Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dev | Add support of the new authentication API with SSPI token on Managed SNI #2063

Merged
merged 8 commits into from
Jun 29, 2023
Merged

Dev | Add support of the new authentication API with SSPI token on Managed SNI #2063

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5b0ace9
add Auth API
DavoudEshtehari Jun 14, 2023
7840fb8
Improve TdsParser
DavoudEshtehari Jun 14, 2023
7ca50a8
Add event source log
DavoudEshtehari Jun 15, 2023
185c4cb
Address comments
DavoudEshtehari Jun 16, 2023
6cb8b4d
Take out dependency on .NET 6.0
DavoudEshtehari Jun 19, 2023
3666130
Take out more dependency
DavoudEshtehari Jun 19, 2023
1c28de4
Take out more dependency
DavoudEshtehari Jun 23, 2023
d361566
Merge remote-tracking branch 'Upstream/main' into NewAuthAPIs
DavoudEshtehari Jun 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
177 changes: 94 additions & 83 deletions src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParser.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8159,43 +8159,54 @@ internal void TdsLogin(SqlLogin rec, TdsEnums.FeatureExtension requestedFeatures
}

int feOffset = length;
// calculate and reserve the required bytes for the featureEx
length = ApplyFeatureExData(requestedFeatures, recoverySessionData, fedAuthFeatureExtensionData, useFeatureExt, length);

WriteLoginData(rec,
requestedFeatures,
recoverySessionData,
fedAuthFeatureExtensionData,
encrypt,
encryptedPassword,
encryptedChangePassword,
encryptedPasswordLengthInBytes,
encryptedChangePasswordLengthInBytes,
useFeatureExt,
userName,
length,
feOffset,
clientInterfaceName,
outSSPIBuff,
outSSPILength);

if (useFeatureExt)
if (rentedSSPIBuff != null)
{
if ((requestedFeatures & TdsEnums.FeatureExtension.SessionRecovery) != 0)
{
length += WriteSessionRecoveryFeatureRequest(recoverySessionData, false);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.FedAuth) != 0)
{
Debug.Assert(fedAuthFeatureExtensionData != null, "fedAuthFeatureExtensionData should not null.");
length += WriteFedAuthFeatureRequest(fedAuthFeatureExtensionData, write: false);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.Tce) != 0)
{
length += WriteTceFeatureRequest(false);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.GlobalTransactions) != 0)
{
length += WriteGlobalTransactionsFeatureRequest(false);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.DataClassification) != 0)
{
length += WriteDataClassificationFeatureRequest(false);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.UTF8Support) != 0)
{
length += WriteUTF8SupportFeatureRequest(false);
}

if ((requestedFeatures & TdsEnums.FeatureExtension.SQLDNSCaching) != 0)
{
length += WriteSQLDNSCachingFeatureRequest(false);
}

length++; // for terminator
ArrayPool<byte>.Shared.Return(rentedSSPIBuff, clearArray: true);
}

_physicalStateObj.WritePacket(TdsEnums.HARDFLUSH);
_physicalStateObj.ResetSecurePasswordsInformation();
_physicalStateObj.HasPendingData = true;
_physicalStateObj._messageStatus = 0;
}// tdsLogin

private void WriteLoginData(SqlLogin rec,
TdsEnums.FeatureExtension requestedFeatures,
SessionData recoverySessionData,
FederatedAuthenticationFeatureExtensionData fedAuthFeatureExtensionData,
SqlConnectionEncryptOption encrypt,
byte[] encryptedPassword,
byte[] encryptedChangePassword,
int encryptedPasswordLengthInBytes,
int encryptedChangePasswordLengthInBytes,
bool useFeatureExt,
string userName,
int length,
int featureExOffset,
string clientInterfaceName,
byte[] outSSPIBuff,
uint outSSPILength)
{
try
{
WriteInt(length, _physicalStateObj);
Expand Down Expand Up @@ -8409,7 +8420,7 @@ internal void TdsLogin(SqlLogin rec, TdsEnums.FeatureExtension requestedFeatures
SqlClientEventSource.Log.TryTraceEvent("<sc.TdsParser.TdsLogin|SEC> Sending federated authentication feature request");
}

WriteInt(feOffset, _physicalStateObj);
WriteInt(featureExOffset, _physicalStateObj);
}

WriteString(clientInterfaceName, _physicalStateObj);
Expand All @@ -8433,42 +8444,7 @@ internal void TdsLogin(SqlLogin rec, TdsEnums.FeatureExtension requestedFeatures
}
}

if (useFeatureExt)
{
if ((requestedFeatures & TdsEnums.FeatureExtension.SessionRecovery) != 0)
{
WriteSessionRecoveryFeatureRequest(recoverySessionData, true);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.FedAuth) != 0)
{
SqlClientEventSource.Log.TryTraceEvent("<sc.TdsParser.TdsLogin|SEC> Sending federated authentication feature request");
Debug.Assert(fedAuthFeatureExtensionData != null, "fedAuthFeatureExtensionData should not null.");
WriteFedAuthFeatureRequest(fedAuthFeatureExtensionData, write: true);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.Tce) != 0)
{
WriteTceFeatureRequest(true);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.GlobalTransactions) != 0)
{
WriteGlobalTransactionsFeatureRequest(true);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.DataClassification) != 0)
{
WriteDataClassificationFeatureRequest(true);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.UTF8Support) != 0)
{
WriteUTF8SupportFeatureRequest(true);
}

if ((requestedFeatures & TdsEnums.FeatureExtension.SQLDNSCaching) != 0)
{
WriteSQLDNSCachingFeatureRequest(true);
}

_physicalStateObj.WriteByte(0xFF); // terminator
}
ApplyFeatureExData(requestedFeatures, recoverySessionData, fedAuthFeatureExtensionData, useFeatureExt, length, true);
}
catch (Exception e)
{
Expand All @@ -8481,17 +8457,58 @@ internal void TdsLogin(SqlLogin rec, TdsEnums.FeatureExtension requestedFeatures

throw;
}
}

if (rentedSSPIBuff != null)
private int ApplyFeatureExData(TdsEnums.FeatureExtension requestedFeatures,
SessionData recoverySessionData,
FederatedAuthenticationFeatureExtensionData fedAuthFeatureExtensionData,
bool useFeatureExt,
int length,
bool write = false)
{
if (useFeatureExt)
{
ArrayPool<byte>.Shared.Return(rentedSSPIBuff, clearArray: true);
if ((requestedFeatures & TdsEnums.FeatureExtension.SessionRecovery) != 0)
{
length += WriteSessionRecoveryFeatureRequest(recoverySessionData, write);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.FedAuth) != 0)
{
SqlClientEventSource.Log.TryTraceEvent("<sc.TdsParser.TdsLogin|SEC> Sending federated authentication feature request & wirte = {0}", write);
Debug.Assert(fedAuthFeatureExtensionData != null, "fedAuthFeatureExtensionData should not null.");
length += WriteFedAuthFeatureRequest(fedAuthFeatureExtensionData, write: write);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.Tce) != 0)
{
length += WriteTceFeatureRequest(write);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.GlobalTransactions) != 0)
{
length += WriteGlobalTransactionsFeatureRequest(write);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.DataClassification) != 0)
{
length += WriteDataClassificationFeatureRequest(write);
}
if ((requestedFeatures & TdsEnums.FeatureExtension.UTF8Support) != 0)
{
length += WriteUTF8SupportFeatureRequest(write);
}

if ((requestedFeatures & TdsEnums.FeatureExtension.SQLDNSCaching) != 0)
{
length += WriteSQLDNSCachingFeatureRequest(write);
}

length++; // for terminator
if (write)
{
_physicalStateObj.WriteByte(0xFF); // terminator
}
}

_physicalStateObj.WritePacket(TdsEnums.HARDFLUSH);
_physicalStateObj.ResetSecurePasswordsInformation();
_physicalStateObj.HasPendingData = true;
_physicalStateObj._messageStatus = 0;
}// tdsLogin
return length;
}

/// <summary>
/// Send the access token to the server.
Expand Down Expand Up @@ -8524,12 +8541,6 @@ internal void SendFedAuthToken(SqlFedAuthToken fedAuthToken)
}

private void SSPIData(byte[] receivedBuff, uint receivedLength, ref byte[] sendBuff, ref uint sendLength)
{
SNISSPIData(receivedBuff, receivedLength, ref sendBuff, ref sendLength);
}


private void SNISSPIData(byte[] receivedBuff, uint receivedLength, ref byte[] sendBuff, ref uint sendLength)
{
if (TdsParserStateObjectFactory.UseManagedSNI)
{
Expand Down
24 changes: 20 additions & 4 deletions ...rosoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParserStateObjectManaged.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,9 @@
using System;
using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.Net.Security;
using System.Runtime.CompilerServices;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Data.Common;
Expand All @@ -18,8 +20,11 @@ internal sealed class TdsParserStateObjectManaged : TdsParserStateObject
{
private SNIMarsConnection? _marsConnection;
private SNIHandle? _sessionHandle;
#if NET7_0_OR_GREATER
private NegotiateAuthentication? _negotiateAuth = null;
#else
private SspiClientContextStatus? _sspiClientContextStatus;

#endif
public TdsParserStateObjectManaged(TdsParser parser) : base(parser) { }

internal TdsParserStateObjectManaged(TdsParser parser, TdsParserStateObject physicalConnection, bool async) :
Expand Down Expand Up @@ -384,15 +389,26 @@ internal override uint SetConnectionBufferSize(ref uint unsignedPacketSize)
return TdsEnums.SNI_SUCCESS;
}

internal override uint GenerateSspiClientContext(byte[] receivedBuff, uint receivedLength, ref byte[] sendBuff, ref uint sendLength, byte[][] _sniSpnBuffer)
internal override uint GenerateSspiClientContext(byte[] receivedBuff,
uint receivedLength,
ref byte[] sendBuff,
ref uint sendLength,
byte[][] _sniSpnBuffer)
{
if (_sspiClientContextStatus is null)
#if NET7_0_OR_GREATER
_negotiateAuth ??= new(new NegotiateAuthenticationClientOptions { Package = "Negotiate", TargetName = Encoding.Unicode.GetString(_sniSpnBuffer[0]) });
DavoudEshtehari marked this conversation as resolved.
Show resolved Hide resolved
sendBuff = _negotiateAuth.GetOutgoingBlob(receivedBuff, out NegotiateAuthenticationStatusCode statusCode)!;
SqlClientEventSource.Log.TryTraceEvent("TdsParserStateObjectManaged.GenerateSspiClientContext | Info | Session Id {0}, StatusCode={1}", _sessionHandle?.ConnectionId, statusCode);
if (statusCode is not NegotiateAuthenticationStatusCode.Completed and not NegotiateAuthenticationStatusCode.ContinueNeeded)
{
_sspiClientContextStatus = new SspiClientContextStatus();
throw new InvalidOperationException(SQLMessage.SSPIGenerateError() + "\n" + statusCode);
DavoudEshtehari marked this conversation as resolved.
Show resolved Hide resolved
}
#else
_sspiClientContextStatus ??= new SspiClientContextStatus();

SNIProxy.GenSspiClientContext(_sspiClientContextStatus, receivedBuff, ref sendBuff, _sniSpnBuffer);
SqlClientEventSource.Log.TryTraceEvent("TdsParserStateObjectManaged.GenerateSspiClientContext | Info | Session Id {0}", _sessionHandle?.ConnectionId);
#endif
sendLength = (uint)(sendBuff != null ? sendBuff.Length : 0);
return 0;
}
Expand Down
Loading
Loading