[Mono.Android] Fix ServerCertificateCustomValidator (#8594)

Fixes: dotnet/runtime#95506
In Release configuration the `X509ExtendedTrustManagerInvoker` class is trimmed and so the `trustManager is IX509TrustManager tm` pattern matching doesn't work. This PR addresses the problem in two ways:
* an internal X509 trust manager is now required - it can't silently work with a null internal trust manager anymore
* `[DynamicDependency]` attribute to prevent trimming of the invoker classes for the `IX509TrustManager` interface and for the `X509ExtendedTrustManager` abstract class

Author: simonrozsival

src/Mono.Android/Xamarin.Android.Net/ServerCertificateCustomValidator.cs

@@ -1,5 +1,6 @@
 usingSystem;
 usingSystem.Collections.Generic;
+usingSystem.Diagnostics.CodeAnalysis;
 usingSystem.Net.Http;
 usingSystem.Net.Security;
 usingSystem.Security.Cryptography.X509Certificates;
@@ -31,12 +32,12 @@ public ITrustManager[] ReplaceX509TrustManager (ITrustManager[]? trustManagers,
 
 privatesealedclassTrustManager:Java.Lang.Object,IX509TrustManager
 {
-privatereadonlyIX509TrustManager?_internalTrustManager;
+privatereadonlyIX509TrustManager_internalTrustManager;
 privatereadonlyHttpRequestMessage_request;
 privatereadonlyFunc<HttpRequestMessage,X509Certificate2?,X509Chain?,SslPolicyErrors,bool>_serverCertificateCustomValidationCallback;
 
 publicTrustManager(
-IX509TrustManager?internalTrustManager,
+IX509TrustManagerinternalTrustManager,
 HttpRequestMessagerequest,
 Func<HttpRequestMessage,X509Certificate2?,X509Chain?,SslPolicyErrors,bool>serverCertificateCustomValidationCallback)
 {
@@ -50,7 +51,7 @@ public void CheckServerTrusted (JavaX509Certificate[] javaChain, string authType
 varsslPolicyErrors=SslPolicyErrors.None;
 
 try{
-_internalTrustManager?.CheckServerTrusted(javaChain,authType);
+_internalTrustManager.CheckServerTrusted(javaChain,authType);
 }catch(JavaCertificateException){
 sslPolicyErrors|=SslPolicyErrors.RemoteCertificateChainErrors;
 }
@@ -158,33 +159,29 @@ private sealed class AlwaysAcceptingHostnameVerifier : Java.Lang.Object, IHostna
 publicboolVerify(string?hostname,ISSLSession?session)=>true;
 }
 
-privatestaticIX509TrustManager?FindX509TrustManager(ITrustManager[]?trustManagers)
+[DynamicDependency(nameof(IX509TrustManager.CheckServerTrusted),typeof(IX509TrustManagerInvoker))]
+[DynamicDependency(nameof(IX509TrustManager.CheckServerTrusted),typeof(X509ExtendedTrustManagerInvoker))]
+privatestaticIX509TrustManagerFindX509TrustManager(ITrustManager[]trustManagers)
 {
-if(trustManagersisnull)
-returnnull;
-
 foreach(vartrustManagerintrustManagers){
 if(trustManagerisIX509TrustManagertm)
 returntm;
 }
 
-returnnull;
+thrownewInvalidOperationException($"Could not find {nameof(IX509TrustManager)} in {nameof(ITrustManager)} array.");
 }
 
-privatestaticITrustManager[]ModifyTrustManagersArray(ITrustManager[]trustManagers,IX509TrustManager?original,IX509TrustManagerreplacement)
+privatestaticITrustManager[]ModifyTrustManagersArray(ITrustManager[]trustManagers,IX509TrustManageroriginal,IX509TrustManagerreplacement)
 {
-varmodifiedTrustManagersCount=originalisnull?trustManagers.Length+1:trustManagers.Length;
-varmodifiedTrustManagersArray=newITrustManager[modifiedTrustManagersCount];
-
-modifiedTrustManagersArray[0]=replacement;
-intnextIndex=1;
+varmodifiedTrustManagersArray=newITrustManager[trustManagers.Length];
 
 for(inti=0;i<trustManagers.Length;i++){
 if(trustManagers[i]==original){
-continue;
+modifiedTrustManagersArray[i]=replacement;
+}else{
+modifiedTrustManagersArray[i]=trustManagers[i];
 }
 
-modifiedTrustManagersArray[nextIndex++]=trustManagers[i];
 }
 
 returnmodifiedTrustManagersArray;

src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/Tasks/LinkerTests.cs

@@ -516,6 +516,40 @@ public void AndroidUseNegotiateAuthentication ([Values (true, false, null)] bool
 }
 }
 
+[Test]
+publicvoidPreserveIX509TrustManagerSubclasses([Values(true,false)]boolhasServerCertificateCustomValidationCallback)
+{
+varproj=newXamarinAndroidApplicationProject{IsRelease=true};
+proj.AddReferences("System.Net.Http");
+proj.MainActivity=proj.DefaultMainActivity.Replace(
+"base.OnCreate (bundle);",
+"base.OnCreate (bundle);\n"+
+(hasServerCertificateCustomValidationCallback
+?"var handler = new Xamarin.Android.Net.AndroidMessageHandler { ServerCertificateCustomValidationCallback = (message, certificate, chain, errors) => true };\n"
+:"var handler = new Xamarin.Android.Net.AndroidMessageHandler();\n")+
+"var client = new System.Net.Http.HttpClient (handler);\n"+
+"client.GetAsync (\"https://microsoft.com\").GetAwaiter ().GetResult ();");
+
+using(varb=CreateApkBuilder()){
+Assert.IsTrue(b.Build(proj),"Build should have succeeded.");
+varassemblyPath=BuildTest.GetLinkedPath(b,true,"Mono.Android.dll");
+
+using(varassembly=AssemblyDefinition.ReadAssembly(assemblyPath)){
+Assert.IsTrue(assembly!=null);
+
+vartypes=new[]{"Javax.Net.Ssl.X509ExtendedTrustManager","Javax.Net.Ssl.IX509TrustManagerInvoker"};
+foreach(vartypeNameintypes){
+vartd=assembly.MainModule.GetType(typeName);
+if(hasServerCertificateCustomValidationCallback){
+Assert.IsNotNull(td,$"{typeName} shouldn't have been linked out");
+}else{
+Assert.IsNull(td,$"{typeName} should have been linked out");
+}
+}
+}
+}
+}
+
 [Test]
 publicvoidDoNotErrorOnPerArchJavaTypeDuplicates([Values(true,false)]boolenableMarshalMethods)
 {