Skip to content

Make AiaCompletionHasLimits handle Windows variance #131242

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bartonjs merged 4 commits into from
Jul 23, 2026
Merged

Make AiaCompletionHasLimits handle Windows variance #131242

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a229987
Make AiaCompletionHasLimits handle Windows variance
bartonjs Jul 22, 2026
907ef98
On retry, generate a whole new PKI
bartonjs Jul 23, 2026
8f29219
Conditionalize Dispose
bartonjs Jul 23, 2026
2ddcc92
Ensure different PKI-name on retry
bartonjs Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
137 changes: 89 additions & 48 deletions ...libraries/System.Security.Cryptography/tests/X509Certificates/RevocationTests/AiaTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,26 +220,29 @@ public static void AiaIgnoresCertOverLimit()
[Fact]
public static void AiaCompletionHasLimits()
{
const int IntermediateCount = 6;
const int IntermediateCount = 8;
int iteration = 0;

CertificateAuthority.BuildPrivatePki(
PkiOptions.AllRevocation,
out RevocationResponder responder,
out CertificateAuthority root,
out CertificateAuthority[] intermediates,
out X509Certificate2 endEntity,
intermediateAuthorityCount: IntermediateCount,
pkiOptionsInSubject: false,
testName: nameof(AiaCompletionHasLimits));

using (responder)
using (root)
using (endEntity)
{
try
RetryHelper.Execute(
() =>
{
RetryHelper.Execute(
() =>
iteration++;

CertificateAuthority.BuildPrivatePki(
PkiOptions.AllRevocation,
out RevocationResponder responder,
out CertificateAuthority root,
out CertificateAuthority[] intermediates,
out X509Certificate2 endEntity,
intermediateAuthorityCount: IntermediateCount,
pkiOptionsInSubject: false,
testName: $"{nameof(AiaCompletionHasLimits)}_{iteration}");

using (responder)
using (root)
using (endEntity)
{
try
{
using (ChainHolder holder = new ChainHolder())
{
Expand All @@ -260,25 +263,60 @@ public static void AiaCompletionHasLimits()

// EE, intermediate0 (AIA), intermediate1 (ExtraStore), intermediate2 (AIA).
AssertExtensions.TrueExpression(chain.Build(endEntity));
Assert.Equal(4, chain.ChainElements.Count);
AssertExtensions.HasFlag(X509ChainStatusFlags.PartialChain, chain.AllStatusFlags());

CloneIntoExtraStore(chain, 1);
CloneIntoExtraStore(chain, 3);
holder.DisposeChainElements();

// Previous 4 plus intermediate3 and intermediate4.
AssertExtensions.TrueExpression(chain.Build(endEntity));
Assert.Equal(6, chain.ChainElements.Count);
AssertExtensions.HasFlag(X509ChainStatusFlags.PartialChain, chain.AllStatusFlags());

CloneIntoExtraStore(chain, 4);
CloneIntoExtraStore(chain, 5);
holder.DisposeChainElements();
// Current Windows only allows 2, by black box testing, but 3 does seem to happen
// on some builds. So, variant test for it being over-sized
if (chain.ChainElements.Count == 5)
{
// The ones described above, plus intermediate3(AIA).
AssertExtensions.HasFlag(X509ChainStatusFlags.PartialChain, chain.AllStatusFlags());

CloneIntoExtraStore(chain, 1);
CloneIntoExtraStore(chain, 3);
CloneIntoExtraStore(chain, 4);
holder.DisposeChainElements();

// Previous 5 plus intermediate4, intermediate5, and intermediate6.
AssertExtensions.TrueExpression(chain.Build(endEntity));
Assert.Equal(8, chain.ChainElements.Count);
AssertExtensions.HasFlag(X509ChainStatusFlags.PartialChain, chain.AllStatusFlags());

CloneIntoExtraStore(chain, 5);
CloneIntoExtraStore(chain, 6);
CloneIntoExtraStore(chain, 7);
holder.DisposeChainElements();
}
else
{
Assert.Equal(4, chain.ChainElements.Count);
Comment thread
bartonjs marked this conversation as resolved.
AssertExtensions.HasFlag(X509ChainStatusFlags.PartialChain, chain.AllStatusFlags());

CloneIntoExtraStore(chain, 1);
CloneIntoExtraStore(chain, 3);
holder.DisposeChainElements();

// Previous 4 plus intermediate3 and intermediate4.
AssertExtensions.TrueExpression(chain.Build(endEntity));
Assert.Equal(6, chain.ChainElements.Count);
AssertExtensions.HasFlag(X509ChainStatusFlags.PartialChain, chain.AllStatusFlags());

CloneIntoExtraStore(chain, 4);
CloneIntoExtraStore(chain, 5);
holder.DisposeChainElements();

// Previous 6 plus intermediate5 and intermediate6.
AssertExtensions.TrueExpression(chain.Build(endEntity));
Assert.Equal(8, chain.ChainElements.Count);
AssertExtensions.HasFlag(X509ChainStatusFlags.PartialChain, chain.AllStatusFlags());

CloneIntoExtraStore(chain, 6);
CloneIntoExtraStore(chain, 7);
holder.DisposeChainElements();
}

// AIA fetches intermediate5 and root, chain finishes.
// AIA fetches intermediate7 and root, chain finishes.
AssertExtensions.TrueExpression(chain.Build(endEntity));
Assert.Equal(8, chain.ChainElements.Count);
Assert.Equal(10, chain.ChainElements.Count);
Assert.Equal(X509ChainStatusFlags.UntrustedRoot, chain.AllStatusFlags());
Comment thread
bartonjs marked this conversation as resolved.
}
finally
Expand All @@ -289,22 +327,25 @@ public static void AiaCompletionHasLimits()
}
}
}
});
}
finally
{
foreach (CertificateAuthority intermediate in intermediates)
{
intermediate.Dispose();
}
finally
{
if (intermediates is not null)
{
foreach (CertificateAuthority intermediate in intermediates)
{
intermediate.Dispose();
}
}
}
}
}
});

static void CloneIntoExtraStore(X509Chain chain, int index)
{
ReadOnlySpan<byte> source = chain.ChainElements[index].Certificate.RawDataMemory.Span;
X509Certificate2 cert = X509CertificateLoader.LoadCertificate(source);
chain.ChainPolicy.ExtraStore.Add(cert);
}
static void CloneIntoExtraStore(X509Chain chain, int index)
{
ReadOnlySpan<byte> source = chain.ChainElements[index].Certificate.RawDataMemory.Span;
X509Certificate2 cert = X509CertificateLoader.LoadCertificate(source);
chain.ChainPolicy.ExtraStore.Add(cert);
}
}
}
Expand Down
Loading