Skip to content

Commit 36a79fc

Browse files
wfurtwfurt
authored
update SSL tests to deal better with disabled protocols (#65120)
* update SSL tests to deal better with disabled protocols * Improve detection of Null encryption on Windows * update expectation for Mismatched protocols * update detection * wrap win32 exception * update ProtocolMismatchData sets * remove debug print * final cleanup * generate mismatch data * avoid SslProtocols.Default
1 parent 50b4abb commit 36a79fc

File tree

7 files changed

+64
-55
lines changed

7 files changed

+64
-55
lines changed

‎src/libraries/Common/tests/System/Net/SslProtocolSupport.cs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,10 +61,12 @@ public IEnumerator<object[]> GetEnumerator()
6161
{
6262
foreach (SslProtocols protocol in Enum.GetValues(typeof(SslProtocols)))
6363
{
64-
if (protocol != SslProtocols.None && (protocol & SupportedSslProtocols) == protocol)
64+
#pragma warning disable 0618 // SSL2/3 are deprecated
65+
if (protocol != SslProtocols.None && protocol != SslProtocols.Default && (protocol & SupportedSslProtocols) == protocol)
6566
{
6667
yield return new object[] { protocol };
6768
}
69+
#pragma warning restore 0618
6870
}
6971
}
7072

‎src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -140,16 +140,23 @@ public static SecurityStatusPal Renegotiate(
140140

141141
public static SafeFreeCredentials AcquireCredentialsHandle(SslStreamCertificateContext? certificateContext, SslProtocols protocols, EncryptionPolicy policy, bool isServer)
142142
{
143-
// New crypto API supports TLS1.3 but it does not allow to force NULL encryption.
144-
SafeFreeCredentials cred = !UseNewCryptoApi || policy == EncryptionPolicy.NoEncryption ?
145-
AcquireCredentialsHandleSchannelCred(certificateContext, protocols, policy, isServer) :
146-
AcquireCredentialsHandleSchCredentials(certificateContext, protocols, policy, isServer);
147-
if (certificateContext != null && certificateContext.Trust != null && certificateContext.Trust._sendTrustInHandshake)
143+
try
148144
{
149-
AttachCertificateStore(cred, certificateContext.Trust._store!);
150-
}
145+
// New crypto API supports TLS1.3 but it does not allow to force NULL encryption.
146+
SafeFreeCredentials cred = !UseNewCryptoApi || policy == EncryptionPolicy.NoEncryption ?
147+
AcquireCredentialsHandleSchannelCred(certificateContext, protocols, policy, isServer) :
148+
AcquireCredentialsHandleSchCredentials(certificateContext, protocols, policy, isServer);
149+
if (certificateContext != null && certificateContext.Trust != null && certificateContext.Trust._sendTrustInHandshake)
150+
{
151+
AttachCertificateStore(cred, certificateContext.Trust._store!);
152+
}
151153

152-
return cred;
154+
return cred;
155+
}
156+
catch (Win32Exception e)
157+
{
158+
throw new AuthenticationException(SR.net_auth_SSPI, e);
159+
}
153160
}
154161

155162
private static unsafe void AttachCertificateStore(SafeFreeCredentials cred, X509Store store)

‎src/libraries/System.Net.Security/tests/FunctionalTests/ClientAsyncAuthenticateTest.cs‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,11 @@ public async Task ClientAsyncAuthenticate_EachSupportedProtocol_Success(SslProto
5555
[Theory]
5656
[MemberData(nameof(ProtocolMismatchData))]
5757
public async Task ClientAsyncAuthenticate_MismatchProtocols_Fails(
58-
SslProtocols serverProtocol,
5958
SslProtocols clientProtocol,
59+
SslProtocols serverProtocol,
6060
Type expectedException)
6161
{
62-
Exception e = await Record.ExceptionAsync(() => ClientAsyncSslHelper(serverProtocol, clientProtocol));
62+
Exception e = await Record.ExceptionAsync(() => ClientAsyncSslHelper(clientProtocol, serverProtocol));
6363
Assert.NotNull(e);
6464
Assert.IsAssignableFrom(expectedException, e);
6565
}
@@ -92,17 +92,19 @@ public async Task ClientAsyncAuthenticate_IndividualServerVsAllClientSupportedPr
9292

9393
public static IEnumerable<object[]> ProtocolMismatchData()
9494
{
95-
#pragma warning disable 0618
96-
yield return new object[] { SslProtocols.Ssl2, SslProtocols.Ssl3, typeof(Exception) };
97-
yield return new object[] { SslProtocols.Ssl2, SslProtocols.Tls12, typeof(Exception) };
98-
yield return new object[] { SslProtocols.Ssl3, SslProtocols.Tls12, typeof(Exception) };
99-
#pragma warning restore 0618
100-
yield return new object[] { SslProtocols.Tls, SslProtocols.Tls11, typeof(AuthenticationException) };
101-
yield return new object[] { SslProtocols.Tls, SslProtocols.Tls12, typeof(AuthenticationException) };
102-
yield return new object[] { SslProtocols.Tls11, SslProtocols.Tls, typeof(AuthenticationException) };
103-
yield return new object[] { SslProtocols.Tls12, SslProtocols.Tls, typeof(AuthenticationException) };
104-
yield return new object[] { SslProtocols.Tls12, SslProtocols.Tls11, typeof(AuthenticationException) };
105-
yield return new object[] { SslProtocols.Tls11, SslProtocols.Tls12, typeof(AuthenticationException) };
95+
var supportedProtocols = new SslProtocolSupport.SupportedSslProtocolsTestData();
96+
97+
foreach (var serverProtocols in supportedProtocols)
98+
foreach (var clientProtocols in supportedProtocols)
99+
{
100+
SslProtocols serverProtocol = (SslProtocols)serverProtocols[0];
101+
SslProtocols clientProtocol = (SslProtocols)clientProtocols[0];
102+
103+
if (clientProtocol != serverProtocol)
104+
{
105+
yield return new object[] { clientProtocol, serverProtocol, typeof(AuthenticationException) };
106+
}
107+
}
106108
}
107109

108110
#region Helpers

‎src/libraries/System.Net.Security/tests/FunctionalTests/LoggingTest.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ public void EventSource_ExistsWithCorrectId()
2727
[SkipOnPlatform(TestPlatforms.iOS | TestPlatforms.tvOS, "X509 certificate store is not supported on iOS or tvOS.")] // Match SslStream_StreamToStream_Authentication_Success
2828
public void EventSource_EventsRaisedAsExpected()
2929
{
30-
RemoteExecutor.Invoke(async () =>
30+
RemoteExecutor.Invoke(async () =>
3131
{
3232
try
3333
{

‎src/libraries/System.Net.Security/tests/FunctionalTests/ServerAsyncAuthenticateTest.cs‎

Lines changed: 11 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ public async Task ServerAsyncAuthenticate_EachSupportedProtocol_Success(SslProto
4646
[Theory]
4747
[MemberData(nameof(ProtocolMismatchData))]
4848
public async Task ServerAsyncAuthenticate_MismatchProtocols_Fails(
49-
SslProtocols serverProtocol,
5049
SslProtocols clientProtocol,
50+
SslProtocols serverProtocol,
5151
Type expectedException)
5252
{
5353
Exception e = await Record.ExceptionAsync(
@@ -236,7 +236,7 @@ public async Task ServerAsyncAuthenticate_ConstructorVerificationDelegate_Succes
236236

237237
(Stream clientStream, Stream serverStream) = TestHelper.GetConnectedStreams();
238238
var client = new SslStream(clientStream);
239-
var server = new SslStream(serverStream, false, (sender, certificate, chain, sslPolicyErrors) => { validationCallbackCalled = true; return true;});
239+
var server = new SslStream(serverStream, false, (sender, certificate, chain, sslPolicyErrors) => { validationCallbackCalled = true; return true; });
240240

241241
using (client)
242242
using (server)
@@ -323,37 +323,18 @@ public async Task ServerAsyncAuthenticate_InvalidHello_Throws(bool close)
323323

324324
public static IEnumerable<object[]> ProtocolMismatchData()
325325
{
326-
if (PlatformDetection.SupportsSsl3)
327-
{
328-
#pragma warning disable 0618
329-
yield return new object[] { SslProtocols.Ssl3, SslProtocols.Tls12, typeof(Exception) };
330-
if (PlatformDetection.SupportsSsl2)
331-
{
332-
yield return new object[] { SslProtocols.Ssl2, SslProtocols.Ssl3, typeof(Exception) };
333-
yield return new object[] { SslProtocols.Ssl2, SslProtocols.Tls12, typeof(Exception) };
334-
}
335-
#pragma warning restore 0618
336-
}
337-
338-
// It is OK if server does not support given protocol. It should still fail.
339-
// But if client does not support it, it will simply fail without sending out any data.
340-
341-
if (PlatformDetection.SupportsTls10)
342-
{
343-
yield return new object[] { SslProtocols.Tls11, SslProtocols.Tls, typeof(AuthenticationException) };
344-
yield return new object[] { SslProtocols.Tls12, SslProtocols.Tls, typeof(AuthenticationException) };
345-
}
326+
var supportedProtocols = new SslProtocolSupport.SupportedSslProtocolsTestData();
346327

347-
if (PlatformDetection.SupportsTls11)
328+
foreach (var serverProtocols in supportedProtocols)
329+
foreach (var clientProtocols in supportedProtocols)
348330
{
349-
yield return new object[] { SslProtocols.Tls, SslProtocols.Tls11, typeof(AuthenticationException) };
350-
yield return new object[] { SslProtocols.Tls12, SslProtocols.Tls11, typeof(AuthenticationException) };
351-
}
331+
SslProtocols serverProtocol = (SslProtocols)serverProtocols[0];
332+
SslProtocols clientProtocol = (SslProtocols)clientProtocols[0];
352333

353-
if (PlatformDetection.SupportsTls12)
354-
{
355-
yield return new object[] { SslProtocols.Tls, SslProtocols.Tls12, typeof(AuthenticationException) };
356-
yield return new object[] { SslProtocols.Tls11, SslProtocols.Tls12, typeof(AuthenticationException) };
334+
if (clientProtocol != serverProtocol)
335+
{
336+
yield return new object[] { clientProtocol, serverProtocol, typeof(AuthenticationException) };
337+
}
357338
}
358339
}
359340

‎src/libraries/System.Net.Security/tests/FunctionalTests/ServerNoEncryptionTest.cs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,10 @@ public async Task ServerNoEncryption_ClientNoEncryption_ConnectWithNoEncryption(
9696
else
9797
{
9898
var ae = await Assert.ThrowsAsync<AuthenticationException>(() => sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocolSupport.DefaultSslProtocols, false));
99-
Assert.IsType<PlatformNotSupportedException>(ae.InnerException);
99+
if (!OperatingSystem.IsWindows())
100+
{
101+
Assert.IsType<PlatformNotSupportedException>(ae.InnerException);
102+
}
100103
}
101104
}
102105
}

‎src/libraries/System.Net.Security/tests/FunctionalTests/TestConfiguration.cs‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,21 @@ public static Task WhenAllOrAnyFailedWithTimeout(params Task[] tasks)
3838
// On Windows, null ciphers (no encryption) are supported.
3939
if (OperatingSystem.IsWindows())
4040
{
41-
return true;
41+
if (!PlatformDetection.IsWindows10OrLater)
42+
{
43+
// All old versions support null encryption
44+
return true;
45+
}
46+
47+
try
48+
{
49+
// New Windows can support null but it may be disabled in Azure images
50+
using (Process p = Process.Start(new ProcessStartInfo("powershell", "-Command Get-TlsCipherSuite") { RedirectStandardOutput = true, RedirectStandardError = true }))
51+
{
52+
return p.StandardOutput.ReadToEnd().Contains("WITH_NULL");
53+
}
54+
}
55+
catch { return true; } // assume availability
4256
}
4357

4458
// On macOS and Android, the null cipher (no encryption) is not supported.

0 commit comments

Comments
 (0)