mORMot Open Source

HgAlexx

Member

Registered: 2020-06-10

Posts: 6

THttpApiServer, HTTP_REQUEST: Issue with Windows Auth and 64 bits

Hello,

I found an issue with Windows authentication when using THttpApiServer and Kerberos (Negotiate), and if mORMot (SynCrtSock.pas) is compiled for 64 bits.

When testing on 32 bits, after an authentication attempt, the field "RequestInfoCount" of structure "HTTP_REQUEST" contains a value > 0

But when testing on 64 bits, "RequestInfoCount" is equal to 0 and the correct value is found inside the field "xxxPadding" of structure "HTTP_REQUEST", which is directly before "RequestInfoCount".

I've "fixed" the issue by adding an IFNDEF arround "xxxPadding" like that:

    // beginning of HTTP_REQUEST_V2 structure
    {$IFNDEF CPU64}
    xxxPadding: DWORD;
    {$ENDIF}
    RequestInfoCount: word;

However, C to Delphi structure conversion and fields size/alignment is not my area of expertise and I not sure at all that this is the proper fix.

Please advise.

Regards,

Alex.

Last edited by HgAlexx (2020-06-10 10:29:52)

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,658

Website

Re: THttpApiServer, HTTP_REQUEST: Issue with Windows Auth and 64 bits

Perhaps https://synopse.info/fossil/info/7e27e1df16 is a better way.

HgAlexx

Member

Registered: 2020-06-10

Posts: 6

Re: THttpApiServer, HTTP_REQUEST: Issue with Windows Auth and 64 bits

I'll give it a try, but I'm wondering:
- Won't this remove the padding when using 32 bits ?
- Since 32 bits was working with the padding, will it still work ?

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,658

Website

Re: THttpApiServer, HTTP_REQUEST: Issue with Windows Auth and 64 bits

Nesting records should do proper alignment and padding.
Please try it.

mpv

Member

From: Ukraine

Registered: 2012-03-24

Posts: 1,571

Website

Re: THttpApiServer, HTTP_REQUEST: Issue with Windows Auth and 64 bits

@HgAlexx - BTW we have a SynSSPIAuth (Windows) / SynGSSAPIAuth (Linux) for Negotiate authentication. Well tested in production for many years. And (IMHO) much flexible compared to HTTP.SYS level authentication.

HgAlexx

Member

Registered: 2020-06-10

Posts: 6

Re: THttpApiServer, HTTP_REQUEST: Issue with Windows Auth and 64 bits

@mpv
I'm only using THttpApiServer so it's pratical for me that http.sys is handling all the back and forth regarding the Windows Auth and make it very simple to implement on my side.

However, we have another issue with it (all request are auth as the first user who logged in, kernel side) so I'll have a look at SynSSPIAuth and see it the issue persist.

@ab
On my way to test the new struct

HgAlexx

Member

Registered: 2020-06-10

Posts: 6

Re: THttpApiServer, HTTP_REQUEST: Issue with Windows Auth and 64 bits

@ab
The new struct works for 64 bits but no longer work for 32 bits
The value of RequestInfoCount is offset and set into pRequestInfo

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,658

Website

Re: THttpApiServer, HTTP_REQUEST: Issue with Windows Auth and 64 bits

I put back your modification as https://synopse.info/fossil/info/be31dd9e97

Hope it works on both Win32 and Win64.