Improve allocations in NegotiateStreamPal#71280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wfurt merged 5 commits into from
Jun 29, 2022
Merged

Improve allocations in NegotiateStreamPal #71280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1dd747d
Reduce buffer allocations during NTLM/Negotiate authentication
filipnavara Jun 25, 2022
49c1ed0
Update ReadWriteAdapter.WriteAsync prototype to use Memory<byte> inst…
filipnavara Jun 25, 2022
2fe4491
Spanify NTAuthentication.Decrypt and avoid couple of offset/count checks
filipnavara Jun 25, 2022
3b4aff6
Spanify NegotiateStreamPal.VerifySignature/MakeSignature.
filipnavara Jun 25, 2022
46e05a4
Update src/libraries/Common/src/System/Net/NTAuthentication.Common.cs
filipnavara Jun 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 8 additions & 11 deletions ...libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -210,10 +210,10 @@ private static unsafe partial Status Wrap(
ref GssBuffer outBuffer);

[LibraryImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
private static partial Status Unwrap(
private static unsafe partial Status Unwrap(
out Status minorStatus,
SafeGssContextHandle? contextHandle,
byte[] inputBytes,
byte* inputBytes,

@wfurtwfurtJun 27, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offset any more? It feels like if we pass pointer we can just do count.

@filipnavarafilipnavaraJun 27, 2022•
edited
Loading

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't. Unfortunately, dotnet/sqlclient uses the native APIs, so I didn't feel confident in changing it. I am quite sure they don't use this particular API though.

@MichalPetrykaMichalPetrykaJun 27, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't the pointer change by itself be breaking for them?

@filipnavarafilipnavaraJun 27, 2022•
edited
Loading

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't change the native code side, the prototype remains unchanged there. They basically copied the managed side of the interop. (We cannot change the signature, add parameters, remove parameters, or change their types. We can change how they are marshalled on the C# side though.)

@wfurtwfurtJun 27, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @JRahnama just in case.

@filipnavarafilipnavaraJun 29, 2022

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cross-checked with the SqlClient source and this particular native method is not referenced so we can remove the offset parameter. I will do that in a follow-up PR (#71373) since I need to update the native interop there anyway.

int offset,
int count,
ref GssBuffer outBuffer);
Expand All@@ -231,19 +231,16 @@ internal static unsafe Status WrapBuffer(
}
}

internal static Status UnwrapBuffer(
internal static unsafe Status UnwrapBuffer(
out Status minorStatus,
SafeGssContextHandle? contextHandle,
byte[] inputBytes,
int offset,
int count,
ReadOnlySpan<byte> inputBytes,
ref GssBuffer outBuffer)
{
Debug.Assert(inputBytes != null, "inputBytes must be valid value");
Debug.Assert(offset >= 0 && offset <= inputBytes.Length, "offset must be valid");
Debug.Assert(count >= 0 && count <= inputBytes.Length, "count must be valid");

return Unwrap(out minorStatus, contextHandle, inputBytes, offset, count, ref outBuffer);
fixed (byte* inputBytesPtr = inputBytes)
{
return Unwrap(out minorStatus, contextHandle, inputBytesPtr, 0, inputBytes.Length, ref outBuffer);
}
}
}
}
2 changes: 1 addition & 1 deletion src/libraries/Common/src/Interop/Windows/SspiCli/ISSPIInterface.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -25,7 +25,7 @@ internal interface ISSPIInterface
int QueryContextChannelBinding(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeContextBufferChannelBinding refHandle);
int QueryContextAttributes(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, Span<byte> buffer, Type? handleType, out SafeHandle? refHandle);
int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityContextTokenHandle phToken);
int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer);
int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer);
int ApplyControlToken(ref SafeDeleteContext? refContext, in SecurityBuffer inputBuffer);
}
}
2 changes: 1 addition & 1 deletion src/libraries/Common/src/Interop/Windows/SspiCli/SSPIAuthType.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -168,7 +168,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
return GetSecurityContextToken(phContext, out phToken);
}

public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
{
return SafeDeleteContext.CompleteAuthToken(ref refContext, in inputBuffer);
}
Expand Down
2 changes: 1 addition & 1 deletion src/libraries/Common/src/Interop/Windows/SspiCli/SSPISecureChannelType.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
throw new NotSupportedException();
}

public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
{
throw new NotSupportedException();
}
Expand Down
143 changes: 1 addition & 142 deletions src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -163,7 +163,7 @@ internal static int AcceptSecurityContext(ISSPIInterface secModule, SafeFreeCred
return errorCode;
}

internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in SecurityBuffer inputBuffer)
internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in InputSecurityBuffer inputBuffer)
{
int errorCode = secModule.CompleteAuthToken(ref context, in inputBuffer);

Expand All@@ -186,147 +186,6 @@ public static int QuerySecurityContextToken(ISSPIInterface secModule, SafeDelete
return secModule.QuerySecurityContextToken(context, out token);
}

public static int EncryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
{
return EncryptDecryptHelper(OP.Encrypt, secModule, context, input, sequenceNumber);
}

public static int DecryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
{
return EncryptDecryptHelper(OP.Decrypt, secModule, context, input, sequenceNumber);
}

internal static int MakeSignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
{
return EncryptDecryptHelper(OP.MakeSignature, secModule, context, input, sequenceNumber);
}

public static int VerifySignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
{
return EncryptDecryptHelper(OP.VerifySignature, secModule, context, input, sequenceNumber);
}

private enum OP
{
Encrypt = 1,
Decrypt,
MakeSignature,
VerifySignature
}

[StructLayout(LayoutKind.Sequential)]
private ref struct ThreeByteArrays
{
public const int NumItems = 3;
internal byte[] _item0;
private byte[] _item1;
private byte[] _item2;
}

private static unsafe int EncryptDecryptHelper(OP op, ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
{
Debug.Assert(Enum.IsDefined<OP>(op), $"Unknown op: {op}");
Debug.Assert(input.Length <= 3, "The below logic only works for 3 or fewer buffers.");

Interop.SspiCli.SecBufferDesc sdcInOut = new Interop.SspiCli.SecBufferDesc(input.Length);
Span<Interop.SspiCli.SecBuffer> unmanagedBuffer = stackalloc Interop.SspiCli.SecBuffer[input.Length];
unmanagedBuffer.Clear();

fixed (Interop.SspiCli.SecBuffer* unmanagedBufferPtr = unmanagedBuffer)
fixed (byte* pinnedBuffer0 = input.Length > 0 ? input[0].token : null)
fixed (byte* pinnedBuffer1 = input.Length > 1 ? input[1].token : null)
fixed (byte* pinnedBuffer2 = input.Length > 2 ? input[2].token : null)
{
sdcInOut.pBuffers = unmanagedBufferPtr;

ThreeByteArrays byteArrayStruct = default;
Span<byte[]> buffers = MemoryMarshal.CreateSpan(ref byteArrayStruct._item0!, ThreeByteArrays.NumItems).Slice(0, input.Length);

for (int i = 0; i < input.Length; i++)
{
ref readonly SecurityBuffer iBuffer = ref input[i];
unmanagedBuffer[i].cbBuffer = iBuffer.size;
unmanagedBuffer[i].BufferType = iBuffer.type;
if (iBuffer.token == null || iBuffer.token.Length == 0)
{
unmanagedBuffer[i].pvBuffer = IntPtr.Zero;
}
else
{
unmanagedBuffer[i].pvBuffer = Marshal.UnsafeAddrOfPinnedArrayElement(iBuffer.token, iBuffer.offset);
buffers[i] = iBuffer.token;
}
}

// The result is written in the input Buffer passed as type=BufferType.Data.
int errorCode = op switch
{
OP.Encrypt => secModule.EncryptMessage(context, ref sdcInOut, sequenceNumber),
OP.Decrypt => secModule.DecryptMessage(context, ref sdcInOut, sequenceNumber),
OP.MakeSignature => secModule.MakeSignature(context, ref sdcInOut, sequenceNumber),
_ /* OP.VerifySignature */ => secModule.VerifySignature(context, ref sdcInOut, sequenceNumber),
};

// Marshalling back returned sizes / data.
for (int i = 0; i < input.Length; i++)
{
ref SecurityBuffer iBuffer = ref input[i];
iBuffer.size = unmanagedBuffer[i].cbBuffer;
iBuffer.type = unmanagedBuffer[i].BufferType;

if (iBuffer.size == 0)
{
iBuffer.offset = 0;
iBuffer.token = null;
}
else
{

// Find the buffer this is inside of. Usually they all point inside buffer 0.
int j;
for (j = 0; j < input.Length; j++)
{
if (buffers[j] != null)
{
checked
{
byte* bufferAddress = (byte*)Marshal.UnsafeAddrOfPinnedArrayElement(buffers[j], 0);
if ((byte*)unmanagedBuffer[i].pvBuffer >= bufferAddress &&
(byte*)unmanagedBuffer[i].pvBuffer + iBuffer.size <= bufferAddress + buffers[j].Length)
{
iBuffer.offset = (int)((byte*)unmanagedBuffer[i].pvBuffer - bufferAddress);
iBuffer.token = buffers[j];
break;
}
}
}
}

if (j >= input.Length)
{
Debug.Fail("Output buffer out of range.");
iBuffer.size = 0;
iBuffer.offset = 0;
iBuffer.token = null;
}
}

// Backup validate the new sizes.
Debug.Assert(iBuffer.offset >= 0 && iBuffer.offset <= (iBuffer.token == null ? 0 : iBuffer.token.Length), $"'offset' out of range. [{iBuffer.offset}]");
Debug.Assert(iBuffer.size >= 0 && iBuffer.size <= (iBuffer.token == null ? 0 : iBuffer.token.Length - iBuffer.offset), $"'size' out of range. [{iBuffer.size}]");
}

if (NetEventSource.Log.IsEnabled() && errorCode != 0)
{
NetEventSource.Error(null, errorCode == Interop.SspiCli.SEC_I_RENEGOTIATE ?
SR.Format(SR.event_OperationReturnedSomething, op, "SEC_I_RENEGOTIATE") :
SR.Format(SR.net_log_operation_failed_with_error, op, $"0x{0:X}"));
}

return errorCode;
}
}

public static SafeFreeContextBufferChannelBinding? QueryContextChannelBinding(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute contextAttribute)
{
SafeFreeContextBufferChannelBinding result;
Expand Down
27 changes: 14 additions & 13 deletions src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -472,9 +472,13 @@ internal static unsafe int InitializeSecurityContext(
// Get unmanaged buffer with index 0 as the only one passed into PInvoke.
outSecBuffer.size = outUnmanagedBuffer.cbBuffer;
outSecBuffer.type = outUnmanagedBuffer.BufferType;
outSecBuffer.token = outSecBuffer.size > 0 ?
new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
null;

if (isSspiAllocated)
{
outSecBuffer.token = outSecBuffer.size > 0 ?
new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
null;
}

if (inSecBuffers.Count > 1 && inUnmanagedBuffer[1].BufferType == SecurityBufferType.SECBUFFER_EXTRA && inSecBuffers._item1.Type == SecurityBufferType.SECBUFFER_EMPTY)
{
Expand DownExpand Up@@ -952,25 +956,22 @@ private static unsafe int MustRunAcceptSecurityContext_SECURITY(

internal static unsafe int CompleteAuthToken(
ref SafeDeleteSslContext? refContext,
in SecurityBuffer inSecBuffer)
in InputSecurityBuffer inSecBuffer)
{
if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}, inSecBuffer = {inSecBuffer}");
if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}");

var inSecurityBufferDescriptor = new Interop.SspiCli.SecBufferDesc(1);
int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;

Interop.SspiCli.SecBuffer inUnmanagedBuffer = default;
inSecurityBufferDescriptor.pBuffers = &inUnmanagedBuffer;
fixed (byte* pinnedToken = inSecBuffer.token)
fixed (byte* pinnedToken = inSecBuffer.Token)
{
inUnmanagedBuffer.cbBuffer = inSecBuffer.size;
inUnmanagedBuffer.BufferType = inSecBuffer.type;

// Use the unmanaged token if it's not null; otherwise use the managed buffer.
Debug.Assert(inSecBuffer.UnmanagedToken != null);
inUnmanagedBuffer.cbBuffer = inSecBuffer.Token.Length;
inUnmanagedBuffer.BufferType = inSecBuffer.Type;
inUnmanagedBuffer.pvBuffer =
inSecBuffer.unmanagedToken != null ? inSecBuffer.unmanagedToken.DangerousGetHandle() :
inSecBuffer.token == null || inSecBuffer.token.Length == 0 ? IntPtr.Zero :
(IntPtr)(pinnedToken + inSecBuffer.offset);
inSecBuffer.Token.IsEmpty ? IntPtr.Zero : (IntPtr)pinnedToken;

Interop.SspiCli.CredHandle contextHandle = refContext != null ? refContext._handle : default;
if (refContext == null || refContext.IsInvalid)
Expand Down
33 changes: 21 additions & 12 deletions src/libraries/Common/src/System/Net/NTAuthentication.Common.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -20,6 +20,7 @@ internal sealed partial class NTAuthentication
private string? _spn;

private int _tokenSize;
private byte[]? _tokenBuffer;
private ContextFlagsPal _requestedContextFlags;
private ContextFlagsPal _contextFlags;

Expand DownExpand Up@@ -158,14 +159,14 @@ internal void CloseContext()
_isCompleted = false;
}

internal int VerifySignature(byte[] buffer, int offset, int count)
internal int VerifySignature(ReadOnlySpan<byte> buffer)
{
return NegotiateStreamPal.VerifySignature(_securityContext!, buffer, offset, count);
return NegotiateStreamPal.VerifySignature(_securityContext!, buffer);
}

internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref byte[] output)
internal int MakeSignature(ReadOnlySpan<byte> buffer, [AllowNull] ref byte[] output)
{
return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, offset, count, ref output);
return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, ref output);
}

internal string? GetOutgoingBlob(string? incomingBlob)
Expand DownExpand Up@@ -221,9 +222,10 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref

internal byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, bool throwOnError, out SecurityStatusPal statusCode)
{
byte[]? result = new byte[_tokenSize];
_tokenBuffer ??= _tokenSize == 0 ? Array.Empty<byte>() : new byte[_tokenSize];
Comment thread
stephentoub marked this conversation as resolved.

bool firstTime = _securityContext == null;
int resultBlobLength;
try
{
if (!_isServer)
Expand All@@ -236,18 +238,19 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
_requestedContextFlags,
incomingBlob,
_channelBinding,
ref result,
ref _tokenBuffer,
out resultBlobLength,
ref _contextFlags);

if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.InitializeSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

if (statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded)
{
statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, result);
statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, _tokenBuffer.AsSpan(0, resultBlobLength));

if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.CompleteAuthToken() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

result = null;
resultBlobLength = 0;
}
}
else
Expand All@@ -259,7 +262,8 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
_requestedContextFlags,
incomingBlob,
_channelBinding,
ref result,
ref _tokenBuffer,
out resultBlobLength,
ref _contextFlags);

if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.AcceptSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");
Expand All@@ -284,6 +288,7 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
{
CloseContext();
_isCompleted = true;
_tokenBuffer = null;
if (throwOnError)
{
throw NegotiateStreamPal.CreateExceptionFromError(statusCode);
Expand All@@ -297,12 +302,18 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
SSPIHandleCache.CacheCredential(_credentialsHandle);
}

byte[]? result =
resultBlobLength == 0 || _tokenBuffer == null ? null :
_tokenBuffer.Length == resultBlobLength ? _tokenBuffer :
_tokenBuffer[0..resultBlobLength];

// The return value will tell us correctly if the handshake is over or not
if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK
|| (_isServer && statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded))
{
// Success.
_isCompleted = true;
_tokenBuffer = null;
}
else
{
Expand DownExpand Up@@ -335,13 +346,11 @@ internal int Encrypt(ReadOnlySpan<byte> buffer, [NotNull] ref byte[]? output, ui
sequenceNumber);
}

internal int Decrypt(byte[] payload, int offset, int count, out int newOffset, uint expectedSeqNumber)
internal int Decrypt(Span<byte> payload, out int newOffset, uint expectedSeqNumber)
{
return NegotiateStreamPal.Decrypt(
_securityContext!,
payload,
offset,
count,
(_contextFlags & ContextFlagsPal.Confidentiality) != 0,
IsNTLM,
out newOffset,
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Improve allocations in NegotiateStreamPal#71280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

wfurt
merged 5 commits into

from

Jun 29, 2022
 Merged


Improve allocations in NegotiateStreamPal
#71280
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
1dd747d

Reduce buffer allocations during NTLM/Negotiate authentication


filipnavara Jun 25, 2022
49c1ed0

Update ReadWriteAdapter.WriteAsync prototype to use Memory<byte> inst…


filipnavara Jun 25, 2022
2fe4491

Spanify NTAuthentication.Decrypt and avoid couple of offset/count checks


filipnavara Jun 25, 2022
3b4aff6

Spanify NegotiateStreamPal.VerifySignature/MakeSignature.


filipnavara Jun 25, 2022
46e05a4

Update src/libraries/Common/src/System/Net/NTAuthentication.Common.cs


filipnavara Jun 28, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 8 additions & 11 deletions
...libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -210,10 +210,10 @@ private static unsafe partial Status Wrap(
 ref GssBuffer outBuffer);

 [LibraryImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
 private static partial Status Unwrap(
 private static unsafe partial Status Unwrap(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 byte* inputBytes,
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offset any more? It feels like if we pass pointer we can just do count.
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't. Unfortunately, dotnet/sqlclient uses the native APIs, so I didn't feel confident in changing it. I am quite sure they don't use this particular API though.
@MichalPetrykaMichalPetrykaJun 27, 2022

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't the pointer change by itself be breaking for them?
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't change the native code side, the prototype remains unchanged there. They basically copied the managed side of the interop. (We cannot change the signature, add parameters, remove parameters, or change their types. We can change how they are marshalled on the C# side though.)
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @JRahnama just in case.
@filipnavarafilipnavaraJun 29, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cross-checked with the SqlClient source and this particular native method is not referenced so we can remove the offset parameter. I will do that in a follow-up PR (#71373) since I need to update the native interop there anyway.
 int offset,
 int count,
 ref GssBuffer outBuffer);
Expand All@@ -231,19 +231,16 @@ internal static unsafe Status WrapBuffer(
 }
 }

 internal static Status UnwrapBuffer(
 internal static unsafe Status UnwrapBuffer(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 int offset,
 int count,
 ReadOnlySpan<byte> inputBytes,
 ref GssBuffer outBuffer)
 {
 Debug.Assert(inputBytes != null, "inputBytes must be valid value");
 Debug.Assert(offset >= 0 && offset <= inputBytes.Length, "offset must be valid");
 Debug.Assert(count >= 0 && count <= inputBytes.Length, "count must be valid");

 return Unwrap(out minorStatus, contextHandle, inputBytes, offset, count, ref outBuffer);
 fixed (byte* inputBytesPtr = inputBytes)
 {
 return Unwrap(out minorStatus, contextHandle, inputBytesPtr, 0, inputBytes.Length, ref outBuffer);
 }
 }
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/ISSPIInterface.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -25,7 +25,7 @@ internal interface ISSPIInterface
 int QueryContextChannelBinding(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeContextBufferChannelBinding refHandle);
 int QueryContextAttributes(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, Span<byte> buffer, Type? handleType, out SafeHandle? refHandle);
 int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityContextTokenHandle phToken);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer);
 int ApplyControlToken(ref SafeDeleteContext? refContext, in SecurityBuffer inputBuffer);
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIAuthType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -168,7 +168,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 return GetSecurityContextToken(phContext, out phToken);
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 return SafeDeleteContext.CompleteAuthToken(ref refContext, in inputBuffer);
 }
Expand Down

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPISecureChannelType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 throw new NotSupportedException();
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 throw new NotSupportedException();
 }
Expand Down

143 changes: 1 addition & 142 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -163,7 +163,7 @@ internal static int AcceptSecurityContext(ISSPIInterface secModule, SafeFreeCred
 return errorCode;
 }

 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in SecurityBuffer inputBuffer)
 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in InputSecurityBuffer inputBuffer)
 {
 int errorCode = secModule.CompleteAuthToken(ref context, in inputBuffer);

Expand All@@ -186,147 +186,6 @@ public static int QuerySecurityContextToken(ISSPIInterface secModule, SafeDelete
 return secModule.QuerySecurityContextToken(context, out token);
 }

 public static int EncryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Encrypt, secModule, context, input, sequenceNumber);
 }

 public static int DecryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Decrypt, secModule, context, input, sequenceNumber);
 }

 internal static int MakeSignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.MakeSignature, secModule, context, input, sequenceNumber);
 }

 public static int VerifySignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.VerifySignature, secModule, context, input, sequenceNumber);
 }

 private enum OP
 {
 Encrypt = 1,
 Decrypt,
 MakeSignature,
 VerifySignature
 }

 [StructLayout(LayoutKind.Sequential)]
 private ref struct ThreeByteArrays
 {
 public const int NumItems = 3;
 internal byte[] _item0;
 private byte[] _item1;
 private byte[] _item2;
 }

 private static unsafe int EncryptDecryptHelper(OP op, ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 Debug.Assert(Enum.IsDefined<OP>(op), $"Unknown op: {op}");
 Debug.Assert(input.Length <= 3, "The below logic only works for 3 or fewer buffers.");

 Interop.SspiCli.SecBufferDesc sdcInOut = new Interop.SspiCli.SecBufferDesc(input.Length);
 Span<Interop.SspiCli.SecBuffer> unmanagedBuffer = stackalloc Interop.SspiCli.SecBuffer[input.Length];
 unmanagedBuffer.Clear();

 fixed (Interop.SspiCli.SecBuffer* unmanagedBufferPtr = unmanagedBuffer)
 fixed (byte* pinnedBuffer0 = input.Length > 0 ? input[0].token : null)
 fixed (byte* pinnedBuffer1 = input.Length > 1 ? input[1].token : null)
 fixed (byte* pinnedBuffer2 = input.Length > 2 ? input[2].token : null)
 {
 sdcInOut.pBuffers = unmanagedBufferPtr;

 ThreeByteArrays byteArrayStruct = default;
 Span<byte[]> buffers = MemoryMarshal.CreateSpan(ref byteArrayStruct._item0!, ThreeByteArrays.NumItems).Slice(0, input.Length);

 for (int i = 0; i < input.Length; i++)
 {
 ref readonly SecurityBuffer iBuffer = ref input[i];
 unmanagedBuffer[i].cbBuffer = iBuffer.size;
 unmanagedBuffer[i].BufferType = iBuffer.type;
 if (iBuffer.token == null || iBuffer.token.Length == 0)
 {
 unmanagedBuffer[i].pvBuffer = IntPtr.Zero;
 }
 else
 {
 unmanagedBuffer[i].pvBuffer = Marshal.UnsafeAddrOfPinnedArrayElement(iBuffer.token, iBuffer.offset);
 buffers[i] = iBuffer.token;
 }
 }

 // The result is written in the input Buffer passed as type=BufferType.Data.
 int errorCode = op switch
 {
 OP.Encrypt => secModule.EncryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.Decrypt => secModule.DecryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.MakeSignature => secModule.MakeSignature(context, ref sdcInOut, sequenceNumber),
 _ /* OP.VerifySignature */ => secModule.VerifySignature(context, ref sdcInOut, sequenceNumber),
 };

 // Marshalling back returned sizes / data.
 for (int i = 0; i < input.Length; i++)
 {
 ref SecurityBuffer iBuffer = ref input[i];
 iBuffer.size = unmanagedBuffer[i].cbBuffer;
 iBuffer.type = unmanagedBuffer[i].BufferType;

 if (iBuffer.size == 0)
 {
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 else
 {

 // Find the buffer this is inside of. Usually they all point inside buffer 0.
 int j;
 for (j = 0; j < input.Length; j++)
 {
 if (buffers[j] != null)
 {
 checked
 {
 byte* bufferAddress = (byte*)Marshal.UnsafeAddrOfPinnedArrayElement(buffers[j], 0);
 if ((byte*)unmanagedBuffer[i].pvBuffer >= bufferAddress &&
 (byte*)unmanagedBuffer[i].pvBuffer + iBuffer.size <= bufferAddress + buffers[j].Length)
 {
 iBuffer.offset = (int)((byte*)unmanagedBuffer[i].pvBuffer - bufferAddress);
 iBuffer.token = buffers[j];
 break;
 }
 }
 }
 }

 if (j >= input.Length)
 {
 Debug.Fail("Output buffer out of range.");
 iBuffer.size = 0;
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 }

 // Backup validate the new sizes.
 Debug.Assert(iBuffer.offset >= 0 && iBuffer.offset <= (iBuffer.token == null ? 0 : iBuffer.token.Length), $"'offset' out of range. [{iBuffer.offset}]");
 Debug.Assert(iBuffer.size >= 0 && iBuffer.size <= (iBuffer.token == null ? 0 : iBuffer.token.Length - iBuffer.offset), $"'size' out of range. [{iBuffer.size}]");
 }

 if (NetEventSource.Log.IsEnabled() && errorCode != 0)
 {
 NetEventSource.Error(null, errorCode == Interop.SspiCli.SEC_I_RENEGOTIATE ?
 SR.Format(SR.event_OperationReturnedSomething, op, "SEC_I_RENEGOTIATE") :
 SR.Format(SR.net_log_operation_failed_with_error, op, $"0x{0:X}"));
 }

 return errorCode;
 }
 }

 public static SafeFreeContextBufferChannelBinding? QueryContextChannelBinding(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute contextAttribute)
 {
 SafeFreeContextBufferChannelBinding result;
Expand Down

27 changes: 14 additions & 13 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -472,9 +472,13 @@ internal static unsafe int InitializeSecurityContext(
 // Get unmanaged buffer with index 0 as the only one passed into PInvoke.
 outSecBuffer.size = outUnmanagedBuffer.cbBuffer;
 outSecBuffer.type = outUnmanagedBuffer.BufferType;
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;

 if (isSspiAllocated)
 {
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;
 }

 if (inSecBuffers.Count > 1 && inUnmanagedBuffer[1].BufferType == SecurityBufferType.SECBUFFER_EXTRA && inSecBuffers._item1.Type == SecurityBufferType.SECBUFFER_EMPTY)
 {
Expand DownExpand Up@@ -952,25 +956,22 @@ private static unsafe int MustRunAcceptSecurityContext_SECURITY(

 internal static unsafe int CompleteAuthToken(
 ref SafeDeleteSslContext? refContext,
 in SecurityBuffer inSecBuffer)
 in InputSecurityBuffer inSecBuffer)
 {
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}, inSecBuffer = {inSecBuffer}");
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}");

 var inSecurityBufferDescriptor = new Interop.SspiCli.SecBufferDesc(1);
 int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;

 Interop.SspiCli.SecBuffer inUnmanagedBuffer = default;
 inSecurityBufferDescriptor.pBuffers = &inUnmanagedBuffer;
 fixed (byte* pinnedToken = inSecBuffer.token)
 fixed (byte* pinnedToken = inSecBuffer.Token)
 {
 inUnmanagedBuffer.cbBuffer = inSecBuffer.size;
 inUnmanagedBuffer.BufferType = inSecBuffer.type;

 // Use the unmanaged token if it's not null; otherwise use the managed buffer.
 Debug.Assert(inSecBuffer.UnmanagedToken != null);
 inUnmanagedBuffer.cbBuffer = inSecBuffer.Token.Length;
 inUnmanagedBuffer.BufferType = inSecBuffer.Type;
 inUnmanagedBuffer.pvBuffer =
 inSecBuffer.unmanagedToken != null ? inSecBuffer.unmanagedToken.DangerousGetHandle() :
 inSecBuffer.token == null || inSecBuffer.token.Length == 0 ? IntPtr.Zero :
 (IntPtr)(pinnedToken + inSecBuffer.offset);
 inSecBuffer.Token.IsEmpty ? IntPtr.Zero : (IntPtr)pinnedToken;

 Interop.SspiCli.CredHandle contextHandle = refContext != null ? refContext._handle : default;
 if (refContext == null || refContext.IsInvalid)
Expand Down

33 changes: 21 additions & 12 deletions
src/libraries/Common/src/System/Net/NTAuthentication.Common.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,6 +20,7 @@ internal sealed partial class NTAuthentication
 private string? _spn;

 private int _tokenSize;
 private byte[]? _tokenBuffer;
 private ContextFlagsPal _requestedContextFlags;
 private ContextFlagsPal _contextFlags;

Expand DownExpand Up@@ -158,14 +159,14 @@ internal void CloseContext()
 _isCompleted = false;
 }

 internal int VerifySignature(byte[] buffer, int offset, int count)
 internal int VerifySignature(ReadOnlySpan<byte> buffer)
 {
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer, offset, count);
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer);
 }

 internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref byte[] output)
 internal int MakeSignature(ReadOnlySpan<byte> buffer, [AllowNull] ref byte[] output)
 {
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, offset, count, ref output);
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, ref output);
 }

 internal string? GetOutgoingBlob(string? incomingBlob)
Expand DownExpand Up@@ -221,9 +222,10 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref

 internal byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, bool throwOnError, out SecurityStatusPal statusCode)
 {
byte[]? result = new byte[_tokenSize];
_tokenBuffer ??= _tokenSize == 0 ? Array.Empty<byte>() : new byte[_tokenSize];
Comment thread
stephentoub marked this conversation as resolved.


 bool firstTime = _securityContext == null;
 int resultBlobLength;
 try
 {
 if (!_isServer)
Expand All@@ -236,18 +238,19 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.InitializeSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded)
 {
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, result);
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, _tokenBuffer.AsSpan(0, resultBlobLength));

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.CompleteAuthToken() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

result = null;
resultBlobLength = 0;
 }
 }
 else
Expand All@@ -259,7 +262,8 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.AcceptSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");
Expand All@@ -284,6 +288,7 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 {
 CloseContext();
 _isCompleted = true;
 _tokenBuffer = null;
 if (throwOnError)
 {
 throw NegotiateStreamPal.CreateExceptionFromError(statusCode);
Expand All@@ -297,12 +302,18 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 SSPIHandleCache.CacheCredential(_credentialsHandle);
 }

 byte[]? result =
 resultBlobLength == 0 || _tokenBuffer == null ? null :
 _tokenBuffer.Length == resultBlobLength ? _tokenBuffer :
 _tokenBuffer[0..resultBlobLength];

 // The return value will tell us correctly if the handshake is over or not
 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK
 || (_isServer && statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded))
 {
 // Success.
 _isCompleted = true;
 _tokenBuffer = null;
 }
 else
 {
Expand DownExpand Up@@ -335,13 +346,11 @@ internal int Encrypt(ReadOnlySpan<byte> buffer, [NotNull] ref byte[]? output, ui
 sequenceNumber);
 }

 internal int Decrypt(byte[] payload, int offset, int count, out int newOffset, uint expectedSeqNumber)
 internal int Decrypt(Span<byte> payload, out int newOffset, uint expectedSeqNumber)
 {
 return NegotiateStreamPal.Decrypt(
 _securityContext!,
 payload,
 offset,
 count,
 (_contextFlags & ContextFlagsPal.Confidentiality) != 0,
 IsNTLM,
 out newOffset,
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Improve allocations in NegotiateStreamPal#71280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

wfurt
merged 5 commits into

from

Jun 29, 2022
 Merged


Improve allocations in NegotiateStreamPal
#71280
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
1dd747d

Reduce buffer allocations during NTLM/Negotiate authentication


filipnavara Jun 25, 2022
49c1ed0

Update ReadWriteAdapter.WriteAsync prototype to use Memory<byte> inst…


filipnavara Jun 25, 2022
2fe4491

Spanify NTAuthentication.Decrypt and avoid couple of offset/count checks


filipnavara Jun 25, 2022
3b4aff6

Spanify NegotiateStreamPal.VerifySignature/MakeSignature.


filipnavara Jun 25, 2022
46e05a4

Update src/libraries/Common/src/System/Net/NTAuthentication.Common.cs


filipnavara Jun 28, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 8 additions & 11 deletions
...libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -210,10 +210,10 @@ private static unsafe partial Status Wrap(
 ref GssBuffer outBuffer);

 [LibraryImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
 private static partial Status Unwrap(
 private static unsafe partial Status Unwrap(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 byte* inputBytes,
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offset any more? It feels like if we pass pointer we can just do count.
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't. Unfortunately, dotnet/sqlclient uses the native APIs, so I didn't feel confident in changing it. I am quite sure they don't use this particular API though.
@MichalPetrykaMichalPetrykaJun 27, 2022

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't the pointer change by itself be breaking for them?
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't change the native code side, the prototype remains unchanged there. They basically copied the managed side of the interop. (We cannot change the signature, add parameters, remove parameters, or change their types. We can change how they are marshalled on the C# side though.)
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @JRahnama just in case.
@filipnavarafilipnavaraJun 29, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cross-checked with the SqlClient source and this particular native method is not referenced so we can remove the offset parameter. I will do that in a follow-up PR (#71373) since I need to update the native interop there anyway.
 int offset,
 int count,
 ref GssBuffer outBuffer);
Expand All@@ -231,19 +231,16 @@ internal static unsafe Status WrapBuffer(
 }
 }

 internal static Status UnwrapBuffer(
 internal static unsafe Status UnwrapBuffer(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 int offset,
 int count,
 ReadOnlySpan<byte> inputBytes,
 ref GssBuffer outBuffer)
 {
 Debug.Assert(inputBytes != null, "inputBytes must be valid value");
 Debug.Assert(offset >= 0 && offset <= inputBytes.Length, "offset must be valid");
 Debug.Assert(count >= 0 && count <= inputBytes.Length, "count must be valid");

 return Unwrap(out minorStatus, contextHandle, inputBytes, offset, count, ref outBuffer);
 fixed (byte* inputBytesPtr = inputBytes)
 {
 return Unwrap(out minorStatus, contextHandle, inputBytesPtr, 0, inputBytes.Length, ref outBuffer);
 }
 }
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/ISSPIInterface.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -25,7 +25,7 @@ internal interface ISSPIInterface
 int QueryContextChannelBinding(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeContextBufferChannelBinding refHandle);
 int QueryContextAttributes(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, Span<byte> buffer, Type? handleType, out SafeHandle? refHandle);
 int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityContextTokenHandle phToken);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer);
 int ApplyControlToken(ref SafeDeleteContext? refContext, in SecurityBuffer inputBuffer);
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIAuthType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -168,7 +168,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 return GetSecurityContextToken(phContext, out phToken);
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 return SafeDeleteContext.CompleteAuthToken(ref refContext, in inputBuffer);
 }
Expand Down

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPISecureChannelType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 throw new NotSupportedException();
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 throw new NotSupportedException();
 }
Expand Down

143 changes: 1 addition & 142 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -163,7 +163,7 @@ internal static int AcceptSecurityContext(ISSPIInterface secModule, SafeFreeCred
 return errorCode;
 }

 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in SecurityBuffer inputBuffer)
 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in InputSecurityBuffer inputBuffer)
 {
 int errorCode = secModule.CompleteAuthToken(ref context, in inputBuffer);

Expand All@@ -186,147 +186,6 @@ public static int QuerySecurityContextToken(ISSPIInterface secModule, SafeDelete
 return secModule.QuerySecurityContextToken(context, out token);
 }

 public static int EncryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Encrypt, secModule, context, input, sequenceNumber);
 }

 public static int DecryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Decrypt, secModule, context, input, sequenceNumber);
 }

 internal static int MakeSignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.MakeSignature, secModule, context, input, sequenceNumber);
 }

 public static int VerifySignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.VerifySignature, secModule, context, input, sequenceNumber);
 }

 private enum OP
 {
 Encrypt = 1,
 Decrypt,
 MakeSignature,
 VerifySignature
 }

 [StructLayout(LayoutKind.Sequential)]
 private ref struct ThreeByteArrays
 {
 public const int NumItems = 3;
 internal byte[] _item0;
 private byte[] _item1;
 private byte[] _item2;
 }

 private static unsafe int EncryptDecryptHelper(OP op, ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 Debug.Assert(Enum.IsDefined<OP>(op), $"Unknown op: {op}");
 Debug.Assert(input.Length <= 3, "The below logic only works for 3 or fewer buffers.");

 Interop.SspiCli.SecBufferDesc sdcInOut = new Interop.SspiCli.SecBufferDesc(input.Length);
 Span<Interop.SspiCli.SecBuffer> unmanagedBuffer = stackalloc Interop.SspiCli.SecBuffer[input.Length];
 unmanagedBuffer.Clear();

 fixed (Interop.SspiCli.SecBuffer* unmanagedBufferPtr = unmanagedBuffer)
 fixed (byte* pinnedBuffer0 = input.Length > 0 ? input[0].token : null)
 fixed (byte* pinnedBuffer1 = input.Length > 1 ? input[1].token : null)
 fixed (byte* pinnedBuffer2 = input.Length > 2 ? input[2].token : null)
 {
 sdcInOut.pBuffers = unmanagedBufferPtr;

 ThreeByteArrays byteArrayStruct = default;
 Span<byte[]> buffers = MemoryMarshal.CreateSpan(ref byteArrayStruct._item0!, ThreeByteArrays.NumItems).Slice(0, input.Length);

 for (int i = 0; i < input.Length; i++)
 {
 ref readonly SecurityBuffer iBuffer = ref input[i];
 unmanagedBuffer[i].cbBuffer = iBuffer.size;
 unmanagedBuffer[i].BufferType = iBuffer.type;
 if (iBuffer.token == null || iBuffer.token.Length == 0)
 {
 unmanagedBuffer[i].pvBuffer = IntPtr.Zero;
 }
 else
 {
 unmanagedBuffer[i].pvBuffer = Marshal.UnsafeAddrOfPinnedArrayElement(iBuffer.token, iBuffer.offset);
 buffers[i] = iBuffer.token;
 }
 }

 // The result is written in the input Buffer passed as type=BufferType.Data.
 int errorCode = op switch
 {
 OP.Encrypt => secModule.EncryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.Decrypt => secModule.DecryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.MakeSignature => secModule.MakeSignature(context, ref sdcInOut, sequenceNumber),
 _ /* OP.VerifySignature */ => secModule.VerifySignature(context, ref sdcInOut, sequenceNumber),
 };

 // Marshalling back returned sizes / data.
 for (int i = 0; i < input.Length; i++)
 {
 ref SecurityBuffer iBuffer = ref input[i];
 iBuffer.size = unmanagedBuffer[i].cbBuffer;
 iBuffer.type = unmanagedBuffer[i].BufferType;

 if (iBuffer.size == 0)
 {
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 else
 {

 // Find the buffer this is inside of. Usually they all point inside buffer 0.
 int j;
 for (j = 0; j < input.Length; j++)
 {
 if (buffers[j] != null)
 {
 checked
 {
 byte* bufferAddress = (byte*)Marshal.UnsafeAddrOfPinnedArrayElement(buffers[j], 0);
 if ((byte*)unmanagedBuffer[i].pvBuffer >= bufferAddress &&
 (byte*)unmanagedBuffer[i].pvBuffer + iBuffer.size <= bufferAddress + buffers[j].Length)
 {
 iBuffer.offset = (int)((byte*)unmanagedBuffer[i].pvBuffer - bufferAddress);
 iBuffer.token = buffers[j];
 break;
 }
 }
 }
 }

 if (j >= input.Length)
 {
 Debug.Fail("Output buffer out of range.");
 iBuffer.size = 0;
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 }

 // Backup validate the new sizes.
 Debug.Assert(iBuffer.offset >= 0 && iBuffer.offset <= (iBuffer.token == null ? 0 : iBuffer.token.Length), $"'offset' out of range. [{iBuffer.offset}]");
 Debug.Assert(iBuffer.size >= 0 && iBuffer.size <= (iBuffer.token == null ? 0 : iBuffer.token.Length - iBuffer.offset), $"'size' out of range. [{iBuffer.size}]");
 }

 if (NetEventSource.Log.IsEnabled() && errorCode != 0)
 {
 NetEventSource.Error(null, errorCode == Interop.SspiCli.SEC_I_RENEGOTIATE ?
 SR.Format(SR.event_OperationReturnedSomething, op, "SEC_I_RENEGOTIATE") :
 SR.Format(SR.net_log_operation_failed_with_error, op, $"0x{0:X}"));
 }

 return errorCode;
 }
 }

 public static SafeFreeContextBufferChannelBinding? QueryContextChannelBinding(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute contextAttribute)
 {
 SafeFreeContextBufferChannelBinding result;
Expand Down

27 changes: 14 additions & 13 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -472,9 +472,13 @@ internal static unsafe int InitializeSecurityContext(
 // Get unmanaged buffer with index 0 as the only one passed into PInvoke.
 outSecBuffer.size = outUnmanagedBuffer.cbBuffer;
 outSecBuffer.type = outUnmanagedBuffer.BufferType;
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;

 if (isSspiAllocated)
 {
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;
 }

 if (inSecBuffers.Count > 1 && inUnmanagedBuffer[1].BufferType == SecurityBufferType.SECBUFFER_EXTRA && inSecBuffers._item1.Type == SecurityBufferType.SECBUFFER_EMPTY)
 {
Expand DownExpand Up@@ -952,25 +956,22 @@ private static unsafe int MustRunAcceptSecurityContext_SECURITY(

 internal static unsafe int CompleteAuthToken(
 ref SafeDeleteSslContext? refContext,
 in SecurityBuffer inSecBuffer)
 in InputSecurityBuffer inSecBuffer)
 {
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}, inSecBuffer = {inSecBuffer}");
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}");

 var inSecurityBufferDescriptor = new Interop.SspiCli.SecBufferDesc(1);
 int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;

 Interop.SspiCli.SecBuffer inUnmanagedBuffer = default;
 inSecurityBufferDescriptor.pBuffers = &inUnmanagedBuffer;
 fixed (byte* pinnedToken = inSecBuffer.token)
 fixed (byte* pinnedToken = inSecBuffer.Token)
 {
 inUnmanagedBuffer.cbBuffer = inSecBuffer.size;
 inUnmanagedBuffer.BufferType = inSecBuffer.type;

 // Use the unmanaged token if it's not null; otherwise use the managed buffer.
 Debug.Assert(inSecBuffer.UnmanagedToken != null);
 inUnmanagedBuffer.cbBuffer = inSecBuffer.Token.Length;
 inUnmanagedBuffer.BufferType = inSecBuffer.Type;
 inUnmanagedBuffer.pvBuffer =
 inSecBuffer.unmanagedToken != null ? inSecBuffer.unmanagedToken.DangerousGetHandle() :
 inSecBuffer.token == null || inSecBuffer.token.Length == 0 ? IntPtr.Zero :
 (IntPtr)(pinnedToken + inSecBuffer.offset);
 inSecBuffer.Token.IsEmpty ? IntPtr.Zero : (IntPtr)pinnedToken;

 Interop.SspiCli.CredHandle contextHandle = refContext != null ? refContext._handle : default;
 if (refContext == null || refContext.IsInvalid)
Expand Down

33 changes: 21 additions & 12 deletions
src/libraries/Common/src/System/Net/NTAuthentication.Common.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,6 +20,7 @@ internal sealed partial class NTAuthentication
 private string? _spn;

 private int _tokenSize;
 private byte[]? _tokenBuffer;
 private ContextFlagsPal _requestedContextFlags;
 private ContextFlagsPal _contextFlags;

Expand DownExpand Up@@ -158,14 +159,14 @@ internal void CloseContext()
 _isCompleted = false;
 }

 internal int VerifySignature(byte[] buffer, int offset, int count)
 internal int VerifySignature(ReadOnlySpan<byte> buffer)
 {
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer, offset, count);
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer);
 }

 internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref byte[] output)
 internal int MakeSignature(ReadOnlySpan<byte> buffer, [AllowNull] ref byte[] output)
 {
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, offset, count, ref output);
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, ref output);
 }

 internal string? GetOutgoingBlob(string? incomingBlob)
Expand DownExpand Up@@ -221,9 +222,10 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref

 internal byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, bool throwOnError, out SecurityStatusPal statusCode)
 {
byte[]? result = new byte[_tokenSize];
_tokenBuffer ??= _tokenSize == 0 ? Array.Empty<byte>() : new byte[_tokenSize];
Comment thread
stephentoub marked this conversation as resolved.


 bool firstTime = _securityContext == null;
 int resultBlobLength;
 try
 {
 if (!_isServer)
Expand All@@ -236,18 +238,19 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.InitializeSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded)
 {
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, result);
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, _tokenBuffer.AsSpan(0, resultBlobLength));

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.CompleteAuthToken() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

result = null;
resultBlobLength = 0;
 }
 }
 else
Expand All@@ -259,7 +262,8 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.AcceptSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");
Expand All@@ -284,6 +288,7 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 {
 CloseContext();
 _isCompleted = true;
 _tokenBuffer = null;
 if (throwOnError)
 {
 throw NegotiateStreamPal.CreateExceptionFromError(statusCode);
Expand All@@ -297,12 +302,18 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 SSPIHandleCache.CacheCredential(_credentialsHandle);
 }

 byte[]? result =
 resultBlobLength == 0 || _tokenBuffer == null ? null :
 _tokenBuffer.Length == resultBlobLength ? _tokenBuffer :
 _tokenBuffer[0..resultBlobLength];

 // The return value will tell us correctly if the handshake is over or not
 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK
 || (_isServer && statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded))
 {
 // Success.
 _isCompleted = true;
 _tokenBuffer = null;
 }
 else
 {
Expand DownExpand Up@@ -335,13 +346,11 @@ internal int Encrypt(ReadOnlySpan<byte> buffer, [NotNull] ref byte[]? output, ui
 sequenceNumber);
 }

 internal int Decrypt(byte[] payload, int offset, int count, out int newOffset, uint expectedSeqNumber)
 internal int Decrypt(Span<byte> payload, out int newOffset, uint expectedSeqNumber)
 {
 return NegotiateStreamPal.Decrypt(
 _securityContext!,
 payload,
 offset,
 count,
 (_contextFlags & ContextFlagsPal.Confidentiality) != 0,
 IsNTLM,
 out newOffset,
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Improve allocations in NegotiateStreamPal#71280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

wfurt
merged 5 commits into

from

Jun 29, 2022
 Merged


Improve allocations in NegotiateStreamPal
#71280
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
1dd747d

Reduce buffer allocations during NTLM/Negotiate authentication


filipnavara Jun 25, 2022
49c1ed0

Update ReadWriteAdapter.WriteAsync prototype to use Memory<byte> inst…


filipnavara Jun 25, 2022
2fe4491

Spanify NTAuthentication.Decrypt and avoid couple of offset/count checks


filipnavara Jun 25, 2022
3b4aff6

Spanify NegotiateStreamPal.VerifySignature/MakeSignature.


filipnavara Jun 25, 2022
46e05a4

Update src/libraries/Common/src/System/Net/NTAuthentication.Common.cs


filipnavara Jun 28, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 8 additions & 11 deletions
...libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -210,10 +210,10 @@ private static unsafe partial Status Wrap(
 ref GssBuffer outBuffer);

 [LibraryImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
 private static partial Status Unwrap(
 private static unsafe partial Status Unwrap(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 byte* inputBytes,
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offset any more? It feels like if we pass pointer we can just do count.
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't. Unfortunately, dotnet/sqlclient uses the native APIs, so I didn't feel confident in changing it. I am quite sure they don't use this particular API though.
@MichalPetrykaMichalPetrykaJun 27, 2022

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't the pointer change by itself be breaking for them?
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't change the native code side, the prototype remains unchanged there. They basically copied the managed side of the interop. (We cannot change the signature, add parameters, remove parameters, or change their types. We can change how they are marshalled on the C# side though.)
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @JRahnama just in case.
@filipnavarafilipnavaraJun 29, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cross-checked with the SqlClient source and this particular native method is not referenced so we can remove the offset parameter. I will do that in a follow-up PR (#71373) since I need to update the native interop there anyway.
 int offset,
 int count,
 ref GssBuffer outBuffer);
Expand All@@ -231,19 +231,16 @@ internal static unsafe Status WrapBuffer(
 }
 }

 internal static Status UnwrapBuffer(
 internal static unsafe Status UnwrapBuffer(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 int offset,
 int count,
 ReadOnlySpan<byte> inputBytes,
 ref GssBuffer outBuffer)
 {
 Debug.Assert(inputBytes != null, "inputBytes must be valid value");
 Debug.Assert(offset >= 0 && offset <= inputBytes.Length, "offset must be valid");
 Debug.Assert(count >= 0 && count <= inputBytes.Length, "count must be valid");

 return Unwrap(out minorStatus, contextHandle, inputBytes, offset, count, ref outBuffer);
 fixed (byte* inputBytesPtr = inputBytes)
 {
 return Unwrap(out minorStatus, contextHandle, inputBytesPtr, 0, inputBytes.Length, ref outBuffer);
 }
 }
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/ISSPIInterface.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -25,7 +25,7 @@ internal interface ISSPIInterface
 int QueryContextChannelBinding(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeContextBufferChannelBinding refHandle);
 int QueryContextAttributes(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, Span<byte> buffer, Type? handleType, out SafeHandle? refHandle);
 int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityContextTokenHandle phToken);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer);
 int ApplyControlToken(ref SafeDeleteContext? refContext, in SecurityBuffer inputBuffer);
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIAuthType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -168,7 +168,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 return GetSecurityContextToken(phContext, out phToken);
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 return SafeDeleteContext.CompleteAuthToken(ref refContext, in inputBuffer);
 }
Expand Down

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPISecureChannelType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 throw new NotSupportedException();
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 throw new NotSupportedException();
 }
Expand Down

143 changes: 1 addition & 142 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -163,7 +163,7 @@ internal static int AcceptSecurityContext(ISSPIInterface secModule, SafeFreeCred
 return errorCode;
 }

 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in SecurityBuffer inputBuffer)
 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in InputSecurityBuffer inputBuffer)
 {
 int errorCode = secModule.CompleteAuthToken(ref context, in inputBuffer);

Expand All@@ -186,147 +186,6 @@ public static int QuerySecurityContextToken(ISSPIInterface secModule, SafeDelete
 return secModule.QuerySecurityContextToken(context, out token);
 }

 public static int EncryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Encrypt, secModule, context, input, sequenceNumber);
 }

 public static int DecryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Decrypt, secModule, context, input, sequenceNumber);
 }

 internal static int MakeSignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.MakeSignature, secModule, context, input, sequenceNumber);
 }

 public static int VerifySignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.VerifySignature, secModule, context, input, sequenceNumber);
 }

 private enum OP
 {
 Encrypt = 1,
 Decrypt,
 MakeSignature,
 VerifySignature
 }

 [StructLayout(LayoutKind.Sequential)]
 private ref struct ThreeByteArrays
 {
 public const int NumItems = 3;
 internal byte[] _item0;
 private byte[] _item1;
 private byte[] _item2;
 }

 private static unsafe int EncryptDecryptHelper(OP op, ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 Debug.Assert(Enum.IsDefined<OP>(op), $"Unknown op: {op}");
 Debug.Assert(input.Length <= 3, "The below logic only works for 3 or fewer buffers.");

 Interop.SspiCli.SecBufferDesc sdcInOut = new Interop.SspiCli.SecBufferDesc(input.Length);
 Span<Interop.SspiCli.SecBuffer> unmanagedBuffer = stackalloc Interop.SspiCli.SecBuffer[input.Length];
 unmanagedBuffer.Clear();

 fixed (Interop.SspiCli.SecBuffer* unmanagedBufferPtr = unmanagedBuffer)
 fixed (byte* pinnedBuffer0 = input.Length > 0 ? input[0].token : null)
 fixed (byte* pinnedBuffer1 = input.Length > 1 ? input[1].token : null)
 fixed (byte* pinnedBuffer2 = input.Length > 2 ? input[2].token : null)
 {
 sdcInOut.pBuffers = unmanagedBufferPtr;

 ThreeByteArrays byteArrayStruct = default;
 Span<byte[]> buffers = MemoryMarshal.CreateSpan(ref byteArrayStruct._item0!, ThreeByteArrays.NumItems).Slice(0, input.Length);

 for (int i = 0; i < input.Length; i++)
 {
 ref readonly SecurityBuffer iBuffer = ref input[i];
 unmanagedBuffer[i].cbBuffer = iBuffer.size;
 unmanagedBuffer[i].BufferType = iBuffer.type;
 if (iBuffer.token == null || iBuffer.token.Length == 0)
 {
 unmanagedBuffer[i].pvBuffer = IntPtr.Zero;
 }
 else
 {
 unmanagedBuffer[i].pvBuffer = Marshal.UnsafeAddrOfPinnedArrayElement(iBuffer.token, iBuffer.offset);
 buffers[i] = iBuffer.token;
 }
 }

 // The result is written in the input Buffer passed as type=BufferType.Data.
 int errorCode = op switch
 {
 OP.Encrypt => secModule.EncryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.Decrypt => secModule.DecryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.MakeSignature => secModule.MakeSignature(context, ref sdcInOut, sequenceNumber),
 _ /* OP.VerifySignature */ => secModule.VerifySignature(context, ref sdcInOut, sequenceNumber),
 };

 // Marshalling back returned sizes / data.
 for (int i = 0; i < input.Length; i++)
 {
 ref SecurityBuffer iBuffer = ref input[i];
 iBuffer.size = unmanagedBuffer[i].cbBuffer;
 iBuffer.type = unmanagedBuffer[i].BufferType;

 if (iBuffer.size == 0)
 {
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 else
 {

 // Find the buffer this is inside of. Usually they all point inside buffer 0.
 int j;
 for (j = 0; j < input.Length; j++)
 {
 if (buffers[j] != null)
 {
 checked
 {
 byte* bufferAddress = (byte*)Marshal.UnsafeAddrOfPinnedArrayElement(buffers[j], 0);
 if ((byte*)unmanagedBuffer[i].pvBuffer >= bufferAddress &&
 (byte*)unmanagedBuffer[i].pvBuffer + iBuffer.size <= bufferAddress + buffers[j].Length)
 {
 iBuffer.offset = (int)((byte*)unmanagedBuffer[i].pvBuffer - bufferAddress);
 iBuffer.token = buffers[j];
 break;
 }
 }
 }
 }

 if (j >= input.Length)
 {
 Debug.Fail("Output buffer out of range.");
 iBuffer.size = 0;
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 }

 // Backup validate the new sizes.
 Debug.Assert(iBuffer.offset >= 0 && iBuffer.offset <= (iBuffer.token == null ? 0 : iBuffer.token.Length), $"'offset' out of range. [{iBuffer.offset}]");
 Debug.Assert(iBuffer.size >= 0 && iBuffer.size <= (iBuffer.token == null ? 0 : iBuffer.token.Length - iBuffer.offset), $"'size' out of range. [{iBuffer.size}]");
 }

 if (NetEventSource.Log.IsEnabled() && errorCode != 0)
 {
 NetEventSource.Error(null, errorCode == Interop.SspiCli.SEC_I_RENEGOTIATE ?
 SR.Format(SR.event_OperationReturnedSomething, op, "SEC_I_RENEGOTIATE") :
 SR.Format(SR.net_log_operation_failed_with_error, op, $"0x{0:X}"));
 }

 return errorCode;
 }
 }

 public static SafeFreeContextBufferChannelBinding? QueryContextChannelBinding(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute contextAttribute)
 {
 SafeFreeContextBufferChannelBinding result;
Expand Down

27 changes: 14 additions & 13 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -472,9 +472,13 @@ internal static unsafe int InitializeSecurityContext(
 // Get unmanaged buffer with index 0 as the only one passed into PInvoke.
 outSecBuffer.size = outUnmanagedBuffer.cbBuffer;
 outSecBuffer.type = outUnmanagedBuffer.BufferType;
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;

 if (isSspiAllocated)
 {
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;
 }

 if (inSecBuffers.Count > 1 && inUnmanagedBuffer[1].BufferType == SecurityBufferType.SECBUFFER_EXTRA && inSecBuffers._item1.Type == SecurityBufferType.SECBUFFER_EMPTY)
 {
Expand DownExpand Up@@ -952,25 +956,22 @@ private static unsafe int MustRunAcceptSecurityContext_SECURITY(

 internal static unsafe int CompleteAuthToken(
 ref SafeDeleteSslContext? refContext,
 in SecurityBuffer inSecBuffer)
 in InputSecurityBuffer inSecBuffer)
 {
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}, inSecBuffer = {inSecBuffer}");
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}");

 var inSecurityBufferDescriptor = new Interop.SspiCli.SecBufferDesc(1);
 int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;

 Interop.SspiCli.SecBuffer inUnmanagedBuffer = default;
 inSecurityBufferDescriptor.pBuffers = &inUnmanagedBuffer;
 fixed (byte* pinnedToken = inSecBuffer.token)
 fixed (byte* pinnedToken = inSecBuffer.Token)
 {
 inUnmanagedBuffer.cbBuffer = inSecBuffer.size;
 inUnmanagedBuffer.BufferType = inSecBuffer.type;

 // Use the unmanaged token if it's not null; otherwise use the managed buffer.
 Debug.Assert(inSecBuffer.UnmanagedToken != null);
 inUnmanagedBuffer.cbBuffer = inSecBuffer.Token.Length;
 inUnmanagedBuffer.BufferType = inSecBuffer.Type;
 inUnmanagedBuffer.pvBuffer =
 inSecBuffer.unmanagedToken != null ? inSecBuffer.unmanagedToken.DangerousGetHandle() :
 inSecBuffer.token == null || inSecBuffer.token.Length == 0 ? IntPtr.Zero :
 (IntPtr)(pinnedToken + inSecBuffer.offset);
 inSecBuffer.Token.IsEmpty ? IntPtr.Zero : (IntPtr)pinnedToken;

 Interop.SspiCli.CredHandle contextHandle = refContext != null ? refContext._handle : default;
 if (refContext == null || refContext.IsInvalid)
Expand Down

33 changes: 21 additions & 12 deletions
src/libraries/Common/src/System/Net/NTAuthentication.Common.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,6 +20,7 @@ internal sealed partial class NTAuthentication
 private string? _spn;

 private int _tokenSize;
 private byte[]? _tokenBuffer;
 private ContextFlagsPal _requestedContextFlags;
 private ContextFlagsPal _contextFlags;

Expand DownExpand Up@@ -158,14 +159,14 @@ internal void CloseContext()
 _isCompleted = false;
 }

 internal int VerifySignature(byte[] buffer, int offset, int count)
 internal int VerifySignature(ReadOnlySpan<byte> buffer)
 {
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer, offset, count);
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer);
 }

 internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref byte[] output)
 internal int MakeSignature(ReadOnlySpan<byte> buffer, [AllowNull] ref byte[] output)
 {
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, offset, count, ref output);
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, ref output);
 }

 internal string? GetOutgoingBlob(string? incomingBlob)
Expand DownExpand Up@@ -221,9 +222,10 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref

 internal byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, bool throwOnError, out SecurityStatusPal statusCode)
 {
byte[]? result = new byte[_tokenSize];
_tokenBuffer ??= _tokenSize == 0 ? Array.Empty<byte>() : new byte[_tokenSize];
Comment thread
stephentoub marked this conversation as resolved.


 bool firstTime = _securityContext == null;
 int resultBlobLength;
 try
 {
 if (!_isServer)
Expand All@@ -236,18 +238,19 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.InitializeSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded)
 {
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, result);
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, _tokenBuffer.AsSpan(0, resultBlobLength));

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.CompleteAuthToken() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

result = null;
resultBlobLength = 0;
 }
 }
 else
Expand All@@ -259,7 +262,8 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.AcceptSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");
Expand All@@ -284,6 +288,7 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 {
 CloseContext();
 _isCompleted = true;
 _tokenBuffer = null;
 if (throwOnError)
 {
 throw NegotiateStreamPal.CreateExceptionFromError(statusCode);
Expand All@@ -297,12 +302,18 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 SSPIHandleCache.CacheCredential(_credentialsHandle);
 }

 byte[]? result =
 resultBlobLength == 0 || _tokenBuffer == null ? null :
 _tokenBuffer.Length == resultBlobLength ? _tokenBuffer :
 _tokenBuffer[0..resultBlobLength];

 // The return value will tell us correctly if the handshake is over or not
 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK
 || (_isServer && statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded))
 {
 // Success.
 _isCompleted = true;
 _tokenBuffer = null;
 }
 else
 {
Expand DownExpand Up@@ -335,13 +346,11 @@ internal int Encrypt(ReadOnlySpan<byte> buffer, [NotNull] ref byte[]? output, ui
 sequenceNumber);
 }

 internal int Decrypt(byte[] payload, int offset, int count, out int newOffset, uint expectedSeqNumber)
 internal int Decrypt(Span<byte> payload, out int newOffset, uint expectedSeqNumber)
 {
 return NegotiateStreamPal.Decrypt(
 _securityContext!,
 payload,
 offset,
 count,
 (_contextFlags & ContextFlagsPal.Confidentiality) != 0,
 IsNTLM,
 out newOffset,
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Improve allocations in NegotiateStreamPal#71280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

wfurt
merged 5 commits into

from

Jun 29, 2022
 Merged


Improve allocations in NegotiateStreamPal
#71280
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
1dd747d

Reduce buffer allocations during NTLM/Negotiate authentication


filipnavara Jun 25, 2022
49c1ed0

Update ReadWriteAdapter.WriteAsync prototype to use Memory<byte> inst…


filipnavara Jun 25, 2022
2fe4491

Spanify NTAuthentication.Decrypt and avoid couple of offset/count checks


filipnavara Jun 25, 2022
3b4aff6

Spanify NegotiateStreamPal.VerifySignature/MakeSignature.


filipnavara Jun 25, 2022
46e05a4

Update src/libraries/Common/src/System/Net/NTAuthentication.Common.cs


filipnavara Jun 28, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 8 additions & 11 deletions
...libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -210,10 +210,10 @@ private static unsafe partial Status Wrap(
 ref GssBuffer outBuffer);

 [LibraryImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
 private static partial Status Unwrap(
 private static unsafe partial Status Unwrap(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 byte* inputBytes,
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offset any more? It feels like if we pass pointer we can just do count.
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't. Unfortunately, dotnet/sqlclient uses the native APIs, so I didn't feel confident in changing it. I am quite sure they don't use this particular API though.
@MichalPetrykaMichalPetrykaJun 27, 2022

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't the pointer change by itself be breaking for them?
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't change the native code side, the prototype remains unchanged there. They basically copied the managed side of the interop. (We cannot change the signature, add parameters, remove parameters, or change their types. We can change how they are marshalled on the C# side though.)
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @JRahnama just in case.
@filipnavarafilipnavaraJun 29, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cross-checked with the SqlClient source and this particular native method is not referenced so we can remove the offset parameter. I will do that in a follow-up PR (#71373) since I need to update the native interop there anyway.
 int offset,
 int count,
 ref GssBuffer outBuffer);
Expand All@@ -231,19 +231,16 @@ internal static unsafe Status WrapBuffer(
 }
 }

 internal static Status UnwrapBuffer(
 internal static unsafe Status UnwrapBuffer(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 int offset,
 int count,
 ReadOnlySpan<byte> inputBytes,
 ref GssBuffer outBuffer)
 {
 Debug.Assert(inputBytes != null, "inputBytes must be valid value");
 Debug.Assert(offset >= 0 && offset <= inputBytes.Length, "offset must be valid");
 Debug.Assert(count >= 0 && count <= inputBytes.Length, "count must be valid");

 return Unwrap(out minorStatus, contextHandle, inputBytes, offset, count, ref outBuffer);
 fixed (byte* inputBytesPtr = inputBytes)
 {
 return Unwrap(out minorStatus, contextHandle, inputBytesPtr, 0, inputBytes.Length, ref outBuffer);
 }
 }
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/ISSPIInterface.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -25,7 +25,7 @@ internal interface ISSPIInterface
 int QueryContextChannelBinding(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeContextBufferChannelBinding refHandle);
 int QueryContextAttributes(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, Span<byte> buffer, Type? handleType, out SafeHandle? refHandle);
 int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityContextTokenHandle phToken);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer);
 int ApplyControlToken(ref SafeDeleteContext? refContext, in SecurityBuffer inputBuffer);
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIAuthType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -168,7 +168,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 return GetSecurityContextToken(phContext, out phToken);
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 return SafeDeleteContext.CompleteAuthToken(ref refContext, in inputBuffer);
 }
Expand Down

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPISecureChannelType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 throw new NotSupportedException();
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 throw new NotSupportedException();
 }
Expand Down

143 changes: 1 addition & 142 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -163,7 +163,7 @@ internal static int AcceptSecurityContext(ISSPIInterface secModule, SafeFreeCred
 return errorCode;
 }

 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in SecurityBuffer inputBuffer)
 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in InputSecurityBuffer inputBuffer)
 {
 int errorCode = secModule.CompleteAuthToken(ref context, in inputBuffer);

Expand All@@ -186,147 +186,6 @@ public static int QuerySecurityContextToken(ISSPIInterface secModule, SafeDelete
 return secModule.QuerySecurityContextToken(context, out token);
 }

 public static int EncryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Encrypt, secModule, context, input, sequenceNumber);
 }

 public static int DecryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Decrypt, secModule, context, input, sequenceNumber);
 }

 internal static int MakeSignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.MakeSignature, secModule, context, input, sequenceNumber);
 }

 public static int VerifySignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.VerifySignature, secModule, context, input, sequenceNumber);
 }

 private enum OP
 {
 Encrypt = 1,
 Decrypt,
 MakeSignature,
 VerifySignature
 }

 [StructLayout(LayoutKind.Sequential)]
 private ref struct ThreeByteArrays
 {
 public const int NumItems = 3;
 internal byte[] _item0;
 private byte[] _item1;
 private byte[] _item2;
 }

 private static unsafe int EncryptDecryptHelper(OP op, ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 Debug.Assert(Enum.IsDefined<OP>(op), $"Unknown op: {op}");
 Debug.Assert(input.Length <= 3, "The below logic only works for 3 or fewer buffers.");

 Interop.SspiCli.SecBufferDesc sdcInOut = new Interop.SspiCli.SecBufferDesc(input.Length);
 Span<Interop.SspiCli.SecBuffer> unmanagedBuffer = stackalloc Interop.SspiCli.SecBuffer[input.Length];
 unmanagedBuffer.Clear();

 fixed (Interop.SspiCli.SecBuffer* unmanagedBufferPtr = unmanagedBuffer)
 fixed (byte* pinnedBuffer0 = input.Length > 0 ? input[0].token : null)
 fixed (byte* pinnedBuffer1 = input.Length > 1 ? input[1].token : null)
 fixed (byte* pinnedBuffer2 = input.Length > 2 ? input[2].token : null)
 {
 sdcInOut.pBuffers = unmanagedBufferPtr;

 ThreeByteArrays byteArrayStruct = default;
 Span<byte[]> buffers = MemoryMarshal.CreateSpan(ref byteArrayStruct._item0!, ThreeByteArrays.NumItems).Slice(0, input.Length);

 for (int i = 0; i < input.Length; i++)
 {
 ref readonly SecurityBuffer iBuffer = ref input[i];
 unmanagedBuffer[i].cbBuffer = iBuffer.size;
 unmanagedBuffer[i].BufferType = iBuffer.type;
 if (iBuffer.token == null || iBuffer.token.Length == 0)
 {
 unmanagedBuffer[i].pvBuffer = IntPtr.Zero;
 }
 else
 {
 unmanagedBuffer[i].pvBuffer = Marshal.UnsafeAddrOfPinnedArrayElement(iBuffer.token, iBuffer.offset);
 buffers[i] = iBuffer.token;
 }
 }

 // The result is written in the input Buffer passed as type=BufferType.Data.
 int errorCode = op switch
 {
 OP.Encrypt => secModule.EncryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.Decrypt => secModule.DecryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.MakeSignature => secModule.MakeSignature(context, ref sdcInOut, sequenceNumber),
 _ /* OP.VerifySignature */ => secModule.VerifySignature(context, ref sdcInOut, sequenceNumber),
 };

 // Marshalling back returned sizes / data.
 for (int i = 0; i < input.Length; i++)
 {
 ref SecurityBuffer iBuffer = ref input[i];
 iBuffer.size = unmanagedBuffer[i].cbBuffer;
 iBuffer.type = unmanagedBuffer[i].BufferType;

 if (iBuffer.size == 0)
 {
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 else
 {

 // Find the buffer this is inside of. Usually they all point inside buffer 0.
 int j;
 for (j = 0; j < input.Length; j++)
 {
 if (buffers[j] != null)
 {
 checked
 {
 byte* bufferAddress = (byte*)Marshal.UnsafeAddrOfPinnedArrayElement(buffers[j], 0);
 if ((byte*)unmanagedBuffer[i].pvBuffer >= bufferAddress &&
 (byte*)unmanagedBuffer[i].pvBuffer + iBuffer.size <= bufferAddress + buffers[j].Length)
 {
 iBuffer.offset = (int)((byte*)unmanagedBuffer[i].pvBuffer - bufferAddress);
 iBuffer.token = buffers[j];
 break;
 }
 }
 }
 }

 if (j >= input.Length)
 {
 Debug.Fail("Output buffer out of range.");
 iBuffer.size = 0;
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 }

 // Backup validate the new sizes.
 Debug.Assert(iBuffer.offset >= 0 && iBuffer.offset <= (iBuffer.token == null ? 0 : iBuffer.token.Length), $"'offset' out of range. [{iBuffer.offset}]");
 Debug.Assert(iBuffer.size >= 0 && iBuffer.size <= (iBuffer.token == null ? 0 : iBuffer.token.Length - iBuffer.offset), $"'size' out of range. [{iBuffer.size}]");
 }

 if (NetEventSource.Log.IsEnabled() && errorCode != 0)
 {
 NetEventSource.Error(null, errorCode == Interop.SspiCli.SEC_I_RENEGOTIATE ?
 SR.Format(SR.event_OperationReturnedSomething, op, "SEC_I_RENEGOTIATE") :
 SR.Format(SR.net_log_operation_failed_with_error, op, $"0x{0:X}"));
 }

 return errorCode;
 }
 }

 public static SafeFreeContextBufferChannelBinding? QueryContextChannelBinding(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute contextAttribute)
 {
 SafeFreeContextBufferChannelBinding result;
Expand Down

27 changes: 14 additions & 13 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -472,9 +472,13 @@ internal static unsafe int InitializeSecurityContext(
 // Get unmanaged buffer with index 0 as the only one passed into PInvoke.
 outSecBuffer.size = outUnmanagedBuffer.cbBuffer;
 outSecBuffer.type = outUnmanagedBuffer.BufferType;
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;

 if (isSspiAllocated)
 {
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;
 }

 if (inSecBuffers.Count > 1 && inUnmanagedBuffer[1].BufferType == SecurityBufferType.SECBUFFER_EXTRA && inSecBuffers._item1.Type == SecurityBufferType.SECBUFFER_EMPTY)
 {
Expand DownExpand Up@@ -952,25 +956,22 @@ private static unsafe int MustRunAcceptSecurityContext_SECURITY(

 internal static unsafe int CompleteAuthToken(
 ref SafeDeleteSslContext? refContext,
 in SecurityBuffer inSecBuffer)
 in InputSecurityBuffer inSecBuffer)
 {
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}, inSecBuffer = {inSecBuffer}");
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}");

 var inSecurityBufferDescriptor = new Interop.SspiCli.SecBufferDesc(1);
 int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;

 Interop.SspiCli.SecBuffer inUnmanagedBuffer = default;
 inSecurityBufferDescriptor.pBuffers = &inUnmanagedBuffer;
 fixed (byte* pinnedToken = inSecBuffer.token)
 fixed (byte* pinnedToken = inSecBuffer.Token)
 {
 inUnmanagedBuffer.cbBuffer = inSecBuffer.size;
 inUnmanagedBuffer.BufferType = inSecBuffer.type;

 // Use the unmanaged token if it's not null; otherwise use the managed buffer.
 Debug.Assert(inSecBuffer.UnmanagedToken != null);
 inUnmanagedBuffer.cbBuffer = inSecBuffer.Token.Length;
 inUnmanagedBuffer.BufferType = inSecBuffer.Type;
 inUnmanagedBuffer.pvBuffer =
 inSecBuffer.unmanagedToken != null ? inSecBuffer.unmanagedToken.DangerousGetHandle() :
 inSecBuffer.token == null || inSecBuffer.token.Length == 0 ? IntPtr.Zero :
 (IntPtr)(pinnedToken + inSecBuffer.offset);
 inSecBuffer.Token.IsEmpty ? IntPtr.Zero : (IntPtr)pinnedToken;

 Interop.SspiCli.CredHandle contextHandle = refContext != null ? refContext._handle : default;
 if (refContext == null || refContext.IsInvalid)
Expand Down

33 changes: 21 additions & 12 deletions
src/libraries/Common/src/System/Net/NTAuthentication.Common.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,6 +20,7 @@ internal sealed partial class NTAuthentication
 private string? _spn;

 private int _tokenSize;
 private byte[]? _tokenBuffer;
 private ContextFlagsPal _requestedContextFlags;
 private ContextFlagsPal _contextFlags;

Expand DownExpand Up@@ -158,14 +159,14 @@ internal void CloseContext()
 _isCompleted = false;
 }

 internal int VerifySignature(byte[] buffer, int offset, int count)
 internal int VerifySignature(ReadOnlySpan<byte> buffer)
 {
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer, offset, count);
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer);
 }

 internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref byte[] output)
 internal int MakeSignature(ReadOnlySpan<byte> buffer, [AllowNull] ref byte[] output)
 {
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, offset, count, ref output);
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, ref output);
 }

 internal string? GetOutgoingBlob(string? incomingBlob)
Expand DownExpand Up@@ -221,9 +222,10 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref

 internal byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, bool throwOnError, out SecurityStatusPal statusCode)
 {
byte[]? result = new byte[_tokenSize];
_tokenBuffer ??= _tokenSize == 0 ? Array.Empty<byte>() : new byte[_tokenSize];
Comment thread
stephentoub marked this conversation as resolved.


 bool firstTime = _securityContext == null;
 int resultBlobLength;
 try
 {
 if (!_isServer)
Expand All@@ -236,18 +238,19 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.InitializeSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded)
 {
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, result);
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, _tokenBuffer.AsSpan(0, resultBlobLength));

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.CompleteAuthToken() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

result = null;
resultBlobLength = 0;
 }
 }
 else
Expand All@@ -259,7 +262,8 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.AcceptSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");
Expand All@@ -284,6 +288,7 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 {
 CloseContext();
 _isCompleted = true;
 _tokenBuffer = null;
 if (throwOnError)
 {
 throw NegotiateStreamPal.CreateExceptionFromError(statusCode);
Expand All@@ -297,12 +302,18 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 SSPIHandleCache.CacheCredential(_credentialsHandle);
 }

 byte[]? result =
 resultBlobLength == 0 || _tokenBuffer == null ? null :
 _tokenBuffer.Length == resultBlobLength ? _tokenBuffer :
 _tokenBuffer[0..resultBlobLength];

 // The return value will tell us correctly if the handshake is over or not
 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK
 || (_isServer && statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded))
 {
 // Success.
 _isCompleted = true;
 _tokenBuffer = null;
 }
 else
 {
Expand DownExpand Up@@ -335,13 +346,11 @@ internal int Encrypt(ReadOnlySpan<byte> buffer, [NotNull] ref byte[]? output, ui
 sequenceNumber);
 }

 internal int Decrypt(byte[] payload, int offset, int count, out int newOffset, uint expectedSeqNumber)
 internal int Decrypt(Span<byte> payload, out int newOffset, uint expectedSeqNumber)
 {
 return NegotiateStreamPal.Decrypt(
 _securityContext!,
 payload,
 offset,
 count,
 (_contextFlags & ContextFlagsPal.Confidentiality) != 0,
 IsNTLM,
 out newOffset,
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Improve allocations in NegotiateStreamPal#71280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

wfurt
merged 5 commits into

from

Jun 29, 2022
 Merged


Improve allocations in NegotiateStreamPal
#71280
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
1dd747d

Reduce buffer allocations during NTLM/Negotiate authentication


filipnavara Jun 25, 2022
49c1ed0

Update ReadWriteAdapter.WriteAsync prototype to use Memory<byte> inst…


filipnavara Jun 25, 2022
2fe4491

Spanify NTAuthentication.Decrypt and avoid couple of offset/count checks


filipnavara Jun 25, 2022
3b4aff6

Spanify NegotiateStreamPal.VerifySignature/MakeSignature.


filipnavara Jun 25, 2022
46e05a4

Update src/libraries/Common/src/System/Net/NTAuthentication.Common.cs


filipnavara Jun 28, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 8 additions & 11 deletions
...libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -210,10 +210,10 @@ private static unsafe partial Status Wrap(
 ref GssBuffer outBuffer);

 [LibraryImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
 private static partial Status Unwrap(
 private static unsafe partial Status Unwrap(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 byte* inputBytes,
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offset any more? It feels like if we pass pointer we can just do count.
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't. Unfortunately, dotnet/sqlclient uses the native APIs, so I didn't feel confident in changing it. I am quite sure they don't use this particular API though.
@MichalPetrykaMichalPetrykaJun 27, 2022

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't the pointer change by itself be breaking for them?
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't change the native code side, the prototype remains unchanged there. They basically copied the managed side of the interop. (We cannot change the signature, add parameters, remove parameters, or change their types. We can change how they are marshalled on the C# side though.)
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @JRahnama just in case.
@filipnavarafilipnavaraJun 29, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cross-checked with the SqlClient source and this particular native method is not referenced so we can remove the offset parameter. I will do that in a follow-up PR (#71373) since I need to update the native interop there anyway.
 int offset,
 int count,
 ref GssBuffer outBuffer);
Expand All@@ -231,19 +231,16 @@ internal static unsafe Status WrapBuffer(
 }
 }

 internal static Status UnwrapBuffer(
 internal static unsafe Status UnwrapBuffer(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 int offset,
 int count,
 ReadOnlySpan<byte> inputBytes,
 ref GssBuffer outBuffer)
 {
 Debug.Assert(inputBytes != null, "inputBytes must be valid value");
 Debug.Assert(offset >= 0 && offset <= inputBytes.Length, "offset must be valid");
 Debug.Assert(count >= 0 && count <= inputBytes.Length, "count must be valid");

 return Unwrap(out minorStatus, contextHandle, inputBytes, offset, count, ref outBuffer);
 fixed (byte* inputBytesPtr = inputBytes)
 {
 return Unwrap(out minorStatus, contextHandle, inputBytesPtr, 0, inputBytes.Length, ref outBuffer);
 }
 }
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/ISSPIInterface.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -25,7 +25,7 @@ internal interface ISSPIInterface
 int QueryContextChannelBinding(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeContextBufferChannelBinding refHandle);
 int QueryContextAttributes(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, Span<byte> buffer, Type? handleType, out SafeHandle? refHandle);
 int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityContextTokenHandle phToken);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer);
 int ApplyControlToken(ref SafeDeleteContext? refContext, in SecurityBuffer inputBuffer);
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIAuthType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -168,7 +168,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 return GetSecurityContextToken(phContext, out phToken);
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 return SafeDeleteContext.CompleteAuthToken(ref refContext, in inputBuffer);
 }
Expand Down

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPISecureChannelType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 throw new NotSupportedException();
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 throw new NotSupportedException();
 }
Expand Down

143 changes: 1 addition & 142 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -163,7 +163,7 @@ internal static int AcceptSecurityContext(ISSPIInterface secModule, SafeFreeCred
 return errorCode;
 }

 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in SecurityBuffer inputBuffer)
 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in InputSecurityBuffer inputBuffer)
 {
 int errorCode = secModule.CompleteAuthToken(ref context, in inputBuffer);

Expand All@@ -186,147 +186,6 @@ public static int QuerySecurityContextToken(ISSPIInterface secModule, SafeDelete
 return secModule.QuerySecurityContextToken(context, out token);
 }

 public static int EncryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Encrypt, secModule, context, input, sequenceNumber);
 }

 public static int DecryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Decrypt, secModule, context, input, sequenceNumber);
 }

 internal static int MakeSignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.MakeSignature, secModule, context, input, sequenceNumber);
 }

 public static int VerifySignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.VerifySignature, secModule, context, input, sequenceNumber);
 }

 private enum OP
 {
 Encrypt = 1,
 Decrypt,
 MakeSignature,
 VerifySignature
 }

 [StructLayout(LayoutKind.Sequential)]
 private ref struct ThreeByteArrays
 {
 public const int NumItems = 3;
 internal byte[] _item0;
 private byte[] _item1;
 private byte[] _item2;
 }

 private static unsafe int EncryptDecryptHelper(OP op, ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 Debug.Assert(Enum.IsDefined<OP>(op), $"Unknown op: {op}");
 Debug.Assert(input.Length <= 3, "The below logic only works for 3 or fewer buffers.");

 Interop.SspiCli.SecBufferDesc sdcInOut = new Interop.SspiCli.SecBufferDesc(input.Length);
 Span<Interop.SspiCli.SecBuffer> unmanagedBuffer = stackalloc Interop.SspiCli.SecBuffer[input.Length];
 unmanagedBuffer.Clear();

 fixed (Interop.SspiCli.SecBuffer* unmanagedBufferPtr = unmanagedBuffer)
 fixed (byte* pinnedBuffer0 = input.Length > 0 ? input[0].token : null)
 fixed (byte* pinnedBuffer1 = input.Length > 1 ? input[1].token : null)
 fixed (byte* pinnedBuffer2 = input.Length > 2 ? input[2].token : null)
 {
 sdcInOut.pBuffers = unmanagedBufferPtr;

 ThreeByteArrays byteArrayStruct = default;
 Span<byte[]> buffers = MemoryMarshal.CreateSpan(ref byteArrayStruct._item0!, ThreeByteArrays.NumItems).Slice(0, input.Length);

 for (int i = 0; i < input.Length; i++)
 {
 ref readonly SecurityBuffer iBuffer = ref input[i];
 unmanagedBuffer[i].cbBuffer = iBuffer.size;
 unmanagedBuffer[i].BufferType = iBuffer.type;
 if (iBuffer.token == null || iBuffer.token.Length == 0)
 {
 unmanagedBuffer[i].pvBuffer = IntPtr.Zero;
 }
 else
 {
 unmanagedBuffer[i].pvBuffer = Marshal.UnsafeAddrOfPinnedArrayElement(iBuffer.token, iBuffer.offset);
 buffers[i] = iBuffer.token;
 }
 }

 // The result is written in the input Buffer passed as type=BufferType.Data.
 int errorCode = op switch
 {
 OP.Encrypt => secModule.EncryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.Decrypt => secModule.DecryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.MakeSignature => secModule.MakeSignature(context, ref sdcInOut, sequenceNumber),
 _ /* OP.VerifySignature */ => secModule.VerifySignature(context, ref sdcInOut, sequenceNumber),
 };

 // Marshalling back returned sizes / data.
 for (int i = 0; i < input.Length; i++)
 {
 ref SecurityBuffer iBuffer = ref input[i];
 iBuffer.size = unmanagedBuffer[i].cbBuffer;
 iBuffer.type = unmanagedBuffer[i].BufferType;

 if (iBuffer.size == 0)
 {
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 else
 {

 // Find the buffer this is inside of. Usually they all point inside buffer 0.
 int j;
 for (j = 0; j < input.Length; j++)
 {
 if (buffers[j] != null)
 {
 checked
 {
 byte* bufferAddress = (byte*)Marshal.UnsafeAddrOfPinnedArrayElement(buffers[j], 0);
 if ((byte*)unmanagedBuffer[i].pvBuffer >= bufferAddress &&
 (byte*)unmanagedBuffer[i].pvBuffer + iBuffer.size <= bufferAddress + buffers[j].Length)
 {
 iBuffer.offset = (int)((byte*)unmanagedBuffer[i].pvBuffer - bufferAddress);
 iBuffer.token = buffers[j];
 break;
 }
 }
 }
 }

 if (j >= input.Length)
 {
 Debug.Fail("Output buffer out of range.");
 iBuffer.size = 0;
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 }

 // Backup validate the new sizes.
 Debug.Assert(iBuffer.offset >= 0 && iBuffer.offset <= (iBuffer.token == null ? 0 : iBuffer.token.Length), $"'offset' out of range. [{iBuffer.offset}]");
 Debug.Assert(iBuffer.size >= 0 && iBuffer.size <= (iBuffer.token == null ? 0 : iBuffer.token.Length - iBuffer.offset), $"'size' out of range. [{iBuffer.size}]");
 }

 if (NetEventSource.Log.IsEnabled() && errorCode != 0)
 {
 NetEventSource.Error(null, errorCode == Interop.SspiCli.SEC_I_RENEGOTIATE ?
 SR.Format(SR.event_OperationReturnedSomething, op, "SEC_I_RENEGOTIATE") :
 SR.Format(SR.net_log_operation_failed_with_error, op, $"0x{0:X}"));
 }

 return errorCode;
 }
 }

 public static SafeFreeContextBufferChannelBinding? QueryContextChannelBinding(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute contextAttribute)
 {
 SafeFreeContextBufferChannelBinding result;
Expand Down

27 changes: 14 additions & 13 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -472,9 +472,13 @@ internal static unsafe int InitializeSecurityContext(
 // Get unmanaged buffer with index 0 as the only one passed into PInvoke.
 outSecBuffer.size = outUnmanagedBuffer.cbBuffer;
 outSecBuffer.type = outUnmanagedBuffer.BufferType;
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;

 if (isSspiAllocated)
 {
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;
 }

 if (inSecBuffers.Count > 1 && inUnmanagedBuffer[1].BufferType == SecurityBufferType.SECBUFFER_EXTRA && inSecBuffers._item1.Type == SecurityBufferType.SECBUFFER_EMPTY)
 {
Expand DownExpand Up@@ -952,25 +956,22 @@ private static unsafe int MustRunAcceptSecurityContext_SECURITY(

 internal static unsafe int CompleteAuthToken(
 ref SafeDeleteSslContext? refContext,
 in SecurityBuffer inSecBuffer)
 in InputSecurityBuffer inSecBuffer)
 {
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}, inSecBuffer = {inSecBuffer}");
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}");

 var inSecurityBufferDescriptor = new Interop.SspiCli.SecBufferDesc(1);
 int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;

 Interop.SspiCli.SecBuffer inUnmanagedBuffer = default;
 inSecurityBufferDescriptor.pBuffers = &inUnmanagedBuffer;
 fixed (byte* pinnedToken = inSecBuffer.token)
 fixed (byte* pinnedToken = inSecBuffer.Token)
 {
 inUnmanagedBuffer.cbBuffer = inSecBuffer.size;
 inUnmanagedBuffer.BufferType = inSecBuffer.type;

 // Use the unmanaged token if it's not null; otherwise use the managed buffer.
 Debug.Assert(inSecBuffer.UnmanagedToken != null);
 inUnmanagedBuffer.cbBuffer = inSecBuffer.Token.Length;
 inUnmanagedBuffer.BufferType = inSecBuffer.Type;
 inUnmanagedBuffer.pvBuffer =
 inSecBuffer.unmanagedToken != null ? inSecBuffer.unmanagedToken.DangerousGetHandle() :
 inSecBuffer.token == null || inSecBuffer.token.Length == 0 ? IntPtr.Zero :
 (IntPtr)(pinnedToken + inSecBuffer.offset);
 inSecBuffer.Token.IsEmpty ? IntPtr.Zero : (IntPtr)pinnedToken;

 Interop.SspiCli.CredHandle contextHandle = refContext != null ? refContext._handle : default;
 if (refContext == null || refContext.IsInvalid)
Expand Down

33 changes: 21 additions & 12 deletions
src/libraries/Common/src/System/Net/NTAuthentication.Common.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,6 +20,7 @@ internal sealed partial class NTAuthentication
 private string? _spn;

 private int _tokenSize;
 private byte[]? _tokenBuffer;
 private ContextFlagsPal _requestedContextFlags;
 private ContextFlagsPal _contextFlags;

Expand DownExpand Up@@ -158,14 +159,14 @@ internal void CloseContext()
 _isCompleted = false;
 }

 internal int VerifySignature(byte[] buffer, int offset, int count)
 internal int VerifySignature(ReadOnlySpan<byte> buffer)
 {
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer, offset, count);
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer);
 }

 internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref byte[] output)
 internal int MakeSignature(ReadOnlySpan<byte> buffer, [AllowNull] ref byte[] output)
 {
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, offset, count, ref output);
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, ref output);
 }

 internal string? GetOutgoingBlob(string? incomingBlob)
Expand DownExpand Up@@ -221,9 +222,10 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref

 internal byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, bool throwOnError, out SecurityStatusPal statusCode)
 {
byte[]? result = new byte[_tokenSize];
_tokenBuffer ??= _tokenSize == 0 ? Array.Empty<byte>() : new byte[_tokenSize];
Comment thread
stephentoub marked this conversation as resolved.


 bool firstTime = _securityContext == null;
 int resultBlobLength;
 try
 {
 if (!_isServer)
Expand All@@ -236,18 +238,19 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.InitializeSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded)
 {
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, result);
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, _tokenBuffer.AsSpan(0, resultBlobLength));

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.CompleteAuthToken() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

result = null;
resultBlobLength = 0;
 }
 }
 else
Expand All@@ -259,7 +262,8 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.AcceptSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");
Expand All@@ -284,6 +288,7 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 {
 CloseContext();
 _isCompleted = true;
 _tokenBuffer = null;
 if (throwOnError)
 {
 throw NegotiateStreamPal.CreateExceptionFromError(statusCode);
Expand All@@ -297,12 +302,18 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 SSPIHandleCache.CacheCredential(_credentialsHandle);
 }

 byte[]? result =
 resultBlobLength == 0 || _tokenBuffer == null ? null :
 _tokenBuffer.Length == resultBlobLength ? _tokenBuffer :
 _tokenBuffer[0..resultBlobLength];

 // The return value will tell us correctly if the handshake is over or not
 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK
 || (_isServer && statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded))
 {
 // Success.
 _isCompleted = true;
 _tokenBuffer = null;
 }
 else
 {
Expand DownExpand Up@@ -335,13 +346,11 @@ internal int Encrypt(ReadOnlySpan<byte> buffer, [NotNull] ref byte[]? output, ui
 sequenceNumber);
 }

 internal int Decrypt(byte[] payload, int offset, int count, out int newOffset, uint expectedSeqNumber)
 internal int Decrypt(Span<byte> payload, out int newOffset, uint expectedSeqNumber)
 {
 return NegotiateStreamPal.Decrypt(
 _securityContext!,
 payload,
 offset,
 count,
 (_contextFlags & ContextFlagsPal.Confidentiality) != 0,
 IsNTLM,
 out newOffset,
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Improve allocations in NegotiateStreamPal#71280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

wfurt
merged 5 commits into

from

Jun 29, 2022
 Merged


Improve allocations in NegotiateStreamPal
#71280
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
1dd747d

Reduce buffer allocations during NTLM/Negotiate authentication


filipnavara Jun 25, 2022
49c1ed0

Update ReadWriteAdapter.WriteAsync prototype to use Memory<byte> inst…


filipnavara Jun 25, 2022
2fe4491

Spanify NTAuthentication.Decrypt and avoid couple of offset/count checks


filipnavara Jun 25, 2022
3b4aff6

Spanify NegotiateStreamPal.VerifySignature/MakeSignature.


filipnavara Jun 25, 2022
46e05a4

Update src/libraries/Common/src/System/Net/NTAuthentication.Common.cs


filipnavara Jun 28, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 8 additions & 11 deletions
...libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -210,10 +210,10 @@ private static unsafe partial Status Wrap(
 ref GssBuffer outBuffer);

 [LibraryImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
 private static partial Status Unwrap(
 private static unsafe partial Status Unwrap(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 byte* inputBytes,
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offset any more? It feels like if we pass pointer we can just do count.
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't. Unfortunately, dotnet/sqlclient uses the native APIs, so I didn't feel confident in changing it. I am quite sure they don't use this particular API though.
@MichalPetrykaMichalPetrykaJun 27, 2022

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't the pointer change by itself be breaking for them?
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't change the native code side, the prototype remains unchanged there. They basically copied the managed side of the interop. (We cannot change the signature, add parameters, remove parameters, or change their types. We can change how they are marshalled on the C# side though.)
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @JRahnama just in case.
@filipnavarafilipnavaraJun 29, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cross-checked with the SqlClient source and this particular native method is not referenced so we can remove the offset parameter. I will do that in a follow-up PR (#71373) since I need to update the native interop there anyway.
 int offset,
 int count,
 ref GssBuffer outBuffer);
Expand All@@ -231,19 +231,16 @@ internal static unsafe Status WrapBuffer(
 }
 }

 internal static Status UnwrapBuffer(
 internal static unsafe Status UnwrapBuffer(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 int offset,
 int count,
 ReadOnlySpan<byte> inputBytes,
 ref GssBuffer outBuffer)
 {
 Debug.Assert(inputBytes != null, "inputBytes must be valid value");
 Debug.Assert(offset >= 0 && offset <= inputBytes.Length, "offset must be valid");
 Debug.Assert(count >= 0 && count <= inputBytes.Length, "count must be valid");

 return Unwrap(out minorStatus, contextHandle, inputBytes, offset, count, ref outBuffer);
 fixed (byte* inputBytesPtr = inputBytes)
 {
 return Unwrap(out minorStatus, contextHandle, inputBytesPtr, 0, inputBytes.Length, ref outBuffer);
 }
 }
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/ISSPIInterface.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -25,7 +25,7 @@ internal interface ISSPIInterface
 int QueryContextChannelBinding(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeContextBufferChannelBinding refHandle);
 int QueryContextAttributes(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, Span<byte> buffer, Type? handleType, out SafeHandle? refHandle);
 int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityContextTokenHandle phToken);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer);
 int ApplyControlToken(ref SafeDeleteContext? refContext, in SecurityBuffer inputBuffer);
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIAuthType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -168,7 +168,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 return GetSecurityContextToken(phContext, out phToken);
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 return SafeDeleteContext.CompleteAuthToken(ref refContext, in inputBuffer);
 }
Expand Down

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPISecureChannelType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 throw new NotSupportedException();
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 throw new NotSupportedException();
 }
Expand Down

143 changes: 1 addition & 142 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -163,7 +163,7 @@ internal static int AcceptSecurityContext(ISSPIInterface secModule, SafeFreeCred
 return errorCode;
 }

 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in SecurityBuffer inputBuffer)
 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in InputSecurityBuffer inputBuffer)
 {
 int errorCode = secModule.CompleteAuthToken(ref context, in inputBuffer);

Expand All@@ -186,147 +186,6 @@ public static int QuerySecurityContextToken(ISSPIInterface secModule, SafeDelete
 return secModule.QuerySecurityContextToken(context, out token);
 }

 public static int EncryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Encrypt, secModule, context, input, sequenceNumber);
 }

 public static int DecryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Decrypt, secModule, context, input, sequenceNumber);
 }

 internal static int MakeSignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.MakeSignature, secModule, context, input, sequenceNumber);
 }

 public static int VerifySignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.VerifySignature, secModule, context, input, sequenceNumber);
 }

 private enum OP
 {
 Encrypt = 1,
 Decrypt,
 MakeSignature,
 VerifySignature
 }

 [StructLayout(LayoutKind.Sequential)]
 private ref struct ThreeByteArrays
 {
 public const int NumItems = 3;
 internal byte[] _item0;
 private byte[] _item1;
 private byte[] _item2;
 }

 private static unsafe int EncryptDecryptHelper(OP op, ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 Debug.Assert(Enum.IsDefined<OP>(op), $"Unknown op: {op}");
 Debug.Assert(input.Length <= 3, "The below logic only works for 3 or fewer buffers.");

 Interop.SspiCli.SecBufferDesc sdcInOut = new Interop.SspiCli.SecBufferDesc(input.Length);
 Span<Interop.SspiCli.SecBuffer> unmanagedBuffer = stackalloc Interop.SspiCli.SecBuffer[input.Length];
 unmanagedBuffer.Clear();

 fixed (Interop.SspiCli.SecBuffer* unmanagedBufferPtr = unmanagedBuffer)
 fixed (byte* pinnedBuffer0 = input.Length > 0 ? input[0].token : null)
 fixed (byte* pinnedBuffer1 = input.Length > 1 ? input[1].token : null)
 fixed (byte* pinnedBuffer2 = input.Length > 2 ? input[2].token : null)
 {
 sdcInOut.pBuffers = unmanagedBufferPtr;

 ThreeByteArrays byteArrayStruct = default;
 Span<byte[]> buffers = MemoryMarshal.CreateSpan(ref byteArrayStruct._item0!, ThreeByteArrays.NumItems).Slice(0, input.Length);

 for (int i = 0; i < input.Length; i++)
 {
 ref readonly SecurityBuffer iBuffer = ref input[i];
 unmanagedBuffer[i].cbBuffer = iBuffer.size;
 unmanagedBuffer[i].BufferType = iBuffer.type;
 if (iBuffer.token == null || iBuffer.token.Length == 0)
 {
 unmanagedBuffer[i].pvBuffer = IntPtr.Zero;
 }
 else
 {
 unmanagedBuffer[i].pvBuffer = Marshal.UnsafeAddrOfPinnedArrayElement(iBuffer.token, iBuffer.offset);
 buffers[i] = iBuffer.token;
 }
 }

 // The result is written in the input Buffer passed as type=BufferType.Data.
 int errorCode = op switch
 {
 OP.Encrypt => secModule.EncryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.Decrypt => secModule.DecryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.MakeSignature => secModule.MakeSignature(context, ref sdcInOut, sequenceNumber),
 _ /* OP.VerifySignature */ => secModule.VerifySignature(context, ref sdcInOut, sequenceNumber),
 };

 // Marshalling back returned sizes / data.
 for (int i = 0; i < input.Length; i++)
 {
 ref SecurityBuffer iBuffer = ref input[i];
 iBuffer.size = unmanagedBuffer[i].cbBuffer;
 iBuffer.type = unmanagedBuffer[i].BufferType;

 if (iBuffer.size == 0)
 {
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 else
 {

 // Find the buffer this is inside of. Usually they all point inside buffer 0.
 int j;
 for (j = 0; j < input.Length; j++)
 {
 if (buffers[j] != null)
 {
 checked
 {
 byte* bufferAddress = (byte*)Marshal.UnsafeAddrOfPinnedArrayElement(buffers[j], 0);
 if ((byte*)unmanagedBuffer[i].pvBuffer >= bufferAddress &&
 (byte*)unmanagedBuffer[i].pvBuffer + iBuffer.size <= bufferAddress + buffers[j].Length)
 {
 iBuffer.offset = (int)((byte*)unmanagedBuffer[i].pvBuffer - bufferAddress);
 iBuffer.token = buffers[j];
 break;
 }
 }
 }
 }

 if (j >= input.Length)
 {
 Debug.Fail("Output buffer out of range.");
 iBuffer.size = 0;
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 }

 // Backup validate the new sizes.
 Debug.Assert(iBuffer.offset >= 0 && iBuffer.offset <= (iBuffer.token == null ? 0 : iBuffer.token.Length), $"'offset' out of range. [{iBuffer.offset}]");
 Debug.Assert(iBuffer.size >= 0 && iBuffer.size <= (iBuffer.token == null ? 0 : iBuffer.token.Length - iBuffer.offset), $"'size' out of range. [{iBuffer.size}]");
 }

 if (NetEventSource.Log.IsEnabled() && errorCode != 0)
 {
 NetEventSource.Error(null, errorCode == Interop.SspiCli.SEC_I_RENEGOTIATE ?
 SR.Format(SR.event_OperationReturnedSomething, op, "SEC_I_RENEGOTIATE") :
 SR.Format(SR.net_log_operation_failed_with_error, op, $"0x{0:X}"));
 }

 return errorCode;
 }
 }

 public static SafeFreeContextBufferChannelBinding? QueryContextChannelBinding(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute contextAttribute)
 {
 SafeFreeContextBufferChannelBinding result;
Expand Down

27 changes: 14 additions & 13 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -472,9 +472,13 @@ internal static unsafe int InitializeSecurityContext(
 // Get unmanaged buffer with index 0 as the only one passed into PInvoke.
 outSecBuffer.size = outUnmanagedBuffer.cbBuffer;
 outSecBuffer.type = outUnmanagedBuffer.BufferType;
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;

 if (isSspiAllocated)
 {
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;
 }

 if (inSecBuffers.Count > 1 && inUnmanagedBuffer[1].BufferType == SecurityBufferType.SECBUFFER_EXTRA && inSecBuffers._item1.Type == SecurityBufferType.SECBUFFER_EMPTY)
 {
Expand DownExpand Up@@ -952,25 +956,22 @@ private static unsafe int MustRunAcceptSecurityContext_SECURITY(

 internal static unsafe int CompleteAuthToken(
 ref SafeDeleteSslContext? refContext,
 in SecurityBuffer inSecBuffer)
 in InputSecurityBuffer inSecBuffer)
 {
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}, inSecBuffer = {inSecBuffer}");
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}");

 var inSecurityBufferDescriptor = new Interop.SspiCli.SecBufferDesc(1);
 int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;

 Interop.SspiCli.SecBuffer inUnmanagedBuffer = default;
 inSecurityBufferDescriptor.pBuffers = &inUnmanagedBuffer;
 fixed (byte* pinnedToken = inSecBuffer.token)
 fixed (byte* pinnedToken = inSecBuffer.Token)
 {
 inUnmanagedBuffer.cbBuffer = inSecBuffer.size;
 inUnmanagedBuffer.BufferType = inSecBuffer.type;

 // Use the unmanaged token if it's not null; otherwise use the managed buffer.
 Debug.Assert(inSecBuffer.UnmanagedToken != null);
 inUnmanagedBuffer.cbBuffer = inSecBuffer.Token.Length;
 inUnmanagedBuffer.BufferType = inSecBuffer.Type;
 inUnmanagedBuffer.pvBuffer =
 inSecBuffer.unmanagedToken != null ? inSecBuffer.unmanagedToken.DangerousGetHandle() :
 inSecBuffer.token == null || inSecBuffer.token.Length == 0 ? IntPtr.Zero :
 (IntPtr)(pinnedToken + inSecBuffer.offset);
 inSecBuffer.Token.IsEmpty ? IntPtr.Zero : (IntPtr)pinnedToken;

 Interop.SspiCli.CredHandle contextHandle = refContext != null ? refContext._handle : default;
 if (refContext == null || refContext.IsInvalid)
Expand Down

33 changes: 21 additions & 12 deletions
src/libraries/Common/src/System/Net/NTAuthentication.Common.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,6 +20,7 @@ internal sealed partial class NTAuthentication
 private string? _spn;

 private int _tokenSize;
 private byte[]? _tokenBuffer;
 private ContextFlagsPal _requestedContextFlags;
 private ContextFlagsPal _contextFlags;

Expand DownExpand Up@@ -158,14 +159,14 @@ internal void CloseContext()
 _isCompleted = false;
 }

 internal int VerifySignature(byte[] buffer, int offset, int count)
 internal int VerifySignature(ReadOnlySpan<byte> buffer)
 {
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer, offset, count);
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer);
 }

 internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref byte[] output)
 internal int MakeSignature(ReadOnlySpan<byte> buffer, [AllowNull] ref byte[] output)
 {
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, offset, count, ref output);
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, ref output);
 }

 internal string? GetOutgoingBlob(string? incomingBlob)
Expand DownExpand Up@@ -221,9 +222,10 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref

 internal byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, bool throwOnError, out SecurityStatusPal statusCode)
 {
byte[]? result = new byte[_tokenSize];
_tokenBuffer ??= _tokenSize == 0 ? Array.Empty<byte>() : new byte[_tokenSize];
Comment thread
stephentoub marked this conversation as resolved.


 bool firstTime = _securityContext == null;
 int resultBlobLength;
 try
 {
 if (!_isServer)
Expand All@@ -236,18 +238,19 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.InitializeSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded)
 {
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, result);
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, _tokenBuffer.AsSpan(0, resultBlobLength));

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.CompleteAuthToken() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

result = null;
resultBlobLength = 0;
 }
 }
 else
Expand All@@ -259,7 +262,8 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.AcceptSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");
Expand All@@ -284,6 +288,7 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 {
 CloseContext();
 _isCompleted = true;
 _tokenBuffer = null;
 if (throwOnError)
 {
 throw NegotiateStreamPal.CreateExceptionFromError(statusCode);
Expand All@@ -297,12 +302,18 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 SSPIHandleCache.CacheCredential(_credentialsHandle);
 }

 byte[]? result =
 resultBlobLength == 0 || _tokenBuffer == null ? null :
 _tokenBuffer.Length == resultBlobLength ? _tokenBuffer :
 _tokenBuffer[0..resultBlobLength];

 // The return value will tell us correctly if the handshake is over or not
 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK
 || (_isServer && statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded))
 {
 // Success.
 _isCompleted = true;
 _tokenBuffer = null;
 }
 else
 {
Expand DownExpand Up@@ -335,13 +346,11 @@ internal int Encrypt(ReadOnlySpan<byte> buffer, [NotNull] ref byte[]? output, ui
 sequenceNumber);
 }

 internal int Decrypt(byte[] payload, int offset, int count, out int newOffset, uint expectedSeqNumber)
 internal int Decrypt(Span<byte> payload, out int newOffset, uint expectedSeqNumber)
 {
 return NegotiateStreamPal.Decrypt(
 _securityContext!,
 payload,
 offset,
 count,
 (_contextFlags & ContextFlagsPal.Confidentiality) != 0,
 IsNTLM,
 out newOffset,
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Improve allocations in NegotiateStreamPal#71280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

wfurt
merged 5 commits into

from

Jun 29, 2022
 Merged


Improve allocations in NegotiateStreamPal
#71280
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
1dd747d

Reduce buffer allocations during NTLM/Negotiate authentication


filipnavara Jun 25, 2022
49c1ed0

Update ReadWriteAdapter.WriteAsync prototype to use Memory<byte> inst…


filipnavara Jun 25, 2022
2fe4491

Spanify NTAuthentication.Decrypt and avoid couple of offset/count checks


filipnavara Jun 25, 2022
3b4aff6

Spanify NegotiateStreamPal.VerifySignature/MakeSignature.


filipnavara Jun 25, 2022
46e05a4

Update src/libraries/Common/src/System/Net/NTAuthentication.Common.cs


filipnavara Jun 28, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


19 changes: 8 additions & 11 deletions
...libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -210,10 +210,10 @@ private static unsafe partial Status Wrap(
 ref GssBuffer outBuffer);

 [LibraryImport(Interop.Libraries.NetSecurityNative, EntryPoint="NetSecurityNative_Unwrap")]
 private static partial Status Unwrap(
 private static unsafe partial Status Unwrap(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 byte* inputBytes,
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offset any more? It feels like if we pass pointer we can just do count.
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't. Unfortunately, dotnet/sqlclient uses the native APIs, so I didn't feel confident in changing it. I am quite sure they don't use this particular API though.
@MichalPetrykaMichalPetrykaJun 27, 2022

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't the pointer change by itself be breaking for them?
@filipnavarafilipnavaraJun 27, 2022•

edited

Loading

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't change the native code side, the prototype remains unchanged there. They basically copied the managed side of the interop. (We cannot change the signature, add parameters, remove parameters, or change their types. We can change how they are marshalled on the C# side though.)
@wfurtwfurtJun 27, 2022

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @JRahnama just in case.
@filipnavarafilipnavaraJun 29, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cross-checked with the SqlClient source and this particular native method is not referenced so we can remove the offset parameter. I will do that in a follow-up PR (#71373) since I need to update the native interop there anyway.
 int offset,
 int count,
 ref GssBuffer outBuffer);
Expand All@@ -231,19 +231,16 @@ internal static unsafe Status WrapBuffer(
 }
 }

 internal static Status UnwrapBuffer(
 internal static unsafe Status UnwrapBuffer(
 out Status minorStatus,
 SafeGssContextHandle? contextHandle,
 byte[] inputBytes,
 int offset,
 int count,
 ReadOnlySpan<byte> inputBytes,
 ref GssBuffer outBuffer)
 {
 Debug.Assert(inputBytes != null, "inputBytes must be valid value");
 Debug.Assert(offset >= 0 && offset <= inputBytes.Length, "offset must be valid");
 Debug.Assert(count >= 0 && count <= inputBytes.Length, "count must be valid");

 return Unwrap(out minorStatus, contextHandle, inputBytes, offset, count, ref outBuffer);
 fixed (byte* inputBytesPtr = inputBytes)
 {
 return Unwrap(out minorStatus, contextHandle, inputBytesPtr, 0, inputBytes.Length, ref outBuffer);
 }
 }
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/ISSPIInterface.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -25,7 +25,7 @@ internal interface ISSPIInterface
 int QueryContextChannelBinding(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeContextBufferChannelBinding refHandle);
 int QueryContextAttributes(SafeDeleteContext phContext, Interop.SspiCli.ContextAttribute attribute, Span<byte> buffer, Type? handleType, out SafeHandle? refHandle);
 int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityContextTokenHandle phToken);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer);
 int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer);
 int ApplyControlToken(ref SafeDeleteContext? refContext, in SecurityBuffer inputBuffer);
 }
}

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIAuthType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -168,7 +168,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 return GetSecurityContextToken(phContext, out phToken);
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 return SafeDeleteContext.CompleteAuthToken(ref refContext, in inputBuffer);
 }
Expand Down

2 changes: 1 addition & 1 deletion
src/libraries/Common/src/Interop/Windows/SspiCli/SSPISecureChannelType.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ public int QuerySecurityContextToken(SafeDeleteContext phContext, out SecurityCo
 throw new NotSupportedException();
 }

 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in SecurityBuffer inputBuffer)
 public int CompleteAuthToken(ref SafeDeleteSslContext? refContext, in InputSecurityBuffer inputBuffer)
 {
 throw new NotSupportedException();
 }
Expand Down

143 changes: 1 addition & 142 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -163,7 +163,7 @@ internal static int AcceptSecurityContext(ISSPIInterface secModule, SafeFreeCred
 return errorCode;
 }

 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in SecurityBuffer inputBuffer)
 internal static int CompleteAuthToken(ISSPIInterface secModule, ref SafeDeleteSslContext? context, in InputSecurityBuffer inputBuffer)
 {
 int errorCode = secModule.CompleteAuthToken(ref context, in inputBuffer);

Expand All@@ -186,147 +186,6 @@ public static int QuerySecurityContextToken(ISSPIInterface secModule, SafeDelete
 return secModule.QuerySecurityContextToken(context, out token);
 }

 public static int EncryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Encrypt, secModule, context, input, sequenceNumber);
 }

 public static int DecryptMessage(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.Decrypt, secModule, context, input, sequenceNumber);
 }

 internal static int MakeSignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.MakeSignature, secModule, context, input, sequenceNumber);
 }

 public static int VerifySignature(ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 return EncryptDecryptHelper(OP.VerifySignature, secModule, context, input, sequenceNumber);
 }

 private enum OP
 {
 Encrypt = 1,
 Decrypt,
 MakeSignature,
 VerifySignature
 }

 [StructLayout(LayoutKind.Sequential)]
 private ref struct ThreeByteArrays
 {
 public const int NumItems = 3;
 internal byte[] _item0;
 private byte[] _item1;
 private byte[] _item2;
 }

 private static unsafe int EncryptDecryptHelper(OP op, ISSPIInterface secModule, SafeDeleteContext context, Span<SecurityBuffer> input, uint sequenceNumber)
 {
 Debug.Assert(Enum.IsDefined<OP>(op), $"Unknown op: {op}");
 Debug.Assert(input.Length <= 3, "The below logic only works for 3 or fewer buffers.");

 Interop.SspiCli.SecBufferDesc sdcInOut = new Interop.SspiCli.SecBufferDesc(input.Length);
 Span<Interop.SspiCli.SecBuffer> unmanagedBuffer = stackalloc Interop.SspiCli.SecBuffer[input.Length];
 unmanagedBuffer.Clear();

 fixed (Interop.SspiCli.SecBuffer* unmanagedBufferPtr = unmanagedBuffer)
 fixed (byte* pinnedBuffer0 = input.Length > 0 ? input[0].token : null)
 fixed (byte* pinnedBuffer1 = input.Length > 1 ? input[1].token : null)
 fixed (byte* pinnedBuffer2 = input.Length > 2 ? input[2].token : null)
 {
 sdcInOut.pBuffers = unmanagedBufferPtr;

 ThreeByteArrays byteArrayStruct = default;
 Span<byte[]> buffers = MemoryMarshal.CreateSpan(ref byteArrayStruct._item0!, ThreeByteArrays.NumItems).Slice(0, input.Length);

 for (int i = 0; i < input.Length; i++)
 {
 ref readonly SecurityBuffer iBuffer = ref input[i];
 unmanagedBuffer[i].cbBuffer = iBuffer.size;
 unmanagedBuffer[i].BufferType = iBuffer.type;
 if (iBuffer.token == null || iBuffer.token.Length == 0)
 {
 unmanagedBuffer[i].pvBuffer = IntPtr.Zero;
 }
 else
 {
 unmanagedBuffer[i].pvBuffer = Marshal.UnsafeAddrOfPinnedArrayElement(iBuffer.token, iBuffer.offset);
 buffers[i] = iBuffer.token;
 }
 }

 // The result is written in the input Buffer passed as type=BufferType.Data.
 int errorCode = op switch
 {
 OP.Encrypt => secModule.EncryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.Decrypt => secModule.DecryptMessage(context, ref sdcInOut, sequenceNumber),
 OP.MakeSignature => secModule.MakeSignature(context, ref sdcInOut, sequenceNumber),
 _ /* OP.VerifySignature */ => secModule.VerifySignature(context, ref sdcInOut, sequenceNumber),
 };

 // Marshalling back returned sizes / data.
 for (int i = 0; i < input.Length; i++)
 {
 ref SecurityBuffer iBuffer = ref input[i];
 iBuffer.size = unmanagedBuffer[i].cbBuffer;
 iBuffer.type = unmanagedBuffer[i].BufferType;

 if (iBuffer.size == 0)
 {
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 else
 {

 // Find the buffer this is inside of. Usually they all point inside buffer 0.
 int j;
 for (j = 0; j < input.Length; j++)
 {
 if (buffers[j] != null)
 {
 checked
 {
 byte* bufferAddress = (byte*)Marshal.UnsafeAddrOfPinnedArrayElement(buffers[j], 0);
 if ((byte*)unmanagedBuffer[i].pvBuffer >= bufferAddress &&
 (byte*)unmanagedBuffer[i].pvBuffer + iBuffer.size <= bufferAddress + buffers[j].Length)
 {
 iBuffer.offset = (int)((byte*)unmanagedBuffer[i].pvBuffer - bufferAddress);
 iBuffer.token = buffers[j];
 break;
 }
 }
 }
 }

 if (j >= input.Length)
 {
 Debug.Fail("Output buffer out of range.");
 iBuffer.size = 0;
 iBuffer.offset = 0;
 iBuffer.token = null;
 }
 }

 // Backup validate the new sizes.
 Debug.Assert(iBuffer.offset >= 0 && iBuffer.offset <= (iBuffer.token == null ? 0 : iBuffer.token.Length), $"'offset' out of range. [{iBuffer.offset}]");
 Debug.Assert(iBuffer.size >= 0 && iBuffer.size <= (iBuffer.token == null ? 0 : iBuffer.token.Length - iBuffer.offset), $"'size' out of range. [{iBuffer.size}]");
 }

 if (NetEventSource.Log.IsEnabled() && errorCode != 0)
 {
 NetEventSource.Error(null, errorCode == Interop.SspiCli.SEC_I_RENEGOTIATE ?
 SR.Format(SR.event_OperationReturnedSomething, op, "SEC_I_RENEGOTIATE") :
 SR.Format(SR.net_log_operation_failed_with_error, op, $"0x{0:X}"));
 }

 return errorCode;
 }
 }

 public static SafeFreeContextBufferChannelBinding? QueryContextChannelBinding(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute contextAttribute)
 {
 SafeFreeContextBufferChannelBinding result;
Expand Down

27 changes: 14 additions & 13 deletions
src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -472,9 +472,13 @@ internal static unsafe int InitializeSecurityContext(
 // Get unmanaged buffer with index 0 as the only one passed into PInvoke.
 outSecBuffer.size = outUnmanagedBuffer.cbBuffer;
 outSecBuffer.type = outUnmanagedBuffer.BufferType;
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;

 if (isSspiAllocated)
 {
 outSecBuffer.token = outSecBuffer.size > 0 ?
 new Span<byte>((byte*)outUnmanagedBuffer.pvBuffer, outUnmanagedBuffer.cbBuffer).ToArray() :
 null;
 }

 if (inSecBuffers.Count > 1 && inUnmanagedBuffer[1].BufferType == SecurityBufferType.SECBUFFER_EXTRA && inSecBuffers._item1.Type == SecurityBufferType.SECBUFFER_EMPTY)
 {
Expand DownExpand Up@@ -952,25 +956,22 @@ private static unsafe int MustRunAcceptSecurityContext_SECURITY(

 internal static unsafe int CompleteAuthToken(
 ref SafeDeleteSslContext? refContext,
 in SecurityBuffer inSecBuffer)
 in InputSecurityBuffer inSecBuffer)
 {
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}, inSecBuffer = {inSecBuffer}");
 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, $"refContext = {refContext}");

 var inSecurityBufferDescriptor = new Interop.SspiCli.SecBufferDesc(1);
 int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;

 Interop.SspiCli.SecBuffer inUnmanagedBuffer = default;
 inSecurityBufferDescriptor.pBuffers = &inUnmanagedBuffer;
 fixed (byte* pinnedToken = inSecBuffer.token)
 fixed (byte* pinnedToken = inSecBuffer.Token)
 {
 inUnmanagedBuffer.cbBuffer = inSecBuffer.size;
 inUnmanagedBuffer.BufferType = inSecBuffer.type;

 // Use the unmanaged token if it's not null; otherwise use the managed buffer.
 Debug.Assert(inSecBuffer.UnmanagedToken != null);
 inUnmanagedBuffer.cbBuffer = inSecBuffer.Token.Length;
 inUnmanagedBuffer.BufferType = inSecBuffer.Type;
 inUnmanagedBuffer.pvBuffer =
 inSecBuffer.unmanagedToken != null ? inSecBuffer.unmanagedToken.DangerousGetHandle() :
 inSecBuffer.token == null || inSecBuffer.token.Length == 0 ? IntPtr.Zero :
 (IntPtr)(pinnedToken + inSecBuffer.offset);
 inSecBuffer.Token.IsEmpty ? IntPtr.Zero : (IntPtr)pinnedToken;

 Interop.SspiCli.CredHandle contextHandle = refContext != null ? refContext._handle : default;
 if (refContext == null || refContext.IsInvalid)
Expand Down

33 changes: 21 additions & 12 deletions
src/libraries/Common/src/System/Net/NTAuthentication.Common.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,6 +20,7 @@ internal sealed partial class NTAuthentication
 private string? _spn;

 private int _tokenSize;
 private byte[]? _tokenBuffer;
 private ContextFlagsPal _requestedContextFlags;
 private ContextFlagsPal _contextFlags;

Expand DownExpand Up@@ -158,14 +159,14 @@ internal void CloseContext()
 _isCompleted = false;
 }

 internal int VerifySignature(byte[] buffer, int offset, int count)
 internal int VerifySignature(ReadOnlySpan<byte> buffer)
 {
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer, offset, count);
 return NegotiateStreamPal.VerifySignature(_securityContext!, buffer);
 }

 internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref byte[] output)
 internal int MakeSignature(ReadOnlySpan<byte> buffer, [AllowNull] ref byte[] output)
 {
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, offset, count, ref output);
 return NegotiateStreamPal.MakeSignature(_securityContext!, buffer, ref output);
 }

 internal string? GetOutgoingBlob(string? incomingBlob)
Expand DownExpand Up@@ -221,9 +222,10 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref

 internal byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, bool throwOnError, out SecurityStatusPal statusCode)
 {
byte[]? result = new byte[_tokenSize];
_tokenBuffer ??= _tokenSize == 0 ? Array.Empty<byte>() : new byte[_tokenSize];
Comment thread
stephentoub marked this conversation as resolved.


 bool firstTime = _securityContext == null;
 int resultBlobLength;
 try
 {
 if (!_isServer)
Expand All@@ -236,18 +238,19 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.InitializeSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded)
 {
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, result);
 statusCode = NegotiateStreamPal.CompleteAuthToken(ref _securityContext, _tokenBuffer.AsSpan(0, resultBlobLength));

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.CompleteAuthToken() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");

result = null;
resultBlobLength = 0;
 }
 }
 else
Expand All@@ -259,7 +262,8 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 _requestedContextFlags,
 incomingBlob,
 _channelBinding,
 ref result,
 ref _tokenBuffer,
 out resultBlobLength,
 ref _contextFlags);

 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"SSPIWrapper.AcceptSecurityContext() returns statusCode:0x{((int)statusCode.ErrorCode):x8} ({statusCode})");
Expand All@@ -284,6 +288,7 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 {
 CloseContext();
 _isCompleted = true;
 _tokenBuffer = null;
 if (throwOnError)
 {
 throw NegotiateStreamPal.CreateExceptionFromError(statusCode);
Expand All@@ -297,12 +302,18 @@ internal int MakeSignature(byte[] buffer, int offset, int count, [AllowNull] ref
 SSPIHandleCache.CacheCredential(_credentialsHandle);
 }

 byte[]? result =
 resultBlobLength == 0 || _tokenBuffer == null ? null :
 _tokenBuffer.Length == resultBlobLength ? _tokenBuffer :
 _tokenBuffer[0..resultBlobLength];

 // The return value will tell us correctly if the handshake is over or not
 if (statusCode.ErrorCode == SecurityStatusPalErrorCode.OK
 || (_isServer && statusCode.ErrorCode == SecurityStatusPalErrorCode.CompleteNeeded))
 {
 // Success.
 _isCompleted = true;
 _tokenBuffer = null;
 }
 else
 {
Expand DownExpand Up@@ -335,13 +346,11 @@ internal int Encrypt(ReadOnlySpan<byte> buffer, [NotNull] ref byte[]? output, ui
 sequenceNumber);
 }

 internal int Decrypt(byte[] payload, int offset, int count, out int newOffset, uint expectedSeqNumber)
 internal int Decrypt(Span<byte> payload, out int newOffset, uint expectedSeqNumber)
 {
 return NegotiateStreamPal.Decrypt(
 _securityContext!,
 payload,
 offset,
 count,
 (_contextFlags & ContextFlagsPal.Confidentiality) != 0,
 IsNTLM,
 out newOffset,
Expand Down
Loading