| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.ObjectModel; |
| | | 6 | | using CoreWCF.Channels; |
| | | 7 | | using CoreWCF.IdentityModel.Policy; |
| | | 8 | | using CoreWCF.Security.Tokens; |
| | | 9 | | |
| | | 10 | | namespace CoreWCF.Security |
| | | 11 | | { |
| | | 12 | | public class SecurityMessageProperty : IMessageProperty, IDisposable |
| | | 13 | | { |
| | | 14 | | // This is the list of outgoing supporting tokens |
| | | 15 | | private Collection<SupportingTokenSpecification> _outgoingSupportingTokens; |
| | | 16 | | private Collection<SupportingTokenSpecification> _incomingSupportingTokens; |
| | | 17 | | private SecurityTokenSpecification _transportToken; |
| | | 18 | | private SecurityTokenSpecification _protectionToken; |
| | | 19 | | private SecurityTokenSpecification _initiatorToken; |
| | | 20 | | private SecurityTokenSpecification _recipientToken; |
| | | 21 | | private ServiceSecurityContext _securityContext; |
| | | 22 | | private bool _disposed = false; |
| | | 23 | | |
| | 206 | 24 | | public SecurityMessageProperty() |
| | | 25 | | { |
| | 206 | 26 | | _securityContext = ServiceSecurityContext.Anonymous; |
| | 206 | 27 | | } |
| | | 28 | | |
| | | 29 | | public ServiceSecurityContext ServiceSecurityContext |
| | | 30 | | { |
| | | 31 | | get |
| | | 32 | | { |
| | 258 | 33 | | ThrowIfDisposed(); |
| | 258 | 34 | | return _securityContext; |
| | | 35 | | } |
| | | 36 | | set |
| | | 37 | | { |
| | 139 | 38 | | ThrowIfDisposed(); |
| | 139 | 39 | | _securityContext = value; |
| | 139 | 40 | | } |
| | | 41 | | } |
| | | 42 | | |
| | 166 | 43 | | public ReadOnlyCollection<IAuthorizationPolicy> ExternalAuthorizationPolicies { get; set; } |
| | | 44 | | |
| | | 45 | | public SecurityTokenSpecification ProtectionToken |
| | | 46 | | { |
| | | 47 | | get |
| | | 48 | | { |
| | 40 | 49 | | ThrowIfDisposed(); |
| | 40 | 50 | | return _protectionToken; |
| | | 51 | | } |
| | | 52 | | set |
| | | 53 | | { |
| | 0 | 54 | | ThrowIfDisposed(); |
| | 0 | 55 | | _protectionToken = value; |
| | 0 | 56 | | } |
| | | 57 | | } |
| | | 58 | | |
| | | 59 | | public SecurityTokenSpecification InitiatorToken |
| | | 60 | | { |
| | | 61 | | get |
| | | 62 | | { |
| | 10 | 63 | | ThrowIfDisposed(); |
| | 10 | 64 | | return _initiatorToken; |
| | | 65 | | } |
| | | 66 | | set |
| | | 67 | | { |
| | 0 | 68 | | ThrowIfDisposed(); |
| | 0 | 69 | | _initiatorToken = value; |
| | 0 | 70 | | } |
| | | 71 | | } |
| | | 72 | | |
| | | 73 | | public SecurityTokenSpecification RecipientToken |
| | | 74 | | { |
| | | 75 | | get |
| | | 76 | | { |
| | 0 | 77 | | ThrowIfDisposed(); |
| | 0 | 78 | | return _recipientToken; |
| | | 79 | | } |
| | | 80 | | set |
| | | 81 | | { |
| | 0 | 82 | | ThrowIfDisposed(); |
| | 0 | 83 | | _recipientToken = value; |
| | 0 | 84 | | } |
| | | 85 | | } |
| | | 86 | | |
| | | 87 | | public SecurityTokenSpecification TransportToken |
| | | 88 | | { |
| | | 89 | | get |
| | | 90 | | { |
| | 17 | 91 | | ThrowIfDisposed(); |
| | 17 | 92 | | return _transportToken; |
| | | 93 | | } |
| | | 94 | | set |
| | | 95 | | { |
| | 3 | 96 | | ThrowIfDisposed(); |
| | 3 | 97 | | _transportToken = value; |
| | 3 | 98 | | } |
| | | 99 | | } |
| | | 100 | | |
| | | 101 | | |
| | 338 | 102 | | public string SenderIdPrefix { get; set; } = "_"; |
| | | 103 | | |
| | | 104 | | public bool HasIncomingSupportingTokens |
| | | 105 | | { |
| | | 106 | | get |
| | | 107 | | { |
| | 232 | 108 | | ThrowIfDisposed(); |
| | 232 | 109 | | return ((_incomingSupportingTokens != null) && (_incomingSupportingTokens.Count > 0)); |
| | | 110 | | } |
| | | 111 | | } |
| | | 112 | | |
| | | 113 | | public Collection<SupportingTokenSpecification> IncomingSupportingTokens |
| | | 114 | | { |
| | | 115 | | get |
| | | 116 | | { |
| | 201 | 117 | | ThrowIfDisposed(); |
| | 201 | 118 | | if (_incomingSupportingTokens == null) |
| | | 119 | | { |
| | 63 | 120 | | _incomingSupportingTokens = new Collection<SupportingTokenSpecification>(); |
| | | 121 | | } |
| | 201 | 122 | | return _incomingSupportingTokens; |
| | | 123 | | } |
| | | 124 | | } |
| | | 125 | | |
| | | 126 | | public Collection<SupportingTokenSpecification> OutgoingSupportingTokens |
| | | 127 | | { |
| | | 128 | | get |
| | | 129 | | { |
| | 0 | 130 | | if (_outgoingSupportingTokens == null) |
| | | 131 | | { |
| | 0 | 132 | | _outgoingSupportingTokens = new Collection<SupportingTokenSpecification>(); |
| | | 133 | | } |
| | 0 | 134 | | return _outgoingSupportingTokens; |
| | | 135 | | } |
| | | 136 | | } |
| | | 137 | | |
| | | 138 | | internal bool HasOutgoingSupportingTokens |
| | | 139 | | { |
| | | 140 | | get |
| | | 141 | | { |
| | 66 | 142 | | return ((_outgoingSupportingTokens != null) && (_outgoingSupportingTokens.Count > 0)); |
| | | 143 | | } |
| | | 144 | | } |
| | | 145 | | |
| | | 146 | | public IMessageProperty CreateCopy() |
| | | 147 | | { |
| | 66 | 148 | | ThrowIfDisposed(); |
| | 66 | 149 | | SecurityMessageProperty result = new SecurityMessageProperty(); |
| | | 150 | | |
| | 66 | 151 | | if (HasOutgoingSupportingTokens) |
| | | 152 | | { |
| | 0 | 153 | | for (int i = 0; i < _outgoingSupportingTokens.Count; ++i) |
| | | 154 | | { |
| | 0 | 155 | | result.OutgoingSupportingTokens.Add(_outgoingSupportingTokens[i]); |
| | | 156 | | } |
| | | 157 | | } |
| | | 158 | | |
| | 66 | 159 | | if (HasIncomingSupportingTokens) |
| | | 160 | | { |
| | 0 | 161 | | for (int i = 0; i < _incomingSupportingTokens.Count; ++i) |
| | | 162 | | { |
| | 0 | 163 | | result.IncomingSupportingTokens.Add(_incomingSupportingTokens[i]); |
| | | 164 | | } |
| | | 165 | | } |
| | | 166 | | |
| | 66 | 167 | | result._securityContext = _securityContext; |
| | 66 | 168 | | result.ExternalAuthorizationPolicies = ExternalAuthorizationPolicies; |
| | 66 | 169 | | result.SenderIdPrefix = SenderIdPrefix; |
| | | 170 | | |
| | 66 | 171 | | result._protectionToken = _protectionToken; |
| | 66 | 172 | | result._initiatorToken = _initiatorToken; |
| | 66 | 173 | | result._recipientToken = _recipientToken; |
| | 66 | 174 | | result._transportToken = _transportToken; |
| | | 175 | | |
| | 66 | 176 | | return result; |
| | | 177 | | } |
| | | 178 | | |
| | | 179 | | public static SecurityMessageProperty GetOrCreate(Message message) |
| | | 180 | | { |
| | 80 | 181 | | if (message == null) |
| | | 182 | | { |
| | 0 | 183 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(message)); |
| | | 184 | | } |
| | | 185 | | |
| | 80 | 186 | | SecurityMessageProperty result = null; |
| | 80 | 187 | | if (message.Properties != null) |
| | | 188 | | { |
| | 80 | 189 | | result = message.Properties.Security; |
| | | 190 | | } |
| | | 191 | | |
| | 80 | 192 | | if (result == null) |
| | | 193 | | { |
| | 74 | 194 | | result = new SecurityMessageProperty(); |
| | 74 | 195 | | message.Properties.Security = result; |
| | | 196 | | } |
| | | 197 | | |
| | 80 | 198 | | return result; |
| | | 199 | | } |
| | | 200 | | |
| | | 201 | | private void AddAuthorizationPolicies(SecurityTokenSpecification spec, Collection<IAuthorizationPolicy> policies |
| | | 202 | | { |
| | 252 | 203 | | if (spec != null && spec.SecurityTokenPolicies != null && spec.SecurityTokenPolicies.Count > 0) |
| | | 204 | | { |
| | 260 | 205 | | for (int i = 0; i < spec.SecurityTokenPolicies.Count; ++i) |
| | | 206 | | { |
| | 68 | 207 | | policies.Add(spec.SecurityTokenPolicies[i]); |
| | | 208 | | } |
| | | 209 | | } |
| | 252 | 210 | | } |
| | | 211 | | |
| | | 212 | | internal ReadOnlyCollection<IAuthorizationPolicy> GetInitiatorTokenAuthorizationPolicies() |
| | | 213 | | { |
| | 63 | 214 | | return GetInitiatorTokenAuthorizationPolicies(true); |
| | | 215 | | } |
| | | 216 | | |
| | | 217 | | internal ReadOnlyCollection<IAuthorizationPolicy> GetInitiatorTokenAuthorizationPolicies(bool includeTransportTo |
| | | 218 | | { |
| | 63 | 219 | | return GetInitiatorTokenAuthorizationPolicies(includeTransportToken, null); |
| | | 220 | | } |
| | | 221 | | |
| | | 222 | | internal ReadOnlyCollection<IAuthorizationPolicy> GetInitiatorTokenAuthorizationPolicies(bool includeTransportTo |
| | | 223 | | { |
| | | 224 | | // fast path |
| | 63 | 225 | | if (!HasIncomingSupportingTokens) |
| | | 226 | | { |
| | 0 | 227 | | if (_transportToken != null && _initiatorToken == null && _protectionToken == null) |
| | | 228 | | { |
| | 0 | 229 | | if (includeTransportToken && _transportToken.SecurityTokenPolicies != null) |
| | | 230 | | { |
| | 0 | 231 | | return _transportToken.SecurityTokenPolicies; |
| | | 232 | | } |
| | | 233 | | else |
| | | 234 | | { |
| | 0 | 235 | | return EmptyReadOnlyCollection<IAuthorizationPolicy>.Instance; |
| | | 236 | | } |
| | | 237 | | } |
| | 0 | 238 | | else if (_transportToken == null && _initiatorToken != null && _protectionToken == null) |
| | | 239 | | { |
| | 0 | 240 | | return _initiatorToken.SecurityTokenPolicies ?? EmptyReadOnlyCollection<IAuthorizationPolicy>.Instan |
| | | 241 | | } |
| | 0 | 242 | | else if (_transportToken == null && _initiatorToken == null && _protectionToken != null) |
| | | 243 | | { |
| | 0 | 244 | | return _protectionToken.SecurityTokenPolicies ?? EmptyReadOnlyCollection<IAuthorizationPolicy>.Insta |
| | | 245 | | } |
| | | 246 | | } |
| | | 247 | | |
| | 63 | 248 | | Collection<IAuthorizationPolicy> policies = new Collection<IAuthorizationPolicy>(); |
| | 63 | 249 | | if (includeTransportToken) |
| | | 250 | | { |
| | 63 | 251 | | AddAuthorizationPolicies(_transportToken, policies); |
| | | 252 | | } |
| | 63 | 253 | | AddAuthorizationPolicies(_initiatorToken, policies); |
| | 63 | 254 | | AddAuthorizationPolicies(_protectionToken, policies); |
| | 63 | 255 | | if (HasIncomingSupportingTokens) |
| | | 256 | | { |
| | 252 | 257 | | for (int i = 0; i < _incomingSupportingTokens.Count; ++i) |
| | | 258 | | { |
| | 63 | 259 | | if (supportingSessionTokenToExclude != null) |
| | | 260 | | { |
| | 0 | 261 | | if (_incomingSupportingTokens[i].SecurityToken is SecurityContextSecurityToken sct && sct.Contex |
| | | 262 | | { |
| | | 263 | | continue; |
| | | 264 | | } |
| | | 265 | | } |
| | 63 | 266 | | SecurityTokenAttachmentMode attachmentMode = _incomingSupportingTokens[i].SecurityTokenAttachmentMod |
| | | 267 | | // a safety net in case more attachment modes get added to the product without |
| | | 268 | | // reviewing this code. |
| | 63 | 269 | | if (attachmentMode == SecurityTokenAttachmentMode.Endorsing |
| | 63 | 270 | | || attachmentMode == SecurityTokenAttachmentMode.Signed |
| | 63 | 271 | | || attachmentMode == SecurityTokenAttachmentMode.SignedEncrypted |
| | 63 | 272 | | || attachmentMode == SecurityTokenAttachmentMode.SignedEndorsing) |
| | | 273 | | { |
| | 63 | 274 | | AddAuthorizationPolicies(_incomingSupportingTokens[i], policies); |
| | | 275 | | } |
| | | 276 | | } |
| | | 277 | | } |
| | 63 | 278 | | return new ReadOnlyCollection<IAuthorizationPolicy>(policies); |
| | | 279 | | } |
| | | 280 | | |
| | | 281 | | public void Dispose() |
| | | 282 | | { |
| | | 283 | | // do no-op for future V2 |
| | 107 | 284 | | if (!_disposed) |
| | | 285 | | { |
| | 107 | 286 | | _disposed = true; |
| | | 287 | | } |
| | 107 | 288 | | } |
| | | 289 | | |
| | | 290 | | private void ThrowIfDisposed() |
| | | 291 | | { |
| | 966 | 292 | | if (_disposed) |
| | | 293 | | { |
| | 0 | 294 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ObjectDisposedException(GetType().FullName |
| | | 295 | | } |
| | 966 | 296 | | } |
| | | 297 | | } |
| | | 298 | | } |