Skip to content

Commit 941f351

Browse files
halter73HaoK
halter73
and
HaoK
authored
[release/6.0] Switch to dynamic cert gen for tests (#55811)
* [release/6.0] Switch to dynamic cert gen for tests - Cherry-picked from #39685 * Remove non-existing project from AspNetCore.sln * Log ClientCertificateAuthenticationTests --------- Co-authored-by: Hao Kung <[email protected]>
1 parent 1c95a9b commit 941f351

15 files changed

+128
-149
lines changed

‎AspNetCore.sln

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -9750,22 +9750,6 @@ Global
97509750
{09FFBC53-3EFF-45C4-9822-5D66089CD6AD}.Release|x64.Build.0 = Release|Any CPU
97519751
{09FFBC53-3EFF-45C4-9822-5D66089CD6AD}.Release|x86.ActiveCfg = Release|Any CPU
97529752
{09FFBC53-3EFF-45C4-9822-5D66089CD6AD}.Release|x86.Build.0 = Release|Any CPU
9753-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
9754-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Debug|Any CPU.Build.0 = Debug|Any CPU
9755-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Debug|arm64.ActiveCfg = Debug|Any CPU
9756-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Debug|arm64.Build.0 = Debug|Any CPU
9757-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Debug|x64.ActiveCfg = Debug|Any CPU
9758-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Debug|x64.Build.0 = Debug|Any CPU
9759-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Debug|x86.ActiveCfg = Debug|Any CPU
9760-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Debug|x86.Build.0 = Debug|Any CPU
9761-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Release|Any CPU.ActiveCfg = Release|Any CPU
9762-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Release|Any CPU.Build.0 = Release|Any CPU
9763-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Release|arm64.ActiveCfg = Release|Any CPU
9764-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Release|arm64.Build.0 = Release|Any CPU
9765-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Release|x64.ActiveCfg = Release|Any CPU
9766-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Release|x64.Build.0 = Release|Any CPU
9767-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Release|x86.ActiveCfg = Release|Any CPU
9768-
{A1D02CE6-1077-410A-81CB-D4BD500FD765}.Release|x86.Build.0 = Release|Any CPU
97699753
{3044DFA5-DE4F-44D8-8DD8-EDF547BE513E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
97709754
{3044DFA5-DE4F-44D8-8DD8-EDF547BE513E}.Debug|Any CPU.Build.0 = Debug|Any CPU
97719755
{3044DFA5-DE4F-44D8-8DD8-EDF547BE513E}.Debug|arm64.ActiveCfg = Debug|Any CPU
@@ -11171,7 +11155,6 @@ Global
1117111155
{17F28812-983E-4415-A55D-842DD7EC6887} = {627BE8B3-59E6-4F1D-8C9C-76B804D41724}
1117211156
{A07D3B13-388B-444F-9E37-DDC0787C4690} = {17F28812-983E-4415-A55D-842DD7EC6887}
1117311157
{09FFBC53-3EFF-45C4-9822-5D66089CD6AD} = {17F28812-983E-4415-A55D-842DD7EC6887}
11174-
{A1D02CE6-1077-410A-81CB-D4BD500FD765} = {0508E463-0269-40C9-B5C2-3B600FB2A28B}
1117511158
{3044DFA5-DE4F-44D8-8DD8-EDF547BE513E} = {C445B129-0A4D-41F5-8347-6534B6B12303}
1117611159
{4BD6F0DB-BE9C-4C54-B52A-D20B88855ED5} = {C445B129-0A4D-41F5-8347-6534B6B12303}
1117711160
{6CCCF618-2E70-4870-B39F-32C016FE08F0} = {088C37A5-30D2-40FB-B031-D163CFBED006}

‎src/Middleware/HttpOverrides/test/CertificateForwardingTest.cs

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -230,34 +230,5 @@ public async Task VerifyArrHeaderEncodedCertFailsOnBadEncoding()
230230
c.Request.Headers["X-Client-Cert"] = "OOPS" + Convert.ToBase64String(Certificates.SelfSignedValidWithNoEku.RawData);
231231
});
232232
}
233-
234-
private static class Certificates
235-
{
236-
public static X509Certificate2 SelfSignedValidWithClientEku { get; private set; } =
237-
new X509Certificate2(GetFullyQualifiedFilePath("validSelfSignedClientEkuCertificate.cer"));
238-
239-
public static X509Certificate2 SelfSignedValidWithNoEku { get; private set; } =
240-
new X509Certificate2(GetFullyQualifiedFilePath("validSelfSignedNoEkuCertificate.cer"));
241-
242-
public static X509Certificate2 SelfSignedValidWithServerEku { get; private set; } =
243-
new X509Certificate2(GetFullyQualifiedFilePath("validSelfSignedServerEkuCertificate.cer"));
244-
245-
public static X509Certificate2 SelfSignedNotYetValid { get; private set; } =
246-
new X509Certificate2(GetFullyQualifiedFilePath("selfSignedNoEkuCertificateNotValidYet.cer"));
247-
248-
public static X509Certificate2 SelfSignedExpired { get; private set; } =
249-
new X509Certificate2(GetFullyQualifiedFilePath("selfSignedNoEkuCertificateExpired.cer"));
250-
251-
private static string GetFullyQualifiedFilePath(string filename)
252-
{
253-
var filePath = Path.Combine(AppContext.BaseDirectory, filename);
254-
if (!File.Exists(filePath))
255-
{
256-
throw new FileNotFoundException(filePath);
257-
}
258-
return filePath;
259-
}
260-
}
261-
262233
}
263234
}

‎src/Middleware/HttpOverrides/test/Microsoft.AspNetCore.HttpOverrides.Tests.csproj

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
</PropertyGroup>
66

77
<ItemGroup>
8+
<Compile Include="$(SharedSourceRoot)test\Certificates\Certificates.cs" />
89
<Reference Include="Microsoft.AspNetCore.HttpOverrides" />
910
<Reference Include="Microsoft.AspNetCore.TestHost" />
1011
<Content Include="$(SharedSourceRoot)test\Certificates\*.cer" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" />

‎src/Security/Authentication/test/CertificateTests.cs

Lines changed: 7 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424

2525
namespace Microsoft.AspNetCore.Authentication.Certificate.Test
2626
{
27-
public class ClientCertificateAuthenticationTests
27+
public class ClientCertificateAuthenticationTests : LoggedTest
2828
{
2929

3030
[Fact]
@@ -159,7 +159,8 @@ public async Task VerifyValidSelfSignedWithServerFailsPurposeValidationIsOffButS
159159
Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
160160
}
161161

162-
[Fact]
162+
[ConditionalFact]
163+
[SkipOnHelix("https://github.com/dotnet/aspnetcore/issues/32813", Queues = "All.Ubuntu")]
163164
public async Task VerifyExpiredSelfSignedFails()
164165
{
165166
using var host = await CreateHost(
@@ -194,7 +195,7 @@ public async Task VerifyExpiredSelfSignedPassesIfDateRangeValidationIsDisabled()
194195
}
195196

196197
[ConditionalFact]
197-
[SkipOnHelix("https://github.com/dotnet/aspnetcore/issues/32813")]
198+
[SkipOnHelix("https://github.com/dotnet/aspnetcore/issues/32813", Queues = "All.Ubuntu")]
198199
public async Task VerifyNotYetValidSelfSignedFails()
199200
{
200201
using var host = await CreateHost(
@@ -787,7 +788,7 @@ public async Task VerifyValidationResultNeverCachedAfter30Min(bool cache)
787788
Assert.Equal(laterExpected, count.First().Value);
788789
}
789790

790-
private static async Task<IHost> CreateHost(
791+
private async Task<IHost> CreateHost(
791792
CertificateAuthenticationOptions configureOptions,
792793
X509Certificate2 clientCertificate = null,
793794
Func<HttpContext, bool> handler = null,
@@ -846,6 +847,8 @@ private static async Task<IHost> CreateHost(
846847
})
847848
.ConfigureServices(services =>
848849
{
850+
AddTestLogging(services);
851+
849852
AuthenticationBuilder authBuilder;
850853
if (configureOptions != null)
851854
{
@@ -932,43 +935,5 @@ private static async Task<IHost> CreateHost(
932935
return Task.CompletedTask;
933936
}
934937
};
935-
936-
private static class Certificates
937-
{
938-
public static X509Certificate2 SelfSignedPrimaryRoot { get; private set; } =
939-
new X509Certificate2(GetFullyQualifiedFilePath("validSelfSignedPrimaryRootCertificate.cer"));
940-
941-
public static X509Certificate2 SignedSecondaryRoot { get; private set; } =
942-
new X509Certificate2(GetFullyQualifiedFilePath("validSignedSecondaryRootCertificate.cer"));
943-
944-
public static X509Certificate2 SignedClient { get; private set; } =
945-
new X509Certificate2(GetFullyQualifiedFilePath("validSignedClientCertificate.cer"));
946-
947-
public static X509Certificate2 SelfSignedValidWithClientEku { get; private set; } =
948-
new X509Certificate2(GetFullyQualifiedFilePath("validSelfSignedClientEkuCertificate.cer"));
949-
950-
public static X509Certificate2 SelfSignedValidWithNoEku { get; private set; } =
951-
new X509Certificate2(GetFullyQualifiedFilePath("validSelfSignedNoEkuCertificate.cer"));
952-
953-
public static X509Certificate2 SelfSignedValidWithServerEku { get; private set; } =
954-
new X509Certificate2(GetFullyQualifiedFilePath("validSelfSignedServerEkuCertificate.cer"));
955-
956-
public static X509Certificate2 SelfSignedNotYetValid { get; private set; } =
957-
new X509Certificate2(GetFullyQualifiedFilePath("selfSignedNoEkuCertificateNotValidYet.cer"));
958-
959-
public static X509Certificate2 SelfSignedExpired { get; private set; } =
960-
new X509Certificate2(GetFullyQualifiedFilePath("selfSignedNoEkuCertificateExpired.cer"));
961-
962-
private static string GetFullyQualifiedFilePath(string filename)
963-
{
964-
var filePath = Path.Combine(AppContext.BaseDirectory, filename);
965-
if (!File.Exists(filePath))
966-
{
967-
throw new FileNotFoundException(filePath);
968-
}
969-
return filePath;
970-
}
971-
}
972938
}
973939
}
974-

‎src/Security/Authentication/test/Microsoft.AspNetCore.Authentication.Test.csproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
</ItemGroup>
1414

1515
<ItemGroup>
16+
<Compile Include="$(SharedSourceRoot)test\Certificates\Certificates.cs" />
17+
1618
<Content Include="WsFederation\federationmetadata.xml">
1719
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
1820
</Content>

‎src/Shared/test/Certificates/Certificates.cs

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
// Licensed to the .NET Foundation under one or more agreements.
2+
// The .NET Foundation licenses this file to you under the MIT license.
3+
4+
using System.Security.Cryptography;
5+
using System.Security.Cryptography.X509Certificates;
6+
7+
public static class Certificates
8+
{
9+
private static string ServerEku = "1.3.6.1.5.5.7.3.1";
10+
private static string ClientEku = "1.3.6.1.5.5.7.3.2";
11+
12+
static Certificates()
13+
{
14+
DateTimeOffset now = DateTimeOffset.UtcNow;
15+
16+
SelfSignedPrimaryRoot = MakeCert(
17+
"CN=Valid Self Signed Client EKU,OU=dev,DC=idunno-dev,DC=org",
18+
ClientEku,
19+
now);
20+
21+
SignedSecondaryRoot = MakeCert(
22+
"CN=Valid Signed Secondary Root EKU,OU=dev,DC=idunno-dev,DC=org",
23+
ClientEku,
24+
now);
25+
26+
SelfSignedValidWithServerEku = MakeCert(
27+
"CN=Valid Self Signed Server EKU,OU=dev,DC=idunno-dev,DC=org",
28+
ServerEku,
29+
now);
30+
31+
SelfSignedValidWithClientEku = MakeCert(
32+
"CN=Valid Self Signed Server EKU,OU=dev,DC=idunno-dev,DC=org",
33+
ClientEku,
34+
now);
35+
36+
SelfSignedValidWithNoEku = MakeCert(
37+
"CN=Valid Self Signed No EKU,OU=dev,DC=idunno-dev,DC=org",
38+
eku: null,
39+
now);
40+
41+
SelfSignedExpired = MakeCert(
42+
"CN=Expired Self Signed,OU=dev,DC=idunno-dev,DC=org",
43+
eku: null,
44+
now.AddYears(-2),
45+
now.AddYears(-1));
46+
47+
SelfSignedNotYetValid = MakeCert(
48+
"CN=Not Valid Yet Self Signed,OU=dev,DC=idunno-dev,DC=org",
49+
eku: null,
50+
now.AddYears(2),
51+
now.AddYears(3));
52+
53+
SignedClient = MakeCert(
54+
"CN=Valid Signed Client,OU=dev,DC=idunno-dev,DC=org",
55+
ClientEku,
56+
now);
57+
58+
}
59+
60+
private static readonly X509KeyUsageExtension s_digitalSignatureOnlyUsage =
61+
new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, true);
62+
63+
private static X509Certificate2 MakeCert(
64+
string subjectName,
65+
string eku,
66+
DateTimeOffset now)
67+
{
68+
return MakeCert(subjectName, eku, now, now.AddYears(5));
69+
}
70+
71+
private static X509Certificate2 MakeCert(
72+
string subjectName,
73+
string eku,
74+
DateTimeOffset notBefore,
75+
DateTimeOffset notAfter)
76+
{
77+
using (var key = RSA.Create(2048))
78+
{
79+
CertificateRequest request = new CertificateRequest(
80+
subjectName,
81+
key,
82+
HashAlgorithmName.SHA256,
83+
RSASignaturePadding.Pkcs1);
84+
85+
request.CertificateExtensions.Add(s_digitalSignatureOnlyUsage);
86+
87+
if (eku != null)
88+
{
89+
request.CertificateExtensions.Add(
90+
new X509EnhancedKeyUsageExtension(
91+
new OidCollection { new Oid(eku, null) }, false));
92+
}
93+
94+
return request.CreateSelfSigned(notBefore, notAfter);
95+
}
96+
}
97+
98+
public static X509Certificate2 SelfSignedPrimaryRoot { get; private set; }
99+
100+
public static X509Certificate2 SignedSecondaryRoot { get; private set; }
101+
102+
public static X509Certificate2 SignedClient { get; private set; }
103+
104+
public static X509Certificate2 SelfSignedValidWithClientEku { get; private set; }
105+
106+
public static X509Certificate2 SelfSignedValidWithNoEku { get; private set; }
107+
108+
public static X509Certificate2 SelfSignedValidWithServerEku { get; private set; }
109+
110+
public static X509Certificate2 SelfSignedNotYetValid { get; private set; }
111+
112+
public static X509Certificate2 SelfSignedExpired { get; private set; }
113+
}

‎src/Shared/test/Certificates/selfSignedNoEkuCertificateExpired.cer

-920 Bytes
Binary file not shown.

‎src/Shared/test/Certificates/selfSignedNoEkuCertificateNotValidYet.cer

-932 Bytes
Binary file not shown.

‎src/Shared/test/Certificates/validSelfSignedClientEkuCertificate.cer

-928 Bytes
Binary file not shown.

‎src/Shared/test/Certificates/validSelfSignedNoEkuCertificate.cer

-930 Bytes
Binary file not shown.

‎src/Shared/test/Certificates/validSelfSignedPrimaryRootCertificate.cer

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎src/Shared/test/Certificates/validSelfSignedServerEkuCertificate.cer

-928 Bytes
Binary file not shown.

‎src/Shared/test/Certificates/validSignedClientCertificate.cer

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎src/Shared/test/Certificates/validSignedSecondaryRootCertificate.cer

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎src/Testing/src/xunit/SkipOnHelixAttribute.cs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ private bool ShouldSkip()
5757
return true;
5858
}
5959

60+
if (Queues.Contains("All.Ubuntu") && targetQueue.StartsWith("ubuntu", StringComparison.OrdinalIgnoreCase))
61+
{
62+
return true;
63+
}
64+
6065
return Queues.ToLowerInvariant().Split(';').Contains(targetQueue);
6166
}
6267

0 commit comments

Comments
 (0)