Implement part of SslCertificateTrust by wfurt · Pull Request #55104 · dotnet/runtime

wfurt · 2021-07-02T22:11:01Z

related to #54219
This adds approved API and uses provided certificate for managing trust.
I assume we don't need anything beyond chain.ChainPolicy.TrustMode, right @bartonjs?

This also adds support for sending Distinguished Names on Windows.
The caveat is that it depends on registry setting as well as very new Windows builds.
So testing is problematic and I did some manual preliminary test.

…tStore

ghost · 2021-07-02T22:11:05Z

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

related to #54219
This adds approved API and uses provided certificate for managing trust.
I assume we don't need anything beyond chain.ChainPolicy.TrustMode, right @bartonjs?

This also adds support for sending Distinguished Names on Windows.
The caveat is that it depends on registry setting as well as very new Windows builds.
So testing is problematic and I did some manual preliminary test.

Author:	wfurt
Assignees:	wfurt
Labels:	`area-System.Net.Security`
Milestone:	-

ghost · 2021-07-02T22:11:05Z

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

wfurt · 2021-07-05T23:11:08Z

feedback addressed, CI is clean.

geoffkizer · 2021-07-08T01:10:19Z

+
+ if (errorCode != Interop.SECURITY_STATUS.OK)
+ {
+ throw new Win32Exception((int)errorCode);


Shouldn't we be throwing something other than Win32Exception here?

I'm not sure. I look at the code around Acquire Credentials and it seems like that what we throw. I can check as we may perhaps wrap it.

geoffkizer · 2021-07-08T01:13:14Z

Tests?

wfurt · 2021-07-08T01:58:15Z

Tests?

As I mentioned tests are problematic on Windows as the handshake depends on registry setting and very recent Windows changes. I'll try to figure out something but for now I would like to defer it. More changes are still coming for #54219.

ManickaP

LGTM, small comments. Please do get another approval, I'm not an expert here, barely noob.

wfurt · 2021-07-12T19:57:09Z

mono build failures are independent.

wfurt added 11 commits March 23, 2021 15:33

snatpshot
ecf3b37

Merge branch 'main' ofhttps://github.com/dotnet/runtimeinto certStore
6e1e6e0

snapshot
fd261f7

Merge branch 'main' ofhttps://github.com/dotnet/runtimeinto certStore
d1a7d86

add csproj'
d30e84d

Merge branch 'certStore' ofhttps://github.com/wfurt/runtimeinto cer…
d7e8f33
…tStore

Merge branch 'main' ofhttps://github.com/dotnet/runtimeinto certStore
27550fb

update
0287155

Merge branch 'main' ofhttps://github.com/dotnet/runtimeinto certStore
9f914ac

more ckeanup
fcb92b7

more cleanup
7b176d5

wfurt added the area-System.Net.Security label Jul 2, 2021

wfurt requested review from a team and bartonjs July 2, 2021 22:11

wfurt self-assigned this Jul 2, 2021

ghost added the new-api-needs-documentation label Jul 2, 2021

jkotas reviewed Jul 2, 2021
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Windows/SspiCli/Interop.SSPI.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Windows/SspiCli/Interop.SSPI.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Windows/SspiCli/Interop.SSPI.cs Outdated

bartonjs reviewed Jul 2, 2021
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs Outdated

bartonjs reviewed Jul 2, 2021
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/ref/System.Net.Security.cs Outdated

wfurt added 2 commits July 3, 2021 12:02

feedback from review
d94a9fe

fix mail tests
da18f0e

geoffkizer reviewed Jul 7, 2021
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslCertificateTrust.cs Outdated

geoffkizer reviewed Jul 7, 2021
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslCertificateTrust.cs Outdated

feedabck from review
ebf9412

geoffkizer reviewed Jul 8, 2021
View reviewed changes

Comment thread...libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.Windows.cs Outdated

geoffkizer reviewed Jul 8, 2021
View reviewed changes

feedback from review
d1052d7

ManickaP approved these changes Jul 9, 2021
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System.Net.Security.csproj
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslCertificateTrust.cs
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslCertificateTrust.cs

make constructor private
f53c003

wfurt merged commit cd4df7d into dotnet:mainJul 12, 2021

wfurt deleted the certStore branch July 12, 2021 19:57

karelz added this to the 6.0.0 milestone Jul 15, 2021

This was referenced Jul 16, 2021
Add API to control trust during TLS handshake #54219
Closed
Add ability to send SslCertificateTrust in TLS handshake on Linux and macOS #55802
Closed

ManickaP mentioned this pull request Jul 20, 2021
[QUIC] Remove AppContext switch from S.N.Quic #56027
Merged

ghost locked as resolved and limited conversation to collaborators Aug 14, 2021

Uh oh!

Conversation

wfurt commented Jul 2, 2021

Uh oh!

ghost commented Jul 2, 2021

Uh oh!

ghost commented Jul 2, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wfurt commented Jul 5, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geoffkizerJul 8, 2021

Choose a reason for hiding this comment

Uh oh!

wfurtJul 8, 2021

Choose a reason for hiding this comment

Uh oh!

geoffkizer commented Jul 8, 2021

Uh oh!

wfurt commented Jul 8, 2021

Uh oh!

ManickaP left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wfurt commented Jul 12, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants