kosipov/anti-syktsu-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix upstream proxy authentication

Browse Source
This commit is contained in:
kosipov
2026-04-11 12:05:15 +03:00
parent 406e6e2d92
commit 3746f79364
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
Program.cs
View File

@@ -692,6 +692,7 @@ sealed class SspiProxyAuthenticator : IDisposable
const int SECPKG_CRED_OUTBOUND = 2; const int SECPKG_CRED_OUTBOUND = 2;
const int SECURITY_NATIVE_DREP = 0x00000010; const int SECURITY_NATIVE_DREP = 0x00000010;
const int ISC_REQ_CONNECTION = 0x00000800; const int ISC_REQ_CONNECTION = 0x00000800;
const int ISC_REQ_ALLOCATE_MEMORY = 0x00000100;
const int SECBUFFER_VERSION = 0; const int SECBUFFER_VERSION = 0;
const int SECBUFFER_TOKEN = 2; const int SECBUFFER_TOKEN = 2;
const uint SEC_I_CONTINUE_NEEDED = 0x00090312; const uint SEC_I_CONTINUE_NEEDED = 0x00090312;
@@ -703,6 +704,7 @@ sealed class SspiProxyAuthenticator : IDisposable
bool _ctxInitialized; bool _ctxInitialized;
readonly string _package; readonly string _package;
readonly string _targetSpn; readonly string _targetSpn;
uint _lastStatus;
public SspiProxyAuthenticator(string package, string proxyHost) public SspiProxyAuthenticator(string package, string proxyHost)
{ {
@@ -713,6 +715,12 @@ sealed class SspiProxyAuthenticator : IDisposable
public string NextToken(string incomingBase64Token) public string NextToken(string incomingBase64Token)
{ {
if (!_credAcquired)
{
Log.Error($"SSPI AcquireCredentialsHandle failed for package {_package} (status=0x{_lastStatus:X8})");
return null;
}
byte[] inBytes = null; byte[] inBytes = null;
if (!string.IsNullOrWhiteSpace(incomingBase64Token)) if (!string.IsNullOrWhiteSpace(incomingBase64Token))
{ {
@@ -773,7 +781,7 @@ sealed class SspiProxyAuthenticator : IDisposable
ref _cred, ref _cred,
ref _ctx, ref _ctx,
_targetSpn, _targetSpn,
ISC_REQ_CONNECTION, ISC_REQ_CONNECTION | ISC_REQ_ALLOCATE_MEMORY,
0, 0,
SECURITY_NATIVE_DREP, SECURITY_NATIVE_DREP,
inDescPtr, inDescPtr,
@@ -789,7 +797,7 @@ sealed class SspiProxyAuthenticator : IDisposable
ref _cred, ref _cred,
IntPtr.Zero, IntPtr.Zero,
_targetSpn, _targetSpn,
ISC_REQ_CONNECTION, ISC_REQ_CONNECTION | ISC_REQ_ALLOCATE_MEMORY,
0, 0,
SECURITY_NATIVE_DREP, SECURITY_NATIVE_DREP,
inDescPtr, inDescPtr,
@@ -809,11 +817,17 @@ sealed class SspiProxyAuthenticator : IDisposable
_ctxInitialized = true; _ctxInitialized = true;
if (status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) if (status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED)
{
Log.Warn($"SSPI InitializeSecurityContext failed (package={_package}, status=0x{status:X8})");
return null; return null;
}
var finalOut = Marshal.PtrToStructure<SecBuffer>(outBufPtr); var finalOut = Marshal.PtrToStructure<SecBuffer>(outBufPtr);
if (finalOut.cbBuffer <= 0 || finalOut.pvBuffer == IntPtr.Zero) if (finalOut.cbBuffer <= 0 || finalOut.pvBuffer == IntPtr.Zero)
{
Log.Warn($"SSPI InitializeSecurityContext returned empty token (package={_package}, status=0x{status:X8})");
return null; return null;
}
var token = new byte[finalOut.cbBuffer]; var token = new byte[finalOut.cbBuffer];
Marshal.Copy(finalOut.pvBuffer, token, 0, token.Length); Marshal.Copy(finalOut.pvBuffer, token, 0, token.Length);
@@ -839,6 +853,7 @@ sealed class SspiProxyAuthenticator : IDisposable
IntPtr.Zero, IntPtr.Zero,
out _cred, out _cred,
out expiry); out expiry);
_lastStatus = status;
_credAcquired = status == SEC_E_OK; _credAcquired = status == SEC_E_OK;
} }