Skip to content

Commit 23674ee

Browse files
ManickaPManickaP
committed
Do not set SslProtocols and log ClientHello on the server.
1 parent a9b700a commit 23674ee

File tree

5 files changed

+49
-24
lines changed

5 files changed

+49
-24
lines changed

‎src/libraries/Common/tests/System/Net/Http/Http2LoopbackConnection.cs

+12-8
Original file line numberDiff line numberDiff line change
@@ -62,19 +62,23 @@ public static async Task<Http2LoopbackConnection> CreateAsync(SocketWrapper sock
6262
using (X509Certificate2 cert = httpOptions.Certificate ?? Configuration.Certificates.GetServerCertificate())
6363
{
6464
#if !NETFRAMEWORK
65-
SslServerAuthenticationOptions options = new SslServerAuthenticationOptions();
65+
await sslStream.AuthenticateAsServerAsync((SslStream stream, SslClientHelloInfo clientHelloInfo, object? state, CancellationToken cancellationToken) =>
66+
{
67+
Console.WriteLine($"SSL protocols: {clientHelloInfo.SslProtocols}");
6668

67-
options.EnabledSslProtocols = httpOptions.SslProtocols;
69+
SslServerAuthenticationOptions options = new SslServerAuthenticationOptions();
6870

69-
var protocols = new List<SslApplicationProtocol>();
70-
protocols.Add(SslApplicationProtocol.Http2);
71-
options.ApplicationProtocols = protocols;
71+
options.EnabledSslProtocols = httpOptions.SslProtocols;
7272

73-
options.ServerCertificate = cert;
73+
var protocols = new List<SslApplicationProtocol>();
74+
protocols.Add(SslApplicationProtocol.Http2);
75+
options.ApplicationProtocols = protocols;
7476

75-
options.ClientCertificateRequired = httpOptions.ClientCertificateRequired;
77+
options.ServerCertificate = cert;
7678

77-
await sslStream.AuthenticateAsServerAsync(options, CancellationToken.None).ConfigureAwait(false);
79+
options.ClientCertificateRequired = httpOptions.ClientCertificateRequired;
80+
return ValueTask.FromResult(options);
81+
}, null, CancellationToken.None).ConfigureAwait(false);
7882
#else
7983
await sslStream.AuthenticateAsServerAsync(cert, httpOptions.ClientCertificateRequired, httpOptions.SslProtocols, checkCertificateRevocation: false).ConfigureAwait(false);
8084
#endif

‎src/libraries/Common/tests/System/Net/Http/Http3LoopbackServer.cs

+4-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
using System.Net.Quic;
88
using System.Net.Security;
99
using System.Security.Cryptography.X509Certificates;
10+
using System.Threading;
1011
using System.Threading.Tasks;
1112

1213
namespace System.Net.Test.Common
@@ -31,8 +32,10 @@ public Http3LoopbackServer(Http3Options options = null)
3132
{
3233
new SslApplicationProtocol(options.Alpn)
3334
},
34-
ConnectionOptionsCallback = (_, _, _) =>
35+
ConnectionOptionsCallback = (QuicConnection quicConnection, SslClientHelloInfo clientHelloInfo, CancellationToken cancellationToken) =>
3536
{
37+
Console.WriteLine($"SSL protocols: {clientHelloInfo.SslProtocols}");
38+
3639
var serverOptions = new QuicServerConnectionOptions()
3740
{
3841
DefaultStreamErrorCode = Http3LoopbackConnection.H3_REQUEST_CANCELLED,

‎src/libraries/Common/tests/System/Net/Http/HttpAgnosticLoopbackServer.cs

+11-1
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,17 @@ public override async Task<GenericLoopbackConnection> EstablishGenericConnection
8080
sslOptions.ApplicationProtocols = _options.SslApplicationProtocols;
8181
sslOptions.ServerCertificate = cert;
8282

83-
await sslStream.AuthenticateAsServerAsync(sslOptions, CancellationToken.None).ConfigureAwait(false);
83+
await sslStream.AuthenticateAsServerAsync((SslStream stream, SslClientHelloInfo clientHelloInfo, object? state, CancellationToken cancellationToken) =>
84+
{
85+
Console.WriteLine($"SSL protocols: {clientHelloInfo.SslProtocols}");
86+
87+
SslServerAuthenticationOptions sslOptions = new SslServerAuthenticationOptions();
88+
89+
sslOptions.EnabledSslProtocols = _options.SslProtocols;
90+
sslOptions.ApplicationProtocols = _options.SslApplicationProtocols;
91+
sslOptions.ServerCertificate = cert;
92+
return ValueTask.FromResult(sslOptions);
93+
}, null, CancellationToken.None).ConfigureAwait(false);
8494
}
8595

8696
stream = sslStream;

‎src/libraries/Common/tests/System/Net/Http/LoopbackServer.cs

+11-6
Original file line numberDiff line numberDiff line change
@@ -478,14 +478,19 @@ public static async Task<Connection> CreateAsync(SocketWrapper socket, Stream st
478478
{
479479
var sslStream = new SslStream(stream, false, delegate { return true; });
480480
#if !NETFRAMEWORK
481-
SslServerAuthenticationOptions sslOptions = new SslServerAuthenticationOptions()
481+
482+
await sslStream.AuthenticateAsServerAsync((SslStream stream, SslClientHelloInfo clientHelloInfo, object? state, CancellationToken cancellationToken) =>
482483
{
483-
EnabledSslProtocols = httpOptions.SslProtocols,
484-
ServerCertificateContext = httpOptions.CertificateContext ?? SslStreamCertificateContext.Create(Configuration.Certificates.GetServerCertificate(), null),
485-
ClientCertificateRequired = true,
486-
};
484+
Console.WriteLine($"SSL protocols: {clientHelloInfo.SslProtocols}");
487485

488-
await sslStream.AuthenticateAsServerAsync(sslOptions, default).ConfigureAwait(false);
486+
SslServerAuthenticationOptions sslOptions = new SslServerAuthenticationOptions()
487+
{
488+
EnabledSslProtocols = httpOptions.SslProtocols,
489+
ServerCertificateContext = httpOptions.CertificateContext ?? SslStreamCertificateContext.Create(Configuration.Certificates.GetServerCertificate(), null),
490+
ClientCertificateRequired = true,
491+
};
492+
return ValueTask.FromResult(sslOptions);
493+
}, null, CancellationToken.None).ConfigureAwait(false);
489494
#else
490495
using (X509Certificate2 cert = httpOptions.Certificate ?? Configuration.Certificates.GetServerCertificate())
491496
{

‎src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs

+11-8
Original file line numberDiff line numberDiff line change
@@ -1176,40 +1176,43 @@ private void SetSessionHandleTlsOptions(SafeWinHttpHandle sessionHandle)
11761176
{
11771177
const SslProtocols Tls13 = (SslProtocols)12288; // enum is missing in .NET Standard
11781178
uint optionData = 0;
1179-
SslProtocols sslProtocols =
1180-
(_sslProtocols == SslProtocols.None) ? SecurityProtocol.DefaultSecurityProtocols : _sslProtocols;
1179+
1180+
if (_sslProtocols == SslProtocols.None)
1181+
{
1182+
return;
1183+
}
11811184

11821185
#pragma warning disable 0618 // SSL2/SSL3 are deprecated
1183-
if ((sslProtocols & SslProtocols.Ssl2) != 0)
1186+
if ((_sslProtocols & SslProtocols.Ssl2) != 0)
11841187
{
11851188
optionData |= Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_SSL2;
11861189
}
11871190

1188-
if ((sslProtocols & SslProtocols.Ssl3) != 0)
1191+
if ((_sslProtocols & SslProtocols.Ssl3) != 0)
11891192
{
11901193
optionData |= Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_SSL3;
11911194
}
11921195
#pragma warning restore 0618
11931196

11941197
#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
1195-
if ((sslProtocols & SslProtocols.Tls) != 0)
1198+
if ((_sslProtocols & SslProtocols.Tls) != 0)
11961199
{
11971200
optionData |= Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1;
11981201
}
11991202

1200-
if ((sslProtocols & SslProtocols.Tls11) != 0)
1203+
if ((_sslProtocols & SslProtocols.Tls11) != 0)
12011204
{
12021205
optionData |= Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1;
12031206
}
12041207
#pragma warning restore SYSLIB0039
12051208

1206-
if ((sslProtocols & SslProtocols.Tls12) != 0)
1209+
if ((_sslProtocols & SslProtocols.Tls12) != 0)
12071210
{
12081211
optionData |= Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2;
12091212
}
12101213

12111214
// Set this only if supported by WinHttp version.
1212-
if (s_supportsTls13.Value && (sslProtocols & Tls13) != 0)
1215+
if (s_supportsTls13.Value && (_sslProtocols & Tls13) != 0)
12131216
{
12141217
optionData |= Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_3;
12151218
}

0 commit comments

Comments
 (0)