How to 'upgrade' a Microsoft.AspNetCore.Connections.ConnectionContext to a SslStream?

[DierkDroth]

I'm using (minimal) Kestrel in a multi-purpose setup:

• as (SSL) websocket server
• as (SSL) HTTP server
• as (SSL) plain socket server

I'm struggling with the latter as I'm implementing the MySQL wire protocol server side (don't ask, there is a business reason). The problem is that during the handshake phase the client wants to upgrade the connection to SSL which usually is done like:

var sslStream = new SslStream(oldStream);
await sslStream.AuthenticateAsServerAsync(certificate);

However, that requires a stream which is readable and writable. Unfortunately I only have:

public override async Task OnConnectedAsync(ConnectionContext connection)
{
	var readableStream = connection.Transport.Input.AsStream();
	var writableStream = connection.Transport.Output.AsStream();
}

... which can't be used on SslStream.ctor but throw an exception like

System.ArgumentException
  HResult=0x80070057
  Message=The stream has to be read/write. (Parameter 'innerStream')
  Source=System.Net.Security
  StackTrace:
   at System.Net.Security.AuthenticatedStream..ctor(Stream innerStream, Boolean leaveInnerStreamOpen)
   at System.Net.Security.SslStream..ctor(Stream innerStream, Boolean leaveInnerStreamOpen, RemoteCertificateValidationCallback userCertificateValidationCallback, LocalCertificateSelectionCallback userCertificateSelectionCallback, EncryptionPolicy encryptionPolicy)
   at System.Net.Security.SslStream..ctor(Stream innerStream)

My only 'escape' for now is trying to implement a duplex stream as wrapper for both streams above which then could be stuffed into SslStream.ctor. However, this sounds like a nightmare, not even thinking about the performance loss...

Isn't there a read/write stream with Microsoft.AspNetCore.Connections.ConnectionContext which I could upgrade midstream to a SslStream? What am I missing?

Side note: this was a 'walk in the park' with legacy System.Net.HttpListener. I would expect something similar with Kestrel...

Thanks in advance

[davidfowl]

You can copy the code from kestrel:

https://github.com/dotnet/aspnetcore/blob/79ef5e329b1e31c3775a1977798253cc8f7da6cc/src/Shared/ServerInfrastructure/SslDuplexPipe.cs

[DierkDroth]

@davidfowl thanks for your suggestion. Unfortunately it appears not to work due to compile error below.

What am I missing?

[davidfowl]

You have to copy that code, out of kestrel. It's not public.

[DierkDroth]

Thanks again @davidfowl.

For anyone else running into that problem: I finally got it working by pulling together the files below from sources + tweaking task related code which still won't compile in DuplexPipeStream.cs. Not sure if this will hold water, but it's my only option for now. :-(

@danroth27 I wonder why it has to be so complicated with Kestrel to upgrade a socket to SSL?!? This was simple 'one-liner' with legacy System.Net.HttpListener...

[DierkDroth]

Thanks for looking into @danroth27. Much appreciated...

[davidfowl]

Kestrel is an HTTP server, TLS + HTTP is a one liner. TLS + TCP isn't. It's not a primary scenario so we haven't spent any time making it nice.

[DierkDroth]

To provide some background info: I had to switch from System.Net.HttpListener to Kestrel - although it comes with a lot of overhead which I don't need - since AFAIK this is the only option to do SSL on a Linux server (here: Amazon Linux).

[davidfowl]

The original issue was about TCP no? I feel like I'm missing something. Are you implementing an HTTP based protocol or TCP based protocol? You mention HttpListener but then also mention the MySQL protocol, which I didn't think was HTTP based. What am I missing?

[DierkDroth]

Yep, this is TCP which is one of the scenarios ('plain socket server') of my 'hybrid' Kestrel usage (please see the first few lines of my original post). In particular I'm implementing ConnectionHandler.OnConnectedAsync to cover that scenario