带TLS/SSL的异步套接字
本文关键字:异步 套接字 SSL TLS | 更新日期: 2023-09-27 18:20:58
我在MSDN上看到了以下示例程序:异步套接字。我试过这个程序,运行正常。是否可以修改异步套接字以支持TLS/SSL?怎么做?
using System;
using System.Net;
using System.Net.Sockets;
using System.Text;
using System.Threading;
// State object for reading client data asynchronously
public class StateObject {
// Client socket.
public Socket workSocket = null;
// Size of receive buffer.
public const int BufferSize = 1024;
// Receive buffer.
public byte[] buffer = new byte[BufferSize];
// Received data string.
public StringBuilder sb = new StringBuilder();
}
public class AsynchronousSocketListener {
// Thread signal.
public static ManualResetEvent allDone = new ManualResetEvent(false);
public static void StartListening() {
// Data buffer for incoming data.
byte[] bytes = new Byte[1024];
// Establish the local endpoint for the socket.
// The DNS name of the computer
// running the listener is "host.contoso.com".
IPHostEntry ipHostInfo = Dns.Resolve(Dns.GetHostName());
IPAddress ipAddress = ipHostInfo.AddressList[0];
IPEndPoint localEndPoint = new IPEndPoint(ipAddress, 11000);
// Create a TCP/IP socket.
Socket listener = new Socket(AddressFamily.InterNetwork,
SocketType.Stream, ProtocolType.Tcp );
// Bind the socket to the local endpoint and listen for incoming connections.
try {
listener.Bind(localEndPoint);
listener.Listen(100);
while (true) {
// Set the event to nonsignaled state.
allDone.Reset();
// Start an asynchronous socket to listen for connections.
Console.WriteLine("Waiting for a connection...");
listener.BeginAccept(new AsyncCallback(AcceptCallback), listener );
// Wait until a connection is made before continuing.
allDone.WaitOne();
}
}
catch (Exception e) {
Console.WriteLine(e.ToString());
}
Console.WriteLine("'nPress ENTER to continue...");
Console.Read();
}
public static void AcceptCallback(IAsyncResult ar) {
// Signal the main thread to continue.
allDone.Set();
// Get the socket that handles the client request.
Socket listener = (Socket) ar.AsyncState;
Socket handler = listener.EndAccept(ar);
// Create the state object.
StateObject state = new StateObject();
state.workSocket = handler;
handler.BeginReceive( state.buffer, 0, StateObject.BufferSize, 0,
new AsyncCallback(ReadCallback), state);
}
public static void ReadCallback(IAsyncResult ar) {
String content = String.Empty;
// Retrieve the state object and the handler socket
// from the asynchronous state object.
StateObject state = (StateObject) ar.AsyncState;
Socket handler = state.workSocket;
// Read data from the client socket.
int bytesRead = handler.EndReceive(ar);
if (bytesRead > 0) {
// There might be more data, so store the data received so far.
state.sb.Append(Encoding.ASCII.GetString(
state.buffer,0,bytesRead));
// Check for end-of-file tag. If it is not there, read
// more data.
content = state.sb.ToString();
if (content.IndexOf("<EOF>") > -1) {
// All the data has been read from the
// client. Display it on the console.
Console.WriteLine("Read {0} bytes from socket. 'n Data : {1}",
content.Length, content );
// Echo the data back to the client.
Send(handler, content);
}
else {
// Not all data received. Get more.
handler.BeginReceive(state.buffer, 0, StateObject.BufferSize, 0,
new AsyncCallback(ReadCallback), state);
}
}
}
private static void Send(Socket handler, String data) {
// Convert the string data to byte data using ASCII encoding.
byte[] byteData = Encoding.ASCII.GetBytes(data);
// Begin sending the data to the remote device.
handler.BeginSend(byteData, 0, byteData.Length, 0,
new AsyncCallback(SendCallback), handler);
}
private static void SendCallback(IAsyncResult ar) {
try {
// Retrieve the socket from the state object.
Socket handler = (Socket) ar.AsyncState;
// Complete sending the data to the remote device.
int bytesSent = handler.EndSend(ar);
Console.WriteLine("Sent {0} bytes to client.", bytesSent);
handler.Shutdown(SocketShutdown.Both);
handler.Close();
}
catch (Exception e) {
Console.WriteLine(e.ToString());
}
}
public static int Main(String[] args) {
StartListening();
return 0;
}
}
不知道如何在C#中实现,但可以使用SSLEngine
在Java中实现。这个API通常被认为很难编程。因此,是的,可以使用SSL/TLS的异步套接字,但我不确定Java的SSLEngine
的等价物是什么。也许在C#中还有另一个(更好的?)API。
在这条路上,你几乎不可避免地会遇到一些问题(基于Java经验,但这在C#中也同样适用):
虽然SSLSocket
s的行为与正常Socket
s相似,但由于SSL/TLS的性质,存在轻微的边缘情况。对于异步I/O,这些差异的影响更为重要。其中一些问题在这个(相当长的)对"正确关闭SSLSocket"(Java)的回答中进行了描述。
此外,一些SSL/TLS行为在应用层方面已经定义不清,异步行为会变得更加混乱。我有客户证书重新协商(或一般重新协商)的想法。使用SSL/TLS,任何一方原则上都可以发起重新协商握手。例如,如果您在Apache Httpd中只使用客户端证书保护一个目录,或者如果web应用程序的一部分在Java容器中只需要CLIENT-CERT
,则可以执行此操作。在使用客户端证书身份验证时,默认情况下,即使IIS也会使用重新协商。这包括在SSL/TLS连接期间进行第二次握手(有效地从客户端获取更多信息:其客户端证书)。
当它工作时(通常带有阻塞I/O),流量看起来是这样的(这里是SSL
和HTTP
层):
C->S SSL Client Hello
S->C SSL Server Hello, Certificate, Server Hello Done
C->S SSL Client Key Exchange, Change Cipher Spec, Finished
S->C SSL Change Cipher Spec
(then encrypted)
C->S SSL Finished
C->S HTTP GET /.../
S->C SSL Hello Request
C->S SSL Client Hello
S->C SSL Server Hello, Certificate, Certificate Request, Server Hello Done
C->S SSL Certificate, Client Key Exchange, Certificate Verify, Change Cipher
Spec, Finished
S->C SSL Change Cipher Spec
C->S SSL Finished
S->C HTTP 200 OK
异步模式下的重新协商非常棘手,因为重新协商应该同时适用于流量的双方。因此,SSL/TLS会话的底层属性可能会在应用层使用过程中发生变化(通常不希望应用层处理此问题)。在重新协商发生时,一方可能仍然在假设某些SSL/TLS设置的情况下发送数据,从而影响双方。
所有这一切的实现都可能很困难,例如,正如Grizzly的这个问题所示。
我自己也在寻找一个使用C#支持tcp/ip套接字上的TLS/SSL的答案,并使用流套接字
直接套接字通信在会话OSI模型层上工作。TLS和SSL在演示层(高于会话)工作。所以,不,AFAIK您不能直接使用套接字,并且具有SSL或TLS级别的安全性。
查看OSI模型
在.NET中,使用SslStream类。它拥有在.NET中构建SSL客户端/服务器所需的一切。非常容易集成。适用于所有版本的.NET.