Fix SslStream client certificate credential caching

[rzikm]

Fixes#131992.

On Windows, SslStream intentionally starts mutual authentication with anonymous credentials when no matching client-certificate credential is cached. When the certificate was supplied through ClientCertificateContext, the selected certificate state was cleared but the context remained on the shared authentication options. The TlsSession/Schannel path could therefore acquire a certificate-bearing credential and cache it under the anonymous key, allowing a later connection without a client certificate to reuse it.

This change temporarily detaches ClientCertificateContext while acquiring the initial anonymous credential, then restores it immediately after credential acquisition completes.

A Windows-only RemoteExecutor regression test verifies that a connection using ClientCertificateContext does not pollute the anonymous credential cache for a subsequent connection with a different target host and no certificate. The test covers TLS 1.2 and TLS 1.3.

Local validation:

• build.cmd clr+libs -rc release
• System.Net.Security product build
• New regression test: 2 passed
• ClientChangeCert_NoResume: 3 passed
• SslStream_NegotiateClientCertificateAsyncTls13_Succeeds: 2 passed
• ServerAsyncAuthenticate_EachSupportedProtocol_Success: 2 passed

The full System.Net.Security functional suite ran 5,279 tests with one unrelated failure that reproduces in isolation: TlsSessionTests.ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert (Expected: Not None, Actual: None).

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR adjusts SslStream’s Windows client-credential acquisition flow to prevent a client-certificate credential (provided via ClientCertificateContext) from being cached under the “anonymous” credential cache key, and adds a Windows-only regression test to validate the behavior across TLS 1.2 and TLS 1.3.

Changes:

• Temporarily detaches SslStreamCertificateContext while acquiring an initial anonymous credential and restores it when client credentials are requested (or on stream teardown).
• Adds a Windows-only RemoteExecutor regression test to ensure a connection without a client certificate cannot reuse a previously cached client-certificate credential.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs	Adds a Windows-only regression test validating credential-cache isolation when using ClientCertificateContext.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Detaches/restores client CertificateContext during anonymous-credential acquisition to prevent cache pollution.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:87

• Pass the protocol argument to RemoteExecutor using an invariant-culture conversion. If the parent process is running under a non-invariant culture, ((int)protocol).ToString() can emit native digits, which may not round-trip reliably in the child process.

 }, ((int)protocol).ToString()).DisposeAsync();

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:56

• The new RemoteExecutor-based regression test runs once per entry in SupportedSslProtocolsTestData (TLS 1.0/1.1/1.2/1.3, potentially SSL3 depending on platform settings). That increases test runtime and can introduce coverage over obsolete protocols that aren’t relevant to the reported caching issue (described as TLS 1.2/1.3). Consider narrowing the data source to TLS 1.2 and (when supported) TLS 1.3.

 [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
[ClassData(typeof(SslProtocolSupport.SupportedSslProtocolsTestData))]
[PlatformSpecific(TestPlatforms.Windows)]
public async Task SslStream_ClientCertificateContext_DoesNotPolluteAnonymousCredentialCache(SslProtocols protocol)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[rzikm]

Fixes#131992.

On Windows, SslStream intentionally starts mutual authentication with anonymous credentials when no matching client-certificate credential is cached. When the certificate was supplied through ClientCertificateContext, the selected certificate state was cleared but the context remained on the shared authentication options. The TlsSession/Schannel path could therefore acquire a certificate-bearing credential and cache it under the anonymous key, allowing a later connection without a client certificate to reuse it.

This change temporarily detaches ClientCertificateContext while acquiring the initial anonymous credential, then restores it immediately after credential acquisition completes.

A Windows-only RemoteExecutor regression test verifies that a connection using ClientCertificateContext does not pollute the anonymous credential cache for a subsequent connection with a different target host and no certificate. The test covers TLS 1.2 and TLS 1.3.

Local validation:

• build.cmd clr+libs -rc release
• System.Net.Security product build
• New regression test: 2 passed
• ClientChangeCert_NoResume: 3 passed
• SslStream_NegotiateClientCertificateAsyncTls13_Succeeds: 2 passed
• ServerAsyncAuthenticate_EachSupportedProtocol_Success: 2 passed

The full System.Net.Security functional suite ran 5,279 tests with one unrelated failure that reproduces in isolation: TlsSessionTests.ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert (Expected: Not None, Actual: None).

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR adjusts SslStream’s Windows client-credential acquisition flow to prevent a client-certificate credential (provided via ClientCertificateContext) from being cached under the “anonymous” credential cache key, and adds a Windows-only regression test to validate the behavior across TLS 1.2 and TLS 1.3.

Changes:

• Temporarily detaches SslStreamCertificateContext while acquiring an initial anonymous credential and restores it when client credentials are requested (or on stream teardown).
• Adds a Windows-only RemoteExecutor regression test to ensure a connection without a client certificate cannot reuse a previously cached client-certificate credential.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs	Adds a Windows-only regression test validating credential-cache isolation when using ClientCertificateContext.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Detaches/restores client CertificateContext during anonymous-credential acquisition to prevent cache pollution.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:87

• Pass the protocol argument to RemoteExecutor using an invariant-culture conversion. If the parent process is running under a non-invariant culture, ((int)protocol).ToString() can emit native digits, which may not round-trip reliably in the child process.

 }, ((int)protocol).ToString()).DisposeAsync();

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:56

• The new RemoteExecutor-based regression test runs once per entry in SupportedSslProtocolsTestData (TLS 1.0/1.1/1.2/1.3, potentially SSL3 depending on platform settings). That increases test runtime and can introduce coverage over obsolete protocols that aren’t relevant to the reported caching issue (described as TLS 1.2/1.3). Consider narrowing the data source to TLS 1.2 and (when supported) TLS 1.3.

 [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
[ClassData(typeof(SslProtocolSupport.SupportedSslProtocolsTestData))]
[PlatformSpecific(TestPlatforms.Windows)]
public async Task SslStream_ClientCertificateContext_DoesNotPolluteAnonymousCredentialCache(SslProtocols protocol)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[rzikm]

Fixes#131992.

On Windows, SslStream intentionally starts mutual authentication with anonymous credentials when no matching client-certificate credential is cached. When the certificate was supplied through ClientCertificateContext, the selected certificate state was cleared but the context remained on the shared authentication options. The TlsSession/Schannel path could therefore acquire a certificate-bearing credential and cache it under the anonymous key, allowing a later connection without a client certificate to reuse it.

This change temporarily detaches ClientCertificateContext while acquiring the initial anonymous credential, then restores it immediately after credential acquisition completes.

A Windows-only RemoteExecutor regression test verifies that a connection using ClientCertificateContext does not pollute the anonymous credential cache for a subsequent connection with a different target host and no certificate. The test covers TLS 1.2 and TLS 1.3.

Local validation:

• build.cmd clr+libs -rc release
• System.Net.Security product build
• New regression test: 2 passed
• ClientChangeCert_NoResume: 3 passed
• SslStream_NegotiateClientCertificateAsyncTls13_Succeeds: 2 passed
• ServerAsyncAuthenticate_EachSupportedProtocol_Success: 2 passed

The full System.Net.Security functional suite ran 5,279 tests with one unrelated failure that reproduces in isolation: TlsSessionTests.ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert (Expected: Not None, Actual: None).

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR adjusts SslStream’s Windows client-credential acquisition flow to prevent a client-certificate credential (provided via ClientCertificateContext) from being cached under the “anonymous” credential cache key, and adds a Windows-only regression test to validate the behavior across TLS 1.2 and TLS 1.3.

Changes:

• Temporarily detaches SslStreamCertificateContext while acquiring an initial anonymous credential and restores it when client credentials are requested (or on stream teardown).
• Adds a Windows-only RemoteExecutor regression test to ensure a connection without a client certificate cannot reuse a previously cached client-certificate credential.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs	Adds a Windows-only regression test validating credential-cache isolation when using ClientCertificateContext.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Detaches/restores client CertificateContext during anonymous-credential acquisition to prevent cache pollution.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:87

• Pass the protocol argument to RemoteExecutor using an invariant-culture conversion. If the parent process is running under a non-invariant culture, ((int)protocol).ToString() can emit native digits, which may not round-trip reliably in the child process.

 }, ((int)protocol).ToString()).DisposeAsync();

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:56

• The new RemoteExecutor-based regression test runs once per entry in SupportedSslProtocolsTestData (TLS 1.0/1.1/1.2/1.3, potentially SSL3 depending on platform settings). That increases test runtime and can introduce coverage over obsolete protocols that aren’t relevant to the reported caching issue (described as TLS 1.2/1.3). Consider narrowing the data source to TLS 1.2 and (when supported) TLS 1.3.

 [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
[ClassData(typeof(SslProtocolSupport.SupportedSslProtocolsTestData))]
[PlatformSpecific(TestPlatforms.Windows)]
public async Task SslStream_ClientCertificateContext_DoesNotPolluteAnonymousCredentialCache(SslProtocols protocol)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[rzikm]

Fixes#131992.

On Windows, SslStream intentionally starts mutual authentication with anonymous credentials when no matching client-certificate credential is cached. When the certificate was supplied through ClientCertificateContext, the selected certificate state was cleared but the context remained on the shared authentication options. The TlsSession/Schannel path could therefore acquire a certificate-bearing credential and cache it under the anonymous key, allowing a later connection without a client certificate to reuse it.

This change temporarily detaches ClientCertificateContext while acquiring the initial anonymous credential, then restores it immediately after credential acquisition completes.

A Windows-only RemoteExecutor regression test verifies that a connection using ClientCertificateContext does not pollute the anonymous credential cache for a subsequent connection with a different target host and no certificate. The test covers TLS 1.2 and TLS 1.3.

Local validation:

• build.cmd clr+libs -rc release
• System.Net.Security product build
• New regression test: 2 passed
• ClientChangeCert_NoResume: 3 passed
• SslStream_NegotiateClientCertificateAsyncTls13_Succeeds: 2 passed
• ServerAsyncAuthenticate_EachSupportedProtocol_Success: 2 passed

The full System.Net.Security functional suite ran 5,279 tests with one unrelated failure that reproduces in isolation: TlsSessionTests.ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert (Expected: Not None, Actual: None).

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR adjusts SslStream’s Windows client-credential acquisition flow to prevent a client-certificate credential (provided via ClientCertificateContext) from being cached under the “anonymous” credential cache key, and adds a Windows-only regression test to validate the behavior across TLS 1.2 and TLS 1.3.

Changes:

• Temporarily detaches SslStreamCertificateContext while acquiring an initial anonymous credential and restores it when client credentials are requested (or on stream teardown).
• Adds a Windows-only RemoteExecutor regression test to ensure a connection without a client certificate cannot reuse a previously cached client-certificate credential.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs	Adds a Windows-only regression test validating credential-cache isolation when using ClientCertificateContext.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Detaches/restores client CertificateContext during anonymous-credential acquisition to prevent cache pollution.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:87

• Pass the protocol argument to RemoteExecutor using an invariant-culture conversion. If the parent process is running under a non-invariant culture, ((int)protocol).ToString() can emit native digits, which may not round-trip reliably in the child process.

 }, ((int)protocol).ToString()).DisposeAsync();

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:56

• The new RemoteExecutor-based regression test runs once per entry in SupportedSslProtocolsTestData (TLS 1.0/1.1/1.2/1.3, potentially SSL3 depending on platform settings). That increases test runtime and can introduce coverage over obsolete protocols that aren’t relevant to the reported caching issue (described as TLS 1.2/1.3). Consider narrowing the data source to TLS 1.2 and (when supported) TLS 1.3.

 [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
[ClassData(typeof(SslProtocolSupport.SupportedSslProtocolsTestData))]
[PlatformSpecific(TestPlatforms.Windows)]
public async Task SslStream_ClientCertificateContext_DoesNotPolluteAnonymousCredentialCache(SslProtocols protocol)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[rzikm]

Fixes#131992.

On Windows, SslStream intentionally starts mutual authentication with anonymous credentials when no matching client-certificate credential is cached. When the certificate was supplied through ClientCertificateContext, the selected certificate state was cleared but the context remained on the shared authentication options. The TlsSession/Schannel path could therefore acquire a certificate-bearing credential and cache it under the anonymous key, allowing a later connection without a client certificate to reuse it.

This change temporarily detaches ClientCertificateContext while acquiring the initial anonymous credential, then restores it immediately after credential acquisition completes.

A Windows-only RemoteExecutor regression test verifies that a connection using ClientCertificateContext does not pollute the anonymous credential cache for a subsequent connection with a different target host and no certificate. The test covers TLS 1.2 and TLS 1.3.

Local validation:

• build.cmd clr+libs -rc release
• System.Net.Security product build
• New regression test: 2 passed
• ClientChangeCert_NoResume: 3 passed
• SslStream_NegotiateClientCertificateAsyncTls13_Succeeds: 2 passed
• ServerAsyncAuthenticate_EachSupportedProtocol_Success: 2 passed

The full System.Net.Security functional suite ran 5,279 tests with one unrelated failure that reproduces in isolation: TlsSessionTests.ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert (Expected: Not None, Actual: None).

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR adjusts SslStream’s Windows client-credential acquisition flow to prevent a client-certificate credential (provided via ClientCertificateContext) from being cached under the “anonymous” credential cache key, and adds a Windows-only regression test to validate the behavior across TLS 1.2 and TLS 1.3.

Changes:

• Temporarily detaches SslStreamCertificateContext while acquiring an initial anonymous credential and restores it when client credentials are requested (or on stream teardown).
• Adds a Windows-only RemoteExecutor regression test to ensure a connection without a client certificate cannot reuse a previously cached client-certificate credential.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs	Adds a Windows-only regression test validating credential-cache isolation when using ClientCertificateContext.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Detaches/restores client CertificateContext during anonymous-credential acquisition to prevent cache pollution.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:87

• Pass the protocol argument to RemoteExecutor using an invariant-culture conversion. If the parent process is running under a non-invariant culture, ((int)protocol).ToString() can emit native digits, which may not round-trip reliably in the child process.

 }, ((int)protocol).ToString()).DisposeAsync();

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:56

• The new RemoteExecutor-based regression test runs once per entry in SupportedSslProtocolsTestData (TLS 1.0/1.1/1.2/1.3, potentially SSL3 depending on platform settings). That increases test runtime and can introduce coverage over obsolete protocols that aren’t relevant to the reported caching issue (described as TLS 1.2/1.3). Consider narrowing the data source to TLS 1.2 and (when supported) TLS 1.3.

 [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
[ClassData(typeof(SslProtocolSupport.SupportedSslProtocolsTestData))]
[PlatformSpecific(TestPlatforms.Windows)]
public async Task SslStream_ClientCertificateContext_DoesNotPolluteAnonymousCredentialCache(SslProtocols protocol)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[rzikm]

Fixes#131992.

On Windows, SslStream intentionally starts mutual authentication with anonymous credentials when no matching client-certificate credential is cached. When the certificate was supplied through ClientCertificateContext, the selected certificate state was cleared but the context remained on the shared authentication options. The TlsSession/Schannel path could therefore acquire a certificate-bearing credential and cache it under the anonymous key, allowing a later connection without a client certificate to reuse it.

This change temporarily detaches ClientCertificateContext while acquiring the initial anonymous credential, then restores it immediately after credential acquisition completes.

A Windows-only RemoteExecutor regression test verifies that a connection using ClientCertificateContext does not pollute the anonymous credential cache for a subsequent connection with a different target host and no certificate. The test covers TLS 1.2 and TLS 1.3.

Local validation:

• build.cmd clr+libs -rc release
• System.Net.Security product build
• New regression test: 2 passed
• ClientChangeCert_NoResume: 3 passed
• SslStream_NegotiateClientCertificateAsyncTls13_Succeeds: 2 passed
• ServerAsyncAuthenticate_EachSupportedProtocol_Success: 2 passed

The full System.Net.Security functional suite ran 5,279 tests with one unrelated failure that reproduces in isolation: TlsSessionTests.ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert (Expected: Not None, Actual: None).

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR adjusts SslStream’s Windows client-credential acquisition flow to prevent a client-certificate credential (provided via ClientCertificateContext) from being cached under the “anonymous” credential cache key, and adds a Windows-only regression test to validate the behavior across TLS 1.2 and TLS 1.3.

Changes:

• Temporarily detaches SslStreamCertificateContext while acquiring an initial anonymous credential and restores it when client credentials are requested (or on stream teardown).
• Adds a Windows-only RemoteExecutor regression test to ensure a connection without a client certificate cannot reuse a previously cached client-certificate credential.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs	Adds a Windows-only regression test validating credential-cache isolation when using ClientCertificateContext.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Detaches/restores client CertificateContext during anonymous-credential acquisition to prevent cache pollution.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:87

• Pass the protocol argument to RemoteExecutor using an invariant-culture conversion. If the parent process is running under a non-invariant culture, ((int)protocol).ToString() can emit native digits, which may not round-trip reliably in the child process.

 }, ((int)protocol).ToString()).DisposeAsync();

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:56

• The new RemoteExecutor-based regression test runs once per entry in SupportedSslProtocolsTestData (TLS 1.0/1.1/1.2/1.3, potentially SSL3 depending on platform settings). That increases test runtime and can introduce coverage over obsolete protocols that aren’t relevant to the reported caching issue (described as TLS 1.2/1.3). Consider narrowing the data source to TLS 1.2 and (when supported) TLS 1.3.

 [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
[ClassData(typeof(SslProtocolSupport.SupportedSslProtocolsTestData))]
[PlatformSpecific(TestPlatforms.Windows)]
public async Task SslStream_ClientCertificateContext_DoesNotPolluteAnonymousCredentialCache(SslProtocols protocol)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[rzikm]

Fixes#131992.

On Windows, SslStream intentionally starts mutual authentication with anonymous credentials when no matching client-certificate credential is cached. When the certificate was supplied through ClientCertificateContext, the selected certificate state was cleared but the context remained on the shared authentication options. The TlsSession/Schannel path could therefore acquire a certificate-bearing credential and cache it under the anonymous key, allowing a later connection without a client certificate to reuse it.

This change temporarily detaches ClientCertificateContext while acquiring the initial anonymous credential, then restores it immediately after credential acquisition completes.

A Windows-only RemoteExecutor regression test verifies that a connection using ClientCertificateContext does not pollute the anonymous credential cache for a subsequent connection with a different target host and no certificate. The test covers TLS 1.2 and TLS 1.3.

Local validation:

• build.cmd clr+libs -rc release
• System.Net.Security product build
• New regression test: 2 passed
• ClientChangeCert_NoResume: 3 passed
• SslStream_NegotiateClientCertificateAsyncTls13_Succeeds: 2 passed
• ServerAsyncAuthenticate_EachSupportedProtocol_Success: 2 passed

The full System.Net.Security functional suite ran 5,279 tests with one unrelated failure that reproduces in isolation: TlsSessionTests.ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert (Expected: Not None, Actual: None).

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR adjusts SslStream’s Windows client-credential acquisition flow to prevent a client-certificate credential (provided via ClientCertificateContext) from being cached under the “anonymous” credential cache key, and adds a Windows-only regression test to validate the behavior across TLS 1.2 and TLS 1.3.

Changes:

• Temporarily detaches SslStreamCertificateContext while acquiring an initial anonymous credential and restores it when client credentials are requested (or on stream teardown).
• Adds a Windows-only RemoteExecutor regression test to ensure a connection without a client certificate cannot reuse a previously cached client-certificate credential.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs	Adds a Windows-only regression test validating credential-cache isolation when using ClientCertificateContext.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Detaches/restores client CertificateContext during anonymous-credential acquisition to prevent cache pollution.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:87

• Pass the protocol argument to RemoteExecutor using an invariant-culture conversion. If the parent process is running under a non-invariant culture, ((int)protocol).ToString() can emit native digits, which may not round-trip reliably in the child process.

 }, ((int)protocol).ToString()).DisposeAsync();

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:56

• The new RemoteExecutor-based regression test runs once per entry in SupportedSslProtocolsTestData (TLS 1.0/1.1/1.2/1.3, potentially SSL3 depending on platform settings). That increases test runtime and can introduce coverage over obsolete protocols that aren’t relevant to the reported caching issue (described as TLS 1.2/1.3). Consider narrowing the data source to TLS 1.2 and (when supported) TLS 1.3.

 [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
[ClassData(typeof(SslProtocolSupport.SupportedSslProtocolsTestData))]
[PlatformSpecific(TestPlatforms.Windows)]
public async Task SslStream_ClientCertificateContext_DoesNotPolluteAnonymousCredentialCache(SslProtocols protocol)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[rzikm]

Fixes#131992.

On Windows, SslStream intentionally starts mutual authentication with anonymous credentials when no matching client-certificate credential is cached. When the certificate was supplied through ClientCertificateContext, the selected certificate state was cleared but the context remained on the shared authentication options. The TlsSession/Schannel path could therefore acquire a certificate-bearing credential and cache it under the anonymous key, allowing a later connection without a client certificate to reuse it.

This change temporarily detaches ClientCertificateContext while acquiring the initial anonymous credential, then restores it immediately after credential acquisition completes.

A Windows-only RemoteExecutor regression test verifies that a connection using ClientCertificateContext does not pollute the anonymous credential cache for a subsequent connection with a different target host and no certificate. The test covers TLS 1.2 and TLS 1.3.

Local validation:

• build.cmd clr+libs -rc release
• System.Net.Security product build
• New regression test: 2 passed
• ClientChangeCert_NoResume: 3 passed
• SslStream_NegotiateClientCertificateAsyncTls13_Succeeds: 2 passed
• ServerAsyncAuthenticate_EachSupportedProtocol_Success: 2 passed

The full System.Net.Security functional suite ran 5,279 tests with one unrelated failure that reproduces in isolation: TlsSessionTests.ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert (Expected: Not None, Actual: None).

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR adjusts SslStream’s Windows client-credential acquisition flow to prevent a client-certificate credential (provided via ClientCertificateContext) from being cached under the “anonymous” credential cache key, and adds a Windows-only regression test to validate the behavior across TLS 1.2 and TLS 1.3.

Changes:

• Temporarily detaches SslStreamCertificateContext while acquiring an initial anonymous credential and restores it when client credentials are requested (or on stream teardown).
• Adds a Windows-only RemoteExecutor regression test to ensure a connection without a client certificate cannot reuse a previously cached client-certificate credential.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs	Adds a Windows-only regression test validating credential-cache isolation when using ClientCertificateContext.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Detaches/restores client CertificateContext during anonymous-credential acquisition to prevent cache pollution.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:87

• Pass the protocol argument to RemoteExecutor using an invariant-culture conversion. If the parent process is running under a non-invariant culture, ((int)protocol).ToString() can emit native digits, which may not round-trip reliably in the child process.

 }, ((int)protocol).ToString()).DisposeAsync();

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCredentialCacheTest.cs:56

• The new RemoteExecutor-based regression test runs once per entry in SupportedSslProtocolsTestData (TLS 1.0/1.1/1.2/1.3, potentially SSL3 depending on platform settings). That increases test runtime and can introduce coverage over obsolete protocols that aren’t relevant to the reported caching issue (described as TLS 1.2/1.3). Consider narrowing the data source to TLS 1.2 and (when supported) TLS 1.3.

 [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
[ClassData(typeof(SslProtocolSupport.SupportedSslProtocolsTestData))]
[PlatformSpecific(TestPlatforms.Windows)]
public async Task SslStream_ClientCertificateContext_DoesNotPolluteAnonymousCredentialCache(SslProtocols protocol)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.