diff --git a/sha1-validation/Program.cs b/sha1-validation/Program.cs new file mode 100644 index 0000000..88feb65 --- /dev/null +++ b/sha1-validation/Program.cs @@ -0,0 +1,47 @@ +using System.Net.Security; +using System.Security.Cryptography.X509Certificates; + +bool sha1RsaSignatureOnLastElementInChain = false; + +HttpClientHandler handler = new HttpClientHandler { + CheckCertificateRevocationList = true, + ServerCertificateCustomValidationCallback = ServerCertificateCustomValidation, +}; + +using HttpClient client = new HttpClient(handler); + +try +{ + HttpResponseMessage response = await client.GetAsync("https://redhat.com"); + + string responseBody = await response.Content.ReadAsStringAsync(); + Console.WriteLine($"{sha1RsaSignatureOnLastElementInChain}"); + Console.WriteLine("PASS"); + return 0; +} +catch (Exception e) +{ + Console.WriteLine("\nException Caught!"); + Console.WriteLine(e); +} + +Console.WriteLine("FAIL"); +return 1; + +bool ServerCertificateCustomValidation(HttpRequestMessage requestMessage, X509Certificate2? certificate, X509Chain? chain, SslPolicyErrors sslErrors) +{ + foreach (var element in chain!.ChainElements) + { + var cert = element.Certificate; + Console.WriteLine($"{cert.SubjectName.Name} {cert.SignatureAlgorithm.FriendlyName}"); + } + if ( chain.ChainElements.Last().Certificate.SignatureAlgorithm.FriendlyName != "sha1RSA" ) + { + sha1RsaSignatureOnLastElementInChain = true; + Console.WriteLine("The certificate chain that is validated is no longer using an RSA1 signature."); + Console.WriteLine("The test must be updated to use a different host."); + } + + Console.WriteLine($"Errors: {sslErrors}"); + return sslErrors == SslPolicyErrors.None; +} \ No newline at end of file diff --git a/sha1-validation/test.json b/sha1-validation/test.json new file mode 100644 index 0000000..b9718d9 --- /dev/null +++ b/sha1-validation/test.json @@ -0,0 +1,15 @@ +{ + "name": "sha1-validation", + "enabled": true, + "requiresSdk": true, + "version": "6.0", + "versionSpecific": false, + "type": "bash", + "cleanup": true, + "skipWhen": [ + "os=rhel.9,version=7", // Test fails on RHEL9 with .NET 7: https://issues.redhat.com/browse/RHEL-25254 + "os=centos.9,version=7", // Test fails on RHEL9 with .NET 7: https://issues.redhat.com/browse/RHEL-25254 + ], + "ignoredRIDs":[ + ] +} diff --git a/sha1-validation/test.sh b/sha1-validation/test.sh new file mode 100755 index 0000000..8167283 --- /dev/null +++ b/sha1-validation/test.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env bash + +set -euo pipefail +IFS=$'\n\t' + +dotnet run \ No newline at end of file diff --git a/sha1-validation/tests.csproj b/sha1-validation/tests.csproj new file mode 100644 index 0000000..6613dbd --- /dev/null +++ b/sha1-validation/tests.csproj @@ -0,0 +1,10 @@ + + + + Exe + $(TestTargetFramework) + enable + enable + + +