protected SslHandshakeStatus ProcessServerKeyExchange(HandshakeMessage message)
{
if (m_State != HandshakeType.Certificate)
{
throw new SslException(AlertDescription.UnexpectedMessage, "ServerKeyExchange message must be preceded by a Certificate message.");
}
CipherDefinition cd = CipherSuites.GetCipherDefinition(m_EncryptionScheme);
if (!cd.Exportable)
{
throw new SslException(AlertDescription.HandshakeFailure, "The ServerKeyExchange message should not be sent for non-exportable ciphers.");
}
if (m_RemoteCertificate.GetPublicKeyLength() <= 512)
{
throw new SslException(AlertDescription.HandshakeFailure, "The ServerKeyExchange message should not be sent because the server certificate public key is of exportable length.");
}
UpdateHashes(message, HashUpdate.All); // input message
// extract modulus and exponent
RSAParameters pars = new RSAParameters();
int size = message.fragment[0] * 256 + message.fragment[1];
pars.Modulus = new byte[size];
Buffer.BlockCopy(message.fragment, 2, pars.Modulus, 0, size);
int offset = size + 2;
size = message.fragment[offset] * 256 + message.fragment[offset + 1];
pars.Exponent = new byte[size];
Buffer.BlockCopy(message.fragment, offset + 2, pars.Exponent, 0, size);
offset += size + 2;
pars.Modulus = RemoveLeadingZeros(pars.Modulus);
pars.Exponent = RemoveLeadingZeros(pars.Exponent);
m_KeyCipher = new RSACryptoServiceProvider();
m_KeyCipher.ImportParameters(pars);
// compute verification hashes
MD5SHA1CryptoServiceProvider ms = new MD5SHA1CryptoServiceProvider();
ms.TransformBlock(m_ClientTime, 0, m_ClientTime.Length, m_ClientTime, 0);
ms.TransformBlock(m_ClientRandom, 0, m_ClientRandom.Length, m_ClientRandom, 0);
ms.TransformBlock(m_ServerTime, 0, m_ServerTime.Length, m_ServerTime, 0);
ms.TransformBlock(m_ServerRandom, 0, m_ServerRandom.Length, m_ServerRandom, 0);
ms.TransformFinalBlock(message.fragment, 0, offset);
// verify the signature
size = message.fragment[offset] * 256 + message.fragment[offset + 1];
byte[] signature = new byte[size]; // holds the signature returned by the server
Buffer.BlockCopy(message.fragment, offset + 2, signature, 0, size);
if (!ms.VerifySignature(m_RemoteCertificate, signature))
{
throw new SslException(AlertDescription.HandshakeFailure, "The data was not signed by the server certificate.");
}
ms.Clear();
return(new SslHandshakeStatus(SslStatus.MessageIncomplete, null));
}
protected SslHandshakeStatus ProcessCertificateRequest(HandshakeMessage message)
{
if (m_State == HandshakeType.ServerKeyExchange)
{
CipherDefinition cd = CipherSuites.GetCipherDefinition(m_EncryptionScheme);
if (this.m_RemoteCertificate.GetPublicKeyLength() <= 512 || !cd.Exportable)
{
throw new SslException(AlertDescription.HandshakeFailure, "Invalid message.");
}
}
else if (m_State != HandshakeType.Certificate)
{
throw new SslException(AlertDescription.UnexpectedMessage, "CertificateRequest message must be preceded by a Certificate or ServerKeyExchange message.");
}
UpdateHashes(message, HashUpdate.All); // input message
// get supported certificate types
bool supportsRsaCerts = false;
byte[] certTypes = new byte[message.fragment[0]]; // currently we're not doing anything with the supported certificate types
Buffer.BlockCopy(message.fragment, 1, certTypes, 0, certTypes.Length);
for (int i = 0; i < certTypes.Length; i++)
{
if (certTypes[i] == 1) // rsa_sign
{
supportsRsaCerts = true;
break;
}
}
// get list of distinguished names
if (m_Options.RequestHandler != null && supportsRsaCerts) // make sure the client passed a delegate
{
Queue q = new Queue();
DistinguishedNameList r = new DistinguishedNameList();
int size, offset = message.fragment[0] + 3;
byte[] buffer;
while (offset < message.fragment.Length)
{
size = message.fragment[offset] * 256 + message.fragment[offset + 1];
buffer = new byte[size];
Buffer.BlockCopy(message.fragment, offset + 2, buffer, 0, size);
q.Enqueue(buffer);
offset += size + 2;
}
// decode RDN structures
while (q.Count > 0)
{
r.Add(ProcessName((byte[])q.Dequeue()));
}
RequestEventArgs e = new RequestEventArgs();
try {
m_Options.RequestHandler(Parent, r, e);
if (e.Certificate != null)
{
m_Options.Certificate = e.Certificate;
}
} catch (Exception de) {
throw new SslException(de, AlertDescription.InternalError, "The code in the CertRequestEventHandler delegate threw an error.");
}
}
if (!supportsRsaCerts)
{
m_Options.Certificate = null; // do not send client certificate
}
m_MutualAuthentication = true;
return(new SslHandshakeStatus(SslStatus.MessageIncomplete, null));
}
protected SslHandshakeStatus GetClientHelloResult()
{
MemoryStream retMessage = new MemoryStream();
SslHandshakeStatus ret = new SslHandshakeStatus();
HandshakeMessage temp;
byte[] bytes;
// ServerHello message
temp = new HandshakeMessage(HandshakeType.ServerHello, new byte[38]);
m_ServerTime = GetUnixTime();
m_ServerRandom = new byte[28];
m_RNG.GetBytes(m_ServerRandom);
temp.fragment[0] = GetVersion().major;
temp.fragment[1] = GetVersion().minor;
Array.Copy(m_ServerTime, 0, temp.fragment, 2, 4);
Array.Copy(m_ServerRandom, 0, temp.fragment, 6, 28);
temp.fragment[34] = 0; // do not resume a session, and do not let the other side cache it
Array.Copy(CipherSuites.GetCipherAlgorithmBytes(m_EncryptionScheme), 0, temp.fragment, 35, 2);
temp.fragment[37] = CompressionAlgorithm.GetAlgorithmByte(m_CompressionMethod);
bytes = temp.ToBytes();
retMessage.Write(bytes, 0, bytes.Length);
// Certificate message
byte[] certs = GetCertificateList(m_Options.Certificate);
temp.type = HandshakeType.Certificate;
temp.fragment = certs;
bytes = temp.ToBytes();
retMessage.Write(bytes, 0, bytes.Length);
// ServerKeyExchange message [optional] => only with RSA_EXPORT and public key > 512 bits
if (m_Options.Certificate.GetPublicKeyLength() > 512 && CipherSuites.GetCipherDefinition(m_EncryptionScheme).Exportable)
{
MemoryStream kes = new MemoryStream();
MD5SHA1CryptoServiceProvider mscsp = new MD5SHA1CryptoServiceProvider();
// hash the client and server random values
mscsp.TransformBlock(m_ClientTime, 0, 4, m_ClientTime, 0);
mscsp.TransformBlock(m_ClientRandom, 0, 28, m_ClientRandom, 0);
mscsp.TransformBlock(m_ServerTime, 0, 4, m_ServerTime, 0);
mscsp.TransformBlock(m_ServerRandom, 0, 28, m_ServerRandom, 0);
// create a new 512 bit RSA key
m_KeyCipher = new RSACryptoServiceProvider(512);
RSAParameters p = m_KeyCipher.ExportParameters(false);
// write the key parameters to the output stream
bytes = new byte[] { (byte)(p.Modulus.Length / 256), (byte)(p.Modulus.Length % 256) };
kes.Write(bytes, 0, 2);
kes.Write(p.Modulus, 0, p.Modulus.Length);
mscsp.TransformBlock(bytes, 0, 2, bytes, 0);
mscsp.TransformBlock(p.Modulus, 0, p.Modulus.Length, p.Modulus, 0);
bytes = new byte[] { (byte)(p.Exponent.Length / 256), (byte)(p.Exponent.Length % 256) };
kes.Write(bytes, 0, 2);
kes.Write(p.Exponent, 0, p.Exponent.Length);
mscsp.TransformBlock(bytes, 0, 2, bytes, 0);
mscsp.TransformFinalBlock(p.Exponent, 0, p.Exponent.Length);
// create signature
bytes = mscsp.CreateSignature(m_Options.Certificate);
kes.Write(new byte[] { (byte)(bytes.Length / 256), (byte)(bytes.Length % 256) }, 0, 2);
kes.Write(bytes, 0, bytes.Length);
// write to output
temp.type = HandshakeType.ServerKeyExchange;
temp.fragment = kes.ToArray();
bytes = temp.ToBytes();
retMessage.Write(bytes, 0, bytes.Length);
kes.Close();
}
else
{
m_KeyCipher = (RSACryptoServiceProvider)m_Options.Certificate.PrivateKey;
}
// CertificateRequest message [optional]
if (m_MutualAuthentication)
{
bytes = GetDistinguishedNames();
if (bytes.Length != 0) // make sure at least one certificate is returned
{
temp.type = HandshakeType.CertificateRequest;
temp.fragment = new byte[bytes.Length + 4];
temp.fragment[0] = 1; // one certificate type supported
temp.fragment[1] = 1; // cert type RSA
temp.fragment[2] = (byte)(bytes.Length / 256);
temp.fragment[3] = (byte)(bytes.Length % 256);
Array.Copy(bytes, 0, temp.fragment, 4, bytes.Length);
bytes = temp.ToBytes();
retMessage.Write(bytes, 0, bytes.Length);
}
}
// ServerHelloDone message
temp.type = HandshakeType.ServerHelloDone;
temp.fragment = new byte[0];
bytes = temp.ToBytes();
retMessage.Write(bytes, 0, bytes.Length);
// final adjustments
ret.Status = SslStatus.ContinueNeeded;
ret.Message = retMessage.ToArray();
retMessage.Close();
UpdateHashes(ret.Message, HashUpdate.All); // output message
ret.Message = m_RecordLayer.EncryptBytes(ret.Message, 0, ret.Message.Length, ContentType.Handshake);
return(ret);
}
