From 0159a219320ee79b15eeba110847ae0a3d1b8a1c Mon Sep 17 00:00:00 2001 From: Jordan Borean Date: Thu, 15 Oct 2020 22:01:54 +1000 Subject: [PATCH 1/5] Add further SSL verification checks for WSMan --- .../engine/remoting/fanin/WSManNativeAPI.cs | 2 +- .../engine/remoting/fanin/WSManTransportManager.cs | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs b/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs index 1b1fe2b2163..e2d00e9063b 100644 --- a/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs +++ b/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs @@ -2445,7 +2445,7 @@ internal static extern int WSManSetSessionOption(IntPtr wsManSessionHandle, /// /// [DllImport(WSManNativeApi.WSManClientApiDll, SetLastError = false, CharSet = CharSet.Unicode)] - internal static extern void WSManGetSessionOptionAsDword(IntPtr wsManSessionHandle, + internal static extern int WSManGetSessionOptionAsDword(IntPtr wsManSessionHandle, WSManSessionOption option, out int value); diff --git a/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs b/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs index 1fad7ccb3e8..6faac212923 100644 --- a/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs +++ b/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs @@ -1546,8 +1546,14 @@ private void Initialize(Uri connectionUri, WSManConnectionInfo connectionInfo) throw new PSRemotingTransportException(PSRemotingErrorId.ConnectFailed, RemotingErrorIdStrings.BasicAuthOverHttpNotSupported); } - // Allow HTTPS on Unix only if SkipCACheck and SkipCNCheck are selected, because OMI client does not support validating server certificates. - if (isSSLSpecified && (!connectionInfo.SkipCACheck || !connectionInfo.SkipCNCheck)) + // The OMI client distributed with PowerShell does not support validating server certificates. Check if + // psrpclient supports the CA check to determine if a custom build of psrpclient and mi are present which + // do support verification. If WSManGetSessionOptionAsDword does not return 0 then it's not supported. + int sslResult; + bool verificationAvailable = WSManNativeApi.WSManGetSessionOptionAsDword(_wsManSessionHandle, + WSManNativeApi.WSManSessionOption.WSMAN_OPTION_SKIP_CA_CHECK, out sslResult) == 0; + + if (isSSLSpecified && !verificationAvailable && (!connectionInfo.SkipCACheck || !connectionInfo.SkipCNCheck)) { throw new PSRemotingTransportException(PSRemotingErrorId.ConnectSkipCheckFailed, RemotingErrorIdStrings.UnixOnlyHttpsWithoutSkipCACheckNotSupported); } From 565c9b76f2464d8e447a6604039987055ef63f90 Mon Sep 17 00:00:00 2001 From: Jordan Borean Date: Thu, 15 Oct 2020 22:18:35 +1000 Subject: [PATCH 2/5] Document return value --- .../engine/remoting/fanin/WSManNativeAPI.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs b/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs index e2d00e9063b..a6c91e1c348 100644 --- a/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs +++ b/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs @@ -2443,7 +2443,7 @@ internal static extern int WSManSetSessionOption(IntPtr wsManSessionHandle, /// /// An int (DWORD) data. /// - /// + /// zero on success, otherwise the error code [DllImport(WSManNativeApi.WSManClientApiDll, SetLastError = false, CharSet = CharSet.Unicode)] internal static extern int WSManGetSessionOptionAsDword(IntPtr wsManSessionHandle, WSManSessionOption option, From 00e35abd49c1a72c721bd9cfb11c240573730dbb Mon Sep 17 00:00:00 2001 From: Jordan Borean Date: Fri, 16 Oct 2020 04:58:30 +1000 Subject: [PATCH 3/5] Simplify code based on review --- .../engine/remoting/fanin/WSManTransportManager.cs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs b/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs index 6faac212923..232153e4e86 100644 --- a/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs +++ b/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs @@ -1549,9 +1549,8 @@ private void Initialize(Uri connectionUri, WSManConnectionInfo connectionInfo) // The OMI client distributed with PowerShell does not support validating server certificates. Check if // psrpclient supports the CA check to determine if a custom build of psrpclient and mi are present which // do support verification. If WSManGetSessionOptionAsDword does not return 0 then it's not supported. - int sslResult; bool verificationAvailable = WSManNativeApi.WSManGetSessionOptionAsDword(_wsManSessionHandle, - WSManNativeApi.WSManSessionOption.WSMAN_OPTION_SKIP_CA_CHECK, out sslResult) == 0; + WSManNativeApi.WSManSessionOption.WSMAN_OPTION_SKIP_CA_CHECK, out _) == 0; if (isSSLSpecified && !verificationAvailable && (!connectionInfo.SkipCACheck || !connectionInfo.SkipCNCheck)) { From 639050b02d5474df02716f55d19e788b9ebab8be Mon Sep 17 00:00:00 2001 From: Jordan Borean Date: Fri, 16 Oct 2020 05:01:17 +1000 Subject: [PATCH 4/5] Fix more linting issues --- .../engine/remoting/fanin/WSManNativeAPI.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs b/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs index a6c91e1c348..b46c13b5ea0 100644 --- a/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs +++ b/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs @@ -2443,7 +2443,7 @@ internal static extern int WSManSetSessionOption(IntPtr wsManSessionHandle, /// /// An int (DWORD) data. /// - /// zero on success, otherwise the error code + /// Zero on success, otherwise the error code. [DllImport(WSManNativeApi.WSManClientApiDll, SetLastError = false, CharSet = CharSet.Unicode)] internal static extern int WSManGetSessionOptionAsDword(IntPtr wsManSessionHandle, WSManSessionOption option, From 87cfdd1d3da16812710f0aa7cf5908f38d2194ae Mon Sep 17 00:00:00 2001 From: Jordan Borean Date: Fri, 16 Oct 2020 15:43:04 +1000 Subject: [PATCH 5/5] Update src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs Co-authored-by: Ilya --- .../engine/remoting/fanin/WSManTransportManager.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs b/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs index 232153e4e86..9be3d79a9e3 100644 --- a/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs +++ b/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs @@ -1546,9 +1546,9 @@ private void Initialize(Uri connectionUri, WSManConnectionInfo connectionInfo) throw new PSRemotingTransportException(PSRemotingErrorId.ConnectFailed, RemotingErrorIdStrings.BasicAuthOverHttpNotSupported); } - // The OMI client distributed with PowerShell does not support validating server certificates. Check if - // psrpclient supports the CA check to determine if a custom build of psrpclient and mi are present which - // do support verification. If WSManGetSessionOptionAsDword does not return 0 then it's not supported. + // The OMI client distributed with PowerShell does not support validating server certificates on Unix. + // Check if third-party psrpclient and MI support the verification. + // If WSManGetSessionOptionAsDword does not return 0 then it's not supported. bool verificationAvailable = WSManNativeApi.WSManGetSessionOptionAsDword(_wsManSessionHandle, WSManNativeApi.WSManSessionOption.WSMAN_OPTION_SKIP_CA_CHECK, out _) == 0;