| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Net; |
| | | 6 | | using System.Net.Security; |
| | | 7 | | using System.Xml; |
| | | 8 | | using CoreWCF.Description; |
| | | 9 | | |
| | | 10 | | namespace CoreWCF.Channels |
| | | 11 | | { |
| | | 12 | | public class HttpsTransportBindingElement : HttpTransportBindingElement, ITransportTokenAssertionProvider |
| | | 13 | | { |
| | | 14 | | private MessageSecurityVersion _messageSecurityVersion; |
| | | 15 | | private XmlElement _transportTokenAssertion; |
| | | 16 | | |
| | 427 | 17 | | public HttpsTransportBindingElement() : base() |
| | | 18 | | { |
| | 427 | 19 | | RequireClientCertificate = TransportDefaults.RequireClientCertificate; |
| | 427 | 20 | | } |
| | | 21 | | |
| | | 22 | | protected HttpsTransportBindingElement(HttpsTransportBindingElement elementToBeCloned) |
| | 1451 | 23 | | : base(elementToBeCloned) |
| | | 24 | | { |
| | 1451 | 25 | | RequireClientCertificate = elementToBeCloned.RequireClientCertificate; |
| | 1451 | 26 | | _messageSecurityVersion = elementToBeCloned.MessageSecurityVersion; |
| | 1451 | 27 | | } |
| | | 28 | | |
| | | 29 | | private HttpsTransportBindingElement(HttpTransportBindingElement elementToBeCloned) |
| | 0 | 30 | | : base(elementToBeCloned) |
| | | 31 | | { |
| | 0 | 32 | | } |
| | | 33 | | |
| | 4134 | 34 | | public bool RequireClientCertificate { get; set; } |
| | | 35 | | |
| | | 36 | | public override string Scheme |
| | | 37 | | { |
| | 490 | 38 | | get { return "https"; } |
| | | 39 | | } |
| | | 40 | | |
| | | 41 | | internal MessageSecurityVersion MessageSecurityVersion |
| | | 42 | | { |
| | | 43 | | get |
| | | 44 | | { |
| | 1451 | 45 | | return _messageSecurityVersion; |
| | | 46 | | } |
| | | 47 | | set |
| | | 48 | | { |
| | 15 | 49 | | if (value == null) |
| | | 50 | | { |
| | 0 | 51 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException(nameof(value))); |
| | | 52 | | } |
| | 15 | 53 | | _messageSecurityVersion = value; |
| | 15 | 54 | | } |
| | | 55 | | } |
| | | 56 | | |
| | | 57 | | public override BindingElement Clone() |
| | | 58 | | { |
| | 1451 | 59 | | return new HttpsTransportBindingElement(this); |
| | | 60 | | } |
| | | 61 | | |
| | | 62 | | internal override bool GetSupportsClientAuthenticationImpl(AuthenticationSchemes effectiveAuthenticationSchemes) |
| | | 63 | | { |
| | 0 | 64 | | return RequireClientCertificate || base.GetSupportsClientAuthenticationImpl(effectiveAuthenticationSchemes); |
| | | 65 | | } |
| | | 66 | | |
| | | 67 | | internal override bool GetSupportsClientWindowsIdentityImpl(AuthenticationSchemes effectiveAuthenticationSchemes |
| | | 68 | | { |
| | 0 | 69 | | return RequireClientCertificate || base.GetSupportsClientWindowsIdentityImpl(effectiveAuthenticationSchemes) |
| | | 70 | | } |
| | | 71 | | |
| | | 72 | | internal static HttpsTransportBindingElement CreateFromHttpBindingElement(HttpTransportBindingElement elementToB |
| | | 73 | | { |
| | 0 | 74 | | return new HttpsTransportBindingElement(elementToBeCloned); |
| | | 75 | | } |
| | | 76 | | |
| | | 77 | | public override T GetProperty<T>(BindingContext context) |
| | | 78 | | { |
| | 152 | 79 | | if (context == null) |
| | | 80 | | { |
| | 0 | 81 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(context)); |
| | | 82 | | } |
| | 152 | 83 | | if (typeof(T) == typeof(ISecurityCapabilities)) |
| | | 84 | | { |
| | 0 | 85 | | AuthenticationSchemes effectiveAuthenticationSchemes = GetEffectiveAuthenticationSchemes(AuthenticationS |
| | 0 | 86 | | context.BindingParameters); |
| | | 87 | | |
| | 0 | 88 | | return (T)(object)new SecurityCapabilities(GetSupportsClientAuthenticationImpl(effectiveAuthenticationSc |
| | 0 | 89 | | true, |
| | 0 | 90 | | GetSupportsClientWindowsIdentityImpl(effectiveAuthenticationSchemes), |
| | 0 | 91 | | ProtectionLevel.EncryptAndSign, |
| | 0 | 92 | | ProtectionLevel.EncryptAndSign); |
| | | 93 | | } |
| | | 94 | | else |
| | | 95 | | { |
| | 152 | 96 | | return base.GetProperty<T>(context); |
| | | 97 | | } |
| | | 98 | | } |
| | | 99 | | |
| | | 100 | | internal override void OnExportPolicy(MetadataExporter exporter, PolicyConversionContext context) |
| | | 101 | | { |
| | 22 | 102 | | base.OnExportPolicy(exporter, context); |
| | 22 | 103 | | var tsbe = context.BindingElements.Find<TransportSecurityBindingElement>(); |
| | 22 | 104 | | if (tsbe != null) |
| | | 105 | | { |
| | 19 | 106 | | _transportTokenAssertion = CreateTransportTokenAssertion(tsbe.MessageSecurityVersion.SecurityPolicyVersi |
| | 19 | 107 | | SecurityBindingElement.ExportPolicyForTransportTokenAssertionProviders(exporter, context); |
| | 19 | 108 | | _transportTokenAssertion = null; |
| | | 109 | | } |
| | | 110 | | else |
| | | 111 | | { |
| | | 112 | | // The below code used to be in ExportPolicyForTransportTokenAssertionProviders but as it can't access t |
| | | 113 | | // it's now been moved inline. This is the code that used to be executed before calling ExportTransportS |
| | 3 | 114 | | TransportSecurityBindingElement dummyTransportBindingElement = new TransportSecurityBindingElement(); |
| | 3 | 115 | | if (context.BindingElements.Find<SecurityBindingElement>() == null) |
| | | 116 | | { |
| | 3 | 117 | | dummyTransportBindingElement.IncludeTimestamp = false; |
| | | 118 | | } |
| | | 119 | | |
| | | 120 | | // In order to generate the right sp assertion without SBE. |
| | | 121 | | // scenario: WSxHttpBinding with SecurityMode.Transport. |
| | 3 | 122 | | if (_messageSecurityVersion != null) |
| | | 123 | | { |
| | 0 | 124 | | dummyTransportBindingElement.MessageSecurityVersion = _messageSecurityVersion; |
| | | 125 | | } |
| | | 126 | | |
| | 3 | 127 | | _transportTokenAssertion = CreateTransportTokenAssertion(dummyTransportBindingElement.MessageSecurityVer |
| | 3 | 128 | | SecurityBindingElement.ExportTransportSecurityBindingElement(dummyTransportBindingElement, this, exporte |
| | 3 | 129 | | _transportTokenAssertion = null; |
| | | 130 | | } |
| | 3 | 131 | | } |
| | | 132 | | |
| | | 133 | | private XmlElement CreateTransportTokenAssertion(Security.SecurityPolicyVersion securityPolicyVersion, MetadataE |
| | | 134 | | { |
| | 22 | 135 | | XmlElement assertion = null; |
| | 22 | 136 | | if (securityPolicyVersion == Security.SecurityPolicyVersion.WSSecurityPolicy11) |
| | | 137 | | { |
| | 22 | 138 | | assertion = CreateWsspAssertion(securityPolicyVersion, "HttpsToken"); // WSSecurityPolicy.HttpsTokenName |
| | 22 | 139 | | assertion.SetAttribute("RequireClientCertificate", // WSSecurityPolicy.RequireClientCertificateName |
| | 22 | 140 | | RequireClientCertificate ? "true" : "false"); |
| | | 141 | | } |
| | 0 | 142 | | else if (securityPolicyVersion == Security.SecurityPolicyVersion.WSSecurityPolicy12) |
| | | 143 | | { |
| | 0 | 144 | | assertion = CreateWsspAssertion(securityPolicyVersion, "HttpsToken"); // WSSecurityPolicy.HttpsTokenName |
| | 0 | 145 | | if (RequireClientCertificate || |
| | 0 | 146 | | AuthenticationScheme == AuthenticationSchemes.Basic || |
| | 0 | 147 | | AuthenticationScheme == AuthenticationSchemes.Digest) |
| | | 148 | | { |
| | 0 | 149 | | var doc = new XmlDocument(); |
| | 0 | 150 | | XmlElement policy = doc.CreateElement("wsp", // WspPrefix |
| | 0 | 151 | | "Policy", // PolicyName |
| | 0 | 152 | | exporter.PolicyVersion.Namespace); |
| | 0 | 153 | | if (RequireClientCertificate) |
| | | 154 | | { |
| | 0 | 155 | | policy.AppendChild(CreateWsspAssertion(securityPolicyVersion, "RequireClientCertificate")); |
| | | 156 | | } |
| | 0 | 157 | | if (AuthenticationScheme == AuthenticationSchemes.Basic) |
| | | 158 | | { |
| | 0 | 159 | | policy.AppendChild(CreateWsspAssertion(securityPolicyVersion, "HttpBasicAuthentication")); |
| | | 160 | | } |
| | 0 | 161 | | else if (AuthenticationScheme == AuthenticationSchemes.Digest) |
| | | 162 | | { |
| | 0 | 163 | | policy.AppendChild(CreateWsspAssertion(securityPolicyVersion, "HttpDigestAuthentication")); |
| | | 164 | | } |
| | 0 | 165 | | assertion.AppendChild(policy); |
| | | 166 | | } |
| | | 167 | | } |
| | | 168 | | |
| | 22 | 169 | | return assertion; |
| | | 170 | | } |
| | | 171 | | |
| | | 172 | | private XmlElement CreateWsspAssertion(Security.SecurityPolicyVersion policyVersion, string name) |
| | | 173 | | { |
| | 22 | 174 | | string policyNamespace = string.Empty; |
| | 22 | 175 | | if (policyVersion == Security.SecurityPolicyVersion.WSSecurityPolicy11) |
| | | 176 | | { |
| | 22 | 177 | | policyNamespace = @"http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"; //WSSecurityPolicy11.WsspName |
| | | 178 | | } |
| | 0 | 179 | | else if(policyVersion == Security.SecurityPolicyVersion.WSSecurityPolicy12) |
| | | 180 | | { |
| | 0 | 181 | | policyNamespace = @"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"; //WSSecurityPolicy12.Wss |
| | | 182 | | } |
| | | 183 | | |
| | 22 | 184 | | var doc = new XmlDocument(); |
| | 22 | 185 | | XmlElement result = doc.CreateElement("sp", // WSSecurityPolicy.WsspPrefix |
| | 22 | 186 | | name, |
| | 22 | 187 | | policyNamespace); |
| | 22 | 188 | | return result; |
| | | 189 | | } |
| | | 190 | | |
| | | 191 | | #region ITransportTokenAssertionProvider Members |
| | | 192 | | |
| | | 193 | | public XmlElement GetTransportTokenAssertion() |
| | | 194 | | { |
| | 22 | 195 | | return _transportTokenAssertion; |
| | | 196 | | } |
| | | 197 | | |
| | | 198 | | #endregion |
| | | 199 | | } |
| | | 200 | | } |