Things needing System.Net.Security.Native may not work on Bionic

[MichalStrehovsky]

#87595 (comment)

We're not building System.Net.Security.Native when targeting Bionic, but it also looks like the managed part is not configured in a way that would avoid calling into this library.

Cc @directhex

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

#87595 (comment)

We're not building System.Net.Security.Native when targeting Bionic, but it also looks like the managed part is not configured in a way that would avoid calling into this library.

Cc @directhex

Author:	MichalStrehovsky
Assignees:	-
Labels:	area-System.Net.Security, os-android
Milestone:	-

[wfurt]

Is this primarily about TLS? NegotiateStream will be probably partially fixed by #86948.

[filipnavara]

There's no GSSAPI on linux-bionic. We should get it to the same plan as Android (managed NTLM).

[filipnavara]

Actually, this is a bit tricky since there's no linux-bionic TFM, so we cannot easily make a special version of System.Net.Security assembly. My current plan is to consolidate all the "offending" code into that single assembly (prerequisities: #86948, #86956). Then we can decide what to do next. One option is to disable the GSSAPI (/System.Net.Security.Native) code paths at runtime. In fact, I wanted to offer an option to use the managed NTLM on macOS, so this would be very similar change.

[wfurt]

May also help with #87568. GSSAPI exist for Kerberos but not for NTLM. Maybe handle legacy NTLM in managed code and leave Negotiate to GSSAPI...?

[filipnavara]

Maybe handle legacy NTLM in managed code and leave Negotiate to GSSAPI...?

There are the multiple possible combinations:

1. Use GSSAPI for NTLM, Kerberos, and Negotiate
2. Use managed NTLM and Negotiate, no Kerberos
3. Use GSSAPI for Kerberos, managed for NTLM and Negotiate (wrapping both the Kerberos and NTLM)
4. Use GSSAPI for Kerberos and Negotiate, managed NTLM only when asked specifically for NTLM

Today we use option 1) on all platforms except Android and tvOS, which are on option 2).

I'd like to add an implementation of 3) with a configuration switch, and runtime fallback to 2) if GSSAPI is not available. I don't have a use case for option 4) but it would be generally easier to implement than option 3) if there's a strong desire or preference.

[wfurt]

Can we get 3) working? I was thinking originally about 4) as it would be simple split. And NTLM would work only for legacy.

[filipnavara]

Can we get 3) working?

I think we can. I may have even done that in one the stale branches last year...