C# SslPolicyErrors.HasFlag方法代码示例

        private bool ValidateCertificateHttpHandler(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) {
            if (_cancellationToken.IsCancellationRequested) {
                return false;
            }

            IsVerified = sslPolicyErrors == SslPolicyErrors.None;
            if (IsVerified) {
                return true;
            }

            if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNotAvailable)) {
                Log.WriteAsync(LogVerbosity.Minimal, MessageCategory.Error, Resources.Error_NoBrokerCertificate).DoNotWait();
                _console.Write(Resources.Error_NoBrokerCertificate.FormatInvariant(Name));
                return false;
            }

            if (_services.MainThread.ThreadId == Thread.CurrentThread.ManagedThreadId) {
                // Prevent potential deadlock if handler enters on background thread, then re-enters on main thread
                // before ValidateX509CertificateAsync is able to transition to the UI thread.
                // At worst the connection fails
                return _certificateValidationResult.HasValue ? _certificateValidationResult.Value : false;
            }

            lock (_verificationLock) {
                if (_certificateValidationResult.HasValue) {
                    return _certificateValidationResult.Value;
                }

                var hashString = certificate.GetCertHashString();
                if (_certificateHash == null || !_certificateHash.EqualsOrdinal(hashString)) {
                    Log.WriteAsync(LogVerbosity.Minimal, MessageCategory.Warning, Resources.Trace_UntrustedCertificate.FormatInvariant(certificate.Subject)).DoNotWait();

                    var message = Resources.CertificateSecurityWarning.FormatInvariant(Uri.Host);
                    var task = _services.Security.ValidateX509CertificateAsync(certificate, message, _cancellationToken);
                    _services.Tasks.Wait(task, _cancellationToken);

                    _certificateValidationResult = task.Result;
                    if (_certificateValidationResult.Value) {
                        _certificateHash = hashString;
                    }
                }
                return _certificateValidationResult.HasValue ? _certificateValidationResult.Value : false;
            }
        }

        /// <summary>
        /// Called by the US.OpenServer.Server and the US.OpenServer.Client.Client
        /// to verify the remote Secure Sockets Layer (SSL) certificate used for
        /// authentication.
        /// </summary>
        /// <param name="sender">An object that contains state information for this validation.</param>
        /// <param name="certificate">The certificate used to authenticate the remote party.</param>
        /// <param name="chain">The chain of certificate authorities associated with the remote certificate.</param>
        /// <param name="sslPolicyErrors">One or more errors associated with the remote certificate.</param>
        /// <returns>True if the specified certificate is accepted for authentication, otherwise False.</returns>
        public bool TlsCertificateValidationCallback(
            object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
        {
            if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNameMismatch))
            {
                Log(Level.Error, "[TLS] Remote certificate name mismatch.");
                return false;
            }

            if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNotAvailable))
            {
                if (TlsConfiguration.RequireRemoteCertificate)
                {
                    Log(Level.Error, "[TLS] Remote certificate not available.");
                    return false;
                }
                else
                {
                    Log(Level.Debug, "[TLS] Remote certificate not available.");
                }
            }

            if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateChainErrors))
            {
                if (!TlsConfiguration.AllowCertificateChainErrors)
                {
                    Log(Level.Error, "[TLS] Remote certificate contains chain errors.");
                    return false;
                }
                else
                {
                    Log(Level.Debug, "[TLS] Remote certificate contains chain errors.");
                }
            }
            Log(Level.Info, "[TLS] Certificate validated.");
            return true;
        }

        private bool RemoteCertificateValidationCallback(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors, ClientNetworkConfig clientNetworkConfig)
        {
            if (sslPolicyErrors == SslPolicyErrors.None)
            {
                return true;
            }

            var validation = true;

            if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateChainErrors))
            {
                var isValidateChain = clientNetworkConfig.GetSSLConfig().IsValidateCertificateChain();
                if (isValidateChain)
                {
                    Logger.Warning("Certificate error:" + sslPolicyErrors);
                    validation = false;
                }
                else
                {
                    Logger.Info("SSL Configured to ignore Certificate chain validation. Ignoring:");
                }
                foreach (var status in chain.ChainStatus)
                {
                    Logger.Info("Certificate chain status:" + status.StatusInformation);
                }
            }
            if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNameMismatch))
            {
                var isValidateName = clientNetworkConfig.GetSSLConfig().IsValidateCertificateName();
                if (isValidateName)
                {
                    Logger.Warning("Certificate error:" + sslPolicyErrors);
                    validation = false;
                }
                else
                {
                    Logger.Info("Certificate name mismatched but client is configured to ignore Certificate name validation.");
                }
            }
            if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNotAvailable))
            {
                Logger.Warning("Certificate error:" + sslPolicyErrors);
                validation = false;
            }
            return validation;
        }

        private bool ValidateCertificate(object s, X509Certificate cert, X509Chain chain, SslPolicyErrors error)
        {
            if (error.HasFlag(SslPolicyErrors.RemoteCertificateNameMismatch) || error.HasFlag(SslPolicyErrors.RemoteCertificateChainErrors))
            {

                // This is for local deployments. DevFabric generates its own certificate for load-balancing / port forwarding.
                const string AzureDevFabricCertificateSubject = "CN=127.0.0.1, O=TESTING ONLY, OU=Windows Azure DevFabric";
                if (cert.Subject == AzureDevFabricCertificateSubject)
                {
                    return true;
                }
                var cert2 = new X509Certificate2(cert);
                if (this._trustedRestSubject == cert2.Subject && cert2.Thumbprint == this._trustedRestCertificateHash)
                {
                    return true;
                }
            }

            return error == SslPolicyErrors.None;
        }

        bool ValidateCertificate(object sender, X509Certificate clientCertificate, X509Chain chain, SslPolicyErrors sslpolicyerrors)
        {
            if (sslpolicyerrors.HasFlag(SslPolicyErrors.RemoteCertificateNotAvailable))
                return false;

            return options.ClientCertificateValidator(new X509Certificate2(clientCertificate)) == CertificateValidationResult.Valid;
        }

        private bool CheckServerCertificate(object sender, X509Certificate cert, X509Chain chain, SslPolicyErrors sslPolicyErrors)
        {
            var serverName = (sender is string) ? sender : ((WebRequest)sender).RequestUri.Host;
            _strategy.LogAction("verifying the server certificate for requested server '{0}'", serverName);
            if (sslPolicyErrors != SslPolicyErrors.None)
            {
                var reasons = new List<string>();
                if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNotAvailable))
                    reasons.Add("the certificate was not returned");
                if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateNameMismatch))
                    reasons.Add(string.Format("the certificate name ({0}) does not match the requested server name",
                                              cert.Subject));
                if (sslPolicyErrors.HasFlag(SslPolicyErrors.RemoteCertificateChainErrors))
                {
                    reasons.Add(string.Format("the certificate chain has errors ({0})",
                                              string.Join("; ", chain.ChainStatus.Select(x => x.StatusInformation))));
                }
                _strategy.LogStatus("The server is not trusted: {0}.", string.Join("; ", reasons));
                return false;
            }

            _strategy.LogAction("verifying that actual server '{0}' was trusted", cert.Subject);
            var m = Regex.Match(cert.Subject, "O=(?'orgid'[^,]+)");
            if (!m.Success)
            {
                _strategy.LogStatus("could not find the organization ID in the certificate subject");
                return false;
            }
            var g = m.Groups["orgid"];
            if (g == null)
            {
                _strategy.LogStatus("could not find the organization ID in the certificate subject (regex said it was there but didn't return it)");
                return false;
            }

            var orgId = g.Value;

            /* TODO
            if (!_info.TrustedOrgIds.Contains(orgId))
            {
                _environment.LogStatus("organization '{0}' is not trusted", orgId);
                return false;
            }
            */
            _strategy.LogStatus("the server is trusted.");
            return true;
        }