[release/6.0] add support for parsing Unified TLS hello #68425
Conversation
|
Tagging subscribers to this area: @dotnet/ncl, @vcsjones Issue Detailsfixes #68310 This covers cases when client sends TLS 1.x hello in Sslv2 frame format. As described in the linked issue, server will respond with normal response and TLS 1.x will be negotiated. The TLS Parser is essentially dup of dotnet/yarp#1656 Both changes were verified by App Service. Note that main will need more work because of #64322.
|
|
test failures should be fixed by #68332. |
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
Outdated
Show resolved
Hide resolved
|
The should be ready for another pass @stephentoub . I use more constant when possible and I removed the side check as unnecessary and possibly problematic. |
danmoseley
added
Servicing-approved
|
approved -- once signeoff/green. |
|
/azp run runtime |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
thanks @carlossanlop. It seems only System.IO is failing on Mac. |
ghost
locked as resolved and limited conversation to collaborators
Customer Impact
This may prevent TLS handshake from some older clients. While the basic parsing should work, the certificate selection callback is not invoked and it breaks scenarios like Kestrel and YARP that depend on it.
This currently impacts Azure App service and their YARP setup.
Testing
Private binaries were verified by AppService. We currently don't have test coverage for this as it depends on particular client device (some IoT in this particular case)
Risk
small. This essentially adds ability to process some new variations but does not change or replace old code.
fixes #68310
Details
This covers cases when client sends TLS 1.x hello in Sslv2 frame format. As described in the linked issue, server will respond with normal response and TLS 1.x will be negotiated.
The TLS Parser is essentially dup of dotnet/yarp#1656
Both changes were verified by App Service.
Note that main will need more work because of #64322.
We may need to bring back some fragments but I would like to do more testing before that.