Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

improve handling of handshake failure #35549

Merged
merged 9 commits into from
May 7, 2020
Merged

improve handling of handshake failure #35549

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ba45dad
improve handling of handshake failure
wfurt Apr 28, 2020
80df4d7
more cleanup
Apr 28, 2020
c610a8a
remove console reference
Apr 28, 2020
f3c8e6d
add quotes around parameter
Apr 28, 2020
eb6acb2
enable ServerAsyncAuthenticate_MismatchProtocols_Fails
wfurt Apr 30, 2020
db8ffba
cleanup ssl2 test
May 4, 2020
364093a
fix http2
May 4, 2020
9245919
feedback from review
wfurt May 7, 2020
5b98319
add back two missing empty lines
wfurt May 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/libraries/System.Net.Security/src/Resources/Strings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,9 @@
<data name="net_auth_eof" xml:space="preserve">
<value>Authentication failed because the remote party has closed the transport stream.</value>
</data>
<data name="net_auth_tls_alert" xml:space="preserve">
<value>Authentication failed because the remote party has sent TLS alert {0}.</value>
wfurt marked this conversation as resolved.
Show resolved Hide resolved
</data>
<data name="net_auth_alert" xml:space="preserve">
<value>Authentication failed on the remote side (the stream might still be available for additional authentication attempts).</value>
</data>
Expand Down
1 change: 1 addition & 0 deletions src/libraries/System.Net.Security/src/System.Net.Security.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@
<Compile Include="System\Net\Security\StreamSizes.cs" />
<Compile Include="System\Net\Security\TlsAlertType.cs" />
<Compile Include="System\Net\Security\TlsAlertMessage.cs" />
<Compile Include="System\Net\Security\TlsFrameHelper.cs" />
<Compile Include="System\Security\Authentication\AuthenticationException.cs" />
<!-- NegotiateStream -->
<Compile Include="System\Net\BufferAsyncResult.cs" />
Expand Down
10 changes: 5 additions & 5 deletions src/libraries/System.Net.Security/src/System/Net/Security/SecureChannel.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -625,7 +625,7 @@ private bool AcquireClientCredentials(ref byte[]? thumbPrint)
//
// Acquire Server Side Certificate information and set it on the class.
//
private bool AcquireServerCredentials(ref byte[]? thumbPrint, ReadOnlySpan<byte> clientHello)
private bool AcquireServerCredentials(ref byte[]? thumbPrint)
{
if (NetEventSource.IsEnabled)
NetEventSource.Enter(this);
Expand All @@ -639,13 +639,13 @@ private bool AcquireServerCredentials(ref byte[]? thumbPrint, ReadOnlySpan<byte>
// with .NET Framework), and if neither is set we fall back to using ServerCertificate.
if (_sslAuthenticationOptions.ServerCertSelectionDelegate != null)
{
string? serverIdentity = SniHelper.GetServerName(clientHello);
localCertificate = _sslAuthenticationOptions.ServerCertSelectionDelegate(serverIdentity);

localCertificate = _sslAuthenticationOptions.ServerCertSelectionDelegate(_sslAuthenticationOptions.TargetHost);
if (localCertificate == null)
{
throw new AuthenticationException(SR.net_ssl_io_no_server_cert);
}
if (NetEventSource.IsEnabled)
NetEventSource.Info(this, "Use delegate selected Cert");
wfurt marked this conversation as resolved.
Show resolved Hide resolved
}
else if (_sslAuthenticationOptions.CertSelectionDelegate != null)
{
Expand Down Expand Up @@ -784,7 +784,7 @@ private SecurityStatusPal GenerateToken(ReadOnlySpan<byte> inputBuffer, ref byte
if (_refreshCredentialNeeded)
{
cachedCreds = _sslAuthenticationOptions.IsServer
? AcquireServerCredentials(ref thumbPrint, inputBuffer)
? AcquireServerCredentials(ref thumbPrint)
: AcquireClientCredentials(ref thumbPrint);
}

Expand Down
18 changes: 4 additions & 14 deletions src/libraries/System.Net.Security/src/System/Net/Security/SniHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,13 +26,13 @@ internal class SniHelper
// opaque fragment[SSLPlaintext.length];
// } SSLPlaintext;
const int ContentTypeOffset = 0;
const int ProtocolVersionOffset = ContentTypeOffset + sizeof(ContentType);
const int ProtocolVersionOffset = ContentTypeOffset + sizeof(TlsContentType);
const int LengthOffset = ProtocolVersionOffset + ProtocolVersionSize;
const int HandshakeOffset = LengthOffset + sizeof(ushort);

// SSL v2's ContentType has 0x80 bit set.
// We do not care about SSL v2 here because it does not support client hello extensions
if (sslPlainText.Length < HandshakeOffset || (ContentType)sslPlainText[ContentTypeOffset] != ContentType.Handshake)
if (sslPlainText.Length < HandshakeOffset || (TlsContentType)sslPlainText[ContentTypeOffset] != TlsContentType.Handshake)
{
return null;
}
Expand Down Expand Up @@ -62,10 +62,10 @@ internal class SniHelper
// } body;
// } Handshake;
const int HandshakeTypeOffset = 0;
const int ClientHelloLengthOffset = HandshakeTypeOffset + sizeof(HandshakeType);
const int ClientHelloLengthOffset = HandshakeTypeOffset + sizeof(TlsHandshakeType);
const int ClientHelloOffset = ClientHelloLengthOffset + UInt24Size;

if (sslHandshake.Length < ClientHelloOffset || (HandshakeType)sslHandshake[HandshakeTypeOffset] != HandshakeType.ClientHello)
if (sslHandshake.Length < ClientHelloOffset || (TlsHandshakeType)sslHandshake[HandshakeTypeOffset] != TlsHandshakeType.ClientHello)
{
return null;
}
Expand Down Expand Up @@ -363,16 +363,6 @@ private static Encoding CreateEncoding()
return Encoding.GetEncoding("utf-8", new EncoderExceptionFallback(), new DecoderExceptionFallback());
}

private enum ContentType : byte
{
Handshake = 0x16
}

private enum HandshakeType : byte
{
ClientHello = 0x01
}

private enum ExtensionType : ushort
{
ServerName = 0x00
Expand Down
Loading