#if MONO_SECURITY_ALIAS
extern alias MonoSecurity;
#endif
-#if MONO_X509_ALIAS
-extern alias PrebuiltSystem;
-#endif
#if MONO_SECURITY_ALIAS
using MonoSecurity::Mono.Security.Interface;
using MSX = Mono.Security.X509;
using Mono.Security.X509.Extensions;
#endif
-#if MONO_X509_ALIAS
-using XX509CertificateCollection = PrebuiltSystem::System.Security.Cryptography.X509Certificates.X509CertificateCollection;
-using XX509Chain = PrebuiltSystem::System.Security.Cryptography.X509Certificates.X509Chain;
-#else
-using XX509CertificateCollection = System.Security.Cryptography.X509Certificates.X509CertificateCollection;
-using XX509Chain = System.Security.Cryptography.X509Certificates.X509Chain;
-#endif
using System;
using System.Net;
{
internal delegate bool ServerCertValidationCallbackWrapper (ServerCertValidationCallback callback, X509Certificate certificate, X509Chain chain, MonoSslPolicyErrors sslPolicyErrors);
- internal class ChainValidationHelper : ICertificateValidator
+ internal class ChainValidationHelper : ICertificateValidator2
{
readonly object sender;
readonly MonoTlsSettings settings;
readonly MonoTlsStream tlsStream;
readonly HttpWebRequest request;
- internal static ICertificateValidator GetDefaultValidator (MonoTlsProvider provider, MonoTlsSettings settings)
+#pragma warning disable 618
+
+ internal static ICertificateValidator GetInternalValidator (MonoTlsProvider provider, MonoTlsSettings settings)
{
if (settings == null)
return new ChainValidationHelper (provider, null, false, null, null);
return new ChainValidationHelper (provider, settings, false, null, null);
}
+ internal static ICertificateValidator GetDefaultValidator (MonoTlsSettings settings)
+ {
+ var provider = MonoTlsProviderFactory.GetProvider ();
+ if (settings == null)
+ return new ChainValidationHelper (provider, null, false, null, null);
+ if (settings.CertificateValidator != null)
+ throw new NotSupportedException ();
+ return new ChainValidationHelper (provider, settings, false, null, null);
+ }
+
#region SslStream support
/*
settings = MonoTlsSettings.CopyDefaultSettings ();
if (cloneSettings)
settings = settings.CloneWithValidator (this);
+ if (provider == null)
+ provider = MonoTlsProviderFactory.GetProvider ();
this.provider = provider;
this.settings = settings;
certValidationCallback = ServicePointManager.ServerCertValidationCallback;
}
- static X509Certificate DefaultSelectionCallback (string targetHost, XX509CertificateCollection localCertificates, X509Certificate remoteCertificate, string[] acceptableIssuers)
+#pragma warning restore 618
+
+ static X509Certificate DefaultSelectionCallback (string targetHost, X509CertificateCollection localCertificates, X509Certificate remoteCertificate, string[] acceptableIssuers)
{
X509Certificate clientCertificate;
if (localCertificates == null || localCertificates.Count == 0)
}
public bool SelectClientCertificate (
- string targetHost, XX509CertificateCollection localCertificates, X509Certificate remoteCertificate,
+ string targetHost, X509CertificateCollection localCertificates, X509Certificate remoteCertificate,
string[] acceptableIssuers, out X509Certificate clientCertificate)
{
if (certSelectionCallback == null) {
}
internal X509Certificate SelectClientCertificate (
- string targetHost, XX509CertificateCollection localCertificates, X509Certificate remoteCertificate,
+ string targetHost, X509CertificateCollection localCertificates, X509Certificate remoteCertificate,
string[] acceptableIssuers)
{
if (certSelectionCallback == null)
internal bool ValidateClientCertificate (X509Certificate certificate, MonoSslPolicyErrors errors)
{
- var certs = new XX509CertificateCollection ();
+ var certs = new X509CertificateCollection ();
certs.Add (new X509Certificate2 (certificate.GetRawCertData ()));
- var result = ValidateChain (string.Empty, true, certs, (SslPolicyErrors)errors);
+ var result = ValidateChain (string.Empty, true, certificate, null, certs, (SslPolicyErrors)errors);
if (result == null)
return false;
return result.Trusted && !result.UserDenied;
}
- public ValidationResult ValidateCertificate (string host, bool serverMode, XX509CertificateCollection certs)
+ public ValidationResult ValidateCertificate (string host, bool serverMode, X509CertificateCollection certs)
+ {
+ try {
+ X509Certificate leaf;
+ if (certs != null && certs.Count != 0)
+ leaf = certs [0];
+ else
+ leaf = null;
+ var result = ValidateChain (host, serverMode, leaf, null, certs, 0);
+ if (tlsStream != null)
+ tlsStream.CertificateValidationFailed = result == null || !result.Trusted || result.UserDenied;
+ return result;
+ } catch {
+ if (tlsStream != null)
+ tlsStream.CertificateValidationFailed = true;
+ throw;
+ }
+ }
+
+ public ValidationResult ValidateCertificate (string host, bool serverMode, X509Certificate leaf, X509Chain chain)
{
try {
- var result = ValidateChain (host, serverMode, certs, 0);
+ var result = ValidateChain (host, serverMode, leaf, chain, null, 0);
if (tlsStream != null)
tlsStream.CertificateValidationFailed = result == null || !result.Trusted || result.UserDenied;
return result;
}
}
- ValidationResult ValidateChain (string host, bool server, XX509CertificateCollection certs, SslPolicyErrors errors)
+ ValidationResult ValidateChain (string host, bool server, X509Certificate leaf,
+ X509Chain chain, X509CertificateCollection certs,
+ SslPolicyErrors errors)
+ {
+ var oldChain = chain;
+ var ownsChain = chain == null;
+ try {
+ var result = ValidateChain (host, server, leaf, ref chain, certs, errors);
+ if (chain != oldChain)
+ ownsChain = true;
+
+ return result;
+ } finally {
+ // If ValidateChain() changed the chain, then we need to free it.
+ if (ownsChain && chain != null)
+ chain.Dispose ();
+ }
+ }
+
+ ValidationResult ValidateChain (string host, bool server, X509Certificate leaf,
+ ref X509Chain chain, X509CertificateCollection certs,
+ SslPolicyErrors errors)
{
// user_denied is true if the user callback is called and returns false
bool user_denied = false;
var hasCallback = certValidationCallback != null || callbackWrapper != null;
- X509Certificate leaf;
- if (certs == null || certs.Count == 0)
- leaf = null;
- else
- leaf = certs [0];
-
if (tlsStream != null)
request.ServicePoint.UpdateServerCertificate (leaf);
return new ValidationResult (result, user_denied, 0, (MonoSslPolicyErrors)errors);
}
+ // Ignore port number when validating certificates.
+ if (!string.IsNullOrEmpty (host)) {
+ var pos = host.IndexOf (':');
+ if (pos > 0)
+ host = host.Substring (0, pos);
+ }
+
ICertificatePolicy policy = ServicePointManager.GetLegacyCertificatePolicy ();
int status11 = 0; // Error code passed to the obsolete ICertificatePolicy callback
- X509Chain chain = null;
bool wantsChain = SystemCertificateValidator.NeedsChain (settings);
if (!wantsChain && hasCallback) {
wantsChain = true;
}
- if (wantsChain)
- chain = SystemCertificateValidator.CreateX509Chain (certs);
+ var xerrors = (MonoSslPolicyErrors)errors;
+ result = provider.ValidateCertificate (this, host, server, certs, wantsChain, ref chain, ref xerrors, ref status11);
+ errors = (SslPolicyErrors)xerrors;
- bool providerValidated = false;
- if (provider != null && provider.HasCustomSystemCertificateValidator) {
- var xerrors = (MonoSslPolicyErrors)errors;
- var xchain = (XX509Chain)(object)chain;
- providerValidated = provider.InvokeSystemCertificateValidator (this, host, server, certs, xchain, out result, ref xerrors, ref status11);
- errors = (SslPolicyErrors)xerrors;
+ if (status11 == 0 && errors != 0) {
+ // TRUST_E_FAIL
+ status11 = unchecked ((int)0x800B010B);
}
- if (!providerValidated)
- result = SystemCertificateValidator.Evaluate (settings, host, certs, chain, ref errors, ref status11);
-
if (policy != null && (!(policy is DefaultCertificatePolicy) || certValidationCallback == null)) {
ServicePoint sp = null;
if (request != null)
sp = request.ServicePointNoLock;
- if (status11 == 0 && errors != 0) {
- // TRUST_E_FAIL
- status11 = unchecked ((int)0x800B010B);
- }
// pre 2.0 callback
result = policy.CheckValidationResult (sp, leaf, request, status11);
return new ValidationResult (result, user_denied, status11, (MonoSslPolicyErrors)errors);
}
- public bool InvokeSystemValidator (string targetHost, bool serverMode, XX509CertificateCollection certificates, XX509Chain xchain, ref MonoSslPolicyErrors xerrors, ref int status11)
+ bool InvokeSystemValidator (string targetHost, bool serverMode, X509CertificateCollection certificates, X509Chain chain, ref MonoSslPolicyErrors xerrors, ref int status11)
{
- X509Chain chain = (X509Chain)(object)xchain;
var errors = (SslPolicyErrors)xerrors;
var result = SystemCertificateValidator.Evaluate (settings, targetHost, certificates, chain, ref errors, ref status11);
xerrors = (MonoSslPolicyErrors)errors;
projects / mono.git / blobdiff