1. 16 6月, 2021 15 次提交
  2. 15 6月, 2021 21 次提交
  3. 14 6月, 2021 4 次提交
    • F
      Fix NTLM authentication from macOS to Windows machines (#54101) · 17481fef
      Filip Navara 提交于
      * Fix NTLM authentication from macOS to Windows machines
      
      The GSSAPI implementation on macOS has partially broken NTLM implementation. It only supports NTLMv2 with the message integrity code (MIC) as specified by the MS-NLMP specification. The MIC is calculated using HMAC-MD5 authentication code over the exchanged NTLM messages with a key named ExportedSessionKey. The proper generation of ExportedSessionKey requires the implementation to negotiate correct capabilities, namely NTLMSSP_NEGOTIATE_KEY_EXCH and at least one of NTLMSSP_NEGOTIATE_SIGN or NTLMSSP_NEGOTIATE_SEAL flags. By default the macOS implementation negotiates NTLMSSP_NEGOTIATE_KEY_EXCH and sends MIC but fails to set one of the additional flags that would make the key exchange valid. This results in violation of the following part of the NTLM specification:
      
      "A session key MUST always exist to generate the MIC (section 3.1.5.1.2) in the authenticate message. NTLMSSP_NEGOTIATE_ALWAYS_SIGN MUST be set in the NEGOTIATE_MESSAGE to the server and the CHALLENGE_MESSAGE to the client."
      
      Adding the GSS_C_INTEG_FLAG flag forces macOS to properly negitiate all the necessary flags (NTLMSSP_NEGOTIATE_ALWAYS_SIGN and NTLMSSP_NEGOTIATE_SIGN) to make the MIC exchange valid. This in turn enables the whole NTLM exchange to be recognized as valid by Windows server side.
      
      The gss-ntlmssp package on Linux interprets the GSS_C_INTEG_FLAG flag as additional negotiation of NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_KEY_EXCH. That should not hurt anything and in fact it may improve security depending on specific configuration. The flag was already specified when NTLM was used by System.Net.Mail.SmtpClient.
      
      * Add temporary test to verify NTLM and Negotiate connections from all platforms
      
      Notably this is expected to fail on Android and tvOS where GSSAPI is not available.
      
      The test machine is single purpose virtual machine running in Azure with clean Windows Server 2019 installation and all the patches. It hosts IIS with single static page behind an NT authentication. The test account and the machine itself is disposable and does NOT contain any sensitive data. Nevertheless I don't expect this test to be merged.
      
      * Use full domain name in test credentials
      
      * Revert "Use full domain name in test credentials"
      
      This reverts commit ea4dc615824c207845628143addc7d8c774ce702.
      
      * Revert "Add temporary test to verify NTLM and Negotiate connections from all platforms"
      
      This reverts commit abf44ce1430edf631fe74b15d354eca9073b4c83.
      17481fef
    • D
      Set the async local just before execution (#54133) · 2ac5e2bb
      David Fowler 提交于
      * Set the async local just before execution.
      - Subscribing to DiagnosticListener.AllListeners replays all created DiagnosticListener instances. Because of this, we need to set the async local just before the execution of the entry point so that we only collect the events that are relevant to the call. Right now, it's also firing with the async local set pre-maturely.
      - Wrote a concurrency test to make sure it's safe to instantiate the factory in parallel.
      2ac5e2bb
    • E
      Make JsonSerializer work when IsDynamicCodeSupported is false. (#54027) · 49fa010d
      Eric Erhardt 提交于
      Use the non-Emit codepath if IsDynamicCodeSupported is false.
      49fa010d
    • J
      Logging Generator: messaging fix (#54080) · 469db3d7
      Jeff Layton 提交于
      469db3d7