| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Globalization; |
| | | 6 | | using System.IO; |
| | | 7 | | using System.Security.Cryptography.X509Certificates; |
| | | 8 | | using CoreWCF.IdentityModel; |
| | | 9 | | using CoreWCF.IdentityModel.Selectors; |
| | | 10 | | using CoreWCF.IdentityModel.Tokens; |
| | | 11 | | using CoreWCF.Security.Tokens; |
| | | 12 | | |
| | | 13 | | namespace CoreWCF.Security |
| | | 14 | | { |
| | | 15 | | internal sealed class SecurityHeaderTokenResolver : SecurityTokenResolver |
| | | 16 | | { |
| | | 17 | | private const int InitialTokenArraySize = 10; |
| | | 18 | | private int _tokenCount; |
| | | 19 | | private SecurityTokenEntry[] _tokens; |
| | | 20 | | private readonly ReceiveSecurityHeader _securityHeader; |
| | | 21 | | |
| | | 22 | | public SecurityHeaderTokenResolver() |
| | 0 | 23 | | : this(null) |
| | | 24 | | { |
| | 0 | 25 | | } |
| | | 26 | | |
| | 188 | 27 | | public SecurityHeaderTokenResolver(ReceiveSecurityHeader securityHeader) |
| | | 28 | | { |
| | 188 | 29 | | _tokens = new SecurityTokenEntry[InitialTokenArraySize]; |
| | 188 | 30 | | _securityHeader = securityHeader; |
| | 188 | 31 | | } |
| | | 32 | | |
| | 0 | 33 | | public SecurityToken ExpectedWrapper { get; set; } |
| | | 34 | | |
| | 0 | 35 | | public SecurityTokenParameters ExpectedWrapperTokenParameters { get; set; } |
| | | 36 | | |
| | | 37 | | public void Add(SecurityToken token) |
| | | 38 | | { |
| | 0 | 39 | | Add(token, SecurityTokenReferenceStyle.Internal, null); |
| | 0 | 40 | | } |
| | | 41 | | |
| | | 42 | | public void Add(SecurityToken token, SecurityTokenReferenceStyle allowedReferenceStyle, SecurityTokenParameters |
| | | 43 | | { |
| | 64 | 44 | | if (token == null) |
| | | 45 | | { |
| | 0 | 46 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(token)); |
| | | 47 | | } |
| | | 48 | | |
| | 64 | 49 | | if ((allowedReferenceStyle == SecurityTokenReferenceStyle.External) && (tokenParameters == null)) |
| | | 50 | | { |
| | 0 | 51 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument(SR.ResolvingExternalTokensRequireSecurityTo |
| | | 52 | | } |
| | | 53 | | |
| | 64 | 54 | | EnsureCapacityToAddToken(); |
| | 64 | 55 | | _tokens[_tokenCount++] = new SecurityTokenEntry(token, tokenParameters, allowedReferenceStyle); |
| | 64 | 56 | | } |
| | | 57 | | |
| | | 58 | | private void EnsureCapacityToAddToken() |
| | | 59 | | { |
| | 64 | 60 | | if (_tokenCount == _tokens.Length) |
| | | 61 | | { |
| | 0 | 62 | | SecurityTokenEntry[] newTokens = new SecurityTokenEntry[_tokens.Length * 2]; |
| | 0 | 63 | | Array.Copy(_tokens, 0, newTokens, 0, _tokenCount); |
| | 0 | 64 | | _tokens = newTokens; |
| | | 65 | | } |
| | 64 | 66 | | } |
| | | 67 | | |
| | | 68 | | public bool CheckExternalWrapperMatch(SecurityKeyIdentifier keyIdentifier) |
| | | 69 | | { |
| | 0 | 70 | | if (ExpectedWrapper == null || ExpectedWrapperTokenParameters == null) |
| | | 71 | | { |
| | 0 | 72 | | return false; |
| | | 73 | | } |
| | | 74 | | |
| | 0 | 75 | | for (int i = 0; i < keyIdentifier.Count; i++) |
| | | 76 | | { |
| | 0 | 77 | | if (ExpectedWrapperTokenParameters.MatchesKeyIdentifierClause(ExpectedWrapper, keyIdentifier[i], Securit |
| | | 78 | | { |
| | 0 | 79 | | return true; |
| | | 80 | | } |
| | | 81 | | } |
| | 0 | 82 | | return false; |
| | | 83 | | } |
| | | 84 | | |
| | | 85 | | internal SecurityToken ResolveToken(SecurityKeyIdentifier keyIdentifier, bool matchOnlyExternalTokens, bool reso |
| | | 86 | | { |
| | 23 | 87 | | if (keyIdentifier == null) |
| | | 88 | | { |
| | 0 | 89 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(keyIdentifier)); |
| | | 90 | | } |
| | 46 | 91 | | for (int i = 0; i < keyIdentifier.Count; i++) |
| | | 92 | | { |
| | 23 | 93 | | SecurityToken token = ResolveToken(keyIdentifier[i], matchOnlyExternalTokens, resolveIntrinsicKeyClause) |
| | 23 | 94 | | if (token != null) |
| | | 95 | | { |
| | 23 | 96 | | return token; |
| | | 97 | | } |
| | | 98 | | } |
| | 0 | 99 | | return null; |
| | | 100 | | } |
| | | 101 | | |
| | | 102 | | private SecurityKey ResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, bool createIntrinsic |
| | | 103 | | { |
| | 0 | 104 | | if (keyIdentifierClause == null) |
| | | 105 | | { |
| | 0 | 106 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException(nameof(keyIdentifier |
| | | 107 | | } |
| | | 108 | | |
| | | 109 | | SecurityKey securityKey; |
| | 0 | 110 | | for (int i = 0; i < _tokenCount; i++) |
| | | 111 | | { |
| | 0 | 112 | | securityKey = _tokens[i].Token.ResolveKeyIdentifierClause(keyIdentifierClause); |
| | 0 | 113 | | if (securityKey != null) |
| | | 114 | | { |
| | 0 | 115 | | return securityKey; |
| | | 116 | | } |
| | | 117 | | } |
| | | 118 | | |
| | 0 | 119 | | if (createIntrinsicKeys) |
| | | 120 | | { |
| | 0 | 121 | | if (SecurityUtils.TryCreateKeyFromIntrinsicKeyClause(keyIdentifierClause, this, out securityKey)) |
| | | 122 | | { |
| | 0 | 123 | | return securityKey; |
| | | 124 | | } |
| | | 125 | | } |
| | | 126 | | |
| | 0 | 127 | | return null; |
| | | 128 | | } |
| | | 129 | | |
| | | 130 | | private bool MatchDirectReference(SecurityToken token, SecurityKeyIdentifierClause keyClause) |
| | | 131 | | { |
| | 0 | 132 | | if (!(keyClause is LocalIdKeyIdentifierClause localClause)) |
| | | 133 | | { |
| | 0 | 134 | | return false; |
| | | 135 | | } |
| | | 136 | | |
| | 0 | 137 | | return token.MatchesKeyIdentifierClause(localClause); |
| | | 138 | | } |
| | | 139 | | |
| | | 140 | | internal SecurityToken ResolveToken(SecurityKeyIdentifierClause keyIdentifierClause, bool matchOnlyExternal, boo |
| | | 141 | | { |
| | 23 | 142 | | if (keyIdentifierClause == null) |
| | | 143 | | { |
| | 0 | 144 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(keyIdentifierClause)); |
| | | 145 | | } |
| | | 146 | | |
| | 23 | 147 | | SecurityToken resolvedToken = null; |
| | 46 | 148 | | for (int i = 0; i < _tokenCount; i++) |
| | | 149 | | { |
| | 23 | 150 | | if (matchOnlyExternal && _tokens[i].AllowedReferenceStyle != SecurityTokenReferenceStyle.External) |
| | | 151 | | { |
| | | 152 | | continue; |
| | | 153 | | } |
| | | 154 | | |
| | 23 | 155 | | SecurityToken token = _tokens[i].Token; |
| | 23 | 156 | | if (_tokens[i].TokenParameters != null && _tokens[i].TokenParameters.MatchesKeyIdentifierClause(token, k |
| | | 157 | | { |
| | 23 | 158 | | resolvedToken = token; |
| | 23 | 159 | | break; |
| | | 160 | | } |
| | 0 | 161 | | else if (_tokens[i].TokenParameters == null) |
| | | 162 | | { |
| | | 163 | | // match it according to the allowed reference style |
| | 0 | 164 | | if (_tokens[i].AllowedReferenceStyle == SecurityTokenReferenceStyle.Internal && MatchDirectReference |
| | | 165 | | { |
| | 0 | 166 | | resolvedToken = token; |
| | 0 | 167 | | break; |
| | | 168 | | } |
| | | 169 | | } |
| | | 170 | | } |
| | | 171 | | |
| | 23 | 172 | | if ((resolvedToken == null) && (keyIdentifierClause is EncryptedKeyIdentifierClause)) |
| | | 173 | | { |
| | 0 | 174 | | EncryptedKeyIdentifierClause keyClause = (EncryptedKeyIdentifierClause)keyIdentifierClause; |
| | 0 | 175 | | SecurityKeyIdentifier wrappingTokenReference = keyClause.EncryptingKeyIdentifier; |
| | | 176 | | SecurityToken unwrappingToken; |
| | 0 | 177 | | if (ExpectedWrapper != null |
| | 0 | 178 | | && CheckExternalWrapperMatch(wrappingTokenReference)) |
| | | 179 | | { |
| | 0 | 180 | | unwrappingToken = ExpectedWrapper; |
| | | 181 | | } |
| | | 182 | | else |
| | | 183 | | { |
| | 0 | 184 | | unwrappingToken = ResolveToken(wrappingTokenReference, true, resolveIntrinsicKeyClause); |
| | | 185 | | } |
| | | 186 | | |
| | 0 | 187 | | if (unwrappingToken != null) |
| | | 188 | | { |
| | 0 | 189 | | resolvedToken = SecurityUtils.CreateTokenFromEncryptedKeyClause(keyClause, unwrappingToken); |
| | | 190 | | } |
| | | 191 | | } |
| | 23 | 192 | | if ((resolvedToken == null) && (keyIdentifierClause is X509RawDataKeyIdentifierClause) && (!matchOnlyExterna |
| | | 193 | | { |
| | 0 | 194 | | resolvedToken = new X509SecurityToken(new X509Certificate2(((X509RawDataKeyIdentifierClause)keyIdentifie |
| | | 195 | | } |
| | 23 | 196 | | byte[] derivationNonce = keyIdentifierClause.GetDerivationNonce(); |
| | 23 | 197 | | if ((resolvedToken != null) && (derivationNonce != null)) |
| | | 198 | | { |
| | | 199 | | // A Implicit Derived Key is specified. Create a derived key off of the resolve token. |
| | 0 | 200 | | if (SecurityUtils.GetSecurityKey<SymmetricSecurityKey>(resolvedToken) == null) |
| | | 201 | | { |
| | | 202 | | // The resolved token contains no Symmetric Security key and thus we cannot create |
| | | 203 | | // a derived key off of it. |
| | 0 | 204 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format(SR. |
| | | 205 | | } |
| | | 206 | | |
| | 0 | 207 | | int derivationLength = (keyIdentifierClause.DerivationLength == 0) ? DerivedKeySecurityToken.DefaultDeri |
| | 0 | 208 | | if (derivationLength > _securityHeader.MaxDerivedKeyLength) |
| | | 209 | | { |
| | 0 | 210 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format(SR. |
| | | 211 | | } |
| | | 212 | | |
| | 0 | 213 | | bool alreadyDerived = false; |
| | 0 | 214 | | for (int i = 0; i < _tokenCount; ++i) |
| | | 215 | | { |
| | 0 | 216 | | if (_tokens[i].Token is DerivedKeySecurityToken derivedKeyToken) |
| | | 217 | | { |
| | 0 | 218 | | if ((derivedKeyToken.Length == derivationLength) && |
| | 0 | 219 | | (CryptoHelper.IsEqual(derivedKeyToken.Nonce, derivationNonce)) && |
| | 0 | 220 | | (derivedKeyToken.TokenToDerive.MatchesKeyIdentifierClause(keyIdentifierClause))) |
| | | 221 | | { |
| | | 222 | | // This is a implcit derived key for which we have already derived the |
| | | 223 | | // token. |
| | 0 | 224 | | resolvedToken = _tokens[i].Token; |
| | 0 | 225 | | alreadyDerived = true; |
| | 0 | 226 | | break; |
| | | 227 | | } |
| | | 228 | | } |
| | | 229 | | } |
| | | 230 | | |
| | 0 | 231 | | if (!alreadyDerived) |
| | | 232 | | { |
| | 0 | 233 | | string psha1Algorithm = SecurityUtils.GetKeyDerivationAlgorithm(_securityHeader.StandardsManager.Mes |
| | | 234 | | |
| | 0 | 235 | | resolvedToken = new DerivedKeySecurityToken(-1, 0, derivationLength, null, derivationNonce, resolved |
| | 0 | 236 | | ((DerivedKeySecurityToken)resolvedToken).InitializeDerivedKey(derivationLength); |
| | 0 | 237 | | Add(resolvedToken, SecurityTokenReferenceStyle.Internal, null); |
| | 0 | 238 | | _securityHeader.EnsureDerivedKeyLimitNotReached(); |
| | | 239 | | } |
| | | 240 | | } |
| | | 241 | | |
| | 23 | 242 | | return resolvedToken; |
| | | 243 | | } |
| | | 244 | | |
| | | 245 | | public override string ToString() |
| | | 246 | | { |
| | 0 | 247 | | using (StringWriter writer = new StringWriter(CultureInfo.InvariantCulture)) |
| | | 248 | | { |
| | 0 | 249 | | writer.WriteLine("SecurityTokenResolver"); |
| | 0 | 250 | | writer.WriteLine(" ("); |
| | 0 | 251 | | writer.WriteLine(" TokenCount = {0},", _tokenCount); |
| | 0 | 252 | | for (int i = 0; i < _tokenCount; i++) |
| | | 253 | | { |
| | 0 | 254 | | writer.WriteLine(" TokenEntry[{0}] = (AllowedReferenceStyle={1}, Token={2}, Parameters={3})", |
| | 0 | 255 | | i, _tokens[i].AllowedReferenceStyle, _tokens[i].Token.GetType(), _tokens[i].TokenParameters); |
| | | 256 | | } |
| | 0 | 257 | | writer.WriteLine(" )"); |
| | 0 | 258 | | return writer.ToString(); |
| | | 259 | | } |
| | 0 | 260 | | } |
| | | 261 | | |
| | | 262 | | protected override bool TryResolveTokenCore(SecurityKeyIdentifier keyIdentifier, out SecurityToken token) |
| | | 263 | | { |
| | 23 | 264 | | token = ResolveToken(keyIdentifier, false, true); |
| | 23 | 265 | | return token != null; |
| | | 266 | | } |
| | | 267 | | |
| | | 268 | | internal bool TryResolveToken(SecurityKeyIdentifier keyIdentifier, bool matchOnlyExternalTokens, bool resolveInt |
| | | 269 | | { |
| | 0 | 270 | | token = ResolveToken(keyIdentifier, matchOnlyExternalTokens, resolveIntrinsicKeyClause); |
| | 0 | 271 | | return token != null; |
| | | 272 | | } |
| | | 273 | | |
| | | 274 | | protected override bool TryResolveTokenCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityToken t |
| | | 275 | | { |
| | 0 | 276 | | token = ResolveToken(keyIdentifierClause, false, true); |
| | 0 | 277 | | return token != null; |
| | | 278 | | } |
| | | 279 | | |
| | | 280 | | internal bool TryResolveToken(SecurityKeyIdentifierClause keyIdentifierClause, bool matchOnlyExternalTokens, boo |
| | | 281 | | { |
| | 0 | 282 | | token = ResolveToken(keyIdentifierClause, matchOnlyExternalTokens, resolveIntrinsicKeyClause); |
| | 0 | 283 | | return token != null; |
| | | 284 | | } |
| | | 285 | | |
| | | 286 | | internal bool TryResolveSecurityKey(SecurityKeyIdentifierClause keyIdentifierClause, bool createIntrinsicKeys, o |
| | | 287 | | { |
| | 0 | 288 | | if (keyIdentifierClause == null) |
| | | 289 | | { |
| | 0 | 290 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(keyIdentifierClause)); |
| | | 291 | | } |
| | 0 | 292 | | key = ResolveSecurityKeyCore(keyIdentifierClause, createIntrinsicKeys); |
| | 0 | 293 | | return key != null; |
| | | 294 | | } |
| | | 295 | | |
| | | 296 | | protected override bool TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityK |
| | | 297 | | { |
| | 0 | 298 | | key = ResolveSecurityKeyCore(keyIdentifierClause, true); |
| | 0 | 299 | | return key != null; |
| | | 300 | | } |
| | | 301 | | |
| | | 302 | | private struct SecurityTokenEntry |
| | | 303 | | { |
| | | 304 | | public SecurityTokenEntry(SecurityToken token, SecurityTokenParameters tokenParameters, SecurityTokenReferen |
| | | 305 | | { |
| | 64 | 306 | | Token = token; |
| | 64 | 307 | | TokenParameters = tokenParameters; |
| | 64 | 308 | | AllowedReferenceStyle = allowedReferenceStyle; |
| | 64 | 309 | | } |
| | | 310 | | |
| | 23 | 311 | | public SecurityToken Token { get; } |
| | | 312 | | |
| | 46 | 313 | | public SecurityTokenParameters TokenParameters { get; } |
| | | 314 | | |
| | 23 | 315 | | public SecurityTokenReferenceStyle AllowedReferenceStyle { get; } |
| | | 316 | | } |
| | | 317 | | } |
| | | 318 | | } |