NSUrlSessionHandler: Adds support for X509 client certificates #20434
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -567,15 +567,20 @@ public DecompressionMethods AutomaticDecompression { | |||||
| [EditorBrowsable (EditorBrowsableState.Never)] | ||||||
| public bool CheckCertificateRevocationList { get; set; } = false; | ||||||
|
|
||||||
|
|
||||||
| X509CertificateCollection? _clientCertificates; | ||||||
|
|
||||||
| /// <summary>Gets the collection of security certificates that are associated with requests to the server.</summary> | ||||||
| /// <remarks>Client certificates are only supported when ClientCertificateOptions is set to ClientCertificateOptions.Manual.</remarks> | ||||||
| public X509CertificateCollection ClientCertificates { | ||||||
| get { | ||||||
| if (ClientCertificateOptions != ClientCertificateOption.Manual) { | ||||||
| throw new InvalidOperationException ($"Enable manual options first on {nameof (ClientCertificateOptions)}"); | ||||||
| } | ||||||
|
|
||||||
| return _clientCertificates ?? (_clientCertificates = new X509CertificateCollection ()); | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| // We're ignoring this property, just like Xamarin.Android does: | ||||||
| // https://github.com/xamarin/xamarin-android/blob/09e8cb5c07ea6c39383185a3f90e53186749b802/src/Mono.Android/Xamarin.Android.Net/AndroidMessageHandler.cs#L148 | ||||||
|
|
@@ -1085,6 +1090,19 @@ void DidReceiveChallengeImpl (NSUrlSession session, NSUrlSessionTask task, NSUrl | |||||
| } | ||||||
| return; | ||||||
| } | ||||||
| #if NET | ||||||
| if (sessionHandler.ClientCertificateOptions == ClientCertificateOption.Manual && challenge.ProtectionSpace.AuthenticationMethod == NSUrlProtectionSpace.AuthenticationMethodClientCertificate) { | ||||||
| var certificate = CertificateHelper.GetEligibleClientCertificate (sessionHandler.ClientCertificates); | ||||||
| if (certificate is not null) { | ||||||
| var cert = new SecCertificate (certificate); | ||||||
| var identity = SecIdentity.Import (certificate); | ||||||
| var credential = new NSUrlCredential (identity, new SecCertificate [] { cert }, NSUrlCredentialPersistence.ForSession); | ||||||
| completionHandler (NSUrlSessionAuthChallengeDisposition.UseCredential, credential); | ||||||
| return; | ||||||
| } | ||||||
| } | ||||||
dotMorten marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
| #endif | ||||||
|
|
||||||
| // case for the basic auth failing up front. As per apple documentation: | ||||||
| // The URL Loading System is designed to handle various aspects of the HTTP protocol for you. As a result, you should not modify the following headers using | ||||||
| // the addValue(_:forHTTPHeaderField:) or setValue(_:forHTTPHeaderField:) methods: | ||||||
|
|
@@ -1589,5 +1607,73 @@ protected override void Dispose (bool disposing) | |||||
| stream?.Dispose (); | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| #if NET | ||||||
| static class CertificateHelper { | ||||||
| // Based on https://github.com/dotnet/runtime/blob/c2848c582f5d6ae42c89f5bfe0818687ab3345f0/src/libraries/Common/src/System/Net/Security/CertificateHelper.cs | ||||||
| // with the NetEventSource code removed and namespace changed. | ||||||
| const string ClientAuthenticationOID = "1.3.6.1.5.5.7.3.2"; | ||||||
|
|
||||||
| internal static X509Certificate2? GetEligibleClientCertificate (X509CertificateCollection? candidateCerts) | ||||||
| { | ||||||
| if (candidateCerts is null || candidateCerts.Count == 0) { | ||||||
| return null; | ||||||
| } | ||||||
|
|
||||||
| var certs = new X509Certificate2Collection (); | ||||||
| certs.AddRange (candidateCerts); | ||||||
|
|
||||||
| return GetEligibleClientCertificate (certs); | ||||||
| } | ||||||
|
|
||||||
| internal static X509Certificate2? GetEligibleClientCertificate (X509Certificate2Collection? candidateCerts) | ||||||
| { | ||||||
| if (candidateCerts is null || candidateCerts.Count == 0) { | ||||||
| return null; | ||||||
| } | ||||||
|
|
||||||
| foreach (X509Certificate2 cert in candidateCerts) { | ||||||
| if (!cert.HasPrivateKey) { | ||||||
| continue; | ||||||
| } | ||||||
|
|
||||||
| if (IsValidClientCertificate (cert)) { | ||||||
| return cert; | ||||||
| } | ||||||
| } | ||||||
| return null; | ||||||
| } | ||||||
|
|
||||||
| static bool IsValidClientCertificate (X509Certificate2 cert) | ||||||
| { | ||||||
| foreach (X509Extension extension in cert.Extensions) { | ||||||
| if ((extension is X509EnhancedKeyUsageExtension eku) && !IsValidForClientAuthenticationEKU (eku)) { | ||||||
| return false; | ||||||
| } else if ((extension is X509KeyUsageExtension ku) && !IsValidForDigitalSignatureUsage (ku)) { | ||||||
| return false; | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| return true; | ||||||
| } | ||||||
|
|
||||||
| static bool IsValidForClientAuthenticationEKU (X509EnhancedKeyUsageExtension eku) | ||||||
| { | ||||||
| foreach (System.Security.Cryptography.Oid oid in eku.EnhancedKeyUsages) { | ||||||
| if (oid.Value == ClientAuthenticationOID) { | ||||||
| return true; | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| return false; | ||||||
| } | ||||||
|
|
||||||
| static bool IsValidForDigitalSignatureUsage (X509KeyUsageExtension ku) | ||||||
| { | ||||||
| const X509KeyUsageFlags RequiredUsages = X509KeyUsageFlags.DigitalSignature; | ||||||
| return (ku.KeyUsages & RequiredUsages) == RequiredUsages; | ||||||
|
Contributor
There was a problem hiding this comment. I have always preferred the HasFlag method over the &, but is a matter of taste. I just think it is easier to read.
Suggested change
Contributor
Author
There was a problem hiding this comment. Since this is code taken from the .NET Runtime I tried not changing the logic from its origin. |
||||||
| } | ||||||
| } | ||||||
| #endif | ||||||
| } | ||||||
| } | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.