| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| using System; |
| using System.Collections.Specialized; |
| using System.Collections.Generic; |
| using NUnit.Framework; |
| using NUnit.Framework.Interfaces; |
| using Apache.NMS; |
| using Apache.NMS.AMQP.Test.Util; |
| using Apache.NMS.AMQP.Test.Attribute; |
| using System.Security.Cryptography.X509Certificates; |
| |
| namespace Apache.NMS.AMQP.Test.TestCase |
| { |
| // initial ssl connection tests. |
| [TestFixture] |
| class SecureConnectionTest : BaseTestCase |
| { |
| protected const string TestSuiteClientCertificateFileName = "config/cert/client.crt"; |
| protected const string ApplicationCallbackExceptionMessage = "Bad Application"; |
| |
| protected IConnection Connection; |
| protected readonly static TimeSpan ConnectTimeout = TimeSpan.FromMilliseconds(60000); |
| public override void Setup() |
| { |
| if(!this.IsSecureBroker) |
| { |
| Assert.Ignore("Broker {0} not configured for secure connection.", TestConfig.Instance.BrokerUri.ToString()); |
| } |
| base.Setup(); |
| |
| } |
| |
| public override void TearDown() |
| { |
| base.TearDown(); |
| Connection?.Close(); |
| Connection = null; |
| } |
| |
| |
| #region Useful Function |
| |
| private static void UpdateDictionaryEntry(StringDictionary dict, string key, string value) |
| { |
| if(dict.ContainsKey(key)) |
| { |
| dict[key] = value; |
| } |
| else |
| { |
| dict.Add(key, value); |
| } |
| } |
| |
| private static List<StringDictionary> GenerateProperties(IDictionary<string, IList<string>> propertyValueSet) |
| { |
| List<StringDictionary> propertyCombinations = new List<StringDictionary>(); |
| int propertyCount = propertyValueSet.Keys.Count; |
| string[] properties = new string[propertyCount]; |
| propertyValueSet.Keys.CopyTo(properties, 0); |
| for (int i=0; i<propertyCount; i++) |
| { |
| |
| string property = properties[i]; |
| IList<string> propertyValues = propertyValueSet[property]; |
| int valueCount = propertyValues.Count; |
| |
| foreach (string propertyValue in propertyValues) |
| { |
| StringDictionary propertyCombination = new StringDictionary(); |
| |
| // add current property value |
| |
| UpdateDictionaryEntry(propertyCombination, property, propertyValue); |
| |
| propertyCombinations.Add(Clone(propertyCombination)); |
| |
| // adds the other properties |
| for (int j = i + 1; j < propertyCount; j++) |
| { |
| |
| string otherProperty = properties[j]; |
| IList<string> otherPropertyValues = propertyValueSet[otherProperty]; |
| int otherValueCount = otherPropertyValues.Count; |
| |
| foreach (string otherValue in otherPropertyValues) |
| { |
| UpdateDictionaryEntry(propertyCombination, otherProperty, otherValue); |
| |
| propertyCombinations.Add(Clone(propertyCombination)); |
| |
| } |
| |
| } |
| } |
| } |
| return propertyCombinations; |
| } |
| |
| private static string GetSecureProviderURIString() |
| { |
| if(TestConfig.Instance.IsSecureBroker) |
| { |
| return TestConfig.Instance.BrokerUri.ToString(); |
| } |
| else |
| { |
| const string SecurePort = "5671"; |
| const string SecureScheme = "amqps://"; |
| string brokerIp = TestConfig.Instance.BrokerIpAddress; |
| string providerURI = string.Format("{0}{1}:{2}", SecureScheme, brokerIp, SecurePort); |
| return providerURI; |
| } |
| } |
| |
| |
| private IConnection CreateSecureConnection(IConnectionFactory connectionFactory) |
| { |
| IConnection connection = null; |
| if (TestConfig.Instance.BrokerUsername != null) |
| { |
| connection = connectionFactory.CreateConnection(TestConfig.Instance.BrokerUsername, TestConfig.Instance.BrokerPassword); |
| } |
| else |
| { |
| connection = connectionFactory.CreateConnection(); |
| } |
| |
| connection.RequestTimeout = ConnectTimeout; |
| |
| return connection; |
| } |
| |
| private void TestSecureConnect(out Exception failure) |
| { |
| TestSecureConnect(Connection, out failure); |
| } |
| |
| private static void TestSecureConnect(IConnection connection, out Exception failure) |
| { |
| failure = null; |
| try |
| { |
| connection.Start(); |
| } |
| catch (Exception ex) |
| { |
| failure = ex; |
| } |
| } |
| |
| #endregion |
| |
| private bool ConnectionFactoryTransportPropertiesMatch(StringDictionary expected, ConnectionFactory actualFactory, out string failure) |
| { |
| failure = null; |
| StringDictionary actualProperties = actualFactory.TransportProperties; |
| foreach(string property in expected.Keys) |
| { |
| if (actualProperties.ContainsKey(property)) |
| { |
| string expectedValue = expected[property]; |
| string actualValue = actualProperties[property]; |
| if (expectedValue != null && actualValue != null) |
| { |
| if (String.Compare(expectedValue, actualValue, true) != 0) |
| { |
| failure = string.Format("Connection Factory property {0} value {1} does not match expected value {2}", property, actualValue, expectedValue); |
| return false; |
| } |
| } |
| else if (expectedValue == null && actualValue == null) |
| { |
| // matches ignore |
| } |
| else |
| { |
| failure = string.Format("Expected property \"{0}\" value of {1} when actual value is {2}", property, expectedValue ?? "null", actualValue ?? "null"); |
| return false; |
| } |
| |
| } |
| else |
| { |
| failure = string.Format("Connection Factory does not contain expected property {0}", property); |
| return false; |
| } |
| } |
| return true; |
| } |
| |
| private void TestConnectionFactorySSLPropertyConfiguration(StringDictionary props) |
| { |
| try |
| { |
| string providerUri = GetSecureProviderURIString(); |
| |
| ConnectionFactory connectionFactory = new ConnectionFactory(new Uri(providerUri), props); |
| |
| string failure = null; |
| |
| Assert.IsTrue( |
| ConnectionFactoryTransportPropertiesMatch(props, connectionFactory, out failure), |
| "Transport Properties do not match given properties. Cause : {0}", |
| failure ?? "" |
| ); |
| } |
| catch (Exception ex) |
| { |
| this.PrintTestFailureAndAssert( |
| this.GetTestMethodName() + "TestConnectionFactorySSLPropertyConfiguration", |
| "Unexpected Exception", |
| ex |
| ); |
| } |
| } |
| |
| private void TestConnectionFactorySSLURIConfiguration(StringDictionary props) |
| { |
| try |
| { |
| // create provider URI |
| string providerUriQueryParameters = Apache.NMS.Util.URISupport.CreateQueryString(props); |
| string providerUriBase = GetSecureProviderURIString(); |
| string providerUri = string.Format("{0}?{1}", providerUriBase, providerUriQueryParameters); |
| |
| IConnectionFactory connectionFactory = CreateConnectionFactory(); |
| connectionFactory.BrokerUri = new Uri(providerUri); |
| ConnectionFactory providerConnectionFactory = connectionFactory as ConnectionFactory; |
| |
| string failure = null; |
| |
| Assert.IsTrue( |
| ConnectionFactoryTransportPropertiesMatch(props, providerConnectionFactory, out failure), |
| "Transport Properties do not match URI parameters {0}. Cause : {1}", |
| providerUriQueryParameters, |
| failure ?? "" |
| ); |
| |
| } |
| catch (Exception ex) |
| { |
| this.PrintTestFailureAndAssert( |
| this.GetTestMethodName() + "_TestConnectionFactorySSLURIConfiguration", |
| "Unexpected Exception", |
| ex |
| ); |
| } |
| } |
| |
| /* |
| * Tests how to configure ssl options for a connection factory, via URI and properties. |
| * These properties are verfified using the Provider connection factory property TransportProperties. |
| */ |
| [Test] |
| public void TestConnectionFactorySSLConfiguration() |
| { |
| /* |
| * PropertyTestValues is the set of all secure transport properties and values to combine and |
| * assign using the connectionfactory URI or the StringDictionary parameter in the connection |
| * Factory constructor. This will be used to generate the combinations of properties and values. |
| */ |
| IDictionary<string, IList<string>> PropertyTestValues = new Dictionary<string, IList<string>>() |
| { |
| { |
| NMSPropertyConstants.NMS_SECURE_TANSPORT_SSL_PROTOCOLS, |
| /* for simplicity only string that can be produced by SSLProtocols.ToString are used */ |
| new List<string> { "Default", "Tls, Tls11, Tls12" } |
| }, |
| { |
| NMSPropertyConstants.NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT, |
| new List<string> { bool.TrueString, bool.FalseString } |
| }, |
| { |
| NMSPropertyConstants.NMS_SECURE_TRANSPORT_CLIENT_CERT_FILE_NAME, |
| new List<string> { TestSuiteClientCertificateFileName, "foo.p12", "testfile" } |
| }, |
| { |
| NMSPropertyConstants.NMS_SECURE_TANSPORT_SERVER_NAME, |
| new List<string>() { "localhost", "test with spaces" } |
| }, |
| { |
| NMSPropertyConstants.NMS_SECURE_TANSPORT_CLIENT_CERT_SUBJECT, |
| new List<string>() { "a subject one.", "CN=client", "myself" } |
| }, |
| { |
| NMSPropertyConstants.NMS_SECURE_TANSPORT_CLIENT_CERT_PASSWORD, |
| new List<string>() { "password", "abcABC123/*-+", "test with spaces" } |
| }, |
| { |
| NMSPropertyConstants.NMS_SECURE_TANSPORT_KEY_STORE_LOCATION, |
| new List<string> |
| { |
| StoreLocation.CurrentUser.ToString(), |
| StoreLocation.LocalMachine.ToString() |
| } |
| }, |
| { |
| NMSPropertyConstants.NMS_SECURE_TANSPORT_KEY_STORE_NAME, |
| new List<string> |
| { |
| StoreName.My.ToString(), |
| StoreName.AddressBook.ToString(), |
| StoreName.AuthRoot.ToString(), |
| StoreName.CertificateAuthority.ToString(), |
| StoreName.Disallowed.ToString(), |
| StoreName.Root.ToString(), |
| StoreName.TrustedPeople.ToString(), |
| StoreName.TrustedPublisher.ToString(), |
| "other" |
| } |
| }, |
| { |
| NMSPropertyConstants.NMS_SECURE_TRANSPORT_SSL_CHECK_CERTIFICATE_REVOCATION, |
| new List<string> |
| { |
| bool.TrueString, |
| bool.FalseString |
| } |
| } |
| }; |
| |
| Logger.Info("Generating SSL configuration Test properties."); |
| |
| List<StringDictionary> TestConfigurations = GenerateProperties(PropertyTestValues); |
| |
| Logger.Info(string.Format("Generated {0} property configurations.", TestConfigurations.Count)); |
| |
| int count = 0; |
| |
| foreach(StringDictionary configuration in TestConfigurations) |
| { |
| count++; |
| if(Logger.IsDebugEnabled) |
| { |
| Logger.Debug(string.Format("Testing SSL configuration combination {0} : \n{1}", count, ToString(configuration))); |
| } |
| |
| TestConnectionFactorySSLPropertyConfiguration(configuration); |
| |
| TestConnectionFactorySSLURIConfiguration(configuration); |
| } |
| } |
| |
| /* |
| * Tests valid values for the transport.SSLProtocol property. |
| * The test then attempts to connect to the broker with the assigned property creating should it not be able to connect. |
| * The protocols Ssl3, Ssl2 and tls1.0 are not secured so all test values should result in the tsl11, or later, protocol to |
| * be selected should a broker support the secure protocols. |
| * */ |
| [Test] |
| public void TestValidSSLProtocols( |
| [Values( "tls11", "tls12", "Ssl3,tls11", "tls,tls11", "Default,tls11", "tls,ssl3,tls11", " tls12,tls", "tls,tls11,tls12")] |
| string protocolsString |
| ) |
| { |
| StringDictionary queryOptions = new StringDictionary() |
| { |
| { NMSPropertyConstants.NMS_SECURE_TANSPORT_SSL_PROTOCOLS, protocolsString } |
| }; |
| |
| string normalizedName; |
| System.Security.Authentication.SslProtocols protocol = System.Security.Authentication.SslProtocols.None; |
| if (Enum.TryParse(protocolsString, true, out protocol)) |
| { |
| normalizedName = protocol.ToString(); |
| } |
| else |
| { |
| normalizedName = protocolsString; |
| } |
| |
| |
| try |
| { |
| // create provider URI |
| string providerUriQueryParameters = Apache.NMS.Util.URISupport.CreateQueryString(queryOptions); |
| string providerUriBase = GetSecureProviderURIString(); |
| string providerUri = string.Format("{0}?{1}", providerUriBase, providerUriQueryParameters); |
| |
| IConnectionFactory connectionFactory = CreateConnectionFactory(); |
| connectionFactory.BrokerUri = new Uri(providerUri); |
| ConnectionFactory providerConnectionFactory = connectionFactory as ConnectionFactory; |
| // disables certificate validation |
| providerConnectionFactory.CertificateValidationCallback = (a, b, c, d) => true; |
| string transportSSLProtocol = providerConnectionFactory.TransportProperties[NMSPropertyConstants.NMS_SECURE_TANSPORT_SSL_PROTOCOLS]; |
| |
| Assert.AreEqual(normalizedName, transportSSLProtocol); |
| |
| Connection = CreateSecureConnection(connectionFactory); |
| |
| try |
| { |
| // attempt to connect to broker |
| Connection.Start(); |
| } |
| catch (NMSSecurityException secEx) |
| { |
| Logger.Warn(string.Format("Security failure. Check {0} file for test configuration. Or check broker configuration. Security Message : {1}", Configuration.CONFIG_FILENAME, secEx.Message)); |
| } |
| } |
| catch(Exception ex) |
| { |
| this.PrintTestFailureAndAssert(this.GetTestMethodName(), "Unexpected Exception", ex); |
| } |
| finally |
| { |
| Connection?.Close(); |
| } |
| |
| } |
| |
| |
| [Test] |
| public void TestProviderRemoteCertificateValidationCallback() |
| { |
| StringDictionary queryOptions = new StringDictionary() |
| { |
| { NMSPropertyConstants.NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT, bool.TrueString } |
| }; |
| try |
| { |
| // Create Provider URI |
| string providerUriQueryParameters = Apache.NMS.Util.URISupport.CreateQueryString(queryOptions); |
| string providerUriBase = GetSecureProviderURIString(); |
| string providerUri = string.Format("{0}?{1}", providerUriBase, providerUriQueryParameters); |
| |
| // Create Provider connection factory |
| IConnectionFactory connectionFactory = CreateConnectionFactory(); |
| connectionFactory.BrokerUri = new Uri(providerUri); |
| ConnectionFactory providerConnectionFactory = connectionFactory as ConnectionFactory; |
| |
| bool signaled = false; |
| |
| // (object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) |
| // test Validation Callback can override NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT property |
| providerConnectionFactory.CertificateValidationCallback = (sender, cert, chain, errors) => |
| { |
| signaled = true; |
| // indicate that the remote certificate is invalid. |
| return false; |
| }; |
| |
| Exception connectionFailure = null; |
| |
| // Create connection using NMS Interface |
| using (Connection = CreateSecureConnection(connectionFactory)) |
| { |
| TestSecureConnect(Connection, out connectionFailure); |
| |
| Assert.IsTrue(signaled, "Application callback was not executed."); |
| |
| Assert.NotNull(connectionFailure, "Application callback CertificateValidationCallback should cause Connection start to fail. Expected exception."); |
| |
| Logger.Info(string.Format("Caught exception on invalid start of connection. Connection failure cause : {0} ", connectionFailure)); |
| } |
| |
| Connection = null; |
| connectionFailure = null; |
| signaled = false; |
| |
| //update connection factory transport settings |
| |
| providerConnectionFactory.TransportProperties[NMSPropertyConstants.NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT] = bool.FalseString; |
| |
| // Test NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT is ignored when the application callback throws exception. |
| providerConnectionFactory.CertificateValidationCallback = (sender, cert, chain, errors) => |
| { |
| signaled = true; |
| // throw dummy exception to indicate an application callback failure. |
| throw new Exception(ApplicationCallbackExceptionMessage); |
| }; |
| |
| // Create connection using NMS Interface |
| using (Connection = CreateSecureConnection(connectionFactory)) |
| { |
| TestSecureConnect(Connection, out connectionFailure); |
| |
| Assert.IsTrue(signaled, "Application Callback thats throws exception was not executed."); |
| |
| Assert.NotNull(connectionFailure, "Connection did not produce an exception from the application callback."); |
| |
| Assert.AreEqual(ApplicationCallbackExceptionMessage, connectionFailure.InnerException?.Message, "Exception produced was not application callback exception."); |
| } |
| } |
| catch (Exception ex) |
| { |
| this.PrintTestFailureAndAssert(this.GetTestMethodName(), "Unexpected Exception", ex); |
| } |
| } |
| |
| /* |
| * Tests that an application can load an X509Certificate and use that certificate in the callback. |
| * This test can fail different base on the TestSuite configuration. Should the testSuite be configured |
| * to use a client certificate this test assumes that the remote broker can accept the client certificate |
| * and fail appropriately. Should the test suite not be configured to use a client certificate the test |
| * will not fail on a connection failure. |
| */ |
| [Test] |
| public void TestProviderLocalCertificateSelectCallback() |
| { |
| bool isConfiguredCert = !String.IsNullOrWhiteSpace(TestConfig.Instance.ClientCertFileName); |
| string clientCertFileName = isConfiguredCert ? TestConfig.Instance.ClientCertFileName : TestSuiteClientCertificateFileName; |
| // configure to ignore remote certificate validation. |
| StringDictionary queryOptions = new StringDictionary() |
| { |
| { NMSPropertyConstants.NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT, bool.TrueString } |
| }; |
| try |
| { |
| // load certificate |
| X509Certificate cert = null; |
| try |
| { |
| cert = X509Certificate2.CreateFromCertFile(clientCertFileName); |
| } |
| catch (Exception ex) |
| { |
| // failure to load should fail test. |
| Assert.Fail("Could not load client certificate for from file {0}, cause of failure : {1}", clientCertFileName, ex.Message); |
| } |
| |
| Assert.NotNull(cert, "Failed to load client certificate {0}.", clientCertFileName); |
| |
| // Create Provider URI |
| string providerUriQueryParameters = Apache.NMS.Util.URISupport.CreateQueryString(queryOptions); |
| string providerUriBase = GetSecureProviderURIString(); |
| string providerUri = string.Format("{0}?{1}", providerUriBase, providerUriQueryParameters); |
| |
| // Create Provider connection factory |
| IConnectionFactory connectionFactory = CreateConnectionFactory(); |
| connectionFactory.BrokerUri = new Uri(providerUri); |
| ConnectionFactory providerConnectionFactory = connectionFactory as ConnectionFactory; |
| |
| bool signaled = false; |
| Exception connectionFailure = null; |
| |
| // Test selecting certificate from loaded by application |
| |
| // X509Certificate LocalCertificateSelectionCallback(object sender, string targetHost, X509CertificateCollection localCertificates, X509Certificate remoteCertificate, string[] acceptableIssuers) |
| providerConnectionFactory.LocalCertificateSelect = (sender, targetHost, localCertificates, remoteCertificate, issuers) => |
| { |
| signaled = true; |
| // return loaded certificate |
| return cert; |
| }; |
| |
| using (Connection = CreateSecureConnection(connectionFactory)) |
| { |
| |
| TestSecureConnect(Connection, out connectionFailure); |
| |
| string failureCause = null; |
| // log any failure for reference |
| if (connectionFailure != null) |
| { |
| failureCause = string.Format("Connection failed to connection. Cause : {0}", connectionFailure.Message); |
| Logger.Info("Caught exception for secure connection " + connectionFailure); |
| } |
| |
| Assert.IsTrue(signaled, "LocalCertificateSelectCallback failed to execute. {0}", failureCause ?? ""); |
| |
| // Should the runner of the test suite indent to use a configured client certificate |
| // the test should fail if the connection fails to connection. |
| // This means the client certificate selected must be accepted by the remote broker. |
| if (isConfiguredCert) |
| { |
| Assert.IsNull(connectionFailure, "Caught Exception for configured client certificate." + |
| " Please check TestSuite Configuration in {0} and" + |
| " ensure host {1} can process client certificate {2}." + |
| " Failure Message : {3}", |
| Configuration.CONFIG_FILENAME, |
| TestConfig.Instance.BrokerIpAddress, |
| clientCertFileName, |
| connectionFailure?.Message); |
| } |
| } |
| } |
| catch (Exception ex) |
| { |
| this.PrintTestFailureAndAssert(this.GetTestMethodName(), "Unexpected Exception", ex); |
| } |
| } |
| |
| /* |
| * Tests the behaviour of the application LocalCertificateSelectCallback callback throw an exception. |
| */ |
| [Test] |
| public void TestProviderLocalCertificateSelectCallbackThrowsException() |
| { |
| // configure to ignore remote certificate validation. |
| StringDictionary queryOptions = new StringDictionary() |
| { |
| { NMSPropertyConstants.NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT, bool.TrueString } |
| }; |
| try |
| { |
| // Create Provider URI |
| string providerUriQueryParameters = Apache.NMS.Util.URISupport.CreateQueryString(queryOptions); |
| string providerUriBase = GetSecureProviderURIString(); |
| string providerUri = string.Format("{0}?{1}", providerUriBase, providerUriQueryParameters); |
| |
| // Create Provider connection factory |
| IConnectionFactory connectionFactory = CreateConnectionFactory(); |
| connectionFactory.BrokerUri = new Uri(providerUri); |
| ConnectionFactory providerConnectionFactory = connectionFactory as ConnectionFactory; |
| |
| bool signaled = false; |
| Exception connectionFailure = null; |
| |
| providerConnectionFactory.LocalCertificateSelect = (sender, targetHost, localCertificates, remoteCertificate, issuers) => |
| { |
| signaled = true; |
| // throw exception |
| throw new Exception(ApplicationCallbackExceptionMessage); |
| }; |
| |
| using (Connection = CreateSecureConnection(connectionFactory)) |
| { |
| TestSecureConnect(Connection, out connectionFailure); |
| |
| string failureCause = null; |
| // log any failure for reference |
| if (connectionFailure != null) |
| { |
| failureCause = string.Format("Connection failed to connection. Cause : {0}", connectionFailure.Message); |
| Logger.Info("Caught exception for secure connection " + connectionFailure); |
| } |
| |
| Assert.IsTrue(signaled, "LocalCertificateSelectCallback failed to execute. {0}", failureCause ?? ""); |
| |
| Assert.NotNull(connectionFailure, "Connection did not produce exception from application callback."); |
| |
| Assert.AreEqual(ApplicationCallbackExceptionMessage, connectionFailure.InnerException?.Message, "Exception produced was not application callback exception."); |
| } |
| } |
| catch (Exception ex) |
| { |
| this.PrintTestFailureAndAssert(this.GetTestMethodName(), "Unexpected Exception", ex); |
| } |
| } |
| |
| /* |
| * Tests that the property for client certificate file name loads the certificate into the |
| * certificate collection for selection. |
| */ |
| [Test] |
| public void TestClientCertificateFileName() |
| { |
| string clientCertificateFileName = TestSuiteClientCertificateFileName; |
| // Configure to ignore remote certificate validation and add TestSuiteClientCertificateFileName for selction. |
| StringDictionary queryOptions = new StringDictionary() |
| { |
| { NMSPropertyConstants.NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT, bool.TrueString }, |
| { NMSPropertyConstants.NMS_SECURE_TRANSPORT_CLIENT_CERT_FILE_NAME, clientCertificateFileName } |
| }; |
| |
| try |
| { |
| // load certificate |
| X509Certificate cert = null; |
| try |
| { |
| cert = X509Certificate2.CreateFromCertFile(clientCertificateFileName); |
| } |
| catch (Exception ex) |
| { |
| // failure to load should fail test. |
| Assert.Fail( |
| "Could not load client certificate for from file {0}, cause of failure : {1}", |
| clientCertificateFileName, |
| ex.Message |
| ); |
| } |
| Assert.NotNull(cert, "Failed to load client certificate. {0}", clientCertificateFileName); |
| |
| byte[] clientCertBytes = cert.GetRawCertData(); |
| |
| // Create Provider URI |
| string providerUriQueryParameters = Apache.NMS.Util.URISupport.CreateQueryString(queryOptions); |
| string providerUriBase = GetSecureProviderURIString(); |
| string providerUri = string.Format("{0}?{1}", providerUriBase, providerUriQueryParameters); |
| |
| // Create Provider connection factory |
| IConnectionFactory connectionFactory = CreateConnectionFactory(); |
| connectionFactory.BrokerUri = new Uri(providerUri); |
| ConnectionFactory providerConnectionFactory = connectionFactory as ConnectionFactory; |
| |
| Exception connectionFailure = null; |
| bool foundCert = false; |
| |
| // use the LocalCertificateSelect callback to test the localCertificates parameter for the client certificate. |
| providerConnectionFactory.LocalCertificateSelect = (sender, targetHost, localCertificates, remoteCertificate, issuers) => |
| { |
| X509Certificate selected = null; |
| foreach (X509Certificate localCert in localCertificates) |
| { |
| byte[] localCertBytes = localCert.GetRawCertData(); |
| if (localCertBytes.Length == clientCertBytes.Length) |
| { |
| int bytesMatched = 0; |
| for (int i=0; i<localCertBytes.Length; i++) |
| { |
| |
| if (localCertBytes[i] != clientCertBytes[i]) |
| { |
| break; |
| } |
| bytesMatched++; |
| } |
| if(bytesMatched == clientCertBytes.Length) |
| { |
| foundCert = true; |
| selected = localCert; |
| break; |
| } |
| } |
| } |
| return selected; |
| }; |
| |
| using(Connection = CreateSecureConnection(connectionFactory)) |
| { |
| // Connect to invoke callback to test. |
| TestSecureConnect(Connection, out connectionFailure); |
| |
| // log connection failure for reference or debugging. |
| if (connectionFailure != null) |
| { |
| Logger.Info("Caught exception for secure connection " + connectionFailure); |
| } |
| |
| Assert.IsTrue(foundCert, "Could not find certificate {0} when added using property \"{1}\"", clientCertificateFileName, NMSPropertyConstants.NMS_SECURE_TRANSPORT_CLIENT_CERT_FILE_NAME); |
| } |
| |
| } |
| catch (Exception ex) |
| { |
| this.PrintTestFailureAndAssert(this.GetTestMethodName(), "Unexpected Exception", ex); |
| } |
| } |
| |
| /* |
| * Tests the NMSPropertyConstants.NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT property for |
| * both Values bool.TrueString and bool.FalseString. Should the true value be used the connection |
| * should not be able to throw an exception to due a validation error. Should the false value be |
| * used the connection may or not may not throw an exception depending on the broker's response. |
| */ |
| [Test] |
| public void TestAcceptInvalidServerCertificateProperty( |
| [Values(true, false)] |
| bool accepted |
| ) |
| { |
| StringDictionary props = new StringDictionary() |
| { |
| { |
| NMSPropertyConstants.NMS_SECURE_TRANSPORT_ACCEPT_INVALID_BROKER_CERT, |
| accepted ? bool.TrueString : bool.FalseString |
| } |
| }; |
| |
| try |
| { |
| // Create Provider URI |
| string providerUriQueryParameters = Apache.NMS.Util.URISupport.CreateQueryString(props); |
| string providerUriBase = GetSecureProviderURIString(); |
| string providerUri = string.Format("{0}?{1}", providerUriBase, providerUriQueryParameters); |
| |
| // Create Provider connection factory |
| this.InitConnectedFactoryProperties(props); |
| |
| IConnectionFactory connectionFactory = CreateConnectionFactory(); |
| connectionFactory.BrokerUri = new Uri(providerUri); |
| ConnectionFactory providerConnectionFactory = connectionFactory as ConnectionFactory; |
| |
| Exception connectionFailure = null; |
| |
| using (Connection = CreateSecureConnection(connectionFactory)) |
| { |
| TestSecureConnect(Connection, out connectionFailure); |
| |
| // log connection failure for reference or debugging. |
| if (connectionFailure != null) |
| { |
| Logger.Info("Caught exception for secure connection " + connectionFailure); |
| } |
| |
| /* |
| * Assert null exception on accepted to indicate any ssl errors were supressed. |
| * The connection may fail or not depending broker's response. |
| */ |
| if (accepted) |
| { |
| Assert.IsNull(connectionFailure, "Connection failed to connect. Cause {0}", connectionFailure?.Message); |
| } |
| } |
| } |
| catch (Exception ex) |
| { |
| this.PrintTestFailureAndAssert(this.GetTestMethodName(), "Unexpected Exception", ex); |
| } |
| } |
| } |
| } |
