search

Azure / DotNetty

DotNetty project – a port of netty, event-driven asynchronous network application framework
Other
4.09k stars 977 forks source link

TLS handshake fails silently due to insufficient private key cert priviledges #225

Closed PeterTruchly closed 7 years ago

PeterTruchly commented 7 years ago
  1. Create new certificate

PS C:\Windows\system32> New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname pcname.domain.net -KeyUsage CRLSign,CertSign,KeyAgreement,DataEncipherment,KeyEnc ipherment,NonRepudiation,DigitalSignature -KeyUsageProperty All

  1. Create a dotnetty server using TlsHandler.Server(certificate)

  2. Run/Debug the server using a user which has NO rights to the cert. private key (check using mmc under cert->All Tasks->Manage Private Keys... )

  3. Start the server and send something to it (e.g. using Packet Sender utility)

Observed behavior: connection is made, handshake silently fails. When debugging, the HandleHandshakeCompleted goes into 'case TaskStatus.Faulted:' but nothing is propagated. The NotifyHandshakeFailure method evaluates 'if (!this.state.HasAny(TlsHandlerState.AuthenticationCompleted))' as false, thus the exception is silently ignored:

{"The credentials supplied to the package were not recognized"}

at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)\r\n
at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)\r\n
at System.Net.Security.SslStream.EndAuthenticateAsServer(IAsyncResult asyncResult)\r\n
at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult iar, Func2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization)"

mrapavy commented 7 years ago

+1