Апр 15 2010
WCF и шифрование трафика
Приведу пример кода для шифрования трафика между клиентом и сервером в WCF комуникаций.
Шифрование сертификатами
на клиенте прописываем
Uri tcpUri = new Uri("net.tcp://" + settings.cServer + ":7777/");
EndpointAddress address = new EndpointAddress(tcpUri, EndpointIdentity.CreateDnsIdentity("CertName")); //имя сертификата
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.Transport; //шифруем только траспорт
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.None; //аутентификация нам пока не нужна
ChannelFactory<IWCFService> factory = new ChannelFactory<IWCFService>(binding, address);
factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.PeerTrust; //удалённому серверу мы доверяем, так же можно использовать класс для валидации сертификата (смотри другие члены класса X509CertificateValidationMode)
service = factory.CreateChannel();
EndpointAddress address = new EndpointAddress(tcpUri, EndpointIdentity.CreateDnsIdentity("CertName")); //имя сертификата
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.Transport; //шифруем только траспорт
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.None; //аутентификация нам пока не нужна
ChannelFactory<IWCFService> factory = new ChannelFactory<IWCFService>(binding, address);
factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.PeerTrust; //удалённому серверу мы доверяем, так же можно использовать класс для валидации сертификата (смотри другие члены класса X509CertificateValidationMode)
service = factory.CreateChannel();
На сервере пишем следующий код
Uri baseAddress = new Uri("net.tcp://localhost:7777/");
try
{
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.None;
svcHost = new ServiceHost(typeof(WCFService), baseAddress);
svcHost.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My,
X509FindType.FindBySubjectName, "CertName"); //сертификат у нас уже добавлен в хранилище, поэтому делаем его поиск по сабжект нэйм
svcHost.AddServiceEndpoint(typeof(IWCFService), binding, String.Empty);
svcHost.Credentials.IssuedTokenAuthentication.CertificateValidationMode = X509CertificateValidationMode.None; //аутентификация не нужна
svcHost.Open();
try
{
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.None;
svcHost = new ServiceHost(typeof(WCFService), baseAddress);
svcHost.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My,
X509FindType.FindBySubjectName, "CertName"); //сертификат у нас уже добавлен в хранилище, поэтому делаем его поиск по сабжект нэйм
svcHost.AddServiceEndpoint(typeof(IWCFService), binding, String.Empty);
svcHost.Credentials.IssuedTokenAuthentication.CertificateValidationMode = X509CertificateValidationMode.None; //аутентификация не нужна
svcHost.Open();
Сертификат создаём при помощи утилиты makecert.exe из комплекта вижуал студии.
makecert.exe -sr LocalMachine -ss My -n CN=CertName-sky exchange -sk CertName-key
Шифрование средствами Windows
на клиенте
Uri tcpUri = new Uri("net.tcp://" + settings.cServer + ":7777/");
EndpointAddress address = new EndpointAddress(tcpUri);
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Windows;
NetworkCredential credential = new NetworkCredential();
client = new ServiceClient(binding, address);
credential.Domain = "Domen";
credential.UserName = "User";
credential.Password = "Password";
client.ClientCredentials.Windows.ClientCredential = credential;
clinet.Func("test");
EndpointAddress address = new EndpointAddress(tcpUri);
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Windows;
NetworkCredential credential = new NetworkCredential();
client = new ServiceClient(binding, address);
credential.Domain = "Domen";
credential.UserName = "User";
credential.Password = "Password";
client.ClientCredentials.Windows.ClientCredential = credential;
clinet.Func("test");
Класс ServiceClient, каждая функция сервиса должна быть прописана в классе по примеру функции Func
class ServiceClient : ClientBase<IService>, IService
{
public ServiceClient(NetTcpBinding binding, EndpointAddress address)
: base(binding, address)
{
}
public void Func(string param)
{
return base.Channel.Func(param);
}
}
{
public ServiceClient(NetTcpBinding binding, EndpointAddress address)
: base(binding, address)
{
}
public void Func(string param)
{
return base.Channel.Func(param);
}
}
на сервере
Uri baseAddress = new Uri("net.tcp://localhost:7777/");
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Windows;
svcHost = new ServiceHost(typeof(Service), baseAddress);
svcHost.AddServiceEndpoint(typeof(IService), binding, String.Empty);
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Windows;
svcHost = new ServiceHost(typeof(Service), baseAddress);
svcHost.AddServiceEndpoint(typeof(IService), binding, String.Empty);
Нужна будет помощь, пишите )
