| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.Generic; |
| | | 6 | | using System.Collections.ObjectModel; |
| | | 7 | | using System.Net.Security; |
| | | 8 | | using System.Xml; |
| | | 9 | | using CoreWCF.Configuration; |
| | | 10 | | using CoreWCF.Description; |
| | | 11 | | using CoreWCF.IdentityModel.Selectors; |
| | | 12 | | using CoreWCF.IdentityModel.Tokens; |
| | | 13 | | using CoreWCF.Runtime; |
| | | 14 | | using CoreWCF.Runtime.Diagnostics; |
| | | 15 | | using CoreWCF.Security; |
| | | 16 | | using CoreWCF.Security.Tokens; |
| | | 17 | | |
| | | 18 | | namespace CoreWCF.Channels |
| | | 19 | | { |
| | | 20 | | public abstract class SecurityBindingElement : BindingElement |
| | | 21 | | { |
| | | 22 | | internal const string DefaultAlgorithmSuiteString = "Default"; |
| | 4 | 23 | | internal static readonly SecurityAlgorithmSuite s_defaultDefaultAlgorithmSuite = SecurityAlgorithmSuite.Default; |
| | | 24 | | internal const bool DefaultIncludeTimestamp = true; |
| | | 25 | | internal const bool DefaultAllowInsecureTransport = false; |
| | | 26 | | internal const MessageProtectionOrder DefaultMessageProtectionOrder = MessageProtectionOrder.SignBeforeEncryptAn |
| | | 27 | | internal const bool DefaultRequireSignatureConfirmation = false; |
| | | 28 | | internal const bool DefaultEnableUnsecuredResponse = false; |
| | | 29 | | internal const bool DefaultProtectTokens = false; |
| | | 30 | | private SecurityAlgorithmSuite _defaultAlgorithmSuite; |
| | | 31 | | private SecurityKeyEntropyMode _keyEntropyMode; |
| | | 32 | | private readonly Dictionary<string, SupportingTokenParameters> _operationSupportingTokenParameters; |
| | | 33 | | private readonly Dictionary<string, SupportingTokenParameters> _optionalOperationSupportingTokenParameters; |
| | | 34 | | private MessageSecurityVersion _messageSecurityVersion; |
| | | 35 | | private SecurityHeaderLayout _securityHeaderLayout; |
| | | 36 | | |
| | | 37 | | internal SecurityBindingElement() |
| | 372 | 38 | | : base() |
| | | 39 | | { |
| | 372 | 40 | | _messageSecurityVersion = MessageSecurityVersion.Default; |
| | 372 | 41 | | _keyEntropyMode = SecurityKeyEntropyMode.CombinedEntropy; // AcceleratedTokenProvider.defaultKeyEntropyMode; |
| | 372 | 42 | | IncludeTimestamp = DefaultIncludeTimestamp; |
| | 372 | 43 | | _defaultAlgorithmSuite = s_defaultDefaultAlgorithmSuite; |
| | 372 | 44 | | LocalServiceSettings = new LocalServiceSecuritySettings(); |
| | 372 | 45 | | EndpointSupportingTokenParameters = new SupportingTokenParameters(); |
| | 372 | 46 | | OptionalEndpointSupportingTokenParameters = new SupportingTokenParameters(); |
| | 372 | 47 | | _operationSupportingTokenParameters = new Dictionary<string, SupportingTokenParameters>(); |
| | 372 | 48 | | _optionalOperationSupportingTokenParameters = new Dictionary<string, SupportingTokenParameters>(); |
| | 372 | 49 | | _securityHeaderLayout = SecurityHeaderLayout.Strict; // SecurityProtocolFactory.defaultSecurityHeaderLayout; |
| | 372 | 50 | | AllowInsecureTransport = DefaultAllowInsecureTransport; |
| | 372 | 51 | | EnableUnsecuredResponse = DefaultEnableUnsecuredResponse; |
| | 372 | 52 | | ProtectTokens = DefaultProtectTokens; |
| | 372 | 53 | | } |
| | | 54 | | |
| | | 55 | | internal SecurityBindingElement(SecurityBindingElement elementToBeCloned) |
| | 1392 | 56 | | : base(elementToBeCloned) |
| | | 57 | | { |
| | 1392 | 58 | | if (elementToBeCloned == null) |
| | | 59 | | { |
| | 0 | 60 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(elementToBeCloned)); |
| | | 61 | | } |
| | | 62 | | |
| | 1392 | 63 | | _defaultAlgorithmSuite = elementToBeCloned._defaultAlgorithmSuite; |
| | 1392 | 64 | | IncludeTimestamp = elementToBeCloned.IncludeTimestamp; |
| | 1392 | 65 | | _keyEntropyMode = elementToBeCloned._keyEntropyMode; |
| | 1392 | 66 | | _messageSecurityVersion = elementToBeCloned._messageSecurityVersion; |
| | 1392 | 67 | | _securityHeaderLayout = elementToBeCloned._securityHeaderLayout; |
| | 1392 | 68 | | EndpointSupportingTokenParameters = (SupportingTokenParameters)elementToBeCloned.EndpointSupportingTokenPara |
| | 1392 | 69 | | OptionalEndpointSupportingTokenParameters = (SupportingTokenParameters)elementToBeCloned.OptionalEndpointSup |
| | 1392 | 70 | | _operationSupportingTokenParameters = new Dictionary<string, SupportingTokenParameters>(); |
| | 2784 | 71 | | foreach (string key in elementToBeCloned._operationSupportingTokenParameters.Keys) |
| | | 72 | | { |
| | 0 | 73 | | _operationSupportingTokenParameters[key] = (SupportingTokenParameters)elementToBeCloned._operationSuppor |
| | | 74 | | } |
| | 1392 | 75 | | _optionalOperationSupportingTokenParameters = new Dictionary<string, SupportingTokenParameters>(); |
| | 2784 | 76 | | foreach (string key in elementToBeCloned._optionalOperationSupportingTokenParameters.Keys) |
| | | 77 | | { |
| | 0 | 78 | | _optionalOperationSupportingTokenParameters[key] = (SupportingTokenParameters)elementToBeCloned._optiona |
| | | 79 | | } |
| | 1392 | 80 | | LocalServiceSettings = (LocalServiceSecuritySettings)elementToBeCloned.LocalServiceSettings.Clone(); |
| | | 81 | | // this.internalDuplexBindingElement = elementToBeCloned.internalDuplexBindingElement; |
| | 1392 | 82 | | MaxReceivedMessageSize = elementToBeCloned.MaxReceivedMessageSize; |
| | 1392 | 83 | | ReaderQuotas = elementToBeCloned.ReaderQuotas; |
| | 1392 | 84 | | DoNotEmitTrust = elementToBeCloned.DoNotEmitTrust; |
| | 1392 | 85 | | AllowInsecureTransport = elementToBeCloned.AllowInsecureTransport; |
| | 1392 | 86 | | EnableUnsecuredResponse = elementToBeCloned.EnableUnsecuredResponse; |
| | 1392 | 87 | | SupportsExtendedProtectionPolicy = elementToBeCloned.SupportsExtendedProtectionPolicy; |
| | 1392 | 88 | | ProtectTokens = elementToBeCloned.ProtectTokens; |
| | 1392 | 89 | | } |
| | | 90 | | |
| | 2786 | 91 | | internal bool SupportsExtendedProtectionPolicy { get; set; } |
| | | 92 | | |
| | 2514 | 93 | | public SupportingTokenParameters EndpointSupportingTokenParameters { get; } |
| | | 94 | | |
| | 1683 | 95 | | public SupportingTokenParameters OptionalEndpointSupportingTokenParameters { get; } |
| | | 96 | | |
| | | 97 | | public IDictionary<string, SupportingTokenParameters> OperationSupportingTokenParameters |
| | | 98 | | { |
| | | 99 | | get |
| | | 100 | | { |
| | 293 | 101 | | return _operationSupportingTokenParameters; |
| | | 102 | | } |
| | | 103 | | } |
| | | 104 | | |
| | | 105 | | public IDictionary<string, SupportingTokenParameters> OptionalOperationSupportingTokenParameters |
| | | 106 | | { |
| | | 107 | | get |
| | | 108 | | { |
| | 211 | 109 | | return _optionalOperationSupportingTokenParameters; |
| | | 110 | | } |
| | | 111 | | } |
| | | 112 | | |
| | | 113 | | public SecurityHeaderLayout SecurityHeaderLayout |
| | | 114 | | { |
| | | 115 | | get |
| | | 116 | | { |
| | 77 | 117 | | return _securityHeaderLayout; |
| | | 118 | | } |
| | | 119 | | set |
| | | 120 | | { |
| | 71 | 121 | | if (!SecurityHeaderLayoutHelper.IsDefined(value)) |
| | | 122 | | { |
| | 0 | 123 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof(val |
| | | 124 | | } |
| | | 125 | | |
| | 71 | 126 | | _securityHeaderLayout = value; |
| | 71 | 127 | | } |
| | | 128 | | } |
| | | 129 | | |
| | | 130 | | public MessageSecurityVersion MessageSecurityVersion |
| | | 131 | | { |
| | | 132 | | get |
| | | 133 | | { |
| | 110 | 134 | | return _messageSecurityVersion; |
| | | 135 | | } |
| | | 136 | | set |
| | | 137 | | { |
| | 502 | 138 | | _messageSecurityVersion = value ?? throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new Argumen |
| | 502 | 139 | | } |
| | | 140 | | } |
| | | 141 | | |
| | 3221 | 142 | | public bool EnableUnsecuredResponse { get; set; } |
| | | 143 | | |
| | 3780 | 144 | | public bool IncludeTimestamp { get; set; } |
| | | 145 | | |
| | 3158 | 146 | | public bool AllowInsecureTransport { get; set; } |
| | | 147 | | |
| | | 148 | | public SecurityAlgorithmSuite DefaultAlgorithmSuite |
| | | 149 | | { |
| | | 150 | | get |
| | | 151 | | { |
| | 133 | 152 | | return _defaultAlgorithmSuite; |
| | | 153 | | } |
| | | 154 | | set |
| | | 155 | | { |
| | 419 | 156 | | _defaultAlgorithmSuite = value ?? throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new Argument |
| | 419 | 157 | | } |
| | | 158 | | } |
| | | 159 | | |
| | 3157 | 160 | | public bool ProtectTokens { get; set; } = DefaultProtectTokens; |
| | | 161 | | |
| | 2549 | 162 | | public LocalServiceSecuritySettings LocalServiceSettings { get; } |
| | | 163 | | |
| | | 164 | | public SecurityKeyEntropyMode KeyEntropyMode |
| | | 165 | | { |
| | | 166 | | get |
| | | 167 | | { |
| | 41 | 168 | | return _keyEntropyMode; |
| | | 169 | | } |
| | | 170 | | set |
| | | 171 | | { |
| | 1 | 172 | | if (!SecurityKeyEntropyModeHelper.IsDefined(value)) |
| | | 173 | | { |
| | 0 | 174 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof(val |
| | | 175 | | } |
| | 1 | 176 | | _keyEntropyMode = value; |
| | 1 | 177 | | } |
| | | 178 | | } |
| | | 179 | | |
| | | 180 | | internal virtual bool SessionMode |
| | | 181 | | { |
| | 0 | 182 | | get { return false; } |
| | | 183 | | } |
| | | 184 | | |
| | | 185 | | internal virtual bool SupportsDuplex |
| | | 186 | | { |
| | 0 | 187 | | get { return false; } |
| | | 188 | | } |
| | | 189 | | |
| | | 190 | | internal virtual bool SupportsRequestReply |
| | | 191 | | { |
| | 0 | 192 | | get { return false; } |
| | | 193 | | } |
| | | 194 | | |
| | 4677 | 195 | | internal long MaxReceivedMessageSize { get; set; } = TransportDefaults.MaxReceivedMessageSize; |
| | | 196 | | |
| | 2803 | 197 | | internal bool DoNotEmitTrust { get; set; } = false; |
| | | 198 | | |
| | 2988 | 199 | | internal XmlDictionaryReaderQuotas ReaderQuotas { get; set; } |
| | | 200 | | |
| | | 201 | | private void GetSupportingTokensCapabilities(ICollection<SecurityTokenParameters> parameters, out bool supportsC |
| | | 202 | | { |
| | 555 | 203 | | supportsClientAuth = false; |
| | 555 | 204 | | supportsWindowsIdentity = false; |
| | 1476 | 205 | | foreach (SecurityTokenParameters p in parameters) |
| | | 206 | | { |
| | 183 | 207 | | if (p.SupportsClientAuthentication) |
| | | 208 | | { |
| | 183 | 209 | | supportsClientAuth = true; |
| | | 210 | | } |
| | | 211 | | |
| | 183 | 212 | | if (p.SupportsClientWindowsIdentity) |
| | | 213 | | { |
| | 183 | 214 | | supportsWindowsIdentity = true; |
| | | 215 | | } |
| | | 216 | | } |
| | 555 | 217 | | } |
| | | 218 | | |
| | | 219 | | private void GetSupportingTokensCapabilities(SupportingTokenParameters requirements, out bool supportsClientAuth |
| | | 220 | | { |
| | 185 | 221 | | supportsClientAuth = false; |
| | 185 | 222 | | supportsWindowsIdentity = false; |
| | 185 | 223 | | GetSupportingTokensCapabilities(requirements.Endorsing, out bool tmpSupportsClientAuth, out bool tmpSupports |
| | 185 | 224 | | supportsClientAuth = supportsClientAuth || tmpSupportsClientAuth; |
| | 185 | 225 | | supportsWindowsIdentity = supportsWindowsIdentity || tmpSupportsWindowsIdentity; |
| | | 226 | | |
| | 185 | 227 | | GetSupportingTokensCapabilities(requirements.SignedEndorsing, out tmpSupportsClientAuth, out tmpSupportsWind |
| | 185 | 228 | | supportsClientAuth = supportsClientAuth || tmpSupportsClientAuth; |
| | 185 | 229 | | supportsWindowsIdentity = supportsWindowsIdentity || tmpSupportsWindowsIdentity; |
| | | 230 | | |
| | 185 | 231 | | GetSupportingTokensCapabilities(requirements.SignedEncrypted, out tmpSupportsClientAuth, out tmpSupportsWind |
| | 185 | 232 | | supportsClientAuth = supportsClientAuth || tmpSupportsClientAuth; |
| | 185 | 233 | | supportsWindowsIdentity = supportsWindowsIdentity || tmpSupportsWindowsIdentity; |
| | 185 | 234 | | } |
| | | 235 | | |
| | | 236 | | internal void GetSupportingTokensCapabilities(out bool supportsClientAuth, out bool supportsWindowsIdentity) |
| | | 237 | | { |
| | 185 | 238 | | GetSupportingTokensCapabilities(EndpointSupportingTokenParameters, out supportsClientAuth, out supportsWindo |
| | 185 | 239 | | } |
| | | 240 | | |
| | | 241 | | internal void AddDemuxerForSecureConversation(ChannelBuilder builder, BindingContext secureConversationBindingCo |
| | | 242 | | { |
| | | 243 | | //new way |
| | 22 | 244 | | secureConversationBindingContext.BindingParameters.Add(builder); |
| | 22 | 245 | | } |
| | | 246 | | |
| | | 247 | | // SecureConversation needs a demuxer below security to 1) demux between the security sessions and 2) demux |
| | | 248 | | // to the authenticator |
| | | 249 | | internal void ApplyPropertiesOnDemuxer(ChannelBuilder builder, BindingContext context) |
| | | 250 | | { |
| | | 251 | | /* TODO later |
| | | 252 | | Collection<ChannelDemuxerBindingElement> demuxerElements = builder.Binding.Elements.FindAll<ChannelDemuxerB |
| | | 253 | | foreach (ChannelDemuxerBindingElement element in demuxerElements) |
| | | 254 | | { |
| | | 255 | | if (element != null) |
| | | 256 | | { |
| | | 257 | | element.MaxPendingSessions = this.LocalServiceSettings.MaxPendingSessions; |
| | | 258 | | element.PeekTimeout = this.LocalServiceSettings.NegotiationTimeout; |
| | | 259 | | } |
| | | 260 | | }*/ |
| | 22 | 261 | | } |
| | | 262 | | |
| | | 263 | | private static BindingContext CreateIssuerBindingContextForNegotiation(BindingContext issuerBindingContext) |
| | | 264 | | { |
| | 1 | 265 | | TransportBindingElement transport = issuerBindingContext.RemainingBindingElements.Find<TransportBindingEleme |
| | 1 | 266 | | if (transport == null) |
| | | 267 | | { |
| | 0 | 268 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR.Tra |
| | | 269 | | } |
| | | 270 | | //ChannelDemuxerBindingElement demuxer = null; |
| | | 271 | | //// pick the demuxer above transport (i.e. the last demuxer in the array) |
| | | 272 | | //for (int i = 0; i < issuerBindingContext.RemainingBindingElements.Count; ++i) |
| | | 273 | | //{ |
| | | 274 | | // if (issuerBindingContext.RemainingBindingElements[i] is ChannelDemuxerBindingElement) |
| | | 275 | | // { |
| | | 276 | | // demuxer = (ChannelDemuxerBindingElement)issuerBindingContext.RemainingBindingElements[i]; |
| | | 277 | | // } |
| | | 278 | | //} |
| | | 279 | | //if (demuxer == null) |
| | | 280 | | //{ |
| | | 281 | | // throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.GetString(S |
| | | 282 | | //} |
| | 1 | 283 | | BindingElementCollection negotiationBindingElements = new BindingElementCollection |
| | 1 | 284 | | { |
| | 1 | 285 | | //negotiationBindingElements.Add(demuxer.Clone()); |
| | 1 | 286 | | transport.Clone() |
| | 1 | 287 | | }; |
| | 1 | 288 | | CustomBinding binding = new CustomBinding(negotiationBindingElements) |
| | 1 | 289 | | { |
| | 1 | 290 | | OpenTimeout = issuerBindingContext.Binding.OpenTimeout, |
| | 1 | 291 | | CloseTimeout = issuerBindingContext.Binding.CloseTimeout, |
| | 1 | 292 | | SendTimeout = issuerBindingContext.Binding.SendTimeout, |
| | 1 | 293 | | ReceiveTimeout = issuerBindingContext.Binding.ReceiveTimeout |
| | 1 | 294 | | }; |
| | 1 | 295 | | if (issuerBindingContext.ListenUriBaseAddress != null) |
| | | 296 | | { |
| | 1 | 297 | | return new BindingContext(binding, new BindingParameterCollection(issuerBindingContext.BindingParameters |
| | 1 | 298 | | issuerBindingContext.ListenUriRelativeAddress);//, issuerBindingContext.ListenUriMode); |
| | | 299 | | } |
| | | 300 | | else |
| | | 301 | | { |
| | 0 | 302 | | return new BindingContext(binding, new BindingParameterCollection(issuerBindingContext.BindingParameters |
| | | 303 | | } |
| | | 304 | | } |
| | | 305 | | |
| | | 306 | | public static TransportSecurityBindingElement CreateIssuedTokenOverTransportBindingElement(IssuedSecurityTokenPa |
| | | 307 | | { |
| | 50 | 308 | | if (issuedTokenParameters == null) |
| | | 309 | | { |
| | 0 | 310 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(issuedTokenParameters)); |
| | | 311 | | } |
| | | 312 | | |
| | 50 | 313 | | issuedTokenParameters.RequireDerivedKeys = false; |
| | 50 | 314 | | TransportSecurityBindingElement result = new TransportSecurityBindingElement(); |
| | 50 | 315 | | if (issuedTokenParameters.KeyType == SecurityKeyType.BearerKey) |
| | | 316 | | { |
| | 50 | 317 | | result.EndpointSupportingTokenParameters.Signed.Add(issuedTokenParameters); |
| | 50 | 318 | | result.MessageSecurityVersion = MessageSecurityVersion.WSSXDefault; |
| | | 319 | | } |
| | | 320 | | else |
| | | 321 | | { |
| | 0 | 322 | | result.EndpointSupportingTokenParameters.Endorsing.Add(issuedTokenParameters); |
| | 0 | 323 | | result.MessageSecurityVersion = MessageSecurityVersion.Default; |
| | | 324 | | } |
| | | 325 | | |
| | 50 | 326 | | result.LocalServiceSettings.DetectReplays = false; |
| | 50 | 327 | | result.IncludeTimestamp = true; |
| | | 328 | | |
| | 50 | 329 | | return result; |
| | | 330 | | } |
| | | 331 | | |
| | | 332 | | public static SymmetricSecurityBindingElement CreateIssuedTokenForCertificateBindingElement(IssuedSecurityTokenP |
| | | 333 | | { |
| | 0 | 334 | | if (issuedTokenParameters == null) |
| | 0 | 335 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(issuedTokenParameters)); |
| | | 336 | | |
| | 0 | 337 | | SymmetricSecurityBindingElement result = new SymmetricSecurityBindingElement( |
| | 0 | 338 | | new X509SecurityTokenParameters( |
| | 0 | 339 | | X509KeyIdentifierClauseType.Thumbprint, |
| | 0 | 340 | | SecurityTokenInclusionMode.Never)); |
| | 0 | 341 | | if (issuedTokenParameters.KeyType == SecurityKeyType.BearerKey) |
| | | 342 | | { |
| | 0 | 343 | | result.EndpointSupportingTokenParameters.SignedEncrypted.Add(issuedTokenParameters); |
| | 0 | 344 | | result.MessageSecurityVersion = MessageSecurityVersion.WSSXDefault; |
| | | 345 | | } |
| | | 346 | | else |
| | | 347 | | { |
| | 0 | 348 | | result.EndpointSupportingTokenParameters.Endorsing.Add(issuedTokenParameters); |
| | 0 | 349 | | result.MessageSecurityVersion = MessageSecurityVersion.Default; |
| | | 350 | | } |
| | 0 | 351 | | result.RequireSignatureConfirmation = true; |
| | 0 | 352 | | return result; |
| | | 353 | | } |
| | | 354 | | |
| | | 355 | | public static SymmetricSecurityBindingElement CreateIssuedTokenForSslBindingElement(IssuedSecurityTokenParameter |
| | | 356 | | { |
| | 0 | 357 | | if (issuedTokenParameters == null) |
| | 0 | 358 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(issuedTokenParameters)); |
| | | 359 | | |
| | 0 | 360 | | SymmetricSecurityBindingElement result = new SymmetricSecurityBindingElement( |
| | 0 | 361 | | new SslSecurityTokenParameters(false, requireCancellation)); |
| | 0 | 362 | | if (issuedTokenParameters.KeyType == SecurityKeyType.BearerKey) |
| | | 363 | | { |
| | 0 | 364 | | result.EndpointSupportingTokenParameters.SignedEncrypted.Add(issuedTokenParameters); |
| | 0 | 365 | | result.MessageSecurityVersion = MessageSecurityVersion.WSSXDefault; |
| | | 366 | | } |
| | | 367 | | else |
| | | 368 | | { |
| | 0 | 369 | | result.EndpointSupportingTokenParameters.Endorsing.Add(issuedTokenParameters); |
| | 0 | 370 | | result.MessageSecurityVersion = MessageSecurityVersion.Default; |
| | | 371 | | } |
| | 0 | 372 | | result.RequireSignatureConfirmation = true; |
| | 0 | 373 | | return result; |
| | | 374 | | } |
| | | 375 | | |
| | | 376 | | internal bool RequiresChannelDemuxer(SecurityTokenParameters parameters) |
| | | 377 | | { |
| | 24 | 378 | | return (parameters is SecureConversationSecurityTokenParameters) |
| | 24 | 379 | | || (parameters is SslSecurityTokenParameters) |
| | 24 | 380 | | || (parameters is SspiSecurityTokenParameters); |
| | | 381 | | } |
| | | 382 | | |
| | | 383 | | internal virtual bool RequiresChannelDemuxer() |
| | | 384 | | { |
| | 92 | 385 | | foreach (SecurityTokenParameters parameters in EndpointSupportingTokenParameters.Endorsing) |
| | | 386 | | { |
| | 24 | 387 | | if (RequiresChannelDemuxer(parameters)) |
| | | 388 | | { |
| | 22 | 389 | | return true; |
| | | 390 | | } |
| | | 391 | | } |
| | 22 | 392 | | foreach (SecurityTokenParameters parameters in EndpointSupportingTokenParameters.SignedEndorsing) |
| | | 393 | | { |
| | 0 | 394 | | if (RequiresChannelDemuxer(parameters)) |
| | | 395 | | { |
| | 0 | 396 | | return true; |
| | | 397 | | } |
| | | 398 | | } |
| | 22 | 399 | | foreach (SecurityTokenParameters parameters in OptionalEndpointSupportingTokenParameters.Endorsing) |
| | | 400 | | { |
| | 0 | 401 | | if (RequiresChannelDemuxer(parameters)) |
| | | 402 | | { |
| | 0 | 403 | | return true; |
| | | 404 | | } |
| | | 405 | | } |
| | 22 | 406 | | foreach (SecurityTokenParameters parameters in OptionalEndpointSupportingTokenParameters.SignedEndorsing) |
| | | 407 | | { |
| | 0 | 408 | | if (RequiresChannelDemuxer(parameters)) |
| | | 409 | | { |
| | 0 | 410 | | return true; |
| | | 411 | | } |
| | | 412 | | } |
| | 22 | 413 | | foreach (SupportingTokenParameters supportingParameters in OperationSupportingTokenParameters.Values) |
| | | 414 | | { |
| | 0 | 415 | | foreach (SecurityTokenParameters parameters in supportingParameters.Endorsing) |
| | | 416 | | { |
| | 0 | 417 | | if (RequiresChannelDemuxer(parameters)) |
| | | 418 | | { |
| | 0 | 419 | | return true; |
| | | 420 | | } |
| | | 421 | | } |
| | 0 | 422 | | foreach (SecurityTokenParameters parameters in supportingParameters.SignedEndorsing) |
| | | 423 | | { |
| | 0 | 424 | | if (RequiresChannelDemuxer(parameters)) |
| | | 425 | | { |
| | 0 | 426 | | return true; |
| | | 427 | | } |
| | | 428 | | } |
| | | 429 | | } |
| | 22 | 430 | | foreach (SupportingTokenParameters supportingParameters in OptionalOperationSupportingTokenParameters.Values |
| | | 431 | | { |
| | 0 | 432 | | foreach (SecurityTokenParameters parameters in supportingParameters.Endorsing) |
| | | 433 | | { |
| | 0 | 434 | | if (RequiresChannelDemuxer(parameters)) |
| | | 435 | | { |
| | 0 | 436 | | return true; |
| | | 437 | | } |
| | | 438 | | } |
| | 0 | 439 | | foreach (SecurityTokenParameters parameters in supportingParameters.SignedEndorsing) |
| | | 440 | | { |
| | 0 | 441 | | if (RequiresChannelDemuxer(parameters)) |
| | | 442 | | { |
| | 0 | 443 | | return true; |
| | | 444 | | } |
| | | 445 | | } |
| | | 446 | | } |
| | 11 | 447 | | return false; |
| | 22 | 448 | | } |
| | | 449 | | |
| | | 450 | | internal bool IsUnderlyingDispatcherDuplex<TChannel>(BindingContext context) |
| | | 451 | | { |
| | 22 | 452 | | return (typeof(TChannel) == typeof(IDuplexSessionChannel)) && context.CanBuildNextServiceDispatcher<IDuplexC |
| | 22 | 453 | | && !context.CanBuildNextServiceDispatcher<IDuplexSessionChannel>(); |
| | | 454 | | } |
| | | 455 | | |
| | | 456 | | internal void ConfigureProtocolFactory(SecurityProtocolFactory factory, SecurityCredentialsManager credentialsMa |
| | | 457 | | { |
| | 55 | 458 | | if (factory == null) |
| | | 459 | | { |
| | 0 | 460 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException(nameof(factory))); |
| | | 461 | | } |
| | | 462 | | |
| | 55 | 463 | | if (credentialsManager == null) |
| | | 464 | | { |
| | 0 | 465 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException(nameof(credentialsMa |
| | | 466 | | } |
| | | 467 | | |
| | 55 | 468 | | factory.AddTimestamp = IncludeTimestamp; |
| | 55 | 469 | | factory.IncomingAlgorithmSuite = DefaultAlgorithmSuite; |
| | 55 | 470 | | factory.OutgoingAlgorithmSuite = DefaultAlgorithmSuite; |
| | 55 | 471 | | factory.SecurityHeaderLayout = SecurityHeaderLayout; |
| | 55 | 472 | | factory.TimestampValidityDuration = LocalServiceSettings.TimestampValidityDuration; |
| | 55 | 473 | | factory.DetectReplays = LocalServiceSettings.DetectReplays; |
| | 55 | 474 | | factory.MaxCachedNonces = LocalServiceSettings.ReplayCacheSize; |
| | 55 | 475 | | factory.MaxClockSkew = LocalServiceSettings.MaxClockSkew; |
| | 55 | 476 | | factory.ReplayWindow = LocalServiceSettings.ReplayWindow; |
| | | 477 | | |
| | 55 | 478 | | if (LocalServiceSettings.DetectReplays) |
| | | 479 | | { |
| | 0 | 480 | | factory.NonceCache = LocalServiceSettings.NonceCache; |
| | | 481 | | } |
| | 55 | 482 | | factory.SecurityBindingElement = (SecurityBindingElement)Clone(); |
| | 55 | 483 | | factory.SecurityBindingElement.SetIssuerBindingContextIfRequired(issuerBindingContext); |
| | 55 | 484 | | factory.SecurityTokenManager = credentialsManager.CreateSecurityTokenManager(); |
| | 55 | 485 | | SecurityTokenSerializer tokenSerializer = factory.SecurityTokenManager.CreateSecurityTokenSerializer(_messag |
| | 55 | 486 | | factory.StandardsManager = new SecurityStandardsManager(_messageSecurityVersion, tokenSerializer); |
| | 55 | 487 | | } |
| | | 488 | | |
| | | 489 | | internal abstract SecurityProtocolFactory CreateSecurityProtocolFactory<TChannel>(BindingContext context, Securi |
| | | 490 | | bool isForService, BindingContext issuanceBindingContext); |
| | | 491 | | |
| | | 492 | | public override IServiceDispatcher BuildServiceDispatcher<TChannel>(BindingContext context, IServiceDispatcher i |
| | | 493 | | { |
| | 33 | 494 | | if (context == null) |
| | | 495 | | { |
| | 0 | 496 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(context)); |
| | | 497 | | } |
| | | 498 | | |
| | 33 | 499 | | if (!CanBuildServiceDispatcher<TChannel>(context)) |
| | | 500 | | { |
| | 0 | 501 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentException(SR.Format(SR.ChannelType |
| | | 502 | | } |
| | | 503 | | |
| | 33 | 504 | | ReaderQuotas = context.GetInnerProperty<XmlDictionaryReaderQuotas>(); |
| | 33 | 505 | | if (ReaderQuotas == null) |
| | | 506 | | { |
| | 0 | 507 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR.Enc |
| | | 508 | | } |
| | | 509 | | |
| | 33 | 510 | | TransportBindingElement transportBindingElement = null; |
| | 33 | 511 | | if (context.RemainingBindingElements != null) |
| | | 512 | | { |
| | 33 | 513 | | transportBindingElement = context.RemainingBindingElements.Find<TransportBindingElement>(); |
| | | 514 | | } |
| | | 515 | | |
| | 33 | 516 | | if (transportBindingElement != null) |
| | | 517 | | { |
| | 33 | 518 | | MaxReceivedMessageSize = transportBindingElement.MaxReceivedMessageSize; |
| | | 519 | | } |
| | | 520 | | |
| | 33 | 521 | | return BuildServiceDispatcherCore<TChannel>(context, innerDispatcher); |
| | | 522 | | } |
| | | 523 | | protected abstract IServiceDispatcher BuildServiceDispatcherCore<TChannel>(BindingContext context, IServiceDispa |
| | | 524 | | where TChannel : class, IChannel; |
| | | 525 | | public override bool CanBuildServiceDispatcher<TChannel>(BindingContext context) |
| | | 526 | | { |
| | 156 | 527 | | if (context == null) |
| | | 528 | | { |
| | 0 | 529 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(context)); |
| | | 530 | | } |
| | | 531 | | |
| | | 532 | | // InternalDuplexBindingElement.AddDuplexListenerSupport(context, ref this.internalDuplexBindingElement); |
| | | 533 | | |
| | | 534 | | // if (this.SessionMode) |
| | | 535 | | // { |
| | | 536 | | // return this.CanBuildSessionChannelListener<TChannel>(context); |
| | | 537 | | // } |
| | | 538 | | |
| | 156 | 539 | | if (!context.CanBuildNextServiceDispatcher<TChannel>()) |
| | | 540 | | { |
| | 90 | 541 | | return false; |
| | | 542 | | } |
| | | 543 | | |
| | 66 | 544 | | return typeof(TChannel) == typeof(IInputChannel) || typeof(TChannel) == typeof(IInputSessionChannel) || |
| | 66 | 545 | | (SupportsDuplex && (typeof(TChannel) == typeof(IDuplexChannel) || typeof(TChannel) == typeof(IDuplexSess |
| | 66 | 546 | | (SupportsRequestReply && (typeof(TChannel) == typeof(IReplyChannel) || typeof(TChannel) == typeof(IReply |
| | | 547 | | } |
| | | 548 | | |
| | | 549 | | |
| | | 550 | | public virtual void SetKeyDerivation(bool requireDerivedKeys) |
| | | 551 | | { |
| | 71 | 552 | | EndpointSupportingTokenParameters.SetKeyDerivation(requireDerivedKeys); |
| | 71 | 553 | | OptionalEndpointSupportingTokenParameters.SetKeyDerivation(requireDerivedKeys); |
| | 142 | 554 | | foreach (SupportingTokenParameters t in OperationSupportingTokenParameters.Values) |
| | | 555 | | { |
| | 0 | 556 | | t.SetKeyDerivation(requireDerivedKeys); |
| | | 557 | | } |
| | | 558 | | |
| | 142 | 559 | | foreach (SupportingTokenParameters t in OptionalOperationSupportingTokenParameters.Values) |
| | | 560 | | { |
| | 0 | 561 | | t.SetKeyDerivation(requireDerivedKeys); |
| | | 562 | | } |
| | 71 | 563 | | } |
| | | 564 | | |
| | | 565 | | internal ChannelProtectionRequirements GetProtectionRequirements(AddressingVersion addressing, ProtectionLevel d |
| | | 566 | | { |
| | 9 | 567 | | if (addressing == null) |
| | | 568 | | { |
| | 0 | 569 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(addressing)); |
| | | 570 | | } |
| | | 571 | | |
| | 9 | 572 | | ChannelProtectionRequirements result = new ChannelProtectionRequirements(); |
| | 9 | 573 | | ProtectionLevel supportedRequestProtectionLevel = GetIndividualProperty<ISecurityCapabilities>().SupportedRe |
| | 9 | 574 | | ProtectionLevel supportedResponseProtectionLevel = GetIndividualProperty<ISecurityCapabilities>().SupportedR |
| | | 575 | | |
| | 9 | 576 | | bool canSupportMoreThanTheDefault = |
| | 9 | 577 | | ProtectionLevelHelper.IsStrongerOrEqual(supportedRequestProtectionLevel, defaultProtectionLevel) |
| | 9 | 578 | | && ProtectionLevelHelper.IsStrongerOrEqual(supportedResponseProtectionLevel, defaultProtectionLevel); |
| | 9 | 579 | | if (canSupportMoreThanTheDefault) |
| | | 580 | | { |
| | 0 | 581 | | MessagePartSpecification signedParts = new MessagePartSpecification(); |
| | 0 | 582 | | MessagePartSpecification encryptedParts = new MessagePartSpecification(); |
| | 0 | 583 | | if (defaultProtectionLevel != ProtectionLevel.None) |
| | | 584 | | { |
| | 0 | 585 | | signedParts.IsBodyIncluded = true; |
| | 0 | 586 | | if (defaultProtectionLevel == ProtectionLevel.EncryptAndSign) |
| | | 587 | | { |
| | 0 | 588 | | encryptedParts.IsBodyIncluded = true; |
| | | 589 | | } |
| | | 590 | | } |
| | 0 | 591 | | signedParts.MakeReadOnly(); |
| | 0 | 592 | | encryptedParts.MakeReadOnly(); |
| | 0 | 593 | | if (addressing.FaultAction != null) |
| | | 594 | | { |
| | | 595 | | // Addressing faults |
| | 0 | 596 | | result.IncomingSignatureParts.AddParts(signedParts, addressing.FaultAction); |
| | 0 | 597 | | result.OutgoingSignatureParts.AddParts(signedParts, addressing.FaultAction); |
| | 0 | 598 | | result.IncomingEncryptionParts.AddParts(encryptedParts, addressing.FaultAction); |
| | 0 | 599 | | result.OutgoingEncryptionParts.AddParts(encryptedParts, addressing.FaultAction); |
| | | 600 | | } |
| | 0 | 601 | | if (addressing.DefaultFaultAction != null) |
| | | 602 | | { |
| | | 603 | | // Faults that do not specify a particular action |
| | 0 | 604 | | result.IncomingSignatureParts.AddParts(signedParts, addressing.DefaultFaultAction); |
| | 0 | 605 | | result.OutgoingSignatureParts.AddParts(signedParts, addressing.DefaultFaultAction); |
| | 0 | 606 | | result.IncomingEncryptionParts.AddParts(encryptedParts, addressing.DefaultFaultAction); |
| | 0 | 607 | | result.OutgoingEncryptionParts.AddParts(encryptedParts, addressing.DefaultFaultAction); |
| | | 608 | | } |
| | | 609 | | // Infrastructure faults |
| | 0 | 610 | | result.IncomingSignatureParts.AddParts(signedParts, FaultCodeConstants.Actions.NetDispatcher); |
| | 0 | 611 | | result.OutgoingSignatureParts.AddParts(signedParts, FaultCodeConstants.Actions.NetDispatcher); |
| | 0 | 612 | | result.IncomingEncryptionParts.AddParts(encryptedParts, FaultCodeConstants.Actions.NetDispatcher); |
| | 0 | 613 | | result.OutgoingEncryptionParts.AddParts(encryptedParts, FaultCodeConstants.Actions.NetDispatcher); |
| | | 614 | | } |
| | | 615 | | |
| | 9 | 616 | | return result; |
| | | 617 | | } |
| | | 618 | | |
| | | 619 | | public override T GetProperty<T>(BindingContext context) |
| | | 620 | | { |
| | 432 | 621 | | if (context == null) |
| | | 622 | | { |
| | 0 | 623 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(context)); |
| | | 624 | | } |
| | 432 | 625 | | if (typeof(T) == typeof(ISecurityCapabilities)) |
| | | 626 | | { |
| | 185 | 627 | | return (T)(object)GetSecurityCapabilities(context); |
| | | 628 | | } |
| | | 629 | | else |
| | | 630 | | { |
| | 247 | 631 | | return context.GetInnerProperty<T>(); |
| | | 632 | | } |
| | | 633 | | } |
| | | 634 | | |
| | | 635 | | internal abstract ISecurityCapabilities GetIndividualISecurityCapabilities(); |
| | | 636 | | |
| | | 637 | | private ISecurityCapabilities GetSecurityCapabilities(BindingContext context) |
| | | 638 | | { |
| | 185 | 639 | | ISecurityCapabilities thisSecurityCapability = GetIndividualISecurityCapabilities(); |
| | 185 | 640 | | ISecurityCapabilities lowerSecurityCapability = context.GetInnerProperty<ISecurityCapabilities>(); |
| | 185 | 641 | | if (lowerSecurityCapability == null) |
| | | 642 | | { |
| | 185 | 643 | | return thisSecurityCapability; |
| | | 644 | | } |
| | | 645 | | else |
| | | 646 | | { |
| | 0 | 647 | | bool supportsClientAuth = thisSecurityCapability.SupportsClientAuthentication; |
| | 0 | 648 | | bool supportsClientWindowsIdentity = thisSecurityCapability.SupportsClientWindowsIdentity; |
| | 0 | 649 | | bool supportsServerAuth = thisSecurityCapability.SupportsServerAuthentication || lowerSecurityCapability |
| | 0 | 650 | | ProtectionLevel requestProtectionLevel = ProtectionLevelHelper.Max(thisSecurityCapability.SupportedReque |
| | 0 | 651 | | ProtectionLevel responseProtectionLevel = ProtectionLevelHelper.Max(thisSecurityCapability.SupportedResp |
| | 0 | 652 | | return new SecurityCapabilities(supportsClientAuth, supportsServerAuth, supportsClientWindowsIdentity, r |
| | | 653 | | } |
| | | 654 | | } |
| | | 655 | | |
| | | 656 | | private void SetIssuerBindingContextIfRequired(BindingContext issuerBindingContext) |
| | | 657 | | { |
| | 55 | 658 | | SetIssuerBindingContextIfRequired(EndpointSupportingTokenParameters, issuerBindingContext); |
| | 55 | 659 | | SetIssuerBindingContextIfRequired(OptionalEndpointSupportingTokenParameters, issuerBindingContext); |
| | 110 | 660 | | foreach (SupportingTokenParameters parameters in OperationSupportingTokenParameters.Values) |
| | | 661 | | { |
| | 0 | 662 | | SetIssuerBindingContextIfRequired(parameters, issuerBindingContext); |
| | | 663 | | } |
| | 110 | 664 | | foreach (SupportingTokenParameters parameters in OptionalOperationSupportingTokenParameters.Values) |
| | | 665 | | { |
| | 0 | 666 | | SetIssuerBindingContextIfRequired(parameters, issuerBindingContext); |
| | | 667 | | } |
| | 55 | 668 | | } |
| | | 669 | | |
| | | 670 | | |
| | | 671 | | protected static void SetIssuerBindingContextIfRequired(SecurityTokenParameters parameters, BindingContext issue |
| | | 672 | | { |
| | 33 | 673 | | if (parameters is SslSecurityTokenParameters parameters1) |
| | | 674 | | { |
| | 0 | 675 | | parameters1.IssuerBindingContext = CreateIssuerBindingContextForNegotiation(issuerBindingContext); |
| | | 676 | | } |
| | 33 | 677 | | else if (parameters is SspiSecurityTokenParameters parameters2) |
| | | 678 | | { |
| | 1 | 679 | | parameters2.IssuerBindingContext = CreateIssuerBindingContextForNegotiation(issuerBindingContext); |
| | | 680 | | } |
| | 33 | 681 | | } |
| | | 682 | | |
| | | 683 | | private static void SetIssuerBindingContextIfRequired(SupportingTokenParameters supportingParameters, BindingCon |
| | | 684 | | { |
| | 244 | 685 | | for (int i = 0; i < supportingParameters.Endorsing.Count; ++i) |
| | | 686 | | { |
| | 12 | 687 | | SetIssuerBindingContextIfRequired(supportingParameters.Endorsing[i], issuerBindingContext); |
| | | 688 | | } |
| | 220 | 689 | | for (int i = 0; i < supportingParameters.SignedEndorsing.Count; ++i) |
| | | 690 | | { |
| | 0 | 691 | | SetIssuerBindingContextIfRequired(supportingParameters.SignedEndorsing[i], issuerBindingContext); |
| | | 692 | | } |
| | 224 | 693 | | for (int i = 0; i < supportingParameters.Signed.Count; ++i) |
| | | 694 | | { |
| | 2 | 695 | | SetIssuerBindingContextIfRequired(supportingParameters.Signed[i], issuerBindingContext); |
| | | 696 | | } |
| | 258 | 697 | | for (int i = 0; i < supportingParameters.SignedEncrypted.Count; ++i) |
| | | 698 | | { |
| | 19 | 699 | | SetIssuerBindingContextIfRequired(supportingParameters.SignedEncrypted[i], issuerBindingContext); |
| | | 700 | | } |
| | 110 | 701 | | } |
| | | 702 | | |
| | | 703 | | // If any changes are made to this method, please make sure that they are |
| | | 704 | | // reflected in the corresponding IsUserNameOverTransportBinding() method. |
| | | 705 | | public static TransportSecurityBindingElement CreateUserNameOverTransportBindingElement() |
| | | 706 | | { |
| | 161 | 707 | | TransportSecurityBindingElement result = new TransportSecurityBindingElement(); |
| | 161 | 708 | | result.EndpointSupportingTokenParameters.SignedEncrypted.Add( |
| | 161 | 709 | | new UserNameSecurityTokenParameters()); |
| | 161 | 710 | | result.IncludeTimestamp = true; |
| | | 711 | | //result.LocalClientSettings.DetectReplays = false; |
| | 161 | 712 | | result.LocalServiceSettings.DetectReplays = false; |
| | 161 | 713 | | return result; |
| | | 714 | | } |
| | | 715 | | |
| | | 716 | | // If any changes are made to this method, please make sure that they are |
| | | 717 | | // reflected in the corresponding IsSecureConversationBinding() method. |
| | | 718 | | public static SecurityBindingElement CreateSecureConversationBindingElement(SecurityBindingElement bootstrapSecu |
| | | 719 | | { |
| | 37 | 720 | | return CreateSecureConversationBindingElement(bootstrapSecurity, SecureConversationSecurityTokenParameters.d |
| | | 721 | | } |
| | | 722 | | |
| | | 723 | | public static SecurityBindingElement CreateSecureConversationBindingElement(SecurityBindingElement bootstrapSecu |
| | | 724 | | { |
| | 86 | 725 | | return CreateSecureConversationBindingElement(bootstrapSecurity, requireCancellation, null); |
| | | 726 | | } |
| | | 727 | | |
| | | 728 | | // If any changes are made to this method, please make sure that they are |
| | | 729 | | // reflected in the corresponding IsCertificateOverTransportBinding() method. |
| | | 730 | | public static TransportSecurityBindingElement CreateCertificateOverTransportBindingElement() |
| | | 731 | | { |
| | 33 | 732 | | return CreateCertificateOverTransportBindingElement(MessageSecurityVersion.Default); |
| | | 733 | | } |
| | | 734 | | |
| | | 735 | | // If any changes are made to this method, please make sure that they are |
| | | 736 | | // reflected in the corresponding IsCertificateOverTransportBinding() method. |
| | | 737 | | public static TransportSecurityBindingElement CreateCertificateOverTransportBindingElement(MessageSecurityVersio |
| | | 738 | | { |
| | 33 | 739 | | if (version == null) |
| | | 740 | | { |
| | 0 | 741 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(version)); |
| | | 742 | | } |
| | | 743 | | X509KeyIdentifierClauseType x509ReferenceType; |
| | | 744 | | |
| | 33 | 745 | | if (version.SecurityVersion == SecurityVersion.WSSecurity10) |
| | | 746 | | { |
| | 0 | 747 | | x509ReferenceType = X509KeyIdentifierClauseType.Any; |
| | | 748 | | } |
| | | 749 | | else |
| | | 750 | | { |
| | 33 | 751 | | x509ReferenceType = X509KeyIdentifierClauseType.Thumbprint; |
| | | 752 | | } |
| | | 753 | | |
| | 33 | 754 | | TransportSecurityBindingElement result = new TransportSecurityBindingElement(); |
| | 33 | 755 | | X509SecurityTokenParameters x509Parameters = new X509SecurityTokenParameters( |
| | 33 | 756 | | x509ReferenceType, |
| | 33 | 757 | | SecurityTokenInclusionMode.AlwaysToRecipient, |
| | 33 | 758 | | false); |
| | 33 | 759 | | result.EndpointSupportingTokenParameters.Endorsing.Add( |
| | 33 | 760 | | x509Parameters |
| | 33 | 761 | | ); |
| | 33 | 762 | | result.IncludeTimestamp = true; |
| | | 763 | | // result.LocalClientSettings.DetectReplays = false; |
| | 33 | 764 | | result.LocalServiceSettings.DetectReplays = false; |
| | 33 | 765 | | result.MessageSecurityVersion = version; |
| | | 766 | | |
| | 33 | 767 | | return result; |
| | | 768 | | } |
| | | 769 | | |
| | | 770 | | // If any changes are made to this method, please make sure that they are |
| | | 771 | | // reflected in the corresponding IsSecureConversationBinding() method. |
| | | 772 | | public static SecurityBindingElement CreateSecureConversationBindingElement(SecurityBindingElement bootstrapSecu |
| | | 773 | | { |
| | 123 | 774 | | if (bootstrapSecurity == null) |
| | | 775 | | { |
| | 0 | 776 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(bootstrapSecurity)); |
| | | 777 | | } |
| | | 778 | | |
| | | 779 | | SecurityBindingElement result; |
| | | 780 | | |
| | 123 | 781 | | if (bootstrapSecurity is TransportSecurityBindingElement) |
| | | 782 | | { |
| | | 783 | | // there is no need to do replay detection or key derivation for transport bindings |
| | 123 | 784 | | TransportSecurityBindingElement primary = new TransportSecurityBindingElement(); |
| | 123 | 785 | | SecureConversationSecurityTokenParameters scParameters = new SecureConversationSecurityTokenParameters( |
| | 123 | 786 | | bootstrapSecurity, |
| | 123 | 787 | | requireCancellation, |
| | 123 | 788 | | bootstrapProtectionRequirements) |
| | 123 | 789 | | { |
| | 123 | 790 | | RequireDerivedKeys = false |
| | 123 | 791 | | }; |
| | 123 | 792 | | primary.EndpointSupportingTokenParameters.Endorsing.Add( |
| | 123 | 793 | | scParameters); |
| | | 794 | | // primary.LocalClientSettings.DetectReplays = false; |
| | 123 | 795 | | primary.LocalServiceSettings.DetectReplays = false; |
| | 123 | 796 | | primary.IncludeTimestamp = true; |
| | 123 | 797 | | result = primary; |
| | | 798 | | } |
| | | 799 | | else // Symmetric- or AsymmetricSecurityBindingElement |
| | | 800 | | { |
| | 0 | 801 | | SymmetricSecurityBindingElement primary = new SymmetricSecurityBindingElement( |
| | 0 | 802 | | new SecureConversationSecurityTokenParameters( |
| | 0 | 803 | | bootstrapSecurity, |
| | 0 | 804 | | requireCancellation, |
| | 0 | 805 | | bootstrapProtectionRequirements)) |
| | 0 | 806 | | { |
| | 0 | 807 | | // there is no need for signature confirmation on the steady state binding |
| | 0 | 808 | | RequireSignatureConfirmation = false |
| | 0 | 809 | | }; |
| | 0 | 810 | | result = primary; |
| | | 811 | | } |
| | 123 | 812 | | return result; |
| | | 813 | | } |
| | | 814 | | |
| | | 815 | | // If any changes are made to this method, please make sure that they are |
| | | 816 | | // reflected in the corresponding IsSspiNegotiationOverTransportBinding() method. |
| | | 817 | | public static TransportSecurityBindingElement CreateSspiNegotiationOverTransportBindingElement(bool requireCance |
| | | 818 | | { |
| | 2 | 819 | | TransportSecurityBindingElement result = new TransportSecurityBindingElement(); |
| | 2 | 820 | | SspiSecurityTokenParameters sspiParameters = new SspiSecurityTokenParameters(requireCancellation) |
| | 2 | 821 | | { |
| | 2 | 822 | | RequireDerivedKeys = false |
| | 2 | 823 | | }; |
| | 2 | 824 | | result.EndpointSupportingTokenParameters.Endorsing.Add( |
| | 2 | 825 | | sspiParameters); |
| | 2 | 826 | | result.IncludeTimestamp = true; |
| | | 827 | | // result.LocalClientSettings.DetectReplays = false; |
| | 2 | 828 | | result.LocalServiceSettings.DetectReplays = false; |
| | 2 | 829 | | result.SupportsExtendedProtectionPolicy = true; |
| | | 830 | | |
| | 2 | 831 | | return result; |
| | | 832 | | } |
| | | 833 | | |
| | | 834 | | //TODO other security mode |
| | | 835 | | |
| | | 836 | | public static void ExportPolicyForTransportTokenAssertionProviders(MetadataExporter exporter, PolicyConversionCo |
| | | 837 | | { |
| | 19 | 838 | | if (exporter == null) |
| | | 839 | | { |
| | 0 | 840 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(exporter)); |
| | | 841 | | } |
| | | 842 | | |
| | 19 | 843 | | if (context == null) |
| | | 844 | | { |
| | 0 | 845 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(context)); |
| | | 846 | | } |
| | | 847 | | |
| | 19 | 848 | | SecurityTraceRecordHelper.TraceExportChannelBindingEntry(); |
| | | 849 | | |
| | 19 | 850 | | SecurityBindingElement binding = null; |
| | 19 | 851 | | ITransportTokenAssertionProvider transportTokenAssertionProvider = null; |
| | 19 | 852 | | BindingElementCollection bindingElementsBelowSecurity = new BindingElementCollection(); |
| | 19 | 853 | | if ((context != null) && (context.BindingElements != null)) |
| | | 854 | | { |
| | 152 | 855 | | foreach (BindingElement be in context.BindingElements) |
| | | 856 | | { |
| | 57 | 857 | | if (be is SecurityBindingElement element) |
| | | 858 | | { |
| | 19 | 859 | | binding = element; |
| | | 860 | | } |
| | | 861 | | else |
| | | 862 | | { |
| | 38 | 863 | | if (binding != null || be is MessageEncodingBindingElement || be is ITransportTokenAssertionProv |
| | | 864 | | { |
| | 38 | 865 | | bindingElementsBelowSecurity.Add(be); |
| | | 866 | | } |
| | 38 | 867 | | if (be is ITransportTokenAssertionProvider provider) |
| | | 868 | | { |
| | 19 | 869 | | transportTokenAssertionProvider = provider; |
| | | 870 | | } |
| | | 871 | | } |
| | | 872 | | } |
| | | 873 | | } |
| | | 874 | | |
| | | 875 | | // this is used when exporting bootstrap policy for secure conversation in SecurityPolicy11.CreateWsspBootst |
| | 19 | 876 | | exporter.State[SecurityPolicyStrings.SecureConversationBootstrapBindingElementsBelowSecurityKey] = bindingEl |
| | | 877 | | |
| | 19 | 878 | | bool hasCompletedSuccessfully = false; |
| | | 879 | | try |
| | | 880 | | { |
| | 19 | 881 | | if (binding is TransportSecurityBindingElement element) |
| | | 882 | | { |
| | 19 | 883 | | if (transportTokenAssertionProvider == null && !binding.AllowInsecureTransport) |
| | | 884 | | { |
| | 0 | 885 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Expor |
| | | 886 | | } |
| | | 887 | | |
| | 19 | 888 | | ExportTransportSecurityBindingElement(element, transportTokenAssertionProvider, exporter, context); |
| | 19 | 889 | | ExportOperationScopeSupportingTokensPolicy(binding, exporter, context); |
| | | 890 | | } |
| | 0 | 891 | | else if (transportTokenAssertionProvider != null) |
| | | 892 | | { |
| | 0 | 893 | | TransportSecurityBindingElement dummyTransportBindingElement = new TransportSecurityBindingElement() |
| | 0 | 894 | | if (binding == null) |
| | | 895 | | { |
| | 0 | 896 | | dummyTransportBindingElement.IncludeTimestamp = false; |
| | | 897 | | } |
| | | 898 | | |
| | 0 | 899 | | if (transportTokenAssertionProvider.GetType().Name.Equals("HttpsTransportBindingElement")) |
| | | 900 | | { |
| | | 901 | | // This case is handled by HttpsTransportBindingElement |
| | 0 | 902 | | return; |
| | | 903 | | } |
| | | 904 | | |
| | 0 | 905 | | ExportTransportSecurityBindingElement(dummyTransportBindingElement, transportTokenAssertionProvider, |
| | | 906 | | } |
| | | 907 | | |
| | 19 | 908 | | hasCompletedSuccessfully = true; |
| | 19 | 909 | | } |
| | | 910 | | finally |
| | | 911 | | { |
| | | 912 | | try |
| | | 913 | | { |
| | 19 | 914 | | exporter.State.Remove(SecurityPolicyStrings.SecureConversationBootstrapBindingElementsBelowSecurityK |
| | 19 | 915 | | } |
| | 0 | 916 | | catch (Exception e) |
| | | 917 | | { |
| | | 918 | | // Always immediately rethrow fatal exceptions. |
| | 0 | 919 | | if (hasCompletedSuccessfully || Fx.IsFatal(e)) throw; |
| | 0 | 920 | | } |
| | 19 | 921 | | } |
| | 19 | 922 | | } |
| | | 923 | | |
| | | 924 | | // |
| | | 925 | | // We will emit the wssp trust 10 assertion for all the case except for the basic http binding |
| | | 926 | | // created through the BasicHttpBinding class. The reason for this exception is to allow better |
| | | 927 | | // interop with third party when the third party doesn't understand the trust asserion |
| | | 928 | | // |
| | | 929 | | private static bool RequiresWsspTrust(SecurityBindingElement sbe) |
| | | 930 | | { |
| | 19 | 931 | | if (sbe == null) |
| | 0 | 932 | | return false; |
| | | 933 | | |
| | 19 | 934 | | return !sbe.DoNotEmitTrust; |
| | | 935 | | } |
| | | 936 | | |
| | | 937 | | public static void ExportTransportSecurityBindingElement(TransportSecurityBindingElement binding, ITransportToke |
| | | 938 | | { |
| | 22 | 939 | | WSSecurityPolicy sp = WSSecurityPolicy.GetSecurityPolicyDriver(binding.MessageSecurityVersion); |
| | | 940 | | |
| | 22 | 941 | | if (transportTokenAssertionProvider == null && binding.AllowInsecureTransport) |
| | | 942 | | { |
| | 0 | 943 | | if ((policyContext != null) && (policyContext.BindingElements != null)) |
| | | 944 | | { |
| | 0 | 945 | | foreach (BindingElement be in policyContext.BindingElements) |
| | | 946 | | { |
| | 0 | 947 | | if (be.GetType().FullName.Equals("CoreWCF.Channels.HttpTransportBindingElement")) |
| | | 948 | | { |
| | | 949 | | Fx.Assert("This could shouldn't be reachable"); |
| | 0 | 950 | | throw new NotSupportedException("WSDL generation for binding not supported"); |
| | | 951 | | //transportTokenAssertionProvider = new HttpsTransportBindingElement(); |
| | | 952 | | //break; |
| | | 953 | | } |
| | | 954 | | |
| | 0 | 955 | | if (be.GetType().FullName.Equals("CoreWCF.Channels.TcpTransportBindingElement")) |
| | | 956 | | { |
| | 0 | 957 | | throw new Exception("Resolve this"); |
| | | 958 | | //transportTokenAssertionProvider = new SslStreamSecurityBindingElement(); |
| | | 959 | | //break; |
| | | 960 | | } |
| | | 961 | | } |
| | | 962 | | } |
| | | 963 | | } |
| | | 964 | | |
| | 22 | 965 | | XmlElement transportTokenAssertion = transportTokenAssertionProvider?.GetTransportTokenAssertion(); |
| | | 966 | | |
| | 22 | 967 | | if (transportTokenAssertion == null) |
| | 0 | 968 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR.NoT |
| | | 969 | | |
| | 22 | 970 | | AddressingVersion addressingVersion = AddressingVersion.WSAddressing10; |
| | 22 | 971 | | MessageEncodingBindingElement messageEncoderBindingElement = policyContext.BindingElements.Find<MessageEncod |
| | 22 | 972 | | if (messageEncoderBindingElement != null) |
| | | 973 | | { |
| | 22 | 974 | | addressingVersion = messageEncoderBindingElement.MessageVersion.Addressing; |
| | | 975 | | } |
| | | 976 | | |
| | 22 | 977 | | AddAssertionIfNotNull(policyContext, sp.CreateWsspTransportBindingAssertion(exporter, binding, transportToke |
| | | 978 | | |
| | 22 | 979 | | Collection<XmlElement> supportingTokenAssertions = sp.CreateWsspSupportingTokensAssertion( |
| | 22 | 980 | | exporter, |
| | 22 | 981 | | binding.EndpointSupportingTokenParameters.Signed, |
| | 22 | 982 | | binding.EndpointSupportingTokenParameters.SignedEncrypted, |
| | 22 | 983 | | binding.EndpointSupportingTokenParameters.Endorsing, |
| | 22 | 984 | | binding.EndpointSupportingTokenParameters.SignedEndorsing, |
| | 22 | 985 | | binding.OptionalEndpointSupportingTokenParameters.Signed, |
| | 22 | 986 | | binding.OptionalEndpointSupportingTokenParameters.SignedEncrypted, |
| | 22 | 987 | | binding.OptionalEndpointSupportingTokenParameters.Endorsing, |
| | 22 | 988 | | binding.OptionalEndpointSupportingTokenParameters.SignedEndorsing, |
| | 22 | 989 | | addressingVersion); |
| | | 990 | | |
| | 22 | 991 | | AddAssertionIfNotNull(policyContext, supportingTokenAssertions); |
| | | 992 | | |
| | 22 | 993 | | if (supportingTokenAssertions.Count > 0 |
| | 22 | 994 | | || HasEndorsingSupportingTokensAtOperationScope(binding)) |
| | | 995 | | { |
| | 19 | 996 | | AddAssertionIfNotNull(policyContext, sp.CreateWsspWssAssertion(exporter, binding)); |
| | 19 | 997 | | if (RequiresWsspTrust(binding)) |
| | | 998 | | { |
| | 19 | 999 | | AddAssertionIfNotNull(policyContext, sp.CreateWsspTrustAssertion(exporter, binding.KeyEntropyMode)); |
| | | 1000 | | } |
| | | 1001 | | } |
| | 22 | 1002 | | } |
| | | 1003 | | |
| | | 1004 | | private static bool HasEndorsingSupportingTokensAtOperationScope(SecurityBindingElement binding) |
| | | 1005 | | { |
| | 6 | 1006 | | foreach (SupportingTokenParameters r in binding.OperationSupportingTokenParameters.Values) |
| | | 1007 | | { |
| | 0 | 1008 | | if (r.Endorsing.Count > 0 || r.SignedEndorsing.Count > 0) |
| | | 1009 | | { |
| | 0 | 1010 | | return true; |
| | | 1011 | | } |
| | | 1012 | | } |
| | | 1013 | | |
| | 3 | 1014 | | return false; |
| | 0 | 1015 | | } |
| | | 1016 | | |
| | | 1017 | | private static void ExportOperationScopeSupportingTokensPolicy(SecurityBindingElement binding, MetadataExporter |
| | | 1018 | | { |
| | 19 | 1019 | | WSSecurityPolicy sp = WSSecurityPolicy.GetSecurityPolicyDriver(binding.MessageSecurityVersion); |
| | | 1020 | | |
| | 19 | 1021 | | if (binding.OperationSupportingTokenParameters.Count == 0 && binding.OptionalOperationSupportingTokenParamet |
| | | 1022 | | { |
| | 19 | 1023 | | return; |
| | | 1024 | | } |
| | | 1025 | | |
| | 0 | 1026 | | foreach (OperationDescription operation in policyContext.Contract.Operations) |
| | | 1027 | | { |
| | 0 | 1028 | | foreach (MessageDescription message in operation.Messages) |
| | | 1029 | | { |
| | | 1030 | | |
| | 0 | 1031 | | if (message.Direction == MessageDirection.Input) |
| | | 1032 | | { |
| | 0 | 1033 | | SupportingTokenParameters requirements = null; |
| | 0 | 1034 | | SupportingTokenParameters optionalRequirements = null; |
| | | 1035 | | |
| | 0 | 1036 | | if (binding.OperationSupportingTokenParameters.ContainsKey(message.Action)) |
| | | 1037 | | { |
| | 0 | 1038 | | requirements = binding.OperationSupportingTokenParameters[message.Action]; |
| | | 1039 | | } |
| | 0 | 1040 | | if (binding.OptionalOperationSupportingTokenParameters.ContainsKey(message.Action)) |
| | | 1041 | | { |
| | 0 | 1042 | | optionalRequirements = binding.OptionalOperationSupportingTokenParameters[message.Action]; |
| | | 1043 | | } |
| | | 1044 | | |
| | 0 | 1045 | | if (requirements == null && optionalRequirements == null) |
| | | 1046 | | { |
| | | 1047 | | continue; |
| | | 1048 | | } |
| | | 1049 | | |
| | 0 | 1050 | | AddAssertionIfNotNull(policyContext, operation, sp.CreateWsspSupportingTokensAssertion( |
| | 0 | 1051 | | exporter, |
| | 0 | 1052 | | requirements?.Signed, |
| | 0 | 1053 | | requirements?.SignedEncrypted, |
| | 0 | 1054 | | requirements?.Endorsing, |
| | 0 | 1055 | | requirements?.SignedEndorsing, |
| | 0 | 1056 | | optionalRequirements?.Signed, |
| | 0 | 1057 | | optionalRequirements?.SignedEncrypted, |
| | 0 | 1058 | | optionalRequirements?.Endorsing, |
| | 0 | 1059 | | optionalRequirements?.SignedEndorsing)); |
| | | 1060 | | } |
| | | 1061 | | } |
| | | 1062 | | } |
| | 0 | 1063 | | } |
| | | 1064 | | |
| | | 1065 | | private static void AddAssertionIfNotNull(PolicyConversionContext policyContext, XmlElement assertion) |
| | | 1066 | | { |
| | 60 | 1067 | | if (policyContext != null && assertion != null) |
| | | 1068 | | { |
| | 60 | 1069 | | policyContext.GetBindingAssertions().Add(assertion); |
| | | 1070 | | } |
| | 60 | 1071 | | } |
| | | 1072 | | |
| | | 1073 | | private static void AddAssertionIfNotNull(PolicyConversionContext policyContext, Collection<XmlElement> assertio |
| | | 1074 | | { |
| | 22 | 1075 | | if (policyContext != null && assertions != null) |
| | | 1076 | | { |
| | 22 | 1077 | | PolicyAssertionCollection existingAssertions = policyContext.GetBindingAssertions(); |
| | 82 | 1078 | | for (int i = 0; i < assertions.Count; ++i) |
| | 19 | 1079 | | existingAssertions.Add(assertions[i]); |
| | | 1080 | | } |
| | 22 | 1081 | | } |
| | | 1082 | | |
| | | 1083 | | private static void AddAssertionIfNotNull(PolicyConversionContext policyContext, OperationDescription operation, |
| | | 1084 | | { |
| | 0 | 1085 | | if (policyContext != null && assertions != null) |
| | | 1086 | | { |
| | 0 | 1087 | | PolicyAssertionCollection existingAssertions = policyContext.GetOperationBindingAssertions(operation); |
| | 0 | 1088 | | for (int i = 0; i < assertions.Count; ++i) |
| | 0 | 1089 | | existingAssertions.Add(assertions[i]); |
| | | 1090 | | } |
| | 0 | 1091 | | } |
| | | 1092 | | } |
| | | 1093 | | } |