Program.cs

//
// Copyright (c) .NET Foundation and Contributors
// See LICENSE file in the project root for full license information.
//

using nanoFramework.Networking;
using System;
using System.Diagnostics;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Resources;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;

#if HAS_WIFI
using System.Device.Wifi;
#endif

namespace SecureClient
{
    public class Program
    {
        public static void Main()
        {
            Debug.WriteLine("Waiting for network up and IP address...");

            bool success;

            CancellationTokenSource cs = new(60000);

#if HAS_WIFI

            Debug.WriteLine("This expectes that there is already a previously configured WiFi connection.");
            success = WifiNetworkHelper.Reconnect(requiresDateTime: true, token: cs.Token);

            // If that's not the case, then uncomment the code snippet below to setup the WiFi connection
            // Make sure to comment the line above
            // success = WifiNetworkHelper.ConnectDhcp("<MY-SSIDS>", "<MY-WIFI-PASSWORD>", requiresDateTime: true, token: cs.Token);
#else
            success = NetworkHelper.SetupAndConnectNetwork(requiresDateTime: true, token: cs.Token);
#endif

            if (!success)
            {
                Debug.WriteLine($"Can't get a proper IP address and DateTime, error: {NetworkHelper.Status}.");

                if (NetworkHelper.HelperException != null)
                {
                    Debug.WriteLine($"Exception: {NetworkHelper.HelperException}");
                }
                return;
            }

            /////////////////////////////////////////////////////////////////////////////////////
            // add certificate in PEM format (as a string in the app)
            X509Certificate letsEncryptCACert = new X509Certificate(_dstRootCAX3);
            /////////////////////////////////////////////////////////////////////////////////////

            /////////////////////////////////////////////////////////////////////////////////////
            // add certificate in CER format (as a managed resource)
            X509Certificate digiCertGlobalRootCACert = new X509Certificate(Resources.GetBytes(Resources.BinaryResources.DigiCertGlobalRootCA));
            /////////////////////////////////////////////////////////////////////////////////////

            /////////////////////////////////////////////////////////////////////////////////////
            // add certificate in CER format (as a managed resource)
            X509Certificate digiCertGlobalG2CACert = new X509Certificate(Resources.GetBytes(Resources.BinaryResources.DigiCert_Global_G2_Azure));
            /////////////////////////////////////////////////////////////////////////////////////

            // **** get host entry for How's my SSL test site
            //IPHostEntry hostEntry = Dns.GetHostEntry("www.howsmyssl.com");
            // **** get host entry for Global Root test site
            IPHostEntry hostEntry = Dns.GetHostEntry("global-root-ca.chain-demos.digicert.com");
            // **** get host entry for Azure IoT test site
            //IPHostEntry hostEntry = Dns.GetHostEntry("g2cert.azure-devices.net");

            ////////////////////////////////////////////////////////////////////////////////
            ////////////////////////////////////////////////////////////////////////////////
            // MAKE sure your using the same URL when calling AuthenticateAsClient below ///
            ////////////////////////////////////////////////////////////////////////////////
            ////////////////////////////////////////////////////////////////////////////////

            // need an IPEndPoint from that one above
            IPEndPoint ep = new IPEndPoint(hostEntry.AddressList[0], 443);

            Debug.WriteLine("Opening socket...");
            using (Socket mySocket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp))
            {
                // keep track of the operation being performed, to report it in case of failure
                string operation = OperationConnecting;

                try
                {
                    Debug.WriteLine("Connecting...");

                    // connect socket
                    mySocket.Connect(ep);

                    Debug.WriteLine("Authenticating with server...");

                    operation = OperationAuthenticating;

                    // setup SSL stream
                    using (SslStream sslStream = new SslStream(mySocket))
                    {
                        ///////////////////////////////////////////////////////////////////////////////////
                        // Authenticating using a client certificate stored in the device is possible by
                        // setting the UseStoredDeviceCertificate property. 
                        // 
                        // In practice it's equivalent to providing a client certificate in
                        // the 'clientCertificate' parameter when calling AuthenticateAsClient(...)
                        //
                        /////////////////////////////////////////////////////////////////////////////////// 
                        //sslStream.UseStoredDeviceCertificate = true;

                        ///////////////////////////////////////////////////////////////////////////////////
                        // Authenticating the server can be handled in one of three ways:
                        //
                        // 1. By providing the root CA certificate of the server being connected to.
                        // 
                        // 2. Having the target device preloaded with the root CA certificate.
                        // 
                        // !! NOT SECURED !! NOT RECOMENDED !!
                        // 3. Forcing the authentication work-flow to NOT validate the server certificate.
                        //
                        /////////////////////////////////////////////////////////////////////////////////// 

                        // option 1 
                        // setup authentication (add CA root certificate to the call)

                        // **** Let's encrypt test certificate for How's My SSL
                        //sslStream.AuthenticateAsClient("www.howsmyssl.com", null, letsEncryptCACert, SslProtocols.Tls11);
                        // **** GlobalRoot CA cert from resources
                        sslStream.AuthenticateAsClient("global-root-ca.chain-demos.digicert.com", null, digiCertGlobalRootCACert, SslProtocols.Tls12);
                        // **** DigiCert Global G2 cert from resources
                        //sslStream.AuthenticateAsClient("g2cert.azure-devices.net", null, digiCertGlobalG2CACert, SslProtocols.Tls12);

                        // option 2
                        // setup authentication (without providing root CA certificate)
                        // this requires that the trusted root CA certificates are available in the device certificate store
                        //sslStream.AuthenticateAsClient("www.howsmyssl.com", SslProtocols.Tls11);
                        //sslStream.AuthenticateAsClient("global-root-ca.chain-demos.digicert.com", SslProtocols.Tls12);

                        // option 3
                        // disable certificate validation
                        //sslStream.SslVerification = SslVerification.NoVerification;
                        //sslStream.AuthenticateAsClient("www.howsmyssl.com", SslProtocols.TLSv11);

                        Debug.WriteLine("SSL handshake OK!");

                        operation = "sending the request";

                        // write an HTTP GET request to receive data
                        byte[] buffer = Encoding.UTF8.GetBytes("GET / HTTP/1.0\r\n\r\n");
                        sslStream.Write(buffer, 0, buffer.Length);

                        Debug.WriteLine($"Wrote {buffer.Length} bytes");

                        operation = "reading the response";

                        int bytesCounter = 0;

                        do
                        {
                            var bufferLenght = sslStream.Length;

                            // if available length is 0, need to read at least 1 byte to get it started
                            if (bufferLenght == 0)
                            {
                                bufferLenght = 1;
                            }

                            // setup buffer to read data from socket
                            buffer = new byte[bufferLenght];

                            // trying to read from socket
                            int bytes = sslStream.Read(buffer, 0, buffer.Length);

                            bytesCounter += bytes;

                            if (bytes > 0)
                            {
                                // data was read!
                                // output as string
                                // mind to use only the amount of data actually read because it could be less than the requested count
                                Debug.Write(new String(Encoding.UTF8.GetChars(buffer, 0, bytes)));
                            }
                        }
                        while (sslStream.DataAvailable);

                        Debug.WriteLine($"Read {bytesCounter} bytes");
                    }
                }
                catch (Exception ex)
                {
                    OutputConnectionError(ex, operation);
                }
            }

            Thread.Sleep(Timeout.Infinite);
        }

        private const string OperationConnecting = "connecting";
        private const string OperationAuthenticating = "authenticating with the server";

        /// <summary>
        /// Outputs the details of an exception thrown while communicating with the server.
        /// </summary>
        /// <param name="ex">The exception to output.</param>
        /// <param name="operation">The operation that was being performed when the exception was thrown.</param>
        private static void OutputConnectionError(Exception ex, string operation)
        {
            Debug.WriteLine($"** {ex.GetType().FullName} while {operation}: {ex.Message} **");

            if (ex is SocketException socketException)
            {
                Debug.WriteLine($"   socket error code {socketException.ErrorCode}");
            }
            else if (ex is CryptographicException cryptographicException)
            {
                int errorCode = cryptographicException.ErrorCode;

                if (errorCode < 0)
                {
                    // the error code is the raw mbedTLS error code
                    Debug.WriteLine($"   mbedTLS error -0x{-errorCode:X4}");
                }
                else if (operation == OperationAuthenticating)
                {
                    // when authenticating, the meaning of the error code depends on the native call that failed,
                    // which isn't known here: SecureClientInit (SSL context setup) or SecureConnect (TLS handshake)
                    // check the stack trace below to find out which one applies
                    Debug.WriteLine($"   error code {errorCode} (0x{errorCode:X}), possible causes:");
                    Debug.WriteLine($"   - if thrown by SecureClientInit: {GetSslErrorDescription(errorCode)}");
                    Debug.WriteLine($"   - if thrown by SecureConnect: {GetCertificateVerifyFlags(errorCode)}");
                }
                else
                {
                    Debug.WriteLine($"   error code {errorCode} (0x{errorCode:X})");
                }
            }
            else if (ex is OutOfMemoryException)
            {
                Debug.WriteLine("   the device may be low on heap");
            }

            if (ex.StackTrace != null)
            {
                Debug.WriteLine(ex.StackTrace);
            }
        }

        /// <summary>
        /// Gets a description of an <see cref="SslError"/> reported when setting up the SSL context.
        /// </summary>
        private static string GetSslErrorDescription(int errorCode)
        {
            switch ((SslError)errorCode)
            {
                case SslError.DrbgSeedFailed:
                    return "DrbgSeedFailed, the entropy source (hardware RNG) could not be initialised";

                case SslError.ConfigDefaultsFailed:
                    return "ConfigDefaultsFailed, setting the TLS configuration defaults failed";

                case SslError.UnsupportedProtocolVersion:
                    return "UnsupportedProtocolVersion, the requested TLS version is not supported on this device";

                case SslError.PrivateKeyParseFailed:
                    return "PrivateKeyParseFailed, the private key could not be parsed";

                case SslError.CertificateParseFailed:
                    return "CertificateParseFailed, a certificate could not be parsed";

                case SslError.OwnCertConfigFailed:
                    return "OwnCertConfigFailed, configuring the client certificate and private key failed";

                case SslError.SetupFailed:
                    return "SetupFailed, the SSL context setup failed";

                default:
                    return "unknown";
            }
        }

        /// <summary>
        /// Gets the reasons for a server certificate verification failure from the <c>MBEDTLS_X509_BADCERT_*</c> flags.
        /// </summary>
        private static string GetCertificateVerifyFlags(int flags)
        {
            StringBuilder reasons = new StringBuilder();

            AppendFlag(reasons, flags, 0x0001, "expired");
            AppendFlag(reasons, flags, 0x0002, "revoked");
            AppendFlag(reasons, flags, 0x0004, "host name doesn't match the certificate CN");
            AppendFlag(reasons, flags, 0x0008, "not signed by a trusted CA");
            AppendFlag(reasons, flags, 0x0040, "certificate missing");
            AppendFlag(reasons, flags, 0x0080, "verification skipped");
            AppendFlag(reasons, flags, 0x0100, "other");
            AppendFlag(reasons, flags, 0x0200, "not valid yet (check the device date and time)");
            AppendFlag(reasons, flags, 0x0800, "key usage mismatch");
            AppendFlag(reasons, flags, 0x1000, "extended key usage mismatch");
            AppendFlag(reasons, flags, 0x2000, "certificate type mismatch");
            AppendFlag(reasons, flags, 0x4000, "signed with an unsupported hash");
            AppendFlag(reasons, flags, 0x8000, "signed with an unsupported public key algorithm");
            AppendFlag(reasons, flags, 0x10000, "signed with an unsupported key (curve or key size)");

            return reasons.Length > 0 ? reasons.ToString() : "unknown";
        }

        private static void AppendFlag(StringBuilder reasons, int flags, int flag, string reason)
        {
            if ((flags & flag) != 0)
            {
                if (reasons.Length > 0)
                {
                    reasons.Append(", ");
                }

                reasons.Append(reason);
            }
        }

        // Identrust DST Root CA X3
        // from https://www.identrust.com/dst-root-ca-x3

        private const string _dstRootCAX3 =
@"-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----";

    }
}