SslStream 类
定义
重要
一些信息与预发行产品相关,相应产品在发行之前可能会进行重大修改。 对于此处提供的信息,Microsoft 不作任何明示或暗示的担保。
提供一个用于客户端-服务器通信的流,该流使用安全套接字层 (SSL) 安全协议对服务器和(可选)客户端进行身份验证。
public ref class SslStream : System::Net::Security::AuthenticatedStream
public class SslStream : System.Net.Security.AuthenticatedStream
type SslStream = class
inherit AuthenticatedStream
Public Class SslStream
Inherits AuthenticatedStream
- 继承
- 继承
示例
下面的代码示例演示如何创建 TcpListener 使用 SslStream 类与客户端通信的 。
#using <System.dll>
using namespace System;
using namespace System::Collections;
using namespace System::Net;
using namespace System::Net::Sockets;
using namespace System::Net::Security;
using namespace System::Security::Authentication;
using namespace System::Text;
using namespace System::Security::Cryptography::X509Certificates;
using namespace System::IO;
public ref class SslTcpServer sealed
{
private:
static X509Certificate^ serverCertificate = nullptr;
public:
// The certificate parameter specifies the name of the file
// containing the machine certificate.
static void RunServer( String^ certificate )
{
serverCertificate = X509Certificate::CreateFromCertFile( certificate );
// Create a TCP/IP (IPv4) socket and listen for incoming connections.
TcpListener^ listener = gcnew TcpListener( IPAddress::Any,5000 );
listener->Start();
while (true)
{
Console::WriteLine( L"Waiting for a client to connect..." );
// Application blocks while waiting for an incoming connection.
// Type CNTL-C to terminate the server.
TcpClient^ client = listener->AcceptTcpClient();
ProcessClient( client );
}
}
static void ProcessClient( TcpClient^ client )
{
// A client has connected. Create the
// SslStream using the client's network stream.
SslStream^ sslStream = gcnew SslStream( client->GetStream(),false );
// Authenticate the server but don't require the client to authenticate.
try
{
sslStream->AuthenticateAsServer( serverCertificate, false, true );
// false == no client cert required; true == check cert revocation.
// Display the properties and settings for the authenticated stream.
DisplaySecurityLevel( sslStream );
DisplaySecurityServices( sslStream );
DisplayCertificateInformation( sslStream );
DisplayStreamProperties( sslStream );
// Set timeouts for the read and write to 5 seconds.
sslStream->ReadTimeout = 5000;
sslStream->WriteTimeout = 5000;
// Read a message from the client.
Console::WriteLine( L"Waiting for client message..." );
String^ messageData = ReadMessage( sslStream );
Console::WriteLine( L"Received: {0}", messageData );
// Write a message to the client.
array<Byte>^message = Encoding::UTF8->GetBytes( L"Hello from the server.<EOF>" );
Console::WriteLine( L"Sending hello message." );
sslStream->Write( message );
}
catch ( AuthenticationException^ e )
{
Console::WriteLine( L"Exception: {0}", e->Message );
if ( e->InnerException != nullptr )
{
Console::WriteLine( L"Inner exception: {0}", e->InnerException->Message );
}
Console::WriteLine( L"Authentication failed - closing the connection." );
sslStream->Close();
client->Close();
return;
}
finally
{
// The client stream will be closed with the sslStream
// because we specified this behavior when creating
// the sslStream.
sslStream->Close();
client->Close();
}
}
static String^ ReadMessage( SslStream^ sslStream )
{
// Read the message sent by the client.
// The client signals the end of the message using the
// "<EOF>" marker.
array<Byte>^buffer = gcnew array<Byte>(2048);
StringBuilder^ messageData = gcnew StringBuilder;
int bytes = -1;
do
{
// Read the client's test message.
bytes = sslStream->Read( buffer, 0, buffer->Length );
// Use Decoder class to convert from bytes to UTF8
// in case a character spans two buffers.
Decoder^ decoder = Encoding::UTF8->GetDecoder();
array<Char>^chars = gcnew array<Char>(decoder->GetCharCount( buffer, 0, bytes ));
decoder->GetChars( buffer, 0, bytes, chars, 0 );
messageData->Append( chars );
// Check for EOF or an empty message.
if ( messageData->ToString()->IndexOf( L"<EOF>" ) != -1 )
{
break;
}
}
while ( bytes != 0 );
return messageData->ToString();
}
static void DisplaySecurityLevel( SslStream^ stream )
{
Console::WriteLine( L"Cipher: {0} strength {1}", stream->CipherAlgorithm, stream->CipherStrength );
Console::WriteLine( L"Hash: {0} strength {1}", stream->HashAlgorithm, stream->HashStrength );
Console::WriteLine( L"Key exchange: {0} strength {1}", stream->KeyExchangeAlgorithm, stream->KeyExchangeStrength );
Console::WriteLine( L"Protocol: {0}", stream->SslProtocol );
}
static void DisplaySecurityServices( SslStream^ stream )
{
Console::WriteLine( L"Is authenticated: {0} as server? {1}", stream->IsAuthenticated, stream->IsServer );
Console::WriteLine( L"IsSigned: {0}", stream->IsSigned );
Console::WriteLine( L"Is Encrypted: {0}", stream->IsEncrypted );
Console::WriteLine( L"Is mutually authenticated: {0}", stream->IsMutuallyAuthenticated );
}
static void DisplayStreamProperties( SslStream^ stream )
{
Console::WriteLine( L"Can read: {0}, write {1}", stream->CanRead, stream->CanWrite );
Console::WriteLine( L"Can timeout: {0}", stream->CanTimeout );
}
static void DisplayCertificateInformation( SslStream^ stream )
{
Console::WriteLine( L"Certificate revocation list checked: {0}", stream->CheckCertRevocationStatus );
X509Certificate^ localCertificate = stream->LocalCertificate;
if ( stream->LocalCertificate != nullptr )
{
Console::WriteLine( L"Local cert was issued to {0} and is valid from {1} until {2}.",
localCertificate->Subject,
localCertificate->GetEffectiveDateString(),
localCertificate->GetExpirationDateString() );
}
else
{
Console::WriteLine( L"Local certificate is null." );
}
X509Certificate^ remoteCertificate = stream->RemoteCertificate;
if ( stream->RemoteCertificate != nullptr )
{
Console::WriteLine( L"Remote cert was issued to {0} and is valid from {1} until {2}.",
remoteCertificate->Subject,
remoteCertificate->GetEffectiveDateString(),
remoteCertificate->GetExpirationDateString() );
}
else
{
Console::WriteLine( L"Remote certificate is null." );
}
}
private:
static void DisplayUsage()
{
Console::WriteLine( L"To start the server specify:" );
Console::WriteLine( L"serverSync certificateFile.cer" );
Environment::Exit( 1 );
}
public:
int RunServerASync()
{
array<String^>^args = Environment::GetCommandLineArgs();
String^ certificate = nullptr;
if ( args == nullptr || args->Length < 2 )
{
DisplayUsage();
}
certificate = args[ 1 ];
SslTcpServer::RunServer( certificate );
return 0;
}
};
int main(){
SslTcpServer^ sts = gcnew SslTcpServer();
sts->RunServerASync();
}
using System;
using System.Collections;
using System.Net;
using System.Net.Sockets;
using System.Net.Security;
using System.Security.Authentication;
using System.Text;
using System.Security.Cryptography.X509Certificates;
using System.IO;
namespace Examples.System.Net
{
public sealed class SslTcpServer
{
static X509Certificate serverCertificate = null;
// The certificate parameter specifies the name of the file
// containing the machine certificate.
public static void RunServer(string certificate)
{
serverCertificate = X509Certificate.CreateFromCertFile(certificate);
// Create a TCP/IP (IPv4) socket and listen for incoming connections.
TcpListener listener = new TcpListener(IPAddress.Any, 5000);
listener.Start();
while (true)
{
Console.WriteLine("Waiting for a client to connect...");
// Application blocks while waiting for an incoming connection.
// Type CNTL-C to terminate the server.
TcpClient client = listener.AcceptTcpClient();
ProcessClient(client);
}
}
static void ProcessClient (TcpClient client)
{
// A client has connected. Create the
// SslStream using the client's network stream.
SslStream sslStream = new SslStream(
client.GetStream(), false);
// Authenticate the server but don't require the client to authenticate.
try
{
sslStream.AuthenticateAsServer(serverCertificate, clientCertificateRequired: false, checkCertificateRevocation: true);
// Display the properties and settings for the authenticated stream.
DisplaySecurityLevel(sslStream);
DisplaySecurityServices(sslStream);
DisplayCertificateInformation(sslStream);
DisplayStreamProperties(sslStream);
// Set timeouts for the read and write to 5 seconds.
sslStream.ReadTimeout = 5000;
sslStream.WriteTimeout = 5000;
// Read a message from the client.
Console.WriteLine("Waiting for client message...");
string messageData = ReadMessage(sslStream);
Console.WriteLine("Received: {0}", messageData);
// Write a message to the client.
byte[] message = Encoding.UTF8.GetBytes("Hello from the server.<EOF>");
Console.WriteLine("Sending hello message.");
sslStream.Write(message);
}
catch (AuthenticationException e)
{
Console.WriteLine("Exception: {0}", e.Message);
if (e.InnerException != null)
{
Console.WriteLine("Inner exception: {0}", e.InnerException.Message);
}
Console.WriteLine ("Authentication failed - closing the connection.");
sslStream.Close();
client.Close();
return;
}
finally
{
// The client stream will be closed with the sslStream
// because we specified this behavior when creating
// the sslStream.
sslStream.Close();
client.Close();
}
}
static string ReadMessage(SslStream sslStream)
{
// Read the message sent by the client.
// The client signals the end of the message using the
// "<EOF>" marker.
byte [] buffer = new byte[2048];
StringBuilder messageData = new StringBuilder();
int bytes = -1;
do
{
// Read the client's test message.
bytes = sslStream.Read(buffer, 0, buffer.Length);
// Use Decoder class to convert from bytes to UTF8
// in case a character spans two buffers.
Decoder decoder = Encoding.UTF8.GetDecoder();
char[] chars = new char[decoder.GetCharCount(buffer,0,bytes)];
decoder.GetChars(buffer, 0, bytes, chars,0);
messageData.Append (chars);
// Check for EOF or an empty message.
if (messageData.ToString().IndexOf("<EOF>") != -1)
{
break;
}
} while (bytes !=0);
return messageData.ToString();
}
static void DisplaySecurityLevel(SslStream stream)
{
Console.WriteLine("Cipher: {0} strength {1}", stream.CipherAlgorithm, stream.CipherStrength);
Console.WriteLine("Hash: {0} strength {1}", stream.HashAlgorithm, stream.HashStrength);
Console.WriteLine("Key exchange: {0} strength {1}", stream.KeyExchangeAlgorithm, stream.KeyExchangeStrength);
Console.WriteLine("Protocol: {0}", stream.SslProtocol);
}
static void DisplaySecurityServices(SslStream stream)
{
Console.WriteLine("Is authenticated: {0} as server? {1}", stream.IsAuthenticated, stream.IsServer);
Console.WriteLine("IsSigned: {0}", stream.IsSigned);
Console.WriteLine("Is Encrypted: {0}", stream.IsEncrypted);
Console.WriteLine("Is mutually authenticated: {0}", stream.IsMutuallyAuthenticated);
}
static void DisplayStreamProperties(SslStream stream)
{
Console.WriteLine("Can read: {0}, write {1}", stream.CanRead, stream.CanWrite);
Console.WriteLine("Can timeout: {0}", stream.CanTimeout);
}
static void DisplayCertificateInformation(SslStream stream)
{
Console.WriteLine("Certificate revocation list checked: {0}", stream.CheckCertRevocationStatus);
X509Certificate localCertificate = stream.LocalCertificate;
if (stream.LocalCertificate != null)
{
Console.WriteLine("Local cert was issued to {0} and is valid from {1} until {2}.",
localCertificate.Subject,
localCertificate.GetEffectiveDateString(),
localCertificate.GetExpirationDateString());
} else
{
Console.WriteLine("Local certificate is null.");
}
// Display the properties of the client's certificate.
X509Certificate remoteCertificate = stream.RemoteCertificate;
if (stream.RemoteCertificate != null)
{
Console.WriteLine("Remote cert was issued to {0} and is valid from {1} until {2}.",
remoteCertificate.Subject,
remoteCertificate.GetEffectiveDateString(),
remoteCertificate.GetExpirationDateString());
} else
{
Console.WriteLine("Remote certificate is null.");
}
}
private static void DisplayUsage()
{
Console.WriteLine("To start the server specify:");
Console.WriteLine("serverSync certificateFile.cer");
Environment.Exit(1);
}
public static int Main(string[] args)
{
string certificate = null;
if (args == null ||args.Length < 1 )
{
DisplayUsage();
}
certificate = args[0];
SslTcpServer.RunServer (certificate);
return 0;
}
}
}
Imports System.Collections
Imports System.Net
Imports System.Net.Sockets
Imports System.Net.Security
Imports System.Security.Authentication
Imports System.Text
Imports System.Security.Cryptography.X509Certificates
Imports System.IO
Namespace Examples.System.Net
Public NotInheritable Class SslTcpServer
Shared serverCertificate As X509Certificate = Nothing
' The certificate parameter specifies the name of the file
' containing the machine certificate.
Public Shared Sub RunServer(certificate As String)
serverCertificate = X509Certificate.CreateFromCertFile(certificate)
' Create a TCP/IP (IPv4) socket And listen for incoming connections.
Dim listener = New TcpListener(IPAddress.Any, 5000)
listener.Start()
While True
Console.WriteLine("Waiting for a client to connect...")
' Application blocks while waiting for an incoming connection.
' Type CNTL-C to terminate the server.
Dim client As TcpClient = listener.AcceptTcpClient()
ProcessClient(client)
End While
End Sub
Private Shared Sub ProcessClient(client As TcpClient)
' A client has connected. Create the
' SslStream using the client's network stream.
Dim sslStream = New SslStream(client.GetStream(), False)
Try
sslStream.AuthenticateAsServer(serverCertificate, clientCertificateRequired:=False, checkCertificateRevocation:=True)
' Display the properties And settings for the authenticated stream.
DisplaySecurityLevel(sslStream)
DisplaySecurityServices(sslStream)
DisplayCertificateInformation(sslStream)
DisplayStreamProperties(sslStream)
' Set timeouts for the read and write to 5 seconds.
sslStream.ReadTimeout = 5000
sslStream.WriteTimeout = 5000
' Read a message from the client.
Console.WriteLine("Waiting for client message...")
Dim messageData As String = ReadMessage(sslStream)
Console.WriteLine("Received: {0}", messageData)
' Write a message to the client.
Dim message As Byte() = Encoding.UTF8.GetBytes("Hello from the server.<EOF>")
Console.WriteLine("Sending hello message.")
sslStream.Write(message)
Catch e As AuthenticationException
Console.WriteLine("Exception: {0}", e.Message)
If e.InnerException IsNot Nothing Then
Console.WriteLine("Inner exception: {0}", e.InnerException.Message)
End If
Console.WriteLine("Authentication failed - closing the connection.")
sslStream.Close()
client.Close()
Return
Finally
' The client stream will be closed with the sslStream
' because we specified this behavior when creating
' the sslStream.
sslStream.Close()
client.Close()
End Try
End Sub
Private Shared Function ReadMessage(sslStream As SslStream) As String
' Read the message sent by the client.
' The client signals the end of the message using the
' "<EOF>" marker.
Dim buffer As Byte() = New Byte(2048) {}
Dim messageData As StringBuilder = New StringBuilder()
Dim bytes As Integer = -1
Do
' Read the client's test message.
bytes = sslStream.Read(buffer, 0, buffer.Length)
' Use decoder class to convert from bytes to UTF8
' in case a character spans two buffers.
Dim decoder As Decoder = Encoding.UTF8.GetDecoder()
Dim chars As Char() = New Char(decoder.GetCharCount(buffer, 0, bytes) - 1) {}
decoder.GetChars(buffer, 0, bytes, chars, 0)
messageData.Append(chars)
' Check for EOF or an empty message.
If messageData.ToString().IndexOf("<EOF>") <> -1 Then
Exit Do
End If
Loop While bytes <> 0
Return messageData.ToString()
End Function
Private Shared Sub DisplaySecurityLevel(stream As SslStream)
Console.WriteLine("Cipher: {0} strength {1}", stream.CipherAlgorithm, stream.CipherStrength)
Console.WriteLine("Hash: {0} strength {1}", stream.HashAlgorithm, stream.HashStrength)
Console.WriteLine("Key exchange: {0} strength {1}", stream.KeyExchangeAlgorithm, stream.KeyExchangeStrength)
Console.WriteLine("Protocol: {0}", stream.SslProtocol)
End Sub
Private Shared Sub DisplaySecurityServices(stream As SslStream)
Console.WriteLine("Is authenticated: {0} as server? {1}", stream.IsAuthenticated, stream.IsServer)
Console.WriteLine("IsSigned: {0}", stream.IsSigned)
Console.WriteLine("Is Encrypted: {0}", stream.IsEncrypted)
Console.WriteLine("Is mutually authenticated: {0}", stream.IsMutuallyAuthenticated)
End Sub
Private Shared Sub DisplayStreamProperties(stream As SslStream)
Console.WriteLine("Can read: {0}, write {1}", stream.CanRead, stream.CanWrite)
Console.WriteLine("Can timeout: {0}", stream.CanTimeout)
End Sub
Private Shared Sub DisplayCertificateInformation(stream As SslStream)
Console.WriteLine("Certificate revocation list checked: {0}", stream.CheckCertRevocationStatus)
Dim localCertificate As X509Certificate = stream.LocalCertificate
If stream.LocalCertificate IsNot Nothing Then
Console.WriteLine("Local cert was issued to {0} and is valid from {1} until {2}.", localCertificate.Subject, localCertificate.GetEffectiveDateString(), localCertificate.GetExpirationDateString())
Else
Console.WriteLine("Local certificate is null.")
End If
' Display the properties of the client's certificate.
Dim remoteCertificate As X509Certificate = stream.RemoteCertificate
If stream.RemoteCertificate IsNot Nothing Then
Console.WriteLine("Remote cert was issued to {0} and is valid from {1} until {2}.", remoteCertificate.Subject, remoteCertificate.GetEffectiveDateString(), remoteCertificate.GetExpirationDateString())
Else
Console.WriteLine("Remote certificate is null.")
End If
End Sub
Private Shared Sub DisplayUsage()
Console.WriteLine("To start the server specify:")
Console.WriteLine("serverSync certificateFile.cer")
Environment.[Exit](1)
End Sub
Public Shared Function Main(ByVal args As String()) As Integer
Dim certificate As String
If args Is Nothing OrElse args.Length < 1 Then
DisplayUsage()
End If
certificate = args(0)
RunServer(certificate)
Return 0
End Function
End Class
End Namespace
下面的代码示例演示如何创建使用 TcpClientSslStream 类与服务器通信的 。
#using <System.dll>
#using <System.Security.dll>
using namespace System;
using namespace System::Collections;
using namespace System::Globalization;
using namespace System::Net;
using namespace System::Net::Security;
using namespace System::Net::Sockets;
using namespace System::Security::Authentication;
using namespace System::Text;
using namespace System::Security::Cryptography::X509Certificates;
using namespace System::IO;
namespace NlsClientSync
{
public ref class SslTcpClient
{
private:
static Hashtable^ certificateErrors = gcnew Hashtable;
// Load a table of errors that might cause
// the certificate authentication to fail.
static void InitializeCertificateErrors()
{
certificateErrors->Add(0x800B0101,
"The certification has expired.");
certificateErrors->Add(0x800B0104,
"A path length constraint "
"in the certification chain has been violated.");
certificateErrors->Add(0x800B0105,
"A certificate contains an unknown extension "
"that is marked critical.");
certificateErrors->Add(0x800B0107,
"A parent of a given certificate in fact "
"did not issue that child certificate.");
certificateErrors->Add(0x800B0108,
"A certificate is missing or has an empty value "
"for a necessary field.");
certificateErrors->Add(0x800B0109,
"The certificate root is not trusted.");
certificateErrors->Add(0x800B010C,
"The certificate has been revoked.");
certificateErrors->Add(0x800B010F,
"The name in the certificate does not not match "
"the host name requested by the client.");
certificateErrors->Add(0x800B0111,
"The certificate was explicitly marked "
"as untrusted by the user.");
certificateErrors->Add(0x800B0112,
"A certification chain processed correctly, "
"but one of the CA certificates is not trusted.");
certificateErrors->Add(0x800B0113,
"The certificate has an invalid policy.");
certificateErrors->Add(0x800B0114,
"The certificate name is either not "
"in the permitted list or is explicitly excluded.");
certificateErrors->Add(0x80092012,
"The revocation function was unable to check "
"revocation for the certificate.");
certificateErrors->Add(0x80090327,
"An unknown error occurred while "
"processing the certificate.");
certificateErrors->Add(0x80096001,
"A system-level error occurred "
"while verifying trust.");
certificateErrors->Add(0x80096002,
"The certificate for the signer of the message "
"is invalid or not found.");
certificateErrors->Add(0x80096003,
"One of the counter signatures was invalid.");
certificateErrors->Add(0x80096004,
"The signature of the certificate "
"cannot be verified.");
certificateErrors->Add(0x80096005,
"The time stamp signature or certificate "
"could not be verified or is malformed.");
certificateErrors->Add(0x80096010,
"The digital signature of the object "
"was not verified.");
certificateErrors->Add(0x80096019,
"The basic constraint extension of a certificate "
"has not been observed.");
}
static String^ CertificateErrorDescription(UInt32 problem)
{
// Initialize the error message dictionary
// if it is not yet available.
if (certificateErrors->Count == 0)
{
InitializeCertificateErrors();
}
String^ description = safe_cast<String^>(
certificateErrors[problem]);
if (description == nullptr)
{
description = String::Format(
CultureInfo::CurrentCulture,
"Unknown certificate error - 0x{0:x8}",
problem);
}
return description;
}
public:
// The following method is invoked
// by the CertificateValidationDelegate.
static bool ValidateServerCertificate(
Object^ sender,
X509Certificate^ certificate,
X509Chain^ chain,
SslPolicyErrors sslPolicyErrors)
{
Console::WriteLine("Validating the server certificate.");
if (sslPolicyErrors == SslPolicyErrors::None)
return true;
Console::WriteLine("Certificate error: {0}", sslPolicyErrors);
// Do not allow this client to communicate with unauthenticated servers.
return false;
}
static void RunClient(String^ machineName, String^ serverName)
{
// Create a TCP/IP client socket.
// machineName is the host running the server application.
TcpClient^ client = gcnew TcpClient(machineName, 5000);
Console::WriteLine("Client connected.");
// Create an SSL stream that will close
// the client's stream.
SslStream^ sslStream = gcnew SslStream(
client->GetStream(), false,
gcnew RemoteCertificateValidationCallback(ValidateServerCertificate),
nullptr);
// The server name must match the name
// on the server certificate.
try
{
sslStream->AuthenticateAsClient(serverName);
}
catch (AuthenticationException^ ex)
{
Console::WriteLine("Exception: {0}", ex->Message);
if (ex->InnerException != nullptr)
{
Console::WriteLine("Inner exception: {0}",
ex->InnerException->Message);
}
Console::WriteLine("Authentication failed - "
"closing the connection.");
sslStream->Close();
client->Close();
return;
}
// Encode a test message into a byte array.
// Signal the end of the message using the "<EOF>".
array<Byte>^ messsage = Encoding::UTF8->GetBytes(
"Hello from the client.<EOF>");
// Send hello message to the server.
sslStream->Write(messsage);
sslStream->Flush();
// Read message from the server.
String^ serverMessage = ReadMessage(sslStream);
Console::WriteLine("Server says: {0}", serverMessage);
// Close the client connection.
sslStream->Close();
client->Close();
Console::WriteLine("Client closed.");
}
private:
static String^ ReadMessage(SslStream^ sslStream)
{
// Read the message sent by the server.
// The end of the message is signaled using the
// "<EOF>" marker.
array<Byte>^ buffer = gcnew array<Byte>(2048);
StringBuilder^ messageData = gcnew StringBuilder;
// Use Decoder class to convert from bytes to UTF8
// in case a character spans two buffers.
Encoding^ u8 = Encoding::UTF8;
Decoder^ decoder = u8->GetDecoder();
int bytes = -1;
do
{
bytes = sslStream->Read(buffer, 0, buffer->Length);
array<__wchar_t>^ chars = gcnew array<__wchar_t>(
decoder->GetCharCount(buffer, 0, bytes));
decoder->GetChars(buffer, 0, bytes, chars, 0);
messageData->Append(chars);
// Check for EOF.
if (messageData->ToString()->IndexOf("<EOF>") != -1)
{
break;
}
}
while (bytes != 0);
return messageData->ToString();
}
};
}
int main()
{
array<String^>^ args = Environment::GetCommandLineArgs();
String^ serverCertificateName = nullptr;
String^ machineName = nullptr;
if (args == nullptr || args->Length < 2)
{
Console::WriteLine("To start the client specify:");
Console::WriteLine("clientSync machineName [serverName]");
return 1;
}
// User can specify the machine name and server name.
// Server name must match the name on
// the server's certificate.
machineName = args[1];
if (args->Length < 3)
{
serverCertificateName = machineName;
}
else
{
serverCertificateName = args[2];
};
NlsClientSync::SslTcpClient::RunClient(machineName,
serverCertificateName);
return 0;
}
using System;
using System.Collections;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Text;
using System.Security.Cryptography.X509Certificates;
using System.IO;
namespace Examples.System.Net
{
public class SslTcpClient
{
private static Hashtable certificateErrors = new Hashtable();
// The following method is invoked by the RemoteCertificateValidationDelegate.
public static bool ValidateServerCertificate(
object sender,
X509Certificate certificate,
X509Chain chain,
SslPolicyErrors sslPolicyErrors)
{
if (sslPolicyErrors == SslPolicyErrors.None)
return true;
Console.WriteLine("Certificate error: {0}", sslPolicyErrors);
// Do not allow this client to communicate with unauthenticated servers.
return false;
}
public static void RunClient(string machineName, string serverName)
{
// Create a TCP/IP client socket.
// machineName is the host running the server application.
TcpClient client = new TcpClient(machineName,5000);
Console.WriteLine("Client connected.");
// Create an SSL stream that will close the client's stream.
SslStream sslStream = new SslStream(
client.GetStream(),
false,
new RemoteCertificateValidationCallback (ValidateServerCertificate),
null
);
// The server name must match the name on the server certificate.
try
{
sslStream.AuthenticateAsClient(serverName);
}
catch (AuthenticationException e)
{
Console.WriteLine("Exception: {0}", e.Message);
if (e.InnerException != null)
{
Console.WriteLine("Inner exception: {0}", e.InnerException.Message);
}
Console.WriteLine ("Authentication failed - closing the connection.");
client.Close();
return;
}
// Encode a test message into a byte array.
// Signal the end of the message using the "<EOF>".
byte[] messsage = Encoding.UTF8.GetBytes("Hello from the client.<EOF>");
// Send hello message to the server.
sslStream.Write(messsage);
sslStream.Flush();
// Read message from the server.
string serverMessage = ReadMessage(sslStream);
Console.WriteLine("Server says: {0}", serverMessage);
// Close the client connection.
client.Close();
Console.WriteLine("Client closed.");
}
static string ReadMessage(SslStream sslStream)
{
// Read the message sent by the server.
// The end of the message is signaled using the
// "<EOF>" marker.
byte [] buffer = new byte[2048];
StringBuilder messageData = new StringBuilder();
int bytes = -1;
do
{
bytes = sslStream.Read(buffer, 0, buffer.Length);
// Use Decoder class to convert from bytes to UTF8
// in case a character spans two buffers.
Decoder decoder = Encoding.UTF8.GetDecoder();
char[] chars = new char[decoder.GetCharCount(buffer,0,bytes)];
decoder.GetChars(buffer, 0, bytes, chars,0);
messageData.Append (chars);
// Check for EOF.
if (messageData.ToString().IndexOf("<EOF>") != -1)
{
break;
}
} while (bytes != 0);
return messageData.ToString();
}
private static void DisplayUsage()
{
Console.WriteLine("To start the client specify:");
Console.WriteLine("clientSync machineName [serverName]");
Environment.Exit(1);
}
public static int Main(string[] args)
{
string serverCertificateName = null;
string machineName = null;
if (args == null ||args.Length <1 )
{
DisplayUsage();
}
// User can specify the machine name and server name.
// Server name must match the name on the server's certificate.
machineName = args[0];
if (args.Length <2 )
{
serverCertificateName = machineName;
}
else
{
serverCertificateName = args[1];
}
SslTcpClient.RunClient (machineName, serverCertificateName);
return 0;
}
}
}
Imports System.Collections
Imports System.Net
Imports System.Net.Security
Imports System.Net.Sockets
Imports System.Security.Authentication
Imports System.Text
Imports System.Security.Cryptography.X509Certificates
Imports System.IO
Namespace Examples.System.Net
Public Class SslTcpClient
' The following method is invoked by the RemoteCertificateValidationDelegate.
Public Shared Function ValidateServerCertificate(
sender As Object,
certificate As X509Certificate,
chain As X509Chain,
sslPolicyErrors As SslPolicyErrors) As Boolean
If sslPolicyErrors = SslPolicyErrors.None Then Return True
Console.WriteLine("Certificate error: {0}", sslPolicyErrors)
' Do not allow this client to communicate with unauthenticated servers.
Return False
End Function
Public Shared Sub RunClient(machineName As String, serverName As String)
' Create a TCP/IP client socket.
' machineName is the host running the server application.
Dim client = New TcpClient(machineName, 5000)
Console.WriteLine("Client connected.")
' Create an SSL stream that will close the client's stream.
Dim sslStream = New SslStream(
client.GetStream(), False,
New RemoteCertificateValidationCallback(AddressOf ValidateServerCertificate), Nothing)
' The server name must match the name on the server certificate.
Try
sslStream.AuthenticateAsClient(serverName)
Catch e As AuthenticationException
Console.WriteLine("Exception: {0}", e.Message)
If e.InnerException IsNot Nothing Then
Console.WriteLine("Inner exception: {0}", e.InnerException.Message)
End If
Console.WriteLine("Authentication failed - closing the connection.")
client.Close()
Return
End Try
' Encode a test message into a byte array.
' Signal the end of the message using the "<EOF>".
Dim messsage As Byte() = Encoding.UTF8.GetBytes("Hello from the client.<EOF>")
' Send hello message to the server.
sslStream.Write(messsage)
sslStream.Flush()
' Read message from the server.
Dim serverMessage = ReadMessage(sslStream)
Console.WriteLine("Server says: {0}", serverMessage)
' Close the client connection
client.Close()
Console.WriteLine("Client closed.")
End Sub
Private Shared Function ReadMessage(sslStream As SslStream) As String
' Read the message sent by the server.
' The end of the message is signaled using the "<EOF>" marker.
Dim buffer = New Byte(2048) {}
Dim messageData = New StringBuilder()
Dim bytes As Integer
Do
bytes = sslStream.Read(buffer, 0, buffer.Length)
' Use Decoder class to convert from bytes to UTF8
' in case a character spans two buffers.
Dim decoder As Decoder = Encoding.UTF8.GetDecoder()
Dim chars = New Char(decoder.GetCharCount(buffer, 0, bytes) - 1) {}
decoder.GetChars(buffer, 0, bytes, chars, 0)
messageData.Append(chars)
' Check for EOF.
If messageData.ToString().IndexOf("<EOF>") <> -1 Then Exit Do
Loop While bytes <> 0
Return messageData.ToString()
End Function
Private Shared Sub DisplayUsage()
Console.WriteLine("To start the client specify:")
Console.WriteLine("clientSync machineName [serverName]")
Environment.[Exit](1)
End Sub
Public Shared Function Main(args As String()) As Integer
Dim serverCertificateName As String
Dim machineName As String
If args Is Nothing OrElse args.Length < 1 Then
DisplayUsage()
End If
' User can specify the machine name and server name.
' Server name must match the name on the server's certificate.
machineName = args(0)
If args.Length < 2 Then
serverCertificateName = machineName
Else
serverCertificateName = args(1)
End If
SslTcpClient.RunClient(machineName, serverCertificateName)
Return 0
End Function
End Class
End Namespace
注解
SSL 协议有助于为使用 SslStream传输的消息提供机密性和完整性检查。 在客户端和服务器之间通信敏感信息时,应使用 SSL 连接(如 提供的 SslStream连接)。 使用 有助于 SslStream 防止任何人在网络上传输信息时读取和篡改信息。
实例 SslStream 使用创建 SslStream时提供的流传输数据。 提供此基础流时,可以选择指定关闭 SslStream 是否同时关闭基础流。 通常, SslStream 类与 TcpClient 和 TcpListener 类一起使用。 方法 GetStream 提供了一个 NetworkStream 适合与 类一起使用的 SslStream 。
创建 SslStream后,服务器和 (可选)客户端必须进行身份验证。 服务器必须提供一个 X509 证书来建立其标识证明,并且可以请求客户端也这样做。 在使用 SslStream传输信息之前,必须执行身份验证。 客户端使用同步 AuthenticateAsClient 方法(在身份验证完成之前阻止)或异步 BeginAuthenticateAsClient 方法(不会阻止等待身份验证完成)启动身份验证。 服务器使用同步 AuthenticateAsServer 或异步 BeginAuthenticateAsServer 方法启动身份验证。 客户端和服务器都必须启动身份验证。
身份验证由安全支持提供程序 (SSPI) 通道提供程序处理。 客户端可以通过在创建 SslStream时指定RemoteCertificateValidationCallback委托来控制服务器证书的验证。 服务器还可以通过提供 RemoteCertificateValidationCallback 委托来控制验证。 委托引用的方法包括远程方的证书,以及验证证书时 SSPI 遇到的任何错误。 请注意,如果服务器指定委托,则无论服务器是否请求客户端身份验证,都会调用委托的 方法。 如果服务器未请求客户端身份验证,则服务器的委托方法将收到一个空证书和一个空的证书错误数组。
如果服务器需要客户端身份验证,则客户端必须指定一个或多个证书进行身份验证。 如果客户端具有多个证书,则客户端可以提供委托 LocalCertificateSelectionCallback 来为服务器选择正确的证书。 客户端的证书必须位于当前用户的“我的”证书存储中。 (SSL 版本 2) 协议不支持 Ssl2 通过证书进行客户端身份验证。
如果身份验证失败,则会收到 , AuthenticationException并且 SslStream 不再可用。 应关闭此对象并删除对其的所有引用,以便垃圾回收器可以收集它。
身份验证过程(也称为 SSL 握手)成功后,服务器标识 (,并且(可选)建立客户端) ,客户端 SslStream 和服务器可以使用 来交换消息。 在发送或接收信息之前,客户端和服务器应检查 提供SslStream的安全服务和级别,以确定所选的协议、算法和强度是否满足其完整性和机密性要求。 如果当前设置不足,则应关闭流。 可以使用 和 IsSigned 属性检查 提供SslStreamIsEncrypted的安全服务。 下表显示了报告用于身份验证、加密和数据签名的加密设置的元素。
元素 | 成员 |
---|---|
用于对服务器和客户端(可选)进行身份验证的安全协议。 | 属性 SslProtocol 和关联的 SslProtocols 枚举。 |
密钥交换算法。 | 属性 KeyExchangeAlgorithm 和关联的 ExchangeAlgorithmType 枚举。 |
消息完整性算法。 | 属性 HashAlgorithm 和关联的 HashAlgorithmType 枚举。 |
消息机密性算法。 | 属性 CipherAlgorithm 和关联的 CipherAlgorithmType 枚举。 |
所选算法的优势。 | KeyExchangeStrength、 HashStrength和 CipherStrength 属性。 |
身份验证成功后,可以使用同步 Write 或异步 BeginWrite 方法发送数据。 可以使用同步 Read 或异步 BeginRead 方法接收数据。
如果向 SslStream 指定基础流应保持打开状态,则需负责在使用完该流后关闭该流。
注意
如果创建 SslStream 对象的应用程序使用 Normal 用户的凭据运行,则应用程序将无法访问本地计算机存储中安装的证书,除非已明确授予用户执行此操作的权限。
SslStream 假设从内部流引发超时以及任何其他 IOException 超时将被其调用方视为致命超时。 在 SslStream 超时后重用实例将返回垃圾。 在这些情况下,应用程序应 Close 将 SslStream 和 引发异常。
.NET Framework 4.6 包含一项新的安全功能,可阻止不安全的加密和哈希算法进行连接。 默认情况下,通过 HTTPClient、HttpWebRequest、FTPClient、SmtpClient、SslStream 等 API 使用 TLS/SSL 并面向 .NET Framework 4.6 的应用程序会获得更安全的行为。
开发人员可能需要选择退出此行为,以保持与其现有 SSL3 服务或 TLS(含 RC4 服务)的互操作性。 本文 介绍如何修改代码,以便禁用新行为。
.NET Framework 4.7 为验证 SslStreams 的方法添加了新的重载,这些方法未指定 TLS 版本,而是使用在 SCHANNEL 中定义为系统默认值的 TLS 版本。 在应用中使用这些方法,以便以后在 TLS 版本最佳做法随时间变化时修改默认值,而无需重新生成和重新部署应用。
另请参阅.NET Framework的传输层安全性 (TLS) 最佳做法。
构造函数
属性
CanRead |
获取一个 Boolean 值,该值指示基础流是否可读。 |
CanSeek |
获取一个 Boolean 值,该值指示基础流是否可查找。 |
CanTimeout |
获取一个 Boolean 值,该值指示基础流是否支持超时。 |
CanWrite |
获取一个 Boolean 值,该值指示基础流是否可写。 |
CheckCertRevocationStatus |
获取一个 Boolean 值,该值指示在证书验证过程中是否检查证书吊销列表。 |
CipherAlgorithm |
获取一个值,该值确定此 SslStream 使用的批量加密算法。 |
CipherStrength |
获取一个值,该值确定此 SslStream 使用的密码算法的强度。 |
HashAlgorithm |
获取用于生成消息身份验证代码 (MAC) 的算法。 |
HashStrength |
获取一个值,该值标识此实例使用的哈希算法的强度。 |
InnerStream |
获取此 AuthenticatedStream 用来发送和接收数据的流。 (继承自 AuthenticatedStream) |
IsAuthenticated |
获取一个 Boolean 值,该值指示身份验证是否成功。 |
IsEncrypted | |
IsMutuallyAuthenticated |
获取一个 Boolean 值,该值指示服务器和客户端是否均已进行身份验证。 |
IsServer | |
IsSigned |
获取一个 Boolean 值,该值指示使用此流发送的数据是否进行签名。 |
KeyExchangeAlgorithm |
获取此 SslStream 使用的密钥交换算法。 |
KeyExchangeStrength |
获取一个值,该值指示此实例使用的密钥交换算法的强度。 |
LeaveInnerStreamOpen |
获取此 AuthenticatedStream 用来发送和接收数据的流是否保持打开。 (继承自 AuthenticatedStream) |
Length |
获取基础流的长度。 |
LocalCertificate |
获取用于对本地终结点进行身份验证的证书。 |
NegotiatedApplicationProtocol |
TLS 握手中的协商应用程序协议。 |
NegotiatedCipherSuite |
获取此连接的已协商密码套件。 |
Position |
获取或设置基础流中的当前位置。 |
ReadTimeout |
获取或设置读取操作阻止等待数据的时间(以毫秒为单位)。 |
RemoteCertificate |
获取用于对远程终结点进行身份验证的证书。 |
SslProtocol |
获取一个值,该值指示用于对此连接进行身份验证的安全协议。 |
TargetHostName |
获取客户端尝试连接到的服务器的名称。 该名称用于服务器证书验证。 它可以是 DNS 名称,也可以是 IP 地址。 |
TransportContext |
获取用于采用扩展保护的身份验证的 TransportContext。 |
WriteTimeout |
获取或设置写操作阻止等待数据的时间。 |
方法
扩展方法
CopyToAsync(Stream, PipeWriter, CancellationToken) |
使用取消令牌从 Stream 中异步读取字节并将其写入到指定的 PipeWriter。 |
ConfigureAwait(IAsyncDisposable, Boolean) |
配置如何执行从异步可处置项返回的任务的等待。 |
适用于
另请参阅
反馈
https://aka.ms/ContentUserFeedback。
即将发布:在整个 2024 年,我们将逐步淘汰作为内容反馈机制的“GitHub 问题”,并将其取代为新的反馈系统。 有关详细信息,请参阅:提交和查看相关反馈