the base time which is midnight January 1, 1601.
Arguments:
SystemTime - Supplies the address of a variable that will receive the
current system time.
Return Value:
STATUS_SUCCESS is returned if the service is successfully executed.
STATUS_ACCESS_VIOLATION is returned if the output parameter for the
system time cannot be written.
--*/
{
SYSTEMTIME CurrentTime;
GetSystemTime( &CurrentTime );
if ( !SystemTimeToFileTime( &CurrentTime, (LPFILETIME) SystemTime ) ) {
return STATUS_ACCESS_VIOLATION;
}
return STATUS_SUCCESS;
}
NTSTATUS
SampMatchworkstation(
IN PUNICODE_STRING LogonWorkStation,
IN PUNICODE_STRING WorkStations
)
/*++
Routine Description:
Check if the given workstation is a member of the list of workstations
given.
Arguments:
LogonWorkStations - UNICODE name of the workstation that the user is
trying to log into.
WorkStations - API list of workstations that the user is allowed to
log into.
Return Value:
STATUS_SUCCESS - The user is allowed to log into the workstation.
--*/
{
PWCHAR WorkStationName;
UNICODE_STRING Unicode;
NTSTATUS NtStatus;
WCHAR Buffer[256];
USHORT LocalBufferLength = 256;
UNICODE_STRING WorkStationsListCopy;
BOOLEAN BufferAllocated = FALSE;
PWCHAR TmpBuffer;
//
// Local workstation is always allowed
// If WorkStations field is 0 everybody is allowed
//
if ( ( LogonWorkStation == NULL ) ||
( LogonWorkStation->Length == 0 ) ||
( WorkStations->Length == 0 ) ) {
return( STATUS_SUCCESS );
}
//
// Assume failure; change status only if we find the string.
//
NtStatus = STATUS_INVALID_WORKSTATION;
//
// WorkStationApiList points to our current location in the list of
// WorkStations.
//
if ( WorkStations->Length > LocalBufferLength ) {
WorkStationsListCopy.Buffer = LocalAlloc( 0, WorkStations->Length );
BufferAllocated = TRUE;
if ( WorkStationsListCopy.Buffer == NULL ) {
NtStatus = STATUS_INSUFFICIENT_RESOURCES;
return( NtStatus );
}
WorkStationsListCopy.MaximumLength = WorkStations->Length;
} else {
WorkStationsListCopy.Buffer = Buffer;
WorkStationsListCopy.MaximumLength = LocalBufferLength;
}
CopyUnicodeString( &WorkStationsListCopy, WorkStations );
//
// wcstok requires a string the first time it's called, and NULL
// for all subsequent calls. Use a temporary variable so we
// can do this.
//
TmpBuffer = WorkStationsListCopy.Buffer;
while( WorkStationName = wcstok(TmpBuffer, L",") ) {
TmpBuffer = NULL;
InitUnicodeString( &Unicode, WorkStationName );
if (EqualComputerName( &Unicode, LogonWorkStation )) {
NtStatus = STATUS_SUCCESS;
break;
}
}
if ( BufferAllocated ) {
LocalFree( WorkStationsListCopy.Buffer );
}
return( NtStatus );
}
NTSTATUS
AccountRestrictions(
IN ULONG UserRid,
IN PUNICODE_STRING LogonWorkStation,
IN PUNICODE_STRING WorkStations,
IN PLOGON_HOURS LogonHours,
OUT PLARGE_INTEGER LogoffTime,
OUT PLARGE_INTEGER KickoffTime
)
/*++
Routine Description:
Validate a user's ability to log on at this time and at the workstation
being logged onto.
Arguments:
UserRid - The user id of the user to operate on.
LogonWorkStation - The name of the workstation the logon is being
attempted at.
WorkStations - The list of workstations the user may log on to. This
information comes from the user's account information. It must
be in API list format.
LogonHours - The times the user may logon. This information comes
from the user's account information.
LogoffTime - Receives the time at which the user should log off the
system.
KickoffTime - Receives the time at which the user should be kicked
off the system.
Return Value:
STATUS_SUCCESS - Logon is permitted.
STATUS_INVALID_LOGON_HOURS - The user is not authorized to log on at
this time.
STATUS_INVALID_WORKSTATION - The user is not authorized to log on to
the specified workstation.
--*/
{
static BOOLEAN GetForceLogoff = TRUE;
static LARGE_INTEGER ForceLogoff = { 0x7fffffff, 0xFFFFFFF};
#define MILLISECONDS_PER_WEEK 7 * 24 * 60 * 60 * 1000
SYSTEMTIME CurrentTimeFields;
LARGE_INTEGER CurrentTime, CurrentUTCTime;
LARGE_INTEGER MillisecondsIntoWeekXUnitsPerWeek;
LARGE_INTEGER LargeUnitsIntoWeek;
LARGE_INTEGER Delta100Ns;
NTSTATUS NtStatus = STATUS_SUCCESS;
ULONG CurrentMsIntoWeek;
ULONG LogoffMsIntoWeek;
ULONG DeltaMs;
ULONG MillisecondsPerUnit;
ULONG CurrentUnitsIntoWeek;
ULONG LogoffUnitsIntoWeek;
USHORT i;
TIME_ZONE_INFORMATION TimeZoneInformation;
DWORD TimeZoneId;
LARGE_INTEGER BiasIn100NsUnits;
LONG BiasInMinutes;
//
// Only check for users other than the builtin ADMIN
//
if ( UserRid != DOMAIN_USER_RID_ADMIN) {
//
// Scan to make sure the workstation being logged into is in the
// list of valid workstations - or if the list of valid workstations
// is null, which means that all are valid.
//
NtStatus = SampMatchworkstation( LogonWorkStation, WorkStations );
if ( NT_SUCCESS( NtStatus ) ) {
//
// Check to make sure that the current time is a valid time to log
// on in the LogonHours.
//
// We need to validate the time taking into account whether we are
// in daylight savings time or standard time. Thus, if the logon
// hours specify that we are able to log on between 9am and 5pm,
// this means 9am to 5pm standard time during the standard time
// period, and 9am to 5pm daylight savings time when in the
// daylight savings time. Since the logon hours stored by SAM are
// independent of daylight savings time, we need to add in the
// difference between standard time and daylight savings time to
// the current time before checking whether this time is a valid
// time to log on. Since this difference (or bias as it is called)
// is actually held in the form
//
// Standard time = Daylight savings time + Bias
//
// the Bias is a negative number. Thus we actually subtract the
// signed Bias from the Current Time.
//
// First, get the Time Zone Information.
//
TimeZoneId = GetTimeZoneInformation(
(LPTIME_ZONE_INFORMATION) &TimeZoneInformation
);
//
// Next, get the appropriate bias (signed integer in minutes) to subtract from
// the Universal Time Convention (UTC) time returned by NtQuerySystemTime
// to get the local time. The bias to be used depends whether we're
// in Daylight Savings time or Standard Time as indicated by the
// TimeZoneId parameter.
//
// local time = UTC time - bias in 100Ns units
//
switch (TimeZoneId) {
case TIME_ZONE_ID_UNKNOWN:
//
// There is no differentiation between standard and
// daylight savings time. Proceed as for Standard Time
//
BiasInMinutes = TimeZoneInformation.StandardBias;
break;
case TIME_ZONE_ID_STANDARD:
BiasInMinutes = TimeZoneInformation.StandardBias;
break;
case TIME_ZONE_ID_DAYLIGHT:
BiasInMinutes = TimeZoneInformation.DaylightBias;
break;
default:
//
// Something is wrong with the time zone information. Fail
// the logon request.
//
NtStatus = STATUS_INVALID_LOGON_HOURS;
break;
}
if (NT_SUCCESS(NtStatus)) {
//
// Convert the Bias from minutes to 100ns units
//
BiasIn100NsUnits.QuadPart = ((LONGLONG)BiasInMinutes)
* 60 * 10000000;
//
// Get the UTC time in 100Ns units used by Windows Nt. This
// time is GMT.
//
NtStatus = QuerySystemTime( &CurrentUTCTime );
}
if ( NT_SUCCESS( NtStatus ) ) {
CurrentTime.QuadPart = CurrentUTCTime.QuadPart -
BiasIn100NsUnits.QuadPart;
FileTimeToSystemTime( (PFILETIME)&CurrentTime, &CurrentTimeFields );
CurrentMsIntoWeek = (((( CurrentTimeFields.wDayOfWeek * 24 ) +
CurrentTimeFields.wHour ) * 60 +
CurrentTimeFields.wMinute ) * 60 +
CurrentTimeFields.wSecond ) * 1000 +
CurrentTimeFields.wMilliseconds;
MillisecondsIntoWeekXUnitsPerWeek.QuadPart =
((LONGLONG)CurrentMsIntoWeek) *
((LONGLONG)LogonHours->UnitsPerWeek);
LargeUnitsIntoWeek.QuadPart =
MillisecondsIntoWeekXUnitsPerWeek.QuadPart / ((ULONG) MILLISECONDS_PER_WEEK);
CurrentUnitsIntoWeek = LargeUnitsIntoWeek.LowPart;
if ( !( LogonHours->LogonHours[ CurrentUnitsIntoWeek / 8] &
( 0x01 << ( CurrentUnitsIntoWeek % 8 ) ) ) ) {
NtStatus = STATUS_INVALID_LOGON_HOURS;
} else {
//
// Determine the next time that the user is NOT supposed to be logged
// in, and return that as LogoffTime.
//
i = 0;
LogoffUnitsIntoWeek = CurrentUnitsIntoWeek;
do {
i++;
LogoffUnitsIntoWeek = ( LogoffUnitsIntoWeek + 1 ) % LogonHours->UnitsPerWeek;
} while ( ( i <= LogonHours->UnitsPerWeek ) &&
( LogonHours->LogonHours[ LogoffUnitsIntoWeek / 8 ] &
( 0x01 << ( LogoffUnitsIntoWeek % 8 ) ) ) );
if ( i > LogonHours->UnitsPerWeek ) {
//
// All times are allowed, so there's no logoff
// time. Return forever for both LogoffTime and
// KickoffTime.
//
LogoffTime->HighPart = 0x7FFFFFFF;
LogoffTime->LowPart = 0xFFFFFFFF;
KickoffTime->HighPart = 0x7FFFFFFF;
KickoffTime->LowPart = 0xFFFFFFFF;
} else {
//
// LogoffUnitsIntoWeek points at which time unit the
// user is to log off. Calculate actual time from
// the unit, and return it.
//
// CurrentTimeFields already holds the current
// time for some time during this week; just adjust
// to the logoff time during this week and convert
// to time format.
//
MillisecondsPerUnit = MILLISECONDS_PER_WEEK / LogonHours->UnitsPerWeek;
LogoffMsIntoWeek = MillisecondsPerUnit * LogoffUnitsIntoWeek;
if ( LogoffMsIntoWeek < CurrentMsIntoWeek ) {
DeltaMs = MILLISECONDS_PER_WEEK - ( CurrentMsIntoWeek - LogoffMsIntoWeek );
} else {
DeltaMs = LogoffMsIntoWeek - CurrentMsIntoWeek;
}
Delta100Ns.QuadPart = (LONGLONG) DeltaMs * 10000;
LogoffTime->QuadPart = CurrentUTCTime.QuadPart +
Delta100Ns.QuadPart;
//
// Grab the domain's ForceLogoff time.
//
if ( GetForceLogoff ) {
NET_API_STATUS NetStatus;
LPUSER_MODALS_INFO_0 UserModals0;
NetStatus = NetUserModalsGet( NULL,
0,
(LPBYTE *)&UserModals0 );
if ( NetStatus == 0 ) {
GetForceLogoff = FALSE;
ForceLogoff = NetpSecondsToDeltaTime( UserModals0->usrmod0_force_logoff );
NetApiBufferFree( UserModals0 );
}
}
//
// Subtract Domain->ForceLogoff from LogoffTime, and return
// that as KickoffTime. Note that Domain->ForceLogoff is a
// negative delta. If its magnitude is sufficiently large
// (in fact, larger than the difference between LogoffTime
// and the largest positive large integer), we'll get overflow
// resulting in a KickOffTime that is negative. In this
// case, reset the KickOffTime to this largest positive
// large integer (i.e. "never") value.
//
KickoffTime->QuadPart = LogoffTime->QuadPart - ForceLogoff.QuadPart;
if (KickoffTime->QuadPart < 0) {
KickoffTime->HighPart = 0x7FFFFFFF;
KickoffTime->LowPart = 0xFFFFFFFF;
}
}
}
}
}
} else {
//
// Never kick administrators off
//
LogoffTime->HighPart = 0x7FFFFFFF;
LogoffTime->LowPart = 0xFFFFFFFF;
KickoffTime->HighPart = 0x7FFFFFFF;
KickoffTime->LowPart = 0xFFFFFFFF;
}
return( NtStatus );
}
LARGE_INTEGER
NetpSecondsToDeltaTime(
IN ULONG Seconds
)
/*++
Routine Description:
Convert a number of seconds to an NT delta time specification
Arguments:
Seconds - a positive number of seconds
Return Value:
Returns the NT Delta time. NT delta time is a negative number
of 100ns units.
--*/
{
LARGE_INTEGER DeltaTime;
LARGE_INTEGER LargeSeconds;
LARGE_INTEGER Answer;
//
// Special case TIMEQ_FOREVER (return a full scale negative)
//
if ( Seconds == TIMEQ_FOREVER ) {
DeltaTime.LowPart = 0;
DeltaTime.HighPart = (LONG) 0x80000000;
//
// Convert seconds to 100ns units simply by multiplying by 10000000.
//
// Convert to delta time by negating.
//
} else {
LargeSeconds.LowPart = Seconds;
LargeSeconds.HighPart = 0;
Answer.QuadPart = LargeSeconds.QuadPart * 10000000;
if ( Answer.QuadPart < 0 ) {
DeltaTime.LowPart = 0;
DeltaTime.HighPart = (LONG) 0x80000000;
} else {
DeltaTime.QuadPart = -Answer.QuadPart;
}
}
return DeltaTime;
} // NetpSecondsToDeltaTime
BOOLEAN
EqualComputerName(
IN PUNICODE_STRING String1,
IN PUNICODE_STRING String2
)
/*++
Routine Description:
Compare two computer names for equality.
Arguments:
String1 - Name of first computer.
String2 - Name of second computer.
Return Value:
TRUE if the names, converted to OEM, compare case-insensitively,
FALSE if they don't compare or can't be converted to OEM.
--*/
{
WCHAR Computer1[CNLEN+1];
WCHAR Computer2[CNLEN+1];
CHAR OemComputer1[CNLEN+1];
CHAR OemComputer2[CNLEN+1];
//
// Make sure the names are not too long
//
if ((String1->Length > CNLEN*sizeof(WCHAR)) ||
(String2->Length > CNLEN*sizeof(WCHAR))) {
return(FALSE);
}
//
// Copy them to null terminated strings
//
CopyMemory(
Computer1,
String1->Buffer,
String1->Length
);
Computer1[String1->Length/sizeof(WCHAR)] = L'\0';
CopyMemory(
Computer2,
String2->Buffer,
String2->Length
);
Computer2[String2->Length/sizeof(WCHAR)] = L'\0';
//
// Convert the computer names to OEM
//
if (!CharToOemW(
Computer1,
OemComputer1
)) {
return(FALSE);
}
if (!CharToOemW(
Computer2,
OemComputer2
)) {
return(FALSE);
}
//
// Do a case insensitive comparison of the oem computer names.
//
if (lstrcmpiA(OemComputer1, OemComputer2) == 0)
{
return(TRUE);
}
else
{
return(FALSE);
}
}
VOID
InitUnicodeString(
OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString OPTIONAL
)
/*++
Routine Description:
The InitUnicodeString function initializes an NT counted
unicode string. The DestinationString is initialized to point to
the SourceString and the Length and MaximumLength fields of
DestinationString are initialized to the length of the SourceString,
which is zero if SourceString is not specified.
Arguments:
DestinationString - Pointer to the counted string to initialize
SourceString - Optional pointer to a null terminated unicode string that
the counted string is to point to.
Return Value:
None.
--*/
{
ULONG Length;
DestinationString->Buffer = (PWSTR)SourceString;
if (SourceString != NULL) {
Length = wcslen( SourceString ) * sizeof( WCHAR );
DestinationString->Length = (USHORT)Length;
DestinationString->MaximumLength = (USHORT)(Length + sizeof(UNICODE_NULL));
}
else {
DestinationString->MaximumLength = 0;
DestinationString->Length = 0;
}
}
VOID
CopyUnicodeString(
OUT PUNICODE_STRING DestinationString,
IN PUNICODE_STRING SourceString OPTIONAL
)
/*++
Routine Description:
The CopyString function copies the SourceString to the
DestinationString. If SourceString is not specified, then
the Length field of DestinationString is set to zero. The
MaximumLength and Buffer fields of DestinationString are not
modified by this function.
The number of bytes copied from the SourceString is either the
Length of SourceString or the MaximumLength of DestinationString,
whichever is smaller.
Arguments:
DestinationString - Pointer to the destination string.
SourceString - Optional pointer to the source string.
Return Value:
None.
--*/
{
UNALIGNED WCHAR *src, *dst;
ULONG n;
if (SourceString != NULL) {
dst = DestinationString->Buffer;
src = SourceString->Buffer;
n = SourceString->Length;
if ((USHORT)n > DestinationString->MaximumLength) {
n = DestinationString->MaximumLength;
}
DestinationString->Length = (USHORT)n;
CopyMemory(dst, src, n);
if (DestinationString->Length < DestinationString->MaximumLength) {
dst[n / sizeof(WCHAR)] = UNICODE_NULL;
}
} else {
DestinationString->Length = 0;
}
return;
}
#if 0
NTSTATUS
Msv1_0SubAuthenticationRoutine (
IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
IN PVOID LogonInformation,
IN ULONG Flags,
IN PUSER_ALL_INFORMATION UserAll,
OUT PULONG WhichFields,
OUT PULONG UserFlags,
OUT PBOOLEAN Authoritative,
OUT PLARGE_INTEGER LogoffTime,
OUT PLARGE_INTEGER KickoffTime
)
/*++
Routine Description:
The subauthentication routine does client/server specific authentication
of a user. The credentials of the user are passed in addition to all the
information from SAM defining the user. This routine decides whether to
let the user log on.
Arguments:
LogonLevel -- Specifies the level of information given in
LogonInformation.
LogonInformation -- Specifies the description for the user
logging on. The LogonDomainName field should be ignored.
Flags - Flags describing the circumstances of the logon.
MSV1_0_PASSTHRU -- This is a PassThru authenication. (i.e., the
user isn't connecting to this machine.)
MSV1_0_GUEST_LOGON -- This is a retry of the logon using the GUEST
user account.
UserAll -- The description of the user as returned from SAM.
WhichFields -- Returns which fields from UserAllInfo are to be written
back to SAM. The fields will only be written if MSV returns success
to it's caller. Only the following bits are valid.
USER_ALL_PARAMETERS - Write UserAllInfo->Parameters back to SAM. If
the size of the buffer is changed, Msv1_0SubAuthenticationRoutine
must delete the old buffer using MIDL_user_free() and reallocate the
buffer using MIDL_user_allocate().
UserFlags -- Returns UserFlags to be returned from LsaLogonUser in the
LogonProfile. The following bits are currently defined:
LOGON_GUEST -- This was a guest logon
LOGON_NOENCRYPTION -- The caller didn't specify encrypted credentials
SubAuthentication packages should restrict themselves to returning
bits in the high order byte of UserFlags. However, this convention
isn't enforced giving the SubAuthentication package more flexibility.
Authoritative -- Returns whether the status returned is an
authoritative status which should be returned to the original
caller. If not, this logon request may be tried again on another
domain controller. This parameter is returned regardless of the
status code.
LogoffTime - Receives the time at which the user should log off the
system. This time is specified as a GMT relative NT system time.
KickoffTime - Receives the time at which the user should be kicked
off the system. This time is specified as a GMT relative system
time. Specify, a full scale positive number if the user isn't to
be kicked off.
Return Value:
STATUS_SUCCESS: if there was no error.
STATUS_NO_SUCH_USER: The specified user has no account.
STATUS_WRONG_PASSWORD: The password was invalid.
STATUS_INVALID_INFO_CLASS: LogonLevel is invalid.
STATUS_ACCOUNT_LOCKED_OUT: The account is locked out
STATUS_ACCOUNT_DISABLED: The account is disabled
STATUS_ACCOUNT_EXPIRED: The account has expired.
STATUS_PASSWORD_MUST_CHANGE: Account is marked as Password must change
on next logon.
STATUS_PASSWORD_EXPIRED: The Password is expired.
STATUS_INVALID_LOGON_HOURS - The user is not authorized to log on at
this time.
STATUS_INVALID_WORKSTATION - The user is not authorized to log on to
the specified workstation.
--*/
{
NTSTATUS Status;
ULONG UserAccountControl;
LARGE_INTEGER LogonTime;
LARGE_INTEGER PasswordDateSet;
UNICODE_STRING LocalWorkstation;
WCHAR achCookie[64];
ANSI_STRING strA1;
ANSI_STRING strA2;
ANSI_STRING strDigest;
ANSI_STRING strPassword;
MD5_CTX md5;
CHAR *pch;
LPSTR pszRealm;
LPSTR pszUri;
LPSTR pszMethod;
LPSTR pszNonce;
LPSTR pszServerNonce;
LPSTR pszDigest;
LPSTR pszDigestUsername;
PNETLOGON_NETWORK_INFO LogonNetworkInfo;
UINT l;
PUNICODE_STRING pPwd;
strA1.Buffer = NULL;
strA2.Buffer = NULL;
strDigest.Buffer = NULL;
strPassword.Buffer = NULL;
//
// Check whether the SubAuthentication package supports this type
// of logon.
//
*Authoritative = TRUE;
*UserFlags = 0;
*WhichFields = 0;
(VOID) QuerySystemTime( &LogonTime );
switch ( LogonLevel ) {
case NetlogonInteractiveInformation:
case NetlogonServiceInformation:
//
// This SubAuthentication package only supports network logons.
//
return STATUS_INVALID_INFO_CLASS;
case NetlogonNetworkInformation:
//
// This SubAuthentication package doesn't support access via machine
// accounts.
//
UserAccountControl = USER_NORMAL_ACCOUNT;
//
// Local user (Temp Duplicate) accounts are only used on the machine
// being directly logged onto.
// (Nor are interactive or service logons allowed to them.)
//
if ( (Flags & MSV1_0_PASSTHRU) == 0 ) {
UserAccountControl |= USER_TEMP_DUPLICATE_ACCOUNT;
}
LogonNetworkInfo = (PNETLOGON_NETWORK_INFO) LogonInformation;
break;
default:
*Authoritative = TRUE;
return STATUS_INVALID_INFO_CLASS;
}
//
// If the account type isn't allowed,
// Treat this as though the User Account doesn't exist.
//
if ( (UserAccountControl & UserAll->UserAccountControl) == 0 ) {
*Authoritative = FALSE;
Status = STATUS_NO_SUCH_USER;
goto Cleanup;
}
//
// This SubAuthentication package doesn't allow guest logons.
//
if ( Flags & MSV1_0_GUEST_LOGON ) {
*Authoritative = FALSE;
Status = STATUS_NO_SUCH_USER;
goto Cleanup;
}
//
// Ensure the account isn't locked out.
//
if ( UserAll->UserId != DOMAIN_USER_RID_ADMIN &&
(UserAll->UserAccountControl & USER_ACCOUNT_AUTO_LOCKED) ) {
//
// Since the UI strongly encourages admins to disable user
// accounts rather than delete them. Treat disabled acccount as
// non-authoritative allowing the search to continue for other
// accounts by the same name.
//
if ( UserAll->UserAccountControl & USER_ACCOUNT_DISABLED ) {
*Authoritative = FALSE;
} else {
*Authoritative = TRUE;
}
Status = STATUS_ACCOUNT_LOCKED_OUT;
goto Cleanup;
}
//
// Check the password.
//
#define IIS_SUBAUTH_SEED 0x8467fd31
switch( ((WCHAR*)(LogonNetworkInfo->NtChallengeResponse.Buffer))[0] )
{
case L'0':
if ( !NetUserCookieW( LogonNetworkInfo->Identity.UserName.Buffer,
LogonNetworkInfo->Identity.UserName.Length/sizeof(WCHAR),
IIS_SUBAUTH_SEED,
achCookie,
sizeof(achCookie ))
|| memcmp( (LPBYTE)achCookie,
((WCHAR*)LogonNetworkInfo->NtChallengeResponse.Buffer)+2,
wcslen(achCookie)*sizeof(WCHAR)
) )
{
wrong_pwd:
Status = STATUS_WRONG_PASSWORD;
//
// Since the UI strongly encourages admins to disable user
// accounts rather than delete them. Treat disabled acccount as
// non-authoritative allowing the search to continue for other
// accounts by the same name.
//
if ( UserAll->UserAccountControl & USER_ACCOUNT_DISABLED ) {
*Authoritative = FALSE;
} else {
*Authoritative = TRUE;
}
goto Cleanup;
}
break;
case L'1':
// digest NTLM authentication
// break fields
pch = LogonNetworkInfo->LmChallengeResponse.Buffer;
if ( !Extract( &pch, &pszRealm ) || // skip 1st field
!Extract( &pch, &pszRealm ) ||
!Extract( &pch, &pszUri ) ||
!Extract( &pch, &pszMethod ) ||
!Extract( &pch, &pszNonce ) ||
!Extract( &pch, &pszServerNonce ) ||
!Extract( &pch, &pszDigest ) ||
!Extract( &pch, &pszDigestUsername ) )
{
Status = STATUS_INVALID_INFO_CLASS;
goto Cleanup;
}
if ( UserAll->NtPasswordPresent )
{
pPwd = &UserAll->NtPassword;
}
else if ( UserAll->LmPasswordPresent )
{
pPwd = &UserAll->LmPassword;
}
else
{
pPwd = &EmptyString;
}
// build A1 & A2 as per Digest-NTLM auth spec
SubaAllocateString( &strA1, strlen( pszDigestUsername ) +
//wcslen(UserAll->UserName.Buffer) +
strlen(pszRealm) +
32 //wcslen(pPwd)
+2 +1 +32
);
if ( !NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA1, pszDigestUsername ) ) ||
//!NT_SUCCESS( Status = RtlUnicodeStringToAnsiString( &strA1, &UserAll->UserName, FALSE )) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA1, ":" ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA1, pszRealm ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA1, ":" )) ||
!NT_SUCCESS( ToHex16( (LPBYTE)(pPwd->Buffer), &strA1 ) ) )
//!NT_SUCCESS( Status = RtlUnicodeStringToAnsiString( &strPassword, pPwd, TRUE ) ) ||
//!NT_SUCCESS( Status = RtlAppendStringToString( (PSTRING)&strA1, (PSTRING)&strPassword ) ) )
{
goto Cleanup;
}
SubaAllocateString( &strA2, strlen(pszMethod)+1+strlen(pszUri)+1+32 );
if ( !NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA2, pszMethod ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA2, ":" ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strA2, pszUri ) ) )
{
goto Cleanup;
}
SubaAllocateString( &strDigest, 32 + 1 + strlen(pszNonce) + 1 + 32 +1 +32 );
// build response digest as per Digest Auth spec
// H(A1)
MD5Init( &md5 );
MD5Update( &md5, (LPBYTE)strA1.Buffer, strA1.Length );
MD5Final( &md5 );
if ( !NT_SUCCESS( ToHex16( md5.digest, &strDigest ) ) )
{
goto Cleanup;
}
// ":" nonce ":"
if ( !NT_SUCCESS( Status = RtlAppendAsciizToString ( &strDigest, ":" ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strDigest, pszNonce ) ) ||
!NT_SUCCESS( Status = RtlAppendAsciizToString ( &strDigest, ":" ) ) )
{
goto Cleanup;
}
// H(A2)
MD5Init( &md5 );
MD5Update( &md5, (LPBYTE)strA2.Buffer, strA2.Length );
MD5Final( &md5 );
if ( !NT_SUCCESS( ToHex16( md5.digest, &strDigest ) ) )
{
goto Cleanup;
}
// H( H(A1) ":" nonce ":" H(A2) )
MD5Init( &md5 );
MD5Update( &md5, (LPBYTE)strDigest.Buffer, strDigest.Length );
MD5Final( &md5 );
strDigest.Length = 0;
if ( !NT_SUCCESS( ToHex16( md5.digest, &strDigest ) ) )
{
goto Cleanup;
}
if ( memcmp( strDigest.Buffer, pszDigest, strDigest.Length ) )
{
goto wrong_pwd;
}
// checking for stalled nonce must be made by caller
break;
default:
goto wrong_pwd;
}
//
// Prevent some things from effecting the Administrator user
//
if (UserAll->UserId == DOMAIN_USER_RID_ADMIN) {
//
// The administrator account doesn't have a forced logoff time.
//
LogoffTime->HighPart = 0x7FFFFFFF;
LogoffTime->LowPart = 0xFFFFFFFF;
KickoffTime->HighPart = 0x7FFFFFFF;
KickoffTime->LowPart = 0xFFFFFFFF;
} else {
//
// Check if the account is disabled.
//
if ( UserAll->UserAccountControl & USER_ACCOUNT_DISABLED ) {
//
// Since the UI strongly encourages admins to disable user
// accounts rather than delete them. Treat disabled acccount as
// non-authoritative allowing the search to continue for other
// accounts by the same name.
//
*Authoritative = FALSE;
Status = STATUS_ACCOUNT_DISABLED;
goto Cleanup;
}
//
// Check if the account has expired.
//
if ( UserAll->AccountExpires.QuadPart != 0 &&
LogonTime.QuadPart >= UserAll->AccountExpires.QuadPart ) {
*Authoritative = TRUE;
Status = STATUS_ACCOUNT_EXPIRED;
goto Cleanup;
}
//
// If your using SAM's password expiration date, use this code, otherwise
// use the code below and supply your own password set date...
//
#if 1
//
// The password is valid, check to see if the password is expired.
// (SAM will have appropriately set PasswordMustChange to reflect
// USER_DONT_EXPIRE_PASSWORD)
//
// If the password checked above is not the SAM password, you may
// want to consider not checking the SAM password expiration times here.
//
if ( LogonTime.QuadPart >= UserAll->PasswordMustChange.QuadPart ) {
if ( UserAll->PasswordLastSet.QuadPart == 0 ) {
Status = STATUS_PASSWORD_MUST_CHANGE;
} else {
Status = STATUS_PASSWORD_EXPIRED;
}
*Authoritative = TRUE;
goto Cleanup;
}
#elif 0
//
// Response is correct. So, check if the password has expired or not
//
if (! (UserAll->UserAccountControl & USER_DONT_EXPIRE_PASSWORD)) {
LARGE_INTEGER MaxPasswordAge;
MaxPasswordAge.HighPart = 0x7FFFFFFF;
MaxPasswordAge.LowPart = 0xFFFFFFFF;
//
// PasswordDateSet should be modified to hold the last date the
// user's password was set.
//
PasswordDateSet.LowPart = 0;
PasswordDateSet.HighPart = 0;
if ( GetPasswordExpired( PasswordDateSet,
MaxPasswordAge )) {
Status = STATUS_PASSWORD_EXPIRED;
goto Cleanup;
}
}
#endif
#if 1
//
// Validate the workstation the user logged on from.
//
// Ditch leading \\ on workstation name before passing it to SAM.
//
LocalWorkstation = LogonNetworkInfo->Identity.Workstation;
if ( LocalWorkstation.Length > 0 &&
LocalWorkstation.Buffer[0] == L'\\' &&
LocalWorkstation.Buffer[1] == L'\\' ) {
LocalWorkstation.Buffer += 2;
LocalWorkstation.Length -= 2*sizeof(WCHAR);
LocalWorkstation.MaximumLength -= 2*sizeof(WCHAR);
}
//
// To validate the user's logon hours as SAM does it, use this code,
// otherwise, supply your own checks below this code.
//
Status = AccountRestrictions( UserAll->UserId,
&LocalWorkstation,
(PUNICODE_STRING) &UserAll->WorkStations,
&UserAll->LogonHours,
LogoffTime,
KickoffTime );
if ( !NT_SUCCESS( Status )) {
goto Cleanup;
}
#elif 0
//
// Validate the user's logon hours.
//
if ( TRUE /* VALIDATE THE LOGON HOURS */ ) {
//
// All times are allowed, so there's no logoff
// time. Return forever for both logofftime and
// kickofftime.
//
LogoffTime->HighPart = 0x7FFFFFFF;
LogoffTime->LowPart = 0xFFFFFFFF;
KickoffTime->HighPart = 0x7FFFFFFF;
KickoffTime->LowPart = 0xFFFFFFFF;
} else {
Status = STATUS_INVALID_LOGON_HOURS;
*Authoritative = TRUE;
goto Cleanup;
}
#endif
#if 0
//
// Validate if the user can log on from this workstation.
// (Supply subauthentication package specific code here.)
if ( LogonNetworkInfo->Identity.Workstation.Buffer == NULL ) {
Status = STATUS_INVALID_WORKSTATION;
*Authoritative = TRUE;
goto Cleanup;
}
#endif
}
//
// The user is valid.
//
*Authoritative = TRUE;
Status = STATUS_SUCCESS;
//
// Cleanup up before returning.
//
Cleanup:
if ( strA1.Buffer )
{
RtlFreeHeap(RtlProcessHeap(), 0, strA1.Buffer );
}
if ( strA2.Buffer )
{
RtlFreeHeap(RtlProcessHeap(), 0, strA2.Buffer );
}
if ( strDigest.Buffer )
{
RtlFreeHeap(RtlProcessHeap(), 0, strDigest.Buffer );
}
if ( strPassword.Buffer )
{
RtlFreeAnsiString( &strPassword );
}
return Status;
} // Msv1_0SubAuthenticationRoutine
NTSTATUS
Msv1_0SubAuthenticationFilter (
IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
IN PVOID LogonInformation,
IN ULONG Flags,
IN PUSER_ALL_INFORMATION UserAll,
OUT PULONG WhichFields,
OUT PULONG UserFlags,
OUT PBOOLEAN Authoritative,
OUT PLARGE_INTEGER LogoffTime,
OUT PLARGE_INTEGER KickoffTime
)
{
return( Msv1_0SubAuthenticationRoutine(
LogonLevel,
LogonInformation,
Flags,
UserAll,
WhichFields,
UserFlags,
Authoritative,
LogoffTime,
KickoffTime
) );
}
#endif
static const CHAR c_szKeyName[] = "SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0";
static const CHAR c_szValueName[] = "Auth132";
static const CHAR c_szIISSUBA[] = "IISSUBA";
VOID CALLBACK
RegisterIISSUBA(
HWND hwnd, // handle to owner window
HINSTANCE hinst, // instance handle for the DLL
LPTSTR lpCmdLine, // string the DLL will parse
int nCmdShow // show state
)
{
HRESULT hr = S_OK;
LONG lRet;
HKEY hKey = NULL;
UNREFERENCED_PARM(hwnd);
UNREFERENCED_PARM(hinst);
UNREFERENCED_PARM(lpCmdLine);
UNREFERENCED_PARM(nCmdShow);
// Open the key
lRet = RegOpenKeyExA( HKEY_LOCAL_MACHINE,
c_szKeyName,
0,
KEY_ALL_ACCESS,
&hKey );
if ( lRet != ERROR_SUCCESS )
{
hr = HRESULT_FROM_WIN32( lRet );
goto exit;
}
// Create Auth132 = IISSUBA
lRet = RegSetValueEx( hKey,
c_szValueName,
0,
REG_SZ,
(BYTE*)c_szIISSUBA,
sizeof( c_szIISSUBA ) );
if ( lRet != ERROR_SUCCESS )
{
hr = HRESULT_FROM_WIN32( lRet );
goto exit;
}
exit:
// Cleanup
if ( hKey != NULL )
{
RegCloseKey( hKey );
hKey = NULL;
}
}
VOID CALLBACK
UnregisterIISSUBA(
HWND hwnd, // handle to owner window
HINSTANCE hinst, // instance handle for the DLL
LPTSTR lpCmdLine, // string the DLL will parse
int nCmdShow // show state
)
{
HRESULT hr = S_OK;
LONG lRet;
HKEY hKey = NULL;
UNREFERENCED_PARM(hwnd);
UNREFERENCED_PARM(hinst);
UNREFERENCED_PARM(lpCmdLine);
UNREFERENCED_PARM(nCmdShow);
// Open the key
lRet = RegOpenKeyExA( HKEY_LOCAL_MACHINE,
c_szKeyName,
0,
KEY_ALL_ACCESS,
&hKey );
if ( lRet != ERROR_SUCCESS )
{
hr = HRESULT_FROM_WIN32( lRet );
goto exit;
}
// Delete Auth132
lRet = RegDeleteValue( hKey,
c_szValueName );
if ( lRet != ERROR_SUCCESS )
{
hr = HRESULT_FROM_WIN32( lRet );
goto exit;
}
exit:
// Cleanup
if ( hKey != NULL )
{
RegCloseKey( hKey );
hKey = NULL;
}
}
// subauth.c eof
View Git Blame Copy Permalink