Skip to content

feat: add handshake Exception on ITlsHandshakeFeature#65807

Open
DeagleGross wants to merge 7 commits intodotnet:mainfrom
DeagleGross:dmkorolev/tls/handshake-failed
Open

feat: add handshake Exception on ITlsHandshakeFeature#65807
DeagleGross wants to merge 7 commits intodotnet:mainfrom
DeagleGross:dmkorolev/tls/handshake-failed

Conversation

@DeagleGross
Copy link
Member

@DeagleGross DeagleGross commented Mar 17, 2026

Adding handshake exception on the ITlsHandshakeFeature

In order to allow users to get the exception happened during tls handshake, adding new approved API on ITlsHandshakeFeature and populating it in the HttpsConnectionMiddleware.

Since we now assume ITlsHandshakeFeature can be used after tls handshake failed, and underlying sslStream may be disposed (should be actually), I added a way to snapshot all the fields from sslStream to TlsConnectionFeature backup-fields, which will be used if set.

Note: changed to NET11_0_OR_GREATER instead of NETCOREAPP to not make an unintended change in net10

Fixes #65758

@DeagleGross DeagleGross self-assigned this Mar 17, 2026
@github-actions github-actions bot added the area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions label Mar 17, 2026
@DeagleGross DeagleGross changed the title [WIP] feat: add HandshakeException on ITlsHandshakeFeature [WIP] feat: add handshake Exception on ITlsHandshakeFeature Mar 20, 2026
@DeagleGross DeagleGross marked this pull request as ready for review March 20, 2026 14:46
@DeagleGross DeagleGross requested review from Copilot March 20, 2026 14:46
@DeagleGross DeagleGross changed the title [WIP] feat: add handshake Exception on ITlsHandshakeFeature feat: add handshake Exception on ITlsHandshakeFeature Mar 20, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds a new Exception property to ITlsHandshakeFeature so middleware can inspect TLS handshake failures, and updates Kestrel’s HttpsConnectionMiddleware to populate it (including snapshotting SslStream-backed properties before disposal).

Changes:

  • Add ITlsHandshakeFeature.Exception (default interface member) as a new approved API surface.
  • Populate the handshake exception in HttpsConnectionMiddleware on handshake failures and snapshot TLS-related properties before SslStream disposal.
  • Add functional tests validating Exception is set on handshake failure/timeout and remains null on success; update sample to demonstrate usage.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
src/Servers/Kestrel/test/InMemory.FunctionalTests/HttpsConnectionMiddlewareTests.cs Adds coverage for handshake exception + post-failure feature access patterns (with some flakiness risks).
src/Servers/Kestrel/samples/SampleApp/Startup.cs Demonstrates reading ITlsHandshakeFeature.Exception after handshake completion.
src/Servers/Kestrel/Core/src/Middleware/HttpsConnectionMiddleware.cs Sets feature.Exception on handshake failure and snapshots properties before disposal.
src/Servers/Kestrel/Core/src/Internal/TlsConnectionFeature.cs Adds snapshotting/cached backing fields and an Exception property implementation.
src/Servers/Connections.Abstractions/src/PublicAPI/net11.0/PublicAPI.Unshipped.txt Declares the new public API entry for net11.0.
src/Servers/Connections.Abstractions/src/Features/ITlsHandshakeFeature.cs Introduces the new Exception property (NETCOREAPP) with a default implementation.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Kestrel HTTPS/TLS API does not provide a way to handle TLS handshake failures

2 participants