Merge branch 'master' into 1547-use-mqttclientdefaultcertificatevalidationhandlerhandle-by-default

Source/MQTTnet/Client/Options/MqttClientCertificateValidationEventArgs.cs

@@ -10,12 +10,20 @@ namespace MQTTnet.Client
 {
     public sealed class MqttClientCertificateValidationEventArgs : EventArgs
     {
-        public X509Certificate Certificate { get; set; }
+        public MqttClientCertificateValidationEventArgs(X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors, IMqttClientChannelOptions clientOptions)
+        {
+            Certificate = certificate ?? throw new ArgumentNullException(nameof(certificate));
+            Chain = chain ?? throw new ArgumentNullException(nameof(chain));
+            SslPolicyErrors = sslPolicyErrors;
+            ClientOptions = clientOptions ?? throw new ArgumentNullException(nameof(clientOptions));
+        }
 
-        public X509Chain Chain { get; set; }
+        public X509Certificate Certificate { get; }
 
-        public SslPolicyErrors SslPolicyErrors { get; set; }
+        public X509Chain Chain { get; }
 
-        public IMqttClientChannelOptions ClientOptions { get; set; }
+        public IMqttClientChannelOptions ClientOptions { get; }
+
+        public SslPolicyErrors SslPolicyErrors { get; }
     }
-}
+}

Source/MQTTnet/Client/Options/MqttClientDefaultCertificateValidationHandler.cs

@@ -12,11 +12,18 @@ namespace MQTTnet.Client
     {
         public static bool Handle(MqttClientCertificateValidationEventArgs eventArgs)
         {
-            if (eventArgs.SslPolicyErrors == SslPolicyErrors.None)
+            var sslPolicyErrors = eventArgs.SslPolicyErrors;
+            
+            if (eventArgs.ClientOptions?.TlsOptions?.IgnoreCertificateChainErrors ?? false)
+            {
+                sslPolicyErrors &= ~SslPolicyErrors.RemoteCertificateChainErrors;
+            }
+            
+            if (sslPolicyErrors == SslPolicyErrors.None)
             {
                 return true;
             }
-
+            
             if (eventArgs.Chain.ChainStatus.Any(c =>
                     c.Status == X509ChainStatusFlags.RevocationStatusUnknown || c.Status == X509ChainStatusFlags.Revoked || c.Status == X509ChainStatusFlags.OfflineRevocation))
             {

Source/MQTTnet/Client/Options/MqttClientOptionsBuilderTlsParameters.cs

@@ -13,8 +13,8 @@ namespace MQTTnet.Client
     public sealed class MqttClientOptionsBuilderTlsParameters
     {
         public bool UseTls { get; set; }
-        
-        public Func<MqttClientCertificateValidationEventArgs, bool> CertificateValidationHandler { get; set; }
+
+        public Func<MqttClientCertificateValidationEventArgs, bool> CertificateValidationHandler { get; set; } = MqttClientDefaultCertificateValidationHandler.Handle;
 
 #if NET48 || NETCOREAPP3_1 || NET5 || NET6
         public SslProtocols SslProtocol { get; set; } = SslProtocols.Tls12 | SslProtocols.Tls13;

Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs

@@ -11,7 +11,7 @@ namespace MQTTnet.Client
 {
     public sealed class MqttClientTlsOptions
     {
-        public Func<MqttClientCertificateValidationEventArgs, bool> CertificateValidationHandler { get; set; }
+        public Func<MqttClientCertificateValidationEventArgs, bool> CertificateValidationHandler { get; set; } = MqttClientDefaultCertificateValidationHandler.Handle;
 
         public bool UseTls { get; set; }
 

Source/MQTTnet/Implementations/MqttTcpChannel.cs

@@ -264,27 +264,15 @@ namespace MQTTnet.Implementations
             }
         }
 
-        bool InternalUserCertificateValidationCallback(object sender, X509Certificate x509Certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
+        bool InternalUserCertificateValidationCallback(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
         {
             var certificateValidationHandler = _tcpOptions?.TlsOptions?.CertificateValidationHandler;
             if (certificateValidationHandler != null)
             {
-                var eventArgs = new MqttClientCertificateValidationEventArgs
-                {
-                    Certificate = x509Certificate,
-                    Chain = chain,
-                    SslPolicyErrors = sslPolicyErrors,
-                    ClientOptions = _tcpOptions
-                };
-
+                var eventArgs = new MqttClientCertificateValidationEventArgs(certificate, chain, sslPolicyErrors, _tcpOptions);
                 return certificateValidationHandler(eventArgs);
             }
 
-            if (_tcpOptions?.TlsOptions?.IgnoreCertificateChainErrors ?? false)
-            {
-                sslPolicyErrors &= ~SslPolicyErrors.RemoteCertificateChainErrors;
-            }
-
             return sslPolicyErrors == SslPolicyErrors.None;
         }
 

Source/MQTTnet/Implementations/MqttWebSocketChannel.cs

@@ -224,14 +224,7 @@ namespace MQTTnet.Implementations
                 clientWebSocket.Options.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) =>
                 {
                     // TODO: Find a way to add client options to same callback. Problem is that they have a different type.
-                    var context = new MqttClientCertificateValidationEventArgs
-                    {
-                        Certificate = certificate,
-                        Chain = chain,
-                        SslPolicyErrors = sslPolicyErrors,
-                        ClientOptions = _options
-                    };
-
+                    var context = new MqttClientCertificateValidationEventArgs(certificate, chain, sslPolicyErrors, _options);
                     return certificateValidationHandler(context);
                 };
 #endif