mcs/class/referencesource/System.ServiceModel/System/ServiceModel/TcpTransportSecurity.cs

   1 //------------------------------------------------------------
   2 // Copyright (c) Microsoft Corporation.  All rights reserved.
   3 //------------------------------------------------------------
   4 namespace System.ServiceModel
   5 {
   6     using System;
   7     using System.Security.Authentication;
   8     using System.Security.Authentication.ExtendedProtection;
   9     using System.ServiceModel.Channels;
  10     using System.ServiceModel.Security;
  11     using System.Net;
  12     using System.Net.Security;
  13     using System.ComponentModel;
  14
  15     public sealed class TcpTransportSecurity
  16     {
  17         internal const TcpClientCredentialType DefaultClientCredentialType = TcpClientCredentialType.Windows;
  18         internal const ProtectionLevel DefaultProtectionLevel = ProtectionLevel.EncryptAndSign;
  19
  20         TcpClientCredentialType clientCredentialType;
  21         ProtectionLevel protectionLevel;
  22         ExtendedProtectionPolicy extendedProtectionPolicy;
  23         SslProtocols sslProtocols;
  24
  25         public TcpTransportSecurity()
  26         {
  27             this.clientCredentialType = DefaultClientCredentialType;
  28             this.protectionLevel = DefaultProtectionLevel;
  29             this.extendedProtectionPolicy = ChannelBindingUtility.DefaultPolicy;
  30             this.sslProtocols = TransportDefaults.SslProtocols;
  31         }
  32
  33         [DefaultValue(DefaultClientCredentialType)]
  34         public TcpClientCredentialType ClientCredentialType
  35         {
  36             get { return this.clientCredentialType; }
  37             set
  38             {
  39                 if (!TcpClientCredentialTypeHelper.IsDefined(value))
  40                 {
  41                     throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException("value"));
  42                 }
  43                 this.clientCredentialType = value;
  44             }
  45         }
  46
  47         [DefaultValue(DefaultProtectionLevel)]
  48         public ProtectionLevel ProtectionLevel
  49         {
  50             get { return this.protectionLevel; }
  51             set
  52             {
  53                 if (!ProtectionLevelHelper.IsDefined(value))
  54                 {
  55                     throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException("value"));
  56                 }
  57                 this.protectionLevel = value;
  58             }
  59         }
  60
  61         public ExtendedProtectionPolicy ExtendedProtectionPolicy
  62         {
  63             get
  64             {
  65                 return this.extendedProtectionPolicy;
  66             }
  67             set
  68             {
  69                 if (value == null)
  70                 {
  71                     throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("value");
  72                 }
  73
  74                 if (value.PolicyEnforcement == PolicyEnforcement.Always &&
  75                     !System.Security.Authentication.ExtendedProtection.ExtendedProtectionPolicy.OSSupportsExtendedProtection)
  76                 {
  77                     throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(
  78                         new PlatformNotSupportedException(SR.GetString(SR.ExtendedProtectionNotSupported)));
  79                 }
  80                 this.extendedProtectionPolicy = value;
  81             }
  82         }
  83
  84         [DefaultValue(TransportDefaults.OldDefaultSslProtocols)]
  85         public SslProtocols SslProtocols
  86         {
  87             get { return this.sslProtocols; }
  88             set
  89             {
  90                 SslProtocolsHelper.Validate(value);
  91                 this.sslProtocols = value;
  92             }
  93         }
  94
  95         SslStreamSecurityBindingElement CreateSslBindingElement(bool requireClientCertificate)
  96         {
  97             if (this.protectionLevel != ProtectionLevel.EncryptAndSign)
  98             {
  99                 throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.GetString(
 100                     SR.UnsupportedSslProtectionLevel, this.protectionLevel)));
 101             }
 102
 103             SslStreamSecurityBindingElement result = new SslStreamSecurityBindingElement();
 104             result.RequireClientCertificate = requireClientCertificate;
 105             result.SslProtocols = sslProtocols;
 106             return result;
 107         }
 108
 109         static bool IsSslBindingElement(BindingElement element, TcpTransportSecurity transportSecurity, out bool requireClientCertificate, out SslProtocols sslProtocols)
 110         {
 111             requireClientCertificate = false;
 112             sslProtocols = TransportDefaults.SslProtocols;
 113             SslStreamSecurityBindingElement ssl = element as SslStreamSecurityBindingElement;
 114             if (ssl == null)
 115                 return false;
 116             transportSecurity.ProtectionLevel = ProtectionLevel.EncryptAndSign;
 117             requireClientCertificate = ssl.RequireClientCertificate;
 118             sslProtocols = ssl.SslProtocols;
 119             return true;
 120         }
 121
 122         internal BindingElement CreateTransportProtectionOnly()
 123         {
 124             return this.CreateSslBindingElement(false);
 125         }
 126
 127         internal static bool SetTransportProtectionOnly(BindingElement transport, TcpTransportSecurity transportSecurity)
 128         {
 129             bool requireClientCertificate;
 130             SslProtocols sslProtocols;
 131             return IsSslBindingElement(transport, transportSecurity, out requireClientCertificate, out sslProtocols);
 132         }
 133
 134         internal BindingElement CreateTransportProtectionAndAuthentication()
 135         {
 136             if (this.clientCredentialType == TcpClientCredentialType.Certificate || this.clientCredentialType == TcpClientCredentialType.None)
 137             {
 138                 return this.CreateSslBindingElement(this.clientCredentialType == TcpClientCredentialType.Certificate);
 139             }
 140             else
 141             {
 142                 WindowsStreamSecurityBindingElement result = new WindowsStreamSecurityBindingElement();
 143                 result.ProtectionLevel = this.protectionLevel;
 144                 return result;
 145             }
 146         }
 147
 148         internal static bool SetTransportProtectionAndAuthentication(BindingElement transport, TcpTransportSecurity transportSecurity)
 149         {
 150             bool requireClientCertificate = false;
 151             SslProtocols sslProtocols = TransportDefaults.SslProtocols;
 152             if (transport is WindowsStreamSecurityBindingElement)
 153             {
 154                 transportSecurity.ClientCredentialType = TcpClientCredentialType.Windows;
 155                 transportSecurity.ProtectionLevel = ((WindowsStreamSecurityBindingElement)transport).ProtectionLevel;
 156                 return true;
 157             }
 158             else if (IsSslBindingElement(transport, transportSecurity, out requireClientCertificate, out sslProtocols))
 159             {
 160                 transportSecurity.ClientCredentialType = requireClientCertificate ? TcpClientCredentialType.Certificate : TcpClientCredentialType.None;
 161                 transportSecurity.SslProtocols = sslProtocols;
 162                 return true;
 163             }
 164             return false;
 165         }
 166
 167         internal bool InternalShouldSerialize()
 168         {
 169             return this.ClientCredentialType != TcpTransportSecurity.DefaultClientCredentialType
 170                 || this.ProtectionLevel != TcpTransportSecurity.DefaultProtectionLevel
 171                 || this.SslProtocols != TransportDefaults.SslProtocols
 172                 || ShouldSerializeExtendedProtectionPolicy();
 173         }
 174
 175         [EditorBrowsable(EditorBrowsableState.Never)]
 176         public bool ShouldSerializeExtendedProtectionPolicy()
 177         {
 178             return !ChannelBindingUtility.AreEqual(this.ExtendedProtectionPolicy, ChannelBindingUtility.DefaultPolicy);
 179         }
 180     }
 181 }