4 uuid("00000000-0000-0000-0000-000000000000"),
14 #define KEY_AGREEMENT_HANDLE int64
19 [size_is(Length
)] uint8
*Asn1Buffer
;
25 [size_is(Length
)] uint8
*checksum
;
26 } KERB_ASN1_DATA_CHECKSUM
;
30 [size_is(length
)] uint8
*value
;
31 } KERB_RPC_OCTET_STRING
;
34 int32 preauth_data_type
;
35 KERB_RPC_OCTET_STRING preauth_data
;
41 KERB_RPC_OCTET_STRING reserved3
;
42 } KERB_RPC_ENCRYPTION_KEY
;
47 [size_is(MaximumLength
/2), length_is(Length
/2)]
48 [string,charset
(UTF16
)] uint16
* Buffer
;
54 [size_is(NameCount
)] RPC_UNICODE_STRING
* Names
;
55 } KERB_RPC_INTERNAL_NAME
;
59 typedef [enum16bit
] enum
61 //RemoteCallMinimum = 0,
62 // start generic calls - not tied to a specific SSP
63 //RemoteCallGenericMinimum = 0,
64 //RemoteCallGenericReserved = 0,
65 //RemoteCallGenericMaximum = 0xff,
66 // Start Kerberos remote calls
67 //RemoteCallKerbMinimum = 0x100,
68 RemoteCallKerbNegotiateVersion
= 0x100,
69 RemoteCallKerbBuildAsReqAuthenticator
= 0x101,
70 RemoteCallKerbVerifyServiceTicket
= 0x102,
71 RemoteCallKerbCreateApReqAuthenticator
= 0x103,
72 RemoteCallKerbDecryptApReply
= 0x104,
73 RemoteCallKerbUnpackKdcReplyBody
= 0x105,
74 RemoteCallKerbComputeTgsChecksum
= 0x106,
75 RemoteCallKerbBuildEncryptedAuthData
= 0x107,
76 RemoteCallKerbPackApReply
= 0x108,
77 RemoteCallKerbHashS4UPreauth
= 0x109,
78 RemoteCallKerbSignS4UPreauthData
= 0x10a,
79 RemoteCallKerbVerifyChecksum
= 0x10b,
89 RemoteCallKerbDecryptPacCredentials
= 0x113,
90 RemoteCallKerbCreateECDHKeyAgreement
= 0x114,
91 RemoteCallKerbCreateDHKeyAgreement
= 0x115,
92 RemoteCallKerbDestroyKeyAgreement
= 0x116,
93 RemoteCallKerbKeyAgreementGenerateNonce
= 0x117,
94 RemoteCallKerbFinalizeKeyAgreement
= 0x118,
95 //RemoteCallKerbMaximum = 0x1ff,
96 // End Kerberos remote calls
98 // Start NTLM remote calls
99 //RemoteCallNtlmMinimum = 0x200,
100 RemoteCallNtlmNegotiateVersion
= 0x200,
101 RemoteCallNtlmLm20GetNtlm3ChallengeResponse
= 0x201,
102 RemoteCallNtlmCalculateNtResponse
= 0x202,
103 RemoteCallNtlmCalculateUserSessionKeyNt
= 0x203,
104 RemoteCallNtlmCompareCredentials
= 0x204 //,
105 //RemoteCallNtlmMaximum = 0x2ff,
106 // End NTLM remote calls
107 //RemoteCallMaximum = 0x2ff,
108 //RemoteCallInvalid = 0xffff // This enumeration MUST fit in 16 bits
112 typedef struct _SECPKG_SUPPLEMENTAL_CRED
{
113 RPC_UNICODE_STRING PackageName
;
114 uint32 CredentialSize
;
115 [size_is(CredentialSize
)] uint8
*Credentials
;
116 } SECPKG_SUPPLEMENTAL_CRED
;
119 uint32 CredentialCount
;
120 [size_is(CredentialCount
)] SECPKG_SUPPLEMENTAL_CRED Credentials
[*];
121 } SECPKG_SUPPLEMENTAL_CRED_ARRAY
;
122 typedef struct SECPKG_SUPPLEMENTAL_CRED_ARRAY
*PSECPKG_SUPPLEMENTAL_CRED_ARRAY
;
127 [size_is(cbData
)] PBYTE pbData
;
128 } KERB_RPC_CRYPTO_API_BLOB
;
131 // Used to negotiate the protocol version that will be used.
132 // Server sends the maximum version it supports; client replies
133 // with the version that will actually be used.
135 uint32 MaxSupportedVersion
;
141 typedef struct LARGE_INTEGER
*PLARGE_INTEGER
;
144 KERB_RPC_ENCRYPTION_KEY
* EncryptionKey
;
145 [ptr] KERB_RPC_ENCRYPTION_KEY
* ArmorKey
; // optional
146 LARGE_INTEGER
*TimeSkew
;
147 } BuildAsReqAuthenticatorReq
;
150 int32 PreauthDataType
;
151 KERB_RPC_OCTET_STRING PreauthData
;
152 } BuildAsReqAuthenticatorResp
;
155 KERB_ASN1_DATA
* PackedTicket
;
156 KERB_RPC_ENCRYPTION_KEY
* ServiceKey
;
157 [ptr] LARGE_INTEGER
*TimeSkew
; // optional
158 } VerifyServiceTicketReq
;
161 KERB_ASN1_DATA DecryptedTicket
;
162 int32 KerbProtocolError
;
163 } VerifyServiceTicketResp
;
165 typedef struct RPC_UNICODE_STRING
*PRPC_UNICODE_STRING
;
167 KERB_RPC_ENCRYPTION_KEY
* EncryptionKey
;
168 uint32 SequenceNumber
;
169 KERB_RPC_INTERNAL_NAME
* ClientName
;
170 RPC_UNICODE_STRING
* ClientRealm
;
171 LARGE_INTEGER
*SkewTime
;
172 [ptr] KERB_RPC_ENCRYPTION_KEY
* SubKey
; // optional
173 [ptr] KERB_ASN1_DATA
* AuthData
; // optional
174 [ptr] KERB_ASN1_DATA_CHECKSUM
* GssChecksum
; // optional
176 } CreateApReqAuthenticatorReq
;
179 LARGE_INTEGER AuthenticatorTime
;
180 KERB_ASN1_DATA Authenticator
;
181 int32 KerbProtocolError
;
182 } CreateApReqAuthenticatorResp
;
185 KERB_ASN1_DATA
* EncryptedReply
;
186 KERB_RPC_ENCRYPTION_KEY
* Key
;
190 KERB_ASN1_DATA ApReply
;
191 } DecryptApReplyResp
;
194 KERB_ASN1_DATA
* EncryptedData
;
195 KERB_RPC_ENCRYPTION_KEY
* Key
;
196 [ptr] KERB_RPC_ENCRYPTION_KEY
* StrengthenKey
; // seems optional
199 } UnpackKdcReplyBodyReq
;
202 int32 KerbProtocolError
;
203 KERB_ASN1_DATA ReplyBody
;
204 } UnpackKdcReplyBodyResp
;
207 KERB_ASN1_DATA
* RequestBody
;
208 KERB_RPC_ENCRYPTION_KEY
* Key
;
210 } ComputeTgsChecksumReq
;
213 KERB_ASN1_DATA_CHECKSUM Checksum
;
214 } ComputeTgsChecksumResp
;
218 KERB_RPC_ENCRYPTION_KEY
* Key
;
219 KERB_ASN1_DATA
* PlainAuthData
;
220 } BuildEncryptedAuthDataReq
;
223 KERB_ASN1_DATA EncryptedAuthData
;
224 } BuildEncryptedAuthDataResp
;
227 KERB_ASN1_DATA
* Reply
;
228 KERB_ASN1_DATA
* ReplyBody
;
229 KERB_RPC_ENCRYPTION_KEY
* SessionKey
;
233 uint32 PackedReplySize
;
234 [size_is(PackedReplySize
)] uint8
*PackedReply
;
238 KERB_ASN1_DATA
* S4UPreauth
;
239 KERB_RPC_ENCRYPTION_KEY
* Key
;
244 uint32
*ChecksumSize
;
245 [size_is(, *ChecksumSize
)] uint8
** ChecksumValue
;
246 } HashS4UPreauthResp
;
249 KERB_RPC_ENCRYPTION_KEY
* Key
;
251 KERB_ASN1_DATA
* UserId
;
253 } SignS4UPreauthDataReq
;
257 uint32
*ChecksumSize
;
258 [size_is(, *ChecksumSize
)] uint8
** ChecksumValue
;
259 } SignS4UPreauthDataResp
;
262 KERB_RPC_ENCRYPTION_KEY
* Key
;
264 uint32 ExpectedChecksumSize
;
265 [size_is(ExpectedChecksumSize
)] UCHAR
* ExpectedChecksum
;
266 uint32 DataToCheckSize
;
267 [size_is(DataToCheckSize
)] UCHAR
* DataToCheck
;
272 } VerifyChecksumResp
;
275 KERB_RPC_ENCRYPTION_KEY
* Key
;
277 uint32 EncryptionType
;
279 [size_is(DataSize
)] UCHAR
* Data
;
280 } DecryptPacCredentialsReq
;
283 PSECPKG_SUPPLEMENTAL_CRED_ARRAY Credentials
;
284 } DecryptPacCredentialsResp
;
288 } CreateECDHKeyAgreementReq
;
291 KEY_AGREEMENT_HANDLE
* KeyAgreementHandle
;
293 uint32
*EncodedPubKeyLen
;
294 [size_is(, *EncodedPubKeyLen
)] uint8
** EncodedPubKey
;
295 } CreateECDHKeyAgreementResp
;
298 // This [case(RemoteCallKerb)] struct has no input parameters, but for
299 // simplicity and consistency with the other parameters, let's define
300 // this as a [case(RemoteCallKerb)] struct with a single ignored value.
302 } CreateDHKeyAgreementReq
;
305 KERB_RPC_CRYPTO_API_BLOB
* ModulusP
;
306 KERB_RPC_CRYPTO_API_BLOB
* GeneratorG
;
307 KERB_RPC_CRYPTO_API_BLOB
* FactorQ
;
308 KEY_AGREEMENT_HANDLE
* KeyAgreementHandle
;
310 uint32
*LittleEndianPublicKeyLen
;
311 [size_is(, *LittleEndianPublicKeyLen
)] uint8
** LittleEndianPublicKey
;
312 } CreateDHKeyAgreementResp
;
315 KEY_AGREEMENT_HANDLE KeyAgreementHandle
;
316 } DestroyKeyAgreementReq
;
319 // This [case(RemoteCallKerb)] struct has no output, but for
320 // simplicity and consistency define as a
321 // [case(RemoteCallKerb)] struct with a single ignored value.
323 } DestroyKeyAgreementResp
;
326 KEY_AGREEMENT_HANDLE KeyAgreementHandle
;
327 } KeyAgreementGenerateNonceReq
;
331 [size_is(, *NonceLen
)] uint8
** Nonce
;
332 } KeyAgreementGenerateNonceResp
;
335 KEY_AGREEMENT_HANDLE
* KeyAgreementHandle
;
337 uint32 RemoteNonceLen
;
338 [size_is(RemoteNonceLen
)] uint8
*RemoteNonce
;
339 uint32 X509PublicKeyLen
;
340 [size_is(X509PublicKeyLen
)] uint8
*X509PublicKey
;
341 } FinalizeKeyAgreementReq
;
344 KERB_RPC_ENCRYPTION_KEY
* SharedKey
;
345 } FinalizeKeyAgreementResp
;
347 typedef [flag
(LIBNDR_FLAG_ALIGN4
),switch_type(uint16
)] union {
348 [case(RemoteCallKerbNegotiateVersion
)] NegotiateVersion negociateVersion
;
349 [case(RemoteCallKerbBuildAsReqAuthenticator
)] BuildAsReqAuthenticatorReq buildAsReqAuthenticator
;
350 [case(RemoteCallKerbVerifyServiceTicket
)] VerifyServiceTicketReq verifyServiceTicket
;
351 [case(RemoteCallKerbCreateApReqAuthenticator
)] CreateApReqAuthenticatorReq createApReqAuthenticator
;
352 [case(RemoteCallKerbDecryptApReply
)] DecryptApReplyReq decryptApReply
;
353 [case(RemoteCallKerbUnpackKdcReplyBody
)] UnpackKdcReplyBodyReq unpackKdcReplyBody
;
354 [case(RemoteCallKerbComputeTgsChecksum
)] ComputeTgsChecksumReq computeTgsChecksum
;
355 [case(RemoteCallKerbBuildEncryptedAuthData
)] BuildEncryptedAuthDataReq buildEncryptedAuthData
;
356 [case(RemoteCallKerbPackApReply
)] PackApReplyReq packApReply
;
357 [case(RemoteCallKerbHashS4UPreauth
)] HashS4UPreauthReq hashS4UPreauth
;
358 [case(RemoteCallKerbSignS4UPreauthData
)] SignS4UPreauthDataReq signS4UPreauthData
;
359 [case(RemoteCallKerbVerifyChecksum
)] VerifyChecksumReq verifyChecksum
;
360 [case(RemoteCallKerbDecryptPacCredentials
)] DecryptPacCredentialsReq decryptPacCredentials
;
361 [case(RemoteCallKerbCreateECDHKeyAgreement
)] CreateECDHKeyAgreementReq createECDHKeyAgreement
;
362 [case(RemoteCallKerbCreateDHKeyAgreement
)] CreateDHKeyAgreementReq createDHKeyAgreement
;
363 [case(RemoteCallKerbDestroyKeyAgreement
)] DestroyKeyAgreementReq destroyKeyAgreement
;
364 [case(RemoteCallKerbKeyAgreementGenerateNonce
)] KeyAgreementGenerateNonceReq keyAgreementGenerateNonce
;
365 [case(RemoteCallKerbFinalizeKeyAgreement
)] FinalizeKeyAgreementReq finalizeKeyAgreement
;
371 // CallId determines the call being sent over the wire.
372 RemoteGuardCallId CallId
;
373 // Input paramters are held in a union so that each call can be sent
374 // over the wire in the same type of KerbCredIsoRemoteInput structure.
375 [switch_type(uint16
), switch_is(CallId
)] KerbInputUnion callUnion
;
376 } KerbCredIsoRemoteInput
;
378 typedef [flag
(LIBNDR_FLAG_ALIGN4
), switch_type(uint16
)]union {
379 [case(RemoteCallKerbNegotiateVersion
)] NegotiateVersion negociateVersion
;
380 [case(RemoteCallKerbBuildAsReqAuthenticator
)] BuildAsReqAuthenticatorResp buildAsReqAuthenticator
;
381 [case(RemoteCallKerbVerifyServiceTicket
)] VerifyServiceTicketResp verifyServiceTicket
;
382 [case(RemoteCallKerbCreateApReqAuthenticator
)] CreateApReqAuthenticatorResp createApReqAuthenticator
;
383 [case(RemoteCallKerbDecryptApReply
)] DecryptApReplyResp decryptApReply
;
384 [case(RemoteCallKerbUnpackKdcReplyBody
)] UnpackKdcReplyBodyResp unpackKdcReplyBody
;
385 [case(RemoteCallKerbComputeTgsChecksum
)] ComputeTgsChecksumResp computeTgsChecksum
;
386 [case(RemoteCallKerbBuildEncryptedAuthData
)] BuildEncryptedAuthDataResp buildEncryptedAuthData
;
387 [case(RemoteCallKerbPackApReply
)] PackApReplyResp packApReply
;
388 [case(RemoteCallKerbHashS4UPreauth
)] HashS4UPreauthResp hashS4UPreauth
;
389 [case(RemoteCallKerbSignS4UPreauthData
)] SignS4UPreauthDataResp signS4UPreauthData
;
390 [case(RemoteCallKerbVerifyChecksum
)] VerifyChecksumResp verifyChecksum
;
391 [case(RemoteCallKerbDecryptPacCredentials
)] DecryptPacCredentialsResp decryptPacCredentials
;
392 [case(RemoteCallKerbCreateECDHKeyAgreement
)] CreateECDHKeyAgreementResp createECDHKeyAgreement
;
393 [case(RemoteCallKerbCreateDHKeyAgreement
)] CreateDHKeyAgreementResp createDHKeyAgreement
;
394 [case(RemoteCallKerbDestroyKeyAgreement
)] DestroyKeyAgreementResp destroyKeyAgreement
;
395 [case(RemoteCallKerbKeyAgreementGenerateNonce
)] KeyAgreementGenerateNonceResp keyAgreementGenerateNonce
;
396 [case(RemoteCallKerbFinalizeKeyAgreement
)] FinalizeKeyAgreementResp finalizeKeyAgreement
;
401 // CallId determines the call being sent over the wire.
402 RemoteGuardCallId CallId
;
405 // Input paramters are held in a union so that each call can be sent
406 // over the wire in the same type of KerbCredIsoRemoteInput structure.
407 [switch_type(RemoteGuardCallId
), switch_is(CallId
)] KerbOutputUnion callUnion
;
408 } KerbCredIsoRemoteOutput
;
410 // ==================================== NTLM =============================================
412 // UCHAR Data[MSV1_0_RESPONSE_LENGTH];
415 typedef struct _NT_CHALLENGE
{
416 //UCHAR Data[MSV1_0_CHALLENGE_LENGTH];
418 typedef struct NT_CHALLENGE
*PNT_CHALLENGE
;
420 typedef NT_CHALLENGE LM_SESSION_KEY
;
423 //UCHAR Response[MSV1_0_NTLM3_RESPONSE_LENGTH];
424 //UCHAR ChallengeFromClient[MSV1_0_CHALLENGE_LENGTH];
425 } MSV1_0_LM3_RESPONSE
;
426 typedef struct MSV1_0_LM3_RESPONSE
*PMSV1_0_LM3_RESPONSE
;
429 //UCHAR Data[MSV1_0_USER_SESSION_KEY_LENGTH];
431 typedef struct PUSER_SESSION_KEY
*PUSER_SESSION_KEY
;
434 //UCHAR Data[MSV1_0_CREDENTIAL_KEY_LENGTH];
435 } MSV1_0_CREDENTIAL_KEY
;
436 typedef struct MSV1_0_CREDENTIAL_KEY
* PMSV1_0_CREDENTIAL_KEY
;
438 typedef struct _MSV1_0_REMOTE_ENCRYPTED_SECRETS
{
442 MSV1_0_CREDENTIAL_KEY reserved4
;
443 MSV1_0_CREDENTIAL_KEY reserved5
;
445 [size_is(reservedSize
)] UCHAR
* reserved6
;
446 } MSV1_0_REMOTE_ENCRYPTED_SECRETS
;
447 typedef struct MSV1_0_REMOTE_ENCRYPTED_SECRETS
*PMSV1_0_REMOTE_ENCRYPTED_SECRETS
;
449 // Use the provided credential and challenge to generate the
450 // NT and LM response for the NTLM v2 authentication protocol.
452 PMSV1_0_REMOTE_ENCRYPTED_SECRETS Credential
;
453 PRPC_UNICODE_STRING UserName
;
454 PRPC_UNICODE_STRING LogonDomainName
;
455 PRPC_UNICODE_STRING ServerName
;
456 //UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH];
457 } Lm20GetNtlm3ChallengeResponseReq
;
460 uint16 Ntlm3ResponseLength
;
461 [size_is(Ntlm3ResponseLength
)] uint8
*Ntlm3Response
;
462 MSV1_0_LM3_RESPONSE Lm3Response
;
463 USER_SESSION_KEY UserSessionKey
;
464 LM_SESSION_KEY LmSessionKey
;
465 } Lm20GetNtlm3ChallengeResponseResp
;
468 PNT_CHALLENGE NtChallenge
;
469 PMSV1_0_REMOTE_ENCRYPTED_SECRETS Credential
;
470 } CalculateNtResponseReq
;
473 NT_RESPONSE NtResponse
;
474 } CalculateNtResponseResp
;
476 // Use the provided credential and response to calculate
477 // a session key according to the NTLM v1 protocol.
479 NT_RESPONSE
*NtResponse
;
480 PMSV1_0_REMOTE_ENCRYPTED_SECRETS Credential
;
481 } CalculateUserSessionKeyNtReq
;
484 USER_SESSION_KEY UserSessionKey
;
485 } CalculateUserSessionKeyNtResp
;
487 // Compare the provided credentials to determine whether
488 // they're identical.
490 PMSV1_0_REMOTE_ENCRYPTED_SECRETS LhsCredential
;
491 PMSV1_0_REMOTE_ENCRYPTED_SECRETS RhsCredential
;
492 } CompareCredentialsReq
;
497 BOOL AreShaOwfsEqual
;
498 } CompareCredentialsResp
;
500 typedef [flag
(LIBNDR_FLAG_ALIGN4
), switch_type(uint16
)] union {
501 [case(RemoteCallNtlmNegotiateVersion
)] NegotiateVersion negotiateVersion
;
502 [case(RemoteCallNtlmLm20GetNtlm3ChallengeResponse
)] Lm20GetNtlm3ChallengeResponseReq lm20GetNtlm3ChallengeResponse
;
503 [case(RemoteCallNtlmCalculateNtResponse
)] CalculateNtResponseReq calculateNtResponse
;
504 [case(RemoteCallNtlmCalculateUserSessionKeyNt
)] CalculateUserSessionKeyNtReq calculateUserSessionKeyNt
;
505 [case(RemoteCallNtlmCompareCredentials
)] CompareCredentialsReq compareCredentials
;
510 RemoteGuardCallId CallId
;
511 [switch_type(RemoteGuardCallId
), switch_is(CallId
)] NtlmCredInput callUnion
;
512 } NtlmCredIsoRemoteInput
;
515 typedef [flag
(LIBNDR_FLAG_ALIGN4
), switch_type(uint16
)] union {
516 [case(RemoteCallNtlmNegotiateVersion
)] NegotiateVersion negotiateVersion
;
517 [case(RemoteCallNtlmLm20GetNtlm3ChallengeResponse
)] Lm20GetNtlm3ChallengeResponseResp lm20GetNtlm3ChallengeResponse
;
518 [case(RemoteCallNtlmCalculateNtResponse
)] CalculateNtResponseResp calculateNtResponse
;
519 [case(RemoteCallNtlmCalculateUserSessionKeyNt
)] CalculateUserSessionKeyNtResp calculateUserSessionKeyNt
;
520 [case(RemoteCallNtlmCompareCredentials
)] CompareCredentialsResp compareCredentials
;
525 RemoteGuardCallId CallId
;
527 [switch_type(RemoteGuardCallId
), switch_is(CallId
)] NtlmCredOutput callUnion
;
528 } NtlmCredIsoRemoteOutput
;