Windows LiveWindows Live™
 
 
Brian's profileBrian's World of BizTalkPhotosBlogLists Tools Help

Blog
    July 12

    PGP Pipeline Component

    Recently I was required to perform some PGP encryption and decryption of files.  Realizing this was going to require a custom Pipeline Component, off I went to Google to find one.  Hey, why reinvent the wheel. 

    I'm not certain why Microsoft didn't put one in place with the release of BTS 2006, but who am I to judge. :)

    The ones that kept popping up:

    GnuPG
    This one works very well.  I actually used GnuPG when creating a pipeline component for another project.  However, it is a command line program and requires installation and key management before it works.  While I knew this would get the job done, I wanted to use something that could be automatically deployed from machine to machine.

    Pro BizTalk 2006
    Since I have not purchased this book, I don't have access to the code.  Again, I don't want to buy something I know I can do. 
    Don't get me wrong, I'm not opposed to buying code, but it needs to make sense.  And in this case, it didn't.  Especially since I have done this before and knew the job could be performed in the allotted timeframe.  Also, I have nothing against this book. It comes highly reviewed.  I'm just a little put-off about buying another BizTalk book.  I waited and waited for the official BTS 2004 book to come out and was very disappointed.  Ok, so I need to get over it.  I will probably buy a BTS 2006 book eventually.  I just don't know which one. [end rant]

    Bouncy Castle Crypto
    A co-worker pointed me in the direction of the Bouncy Castle C# API.  They give you the DLL as well as the source code.  The only problem I ran in to was that the DLL was not strongly named.  Once I resolved that issue I was off and running.  This gave me the ability to easily deploy from server to server.  The only thing I had to do was GAC the DLL and copy the keys.

    Here is the code for the PGP Pipeline component.  I did not distribute the necessary crypto.dll, so you will need to get it from Bouncy Castle.  Remember, you will need to get the source in order to strongly name the assembly. 

    [UPDATED - 7/27/2007] - I have updated the code and source with version 1.1. 

    Link to readme.txt: readme.txt
    Link to dll: BAJ.BizTalk.PipelineComponent.PGP.dll
    Link to source code:  PGP.zip

    Notes:

    • I can't get the stupid icon to appear for whatever reason.  If you spot my error, please let me know so I can fix it.
    • The project has a Post Build Event that will copy the DLL to C:\Program Files\Microsoft BizTalk Server 2006\Pipeline Components. 
      • You may need to change the path based on your environment.
      • You will receive a build failure if you have a project open that references that file.  Also, you may need to stop your BizTalk host before compilation once you have deployed and used the component.
  • The code assumes you already have the necessary Public and/or Private keys.  I did not include a way to generate the pair.
  • Be careful when testing.  I chased around this error message for almost an hour before I realized what was happening: Could not find file 'C:\Temp\testfile.txt'.
    • The PGP Pipeline Component expects the encrypted version of the file and the decrypted version of the file to have the same name with the exception of the .PGP extension.  If you encrypt somefile.txt, it becomes somefile.txt.pgp.  If you then rename somefile.txt.pgp to differentfile.txt.pgp, the crypto.dll writes the decrypted file to somefile.txt.
    • Because I wasn't sure what the end-user's desired outcome should be (error if the filenames don't match, always use the filename of the message, etc.) I left it alone and created a DecryptFileAsStream() method that does not create a file, but returns the decrypted content as a Stream.
    • I had thought about adding a property to specify the temporary location where the file is written during encryption/decryption but have not had time to add it.  Currently, it will place the temporary files in C:\Windows\System32.
      • Ok, so now I have added it. :)

        • Feedback welcomed.

        4:05 PM | Blog it | BizTalk

        Comments (3)

        Please wait...
        Sorry, the comment you entered is too long. Please shorten it.
        You didn't enter anything. Please try again.
        Sorry, we can't add your comment right now. Please try again later.
        To add a comment, you need permission from your parent. Ask for permission
        Your parent has turned off comments.
        Sorry, we can't delete your comment right now. Please try again later.
        You've exceeded the maximum number of comments that can be left in one day. Please try again in 24 hours.
        Your account has had the ability to leave comments disabled because our systems indicate that you may be spamming other users. If you believe that your account has been disabled in error please contact Windows Live support.
        Complete the security check below to finish leaving your comment.
        The characters you type in the security check must match the characters in the picture or audio.

        To add a comment, sign in with your Windows Live ID (if you use Hotmail, Messenger, or Xbox LIVE, you have a Windows Live ID). Sign in


        Don't have a Windows Live ID? Sign up
        Firoz Ozmanwrote:
        Hi Brian,

        I have made the changes you noted here for the PropertyBag issues. I still face the same issues.
        Do we have an updates code for this?
        Thanks very much for your help.

        Pls reach mail me at firoz@firozozman.com
        May 15
        Matt Littlewrote:

        I think that I have spotted a problem in the code in relation to the design time versus instance/deployment time properties.

         

        As the code stands, it works if you set the properties at design time. It also works if you change ALL the properties from the default after deployment.

         

        The problem arises when you change just some of the properties once on a send/receive port.

         

        You can see this if, for example, you change the public key name once the component has been used on a pipeline. You get an error "Invalid Operation". If you change the operation from encrypt to decrypt, then it complains about an invalid path.

         

        I believe that the issue is in IPersistPropertyBag.Load. The problem arises when the code reads initially the design time value and then reads the instance time setting (two executions always occur per invocation).

         

        The code will read a design time setting and then (if not changed at deployment time) will get null when it reads from the deployment/instance time setting. The code that deals with this is here:

         

        if (valPublicKeyFile != null)

                        PublicKeyFile = (string)valPublicKeyFile;

                    else

                        PublicKeyFile = "";

         

        All is ok when it gets the design time setting. On BT 2006 when another setting has been changed (e.g. Operation) then the value of valPublicKeyFile (set elsewhere in your code) will be null - at which point you set it to empty string, thereby overwriting the design time setting.

         

        I changed to code to the following to get it work:

         

        if (valPublicKeyFile != null)

                        PublicKeyFile = (string)valPublicKeyFile;

         

        This should be sufficient as all design time settings, once the component is on a pipeline, are validated when you build the pipeline – it is impossible to build the pipeline unless you have either the string Encrypt or Decrypt as the operation and other values are also valid. You could perform other tests to check that a valid instance/deployment time value has been set (actually only applies to the operation string as Booleans can only be set in a dropdown and there is no way to validate that the keys are valid until you try to use them).


        This problem is repeatable if the component is placed on a pipeline in BT2006. 


        Mail me if you want more explanation!

         

        Matt

         

        Dec. 17
        Brianwrote:

        I have run across an issue when attempting to decrypt a signed file.  I have updated my local version of the code, but have not updated the online version.  I will post the changes as time permits.  In the interim, if you would like it sooner, please let me know.

        July 25

        Trackbacks

        The trackback URL for this entry is:
        http://bajwork.spaces.live.com/blog/cns!2BA8444DD234C287!145.trak
        Weblogs that reference this entry
        • None