Update certificate validation callback (#4071)

icerpc · Sep 16, 2024 · 170aa1e · 170aa1e
1 parent 2cbf182
commit 170aa1e
Show file tree

Hide file tree

Showing 10 changed files with 130 additions and 60 deletions.
diff --git a/examples/protobuf/GenericHost/Client/Program.cs b/examples/protobuf/GenericHost/Client/Program.cs
@@ -42,12 +42,19 @@
                     // validate the peer certificates.
                     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
                     {
-                        using var customChain = new X509Chain();
-                        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-                        customChain.ChainPolicy.DisableCertificateDownloads = true;
-                        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-                        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-                        return customChain.Build((X509Certificate2)certificate!);
+                        if (certificate is X509Certificate2 peerCertificate)
+                        {
+                            using var customChain = new X509Chain();
+                            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+                            customChain.ChainPolicy.DisableCertificateDownloads = true;
+                            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+                            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+                            return customChain.Build(peerCertificate);
+                        }
+                        else
+                        {
+                            return false;
+                        }
                     }
                 };
             });

diff --git a/examples/protobuf/Quic/Client/Program.cs b/examples/protobuf/Quic/Client/Program.cs
@@ -14,12 +14,19 @@
 {
     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
     {
-        using var customChain = new X509Chain();
-        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-        customChain.ChainPolicy.DisableCertificateDownloads = true;
-        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-        return customChain.Build((X509Certificate2)certificate!);
+        if (certificate is X509Certificate2 peerCertificate)
+        {
+            using var customChain = new X509Chain();
+            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            customChain.ChainPolicy.DisableCertificateDownloads = true;
+            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+            return customChain.Build(peerCertificate);
+        }
+        else
+        {
+            return false;
+        }
     }
 };
 

diff --git a/examples/protobuf/Secure/Client/Program.cs b/examples/protobuf/Secure/Client/Program.cs
@@ -13,12 +13,19 @@
 {
     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
     {
-        using var customChain = new X509Chain();
-        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-        customChain.ChainPolicy.DisableCertificateDownloads = true;
-        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-        return customChain.Build((X509Certificate2)certificate!);
+        if (certificate is X509Certificate2 peerCertificate)
+        {
+            using var customChain = new X509Chain();
+            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            customChain.ChainPolicy.DisableCertificateDownloads = true;
+            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+            return customChain.Build(peerCertificate);
+        }
+        else
+        {
+            return false;
+        }
     }
 };
 

diff --git a/examples/protobuf/TcpFallback/Client/Program.cs b/examples/protobuf/TcpFallback/Client/Program.cs
@@ -18,12 +18,19 @@
 {
     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
     {
-        using var customChain = new X509Chain();
-        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-        customChain.ChainPolicy.DisableCertificateDownloads = true;
-        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-        return customChain.Build((X509Certificate2)certificate!);
+        if (certificate is X509Certificate2 peerCertificate)
+        {
+            using var customChain = new X509Chain();
+            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            customChain.ChainPolicy.DisableCertificateDownloads = true;
+            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+            return customChain.Build(peerCertificate);
+        }
+        else
+        {
+            return false;
+        }
     }
 };
 

diff --git a/examples/slice/GenericHost/Client/Program.cs b/examples/slice/GenericHost/Client/Program.cs
@@ -42,12 +42,19 @@
                     // validate the peer certificates.
                     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
                     {
-                        using var customChain = new X509Chain();
-                        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-                        customChain.ChainPolicy.DisableCertificateDownloads = true;
-                        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-                        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-                        return customChain.Build((X509Certificate2)certificate!);
+                        if (certificate is X509Certificate2 peerCertificate)
+                        {
+                            using var customChain = new X509Chain();
+                            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+                            customChain.ChainPolicy.DisableCertificateDownloads = true;
+                            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+                            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+                            return customChain.Build(peerCertificate);
+                        }
+                        else
+                        {
+                            return false;
+                        }
                     }
                 };
             });

diff --git a/examples/slice/Quic/Client/Program.cs b/examples/slice/Quic/Client/Program.cs
@@ -14,12 +14,19 @@
 {
     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
     {
-        using var customChain = new X509Chain();
-        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-        customChain.ChainPolicy.DisableCertificateDownloads = true;
-        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-        return customChain.Build((X509Certificate2)certificate!);
+        if (certificate is X509Certificate2 peerCertificate)
+        {
+            using var customChain = new X509Chain();
+            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            customChain.ChainPolicy.DisableCertificateDownloads = true;
+            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+            return customChain.Build(peerCertificate);
+        }
+        else
+        {
+            return false;
+        }
     }
 };
 

diff --git a/examples/slice/Secure/Client/Program.cs b/examples/slice/Secure/Client/Program.cs
@@ -13,12 +13,19 @@
 {
     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
     {
-        using var customChain = new X509Chain();
-        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-        customChain.ChainPolicy.DisableCertificateDownloads = true;
-        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-        return customChain.Build((X509Certificate2)certificate!);
+        if (certificate is X509Certificate2 peerCertificate)
+        {
+            using var customChain = new X509Chain();
+            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            customChain.ChainPolicy.DisableCertificateDownloads = true;
+            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+            return customChain.Build(peerCertificate);
+        }
+        else
+        {
+            return false;
+        }
     }
 };
 

diff --git a/examples/slice/TcpFallback/Client/Program.cs b/examples/slice/TcpFallback/Client/Program.cs
@@ -18,12 +18,19 @@
 {
     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
     {
-        using var customChain = new X509Chain();
-        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-        customChain.ChainPolicy.DisableCertificateDownloads = true;
-        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-        return customChain.Build((X509Certificate2)certificate!);
+        if (certificate is X509Certificate2 peerCertificate)
+        {
+            using var customChain = new X509Chain();
+            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            customChain.ChainPolicy.DisableCertificateDownloads = true;
+            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+            return customChain.Build(peerCertificate);
+        }
+        else
+        {
+            return false;
+        }
     }
 };
 

diff --git a/src/IceRpc.Templates/Templates/IceRpc-Protobuf-Client/Program.cs b/src/IceRpc.Templates/Templates/IceRpc-Protobuf-Client/Program.cs
@@ -21,12 +21,19 @@
 {
     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
     {
-        using var customChain = new X509Chain();
-        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-        customChain.ChainPolicy.DisableCertificateDownloads = true;
-        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-        return customChain.Build((X509Certificate2)certificate!);
+        if (certificate is X509Certificate2 peerCertificate)
+        {
+            using var customChain = new X509Chain();
+            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            customChain.ChainPolicy.DisableCertificateDownloads = true;
+            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+            return customChain.Build(peerCertificate);
+        }
+        else
+        {
+            return false;
+        }
     }
 };
 

diff --git a/src/IceRpc.Templates/Templates/IceRpc-Slice-Client/Program.cs b/src/IceRpc.Templates/Templates/IceRpc-Slice-Client/Program.cs
@@ -21,12 +21,19 @@
 {
     RemoteCertificateValidationCallback = (sender, certificate, chain, errors) =>
     {
-        using var customChain = new X509Chain();
-        customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
-        customChain.ChainPolicy.DisableCertificateDownloads = true;
-        customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
-        customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
-        return customChain.Build((X509Certificate2)certificate!);
+        if (certificate is X509Certificate2 peerCertificate)
+        {
+            using var customChain = new X509Chain();
+            customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+            customChain.ChainPolicy.DisableCertificateDownloads = true;
+            customChain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+            customChain.ChainPolicy.CustomTrustStore.Add(rootCA);
+            return customChain.Build(peerCertificate);
+        }
+        else
+        {
+            return false;
+        }
     }
 };