Skip to content

Commit 59bbb1f

Browse files
rzikmMihaZupanwfurt
authored
[Release/6.0] Backport test fixes (#68332)
* Resolve System.Net.Security.Tests.LoggingTest SkipTestException failure (#65322) * improve Tls12 detection on Windows7 (#67935) * disable Tls 1.0 and 1.1 tests on new Windows (#68083) * Don't throw from RemoteExecutor on SkipTestExceptions (#65105) * update SSL tests to deal better with disabled protocols (#65120) * update SSL tests to deal better with disabled protocols * Improve detection of Null encryption on Windows * update expectation for Mismatched protocols * update detection * wrap win32 exception * update ProtocolMismatchData sets * remove debug print * final cleanup * generate mismatch data * avoid SslProtocols.Default Co-authored-by: Miha Zupan <[email protected]> Co-authored-by: Tomas Weinfurt <[email protected]>
1 parent 31c3ba9 commit 59bbb1f

File tree

10 files changed

+155
-117
lines changed

10 files changed

+155
-117
lines changed

‎src/libraries/Common/tests/System/Net/SslProtocolSupport.cs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,10 +61,12 @@ public IEnumerator<object[]> GetEnumerator()
6161
{
6262
foreach (SslProtocols protocol in Enum.GetValues(typeof(SslProtocols)))
6363
{
64-
if (protocol != SslProtocols.None && (protocol & SupportedSslProtocols) == protocol)
64+
#pragma warning disable 0618 // SSL2/3 are deprecated
65+
if (protocol != SslProtocols.None && protocol != SslProtocols.Default && (protocol & SupportedSslProtocols) == protocol)
6566
{
6667
yield return new object[] { protocol };
6768
}
69+
#pragma warning restore 0618
6870
}
6971
}
7072

‎src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs‎

Lines changed: 34 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -339,7 +339,7 @@ private static bool GetIsInContainer()
339339
return (IsLinux && File.Exists("/.dockerenv"));
340340
}
341341

342-
private static bool GetProtocolSupportFromWindowsRegistry(SslProtocols protocol, bool defaultProtocolSupport)
342+
private static bool GetProtocolSupportFromWindowsRegistry(SslProtocols protocol, bool defaultProtocolSupport, bool disabledByDefault = false)
343343
{
344344
string registryProtocolName = protocol switch
345345
{
@@ -359,13 +359,18 @@ private static bool GetProtocolSupportFromWindowsRegistry(SslProtocols protocol,
359359
string serverKey = @$"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\{registryProtocolName}\Server";
360360

361361
object client, server;
362+
object clientDefault, serverDefault;
362363
try
363364
{
364365
client = Registry.GetValue(clientKey, "Enabled", defaultProtocolSupport ? 1 : 0);
365366
server = Registry.GetValue(serverKey, "Enabled", defaultProtocolSupport ? 1 : 0);
366-
if (client is int c && server is int s)
367+
368+
clientDefault = Registry.GetValue(clientKey, "DisabledByDefault", 1);
369+
serverDefault = Registry.GetValue(serverKey, "DisabledByDefault", 1);
370+
371+
if (client is int c && server is int s && clientDefault is int cd && serverDefault is int sd)
367372
{
368-
return c == 1 && s == 1;
373+
return (c == 1 && s == 1) && (!disabledByDefault || (cd == 0 && sd == 0));
369374
}
370375
}
371376
catch (SecurityException)
@@ -414,28 +419,35 @@ private static bool AndroidGetSslProtocolSupport(SslProtocols protocol)
414419

415420
private static bool GetTls10Support()
416421
{
417-
// on Windows, macOS, and Android TLS1.0/1.1 are supported.
422+
// on macOS and Android TLS 1.0 is supported.
418423
if (IsOSXLike || IsAndroid)
419424
{
420425
return true;
421426
}
427+
428+
// Windows depend on registry, enabled by default on all supported versions.
422429
if (IsWindows)
423430
{
424-
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls, true);
431+
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls, defaultProtocolSupport: true) && !IsWindows10Version20348OrGreater;
425432
}
426433

427434
return OpenSslGetTlsSupport(SslProtocols.Tls);
428435
}
429436

430437
private static bool GetTls11Support()
431438
{
432-
// on Windows, macOS, and Android TLS1.0/1.1 are supported.
433439
if (IsWindows)
434440
{
435-
// TLS 1.1 and 1.2 can work on Windows7 but it is not enabled by default.
436-
bool defaultProtocolSupport = !IsWindows7;
437-
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls11, defaultProtocolSupport);
441+
// TLS 1.1 can work on Windows 7 but it is disabled by default.
442+
if (IsWindows7)
443+
{
444+
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls11, defaultProtocolSupport: false, disabledByDefault: true);
445+
}
446+
447+
// It is enabled on other versions unless explicitly disabled.
448+
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls11, defaultProtocolSupport: true) && !IsWindows10Version20348OrGreater;
438449
}
450+
// on macOS and Android TLS 1.1 is supported.
439451
else if (IsOSXLike || IsAndroid)
440452
{
441453
return true;
@@ -446,9 +458,19 @@ private static bool GetTls11Support()
446458

447459
private static bool GetTls12Support()
448460
{
449-
// TLS 1.1 and 1.2 can work on Windows7 but it is not enabled by default.
450-
bool defaultProtocolSupport = !IsWindows7;
451-
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls12, defaultProtocolSupport);
461+
if (IsWindows)
462+
{
463+
// TLS 1.2 can work on Windows 7 but it is disabled by default.
464+
if (IsWindows7)
465+
{
466+
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls12, defaultProtocolSupport: false, disabledByDefault: true);
467+
}
468+
469+
// It is enabled on other versions unless explicitly disabled.
470+
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls12, defaultProtocolSupport: true);
471+
}
472+
473+
return true;
452474
}
453475

454476
private static bool GetTls13Support()

‎src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -122,16 +122,23 @@ public static SecurityStatusPal Renegotiate(ref SafeFreeCredentials? credentials
122122

123123
public static SafeFreeCredentials AcquireCredentialsHandle(SslStreamCertificateContext? certificateContext, SslProtocols protocols, EncryptionPolicy policy, bool isServer)
124124
{
125-
// New crypto API supports TLS1.3 but it does not allow to force NULL encryption.
126-
SafeFreeCredentials cred = !UseNewCryptoApi || policy == EncryptionPolicy.NoEncryption ?
127-
AcquireCredentialsHandleSchannelCred(certificateContext, protocols, policy, isServer) :
128-
AcquireCredentialsHandleSchCredentials(certificateContext, protocols, policy, isServer);
129-
if (certificateContext != null && certificateContext.Trust != null && certificateContext.Trust._sendTrustInHandshake)
125+
try
130126
{
131-
AttachCertificateStore(cred, certificateContext.Trust._store!);
132-
}
127+
// New crypto API supports TLS1.3 but it does not allow to force NULL encryption.
128+
SafeFreeCredentials cred = !UseNewCryptoApi || policy == EncryptionPolicy.NoEncryption ?
129+
AcquireCredentialsHandleSchannelCred(certificateContext, protocols, policy, isServer) :
130+
AcquireCredentialsHandleSchCredentials(certificateContext, protocols, policy, isServer);
131+
if (certificateContext != null && certificateContext.Trust != null && certificateContext.Trust._sendTrustInHandshake)
132+
{
133+
AttachCertificateStore(cred, certificateContext.Trust._store!);
134+
}
133135

134-
return cred;
136+
return cred;
137+
}
138+
catch (Win32Exception e)
139+
{
140+
throw new AuthenticationException(SR.net_auth_SSPI, e);
141+
}
135142
}
136143

137144
private static unsafe void AttachCertificateStore(SafeFreeCredentials cred, X509Store store)

‎src/libraries/System.Net.Security/tests/FunctionalTests/ClientAsyncAuthenticateTest.cs‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -69,11 +69,11 @@ public async Task ClientAsyncAuthenticate_Ssl2WithSelf_Success()
6969
[Theory]
7070
[MemberData(nameof(ProtocolMismatchData))]
7171
public async Task ClientAsyncAuthenticate_MismatchProtocols_Fails(
72-
SslProtocols serverProtocol,
7372
SslProtocols clientProtocol,
73+
SslProtocols serverProtocol,
7474
Type expectedException)
7575
{
76-
Exception e = await Record.ExceptionAsync(() => ClientAsyncSslHelper(serverProtocol, clientProtocol));
76+
Exception e = await Record.ExceptionAsync(() => ClientAsyncSslHelper(clientProtocol, serverProtocol));
7777
Assert.NotNull(e);
7878
Assert.IsAssignableFrom(expectedException, e);
7979
}
@@ -106,17 +106,19 @@ public async Task ClientAsyncAuthenticate_IndividualServerVsAllClientSupportedPr
106106

107107
public static IEnumerable<object[]> ProtocolMismatchData()
108108
{
109-
#pragma warning disable 0618
110-
yield return new object[] { SslProtocols.Ssl2, SslProtocols.Ssl3, typeof(Exception) };
111-
yield return new object[] { SslProtocols.Ssl2, SslProtocols.Tls12, typeof(Exception) };
112-
yield return new object[] { SslProtocols.Ssl3, SslProtocols.Tls12, typeof(Exception) };
113-
#pragma warning restore 0618
114-
yield return new object[] { SslProtocols.Tls, SslProtocols.Tls11, typeof(AuthenticationException) };
115-
yield return new object[] { SslProtocols.Tls, SslProtocols.Tls12, typeof(AuthenticationException) };
116-
yield return new object[] { SslProtocols.Tls11, SslProtocols.Tls, typeof(AuthenticationException) };
117-
yield return new object[] { SslProtocols.Tls12, SslProtocols.Tls, typeof(AuthenticationException) };
118-
yield return new object[] { SslProtocols.Tls12, SslProtocols.Tls11, typeof(AuthenticationException) };
119-
yield return new object[] { SslProtocols.Tls11, SslProtocols.Tls12, typeof(AuthenticationException) };
109+
var supportedProtocols = new SslProtocolSupport.SupportedSslProtocolsTestData();
110+
111+
foreach (var serverProtocols in supportedProtocols)
112+
foreach (var clientProtocols in supportedProtocols)
113+
{
114+
SslProtocols serverProtocol = (SslProtocols)serverProtocols[0];
115+
SslProtocols clientProtocol = (SslProtocols)clientProtocols[0];
116+
117+
if (clientProtocol != serverProtocol)
118+
{
119+
yield return new object[] { clientProtocol, serverProtocol, typeof(AuthenticationException) };
120+
}
121+
}
120122
}
121123

122124
#region Helpers

‎src/libraries/System.Net.Security/tests/FunctionalTests/LoggingTest.cs‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
// The .NET Foundation licenses this file to you under the MIT license.
33

44
using System.Collections.Concurrent;
5-
using System.Diagnostics;
65
using System.Diagnostics.Tracing;
76
using Microsoft.DotNet.RemoteExecutor;
87
using Microsoft.DotNet.XUnitExtensions;
@@ -25,28 +24,28 @@ public void EventSource_ExistsWithCorrectId()
2524
}
2625

2726
[ConditionalFact(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
27+
[SkipOnPlatform(TestPlatforms.iOS | TestPlatforms.tvOS, "X509 certificate store is not supported on iOS or tvOS.")] // Match SslStream_StreamToStream_Authentication_Success
2828
public void EventSource_EventsRaisedAsExpected()
2929
{
30-
if (PlatformDetection.IsWindows10Version22000OrGreater)
30+
RemoteExecutor.Invoke(async () =>
3131
{
32-
// [ActiveIssue("https://github.com/dotnet/runtime/issues/58927")]
33-
throw new SkipTestException("Unstable on Windows 11");
34-
}
35-
36-
RemoteExecutor.Invoke(() =>
37-
{
38-
using (var listener = new TestEventListener("Private.InternalDiagnostics.System.Net.Security", EventLevel.Verbose))
32+
try
3933
{
34+
using var listener = new TestEventListener("Private.InternalDiagnostics.System.Net.Security", EventLevel.Verbose);
4035
var events = new ConcurrentQueue<EventWrittenEventArgs>();
41-
listener.RunWithCallback(events.Enqueue, () =>
36+
await listener.RunWithCallbackAsync(events.Enqueue, async () =>
4237
{
4338
// Invoke tests that'll cause some events to be generated
4439
var test = new SslStreamStreamToStreamTest_Async();
45-
test.SslStream_StreamToStream_Authentication_Success().GetAwaiter().GetResult();
40+
await test.SslStream_StreamToStream_Authentication_Success();
4641
});
4742
Assert.DoesNotContain(events, ev => ev.EventId == 0); // errors from the EventSource itself
4843
Assert.InRange(events.Count, 1, int.MaxValue);
4944
}
45+
catch (SkipTestException)
46+
{
47+
// Don't throw inside RemoteExecutor if SslStream_StreamToStream_Authentication_Success chose to skip the test
48+
}
5049
}).Dispose();
5150
}
5251
}

‎src/libraries/System.Net.Security/tests/FunctionalTests/ServerAsyncAuthenticateTest.cs‎

Lines changed: 11 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ public async Task ServerAsyncAuthenticate_EachSupportedProtocol_Success(SslProto
4646
[Theory]
4747
[MemberData(nameof(ProtocolMismatchData))]
4848
public async Task ServerAsyncAuthenticate_MismatchProtocols_Fails(
49-
SslProtocols serverProtocol,
5049
SslProtocols clientProtocol,
50+
SslProtocols serverProtocol,
5151
Type expectedException)
5252
{
5353
Exception e = await Record.ExceptionAsync(
@@ -236,7 +236,7 @@ public async Task ServerAsyncAuthenticate_ConstructorVerificationDelegate_Succes
236236

237237
(Stream clientStream, Stream serverStream) = TestHelper.GetConnectedStreams();
238238
var client = new SslStream(clientStream);
239-
var server = new SslStream(serverStream, false, (sender, certificate, chain, sslPolicyErrors) => { validationCallbackCalled = true; return true;});
239+
var server = new SslStream(serverStream, false, (sender, certificate, chain, sslPolicyErrors) => { validationCallbackCalled = true; return true; });
240240

241241
using (client)
242242
using (server)
@@ -287,37 +287,18 @@ public async Task ServerAsyncAuthenticate_NoCertificate_Throws(bool useAsync)
287287

288288
public static IEnumerable<object[]> ProtocolMismatchData()
289289
{
290-
if (PlatformDetection.SupportsSsl3)
291-
{
292-
#pragma warning disable 0618
293-
yield return new object[] { SslProtocols.Ssl3, SslProtocols.Tls12, typeof(Exception) };
294-
if (PlatformDetection.SupportsSsl2)
295-
{
296-
yield return new object[] { SslProtocols.Ssl2, SslProtocols.Ssl3, typeof(Exception) };
297-
yield return new object[] { SslProtocols.Ssl2, SslProtocols.Tls12, typeof(Exception) };
298-
}
299-
#pragma warning restore 0618
300-
}
301-
302-
// It is OK if server does not support given protocol. It should still fail.
303-
// But if client does not support it, it will simply fail without sending out any data.
304-
305-
if (PlatformDetection.SupportsTls10)
306-
{
307-
yield return new object[] { SslProtocols.Tls11, SslProtocols.Tls, typeof(AuthenticationException) };
308-
yield return new object[] { SslProtocols.Tls12, SslProtocols.Tls, typeof(AuthenticationException) };
309-
}
290+
var supportedProtocols = new SslProtocolSupport.SupportedSslProtocolsTestData();
310291

311-
if (PlatformDetection.SupportsTls11)
292+
foreach (var serverProtocols in supportedProtocols)
293+
foreach (var clientProtocols in supportedProtocols)
312294
{
313-
yield return new object[] { SslProtocols.Tls, SslProtocols.Tls11, typeof(AuthenticationException) };
314-
yield return new object[] { SslProtocols.Tls12, SslProtocols.Tls11, typeof(AuthenticationException) };
315-
}
295+
SslProtocols serverProtocol = (SslProtocols)serverProtocols[0];
296+
SslProtocols clientProtocol = (SslProtocols)clientProtocols[0];
316297

317-
if (PlatformDetection.SupportsTls12)
318-
{
319-
yield return new object[] { SslProtocols.Tls, SslProtocols.Tls12, typeof(AuthenticationException) };
320-
yield return new object[] { SslProtocols.Tls11, SslProtocols.Tls12, typeof(AuthenticationException) };
298+
if (clientProtocol != serverProtocol)
299+
{
300+
yield return new object[] { clientProtocol, serverProtocol, typeof(AuthenticationException) };
301+
}
321302
}
322303
}
323304

‎src/libraries/System.Net.Security/tests/FunctionalTests/ServerNoEncryptionTest.cs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,10 @@ public async Task ServerNoEncryption_ClientNoEncryption_ConnectWithNoEncryption(
9696
else
9797
{
9898
var ae = await Assert.ThrowsAsync<AuthenticationException>(() => sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocolSupport.DefaultSslProtocols, false));
99-
Assert.IsType<PlatformNotSupportedException>(ae.InnerException);
99+
if (!OperatingSystem.IsWindows())
100+
{
101+
Assert.IsType<PlatformNotSupportedException>(ae.InnerException);
102+
}
100103
}
101104
}
102105
}

‎src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamStreamToStreamTest.cs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,6 @@ public static IEnumerable<object[]> SslStream_StreamToStream_Authentication_Succ
7272
[SkipOnPlatform(TestPlatforms.iOS | TestPlatforms.tvOS, "X509 certificate store is not supported on iOS or tvOS.")]
7373
public async Task SslStream_StreamToStream_Authentication_Success(X509Certificate serverCert = null, X509Certificate clientCert = null)
7474
{
75-
7675
if (PlatformDetection.IsWindows10Version20348OrGreater)
7776
{
7877
// [ActiveIssue("https://github.com/dotnet/runtime/issues/58927")]

0 commit comments

Comments
 (0)