Add Apple chain status regression test#126811
Add Apple chain status regression test#126811artahir-dev wants to merge 1 commit intodotnet:mainfrom
Conversation
|
@artahir-dev please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement ( “Agreement” ) is agreed to by the party signing below ( “You” ), 1. Definitions. “Code” means the computer software code, whether in human-readable or machine-executable form, “Project” means any of the projects owned or managed by .NET Foundation and offered under a license “Submit” is the act of uploading, submitting, transmitting, or distributing code or other content to any “Submission” means the Code and any other copyrightable material Submitted by You, including any 2. Your Submission. You must agree to the terms of this Agreement before making a Submission to any 3. Originality of Work. You represent that each of Your Submissions is entirely Your 4. Your Employer. References to “employer” in this Agreement include Your employer or anyone else 5. Licenses. a. Copyright License. You grant .NET Foundation, and those who receive the Submission directly b. Patent License. You grant .NET Foundation, and those who receive the Submission directly or c. Other Rights Reserved. Each party reserves all rights not expressly granted in this Agreement. 6. Representations and Warranties. You represent that You are legally entitled to grant the above 7. Notice to .NET Foundation. You agree to notify .NET Foundation in writing of any facts or 8. Information about Submissions. You agree that contributions to Projects and information about 9. Governing Law/Jurisdiction. This Agreement is governed by the laws of the State of Washington, and 10. Entire Agreement/Assignment. This Agreement is the entire agreement between the parties, and .NET Foundation dedicates this Contribution License Agreement to the public domain according to the Creative Commons CC0 1. |
|
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security |
There was a problem hiding this comment.
Pull request overview
Adds a new macOS-focused regression test in System.Security.Cryptography to validate Apple chain-building behavior when a leaf certificate’s signature is tampered and AllowUnknownCertificateAuthority is set.
Changes:
- Add
ApplePartialChainTestscovering tampered-leaf chain build behavior on Apple platforms. - Add the new test file to
System.Security.Cryptography.Tests.csprojcompilation items.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
src/libraries/System.Security.Cryptography/tests/X509Certificates/ApplePartialChainTests.cs |
New regression test that builds a custom chain and asserts Apple-specific status/validity outcomes for a tampered leaf cert. |
src/libraries/System.Security.Cryptography/tests/System.Security.Cryptography.Tests.csproj |
Includes the new test file in the test project build. |
| using System.Security.Cryptography; | ||
| using System.Security.Cryptography.X509Certificates; | ||
| using Test.Cryptography; | ||
| using Xunit; |
|
|
||
| private static byte[] TamperSignature(byte[] cert) | ||
| { | ||
| byte[] mutated = cert.ToArray(); |
| req.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, false, 0, true)); | ||
| req.CertificateExtensions.Add(new X509SubjectKeyIdentifierExtension(req.PublicKey, false)); | ||
| X509Certificate2 cert = req.Create(root, DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(20), Guid.NewGuid().ToByteArray()); | ||
| return cert.CopyWithPrivateKey(key); | ||
| } |
| req.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(new OidCollection { new Oid("1.3.6.1.5.5.7.3.1") }, true)); | ||
| X509Certificate2 cert = req.Create(intermediate, DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(10), Guid.NewGuid().ToByteArray()); | ||
| return cert.CopyWithPrivateKey(leafKey); | ||
| } |
| using X509Certificate2 root = CreateRoot(out ECDsa rootKey); | ||
| using X509Certificate2 intermediate = CreateIntermediate(root, out ECDsa intermediateKey); | ||
| using X509Certificate2 leaf = CreateLeaf(intermediate, intermediateKey); |
| private static X509Certificate2 CreateLeaf(X509Certificate2 intermediate, ECDsa intermediateKey) | ||
| { | ||
| using ECDsa leafKey = ECDsa.Create(ECCurve.NamedCurves.nistP256); | ||
| var req = new CertificateRequest("CN=Leaf", leafKey, HashAlgorithmName.SHA256); |
| [Fact] | ||
| [PlatformSpecific(TestPlatforms.OSX)] | ||
| public static void TamperedSignature_WithAllowUnknownCertificateAuthority_IsAccepted_OnApple() | ||
| { |
| { | ||
| [Fact] | ||
| [PlatformSpecific(TestPlatforms.OSX)] | ||
| public static void TamperedSignature_WithAllowUnknownCertificateAuthority_IsAccepted_OnApple() |
There was a problem hiding this comment.
I'm not quite sure what the purpose of the test is, but it doesn't seem like it needs a new file. Mostly it looks like it would belong in DynamicChainTests, maybe as a variant (or additional step) in BuildInvalidSignatureTwice, maybe as a new test.
No description provided.