From b7ab29473b5a6902b6aba6cc0acda5d7cfca1cd9 Mon Sep 17 00:00:00 2001
From: JanEggers <jan.eggers@ferag.com>
Date: Sun, 7 Oct 2018 12:10:26 +0200
Subject: [PATCH] added ability to specify tls protocol version

---
 Source/MQTTnet/Implementations/MqttTcpServerListener.cs  | 9 +++++++--
 Source/MQTTnet/Server/MqttServerOptionsBuilder.cs        | 7 +++++++
 Source/MQTTnet/Server/MqttServerTlsTcpEndpointOptions.cs | 7 ++++++-
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/Source/MQTTnet/Implementations/MqttTcpServerListener.cs b/Source/MQTTnet/Implementations/MqttTcpServerListener.cs
index e3522979..e72c831d 100644
--- a/Source/MQTTnet/Implementations/MqttTcpServerListener.cs
+++ b/Source/MQTTnet/Implementations/MqttTcpServerListener.cs
@@ -20,8 +20,8 @@ namespace MQTTnet.Implementations
         private readonly CancellationToken _cancellationToken;
         private readonly AddressFamily _addressFamily;
         private readonly MqttServerTcpEndpointBaseOptions _options;
+        private readonly MqttServerTlsTcpEndpointOptions _tlsOptions;
         private readonly X509Certificate2 _tlsCertificate;
-
         private Socket _socket;
 
         public MqttTcpServerListener(
@@ -36,6 +36,11 @@ namespace MQTTnet.Implementations
             _tlsCertificate = tlsCertificate;
             _cancellationToken = cancellationToken;
             _logger = logger.CreateChildLogger(nameof(MqttTcpServerListener));
+            
+            if (_options is MqttServerTlsTcpEndpointOptions tlsOptions)
+            {
+                _tlsOptions = tlsOptions;
+            }
         }
 
         public event EventHandler<MqttServerAdapterClientAcceptedEventArgs> ClientAccepted;
@@ -75,7 +80,7 @@ namespace MQTTnet.Implementations
                     if (_tlsCertificate != null)
                     {
                         sslStream = new SslStream(new NetworkStream(clientSocket), false);
-                        await sslStream.AuthenticateAsServerAsync(_tlsCertificate, false, SslProtocols.Tls12, false).ConfigureAwait(false);
+                        await sslStream.AuthenticateAsServerAsync(_tlsCertificate, false, _tlsOptions.SslProtocol, false).ConfigureAwait(false);
                     }
 
                     _logger.Verbose("Client '{0}' accepted by TCP listener '{1}, {2}'.",
diff --git a/Source/MQTTnet/Server/MqttServerOptionsBuilder.cs b/Source/MQTTnet/Server/MqttServerOptionsBuilder.cs
index f54f379f..45400620 100644
--- a/Source/MQTTnet/Server/MqttServerOptionsBuilder.cs
+++ b/Source/MQTTnet/Server/MqttServerOptionsBuilder.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Net;
+using System.Security.Authentication;
 
 namespace MQTTnet.Server
 {
@@ -80,6 +81,12 @@ namespace MQTTnet.Server
             return this;
         }
 
+        public MqttServerOptionsBuilder WithEncryptionSslProtocol(SslProtocols value)
+        {
+            _options.TlsEndpointOptions.SslProtocol = value;
+            return this;
+        }
+
         public MqttServerOptionsBuilder WithoutEncryptedEndpoint()
         {
             _options.TlsEndpointOptions.IsEnabled = false;
diff --git a/Source/MQTTnet/Server/MqttServerTlsTcpEndpointOptions.cs b/Source/MQTTnet/Server/MqttServerTlsTcpEndpointOptions.cs
index 76d6c862..88d2f86d 100644
--- a/Source/MQTTnet/Server/MqttServerTlsTcpEndpointOptions.cs
+++ b/Source/MQTTnet/Server/MqttServerTlsTcpEndpointOptions.cs
@@ -1,4 +1,6 @@
-namespace MQTTnet.Server
+using System.Security.Authentication;
+
+namespace MQTTnet.Server
 {
     public class MqttServerTlsTcpEndpointOptions : MqttServerTcpEndpointBaseOptions
     {
@@ -8,5 +10,8 @@
         }
 
         public byte[] Certificate { get; set; }
+
+
+        public SslProtocols SslProtocol { get; set; } = SslProtocols.Tls12;
     }
 }