Implement client certificate authentication

src/Microsoft.AspNet.Server.Kestrel.Https/ClientCertificateMode.cs

@@ -0,0 +1,12 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+namespace Microsoft.AspNet.Server.Kestrel.Https
+{
+    public enum ClientCertificateMode
+    {
+        NoCertificate,
+        AllowCertificate,
+        RequireCertificate
+    }
+}

src/Microsoft.AspNet.Server.Kestrel.Https/HttpsApplicationBuilderExtensions.cs

@@ -11,6 +11,11 @@ namespace Microsoft.AspNet.Server.Kestrel.Https
     public static class HttpsApplicationBuilderExtensions
     {
         public static IApplicationBuilder UseKestrelHttps(this IApplicationBuilder app, X509Certificate2 cert)
+        {
+            return app.UseKestrelHttps(new HttpsConnectionFilterOptions { ServerCertificate = cert});
+        }
+
+        public static IApplicationBuilder UseKestrelHttps(this IApplicationBuilder app, HttpsConnectionFilterOptions options)
         {
             var serverInfo = app.ServerFeatures.Get<IKestrelServerInformation>();
 
@@ -21,7 +26,7 @@ public static IApplicationBuilder UseKestrelHttps(this IApplicationBuilder app,
 
             var prevFilter = serverInfo.ConnectionFilter ?? new NoOpConnectionFilter();
 
-            serverInfo.ConnectionFilter = new HttpsConnectionFilter(cert, prevFilter);
+            serverInfo.ConnectionFilter = new HttpsConnectionFilter(options, prevFilter);
 
             return app;
         }

src/Microsoft.AspNet.Server.Kestrel.Https/HttpsConnectionFilter.cs

@@ -3,29 +3,36 @@
 
 using System;
 using System.Net.Security;
+using System.Security.Authentication;
 using System.Security.Cryptography.X509Certificates;
 using System.Threading.Tasks;
+using Microsoft.AspNet.Http.Features;
+using Microsoft.AspNet.Http.Features.Internal;
 using Microsoft.AspNet.Server.Kestrel.Filter;
 
 namespace Microsoft.AspNet.Server.Kestrel.Https
 {
     public class HttpsConnectionFilter : IConnectionFilter
     {
-        private readonly X509Certificate2 _cert;
+        private readonly HttpsConnectionFilterOptions _options;
         private readonly IConnectionFilter _previous;
 
-        public HttpsConnectionFilter(X509Certificate2 cert, IConnectionFilter previous)
+        public HttpsConnectionFilter(HttpsConnectionFilterOptions options, IConnectionFilter previous)
         {
-            if (cert == null)
+            if (options == null)
             {
-                throw new ArgumentNullException(nameof(cert));
+                throw new ArgumentNullException(nameof(options));
             }
             if (previous == null)
             {
                 throw new ArgumentNullException(nameof(previous));
             }
+            if (options.ServerCertificate == null)
+            {
+                throw new ArgumentException("The server certificate parameter is required.");
+            }
 
-            _cert = cert;
+            _options = options;
             _previous = previous;
         }
 
@@ -35,8 +42,71 @@ public async Task OnConnection(ConnectionFilterContext context)
 
             if (string.Equals(context.Address.Scheme, "https", StringComparison.OrdinalIgnoreCase))
             {
-                var sslStream = new SslStream(context.Connection);
-                await sslStream.AuthenticateAsServerAsync(_cert);
+                X509Certificate2 clientCertificate = null;
+                SslStream sslStream;
+                if (_options.ClientCertificateMode == ClientCertificateMode.NoCertificate)
+                {
+                    sslStream = new SslStream(context.Connection);
+                    await sslStream.AuthenticateAsServerAsync(_options.ServerCertificate, clientCertificateRequired: false,
+                        enabledSslProtocols: _options.SslProtocols, checkCertificateRevocation: _options.CheckCertificateRevocation);
+                }
+                else
+                {
+                    sslStream = new SslStream(context.Connection, leaveInnerStreamOpen: false,
+                        userCertificateValidationCallback: (sender, certificate, chain, sslPolicyErrors) =>
+                        {
+                            if (certificate == null)
+                            {
+                                return _options.ClientCertificateMode != ClientCertificateMode.RequireCertificate;
+                            }
+
+                            if (_options.ClientCertificateValidation == null)
+                            {
+                                if (sslPolicyErrors != SslPolicyErrors.None)
+                                {
+                                    return false;
+                                }
+                            }
+
+                            X509Certificate2 certificate2 = certificate as X509Certificate2;
+                            if (certificate2 == null)
+                            {
+#if DOTNET5_4
+                                // conversion X509Certificate to X509Certificate2 not supported
+                                // https://github.com/dotnet/corefx/issues/4510
+                                return false;
+#else
+                                certificate2 = new X509Certificate2(certificate);
+#endif
+                            }
+
+                            if (_options.ClientCertificateValidation != null)
+                            {
+                                if (!_options.ClientCertificateValidation(certificate2, chain, sslPolicyErrors))
+                                {
+                                    return false;
+                                }
+                            }
+
+                            clientCertificate = certificate2;
+                            return true;
+                        });
+                    await sslStream.AuthenticateAsServerAsync(_options.ServerCertificate, clientCertificateRequired: true,
+                        enabledSslProtocols: _options.SslProtocols, checkCertificateRevocation: _options.CheckCertificateRevocation);
+                }
+
+                var previousPrepareRequest = context.PrepareRequest;
+                context.PrepareRequest = features =>
+                {
+                    previousPrepareRequest?.Invoke(features);
+
+                    if (clientCertificate != null)
+                    {
+                        features.Set<ITlsConnectionFeature>(new TlsConnectionFeature { ClientCertificate = clientCertificate });
+                    }
+
+                    features.Get<IHttpRequestFeature>().Scheme = "https";
+                };
                 context.Connection = sslStream;
             }
         }

src/Microsoft.AspNet.Server.Kestrel.Https/HttpsConnectionFilterOptions.cs

@@ -0,0 +1,25 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Net.Security;
+using System.Security.Authentication;
+using System.Security.Cryptography.X509Certificates;
+
+namespace Microsoft.AspNet.Server.Kestrel.Https
+{
+    public class HttpsConnectionFilterOptions
+    {
+        public HttpsConnectionFilterOptions()
+        {
+            ClientCertificateMode = ClientCertificateMode.NoCertificate;
+            SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls;
+        }
+
+        public X509Certificate2 ServerCertificate { get; set; }
+        public ClientCertificateMode ClientCertificateMode { get; set; }
+        public Func<X509Certificate2, X509Chain, SslPolicyErrors, bool> ClientCertificateValidation { get; set; }
+        public SslProtocols SslProtocols { get; set; }
+        public bool CheckCertificateRevocation { get; set; }
+    }
+}

src/Microsoft.AspNet.Server.Kestrel/Filter/ConnectionFilterContext.cs

@@ -1,13 +1,16 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+using System;
 using System.IO;
+using Microsoft.AspNet.Http.Features;
 
 namespace Microsoft.AspNet.Server.Kestrel.Filter
 {
     public class ConnectionFilterContext
     {
         public ServerAddress Address { get; set; }
-        public Stream Connection { get; set;  }
+        public Stream Connection { get; set; }
+        public Action<IFeatureCollection> PrepareRequest { get; set; }
     }
 }

src/Microsoft.AspNet.Server.Kestrel/Filter/NoOpConnectionFilter.cs

@@ -2,6 +2,7 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System.Threading.Tasks;
+using Microsoft.AspNet.Http.Features;
 using Microsoft.AspNet.Server.Kestrel.Infrastructure;
 
 namespace Microsoft.AspNet.Server.Kestrel.Filter

src/Microsoft.AspNet.Server.Kestrel/Http/Connection.cs

@@ -177,7 +177,7 @@ private void OnRead(UvStreamHandle handle, int status)
 
         private Frame CreateFrame()
         {
-            return new Frame(this, _remoteEndPoint, _localEndPoint);
+            return new Frame(this, _remoteEndPoint, _localEndPoint, _filterContext?.PrepareRequest);
         }
 
         void IConnectionControl.Pause()

src/Microsoft.AspNet.Server.Kestrel/Http/Frame.cs

@@ -11,6 +11,7 @@
 using System.Threading.Tasks;
 using Microsoft.AspNet.Http;
 using Microsoft.AspNet.Http.Features;
+using Microsoft.AspNet.Server.Kestrel.Filter;
 using Microsoft.AspNet.Server.Kestrel.Infrastructure;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Primitives;
@@ -55,19 +56,22 @@ public partial class Frame : FrameContext, IFrameControl
 
         private readonly IPEndPoint _localEndPoint;
         private readonly IPEndPoint _remoteEndPoint;
+        private readonly Action<IFeatureCollection> _prepareRequest;
 
         public Frame(ConnectionContext context)
-            : this(context, remoteEndPoint: null, localEndPoint: null)
+            : this(context, remoteEndPoint: null, localEndPoint: null, prepareRequest: null)
         {
         }
 
         public Frame(ConnectionContext context,
                      IPEndPoint remoteEndPoint,
-                     IPEndPoint localEndPoint)
+                     IPEndPoint localEndPoint,
+                     Action<IFeatureCollection> prepareRequest)
             : base(context)
         {
             _remoteEndPoint = remoteEndPoint;
             _localEndPoint = localEndPoint;
+            _prepareRequest = prepareRequest;
 
             FrameControl = this;
             Reset();
@@ -140,6 +144,8 @@ public void Reset()
                 httpConnectionFeature.IsLocal = false;
             }
 
+            _prepareRequest?.Invoke(this);
+
             _requestAbortCts?.Dispose();
         }