Move NegotiateStreamPal.Encrypt/Decrypt to shared sources. Unix imple…

…mentation already had them and they get trimmed anyway.

src/libraries/Common/src/System/Net/Security/NegotiateStreamPal.Windows.cs

@@ -263,5 +263,201 @@ internal static int MakeSignature(SafeDeleteContext securityContext, byte[] buff
             // return signed size
             return securityBuffer[0].size + securityBuffer[1].size;
         }
+
+        internal static int Encrypt(
+            SafeDeleteContext securityContext,
+            ReadOnlySpan<byte> buffer,
+            bool isConfidential,
+            bool isNtlm,
+            [NotNull] ref byte[]? output,
+            uint sequenceNumber)
+        {
+            SecPkgContext_Sizes sizes = default;
+            bool success = SSPIWrapper.QueryBlittableContextAttributes(GlobalSSPI.SSPIAuth, securityContext, Interop.SspiCli.ContextAttribute.SECPKG_ATTR_SIZES, ref sizes);
+            Debug.Assert(success);
+
+            int maxCount = checked(int.MaxValue - 4 - sizes.cbBlockSize - sizes.cbSecurityTrailer);
+            if (buffer.Length > maxCount)
+            {
+                throw new ArgumentOutOfRangeException(nameof(buffer.Length), SR.Format(SR.net_io_out_range, maxCount));
+            }
+
+            int resultSize = buffer.Length + sizes.cbSecurityTrailer + sizes.cbBlockSize;
+            if (output == null || output.Length < resultSize + 4)
+            {
+                output = new byte[resultSize + 4];
+            }
+
+            // Make a copy of user data for in-place encryption.
+            buffer.CopyTo(output.AsSpan(4 + sizes.cbSecurityTrailer));
+
+            // Prepare buffers TOKEN(signature), DATA and Padding.
+            ThreeSecurityBuffers buffers = default;
+            var securityBuffer = MemoryMarshal.CreateSpan(ref buffers._item0, 3);
+            securityBuffer[0] = new SecurityBuffer(output, 4, sizes.cbSecurityTrailer, SecurityBufferType.SECBUFFER_TOKEN);
+            securityBuffer[1] = new SecurityBuffer(output, 4 + sizes.cbSecurityTrailer, buffer.Length, SecurityBufferType.SECBUFFER_DATA);
+            securityBuffer[2] = new SecurityBuffer(output, 4 + sizes.cbSecurityTrailer + buffer.Length, sizes.cbBlockSize, SecurityBufferType.SECBUFFER_PADDING);
+
+            int errorCode;
+            if (isConfidential)
+            {
+                errorCode = SSPIWrapper.EncryptMessage(GlobalSSPI.SSPIAuth, securityContext, securityBuffer, sequenceNumber);
+            }
+            else
+            {
+                if (isNtlm)
+                {
+                    securityBuffer[1].type |= SecurityBufferType.SECBUFFER_READONLY;
+                }
+
+                errorCode = SSPIWrapper.MakeSignature(GlobalSSPI.SSPIAuth, securityContext, securityBuffer, 0);
+            }
+
+            if (errorCode != 0)
+            {
+                Exception e = new Win32Exception(errorCode);
+                if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(null, e);
+                throw e;
+            }
+
+            // Compacting the result.
+            resultSize = securityBuffer[0].size;
+            bool forceCopy = false;
+            if (resultSize != sizes.cbSecurityTrailer)
+            {
+                forceCopy = true;
+                Buffer.BlockCopy(output, securityBuffer[1].offset, output, 4 + resultSize, securityBuffer[1].size);
+            }
+
+            resultSize += securityBuffer[1].size;
+            if (securityBuffer[2].size != 0 && (forceCopy || resultSize != (buffer.Length + sizes.cbSecurityTrailer)))
+            {
+                Buffer.BlockCopy(output, securityBuffer[2].offset, output, 4 + resultSize, securityBuffer[2].size);
+            }
+
+            resultSize += securityBuffer[2].size;
+            unchecked
+            {
+                output[0] = (byte)((resultSize) & 0xFF);
+                output[1] = (byte)(((resultSize) >> 8) & 0xFF);
+                output[2] = (byte)(((resultSize) >> 16) & 0xFF);
+                output[3] = (byte)(((resultSize) >> 24) & 0xFF);
+            }
+
+            return resultSize + 4;
+        }
+
+        internal static int Decrypt(
+            SafeDeleteContext securityContext,
+            byte[]? buffer,
+            int offset,
+            int count,
+            bool isConfidential,
+            bool isNtlm,
+            out int newOffset,
+            uint sequenceNumber)
+        {
+            if (offset < 0 || offset > (buffer == null ? 0 : buffer.Length))
+            {
+                Debug.Fail("Argument 'offset' out of range.");
+                throw new ArgumentOutOfRangeException(nameof(offset));
+            }
+
+            if (count < 0 || count > (buffer == null ? 0 : buffer.Length - offset))
+            {
+                Debug.Fail("Argument 'count' out of range.");
+                throw new ArgumentOutOfRangeException(nameof(count));
+            }
+
+            if (isNtlm)
+            {
+                return DecryptNtlm(securityContext, buffer, offset, count, isConfidential, out newOffset, sequenceNumber);
+            }
+
+            //
+            // Kerberos and up
+            //
+            TwoSecurityBuffers buffers = default;
+            var securityBuffer = MemoryMarshal.CreateSpan(ref buffers._item0, 2);
+            securityBuffer[0] = new SecurityBuffer(buffer, offset, count, SecurityBufferType.SECBUFFER_STREAM);
+            securityBuffer[1] = new SecurityBuffer(0, SecurityBufferType.SECBUFFER_DATA);
+
+            int errorCode;
+            if (isConfidential)
+            {
+                errorCode = SSPIWrapper.DecryptMessage(GlobalSSPI.SSPIAuth, securityContext, securityBuffer, sequenceNumber);
+            }
+            else
+            {
+                errorCode = SSPIWrapper.VerifySignature(GlobalSSPI.SSPIAuth, securityContext, securityBuffer, sequenceNumber);
+            }
+
+            if (errorCode != 0)
+            {
+                Exception e = new Win32Exception(errorCode);
+                if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(null, e);
+                throw e;
+            }
+
+            if (securityBuffer[1].type != SecurityBufferType.SECBUFFER_DATA)
+            {
+                throw new InternalException(securityBuffer[1].type);
+            }
+
+            newOffset = securityBuffer[1].offset;
+            return securityBuffer[1].size;
+        }
+
+        private static int DecryptNtlm(
+            SafeDeleteContext securityContext,
+            byte[]? buffer,
+            int offset,
+            int count,
+            bool isConfidential,
+            out int newOffset,
+            uint sequenceNumber)
+        {
+            const int ntlmSignatureLength = 16;
+            // For the most part the arguments are verified in Decrypt().
+            if (count < ntlmSignatureLength)
+            {
+                Debug.Fail("Argument 'count' out of range.");
+                throw new ArgumentOutOfRangeException(nameof(count));
+            }
+
+            TwoSecurityBuffers buffers = default;
+            var securityBuffer = MemoryMarshal.CreateSpan(ref buffers._item0, 2);
+            securityBuffer[0] = new SecurityBuffer(buffer, offset, ntlmSignatureLength, SecurityBufferType.SECBUFFER_TOKEN);
+            securityBuffer[1] = new SecurityBuffer(buffer, offset + ntlmSignatureLength, count - ntlmSignatureLength, SecurityBufferType.SECBUFFER_DATA);
+
+            int errorCode;
+            SecurityBufferType realDataType = SecurityBufferType.SECBUFFER_DATA;
+
+            if (isConfidential)
+            {
+                errorCode = SSPIWrapper.DecryptMessage(GlobalSSPI.SSPIAuth, securityContext, securityBuffer, sequenceNumber);
+            }
+            else
+            {
+                realDataType |= SecurityBufferType.SECBUFFER_READONLY;
+                securityBuffer[1].type = realDataType;
+                errorCode = SSPIWrapper.VerifySignature(GlobalSSPI.SSPIAuth, securityContext, securityBuffer, sequenceNumber);
+            }
+
+            if (errorCode != 0)
+            {
+                Exception e = new Win32Exception(errorCode);
+                if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(null, e);
+                throw new Win32Exception(errorCode);
+            }
+
+            if (securityBuffer[1].type != realDataType)
+            {
+                throw new InternalException(securityBuffer[1].type);
+            }
+
+            newOffset = securityBuffer[1].offset;
+            return securityBuffer[1].size;
+        }
     }
 }