-
-
Notifications
You must be signed in to change notification settings - Fork 159
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feature: create abstraction for SNI certificates in Kestrel
- Loading branch information
1 parent
1d8502c
commit 239c503
Showing
11 changed files
with
151 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| // Copyright (c) Nate McMaster. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using System.Security.Cryptography.X509Certificates; | ||
| using Microsoft.AspNetCore.Connections; | ||
|
|
||
| namespace McMaster.AspNetCore.Kestrel.Certificates | ||
| { | ||
| /// <summary> | ||
| /// Selects a certificate for incoming TLS connections. | ||
| /// </summary> | ||
| public interface IServerCertificateSelector | ||
| { | ||
| /// <summary> | ||
| /// <para> | ||
| /// A callback that will be invoked to dynamically select a server certificate. | ||
| /// If SNI is not available, then the domainName parameter will be null. | ||
| /// </para> | ||
| /// <para> | ||
| /// If the server certificate has an Extended Key Usage extension, the usages must include Server Authentication (OID 1.3.6.1.5.5.7.3.1). | ||
| /// </para> | ||
| /// </summary> | ||
| X509Certificate2? Select(ConnectionContext context, string? domainName); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| // Copyright (c) Nate McMaster. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using McMaster.AspNetCore.Kestrel.Certificates; | ||
| using Microsoft.AspNetCore.Server.Kestrel.Https; | ||
|
|
||
| // ReSharper disable once CheckNamespace | ||
| namespace Microsoft.AspNetCore.Hosting | ||
| { | ||
| /// <summary> | ||
| /// API for configuring Kestrel certificiate options | ||
| /// </summary> | ||
| public static class KestrelHttpsOptionsExtensions | ||
| { | ||
| /// <summary> | ||
| /// Configure HTTPS certificates dynamically with an implementation of <see cref="IServerCertificateSelector"/>. | ||
| /// </summary> | ||
| /// <param name="httpsOptions">The HTTPS configuration</param> | ||
| /// <param name="certificateSelector">The server certificate selector.</param> | ||
| /// <returns>The HTTPS configuration</returns> | ||
| public static HttpsConnectionAdapterOptions UseServerCertificateSelector( | ||
| this HttpsConnectionAdapterOptions httpsOptions, | ||
| IServerCertificateSelector certificateSelector) | ||
| { | ||
| httpsOptions.ServerCertificateSelector = certificateSelector.Select; | ||
| return httpsOptions; | ||
| } | ||
| } | ||
| } |
22 changes: 22 additions & 0 deletions
22
src/Kestrel.Certificates/McMaster.AspNetCore.Kestrel.Certificates.csproj
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| <Project Sdk="Microsoft.NET.Sdk"> | ||
|
|
||
| <PropertyGroup> | ||
| <TargetFrameworks>netcoreapp3.0;netstandard2.0</TargetFrameworks> | ||
| <GenerateDocumentationFile>true</GenerateDocumentationFile> | ||
| <Nullable>enable</Nullable> | ||
| <IsPackable>true</IsPackable> | ||
| <Description>A class library for managing HTTPS certificates with ASP.NET Core.</Description> | ||
| <VersionPrefix>1.0.0</VersionPrefix> | ||
| <PackageVersion>$(VersionPrefix)</PackageVersion> | ||
| <PackageVersion Condition="'$(IncludePreReleaseLabelInPackageVersion)' == 'true'">$(PackageVersion)-$(VersionSuffix)</PackageVersion> | ||
| </PropertyGroup> | ||
|
|
||
| <ItemGroup Condition="'$(TargetFramework)' == 'netcoreapp3.0'"> | ||
| <FrameworkReference Include="Microsoft.AspNetCore.App" /> | ||
| </ItemGroup> | ||
|
|
||
| <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'"> | ||
| <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Core" Version="2.1.2" /> | ||
| </ItemGroup> | ||
|
|
||
| </Project> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| #nullable enable |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| #nullable enable | ||
| McMaster.AspNetCore.Kestrel.Certificates.IServerCertificateSelector | ||
| McMaster.AspNetCore.Kestrel.Certificates.IServerCertificateSelector.Select(Microsoft.AspNetCore.Connections.ConnectionContext! context, string? domainName) -> System.Security.Cryptography.X509Certificates.X509Certificate2? | ||
| Microsoft.AspNetCore.Hosting.KestrelHttpsOptionsExtensions | ||
| static Microsoft.AspNetCore.Hosting.KestrelHttpsOptionsExtensions.UseServerCertificateSelector(this Microsoft.AspNetCore.Server.Kestrel.Https.HttpsConnectionAdapterOptions! httpsOptions, McMaster.AspNetCore.Kestrel.Certificates.IServerCertificateSelector! certificateSelector) -> Microsoft.AspNetCore.Server.Kestrel.Https.HttpsConnectionAdapterOptions! |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| using System; | ||
| using System.Reflection; | ||
| using Microsoft.AspNetCore.Server.Kestrel.Core; | ||
| using Microsoft.AspNetCore.Server.Kestrel.Https; | ||
| using Microsoft.Extensions.DependencyInjection; | ||
| using Microsoft.Extensions.Options; | ||
| using Xunit; | ||
|
|
||
| namespace LettuceEncrypt.UnitTests | ||
| { | ||
| public class KestrelOptionsSetupTests | ||
| { | ||
| [Fact] | ||
| public void ItSetsCertificateSelector() | ||
| { | ||
| var services = new ServiceCollection() | ||
| .AddLogging() | ||
| .AddLettuceEncrypt() | ||
| .Services | ||
| .BuildServiceProvider(validateScopes: true); | ||
|
|
||
| var kestrelOptions = services.GetRequiredService<IOptions<KestrelServerOptions>>().Value; | ||
| // reflection is gross, but there is no public API for this so (shrug) | ||
| var httpsDefaultsProp = | ||
| typeof(KestrelServerOptions).GetProperty("HttpsDefaults", | ||
| BindingFlags.Instance | BindingFlags.NonPublic); | ||
| var httpsDefaultsFunc = | ||
| (Action<HttpsConnectionAdapterOptions>) httpsDefaultsProp.GetMethod.Invoke(kestrelOptions, | ||
| Array.Empty<object>()); | ||
| var httpsDefaults = new HttpsConnectionAdapterOptions(); | ||
|
|
||
| Assert.Null(httpsDefaults.ServerCertificateSelector); | ||
|
|
||
| httpsDefaultsFunc(httpsDefaults); | ||
|
|
||
| Assert.NotNull(httpsDefaults.ServerCertificateSelector); | ||
| } | ||
| } | ||
| } |