Skip to content

Commit

Permalink
Fix SSPI ComputeIntegrityCheck with Sign level
Browse files Browse the repository at this point in the history
Fix calling NegotiateAuthentication.ComputeIntegrityCheck on SSPI when
the negotiation context was built with ProtectionLevel.Sign. The
SECQOP_WRAP_NO_ENCRYPT QoP flag should not be set when calling GetMIC as
no encryption is involved and some authentication providers fail when
this is set.

Fix dotnet#103461
  • Loading branch information
jborean93 committed Jul 28, 2024
1 parent 0912e94 commit 555de1a
Showing 1 changed file with 1 addition and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -587,8 +587,7 @@ public override unsafe void GetMIC(ReadOnlySpan<byte> message, IBufferWriter<byt
pBuffers = unmanagedBuffer
};

uint qop = IsEncrypted ? 0 : Interop.SspiCli.SECQOP_WRAP_NO_ENCRYPT;
int errorCode = Interop.SspiCli.MakeSignature(ref _securityContext._handle, qop, ref sdcInOut, 0);
int errorCode = Interop.SspiCli.MakeSignature(ref _securityContext._handle, 0, ref sdcInOut, 0);

if (errorCode != 0)
{
Expand Down

0 comments on commit 555de1a

Please sign in to comment.