Draft: Add support for EPA #295
Conversation
Signed-off-by: Bulat <[email protected]>
|
As I understand I need to pass tls-unique to |
@microsoft-github-policy-service agree |
Signed-off-by: Bulat <[email protected]>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #295 +/- ##
==========================================
- Coverage 75.23% 75.04% -0.19%
==========================================
Files 33 33
Lines 6501 6517 +16
==========================================
Hits 4891 4891
- Misses 1326 1339 +13
- Partials 284 287 +3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull Request Overview
This PR implements Extended Protection for Authentication (EPA) through TLS channel binding tokens for integrated authentication methods (NTLM and Kerberos). The implementation generates channel binding tokens from the TLS unique value and passes them to authenticators to enhance security against man-in-the-middle attacks.
- Adds channel binding token generation from TLS unique values
- Implements EPA support in NTLM authentication with AV_PAIR structure
- Adds a
DisableEPAconnection string parameter to opt out of channel binding - Updates all integrated authenticators to support the new
SetChannelBindinginterface method
Reviewed Changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| tds.go | Extracts TLS unique value from connection state and generates channel binding token, then passes it to authenticators before login |
| msdsn/conn_str.go | Adds DisableEPA parameter parsing and Config field for disabling Extended Protection for Authentication |
| integratedauth/integratedauthenticator.go | Adds SetChannelBinding method to IntegratedAuthenticator interface |
| integratedauth/channel_binding.go | New file implementing CBT generation from TLS unique value per MS-NLMP specification |
| integratedauth/ntlm/ntlm.go | Implements channel binding in NTLM by adding MsvAvChannelBindings AV_PAIR to target info fields |
| integratedauth/krb5/krb5.go | Adds channelBinding field and SetChannelBinding method to krbAuth struct |
| integratedauth/winsspi/winsspi.go | Adds stub SetChannelBinding implementation for Windows SSPI auth |
| integratedauth/auth_test.go | Updates stub authenticator with SetChannelBinding method |
| examples/channel_binding/tsql.go | New example demonstrating channel binding usage with both NTLM and Kerberos authentication |
integratedauth/krb5/krb5.go
Outdated
| channelBinding []byte | ||
| } | ||
|
|
||
| func (k *krbAuth) SetChannelBinding(channelBinding []byte) { | ||
| k.channelBinding = channelBinding | ||
| } | ||
|
|
There was a problem hiding this comment.
The channelBinding field is stored but never used in the Kerberos authentication flow. The field should either be integrated into the authentication logic (e.g., passed to the SPNEGO client) or removed if channel binding is not supported for Kerberos authentication in this implementation.
| channelBinding []byte | |
| } | |
| func (k *krbAuth) SetChannelBinding(channelBinding []byte) { | |
| k.channelBinding = channelBinding | |
| } | |
| } |
|
thx for opening a PR! |
3 participants
TODO: