Develop Reference

Connecting from HttpClient to API behind Azure FrontDoor using TLS 1.2

Azure Front Door is configured with minimum TLS 1.2.
The backend Azure App Service is also configured to use minimum TLS 1.2.
When running the .Net Framework 4.7.1 console app with the following code on Windows Server 2012 R2:
class Program
{
static async Task Main(string[] args)
{
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
var client = new HttpClient();
try
{
var OK = await client.GetAsync("https://foo-appservice.azurewebsites.net/"); // App service.
var NotOK = await client.GetAsync("https://foo.myfoo.io/"); // Front door.
}
catch (Exception e)
{
Console.WriteLine(e);
}
Console.ReadKey();
}
}
I get the following exception on the second call.
An error occurred while sending the request.
The underlying connection was closed: An unexpected error occurred on a send.
Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.
Running this with curl from the same server works, however:
curl https://foo.myfoo.io/ -i --tlsv1.2 --tls-max 1.2
The same .net code runs fine from my other windows 10 laptop.
What can be the reason why the call fails on the windows server box?
Edit:
I think this has to do with custom domains, since performing a simple GET to the front door assigned domain works.

Turns out "someone" had disabled a lot of cipher suites on the Windows Server.
I used wireshark to look at the TLS handshake and noticed that the cipher suites listed at the Client Hello didn't match the servers.
So for anyone struggling with TLS errors, it can be worthwile to look at the TLS handshake in Wireshark!

How to use WebSocket in one server and access it in another PC in the same LAN?

When I use WebSocket server in C#, and access it in local PC, it works normally. But when I try to access with another PC, it doesn't work.
I'm using WebSocket library from Fleck.
Code in C# WebSocket Server:
_server = new Fleck.WebSocketServer("wss://127.0.0.1:8181");
_server.Certificate = new X509Certificate2(#"C:\test.com.pfx", "123");
Code in HTML/Javascript:
websocket = new WebSocket('wss://192.168.1.37:8181');
When I work with insecure WebSocket "ws://127.0.0.1:8181" when I try to access the local IP "ws://192.168.1.37:8181", it the Chrome Console sends the error:
The page at 'https://www.websocket.org/echo.html' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://192.168.1.37:8181/?encoding=text'. This request has been blocked; this endpoint must be available over WSS.
When I work with Secure WebSocket "wss://127.0.0.1:8181"
it sends the error:
WebSocket connection to 'wss://192.168.1.37:8181/?encoding=text' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED
It only works when I type "wss://127.0.0.1:8181" in WebSocket client, but I want to work with the standard IP, to be accessed by other PC.

I found the solution, here the steps if someone needs:
You need to start the Fleck WebSocket server as bellow:
_server = new Fleck.WebSocketServer("wss://0.0.0.0:8181");
_server.Certificate = new X509Certificate2(#"C:\test.com.pfx", "123");
Then in the PC that you want to access though WebSocket client, you need to access first with the browser:
https://192.168.1.37:8181
Then you allow the access. (It'll let the Certification of an Unknown User)
After that you WebSocket Client will work.

ASP core HttpClient.Get From container to localhost site is failing

Given:
Windows 10 PC With Docker (linux container format)
Local website in IIS accessable on the bare machine (no container) http://localhost/foo
ASP Core DockerContainer which wants to access HTTP GET http://localhost/foo
Problem:
All requests to http://localhost are failing
var client = new HttpClient();
var result = await client.GetAsync("http://localhost/foo");
Then I get
System.Net.Http.HttpRequestException: An error
occurred while sending the request. --->
System.Net.Http.CurlException: Couldn't connect to server
at System.Net.Http.CurlHandler.ThrowIfCURLEError(CURLcode error)
at System.Net.Http.CurlHandler.MultiAge...
Is this expected? I thought access to localhost from inside container should work.
Also other protocols like mongodb are working with localhost. So it seems to be specific to http connections form asp core?

One question before: I suppose that the server you are trying to reach is in the same container, right?
If yes:
You should be able to connect from within the container using localhost.
The problem might be that this container doesn't expose the port 80 internally. Can you check the port internal port with "docker ps"?
If no:
In that case it means that localhost is used to connect to the host. My understanding is that it should not work.

C#: Send XML over https/SSL3 with client/server certificates

I need to develop a C# client able to post XML docs into a SAP Bussiness Connector 4.6.
The Client:
.NET until 4.6, VS 2013 available, SO Win 8.1 Pro 64 bits.
The Server:
Windows 2000, with SAP Business Connector 4.6 (it's really equal to WebMethods 4.6), configured with https and Client certificate as authentication method. The server has a certificate that doesn't match the URL used in local development against it.
I'm trying several .NET methods and clients. I'm actually trying httpClient to connect with BC, without success.
The actual code is very similar to this:
try
{
System.Net.Http.HttpClient client;
//HttpClient uses the HttpMessageHandler pipeline for sending and receiving requests
//WebRequestHandler derives from HttpClientHandler but adds properties that generally only are available on full .NET
System.Net.Http.WebRequestHandler wrHandler = new System.Net.Http.WebRequestHandler();
System.Security.Cryptography.X509Certificates.X509Certificate x509cert = System.Security.Cryptography.X509Certificates.X509Certificate2.CreateFromCertFile("MyClientCertificate.crt");
wrHandler.ClientCertificates.Add(x509cert);
client = new System.Net.Http.HttpClient(wrHandler);
//THIS SKIPS SERVER CERTIFICATE
System.Net.ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
System.Net.Http.HttpRequestMessage request = new System.Net.Http.HttpRequestMessage();
request.Method = System.Net.Http.HttpMethod.Post;
request.RequestUri = new System.Uri("https://192.168.12.12:3333/invoke/wm.PartnerMgr.flows.UCLR.0000000001:ORDERS");
request.Content = new System.Net.Http.StringContent(CtrXMLToSendContent.Text, Encoding.UTF8, CtrClient1MediaType.Text);
System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Ssl3 | System.Net.SecurityProtocolType.Tls;
Task<System.Net.Http.HttpResponseMessage> taskResponse = client.SendAsync(request);
if (taskResponse.Wait(-1)) //-1 = infinite
{
//Response received
System.Net.Http.HttpResponseMessage response = taskResponse.Result;
TextResponseData.Text = response.ToString();
Task<String> taskResponseStr = response.Content.ReadAsStringAsync();
taskResponseStr.Wait();
String responseContent = taskResponseStr.Result;
TextResponseContent.Text = responseContent;
}
else
{
TextClient1Infolog.AppendText("Wait ");
}
}
catch (Exception _e)
{
TextClient1Infolog.AppendText("Error :" + Environment.NewLine);
TextClient1Infolog.AppendText(_e.ToString());
}
When I launch it, it throws an exception, giving this error:
System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.
There's no server response at all I can explore or debug. I think it's a problem of handshaking SSL protocol. I must insist: There's no response text from server, no 402 or 404 message errors at all: Nothing is received.
Firefox over that direction says no connection. IE, with TSL 1.0, 1.2 and 1.3 activated, says it cannot connect; activating SSL 3.0 and reopening page says there's a problem with server certificate (yes, because I'm accesing from local network, where certificate states for something like "this.server.com").
Fiddler4 doesn't say me much (and autocertificates appears to be confusing something), SoapUI appears to be not very useful here (haven't see way to set certificates and SSL handshakes).
Found a tool (TestSSLServer, link: http://www.bolet.org/TestSSLServer/) that gave me this info:
Supported versions: SSLv3 TLSv1.0 Deflate compression: no Supported
cipher suites (ORDER IS NOT SIGNIFICANT):
SSLv3
RSA_EXPORT_WITH_RC4_40_MD5
RSA_WITH_RC4_128_MD5
RSA_WITH_RC4_128_SHA
RSA_EXPORT_WITH_RC2_CBC_40_MD5
RSA_EXPORT_WITH_DES40_CBC_SHA
RSA_WITH_DES_CBC_SHA
RSA_WITH_3DES_EDE_CBC_SHA
(TLSv1.0: idem)
---------------------- Server certificate(s):
188659f61762af0de690bf5cb76a8554e7ff7f23: CN=my.server.com,
OU=Domain Control Validated
---------------------- Minimal encryption strength: weak encryption (40-bit) Achievable encryption strength: strong encryption
(96-bit or more) BEAST status: vulnerable CRIME status: protected
So I suppose I have to force SSL3 handshake (I think this is OK in my code), validate server certificate (too)... perhaps I must do something with client certificate.
Must I generate one for my client computer and load it? How can I generate one with one of the encriptions of the TestSSLServer's list? Wich file should be installed in what computer?
And I'm open to hear about other http clients (ServerXMLHTTP, etc) or tools able to test xml postings over xml. Any ideas about how to proceed for now?

How to ping a WebSocket server using a WampSharp Client?

I have created a WebSocket server in python using the Wamp WS. I am connecting a DotNet application containing the WampSharp client with the above mentioned WebSocket server using the following code:
DefaultWampChannelFactory channelFactory = new DefaultWampChannelFactory();
channel = channelFactory.CreateChannel(serverAddress);
channel.Open();
Now I need to ping my server from the client. When I had a look at the Wamp WS client created in Python it consisted of the sendPing(self,payload) function which would ping the server as follows:
WampClientProtocol.sendPing(self, payload)
and at server side there is a onPing function which handles the ping sent as follows:
def onPing(self, payload):
print "Recieved ping message successfully"
Thus, I would like to know whether there is any way I could ping the server from my WampSharp client?
WebSocket Server started at: 127.0.0.1:8000
Thanks in advance

There is no supported way to do this currently.
Note that WampSharp wraps WebSocket4Net's WebSocket class, which by default automatically sends a ping message every 60 seconds.
I could not find any support for manual ping send in WebSocket4Net from the WebSocket class, but maybe it exists and I missed it.
If you want, you can find a different WebSocket client library that supports manual ping send, and implement a IControlledWampConnection that wraps it (see WebSocket4NetConnection), and use the DefaultWampChannelFactory overload that specifies the IControlledWampConnection to use (see WebSocket4Net extension methods).