PowerShell · adityapatwardhan · Nov 28, 2018 · Nov 14, 2018 · Nov 14, 2018 · Nov 15, 2018
@@ -138,7 +138,6 @@
     <Compile Remove="engine\remoting\commands\ConnectPSSession.cs" />
     <Compile Remove="engine\remoting\commands\CustomShellCommands.cs" />
     <Compile Remove="engine\remoting\commands\DisconnectPSSession.cs" />
-    <Compile Remove="engine\remoting\commands\NewPSSessionOptionCommand.cs" />
     <Compile Remove="engine\remoting\commands\ReceivePSSession.cs" />
     <Compile Remove="engine\remoting\commands\TestPSSessionConfigurationFile.cs" />
   </ItemGroup>

diff --git a/src/System.Management.Automation/engine/InitialSessionState.cs b/src/System.Management.Automation/engine/InitialSessionState.cs
@@ -5264,7 +5264,6 @@ private static void InitializeCoreCmdletsAndProviders(
                 {"Get-PSSessionCapability",           new SessionStateCmdletEntry("Get-PSSessionCapability", typeof(GetPSSessionCapabilityCommand), helpFile) },
                 {"Get-PSSessionConfiguration",        new SessionStateCmdletEntry("Get-PSSessionConfiguration", typeof(GetPSSessionConfigurationCommand), helpFile) },
                 {"New-PSSessionConfigurationFile",    new SessionStateCmdletEntry("New-PSSessionConfigurationFile", typeof(NewPSSessionConfigurationFileCommand), helpFile) },
-                {"New-PSSessionOption",               new SessionStateCmdletEntry("New-PSSessionOption", typeof(NewPSSessionOptionCommand), helpFile) },
                 {"Receive-PSSession",                 new SessionStateCmdletEntry("Receive-PSSession", typeof(ReceivePSSessionCommand), helpFile) },
                 {"Register-PSSessionConfiguration",   new SessionStateCmdletEntry("Register-PSSessionConfiguration", typeof(RegisterPSSessionConfigurationCommand), helpFile) },
                 {"Unregister-PSSessionConfiguration", new SessionStateCmdletEntry("Unregister-PSSessionConfiguration", typeof(UnregisterPSSessionConfigurationCommand), helpFile) },
@@ -5294,6 +5293,7 @@ private static void InitializeCoreCmdletsAndProviders(
                 {"New-ModuleManifest",                new SessionStateCmdletEntry("New-ModuleManifest", typeof(NewModuleManifestCommand), helpFile) },
                 {"New-PSRoleCapabilityFile",          new SessionStateCmdletEntry("New-PSRoleCapabilityFile", typeof(NewPSRoleCapabilityFileCommand), helpFile) },
                 {"New-PSSession",                     new SessionStateCmdletEntry("New-PSSession", typeof(NewPSSessionCommand), helpFile) },
+                {"New-PSSessionOption",               new SessionStateCmdletEntry("New-PSSessionOption", typeof(NewPSSessionOptionCommand), helpFile) },
                 {"New-PSTransportOption",             new SessionStateCmdletEntry("New-PSTransportOption", typeof(NewPSTransportOptionCommand), helpFile) },
                 {"Out-Default",                       new SessionStateCmdletEntry("Out-Default", typeof(OutDefaultCommand), helpFile) },
                 {"Out-Host",                          new SessionStateCmdletEntry("Out-Host", typeof(OutHostCommand), helpFile) },

@@ -20,6 +20,7 @@ public sealed class NewPSSessionOptionCommand : PSCmdlet
     {
         #region Parameters (specific to PSSessionOption)
 
+#if !UNIX
         /// <summary>
         /// The MaximumRedirection parameter enables the implicit redirection functionality
         /// -1 = no limit
@@ -178,11 +179,13 @@ public int IdleTimeout
             set { _idleTimeout = value; }
         }
         private int? _idleTimeout;
+#endif
 
         #endregion Parameters
 
         #region Parameters copied from New-WSManSessionOption
 
+#if !UNIX
         /// <summary>
         /// By default, ProxyAccessType is None, that means Proxy information (ProxyAccessType,
         /// ProxyAuthenticationMechanism and ProxyCredential)is not passed to WSMan at all.
@@ -210,6 +213,7 @@ public int IdleTimeout
         [ValidateNotNullOrEmpty]
         [Credential]
         public PSCredential ProxyCredential { get; set; }
+#endif
 
         /// <summary>
         /// The following is the definition of the input parameter "SkipCACheck".
@@ -241,6 +245,8 @@ public SwitchParameter SkipCNCheck
         }
         private bool _skipcncheck;
 
+#if !UNIX
+
         /// <summary>
         /// The following is the definition of the input parameter "SkipRevocation".
         /// Indicates that certificate common name (CN) of the server need not match the
@@ -319,6 +325,8 @@ public SwitchParameter IncludePortInSPN
         }
         private bool _includePortInSPN;
 
+#endif
+
         #endregion
 
         #region Implementation
@@ -330,11 +338,14 @@ protected override void BeginProcessing()
         {
             PSSessionOption result = new PSSessionOption();
             // Begin: WSMan specific options
+#if !UNIX
             result.ProxyAccessType = this.ProxyAccessType;
             result.ProxyAuthentication = this.ProxyAuthentication;
             result.ProxyCredential = this.ProxyCredential;
+#endif
             result.SkipCACheck = this.SkipCACheck;
             result.SkipCNCheck = this.SkipCNCheck;
+#if !UNIX
             result.SkipRevocationCheck = this.SkipRevocationCheck;
             if (_operationtimeout.HasValue)
             {
@@ -385,6 +396,7 @@ protected override void BeginProcessing()
             {
                 result.ApplicationArguments = this.ApplicationArguments;
             }
+#endif
 
             this.WriteObject(result);
         }

@@ -127,6 +127,7 @@ internal enum PSRemotingErrorId : uint
         CannotSetStdOutHandle = 822,
         CannotSetStdErrHandle = 823,
         InvalidConfigurationName = 824,
+        ConnectSkipCheckFailed = 825,
         // Error codes added to support new WSMan Fan-In Model API
         CreateSessionFailed = 851,
         CreateExFailed = 853,

@@ -1924,8 +1924,11 @@ internal static WSManReceiveDataResult UnMarshal(IntPtr unmanagedData)
                         0,
                         result1.data.binaryData.bufferLength);
                 }
+
+#if !UNIX
                 Dbg.Assert(result1.data.type == (uint)WSManDataType.WSMAN_DATA_TYPE_BINARY,
                     "ReceiveDataResult can receive only binary data");
+#endif
 
                 WSManReceiveDataResult result = new WSManReceiveDataResult();
                 result.data = dataRecvd;

@@ -1528,11 +1528,17 @@ private void Initialize(Uri connectionUri, WSManConnectionInfo connectionInfo)
             }
 
 #if UNIX
-            // explicitly disallow Basic auth over HTTP on Unix.
+            // Explicitly disallow Basic auth over HTTP on Unix.
             if (connectionInfo.AuthenticationMechanism == AuthenticationMechanism.Basic && !isSSLSpecified && connectionUri.Scheme != Uri.UriSchemeHttps)
             {
                 throw new PSRemotingTransportException(PSRemotingErrorId.ConnectFailed, RemotingErrorIdStrings.BasicAuthOverHttpNotSupported);
             }
+
+            // Allow HTTPS on Unix only if SkipCACheck and SkipCNCheck are selected, because OMI client does not support validating server certificates.
+            if (isSSLSpecified && (!connectionInfo.SkipCACheck || !connectionInfo.SkipCNCheck))
+            {
+                throw new PSRemotingTransportException(PSRemotingErrorId.ConnectSkipCheckFailed, RemotingErrorIdStrings.UnixOnlyHttpsWithoutSkipCACheckNotSupported);
+            }
 #endif
 
             if (connectionInfo.NoEncryption)

diff --git a/src/System.Management.Automation/resources/RemotingErrorIdStrings.resx b/src/System.Management.Automation/resources/RemotingErrorIdStrings.resx
@@ -1670,4 +1670,7 @@ All WinRM sessions connected to PowerShell session configurations, such as Micro
   <data name="CannotGetHostInteropTypes" xml:space="preserve">
     <value>Host system does not have the correct version of Hyper-V schema.</value>
   </data>
+  <data name="UnixOnlyHttpsWithoutSkipCACheckNotSupported" xml:space="preserve">
+    <value>HTTPS on Unix does not currently support CA or CN checks. Use the PSSessionOption -SkipCACheck and -SkipCNCheck if you are certain you trust the server you are connecting to and the network in between.</value>
+  </data>
 </root>
diff --git a/test/powershell/engine/Basic/DefaultCommands.Tests.ps1 b/test/powershell/engine/Basic/DefaultCommands.Tests.ps1
@@ -340,7 +340,7 @@ Describe "Verify approved aliases list" -Tags "CI" {
 "Cmdlet", "New-PSRoleCapabilityFile",                           ,                     $(             $CoreWindows -or $CoreUnix)
 "Cmdlet", "New-PSSession",                                      ,                     $($FullCLR -or $CoreWindows -or $CoreUnix)
 "Cmdlet", "New-PSSessionConfigurationFile",                     ,                     $($FullCLR -or $CoreWindows              )
-"Cmdlet", "New-PSSessionOption",                                ,                     $($FullCLR -or $CoreWindows              )
+"Cmdlet", "New-PSSessionOption",                                ,                     $($FullCLR -or $CoreWindows -or $CoreUnix)
 "Cmdlet", "New-PSTransportOption",                              ,                     $($FullCLR -or $CoreWindows -or $CoreUnix)
 "Cmdlet", "New-Service",                                        ,                     $($FullCLR -or $CoreWindows              )
 "Cmdlet", "New-TemporaryFile",                                  ,                     $(             $CoreWindows -or $CoreUnix)

diff --git a/test/powershell/engine/Remoting/PSSession.Tests.ps1 b/test/powershell/engine/Remoting/PSSession.Tests.ps1
@@ -0,0 +1,79 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+#
+# PSSession tests for non-Windows platforms
+#
+
+Describe "New-PSSessionOption parameters for non-Windows platforms" -Tag "CI" {
+
+    BeforeAll {
+        $originalDefaultParameterValues = $PSDefaultParameterValues.Clone()
+
+        if ($IsWindows)  {
+            $PSDefaultParameterValues['it:skip'] = $true
+        }
+    }
+
+    AfterAll {
+        $global:PSDefaultParameterValues = $originalDefaultParameterValues
+    }
+
+    It "Verifies New-PSSessionOption parameters" {
+
+        $cmdInfo = Get-Command New-PSSessionOption
+
+        $commonParameterCount = [System.Management.Automation.Internal.CommonParameters].GetProperties().Length
+        $cmdInfo.Parameters.Count | Should -Be ($commonParameterCount + 2) -Because "Only -SkipCACheck and -SkipCNCheck switch parameters are available"
+
+        { $null = $cmdInfo.ResolveParameter("SkipCACheck") } | Should -Not -Throw -Because "SkipCACheck parameter should be available"
+        { $null = $cmdInfo.ResolveParameter("SkipCNCheck") } | Should -Not -Throw -Because "SkipCNCheck parameter should be available"
+    }
+}
+
+Describe "SkipCACheck and SkipCNCheck PSSession options are required for New-PSSession on non-Windows platforms" -Tag "CI" {
+
+    BeforeAll {
+        $originalDefaultParameterValues = $PSDefaultParameterValues.Clone()
+
+        if ($IsWindows)  {
+            $PSDefaultParameterValues['it:skip'] = $true
+        }
+        else {
+            $userName = "User_$(Get-Random -Maximum 99999)"
+            $userPassword = "Password_$(Get-Random -Maximum 99999)"
+            $cred = [pscredential]::new($userName, (ConvertTo-SecureString -String $userPassword -AsPlainText -Force))
+            $soSkipCA = New-PSSessionOption -SkipCACheck
+            $soSkipCN = New-PSSessionOption -SkipCNCheck
+        }
+    }
+
+    AfterAll {
+        $global:PSDefaultParameterValues = $originalDefaultParameterValues
+    }
+
+    $testCases = @(
+        @{
+            Name = 'Verifies expected error when session options is missing'
+            ScriptBlock = { New-PSSession -cn localhost -Credential $cred -Authentication Basic -UseSSL }
+            ExpectedErrorCode = 825
+        },
+        @{
+            Name = 'Verifies expected error when SkipCACheck option is missing'
+            ScriptBlock = { New-PSSession -cn localhost -Credential $cred -Authentication Basic -UseSSl -SessionOption $soSkipCN }
+            ExpectedErrorCode = 825
+        },
+        @{
+            Name = 'Verifies expected error when SkipCNCheck option is missing'
+            ScriptBlock = { New-PSSession -cn localhost -Credential $cred -Authentication Basic -UseSSl -SessionOption $soSkipCA }
+            ExpectedErrorCode = 825
+        }
+    )
+
+    It "<Name>" -TestCases $testCases {
+        param ($scriptBlock, $expectedErrorCode)
+
+        $er = { & $scriptBlock } | Should -Throw -ErrorId 'System.Management.Automation.Remoting.PSRemotingDataStructureException,Microsoft.PowerShell.Commands.NewPSSessionCommand' -PassThru
+        $er.Exception.ErrorCode | Should -Be $expectedErrorCode
+    }
+}