From 9e47a0985bf90e1ca5f310916e88725738539225 Mon Sep 17 00:00:00 2001
From: Tim <TimSiefert@users.noreply.github.com>
Date: Thu, 21 Apr 2022 21:02:39 +0200
Subject: [PATCH] Allow to change cipher suite (#1381)

* Allow to change the used Cipher Suite

* Also added cipher suite to the mqtt client part

* Added ConfigureAwait
---
 .../Client/Options/MqttClientTlsOptions.cs    |  2 ++
 .../MQTTnet/Implementations/MqttTcpChannel.cs |  3 ++-
 .../Implementations/MqttTcpServerListener.cs  | 23 +++++++++++++++----
 .../MqttServerTlsTcpEndpointOptions.cs        |  4 ++++
 4 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs b/Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs
index 840886ca..4865dc27 100644
--- a/Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs
+++ b/Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs
@@ -29,6 +29,8 @@ namespace MQTTnet.Client
 
 #if NETCOREAPP3_1 || NET5_0_OR_GREATER
         public List<System.Net.Security.SslApplicationProtocol> ApplicationProtocols { get; set; }
+        
+        public System.Net.Security.CipherSuitesPolicy CipherSuitesPolicy { get; set; }
 #endif
 
 #if NET48 || NETCOREAPP3_1 || NET5 || NET6
diff --git a/Source/MQTTnet/Implementations/MqttTcpChannel.cs b/Source/MQTTnet/Implementations/MqttTcpChannel.cs
index f3e84621..7689096c 100644
--- a/Source/MQTTnet/Implementations/MqttTcpChannel.cs
+++ b/Source/MQTTnet/Implementations/MqttTcpChannel.cs
@@ -104,7 +104,8 @@ namespace MQTTnet.Implementations
                             ClientCertificates = LoadCertificates(),
                             EnabledSslProtocols = _tcpOptions.TlsOptions.SslProtocol,
                             CertificateRevocationCheckMode = _tcpOptions.TlsOptions.IgnoreCertificateRevocationErrors ? X509RevocationMode.NoCheck : X509RevocationMode.Online,
-                            TargetHost = _tcpOptions.Server
+                            TargetHost = _tcpOptions.Server,
+                            CipherSuitesPolicy = _tcpOptions.TlsOptions.CipherSuitesPolicy
                         };
 
                         await sslStream.AuthenticateAsClientAsync(sslOptions, cancellationToken).ConfigureAwait(false);
diff --git a/Source/MQTTnet/Implementations/MqttTcpServerListener.cs b/Source/MQTTnet/Implementations/MqttTcpServerListener.cs
index 2f7fb1a1..b2f814da 100644
--- a/Source/MQTTnet/Implementations/MqttTcpServerListener.cs
+++ b/Source/MQTTnet/Implementations/MqttTcpServerListener.cs
@@ -178,11 +178,24 @@ namespace MQTTnet.Implementations
                 {
                     var sslStream = new SslStream(stream, false, _tlsOptions.RemoteCertificateValidationCallback);
 
-                    await sslStream.AuthenticateAsServerAsync(
-                        _tlsCertificate,
-                        _tlsOptions.ClientCertificateRequired,
-                        _tlsOptions.SslProtocol,
-                        _tlsOptions.CheckCertificateRevocation).ConfigureAwait(false);
+                    #if NETCOREAPP3_1 || NET5_0_OR_GREATER
+                        await sslStream.AuthenticateAsServerAsync(
+                            new SslServerAuthenticationOptions()
+                            {
+                                ServerCertificate = _tlsCertificate,
+                                ClientCertificateRequired = _tlsOptions.ClientCertificateRequired,
+                                EnabledSslProtocols = _tlsOptions.SslProtocol,
+                                CertificateRevocationCheckMode = _tlsOptions.CheckCertificateRevocation ? X509RevocationMode.Online : X509RevocationMode.NoCheck,
+                                EncryptionPolicy = EncryptionPolicy.RequireEncryption,
+                                CipherSuitesPolicy = _tlsOptions.CipherSuitesPolicy
+                            }).ConfigureAwait(false);
+                    #else
+                        await sslStream.AuthenticateAsServerAsync(
+                            _tlsCertificate,
+                            _tlsOptions.ClientCertificateRequired,
+                            _tlsOptions.SslProtocol,
+                            _tlsOptions.CheckCertificateRevocation).ConfigureAwait(false);
+                    #endif
 
                     stream = sslStream;
 
diff --git a/Source/MQTTnet/Server/Options/MqttServerTlsTcpEndpointOptions.cs b/Source/MQTTnet/Server/Options/MqttServerTlsTcpEndpointOptions.cs
index ddab4ffe..f24881c0 100644
--- a/Source/MQTTnet/Server/Options/MqttServerTlsTcpEndpointOptions.cs
+++ b/Source/MQTTnet/Server/Options/MqttServerTlsTcpEndpointOptions.cs
@@ -24,5 +24,9 @@ namespace MQTTnet.Server
         public bool CheckCertificateRevocation { get; set; }
 
         public SslProtocols SslProtocol { get; set; } = SslProtocols.Tls12;
+        
+#if NETCOREAPP3_1 || NET5_0_OR_GREATER
+        public System.Net.Security.CipherSuitesPolicy CipherSuitesPolicy { get; set; }
+#endif
     }
 }