C# Security.ProtocolToken类代码示例

        private ProtocolToken GenerateAlertToken()
        {
            byte[] nextmsg = null;

            SecurityStatusPal status;
            status = GenerateToken(null, 0, 0, ref nextmsg);

            ProtocolToken token = new ProtocolToken(nextmsg, status);

            return token;
        }

 private void StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
 {
     if ((message == null) || (message.Size == 0))
     {
         throw exception;
     }
     if (asyncRequest == null)
     {
         this.InnerStream.Write(message.Payload, 0, message.Size);
     }
     else
     {
         asyncRequest.AsyncState = exception;
         IAsyncResult asyncResult = this.InnerStream.BeginWrite(message.Payload, 0, message.Size, _WriteCallback, asyncRequest);
         if (!asyncResult.CompletedSynchronously)
         {
             return;
         }
         this.InnerStream.EndWrite(asyncResult);
     }
     throw exception;
 }

        /*++
            VerifyRemoteCertificate - Validates the content of a Remote Certificate

            checkCRL if true, checks the certificate revocation list for validity.
            checkCertName, if true checks the CN field of the certificate
        --*/

        //This method validates a remote certificate.
        //SECURITY: The scenario is allowed in semitrust StorePermission is asserted for Chain.Build
        //          A user callback has unique signature so it is safe to call it under permission assert.
        //
        internal bool VerifyRemoteCertificate(RemoteCertValidationCallback remoteCertValidationCallback, ref ProtocolToken alertToken)
        {
            if (GlobalLog.IsEnabled)
            {
                GlobalLog.Enter("SecureChannel#" + LoggingHash.HashString(this) + "::VerifyRemoteCertificate");
            }

            SslPolicyErrors sslPolicyErrors = SslPolicyErrors.None;

            // We don't catch exceptions in this method, so it's safe for "accepted" be initialized with true.
            bool success = false;
            X509Chain chain = null;
            X509Certificate2 remoteCertificateEx = null;

            try
            {
                X509Certificate2Collection remoteCertificateStore;
                remoteCertificateEx = CertificateValidationPal.GetRemoteCertificate(_securityContext, out remoteCertificateStore);
                _isRemoteCertificateAvailable = remoteCertificateEx != null;

                if (remoteCertificateEx == null)
                {
                    if (GlobalLog.IsEnabled)
                    {
                        GlobalLog.Leave("SecureChannel#" + LoggingHash.HashString(this) + "::VerifyRemoteCertificate (no remote cert)", (!_remoteCertRequired).ToString());
                    }
                    sslPolicyErrors |= SslPolicyErrors.RemoteCertificateNotAvailable;
                }
                else
                {
                    chain = new X509Chain();
                    chain.ChainPolicy.RevocationMode = _checkCertRevocation ? X509RevocationMode.Online : X509RevocationMode.NoCheck;
                    chain.ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
                    if (remoteCertificateStore != null)
                    {
                        chain.ChainPolicy.ExtraStore.AddRange(remoteCertificateStore);
                    }

                    sslPolicyErrors |= CertificateValidationPal.VerifyCertificateProperties(
                        chain,
                        remoteCertificateEx,
                        _checkCertName,
                        _serverMode,
                        _hostName);
                }

                if (remoteCertValidationCallback != null)
                {
                    success = remoteCertValidationCallback(_hostName, remoteCertificateEx, chain, sslPolicyErrors);
                }
                else
                {
                    if (sslPolicyErrors == SslPolicyErrors.RemoteCertificateNotAvailable && !_remoteCertRequired)
                    {
                        success = true;
                    }
                    else
                    {
                        success = (sslPolicyErrors == SslPolicyErrors.None);
                    }
                }

                if (SecurityEventSource.Log.IsEnabled())
                {
                    LogCertificateValidation(remoteCertValidationCallback, sslPolicyErrors, success, chain);
                }

                if (GlobalLog.IsEnabled)
                {
                    GlobalLog.Print("Cert Validation, remote cert = " + (remoteCertificateEx == null ? "<null>" : remoteCertificateEx.ToString(true)));
                }

                if (!success)
                {
                    alertToken = CreateFatalHandshakeAlertToken(sslPolicyErrors, chain);
                }
            }
            finally
            {
                // At least on Win2k server the chain is found to have dependencies on the original cert context.
                // So it should be closed first.
                if (chain != null)
                {
                    chain.Dispose();
                }

                if (remoteCertificateEx != null)
                {
                    remoteCertificateEx.Dispose();
//.........这里部分代码省略.........

        //
        // Only processing SEC_I_RENEGOTIATE.
        //
        private int ProcessReadErrorCode(SecurityStatusPal status, byte[] buffer, int offset, int count, AsyncProtocolRequest asyncRequest, byte[] extraBuffer)
        {
            ProtocolToken message = new ProtocolToken(null, status);

            if (GlobalLog.IsEnabled)
            {
                GlobalLog.Print("SecureChannel#" + LoggingHash.HashString(this) + "::***Processing an error Status = " + message.Status.ToString());
            }

            if (message.Renegotiate)
            {
                _sslState.ReplyOnReAuthentication(extraBuffer);

                // Loop on read.
                return -1;
            }

            if (message.CloseConnection)
            {
                _sslState.FinishRead(null);
                if (asyncRequest != null)
                {
                    asyncRequest.CompleteUser((object)0);
                }

                return 0;
            }

            throw new IOException(SR.net_io_decrypt, message.GetException());
        }

        private void ProcessReceivedBlob(byte[] buffer, int count, AsyncProtocolRequest asyncRequest)
        {
            if (count == 0)
            {
                // EOF received.
                throw new AuthenticationException(SR.net_auth_eof, null);
            }

            if (_pendingReHandshake)
            {
                int offset = 0;
                SecurityStatusPal status = PrivateDecryptData(buffer, ref offset, ref count);

                if (status.ErrorCode == SecurityStatusPalErrorCode.OK)
                {
                    Exception e = EnqueueOldKeyDecryptedData(buffer, offset, count);
                    if (e != null)
                    {
                        StartSendAuthResetSignal(null, asyncRequest, ExceptionDispatchInfo.Capture(e));
                        return;
                    }

                    _Framing = Framing.Unknown;
                    StartReceiveBlob(buffer, asyncRequest);
                    return;
                }
                else if (status.ErrorCode != SecurityStatusPalErrorCode.Renegotiate)
                {
                    // Fail re-handshake.
                    ProtocolToken message = new ProtocolToken(null, status);
                    StartSendAuthResetSignal(null, asyncRequest, ExceptionDispatchInfo.Capture(new AuthenticationException(SR.net_auth_SSPI, message.GetException())));
                    return;
                }

                // We expect only handshake messages from now.
                _pendingReHandshake = false;
                if (offset != 0)
                {
                    Buffer.BlockCopy(buffer, offset, buffer, 0, count);
                }
            }
            StartSendBlob(buffer, count, asyncRequest);
        }

        //
        // Codes we process (Anything else - fail)
        //
        // - SEC_I_RENEGOTIATE
        //
        private int ProcessReadErrorCode(SecurityStatus errorCode, byte[] buffer, int offset, int count, AsyncProtocolRequest asyncRequest, byte[] extraBuffer)
        {
            // ERROR - examine what kind
            ProtocolToken message = new ProtocolToken(null, errorCode);

            GlobalLog.Print("SecureChannel#" + ValidationHelper.HashString(this) + "::***Processing an error Status = " + message.Status.ToString());

            if (message.Renegotiate)
            {
                _SslState.ReplyOnReAuthentication(extraBuffer);
                // loop on read
                return -1;
            }
            if (message.CloseConnection) {
                _SslState.FinishRead(null);
                if (asyncRequest != null)
                {
                    asyncRequest.CompleteUser((object)0);
                }
                return 0;
            }
            // Otherwise bail out.
            throw new IOException(SR.GetString(SR.net_io_decrypt), message.GetException());
        }

        // - Loads the channel parameters
        // - Optionally verifies the Remote Certificate
        // - Sets HandshakeCompleted flag
        // - Sets the guarding event if other thread is waiting for
        //   handshake completion
        //
        // - Returns false if failed to verify the Remote Cert
        //
        private bool CompleteHandshake(ref ProtocolToken alertToken)
        {
            if (NetEventSource.IsEnabled) NetEventSource.Enter(this);

            Context.ProcessHandshakeSuccess();

            if (!Context.VerifyRemoteCertificate(_certValidationDelegate, ref alertToken))
            {
                _handshakeCompleted = false;
                _certValidationFailed = true;

                if (NetEventSource.IsEnabled) NetEventSource.Exit(this, false);
                return false;
            }

            _certValidationFailed = false;
            _handshakeCompleted = true;

            if (NetEventSource.IsEnabled) NetEventSource.Exit(this, true);
            return true;
        }

 private void StartWriting(byte[] buffer, int offset, int count, AsyncProtocolRequest asyncRequest)
 {
     if (asyncRequest != null)
     {
         asyncRequest.SetNextRequest(buffer, offset, count, _ResumeAsyncWriteCallback);
     }
     if (count >= 0)
     {
         byte[] outBuffer = null;
         do
         {
             int num2;
             if (this._SslState.CheckEnqueueWrite(asyncRequest))
             {
                 return;
             }
             int num = Math.Min(count, this._SslState.MaxDataSize);
             SecurityStatus errorCode = this._SslState.EncryptData(buffer, offset, num, ref outBuffer, out num2);
             if (errorCode != SecurityStatus.OK)
             {
                 ProtocolToken token = new ProtocolToken(null, errorCode);
                 throw new IOException(SR.GetString("net_io_encrypt"), token.GetException());
             }
             if (asyncRequest != null)
             {
                 asyncRequest.SetNextRequest(buffer, offset + num, count - num, _ResumeAsyncWriteCallback);
                 IAsyncResult asyncResult = this._SslState.InnerStream.BeginWrite(outBuffer, 0, num2, _WriteCallback, asyncRequest);
                 if (!asyncResult.CompletedSynchronously)
                 {
                     return;
                 }
                 this._SslState.InnerStream.EndWrite(asyncResult);
             }
             else
             {
                 this._SslState.InnerStream.Write(outBuffer, 0, num2);
             }
             offset += num;
             count -= num;
             this._SslState.FinishWrite();
         }
         while (count != 0);
     }
     if (asyncRequest != null)
     {
         asyncRequest.CompleteUser();
     }
 }

        //
        internal ProtocolToken NextMessage(byte[] incoming, int offset, int count)
        {
            if (NetEventSource.IsEnabled) NetEventSource.Enter(this);

            byte[] nextmsg = null;
            SecurityStatusPal status = GenerateToken(incoming, offset, count, ref nextmsg);

            if (!_serverMode && status.ErrorCode == SecurityStatusPalErrorCode.CredentialsNeeded)
            {
                if (NetEventSource.IsEnabled) NetEventSource.Info(this, "NextMessage() returned SecurityStatusPal.CredentialsNeeded");

                SetRefreshCredentialNeeded();
                status = GenerateToken(incoming, offset, count, ref nextmsg);
            }

            ProtocolToken token = new ProtocolToken(nextmsg, status);
            if (NetEventSource.IsEnabled) NetEventSource.Exit(this, token);
            return token;
        }

 private int ProcessReadErrorCode(SecurityStatus errorCode, byte[] buffer, int offset, int count, AsyncProtocolRequest asyncRequest, byte[] extraBuffer)
 {
     ProtocolToken token = new ProtocolToken(null, errorCode);
     if (token.Renegotiate)
     {
         this._SslState.ReplyOnReAuthentication(extraBuffer);
         return -1;
     }
     if (!token.CloseConnection)
     {
         throw new IOException(SR.GetString("net_io_decrypt"), token.GetException());
     }
     this._SslState.FinishRead(null);
     if (asyncRequest != null)
     {
         asyncRequest.CompleteUser(0);
     }
     return 0;
 }

 private BufferOffsetSize[] EncryptBuffers(BufferOffsetSize[] buffers, byte[] lastHandshakePayload)
 {
     List<BufferOffsetSize> list = null;
     SecurityStatus oK = SecurityStatus.OK;
     foreach (BufferOffsetSize size in buffers)
     {
         int num2;
         int count = Math.Min(size.Size, this._SslState.MaxDataSize);
         byte[] outBuffer = null;
         oK = this._SslState.EncryptData(size.Buffer, size.Offset, count, ref outBuffer, out num2);
         if (oK != SecurityStatus.OK)
         {
             break;
         }
         if ((count != size.Size) || (list != null))
         {
             if (list == null)
             {
                 list = new List<BufferOffsetSize>(buffers.Length * ((size.Size / count) + 1));
                 if (lastHandshakePayload != null)
                 {
                     list.Add(new BufferOffsetSize(lastHandshakePayload, false));
                 }
                 foreach (BufferOffsetSize size2 in buffers)
                 {
                     if (size2 == size)
                     {
                         break;
                     }
                     list.Add(size2);
                 }
             }
             list.Add(new BufferOffsetSize(outBuffer, 0, num2, false));
             while ((size.Size -= count) != 0)
             {
                 size.Offset += count;
                 count = Math.Min(size.Size, this._SslState.MaxDataSize);
                 oK = this._SslState.EncryptData(size.Buffer, size.Offset, count, ref outBuffer, out num2);
                 if (oK != SecurityStatus.OK)
                 {
                     break;
                 }
                 list.Add(new BufferOffsetSize(outBuffer, 0, num2, false));
             }
         }
         else
         {
             size.Buffer = outBuffer;
             size.Offset = 0;
             size.Size = num2;
         }
         if (oK != SecurityStatus.OK)
         {
             break;
         }
     }
     if (oK != SecurityStatus.OK)
     {
         ProtocolToken token = new ProtocolToken(null, oK);
         throw new IOException(SR.GetString("net_io_encrypt"), token.GetException());
     }
     if (list != null)
     {
         buffers = list.ToArray();
         return buffers;
     }
     if (lastHandshakePayload != null)
     {
         BufferOffsetSize[] destinationArray = new BufferOffsetSize[buffers.Length + 1];
         Array.Copy(buffers, 0, destinationArray, 1, buffers.Length);
         destinationArray[0] = new BufferOffsetSize(lastHandshakePayload, false);
         buffers = destinationArray;
     }
     return buffers;
 }

        //
        private void StartWriting(byte[] buffer, int offset, int count, AsyncProtocolRequest asyncRequest)
        {
            if (asyncRequest != null)
            {
                asyncRequest.SetNextRequest(buffer, offset, count, _ResumeAsyncWriteCallback);
            }

            // We loop to this method from the callback
            // If the last chunk was just completed from async callback (count < 0), we complete user request
            if (count >= 0 )
            {
                byte[] outBuffer = null;
                do
                {
                    // request a write IO slot
                    if (_SslState.CheckEnqueueWrite(asyncRequest))
                    {
                        // operation is async and has been queued, return.
                        return;
                    }

                    int chunkBytes = Math.Min(count, _SslState.MaxDataSize);
                    int encryptedBytes;
                    SecurityStatus errorCode =  _SslState.EncryptData(buffer, offset, chunkBytes, ref outBuffer, out encryptedBytes);
                    if (errorCode != SecurityStatus.OK)
                    {
                        //
                        ProtocolToken message = new ProtocolToken(null, errorCode);
                        throw new IOException(SR.GetString(SR.net_io_encrypt), message.GetException());
                    }

                    if (asyncRequest != null)
                    {
                        // prepare for the next request
                        asyncRequest.SetNextRequest(buffer, offset+chunkBytes, count-chunkBytes, _ResumeAsyncWriteCallback);
                        IAsyncResult ar = _SslState.InnerStream.BeginWrite(outBuffer, 0, encryptedBytes, _WriteCallback, asyncRequest);
                        if (!ar.CompletedSynchronously)
                        {
                            return;
                        }
                        _SslState.InnerStream.EndWrite(ar);

                    }
                    else
                    {
                        _SslState.InnerStream.Write(outBuffer, 0, encryptedBytes);
                    }
                    offset += chunkBytes;
                    count  -= chunkBytes;

                    // release write IO slot
                    _SslState.FinishWrite();

                } while (count != 0);
            }

            if (asyncRequest != null) {
                asyncRequest.CompleteUser();
            }
        }

        private int ProcessReadErrorCode(SecurityStatusPal status, byte[] buffer, int offset, int count, AsyncProtocolRequest asyncRequest, byte[] extraBuffer)
        {
            ProtocolToken message = new ProtocolToken(null, status);
            if (NetEventSource.IsEnabled) NetEventSource.Info(null, $"***Processing an error Status = {message.Status}");

            if (message.Renegotiate)
            {
                _sslState.ReplyOnReAuthentication(extraBuffer);

                // Loop on read.
                return -1;
            }

            if (message.CloseConnection)
            {
                _sslState.FinishRead(null);
                if (asyncRequest != null)
                {
                    asyncRequest.CompleteUser((object)0);
                }

                return 0;
            }

            throw new IOException(SR.net_io_decrypt, message.GetException());
        }

 private void CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
 {
     if (message.Failed)
     {
         this.StartSendAuthResetSignal(null, asyncRequest, new AuthenticationException(SR.GetString("net_auth_SSPI"), message.GetException()));
     }
     else if (message.Done && !this._PendingReHandshake)
     {
         if (this.CheckWin9xCachedSession())
         {
             this._PendingReHandshake = true;
             this.Win9xSessionRestarted();
             this.ForceAuthentication(false, null, asyncRequest);
         }
         else if (!this.CompleteHandshake())
         {
             this.StartSendAuthResetSignal(null, asyncRequest, new AuthenticationException(SR.GetString("net_ssl_io_cert_validation"), null));
         }
         else
         {
             this.FinishHandshake(null, asyncRequest);
         }
     }
     else
     {
         this.StartReceiveBlob(message.Payload, asyncRequest);
     }
 }

        //
        internal ProtocolToken NextMessage(byte[] incoming, int offset, int count)
        {
            if (GlobalLog.IsEnabled)
            {
                GlobalLog.Enter("SecureChannel#" + LoggingHash.HashString(this) + "::NextMessage");
            }

            byte[] nextmsg = null;
            SecurityStatusPal status = GenerateToken(incoming, offset, count, ref nextmsg);

            if (!_serverMode && status.ErrorCode == SecurityStatusPalErrorCode.CredentialsNeeded)
            {
                if (GlobalLog.IsEnabled)
                {
                    GlobalLog.Print("SecureChannel#" + LoggingHash.HashString(this) + "::NextMessage() returned SecurityStatusPal.CredentialsNeeded");
                }

                SetRefreshCredentialNeeded();
                status = GenerateToken(incoming, offset, count, ref nextmsg);
            }

            ProtocolToken token = new ProtocolToken(nextmsg, status);
            if (GlobalLog.IsEnabled)
            {
                GlobalLog.Leave("SecureChannel#" + LoggingHash.HashString(this) + "::NextMessage", token.ToString());
            }
            return token;
        }