Support default handshake timeout

Author: halter73

src/Servers/Kestrel/Core/src/HttpsConnectionAdapterOptions.cs

@@ -25,8 +25,7 @@ public class HttpsConnectionAdapterOptions
         public HttpsConnectionAdapterOptions()
         {
             ClientCertificateMode = ClientCertificateMode.NoCertificate;
-            // Defaults to 10 seconds
-            HandshakeTimeout = HttpsConnectionMiddleware.DefaultHandshakeTimeout;
+            HandshakeTimeout = TimeSpan.FromSeconds(10);
         }
 
         /// <summary>

src/Servers/Kestrel/Core/src/Internal/SniOptionsSelector.cs

@@ -144,8 +144,7 @@ public SniOptions GetOptions(ConnectionContext connection, string serverName)
                 Debug.Assert(_fallbackServerCertificateSelector != null,
                     "The cached SniOptions ServerCertificate can only be null if there's a fallback certificate selector.");
 
-                // If a ServerCertificateSelector passed into HttpsConnectionMiddleware via HttpsConnectionAdapterOptions doesn't return a cert,
-                // HttpsConnectionMiddleware doesn't fallback to the ServerCertificate, so we don't do that here either.
+                // If a ServerCertificateSelector doesn't return a cert, HttpsConnectionMiddleware doesn't fallback to the ServerCertificate.
                 options = options.Clone();
                 options.SslOptions.ServerCertificate = _fallbackServerCertificateSelector(connection, serverName);
             }

src/Servers/Kestrel/Core/src/KestrelConfigurationLoader.cs

@@ -359,7 +359,7 @@ public void Load()
                         var logger = Options.ApplicationServices.GetRequiredService<ILogger<KestrelConfigurationLoader>>();
                         var sniOptionsSelector = new SniOptionsSelector(this, endpoint, httpsOptions, listenOptions.Protocols, logger);
 
-                        listenOptions.UseHttps(ServerOptionsSelectionCallback, sniOptionsSelector);
+                        listenOptions.UseHttps(ServerOptionsSelectionCallback, sniOptionsSelector, httpsOptions.HandshakeTimeout);
                     }
                 }
 

src/Servers/Kestrel/Core/src/ListenOptionsHttpsExtensions.cs

@@ -235,15 +235,16 @@ public static ListenOptions UseHttps(this ListenOptions listenOptions, HttpsConn
         /// <param name="listenOptions">The <see cref="ListenOptions"/> to configure.</param>
         /// <param name="httpsOptionsCallback">Callback to configure HTTPS options.</param>
         /// <param name="state">State for the <see cref="ServerOptionsSelectionCallback" />.</param>
+        /// <param name="handshakeTimeout">Specifies the maximum amount of time allowed for the TLS/SSL handshake. This must be positive and finite.</param>
         /// <returns>The <see cref="ListenOptions"/>.</returns>
-        internal static ListenOptions UseHttps(this ListenOptions listenOptions, HttpsOptionsCallback httpsOptionsCallback, object state = null)
+        internal static ListenOptions UseHttps(this ListenOptions listenOptions, HttpsOptionsCallback httpsOptionsCallback, object state, TimeSpan handshakeTimeout)
         {
             var loggerFactory = listenOptions.KestrelServerOptions?.ApplicationServices.GetRequiredService<ILoggerFactory>() ?? NullLoggerFactory.Instance;
 
             listenOptions.IsTls = true;
             listenOptions.Use(next =>
             {
-                var middleware = new HttpsConnectionMiddleware(next, httpsOptionsCallback, state, loggerFactory);
+                var middleware = new HttpsConnectionMiddleware(next, httpsOptionsCallback, state, handshakeTimeout, loggerFactory);
                 return middleware.OnConnectionAsync;
             });
 

src/Servers/Kestrel/Core/src/Middleware/HttpsConnectionMiddleware.cs

@@ -31,9 +31,10 @@ internal class HttpsConnectionMiddleware
     {
         private const string EnableWindows81Http2 = "Microsoft.AspNetCore.Server.Kestrel.EnableWindows81Http2";
 
-        internal static readonly TimeSpan DefaultHandshakeTimeout = TimeSpan.FromSeconds(10);
+        private static readonly bool _isWindowsVersionIncompatible = IsWindowsVersionIncompatible();
 
         private readonly ConnectionDelegate _next;
+        private readonly TimeSpan _handshakeTimeout;
         private readonly ILogger _logger;
         private readonly Func<Stream, SslStream> _sslStreamFactory;
 
@@ -43,7 +44,6 @@ internal class HttpsConnectionMiddleware
         private readonly Func<ConnectionContext, string, X509Certificate2> _serverCertificateSelector;
 
         // The following fields are only set by ServerOptionsSelectionCallback ctor.
-        // If we ever expose this via a public API, we should really create a delegate type.
         private readonly HttpsOptionsCallback _httpsOptionsCallback;
         private readonly object _httpsOptionsCallbackState;
 
@@ -59,12 +59,13 @@ public HttpsConnectionMiddleware(ConnectionDelegate next, HttpsConnectionAdapter
                 throw new ArgumentNullException(nameof(options));
             }
 
-            _options = options;
+            _next = next;
+            _handshakeTimeout = options.HandshakeTimeout;
             _logger = loggerFactory.CreateLogger<HttpsConnectionMiddleware>();
 
+            _options = options;
             _options.HttpProtocols = ValidateAndNormalizeHttpProtocols(_options.HttpProtocols, _logger);
 
-            _next = next;
             // capture the certificate now so it can't be switched after validation
             _serverCertificate = options.ServerCertificate;
             _serverCertificateSelector = options.ServerCertificateSelector;
@@ -94,10 +95,13 @@ internal HttpsConnectionMiddleware(
             ConnectionDelegate next,
             HttpsOptionsCallback httpsOptionsCallback,
             object httpsOptionsCallbackState,
+            TimeSpan handshakeTimeout,
             ILoggerFactory loggerFactory)
         {
             _next = next;
+            _handshakeTimeout = handshakeTimeout;
             _logger = loggerFactory.CreateLogger<HttpsConnectionMiddleware>();
+
             _httpsOptionsCallback = httpsOptionsCallback;
             _httpsOptionsCallbackState = httpsOptionsCallbackState;
             _sslStreamFactory = s => new SslStream(s);
@@ -122,7 +126,7 @@ public async Task OnConnectionAsync(ConnectionContext context)
 
             try
             {
-                using var cancellationTokenSource = new CancellationTokenSource(_options?.HandshakeTimeout ?? DefaultHandshakeTimeout);
+                using var cancellationTokenSource = new CancellationTokenSource(_handshakeTimeout);
                 if (_httpsOptionsCallback is null)
                 {
                     await DoOptionsBasedHandshakeAsync(context, sslStream, feature, cancellationTokenSource.Token);
@@ -255,9 +259,6 @@ internal static void ConfigureAlpn(SslServerAuthenticationOptions serverOptions,
             }
         }
 
-        private bool RemoteCertificateValidationCallback(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) =>
-            RemoteCertificateValidationCallback(_options.ClientCertificateMode, _options.ClientCertificateValidation, certificate, chain, sslPolicyErrors);
-
         internal static bool RemoteCertificateValidationCallback(
             ClientCertificateMode clientCertificateMode,
             Func<X509Certificate2, X509Chain, SslPolicyErrors, bool> clientCertificateValidation,
@@ -295,6 +296,9 @@ internal static bool RemoteCertificateValidationCallback(
             return true;
         }
 
+        private bool RemoteCertificateValidationCallback(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) =>
+            RemoteCertificateValidationCallback(_options.ClientCertificateMode, _options.ClientCertificateValidation, certificate, chain, sslPolicyErrors);
+
         private SslDuplexPipe CreateSslDuplexPipe(IDuplexPipe transport, MemoryPool<byte> memoryPool)
         {
             var inputPipeOptions = new StreamPipeReaderOptions
@@ -366,12 +370,12 @@ internal static HttpProtocols ValidateAndNormalizeHttpProtocols(HttpProtocols ht
                 {
                     throw new NotSupportedException(CoreStrings.Http2NoTlsOsx);
                 }
-                else if (IsWindowsVersionIncompatible())
+                else if (_isWindowsVersionIncompatible)
                 {
                     throw new NotSupportedException(CoreStrings.Http2NoTlsWin81);
                 }
             }
-            else if (httpProtocols == HttpProtocols.Http1AndHttp2 && IsWindowsVersionIncompatible())
+            else if (httpProtocols == HttpProtocols.Http1AndHttp2 && _isWindowsVersionIncompatible)
             {
                 logger.Http2DefaultCiphersInsufficient();
                 return HttpProtocols.Http1;