Skip to content

fix failing revocation & ssl tests #38827

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 8, 2020
Merged

fix failing revocation & ssl tests #38827

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
24257fb
fix failing tests
wfurt Jul 6, 2020
ea256cf
fix casing
wfurt Jul 7, 2020
52cec0c
feedback from review
wfurt Jul 7, 2020
1b0fa73
style update
wfurt Jul 7, 2020
ba4eca9
retire EndEntityIsServer
wfurt Jul 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 32 additions & 13 deletions ...raries/Common/tests/System/Security/Cryptography/X509Certificates/CertificateAuthority.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ public enum PkiOptions
IssuerRevocationViaOcsp = 1 << 1,
EndEntityRevocationViaCrl = 1 << 2,
EndEntityRevocationViaOcsp = 1 << 3,
EndEntityIsServer = 1 << 4,

CrlEverywhere = IssuerRevocationViaCrl | EndEntityRevocationViaCrl,
OcspEverywhere = IssuerRevocationViaOcsp | EndEntityRevocationViaOcsp,
Expand Down Expand Up @@ -106,6 +107,11 @@ internal sealed class CertificateAuthority : IDisposable
internal DateTimeOffset? RevocationExpiration { get; set; }
internal bool CorruptRevocationIssuerName { get; set; }

// All keys created in this method are smaller than recommended,
// but they only live for a few seconds (at most),
// and never communicate out of process.
const int DefaultKeySize = 1024;

internal CertificateAuthority(
X509Certificate2 cert,
string aiaHttpUrl,
Expand Down Expand Up @@ -169,6 +175,18 @@ internal X509Certificate2 CreateSubordinateCA(
}

internal X509Certificate2 CreateEndEntity(string subject, RSA publicKey, X509Extension altName)
{
return CreateCertificate(
subject,
publicKey,
TimeSpan.FromSeconds(2),
s_eeConstraints,
s_eeKeyUsage,
s_tlsClientEku,
altName: altName);
}

internal X509Certificate2 CreateServerEndEntity(string subject, RSA publicKey, X509Extension altName)
{
return CreateCertificate(
subject,
Expand Down Expand Up @@ -841,28 +859,25 @@ internal static void BuildPrivatePki(
string testName = null,
bool registerAuthorities = true,
bool pkiOptionsInSubject = false,
string subjectName = null)
string subjectName = null,
int keySize = DefaultKeySize)
{
bool rootDistributionViaHttp = !pkiOptions.HasFlag(PkiOptions.NoRootCertDistributionUri);
bool issuerRevocationViaCrl = pkiOptions.HasFlag(PkiOptions.IssuerRevocationViaCrl);
bool issuerRevocationViaOcsp = pkiOptions.HasFlag(PkiOptions.IssuerRevocationViaOcsp);
bool issuerDistributionViaHttp = !pkiOptions.HasFlag(PkiOptions.NoIssuerCertDistributionUri);
bool endEntityRevocationViaCrl = pkiOptions.HasFlag(PkiOptions.EndEntityRevocationViaCrl);
bool endEntityRevocationViaOcsp = pkiOptions.HasFlag(PkiOptions.EndEntityRevocationViaOcsp);
bool endEntityIsServer = pkiOptions.HasFlag(PkiOptions.EndEntityIsServer);

Assert.True(
issuerRevocationViaCrl || issuerRevocationViaOcsp ||
endEntityRevocationViaCrl || endEntityRevocationViaOcsp,
"At least one revocation mode is enabled");

// All keys created in this method are smaller than recommended,
// but they only live for a few seconds (at most),
// and never communicate out of process.
const int KeySize = 1024;

using (RSA rootKey = RSA.Create(KeySize))
using (RSA intermedKey = RSA.Create(KeySize))
using (RSA eeKey = RSA.Create(KeySize))
using (RSA rootKey = RSA.Create(keySize))
using (RSA intermedKey = RSA.Create(keySize))
using (RSA eeKey = RSA.Create(keySize))
{
var rootReq = new CertificateRequest(
BuildSubject("A Revocation Test Root", testName, pkiOptions, pkiOptionsInSubject),
Expand Down Expand Up @@ -929,10 +944,14 @@ internal static void BuildPrivatePki(
altName = builder.Build();
}

endEntityCert = intermediateAuthority.CreateEndEntity(
BuildSubject(subjectName ?? "A Revocation Test Cert", testName, pkiOptions, pkiOptionsInSubject),
eeKey,
altName);
endEntityCert = endEntityIsServer ?
intermediateAuthority.CreateServerEndEntity(
Copy link
Member

@bartonjs bartonjs Jul 7, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really this feels like it should just take an OidCollection or Oid or string, rather than using a bit in the PkiOptions.

Copy link
Member Author

@wfurt wfurt Jul 7, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking about adding bool to BuildPrivatePki() but OidCollection seems like better option. I think more variations are yet to come.

BuildSubject(subjectName ?? "A Revocation Test Cert", testName, pkiOptions, pkiOptionsInSubject),
eeKey, altName) :
intermediateAuthority.CreateEndEntity(
BuildSubject(subjectName ?? "A Revocation Test Cert", testName, pkiOptions, pkiOptionsInSubject),
eeKey, altName);

endEntityCert = endEntityCert.CopyWithPrivateKey(eeKey);
}

Expand Down
5 changes: 3 additions & 2 deletions src/libraries/System.Net.Security/tests/FunctionalTests/TestHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,13 +55,14 @@ internal static (X509Certificate2 certificate, X509Certificate2Collection) Gener
X509Certificate2Collection chain = new X509Certificate2Collection();

CertificateAuthority.BuildPrivatePki(
PkiOptions.IssuerRevocationViaCrl,
PkiOptions.IssuerRevocationViaCrl | PkiOptions.EndEntityIsServer,
out RevocationResponder responder,
out CertificateAuthority root,
out CertificateAuthority intermediate,
out X509Certificate2 endEntity,
subjectName: name,
testName: testName);
testName: testName,
keySize: 2048);

chain.Add(intermediate.CloneIssuerCert());
chain.Add(root.CloneIssuerCert());
Expand Down