Skip to content

Conversation

DeagleGross
Copy link
Member

Supporting TLS Client Hello callback in Kestrel

HTTP.SYS contribution was done in this PR

Description

Adding a new property to HttpsConnectionAdapterOptions - TlsClientHelloBytesCallback (added to public API).
It allows to subscribe to the TLS client hello message parsed from the ConnectionContext.Transport.Input:

options.TlsClientHelloBytesCallback = (connection, clientHelloBytes) =>
{
    Logger.LogDebug("[Received TlsClientHelloBytesCallback] Connection: {0}; TLS client hello buffer: {1}", connection.ConnectionId, clientHelloBytes.Length);
};

If property HttpsConnectionAdapterOptions.TlsClientHelloBytesCallback is set (not null), then new middleware is added before HttpsConnectionMiddleware.

The implementation is doing the following:

  1. waiting for data to come
  2. if there is enough data, try to parse TLS and determine if we need to invoke a callback
  3. if there is not enough data, we either wait (not end of the stream) or simply continue the middleware pipeline

Fixes #60805

@DeagleGross DeagleGross self-assigned this Apr 23, 2025
@ghost ghost added the area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions label Apr 23, 2025
Copy link
Member

@gfoidl gfoidl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM -- just a small comment.

@DeagleGross
Copy link
Member Author

add tests for SSL 2.0 and SSL 3.0

@DeagleGross
Copy link
Member Author

add tests for SSL 2.0 and SSL 3.0

done

@DeagleGross DeagleGross merged commit 0862db9 into dotnet:main May 1, 2025
26 of 27 checks passed
@DeagleGross DeagleGross deleted the dmkorolev/kestrel-tls branch May 1, 2025 17:00
@dotnet-policy-service dotnet-policy-service bot added this to the 10.0-preview5 milestone May 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions
Projects
None yet
Development

Successfully merging this pull request may close these issues.

API Proposal: Expose TLS client hello message
3 participants