Skip to content

Commit dedaf46

Browse files
vcsjonesvcsjones
authored
Skip RC2 encrypted PKCS12 files on Android for iteration counting
1 parent 2f853d1 commit dedaf46

File tree

3 files changed

+63
-15
lines changed

3 files changed

+63
-15
lines changed

‎src/libraries/System.Security.Cryptography/tests/X509Certificates/PfxIterationCountTests.CustomAppContextDataLimit.cs‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
using Microsoft.DotNet.XUnitExtensions;
66
using System.Collections.Generic;
77
using System.Linq;
8+
using Test.Cryptography;
89
using Xunit;
910

1011
namespace System.Security.Cryptography.X509Certificates.Tests
@@ -20,7 +21,7 @@ private static readonly Dictionary<string, PfxInfo> s_certificatesDictionary
2021

2122
[ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
2223
[MemberData(memberName: nameof(PfxIterationCountTests.GetCertsWith_IterationCountNotExceedingDefaultLimit_AndNullOrEmptyPassword_MemberData), MemberType = typeof(PfxIterationCountTests))]
23-
public void Import_AppContextDataWithValueMinusTwo_ActsAsDefaultLimit_IterationCountNotExceedingDefaultLimit(string name, bool usesPbes2, byte[] blob, long iterationCount)
24+
public void Import_AppContextDataWithValueMinusTwo_ActsAsDefaultLimit_IterationCountNotExceedingDefaultLimit(string name, bool usesPbes2, byte[] blob, long iterationCount, bool usesRC2)
2425
{
2526
_ = iterationCount;
2627
_ = blob;
@@ -30,6 +31,11 @@ public void Import_AppContextDataWithValueMinusTwo_ActsAsDefaultLimit_IterationC
3031
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
3132
}
3233

34+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
35+
{
36+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
37+
}
38+
3339
RemoteExecutor.Invoke((certName) =>
3440
{
3541
AppContext.SetData("System.Security.Cryptography.Pkcs12UnspecifiedPasswordIterationLimit", -2);
@@ -43,7 +49,7 @@ public void Import_AppContextDataWithValueMinusTwo_ActsAsDefaultLimit_IterationC
4349

4450
[ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
4551
[MemberData(memberName: nameof(PfxIterationCountTests.GetCertsWith_IterationCountExceedingDefaultLimit_MemberData), MemberType = typeof(PfxIterationCountTests))]
46-
public void Import_AppContextDataWithValueMinusTwo_ActsAsDefaultLimit_IterationCountLimitExceeded_Throws(string name, string password, bool usesPbes2, byte[] blob, long iterationCount)
52+
public void Import_AppContextDataWithValueMinusTwo_ActsAsDefaultLimit_IterationCountLimitExceeded_Throws(string name, string password, bool usesPbes2, byte[] blob, long iterationCount, bool usesRC2)
4753
{
4854
_ = password;
4955
_ = iterationCount;
@@ -54,6 +60,11 @@ public void Import_AppContextDataWithValueMinusTwo_ActsAsDefaultLimit_IterationC
5460
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
5561
}
5662

63+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
64+
{
65+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
66+
}
67+
5768
RemoteExecutor.Invoke((certName) =>
5869
{
5970
AppContext.SetData("System.Security.Cryptography.Pkcs12UnspecifiedPasswordIterationLimit", -2);
@@ -67,7 +78,7 @@ public void Import_AppContextDataWithValueMinusTwo_ActsAsDefaultLimit_IterationC
6778

6879
[ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
6980
[MemberData(memberName: nameof(PfxIterationCountTests.GetCertsWith_IterationCountNotExceedingDefaultLimit_AndNullOrEmptyPassword_MemberData), MemberType = typeof(PfxIterationCountTests))]
70-
public void Import_AppContextDataWithValueZero_IterationCountNotExceedingDefaultLimit_Throws(string name, bool usesPbes2, byte[] blob, long iterationCount)
81+
public void Import_AppContextDataWithValueZero_IterationCountNotExceedingDefaultLimit_Throws(string name, bool usesPbes2, byte[] blob, long iterationCount, bool usesRC2)
7182
{
7283
_ = iterationCount;
7384
_ = blob;
@@ -77,6 +88,11 @@ public void Import_AppContextDataWithValueZero_IterationCountNotExceedingDefault
7788
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
7889
}
7990

91+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
92+
{
93+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
94+
}
95+
8096
RemoteExecutor.Invoke((certName) =>
8197
{
8298
AppContext.SetData("System.Security.Cryptography.Pkcs12UnspecifiedPasswordIterationLimit", 0);
@@ -90,7 +106,7 @@ public void Import_AppContextDataWithValueZero_IterationCountNotExceedingDefault
90106

91107
[ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
92108
[MemberData(memberName: nameof(PfxIterationCountTests.GetCertsWith_IterationCountExceedingDefaultLimit_MemberData), MemberType = typeof(PfxIterationCountTests))]
93-
public void Import_AppContextDataWithValueMinusOne_IterationCountExceedingDefaultLimit(string name, string password, bool usesPbes2, byte[] blob, long iterationCount)
109+
public void Import_AppContextDataWithValueMinusOne_IterationCountExceedingDefaultLimit(string name, string password, bool usesPbes2, byte[] blob, long iterationCount, bool usesRC2)
94110
{
95111
_ = password;
96112
_ = blob;
@@ -101,6 +117,11 @@ public void Import_AppContextDataWithValueMinusOne_IterationCountExceedingDefaul
101117
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
102118
}
103119

120+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
121+
{
122+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
123+
}
124+
104125
RemoteExecutor.Invoke((certName) =>
105126
{
106127
AppContext.SetData("System.Security.Cryptography.Pkcs12UnspecifiedPasswordIterationLimit", -1);

‎src/libraries/System.Security.Cryptography/tests/X509Certificates/PfxIterationCountTests.cs‎

Lines changed: 32 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,18 @@ public abstract partial class PfxIterationCountTests
2424

2525
[ConditionalTheory]
2626
[MemberData(nameof(GetCertsWith_IterationCountNotExceedingDefaultLimit_AndNullOrEmptyPassword_MemberData))]
27-
public void Import_IterationCounLimitNotExceeded_Succeeds(string name, bool usesPbes2, byte[] blob, long iterationCount)
27+
public void Import_IterationCounLimitNotExceeded_Succeeds(string name, bool usesPbes2, byte[] blob, long iterationCount, bool usesRC2)
2828
{
2929
if (usesPbes2 && !PfxTests.Pkcs12PBES2Supported)
3030
{
3131
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
3232
}
3333

34+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
35+
{
36+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
37+
}
38+
3439
if (PfxTests.IsPkcs12IterationCountAllowed(iterationCount, PfxTests.DefaultIterations))
3540
{
3641
X509Certificate cert = Import(blob);
@@ -40,7 +45,7 @@ public void Import_IterationCounLimitNotExceeded_Succeeds(string name, bool uses
4045

4146
[ConditionalTheory]
4247
[MemberData(nameof(GetCertsWith_IterationCountExceedingDefaultLimit_MemberData))]
43-
public void Import_IterationCountLimitExceeded_Throws(string name, string password, bool usesPbes2, byte[] blob, long iterationCount)
48+
public void Import_IterationCountLimitExceeded_Throws(string name, string password, bool usesPbes2, byte[] blob, long iterationCount, bool usesRC2)
4449
{
4550
_ = password;
4651
_ = iterationCount;
@@ -50,13 +55,18 @@ public void Import_IterationCountLimitExceeded_Throws(string name, string passwo
5055
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
5156
}
5257

58+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
59+
{
60+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
61+
}
62+
5363
CryptographicException ce = Assert.Throws<CryptographicException>(() => Import(blob));
5464
Assert.Contains(FwlinkId, ce.Message);
5565
}
5666

5767
[ConditionalTheory]
5868
[MemberData(nameof(GetCertsWith_IterationCountExceedingDefaultLimit_MemberData))]
59-
public void ImportWithPasswordOrFileName_IterationCountLimitExceeded(string name, string password, bool usesPbes2, byte[] blob, long iterationCount)
69+
public void ImportWithPasswordOrFileName_IterationCountLimitExceeded(string name, string password, bool usesPbes2, byte[] blob, long iterationCount, bool usesRC2)
6070
{
6171
_ = iterationCount;
6272

@@ -65,6 +75,11 @@ public void ImportWithPasswordOrFileName_IterationCountLimitExceeded(string name
6575
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
6676
}
6777

78+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
79+
{
80+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
81+
}
82+
6883
using (TempFileHolder tempFile = new TempFileHolder(blob))
6984
{
7085
string fileName = tempFile.FilePath;
@@ -100,13 +115,18 @@ internal static void VerifyThrowsCryptoExButDoesNotThrowPfxWithoutPassword(Actio
100115

101116
[ConditionalTheory]
102117
[MemberData(nameof(GetCertsWith_NonNullOrEmptyPassword_MemberData))]
103-
public void Import_NonNullOrEmptyPasswordExpected_Throws(string name, string password, bool usesPbes2, byte[] blob, long iterationCount)
118+
public void Import_NonNullOrEmptyPasswordExpected_Throws(string name, string password, bool usesPbes2, byte[] blob, long iterationCount, bool usesRC2)
104119
{
105120
if (usesPbes2 && !PfxTests.Pkcs12PBES2Supported)
106121
{
107122
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
108123
}
109124

125+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
126+
{
127+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
128+
}
129+
110130
CryptographicException ce = Assert.ThrowsAny<CryptographicException>(() => Import(blob));
111131

112132
if (PfxTests.IsPkcs12IterationCountAllowed(iterationCount, PfxTests.DefaultIterations))
@@ -123,7 +143,7 @@ public void Import_NonNullOrEmptyPasswordExpected_Throws(string name, string pas
123143
}
124144
}
125145

126-
[Fact]
146+
[ConditionalFact(typeof(PlatformSupport), nameof(PlatformSupport.IsRC2Supported))]
127147
public void ExportedPfxWithNullPassword_DecryptReturnsValidPaddingWithEmptyPassword()
128148
{
129149
Assert.NotNull(Import(TestData.MsCertificateExportedToPfx_NullPassword));
@@ -160,7 +180,7 @@ private static List<PfxInfo> GetCertificates()
160180
certificates.Add(new PfxInfo(
161181
nameof(TestData.Pkcs12WindowsDotnetExportEmptyPassword), "", 6000, false, TestData.Pkcs12WindowsDotnetExportEmptyPassword));
162182
certificates.Add(new PfxInfo(
163-
nameof(TestData.Pkcs12MacosKeychainCreated), null, 4097, false, TestData.Pkcs12MacosKeychainCreated));
183+
nameof(TestData.Pkcs12MacosKeychainCreated), null, 4097, false, TestData.Pkcs12MacosKeychainCreated, usesRC2: true));
164184
certificates.Add(new PfxInfo(
165185
nameof(TestData.Pkcs12BuilderSaltWithMacNullPassword), null, 120000, true, TestData.Pkcs12BuilderSaltWithMacNullPassword));
166186
certificates.Add(new PfxInfo(
@@ -183,7 +203,7 @@ public static IEnumerable<object[]> GetCertsWith_IterationCountNotExceedingDefau
183203
{
184204
if (p.IterationCount <= DefaultIterationLimit && string.IsNullOrEmpty(p.Password))
185205
{
186-
yield return new object[] { p.Name, p.UsesPbes2, p.Blob, p.IterationCount };
206+
yield return new object[] { p.Name, p.UsesPbes2, p.Blob, p.IterationCount, p.UsesRC2 };
187207
}
188208
}
189209
}
@@ -194,7 +214,7 @@ public static IEnumerable<object[]> GetCertsWith_IterationCountExceedingDefaultL
194214
{
195215
if (p.IterationCount > DefaultIterationLimit)
196216
{
197-
yield return new object[] { p.Name, p.Password, p.UsesPbes2, p.Blob, p.IterationCount };
217+
yield return new object[] { p.Name, p.Password, p.UsesPbes2, p.Blob, p.IterationCount, p.UsesRC2 };
198218
}
199219
}
200220
}
@@ -205,7 +225,7 @@ public static IEnumerable<object[]> GetCertsWith_NonNullOrEmptyPassword_MemberDa
205225
{
206226
if (!string.IsNullOrEmpty(p.Password))
207227
{
208-
yield return new object[] { p.Name, p.Password, p.UsesPbes2, p.Blob, p.IterationCount };
228+
yield return new object[] { p.Name, p.Password, p.UsesPbes2, p.Blob, p.IterationCount, p.UsesRC2 };
209229
}
210230
}
211231
}
@@ -218,14 +238,16 @@ public class PfxInfo
218238
internal long IterationCount { get; set; }
219239
internal bool UsesPbes2 { get; set; }
220240
internal byte[] Blob { get; set; }
241+
internal bool UsesRC2 { get; set; }
221242

222-
internal PfxInfo(string name, string password, long iterationCount, bool usesPbes2, byte[] blob)
243+
internal PfxInfo(string name, string password, long iterationCount, bool usesPbes2, byte[] blob, bool usesRC2 = false)
223244
{
224245
Name = name;
225246
Password = password;
226247
IterationCount = iterationCount;
227248
UsesPbes2 = usesPbes2;
228249
Blob = blob;
250+
UsesRC2 = usesRC2;
229251
}
230252
}
231253
}

‎src/libraries/System.Security.Cryptography/tests/X509Certificates/PfxTests.cs‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,7 @@ public static void CollectionPerphemeralImport_HasKeyName()
470470

471471
[ConditionalTheory]
472472
[MemberData(memberName: nameof(PfxIterationCountTests.GetCertsWith_IterationCountNotExceedingDefaultLimit_AndNullOrEmptyPassword_MemberData), MemberType = typeof(PfxIterationCountTests))]
473-
public static void TestIterationCounter(string name, bool usesPbes2, byte[] blob, int iterationCount)
473+
public static void TestIterationCounter(string name, bool usesPbes2, byte[] blob, int iterationCount, bool usesRC2)
474474
{
475475
_ = iterationCount;
476476

@@ -482,6 +482,11 @@ public static void TestIterationCounter(string name, bool usesPbes2, byte[] blob
482482
throw new SkipTestException(name + " uses PBES2, which is not supported on this version.");
483483
}
484484

485+
if (usesRC2 && !PlatformSupport.IsRC2Supported)
486+
{
487+
throw new SkipTestException(name + " uses RC2, which is not supported on this platform.");
488+
}
489+
485490
try
486491
{
487492
long count = (long)target(blob, out int bytesConsumed);

0 commit comments

Comments
 (0)