Jon Cole

New MSDN articles about WCF and WF

JonCole — Fri, 09 Sep 2011 09:56:10 GMT

MSDN recently published a series of new articles about WCF and WF. Take a look and let me know what you think…

Workflow Services
Describes how to create and configure workflow services.

Endpoints: Addresses, Bindings, and Contracts
Describes how to control multiple aspects of your service.

Data Transfer and Serialization
Describes how serialization of data can be tailored for interoperation or future compatibility.

Sessions, Instancing, and Concurrency
Describes the instancing and session modes of WCF and how to select the right mode for your application.

Transports in Windows Communication Foundation
Describes how to configure the transport layer, the lowest level of the channel stack.

Queues and Reliable Sessions
Describes queues, which store messages from a sending application on behalf of a receiving application and later forward these messages to the receiving application.

Transactions
Explains how to created transacted operations that can be rolled back if needed.

Windows Communication Foundation Security
Describes how WCF security helps you to create applications that have confidentiality and integrity. Authentication and authorization are also available, as are auditing features.

Peer-to-Peer Networking
Details how to create peer services and clients.

Metadata
Describes metadata architecture and formats.

Clients
Describes how to create a variety of clients that access services.

Hosting
Describes hosting. A service can be hosted by another application, or it can be self-hosted.

Interoperability and Integration
Describes how to use WCF to extend your existing logic rather than having to rewrite it if you have a substantial investment in component-based application logic hosted in COM+.

WCF Web HTTP Programming Model
Describes the WCF Web Programming Model that allows developers to expose WCF service operations to non-SOAP endpoints.

WCF Syndication
Describes support to easily expose syndication feeds from a WCF service.

AJAX Integration and JSON Support
Describes support for ASP.NET Asynchronous JavaScript and XML (AJAX) and the Javascript Object Notation (JSON) data format to allow WCF services to expose operations to AJAX clients.

WCF Discovery
Describes support to enable services to be discoverable at runtime in an interoperable way using the WS-Discovery protocol.

Routing
Describes the routing service.

This same list can be found here.

WCF Keep Alive Channel

JonCole — Tue, 24 May 2011 09:46:02 GMT

Customers periodically ask for a way to enable TCP Keep Alive on the underlying socket for the TCP transport in WCF. The most often reason I hear this request is to workaround an idle timeout on some intermediary device (like a proxy or load balancer). However, TCP Keep alive is a hop by hop solution that will usually only solve the problem for the connection between the client and the first intermediary device on the network. If there are multiple intermediary devices between the client and server, then TCP Keep alive probably won’t solve the problem.

One team here at Microsoft solved this problem by implementing a KeepAlive WCF Layered channel that sends application-transparent soap messages as necessary to keep the channel alive. The code was tested quite heavily by the team that implemented it and they agreed to allow us to publish it for others to use. If you are interested, you can find the code at https://code.msdn.microsoft.com/WCF-Azure-NetTCP-Keep-Alive-09f50fd9.

Fix available for SMSvcHost.exe Event Log ID 8 issue

JonCole — Fri, 22 Apr 2011 16:55:17 GMT

A fix for the SMSvcHost.exe Event ID 8 issue described here has now been published. The download can be found at here: The associated KB article has details of where to get the fix. https://support.microsoft.com/en-us/kb/2536618

Server-side Tcp Connection pooling

JonCole — Tue, 26 Oct 2010 15:49:37 GMT

An internal customer was asking how to control connection pooling on the server side of WCF for the Tcp Transport. There are two knobs to control this behavior. The first controls how long a connection can stay open while waiting to be reused and can be set through the IdleTimeout property on the TcpConnectionPoolSettings object, which is exposed from the TcpTransportBindingElement. The second controls how many connections can live in the server’s connection pool waiting for reuse and can be set through either the MaxOutboundConnectionsPerEndpoint property on the TcpConnectionPoolSettings or through the MaxConnections property on the NetTcpBinding.

SMSvcHost.exe Event Log ID 8 - An error occurred while dispatching a duplicated socket: this handle is now leaked in the process

JonCole — Tue, 29 Jun 2010 15:34:00 GMT

Recently, I have worked with several internal and external customers that are hitting an odd error when using WCF's TCP Port Sharing Service or Tcp Activation Service. The symptoms include client's timing out during channel open, an event log entry on the server, and, in some cases, a server process that doesn't ever respond to new connection requests once this problem occurs.

The Symptoms:

The two symptoms that are consistently seen for each customer reporting this issue are:

An entry in the Windows Event Log that looked something like this:
Log Name:      System
Source:        SMSvcHost 3.0.0.0
Date:          2/3/2010 3:18:25 PM
Event ID:      8
Task Category: Sharing Service
Level:         Error
Keywords:      Classic
User:          LOCAL SERVICE
Computer:      Server1.Contoso.com
Description: An error occurred while dispatching a duplicated socket: this handle is now leaked in the process.
ID: 6408
Source: System.ServiceModel.Activation.TcpWorkerProcess/54166759
Exception: System.TimeoutException: This request operation sent to https://schemas.microsoft.com/2005/12/ServiceModel/Addressing/Anonymous did not receive a reply within the configured timeout (00:01:00). The time allotted to this operation may have been a portion of a longer timeout. This may be because the service is still processing the operation or because the service was unable to send a reply message. Please consider increasing the operation timeout (by casting the channel/proxy to IContextChannel and setting the OperationTimeout property) and ensure that the service is able to connect to the client.

Server stack trace:
   at System.ServiceModel.AsyncResult.End[TAsyncResult](IAsyncResult result)
   at System.ServiceModel.Channels.ServiceChannel.SendAsyncResult.End(SendAsyncResult result)
   at System.ServiceModel.Channels.ServiceChannel.EndCall(String action, Object[] outs, IAsyncResult result)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeEndService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
Exception rethrown at [0]:
   at System.ServiceModel.AsyncResult.End[TAsyncResult](IAsyncResult result)
   at System.ServiceModel.Activation.WorkerProcess.EndDispatchSession(IAsyncResult result)

Process Name: SMSvcHost
Process ID: 4056
An entry in the WCF traces for the service (w3wp.exe or your process using port sharing service) showed the following error:

System.ServiceModel.CommunicationException: There was an error reading from the pipe: The pipe has been ended. (109, 0x6d).
--->System.IO.PipeException: There was an error reading from the pipe: The pipe has been ended. (109, 0x6d).
at System.ServiceModel.Channels.PipeConnection.OnAsyncReadComplete(Boolean haveResult, Int32 error, Int32 numBytes)
--- End of inner exception stack trace ---
at System.ServiceModel.Channels.PipeConnection.EndRead()
at System.ServiceModel.Channels.DelegatingConnection.EndRead()
at System.ServiceModel.Channels.TracingConnection.EndRead()
at System.ServiceModel.Channels.SessionConnectionReader.OnAsyncReadComplete(Object state)

What causes this to occur?

It turns out there are three known issues (there may be more) that can cause this problem:

The CPU Spikes to 100% and last longer than 1 minute.
- System CPU is too busy to process IO operations. If the system is too busy, it will not be able to process incoming requests from SMSvcHost.exe and those requests will timeout.
- The best tool for figuring out if this is what is causing your problem is going to be perfmon - capture CPU perfmon logs for your process and watch for spikes that last for 1 minute or longer.
Long running service operations (> 1 minute) with service throttling enabled.
- In one customer’s case, they had configured the MaxConcurrentCalls throttle on the ServiceThrottlingBehavior to 16, then inside of their service operations they were calling out to a back end service. The calls to the back end service were taking longer than they expected, causing 16 operations to be blocked within the service, which resulted in the MaxConcurrentCalls throttle being hit.
- You can detect this problem by turning on warning level trace for WCF. Any time a throttle is hit, we will log a warning to the trace log.
Service is hosted in IIS and it takes a long time to activate the service when the first message is received.
- For example, one customer hit this when the signature validation for the assemblies tried to check for revoked certificates. The call to check the cert was timing out, which resulted in 15 seconds delay for each signed assembly. Since they had multiple signed assemblies, the delay was larger than 1 minute. Here is a blog post about certification validation delays and they ways to workaround these problems.
- In another case, the customer's application was taking longer than 1 minute for the code to compile. Pre-compiling the application before deploying is one possible workaround in this instance.

Digging into the problem:

When using TCP port sharing or activation in IIS, the listening TCP socket actually resides inside SMSvcHost.exe. When a new connection arrives from a client, we read the “preamble” on the connection, which includes the via address which helps us know which service needs to handle this client connection. Once we identify the target service that should handle the connection, we duplicate the socket handle and then send it over a named pipe connection to the target service. In current releases, we have hard coded the timeout for the call to give the socket handle to the service to 1 minute. If that call takes longer than 1 minute, we kill the named pipe connection and log the event log.

The reason the “handle is now leaked in the process” is due to the way the socket handle gets duplicated. When calling into windows to create a duplicate handle to that socket, we tell the API which process should own the duplicated handle. Since the duplicated handle is owned by the target service process, SMSvcHost.exe cannot close the handle – only the target process can close it. Given that we failed to let the other process know that it now owns that handle, it will not close that handle until that process is closed and the OS does the auto-closing of all opened handles.

Most of the customers I have worked with on this issue have been able to capture a memory dump of the service process (e.g. w3wp.exe) by breaking into the debugger on the first chance exception of type System.IO.PipeException. This dump allows you to see what is happening inside the service process at the time the named pipe connection gets closed due to a timeout inside of SMSvcHost.exe.

Unfortunately, there isn’t currently a fix available, but we will try to address some of these pain points in upcoming releases. If you find that this issue is blocking you, please contact customer support.

Update: A fix is now available.

TCP Port sharing - Access is denied

JonCole — Thu, 10 Jun 2010 18:46:00 GMT

I recently helped a customer who ran into this error:

System.ServiceModel.CommunicationException: The service endpoint failed to listen on the URI 'net.tcp://localhost/CalcultorService.svc/' because access was denied. Verify that the current user is granted access in the appropriate allowAccunts section of SMSvcHost.exe.config. ---> System.ComponentModel.Win32Exception: Access is denied

They had updated the section of the smsvchost.exe.config file as described here and then restarted the Net.Tcp port sharing service but still hit this error. However, they didn't realize that there are additional services running inside of that same instance of the process. The services that share the same process instance are:

Net.Tcp Listener Adapter
Net.Tcp Port Sharing Service
Net.Pipe Listener Adapter
Net.Msmq Listener Adapter Correction: I realized after posting this that the Net.Msmq service actually runs in different instance of SMSvcHost.exe, so you shouldn't have to restart that service.

If any of those services are running on your machine, then you have to stop all of them, then restart them in order for the changes to the configuration file be picked up. Restarting the machine will also do the trick.

Impersonation code in C#

JonCole — Mon, 21 Sep 2009 13:06:00 GMT

While investigating a customer issue, I needed code to impersonate a different user on the current thread. A quick search of the msdn blogs turned up this post, which got me most of the way there. I decided to wrap the code into a class that inherits from IDisposable just to make it easily usable in a using statement. Here is what I came up with:

using System;

using System.ComponentModel;

using System.Runtime.InteropServices;

using System.Security.Principal;

public class ImpersonatedUser : IDisposable

{

IntPtr userHandle;

WindowsImpersonationContext impersonationContext;

public ImpersonatedUser(string user, string domain, string password)

{

userHandle = IntPtr.Zero;

bool loggedOn = LogonUser(

user,

domain,

password,

LogonType.Interactive,

LogonProvider.Default,

out userHandle);

if (!loggedOn)

throw new Win32Exception(Marshal.GetLastWin32Error());

// Begin impersonating the user

impersonationContext = WindowsIdentity.Impersonate(userHandle);

}

public void Dispose()

{

if (userHandle != IntPtr.Zero)

{

CloseHandle(userHandle);

userHandle = IntPtr.Zero;

impersonationContext.Undo();

}

[DllImport("advapi32.dll", SetLastError = true)]

static extern bool LogonUser(

string lpszUsername,

string lpszDomain,

string lpszPassword,

LogonType dwLogonType,

LogonProvider dwLogonProvider,

out IntPtr phToken

);

[DllImport("kernel32.dll", SetLastError = true)]

static extern bool CloseHandle(IntPtr hHandle);

enum LogonType : int

{

Interactive = 2,

Network = 3,

Batch = 4,

Service = 5,

NetworkCleartext = 8,

NewCredentials = 9,

}

enum LogonProvider : int

{

Default = 0,

}

Sample Asynchronous SslStream Client/Server Implementation

JonCole — Wed, 13 Jun 2007 15:01:00 GMT

I was recently asked about sample code for the System.Net.Security.SslStream using the asynchronous APIs. I searched the web and couldn't find anything significant, so I decided to write some that included the asynchronous usage of the TcpListenter and TcpClient objects (both in the System.Net.Sockets namespace). In this post, I will show both the client and server side of the picture.

The person that was requesting this sample code seemed pretty anxious to get it, so I pumped this out pretty quickly, and as such, there are probably some bugs in it – please let me know of any you find and I will fix them. My goal here is to introduce the concepts and is not to provide production ready code. There are some things that I plan on changing about this code, but this should be a good starting place for anyone unfamiliar with the usage. Watch for “To Do Items” sections where I try to call out some of the things that I would like to add at some point, but you may need to add to your own code in the mean time…

To start, here is some helper code that is shared between client and server code.

Common Code:

The delegate function definition is used to notify you that a secure connection attempt is either ready for use or that an asynchronous error occurred. The SecureConnectionResults class is merely a holder for the results. You will need to provide an implementation of this delegate function.

When you delegate function is called, you will need to check for any asynchronous exception that may have occurred by looking at the SecureConnectionResults.AsyncException property. If it is null, then the SslStream object should be ready for use. Also, you will want to note that the SecureConnectionResultsCallback will be invoked on a Threadpool thread, so you won’t want to hold onto that thread permanently as it is a limited resource.

To Do Items:

· May also want to expose the underlying socket through the SecureConnectionResults object. This would allow you to change socket options or switch back to an unencrypted network connection if you so desire.

using System;

using System.Net.Security;

public delegate void SecureConnectionResultsCallback(object sender, SecureConnectionResults args);

public class SecureConnectionResults

{

private SslStream secureStream;

private Exception asyncException;

internal SecureConnectionResults(SslStream sslStream)

{

this.secureStream = sslStream;

}

internal SecureConnectionResults(Exception exception)

{

this.asyncException = exception;

}

public Exception AsyncException{get{return asyncException;}}

public SslStream SecureStream{get{return secureStream;}}

}

Server Code:

Here is my implementation of a TcpListener that accepts a connection and then initiates the SSL handshake immediately (by calling SslStream.BeginAuthenticateAsServer from within the OnAcceptConnection callback). This code automatically handles both IPv6 and IPv4 for you – make sure to read the “To Do Items”. If you aren't interested in reading all of the code, the bulk of the work is done inside the StartConnecting, OnAcceptConnection and OnAuthenticateAsServer functions.

To Do Items:

· I haven’t added any substantial error handling to this code.

o For example, you might be able to bind the IPv4 socket to the port but an error could occur when trying to bind the IPv6 socket to that same port (i.e. - it is taken by another application on IPv6 but not on IPv4).

· When on Windows Vista or later, use a single socket to listen for both IPv4 and IPv6 – this avoids the binding problem previously discussed.

· Another example would be that a fatal socket error could happen in OnAcceptConnection or OnAuthenticateAsServer that should result in the entire object being invalidated. I will leave it up to you to add these details for now, but will try to update the code when I have time.

· Thread safety. I am not doing any locking inside the object and so you could see funny results.

o For example, you shutdown the object while a callback is in progress.

using System;

using System.Net;

using System.Net.Sockets;

using System.Net.Security;

using System.Security.Cryptography.X509Certificates;

using System.Security.Authentication;

public class SecureTcpServer : IDisposable

{

X509Certificate serverCert;

RemoteCertificateValidationCallback certValidationCallback;

SecureConnectionResultsCallback connectionCallback;

AsyncCallback onAcceptConnection;

AsyncCallback onAuthenticateAsServer;

bool started;

int listenPort;

TcpListener listenerV4;

TcpListener listenerV6;

int disposed;

bool clientCertificateRequired;

bool checkCertifcateRevocation;

SslProtocols sslProtocols;

public SecureTcpServer(int listenPort, X509Certificate serverCertificate,

SecureConnectionResultsCallback callback)

:this(listenPort,serverCertificate,callback,null)

{

}

public SecureTcpServer(int listenPort, X509Certificate serverCertificate,

SecureConnectionResultsCallback callback,

RemoteCertificateValidationCallback certValidationCallback)

{

if (listenPort < 0 || listenPort > UInt16.MaxValue)

throw new ArgumentOutOfRangeException("listenPort");

if (serverCertificate == null)

throw new ArgumentNullException("serverCertificate");

if (callback == null)

throw new ArgumentNullException("callback");

onAcceptConnection = new AsyncCallback(OnAcceptConnection);

onAuthenticateAsServer = new AsyncCallback(OnAuthenticateAsServer);

this.serverCert = serverCertificate;

this.certValidationCallback = certValidationCallback;

this.connectionCallback = callback;

this.listenPort = listenPort;

this.disposed = 0;

this.checkCertifcateRevocation = false;

this.clientCertificateRequired = false;

this.sslProtocols = SslProtocols.Default;

}

~SecureTcpServer()

{

Dispose();

}

public SslProtocols SslProtocols

{

get { return sslProtocols; }

set { sslProtocols = value; }

}

public bool CheckCertifcateRevocation

{

get { return checkCertifcateRevocation; }

set { checkCertifcateRevocation = value; }

}

public bool ClientCertificateRequired

{

get { return clientCertificateRequired; }

set { clientCertificateRequired = value; }

}

public void StartListening()

{

if(started)

throw new InvalidOperationException("Already started...");

IPEndPoint localIP;

if (Socket.SupportsIPv4 && listenerV4 == null)

{

localIP = new IPEndPoint(IPAddress.Any, listenPort);

Console.WriteLine("SecureTcpServer: Started listening on {0}", localIP);

listenerV4 = new TcpListener(localIP);

}

if(Socket.OSSupportsIPv6 && listenerV6 == null)

{

localIP = new IPEndPoint(IPAddress.IPv6Any, listenPort);

Console.WriteLine("SecureTcpServer: Started listening on {0}", localIP);

listenerV6 = new TcpListener(localIP);

}

if(listenerV4 != null)

{

listenerV4.Start();

listenerV4.BeginAcceptTcpClient(onAcceptConnection,listenerV4);

}

if(listenerV6 != null)

{

listenerV6.Start();

listenerV6.BeginAcceptTcpClient(onAcceptConnection,listenerV6);

}

started = true;

}

public void StopListening()

{

if (!started)

return;

started = false;

if (listenerV4 != null)

listenerV4.Stop();

if (listenerV6 != null)

listenerV6.Stop();

}

void OnAcceptConnection(IAsyncResult result)

{

TcpListener listener = result.AsyncState as TcpListener;

TcpClient client = null;

SslStream sslStream = null;

try

{

if (this.started)

{

//start accepting the next connection...

listener.BeginAcceptTcpClient(this.onAcceptConnection, listener);

}

else

{

//someone called Stop() - don't call EndAcceptTcpClient because

//it will throw an ObjectDisposedException

return;

}

//complete the last operation...

client = listener.EndAcceptTcpClient(result);

bool leaveStreamOpen = false;//close the socket when done

if (this.certValidationCallback != null)

sslStream = new SslStream(client.GetStream(), leaveStreamOpen, this.certValidationCallback);

else

sslStream = new SslStream(client.GetStream(), leaveStreamOpen);

sslStream.BeginAuthenticateAsServer(this.serverCert,

this.clientCertificateRequired,

this.sslProtocols,

this.checkCertifcateRevocation,//checkCertifcateRevocation

this.onAuthenticateAsServer,

sslStream);

}

catch (Exception ex)

{

if (sslStream != null)

{

sslStream.Dispose();

sslStream = null;

}

this.connectionCallback(this, new SecureConnectionResults(ex));

}

void OnAuthenticateAsServer(IAsyncResult result)

{

SslStream sslStream = null;

try

{

sslStream = result.AsyncState as SslStream;

sslStream.EndAuthenticateAsServer(result);

this.connectionCallback(this, new SecureConnectionResults(sslStream));

}

catch (Exception ex)

{

if (sslStream != null)

{

sslStream.Dispose();

sslStream = null;

}

this.connectionCallback(this, new SecureConnectionResults(ex));

}

public void Dispose()

{

if (System.Threading.Interlocked.Increment(ref disposed) == 1)

{

if (this.listenerV4 != null)

listenerV4.Stop();

if (this.listenerV6 != null)

listenerV6.Stop();

listenerV4 = null;

listenerV6 = null;

GC.SuppressFinalize(this);

}

Client Code:

The client code is similar to the server code in that it tries to abstract you from handling the connecting and SSL negotiation. The remoteHostName parameter is used when validating the server’s certificate. If the name you pass in doesn’t match the name on the server’s certificate, you will get certificate errors (i.e. System.Net.Security.SslPolicyErrors.RemoteCertificateNameMismatch). Again, if you really only want to look at the most important parts of the code, focus on the StartConnecting, OnConnected and OnAuthenticateAsClient functions.

To Do Items:

· Change StartConnecting so that it doesn’t require a single IPEndpoint. It would be nice if the code just did an asynchronous DNS lookup for you based on the host name and then automatically connected to any of the resolved addresses (regardless of IPv4 or IPv6)

· I haven’t added any substantial error handling to this code.

o An example would be that a fatal error could happen that should result in the entire object being invalidated. I will leave it up to you to add these details for now, but will try to update the code when I have time.

· Thread safety. I am not doing any locking inside the object and so you could see funny results.

using System;

using System.Net;

using System.Net.Sockets;

using System.Net.Security;

using System.Security.Cryptography.X509Certificates;

using System.Security.Authentication;

public class SecureTcpClient : IDisposable

{

X509CertificateCollection clientCertificates;

RemoteCertificateValidationCallback certValidationCallback;

SecureConnectionResultsCallback connectionCallback;

bool checkCertificateRevocation;

AsyncCallback onConnected;

AsyncCallback onAuthenticateAsClient;

TcpClient client;

IPEndPoint remoteEndPoint;

string remoteHostName;

SslProtocols protocols;

int disposed;

public SecureTcpClient(SecureConnectionResultsCallback callback)

: this(callback,null,SslProtocols.Default)

{

}

public SecureTcpClient(SecureConnectionResultsCallback callback,

RemoteCertificateValidationCallback certValidationCallback)

: this(callback, certValidationCallback, SslProtocols.Default)

{

}

public SecureTcpClient(SecureConnectionResultsCallback callback,

RemoteCertificateValidationCallback certValidationCallback,

SslProtocols sslProtocols)

{

if (callback == null)

throw new ArgumentNullException("callback");

onConnected = new AsyncCallback(OnConnected);

onAuthenticateAsClient = new AsyncCallback(OnAuthenticateAsClient);

this.certValidationCallback = certValidationCallback;

this.connectionCallback = callback;

protocols = sslProtocols;

this.disposed = 0;

}

~SecureTcpClient()

{

Dispose();

}

public bool CheckCertificateRevocation

{

get { return checkCertificateRevocation; }

set {checkCertificateRevocation = value;}

}

public void StartConnecting(string remoteHostName, IPEndPoint remoteEndPoint)

{

StartConnecting(remoteHostName,remoteEndPoint,null);

}

public void StartConnecting(string remoteHostName, IPEndPoint remoteEndPoint,

X509CertificateCollection clientCertificates)

{

if (string.IsNullOrEmpty(remoteHostName))

throw new ArgumentException("Value cannot be null or empty","remoteHostName");

if (remoteEndPoint == null)

throw new ArgumentNullException("remoteEndPoint");

Console.WriteLine("Client connecting to: {0}", remoteEndPoint);

this.clientCertificates = clientCertificates;

this.remoteHostName = remoteHostName;

this.remoteEndPoint = remoteEndPoint;

if (client != null)

client.Close();

client = new TcpClient(remoteEndPoint.AddressFamily);

client.BeginConnect(remoteEndPoint.Address,

remoteEndPoint.Port,

this.onConnected,null);

}

public void Close()

{

Dispose();

}

void OnConnected(IAsyncResult result)

{

SslStream sslStream = null;

try

{

bool leaveStreamOpen = false;//close the socket when done

if (this.certValidationCallback != null)

sslStream = new SslStream(client.GetStream(), leaveStreamOpen, this.certValidationCallback);

else

sslStream = new SslStream(client.GetStream(), leaveStreamOpen);

sslStream.BeginAuthenticateAsClient(this.remoteHostName,

this.clientCertificates,

this.protocols,

this.checkCertificateRevocation,

this.onAuthenticateAsClient,

sslStream);

}

catch (Exception ex)

{

if (sslStream != null)

{

sslStream.Dispose();

sslStream = null;

}

this.connectionCallback(this,new SecureConnectionResults(ex));

}

void OnAuthenticateAsClient(IAsyncResult result)

{

SslStream sslStream = null;

try

{

sslStream = result.AsyncState as SslStream;

sslStream.EndAuthenticateAsClient(result);

this.connectionCallback(this,new SecureConnectionResults( sslStream));

}

catch (Exception ex)

{

if (sslStream != null)

{

sslStream.Dispose();

sslStream = null;

}

this.connectionCallback(this, new SecureConnectionResults(ex));

}

public void Dispose()

{

if (System.Threading.Interlocked.Increment(ref disposed) == 1)

{

if (client != null)

{

client.Close();

client = null;

}

GC.SuppressFinalize(this);

}

Sample Program:

Here is a very simple program that demonstrates the use of these objects.

using System;

using System.IO;

using System.Net;

using System.Threading;

using System.Net.Sockets;

using System.Security.Cryptography;

using System.Security.Cryptography.X509Certificates;

using System.Net.Security;

class Program

{

static void Main(string[] args)

{

SecureTcpServer server = null;

SecureTcpClient client = null;

try

{

int port = 8889;

RemoteCertificateValidationCallback certValidationCallback = null;

certValidationCallback = new RemoteCertificateValidationCallback(IgnoreCertificateErrorsCallback);

string certPath = System.Reflection.Assembly.GetEntryAssembly().Location;

certPath = Path.GetDirectoryName(certPath);

certPath = Path.Combine(certPath, "serverCert.cer");

Console.WriteLine("Loading Server Cert From: " + certPath);

X509Certificate serverCert = X509Certificate.CreateFromCertFile(certPath);

server = new SecureTcpServer(port, serverCert,

new SecureConnectionResultsCallback(OnServerConnectionAvailable));

server.StartListening();

client = new SecureTcpClient(new SecureConnectionResultsCallback(OnClientConnectionAvailable),

certValidationCallback);

client.StartConnecting("localhost", new IPEndPoint(IPAddress.Loopback, port));

}

catch (Exception ex)

{

Console.WriteLine(ex);

}

//sleep to avoid printing this text until after the callbacks have been invoked.

Thread.Sleep(4000);

Console.WriteLine("Press any key to continue...");

Console.ReadKey();

if (server != null)

server.Dispose();

if (client != null)

client.Dispose();

}

static void OnServerConnectionAvailable(object sender, SecureConnectionResults args)

{

if (args.AsyncException != null)

{

Console.WriteLine(args.AsyncException);

return;

}

SslStream stream = args.SecureStream;

Console.WriteLine("Server Connection secured: " + stream.IsAuthenticated);

StreamWriter writer = new StreamWriter(stream);

writer.AutoFlush = true;

writer.WriteLine("Hello from server!");

StreamReader reader = new StreamReader(stream);

string line = reader.ReadLine();

Console.WriteLine("Server Recieved: '{0}'", line == null ? "" : line);

writer.Close();

reader.Close();

stream.Close();

}

static void OnClientConnectionAvailable(object sender, SecureConnectionResults args)

{

if (args.AsyncException != null)

{

Console.WriteLine(args.AsyncException);

return;

}

SslStream stream = args.SecureStream;

Console.WriteLine("Client Connection secured: " + stream.IsAuthenticated);

StreamWriter writer = new StreamWriter(stream);

writer.AutoFlush = true;

writer.WriteLine("Hello from client!");

StreamReader reader = new StreamReader(stream);

string line = reader.ReadLine();

Console.WriteLine("Client Recieved: '{0}'", line == null ? "" : line);

writer.Close();

reader.Close();

stream.Close();

}

static bool IgnoreCertificateErrorsCallback(object sender,

X509Certificate certificate,

X509Chain chain,

SslPolicyErrors sslPolicyErrors)

{

if (sslPolicyErrors != SslPolicyErrors.None)

{

Console.WriteLine("IgnoreCertificateErrorsCallback: {0}", sslPolicyErrors);

//you should implement different logic here...

if ((sslPolicyErrors & SslPolicyErrors.RemoteCertificateChainErrors) != 0)

{

foreach (X509ChainStatus chainStatus in chain.ChainStatus)

{

Console.WriteLine("\t" + chainStatus.Status);

}

//returning true tells the SslStream object you don't care about any errors.

return true;

}

Note that if you don’t have a certificate for testing this code, you can create a certificate using the MakeCert.exe tool, which ships with the Visual Studio SDK.

Creating a Process Memory Dump

JonCole — Thu, 29 Mar 2007 21:29:00 GMT

When trying to help customers debug some issues it is periodically necessary to get a memory dump (snapshot) of a process for analysis at another time or place. This is frequently the case when an error is intermittent or a live debug session is not feasible (like in a production environment). I will discuss the steps necessary to install the right debuggers, attach to the process in question, looking for the right event to occur (knowing when to save the dump) and saving a dump to disk. In this case I will be looking at BtsNtSvc.exe, which is the BizTalk NT Service process.

Installing the Debuggers

Many debuggers have support for creating (or opening) memory dumps, including Visual Studio. However, because of the size of Visual Studio and license requirements, I will discuss the use of the freely downloadable debugging tools that Microsoft provides - Debugging Tools for Windows. Make sure you install the correct version for you processor architecture (x86 vs x64).

You may want to read the Getting Started page for supplemental information. These tools come with several debuggers, most of which support the same types of operations. Windbg.exe is the GUI version, but you can also use cdb.exe (a command line based debugger) and accomplish pretty much the same things because they are built on top of the same underlying debugging libraries. In this article I will focus on WinDbg.

Setting your Symbol Path

The symbol path (path to pdb files) can be set in several ways. You can set it before you start the debugger by using the _NT_SYMBOL_PATH environment variable or at runtime. To set the symbol path at runtime, select File->Symbol File Path. This symbol path is basically just a semicolon (;) delimited list of search paths that the debugger should use when trying to locate debug symbols for the exe/dlls in your process. I will try to write more about setting up your symbol path at a later date.

You can also set the symbol path by using the .sympath command (more information below on how to run commands). See the debugger help files for more information.

Check out KB article 311503 for more information on setting symbols, including how to get publicly available symbols for microsoft products. It aslo includes a video tuturial on how to set the symbol path in the Visual Studio.Net debugger.

Attaching to the process

You can attach to the process in a couple of ways. Choose one of the following:

From the command line you can type any of the following:
1. "Windbg.exe -p " (example: "windbg.exe -p 1234")
2. "windbg.exe -pn " (example: "windbg.exe -pn btsntsvc.exe")
3. Note that you can add "-g" (lower case g) to any of the above to avoid breaking into the debugger immediately after attaching.
After starting WinDbg:

Select File->Attach to a Process from the menu
Select the Process from the list in the new windows that comes up

Once you have the debugger open, you can either type ".hh" in the command box or by selecting Help-> Contents from the menu. Note that you will have to break into the debugger before you can run any commands in the command box. Hit "Ctrl-Break" on your keyboard or click the pause button on the toolbar to break into the debugger.

FYI, here is a snapshot of the command box (found in the lower left hand corner of the window). I have circled it in red. Note that the "0 : 003" indicates that I am currently examining thread number 3.

Looking for the right event

There may be several types of events you are interested in and several ways to locate the event you are interested in. I will only speak of three types of events in this article. Some will result in the debugger breaking for you automatically, others you will have to tell the debugger you are interested in stopping if it occurs. I will primarily focus on .NET exceptions in this article.

Access Violation (a.k.a. AV). This type of error will result in the process breaking into the debugger without any special setup on your part. AVs occur when your program tries to access memory that it doesn't have permission to access. Examples would be reading/writing protected memory or trying to use an object that is null. In .NET, these will result in either an AccessViolationException (read/write protected memory) or NullReferenceException (null object referenced in code).
.NET exception at the time it is thrown (a.k.a first chance exception). Windbg will not break into the debugger for this one automatically. You have to tell it that you want it to stop. You can do this by running the command sxe clr. If you need to stop breaking into the debugger every time a .NET exception is thrown, you can use the sxi clr command. Keep in mind that just because an exception is thrown does not mean that it is unexpected and unhandled. The process may expect to get exceptions in certain recoverable situations and the user may be completely unaware that anything has happened.
.NET exception is thrown and is not handled. This will result in your process crashing. This is especially true in .NET 2.0 and later. In earlier versions of the framework, an exception being thrown and unhandled on a thread pool thread did not necessarily cause the application to shut down - it was swallowed. This made debugging applications more difficult, so in V2.0 of the framework an unhandled exception causes the application to shutdown immediately to make the system easier to debug.

Now that we know how to get the system to break into the debugger, we need to be able to look at the exception that occurred to determine if it is the one we care about. I will discuss how to do this in V2.0 of the framework. It can be done in earlier versions of the framework also, but it isn't quite as easy.

Because Windbg is primarily a native application debugging tool, you have to load what is called a debugger extension to enable you to debug managed code. This extension is called sos.dll and it sits in the .net framework installation directory. You can use one of the following commands to easily load it without having to type the full path:

.Net Framework 3.5 or earlier: .loadby sos mscorwks
.Net Framework 4.0: .loadby sos clr

This tells windbg to look in the same directory as mscorwks.dll or clr.dll (always loaded into .NET applications) to find sos.dll. Commands that are loaded from a debugger extension dll are always prefixed with an exclamation mark (!).

When you have sos.dll loaded you can run !help. Note that if you have multiple extensions loaded, you may have to prefix your commands with the specific extension that has the command you want. For example: !sos.help.

Now, when the debugger breaks, we can do run two commands to help us figure out where we are and what type of exception occured. !sos.printexception (or !pe is the shorthand version) and !clrstack. If the exception type, message and stack trace match the one you see in logs, event viewer, etc., then you have (hopefully) found the right exception.

Here is some sample output when a first chance .NET exception occurs:

(650.1c9c): CLR exception - code e0434f4d (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0012f298 ebx=00181a60 ecx=00000000 edx=00000025 esi=0012f324 edi=e0434f4d
eip=77e55e02 esp=0012f294 ebp=0012f2e8 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
KERNEL32!RaiseException+0x53:
77e55e02 5e pop esi

0:000> !pe
Exception object: 01355858
Exception type: System.InvalidOperationException
Message: This is a sample exception message for an InvalidOperationException
InnerException:
StackTrace (generated):

StackTraceString:
HResult: 80131509

0:000> !clrstack
OS Thread Id: 0x1c9c (0)
ESP EIP
0012f370 77e55e02 [HelperMethodFrame: 0012f370]
0012f414 00d8021e Test.AnotherFunctionThatThrowsAnException(System.String)
0012f420 00d801c2 Test.SomeFunction()
0012f428 00d800b2 Test.Main()
0012f69c 79e88f63 [GCFrame: 0012f69c]

If the exception you are currently looking at is not the one you were looking for, then you can tell the debugger to let the process continue until the next event by using the g command (go). Of course, these debuggers support break points also, but that is a discussion for another day.

Saving the Dump File

Now that you have the process broken into the debugger at the right place, you can use .dump command to write the memory dump out to a file.

.dump
example: .dump /ma c:\temp\myDump.dmp

I would recommend the /ma options for this command as I show above. You can read the help files for the .dump command to get more information on the options you can use and what they imply.

Just a reminder...

One last warning about memory dumps before we are done. Memory dumps contain the memory snapshot of the process. This memory can contain private information that you and/or your customers wouldn't want to give out to just anyone. Some examples: usernames and passwords, credit card numbers, etc - anything that is in memory at the time the dump is taken. Consider yourself warned - don't give a copy of the memory dump to just anyone.

Be consistent in your configuration

JonCole — Fri, 23 Mar 2007 14:54:00 GMT

I recently worked with a customer using BizTalk 2004. They were experiencing some very odd behavior where a WebService client would call into a BizTalk WebService and experience a long wait before the client finally got a timeout error. The timeout happend to correspond to the 120 second timeout configured in IIS.

Being fairly new to the Soap Receive Adapter code, I spent a couple hours looking over the code and some trace logs trying to understand what was happening. I finally noticed one very simple (yet easy to miss) mistake that the customer was making. They weren't being consistent in the configuration of the WebService. The Receive Port in BizTalk was configured as a Request-Response (two-way) port, as was the Web Method defined in the WSDL. However, within the WebMethod implementation, when they were calling the base.Invoke(...) function on the ServiceProxy base class they were passing true for the oneway parameter. This inconsistency broke the contract between the WebService Implementation and the code that interacted with the Message Box, thus leading to the inconsistent behavior.