WCF和時鐘歪斜 - 自定義綁定配置被忽略？

Question

我們的客戶正面臨同樣令人困擾的時鐘偏移問題somanyother人也是如此。

這些頁面的答案和進一步的網絡搜索幫助了很多，但我面臨着一個不同的問題。

在本地機器上進行調試時，可以看到綁定的屬性設置正確。 但是，因爲我無法在本地測試代碼（我只有一個時鐘），所以我必須將該服務發佈到測試服務器。然而，當我連接到歪斜的時鐘服務，我仍然收到MessageSecurityException s。

我的第一個想法是綁定在創建後得到修改，但我和這個項目的同事證實綁定創建了一次，之後沒有被觸及。

我明顯是做錯了。如果有人能夠闡明此事，我將非常感激。先謝謝你。

---

這是創建綁定代碼：

WSHttpBinding binding = new WSHttpBinding(); 
binding.Security.Mode = SecurityMode.TransportWithMessageCredential; 
binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName; 

// ... blah blah ... 

// fix ongoing security 
sbe.LocalClientSettings.DetectReplays = false; 
sbe.LocalClientSettings.MaxClockSkew = TimeSpan.MaxValue; 
sbe.LocalClientSettings.SessionKeyRenewalInterval = TimeSpan.MaxValue; 

sbe.LocalServiceSettings.DetectReplays = false; 
sbe.LocalServiceSettings.MaxClockSkew = TimeSpan.MaxValue; 
sbe.LocalServiceSettings.SessionKeyRenewalInterval = TimeSpan.MaxValue; 

// fix bootstrap security 
SecureConversationSecurityTokenParameters sct = null; 

if (sbe is SymmetricSecurityBindingElement) 
{ 
    SecurityTokenParameters tokenParameters = 
((SymmetricSecurityBindingElement)sbe).ProtectionTokenParameters; 
    if (tokenParameters is SecureConversationSecurityTokenParameters) 
    { 
     sct = tokenParameters as SecureConversationSecurityTokenParameters; 
    } 
} 
else if (sbe is TransportSecurityBindingElement) 
{ 
    sct = sbe.EndpointSupportingTokenParameters 
      .Endorsing 
      .OfType<SecureConversationSecurityTokenParameters>() 
      .FirstOrDefault(); 
} 
else 
{ 
    throw new ArgumentException("Binding has neiter a " + 
     "SymmetricSecurityBindingElement nor " + 
     "TransportSecurityBindingElement"); 
} 

SecurityBindingElement bootbe = sct.BootstrapSecurityBindingElement; 

bootbe.LocalClientSettings.DetectReplays = false; 
bootbe.LocalClientSettings.MaxClockSkew = TimeSpan.MaxValue; 
bootbe.LocalClientSettings.SessionKeyRenewalInterval = TimeSpan.MaxValue; 

bootbe.LocalServiceSettings.DetectReplays = false; 
bootbe.LocalServiceSettings.MaxClockSkew = TimeSpan.MaxValue; 
bootbe.LocalServiceSettings.SessionKeyRenewalInterval = TimeSpan.MaxValue; 

這是異常的調用堆棧我收到的服務跟蹤日誌：

System.ServiceModel.Security.MessageSecurityException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 

System.ServiceModel.Security.TransportSecurityProtocol.VerifyIncomingMessage(Message& message, TimeSpan timeout) 
System.ServiceModel.Security.SecurityProtocol.VerifyIncomingMessage(Message& message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates) 
System.ServiceModel.Channels.SecurityChannelListener`1.ServerSecurityChannel`1.VerifyIncomingMessage(Message& message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationState) 
System.ServiceModel.Channels.SecurityChannelListener`1.SecurityReplyChannel.ProcessReceivedRequest(RequestContext requestContext, TimeSpan timeout) 
System.ServiceModel.Channels.SecurityChannelListener`1.ReceiveItemAndVerifySecurityAsyncResult`2.OnInnerReceiveDone() 
System.ServiceModel.Channels.SecurityChannelListener`1.ReceiveItemAndVerifySecurityAsyncResult`2.InnerTryReceiveCompletedCallback(IAsyncResult result) 
System.Runtime.Fx.AsyncThunk.UnhandledExceptionFrame(IAsyncResult result) 
System.Runtime.AsyncResult.Complete(Boolean completedSynchronously) 
System.Runtime.InputQueue`1.AsyncQueueReader.Set(Item item) 
System.Runtime.InputQueue`1.Dispatch() 
System.Runtime.ActionItem.DefaultActionItem.Invoke() 
System.Runtime.ActionItem.CallbackHelper.InvokeWithoutContext(Object state) 
System.Runtime.IOThreadScheduler.ScheduledOverlapped.IOCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* nativeOverlapped) 
System.Runtime.Fx.IOCompletionThunk.UnhandledExceptionFrame(UInt32 error, UInt32 bytesRead, NativeOverlapped* nativeOverlapped) 
System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* pOVERLAP) 

Answer 1

您會收到一條MessageSecurityException如果您的郵件由於服務器和客戶端的時間差異超過時鐘偏移設置而被拒絕。鑑於你的描述，我認爲你所看到的是預期的。

According to Microsoft，一個MessageSecurityException返回，而不是更具體的事情的原因是因爲

安全例外可能會暴露一些非常敏感的信息，並且由於 到這一點，我們決定不暴露在安全層的任何細節。 例如，您提到的時鐘歪斜問題（當 暴露在故障例外中）會爲攻擊者提供服務的時鐘偏移設置 ，並提供信息以製造更多的特定攻擊。