| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.ComponentModel; |
| | | 6 | | using System.Net.Security; |
| | | 7 | | using System.Runtime.InteropServices; |
| | | 8 | | using System.Security.Authentication; |
| | | 9 | | using System.Security.Authentication.ExtendedProtection; |
| | | 10 | | using CoreWCF.Channels; |
| | | 11 | | using CoreWCF.Security; |
| | | 12 | | |
| | | 13 | | namespace CoreWCF |
| | | 14 | | { |
| | | 15 | | public sealed partial class UnixDomainSocketTransportSecurity |
| | | 16 | | { |
| | | 17 | | internal const UnixDomainSocketClientCredentialType DefaultClientCredentialType = UnixDomainSocketClientCredenti |
| | | 18 | | internal const ProtectionLevel DefaultProtectionLevel = ProtectionLevel.EncryptAndSign; |
| | | 19 | | |
| | | 20 | | private UnixDomainSocketClientCredentialType _clientCredentialType; |
| | | 21 | | private ProtectionLevel _protectionLevel; |
| | | 22 | | private ExtendedProtectionPolicy _extendedProtectionPolicy; |
| | | 23 | | private SslProtocols _sslProtocols; |
| | | 24 | | |
| | 12 | 25 | | public UnixDomainSocketTransportSecurity() |
| | | 26 | | { |
| | 12 | 27 | | _clientCredentialType = DefaultClientCredentialType; |
| | 12 | 28 | | _protectionLevel = DefaultProtectionLevel; |
| | 12 | 29 | | _extendedProtectionPolicy = ChannelBindingUtility.DefaultPolicy; |
| | 12 | 30 | | _sslProtocols = TransportDefaults.SslProtocols; |
| | 12 | 31 | | } |
| | | 32 | | |
| | | 33 | | [DefaultValue(DefaultClientCredentialType)] |
| | | 34 | | public UnixDomainSocketClientCredentialType ClientCredentialType |
| | | 35 | | { |
| | 35 | 36 | | get { return _clientCredentialType; } |
| | | 37 | | set |
| | | 38 | | { |
| | 5 | 39 | | if (!UnixDomainSocketClientCredentialTypeHelper.IsDefined(value)) |
| | | 40 | | { |
| | 0 | 41 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof(val |
| | | 42 | | } |
| | 5 | 43 | | _clientCredentialType = value; |
| | 5 | 44 | | } |
| | | 45 | | } |
| | | 46 | | |
| | | 47 | | [DefaultValue(DefaultProtectionLevel)] |
| | | 48 | | public ProtectionLevel ProtectionLevel |
| | | 49 | | { |
| | 0 | 50 | | get { return _protectionLevel; } |
| | | 51 | | set |
| | | 52 | | { |
| | 0 | 53 | | if (!Security.ProtectionLevelHelper.IsDefined(value)) |
| | | 54 | | { |
| | 0 | 55 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException(nameof(val |
| | | 56 | | } |
| | | 57 | | |
| | 0 | 58 | | _protectionLevel = value; |
| | 0 | 59 | | } |
| | | 60 | | } |
| | | 61 | | |
| | | 62 | | public ExtendedProtectionPolicy ExtendedProtectionPolicy |
| | | 63 | | { |
| | | 64 | | get |
| | | 65 | | { |
| | 0 | 66 | | return _extendedProtectionPolicy; |
| | | 67 | | } |
| | | 68 | | set |
| | | 69 | | { |
| | 0 | 70 | | if (value == null) |
| | | 71 | | { |
| | 0 | 72 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull(nameof(value)); |
| | | 73 | | } |
| | | 74 | | |
| | 0 | 75 | | if (value.PolicyEnforcement == PolicyEnforcement.Always && |
| | 0 | 76 | | !ExtendedProtectionPolicy.OSSupportsExtendedProtection) |
| | | 77 | | { |
| | 0 | 78 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError( |
| | 0 | 79 | | new PlatformNotSupportedException(SR.ExtendedProtectionNotSupported)); |
| | | 80 | | } |
| | 0 | 81 | | _extendedProtectionPolicy = value; |
| | 0 | 82 | | } |
| | | 83 | | } |
| | | 84 | | |
| | | 85 | | [DefaultValue(TransportDefaults.SslProtocols)] |
| | | 86 | | public SslProtocols SslProtocols |
| | | 87 | | { |
| | 0 | 88 | | get { return _sslProtocols; } |
| | | 89 | | set |
| | | 90 | | { |
| | 0 | 91 | | SslProtocolsHelper.Validate(value); |
| | 0 | 92 | | _sslProtocols = value; |
| | 0 | 93 | | } |
| | | 94 | | } |
| | | 95 | | |
| | | 96 | | private SslStreamSecurityBindingElement CreateSslBindingElement(bool requireClientCertificate) |
| | | 97 | | { |
| | 16 | 98 | | if (_protectionLevel != ProtectionLevel.EncryptAndSign) |
| | | 99 | | { |
| | 0 | 100 | | throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format( |
| | 0 | 101 | | SR.UnsupportedSslProtectionLevel, _protectionLevel))); |
| | | 102 | | } |
| | | 103 | | |
| | 16 | 104 | | SslStreamSecurityBindingElement result = new SslStreamSecurityBindingElement |
| | 16 | 105 | | { |
| | 16 | 106 | | RequireClientCertificate = requireClientCertificate, |
| | 16 | 107 | | SslProtocols = _sslProtocols |
| | 16 | 108 | | }; |
| | 16 | 109 | | return result; |
| | | 110 | | } |
| | | 111 | | |
| | | 112 | | internal BindingElement CreateTransportProtectionOnly() |
| | | 113 | | { |
| | 0 | 114 | | return CreateSslBindingElement(false); |
| | | 115 | | } |
| | | 116 | | |
| | | 117 | | internal BindingElement CreatePosixIdentityOnlyBinding() |
| | | 118 | | { |
| | 16 | 119 | | return new UnixPosixIdentityBindingElement(); |
| | | 120 | | } |
| | | 121 | | |
| | | 122 | | internal BindingElement CreateTransportProtectionAndAuthentication() |
| | | 123 | | { |
| | 32 | 124 | | if (_clientCredentialType == UnixDomainSocketClientCredentialType.Default) |
| | | 125 | | { |
| | 0 | 126 | | if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
| | | 127 | | { |
| | 0 | 128 | | return new WindowsStreamSecurityBindingElement |
| | 0 | 129 | | { |
| | 0 | 130 | | ProtectionLevel = _protectionLevel |
| | 0 | 131 | | }; |
| | | 132 | | } |
| | | 133 | | else |
| | | 134 | | { |
| | 0 | 135 | | return CreatePosixIdentityOnlyBinding(); |
| | | 136 | | } |
| | | 137 | | } |
| | 32 | 138 | | else if (_clientCredentialType == UnixDomainSocketClientCredentialType.Certificate) |
| | | 139 | | { |
| | 16 | 140 | | return CreateSslBindingElement(true); |
| | | 141 | | } |
| | 16 | 142 | | else if (_clientCredentialType == UnixDomainSocketClientCredentialType.Windows) |
| | | 143 | | { |
| | 0 | 144 | | return new WindowsStreamSecurityBindingElement |
| | 0 | 145 | | { |
| | 0 | 146 | | ProtectionLevel = _protectionLevel |
| | 0 | 147 | | }; |
| | | 148 | | } |
| | 16 | 149 | | else if (_clientCredentialType == UnixDomainSocketClientCredentialType.PosixIdentity) |
| | | 150 | | { |
| | 16 | 151 | | if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
| | | 152 | | { |
| | 0 | 153 | | throw new NotSupportedException(); |
| | | 154 | | } |
| | 16 | 155 | | return CreatePosixIdentityOnlyBinding(); |
| | | 156 | | } |
| | 0 | 157 | | else if (_clientCredentialType == UnixDomainSocketClientCredentialType.None) |
| | | 158 | | { |
| | 0 | 159 | | return CreateTransportProtectionOnly(); |
| | | 160 | | } |
| | | 161 | | else |
| | | 162 | | { |
| | 0 | 163 | | return null; |
| | | 164 | | } |
| | | 165 | | } |
| | | 166 | | |
| | | 167 | | } |
| | | 168 | | } |