NegotiateAuthentication: Implement additional API surface - #71777

Merged
wfurt merged 2 commits into
dotnet:mainfrom
filipnavara:negotiate-wrap-api2
Jul 11, 2022
Merged

NegotiateAuthentication: Implement additional API surface#71777
wfurt merged 2 commits into
dotnet:mainfrom
filipnavara:negotiate-wrap-api2

Conversation

@filipnavara

@filipnavarafilipnavara commented Jul 7, 2022•
edited
Loading

Copy link
Copy Markdown
Member
  • Implemented NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
  • Updated unit tests
  • Migrated System.Net.Mail to use NegotiateAuthentication API
  • Implementation of extended protection policy and impersonation APIs (no uses yet)

Best reviewed commit by commit.

Fixes#70909

@ghostghost added area-System.Net new-api-needs-documentation community-contribution Indicates that the PR has been added by a community member labels Jul 7, 2022
@ghost

ghost commented Jul 7, 2022

Copy link
Copy Markdown

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

@filipnavara
filipnavara requested a review from wfurtJuly 7, 2022 18:28
@ghost

ghost commented Jul 7, 2022

Copy link
Copy Markdown

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API

Contributes to #70909

Author:filipnavara
Assignees:-
Labels:

area-System.Net, new-api-needs-documentation, community-contribution

Milestone:-

@filipnavarafilipnavara changed the title Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIsNegotiateAuthentication: Implement additional API surfaceJul 7, 2022
@filipnavara
filipnavara marked this pull request as ready for review July 7, 2022 20:11
@filipnavara
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
e3260f2
Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API
@filipnavara
Implementation of extended protection policy and impersonation in Neg…
fed4d67
…otiateAuthentication
@filipnavara

filipnavara commented Jul 11, 2022

Copy link
Copy Markdown
MemberAuthor

Rebased to resolve conflicts.

wfurt
wfurt reviewed Jul 11, 2022
View reviewed changes
Comment threadsrc/libraries/System.Net.Mail/src/System/Net/Mail/SmtpNegotiateAuthenticationModule.cs
// is negotiated.
if (OperatingSystem.IsLinux())
{
protectionLevel = ProtectionLevel.EncryptAndSign;

@wfurtwfurtJul 11, 2022•
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there harm of doing it also on Windows/macOS?

@filipnavarafilipnavaraJul 11, 2022

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(FWIW: this is not a new check in this PR, it is just re-indented existing one)

In theory it would be fine on all systems but I don't have sufficient data to confirm. The negotiated protocol can end up being either Kerberos or NTLM. If it's Kerberos on Linux/macOS we get forced confidentiality anyway. For all other scenarios it could result in unilaterally bumped security requirements from the client side. If the server is Exchange then it would work. If the server is something running on an embedded device with Cyrus SASL backend I would not be so sure that everything would still work (notably the NTLM implementation in Cyrus is not even interoperable with Windows 11 in default configuration).

@filipnavarafilipnavaraJul 11, 2022

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short version: It's mostly just being cautious.

@wfurtwfurtJul 11, 2022•
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine. I was nice to see less platform specific code through this PR and if we could avoid one more platform check I would be happy. But even with it it seems like great improvement.

wfurt
wfurt approved these changes Jul 11, 2022
View reviewed changes

@wfurtwfurt left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
thanks for big cleanup in SMTP @filipnavara

@wfurt
wfurt merged commit 26da83d into dotnet:mainJul 11, 2022
@filipnavara

filipnavara commented Jul 11, 2022

Copy link
Copy Markdown
MemberAuthor

Thanks for review! I'm very happy that we managed to get the API in at the last minute :-)

@filipnavara
filipnavara deleted the negotiate-wrap-api2 branch July 11, 2022 11:14
@karelzkarelz added this to the 7.0.0 milestone Jul 19, 2022
@ghostghost locked as resolved and limited conversation to collaborators Aug 18, 2022
@bartonjsbartonjs added cryptographic-docs-impact needs-further-triage Issue has been initially triaged, but needs deeper consideration or reconsideration labels Aug 23, 2022
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

No one assigned

Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community memberneeds-further-triageIssue has been initially triaged, but needs deeper consideration or reconsiderationnew-api-needs-documentation

Projects

None yet

Milestone

7.0.0

Development

Successfully merging this pull request may close these issues.

[API Proposal]: Add Wrap and Unwrap methods to NegotiateAuthentication API

4 participants

@filipnavara@wfurt@karelz@bartonjs
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
NegotiateAuthentication: Implement additional API surface - #71777
Merged
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Jul 11, 2022
Merged
NegotiateAuthentication: Implement additional API surface#71777
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Jul 7, 2022•

edited

Loading

Copy link


Copy Markdown

Member
  • Implemented NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
  • Updated unit tests
  • Migrated System.Net.Mail to use NegotiateAuthentication API
  • Implementation of extended protection policy and impersonation APIs (no uses yet)
Best reviewed commit by commit.
Fixes#70909
@ghostghost
added

area-System.Net

new-api-needs-documentation

community-contribution
Indicates that the PR has been added by a community member
labels
Jul 7, 2022
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Note regarding the new-api-needs-documentation label:
This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.
@filipnavara
filipnavara
requested a review
from wfurtJuly 7, 2022 18:28
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl

See info in area-owners.md if you want to be subscribed.
Issue Details
Updated unit tests

Migrate System.Net.Mail to use NegotiateAuthentication API
Contributes to #70909
Author:filipnavara
Assignees:-
Labels:
area-System.Net, new-api-needs-documentation, community-contribution
Milestone:-
@filipnavarafilipnavara
changed the title
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIsNegotiateAuthentication: Implement additional API surfaceJul 7, 2022
@filipnavara
filipnavara
marked this pull request as ready for review
July 7, 2022 20:11
@filipnavara
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
e3260f2
Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API
@filipnavara
Implementation of extended protection policy and impersonation in Neg…
fed4d67
…otiateAuthentication
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Rebased to resolve conflicts.
wfurt
wfurt
reviewed
Jul 11, 2022
View reviewed changes
Comment threadsrc/libraries/System.Net.Mail/src/System/Net/Mail/SmtpNegotiateAuthenticationModule.cs
 // is negotiated.
 if (OperatingSystem.IsLinux())
 {
 protectionLevel = ProtectionLevel.EncryptAndSign;
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there harm of doing it also on Windows/macOS?
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(FWIW: this is not a new check in this PR, it is just re-indented existing one)
In theory it would be fine on all systems but I don't have sufficient data to confirm. The negotiated protocol can end up being either Kerberos or NTLM. If it's Kerberos on Linux/macOS we get forced confidentiality anyway. For all other scenarios it could result in unilaterally bumped security requirements from the client side. If the server is Exchange then it would work. If the server is something running on an embedded device with Cyrus SASL backend I would not be so sure that everything would still work (notably the NTLM implementation in Cyrus is not even interoperable with Windows 11 in default configuration).
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short version: It's mostly just being cautious.
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine. I was nice to see less platform specific code through this PR and if we could avoid one more platform check I would be happy. But even with it it seems like great improvement.
wfurt
wfurt
approved these changes
Jul 11, 2022
View reviewed changes
@wfurtwfurt
left a comment
•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

thanks for big cleanup in SMTP @filipnavara
@wfurt
wfurt
merged commit 26da83d
into
dotnet:mainJul 11, 2022
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Thanks for review! I'm very happy that we managed to get the API in at the last minute :-)
@filipnavara
filipnavara
deleted the

negotiate-wrap-api2

branch
July 11, 2022 11:14
@karelzkarelz
added this to the 7.0.0 milestone
Jul 19, 2022
@ghostghost
locked as resolved and limited conversation to collaborators
Aug 18, 2022
@bartonjsbartonjs
added

cryptographic-docs-impact

needs-further-triage
Issue has been initially triaged, but needs deeper consideration or reconsideration
labels
Aug 23, 2022
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community memberneeds-further-triageIssue has been initially triaged, but needs deeper consideration or reconsiderationnew-api-needs-documentation

Projects


None yet


Milestone

7.0.0

Development

Successfully merging this pull request may close these issues.

[API Proposal]: Add Wrap and Unwrap methods to NegotiateAuthentication API


4 participants

@filipnavara@wfurt@karelz@bartonjs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
NegotiateAuthentication: Implement additional API surface - #71777
Merged
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Jul 11, 2022
Merged
NegotiateAuthentication: Implement additional API surface#71777
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Jul 7, 2022•

edited

Loading

Copy link


Copy Markdown

Member
  • Implemented NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
  • Updated unit tests
  • Migrated System.Net.Mail to use NegotiateAuthentication API
  • Implementation of extended protection policy and impersonation APIs (no uses yet)
Best reviewed commit by commit.
Fixes#70909
@ghostghost
added

area-System.Net

new-api-needs-documentation

community-contribution
Indicates that the PR has been added by a community member
labels
Jul 7, 2022
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Note regarding the new-api-needs-documentation label:
This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.
@filipnavara
filipnavara
requested a review
from wfurtJuly 7, 2022 18:28
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl

See info in area-owners.md if you want to be subscribed.
Issue Details
Updated unit tests

Migrate System.Net.Mail to use NegotiateAuthentication API
Contributes to #70909
Author:filipnavara
Assignees:-
Labels:
area-System.Net, new-api-needs-documentation, community-contribution
Milestone:-
@filipnavarafilipnavara
changed the title
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIsNegotiateAuthentication: Implement additional API surfaceJul 7, 2022
@filipnavara
filipnavara
marked this pull request as ready for review
July 7, 2022 20:11
@filipnavara
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
e3260f2
Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API
@filipnavara
Implementation of extended protection policy and impersonation in Neg…
fed4d67
…otiateAuthentication
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Rebased to resolve conflicts.
wfurt
wfurt
reviewed
Jul 11, 2022
View reviewed changes
Comment threadsrc/libraries/System.Net.Mail/src/System/Net/Mail/SmtpNegotiateAuthenticationModule.cs
 // is negotiated.
 if (OperatingSystem.IsLinux())
 {
 protectionLevel = ProtectionLevel.EncryptAndSign;
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there harm of doing it also on Windows/macOS?
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(FWIW: this is not a new check in this PR, it is just re-indented existing one)
In theory it would be fine on all systems but I don't have sufficient data to confirm. The negotiated protocol can end up being either Kerberos or NTLM. If it's Kerberos on Linux/macOS we get forced confidentiality anyway. For all other scenarios it could result in unilaterally bumped security requirements from the client side. If the server is Exchange then it would work. If the server is something running on an embedded device with Cyrus SASL backend I would not be so sure that everything would still work (notably the NTLM implementation in Cyrus is not even interoperable with Windows 11 in default configuration).
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short version: It's mostly just being cautious.
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine. I was nice to see less platform specific code through this PR and if we could avoid one more platform check I would be happy. But even with it it seems like great improvement.
wfurt
wfurt
approved these changes
Jul 11, 2022
View reviewed changes
@wfurtwfurt
left a comment
•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

thanks for big cleanup in SMTP @filipnavara
@wfurt
wfurt
merged commit 26da83d
into
dotnet:mainJul 11, 2022
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Thanks for review! I'm very happy that we managed to get the API in at the last minute :-)
@filipnavara
filipnavara
deleted the

negotiate-wrap-api2

branch
July 11, 2022 11:14
@karelzkarelz
added this to the 7.0.0 milestone
Jul 19, 2022
@ghostghost
locked as resolved and limited conversation to collaborators
Aug 18, 2022
@bartonjsbartonjs
added

cryptographic-docs-impact

needs-further-triage
Issue has been initially triaged, but needs deeper consideration or reconsideration
labels
Aug 23, 2022
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community memberneeds-further-triageIssue has been initially triaged, but needs deeper consideration or reconsiderationnew-api-needs-documentation

Projects


None yet


Milestone

7.0.0

Development

Successfully merging this pull request may close these issues.

[API Proposal]: Add Wrap and Unwrap methods to NegotiateAuthentication API


4 participants

@filipnavara@wfurt@karelz@bartonjs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
NegotiateAuthentication: Implement additional API surface - #71777
Merged
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Jul 11, 2022
Merged
NegotiateAuthentication: Implement additional API surface#71777
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Jul 7, 2022•

edited

Loading

Copy link


Copy Markdown

Member
  • Implemented NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
  • Updated unit tests
  • Migrated System.Net.Mail to use NegotiateAuthentication API
  • Implementation of extended protection policy and impersonation APIs (no uses yet)
Best reviewed commit by commit.
Fixes#70909
@ghostghost
added

area-System.Net

new-api-needs-documentation

community-contribution
Indicates that the PR has been added by a community member
labels
Jul 7, 2022
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Note regarding the new-api-needs-documentation label:
This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.
@filipnavara
filipnavara
requested a review
from wfurtJuly 7, 2022 18:28
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl

See info in area-owners.md if you want to be subscribed.
Issue Details
Updated unit tests

Migrate System.Net.Mail to use NegotiateAuthentication API
Contributes to #70909
Author:filipnavara
Assignees:-
Labels:
area-System.Net, new-api-needs-documentation, community-contribution
Milestone:-
@filipnavarafilipnavara
changed the title
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIsNegotiateAuthentication: Implement additional API surfaceJul 7, 2022
@filipnavara
filipnavara
marked this pull request as ready for review
July 7, 2022 20:11
@filipnavara
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
e3260f2
Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API
@filipnavara
Implementation of extended protection policy and impersonation in Neg…
fed4d67
…otiateAuthentication
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Rebased to resolve conflicts.
wfurt
wfurt
reviewed
Jul 11, 2022
View reviewed changes
Comment threadsrc/libraries/System.Net.Mail/src/System/Net/Mail/SmtpNegotiateAuthenticationModule.cs
 // is negotiated.
 if (OperatingSystem.IsLinux())
 {
 protectionLevel = ProtectionLevel.EncryptAndSign;
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there harm of doing it also on Windows/macOS?
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(FWIW: this is not a new check in this PR, it is just re-indented existing one)
In theory it would be fine on all systems but I don't have sufficient data to confirm. The negotiated protocol can end up being either Kerberos or NTLM. If it's Kerberos on Linux/macOS we get forced confidentiality anyway. For all other scenarios it could result in unilaterally bumped security requirements from the client side. If the server is Exchange then it would work. If the server is something running on an embedded device with Cyrus SASL backend I would not be so sure that everything would still work (notably the NTLM implementation in Cyrus is not even interoperable with Windows 11 in default configuration).
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short version: It's mostly just being cautious.
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine. I was nice to see less platform specific code through this PR and if we could avoid one more platform check I would be happy. But even with it it seems like great improvement.
wfurt
wfurt
approved these changes
Jul 11, 2022
View reviewed changes
@wfurtwfurt
left a comment
•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

thanks for big cleanup in SMTP @filipnavara
@wfurt
wfurt
merged commit 26da83d
into
dotnet:mainJul 11, 2022
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Thanks for review! I'm very happy that we managed to get the API in at the last minute :-)
@filipnavara
filipnavara
deleted the

negotiate-wrap-api2

branch
July 11, 2022 11:14
@karelzkarelz
added this to the 7.0.0 milestone
Jul 19, 2022
@ghostghost
locked as resolved and limited conversation to collaborators
Aug 18, 2022
@bartonjsbartonjs
added

cryptographic-docs-impact

needs-further-triage
Issue has been initially triaged, but needs deeper consideration or reconsideration
labels
Aug 23, 2022
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community memberneeds-further-triageIssue has been initially triaged, but needs deeper consideration or reconsiderationnew-api-needs-documentation

Projects


None yet


Milestone

7.0.0

Development

Successfully merging this pull request may close these issues.

[API Proposal]: Add Wrap and Unwrap methods to NegotiateAuthentication API


4 participants

@filipnavara@wfurt@karelz@bartonjs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
NegotiateAuthentication: Implement additional API surface - #71777
Merged
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Jul 11, 2022
Merged
NegotiateAuthentication: Implement additional API surface#71777
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Jul 7, 2022•

edited

Loading

Copy link


Copy Markdown

Member
  • Implemented NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
  • Updated unit tests
  • Migrated System.Net.Mail to use NegotiateAuthentication API
  • Implementation of extended protection policy and impersonation APIs (no uses yet)
Best reviewed commit by commit.
Fixes#70909
@ghostghost
added

area-System.Net

new-api-needs-documentation

community-contribution
Indicates that the PR has been added by a community member
labels
Jul 7, 2022
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Note regarding the new-api-needs-documentation label:
This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.
@filipnavara
filipnavara
requested a review
from wfurtJuly 7, 2022 18:28
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl

See info in area-owners.md if you want to be subscribed.
Issue Details
Updated unit tests

Migrate System.Net.Mail to use NegotiateAuthentication API
Contributes to #70909
Author:filipnavara
Assignees:-
Labels:
area-System.Net, new-api-needs-documentation, community-contribution
Milestone:-
@filipnavarafilipnavara
changed the title
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIsNegotiateAuthentication: Implement additional API surfaceJul 7, 2022
@filipnavara
filipnavara
marked this pull request as ready for review
July 7, 2022 20:11
@filipnavara
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
e3260f2
Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API
@filipnavara
Implementation of extended protection policy and impersonation in Neg…
fed4d67
…otiateAuthentication
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Rebased to resolve conflicts.
wfurt
wfurt
reviewed
Jul 11, 2022
View reviewed changes
Comment threadsrc/libraries/System.Net.Mail/src/System/Net/Mail/SmtpNegotiateAuthenticationModule.cs
 // is negotiated.
 if (OperatingSystem.IsLinux())
 {
 protectionLevel = ProtectionLevel.EncryptAndSign;
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there harm of doing it also on Windows/macOS?
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(FWIW: this is not a new check in this PR, it is just re-indented existing one)
In theory it would be fine on all systems but I don't have sufficient data to confirm. The negotiated protocol can end up being either Kerberos or NTLM. If it's Kerberos on Linux/macOS we get forced confidentiality anyway. For all other scenarios it could result in unilaterally bumped security requirements from the client side. If the server is Exchange then it would work. If the server is something running on an embedded device with Cyrus SASL backend I would not be so sure that everything would still work (notably the NTLM implementation in Cyrus is not even interoperable with Windows 11 in default configuration).
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short version: It's mostly just being cautious.
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine. I was nice to see less platform specific code through this PR and if we could avoid one more platform check I would be happy. But even with it it seems like great improvement.
wfurt
wfurt
approved these changes
Jul 11, 2022
View reviewed changes
@wfurtwfurt
left a comment
•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

thanks for big cleanup in SMTP @filipnavara
@wfurt
wfurt
merged commit 26da83d
into
dotnet:mainJul 11, 2022
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Thanks for review! I'm very happy that we managed to get the API in at the last minute :-)
@filipnavara
filipnavara
deleted the

negotiate-wrap-api2

branch
July 11, 2022 11:14
@karelzkarelz
added this to the 7.0.0 milestone
Jul 19, 2022
@ghostghost
locked as resolved and limited conversation to collaborators
Aug 18, 2022
@bartonjsbartonjs
added

cryptographic-docs-impact

needs-further-triage
Issue has been initially triaged, but needs deeper consideration or reconsideration
labels
Aug 23, 2022
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community memberneeds-further-triageIssue has been initially triaged, but needs deeper consideration or reconsiderationnew-api-needs-documentation

Projects


None yet


Milestone

7.0.0

Development

Successfully merging this pull request may close these issues.

[API Proposal]: Add Wrap and Unwrap methods to NegotiateAuthentication API


4 participants

@filipnavara@wfurt@karelz@bartonjs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
NegotiateAuthentication: Implement additional API surface - #71777
Merged
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Jul 11, 2022
Merged
NegotiateAuthentication: Implement additional API surface#71777
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Jul 7, 2022•

edited

Loading

Copy link


Copy Markdown

Member
  • Implemented NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
  • Updated unit tests
  • Migrated System.Net.Mail to use NegotiateAuthentication API
  • Implementation of extended protection policy and impersonation APIs (no uses yet)
Best reviewed commit by commit.
Fixes#70909
@ghostghost
added

area-System.Net

new-api-needs-documentation

community-contribution
Indicates that the PR has been added by a community member
labels
Jul 7, 2022
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Note regarding the new-api-needs-documentation label:
This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.
@filipnavara
filipnavara
requested a review
from wfurtJuly 7, 2022 18:28
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl

See info in area-owners.md if you want to be subscribed.
Issue Details
Updated unit tests

Migrate System.Net.Mail to use NegotiateAuthentication API
Contributes to #70909
Author:filipnavara
Assignees:-
Labels:
area-System.Net, new-api-needs-documentation, community-contribution
Milestone:-
@filipnavarafilipnavara
changed the title
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIsNegotiateAuthentication: Implement additional API surfaceJul 7, 2022
@filipnavara
filipnavara
marked this pull request as ready for review
July 7, 2022 20:11
@filipnavara
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
e3260f2
Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API
@filipnavara
Implementation of extended protection policy and impersonation in Neg…
fed4d67
…otiateAuthentication
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Rebased to resolve conflicts.
wfurt
wfurt
reviewed
Jul 11, 2022
View reviewed changes
Comment threadsrc/libraries/System.Net.Mail/src/System/Net/Mail/SmtpNegotiateAuthenticationModule.cs
 // is negotiated.
 if (OperatingSystem.IsLinux())
 {
 protectionLevel = ProtectionLevel.EncryptAndSign;
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there harm of doing it also on Windows/macOS?
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(FWIW: this is not a new check in this PR, it is just re-indented existing one)
In theory it would be fine on all systems but I don't have sufficient data to confirm. The negotiated protocol can end up being either Kerberos or NTLM. If it's Kerberos on Linux/macOS we get forced confidentiality anyway. For all other scenarios it could result in unilaterally bumped security requirements from the client side. If the server is Exchange then it would work. If the server is something running on an embedded device with Cyrus SASL backend I would not be so sure that everything would still work (notably the NTLM implementation in Cyrus is not even interoperable with Windows 11 in default configuration).
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short version: It's mostly just being cautious.
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine. I was nice to see less platform specific code through this PR and if we could avoid one more platform check I would be happy. But even with it it seems like great improvement.
wfurt
wfurt
approved these changes
Jul 11, 2022
View reviewed changes
@wfurtwfurt
left a comment
•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

thanks for big cleanup in SMTP @filipnavara
@wfurt
wfurt
merged commit 26da83d
into
dotnet:mainJul 11, 2022
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Thanks for review! I'm very happy that we managed to get the API in at the last minute :-)
@filipnavara
filipnavara
deleted the

negotiate-wrap-api2

branch
July 11, 2022 11:14
@karelzkarelz
added this to the 7.0.0 milestone
Jul 19, 2022
@ghostghost
locked as resolved and limited conversation to collaborators
Aug 18, 2022
@bartonjsbartonjs
added

cryptographic-docs-impact

needs-further-triage
Issue has been initially triaged, but needs deeper consideration or reconsideration
labels
Aug 23, 2022
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community memberneeds-further-triageIssue has been initially triaged, but needs deeper consideration or reconsiderationnew-api-needs-documentation

Projects


None yet


Milestone

7.0.0

Development

Successfully merging this pull request may close these issues.

[API Proposal]: Add Wrap and Unwrap methods to NegotiateAuthentication API


4 participants

@filipnavara@wfurt@karelz@bartonjs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
NegotiateAuthentication: Implement additional API surface - #71777
Merged
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Jul 11, 2022
Merged
NegotiateAuthentication: Implement additional API surface#71777
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Jul 7, 2022•

edited

Loading

Copy link


Copy Markdown

Member
  • Implemented NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
  • Updated unit tests
  • Migrated System.Net.Mail to use NegotiateAuthentication API
  • Implementation of extended protection policy and impersonation APIs (no uses yet)
Best reviewed commit by commit.
Fixes#70909
@ghostghost
added

area-System.Net

new-api-needs-documentation

community-contribution
Indicates that the PR has been added by a community member
labels
Jul 7, 2022
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Note regarding the new-api-needs-documentation label:
This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.
@filipnavara
filipnavara
requested a review
from wfurtJuly 7, 2022 18:28
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl

See info in area-owners.md if you want to be subscribed.
Issue Details
Updated unit tests

Migrate System.Net.Mail to use NegotiateAuthentication API
Contributes to #70909
Author:filipnavara
Assignees:-
Labels:
area-System.Net, new-api-needs-documentation, community-contribution
Milestone:-
@filipnavarafilipnavara
changed the title
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIsNegotiateAuthentication: Implement additional API surfaceJul 7, 2022
@filipnavara
filipnavara
marked this pull request as ready for review
July 7, 2022 20:11
@filipnavara
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
e3260f2
Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API
@filipnavara
Implementation of extended protection policy and impersonation in Neg…
fed4d67
…otiateAuthentication
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Rebased to resolve conflicts.
wfurt
wfurt
reviewed
Jul 11, 2022
View reviewed changes
Comment threadsrc/libraries/System.Net.Mail/src/System/Net/Mail/SmtpNegotiateAuthenticationModule.cs
 // is negotiated.
 if (OperatingSystem.IsLinux())
 {
 protectionLevel = ProtectionLevel.EncryptAndSign;
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there harm of doing it also on Windows/macOS?
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(FWIW: this is not a new check in this PR, it is just re-indented existing one)
In theory it would be fine on all systems but I don't have sufficient data to confirm. The negotiated protocol can end up being either Kerberos or NTLM. If it's Kerberos on Linux/macOS we get forced confidentiality anyway. For all other scenarios it could result in unilaterally bumped security requirements from the client side. If the server is Exchange then it would work. If the server is something running on an embedded device with Cyrus SASL backend I would not be so sure that everything would still work (notably the NTLM implementation in Cyrus is not even interoperable with Windows 11 in default configuration).
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short version: It's mostly just being cautious.
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine. I was nice to see less platform specific code through this PR and if we could avoid one more platform check I would be happy. But even with it it seems like great improvement.
wfurt
wfurt
approved these changes
Jul 11, 2022
View reviewed changes
@wfurtwfurt
left a comment
•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

thanks for big cleanup in SMTP @filipnavara
@wfurt
wfurt
merged commit 26da83d
into
dotnet:mainJul 11, 2022
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Thanks for review! I'm very happy that we managed to get the API in at the last minute :-)
@filipnavara
filipnavara
deleted the

negotiate-wrap-api2

branch
July 11, 2022 11:14
@karelzkarelz
added this to the 7.0.0 milestone
Jul 19, 2022
@ghostghost
locked as resolved and limited conversation to collaborators
Aug 18, 2022
@bartonjsbartonjs
added

cryptographic-docs-impact

needs-further-triage
Issue has been initially triaged, but needs deeper consideration or reconsideration
labels
Aug 23, 2022
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community memberneeds-further-triageIssue has been initially triaged, but needs deeper consideration or reconsiderationnew-api-needs-documentation

Projects


None yet


Milestone

7.0.0

Development

Successfully merging this pull request may close these issues.

[API Proposal]: Add Wrap and Unwrap methods to NegotiateAuthentication API


4 participants

@filipnavara@wfurt@karelz@bartonjs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
NegotiateAuthentication: Implement additional API surface - #71777
Merged
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Jul 11, 2022
Merged
NegotiateAuthentication: Implement additional API surface#71777
wfurt merged 2 commits into
dotnet:mainfrom 
filipnavara:negotiate-wrap-api2
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Jul 7, 2022•

edited

Loading

Copy link


Copy Markdown

Member
  • Implemented NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
  • Updated unit tests
  • Migrated System.Net.Mail to use NegotiateAuthentication API
  • Implementation of extended protection policy and impersonation APIs (no uses yet)
Best reviewed commit by commit.
Fixes#70909
@ghostghost
added

area-System.Net

new-api-needs-documentation

community-contribution
Indicates that the PR has been added by a community member
labels
Jul 7, 2022
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Note regarding the new-api-needs-documentation label:
This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.
@filipnavara
filipnavara
requested a review
from wfurtJuly 7, 2022 18:28
@ghost
ghost
commented
Jul 7, 2022

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl

See info in area-owners.md if you want to be subscribed.
Issue Details
Updated unit tests

Migrate System.Net.Mail to use NegotiateAuthentication API
Contributes to #70909
Author:filipnavara
Assignees:-
Labels:
area-System.Net, new-api-needs-documentation, community-contribution
Milestone:-
@filipnavarafilipnavara
changed the title
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIsNegotiateAuthentication: Implement additional API surfaceJul 7, 2022
@filipnavara
filipnavara
marked this pull request as ready for review
July 7, 2022 20:11
@filipnavara
Implement NegotiateAuthentication.Wrap/Unwrap/UnwrapInPlace APIs
e3260f2
Updated unit tests
Migrate System.Net.Mail to use NegotiateAuthentication API
@filipnavara
Implementation of extended protection policy and impersonation in Neg…
fed4d67
…otiateAuthentication
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Rebased to resolve conflicts.
wfurt
wfurt
reviewed
Jul 11, 2022
View reviewed changes
Comment threadsrc/libraries/System.Net.Mail/src/System/Net/Mail/SmtpNegotiateAuthenticationModule.cs
 // is negotiated.
 if (OperatingSystem.IsLinux())
 {
 protectionLevel = ProtectionLevel.EncryptAndSign;
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there harm of doing it also on Windows/macOS?
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(FWIW: this is not a new check in this PR, it is just re-indented existing one)
In theory it would be fine on all systems but I don't have sufficient data to confirm. The negotiated protocol can end up being either Kerberos or NTLM. If it's Kerberos on Linux/macOS we get forced confidentiality anyway. For all other scenarios it could result in unilaterally bumped security requirements from the client side. If the server is Exchange then it would work. If the server is something running on an embedded device with Cyrus SASL backend I would not be so sure that everything would still work (notably the NTLM implementation in Cyrus is not even interoperable with Windows 11 in default configuration).
@filipnavarafilipnavaraJul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short version: It's mostly just being cautious.
@wfurtwfurtJul 11, 2022•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine. I was nice to see less platform specific code through this PR and if we could avoid one more platform check I would be happy. But even with it it seems like great improvement.
wfurt
wfurt
approved these changes
Jul 11, 2022
View reviewed changes
@wfurtwfurt
left a comment
•

edited

Loading

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

thanks for big cleanup in SMTP @filipnavara
@wfurt
wfurt
merged commit 26da83d
into
dotnet:mainJul 11, 2022
@filipnavara
filipnavara
commented
Jul 11, 2022

Copy link


Copy Markdown

MemberAuthor
Thanks for review! I'm very happy that we managed to get the API in at the last minute :-)
@filipnavara
filipnavara
deleted the

negotiate-wrap-api2

branch
July 11, 2022 11:14
@karelzkarelz
added this to the 7.0.0 milestone
Jul 19, 2022
@ghostghost
locked as resolved and limited conversation to collaborators
Aug 18, 2022
@bartonjsbartonjs
added

cryptographic-docs-impact

needs-further-triage
Issue has been initially triaged, but needs deeper consideration or reconsideration
labels
Aug 23, 2022
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community memberneeds-further-triageIssue has been initially triaged, but needs deeper consideration or reconsiderationnew-api-needs-documentation

Projects


None yet


Milestone

7.0.0

Development

Successfully merging this pull request may close these issues.

[API Proposal]: Add Wrap and Unwrap methods to NegotiateAuthentication API


4 participants

@filipnavara@wfurt@karelz@bartonjs