Accessing Kestrel state in ServerOptionsSelectionCallback

[Tratcher]

In 5.0 we added the following API so users could customize TLS settings on a per connection basis:

aspnetcore/src/Servers/Kestrel/Core/src/ListenOptionsHttpsExtensions.cs

Line 257 in 52eff90

public static ListenOptions UseHttps(this ListenOptions listenOptions, ServerOptionsSelectionCallback serverOptionsSelectionCallback, object state, TimeSpan handshakeTimeout)

This directly exposes SslStream's ServerOptionsSelectionCallback delegate. The problem we're running into now is that customers need access to kestrel specific state inside that callback, like the ConnectionContext, transport information (IPs), enabling/disabling client cert renegotiation, etc..

There is an internal API used by the config code that wraps ServerOptionsSelectionCallback and exposes the ConnectionContext.

aspnetcore/src/Servers/Kestrel/Core/src/ListenOptionsHttpsExtensions.cs

Line 275 in 52eff90

internal static ListenOptions UseHttps(this ListenOptions listenOptions, HttpsOptionsCallback httpsOptionsCallback, object state, TimeSpan handshakeTimeout)

That API isn't very future proof, I'm already having to modify it for client certs (#33264). Modifying it to take a specific context object might be more future proof.

updated

+ public static ListenOptions UseHttps(this ListenOptions listenOptions, HttpsConnectionMiddlewareOptions options);

+ public class HttpsConnectionMiddlewareOptions
+ {
+   public Func<TlsCallbackContext, ValueTask<SslServerAuthenticationOptions>> OnConnection { get; set; } // Required
+   public object? OnConnectionState { get; set; }
+   public TimeSpan HandshakeTimeout { get; set; } = (our default)
+ }

+ public sealed class TlsCallbackContext
+ {
+   // ServerOptionsSelectionCallback parameters
+   public SslStream SslStream { get; }
+   public SslClientHelloInfo ClientHelloInfo { get; }
+   public object? State { get; }
+   public CancellationToken CancellationToken { get; }
+   // Kestrel specific
+   public ConnectionContext Connection { get; }
+   public bool AllowDelayedClientCertificateNegotation { get; set; }
+ }

[halter73]

Func<TlsCallbackContext, ValueTask<SslServerAuthenticationOptions>> onConnection

I think OnConnection, OnConnectionState and HandshakeTimeout should become new properties on a new HttpsConnectionMiddlewareOptions type.

Thanks for contacting us.

We're moving this issue to the Next sprint planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

[Tratcher]

Like this?

+ public static ListenOptions UseHttps(this ListenOptions listenOptions, HttpsConnectionMiddlewareOptions options);

+ public class HttpsConnectionMiddlewareOptions
+ {
+   public Func<TlsCallbackContext, ValueTask<SslServerAuthenticationOptions>> OnConnection { get; set; } // Required
+   public object? OnConnectionState { get; set; }
+   public TimeSpan HandshakeTimeout { get; set; } = (our default)
+ }

+ public sealed class TlsCallbackContext
+ {
+   // ServerOptionsSelectionCallback parameters
+   public SslStream SslStream { get; }
+   public SslClientHelloInfo ClientHelloInfo { get; }
+   public object? State { get; }
+   public CancellationToken CancellationToken { get; }
+   // Kestrel specific
+   public ConnectionContext Connection { get; }
+   public bool AllowDelayedClientCertificateNegotation { get; set; }
+ }

[halter73]

Yeah. It doesn't make it the simple set a single cert use case easy, but I think there are ways we could address that with extension methods or methods on WebApplication or something. And it's not like the old HttpsConnectionAdapterOptions are going away.

[pranavkm]

+ public sealed class TlsHandshakeCallbackOptions
+ {
+   public TlsHandshakeCallbackOptions(Func<TlsCallbackContext, ValueTask<SslServerAuthenticationOptions>> onConnection);
+   public Func<TlsCallbackContext, ValueTask<SslServerAuthenticationOptions>> OnConnection { get; }
+   public object? OnConnectionState { get; set; }
+   public TimeSpan HandshakeTimeout { get; set; } = (our default)
+ }

+ public sealed class TlsHandshakeCallbackContext