Question

有谁知道，我如何在.NET中实现TLS-ALPN？

我已经实现了一个基本的HTTP / 2服务器，但是没有TLS加密。我在谷歌搜索，但我只找到了C，Java或其他语言的资源，但没有用于.NET（C＃）

Answer 1

根据Github上的HttpTwo项目，目前因为一个错误而无法实现。

更新：.NET不支持它。您可以在此投票：https://visualstudio.uservoice.com/forums/121579-visual-studio-2015/suggestions/6264363-add-support-for-alpn-to-system-net-security-sslstr

报价：

HTTP / 2 RFC声明安全连接必须使用ALPN 协商协议。不幸的是，.NET的SslStream没有能力指定应用程序协议作为TLS身份验证的一部分，所以它无法支持ALPN。虽然有issue tracking this on dotnetfix，但似乎不会发生这种情况很快（特别是在mono和.NET 4.x上）。

Answer 2

.NET Core 2.1.2包括对支持ALPN所需的SslStream的必要更改。它尚未被记录，但是添加它的拉取请求是here

Answer 3

实际上是可能的。经过一番思考，您可以在客户端或服务器问候中插入任何扩展名。

下面的代码可以给您一个想法：

// Refer IANA on ApplicationProtocols: https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
public static void FixALPN(params string[] protocols) {
    if (Interlocked.Increment(ref cntFixALPN) > 1)
    {
        throw new Exception("FixALPN should be called only ONCE, put it in your Main or use a static constructor.");
        return;
    }

    // get the needed (internal) System types
    string tpname = typeof(System.Net.HttpListener).AssemblyQualifiedName;
    Type tpiface = Type.GetType(tpname.Replace("HttpListener", "SSPIInterface"));
    Type tpgsspi = Type.GetType(tpname.Replace("HttpListener", "GlobalSSPI"));
    Type tpsdc = Type.GetType(tpname.Replace("HttpListener", "SafeDeleteContext"));
    Type tpsecbuf = Type.GetType(tpname.Replace("HttpListener", "SecurityBuffer"));

    // create ALPN buffer
    ConstructorInfo ci = (from x in tpsecbuf.GetConstructors() where x.GetParameters().Length == 4 select x).First();
    var secbufempty = ci.Invoke(new object[] { new byte[0], 0, 0, 0 });
    byte[] btsalpn = GetALPNBuffer(protocols);
    var secbufalpn = ci.Invoke(new object[] { btsalpn, 0, btsalpn.Length, 18 });

    // grab the object to replace...
    FieldInfo fi = tpgsspi.GetField("SSPISecureChannel", BindingFlags.NonPublic | BindingFlags.Static);
    var secchan = fi.GetValue(null);

    // ...and the method(s) we'll use in our intercepted call(s)
    MethodInfo miSDC_ISC = tpsdc.GetMethod("InitializeSecurityContext", BindingFlags.NonPublic | BindingFlags.Static);
    MethodInfo miSDC_ASC = tpsdc.GetMethod("AcceptSecurityContext", BindingFlags.NonPublic | BindingFlags.Static);

    // fake the internal interface
    var result = new InterfaceImplementer(tpiface, (mcm) => {
        MethodInfo mi = (MethodInfo)mcm.MethodBase;
        object[] args = mcm.Args;
        object ret = null;
        if (mi.Name == "InitializeSecurityContext") // For Client Mode
        {
            if (args[5] == null) // empty input, new connection
            {
                dynamic[] secbufs = (dynamic[])Activator.CreateInstance(miSDC_ASC.GetParameters()[6].ParameterType, new object[] { 1 });
                secbufs[0] = secbufalpn;
                object[] sdcargs = new object[] { 0, args[0], args[1], args[2], args[3], args[4],
                    null,
                    secbufs,
                    args[6], args[7]
                };
                ret = miSDC_ISC.Invoke(null, sdcargs);
                args[0] = sdcargs[1];
                args[1] = sdcargs[2];
                args[7] = sdcargs[9];
            }
            else
            {
                ret = mi.Invoke(secchan, args);
            }
        }
        else if (mi.Name == "AcceptSecurityContext") // For Server Mode
        {
            dynamic[] secbufs = (dynamic[])Activator.CreateInstance(miSDC_ASC.GetParameters()[6].ParameterType, new object[] { 3 });
            secbufs[0] = args[2];
            secbufs[1] = secbufempty;
            secbufs[2] = secbufalpn;
            object[] sdcargs = new object[] { 0, args[0], args[1], args[3], args[4],
                null,
                secbufs,
                args[5], args[6]
            };
            ret = miSDC_ASC.Invoke(null, sdcargs);
            args[0] = sdcargs[1];
            args[1] = sdcargs[2];
            args[6] = sdcargs[8];
        }
        else
            ret = mi.Invoke(secchan, args);

        return new ReturnMessage(ret, args, args.Length, mcm.LogicalCallContext, mcm);
    }).GetTransparentProxy();
    
    // and set it, done
    fi.SetValue(null, result);
}

如何在.NET C＃中为HTTP / 2服务器实现TLS-ALPN

3 个答案: