| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.ComponentModel; |
| | | 6 | | using System.Globalization; |
| | | 7 | | using System.Runtime.CompilerServices; |
| | | 8 | | using CoreWCF.Channels; |
| | | 9 | | using CoreWCF.Runtime; |
| | | 10 | | using CoreWCF.Security; |
| | | 11 | | |
| | | 12 | | namespace CoreWCF.Security |
| | | 13 | | { |
| | | 14 | | public sealed class MessageSecurityOverTcp |
| | | 15 | | { |
| | | 16 | | internal const MessageCredentialType DefaultClientCredentialType = MessageCredentialType.Windows; |
| | | 17 | | internal const string DefaultServerIssuedTransitionTokenLifetimeString = "00:15:00"; |
| | | 18 | | |
| | | 19 | | private MessageCredentialType _clientCredentialType; |
| | | 20 | | private SecurityAlgorithmSuite _algorithmSuite; |
| | | 21 | | private bool _wasAlgorithmSuiteSet; |
| | | 22 | | |
| | 117 | 23 | | public MessageSecurityOverTcp() |
| | | 24 | | { |
| | 117 | 25 | | _clientCredentialType = DefaultClientCredentialType; |
| | 117 | 26 | | _algorithmSuite = SecurityAlgorithmSuite.Default; |
| | 117 | 27 | | } |
| | | 28 | | |
| | | 29 | | public MessageCredentialType ClientCredentialType |
| | | 30 | | { |
| | 0 | 31 | | get { return _clientCredentialType; } |
| | | 32 | | set |
| | | 33 | | { |
| | 12 | 34 | | if (!MessageCredentialTypeHelper.IsDefined(value)) |
| | | 35 | | { |
| | 0 | 36 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof(val |
| | | 37 | | } |
| | 12 | 38 | | _clientCredentialType = value; |
| | 12 | 39 | | } |
| | | 40 | | } |
| | | 41 | | |
| | | 42 | | public SecurityAlgorithmSuite AlgorithmSuite |
| | | 43 | | { |
| | 37 | 44 | | get { return _algorithmSuite; } |
| | | 45 | | set |
| | | 46 | | { |
| | 0 | 47 | | if (value == null) |
| | | 48 | | { |
| | 0 | 49 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(value)); |
| | | 50 | | } |
| | 0 | 51 | | _algorithmSuite = value; |
| | 0 | 52 | | _wasAlgorithmSuiteSet = true; |
| | 0 | 53 | | } |
| | | 54 | | } |
| | | 55 | | |
| | 0 | 56 | | internal bool WasAlgorithmSuiteSet => _wasAlgorithmSuiteSet; |
| | | 57 | | |
| | | 58 | | [MethodImpl(MethodImplOptions.NoInlining)] |
| | | 59 | | public SecurityBindingElement CreateSecurityBindingElement(bool isSecureTransportMode, bool isReliableSession, B |
| | | 60 | | { |
| | | 61 | | SecurityBindingElement result; |
| | | 62 | | SecurityBindingElement oneShotSecurity; |
| | 37 | 63 | | if (isSecureTransportMode) |
| | | 64 | | { |
| | 37 | 65 | | switch (_clientCredentialType) |
| | | 66 | | { |
| | | 67 | | case MessageCredentialType.None: |
| | 0 | 68 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Forma |
| | | 69 | | case MessageCredentialType.UserName: |
| | 37 | 70 | | oneShotSecurity = SecurityBindingElement.CreateUserNameOverTransportBindingElement(); |
| | 37 | 71 | | break; |
| | | 72 | | case MessageCredentialType.Certificate: |
| | 0 | 73 | | oneShotSecurity = SecurityBindingElement.CreateCertificateOverTransportBindingElement(); |
| | 0 | 74 | | break; |
| | | 75 | | case MessageCredentialType.Windows: |
| | 0 | 76 | | oneShotSecurity = SecurityBindingElement.CreateSspiNegotiationOverTransportBindingElement(true); |
| | 0 | 77 | | break; |
| | | 78 | | case MessageCredentialType.IssuedToken: |
| | 0 | 79 | | throw new NotImplementedException(); |
| | | 80 | | // oneShotSecurity = SecurityBindingElement.CreateIssuedTokenOverTransportBindingElement(IssuedSe |
| | | 81 | | default: |
| | | 82 | | Fx.Assert("unknown ClientCredentialType"); |
| | 0 | 83 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException()); |
| | | 84 | | } |
| | 37 | 85 | | result = SecurityBindingElement.CreateSecureConversationBindingElement(oneShotSecurity); |
| | | 86 | | } |
| | | 87 | | else |
| | | 88 | | { |
| | 0 | 89 | | throw new NotSupportedException(); |
| | | 90 | | /* switch (this.clientCredentialType) |
| | | 91 | | { |
| | | 92 | | case MessageCredentialType.None: |
| | | 93 | | oneShotSecurity = SecurityBindingElement.CreateSslNegotiationBindingElement(false, true); |
| | | 94 | | break; |
| | | 95 | | case MessageCredentialType.UserName: |
| | | 96 | | // require cancellation so that impersonation is possible |
| | | 97 | | oneShotSecurity = SecurityBindingElement.CreateUserNameForSslBindingElement(true); |
| | | 98 | | break; |
| | | 99 | | case MessageCredentialType.Certificate: |
| | | 100 | | oneShotSecurity = SecurityBindingElement.CreateSslNegotiationBindingElement(true, true); |
| | | 101 | | break; |
| | | 102 | | case MessageCredentialType.Windows: |
| | | 103 | | // require cancellation so that impersonation is possible |
| | | 104 | | oneShotSecurity = SecurityBindingElement.CreateSspiNegotiationBindingElement(true); |
| | | 105 | | break; |
| | | 106 | | case MessageCredentialType.IssuedToken: |
| | | 107 | | oneShotSecurity = SecurityBindingElement.CreateIssuedTokenForSslBindingElement(IssuedSecurityTok |
| | | 108 | | break; |
| | | 109 | | default: |
| | | 110 | | Fx.Assert("unknown ClientCredentialType"); |
| | | 111 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException()); |
| | | 112 | | } |
| | | 113 | | result = SecurityBindingElement.CreateSecureConversationBindingElement(oneShotSecurity, true);*/ |
| | | 114 | | } |
| | | 115 | | |
| | | 116 | | // set the algorithm suite and issued token params if required |
| | 37 | 117 | | result.DefaultAlgorithmSuite = oneShotSecurity.DefaultAlgorithmSuite = AlgorithmSuite; |
| | | 118 | | |
| | 37 | 119 | | result.IncludeTimestamp = true; |
| | 37 | 120 | | if (!isReliableSession) |
| | | 121 | | { |
| | 37 | 122 | | result.LocalServiceSettings.ReconnectTransportOnFailure = false; |
| | | 123 | | } |
| | | 124 | | else |
| | | 125 | | { |
| | 0 | 126 | | result.LocalServiceSettings.ReconnectTransportOnFailure = true; |
| | | 127 | | } |
| | | 128 | | |
| | | 129 | | // since a session is always bootstrapped, configure the transition sct to live for a short time only |
| | 37 | 130 | | oneShotSecurity.LocalServiceSettings.IssuedCookieLifetime = TimeSpan.Parse(DefaultServerIssuedTransitionToke |
| | 37 | 131 | | result.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFe |
| | 37 | 132 | | oneShotSecurity.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConve |
| | | 133 | | |
| | 37 | 134 | | return result; |
| | | 135 | | } |
| | | 136 | | } |
| | | 137 | | } |