From 384defcee53663908e43b82e79b7b72c5043d918 Mon Sep 17 00:00:00 2001 From: Kevin Jones Date: Tue, 20 Aug 2024 10:07:17 -0400 Subject: [PATCH 1/2] Disable explicit EC curves on SCOSSL --- .../AlgorithmImplementations/EC/ECKeyFileTests.cs | 4 +++- .../ECDiffieHellman/ECDiffieHellmanFactory.cs | 3 +++ .../ECDiffieHellman/ECDiffieHellmanTests.ImportExport.cs | 2 +- .../AlgorithmImplementations/ECDsa/ECDsaFactory.cs | 2 ++ .../AlgorithmImplementations/RSA/KeyGeneration.cs | 4 ++-- .../tests/TestUtilities/System/PlatformDetection.Unix.cs | 1 + .../tests/EcDsaOpenSslProvider.cs | 2 +- .../tests/DefaultECDiffieHellmanProvider.Unix.cs | 2 +- .../tests/DefaultECDsaProvider.Unix.cs | 2 +- 9 files changed, 15 insertions(+), 7 deletions(-) diff --git a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/EC/ECKeyFileTests.cs b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/EC/ECKeyFileTests.cs index 492c9d451329c8..1a6686c4326db3 100644 --- a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/EC/ECKeyFileTests.cs +++ b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/EC/ECKeyFileTests.cs @@ -18,7 +18,9 @@ public abstract partial class ECKeyFileTests where T : ECAlgorithm // This would need to be virtualized if there was ever a platform that // allowed explicit in ECDH or ECDSA but not the other. - public static bool SupportsExplicitCurves { get; } = EcDiffieHellman.Tests.ECDiffieHellmanFactory.ExplicitCurvesSupported; + public static bool SupportsExplicitCurves { get; } = + EcDiffieHellman.Tests.ECDiffieHellmanFactory.ExplicitCurvesSupported || + EcDiffieHellman.Tests.ECDiffieHellmanFactory.ExplicitCurvesSupportFailOnUseOnly; public static bool CanDeriveNewPublicKey { get; } = EcDiffieHellman.Tests.ECDiffieHellmanFactory.CanDeriveNewPublicKey; diff --git a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDiffieHellman/ECDiffieHellmanFactory.cs b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDiffieHellman/ECDiffieHellmanFactory.cs index 9a2de091ab3b42..d3d00c754d584e 100644 --- a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDiffieHellman/ECDiffieHellmanFactory.cs +++ b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDiffieHellman/ECDiffieHellmanFactory.cs @@ -12,6 +12,7 @@ public interface IECDiffieHellmanProvider #endif bool IsCurveValid(Oid oid); bool ExplicitCurvesSupported { get; } + bool ExplicitCurvesSupportFailOnUseOnly => PlatformDetection.IsAzureLinux; bool CanDeriveNewPublicKey { get; } bool SupportsRawDerivation { get; } bool SupportsSha3 { get; } @@ -48,5 +49,7 @@ public static bool IsCurveValid(Oid oid) public static bool SupportsRawDerivation => s_provider.SupportsRawDerivation; public static bool SupportsSha3 => s_provider.SupportsSha3; + + public static bool ExplicitCurvesSupportFailOnUseOnly => s_provider.ExplicitCurvesSupportFailOnUseOnly; } } diff --git a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDiffieHellman/ECDiffieHellmanTests.ImportExport.cs b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDiffieHellman/ECDiffieHellmanTests.ImportExport.cs index 1c507beee0d8d7..2651a538a8019f 100644 --- a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDiffieHellman/ECDiffieHellmanTests.ImportExport.cs +++ b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDiffieHellman/ECDiffieHellmanTests.ImportExport.cs @@ -319,7 +319,7 @@ public static void TestGeneralExportWithExplicitParameters() [Fact] public static void TestExplicitCurveImportOnUnsupportedPlatform() { - if (ECDiffieHellmanFactory.ExplicitCurvesSupported) + if (ECDiffieHellmanFactory.ExplicitCurvesSupported || ECDiffieHellmanFactory.ExplicitCurvesSupportFailOnUseOnly) { return; } diff --git a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDsa/ECDsaFactory.cs b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDsa/ECDsaFactory.cs index 01e5dfe6701f48..7571ec641fb718 100644 --- a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDsa/ECDsaFactory.cs +++ b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/ECDsa/ECDsaFactory.cs @@ -12,6 +12,7 @@ public interface IECDsaProvider #endif bool IsCurveValid(Oid oid); bool ExplicitCurvesSupported { get; } + bool ExplicitCurvesSupportFailOnUseOnly => PlatformDetection.IsAzureLinux; } public static partial class ECDsaFactory @@ -39,5 +40,6 @@ public static bool IsCurveValid(Oid oid) } public static bool ExplicitCurvesSupported => s_provider.ExplicitCurvesSupported; + public static bool ExplicitCurvesSupportFailOnUseOnly => s_provider.ExplicitCurvesSupportFailOnUseOnly; } } diff --git a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/KeyGeneration.cs b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/KeyGeneration.cs index ea13e350b977f9..601118c17bd01c 100644 --- a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/KeyGeneration.cs +++ b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/KeyGeneration.cs @@ -8,13 +8,13 @@ namespace System.Security.Cryptography.Rsa.Tests [SkipOnPlatform(TestPlatforms.Browser, "Not supported on Browser")] public class KeyGeneration { - [Fact] + [ConditionalFact(typeof(PlatformDetection), nameof(PlatformDetection.IsNotAzureLinux))] public static void GenerateMinKey() { GenerateKey(rsa => GetMin(rsa.LegalKeySizes)); } - [Fact] + [ConditionalFact(typeof(PlatformDetection), nameof(PlatformDetection.IsNotAzureLinux))] public static void GenerateSecondMinKey() { GenerateKey(rsa => GetSecondMin(rsa.LegalKeySizes)); diff --git a/src/libraries/Common/tests/TestUtilities/System/PlatformDetection.Unix.cs b/src/libraries/Common/tests/TestUtilities/System/PlatformDetection.Unix.cs index 9b7cc6553b0e61..8681d16fd9fb4b 100644 --- a/src/libraries/Common/tests/TestUtilities/System/PlatformDetection.Unix.cs +++ b/src/libraries/Common/tests/TestUtilities/System/PlatformDetection.Unix.cs @@ -34,6 +34,7 @@ public static partial class PlatformDetection public static bool IsNotMonoLinuxArm64 => !IsMonoLinuxArm64; public static bool IsQemuLinux => IsLinux && Environment.GetEnvironmentVariable("DOTNET_RUNNING_UNDER_QEMU") != null; public static bool IsNotQemuLinux => !IsQemuLinux; + public static bool IsNotAzureLinux => !IsAzureLinux; // OSX family public static bool IsApplePlatform => IsOSX || IsiOS || IstvOS || IsMacCatalyst; diff --git a/src/libraries/System.Security.Cryptography.OpenSsl/tests/EcDsaOpenSslProvider.cs b/src/libraries/System.Security.Cryptography.OpenSsl/tests/EcDsaOpenSslProvider.cs index aac122ce56d587..4735038ec0184c 100644 --- a/src/libraries/System.Security.Cryptography.OpenSsl/tests/EcDsaOpenSslProvider.cs +++ b/src/libraries/System.Security.Cryptography.OpenSsl/tests/EcDsaOpenSslProvider.cs @@ -50,7 +50,7 @@ public bool ExplicitCurvesSupported { get { - return true; + return !PlatformDetection.IsAzureLinux; } } } diff --git a/src/libraries/System.Security.Cryptography/tests/DefaultECDiffieHellmanProvider.Unix.cs b/src/libraries/System.Security.Cryptography/tests/DefaultECDiffieHellmanProvider.Unix.cs index 5e8aef8546006c..77c32104f2d575 100644 --- a/src/libraries/System.Security.Cryptography/tests/DefaultECDiffieHellmanProvider.Unix.cs +++ b/src/libraries/System.Security.Cryptography/tests/DefaultECDiffieHellmanProvider.Unix.cs @@ -25,7 +25,7 @@ public bool ExplicitCurvesSupported { get { - if (PlatformDetection.IsApplePlatform) + if (PlatformDetection.IsApplePlatform || PlatformDetection.IsAzureLinux) { return false; } diff --git a/src/libraries/System.Security.Cryptography/tests/DefaultECDsaProvider.Unix.cs b/src/libraries/System.Security.Cryptography/tests/DefaultECDsaProvider.Unix.cs index c2dad6c0938fdb..cec7aac4895ab5 100644 --- a/src/libraries/System.Security.Cryptography/tests/DefaultECDsaProvider.Unix.cs +++ b/src/libraries/System.Security.Cryptography/tests/DefaultECDsaProvider.Unix.cs @@ -25,7 +25,7 @@ public bool ExplicitCurvesSupported { get { - if (PlatformDetection.IsApplePlatform) + if (PlatformDetection.IsApplePlatform || PlatformDetection.IsAzureLinux) { return false; } From bd04fa88e88ac3ae03a3ea81bde0f70951d74832 Mon Sep 17 00:00:00 2001 From: Kevin Jones Date: Tue, 20 Aug 2024 10:52:42 -0400 Subject: [PATCH 2/2] Handle ChaCha-Poly being disabled --- .../tests/ChaCha20Poly1305Tests.cs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/libraries/System.Security.Cryptography/tests/ChaCha20Poly1305Tests.cs b/src/libraries/System.Security.Cryptography/tests/ChaCha20Poly1305Tests.cs index 8ec4f3bc059cac..3968505af2aeb8 100644 --- a/src/libraries/System.Security.Cryptography/tests/ChaCha20Poly1305Tests.cs +++ b/src/libraries/System.Security.Cryptography/tests/ChaCha20Poly1305Tests.cs @@ -478,6 +478,11 @@ public static void CheckIsSupported() // CryptoKit is supported on macOS 10.15+, which is our minimum target. On iOS/tvOS, it was added in 13.0 but we can expect that version in our testing environments. expectedIsSupported = true; } + else if (PlatformDetection.IsAzureLinux) + { + // Though Azure Linux uses OpenSSL, they build OpenSSL without ChaCha20-Poly1305. + expectedIsSupported = false; + } else if (PlatformDetection.OpenSslPresentOnSystem && PlatformDetection.IsOpenSslSupported) { const int OpenSslChaChaMinimumVersion = 0x1_01_00_00_F; //major_minor_fix_patch_status