From 30426e5e1e2e64ff0e4e8cc7ae3b0bf8161f112c Mon Sep 17 00:00:00 2001 From: Christian <6939810+chkr1011@users.noreply.github.com> Date: Sun, 6 Nov 2022 10:45:32 +0100 Subject: [PATCH] Move all logic to default handler implementation. Use default handler implementation as default. --- ...MqttClientCertificateValidationEventArgs.cs | 18 +++++++++++++----- ...lientDefaultCertificateValidationHandler.cs | 11 +++++++++-- .../MqttClientOptionsBuilderTlsParameters.cs | 4 ++-- .../Client/Options/MqttClientTlsOptions.cs | 2 +- .../MQTTnet/Implementations/MqttTcpChannel.cs | 16 ++-------------- 5 files changed, 27 insertions(+), 24 deletions(-) diff --git a/Source/MQTTnet/Client/Options/MqttClientCertificateValidationEventArgs.cs b/Source/MQTTnet/Client/Options/MqttClientCertificateValidationEventArgs.cs index f1842cb1..6721c55e 100644 --- a/Source/MQTTnet/Client/Options/MqttClientCertificateValidationEventArgs.cs +++ b/Source/MQTTnet/Client/Options/MqttClientCertificateValidationEventArgs.cs @@ -10,12 +10,20 @@ namespace MQTTnet.Client { public sealed class MqttClientCertificateValidationEventArgs : EventArgs { - public X509Certificate Certificate { get; set; } + public MqttClientCertificateValidationEventArgs(X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors, IMqttClientChannelOptions clientOptions) + { + Certificate = certificate ?? throw new ArgumentNullException(nameof(certificate)); + Chain = chain ?? throw new ArgumentNullException(nameof(chain)); + SslPolicyErrors = sslPolicyErrors; + ClientOptions = clientOptions ?? throw new ArgumentNullException(nameof(clientOptions)); + } - public X509Chain Chain { get; set; } + public X509Certificate Certificate { get; } - public SslPolicyErrors SslPolicyErrors { get; set; } + public X509Chain Chain { get; } - public IMqttClientChannelOptions ClientOptions { get; set; } + public IMqttClientChannelOptions ClientOptions { get; } + + public SslPolicyErrors SslPolicyErrors { get; } } -} +} \ No newline at end of file diff --git a/Source/MQTTnet/Client/Options/MqttClientDefaultCertificateValidationHandler.cs b/Source/MQTTnet/Client/Options/MqttClientDefaultCertificateValidationHandler.cs index ffc4c080..418c77a8 100644 --- a/Source/MQTTnet/Client/Options/MqttClientDefaultCertificateValidationHandler.cs +++ b/Source/MQTTnet/Client/Options/MqttClientDefaultCertificateValidationHandler.cs @@ -12,11 +12,18 @@ namespace MQTTnet.Client { public static bool Handle(MqttClientCertificateValidationEventArgs eventArgs) { - if (eventArgs.SslPolicyErrors == SslPolicyErrors.None) + var sslPolicyErrors = eventArgs.SslPolicyErrors; + + if (eventArgs.ClientOptions?.TlsOptions?.IgnoreCertificateChainErrors ?? false) + { + sslPolicyErrors &= ~SslPolicyErrors.RemoteCertificateChainErrors; + } + + if (sslPolicyErrors == SslPolicyErrors.None) { return true; } - + if (eventArgs.Chain.ChainStatus.Any(c => c.Status == X509ChainStatusFlags.RevocationStatusUnknown || c.Status == X509ChainStatusFlags.Revoked || c.Status == X509ChainStatusFlags.OfflineRevocation)) { diff --git a/Source/MQTTnet/Client/Options/MqttClientOptionsBuilderTlsParameters.cs b/Source/MQTTnet/Client/Options/MqttClientOptionsBuilderTlsParameters.cs index c065bb72..a6f31d8e 100644 --- a/Source/MQTTnet/Client/Options/MqttClientOptionsBuilderTlsParameters.cs +++ b/Source/MQTTnet/Client/Options/MqttClientOptionsBuilderTlsParameters.cs @@ -13,8 +13,8 @@ namespace MQTTnet.Client public sealed class MqttClientOptionsBuilderTlsParameters { public bool UseTls { get; set; } - - public Func CertificateValidationHandler { get; set; } + + public Func CertificateValidationHandler { get; set; } = MqttClientDefaultCertificateValidationHandler.Handle; #if NET48 || NETCOREAPP3_1 || NET5 || NET6 public SslProtocols SslProtocol { get; set; } = SslProtocols.Tls12 | SslProtocols.Tls13; diff --git a/Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs b/Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs index d33a3291..1a402047 100644 --- a/Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs +++ b/Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs @@ -11,7 +11,7 @@ namespace MQTTnet.Client { public sealed class MqttClientTlsOptions { - public Func CertificateValidationHandler { get; set; } + public Func CertificateValidationHandler { get; set; } = MqttClientDefaultCertificateValidationHandler.Handle; public bool UseTls { get; set; } diff --git a/Source/MQTTnet/Implementations/MqttTcpChannel.cs b/Source/MQTTnet/Implementations/MqttTcpChannel.cs index c1e0b316..26841f96 100644 --- a/Source/MQTTnet/Implementations/MqttTcpChannel.cs +++ b/Source/MQTTnet/Implementations/MqttTcpChannel.cs @@ -264,27 +264,15 @@ namespace MQTTnet.Implementations } } - bool InternalUserCertificateValidationCallback(object sender, X509Certificate x509Certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) + bool InternalUserCertificateValidationCallback(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) { var certificateValidationHandler = _tcpOptions?.TlsOptions?.CertificateValidationHandler; if (certificateValidationHandler != null) { - var eventArgs = new MqttClientCertificateValidationEventArgs - { - Certificate = x509Certificate, - Chain = chain, - SslPolicyErrors = sslPolicyErrors, - ClientOptions = _tcpOptions - }; - + var eventArgs = new MqttClientCertificateValidationEventArgs(certificate, chain, sslPolicyErrors, _tcpOptions); return certificateValidationHandler(eventArgs); } - if (_tcpOptions?.TlsOptions?.IgnoreCertificateChainErrors ?? false) - { - sslPolicyErrors &= ~SslPolicyErrors.RemoteCertificateChainErrors; - } - return sslPolicyErrors == SslPolicyErrors.None; }