| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Net.Security; |
| | | 6 | | using CoreWCF.Configuration; |
| | | 7 | | using CoreWCF.Description; |
| | | 8 | | using CoreWCF.Dispatcher; |
| | | 9 | | using CoreWCF.Security; |
| | | 10 | | using CoreWCF.Security.Tokens; |
| | | 11 | | |
| | | 12 | | namespace CoreWCF.Channels |
| | | 13 | | { |
| | | 14 | | public sealed class TransportSecurityBindingElement : SecurityBindingElement //, IPolicyExportExtension |
| | | 15 | | { |
| | 372 | 16 | | public TransportSecurityBindingElement() : base() |
| | | 17 | | { |
| | 372 | 18 | | } |
| | | 19 | | |
| | 1392 | 20 | | private TransportSecurityBindingElement(TransportSecurityBindingElement elementToBeCloned) : base(elementToBeClo |
| | | 21 | | { |
| | | 22 | | // empty |
| | 1392 | 23 | | } |
| | | 24 | | |
| | | 25 | | internal override ISecurityCapabilities GetIndividualISecurityCapabilities() |
| | | 26 | | { |
| | 185 | 27 | | GetSupportingTokensCapabilities(out bool supportsClientAuthentication, out bool supportsClientWindowsIdentit |
| | 185 | 28 | | return new SecurityCapabilities(supportsClientAuthentication, false, supportsClientWindowsIdentity, |
| | 185 | 29 | | ProtectionLevel.None, ProtectionLevel.None); |
| | | 30 | | } |
| | | 31 | | |
| | | 32 | | internal override bool SessionMode |
| | | 33 | | { |
| | | 34 | | get |
| | | 35 | | { |
| | 0 | 36 | | SecureConversationSecurityTokenParameters scParameters = null; |
| | 0 | 37 | | if (EndpointSupportingTokenParameters.Endorsing.Count > 0) |
| | | 38 | | { |
| | 0 | 39 | | scParameters = EndpointSupportingTokenParameters.Endorsing[0] as SecureConversationSecurityTokenPara |
| | | 40 | | } |
| | | 41 | | |
| | 0 | 42 | | if (scParameters != null) |
| | | 43 | | { |
| | 0 | 44 | | return scParameters.RequireCancellation; |
| | | 45 | | } |
| | | 46 | | else |
| | | 47 | | { |
| | 0 | 48 | | return false; |
| | | 49 | | } |
| | | 50 | | } |
| | | 51 | | } |
| | | 52 | | |
| | | 53 | | internal override bool SupportsDuplex |
| | | 54 | | { |
| | 66 | 55 | | get { return true; } |
| | | 56 | | } |
| | | 57 | | |
| | | 58 | | internal override bool SupportsRequestReply |
| | | 59 | | { |
| | 60 | 60 | | get { return true; } |
| | | 61 | | } |
| | | 62 | | |
| | | 63 | | |
| | | 64 | | internal override SecurityProtocolFactory CreateSecurityProtocolFactory<TChannel>(BindingContext context, Securi |
| | | 65 | | { |
| | 33 | 66 | | if (context == null) |
| | | 67 | | { |
| | 0 | 68 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(context)); |
| | | 69 | | } |
| | | 70 | | |
| | 33 | 71 | | if (credentialsManager == null) |
| | | 72 | | { |
| | 0 | 73 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(credentialsManager)); |
| | | 74 | | } |
| | | 75 | | |
| | 33 | 76 | | TransportSecurityProtocolFactory protocolFactory = new TransportSecurityProtocolFactory(); |
| | | 77 | | // if (isForService) |
| | | 78 | | // base.ApplyAuditBehaviorSettings(context, protocolFactory); |
| | 33 | 79 | | ConfigureProtocolFactory(protocolFactory, credentialsManager, isForService, issuerBindingContext, context.Bi |
| | 33 | 80 | | protocolFactory.DetectReplays = false; |
| | | 81 | | |
| | 33 | 82 | | return protocolFactory; |
| | | 83 | | } |
| | | 84 | | |
| | | 85 | | protected override IServiceDispatcher BuildServiceDispatcherCore<TChannel>(BindingContext context, IServiceDispa |
| | | 86 | | { |
| | 33 | 87 | | SecurityServiceDispatcher securityServiceDispatcher = new SecurityServiceDispatcher(context, serviceDispatch |
| | 33 | 88 | | SecurityCredentialsManager credentialsManager = serviceDispatcher.Host.Description.Behaviors.Find<SecurityCr |
| | 33 | 89 | | if (credentialsManager == null) |
| | | 90 | | { |
| | 1 | 91 | | credentialsManager = ServiceCredentials.CreateDefaultCredentials(); |
| | | 92 | | } |
| | | 93 | | |
| | | 94 | | SecureConversationSecurityTokenParameters scParameters; |
| | 33 | 95 | | if (EndpointSupportingTokenParameters.Endorsing.Count > 0) |
| | | 96 | | { |
| | 24 | 97 | | scParameters = EndpointSupportingTokenParameters.Endorsing[0] as SecureConversationSecurityTokenParamete |
| | | 98 | | } |
| | | 99 | | else |
| | | 100 | | { |
| | 9 | 101 | | scParameters = null; |
| | | 102 | | } |
| | | 103 | | |
| | 33 | 104 | | bool requireDemuxer = RequiresChannelDemuxer(); |
| | 33 | 105 | | ChannelBuilder channelBuilder = new ChannelBuilder(context, requireDemuxer); |
| | | 106 | | |
| | 33 | 107 | | if (requireDemuxer) |
| | | 108 | | { |
| | 22 | 109 | | ApplyPropertiesOnDemuxer(channelBuilder, context); |
| | | 110 | | } |
| | | 111 | | |
| | 33 | 112 | | BindingContext issuerBindingContext = context.Clone(); |
| | 33 | 113 | | issuerBindingContext.BindingParameters.Add(credentialsManager); |
| | 33 | 114 | | if (scParameters != null) |
| | | 115 | | { |
| | 22 | 116 | | if (scParameters.BootstrapSecurityBindingElement == null) |
| | | 117 | | { |
| | 0 | 118 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR |
| | | 119 | | } |
| | | 120 | | |
| | 22 | 121 | | AddDemuxerForSecureConversation(channelBuilder, issuerBindingContext); |
| | | 122 | | |
| | 22 | 123 | | if (scParameters.RequireCancellation) |
| | | 124 | | { |
| | 22 | 125 | | SessionSymmetricTransportSecurityProtocolFactory sessionFactory = new SessionSymmetricTransportSecur |
| | 22 | 126 | | { |
| | 22 | 127 | | // base.ApplyAuditBehaviorSettings(context, sessionFactory); |
| | 22 | 128 | | SecurityTokenParameters = scParameters.Clone() |
| | 22 | 129 | | }; |
| | 22 | 130 | | ((SecureConversationSecurityTokenParameters)sessionFactory.SecurityTokenParameters).IssuerBindingCon |
| | 22 | 131 | | EndpointSupportingTokenParameters.Endorsing.RemoveAt(0); |
| | | 132 | | try |
| | | 133 | | { |
| | 22 | 134 | | ConfigureProtocolFactory(sessionFactory, credentialsManager, true, issuerBindingContext, context |
| | 22 | 135 | | } |
| | | 136 | | finally |
| | | 137 | | { |
| | 22 | 138 | | EndpointSupportingTokenParameters.Endorsing.Insert(0, scParameters); |
| | 22 | 139 | | } |
| | | 140 | | |
| | 22 | 141 | | securityServiceDispatcher.SessionMode = true; |
| | 22 | 142 | | securityServiceDispatcher.SessionServerSettings.InactivityTimeout = LocalServiceSettings.InactivityT |
| | 22 | 143 | | securityServiceDispatcher.SessionServerSettings.KeyRolloverInterval = LocalServiceSettings.SessionKe |
| | 22 | 144 | | securityServiceDispatcher.SessionServerSettings.MaximumPendingSessions = LocalServiceSettings.MaxPen |
| | 22 | 145 | | securityServiceDispatcher.SessionServerSettings.MaximumKeyRenewalInterval = LocalServiceSettings.Ses |
| | 22 | 146 | | securityServiceDispatcher.SessionServerSettings.TolerateTransportFailures = LocalServiceSettings.Rec |
| | 22 | 147 | | securityServiceDispatcher.SessionServerSettings.CanRenewSession = scParameters.CanRenewSession; |
| | 22 | 148 | | securityServiceDispatcher.SessionServerSettings.IssuedSecurityTokenParameters = scParameters.Clone() |
| | 22 | 149 | | ((SecureConversationSecurityTokenParameters)securityServiceDispatcher.SessionServerSettings.IssuedSe |
| | 22 | 150 | | securityServiceDispatcher.SessionServerSettings.SecurityStandardsManager = sessionFactory.StandardsM |
| | 22 | 151 | | securityServiceDispatcher.SessionServerSettings.SessionProtocolFactory = sessionFactory; |
| | 22 | 152 | | securityServiceDispatcher.SecurityProtocolFactory = sessionFactory; |
| | | 153 | | |
| | | 154 | | // pass in the error handler for handling unknown security sessions - dont do this if the underlying |
| | | 155 | | // back faults in response to badly secured requests over duplex can result in DoS. |
| | 22 | 156 | | if (context.BindingParameters != null && context.BindingParameters.Find<IChannelDemuxFailureHandler> |
| | 22 | 157 | | && !IsUnderlyingDispatcherDuplex<TChannel>(context)) |
| | | 158 | | { |
| | 22 | 159 | | context.BindingParameters.Add(new SecuritySessionServerSettings.SecuritySessionDemuxFailureHandl |
| | | 160 | | } |
| | | 161 | | } |
| | | 162 | | else |
| | | 163 | | { |
| | | 164 | | //TODO later |
| | 0 | 165 | | TransportSecurityProtocolFactory protocolFactory = new TransportSecurityProtocolFactory(); |
| | | 166 | | // base.ApplyAuditBehaviorSettings(context, protocolFactory); |
| | 0 | 167 | | EndpointSupportingTokenParameters.Endorsing.RemoveAt(0); |
| | | 168 | | try |
| | | 169 | | { |
| | 0 | 170 | | ConfigureProtocolFactory(protocolFactory, credentialsManager, true, issuerBindingContext, contex |
| | 0 | 171 | | SecureConversationSecurityTokenParameters acceleratedTokenParameters = (SecureConversationSecuri |
| | 0 | 172 | | acceleratedTokenParameters.IssuerBindingContext = issuerBindingContext; |
| | 0 | 173 | | protocolFactory.SecurityBindingElement.EndpointSupportingTokenParameters.Endorsing.Insert(0, acc |
| | 0 | 174 | | } |
| | | 175 | | finally |
| | | 176 | | { |
| | 0 | 177 | | EndpointSupportingTokenParameters.Endorsing.Insert(0, scParameters); |
| | 0 | 178 | | } |
| | | 179 | | |
| | 0 | 180 | | securityServiceDispatcher.SecurityProtocolFactory = protocolFactory; |
| | | 181 | | } |
| | | 182 | | } |
| | | 183 | | else |
| | | 184 | | { |
| | 11 | 185 | | SecurityProtocolFactory protocolFactory = CreateSecurityProtocolFactory<TChannel>(context, credentialsMa |
| | 11 | 186 | | securityServiceDispatcher.SecurityProtocolFactory = protocolFactory; |
| | | 187 | | } |
| | 33 | 188 | | securityServiceDispatcher.InitializeSecurityDispatcher(channelBuilder, typeof(TChannel)); |
| | | 189 | | //return channelListener; |
| | 33 | 190 | | channelBuilder.BuildServiceDispatcher<TChannel>(context, securityServiceDispatcher); |
| | 33 | 191 | | return securityServiceDispatcher; |
| | | 192 | | } |
| | | 193 | | |
| | | 194 | | public override T GetProperty<T>(BindingContext context) |
| | | 195 | | { |
| | 441 | 196 | | if (context == null) |
| | | 197 | | { |
| | 0 | 198 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(context)); |
| | | 199 | | } |
| | | 200 | | |
| | 441 | 201 | | if (typeof(T) == typeof(ChannelProtectionRequirements)) |
| | | 202 | | { |
| | 9 | 203 | | AddressingVersion addressing = MessageVersion.Default.Addressing; |
| | 9 | 204 | | MessageEncodingBindingElement encoding = context.Binding.Elements.Find<MessageEncodingBindingElement>(); |
| | 9 | 205 | | if (encoding != null) |
| | | 206 | | { |
| | 9 | 207 | | addressing = encoding.MessageVersion.Addressing; |
| | | 208 | | } |
| | | 209 | | |
| | 9 | 210 | | ChannelProtectionRequirements myRequirements = GetProtectionRequirements(addressing, ProtectionLevel.Enc |
| | 9 | 211 | | myRequirements.Add(context.GetInnerProperty<ChannelProtectionRequirements>() ?? new ChannelProtectionReq |
| | 9 | 212 | | return (T)(object)myRequirements; |
| | | 213 | | } |
| | | 214 | | else |
| | | 215 | | { |
| | 432 | 216 | | return base.GetProperty<T>(context); |
| | | 217 | | } |
| | | 218 | | } |
| | | 219 | | |
| | | 220 | | public override BindingElement Clone() |
| | | 221 | | { |
| | 1392 | 222 | | return new TransportSecurityBindingElement(this); |
| | | 223 | | } |
| | | 224 | | } |
| | | 225 | | } |