/**
  * The execution of this behavior comes rather late.
  * Anyone that inspects the service description in the meantime,
  * such as for metadata generation, won't see the protection level that we want to use.
  *
  * One way of doing it is at when create HostFactory
  *
  * ServiceEndpoint endpoint = host.Description.Endpoints.Find(typeof(IService));
  * OperationDescription operation = endpoint.Contract.Operations.Find("Action");
  * MessageDescription message = operation.Messages.Find("http://tempuri.org/IService/ActionResponse");
  * MessageHeaderDescription header = message.Headers[new XmlQualifiedName("aheader", "http://tempuri.org/")];
  * header.ProtectionLevel = ProtectionLevel.Sign;
  *
  * **/
 public void AddBindingParameters(ContractDescription contractDescription, ServiceEndpoint endpoint, BindingParameterCollection bindingParameters)
 {
     ChannelProtectionRequirements requirements = bindingParameters.Find<ChannelProtectionRequirements>();
     XmlQualifiedName qName = new XmlQualifiedName(header, ns);
     MessagePartSpecification part = new MessagePartSpecification(qName);
     requirements.OutgoingSignatureParts.AddParts(part, action);
 }

 private void AddParts(ref MessagePartSpecification parts1, MessagePartSpecification parts2)
 {
     if (parts1 == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("parts1"));
     }
     if (parts2 == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("parts2"));
     }
     if (!parts2.IsEmpty())
     {
         if (parts1.IsReadOnly)
         {
             MessagePartSpecification specification = new MessagePartSpecification();
             specification.Union(parts1);
             specification.Union(parts2);
             parts1 = specification;
         }
         else
         {
             parts1.Union(parts2);
         }
     }
 }

 internal void AddParts(MessagePartSpecification parts, XmlDictionaryString action)
 {
     if (action == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("action"));
     }
     this.AddParts(parts, action.Value);
 }

    public bool TryGetParts(string action, out MessagePartSpecification parts)
    {
      Contract.Ensures(Contract.Result<bool>() == (Contract.ValueAtReturn(out parts) != null));

      parts = default(MessagePartSpecification);

      return default(bool);
    }

		public void AddParts (MessagePartSpecification parts)
		{
			if (parts == null)
				throw new ArgumentNullException ("parts");
			if (IsReadOnly)
				throw new InvalidOperationException ("This ScopedMessagePartSpecification is read-only.");
			ChannelParts.Union (parts);
		}

		public void UnionReadOnlyPart ()
		{
			MessagePartSpecification s =
				new MessagePartSpecification ();
			s.MakeReadOnly ();
			Assert.AreEqual (true, s.IsReadOnly, "#1");
			s.Union (new MessagePartSpecification ());
		}

		public ScopedMessagePartSpecification (
			ScopedMessagePartSpecification other)
		{
			XmlQualifiedName [] array = new XmlQualifiedName [other.parts.HeaderTypes.Count];
			other.parts.HeaderTypes.CopyTo (array, 0);
			parts = new MessagePartSpecification (
				other.parts.IsBodyIncluded, array);
			table = new Dictionary<string,MessagePartSpecification> (other.table);
		}

        public void AddParts(MessagePartSpecification parts)
        {
            if (parts == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("parts"));

            ThrowIfReadOnly();

            _channelParts.Union(parts);
        }

		public void DefaultValues ()
		{
			MessagePartSpecification s =
				new MessagePartSpecification ();
			Assert.IsFalse (s.IsBodyIncluded, "#1");
			Assert.AreEqual (0, s.HeaderTypes.Count, "#2");

			s = new MessagePartSpecification (new XmlQualifiedName [] {new XmlQualifiedName ("foo", "urn:foo")});
			Assert.IsFalse (s.IsBodyIncluded, "#3");
			Assert.AreEqual (1, s.HeaderTypes.Count, "#4");
		}

        public ScopedMessagePartSpecification(ScopedMessagePartSpecification other)
            : this()
        {
            if (other == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("other"));

            _channelParts.Union(other._channelParts);
            if (other._actionParts != null)
            {
                foreach (string action in other._actionParts.Keys)
                {
                    MessagePartSpecification p = new MessagePartSpecification();
                    p.Union(other._actionParts[action]);
                    _actionParts[action] = p;
                }
            }
        }

 public ScopedMessagePartSpecification(ScopedMessagePartSpecification other) : this()
 {
     if (other == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("other"));
     }
     this.channelParts.Union(other.channelParts);
     if (other.actionParts != null)
     {
         foreach (string str in other.actionParts.Keys)
         {
             MessagePartSpecification specification = new MessagePartSpecification();
             specification.Union(other.actionParts[str]);
             this.actionParts[str] = specification;
         }
     }
 }

		public void Union ()
		{
			XmlQualifiedName q1, q2, q3;
			q1 = new XmlQualifiedName ("foo");
			q2 = new XmlQualifiedName ("bar");
			q3 = new XmlQualifiedName ("baz");
			MessagePartSpecification p1 =
				new MessagePartSpecification (false, new XmlQualifiedName [] {q1, q2});
			MessagePartSpecification p2 =
				new MessagePartSpecification (true, new XmlQualifiedName [] {q3, q2});
			p1.Union (p2);
			Assert.IsTrue (p1.IsBodyIncluded, "#1");
			// Sigh. It does not exclude duplicates.
			Assert.AreEqual (4, p1.HeaderTypes.Count, "#1-2");
			Assert.IsTrue (p1.HeaderTypes.Contains (q1), "#2");
			Assert.IsTrue (p1.HeaderTypes.Contains (q2), "#3");
			Assert.IsTrue (p1.HeaderTypes.Contains (q3), "#4");
		}

 private AddressingVersion(string ns, XmlDictionaryString dictionaryNs, string toStringFormat, MessagePartSpecification signedMessageParts, string anonymous, XmlDictionaryString dictionaryAnonymous, string none, string faultAction, string defaultFaultAction)
 {
     this.ns = ns;
     this.dictionaryNs = dictionaryNs;
     this.toStringFormat = toStringFormat;
     this.signedMessageParts = signedMessageParts;
     this.anonymous = anonymous;
     this.dictionaryAnonymous = dictionaryAnonymous;
     if (anonymous != null)
     {
         this.anonymousUri = new Uri(anonymous);
     }
     if (none != null)
     {
         this.noneUri = new Uri(none);
     }
     this.faultAction = faultAction;
     this.defaultFaultAction = defaultFaultAction;
 }

        public void AddBindingParameters(ServiceEndpoint endpoint, System.ServiceModel.Channels.BindingParameterCollection bindingParameters)
        {

            var proReq =
                bindingParameters.Remove<ChannelProtectionRequirements>();

            proReq = new ChannelProtectionRequirements();

            MessagePartSpecification unProtectedSpec = new MessagePartSpecification();
            MessagePartSpecification protectedSpec = new MessagePartSpecification(true);

            // I'm setting same protection level for all the actions.
            // You could specify different protection level per action, if required. 
            // Also note, I haven't implemented any support for custom SOAP headers.
            // However that can easily be added using the same mechansim.
            switch (level)
            {
                case ProtectionLevel.None:
                    proReq.OutgoingSignatureParts.AddParts(unProtectedSpec, "*");
                    proReq.IncomingSignatureParts.AddParts(unProtectedSpec, "*");

                    proReq.OutgoingEncryptionParts.AddParts(unProtectedSpec, "*");
                    proReq.IncomingEncryptionParts.AddParts(unProtectedSpec, "*");
                    break;
                case ProtectionLevel.Sign:
                    proReq.OutgoingSignatureParts.AddParts(protectedSpec, "*");
                    proReq.IncomingSignatureParts.AddParts(protectedSpec, "*");

                    proReq.OutgoingEncryptionParts.AddParts(unProtectedSpec, "*");
                    proReq.IncomingEncryptionParts.AddParts(unProtectedSpec, "*");
                    break;
                case ProtectionLevel.EncryptAndSign:
                    proReq.OutgoingSignatureParts.AddParts(protectedSpec, "*");
                    proReq.IncomingSignatureParts.AddParts(protectedSpec, "*");

                    proReq.OutgoingEncryptionParts.AddParts(protectedSpec, "*");
                    proReq.IncomingEncryptionParts.AddParts(protectedSpec, "*");
                    break;
            }
            // Add our protection requirement for this endpoint into the binding params.

            bindingParameters.Add(proReq);
        }

        internal static ChannelProtectionRequirements GetChannelProtectionRequirements(ProtectionLevel protectionLevel)
        {
            ChannelProtectionRequirements result;

            if (protectionLevel == ProtectionLevel.EncryptAndSign)
            {
                if (encryptAndSignChannelProtectionRequirements == null)
                {
                    MessagePartSpecification header = new MessagePartSpecification();
                    header.HeaderTypes.Add(new XmlQualifiedName(CallbackContextHeaderName, CallbackContextHeaderNamespace));
                    ChannelProtectionRequirements requirements = new ChannelProtectionRequirements();
                    requirements.IncomingSignatureParts.AddParts(header);
                    requirements.IncomingEncryptionParts.AddParts(header);
                    requirements.OutgoingSignatureParts.AddParts(header);
                    requirements.OutgoingEncryptionParts.AddParts(header);
                    requirements.MakeReadOnly();
                    encryptAndSignChannelProtectionRequirements = requirements;
                }
                result = encryptAndSignChannelProtectionRequirements;
            }
            else if (protectionLevel == ProtectionLevel.Sign)
            {
                if (signChannelProtectionRequirements == null)
                {
                    MessagePartSpecification header = new MessagePartSpecification();
                    header.HeaderTypes.Add(new XmlQualifiedName(CallbackContextHeaderName, CallbackContextHeaderNamespace));
                    ChannelProtectionRequirements requirements = new ChannelProtectionRequirements();
                    requirements.IncomingSignatureParts.AddParts(header);
                    requirements.OutgoingSignatureParts.AddParts(header);
                    requirements.MakeReadOnly();
                    signChannelProtectionRequirements = requirements;
                }
                result = signChannelProtectionRequirements;
            }
            else
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException("protectionLevel"));
            }

            return result;
        }

 internal static ChannelProtectionRequirements GetChannelProtectionRequirements(ProtectionLevel protectionLevel)
 {
     if (protectionLevel == ProtectionLevel.EncryptAndSign)
     {
         if (encryptAndSignChannelProtectionRequirements == null)
         {
             MessagePartSpecification parts = new MessagePartSpecification {
                 HeaderTypes = { new XmlQualifiedName("CallbackContext", "http://schemas.microsoft.com/ws/2008/02/context") }
             };
             ChannelProtectionRequirements requirements2 = new ChannelProtectionRequirements();
             requirements2.IncomingSignatureParts.AddParts(parts);
             requirements2.IncomingEncryptionParts.AddParts(parts);
             requirements2.OutgoingSignatureParts.AddParts(parts);
             requirements2.OutgoingEncryptionParts.AddParts(parts);
             requirements2.MakeReadOnly();
             encryptAndSignChannelProtectionRequirements = requirements2;
         }
         return encryptAndSignChannelProtectionRequirements;
     }
     if (protectionLevel != ProtectionLevel.Sign)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException("protectionLevel"));
     }
     if (signChannelProtectionRequirements == null)
     {
         MessagePartSpecification specification2 = new MessagePartSpecification {
             HeaderTypes = { new XmlQualifiedName("CallbackContext", "http://schemas.microsoft.com/ws/2008/02/context") }
         };
         ChannelProtectionRequirements requirements3 = new ChannelProtectionRequirements();
         requirements3.IncomingSignatureParts.AddParts(specification2);
         requirements3.OutgoingSignatureParts.AddParts(specification2);
         requirements3.MakeReadOnly();
         signChannelProtectionRequirements = requirements3;
     }
     return signChannelProtectionRequirements;
 }

 protected override void StartPrimarySignatureCore(SecurityToken token, SecurityKeyIdentifier keyIdentifier, MessagePartSpecification signatureParts, bool generateTargettableSignature)
 {
     string str3;
     XmlDictionaryString str4;
     SecurityAlgorithmSuite algorithmSuite = base.AlgorithmSuite;
     string defaultCanonicalizationAlgorithm = algorithmSuite.DefaultCanonicalizationAlgorithm;
     XmlDictionaryString defaultCanonicalizationAlgorithmDictionaryString = algorithmSuite.DefaultCanonicalizationAlgorithmDictionaryString;
     if (defaultCanonicalizationAlgorithm != "http://www.w3.org/2001/10/xml-exc-c14n#")
     {
         throw System.ServiceModel.DiagnosticUtility.ExceptionUtility.ThrowHelperError(new MessageSecurityException(System.ServiceModel.SR.GetString("UnsupportedCanonicalizationAlgorithm", new object[] { algorithmSuite.DefaultCanonicalizationAlgorithm })));
     }
     algorithmSuite.GetSignatureAlgorithmAndKey(token, out str3, out this.signatureKey, out str4);
     string defaultDigestAlgorithm = algorithmSuite.DefaultDigestAlgorithm;
     XmlDictionaryString defaultDigestAlgorithmDictionaryString = algorithmSuite.DefaultDigestAlgorithmDictionaryString;
     this.signedInfo = new PreDigestedSignedInfo(ServiceModelDictionaryManager.Instance, defaultCanonicalizationAlgorithm, defaultCanonicalizationAlgorithmDictionaryString, defaultDigestAlgorithm, defaultDigestAlgorithmDictionaryString, str3, str4);
     this.signedXml = new SignedXml(this.signedInfo, ServiceModelDictionaryManager.Instance, base.StandardsManager.SecurityTokenSerializer);
     if (keyIdentifier != null)
     {
         this.signedXml.Signature.KeyIdentifier = keyIdentifier;
     }
     if (generateTargettableSignature)
     {
         this.signedXml.Id = base.GenerateId();
     }
     this.effectiveSignatureParts = signatureParts;
     this.hashStream = this.signedInfo.ResourcePool.TakeHashStream(defaultDigestAlgorithm);
 }

 protected override void StartPrimarySignatureCore(SecurityToken token,
     SecurityKeyIdentifier keyIdentifier,
     MessagePartSpecification signatureParts,
     bool generateTargettableSignature)
 {
     SecurityAlgorithmSuite suite = this.AlgorithmSuite;
     string canonicalizationAlgorithm = suite.DefaultCanonicalizationAlgorithm;
     XmlDictionaryString canonicalizationAlgorithmDictionaryString = suite.DefaultCanonicalizationAlgorithmDictionaryString;
     if (canonicalizationAlgorithm != SecurityAlgorithms.ExclusiveC14n)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(
             new MessageSecurityException(SR.GetString(SR.UnsupportedCanonicalizationAlgorithm, suite.DefaultCanonicalizationAlgorithm)));
     }
     string signatureAlgorithm;
     XmlDictionaryString signatureAlgorithmDictionaryString;
     suite.GetSignatureAlgorithmAndKey(token, out signatureAlgorithm, out this.signatureKey, out signatureAlgorithmDictionaryString);
     string digestAlgorithm = suite.DefaultDigestAlgorithm;
     XmlDictionaryString digestAlgorithmDictionaryString = suite.DefaultDigestAlgorithmDictionaryString;
     this.signedInfo = new PreDigestedSignedInfo(ServiceModelDictionaryManager.Instance, canonicalizationAlgorithm, canonicalizationAlgorithmDictionaryString, digestAlgorithm, digestAlgorithmDictionaryString, signatureAlgorithm, signatureAlgorithmDictionaryString);
     this.signedXml = new SignedXml(this.signedInfo, ServiceModelDictionaryManager.Instance, this.StandardsManager.SecurityTokenSerializer);
     if (keyIdentifier != null)
     {
         this.signedXml.Signature.KeyIdentifier = keyIdentifier;
     }
     if (generateTargettableSignature)
     {
         this.signedXml.Id = GenerateId();
     }
     this.effectiveSignatureParts = signatureParts;
     this.hashStream = this.signedInfo.ResourcePool.TakeHashStream(digestAlgorithm);
 }

        private static void AddFaultProtectionRequirements(FaultDescriptionCollection faults, ChannelProtectionRequirements requirements, ProtectionLevel defaultProtectionLevel, bool addToIncoming)
        {
            if (faults == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("faults"));
            if (requirements == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("requirements"));

            foreach (FaultDescription fault in faults)
            {
                MessagePartSpecification signedParts = new MessagePartSpecification();
                MessagePartSpecification encryptedParts = new MessagePartSpecification();
                ProtectionLevel p = fault.HasProtectionLevel ? fault.ProtectionLevel : defaultProtectionLevel;
                if (p != ProtectionLevel.None)
                {
                    signedParts.IsBodyIncluded = true;
                    if (p == ProtectionLevel.EncryptAndSign)
                    {
                        encryptedParts.IsBodyIncluded = true;
                    }
                }
                if (addToIncoming)
                {
                    requirements.IncomingSignatureParts.AddParts(signedParts, fault.Action);
                    requirements.IncomingEncryptionParts.AddParts(encryptedParts, fault.Action);
                }
                else
                {
                    requirements.OutgoingSignatureParts.AddParts(signedParts, fault.Action);
                    requirements.OutgoingEncryptionParts.AddParts(encryptedParts, fault.Action);
                }
            }
        }

 private static void AddHeaderProtectionRequirements(MessageHeaderDescription header, MessagePartSpecification signedParts,
     MessagePartSpecification encryptedParts, ProtectionLevel defaultProtectionLevel)
 {
     ProtectionLevel p = header.HasProtectionLevel ? header.ProtectionLevel : defaultProtectionLevel;
     if (p != ProtectionLevel.None)
     {
         XmlQualifiedName headerName = new XmlQualifiedName(header.Name, header.Namespace);
         signedParts.HeaderTypes.Add(headerName);
         if (p == ProtectionLevel.EncryptAndSign)
             encryptedParts.HeaderTypes.Add(headerName);
     }
 }