HttpsContentFilter Error on Azure Service Fabric

[SergeBerwert]

I have an Application Hosted by Kestrel Insight Service Fabric Cluster on an Azure vm scale set with a load balancier in front. I have an exception every 5 seconds in my Log. After analyzing it looks like the problem is coming from this line of Code:

Line 47 class HttpsConnectionFilter

await sslStream.AuthenticateAsServerAsync(_options.ServerCertificate, clientCertificateRequired: false,
    enabledSslProtocols: _options.SslProtocols, checkCertificateRevocation: _options.CheckCertificateRevocation);

The Source IP that causes the problem is from some ware insight the Microsoft network. It seems like some kind of Https ping.
Regular requests perform without any problems.

The Exception is:

[23:33:43.6275 070716] Debug      : [Kestrel] [6] Connection id "0HKT6NOUC059E" received FIN.
[23:33:43.6431 070716] Debug      : [Kestrel] [1] Connection id "0HKT6NOUC059F" started.
[23:33:43.6431 070716] Error      : [Kestrel] ConnectionFilter.OnConnection
System.AggregateException: One or more errors occurred. ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Server.Kestrel.Https.HttpsConnectionFilter.<OnConnectionAsync>d__3.MoveNext()
   --- End of inner exception stack trace ---
---> (Inner Exception #0) System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Server.Kestrel.Https.HttpsConnectionFilter.<OnConnectionAsync>d__3.MoveNext()<---

[23:33:43.6431 070716] Debug      : [Kestrel] [10] Connection id "0HKT6NOUC059E" disconnecting.
[23:33:43.6431 070716] Debug      : [Kestrel] [2] Connection id "0HKT6NOUC059E" stopped. 

[halter73]

Interesting. It seems the only way to avoid the exception would be not to call AuthenticateAsServerAsync.

I'm not sure what the best logic would be to determine not to do that. The easiest thing might be to wait for request data to arrive before calling IConnectionFilter.OnConnectionAsync. This would prevent connection filters from "seeing" connections that don't send data like these pings. It wouldn't be a problem for HttpsConnectionFilter, but that might be an issue for a logging filter.

[muratg]

We can change the LogLevel to Warning in

KestrelHttpServer/src/Microsoft.AspNetCore.Server.Kestrel.Https/HttpsConnectionFilter.cs

Line 37 in badbc7c

public async Task OnConnectionAsync(ConnectionFilterContext context)

[muratg]

Additionally, we'll come up with a new EventID for these class of errors (if we don't already have it) so that folks can turn logging off for these logs.