Implementing an internal interface over .NET Remoting

Question

I had an internal interface that I needed to implement over .NET remoting to make sure only our assemblies ever called these members remotely (used InternalsVisibleTo to give access to friend assemblies). However, when I implemented the interface and built it, I got the following error:

'AssemblyName' does not implement interface member 'InterfaceMember1(...)' 'AssemblyName' cannot implement an interface because it is not public.

I was unable to search and find a way to make this work. However, I explicitly implemented the interface which allowed my assembly to build, and I can call the remote methods from any friend assembly with no issues.

I'm concerned with the lack of information I found on this topic though, especially on MSDN and StackOverflow. Is there anything wrong with implementing .NET remoting over an internal interface? And if so, why?

EDIT Here is what my interface and implementation look like:

Interface

internal interface IAdmin
{
    bool TESTPING();
    bool AdminTask1(int val);
    ...
}

Implementation

public class RService : MarshalByRefObject, IAdmin
{
    //IAdmin members

    bool IAdmin.TESTPING()
    {
        return true;
    }

    bool IAdmin.AdminTask1(int val)
    {
        // do stuff
        return true;
    }
}

score 1 · Answer 1 · answered Apr 15 '13 at 11:37

1

MSDN: http://msdn.microsoft.com/en-us/library/ms182313(VS.80).aspx

Interface methods have public accessibility, which cannot be changed by the implementing type. An internal interface creates a contract that is not intended to be implemented outside the assembly that defines the interface. A public type that implements a method of an internal interface using the virtual modifier allows the method to be overridden by a derived type that is outside the assembly. If a second type in the defining assembly calls the method and expects an internal-only contract, behavior might be compromised when, instead, the overridden method in the outside assembly is executed. This creates a security vulnerability.

answered Apr 15 '13 at 11:37

Felix C

1,755
5
26
40

Isn't the bit about having the interface member overridden only true if I mark the interface members as virtual? I thought interface members were sealed by default in .NET? Or am I misunderstanding the vulnerability? – codewario Apr 15 '13 at 11:49
An interface is always abstract. The MSDN article is talking about creating a class, which implements the interface and sets the implemented members as virtual. And in your remote application, you inherit from the new class. But before doing this, I would think about making the interface public. – Felix C Apr 15 '13 at 12:02

score 1 · Accepted Answer · answered Apr 15 '13 at 11:37

1

You can't implement security feature that way. Remoting specification is open, so anyone can create a message, send it to your remoted class and receive a response. Your service cannot reliably determine who called it.

You can implement a custom authorization, and send a secret token with each method call to ensure that only your code calls it.

answered Apr 15 '13 at 11:37

alex

12,464
3
46
67

I already do this in my code, I thought making the interface internal might add a bit of extra security which it seems is not the case – codewario Apr 15 '13 at 16:21

Implementing an internal interface over .NET Remoting

2 Answers2