Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support getting cert check options from PowerShell SessionOption #15

Merged
merged 3 commits into from
Oct 16, 2020

Conversation

jborean93
Copy link
Owner

PowerShell/PowerShell#13577 has more details on the background of this issue but there are 2 issues with cert verification with WSMan endpoints

  • PowerShell requires you to set -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck)
    • This is because the builtin OMI client did not do any cert verification and they wanted the callers to be aware of this fact
  • Since v1.2.0 of this fork, certificate validation was enabled by default regardless of the -SessionOption value from PowerShell
    • The only way to opt out of this was through a global env var
    • This env var could not be set per session and required PInvoke to call setenv directly due to .NET's handling of env vars on non-Windows hosts

What this PR does is

  • Plumb in the logic for handling WSManSetSessionOption() for both the CA and CN skip options in psrpclient
  • Change OMI to use these options, if present, when setting up the verification work
  • Expose a way for PowerShell to check if the underlying libs support cert verification without any breaking changes

The first two will allow the -SkipC*Check options to pass down and actually work once PowerShell removes the hardcoded check. The last fix gives PowerShell a way to remove that hardcoded check when it knows the client supports certificate verification.

Ultimately this will allow an end user of this fork the ability to connect to a WSMan listener and feel secure that the proper verification work is in place but also allow them to disable those checks using the proper PowerShell way like they can do on Windows.

@jborean93
Copy link
Owner Author

PowerShell/PowerShell#13786 contains the proposed PowerShell changes that will drop the hardcoded skip checks if possible.

@jborean93 jborean93 merged commit 4a7e3a3 into main Oct 16, 2020
@jborean93 jborean93 deleted the cert-checks branch October 16, 2020 23:01
jborean93 added a commit that referenced this pull request Oct 4, 2021
* Support getting cert check options from PowerShell
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant