Skip to content

feat(HTTP.SYS): on-demand TLS client hello retrieval#62209

Merged
DeagleGross merged 8 commits intodotnet:mainfrom
DeagleGross:dmkorolev/httpsys-ondemand-tlsclienthello
Jun 7, 2025
Merged

feat(HTTP.SYS): on-demand TLS client hello retrieval#62209
DeagleGross merged 8 commits intodotnet:mainfrom
DeagleGross:dmkorolev/httpsys-ondemand-tlsclienthello

Conversation

@DeagleGross
Copy link
Member

@DeagleGross DeagleGross commented Jun 2, 2025

HTTP.SYS only on-demand TLS client hello

As discussed in api proposal we are doing 2 things here:

  1. removing previous "callback" API HttpSysOptions.TlsClientHelloBytesCallback
  2. implementing an on-demand request of TlsClientHello via win API. It is done by exposing a method on a new feature interface IHttpSysRequestPropertiesFeature: IHttpSysRequestPropertiesFeature.TryGetTlsClientHello.

TlsFeaturesObserve.Program sample shows the usage of that feature and this API in particular:

app.Use(async (context, next) =>
{
    var connectionFeature = context.Features.GetRequiredFeature<IHttpConnectionFeature>();
    var httpSysPropFeature = context.Features.GetRequiredFeature<IHttpSysRequestPropertyFeature>();

    // first time invocation to find out required size
    var success = httpSysPropFeature.TryGetTlsClientHello(Array.Empty<byte>(), out var bytesReturned);
    Debug.Assert(!success);
    Debug.Assert(bytesReturned > 0);

    // rent with enough memory span and invoke
    var bytes = ArrayPool<byte>.Shared.Rent(bytesReturned);
    success = httpSysPropFeature.TryGetTlsClientHello(bytes, out _);
    Debug.Assert(success);

    await context.Response.WriteAsync($"[Response] connectionId={connectionFeature.ConnectionId}; tlsClientHello.length={bytesReturned}; tlsclienthello start={string.Join(' ', bytes.AsSpan(0, 30).ToArray())}");
    await next(context);
});

Implements #61625

@github-actions github-actions bot added the area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions label Jun 2, 2025
@build-analysis build-analysis bot mentioned this pull request Jun 2, 2025
Open
halter73
halter73 approved these changes Jun 2, 2025
View reviewed changes
BrennanConroy
BrennanConroy reviewed Jun 3, 2025
View reviewed changes
BrennanConroy
BrennanConroy reviewed Jun 4, 2025
View reviewed changes
tdykstra
tdykstra approved these changes Jun 5, 2025
View reviewed changes
Copy link
Contributor

@tdykstra tdykstra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just A few nits.

tdykstra

This comment was marked as duplicate.

Sign in to view

@DeagleGross DeagleGross enabled auto-merge (squash) June 6, 2025 22:15
@DeagleGross DeagleGross merged commit 047246c into dotnet:main Jun 7, 2025
27 checks passed
@dotnet-policy-service dotnet-policy-service bot added this to the 10.0-preview6 milestone Jun 7, 2025
@DeagleGross DeagleGross deleted the dmkorolev/httpsys-ondemand-tlsclienthello branch June 7, 2025 10:44
@DeagleGross
Copy link
Member Author

DeagleGross commented Jun 9, 2025

/backport to release/8.0

@github-actions
Copy link
Contributor

github-actions bot commented Jun 9, 2025

Started backporting to release/8.0: https://github.com/dotnet/aspnetcore/actions/runs/15546470366

@github-actions
Copy link
Contributor

github-actions bot commented Jun 9, 2025

@DeagleGross backporting to "release/8.0" failed, the patch most likely resulted in conflicts:

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: drop callback / implement on-demand tls client hello access
Using index info to reconstruct a base tree...
M	src/Servers/HttpSys/samples/TlsFeaturesObserve/Program.cs
M	src/Servers/HttpSys/src/HttpSysListener.cs
M	src/Servers/HttpSys/src/HttpSysOptions.cs
M	src/Servers/HttpSys/src/PublicAPI.Unshipped.txt
M	src/Servers/HttpSys/src/RequestProcessing/Request.cs
M	src/Servers/HttpSys/src/RequestProcessing/RequestContext.FeatureCollection.cs
M	src/Servers/HttpSys/src/RequestProcessing/RequestContext.cs
M	src/Servers/HttpSys/src/RequestProcessing/TlsListener.cs
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): src/Servers/HttpSys/src/RequestProcessing/TlsListener.cs deleted in drop callback / implement on-demand tls client hello access and modified in HEAD. Version HEAD of src/Servers/HttpSys/src/RequestProcessing/TlsListener.cs left in tree.
Removing src/Servers/HttpSys/src/RequestProcessing/TlsListener.Log.cs
Auto-merging src/Servers/HttpSys/src/RequestProcessing/RequestContext.cs
CONFLICT (content): Merge conflict in src/Servers/HttpSys/src/RequestProcessing/RequestContext.cs
Auto-merging src/Servers/HttpSys/src/RequestProcessing/RequestContext.FeatureCollection.cs
Auto-merging src/Servers/HttpSys/src/RequestProcessing/Request.cs
CONFLICT (content): Merge conflict in src/Servers/HttpSys/src/RequestProcessing/Request.cs
Auto-merging src/Servers/HttpSys/src/PublicAPI.Unshipped.txt
CONFLICT (content): Merge conflict in src/Servers/HttpSys/src/PublicAPI.Unshipped.txt
Auto-merging src/Servers/HttpSys/src/HttpSysOptions.cs
CONFLICT (content): Merge conflict in src/Servers/HttpSys/src/HttpSysOptions.cs
Auto-merging src/Servers/HttpSys/src/HttpSysListener.cs
CONFLICT (content): Merge conflict in src/Servers/HttpSys/src/HttpSysListener.cs
Removing src/Servers/HttpSys/samples/TlsFeaturesObserve/Startup.cs
Auto-merging src/Servers/HttpSys/samples/TlsFeaturesObserve/Program.cs
CONFLICT (content): Merge conflict in src/Servers/HttpSys/samples/TlsFeaturesObserve/Program.cs
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 drop callback / implement on-demand tls client hello access
Error: The process '/usr/bin/git' failed with exit code 128

Please backport manually!

@DeagleGross DeagleGross mentioned this pull request Jun 9, 2025
Merged
10 tasks
joperezr pushed a commit that referenced this pull request Jun 11, 2025
@DeagleGross
backport(net8.0): http.sys on-demand TLS client hello retrieval (#62290)
9e8ebbf 
* feat(HTTP.SYS): on-demand TLS client hello retrieval (#62209)

* fix cherry-pick

* setup sample

* provide example

* fix build error
@danroth27 danroth27 added the blog-candidate Consider mentioning this in the release blog post label Jul 1, 2025
@dotnet-policy-service
Copy link
Contributor

dotnet-policy-service bot commented Jul 1, 2025

@@DeagleGross, this change will be considered for inclusion in the blog post for the release it'll ship in. Nice work!

Please ensure that the original comment in this thread contains a clear explanation of what the change does, why it's important (what problem does it solve?), and, if relevant, include things like code samples and/or performance numbers.

This content may not be exactly what goes into the blog post, but it will help the team putting together the announcement.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@halter73 halter73 halter73 approved these changes

@tdykstra tdykstra tdykstra approved these changes

@BrennanConroy BrennanConroy BrennanConroy approved these changes

@JamesNK JamesNK Awaiting requested review from JamesNK JamesNK is a code owner

@mgravell mgravell Awaiting requested review from mgravell

@captainsafia captainsafia Awaiting requested review from captainsafia

Assignees

No one assigned

Labels

area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions blog-candidate Consider mentioning this in the release blog post feature-httpsys

Projects

None yet

Milestone

10.0-preview6

Development

Successfully merging this pull request may close these issues.

6 participants

@DeagleGross @halter73 @tdykstra @BrennanConroy @danroth27 @gfoidl