Expose the cipher suite and SslStream

[xiaoyangwang-geotab]

Hello .NET Core Team,

I hope this message finds you well. I am reaching out to request assistance in retrieving the cipher suite of each connection in my application.

I understand that this information is important for ensuring the security of the connection and I would like to know the steps to retrieve it using .NET Core.

I tried to use ITlsHandshakeFeature retrieved from HttpContext, but I could only get the CipherAlgorithm, and both HashAlgorithm and KeyExchangeAlgorithm get None. Also, when I debug, I found a private field _sslSream in the ITlsHandshakeFeature which gave me the cipher suite value from its property NegotiatedCipherSuite. But unfortunately, I couldn't find a way to access the sslStream.

If there are any classes, methods or resources that you can recommend or provide, I would be grateful. I would also appreciate any additional information or guidance that you can offer on this matter.

Thank you for your time and assistance. I look forward to your response.

Best regards,
Xiaoyang

[davidfowl]

Where are you trying to get this information and what do you want to do with it?

[xiaoyangwang-geotab]

I tried get it from HttpContext after the connection build.
We would like to monitor the usage of SSL ciphers, in particular to know when customers are using an insecure cipher, and so we could know when support for it can be safely removed.

[Tratcher]

Hmm, why didn't we include the NegotiatedCipherSuite?

The other ITlsHandshakeFeature fields give you most of the same information, just decomposed.

Try HttpContext.Features.Get<SslStream>();

aspnetcore/src/Servers/Kestrel/Core/src/Middleware/HttpsConnectionMiddleware.cs

Line 419 in 7d0b688

context.Features.Set(sslStream);

[xiaoyangwang-geotab]

Thanks Chris. I had tried HttpContext.Features.Get() too but it returned null for me.

[xiaoyangwang-geotab]

Additionally, here are the other fields I got:
CipherAlgorithm: Aes256
CipherStrength: 256
HashAlgorithm: None
HashStrength: 0
KeyExchangeAlgorithm: None
KeyExchangeStrength: 0
Protocol: Tls13
As I said HashAlgorithm and KeyExchangeAlgorithm are None, but from debug, I could see _sslStream.NegotiatedCipherSuite is TLS_AES_256_GCM_SHA384.
I don't understand why I kept getting None for the HashAlgorithm and KeyExchangeAlgorithm.
Thanks again for helping me with it!

[Tratcher]

Those values match the properties from SslStream, right? We can only report what it does.

You may need to use reflection to get the SslStream for now. We can look at exposing the cipher suite in the future.

[xiaoyangwang-geotab]

Yes, those values match the properties from SslStream.
Also, using reflection to get SslStream, you mean I could iterate all the HttpContext.Features and use reflection get SslStream, right? Thanks!

[Tratcher]

I meant you could use reflection to get the field from the type instance that implements ITlsHandshakeFeature.

[xiaoyangwang-geotab]

I see. Cool! I'll try to see if I could get it this way and will update the result later. Thanks

[xiaoyangwang-geotab]

Using reflection worked for now. But still hope the cipher suite will be exposed in the future to reduce overhead. Thanks!

[davidfowl]

I just took a look at this and it seems like an oversight. We only add the SSL Stream as a feature when you hook the certificate selector in the https options. I think we should just expose the SSLStream on a feature (either an existing one or a new one) like we do the socket.