SslStream.TargetHostName is unavailable

[shirhatti]

Description

SslStream.TargetHostName is not set unless I've I'm using one of the callbacks on SslStream (LocalCertificateSelectionCallback or the ServerOptionsSelectionCallback). If I specify the certificate directly, you won't attempt to decode the SNI)

runtime/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs

Lines 508 to 521 in 1dfe32a

	case TlsContentType.Handshake:
	if (!_isRenego && _handshakeBuffer.ActiveReadOnlySpan[TlsFrameHelper.HeaderSize] == (byte)TlsHandshakeType.ClientHello &&
	(_sslAuthenticationOptions!.ServerCertSelectionDelegate != null ||
	_sslAuthenticationOptions!.ServerOptionDelegate != null))
	{
	TlsFrameHelper.ProcessingOptions options = NetEventSource.Log.IsEnabled() ?
	TlsFrameHelper.ProcessingOptions.All :
	TlsFrameHelper.ProcessingOptions.ServerName;
	// Process SNI from Client Hello message
	if (!TlsFrameHelper.TryGetFrameInfo(_handshakeBuffer.ActiveReadOnlySpan, ref _lastFrame, options))
	{
	if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(this, $"Failed to parse TLS hello.");
	}

Repro

Server:

using System.Diagnostics;
using System.Linq;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using System.Text;
var port = 5001;
var ipEndPoint = new IPEndPoint(IPAddress.Loopback, port);
var listenSocket = new Socket(ipEndPoint.AddressFamily,
                        SocketType.Stream,
                        ProtocolType.Tcp);
listenSocket.Bind(ipEndPoint);
listenSocket.Listen();
using var acceptSocket = await listenSocket.AcceptAsync();
using var ns = new NetworkStream(acceptSocket);
using var sslStream = new SslStream(ns);
using var store = new X509Store("My", StoreLocation.CurrentUser, OpenFlags.ReadOnly);
using var certificate = store.Certificates.Find(X509FindType.FindBySubjectName, "localhost", false)
                  .Where(c => c.HasPrivateKey)
                  .FirstOrDefault();

// Specifying a delegate instead of directly providing the certificate works
var sslOptions = new SslServerAuthenticationOptions
{
    ServerCertificate = certificate,
//  ServerCertificateSelectionCallback = (_, name) => certificate,
    CertificateRevocationCheckMode = X509RevocationMode.NoCheck
};
sslStream.AuthenticateAsServer(sslOptions);
Debug.Assert(!string.IsNullOrEmpty(sslStream.TargetHostName));
await sslStream.WriteAsync(Encoding.UTF8.GetBytes("Hello, World!"));

Client: curl.exe -k https://localhost:5001

👀 @wfurt

[ghost]

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

SslStream.TargetHostName is not set unless I've I'm using one of the callbacks on SslStream (LocalCertificateSelectionCallback or the ServerOptionsSelectionCallback). If I specify the certificate directly, you won't attempt to decode the SNI)

runtime/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs

Lines 508 to 521 in 1dfe32a

	case TlsContentType.Handshake:
	if (!_isRenego && _handshakeBuffer.ActiveReadOnlySpan[TlsFrameHelper.HeaderSize] == (byte)TlsHandshakeType.ClientHello &&
	(_sslAuthenticationOptions!.ServerCertSelectionDelegate != null ||
	_sslAuthenticationOptions!.ServerOptionDelegate != null))
	{
	TlsFrameHelper.ProcessingOptions options = NetEventSource.Log.IsEnabled() ?
	TlsFrameHelper.ProcessingOptions.All :
	TlsFrameHelper.ProcessingOptions.ServerName;
	// Process SNI from Client Hello message
	if (!TlsFrameHelper.TryGetFrameInfo(_handshakeBuffer.ActiveReadOnlySpan, ref _lastFrame, options))
	{
	if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(this, $"Failed to parse TLS hello.");
	}

Repro

Server:

using System.Diagnostics;
using System.Linq;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using System.Text;
var port = 5001;
var ipEndPoint = new IPEndPoint(IPAddress.Loopback, port);
var listenSocket = new Socket(ipEndPoint.AddressFamily,
                        SocketType.Stream,
                        ProtocolType.Tcp);
listenSocket.Bind(ipEndPoint);
listenSocket.Listen();
using var acceptSocket = await listenSocket.AcceptAsync();
using var ns = new NetworkStream(acceptSocket);
using var sslStream = new SslStream(ns);
using var store = new X509Store("My", StoreLocation.CurrentUser, OpenFlags.ReadOnly);
using var certificate = store.Certificates.Find(X509FindType.FindBySubjectName, "localhost", false)
                  .Where(c => c.HasPrivateKey)
                  .FirstOrDefault();

// Specifying a delegate instead of directly providing the certificate works
var sslOptions = new SslServerAuthenticationOptions
{
    ServerCertificate = certificate,
//  ServerCertificateSelectionCallback = (_, name) => certificate,
    CertificateRevocationCheckMode = X509RevocationMode.NoCheck
};
sslStream.AuthenticateAsServer(sslOptions);
Debug.Assert(!string.IsNullOrEmpty(sslStream.TargetHostName));
await sslStream.WriteAsync(Encoding.UTF8.GetBytes("Hello, World!"));

Client: curl.exe -k https://localhost:5001

👀 @wfurt

Author:	shirhatti
Assignees:	-
Labels:	area-System.Net.Security, untriaged
Milestone:	-

[ManickaP]

Triage: we should either fix this or document the behavior.
@shirhatti how important is this for you? Is this something critical for 6.0?

[shirhatti]

Not important.