|
| 1 | +using System; |
| 2 | +using System.IO; |
| 3 | +using System.Net; |
| 4 | +using System.Net.Security; |
| 5 | +using System.Security; |
| 6 | +using System.Security.Authentication; |
| 7 | +using System.Text; |
| 8 | +using System.Threading; |
| 9 | +using System.Threading.Tasks; |
| 10 | +using MySqlConnector.Core; |
| 11 | +using MySqlConnector.Utilities; |
| 12 | + |
| 13 | +namespace MySqlConnector.Protocol.Serialization |
| 14 | +{ |
| 15 | + internal class NegotiateStreamConstants |
| 16 | + { |
| 17 | + public const int HeaderLength = 5; |
| 18 | + public const byte MajorVersion = 1; |
| 19 | + public const byte MinorVersion = 0; |
| 20 | + public const byte HandshakeDone = 0x14; |
| 21 | + public const byte HandshakeError = 0x15; |
| 22 | + public const byte HandshakeInProgress = 0x16; |
| 23 | + public const ushort MaxPayloadLength = ushort.MaxValue; |
| 24 | + } |
| 25 | + |
| 26 | + /// <summary> |
| 27 | + /// Helper class to translate NegotiateStream framing for SPNEGO token |
| 28 | + /// into MySQL protocol packets. |
| 29 | + /// |
| 30 | + /// Serves as underlying stream for System.Net.NegotiateStream |
| 31 | + /// to perform MariaDB's auth_gssapi_client authentication. |
| 32 | + /// |
| 33 | + /// NegotiateStream protocol is described in e.g here |
| 34 | + /// https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-NNS/[MS-NNS].pdf |
| 35 | + /// We only use Handshake Messages for authentication. |
| 36 | + /// </summary> |
| 37 | + |
| 38 | + internal class NegotiateToMySqlConverterStream : Stream |
| 39 | + { |
| 40 | + bool m_clientHandshakeDone; |
| 41 | + |
| 42 | + MemoryStream m_readBuffer; |
| 43 | + MemoryStream m_writeBuffer; |
| 44 | + int m_writePayloadLength; |
| 45 | + ServerSession m_serverSession; |
| 46 | + IOBehavior m_ioBehavior; |
| 47 | + CancellationToken m_cancellationToken; |
| 48 | + |
| 49 | + public PayloadData MySQLProtocolPayload { get; private set; } |
| 50 | + public NegotiateToMySqlConverterStream(ServerSession serverSession, IOBehavior ioBehavior, CancellationToken cancellationToken) |
| 51 | + { |
| 52 | + m_serverSession = serverSession; |
| 53 | + m_readBuffer = new MemoryStream(); |
| 54 | + m_writeBuffer = new MemoryStream(); |
| 55 | + m_ioBehavior = ioBehavior; |
| 56 | + m_cancellationToken = cancellationToken; |
| 57 | + } |
| 58 | + |
| 59 | + static void CreateNegotiateStreamMessageHeader(byte[] buffer, int offset, byte messageId, long payloadLength) |
| 60 | + { |
| 61 | + buffer[offset] = messageId; |
| 62 | + buffer[offset+1] = NegotiateStreamConstants.MajorVersion; |
| 63 | + buffer[offset+2] = NegotiateStreamConstants.MinorVersion; |
| 64 | + buffer[offset+3] = (byte) (payloadLength >> 8); |
| 65 | + buffer[offset+4] = (byte) (payloadLength & 0xff); |
| 66 | + } |
| 67 | + public override async Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken) |
| 68 | + { |
| 69 | + var bytesRead = 0; |
| 70 | + |
| 71 | + if (m_readBuffer.Length == m_readBuffer.Position) |
| 72 | + { |
| 73 | + if (count < NegotiateStreamConstants.HeaderLength) |
| 74 | + throw new InvalidDataException("Unexpected call to read less then NegotiateStream header"); |
| 75 | + |
| 76 | + if (m_clientHandshakeDone) |
| 77 | + { |
| 78 | + // NegotiateStream protocol expects server to send "handshake done" |
| 79 | + // empty message at the end of handshake. |
| 80 | + CreateNegotiateStreamMessageHeader(buffer, offset, NegotiateStreamConstants.HandshakeDone, 0); |
| 81 | + return NegotiateStreamConstants.HeaderLength; |
| 82 | + } |
| 83 | + // Read and cache packet from server. |
| 84 | + var payload = await m_serverSession.ReceiveReplyAsync(m_ioBehavior, cancellationToken).ConfigureAwait(false); |
| 85 | + var segment = payload.ArraySegment; |
| 86 | + |
| 87 | + if (segment.Count > NegotiateStreamConstants.MaxPayloadLength) |
| 88 | + throw new InvalidDataException(String.Format("Payload too big for NegotiateStream - {0} bytes", segment.Count)); |
| 89 | + |
| 90 | + // Check the first byte of the incoming packet. |
| 91 | + // It can be an OK packet indicating end of server processing, |
| 92 | + // or it can be 0x01 prefix we must strip off - 0x01 server masks special bytes, e.g 0xff, 0xfe in the payload |
| 93 | + // during pluggable authentication packet exchanges. |
| 94 | + var segmentOffset = segment.Offset; |
| 95 | + var segmentCount = segment.Count; |
| 96 | + |
| 97 | + switch (segment.Array[segment.Offset]) |
| 98 | + { |
| 99 | + case 0x0: |
| 100 | + MySQLProtocolPayload = payload; |
| 101 | + CreateNegotiateStreamMessageHeader(buffer, offset, NegotiateStreamConstants.HandshakeDone, 0); |
| 102 | + return NegotiateStreamConstants.HeaderLength; |
| 103 | + case 0x1: |
| 104 | + segmentOffset++; |
| 105 | + segmentCount--; |
| 106 | + break; |
| 107 | + } |
| 108 | + |
| 109 | + m_readBuffer = new MemoryStream(segment.Array, segmentOffset, segmentCount); |
| 110 | + CreateNegotiateStreamMessageHeader(buffer, offset, NegotiateStreamConstants.HandshakeInProgress, m_readBuffer.Length); |
| 111 | + bytesRead = NegotiateStreamConstants.HeaderLength; |
| 112 | + offset += bytesRead; |
| 113 | + count -= bytesRead; |
| 114 | + } |
| 115 | + if (count > 0) |
| 116 | + { |
| 117 | + // Return cached data. |
| 118 | + bytesRead += m_readBuffer.Read(buffer, offset, count); |
| 119 | + } |
| 120 | + return bytesRead; |
| 121 | + } |
| 122 | + |
| 123 | + public override int Read(byte[] buffer, int offset, int count) => ReadAsync(buffer, offset, count, m_cancellationToken).GetAwaiter().GetResult(); |
| 124 | + |
| 125 | + public override async Task WriteAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken) |
| 126 | + { |
| 127 | + if (m_writePayloadLength == 0) |
| 128 | + { |
| 129 | + // The message header was not read yet. |
| 130 | + if (count < NegotiateStreamConstants.HeaderLength) |
| 131 | + // For simplicity, we expect header to be written in one go |
| 132 | + throw new InvalidDataException("Cannot parse NegotiateStream handshake message header"); |
| 133 | + |
| 134 | + // Parse NegotiateStream handshake header |
| 135 | + var messageId = buffer[offset+0]; |
| 136 | + var majorProtocolVersion = buffer[offset+1]; |
| 137 | + var minorProtocolVersion = buffer[offset+2]; |
| 138 | + var payloadSizeLow = buffer[offset+4]; |
| 139 | + var payloadSizeHigh = buffer[offset+3]; |
| 140 | + |
| 141 | + |
| 142 | + if (majorProtocolVersion != NegotiateStreamConstants.MajorVersion || |
| 143 | + minorProtocolVersion != NegotiateStreamConstants.MinorVersion) |
| 144 | + { |
| 145 | + throw new FormatException( |
| 146 | + String.Format("Unknown version of NegotiateStream protocol {0}.{1}, expected {2}.{3}", |
| 147 | + majorProtocolVersion, minorProtocolVersion, |
| 148 | + NegotiateStreamConstants.MajorVersion, NegotiateStreamConstants.MinorVersion)); |
| 149 | + } |
| 150 | + if (messageId != NegotiateStreamConstants.HandshakeDone && |
| 151 | + messageId != NegotiateStreamConstants.HandshakeError && |
| 152 | + messageId != NegotiateStreamConstants.HandshakeInProgress) |
| 153 | + { |
| 154 | + throw new FormatException( |
| 155 | + String.Format("Invalid NegotiateStream MessageId 0x{0:X2}", messageId)); |
| 156 | + } |
| 157 | + |
| 158 | + m_writePayloadLength = (int) payloadSizeLow + ((int) payloadSizeHigh << 8); |
| 159 | + if (messageId == NegotiateStreamConstants.HandshakeDone) |
| 160 | + m_clientHandshakeDone = true; |
| 161 | + |
| 162 | + count -= NegotiateStreamConstants.HeaderLength; |
| 163 | + } |
| 164 | + |
| 165 | + if (count == 0) |
| 166 | + return; |
| 167 | + |
| 168 | + if (count + m_writeBuffer.Length > m_writePayloadLength) |
| 169 | + throw new InvalidDataException("Attempt to write more than a single message"); |
| 170 | + |
| 171 | + PayloadData payload; |
| 172 | + if (count < m_writePayloadLength) |
| 173 | + { |
| 174 | + m_writeBuffer.Write(buffer, offset, count); |
| 175 | + if (m_writeBuffer.Length < m_writePayloadLength) |
| 176 | + // The message is only partially written |
| 177 | + return; |
| 178 | + |
| 179 | + var payloadBytes = m_writeBuffer.ToArray(); |
| 180 | + payload = new PayloadData(new ArraySegment<byte>(payloadBytes, 0, (int) m_writeBuffer.Length)); |
| 181 | + m_writeBuffer.SetLength(0); |
| 182 | + } |
| 183 | + else |
| 184 | + { |
| 185 | + // full payload provided |
| 186 | + payload = new PayloadData(new ArraySegment<byte>(buffer, offset, m_writePayloadLength)); |
| 187 | + } |
| 188 | + await m_serverSession.SendReplyAsync(payload, m_ioBehavior, cancellationToken).ConfigureAwait(false); |
| 189 | + // Need to parse NegotiateStream header next time |
| 190 | + m_writePayloadLength = 0; |
| 191 | + } |
| 192 | + |
| 193 | + public override void Write(byte[] buffer, int offset, int count) => WriteAsync(buffer, offset, count, m_cancellationToken).GetAwaiter().GetResult(); |
| 194 | + |
| 195 | + public override bool CanRead => true; |
| 196 | + |
| 197 | + public override bool CanSeek => false; |
| 198 | + |
| 199 | + public override bool CanWrite => true; |
| 200 | + |
| 201 | + public override long Length => throw new NotImplementedException(); |
| 202 | + |
| 203 | + public override long Position { get => throw new NotImplementedException(); set => throw new NotImplementedException(); } |
| 204 | + |
| 205 | + public override void Flush() |
| 206 | + { |
| 207 | + } |
| 208 | + |
| 209 | + public override long Seek(long offset, SeekOrigin origin) => throw new NotImplementedException(); |
| 210 | + |
| 211 | + public override void SetLength(long value) => throw new NotImplementedException(); |
| 212 | + |
| 213 | + } |
| 214 | + internal class AuthGSSAPI |
| 215 | + { |
| 216 | + private static string GetServicePrincipalName(byte[] switchRequest) |
| 217 | + { |
| 218 | + var reader = new ByteArrayReader(switchRequest.AsSpan()); |
| 219 | + return Encoding.UTF8.GetString(reader.ReadNullOrEofTerminatedByteString()); |
| 220 | + } |
| 221 | + public static async Task<PayloadData> AuthenticateAsync(ConnectionSettings cs, byte[] switchRequestPayloadData, |
| 222 | + ServerSession session, IOBehavior ioBehavior, CancellationToken cancellationToken) |
| 223 | + { |
| 224 | + using (var innerStream = new NegotiateToMySqlConverterStream(session, ioBehavior, cancellationToken)) |
| 225 | + using (var negotiateStream = new NegotiateStream(innerStream)) |
| 226 | + { |
| 227 | + var targetName =cs.ServerSPN ?? GetServicePrincipalName(switchRequestPayloadData); |
| 228 | +#if NETSTANDARD1_3 |
| 229 | + await negotiateStream.AuthenticateAsClientAsync(CredentialCache.DefaultNetworkCredentials, targetName).ConfigureAwait(false); |
| 230 | +#else |
| 231 | + if (ioBehavior == IOBehavior.Synchronous) |
| 232 | + { |
| 233 | + negotiateStream.AuthenticateAsClient(CredentialCache.DefaultNetworkCredentials, targetName); |
| 234 | + } |
| 235 | + else |
| 236 | + { |
| 237 | + await negotiateStream.AuthenticateAsClientAsync(CredentialCache.DefaultNetworkCredentials, targetName).ConfigureAwait(false); |
| 238 | + } |
| 239 | +#endif |
| 240 | + if (cs.ServerSPN != null && !negotiateStream.IsMutuallyAuthenticated) |
| 241 | + { |
| 242 | + // Negotiate used NTLM fallback, server name cannot be verified. |
| 243 | + throw new AuthenticationException(String.Format( |
| 244 | + "GSSAPI : Unable to verify server principal name using authentication type {0}", |
| 245 | + negotiateStream.RemoteIdentity?.AuthenticationType)); |
| 246 | + } |
| 247 | + if (innerStream.MySQLProtocolPayload.ArraySegment.Array != null) |
| 248 | + // return already pre-read OK packet. |
| 249 | + return innerStream.MySQLProtocolPayload; |
| 250 | + |
| 251 | + // Read final OK packet from server |
| 252 | + return await session.ReceiveReplyAsync(ioBehavior, cancellationToken).ConfigureAwait(false); |
| 253 | + } |
| 254 | + } |
| 255 | + } |
| 256 | +} |
0 commit comments