-
Couldn't load subscription status.
- Fork 5.2k
[release/8.0] Fix implementation of NegotiateAuthentication.Wrap for Kerberos on Windows #91311
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones Issue DetailsBackport of #91152 to release/8.0 /cc @rzikm @filipnavara Customer ImpactTestingRiskIMPORTANT: If this backport is for a servicing release, please verify that:
|
|
@filipnavara would you be able to provide text for the Testing and Risk sections as well? cc: @karelz |
This comment was marked as duplicate.
This comment was marked as duplicate.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Thanks @filipnavara
|
@karelz do you approve this for RC2? |
|
I approve, it is E2E regression - @artl93 it is ready for you |
|
M2 approved. |
Backport of #91152 to release/8.0
Fixes PowerShell/PowerShell#20168
/cc @rzikm @filipnavara
Customer Impact
Regression against 7.0 - Establishing NTLM (Kerberos) authenticated connection can fail with "The encryption operation failed" (see PowerShell/PowerShell#20168).
The story behind the regression:
The regression is caused by changes in .NET Kerberos/NTLM authentication which started in 7.0 and which are finishing now in 8.0. The goal was to introduce public Kerberos/NTLM authentication APIs (
NegotiateAuthenticaton) for higher-level frameworks and applications (e.g. ASP.NET needed it to avoid using private Reflection - see #29270).In 6.0 and earlier, the Kerberos/NTLM authentication (
NTAuthentication) was internal only code and was compiled into multiple Networking assemblies (e.g.System.Net.Security,System.Net.Mail, etc.) to avoid using Reflection. Therefore, it also had negative impact on .NET binaries size due to compiled code duplication (while the source code was shared).In 7.0, we introduced the new public API
NegotiateAuthenticatonand we migrated a few internal usages ofNTAuthenticationto the new public API (e.g.Mail), but not all of them.One of the public APIs (
NegotiateAuthentication.Wrap) had a bug on Windows only that was not exposed until 8.0, when we migrated alsoNegotiateStreamto the public APIs in PR #86948.NegotiateStreamsupport of Kerberos requires more flexibility in encryption padding, which NTLM didn't need, and the new API didn't fully provide it.This PR brings parity of old internal functionality in
NegotiateStreamPal.Encryptto the new public APINegotiateAuthentication.Wrap.Testing
The change was tested on affected scenario reported in PowerShell/PowerShell#20168.
Additional validation was performed using a custom/manual
NegotiateStreamclient-server setup between Windows Server 2019 server machine and Windows 11 client machine.Note: NTLM has good unit test coverage. Kerberos has also good unit test coverage on Linux via Kerberos.NET. However, Kerberos on Windows requires complicated multi-machine setup, therefore it is not automated. We will evaluate feasibility of adding Kerberos test endpoint for CI during 9.0 to address the test gap.
Risk
Low to Medium.
The change affects encryption and signing of data transferred through
NegotiateStream. There's no other internal consumer of theNegotiateAuthentication.WrapAPI (with exception of single message in SMTP GSSAPI authentication which is covered by tests). Given that this is very advanced API introduced in 7.0, we do not expect there to be any external usages of the API either. And if they are, they would not be ok with the buggy behavior in 7.0.Only two encryption protocols are supported - NTLM and Kerberos, and NTLM is covered by tests. The Kerberos use case was reported to be broken, and this restores the affected code to mimic the .NET 7 behavior.