Introducing native shims for libgssapi in order to support NegotiateStream

src/Common/src/Interop/Unix/Interop.Libraries.cs

@@ -9,6 +9,7 @@ private static partial class Libraries
         // Shims
         internal const string SystemNative = "System.Native";
         internal const string HttpNative = "System.Net.Http.Native";
+        internal const string NetSecurityNative = "System.Net.Security.Native";
         internal const string CryptoNative = "System.Security.Cryptography.Native";
         internal const string GlobalizationNative = "System.Globalization.Native";
         internal const string CompressionNative = "System.IO.Compression.Native";

src/Common/src/Interop/Unix/System.Net.Security.Native/Interop.GssApi.cs

@@ -0,0 +1,128 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+internal static partial class Interop
+{
+    internal static class GssApi
+    {
+        internal static bool EstablishSecurityContext(
+            ref SafeGssContextHandle context,
+            SafeGssCredHandle credential,
+            bool isNtlm,
+            SafeGssNameHandle targetName,
+            Interop.NetSecurityNative.GssFlags inFlags,
+            byte[] buffer,
+            out byte[] outputBuffer,
+            out uint outFlags)
+        {
+            outputBuffer = null;
+            outFlags = 0;
+
+            // EstablishSecurityContext is called multiple times in a session.
+            // In each call, we need to pass the context handle from the previous call.
+            // For the first call, the context handle will be null.
+            if (context == null)
+            {
+                context = new SafeGssContextHandle();
+            }
+
+            Interop.NetSecurityNative.GssBuffer token = default(Interop.NetSecurityNative.GssBuffer);
+            Interop.NetSecurityNative.Status status;
+
+            try
+            {
+                Interop.NetSecurityNative.Status minorStatus;
+                status = NetSecurityNative.InitSecContext(out minorStatus,
+                                                          credential,
+                                                          ref context,
+                                                          isNtlm,
+                                                          targetName,
+                                                          (uint)inFlags,
+                                                          buffer,
+                                                          (buffer == null) ? 0 : buffer.Length,
+                                                          ref token,
+                                                          out outFlags);
+
+                if ((status != NetSecurityNative.Status.GSS_S_COMPLETE) && (status != NetSecurityNative.Status.GSS_S_CONTINUE_NEEDED))
+                {
+                    throw new NetSecurityNative.GssApiException(status, minorStatus);
+                }
+
+                outputBuffer = token.ToByteArray();
+            }
+            finally
+            {
+                token.Dispose();
+            }
+
+            return status == NetSecurityNative.Status.GSS_S_COMPLETE;
+        }
+
+        internal static byte[] Encrypt(
+            SafeGssContextHandle context,
+            bool encrypt,
+            byte[] buffer,
+            int offset,
+            int count)
+        {
+            Debug.Assert((buffer != null) && (buffer.Length > 0), "Invalid input buffer passed to Encrypt");
+            Debug.Assert((offset >= 0) && (offset < buffer.Length), "Invalid input offset passed to Encrypt");
+            Debug.Assert((count > 0) && (count <= (buffer.Length - offset)), "Invalid input count passed to Encrypt");
+
+            Interop.NetSecurityNative.GssBuffer encryptedBuffer = default(Interop.NetSecurityNative.GssBuffer);
+            try
+            {
+
+                NetSecurityNative.Status minorStatus;
+                NetSecurityNative.Status status = NetSecurityNative.Wrap(out minorStatus, context, encrypt, buffer, offset, count, ref encryptedBuffer);
+                if (status != NetSecurityNative.Status.GSS_S_COMPLETE)
+                {
+                    throw new NetSecurityNative.GssApiException(status, minorStatus);
+                }
+
+                return encryptedBuffer.ToByteArray();
+            }
+            finally
+            {
+                encryptedBuffer.Dispose();
+            }
+        }
+
+        internal static int Decrypt(
+            SafeGssContextHandle context,
+            byte[] buffer,
+            int offset,
+            int count)
+        {
+            Debug.Assert((buffer != null) && (buffer.Length > 0), "Invalid input buffer passed to Decrypt");
+            Debug.Assert((offset >= 0) && (offset <= buffer.Length), "Invalid input offset passed to Decrypt");
+            Debug.Assert((count > 0) && (count <= (buffer.Length - offset)), "Invalid input count passed to Decrypt");
+
+            Interop.NetSecurityNative.GssBuffer decryptedBuffer = default(Interop.NetSecurityNative.GssBuffer);
+            try
+            {
+                NetSecurityNative.Status minorStatus;
+                NetSecurityNative.Status status = NetSecurityNative.Unwrap(out minorStatus, context, buffer, offset, count, ref decryptedBuffer);
+                if (status != NetSecurityNative.Status.GSS_S_COMPLETE)
+                {
+                    throw new NetSecurityNative.GssApiException(status, minorStatus);
+                }
+
+                return decryptedBuffer.Copy(buffer, offset);
+            }
+            finally
+            {
+                decryptedBuffer.Dispose();
+            }
+        }
+    }
+}
+
+

src/Common/src/Interop/Unix/System.Net.Security.Native/Interop.GssApiException.cs

@@ -0,0 +1,61 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+
+internal static partial class Interop
+{
+    internal static partial class NetSecurityNative
+    {
+        internal sealed class GssApiException : Exception
+        {
+            private readonly Status _minorStatus;
+
+            public Status MinorStatus
+            {
+                get { return _minorStatus;  }
+            }
+
+            public GssApiException(string message) : base(message)
+            {
+            }
+
+            public GssApiException(Status majorStatus, Status minorStatus)
+                : base(GetGssApiDisplayStatus(majorStatus, minorStatus))
+            {
+                HResult = (int)majorStatus;
+                _minorStatus = minorStatus;
+            }
+
+            private static string GetGssApiDisplayStatus(Status majorStatus, Status minorStatus)
+            {
+                string majorError = GetGssApiDisplayStatus(majorStatus, false);
+                string minorError = GetGssApiDisplayStatus(minorStatus, true);
+
+                return (majorError != null && minorError != null) ?
+                    SR.Format(SR.net_gssapi_operation_failed_detailed, majorError, minorError) :
+                    SR.Format(SR.net_gssapi_operation_failed, majorStatus.ToString("x8"), minorStatus.ToString("x8"));
+            }
+
+            private static string GetGssApiDisplayStatus(Status status, bool isMinor)
+            {
+                GssBuffer displayBuffer = default(GssBuffer);
+                Interop.NetSecurityNative.Status minStat;
+
+                try
+                {
+                    Interop.NetSecurityNative.Status displayCallStatus = DisplayStatus(out minStat, status, isMinor, ref displayBuffer);
+                    return (Status.GSS_S_COMPLETE != displayCallStatus) ? null : Marshal.PtrToStringAnsi(displayBuffer.data);
+                }
+                finally
+                {
+                    displayBuffer.Dispose();
+                }
+            }
+        }
+    }
+}

src/Common/src/Interop/Unix/System.Net.Security.Native/Interop.GssBuffer.cs

@@ -0,0 +1,67 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+internal static partial class Interop
+{
+    internal static partial class NetSecurityNative
+    {
+        [StructLayout(LayoutKind.Sequential)]
+        internal unsafe struct GssBuffer : IDisposable
+        {
+            internal UInt64 length;
+            internal IntPtr data;
+
+            internal int Copy(byte[] destination, int offset)
+            {
+                Debug.Assert(destination != null, "target destination cannot be null");
+                Debug.Assert(offset >= 0 && offset < destination.Length, "invalid offset " + offset);
+
+                if (data == IntPtr.Zero || length == 0)
+                {
+                    return 0;
+                }
+
+                int bufferLength = Convert.ToInt32(length);
+                int available = destination.Length - offset;  // amount of space in the given buffer
+                if (bufferLength > available)
+                {
+                    throw new NetSecurityNative.GssApiException(SR.Format(SR.net_context_buffer_too_small, bufferLength, available));
+                }
+
+                Marshal.Copy(data, destination, offset, bufferLength);
+                return bufferLength;
+            }
+
+            internal byte[] ToByteArray()
+            {
+                if (data == IntPtr.Zero || length == 0)
+                {
+                    return Array.Empty<byte>();
+                }
+
+                int bufferLength = Convert.ToInt32(length);
+                byte[] destination = new byte[bufferLength];
+                Marshal.Copy(data, destination, 0, bufferLength);
+                return destination;
+            }
+
+            public void Dispose()
+            {
+                if (data != IntPtr.Zero)
+                {
+                    Interop.NetSecurityNative.ReleaseGssBuffer(data, length);
+                    data = IntPtr.Zero;
+                }
+
+                length = 0;
+            }
+        }
+    }
+}
+

src/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs

@@ -0,0 +1,126 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+internal static partial class Interop
+{
+    internal static partial class NetSecurityNative
+    {
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_ReleaseGssBuffer")]
+        internal static extern void ReleaseGssBuffer(
+            IntPtr bufferPtr,
+            UInt64 length);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_DisplayStatus")]
+        internal static extern Status DisplayStatus(
+            out Status minorStatus,
+            Status statusValue,
+            bool isGssMechCode,
+            ref GssBuffer buffer);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, CharSet = CharSet.Ansi, EntryPoint="NetSecurityNative_ImportUserName")]
+        internal static extern Status ImportUserName(
+            out Status minorStatus,
+            string inputName,
+            int inputNameLen,
+            out SafeGssNameHandle outputName);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, CharSet = CharSet.Ansi, EntryPoint="NetSecurityNative_ImportPrincipalName")]
+        internal static extern Status ImportPrincipalName(
+            out Status minorStatus,
+            string inputName,
+            int inputNameLen,
+            out SafeGssNameHandle outputName);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_ReleaseName")]
+        internal static extern Status ReleaseName(
+            out Status minorStatus,
+            ref IntPtr inputName);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_InitiateCredSpNego")]
+        internal static extern Status InitiateCredSpNego(
+            out Status minorStatus,
+            SafeGssNameHandle desiredName,
+            out SafeGssCredHandle outputCredHandle);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, CharSet = CharSet.Ansi, EntryPoint="NetSecurityNative_InitiateCredWithPassword")]
+        internal static extern Status InitiateCredWithPassword(
+            out Status minorStatus,
+            SafeGssNameHandle desiredName,
+            string password,
+            int passwordLen,
+            out SafeGssCredHandle outputCredHandle);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_ReleaseCred")]
+        internal static extern Status ReleaseCred(
+            out Status minorStatus,
+            ref IntPtr credHandle);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_InitSecContext")]
+        internal static extern Status InitSecContext(
+            out Status minorStatus,
+            SafeGssCredHandle initiatorCredHandle,
+            ref SafeGssContextHandle contextHandle,
+            bool isNtlm,
+            SafeGssNameHandle targetName,
+            uint reqFlags,
+            byte[] inputBytes,
+            int inputLength,
+            ref GssBuffer token,
+            out uint retFlags);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_DeleteSecContext")]
+        internal static extern Status DeleteSecContext(
+            out Status minorStatus,
+            ref IntPtr contextHandle);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Wrap")]
+        internal static extern Status Wrap(
+            out Status minorStatus,
+            SafeGssContextHandle contextHandle,
+            bool isEncrypt,
+            byte[] inputBytes,
+            int offset,
+            int count,
+            ref GssBuffer outBuffer);
+
+        [DllImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
+        internal static extern Status Unwrap(
+            out Status minorStatus,
+            SafeGssContextHandle contextHandle,
+            byte[] inputBytes,
+            int offset,
+            int count,
+            ref GssBuffer outBuffer);
+
+        internal enum Status : uint
+        {
+            GSS_S_COMPLETE = 0,
+            GSS_S_CONTINUE_NEEDED = 1
+        }
+
+        [Flags]
+        internal enum GssFlags : uint
+        {
+            GSS_C_DELEG_FLAG = 0x1,
+            GSS_C_MUTUAL_FLAG = 0x2,
+            GSS_C_REPLAY_FLAG = 0x4,
+            GSS_C_SEQUENCE_FLAG = 0x8,
+            GSS_C_CONF_FLAG = 0x10,
+            GSS_C_INTEG_FLAG = 0x20,
+            GSS_C_ANON_FLAG = 0x40,
+            GSS_C_PROT_READY_FLAG = 0x80,
+            GSS_C_TRANS_FLAG = 0x100,
+            GSS_C_DCE_STYLE = 0x1000,
+            GSS_C_IDENTIFY_FLAG = 0x2000,
+            GSS_C_EXTENDED_ERROR_FLAG = 0x4000,
+            GSS_C_DELEG_POLICY_FLAG = 0x8000
+        }
+    }
+}