public SafeDeleteContext(SafeFreeCredentials credential, bool isServer, bool remoteCertRequired)
: base(IntPtr.Zero, true)
{
Debug.Assert((null != credential) && !credential.IsInvalid, "Invalid credential used in SafeDeleteContext");
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization. The certificate handle and
// key handle are used in the SSL data structures and should survive the lifetime of
// the SSL context
bool gotCredRef = false;
_credential = credential;
_credential.DangerousAddRef(ref gotCredRef);
try
{
_sslContext = Interop.OpenSsl.AllocateSslContext(
credential.Protocols,
credential.CertHandle,
credential.CertKeyHandle,
credential.Policy,
isServer,
remoteCertRequired);
}
catch (Exception ex)
{
if (gotCredRef)
{
_credential.DangerousRelease();
}
Debug.Write("Exception Caught. - " + ex);
throw;
}
}
public SafeDeleteContext(SafeFreeCredentials credential, long options, bool isServer, bool remoteCertRequired)
: base(IntPtr.Zero, true)
{
Debug.Assert((null != credential) && !credential.IsInvalid, "Invalid credential used in SafeDeleteContext");
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization. The certificate handle and
// key handle are used in the SSL data structures and should survive the lifetime of
// the SSL context
bool ignore = false;
_credential = credential;
_credential.DangerousAddRef(ref ignore);
try
{
_sslContext = Interop.OpenSsl.AllocateSslContext(
options,
credential.CertHandle,
credential.CertKeyHandle,
isServer,
remoteCertRequired);
}
finally
{
if (IsInvalid)
{
_credential.DangerousRelease();
}
}
}
private SafeCredentialReference(SafeFreeCredentials target) : base()
{
// Bumps up the refcount on Target to signify that target handle is statically cached so
// its dispose should be postponed
bool ignore = false;
target.DangerousAddRef(ref ignore);
Target = target;
SetHandle(new IntPtr(0)); // make this handle valid
}
private SafeCredentialReference(SafeFreeCredentials target)
{
// Bumps up the refcount on Target to signify that target handle is statically cached so
// its dispose should be postponed
bool ignore = false;
target.DangerousAddRef(ref ignore);
Target = target;
}
private SafeCredentialReference(SafeFreeCredentials target) : base()
{
// Bumps up the refcount on Target to signify that target handle is statically cached so
// its dispose should be postponed
bool ignore = false;
target.DangerousAddRef(ref ignore);
Target = target;
SetHandle(new IntPtr(0)); // make this handle valid
}
protected SafeDeleteContext(SafeFreeCredentials credential)
: base(IntPtr.Zero, true)
{
Debug.Assert((null != credential), "Invalid credential passed to SafeDeleteContext");
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization. The credential properties
// are used in the SSL/NEGO data structures and should survive the lifetime of
// the SSL/NEGO context
bool ignore = false;
_credential = credential;
_credential.DangerousAddRef(ref ignore);
}
public SafeDeleteContext(IntPtr handle, SafeFreeCredentials credential) : base(handle, true)
{
Debug.Assert((null != credential) && !credential.IsInvalid, "Invalid credential used in SafeDeleteContext");
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization. The certificate handle and
// key handle are used in the SSL data structures and should survive the lifetime of
// the SSL context
bool ignore = false;
_credential = credential;
_credential.DangerousAddRef(ref ignore);
}
static void SetCredentials(SSPIInterface secModule, SafeFreeCredentials credentials)
{
if (credentials != null && !credentials.IsInvalid)
{
if (!secModule.Context.HasCredentials && credentials.Certificate != null)
{
var cert = new X509Certificate2(credentials.Certificate.RawData);
secModule.Context.SetCertificate(cert, credentials.Certificate.PrivateKey);
}
bool success = true;
credentials.DangerousAddRef(ref success);
}
}
protected SafeDeleteContext(SafeFreeCredentials credential)
: base(IntPtr.Zero, true)
{
Debug.Assert((null != credential), "Invalid credential passed to SafeDeleteContext");
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization. The credential properties
// are used in the SSL/NEGO data structures and should survive the lifetime of
// the SSL/NEGO context
bool ignore = false;
_credential = credential;
_credential.DangerousAddRef(ref ignore);
}
private SafeCredentialReference(SafeFreeCredentials target)
: base()
{
// Bumps up the refcount on Target to signify that target handle is statically cached so
// its dispose should be postponed
bool b = false;
try {
target.DangerousAddRef(ref b);
} catch {
if (b)
{
target.DangerousRelease();
b = false;
}
} finally {
if (b)
{
_Target = target;
SetHandle(new IntPtr(0)); // make this handle valid
}
}
}
//
// After PInvoke call the method will fix the handleTemplate.handle with the returned value.
// The caller is responsible for creating a correct SafeFreeContextBuffer_XXX flavour or null can be passed if no handle is returned.
//
private static unsafe int MustRunAcceptSecurityContext_SECURITY(
ref SafeFreeCredentials inCredentials,
void* inContextPtr,
Interop.Secur32.SecurityBufferDescriptor inputBuffer,
Interop.Secur32.ContextFlags inFlags,
Interop.Secur32.Endianness endianness,
SafeDeleteContext outContext,
Interop.Secur32.SecurityBufferDescriptor outputBuffer,
ref Interop.Secur32.ContextFlags outFlags,
SafeFreeContextBuffer handleTemplate)
{
int errorCode = (int)Interop.SecurityStatus.InvalidHandle;
// Run the body of this method as a non-interruptible block.
try
{
bool ignore = false;
inCredentials.DangerousAddRef(ref ignore);
outContext.DangerousAddRef(ref ignore);
Interop.Secur32.SSPIHandle credentialHandle = inCredentials._handle;
long timeStamp;
errorCode = Interop.Secur32.AcceptSecurityContext(
ref credentialHandle,
inContextPtr,
inputBuffer,
inFlags,
endianness,
ref outContext._handle,
outputBuffer,
ref outFlags,
out timeStamp);
}
finally
{
//
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization.
// If the credential handle has been changed we de-ref the old one and associate the
// context with the new cred handle but only if the call was successful.
if (outContext._EffectiveCredential != inCredentials && (errorCode & 0x80000000) == 0)
{
// Disassociate the previous credential handle.
if (outContext._EffectiveCredential != null)
{
outContext._EffectiveCredential.DangerousRelease();
}
outContext._EffectiveCredential = inCredentials;
}
else
{
inCredentials.DangerousRelease();
}
outContext.DangerousRelease();
}
// The idea is that SSPI has allocated a block and filled up outUnmanagedBuffer+8 slot with the pointer.
if (handleTemplate != null)
{
//ATTN: on 64 BIT that is still +8 cause of 2* c++ unsigned long == 8 bytes.
handleTemplate.Set(((Interop.Secur32.SecurityBufferStruct*)outputBuffer.UnmanagedPointer)->token);
if (handleTemplate.IsInvalid)
{
handleTemplate.SetHandleAsInvalid();
}
}
if (inContextPtr == null && (errorCode & 0x80000000) != 0)
{
// An error on the first call, need to set the out handle to invalid value.
outContext._handle.SetToInvalid();
}
return errorCode;
}
private static unsafe int MustRunAcceptSecurityContext_SECURITY(
ref SafeFreeCredentials inCredentials,
bool isContextAbsent,
Interop.SspiCli.SecBufferDesc *inputBuffer,
Interop.SspiCli.ContextFlags inFlags,
Interop.SspiCli.Endianness endianness,
SafeDeleteContext outContext,
ref Interop.SspiCli.SecBufferDesc outputBuffer,
ref Interop.SspiCli.ContextFlags outFlags,
SafeFreeContextBuffer?handleTemplate)
{
int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;
// Run the body of this method as a non-interruptible block.
try
{
bool ignore = false;
inCredentials.DangerousAddRef(ref ignore);
outContext.DangerousAddRef(ref ignore);
Interop.SspiCli.CredHandle credentialHandle = inCredentials._handle;
long timeStamp;
// Now that "outContext" (or "refContext" by the caller) references an actual handle (and cannot
// be closed until it is released below), point "inContextPtr" to its embedded handle (or
// null if the embedded handle has not yet been initialized).
Interop.SspiCli.CredHandle contextHandle = outContext._handle;
void *inContextPtr = contextHandle.IsZero ? null : &contextHandle;
// The "isContextAbsent" supplied by the caller is generally correct but was computed without proper
// synchronization. Rewrite the indicator now that the final "inContext" is known, update if necessary.
isContextAbsent = (inContextPtr == null);
errorCode = Interop.SspiCli.AcceptSecurityContext(
ref credentialHandle,
inContextPtr,
inputBuffer,
inFlags,
endianness,
ref outContext._handle,
ref outputBuffer,
ref outFlags,
out timeStamp);
}
finally
{
//
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization.
// If the credential handle has been changed we de-ref the old one and associate the
// context with the new cred handle but only if the call was successful.
if (outContext._EffectiveCredential != inCredentials && (errorCode & 0x80000000) == 0)
{
// Disassociate the previous credential handle.
outContext._EffectiveCredential?.DangerousRelease();
outContext._EffectiveCredential = inCredentials;
}
else
{
inCredentials.DangerousRelease();
}
outContext.DangerousRelease();
}
// The idea is that SSPI has allocated a block and filled up outUnmanagedBuffer+8 slot with the pointer.
if (handleTemplate != null)
{
//ATTN: on 64 BIT that is still +8 cause of 2* c++ unsigned long == 8 bytes.
handleTemplate.Set(((Interop.SspiCli.SecBuffer *)outputBuffer.pBuffers)->pvBuffer);
if (handleTemplate.IsInvalid)
{
handleTemplate.SetHandleAsInvalid();
}
}
if (isContextAbsent && (errorCode & 0x80000000) != 0)
{
// An error on the first call, need to set the out handle to invalid value.
outContext._handle.SetToInvalid();
}
return(errorCode);
}
public SafeDeleteContext(SafeFreeCredentials credential, long options, bool isServer, bool remoteCertRequired)
: base(IntPtr.Zero, true)
{
Debug.Assert((null != credential) && !credential.IsInvalid, "Invalid credential used in SafeDeleteContext");
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization. The certificate handle and
// key handle are used in the SSL data structures and should survive the lifetime of
// the SSL context
bool ignore = false;
_credential = credential;
_credential.DangerousAddRef(ref ignore);
try
{
_sslContext = Interop.OpenSsl.AllocateSslContext(
options,
credential.CertHandle,
credential.CertKeyHandle,
isServer,
remoteCertRequired);
}
finally
{
if (IsInvalid)
{
_credential.DangerousRelease();
}
}
}
private SafeCredentialReference (SafeFreeCredentials target)
: base ()
{
// Bumps up the refcount on Target to signify that target handle is statically cached so
// its dispose should be postponed
bool b = false;
try {
target.DangerousAddRef (ref b);
} catch {
if (b) {
target.DangerousRelease ();
b = false;
}
} finally {
if (b) {
_Target = target;
SetHandle (new IntPtr (0)); // make this handle valid
}
}
}
//
// After PInvoke call the method will fix the handleTemplate.handle with the returned value.
// The caller is responsible for creating a correct SafeFreeContextBuffer_XXX flavour or null can be passed if no handle is returned.
//
private static unsafe int MustRunAcceptSecurityContext_SECURITY(
ref SafeFreeCredentials inCredentials,
void *inContextPtr,
Interop.Secur32.SecurityBufferDescriptor inputBuffer,
Interop.Secur32.ContextFlags inFlags,
Interop.Secur32.Endianness endianness,
SafeDeleteContext outContext,
Interop.Secur32.SecurityBufferDescriptor outputBuffer,
ref Interop.Secur32.ContextFlags outFlags,
SafeFreeContextBuffer handleTemplate)
{
int errorCode = (int)Interop.SecurityStatus.InvalidHandle;
// Run the body of this method as a non-interruptible block.
try
{
bool ignore = false;
inCredentials.DangerousAddRef(ref ignore);
outContext.DangerousAddRef(ref ignore);
Interop.Secur32.SSPIHandle credentialHandle = inCredentials._handle;
long timeStamp;
errorCode = Interop.Secur32.AcceptSecurityContext(
ref credentialHandle,
inContextPtr,
inputBuffer,
inFlags,
endianness,
ref outContext._handle,
outputBuffer,
ref outFlags,
out timeStamp);
}
finally
{
//
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization.
// If the credential handle has been changed we de-ref the old one and associate the
// context with the new cred handle but only if the call was successful.
if (outContext._EffectiveCredential != inCredentials && (errorCode & 0x80000000) == 0)
{
// Disassociate the previous credential handle.
if (outContext._EffectiveCredential != null)
{
outContext._EffectiveCredential.DangerousRelease();
}
outContext._EffectiveCredential = inCredentials;
}
else
{
inCredentials.DangerousRelease();
}
outContext.DangerousRelease();
}
// The idea is that SSPI has allocated a block and filled up outUnmanagedBuffer+8 slot with the pointer.
if (handleTemplate != null)
{
//ATTN: on 64 BIT that is still +8 cause of 2* c++ unsigned long == 8 bytes.
handleTemplate.Set(((Interop.Secur32.SecurityBufferStruct *)outputBuffer.UnmanagedPointer)->token);
if (handleTemplate.IsInvalid)
{
handleTemplate.SetHandleAsInvalid();
}
}
if (inContextPtr == null && (errorCode & 0x80000000) != 0)
{
// An error on the first call, need to set the out handle to invalid value.
outContext._handle.SetToInvalid();
}
return(errorCode);
}
//
// After PInvoke call the method will fix the handleTemplate.handle with the returned value.
// The caller is responsible for creating a correct SafeFreeContextBuffer_XXX flavor or null can be passed if no handle is returned.
//
private static unsafe int MustRunInitializeSecurityContext_SECURITY(
ref SafeFreeCredentials inCredentials,
void* inContextPtr,
byte* targetName,
Interop.SspiCli.ContextFlags inFlags,
Interop.SspiCli.Endianness endianness,
Interop.SspiCli.SecBufferDesc* inputBuffer,
SafeDeleteContext outContext,
ref Interop.SspiCli.SecBufferDesc outputBuffer,
ref Interop.SspiCli.ContextFlags attributes,
SafeFreeContextBuffer handleTemplate)
{
int errorCode = (int)Interop.SECURITY_STATUS.InvalidHandle;
try
{
bool ignore = false;
inCredentials.DangerousAddRef(ref ignore);
outContext.DangerousAddRef(ref ignore);
Interop.SspiCli.CredHandle credentialHandle = inCredentials._handle;
long timeStamp;
errorCode = Interop.SspiCli.InitializeSecurityContextW(
ref credentialHandle,
inContextPtr,
targetName,
inFlags,
0,
endianness,
inputBuffer,
0,
ref outContext._handle,
ref outputBuffer,
ref attributes,
out timeStamp);
}
finally
{
//
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization.
// If the credential handle has been changed we de-ref the old one and associate the
// context with the new cred handle but only if the call was successful.
if (outContext._EffectiveCredential != inCredentials && (errorCode & 0x80000000) == 0)
{
// Disassociate the previous credential handle
if (outContext._EffectiveCredential != null)
{
outContext._EffectiveCredential.DangerousRelease();
}
outContext._EffectiveCredential = inCredentials;
}
else
{
inCredentials.DangerousRelease();
}
outContext.DangerousRelease();
}
// The idea is that SSPI has allocated a block and filled up outUnmanagedBuffer+8 slot with the pointer.
if (handleTemplate != null)
{
//ATTN: on 64 BIT that is still +8 cause of 2* c++ unsigned long == 8 bytes
handleTemplate.Set(((Interop.SspiCli.SecBuffer*)outputBuffer.pBuffers)->pvBuffer);
if (handleTemplate.IsInvalid)
{
handleTemplate.SetHandleAsInvalid();
}
}
if (inContextPtr == null && (errorCode & 0x80000000) != 0)
{
// an error on the first call, need to set the out handle to invalid value
outContext._handle.SetToInvalid();
}
return errorCode;
}
static void SetCredentials (SSPIInterface secModule, SafeFreeCredentials credentials)
{
if (credentials != null && !credentials.IsInvalid) {
if (!secModule.Context.HasCredentials && credentials.Certificate != null) {
var cert = new X509Certificate2 (credentials.Certificate.RawData);
secModule.Context.SetCertificate (cert, credentials.Certificate.PrivateKey);
}
bool success = true;
credentials.DangerousAddRef (ref success);
}
}
public SafeDeleteContext(IntPtr handle, SafeFreeCredentials credential) : base(handle, true)
{
Debug.Assert((null != credential) && !credential.IsInvalid, "Invalid credential used in SafeDeleteContext");
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization. The certificate handle and
// key handle are used in the SSL data structures and should survive the lifetime of
// the SSL context
bool ignore = false;
_credential = credential;
_credential.DangerousAddRef(ref ignore);
}
public SafeDeleteContext(SafeFreeCredentials credential, bool isServer, bool remoteCertRequired)
: base(IntPtr.Zero, true)
{
Debug.Assert((null != credential) && !credential.IsInvalid, "Invalid credential used in SafeDeleteContext");
// When a credential handle is first associated with the context we keep credential
// ref count bumped up to ensure ordered finalization. The certificate handle and
// key handle are used in the SSL data structures and should survive the lifetime of
// the SSL context
bool gotCredRef = false;
_credential = credential;
_credential.DangerousAddRef(ref gotCredRef);
try
{
_sslContext = Interop.OpenSsl.AllocateSslContext(
credential.Protocols,
credential.CertHandle,
credential.CertKeyHandle,
credential.Policy,
isServer,
remoteCertRequired);
}
catch(Exception ex)
{
if (gotCredRef)
{
_credential.DangerousRelease();
}
Debug.Write("Exception Caught. - " + ex);
throw;
}
}
