Skip to content

Support optional client certificates for MsQuicConnection #69603

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 25, 2022
Merged

Support optional client certificates for MsQuicConnection #69603

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
18e8a77
Support optional client certificates for MsQuicConnection
rzikm May 20, 2022
2195164
fixup! Support optional client certificates for MsQuicConnection
rzikm May 20, 2022
4238083
Update Fedora image
rzikm May 24, 2022
72fb91c
Remove DEFER_CERTIFICATE_VALIDATION flag
rzikm May 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion eng/pipelines/coreclr/templates/helix-queues-setup.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ jobs:
- (Debian.11.Amd64)[email protected]/dotnet-buildtools/prereqs:debian-11-helix-amd64-20210304164428-5a7c380
- Ubuntu.1804.Amd64
- (Centos.8.Amd64)[email protected]/dotnet-buildtools/prereqs:centos-8-helix-20201229003624-c1bf759
- (Fedora.34.Amd64)[email protected]/dotnet-buildtools/prereqs:fedora-34-helix-20220331150839-4f64125
- (Fedora.34.Amd64)[email protected]/dotnet-buildtools/prereqs:fedora-34-helix-20220523150939-4f64125
- RedHat.7.Amd64

# OSX arm64
Expand Down
4 changes: 2 additions & 2 deletions eng/pipelines/libraries/helix-queues-setup.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,14 +62,14 @@ jobs:
- (Centos.8.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:centos-8-helix-20201229003624-c1bf759
- RedHat.7.Amd64.Open
- SLES.15.Amd64.Open
- (Fedora.34.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:fedora-34-helix-20220331150839-4f64125
- (Fedora.34.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:fedora-34-helix-20220523150939-4f64125
- (Ubuntu.2110.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:ubuntu-21.10-helix-amd64-20211116135132-0f8d97e
- (Debian.10.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:debian-10-helix-amd64-bfcd90a-20200121150006
- ${{ if or(ne(parameters.jobParameters.testScope, 'outerloop'), ne(parameters.jobParameters.runtimeFlavor, 'mono')) }}:
- ${{ if or(eq(parameters.jobParameters.isExtraPlatforms, true), eq(parameters.jobParameters.includeAllPlatforms, true)) }}:
- (Centos.8.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:centos-8-helix-20201229003624-c1bf759
- SLES.15.Amd64.Open
- (Fedora.34.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:fedora-34-helix-20220331150839-4f64125
- (Fedora.34.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:fedora-34-helix-20220523150939-4f64125
- (Ubuntu.2110.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:ubuntu-21.04-helix-amd64-20210922170909-34a2d72
- (Debian.11.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:debian-11-helix-amd64-20210304164428-5a7c380
- (Mariner.1.0.Amd64.Open)[email protected]/dotnet-buildtools/prereqs:cbl-mariner-1.0-helix-20210528192219-92bf620
Expand Down
2 changes: 1 addition & 1 deletion ....Quic/src/System/Net/Quic/Implementations/MsQuic/Interop/SafeMsQuicConfigurationHandle.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ public static SafeMsQuicConfigurationHandle Create(QuicClientConnectionOptions o
}
}

return Create(options, QUIC_CREDENTIAL_FLAGS.CLIENT, certificate: certificate, certificateContext: null, options.ClientAuthenticationOptions?.ApplicationProtocols, options.ClientAuthenticationOptions?.CipherSuitesPolicy);
return Create(options, QUIC_CREDENTIAL_FLAGS.CLIENT | QUIC_CREDENTIAL_FLAGS.USE_SUPPLIED_CREDENTIALS, certificate: certificate, certificateContext: null, options.ClientAuthenticationOptions?.ApplicationProtocols, options.ClientAuthenticationOptions?.CipherSuitesPolicy);
Copy link

@anrossi anrossi May 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By the way, USE_SUPPLIED_CREDENTIALS is only used for Schannel. It should cause an error to use it with OpenSSL.

Copy link
Member Author

@rzikm rzikm May 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's strange, I didn't observe any test failures on Linux

Copy link
Member

@wfurt wfurt May 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm still planning to finish testing on Linux & Windows but got distracted with my trip. I should be able to finish testing tomorrow.

Copy link
Member

@ManickaP ManickaP May 26, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This fails on my machine, I'll put up a PR to fix this.

}

public static SafeMsQuicConfigurationHandle Create(QuicOptions options, SslServerAuthenticationOptions? serverAuthenticationOptions, string? targetHost = null)
Expand Down
13 changes: 5 additions & 8 deletions src/libraries/System.Net.Quic/tests/FunctionalTests/MsQuicTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,6 @@ public async Task UnidirectionalAndBidirectionalChangeValues()
}

[Fact]
[ActiveIssue("https://github.com/dotnet/runtime/issues/46837", TestPlatforms.OSX)]
public async Task ConnectWithCertificateChain()
{
(X509Certificate2 certificate, X509Certificate2Collection chain) = System.Net.Security.Tests.TestHelper.GenerateCertificates("localhost", longChain: true);
Expand Down Expand Up @@ -107,7 +106,6 @@ public async Task ConnectWithCertificateChain()
}

[Fact]
[ActiveIssue("https://github.com/dotnet/runtime/issues/64944", TestPlatforms.Windows)]
public async Task UntrustedClientCertificateFails()
{
var listenerOptions = new QuicListenerOptions();
Expand Down Expand Up @@ -338,9 +336,8 @@ public async Task ConnectWithCertificateForLoopbackIP_IndicatesExpectedError(str

[Theory]
[InlineData(true)]
// [InlineData(false)] [ActiveIssue("https://github.com/dotnet/runtime/issues/57308")]
[ActiveIssue("https://github.com/dotnet/runtime/issues/64944", TestPlatforms.Windows)]
public async Task ConnectWithClientCertificate(bool sendCerttificate)
[InlineData(false)]
public async Task ConnectWithClientCertificate(bool sendCertificate)
{
bool clientCertificateOK = false;

Expand All @@ -350,7 +347,7 @@ public async Task ConnectWithClientCertificate(bool sendCerttificate)
listenerOptions.ServerAuthenticationOptions.ClientCertificateRequired = true;
listenerOptions.ServerAuthenticationOptions.RemoteCertificateValidationCallback = (sender, cert, chain, errors) =>
{
if (sendCerttificate)
if (sendCertificate)
{
_output.WriteLine("client certificate {0}", cert);
Assert.NotNull(cert);
Expand All @@ -363,7 +360,7 @@ public async Task ConnectWithClientCertificate(bool sendCerttificate)

using QuicListener listener = new QuicListener(QuicImplementationProviders.MsQuic, listenerOptions);
QuicClientConnectionOptions clientOptions = CreateQuicClientOptions();
if (sendCerttificate)
if (sendCertificate)
{
clientOptions.ClientAuthenticationOptions.ClientCertificates = new X509CertificateCollection() { ClientCertificate };
}
Expand All @@ -373,7 +370,7 @@ public async Task ConnectWithClientCertificate(bool sendCerttificate)
await PingPong(clientConnection, serverConnection);
// check we completed the client certificate verification.
Assert.True(clientCertificateOK);
Assert.Equal(ClientCertificate, serverConnection.RemoteCertificate);
Assert.Equal(sendCertificate ? ClientCertificate : null, serverConnection.RemoteCertificate);

await serverConnection.CloseAsync(0);
clientConnection.Dispose();
Expand Down