Skip to content

Commit 9821148

Browse files
DeagleGrossDeagleGross
committed
resolve conflicts
2 parents 6480bd1 + e8d6427 commit 9821148

File tree

3 files changed

+119
-11
lines changed

3 files changed

+119
-11
lines changed

‎scenarios/tls.benchmarks.yml‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,15 @@ jobs:
1414
project: src/BenchmarksApps/TLS/HttpSys/HttpSys.csproj
1515
readyStateText: Application started.
1616
variables:
17+
# behavioral settings
1718
mTLS: false # enables settings on http.sys to negotiate client cert on connections
1819
tlsRenegotiation: false # enables client cert validation
20+
# debug settings
1921
certValidationConsoleEnabled: false
2022
httpSysLogs: false
2123
statsEnabled: false
22-
arguments: "--urls https://{{serverAddress}}:{{serverPort}} --mTLS {{mTLS}} --certValidationConsoleEnabled {{certValidationConsoleEnabled}} --statsEnabled {{statsEnabled}} --tlsRenegotiation {{tlsRenegotiation}} --httpSysLogs {{httpSysLogs}}"
24+
logRequestDetails: false
25+
arguments: "--urls https://{{serverAddress}}:{{serverPort}} --mTLS {{mTLS}} --certValidationConsoleEnabled {{certValidationConsoleEnabled}} --statsEnabled {{statsEnabled}} --tlsRenegotiation {{tlsRenegotiation}} --httpSysLogs {{httpSysLogs}} --logRequestDetails {{logRequestDetails}}"
2326

2427
kestrelServer:
2528
source:
@@ -28,11 +31,15 @@ jobs:
2831
project: src/BenchmarksApps/TLS/Kestrel/Kestrel.csproj
2932
readyStateText: Application started.
3033
variables:
34+
# behavioral settings
3135
mTLS: false
3236
tlsRenegotiation: false
37+
tlsProtocols: "tls12,tls13"
38+
# debug settings
3339
certValidationConsoleEnabled: false
3440
statsEnabled: false
35-
arguments: "--urls https://{{serverAddress}}:{{serverPort}} --mTLS {{mTLS}} --certValidationConsoleEnabled {{certValidationConsoleEnabled}} --statsEnabled {{statsEnabled}} --tlsRenegotiation {{tlsRenegotiation}}"
41+
logRequestDetails: false
42+
arguments: "--urls https://{{serverAddress}}:{{serverPort}} --mTLS {{mTLS}} --certValidationConsoleEnabled {{certValidationConsoleEnabled}} --tlsProtocols {{tlsProtocols}} --statsEnabled {{statsEnabled}} --tlsRenegotiation {{tlsRenegotiation}} --logRequestDetails {{logRequestDetails}}"
3643

3744
dockerLinuxKestrelServer:
3845
sources:
@@ -65,6 +72,7 @@ scenarios:
6572
presetHeaders: connectionclose
6673
connections: 32
6774
serverScheme: https
75+
sslProtocol: tls12
6876

6977
mTls-handshakes-httpsys:
7078
application:
@@ -85,6 +93,7 @@ scenarios:
8593
serverScheme: https
8694
certPath: https://raw.githubusercontent.com/aspnet/Benchmarks/refs/heads/main/src/BenchmarksApps/TLS/HttpSys/testCert.pfx
8795
certPwd: testPassword
96+
sslProtocol: tls12
8897

8998
tls-renegotiation-httpsys:
9099
application:
@@ -103,6 +112,7 @@ scenarios:
103112
serverScheme: https
104113
certPath: https://raw.githubusercontent.com/aspnet/Benchmarks/refs/heads/main/src/BenchmarksApps/TLS/HttpSys/testCert.pfx
105114
certPwd: testPassword
115+
sslProtocol: tls12
106116

107117
# Kestrel
108118

@@ -116,6 +126,7 @@ scenarios:
116126
presetHeaders: connectionclose
117127
connections: 32
118128
serverScheme: https
129+
sslProtocol: tls12
119130

120131
mTls-handshakes-kestrel:
121132
application:
@@ -132,6 +143,7 @@ scenarios:
132143
serverScheme: https
133144
certPath: https://raw.githubusercontent.com/aspnet/Benchmarks/refs/heads/main/src/BenchmarksApps/TLS/Kestrel/testCert.pfx
134145
certPwd: testPassword
146+
sslProtocol: tls12
135147

136148
tls-renegotiation-kestrel:
137149
application:
@@ -149,6 +161,7 @@ scenarios:
149161
serverScheme: https
150162
certPath: https://raw.githubusercontent.com/aspnet/Benchmarks/refs/heads/main/src/BenchmarksApps/TLS/Kestrel/testCert.pfx
151163
certPwd: testPassword
164+
sslProtocol: tls12
152165

153166
# Kestrel in Docker
154167
tls-handshakes-docker-openssl-332:
@@ -167,6 +180,7 @@ scenarios:
167180
presetHeaders: connectionclose
168181
connections: 32
169182
serverScheme: https
183+
sslProtocol: tls12
170184

171185
tls-handshakes-docker-openssl-111:
172186
application:
@@ -184,6 +198,7 @@ scenarios:
184198
presetHeaders: connectionclose
185199
connections: 32
186200
serverScheme: https
201+
sslProtocol: tls12
187202

188203
tls-handshakes-docker-openssl-3015:
189204
application:
@@ -200,4 +215,5 @@ scenarios:
200215
serverPort: 8080
201216
presetHeaders: connectionclose
202217
connections: 32
203-
serverScheme: https
218+
serverScheme: https
219+
sslProtocol: tls12

‎src/BenchmarksApps/TLS/HttpSys/Program.cs‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,23 @@
11
using HttpSys;
2+
using Microsoft.AspNetCore.Connections.Features;
3+
using Microsoft.AspNetCore.Http.Features;
24
using Microsoft.AspNetCore.Server.HttpSys;
35

46
var builder = WebApplication.CreateBuilder(args);
57
builder.Logging.ClearProviders();
68

7-
var writeCertValidationEventsToConsole = bool.TryParse(builder.Configuration["certValidationConsoleEnabled"], out var certValidationConsoleEnabled) && certValidationConsoleEnabled;
9+
// behavioral
810
var httpSysLoggingEnabled = bool.TryParse(builder.Configuration["httpSysLogs"], out var httpSysLogsEnabled) && httpSysLogsEnabled;
9-
var statsEnabled = bool.TryParse(builder.Configuration["statsEnabled"], out var connectionStatsEnabledConfig) && connectionStatsEnabledConfig;
1011
var mTlsEnabled = bool.TryParse(builder.Configuration["mTLS"], out var mTlsEnabledConfig) && mTlsEnabledConfig;
1112
var tlsRenegotiationEnabled = bool.TryParse(builder.Configuration["tlsRenegotiation"], out var tlsRenegotiationEnabledConfig) && tlsRenegotiationEnabledConfig;
1213
var listeningEndpoints = builder.Configuration["urls"] ?? "https://localhost:5000/";
1314
var httpsIpPort = listeningEndpoints.Split(";").First(x => x.Contains("https")).Replace("https://", "");
1415

16+
// debug
17+
var writeCertValidationEventsToConsole = bool.TryParse(builder.Configuration["certValidationConsoleEnabled"], out var certValidationConsoleEnabled) && certValidationConsoleEnabled;
18+
var statsEnabled = bool.TryParse(builder.Configuration["statsEnabled"], out var connectionStatsEnabledConfig) && connectionStatsEnabledConfig;
19+
var logRequestDetails = bool.TryParse(builder.Configuration["logRequestDetails"], out var logRequestDetailsConfig) && logRequestDetailsConfig;
20+
1521
#pragma warning disable CA1416 // Can be launched only on Windows (HttpSys)
1622
builder.WebHost.UseHttpSys(options =>
1723
{
@@ -30,6 +36,28 @@
3036
var connectionIds = new HashSet<string>();
3137
var fetchedCertsCounter = 0;
3238

39+
if (logRequestDetails)
40+
{
41+
var logged = false;
42+
Console.WriteLine("Registered request details logging middleware");
43+
app.Use(async (context, next) =>
44+
{
45+
if (!logged)
46+
{
47+
logged = true;
48+
49+
var tlsHandshakeFeature = context.Features.GetRequiredFeature<ITlsHandshakeFeature>();
50+
51+
Console.WriteLine("Request details:");
52+
Console.WriteLine("-----");
53+
Console.WriteLine("TLS: " + tlsHandshakeFeature.Protocol);
54+
Console.WriteLine("-----");
55+
}
56+
57+
await next(context);
58+
});
59+
}
60+
3361
if (statsEnabled)
3462
{
3563
Console.WriteLine("Registered stats middleware");
@@ -38,7 +66,7 @@
3866
connectionIds.Add(context.Connection.Id);
3967
Console.WriteLine($"[stats] unique connections established: {connectionIds.Count}; fetched certificates: {fetchedCertsCounter}");
4068

41-
await next();
69+
await next(context);
4270
});
4371
}
4472

@@ -104,7 +132,7 @@ void OnShutdown()
104132
// we have a client cert here, and lets imagine we do the validation here
105133
// if (clientCert.Thumbprint != "1234567890") throw new NotImplementedException();
106134

107-
await next();
135+
await next(context);
108136
});
109137
}
110138

‎src/BenchmarksApps/TLS/Kestrel/Program.cs‎

Lines changed: 68 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
using System.Diagnostics;
22
using System.Net;
33
using System.Net.Security;
4+
using System.Security.Authentication;
45
using System.Security.Cryptography.X509Certificates;
6+
using Microsoft.AspNetCore.Authentication.Certificate;
7+
using Microsoft.AspNetCore.Connections.Features;
8+
using Microsoft.AspNetCore.Http.Features;
59
using Microsoft.AspNetCore.Server.HttpSys;
610
using Microsoft.AspNetCore.Server.Kestrel.Core;
711
using Microsoft.AspNetCore.Server.Kestrel.Https;
@@ -11,11 +15,16 @@
1115
var builder = WebApplication.CreateBuilder(args);
1216
builder.Logging.ClearProviders();
1317

14-
var writeCertValidationEventsToConsole = bool.TryParse(builder.Configuration["certValidationConsoleEnabled"], out var certValidationConsoleEnabled) && certValidationConsoleEnabled;
18+
// behavioral
1519
var mTlsEnabled = bool.TryParse(builder.Configuration["mTLS"], out var mTlsEnabledConfig) && mTlsEnabledConfig;
1620
var tlsRenegotiationEnabled = bool.TryParse(builder.Configuration["tlsRenegotiation"], out var tlsRenegotiationEnabledConfig) && tlsRenegotiationEnabledConfig;
17-
var statsEnabled = bool.TryParse(builder.Configuration["statsEnabled"], out var connectionStatsEnabledConfig) && connectionStatsEnabledConfig;
1821
var listeningEndpoints = builder.Configuration["urls"] ?? "https://localhost:5000/";
22+
var supportedTlsVersions = ParseSslProtocols(builder.Configuration["tlsProtocols"]);
23+
24+
// debug
25+
var writeCertValidationEventsToConsole = bool.TryParse(builder.Configuration["certValidationConsoleEnabled"], out var certValidationConsoleEnabled) && certValidationConsoleEnabled;
26+
var statsEnabled = bool.TryParse(builder.Configuration["statsEnabled"], out var connectionStatsEnabledConfig) && connectionStatsEnabledConfig;
27+
var logRequestDetails = bool.TryParse(builder.Configuration["logRequestDetails"], out var logRequestDetailsConfig) && logRequestDetailsConfig;
1928

2029
if (mTlsEnabled && tlsRenegotiationEnabled)
2130
{
@@ -42,6 +51,11 @@ void ConfigureListen(KestrelServerOptions serverOptions, IConfigurationRoot conf
4251
// [SuppressMessage("Microsoft.Security", "CSCAN0220.DefaultPasswordContexts", Justification="Benchmark code, not a secret")]
4352
listenOptions.UseHttps("testCert.pfx", "testPassword", options =>
4453
{
54+
if (supportedTlsVersions is not null)
55+
{
56+
options.SslProtocols = supportedTlsVersions.Value;
57+
}
58+
4559
if (mTlsEnabled)
4660
{
4761
options.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
@@ -83,6 +97,28 @@ bool AllowAnyCertificateValidationWithLogging(X509Certificate2 certificate, X509
8397
return true;
8498
}
8599

100+
if (logRequestDetails)
101+
{
102+
var logged = false;
103+
Console.WriteLine("Registered request details logging middleware");
104+
app.Use(async (context, next) =>
105+
{
106+
if (!logged)
107+
{
108+
logged = true;
109+
110+
var tlsHandshakeFeature = context.Features.GetRequiredFeature<ITlsHandshakeFeature>();
111+
112+
Console.WriteLine("Request details:");
113+
Console.WriteLine("-----");
114+
Console.WriteLine("TLS: " + tlsHandshakeFeature.Protocol);
115+
Console.WriteLine("-----");
116+
}
117+
118+
await next(context);
119+
});
120+
}
121+
86122
if (statsEnabled)
87123
{
88124
Console.WriteLine("Registered stats middleware");
@@ -91,7 +127,7 @@ bool AllowAnyCertificateValidationWithLogging(X509Certificate2 certificate, X509
91127
connectionIds.Add(context.Connection.Id);
92128
Console.WriteLine($"[stats] unique connections established: {connectionIds.Count}; fetched certificates: {fetchedCertsCounter}");
93129

94-
await next();
130+
await next(context);
95131
});
96132
}
97133

@@ -111,7 +147,7 @@ bool AllowAnyCertificateValidationWithLogging(X509Certificate2 certificate, X509
111147
Console.WriteLine($"client certificate ({clientCert.Thumbprint}) already exists on the connection {context.Connection.Id}");
112148
}
113149

114-
await next();
150+
await next(context);
115151
});
116152
}
117153

@@ -140,6 +176,7 @@ bool AllowAnyCertificateValidationWithLogging(X509Certificate2 certificate, X509
140176
{
141177
Console.WriteLine($"\tenabled logging stats to console");
142178
}
179+
Console.WriteLine($"\tsupported TLS versions: {supportedTlsVersions}");
143180
Console.WriteLine($"\tlistening endpoints: {listeningEndpoints}");
144181
Console.WriteLine("--------------------------------");
145182

@@ -162,6 +199,33 @@ static IPEndPoint CreateIPEndPoint(UrlPrefix urlPrefix)
162199
return new IPEndPoint(ip, urlPrefix.PortValue);
163200
}
164201

202+
static SslProtocols? ParseSslProtocols(string? supportedTlsVersions)
203+
{
204+
var protocols = SslProtocols.None;
205+
if (string.IsNullOrEmpty(supportedTlsVersions) || supportedTlsVersions == "any")
206+
{
207+
return null;
208+
}
209+
210+
foreach (var version in supportedTlsVersions.Split(','))
211+
{
212+
switch (version.Trim().ToLower())
213+
{
214+
case "tls12":
215+
protocols |= SslProtocols.Tls12;
216+
break;
217+
case "tls13":
218+
protocols |= SslProtocols.Tls13;
219+
break;
220+
default:
221+
throw new ArgumentException($"Unsupported TLS version: {version}");
222+
}
223+
}
224+
225+
return protocols;
226+
}
227+
}
228+
165229
static void LogOpenSSLVersion()
166230
{
167231
using var process = new Process()

0 commit comments

Comments
 (0)