Commit 31c859d
authored
Always use system TLS defaults (#706)
* Always use system TLS defaults
* Add extra tests to confirm SChannel cache is clean
* Fix test to run on Windows
* MemoryFixture workaround
* Generate unique certificates per test to fix SChannel session-cache collisions on net48
With SslProtocols.None on .NET Framework 4.8, Windows SChannel uses a per-process
TLS session cache keyed on certificate + hostname. Reusing the same static certs
(Octopus, TentacleListening, TentaclePolling) across tests in the same process causes
SChannel to incorrectly reuse session entries when connecting to localhost, producing
AuthenticationExceptions that cause ~202 test failures on net48.
Fix by generating fresh unique certificates per test in:
- LatestClientAndLatestServiceBuilder (Listening/Polling/PollingOverWebSocket factories)
- SecureClientFixture (SetUp + SecureClientClearsPoolWhenAllConnectionsCorrupt)
- ClientServerLifecycleTests (ListeningConfiguration/PollingConfiguration/ListeningThenPollingConfiguration)
Tests that explicitly call WithCertificates(...) are unaffected.
* Extend unique-cert-per-test fix to backwards compat builders and bad-cert tests
Add ServiceThumbprint property to ClientAndService so bad-certificate tests
can reference the service's actual cert thumbprint rather than the client's
configured trusted thumbprint (which differs in WithClientTrustingTheWrongCertificate
tests). Also fixes DiscoveryClientFixture and backwards compatibility builders.
* Scope per-test unique certificates to net48
The unique-cert-per-test fix (added to work around SChannel session-cache
collisions under SslProtocols.None on net48) was applied to all target
frameworks. On net80 this defeats SChannel TLS session resumption, so every
handshake becomes a slow full handshake. With a short receive timeout that
bleeds into the handshake (ssl.ReadTimeout), this made
ReceiveResponseTimeoutTests.WhenRpcExecutionIsWithinReceiveResponseTimeout_ButSubsequentDataIsDelayed
fail consistently on net80 Windows.
Move all of the conditional logic into a single TestCertificates helper that
generates fresh certs per test only on net48, and otherwise returns the shared
static certs (Octopus/TentacleListening/TentaclePolling) used on main. This
restores fast resumed handshakes on net80/Linux while keeping the net48
collision fix intact.
* Extend unique-cert-per-test fix to client-only builder
The client-only path (LatestClientBuilder.ForServiceConnectionType, used by
CreateClientOnlyTestCaseBuilder) still used the shared static Octopus cert on
net48. Under SslProtocols.None this intermittently triggers the same SChannel
session-cache collision as before, surfacing as an AuthenticationException
('a call to SSPI failed ... they do not possess a common algorithm'). That is
classified as UnknownError rather than IsNetworkError, causing
ExceptionReturnedByHalibutProxyExtensionMethodFixture.BecauseTheListeningTentacleIsNotResponding
to flake on net48 Windows.
Generate a fresh per-test client certificate on net48 (Polling/Listening) and
dispose its TmpDirectory with the client. PollingOverWebSocket keeps the Ssl
cert (bound via netsh). No-op on net80/Linux.
* Trust each polling client's own certificate
WhenPollingMultipleClientsWithOneService builds two client-only polling
clients plus one service that polls both. The service builder trusted a
single static thumbprint and dialled every listening client expecting it,
which only worked while all client-only builders shared the static Octopus
cert. Generating a unique client cert per test on net48 broke that contract,
failing RequestsShouldBeTakenFromAnyClient on every net48 build.
Carry each client's own certificate thumbprint from the client-only builder
through to the service builder so the polling service dials each listening
client with that client's thumbprint:
- expose LatestClient.ClientThumbprint (via IClient)
- WithListeningClient/WithListeningClients now take (uri, thumbprint)
Identical behaviour on net80/Linux (every client resolves to the shared
Octopus thumbprint); on net48 the service trusts each unique client cert.
* Make listening-client trust thumbprint optional
The previous change had the combined builder dial each listening client
with that client's actual certificate thumbprint. That overrode the
service's configured serviceTrustsThumbprint, which the wrong-certificate
test helpers deliberately set to a non-matching value. As a result the
polling service accepted connections it should have rejected, breaking the
bad-certificate negative tests on every platform:
- BadCertificatesTests.FailWhenClientPresentsWrongCertificateToPollingService
- ConnectionObserverFixture.ObserveUnauthorizedPollingWebSocketConnections
Make the per-client thumbprint optional. The combined builder passes none, so
the polling loop falls back to serviceTrustsThumbprint (its previous, known-
good behaviour). Only the standalone multi-client test, which has two clients
with distinct certs and no wrong-certificate setup, passes explicit per-client
thumbprints via WithListeningClients.
* Extract ICertAndThumbprint, remove SchannelProbe binary
CertAndThumbprint now implements ICertAndThumbprint, allowing builders
to hold either static certs or disposable per-test certs behind a
common interface. All builders replace their TmpDirectory? nullable
field with a DisposableCollection, making lifetime management uniform
regardless of whether per-test certs are generated.
CertificateGenerator is removed in favour of
TempDisposableCertAndThumbprint.CreateSelfSigned, which manages its
own temp directory and registers with the caller's DisposableCollection.
The SchannelProbe compat binary and SchannelSessionCacheFixture are
deleted. They proved that process isolation avoids SChannel session-
cache collisions; with unique per-test certs that problem is solved
in-process and the out-of-process probe is no longer needed.
* Remove redundant comments from certificate setup methods
The rationale for using separate runtimes and distinct certificates is
already documented in detail at the test method level. These helper method
comments were duplicating that explanation, so remove them to reduce clutter.
* Fix net48 build
* empty commit to force build1 parent fe55a78 commit 31c859d
34 files changed
Lines changed: 404 additions & 231 deletions
File tree
- source
- Halibut.Tests.DotMemory
- Halibut.Tests
- Support
- BackwardsCompatibility
- Transport
- Util
- Halibut
- Transport
- Streams
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
59 | 59 | | |
60 | 60 | | |
61 | 61 | | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
62 | 75 | | |
| 76 | + | |
63 | 77 | | |
64 | 78 | | |
65 | 79 | | |
66 | 80 | | |
| 81 | + | |
67 | 82 | | |
68 | 83 | | |
69 | 84 | | |
| |||
75 | 90 | | |
76 | 91 | | |
77 | 92 | | |
78 | | - | |
| 93 | + | |
79 | 94 | | |
80 | 95 | | |
81 | 96 | | |
| 97 | + | |
| 98 | + | |
82 | 99 | | |
83 | 100 | | |
84 | | - | |
| 101 | + | |
85 | 102 | | |
86 | 103 | | |
87 | 104 | | |
| |||
106 | 123 | | |
107 | 124 | | |
108 | 125 | | |
| 126 | + | |
109 | 127 | | |
110 | 128 | | |
111 | 129 | | |
| |||
142 | 160 | | |
143 | 161 | | |
144 | 162 | | |
145 | | - | |
146 | 163 | | |
147 | 164 | | |
148 | 165 | | |
149 | | - | |
150 | | - | |
151 | | - | |
152 | 166 | | |
153 | 167 | | |
154 | 168 | | |
| 169 | + | |
| 170 | + | |
| 171 | + | |
| 172 | + | |
| 173 | + | |
| 174 | + | |
| 175 | + | |
| 176 | + | |
| 177 | + | |
| 178 | + | |
| 179 | + | |
| 180 | + | |
155 | 181 | | |
156 | 182 | | |
157 | 183 | | |
| |||
169 | 195 | | |
170 | 196 | | |
171 | 197 | | |
172 | | - | |
| 198 | + | |
| 199 | + | |
| 200 | + | |
173 | 201 | | |
174 | 202 | | |
| 203 | + | |
| 204 | + | |
175 | 205 | | |
176 | 206 | | |
177 | 207 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
30 | 30 | | |
31 | 31 | | |
32 | 32 | | |
| 33 | + | |
33 | 34 | | |
34 | 35 | | |
35 | 36 | | |
| |||
43 | 44 | | |
44 | 45 | | |
45 | 46 | | |
46 | | - | |
| 47 | + | |
47 | 48 | | |
48 | 49 | | |
49 | 50 | | |
| |||
53 | 54 | | |
54 | 55 | | |
55 | 56 | | |
| 57 | + | |
| 58 | + | |
56 | 59 | | |
57 | 60 | | |
58 | 61 | | |
| |||
62 | 65 | | |
63 | 66 | | |
64 | 67 | | |
65 | | - | |
66 | | - | |
| 68 | + | |
| 69 | + | |
67 | 70 | | |
68 | 71 | | |
69 | 72 | | |
| |||
93 | 96 | | |
94 | 97 | | |
95 | 98 | | |
| 99 | + | |
| 100 | + | |
96 | 101 | | |
97 | 102 | | |
98 | 103 | | |
| |||
105 | 110 | | |
106 | 111 | | |
107 | 112 | | |
108 | | - | |
| 113 | + | |
109 | 114 | | |
110 | 115 | | |
111 | 116 | | |
| |||
124 | 129 | | |
125 | 130 | | |
126 | 131 | | |
127 | | - | |
| 132 | + | |
128 | 133 | | |
129 | 134 | | |
130 | 135 | | |
| |||
195 | 200 | | |
196 | 201 | | |
197 | 202 | | |
198 | | - | |
199 | | - | |
| 203 | + | |
| 204 | + | |
200 | 205 | | |
201 | 206 | | |
202 | 207 | | |
| |||
254 | 259 | | |
255 | 260 | | |
256 | 261 | | |
| 262 | + | |
| 263 | + | |
257 | 264 | | |
258 | 265 | | |
259 | 266 | | |
260 | 267 | | |
261 | | - | |
| 268 | + | |
262 | 269 | | |
263 | 270 | | |
264 | 271 | | |
| |||
275 | 282 | | |
276 | 283 | | |
277 | 284 | | |
| 285 | + | |
| 286 | + | |
278 | 287 | | |
279 | 288 | | |
280 | 289 | | |
| |||
285 | 294 | | |
286 | 295 | | |
287 | 296 | | |
288 | | - | |
| 297 | + | |
289 | 298 | | |
290 | 299 | | |
291 | 300 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
28 | 48 | | |
29 | 49 | | |
30 | 50 | | |
31 | 51 | | |
32 | 52 | | |
33 | 53 | | |
34 | | - | |
| 54 | + | |
35 | 55 | | |
36 | 56 | | |
37 | 57 | | |
| |||
56 | 76 | | |
57 | 77 | | |
58 | 78 | | |
59 | | - | |
| 79 | + | |
60 | 80 | | |
61 | 81 | | |
62 | 82 | | |
| |||
65 | 85 | | |
66 | 86 | | |
67 | 87 | | |
68 | | - | |
| 88 | + | |
69 | 89 | | |
70 | 90 | | |
71 | 91 | | |
72 | | - | |
| 92 | + | |
73 | 93 | | |
74 | 94 | | |
75 | 95 | | |
76 | | - | |
| 96 | + | |
77 | 97 | | |
78 | 98 | | |
79 | 99 | | |
| |||
83 | 103 | | |
84 | 104 | | |
85 | 105 | | |
86 | | - | |
| 106 | + | |
87 | 107 | | |
88 | 108 | | |
89 | 109 | | |
90 | 110 | | |
91 | 111 | | |
92 | 112 | | |
93 | 113 | | |
94 | | - | |
| 114 | + | |
95 | 115 | | |
96 | 116 | | |
97 | 117 | | |
98 | | - | |
| 118 | + | |
99 | 119 | | |
100 | 120 | | |
101 | 121 | | |
| |||
115 | 135 | | |
116 | 136 | | |
117 | 137 | | |
118 | | - | |
| 138 | + | |
119 | 139 | | |
120 | 140 | | |
121 | 141 | | |
122 | 142 | | |
123 | | - | |
124 | | - | |
| 143 | + | |
| 144 | + | |
125 | 145 | | |
126 | 146 | | |
127 | 147 | | |
| |||
Lines changed: 13 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
12 | 23 | | |
13 | 24 | | |
14 | | - | |
15 | 25 | | |
16 | 26 | | |
17 | 27 | | |
18 | 28 | | |
19 | 29 | | |
20 | | - | |
| 30 | + | |
21 | 31 | | |
22 | 32 | | |
23 | 33 | | |
24 | 34 | | |
25 | 35 | | |
26 | 36 | | |
27 | 37 | | |
28 | | - | |
| 38 | + | |
29 | 39 | | |
30 | 40 | | |
31 | 41 | | |
| |||
0 commit comments