diff --git a/nanoFramework.System.Net/Security/SslError.cs b/nanoFramework.System.Net/Security/SslError.cs index 8c92cb1..d69b229 100644 --- a/nanoFramework.System.Net/Security/SslError.cs +++ b/nanoFramework.System.Net/Security/SslError.cs @@ -3,6 +3,8 @@ // See LICENSE file in the project root for full license information. // +using System.Security.Cryptography; + namespace System.Net.Sockets { @@ -12,8 +14,8 @@ namespace System.Net.Sockets /// /// /// Values are kept in sync with the SSL_Error enum in the native interpreter - /// (ssl_functions.h). surfaces these - /// through + /// (ssl_functions.h). surfaces these + /// through /// when SSL context setup fails. /// /// @@ -75,5 +77,34 @@ public enum SslError : byte /// This is an internal mbedTLS error that should not occur under normal conditions. /// SetupFailed, + + /// + /// The SSL context was not valid when attempting the handshake. + /// Thrown as . + /// + HandshakeBadContext, + + /// + /// Setting the server hostname for SNI failed during the handshake. + /// Thrown as . + /// + HandshakeSetHostname, + + /// + /// Certificate verification failed during the handshake. + /// Thrown as + /// with + /// set to the bitmask of MBEDTLS_X509_BADCERT_* verification flags returned + /// by mbedtls_ssl_get_verify_result(). + /// + HandshakeCertVerifyFailed, + + /// + /// The TLS handshake failed. + /// Thrown as + /// with + /// set to the raw negative mbedTLS error code. + /// + HandshakeFailed, } } diff --git a/nanoFramework.System.Net/Security/SslStream.cs b/nanoFramework.System.Net/Security/SslStream.cs index fa2ad22..254e0b2 100644 --- a/nanoFramework.System.Net/Security/SslStream.cs +++ b/nanoFramework.System.Net/Security/SslStream.cs @@ -7,6 +7,7 @@ using System.IO; using System.Net.Sockets; using System.Runtime.CompilerServices; +using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates; namespace System.Net.Security @@ -72,18 +73,33 @@ public SslStream(Socket socket) /// The value that represents the protocol used for authentication. /// Authentication has already been performed on this stream, or all native SSL context slots are in. /// A memory allocation failed while setting up the SSL context. The device may be low on heap. - /// - /// SSL context initialisation failed. The property contains the + /// + /// SSL context initialisation failed. The property contains the /// corresponding value: - /// — entropy source could not be initialised; - /// — internal mbedTLS configuration error; - /// — the requested TLS version is not supported on this device; - /// — final SSL context setup failed. + /// - entropy source could not be initialised; + /// - internal mbedTLS configuration error; + /// - the requested TLS version is not supported on this device; + /// - final SSL context setup failed. /// - /// The TLS handshake with the remote server failed. - public void AuthenticateAsClient(string targetHost, SslProtocols enabledSslProtocols) + /// + /// Thrown during the TLS handshake when: + /// - the SSL context was not valid; + /// - setting the server hostname for SNI failed. + /// + /// + /// Thrown during the TLS handshake. The property contains: + /// for - the bitmask of MBEDTLS_X509_BADCERT_* verification flags; + /// for - the raw negative mbedTLS error code. + /// + public void AuthenticateAsClient( + string targetHost, + SslProtocols enabledSslProtocols) { - Authenticate(false, targetHost, null, null, enabledSslProtocols); + Authenticate(false, + targetHost, + null, + null, + enabledSslProtocols); } /// @@ -98,21 +114,37 @@ public void AuthenticateAsClient(string targetHost, SslProtocols enabledSslProto /// /// Authentication has already been performed on this stream, or all native SSL context slots are in. /// A memory allocation failed while setting up the SSL context. The device may be low on heap. - /// - /// SSL context initialisation failed. The property contains the + /// + /// SSL context initialisation failed. The property contains the /// corresponding value: - /// — entropy source could not be initialised; - /// — internal mbedTLS configuration error; - /// — the requested TLS version is not supported on this device; - /// — the client certificate could not be parsed; - /// — the client private key could not be parsed; - /// — configuring the certificate/key pair on the SSL context failed; - /// — final SSL context setup failed. + /// - entropy source could not be initialised; + /// - internal mbedTLS configuration error; + /// - the requested TLS version is not supported on this device; + /// - the client certificate could not be parsed; + /// - the client private key could not be parsed; + /// - configuring the certificate/key pair on the SSL context failed; + /// - final SSL context setup failed. + /// + /// + /// Thrown during the TLS handshake when: + /// - the SSL context was not valid; + /// - setting the server hostname for SNI failed. /// - /// The TLS handshake with the remote server failed. - public void AuthenticateAsClient(string targetHost, X509Certificate clientCertificate, SslProtocols enabledSslProtocols) + /// + /// Thrown during the TLS handshake. The property contains: + /// for - the bitmask of MBEDTLS_X509_BADCERT_* verification flags; + /// for - the raw negative mbedTLS error code. + /// + public void AuthenticateAsClient( + string targetHost, + X509Certificate clientCertificate, + SslProtocols enabledSslProtocols) { - Authenticate(false, targetHost, clientCertificate, null, enabledSslProtocols); + Authenticate(false, + targetHost, + clientCertificate, + null, + enabledSslProtocols); } /// @@ -128,21 +160,38 @@ public void AuthenticateAsClient(string targetHost, X509Certificate clientCertif /// /// Authentication has already been performed on this stream, or all native SSL context slots are in. /// A memory allocation failed while setting up the SSL context. The device may be low on heap. - /// - /// SSL context initialisation failed. The property contains the + /// + /// SSL context initialisation failed. The property contains the /// corresponding value: - /// — entropy source could not be initialised; - /// — internal mbedTLS configuration error; - /// — the requested TLS version is not supported on this device; - /// — the client or CA certificate could not be parsed; - /// — the client private key could not be parsed; - /// — configuring the certificate/key pair on the SSL context failed; - /// — final SSL context setup failed. + /// - entropy source could not be initialised; + /// - internal mbedTLS configuration error; + /// - the requested TLS version is not supported on this device; + /// - the client or CA certificate could not be parsed; + /// - the client private key could not be parsed; + /// - configuring the certificate/key pair on the SSL context failed; + /// - final SSL context setup failed. + /// + /// + /// Thrown during the TLS handshake when: + /// - the SSL context was not valid; + /// - setting the server hostname for SNI failed. /// - /// The TLS handshake with the remote server failed. - public void AuthenticateAsClient(string targetHost, X509Certificate clientCertificate, X509Certificate ca, SslProtocols enabledSslProtocols) + /// + /// Thrown during the TLS handshake. The property contains: + /// for - the bitmask of MBEDTLS_X509_BADCERT_* verification flags; + /// for - the raw negative mbedTLS error code. + /// + public void AuthenticateAsClient( + string targetHost, + X509Certificate clientCertificate, + X509Certificate ca, + SslProtocols enabledSslProtocols) { - Authenticate(false, targetHost, clientCertificate, ca, enabledSslProtocols); + Authenticate(false, + targetHost, + clientCertificate, + ca, + enabledSslProtocols); } /// @@ -156,21 +205,34 @@ public void AuthenticateAsClient(string targetHost, X509Certificate clientCertif /// /// Authentication has already been performed on this stream, or all native SSL context slots are in. /// A memory allocation failed while setting up the SSL context. The device may be low on heap. - /// - /// SSL context initialisation failed. The property contains the + /// + /// SSL context initialisation failed. The property contains the /// corresponding value: - /// — entropy source could not be initialised; - /// — internal mbedTLS configuration error; - /// — the requested TLS version is not supported on this device; - /// — the server certificate could not be parsed; - /// — the server private key could not be parsed; - /// — configuring the certificate/key pair on the SSL context failed; - /// — final SSL context setup failed. + /// - entropy source could not be initialised; + /// - internal mbedTLS configuration error; + /// - the requested TLS version is not supported on this device; + /// - the server certificate could not be parsed; + /// - the server private key could not be parsed; + /// - configuring the certificate/key pair on the SSL context failed; + /// - final SSL context setup failed. + /// + /// + /// Thrown during the TLS handshake when - the SSL context was not valid. + /// + /// + /// Thrown during the TLS handshake. The property contains: + /// for - the bitmask of MBEDTLS_X509_BADCERT_* verification flags (when client certificate verification is enabled); + /// for - the raw negative mbedTLS error code. /// - /// The TLS handshake with the remote client failed. - public void AuthenticateAsServer(X509Certificate serverCertificate, SslProtocols enabledSslProtocols) + public void AuthenticateAsServer( + X509Certificate serverCertificate, + SslProtocols enabledSslProtocols) { - Authenticate(true, "", serverCertificate, null, enabledSslProtocols); + Authenticate(true, + "", + serverCertificate, + null, + enabledSslProtocols); } /// @@ -184,23 +246,37 @@ public void AuthenticateAsServer(X509Certificate serverCertificate, SslProtocols /// /// Authentication has already been performed on this stream, or all native SSL context slots are in. /// A memory allocation failed while setting up the SSL context. The device may be low on heap. - /// - /// SSL context initialisation failed. The property contains the + /// + /// SSL context initialisation failed. The property contains the /// corresponding value: - /// — entropy source could not be initialised; - /// — internal mbedTLS configuration error; - /// — the requested TLS version is not supported on this device; - /// — the server certificate could not be parsed; - /// — the server private key could not be parsed; - /// — configuring the certificate/key pair on the SSL context failed; - /// — final SSL context setup failed. + /// - entropy source could not be initialised; + /// - internal mbedTLS configuration error; + /// - the requested TLS version is not supported on this device; + /// - the server certificate could not be parsed; + /// - the server private key could not be parsed; + /// - configuring the certificate/key pair on the SSL context failed; + /// - final SSL context setup failed. + /// + /// + /// Thrown during the TLS handshake when - the SSL context was not valid. + /// + /// + /// Thrown during the TLS handshake. The property contains: + /// for - the bitmask of MBEDTLS_X509_BADCERT_* verification flags (when client certificate verification is enabled); + /// for - the raw negative mbedTLS error code. /// - /// The TLS handshake with the remote client failed. - public void AuthenticateAsServer(X509Certificate serverCertificate, bool clientCertificateRequired, SslProtocols enabledSslProtocols) + public void AuthenticateAsServer( + X509Certificate serverCertificate, + bool clientCertificateRequired, + SslProtocols enabledSslProtocols) { SslVerification = clientCertificateRequired ? SslVerification.VerifyClientOnce : SslVerification.NoVerification; - Authenticate(true, "", serverCertificate, null, enabledSslProtocols); + Authenticate(true, + "", + serverCertificate, + null, + enabledSslProtocols); } internal void Authenticate(bool isServer, string targetHost, X509Certificate certificate, X509Certificate ca, SslProtocols enabledSslProtocols)