GetPolicy() public static method

Returns a SP object that can be used to create SymmetricAlgorithm and HashAlgorithm objects.
public static GetPolicy ( int Index ) : SecurityPolicy
Index int
return SecurityPolicy
Ejemplo n.º 1
0
        /// <summary>2a) Receive a CookieResponse that contains a list of CAs, if you have
        /// a Certificate that supports one of the CAs send it along with a DHE
        /// and a list of your supported CAs in a DHEWithCertificateAndCAs.</summary>
        /// <param name="sa">A security association that we wish to perform the
        /// specified control operation on.</param>
        /// <param name="scm">The received SecurityControlMessage.</param>
        /// <param name="scm_reply">A prepared reply message (with headers and such.</param>
        /// <param name="return_path">Where to send the result.</param>
        /// <param name="low_level_sender">We expect the return_path to not be an edge or
        /// some other type of "low level" sender, so this contains the parsed out value.</param>
        protected void HandleControlCookieResponse(SecurityAssociation sa,
                                                   SecurityControlMessage scm, SecurityControlMessage scm_reply,
                                                   ISender return_path, ISender low_level_sender)
        {
            ProtocolLog.WriteIf(ProtocolLog.Security, GetHashCode() + " Received CookieResponse from: " + low_level_sender);
            if (sa == null)
            {
                throw new Exception("No valid SA!");
            }
            // This seems like unnecessary code
            scm_reply.Type = SecurityControlMessage.MessageType.CookieResponse;
            X509Certificate lcert = null;

            if (SecurityPolicy.GetPolicy(scm.SPI).PreExchangedKeys)
            {
                lcert = _ch.DefaultCertificate;
            }
            else
            {
                lcert = _ch.FindCertificate(scm.CAs);
            }

            sa.RemoteCookie.Value     = scm.LocalCookie;
            sa.LocalCertificate.Value = lcert;
            scm_reply.Certificate     = lcert.RawData;

            scm_reply.DHE          = sa.LDHE;
            scm_reply.LocalCookie  = scm.RemoteCookie;
            scm_reply.RemoteCookie = scm.LocalCookie;
            scm_reply.Type         = SecurityControlMessage.MessageType.DHEWithCertificateAndCAs;
            if (SecurityPolicy.GetPolicy(scm.SPI).PreExchangedKeys)
            {
                scm_reply.CAs = new List <MemBlock>(0);
            }
            else
            {
                scm_reply.CAs = _ch.SupportedCAs;
            }
            HashAlgorithm sha1 = new SHA1CryptoServiceProvider();

            lock (_private_key_lock) {
                scm_reply.Sign(_private_key, sha1);
            }

            sa.DHEWithCertificateAndCAsOutHash.Value = sha1.ComputeHash((byte[])scm_reply.Packet);
            ICopyable to_send = new CopyList(Security, SecureControl, scm_reply.Packet);

            _rrman.SendRequest(return_path, ReqrepManager.ReqrepType.Request,
                               to_send, this, sa);
            ProtocolLog.WriteIf(ProtocolLog.Security, GetHashCode() + " Successful CookieResponse from: " + low_level_sender);
        }
Ejemplo n.º 2
0
        /// <summary>2b) Receive a DHEWithCertificateAndCAs, verify the certificate and attempt
        /// to find a matching Certificate for the list of CAs, if you find one,
        /// finish the DHE handshake and send the certificate via a DHEWithCertificate</summary>
        /// <param name="sa">A security association that we wish to perform the
        /// specified control operation on.</param>
        /// <param name="scm">The received SecurityControlMessage.</param>
        /// <param name="scm_reply">A prepared reply message (with headers and such.</param>
        /// <param name="return_path">Where to send the result.</param>
        /// <param name="low_level_sender">We expect the return_path to not be an edge or
        /// some other type of "low level" sender, so this contains the parsed out value.</param>
        protected void HandleControlDHEWithCertificateAndCAs(SecurityAssociation sa,
                                                             SecurityControlMessage scm, SecurityControlMessage scm_reply,
                                                             ISender return_path, ISender low_level_sender)
        {
            ProtocolLog.WriteIf(ProtocolLog.Security, GetHashCode() + " Received DHEWithCertificateAndCAs from: " + low_level_sender);
            if (sa == null)
            {
                sa = CreateSecurityAssociation(low_level_sender, scm.SPI, false);
            }
            byte[] cert = new byte[scm.Certificate.Length];
            scm.Certificate.CopyTo(cert, 0);
            X509Certificate rcert = new X509Certificate(cert);

            _ch.Verify(rcert);
            HashAlgorithm sha1 = new SHA1CryptoServiceProvider();

            scm.Verify((RSACryptoServiceProvider)rcert.RSA, sha1);

            X509Certificate lcert = null;

            if (SecurityPolicy.GetPolicy(scm.SPI).PreExchangedKeys)
            {
                lcert = _ch.DefaultCertificate;
            }
            else
            {
                lcert = _ch.FindCertificate(scm.CAs);
            }

            sa.LocalCertificate.Value  = lcert;
            sa.RemoteCertificate.Value = rcert;
            sa.RDHE.Value = scm.DHE;
            sa.DHEWithCertificateAndCAsInHash.Value = MemBlock.Reference(sha1.ComputeHash((byte[])scm.Packet));

            scm_reply.LocalCookie  = scm.RemoteCookie;
            scm_reply.RemoteCookie = scm.LocalCookie;
            scm_reply.DHE          = sa.LDHE;
            scm_reply.Certificate  = MemBlock.Reference(lcert.RawData);
            scm_reply.Type         = SecurityControlMessage.MessageType.DHEWithCertificate;
            lock (_private_key_lock) {
                scm_reply.Sign(_private_key, sha1);
            }
            sa.DHEWithCertificateHash.Value = MemBlock.Reference(sha1.ComputeHash((byte[])scm_reply.Packet));

            ICopyable to_send = new CopyList(SecureControl, scm_reply.Packet);

            return_path.Send(to_send);
            ProtocolLog.WriteIf(ProtocolLog.Security, GetHashCode() + " Successful DHEWithCertificateAndCAs from: " + low_level_sender);
        }
Ejemplo n.º 3
0
        /// <summary>1b) Receive a Cookie which responds with a CookieResponse</summary>
        /// <param name="sa">A security association that we wish to perform the
        /// specified control operation on.</param>
        /// <param name="calc_cookie">Cookie value for the association sender.</param>
        /// <param name="scm">The received SecurityControlMessage.</param>
        /// <param name="scm_reply">A prepared reply message (with headers and such.</param>
        /// <param name="return_path">Where to send the result.</param>
        /// <param name="low_level_sender">We expect the return_path to not be an edge or
        /// some other type of "low level" sender, so this contains the parsed out value.</param>
        protected void HandleControlCookie(SecurityAssociation sa,
                                           MemBlock calc_cookie, SecurityControlMessage scm,
                                           SecurityControlMessage scm_reply, ISender return_path,
                                           ISender low_level_sender)
        {
            ProtocolLog.WriteIf(ProtocolLog.Security, GetHashCode() + " Received Cookie from: " + low_level_sender);
            scm_reply.Type         = SecurityControlMessage.MessageType.CookieResponse;
            scm_reply.RemoteCookie = scm.LocalCookie;
            scm_reply.LocalCookie  = calc_cookie;
            if (SecurityPolicy.GetPolicy(scm.SPI).PreExchangedKeys)
            {
                scm_reply.CAs = new List <MemBlock>(0);
            }
            else
            {
                scm_reply.CAs = _ch.SupportedCAs;
            }
            ICopyable to_send = new CopyList(SecureControl, scm_reply.Packet);

            return_path.Send(to_send);
            ProtocolLog.WriteIf(ProtocolLog.Security, GetHashCode() + " Successful Cookie from: " + low_level_sender);
        }
Ejemplo n.º 4
0
        ///<summary>Enables the SA if it has been properly setup.</summary>
        public void Enable()
        {
            // If both parties setup simultaneous SAs we could end up calling this
            // twice, once as a client and the other as server, this way we only
            // go through the whole process once.
            lock (_sync) {
                if (_called_enable == 1)
                {
                    return;
                }
                else if (_closed == 1)
                {
                    throw new Exception("Cannot enable a closed SA!");
                }
                else if (_ldhe == null)
                {
                    throw new Exception("Local DHE not set.");
                }
                else if (RDHE.Value == null)
                {
                    throw new Exception("Remote DHE not set.");
                }
                else if (!_hash_verified)
                {
                    throw new Exception("Hash is not verified!");
                }
                else if (TimedOut)
                {
                    throw new Exception("Timed out on this one!");
                }
                _called_enable = 1;

                // Deriving the DHE exchange and determing the order of keys
                // Specifically, we need up to 4 keys for the sender/receiver encryption/
                // authentication codes.  So to determine the order, we say whomever has
                // the smallest gets the first set of keys.
                byte[] rdhe = (byte[])RDHE.Value;
                RDHE = null;
                byte[] key = _dh.DecryptKeyExchange(rdhe);
                _dh.Clear();
                _dh = null;
                int i = 0;
                while (i < _ldhe.Length && _ldhe[i] == rdhe[i])
                {
                    i++;
                }
                bool same  = i == _ldhe.Length;
                bool first = !same && (_ldhe[i] < rdhe[i]);
                _ldhe = null;
                // Gathering our security parameter objects
                SecurityPolicy     sp     = SecurityPolicy.GetPolicy(_spi);
                SymmetricAlgorithm in_sa  = sp.CreateSymmetricAlgorithm();
                HashAlgorithm      in_ha  = sp.CreateHashAlgorithm();
                SymmetricAlgorithm out_sa = sp.CreateSymmetricAlgorithm();
                HashAlgorithm      out_ha = sp.CreateHashAlgorithm();

                // Generating the total key length
                int key_length             = key.Length + 2 + (in_sa.KeySize / 8 + in_sa.BlockSize / 8) * 2;
                KeyedHashAlgorithm in_kha  = in_ha as KeyedHashAlgorithm;
                KeyedHashAlgorithm out_kha = out_ha as KeyedHashAlgorithm;
                if (in_kha != null)
                {
                    key_length += (in_kha.HashSize / 8) * 2;
                }

                // Generating a key by repeatedly hashing the DHE value and the key so far
                SHA1CryptoServiceProvider sha1 = new SHA1CryptoServiceProvider();
                int usable_key_offset          = key.Length;
                while (key.Length < key_length)
                {
                    byte[] hash    = sha1.ComputeHash(key);
                    byte[] tmp_key = new byte[hash.Length + key.Length];
                    key.CopyTo(tmp_key, 0);
                    hash.CopyTo(tmp_key, key.Length);
                    key = tmp_key;
                }

                // Like a sub-session ID (see DTLS)
                short epoch = (short)((key[usable_key_offset] << 8) + key[usable_key_offset + 1]);
                usable_key_offset += 2;

                byte[] key0 = new byte[in_sa.KeySize / 8];
                Array.Copy(key, usable_key_offset, key0, 0, key0.Length);
                usable_key_offset += key0.Length;

                byte[] key1 = new byte[in_sa.KeySize / 8];
                Array.Copy(key, usable_key_offset, key1, 0, key1.Length);
                usable_key_offset += key1.Length;

                // Same may occur if we are forming a session with ourselves!
                if (same)
                {
                    in_sa.Key  = key0;
                    out_sa.Key = key0;
                }
                else if (first)
                {
                    in_sa.Key  = key0;
                    out_sa.Key = key1;
                }
                else
                {
                    out_sa.Key = key0;
                    in_sa.Key  = key1;
                }

                if (in_kha != null)
                {
                    byte[] hkey0 = new byte[in_kha.HashSize / 8];
                    Array.Copy(key, usable_key_offset, hkey0, 0, hkey0.Length);
                    usable_key_offset += hkey0.Length;

                    byte[] hkey1 = new byte[in_kha.HashSize / 8];
                    Array.Copy(key, usable_key_offset, hkey1, 0, hkey1.Length);
                    usable_key_offset += hkey1.Length;

                    if (same)
                    {
                        in_kha.Key  = hkey0;
                        out_kha.Key = hkey0;
                    }
                    else if (first)
                    {
                        in_kha.Key  = hkey0;
                        out_kha.Key = hkey1;
                    }
                    else
                    {
                        out_kha.Key = hkey0;
                        in_kha.Key  = hkey1;
                    }
                }

                SecurityHandler sh = new SecurityHandler(in_sa, out_sa, in_ha, out_ha, epoch);
                sh.Update += UpdateSH;
                SecurityHandler to_close = _current_sh;
                if (to_close != null)
                {
                    to_close.Close();
                }
                _current_sh    = sh;
                _last_epoch    = _current_epoch;
                _current_epoch = epoch;
            }
            // All finished set the state (which will probably fire an event)
            State = SAState.Active;
        }