예제 #1
0
        /// <summary>
        /// Safely invokes the native VerifySignature function, making sure that handle ref counting is
        /// performed in a proper CER.
        /// </summary>
        /// <param name="handle"></param>
        /// <param name="qualityOfProtection"></param>
        /// <param name="adapter"></param>
        /// <param name="sequenceNumber"></param>
        /// <returns></returns>
        internal static SecurityStatus SafeVerifySignature(
            SafeContextHandle handle,
            int qualityOfProtection,
            SecureBufferAdapter adapter,
            int sequenceNumber)
        {
            bool           gotRef = false;
            SecurityStatus status = SecurityStatus.InternalError;

            RuntimeHelpers.PrepareConstrainedRegions();
            try
            {
                handle.DangerousAddRef(ref gotRef);
            }
            catch (Exception)
            {
                if (gotRef)
                {
                    handle.DangerousRelease();
                    gotRef = false;
                }

                throw;
            }
            finally
            {
                if (gotRef)
                {
                    status = ContextNativeMethods.VerifySignature(
                        ref handle.rawHandle,
                        adapter.Handle,
                        sequenceNumber,
                        qualityOfProtection
                        );

                    handle.DangerousRelease();
                }
            }

            return(status);
        }
예제 #2
0
        /// <summary>
        /// Queries the security package's expectations regarding message/token/signature/padding buffer sizes.
        /// </summary>
        /// <returns></returns>
        private SecPkgContext_Sizes QueryBufferSizes()
        {
            SecPkgContext_Sizes sizes  = new SecPkgContext_Sizes();
            SecurityStatus      status = SecurityStatus.InternalError;
            bool gotRef = false;

            RuntimeHelpers.PrepareConstrainedRegions();
            try
            {
                this.ContextHandle.DangerousAddRef(ref gotRef);
            }
            catch (Exception)
            {
                if (gotRef)
                {
                    this.ContextHandle.DangerousRelease();
                    gotRef = false;
                }

                throw;
            }
            finally
            {
                if (gotRef)
                {
                    status = ContextNativeMethods.QueryContextAttributes_Sizes(
                        ref this.ContextHandle.rawHandle,
                        ContextQueryAttrib.Sizes,
                        ref sizes
                        );
                    this.ContextHandle.DangerousRelease();
                }
            }

            if (status != SecurityStatus.OK)
            {
                throw new SspiException("Failed to query context buffer size attributes", status);
            }

            return(sizes);
        }
예제 #3
0
        /// <summary>
        /// Performs and continues the authentication cycle.
        /// </summary>
        /// <remarks>
        /// This method is performed iteratively to start, continue, and end the authentication cycle with the
        /// server. Each stage works by acquiring a token from one side, presenting it to the other side
        /// which in turn may generate a new token.
        ///
        /// The cycle typically starts and ends with the client. On the first invocation on the client,
        /// no server token exists, and null is provided in its place. The client returns its status, providing
        /// its output token for the server. The server accepts the clients token as input and provides a
        /// token as output to send back to the client. This cycle continues until the server and client
        /// both indicate, typically, a SecurityStatus of 'OK'.
        /// </remarks>
        /// <param name="serverToken">The most recently received token from the server, or null if beginning
        /// the authentication cycle.</param>
        /// <param name="outToken">The clients next authentication token in the authentication cycle.</param>
        /// <returns>A status message indicating the progression of the authentication cycle.
        /// A status of 'OK' indicates that the cycle is complete, from the client's perspective. If the outToken
        /// is not null, it must be sent to the server.
        /// A status of 'Continue' indicates that the output token should be sent to the server and
        /// a response should be anticipated.</returns>
        public SecurityStatus Init(byte[] serverToken, out byte[] outToken)
        {
            TimeStamp rawExpiry = new TimeStamp();

            SecurityStatus status;

            SecureBuffer        outTokenBuffer;
            SecureBufferAdapter outAdapter;

            SecureBuffer        serverBuffer;
            SecureBufferAdapter serverAdapter;

            if (this.Disposed)
            {
                throw new ObjectDisposedException("ClientContext");
            }
            else if ((serverToken != null) && (this.ContextHandle.IsInvalid))
            {
                throw new InvalidOperationException("Out-of-order usage detected - have a server token, but no previous client token had been created.");
            }
            else if ((serverToken == null) && (this.ContextHandle.IsInvalid == false))
            {
                throw new InvalidOperationException("Must provide the server's response when continuing the init process.");
            }

            // The security package tells us how big its biggest token will be. We'll allocate a buffer
            // that size, and it'll tell us how much it used.
            outTokenBuffer = new SecureBuffer(
                new byte[this.Credential.PackageInfo.MaxTokenLength],
                BufferType.Token
                );

            serverBuffer = null;
            if (serverToken != null)
            {
                serverBuffer = new SecureBuffer(serverToken, BufferType.Token);
            }

            // Some notes on handles and invoking InitializeSecurityContext
            //  - The first time around, the phContext parameter (the 'old' handle) is a null pointer to what
            //    would be an RawSspiHandle, to indicate this is the first time it's being called.
            //    The phNewContext is a pointer (reference) to an RawSspiHandle struct of where to write the
            //    new handle's values.
            //  - The next time you invoke ISC, it takes a pointer to the handle it gave you last time in phContext,
            //    and takes a pointer to where it should write the new handle's values in phNewContext.
            //  - After the first time, you can provide the same handle to both parameters. From MSDN:
            //       "On the second call, phNewContext can be the same as the handle specified in the phContext
            //        parameter."
            //    It will overwrite the handle you gave it with the new handle value.
            //  - All handle structures themselves are actually *two* pointer variables, eg, 64 bits on 32-bit
            //    Windows, 128 bits on 64-bit Windows.
            //  - So in the end, on a 64-bit machine, we're passing a 64-bit value (the pointer to the struct) that
            //    points to 128 bits of memory (the struct itself) for where to write the handle numbers.
            using (outAdapter = new SecureBufferAdapter(outTokenBuffer))
            {
                if (this.ContextHandle.IsInvalid)
                {
                    status = ContextNativeMethods.InitializeSecurityContext_1(
                        ref this.Credential.Handle.rawHandle,
                        IntPtr.Zero,
                        this.serverPrinc,
                        this.requestedAttribs,
                        0,
                        SecureBufferDataRep.Network,
                        IntPtr.Zero,
                        0,
                        ref this.ContextHandle.rawHandle,
                        outAdapter.Handle,
                        ref this.finalAttribs,
                        ref rawExpiry
                        );
                }
                else
                {
                    using (serverAdapter = new SecureBufferAdapter(serverBuffer))
                    {
                        status = ContextNativeMethods.InitializeSecurityContext_2(
                            ref this.Credential.Handle.rawHandle,
                            ref this.ContextHandle.rawHandle,
                            this.serverPrinc,
                            this.requestedAttribs,
                            0,
                            SecureBufferDataRep.Network,
                            serverAdapter.Handle,
                            0,
                            ref this.ContextHandle.rawHandle,
                            outAdapter.Handle,
                            ref this.finalAttribs,
                            ref rawExpiry
                            );
                    }
                }
            }

            if (status.IsError() == false)
            {
                if (status == SecurityStatus.OK)
                {
                    base.Initialize(rawExpiry.ToDateTime());
                }

                outToken = null;

                if (outTokenBuffer.Length != 0)
                {
                    outToken = new byte[outTokenBuffer.Length];
                    Array.Copy(outTokenBuffer.Buffer, outToken, outToken.Length);
                }
            }
            else
            {
                throw new SspiException("Failed to invoke InitializeSecurityContext for a client", status);
            }

            return(status);
        }