Skip to content

Fix SSPI acceptor credentials #857

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tgauth merged 1 commit into from
Jul 24, 2026
+35 −15
Merged

Fix SSPI acceptor credentials #857

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 35 additions & 15 deletions contrib/win32/win32compat/gss-sspi.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,31 @@ ssh_gss_sspi_init(_Out_ OM_uint32 * minor_status)
return 1;
}

static CredHandle *
default_cred_handle(ULONG cred_usage, const gss_cred_id_t *in)
{
static CredHandle default_inbound_cred_handle = { 0, 0 };
static CredHandle default_outbound_cred_handle = { 0, 0 };
TimeStamp cred_expiry;

if (*in != GSS_C_NO_CREDENTIAL)
return &(*in)->credHandle;

CredHandle *ret = &default_inbound_cred_handle;
if (cred_usage == SECPKG_CRED_OUTBOUND)
ret = &default_outbound_cred_handle;

if (ret->dwLower || ret->dwUpper)
return ret;

if (SecFunctions->AcquireCredentialsHandleW(NULL,
MICROSOFT_KERBEROS_NAME_W, cred_usage, NULL, NULL, NULL,
NULL, ret, &cred_expiry) != SEC_E_OK)
return NULL;

return ret;
}

/*
* Allows an application to determine which underlying security mechanisms are
* available.
Expand Down Expand Up @@ -532,20 +557,10 @@ gss_init_sec_context(
GetSystemTime(&current_time_system);

/* acquire default cred handler if none specified */
CredHandle *pCredHandle = NULL;
if (claimant_cred_handle != NULL)
pCredHandle = &(claimant_cred_handle->credHandle);

if (pCredHandle == NULL) {
static CredHandle cred_handle = { 0, 0 };
pCredHandle = &cred_handle;
if (cred_handle.dwLower == 0 && cred_handle.dwUpper == 0) {
TimeStamp expiry_cred;
if (SecFunctions->AcquireCredentialsHandleW(NULL, MICROSOFT_KERBEROS_NAME_W, SECPKG_CRED_OUTBOUND,
NULL, NULL, NULL, NULL, &cred_handle, &expiry_cred) != SEC_E_OK)
goto done;
}
}
CredHandle *pCredHandle = default_cred_handle(SECPKG_CRED_OUTBOUND,
&claimant_cred_handle);
if (!pCredHandle)
goto done;

/* condition the string for windows */
if ((target_name_utf16 = utf8_to_utf16(target_name)) == NULL)
Expand Down Expand Up @@ -822,6 +837,11 @@ gss_accept_sec_context(_Out_ OM_uint32 * minor_status, _Inout_opt_ gss_ctx_id_t
if (ssh_gss_sspi_init(minor_status) == 0)
goto done;

CredHandle *p_acceptor_cred_handle = default_cred_handle(
SECPKG_CRED_INBOUND, &acceptor_cred_handle);
if (!p_acceptor_cred_handle)
goto done;

/* setup input buffer */
SecBuffer input_buffer_token = { (unsigned long) input_token_buffer->length,
SECBUFFER_TOKEN | SECBUFFER_READONLY, input_token_buffer->value };
Expand All @@ -842,7 +862,7 @@ gss_accept_sec_context(_Out_ OM_uint32 * minor_status, _Inout_opt_ gss_ctx_id_t
ASC_REQ_DELEGATE | ASC_REQ_SEQUENCE_DETECT | ASC_REQ_ALLOCATE_MEMORY;

/* call sspi accept security context function */
const SECURITY_STATUS status = SecFunctions->AcceptSecurityContext(&acceptor_cred_handle->credHandle,
const SECURITY_STATUS status = SecFunctions->AcceptSecurityContext(p_acceptor_cred_handle,
(*context_handle == GSS_C_NO_CONTEXT) ? NULL : *context_handle, &input_buffer,
sspi_req_flags, SECURITY_NATIVE_DREP,
(*context_handle == GSS_C_NO_CONTEXT) ? &sspi_context_handle : *context_handle,
Expand Down