protected override Stream OnAcceptUpgrade(Stream stream, out SecurityMessageProperty remoteSecurity)
 {
     SslStream stream2 = new SslStream(stream, false, new RemoteCertificateValidationCallback(this.ValidateRemoteCertificate));
     try
     {
         stream2.AuthenticateAsServer(this.parent.ServerCertificate, this.parent.RequireClientCertificate, SslProtocols.Default, false);
     }
     catch (AuthenticationException exception)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityNegotiationException(exception.Message, exception));
     }
     catch (IOException exception2)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityNegotiationException(System.ServiceModel.SR.GetString("NegotiationFailedIO", new object[] { exception2.Message }), exception2));
     }
     if (System.ServiceModel.Security.SecurityUtils.ShouldValidateSslCipherStrength())
     {
         System.ServiceModel.Security.SecurityUtils.ValidateSslCipherStrength(stream2.CipherStrength);
     }
     remoteSecurity = this.clientSecurity;
     if (this.IsChannelBindingSupportEnabled)
     {
         this.channelBindingToken = ChannelBindingUtility.GetToken(stream2);
     }
     return stream2;
 }

		public InitiatorSecureMessageDecryptor (
			Message source, SecurityMessageProperty secprop, InitiatorMessageSecurityBindingSupport security)
			: base (source, security)
		{
			this.security = security;
			request_security = secprop;
		}

 public IMessageProperty CreateCopy()
 {
     this.ThrowIfDisposed();
     SecurityMessageProperty property = new SecurityMessageProperty();
     if (this.HasOutgoingSupportingTokens)
     {
         for (int i = 0; i < this.outgoingSupportingTokens.Count; i++)
         {
             property.OutgoingSupportingTokens.Add(this.outgoingSupportingTokens[i]);
         }
     }
     if (this.HasIncomingSupportingTokens)
     {
         for (int j = 0; j < this.incomingSupportingTokens.Count; j++)
         {
             property.IncomingSupportingTokens.Add(this.incomingSupportingTokens[j]);
         }
     }
     property.securityContext = this.securityContext;
     property.externalAuthorizationPolicies = this.externalAuthorizationPolicies;
     property.senderIdPrefix = this.senderIdPrefix;
     property.protectionToken = this.protectionToken;
     property.initiatorToken = this.initiatorToken;
     property.recipientToken = this.recipientToken;
     property.transportToken = this.transportToken;
     return property;
 }

 protected SingletonConnectionReader(IConnection connection, int offset, int size, SecurityMessageProperty security, IConnectionOrientedTransportFactorySettings transportSettings, Uri via)
 {
     this.connection = connection;
     this.offset = offset;
     this.size = size;
     this.security = security;
     this.transportSettings = transportSettings;
     this.via = via;
 }

 public static void AddSupportingToken(Message message, RequestSecurityTokenResponse rstr)
 {
     GenericXmlSecurityToken token = rstr.GetIssuedToken(null, null, SecurityKeyEntropyMode.ServerEntropy, null, null, null);
     SecurityMessageProperty property = new SecurityMessageProperty();
     SupportingTokenSpecification item = new SupportingTokenSpecification(token, new List<IAuthorizationPolicy>().AsReadOnly(), SecurityTokenAttachmentMode.Endorsing, SecurityContextSecurityTokenParameters);
     property.OutgoingSupportingTokens.Add(item);
     message.Properties.Security = property;
     if (DebugTrace.Verbose)
     {
         DebugTrace.Trace(TraceLevel.Verbose, "Attached supporting token {0} to register message", rstr.Context);
     }
 }

        protected SingletonConnectionReader(IConnection connection, int offset, int size, SecurityMessageProperty security,
            IConnectionOrientedTransportFactorySettings transportSettings, Uri via)
        {
            Contract.Assert(connection != null);

            _connection = connection;
            _offset = offset;
            _size = size;
            _security = security;
            _transportSettings = transportSettings;
            _via = via;
        }

 protected SessionConnectionReader(IConnection connection, IConnection rawConnection,
     int offset, int size, SecurityMessageProperty security)
 {
     _offset = offset;
     _size = size;
     if (size > 0)
     {
         _buffer = connection.AsyncReadBuffer;
     }
     _connection = connection;
     _rawConnection = rawConnection;
     _security = security;
 }

 protected SessionConnectionReader(IConnection connection, IConnection rawConnection, int offset, int size, SecurityMessageProperty security)
 {
     this.offset = offset;
     this.size = size;
     if (size > 0)
     {
         this.buffer = connection.AsyncReadBuffer;
     }
     this.connection = connection;
     this.rawConnection = rawConnection;
     this.onAsyncReadComplete = new WaitCallback(this.OnAsyncReadComplete);
     this.security = security;
 }

 public override SecurityMessageProperty GetRemoteSecurity()
 {
     if (this.clientSecurity.TransportToken != null)
     {
         return this.clientSecurity;
     }
     if (this.clientCertificate != null)
     {
         SecurityToken token = new X509SecurityToken(this.clientCertificate);
         ReadOnlyCollection<IAuthorizationPolicy> tokenPolicies = System.ServiceModel.Security.SecurityUtils.NonValidatingX509Authenticator.ValidateToken(token);
         this.clientSecurity = new SecurityMessageProperty();
         this.clientSecurity.TransportToken = new SecurityTokenSpecification(token, tokenPolicies);
         this.clientSecurity.ServiceSecurityContext = new ServiceSecurityContext(tokenPolicies);
         return this.clientSecurity;
     }
     return base.GetRemoteSecurity();
 }

        internal IConnection SendPreamble(IConnection connection, ref TimeoutHelper timeoutHelper,
            ClientFramingDecoder decoder, out SecurityMessageProperty remoteSecurity)
        {
            connection.Write(Preamble, 0, Preamble.Length, true, timeoutHelper.RemainingTime());

            if (_upgrade != null)
            {
                IStreamUpgradeChannelBindingProvider channelBindingProvider = _upgrade.GetProperty<IStreamUpgradeChannelBindingProvider>();

                StreamUpgradeInitiator upgradeInitiator = _upgrade.CreateUpgradeInitiator(this.RemoteAddress, this.Via);

                if (!ConnectionUpgradeHelper.InitiateUpgrade(upgradeInitiator, ref connection, decoder,
                    this, ref timeoutHelper))
                {
                    ConnectionUpgradeHelper.DecodeFramingFault(decoder, connection, Via, _messageEncoder.ContentType, ref timeoutHelper);
                }

#if FEATURE_CORECLR // ExtendedProtection
                if (channelBindingProvider != null && channelBindingProvider.IsChannelBindingSupportEnabled)
                {
                    _channelBindingToken = channelBindingProvider.GetChannelBinding(upgradeInitiator, ChannelBindingKind.Endpoint);
                }
#endif // FEATURE_CORECLR // ExtendedProtection

                remoteSecurity = StreamSecurityUpgradeInitiator.GetRemoteSecurity(upgradeInitiator);

                connection.Write(ClientSingletonEncoder.PreambleEndBytes, 0,
                    ClientSingletonEncoder.PreambleEndBytes.Length, true, timeoutHelper.RemainingTime());
            }
            else
            {
                remoteSecurity = null;
            }

            // read ACK
            byte[] ackBuffer = new byte[1];
            int ackBytesRead = connection.Read(ackBuffer, 0, ackBuffer.Length, timeoutHelper.RemainingTime());
            if (!ConnectionUpgradeHelper.ValidatePreambleResponse(ackBuffer, ackBytesRead, decoder, this.Via))
            {
                ConnectionUpgradeHelper.DecodeFramingFault(decoder, connection, Via, _messageEncoder.ContentType, ref timeoutHelper);
            }

            return connection;
        }

 public static IConnection End(IAsyncResult result, out SecurityMessageProperty remoteSecurity)
 {
     StreamedFramingRequestChannel.StreamedConnectionPoolHelper.SendPreambleAsyncResult result2 = AsyncResult.End<StreamedFramingRequestChannel.StreamedConnectionPoolHelper.SendPreambleAsyncResult>(result);
     remoteSecurity = result2.remoteSecurity;
     return result2.connection;
 }

		public Message SecureMessage ()
		{
			secprop = Message.Properties.Security ?? new SecurityMessageProperty ();

			SecurityToken encToken =
				secprop.InitiatorToken != null ? secprop.InitiatorToken.SecurityToken : security.EncryptionToken;
			// FIXME: it might be still incorrect.
			SecurityToken signToken =
				Parameters == CounterParameters ? null :
				security.SigningToken;
			MessageProtectionOrder protectionOrder =
				security.MessageProtectionOrder;
			SecurityTokenSerializer serializer =
				security.TokenSerializer;
			SecurityBindingElement element =
				security.Element;
			SecurityAlgorithmSuite suite = element.DefaultAlgorithmSuite;

// FIXME: remove this hack
if (!ShouldOutputEncryptedKey)
	encToken = new BinarySecretSecurityToken (secprop.EncryptionKey);

			string messageId = "uuid-" + Guid.NewGuid ();
			int identForMessageId = 1;
			XmlDocument doc = new XmlDocument ();
			doc.PreserveWhitespace = true;

			UniqueId relatesTo = RelatesTo;
			if (relatesTo != null)
				msg.Headers.RelatesTo = relatesTo;
			else // FIXME: probably it is always added when it is stateful ?
				msg.Headers.MessageId = new UniqueId ("urn:" + messageId);

			// FIXME: get correct ReplyTo value
			if (Direction == MessageDirection.Input)
				msg.Headers.ReplyTo = new EndpointAddress (Constants.WsaAnonymousUri);

			if (MessageTo != null)
				msg.Headers.To = MessageTo.Uri;

			// wss:Security
			WSSecurityMessageHeader header =
				new WSSecurityMessageHeader (serializer);
			msg.Headers.Add (header);
			// 1. 1653525092
			if (element.IncludeTimestamp) {
				WsuTimestamp timestamp = new WsuTimestamp ();
				timestamp.Id = messageId + "-" + identForMessageId++;
				timestamp.Created = DateTime.Now;
				// FIXME: on service side, use element.LocalServiceSettings.TimestampValidityDuration
				timestamp.Expires = timestamp.Created.Add (element.LocalClientSettings.TimestampValidityDuration);
				header.AddContent (timestamp);
			}

			XmlNamespaceManager nsmgr = new XmlNamespaceManager (doc.NameTable);
			nsmgr.AddNamespace ("s", msg.Version.Envelope.Namespace);
			nsmgr.AddNamespace ("o", Constants.WssNamespace);
			nsmgr.AddNamespace ("u", Constants.WsuNamespace);
			nsmgr.AddNamespace ("o11", Constants.Wss11Namespace);

			/*WrappedKey*/SecurityToken primaryToken = null;
			DerivedKeySecurityToken dkeyToken = null;
			SecurityToken actualToken = null;
			SecurityKeyIdentifierClause actualClause = null;
			Signature sig = null;

			List<DerivedKeySecurityToken> derivedKeys =
				new List<DerivedKeySecurityToken> ();

			SymmetricAlgorithm masterKey = new RijndaelManaged ();
			masterKey.KeySize = suite.DefaultSymmetricKeyLength;
			masterKey.Mode = CipherMode.CBC;
			masterKey.Padding = PaddingMode.ISO10126;
			SymmetricAlgorithm actualKey = masterKey;

			// 2. [Encryption Token]

			// SecurityTokenInclusionMode
			// - Initiator or Recipient
			// - done or notyet. FIXME: not implemented yet
			// It also affects on key reference output

			bool includeEncToken = // /* FIXME: remove this hack */Parameters is SslSecurityTokenParameters ? false :
						ShouldIncludeToken (
				Security.RecipientParameters.InclusionMode, false);
			bool includeSigToken = // /* FIXME: remove this hack */ Parameters is SslSecurityTokenParameters ? false :
						ShouldIncludeToken (
				Security.InitiatorParameters.InclusionMode, false);

			SecurityKeyIdentifierClause encClause = ShouldOutputEncryptedKey ?
				CounterParameters.CallCreateKeyIdentifierClause (encToken, !ShouldOutputEncryptedKey ? SecurityTokenReferenceStyle.Internal : includeEncToken ? Parameters.ReferenceStyle : SecurityTokenReferenceStyle.External) : null;

			MessagePartSpecification sigSpec = SignaturePart;
			MessagePartSpecification encSpec = EncryptionPart;

			// encryption key (possibly also used for signing)
			// FIXME: get correct SymmetricAlgorithm according to the algorithm suite
			if (secprop.EncryptionKey != null)
				actualKey.Key = secprop.EncryptionKey;

//.........这里部分代码省略.........

 public static Stream End(IAsyncResult result, out SecurityMessageProperty remoteSecurity)
 {
     StreamSecurityUpgradeAcceptorAsyncResult thisPtr = AsyncResult.End<StreamSecurityUpgradeAcceptorAsyncResult>(result);
     remoteSecurity = thisPtr.remoteSecurity;
     return thisPtr.upgradedStream;
 }

 public static Stream End(IAsyncResult result, out SecurityMessageProperty remoteSecurity, out ChannelBinding channelBinding)
 {
     Stream stream = StreamSecurityUpgradeInitiatorAsyncResult.End(result, out remoteSecurity);
     channelBinding = ((SslStreamSecurityUpgradeInitiator.InitiateUpgradeAsyncResult) result).channelBindingToken;
     return stream;
 }

 protected override Stream OnEndInitiateUpgrade(IAsyncResult result, out SecurityMessageProperty remoteSecurity)
 {
     return InitiateUpgradeAsyncResult.End(result, out remoteSecurity, out this.channelBindingToken);
 }

 public static SecurityMessageProperty GetOrCreate(Message message)
 {
     if (message == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("message");
     }
     SecurityMessageProperty security = null;
     if (message.Properties != null)
     {
         security = message.Properties.Security;
     }
     if (security == null)
     {
         security = new SecurityMessageProperty();
         message.Properties.Security = security;
     }
     return security;
 }

 protected abstract Stream OnAcceptUpgrade(Stream stream, out SecurityMessageProperty remoteSecurity);

 protected abstract Stream OnEndAcceptUpgrade(IAsyncResult result,
     out SecurityMessageProperty remoteSecurity);

		public RecipientMessageSecurityGenerator (
			Message msg,
			SecurityMessageProperty requestSecProp,
			RecipientMessageSecurityBindingSupport security)
			: base (msg, security)
		{
			this.security = security;
			SecurityMessageProperty secprop =
				(SecurityMessageProperty) requestSecProp.CreateCopy ();
			msg.Properties.Security = secprop;
		}

		Message ProcessReply (Message message, SecurityMessageProperty secprop)
		{
			// FIXME: provide correct parameters
			return message.IsFault ? message : new InitiatorSecureMessageDecryptor (message, secprop, security).DecryptMessage ();
		}