From 318e7414a5a5a18a7ec02af7f9acc42636ebb7dc Mon Sep 17 00:00:00 2001 From: Jan Jahoda Date: Tue, 26 Jan 2021 14:10:28 +0100 Subject: [PATCH 1/5] Randomize SNI --- .../tests/FunctionalTests/SslStreamSystemDefaultsTest.cs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs index 4136320067cd2f..0cbef315474097 100644 --- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs +++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs @@ -79,7 +79,8 @@ public async Task ClientAndServer_OneOrBothUseDefault_Ok(SslProtocols? clientPro using (X509Certificate2 serverCertificate = Configuration.Certificates.GetServerCertificate()) using (X509Certificate2 clientCertificate = Configuration.Certificates.GetClientCertificate()) { - string serverHost = serverCertificate.GetNameInfo(X509NameType.SimpleName, false); + string serverHost = Guid.NewGuid().ToString("N") + "." + serverCertificate.GetNameInfo(X509NameType.SimpleName, false); + Console.WriteLine(serverHost); var clientCertificates = new X509CertificateCollection() { clientCertificate }; await TestConfiguration.WhenAllOrAnyFailedWithTimeout( @@ -130,6 +131,7 @@ private bool ClientCertCallback(object sender, X509Certificate certificate, X509 case SslPolicyErrors.None: case SslPolicyErrors.RemoteCertificateChainErrors: case SslPolicyErrors.RemoteCertificateNameMismatch: + case SslPolicyErrors.RemoteCertificateChainErrors | SslPolicyErrors.RemoteCertificateNameMismatch: return true; case SslPolicyErrors.RemoteCertificateNotAvailable: default: From b053bb45ce10117c7e84f9dc10b45cf1d2bf8161 Mon Sep 17 00:00:00 2001 From: Jan Jahoda Date: Tue, 26 Jan 2021 14:41:16 +0100 Subject: [PATCH 2/5] remove debug message --- .../tests/FunctionalTests/SslStreamSystemDefaultsTest.cs | 1 - 1 file changed, 1 deletion(-) diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs index 0cbef315474097..7d8667983f4b29 100644 --- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs +++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs @@ -80,7 +80,6 @@ public async Task ClientAndServer_OneOrBothUseDefault_Ok(SslProtocols? clientPro using (X509Certificate2 clientCertificate = Configuration.Certificates.GetClientCertificate()) { string serverHost = Guid.NewGuid().ToString("N") + "." + serverCertificate.GetNameInfo(X509NameType.SimpleName, false); - Console.WriteLine(serverHost); var clientCertificates = new X509CertificateCollection() { clientCertificate }; await TestConfiguration.WhenAllOrAnyFailedWithTimeout( From aacabe16503e73d52b5ad124a41e9a675243af94 Mon Sep 17 00:00:00 2001 From: Jan Jahoda Date: Wed, 27 Jan 2021 16:21:33 +0100 Subject: [PATCH 3/5] Fix the http test --- .../Net/Http/HttpClientHandlerTest.SslProtocols.cs | 13 ++++++++++--- .../FunctionalTests/SslStreamSystemDefaultsTest.cs | 12 +++++++++++- 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs index b0b121d73693ab..e9193013d0a673 100644 --- a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs +++ b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs @@ -86,7 +86,7 @@ public static IEnumerable GetAsync_AllowedSSLVersion_Succeeds_MemberDa { yield return new object[] { protocol, true }; #pragma warning disable 0618 // SSL2/3 are deprecated - // On certain platforms these are completely disabled and cannot be used at all. + // On certain platforms these are completely disabled and cannot be used at all. if (protocol != SslProtocols.Ssl2 && protocol != SslProtocols.Ssl3) { yield return new object[] { protocol, false }; @@ -126,16 +126,23 @@ public async Task GetAsync_AllowedSSLVersion_Succeeds(SslProtocols acceptedProto #pragma warning restore 0618 } + client.DefaultRequestHeaders.Host = getTestSNIName(); + var options = new LoopbackServer.Options { UseSsl = true, SslProtocols = acceptedProtocol }; await LoopbackServer.CreateServerAsync(async (server, url) => { await TestHelper.WhenAllCompletedOrAnyFailed( - server.AcceptConnectionSendResponseAndCloseAsync(), - client.GetAsync(url)); + server.AcceptConnectionSendResponseAndCloseAsync(), + client.GetAsync(url)); }, options); Assert.Equal(1, count); } + + string getTestSNIName() + { + return $"{nameof(GetAsync_AllowedSSLVersion_Succeeds)}_{acceptedProtocol}_{requestOnlyThisProtocol}"; + } } public static IEnumerable SupportedSSLVersionServers() diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs index 7d8667983f4b29..9d3e95d78b8faf 100644 --- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs +++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs @@ -79,7 +79,7 @@ public async Task ClientAndServer_OneOrBothUseDefault_Ok(SslProtocols? clientPro using (X509Certificate2 serverCertificate = Configuration.Certificates.GetServerCertificate()) using (X509Certificate2 clientCertificate = Configuration.Certificates.GetClientCertificate()) { - string serverHost = Guid.NewGuid().ToString("N") + "." + serverCertificate.GetNameInfo(X509NameType.SimpleName, false); + string serverHost = getTestSNIName(); var clientCertificates = new X509CertificateCollection() { clientCertificate }; await TestConfiguration.WhenAllOrAnyFailedWithTimeout( @@ -99,6 +99,16 @@ await TestConfiguration.WhenAllOrAnyFailedWithTimeout( _clientStream.SslProtocol + " " + _clientStream.HashAlgorithm); } } + + string getTestSNIName() + { + static string ProtocolToString(SslProtocols? protocol) + { + return (protocol?.ToString() ?? "null").Replace(", ", "_"); + } + + return $"{nameof(ClientAndServer_OneOrBothUseDefault_Ok)}_{ProtocolToString(clientProtocols)}_{ProtocolToString(serverProtocols)}"; + } } [ConditionalTheory(nameof(IsNotWindows7))] From c0b24977a0f2a9fbde6280bd1ecfc32b2c1e1a9c Mon Sep 17 00:00:00 2001 From: Jan Jahoda Date: Wed, 27 Jan 2021 17:32:04 +0100 Subject: [PATCH 4/5] Add explanation comment --- .../tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs | 1 + .../tests/FunctionalTests/SslStreamSystemDefaultsTest.cs | 1 + 2 files changed, 2 insertions(+) diff --git a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs index e9193013d0a673..4412cda93bdbbc 100644 --- a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs +++ b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs @@ -126,6 +126,7 @@ public async Task GetAsync_AllowedSSLVersion_Succeeds(SslProtocols acceptedProto #pragma warning restore 0618 } + // Use a different SNI for each connection to prevent TLS 1.3 renegotiation issue: https://github.com/dotnet/runtime/issues/47378 client.DefaultRequestHeaders.Host = getTestSNIName(); var options = new LoopbackServer.Options { UseSsl = true, SslProtocols = acceptedProtocol }; diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs index 9d3e95d78b8faf..0eebb02de11815 100644 --- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs +++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs @@ -79,6 +79,7 @@ public async Task ClientAndServer_OneOrBothUseDefault_Ok(SslProtocols? clientPro using (X509Certificate2 serverCertificate = Configuration.Certificates.GetServerCertificate()) using (X509Certificate2 clientCertificate = Configuration.Certificates.GetClientCertificate()) { + // Use a different SNI for each connection to prevent TLS 1.3 renegotiation issue: https://github.com/dotnet/runtime/issues/47378 string serverHost = getTestSNIName(); var clientCertificates = new X509CertificateCollection() { clientCertificate }; From e3b0fbd686c5c93b330ada731ba27a307fb13f13 Mon Sep 17 00:00:00 2001 From: Jan Jahoda Date: Thu, 28 Jan 2021 13:28:57 +0100 Subject: [PATCH 5/5] Remove accidental indentation --- .../System/Net/Http/HttpClientHandlerTest.SslProtocols.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs index 4412cda93bdbbc..ed0563692771c1 100644 --- a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs +++ b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs @@ -133,8 +133,8 @@ public async Task GetAsync_AllowedSSLVersion_Succeeds(SslProtocols acceptedProto await LoopbackServer.CreateServerAsync(async (server, url) => { await TestHelper.WhenAllCompletedOrAnyFailed( - server.AcceptConnectionSendResponseAndCloseAsync(), - client.GetAsync(url)); + server.AcceptConnectionSendResponseAndCloseAsync(), + client.GetAsync(url)); }, options); Assert.Equal(1, count);