Skip to content

Commit 3c20b6e

Browse files
martin-tomanmartin-toman
committed
new draft
1 parent 47482f5 commit 3c20b6e

File tree

6 files changed

+42
-27
lines changed

6 files changed

+42
-27
lines changed

‎src/Agent.Listener/Configuration.Windows/RSAEncryptedFileKeyManager.cs

+18-13
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,11 @@ private RSA CreateKeyStoreKeyInNamedContainer(bool useCng)
5757

5858
CspParameters Params = new CspParameters();
5959
Params.KeyContainerName = "AgentKeyContainer" + Guid.NewGuid().ToString();
60-
Params.Flags |= CspProviderFlags.UseNonExportableKey | CspProviderFlags.UseMachineKeyStore;
61-
rsa = new RSACryptoServiceProvider(2048, Params);
60+
Params.Flags |= CspProviderFlags.UseMachineKeyStore;
61+
using (var csp = new RSACryptoServiceProvider(2048, Params))
62+
{
63+
rsa = RSA.Create(csp.ExportParameters(includePrivateParameters: true));
64+
}
6265

6366
// Now write the parameters to disk
6467
SaveParameters(default(RSAParameters), Params.KeyContainerName, useCng);
@@ -79,8 +82,11 @@ private RSA CreateKeyStoreKeyInNamedContainer(bool useCng)
7982

8083
CspParameters Params = new CspParameters();
8184
Params.KeyContainerName = result.containerName;
82-
Params.Flags |= CspProviderFlags.UseNonExportableKey | CspProviderFlags.UseMachineKeyStore;
83-
rsa = new RSACryptoServiceProvider(Params);
85+
Params.Flags |= CspProviderFlags.UseMachineKeyStore;
86+
using (var csp = new RSACryptoServiceProvider(Params))
87+
{
88+
rsa = RSA.Create(csp.ExportParameters(includePrivateParameters: true));
89+
}
8490
}
8591

8692
return rsa;
@@ -93,12 +99,12 @@ private RSA CreateKeyStoreKeyInNamedContainer(bool useCng)
9399

94100
private RSA CreateKeyStoreKeyInFile(bool useCng)
95101
{
96-
RSACryptoServiceProvider rsa = null;
102+
RSA rsa = null;
97103
if (!File.Exists(_keyFile))
98104
{
99105
Trace.Info("Creating new RSA key using 2048-bit key length");
100106

101-
rsa = new RSACryptoServiceProvider(2048);
107+
rsa = RSA.Create(2048);
102108

103109
// Now write the parameters to disk
104110
SaveParameters(rsa.ExportParameters(true), string.Empty, false);
@@ -116,7 +122,6 @@ private RSA CreateKeyStoreKeyInFile(bool useCng)
116122
return CreateKeyStoreKeyInNamedContainer(useCng);
117123
}
118124

119-
rsa = new RSACryptoServiceProvider();
120125
rsa.ImportParameters(result.rsaParameters);
121126
}
122127

@@ -170,9 +175,11 @@ private RSA GetKeyFromNamedContainer()
170175
Trace.Info("Using RSACryptoServiceProvider");
171176
CspParameters Params = new CspParameters();
172177
Params.KeyContainerName = result.containerName;
173-
Params.Flags |= CspProviderFlags.UseNonExportableKey | CspProviderFlags.UseMachineKeyStore;
174-
var rsa = new RSACryptoServiceProvider(Params);
175-
return rsa;
178+
Params.Flags |= CspProviderFlags.UseMachineKeyStore;
179+
using (var csp = new RSACryptoServiceProvider(Params))
180+
{
181+
return RSA.Create(csp.ExportParameters(includePrivateParameters: true));
182+
}
176183
}
177184
}
178185

@@ -193,9 +200,7 @@ private RSA GetKeyFromFile()
193200
return GetKeyFromNamedContainer();
194201
}
195202

196-
var rsa = new RSACryptoServiceProvider();
197-
rsa.ImportParameters(result.rsaParameters);
198-
return rsa;
203+
return RSA.Create(result.rsaParameters);
199204
}
200205

201206
private (string containerName, bool useCng, RSAParameters rsaParameters) LoadParameters()

‎src/Agent.Listener/Configuration/IRSAKeyManager.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ public interface IRSAKeyManager : IAgentService
3535
void DeleteKey();
3636

3737
/// <summary>
38-
/// Gets the <c>RSACryptoServiceProvider</c> instance currently stored by the key manager.
38+
/// Gets the <c>RSA</c> instance currently stored by the key manager.
3939
/// </summary>
40-
/// <returns>An <c>RSACryptoServiceProvider</c> instance representing the key for the agent</returns>
40+
/// <returns>An <c>RSA</c> implementation representing the key for the agent</returns>
4141
/// <exception cref="CryptographicException">No key exists in the store</exception>
4242
RSA GetKey();
4343
}

‎src/Agent.Listener/Configuration/RSAFileKeyManager.cs

+4-7
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ public class RSAFileKeyManager : AgentService, IRSAKeyManager
1616

1717
public RSA CreateKey(bool enableAgentKeyStoreInNamedContainer, bool useCng)
1818
{
19-
RSACryptoServiceProvider rsa = null;
19+
RSA rsa = null;
2020
if (!File.Exists(_keyFile))
2121
{
2222
Trace.Info("Creating new RSA key using 2048-bit key length");
2323

24-
rsa = new RSACryptoServiceProvider(2048);
24+
rsa = RSA.Create(2048);
2525

2626
// Now write the parameters to disk
2727
IOUtil.SaveObject(new RSAParametersSerializable("", false, rsa.ExportParameters(true)), _keyFile);
@@ -53,9 +53,7 @@ public RSA CreateKey(bool enableAgentKeyStoreInNamedContainer, bool useCng)
5353
else
5454
{
5555
Trace.Info("Found existing RSA key parameters file {0}", _keyFile);
56-
57-
rsa = new RSACryptoServiceProvider();
58-
rsa.ImportParameters(IOUtil.LoadObject<RSAParametersSerializable>(_keyFile).RSAParameters);
56+
rsa = RSA.Create(IOUtil.LoadObject<RSAParametersSerializable>(_keyFile).RSAParameters);
5957
}
6058

6159
return rsa;
@@ -80,8 +78,7 @@ public RSA GetKey()
8078
Trace.Info("Loading RSA key parameters from file {0}", _keyFile);
8179

8280
var parameters = IOUtil.LoadObject<RSAParametersSerializable>(_keyFile).RSAParameters;
83-
var rsa = new RSACryptoServiceProvider();
84-
rsa.ImportParameters(parameters);
81+
var rsa = RSA.Create(parameters);
8582
return rsa;
8683
}
8784

‎src/Agent.Listener/MessageListener.cs

+14-1
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ public async Task<Boolean> CreateSessionAsync(CancellationToken token)
9595
await _agentServer.ConnectAsync(new Uri(serverUrl), creds);
9696
Trace.Info("VssConnection created");
9797

98+
taskAgentSession.AgentCanHandleOaepSHA256 = true;
9899
_session = await _agentServer.CreateAgentSessionAsync(
99100
_settings.PoolId,
100101
taskAgentSession,
@@ -336,9 +337,21 @@ private ICryptoTransform GetMessageDecryptor(
336337
{
337338
// The agent session encryption key uses the AES symmetric algorithm
338339
var keyManager = HostContext.GetService<IRSAKeyManager>();
340+
RSAEncryptionPadding rsaPadding;
341+
switch (_session.EncryptionKey.EncryptionPadding)
342+
{
343+
case "OaepSHA256":
344+
rsaPadding = RSAEncryptionPadding.OaepSHA256;
345+
break;
346+
347+
default:
348+
rsaPadding = RSAEncryptionPadding.OaepSHA1;
349+
break;
350+
}
351+
339352
using (var rsa = keyManager.GetKey())
340353
{
341-
return aes.CreateDecryptor(rsa.Decrypt(_session.EncryptionKey.Value, RSAEncryptionPadding.OaepSHA1), message.IV);
354+
return aes.CreateDecryptor(rsa.Decrypt(_session.EncryptionKey.Value, rsaPadding), message.IV);
342355
}
343356
}
344357
else

‎src/Test/L0/Listener/Configuration/ConfigurationManagerL0.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ public sealed class ConfigurationManagerL0 : IDisposable
5858
private int _expectedPoolId = 1;
5959
private int _expectedDeploymentMachineId = 81;
6060
private int _expectedEnvironmentVMResourceId = 71;
61-
private RSACryptoServiceProvider rsa = null;
61+
private RSA rsa = null;
6262
private AgentSettings _configMgrAgentSettings = new AgentSettings();
6363

6464
public ConfigurationManagerL0()
@@ -129,7 +129,7 @@ public ConfigurationManagerL0()
129129
_agentServer.Setup(x => x.AddAgentAsync(It.IsAny<int>(), It.IsAny<TaskAgent>())).Returns(Task.FromResult(expectedAgent));
130130
_agentServer.Setup(x => x.UpdateAgentAsync(It.IsAny<int>(), It.IsAny<TaskAgent>())).Returns(Task.FromResult(expectedAgent));
131131

132-
rsa = new RSACryptoServiceProvider(2048);
132+
rsa = RSA.Create(2048);
133133

134134
_rsaKeyManager.Setup(x => x.CreateKey(It.IsAny<bool>(), It.IsAny<bool>())).Returns(rsa);
135135

‎src/Test/L0/Listener/MessageListenerL0.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public sealed class MessageListenerL0 : IDisposable
2929
private Mock<ICapabilitiesManager> _capabilitiesManager;
3030
private Mock<IFeatureFlagProvider> _featureFlagProvider;
3131
private Mock<IRSAKeyManager> _rsaKeyManager;
32-
private readonly RSACryptoServiceProvider rsa;
32+
private readonly RSA rsa;
3333

3434
public MessageListenerL0()
3535
{
@@ -45,7 +45,7 @@ public MessageListenerL0()
4545
_featureFlagProvider.Setup(x => x.GetFeatureFlagAsync(It.IsAny<IHostContext>(), It.IsAny<string>(), It.IsAny<ITraceWriter>(), It.IsAny<CancellationToken>())).Returns(Task.FromResult(new FeatureAvailability.FeatureFlag("", "", "", "Off", "Off")));
4646
_featureFlagProvider.Setup(x => x.GetFeatureFlagWithCred(It.IsAny<IHostContext>(), It.IsAny<string>(), It.IsAny<ITraceWriter>(), It.IsAny<AgentSettings>(), It.IsAny<VssCredentials>(), It.IsAny<CancellationToken>())).Returns(Task.FromResult(new FeatureAvailability.FeatureFlag("", "", "", "Off", "Off")));
4747

48-
rsa = new RSACryptoServiceProvider(2048);
48+
rsa = RSA.Create(2048);
4949
_rsaKeyManager.Setup(x => x.CreateKey(It.IsAny<bool>(), It.IsAny<bool>())).Returns(rsa);
5050
}
5151

0 commit comments

Comments
 (0)