Skip to content

Commit 7ec7435

Browse files
tyranidtyranid
committed
Added control token api.
1 parent 0ff9eff commit 7ec7435

13 files changed

Lines changed: 382 additions & 1 deletion

‎NtApiDotNet/NtApiDotNet.csproj‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -557,6 +557,14 @@
557557
<Compile Include="Win32\SafeHandles\SafeSecWinNtAuthIdentityBuffer.cs" />
558558
<Compile Include="Win32\Security\Authentication\AuthenticationContextKeyInfo.cs" />
559559
<Compile Include="Win32\Security\Authentication\BufferAuthenticationCredentials.cs" />
560+
<Compile Include="Win32\Security\Authentication\ControlToken.cs" />
561+
<Compile Include="Win32\Security\Authentication\Schannel\SchannelAlertControlToken.cs" />
562+
<Compile Include="Win32\Security\Authentication\Schannel\SchannelAlertNumber.cs" />
563+
<Compile Include="Win32\Security\Authentication\Schannel\SchannelAlertType.cs" />
564+
<Compile Include="Win32\Security\Authentication\Schannel\SchannelControlToken.cs" />
565+
<Compile Include="Win32\Security\Authentication\Schannel\SchannelSessionControlToken.cs" />
566+
<Compile Include="Win32\Security\Authentication\Schannel\SchannelSessionFlags.cs" />
567+
<Compile Include="Win32\Security\Authentication\Schannel\SchannelShutdownControlToken.cs" />
560568
<Compile Include="Win32\Security\Credential\AuthIdentity\SecWinNtAuthIdentity.cs" />
561569
<Compile Include="Win32\Security\Credential\AuthIdentity\SecWinNtAuthIdentityCreateOptions.cs" />
562570
<Compile Include="Win32\Security\Credential\AuthIdentity\SecWinNtAuthIdentityEncryptionOptions.cs" />

‎NtApiDotNet/Win32/Security/Authentication/ClientAuthenticationContext.cs‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -552,6 +552,34 @@ public ExportedSecurityContext Export()
552552
Dispose();
553553
return context;
554554
}
555+
556+
/// <summary>
557+
/// Apply a control token.
558+
/// </summary>
559+
/// <param name="input">The input buffers to apply.</param>
560+
public void ApplyControlToken(IEnumerable<SecurityBuffer> input)
561+
{
562+
if (input is null)
563+
{
564+
throw new ArgumentNullException(nameof(input));
565+
}
566+
567+
SecurityContextUtils.ApplyControlToken(_context, input, true);
568+
}
569+
570+
/// <summary>
571+
/// Apply a control token.
572+
/// </summary>
573+
/// <param name="token">The control token to apply.</param>
574+
public void ApplyControlToken(ControlToken token)
575+
{
576+
if (token is null)
577+
{
578+
throw new ArgumentNullException(nameof(token));
579+
}
580+
581+
ApplyControlToken(new[] { token.ToBuffer() });
582+
}
555583
#endregion
556584

557585
#region IDisposable Implementation

‎NtApiDotNet/Win32/Security/Authentication/ControlToken.cs‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Copyright 2020 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Win32.Security.Buffers;
16+
17+
namespace NtApiDotNet.Win32.Security.Authentication
18+
{
19+
/// <summary>
20+
/// Base class for a security control token.
21+
/// </summary>
22+
public abstract class ControlToken
23+
{
24+
/// <summary>
25+
/// Convert the token into a security buffer.
26+
/// </summary>
27+
/// <returns>The security buffer.</returns>
28+
public abstract SecurityBuffer ToBuffer();
29+
}
30+
}

‎NtApiDotNet/Win32/Security/Authentication/SChannel/SchannelAlertControlToken.cs‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
// Copyright 2021 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Utilities.Data;
16+
17+
namespace NtApiDotNet.Win32.Security.Authentication.Schannel
18+
{
19+
/// <summary>
20+
/// Class to represent an Schannel alert control token.
21+
/// </summary>
22+
public sealed class SchannelAlertControlToken : SchannelControlToken
23+
{
24+
private const int SCHANNEL_ALERT = 2;
25+
private readonly SchannelAlertType _type;
26+
private readonly SchannelAlertNumber _number;
27+
28+
/// <summary>
29+
/// Constructor
30+
/// </summary>
31+
/// <param name="type">The alert type.</param>
32+
/// <param name="number">The alert number.</param>
33+
public SchannelAlertControlToken(SchannelAlertType type, SchannelAlertNumber number)
34+
{
35+
_type = type;
36+
_number = number;
37+
}
38+
39+
private protected override void WriteBuffer(DataWriter writer)
40+
{
41+
writer.Write(SCHANNEL_ALERT);
42+
writer.Write((int)_type);
43+
writer.Write((int)_number);
44+
}
45+
}
46+
}

‎NtApiDotNet/Win32/Security/Authentication/SChannel/SchannelAlertNumber.cs‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// Copyright 2021 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Utilities.Reflection;
16+
17+
namespace NtApiDotNet.Win32.Security.Authentication.Schannel
18+
{
19+
/// <summary>
20+
/// Schannel Alert Number.
21+
/// </summary>
22+
public enum SchannelAlertNumber
23+
{
24+
#pragma warning disable CS1591 // Missing XML comment for publicly visible type or member
25+
[SDKName("TLS1_ALERT_CLOSE_NOTIFY")] CloseNotify = 0, // warning
26+
[SDKName("TLS1_ALERT_UNEXPECTED_MESSAGE")] UnexpectedMessage = 10, // error
27+
[SDKName("TLS1_ALERT_BAD_RECORD_MAC")] BadRecordMAC = 20, // error
28+
[SDKName("TLS1_ALERT_DECRYPTION_FAILED")] DecryptionFailed = 21, // reserved
29+
[SDKName("TLS1_ALERT_RECORD_OVERFLOW")] RecordOverflow = 22, // error
30+
[SDKName("TLS1_ALERT_DECOMPRESSION_FAIL")] DecompressionFail = 30, // error
31+
[SDKName("TLS1_ALERT_HANDSHAKE_FAILURE")] HandshakeFailure = 40, // error
32+
[SDKName("TLS1_ALERT_BAD_CERTIFICATE")] BadCertificate = 42, // warning or error
33+
[SDKName("TLS1_ALERT_UNSUPPORTED_CERT")] UnsupportedCert = 43, // warning or error
34+
[SDKName("TLS1_ALERT_CERTIFICATE_REVOKED")] CertificateRevoked = 44, // warning or error
35+
[SDKName("TLS1_ALERT_CERTIFICATE_EXPIRED")] CertificateExpired = 45, // warning or error
36+
[SDKName("TLS1_ALERT_CERTIFICATE_UNKNOWN")] CertificateUnknown = 46, // warning or error
37+
[SDKName("TLS1_ALERT_ILLEGAL_PARAMETER")] IllegalParameter = 47, // error
38+
[SDKName("TLS1_ALERT_UNKNOWN_CA")] UnknownCA = 48, // error
39+
[SDKName("TLS1_ALERT_ACCESS_DENIED")] AccessDenied = 49, // error
40+
[SDKName("TLS1_ALERT_DECODE_ERROR")] DecodeError = 50, // error
41+
[SDKName("TLS1_ALERT_DECRYPT_ERROR")] DecryptError = 51, // error
42+
[SDKName("TLS1_ALERT_EXPORT_RESTRICTION")] ExportRestriction = 60, // reserved
43+
[SDKName("TLS1_ALERT_PROTOCOL_VERSION")] ProtocolVersion = 70, // error
44+
[SDKName("TLS1_ALERT_INSUFFIENT_SECURITY")] InsufficientSecurity = 71, // error
45+
[SDKName("TLS1_ALERT_INTERNAL_ERROR")] InternalError = 80, // error
46+
[SDKName("TLS1_ALERT_USER_CANCELED")] UserCancelled = 90, // warning or error
47+
[SDKName("TLS1_ALERT_NO_RENEGOTIATION")] NoRenogotiation = 100, // warning
48+
[SDKName("TLS1_ALERT_UNSUPPORTED_EXT")] UnsupportedExt = 110, // error
49+
[SDKName("TLS1_ALERT_UNKNOWN_PSK_IDENTITY")] UnknownPskIdentity = 115, // error
50+
[SDKName("TLS1_ALERT_NO_APP_PROTOCOL")] NoAppProtocol = 120, // error
51+
#pragma warning restore CS1591 // Missing XML comment for publicly visible type or member
52+
}
53+
}

‎NtApiDotNet/Win32/Security/Authentication/SChannel/SchannelAlertType.cs‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright 2021 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Utilities.Reflection;
16+
17+
namespace NtApiDotNet.Win32.Security.Authentication.Schannel
18+
{
19+
/// <summary>
20+
/// Schannel Alert Type.
21+
/// </summary>
22+
public enum SchannelAlertType
23+
{
24+
#pragma warning disable CS1591 // Missing XML comment for publicly visible type or member
25+
[SDKName("TLS1_ALERT_WARNING")]
26+
Warning = 1,
27+
[SDKName("TLS1_ALERT_FATAL")]
28+
Fatal = 2,
29+
#pragma warning restore CS1591 // Missing XML comment for publicly visible type or member
30+
}
31+
}

‎NtApiDotNet/Win32/Security/Authentication/SChannel/SchannelControlToken.cs‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
// Copyright 2021 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Utilities.Data;
16+
using NtApiDotNet.Win32.Security.Buffers;
17+
18+
namespace NtApiDotNet.Win32.Security.Authentication.Schannel
19+
{
20+
/// <summary>
21+
/// Base class for an Schannel Control Token.
22+
/// </summary>
23+
public abstract class SchannelControlToken : ControlToken
24+
{
25+
private protected abstract void WriteBuffer(DataWriter writer);
26+
27+
/// <summary>
28+
/// Convert the token into a security buffer.
29+
/// </summary>
30+
/// <returns>The security buffer.</returns>
31+
public override SecurityBuffer ToBuffer()
32+
{
33+
DataWriter writer = new DataWriter();
34+
WriteBuffer(writer);
35+
return new SecurityBufferInOut(SecurityBufferType.Token | SecurityBufferType.ReadOnly, writer.ToArray());
36+
}
37+
}
38+
}

‎NtApiDotNet/Win32/Security/Authentication/SChannel/SchannelSessionControlToken.cs‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Copyright 2021 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Utilities.Data;
16+
17+
namespace NtApiDotNet.Win32.Security.Authentication.Schannel
18+
{
19+
/// <summary>
20+
/// Class to represent an Schannel shutdown control token.
21+
/// </summary>
22+
public sealed class SchannelSessionControlToken : SchannelControlToken
23+
{
24+
private const int SCHANNEL_SESSION = 3;
25+
private readonly SchannelSessionFlags _flags;
26+
27+
/// <summary>
28+
/// Constructor.
29+
/// </summary>
30+
/// <param name="flags">The session flags.</param>
31+
public SchannelSessionControlToken(SchannelSessionFlags flags)
32+
{
33+
_flags = flags;
34+
}
35+
36+
private protected override void WriteBuffer(DataWriter writer)
37+
{
38+
writer.Write(SCHANNEL_SESSION);
39+
writer.Write((int)_flags);
40+
}
41+
}
42+
}

‎NtApiDotNet/Win32/Security/Authentication/SChannel/SchannelSessionFlags.cs‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright 2021 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Utilities.Reflection;
16+
17+
namespace NtApiDotNet.Win32.Security.Authentication.Schannel
18+
{
19+
/// <summary>
20+
/// Schannel session flags.
21+
/// </summary>
22+
public enum SchannelSessionFlags
23+
{
24+
#pragma warning disable CS1591 // Missing XML comment for publicly visible type or member
25+
[SDKName("SSL_SESSION_ENABLE_RECONNECTS")]
26+
EnableReconnects = 1,
27+
[SDKName("SSL_SESSION_DISABLE_RECONNECTS")]
28+
DisableReconnects = 2,
29+
#pragma warning restore CS1591 // Missing XML comment for publicly visible type or member
30+
}
31+
}

‎NtApiDotNet/Win32/Security/Authentication/SChannel/SchannelShutdownControlToken.cs‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright 2021 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Utilities.Data;
16+
17+
namespace NtApiDotNet.Win32.Security.Authentication.Schannel
18+
{
19+
/// <summary>
20+
/// Class to represent an Schannel shutdown control token.
21+
/// </summary>
22+
public sealed class SchannelShutdownControlToken : SchannelControlToken
23+
{
24+
private const int SCHANNEL_SHUTDOWN = 1;
25+
26+
private protected override void WriteBuffer(DataWriter writer)
27+
{
28+
writer.Write(SCHANNEL_SHUTDOWN);
29+
}
30+
}
31+
}

0 commit comments

Comments
 (0)