closes #2662 This feature adds the ability to restrict the SSL/TLS protocol used when making the web request. In 5.1 the user could make use of .NET API's to enforce this on the Web Cmdlets. With the move to HttpClient in PowerShell Core, those APIs have no impact. The user still has requirements to ensure specific protocols are used. The public enum WebSslProtocol is added as a wrapper to the underlying SslProtocols enum. Neither it nor SecurityProtocolType can be used because Ssl3 and Ssl2 are not supported by HttpClientHandler.SslProtocols. While it may not be intuitive to a PowerShell user to use -bor or "Tls, Tls11" to set multiple options, the general use case for this will be a single protocol. Adds -SslProtocol parameter to Web Cmdlets Adds WebSslProtocol Enum to support limited subset of SslProtocol enum supported by HttpClientHandler Adds TLS 1.1 and TLS 1.0 listening ports to WebListener
72 lines
3.5 KiB
C#
72 lines
3.5 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
using System.IO;
|
|
using System.Linq;
|
|
using System.Net;
|
|
using System.Security.Authentication;
|
|
using System.Security.Cryptography.X509Certificates;
|
|
using System.Threading.Tasks;
|
|
using Microsoft.AspNetCore;
|
|
using Microsoft.AspNetCore.Hosting;
|
|
using Microsoft.AspNetCore.Server.Kestrel.Https;
|
|
using Microsoft.Extensions.Configuration;
|
|
using Microsoft.Extensions.Logging;
|
|
|
|
|
|
|
|
namespace mvc
|
|
{
|
|
public class Program
|
|
{
|
|
public static void Main(string[] args)
|
|
{
|
|
if (args.Count() != 6)
|
|
{
|
|
System.Console.WriteLine("Required: <CertificatePath> <CertificatePassword> <HTTPPortNumber> <HTTPSPortNumberTls2> <HTTPSPortNumberTls11> <HTTPSPortNumberTls>");
|
|
Environment.Exit(1);
|
|
}
|
|
BuildWebHost(args).Run();
|
|
}
|
|
|
|
public static IWebHost BuildWebHost(string[] args) =>
|
|
WebHost.CreateDefaultBuilder()
|
|
.UseStartup<Startup>().UseKestrel(options =>
|
|
{
|
|
options.Listen(IPAddress.Loopback, int.Parse(args[2]));
|
|
options.Listen(IPAddress.Loopback, int.Parse(args[3]), listenOptions =>
|
|
{
|
|
var certificate = new X509Certificate2(args[0], args[1]);
|
|
HttpsConnectionAdapterOptions httpsOption = new HttpsConnectionAdapterOptions();
|
|
httpsOption.SslProtocols = SslProtocols.Tls12;
|
|
httpsOption.ClientCertificateMode = ClientCertificateMode.AllowCertificate;
|
|
httpsOption.ClientCertificateValidation = (inCertificate, inChain, inPolicy) => {return true;};
|
|
httpsOption.CheckCertificateRevocation = false;
|
|
httpsOption.ServerCertificate = certificate;
|
|
listenOptions.UseHttps(httpsOption);
|
|
});
|
|
options.Listen(IPAddress.Loopback, int.Parse(args[4]), listenOptions =>
|
|
{
|
|
var certificate = new X509Certificate2(args[0], args[1]);
|
|
HttpsConnectionAdapterOptions httpsOption = new HttpsConnectionAdapterOptions();
|
|
httpsOption.SslProtocols = SslProtocols.Tls11;
|
|
httpsOption.ClientCertificateMode = ClientCertificateMode.AllowCertificate;
|
|
httpsOption.ClientCertificateValidation = (inCertificate, inChain, inPolicy) => {return true;};
|
|
httpsOption.CheckCertificateRevocation = false;
|
|
httpsOption.ServerCertificate = certificate;
|
|
listenOptions.UseHttps(httpsOption);
|
|
});
|
|
options.Listen(IPAddress.Loopback, int.Parse(args[5]), listenOptions =>
|
|
{
|
|
var certificate = new X509Certificate2(args[0], args[1]);
|
|
HttpsConnectionAdapterOptions httpsOption = new HttpsConnectionAdapterOptions();
|
|
httpsOption.SslProtocols = SslProtocols.Tls;
|
|
httpsOption.ClientCertificateMode = ClientCertificateMode.AllowCertificate;
|
|
httpsOption.ClientCertificateValidation = (inCertificate, inChain, inPolicy) => {return true;};
|
|
httpsOption.CheckCertificateRevocation = false;
|
|
httpsOption.ServerCertificate = certificate;
|
|
listenOptions.UseHttps(httpsOption);
|
|
});
|
|
})
|
|
.Build();
|
|
}
|
|
}
|