| | | 1 | | // Copyright (c) ZeroC, Inc. |
| | | 2 | | |
| | | 3 | | using Ice.Internal; |
| | | 4 | | using System.Diagnostics; |
| | | 5 | | using System.Net.Security; |
| | | 6 | | using System.Security; |
| | | 7 | | using System.Security.Cryptography; |
| | | 8 | | using System.Security.Cryptography.X509Certificates; |
| | | 9 | | using System.Text; |
| | | 10 | | |
| | | 11 | | namespace Ice.SSL; |
| | | 12 | | |
| | | 13 | | internal class SSLEngine : IDisposable |
| | | 14 | | { |
| | 1 | 15 | | internal SSLEngine(Ice.Communicator communicator) |
| | | 16 | | { |
| | 1 | 17 | | _communicator = communicator; |
| | 1 | 18 | | _logger = communicator.getLogger(); |
| | 1 | 19 | | _securityTraceLevel = _communicator.getProperties().getIcePropertyAsInt("IceSSL.Trace.Security"); |
| | 1 | 20 | | _securityTraceCategory = "Security"; |
| | 1 | 21 | | _trustManager = new TrustManager(_communicator); |
| | 1 | 22 | | } |
| | | 23 | | |
| | | 24 | | public void Dispose() |
| | | 25 | | { |
| | | 26 | | // Release the unmanaged key handles that back each X509Certificate2. The certificate |
| | | 27 | | // collection itself isn't IDisposable, so we have to walk its contents. |
| | 1 | 28 | | if (_certs is not null) |
| | | 29 | | { |
| | 1 | 30 | | foreach (X509Certificate2 cert in _certs) |
| | | 31 | | { |
| | 1 | 32 | | cert.Dispose(); |
| | | 33 | | } |
| | 1 | 34 | | _certs = null; |
| | | 35 | | } |
| | | 36 | | |
| | 1 | 37 | | if (_caCerts is not null) |
| | | 38 | | { |
| | 1 | 39 | | foreach (X509Certificate2 cert in _caCerts) |
| | | 40 | | { |
| | 1 | 41 | | cert.Dispose(); |
| | | 42 | | } |
| | 1 | 43 | | _caCerts = null; |
| | | 44 | | } |
| | 1 | 45 | | } |
| | | 46 | | |
| | | 47 | | internal void initialize() |
| | | 48 | | { |
| | 1 | 49 | | Ice.Properties properties = communicator().getProperties(); |
| | | 50 | | |
| | | 51 | | // Check for a default directory. We look in this directory for files mentioned in the configuration. |
| | 1 | 52 | | _defaultDir = properties.getIceProperty("IceSSL.DefaultDir"); |
| | | 53 | | |
| | 1 | 54 | | _verifyPeer = properties.getIcePropertyAsInt("IceSSL.VerifyPeer"); |
| | 1 | 55 | | if (_verifyPeer < 0 || _verifyPeer > 2) |
| | | 56 | | { |
| | 0 | 57 | | throw new Ice.InitializationException("SSL transport: invalid value for IceSSL.VerifyPeer"); |
| | | 58 | | } |
| | | 59 | | |
| | | 60 | | // CheckCRL determines whether the certificate revocation list is checked, and how strictly. |
| | 1 | 61 | | _checkCRL = properties.getIcePropertyAsInt("IceSSL.CheckCRL"); |
| | | 62 | | |
| | 1 | 63 | | string certStoreLocation = properties.getIceProperty("IceSSL.CertStoreLocation"); |
| | | 64 | | StoreLocation storeLocation; |
| | 1 | 65 | | if (certStoreLocation == "CurrentUser") |
| | | 66 | | { |
| | 1 | 67 | | storeLocation = StoreLocation.CurrentUser; |
| | | 68 | | } |
| | 0 | 69 | | else if (certStoreLocation == "LocalMachine") |
| | | 70 | | { |
| | 0 | 71 | | storeLocation = StoreLocation.LocalMachine; |
| | | 72 | | } |
| | | 73 | | else |
| | | 74 | | { |
| | 0 | 75 | | _logger.warning( |
| | 0 | 76 | | "Invalid IceSSL.CertStoreLocation value `" + certStoreLocation + "' adjusted to `CurrentUser'"); |
| | 0 | 77 | | storeLocation = StoreLocation.CurrentUser; |
| | | 78 | | } |
| | 1 | 79 | | _useMachineContext = certStoreLocation == "LocalMachine"; |
| | | 80 | | |
| | | 81 | | // CheckCertName determines whether we compare the name in a peer's certificate against its hostname. |
| | 1 | 82 | | _checkCertName = properties.getIcePropertyAsInt("IceSSL.CheckCertName") > 0; |
| | | 83 | | |
| | | 84 | | Debug.Assert(_certs == null); |
| | | 85 | | // If IceSSL.CertFile is defined, load a certificate from a file and add it to the collection. |
| | 1 | 86 | | _certs = []; |
| | 1 | 87 | | string certFile = properties.getIceProperty("IceSSL.CertFile"); |
| | 1 | 88 | | string passwordStr = properties.getIceProperty("IceSSL.Password"); |
| | 1 | 89 | | string findCert = properties.getIceProperty("IceSSL.FindCert"); |
| | | 90 | | |
| | 1 | 91 | | if (certFile.Length > 0) |
| | | 92 | | { |
| | 1 | 93 | | if (!checkPath(ref certFile)) |
| | | 94 | | { |
| | 0 | 95 | | throw new Ice.InitializationException($"IceSSL: certificate file not found: {certFile}"); |
| | | 96 | | } |
| | | 97 | | |
| | | 98 | | try |
| | | 99 | | { |
| | | 100 | | X509Certificate2 cert; |
| | | 101 | | X509KeyStorageFlags importFlags; |
| | 1 | 102 | | if (_useMachineContext) |
| | | 103 | | { |
| | 0 | 104 | | importFlags = X509KeyStorageFlags.MachineKeySet; |
| | | 105 | | } |
| | | 106 | | else |
| | | 107 | | { |
| | 1 | 108 | | importFlags = X509KeyStorageFlags.UserKeySet; |
| | | 109 | | } |
| | | 110 | | |
| | 1 | 111 | | if (passwordStr.Length > 0) |
| | | 112 | | { |
| | 1 | 113 | | using SecureString password = createSecureString(passwordStr); |
| | 1 | 114 | | cert = new X509Certificate2(certFile, password, importFlags); |
| | | 115 | | } |
| | | 116 | | else |
| | | 117 | | { |
| | 1 | 118 | | cert = new X509Certificate2(certFile, (string)null, importFlags); |
| | | 119 | | } |
| | 1 | 120 | | _certs.Add(cert); |
| | 1 | 121 | | } |
| | 0 | 122 | | catch (CryptographicException ex) |
| | | 123 | | { |
| | 0 | 124 | | throw new Ice.InitializationException( |
| | 0 | 125 | | $"IceSSL: error while attempting to load certificate from {certFile}", |
| | 0 | 126 | | ex); |
| | | 127 | | } |
| | | 128 | | } |
| | 1 | 129 | | else if (findCert.Length > 0) |
| | | 130 | | { |
| | 1 | 131 | | string certStore = properties.getIceProperty("IceSSL.CertStore"); |
| | 1 | 132 | | _certs.AddRange(findCertificates("IceSSL.FindCert", storeLocation, certStore, findCert)); |
| | 1 | 133 | | if (_certs.Count == 0) |
| | | 134 | | { |
| | 1 | 135 | | throw new Ice.InitializationException("IceSSL: no certificates found"); |
| | | 136 | | } |
| | | 137 | | } |
| | | 138 | | |
| | | 139 | | Debug.Assert(_caCerts == null); |
| | 1 | 140 | | string certAuthFile = properties.getIceProperty("IceSSL.CAs"); |
| | 1 | 141 | | if (certAuthFile.Length > 0 || properties.getIcePropertyAsInt("IceSSL.UsePlatformCAs") <= 0) |
| | | 142 | | { |
| | 1 | 143 | | _caCerts = []; |
| | | 144 | | } |
| | | 145 | | |
| | 1 | 146 | | if (certAuthFile.Length > 0) |
| | | 147 | | { |
| | 1 | 148 | | if (!checkPath(ref certAuthFile)) |
| | | 149 | | { |
| | 0 | 150 | | throw new Ice.InitializationException($"IceSSL: CA certificate file not found: {certAuthFile}"); |
| | | 151 | | } |
| | | 152 | | try |
| | | 153 | | { |
| | | 154 | | try |
| | | 155 | | { |
| | | 156 | | // First try to import as a PEM file, which supports importing multiple certificates from a PEM |
| | | 157 | | // encoded file |
| | 1 | 158 | | _caCerts.ImportFromPemFile(certAuthFile); |
| | 1 | 159 | | } |
| | 0 | 160 | | catch (CryptographicException) |
| | | 161 | | { |
| | | 162 | | // Expected if the file is not in PEM format. |
| | 0 | 163 | | } |
| | | 164 | | |
| | 1 | 165 | | if (_caCerts.Count == 0) |
| | | 166 | | { |
| | | 167 | | // Fallback to Import which handles DER/PFX. |
| | 1 | 168 | | _caCerts.Import(certAuthFile); |
| | | 169 | | } |
| | 1 | 170 | | } |
| | 0 | 171 | | catch (Exception ex) |
| | | 172 | | { |
| | 0 | 173 | | throw new Ice.InitializationException( |
| | 0 | 174 | | $"IceSSL: error while attempting to load CA certificate from {certAuthFile}", |
| | 0 | 175 | | ex); |
| | | 176 | | } |
| | | 177 | | } |
| | 1 | 178 | | } |
| | | 179 | | |
| | 1 | 180 | | internal Ice.Communicator communicator() => _communicator; |
| | | 181 | | |
| | 1 | 182 | | internal int securityTraceLevel() => _securityTraceLevel; |
| | | 183 | | |
| | 1 | 184 | | internal string securityTraceCategory() => _securityTraceCategory; |
| | | 185 | | |
| | 1 | 186 | | internal X509Certificate2Collection certs() => _certs; |
| | | 187 | | |
| | | 188 | | internal void traceStream(SslStream stream, string connInfo) |
| | | 189 | | { |
| | 0 | 190 | | var s = new StringBuilder(); |
| | 0 | 191 | | s.Append("SSL connection summary"); |
| | 0 | 192 | | if (connInfo.Length > 0) |
| | | 193 | | { |
| | 0 | 194 | | s.Append('\n'); |
| | 0 | 195 | | s.Append(connInfo); |
| | | 196 | | } |
| | 0 | 197 | | s.Append("\nauthenticated = " + (stream.IsAuthenticated ? "yes" : "no")); |
| | 0 | 198 | | s.Append("\nencrypted = " + (stream.IsEncrypted ? "yes" : "no")); |
| | 0 | 199 | | s.Append("\nsigned = " + (stream.IsSigned ? "yes" : "no")); |
| | 0 | 200 | | s.Append("\nmutually authenticated = " + (stream.IsMutuallyAuthenticated ? "yes" : "no")); |
| | 0 | 201 | | s.Append("\ncipher = " + stream.NegotiatedCipherSuite); |
| | 0 | 202 | | s.Append("\nprotocol = " + stream.SslProtocol); |
| | 0 | 203 | | _logger.trace(_securityTraceCategory, s.ToString()); |
| | 0 | 204 | | } |
| | | 205 | | |
| | | 206 | | internal void verifyPeer(ConnectionInfo info, string description) |
| | | 207 | | { |
| | 1 | 208 | | if (!_trustManager.verify(info, description)) |
| | | 209 | | { |
| | 1 | 210 | | string msg = (info.incoming ? "incoming" : "outgoing") + " connection rejected by trust manager\n" + |
| | 1 | 211 | | description; |
| | 1 | 212 | | if (_securityTraceLevel >= 1) |
| | | 213 | | { |
| | 0 | 214 | | _logger.trace(_securityTraceCategory, msg); |
| | | 215 | | } |
| | | 216 | | |
| | 1 | 217 | | throw new SecurityException($"IceSSL: {msg}"); |
| | | 218 | | } |
| | 1 | 219 | | } |
| | | 220 | | |
| | | 221 | | internal SslClientAuthenticationOptions createClientAuthenticationOptions( |
| | | 222 | | RemoteCertificateValidationCallback remoteCertificateValidationCallback, |
| | | 223 | | string host) |
| | | 224 | | { |
| | 1 | 225 | | var authenticationOptions = new SslClientAuthenticationOptions |
| | 1 | 226 | | { |
| | 1 | 227 | | ClientCertificates = _certs, |
| | 1 | 228 | | LocalCertificateSelectionCallback = (sender, targetHost, certs, remoteCertificate, acceptableIssuers) => |
| | 1 | 229 | | { |
| | 1 | 230 | | if (certs == null || certs.Count == 0) |
| | 1 | 231 | | { |
| | 1 | 232 | | return null; |
| | 1 | 233 | | } |
| | 1 | 234 | | else if (certs.Count == 1) |
| | 1 | 235 | | { |
| | 1 | 236 | | return certs[0]; |
| | 1 | 237 | | } |
| | 1 | 238 | | |
| | 1 | 239 | | // Use the first certificate that match the acceptable issuers. |
| | 0 | 240 | | if (acceptableIssuers != null && acceptableIssuers.Length > 0) |
| | 1 | 241 | | { |
| | 0 | 242 | | foreach (X509Certificate certificate in certs) |
| | 1 | 243 | | { |
| | 0 | 244 | | if (Array.IndexOf(acceptableIssuers, certificate.Issuer) != -1) |
| | 1 | 245 | | { |
| | 0 | 246 | | return certificate; |
| | 1 | 247 | | } |
| | 1 | 248 | | } |
| | 1 | 249 | | } |
| | 0 | 250 | | return certs[0]; |
| | 0 | 251 | | }, |
| | 1 | 252 | | RemoteCertificateValidationCallback = remoteCertificateValidationCallback, |
| | 1 | 253 | | TargetHost = host, |
| | 1 | 254 | | }; |
| | | 255 | | |
| | 1 | 256 | | authenticationOptions.CertificateChainPolicy = new X509ChainPolicy(); |
| | 1 | 257 | | if (_caCerts is null) |
| | | 258 | | { |
| | 0 | 259 | | authenticationOptions.CertificateChainPolicy.TrustMode = X509ChainTrustMode.System; |
| | | 260 | | } |
| | | 261 | | else |
| | | 262 | | { |
| | 1 | 263 | | authenticationOptions.CertificateChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust; |
| | 1 | 264 | | foreach (X509Certificate certificate in _caCerts) |
| | | 265 | | { |
| | 1 | 266 | | authenticationOptions.CertificateChainPolicy.CustomTrustStore.Add(certificate); |
| | | 267 | | } |
| | | 268 | | } |
| | | 269 | | |
| | 1 | 270 | | if (!_checkCertName) |
| | | 271 | | { |
| | 1 | 272 | | authenticationOptions.CertificateChainPolicy.VerificationFlags |= X509VerificationFlags.IgnoreInvalidName; |
| | | 273 | | } |
| | | 274 | | |
| | 1 | 275 | | if (_checkCRL == 1) |
| | | 276 | | { |
| | 0 | 277 | | authenticationOptions.CertificateChainPolicy.VerificationFlags |= |
| | 0 | 278 | | X509VerificationFlags.IgnoreCertificateAuthorityRevocationUnknown; |
| | | 279 | | } |
| | 1 | 280 | | authenticationOptions.CertificateChainPolicy.RevocationMode = |
| | 1 | 281 | | _checkCRL == 0 ? X509RevocationMode.NoCheck : X509RevocationMode.Online; |
| | 1 | 282 | | return authenticationOptions; |
| | | 283 | | } |
| | | 284 | | |
| | | 285 | | internal SslServerAuthenticationOptions createServerAuthenticationOptions( |
| | | 286 | | RemoteCertificateValidationCallback remoteCertificateValidationCallback) |
| | | 287 | | { |
| | | 288 | | // Get the certificate collection and select the first one. |
| | 1 | 289 | | X509Certificate2 cert = null; |
| | 1 | 290 | | if (_certs.Count > 0) |
| | | 291 | | { |
| | 1 | 292 | | cert = _certs[0]; |
| | | 293 | | } |
| | | 294 | | |
| | 1 | 295 | | var authenticationOptions = new SslServerAuthenticationOptions |
| | 1 | 296 | | { |
| | 1 | 297 | | ServerCertificate = cert, |
| | 1 | 298 | | ClientCertificateRequired = _verifyPeer > 0, |
| | 1 | 299 | | RemoteCertificateValidationCallback = remoteCertificateValidationCallback, |
| | 1 | 300 | | }; |
| | | 301 | | |
| | 1 | 302 | | authenticationOptions.CertificateChainPolicy = new X509ChainPolicy(); |
| | 1 | 303 | | if (_caCerts is null) |
| | | 304 | | { |
| | 0 | 305 | | authenticationOptions.CertificateChainPolicy.TrustMode = X509ChainTrustMode.System; |
| | | 306 | | } |
| | | 307 | | else |
| | | 308 | | { |
| | 1 | 309 | | authenticationOptions.CertificateChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust; |
| | 1 | 310 | | foreach (X509Certificate certificate in _caCerts) |
| | | 311 | | { |
| | 1 | 312 | | authenticationOptions.CertificateChainPolicy.CustomTrustStore.Add(certificate); |
| | | 313 | | } |
| | | 314 | | } |
| | 1 | 315 | | authenticationOptions.CertificateChainPolicy.RevocationMode = |
| | 1 | 316 | | _checkCRL == 0 ? X509RevocationMode.NoCheck : X509RevocationMode.Online; |
| | 1 | 317 | | if (_checkCRL == 1) |
| | | 318 | | { |
| | 0 | 319 | | authenticationOptions.CertificateChainPolicy.VerificationFlags |= |
| | 0 | 320 | | X509VerificationFlags.IgnoreCertificateAuthorityRevocationUnknown; |
| | | 321 | | } |
| | 1 | 322 | | return authenticationOptions; |
| | | 323 | | } |
| | | 324 | | |
| | | 325 | | private static bool isAbsolutePath(string path) |
| | | 326 | | { |
| | | 327 | | // Skip whitespace |
| | 1 | 328 | | path = path.Trim(); |
| | 1 | 329 | | if (path.Length == 0) |
| | | 330 | | { |
| | 0 | 331 | | return false; |
| | | 332 | | } |
| | | 333 | | |
| | 1 | 334 | | if (AssemblyUtil.isWindows) |
| | | 335 | | { |
| | | 336 | | // We need at least 3 non-whitespace characters to have an absolute path |
| | 0 | 337 | | if (path.Length < 3) |
| | | 338 | | { |
| | 0 | 339 | | return false; |
| | | 340 | | } |
| | | 341 | | |
| | | 342 | | // Check for X:\ path ('\' may have been converted to '/') |
| | 0 | 343 | | if ((path[0] >= 'A' && path[0] <= 'Z') || (path[0] >= 'a' && path[0] <= 'z')) |
| | | 344 | | { |
| | 0 | 345 | | return path[1] == ':' && (path[2] == '\\' || path[2] == '/'); |
| | | 346 | | } |
| | | 347 | | } |
| | | 348 | | // Check for UNC path or Unix absolute path |
| | 1 | 349 | | return (path.Length >= 2 && path[0] == '\\' && path[1] == '\\') || path[0] == '/'; |
| | | 350 | | } |
| | | 351 | | |
| | | 352 | | private static X509Certificate2Collection findCertificates( |
| | | 353 | | string prop, |
| | | 354 | | StoreLocation storeLocation, |
| | | 355 | | string name, |
| | | 356 | | string value) |
| | | 357 | | { |
| | | 358 | | // Open the X509 certificate store. |
| | | 359 | | X509Store store; |
| | | 360 | | try |
| | | 361 | | { |
| | | 362 | | try |
| | | 363 | | { |
| | 1 | 364 | | store = new X509Store(Enum.Parse<StoreName>(name, true), storeLocation); |
| | 1 | 365 | | } |
| | 0 | 366 | | catch (ArgumentException) |
| | | 367 | | { |
| | 0 | 368 | | store = new X509Store(name, storeLocation); |
| | 0 | 369 | | } |
| | 1 | 370 | | store.Open(OpenFlags.ReadOnly); |
| | 1 | 371 | | } |
| | 0 | 372 | | catch (Exception ex) |
| | | 373 | | { |
| | 0 | 374 | | throw new Ice.InitializationException($"IceSSL: failure while opening store specified by {prop}", ex); |
| | | 375 | | } |
| | | 376 | | |
| | | 377 | | // Start with all of the certificates in the collection and filter as necessary. |
| | | 378 | | // |
| | | 379 | | // - If the value is "*", return all certificates. |
| | | 380 | | // - Otherwise, search using key:value pairs. The following keys are supported: |
| | | 381 | | // |
| | | 382 | | // Issuer |
| | | 383 | | // IssuerDN |
| | | 384 | | // Serial |
| | | 385 | | // Subject |
| | | 386 | | // SubjectDN |
| | | 387 | | // SubjectKeyId |
| | | 388 | | // Thumbprint |
| | | 389 | | // |
| | | 390 | | // A value must be enclosed in single or double quotes if it contains whitespace. |
| | 1 | 391 | | X509Certificate2Collection result = [.. store.Certificates]; |
| | | 392 | | try |
| | | 393 | | { |
| | 1 | 394 | | if (value != "*") |
| | | 395 | | { |
| | 1 | 396 | | if (!value.Contains(':', StringComparison.Ordinal)) |
| | | 397 | | { |
| | 1 | 398 | | throw new Ice.InitializationException($"IceSSL: no key in `{value}'"); |
| | | 399 | | } |
| | 1 | 400 | | int start = 0; |
| | | 401 | | int pos; |
| | 1 | 402 | | while ((pos = value.IndexOf(':', start)) != -1) |
| | | 403 | | { |
| | | 404 | | // Parse the X509FindType. |
| | 1 | 405 | | string field = value[start..pos].Trim().ToUpperInvariant(); |
| | | 406 | | X509FindType findType; |
| | 1 | 407 | | if (field == "SUBJECT") |
| | | 408 | | { |
| | 1 | 409 | | findType = X509FindType.FindBySubjectName; |
| | | 410 | | } |
| | 1 | 411 | | else if (field == "SUBJECTDN") |
| | | 412 | | { |
| | 1 | 413 | | findType = X509FindType.FindBySubjectDistinguishedName; |
| | | 414 | | } |
| | 1 | 415 | | else if (field == "ISSUER") |
| | | 416 | | { |
| | 1 | 417 | | findType = X509FindType.FindByIssuerName; |
| | | 418 | | } |
| | 1 | 419 | | else if (field == "ISSUERDN") |
| | | 420 | | { |
| | 1 | 421 | | findType = X509FindType.FindByIssuerDistinguishedName; |
| | | 422 | | } |
| | 1 | 423 | | else if (field == "THUMBPRINT") |
| | | 424 | | { |
| | 1 | 425 | | findType = X509FindType.FindByThumbprint; |
| | | 426 | | } |
| | 1 | 427 | | else if (field == "SUBJECTKEYID") |
| | | 428 | | { |
| | 1 | 429 | | findType = X509FindType.FindBySubjectKeyIdentifier; |
| | | 430 | | } |
| | 1 | 431 | | else if (field == "SERIAL") |
| | | 432 | | { |
| | 1 | 433 | | findType = X509FindType.FindBySerialNumber; |
| | | 434 | | } |
| | | 435 | | else |
| | | 436 | | { |
| | 1 | 437 | | throw new Ice.InitializationException($"IceSSL: unknown key in `{value}'"); |
| | | 438 | | } |
| | | 439 | | |
| | | 440 | | // Parse the argument. |
| | 1 | 441 | | start = pos + 1; |
| | 1 | 442 | | while (start < value.Length && (value[start] == ' ' || value[start] == '\t')) |
| | | 443 | | { |
| | 0 | 444 | | ++start; |
| | | 445 | | } |
| | | 446 | | |
| | 1 | 447 | | if (start == value.Length) |
| | | 448 | | { |
| | 0 | 449 | | throw new Ice.InitializationException($"IceSSL: missing argument in `{value}'"); |
| | | 450 | | } |
| | | 451 | | |
| | | 452 | | string arg; |
| | 1 | 453 | | if (value[start] == '"' || value[start] == '\'') |
| | | 454 | | { |
| | 1 | 455 | | int end = start; |
| | 1 | 456 | | ++end; |
| | 1 | 457 | | while (end < value.Length) |
| | | 458 | | { |
| | 1 | 459 | | if (value[end] == value[start] && value[end - 1] != '\\') |
| | | 460 | | { |
| | | 461 | | break; |
| | | 462 | | } |
| | 1 | 463 | | ++end; |
| | | 464 | | } |
| | 1 | 465 | | if (end == value.Length || value[end] != value[start]) |
| | | 466 | | { |
| | 0 | 467 | | throw new Ice.InitializationException($"IceSSL: unmatched quote in `{value}'"); |
| | | 468 | | } |
| | 1 | 469 | | ++start; |
| | 1 | 470 | | arg = value[start..end]; |
| | 1 | 471 | | start = end + 1; |
| | | 472 | | } |
| | | 473 | | else |
| | | 474 | | { |
| | 1 | 475 | | char[] ws = [' ', '\t']; |
| | 1 | 476 | | int end = value.IndexOfAny(ws, start); |
| | 1 | 477 | | if (end == -1) |
| | | 478 | | { |
| | 1 | 479 | | arg = value[start..]; |
| | 1 | 480 | | start = value.Length; |
| | | 481 | | } |
| | | 482 | | else |
| | | 483 | | { |
| | 1 | 484 | | arg = value[start..end]; |
| | 1 | 485 | | start = end + 1; |
| | | 486 | | } |
| | | 487 | | } |
| | | 488 | | |
| | | 489 | | // Execute the query. |
| | | 490 | | // |
| | | 491 | | // TODO: allow user to specify a value for validOnly? |
| | 1 | 492 | | bool validOnly = false; |
| | 1 | 493 | | if (findType == X509FindType.FindBySubjectDistinguishedName || |
| | 1 | 494 | | findType == X509FindType.FindByIssuerDistinguishedName) |
| | | 495 | | { |
| | 1 | 496 | | X500DistinguishedNameFlags[] flags = [ |
| | 1 | 497 | | X500DistinguishedNameFlags.None, |
| | 1 | 498 | | X500DistinguishedNameFlags.Reversed, |
| | 1 | 499 | | ]; |
| | 1 | 500 | | var dn = new X500DistinguishedName(arg); |
| | 1 | 501 | | X509Certificate2Collection r = result; |
| | 1 | 502 | | for (int i = 0; i < flags.Length; ++i) |
| | | 503 | | { |
| | 1 | 504 | | r = result.Find(findType, dn.Decode(flags[i]), validOnly); |
| | 1 | 505 | | if (r.Count > 0) |
| | | 506 | | { |
| | | 507 | | break; |
| | | 508 | | } |
| | | 509 | | } |
| | 1 | 510 | | result = r; |
| | | 511 | | } |
| | | 512 | | else |
| | | 513 | | { |
| | 1 | 514 | | result = result.Find(findType, arg, validOnly); |
| | | 515 | | } |
| | | 516 | | } |
| | | 517 | | } |
| | 1 | 518 | | } |
| | | 519 | | finally |
| | | 520 | | { |
| | 1 | 521 | | store.Close(); |
| | 1 | 522 | | } |
| | | 523 | | |
| | 1 | 524 | | return result; |
| | | 525 | | } |
| | | 526 | | |
| | | 527 | | private static SecureString createSecureString(string s) |
| | | 528 | | { |
| | 1 | 529 | | var result = new SecureString(); |
| | 1 | 530 | | foreach (char ch in s) |
| | | 531 | | { |
| | 1 | 532 | | result.AppendChar(ch); |
| | | 533 | | } |
| | 1 | 534 | | return result; |
| | | 535 | | } |
| | | 536 | | |
| | | 537 | | private bool checkPath(ref string path) |
| | | 538 | | { |
| | 1 | 539 | | if (File.Exists(path)) |
| | | 540 | | { |
| | 0 | 541 | | return true; |
| | | 542 | | } |
| | | 543 | | |
| | 1 | 544 | | if (_defaultDir.Length > 0 && !isAbsolutePath(path)) |
| | | 545 | | { |
| | 1 | 546 | | string s = _defaultDir + Path.DirectorySeparatorChar + path; |
| | 1 | 547 | | if (File.Exists(s)) |
| | | 548 | | { |
| | 1 | 549 | | path = s; |
| | 1 | 550 | | return true; |
| | | 551 | | } |
| | | 552 | | } |
| | 0 | 553 | | return false; |
| | | 554 | | } |
| | | 555 | | |
| | | 556 | | private readonly Ice.Communicator _communicator; |
| | | 557 | | |
| | | 558 | | // CA2213: _logger is borrowed from the communicator; the communicator owns its lifecycle. |
| | | 559 | | #pragma warning disable CA2213 |
| | | 560 | | private readonly Ice.Logger _logger; |
| | | 561 | | #pragma warning restore CA2213 |
| | | 562 | | private readonly int _securityTraceLevel; |
| | | 563 | | private readonly string _securityTraceCategory; |
| | | 564 | | private string _defaultDir; |
| | | 565 | | private bool _checkCertName; |
| | | 566 | | private int _verifyPeer; |
| | | 567 | | private int _checkCRL; |
| | | 568 | | private X509Certificate2Collection _certs; |
| | | 569 | | private bool _useMachineContext; |
| | | 570 | | private X509Certificate2Collection _caCerts; |
| | | 571 | | private readonly TrustManager _trustManager; |
| | | 572 | | } |