Skip to content

Commit d9e8e3f

Browse files
vcsjonesvcsjones
authored
Remove dependency on System.Security.Cryptography.Native.OpenSsl in QUIC
1 parent 61fc02b commit d9e8e3f

File tree

3 files changed

+20
-50
lines changed

3 files changed

+20
-50
lines changed

‎src/libraries/Common/src/System/Net/Security/CertificateValidation.OSX.cs

Lines changed: 11 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,9 @@ internal static class CertificateValidation
1313
{
1414
private static readonly IdnMapping s_idnMapping = new IdnMapping();
1515

16-
// WARNING: This function will do the verification using OpenSSL. If the intention is to use OS function, caller should use CertificatePal interface.
17-
internal static SslPolicyErrors BuildChainAndVerifyProperties(X509Chain chain, X509Certificate2 remoteCertificate, bool checkCertName, bool _ /*isServer*/, string? hostName, Span<byte> certificateBuffer)
16+
#pragma warning disable IDE0060
17+
internal static SslPolicyErrors BuildChainAndVerifyProperties(X509Chain chain, X509Certificate2 remoteCertificate, bool checkCertName, bool isServer, string? hostName, Span<byte> certificateBuffer)
18+
#pragma warning restore IDE0060
1819
{
1920
SslPolicyErrors errors = chain.Build(remoteCertificate) ?
2021
SslPolicyErrors.None :
@@ -30,53 +31,19 @@ internal static SslPolicyErrors BuildChainAndVerifyProperties(X509Chain chain, X
3031
return errors | SslPolicyErrors.RemoteCertificateNameMismatch;
3132
}
3233

33-
SafeX509Handle certHandle;
34-
unsafe
34+
bool match;
35+
36+
if (IPAddress.TryParse(hostName, out _))
3537
{
36-
if (certificateBuffer.Length > 0)
37-
{
38-
fixed (byte* pCert = certificateBuffer)
39-
{
40-
certHandle = Interop.Crypto.DecodeX509((IntPtr)pCert, certificateBuffer.Length);
41-
}
42-
}
43-
else
44-
{
45-
// We dont't have DER encoded buffer.
46-
byte[] der = remoteCertificate.Export(X509ContentType.Cert);
47-
fixed (byte* pDer = der)
48-
{
49-
certHandle = Interop.Crypto.DecodeX509((IntPtr)pDer, der.Length);
50-
}
51-
}
38+
match = remoteCertificate.MatchesHostname(hostName);
5239
}
53-
54-
int hostNameMatch;
55-
using (certHandle)
40+
else
5641
{
57-
IPAddress? hostnameAsIp;
58-
if (IPAddress.TryParse(hostName, out hostnameAsIp))
59-
{
60-
byte[] addressBytes = hostnameAsIp.GetAddressBytes();
61-
hostNameMatch = Interop.Crypto.CheckX509IpAddress(certHandle, addressBytes, addressBytes.Length, hostName, hostName.Length);
62-
}
63-
else
64-
{
65-
// The IdnMapping converts Unicode input into the IDNA punycode sequence.
66-
// It also does host case normalization. The bypass logic would be something
67-
// like "all characters being within [a-z0-9.-]+"
68-
string matchName = s_idnMapping.GetAscii(hostName);
69-
hostNameMatch = Interop.Crypto.CheckX509Hostname(certHandle, matchName, matchName.Length);
70-
71-
if (hostNameMatch < 0)
72-
{
73-
throw Interop.Crypto.CreateOpenSslCryptographicException();
74-
}
75-
}
42+
string matchName = s_idnMapping.GetAscii(hostName);
43+
match = remoteCertificate.MatchesHostname(matchName);
7644
}
7745

78-
Debug.Assert(hostNameMatch == 0 || hostNameMatch == 1, $"Expected 0 or 1 from CheckX509Hostname, got {hostNameMatch}");
79-
return hostNameMatch == 1 ?
46+
return match ?
8047
errors :
8148
errors | SslPolicyErrors.RemoteCertificateNameMismatch;
8249
}

‎src/libraries/System.Net.Quic/src/System.Net.Quic.csproj

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -77,12 +77,9 @@
7777
<Compile Include="$(CommonPath)System\Net\SocketAddressPal.Windows.cs" Link="Common\System\Net\SocketAddressPal.Windows.cs" />
7878
</ItemGroup>
7979

80-
<!-- Unix (OSX + Linux) specific files -->
81-
<ItemGroup Condition="'$(TargetPlatformIdentifier)' == 'linux' or '$(TargetPlatformIdentifier)' == 'osx' or '$(TargetPlatformIdentifier)' == 'freebsd'">
82-
<Compile Include="$(CommonPath)Interop\Unix\Interop.Libraries.cs" Link="Common\Interop\Unix\Interop.Libraries.cs" />
83-
<Compile Include="$(CommonPath)Interop\Unix\Interop.Errors.cs" Link="Common\Interop\Unix\Interop.Errors.cs" />
80+
<!-- Unix (Linux) specific files -->
81+
<ItemGroup Condition="'$(TargetPlatformIdentifier)' == 'linux' or '$(TargetPlatformIdentifier)' == 'freebsd'">
8482
<Compile Include="$(CommonPath)Interop\Unix\System.Security.Cryptography.Native\Interop.ASN1.cs" Link="Common\Interop\Unix\System.Security.Cryptography.Native\Interop.ASN1.cs" />
85-
<Compile Include="$(CommonPath)Interop\Unix\System.Native\Interop.SocketAddress.cs" Link="Common\Interop\Unix\System.Native\Interop.SocketAddress.cs" />
8683
<Compile Include="$(CommonPath)Interop\Unix\System.Security.Cryptography.Native\Interop.BIO.cs" Link="Common\Interop\Unix\System.Security.Cryptography.Native\Interop.BIO.cs" />
8784
<Compile Include="$(CommonPath)Interop\Unix\System.Security.Cryptography.Native\Interop.ERR.cs" Link="Common\Interop\Unix\System.Security.Cryptography.Native\Interop.ERR.cs" />
8885
<Compile Include="$(CommonPath)Interop\Unix\System.Security.Cryptography.Native\Interop.Initialization.cs" Link="Common\Interop\Unix\System.Security.Cryptography.Native\Interop.Initialization.cs" />
@@ -99,6 +96,12 @@
9996
<Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeBioHandle.Unix.cs" Link="Common\Microsoft\Win32\SafeHandles\SafeBioHandle.Unix.cs" />
10097
<Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\Asn1SafeHandles.Unix.cs" Link="Common\Microsoft\Win32\SafeHandles\Asn1SafeHandles.Unix.cs" />
10198
<Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeHandleCache.cs" Link="Common\Microsoft\Win32\SafeHandles\SafeHandleCache.cs" />
99+
</ItemGroup>
100+
101+
<ItemGroup Condition="'$(TargetPlatformIdentifier)' == 'linux' or '$(TargetPlatformIdentifier)' == 'osx' or '$(TargetPlatformIdentifier)' == 'freebsd'">
102+
<Compile Include="$(CommonPath)Interop\Unix\Interop.Libraries.cs" Link="Common\Interop\Unix\Interop.Libraries.cs" />
103+
<Compile Include="$(CommonPath)Interop\Unix\Interop.Errors.cs" Link="Common\Interop\Unix\Interop.Errors.cs" />
104+
<Compile Include="$(CommonPath)Interop\Unix\System.Native\Interop.SocketAddress.cs" Link="Common\Interop\Unix\System.Native\Interop.SocketAddress.cs" />
102105
<Compile Include="$(CommonPath)System\Net\SocketAddressPal.Unix.cs" Link="Common\System\Net\SocketAddressPal.Unix.cs" />
103106
</ItemGroup>
104107

‎src/libraries/System.Net.Quic/tests/FunctionalTests/MsQuicTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1426,7 +1426,7 @@ private async Task SniTestCore(string hostname, bool shouldSendSni)
14261426
[InlineData("a")]
14271427
[InlineData("test")]
14281428
[InlineData("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")] // max allowed hostname length is 63
1429-
[InlineData("\u017C\u00F3\u0142\u0107 g\u0119\u015Bl\u0105 ja\u017A\u0144. \u7EA2\u70E7. \u7167\u308A\u713C\u304D")]
1429+
[InlineData("\u017C\u00F3\u0142\u0107g\u0119\u015Bl\u0105ja\u017A\u0144.\u7EA2\u70E7.\u7167\u308A\u713C\u304D")]
14301430
public Task ClientSendsSniServerReceives_Ok(string hostname) => SniTestCore(hostname, true);
14311431

14321432
[Theory]

0 commit comments

Comments
 (0)