Skip to content
This repository was archived by the owner on Jan 23, 2023. It is now read-only.

Fix SPN used for Negotiate authentication #33426

Merged
merged 2 commits into from
Nov 12, 2018
Merged

Fix SPN used for Negotiate authentication #33426

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
650c8e6
Fix SPN used for Negotiate authentication
davidsh Oct 23, 2018
93d6e81
Address PR feedback
davidsh Nov 12, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/System.Net.Http/src/System.Net.Http.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -599,6 +599,9 @@
<Compile Include="System\Net\Http\HttpClientHandler.Core.cs" />
<Compile Include="uap\System\Net\HttpClientHandler.cs" />
</ItemGroup>
<ItemGroup Condition="'$(TargetGroup)' == 'netcoreapp'">
<Reference Include="System.Net.NameResolution" />
</ItemGroup>
Copy link
Member

@stephentoub stephentoub Nov 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We didn't already have this because we were relying on the underlying implementation (e.g. System.Net.Sockets) to do the original Dns call?

Copy link
Contributor Author

@davidsh davidsh Nov 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct. I needed to add it in order to compile.

<ItemGroup Condition="'$(TargetGroup)' == 'netcoreapp' OR '$(TargetGroup)' == 'netcoreappaot' OR '$(TargetGroup)' == 'uap'">
<Reference Include="Microsoft.Win32.Primitives" />
<Reference Include="System.Buffers" />
Expand Down
24 changes: 23 additions & 1 deletion src/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/AuthenticationHelper.NtAuth.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

using System.Collections.Generic;
using System.Diagnostics;
using System.Net;
using System.Net.Http.Headers;
using System.Threading;
using System.Threading.Tasks;
Expand Down Expand Up @@ -77,7 +78,28 @@ private static async Task<HttpResponseMessage> SendWithNtAuthAsync(HttpRequestMe

string challengeData = challenge.ChallengeData;

string spn = "HTTP/" + authUri.IdnHost;
// Need to use FQDN normalized host so that CNAME's are traversed.
Copy link
Member

@karelz karelz Nov 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we move the comment rather into the else-branch?

Copy link
Contributor Author

@davidsh davidsh Nov 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the comment is in the right place since it describes the logic to calculate the SPN. But I will revise the comment because it needs to describe that we skip DNS lookup in cases of IP literals.

// Use DNS to do the forward lookup to an A (host) record.
// But skip DNS lookup on IP literals. Otherwise, we would end up
// doing an unintended reverse DNS lookup.
string spn;
UriHostNameType hnt = authUri.HostNameType;
if (hnt == UriHostNameType.IPv6 || hnt == UriHostNameType.IPv4)
{
spn = authUri.IdnHost;
}
else
{
IPHostEntry result = await Dns.GetHostEntryAsync(authUri.IdnHost).ConfigureAwait(false);
spn = result.HostName;
}
Copy link
Member

@stephentoub stephentoub Nov 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: maybe instead of doing:

string spn;
if (...)
{
    spn = "HTTP/" + authUri.IdnHost;
}
else
{
    ...
    spn = "HTTP/" + result.HostName;
}

do:

string spn;
if (...)
{
    spn = authUri.IdnHost;
}
else
{
    ...
    spn = result.HostName;
}
spn = "HTTP/" + spn;

?

Copy link
Contributor Author

@davidsh davidsh Nov 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this better? Is seems slower because we are doing two assignments of spn field.

I don't think it is really less lines of IL or memory because the "HTTP/" string should only occur once.

Copy link
Member

@stephentoub stephentoub Nov 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this better? Is seems slower because we are doing two assignments of spn field.

From my perspective it's better because it's centralizing some logic, namely the concatenation of the "HTTP/" prefix. There's also no additional field assignment, as spn here is a local, not a field. And the IL is a bit longer otherwise, as there are two calls to Concat instead of one:
https://sharplab.io/#v2:EYLgtghgzgLgpgJwDQxASwDYB8ACAGAAhwEYBuAWACh8jiA6AOThgsqpwGYiAmAgYQIBvKgVFEuJQgFliACgCqCNAQCuSgJQixwygEgxBRWgASAe1gMIYOABUAngAc4BABYA7GAQC8qpXTMWVraOcKwGBpIEUA5uYeGiaABmBLLunl4+RgEwltb2TnQAkgAKAG4ALARYWK4e3plK2bnBBSWlAGyalPGiOj3h0W7eBABExjY2xQD0IwQA1L5oRQAmbtlx8QC+WvFwGFBwO+F9/WKDw2MT07MLACJuUHQA4szZAKIeCHayakuFq9l1P5zDkghtwttuj0cAB2KIxcGQgxHTi0aTcBRKRZdAw6fRiLIg5r5ZxpYa/YGBPIhcERYiEQa0sRJFJkjKGRpEoIkoplSrVWrpBomLnU1plTpHXFSnrnHwU/5rEFM0RInp7A4y3pagYxYb3R4vGDvT7fBUAkFAppgnVq+Jy0bjSYzebw2I62FuxFUTZAA=

But it's just a small thing. Whatever you prefer is fine.

Copy link
Contributor Author

@davidsh davidsh Nov 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok. I'll make the change.

And I like the https://sharplab.io example! That is a nice website for this kind of analysis.

spn = "HTTP/" + spn;

if (NetEventSource.IsEnabled)
{
NetEventSource.Info(connection, $"Authentication: {challenge.AuthenticationType}, Host: {authUri.IdnHost}, SPN: {spn}");
}

ChannelBinding channelBinding = connection.TransportContext?.GetChannelBinding(ChannelBindingKind.Endpoint);
NTAuthentication authContext = new NTAuthentication(isServer:false, challenge.SchemeName, challenge.Credential, spn, ContextFlagsPal.Connection, channelBinding);
try
Expand Down