Skip to content

Commit abdc360

Browse files
halter73halter73
committed
Remove EndpointDefaults.Sni
1 parent 0bc23a4 commit abdc360

File tree

7 files changed

+8
-176
lines changed

7 files changed

+8
-176
lines changed

‎src/Servers/Kestrel/Core/src/Internal/ConfigurationReader.cs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,6 @@ private EndpointDefaults ReadEndpointDefaults()
7575
Protocols = ParseProtocols(configSection[ProtocolsKey]),
7676
SslProtocols = ParseSslProcotols(configSection.GetSection(SslProtocolsKey)),
7777
ClientCertificateMode = ParseClientCertificateMode(configSection[ClientCertificateModeKey]),
78-
Sni = ReadSni(configSection.GetSection(SniKey), EndpointDefaultsKey)
7978
};
8079
}
8180

‎src/Servers/Kestrel/Core/src/KestrelConfigurationLoader.cs‎

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -260,22 +260,6 @@ internal void ApplyHttpsDefaults(HttpsConnectionAdapterOptions httpsOptions)
260260
}
261261
}
262262

263-
internal SniOptionsSelector GetDefaultSniOptionsSelector(HttpsConnectionAdapterOptions fallbackHttpsOptions, HttpProtocols fallbackHttpProtocols)
264-
{
265-
if (ConfigurationReader.EndpointDefaults.Sni.Count == 0)
266-
{
267-
return null;
268-
}
269-
270-
return new SniOptionsSelector(
271-
ConfigurationReader.EndpointDefaultsKey,
272-
ConfigurationReader.EndpointDefaults.Sni,
273-
CertificateConfigLoader,
274-
fallbackHttpsOptions,
275-
fallbackHttpProtocols,
276-
HttpsLogger);
277-
}
278-
279263
public void Load()
280264
{
281265
if (_loaded)
@@ -352,13 +336,6 @@ public void Load()
352336
endpoint.ClientCertificateMode = ConfigurationReader.EndpointDefaults.ClientCertificateMode;
353337
}
354338

355-
if (endpoint.Sni.Count == 0)
356-
{
357-
// Ensure endpoint is reloaded if it used the default SNI config and it changed.
358-
// No need to configure httpsOptions for SNI since the SniOptionsSelector will now use the EndpointDefaults SNI config.
359-
endpoint.Sni = ConfigurationReader.EndpointDefaults.Sni;
360-
}
361-
362339
// A cert specified directly on the endpoint overrides any defaults.
363340
httpsOptions.ServerCertificate = CertificateConfigLoader.LoadCertificate(endpoint.Certificate, endpoint.Name)
364341
?? httpsOptions.ServerCertificate;

‎src/Servers/Kestrel/Core/src/ListenOptionsHttpsExtensions.cs‎

Lines changed: 4 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -184,21 +184,12 @@ public static ListenOptions UseHttps(this ListenOptions listenOptions, Action<Ht
184184
configureOptions(options);
185185
listenOptions.KestrelServerOptions.ApplyDefaultCert(options);
186186

187-
var sniOptionsSelector = listenOptions.KestrelServerOptions.ConfigurationLoader?.GetDefaultSniOptionsSelector(options, listenOptions.Protocols);
188-
189-
if (options.ServerCertificate == null && options.ServerCertificateSelector == null && sniOptionsSelector == null)
187+
if (options.ServerCertificate == null && options.ServerCertificateSelector == null)
190188
{
191189
throw new InvalidOperationException(CoreStrings.NoCertSpecifiedNoDevelopmentCertificateFound);
192190
}
193191

194-
if (sniOptionsSelector is null)
195-
{
196-
return listenOptions.UseHttps(options);
197-
}
198-
else
199-
{
200-
return listenOptions.UseHttps(SniOptionsSelector.OptionsCallback, sniOptionsSelector, options.HandshakeTimeout);
201-
}
192+
return listenOptions.UseHttps(options);
202193
}
203194

204195
// Use Https if a default cert is available
@@ -208,22 +199,12 @@ internal static bool TryUseHttps(this ListenOptions listenOptions)
208199
listenOptions.KestrelServerOptions.ApplyHttpsDefaults(options);
209200
listenOptions.KestrelServerOptions.ApplyDefaultCert(options);
210201

211-
var sniOptionsSelector = listenOptions.KestrelServerOptions.ConfigurationLoader?.GetDefaultSniOptionsSelector(options, listenOptions.Protocols);
212-
213-
if (options.ServerCertificate == null && options.ServerCertificateSelector == null && sniOptionsSelector == null)
202+
if (options.ServerCertificate == null && options.ServerCertificateSelector == null)
214203
{
215204
return false;
216205
}
217206

218-
if (sniOptionsSelector is null)
219-
{
220-
listenOptions.UseHttps(options);
221-
}
222-
else
223-
{
224-
listenOptions.UseHttps(SniOptionsSelector.OptionsCallback, sniOptionsSelector, options.HandshakeTimeout);
225-
}
226-
207+
listenOptions.UseHttps(options);
227208
return true;
228209
}
229210

‎src/Servers/Kestrel/Core/test/SniOptionsSelectorTests.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -674,7 +674,7 @@ public void CloneSslOptionsClonesAllProperties()
674674
// Defaults to true
675675
AllowRenegotiation = false,
676676
// Defaults to null
677-
ApplicationProtocols = new List<SslApplicationProtocol> { SslApplicationProtocol.Http3 },
677+
ApplicationProtocols = new List<SslApplicationProtocol> { SslApplicationProtocol.Http2 },
678678
// Defaults to X509RevocationMode.NoCheck
679679
CertificateRevocationCheckMode = X509RevocationMode.Offline,
680680
// Defaults to null

‎src/Servers/Kestrel/Kestrel/test/ConfigurationReaderTests.cs‎

Lines changed: 3 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,7 @@ public void ReadEndpointWithNoSslProtocolSettings_ReturnsNull()
275275
}
276276

277277
[Fact]
278-
public void ReadEndpointsOrEndpointDefaultsWithEmptySniSection_ReturnsEmptyCollection()
278+
public void ReadEndpointWithEmptySniSection_ReturnsEmptyCollection()
279279
{
280280
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
281281
{
@@ -287,32 +287,25 @@ public void ReadEndpointsOrEndpointDefaultsWithEmptySniSection_ReturnsEmptyColle
287287
var endpoint = reader.Endpoints.First();
288288
Assert.NotNull(endpoint.Sni);
289289
Assert.False(endpoint.Sni.Any());
290-
291-
var endpointDefaults = reader.EndpointDefaults;
292-
Assert.NotNull(endpointDefaults.Sni);
293-
Assert.False(endpointDefaults.Sni.Any());
294290
}
295291

296292
[Fact]
297-
public void ReadEndpointsOrEndpointDefaultsWithEmptySniKey_Throws()
293+
public void ReadEndpointWithEmptySniKey_Throws()
298294
{
299295
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
300296
{
301297
new KeyValuePair<string, string>("Endpoints:End1:Url", "http://*:5001"),
302298
new KeyValuePair<string, string>("Endpoints:End1:Sni::Protocols", "Http1"),
303-
new KeyValuePair<string, string>("EndpointDefaults:Sni::Protocols", "Http1"),
304299
}).Build();
305300

306301
var reader = new ConfigurationReader(config);
307302
var end1Ex = Assert.Throws<InvalidOperationException>(() => reader.Endpoints);
308-
var defaultEx = Assert.Throws<InvalidOperationException>(() => reader.EndpointDefaults);
309303

310304
Assert.Equal(CoreStrings.FormatSniNameCannotBeEmpty("End1"), end1Ex.Message);
311-
Assert.Equal(CoreStrings.FormatSniNameCannotBeEmpty("EndpointDefaults"), defaultEx.Message);
312305
}
313306

314307
[Fact]
315-
public void ReadEndpointsOrEndpointDefaultsWithSniConfigured_ReturnsCorrectValue()
308+
public void ReadEndpointWithSniConfigured_ReturnsCorrectValue()
316309
{
317310
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
318311
{
@@ -322,11 +315,6 @@ public void ReadEndpointsOrEndpointDefaultsWithSniConfigured_ReturnsCorrectValue
322315
new KeyValuePair<string, string>("Endpoints:End1:Sni:*.example.org:Certificate:Path", "/path/cert.pfx"),
323316
new KeyValuePair<string, string>("Endpoints:End1:Sni:*.example.org:Certificate:Password", "certpassword"),
324317
new KeyValuePair<string, string>("Endpoints:End1:SNI:*.example.org:ClientCertificateMode", "AllowCertificate"),
325-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:Protocols", "Http1"),
326-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:SslProtocols:0", "Tls12"),
327-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:Certificate:Path", "/path/cert.pfx"),
328-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:Certificate:Password", "certpassword"),
329-
new KeyValuePair<string, string>("EndpointDefaults:SNI:*.example.org:ClientCertificateMode", "AllowCertificate"),
330318
}).Build();
331319

332320
var reader = new ConfigurationReader(config);
@@ -343,7 +331,6 @@ static void VerifySniConfig(SniConfig config)
343331
}
344332

345333
VerifySniConfig(reader.Endpoints.First().Sni["*.Example.org"]);
346-
VerifySniConfig(reader.EndpointDefaults.Sni["*.Example.org"]);
347334
}
348335

349336
[Fact]

‎src/Servers/Kestrel/Kestrel/test/KestrelConfigurationLoaderTests.cs‎

Lines changed: 0 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -831,51 +831,6 @@ public void DefaultEndpointConfigureSection_ConfigureHttpsDefaultsCanOverrideCli
831831
Assert.True(ran1);
832832
}
833833

834-
[Fact]
835-
public void DefaultConfigSection_CanConfigureSni()
836-
{
837-
var serverOptions = CreateServerOptions();
838-
839-
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
840-
{
841-
new KeyValuePair<string, string>("Endpoints:End1:Url", "https://*:5001"),
842-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:Protocols", "None"),
843-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:SslProtocols:0", "Tls12"),
844-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:ClientCertificateMode", "AllowCertificate"),
845-
}).Build();
846-
847-
var (_, endpointsToStart) = serverOptions.Configure(config).Reload();
848-
var end1 = Assert.Single(endpointsToStart);
849-
var (name, sniConfig) = Assert.Single(end1?.EndpointConfig?.Sni);
850-
851-
Assert.Equal("*.example.org", name);
852-
Assert.Equal(HttpProtocols.None, sniConfig.Protocols);
853-
Assert.Equal(SslProtocols.Tls12, sniConfig.SslProtocols);
854-
Assert.Equal(ClientCertificateMode.AllowCertificate, sniConfig.ClientCertificateMode);
855-
}
856-
857-
[Fact]
858-
public void DefaultConfigSection_SniConfigurationIsOverriddenByNotMergedWithEndpointSpecificConfigSection()
859-
{
860-
var serverOptions = CreateServerOptions();
861-
862-
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
863-
{
864-
new KeyValuePair<string, string>("Endpoints:End1:Url", "https://*:5001"),
865-
new KeyValuePair<string, string>("Endpoints:End1:Sni:*:Protocols", "None"),
866-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:Protocols", "Http1"),
867-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:SslProtocols:0", "Tls12"),
868-
new KeyValuePair<string, string>("EndpointDefaults:Sni:*.example.org:ClientCertificateMode", "AllowCertificate"),
869-
}).Build();
870-
871-
var (_, endpointsToStart) = serverOptions.Configure(config).Reload();
872-
var end1 = Assert.Single(endpointsToStart);
873-
var (name, sniConfig) = Assert.Single(end1?.EndpointConfig?.Sni);
874-
875-
Assert.Equal("*", name);
876-
Assert.Equal(HttpProtocols.None, sniConfig.Protocols);
877-
}
878-
879834
[Fact]
880835
public void Reload_IdentifiesEndpointsToStartAndStop()
881836
{

‎src/Servers/Kestrel/test/InMemory.FunctionalTests/HttpsConnectionMiddlewareTests.cs‎

Lines changed: 0 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -95,73 +95,6 @@ void ConfigureListenOptions(ListenOptions listenOptions)
9595
}
9696
}
9797

98-
[ConditionalFact]
99-
[OSSkipCondition(OperatingSystems.MacOSX, SkipReason = "Missing SslStream ALPN support: https://github.com/dotnet/corefx/issues/30492")]
100-
[MinimumOSVersion(OperatingSystems.Windows, WindowsVersions.Win81)]
101-
public async Task CanUseDefaultSniConfiguration()
102-
{
103-
var configuration = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string>
104-
{
105-
["EndpointDefaults:Sni:*.example.org:Protocols"] = "Http1",
106-
["EndpointDefaults:Sni:dot.net:Protocols"] = "None",
107-
}).Build();
108-
109-
var options = new KestrelServerOptions();
110-
var env = new Mock<IHostEnvironment>();
111-
env.SetupGet(e => e.ContentRootPath).Returns(Directory.GetCurrentDirectory());
112-
113-
options.ApplicationServices = new ServiceCollection()
114-
.AddLogging()
115-
.AddSingleton(env.Object)
116-
.BuildServiceProvider();
117-
118-
options.Configure(configuration).Load();
119-
120-
void ConfigureListenOptions(ListenOptions listenOptions)
121-
{
122-
listenOptions.KestrelServerOptions = options;
123-
listenOptions.UseHttps(_x509Certificate2);
124-
// We don't need to set listenOptions.Protocols since it will be flowed through the HttpProtocolsFeature
125-
};
126-
127-
await using var server = new TestServer(context => Task.CompletedTask, new TestServiceContext(LoggerFactory), ConfigureListenOptions);
128-
129-
using var exampleConnection = server.CreateConnection();
130-
var exampleSslOptions = new SslClientAuthenticationOptions
131-
{
132-
TargetHost = "a.example.org",
133-
ApplicationProtocols = new List<SslApplicationProtocol> { SslApplicationProtocol.Http11, SslApplicationProtocol.Http2 },
134-
};
135-
136-
using var exampleStream = OpenSslStream(exampleConnection.Stream);
137-
await exampleStream.AuthenticateAsClientAsync(exampleSslOptions);
138-
139-
Assert.Equal(SslApplicationProtocol.Http11, exampleStream.NegotiatedApplicationProtocol);
140-
141-
using var dotnetConnection = server.CreateConnection();
142-
var dotnetSslOptions = new SslClientAuthenticationOptions
143-
{
144-
TargetHost = "dot.net",
145-
ApplicationProtocols = new List<SslApplicationProtocol> { SslApplicationProtocol.Http11, SslApplicationProtocol.Http2 },
146-
};
147-
148-
using var dotnetStream = OpenSslStream(dotnetConnection.Stream);
149-
await dotnetStream.AuthenticateAsClientAsync(dotnetSslOptions);
150-
151-
// HttpProtocols.None was configured, so there is no negotiated protocol
152-
Assert.True(dotnetStream.NegotiatedApplicationProtocol.Protocol.IsEmpty);
153-
154-
using var emptyNameConnection = server.CreateConnection();
155-
var emptyNameSslOptions = new SslClientAuthenticationOptions
156-
{
157-
TargetHost = "",
158-
};
159-
160-
using var refusedStream = OpenSslStream(emptyNameConnection.Stream);
161-
// We expect the handshake to throw here because Kestrel refuses the connection due to there being no TargetHost and now wildcard config.
162-
await Assert.ThrowsAsync<IOException>(async () => await refusedStream.AuthenticateAsClientAsync(emptyNameSslOptions));
163-
}
164-
16598
[Fact]
16699
public async Task HandshakeDetailsAreAvailable()
167100
{

0 commit comments

Comments
 (0)