diff --git a/NuGet.config b/NuGet.config index dfc9b0309dda88..7a7c2d23d9bdea 100644 --- a/NuGet.config +++ b/NuGet.config @@ -9,6 +9,8 @@ + + diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 18309684120ab2..96d71f76b4bd55 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -26,77 +26,77 @@ - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 https://github.com/microsoft/vstest @@ -222,9 +222,9 @@ https://github.com/dotnet/xharness d1dd9c2ce3fc0b9358d2cda64c52d052d1a612c1 - + https://github.com/dotnet/arcade - bd9b4590681e602535ed414e98a17e6ba121dca4 + 2eab07c3d7b78219d10099b19fafeef2ecae1779 https://dev.azure.com/dnceng/internal/_git/dotnet-optimization diff --git a/eng/Versions.props b/eng/Versions.props index f94d3d5f9fa95e..b34311e31e6af5 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -1,11 +1,11 @@ - 6.0.31 + 6.0.32 6 0 - 31 + 32 6.0.400 servicing @@ -42,21 +42,21 @@ 1.1.0-preview.22164.17 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 2.5.1-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 - 6.0.0-beta.24204.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 2.5.1-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 + 6.0.0-beta.24266.4 6.0.0-preview.1.102 diff --git a/eng/common/templates-official/job/source-index-stage1.yml b/eng/common/templates-official/job/source-index-stage1.yml index e96ec3cbe0ed11..f04ad04c2b1861 100644 --- a/eng/common/templates-official/job/source-index-stage1.yml +++ b/eng/common/templates-official/job/source-index-stage1.yml @@ -1,6 +1,6 @@ parameters: runAsPublic: false - sourceIndexPackageVersion: 1.0.1-20210614.1 + sourceIndexPackageVersion: 1.0.1-20240320.1 sourceIndexPackageSource: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json sourceIndexBuildCommand: powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "eng/common/build.ps1 -restore -build -binarylog -ci" preSteps: [] @@ -32,10 +32,10 @@ jobs: - ${{ preStep }} - task: UseDotNet@2 - displayName: Use .NET Core sdk 3.1 + displayName: Use .NET 8 SDK inputs: packageType: sdk - version: 3.1.x + version: 8.0.x installationPath: $(Agent.TempDirectory)/dotnet workingDirectory: $(Agent.TempDirectory) diff --git a/eng/common/templates-official/jobs/source-build.yml b/eng/common/templates-official/jobs/source-build.yml index 2159009dc8e1d3..b9a1f67b9a9ac5 100644 --- a/eng/common/templates-official/jobs/source-build.yml +++ b/eng/common/templates-official/jobs/source-build.yml @@ -14,7 +14,7 @@ parameters: # This is the default platform provided by Arcade, intended for use by a managed-only repo. defaultManagedPlatform: name: 'Managed' - container: 'mcr.microsoft.com/dotnet-buildtools/prereqs:centos-7-3e800f1-20190501005343' + container: 'mcr.microsoft.com/dotnet-buildtools/prereqs:centos-7' # Defines the platforms on which to run build jobs. One job is created for each platform, and the # object in this array is sent to the job template as 'platform'. If no platforms are specified, diff --git a/eng/common/templates/job/source-index-stage1.yml b/eng/common/templates/job/source-index-stage1.yml index d8990549e8097e..b710698eb4d4f1 100644 --- a/eng/common/templates/job/source-index-stage1.yml +++ b/eng/common/templates/job/source-index-stage1.yml @@ -1,6 +1,6 @@ parameters: runAsPublic: false - sourceIndexPackageVersion: 1.0.1-20210614.1 + sourceIndexPackageVersion: 1.0.1-20240320.1 sourceIndexPackageSource: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json sourceIndexBuildCommand: powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "eng/common/build.ps1 -restore -build -binarylog -ci" preSteps: [] @@ -30,10 +30,10 @@ jobs: - ${{ preStep }} - task: UseDotNet@2 - displayName: Use .NET Core sdk 3.1 + displayName: Use .NET 8 SDK inputs: packageType: sdk - version: 3.1.x + version: 8.0.x installationPath: $(Agent.TempDirectory)/dotnet workingDirectory: $(Agent.TempDirectory) diff --git a/eng/common/templates/jobs/source-build.yml b/eng/common/templates/jobs/source-build.yml index 00aa98eb3bfd38..7c240e65447243 100644 --- a/eng/common/templates/jobs/source-build.yml +++ b/eng/common/templates/jobs/source-build.yml @@ -14,7 +14,7 @@ parameters: # This is the default platform provided by Arcade, intended for use by a managed-only repo. defaultManagedPlatform: name: 'Managed' - container: 'mcr.microsoft.com/dotnet-buildtools/prereqs:centos-7-3e800f1-20190501005343' + container: 'mcr.microsoft.com/dotnet-buildtools/prereqs:centos-7' # Defines the platforms on which to run build jobs. One job is created for each platform, and the # object in this array is sent to the job template as 'platform'. If no platforms are specified, diff --git a/global.json b/global.json index 4ff0a383a07ed1..ec967648df7acb 100644 --- a/global.json +++ b/global.json @@ -1,21 +1,21 @@ { "sdk": { - "version": "6.0.128", + "version": "6.0.130", "allowPrerelease": true, "rollForward": "major" }, "tools": { - "dotnet": "6.0.128" + "dotnet": "6.0.130" }, "native-tools": { "cmake": "3.16.4", "python3": "3.7.1" }, "msbuild-sdks": { - "Microsoft.DotNet.Build.Tasks.TargetFramework.Sdk": "6.0.0-beta.24204.4", - "Microsoft.DotNet.Arcade.Sdk": "6.0.0-beta.24204.4", - "Microsoft.DotNet.Helix.Sdk": "6.0.0-beta.24204.4", - "Microsoft.DotNet.SharedFramework.Sdk": "6.0.0-beta.24204.4", + "Microsoft.DotNet.Build.Tasks.TargetFramework.Sdk": "6.0.0-beta.24266.4", + "Microsoft.DotNet.Arcade.Sdk": "6.0.0-beta.24266.4", + "Microsoft.DotNet.Helix.Sdk": "6.0.0-beta.24266.4", + "Microsoft.DotNet.SharedFramework.Sdk": "6.0.0-beta.24266.4", "Microsoft.Build.NoTargets": "3.1.0", "Microsoft.Build.Traversal": "3.0.23", "Microsoft.NET.Sdk.IL": "6.0.0-rc.1.21415.6" diff --git a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_x509.c b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_x509.c index 0b6d1f889bc691..8d2b87d466f13f 100644 --- a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_x509.c +++ b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_x509.c @@ -106,7 +106,6 @@ PAL_X509ContentType AppleCryptoNative_X509GetContentType(uint8_t* pbData, int32_ // The sniffing order is: // * X509 DER // * PKCS7 PEM/DER - // * PKCS12 DER (or PEM if Apple has non-standard support for that) // * X509 PEM or PEM aggregate (or DER, but that already matched) // // If the X509 PEM check is done first SecItemImport will erroneously match @@ -114,6 +113,11 @@ PAL_X509ContentType AppleCryptoNative_X509GetContentType(uint8_t* pbData, int32_ // // Likewise, if the X509 DER check isn't done first, Apple will report it as // being a PKCS#7. + // + // This does not attempt to open a PFX / PKCS12 as Apple does not provide + // a suitable API to determine if it is PKCS12 without doing potentially + // unbound MAC / KDF work. Instead, let that return Unknown and let the managed + // decoding do the check. SecCertificateRef certref = SecCertificateCreateWithData(NULL, cfData); if (certref != NULL) @@ -140,41 +144,6 @@ PAL_X509ContentType AppleCryptoNative_X509GetContentType(uint8_t* pbData, int32_ } } - dataFormat = kSecFormatPKCS12; - actualFormat = dataFormat; - itemType = kSecItemTypeAggregate; - actualType = itemType; - - osStatus = SecItemImport(cfData, NULL, &actualFormat, &actualType, 0, NULL, NULL, NULL); - - if (osStatus == errSecPassphraseRequired) - { - dataFormat = kSecFormatPKCS12; - actualFormat = dataFormat; - itemType = kSecItemTypeAggregate; - actualType = itemType; - - SecItemImportExportKeyParameters importParams; - memset(&importParams, 0, sizeof(SecItemImportExportKeyParameters)); - - importParams.version = SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION; - importParams.passphrase = CFSTR(""); - - osStatus = SecItemImport(cfData, NULL, &actualFormat, &actualType, 0, &importParams, NULL, NULL); - - CFRelease(importParams.passphrase); - importParams.passphrase = NULL; - } - - if (osStatus == noErr || osStatus == errSecPkcs12VerifyFailure) - { - if (actualType == itemType && actualFormat == dataFormat) - { - CFRelease(cfData); - return PAL_Pkcs12; - } - } - dataFormat = kSecFormatX509Cert; actualFormat = dataFormat; itemType = kSecItemTypeCertificate; diff --git a/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.OSX/X509Pal.cs b/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.OSX/X509Pal.cs index 2b654b2b3b9c2f..7c17e4d7963077 100644 --- a/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.OSX/X509Pal.cs +++ b/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.OSX/X509Pal.cs @@ -123,7 +123,7 @@ public X509ContentType GetCertContentType(ReadOnlySpan rawData) X509ContentType contentType = Interop.AppleCrypto.X509GetContentType(rawData); - // Apple doesn't seem to recognize PFX files with no MAC, so try a quick maybe-it's-a-PFX test + // Apple's native check can't check for PKCS12, so do a quick decode test to see if it is PKCS12 / PFX. if (contentType == X509ContentType.Unknown) { try @@ -132,9 +132,11 @@ public X509ContentType GetCertContentType(ReadOnlySpan rawData) { fixed (byte* pin = rawData) { + AsnValueReader reader = new AsnValueReader(rawData, AsnEncodingRules.BER); + using (var manager = new PointerMemoryManager(pin, rawData.Length)) { - PfxAsn.Decode(manager.Memory, AsnEncodingRules.BER); + PfxAsn.Decode(ref reader, manager.Memory, out _); } contentType = X509ContentType.Pkcs12; diff --git a/src/libraries/System.Security.Cryptography.X509Certificates/tests/PfxIterationCountTests.X509Certificate2.cs b/src/libraries/System.Security.Cryptography.X509Certificates/tests/PfxIterationCountTests.X509Certificate2.cs index 6e4697f406548d..4aa403e6666b51 100644 --- a/src/libraries/System.Security.Cryptography.X509Certificates/tests/PfxIterationCountTests.X509Certificate2.cs +++ b/src/libraries/System.Security.Cryptography.X509Certificates/tests/PfxIterationCountTests.X509Certificate2.cs @@ -1,8 +1,13 @@ // Licensed to the .NET Foundation under one or more agreements. // The .NET Foundation licenses this file to you under the MIT license. +using Microsoft.DotNet.RemoteExecutor; +using Microsoft.DotNet.XUnitExtensions; +using Xunit; + namespace System.Security.Cryptography.X509Certificates.Tests { + [SkipOnPlatform(TestPlatforms.Browser, "Browser doesn't support X.509 certificates")] public class PfxIterationCountTests_X509Certificate2 : PfxIterationCountTests { internal override X509Certificate Import(byte[] blob) @@ -22,5 +27,29 @@ internal override X509Certificate Import(string fileName, string password) internal override X509Certificate Import(string fileName, SecureString password) => new X509Certificate2(fileName, password); + + + [ConditionalFact(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))] + public static void Import_IterationCountLimitExceeded_ThrowsInAllottedTime() + { + const int AllottedTime = 5000; + + if (!PfxTests.Pkcs12PBES2Supported) + { + throw new SkipTestException("Pkcs12NoPassword100MRounds uses PBES2, which is not supported on this version."); + } + + RemoteInvokeOptions options = new() + { + TimeOut = AllottedTime + }; + + RemoteExecutor.Invoke(static () => + { + byte[] blob = TestData.Pkcs12NoPassword100MRounds; + CryptographicException ce = Assert.Throws(() => new X509Certificate2(blob)); + Assert.Contains("2233907", ce.Message); + }, options).Dispose(); + } } } diff --git a/src/libraries/System.Security.Cryptography.X509Certificates/tests/TestData.cs b/src/libraries/System.Security.Cryptography.X509Certificates/tests/TestData.cs index f20741f99737c0..93f2b74d05a960 100644 --- a/src/libraries/System.Security.Cryptography.X509Certificates/tests/TestData.cs +++ b/src/libraries/System.Security.Cryptography.X509Certificates/tests/TestData.cs @@ -3339,6 +3339,26 @@ internal static DSAParameters GetDSA1024Params() "04020105000420AD0EB570ACFB8357A8E99B17672353CFBA69C76FFE5B6BC113" + "05577F12AE24040408D04E60444B79672302030927C1"; + internal static readonly byte[] Pkcs12NoPassword100MRounds = Convert.FromBase64String( + "MIIDygIBAzCCA4QGCSqGSIb3DQEHAaCCA3UEggNxMIIDbTCCA2kGCSqGSIb3DQEHBqCCA1owggNW" + + "AgEAMIIDTwYJKoZIhvcNAQcBMF4GCSqGSIb3DQEFDTBRMDAGCSqGSIb3DQEFDDAjBBCNparJkj/3" + + "Uk8N7n0KCMeQAgEBMAwGCCqGSIb3DQILBQAwHQYJYIZIAWUDBAEqBBAcqpBrSDFcXYAWVWKcsEi9" + + "gIIC4P/ANdPYWI1vBH1U5sZGMIwLjY96pYaBelyZd0ZfKA8QfGHVNP9+E9hplBKGvRfIMiqmFutj" + + "RO4v7Ls8HZEk0hwBt9+6zXPWDJLxBDfSMHUd08+ZAH1yzEqq8aBMyIRVHOQkJFuFuCQJ9Ke5HzVi" + + "39S1rgHpnKYFvy+xZAhgI9OO1YxuFt4P9nhlEV/JCoyEQ/2iY99kKc3z7ArrV7BBFhfYGKhWQCBu" + + "kAmNBKweRldNWgDuW21WJEl5sByOmyDwpiK55Zxy1K1aIY8DYJTtIzzcX4CILaj6tClMH1G9w4jW" + + "BkQI2CG4vCsMl/28BbIP9EyH2C+gBAxvc1N32y3NSvO0/GPVenmQFF9KBMc4FVy4Z21syMKzUkBi" + + "PtIbDkcQbGAfyPgFk4SXCgn8OpIIvOOGI50/r+Hj14qex9VIrlwAAWCH8Y+YjwqFAQJYHQpb47zp" + + "B1fTwJFOrsXrBgLUzJLZKLR43yW2E9u6b8RsTuFHjh985naCHLuWPYOXS1zduBpHKpwoPUyCwD2r" + + "DAokCvA7RCsSXroUkpJarN4CAqsEB8COnzV1Dl2xcAYMerJxrTCKX6WIQUYo0/qeCoqTT38lDAlE" + + "7Ydjyx12iVM6eWejAdjORvlVtCQQtCxz8fZpdFGbMP8rf35A8hu++e4u0CLHnhTx38zPIm6H6YfN" + + "qj5h1Kz0xLzqnRfa7EGfDEERSHOy/DqNY4nUNG2DTjGOHy1QJelToG7Vo2L7CCZV+leX0nwLNExf" + + "hKEp+uQCiYSJe9iDm9fS9VymED79OJbr2bxdq3MggEGksLZv/H0ZT8Wsue0vq9jQ6J6YIEM+DKYr" + + "Zt2l4WgTBEKbpqmRvOqYRh9O8Sp+3IRNPzMC2ehzlYXqoPbtG4vxpoRsAMCM/W2x61jbsBSaNSFA" + + "eaUwcnKswRg30UonHUAIOJkqtadI57WE/Rat5eHVyya9f7ZN8bTFZjx0BQs6Bo8PK9yfqoidSN8w" + + "PTAfMAcGBSsOAwIaBBTt8zpgzygINykjoAwr2GKEywYFwgQUA+L1vfCVASwiE++gTfRgIScMGycC" + + "BAX14QA="); + internal const string Pkcs12OpenSslOneCertDefaultEmptyPassword = "308209CF0201033082098506092A864886F70D010701A0820976048209723082" + "096E308203E206092A864886F70D010706A08203D3308203CF020100308203C8" +