//******************************************************************************************************//  SimpleCertificateChecker.cs - Gbtc////  Copyright © 2012, Grid Protection Alliance.  All Rights Reserved.////  Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See//  the NOTICE file distributed with this work for additional information regarding copyright ownership.//  The GPA licenses this file to you under the MIT License (MIT), the "License"; you may//  not use this file except in compliance with the License. You may obtain a copy of the License at:////      http://www.opensource.org/licenses/MIT////  Unless agreed to in writing, the subject software distributed under the License is distributed on an//  "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the//  License for the specific language governing permissions and limitations.////  Code Modification History://  ----------------------------------------------------------------------------------------------------//  11/06/2012 - Stephen C. Wills//       Generated original version of source code.//  12/14/2012 - Starlynn Danyelle Gilliam//       Modified Header.////****************************************************************************************************** using System.Collections.Generic;using System.Linq;using System.Net.Security;using System.Security.Cryptography.X509Certificates; namespace GSF.Net.Security{    /// <summary>    /// Simple implementation of <see cref="ICertificateChecker"/>.    /// </summary>    public class SimpleCertificateChecker : ICertificateChecker    {        #region [ Members ]         // Fields        private readonly List<X509Certificate> m_trustedCertificates;        private SslPolicyErrors m_validPolicyErrors;        private X509ChainStatusFlags m_validChainFlags;        private string m_reasonForFailure;         #endregion         #region [ Constructors ]         /// <summary>        /// Creates a new instance of the <see cref="SimpleCertificateChecker"/> class.        /// </summary>        public SimpleCertificateChecker()        {            m_trustedCertificates = new List<X509Certificate>();            m_validPolicyErrors = SslPolicyErrors.None;            m_validChainFlags = X509ChainStatusFlags.NoError;        }         #endregion         #region [ Properties ]         /// <summary>        /// Gets the list of certificates on the system which are        /// considered trusted when validating remote certificates.        /// </summary>        public List<X509Certificate> TrustedCertificates        {            get            {                return m_trustedCertificates;            }        }         /// <summary>        /// Gets or sets the set of invalid policy errors.        /// </summary>        public SslPolicyErrors ValidPolicyErrors        {            get            {                return m_validPolicyErrors;            }            set            {                m_validPolicyErrors = value;            }        }         /// <summary>        /// Gets or sets the set of invalid chain flags.        /// </summary>        public X509ChainStatusFlags ValidChainFlags        {            get            {                return m_validChainFlags;            }            set            {                m_validChainFlags = value;            }        }         /// <summary>        /// Gets the reason why the remote certificate validation        /// failed, or null if certificate validation did not fail.        /// </summary>        public string ReasonForFailure        {            get            {                return m_reasonForFailure;            }        }         #endregion         #region [ Methods ]         /// <summary>        /// Validates the given remote certificate to determine if the host is trusted.        /// </summary>        /// <param name="remoteCertificate">Certificate of the remote host.</param>        /// <returns>True if the remote certificate is trusted; false otherwise.</returns>        public bool ValidateRemoteCertificate(X509Certificate remoteCertificate)        {            byte[] hash = remoteCertificate.GetCertHash();            byte[] key = remoteCertificate.GetPublicKey();            bool hashMatch, keyMatch;             foreach (X509Certificate certificate in TrustedCertificates)            {                hashMatch = hash.SequenceEqual(certificate.GetCertHash());                keyMatch = hashMatch && key.SequenceEqual(certificate.GetPublicKey());                 if (keyMatch)                    return true;            }             m_reasonForFailure = "No matching certificate found in the list of trusted certificates.";             return false;        }         /// <summary>        /// Verifies the remote certificate used for authentication.        /// </summary>        /// <param name="sender">An object that contains state information for this validation.</param>        /// <param name="remoteCertificate">The certificate used to authenticate the remote party.</param>        /// <param name="chain">The chain of certificate authorities associated with the remote certificate.</param>        /// <param name="errors">One or more errors associated with the remote certificate.</param>        /// <returns>A flag that determines whether the specified certificate is accepted for authentication.</returns>        public bool ValidateRemoteCertificate(object sender, X509Certificate remoteCertificate, X509Chain chain, SslPolicyErrors errors)        {            X509ChainStatusFlags chainFlags;            m_reasonForFailure = null;             if ((errors & ~m_validPolicyErrors) != SslPolicyErrors.None)            {                m_reasonForFailure = string.Format("Policy errors encountered during validation: {0}", errors & ~m_validPolicyErrors);                return false;            }             chainFlags = chain.ChainStatus.Aggregate(X509ChainStatusFlags.NoError, (flags, status) => flags | (status.Status & ~m_validChainFlags));             if (chainFlags != X509ChainStatusFlags.NoError)            {                m_reasonForFailure = string.Format("Invalid chain flags found during validation: {0}", chainFlags);                return false;            }             return ValidateRemoteCertificate(remoteCertificate);        }         #endregion    }}