Steve Sheldon

Simple Cryptography Block

sodablue — Sat, 25 Oct 2008 19:23:00 GMT

I was looking around for a piece of code which would take a string and encrypt it into a Base64 encoded string such that I could later decrypt the string and obtain the message. This was to be used in a confirmation email. The message being urlencoded onto a confirmation url that the user could click and verify his email address was correct, or to redirect to a password setup page. I found some examples in MSDN, but none did quite what I wanted. I also wanted to use the key from the machineKey section of web.config.

I came up with this and thought others might find some use for it.

using System;
using System.Text;
using System.Security.Cryptography;
using System.Web.Configuration;
using System.IO;
using System.Configuration;

namespace SodaBlue.Utility
{
  public static class Cryptography
  {
    public static string EncryptAESToBase64(string dataToEncrypt)
    {
      //Get the decryption key from the machine key section of the web.config
      MachineKeySection machineKey = (MachineKeySection)ConfigurationManager.GetSection("system.web/machineKey");
      string key = machineKey.DecryptionKey;
      byte[] keyBytes = UTF8Encoding.UTF8.GetBytes(key);
      Rfc2898DeriveBytes rfc = new Rfc2898DeriveBytes(key, keyBytes, 1000);

      // Use the AES managed encryption provider
      AesManaged encryptor = new AesManaged();
      encryptor.Key = rfc.GetBytes(16);
      encryptor.IV = rfc.GetBytes(16);

      using (MemoryStream ms = new MemoryStream())
      {
        using (CryptoStream encrypt = new CryptoStream(ms, encryptor.CreateEncryptor(), CryptoStreamMode.Write))
        {
          byte[] dataBytes = new UTF8Encoding(false).GetBytes(dataToEncrypt);
          encrypt.Write(dataBytes, 0, dataBytes.Length);
          encrypt.FlushFinalBlock();
          encrypt.Close();
          return Convert.ToBase64String(ms.ToArray());
        }
      }
    }

    public static string DecryptAESFromBase64(string dataToDeCrypt)
    {
      //Get the decryption key from the machine key section of the web.config
      MachineKeySection machineKey = (MachineKeySection)ConfigurationManager.GetSection("system.web/machineKey");
      string key = machineKey.DecryptionKey;
      byte[] keyBytes = new UTF8Encoding(false).GetBytes(key);
      Rfc2898DeriveBytes rfc = new Rfc2898DeriveBytes(key, keyBytes, 1000);

      AesManaged decryptor = new AesManaged();
      decryptor.Key = rfc.GetBytes(16);
      decryptor.IV = rfc.GetBytes(16);

      using (MemoryStream ms = new MemoryStream())
      {
        using (CryptoStream decrypt = new CryptoStream(ms, decryptor.CreateDecryptor(), CryptoStreamMode.Write))
        {
          byte[] dataBytes = Convert.FromBase64String(dataToDeCrypt);
          decrypt.Write(dataBytes, 0, dataBytes.Length);
          decrypt.FlushFinalBlock();
          decrypt.Close();

          return new UTF8Encoding(false).GetString(ms.ToArray());
        }
      }
    }

  }
}

And a simple unit test to validate we can encrypt and decrypt

using System;
using NUnit.Framework;
using sbCommunity.Core.Infrastructure;

namespace sbCommunity.UnitTests
{
  [TestFixture]
  public class CryptographyTest
  {
    [Test]
    public void TestEncrypt()
    {
      const string cTest = "Now is the time for all good men to come to the aid of our countries";
      string encrypted = Cryptography.EncryptAESToBase64(cTest);
      string decrypted = Cryptography.DecryptAESFromBase64(encrypted);
      Assert.AreEqual(cTest, decrypted);
    }
  }
}

A Method to Handle Audit Fields in LINQ to SQL

sodablue — Sun, 24 Feb 2008 01:27:00 GMT

Subsonic has this convention where it does this automatically for you, if the table had columns CreatedOn, CreatedBy, ModifiedOn, ModifiedBy. DLINQ doesn't really have anything like this built-in. This isn't something one wishes to do manually, as to remember to update these columns every time you save something would be prone to forgetfulness as well as being a lot of extra typing. So how might we wire up something similar to what SubSonic does?

I did a few searches on the internet, and while I found a couple of suggestions I didn't find an easy solution. One suggestion was to extend the partial methods of the DataContext for Insert and Update. This worked, but it means for every entity in your model you have to extend Insert and Update. Fairly quickly you have several dozen of these things and you notice they're all doing the same thing. Another suggestion involved extending SubmitChanges() in the DataContext, but it was rather complicated and relied upon reflecting upon the properties of the class to check if they had the right keywords in them set them appropriately. I don't want to do reflection if I can otherwise avoid it.

What if we used our own convention? Our tables use the same audit field names, just like with Subsonic. When we pull the tables into the LINQ to SQL class builder, it creates all of our entity classes for us with properties for those fields. Since the classes are partials, we can also extend them and claim they implement a common interface.

Examples are in C#, and you'll need to remember to create the interfaces and classes in the appropriate namespaces.

First, we create an interface to define our contract. We create an IAuditable interface with properties for our audit fields.

    internal interface IAuditable
    {
        string CreatedBy { get; set; }
        DateTime CreatedOn { get; set; }
        string ModifiedBy { get; set; }
        DateTime ModifiedOn { get; set; }
    }

Now, we extend the classes created by LINQ to SQL, and note that they implement our interface. This is relatively easy to do as they were partial classes. The properties should already be in the classes as they were created by LINQ to SQL based on our table definitions. Here I just use a couple of example table classes, you'll need to remember to add the same syntax for each table as you add it to LINQ to SQL.

    public partial class Calendar : IAuditable
    {
    }

    public partial class Photo : IAuditable
    {
    }

    public partial class Content : IAuditable
    {
    }

    public partial class Discussion : IAuditable
    {
    }

Now, we override SubmitChanges in our DataContext. I have it call a routine which updates the auditfields, passing in the list of all objects being managed by the datacontext. It's nice that the DataContext method GetChangeSet() has lists for Inserts or Updates. I'm using a utility class to perform the work.

        public override void SubmitChanges(System.Data.Linq.ConflictMode failureMode)
        {
            AuditUtility.ProcessInserts(base.GetChangeSet().Inserts);
            AuditUtility.ProcessUpdates(base.GetChangeSet().Updates);
            
            base.SubmitChanges(failureMode);
        }

And then finally our AuditUtility class. Basically, it iterates through the list, checks to see if the object implements the IAuditable interface we created, and if so sets the auditfields. This allows us to have tables which don't have audit fields, in which case they are simple ignored. I have a GetUserName() method inside that tries to identify the authenticated user whether it's web or local windows context, although this may need to be modified to handle the specifics of your app.

    internal static class AuditUtility
    {
        private static string GetUserName()
        {
            string userName = "";
            if (System.Web.HttpContext.Current != null)
                userName = System.Web.HttpContext.Current.User.Identity.Name;
            else
                userName = Environment.UserName;

            return userName;
        }

        private static void ProcessAuditFields(IList<System.Object> list, bool UpdateCreatedFields)
        {
            foreach (var item in list)
            {
                IAuditable entity = item as IAuditable;
                if (entity != null)
                {
                    if (UpdateCreatedFields)
                    {
                        entity.CreatedBy = GetUserName();
                        entity.CreatedOn = DateTime.Now;
                    }
                
                    entity.ModifiedBy = GetUserName();
                    entity.ModifiedOn = DateTime.Now;
                }
            }
        }

        internal static void ProcessInserts(IList<System.Object> list)
        {
            ProcessAuditFields(list, true);
        }

        internal static void ProcessUpdates(IList<System.Object> list)
        {
            ProcessAuditFields(list, false);
        }

    }

I hope that this technique can be of some use to others, and would value any feedback on how to make it work better.

Good Afternoon

sodablue — Wed, 23 Jan 2008 16:58:00 GMT

I want to thank Joe Stagner for his invitation for people to blog at the asp.net site. I feel like an AOL n00b joing usenet back in '94.

By day I work for a financial services company supporting an asp.net website with Microsoft Analysis Services on the backend. By night, I've been spending my time most recently creating a personal project with the ASP.NET MVC framework CTP, LINQ and anything .Net 3.5, and I hope to write about things here as I discover them.