Skip to content

Commit 32bc9e9

Browse files
dotnet-botdotnet-bot
committed
Merge in 'release/6.0' changes
2 parents 7c2d8f8 + a4daad6 commit 32bc9e9

File tree

27 files changed

+670
-77
lines changed

27 files changed

+670
-77
lines changed

‎eng/pipelines/common/restore-internal-tools.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
steps:
2-
- task: NuGetAuthenticate@0
2+
- task: NuGetAuthenticate@1
33
inputs:
44
nuGetServiceConnections: 'devdiv/dotnet-core-internal-tooling'
55
forceReinstallCredentialProvider: true

‎eng/pipelines/installer/jobs/base-job.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,7 @@ jobs:
344344
displayName: Clean up old artifacts owned by root
345345
346346
- ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
347-
- task: NuGetAuthenticate@0
347+
- task: NuGetAuthenticate@1
348348

349349
- ${{ if eq(parameters.osGroup, 'windows') }}:
350350
# NuGet's http cache lasts 30 minutes. If we're on a static machine, this may interfere with

‎eng/pipelines/official/jobs/prepare-signed-artifacts.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
fetchDepth: 20
2727

2828
- ${{ if eq(parameters.isOfficialBuild, true) }}:
29-
- task: NuGetAuthenticate@0
29+
- task: NuGetAuthenticate@1
3030

3131
- task: MicroBuildSigningPlugin@2
3232
displayName: Install MicroBuild plugin for Signing

‎eng/pipelines/runtime.yml

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -492,40 +492,40 @@ jobs:
492492
#
493493
# Build the whole product using Mono for Android and run runtime tests with Android emulator
494494
#
495-
- template: /eng/pipelines/common/platform-matrix.yml
496-
parameters:
497-
jobTemplate: /eng/pipelines/common/global-build-job.yml
498-
helixQueuesTemplate: /eng/pipelines/coreclr/templates/helix-queues-setup.yml
499-
buildConfig: Release
500-
runtimeFlavor: mono
501-
platforms:
502-
- Android_x64
503-
variables:
504-
- ${{ if and(eq(variables['System.TeamProject'], 'public'), eq(variables['Build.Reason'], 'PullRequest')) }}:
505-
- name: _HelixSource
506-
value: pr/dotnet/runtime/$(Build.SourceBranch)
507-
- ${{ if and(eq(variables['System.TeamProject'], 'public'), ne(variables['Build.Reason'], 'PullRequest')) }}:
508-
- name: _HelixSource
509-
value: ci/dotnet/runtime/$(Build.SourceBranch)
510-
- name: timeoutPerTestInMinutes
511-
value: 60
512-
- name: timeoutPerTestCollectionInMinutes
513-
value: 180
514-
jobParameters:
515-
testGroup: innerloop
516-
nameSuffix: AllSubsets_Mono_RuntimeTests
517-
buildArgs: -s mono+libs -c $(_BuildConfig)
518-
timeoutInMinutes: 240
519-
condition: >-
520-
or(
521-
eq(dependencies.evaluate_paths.outputs['SetPathVars_runtimetests.containsChange'], true),
522-
eq(dependencies.evaluate_paths.outputs['SetPathVars_mono.containsChange'], true),
523-
eq(variables['isFullMatrix'], true))
524-
# extra steps, run tests
525-
extraStepsTemplate: /eng/pipelines/common/templates/runtimes/android-runtime-and-send-to-helix.yml
526-
extraStepsParameters:
527-
creator: dotnet-bot
528-
testRunNamePrefixSuffix: Mono_$(_BuildConfig)
495+
#- template: /eng/pipelines/common/platform-matrix.yml
496+
# parameters:
497+
# jobTemplate: /eng/pipelines/common/global-build-job.yml
498+
# helixQueuesTemplate: /eng/pipelines/coreclr/templates/helix-queues-setup.yml
499+
# buildConfig: Release
500+
# runtimeFlavor: mono
501+
# platforms:
502+
# - Android_x64
503+
# variables:
504+
# - ${{ if and(eq(variables['System.TeamProject'], 'public'), eq(variables['Build.Reason'], 'PullRequest')) }}:
505+
# - name: _HelixSource
506+
# value: pr/dotnet/runtime/$(Build.SourceBranch)
507+
# - ${{ if and(eq(variables['System.TeamProject'], 'public'), ne(variables['Build.Reason'], 'PullRequest')) }}:
508+
# - name: _HelixSource
509+
# value: ci/dotnet/runtime/$(Build.SourceBranch)
510+
# - name: timeoutPerTestInMinutes
511+
# value: 60
512+
# - name: timeoutPerTestCollectionInMinutes
513+
# value: 180
514+
# jobParameters:
515+
# testGroup: innerloop
516+
# nameSuffix: AllSubsets_Mono_RuntimeTests
517+
# buildArgs: -s mono+libs -c $(_BuildConfig)
518+
# timeoutInMinutes: 240
519+
# condition: >-
520+
# or(
521+
# eq(dependencies.evaluate_paths.outputs['SetPathVars_runtimetests.containsChange'], true),
522+
# eq(dependencies.evaluate_paths.outputs['SetPathVars_mono.containsChange'], true),
523+
# eq(variables['isFullMatrix'], true))
524+
# # extra steps, run tests
525+
# extraStepsTemplate: /eng/pipelines/common/templates/runtimes/android-runtime-and-send-to-helix.yml
526+
# extraStepsParameters:
527+
# creator: dotnet-bot
528+
# testRunNamePrefixSuffix: Mono_$(_BuildConfig)
529529

530530
#
531531
# Build Mono and Installer on LLVMJIT mode

‎eng/testing/performance/performance-setup.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ if ($Internal) {
4848
"perftiger_crossgen" { $Queue = "Windows.10.Amd64.19H1.Tiger.Perf" }
4949
"perfowl" { $Queue = "Windows.10.Amd64.20H2.Owl.Perf" }
5050
"perfsurf" { $Queue = "Windows.10.Arm64.Perf.Surf" }
51-
"perfpixel4a" { $Queue = "Windows.10.Amd64.Pixel.Perf" }
51+
"perfpixel4a" { $Queue = "Windows.11.Amd64.Pixel.Perf" }
5252
Default { $Queue = "Windows.10.Amd64.19H1.Tiger.Perf" }
5353
}
5454
$PerfLabArguments = "--upload-to-perflab-container"

‎src/libraries/Common/src/Interop/Android/System.Security.Cryptography.Native.Android/Interop.Ssl.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,10 @@ internal static void SSLStreamSetTargetHost(
8787
throw new SslException();
8888
}
8989

90+
[DllImport(Interop.Libraries.AndroidCryptoNative, EntryPoint = "AndroidCryptoNative_SSLStreamIsLocalCertificateUsed")]
91+
[return: MarshalAs(UnmanagedType.U1)]
92+
internal static extern bool SSLStreamIsLocalCertificateUsed(SafeSslHandle sslHandle);
93+
9094
[DllImport(Interop.Libraries.AndroidCryptoNative, EntryPoint = "AndroidCryptoNative_SSLStreamRequestClientAuthentication")]
9195
internal static extern void SSLStreamRequestClientAuthentication(SafeSslHandle sslHandle);
9296

‎src/libraries/Common/src/Interop/Windows/SspiCli/Interop.SSPI.cs

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,10 @@ internal enum ContextAttribute
6767
SECPKG_ATTR_ISSUER_LIST_EX = 0x59, // returns SecPkgContext_IssuerListInfoEx
6868
SECPKG_ATTR_CLIENT_CERT_POLICY = 0x60, // sets SecPkgCred_ClientCertCtlPolicy
6969
SECPKG_ATTR_CONNECTION_INFO = 0x5A, // returns SecPkgContext_ConnectionInfo
70+
SECPKG_ATTR_SESSION_INFO = 0x5D, // sets SecPkgContext_SessionInfo
7071
SECPKG_ATTR_CIPHER_INFO = 0x64, // returns SecPkgContext_CipherInfo
71-
SECPKG_ATTR_UI_INFO = 0x68, // sets SEcPkgContext_UiInfo
72+
SECPKG_ATTR_REMOTE_CERT_CHAIN = 0x67, // returns PCCERT_CONTEXT
73+
SECPKG_ATTR_UI_INFO = 0x68, // sets SEcPkgContext_UiInfo
7274
}
7375

7476
// These values are defined within sspi.h as ISC_REQ_*, ISC_RET_*, ASC_REQ_* and ASC_RET_*.
@@ -330,6 +332,21 @@ internal unsafe struct SecPkgCred_ClientCertPolicy
330332
public char* pwszSslCtlIdentifier;
331333
}
332334

335+
[StructLayout(LayoutKind.Sequential)]
336+
internal unsafe struct SecPkgContext_SessionInfo
337+
{
338+
public uint dwFlags;
339+
public uint cbSessionId;
340+
public fixed byte rgbSessionId[32];
341+
342+
[Flags]
343+
public enum Flags
344+
{
345+
Zero = 0,
346+
SSL_SESSION_RECONNECT = 0x01,
347+
};
348+
}
349+
333350
[DllImport(Interop.Libraries.SspiCli, ExactSpelling = true, SetLastError = true)]
334351
internal static extern int EncryptMessage(
335352
ref CredHandle contextHandle,

‎src/libraries/Common/src/Interop/Windows/SspiCli/SSPIWrapper.cs

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -426,27 +426,41 @@ public static bool QueryBlittableContextAttributes<T>(ISSPIInterface secModule,
426426
}
427427
}
428428

429-
public static SafeFreeCertContext? QueryContextAttributes_SECPKG_ATTR_REMOTE_CERT_CONTEXT(ISSPIInterface secModule, SafeDeleteContext securityContext)
429+
private static bool QueryCertContextAttribute(ISSPIInterface secModule, SafeDeleteContext securityContext, Interop.SspiCli.ContextAttribute attribute, out SafeFreeCertContext? certContext)
430430
{
431431
Span<IntPtr> buffer = stackalloc IntPtr[1];
432432
int errorCode = secModule.QueryContextAttributes(
433433
securityContext,
434-
Interop.SspiCli.ContextAttribute.SECPKG_ATTR_REMOTE_CERT_CONTEXT,
434+
attribute,
435435
MemoryMarshal.AsBytes(buffer),
436436
typeof(SafeFreeCertContext),
437437
out SafeHandle? sspiHandle);
438438

439-
if (errorCode != 0)
439+
// certificate is not always present (e.g. on server when querying client certificate)
440+
// but we still want to consider such case as a success.
441+
bool success = errorCode == 0 || errorCode == (int)Interop.SECURITY_STATUS.NoCredentials;
442+
443+
if (!success)
440444
{
441445
sspiHandle?.Dispose();
446+
sspiHandle = null;
442447
if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(null, $"ERROR = {ErrorDescription(errorCode)}");
443-
return null;
444448
}
445449

446-
var result = (SafeFreeCertContext)sspiHandle!;
447-
return result;
450+
certContext = sspiHandle as SafeFreeCertContext;
451+
return success;
448452
}
449453

454+
public static bool QueryContextAttributes_SECPKG_ATTR_REMOTE_CERT_CONTEXT(ISSPIInterface secModule, SafeDeleteContext securityContext, out SafeFreeCertContext? certContext)
455+
=> QueryCertContextAttribute(secModule, securityContext, Interop.SspiCli.ContextAttribute.SECPKG_ATTR_REMOTE_CERT_CONTEXT, out certContext);
456+
457+
public static bool QueryContextAttributes_SECPKG_ATTR_LOCAL_CERT_CONTEXT(ISSPIInterface secModule, SafeDeleteContext securityContext, out SafeFreeCertContext? certContext)
458+
=> QueryCertContextAttribute(secModule, securityContext, Interop.SspiCli.ContextAttribute.SECPKG_ATTR_LOCAL_CERT_CONTEXT, out certContext);
459+
460+
public static bool QueryContextAttributes_SECPKG_ATTR_REMOTE_CERT_CHAIN(ISSPIInterface secModule, SafeDeleteContext securityContext, out SafeFreeCertContext? certContext)
461+
=> QueryCertContextAttribute(secModule, securityContext, Interop.SspiCli.ContextAttribute.SECPKG_ATTR_REMOTE_CERT_CHAIN, out certContext);
462+
463+
450464
public static bool QueryContextAttributes_SECPKG_ATTR_ISSUER_LIST_EX(ISSPIInterface secModule, SafeDeleteContext securityContext, ref Interop.SspiCli.SecPkgContext_IssuerListInfoEx ctx, out SafeHandle? sspiHandle)
451465
{
452466
Span<Interop.SspiCli.SecPkgContext_IssuerListInfoEx> buffer =

‎src/libraries/Common/src/Interop/Windows/SspiCli/SecuritySafeHandles.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
using System.Globalization;
66
using System.Runtime.InteropServices;
77
using System.Security.Authentication.ExtendedProtection;
8+
using System.Security.Cryptography.X509Certificates;
89
using Microsoft.Win32.SafeHandles;
910

1011
namespace System.Net.Security
@@ -320,10 +321,15 @@ public static unsafe int AcquireCredentialsHandle(
320321

321322
internal sealed class SafeFreeCredential_SECURITY : SafeFreeCredentials
322323
{
324+
#pragma warning disable 0649
325+
// This is used only by SslStream but it is included elsewhere
326+
public X509Certificate? LocalCertificate;
327+
#pragma warning restore 0649
323328
public SafeFreeCredential_SECURITY() : base() { }
324329

325330
protected override bool ReleaseHandle()
326331
{
332+
LocalCertificate?.Dispose();
327333
return Interop.SspiCli.FreeCredentialsHandle(ref _handle) == 0;
328334
}
329335
}

‎src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.ServerCertificates.cs

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,8 @@ public async Task UseCallback_ValidCertificate_ExpectedValuesDuringCallback(Conf
146146
{
147147
bool callbackCalled = false;
148148
handler.CheckCertificateRevocationList = checkRevocation;
149-
handler.ServerCertificateCustomValidationCallback = (request, cert, chain, errors) => {
149+
handler.ServerCertificateCustomValidationCallback = (request, cert, chain, errors) =>
150+
{
150151
callbackCalled = true;
151152
Assert.NotNull(request);
152153

@@ -225,6 +226,7 @@ public async Task NoCallback_BadCertificate_ThrowsException(string url)
225226
}
226227

227228
[OuterLoop("Uses external servers")]
229+
[ActiveIssue("https://github.com/dotnet/runtime/issues/77726")]
228230
[ConditionalFact(nameof(ClientSupportsDHECipherSuites))]
229231
public async Task NoCallback_RevokedCertificate_NoRevocationChecking_Succeeds()
230232
{

‎src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs

Lines changed: 39 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -338,19 +338,10 @@ private void RsaCryptRoundtrip(RSAEncryptionPadding paddingMode, bool expectSucc
338338
Assert.Equal(TestData.HelloBytes, output);
339339
}
340340

341-
[ConditionalFact]
341+
[ConditionalFact(nameof(PlatformSupportsEmptyRSAEncryption))]
342342
[SkipOnTargetFramework(TargetFrameworkMonikers.NetFramework)]
343343
public void RoundtripEmptyArray()
344344
{
345-
if (OperatingSystem.IsIOS() && !OperatingSystem.IsIOSVersionAtLeast(13, 6))
346-
{
347-
throw new SkipTestException("iOS prior to 13.6 does not reliably support RSA encryption of empty data.");
348-
}
349-
if (OperatingSystem.IsTvOS() && !OperatingSystem.IsTvOSVersionAtLeast(14, 0))
350-
{
351-
throw new SkipTestException("tvOS prior to 14.0 does not reliably support RSA encryption of empty data.");
352-
}
353-
354345
using (RSA rsa = RSAFactory.Create(TestData.RSA2048Params))
355346
{
356347
void RoundtripEmpty(RSAEncryptionPadding paddingMode)
@@ -701,6 +692,26 @@ public void NotSupportedValueMethods()
701692
}
702693
}
703694

695+
[ConditionalTheory]
696+
[InlineData(new byte[] { 1, 2, 3, 4 })]
697+
[InlineData(new byte[0])]
698+
public void Decrypt_Pkcs1_ErrorsForInvalidPadding(byte[] data)
699+
{
700+
if (data.Length == 0 && !PlatformSupportsEmptyRSAEncryption)
701+
{
702+
throw new SkipTestException("Platform does not support RSA encryption of empty data.");
703+
}
704+
705+
using (RSA rsa = RSAFactory.Create(TestData.RSA2048Params))
706+
{
707+
byte[] encrypted = Encrypt(rsa, data, RSAEncryptionPadding.Pkcs1);
708+
encrypted[1] ^= 0xFF;
709+
710+
// PKCS#1, the data, and the key are all deterministic so this should always throw an exception.
711+
Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, encrypted, RSAEncryptionPadding.Pkcs1));
712+
}
713+
}
714+
704715
public static IEnumerable<object[]> OaepPaddingModes
705716
{
706717
get
@@ -715,5 +726,23 @@ public static IEnumerable<object[]> OaepPaddingModes
715726
}
716727
}
717728
}
729+
730+
public static bool PlatformSupportsEmptyRSAEncryption
731+
{
732+
get
733+
{
734+
if (OperatingSystem.IsIOS() && !OperatingSystem.IsIOSVersionAtLeast(13, 6))
735+
{
736+
return false;
737+
}
738+
739+
if (OperatingSystem.IsTvOS() && !OperatingSystem.IsTvOSVersionAtLeast(14, 0))
740+
{
741+
return false;
742+
}
743+
744+
return true;
745+
}
746+
}
718747
}
719748
}

‎src/libraries/Native/Unix/System.Security.Cryptography.Native/opensslshim.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,8 +272,10 @@ const EVP_CIPHER* EVP_chacha20_poly1305(void);
272272
REQUIRED_FUNCTION(ERR_peek_error) \
273273
REQUIRED_FUNCTION(ERR_peek_error_line) \
274274
REQUIRED_FUNCTION(ERR_peek_last_error) \
275+
REQUIRED_FUNCTION(ERR_pop_to_mark) \
275276
FALLBACK_FUNCTION(ERR_put_error) \
276277
REQUIRED_FUNCTION(ERR_reason_error_string) \
278+
REQUIRED_FUNCTION(ERR_set_mark) \
277279
LIGHTUP_FUNCTION(ERR_set_debug) \
278280
LIGHTUP_FUNCTION(ERR_set_error) \
279281
REQUIRED_FUNCTION(EVP_aes_128_cbc) \
@@ -328,6 +330,7 @@ const EVP_CIPHER* EVP_chacha20_poly1305(void);
328330
REQUIRED_FUNCTION(EVP_PKCS82PKEY) \
329331
REQUIRED_FUNCTION(EVP_PKEY2PKCS8) \
330332
REQUIRED_FUNCTION(EVP_PKEY_CTX_ctrl) \
333+
REQUIRED_FUNCTION(EVP_PKEY_CTX_ctrl_str) \
331334
REQUIRED_FUNCTION(EVP_PKEY_CTX_free) \
332335
REQUIRED_FUNCTION(EVP_PKEY_CTX_get0_pkey) \
333336
REQUIRED_FUNCTION(EVP_PKEY_CTX_new) \
@@ -725,8 +728,10 @@ FOR_ALL_OPENSSL_FUNCTIONS
725728
#define ERR_peek_error_line ERR_peek_error_line_ptr
726729
#define ERR_peek_last_error ERR_peek_last_error_ptr
727730
#define ERR_put_error ERR_put_error_ptr
731+
#define ERR_pop_to_mark ERR_pop_to_mark_ptr
728732
#define ERR_reason_error_string ERR_reason_error_string_ptr
729733
#define ERR_set_debug ERR_set_debug_ptr
734+
#define ERR_set_mark ERR_set_mark_ptr
730735
#define ERR_set_error ERR_set_error_ptr
731736
#define EVP_aes_128_cbc EVP_aes_128_cbc_ptr
732737
#define EVP_aes_128_cfb8 EVP_aes_128_cfb8_ptr
@@ -780,6 +785,7 @@ FOR_ALL_OPENSSL_FUNCTIONS
780785
#define EVP_PKCS82PKEY EVP_PKCS82PKEY_ptr
781786
#define EVP_PKEY2PKCS8 EVP_PKEY2PKCS8_ptr
782787
#define EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_ctrl_ptr
788+
#define EVP_PKEY_CTX_ctrl_str EVP_PKEY_CTX_ctrl_str_ptr
783789
#define EVP_PKEY_CTX_free EVP_PKEY_CTX_free_ptr
784790
#define EVP_PKEY_CTX_get0_pkey EVP_PKEY_CTX_get0_pkey_ptr
785791
#define EVP_PKEY_CTX_new EVP_PKEY_CTX_new_ptr

‎src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,19 @@ static bool ConfigureEncryption(EVP_PKEY_CTX* ctx, RsaPaddingMode padding, const
6363
{
6464
return false;
6565
}
66+
67+
// OpenSSL 3.2 introduced a change where PKCS#1 RSA decryption does not fail for invalid padding.
68+
// If the padding is invalid, the decryption operation returns random data.
69+
// See https://github.com/openssl/openssl/pull/13817 for background.
70+
// Some Linux distributions backported this change to previous versions of OpenSSL.
71+
// Here we do a best-effort to set a flag to revert the behavior to failing if the padding is invalid.
72+
ERR_set_mark();
73+
74+
EVP_PKEY_CTX_ctrl_str(ctx, "rsa_pkcs1_implicit_rejection", "0");
75+
76+
// Undo any changes to the error queue that may have occured while configuring implicit rejection if the
77+
// current version does not support implicit rejection.
78+
ERR_pop_to_mark();
6679
}
6780
else
6881
{

‎src/libraries/System.Net.Http/tests/FunctionalTests/HttpClientHandlerTest.Http3.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1013,6 +1013,13 @@ public async Task StatusCodes_ReceiveSuccess(HttpStatusCode statusCode, bool qpa
10131013
[InlineData(1000)]
10141014
public async Task EchoServerStreaming_DifferentMessageSize_Success(int messageSize)
10151015
{
1016+
// Disable failing test in 6.0 branch, see https://github.com/dotnet/runtime/issues/95158
1017+
// The mock tests don't exist in newer releases -> no need to keep an active issue.
1018+
if (this.UseQuicImplementationProvider == QuicImplementationProviders.Mock)
1019+
{
1020+
return;
1021+
}
1022+
10161023
int iters = 5;
10171024
var message = new byte[messageSize];
10181025
var readBuffer = new byte[5 * messageSize]; // bigger than message

0 commit comments

Comments
 (0)