-
Notifications
You must be signed in to change notification settings - Fork 462
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
AMQP and AMQP+WS support for X.509 authentication (#624)
* Add tests for workload client trust bundle and minor fixes * Add support for HTTP and WS X.509 auth * Address PR comments * Fix to obtain the client certificate chain * Address PR comments * Address PR comments and bug fix * AMQP and AMQP+WS support for X.509 authentication * Add tests and cleanups * Address PR comments * Rename files per PR comments * More renames * Rename EdgeHubAmqpException to EdgeAmqpException * Address PR comment and add tests accordingly
- Loading branch information
1 parent
d8aa924
commit 875776c
Showing
25 changed files
with
759 additions
and
90 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
52 changes: 52 additions & 0 deletions
52
edge-hub/src/Microsoft.Azure.Devices.Edge.Hub.Amqp/EdgeTlsTransport.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| // Copyright (c) Microsoft. All rights reserved. | ||
|
|
||
| namespace Microsoft.Azure.Devices.Edge.Hub.Amqp | ||
| { | ||
| using System.Collections.Generic; | ||
| using System.Linq; | ||
| using System.Net.Security; | ||
| using System.Security.Cryptography.X509Certificates; | ||
| using Microsoft.Azure.Amqp.Transport; | ||
| using Microsoft.Azure.Amqp.X509; | ||
| using Microsoft.Azure.Devices.Edge.Hub.Core; | ||
| using Microsoft.Azure.Devices.Edge.Hub.Core.Identity; | ||
| using Microsoft.Azure.Devices.Edge.Util; | ||
|
|
||
| public class EdgeTlsTransport : TlsTransport | ||
| { | ||
| readonly IClientCredentialsFactory clientCredentialsProvider; | ||
| readonly IAuthenticator authenticator; | ||
| private IList<X509Certificate2> remoteCertificateChain; | ||
|
|
||
| public EdgeTlsTransport( | ||
| TransportBase innerTransport, | ||
| TlsTransportSettings tlsSettings, | ||
| IAuthenticator authenticator, | ||
| IClientCredentialsFactory clientCredentialsProvider) | ||
| : base(innerTransport, tlsSettings) | ||
| { | ||
| this.clientCredentialsProvider = Preconditions.CheckNotNull(clientCredentialsProvider, nameof(clientCredentialsProvider)); | ||
| this.authenticator = Preconditions.CheckNotNull(authenticator, nameof(authenticator)); | ||
| this.remoteCertificateChain = null; | ||
| } | ||
|
|
||
| protected override X509Principal CreateX509Principal(X509Certificate2 certificate) | ||
| { | ||
| var principal = new EdgeX509Principal(new X509CertificateIdentity(certificate, true), | ||
| this.remoteCertificateChain, | ||
| this.authenticator, | ||
| this.clientCredentialsProvider); | ||
| // release chain elements from here since principal has this | ||
| this.remoteCertificateChain = null; | ||
| return principal; | ||
| } | ||
|
|
||
| protected override bool ValidateRemoteCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) | ||
| { | ||
| // copy of the chain elements since they are destroyed after this method completes | ||
| this.remoteCertificateChain = chain == null ? new List<X509Certificate2>() : | ||
| chain.ChainElements.Cast<X509ChainElement>().Select(element => element.Certificate).ToList(); | ||
| return base.ValidateRemoteCertificate(sender, certificate, chain, sslPolicyErrors); | ||
| } | ||
| } | ||
| } |
28 changes: 28 additions & 0 deletions
28
edge-hub/src/Microsoft.Azure.Devices.Edge.Hub.Amqp/EdgeTlsTransportListener.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| // Copyright (c) Microsoft. All rights reserved. | ||
|
|
||
| namespace Microsoft.Azure.Devices.Edge.Hub.Amqp | ||
| { | ||
| using Microsoft.Azure.Amqp.Transport; | ||
| using Microsoft.Azure.Devices.Edge.Hub.Core; | ||
| using Microsoft.Azure.Devices.Edge.Hub.Core.Identity; | ||
| using Microsoft.Azure.Devices.Edge.Util; | ||
|
|
||
| public class EdgeTlsTransportListener : TlsTransportListener | ||
| { | ||
| readonly IClientCredentialsFactory clientCredentialsProvider; | ||
| readonly IAuthenticator authenticator; | ||
|
|
||
| public EdgeTlsTransportListener( | ||
| TlsTransportSettings transportSettings, | ||
| IAuthenticator authenticator, | ||
| IClientCredentialsFactory clientCredentialsProvider) | ||
| : base(transportSettings) | ||
| { | ||
| this.clientCredentialsProvider = Preconditions.CheckNotNull(clientCredentialsProvider, nameof(clientCredentialsProvider)); | ||
| this.authenticator = Preconditions.CheckNotNull(authenticator, nameof(authenticator)); | ||
| } | ||
|
|
||
| protected override TlsTransport OnCreateTransport(TransportBase innerTransport, TlsTransportSettings tlsTransportSettings) => | ||
| new EdgeTlsTransport(innerTransport, tlsTransportSettings, this.authenticator, this.clientCredentialsProvider); | ||
| } | ||
| } |
37 changes: 37 additions & 0 deletions
37
edge-hub/src/Microsoft.Azure.Devices.Edge.Hub.Amqp/EdgeTlsTransportSettings.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| // Copyright (c) Microsoft. All rights reserved. | ||
|
|
||
| namespace Microsoft.Azure.Devices.Edge.Hub.Amqp | ||
| { | ||
| using System; | ||
| using Microsoft.Azure.Amqp.Transport; | ||
| using Microsoft.Azure.Devices.Edge.Hub.Core; | ||
| using Microsoft.Azure.Devices.Edge.Hub.Core.Identity; | ||
| using Microsoft.Azure.Devices.Edge.Util; | ||
|
|
||
| public class EdgeTlsTransportSettings : TlsTransportSettings | ||
| { | ||
| readonly IClientCredentialsFactory clientCredentialsProvider; | ||
| readonly IAuthenticator authenticator; | ||
|
|
||
| public EdgeTlsTransportSettings( | ||
| TransportSettings innerSettings, | ||
| bool isInitiator, | ||
| IAuthenticator authenticator, | ||
| IClientCredentialsFactory clientCredentialsProvider) | ||
| : base(innerSettings, isInitiator) | ||
| { | ||
| this.clientCredentialsProvider = Preconditions.CheckNotNull(clientCredentialsProvider, nameof(clientCredentialsProvider)); | ||
| this.authenticator = Preconditions.CheckNotNull(authenticator, nameof(authenticator)); | ||
| } | ||
|
|
||
| public override TransportListener CreateListener() | ||
| { | ||
| if (this.Certificate == null) | ||
| { | ||
| throw new InvalidOperationException("Server certificate must be set"); | ||
| } | ||
|
|
||
| return new EdgeTlsTransportListener(this, this.authenticator, this.clientCredentialsProvider); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.