Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve SSL platform detection #64923

Merged
merged 8 commits into from
Feb 8, 2022
Merged

Improve SSL platform detection #64923

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4ff8086
CI matrix change: add Windows Server 2022
Oct 8, 2021
21434c2
Add registry check for ssl3 - tls1.2 tests
Oct 18, 2021
5f92ecf
Disable TLS1.3 on framework code
Oct 21, 2021
f3e9e2b
Merge remote-tracking branch 'upstream/main' into jajahoda/cimatrix2022
Nov 24, 2021
af9bbce
Fix typo
Nov 25, 2021
3baf462
Merge branch 'main' into jajahoda/cimatrix2022
Nov 29, 2021
ce672da
revert queue change
wfurt Feb 7, 2022
04871d9
Merge branch 'main' of https://github.com/dotnet/runtime into HEAD
wfurt Feb 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
97 changes: 60 additions & 37 deletions src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,34 +342,59 @@ private static bool GetIsInContainer()
return (IsLinux && File.Exists("/.dockerenv"));
}

private static bool GetSsl3Support()
private static bool GetProtocolSupportFromWindowsRegistry(SslProtocols protocol, bool defaultProtocolSupport)
{
if (IsWindows)
string registryProtocolName = protocol switch
{
string clientKey = @"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client";
string serverKey = @"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server";
#pragma warning disable CS0618 // Ssl2 and Ssl3 are obsolete
SslProtocols.Ssl3 => "SSL 3.0",
#pragma warning restore CS0618
SslProtocols.Tls => "TLS 1.0",
SslProtocols.Tls11 => "TLS 1.1",
SslProtocols.Tls12 => "TLS 1.2",
#if !NETFRAMEWORK
SslProtocols.Tls13 => "TLS 1.3",
#endif
_ => throw new Exception($"Registry key not defined for {protocol}.")
};

object client, server;
try
{
client = Registry.GetValue(clientKey, "Enabled", null);
server = Registry.GetValue(serverKey, "Enabled", null);
}
catch (SecurityException)
{
// Insufficient permission, assume that we don't have SSL3 (since we aren't exactly sure)
return false;
}
string clientKey = @$"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\{registryProtocolName}\Client";
string serverKey = @$"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\{registryProtocolName}\Server";

object client, server;
try
{
client = Registry.GetValue(clientKey, "Enabled", defaultProtocolSupport ? 1 : 0);
server = Registry.GetValue(serverKey, "Enabled", defaultProtocolSupport ? 1 : 0);
if (client is int c && server is int s)
{
return c == 1 && s == 1;
}
}
catch (SecurityException)
{
// Insufficient permission, assume that we don't have protocol support (since we aren't exactly sure)
return false;
}
catch { }

return defaultProtocolSupport;
}

private static bool GetSsl3Support()
{
if (IsWindows)
{

// Missing key. If we're pre-20H1 then assume SSL3 is enabled.
// Otherwise, disabled. (See comments on https://github.com/dotnet/runtime/issues/1166)
// Alternatively the returned values must have been some other types.
return !IsWindows10Version2004OrGreater;
bool ssl3DefaultSupport = !IsWindows10Version2004OrGreater;

#pragma warning disable CS0618 // Ssl2 and Ssl3 are obsolete
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Ssl3, ssl3DefaultSupport);
#pragma warning restore CS0618

}

return (IsOSX || (IsLinux && OpenSslVersion < new Version(1, 0, 2) && !IsDebian));
Expand All @@ -393,21 +418,26 @@ private static bool AndroidGetSslProtocolSupport(SslProtocols protocol)
private static bool GetTls10Support()
{
// on Windows, macOS, and Android TLS1.0/1.1 are supported.
if (IsWindows || IsOSXLike || IsAndroid)
if (IsOSXLike || IsAndroid)
{
return true;
}
if (IsWindows)
{
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls, true);
}

return OpenSslGetTlsSupport(SslProtocols.Tls);
}

private static bool GetTls11Support()
{
// on Windows, macOS, and Android TLS1.0/1.1 are supported.
// TLS 1.1 and 1.2 can work on Windows7 but it is not enabled by default.
// on Windows, macOS, and Android TLS1.0/1.1 are supported.
if (IsWindows)
{
return !IsWindows7;
// TLS 1.1 and 1.2 can work on Windows7 but it is not enabled by default.
bool defaultProtocolSupport = !IsWindows7;
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls11, defaultProtocolSupport);
}
else if (IsOSXLike || IsAndroid)
{
Expand All @@ -420,7 +450,8 @@ private static bool GetTls11Support()
private static bool GetTls12Support()
{
// TLS 1.1 and 1.2 can work on Windows7 but it is not enabled by default.
return !IsWindows7;
bool defaultProtocolSupport = !IsWindows7;
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls12, defaultProtocolSupport);
}

private static bool GetTls13Support()
Expand All @@ -431,25 +462,17 @@ private static bool GetTls13Support()
{
return false;
}

string clientKey = @"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client";
string serverKey = @"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server";

object client, server;
try
{
client = Registry.GetValue(clientKey, "Enabled", null);
server = Registry.GetValue(serverKey, "Enabled", null);
if (client is int c && server is int s)
{
return c == 1 && s == 1;
}
}
catch { }
// assume no if positive entry is missing on older Windows
// Latest insider builds have TLS 1.3 enabled by default.
// The build number is approximation.
return IsWindows10Version2004Build19573OrGreater;
bool defaultProtocolSupport = IsWindows10Version2004Build19573OrGreater;

#if NETFRAMEWORK
return false;
#else
return GetProtocolSupportFromWindowsRegistry(SslProtocols.Tls13, defaultProtocolSupport);
#endif

}
else if (IsOSX || IsMacCatalyst || IsiOS || IstvOS)
{
Expand Down