From 3746f793647bb6316604fd235de7c43654e2bcac Mon Sep 17 00:00:00 2001
From: kosipov <mail@kosipov.ru>
Date: Sat, 11 Apr 2026 12:05:15 +0300
Subject: [PATCH] Fix upstream proxy authentication

---
 Program.cs | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/Program.cs b/Program.cs
index d36c7d1..4b1d7f6 100644
--- a/Program.cs
+++ b/Program.cs
@@ -692,6 +692,7 @@ sealed class SspiProxyAuthenticator : IDisposable
     const int SECPKG_CRED_OUTBOUND = 2;
     const int SECURITY_NATIVE_DREP = 0x00000010;
     const int ISC_REQ_CONNECTION = 0x00000800;
+    const int ISC_REQ_ALLOCATE_MEMORY = 0x00000100;
     const int SECBUFFER_VERSION = 0;
     const int SECBUFFER_TOKEN = 2;
     const uint SEC_I_CONTINUE_NEEDED = 0x00090312;
@@ -703,6 +704,7 @@ sealed class SspiProxyAuthenticator : IDisposable
     bool _ctxInitialized;
     readonly string _package;
     readonly string _targetSpn;
+    uint _lastStatus;
 
     public SspiProxyAuthenticator(string package, string proxyHost)
     {
@@ -713,6 +715,12 @@ sealed class SspiProxyAuthenticator : IDisposable
 
     public string NextToken(string incomingBase64Token)
     {
+        if (!_credAcquired)
+        {
+            Log.Error($"SSPI AcquireCredentialsHandle failed for package {_package} (status=0x{_lastStatus:X8})");
+            return null;
+        }
+
         byte[] inBytes = null;
         if (!string.IsNullOrWhiteSpace(incomingBase64Token))
         {
@@ -773,7 +781,7 @@ sealed class SspiProxyAuthenticator : IDisposable
                         ref _cred,
                         ref _ctx,
                         _targetSpn,
-                        ISC_REQ_CONNECTION,
+                        ISC_REQ_CONNECTION | ISC_REQ_ALLOCATE_MEMORY,
                         0,
                         SECURITY_NATIVE_DREP,
                         inDescPtr,
@@ -789,7 +797,7 @@ sealed class SspiProxyAuthenticator : IDisposable
                         ref _cred,
                         IntPtr.Zero,
                         _targetSpn,
-                        ISC_REQ_CONNECTION,
+                        ISC_REQ_CONNECTION | ISC_REQ_ALLOCATE_MEMORY,
                         0,
                         SECURITY_NATIVE_DREP,
                         inDescPtr,
@@ -809,11 +817,17 @@ sealed class SspiProxyAuthenticator : IDisposable
 
             _ctxInitialized = true;
             if (status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED)
+            {
+                Log.Warn($"SSPI InitializeSecurityContext failed (package={_package}, status=0x{status:X8})");
                 return null;
+            }
 
             var finalOut = Marshal.PtrToStructure<SecBuffer>(outBufPtr);
             if (finalOut.cbBuffer <= 0 || finalOut.pvBuffer == IntPtr.Zero)
+            {
+                Log.Warn($"SSPI InitializeSecurityContext returned empty token (package={_package}, status=0x{status:X8})");
                 return null;
+            }
 
             var token = new byte[finalOut.cbBuffer];
             Marshal.Copy(finalOut.pvBuffer, token, 0, token.Length);
@@ -839,6 +853,7 @@ sealed class SspiProxyAuthenticator : IDisposable
             IntPtr.Zero,
             out _cred,
             out expiry);
+        _lastStatus = status;
         _credAcquired = status == SEC_E_OK;
     }