[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC - #98031

Merged
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom
filipnavara:getmic-backport
Feb 12, 2024
Merged

[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC#98031
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom
filipnavara:getmic-backport

Conversation

@filipnavara

@filipnavarafilipnavara commented Feb 6, 2024•
edited by karelz
Loading

Copy link
Copy Markdown
Member

Partial backport of PR #96712.

Fixes#97942.

Customer Impact

  • Customer reported
  • Found internally

The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.

Regression

  • Yes
  • No

Regression was introduced with PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.

Testing

Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.

Specific changes in this PR have also been tested against the repro provided in #97942.

Risk

Low

The error is well understood, and the fix was already done in main branch last month. .NET 8 exposed this implementation detail only through the NegotiateStream API in a specific combination of parameters.

@ghostghost added area-System.Net.Security community-contribution Indicates that the PR has been added by a community member labels Feb 6, 2024
@ghost

ghost commented Feb 6, 2024

Copy link
Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

Fixes #97942.

Customer Impact

  • Customer reported
  • Found internally

The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.

Regression

  • Yes
  • No

Regression was introduced in PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.

Testing

Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.

Risk

Low

The error is well understood, and the fix was already done in main branch last month.

Author:filipnavara
Assignees:-
Labels:

area-System.Net.Security

Milestone:-

@rzikm
rzikm requested a review from wfurtFebruary 6, 2024 12:35
rzikm
rzikm approved these changes Feb 6, 2024
View reviewed changes

@rzikmrzikm left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@build-analysisbuild-analysisBot mentioned this pull request Feb 6, 2024
Open
3 tasks
@filipnavarafilipnavara added the Servicing-consider Issue for next servicing release review label Feb 6, 2024
@akoeplingerakoeplinger added this to the 8.0.x milestone Feb 7, 2024
@danmoseley

danmoseley commented Feb 8, 2024

Copy link
Copy Markdown
Contributor

please get approval by mail for this one

@carlossanlop

carlossanlop commented Feb 8, 2024

Copy link
Copy Markdown
Contributor

Friendly reminder that Monday February 12th is the Code Complete deadline for the March Release.

@rzikmrzikm changed the title [release/8.0-staging] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMICFeb 9, 2024
@rzikmrzikm self-assigned this Feb 9, 2024
@stephentoub

stephentoub commented Feb 9, 2024

Copy link
Copy Markdown
Member

We don't want to backport the tests as well?

@filipnavara

filipnavara commented Feb 9, 2024

Copy link
Copy Markdown
MemberAuthor

We don't want to backport the tests as well?

The tests use new public API that was introduced in .NET 9. It makes it rather non-trivial to port them.

@rzikm

rzikm commented Feb 12, 2024

Copy link
Copy Markdown
Member

Approved via email

@rzikmrzikm added Servicing-approved Approved for servicing release and removed Servicing-consider Issue for next servicing release review labels Feb 12, 2024
@rzikm

rzikm commented Feb 12, 2024

Copy link
Copy Markdown
Member

Ci is green

@rzikm
rzikm merged commit 2190e9b into dotnet:release/8.0-stagingFeb 12, 2024
@filipnavara

filipnavara commented Feb 12, 2024

Copy link
Copy Markdown
MemberAuthor

Thanks for taking care of it!

@github-actionsgithub-actionsBot locked and limited conversation to collaborators Mar 13, 2024
@karelzkarelz modified the milestones: 8.0.x, 8.0.3Jun 25, 2024
@filipnavara
filipnavara deleted the getmic-backport branch June 5, 2025 07:34
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@wfurtwfurtwfurt approved these changes
@rzikmrzikmrzikm approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Securitycommunity-contributionIndicates that the PR has been added by a community memberServicing-approvedApproved for servicing release

Projects

None yet

Milestone

8.0.3

Development

Successfully merging this pull request may close these issues.

8 participants

@filipnavara@danmoseley@carlossanlop@stephentoub@rzikm@wfurt@akoeplinger@karelz
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC - #98031
Merged
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Feb 12, 2024
Merged
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC#98031
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Feb 6, 2024•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Partial backport of PR #96712.
Fixes#97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced with PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Specific changes in this PR have also been tested against the repro provided in #97942.
Risk
Low
The error is well understood, and the fix was already done in main branch last month. .NET 8 exposed this implementation detail only through the NegotiateStream API in a specific combination of parameters.
@ghostghost
added

area-System.Net.Security

community-contribution
Indicates that the PR has been added by a community member
labels
Feb 6, 2024
@ghost
ghost
commented
Feb 6, 2024

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced in PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Risk
Low
The error is well understood, and the fix was already done in main branch last month.
Author:filipnavara
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtFebruary 6, 2024 12:35
rzikm
rzikm
approved these changes
Feb 6, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Feb 6, 2024

Open

3 tasks
@filipnavarafilipnavara
added
the 
Servicing-consider
Issue for next servicing release review
label
Feb 6, 2024
@akoeplingerakoeplinger
added this to the 8.0.x milestone
Feb 7, 2024
@danmoseley
danmoseley
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
please get approval by mail for this one
@carlossanlop
carlossanlop
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
Friendly reminder that Monday February 12th is the Code Complete deadline for the March Release.
@rzikmrzikm
changed the title
[release/8.0-staging] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMICFeb 9, 2024
@rzikmrzikm
self-assigned this
Feb 9, 2024
@stephentoub
stephentoub
commented
Feb 9, 2024

Copy link


Copy Markdown

Member
We don't want to backport the tests as well?
@filipnavara
filipnavara
commented
Feb 9, 2024

Copy link


Copy Markdown

MemberAuthor
We don't want to backport the tests as well?
The tests use new public API that was introduced in .NET 9. It makes it rather non-trivial to port them.
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Approved via email
@rzikmrzikm
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Feb 12, 2024
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Ci is green
@rzikm
rzikm
merged commit 2190e9b
into
dotnet:release/8.0-stagingFeb 12, 2024
@filipnavara
filipnavara
commented
Feb 12, 2024

Copy link


Copy Markdown

MemberAuthor
Thanks for taking care of it!
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Mar 13, 2024
@karelzkarelz
modified the milestones:
8.0.x, 8.0.3Jun 25, 2024
@filipnavara
filipnavara
deleted the

getmic-backport

branch
June 5, 2025 07:34
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes
@rzikmrzikmrzikm approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Securitycommunity-contributionIndicates that the PR has been added by a community memberServicing-approvedApproved for servicing release

Projects


None yet


Milestone

8.0.3

Development

Successfully merging this pull request may close these issues.

8 participants

@filipnavara@danmoseley@carlossanlop@stephentoub@rzikm@wfurt@akoeplinger@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC - #98031
Merged
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Feb 12, 2024
Merged
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC#98031
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Feb 6, 2024•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Partial backport of PR #96712.
Fixes#97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced with PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Specific changes in this PR have also been tested against the repro provided in #97942.
Risk
Low
The error is well understood, and the fix was already done in main branch last month. .NET 8 exposed this implementation detail only through the NegotiateStream API in a specific combination of parameters.
@ghostghost
added

area-System.Net.Security

community-contribution
Indicates that the PR has been added by a community member
labels
Feb 6, 2024
@ghost
ghost
commented
Feb 6, 2024

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced in PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Risk
Low
The error is well understood, and the fix was already done in main branch last month.
Author:filipnavara
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtFebruary 6, 2024 12:35
rzikm
rzikm
approved these changes
Feb 6, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Feb 6, 2024

Open

3 tasks
@filipnavarafilipnavara
added
the 
Servicing-consider
Issue for next servicing release review
label
Feb 6, 2024
@akoeplingerakoeplinger
added this to the 8.0.x milestone
Feb 7, 2024
@danmoseley
danmoseley
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
please get approval by mail for this one
@carlossanlop
carlossanlop
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
Friendly reminder that Monday February 12th is the Code Complete deadline for the March Release.
@rzikmrzikm
changed the title
[release/8.0-staging] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMICFeb 9, 2024
@rzikmrzikm
self-assigned this
Feb 9, 2024
@stephentoub
stephentoub
commented
Feb 9, 2024

Copy link


Copy Markdown

Member
We don't want to backport the tests as well?
@filipnavara
filipnavara
commented
Feb 9, 2024

Copy link


Copy Markdown

MemberAuthor
We don't want to backport the tests as well?
The tests use new public API that was introduced in .NET 9. It makes it rather non-trivial to port them.
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Approved via email
@rzikmrzikm
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Feb 12, 2024
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Ci is green
@rzikm
rzikm
merged commit 2190e9b
into
dotnet:release/8.0-stagingFeb 12, 2024
@filipnavara
filipnavara
commented
Feb 12, 2024

Copy link


Copy Markdown

MemberAuthor
Thanks for taking care of it!
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Mar 13, 2024
@karelzkarelz
modified the milestones:
8.0.x, 8.0.3Jun 25, 2024
@filipnavara
filipnavara
deleted the

getmic-backport

branch
June 5, 2025 07:34
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes
@rzikmrzikmrzikm approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Securitycommunity-contributionIndicates that the PR has been added by a community memberServicing-approvedApproved for servicing release

Projects


None yet


Milestone

8.0.3

Development

Successfully merging this pull request may close these issues.

8 participants

@filipnavara@danmoseley@carlossanlop@stephentoub@rzikm@wfurt@akoeplinger@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC - #98031
Merged
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Feb 12, 2024
Merged
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC#98031
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Feb 6, 2024•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Partial backport of PR #96712.
Fixes#97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced with PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Specific changes in this PR have also been tested against the repro provided in #97942.
Risk
Low
The error is well understood, and the fix was already done in main branch last month. .NET 8 exposed this implementation detail only through the NegotiateStream API in a specific combination of parameters.
@ghostghost
added

area-System.Net.Security

community-contribution
Indicates that the PR has been added by a community member
labels
Feb 6, 2024
@ghost
ghost
commented
Feb 6, 2024

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced in PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Risk
Low
The error is well understood, and the fix was already done in main branch last month.
Author:filipnavara
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtFebruary 6, 2024 12:35
rzikm
rzikm
approved these changes
Feb 6, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Feb 6, 2024

Open

3 tasks
@filipnavarafilipnavara
added
the 
Servicing-consider
Issue for next servicing release review
label
Feb 6, 2024
@akoeplingerakoeplinger
added this to the 8.0.x milestone
Feb 7, 2024
@danmoseley
danmoseley
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
please get approval by mail for this one
@carlossanlop
carlossanlop
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
Friendly reminder that Monday February 12th is the Code Complete deadline for the March Release.
@rzikmrzikm
changed the title
[release/8.0-staging] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMICFeb 9, 2024
@rzikmrzikm
self-assigned this
Feb 9, 2024
@stephentoub
stephentoub
commented
Feb 9, 2024

Copy link


Copy Markdown

Member
We don't want to backport the tests as well?
@filipnavara
filipnavara
commented
Feb 9, 2024

Copy link


Copy Markdown

MemberAuthor
We don't want to backport the tests as well?
The tests use new public API that was introduced in .NET 9. It makes it rather non-trivial to port them.
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Approved via email
@rzikmrzikm
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Feb 12, 2024
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Ci is green
@rzikm
rzikm
merged commit 2190e9b
into
dotnet:release/8.0-stagingFeb 12, 2024
@filipnavara
filipnavara
commented
Feb 12, 2024

Copy link


Copy Markdown

MemberAuthor
Thanks for taking care of it!
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Mar 13, 2024
@karelzkarelz
modified the milestones:
8.0.x, 8.0.3Jun 25, 2024
@filipnavara
filipnavara
deleted the

getmic-backport

branch
June 5, 2025 07:34
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes
@rzikmrzikmrzikm approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Securitycommunity-contributionIndicates that the PR has been added by a community memberServicing-approvedApproved for servicing release

Projects


None yet


Milestone

8.0.3

Development

Successfully merging this pull request may close these issues.

8 participants

@filipnavara@danmoseley@carlossanlop@stephentoub@rzikm@wfurt@akoeplinger@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC - #98031
Merged
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Feb 12, 2024
Merged
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC#98031
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Feb 6, 2024•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Partial backport of PR #96712.
Fixes#97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced with PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Specific changes in this PR have also been tested against the repro provided in #97942.
Risk
Low
The error is well understood, and the fix was already done in main branch last month. .NET 8 exposed this implementation detail only through the NegotiateStream API in a specific combination of parameters.
@ghostghost
added

area-System.Net.Security

community-contribution
Indicates that the PR has been added by a community member
labels
Feb 6, 2024
@ghost
ghost
commented
Feb 6, 2024

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced in PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Risk
Low
The error is well understood, and the fix was already done in main branch last month.
Author:filipnavara
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtFebruary 6, 2024 12:35
rzikm
rzikm
approved these changes
Feb 6, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Feb 6, 2024

Open

3 tasks
@filipnavarafilipnavara
added
the 
Servicing-consider
Issue for next servicing release review
label
Feb 6, 2024
@akoeplingerakoeplinger
added this to the 8.0.x milestone
Feb 7, 2024
@danmoseley
danmoseley
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
please get approval by mail for this one
@carlossanlop
carlossanlop
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
Friendly reminder that Monday February 12th is the Code Complete deadline for the March Release.
@rzikmrzikm
changed the title
[release/8.0-staging] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMICFeb 9, 2024
@rzikmrzikm
self-assigned this
Feb 9, 2024
@stephentoub
stephentoub
commented
Feb 9, 2024

Copy link


Copy Markdown

Member
We don't want to backport the tests as well?
@filipnavara
filipnavara
commented
Feb 9, 2024

Copy link


Copy Markdown

MemberAuthor
We don't want to backport the tests as well?
The tests use new public API that was introduced in .NET 9. It makes it rather non-trivial to port them.
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Approved via email
@rzikmrzikm
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Feb 12, 2024
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Ci is green
@rzikm
rzikm
merged commit 2190e9b
into
dotnet:release/8.0-stagingFeb 12, 2024
@filipnavara
filipnavara
commented
Feb 12, 2024

Copy link


Copy Markdown

MemberAuthor
Thanks for taking care of it!
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Mar 13, 2024
@karelzkarelz
modified the milestones:
8.0.x, 8.0.3Jun 25, 2024
@filipnavara
filipnavara
deleted the

getmic-backport

branch
June 5, 2025 07:34
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes
@rzikmrzikmrzikm approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Securitycommunity-contributionIndicates that the PR has been added by a community memberServicing-approvedApproved for servicing release

Projects


None yet


Milestone

8.0.3

Development

Successfully merging this pull request may close these issues.

8 participants

@filipnavara@danmoseley@carlossanlop@stephentoub@rzikm@wfurt@akoeplinger@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC - #98031
Merged
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Feb 12, 2024
Merged
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC#98031
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Feb 6, 2024•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Partial backport of PR #96712.
Fixes#97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced with PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Specific changes in this PR have also been tested against the repro provided in #97942.
Risk
Low
The error is well understood, and the fix was already done in main branch last month. .NET 8 exposed this implementation detail only through the NegotiateStream API in a specific combination of parameters.
@ghostghost
added

area-System.Net.Security

community-contribution
Indicates that the PR has been added by a community member
labels
Feb 6, 2024
@ghost
ghost
commented
Feb 6, 2024

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced in PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Risk
Low
The error is well understood, and the fix was already done in main branch last month.
Author:filipnavara
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtFebruary 6, 2024 12:35
rzikm
rzikm
approved these changes
Feb 6, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Feb 6, 2024

Open

3 tasks
@filipnavarafilipnavara
added
the 
Servicing-consider
Issue for next servicing release review
label
Feb 6, 2024
@akoeplingerakoeplinger
added this to the 8.0.x milestone
Feb 7, 2024
@danmoseley
danmoseley
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
please get approval by mail for this one
@carlossanlop
carlossanlop
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
Friendly reminder that Monday February 12th is the Code Complete deadline for the March Release.
@rzikmrzikm
changed the title
[release/8.0-staging] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMICFeb 9, 2024
@rzikmrzikm
self-assigned this
Feb 9, 2024
@stephentoub
stephentoub
commented
Feb 9, 2024

Copy link


Copy Markdown

Member
We don't want to backport the tests as well?
@filipnavara
filipnavara
commented
Feb 9, 2024

Copy link


Copy Markdown

MemberAuthor
We don't want to backport the tests as well?
The tests use new public API that was introduced in .NET 9. It makes it rather non-trivial to port them.
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Approved via email
@rzikmrzikm
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Feb 12, 2024
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Ci is green
@rzikm
rzikm
merged commit 2190e9b
into
dotnet:release/8.0-stagingFeb 12, 2024
@filipnavara
filipnavara
commented
Feb 12, 2024

Copy link


Copy Markdown

MemberAuthor
Thanks for taking care of it!
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Mar 13, 2024
@karelzkarelz
modified the milestones:
8.0.x, 8.0.3Jun 25, 2024
@filipnavara
filipnavara
deleted the

getmic-backport

branch
June 5, 2025 07:34
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes
@rzikmrzikmrzikm approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Securitycommunity-contributionIndicates that the PR has been added by a community memberServicing-approvedApproved for servicing release

Projects


None yet


Milestone

8.0.3

Development

Successfully merging this pull request may close these issues.

8 participants

@filipnavara@danmoseley@carlossanlop@stephentoub@rzikm@wfurt@akoeplinger@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC - #98031
Merged
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Feb 12, 2024
Merged
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC#98031
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Feb 6, 2024•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Partial backport of PR #96712.
Fixes#97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced with PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Specific changes in this PR have also been tested against the repro provided in #97942.
Risk
Low
The error is well understood, and the fix was already done in main branch last month. .NET 8 exposed this implementation detail only through the NegotiateStream API in a specific combination of parameters.
@ghostghost
added

area-System.Net.Security

community-contribution
Indicates that the PR has been added by a community member
labels
Feb 6, 2024
@ghost
ghost
commented
Feb 6, 2024

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced in PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Risk
Low
The error is well understood, and the fix was already done in main branch last month.
Author:filipnavara
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtFebruary 6, 2024 12:35
rzikm
rzikm
approved these changes
Feb 6, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Feb 6, 2024

Open

3 tasks
@filipnavarafilipnavara
added
the 
Servicing-consider
Issue for next servicing release review
label
Feb 6, 2024
@akoeplingerakoeplinger
added this to the 8.0.x milestone
Feb 7, 2024
@danmoseley
danmoseley
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
please get approval by mail for this one
@carlossanlop
carlossanlop
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
Friendly reminder that Monday February 12th is the Code Complete deadline for the March Release.
@rzikmrzikm
changed the title
[release/8.0-staging] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMICFeb 9, 2024
@rzikmrzikm
self-assigned this
Feb 9, 2024
@stephentoub
stephentoub
commented
Feb 9, 2024

Copy link


Copy Markdown

Member
We don't want to backport the tests as well?
@filipnavara
filipnavara
commented
Feb 9, 2024

Copy link


Copy Markdown

MemberAuthor
We don't want to backport the tests as well?
The tests use new public API that was introduced in .NET 9. It makes it rather non-trivial to port them.
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Approved via email
@rzikmrzikm
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Feb 12, 2024
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Ci is green
@rzikm
rzikm
merged commit 2190e9b
into
dotnet:release/8.0-stagingFeb 12, 2024
@filipnavara
filipnavara
commented
Feb 12, 2024

Copy link


Copy Markdown

MemberAuthor
Thanks for taking care of it!
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Mar 13, 2024
@karelzkarelz
modified the milestones:
8.0.x, 8.0.3Jun 25, 2024
@filipnavara
filipnavara
deleted the

getmic-backport

branch
June 5, 2025 07:34
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes
@rzikmrzikmrzikm approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Securitycommunity-contributionIndicates that the PR has been added by a community memberServicing-approvedApproved for servicing release

Projects


None yet


Milestone

8.0.3

Development

Successfully merging this pull request may close these issues.

8 participants

@filipnavara@danmoseley@carlossanlop@stephentoub@rzikm@wfurt@akoeplinger@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC - #98031
Merged
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Feb 12, 2024
Merged
[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC#98031
rzikm merged 1 commit into
dotnet:release/8.0-stagingfrom 
filipnavara:getmic-backport
Conversation
@filipnavara
@filipnavarafilipnavara
commented
Feb 6, 2024•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Partial backport of PR #96712.
Fixes#97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced with PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Specific changes in this PR have also been tested against the repro provided in #97942.
Risk
Low
The error is well understood, and the fix was already done in main branch last month. .NET 8 exposed this implementation detail only through the NegotiateStream API in a specific combination of parameters.
@ghostghost
added

area-System.Net.Security

community-contribution
Indicates that the PR has been added by a community member
labels
Feb 6, 2024
@ghost
ghost
commented
Feb 6, 2024

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #97942.
Customer Impact
  •  Customer reported
  •  Found internally
The NegotiateStream API sends incorrectly wrapped data on Windows when ProtectionLevel.Sign is used and NTLM is used as the underlying algorithm. Other platforms are not affected, other protection levels like ProtectionLevel.EncryptAndSign are not affected either.
Regression
  •  Yes
  •  No
Regression was introduced in PR #86948 in .NET 8. We lacked sufficient testing which was rectified in #96712 in .NET 9 when public APIs were added to expose the internal method. This PR backports the bug fix that was merged as part of PR #96712.
Testing
Tests were added in #96712 in main branch when the functionality was exposed as public API. The bug in the Windows implementation was uncovered by those tests and fixed. The customer who reported this issue in #97942 for .NET 8 has verified that the scenario is now fixed on .NET 9 nightly builds.
Risk
Low
The error is well understood, and the fix was already done in main branch last month.
Author:filipnavara
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtFebruary 6, 2024 12:35
rzikm
rzikm
approved these changes
Feb 6, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Feb 6, 2024

Open

3 tasks
@filipnavarafilipnavara
added
the 
Servicing-consider
Issue for next servicing release review
label
Feb 6, 2024
@akoeplingerakoeplinger
added this to the 8.0.x milestone
Feb 7, 2024
@danmoseley
danmoseley
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
please get approval by mail for this one
@carlossanlop
carlossanlop
commented
Feb 8, 2024

Copy link


Copy Markdown

Contributor
Friendly reminder that Monday February 12th is the Code Complete deadline for the March Release.
@rzikmrzikm
changed the title
[release/8.0-staging] Fix Windows implementation of NegotiateAuthenticationPal.GetMIC[release/8.0] Fix Windows implementation of NegotiateAuthenticationPal.GetMICFeb 9, 2024
@rzikmrzikm
self-assigned this
Feb 9, 2024
@stephentoub
stephentoub
commented
Feb 9, 2024

Copy link


Copy Markdown

Member
We don't want to backport the tests as well?
@filipnavara
filipnavara
commented
Feb 9, 2024

Copy link


Copy Markdown

MemberAuthor
We don't want to backport the tests as well?
The tests use new public API that was introduced in .NET 9. It makes it rather non-trivial to port them.
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Approved via email
@rzikmrzikm
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Feb 12, 2024
@rzikm
rzikm
commented
Feb 12, 2024

Copy link


Copy Markdown

Member
Ci is green
@rzikm
rzikm
merged commit 2190e9b
into
dotnet:release/8.0-stagingFeb 12, 2024
@filipnavara
filipnavara
commented
Feb 12, 2024

Copy link


Copy Markdown

MemberAuthor
Thanks for taking care of it!
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Mar 13, 2024
@karelzkarelz
modified the milestones:
8.0.x, 8.0.3Jun 25, 2024
@filipnavara
filipnavara
deleted the

getmic-backport

branch
June 5, 2025 07:34
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes
@rzikmrzikmrzikm approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Securitycommunity-contributionIndicates that the PR has been added by a community memberServicing-approvedApproved for servicing release

Projects


None yet


Milestone

8.0.3

Development

Successfully merging this pull request may close these issues.

8 participants

@filipnavara@danmoseley@carlossanlop@stephentoub@rzikm@wfurt@akoeplinger@karelz