| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Collections.Generic; |
| | | 6 | | using System.Collections.ObjectModel; |
| | | 7 | | using System.Threading; |
| | | 8 | | using System.Threading.Tasks; |
| | | 9 | | using CoreWCF.Channels; |
| | | 10 | | using CoreWCF.Description; |
| | | 11 | | using CoreWCF.IdentityModel.Policy; |
| | | 12 | | using CoreWCF.IdentityModel.Selectors; |
| | | 13 | | using CoreWCF.IdentityModel.Tokens; |
| | | 14 | | using CoreWCF.Runtime; |
| | | 15 | | using CoreWCF.Security.Tokens; |
| | | 16 | | |
| | | 17 | | namespace CoreWCF.Security |
| | | 18 | | { |
| | | 19 | | // See SecurityProtocolFactory for contracts on subclasses etc |
| | | 20 | | internal abstract class SecurityProtocol : ISecurityCommunicationObject |
| | | 21 | | { |
| | | 22 | | private static ReadOnlyCollection<SupportingTokenProviderSpecification> s_emptyTokenProviders; |
| | | 23 | | private Dictionary<string, Collection<SupportingTokenProviderSpecification>> _mergedSupportingTokenProvidersMap; |
| | | 24 | | |
| | 34 | 25 | | protected SecurityProtocol(SecurityProtocolFactory factory, EndpointAddress target, Uri via) |
| | | 26 | | { |
| | 34 | 27 | | SecurityProtocolFactory = factory; |
| | 34 | 28 | | Target = target; |
| | 34 | 29 | | Via = via; |
| | 34 | 30 | | CommunicationObject = new WrapperSecurityCommunicationObject(this); |
| | 34 | 31 | | } |
| | | 32 | | |
| | 211 | 33 | | protected WrapperSecurityCommunicationObject CommunicationObject { get; } |
| | | 34 | | |
| | 625 | 35 | | public SecurityProtocolFactory SecurityProtocolFactory { get; } |
| | | 36 | | |
| | 0 | 37 | | public EndpointAddress Target { get; } |
| | | 38 | | |
| | 0 | 39 | | public Uri Via { get; } |
| | | 40 | | |
| | 0 | 41 | | public ICollection<SupportingTokenProviderSpecification> ChannelSupportingTokenProviderSpecification { get; priv |
| | | 42 | | |
| | 0 | 43 | | public Dictionary<string, ICollection<SupportingTokenProviderSpecification>> ScopedSupportingTokenProviderSpecif |
| | | 44 | | |
| | | 45 | | private static ReadOnlyCollection<SupportingTokenProviderSpecification> EmptyTokenProviders |
| | | 46 | | { |
| | | 47 | | get |
| | | 48 | | { |
| | 0 | 49 | | if (s_emptyTokenProviders == null) |
| | | 50 | | { |
| | 0 | 51 | | s_emptyTokenProviders = new ReadOnlyCollection<SupportingTokenProviderSpecification>(new List<Suppor |
| | | 52 | | } |
| | 0 | 53 | | return s_emptyTokenProviders; |
| | | 54 | | } |
| | | 55 | | } |
| | | 56 | | |
| | | 57 | | // ISecurityCommunicationObject members |
| | | 58 | | public TimeSpan DefaultOpenTimeout |
| | | 59 | | { |
| | 68 | 60 | | get { return ServiceDefaults.OpenTimeout; } |
| | | 61 | | } |
| | | 62 | | |
| | | 63 | | public TimeSpan DefaultCloseTimeout |
| | | 64 | | { |
| | 20 | 65 | | get { return ServiceDefaults.CloseTimeout; } |
| | | 66 | | } |
| | | 67 | | |
| | | 68 | | public Task OpenAsync(TimeSpan timeout) |
| | | 69 | | { |
| | 34 | 70 | | return CommunicationObject.OpenAsync(); |
| | | 71 | | } |
| | | 72 | | |
| | 10 | 73 | | public void OnClosed() { } |
| | | 74 | | |
| | 0 | 75 | | public void OnClosing() { } |
| | | 76 | | |
| | 0 | 77 | | public void OnFaulted() { } |
| | | 78 | | |
| | 0 | 79 | | public void OnOpened() { } |
| | | 80 | | |
| | 0 | 81 | | public void OnOpening() { } |
| | | 82 | | |
| | | 83 | | internal IList<SupportingTokenProviderSpecification> GetSupportingTokenProviders(string action) |
| | | 84 | | { |
| | 0 | 85 | | if (_mergedSupportingTokenProvidersMap != null && _mergedSupportingTokenProvidersMap.Count > 0) |
| | | 86 | | { |
| | 0 | 87 | | if (action != null && _mergedSupportingTokenProvidersMap.ContainsKey(action)) |
| | | 88 | | { |
| | 0 | 89 | | return _mergedSupportingTokenProvidersMap[action]; |
| | | 90 | | } |
| | 0 | 91 | | else if (_mergedSupportingTokenProvidersMap.ContainsKey(MessageHeaders.WildcardAction)) |
| | | 92 | | { |
| | 0 | 93 | | return _mergedSupportingTokenProvidersMap[MessageHeaders.WildcardAction]; |
| | | 94 | | } |
| | | 95 | | } |
| | | 96 | | // return null if the token providers list is empty - this gets a perf benefit since calling Count is expens |
| | | 97 | | // ReadOnlyCollection |
| | 0 | 98 | | return (ChannelSupportingTokenProviderSpecification == EmptyTokenProviders) ? null : (IList<SupportingTokenP |
| | | 99 | | } |
| | | 100 | | |
| | | 101 | | protected InitiatorServiceModelSecurityTokenRequirement CreateInitiatorSecurityTokenRequirement() |
| | | 102 | | { |
| | 0 | 103 | | InitiatorServiceModelSecurityTokenRequirement requirement = new InitiatorServiceModelSecurityTokenRequiremen |
| | 0 | 104 | | { |
| | 0 | 105 | | TargetAddress = Target, |
| | 0 | 106 | | Via = Via, |
| | 0 | 107 | | SecurityBindingElement = SecurityProtocolFactory.SecurityBindingElement, |
| | 0 | 108 | | SecurityAlgorithmSuite = SecurityProtocolFactory.OutgoingAlgorithmSuite, |
| | 0 | 109 | | MessageSecurityVersion = SecurityProtocolFactory.MessageSecurityVersion.SecurityTokenVersion |
| | 0 | 110 | | }; |
| | 0 | 111 | | return requirement; |
| | | 112 | | } |
| | | 113 | | |
| | | 114 | | private InitiatorServiceModelSecurityTokenRequirement CreateInitiatorSecurityTokenRequirement(SecurityTokenParam |
| | | 115 | | { |
| | 0 | 116 | | InitiatorServiceModelSecurityTokenRequirement requirement = CreateInitiatorSecurityTokenRequirement(); |
| | 0 | 117 | | parameters.InitializeSecurityTokenRequirement(requirement); |
| | 0 | 118 | | requirement.KeyUsage = SecurityKeyUsage.Signature; |
| | 0 | 119 | | requirement.Properties[ServiceModelSecurityTokenRequirement.MessageDirectionProperty] = MessageDirection.Out |
| | 0 | 120 | | requirement.Properties[ServiceModelSecurityTokenRequirement.SupportingTokenAttachmentModeProperty] = attachm |
| | 0 | 121 | | return requirement; |
| | | 122 | | } |
| | | 123 | | |
| | | 124 | | private void AddSupportingTokenProviders(SupportingTokenParameters supportingTokenParameters, bool isOptional, I |
| | | 125 | | { |
| | 0 | 126 | | for (int i = 0; i < supportingTokenParameters.Endorsing.Count; ++i) |
| | | 127 | | { |
| | 0 | 128 | | SecurityTokenRequirement requirement = CreateInitiatorSecurityTokenRequirement(supportingTokenParameters |
| | | 129 | | try |
| | | 130 | | { |
| | 0 | 131 | | if (isOptional) |
| | | 132 | | { |
| | 0 | 133 | | requirement.IsOptionalToken = true; |
| | | 134 | | } |
| | 0 | 135 | | SecurityTokenProvider provider = SecurityProtocolFactory.SecurityTokenManager.CreateSecurityTokenPro |
| | 0 | 136 | | if (provider == null) |
| | | 137 | | { |
| | 0 | 138 | | continue; |
| | | 139 | | } |
| | 0 | 140 | | SupportingTokenProviderSpecification providerSpec = new SupportingTokenProviderSpecification(provide |
| | 0 | 141 | | providerSpecList.Add(providerSpec); |
| | 0 | 142 | | } |
| | 0 | 143 | | catch (Exception e) |
| | | 144 | | { |
| | 0 | 145 | | if (!isOptional || Fx.IsFatal(e)) |
| | | 146 | | { |
| | 0 | 147 | | throw; |
| | | 148 | | } |
| | 0 | 149 | | } |
| | | 150 | | } |
| | | 151 | | |
| | 0 | 152 | | for (int i = 0; i < supportingTokenParameters.SignedEndorsing.Count; ++i) |
| | | 153 | | { |
| | 0 | 154 | | SecurityTokenRequirement requirement = CreateInitiatorSecurityTokenRequirement(supportingTokenParameters |
| | | 155 | | try |
| | | 156 | | { |
| | 0 | 157 | | if (isOptional) |
| | | 158 | | { |
| | 0 | 159 | | requirement.IsOptionalToken = true; |
| | | 160 | | } |
| | 0 | 161 | | SecurityTokenProvider provider = SecurityProtocolFactory.SecurityTokenManager.CreateSecurityTokenPro |
| | 0 | 162 | | if (provider == null) |
| | | 163 | | { |
| | 0 | 164 | | continue; |
| | | 165 | | } |
| | 0 | 166 | | SupportingTokenProviderSpecification providerSpec = new SupportingTokenProviderSpecification(provide |
| | 0 | 167 | | providerSpecList.Add(providerSpec); |
| | 0 | 168 | | } |
| | 0 | 169 | | catch (Exception e) |
| | | 170 | | { |
| | 0 | 171 | | if (!isOptional || Fx.IsFatal(e)) |
| | | 172 | | { |
| | 0 | 173 | | throw; |
| | | 174 | | } |
| | 0 | 175 | | } |
| | | 176 | | } |
| | | 177 | | |
| | 0 | 178 | | for (int i = 0; i < supportingTokenParameters.SignedEncrypted.Count; ++i) |
| | | 179 | | { |
| | 0 | 180 | | SecurityTokenRequirement requirement = CreateInitiatorSecurityTokenRequirement(supportingTokenParameters |
| | | 181 | | try |
| | | 182 | | { |
| | 0 | 183 | | if (isOptional) |
| | | 184 | | { |
| | 0 | 185 | | requirement.IsOptionalToken = true; |
| | | 186 | | } |
| | 0 | 187 | | SecurityTokenProvider provider = SecurityProtocolFactory.SecurityTokenManager.CreateSecurityTokenPro |
| | 0 | 188 | | if (provider == null) |
| | | 189 | | { |
| | 0 | 190 | | continue; |
| | | 191 | | } |
| | 0 | 192 | | SupportingTokenProviderSpecification providerSpec = new SupportingTokenProviderSpecification(provide |
| | 0 | 193 | | providerSpecList.Add(providerSpec); |
| | 0 | 194 | | } |
| | 0 | 195 | | catch (Exception e) |
| | | 196 | | { |
| | 0 | 197 | | if (!isOptional || Fx.IsFatal(e)) |
| | | 198 | | { |
| | 0 | 199 | | throw; |
| | | 200 | | } |
| | 0 | 201 | | } |
| | | 202 | | } |
| | | 203 | | |
| | 0 | 204 | | for (int i = 0; i < supportingTokenParameters.Signed.Count; ++i) |
| | | 205 | | { |
| | 0 | 206 | | SecurityTokenRequirement requirement = CreateInitiatorSecurityTokenRequirement(supportingTokenParameters |
| | | 207 | | try |
| | | 208 | | { |
| | 0 | 209 | | if (isOptional) |
| | | 210 | | { |
| | 0 | 211 | | requirement.IsOptionalToken = true; |
| | | 212 | | } |
| | 0 | 213 | | SecurityTokenProvider provider = SecurityProtocolFactory.SecurityTokenManager.CreateSecurityTokenPro |
| | 0 | 214 | | if (provider == null) |
| | | 215 | | { |
| | 0 | 216 | | continue; |
| | | 217 | | } |
| | 0 | 218 | | SupportingTokenProviderSpecification providerSpec = new SupportingTokenProviderSpecification(provide |
| | 0 | 219 | | providerSpecList.Add(providerSpec); |
| | 0 | 220 | | } |
| | 0 | 221 | | catch (Exception e) |
| | | 222 | | { |
| | 0 | 223 | | if (!isOptional || Fx.IsFatal(e)) |
| | | 224 | | { |
| | 0 | 225 | | throw; |
| | | 226 | | } |
| | 0 | 227 | | } |
| | | 228 | | } |
| | 0 | 229 | | } |
| | | 230 | | |
| | | 231 | | private async Task MergeSupportingTokenProvidersAsync(TimeSpan timeout) |
| | | 232 | | { |
| | 0 | 233 | | if (ScopedSupportingTokenProviderSpecification.Count == 0) |
| | | 234 | | { |
| | 0 | 235 | | _mergedSupportingTokenProvidersMap = null; |
| | | 236 | | } |
| | | 237 | | else |
| | | 238 | | { |
| | 0 | 239 | | TimeoutHelper timeoutHelper = new TimeoutHelper(timeout); |
| | 0 | 240 | | SecurityProtocolFactory.ExpectSupportingTokens = true; |
| | 0 | 241 | | _mergedSupportingTokenProvidersMap = new Dictionary<string, Collection<SupportingTokenProviderSpecificat |
| | 0 | 242 | | foreach (string action in ScopedSupportingTokenProviderSpecification.Keys) |
| | | 243 | | { |
| | 0 | 244 | | ICollection<SupportingTokenProviderSpecification> scopedProviders = ScopedSupportingTokenProviderSpe |
| | 0 | 245 | | if (scopedProviders == null || scopedProviders.Count == 0) |
| | | 246 | | { |
| | | 247 | | continue; |
| | | 248 | | } |
| | 0 | 249 | | Collection<SupportingTokenProviderSpecification> mergedProviders = new Collection<SupportingTokenPro |
| | 0 | 250 | | foreach (SupportingTokenProviderSpecification spec in ChannelSupportingTokenProviderSpecification) |
| | | 251 | | { |
| | 0 | 252 | | mergedProviders.Add(spec); |
| | | 253 | | } |
| | 0 | 254 | | foreach (SupportingTokenProviderSpecification spec in scopedProviders) |
| | | 255 | | { |
| | 0 | 256 | | await SecurityUtils.OpenTokenProviderIfRequiredAsync(spec.TokenProvider, timeoutHelper.GetCancel |
| | 0 | 257 | | if (spec.SecurityTokenAttachmentMode == SecurityTokenAttachmentMode.Endorsing || spec.SecurityTo |
| | | 258 | | { |
| | 0 | 259 | | if (spec.TokenParameters.RequireDerivedKeys && !spec.TokenParameters.HasAsymmetricKey) |
| | | 260 | | { |
| | 0 | 261 | | SecurityProtocolFactory.ExpectKeyDerivation = true; |
| | | 262 | | } |
| | | 263 | | } |
| | 0 | 264 | | mergedProviders.Add(spec); |
| | 0 | 265 | | } |
| | 0 | 266 | | _mergedSupportingTokenProvidersMap.Add(action, mergedProviders); |
| | 0 | 267 | | } |
| | | 268 | | } |
| | 0 | 269 | | } |
| | | 270 | | |
| | | 271 | | public virtual async Task OnOpenAsync(TimeSpan timeout) |
| | | 272 | | { |
| | 34 | 273 | | TimeoutHelper timeoutHelper = new TimeoutHelper(timeout); |
| | 34 | 274 | | if (SecurityProtocolFactory.ActAsInitiator) |
| | | 275 | | { |
| | 0 | 276 | | ChannelSupportingTokenProviderSpecification = new Collection<SupportingTokenProviderSpecification>(); |
| | 0 | 277 | | ScopedSupportingTokenProviderSpecification = new Dictionary<string, ICollection<SupportingTokenProviderS |
| | | 278 | | |
| | 0 | 279 | | AddSupportingTokenProviders(SecurityProtocolFactory.SecurityBindingElement.EndpointSupportingTokenParame |
| | 0 | 280 | | AddSupportingTokenProviders(SecurityProtocolFactory.SecurityBindingElement.OptionalEndpointSupportingTok |
| | 0 | 281 | | foreach (string action in SecurityProtocolFactory.SecurityBindingElement.OperationSupportingTokenParamet |
| | | 282 | | { |
| | 0 | 283 | | Collection<SupportingTokenProviderSpecification> providerSpecList = new Collection<SupportingTokenPr |
| | 0 | 284 | | AddSupportingTokenProviders(SecurityProtocolFactory.SecurityBindingElement.OperationSupportingTokenP |
| | 0 | 285 | | ScopedSupportingTokenProviderSpecification.Add(action, providerSpecList); |
| | | 286 | | } |
| | | 287 | | |
| | 0 | 288 | | foreach (string action in SecurityProtocolFactory.SecurityBindingElement.OptionalOperationSupportingToke |
| | | 289 | | { |
| | | 290 | | Collection<SupportingTokenProviderSpecification> providerSpecList; |
| | 0 | 291 | | if (ScopedSupportingTokenProviderSpecification.TryGetValue(action, out ICollection<SupportingTokenPr |
| | | 292 | | { |
| | 0 | 293 | | providerSpecList = ((Collection<SupportingTokenProviderSpecification>)existingList); |
| | | 294 | | } |
| | | 295 | | else |
| | | 296 | | { |
| | 0 | 297 | | providerSpecList = new Collection<SupportingTokenProviderSpecification>(); |
| | 0 | 298 | | ScopedSupportingTokenProviderSpecification.Add(action, providerSpecList); |
| | | 299 | | } |
| | | 300 | | |
| | 0 | 301 | | AddSupportingTokenProviders(SecurityProtocolFactory.SecurityBindingElement.OptionalOperationSupporti |
| | | 302 | | } |
| | | 303 | | |
| | 0 | 304 | | if (!ChannelSupportingTokenProviderSpecification.IsReadOnly) |
| | | 305 | | { |
| | 0 | 306 | | if (ChannelSupportingTokenProviderSpecification.Count == 0) |
| | | 307 | | { |
| | 0 | 308 | | ChannelSupportingTokenProviderSpecification = EmptyTokenProviders; |
| | | 309 | | } |
| | | 310 | | else |
| | | 311 | | { |
| | 0 | 312 | | SecurityProtocolFactory.ExpectSupportingTokens = true; |
| | 0 | 313 | | CancellationToken cancellationToken = timeoutHelper.GetCancellationToken(); |
| | 0 | 314 | | foreach (SupportingTokenProviderSpecification tokenProviderSpec in ChannelSupportingTokenProvide |
| | | 315 | | { |
| | 0 | 316 | | await SecurityUtils.OpenTokenProviderIfRequiredAsync(tokenProviderSpec.TokenProvider, cancel |
| | 0 | 317 | | if (tokenProviderSpec.SecurityTokenAttachmentMode == SecurityTokenAttachmentMode.Endorsing | |
| | | 318 | | { |
| | 0 | 319 | | if (tokenProviderSpec.TokenParameters.RequireDerivedKeys && !tokenProviderSpec.TokenPara |
| | | 320 | | { |
| | 0 | 321 | | SecurityProtocolFactory.ExpectKeyDerivation = true; |
| | | 322 | | } |
| | | 323 | | } |
| | 0 | 324 | | } |
| | 0 | 325 | | ChannelSupportingTokenProviderSpecification = |
| | 0 | 326 | | new ReadOnlyCollection<SupportingTokenProviderSpecification>((Collection<SupportingTokenProv |
| | | 327 | | } |
| | | 328 | | } |
| | | 329 | | // create a merged map of the per operation supporting tokens |
| | 0 | 330 | | await MergeSupportingTokenProvidersAsync(timeoutHelper.RemainingTime()); |
| | | 331 | | } |
| | 34 | 332 | | } |
| | | 333 | | |
| | | 334 | | public virtual void OnAbort() |
| | | 335 | | { |
| | 0 | 336 | | if (SecurityProtocolFactory.ActAsInitiator) |
| | | 337 | | { |
| | 0 | 338 | | foreach (SupportingTokenProviderSpecification spec in ChannelSupportingTokenProviderSpecification) |
| | | 339 | | { |
| | 0 | 340 | | SecurityUtils.AbortTokenProviderIfRequired(spec.TokenProvider); |
| | | 341 | | } |
| | 0 | 342 | | foreach (string action in ScopedSupportingTokenProviderSpecification.Keys) |
| | | 343 | | { |
| | 0 | 344 | | ICollection<SupportingTokenProviderSpecification> supportingProviders = ScopedSupportingTokenProvide |
| | 0 | 345 | | foreach (SupportingTokenProviderSpecification spec in supportingProviders) |
| | | 346 | | { |
| | 0 | 347 | | SecurityUtils.AbortTokenProviderIfRequired(spec.TokenProvider); |
| | | 348 | | } |
| | | 349 | | } |
| | | 350 | | } |
| | 0 | 351 | | } |
| | | 352 | | |
| | | 353 | | //public virtual async Task OnCloseAsync(CancellationToken token) |
| | | 354 | | //{ |
| | | 355 | | // if (SecurityProtocolFactory.ActAsInitiator) |
| | | 356 | | // { |
| | | 357 | | // /* |
| | | 358 | | // TimeoutHelper timeoutHelper = new TimeoutHelper(timeout); |
| | | 359 | | // foreach (SupportingTokenProviderSpecification spec in ChannelSupportingTokenProviderSpecification) |
| | | 360 | | // { |
| | | 361 | | // await SecurityUtils.CloseTokenProviderIfRequiredAsync(spec.TokenProvider, timeoutHelper.RemainingT |
| | | 362 | | // } |
| | | 363 | | |
| | | 364 | | // foreach (string action in ScopedSupportingTokenProviderSpecification.Keys) |
| | | 365 | | // { |
| | | 366 | | // ICollection<SupportingTokenProviderSpecification> supportingProviders = ScopedSupportingTokenProvi |
| | | 367 | | // foreach (SupportingTokenProviderSpecification spec in supportingProviders) |
| | | 368 | | // { |
| | | 369 | | // await SecurityUtils.CloseTokenProviderIfRequiredAsync(spec.TokenProvider, timeoutHelper.Remain |
| | | 370 | | // } |
| | | 371 | | // }*/ |
| | | 372 | | // } |
| | | 373 | | //} |
| | | 374 | | |
| | | 375 | | private static void SetSecurityHeaderId(SendSecurityHeader securityHeader, Message message) |
| | | 376 | | { |
| | 63 | 377 | | SecurityMessageProperty messageProperty = message.Properties.Security; |
| | 63 | 378 | | if (messageProperty != null) |
| | | 379 | | { |
| | 0 | 380 | | securityHeader.IdPrefix = messageProperty.SenderIdPrefix; |
| | | 381 | | } |
| | 63 | 382 | | } |
| | | 383 | | |
| | | 384 | | private void AddSupportingTokenSpecification(SecurityMessageProperty security, IList<SecurityToken> tokens, Secu |
| | | 385 | | { |
| | 252 | 386 | | if (tokens == null || tokens.Count == 0) |
| | | 387 | | { |
| | 189 | 388 | | return; |
| | | 389 | | } |
| | | 390 | | |
| | 252 | 391 | | for (int i = 0; i < tokens.Count; ++i) |
| | | 392 | | { |
| | 63 | 393 | | security.IncomingSupportingTokens.Add(new SupportingTokenSpecification(tokens[i], tokenPoliciesMapping[t |
| | | 394 | | } |
| | 63 | 395 | | } |
| | | 396 | | |
| | | 397 | | protected void AddSupportingTokenSpecification(SecurityMessageProperty security, IList<SecurityToken> basicToken |
| | | 398 | | { |
| | 63 | 399 | | AddSupportingTokenSpecification(security, basicTokens, SecurityTokenAttachmentMode.SignedEncrypted, tokenPol |
| | 63 | 400 | | AddSupportingTokenSpecification(security, endorsingTokens, SecurityTokenAttachmentMode.Endorsing, tokenPolic |
| | 63 | 401 | | AddSupportingTokenSpecification(security, signedEndorsingTokens, SecurityTokenAttachmentMode.SignedEndorsing |
| | 63 | 402 | | AddSupportingTokenSpecification(security, signedTokens, SecurityTokenAttachmentMode.Signed, tokenPoliciesMap |
| | 63 | 403 | | } |
| | | 404 | | |
| | | 405 | | protected SendSecurityHeader CreateSendSecurityHeader(Message message, string actor, SecurityProtocolFactory fac |
| | | 406 | | { |
| | 0 | 407 | | return CreateSendSecurityHeader(message, actor, factory, true); |
| | | 408 | | } |
| | | 409 | | |
| | | 410 | | protected SendSecurityHeader CreateSendSecurityHeaderForTransportProtocol(Message message, string actor, Securit |
| | | 411 | | { |
| | 63 | 412 | | return CreateSendSecurityHeader(message, actor, factory, false); |
| | | 413 | | } |
| | | 414 | | |
| | | 415 | | private SendSecurityHeader CreateSendSecurityHeader(Message message, string actor, SecurityProtocolFactory facto |
| | | 416 | | { |
| | 63 | 417 | | MessageDirection transferDirection = factory.ActAsInitiator ? MessageDirection.Input : MessageDirection.Outp |
| | 63 | 418 | | SendSecurityHeader sendSecurityHeader = factory.StandardsManager.CreateSendSecurityHeader( |
| | 63 | 419 | | message, |
| | 63 | 420 | | actor, true, false, |
| | 63 | 421 | | factory.OutgoingAlgorithmSuite, transferDirection); |
| | 63 | 422 | | sendSecurityHeader.Layout = factory.SecurityHeaderLayout; |
| | 63 | 423 | | sendSecurityHeader.RequireMessageProtection = requireMessageProtection; |
| | 63 | 424 | | SetSecurityHeaderId(sendSecurityHeader, message); |
| | 63 | 425 | | if (factory.AddTimestamp) |
| | | 426 | | { |
| | 63 | 427 | | sendSecurityHeader.AddTimestamp(factory.TimestampValidityDuration); |
| | | 428 | | } |
| | | 429 | | |
| | 63 | 430 | | sendSecurityHeader.StreamBufferManager = factory.StreamBufferManager; |
| | 63 | 431 | | return sendSecurityHeader; |
| | | 432 | | } |
| | | 433 | | |
| | | 434 | | internal void AddMessageSupportingTokens(Message message, ref IList<SupportingTokenSpecification> supportingToke |
| | | 435 | | { |
| | 0 | 436 | | SecurityMessageProperty supportingTokensProperty = message.Properties.Security; |
| | 0 | 437 | | if (supportingTokensProperty != null && supportingTokensProperty.HasOutgoingSupportingTokens) |
| | | 438 | | { |
| | 0 | 439 | | if (supportingTokens == null) |
| | | 440 | | { |
| | 0 | 441 | | supportingTokens = new Collection<SupportingTokenSpecification>(); |
| | | 442 | | } |
| | | 443 | | |
| | 0 | 444 | | for (int i = 0; i < supportingTokensProperty.OutgoingSupportingTokens.Count; ++i) |
| | | 445 | | { |
| | 0 | 446 | | SupportingTokenSpecification spec = supportingTokensProperty.OutgoingSupportingTokens[i]; |
| | 0 | 447 | | if (spec.SecurityTokenParameters == null) |
| | | 448 | | { |
| | 0 | 449 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Sender |
| | | 450 | | } |
| | 0 | 451 | | supportingTokens.Add(spec); |
| | | 452 | | } |
| | | 453 | | } |
| | 0 | 454 | | } |
| | | 455 | | |
| | | 456 | | internal async Task<IList<SupportingTokenSpecification>> TryGetSupportingTokensAsync(SecurityProtocolFactory fac |
| | | 457 | | { |
| | 0 | 458 | | IList<SupportingTokenSpecification> supportingTokens = null; |
| | 0 | 459 | | if (!factory.ActAsInitiator) |
| | | 460 | | { |
| | 0 | 461 | | return null; |
| | | 462 | | } |
| | | 463 | | |
| | 0 | 464 | | if (message == null) |
| | | 465 | | { |
| | 0 | 466 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(message)); |
| | | 467 | | } |
| | | 468 | | |
| | 0 | 469 | | TimeoutHelper timeoutHelper = new TimeoutHelper(timeout); |
| | 0 | 470 | | IList<SupportingTokenProviderSpecification> supportingTokenProviders = GetSupportingTokenProviders(message.H |
| | 0 | 471 | | if (supportingTokenProviders != null && supportingTokenProviders.Count > 0) |
| | | 472 | | { |
| | 0 | 473 | | supportingTokens = new Collection<SupportingTokenSpecification>(); |
| | 0 | 474 | | for (int i = 0; i < supportingTokenProviders.Count; ++i) |
| | | 475 | | { |
| | 0 | 476 | | SupportingTokenProviderSpecification spec = supportingTokenProviders[i]; |
| | | 477 | | SecurityToken supportingToken; |
| | 0 | 478 | | supportingToken = await spec.TokenProvider.GetTokenAsync(timeoutHelper.GetCancellationToken()); |
| | | 479 | | |
| | 0 | 480 | | supportingTokens.Add(new SupportingTokenSpecification(supportingToken, EmptyReadOnlyCollection<IAuth |
| | 0 | 481 | | } |
| | | 482 | | } |
| | | 483 | | |
| | | 484 | | // add any runtime supporting tokens |
| | 0 | 485 | | AddMessageSupportingTokens(message, ref supportingTokens); |
| | 0 | 486 | | return supportingTokens; |
| | 0 | 487 | | } |
| | | 488 | | |
| | | 489 | | protected ReadOnlyCollection<SecurityTokenResolver> MergeOutOfBandResolvers(IList<SupportingTokenAuthenticatorSp |
| | | 490 | | { |
| | 94 | 491 | | Collection<SecurityTokenResolver> outOfBandResolvers = null; |
| | 94 | 492 | | if (supportingAuthenticators != null && supportingAuthenticators.Count > 0) |
| | | 493 | | { |
| | 296 | 494 | | for (int i = 0; i < supportingAuthenticators.Count; ++i) |
| | | 495 | | { |
| | 74 | 496 | | if (supportingAuthenticators[i].TokenResolver != null) |
| | | 497 | | { |
| | 53 | 498 | | outOfBandResolvers = outOfBandResolvers ?? new Collection<SecurityTokenResolver>(); |
| | 53 | 499 | | outOfBandResolvers.Add(supportingAuthenticators[i].TokenResolver); |
| | | 500 | | } |
| | | 501 | | } |
| | | 502 | | } |
| | | 503 | | |
| | 94 | 504 | | if (outOfBandResolvers != null) |
| | | 505 | | { |
| | 53 | 506 | | if (primaryResolvers != null) |
| | | 507 | | { |
| | 106 | 508 | | for (int i = 0; i < primaryResolvers.Count; ++i) |
| | | 509 | | { |
| | 0 | 510 | | outOfBandResolvers.Insert(0, primaryResolvers[i]); |
| | | 511 | | } |
| | | 512 | | } |
| | 53 | 513 | | return new ReadOnlyCollection<SecurityTokenResolver>(outOfBandResolvers); |
| | | 514 | | } |
| | | 515 | | else |
| | | 516 | | { |
| | 41 | 517 | | return primaryResolvers ?? EmptyReadOnlyCollection<SecurityTokenResolver>.Instance; |
| | | 518 | | } |
| | | 519 | | } |
| | | 520 | | |
| | | 521 | | protected void AddSupportingTokens(SendSecurityHeader securityHeader, IList<SupportingTokenSpecification> suppor |
| | | 522 | | { |
| | 0 | 523 | | if (supportingTokens != null) |
| | | 524 | | { |
| | 0 | 525 | | for (int i = 0; i < supportingTokens.Count; ++i) |
| | | 526 | | { |
| | 0 | 527 | | SecurityToken token = supportingTokens[i].SecurityToken; |
| | 0 | 528 | | SecurityTokenParameters tokenParameters = supportingTokens[i].SecurityTokenParameters; |
| | 0 | 529 | | switch (supportingTokens[i].SecurityTokenAttachmentMode) |
| | | 530 | | { |
| | | 531 | | case SecurityTokenAttachmentMode.Signed: |
| | 0 | 532 | | securityHeader.AddSignedSupportingToken(token, tokenParameters); |
| | 0 | 533 | | break; |
| | | 534 | | case SecurityTokenAttachmentMode.Endorsing: |
| | 0 | 535 | | securityHeader.AddEndorsingSupportingToken(token, tokenParameters); |
| | 0 | 536 | | break; |
| | | 537 | | case SecurityTokenAttachmentMode.SignedEncrypted: |
| | 0 | 538 | | securityHeader.AddBasicSupportingToken(token, tokenParameters); |
| | 0 | 539 | | break; |
| | | 540 | | case SecurityTokenAttachmentMode.SignedEndorsing: |
| | 0 | 541 | | securityHeader.AddSignedEndorsingSupportingToken(token, tokenParameters); |
| | 0 | 542 | | break; |
| | | 543 | | default: |
| | | 544 | | Fx.Assert("Unknown token attachment mode " + supportingTokens[i].SecurityTokenAttachmentMode |
| | 0 | 545 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException(SR.Forma |
| | | 546 | | } |
| | | 547 | | } |
| | | 548 | | } |
| | 0 | 549 | | } |
| | | 550 | | |
| | | 551 | | internal static async Task<SecurityToken> GetTokenAsync(SecurityTokenProvider provider, EndpointAddress target, |
| | | 552 | | { |
| | 0 | 553 | | if (provider == null) |
| | | 554 | | { |
| | 0 | 555 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format(SR.Toke |
| | | 556 | | } |
| | | 557 | | |
| | | 558 | | SecurityToken token; |
| | | 559 | | try |
| | | 560 | | { |
| | 0 | 561 | | token = await provider.GetTokenAsync(new TimeoutHelper(timeout).GetCancellationToken()); |
| | 0 | 562 | | } |
| | 0 | 563 | | catch (SecurityTokenException exception) |
| | | 564 | | { |
| | 0 | 565 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(SR.Format(SR.Toke |
| | | 566 | | } |
| | 0 | 567 | | catch (SecurityNegotiationException sne) |
| | | 568 | | { |
| | 0 | 569 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityNegotiationException(SR.Format(SR. |
| | | 570 | | } |
| | | 571 | | |
| | 0 | 572 | | return token; |
| | 0 | 573 | | } |
| | | 574 | | |
| | | 575 | | public abstract Message SecureOutgoingMessage(Message message, CancellationToken token); |
| | | 576 | | |
| | | 577 | | // subclasses that offer correlation should override this version |
| | | 578 | | public virtual (SecurityProtocolCorrelationState, Message) SecureOutgoingMessage(Message message, SecurityProtoc |
| | | 579 | | { |
| | 41 | 580 | | return (null, SecureOutgoingMessage(message, token)); |
| | | 581 | | } |
| | | 582 | | |
| | | 583 | | protected virtual void OnOutgoingMessageSecured(Message securedMessage) |
| | | 584 | | { |
| | 63 | 585 | | } |
| | | 586 | | |
| | | 587 | | protected virtual void OnSecureOutgoingMessageFailure(Message message) |
| | | 588 | | { |
| | 0 | 589 | | } |
| | | 590 | | |
| | | 591 | | public abstract ValueTask<Message> VerifyIncomingMessageAsync(Message message, TimeSpan timeout); |
| | | 592 | | |
| | | 593 | | // subclasses that offer correlation should override this version |
| | | 594 | | public virtual async ValueTask<(Message, SecurityProtocolCorrelationState)> VerifyIncomingMessageAsync(Message m |
| | | 595 | | { |
| | 91 | 596 | | var verifiedMessage = await VerifyIncomingMessageAsync(message, timeout); |
| | 61 | 597 | | return (verifiedMessage, null); |
| | 61 | 598 | | } |
| | | 599 | | |
| | | 600 | | protected virtual void OnIncomingMessageVerified(Message verifiedMessage) |
| | | 601 | | { |
| | 63 | 602 | | } |
| | | 603 | | |
| | | 604 | | protected virtual void OnVerifyIncomingMessageFailure(Message message, Exception exception) |
| | | 605 | | { |
| | 31 | 606 | | } |
| | | 607 | | protected IList<SupportingTokenAuthenticatorSpecification> GetSupportingTokenAuthenticatorsAndSetExpectationFlag |
| | | 608 | | ReceiveSecurityHeader securityHeader) |
| | | 609 | | { |
| | 20 | 610 | | if (message == null) |
| | | 611 | | { |
| | 0 | 612 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(message)); |
| | | 613 | | } |
| | 20 | 614 | | IList<SupportingTokenAuthenticatorSpecification> authenticators = factory.GetSupportingTokenAuthenticators(m |
| | 20 | 615 | | out bool expectSignedTokens, out bool expectBasicTokens, out bool expectEndorsingTokens); |
| | 20 | 616 | | securityHeader.ExpectBasicTokens = expectBasicTokens; |
| | 20 | 617 | | securityHeader.ExpectEndorsingTokens = expectEndorsingTokens; |
| | 20 | 618 | | securityHeader.ExpectSignedTokens = expectSignedTokens; |
| | 20 | 619 | | return authenticators; |
| | | 620 | | } |
| | | 621 | | |
| | | 622 | | public Task CloseAsync(bool aborted, TimeSpan timeout) |
| | | 623 | | { |
| | 10 | 624 | | if (aborted) |
| | | 625 | | { |
| | 0 | 626 | | CommunicationObject.Abort(); |
| | | 627 | | } |
| | | 628 | | else |
| | | 629 | | { |
| | 10 | 630 | | CommunicationObject.CloseAsync(); |
| | | 631 | | } |
| | 10 | 632 | | return Task.CompletedTask; |
| | | 633 | | } |
| | | 634 | | public Task OnCloseAsync(TimeSpan timeout) |
| | | 635 | | { |
| | 10 | 636 | | OnClosed(); |
| | 10 | 637 | | return Task.CompletedTask; |
| | | 638 | | } |
| | | 639 | | } |
| | | 640 | | } |