指定签名时加密 WCF 消息 (net.msmq)

Question

我正在使用 WCF 通过 MSMQ（net.msmq 协议）发送消息。一切顺利，BizTalk 服务器接收消息并处理它。但是，当我查看 SVCLOG 时，我发现当我专门将 MsmqProtectionLevel 设置为 Sign 时，消息已加密。

还有其他人看到过这种行为吗？是否可以停止加密？我的一些消息超过 1MB，加密使速度变得非常慢。

提前致谢！

  ChannelFactory<OnRampEntry> Factory
  {
     get
     {
        if (factory == null)
        {
           lock (this)
           {
              if (factory == null)
              {
                 var uri = ResolveQueueName(new Uri(Url));
                 var identity = EndpointIdentity.CreateDnsIdentity(BizTalkIdentity);
                 var binding = new NetMsmqBinding(NetMsmqSecurityMode.Both)
                 {
                    DeadLetterQueue = DeadLetterQueue.System,
                    ExactlyOnce = true
                 };
                 binding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;
                 binding.Security.Transport.MsmqProtectionLevel = System.Net.Security.ProtectionLevel.Sign;
                 binding.Security.Transport.MsmqAuthenticationMode = MsmqAuthenticationMode.WindowsDomain;
                 binding.Security.Transport.MsmqSecureHashAlgorithm = MsmqSecureHashAlgorithm.Sha1;
                 factory = new ChannelFactory<OnRampEntry>(binding, new EndpointAddress(uri, identity, (AddressHeaderCollection) null));
                 factory.Endpoint.Behaviors.Add(new LogonCertificateBehavior());
                 factory.Credentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.LocalMachine, StoreName.TrustedPeople, X509FindType.FindBySubjectName, BizTalkIdentity);
                 factory.Open();
              }
           }
        }
        return factory;
     }
  }

  /// <summary>
  ///   MSMQ does not allow a DNS alias to be used in a queue name, e.g. "net.msmq://alias/private$/queue".
  ///   <b>ResolveQueueName</b> will tranlsate an alias to its actual machine name.
  /// </summary>
  /// <param name="uri"></param>
  /// <returns></returns>
  Uri ResolveQueueName(Uri uri)
  {
     var hostName = uri.DnsSafeHost;

     try
     {
        var hostEntry = Dns.GetHostEntry(hostName);
        var resolved = new Uri(uri.ToString().Replace(hostName, hostEntry.HostName));

        if (log.IsDebugEnabled)
           log.Debug(string.Format("Resolved '{0}' to '{1}'.", uri, resolved));
        return resolved;
     }
     catch (SocketException e)
     {
        if (e.SocketErrorCode == SocketError.HostNotFound)
           return uri;
        throw e;
     }
  }

Answer 1

消息加密的原因是使用 NetMsmqSecurityMode.Both - 传输安全和消息安全。

var binding = new NetMsmqBinding(NetMsmqSecurityMode.Both)

在传输级别，上面的配置使用

binding.Security.Transport.MsmqProtectionLevel = System.Net.Security.ProtectionLevel.Sign;

查看 WCF 日志，将无法查看传输级别的设置，因为消息级别加密已到位。

不幸的是，这并不能回答如何在不使用证书加密消息正文的情况下对消息进行签名（使用 X.509 证书）的问题。