Skip to content

Commit f4a452e

Browse files
authored
Update PSRP protocol to deprecate session key exchange between newer client and server (PowerShell#25774)
1 parent 5de5016 commit f4a452e

File tree

14 files changed

+173
-145
lines changed

14 files changed

+173
-145
lines changed

src/Microsoft.PowerShell.Commands.Utility/commands/utility/ImplicitRemotingCommands.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1705,7 +1705,7 @@ private void HandleHostCallReceived(object sender, RemoteDataEventArgs<RemoteHos
17051705
internal List<CommandMetadata> GetRemoteCommandMetadata(out Dictionary<string, string> alias2resolvedCommandName)
17061706
{
17071707
bool isReleaseCandidateBackcompatibilityMode =
1708-
this.Session.Runspace.GetRemoteProtocolVersion() == RemotingConstants.ProtocolVersionWin7RC;
1708+
this.Session.Runspace.GetRemoteProtocolVersion() == RemotingConstants.ProtocolVersion_2_0;
17091709

17101710
alias2resolvedCommandName = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
17111711
if ((this.CommandName == null) || (this.CommandName.Length == 0) ||

src/System.Management.Automation/engine/hostifaces/Command.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -662,7 +662,7 @@ internal PSObject ToPSObjectForRemoting(Version psRPVersion)
662662
commandAsPSObject.Properties.Add(new PSNoteProperty(RemoteDataNameStrings.MergeUnclaimedPreviousCommandResults, this.MergeUnclaimedPreviousCommandResults));
663663

664664
if (psRPVersion != null &&
665-
psRPVersion >= RemotingConstants.ProtocolVersionWin10RTM)
665+
psRPVersion >= RemotingConstants.ProtocolVersion_2_3)
666666
{
667667
// V5 merge instructions
668668
commandAsPSObject.Properties.Add(new PSNoteProperty(RemoteDataNameStrings.MergeError, MergeInstructions[(int)MergeType.Error]));
@@ -672,7 +672,7 @@ internal PSObject ToPSObjectForRemoting(Version psRPVersion)
672672
commandAsPSObject.Properties.Add(new PSNoteProperty(RemoteDataNameStrings.MergeInformation, MergeInstructions[(int)MergeType.Information]));
673673
}
674674
else if (psRPVersion != null &&
675-
psRPVersion >= RemotingConstants.ProtocolVersionWin8RTM)
675+
psRPVersion >= RemotingConstants.ProtocolVersion_2_2)
676676
{
677677
// V3 merge instructions.
678678
commandAsPSObject.Properties.Add(new PSNoteProperty(RemoteDataNameStrings.MergeError, MergeInstructions[(int)MergeType.Error]));

src/System.Management.Automation/engine/hostifaces/PowerShell.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5271,7 +5271,7 @@ private bool ServerSupportsBatchInvocation()
52715271
if (_runspace != null)
52725272
{
52735273
return _runspace.RunspaceStateInfo.State != RunspaceState.BeforeOpen &&
5274-
_runspace.GetRemoteProtocolVersion() >= RemotingConstants.ProtocolVersionWin8RTM;
5274+
_runspace.GetRemoteProtocolVersion() >= RemotingConstants.ProtocolVersion_2_2;
52755275
}
52765276

52775277
RemoteRunspacePoolInternal remoteRunspacePoolInternal = null;
@@ -5285,7 +5285,7 @@ private bool ServerSupportsBatchInvocation()
52855285
}
52865286

52875287
return remoteRunspacePoolInternal != null &&
5288-
remoteRunspacePoolInternal.PSRemotingProtocolVersion >= RemotingConstants.ProtocolVersionWin8RTM;
5288+
remoteRunspacePoolInternal.PSRemotingProtocolVersion >= RemotingConstants.ProtocolVersion_2_2;
52895289
}
52905290

52915291
/// <summary>

src/System.Management.Automation/engine/remoting/client/RemoteRunspacePoolInternal.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,7 @@ internal override bool ResetRunspaceState()
291291
// version 2.3 or greater.
292292
Version remoteProtocolVersionDeclaredByServer = PSRemotingProtocolVersion;
293293
if ((remoteProtocolVersionDeclaredByServer == null) ||
294-
(remoteProtocolVersionDeclaredByServer < RemotingConstants.ProtocolVersionWin10RTM))
294+
(remoteProtocolVersionDeclaredByServer < RemotingConstants.ProtocolVersion_2_3))
295295
{
296296
throw PSTraceSource.NewInvalidOperationException(RunspacePoolStrings.ResetRunspaceStateNotSupportedOnServer);
297297
}
@@ -733,7 +733,7 @@ internal bool CanDisconnect
733733
{
734734
// Disconnect/Connect support is currently only provided by the WSMan transport
735735
// that is running PSRP protocol version 2.2 and greater.
736-
return (remoteProtocolVersionDeclaredByServer >= RemotingConstants.ProtocolVersionWin8RTM &&
736+
return (remoteProtocolVersionDeclaredByServer >= RemotingConstants.ProtocolVersion_2_2 &&
737737
DataStructureHandler.EndpointSupportsDisconnect);
738738
}
739739

src/System.Management.Automation/engine/remoting/client/RunspaceRef.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -326,7 +326,7 @@ internal void Override(RemoteRunspace remoteRunspace, object syncObject, out boo
326326
powerShell.AddParameter("Name", new string[] { "Out-Default", "Exit-PSSession" });
327327
powerShell.Runspace = _runspaceRef.Value;
328328

329-
bool isReleaseCandidateBackcompatibilityMode = _runspaceRef.Value.GetRemoteProtocolVersion() == RemotingConstants.ProtocolVersionWin7RC;
329+
bool isReleaseCandidateBackcompatibilityMode = _runspaceRef.Value.GetRemoteProtocolVersion() == RemotingConstants.ProtocolVersion_2_0;
330330
powerShell.IsGetCommandMetadataSpecialPipeline = !isReleaseCandidateBackcompatibilityMode;
331331
int expectedNumberOfResults = isReleaseCandidateBackcompatibilityMode ? 2 : 3;
332332

src/System.Management.Automation/engine/remoting/client/clientremotesession.cs

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -505,20 +505,11 @@ private bool RunClientNegotiationAlgorithm(RemoteSessionCapability serverRemoteS
505505
_serverProtocolVersion = serverProtocolVersion;
506506
Version clientProtocolVersion = Context.ClientCapability.ProtocolVersion;
507507

508-
if (
509-
clientProtocolVersion.Equals(serverProtocolVersion)
510-
|| (clientProtocolVersion == RemotingConstants.ProtocolVersionWin7RTM &&
511-
serverProtocolVersion == RemotingConstants.ProtocolVersionWin7RC)
512-
|| (clientProtocolVersion == RemotingConstants.ProtocolVersionWin8RTM &&
513-
(serverProtocolVersion == RemotingConstants.ProtocolVersionWin7RC ||
514-
serverProtocolVersion == RemotingConstants.ProtocolVersionWin7RTM
515-
))
516-
|| (clientProtocolVersion == RemotingConstants.ProtocolVersionWin10RTM &&
517-
(serverProtocolVersion == RemotingConstants.ProtocolVersionWin7RC ||
518-
serverProtocolVersion == RemotingConstants.ProtocolVersionWin7RTM ||
519-
serverProtocolVersion == RemotingConstants.ProtocolVersionWin8RTM
520-
))
521-
)
508+
if (clientProtocolVersion == serverProtocolVersion ||
509+
serverProtocolVersion == RemotingConstants.ProtocolVersion_2_0 ||
510+
serverProtocolVersion == RemotingConstants.ProtocolVersion_2_1 ||
511+
serverProtocolVersion == RemotingConstants.ProtocolVersion_2_2 ||
512+
serverProtocolVersion == RemotingConstants.ProtocolVersion_2_3)
522513
{
523514
// passed negotiation check
524515
}

src/System.Management.Automation/engine/remoting/commands/InvokeCommandCommand.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1026,7 +1026,7 @@ protected override void BeginProcessing()
10261026
{
10271027
// In order to support foreach remoting properly ( icm | % { icm } ), the server must
10281028
// be using protocol version 2.2. Otherwise, we skip this and assume the old behavior.
1029-
if (version >= RemotingConstants.ProtocolVersionWin8RTM)
1029+
if (version >= RemotingConstants.ProtocolVersion_2_2)
10301030
{
10311031
// Suppress collection behavior
10321032
_needToCollect = false;

src/System.Management.Automation/engine/remoting/common/RemoteSessionNamedPipe.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -454,7 +454,7 @@ private static NamedPipeServerStream CreateNamedPipe(
454454
SafePipeHandle pipeHandle = NamedPipeNative.CreateNamedPipe(
455455
fullPipeName,
456456
NamedPipeNative.PIPE_ACCESS_DUPLEX | NamedPipeNative.FILE_FLAG_FIRST_PIPE_INSTANCE | NamedPipeNative.FILE_FLAG_OVERLAPPED,
457-
NamedPipeNative.PIPE_TYPE_MESSAGE | NamedPipeNative.PIPE_READMODE_MESSAGE,
457+
NamedPipeNative.PIPE_TYPE_MESSAGE | NamedPipeNative.PIPE_READMODE_MESSAGE | NamedPipeNative.PIPE_REJECT_REMOTE_CLIENTS,
458458
1,
459459
_namedPipeBufferSizeForRemoting,
460460
_namedPipeBufferSizeForRemoting,

src/System.Management.Automation/engine/remoting/common/WireDataFormat/EncodeAndDecode.cs

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,18 +76,27 @@ internal static class RemotingConstants
7676
{
7777
internal static readonly Version HostVersion = PSVersionInfo.PSVersion;
7878

79-
internal static readonly Version ProtocolVersionWin7RC = new Version(2, 0);
80-
internal static readonly Version ProtocolVersionWin7RTM = new Version(2, 1);
81-
internal static readonly Version ProtocolVersionWin8RTM = new Version(2, 2);
82-
internal static readonly Version ProtocolVersionWin10RTM = new Version(2, 3);
79+
internal static readonly Version ProtocolVersion_2_0 = new(2, 0); // Window 7 RC
80+
internal static readonly Version ProtocolVersion_2_1 = new(2, 1); // Window 7 RTM
81+
internal static readonly Version ProtocolVersion_2_2 = new(2, 2); // Window 8 RTM
82+
internal static readonly Version ProtocolVersion_2_3 = new(2, 3); // Window 10 RTM
83+
internal static readonly Version ProtocolVersion_2_4 = new(2, 4); // PowerShell 7.6
8384

8485
// Minor will be incremented for each change in PSRP client/server stack and new versions will be
8586
// forked on early major release/drop changes history.
8687
// 2.101 to 2.102 - Disconnect support as of M2
8788
// 2.102 to 2.103 - Key exchange protocol changes in M3
8889
// 2.103 to 2.2 - Final ship protocol version value, no change to protocol
8990
// 2.2 to 2.3 - Enabling informational stream
90-
internal static readonly Version ProtocolVersionCurrent = new Version(2, 3);
91+
// 2.3 to 2.4 - Deprecate the 'Session_Key' exchange. The following messages are obsolete when both server and client are v2.4+:
92+
// - PUBLIC_KEY
93+
// - PUBLIC_KEY_REQUEST
94+
// - ENCRYPTED_SESSION_KEY
95+
// The padding algorithm 'RSAEncryptionPadding.Pkcs1' used in the 'Session_Key' exchange is NOT secure, and therefore,
96+
// PSRP needs to be used on top of a secure transport and the 'Session_Key' doesn't add any extra security.
97+
// So, we decided to deprecate the 'Session_Key' exchange in PSRP and skip encryption and decryption for 'SecureString'
98+
// objects. Instead, we require the transport to be secure for secure data transfer between PSRP clients and servers.
99+
internal static readonly Version ProtocolVersionCurrent = new(2, 4);
91100
internal static readonly Version ProtocolVersion = ProtocolVersionCurrent;
92101
// Used by remoting commands to add remoting specific note properties.
93102
internal static readonly string ComputerNameNoteProperty = "PSComputerName";
@@ -2158,7 +2167,7 @@ internal static bool ServerSupportsBatchInvocation(Runspace runspace)
21582167
return false;
21592168
}
21602169

2161-
return (runspace.GetRemoteProtocolVersion() >= RemotingConstants.ProtocolVersionWin8RTM);
2170+
return (runspace.GetRemoteProtocolVersion() >= RemotingConstants.ProtocolVersion_2_2);
21622171
}
21632172
}
21642173
}

src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1258,7 +1258,7 @@ public override void CloseAsync()
12581258
/// <param name="serverProtocolVersion">Server negotiated protocol version.</param>
12591259
internal void AdjustForProtocolVariations(Version serverProtocolVersion)
12601260
{
1261-
if (serverProtocolVersion <= RemotingConstants.ProtocolVersionWin7RTM)
1261+
if (serverProtocolVersion <= RemotingConstants.ProtocolVersion_2_1)
12621262
{
12631263
int maxEnvSize;
12641264
WSManNativeApi.WSManGetSessionOptionAsDword(_wsManSessionHandle,

0 commit comments

Comments
 (0)