Tom:

What I don't understand is, according to MSDN documentation "Automatic Deserialization in .NET Remoting", the default "Low" deserialization level supports "Reference and value types that are marked with the SerializableAttribute attribute but do not implement the ISerializable interface.". In my test app below, the class Stuff fits in this category, but the security error remains. This was resolved by setting typeFilterLevel = Full.

Any idea why?

Here's the code listing:

This sample app is a remoting server hosted in a windows service with a console client. I'm listing the code below.

First the remoting interface:

public interface IDoStuff{
void setStuff(Stuff stf);
Stuff getStuff();
}

Stuff is a simple serialized class WITHOUT implementing ISerializable:

[Serializable]
public class Stuff {
private string id;
public string ID {
get{ return id; }
set{ id = value; }
}
}

Now the remoting server that implements IDoStuff:

public class TestServiceCtrl : MarshalByRefObject, IDoStuff
{
void IDoStuff.setStuff(Stuff stf){
// Util.WriteLog code not shown here
Util.WriteLog("TestServiceCtrl setStuff: " + stf.ID);
}

Stuff IDoStuff.getStuff(){
Stuff s = new Stuff();
s.ID = "ID_" + DateTime.Now;
Util.WriteLog("TestServiceCtrl getStuff: " + s.ID);
return s;
}
}

And the windows service that exposes the remoting server:

protected override void OnStart(string[] args)
{
IChannel ch = new TcpChannel(50015);
ChannelServices.RegisterChannel(ch);
RemotingConfiguration.RegisterWellKnownServiceType (typeof(TestServiceCtrl),
"testremote",
WellKnownObjectMode.Singleton);
Util.WriteLog("OnStart called, TestServer at port 50015");
}

And finally the client:

class TestClient
{
static void Main(string[] args)
{
new TestClient().run();
}

public void run(){
Type type = typeof(IDoStuff);
IDoStuff ctrl = (IDoStuff)Activator.GetObject(type, "tcp://localhost:50015/testremote");
Stuff s = ctrl.getStuff();
Console.WriteLine("Client got stuff: " + s.ID);
s.ID += "_client";
Console.WriteLine("Client setting stuff: " + s.ID);
ctrl.setStuff(s); // line 26
}
}

at line 26, following exception is thrown:

Unhandled Exception: System.Runtime.Serialization.SerializationExceptio n:
Because of security restrictions, the type TestRemote.Stuff cannot be accessed. ---> System.Security.SecurityException: Request failed.
at System.Security.SecurityRuntime.FrameDescSetHelper (FrameSecurityDescriptor secDesc, PermissionSet demand
Set, PermissionSet& alteredDemandSet)
at System.Runtime.Serialization.FormatterServices.nat iveGetSafeUninitializedObject(RuntimeType type)
at System.Runtime.Serialization.FormatterServices.Get SafeUninitializedObject(Type type)
--- End of inner exception stack trace ---


"Tom" wrote:

Hi,
the class Stuff have to be implemented in a separate assembly, which is
accessible (and referenced) both from the client and the server.

Sunny


In article <59E0611C-E434-426C-BE50-FD0D8C1D7D73 (AT) microsoft (DOT) com>,
tang_ai (AT) hotmail (DOT) com. says...