Background and motivation
Consider the following code:
var handler = new SocketsHttpHandler
{
SslOptions = new SslClientAuthenticationOptions { RemoteCertificateValidationCallback = HandlePinningPolicy }
};
var httpClient = new HttpClient(handler);
private static bool HandlePinningPolicy(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
if (sslPolicyErrors != SslPolicyErrors.None) return false;
if (PinList != null && PinList.TryGetValue(((SslStream)sender).TargetHostName, out var pin)) return new Span<byte>(pin).SequenceEqual(SHA256.HashData(certificate.GetPublicKey()));
return true;
}
On HTTP 1 and 2 connections, that all works perfectly fine. With .NET 7 and HTTP 3, I noticed HandlePinningPolicy was throwing an exception:
Unable to cast object of type 'System.Net.Quic.QuicConnection' to type 'System.Net.Security.SslStream'.
The problem is obvious, so I decided to add a check for when the sender is QuicConnection. Just one problem though.. QuicConnection doesn't provide the host name of the connection, and I do not see any way to get it:
As a result, pinning HTTP 3 connections seems impossible.
Any temporary workaround would be appreciated.🙂
API Proposal
namespace System.Net.Quic;
public sealed partial class QuicConnection : IAsyncDisposable
{
+ public string TargetHostName { ... }
}API Usage
if(PinList!=null&&PinList.TryGetValue(senderisQuicConnectionqc?qc.TargetHostName:((SslStream)sender).TargetHostName,outvarpin))returnnewSpan<byte>(pin).SequenceEqual(SHA256.HashData(certificate.GetPublicKey()));
Alternative Designs
No response
Risks
None
Background and motivation
Consider the following code:
On HTTP 1 and 2 connections, that all works perfectly fine. With .NET 7 and HTTP 3, I noticed HandlePinningPolicy was throwing an exception:
Unable to cast object of type 'System.Net.Quic.QuicConnection' to type 'System.Net.Security.SslStream'.The problem is obvious, so I decided to add a check for when the
senderisQuicConnection. Just one problem though..QuicConnectiondoesn't provide the host name of the connection, and I do not see any way to get it:As a result, pinning HTTP 3 connections seems impossible.
Any temporary workaround would be appreciated.🙂
API Proposal
namespace System.Net.Quic; public sealed partial class QuicConnection : IAsyncDisposable { + public string TargetHostName { ... } }API Usage
Alternative Designs
No response
Risks
None