面向.NET的SSL/TLS的客户端与服务器端和SSL通道

Server class:服务器类

class SSLServer
{ 
public: 
    //disconnect from given client, based on id 
    void DisconnectFromClient(Guid ClientID, Object* state); 
    //clean up 
    void Dispose(); 
    //encrypt data, encrypted data is retuned in WriteSSL callback 
    void EncryptSend(Byte data[], int ActualLen, Guid ClientID, 
                     Object* state); 
    //decrypt data, decrypted data is returned in PlainData callback 
    void DecryptData(Byte data[], Int32 ActualLen, Guid ClientID, 
                     Object* state); 
    //remove client based on id from internal list of clients 
    void RemoveClient(Guid ClientID); 
    //maximum data chunk to use for send/recv at a time 
    int MaxDataChunkSize(Guid ClientID);
    //setup credentials, certThumbPrint is certificate's hash 
    void SetupCredentials(Byte certThumbPrint[], 
            Common::Misc::SecurityProviderProtocol prot); 
    //ask client to renegotiate and possibly get different credentials 
    void AskForRenegotiate(Guid ClientID, Object* state); 

public: 
    //recommended initial chunk size when negotiation just starts, 
    // this is max auth token size 
    __property int get_MaxInitialChunkSize(); 
    //ask client to provide certificate or not 
    __property void set_AskClientForAuth(bool value); 

public: 
    //callback for encrypted data 
    WriteSSL* DoWrite; 
    //callback for decrypted data 
    PlainData* DoPlainData; 
    //optional 
    VerifyClientCert* DoClientCertVerify; 
    //optional 
    HandShakeSuccess* DoHandShakeSuccess; 

private:
    ...
};

Quick Example:快速示例

          SSLServer SSL    = new SSLServer();

          SSL.DoPlainData = new  SSL.Server.PlainData(OnPlainData);

          SSL.DoWrite      = new  SSL.Server.WriteSSL(OnSend);

          SSL.DoClientCertVerify

          = new  SSL.Server.VerifyClientCert(OnClientCertInfo);

          SSL.DoHandShakeSuccess

          = new  SSL.Server.HandShakeSuccess(OnClientHandShakeSuccess);

          SSL.AskClientForAuth = false;
  //TODO: change values to match your server's certificates hash 

    byte[] ServerCertThumbPrint = new byte[]{0xA4, 0x01,  0xC2, 0xB1, 0x73,

    0xD9,  0xD9, 0xF4, 0x77, 0x68, 

    0x60,  0xE5, 0xAD, 0x25, 0x34, 

    0xEE,  0x59, 0xEB, 0x0E, 0x8D};

    SSL.SetupCredentials(ServerCertThumbPrint,

    SSL.Common.Misc.SecurityProviderProtocol.PROT_TLS1);

    //listen for incoming connections on Socket 

    //Accept new connection if any 

    //begin receiving data from client 

    Guid clientID = Guid.NewGuid();

    SSL.DecryptData(buff, bytesRead, clientID, null);

    SSL.DisconnectFromClient(clientID);

    //When client handshake complete,  

    //do SSL.EncryptSend(data, data.Length, ClientID, null); when needed 

    SSL.Dispose();

  
////////////////////////////////////////////////////////////////

    void OnPlainData(byte[] data, Guid ClientID, object o)

    {

    //process data 

    }
  
bool OnSend(byte[] data, Guid ClientID, object o)

    {

    //send data out on  socket 

    }
  
void OnClientCertInfo(SSL.Common.Misc.CeriticateInfo clientCert)

    {

    X509Certificate cert = new X509Certificate(clientCert.CertData);

    //display client's cert  info 

    }
  
void OnClientHandShakeSuccess(Guid ClientID)

    {

    // handshake with client  is successful 

    }
        

SSL Tunnel Sample: SSL通道示例

NOTE: Never Never try this with your real/production SQL server. Try AT YOUR OWN RISK with your test installation of db or something else that goes through known TCP/IP connection. Also, go through code see what it does, make sure it suits your specific purposes.
To use it simply build the client and server .exes. Make sure the .config file is where the .exe is. You can test how it work by securing MS SQL connection with SSL/TLS. Here are the steps to do it: Make sure you installed your own certificate and updated the hash/thumbprints in code.
Open the MS SQL Client Network utility. Go to Alias | Add, then set the options as below:

• Server Alias: SSL
• Network Libraries: TCP/IP
• Server Name: Your Client.exe's IP (for ex., "localhost")
• Port Number: Your Client's listening Port (that's the "PortToListenForRedirect" value in Client.exe.config)

In Client.exe.config "SSLDestIP" and "SSLDestPort" will be your Server.exe's IP, and port that it listens on for redirect.
In Server.exe.config "PortToListenForSSL" is port Server.exe listens on for Client.exe, and "DestIP" "DestPort" are MS SQL Servers real IP and Port where everything from client will be sent. So the Cnnection in between client and exe will be secure. Client.exe will run on local machine for example and Server.exe will run on machine closer to SQL Server.
Run the SSL Client/Server applications.
Open the MS SQL Enterprise Manager console. Choose "New SQL Server registration". For server name put SSL, fill in the login info. Click OK. Now, you should be connected through SSL to your SQL Server.
注意：永远不要尝试使用您的真实/产品SQL服务器。尝试安装db或其他通过已知TCP / IP连接的东西，自行承担风险。此外，通过代码查看它的作用，确保它符合您的特定目的。
要使用它，只需构建客户端和服务器.exes。确保.config文件是.exe所在的位置。您可以通过使用SSL / TLS保护MS SQL连接来测试其工作方式。以下是执行此操作的步骤：确保安装了自己的证书并更新了代码中的哈希/指纹。
打开MS SQL客户端网络实用程序。转到Alias | 单击添加，然后设置如下选项：

• 服务器别名：SSL
• 网络库：TCP / IP
• 服务器名称：您的Client.exe的IP（例如，“localhost”）
• 端口号：客户端的侦听端口（即Client.exe.config中的“PortToListenForRedirect”值）

在Client.exe.config中，“SSLDestIP”和“SSLDestPort”将是您的Server.exe的IP，以及它侦听重定向的端口。
在Server.exe.config中，“PortToListenForSSL”是Server.exe侦听Client.exe的端口，“DestIP”“DestPort”是MS SQL Server真实IP和端口，其中发送来自客户端的所有内容。因此，客户端和exe之间的连接将是安全的。例如，Client.exe将在本地计算机上运行，​​Server.exe将在靠近SQL Server的计算机上运行。
运行SSL客户端/服务器应用程序。
打开MS SQL企业管理器控制台。选择“新建SQL Server注册”。对于服务器名称放置SSL，请填写登录信息。单击确定。现在，您应该通过SSL连接到SQL Server。