use also SslCertificateTrust when constructing CertificateContext - #103372

Merged
wfurt merged 6 commits into
dotnet:mainfrom
wfurt:trust
Jun 25, 2024
Merged

use also SslCertificateTrust when constructing CertificateContext#103372
wfurt merged 6 commits into
dotnet:mainfrom
wfurt:trust

Conversation

@wfurt

@wfurtwfurt commented Jun 12, 2024

Copy link
Copy Markdown
Member

there are two parts to this change.

When #54219 added support for SslCertificateTrust it did impact only certificate validation but not SslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will use Trust if provided to construct the chain for consistency.

Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.
The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.

contributes to #100602
I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.

@wfurtwfurt added this to the 9.0.0 milestone Jun 12, 2024
@wfurtwfurt self-assigned this Jun 12, 2024
@dotnet-policy-service

dotnet-policy-serviceBot commented Jun 12, 2024

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

@build-analysisbuild-analysisBot mentioned this pull request Jun 13, 2024
Closed
rzikm
rzikm reviewed Jun 13, 2024
View reviewed changes

@rzikmrzikm left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo comments, but I would prefer @bartonjs to confirm that trusting everything to build a chain is okay.

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs Outdated
Comment threadsrc/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@simonrozsival

simonrozsival commented Jun 20, 2024

Copy link
Copy Markdown
Member

@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

This was referenced Jun 20, 2024
Open
Closed
Closed
Closed
Closed
Closed
Closed
rzikm
rzikm approved these changes Jun 21, 2024
View reviewed changes

@rzikmrzikm left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@build-analysisbuild-analysisBot mentioned this pull request Jun 21, 2024
Closed
3 tasks
This was referenced Jun 24, 2024
Closed
Closed
@wfurt
wfurt merged commit 973237d into dotnet:mainJun 25, 2024
@wfurt

wfurt commented Jun 25, 2024

Copy link
Copy Markdown
MemberAuthor

@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...?

@matouskozakmatouskozak mentioned this pull request Jun 26, 2024
Closed
This was referenced Jun 26, 2024
Merged
Closed
simonrozsival pushed a commit to simonrozsival/runtime that referenced this pull request Jul 8, 2024
@wfurt@simonrozsival
use also SslCertificateTrust when constructing CertificateContext (do…
9f1b0c4
…tnet#103372)
* use also SslCertificateTrust when constructing CertificateContext
* 'build
* feedback
@simonrozsivalsimonrozsival mentioned this pull request Jul 8, 2024
Merged
4 tasks
vitek-karas added a commit that referenced this pull request Jul 15, 2024
@simonrozsival@wfurt@vitek-karas
[release/8.0-staging] use also SslCertificateTrust when constructing …
ce2fdb4
…CertificateContext (#104541)
Backport of #103372 and #104016 to release/8.0-staging
## Customer Impact
- [X] Customer reported (#100602)
- [ ] Found internally
Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform.
## Regression
- [ ] Yes
- [X] No
## Testing
Unit tests and manual testing on Android emulator.
## Risk
Low. The change is mostly limited to Android where this API doesn't currently work in many cases. ---------
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
@github-actionsgithub-actionsBot locked and limited conversation to collaborators Jul 25, 2024
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@simonrozsivalsimonrozsivalsimonrozsival approved these changes
@rzikmrzikmrzikm approved these changes
@bartonjsbartonjsAwaiting requested review from bartonjs

Assignees

@wfurtwfurt

Labels

area-System.Net.Security

Projects

None yet

Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@wfurt@simonrozsival@rzikm
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
use also SslCertificateTrust when constructing CertificateContext - #103372
Merged
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Jun 25, 2024
Merged
use also SslCertificateTrust when constructing CertificateContext#103372
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Conversation
@wfurt
@wfurtwfurt
commented
Jun 12, 2024

Copy link


Copy Markdown

Member
there are two parts to this change.
When #54219 added support for SslCertificateTrust  it did impact only certificate validation but not SslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will use Trust if provided to construct the chain for consistency.
Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.

The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.
contributes to #100602

I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.
@wfurtwfurt
added this to the 9.0.0 milestone
Jun 12, 2024
@wfurtwfurt
self-assigned this
Jun 12, 2024
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jun 12, 2024

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 13, 2024

Closed

rzikm
rzikm
reviewed
Jun 13, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo comments, but I would prefer @bartonjs to confirm that trusting everything to build a chain is okay.
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Outdated

Comment threadsrc/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@simonrozsival
simonrozsival
commented
Jun 20, 2024

Copy link


Copy Markdown

Member
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

This was referenced Jun 20, 2024

Open


Closed


Closed


Closed


Closed


Closed


Closed

rzikm
rzikm
approved these changes
Jun 21, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 21, 2024

Closed

3 tasks

This was referenced Jun 24, 2024

Closed


Closed

@wfurt
wfurt
merged commit 973237d
into
dotnet:mainJun 25, 2024
@wfurt
wfurt
commented
Jun 25, 2024

Copy link


Copy Markdown

MemberAuthor
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?
why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...?
@matouskozakmatouskozak
mentioned this pull request
Jun 26, 2024

Closed


This was referenced Jun 26, 2024
 Merged


Closed

simonrozsival pushed a commit
to simonrozsival/runtime
that referenced
this pull request
Jul 8, 2024
@wfurt@simonrozsival
use also SslCertificateTrust when constructing CertificateContext (do…
9f1b0c4
…tnet#103372)
* use also SslCertificateTrust when constructing CertificateContext
* 'build
* feedback
@simonrozsivalsimonrozsival
mentioned this pull request
Jul 8, 2024
 Merged

4 tasks
vitek-karas added a commit
that referenced
this pull request
Jul 15, 2024
@simonrozsival@wfurt@vitek-karas
[release/8.0-staging] use also SslCertificateTrust when constructing …
ce2fdb4
…CertificateContext (#104541)
Backport of #103372 and #104016 to release/8.0-staging
## Customer Impact
- [X] Customer reported (#100602)
- [ ] Found internally
Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform.
## Regression
- [ ] Yes
- [X] No
## Testing
Unit tests and manual testing on Android emulator.
## Risk
Low. The change is mostly limited to Android where this API doesn't currently work in many cases. ---------
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Jul 25, 2024
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@simonrozsivalsimonrozsivalsimonrozsival approved these changes
@rzikmrzikmrzikm approved these changes
@bartonjsbartonjsAwaiting requested review from bartonjs

Assignees

@wfurtwfurt

Labels

area-System.Net.Security

Projects


None yet


Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@wfurt@simonrozsival@rzikm

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
use also SslCertificateTrust when constructing CertificateContext - #103372
Merged
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Jun 25, 2024
Merged
use also SslCertificateTrust when constructing CertificateContext#103372
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Conversation
@wfurt
@wfurtwfurt
commented
Jun 12, 2024

Copy link


Copy Markdown

Member
there are two parts to this change.
When #54219 added support for SslCertificateTrust  it did impact only certificate validation but not SslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will use Trust if provided to construct the chain for consistency.
Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.

The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.
contributes to #100602

I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.
@wfurtwfurt
added this to the 9.0.0 milestone
Jun 12, 2024
@wfurtwfurt
self-assigned this
Jun 12, 2024
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jun 12, 2024

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 13, 2024

Closed

rzikm
rzikm
reviewed
Jun 13, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo comments, but I would prefer @bartonjs to confirm that trusting everything to build a chain is okay.
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Outdated

Comment threadsrc/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@simonrozsival
simonrozsival
commented
Jun 20, 2024

Copy link


Copy Markdown

Member
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

This was referenced Jun 20, 2024

Open


Closed


Closed


Closed


Closed


Closed


Closed

rzikm
rzikm
approved these changes
Jun 21, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 21, 2024

Closed

3 tasks

This was referenced Jun 24, 2024

Closed


Closed

@wfurt
wfurt
merged commit 973237d
into
dotnet:mainJun 25, 2024
@wfurt
wfurt
commented
Jun 25, 2024

Copy link


Copy Markdown

MemberAuthor
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?
why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...?
@matouskozakmatouskozak
mentioned this pull request
Jun 26, 2024

Closed


This was referenced Jun 26, 2024
 Merged


Closed

simonrozsival pushed a commit
to simonrozsival/runtime
that referenced
this pull request
Jul 8, 2024
@wfurt@simonrozsival
use also SslCertificateTrust when constructing CertificateContext (do…
9f1b0c4
…tnet#103372)
* use also SslCertificateTrust when constructing CertificateContext
* 'build
* feedback
@simonrozsivalsimonrozsival
mentioned this pull request
Jul 8, 2024
 Merged

4 tasks
vitek-karas added a commit
that referenced
this pull request
Jul 15, 2024
@simonrozsival@wfurt@vitek-karas
[release/8.0-staging] use also SslCertificateTrust when constructing …
ce2fdb4
…CertificateContext (#104541)
Backport of #103372 and #104016 to release/8.0-staging
## Customer Impact
- [X] Customer reported (#100602)
- [ ] Found internally
Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform.
## Regression
- [ ] Yes
- [X] No
## Testing
Unit tests and manual testing on Android emulator.
## Risk
Low. The change is mostly limited to Android where this API doesn't currently work in many cases. ---------
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Jul 25, 2024
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@simonrozsivalsimonrozsivalsimonrozsival approved these changes
@rzikmrzikmrzikm approved these changes
@bartonjsbartonjsAwaiting requested review from bartonjs

Assignees

@wfurtwfurt

Labels

area-System.Net.Security

Projects


None yet


Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@wfurt@simonrozsival@rzikm

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
use also SslCertificateTrust when constructing CertificateContext - #103372
Merged
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Jun 25, 2024
Merged
use also SslCertificateTrust when constructing CertificateContext#103372
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Conversation
@wfurt
@wfurtwfurt
commented
Jun 12, 2024

Copy link


Copy Markdown

Member
there are two parts to this change.
When #54219 added support for SslCertificateTrust  it did impact only certificate validation but not SslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will use Trust if provided to construct the chain for consistency.
Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.

The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.
contributes to #100602

I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.
@wfurtwfurt
added this to the 9.0.0 milestone
Jun 12, 2024
@wfurtwfurt
self-assigned this
Jun 12, 2024
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jun 12, 2024

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 13, 2024

Closed

rzikm
rzikm
reviewed
Jun 13, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo comments, but I would prefer @bartonjs to confirm that trusting everything to build a chain is okay.
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Outdated

Comment threadsrc/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@simonrozsival
simonrozsival
commented
Jun 20, 2024

Copy link


Copy Markdown

Member
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

This was referenced Jun 20, 2024

Open


Closed


Closed


Closed


Closed


Closed


Closed

rzikm
rzikm
approved these changes
Jun 21, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 21, 2024

Closed

3 tasks

This was referenced Jun 24, 2024

Closed


Closed

@wfurt
wfurt
merged commit 973237d
into
dotnet:mainJun 25, 2024
@wfurt
wfurt
commented
Jun 25, 2024

Copy link


Copy Markdown

MemberAuthor
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?
why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...?
@matouskozakmatouskozak
mentioned this pull request
Jun 26, 2024

Closed


This was referenced Jun 26, 2024
 Merged


Closed

simonrozsival pushed a commit
to simonrozsival/runtime
that referenced
this pull request
Jul 8, 2024
@wfurt@simonrozsival
use also SslCertificateTrust when constructing CertificateContext (do…
9f1b0c4
…tnet#103372)
* use also SslCertificateTrust when constructing CertificateContext
* 'build
* feedback
@simonrozsivalsimonrozsival
mentioned this pull request
Jul 8, 2024
 Merged

4 tasks
vitek-karas added a commit
that referenced
this pull request
Jul 15, 2024
@simonrozsival@wfurt@vitek-karas
[release/8.0-staging] use also SslCertificateTrust when constructing …
ce2fdb4
…CertificateContext (#104541)
Backport of #103372 and #104016 to release/8.0-staging
## Customer Impact
- [X] Customer reported (#100602)
- [ ] Found internally
Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform.
## Regression
- [ ] Yes
- [X] No
## Testing
Unit tests and manual testing on Android emulator.
## Risk
Low. The change is mostly limited to Android where this API doesn't currently work in many cases. ---------
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Jul 25, 2024
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@simonrozsivalsimonrozsivalsimonrozsival approved these changes
@rzikmrzikmrzikm approved these changes
@bartonjsbartonjsAwaiting requested review from bartonjs

Assignees

@wfurtwfurt

Labels

area-System.Net.Security

Projects


None yet


Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@wfurt@simonrozsival@rzikm

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
use also SslCertificateTrust when constructing CertificateContext - #103372
Merged
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Jun 25, 2024
Merged
use also SslCertificateTrust when constructing CertificateContext#103372
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Conversation
@wfurt
@wfurtwfurt
commented
Jun 12, 2024

Copy link


Copy Markdown

Member
there are two parts to this change.
When #54219 added support for SslCertificateTrust  it did impact only certificate validation but not SslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will use Trust if provided to construct the chain for consistency.
Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.

The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.
contributes to #100602

I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.
@wfurtwfurt
added this to the 9.0.0 milestone
Jun 12, 2024
@wfurtwfurt
self-assigned this
Jun 12, 2024
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jun 12, 2024

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 13, 2024

Closed

rzikm
rzikm
reviewed
Jun 13, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo comments, but I would prefer @bartonjs to confirm that trusting everything to build a chain is okay.
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Outdated

Comment threadsrc/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@simonrozsival
simonrozsival
commented
Jun 20, 2024

Copy link


Copy Markdown

Member
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

This was referenced Jun 20, 2024

Open


Closed


Closed


Closed


Closed


Closed


Closed

rzikm
rzikm
approved these changes
Jun 21, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 21, 2024

Closed

3 tasks

This was referenced Jun 24, 2024

Closed


Closed

@wfurt
wfurt
merged commit 973237d
into
dotnet:mainJun 25, 2024
@wfurt
wfurt
commented
Jun 25, 2024

Copy link


Copy Markdown

MemberAuthor
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?
why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...?
@matouskozakmatouskozak
mentioned this pull request
Jun 26, 2024

Closed


This was referenced Jun 26, 2024
 Merged


Closed

simonrozsival pushed a commit
to simonrozsival/runtime
that referenced
this pull request
Jul 8, 2024
@wfurt@simonrozsival
use also SslCertificateTrust when constructing CertificateContext (do…
9f1b0c4
…tnet#103372)
* use also SslCertificateTrust when constructing CertificateContext
* 'build
* feedback
@simonrozsivalsimonrozsival
mentioned this pull request
Jul 8, 2024
 Merged

4 tasks
vitek-karas added a commit
that referenced
this pull request
Jul 15, 2024
@simonrozsival@wfurt@vitek-karas
[release/8.0-staging] use also SslCertificateTrust when constructing …
ce2fdb4
…CertificateContext (#104541)
Backport of #103372 and #104016 to release/8.0-staging
## Customer Impact
- [X] Customer reported (#100602)
- [ ] Found internally
Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform.
## Regression
- [ ] Yes
- [X] No
## Testing
Unit tests and manual testing on Android emulator.
## Risk
Low. The change is mostly limited to Android where this API doesn't currently work in many cases. ---------
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Jul 25, 2024
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@simonrozsivalsimonrozsivalsimonrozsival approved these changes
@rzikmrzikmrzikm approved these changes
@bartonjsbartonjsAwaiting requested review from bartonjs

Assignees

@wfurtwfurt

Labels

area-System.Net.Security

Projects


None yet


Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@wfurt@simonrozsival@rzikm

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
use also SslCertificateTrust when constructing CertificateContext - #103372
Merged
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Jun 25, 2024
Merged
use also SslCertificateTrust when constructing CertificateContext#103372
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Conversation
@wfurt
@wfurtwfurt
commented
Jun 12, 2024

Copy link


Copy Markdown

Member
there are two parts to this change.
When #54219 added support for SslCertificateTrust  it did impact only certificate validation but not SslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will use Trust if provided to construct the chain for consistency.
Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.

The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.
contributes to #100602

I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.
@wfurtwfurt
added this to the 9.0.0 milestone
Jun 12, 2024
@wfurtwfurt
self-assigned this
Jun 12, 2024
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jun 12, 2024

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 13, 2024

Closed

rzikm
rzikm
reviewed
Jun 13, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo comments, but I would prefer @bartonjs to confirm that trusting everything to build a chain is okay.
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Outdated

Comment threadsrc/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@simonrozsival
simonrozsival
commented
Jun 20, 2024

Copy link


Copy Markdown

Member
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

This was referenced Jun 20, 2024

Open


Closed


Closed


Closed


Closed


Closed


Closed

rzikm
rzikm
approved these changes
Jun 21, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 21, 2024

Closed

3 tasks

This was referenced Jun 24, 2024

Closed


Closed

@wfurt
wfurt
merged commit 973237d
into
dotnet:mainJun 25, 2024
@wfurt
wfurt
commented
Jun 25, 2024

Copy link


Copy Markdown

MemberAuthor
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?
why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...?
@matouskozakmatouskozak
mentioned this pull request
Jun 26, 2024

Closed


This was referenced Jun 26, 2024
 Merged


Closed

simonrozsival pushed a commit
to simonrozsival/runtime
that referenced
this pull request
Jul 8, 2024
@wfurt@simonrozsival
use also SslCertificateTrust when constructing CertificateContext (do…
9f1b0c4
…tnet#103372)
* use also SslCertificateTrust when constructing CertificateContext
* 'build
* feedback
@simonrozsivalsimonrozsival
mentioned this pull request
Jul 8, 2024
 Merged

4 tasks
vitek-karas added a commit
that referenced
this pull request
Jul 15, 2024
@simonrozsival@wfurt@vitek-karas
[release/8.0-staging] use also SslCertificateTrust when constructing …
ce2fdb4
…CertificateContext (#104541)
Backport of #103372 and #104016 to release/8.0-staging
## Customer Impact
- [X] Customer reported (#100602)
- [ ] Found internally
Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform.
## Regression
- [ ] Yes
- [X] No
## Testing
Unit tests and manual testing on Android emulator.
## Risk
Low. The change is mostly limited to Android where this API doesn't currently work in many cases. ---------
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Jul 25, 2024
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@simonrozsivalsimonrozsivalsimonrozsival approved these changes
@rzikmrzikmrzikm approved these changes
@bartonjsbartonjsAwaiting requested review from bartonjs

Assignees

@wfurtwfurt

Labels

area-System.Net.Security

Projects


None yet


Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@wfurt@simonrozsival@rzikm

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
use also SslCertificateTrust when constructing CertificateContext - #103372
Merged
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Jun 25, 2024
Merged
use also SslCertificateTrust when constructing CertificateContext#103372
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Conversation
@wfurt
@wfurtwfurt
commented
Jun 12, 2024

Copy link


Copy Markdown

Member
there are two parts to this change.
When #54219 added support for SslCertificateTrust  it did impact only certificate validation but not SslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will use Trust if provided to construct the chain for consistency.
Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.

The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.
contributes to #100602

I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.
@wfurtwfurt
added this to the 9.0.0 milestone
Jun 12, 2024
@wfurtwfurt
self-assigned this
Jun 12, 2024
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jun 12, 2024

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 13, 2024

Closed

rzikm
rzikm
reviewed
Jun 13, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo comments, but I would prefer @bartonjs to confirm that trusting everything to build a chain is okay.
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Outdated

Comment threadsrc/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@simonrozsival
simonrozsival
commented
Jun 20, 2024

Copy link


Copy Markdown

Member
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

This was referenced Jun 20, 2024

Open


Closed


Closed


Closed


Closed


Closed


Closed

rzikm
rzikm
approved these changes
Jun 21, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 21, 2024

Closed

3 tasks

This was referenced Jun 24, 2024

Closed


Closed

@wfurt
wfurt
merged commit 973237d
into
dotnet:mainJun 25, 2024
@wfurt
wfurt
commented
Jun 25, 2024

Copy link


Copy Markdown

MemberAuthor
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?
why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...?
@matouskozakmatouskozak
mentioned this pull request
Jun 26, 2024

Closed


This was referenced Jun 26, 2024
 Merged


Closed

simonrozsival pushed a commit
to simonrozsival/runtime
that referenced
this pull request
Jul 8, 2024
@wfurt@simonrozsival
use also SslCertificateTrust when constructing CertificateContext (do…
9f1b0c4
…tnet#103372)
* use also SslCertificateTrust when constructing CertificateContext
* 'build
* feedback
@simonrozsivalsimonrozsival
mentioned this pull request
Jul 8, 2024
 Merged

4 tasks
vitek-karas added a commit
that referenced
this pull request
Jul 15, 2024
@simonrozsival@wfurt@vitek-karas
[release/8.0-staging] use also SslCertificateTrust when constructing …
ce2fdb4
…CertificateContext (#104541)
Backport of #103372 and #104016 to release/8.0-staging
## Customer Impact
- [X] Customer reported (#100602)
- [ ] Found internally
Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform.
## Regression
- [ ] Yes
- [X] No
## Testing
Unit tests and manual testing on Android emulator.
## Risk
Low. The change is mostly limited to Android where this API doesn't currently work in many cases. ---------
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Jul 25, 2024
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@simonrozsivalsimonrozsivalsimonrozsival approved these changes
@rzikmrzikmrzikm approved these changes
@bartonjsbartonjsAwaiting requested review from bartonjs

Assignees

@wfurtwfurt

Labels

area-System.Net.Security

Projects


None yet


Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@wfurt@simonrozsival@rzikm

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
use also SslCertificateTrust when constructing CertificateContext - #103372
Merged
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Jun 25, 2024
Merged
use also SslCertificateTrust when constructing CertificateContext#103372
wfurt merged 6 commits into
dotnet:mainfrom 
wfurt:trust
Conversation
@wfurt
@wfurtwfurt
commented
Jun 12, 2024

Copy link


Copy Markdown

Member
there are two parts to this change.
When #54219 added support for SslCertificateTrust  it did impact only certificate validation but not SslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will use Trust if provided to construct the chain for consistency.
Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.

The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.
contributes to #100602

I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.
@wfurtwfurt
added this to the 9.0.0 milestone
Jun 12, 2024
@wfurtwfurt
self-assigned this
Jun 12, 2024
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jun 12, 2024

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones

See info in area-owners.md if you want to be subscribed.
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 13, 2024

Closed

rzikm
rzikm
reviewed
Jun 13, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo comments, but I would prefer @bartonjs to confirm that trusting everything to build a chain is okay.
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Outdated

Comment threadsrc/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@simonrozsival
simonrozsival
commented
Jun 20, 2024

Copy link


Copy Markdown

Member
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?

This was referenced Jun 20, 2024

Open


Closed


Closed


Closed


Closed


Closed


Closed

rzikm
rzikm
approved these changes
Jun 21, 2024
View reviewed changes
@rzikmrzikm
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@build-analysisbuild-analysisBot
mentioned this pull request
Jun 21, 2024

Closed

3 tasks

This was referenced Jun 24, 2024

Closed


Closed

@wfurt
wfurt
merged commit 973237d
into
dotnet:mainJun 25, 2024
@wfurt
wfurt
commented
Jun 25, 2024

Copy link


Copy Markdown

MemberAuthor
@wfurt the SslStream_ClientCertificateContext_SendsChain test will now work on Android and we can remove the ActiveIssue. Do you want to do that in this PR or should I open a follow-up PR and do that separately?
why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...?
@matouskozakmatouskozak
mentioned this pull request
Jun 26, 2024

Closed


This was referenced Jun 26, 2024
 Merged


Closed

simonrozsival pushed a commit
to simonrozsival/runtime
that referenced
this pull request
Jul 8, 2024
@wfurt@simonrozsival
use also SslCertificateTrust when constructing CertificateContext (do…
9f1b0c4
…tnet#103372)
* use also SslCertificateTrust when constructing CertificateContext
* 'build
* feedback
@simonrozsivalsimonrozsival
mentioned this pull request
Jul 8, 2024
 Merged

4 tasks
vitek-karas added a commit
that referenced
this pull request
Jul 15, 2024
@simonrozsival@wfurt@vitek-karas
[release/8.0-staging] use also SslCertificateTrust when constructing …
ce2fdb4
…CertificateContext (#104541)
Backport of #103372 and #104016 to release/8.0-staging
## Customer Impact
- [X] Customer reported (#100602)
- [ ] Found internally
Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform.
## Regression
- [ ] Yes
- [X] No
## Testing
Unit tests and manual testing on Android emulator.
## Risk
Low. The change is mostly limited to Android where this API doesn't currently work in many cases. ---------
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Jul 25, 2024
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@simonrozsivalsimonrozsivalsimonrozsival approved these changes
@rzikmrzikmrzikm approved these changes
@bartonjsbartonjsAwaiting requested review from bartonjs

Assignees

@wfurtwfurt

Labels

area-System.Net.Security

Projects


None yet


Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@wfurt@simonrozsival@rzikm