SSL handshake + WCF + logging

Question

I have a wcf service making use of https protocol. I use certificates for client authentication as well as for transport level security.

I would like to know if there is a way out to log the details of the handshake which happens behind the scene. I am currently logging the details of the certificate the client sends (using custom certificate validator). But it is used only for client authentication.

I would like to log what happens behind the scenes. I saw in couple of places where they use netmon to view handshake related data. Is there a way to log data in some format, in case of WCF Service, which just tells about the handshake which has happened.

I have hosted my WCF service using windows service.

thanks

Answer 1

Best way is to use the graphical tool: Look at a similar path: C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.7.2 Tools

Find SvcConfigEditor.exe.

Open the web.config with it, and you can now easily add diagnostics, including what you've asked for.

Answer 2

You may be well served using a custom tracer:

Your custom tracer class:

using System.Diagnostics;

namespace MambaBase.Utils
{
    public class TraceLogger : TraceListener
    {
        private static readonly log4net.ILog log = log4net.LogManager.GetLogger(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType);
#if EXTENDED_DEBUG
        private string s(object payload)
        {
            try
            {
                return Newtonsoft.Json.JsonConvert.SerializeObject(payload, new Newtonsoft.Json.JsonSerializerSettings() { ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore });
            }
            catch (Exception)
            {
                return "°°°";
            }
        }
        public override void TraceData(TraceEventCache eventCache, string source, TraceEventType eventType, int id, object data)
        {
            if (log.IsDebugEnabled) log.Debug("eventCache:" + s(eventCache) + " / source:" + s(source) + " / eventType:" + s(eventType) + " / Id:" + id + " / data:" + s(data));
            base.TraceData(eventCache, source, eventType, id, data);
        }

        public override void TraceData(TraceEventCache eventCache, string source, TraceEventType eventType, int id, params object[] data)
        {
            if (log.IsDebugEnabled) log.Debug("eventCache:" + s(eventCache) + " / source:" + s(source) + " / eventType:" + s(eventType) + " / Id:" + id + " / data:" + s(data));
            base.TraceData(eventCache, source, eventType, id, data);
        }

        public override void TraceEvent(TraceEventCache eventCache, string source, TraceEventType eventType, int id)
        {
            if (log.IsDebugEnabled) log.Debug("eventCache:" + s(eventCache) + " / source:" + s(source) + " / eventType:" + s(eventType) + " / Id:" + id );
            base.TraceEvent(eventCache, source, eventType, id);
        }
        public override void TraceEvent(TraceEventCache eventCache, string source, TraceEventType eventType, int id, string format, params object[] args)
        {
            if (log.IsDebugEnabled) log.Debug("eventCache:" + s(eventCache) + " / source:" + s(source) + " / eventType:" + s(eventType) + " / Id:" + id + " / format:" + format + " / args:" + s(args));
            base.TraceEvent(eventCache, source, eventType, id, format, args);
        }

        public override void TraceEvent(TraceEventCache eventCache, string source, TraceEventType eventType, int id, string message)
        {
            if (log.IsDebugEnabled) log.Debug("eventCache:" + s(eventCache) + " / source:" + s(source) + " / eventType:" + s(eventType) + " / Id:" + id + " / message:" + message);
            base.TraceEvent(eventCache, source, eventType, id, message);
        }

        public override void TraceTransfer(TraceEventCache eventCache, string source, int id, string message, Guid relatedActivityId)
        {
            if (log.IsDebugEnabled) log.Debug("eventCache:" + s(eventCache) + " / source:" + s(source) + " / Id:" + id + " / message:" + message + " / relatedActivityId:" + relatedActivityId.ToString());
            base.TraceTransfer(eventCache, source, id, message, relatedActivityId);
        }
        public override void Fail(string message)
        {
            if (log.IsDebugEnabled) log.Debug("Fail - message:" + message);
            base.Fail(message);
        }

        public override void WriteLine(object o)
        {
            if (log.IsDebugEnabled) log.Debug("Trace:" + s(o));
            base.WriteLine(o);
        }
        public override void Write(object o, string category)
        {
            if (log.IsDebugEnabled) log.Debug("Trace:" + s(o) + " / category:" + category);
            base.Write(o, category);
        }
        public override void Write(string message, string category)
        {
            if (log.IsDebugEnabled) log.Debug("Trace:" + message + " / category:" + category);
            base.Write(message, category);
        }

        public override void WriteLine(object o, string category)
        {
            if (log.IsDebugEnabled) log.Debug("Trace:" + s(o) + " / category:" + category);
            base.WriteLine(o, category);
        }

        public override void Write(object o)
        {
            if (log.IsDebugEnabled) log.Debug("Trace:" + s(o) );
            base.Write(o);
        }

        public override void WriteLine(string message, string category)
        {
            if (log.IsDebugEnabled) log.Debug("Trace:" + message + " / category:" + category);
            base.WriteLine(message, category);
        }

#endif
        public override void Write(string message)
        {
#if EXTENDED_DEBUG
            if (log.IsDebugEnabled) log.Debug("Trace:" + message);
            Debug.Write(message);
#endif
        }
        public override void WriteLine(string message)
        {
            if (log.IsDebugEnabled) log.Debug("Trace ==> " + message);
            Debug.WriteLine(message);
        }
    }
}

Within the web.config or app.config of your application:

  <system.diagnostics>
    <sources>
      <source name="System.ServiceModel" switchValue="Information, ActivityTracing" propagateActivity="true">
        <listeners><add name="CustomTracer"/></listeners>
      </source>
      <source name="System.ServiceModel.MessageLogging">
        <listeners><add name="CustomTracer"/></listeners>
      </source>
      <source name="System.Net">
        <listeners><add name="CustomTracer"/></listeners>
      </source>
      <source name="System.Net.Sockets">
        <listeners><add name="CustomTracer"/></listeners>
      </source>
      <source name="System.Net.Cache">
        <listeners><add name="CustomTracer"/></listeners>
      </source>
      <source name="System.Net.Security">
        <listeners><add name="CustomTracer"/></listeners>
      </source>
      <source name="System.Security">
        <listeners><add name="CustomTracer"/></listeners>
      </source>
    </sources>
    <switches>
      <add name="System.ServiceModel" value="Verbose"/>
      <add name="System.ServiceModel.MessageLogging" value="Verbose"/>
      <add name="System.Net" value="Verbose"/>
      <add name="System.Net.Sockets" value="Verbose"/>
      <add name="System.Net.Cache" value="Verbose"/>
      <add name="System.Security" value="Verbose"/>
      <add name="System.Net.Security" value="Verbose"/>
    </switches>
    <sharedListeners>
      <add name="CustomTracer" type="MambaBase.Utils.TraceLogger, MambaBase" />
    </sharedListeners>
    <trace autoflush="true"/>
  </system.diagnostics>

  <system.serviceModel>
    <diagnostics performanceCounters="All" wmiProviderEnabled="true">
      <messageLogging logEntireMessage="true" logMalformedMessages="true" logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true" maxMessagesToLog="100000" />
    </diagnostics>
  </system.serviceModel>

Needless to say that this is going to produce loads of logging, even more so if you activate EXTENDED_DEBUG.

And the logs will contain sensitive data such as passwords.